Changes of Mind

This page intentionally left blank

CHANGES OF MIND
An Essay on Rational Belief Revision
n e i l t e n na n t

Great Clarendon Street, Oxford, ox dp,

United Kingdom
Oxford University Press is a department of the University of Oxford.
It furthers the Universitys objective of excellence in research, scholarship,
and education by publishing worldwide. Oxford is a registered trade mark of
Oxford University Press in the UK and in certain other countries
Neil Tennant
The moral rights of the author have been asserted
First Edition published
Impression:
All rights reserved. No part of this publication may be reproduced, stored in
a retrieval system, or transmitted, in any form or by any means, without the
prior permission in writing of Oxford University Press, or as expressly permitted
by law, by licence or under terms agreed with the appropriate reprographics
rights organization. Enquiries concerning reproduction outside the scope of the
above should be sent to the Rights Department, Oxford University Press, at the
address above
You must not circulate this work in any other form
and you must impose this same condition on any acquirer
British Library Cataloguing in Publication Data
Data available
Library of Congress Cataloging in Publication Data
Library of Congress Control Number:
ISBN
Printed and bound by
CPI Group (UK) Ltd, Croydon, CR YY

For Janel, who has changed my mind about so many things.

And for Henry and Hugo, who are changing everything.
Columbus, March 2012

This page intentionally left blank

PREFACE

This book sets off right away with the authors preferred account. Only thereafter
does it turn to the task of providing critiques of, or comparisons with, some of
the main opposing schools. This decision is occasioned by the wish not to fall
victim to what may be called the Chapter Syndrome. This syndrome is that the
majority of readers, for whatever reasons (skepticism? boredom? interruptions
beyond their control?) seldom progress past Chapter of any book they pick
up. One is tempted by the thought that this is why it is Chapter of Quines
celebrated Word and Object that gets all the attention. Whatever the reason for
the syndrome, this author is anxious to avoid it.
The positive account is therefore given in Part I. It is also given in what might
be called its natural logical order. The reader is introduced to the intuitive
motivations for, and the most natural and economical methods to apply in, the
process of rational belief revision.
The stress here on rational signals that it is a theory of competence that is
being proposed, not a descriptive theory of how ordinary thinkers do actually
go about changing their beliefs. The author is a logician, not a cognitive psychologist. Teaching introductory courses in logic has convinced him, sadly, that
even very intelligent people more often than not reason fallaciously. So the laws
of logic (or: rational deduction) do not describe how they actually reason. The
same people also have a hard time abandoning their cherished beliefs in the light
of recalcitrant evidence. So, whatever laws of rational belief revision one may
wish to propose, they are hardly likely to describe how even very intelligent
let alone, ordinarypeople actually adjust their beliefs in light of the evidence
available to them. What is on offer here, by contrast, is a rational account of how
one ought to go about changing ones beliefs. And at a more philosophically

P R E FAC E

vii

reflective level, this account challenges opposing theorists of belief change to

change their beliefs about how beliefs ought to be changed.
The authors interest in theory change, or belief revision, was first kindled
by a series of presentations by Peter Grdenfors when he visited the Australian
National University in , and tested drafts of portions of his book Knowledge in Flux, which was published the following year. The book provided the
canonical presentation of the formal theory of belief revision now known by
the acronym AGM-theory, after its cofounders Carlos Alchourrn, Grdenfors
and David Makinson. The present author was skeptical back then about AGMs
so-called Recovery Postulate, and remains so to this day. At that stage, however,
he was engrossed in problems of automated deduction within a theory,1 and had
given little thought to the automation of theory change itself.
The first opportunity to reflect more systematically on theory change was
afforded by an Overseas Fellowship at Churchill College, Cambridge in the academic year . That period of study led to the publication of Changing the
Theory of Theory-Change: Towards a Computational Approach, British Journal
for Philosophy of Science, . It gave a critique of AGM-theory as set out in
Grdenforss book, and sketched a computational alternative. The alternative
sought to be more sensitive both to what was called the finitary predicament,
and to the fact that a rational system of belief is something more than just a
logically closed set of sentences. It essentially involves, in addition, the agents
structure of reasons for holding the beliefs she does.2
The BJPS paper occasioned some sharp reactions from AGM-theorists, to
which the author duly replied. AGM-ers themselves seem not yet to have
acknowledged the full extent of the anomalies now confronting their account.
The debate has not been properly resolvedat least, not to the satisfaction of
the interested but disinterested bystander. This is largely for want of a more
systematic treatise setting out the authors opposing account more fully. More
needed to be done to bring home the force of the computational motivations
and considerations that were being commended. AGM-theory, after all, itself
held out an explicit promise of computational application. But this promise has
remained unfulfilled.
Perhaps more seriously, AGM-theory in its main current form suffers from
a kind of trivialization, or collapse, not unlike that revealed by Alonzo Church
as affecting Alfred Ayers attempted definition of an indirectly verifiable state

viii

See Tennant [].

This has since been emphasized independently by Pollock and Gillies [].

P R E FAC E

ment.3 Tennant [b] set out the case for AGM-theorys collapse. Section .. of the present work provides a condensed account of the main results
of that paper. It is worth pointing out here that the word Degeneracy in its
titleA Degeneracy Theorem for the Full AGM-Theory of Theory-Revision
was being used in its familiar mathematical sense (and was even suggested to
the author by a mathematician colleague). That special sense involves trivial
or extremal casestypically ones that one wishes to avoid, in order to have
a good theory dealing with the non-trivial, non-extremal cases. The reader
could, however, justifiably associate with degeneracy the Lakatosian notion of
a degenerating research program. Rohit Parikh has called the result in question
a triviality result (for AGM-theory).4
This much having been said already about AGM-theory, it is worth saying
a little more in order to forestall any mistaken impression, on the part of the
reader, that the present work is perforce a commentary on, or sustained critique of, AGM-theory itself. It is not. The theory of rational belief revision on
offer here is developed within a completely different formal framework from
AGM-theory, and strikes out in a completely different direction from AGMtheory. This new way pays careful attention to epistemological considerations
(the structure of reasons underlying an agents beliefs). It represents belief systems as finitary, hence as potentially computationally tractable. It then provides
explicit algorithms for contracting and revising belief systems, thereby showing
that they are indeed computationally tractable. (Confining oneself to finitary
objects provides no guarantee that all the relations among them, and operations
on them, that might hold ones interest will be computable ones; but, in the
belief-revision case, they are.)
This work could have been written with no mention at all of AGM-theory.
For the account is self-contained. In deference to scholarly tradition and expectations, however, the author has been careful to make some central points of
connection and contrast between his own account and the main extant accounts
of other theorists in the three most relevant communities: epistemologists,
logicians, and computer scientists. AGM-theory is but one of the alternative
accounts considered in this connection.
Writing at treatise length on this topic has imposed severe interdisciplinary
demands. These include philosophical analysis, mathematical formalization,

See Churchs celebrated review of the second edition of Ayers Language, Truth and Logic, in
The Journal of Symbolic Logic, .
See Parikh [], p. , n. .

P R E FAC E

ix

logical systematization, and applying the main procedures in computing

science: choosing data types; isolating effectively decidable properties and relations; specifying algorithms; analyzing their computational complexity; and
implementing them in a high-level computer language (for which the author
chose Prolog). It has been a challenge to merge the competing stylistic demands
of the different approaches mentioned above, so that the writing, overall, is of
an even texture. Should readers detect any failures in this regard, it is hoped they
will be prepared to forgive the author, with an eye to the nature of the material
itself.
More than once the author has been put in mind of the caution he once heard,
from Quentin Skinner, against falling victim to a different syndrome, the Firth
of Forth Bridge syndrome. That particular bridge is so long that as soon as the
maintenance crews finish painting it, they have to go back to the other end and
begin painting it all over again.
This bridge, it is hoped, will take us over troubled water to a place affording
a clearer view. Here, at last, is the final lick of paint.

P R E FAC E

ACKNOWLEDGMENTS

The various strands of this bookpositive account and negative critiquewere

able to be pulled together into a project of treatise length when the author had
the opportunity to give an advanced research seminar on belief revision in the
Department of Philosophy at The Ohio State University in Autumn Term .
He is grateful to the graduate students who sat through that course and who
gave him the benefit of their criticisms and comments: Eric Carter, Salvatore
Florio, Timothy Fuller, James MacPherson, Cristina Moisa, Ian Smith and John
Washatka.
Other scholars whose comments or support have been very helpful are Anish
Arora, Horacio Arl-Costa, Sam Buss, B. Chandrasekaran, Julian Cole, Thomas
Eiter, Harvey Friedman, Georg Gottlob, Anil Gupta, Susan Haack, Sven Ove
Hansson, Gilbert Harman, Joongol Kim, Peter Klein, Isaac Levi, Viktor Marek,
William Ogden, Daniel Osherson, George Pappas, Judea Pearl, Rohit Parikh,
Diana Raffman, William Roche, Mark Ryan, Kevin Scharp, George Schumm,
Krister Segerberg, Stewart Shapiro, Timothy Smiley, Wolfgang Spohn, Ken
Supowit, Paul Thagard, and Gabriel Uzquiano-Cruz. Both Salvatore Florio and
Kevin Scharp gave many valuable suggestions concerning the ordering and
presentation of the material. Naturally the author is solely responsible for any
errors that remain.
It is an honor to have permission to include original work by Harvey Friedman in Chapter , by way of solution of a deep and interesting problem in the
foundations of mathematics that is relevant to this project. The present author
posed the problem, and Friedman provided the solution.
Thanks are owed to Ohio States College of Humanities for two Special
Research Assignments during Spring Terms, and for a two-term period of Faculty Professional Leave; and to the National Endowment for the Humanities, for
AC K N OW L E D G M E N T S

xi

a Fellowship lasting an academic year. These awards provided full relief from
teaching duties to enable pursuit of research for this book.
The author is grateful to colloquium audiences who have responded to presentations of his ideas on a computational theory of theory change: the Moral
Sciences Club at the University of Cambridge; the Workshop on Philosophy
of Physics at the University of St. Andrews; the Colloquium in History and
Philosophy of Science at the University of Colorado, Boulder; the th Annual
Workshop of the Center for Philosophy of Science in Pittsburgh; the Arch
Colloquium at the University of St. Andrews; the Dresden Workshop on Constructive Negation; the Princeton Philosophy Colloquium; the Central Division Meeting of the American Philosophical Association (where Joongol Kim
was the commentator); and, at Ohio State: the Research Group in Re-usable
Software; the Center for Cognitive Science; and an Interdisciplinary Research
Seminar on the Mechanization of Inference.
Much of the final draft was composed and revised in a little refuge in an
athletic facility at Ohio State, affectionately known by its users as the man cave.
All mens miseries come from one thing, which is not knowing how to sit quietly
in a room.5 It has been a salutary experience to be immersed in an atmosphere
of intense commitment on the part of coaches and elite athletes in Olympic
sports, and to sense the self-discipline, the focus and the dedication to hard
work that pervades the whole establishment.
Last, and most importantly, I want to express my love and gratitude to my
wife Janel Hall and our sons Henry and Hugo. They have put up with various
distractions and disruptions that the writing and proofing of this book have
occasioned.

tout le malheur des hommes vient dune seule chose, qui est de ne savoir pas demeurer en
repos, dans une chambre. Pascal, Penses, .

xii

AC K N OW L E D G M E N T S

CONTENTS

i n t ro d u c t i o n
. Logical statics v. logical dynamics
.. The fiction of the logical saint
.. Epistemic norms and the paragon
.. Classifying changes of mind

.
.
.
.
.
.
.
.

Revolutionary change v. normal, incremental change

More on paragons and saints
Changes in the doxastic status of a proposition
What a theory needs to explain
Computational considerations
Philosophical considerations
Methods
Methodological considerations
.. Simplicity v. comprehensiveness: a case study from deductive logic

.. Applying the lessons learned in the case study from deductive logic

to the problem of belief revision

. Relation to present state of the field

. Chapter-by-chapter foreshadowing summary

I Computational Considerations
c o m p u t i n g c ha n g e s i n b e l i e f

. Nodes and steps

.. Nodes
.. Initial steps
.. Transitional steps
CONTENTS

xiii

. Axioms for a belief network

.. Axioms of Configuration
.. Axioms of Coloration
.. Comments on our coloring convention
.. Examples of violations of the four main Axioms of Coloration

. Spreading white v. spreading black

.. Spreading white: the White Lock constraint
.. Spreading black downwards: the Black Lock constraint

. The roles of the white and black parts of a belief scheme

.. Primitive local transitions in coloration
.. Example
.. Example
.. Example
.. Example
.. Example
.. Example

. Summary and conclusion

. A look ahead

g l o ba l c o n d i t i o n s o n c o n t r ac t i o n
.
.
.
.

Knowledge sets and belief sets versus theories

Bases, developments and theories
Contractions
What do we require of a contraction?

.. Taking the intuitionistic case seriously: the condition for successful

contraction
.. Minimal mutilation

a f o r m a l t h e o ry o f c o n t r ac t i o n
. Introduction
. The computational complexity of various decision problems in
logic
. Relative entrenchment of beliefs
. Some intuitions
. The finitary predicament and the question of well-foundedness
. The logical macro-level v. micro-level

xiv

CONTENTS

. New notions needed for the modeling of belief schemes

.. Nodes
.. Steps formally defined
.. Steps informally explained
.. The agents transitional commitments, and what she believes
.. Dependency networks formally defined
.. Examples of dependency networks
.. More network notions formally defined

. Closure
.. Universal closure of belief schemes

. Contraction formally defined

.. Contraction involves only steps in the agents belief scheme

.. Revision and expansion can involve recourse to steps known

to the agent, but not in the belief scheme

. Considerations of complexity
. Conclusion

s pe c i f i c at i o n o f a c o n t r ac t i o n a l g o ri t h m
.
.
.
.

Greedy algorithms
A brute-force, undiscerning algorithm
Preliminaries
Contraction Algorithm: First Version
.. Example of Version at work
.. An observation about the order of whitening
.. Discussion of Version

. Contraction Algorithm: Second Version

.. Example of Version at work
.. Discussion of Version

. Contraction Algorithm: Third Version

.. Example of Version at work
.. Another example of Version at work

. Making use of entrenchment information

. Contraction Algorithm: Fourth Version
. Future work
.. Further study of the efficiency of contraction algorithms
.. Surrendering steps as well as nodes

CONTENTS

xv

.. The question of neuropsychological reality

.. Weakening the support offered by steps

. Conclusion

a pro l o g pro g r a m f o r c o n t r ac t i o n
. Management of input files of problems
. The top-level part of the program
.. For search without checks for minimal mutilation
.. For search with checks for minimal mutilation
.. The lower-level part of the program

. Pre-processing
. Clauses for the various print commands

re s u lt s o f ru n n i n g o u r pro g r a m
f o r c o n t r ac t i o n
. Some simple contraction problems
. Outputs of our program on the foregoing problems

II Logical and Philosophical Considerations

c o re l o g i c i s t h e i n v i o l a b l e c o re o f l o g i c
. The debate over logical reform
. Core Logic
.. Graphic Rules of Natural Deduction for Core Logic
.. Sequent Rules for Core Logic

. Transitivity of proof in Core Logic

. Considerations in favor of Core Logic
. Reflexive stability
.. Detecting violations of Axiom ()
.. Detecting violations of Axiom ()
.. Detecting violations of Axiom ()
.. Detecting violations of Axiom ()
.. Resolving violations of Axiom ()
.. Resolving violations of Axiom ()
.. Reflecting on our reasoning towards resolutions
.. Resolving violations of Axiom ()
.. Resolving violations of Axiom ()

. The upshot

xvi

CONTENTS

 t h e f i n i ta ry pre d i c a m e n t

. Finitude of the set of known theorems

. Finitude of the set of known proofs
. Thoroughgoing theoretical finitude

m at h e m at i c a l j u s t i f i c at i o n s a re n o t
i n f i n i t e ly va ri o u s
. Definitions of terminology
. Results

III Comparisons
d i f f e re n c e s f ro m o t h e r f o r m a l t h e o ri e s
. Truth-maintenance systems
. AGM-theory
.. Some background
.. A brief summary of the AGM-theory of contraction
.. Implementability
.. The Postulate of Recovery
.. Minimal mutilation
.. The degeneracy of AGM-theory
.. A condensed account of the degeneracy results

. Bayesian Networks

c o n n e c t i o n s w i t h va ri o u s e pi s t e m o l o g i c a l
ac c o u n t s
. Stage setting
. Perennial topics of mainstream epistemology
.. Skepticism
.. Basic beliefs
.. Foundationalism, coherentism and foundherentism

. Works that address the problem of belief revision, and offer

some formal modeling

.. Isaac Levis contractions

. Works that address the problem of belief revision, but do not

offer any formal modeling

.. Quine and Ullians Web of Belief

.. Gilbert Harmans Change in View

CONTENTS

xvii

. Works that do not explicitly address the problem of belief

revision, except perhaps in passing

.. Peter Klein on infinite regress

.. Anil Guptas Empiricism and Experience

References
Index

xviii

CONTENTS

CHAPTER 1

Introduction

his is a book on the dynamics of theory changeor, as it is now commonly called, belief contraction and belief revision. It provides a new
picture of how we ought to change our minds when the need arises. It
begins with that picture, and then examines the main current competitors, in
order to explain the comparative advantages of the new account. The book is
therefore an invitation to those other theorists to engage in an exercise of the
very method that we think about.
Ever since Hume, philosophers have been aware of the need to assign equal
importance to the propositional attitudes of belief and desirethe one arising
from perception, the other leading to action. As John Searle puts it, belief
involves the mind-to-world fit, whereas desire involves the world-to-mind fit.1
And in Donald Davidsons view of the mind, reasons for an agents intentional
actions are belief-desire pairs.2 Hence, contemporary philosophers might well
take changes of mind to encompass changes in desire as well as changes in
belief. The title of this book, however, is a little more restrictive. Changes in
desires the author would call changes of heart; so that changes of mind are
changes of belief. The reader will, one trusts, permit this quaint distinction. The
discussion here will concern only changes in belief. If that leaves out half the

Searle first introduced the contrast in Searle [], at p. . See also Searle [], pp. ,
and Searle [], pp. .
See Davidson [], p. .

INTRODUCTION

picture, it does not really matter. The author has nothing systematic, rational or
useful to say about changing ones desiresand if he did, he would be unlikely
to share it.

1.1 Logical statics v. logical dynamics

Logic has long been regarded as consisting of laws of thought. These laws
govern what may be inferred from what. The drawing of inferences is in some
sense movement in thought. So the laws governing that movement might be
regarded as comprising the dynamics of thought. This, however, is not so. Logic
should really be regarded as characterizing the statics of a rational system of
belief. The dynamics of belief, which is what we are after here, has yet to be
characterized adequately by any body of rules or laws. Let us pursue this contrast
in a little more detail.

1.1.1 The fiction of the logical saint

Logicians, who are fond of abstraction and idealization, often talk about the
logically specious present. An infinitely powerful logical intelligencea logical
saint, for shortwould need only the logically specious present in order to infer
everything that followed logically from any beliefs that it might entertain. Any
movement in thought that could be accomplished in the logically specious
present would be no movement at all. That is why logic, in so far as it is a
body of laws of thought, is more like a theory of statics than one of dynamics.
A theory in the logicians sensethat is, a logically closed set of sentences
can be thought of as a (necessarily infinite) system in equilibrium. Its logical
closure is attained in the logically specious present, and its structure is therefore
to be described by a theory of logical statics. To this theory belong logicians
usual definitions of logical consequence, their deductive systems consisting
of rules of inference, and their resulting notions of deducibility and logical
closure.
The logicians notions are highly idealized. Their notion of a theory (a logically closed set of sentences) is not very useful when discussing the belief
systems of actual thinkers. Actual thinkers are not, and indeed cannot be, logical
saints of the kind just described. For one thing, actual thinkerseven the most
expert among themhave only finite cognitive resources. For another, they
are able to perform only finitely many steps of reasoning within their limited
2

INTRODUCTION

lifetimes. So, even if they only ever reason impeccably, never making any logical
mistakes, their belief systems could never be theories in the logicians sense.
In order to make vivid the difference between the statics and the dynamics
of belief, however, let us return for a moment to the fiction of the logical saint.
Think of a logical saints current beliefs as forming a logically closed set in the
logically specious present. Even a logical saint, however, would have to take at
least one discrete quantum of time, no matter how short, in order to change its
mind. Otherwise there would be no way to distinguish between what the saint
formerly believed, and what she now believes. For the logical saint, change still
takes time; whereas logical closure does not.

1.1.2 Epistemic norms and the paragon

Not aspiring to logical saintliness does not mean that we do not show any
interest in certain more modest virtues on the part of rational agents. For this is
an inquiry into certain epistemic norms, and norms are things that most people
honor in the breach. In pursuit of our own normative theory, we shall have
recourse to a more modest idealizationa paragonwhose particular virtues
will be explained below. The epistemological reader just needs to know, at this
stage, that the paragon is our ideally rational agent who never breaks the rules,
and always gets its computations right. And the computationalist reader just
needs to know that the paragon can be modeled computationally. It may have
powers that extend those of the best experts among us, but they are at least
powers that one can imagine by finite and smooth extrapolation from what
we finite and resource-bounded thinkers can achieve. This is how it should be,
though, with normative ideals prompted by consideration of patterns of expert
behavior.

1.1.3 Classifying changes of mind

Changes of mind are here taken to be changes in the status of a proposition,
from one to another of believed, disbelieved, and moot (neither believed nor
disbelieved). The last two cases are covered by not believed. Such changes of
mind induce transitions from one logically closed set of beliefs to another.
That involves true dynamics. Of course, the statics constrain the dynamics.
In order for a new state of belief to be acceptable after one of these changes,
one has to have an eye for those logical interrelationships among beliefs that
are governed by the statics. For example, one wishes to avoid inconsistency.
L O G I C A L S TAT I C S V. L O G I C A L DY N A M I C S

One also wishes to succeed in making whatever change one has decided upon.
Suppose the change in question is to surrender a certain belief. Then one would
not wish to have that belief popping back up in the next logically specious
present. This could happen if there were enough doxastic detritus left behind
after the initial attempted excision. Surrendering beliefs involves undertaking a
thorough purging. One must not leave behind other beliefs that would rationally
demand continued commitment to the belief to be surrendered.
Sometimes a change of terminology is needed in order to slough off old mental habits. So the talk here is of surrendering and switching beliefs, rather than
(or in addition to) talking of belief contraction and belief revision. The reason is
this: belief contraction is something of a solecism; it should, more accurately,
be written as contraction of a system of beliefs. It is the system that contracts
when one gives up a belief. It does not make sense to think of an individual belief
being contracted. (There are no font-size reductions in Mentalese ) Likewise,
we may revise a system of beliefs by following through on an initial decision to
switch from belief in a certain proposition to disbelief. That is, one can switch
from the belief that p to the belief that p; and in so doing, one would in general
need to make yet further changes, changes that amount to a successful revision
of ones system of beliefs.
The already expert reader must be careful not to invest the terms contraction
and revision, which are intended to apply here to systems of belief, with the narrowly technical meanings that may be bestowed on them by current paradigms
of theory change. An altogether different account will be offered here of the
content and structure of a system of beliefs, and of the systematic changes that
we call contraction and revision. Unless and until we are actually discussing
competing accounts of contraction and revision, the reader must be prepared to
take these terms at this stage as pre-formal, and in need of eventual explication.

1.2 Revolutionary change v. normal,

incremental change
A metabelief that has gained wide currency from the work of Thomas Kuhn
on scientific revolutions is that people change their beliefs somewhat in the
way that moths changed their coloration: by having old beliefs die out with
their bearers, and having new beliefs take hold in the next generation. One
mentions moths here because the phenomenon of industrial melanism is one
of the standard examples used in order to illustrate the workings of natu4

INTRODUCTION

ral selection. Unlike chameleons, individual moths cannot change their coloration during their lifetimes. But coloration can vary within any population
of moths: some will be lighter than average, others darker. During the industrial revolution, the dark satanic mills belched out fumes that darkened surrounding tree trunks. So lighter-colored moths were easier pickings for birds.
Darker-colored moths were therefore at a selective advantage. Within a few
generations, the proportion of darker-colored moths rose significantly. Moths
changed their coloration because the lighter-colored ones died out, leaving
relatively fewer offspring like them, and darker coloration took hold in the next
generation.
Consider now the following flamboyant and Kuhnian comment on the dead
weight of dogma (from Bayles and Orland [], at p. ):
When Columbus returned from the New World and proclaimed the earth was round,
almost everyone else went right on believing the earth was flat. Then they diedand the
next generation grew up believing the world was round. Thats how people change their
minds.

One is reminded also of the dark quip that social progress (which involves the
adoption of more enlightened beliefs) takes place one funeral at a time.
But for the more rational among us, that is not how we change our minds;
or, at least, that is not how we ought to change our minds. Indeed, this picture
of the dead weight of dogma does not make any place at all for people actually
changing their mindsany more than the evolutionary account of industrial
melanism represents individual moths as changing their coloration during their
own lifetimes.
What we want is a more chameleonic account of rational belief change. We
need to show how individual agents can and should change their own beliefs
whether as the result of perception, or the testimony of others, or theoretical
re-consideration. Consider the following examples of how individuals might
change their minds.
John has called his engagement off. For he has just discovered that his fiance
Mary has a dark secret. The discovery conflicts with many of his previously
cherished beliefs about her. He no longer believes she is trustworthy. Nor does
he believe that they will marry. But should he change any of his beliefs about the
institution of marriage? Should he call into question his belief that he will, one
day, be able to find the right partner? Should he revisit his former beliefand
now, perhaps, view it as navely trustingthat there is no such thing as a battle
between the sexes? How far should his belief revision go?
R E VO L U T I O N A RY C H A N G E V. N O R M A L C H A N G E

Second example: Bertrand has pointed out a contradiction in the foundations

of Gottlobs logical system for mathematics. Gottlob has to give something up,
in order to restore consistency. But what claims should he retract? And what will
be the impact on Gottlobs commitment to the higher reaches of the edifice that
he had built on those foundations? (One can also ask: did the actual Gottlob get
his revision right?)
Rational revision of beliefs, in our personal affairs and in our intellectual
lives, is critical. The task can be simply stated, for an ideally rational agent,
as follows. Suppose the agents current system of belief implies a particular
proposition, which the agent now realizes is false. Thus, the agent wishes to
believe the negation of that proposition, and to mutilate the system as little as
possible in coming to do so. First, the agent must contract the systemgive the
proposition up, along with anything in the system that either implies, or wholly
depends on it. Then the agent will add the desired negation to the contracted
result.

1.3 More on paragons and saints

We are going to assume always that we are dealing with the kind of idealized
rational agentthe logical paragonwho always obeys the epistemic norms
that we seek to uncover and articulate. Some of the points we wish to make
about the limitations or predicaments of a paragon are all the more forceful
when stated as limitations or predicaments of saints. Remember that saints are
even more idealized figures than paragons are! Saints reside at a completely
unfeasible, merely logically possible extreme, which not even a paragon could
attainlet alone a human being. Perhaps the most appropriate way to sum up
the virtues of a logical paragon is to say that while she is not a logical saint, she
is nevertheless a computational saint.
Logical paragons, like logical saints, can be perceptual dimwits and
gullible listeners. Being logically perfectindeed, even being a logical saint
vouchsafes no more truth to ones beliefs than derives from believing all logical
truths, hence disbelieving all logical falsehoods. That is not much help in navigating the world. Even a logical sainthence also, a paragonmight believe (as
a result of careless observation under the wrong lighting conditions) that grass
is purple; or might believe the salesmans pitch. Logical saints and paragons,
like the rest of us, have to learn about the world the hard way, by discovering
mismatches between basic beliefs and hard facts. So logical saints and paragons
6

INTRODUCTION

can find themselves temporarily entertaining conflicting beliefshence, strictly

speaking, logically committed to certain logical falsehoods.
On an alternative and even more idealized conception of epistemic virtue,
the logical saint or paragon would never fall prey to holding beliefs that are
mutually inconsistent. The saint or paragon would, as it were, always employ
an instantaneous and perfectly reliable consistency check before adopting any
new belief. In that case, the logical saint or paragon who has the erroneous,
but consistent, belief that grass is purple would, upon looking at grass more
carefully under better lighting conditions, become aware of the perceptual belief
that she would like to adopt (namely, that grass is green) but that is in immediately detected tension with the belief that she currently holds (namely, that
grass is purple). If (but only if) the formation of perceptual beliefs could be
thus deliberate and under the control of the agent, would it be permissible
to represent the logical saint or paragon as never actually falling prey to an
explicit contradiction among beliefs held at any one time. One can think of
the logical saint or paragon, however, as displaying the relevant virtues only in
logical or computational matters, respectively, and otherwise just as prone as
we are to form new perceptual beliefs pretty much involuntarily, in response
to our sensory experience. In that case even the logical saint (hence also the
paragon) would have to tend her garden of belief from time to time, weeding
out the contradictions that may be revealed by each fresh act of closure within a
logically specious present. The good thing about the logical saint or paragon is
that they immediately set about taking whatever measures are (not so much
necessary, as) minimally sufficient to restore consistency to their systems of
belief. As with logical saints and paragons, so with us, if we wish to be minimally
rational. When things turn out contrary to the way we think they are, we need
to re-think.
An ideal theory of belief dynamics would tell us, however, how to re-think
like a logical paragon. This is where being a logical paragon would have its
advantages. Theory dynamics is concerned with those movements of thought
that arise from changes of mind on the part of the logical paragon (however
ill-considered the initial changes might actually be).
A logical saint believes every logical truth, and strives not to believe any
logical falsehoodsindeed, disbelieves all of them. Likewise, a logical paragon
continues to believe any logical truth that she has ever established as a logical truth, even if at any given time there are logical truths that she does not
yet believe. (Certainly, she will never come to disbelieve any logical truth.)
Moreover, once a logical paragon is apprised of a sentence as a logical truth,
M O R E O N PA R AG O N S A N D S A I N T S

she will not seek to make contribute any would-be justificatory support to
any other beliefs she might form. For, as she knows, logical truths can always
be suppressed as premises. So, in the absence of any conflicts among beliefs,
changes of mind on the part of a logical paragon can be presumed to involve
only propositions that, as far as the paragon knows, are logically contingent. (She
can, of course, hold mathematical beliefs, on the basis of logical proof from
mathematical axioms; but these will not be logical truths in the conventional
sense, unless some extremely implausible logicist account of mathematics turns
out to be true.)
It is worth dwelling further on the foregoing emphasis on the rider as far as
the paragon knows. Unlike a saint, a paragon is not presumed to be logically
omniscient. She is always right about the logical proofs she constructs, and she
remembers them; but she is not presumed to be aware of every logical deducibility, except for those that hold in effectively decidable systems of logic. (And
even then, she would need to be given the time it would take to reach a correct
decision on the logical validity of any argument that she might be required to
appraise. Her knowledge of such deducibilities would not be instantaneous, as
is presumed to be the case with a logical saint.) The following situation is therefore possible, for a paragon. She subscribes to classical first-order logic, whose
decision problem is not effectively decidable. Two contingent and logically complex propositions p and p , let us say, are (classically) logically equivalent, but
the paragon does not realize this, because of the effective undecidability just
mentioned. The paragon comes to believe that p. By a step of -Introduction,
she then comes to believe that p p . She does not realize that the latter
is a (classical) logical truth. Subsequently, she may decide to surrender this
disjunctive belief. So, her change of mind, in this example, happens to involve
a logical truth. Still, as far as the paragon knows, the disjunctive belief p p
could be contingent.
If an objector wishes to avoid such hair-splitting cases, we could simply stipulate, at the outset, that our formal modeling is confined to belief schemes that
consist only of genuinely logically contingent propositionseven if the rational
agent in question happens to be unaware that they are all indeed logically
contingent, and lacks any effective method for establishing that this is indeed
the case. Such stipulation would be unnecessary, however, for those cases where
theoremhood in the paragons logic is effectively decidable.
Our omission of logically true sentences (as premises or conclusions of steps)
can be justified further as follows. All theorists of theory contraction agree that
the contraction of T with respect to any logical truth is simply T. Put another
8

INTRODUCTION

way, one cannot really contract with respect to any logical truth. Hence, there
is also no point at all in insisting on logical truths being able to appear as
conclusions of any steps of systems that are eligible for contraction with respect
to any of their nodes. Moreover, it is a well-known point of logic that a logical
truth can always be suppressed wherever it may appear as a premise in an
argument. Hence, there is no point either in insisting on logical truths being
able to appear as premises of any steps. We realize, of coursesee above
that a logical paragon, according to our definition of this idealized kind of
agent, might be using a logic with an effectively undecidable decision problem.
Therefore we cannot assume that she would at any given time know, of any
logical truth in her language, that it is indeed a logical truth. This means that she
might occasionally have, in her belief network, a node labeled by a sentence of
her language that happens to be a logical truth, like the p p example above.
Should she eventually discover that it has this status, however, she will simply
omit the node, along with all and any justificatory connections it had enjoyed,
from her belief network. Getting the logical status of any particular node wrong
is no principled obstacle to our modeling a rational agents belief nodes as
though they were labeled only by contingent sentences. For the contraction
process, by her own lights, would, at any time, still have to proceed according
to the rules we are laying down.
The ideal of logical saintliness is an extreme one. The logical saint is required
to just know that a given proposition follows logically from certain others when
indeed it does. Alonzo Churchs undecidability theorem for first-order logic tells
us that it is in principle impossible for any mechanically simulable intelligence
to decide, of any given argument P , . . . , Pn , ergo Q, and within a finite period
of time, whether there is a logical proof of the conclusion Q from the premises
P , . . . , Pn . So any saintly logician who can do that (for all P , . . . , Pn , Q) is
beyond the limits of mechanical simulation. And that is the case even absent
the further requirement that the knowledge should be available instantaneously
whenever the saint needs it.
We are proposing a lesser extreme, however, which can still be useful in
guiding our endeavors. We have weakened the requirements for good logical conduct. Suppose we hold the agent responsible only for never neglecting
those logical transitions among sentences for which she has already worked
out a justification. Just as she is allowed to be perceptually mistaken, from
time to time, so too now she can be allowed to be ignorant of certain logical
consequences. But she is required never to forget and never to fail to apply,
where appropriate, any justificatory transition for which she has already worked
M O R E O N PA R AG O N S A N D S A I N T S

out satisfactory details. Moreover, we require that, within the limitations of her
explicit resources, any mechanically decidable logical matter is one on which
she will make a correct decision (given enough time). We are calling this more
modest kind of norm-obeying agent a paragon, or a rational agent. Rational
agents are, after all, resource bounded. We require them only to work perfectly
with what theyve got. And we must allow them whatever time it necessarily takes
for them to do so.
To aspire to saintliness is to aspire for the impossible. To aim to be a paragon,
however, is a realistic ideal. This book is about how a paragon would change its
beliefs.

1.4 Changes in the doxastic status of a

proposition
If the state of mind A changes to the different state of mind B, we shall write
A  B. (This is not to be confused with the conditional if A then B.) There are,
in all, six kinds of initial change that could occur, concerning any contingent
proposition p :
1. believe p  neither believe nor disbelieve p;
2. believe p  disbelieve p;
3. neither believe nor disbelieve p  believe p;
4. neither believe nor disbelieve p  disbelieve p;
5. disbelieve p  believe p;
6. disbelieve p  neither believe nor disbelieve p.

Now disbelieving p is a matter of believing p. So the six kinds of change can

be re-written as:
1. believe p  neither believe p nor believe p;
2. believe p  believe p;
3. neither believe p nor believe p  believe p;
4. neither believe p nor believe p  believe p;
5. believe p  believe p;
6. believe p  neither believe p nor believe p.

In the classical case, when one is using classical logic, p is logically equivalent to
p. So () can be re-written as
10

INTRODUCTION

5 . believe p  believe p,

upon which we see that both () and ( ) have the common form
Switching: believe  believe .
Likewise, () and () have the common form
Surrendering: believe  neither believe nor believe .
Finally, () and () have the common form
Adopting: neither believe nor believe  believe .
When switching a belief, one revises ones system of belief. When surrendering
a belief, one contracts ones system of belief. And when adopting a belief, one
expands ones system of belief.

1.5 What a theory needs to explain

We need a rigorous account of the norms governing the operation of surrendering a beliefthat is, the operation of contracting a system of belief with respect
to one of the (logically contingent) beliefs in it. How wide-ranging ought this
operation to be? What norms constrain a rational mind from throwing the baby
out with the bathwater?
Philosophers of science are very much aware of the danger of giving up too
much when scientific systems of belief are being revised. They often talk of
minimally mutilating changes in the web of belief; but so far they have specified
no precise way to effect them. Minimal mutilation involves giving up as little as
possible when revising ones beliefs. For example: if you are revising your beliefs
as to the whereabouts of your car keys, you do not need to give up any of your
beliefs (assuming you have any) concerning the motions of the planets. For this
would be a case of mutilating too much.
Curiously, theorists of belief change hardly ever frame the obvious desideratum at the other extreme, so to speak. This is that one should also take on as
little as possible, in the way of new commitments, when revising ones beliefs. To
modify the earlier example: if you are revising your beliefs as to the whereabouts
of your car keys, you do not need to take on any new beliefs (assuming you
have none) concerning the motions of the planets. We need a new term for
W H AT A T H E O RY N E E D S TO E X P L A I N

11

this requirement, analogous to minimal mutilation at the other extreme. The

author suggests minimal bloating for this purpose. The word bloating has
graphic connotations that match those of mutilation. If these words strain the
sensibilities of the reader too much, then more neutral terms such as deflation
(in place of mutilation) and inflation (in place of bloating) could be used.
The tradition, however, has so inured the philosophical reader to the use of
mutilation that it is hoped that bloating will be acceptable for this other
extreme, of which we need to be mindful. If the maxim of minimal mutilation
counsels against throwing the baby out with the bathwater, then the maxim of
minimal bloating counsels against filling the bath thereafter, around the baby,
with toxic waste.
Theorists have failed to explicate the notion of minimal mutilation, even
though it has been a hand-waving requirement in the literature for some time.
But so far theorists have not even waved a hand in the direction of minimal
bloating.
Hence the current project: give a philosophically sound, mathematically precise account of contraction and revision, based on appropriate explications of
these requirements, and formulate it in such a way as to be programmable on a
computer. As John Pollock once wrote,3
A major d[e]sideratum that I would impose upon an investigation of epistemic rules is that
they be stated with enough precision that they can be impl[e]mented on a computer.

In order to be philosophically sound, the account must provide a satisfactory

explication of the all-important requirement of minimal mutilation on contractions.
The sought account will be normative, not descriptive. This is because we
need to know what ought to be done by an ideally rational agent confronted with
the need to change its mind. The focus in this work will be on what happens,
when one surrenders an individual belief, to that beliefs logical neighbors;
or rather: what should happen to them. Reason dictates that such changes in
belief have ramifying consequences, consequences that are forced upon us, once
we take the initial plunge. There are norms to be articulated governing the
ramifications of retrenchment.
One of our main theses is that the correct statement of such norms need not
involve any truck with the infinite. The norms can be framed entirely in terms

12

See Pollock [], p. .

INTRODUCTION

of finitary objects and structures. This means that we can also inquire after the
implementation of those norms in a computational system.

1.6 Computational considerations

Only finitary objects can be inputs to, and outputs of, computational procedures. If our brains are finite automata, and are computing the results of surrendering certain beliefs, then we need to frame matters in finitary terms in
order to describe what the brain is doing. Indeed, we need to frame matters in
finitary terms even when stating what the brain ought to be doing.
In this study, the aim is to offer an instrument of refined rationality, with
unprecedented scope and power. The scope is achieved by attaining a suitable
level of abstraction, and working with suitably simple conceptual materials.
Ironically, no great subtlety is involved. The power is achieved by bringing
computational methods to bear on the materials thus identified, so that boring
details can be relegated to cybernetic prosthetics.
Successful automation of the task of belief revision promises to bring widespread applications. These range from specialized fields such as medical diagnostics, to more general predictive and explanatory frameworks in the natural
sciences. Wherever beliefs are organized with articulated reasons, such methods
of rational revision would apply.
The project is therefore interdisciplinary. First, there are important epistemological issues to be resolved or accommodated. These concern whether belief
systems are finite (can our finite minds entertain only finitely many beliefs?);
epistemic priority (what counts as a reason for what?); and possible patterns of
justificatory regress (can justifications form loops? can they backtrack forever,
or must they terminate?).
Secondly, the systematic character of the essential components and structures
involved in rational belief systems motivates a more precise logical theory. This
logical theory provides the mathematical means to represent belief systems,
as well as the computational means to manipulate and transform them. The
technical part will present mathematical details of so-called finite dependency
networks from first principles. Such networks model patterns of justificatory
relations. They enable one to precisely define the problem of contraction. One
can then ask how complex the contraction problem isthat is, how much time
and memory space are needed for the computation, depending on the size of
input.
C O M P U TAT I O N A L C O N S I D E R AT I O N S

13

It turns out that the problem of contraction is exactly as complex as the

problem of deciding whether one can make a given formula of sentential logic
true by assigning appropriate truth values to its sentence letters.
The technical term for this kind of problem is NP-complete. That is short
for non-deterministic polynomial-time complete. This notion will be fully
explained in Section ..
For the cognitive scientist, or the mechanist about the mind, algorithmic
complexity is a real theoretical concern. Suppose the mind is to be simulated
or emulated by mechanical or computational means. It will then be a constraint on our models of mental functioning that they should not be more
computationally complex than necessary. If the mental functions themselves
appear to be pretty efficientespecially in their real-time operationso too
should our computational models of them. We have to allow, of course, for
the fact that silicon-based digital processors are very different from the massively parallel neural networks that have evolved by natural selection to carry
out real-time perceptual, communicative and motor tasks. But still, the theorist will be concerned not to postulate computational models that are off
the charts as far as their inherent computational complexity is concerned.
For there will come a point at which they will just look implausible as models of the natural mental phenomena involved. We are aware of the point,
often made about the algorithms that the brain might actually be implementing, that for significant initial segments of the measure of input length, an
exponential-time algorithm could, surprisingly perhaps, yield its results more
quickly than a polynomial-time algorithm. Indeed, this could be the case for all
problem lengths ever to be encountered under reasonable assumptions about
lifespans and the computational tasks one confronts.4 Nevertheless, in spite
of all that, one will by default prefer an algorithm in a lower complexity class
to any rival one in a higher complexity class, for the purposes of cognitive
modeling.5
One source of unwanted complexity is the kind of exponentiation that
can be involved when one has to deal with (search through) all possible subsets of a given set. And this is why models of the belief-revision or beliefcontraction process threaten to be exponentially more complex than would be
The present author made a closely related point in Tennant [], at p. : an algorithm A
that achieves speed-up over another algorithm A on longer problems might very well do so at the
cost of some slow-down on the shorter ones.
For further interesting discussion of the issue of complexity in the computational modeling of
cognition, see van Rooij [].

14

INTRODUCTION

the determination of logical relations among sentences. For, in the contraction

process one will have occasion to search through all sets of the agents beliefs
that might justify a given belief (as far as the agent is concerned). Intuitively,
this is a warning sign, to the complexity theorist, that there might be unwelcome
exponential blow-up.
Fortunately, such blow-up can be contained within the bounds already set by
NP-completeness. For, on the present analysis, what we call the simple contraction problem issomewhat surprisinglyNP-complete.6 This is a gratifying
result. It means that it is of the lowest level of complexity that one can hope for
with a non-trivial logic problem. For even at the modest level of propositional
logic, it is rare to find a computational logic problem that is as tame as NPcomplete. (We shall survey various complexity results in support of this contention, in Section ..) That the simple problem of contraction, as we conceive
it and formulate it here, turns out to be NP-complete is therefore a strong point
in favor of the new account.
The simple problem of contraction does not involve verifying that any contraction that is found is minimally mutilating. On our explication of the latter
notion, if we do require minimal mutilation, then the more exigent contraction
problem increases to a level of difficulty no worse than the second level of the
so-called polynomial hierarchy.
In Chapter , efficient contraction algorithms are specified, and in Chapter we provide a Prolog implementation for the simplest of them. (Prolog
is a high-level language for programming in logic). The algorithms have been
applied to the various problems that have appeared in the literature by way
of criticism of extant theories of contraction and revision. It turns out that
the new account handles these problems in a way that would appeal to any
intelligent person uncorrupted by implausible theories of revision. The computational theory affords the most efficient tests possible of implementations
of ones contraction algorithms on a wide range of inputs. Such tests can yield
theoretical insights as to how variously structured belief systems undergo contractions with respect to variously positioned consequences. The contraction
algorithms can also deal with relative entrenchment among beliefs, which is
important for epistemologists concerned with real-world modeling of belief
systems.

See Section ..

C O M P U TAT I O N A L C O N S I D E R AT I O N S

15

1.7 Philosophical considerations

The form of representation of belief systems that this account employs for
computational purposes helps to illuminate the commonalities and differences
among the major positions held by epistemologists. These positions are the bestknown responses to the problem of regress of justification. Foundationalists
think chains of justification must terminate, whereas coherentists will tolerate
loops.
Now, logicians have sought to provide a unified framework in proof theory
allowing for variant systems of deductive reasoning (such as classical, constructive7 or relevance logic8 ) with rules of inference tailored to various presuppositions about truth and meaning. These deductive systems enable the
reasoner to move rigorously and efficiently within a theory. For belief revision,
then, we should likewise seek to provide a unified framework in the theory of
theory change allowing for variant epistemological positions (such as foundationalism, coherentism9 and foundherentism 10 ) with contraction methods formulated with sufficient flexibility and generality to be able to cope with various
presuppositions about rational belief and justificatory structure. Such systems
would enable the reasoner to move rigorously and efficiently from theory to
theory. 11
The new account of rational belief revision can also help identify the inviolable core of logicthose forms of inference essential to the task of revision
itself, and hence immune to revision in the light of any experiences, no matter
how unexpected they may be. This Core Logic (so we shall argue) turns out
to be intuitionistic relevant logic (IR), whose philosophical, methological and
computational credentials the author has presented elsewhere. 12
The new account could also be extended to handle retractions of justificatory
steps themselves, in addition to the beliefs serving as their premises and conclusions. That would be the right juncture at which to model the more radical
process of revision of ones logic. In so far as many steps will be justificatory,

Loci classici: Gentzen [, ], Prawitz [].

Locus classicus: Anderson and Belnap [].
Locus classicus for the contrast: Sosa [].
Locus classicus: Haack [].
The account proposed here could, in fact, supply the missing details for the revision process
invoked in Gupta []. See his Chapter , especially pp. ff. We discuss this further in Section ...
See Tennant [] and Tennant [c].

16

INTRODUCTION

for the agent, by virtue of instantiating a valid inference within the agents
chosen logic, such steps would cease to be justificatoryand would need to
be surrendered, or given upif the agent were to revise her logic in such a way
as to invalidate the formerly valid inference pattern in question. (The inference
from xF(x) to xF(x), for example, would be invalidated in the process of
revising classical logic so as to yield intuitionistic logic.)
Such an extension of our account, however, is not undertaken here. The
ensuing discussion will be conducted on the assumption that the justificatory
steps are immune to retraction or revision, and that it is only the beliefs at
their premise and/or conclusion nodes, so to speak, that can be adopted or
surrendered. But it is important to keep an open mind about the possibility
of rendering such steps liable to retraction, in situations where it is not enough
to change the doxastic status only of the nodes that they connect. Having said
that, it will emerge that one rationally cannot give up any justificatory step that
is an instance of a valid argument in the Core Logic just mentioned. For that
would lead to an overall reflexive instability in the mental makeup of the agent.
She would no longer be able to conduct the reasoning that is required in order
to motivate the very project of belief revision that is rationally called for when
one discovers that ones current belief scheme is contradicted by newly available
evidence. If one gives up any of the rules of Core Logic, then one will not be in
a position to work out what to do when placed in such a predicament. Such
an unstable situation would not be irredeemablethe agent would just have to
take back on board (at least) the inference rules of Core Logic.
The behavior of the new contraction algorithm deserves to be investigated
systematically on many larger problem sets, in search of regularities involving the initial structure of a belief system and the variety of ways in which
one can contract it. Of particular interest will be phase-transition or threshold phenomena such as those encountered at times of theoretical crisis, when
many anomalies have cropped up. Thomas Kuhn wrote of paradigm shifts,
or revolutionary theory changesuch as the shift from Newtonian dynamics
to Einsteinian relativity theory. What prepares the ground for such a shift?
Why does the old theory suddenly implode under the force of the contractions demanded by experience? How does contraction in response to bits of
evidence induce large-scale theoretical collapse? Might there be a more deeply
rational process at work than some of Kuhns followers have claimed? The
work seeks to provide new methods that could throw some light on these
questions.

P H I L O S O P H I C A L C O N S I D E R AT I O N S

17

1.8 Methods
As mentioned in the Preface, this interdisciplinary project requires philosophical analysis, mathematical formalization, logical systematization, and application of the main procedures in computing science: choice of data types (also
sometimes called data structures); isolation of effectively decidable properties
and relations; analysis of computational complexity; specification of algorithms;
and their implementation in high-level computer languages. Contraction algorithms will vary in their optimality and efficiency, in light of NP-completeness.
They are specified in detail, so that Artificial Intelligence (AI)-theorists can
implement them in various computing languages. A Prolog program is also
provided for the simplest version of the contraction algorithm.
Paul Thagard was one of the first philosophers of science to emphasize the
importance of AI and computation for our understanding of scientific theories. In Thagard [] he described how an Artificial Intelligence (AI)-based
approach could throw light on the discovery, testing and evaluation of scientific
theories. This involved consideration of analogical problem solving, abduction,
and inference to the best explanation. Thagards preference was for very rich
data types, and programs that worked well by delving into, exploring, and
making connections among the innards of these data types. He chose formalizations that were easy to encode in the programming language LISP, for
such things as concepts, rules, problems, and problem-schemata. As he stressed
(pp. ), the
structures and algorithms are interdependent: the algorithms must work with the data in
the form given to them.Philosophers tend to assume the ubiquity of only one kind of
data structurethe propositionand only one kind of algorithmlogical reasoning. But
computer science offers a wealth of structures in which data can be stored: arrays, tables,
records, frames, and so on.[O]ur view of the nature of thinking can be broadened considerably by allowing for the possibility of nonpropositional data structures and nonlogistic
processing mechanisms.

Here we follow Thagards advice, but do not follow his example. We definitely get
away from the proposition as the, or even the main, data type. Instead, our only
data type of any significance is the step, consisting of finitely many premises and
a conclusion. But the way in which we do not follow Thagards own example is
that the nodes of which our steps consist are primitive Urelemente, and internally unstructured. And apart from defining dependency networks as finite
sets of steps satisfying certain very simple conditions, that is it; that is all we
deal with.
18

INTRODUCTION

This is because we are attempting to study regularities in the process of

contraction and revision of belief schemes that will manifest themselves only
in this austere kind of setting. We are aiming to supply an account that will
be universally applicable. It must handle all different kinds of belief scheme,
no matter how richly structured, internally, the individual beliefs within them
might be. To endow our networks and the steps within them with any further
innards would distract from this theoretical goal. These comments lead us to
dwell a little longer on some points of methodology.

1.9 Methodological considerations

Formal or mathematical models are subject to a variety of adequacy constraints;
and sometimes different constraints can pull in opposite directions. The great
virtues of formal modeling are precision, clarity and rigor, which enable one
to pursue a deeper understanding of certain central features of the subject
matter. One would hope that every kind of formal modeling would display
these basic virtues. One cannot imagine any countervailing pull in any opposite
direction. 13
In addition to the basic and abiding virtues, there is the virtue of simplicity.
This is in evidence when theoretical primitives are kept to a minimum. In a
simple model, only the most important notions or structural features are isolated for formalization, and only the most central and important properties and
relations are provided with a formal representation.
But another virtue, pulling in the opposite direction to simplicity, is comprehensiveness: the temptation or aspiration to accommodate as many as possible of
the pre-formal features that one judges to be part and parcel of a multi-faceted
subject matter.
At some point a balance has to be struck, between the desideratum of simplicity and the desideratum of comprehensiveness.

1.9.1 Simplicity v. comprehensiveness: a case study from

deductive logic
Take, for example, the modern treatment of deductive logic. Logical systems,
almost by definition, are clear, precise and rigorous. They have the abiding,
Possible exceptions are formal accounts of fuzzy reasoning and of vague predicates. This
observation is due to Stewart Shapiro.

M E T H O D O L O G I C A L C O N S I D E R AT I O N S

19

basic virtues of a formal model. Cautionary note for logicians: here we are using
model in the informal sense of scientific model (i.e. theory) of some subject
matter, rather than in the specialized sense in which logicians talk of models of
theories in a formal language. Models in the latter sense are perhaps models, in
the former sense, of the kinds of subject matter that such languages can describe.
SIMPLICITY

Consider the classical propositional calculus. It is a simple model of deductive reasoningindeed, the simplest possible. (Sometimes experts call it baby
logic; this underscores the point being made here.)
The propositional calculus deals only with the logical connectivesnegation,
conjunction, disjunction and the conditional. The formal semantics for a propositional language tells one how to interpret its atomic sentences (the so-called
propositional variables) by assigning truth values to themtrue or false. And the
semantics interprets the connectives by means of the well-known truth tables,
which tell one how to compute the truth value of a complex sentence, under
an assignment of truth values to its atomic constituents. The notion of logical
consequence can then be defined as preservation of the truth value true from
premises to conclusion, under all possible assignments:
is a logical consequence of 1 , . . . , n
if and only if
for every assignment of truth values to atomic sentences occurring therein, if makes
all of 1 , . . . , n true, then makes true.

This notion of consequence is then matched by a syntactic notion of deducibility.

One can furnish a system S of proof for the propositional language, consisting
of rules of inference governing the connectives. 14 By applying such rules one
can construct formal proofs. The notion of deducibility can then be defined by
appeal to the existence of a proof:
is deducible (in S) from 1 , . . . , n
if and only if
there is a proof in the system S whose premises are among 1 , . . . , n and whose
conclusion is .

The reader who is not a logician might wish to take a quick look at the formal rules for Core
Logic, which are stated in Section ..

20

INTRODUCTION

The job of a formal proof is to show, by individually unimpeachable steps, each

one of them in accordance with a precisely stated rule of inference, that its
conclusion is a logical consequence of its premises , . . . , n . Ones system
S of proof is adequate for the propositional language L just in case it is both
sound and complete for L. Here is the definition of soundness:
System S of proof is sound for the language L
if and only if
for all 1 , . . . , n , if is deducible (in S) from 1 , . . . , n , then is a logical consequence in L of 1 , . . . , n .

And here is the definition of completeness:

System S of proof is complete for L
if and only if
for all 1 , . . . , n , if is a logical consequence in L of 1 , . . . , n , then is deducible
(in S) from 1 , . . . , n .

This brief explanation of the theory of propositional logic will have to suffice,
for it is provided only in order to illustrate our methodological point about the
need to strike a balance between the demand for simplicity and the demand for
comprehensiveness.
The simplicity of propositional logic is self-evident. Against this setting
one attains a very good and serviceable conceptual grasp of the distinction
between syntax and semantics, and of the metalogical notions of soundness
and completeness. One could go further and develop computational methods
of proof search within this system, but this is not usually done in standard
introductory texts. 15 One could also illustrate various metalogical themes
arising from the study of fragments of the language, such as the fragment based
on just negation and conjunction. 16 One could study certain preferred forms
of proof that exhibit a particular sort of elegance and directness. These are the
proofs in so-called normal form. (Again, this is a topic not usually covered in
standard introductory texts.)
The point emerging from these remarks is this: simple though it is, propositional logicwhen presented in the right wayis a wonderful setting within
See the discussion in Section . of the complexity of the decision problems for various wellknown systems of propositional logic.
A good methodological dictum about logical theorizing, acquired by this author from his
teacher Timothy Smiley, is that if ever you wish to establish a metalogical result, check first how it
works out for just negation and conjunction!

M E T H O D O L O G I C A L C O N S I D E R AT I O N S

21

which to get to grips with, and to learn standard theoretical techniques for
proving, results that can be extended to more complicated systems containing all
of propositional logic as a subsystem. (We shall look at one of these presently.)
It is also worth remarking that even at the simple level of propositional
language and logic, a host of philosophical issues and debates can arise. These
concern such questions as:
What are the truth bearers? Are they sentences, or statements, or propositions?
Why do we assume that the truth value of any one atomic sentence can be
assigned to it independently of the truth values assigned to other atomic
sentences? Why do we restrict ourselves to single-conclusion arguments? Why
not study multiple-conclusion calculi? What is the right account of logical
consequence? Should we say that a logically contradictory set of premises such
as {A, A} has any and every sentence B as a logical consequence? Or should
we deny this (as the relevantist does)? 17 And what about determinacy of truth
value? Should we be assuming that every sentence is determinately true or false?
Or might there be truth-value gaps? . . . or even gluts? Is it really the case (as
the classicist maintains), that using only negation and a binary connective, one
can define all other connectives? What if we think (as the intuitionist does)
that each of the usual connectives (negation, conjunction, disjunction and the
conditional) cannot be defined in terms of the other three? And what about
alternative truth values, such as indeterminate (for quantum mechanics), or
evaluation transcendent (for deeply elusive conjectures in mathematics, such
as the Continuum Hypothesis), or in-between (for vague statements)? Indeed,
what about having a continuum of truth values, as is done in probability theory,
which uses the real unit interval [,] as its space of truth values?
The classical system of logic involves taking some peremptory (and in some
cases carefully considered) stands on these issues.
Truth bearers are sentences. Atomic sentences are semantically independent
of each other. We study single-conclusion calculi for the sake of simplicity,
but we could accommodate multiple-conclusion calculi if you wish. The right
account of logical consequence is preservation of classically construed truth.
Contradictions logically imply every sentence. Truth values are determinate, even
if their determination transcends our grasp. There cannot be truth-value gaps or
The inference from A and A to (arbitrary) B is known as Lewiss First Paradox. It is taken
as correct in intuitionistic, hence also in classical, logic. So both these systems fail to be systems of
relevant logic.

22

INTRODUCTION

gluts. Negation and one binary connective yield all other connectives by suitable
definitions. And aroint thee, knave, we shall have no truck with alternative truth
values!
Note that to get bogged down with the first question, concerning the right
choice of truth bearers, is to opt for philosophical disquisition while sacrificing even the simplest form of system building. If one were to become too
obsessed with finding philosophically satisfying answers to all the questions
initially raised, one might never get round to building any sort of deductive
system.
The system-building theorist, however, gets a headstart by being willing to
make certain idealizing assumptions, plumping for structures and methods
that, it is to be hoped, will prove to be invariant across different resolutions
of the philosophical issues raised. One can study the structure of deductive
inference without having to settle in advance the minutiae of the debate over
truth bearers. With other topics on the list above, however, one might have to
proceed more cautiously. On the question of relevance (does a contradiction
logically imply every sentence/statement/proposition?) one might need a better
idea of the shape of ones answer before deciding on any particular choice of
rules of inference. This is because those very rules are the ones that will be
generating proofs of any conclusions that do follow from premises that happen
to be contradictory.
Alternatively, on questions such as this one, which have serious implications
for ones choice of formal logic, one can be a system builder in advance of any
final resolution of the philosophical issue concerned. One can try to cater for
the various choices that could eventually represent informed answers to the
question in hand. Indeed, ones attempts in this connection at system building
might furnish valuable considerations that can be brought to bear in offering a
final answer to the question posed.
There would appear, then, to be two strategies open to the system builder,
when faced with a thorny philosophical issue:
1. try to furnish a system that is invariant across (hence: indifferent to) the various
possible resolutions of the issue; or
2. try to tailor different systems to the different possible outcomes associated with
competing resolutions of the issue.

Arguably, given its historical evolution through the writings of Frege,

Russell and Whitehead, Hilbert, and Gentzen, the development of (even just
M E T H O D O L O G I C A L C O N S I D E R AT I O N S

23

propositional) logic as a system in which the so-called propositional variables

are placeholders for whatever count as the truth bearers seems to have followed
strategy (). On the other hand, one could view the later formulations of intuitionistic (propositional) logic by Heyting, and of various systems of relevant
logic and logics of entailment by Anderson, Belnap and others, as contributing
to something roughly like strategy ().
The moral to be drawn is that rigorous system building should not await
detailed resolution of all the outstanding philosophical issues that thinkers
might wish to raise. Life is short. Time is limited. Structural insights are precious. System building is satisfying.
COMPREHENSIVENESS

Now we come to comprehensiveness. We spoke above of the theoreticians desire

to accommodate as many as possible of the pre-formal features that one judges
to be part and parcel of a multi-faceted subject matter. In this methodological
case study, the subject matter in question is the logic of a chosen language.
But what can be accomplished within a propositional language? The answer
is: not much! It is too impoverished, grammatically, to come anywhere near
satisfying our theoretical needs in deploying logic. These needs have mainly to
do with rigorous regimentation of deductive reasoning within pure and applied
mathematics. And when one takes a closer look at even the simplest forms of
mathematical argumentation, one finds that they are rife with equations (identity statements of the form t = u; to take a time-honored example, + = )
and quantifier moves, involving the expressions for all x (x) and there
exists x (x).
Mathematical communication and argument both involve essential recourse
to identities and to quantifier expressions. Without them, there would be no
mathematical thinking and no proofs of mathematical theorems.
So, an extension of propositional logic is needed in order to service the needs
of mathematics. How is this to be done?
The short answer, now firmly entrenched within the tradition of foundations
of mathematics, is that one uses a first-order formal language with the identity
predicate =. 18 So, apart from a few primitive mathematical relational or func Some scholars, such as Shapiro [], argue that one needs even more in order properly
to capture what is mathematically expressible. The alleged extra needed is the use of second-order
quantifiers. Ascent to second order, however, brings greater expressive power at the inevitable cost
of reduced deductive power. See Tennant [] for more details.

24

INTRODUCTION

tional expressions such as < or +, one adds to the language of propositional

logic just the logical operators and , and the binary logical predicate =.
One also breaks into the logico-grammatical form of relational predication,
by ensuring that one can write predicate-argument sentences such as
< ; + = ; . . .
into whose argument places one can then quantify, either existentially or universally:
y < y; xy x < y; y y + y = ; xy y + y = x ; . . .
The metalogical notions of logical consequence, deducibility, soundness and
completeness for such a first-order language enjoy definitions that involve only
relatively minor tweaking of the definitions of the corresponding notions for
a propositional language. That is why university courses in logic are so often
organized with coverage of propositional language and logic preceding coverage
of first-order language and logic.
The relatively minor tweaking of the definitions on the semantical side
involve generalizing from the simple notion of an assignment of truth values
to atomic sentences, to the slightly more complicated notion of a model. A
model consists of a domain of individuals and a specification of (i) which of
them answer to which names; and (ii) which of them have which properties,
and which of them stand in which relations to which others. Obvious clauses
are added for the semantic evaluation of quantified formulae when they are
interpreted as making claims about the model. We do not intend this apparently
nonchalant remark to downplay the historical importance of the breakthrough
of Alfred Tarski in (see Tarski []) in defining the notion of satisfaction
of an open formula by an assignment of individuals to its free variables. But,
with the benefit of historical hindsight, the Tarskian treatment can be made
to look like the obvious leg-up that it is, in order to be able to deal with the
quantifiers as well as the connectives.
Likewise, rather obvious rules of inference governing the quantifiers can
be added to the formal system of proof. Again, we do not mean to downplay
here the historical importance of the breakthroughs by Gottlob Frege [;
reprinted ] and Gerhard Gentzen [, ] in stating the first sound
and complete rules for the quantifiersthe latter in an exceptionally natural
way. But, with the benefit of historical hindsight, the Gentzenian treatment can
M E T H O D O L O G I C A L C O N S I D E R AT I O N S

25

be made to look like the obvious leg-up that it is, in order to be able to deal
with the quantifiers as well as the connectives.
Having thus specified the slightly more complicated (because more comprehensive) formal semantics and system of proof for the quantifiers and the
identity predicate, one then finds that the work has already been done, at the
propositional level, in defining soundness and completeness. The very same definitions work at first order as they did before, provided only that one appropriately re-construe the formal proof system S and the formal language L therein.
For S now contains the inference rules governing the quantifiers and the identity predicate, and these expressions have increased the expressive power of L,
and have been characterized semantically.
The lift to first order brings some rather important theoretical changes. Most
conspicuous among these is that there is no longer any mechanical decision
procedure for telling whether there is a proof of a given conclusion from finitely
many given premises. And of course one requires a rather more sophisticated
method of proof, in the metalanguage, in order to establish that the formal firstorder proof system is complete. 19

1.9.2 Applying the lessons learned in the case study from

deductive logic to the problem of belief revision
The question now is: what methodological lessons can be drawn, from this case
study of propositional v. first-order languages and logic, for our rather different
theoretical endeavors in the area of belief revision?
Let us be forthright: in this work, we shall happily restrict ourselves to
a belief-revision analogue of the propositional calculus. That is to say, we
shall seek precision, clarity and rigorbut we shall opt also for considerable
simplicity.
It is important, however, to appreciate that we are not thereby limiting ourselves to the study of contraction and revision of systems of beliefs that require
only the resources of a propositional, as opposed to a first-order, language for
their expression. For, in our modeling, the nodes of a dependency network
(which represent the agents beliefs) could be place holding for beliefs whose
linguistic expression is of arbitrary logico-linguistic complexity. The agent can
have relational beliefs and quantified beliefs, for example; and they can be
The completeness of first-order logic was first proved by Kurt Gdel []. The method of
proof most widely preferred today is due to Leon Henkin [].

26

INTRODUCTION

handled via nodes within our networks just as easily as any (linguistically) simpler beliefs, expressible by using more modest linguistic resources. In speaking
of our account of belief change as analogous to the logicians account of propositional logic, we are adverting, rather, to the systemic simplicity of propositional
logic itself.
We shall enter several idealizing assumptions, which are bound to provoke
debate:
Belief systems can be represented as finite dependency networks. Structureless
nodes represent the agents beliefs. Nodes are either in or out (believed or not
believed). Steps connecting the nodes represent apodeictic warrant-preserving
transitions (for the agent). Steps are either initial or transitional. Belief systems
are made up of steps.
We do not require our dependency networks to be structured in any particular
way. In particular, we do not insist that they form tree-like structures (though
of course they may). In a contraction process, steps cannot be surrendered; only
nodes can.
Our interest in making all these idealizing assumptions is that they will reduce
a thorny subject to more manageable proportions at the outset. They will allow
us to investigate some rather intriguing phenomena in the contraction and
revision of belief systems. They will afford insight into the computational complexity of the contraction process. They will enable a manageable first stab at
an actual implementation of a contraction algorithm, which runs efficiently in
real time on reasonably complex examples. This affords the prospect of further
theoretical insights into such matters as Kuhnian sudden collapse under the
weight of accumulating anomalies.
Moreover, the formal theory of contraction that we shall develop, and the
algorithms that we shall specify, and our Prolog implementations thereof, have
the desirable feature of not taking a doctrinaire stand on the major epistemological issue of foundationalism versus coherentism. But our modeling will offer the
intriguing possibility that, as one computationally explores the consequences,
for belief contraction and belief revision, of embodying (say) coherentist patterns of interdependence in belief schemes, one may learn crucial lessons about
the behavior of such schemes under contraction and revision. These lessons may
reflect well or poorly on the philosophical credentials claimed for coherentism.
There is nothing more sobering than certain results of formal exploration of
grand philosophical commitments: ask the ghost of Gottlob Frege about nave
abstraction, or the ghost of Alfred Ayer about indirect verifiability.
M E T H O D O L O G I C A L C O N S I D E R AT I O N S

27

The austere formal modeling that we develop here can serve as a departure
point for further investigations that might yield refinements and extensions of
the modest initial account. We shall touch on various possibilities in Section .,
so it is not necessary to go into details at this point.

1.10 Relation to present state of the field

The remarks in this section will be kept as brief as possible, since this is the
introduction. More detailed discussion can be found in Chapter .
The computational picture commended here differs from the AI-communitys theory of Justification-based Truth-Maintenance Systems (JTMS). It also
differs from the logicians prevailing theory of theory changeAGM-theory
which was mentioned above. This is for the following reasons, which will be
stated here only briefly.
First, JTMS-theory (as presented, for example, in Forbus and de Kleer [])
handles logical truths incorrectly (as supposedly potent premises), and nonfoundationalist epistemologies not at all. It retracts only assumptions, and fails
to deal with the general operation of contracting a belief system with respect to
arbitrary unwanted consequences.
Secondly, no one can implement AGM-theory in full generality on a computer, for it does not treat belief systems as finite. (The only implementations
possible are for theories with finite bases, at the level of propositional logic,
whose deducibility relation is decidable.) Moreover, one of the main AGMpostulates, the so-called Postulate of Recovery (about what happens if one
surrenders a belief and then re-adopts it), succumbs to striking counterexamples. Also, its methods of contraction (involving complicated set-theoretic
operations) can mutilate theories too much, and its methods of revision can in
addition bloat theories too much.
Much of what we do is not fully undoable. 20 Even erasures of the marks
we make leave marks of another sort. Adopting and surrendering beliefs is no
different. The Recovery Postulate ignores this. Suppose you have many beliefs,
among which are the beliefs p and q. Suppose you surrender p, and make
various other adjustments so as to ensure that p is not forced upon you by other
beliefs that you still hold. Suppose further that q is one of the casualties in this
As the convenience-store owner said to Juno in Juno: This is one doodle that cant be undid,
Home Skillet.

28

INTRODUCTION

process of adjustment. That is, in giving up your belief p, you also give up q. The
Recovery Postulate claims that if you have an immediate change of mind, and
adopt once more the belief p, then you will thereby reclaim the belief q.
Such has been the view, until very recently, of AGM-theorists of belief contraction. They treat systems of belief as idealized, logically closed theories, and
study how one such theory can be a contraction, or revision, of another, with
respect to any particular sentence p. In other words, they think of the rational
agent as a logical saint in the sense explained above. A whole mathematical and
metalogical edifice, with representation theorems and exaggerated promises
of computational applications, was built upon this unexamined dogma about
the surrendering and re-capturing of beliefs. The dogma is false, however, and
ought itself to be surrendered. This book shows what can be recovered without
the Recovery Postulate.
Any new account should seek to remedy these shortcomings, and achieve further important goals. It should justify the claim that representing belief systems
as finite dependency networks (as a computational account must do) incurs no
loss of generality, and no restriction in the scope of applicability. It should establish how complex the contraction problem is. It should also explicate the notion
of minimal mutilation. By working on the way we employ justificatory relations
among propositions when contracting a belief system, we aim to uncover the
essential features of theory change in general, without resorting to non-standard
revisions of the underlying logic itself.

1.11 Chapter-by-chapter foreshadowing

summary
. Introduction (i.e. this chapter)
We have explained the distinction between, on the one hand, logic as a theory of belief
statics and, on the other hand, our sought account of belief dynamics. The various kinds
of belief change have been classified. These are: surrendering, adopting or switching individual beliefs; and thereby contracting, expanding or revising ones system of beliefs. Our
account of the epistemic norms involved is agent-centric. The idealized figure of the logical paragon (as opposed to the completely fictional figure of the logical saint) is introduced as the guiding model of a rational agent who is thoroughly competent in matters of
belief change. We discuss what a theory of belief change needs to characterize or make
feasible. Two key constraints are formulated: we need to explicate (and ensure) both
minimal mutilation and minimal bloating of systems of belief undergoing contractions
C H A P T E R - B Y- C H A P T E R F O R E S H A D OW I N G S U M M A RY

29

and revisions. The explicit goal is to provide a computationally implementable account

of belief change. We have foreshadowed welcome results to be proved about the computational complexity of the contraction problem. We have stressed that our account of
belief dynamics will be able to cope with differences among different schools, or -isms,
in epistemology, regarding permissible global patterns of support or justification among
beliefs. We have included an important discussion of methodology, invoking the contrast
between propositional and first-order logic as a case study, in order to highlight the
virtues of simplicity in formal modeling. Ours is promised to be an account of belief
change under judiciously chosen simplifying assumptions that nevertheless allow a rich
structure to come into focus, and challenging problems to emerge. The chapter ends
with summaries of the chapters, of which this summary is the summary of this chapter.
We shall not seek here to summarize the ensuing summaries; instead we shall simply
summarize the ensuing chapters.
Now we foreshadow what we try to accomplish in the remaining chapters, for the
reader who is a victim of the Chapter Syndrome, a condition even more acute than the
Chapter Syndrome of the Preface.

Part I: Computational Considerations

. Computing Changes in Belief
We introduce the reader to the basic ideas involved in our formal modeling of belief
schemes as finite dependency networks. The formal constituents are introduced in such
a way as to emphasize the epistemological motivation for having them in the picture.
Beliefs are represented by (structureless) nodes, which are arranged in steps that transmit
justificatory support. We lay down Axioms of Configuration specifying exactly the general
structural features of a finite dependency network. The following coloration convention
is adopted: nodes that represent current beliefs are black, while all others are white. It
is useful to color the inference strokes of steps in this way too: a thick black inference
stroke shows that the step in question is transmitting justificatory support; while a pair
of thin parallel strokes with white space between them shows that the step is not doing
so. (The premises of that step have been uncoupled from its conclusion, so to speak.)
We lay down Axioms of Coloration that ensure a correct epistemological interpretation
of an equilibrium state of a network. The coloration convention allows one to make
vivid the necessary and permissible Action Types when propagating changes in belief.
The changes are always made locally, with the continual aim of correcting violations of
the Axioms of Coloration as these arise during the process of change in question. The
changes can be initiated either by adopting a new belief (expanding), or by surrendering
an old one (contracting). With expansion, a constraint we call Black Lock is in place;
with contraction, the corresponding constraint is White Lock. These Locks dictate what
corrections are called for in response to each kind of violation of an Axiom of Coloration.

30

INTRODUCTION

We work through many small examples to impart a thorough and vivid understanding
of the dynamics of belief change, using these conventions.

. Global Conditions on Contraction

We distinguish among three different formal explications of a system of belief: axiomatic
bases; logically closed theories; and a kind of system intermediate between those two,
called a finite development. We get the reader argumentatively used to the idea that every
system of belief is finite. We also introduce the important idea that a system of belief
is characterized by appeal to the justificatory pedigrees that it furnishes for the beliefs
within it. There is more structure to a system of belief than can be read off from the list
of individual beliefs within it. These considerations point to finite developments as the
best formal representation of rational agents belief systems. We raise again the problem
of a much-needed explication of the notion of minimal mutilation when contracting a
system of belief upon surrendering any belief within it.

. A Formal Theory of Contraction

This is the heart of the formal theory. Mathematically rigorous definitions are provided
of all the formal notions that have been gently introduced in the earlier discussion. The
main data type of a step is defined, and the central concept of a dependency network is
defined in terms of steps. We are then in a position to explicate the concept of a minimally
mutilating contraction. We motivate our interest in the computational complexity of
the contraction problem by thoroughly surveying known results about the (sometimes
horrendous) complexities of various other decision problems of a logical nature. This is
in order to provide a context within which our own complexity results for contraction
should strike the reader as both interesting and welcome. The contraction problem is
rigorously characterized, including the hard version that involves the (now precisely
explicated) desideratum of minimal mutilation. The simplest version of the contraction
problem is shown to be NP-complete; the harder version, involving minimal mutilation,
is shown to be at just the next level up in the so-called polynomial hierarchy.

. Specification of a Contraction Algorithm

We explain the concept of a greedy algorithm, and provide four successively less-greedy
versions of a contraction algorithm. Here, the earlier work familiarizing the reader
with dependency networks and their coloration conventions is key. We discuss further
possible sophistications of our approach, which would involve relaxing some of our
simplifying assumptions: (i) making use of information about relative entrenchment of
beliefs; (ii) being able to give up transitional steps among beliefs, in addition to beliefs
themselves; and (iii) weakening the degree of support that the premises of a step afford
its conclusion, so that it is probabilistic rather than apodeictic. The fourth version of our
algorithm addresses (i).

C H A P T E R - B Y- C H A P T E R F O R E S H A D OW I N G S U M M A RY

31

. A Prolog Program for Contraction

Here we do something unusual: we state all the details of a Prolog program, for the simplest version of our contraction algorithm. Details of programs are hardly ever disclosed
in books (or articles) in AI. Usually, the reader has to take on trust authors claims about
what their computer programs have actually accomplished, or how they generally behave
on various problem sets, because the authors never reveal any details of the programs
they (or their graduate students) might have written. The present author composed this
Prolog program himself, and it actually works (at lightning speed, one might add) in a
beautifully thorough fashion on a wide range of contraction problems in the literature.
The various modules of the program are laid out and explained.

. Results of Running our Program for Contraction

We give the results of running our program on various problems specifically designed
to test whether the program is a correct implementation of the algorithm, and whether
the algorithm has itself been correctly specified. The problems are simple enough for the
reader to be able to make well-educated, intuitive guesses as to the possible outcomes,
and then see those very outcomes corroborated by a run of the program.

Part II: Logical and Philosophical Considerations

. Core Logic is the Inviolable Core of Logic
We give a novel argument for the inviolability of the principles of Core Logic. This is very
anti-Quinean. If any of those principles were to be surrendered, then the rational agent
would not be able to undertake the operations that are required in the process of rational
belief change. The argument turns on the requirement of a certain reflexive philosophical stability. The argument is completely novel, and possible to advance only within
the context of the account of rational belief change offered here. The author regards
this argument as rounding out, and completing, the many-faceted casephilosophical,
mathematical, computational, and, now, revision-theoreticfor the correctness of Core
Logic (also known, and described in his earlier publications, as intuitionistic relevant
logic). The present argument, to the effect that the principles of Core Logic are indeed
the core principles of logic, justifies this attractive change of name for the logical system
in question.

. The Finitary Predicament

We provide further argument justifying the claim that our use of finite dependency
networks entails no loss at all of theoretical generality, as far as belief revision on the
part of rational creatures is concerned. Some basic concepts in mathematical logic are
defined, to lay the groundwork for the metatheorem, due to Harvey Friedman, that is
proved in the next chapter.

32

INTRODUCTION

. Mathematical Justifications are Not Infinitely Various

We give a suitably texturized proof of a deep result in mathematical logic by the authors
colleague Harvey Friedman, which was produced at the request and behest of the author.
It states that every extant mathematical theory (by virtue of satisfying a very general
characterization of possible forms of axiomatic presentation) provides, for each of its
theorems, at most finitely many logically distinct choices of axioms from which it can be
proved. This further bolsters our philosophical argument for the theoretical adequacy of
a finitary approach to the problems of belief revision.

Part III: Comparisons

. Differences from Other Formal Theories
We compare and contrast our account with three other major formal accounts of belief
revision: AGM-theory; Justified Truth-Maintenance Systems; and Bayesian networks.
We have both critical and constructive things to say about these competing accounts.
This discussion should serve to situate our work for the reader in mathematical logic,
AI and/or computing science.

. Connections with Various Epistemological Accounts

We survey the relevant recent literature in epistemology with two aims in mind. First, we
wish to show that our account of belief revision is orthogonal to, or invariant across, the
different ways in which ongoing epistemological debates might be resolved, concerning
such matters as the role of experience in founding justifications, and the permissible
global patterns of justificatory support (foundationalist, coherentist, or foundherentist?).
Secondly, we wish to show how compatible our new account of belief revision is with
various important epistemological accounts that touch on the topic of belief revision,
albeit not in any great logical or computational detail. To this end, we examine the
writings of Sosa, BonJour, Cornman, Haack, Levi, Quine and Ullian, Harman, Klein, and
Gupta. This discussion should serve to situate our work for the epistemological reader.

C H A P T E R - B Y- C H A P T E R F O R E S H A D OW I N G S U M M A RY

33

This page intentionally left blank

PA RT I

Computational Considerations

This page intentionally left blank

CHAPTER 2

Computing Changes
in Belief

his chapter illustrates a method for computing contractions and

expansions of a system of belief, and shows how it yields intuitively correct results for a range of interesting examples from the belief-revision
literature. (The reader must bear in mind that revising with respect to p involves
first contracting with respect to p, and then expanding with respect to p.)
We lay down some simple and elemental rules for changing the doxastic status of nodes in a belief network, and formulate two local constraints governing
the respective processes of contraction and expansion. These rules and local
constraints form the basis of an easily implementable algorithm for belief revision. The treatment in this chapter is intended to be a more accessible and vivid
introduction to the formal ideas developed in Chapter , which investigates the
computational complexity of the contraction problem, and in Chapter , which
specifies detailed algorithms.
The reader will here be encountering, for the first time, the materials and
methods we propose for a more formal treatment of belief systems and the ways
one ought to change them. We shall therefore take pains to explain the epistemological interpretation of all the formal elements as these are introduced.
Once the reader has been familiarized with the epistemological interpretations
of nodes, steps and networks, we shall be able to discuss matters more consistently in formal mode. The computational theorist ought to bear in mind

COMPUTING CHANGES IN BELIEF

37

that the epistemological explanations of our modeling are offered only in order
to motivate our formal concepts. The formal material itself, however, when
considered in its own right, independently of the epistemological interpretations, is mathematically (or combinatorially) concrete enough to allow one to
pose, and to solve, questions about the computational complexity of contraction
problems.
A dependency network is a useful formal representation of a rational agents
belief scheme. We shall now introduce local features of dependency networks,
for which we shall provide diagrams. Our diagrams are designed to represent
sentences believed (black), sentences not believed (white), and justificatory
steps involving such sentences, mediated by inference strokes. The idea of
including inference strokes as integral parts of a diagram of dependencies (of
conclusions on sets of premises) is taken from Chapter , Graph Arguments,
of the pioneering work of Shoesmith and Smiley [] in multiple-conclusion
logic. Even though we are not here contemplating steps with multiple conclusions (see below), the use of inference strokes within our diagrams affords a
structural clarity that has proved to be indispensable in our dealing with the
problems of contraction and revision of belief schemes.

2.1 Nodes and steps

2.1.1 Nodes
We intend to explain how a rational agent can take old beliefs out of her belief
box, and put new beliefs into it. We shall use black nodes for sentences expressing
propositions that are believed, and white nodes for sentences expressing propositions that are not believed (by the agent in question). Remember, not believed
covers two cases: disbelieved and neither believed nor disbelieved. The belief box,
therefore, contains exactly the black nodes. It also contains all the justificatory
steps by means of which these nodes inherit the status of justified beliefs (for
the agent in question).
It is important to have a record, however, of all steps (known to the agent) that
would justify their conclusions, provided only that their premises were justified
(for the agent). In order to stress the presence of these justificatory steps (actual
and would-be), we prefer to use the phrase belief scheme. The agents belief
scheme contains her belief box, and possibly morenamely, steps of the kind

38

COMPUTING CHANGES IN BELIEF

just mentioned. We need to have an eye not only on the nodes that are involved
but also on the steps that connect them.
We need, henceforth, to be relieved of the obligation to keep putting in the
parenthetical riders (for the agent in question). So the reader is put on notice
that all of our modeling is thoroughly agent-centric. That said, we shall still insert
an occasional reminder to this effect.
Note that not believing a proposition p does not entail believing its negation
p, i.e. disbelieving p. A proposition that is not believed can be moot or undecidedneither believed nor disbelieved.
We shall henceforth permit ourselves the solecism believing a sentence.
Black means in and white means out, as far as the belief scheme is concerned.
We do not need to distinguish between sentences that are neither believed nor
disbelieved, and sentences that are disbelieved. Both these kinds of sentence are
considered out, and would be rendered white.

2.1.2 Initial steps

If a sentence or proposition a is believed without need, as far as the agent is
concerned, for any justification, then a is the conclusion of an initial step:

With this initial step we have a black inference stroke sending out an arrow to
the black node labelled a. No arrows come into the inference stroke in question;
and this indicates that a (from the agents point of view) may be, and is, believed
outright. Call a stroke that receives no arrows a starting stroke.
Epistemologists are divided on the question of what kind of belief may serve
as an initial belief for a rational agent, especially if one requires the agents
belief scheme to exhibit a foundationalist structure. The safest and least controversial examplesat least for one whose commonsense intuitions survive
exposure to the problem of skepticismare simple observation reports, such
as that is a brown penny. As the old adage has it, seeing is believingeven if,
in response to the skeptic, one needs to emphasize how such simple knowledge
claims can be corroborated by bringing to bear other sensory modalities, such as
touch.

NODES AND STEPS

39

2.1.3 Transitional steps

Consider a step from the premise set {b , . . . , bn } to the (distinct) conclusion a.
This is what we call a transitional step. Here, we prescind from the status of the
nodes and of the inference stroke, as white or black, and color them neutrally
in gray. The transitional step
b1

. . . bn

carries the logical interpretation (for an agent who adopts the step)
if one is justified in believing each of b1 , . . . , bn ,
then one is justified in believing a.

This inferential interpretation could be written as the natural-deduction inference

Jb . . . Jbn
Ja
where J means one is justified in believing .
If a sentence a is believed on the basis (as far as the agent is concerned)
of other beliefs b , . . . , bn , then all the nodes of this transitional step, and its
inference stroke, are black:
b1

. . . bn

With this transitional step we have the black inference stroke receiving arrows
from (exactly) the black nodes labeled b , . . . , bn , and sending out an arrow
to the black node labeled a. It is by means of its inference stroke that a step can
be identified. For, given the inference stroke, one determines the premises of the

40

COMPUTING CHANGES IN BELIEF

step as those nodes that send arrows to the inference stroke; and one determines
the conclusion of the step as the sole node to which the inference stroke sends
an arrow.
It may come as a surprise to the reader to learn that a node can be the
conclusion both of an initial step and of a transitional stepwe shall have more
to say about this feature in Section ...
Transitional steps are not all confined to the agents belief box. Put in terms
of our chosen coloration convention: it is not necessary that all transitional
steps known to the agent should have black inference strokes; some of them
could be white. The agent could be apprised of a deductive transition, say, from
b , . . . , bn to a, without believing a. This would entail that the agent (whom we
are assuming to be rational) would not believe all of b , . . . , bn . Suppose for
the sake of illustration that she does not believe either a or b but does believe
b , . . . , bn . Such a step would be rendered in black and white as follows:
b1 b2

...

bn

Note that the inference stroke is white, as indicated by the white space created
between the two thin parallel lines in place of what would otherwise be a
single inference stroke. This notation is suggestive also of a decoupling of the
premises from the conclusion, showing that the latter does not acquire support
from the former (collectively), since not all of them are black. The whitening
of the inference stroke does not mean that the agent has come to doubt the
inference concerned. Rather, it means that this inference is not responsible for
the agents belief in the conclusion a (should she indeed happen to believe a).
For, even though the step is still (as far as the agent is concerned) justificatorily
valid, it fails to confer belief on a because not all its premises are believed. This
would continue to be the case even if a were believed, but on the basis, say, of
other beliefs c , . . . , cm . In such a case the previous diagram would continue to
contribute its white inference stroke, but the node for a would be black, on the
strength of the black inference stroke transmitting the support of c , . . . , cm , all
of which are black:

NODES AND STEPS

41

b1 b2

...

bn

c1

...

cm

Note that the sets {b , . . . , bn } and {c , . . . , cm } are not required to be disjoint.

The diagram above happens to show these sets as disjoint; but that feature is
not essential. What the foregoing diagram represents is that, for the agent in
question,
1. if she were to believe all of b1 , . . . bn with justification, then she should take
herself to be justified in believing a (but, since she does not believe b1 , this
transitional step does not at present provide her with any justification for belief
in a); and
2. if she were to believe all of c1 , . . . cm with justification, then she should believe a
(and, since she does believe all of c1 , . . . cm with justification, she does similarly
believe a).

The two premise sets could, in general, have members in common. All that is
required, for any node a, is that each of two distinct premise sets of steps with
conclusion a should have a member that is not in the other premise set. That
entails, in particular, that neither set may be included in the other (more on this
below). We can call two such sets non-inclusively distinct.
In this and subsequent chapters, such an inference (with n ) will be taken
to enjoy an inviolable status, for the agent in question. Unlike initial beliefs (for
which n = ), such an inference is not one that an agent will be able to give
up, once she has adopted it (once she concurs with the transmission of justification that it represents for her). This means that the step (from {b , . . . , bn }
to a, where n ) remains in the agents inferential base forever, once she has
acquired it. Unlike its propositional nodes, such a step cannot be given up. The
agent might surrender her belief in a, and therefore also in at least one of the
premises b , . . . , bn ; she would not, however, expunge the step itself from her
accumulated base of such steps. (It is worth reminding the reader that this
means that we cannot, at this stage of our investigations, offer a formal account
of any process of revising ones logic. But the basic account could eventually be
extended so as to deal with such revision.)
42

COMPUTING CHANGES IN BELIEF

This distinction that we are proposing to make between a step and its nodes
(as to their revisability for the agent) is a methodological one, with the aim of
simplifying the modeling for the time being. We maintain it for as long as we
can, in our attempt to model the process of rational contraction and revision
of belief schemes. One can think of the set of steps adopted by a given agent
as forming a sort of jungle gym of fixed connections among nodes. The nodes
that are believed will be colored black; all other nodes will be colored white. It
is possible that at any given time many nodes are white.
Contractions and revisions involve changes in patterns of coloration only.
They do not involve adding to, or destroying any part of, the agents jungle
gym of justificatory steps (her inferential basis). In terminology to be introduced below, the structure of nodes and of steps connecting them remains
constant, while the coloration of the nodes (and of the steps inference strokes)
may change.
It lies beyond the scope of this work to inquire into the possibility of making
steps themselves eligible for expulsion or elimination from an inferential basis.
This will probably bring with it the prospect of drastic changes taking place
within a belief scheme. Thus, many steps in a single agents scheme can be
there by virtue of a common form that the agent has descried. (Instances of
inductive or certain deductive rules of inference serve as an example here.)
Presumably, the expulsion of any one step of such a form would require the
expulsion of all the other steps of that same form. For, if each of them is in
the agents scheme by virtue of its having a certain form, what could rationalize
holding on to any one of them, once one of them has been given up? If we make
a particular transition in thought only on the basis of its form, we always blame
the form if the transition is found to be in error. And we subsequently mistrust
all transitions of that form, whose correctness was once supposed to consist in
their having the form in question. These considerations reveal both the power
and the potential frailty of formal transitions. The revealed defectiveness of any
one instance of that form discredits the form itself as a basis for confidence in
any other of its instances.
Of course, any step {b , . . . , bn }, therefore a:
b1

. . . bn

NODES AND STEPS

43

can be rendered absolutely invulnerable (for the agent) by encoding the transition it represents as the extra premise (b . . . bn ) a, thereby ensuring
that the resulting (n+)-premise step is logically necessary:
b1

. . . bn

(b1 . . . bn) a

What this means is that the agent has packed into the sentential belief
(b . . . bn ) a
the burden of justificatory transmission of the erstwhile n-premise step. The
new step with (n+) premises, being core-logically valid, will be inviolable for
any rational agent. Core logic is a very special subsystem of intuitionistic (hence
of classical) logic. We shall be arguing that it is the part of logic that cannot
rationally be revised, if we wish to maintain a certain reflexive stability for the
whole enterprise of rational belief revision. We shall be returning to this theme
in Chapter . The core proof of the (n+)-premise step involves multiple steps
of -Introduction (to take one from b , . . . , bn to b . . . bn ) followed by
a step of -Elimination with (b . . . bn ) a as its major premise. Both
-Introduction and -Elimination are rules of Core Logic.
We adopt the rational simplification that if the step from {b , . . . , bn } to a is
known to the agent, then she will not know of any step to a from any proper subset of {b , . . . , bn }. This is because the agent, being rational, will be concerned to
remember only steps with premise sets that are (as far as she can tell at the time)
inclusion-minimal in justifying the conclusion. Why should any rational agent,
after all, bother to remember any dilution, or weakening,1 of a step of which
she is already apprised? If she already knows that a follows from b alone, why
should she bother to bear in mind the diluting step from {b , b } to a? In the
interests of efficiency, and economical use of resources, she should undertake to
remember only the stronger step, which uses the reduced set {b } of premises.
The foregoing rational simplification does not ensure, however, that every
step {b , . . . , bn }, therefore a known to the agent really needs all its premises

44

Logicians will recognize this borrowing of terminology from Gentzens sequent calculi.

COMPUTING CHANGES IN BELIEF

in order to be valid, or justificatory (in the appropriately objective, agentindependent sense that attaches, say, to logical validity). The simplification is
only that she does not know of any step that would be justificatory by her
own lights for the conclusion a, and that makes do with some proper subset of
{b , . . . , bn } as its premise set. Suppose, however, that, unknown to the agent,
the subset {b , . . . , bn } furnishes adequate logical support for athat there is a
logical proof of the sequent {b , . . . , bn }, therefore a. Then, as it happens, she
might contract with respect to a in a strategically disastrous way, by surrendering b and thinking (mistakenly) that she had thereby done enough to ensure
that a could not be justified by appeal to such beliefs as remain in her belief
scheme. In the subjective, agent-relative sense, she is right; for, ex hypothesi, she
does not know of any justificatory transition from {b , . . . , bn } to a. Her continuing belief in b , . . . , bn , as it happens, logically commits her (in the appropriately
objective, agent-independent sense) to belief in abut she does not know that.
In such a case we cannot hold the agent accountable to the external, objective,
transmission of warrant, for she does not know of it. From within her own
perspectiveby her own lights, as we have been sayingshe has done enough,
in giving up b , to neutralize the step {b , . . . , bn }, therefore a in the role it
had played in her earlier belief scheme. While the belief a could be justified (by
external standards) by appeal to such beliefs as remain in her belief scheme, it
cannot be justified by the appropriately internal standards, which involve appeal
only to such steps as are known to the agent.
Rational agentslogical paragonsare constantly hostage to the historical fortune of discovery of proofnot its mere Platonic existence. All we can
demand of paragons is that they carry out their contractions and revisions in a
rational fashion in accordance with what they already know of logical relations
as a result of their past discovery of proofs.
Given any set of premises {b , . . . , bn }, and conclusion a, there can be only
one inference stroke mediating the step from {b , . . . , bn } to a. (For the transition is a matter of those premises supporting that conclusion.) This means that,
in the formal modeling presented in Chapter , the step can be represented as
the set
{{b , . . . , bn }, a}.
This extensionality condition on steps has its diagrammatic counterpart: any
two distinct inference strokes receiving arrows from exactly the same nodes
must send their single outgoing arrows to respectively distinct nodes. Remember, every inference stroke sends out exactly one arrow (that is, all steps are
NODES AND STEPS

45

single-conclusion steps). Treatment of the multiple-conclusion caseeven if it

happens to be both useful and possibleis beyond the scope of this book.

2.2 Axioms for a belief network

2.2.1 Axioms of Configuration
We may accord both nodes and inference strokes a kind of equality of consideration by taking them as forming a two-sorted system, or network. Each of
its elements is either a node or a stroke, but not both. Furthermore, there is a
binary relation Axy, which we can read picturesquely as x sends an arrow to y
without thereby quantifying over arrows as objects. Instead of saying x sends
an arrow to y, one could say x points at y. This would help to curb the mistaken
tendency to reify the arrows. But we shall continue to speak of arrows rather
than pointing, on the understanding that the reader will not take the arrows to
be individuals in the domain of discourse. The only individuals are the nodes
and the inference strokes.
The relation Axy satisfies certain constraints, as expressed in the following
Axioms of Configuration. These axioms determine the possible arrangements
of nodes and strokes, connected by arrows, into a dependency network. The
mathematically minded reader can think of these axioms as like the axioms for
some kind of algebra, which determine the possible arrangements of elements,
in terms of various operations or orderings, in algebras of the kind in question.
(One could think here of groups, or lattices, or directed graphs, for example.)
As with such algebras, dependency networks can vary in size, and, even within
one size, can fall into many different isomorphism classes.
To repeat: the individual elements within a dependency network are
nodes and inference strokes. There is a single binary relation among them
represented in our diagrams by the arrowswhich satisfies the following
axioms. This means that the arrows themselves are not elements of the dependency network. Rather, they are a diagrammatic means of representing the
structure among the elements. Note that these Axioms of Configuration do not
carry any direct epistemological interpretation. Rather, they serve to characterize dependency networks made up of nodes, inference strokes and arrows,
within which the various steps (initial or transitional) can be given an epistemological interpretation.
46

COMPUTING CHANGES IN BELIEF

1. Everything is either a node or a stroke.

x(Nx Sx)
2. Nothing is both a node and a stroke.
x(Nx Sx)
3. Strokes send arrows only to nodes.
x(Sx y(Axy Ny))
4. Nodes send arrows only to strokes.
x(Nx y(Axy Sy))
5. Every stroke sends an arrow to exactly one thing.
x(Sx yz(y = z Axz))
6. Arrowing is one-way.
xy(Axy Ayx)
7. If two strokes send arrows to any same thing, and the things from which one of
them receives arrows are among those from which the other receives arrows,
then those strokes are identical.
xy((Sx Sy) z((Axz Ayz) (w(Awx Awy) x = y)))
8. Every node receives an arrow.
x(Nx yAyx)

These axioms specify, as it were, the geometry or connectivity of a dependency

network consisting of nodes and inference strokes connected by arrows. The
formal theory of such networks will be developed in Chapter .
A consequence of (), () and () is
(a) Strokes receive arrows only from nodes: x(Sx z(Azx Nz)).
Proof. A sequent proof in Core Logic is set out below. (For the formal statement
of the rules of the sequent calculus for Core Logic, see Section ...)

A X I O M S F O R A B E L I E F N E T WO R K

47

Nb : Nb
Sb : Sb
Nb , Sb : Nb Sb
Acb : Acb Nb , Sb : x(NxSx)
Sc : Sc

Acb Nb , Acb , Sb : x(NxSx)

y(AcyNy) , Acb , Sb : x(NxSx)

Sc y(AcyNy) , Sc , Acb , Sb : x(NxSx)

x(Sxy(AxyNy)) , Sc , Acb , Sb : x(NxSx)
Nc : Nc x(Sxy(AxyNy)) , Sc , Acb , Sb , x(NxSx) :
Nc Sc , x(Sxy(AxyNy)) , Acb , Sb , x(NxSx) : Nc
x(Nx Sx) , x(Sxy(AxyNy)) , Acb , Sb , x(NxSx) : Nc
x(Nx Sx) , x(Sxy(AxyNy)) , Sb , x(NxSx) : Acb Nc
x(Nx Sx) , x(Sxy(AxyNy)) , Sb , x(NxSx) : z(AzbNz)
x(Nx Sx) , x(Sxy(AxyNy)) , x(NxSx) : Sb z(AzbNz)
x(Nx Sx) , x(Sxy(AxyNy)) , x(NxSx) : x(Sxz(AzxNz))
A similar proof shows that a consequence of (), () and () is
(a) Nodes receive arrows only from strokes: x(Nx z(Azx Sz)).
Note that Axiom () is a stronger condition even than extensionality for steps
of inference that are identified by their inference strokes. Ordinary extensionality is the condition that steps of inference are identical if they have the same
premises and the same conclusion. Axiom () implies ordinary extensionality,
and goes further. It implies that if one has a step of inference involving certain
premises and a conclusion, then no other step with the same conclusion can
involve all those premises. Thus, steps of inference are in a sense as strong as
possible, in that their premise sets are inclusion-minimal.
The effect of our Axioms of Configuration is that we can model a step of
inference in general as a pair
{{a , . . . an }, b},
resting assured that its premises a , . . . an and conclusion b are all nodes. For
a step of inference can be thought of as being represented by a stroke receiving arrows from its premises a , . . . an and sending an arrow to its (unique)
conclusion b. In the set-theoretic representation, there is no element corresponding to the stroke itself; rather, the step is identified simply by citing its
(set of) premises and its conclusion. Nor, in the set-theoretic representation,
are there any elements corresponding to the arrows in our diagrams. Our
diagrams introduce strokes as explicit visual elements; and in our two-sorted
48

COMPUTING CHANGES IN BELIEF

axiomatization at first order, the strokes are also treated as individuals in the
domain. But not even the two-sorted axiomatization at first order treats the
arrows of the diagram as individuals. Rather, the arrows collectively represent
the extension of the binary relation A among nodes and strokes.

2.2.2 Axioms of Coloration

One can think of a colorless dependency network as fixed, and consider how its
nodes and inference strokes might then be colored (black or white). The axioms
constraining this can be called Axioms of Coloration. We shall concentrate here
on four in particular. (See below for another two candidates, which on closer
analysis turn out to be superfluous.)
1. Every black node receives an arrow from some black inference stroke.
x((Bx Nx) y(By Sy Ayx))

Epistemological interpretation: A rational agent can take herself to believe a

particular proposition with justification (so that we can take the corresponding
node to be black) only if that proposition is the conclusion of a justifying step
(whose inference stroke is accordingly black). In the degenerate case, the node
in question is an initial belief, and the black inference stroke from which it
receives an arrow does not itself receive any arrows from other (black) nodes. In
the non-degenerate case, the node in question is the conclusion of a transitional
step, and the black inference stroke from which it receives an arrow receives
arrows from the (black) nodes that are the premises for that step.
2. Every white node receives arrows (if any) only from white inference strokes.
x((Wx Nx) y(Ayx (Wy Sy)))

Epistemological interpretation: A rational agent can fail to believe a particular

proposition only if it is not the conclusion of any justifying step all of whose
premises she believes. Thus, any step of which the proposition in question is
the conclusion has a white inference stroke (signifying that not all the premises
of that step are black).
3. Every black inference stroke receives arrows (if any) only from black nodes.
x((Bx Sx) y(Ayx (By Ny)))

Epistemological interpretation: A black inference stroke signifies that the

step in question is transmitting justification from its premises to its conclusion
(whence all those premises are black).
A X I O M S F O R A B E L I E F N E T WO R K

49

4. Every white inference stroke that receives an arrow receives an arrow from some
white node.
x((Wx Sx zAzx) y(Wy Ny Ayx))

Epistemological interpretation: A white inference stroke signifies that the step

in question is failing to transmit justification from its premises (if it has any) to
its conclusion. If there are no such premises, the white inference stroke signifies
that the conclusion node is not (at present) believed outright. If there are such
premises, then not all of them are black; so at least one of them is white.
Why the qualification that receives an arrow in Axiom ()? Why not a
simple analogue of Axiom (): Every white inference stroke receives an arrow
from some white node? The answer lies in the need to deal with initial steps.
These represent beliefs that are believed outright, without depending on any
other beliefs for their justification. An initial belief is to be represented in our
diagrams as a black node receiving an arrow from a (single) black inference
stroke that does not receive arrows from any nodes. If such a belief is ever given
up, the node is whitened, and so is its associated inference stroke. The resulting
situation would falsify the simple analogue of Axiom (). Hence the need for
the aforementioned qualification.
Every node and inference stroke is either black or white, but not both.
Strictly speaking, this would need to be stipulated as well. We could adopt the
further two coloration axioms
1. Everything is black or white
x(Bx Wx)
0. Nothing is both black and white
x(Bx Wx)

() would be informative only if other colors could be in contention. () is

simply an analytic truth about color, if the coloring is taken literally.
We have chosen to indicate which beliefs the agent holds by exploiting
a dichotomous coloration of the nodes, limiting our palette to just black
and white. We have chosen black for believed, and white for not believed.
This choice is of course entirely conventional. Any symbolically represented
dichotomy would do. We could instead choose the predicate B(x) to encode,
not x is black, but x is believed; and then we could replace the predicate W(x)
50

COMPUTING CHANGES IN BELIEF

(x is white) with B(x). If we take this course, then Axioms () and () would
become, respectively,
1B . Everything is either black or not black
x(Bx Bx)
0B . Nothing is both black and not black
x(Bx Bx)

So on this approach (B ) comes out as an instance of the Law of NonContradiction, and (B ) comes out as an instance of the (classical) Law of
Excluded Middle for monadic predicates. The latter does not offend against
intuitionistic scruples, since we readily concede that the predicate B(x) is decidable. It is for this reason that we are not unduly concerned to make special
mention of Axioms () and (). The closer analysis just given renders them
superfluous. We concentrate instead on the other four Axioms of Coloration,
which is where the action is.

2.2.3 Comments on our coloring convention

The reader should bear in mind that in using the two colors Black and White to
represent, respectively, believed (by the agent) and not believed (by the agent),
we are merely enabling ourselves to make matters diagrammatically vivid. It is
much easier to depict, and imagine, changes in color than it is to grasp changes
in abstract status. Our use of color, however, is iconic only: ultimately, Black
represents believed and White represents not believed. All our axiomsthose
of Configuration and those of Colorationcould be re-written, without loss,
using the complex predicate B in place of the primitive predicate W. This
point is worth bearing in mind when we undertake the philosophical task (in
Chapter ) of reflecting on the logical structure and principles involved in the
reasoning by means of which a rational agent (on our modeling) effects the
process of rational belief revision.
There is just one further consideration that inclines us to favor the use of
colorand the deployment of the two primitive predicates B and Win our
diagrams for belief systems and in our theorizing about belief change. It is
that the inference strokes within our diagrams, as well as the nodes therein, are
informatively (and, as it were, functionally) colored. The doxastic interpretation of an inference strokes being black would be something along the lines of
A X I O M S F O R A B E L I E F N E T WO R K

51

is actively transmitting justification, from the premises pointing to it, to the

conclusion to which it points. And the doxastic interpretation of an inference
strokes being white would be something along the lines of is not actively transmitting justification, from the premises pointing to it, to the conclusion to which
it points. Both of these interpretations are rather cumbrous, and we choose to
eschew them, in favor of speaking of both inference strokes and nodes being
either white or black. That enables readier reasoning and manipulation, and
allows one to read off the ultimately doxastic interpretation (of the nodes within
the network) only when processes of change have been completed.
The coloration axioms () and () jointly imply that an inference stroke is
black if and only if all its premises and its conclusion are black. Hence, one
can talk unambiguously of a black step. Every such step is, as it were, wholly
black (premises; inference stroke; and conclusion). It is the black steps that
make up an agents belief scheme at any given time. All other steps (with white
inference strokes) are ones known to the agent (as hypothetical or conditional
justificatory transitions) but not (at that time) serving to propagate belief (i.e.
serving to spread black). All steps with which the agent concurs (as inferences),
whatever the color of their inference strokes, form what we have called the
agents inferential basis.
An important kind of inferential step is one with conclusion (absurdity).
The premises of such a step are thereby (taken by the agent to be) jointly
inconsistent. If ever such a conclusion is black, then the agent believes (what
she herself takes to be) an inconsistency. In rational revision of a belief scheme,
one constant aim would be to avoid having any black nodes labeled . Indeed,
a case could be made for the view that all change in belief is driven by the single
imperative Avoid inconsistency! We shall explore this possibility in Chapter .

2.2.4 Examples of violations of the four main Axioms of

Coloration
A X I O M V I O L AT I O N S W I T H I N A W I D E D I AG R A M M AT I C A L
CONTEXT

Our main Axioms of Coloration ()() rule out the following arrangements.
V I O L AT I O N O F A X I O M ( 1 )

If the only inference strokes sending arrows to a were those shown, then a
should be white, not black, on pain of violating Axiom (): Every black node
52

COMPUTING CHANGES IN BELIEF

receives an arrow from some black inference stroke. The agent is represented as
believing a, but with no active justification or justificatory path leading to a
(that is, with no arrow coming to a from a black inference stroke, even if only
an initial one).
V I O L AT I O N O F A X I O M ( 2 )

Consider now the following configuration:

Here we have a violation of Axiom (): Every white node receives arrows (if any)
only from white inference strokes. It is a failure of closure under known steps.
The agent is represented as apprised of the step from the two premises to the
conclusion, as believing the premises (black) but as not believing the conclusion
(white).
V I O L AT I O N O F A X I O M ( 3 )

A simple change of blacks and whites produces our next configuration to illustrate axiom violations:

A X I O M S F O R A B E L I E F N E T WO R K

53

Here we have a violation of Axiom (): Every black inference stroke receives
arrows (if any) only from black nodes. The step is being taken (with black inference stroke and black conclusion) as providing justification for the conclusion;
while yet one of the premises (white) is not believed.
V I O L AT I O N O F A X I O M ( 4 )

Another change of blacks and whites produces our final axiom-violating configuration:

Here we have a violation of Axiom (): Every white inference stroke that receives
an arrow receives an arrow from some white node. It is a failure of closure
(downwards) under a known step. The premises are believed, and the step is
known. So the inference stroke should be black, and the conclusion should
be too (since, by the agents own lights, it is to be believed). Alternatively: it
is a failure of closure (upwards) under a known step. The conclusion is not
believed, and the step is known. So at least one of the premises should not be
believed.
Which of these two alternatives prevails will depend on whether one is busy
expanding or contracting the belief network. If expanding, the former alternative prevails; if contracting, the latter one prevails. This is not merely a case of
one agents modus ponens being another agents modus tollens. Rather, the fix
for the violation will depend on the agents purposes at the time.
Similar remarks apply to the violation of Axiom () above. The fix in each of
these cases will depend on whether one is intent on spreading black (expanding) or on spreading white (contracting).
A X I O M V I O L AT I O N S W I T H I N A N A R ROW E R
D I AG R A M M AT I C A L C O N T E X T

The diagrams in Section .. actually show more structural details than is

absolutely necessary in order to picture the violations in question. This happened because of a natural preference to include within any diagram only nodes
54

COMPUTING CHANGES IN BELIEF

as its topmost elements and only nodes as its bottommost elements. Here, we
shall repeat the exercise of picturing the four possible violations, but focus on
a narrower diagrammatical context in doing so. We shall display only those
fragments of diagrams that exhibit the violations. In doing so, we shall allow
inference strokes to appear either as topmost or as bottommost elements of
diagrams.
Here now are the same axiom-of-coloration violations as before, but pictured
more economically.
V I O L AT I O N O F A X I O M ( 1 )

all white
...

Here we have a violation of Axiom (): Every black node receives an arrow from
some black inference stroke.
V I O L AT I O N O F A X I O M ( 2 )

Here we have a violation of Axiom (): Every white node receives arrows (if any)
only from white inference strokes.
V I O L AT I O N O F A X I O M ( 3 )

...

...

Here we have a violation of Axiom (): Every black inference stroke receives
arrows (if any) only from black nodes.
A X I O M S F O R A B E L I E F N E T WO R K

55

V I O L AT I O N O F A X I O M ( 4 )

al l black
...

Here we have a violation of Axiom (): Every white inference stroke that receives
an arrow receives an arrow from some white node.

2.3 Spreading white v. spreading black

In the violations of Axiom () and of Axiom () we saw failures of closure.
Our requirement of closure in the context of dependency networks is not as
demanding as that of full logical closure. We are not requiring our rational
agent (the paragon of Section .) to believe every logical consequence of what
she believes. Rather, we are requiring only that she believe the consequence
of any step known to her, whenever she believes all the premises of that step.
(This requirement, by iteration, entails that her beliefs must be closed under
the steps known to her.) We can think of the belief system as made up out of a
black kernel of believed nodes featuring in a class of transitional steps known
to the agent. Here is an example each of whose transitional steps involves only
two premises:

Diagram A

56

COMPUTING CHANGES IN BELIEF

The white steps (identified by having white inference strokes) are known to the
agent, but cannot contribute to the closure of her belief system (the black nodes).
This is because with a white step, the agent does not believe all its premises: at
least one premise is white. All it takes is one non-believed premise to render
a known step irrelevant for purposes of closure. Thus, even if a white step
has some black premises, its conclusion will still be white (unless the node in
question stands also as the conclusion of some other step, all of whose premises
are black).
With belief systems represented this way, the problem of contraction is particularly vivid. Suppose someone points to a black node, and orders that it be
changed to white. In other words, the agent is being told to suspend that belief.
All the transitional steps are to remain in place; only the colors of nodes and
inference steps are to change (as a result of compliance with this order). How
should such changes be effected? The agent must seek to minimize the spread
of white, and salvage a maximal amount of black.

2.3.1 Spreading white: the White Lock constraint

S P R E A D I N G W H I T E U P WA R D S

The result of spreading white must conform to Axioms ()(). Moreover, the
process will be subject to the following overarching constraint:
[White Lock] Do not make anything white black.

The constraint is in place because we are concerned, with contraction, only with
cases where the agent has to give up certain beliefs, and not take on any new
ones.
The basic actions that can or must be taken in this process are of the following
Action Types:
Action Type . A black node that is initial (i.e. believed outright) can be made
white, and made to stand unsupported by any (black) inference stroke above it:

If a were an observation report (this is a brown penny, for example) one could
imagine the agent ceasing to believe a upon discovering, say, that the lighting
conditions had been abnormal.
S P R E A D I N G W H I T E V. S P R E A D I N G B L AC K

57

This way of representing the change conveniently assimilates the initial case
to the general case where the node a might be justified by at least one set of other
nodes (possibly even: a plurality of such sets). See Section .. for further discussion of this possibility. As already remarked in Section .., calling a node
initial does not mean that it cannot also stand as the conclusion of a justifying
step involving other nodes. In Section .. we shall say more about this.
Note that the reverse of Action Type is not an option during a contraction
process. Contraction has only to do with surrendering beliefs, not adopting
them. The constraint White Lock on contractions makes this explicit.
Action Type . This type of action modifies a diagram so as to move from a situation in which certain epistemic norms are violated to a situation that conforms
with those norms. Here, the norms in question are our Axioms of Coloration,
which ensure that a dependency network can be interpreted as the belief scheme
of a rational agent. A black step whose (formerly black) conclusion (Subdiagram
a) has been made white (Subdiagram b) must have its inference stroke, and
at least one of its premises, made red (Subdiagram c). Subdiagram b is normviolating; but Subdiagram c conforms with the norms.
(this one, say)

choose a premise
for whitening

Subdiagram 2a

Subdiagram 2b

Subdiagram 2c

One has to disable the premise set, in order to prevent the conclusion from
being forced to be black by the step in question. This is called an upward
sweep (of whitening). It is roughly like performing a modus tollens on a known
step. We say roughly like because what is being transmitted back (or up) from
conclusion to premises is not falsity or disbelief, but rather lack of belief. That is
the status represented by a nodes being white.
The only problem is: Which premise do we choose for whitening? Philosophers
call this the QuineDuhem problem.2 Computer scientists will recognize it as
a source of non-determinism of any algorithm for belief-scheme contraction

The problem is really due to Poincar and Carnap as well.

58

COMPUTING CHANGES IN BELIEF

within this formal modeling that we are providing. Note that Subdiagram b
represents the first stage of a (local) contraction process, and does not comply
with Coloration Axioms ()(). Indeed, it violates Axiom (): Every white node
receives arrows (if any) only from white inference strokes. The further whitening
in Subdiagram c rectifies this situation. It does so by whitening the inference
stroke, and the right-hand node shown. Of course, the left-hand node could
have been whitened instead of the right-hand one, to the same effect (compliance with Axioms ()()):
(this one, say)

choose a premise
for whitening

Subdiagram 2a

Subdiagram 2c

Subdiagram 2b

S P R E A D I N G W H I T E D OW N WA R D S

Action Type . A black step (Subdiagram a) any one of whose (formerly black)
premises has been made white (Subdiagram b) must have its inference stroke
made white (Subdiagram c):

Subdiagram 3a

Subdiagram 3b

Subdiagram 3c

Note that Subdiagram b represents the first stage of a (local) contraction process, and does not comply with Axioms ()(). Indeed, it violates Axiom ():
Every black inference stroke receives arrows (if any) only from black nodes. The
whitening of the inference stroke in Subdiagram c rectifies this situation. For, if
one of the premises of a transitional step is white (i.e. not believed), then those
premises do not, collectively, suffice to justify belief in the conclusion. (This
is not to say, however, that there can be no other sufficient justification for the
conclusion in question. It is only to say that this particular step, whose premises
are not all black, does not by itself justify belief in the conclusion.)
S P R E A D I N G W H I T E V. S P R E A D I N G B L AC K

59

Action Type . As we have just observed, the process in () above does not
necessarily entail that the conclusion of the step (call it a) must also be made
white. That is required only when every step (known to the agent) of which a
is the conclusion has a white inference stroke, as in the belief-scheme fragment
illustrated below. Here, we show three inference strokes altogether that send
arrows to node a. These represent three different ways in which the agent could
take herself to be justified, or would be justified, in believing aif only one of
those strokes were black.3 But they are all whitein particular, the one in the
middle. For the strokes on the left and on the right, we omit the premise nodes
that send arrows to them; for the reader is being asked to focus on the step in
the middle, the changing coloring of whose premise and conclusion nodes is
what is salient for our present purposes:

a
Subdiagram 4a

a
Subdiagram 4b

This is called a downward sweep (of whitening). If the belief a has been
deprived of all the justificatory support that it formerly enjoyedthat is, when
every inference stroke sending an arrow to a has been made whitethen a must
be given up (must be made white). Subdiagram a does not comply with our
Axioms ()(); for it violates Axiom (): Every black node receives an arrow
from some black inference stroke. The whitening of node a in Subdiagram b
rectifies this situation.
W H AT C O U N T S F O R C O N T R AC T I O N

When one is contracting a belief system (turning black inference strokes and
nodes to white ones), it turns out that only the steps that are black at the very
beginning of the contraction process are relevant. Put another way, one could,
With this contrast between an agent taking herself to be justified versus actually being justified,
we are indicating that our dependency networks could admit of either an external, objective
reading (regarding matters of epistemic justification) or an internal, subjective reading. In this
exposition, we systematically prefer the latter reading. But it is worth keeping in mind the possibility
that the formalism of dependency networks could be put at the service of a more objectivist
epistemology also. This point was made by Salvatore Florio.

60

COMPUTING CHANGES IN BELIEF

before the contraction process even begins, expunge from the diagram every
white node and white inference stroke, and every arrow leading to or from a
white inference stroke. The absence of these elements will not affect what the
outcome of the contraction process will be. This is because contractions go to
work only on the black part of a diagram, turning some of it to white. And the
considerations that prompt the spread of white within the erstwhile black are
not sensitive to any of the white within the original diagram. Thus, if one were
contracting the (black) belief scheme within Diagram A:

Diagram A

one could begin by limiting ones attention just to the black steps therein:

Diagram A Black

S P R E A D I N G W H I T E V. S P R E A D I N G B L AC K

61

We have labeled three of the nodes a, b and c for the following purposes. Suppose, for the sake of illustration, one were ordered to contract this belief system
with respect to the node a. If one accordingly gives up b, then one obtains the
contraction on the left; whereas if one decides instead to give up c, then one
obtains the contraction on the right:

As the reader can easily verify, each of these contractions is in conformity with
Axioms ()(). Moreover, each counts as a minimally mutilating contraction,
by virtue of being maximally black without blackening the node a, in the following sense:
If one were to extend the blackening in any way within the diagram, then, in making the
result conform with Axioms (1)(4) (under the constraint Black Lock, to be explained
presently), one would be forced to make the node a black again.

The two diagrams above represent the outcomes of two possible spreads of
white emanating from the whitening of a, in pursuit of conformity with Axioms
()() (under the constraint White Lock). All that was relevant for this process
was the original extent of black. The two divergent outcomes reflect the multiplicity of choices that could be made along the way. In the contraction process,
we had some of the original black turning to white, with White Lock in effect.
The nodes and inference strokes that were originally white were irrelevant for
this further whitening. They could not have affected our choices in any way.
The original white nodes and inference strokes do become relevant, however,
as soon as one expands a belief scheme (or any of its contractions) by adopting
new beliefs in such a way as to make any formerly white node become black.

62

COMPUTING CHANGES IN BELIEF

(One would also, thereby, put Black Lock into effect.) This process could well
turn a formerly white inference stroke into a black one, upon all the premises
of the step in question becoming black. In that case, the conclusion of the step
would also become black, and so on.
Consider now the belief scheme in Diagram (i) below, which conforms to
Axioms ()().

a
Diagram (i)

The belief system is to be contracted, say, with respect to its element a. This is
indicated in Diagram (ii), in which a is now whitened. Also, remember that with
contraction the constraint White Lock is in effect.

a
Diagram (ii)

Diagram (ii) violates Axiom (): Every white node receives arrows (if any) only
from white inference strokes. We have to rectify this situation. Two Action Types
are available to do so. We could make a black again; or we could whiten the
inference stroke above a. The first alternative would be, in effect, to abandon the
process of contraction with respect to a supposedly embarked upon. (It would

S P R E A D I N G W H I T E V. S P R E A D I N G B L AC K

63

violate the constraint White Lock on the process of contraction.) So we have

to opt for the second alternative, and whiten the inference stroke above a. This
yields Diagram (iii).

a
Diagram (iii)

Alas, Diagram (iii) violates Axiom (): Every white inference stroke that receives
an arrow receives an arrow from some white node. Again, two alternative Action
Types present themselves: we could make the inference stroke black again,
thereby returning (ill-advisedly) to Diagram (ii), in violation of White Lock; or
we could bite the bullet and whiten one of the premises supporting a. Suppose
we choose to whiten the leftmost premise, b. The result is Diagram (iv.a), which
at last conforms to Axioms ()().

a
Diagram (iv.a)

The initial whitening of a has induced the upward whitening of the inference
stroke above it, as well as the whitening (for Diagram (iv.a)) of the leftmost
supporting premise b. The only black bit of the original diagram that survives
in this contraction is the outright belief in d.
Suppose now that we choose (in Diagram (iii)) to whiten the rightmost
supporting premise d (for the step with conclusion a) rather than the leftmost
supporting premise b. Then we would obtain Diagram (iv.b):
64

COMPUTING CHANGES IN BELIEF

a
Diagram (iv.b)

We point out the alternatives (iv.a) and (iv.b) in order to underscore once
again the phenomenon of non-deterministic choice with our algorithmic
method of contraction. Whenever a conclusion a of a step is being whitened (i.e.
surrendered), and the step has more than one premise, there are correspondingly many ways of inducing upward whitening (from a) at the next stage. One
needs to disable the premise set in question; but, in order to do so, it suffices to
whiten only one of its premises. Moreover, that remark applies to each step (in
the dependency network being contracted) that has a as its conclusion. Hence,
if any of these premise sets overlap, one might consider whitening a common
premise, thereby minimizing the amount of whitening induced. This aspect of
the procedure will be discussed in greater detail in Chapter .

2.3.2 Spreading black downwards: the Black Lock constraint

When a process of expansion is underwayas opposed to one of contraction
it is subject to the following overarching constraint:
[Black Lock] Do not make anything black white.

In order to illustrate this constraint in action, let us return to the stage reached
above in Diagram (iv.a):

a
Diagram (iv.a)

S P R E A D I N G W H I T E V. S P R E A D I N G B L AC K

65

Imagine now that the agent acquires outright belief in the sentence labeled c,
which thus far has been white. We make both the node c and the inference stroke
above c black, to obtain Diagram (v).

a
Diagram (v)

We are not yet done. Diagram (v) violates Axiom (): Every white inference
stroke that receives an arrow receives an arrow from some white node. The rightmost two-premise step is the new culprit: it has black premises (d and c), but
a white inference stroke and a white conclusion. Once again, two alternative
Action Types are open to us. We can whiten one of the premises; or we can
make the inference stroke (and thereafter the conclusion) black. Whitening
either one of the premises is counterproductive. It would violate the constraint Black Lock on the process of expansion. For, if we whiten c, we shall
be abandoning the very expansion begun by the blackening of c. Moreover, if
we whiten the other premise d, we shall not be conserving as much as possible of the original black in Diagram (i). So, we decide (in conformity with
Black Lock) to make the inference stroke, and the conclusion below it, black.
The result is Diagram (vi) below, which conforms to Axioms ()(); so we
are done.

a
Diagram (vi)

66

COMPUTING CHANGES IN BELIEF

2.4 The roles of the white and black parts of a

belief scheme
The foregoing example shows that the process of closure (with respect to known
steps), upon which it is rational to insist, can make formerly white steps (i.e.
the ones with white inference strokes) significant for an expansion of a contraction. That is why, in a general theory of revision of belief schemes, which
involves contraction followed by expansion, it is important to make provision
for both the white and the black parts of those transitional steps known to the
agent. For the revision of a (black) belief scheme with respect to the (formerly
white) proposition p is effected by first contracting the scheme with respect to
p (here we are assuming that the scheme contains p, whose node would
of course be black at the outset); secondly, expanding the contracted result
by adjoining p; and thirdly, closing with respect to the steps known to the
agent.
In borrowed notation familiar to students of the belief-revision literature, we
take a scheme B containing p. We contract B with respect to p, so as to obtain
the contraction
(B p).
Then we adjoin p, and take the closure of the result. This operation is called
expanding with respect to p. In the case at hand, we obtain the expansion
[(B p), p].
(Some authors write this expansion as (B p) + p.) Note, however, that there
are significant differences between what these symbols denote in AGM-theory,
and what they denote according to the present account. For the AGM-theorist,
B is a theory in a formal languagean infinite set of sentences closed under
logical consequence (or deducibility). On the present account, B is a finitary
belief scheme, consisting of steps made up of nodes and inference strokes,
whose white or black coloration reveals what is believed by the agent, and
how, and why (as far as she is concerned). For the AGM-theorist, the contraction function need not be computable; on the present account, it must be.
(This is a self-imposed constraint, for the purposes of cognitive modeling.4 )

Thanks to Stewart Shapiro for eliciting this clarification.

T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

67

For the AGM-theorist, taking the closure [(B p), p] means taking the (not
necessarily decidable, or even effectively enumerable) logical closure of the set
(B p) {p}, which in general is a non-effective operation; whereas on the
present account it means effectively determining a new finitary belief scheme
from an old one.
One can now appreciate why it is important to conserve all (and only)
the (most economical) transitional commitments that the agent has already
acquired, even if much of it might lie within the white part of the overall scheme
before any revisions take place.

2.4.1 Primitive local transitions in coloration

Our four main Coloration Axioms and two Locks (on color changes during contractions and expansions) determine the following scheme of primitive local
transitions. They concern the two kinds of (possibly multi-pronged) forks that
can occur within a diagram of justificatory steps. One kind of fork is based on
an inference stroke, receiving arrows from nodes above; the other kind of fork
is based on a node, receiving arrows from inference strokes above it. As the
reader can easily verify, our list of eight forks (four of each kind) is a partition
of the possibilities. Every possibility is covered by exactly one respresentation
(in the left column below) of a fork. The first four shapes of fork are stable,
in the sense that they are already in conformity with Axioms ()(), and
occasion no changes of coloration. The next two forks cannot arise during
expansions, for the simple reason that expansion propagates black downwards
(i.e. in the direction of the arrows), beginning with a diagram that conforms to
Axioms ()(). Under contraction, however, which propagates white upwards
(counter to the direction of the arrows), one can encounter forks of the fourth
or fifth shape.
The final two shapes of fork are the ones that call for changes both during
contractions and during expansions. Moreover, the seventh shape of fork, during contractions, calls for the choice of some node (among possibly more than
one) for whitening.
Note that the last four shapes of fork represent violations of Coloration
Axioms (), (), () and (), respectively. We use a universal quantifier in order
to indicate that all nodes (or inference strokes) at the upper level are of the
indicated color. An existential quantifier, likewise, is used to indicate that at
least one of them is of the neighboring color.

68

COMPUTING CHANGES IN BELIEF

Contraction
under White Lock:

Shape of Fork

Expansion
underBlack Lock:

... ...
Stable

Stable

Stable

Stable

Stable

Stable

Stable

Stable

...

...

... ...

...

...
Does not arise

... ...

... ...

Does not arise

... ...

...


...

... ...

... ...

...

This boxed diagram is the source of the non-determinism of the contraction

algorithm.
With these general principles constraining how one sets about changing ones
beliefs on giving up any particular belief, we can now work through some
concrete examples.
T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

69

2.4.2 Example 1
This example is a simplification of one to be found in Hansson [], at
pp. . It is also an instance of the schematic example given by Fuhrmann
[], at p. .
The agent believes that
(a) Cleopatra had a daughter.

The agent is aware that this entails that

(b) Cleopatra had a child.

So the agent believes b on the basis of a (Subdiagram a). But the agent subsequently ceases to have any confidence in the source of the would-be information
that Cleopatra had a daughter. The agent therefore gives up the belief a. (Subdiagram b below: the node a is now white, and without any support.) So, because
a was the sole support in the agents belief scheme for b, the agent gives up the
belief b as well (Subdiagram c). Now, if the agent were somehow to come across
reliable but non-specific information to the effect that Cleopatra did, after all,
have a child, but with the sex of the child left unspecified, the node b could
become black again, this time with its own initial (black) inference stroke, and
without re-instatement of the belief a (Subdiagram d):

Subdiagram 1a

Subdiagram 1b

b
Subdiagram 1c

b
Subdiagram 1d

Note that Subdiagram b pictures an intermediate stage of the contraction

process, and does not depict a belief scheme obeying the Axioms ()() set out
above. Specifically, Axiom () is violated: Every black inference stroke receives
arrows (if any) only from black nodes. The further whitenings that occur in
Subdiagram c rectify this situation, in accordance with basic Action Type ()
described above.
70

COMPUTING CHANGES IN BELIEF

2.4.3 Example 2
This example comes from Hansson [], at pp. , concerning a belief
set K. (The reader should be advised that we use brackets to indicate either
useful interpolations, or innocuous changes of notation that are intended to
ensure consistency of exposition. So the brackets within this quote do not
indicate logical closure!)
I previously entertained [at Stage 1] the two beliefs George is a criminal () and George
is a mass murderer (). When I received information [i] that induced me to give up the first
of these beliefs (), the second () had to go as well (since would otherwise follow from
) [I thereby reached Stage 2]. I then received new information [j] that made me accept the
belief George is a shoplifter (). The resulting new belief set is the expansion of [K ]
by , [(K ) + ]. [Call this Stage 3.] Since follows from , [(K ) + ] is a subset of
[(K ) + ]. By recovery, [(K ) + ] includes , from which follows that [(K ) +
] includes . Thus, since I previously believed George to be a mass murderer, I cannot
any longer believe him to be a shoplifter without believing him to be a mass murderer.

Clearly the pieces of information i and j (whatever they might have been)
conflict with one another, as does the piece of information i with the claim .
Let us assume that from the very beginning the agent realizes that being a
shoplifter entails being a criminal, even though (at the outset) the agent does
not believe that George is a shoplifter. (A mass murderer, yes, but at any rate not
also a shoplifter!) Here, then, is the sequence of changes described in Hanssons
counterexample:

Stage 1

Stage 2
(on learning i)

Stage 3
(on learning j)

T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

71

Each of these three stages complies with Axioms ()(); we do not show the
intermediate stages of the two revision processes from Stage to Stage and
from Stage to Stage .

2.4.4 Example 3
This example comes from Niedere []. Once again, let K be a belief set,
and suppose that K implies A. Suppose also that the agent is apprised of the two
transitional steps A, therefore A B and B, therefore A B.

AB

Contracting with respect to A B would produce the following:

AB

Expanding now with B would produce only

AB

with no support for A.

72

COMPUTING CHANGES IN BELIEF

It is evident that Niederes example is at the heart of Hanssons one about

Georges criminal status. Hanssons example simply fleshes out with some reasons (which we called i and j) as to why one contracted with respect to a certain
conclusion and later expanded by adjoining a certain premise. Both examples
make the central point that with a simple fork of the form
..
.

..
.
b

contracting with respect to c and then expanding with b leaves a unsupported.

2.4.5 Example 4
This example comes from Levi [], pp. . We quote at length, with
B A in place of Levis distracting contrapositive A B:
Suppose that we know that Jones suffers from hepatitis and that he contracted it by eating
tainted humus [sic].5 Call Jones ate tainted humus A and Jones suffers from hepatitis B.
Consider the contraction of our corpus K by giving up B. We would be faced with giving
up either A B or A B. We might quite plausibly regard giving up the claim A B
as incurring greater loss of informational value than giving up A B on the grounds
that in doing so, we would be giving up the assumption that eating tainted humus tends
to result in becoming infected with hepatitis, which has some explanatory value.[fn] But
then if we retain A B, we shall be required to give up A. The only question that remains
is whether, in giving up A, we should also give up [B A] or retain it. But if we put
ourselves in the position of someone who does not know that Jones has hepatitis and
does not know that he has eaten tainted humus, would we take ourselves as knowing that
if the person has hepatitis, he has eaten tainted humus? There are contexts in which we
would respond affirmatively. We would do so if we had information that ruled out that
Jones had sexual contact with an infected person, used tainted needles, undergone blood
transfusions, and the like. Suppose, however, that we lacked such information. If the initial
corpus that contained the information that Jones had eaten tainted humus did not rule
out that he had sexual contact with someone infected with hepatitis or some other such
source, then when B was removed and subsequently re-instated, we would not be in a
position to conclude that Jones had eaten tainted humus. But this means that [B A]

Humus is the Turkish spelling for the English word hummus.

T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

73

is not retained in the contraction. It seems to me that in situations such as the one
envisaged, we do not think that the loss of [B A] adds to the loss of informational value
incurred in giving up B additional to what is lost by giving up A B even though it adds
to the loss of information. The extra information lost is considered irrelevant. We might
say that we initially believed [B A] only because of our initial conviction in the truth
of A. No loss of explanatory information is incurred by giving up [B A] except that
incurred in giving up A.

It is difficult to tell from this quote whether Levi is at all concerned to

distinguish between a step that shows the direction of evidential support and
a step that merely registers a logical implication, but whose conclusion does
not depend, for its support, on the premises involved. Moreover, the sentence
A B does not sustain the interpretation that eating tainted hum[m]us tends
to result in becoming infected with hepatitis. For A B is the singular claim
If Jones ate tainted hummus then Jones suffers from hepatitis. Such a singular
claim could, arguably, be abandoned without necessarily abandoning the claim
that eating tainted hummus tends to result in becoming infected with hepatitis.
For, the tendency claim is one that would be well regimented either as attaching
a high conditional probability to all instances:
for all x, prob(x gets hepatitis | x has eaten tainted hummus) > ( )
or as a plurality quantification:
for almost all x, if x eats tainted hummus, then x suffers from hepatitis.
One could, rationally, hold the tendency claim in either of these two forms,
while yet abandoning the singular material conditional concerning Jones. In
deference, however, to Levis preferred way of imagining how things might
go at the explanatory level, let us simply think of the tendency claim as the
ordinary universally quantified conditional
(C) for all x, if x eats tainted hummus, then x suffers from hepatitis
which logically implies the instance
(A B) If Jones eats tainted hummus, then Jones suffers from hepatitis.
Let us also follow Levi in apparently crediting the agent with awareness of the
logical implications registered by the transitional steps in the following diagram:
74

COMPUTING CHANGES IN BELIEF

AB

BA

AB

Levis point is that contraction of this belief scheme with respect to B should
result in ones giving up BA as well.
The point of interest here, though, over and above our agreement with Levi on
this score, is how the contraction would proceed with respect to B, and what the
final coloring of the contracted scheme would be. First, as a result of whitening
B, and the desire to salvage belief in the explanatorily prized generalization C,
we would decide to whiten A (since, if we whitened AB, we would have to
whiten C). Secondly, since both A and B are now whitened, we would whiten
the two conditionals below them, which have no other support in the diagram:

A B

B A

A B

T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

75

We are left believing C, the universally quantified conditional, as well as its

instance involving Jones; but not believing either the antecedent or the consequent of this instance. Levis intuitions about how the contraction with
respect to B should go are captured exactly by our method of whitening a
diagram.

2.4.6 Example 5
Our next example is the one given in Tennant [a], at p. . It involves
the two outright beliefs A and AB, along with their two consequences BA
and B:

<

BA

AB

As the reader will easily detect, this is a subdiagram of the diagram above
depicting Levis example. At the time of writing the BJPS paper the author
was not, alas, aware of Levis reflections on tainted hummus, unsafe sex,
shared needles, blood transfusions and hepatitis. But even after encountering
his example, it was not until we analyzed it in the diagrammatic detail just
given that we realized that it properly contained the subdiagram just isolated
above. Our own example was couched directly in terms of the simple formulae
and steps just depicted, and with the permissible assumption that for the agent
concerned, the conditional AB was more entrenched than its antecedent A
(as indicated in the diagrams immediately above and below by the sign <).
Suppose one is to contract with respect to B. Then A will have to go. So too
will BA, since it is believed only because A is believed. Upon restoring B, we
will not get A back again:

76

COMPUTING CHANGES IN BELIEF

Result of contracting
with respect to B:

<

BA

Result of then expanding

with respect to B:

AB

<

BA

AB

2.4.7 Example 6
Our final example comes from Quine and Ullian [] at p. . The following
dependency network illustrates the forensic predicament they describe. The
authors do not tell their reader where the murder was committed; so let us
assume that it was in Boston.

nfe

nfb

abc

Legend (where t is the time of the murder):

Abbotts signature at t is in a respectable hotels register in Albany

Babbitts brother-in-law says Babbitt was with him in Brooklyn at t
T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

77


A
B
C
nfe
nfb
a
b
c

Cabot is in a TV report at t from the Catskills ski meet

Abbott was in Albany at t
Babbitt was in Brooklyn at t
Cabot was in the Catskills at t
There was no forced entry at the scene of the murder
No fourth beneficiary: Abbott, Babbitt and Cabot are the only
beneficiaries of the victims will
Abbott committed the murder
Babbitt committed the murder
Cabot committed the murder

The network is drawn so that doubt can fall only on its nodes, not on its
transitional steps (marked with the horizontal strokes). The network is unacceptable in the current state, because its final step has conclusion , from four
premises indicated as believed (colored in black). Our task is to whiten parts
of the network, so as to restore consistency. Whitened nodes will no longer be
believed. The problem is: what is the most economical and sensible way of doing
this (i.e. spreading white upwards from the bottommost node, labeled )?
As Quine and Ullian tell the story, ones response to the terminal contradiction should be to reject [b] or [a b c], thus either incriminating Babbitt
or widening our net for some new suspect. We shall illustrate here the effect of
following either of these courses of action.
First, suppose we reject b. Then the network would become

78

COMPUTING CHANGES IN BELIEF

nfe

nfb

abc

The reason why this would now incriminate Babbitt is that one credits
the agent with the ability to make the easy propositional inference from the
premises
a, c, a b c
to the conclusion b. The step that would represent this inference is not shown
explicitly in the diagram. It is interesting to note that the conclusion b is not
vouchsafed (as black) simply on the basis of the whitening of b. It is only
because the step just mentioned:
a

abc

is presumed to be available to the agent that the conclusion b ends up being

blacked.
Secondly, suppose we reject a b c. Then the network would become

nfe

nfb

abc

T H E R O L E S O F T H E W H I T E A N D B L AC K PA RT S

79

These two ways of contracting are dictated by the fact that the beliefs B
and nfb (no fourth beneficiary) are the least entrenched among the initial
nodes. Without recourse to such entrenchment considerations, it would be just
as licit to contract in a way that casts doubt on the reputation of the Albany hotel:

nfe

nfb

abc

2.5 Summary and conclusion

This completes our survey of various examples that have been given in the
literature on theory contraction. We have shown that each can be handled in a
direct and intuitively correct fashion by our diagrammatic method of stepwise
representation. Changes must conform both with our main Coloration Axioms
()() and with the constraints White Lock (in the case of contractions) and
Black Lock (in the case of expansions). These axioms and constraints allow us
economically to achieve new and satisfactory rational equilibria when changing
the doxastic status of any node in the network of steps.
The more formal treatment in Chapter provides all the formal definitions required both for the specification of contraction algorithms and for
the determination of the complexity of the contraction problem. We show
that the simplest form of the contraction problem is NP-complete. This result

80

COMPUTING CHANGES IN BELIEF

is of some interest, for two reasons, which have already been broached in
Section ..
First, although NP-completeness is an indication to computer scientists that
a problem is intractable, it is nevertheless the lowest degree of computational
complexity to which anyone can aspire when doing anything reasonably serious
in computational logic. Even the decision problem for truth-table satisfiability
in classical propositional logic is NP-complete. (Decision problems for theoremhood in other propositional systems are much worsesee Section ..)
Thus we can claim that our contraction method is no more complex than a
truth-table test.
Secondly, since one has to consider sets of sets of premises in the contraction
process, there was the prima facie danger that the complexity of the problem
might exponentiate above that of a truth-table test. Fortunately, however, this
turns out not to be so.
A computational treatment was made possible only by conceiving of the
inputs (the belief systems) as finitary objects, and by isolating simple, mechanically implementable rules for their manipulation so as to produce outputs
with a certain decidable property. It is understandable that one might therefore be concerned at the very outset that such a simple conception of the
matter must do some violence (albeit in the interests of effectiveness) to the
various underlying logical notions. After all, are there not theories that are
not finitely axiomatizable? What about undecidable theories? And is not the
logical closure of even a finite axiomatic basis itself infinite? Are not these
logical infinities and undecidabilities going to pose insuperable problems to an
effective (hence finitary) method of theory contraction that aspires to be fully
general?
These concerns will be addressed and allayed in Chapter . Even an infinitely
axiomatized and undecidable theory will only ever have been finitely developed
by the time any contraction might be contemplated. (This notion of finite development will be discussed in greater detail in Chapter .) Deductions, or steps,
that a rational agent does not yet know about are perforce irrelevant to what
she ought to do upon giving up any statement that she knows to be one of her
present commitments. The diagrams above isomorphically depict these finite
dependency networks, and contain all the information relevant to a rational
process of theory contraction. Moreover, they do so in a way that makes the
whole process algorithmic, and of the lowest complexity that could reasonably
have been expected.

S U M M A RY A N D C O N C L U S I O N

81

2.6 A look ahead

We have explained our local constraints White Lock and Black Lock, and have
shown how to effect local changes of coloration when giving up a belief (changing a node from black to white). Now we must inquire after some more global
conditions or desiderata governing the contraction process. Chapter addresses
theseamong them, most importantly, the elusive requirement of minimal
mutilation. The discussion in Chapter will be carried out in a terminology
that enables one to compare and contrast the theory-based formulations of
AGM-theory with formulations that are more in the spirit of the alternative
approach on offer here. So, for a while, we suspend our talk of belief schemes
and their formal representation by networks consisting of nodes and steps, and
use a more standard terminology in order to compare and contrast the two
approaches. Chapter will then revert to a more rigorous discussion of our
account involving networks consisting of nodes and steps.

82

COMPUTING CHANGES IN BELIEF

CHAPTER 3

Global Conditions on
Contraction

3.1 Knowledge sets and belief sets versus

theories
Ramanujan, the great mathematician, claimed that an angel visited him in his
sleep at nights, and wrote upon a tablet various theorems that Ramanujan ought
to prove.1 Ramanujan would dutifully prove them; and his contribution to the
expansion of our knowledge in mathematical analysis was considerable.
The story about the goddess of Namakkal is familiar from C. P. Snows foreword to the
reprinting of Hardy []. But much richer detail is available in Robert Kanigels more recent and
extraordinarily thoroughly researched biography of Ramanujan. From Kanigel [], at p. :

In Ramanujans family, the family deity was the goddess Namagiri, consort of the lion-god Narasimha.
Her shrine at Namakkal was about a hundred miles from Kumbakonam [the town where Ramanujan
grew upNT ], about three-quarters of the way to Erode, near where Komalatammals [Ramanujans
mothersNT ] family came from. ...Ramanujan ...would utter Namagiris name all his life, invoke
her blessings, seek her counsel. It was goddess Namagiri, he would tell friends, to whom he owed
his mathematical gifts. Namagiri would write the equations on his tongue. Namagiri would bestow
mathematical insights in his dreams.
But the available evidence does not exactly identify a unique supernatural agency at work. We learn
also, ibid. at p. :
T. K. Rajagopolan, a former accountant general of Madras, would tell of Ramanujans insistence that
after seeing in dreams the drops of blood that, according to tradition, heralded the presence of the

K N OW L E D G E S E T S A N D B E L I E F S E T S V E R S U S T H E O R I E S

83

Expanding a set of known propositions involves providing justification for

believing some new proposition to be true. The proposition is new in the sense
that it has not heretofore been proved. The first principles from which such
proofs might proceed will already be consciously and explicitly known. Thus
there is an everyday sense in which we are willing to talk of expanding our
knowledge even when the expansion involves proving something that follows
logically from propositions already known to be true.
This is a clue to the inadequacy of the view that a knowledge set or belief
set (that is, a set of propositions known or believed) has to be thought of as
deductively closed. Typically, such sets are not deductively closed; and that is why
we are willing to talk of expansion (conceived of as proper expansion) when
we prove a new result, albeit from principles already known (or believed) and
thus already in the set before the expansion in question.
Our knowledge sets and belief sets (even when we are not guilty of any inconsistency) are inadequately modeled as deductively closed sets of sentencesthat
is, as what logicians standardly refer to as theories. But even taking into account
their lack of logical closure, our knowledge sets and belief sets are not good
representations of our knowledge schemes and belief schemes. For those schemes
consist, typically, of finitely many propositions, or proposition-schemata, along
with justifications that are articulated to varying degrees. Its belief set could be
called the kernel of a belief scheme; it represents what propositions are in the
scheme, and therefore believed. The belief scheme goes beyond this kernelit
represents in addition how each proposition has come to be believed; that is,
what the believers reasons are for believing it. In order to maintain a form of
conversational continuity with other writers contributions on the topic of theory contraction, we have to be careful to talk about belief sets when contrasting
certain ideas of ours with ideas of theirs. On other occasions, when we venture
into new territory with considerations relating exclusively to schemes, we can
stress the difference by using the appropriate terminology.
The first time that a new theorem of a mathematical theory is proved, the
sole justification for it will be the new proof offered. Mathematicians usually
succeed in providing yet further, different proofs of a theorem already proved.
They might seek to constrain further the first principles appealed to in the
proof, eliminating, if possible, unnecessary ones. They might also seek different
deductive routes to the same theorem, ones that (when codified as proofs) reveal
god Narasimha, the male consort of the goddess Namagiri, scrolls containing the most complicated
mathematics used to unfold before his eyes."

84

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

more clearly why the result holds, or that lend themselves to generalization in
the solution of whole classes of related conjectures. The upshot, then, is that a
typical item in a knowledge (or belief) scheme is a known (or believed) proposition furnished with possibly more than onebut still only finitely many
justifications, or epistemic pedigrees, or proofs.

3.2 Bases, developments and theories

Let us return for the time being just to sets of sentences, and ignore the need
to take into account the justificatory pedigrees available for each sentence in a
knowledge set or belief set. We still need to distinguish three things: bases; what
we shall call developments; and theories. The phrase belief set is ambiguous
among all three of these.
A theory is a logically closed set of sentences: that is, a set of sentences
that contains every logical consequence of any of its subsets. Obviously any
theory is infinite, and contains all logical truths, that is, all logical consequences of the empty set. We shall assume throughout that completeness holds,
that is, that the semantic notion of logical consequence and the proof-based
notion of deducibility coincide in extension; and we shall continue to use
 to stand for this relation, whether it be conceived model-theoretically or
proof-theoretically. Thus X  x will mean that the sentence x is deducible from
(is a logical consequence of) the set X of sentences. When X is empty, we shall
simply write  x.
A base is a set of axioms (finite or infinite) for a theory, and is (almost always)
not itself logically closed. A theory is the logical closure of any base for it.
When A is the logical closure of a set B of sentences we shall write A = [B].
In particular, A is a theory if and only if A = [A]. The set of logical truths is
just [].
A base B is called irredundant just in case removing any one of its members
results in the generation of a different theory: that is, if and only if
b B (B  B \ {b}]  ).

One can have different bases for one and the same theory; indeed, one can
have different irredundant bases for one and the same theory. For take the two
irredundant bases {a, b} and {a, a b}. From the first of these bases one can
deduce a b by means of one step of I; and from the second, one can deduce
b by means of one step of E. In each case that yields the same development
BASES, DEVELOPMENTS AND THEORIES

85

{a, b, a b}; and from there on everything will coincide, and the same unique
theory will be generated.
This example serves also to illustrate what we shall mean by a development.
In the case where the base is finite, a development will be any (finite) set lying
somewhere between that base and its full logical closure. To be realistic, a
development moreover is always a finite set:
(finite) base
{a, b}

(finite) development
{a, b, a b}

full (infinite) theory

[a, b]

The first containment is to be understood as a proper one by virtue of the

presence, in the development, of at least one logically contingent non-member
of the base in question (here, a b). Merely extending a base by adding only
logical truths does not produce a true development. In our example, what we
added in order to produce the development was the sentence a b, which is
both logically contingent and not itself in the base {a, b}.
When the base is infinite, however, the first containment above will not hold;
for a development, we have stipulated, is always to be finite. In the case where the
base is infinite, therefore, the development will be some partial logical closure of
some finite subset of that base, by means of at least one logically contingent nonmember, but consequence, of the base. That is, the development will consist of
finitely many members of the base plus finitely many sentences that they jointly
imply, among which will be at least one logically contingent non-member of the
base. A development in this case will not itself be a subset of the (infinite) base
in question, but its logical closure will be a subset of the theory determined by
that base.
Note that any development must, according to our definition, contain some
redundancy; that is, no development can be an irredundant base. When a development is fleshed out with proofs to justify each sentence in the development, it
becomes a systematic development. Moreover, a sensible view is that all systematic developments are finite, even if the base of available axioms is an infinite set.
For at any stage of our history we shall only ever have produced finitely many
proofs. And since the proofs themselves are finite, we shall have invoked only
finitely many of these axioms.
Systematic developments, containing only such base members as have been
used in proofs, are foundationalist versions of what we have been calling finite
dependency networks. Such networks were explained informally in Chapter
and will be formally explicated in Chapter .
86

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

3.3 Contractions
Back to Ramanujannot the historical one, but rather a fictional extension
of him for expository purposes, whom we shall call Ramanujan . Suppose
Ramanujan is interested in theories and belief sets quite generally, and not just
mathematical ones. (What we shall be saying, however, will apply to mathematical theories as well as to non-mathematical ones.) Ramanujan s angel now
comes to him in his sleep holding a different kind of tablet. No longer does
the angel write down whatever mathematical claim p he wants Ramanujan
to believe, and instruct him to find a reason for believing p (to find, that is,
a proof of p). Rather, the angel writes down what he wants Ramanujan to
cease believing. Indeed, when the angels practice changed, he had an initial
conversation with the dreaming Ramanujan about the new tack. The angel
spake thus:
In the past I have told you what propositions are worth believing. But from now on I
shall tell you what propositions you should no longer believe. Do not, however, leap to any
conclusions about their contradictories. Im not telling you to disbelieve them; I just want
you not to believe any proposition I may happen to write on the tablet. But, as far as each
such proposition will be concerned, I want you to keep an open mind. For who knows?
one day you might have to recruit back the beliefs Ive asked you to let go. Or, you may
have to take on some of their contradictories. But, for the time being, I cant say which. So
do please keep an open mind. Obey my injunctions by giving up as little as possible. And
if ever I instruct you to cease believing a logical truth, you can disregard that instruction.
Take seriously only my proscriptions of propositions that are not logical truths!

Ramanujan has been assigned the general task of contracting a set of beliefs
with respect to any given (contingent) proposition implied by it. A contingent
proposition is one that is neither logically true nor logically false. Contracting
with respect to a logical truth involves doing nothing. And the reason why
contraction with respect to a logical falsehood is not explicitly considered is
that one assumes an abiding commitment to consistency of belief anyway, in
the form, perhaps, of the angelic proscription Do not believe !
Ramanujan falls to reflecting on how best to carry out the angels commands.
He knows the shape of the problem in general: at any stage he will have a set A of
current beliefs. There will be only finitely many of them; but, potentially, at least,
there is an infinite set of beliefs derivable from A. This is because the believer is
rationally committed to any proposition that can be shown to be in the logical
closure of A. (Among these, for example, will be all the logical truths in the
C O N T R AC T I O N S

87

language of A.) So any changes Ramanujan proposes to make to a belief set

will have ramifying consequences.
Exactly which propositions are to be sacrificed from a theory in a rational
process of contraction with respect to one of its consequences will in general
depend on how the theory is articulated (including, among other considerations, what might be taken as its base) and what the sacrificial preferences are
of the theorist whose theory it is. Ramanujan , for example, may have no preference for a over b, and vice versa. But he may also have a very strong preference
for the implication a b over a. Under such circumstances consider now our
two earlier irredundant bases {a, b} and {a, a b}, which, as we noted, generate
the same theory (call it
).
Suppose, on the one hand, that Ramanujan holds this theory
in virtue of
{a, b} and is told by the angel to give up the conjunction a b. Then he might
do any one of the following:
1. give up both a and b and therefore go back to scratch, as it were, contracting
all the way to the theory of the empty base (i.e. logic);
2. opt to give up a, even though he has no particular reason for preferring b to
ain which case the contracted theory will be [b]; or
3. opt to give up b, even though he has no particular reason for preferring a to
bin which case the contracted theory will be [a].

A more sophisticated look ahead method might disincline one to select

option (), since it involves the loss of a b, which we are supposing to be preferred to a. Here we are invoking considerations that do not fall within the ambit
of any mathematical provisions by AGM-theory. Indeed, AGM-theory allows
only option () under the hypotheses of the example (on their method of finite
base contraction). Note, however, that option () would be the best choice for
Ramanujan , since, unlike the other two options, it vouchsafes a b, which,
ex hypothesi, he strongly prefers to a.
Suppose, on the other hand, that Ramanujan holds the theory
in virtue
of the other base {a, a b}. Then he should contract it with respect to a b as
follows:
First, note that one has to give up one or other (possibly both) of a, b, in order to get
rid of their conjunction a b. If, on the one hand, a is given up first, then there will no
longer be any justification for b, since b had been derived by E from the two members
a, a b of the base; so b will be given up also. If, on the other hand, b is given up first,
then, since it is jointly implied by the two members of the base {a, a b} in question,
one will have to give up one of them too. But, ex hypothesi, ones preference is for a b

88

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

over a; whence one will give up a. Thus one gives up both a and b regardless of which of
these two one gives up first. The residue will therefore be [a b].

This makes contraction look rather intensional as a process. It makes it look as

though contraction depends on more than just the sentence membership of the
theory (or belief scheme) being contracted. And indeed it does. Within a belief
scheme A, there is more to each belief than just its propositional content a.
Each belief within the scheme A consists in the proposition a believed, along
with such justifications, or derivational pedigrees, as a might have acquired by
that stage. The proposition a is a member of the kernel; while the item provides
crucial extra information about the role and status of the proposition a within
the belief scheme. The item furnishes the proposition a with proofs, so that it
can be a justified item in the scheme. The general form of a justified item in the
belief scheme is therefore
= a, { , . . . , n },
where the i are the various justifications so far provided for a. The proofs i
provide, as it were, an extra dimension in which to view the proposition a within
the schemehence the potentially intensional behavior of a upon contraction.
A belief scheme is more than a mere set of beliefs. The various justifications provided for each belief are partially constitutive of the schemes identity. A scheme
will have the set of beliefs as its kernel ; but it will not be fully determined until
all of the believers justifications for beliefs in that kernel have been provided.
If the scheme (or scheme user) has bad memory, some of the fine internal
structure of these proofs i might have been lost. In that case, one could retreat
to a coarser kind of representation for scheme items:
= a, { , . . . , n },
where each i is the set of premises (undischarged assumptions) of the erstwhile and now forgotten proof i . Note that there is no requirement to the effect
that every member of such a set i should itself be an axiom, or first principle, of
the theory of which A is a (necessarily finite and) partial development. Rather,
all that is required is that any member of such i be itself justified within
the scheme A. (Of course, axioms count as justified!) We do, characteristically,
build upon our past successesa process whereby a derived result can become
the starting point for fresh inquiry. In logicians parlance, a member of a set
i within an item of the form just displayed above could be a cut formula
C O N T R AC T I O N S

89

(or lemma) for the ultimate proof, from first principles, of the corresponding
result a.
Note that the representation of above could also be furnished as the following list of steps with conclusion a:
 , a, . . . , n , a.
And indeed this will be our preferred method of representation, within the
modeling to be described in Chapter . For one finds that the most convenient
kind of object on which to focus, for formal manipulations, is the step. It is better
to treat the various steps just displayed above severally and individually, as it
were, rather than to treat the set
{ , a, . . . , n , a}
of steps that have a given node a as their common conclusion.
It is an interesting question, and one worth exploring, whether making do
with the most recent lemmata (as members of i ) adduced for the proof(s) of
a, rather than tracing logical dependencies all the way back to those members
of the base in question on which a ultimately rests, substantially affects the
outcome(s) of the contraction process. If it did, then this would be yet another
manifestation of the intensionality of that process. This question is one that is
unable to be posed on the AGM-approach, since it does not model the dependencies or pedigrees of justification to which we have been drawing attention.
Ramanujan knows that the angel could write on his tablet any proposition p,
regardless of whether it features as an already justified item in the currently
developed scheme A. If there is as yet no justification, within A, of the prohibited
proposition p, then Ramanujan will have to live in constant fear of the prospect
that his scheme might unexpectedly turn up such a would-be justification for p,
contrary to the angels wishes. Ramanujan will just have to be very vigilant to
avert such a prospect; but, apart from wondering about what proofs of p there
might, unknown to him (at present) be, there is precious little that he can do,
for the time being, to respect the angels wish that he not believe p. If there is
already a proof  for p in his scheme A, however, so that A has a justified item
of the form
= p, {. . . , , . . .}
then matters are different. Ramanujan in this case has his work cut out for
him; for he has to excise p and disable every one of those justifications like .
Fortunately, the cruder form of representation
90

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

 = p, {. . . , , . . .}
(where  is the set of premises of the justification ) suffices for this doxastic
surgery. For all that Ramanujan has to do is remove some member, or members, from each such set , so as to make what is left over insufficient for the
justification of the proscribed proposition p.
Exactly how Ramanujan will contrive to do this is a matter we can leave,
at this stage of our tale, to his own sharp wits. We have already begun the task
of presenting a detailed method, which we have just illustrated above with the
toy examples of contracting [a, b] and [a, a b] with respect to a b. Let us
remark, however, on one stratagem that Ramanujan considers and quickly
rejects.

3.4 What do we require of a contraction?

3.4.1 Taking the intuitionistic case seriously: the condition
for successful contraction
Ramanujan recalls that the angel has never expressed to him any preference for
classical as opposed to intuitionistic logic. Indeed, for all Ramanujan knows,
the angel might be an intuitionist. For (so our little story goes) all the proofs
that Ramanujan has found in the past on the angels promptings have been
intuitionistic ones, and their conclusions have been propositions that were not
effectively decidable. (Moreover, the angel would not deign to test Ramanujan
with such trivia as decidable propositions.) Aha! schemes Ramanujan , Ill just
respond to every angelic proscription of belief p (at least where p is not itself a
negation)2 by believing p instead, and insisting on using only intuitionistic
logic. Then no-one can force me to admit that Im still committed to p, and I will
have obeyed the angels injunction.
The angel, reading Ramanujan s thoughts, raises an eyebrow. Ramanujan
immediately has second thoughts, recalling the angels insistence that he keep an
open mind concerning the proscribed propositions. How can one keep an open
mind with respect to p if one believes p even if not, admittedly, believing
The reason for this qualification is that for the intuitionist the double negation of a negation
logically implies it, even though Double-Negation Elimination (from infer ) is not, in
general, a valid rule.

W H AT D O W E R E Q U I R E O F A C O N T R AC T I O N ?

91

p itself? Surely an open mind means that one can proceed either to adopt p
or to adopt p as a new belief without thereby incurring any inconsistency?
But if Ramanujan were to pursue the cheeky intuitionist path, he would be
unable subsequently to embrace p without thereby engendering conflict with
his belief p, even in the absence of p.
Realizing this, Ramanujan sees that one has to be careful when formulating
the conditions for success in the project of contracting a set A of beliefs with
respect to any of its consequences p. The contraction A p (that is, the kernel
of the contracted scheme ) must not only fail to imply p; it must also be consistent
with p (that is: A p, p  ). Against the background of classical logic,
these two requirements are equivalent; against the background of intuitionistic
logic, however, they are not. In the intuitionistic case the way to express the
condition for success is to insist that the contraction A p be consistent with
p. This will guarantee that A p fails to imply p. Intuitionistically, merely
insisting that A p fail to imply p is not enough to guarantee that A p will
also be consistent with p.
Let us now be mindful once again of the distinction drawn earlier between
knowledge sets and belief sets, on the one hand, and knowledge schemes and
belief schemes on the other. A belief set is just the set of propositions believed
by an agent. But her belief scheme provides for each belief in that set a list of
justificatory pedigrees within her system of belief. This is the extra dimension
that underlies some of the intensional behavior of beliefs in a contraction
process.
The task of contracting a belief scheme A with respect to one of its consequences p is this: make the (kernel of the) result consistent with p; and make
it as extensive a subscheme of A as you can. The first requirement is that of
success; the second requirement is that of minimal mutilation. Moreover,
note that in a scheme, as opposed to a set, mutilation is all the greater the more
proofs or justifications one loses. One would like to be able to conserve as much
as possible of past computational effort, in the form of previously discovered
proofs that ought still to be available after the contraction has been completed.

3.4.2 Minimal mutilation

Ramanujan s angel would do more than raise an eyebrow if Ramanujan were
simply to retreat all the way back to logic whenever faced with the proscription
of a given proposition p. For, remember, the angel had told him to give up
as little as possible! Admittedly this was a vague injunction, but still it carries
92

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

considerable weight. Cutting all the way back to logic would clearly be a breach
of this injunction in general. We need a further postulate on contraction: one
that will give expression to the requirement of minimal mutilation.
It has been suggested that the following captures this requirement (where
once again we speak of sets rather than schemes):
recovery: If p is implied by A, then whatever is implied by A
is implied by A p, p.
The idea can be attributed to Grdenfors []:
it is reasonable to require that we get all of the beliefs in [our theory] back again after
first contracting and then expanding with respect to the same belief. Formally, this idea is
captured by the axiom [of recovery]. (pp. 9394)

This is an assertion, not an argument. In Grdenfors [] the case for the

axiom had still not been improved:
The criterion of informational economy requires that [the contraction of a theory] be a
large subset of [the theory]. Formally this can be expressed as [the axiom of recovery].
(p. 67)

Note that our statement of Recovery has it that contraction with respect to any
consequence p of the set A should admit recovery of all consequences upon
restoration of p to A p. It would not be strong enough, to capture the intended
spirit of minimal mutilation, to require only that contraction with respect to any
belief in A should admit recovery of all consequences of A upon restoration of
that member to the contracted set. For A in general is not logically closed, and
indeed is only finitely developed.
Not much interest attaches, therefore, to the claim of Alchourrn and Makinson [], p. , that recovery holds when applied to irredundant sets of propositions; for their form of recovery is stated with the antecedent If p is already
in A . . . . (For Alchourrn and Makinson, an irredundant set of propositions
is one none of whose members follows from the rest. This is clearly equivalent
to the definition given above.) They are talking about recovery for contraction
with respect to members; we are talking about recovery for contraction with
respect to consequences. In the case of theories, there is no difference between
these two ways of talking, for all consequences are members; but in the case
of belief sets not closed under logical consequence, there is a great difference,
for then there will be consequences that are not members. In the latter case
the really interesting form of recovery is recovery for contraction with respect
W H AT D O W E R E Q U I R E O F A C O N T R AC T I O N ?

93

to consequences, that is, when the proscribed belief newly restored followed
from A, without necessarily being itself a member of A.
Recovery is a seductive idea: it is the supposition that we shall be able give up
so little upon giving up p that, were we to be given just p back again, we would be
able to recover everything (by way of consequence) that we had secured before.
But its attraction is only apparent. Recovery is false; and it fails to give expression
to the requirement of minimal mutilation. Tennant [b] presents a detailed
argument for this conclusion.
Meanwhile, we may draw a methodological conclusion: we stand in need of
a suitable explication of the notion of minimal mutilation, within an account
of contraction that pays proper attention to the structures of reasons within
rational agents belief schemes. Such an explication will be given in Chapter .
The explication is very natural, and is immune to the kinds of counterexamples
to which Recovery succumbs.

94

G L O B A L C O N D I T I O N S O N C O N T R AC T I O N

CHAPTER 4

A Formal Theory of
Contraction

4.1 Introduction

he task of belief-scheme revision can be stated as follows. Suppose

that one is an ideally rational agentalbeit one with finite resources.
Suppose further that ones current belief scheme, or system of belief,
implies (by ones own lights) the proposition p. Suppose finally that one becomes
convinced that p has been falsified. Thus one wishes to believe not-p rather
than p. Also, one wishes to mutilate ones belief scheme as little as possible in
coming to do so. What, then, does one do?
There is a standard answer to this question, which is due to Isaac Levi, and
with which we agree.1 First, one contracts the belief scheme with respect to p.
Secondly, one adds not-p to the contracted result, thereby expanding it. This
second step is relatively simple, on the assumption that the first step has been
properly carried out. For a successful contraction will have rendered the question whether p moot, and thereby will have opened the way for one to adopt
the new belief p. The main action, as the saying goes, lies with the operation
of contraction.
This does not mean, however, that we agree with Levis own account of how best to contract a
belief system with respect to a belief in it. See the discussion in Section ...

INTRODUCTION

95

The logical aspect of the problem of theory contraction is this: how does one
give up a belief p present in, or entailed by, a system T of beliefs, in such a way
as to ensure that what is left will not give one p back again? The methodological
aspect of the problem is this: how does one give up p with minimal mutilation
of T, so as to obtain a contracted result (call it T p) that is undecided as
between p and its negation p? The computational aspect of the problem is
this: how does one give up p in a methodical, rule-governed way that could be
spelled out as an algorithm? And how complex will such algorithms be?
If we can solve the problem of contraction in general, by dealing with all these
aspects of it, then, to repeat, we shall also obtain a solution to the problem of
belief revision: how does one adopt a belief q that logically conflicts with ones
system T of beliefs, while yet minimally mutilating T? The answer, as already
indicated above, is: first, contract T with respect to its consequence q; then
add q to the result.
There should be a rigorous account of this operation of contraction. Epistemologists and philosophers of science talk of minimally mutilating changes in
the web of belief , but give no constructive account of how to effect them. Hence
we face the challenge of giving a philosophically sound, mathematically precise
account of contraction, programmable on a computer. Automation of the task
of belief-scheme contraction would bring widespread applications.
The account of contraction (hence also of revision) will be normative, not
descriptive: it will reveal what ought to be done by an ideally rational agent
confronted with the need to change its mind. One of the central questions to
be addressed is this:
I understand that giving up p will involve not just giving up p by itself, but will also involve
giving up enough in the way of other beliefs to ensure that what remains is insufficient
to imply p; but does giving up p also involve giving up any belief in the system that wholly
depends on p?

Our answer to this question is affirmative; and this is one of the main features
that sets our account apart from certain others.
The aim in this chapter is to set out an abstract and completely general
framework for the discussion of belief schemes and their contractions; to explicate what exactly is meant by minimal mutilation; to characterize the contraction problem precisely; and to show that this problem, in its simplest form, is
NP-complete.
We treat here of finite belief schemes. Our interest is in how a finite belief
scheme can be contracted with respect to any belief in ithow, that is to say,
one can give the belief up while at the same time inflicting minimal mutilation
96

A F O R M A L T H E O RY O F C O N T R AC T I O N

on the original belief scheme. This is a form of optimization problem, involving

keeping holistic tabs on the potentially ramifying knock-on effects of trying to
get rid of a particular belief, and at the same time trying to keep these effects
to a minimum. Giving up a belief p brings in its train the obligation to ensure
that p does not get back in as a consequence of yet other beliefs that one has
(mistakenly) not given up. But at the same time one does not want to throw the
baby out with the bathwater. One wishes to hold on to as many of the original
beliefs as one can, consistently with ensuring that p cannot get back in by any
(known) permitted route from what remains. So, on the one hand, there is the
need to give up as much as one has to; while, on the other hand, there is the need
to give up as little as one can. This is the optimization problem; and it is holistic.
It involves checking lots of things; and this threatens to make the computational
task explode in complexity.
The task, formally, is the following decision problem:
given a finite belief scheme T, and any belief p therein, is there a (minimally mutilated)
contraction of T with respect to p of at least such-and-such finite size (less than that of T)?

And we are interested in determining its computational complexity. This chapters main theoretical aim is to show that this decision problem is NP-complete
if one does not worry about the requirement of minimal mutilation. With
that requirement in place, however, the decision problem is prima facie more
difficult. Details will emerge below.
We need to provide formal definitions both for the formulation of the problem and for rigorous proof of the claim that the simplest form of the problem is
NP-complete. It is well known that there are thousands of NP-complete decision
problems. But that fact does not entitle one to dismiss the main result of this
chapter as just another NP-completeness theorem. That would be to underestimate the importance of this particular decision problem for the logic of theory
dynamics and for epistemology at large. This anticipatory defence depends, of
course, on the formal modeling being acceptable as a good first approximation
of the epistemologically important phenomena. But arguing in detail that it
should be so accepted lies beyond the scope of this chapter. (Chapter will
set out the proof of the metatheorem, due to Harvey Friedman, that ensures
that one incurs no loss of theoretical generality by restricting oneself to finite
belief schemes.)
Despite this chapters focus on proving the main theoretical result about NPcompleteness, both the ideas behind our modeling, and the aforementioned
result, need to be easily accessible to the reader who is not a specialist in the
area of belief revision. For the sake of clarity, therefore, we provide illustrations
INTRODUCTION

97

of defined notions along the way. We also make some comments, which are kept
to a minimum, about the motivation behind our modeling of belief schemes
and behind the formal definitions that give it expression. These comments
are expository only, intended to help the reader who is unfamiliar with the
general area.
The reader also needs to know what this chapter is not. It does not specify
any algorithms. (That is done in Chapter .) Nor does it offer any implementations of algorithms. (That is done in Chapter .) One needs to know that
the computational problem is NP-complete in order to be able to assess any
proposed algorithms for solving it. The actual algorithm that is proposed in due
course is a development (in successively less greedy versions) of what was called
the staining algorithm in Tennant [a]. Perhaps now, since our coloring
convention involves whitening the nodes representing the erstwhile beliefs that
are being given up, this algorithm should be re-named the bleaching algorithm.
This chapter is not concerned, either, to provide detailed critiques of, or comparisons with, rival accounts of belief revision and/or contraction. In Chapter
we discuss AGM-theory, JTMS-theory, and Bayesian network theory, so that the
reader can appreciate how the present approach differs from those.
We define all the notions needed for a full understanding of the structure of
dependency networks, that is, finite fragments of theories. These finite fragments
are all that human beings could ever have developed; all that one could in principle be held responsible to take into account when performing a contraction;
and all that any algorithmic contraction method could be applied to. Identifying
successful and minimally mutilating contractions of dependency networks is
non-trivial, especially when non-well-founded justificatory structures are to be
taken into account. One has to draw on significant formal conceptual resources
in order both to explicate the contraction problem and to determine its inherent
computational complexity. The intention here is to introduce those formal conceptual resources by way of sufficient examples and explanatory motivations.

4.2 The computational complexity of various

decision problems in logic

The pioneering work of Cook [] established the NP-completeness of the
problem (called SAT) of deciding whether one can make a given formula of
sentential logic true by assigning appropriate truth values to its sentence letters.
98

A F O R M A L T H E O RY O F C O N T R AC T I O N

The result holds even when one considers only sentences in conjunctive normal form whose conjuncts are disjunctions of at most three literals. The latter
problem is often referred to as -SAT. SAT is reducible to -SAT in polynomial
time.
There are two kinds of resource that are important for any given class of computational problems. First, there is the amount of memory space that is needed,
at a minimum, by the most efficient algorithm, in the course of executing it in
a computation. Secondly, there is the amount of time that is likewise needed.
These are measured by functions that take as their inputs the lengths of the
problems in question (according to some natural measure).
What does it mean when one says that a computational problem class
(such as deciding whether a given deductive problem admits of proof) is
NP-complete? It means that it can be solved in non-deterministic polynomial
time (that is, it is in NP); and that any other problem class that can be so
solved can be transformed into the one at hand in (deterministic) polynomial
time (that is, it is NP-hard). This in turn raises definitional demands regarding
the notions non-deterministic polynomial time and (deterministic) polynomial
time.
We take the latter notion first. A problem class can be solved in (deterministic)
polynomial time just in case there is a polynomial function f (_) such that any
problem of length n in the given class can be solved in f (n) units of time. These
are also known conventionally as the tractable problems.
Now for the former notion. A problem class can be solved in nondeterministic polynomial time just in case there is an algorithm for solving it,
and a polynomial function f (_), such that for any input problem of length n,
the search tree generated by the branching (choice) points of the algorithm
applied to the problem contains a solution at the end of a branch of length
less than f (n). An intuitive way of thinking of this is that if, in the execution of
the algorithm (which requires us at branching points to make single choices
from a range of possible alternatives) we were so lucky as always to choose
correctlyand thereby solve the problem as quickly as possiblethen indeed
we would do so in no more than f (n) units of time.
That we should be so lucky! . . . P is the class of problems (more exactly:
problem classes) that can be computed in polynomial time. NP is the class of
problem classes that can be computed in non-deterministic polynomial time. It
is an open problem whether P=NP. (This is one of the seven Clay Millennium
problems. The first person to solve it will be eligible for a prize of one million
dollars.) The orthodox conjecture is that P =NP; for no-one has ever provided,
C O M P L E X I T Y O F VA R I O U S D E C I S I O N P R O B L E M S

99

for any one of the hundreds of problem classes now known to be NP-complete,
an algorithm that runs in polynomial time.2
By way of comparison, for the expert:
1. The decision problem for classical propositional logic C is co-NP-complete.
2. Changing classical to intuitionistic makes matters prima facie worse: the decision problem for intuitionistic propositional logic I is PSPACE-complete.3 The
same is true of Johanssons minimal propositional logic4 M.
3. The present authors systems of relevant propositional logic called CR and IR
are of the same complexity as their respective parent systems C and I.5
4. By contrast, the propositional relevance logic R of Anderson and Belnap6 is
undecidable.7
5. Robert Meyers well-known decidable fragment LR8 of R, obtained by dropping
the distributivity axiom, has an awesomely complex decision problem: at best
ESPACE-hard, at worst space-hard in a function that is primitive recursive in the
generalized Ackerman exponential.9
6. For most change operators on propositional knowledge bases T, the question whether T p logically implies q is co-NPNP -complete.10 So, under the
[generally accepted] assumption that the polynomial hierarchy does not collapse,[fn] this means that counterfactual inference is [computationally] harder
than classical inference.11
7. For propositional logics that formalize non-monotonic reasoningReiters
default logic,12 McDermotts and Doyles non-monotonic logic,13 Moores
autoepistemic logic,14 and Mareks and Truszczynskis non-monotonic
N 15 both the problem of testing for the existence of a fixed point (in
the semantics) for a set of premises and the problem of deciding whether

For a lucid introduction to the theory of complexity see Garey and Johnson [].
See Statman []. The proof given there can be adapted to deal also with minimal propositional logic M.
Johansson [].
See Tennant []. Note that Core Logic is now the authors preferred name for IR.
See Anderson and Belnap [].
See Urquhart [].
See Thistlewaite et al. [].
See Urquhart [].
The class NPNP is also referred to as  P by theorists of the so-called polynomial hierarchy.
2
For a good explanation of the terminology, see Garey and Johnson [] at pp. .
See Eiter and Gottlob [].
See Reiter [].
See McDermott and Doyle [].
See Moore [].
See Marek and Truszczynski [].

100

A F O R M A L T H E O RY O F C O N T R AC T I O N

a given sentence belongs to at least one fixed point (so-called brave

reasoning) are NPNP -complete; while the problem of deciding whether a
given sentence belongs to all fixed points (so-called cautious reasoning) is
co-NPNP -complete.16
8. Adding the first-order quantifiers some and all to the logical system brings
undecidability almost everywhere. Classical first-order logic is decidable when
only monadic predicates are involved, but is undecidable as soon as one adds
a single two-place predicate.17 Intuitionistic first-order logic is even worse: it
becomes undecidable as soon as there are two one-place predicates.18

So we see that even at the modest level of propositional logic, it is rare to find
a computational logic problem that is as tame as NP-completeas was claimed
in Section ..

4.3 Relative entrenchment of beliefs

Some beliefs are more entrenched than others (for a given agent). We can say that
the agent x prefers the belief a to the belief b. This is a more convenient form of
expression than saying that, for the agent x, the belief a is more entrenched than
the belief b. The shorter form of expression does not advert to any desires on the
agent xs part (what a decision theorist might call her preference ranking), or any
wishful thinking. Rather, it registers the fact that the belief a is more entrenched
than the belief b within xs belief scheme.
To be more entrenched is to be less vulnerable to surrender during the process of contraction that is involved in revision. The entrenchment relation is
our way of codifying that to which the agent needs recourse in order to avoid
doxastic Sophies choices. The idea finds clear expression by Quine and Ullian: 19
Once we recognize a conflict among our beliefs, it is up to us to gather and assess our
evidence with a view to weeding out one or another of the conflicting beliefs
the situation where a new belief, up for adoption, conflicts somehow with the
present body of beliefs as a body. Now when a set of beliefs is inconsistent, at least one
of the beliefs must be rejected as false; but a question may remain open as to which to

See Gottlob [].

See Church [a] and Church [b].
This is a result of Saul Kripke. See Dummett [], pp. .
Quine and Ullian [], at pp. .

R E L AT I V E E N T R E N C H M E N T O F B E L I E F S

101

reject. Evidence must then be assessed, with a view to rejecting the least firmly supported
of the conflicting beliefs.

Since Quine and Ullian countenance varying degrees of support, it is easy for
them to define the relative entrenchment relation in terms of degree comparison. Our account, however, makes the simplifying assumption that belief nodes
that are in (black) have degree of support , and belief nodes that are out
(white) have degree of support . So comparison of degrees of support will not,
for us, yield a relation of relative entrenchment. Nevertheless, such a relation
can still supervene on the other considerations mentioned in the text, and be
useful in making the best choices (for whitening) during a contraction process.
Relative entrenchment is the result of many influences of a mainly pragmatic
nature. The belief a might contribute more than the belief b to the unification
or simplicity of the agents belief scheme. Or the two beliefs might differ in their
degrees of testimonial dependence on the word of others, or the agents estimate
of the reliability of her testimonial sources. There is no implication here that
relative entrenchment could be modeled by suggesting that the agent assigns to
them different degrees of subjective probability or credence. In our modeling
of the agents belief scheme, we can have a relation of relative entrenchment
alongside a discrete on-off (or black-white) assignment to nodes (i.e. beliefs).
Our modeling employs no continuum of values between on and off , as would
be required by a system of probability or credence assignments, which typically
employ the real interval [,] as the space of possible values. For us, there are
only the values and , as it were.
Our modeling also represents the agent as committed to the continuing
reliability of such justificatory steps as she has acknowledged thus far as binding.
The steps always remain the same; and we consider only changes of belief status
on the part of the premise and conclusion nodes of those steps. This means that
any attribution of an inductive source for a step might have to be taken cum
grano salis. For it is a well-known phenomenon with inductive reasoning that
a formerly reliable step a, b, therefore c (whose premises a and b are believed)
can itself be infirmed upon discovery of counterevidence to its conclusion c.
The agent can continue to believe both a and b, but cease to accept the step
from a and b to c. New evidence e, say, could be discovered, and new allegiance
be given to the step a, b, e, therefore not-c. This phenomenon is known as the
non-monotonicity of inductive inference.
In what follows, we do not allow for non-monotonic inferences. We are concerned only with a first and most modest kind of model of belief schemes and
changes to them: those in which the steps remain constant, and only the status
102

A F O R M A L T H E O RY O F C O N T R AC T I O N

of the nodes changes. Put metaphorically in terms of our diagrams, we are

concerned only with situations where the geometry of the diagram is fixed,
and only the coloration of its nodes and inference strokes can change. This is
a clearly professed limitation at the outset; and we shall see that we still face
considerable theoretical challenges in understanding how contraction should
ideally be undertaken.

4.4 Some intuitions

Our method of theory contraction rests on the following clear intuitions about
contraction (if one takes as fixed the steps involved, and is concerned only
with possible changes in the status of their nodes, as just explained). In the
authors experience with students, colleagues, and colloquium audiences, these
intuitions turn out to be widely shared, once they are stated thus innocently,
and independently of any debate between representatives of different formal
approaches to theory revision and theory contraction.
1. If one takes the propositions a and b jointly to justify c, and one is giving up c,
then one will have to give up either a or b.
2. If in such a situation one prefers a to b, then (in the absence of compelling logical
reasons to the contrary) one will give up b rather than give up a.
3. One would prefer giving up a alone or giving up b alone to giving up both a
and b.
4. If one believes the proposition b only because one believes the proposition a,
and one is giving up a, then one ought to give up b as well.20

Generalizing,
1. If one takes the set X of premises to justify c, and one is giving up c, then one
will have to give up at least one member of X.
2. If in such a situation one prefers some member of X to some other, then (in
the absence of compelling logical reasons to the contrary) one will give up the
latter rather than give up the former.
3. If in such a situation Z W X then one would prefer giving up all of Z to
giving up all of W.
Compare Quine and Ullian [], at p. : Insofar as we are rational, we will drop a belief
when we have tried in vain to find evidence for it. So, if our surrenderings during a contraction
process have deprived a belief of all its sources of support, it too should be a casualty of the process
of contraction.

SOME INTUITIONS

103

4. If in such a situation one believes the proposition b only because one believes
all the propositions in the set X, and one is giving up some members of X, then
one will give up b as well.

This generalized intuition () is actually expressed in a weaker form than we

are entitled to state. Beliefs can have distinct, sufficient rationales. A rational
agent can believe c on the basis of the set {a, b} and can believe c on the basis of
a quite different (indeed, disjoint) set {d, e}. Suppose now that these two are the
only justifying sets of beliefs that the agent can adduce for her belief that c. And
suppose further that each of the individual beliefs a, b, d and e is insufficient
(as far as the agent is concerned) to justify c. Imagine now that it comes to pass
that the agent gives up the two beliefs a and d. Thus both the first justifying
set {a, b} has lost a member (namely, a) and the second justifying set {d, e} has
lost a member (namely, d). And there are no other justifying sets for c, as far as
this rational agent is concerned. In such circumstances, the agent ought to give
up the belief cfor c has been deprived of all clinching support. Ex hypothesi,
the remaining beliefs b and e are insufficient as a basis for belief in c. So, even
though b and e survive the contraction process, the belief c will have to go.
The correct generalized form of intuition () is therefore
(4*) If one believes the proposition c only because either one believes all the
propositions in the set X1 , or one believes all the propositions in the set X2 ,
oror one believes all the propositions in the set Xn , and one is giving up
at least one proposition in X1 , and giving up at least one proposition in X2 ,
andand giving up at least one proposition in Xn , and what remains of X1
is insufficient to justify c, and what remains of X2 is insufficient to justify c,
andand what remains of Xn is insufficient to justify c, then one ought to give
up c as well.

The reader will no doubt forgive the author for not having offered this pithy,
perspicuous formulation right away.

4.5 The finitary predicament and the question

of well-foundedness
In Chapters and we shall allay, in the context of deductive theories (or, more
generally: axiomatizable theories in a first-order language), the misgiving that
a computational approach to contraction might suffer from some restriction in
104

A F O R M A L T H E O RY O F C O N T R AC T I O N

its range of application. It does not. We would do well to bear in mind, however, that our treatment of theory contraction will not be limited to deductive
theories, in which justificatory steps from premises to conclusions have to be
logically valid. Rather, we shall take such steps of the form p , . . . , pn ; so, q
to represent justificatory transitions for the (presumably, rational) agent whose
beliefs are in question. In our representation of such an agents belief scheme,
we do not have to be specific about the deductive or inductive status of such
steps. They are simply steps that work as far as the agent is concerned, and that
she will not give up once she has discovered them.
Whatever the nature of justificatory stepsbe they deductive or inductive
not all systems of belief developed by those steps have a well-founded structure
of justifications for their theorems. Let us turn our thoughts for a moment to
theories (or systems of belief) that are not well-founded in their justificatory
structure. According to non-foundationalist, coherentist epistemologists, the
justificatory structures of some systems of belief could involve lines of mutual
logical interdependency, or loops. We shall assume, however, that they could
not involve non-looping, infinitely descending chains of justification among
beliefs. The acquisition or entertaining of any belief takes more than some
fixed amount of time. Hence no finite agent could have progressively acquired,
hence occurrently entertained, each member of such an infinite chain, during
a finite lifetime. The same would hold even of a communal system of beliefs
accumulated by finitely many agents with finite lifetimes. Despite our thus
ruling out of consideration the infinite non-looping case, the non-well-founded
(because looping) case has not in general been excluded. Thus our notion of a
dependency network must be adequate to both the well-founded and the nonwell-founded case.

4.6 The logical macro-level v. micro-level

The intuitions governing theory contraction, and the effective procedures
embodying them, concern what one might call the logical macro-level. All one
needs to know, for the purposes of effecting a contraction, is what sentences are
involved in what justificatory steps known to the agent. That is, one need only
know what sentences (according to the agent) justify what others. The internal
logical structure of those sentences is irrelevant. Doubtless the internal logical
structure (the micro-level) will almost always have to be invoked in order to
establish steps as justificatory. But when one computes a contraction, one is
T H E L O G I C A L M AC R O - L E V E L V. M I C R O - L E V E L

105

working with a certain set of justificatory steps as given. One works only at the
macro-level.
The macro-level is a level of abstraction one up from the assignment of logical
forms to sentences and the negotiation of deductive passages among them.
In the interregna between contractions and revisionsperiods of inquiry that
might also include expansions of the belief schemethe agent will be discovering (and recording) new justificatory steps by working at the micro-level. But
as soon as one is confronted with a need to contract the scheme, one can ascend
to the higher, or macro-, level and regard the sentences in ones belief scheme as
just so many internally featureless nodes within a directed graph that contains
all the justificatory steps discovered thus far. Cf. Doyle [], at p. , when
treating his truth maintenance system:
dependency-directed backtrackingonly operates on the reasons for beliefs, not on
the form or content of the beliefs.

This is operation at what we are calling the macro-level. Similarly, de Kleer

[], at p. , describes his assumption-based TMS as consisting of two
components, a problem solver and a TMS, and writes
the same expressions have internal structure to the problem solver but are atomic to
the TMS.The TMS determines belief given the justifications encountered thus far and not
with respect to the logic of the problem solver.

In our terminology, de Kleers problem solver works at the micro-level, and his
assumption-based TMS works at the macro-level.
In this way also the method of contraction is absolutely indifferent to what
underlying logic might be employed at the micro-level. It is invariant across
choice of logic. This higher level of abstraction affords the prospect of graphtheoretic classifications of belief schemes according to their behavior under the
contraction operation. Intelligent systems could then recognize a new contraction problem as graph-theoretically isomorphic to an earlier one that might
have involved completely different sentences, with completely different internal
logical structures, and concerning a completely different subject matter. The
gain from such abstraction is a wider range of applicability, without an eye to
distractingbecause irrelevantinternal details.
Our dependency networks are made up of steps connecting nodes via inference strokes.
CONSISTENCY CONSTRAINT.

The absurdity constant is not allowed to be a black node in a

dependency network.

106

A F O R M A L T H E O RY O F C O N T R AC T I O N

The consistency constraint does not, however, prevent the agent from being
apprised of steps of the form p , . . . , pn |. Such steps can play an important
role, which will be explained in due course. They cannot, however, appear in the
agents actual belief scheme (i.e. in the black part of it), since that scheme is supposed to capture the agents beliefs. And, since the agent is assumed to be a logical paragon, she will not believe absurdity (). It will always be white for her.
As already observed, a given step (even one with conclusion ) finds its way
into an agents repertoire of known steps through some process of discovery or
recognition on the agents part, a process that may well turn on details of the
internal logical structure of the sentences that label the nodes in question. But
the step itself, once adopted, represents only the fact (at a grosser level) that,
as far as this agent is concerned, one may justify belief in the conclusion node
of a step (when that conclusion is not ) by appeal to belief in all its premise
nodes. That is the ground zero, or lowest substratum of relevant facts, that will
be available to guide the agent (or guide us, on the agents behalf) through any
subsequent process of contraction (or revision).
For these reasons, we adopt here the following methodological maxim:
MACRO-STRUCTURAL CONSTRAINT.

What counts as a correct contraction should never turn on

any of the internal details of the sentences involved.

One should be able to judge the correctness of a contraction solely by reference

to the structure of the justificatory steps within the belief scheme in question, in
which each sentence is a node, labeled by a single letter (perhaps with a numerical subscript) to distinguish it. This ensures that the contraction problem is fully
concrete, in the mathematical or computational sense, so that one can intelligibly raise the question To what complexity class does this problem belong?.
As with any scientific endeavor, one seeks to carve Nature at the appropriate
joints in order to understand the relevant structures and the processes in which
they are involved. Our contention here is that the right level of structure is that
of a step within a dependency network, taken as a primitive data type, and
without an eye to potentially distracting details concerning the logical forms
of its premise and conclusion nodes. That methodological stance will in the
end be justified by its theoretical fruitfulness. We shall discover that in this
modest framework we can handle all the intuitive problems that arise in various
examples of belief revision; cast light on interesting patterns of phenomena
that emerge at a global level; give some formal meat to intuitive notions, by
way of formal explication; and answer interesting theoretical problems within
a simplified abstract setting.
T H E L O G I C A L M AC R O - L E V E L V. M I C R O - L E V E L

107

In order to attain the appropriate notion of finite dependency network, for

the modeling of such belief schemes, we need to proceed more gradually via
some new notions peculiar to that task.

4.7 New notions needed for the modeling of

belief schemes
In our formal modeling, we are representing any rational agents finitary belief
scheme as consisting of finitely many sentences (or nodes), arranged in finitely
many steps. The collection of such steps is a dependency network. (Note that
we have yet to state a precise formal definition of the notion of dependency
network. Everything we have said thus far about dependency networks has been
designed to convey the intended notion, so that the formal definition, when it
is given, will make good sense.) Every node figuring as a belief of the agent
must stand as the conclusion of some stepeven if this is a step of the form x|x,
indicating that the belief x is, as far as the agent is concerned, directly warranted.
Beliefs that are only indirectly warranted within the agents belief scheme will
stand as conclusions of steps whose premises are in the scheme in question.

4.7.1 Nodes
Nodesfeatureless and unstructuredare to represent particular beliefs within
the belief scheme of a rational agent. They represent, as it were, specific propositions that the agent might or might not believe. Nodes are the Urelemente
of which we treat. Everything else that we shall be talking about will be built,
Bourbaki-style, out of nodes by forming hereditarily finite sets. In this project
of theoretical modeling, one must be careful not to take certain convenient
artifacts of the model as representing would-be, but absent, features of the
situation being modeled. We shall have occasion to remind the reader of the
need for caution on this score when we see how we treat initial beliefs in our
formal modeling.

4.7.2 Steps formally defined

Definition 1 A pair (U, x) is called a step just in case
(1) U is a non-empty finite set of nodes and x is a node, and

108

A F O R M A L T H E O RY O F C O N T R AC T I O N

(2) x is in U if and only if U = {x}.

U is called the premise set of the step (U, x); x is called the conclusion of the step
(U, x).
Observation 1 For a given node x there are only two possible forms of step with
x as conclusion:
y , . . . , yn |x where each yi is distinct from x ( i n); and x|x.
We shall call these transitional and initial steps, respectively.
Every step is either initial or transitional. No step is both initial and transitional.
The reader is advised not to confuse our use of | here with other widespread
uses of that symbol. The latter include the use on which it is read as such that
within a set-abstract like {x | F(x)}; as well as its use in logic programming,
where it means given, as in procedural rules of the form
goal | subgoal , . . . , subgoaln .
Our use of | might look like a single turnstile shorn of its horizontal stroke:
to be sure, premises occur to its left, and a conclusion occurs to its right. But
what is designated overall is a justificatory step (for the agent). No claim of
logical deducibility is made or implied by the use of |. For, first, x , . . . , xn | y
is a complex noun phrase, meaning the step whose premises are the nodes
x , . . . , xn and whose conclusion is the node y. By contrast, , . . . , n 
is a statement, to the effect that there is a proof of the sentential conclusion
from the sentential premises , . . . , n . Secondly, the nodes are featureless, and
devoid of logical structure. That is not to say, however, that an agent might not
know of a certain step because of an actual deductive proof in her possession,
leading from the sentential premises corresponding to the premise-nodes of the
step in question to the sentential conclusion corresponding to its conclusion
node. It is just to say that when such a step is represented as a transition, not
among sentences, but among featureless nodes, such deductive provenance can
be, and is, suppressed. This is in the interests of revealing only such justificatory
macro-structure within a belief scheme as is relevant for the purposes of contraction. This structure resides at a grosser and more abstract level than that of
the detailed logical forms of sentences themselves.
Definition 2 Let T be a set of steps, called T-entries. For any step (U, x) in T, U
is said to be x-generating or (when x = ) x-justifying (in T).
N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

109

Some terminological clarification is in order here. What we are here calling

steps are called justifications in the JTMS-literature. We prefer the shorter,
neutral designation because not every step is a justification in the usual epistemological sense. In general, justifications (in the usual sense) would consist
of more than one step. Note also that premises, in the JTMS-literature, are taken
to be assumptions that cannot be retracted. This too is a non-standard use of the
logicians word premise. The logician speaks of premises for a step of inference,
without necessarily endorsing those premises as true.

4.7.3 Steps informally explained

The agents beliefs will be represented as standing in relations of support (as far
as the agent is concerned), and these relations are made explicit in what we are
calling (justificatory) steps involving nodes ( = ). A step is fully specified by
specifying its finitely many premises and its conclusion.
We impose a simple rational constraint at the outset. First, note that no
rational agent would ever seek to justify a belief by appealing both to that belief
and yet other beliefs. This rational reluctance can be subsumed as a special case
of the following more general constraint.
PERFECTION CONSTRAINT.

No rational agents repertoire of steps contains two distinct steps with

the same conclusion, and with all the premises of one of those steps being among the premises
of the other.

Put another way: steps in a rational agents repertoire require all their premises.
If an agent comes to realize, of a given step in her repertoire, that she can reach
its conclusion by using some but not all of the premises of that step, then she
will discard the weaker step in favor of the stronger step that uses the weaker
(reduced) set of premises.
From now on we assume that all (our formal modelings of) a rational agents
belief scheme, and repertoire of known steps, satisfy the perfection constraint.
A step whose conclusion is distinct from each of its premises is called transitional. In our modeling, a transitional step is understood as being something
of which the agent is aware, or which the agent has acknowledged, as rationally
compelling for her. Hence it is a normative requirement that the agents system
of beliefs should be closed with respect to all such steps. One is, in effect, saying
to the agent Since you yourself acknowledge the step from x , . . . , xn to y as
110

A F O R M A L T H E O RY O F C O N T R AC T I O N

compelling, and since you believe each of x , . . . , xn , you should also believe y.
Note that such obligations are agent-relative, since the nodes are featureless.
We are not adverting to the logical structures of the sentences expressing the
beliefs x , . . . , xn and y, and insisting that the agent should recognize the step
as logically valid. Rather, it is taken as a given that the agent herself, for whatever reason, has already acknowledged the step in question as compelling. Her
obligation is now only that of taking the step to y should she ever come to believe
all of x , . . . , xn .
Although nodes are basic, in that steps are built up out of them, we shall find
that steps themselves are the most convenient data type with which to work.
Note that an agent can know of a step without being committed to any of its
nodes, as beliefs. But if an agent knows of a step all of whose premise nodes she
believes, then we take her to be committed to believing the conclusion of that
step as well.
Given the perfection constraint, any step with more than one premise
will be transitional. For steps with exactly one premise, there are two possibilities: those where the conclusion is distinct from the premise and hence are
transitional; and those where the conclusion is identical to the premise (and
hence are non-transitional).
In the latter case, we acquire a convenient way of representing an initial belief:
one that is believed outright, in the sense that (as far as the agent is concerned)
it requires no further support from any other beliefs that the agent happens to
hold. The operational meaning of an initial step, i.e. one of the form p|p, is to be
that p is believed outright, without justificatory appeal to any other beliefs. The
diagrammatic representation of such an initial step is as follows (as explained
in Chapter ):

An example might be a simple perceptual statement such as This penny is

brown. The epistemologist who wishes to quibble with our choice of this kind
of sentence is free to substitute her own favorite kind of directly warrantable
sentence instead. The idea here is that some beliefs that the agent holds need not
be based on, or justified by appeal to, other beliefs.
Note that the operational meaning of p|p is not the logicians law of reflexivity
(or rule of initial sequents)that p follows logically from p. Nor is it that p

N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

111

is logically valid. Indeed, it will be a simplifying assumption in our modeling

(without loss of any generality in its applications) that no logically valid sentence
can ever feature as a premise, or as the conclusion, of any step. Steps will only
ever involve sentences that are not logically true.
We say in the case of an initial step p|p that the belief p in question can
be thought of as depending on itself . The notation p|p is employed mainly
for reasons of technical convenience within our chosen Bourbaki-style formalization of dependency networks. We require each premise of any step in
a network to feature as the conclusion of some step. For initial belief nodes,
that poses a formal problem. This is because we tend to think of initial beliefs
as beliefs that do not rest on any other beliefs; indeed, they rest on nothing that
is propositionaleven if they do rest on something non-propositional, such as
perceptual experience. The formal problem, for an initial belief p, is this: how
best should we represent ps being held as an initial belief, given that our chosen
method of formalization requires that p feature as the conclusion of some step?
The formal answera trick, if you willis to take as the step in question the
reflexive-looking {p}, p, or p|p. This makes it look as if we are thereby regarding
p as mysteriously justified by appeal to itself . But this mistaken appearance
is entirely an artifact of the trick that we have adopted within a Bourbakizing
framework.
Representing an initial belief p by means of the step p|p does not mean that
the belief p is being represented as somehow having been drawn (by the agent)
as a conclusion from itself. For that would be blatantly circular, and is definitely
not what is going on when an agent forms an initial belief. Nor does it means that
the belief p is a priori, and therefore unable ever to be repealed. It means only
that the agent believes p outright, in the sense that, as far as she is concerned, she
would be justified in believing p even if p were to enjoy no justificatory support
from any other beliefs within her scheme.
This is of course compatible with p also enjoying such support in certain
cases. To make vivid the point that initial beliefs are not necessarily a priori, we should remind the reader that our modeling of finite belief schemes
could confine itself to just the contingent beliefs of the agent. In our representation of the agents beliefs, a belief s depending on itself (i.e. being
believed outright) will be registered by means of a single-premise step, whose
premise is the very same node as its conclusion. By adopting this convention we attain a certain smoothness in our mathematical and computational
treatments.

112

A F O R M A L T H E O RY O F C O N T R AC T I O N

Recall that steps fall into two disjoint kinds. There are the initial steps, whose
reflexive-seeming Bourbakization p|p we have explained above; and there are
the transitional steps, that take one from certain premise nodes to another,
quite distinct, conclusion node. We repeat, however, that it is compatible with
ps being an initial belief that p stand also as the conclusion of some other,
transitional, step, all of whose premises the agent believes. Such would be the
case, for example, if p were a simple observational belief that the agent had
acquired in the usual way, but for which the agent also had theoretical support
by way of, say, prediction within a higher-level theory on the basis of yet other
observational beliefs.
Any rational agent who has a system of beliefs might treat some of these only
as initial, that is to say, might believe them outright, without offering yet other
beliefs in support of them. In all other cases, a belief will have support within
the agents system. That is, the belief in question will stand as the conclusion of
at least one transitional step that involves at least one premise, and all of whose
premises are in turn believed. Naturally, a belief can be over-determined, by
enjoying support from many distinct (though not necessarily disjoint) premise
sets, each of which is sufficient (from the agents point of view) to justify the
belief in question. (This is why we had to be so careful in formulating the
generalized intuition (*) in Section ..) This is what makes the contraction
problem, in general, so interesting. For, in giving up such a belief p, the agent
will have to give up at least one premise within the premise set of each step that
has p as its conclusion.
We argued in Section . that we can omit from a rational agents belief
network any nodes labeled by sentences that she knows to be logically true. We
do, however, continue to cater for the possibility that a logical falsehood might
pop up within a belief scheme. It may take time for the agent to discover that
absurdity lurks in her belief schemetwo contrary beliefs p and qbut as soon
as she is aware of that fact she must contract with respect to the conclusion
of the newly recruited step
p

whose presence, now, in her repertoire of known steps is precisely what her
awareness of that fact consists in. (Note that we do not say presence, now, in
her belief scheme, since it is required of any step within a belief scheme that its

N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

113

premises and conclusion be believed.) Note that in many cases q will be of the
form p, the explicit contradictory of p. But we are allowing here also for pairs
of contraries such as It is nutritious and It is poisonous. 21
Our modest consistency requirement on a rational agent is not that her
beliefs should always be consistent tout court, but only that they should be
consistent according to the steps of which she is apprised. 22 As soon as she
becomes apprised of a new step whose conclusion is , the use of which renders
her current beliefs jointly inconsistent, she must undertake the necessary process of contraction (with respect to ) in order to get rid of the inconsistency.
The rationality maxim in question is therefore Always be prepared to contract
with respect to !, rather than the unrealistically demanding Do not ever form
beliefs from which can be derived!unless, of course, she already knows the
steps by means of which can be derived. The way this would be represented
in our diagrams is to insist that the absurdity node and the inference stroke
immediately above it always be white:
p

Here we color the nodes p and q gray, in order to emphasize the obligatory
whiteness of what is below them.
The operational meaning of a transitional step, i.e. one of the form
y , . . . , yn |x, is that for the agent, the premises y , . . . , yn would justify the
conclusion x. If moreover she believes each of the premises y , . . . , yn , then she
does believe the conclusion x, since she is a logical paragon. The presence of
this step within the agents belief scheme (let us call that scheme B) represents
the agent both as believing its premises y , . . . , yn and hence also as believing its
conclusion x. Knowledge of the step is one thing; believing all its premises, and
hence believing its conclusion, is quite another. In Chapter we used black to
indicate belief:
See Tennant [], where a case is made for logical contrariety being more fundamental than
the notion of a propositions contradictory.
Even this modest a requirement puts one in disagreement with Foley [].

114

A F O R M A L T H E O RY O F C O N T R AC T I O N

...

y1

yn

Once a transitional step is known to the agent, it remains a permanent conduit, and represents a commitment on her part. So, whatever the patterns of
colorationhere is the same step but with a different pattern of coloration:
...

y1

yn

this little bit of the jungle gym remains as a step known to the agent.
This too is a rather modest requirement of rationality. If the agent were ever
to give up the belief x, then she would have to give up also at least one of
the beliefs y , . . . , yn . (The last diagram represents her as having given up at
least yn .) Moreover, if thereafter the agent were ever willing once again to assert
all the premises y , . . . , yn of the step, then she would be willing also to assert its
conclusion x. Such relative justification is internal to the agent, and we do not
inquire after its legitimacy. We can prescind from all questions about the nature
of the justification, about the status of such intermediate inferences as she may
have employed, and so on. The agent sets her own standards of justification; but
then we take her as beholden to them.

4.7.4 The agents transitional commitments, and what she

believes
Our commitment requirement of rationality is only that the agent should
always respect those (transitional) steps of the form y , . . . , yn |x of which she
is or has been apprised. Since there are only ever finitely many such steps, this is
not an unrealistic requirement. Let the set of all (transitional) steps thus known
to the agent be C. This is what we have thus far been calling the agents repertoire
of known steps. The choice of letter here is meant to be suggestive of (known)
N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

115

consequences. Quite serendipitously, it also suggests de Kleers [] cache for

all the inferences ever made (p. ).
Every transitional step in the agents (varying) belief scheme B is in C. There
are no initial steps in C; these are confined to B. The transitional steps within B
are the ones all of whose premises (hence also their conclusions) are believed.
(They would be the completely black steps in the diagram representing both
B and C.) Hence is never in the agents belief scheme. The only place we can
find occurring is as the conclusion of a step known to the agent; and all such
steps will reside in the fringe C \ B. Here is an example:

Every step in C \ B would, on our coloring convention, have its inference stroke
white, even if its conclusion is not . And any step whose inference stroke is
white must have that inference stroke positioned in the fringe C \ B. The conclusion of such a step, howeverprovided it is not could still be black, by virtue
of support received from elsewhere, within B. And every black conclusion node
lies within B. For example:

116

A F O R M A L T H E O RY O F C O N T R AC T I O N

The picture, then, is that the transitional part of the agents belief network B
is (most likely, properly) contained within the set C of transitional steps known
to her. In the case of proper containment, C \ B is non-empty. So there is a step
y , . . . , yn |x in C that is not in B. This means that the agent does not believe all
of the premises y , . . . , yn (so at least one of them would be white, along with
the steps inference stroke); otherwise, the step would be in B.
Moreover, C can contain steps with conclusion . Since B is consistent modulo C, this means that given any such step, not all of its premises can be in B.
Consider such a step p, q|. If its premise p is in B, then its other premise q
must lie outside B:

..
.

B
C

In the terminology of Doyle ([], at p. ), q would be on the outlist

of p (and vice versa). As it happens, the formal modeling we have chosen
the structuring of belief networks B, their transitional parts, and the set C of
known steps, among which might be steps with conclusion obviates the
need for any analogue, in our treatment, of Doyles outlists in addition to his
inlists.

4.7.5 Dependency networks formally defined

Definition 3 Let T be a set of steps whose conclusions are not . T is a dependency network if and only if T is finite and
1. for every (U, x) in T and for every y in U, there is some (V, y) in T;
2. if (U, x) and (W, x) are in T, and neither U nor W is {x}, then W is not a proper
subset of U.

N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

117

A dependency network is our way of modeling those beliefs of a finite rational

agent that are not logically true, along with the justificatory structure that the
agents thinking has revealed among those beliefs. What we have been calling a
belief scheme or system of belief B is formally modeled as a dependency network.
We shall continue to use these terms interchangeablythe former two when we
need to harken back to intuitive motivations for our modeling, the latter when
we are dealing with the formal modeling itself.
Condition () in our definition of a dependency network ensures that every
node involved in any way in T is justified (for the agent) in T. Any conclusion x
of a T-entry (U, x) is justified simply because of the premise set U of that entry.
Recall the possible forms for a step with conclusion x:
y , . . . , yn |x
where each yi is distinct from x ( i n); and
x|x.
In the former case, each member y of U is in turn justified by some set V. In
the latter case x is already justified without having to appeal to any other belief;
at least one train of justification stops at (and originates in) x. We can call such
a node x self-justifying in T. We should avoid the possible confusion, however,
of thinking of self-justifiers as logical theorems. As our earlier example This
penny is brown showed, the self-justifying axioms of a dependency network
can be contingent statements.
Condition () ensures that a dependency network only ever uses the most
succinct justifications available. There is no point in having the entry (U, x) in
a belief scheme or repertoire of known steps if for some proper subset W of U
we have (W, x).
The reader might wonder whether to include also a further condition:
() if ({x}, x) and (U, x) are in T, then U = {x}.
Condition (), it might be thought, would secure the intended interpretation of
x|x as x is believed but is not justified by appeal to any other beliefs.
We shall purposely eschew imposing Condition () (on the obvious universal reading: for all nodes x ), for the following reasons. First, we can agree to
interpret x|x as meaning that x is believed (by the agent in question) but does
not need to be justified by appeal to any other beliefs (of the agent in question).
This is what being an initial belief really consists in. Take now a prime example
118

A F O R M A L T H E O RY O F C O N T R AC T I O N

of such a belief, such as (given suitable lighting conditions, unobstructed views,

etc.) This penny is brown. Normally one holds such a belief directly, on the basis
of perception. But there is no reason at all to exclude other, more complicated
ways of justifying such a belief. One might appeal, for example, to beliefs about
the metallic makeup of pennies, about their resulting stability in color, and
about a requirement, at the Mint, that all exiting pennies be brown.
More generally, let O by any observation sentence of the kind that one would
normally believe directly on the basis of perception. One of the aims of science
is to explain the truth of many such sentences, on the basis of higher-level laws
and observation sentences concerning antecedent observable matters. Thus one
might deduce O from a (believed) law L and some other observational beliefs
O , . . . , On . If O registers the outcome of some experiment whose initial and
boundary conditions are given by O , . . . , On , then one might have the preexperimental, i.e. predictive belief O on the basis of ones belief in L and ones
beliefs O , . . . , On . Upon running the experiment, one might come to belief
O directly, upon perceiving the experimental outcome. In such a situation, it
would be fair to have O involved as the conclusion of two distinct steps: first, the
transitional step L, O , . . . , On | O; secondly, the initial step O | O. This would
run counter to Condition ().
Note that our reluctance to impose Condition () on its universal reading
does not render our framework incapable of accommodating the foundationalist. Not thus imposing Condition () does not entail that there cannot be any
nodes x for which Condition () holds. So the foundationalist is free to have
beliefs x that are not supported by any other beliefs. We can still model the
foundationalists preferred kind of belief scheme. As we shall frequently remind
the reader, ours is a catholic account, with a small c. Our dependency networks
are designed to accommodate different epistemological views as to the overall
structure of the justificatory relation.
We shall often write x|x more economically as | x. This enables one to
tell at a glance that x is a self-justifying starting point within the network
concerned.

4.7.6 Examples of dependency networks

1. , the empty dependency network.
2. {({a}, a)}, the dependency network consisting of the single self-justifying statement a. We can also write this as
| a.
N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

119

3. {({a1 }, a1 ),, ({an }, an )}, the dependency network consisting of the selfjustifying statements a1 , . . . , an . We can also write this as
| a1 , . . . , | an .
4. {({a}, a), ({b}, b), ({a, b}, c)}, the dependency network consisting of the two selfjustifying statements a, b and their immediate consequence c. We can also write
this as
| a,

| b,

a, b | c.

5. {({a}, b), ({b}, a)}, the dependency network consisting of the two mutually justifying statements a, b (making up a shortest possible loop). We can also write
this as
a | b,

b | a.

6. {({a1 }, a2 ), ({a2 }, a3 ),, ({an }, a1 )} (n 2), the dependency network consisting of the statements a1 , . . . , an arranged in a longer justificatory loop. We can
also write this as
a1 |a2 ,

a2 |a3 , . . . ,

an |a1 .

7. {({a}, a), ({c}, b), ({a, b}, c)}, the dependency network consisting of the selfjustifying statement a, the statement b depending on c, and the statement c
depending on a and b. We can also write this as
| a,

c|b,

a, b|c.

8. {({a}, a), ({b}, b), ({a}, c), ({b}, c)}, the dependency network consisting of the selfjustifiying statements a and b, and the statement c, which depends on a and also
depends on b. That is, each of a and b by itself is sufficient justification for c. We
can also write this as
| a,

| b,

a | c,

b | c.

Remark 1: It is evident from our definition and examples that a dependency

network need not have a well-founded justificatory structure. Examples () and
() do not even have any well-founded part; while example () combines a wellfounded part with a non-well-founded part. Note, however, that the non-wellfoundedness is confined to looping, and does not arise from infinite descending
chains.
Remark 2: In general there can be more than one T-entry of the form (U, x) for
any given statement x. Condition () in the definition of a dependency network
tells us that each such U isin the context of the justificatory connections
known to the agenta minimal generating set for x: that is, U implies x but
as far as the agent is awareno proper subset or superset of U implies x. In
future we shall often suppress the adjective minimal; but it should be borne in
mind that it always applies.
120

A F O R M A L T H E O RY O F C O N T R AC T I O N

Remark 3: The definition of a dependency network captures, as it were, its

geometrythe pattern of nodes, arrows and inference strokes within a blackand-white diagram representing the networkbut does not always fully determine its coloration as wholly black (according to the coloring convention
adopted and explained in Chapter ). Nodes for any initial beliefs in a dependency network must of course be colored black in any diagram representing
the network, and the black should be transmitted to inference strokes and
conclusions of such steps as have all their premise nodes colored black. But
sometimes there is no way to determine that the whole network, as a result,
would be black. For example, the non-well-founded network () above, which
lacks initial nodes altogether, could either be wholly white:

or wholly black:

Likewise, the partly non-well-founded example () above can be either white or

black at least in part, even though the initial node a must be black:

or
c

Remark 4: Notwithstanding Remark , any dependency network (as formally

defined above) can be colored wholly black (as just illustrated on the right
N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

121

immediately above), without violating any of the Axioms of Coloration set

out in Chapter . (This is because no dependency network contains a node
labeled .)

4.7.7 More network notions formally defined

Definition 4 |T |, the kernel of T, is the set of statements x such that for some U,
the dependency network T contains the entry (U, x).
An agent whose beliefs are modeled by a dependency network T believes exactly
what is in |T |, and for the reasons articulated by the entries in T.
Definition 5 A node q is said to be in a dependency network T (and conversely:
T contains q) just in case some step (U, q) with conclusion q is a member of T. 23
(Recall that a dependency network is defined as a set of steps (satisfying certain
conditions).)
Note that every member of any such premise set U will also be in T, because
of condition () in the definition of a dependency network. Thus any node
involved in any T-entry is in T. With this understanding of the preposition
in, we can say (loosely) that a node is in (T\R) (where R is a subnetwork of T)
when what is meant, strictly, is that it is in (|T|\|R|).
Definition 6 R is a subnetwork of T just in case every entry of R is an entry of
T and R is a dependency network. We also say that the network T extends the
subnetwork R.
Definition 7 Let R be a subnetwork of T. We say that R is closed upwards modulo
T if every initial element of R is initial in T.
Remark 5: Note that a subnetwork of T, since it is a dependency network in
its own right, is closed upwards modulo T. That is to say, a subnetwork of
T will not have any elements of T as initial elements that are not also initial
in T. Instead, the subnetwork will supply for each of its non-initial elements at
least one of the patterns of justification with which it is furnished within the
containing network T.

122

Cf. Doyle [], p. .

A F O R M A L T H E O RY O F C O N T R AC T I O N

Example to illustrate Remark 5. Let T be the dependency network

|p, |q, p|r, q|r.
The node r is the only non-initial node. Any subnetwork of T that contains r will
have to contain also one of its patterns of justification within T. As it happens,
there are two distinct such patterns: one leading from the initial node p, the
other leading from the initial node q. Thus the only possible proper, non-empty
subnetworks of T are
|p, p|r
and
|q, q|r.
Both these subnetworks terminate their justifications for r on initial nodes.
When closing upwards modulo T, however, one does not in general always
terminate in this fashion on initial nodes. For example, consider the non-wellfounded network
p|q, q|p, p|r, q|r.
The only subnetwork of T that contains the node r is T itself. For, as we close
upwards from r modulo T, we must include either p or q as a node. Each of
these, in turn, requires the other, in order to have any T-justification at all. But
neither of them is initial.
Remark 6: Not every subset of a dependency network is a subnetwork.
Example to illustrate Remark 6. {({b}, a)} is a subset but not a subnetwork of
the dependency network {({b}, a), ({a}, b)}. {({b}, a)} fails to be a dependency
network because b enjoys no justification within it.
Definition 8 R is closed downwards modulo T if and only if for every step (U, x)
in T, if U |R|, then (U, x) is in R.
Definition 9 The T-closure of R is the -least subnetwork S of T satisfying the
following:
(1) R is a subnetwork of S ; and
(2) S is closed downwards modulo T.

N E W N OT I O N S F O R M O D E L I N G O F B E L I E F S C H E M E S

123

This definition has as an immediate consequence that the T-closure of R is

closed upwards modulo T. (See Remark above.)
We shall write [R]T for the T-closure of R, and sometimes suppress mention
of T when T is clear from the context. An intuitive understanding of T-closure
is as follows. The subnetwork R of T, before such closure, will, as a dependency
network in its own right, contain justifications for every one of its nodes (as a
conclusion). But it might also contain all the premises (i.e. members of U) of
some T-step (U, x) without containing the conclusion x itself. The requirement
of T-closure is that R should then be expanded by adding (U, x) to R and thereby
justifying x within R. It does not follow that every conclusion of T itself would
in due course be added in this way. The closure process could be carried out to
its fullest possible extent, while yet the T-closure fall properly short of T itself.
This would happen when |R| failed to encompass enough of the members of |T |
for the T-steps to effect a full enough expansion during closure. Clearly also, a
proper subnetwork R of T can be properly contained in its own T-closure. The
following remark summarizes these observations.
Remark 7: In general we have that R is a (possibly proper) subset of its T-closure
[R]T , which in turn is a (possibly proper) subset of T.
Example to illustrate Remark 7. R = {({a}, a), ({b}, b)} is a proper subnetwork of
T = {({a}, a), ({b}, b), ({a, b}, c), ({d}, d)}
but the T-closure of R is {({a}, a), ({b}, b), ({a, b}, c)}. So here we have R properly contained in its own T-closure, which in turn is a proper subnetwork
of T.
Remark 8: RT can be computed from R and T in polynomial time.
Definition 10 A subnetwork R of T is T-closed if and only if R is its own Tclosure, that is, just in case R = [R]T .

4.8 Closure
In the course of the agents investigations, she can come to accept or acknowledge many transitional steps of the form
y , . . . , yn |x
124

A F O R M A L T H E O RY O F C O N T R AC T I O N

while yet failing to believe all of y , . . . , yn . The belief x might fail to enjoy any
support, within the agents belief scheme, from sufficient sets of beliefs (from the
agents point of view). In such situations the known steps with x as conclusion
are not useless. For, if ever the agent were to come to believe all the premises
of any such step, its conclusion x would thereby acquire rational support (from
her point of view). This could happen, for example, if the agent at first believed
all of y , . . . , yn but did not believe yn ; and subsequently came to believe yn .
At that point, since the step
y , . . . , yn |x
is known to the agent, she would be rationally obliged to adopt the belief x. That
is, she would have to close her beliefs under the step in question.
Clearly, such obligatory operations are iterable, with respect to all known
steps all of whose premises have come to be believed. But the iterations will
only ever be finite in number. This is because only finitely many steps are known
to the agent, and each step involves only finitely many premises. The need for
these iterable operations arises only when the agent adopts one or more new
beliefs.
Now it is important not to fall prey to the confused thought that the agent
may know of schematic rules that correspond to an infinity of steps. We reiterate
the point that our nodes are featureless, and their labels are not to be thought
of as endowed with any essentially logical structure. Each node represents a
particular belief, as given by a particular proposition, expressible by a particular
sentence. No agent will ever have justified to herself more than finitely many
such beliefs. Nor will she ever have performed, in her thinking, more than
finitely many steps. Indeed, at no time in the future of humankind will the
communal belief scheme, and its repertoire of known steps, even assuming
perfect memory, ever contain more than finitely many beliefs, or involve more
than finitely many steps. We call this the finitary predicament. Fortunately, it is
what makes a computational account of contraction and revision possible! To
put the matter succinctly: for the purposes of belief representation, schemata are
irrelevant; only their instances count. And at any point in time, there will have
been only finitely many instantiations.
We shall call the outcome of the iterable operations described above the
universal closure of the agents belief scheme, within the set of steps known to
the agent, and with respect to the agents set of newly adopted beliefs. We are
assuming that in this context there is no possibility of confusing this kind of
universal closure with the logicians syntactic notion of the universal closure of
CLOSURE

125

a formula with free variables, which closure is obtained by prefixing the formula
with universal quantifiers to bind its free variables. Universal Closure is called
propagate inness by JTMS-theorists; see Forbus and de Kleer [].
The situation can be schematized as follows. Let C be the finite set of all
transitional steps known to the agent. Every transitional step in the agents
current belief scheme B (which itself is finite) will be in C; but in general there
could be (transitional) steps in C that are not in B. Moreover, B can contain
initial steps, none of which is in C. Note that in the belief scheme B, every node
of every step is believed, whether it be a premise or a conclusion of the step in
question.
By way of illustration, take the current belief scheme B to consist of the steps
a|a (initial)
e|e (initial)
e|h (transitional)
and let the set C of transitional steps known to the agent be
e|h
a, b|d
c, d|f
d, e|g.

(note: this is also in B)

The following diagram represents the combination of B and C. We employ once

again the diagrammatic conventions laid out in Chapter . The black nodes
represent the actual beliefs of the agent. These are conclusions of steps in B.
The white nodes represent propositions that are not believed, but that feature
in transitional steps in C \ B. The initial beliefs (which are all in B, and are
black) are each furnished with an initial arrow emanating from a horizontal
stroke that itself receives no arrows. Horizontal strokes represent the inferential
transitions made in steps. The inferential direction is downwards (at least in this
illustration; but there are other cases where it proves convenient to have arrows
pointing upwards or sideways). In general, more than one arrow can come
down to a single inference stroke, from the premises of the step in question;
while only one arrow descends from the stroke, to the conclusion of the step in
question. If a step has all its premise nodes black, then its horizontal stroke is
also black. Such a step will be in B. But if a step has at least one white premise
node, then its horizontal stroke is accordingly white. Such a step is in C, but
not in B.
126

A F O R M A L T H E O RY O F C O N T R AC T I O N

Let P now be a finite set of nodes not in B. The nodes in P are to be understood as newly adopted initial beliefs. If, upon adopting all the new beliefs
in P, the agent finds that she now believes all the premises of some step in
C \ B, then she is obliged to close her beliefs under that step, thereby possibly
acquiring a further new belief (namely, the conclusion of the step in question).
The eventual outcome of iterating the operation will be the universal closure
discussed above. In full detail, it is the universal closure of B within C with respect
to Pabbreviated [B; P]C .
Let us illustrate the process of universal closure with the diagram above.
Suppose we take P to be {b}. Then the universal closure [B; P]C is easily seen
to be the black part of the following diagram:

Dependency networks can in general contain subnetworks. The task of contracting a network T with respect to one of its nodes p will be the task of finding
a suitable subnetwork: one that does not contain the node p, but that satisfies
CLOSURE

127

the rational closure requirement (with respect to the transitional steps in T).
A further requirement would be that the contraction is, in some suitable sense
(to be explicated below) maximal. That is to say, the subnetwork R in question
must be the outcome of a minimally mutilating process of contraction of the
original network T. And the subnetwork R must itself be closed with respect to
the transitional steps in T.
Why require such closure? Because the subnetwork R is supposed to represented a new rational reflective equilibrium for the agent. She is still rationally
beholden to close her surviving beliefs under all the steps known to her. Even
though the status of nodes may change, the steps remain, as conduits of commitment that will continue to compel the agent from their premises to their
conclusions. The agent will have achieved reflective equilibrium after carrying
out the contraction process in question only if that equilibrium represents her
as having made all the justificatory transitions that she knows about. The justificatory transitions in question are exactly the transitional steps in T. We must
remember that in giving up a step, the agent is not losing, or eschewing, or
no longer claiming to be aware of, the justificatory transition that it represents;
rather, she is simply reaching a state in which she no longer believes all its
premises. The step itself, however, is still there for her to use; and use it she
ought. Her new system of beliefs must be closed; it must be a T-closed subsystem
of her original system T.
We shall explicate the notion of maximality below. It is important to realize
that in general a network T might contain more than one maximal closed subnetwork not containing p. That is, the operation of contracting T with respect
to p can in general yield more than one result. This will be reflected in the nondeterministic character of any algorithms that one might devise for performing
contractions.
The complaint has been raised, by theorists immersed in the AGM-tradition,
that any procedure for contraction should tell one exactly which contraction to
adopt. But this is not, in general, possible! Contraction is not functional. That is,
contraction is not an operation with uniquely defined values. No matter what
extra information one avails oneself of, in the way of relative entrenchment of
beliefs (say), there is always the logical and mathematical possibility that there
is more than one equally good contraction of a given system of beliefs with respect
to any chosen one of the beliefs therein.24 Our account has the great virtue of
accepting this possibility (which tends to be the rule rather than the exception),
Tennant [a] offers a friendly amendment to AGM-theory, allowing for multiplicity of
contractions and revisions.

128

A F O R M A L T H E O RY O F C O N T R AC T I O N

and turning to the task of how one accounts for all the eligible contractions
in the multiple-valued case. Indeed, the contraction algorithm(s) described in
Chapter systematically generate all the eligible contractions; and in the Prolog
implementation that we favor, this is achieved by back tracking from one good
solution to another, until all the equally good solutions have been enumerated.

4.8.1 Universal closure of belief schemes

The informal explanation of universal closure given in the previous section
should enable the reader to understand the following statement, in pseudocode,
of the algorithm for universal closure.

Algorithm 4.8.1: U n i v e r s a l C lo s u r e C, B , P
Steps C
Closure B the set of initial steps involving members of P
while some step in Steps but not in Closure has each of its premises standing
as the conclusion of a step in Closure

NewSteps the set of all such steps

do Closure Closure NewSteps

Steps Steps \ NewSteps

return (Closure)

The algorithm must terminate, since C is finite. We say that it determines the
universal closure (of B within C with respect to P) because of the word each in
the while condition.
Universal closure is exceptionally simple. Indeed, even the prima facie more
difficult problem of deciding whether a given step can be derived using finitely
many given steps is solvable in linear time. In this connection, see Dowling and
Gallier []. The problem is exactly that of querying a Prolog program with
finitely many propositional clauses. A conditional Prolog clause such as a :- b, c.
is precisely the transitional step b, c|a. An unconditional Prolog clause a. is
precisely the initial step a|a. To find whether, say, the step p, q, r|s follows from
finitely many other steps, simply form the Prolog program consisting of the
clauses corresponding to the latter steps, adjoin the Prolog clauses p., q. and r.
to the program, and query the expanded program with s.
CLOSURE

129

4.9 Contraction formally defined

Definition 11 The following conditions on a subnetwork R of T are individually necessary and jointly sufficient for R to be a contraction of T with respect
to p:
1. (HONESTY) R is a T-closed subnetwork of T.
2. (SUCCESS) |R| does not contain p.

Remember that T-closure involves only the application of steps that are never
called into question during the contraction process.
The honesty condition says that one should not be able to close Tp any
further by means of T-steps. Thus a contraction contains all nodes known to be
consequences of any nodes that it contains.
The success condition says that Tp should not contain any step of the form
(U, p). Put another way, p should not be in |T p| = |[Tp]T |.
Definition 12 A contraction R of T with respect to p is minimally mutilating just
in case it satisfies the further condition
3. (MINIMAL MUTILATION) R is inclusion-maximal with regard to (1) and (2).

The minimal mutilation condition ensures that a contraction is as economical as possible, in the sense that one gives up as little as possible in the
way of T-steps when passing from T to Tp. Here, giving up a step means
changing its inference stroke and at least one of its premises from black to white.
The step itself, of course, remains, relegated to C \ B, for possible future use in
expansions, as we have already explained. The minimal mutilation condition
seeks to conserve the outputs of past computational effort in developing T.
As de Kleer [], p. , put it: Thus inferences, once made, need not be
repeated . We are therefore requiring a minimally mutilating contraction to
be a maximally non-(p-generating), T-closed subnetwork of T. So a minimally
mutilating contraction Tp will contain all those T-steps compatible with the
requirement that p not be in |T p |.
This is the intuitively clear, mathematically precise explication of minimal
mutilation that we have been looking for. No more hand-waving will be needed.
And we confidently conjecture that no intuitively compelling counterexamples
to it will be found.
130

A F O R M A L T H E O RY O F C O N T R AC T I O N

4.9.1 Contraction involves only steps in the agents belief

scheme
Recall that C is the set of all (transitional) steps known to the agent, whereas B
is (the dependency network that models) the agents belief scheme. C need not
itself be a dependency network. (It certainly cannot be if any of its steps has
as its conclusion.)
The steps in C \ B are those known to the agent (or, rather: taken by the agent
to be justification transferring) but not all of whose premises are believed. These
transitional steps are known to the agent because they are in C. They are irrelevant for the purposes of contracting B, but can become relevant upon expanding B (or any of its contractions). Upon adopting any new beliefs p , . . . pn ,
the agent needs only to pull into B formerly irrelevant transitional steps from
C \ B, as follows:
First, pull in from C all transitional steps all of whose premises other than p1 , . . . pn are
involved in steps (initial or transitional) already in B. Next, gather all the new conclusions
q1 , . . . qm of the transitional steps thus pulled in. Repeat this process until the transitional
steps most recently pulled in do not involve any new conclusions (i.e. ones not already
in B).

This universal closure process is exceptionally simple, as remarked above. We

are not requiring any oracular powers on the part of our rational agent. We
require only perfect memory of finitely many steps, and an ability to compute
an answer to a wholly tractable problem. These are personal virtues already
embodied in a PC, by means of which one would hope to be able to implement
our normative theory. The rationality maxim in question is therefore Always
be prepared to close your belief scheme under the finitely many steps known
to you at the time!, rather than the unrealistically demanding Always believe
every logical consequence of what you believe!.
In general any agent will have a great deal of deductive knowledge, or knowledge of patterns of potential justifications, that does not find its way into our
representation of her belief scheme for the purposes of modeling the process of
contraction. That is to say, C \ B can be large. The agent may, for example, know
of the deductive transition y , . . . , yn |x, while yet not believing any of y , . . . , yn
or x. Or she may believe x outright, without believing any of y , . . . , yn . Or she
may believe some, but not all of y , . . . , yn .
If the agent does not believe all the premises of a transitional step known
to her (i.e. if that step is in C \ B), then that step will be irrelevant to any of
C O N T R AC T I O N F O R M A L LY D E F I N E D

131

the adjustments required or permitted in the process of contracting her belief

scheme B with respect to any of the beliefs within it. This is very important.
It means thatto adapt a well-known sayingwhat stays in Vegas must have
happened in Vegas. Any step that stays in B (after any contraction) must already
have been in B.

4.9.2 Revision and expansion can involve recourse to steps

known to the agent, but not in the belief scheme
Matters are different, however, when we come to the problem of belief-scheme
revision, which involves both contraction and expansion. As the Levi identity
has it, if we wish to revise a belief scheme B so as to incorporate the belief p,
then we must first contract B with respect to p; secondly, expand the result
by adjoining p; and thirdly, close as best we can under the logical transitions
known to us. This is where we can finally exploit the fact that we often know of
logical transitions among statements that are not, at present, all in our belief
scheme. Once we adjoin the new belief pwhich might have contradicted
some of our beliefs in B before its contraction with respect to pwe can
suddenly find those transitional steps relevant to the new task of closing upon
the adjunction of p. For belief revision there is a theoretical need, therefore, to
be mindful of all known justificatory steps, whether or not they involve only
propositions currently believed. For the process of contraction, however, that
need does not arise. In our modeling of belief schemes that are to undergo
contraction, we can without loss of generality limit our view just to those
known transitional steps that involve only beliefs to which the agent is currently
committed.
Each transitional step in the agents belief scheme is itself immune to revision
during any contraction process. Collectively these transitional steps provide a
logical scaffolding against the background of which the contraction proceeds.
The normative message of our algorithm for theory contraction is If you (the
agent) are committed to such-and-such steps as justificatory, then, modulo that
commitment, the right ways to contract your belief set with respect to any of its
member nodes are as follows: . Any attempt to make any of the transitional
steps themselves liable to revision or retraction during the course of theory
contraction faces deep difficulties, which lie beyond the scope of the present
investigations.
132

A F O R M A L T H E O RY O F C O N T R AC T I O N

4.10 Considerations of complexity

First, we show that the simplest form of the contraction problem (understood as
a decision problem) is in NP, the class of problems solvable in non-deterministic
polynomial time. (See Section . for an explanation of this notion.) To be
precise, the contraction problem in its simplest form is the following decision
problem:
Given T, a node p in T, and an integer k, decide whether there is a T-closed subnetwork
R not containing p, which is of size at least k.

Theorem 1 The contraction problem in its simplest form is in NP. 25

Proof. The NP algorithm guesses a subset R of T of size k and decides, in polynomial time, whether it is T-closed and is a subnetwork of T and does not
contain p.
Theorem 2 The contraction problem in its simplest form is NP-complete.
Proof. By Theorem , the contraction problem in its simplest form is in NP.
It remains to show that some NP-complete problem can be transformed in
polynomial time into the contraction problem in its simplest form. To this
end, consider the class of networks all of whose transitional steps have exactly
two self-justifying premises, and conclusion p. Clearly any contraction of such
a network (with respect to p) that is of size k will be determined by a nonp-generating subset, of size k, of the set P of self-justifying premises. Thus
the problem of finding a contraction of size k with respect to p boils down
to the problem of finding a subset of size card(P) k, whose members are
to be removed from the network. (The length of input for the latter problem
is no less than some fixed fraction of the length of input for the contraction
problem; such a linear factor will not affect the resulting complexity class for the
contraction problem.) But this is isomorphic to the NP-complete Vertex Cover
(VC) Problem, which is to find a subset (of a given size) of the set of vertices of
a graph that contains, for each edge in the graph, at least one of the two vertices
incident on that edge. 26 In the case of contraction we have described, we are
looking, analogously, for a subset (of a given size) of the set of premises involved
in two-premise steps of the network that contains, for each two-premise step in
Here we make it clear that the contractions in question are not required to be minimally
mutilating. This corrects an error in Tennant [], which proved Theorems and .
See Garey and Johnson [], p. . The author is indebted here to Anish Arora.

C O N S I D E R AT I O N S O F C O M P L E X I T Y

133

the network, at least one of its premises. (Naturally, we seek to minimize this
subset in order to maximize the resulting contraction.) The isomorphism with
graphs is easy to see: the (unordered) pair-sets of premises (of the steps) map
to edges of a graph, which are (unordered) pair-sets of vertices. Ones choice of
a set of premise nodes to be removed (at least one from each pair-set) in order
for the common conclusion of all the two-premise steps to have no justification
then corresponds to a choice of a set of vertices in the graph that covers each
edge (by containing at least one vertex from each edge, i.e. from each pair-set of
vertices).
QED
The classification of problem classes in complexity theory requires that one
state whether one is dealing with a decision problem, or with a (functional)
search problem. For given inputs x, and effectively decidable relation L(x, y), the
decision problem takes the form of asking whether yL(x, y), and the outputs
of any algorithm for solving such a problem are accordingly Yes/No; whereas
the corresponding search problem requires as output either a computed value
such that L(x, ) (if such a value exists), or the answer No if no such value
exists. Whereas the decision problems are assigned to the classes P, NP, etc., the
corresponding search problems are assigned to the classes known as FP, FNP,
etc., where the F stands for functional. This terminology is now standard, even
though there is no guarantee of uniqueness on the part of any values such that
L(x, ).
When a decision problem is hard, then the corresponding search problem is
at least as hard. By Theorem , the problem of searching for a contractionand
so, a fortiori, for a minimally mutilating contractionis at least FNP-hard.
Unlike the problem of deciding whether there is a contraction of a certain size
a contraction that is required to satisfy only conditions () and (), so that this
decision problem is in NPthe problem of searching for a minimally mutilating
contractionone satisfying in addition condition ()is not necessarily in
FNP. 27
When minimally mutilating contractions are the objects of interest, we pose
the problem as a search problem rather than as a decision problem. This is
because minimally mutilating contractions are inclusion-maximal; so it is trivial
that a Yes [No] answer to the question Is there a (simple) contraction of size at
least such-and-such? implies the same Yes [No] answer to the question Is there
a minimally mutilating contraction of size at least such-and-such?.

134

Discussion with Ken Supowit has been helpful here.

A F O R M A L T H E O RY O F C O N T R AC T I O N

The search problem for minimally mutilating contractions appears to be

more complex than either the search problem or the decision problem for
simple contractions. To be sure, an algorithm that guesses R of size k can decide,
in polynomial time, whether R is T-closed and is a subnetwork of T and does
not contain p (so the problem of finding a simple contraction is in FNP). But
verifying further that condition () holdsthat there is no T-closed subnetwork of T not containing p but properly including Rtakes the problem out
of FNP. The following more exigent search problem for minimally mutilating
contractions is not in FNP (unless P=NP).
Given T, a node p in T, and an integer k, find R such that:
(i) R is a T-closed subnetwork of T not containing p, of size at least k; and
(ii) there is no U such that R U T and U is a T-closed subnetwork of T not
containing p.

For, having guessed a would-be minimally mutilating contraction R of T with

respect to p, one cannot manage, in polynomial time, to check that no proper
extension of R within T is a T-closed subnetwork of T not containing p. This is
because one would have to inspect each subset S of T that properly includes R,
and verify that it is not a T-closed subnetwork of T not containing p. And the
number of such subsets S threatens to be exponential in the size of T. It is
not, however, as bad as it might seem, as the following theorem shows. Here
we construe the class FP as FPFNP the class of search problems solvable
in polynomial time by making at most a polynomial number of calls to an
FNP-oracle. 28
Theorem 3. (Tennant) The problem of searching for a minimally mutilating contraction of a given minimum size is in the class FP , at the second level of the
polynomial hierarchy. Indeed, it is in the subclass FPFNP[O(n)] , the class of search
problems solvable in polynomial time by making at most a linear number of calls
to an FNP-oracle.
Proof. An (F)NP-oracle is a sub routine that is assumed to take only one unit of
time in order to solve any problem in (F)NP. We need to show (for membership
in FP , construed as FPFNP ) that the search problem for minimally mutilating
contractions can be solved by making no more than a polynomial number of
Victor Mareks help has been invaluable here, in improving an earlier (unpublished) result of
the author that put the problem of searching for a minimally mutilating contraction in the class P .
The author is grateful also to Georg Gottlob for drawing attention to the niceties of the F classes.

C O N S I D E R AT I O N S O F C O M P L E X I T Y

135

calls to an FNP-oracle. What we can actually show (thereby securing membership in the subclass FPFNP[O(n)] ) is that the problem can be solved by making
no more than a linear number of calls to an FNP-oracle. The FNP-oracle will be
called upon here to solve instances of the simple decision problem above.
Here is the search strategy.
First, ask the FNP-oracle to look for R with inputs T, p and k = |T| .
If some R is found satisfying condition (i), then |R| = |T| and condition (ii) is automatically satisfied, since R itself is as large a solution as can be.
If with inputs T, p and k = |T| no R is found satisfying condition (i),
then ask the FNP-oracle to look for R with inputs T, p and k = |T| .
If some R is found satisfying (i), then once again condition (ii) is automatically satisfied. This is because failure to satisfy condition (ii) means that there
is some U such that U is a T-closed subnetwork of T not containing p, of size
at least |T| . But the existence of such U would have registered earlier as
success in the search for R satisfying condition (i) with k = |T| .
If with inputs T, p and k = |T| no R is found satisfying condition (i),
then ask the FNP-oracle to look for R with inputs T, p and k = |T| .
Clearly, since we know that a satisfactory object of our search does exist, we
shall make at most |T| calls to the FNP-oracle before we find some R such that
conditions (i) and (ii) hold.
QED
As shown by Georg Gottlob (personal communication), Theorem can be
improved.
Let us abbreviate the conjunction of (i) and (ii) as L(T, p, k, R).
Theorem 4. (Gottlob) The problem of searching for a minimally mutilating contraction of a given minimum size is in FPFNP[O(log(n))] , since it can be solved in
polynomial time with at most a logarithmic number of calls to an FNP-oracle.
Proof. The problem of searching for a minimally mutilating contraction is to
be understood as follows: given as inputs a dependency network T, a node p
therein, and an integer k, find some R such that L(T, p, k, R).
The search algorithm first determines, via binary search with O(log(n)) calls
to an NP-oracle, the maximum number m such that
m < |T| R L(T, p, m, R).
(Here it actually suffices to make the intended calls to a Yes/No oracle, i.e. an
oracle for a decision problem.)
136

A F O R M A L T H E O RY O F C O N T R AC T I O N

To determine this maximum number m, we first ask our NP-oracle whether

RL(T, p,

|T|
, R).

If our NP-oracle answers Yes, we ask it next whether

RL(T, p,

|T|
, R);

if our NP-oracle answers No, we ask it next whether

RL(T, p,

|T|
, R),

and so on. Once the maximum such m has been determined, we call finally
on a functional (FNP) oracle to find some R such that
L(T, p, m, R).
Since m has already been determined as a maximum in this regard, any solution
R that the FNP-oracle returns will be such that
(i) R is a T-closed subnetwork of T not containing p, of size exactly m; and
(ii) there is no U such that R U T and U is a T-closed subnetwork of T not
containing p

This procedure uses, altogether, no more than log(|T|) + oracle calls. Thus
the algorithm runs in polynomial time with O(log(n)) oracle calls.
QED
Theorem is an improvement that consists in making at most a logarithmic
number of calls to an oracle, rather than a linear or polynomial number of calls.
As Gottlob has also pointed out, there is a way to emulate a call to an FNP-oracle
by making a polynomial number of calls to a Yes/No NP-oracle. This enables
one to re-cast the proof of Theorem so as to make it a proof of the conclusion
that the search problem for a minimally mutilating contraction is in FPNP . But
this does not appear to admit of further improvement to FPNP[O(log(n))] . The
latter class is widely believed to be properly included in FPFNP[O(log(n))] , which
is widely believed to be properly included in FP , which is equal by definition
to FPFNP , which in turn is equal (by the argument for search-oracle imitation
in polynomial time by a bit-oracle) to FPNP .
We leave as an open problem that of determining whether the minimally
mutilating contraction problem is complete for FPFNP[O(log(n))] i.e. whether
it is FPFNP[O(log(n))] -hard.
C O N S I D E R AT I O N S O F C O M P L E X I T Y

137

One should not be at all surprised or dismayed to find that the problem
of belief contraction in its simplest form is intractable in the sense of being
NP-complete. The interesting challenge was how to conceive of the problem in
a manner sufficiently amenable to complexity analysis in the first place. It is
in this spirit that we have conducted our investigations. The result has been
encouraging. We have discovered that the simplest form of the problem of
theory contraction, conceived in this way, is of the lowest complexity that one
could have expected it to be, given the considerations laid out in Section ..
Moreover, theorists of contraction who object (misguidedly, in our view) to
representing belief schemes in our finitary fashion now have to contend with the
prospect that their own contraction decision problems (in so far as they might
be able to define any, on their approaches) will have much worse lower bounds
of computational complexity. If NP-completeness, or a region quite low down
in the second level of the polynomial hierarchy is bad news for the dependencynetwork theorist, then it will be just as bad, if not worse, for AGM-theorists
if ever they produce any computational implementations of their contraction
functions.

4.11 Conclusion
We have laid the theoretical foundation for a general computational account
of theory contraction, by conceiving of belief schemes in an appropropriately
finitary wayas dependency networks. The treatment marks a retreat from
the infinitistic objects of AGM-theory, and a return to the level of description
favored by earlier TMS-theorizers, in which all that is important (for the purposes of contraction) is the pattern of justificatory connections thus far disclosed among the agents various beliefs, and not the internal logical structure of
the sentences involved, nor the underlying logic that would exploit such structure. By paying too much attention to the latter features, AGM-theory had made
the contraction problem non-computable. We have regained computability by
abstracting at the appropriate level. We can also supply principled reasons why
one can limit oneself to finitary objects without any loss of theoretical generality.
Our formal modeling is arguably more precise and logically cleaner than
earlier TMS-theorizing. It exactly captures the intuitions involved in the various
counterexamples that have been advanced against AGM-theorys postulate of
recovery. It allows for the definition of contraction in such a way that minimal
mutilation is captured by inclusion-maximality. That mathematical definition
138

A F O R M A L T H E O RY O F C O N T R AC T I O N

allows one to characterize the decision problem for contraction of belief networks as NP-complete (if one does not require minimal mutilation) and the
search problem as no worse than FPFNP[O(log(n))] (if one does require minimal
mutilation).
So the requirement of minimal mutilation really elevates the contraction decision problem to a prima facie strictly higher level of computational
complexitythough no further than (quite low down in) the second level of
the polynomial hierarchy. One might take this fact to provide at least a partial
explanation of why the notion of minimal mutilation appears to have resisted
precise characterization for so long. One would also expect rational agents to
have developed heuristics that, while aimed at producing contractions without
checking them for minimal mutilation, nevertheless tend to produce, at a decent
rate, contractions that do happen to be either minimally mutilating, or almost
minimally mutilating.
The following chapter explores some of the heuristics that might be employed
in algorithms designed to guide contraction processes that are reasonably minimally (even if not absolutely minimally) mutilating.

CONCLUSION

139

CHAPTER 5

Specification of a
Contraction Algorithm

5.1 Greedy algorithms

An algorithm is a mechanical recipe for finding a solution to a problem within
a finite time, by making certain choices in succession. Some solutions may be
better than others. For example, the problem may be to choose some coins of
various available denominations whose sum is to be a given amount. This is the
problem of giving change in that amount.1 Suppose the amount of change to be
counted out is cents. The optimum (best) solution would involve choosing a
dime ( cents), a nickel ( cents) and two pennies ( cent pieces)four coins
in all. The worst solution would involve choosing seventeen pennies. The first
solution is clearly much better than the second. The fewer the coins chosen,
the better the solution. The best solution is the one involving the fewest coins
(four); the worst solution is the one involving the most coins (seventeen). In
between those two extremes are various suboptimal solutions: three nickels plus
two pennies, say (five coins); or one nickel plus twelve pennies (thirteen coins).
The algorithm that produces the best solution for the change-giving problem
applies a simple, local criterion for making the next choice. At any stage, choose

An example like this is used in Matuszek [].

140

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

the coin of highest value that does not exceed the outstanding amount. With the
US currency of quarters, dimes, nickels and cents, this algorithm always yields
the best solution. Indeed, it will do so with any currency each of whose coinvalues is at least twice that of the next lower coin-value (if there is one).
The algorithm is called a greedy onenot because it involves money, but
because it seeks to take as little time and to consume as few resources as possible
in the course of producing a solution. At each stage, the algorithm dictates a
local choice, which can be made very efficiently. The sequence of those local
choices produces, happily, a globally optimal solution. Greedy can be good;
indeed, best possible.
Whether a greedy algorithm produces a globally optimal solution depends
however, on the nature of the problem being solved. It is easy to imagine coin
denominations other than those of the US currency, for which the greedy algorithm just described would produce suboptimal solutions. Suppose some weird
cult were to gain control of the nation, and outlaw quarters and nickels, while
introducing also the septickel, a coin worth cents (to remind us, say, of the
seven deadly sins). If one wished to give cents in change, the greedy algorithm
would serve up a dime and then four penniesfive coins in all. It would miss
altogether the optimal solution of two septickels.
The advantage of a greedy algorithm is that it operates fastor at least, as fast
as is permitted by the local considerations that enter into the determination
of each successive choice. In general a greedy algorithm makes its successive
local choices very efficiently, and uniquely, hence offers up an overall solution
quite quickly. The emphasis on unique choice is important: with the changegiving problem, the next coin to be chosen is uniquely determined by the
amount outstanding. There is no branching in the decision tree. The decision tree is really a decision chaina steady march from one choice to the
next. For this reason the algorithm is called deterministic. The big question,
however, is whether the problem being solved is one for which suboptimal
solutions can be tolerated. The suboptimality of the solution has to be arbitraged
against the extra computing costs that would be involved in finding an optimal
solution.
In the field of Artificial Intelligence, the technique of providing an efficient
algorithm that produces good enough solutions to the problem at hand is called
satisficing. The idea was introduced by the Nobel laureate Herbert Simon. The
notion of satisficing has proved useful also in the field of evolutionary biology.
Certain adaptive modifications of body-plan, for example, might be absolutely

G R E E DY A L G O R I T H M S

141

ideal for a given species under certain selective pressures. Yet it may be that
too much genetic change would be called for in order to achieve the best
possible modification; and it may be that intermediate stages through which
the changing body-plan would have to pass in order to achieve the best plan
possible would actually be very suboptimal. (The species would have to descend
into a valley in the landscape of fitness values before being able to scale the
neighboring, much higher peak. One has to think here of the underlying plane
for this metaphor as made up of points corresponding to the phenotypes involving certain body-plans.) So natural selection will satisfice by producing as
much change in that direction as possible, by using up the available genetic
variability for the re-shaping that improves overall fitness. It will drive the
species higher on that mountain in the landscape of fitness values on which
it is currently located. And whether the species reaches the absolute summit of
that mountain depends again on the costs involved in getting there. It may do
very well by getting sufficiently close to that local peak; and too much change
might be called for in order to get it to occupy the peak itself. In the parlance
often employed, it is enough to get within an epsilon of where, ideally, one
would wish to be. For further discussion, see von Schilcher and Tennant [],
pp. .
The way extra computing costs can be involved is that one may wish to look
ahead, further down the decision tree, to consider branching points at which
alternative choices may be available for continued construction of a solution.
One looks ahead in order to tell whether a choice now being contemplated is
one that could have inevitable and bad knock-on effects further down the line.
In general, a non-deterministic algorithm is one that involves exploring all the
possible branches within a decision tree, and evaluating the solutions that would
be obtained upon reaching the end of any one branch. The more one takes into
account in looking ahead, the less greedy ones algorithm becomes. As we saw
in Section .., the source of non-determinism in the contraction problem
is the need to make a choice of a premise node to whiten from among possibly several alternatives when spreading white upwards under the constraint
White Lock.
This chapter specifies a contraction algorithm in three successively less greedy
versions, where greediness (or efficiency) is sacrificed in the interests of ensuring minimal mutilation of the agents belief system. We prove that the least
greedy version of the algorithm is minimally mutilating in a suitable sense.

142

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Finally we indicate how entrenchment information can also be taken into

account whenever it is available.
First, however, we need to mention one kind of algorithm that would do the
job, but be rather dim.

5.2 A brute-force, undiscerning algorithm

Recall the definition of a minimally mutilating contraction in Section .:
A subnetwork R of a network T is contraction of T with respect to p if and only if
1. (HONESTY) R is a T-closed subnetwork of T.
2. (SUCCESS) |R| does not contain p.
3. (MINIMAL MUTILATION) R is inclusion-maximal with regard to (1) and (2).

Given a network T, and a node p within it, one could set about finding a
contraction in the following unintelligent, albeit completely mechanical, way.
Remember that T is a finite set of steps, and that any contraction of T with
respect to p is a subset of T. So, to find a contraction in a really plodding fashion,
proceed as follows.
Consider in turn each proper subset R of T. R must pass tests (1), (2) and (3) below in
order to count as a contraction of T with respect to p. (Failure on any one of these tests
prompts a different choice of subset of T.)
1. Check that R is a T-closed subnetwork of T.
2. Check that |R| does not contain p.
3. Consider in turn each non-empty set S of steps such that R S T. Apply tests
(1) and (2) to S. If some such S passes tests (1) and (2), then R fails test (3). But
if every such S fails either test (1) or (2), then R passes test (3).

It may take a month of Sundays, but this algorithm will eventually turn up a
contraction of T with respect to p. In similar vein one would eventually find
ones keys in a car park by beginning under a lamppost nowhere near ones past
route, and searching meticulously in an ever-widening spiral.
What we clearly want, by contrast, is a more discerning algorithm: one that
goes to work on p, and pays immediate attention to ps place within the dependency network. This is like searching for ones lost keys by beginning at ones
parked car, and re-tracing ones earlier steps away from and back to the car as
best one can.

A B RU T E - F O R C E , U N D I S C E R N I N G A L G O R I T H M

143

5.3 Preliminaries
We shall now introduce some further definitions that will be of use in stating
a general (non-deterministic) algorithm for the contraction process. We are
dealing with dependency networks T, R, etc., involving nodes x, y, etc.
In Section .. we specified an algorithm for what we called the universal
closure of a belief scheme B within a set C of steps and with respect to a set P
of nodes not in B. We said that this algorithm determines the universal closure
because of the word each in the while condition. The algorithm is used in order
to expand the belief scheme B upon adopting as new beliefs all the members
of P. This expansion can of course draw upon all the (transitional) steps known
to the agent, which make up the set C.
We now wish to specify a related algorithm, this time for identifying the set
of all steps in B that would have to be whitened if one were told that certain
nodes within B had been whitened. Let Q be the set of these initially whitened
nodes in B.

Algorithm 5.3.1: E x i s t e n t i a l C lo s u r e ( B, Q )
Steps B
Closure the set of steps in B with a premise in Q
WhiteNodes Q
while the conclusion of some step in Closure
is not in WhiteNodes
and is not the conclusion of any step in Steps

NewWhiteNodes the set of such conclusions

WhiteNodes
WhiteNodes NewWhiteNodes

NewSteps the set of all steps in Steps with at least

do
one premise in WhiteNodes

Closure

Closure
NewSteps

Steps Steps \ NewSteps

return (Closure)

We say that this algorithm determines the existential closure of B with respect
to Q because of the phrase at least one in the while condition. Existential
closure is the operation we use in order to determine which steps to whiten
in a Downward pass of our contraction algorithm.

144

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Let T be the network

The reader should note carefully the direction of the arrows in the top and
middle part of the diagram. The single node c below the top two has two arrows
coming into it, one vertically downwards from the (inference stroke below the)
two nodes immediately above it, and one vertically upwards from the (inference
stroke above the) two nodes immediately below it. Bear in mind that when we
speak of a downward sweep or pass (of whitening), we intend downward to
be understood as in the direction in which arrows point.
The following sequence of increasingly whitened diagrams (to be read leftto-right and top-down) exhibits the stepwise application of the algorithm for
determining the existential closure of T with respect to the set X consisting of
the two initially whitened white nodes a and b. The termination of the algorithm represents a completed Downward pass, in the sense of downward just
explained.
When an inference stroke is whitened that represents placing the step in
question into Closure. (Closure will always contain only white steps, i.e. steps
whose inference strokes are white.) The set Steps consists of those steps whose
inference strokes remain black. At each stage the membership of the set WhiteNodes is obvious. At each stage at which the while condition applies, it will be
equally obvious what nodes find their way into the set NewWhiteNodes. Each
succeeding diagram in the sequence represents the new stage reached upon
performing the do clause in response to ascertaining that the while condition
is satisfied.

PRELIMINARIES

145

Above left: We begin with just the nodes a and b whitened.

Above right: We whiten the steps (i.e. the inference strokes of the steps) whose
premise sets contain at least one white node. Note in particular that both a and
b are initial nodes, corresponding to the steps {{a}, a} and {{b}, b}. The premise
set of {{a}, a} contains the white node a; and the premise set of {{b}, b} contains
the white node b. Hence their initial inference strokes (representing these two
initial steps) are now whitened.

Above left: The two newly whitened nodes (in the second tier) have been
whitened because they stand as conclusions of only white steps. Note, however,
that the node c is not whitened. This is because c stands as the conclusion of a
black step, i.e. the one whose inference stroke is above it.
146

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Above right: We now whiten the two lowest inference strokes, since each one
has a premise set containing at least one white node.

Finally (as shown in this last diagram) we whiten the two bottommost nodes,
since they stand as conclusions of only white steps.
At this stage, the while condition of our algorithm, namely:
the conclusion of some step in Closure is not in White Nodes and is not the conclusion of
any step in Steps

that is,
the conclusion of some white step is black and is not the conclusion of any black step,

or, equivalently,
some black node is the conclusion of only white steps

is no longer satisfied. That is to say: no black node is the conclusion of only

white steps. So the algorithm terminates. The Downward pass of whitening has
been completed. The sought existential closure consists of those steps whose
inference strokes have been whitened. It is not necessary, for membership in
the existential closure, for the conclusion of a step to have been whitened. It is
sufficient that its inference stroke has been whitened.
Note, however, that in the example just worked through, one of those
whitened steps had its conclusion (c) survive as black. We shall have occasion
to talk about the set of nodes that are whitened in the course of constructing the
PRELIMINARIES

147

existential closure of a network T with respect to a set X of initially whitened

nodes. The set in question will of course include X. We shall call it the downward
amplification of X in T.
Definition 13 Let X be a subset of the kernel |T| of network T. Then T (X)the
downward amplification of X in Tis the least set Y (under inclusion) satisfying
the following conditions:
(1) X is a subset of Y;
(2) for every y in |T|,
if : for every step (U, y) in T, U has a member in common with Y, then: y is in Y.

T (X) will contain all nodes whose presence (as conclusions) in T can be justified only by appeal, ultimately, to the presence in T of some member of X.
Recall Definition .. in Section .. of the kernel |T| of a dependency
network T: it is the set of nodes x such that for some U, T contains the step
(U, x).
Definition 14 x is a T-casualty for R if and only if x is in |T| but not in |R|.
Definition 15 A cluster is a non-empty finite family of non-empty finite sets of
nodes, none of which properly includes any other.
Here is an example of a cluster (in which the six large rectangles represent
members of the cluster, and the circles within them represent their members):

Definition 16 Let X be a cluster, and let Y be a set of nodes. Y hits X (or Y is an

X-hitter) if and only if each member of X has a member in Y.
Definition 17 Let X, Y be as before. Y occludes X (or, Y is an X-occluder) if and
only if Y hits X and every member of Y is in some member of X containing no
other member of Y.
Definition 18 Y is a perfect hitter of X just in case Y hits X but no proper subset
of Y hits X.

148

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Lemma 1 If X is a cluster hit by Y, then Y is a perfect hitter of X if and only if Y

occludes X.
Proof. Let X be a cluster hit by Y. Suppose Y is a perfect hitter of X. Let y be any
member of Y. Then (Y \ y) does not hit X. So some member of X (Z, say) has
no member in (Y \ y). But Y hits X, whence some member of Y is in Z. Hence
Z contains y but no other member of Y. But y was an arbitrary member of Y. It
follows that Y occludes X.
Now suppose, for the converse, that Y occludes X. Take any proper subset,
W say, of Y. Let x be in Y but not in W. Since Y occludes X, some member of
X (Z, say) contains x but no other member of Y. It follows that (Y \ x) does not
hit X; whence W does not hit X. But W was an arbitrary proper subset of Y.
Hence Y is a perfect hitter of X.
Lemma 2 Every cluster has an occluder.
Proof. Let X be a cluster. X will have a hitter. So let W hit X. The finitely many
subsets of W are partially ordered by inclusion. The empty set does not hit X.
Hence there will be inclusion-minimal hitters of X included in W. Each of these
(by the first half of Lemma ) will occlude X.
The following is an example of an occluder for the earlier example of a cluster.
Members of the occluder are gray:

Here is another occluder for the same example:

PRELIMINARIES

149

When we contract a dependency network T with respect to one of its nodes

p we obtain some subnetwork Tp of T. We shall use the suffix i in the expression Ti p in order to stress that contraction might very well not be a singlevalued operation in general. There may be a multiplicity of contractions T p,
T p, , Tn p, for a given network T and node p within it, even when we
impose the requirement that contraction be minimally mutilating (in the sense
defined in Section .) and even when we impose the further possible requirement (considered below) that one avail oneself of all available information about
the theorists pairwise preferencesalso called relative entrenchmentsamong
beliefs within her scheme.
When Tp is a contraction of T, the T-casualties for Tp are those nodes
of T that are whitened in the contraction process that yields Tp. When a
node is whitened, it is no longer in the kernel of the contraction. That is, it
cannot be justified within the contraction by appealing to any T-steps within
the contraction.
Note that one succeeds in whitening a node q in T only by whitening the
inference strokes of all T-steps of the form (U, q). In general, one could whiten
the inference strokes of many steps without whitening any of their conclusions.
This is because any given conclusion could have a multiplicity of justifying steps,
some of which might escape having any of their premise nodes (hence also
their inference strokes) whitened.
Let us speak elliptically of whitening a T-step, instead of whitening its inference stroke.
When we focus on whitening T-steps in what follows, the generation of T (X)
will be a by-product of the more general process of whitening steps, beginning
with those that have any premise in X. This is the operation of existential closure
defined and illustrated above:
Identify all those T-steps (U, y) where U overlaps X. Whiten them (i.e. their inference
strokes). Take all those nodes y such that all T-steps with conclusion y have been thus
whitened. Whiten these nodes (that is, add them to X). Call the result X1 . Repeat the
process just described with X1 in place of X. Continue in this fashion until no more Tsteps are whitened.

As we said above, each successive stage in this process of whitening steps is

a downward sweep; and the completed succession of such sweeps make up a
Downward pass.
It is important to realize that the T-steps themselves are not the sort of thing
that the agent can give up in the course of contracting T, even though she

150

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

whitens them (i.e. whitens their inference strokes). For the T-steps represent
inferential transitions, which hold because of logical, mathematical, conceptual
or evidential relations and connections that the agent has discovered thus far
among sentences and their constituents. On the present, consciously limited
account, the T-steps are being treated as though they are a priori for the agent.
Once discovered, they are never given up, in the sense of being epistemically
abandoned, or taken to be confuted. Rather, under the self-imposed restrictions
of the present account, it is only individual beliefs (i.e. nodes) that can be given
up during a contraction.
The steps in which those nodes are involved as premises and/or conclusions,
however, remain. They are never given up. Thus whenever we talk of (the rational agent, or ourselves on her behalf) getting rid of a step, or whitening it, what
we really mean is that that step no longer consists of premises that are all black
(believed by the agent) and a conclusion that is, therefore, also black (believed
by the agent). At the very least, one of its premises will be white (not believed by
the agent). This means that, for the agent, the step cannot be used to propagate
belief (from all its premises) to its conclusion. Only when all the premises are
once again believed by the agent will the step be engaged so as to support its
conclusion (for the agent). Indeed, the step will then not only be able to be thus
engagedit will have to be engaged. This is a demand of rationality that we
impose upon the agent: she is beholden to all the steps that she has recognized
as transmitting support from their premises to their conclusions. Remember:
she is a computational saint, even if not a logical one.
Note further: during a contraction process, steps are only ever given up in
this sensetaken out of the dependency network that represents the agents
former beliefson a Downward pass of the contraction algorithm. Moreover,
nodes are only ever whitenedmeaning that they are no longer believed by the
agenton an Upward pass of the contraction algorithm.
Example of a contraction: Take one of the simple examples of a dependency
network given earlier: {({a}, a), ({b}, b), ({a, b}, c)}. Call this T. One contraction
of T with respect to c is the subnetwork {({b}, b)}; another is {({a}, a)}. Note that
the contraction cannot be simply {({a}, a), ({b}, b)}, the result of whitening all
T-steps of the form (U, c) from T, as though pretending that they had never
been discovered; for the latter subnetwork is not T-closed. By reference to
T this subnetwork {({a}, a), ({b}, b)} could automatically be T-closed so as to
contain ({a, b}, c) (thereby becoming, in fact, identical to T), contrary to the
basic requirement on a contraction. Note that the empty network does not count

PRELIMINARIES

151

here as a contraction of T with respect to c, since it violates the maximality

requirement. For the empty network is properly contained in each of the contractions {({a}, a)} and {({b}, b)}. (Here we are in agreement with Marek and
Truszczynski []; and very much in disagreement with Fuhrmann [],
who is representative of AGM-theorists in not countenancing the possibility of
giving up just one of a set of (equally entrenched) sentences when they cannot all
be maintained. Rather, in such circumstances the AGM-theorists give up every
member of such a set. In Tennant [] this was called en bloc mutilation.)
Our example illustrates the following fundamental lesson about contraction:
Contracting T with respect to p is not simply a matter of whitening all T-steps
of the form (U, p). It involves also whitening such other steps as is necessary
(and minimally sufficient) to ensure that p is not generated back again via T;
that is, so as to ensure that p is not in the kernel of [Tp]T .
Our fundamental objective in this chapter is to provide an algorithm for
computing a contraction Tp given a dependency network T and one of its
nodes p as inputs. We stress a contraction rather than the contraction because,
as observed above, uniqueness cannot in general be guaranteed. This is contrary
to the overly optimistic view of Grdenfors []:
The contraction of a belief set K with respect to a sentence A, that is, the sentence to be
rejected, is denoted KA . It is assumed that, for any belief set K and any sentence A, there
is a unique [emphasis in original] contraction so that the expression KA is well-defined.
(p. 61)

We have already seen, however, the non-deterministic choices available when

one is seeking to disable each and every premise set supporting a conclusion
that is to be surrendered.2
When we have to contract with respect to p, we shall begin by whitening p.
(We write we here even though we are really giving an account of how a rational
agent can and should proceed.) For every step (U, p) in T, we shall have to
disable U, that is, whiten at least one member of U. How such a member of U is
chosen for such Upward whitening will be the crux of the matter. (See below
our discussion of excision sets, which consist of nodes that are candidates for
whitening, by virtue of belonging to sets like U, which for the time being we are
considering in isolation, as though it is the only premise set that yields p as a
conclusion. Bear in mind that excision sets are occluders of clusters of premise
In Tennant [a] we offered a relational re-formulation of AGM-theory that is sensitive to
the plurality of contractions.

152

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

sets like U. We use the term excision set when it would be cumbersome to
specify the cluster in question.) We speak here of Upward whitening because of
the way in which, in our colorful method of graphical representation, premises
(in the set U = {u , . . . un }) are usually depicted as being above the conclusion
p that depends on them:
. . . un

u1

p
Whiten node p . . .

u1

...

. . .un

p
. . . hence whiten
some premise node

u1

...

. . .un

p
. . . hence whiten
the inference stroke

We stressed usually above because the official meaning of upward is in the

direction opposite to that in which the arrows point.
After completing such an Upward pass of whitening, dealing with every
premise set U of a T-step (U, p), we shall have chosen an excision set X, say,
of nodes within the premise sets U that have to be disabled. We then make a
Downward pass of step and node whitenings, consisting of as many sweeps as
are necessary. (That is, we construct the existential closure of T with respect
to X.) In the first sweep we shall whiten the inference strokes of all T-steps
(W, q) where W contains a whitened member. (Note that if q is whitened, and if
there is a step of the form ({q}|q), then that step is whitened in the first sweep.)
Thereafter we shall whiten every node whose every supporting step has been
whitened.
In the next sweep we shall whiten the inference strokes of all T-steps (V, s)
where V contains any node that has been whitened; thereafter, once again, we
shall whiten every node whose every supporting step has been whitened. We
shall repeat such sweeps until the while condition is no longer satisfied, that is,
until no black node is the conclusion of only white steps. Thus every black node
will be the conclusion of at least one surviving black step.
If in any surviving step (Z, r) the node r is whitened, this will call for another
Upward pass. We shall deal with each such r in the same way that we dealt with p,
only striving to make the next round of whitening as economical as possible, by
whitening as few new nodes (and steps) as possible. Thereafter we shall make
another Downward pass; and so on. The output of the contraction algorithm
will be the subnetwork remaining as soon as a completed Downward pass leaves
PRELIMINARIES

153

no black step with a whitened conclusion. Hence the output (of surviving black
steps) will involve no white.
We turn now to discuss in more detail the choice of an excision set, a matter
that we foreshadowed above. Note that by the formal definition of a dependency
network in Section .., no p-implying premise set can be properly included
in any other. If {U , . . . , Un } is the family (or cluster) of all the p-implying sets
( i n), then none of these sets is properly included in any other.
If we have occasion, on an Upward pass, to consider {U , . . . , Un } for collective disabling, our task will be to find an excision set (i.e. an occluder) for
the cluster {U , . . . , Un }, and whiten all of its members. The algorithm then
proceeds to work through the consequences of ones having thus whitened
these members. This it will do on its next Downward pass, which will involve
whitening (the inference stroke of) any step that has a whitened premise.
We shall presently describe an algorithm for contracting a dependency network T with respect to one of its nodes p. The contraction will proceed in stages.
As the reader will see from the description of our algorithm, we could take the
initial problem to be that of contracting a dependency network T with respect
to any (finite) set X of its nodes. But we simply follow the usual custom here of
contracting, at the outset, with respect to only one node p.
At any stage there will be four components, dynamically evolving during the
computation. These components will be called R, M, M and E.
1. The component R starts off as the given network T to be contracted, and at
the completion of each successive Downward pass R will be an ever smaller
subnetwork of T. It is not until the final value of R is attained, however, that R
becomes T-closed. The final value of R, when the computation terminates, will be
the contraction Tp as determined by that particular course of computation.
(Since the computation is non-deterministic, we have to bear in mind that Tp
is not always uniquely determined.) We choose the letter R because it reminds
us that we are dealing here with the residue of the dependency network T as
the contraction proceeds.
2. The component M is the set of nodes most recently whitened at the given
stage of computation.
3. The component M# consists of nodes whitened at the most recent stage but
one. The whitened nodes (in M or in M# ) are about to be thrown out, but
have not been just yet.
4. The component E denotes the set of nodes of T that actually have been
whitened by that stage of the contraction process, and that therefore no longer

154

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

feature as nodes of the residual network R; that is, they are not in |R|; they have
been eliminated.

Every node that gets whitened and placed in M at any Upward pass winds up
being transferred to E by the next Downward pass but one, possibly via a sojourn
in M ; but not every node in E need have been whitened beforehand in order
to wind up in E. The significance of this fact will emerge in due course.
Remember that a dependency network (such as T or any of its subnetworks R) is just a set of steps of the form (U, x) where x and all members of the
finite set U are nodes. There is no explicit representation of the inference stroke
of a step. Inference strokes are just visual aids that appear in the colored diagrams
that represent dependency networks. From what we have just said, the motivation
for the following definition should now be clear. (R, M, M , E) is to be the state
of play at any stage in the process of contracting T with respect to a node.
Definition 19 Let T be a dependency network, with R a subnetwork of T; and let
M, M and E be sets of nodes. We say that (R, M, M , E) is T-orderly if and only
if |R| and E partition |T| and M and M are disjoint subsets of |R|:
|R |
M

M#

|T |

5.4 Contraction Algorithm: First Version

Version of the contraction algorithm for contracting T with respect to p is
as follows.
beginning of algorithm
Priming: Pass (T,{p},, ) to Downward.
(Note that (T, {p}, , ) is T-orderly.)
Downward: Given T-orderly (R, M, M , E):

C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

155

(I) If no member of M features as a premise in R, that is, if there is no

step (U, q) in R where U contains a member of M, then there is no work
for the Downward pass to accomplish; so pass (R, M, M , E) to Upward.
Otherwise,
(II) whiten every step (U, q) in R where U contains a most recently
whitened node, i.e. a member of M. Call the residue of unwhitened
steps R (which residue is a subset of R). Let R be the set of nodes
q in |R| that are to be whitened in this Downward pass, that is, none of
whose steps (U, q) in R survives in R . This means that R is |R| \ |R |.
Form E (R), and call the result E . Form M \ (R) and call the result
M . Form M \ (R) and call the result M . If M M is emptythat
is, if there are no whitened nodes prompting any further workhalt
and output R ; otherwise, pass (R , M , M , E ) with its non-empty set
M M of whitened nodes back again to repeat Downward. As soon
as you reach a stage where no further step whitenings can be made, yet
M M is still non-empty, pass the result to Upward.
Note that (i) M and M are subsets of |R |; (ii) M , M and
E are pairwise disjoint; and (iii) |R | and E partition |T|; that is,
(R , M , M , E ) is T-orderly.
Upward: Given T-orderly (Q, {p , . . . , pn }, M , E), take the cluster of
sets X = {X , . . . , Xk } that generate any of the pi ( i n) in Q.
For each i ( i n), there must be at least one such set; otherwise,
pi would have been transferred from M to E at the previous Downward

pass. Note also that ( i Xi ) ({p , . . . , pn } M ) is empty, that is,
none of the whitened nodes occurs in any of the impliers Xj ( j k).
This is because the previous Downward pass will have ensured that for
every surviving Q-step (U, x) no member of U is whitened.
Now choose an excision set Y for X by taking it to be an occluder for
X. If more than one such excision set is possible, take any one of them.
(This is where the non-determinism of the algorithm is manifest; or
where further criteria need to be applied in order to guarantee uniqueness of the choice.) Pass the T-orderly (Q, Y, {p , . . . , pn } M , E) to
Downward.

156

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Note how we have transferred all the pi from the M slot to the M
slot. They are now old whitened nodes, having been displaced by the
whitened newcomers in Y. Note also that the very next step of Downward will whiten all members of M .
End of Algorithm
In this algorithm, the subproblem find an occluder for X is NP-complete.
Hence the algorithm we have given is at least NP-hard. We exploited this observation in our proof of Theorem in Section ..

5.4.1 Example of Version 1 at work

We illustrate Version of the algorithm by walking through a very simple
example. Suppose the dependency network T is

|a

|b

a, b | c

That is, T consists of two axioms a and b, and has developed just one consequence, namely c, from {a, b}. Consider the problem of contracting T with
respect to c.

|a

|b

a, b | c

C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

157

We take the T-orderly quadruple

({({a}, a ), ({b}, b ), ({a,b }, c )} , {c} , , )
a
a

|R|

M#

M
c

|T |

at Priming and pass it to Downward. According to Downward(I), we pass the

same quadruple on immediately to Upward (since c does not feature anywhere
in T as a premise).
In Upward, X will have the single member {a, b}. The excision set Y will be
{a} or {b}. Let us take {a} for Y. (Note that this choice is non-deterministic.)
Thus we form the new T-orderly quadruple
({({a}, a), ({b}, b), ({a, b}, c)} , {a, c} , , )
|R|

b
a

M#

M
a
c

|T |

and pass it to Downward. (Note that we have not yet actually eliminated anything, that is, put anything into the E-term. And this is the first round of
whitening, so M is still empty.)
On this new pass of Downward, things finally happen. We now have a member of the component M = {a, c} that features as a premise in R: for a is in
the implier (i.e. the premise set) {a, b} of the R-step ({a, b}, c); and it is also
in the implier of the R-step ({a}, a). Accordingly by Downward(II), these steps
are deleted from R (that is, whitened within R). The resulting subnetwork is
R = {({b}, b)}. Neither the conclusion a nor the conclusion c of the whitened
steps occurs as the conclusion of any step in R . Thus both a and c are deleted
158

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

from the M-term {a, c} to leave as M ; and they are added to the E-term to
yield {a, c} as E :
({({b}, b)} , , , {a, c})
| R1 |

b
a

M1

E1

M#
a

c
|T |

The residue R is {({b}, b)}. (R ) is {a, c}. E is E (R) = {a, c}. M is

M \ (R ) = {a, c}\{a, c} = . The M term remains empty. Since M is also
empty, we halt and output R = {({b}, b)}.

5.4.2 An observation about the order of whitening

In the colored-diagram accompaniments to each stage of the contraction process, we exhibited the upward spread of white as the algorithm is designed to
accomplish it. In particular, beginning with node c whitened, we chose on the
Upward pass to whiten node a. At that stage, however, we left the inference
stroke of the step ({a, b}, c) black. We could do so because we had the assurance
that on the very next Downward pass that inference stroke would be whitened
anyway, since the premise node a was whitened. Managing the order of whitening of nodes and of inference strokes in this way enables us to underscore the
fact that it is only at Downward passes of the algorithm that steps themselves
are removed in order to reveal the residue.
In the residue, the steps that remain will always have black inference strokes.
But it might still be the case that some of those steps have white conclusion
nodes. If any of them do, then a new Upward pass will be triggered. Once again,
however, it will only be at the next Downward pass that the inference strokes
above those white conclusion nodes will themselves be whitened, indicating
that the steps in question will not be in the new residue.
This possibility is easily illustrated by the following sequence of diagrams,
showing successive stages of the contraction process when the system
|a a|b b|c

C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

159

is contracted with respect to c:

Upward
pass
whitens b

Downward
pass
whitens b|c

Upward
pass
whitens a

Downward a
pass
whitens
a|a, b|c

By delaying the whitening of inference strokeswhich is bound to happen, anyway, since at least one premise node above each such stroke has been
whitenedwe underscore the fact that the main data type on which we are
focussed is the step rather than the node. In our formal modeling, there is
no atomic constituent corresponding to an inference stroke. The step from a
and b to c, say, is formalized as ({a, b}, c), or, in the corresponding list notation
of Prolog, as [[a, b], c]. Thus the inference stroke in our colored diagrammatic
representation of this step:
a

really only serves to emphasize the second comma, which separates the premise
set from the conclusion. It is appropriate, therefore, to whiten the inference
stroke only as a sign that the whole step has been removed.

5.4.3 Discussion of Version 1

The foregoing example illustrates how the eliminations of nodesi.e. their
relegation to Ereally take place at Downward passes. All that the Upward
pass does is whiten certain premises (in an excision set) in order to trigger
the whitening of steps, and thereby possible whitening of conclusion nodes, at
the next Downward pass. But an excision set Y is always chosen so that the
160

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

unwanted common conclusion of the premise sets Xi affected by that choice

of Y will be shunted from the M slot (just whitened), perhaps via the M
slot (whitened sometime earlier) to the E slot (actually eliminated) at some
subsequent Downward passfor the conclusion in question will, by choice of Y,
have lost all its support in the form of the various Xi once all the members of
the excision set have finally been whitened.
The Downward pass actually does more. Certainly, it shakes out conclusions
that had earlier been whitened as unwanted, and whose status as whitened
resulted in further Upward whitening of supporting premises. But in addition
a Downward pass can happen to whiten any node no longer able to stand as
a supported conclusion: a conclusion that turns out to have been deprived of
all its supporting premise sets, whether or not that conclusion itself had been
whitened earlier as culpable for the presence of something unwanted.
This indeed is what makes it difficult to state conditions that will guarantee an optimal contraction as opposed to a suboptimal one. The algorithm as
specified above is a greedy algorithm. It makes choices of an excision set at
each stage that can be determined relatively quickly, so that it can get on to
the next stage as soon as possible. It does not take more time (and space) in
the computation to look ahead to determine whether a local choice (of an
excision set) is indeed optimal in the sense of contributing to a contraction that
is minimally mutilating in a global sense. In order to illustrate this limitation,
we shall construct a small dependency network for which the greedy algorithm
(Version ) delivers a globally suboptimal outcome. Consider now the following
case, where we confine our attention to the colored diagram, and also use the
easy-to-read symbolic representation of the steps of the diagram that does not
involve so many curly set-parentheses:

|a
a|b

|c
a|d

b, c|d

C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

161

In order to contract with respect to d, the greedy algorithm proceeds as

follows. First, d is whitened:

Nothing depends essentially on d, so we do not whiten anything in the first

Downward pass. In the first Upward pass, we need to disable each of two dimplying premise sets. The two premise sets in question are {a} and {b, c}. This
is the cluster we have to deal with. One excision set for this cluster is {a, c};
another is {a, b}. Suppose we choose {a, c}:

The first sweep of the next Downward pass accordingly eliminates a, c, d

(because d depends essentially on the presence of a and of c) and b (because
b depends essentially on the presence of a):
162

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

That is, the Downward pass eliminates everything, leaving us nothing. It cuts
the network back to the empty set.
A moments reflection shows, however, that an effective contraction need not
be that mutilating. There is no reason at all why c should not survive while a,
b and d are eliminated. The trouble, however, is that the greedy algorithm is
unable to see this, intent as it is on identifying the d-implying premise sets as {a}
and {b, c} and then plumping (albeit non-deterministically) in an uninformed
manner for {a, c} as the excision set. For look what could have happened had
the algorithm tarried awhile to consider the possibility of whitening, not the
whole of {a, c} (and then proceeding to the Downward pass) but rather an
appropriately chosen non-empty proper subset of {a, c}, and then looking ahead
at the projected result of the next Downward pass. Had {a} been thus chosen
instead of {a, c}:

C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

163

then it would have been discovered at the very next Downward pass that b would
be whitened (since b depends essentially on a):

Hence the d-implier {b, c} would be disabled. Thus it would be unnecessary to

whiten its other member c. That would leave c as the sole survivor of the overall
contraction.
Recall that we denote by (Y) the look ahead function determining what
nodes will be whitened at the next Downward pass if the excision set Y is chosen.
(We suppress here the subscript T on .) Suppose now that we are looking
for an appropriate excision set Y for a cluster X of d-implying premise sets.

Let us call Y ((Y) ( X)) the downward amplification of Y for X. In our

example, X={{a},{b, c}} and ({a}) = {a, b, d}. We note that {a}(({a})( X))
is the set {a, b}, which occludes X. By contrast, ({a, c}) = {a, b, c, d}; whence

{a, c} (({a, c}) ( X)) is the set {a, b, c}, which hits X all right, but not
perfectly. The downward amplification for {{a},{b, c}} of its occluder {a, c} is
not even an occluder of {{a},{b, c}}!whereas the proper subset {a} of this
occluder has a downward amplification that is at least a hitter of {{a},{b, c}}.
In the circumstances it would therefore be better to choose {a} as a provisional
excision set at the Upward pass, entrusting to the following Downward pass
the job of amplifying {a} to be at least a hitter, if not an occluder, for the set of
impliers in question. The point is that perfection in hitting can be wiped out with
one Downward pass. What we should be looking for is some excision set that
is not necessarily itself an X-occluder, but whose downward amplification for
X will be inclusion-minimal among all other downward amplifications, for X,
of alternative excision sets. This is because the purging effect of the Downward
164

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

pass is ineluctable; and we should be aiming to minimize that effect, not aiming
to minimize the excision set that triggers that effect.
The situation with the greedy algorithm for theory contraction can be summarized as follows. Often we shall include unnecessary members in an excision
set during the Upward pass: members (like c in our example) that seem perfectly
well chosen, and therefore perfectly eligible, so to speak, locally, for whitening;
but that, even if they were not whitened at this Upward pass, would be losing
anyway some of their fellow members in premise sets at the very next Downward pass, and could therefore escape whitening without any net loss in the
(minimally mutilating) contraction effect sought.
This general possibility prompts one to consider more carefully, at an Upward
pass, exactly which excision set is to be chosen. We do not want to choose too
large an excision set Y (that is, an occluder for the set of impliers at that stage).
For, as we have seen, we might in our haste be including in such an excision set Y
certain unnecessary members cmembers c even in whose absence from the
excision set an adequate hitter will in effect be completed by the next Downward
pass triggered by a (non-empty) proper subset Z of Y not containing c. Such a
situation has the general features
(i) Y occludes X;
(ii) Z is a proper subset of Y, hence does not hit X; but

X)) hits X.

(iii) Z ((Z) (

The aim should be to find some such Z whose amplification

Z ((Z) (

X))

is minimized among competing amplifications of similar form.

Before we can state Version of the contraction algorithm, we need one
more useful notion, reached via the following definitions.
Definition 20 x and y are T-allied for z if and only if for some U (U, z) is in T
and both x and y are in U.
Often the context tells us what node z is in question, and what the dependency
network T is; when that is the case we shall simply say that x and y are allies.
Allies are really just nodes in the same predicamentfacing the chop! By virtue
of their membership in U, a justifying set for z, they face the prospect of having
to go, or being excised, if the decision is ever taken to get rid of z.
C O N T R AC T I O N A L G O R I T H M : F I R S T V E R S I O N

165

Definition 21 CT (x, y, Z), the x-baffle for y in T based on Z, is the set of those
sets U such that x is the sole member of Z in U and (U, y) is in T. The union of
such a baffle contains no T-allies of x for y from Z.3
We shall use the variable B for sets of baffles.4 We shall often suppress mention
of T when T is clear from the context. By Remark , note that an x-baffle for y
(in T) need not be a singleton.

5.5 Contraction Algorithm: Second Version

Here, then, is Version of the contraction algorithm. It is less greedy and more
foresightful than Version .
beginning of algorithm
Priming: as before.
Downward: as before.

Upward: Given T-orderly (Q, {p , . . . , pn }, M , E), take X= i Xi where
Xi is the family of non-empty pi -implying premise sets ( i n) in Q.
Choose an excision set Z for X as follows:
Consider all non-empty subsets W of occluders for X. Consider the
spectrum of their downward amplifications for X, i.e. the spectrum of

sets of the form W ((W) ( X)). Among these narrow your attention to those that hit X. (There will be at least one, since the downward
amplification of any X-occluder will hit X!)
Consider now the (non-empty) set  of all such embedded W of
any such downward amplified X-hitter. Take any inclusion-minimal
member of . Such a set can serve as the excision set Z sought. (Note
that Z is a subset of an X-occluder. Hence for all z in Z, there is some i
( i n) such that C(z, pi , Z) is non-empty. Thus each member of the
excision set Z is the sole disabler of some justifier of some node already
whitened.)
If more than one such excision set is possible, take any one of them.
(This is where the non-determinism of the algorithm is manifest; or
Note that we are now using the letter C with a different sense from what it had in our earlier
discussion of the set of steps known to the agent.
Note that we are now using the letter B with a different sense from what it had in our earlier
discussion of the set of steps making up the agents belief scheme.

166

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

where further criteria need to be applied in order to guarantee uniqueness of the choice.) Pass the T-orderly (Q, Z, {p , . . . , pn } M , E) to
Downward.
End of Algorithm

5.5.1 Example of Version 2 at work

Consider the dependency network

|a |b |c |d |e
a, b | h c, d | h e, f | i
g, h | j d, i | j

|f

|g

We shall apply Version of the algorithm just formulated to contract this

network with respect to j (which is why j is whitened). Nothing depends on j,
so nothing happens at the first Downward pass. At the first Upward step, we
consider the set X of j-impliers, which is {{g, h},{d, i}}. We have to whiten at least
one member in each of these two sets. That is, we have to find an excision set that
occludes X and satisfies the minimality conditions required by the algorithm.
The candidate excision sets are
{g, d}, {g, i}, {h, d}, {h, i}.
Each of these is an adequate X-occluder. We now check each of these sets to
see whether, at the very least, it might include a non-empty proper subset W

such that W ((W) ( X)) occludes X; if we were to succeed in this then
we could fine tune our choice further with the remaining minimality requirements. But inspection reveals that no non-empty proper subset of any member
of X is such that its downward amplification occludes X. There are only four
possibilities for W: they are {g}, {h}, {i} and {d}. The downward amplification of
{g} fails to intersect {d, i}. Likewise for the downward amplification of {h}. The
C O N T R AC T I O N A L G O R I T H M : S E C O N D V E R S I O N

167

downward amplification of {i} fails to intersect {g, h}. Finally, the downward
amplification of {d} fails to intersect {g, h}, since, although the step ({c, d}, h)
would be lost in the Downward pass, the step ({a, b}, h) would remain, ensuring
that h survived. We therefore have to resort to one or other of the full excision
sets. So suppose we (non-deterministically) choose {h, i}:

That ends the first Upward step. We have chosen h and i for whitening. j is now
old whitened (hence rendered as gray), and transferred from the M slot to the
M slot.
The next Downward pass whitens the steps
({g, h}, j)({d, i}, j)
and places j in E, since j has now lost all its support. (It is a conclusion only of
white steps.) The network has accordingly been reduced to

|a |b |c |d |e |f
a, b| h c,d | h e, f| i

168

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

|g

Note that the reduced network at this stage consists of the steps whose inference strokes are single black lines in the diagram. Asterisks are placed next to
the labels of nodes (here, h and i) that have been whitened, but whose whitening
has not yet resulted in the loss of the steps in which they appear as conclusions.
Once again we perform an Upward pass. The set X of h-impliers and/or
i-impliers is
{{a, b}, {c, d}, {e, f }}.
Suppose we choose {b, d, e} as an excision set for X. (There are of course alternatives to this choice.) Both h and i are now old white, and are transferred from
the M-slot to the M -slot. Since each member of {b, d, e} is self-supporting, the
next Downward pass reduces the network to

h
|a

|c

|f

|g

The old whitened nodes h and i are transferred to E along with the most recently
whitened b, d and e, because all these nodes now stand as conclusions only of
white steps. There are no longer any nodes left whitened in the residual network,
so the algorithm halts and this is its output.

5.5.2 Discussion of Version 2

The foregoing example has been carefully chosen to illustrate something a little
untoward. Notice that if we now restore the excised node e to the contracted
network, the network will be able to be re-constructed (that is, universally
closed under the inferences in the original network) only this far:
C O N T R AC T I O N A L G O R I T H M : S E C O N D V E R S I O N

169

h
|a
|c
e, f | i

|e

|f

|g

We will not be able to recover j, the original node with respect to which the contraction process began. To be sure, if we restore d instead of e to the contracted
network, j will be recoverable:

|a
|c
c, d | h
g, h | j

|d

|f

|g

But this is weak succour indeed. What we would ideally like, as a guarantee of
minimal mutilation, is a theorem to the effect that restoring any node lost via
whitening during an Upward pass of the contraction process will precipitate
back the original node with respect to which the contraction began (here, j).
There is indeed a way to ensure this result about minimal mutilation (our
Theorem below), but first we need to introduce some further refinement in
the whitening undertaken in an Upward pass. Our algorithm in its present form
170

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

employs foresight by looking ahead at the effects of downward amplifications,

but not beyond the scope of the contemplated excision set at the Upward pass
in question. It could now benefit by having such foresight extended. For this it
will also need the benefit of some hindsight. At any given Upward pass we shall
draw on information generated by earlier Upward passes, as follows. First, we
describe what will be recorded at any Upward pass for subsequent up-dating
and recall; then we describe how subsequent Upward passes will make use of
the information thus recorded and up-dated in the interim.
At any Upward pass there is a set M of most recently whitened nodes. The
task in the Upward pass is to whiten yet more nodes, appropriately chosen
from impliers of members of M. These chosen nodes form the excision set Z.
Suppose that the Upward pass in question is dealing with the subnetwork R (of
the original network T) and results in the whitening of some member x of an
implier of a member of M. (Thus x goes into the excision set Z.) The information
we must now record is the set of those impliers (within T) of members of M
whose sole member from Z is x. That is, we want to record the x-baffle

CT (x, y, Z).
yM

Note that for every x in Z, this x-baffle will be non-empty, because of the way
excision sets are determined (as subsets of occluders of the cluster of impliers
of members of M).
So much for the recording of the necessary information in the form of baffles. What about its recall and use at subsequent Upward passes? Imagine now
that one is performing an Upward pass further along in the execution of the
contraction algorithm, say at stage k. Suppose at the earlier stage i (< k) the set
of newly whitened nodes was Mi . If z is in Mi then we shall, at the ith Upward
pass, have recorded the z-baffle

CT (z, y, Mi ).
yM i

At every following Downward pass, each such baffle is replaced by its surviving
subsetthe set of those of its members U for which no member of U other
than z has been whitened. The surviving subset will always be non-empty
because of the following constraint, furnished by the set B of all such up-dated
baffles, on any Upward pass:
() Ensure that the excision set Z chosen is such that for no x is the x-baffle in B hit by
(Z T (Z))\{x}.

C O N T R AC T I O N A L G O R I T H M : S E C O N D V E R S I O N

171

We see now why each baffle will, after the next Downward pass, have a nonempty surviving subset (in the sense just explained) to take its place in B.
() is an optimizing condition, and we have as yet no guarantee that it can
in general be fulfilled. An excision set meeting the condition () will be called
unbaffled. If Y is baffled, however, then its bafflement will be
{x-baffle B in B | (Y T (Y)) \ {x} hits B}.
Clearly we want bafflements to be minimized, if and whenever they are forced
upon us. Note that as proper up-dating of baffles proceeds, () becomes more
exigent on the choice of Y, since the kind of proscribed hitting is harder to avoid
on a proper subset of a baffle than on the baffle itself.
Non-empty bafflement of Y should trigger backtracking in the algorithm
until some suitable unbaffled alternative to Y is found, subject of course to all
the other earlier requirements that we have laid down. If no unbaffled candidate
can be found, then one may have to consider satisficing in this regarda topic
we shall not, however, address on this occasion.
Note that choosing an unbaffled excision set is merely extending the spirit of
the earlier condition concerning downward amplification.

5.6 Contraction Algorithm: Third Version

Here now is Version of the contraction algorithm. Each input has the form
(R, M, M , E, B) with a new extra parameter B for the set of baffles produced
by the stage of execution in question.
beginning of algorithm
Priming: Pass (T,{p},, , ) to Downward.
(Note that (T, {p}, , , ) is T-orderly.)
Downward: Given T-orderly (R, M, M , E, B):
(I) If no member of M features as a premise in R, that is, if there is
no step (U, q) in R where U contains a member of M, then there is no
work for the Downward pass to accomplish; so pass (R, M, M , E, B) to
Upward.
Otherwise,
(II) whiten every step (U, q) in R where U contains a most recently
whitened node, i.e. a member of M. Call the residue of unwhitened steps
172

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

R (which residue is a subset of R). Let R be the set of nodes q in |R|

none of whose steps (U, q) in R survives in R ; that is, R is |R| \ |R |.
Form E (R), and call the result E .
Form M \ (R) and call the result M .
Form M \ (R) and call the result M .

Let B be any baffle in B. B will be of the form y CT (x, y, Y), that
is, B will consist of sets U featuring in steps of the form (U, y) where
U Y = {x}. Remove from B all those sets U for which some member
of U other than x is in R. Call the result of such whitenings B. Replace
B in B with B. Call the result of such replacement B .
If M M is emptythat is, if there are no whitened nodes
prompting any further workhalt and output R ; otherwise pass
(R , M , M , E , B ) with its non-empty set M M of whitened
nodes back again to repeat Downward. As soon as you reach a stage
where no further whitenings can be made, yet M M is still nonempty, pass the result to Upward.
Note that (i) M and M are subsets of |R |; (ii) M , M and
E are pairwise disjoint; and (iii) |R | and E partition |T|; that is,
(R , M , M , E ) is T-orderly.

Upward: Given T-orderly (Q, {p , . . . , pn }, M , E, B), take X = i Xi
where Xi is the family of non-empty pi -implying premise sets
( i n) in Q. Choose an excision set Z for X as follows:
Consider all non-empty subsets W of occluders for X. Consider the
spectrum of their downward amplifications for X, i.e. the spectrum of

sets of the form W ((W) ( X)). Among these narrow your attention to those that hit X. (There will be at least one, since the downward
amplification of any X-occluder will hit X!)
Consider now the set  of all such embedded W of any such downward amplified X-hitter. Take the inclusion-minimal members of .
(There will be at least one such member of .) Among these, take the
unbaffled onesshould any existthat is, those Y such that for no x
does (Y T (Y)) \ {x} hit any x-baffle in B.
(The idea is that we want Y to be as small as possible. Since x is
whitened, all the sets in the x-baffle are already disabled. By not hitting
any x-baffle, the choice of Y ensures that the whitening of x will turn out
to have been needed.)

C O N T R AC T I O N A L G O R I T H M : T H I R D V E R S I O N

173

Such an unbaffled set can serve as the excision set Z sought.

(Note that Z is a subset of an X-occluder. Hence for all z in Z, there is
some i ( i n) such that C(z, pi , Z) is non-empty. Thus each member of the excision set Z is the sole disabler of some justifier of some
node already whitened.)
If more than one such excision set is possible, take any one of them.
(This is where the non-determinism of the algorithm is manifest; or
where further criteria need to be applied in order to guarantee uniqueness of the choice.) If there is no unbaffled set, then either backtrack
or choose one whose bafflement is minimal. Form the new set B of
baffles by adding to B all z-baffles, for z in Zthat is, all sets of the form
CT (z, pi , Z) where z is in Z and i n.
Pass the T-orderly (Q, Z, {p , . . . , pn } M , E, B ) to Downward.
End of Algorithm

5.6.1 Example of Version 3 at work

Consider once again the dependency network

|a |b |c |d |e
a, b | h c, d | h e, f | i
g, h | j d, i | j

|f

|g

one of whose permitted contractions by Version of the contraction algorithm

was not minimally mutilating. We shall apply the newly extended algorithm
employing constraint () to contract this network with respect to j (which
is why j is whitened). Nothing depends on j, so nothing happens at the first
Downward pass. At the first Upward step, we consider as before the set X of

174

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

j-impliers, which is {{g, h},{d, i}}. Once again we choose h and i for whitening
(bearing in mind, of course, that there are alternatives to this non-deterministic
choice of excision set). The set of baffles is empty. The next Downward pass
whitens the steps
({g, h}, j) ({d, i}, j)
and places j in E, since j has now lost all its support. (It is a conclusion only of
white steps.):

|a |b |c |d |e |f
a, b | h c, d | h e, f | i

|g

At this point we record the h-baffle CT (h, j, {h, i}) and the i-baffle
CT (i, j, {h, i}), which are, respectively,
{{g, h}} and {{d, i}}.
(In general, such baffles need not be singletons.)
Once again we perform an Upward pass. The set X of h-impliers and/or iimpliers is
{{a, b},{c, d},{e, f }}.
The choice of an excision set Y for X is now not so straightforward. Y will have
to contain either a or b, and contain either c or d, and contain either e or f . By
constraint (), Y cannot contain d, since {d} occludes the i-baffle {{d, i}}, and
does not contain i. So suppose Y is {b, c, e}. Both h and i are now transferred
from M to M . Thus M is now {b, c, e} and M is {h, i}. Since each member of
M is self-supporting, the next Downward pass reduces the network to

C O N T R AC T I O N A L G O R I T H M : T H I R D V E R S I O N

175

|a

|d

|f

|g

There are no longer any white nodes standing as conclusions of black steps
(the set M M is empty) so the algorithm halts and this is its output.
Now the earlier untoward result concerning contraction of this network is
averted. If we restore as a self-justifier any of the nodes that were whitened on
an Upward pass, the universal closure of the contraction with respect to the
restored node will contain j.

5.6.2 Another example of Version 3 at work

Consider the same network as before, but with one slight change: c is no longer
needed as a premise along with d to get h ; d by itself suffices to get h. c does not
appear in the network at all. So the dependency network is

|a |b |d |e |f
a, b | h d | h e, f | i
g, h | j d, i | j

176

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

|g

As before we have to contract this network with respect to j, which is why j

is initially whitened. Nothing depends on j, so nothing happens at the first
Downward pass. At the first Upward pass, the same considerations as before
lead us to choose h and i for whitening:

|a |b |d |e |f
a, b | h d | h e, f | i
g, h | j d, i | j

|g

The next Downward pass whitens the steps

({g, h}, j) ({d, i}, j)
and places j in E, since j has now lost all its support:

|a |b |d
a, b | h d | h

|e |f
e, f | i

|g

The set of baffles recorded will once again be the h-baffle

{{g, h}}
and the i-baffle
{{d, i}}.
C O N T R AC T I O N A L G O R I T H M : T H I R D V E R S I O N

177

Once again we perform an Upward pass. The set X of h-impliers and/or

i-impliers is
{{a, b},{d},{e, f }}.
The choice of an excision set Y for X is now impossible, for Y would have to
contain d, which it cannot do on pain of violating constraint () with respect to
the i-baffle {{d, i}}. Thus in the further execution of our algorithm we will have
to backtrack.
Indeed, when we re-consider, on backtracking, the choice of excision set at
the earlier Upward pass, we can choose {d, h} instead of {h, i}:
e

|a |b |d |e |f
a, b | h d | h e, f | i
g, h | j d, i | j

|g

The ensuing Downward pass will reduce the network to

e

|a |b |e |f
a, b | h e, f | i

|g

and record the h-baffle

{{g, h}}
178

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

and the d-baffle

{{d, i}}.
There is no white node in the premise set of any of the surviving (white) steps.
So the Downward pass is complete. But there is still a black step (namely a, b|h )
with a white conclusion. So there will be one more Upward pass: the excision
set {b}, say, will be chosen. It satisfies constraint () with respect to both the
baffles so far recorded. The final Downward pass will produce

|a |e
e, f | i

|f

|g

which will be the output, since now no conclusion nodes of black steps are
whitened.
Note now how this contraction also satisfies condition () for minimal mutilation. The nodes whitened in Upward passes in the course of the contraction
were b, d, h and j. Restoring any one of them precipitates j back again. We need
only check this for b, d and h taken singly. If we restore just b we obtain
|a |b

|e

|f

|g

a, b|h e, f |i
g, h|j.
If we restore just d we obtain
|a |d

|e

|f

|g

e, f |i d|h
g, h|j d, i|j.
C O N T R AC T I O N A L G O R I T H M : T H I R D V E R S I O N

179

If we restore just h then we obtain

|a |e

|f
e, f |i

|g

|h

g, h|j.

We shall prove below that this holds quite generally for the algorithm equipped
with the foresight of downward amplification of minimal occluders plus hindsight concerning which potential culprits escaped whitening. Constraint ()
provides just the right measure of discrimination needed. We shall show that
whenever we do obtain an output from this algorithm, that output is minimally
mutilated.
Theorem 5 Suppose the contraction algorithm can be executed with unbaffled
excision sets at every Upward pass in the process of contracting T with respect
to p. Let q be any node that was whitened in the process of contraction. Then p is
in [(Tp) {| q}]T .
Proof. Suppose the contraction process terminated after k stages. There would
have been k excision sets determined in the course of the contraction, one for
each stage. Consider the stage at which q was whitened. (If q = p, the result is
obvious.) At this stage q (= q ) found its way into an excision set M (assuming
now that q = p). It did so because at least one node q , say, had been whitened at
the previous stage, that is, placed in an excision set M , and q was in a surviving
q -implier U . (Note that the order relation of the numerical subscripts on
these excision sets reverses the order in which the excision sets would have
been determined!) The node q had, in turn, been whitened at the immediately
preceding stage because at least one node q , say, had been whitened, that is,
placed in the excision set M , and q was in a surviving q -implier U . These
considerations generate a sequence of sets U , U , , Um and a sequence of
nodes q = q , q , . . . , qm , qm = p such that for each i:
(1) qi is in Ui Mi (0 i < m k); and
(2) (qi+1 , Ui ) is in T (0 i m k).

Now consider CT (q , q , M ), the (non-empty) set of those sets U such that q

is the sole member of M in U and (U, q ) is in T. Ex hypothesi no Downward
pass ever whitened all the members of any occluder (other than {q } itself)
of CT (q , q , M ). Thus CT (q , q , M ) contains at least one membercall it
U all of whose members apart from q survived in Tp. This is because
CT (q , q , M ) would have had, by virtue of constraint (), at least one surviving
180

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

non-empty subset as a baffle in B to the very end of the contraction process.

of alterRepeating these considerations, we generate a sequence U , ,Um

natives to U , U , . . . , Um such that for each i :
(1*) qi is in Ui Mi (0 i < m k);

(2*) (qi+1 , Ui ) is in T (0 i m k);

(3*) every member of Ui , apart from qi , survives in Tp (for CT (qi , qi+1 , Mi ) would
have had, by virtue of constraint (), non-empty surviving subsets as baffles in
B to the very end of the contraction process).

That makes it obvious that when we add the self-justifying step |q (= |q ) to

Tp, the T-closure of the result generates p.
QED
What Theorem establishes is how minimally mutilating our whitening
choices are when constraint () is in place. Every node chosen for whitening
is chosen for good reason: if it were restored to the contraction as a justified
node, then the inferences available in the original network T would precipitate
p back again. Note that we are not claiming that every node whitened within
T in the process of contracting with respect to p would have the same effect.
Remember that some nodes are whitened only on Downward passes, and they
may therefore play no role in securing the presence of p in T. Therefore we
cannot expect their restoration to the contraction Tp to precipitate p back
again.
The question now arises: Under what conditions can we be assured that a
()-respecting outcome Tp of the contraction process can be obtained?
Definition 22 Let Rxy hold between distinct nodes x and y just in case there is
some T-step (X, y) with x in X. The (directed) R-graph within T ending on p is
determined in the obvious way. We say that the network T is stratified down to
p just in case this graph is a tree.
One obviously sufficient condition for satisfaction of constraint () by the
contraction process seeking Tp is that the network T should be stratified
down to p.
Definition 23 An upward path (in an R-graph) determined by p is a sequence
p=p , p , where for each i > , R(pi , pi ) and for each j > if for some q  = pj
R(pj , q) then pj is not the terminal element of the sequence.
C O N T R AC T I O N A L G O R I T H M : T H I R D V E R S I O N

181

Definition 24 A branch (in an R-graph) determined by p is a finite upward path

p=p , ,pn where no pi is identical to pj (i  = j) and pn is self-justifying.
Definition 25 An R-graph is well-founded for p if and only if every upward path
determined by p has a branch as an initial segment.
Definition 26 A network R is balanced on p if and only if its R-graph is wellfounded for p and all its branches that are determined by p, and have the same
terminal element, are of equal length.
Another sufficient condition for satisfaction of constraint () by the contraction
process seeking Tp is that the network T should be balanced on p. Whether
this condition could be relaxed further and still be sufficient in the required
respect is a matter for further investigation.

5.7 Making use of entrenchment information

One way to constrain the choices of nodes available for excision when a network
is being contracted is to avail oneself of any relative entrenchment information
that might be at hand for the network in question. The pragmatist point is frequently made that a rational agent can have preference orderings or rankings
of her beliefs. If the agent has two beliefs a and b, and ranks b higher than a,
then the agent will (ceteris paribus) choose to hold on to b and excise a if ever
it were to come down to making a choice between a and b. We can represent
such ranking or ordering by writing a < b. We can think of this as saying that,
as far as the agent is concerned, b is more important, or of higher value, than a.
A more objective-sounding way of expressing this is to say that, for the agent in
question, b is more entrenched than a.
Relative entrenchment can arise from a host of factors: quality of original evidence, reliability of testimony, further confirmation, centrality to a theoretical
scheme, simplicity, predictive power, and so on. Since our nodes are unstructured, we can fortunately prescind from representing these various factors at
work. It is enough just to be able to register the outcome of their joint influence:
a < b.
Definition 27 A relation < is single-premise T-respecting just in case for every
T-step of the form ({x}, y) we have x < y.
182

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

Definition 28 A set of entrenchments on T is a set of statements of the form

x < y, where x and y are in |T|, and the relation < is reflexive, transitive, and
single-premise T-respecting.
The operational meaning of a < b, as already intimated, is that if at any given
stage of the process of contracting T one may choose either the node a or the
node b (or possibly both) for excision, and if it is moreover possible at that stage
to excise a but retain b, then that is what one will do (ceteris paribus). If, however,
one retains the node a but excises the node bthat is, if one gets matters the
wrong way roundthen we say that the preference (or entrenchment) a < b
has been violated.
Henceforth we shall assume that any relation < we mention (holding among
nodes) is an entrenchment relation.
Definition 29 R violates x < y if and only if x is in |R| but y is not.
We shall use < for the set of entrenchments on T, suppressing mention of T
when context permits.
Definition 30 The <-violation of R within T =df {x, y | x < y and x and y are
T-allied for some T-casualty for R and R violates x < y}.
We shall call the <-violation of R within T simply < (T, R).
Remark : When contracting T with respect to p, we must ensure that we
respect as far as is possible whatever information we might have about the
theorists pairwise preferences among nodes in T. A desirable feature of any
contraction is that its associated <-violation should be minimal (under set
inclusion). But this new condition (M< ) is imposed only after the condition
of Minimal Mutilation is satisfied.
(M< ) The <-violation of Tp within T should be inclusion-minimal.

Definition 31 Assume Y hits X. Then < (X, Y) =df {x, y | x < y and x and y
are in some member of X; and y, but not x, is in Y}.
< (X, Y) is the <-violation involved when X is some cluster of premise sets each
of which has to be disabled, and Y is a proposed excision set containing at least
one member from each premise set in X.
M A K I N G U S E O F E N T R E N C H M E N T I N F O R M AT I O N

183

5.8 Contraction Algorithm: Fourth Version

Version of the contraction algorithm caters for entrenchment information.
All that is involved in the change is an appeal to minimization of <-violation in
the choice of an excision set. The Upward pass is changed so as to contain the
following insertion:
Then choose those X-hitters of the form
W ((W) (

X))

that are minimal among such hitters under set inclusion. Among these, choose those
whose <-violations are minimal under set inclusion.

Heeding entrenchment information helps to constrain more narrowly the range

of possible contractions, but cannot guarantee in general that the result of the
contraction process will be unique. For this reason we have left mention of
entrenchment to the end, so as not to complicate unnecessarily the exposition
of the new and sometimes difficult combinatorial ideas employed in the contraction algorithm.

5.9 Future work

5.9.1 Further study of the efficiency of contraction
algorithms
A good contraction algorithm would aim to enumerate all the minimally mutilating contractions of a given network T with respect to any of its nodes p. One
will have to put up with some of the enumerated solutions being more than
minimally mutilating, unless one filters out the latter. The problem, however, is
that identifying them as such is what incurs the increased cost in time.
The best one can hope for, in the case of search algorithms that are FNPcomplete or worse, is to employ insightful heuristics that makes the searches
as efficient as possible while being as successful as possible. We should aim to
build enough intelligent design features into our contraction-search algorithm
to ensure that the contractions that are produced tend, by and large, to be minimally mutilatingeven though we might choose, in the interests of efficiency, to
avoid always checking for this property. As it happens, we have found so far that
the vast majority of contractions computed by the program in Chapter have
184

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

been minimally mutilating. This suggests a potential line of research that we

cannot pursue here: identify structural features of dependency networks that are
arguably very prevalent in the networks that best model human belief systems,
and try to establish that these structural features guarantee a high proportion
of minimally mutilating contractions among the simple contractions that they
generate.

5.9.2 Surrendering steps as well as nodes

Another extension of the simple modelingwhich we do not consider here
would enable one to represent the agent as willing and able, in the course of a
contraction, to give up one or more of the steps within the dependency network.
The present modeling treats the steps themselves as unsurrenderable, and
allows only nodes to be given up. Allowing steps themselves to be vulnerable
in contractions, however, can have dramatic knock-on effects, especially when
one considers that a given step might be an instance of a more general rule that
would itself be impugned should the step be given up. A study of this problem
is underway, but its detailed results, both computational and philosophical, will
have to await another occasion.
Suffice it to say here that the modeling in this chapter can be extended so as to
allow for the retraction of steps as well as nodes. This is a possibility that, once
explored, reveals why thinkers are rightly loath to tamper with their logicfor
the knock-on effects are enormous. It is also a possibility whose closer scrutiny
commends an inviolable core of logic, namely the logic needed in order to
underpin the contraction process itself. (In this connection, see Chapter .)
Finally, as far as retracting steps as well as nodes is concerned: for the theoretical purposes of the present chapter, it has been important not to countenance
this possibility. That the contraction problem is NP-complete (that is, officially
intractable) when only nodes are given up is all the more arresting. Contraction
is intractable even when the problem setting is as austere and pared down as it
could possibly be.

5.9.3 The question of neuropsychological reality

We should point out that we have opted for a considerable degree of abstraction.
We have abstracted away from details such as the internal logical structure of
the beliefs represented by nodes, and what underlying logic might be employed
F U T U R E WO R K

185

to justify steps within a belief scheme. We have sought instead to provide a

representation of what is essentially involved in the process of contraction.
It remains to be investigated whether indeed our chosen level of theoretical
representationeven though heavily normativemight accord with the underlying neuropsychological reality of actual cognitive agents. Perhaps it is (or
could be) part of the design of a good cognitive system that its contraction
and revision module operate at the level of abstraction employed here. The
linguistic system furnishes complex grammatical structures for the expression
of ones beliefs; and ones logical system, and other reasoning modules, generate
various (derived) steps, for the rational development of ones beliefs. (We have in
mind here the need to grasp analytic connections among representationssuch
moves as This is red; ergo, this is colored.) For the purposes of orderly, rational
and efficient revision or updating, however, the only structure that is required
is that captured by the kind of dependency networks employed above. Between
the actual sentences of ones language, and the nodes in such networks, there
need only be a system of pointers. Contraction and revision can proceed at the
more abstract level of nodes and steps, prescinding altogether from distracting
questions about the internal logical structure of the nodes themselves, and the
kind of logic that justifies the steps.
Even though our theory is normative, there is no implication that creatures
operating in accordance with it would be doing so consciously, by reflecting
on correct applications of rules, etc. Their brains might be so wired that all
their norm-conforming behavior is automatic and subconscious. It would be an
open question whether, even in the case of creatures whose rational competence
in this regard were to outstrip ours, they would ever consciously conceive of
themselves as following rules in doing so.

5.9.4 Weakening the support offered by steps

Throughout this work we take steps to transmit justification fully from their
premises to their conclusions. One might say: we treat them as apodeictic.
The only genuine instances of such steps in actual thinking are ones that are
conceptually analytic (this is red; ergo, this is colored) or deductive (logicomathematical). This is a simplifying assumption within whose scope we have
nevertheless been able to explore a rich range of phenomena. But, as with any
other simplifying assumption in a theoretical investigation, pressure will be
brought to bear on it. Theorists will wish to explore the consequences of relaxing
186

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

the assumption, or liberalizing it, or making it epistemologically more realistic.

This can be done in several ways.
One might wish, for example, to investigate steps within systems of nonmonotonic or defeasible reasoning. Such systems allow steps to hold, as it were,
in the absence of certain beliefs or items of information, but to be undermined
by their presence. These beliefs or bits of information may be called defeaters. As
Pollock and Gillies [] point out, a defeater can either rebut a step (U, x) or
undercut it. A rebutting defeater gives one reason to disbelieve x. An undercutting defeater gives one reason to surrender the step itself, that is, the transition
from U to x. (Pollock and Gillies consider a richer structure than we do, one
that contains rebutting and undercutting defeaters for arguments that would
otherwise justify belief in their conclusions. But the need to take the agents
structure of reasons into account is apparent even in the more modest context,
investigated here, of non-defeasible justifications.)
Another way to relax our simplifying assumption that steps are apodeictic
and non-surrenderable is to try to model more closely what takes place in inductive reasoning. There, a set U of premises might support a conclusion x only to a
certain degree. Degrees can be measured by rational or real numbers in the unit
interval [, ]. Even initial beliefs can be assigned non-zero degrees less than
unity; and conclusions reached by a series of steps of degree less than unity will
of course have their own degrees attenuated thereby. One can specify a threshold
value (say ), and model the agents beliefs as those that have a degree greater
than the threshold value. One would need to provide details of the background
logic of degrees whereby the attenuation of support can be calculated from the
pattern of steps and their own individual support degrees. Within such a richer
framework, one could then investigate how best to effect contractions when the
trigger for contracting takes the form of a sudden demotion of degree for one
or more beliefs within the network.
We shall not speculate any further here as to how such details might unfold.
Suffice it to say that this would be the obvious point of contact to be developed
between the aims and methods of the present work and those of Bayesian
confirmation theory within so-called formal epistemology.

5.10 Conclusion
We have specified in this chapter various successively less greedy versions
of a contraction algorithm. In Chapter we provide a Prolog program that
CONCLUSION

187

implements the first of them. One can demonstrate how such programs produce
intuitively satisfying results on all extant contraction problems canvassed in the
literature. Further experiences with applications of such programsespecially
for the less-greedy versions of the contraction algorithmto larger examples
can be expected to yield more material for theoretical reflection.

188

S P E C I F I C AT I O N O F A C O N T R AC T I O N A L G O R I T H M

CHAPTER 6

A Prolog Program
for Contraction

6.1 Management of input files of problems

The best way to understand how this Prolog program works is to see what it goes
to work on. We have a file called Filename, containing a sequence of queries of
the form
[Step ,, Stepn ] ?- [WhitenedSentence(s)].
The steps on the left, before the question mark, constitute a dependency network, or system. On the right, after the question mark, are listed the nodes that
are initially whitened, and with respect to which a contraction of that network is
to be determined. See Section . for several examples of contraction problems
posed in this format.
Within Prolog, once the program is loaded, one gives the command
t(Filename).
This calls the predicate @, whose job it is to feed the queries one by one to the
program:
t(Filename) :@(Filename),
write(Thank you for your attention.).
M A N AG E M E N T O F I N P U T F I L E S O F P R O B L E M S

189

The queries are read, echoed, the predicate contract/ called on to answer them
(see below) and the result displayed.
These two clauses re-define certain system-defined predicates:
?- op(,fx,@).
?- op(,xfx,?-).
The reader is advised that in this presentation we eschew altogether Prologs
new-line command nl. Its many occurrences take up too much space, and are
distracting. In the actual program that we run, the command is used frequently,
in order to achieve readable output on the screen.
Here is the clause for the predicate @:
@(FileName) :see(FileName),
repeat,
read(Term),
(if isEof(Term)
then seen
else Term = (Steps ?- WhitenedSentences),
contract(Steps,WhitenedSentences,Residue),
fail).
This is the clause for the three-place start-up predicate contract:
contract(X,A,D) :listToSet(X,Y),
listToSet(A,B),
writeproblem(Y,B),
now contract(Y,B,D),
print(ANSWER:),
printsteps(D),
write(),
fail.
Use this line for multiple answers to each problem.

!.
Use this line for the first answer to each problem.
?- lib osets.

190

A P R O L O G P R O G R A M F O R CONTRACTION

writeproblem(X,A) :print(What is the result of contracting the system),

printsteps(X),
print(with respect to the set of sentences),
print([),
printsentences(A),
print(]),
print(?).

6.2 The top-level part of the program

6.2.1 For search without checks for minimal mutilation
The three-place predicate
now contract(System,Whitened,Contraction)
takes the System, in which certain nodes are Whitened, and determines a (not
necessarily unique) Contraction. It does so by immediately handing off to a
new four-place contraction predicate (see below), which goes to work in two
different modes, down or up, as indicated in its (newly supplied) first argumentplace.
We always begin with a downward pass, invoking the three-place predicate
existentialclosure, in order to whiten all steps of the system that have a premise
node affected by the whitening already in hand. Whitened steps are then subtracted from the system. Among the remaining steps we determine the new set
of still-white conclusion nodes. We then initiate an upward pass of whitening
prompted by these. In the upward pass, we determine occluders for the premise
sets of steps that still have white nodes as conclusions. The members of these
occluders are then whitened. The newly determined set of white nodes then
triggers another downward pass.
When the program backtracks, it explores different choices of occluders. This
is what can lead to a plurality of solutions to the contraction problem at hand.
now contract(System,Whitened,Contraction) :contraction(down,System,Whitened,Contraction).
contraction( ,[ ], ,[ ]).

T H E TO P - L E V E L PA RT O F T H E P R O G R A M

191

contraction( ,X,[ ],X).

contraction(down,System,Whitened,Contraction) :print(Now I am in Downward mode.),
print(Residual system: ),
printsteps(System),
print(Whitened sentences: ),
printsentences(Whitened),
existentialclosure(System,Whitened,Closure),
print(Existential closure: ),
printsteps(Closure),
subtract(System,Closure,System),
print(New Residual system: ),
printsteps(System),
remainingwhite(System,Whitened,Whitened),
print(Remaining whitened sentences: ),
printsentences(Whitened),
(
if Whitened = [ ]
then Contraction = System,
print(Final contraction is: ),
printsteps(Contraction)
else contraction(up,System,Whitened,Contraction),
print(Now changing to Upward mode )
).
contraction(up,System,Whitened,Contraction) :print(Now I am in Upward mode.),
print(Residual system: ),
printsteps(System),
print(Whitened sentences: ),
printsentences(Whitened),
all premise sets(System,Whitened,Family),
listToSet(Family,Family),
ord union(Family,Union),
listToSet(Union,Set),
extract cluster(Set,Set,Cluster),
print(leading me to identify the following cluster of premise-sets:),
192

A P R O L O G P R O G R A M F O R CONTRACTION

printsetsofpremises(Cluster),
occluder(Cluster,Occluder),
print(for which I choose the following occluder: ),
printsentences(Occluder),
print(and then change to Downward mode ),
contraction(down,System,Occluder,Contraction).

6.2.2 For search with checks for minimal mutilation

Note the new addition in the following clause, of mmtest and report.
The remaining clauses of this section are needed in order to supply its full
operational meaning.
contraction(down,System,Whitened,Contraction) :print(Now I am in Downward mode.),
print(Residual system: ),
printsteps(System),
print(Whitened sentences: ),
printsentences(Whitened),
existentialclosure(System,Whitened,Closure),
print(Existential closure: ),
printsteps(Closure),
subtract(System,Closure,System),
print(New Residual system: ),
printsteps(System),
remainingwhite(System,Whitened,Whitened),
print(Remaining whitened sentences: ),
printsentences(Whitened),
(
if Whitened = [ ]
then Contraction = System,
print(Final contraction is: ),
printsteps(Contraction),
mmtest and report(System,System,Whitened)
else contraction(up,System,Whitened,Contraction),
print(Now changing to Upward mode )
).

T H E TO P - L E V E L PA RT O F T H E P R O G R A M

193

mmtest and report(System,System,Whitened) :mm(System,System,Whitened),

!,
print(This contraction is minimally mutilating.).
mmtest and report(System,System,Whitened) :!,
print(This contraction is NOT minimally mutilating.).
mm(R,T,Unwanted) :listToSet(R,R),
listToSet(T,T),
subtract(T,R,TminusR),
fsso(TminusR,X),
nonempty(X),
passesand(R,X,T,Unwanted),
fail.
mm(R,T,Unwanted).
fsso(X,Y): find a subset of X and call it Y.
This will generate every possible subset of X upon backtracking.
fsso([ ],[ ]).
fsso([H|T],[H|Z]) :fsso(T,Z).
fsso([H|T],Y) :fsso(T,Y).
nonempty([ ]) :fail.
nonempty([H| ]) :!.

194

A P R O L O G P R O G R A M F O R CONTRACTION

passesand(R,X,T,Unwanted) :union(R,X,S),
pc(X,S),
!,
cdm(T,S),
!,
free of(Unwanted,S),
!.
passesand(R,X,T,Unwanted) :!,
fail.
Note: pc(X,S) means that every premise of a step in X is the conclusion
of some step in S. This suffices as a test for Ss being a subnetwork of T,
since we already know that R is one.
pc([ ], ) :- !.
pc([H|T],[ ]) :- !,
fail.
pc([H|T],Y) :pc this step(H,Y),
!,
pc(T,Y),
!.
pc this step([Prem,Con],Y) :pc this node(Prem,Y),
!.
pc this node([ ], ) :!.
pc this node([H|T],Y) :conc(H,Y),
!,
T H E TO P - L E V E L PA RT O F T H E P R O G R A M

195

pc this node(T,Y),
!.
conc(H,Y): H is the conclusion of some step in Y.
conc(Conclusion,[ ]) :!,
fail.
conc(Conclusion,[[ ,Conclusion]| ]) :!.
conc(Conclusion,[H|T]) :!,
conc(Conclusion,T).
cdm(T,R): R is closed downwards modulo T; that is, for any step [U,X]
in T, if every node in U is a conclusion of a step in R, then [U,X] is in R.
cdm([ ], ).
cdm([[U,X]|Tail of T],R) :member([U,X],R),
!,
cdm(Tail of T,R).
cdm([[U,X]|Tail of T],R) :black in(R,U),
!,
fail.
cdm([[U,X]|Tail of T],R) :!,
cdm(Tail of T,R).
black in(R,U): every node in U is the conclusion of some step in R.

196

A P R O L O G P R O G R A M F O R CONTRACTION

black in( ,[ ]).

black in(R,[H|T]) :conc(H,R),
!,
black in(R,T).
black in(R,[H|T]) :!,
fail.
free of(U,S): no node in U is the conclusion of any step in S
free of([ ], ).
free of([H|T],S) :conc(H,S),
!,
fail.
free of([H|T],S) :!,
free of(T,S).

6.2.3 The lower-level part of the program

occluder([ ],[ ]).
occluder([CH|CT],Occluder) :member(X,CH),
setsFrom(CT,thatHave(X,CTHits,andthe(CTMisses))),
intersection([CH|CTHits],IntersectHits),
subtract from members(CTMisses,IntersectHits,Pruned CTMisses),
occluder(Pruned CTMisses,Occluder),
addElement(X,Occluder,Occluder).
setsFrom([ ],thatHave( ,[ ],andthe([ ]))).

T H E TO P - L E V E L PA RT O F T H E P R O G R A M

197

setsFrom([H|T],thatHave(X,[H|SetOfTailHits],andthe(SetOfTailMisses))) :member(X,H),
!,
setsFrom(T,thatHave(X,SetOfTailHits,andthe(SetOfTailMisses))).
setsFrom([H|T],thatHave(X,SetOfTailHits,andthe([H|SetOfTailMisses]))) :setsFrom(T,thatHave(X,SetOfTailHits,andthe(SetOfTailMisses))).
intersection([H],H).
intersection([H|[K|T]],Intersect) :intersection([K|T],IntersectKT),
intersect(H,IntersectKT,Intersect).
occludes(Cluster,Occluder) :!,
hits(Occluder,Cluster),
hitsperfectly(Occluder,Cluster).
hitsperfectly(Occluder,Cluster) :member(X,Occluder),
delElement(X,Occluder,WouldBeOccluder),
hits(WouldBeOccluder,Cluster),
!,
fail.
hitsperfectly(Occluder,Cluster).
remainingwhite(System,[ ],[ ]).
remainingwhite(System,[H|T],[H|U]) :conc(H,System),
!,
remainingwhite(System,T,U).
remainingwhite(System,[H|T],U) :!,
remainingwhite(System,T,U).

198

A P R O L O G P R O G R A M F O R CONTRACTION

existentialclosure(System,Whitened,Closure) :existentialclosure(System,Whitened,Closure,[ ]).

existentialclosure([ ],Whitened,Closure,[ ]) :!,
solutions([[P],P],member(P,Whitened),Closure).
existentialclosure( ,[ ],Buildup,Buildup) :!.
existentialclosure(System,Whitened,Closure,Buildup) :prem(Whitened,System),
!,
infected(Whitened,System,Infected),
subtract(System,Infected,System),
union(Buildup,Infected,Biggerbuildup),
freshlywhite(Whitened,System,Infected,Freshlywhitened),
conclusions(Freshlywhitened,Freshwhitened),
existentialclosure(System,Freshwhitened,Closure,Biggerbuildup).
existentialclosure(System,Whitened,Buildup,Buildup) :!.
conclusions([ ],[ ]).
conclusions([[Premises,Conclusion]|T],[Conclusion|Conclusions]) :!,
conclusions(T,Conclusions).
freshlywhite(Whitened,System,[ ],[ ]).
freshlywhite(Whitened,System,[[Prems,Conclusion]|T],[[Prems,Conclusion]|U]) :-

not member(Conclusion,Whitened),
not conc(Conclusion,System),
!,
freshlywhite(Whitened,System,T,U).

T H E TO P - L E V E L PA RT O F T H E P R O G R A M

199

freshlywhite(Whitened,System,[H|T],U) :!,
freshlywhite(Whitened,System,T,U).
infected(Whitened,[ ],[ ]).
infected(Whitened,[[Premises,Conclusion]|T],[[Premises,Conclusion]|U]) :listToSet(Whitened,Whitened),
listToSet(Premises, Premises ),
intersect(Premises,Whitened),
!,
infected(Whitened,T,U).
infected(Whitened,[H|T],U) :!,
infected(Whitened,T,U).
prem([ ], ) :!,
fail.
prem( ,[ ]) :!,
fail.
prem(Whitened,[[Premises,Conclusion]|T]) :listToSet(Whitened,Whitened),
listToSet(Premises, Premises ),
intersect(Premises,Whitened),
!.
prem(Whitened,[[Premises,Conclusion]|T]) :prem(Whitened,T).
all premise sets([ ], ,[ ]).
all premise sets( ,[ ],[ ]).

200

A P R O L O G P R O G R A M F O R CONTRACTION

all premise sets(System,[H|T],[H|T]) :!,

premise sets(System,H,H),
listToSet(H,H),
all premise sets(System,T,T).
premise sets([ ], ,[ ]).
premise sets([[Prems,Conclusion]|SystemTail],Conclusion,[Prems|T]) :!,
premise sets(SystemTail,Conclusion,T).
premise sets([SystemHead|SystemTail],Conclusion,T) :!,
premise sets(SystemTail,Conclusion,T).
extract cluster( ,[ ],[ ]).
extract cluster(X,[H|T],U) :iism(X,H),
delElement(H,X,X),
!,
extract cluster(X,T,U).
extract cluster(X,[H|T],[H|U]) :!,
extract cluster(X,T,U).
iism([ ], ) :fail.
iism([X|Y],H) :subset(X,H),
not subset(H,X),
!.
iism([X|Y],H) :iism(Y,H).

T H E TO P - L E V E L PA RT O F T H E P R O G R A M

201

subtract from members([ ], ,[ ]).

subtract from members([H|T],Y,[H|T]) :subtract(H,Y,H),
subtract from members(T,Y,T).
hitter([ ],[ ]).
hitter([CH|CT],Hitter) :member(X,CH),
setOfMisses(X,CT,CT),
hitter(CT,Hitter),
addElement(X,Hitter,Hitter).
hits( ,[ ]).
hits([ ], ) :!,
fail.
hits(X,[H|T]) :listToSet(X,X),
listToSet(H,H),
intersect(X,H),
hits(X,T),
!.
setOfMisses(X,[ ],[ ]).
setOfMisses(X,[H|T],[H|U]) :not member(X,H),
!,
setOfMisses(X,T,U).
setOfMisses(X,[H|T],U) :!,
setOfMisses(X,T,U).

202

A P R O L O G P R O G R A M F O R CONTRACTION

6.3 Pre-processing
The foregoing program will work just fine, provided, of course, that the input
problems are well formed. This means, in particular, that the list to the left of
each question mark of a posed problem is a list of steps that really do form a
dependency network, strictly defined. If there is any worry that this might not
be the case, one can use the clauses below to pre-process the inputs, in order
to ensure that they are properly posed contraction problems.

preprocess(X,Y) :dependency network(X),

nodes(Y).
dependency network(X) :!,
list of steps(X),
pc(X,X).
nodes([ ]).
nodes([H|T]) :node(H),
nodes(T),
!.
node(a).
node(b).
node(c).
node(d).
node(e).
node(f).
node(g).
node(h).
node(i).
node(j).
etcetera, for as many primitive nodes as one wishes.

PRE-PROCESSING

203

list of steps([ ]).

list of steps([H|T]) :!,
step(H),
list of steps(T).
step(X) :initial step(X),
!.
step(X) :transitional step(X),
!.
initial step([[X],X]) :node(X).
transitional step([Premises,Conclusion]) :!,
node(Conclusion),
nonempty list of nodes(Premises),
listToSet(Premises,Premises),
setEq(Premises,Premises),
not member(Conclusion,Premises).
nonempty list of nodes([H]) :!,
node(H).
nonempty list of nodes([H|T]) :!,
nonempty list of nodes(T).
premise sets of([ ],[ ]).

204

A P R O L O G P R O G R A M F O R CONTRACTION

premise sets of([[Premises,Conclusion]|T],[Premises|T]) :premise sets of(T,T),

!.
ord union(ListOfSets,Union) :length(ListOfSets,Length),
(
if Length =:=
then Union = [ ]
else ord union(Length,ListOfSets,Union,[ ])
).
ord union(,[Set|Sets],Set,Sets) :!.
ord union(N,Sets,Union,Sets) :A is N//,
ord union(A,Sets,X,Sets),
Z is N-A,
ord union(Z,Sets,Y,Sets),
union(X,Y,Union).
allconclusions([ ], ).
allconclusions([H|T],Y) :member([Premises,H],Y),
!.
conclusion in(H,[ ]) :!,
fail.
conclusion in(H,[[Head|H]|T]) :!.
conclusion in(H,[Head|T]) :!,
conclusion in(H,T).

PRE-PROCESSING

205

6.4 Clauses for the various print commands

printsteps([ ]) :print([ ]).
printsteps([H]) :!,
writestep(H).
printsteps([H|T]) :!,
writestep(H),
printsteps(T).
printsentences([ ]) :print([ ]).
printsentences([H]) :!,
display(H).
printsentences([H|T]) :!,
display(H),
print(,),
printsentences(T).
writestep([X,A]) :!,
printsentences(X),
print( |- ),
display(A).
printsetsofpremises([ ]).
printsetsofpremises([H]) :print([),

206

A P R O L O G P R O G R A M F O R CONTRACTION

printpremises(H),
print(]),
!.
printsetsofpremises([H|T]) :print([),
printpremises(H),
print(]),
print(, ),
printsetsofpremises(T).
printpremises([ ]).
printpremises([H]) :display(H),
!.
printpremises([H|T]) :display(H),
print(, ),
printpremises(T).

C L A U S E S F O R T H E VA R I O U S P R I N T C O M M A N D S

207

CHAPTER 7

Results of Running our

Program for Contraction

7.1 Some simple contraction problems

We give below some mini-networks, with suggestive names. Each contains a
whitened node. This makes vivid the contraction problem
Contract this network with respect to its whitened node!

The reader will see that some of the networks are repeated, using different
choices of whitened node. The subscripts in some of the network names are
intended to remind the reader where, within the network concerned, the initially whitened node is situated. (Of course, the initially whitened node need
not be an initial node!)
In all the networks we indicate initial nodes by means of arrows coming to
them from (black) inference strokes that in turn receive no arrows. One of the
networks, though it looks like a square, is called Circle because it is representative of coherentist circles of mutually supporting nodes. Any plurality of nodes
would do; we have chosen here to deal with four.
Some of the networks will strike the reader as extremely trivial. But such
simple or degenerate examples are important aids to ascertaining whether ones
algorithm, and its implementation in ones chosen programming language,
work correctly. Every programmer knows how important it is to use lists of
208

R E S U LT S O F RU N N I N G O U R P R O G R A M

well-chosen but degenerate (i.e. easily surveyable) examples to debug programs

that are intended to implement correct algorithms. This is because, as anyones
programming experience reveals, a great many programming errors result from
a failure to grasp how the program ought to work on the very simplest of cases.
Programming is a humbling discipline. So the author makes no apology for
introducing the reader to the bread-and-butter examples below. The expository
challenge to the reader, at this stage, is to work out how the algorithm ought to
work in each of these cases, and to compare the conjectured results with those
that are actually produced by our program.
Corresponding to the colored diagram of each network is its contraction
problem, stated in Prolog notation. Each problem takes the form
[Steps of the network] ?- [white node(s)].
We shall have only one initially whitened node in each case. In general there
could be more than one, and our algorithm can deal with such cases. The reader
should bear in mind that, in the diagrammatic presentation of a contraction
problem, this initial whitening is confined to a single node, and has not yet
spread to any inference strokes, or any other nodes.
Inspection of the diagrams below will easily reveal how one can construct the
statement of the contraction problem from the diagram, and vice versa.
These mini-networks, and a great many others like them, are useful for
debugging computer programs that implement ones contraction algorithm. We
shall give the outputs of our Prolog program on these examples, in order to
show that it generates all the right possibilities for contractions. Ours is a backtracking program that can be prompted repeatedly to find alternative solutions,
resulting ultimately in the (finite) set of all possible contractions. Among these
could be some that are more than minimally mutilating. We could, if we wished,
add to our program the module given in Section .., to check that a contraction that has been generated is indeed minimally mutilating. One could then
filter out all those that mutilate too much. Such a modified program would produce as outputs only the genuine, because minimally mutilating, contractions.

Solo

[[[a], a]] ?- [a].

The challenge with Solo is to ensure that ones program produces the empty
network as the desired contraction.

S O M E S I M P L E C O N T R AC T I O N P R O B L E M S

209

Duo

[[[a], a], [[b], b]] ?- [a].

The challenge with Duo is to ensure that ones program does not get rid of b in
the desired contraction.
a

[[a, b], [b, c], [c, d], [d, a]] ?- [a].

Circle

The challenge with Circle is to ensure that ones program completes it, and
whitens all the nodes, yielding the empty network as the desired contraction.

c
[[[b], b], [[c], c], [[b], a], [[c], a]] ?- [a].

Veebottom

The challenge with Veebottom is to ensure that both sources of support for a are
whitened, yielding the empty network as the desired contraction.

Veetop

[[[b], b], [[c], c], [[b], a], [[c], a]] ?- [b].

210

R E S U LT S O F RU N N I N G O U R P R O G R A M

The challenge with Veetop is to ensure that ones program respects the fact that
a enjoys support from c, even when b cannot be counted on for support. So the
contraction should contain both c and a.

a
[[[a], a],[[a], b],[[a], c]] ?- [a].

Wedgetopmiddle
b

The challenge with Wedgetopmiddle is once again to obtain the empty network
as the desired contractionsince a is the only source of support indicated both
for b and for c.

a
[[[a], a], [[a], b], [[a], c]] ?- [c].

Wedgebottom

The challenge with Wedgebottom is to spread the white upwards from c to a,

and then downwards from a to b, yielding the empty network as the desired
contraction.

Zigzagbottommiddle
c

[[[a], a], [[b], b], [[a], c], [[a], d], [[b], d], [[b], e]] ?- [d].

The challenge with Zigzagbottommiddle isas the reader will no doubt have
guessedto yield the empty network as the desired contraction.
S O M E S I M P L E C O N T R AC T I O N P R O B L E M S

211

Zigzagtop
c

[[[a], a], [[b], b], [[a], c], [[a], d], [[b], d], [[b], e]] ?- [a].

The challenge with Zigzagtop is one of damage controldo not surrender any
of b, d or e!

Zigzagbottomend
c

[[[a], a], [[b], b], [[a], c], [[a], d], [[b], d], [[b], e]] ?- [e].

The challenge with Zigzagbottomend is again one of damage controldo not

surrender any of a, c or d!

[[[a], a], [[b], b], [[a, b], c]] ?- [c].

Twigbottom
c

The challenge with Twigbottom is to generate the two distinct possibilities of

contractionone in which a is surrendered but b survives, and the other in
which b is surrendered but a survives.
212

R E S U LT S O F RU N N I N G O U R P R O G R A M

Twigtop

[[[a], a], [[b], b], [[a, b], c]] ?- [b].

c

The challenge with Twigtop is to have the whitening go only downwards, and
not upwards thereafter. The node a must survive (i.e. remain black).

Double Twigbottom
e
[[[a], a], [[b], b], [[c], c], [[d], d], [[a, b], e], [[c, d], e]] ?- [e].

The challenge with Double Twigbottom is to generate the four distinct contractions that the reader will no doubt be able to identify.

Double Twigtop
e

[[[a], a], [[b], b], [[c], c], [[d], d], [[a, b], e], [[c, d], e]] ?- [b].

The challenge with Double Twigtop is once again one of damage control. All
that is black (apart from the inference strokes above and below b) must remain
black.
S O M E S I M P L E C O N T R AC T I O N P R O B L E M S

213

Sprigbottom

[[[a], a], [[b], b], [[c], c], [[d], d], [[a, b], e], [[c, d], f ], [[e, f ], g]] ?- [g].

The challenge with Sprigbottom is to whiten one whole branch at a time, thereby
generating the four distinct -node contractions that the reader will easily identify. (Each of these contractions will have distinct black nodes.)

Sprigtop

g
[[[a], a], [[b], b], [[c], c], [[d], d], [[a, b], e], [[c, d], f ], [[e, f ], g]] ?- [b].

The challenge with Sprigtop is to whiten only e and g in addition to b. The

whitening must go only downwards, and not be re-transmitted upwards to any
other nodes.

214

R E S U LT S O F RU N N I N G O U R P R O G R A M

Hexagonbottom

f
[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], e], [[d, e], f ]] ?- [f ].

The challenge with Hexagonbottom is to ensure that, in the contractions that

surrender b, both d and e are surrendered alsoone via upward whitening, the
other via downward whitening.

Hexagontopmiddle

[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], e], [[d, e], f ]] ?- [b].

The challenge with Hexagontopmiddle is to generate the unique contraction that

consists of only a and c.

S O M E S I M P L E C O N T R AC T I O N P R O B L E M S

215

d
Hexagontopend

[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], e], [[d, e], f ]] ?- [a].

The challenge with Hexagontopend is contain the spread of white to just the
branch adf .

Rhombusbottom
d
[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], d]] ?- [d].

The challenge with Rhombusbottom is to ensure that d does not get back in again.
Whitening b will ensure that. So too will whitening both a and c.

Rhombustopmiddle
d
[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], d]] ?- [b].

216

R E S U LT S O F RU N N I N G O U R P R O G R A M

The challenge with Rhombustopmiddle is to whiten only d, leaving a and c intact.

Rhombustopend
d
[[[a], a], [[b], b], [[c], c], [[a, b], d], [[b, c], d]] ?- [a].

The challenge with Rhombustopend is to refrain from whitening any other node.

Chaintop

Chainbottom

[[[a], a], [[a], b], [[b], c], [[c], d], [[d], e]] ?- [a].

[[[a], a], [[a], b], [[b], c], [[c], d], [[d], e]] ?- [e].

The challenge with each of these chains is to generate the empty network as the
desired contraction, but differently in each case. With Chaintop , all the whitening is accomplished in a Downward pass. With Chainbottom , all the whitening
S O M E S I M P L E C O N T R AC T I O N P R O B L E M S

217

(of nodes and then of steps) is accomplished in a series of alternating upward

and Downward passes, respectively.

7.2 Outputs of our program on the foregoing

problems
Solo
Script started on Wed Mar 24 22:56:04 2010
mercutio:/prooffinders [1] np
NU-Prolog 1.6.5
1?- [ctc].
Consulting /n/mercutio/1/neilt/prooffinders/ctc.nl.
Consulting /n/mercutio/1/neilt/prooffinders/
ctcmanagershort.nl.
Warning in op(1200, xfx, (?-)) -- changing a
system-defined operator.
Loading /n/mercutio/0/nuprolog/lib/lib.10605/osets.
no.
done
true.
2?- t(solo).
What is the result of contracting the system
a |- a
with respect to the set of sentences
[a] ?
Now I am in Downward mode.
Residual system:
a |- a
Whitened sentences:
a
Existential closure:
a |- a
New Residual system:
[ ]
Remaining whitened sentences:
218

R E S U LT S O F RU N N I N G O U R P R O G R A M

[ ]
Final contraction is:
[ ]
ANSWER:
[ ]
####################################################
Thank you for your attention.

With the remaining examples, the output will be shorn of all unnecessary
computerese, along with unnecessary parts of the automatically running commentary on the execution of the program. Bits of the latter will be left in only
when they help to illuminate some new feature of the example.

Duo
ANSWER:
b |- b

Circle
What
a |b |c |d |with
[a]

is the result of contracting the system

b
c
d
a
respect to the set of sentences
?

ANSWER:
[ ]

Veebottom
What
b |b |c |-

is the result of contracting the system

b
a
c
PROGRAM ON THE FOREGOING PROBLEMS

219

c |- a
with respect to the set of sentences
[a] ?
ANSWER:
[ ]

Veetop
What
b |b |c |c |with
[b]

is the result of contracting the system

b
a
c
a
respect to the set of sentences
?

ANSWER:
c |- c
c |- a

Wedgetopmiddle
What
a |a |a |with
[a]

is the result of contracting the system

a
b
c
respect to the set of sentences
?

ANSWER:
[ ]

Wedgebottom
What is the result of contracting the system
a |- a
220

R E S U LT S O F RU N N I N G O U R P R O G R A M

a |a |with
[c]

b
c
respect to the set of sentences
?

ANSWER:
[ ]

Zigzagbottommiddle
What
a |a |a |b |b |b |with
[d]

is the result of contracting the system

a
c
d
b
d
e
respect to the set of sentences
?

ANSWER:
[ ]

Zigzagtop
What
a |a |a |b |b |b |with
[a]

is the result of contracting the system

a
c
d
b
d
e
respect to the set of sentences
?

ANSWER:
b |- b
PROGRAM ON THE FOREGOING PROBLEMS

221

b |- d
b |- e

Zigzagbottomend
What
a |a |a |b |b |b |with
[e]

is the result of contracting the system

a
c
d
b
d
e
respect to the set of sentences
?

ANSWER:
a |- a
a |- c
a |- d

Twigbottom
With this problem, we revert to showing a fuller version of the programs output,
since it involves backtracking.
What is the result of contracting the system
a |- a
a,b |- c
b |- b
with respect to the set of sentences
[c] ?
Now I am in Downward mode.
Residual system:
a |- a
a,b |- c
b |- b
Whitened sentences:
222

R E S U LT S O F RU N N I N G O U R P R O G R A M

c
Existential closure:
[ ]
New Residual system:
a |- a
a,b |- c
b |- b
Remaining whitened sentences:
c
Now I am in Upward mode.
Residual system:
a |- a
a,b |- c
b |- b
Whitened sentences:
c
leading me to identify the following cluster of
premise-sets:
[a, b]
for which I choose the following occluder:
a
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- c
b |- b
Whitened sentences:
a
Existential closure:
a |- a
a,b |- c
New Residual system:
b |- b
Remaining whitened sentences:
[ ]
Final contraction is:
b |- b
PROGRAM ON THE FOREGOING PROBLEMS

223

ANSWER:
b |- b
####################################################
(The program now backtracks to change its choice of occluder. This is the first
time we have seen this happen.)
for which I choose the following occluder:
b
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- c
b |- b
Whitened sentences:
b
Existential closure:
a,b |- c
b |- b
New Residual system:
a |- a
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
ANSWER:
a |- a

Twigtop
What is the result of contracting the system
a |- a
a,b |- c
b |- b
with respect to the set of sentences
[b] ?

224

R E S U LT S O F RU N N I N G O U R P R O G R A M

ANSWER:
a |- a

DoubleTwigbottom
With this example we see, for the first time, four alternative solutions. Each of
the last three solutions is generated upon backtracking by trying an alternative
occluder.
What is the result of contracting the system
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
with respect to the set of sentences
[e] ?
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
Whitened sentences:
e
Existential closure:
[ ]
New Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
PROGRAM ON THE FOREGOING PROBLEMS

225

Remaining whitened sentences:

e
Now I am in Upward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
Whitened sentences:
e
leading me to identify the following cluster of
premise-sets:
[a, b], [c, d]
for which I choose the following occluder:
a,c
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
Whitened sentences:
a,c
Existential closure:
a |- a
a,b |- e
c |- c
c,d |- e
New Residual system:
b |- b
d |- d
Remaining whitened sentences:
[ ]
226

R E S U LT S O F RU N N I N G O U R P R O G R A M

Final contraction is:

b |- b
d |- d
ANSWER:
b |- b
d |- d
####################################################
(Now comes the first choice of alternative occluder; unnecessarily repetitive
material is suppressedNT)
for which I choose the following occluder:
a,d
and then change to Downward mode ...
ANSWER:
b |- b
c |- c
####################################################
(Now comes the second choice of alternative occluderNT)
for which I choose the following occluder:
b,c
and then change to Downward mode ...
ANSWER:
a |- a
d |- d
####################################################
(Now comes the third choice of alternative occluderNT)
for which I choose the following occluder:
b,d
and then change to Downward mode ...
ANSWER:
a |- a
c |- c

PROGRAM ON THE FOREGOING PROBLEMS

227

That is the fourth and final solution on offer.

DoubleTwigtop
What is the result of contracting the system
a |- a
a,b |- e
b |- b
c |- c
c,d |- e
d |- d
with respect to the set of sentences
[b] ?
ANSWER:
a |- a
c |- c
c,d |- e
d |- d

Sprigbottom
What is the result of contracting the system
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
with respect to the set of sentences
[g] ?
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
228

R E S U LT S O F RU N N I N G O U R P R O G R A M

c |- c
c,d |- f
d |- d
e,f |- g
Whitened sentences:
g
Existential closure:
[ ]
New Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
Remaining whitened sentences:
g
Now I am in Upward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
Whitened sentences:
g
leading me to identify the following cluster of
premise-sets:
[e, f]
for which I choose the following occluder:
e
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
PROGRAM ON THE FOREGOING PROBLEMS

229

a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
Whitened sentences:
e
Existential closure:
e,f |- g
New Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Remaining whitened sentences:
e
Now I am in Upward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Whitened sentences:
e
leading me to identify the following cluster of
premise-sets:
[a, b]
for which I choose the following occluder:
a
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
230

R E S U LT S O F RU N N I N G O U R P R O G R A M

a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Whitened sentences:
a
Existential closure:
a |- a
a,b |- e
New Residual system:
b |- b
c |- c
c,d |- f
d |- d
Remaining whitened sentences:
[ ]
Final contraction is:
b |- b
c |- c
c,d |- f
d |- d
ANSWER:
b |- b
c |- c
c,d |- f
d |- d
#####################################################
for which I choose the following occluder:
b
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
PROGRAM ON THE FOREGOING PROBLEMS

231

d |- d
Whitened sentences:
b
Existential closure:
a,b |- e
b |- b
New Residual system:
a |- a
c |- c
c,d |- f
d |- d
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
c |- c
c,d |- f
d |- d
ANSWER:
a |- a
c |- c
c,d |- f
d |- d
#####################################################
for which I choose the following occluder:
f
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
Whitened sentences:
f
232

R E S U LT S O F RU N N I N G O U R P R O G R A M

Existential closure:
e,f |- g
New Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Remaining whitened sentences:
f
Now I am in Upward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Whitened sentences:
f
leading me to identify the following cluster of
premise-sets:
[c, d]
for which I choose the following occluder:
c
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Whitened sentences:
c

PROGRAM ON THE FOREGOING PROBLEMS

233

Existential closure:
c |- c
c,d |- f
New Residual system:
a |- a
a,b |- e
b |- b
d |- d
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
a,b |- e
b |- b
d |- d
ANSWER:
a |- a
a,b |- e
b |- b
d |- d
#####################################################
for which I choose the following occluder:
d
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
Whitened sentences:
d
Existential closure:
c,d |- f
d |- d

234

R E S U LT S O F RU N N I N G O U R P R O G R A M

New Residual system:

a |- a
a,b |- e
b |- b
c |- c
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
a,b |- e
b |- b
c |- c
ANSWER:
a |- a
a,b |- e
b |- b
c |- c

Sprigtop
What is the result of contracting the system
a |- a
a,b |- e
b |- b
c |- c
c,d |- f
d |- d
e,f |- g
with respect to the set of sentences
[b] ?
ANSWER:
a |- a
c |- c
c,d |- f
d |- d

PROGRAM ON THE FOREGOING PROBLEMS

235

Hexagonbottom
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
with respect to the set of sentences
[f] ?
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
Whitened sentences:
f
Existential closure:
[ ]
New Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
Remaining whitened sentences:
f
Now I am in Upward mode.
Residual system:
a |- a
a,b |- d
b |- b

236

R E S U LT S O F RU N N I N G O U R P R O G R A M

b,c |- e
c |- c
d,e |- f
Whitened sentences:
f
leading me to identify the following cluster of
premise-sets:
[d, e]
for which I choose the following occluder:
d
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
Whitened sentences:
d
Existential closure:
d,e |- f
New Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Remaining whitened sentences:
d
Now I am in Upward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
PROGRAM ON THE FOREGOING PROBLEMS

237

Whitened sentences:
d
leading me to identify the following cluster of
premise-sets:
[a, b]
for which I choose the following occluder:
a
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Whitened sentences:
a
Existential closure:
a |- a
a,b |- d
New Residual system:
b |- b
b,c |- e
c |- c
Remaining whitened sentences:
[ ]
Final contraction is:
b |- b
b,c |- e
c |- c
ANSWER:
b |- b
b,c |- e
c |- c
#####################################################
for which I choose the following occluder:
b
and then change to Downward mode ...
238

R E S U LT S O F RU N N I N G O U R P R O G R A M

Now I am in Downward mode.

Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Whitened sentences:
b
Existential closure:
a,b |- d
b |- b
b,c |- e
New Residual system:
a |- a
c |- c
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
c |- c
ANSWER:
a |- a
c |- c
#####################################################
for which I choose the following occluder:
e
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
Whitened sentences:
e
PROGRAM ON THE FOREGOING PROBLEMS

239

Existential closure:
d,e |- f
New Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Remaining whitened sentences:
e
Now I am in Upward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Whitened sentences:
e
leading me to identify the following cluster of
premise-sets:
[b, c]
for which I choose the following occluder:
b
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Whitened sentences:
b
Existential closure:
a,b |- d
b |- b
b,c |- e
240

R E S U LT S O F RU N N I N G O U R P R O G R A M

New Residual system:

a |- a
c |- c
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
c |- c
ANSWER:
a |- a
c |- c
#####################################################
for which I choose the following occluder:
c
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
Whitened sentences:
c
Existential closure:
b,c |- e
c |- c
New Residual system:
a |- a
a,b |- d
b |- b
Remaining whitened sentences:
[ ]
Final contraction is:
a |- a
a,b |- d
b |- b
ANSWER:
PROGRAM ON THE FOREGOING PROBLEMS

241

a |- a
a,b |- d
b |- b

Hexagontopmiddle
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
with respect to the set of sentences
[b] ?
ANSWER:
a |- a
c |- c

Hexagontopend
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- e
c |- c
d,e |- f
with respect to the set of sentences
[a] ?
ANSWER:
b |- b
b,c |- e
c |- c

242

R E S U LT S O F RU N N I N G O U R P R O G R A M

Rhombusbottom
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- d
c |- c
with respect to the set of sentences
[d] ?
ANSWER:
b |- b
####################################################
(Here now is the only backtracking alternative choice of occluderNT.)
for which I choose the following occluder:
b
and then change to Downward mode ...
ANSWER:
a |- a
c |- c

Rhombustopmiddle
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- d
c |- c
with respect to the set of sentences
[b] ?

PROGRAM ON THE FOREGOING PROBLEMS

243

ANSWER:
a |- a
c |- c

Rhombustopend
What is the result of contracting the system
a |- a
a,b |- d
b |- b
b,c |- d
c |- c
with respect to the set of sentences
[a] ?
ANSWER:
b |- b
b,c |- d
c |- c

Chaintop
What
a |a |b |c |d |with
[a]

is the result of contracting the system

a
b
c
d
e
respect to the set of sentences
?

ANSWER:
[ ]

244

R E S U LT S O F RU N N I N G O U R P R O G R A M

Chainbottom
One might think that this case will be as straightforward as the last one. We can
just see that white will be spread upwards in a straight line to the node a at the
top. But the algorithm does not see that. It methodically performs alternating
upward and Downward passes. The Downward passes remove just one step at
a time. The remaining whitened node, at any stage, is the bottommost node of
the residual straight line, or branch, of the original system. On each Upward
pass, the node immediately above it is whitened. On the subsequent Downward pass, the step from the higher node to the node immediately below it is
eliminated.
What
a |a |b |c |d |with
[e]

is the result of contracting the system

a
b
c
d
e
respect to the set of sentences
?

Now I am in Downward mode.

Residual system:
a |- a
a |- b
b |- c
c |- d
d |- e
Whitened sentences:
e
Existential closure:
[ ]
New Residual system:
a |- a
a |- b
b |- c
c |- d
d |- e
Remaining whitened sentences:
PROGRAM ON THE FOREGOING PROBLEMS

245

e
Now I am in Upward mode.
Residual system:
a |- a
a |- b
b |- c
c |- d
d |- e
Whitened sentences:
e
leading me to identify the following cluster of
premise-sets:
[d]
for which I choose the following occluder:
d
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a |- b
b |- c
c |- d
d |- e
Whitened sentences:
d
Existential closure:
d |- e
New Residual system:
a |- a
a |- b
b |- c
c |- d
Remaining whitened sentences:
d
Now I am in Upward mode.
Residual system:
a |- a
a |- b
246

R E S U LT S O F RU N N I N G O U R P R O G R A M

b |- c
c |- d
Whitened sentences:
d
leading me to identify the following cluster of
premise-sets:
[c]
for which I choose the following occluder:
c
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a |- b
b |- c
c |- d
Whitened sentences:
c
Existential closure:
c |- d
New Residual system:
a |- a
a |- b
b |- c
Remaining whitened sentences:
c
Now I am in Upward mode.
Residual system:
a |- a
a |- b
b |- c
Whitened sentences:
c
leading me to identify the following cluster of
premise-sets:
[b]
for which I choose the following occluder:
b
PROGRAM ON THE FOREGOING PROBLEMS

247

and then change to Downward mode ...

Now I am in Downward mode.
Residual system:
a |- a
a |- b
b |- c
Whitened sentences:
b
Existential closure:
b |- c
New Residual system:
a |- a
a |- b
Remaining whitened sentences:
b
Now I am in Upward mode.
Residual system:
a |- a
a |- b
Whitened sentences:
b
leading me to identify the following cluster of
premise-sets:
[a]
for which I choose the following occluder:
a
and then change to Downward mode ...
Now I am in Downward mode.
Residual system:
a |- a
a |- b
Whitened sentences:
a
Existential closure:
a |- a
a |- b
New Residual system:
[ ]
248

R E S U LT S O F RU N N I N G O U R P R O G R A M

Remaining whitened sentences:

[ ]
Final contraction is:
[ ]
ANSWER:
[ ]

PROGRAM ON THE FOREGOING PROBLEMS

249

This page intentionally left blank

PA RT II

Logical and Philosophical

Considerations

This page intentionally left blank

CHAPTER 8

Core Logic is the

Inviolable Core of Logic
8.1 The debate over logical reform
There is much dispute over which logic is the right logicindeed, over whether
there could even be such a thing as the right logic, rather than a spectrum of
logics variously suited for different applications in different areas. Absolutists
about logic regard the use of the definite article as justified; pluralists have their
principled doubts. For those who engage in the absolutist debate, those whom
we can call the quietists are willing to accept the full canon of classical logic.
Their opponentsintuitionists and relevantists prominent among themargue
that certain rules of classical logic lack validity, and have no right to be in the
canon.
Intuitionists, on the one hand, originally drew inspiration for their critique of classical logic from the requirements of constructivity in mathematical
proof. According to the constructivists construal of existence, a mathematical existence claim of the form there is a natural number n such that F(n)
requires its asserter to be able to provide a justifying instancea constructively
determinable number t for which one can (constructively!) prove that F(t):
F(t)
.
xF(x)
This means that one may not use the back-door, or indirect, reasoning that
would be available to a classical mathematician, whereby in order to derive
T H E D E B AT E OV E R L O G I C A L R E F O R M

253

the conclusion that there is a natural number n such that F(n), it would be
sufficient simply to assume that no natural number has the property F, and then
(classically!) derive an absurdity from that assumption:
(i)

xF(x)
..
.
(i)
xF(x)

Thus the intuitionists ended up rejecting the rule of Classical Reductio ad Absurdum (CR):
(i)

..
.
(i)

and all rules equivalent to it, modulo the set of rules that the intuitionist could
eventually motivate or justify in a more direct fashion. Among these intuitionistic equivalents of (CR) is the Law of Excluded Middle (LEM):

through whose rejection intuitionistic logic is perhaps better known.
But even the intuitionists retained the rule Ex Falso Quodlibet (EFQ), also
known as the Absurdity Rule:

which allows one to infer any conclusion one wishes as soon as one has derived
an absurdity. This residual rule within intuitionistic logic is anathema to relevantists, since it affords an easy proof of the infamous Lewiss First Paradox:
A, A  B. The proof is
A

254

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

Relevantists refuse to accept Lewiss First Paradox, on the grounds that there
need not be any connection in meaning between the sentence A in its premises
and its conclusion B. Relevantists regard such a lack of relevance between the
premises and conclusions of certain classically (and intuitionistically) approved
rules of inference as compromising their claim to genuine validity. Many relevantists are still otherwise classical in their orientation, in endorsing (as relevantly valid) such inferences as Double-Negation Elimination (DNE), another
intuitionistic equivalent of CR (and of LEM):

Both campsintuitionist and relevantisthave variously produced philosophical, methodological, meaning-theoretic and intuitive considerations in support of their respective recommendations for restricting classical logic. Their
respective complaints about aspects of classical logic have, however, tended to
be orthogonal to one another.
Still, all participants in the debate over logical reform have an eye to the
methodological requirements of mathematics and natural science. Two central
concerns have been:
Does ones logic afford all the mathematical theorems that are needed for application in
science?

and
Does ones logic enable one to carry out the most rigorous possible tests of a scientific theory?

8.2 Core Logic

The two main lines of logical reformintuitionistic and relevantisthave been
concerned with different shortcomings of classical logic. Intuitionists still commit fallacies of relevance, and relevantists still endorse various strictly classical
(non-constructive) modes of inference. The present author, however, endorses
both kinds of reform, albeit with slightly different resultsespecially in the
matter of relevancefrom those proposed by other authors. A natural (if
unwieldy) label for a system of logic resulting from carrying out both intuitionistic and relevantist reforms would be intuitionistic relevant logic (IR);
and that indeed was the name and label proposed in Tennant [b] and
Tennant [a].
CORE LOGIC

255

A much better name for the system in question, however, would be Core
Logic; and that is the name we shall use here.
In the following statement of the rules of Core Logic, the boxes next to discharge strokes indicate that vacuous discharge is not allowed. There must be an
assumption of the indicated form available for discharge. (With (-E) and (-E)
we require only that at least one of the indicated assumptions should have been
used, and be available for discharge.) The diamond next to the discharge stroke
in the second half of (-I) indicates that it is not required that the assumption
in question should have been used and be available for discharge. But if it is
available, then it is discharged.
a indicates that no occurrence of the parameter a is permitThe annotation 
ted in the sentence(s) thus annotated.
Note, finally, that major premises for eliminations must stand proud; they are
to have no proof-work above them.

8.2.1 Graphic Rules of Natural Deduction for Core Logic

(i)

(-I)

(-E)

..
.

(i)

..
.

(-I)

..
.

..
.

(i)

(i)

,


..
.

(-E)

(i)

256

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

(-I)

..
.

..
.

(-E)

..
.

(i) 

..
.

(i)

(-I)

(i)

..
.

(i)

..
.

(-E)

..
.

..
.

(i) 

..
.

(i)

(i)

..
.

(i) 

..
.

(i)

(i)

(i)

..
.

(-I)

(i)

(i)

(i)

(i)

..
.
tx
x
(i)

a. . . ax . . .
a


..
.

(-E)

a


a
x

(i)

a


(-I)

..
.

xxa

CORE LOGIC

257

(i)

tx


(-E)

. . .. . .
(i)
, . . . , txn


..
.

(=-I)

(i)

t=t

(=-E)

t=u

..
.
t
t
, where u = u and  = .

8.2.2 Sequent Rules for Core Logic

We use ,  for (possibly empty) sets of sentences. Sequents are of the form
 : , where  has at most one member. Instead of {} we shall write when
there can be no confusion. Instead of   we shall write , . Whenever
we write , , . . . n :  (n ) in a premise-sequent, it is to be understood
that i   ( i n). Instead of writing on the right of a colon, we shall
sometimes simply leave a blank space, or write .
The sequent rules for any logical operator @ are of two kinds: those for introducing a dominant occurrence of @ on the right of the colon of the sequent, and
those for introducing it on the left. The Right-rules correspond to introduction
rules in natural deduction; the Left-rules correspond to elimination rules in
natural deduction. Note that our rules of natural deduction for Core Logic
were stated so as to make core natural deductions isomorphic (subject to minor
qualifications) to sequent proofs.
(-R)

, :
 :

(-L)

:
, :

(-R)

 :
 :
 ,  :

258

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

, : 
, : 

(-L)

, : 
, : 

(-R)

:
:
 :  :

(-L)
(-R)
(-L)

 , :   , :   , :  , :  , :  , :
 ,  , : 
 ,  , :
 ,  , :
, :
:
, :
 :  :  :
 , : 
 :
 ,  , : 

(-R)

 : tx
 : x

(-L)

, ax : 
, x : 

(-R)
(-L)
(=-R)
(=-L)

, , : 
, : 

(where  )

where the conclusion sequent has no occurrences of a

:
where a occurs in but in no member of 
 : xxa
, tx , . . . , txn : 
, x : 
:t=t
:
, t=u :

where ut = ut

8.3 Transitivity of proof in Core Logic

In core proofs, every major premise for an elimination stands proud. So all
core proofs are in normal form. This raises the question: how can one ensure
transitivity of core proof? Suppose one has core (hence, normal) proofs


A

and

A, 
 ,

where, by virtue of As being displayed separately, it is to be assumed that A  .

In systems of proof allowing accumulation of proof trees, one would be able
TRANSITIVITY OF PROOF IN CORE LOGIC

259

to form a proof by grafting a copy of  onto every undischarged assumptionoccurrence of A within :



(A) , 


and one would have the assurance that the resulting construction would count
as a proof of the overall conclusion from the set   of combined assumptions. Finite repetitions of the accumulation operation would also of course be
countenanced:

n

n

n
A , . . . , An , 
together yield (A ) , . . . , (An ) ,  ,

 ,, n and

A
An


where A , . . . , An  . This is what is commonly understood as constituting

the transitivity of proof (within a system allowing the formation of abnormal
proofs).
Why the stress on abnormal? Answer: in the core (hence: normal) proof ,
the cut-sentence A might stand at one of its undischarged assumptionoccurrences as the major premise of an elimination. In a system of normal proof,
the proof accumulation given above of  on top of  would therefore not
always count as a proof (of from  ). A fortiori, the proof accumulation
just indicated of  , . . . , n on top of  would not always count as a proof (of
from  . . . n ).
But this apparent absence of unrestricted transitivity (for the system of core,
hence normal, proof) imposes no limitation in principle. This perhaps surprising, but very welcome, result is secured by the following theorem, which is
stated here without proof. A detailed proof can be found in Tennant [forthcoming].
Theorem 6. (Cut Elimination for Core Proof)
There is an effective method [ , ] that transforms any two core proofs
A, 

(where A   and  may be empty)



A
into a core proof [] of or of from (some subset of)  .
260

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

Corollary 1 (Multiple Cut Elimination for Core Proof)

One can effectively transform the core proof

 n A , . . . , An , 

 , , n

A
An
(where A , . . . , An   and  may be empty) into a core proof
[ [. . . [n ] . . .]]
of or of from (some subset of)  . . . n .

8.4 Considerations in favor of Core Logic

Tennant [c] established the adequacy of Core Logic for natural science,
by adapting the proof in Tennant [] of the adequacy of minimal logic.
Tennant [] exploited the naturalness of Core Logic for efficient proof search
in computational logic. Tennant [b] showed that Core Logic is adequate
for intuitionistic mathematics. Tennant [c] gave a meaning-theoretic argument for the claim that Core Logic is the correct logic.
This chapter will argue for an important revision-theoretic thesis:
Core Logic is the minimal inviolable core of logic without any part of which one would not be
able to establish the rationality of belief revision.

Thus the sequence of different kinds of justification for choice of logic will at
last be rooted in one that underscores the appropriateness of the new name for
the system. The principles of Core Logic are the core principles of logic.

8.5 Reflexive stability

The theory of belief revision affords a fresh perspective on the important problem of the correct choice of logic. It will be argued here that this choice should
be made with an eye to the following requirement of reflexive stability:
The correct logic is inviolable: that is, no part of it can be given up without intolerable
loss of reasoning power. In particular, the logical rules that are required in order to be
able to carry out a rational process of belief revision cannot themselves (either singly or
collectively) be given up as a result of that process. Rational belief revision cannot be selfR E F L E X I V E S TA B I L I T Y

261

undermining or self-constraining. It must allow at least as much logic to survive as is needed

for the reflections involved in rationally revising ones beliefs.

In order to put this principle of reflexive stability to useful effect, we need to

examine the logical principles that are involved in the reasoning that is carried
out when a rational agent revises her beliefs. To this end, we appeal to the modeling of that process that was described in detail in Chapter . This modeling
is modest in its aims. It allows only for giving up beliefs, rather than possibly
also giving up transitional steps among beliefs. This means that, if we can show
that a certain core of logicCore Logic, no lessis required for the rational
process of belief revision in such a modest setting, we shall have prevailed. For,
in the more complicated setting of a more liberal approach to contraction and
revision, the reasoning involved in arriving at rational overall adjustments to a
belief scheme will be all the more demanding.
We saw in Chapter that belief systems are usefully modeled as dependency
networks, consisting of nodes and inference strokes connected by arrows. Their
pattern of connectivity was subject to certain Axioms of Configuration (see
Section ..), which ensured that premise nodes would be appropriately linked
to inference strokes that in turn would be linked to unique conclusion nodes.
Which beliefs the agent holds is indicated by a chosen coloration of the nodes.
We chose black for believed, and white for not believed. This choice, we noted,
is entirely conventional. Any symbolically represented dichotomy would do. We
could instead have chosen the predicate Bx to encode, not x is black, but x is
believed; and then we could have replaced the predicate Wx (x is white) with
Bx (since white and black are the only two colors under consideration).
What is the reasoning that we have to be able to go through, and offer, in our
account of our method of rational belief revision? We saw that in the course of
a contraction, one would be seeking to spread white through a belief network
under the constraint that we called White Lock. This constraint would ensure
that we resolved violations of the Axioms of Coloration ()() as uniquely
as possible, subject only to the non-determinacy involved in having to choose
which premise, within a given set of black premises, to whiten. We saw also that
in the course of an expansion, one would be seeking to spread black through the
belief network under the constraint that we called Black Lock. This constraint
would ensure that we resolved violations of the Axioms of Coloration ()()
uniquely.
Our actions are of course confined to spreading white or spreading black,
leaving the underlying finite network of nodes and arrows unchanged. This is
262

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

very important. In the first-order language L of the binary predicate A and

the monadic predicates S and N, plus identity, one can categorically describe
the underlying network N in question. That categorical description can be
reduced to a single sentence N , since N is finite. What categoricity means
here is that N is the sole model of N , up to isomorphism (in L). Moreover,
every L-sentence that is true-in-N is a logical consequence of the categorical
description N . Among these true L-sentences, of course, are the Axioms of
Configuration. These Axioms characterize the class of dependency networks, in
the same way that the axioms of group theory characterize the class of groups.
Each particular (finite) dependency network, however, makes true not only
the Axioms of Configuration but also (in the language L) sentences that, while
consistent with them, are not logical consequences of those Axioms.
When resolving violations of the Axioms of Coloration, the structure of the
network N , as expressed by the L-sentence N , remains unchangedwhence
N and all its logical consequences remain true. The only changes that we
can make are to coloration facts, expressed by means of the further monadic
predicate B (and its contradictory B).
We must therefore look to the reasoning involved in detecting violations of
our four Axioms of Coloration, and in settling on the various Action Types that
we isolated for the resolution of those violations. In particular, let us re-visit
Section .., showing the narrow diagrammatical context of such violations.
On this occasion we shall introduce labels for the nodes and inference strokes
under consideration.

8.5.1 Detecting violations of Axiom (1)

b
bn
all white
...
HH

H

HH

jw


a
Here we have a violation of Axiom (): Every black node receives an arrow from
some black inference stroke; in logical symbols,
x((Bx Nx) y(By Sy Ayx)).
At the theoretical level, we have to be able to reason to two conclusions. The
first conclusion is roughly of the form We have a problem here. The second
R E F L E X I V E S TA B I L I T Y

263

conclusion is roughly of the form The way to fix this problem is to make it the
case that . . . . Let us explain.
The inference strokes b , . . . , bn send arrows to the node a, and are all the
inference strokes doing so:
Ab a, . . . , Abn a;
x((Sx Axa) (x = b . . . x = bn )).
The inference strokes b , . . . , bn are all white:
Sb , . . . , Sbn ;
Wb , . . . , Wbn .
The node a is black:
Na;
Ba.
Let us denote by  the set of diagrammatic assumptions just listed. A fragmentary situation of the kind described by  sins against our rules; that is the
problem on our hands. Logically, it manifests itself thus: from  and certain of
our Axioms of Coloration, one can derive absurdity. That is, we can detect the
violation in question, by deducing from  and appropriately chosen Axioms
of Coloration. With  as stated, where the monadic predicate W is used, these
chosen axioms can be Axioms (), () and (). Alternatively, if  is formulated
using B in place of W, we can get by with just Axiom (). Let us follow this
second alternative. The logical task for the revision theorist, then, is to deduce
from the set of assumptions
Bb , . . . , Bbn , Ba, Na,
Sb , . . . , Sbn , Ab a, . . . , Abn a,
x((Sx Axa) (x = b . . . x = bn )),
x((Bx Nx) y(By Sy Ayx))
This sentence is an example of one that is a logical consequence of the L-sentence that categorically describes the A-, N- and S- structure of the network (i.e. of the whole diagram), assuming
that the language L contains also the names a, b , . . . , bn .

264

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

It will turn out that the following assumptions suffice:

Bb , . . . , Bbn , Ba, Na,
x((Sx Axa) (x = b . . . x = bn )),
x((Bx Nx) y(By Sy Ayx)).
The following is a proof in the sequent calculus for Core Logic:

Bb : Bb

b=b i , Bb : Bb i

b = b i , Bb i , Bb : in

Sb Aba : Sb Aba

ni= b = b i , Bb , . . . , Bb n , Bb :

Aba) ni=

Ba : Ba Na : Na
Ba, Na : BaNa

(Sb
b = b i , Bb, Sb Aba, Bb , . . . , Bb n :
Bb, Sb Aba, x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n :
BbSb Aba, x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n :
y(By Sy Aya)), x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n :

(Ba Na)y(By Sy Aya), x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n , Ba, Na :

x((Bx Nx) y(By Sy Ayx)), x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n , Ba, Na :

Note that all steps but one within this proof are Left-introduction steps (which,
in natural deduction, would be steps of elimination). The exception is the step
of (-R) at the top on the left. This appeal to a Right-introduction rule could,
however, have been avoided, had we used the sentence
x(Bx(Nxy(BySyAyx)))
instead of
x((BxNx)y(BySyAyx)).
With that choice of a logical equivalent, we would have had a proof of inconsistency consisting only of Left-introduction steps. But even in the proof we have
displayed, every Left-introduction rule finds application. So, whatever content
is conferred on a logical operator by its Left-introduction rule, we may conclude
that it needs to be endowed with at least that much content in order for us to
be able (rigorously to) detect that, with the diagram fragment above, we have a
problem on our hands, in the form of a violation of Coloration Axiom ().
R E F L E X I V E S TA B I L I T Y

265

8.5.2 Detecting violations of Axiom (2)

b
?
a g
Here we have a violation of Axiom (): Every white node receives arrows (if any)
only from white inference strokes; in logical symbols,

x((Wx Nx) y(Ayx (Wy Sy))).

The inference stroke b, which is black, sends an arrow to the node a, which is
white:

Sb, Bb, Aba, Na, Wa.

Replacing, as before, W with B, we have the task of deriving from the set of
assumptions

Sb, Bb, Aba, Na, Ba,

x((Bx Nx) y(Ayx (By Sy)))

in order to detect the violation of Axiom () that this diagram fragment represents. The reductio proof below makes do without the assumption Sb.
Bb : Bb
Bb, Bb :
Aba : Aba Bb Sb, Bb :
Ba : Ba Na : Na
Ba, Na : BaNa

Aba (BbSb), Aba, Bb :

y(Aya(By Sy)), Aba, Bb :

(Ba Na)y(Aya (By Sy)), Ba, Na, Aba, Bb :

x((Bx Nx) y(Ayx (By Sy))), Ba, Na, Aba, Bb :
Note that every logical operator occurring in the premises is Left-introduced in
pursuit of the inconsistency.
266

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

8.5.3 Detecting violations of Axiom (3)

b
g

?
a
Here we have a violation of Axiom (): Every black inference stroke receives
arrows (if any) only from black nodes; in logical symbols,
x((Bx Sx) y(Ayx (By Ny))).
Following the method already illustrated above, we seek a proof of from
Axiom () along with the assumptions
Nb, Bb, Aba, Sa, Ba.
The assumptions other than Nb suffice. The sought proof can be obtained from
the previous one, by substituting S for N throughout, and B for B in certain
places:

Aba : Aba
Ba : Ba Sa : Sa
Ba, Sa : BaSa

Bb : Bb
Bb, Bb :
BbSb, Bb :

Aba(Bb Sb), Aba, Bb :

y(Aya (By Sy)), Aba, Bb :

(Ba Sa)y(Aya (By Sy)), Ba, Sa, Aba, Bb :

x((Bx Sx) y(Ayx (By Sy))), Ba, Sa, Aba, Bb :
As before, all logical operators occurring in the premises enjoy Leftintroductions within this proof.

8.5.4 Detecting violations of Axiom (4)

b all black
w

@
@
R
@
a

bn
w

R E F L E X I V E S TA B I L I T Y

267

Here we have a violation of Axiom (): Every white inference stroke that receives
an arrow receives an arrow from some white node; in logical symbols,
x((Wx Sx zAzx) y(Wy Ny Ayx)).
The nodes b , . . . , bn send arrows to the inference stroke a, and are all the nodes
doing so:
Ab a, . . . , Abn a;
x((Nx Ax, a)) (x = b . . . x = bn )).
The nodes b , . . . , bn are all black:
Nb , . . . , Nbn ;
Bb , . . . , Bbn .
The inference stroke a is not black:
Sa;
Ba.
Analogously to the case with the violation of Axiom (), it turns out that we
have no need for the assumptions of the form Nbi . We do, however, need one
(but only one) assumption of the form Abi a. For definiteness, let us take Ab a.
That will guarantee zAza. The proof of from the remaining assumptions is
similar to that in the case of Axiom ():

Bb : Bb

b=b i , Bb : Bb i

b = b i , Bb i , Bb : in

Sb Aba : Sb Aba
Ba : Ba
Sa : Sa
Ba, Sa : Ba Sa

Ab a : Ab a
Ab a : zAza

Ba, Sa, Ab a : Ba Sa zAza

ni= b = b i , Bb , . . . , Bbn , Bb :

(Sb Aba) ni= b = b i , Bb, Sb Aba, Bb , . . . , Bb n :

Bb, Sb Aba, x((Sx Axa) ni= x = b i ), Bb , . . . , Bbn :
Bb Sb Aba, x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n :
y(By Sy Aya), x((Sx Axa) ni= x = b i ), Bb , . . . , Bbn :

(Ba Sa zAza)y(By Sy Aya), x((Sx Axa) ni= x = b i ), Bb , . . . , Bbn , Ba, Sa, Ab a :

x((Bx Sx zAzx) y(By Sy Ayx)), x((Sx Axa) ni= x = b i ), Bb , . . . , Bb n , Ba, Sa, Ab a :

Similar remarks as before hold for steps of Left-introduction within this proof.
268

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

8.5.5 Resolving violations of Axiom (1)

With violations of Axiom (), we have a core proof of from the assumptions
x((Bx Nx) y(By Sy Ayx)), x((Sx Axa) ni= x = bi ),
Bb , . . . , Bbn , Ba, Na.
We have here, at first blush, a version of the QuineDuhem problem. Which of
these assumptions is to be rejected? Note that we cannot merely identify one
assumption as the culprit and give it up without denying it; for its negation
follows logically from the remaining assumptions. We cannot (do anything
with the result that we have to) give up (or deny) the universally quantified
claim
x((Bx Nx) y(By Sy Ayx)),
for that is Axiom (), which has to hold for any belief network. Nor can we
(do anything with the result that we have to) give up (or deny) the universally
quantified claim
x((Sx Axa) ni= x = bi ),
for that is a true description of a fixed structural aspect of the network in
question. The node a simply does receive arrows from exactly the inference
strokes b , . . . , bn . That is a given, and cannot be changed. So too is the singular
fact Na. With White Lock in effect:
Do not make anything white black (i.e. do not make anything non-black black),

we are prevented from doing anything that would result in our having to give
up (or deny) any of Bb , . . . , Bbn . That leaves only Ba as the possible culprit.
So it is more of a Hobsons choice, rather than an instance of the QuineDuhem
problem (which problem consists in there being more than one assumption that
could, with equal reason, be rejected). The resolution of the problem at hand
consists in holding on to all of
x((Bx Nx) y(By Sy Ayx)), x((Sx Axa) ni= x = bi ),
Bb , . . . , Bbn , Na,

R E F L E X I V E S TA B I L I T Y

269

and making it the case that we can give up Ba, hence deny it. That is, we get
ourselves into a position where we can assert Ba (which is equivalent to
asserting Wa). In order to do this, we whiten the node a. The resulting diagram
fragment is accordingly
bn
b
all white
...
HH


HH


jg
H


a
It is easy to see that this diagram fragment is in accord with the Axioms of
Coloration. That is not to say, however, that there will be no further violations
of Coloration Axioms to be resolved. For, by whitening the node a, we could
well have produced such a violation elsewhere in the diagram, at a neighboring
fragment. That indeed is how a process of contraction or expansion plays out
successive adjustments in coloration of nodes, dealing with the knock-on effects
at neighboring parts of the diagram, until, in the end (after finitely many such
steps) we achieve a coloration that is in accord with the Axioms everywhere
within the whole digram.

8.5.6 Resolving violations of Axiom (2)

With violations of Axiom (), we have a core proof of from the assumptions
Sb, Bb, Aba, Na, Ba,
x((Bx Nx) y(Ayx (By Sy))).
For the same reasons as before, the only candidates for rejection are the singular
claims about color: Bb and Ba.
Under the constraint White Lock, which is in effect during any process of
contraction, we cannot act so as to give up Ba. Hence we are forced to act so
that we give up Bb (Hobsons choice once again). Accordingly, we whiten the
inference stroke b.
Under the constraint Black Lock, which is in effect during any process of
expansion, we cannot act so as to give up Bb. Hence we are forced to act so
that we give up Ba (Hobsons choice once again). Accordingly, we make the
node a black.

270

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

8.5.7 Reflecting on our reasoning towards resolutions

It may look as though the resolutions arrived at in the last two sections are
simple instances of Negation Introduction (-I): we find that  is inconsistent
with (where has been singled out in some salient way), and accordingly
conclude that follows from .
But the logical structure involved in our decisions to whiten an inference
stroke or a node (or make it black) is slightly more subtle than this. We can
best represent the process as consisting of two stagesindexed, say, with an
instant t and a successor instant t  . Configurational facts about a networkof
such forms as Na, Sb, Aab, etc.are stage-invariant. They hold at all instants t.
We can represent this by supplying an extra argument place for each predicate
involved, and then universally quantifying over it. Thus the foregoing forms of
configurational fact are, say, Na , Sb , Aab , etc.
Coloration facts, by contrast, can be stage-dependent. A node a, say, might
be black at the instant t (Bat) but not at the succeeding instant t (Bat  ).
The argument-place for discrete temporal instants can also be useful for
expressing the constraints White Lock and Black Lock on the processes of contraction and expansion, respectively. With White Lock we have
x (Bx Bx  ),
whereas with Black Lock we have
x (Bx Bx  ).
At the stage t when a problem is detected (in the form of a violation of a
Coloration Axiom) with reference to some diagram fragment, the inconsistency
proofs given above would go through with the simple modification of supplying t as an extra argument in all primitive predications. The overall forms of the
proofs would remain unchanged.
The resolution of such a problem (as we have seen thus far with reference
to detected violations of Axioms () and ()) consists in aiming to avoid the
t-dependent inconsistency revealed, by changing some coloration fact at t to
its opposite at t  : replacing Bat, say, with Bat  , or replacing Bat with Bat 
(for some node or inference stroke a). Which change is chosen will depend on
whether it is White Lock or Black Lock that is in place. Once the choice of Lock
is known, however, the question What to do? has a unique answer: Change the
R E F L E X I V E S TA B I L I T Y

271

color of that element!, where the referent of that element (a particular node or
inference stroke) is uniquely determined.
The reasoning is practical as well as theoretical. Confronted at instant t with
a diagram fragment that is inconsistent (as shown by some core proof ) with
the set of assumptions consisting of the Axioms of Coloration and the Axioms
of Configuration, the task is to work out what to do (by way of elemental color
change), consistently with whatever Lock is in place, in order to ensure that at
the successive instant t  following that elemental color change, the proof  of
inconsistency cannot go through if the t -relative assumptions are substituted
for the t-relative ones. We have seen so far that with the resolutions involving
Axioms () and (), there is only one possible choice, so it is forced upon one.
The same holds for resolutions of violations of Axiom (); but, as we shall
presently see, not with violations of Axiom ().
Before passing on to examine the cases with Axiom () and (), it is worth
stressing that the resolutions under consideration are always local. They involve
diagram fragments, not the whole diagram. There is no guarantee that upon
carrying out any such local resolution there will be no further violation of
Coloration Axioms elsewhere in the diagram. Expunging all such violations
is, literally, a time-consuming task. In general, we shall pass through many
successive stages t, t , t , . . . before an equilibrium is reached in which all the
Axioms are satisfied.

8.5.8 Resolving violations of Axiom (3)

With violations of Axiom (), we have a core proof of from the assumptions
x((BxSx)y(Ayx(BySy))), Ba, Sa, Aba, Bb.
Clearly if Black Lock is in effect, the only thing we can do is make the inference
stroke b black; and if White Lock is in effect, the only thing we can do to avoid
this inconsistency is whiten the node a.

8.5.9 Resolving violations of Axiom (4)

With violations of Axiom (), we have a core proof of from the assumptions
x((Bx Sx zAzx)y(By Sy Ayx)), x((Sx Axa)ni= x = bi ),
Bb , . . . , Bbn , Ba, Sa, Ab a.
272

CORE LOGIC IS THE INVIOLABLE CORE OF LOGIC

Clearly if Black Lock is in effect, the only thing we can do to avoid this inconsistency is make the inference stroke a black. If White Lock is in effect, however,
we have a range of similar choices: we can avoid the inconsistency by whitening
just one of the nodes b , . . . , bn . With n possible choices of action, the process becomes non-deterministic. Each of the available choices could lead to the
process playing out in a distinctive way across the whole diagram N , thereby
resulting in many different N -wide coloration equilibria that would satisfy
not only the categorical description N of the diagram, but also the Axioms
of Coloration.

8.6 The upshot

The upshot of these considerations is that the theoretical reasoning that is
fundamentally involved at the meta level, as it were, in the process of rational
belief revision makes ineliminable use of Left-introduction rules for the logical
operators (and of some Right-introduction rules, depending on ones choices
among logically equivalent formulations). If any of these rules were to be given
up, rational belief revision would be impossible.
Each Left-introduction rule has, as its natural and harmonious counterpart, the corresponding Right-introduction rule. Together these rules constitute
Core Logic. Core Logic is therefore the logic determined by the requirement of
reflexive stability discussed above.

T H E U P S H OT

273

CHAPTER 9

The Finitary Predicament

[Boris] had always treated objects like forks and spoons as though they had been
indefinitely renewablea profound mistake; there was a finite number of bars, cinemas,
houses, towns, and villages, and one and the same individual could not go to each of them
more than a finite number of times. At the moment of his death, in 42, he would have
lunched 365 22 times, 8,030 times in all, counting his meals in infancy. And assuming
that he had had an omelet once out of every ten occasions, he would have eaten 803
omelets.Only 803 omelets?" he said to himself with astonishment. Oh no; there are
the dinners too, that makes 16,060 meals, and 1,606 omelets. Anyway, for a man partial
to omelets that was not a considerable total. And what about cafs? he continued. The
number of times that I shall go to a caf after today can be calculated: suppose I go twice
a day, and that I am called up in a year, that makes 730 times. 730 times!thats not very
often.
Sartre (1947), at pp. 2712.

s with Boriss omelets, so with our beliefs: there are only finitely many
of them. Gentle reader, do not raise your hand with your immediate objection. Of course a logical law, such as the Law of NonContradiction:

274

T H E F I N I TA RY P R E D I C A M E N T

( )
has infinitely many potential substitution instances, such as
(It is raining (It is raining)).
And of course a logical saint would be obliged to believe every one of them! Similarly, of course a simple theorem of arithmetic, such as the Law of Commutativity
of Addition:
nm n + m = m + n
has infinitely many instances, such as
+ = + .
But no logical paragonand certainly no human beinghas ever actively
entertained each and every one of these infinitely many instances. Far from it.
Even a logical paragon will have entertained only finitely many such instances,
no matter how irreproachable her thought processes have been.
We shall accordingly be interested in representations of finite stages of development of axiomatizable theories.

9.1 Finitude of the set of known theorems

Given any axiomatizable theory T, with axiom set B, even when T is not finitely
axiomatizable, one can make the following observation: in the whole course of
human intellectual history, only finitely many theorems of T have been discovered
and proved.
It is no objection to this claim that one knows the truth of infinitely many
claims having, say, the form
( )
of the Law of Non-Contradiction. Nor would it be an objection that one knows
the truth of infinitely many arithmetical results of the form
a + b = b + a.
For, the schematic Law of Non-Contradiction is not really a statement; rather, it
is a schema for the generation of substitution instances that can be statements.
F I N I T U D E O F T H E S E T O F K N OW N T H E O R E M S

275

Either that, or it must, in order to be understood as a statement, be taken as a

universal generalization in the language of quantified propositional logic:
( ).
No matter how many instances of non-contradiction we have ever asserted
such claims as It is not the case both that + = and that +  = there
will have been only finitely many of them.
Likewise, the schematic Law of Commutativity of Addition is not really a
statement; rather, it is a schema for the generation of substitution instances
that can be statements. Either that, or it must, in order to be understood as a
statement, be taken as a universally quantified first-order claim:
xy(x + y = y + x).
No matter how many instances of the commutativity of addition we have ever
asserted or provedstatements such as +=+there will have been only
finitely many of them.

9.2 Finitude of the set of known proofs

Moreover, given any theorem p of our axiomatized theory T that has been
discovered and proved, p will have received at most finitely many proofs from
the set B of axioms of T. Furthermore, by the finitude of proofs, the subsets
of B involved, which have thus been shown to imply p, will be finite. Thus at
any stage in the development of T (from B), there will be only finitely many
sentences (including instances of axiom schemata) that have been expressly
acknowledged as axioms (i.e. as members of B), or established as theorems, of T;
and every sentence p expressly thus recognized as belonging to T will have been
deduced from at most finitely many finite subsets of the set B of axioms.

9.3 Thoroughgoing theoretical finitude

We would have what one might call thoroughgoing theoretical finitude if this last
claim could be strengthened so as to read
for every sentence p expressly thus recognized as belonging to T there are at most
finitely many (up to logical equivalenceand necessarily finite) logically minimal p-implying
subsets of B.

276

T H E F I N I TA RY P R E D I C A M E N T

Perhaps surprisingly: it can be so strengthened. The task in Chapter is to

justify this claim. Our situation is indeed one of thoroughgoing theoretical
finitude. And that is good news for the computationalist, who is constrained
to work with finitary representations.
For the time being we shall conduct our discussion using the word theory in
the sense associated with it by mathematical logiciansthat of a logically closed
(hence infinite) set of sentences.
We assume some logic for the object language with respect to which one
can speak in the usual way of a set of sentences logically implying a sentence.
We shall further assume soundness and completeness of some finitary system
of proof with respect to some semantics for that logic, so that one can speak
indifferently of logical consequence (|) and of logical deducibility ().
Definition 32 A theory is a logically closed set of sentences, all of which are
theorems of that theory.
Every theory contains every logically true sentence in its language, and is of
course infinite.
Definition 33 A set B that is not logically closed is called a base, or set of axioms,
for its logical closure [B].
We generalize the notion of logical implication by means of the following
definition, so that we can deal with sets of sentences on the right.
Definition 34 A set X of sentences logically implies a set Y of sentences just in
case X implies every member of Y.
Note that this generalization of logical implication to deal with sets on the
right is different from the usual reading of X  Y in the sequent calculus
(see Gentzen []) or multiple-conclusion logic (see Shoesmith and Smiley
[]), which treat Y disjunctively rather than conjunctively.
Definition 35 A logically minimal p-implying subset of B is a subset X of B that
implies p and is such that for any other subset Y of B implying p, if X logically
implies Y then Y logically implies X.
Definition 36 A set  of sentences of a language L is decidable just in case there is
a mechanical decision method that, applied to any given sentence of the language
L, yields after a finite time a correct answer to the question Is in ?.
THOROUGHGOING THEORETICAL FINITUDE

277

Definition 37 A theory is axiomatizable just in case it is the logical closure of

some decidable base.
Definition 38 An axiomatizable theory is finitely axiomatizable just in case it is
the logical closure of some finite base.
Note that of course every finite set is decidable.
By the result of Harvey Friedman proved in Chapter , the situation of
thoroughgoing theoretical finitude is almost perfectly general. It obtains for any
theory that, though not finitely axiomatizable, can nevertheless be axiomatized
by finitely many axioms plus finitely many normal axiom schemata.
Definition 39 An axiom schema is normal just in case substituting logical validities in it always produces logical validities.
Definition 40 A theory that can be axiomatized by finitely many axioms plus
finitely many normal axiom schemata is called finitely schematic.
Every known axiomatizable theory in mathematics is finitely schematic. Peano
Arithmetic and ZermeloFraenkel Set Theory are two examples. The metatheorem that secures this almost perfect generality for thoroughgoing theoretical
finitude is the following (see Chapter ).
Metatheorem [Friedman] Let T be a theory axiomatized by finitely many
axioms and finitely many normal axiom schemata. (The former axioms, and all
substitution instances of the axiom schemata, are the axioms of T.) Then for every
theorem p of T, there are at most finitely many logically minimal p-implying sets
of T-axioms.
Perfect generality of thoroughgoing theoretical finitude can then be ensured by
the following. Axiomatizable theories that are not finitely schematic can anyway be re-axiomatized so that thoroughgoing theoretical finitude still obtains.
Should T not be finitely schematic, it is hard to think of any principled objection that an opponent could raise to any re-axiomatization of T that secured
thoroughgoing theoretical finitude.
Note, then, that thoroughgoing theoretical finitude is a characteristic of any
finite set of theorems of any axiomatizable theory. So long as we are in possession of only finitely many theorems, we can proceed as if the theory of which
they are theorems is completely captured in all its relevant logical ramifications
by our notion of a (finite) dependency network, defined in Section ... Our aim
is to provide a perfectly general computational treatment of theory contraction.
278

T H E F I N I TA RY P R E D I C A M E N T

The aforementioned results in mathematical logic ensure that we can do so.

And our account of contraction and revision is not affected by the constraints
imposed on any computational logician by Churchs Theorem on the undecidability of first-order logic. For contraction and revision are operations applied
to finite developments of theories, which, as we have seen, can be modeled as
finite dependency networks.

THOROUGHGOING THEORETICAL FINITUDE

279

C H A P T E R 10

Mathematical
Justifications are Not
Infinitely Various
In every first-order theory axiomatized by axioms and axiom schemes, subject to mild conditions, every theorem follows logically from at most finitely many logically minimal sets of its
axioms and axiom-scheme instances.

his is a striking claim, whose hitherto unpublished proof is due to

Harvey Friedman. The reason why it is striking is that almost all important axiomatized first-order theories in mathematics are not finitely
axiomatizable. Thus, prima facie, any given theoremor, at the very least, some
theoremin such a theory might enjoy infinitely many distinct proofs, involving, respectively, infinitely many pairwise logically inequivalent finite sets of
axioms. That this is not the case is indeed surprising. The infinitude of axioms
of axiomatized theories that are not finitely axiomatizable is therefore to be
understood as needed only for the infinite variety of its theorems, rather than
for any supposed infinite variety of proofs of any given theorem.
This chapter sets out Friedmans original proof (private communication). The
only contribution of the present author is to have texturized the proofs so as to
make them more accessible to the average reader.
Before starting the detailed treatment, we mention two special cases of what
we are going to establish. These are the systems PA of Peano Arithmetic, and
ZFC of ZermeloFraenkel Set Theory with the Axiom of Choice. The language

280

M AT H E M AT I C A L J U S T I F I C AT I O N S

of PA is , s, +, ; and the language of ZFC is . We view equality as understood

without mention.
Both PA and ZFC take the form of finitely many axioms together with finitely
many axiom schemes. PA consists of two axioms for zero and successor, four
defining axioms for + and , and the induction scheme. ZFC consists of seven
axioms, along with the separation axiom scheme, and the replacement axiom
scheme.
For both PA and ZFC, the schemes generate more axioms by substitution
indeed, generate infinitely many more. In substitutions, only formulas from PA
and ZFC are used, and only formulas from PA and ZFC are generated. The
formulas resulting from substitutions in a scheme are called instances of that
scheme.
Corollary to Theorems 7 and 8 below. Let be a consequence of PA. There is
a finite set K of axioms and axiom-scheme instances of PA that logically imply ,
and that is minimal in the following sense. Any other finite set of axioms and
axiom-scheme instances of PA that logically imply , and that are logically implied
by K, are logically equivalent to K. Furthermore, there are only finitely many such
minimal logically implying sets K for , up to logical equivalence. The same assertions hold for ZFC. For PA and ZFC, the number is at most and , respectively.

We leave open the question of the exact counts for PA, ZFC.

10.1 Definitions of terminology

We begin with a presentation of the terminology that we will use. The reader is
assumed to be familiar with the basics of the first-order predicate calculus with
equality. We first make a definition that will avoid ambiguities.
Definition 41 A formula is valid if and only if it is true in all structures under
all assignments. A theory is a set of formulas. A consequence of theory T is a
formula that is true in all models M such that M satisfies T under all assignments.
Two formulas are equivalent if and only if each is a consequence of the other. This
definition is extended to sets of formulas in the standard way. For formulas , we
write for the universal closure of . If K is a finite set of formulas, then K is
the universal closure of the conjunction of K.
DEFINITIONS OF TERMINOLOGY

281

Definition 42 A non-logical symbol is a constant, relation, or function symbol. A

relational type is a set of non-logical symbols, for use in predicate calculus with
equality. Thus a formula can use quantifiers, connectives, nonlogical symbols
from , and equality. We put no restriction on the cardinality of . A theory is
a set of formulas.
Definition 43 A scheme is a formula in predicate calculus with equality that
uses at most the non-logical symbols in , equality, and uses one or more additional relation symbols not in . A schematic theory is a set of formulas and
schemes. Note that no formula is a scheme.
Definition 44 Let S be a scheme. An S-substitution is a function f from the
non-logical symbols appearing in S but not in , into formulas, subject to a
restriction that we explain below. We define S[f ] as the formula resulting from
replacing each atomic subformula
R(t , . . . , tk )
of T by
f (R)[v /t , . . . , vk /tk ].
The S[f ] are called the instances of S.
We now provide the restriction needed in Definition as promised. We
require that no bound variable of f (R) appears in S, and no free variable of f (R),
other than v , . . . , vk , appears in S.
Definition 45 Let T be a schematic theory. We say that is a consequence of
T if and only if is a formula that is a consequence of the axioms of T together
with the instances of the schemes in T.
Definition 46 Let T be a schematic theory. We say that T has the validity
property if and only if for any scheme S in T, and any S-substitution f whose values
are all of the form v v = v, S[f ] is valid.
Definition 47 Let T be a schematic theory. We say that K is an implying set in
T for if and only if K consists of axioms of T and of instances of axiom schemes
of T and K implies . We say that K is a minimal implying set in T for if and
only if K is an implying set in T for , and for all implying sets K  in T for , if K 
is a consequence of K then K, K  are equivalent.

282

M AT H E M AT I C A L J U S T I F I C AT I O N S

10.2 Results
Theorem 7 PA has the validity property. ZFC has the validity property.
Proof. The induction axiom scheme is
(R() x(R(x) R(s(x)))) R(x).
Note that the final occurrence of x is free. Replacing R by v v = v, we obtain a
valid formula.
The separation axiom scheme is
xy(y x (R(y) y z)).
Note that the final occurrence of z is free. Replacing R by v v = v, we obtain
xy(y x (v v = v y z)),
which is valid by setting x = z. The replacement axiom scheme is
(x x y !zR(x, z))wx(x y z(R(x, z) z w)).
Note that the two occurrences of y are free. Replacing R by v v = v, and
performing some obvious logical simplifications, we obtain
(x x y !z z = z) wx(x y z z w).
To see that this is logically valid, set w = y. QED
Lemma 3 Let T be a schematic theory with the validity property, and no
axioms. Then every consequence of T is equivalent to a finite set of instances of
the schemes in T.
Proof. Let T, be as given, and let be a consequence of T. Let be a consequence of { [f ], . . . , m [fm ]}, where the s are instances of the schemes in T,
using substitution functions f , . . . , fm .
We now use substitution functions g , . . . , gm given by gi (R) = fi (R).
We will show that is equivalent to { [g ], . . . , m [gm ]}. We claim that
implies i [gi ].
To see this, we assume . Then each gj (R) holds if and only if v v = v.
Therefore each i [gi ] holds if and only if i [f ] holds, where f is constantly
v v = v. Hence each i [gi ] holds if and only if some particular logically valid
formula holds.
R E S U LT S

283

Now assume . Then each gj (R) holds if and only if fj (R). Therefore each
i [gi ] holds if and only if i [fi ] holds. Now we have that for some i, i [fi ].
Hence for some i, i [gi ] . Therefore ( [g ] . . . m [gm ]) . QED
Lemma 4 Let T be a schematic theory with the validity property, with a finite
set K of axioms. Let be a consequence of T. Then has a minimal implying set
in T.
Proof. Let T, , K, be as given. Let W be the set of all E {} such that E K
and E is a consequence of the schemes in T. Obviously K W, and W
is finite.
For each E W, we can apply Lemma . to E , to form a finite set
(E) of instances of the schemes in T that is equivalent to E . Obviously,
if E W then E (E) is equivalent to E {}. In particular, if E W then
E (E) is an implying set in T for .
Let E be a minimal element of W in the following sense. For any E W, if

E {} is a consequence of E {}, then E {} is a consequence of E {}.
We claim that E (E) is a minimal implying set in T for .
To see this, let K  { ,,m } be an implying set in T for , where

K  K,
m 0,
1 , . . . , m are instances of schemes in T, and

K  {1 , . . . , m } is a consequence of E (E).

We want to show that E (E) is a consequence of K  { , . . . , m }. It is clear

that K  W. Also, K  {} is a consequence of E (E), and hence a consequence of E {}. By the choice of E, it follows that E (E) is a consequence
of K  {}, and hence a consequence of K  { , . . . , m }. QED
Lemma 5 Under the hypotheses of Lemma , any two minimal implying sets in
T for with the same axioms from T are equivalent. has at most |K| minimal
implying sets in T, under equivalence.
Proof. Let E { ,,m } be a minimal implying set in T for , where E is a set
of axioms in T and { ,,m } are instances of the schemes in T.
Obviously E is a consequence of { , . . . , m }, and so E {} is
a consequence of E { , . . . , m }. Now we can find an implying set in T
for of the form E { , . . . , r } that is equivalent to E {}, by applying
Lemma to E , as we did in the proof of Lemma . Hence by minimality,
284

M AT H E M AT I C A L J U S T I F I C AT I O N S

E { , . . . , m } is equivalent to E {}. This establishes the first claim. The

second claim follows immediately. QED
Theorem 8 Let be any relational type. In any schematic theory with at most
n axioms, the number of minimal implying sets for any consequence is among
, . . . , n .
Proof. By Lemmas , . QED
For a proof of the following result, known as Sperners Theorem, see Lubell
[].
Lemma 6 (Sperner) The largest possible size of a set of subsets of {, . . . , n}, no
element of which includes any other, is C(n, n/).
Theorem 9 Let be any relational type. In any schematic theory with at most
n axioms, the number of minimal implying sets for any for consequence, up
to equivalence, is among , . . . , C(n, n/).
Proof. From the proof of Theorem , we see that the minimal implying sets of
any consequence are equivalent to the E {}, where E is a set of axioms. We
need only use the E {} such that for no E properly included in E, is E {}
equivalent to E {}. These Es thus form a family of sets of axioms, none of
which includes any other. Now apply Lemma . QED

R E S U LT S

285

This page intentionally left blank

PA RT III

Comparisons

This page intentionally left blank

C H A P T E R 11

Differences from Other

Formal Theories

here are two main approaches to the problem of theory contraction that
are by now reasonably well entrenched. One is from artificial intelligence; the other is from mathematical logic. The new approach that has
been adopted here is distinct from both of these, seeking to avoid different difficulties inherent in each. A section is devoted to each of these other approaches,
in order to highlight the respects in which the new approach differs.
A third section is devoted to another branch of AI, which investigates probabilistic networks.
We have chosen the foci for these sections with an eye to how closely they
address the same problems as this account, and because they are approaches
now well served by authoritative monographs on them.
The author is well aware that many alternative approaches that are represented in the journal literature could merit coverage as well. But that would lead
to a discussion of unmanageable length. By confining our attention to just these
three main approaches, we hope to put the reader in a position to extrapolate
to unexamined approaches the points of contrast and criticism that we would
be inclined to raise.

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

289

11.1 Truth-maintenance systems

The present account of theory contraction differs significantly from the
prevailing paradigm, among theorists of Artificial Intelligence, of so-called
truth-maintenance systems (TMSs), reason-maintenance systems (RMSs), and
justification-based truth-maintenance systems (JTMSs). (These originate from
the work of Doyle []. For an integrated overview, see Forbus and de Kleer
[].)
First, unlike the JTMS-theorist (see Forbus and de Kleer [], ch. ), we
take seriously the possibility of coherentist epistemologies according to which
beliefs may be held without their being grounded in beliefs of any privileged
class (such as observation reports or sense-datum reports). That is to say, we
permit the general possibility of a belief within a belief system having no
well-founded pedigree of support terminating on what the JTMS-theorist calls
enabled assumptions. We can still accommodate well-founded belief systems
as a special (and obviously very important) case; but our formal theory accommodates non-well-founded belief systems as well.
Accommodating the non-well-founded case is sufficient to distinguish our
approach from JTMS-theory, even if some coherentist epistemologists were to
quibble that abandoning one belief may mean the remaining beliefs no longer
cohere and a radically different set of beliefs need to be adopted. If the coherentists complaint here is that we are giving her short shrift, we can simply point out
that JTMS-theory gives her even shorter shrift. Moreover, the coherentist has yet
to provide a really precise explication of exactly what coherentism consists in,
in so far as local relations of justificatory support among beliefs are concerned.
There is the very real prospect that at least one systematic explication of coherentism would allow for local relations of justificatory support, and would allow,
further, for the general possibility described abovenamely, that a belief within
a belief system might have no well-founded pedigree of support terminating on
initial beliefs that are themselves in no need of any further support. Moreover,
on our approach there is also the prospect of providing convincing evidence
for the very claim quoted from our imaginary coherentist critic a few lines
back.
Secondly, our primary theoretical focus is on inferential steps (identified
by their immediate premises and conclusions) rather than on nodes (which
correspond to sentences, be they premises or conclusions, or both). Any computational treatment of a subject matter is greatly facilitated by the appropriate

290

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

choice of data structure for theoretical manipulation and reasoning. We contend

that the most appropriate data structure is that of the step, not the (labeled)
node.
The final and most important difference between our approach and all forms
of TMS-theory, including JTMS-theory, is that we tackle the most general problem of how to contract a belief system with respect to any belief that the [J]TMStheorizer regards as in. We do not confine the operation of contraction to be
simply a matter of retracting assumptions, to use the terminology of JTMStheory.
As far as giving up beliefs is concerned, the most complex procedure on offer
from current JTMS-theorizing is the algorithmic operation of retracting an
enabled assumption. In the terminology of Chapter , this is the restricted operation of contracting with respect to an initial node. (See Forbus and de Kleer
[], ch. .):
Given a belief system B, and any one of its enabled assumptions a, the result of retracting
a is uniquely determined by B and a.

This restricted operation is deterministic, and it is easy to provide for it a

polynomial-time algorithm.
By contrast, we have shown that the general, non-deterministic operation of contracting with respect to any node, whether initial or non-initial,
is intractable. Our contraction operation includes the JTMS-theorists operation of assumption retraction as a special case, and generalizes it appropriately for the retraction of nodes in general, in what is obviously the canonical way. Retracting a node p (equivalently: contracting with respect to a
node p) is a general operation of obvious importance. The upshot of our
investigations is therefore: JTMS-theory cannot be fully general in its treatment of important operations on dependency networks except at the cost of
intractability.

11.2 AGM-theory
The approach from mathematical logic, so-called AGM-theory, is due to
Alchourrn, Grdenfors and Makinson. (See Grdenfors [] for an account
of AGM-theory.) In this section we expound the theory, and then note some
difficulties confronting it.

AG M-T H E O RY

291

11.2.1 Some background

Given the remarks in the Preface, it is worth supplying some background. The
authors prior engagement with AGM-theory has been as follows.
Tennant [a] launched a critique of AGM-theory, and sketched a computational alternative to it. That alternative, now worked out in full detail, is
the subject of the present monograph. AGM-theorists responded sharply to
Tennant [a]; their criticisms were countered in Tennant [a]. Tennant
[b] provided a more detailed critique of AGM-theorys problematic Postulate of Recovery. Tennant [] showed that subtle but important changes
were called for in AGM-theory if it is to handle belief systems that use a nonclassical consequence relation. Tennant [a] offered a friendly amendment
to AGM-theory that enabled it to deal with the relational notion theory T  is a
contraction of theory T with respect to proposition p, rather than the unnaturally functional notion theory T  is the contraction of theory T with respect to
proposition p. Tennant [] revealed a deeply hidden and irreparable fallacy
in the proof of a widely accepted and highly influential impossibility result in
Grdenfors [].
Tennant [b] calls for more detailed description. It showed that the
full set of AGM postulatesthe so-called basic postulates along with the
so-called supplementary onesso weakly constrains the notion of a rational belief-revision function that there are admitted, as legitimate interpretations, belief-revision functions that are both maximally mutilating and
maximally bloating (in devastating senses that can be precisely defined). This
degeneracy theorem revealed an unexpected and extreme laxity in the AGMpostulates. Collectively they are profoundly inadequate as a characterization of
their target notion.

11.2.2 A brief summary of the AGM-theory of contraction

The heart of any theory of belief revision is provided by what it says about
contraction. This is because the Levi identity is an impeccable way of obtaining
a revision with respect to A: first, contract with respect to A; then add A and
close. In symbols:
K A = [(KA), A].
So we focus here on AGMs account of contraction.
292

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

AGM-theory treats belief systems as theories, that is, as logically closed

(hence infinite) sets of sentences. When a theory K is contracted with respect
to one of its member sentences A, the resulting contraction (KA) is required
to satisfy certain conditions; these are set out as the contraction postulates
of AGM-theory. The AGM-theorists aim is then to show that certain functions (defined in terms of logical deducibility and certain set-theoretic
constructions) on K and A will produce outputs (KA) satisfying these postulates for contraction; and, conversely, any function satisfying the postulates for
contraction can be thus defined. This two-way result is called the Representation
Theorem.
The AGM-postulates governing belief-contraction functions can be found
in Alchourrn, Grdenfors and Makinson () at p. , and (in slightly
altered form) in Grdenfors (), pp. . For definiteness, we focus on
the earlier paper. It lays down six basic postulates (K )(K ). The labels are
from Alchourrn, Grdenfors and Makinson, loc. cit. Remember K is a theory,
A is a sentence.
(K 1) KA is always a theory [closure]
(K 2) KA is included in K [inclusion]
(K 3) If A  K, then KA = K [vacuity]
(K 4) If   A, then A is not in KA [success]
(K 5) If A and B are logically equivalent, then KA = KB [preservation]
(K 6) If A K, then K [(KA), A] [recovery]

(K ) may also be expressed by saying that the contraction KA permits

recovery of K via A. (K ) is AGMs formal attempt to capture the requirement
that contractions should be minimally mutilating.
There are also two supplementary contraction postulates, (K ) and (K ):
(K 7) (KA) (KB) K (A B)
(K 8) If A  K (A B), then K (A B) KA

These supplementary postulates seek only to constrain the relationship between

contraction with respect to any conjunction, and contraction with respect to
either of its conjuncts.
Definition 48 K A is the set of maximal non-(A-implying) subsets of K.
Thus any member J of (K A) is a subtheory of K that does not imply A. Its
maximality in this regard resides in the fact that J, B  A for any sentence B of
K that is not in J.
AG M-T H E O RY

293

Definition 49 Let K be a theory. is a selection function for K just in case for

every sentence A
if (K A) is empty, then (K A) = {K}; and
if (K A) is non-empty, then (K A) is a non-empty subset of (K A).

Definition 50 A partial meet contraction function is a binary function on

theories and sentences satisfying the following condition: for every theory K and

every sentence A in K, KA is (K A), where is a selection function
for K.
The word partial features here because (K A) may be a proper subset of
(K A). The word meet is used because it is a synonym for intersection,
and one is taking the intersection of the members of (K A) in order to
determine the value KA.
The main result in the AGM-theory of contraction is the following.
Theorem 10. (Representation Theorem for Basic Postulates) A function
KA defined on theories K and sentences A is a partial meet contraction function if and only if it satisfies the six basic contraction postulates (K )(K ).
There is also an extension of this theorem to cover the two supplementary
postulates (K ) and (K ). In order to state it, we need to provide one more
definition.
Definition 51 Let be a selection function for K. Then is transitively relational
over K just in case there is some transitive relation among subsets of K such that
for all A, (K A) consists of exactly those members of (K A) that are borne
the relation by all members of (K A). That is,
(K A) = {J (K A) | H (K A) H J}.
Theorem 11. (Representation Theorem for Full Postulates) A function KA
defined on theories K and sentences A is a transitively relational partial meet
contraction function if and only if it satisfies the six basic contraction postulates
(K )(K ) and the two supplementary postulates (K ) and (K ).
The account of theory contraction developed in this book differs from AGMtheory on three important points:

294

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

1. implementability (which AGM fails to secure, but on which we insist);

2.

RECOVERY

(which is a central postulate of AGM, but that we abandon in light of

convincing counterexamples); and

3. the requirement of minimal mutilation (which AGM does not succeed in ensuring, but that we cansince on our account it is an effectively decidable property
of would-be contractions).

11.2.3 Implementability
The first difference, on implementability, arises because we are not concerned
with (necessarily infinite) logical closures; instead, all the objects and structures with which we operate are finite, and all relations among them are effectively decidable. Moreover, there is a principled philosophical and metalogical justification for restricting our treatment to the finite and computable.
This rests on the result proved by Harvey Friedman (and presented in Chapter ), to the effect that there are at most finitely many logically minimal sets
of axioms implying any theorem, provided only that the theory in question
is axiomatized by means of finitely many axioms and finitely many normal
axiom schemes. (Every extant axiomatic theory in mathematics meets this
condition.)
Partial meet contraction functions are not, in general, computable, because
of their infinitistic character and the undecidability of the underlying relations
of logical consequence, reference to which is essential for the theoretical constructions involved. Hence AGM-theory does not offer a convincing prospect
for computer implementation of its methods of contraction.
Tennant [a] gave a preliminary and rough sketch of the staining algorithm for theory contraction. It was put forward in order to illustrate, and
make use of, a finitary conception of the structure of theories and a computational conception of the true nature of theory contractions. This computational conception was at odds with the infinitistic and non-effective conceptions
respectively presupposed and developed in AGM-theory. Grdenfors []
maintained
Although I do not develop computer implementations of the constructions, I believe that
my theory is of interest to AI (artificial intelligence) researchers. (p. ix)
these constructions are suitable for computer programs, although the implementation details are not pursued here. (p. 3)

AG M-T H E O RY

295

The fact of the matter, however, is that AGM-theory is not implementable on

a computer. It deals with logically closed sets of sentences, which are infinite;
and, consequently, does not provide any specifications of algorithms for either
theory contraction or theory revision. This criticism is made also in Hansson
[], at p. , concerning belief sets construed as logically closed sets of
sentences:
It seems unnatural for changes to be performed on such large entities as belief-sets, that
contain all kinds of irrelevant and never-thought-of sentences. This alone is sufficient reason
to search for alternatives to the AGM model.

Moreover, AGM-theory has not found the right solution to the problem of
contraction, even in the case of theories with finite bases, in the proposed
method of base contraction. This is because (as argued in Tennant [a])
the method of base contraction is not minimally mutilating. It would appear,
then, that the promissory notes of AGM-theory just quoted have proved to be
unrealistic tender.
It is a serious shortcoming on the part of any theory of potential interest to
AI that its objects and constructions are not finitary and effective. It might be
thought that that might simply be a price that has to be paid in order to get at
the whole truth about an important range of phenomena, which may somehow
transcend the computable. If this were so in the case of theory contraction and
theory revision, perhaps AGM-theory could be forgiven for not being usefully
implementable; perhaps its real value would derive from its nevertheless being
a true picture of a very complicated matter.
Unfortunately, this is not so in the case of AGM-theory.

11.2.4 The Postulate of Recovery

One of the most important postulates of AGM-theory is recovery. This is the
claim that if one contracts a theory K with respect to A, and subsequently reinstates A, then one will recover all the original consequences of K. recovery
isas inspection of their proofs will revealcrucial for the foregoing Representation Theorems.
recovery, however, violates the following compelling pre-theoretical intuition, which we discussed in Section .:
If one believes the proposition b only because one believes the proposition a, and one is
giving up a, then one ought to give up b as well.

296

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

Counterexamples to recovery were analyzed in Chapter . They were drawn

from Niedere [], at pp. ; Levi [], at pp. ; Hansson [],
at pp. ; and Tennant [a], at pp. . None of these other writers,
however, seems to have taken the lesson to heart, and sought to specify an
algorithm that would contract their examples in what they, and their readers,
would agree is the intuitively correct fashion.
The intuitive correction required is that one pay proper attention to the
intuition expressed above. It is easy to verify that all the counterexamples to
Recovery just cited are handled in the intuitively correct fashion by the algorithm for contraction described in Chapter .
Certain inadequacies of AGM-theory are due at least in part to failure on
the part of logical theorists to explore more fully and precisely some of the
insights of the AI literature, which do pay attention to the intuition above.
Grdenfors [] (at pp. ) makes only cursory mention of the work
of Doyle [] on truth-maintenance systems, and subsequently ignores the
lessons to be learned from it, even though he acknowledged (p. ) that
the idea of including justifications for the beliefs held seems fruitful. This aspect of belief
systems seems to be neglected in other models of epistemic states.

Nor has any believer in recovery heeded the insight of Etherington [] on

default reasoning, where the intuition found clear expression that if we give up
some belief then we should give up also those beliefs that depend on it for their
own justification: new information can invalidate previously derived facts (loc.
cit., p. ).
So there is a reflexive irony here; AGM-theory stands in need of a certain contraction. It needs to abandon the Postulate of Recovery. Whether anything still
recognizable as AGM-theory will result from such a contraction is a question
to be left to that theorys practitioners.1

11.2.5 Minimal mutilation

AGM-theorists do, however, share at least one main aim with their opposition:
that of characterizing theory contraction in such a way that it can be shown to be
minimally mutilating. Indeed, recovery was put forward in order, supposedly,
to capture the requirement of minimal mutilation.

Hansson [] is an attempt to do AGM-theory without the Recovery Postulate.

AG M-T H E O RY

297

Once again, however, AGM-theory encounters a serious shortcoming.

Its two main methods of contraction, namely partial meet contraction
(explained above) and so-called safe contraction,2 are demonstrably morethan-minimally-mutilating. So too, as already remarked above, is the method
of base contraction for theories with finite bases.3

11.2.6 The degeneracy of AGM-theory

Perhaps the most serious shortcoming of AGM-theory is that its postulates,
collectively, are extremely weak. They are supposed to characterize contraction and revision functions in a constraining way, so that those functions may
reasonably be regarded as candidates for use by a rational agent whose belief
scheme is being contracted or revised. Contrary to the widespread impression
that this was the case, Tennant [b] showed that absolutely bizarre revisions
of consistent theories with respect to contingent sentences that they refute
can be delivered by revision functions satisfying the full set of postulates of
the AGM-theory of theory revision. (The full set includes both the so-called
basic postulates, and the so-called supplementary ones.) These functions are
bizarre because they are both maximally mutilating and maximally bloating.
(The reader will recall our discussion of these notions in Section ..)
Much had been made (by AGM-theorists) of how their Representation Theorem establishes a bridge between their postulates supposedly characterizing
rational belief-revision functions, on the one hand, and, on the other hand, their
logico-algebraic recipes for constructing the revision functions themselves.
Such a theorem takes the form that, for any function f of the appropriate type
(mapping theory-sentence pairs to theories),
f satisfies such-and-such AGM-postulates
if and only if
f can be constructed according to such-and-such logico-algebraic recipe.

The Degeneracy Theorem shows that there are continuum-many functions f

that are bizarrely irrational as would-be belief-revision functions but that satisfy
the AGM-postulates. So, vividly put, the question arises: What boots it to have
See Alchourrn and Makinson [], Alchourrn and Makinson [], and Alchourrn
et al. [].
The critique based on the foregoing points is more fully developed in Tennant [b]. The
first airing of criticisms along these lines in Tennant [a] provoked responses from Makinson
[] and Hansson and Rott []. These criticisms are answered in Tennant [a] and Tennant
[b].

298

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

such a bridge, when each end of it is blocked by a pile of rubbish? The bizarrely
irrational functions satisfy the AGM-postulates; and they can be constructed
according to the favored logico-algebraic recipe.
The situation with AGM-theory is therefore analogous to that of Alfred
J. Ayers unhappy attempt to provide a criterion of cognitive significance by
offering a definition of what Ayer called indirectly verifiable sentences (which
include the directly verifiable ones as a special case). (See Ayer [].) Alonzo
Church showed that, on a weak assumption that one would expect to be satisfied
by any scientific language, for every sentence S, either S would count as indirectly verifiable or S would count as directly verifiable, on Ayers definition.
(See Church [].) The assumption in question is that the language contains
three mutually independent observation sentences. This assumption was subsequently weakened by Ullian []. He showed that if O and O are observation
sentences such that O does not imply O, then any contingent sentence not
implied by O would count as indirectly verifiable.4
Churchs result has come to be known as a collapse proof. A collapse proof
shows that any attempted formal explication of an apparently stable and intuitively appealing informal notion (such as cognitive significance) spectacularly
misses its markeither by a surfeit of false positives or by a surfeit of false
negatives. In Ayers case, the surfeit of false positives was the whole language
every sentence counted as indirectly verifiable (on his formal definition of that
notion), while of course the target informal notion of cognitive significance was
supposed to be highly restricted in its extension.
The Degeneracy Theorem for AGM-theory shows, likewise, that its attempted
formal explication of the informal notion of a revision function seriously misses
its mark, allowing for a surfeit of false positives. Whether this deficiency can
be repaired from within the AGM-framework (by adopting more postulates)
remains to be seen. The present author is not sanguine on this score.

11.2.7 A condensed account of the degeneracy results

Tennant [b] provided a general method whereby bizarre revisions of consistent theories with respect to contingent sentences that they refute can be
delivered by revision functions satisfying both the basic and the supplementary

In Tennant [c], ch. , a theory of cognitive significance is put forward that is intended to
avoid these difficulties.

AG M-T H E O RY

299

postulates of the AGM-theory of theory revision. Here, we summarize the main

results. Detailed proofs are given in the original paper.
Definition 52 For C a sentence, and
any set of sentences:


[C,
] if C,
 
C
=df
.
[C]
if C,

Theorem 12 Let
be a consistent set of sentences. For any consistent theory K
and any contingent sentence A refuted by K, set
KA =df A
.
Then is a revision-function satisfying the full set of AGM-postulates.
Theorem affords a uniform way of making bizarre revisions. Note that

is an arbitrary consistent set of sentences. For many a consistent theory K

inconsistent with A, the theory A
will be bizarre as a revision of K with
respect to A. This holds even (indeed, especially) when A is consistent with

, so that A
is [A,
]. For then
will often effect unwanted bloating in
addition to unwanted mutilation. This problem of bloating is particularly acute
when
is a complete theory, or when
has no extra-logical vocabulary (that
is, propositional atoms; or names, function signs and predicates) in common
with K or with A.
If this were not already bad enough for the AGM-theory of revision, it is
worth pointing out also that one can appeal to Theorem so as to ensure that,
for any given K inconsistent with A, and for any theory J that would definitely
count as bizarre qua revision of K with respect to A, there will be an AGMrevision function such that K A = J. The way to ensure this will be described
in Theorem .
Definition 53 Let D be a sentence and let H be a set of sentences. Then DH =df
{D | H}.
Theorem 13 Let J be a consistent theory, let D be a contingent sentence inconsistent with J, and let H be any theory that implies D. (H may be highly irrational
as a revision of J with respect to D; for H may involve both unwanted mutilation
and unwanted bloating.) For any consistent theory K and any contingent sentence
A refuted by K, set
KA =df A DH.
300

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

Then satisfies the full set of AGM-postulates, and JD = H.

Theorem tells us that a particular bizarre theory revision can be extended
to an overall revision function satisfying the full set of AGM-postulates. This
result can be strengthened (see Theorem below), so as to provide infinitely
many bizarre revisions for each theory K.
Definition 54 A spectrum consists of two lists of the same (finite or countably
infinite) order type :
{D , D , . . . }
{H , H , . . . }
of contingent sentences Di and consistent theories Hi , where for each i < ,
Hi  Di and for i = j < , Hj refutes Di .
Definition 55 Given a consistent theory K, a K-spectrum is a spectrum
{DKi }i< , {HiK }i< 
(for some ), where, as indicated by the superscripts, the choice of the ith
member of each list depends on K, and for every i < , K refutes DKi . Such a
spectrum is somewhere [respectively everywhere] bizarre just in case for some
[respectively every] i < , the theory HiK would count as a bizarre revision of K
with respect to DKi .
Example of a K-spectrum. Let K contain xx (for some consistent predicate ). For DKi take the sentence there are exactly i s, and let HiK be any
consistent theory containing DKi .
Theorem 14 For every consistent theory K, let {DKi }i< , {HiK }i<  be a
K-spectrum. Then there is an AGM revision-function satisfying all the AGMpostulates for revision, such that:
For every K, for every i < , HiK = K DKi .
This is the case even if one chooses K-spectra that are everywhere bizarre.
Corollary 2 Suppose that K implies that there are at most k s. For every n > k,
let DKn be the claim there are exactly n s. Then for each n > k, one can choose
a different bizarre theory JnK (subject only to the condition that JnK be consistent
with DKn ) and take [JnK , DKn ] as the revision of K with respect to DKn .
AG M-T H E O RY

301

Corollary 3 Suppose that K  xx. For every n > , let DKn be the claim there
are exactly n non-s. Then for each n > , one can choose a different bizarre
theory JnK (subject only to the condition that JnK be consistent with DKn ) and take
[JnK , DKn ] as the revision of K with respect to DKn .
With both these Corollaries, the bizarre extra beliefs JnK could, for example,
differ in saying, among other things, that at any given time there are exactly
n angels dancing on the head of a pin.
Corollary shows that the full set of eight AGM postulates for revision admits
of revision functions * such that for every theory K containing a universal
generalization, and for infinitely many A inconsistent with K, the revision K A
can be as bizarre as one wishes.
Note that Theorem and its two Corollaries do not presuppose, or depend
on, any particular analysis or formal explication of the notions of (minimal)
mutilation or (minimal) bloatingor of bizarreness (qua revision). The dialectical structure of the predicament in which AGM-theory is revealed to stand
is as follows. The asserter of Theorem is in effect saying You, the listener,
may choose whatever you would say is a bizarre series of revisions; then I, the
speaker, will show you a revision function that satisfies all the AGM-postulates,
yet yields all those bizarre revisions. The asserter of Theorem is allowing
his listener to work with any intuitive sense of bizarreness that she wishes. She
gets to specify exactly what would count as a bizarre K-spectrum, by her own
lights. (She might do this intuitively, without recourse to any particular logical
or set-theoretic explication of the notions of minimal bloating and minimal
mutilation.) Once she has a K-spectrum {D Ki }i< , {HiK }i<  for which she
agrees that Hi would be bizarre as a revision of K with respect to Di , Theorem
can immediately be applied so as to produce a revision function * satisfying
all eight AGM postulates, but such that K Di = Hi . Moreover, as Corollary
shows, any theory K containing a universally quantified claim xx affords
one the opportunity to create such spectral mischief. One need only contemplate revisions of K with respect to the infinitely various claims to the effect
that there are, respectively, exactly , , . . . counterexamples to the universal
generalization in question.
In light of the foregoing results it would appear that an undesirable degree
of laxity has been revealed in the full set of AGM postulates for revision functions. This laxity has been revealed by attention to the postulates themselves,
rather than to the mathematical constructions afforded by the representation
theorem.

302

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

11.3 Bayesian Networks

An altogether different kind of formal modeling is offered by Bayesian network
theorists. Pearl [] constructs belief nets of nodes (representing propositions
or events), but connects them directly with arrows, without interpolating (as
we do) inference strokes to show exactly which sets of premises support which
conclusions. His approach is also probabilistic, in that it involves both assigning
nodes numerical values between and (their absolute probabilities), and
indicating (via the appropriate conditional probabilities) the strength of support
(or causal influence) that would be represented by the arrows in his diagrams.
As he puts it on p. ,
Bayesian networks are [directed acyclic graphs] in which the nodes represent variables,
and [arrows] signify the existence of direct causal influences between the linked variables,
and the strengths of these influences are expressed by forward conditional probabilities.

(Bear in mind that what Pearl and other probability theorists like to call variables are the propositions or events represented by the nodes.5 )
Let U be a set of propositions or events, and let P be a probability distribution
on U. Assume that where X, Y and Z are (pairwise) disjoint subsets of U, one can
assign a truth value to the probability-theoretic claim X is (probabilistically)
independent of Y given Z, where this claim of course involves reference to the
distribution P. That results in a so-called dependency model (p. ). We could
call the dependency model M (as Pearl does), and abbreviate the claim just
mentioned as I(X, Y, Z)M . But in the interests of clarity, we shall simply employ
the subscript P to the same effect, and use the abbreviation IP (X, Y, Z).
Now, if the same nodes (the ones forming the set U) were to be connected
in some pattern by arrows, so as to form a directed acyclic graphwhich we
can call Done can inquire whether the pattern of influences encoded by (the
arrows among nodes in) D accords with the given probability distribution P
on the nodesthat is, whether the claimed probabilistic (in)dependencies
IP (X, Y, Z) are respected by the pattern D of arrows. In order to diagnose
whether this is the case, Pearl introduces the following notion of separation of
pairwise disjoint subsets X, Y and Z within D (p. ). We are introducing stylistic changes here, so the following, though fair and accurate, is not a direct quote:
As Pearl has clarified (personal communication), nodes are variables, and each variable is a
partition of worlds, e.g., Variable Temperature is a partition into the events: T= T= etc.

B AY E S I A N N E T WO R K S

303

the set Z of nodes separates the set X of nodes from the set Y of nodesin short,
X|Z|YD just in case there is no path of D between any node in X and any node in Y
along which
(1) every node with converging arrows is in Z or has a descendant in Z; and
(2) every other node is outside Z.

Now suppose that for every pairwise disjoint subsets X, Y and Z of U we have
X|Z|YD IP (X, Y, Z).
Suppose further that if D were to lose any of its arrows, then this implication
would no longer hold (i.e. suppose that D is minimal in this regard). Under these
suppositions, D is said to be a Bayesian network of the probability distribution P
(on the nodes of D).6
The question now arises: given a probability distribution P, how might one
determine a Bayesian network of P? That is, how might one find a directed
acyclic graph (for short: a dag) D, using the nodes on which P is defined, so
as to ensure that
X|Z|YD IP (X, Y, Z),
and also that D is minimal in this regard? The answer is that, relative to any
(linear) ordering < of the nodes, one can define the notion of a boundary dag
for P relative to <. (The details will not detain us here.7 )

See the two definitions that Pearl gives on p. .

Rather, these details may be left to detain the reader of this footnote. Let the nodes be ordered
by <:

X < X < X < . . . < X n .

Let U(i) be {X , . . . , Xn }. So
U() = ;
U() = {X };
U() = {X , X };
U() = {X , X , X };
..
.
U(n) = {X , X , X , . . . , Xn }.
Note that for each i, Xi  U(i) . We now define, for each i, a set Bi of nodes that will be the parents
of Xi in the sought boundary dag for P. For each i, let Bi be an inclusion-minimal set B of U(i) such
that IP (Xi , B, U(i) \ B).

304

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

It can be shown8 that for any probability distribution P, the ternary indifference relation IP (X, Y, Z) satisfies four simple conditions.9 One can then prove
that it follows from the fact that IP (X, Y, Z) satisfies these four conditions that
any boundary dag for P relative to any ordering of the nodes is a Bayesian
network of P. 10
Pearls main theoretical aim is to supply a computationally efficient method
for propagating changes in probability values along the links in a Bayesian
network, so that a new equilibrium will be reached in response to the initial
changes. To this end, he pays attention to the kinds of structure that a network
can exhibit. In broad terms, he is seeking to canalize or confine the effects
of such changes, 11 so that they propagate in as linear a fashion as possible,
and by means of algorithmic calculations that are as local as possible. (The
reader will recall in this connection our earlier discussion of greedy algorithms
in Section ..) The aim is to cope with feedback loops, and ensure that at
equilibrium, the correct probabilities will be assigned to every node. 12
This brief exposition will have to suffice, for we are concerned here only to
make a few important points of contrast. It is clear that, as Pearl conceives his
project, the nodes can represent events that can be part of a causal network. But,
as he has clarified further (personal communication),
(Clearly, B = . So the node X will have no parents in the sought boundary dag.) At each ith
stage, we are creating Bi by selecting as few nodes as possible from among X , . . . , Xi , thereby
leaving as many nodes as possible in the residue
Bi = {X , . . . , Xi } \ Bi ,
in such a way as to satisfy the independence condition
IP (Xi , Bi , Bi ).
We repeat that the sought boundary dag is obtained by making the nodes in Bi the parents of the
node Xi .
See Pearls Theorem , p. .
The conditions in question are as follows (ibid., at p. ):
1.
2.
3.
4.

Symmetry: IP (X, Z, Y) IP (Y, Z, X);

Decomposition: IP (X, Z, Y W) IP (X, Z, Y) IP (X, Z, W);
Weak Union: IP (X, Z, Y W) IP (X, Z W, Y);
Contraction: IP (X, Z, Y) IP (X, Z Y, W) IP (X, Z, Y W).

This is in effect Theorem on p. . Pearl credits it to Verma [].

See, for example, the notion of a causal polytree defined on p. , in which no more than
one path may lead from any one node to any other. When this condition is not satisfied, as Pearl
concedes on p. , local propagation schemes will invariably run into trouble.
The author is indebted to Pearl for clarifying this. (Personal communication.)

B AY E S I A N N E T WO R K S

305

There is no restriction that the links represent causal relations (although this has many
advantages). Belief propagation will work as well on non-causal networks, be it probabilistic
or logical, as long as the graph is compatible with the underlying probability function.

So the arrows in Pearls belief nets could represent the lending of justificatory
support, whether singly or in larger sets. And presumably this could be so
even in the extreme case where the only probability values in use are and
(corresponding to a completely deterministic picture, in the causal case). So his
belief nets could conceivably deal with, say, mathematical beliefs as a special
case. Despite the fact that their original exposition seemed to be concerned
with only the causal caseinvolving simple contingent propositions about the
external world, all of them caught up in a causal webwe have to take seriously
that Pearls belief nets have as wide an intended range of application as do our
dependency networks.
But then, from our own formal modeling perspective, special interest
attaches to the aforementioned lack of any use of inference strokes to mediate
the connections among nodes. Because Pearl does not employ any such device,
it might appear there is no way of telling whether the arrow-fork
a

represents a and b conjointly (i.e. together) causing c, or represents the conjunction of as causing c along with bs (independently) causing c. As Pearl has
made clear, however (personal communication), In belief nets, the distinction
you are making in the two graphs [see belowNT] is encoded in the probability
tables, not in the graphs.
This raises two questions worthy of further investigation:
(i) Is there an algorithmic way to read off , from the probability tables, the appropriate placement of inference strokes and arrows for the theorist of dependency
networks?
(ii) Might the placement of inference strokes and arrows by the theorist of dependency networks be a fruitful additional device for the theorist of belief nets?

In any future extension of the present work to the probabilistic case where intermediate probability values are countenanced (rather than just the two extreme
306

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

values of and ), we would be concerned to investigate what theoretical benefits might flow from using this apparently innocent device (i.e. the inference
stroke) to make the necessary (and very useful) distinction:
a

versus
c

that otherwise has to be read off from the probability tables.

It is important to appreciate that a node in a Bayesian network does not
represent a determinate proposition, in the way that a node in a dependency
network does. Rather, a node in a Bayesian network that is labeled with the
propositional letter p has associated with it (but provided with their own nodes!)
the two mutually exclusive possibilities p and p. (Note the move from italics to
roman here.) In such a case, the node p is called a binary propositional variable,
and it is said to take the two values p and p. In other casessuch as Pearls
example of temperaturea node (i.e. variable) Temp might have more than
two values, say Temp ,,Tempn , where the latter might be pairwise contiguous
temperature ranges. Another example might be a node TestResult, with values
Positive, Neutral, Negative.
It is these non-italicized values that would be represented by nodes in our
dependency diagrams. In order to get the interconnections right, we would
furnish steps with conclusion in order to indicate that any pair of values
are contraries. We would not have just one node labeled p taking the values p
and p. Rather, we would have two distinct nodes, one labeled p and the other
labeled p, with each of them sending an arrow to an inference stroke that in
turn sends an arrow to (the white(!) node labeled) .
Where the Bayesian Network theorist has a parent node labeled a and a child
node labeled b, and attached probability tables:
a

Prob(a)=p1

Prob(b|a)=q1
Prob(b|a)=q2

B AY E S I A N N E T WO R K S

307

the dependency network theorist would separate out the values a and a, and
supply them with their own nodes. The conditional probability values could
then be transferred to the inference strokes in order to register the respective
strengths of support:
b
q1
a
p1

q2
a
1p1

No doubt the current practice in Bayesian network theory of collapsing

the mutually exclusive, or pairwise contrary, proposition values into a single
node brings the benefit of being able more easily to trace dependencies and
independencies by means of graph-theoretic conditions. But this practice could
still be recovered, on our approach, by availing oneself of the homomorphisms
that effect such collapses. We cannot go any further into this suggested rapprochement between Bayesian network theory and our theory of dependency
networks. Suffice it to say that the present author suspects that the introduction
of inference strokes into Bayesian networks, and the teasing apart of all the
distinct propositional values as nodes in their own right could well prove very
fruitful. But that is a topic for treatment elsewhere.
So too is the following question:
(iii) In those cases where only the probabilities 0 and 1 are used, and the belief
net is compatible with the underlying probability function (call the belief net
in such a case a determinate Bayesian network), does a change of value from
1 to 0 for any particular node in the determinate Bayesian network induce
a terminating propagation of changes in probability assignments to nodes
therein, that, in effect, produces the same contractions as would be produced
by our contraction algorithm for the corresponding dependency network of
the present account?

308

D I F F E R E N C E S F R O M OT H E R F O R M A L T H E O R I E S

C H A P T E R 12

Connections with Various

Epistemological Accounts

12.1 Stage setting

n epistemology, or the theory of knowledge, philosophers have, with few

exceptions to date, been concerned mainly with topics and problems inviting discursive treatment, rather than with those amenable to mathematical
modeling or computational treatment. The purpose of this chapter is to look
for connections between the more formal treatment presented here and wellknown work in contemporary epistemology.
We can divide the latter work, for the purposes of this discussion, into three
groups:
1. works that address the problem of belief revision, and offer some formal
modeling;
2. works that address the problem of belief revision, but do not offer any formal
modeling; and
3. works that do not explicitly address the problem of belief revision, except
perhaps in passing.

Our interest in the works thus classified is accordingly motivated by the following questions, respectively.

S TAG E S E T T I N G

309

1. (a) Do these works lay out the general features of belief revision in a way that
is at least broadly in accord with the theory advanced here?
(b) Do they set about the task of formal modeling in ways that are at odds
with our own chosen methods, or in ways that could be emulated by (some
plausible extension of) them?
2. (a) as above.
(b) Could the formal modeling that we offer be plugged into those works, so
as to fill understandable, but theoretically hospitable, lacunae?
3. Do these works paint an informal picture of the structure of our beliefs, and
possibly also of their revision, that offers at least some prospect of being
captured by our framework?

We shall in due course examine various epistemological works according to the

classification just provided, in order to provide a thorough comparison of the
present work with work by others. With a few exceptions of important articles,
we confine our brief study to well-known monographs by leading authors. As
with our discussion in Chapter of other formal approaches to belief revision,
so too with this chapters discussion of epistemological views: there is no way
that we can cover them all, thoroughly, in the space available. We choose only to
highlight certain themes as they arise in selected works, in order to make points
of contact with our account of belief revision. The inevitable result is that many
fine pieces of epistemological work escape scrutiny. The author nevertheless
hopes that, with any of these unexamined epistemological views as with any
of the formal approaches left unexamined in Chapter , the reader will be able
to extrapolate from the cases handled here, and work out what we would be
inclined to say about those views by way of criticism or agreement.
The next section is devoted to a brief look at some of the main debates within
epistemology, and an explanation of how they bear on the formal account of
belief revision on offer here.

12.2 Perennial topics of mainstream

epistemology
12.2.1 Skepticism
Evil demons or brains in vats?we dont go there. Nor, apparently, are we
alone in this regard. According to Hendricks [], formal epistemologies are
310

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

marked, one and all, by the distinguishing feature that they build in some sort
of assumption to the effect that radical skepticism does not hold.
On the other hand, there is nothing to stop us from using our formal modeling of belief systems to represent the beliefs of a philosopher grappling with the
problem of radical skepticism and eventually deciding to resolve the problem one
way or another. Happily, the construction of suitably accommodating before
and after dependency networks can be left to the reader who insists that we
ought to be able to model the processes of belief change on the part of an
agent in the grips of this, the deepest of all skeptical problems. In exactly the
same way, one supposes, formal logic can be put at the disposal of someone
wishing to construct her horoscope or read the future in her tea leaves. Good
luck constructing all the steps that have (either as a premise or as the conclusion)
the node for I am a brain in a vat! It might bring some clarity to the debate about
the issues.

12.2.2 Basic beliefs

Epistemologists argue constantly about the sources of our basic beliefs: do they
have their provenance in perception, or in introspection, or memory, or (pure)
intuition, or reason?or in all of the above? Our formal system building is compatible with any view about the sources of our basic beliefs. This is analogous
to a devotee of propositional logic not taking a stand on the issue of whether
the truth bearers are sentences, statements or propositions. No matter how we
answer the question What are the truth bearers?, the answer is not likely to
undermine the structure of the deductive framework that the propositional
logician sets out to construct. Traversing the analogy back to belief revision: no
matter how we answer the question What is the ultimate legitimating source for
our basic beliefs?, the answer will easily be accommodated within the structure
of dependency networks themselves, which will be able to account for the way
they behave under contraction and revision.
The same holds with regard to the various answers on offer to the question
What exactly are basic beliefs?. Whether basic beliefs have to be restricted to
beliefs about ones mental states (such as its seeming to one that p), or whether
they can concern perceived externalities, they will be handled in the same way
within our formal framework. Answering those questions will not change the
status of so-called basic beliefs as simply the initial nodes of our dependency
networks. Structurally, that is their rolethe whole of their role, and nothing
but their role.
P E R E N N I A L TO P I C S O F M A I N S T R E A M E P I S T E M O L O G Y

311

And the same holds once more with regard to the various answers on offer
to the question To what does a basic belief owe its justification?. Its being basic
consists at least in this: a basic justified belief does not owe its justification to
any other beliefs; and a basic justified belief is one whose justification does not
depend on any justification the agent has for holding any other belief. Both these
features of basicality are nicely accommodated by the role allotted to initial
nodes within our dependency networks.

12.2.3 Foundationalism, coherentism and foundherentism

F O U N DAT I O N A L I S M

The much-cited paper Sosa [] is famous for its contrasting metaphors for
coherentism and foundationalism. Here we concentrate on what Sosa says about
foundationalism. The definition that Sosa provides on p. is as follows.
With respect to a body of knowledge K (in someones possession), foundationalism implies
that K can be divided into parts K1 , K2 ,, such that there is some nonsymmetric relation
R (analogous to the relation of physical support) which orders those parts in such a way
that there is onecall it Fthat bears R to every other part while none of them bears
R in turn to F.
According to foundationalism, each piece of knowledge lies on a pyramid such as the
following:

P
P1
P11

P2
P12

P21

P22

The nodes of such a pyramid (for a proposition P relative to a subject S and a time t)
must obey the following requirements:
a. The set of all nodes that succeed (directly) any given node must serve jointly as
a base that properly supports that node (for S at t).
b. Each node must be a proposition that S is justified in believing at t.
c. If a node is not self-evident (for S at t), it must have successors (that serve jointly
as a base that properly supports that node).
d. Each branch of an epistemic pyramid must terminate.

In order to secure the right picture, Sosa needed to say that the relation R is nonsymmetric and transitivefor otherwise it would be easy to construct systems
312

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

according with his definition of foundationalism, in which there were unwanted

dependency loops. He is clearly relying on the branching pyramidal diagram
that he provided to be sufficiently suggestive of his structural intentions: as
one descends to ever lower tiers of the pyramid, one will not encounter nodes
that have already appeared at higher levels.
Fortunately for our present purposes, we do not need to enter into any
debates with epistemologists over the best way to define the contrast between
foundationalism and coherentism. This is because ours is a catholic approach
(with a small c), intended to afford a method of belief revision that will serve
both foundationalists and coherentists equally well. The challenge has been to
define dependency networks in a sufficiently liberal way to accommodate both
foundationalism and coherentism, and indeed any position (such as foundherentismsee below) that combines elements of both.
COHERENTISM

That being said, one must complain that coherentism, as an epistemological

doctrine, presents a problem for one who wishes to provide a formal modeling
of the structure of belief schemes. The problem is that it is difficult to find a clear
articulation of exactly what the distinctive structural features of coherentism
happen to be.1
One can see this already in the brief characterization of coherentism in Sosa
[], which spells out an orthodox understanding of the doctrine as follows.
The first quote is from p. , and the second is from p. :
By coherentism we shall mean any view according to which the ultimate sources of
justification for any belief lie in relations among that belief and other beliefs of the
subject: explanatory relations, perhaps, or relations of probability or logic. [Emphases
addedNT.]
For the coherentist a body of knowledge is a free-floating raft every plank of which helps
directly or indirectly to keep all the others in place, and no plank of which would retain
its status with no help from the others.

For the mathematician or computer scientist these definitions are at best suggestive. The more formally minded theorist would want, ideally, a definition of
coherentism that would make it clear just what sorts of patterns of justification
(involving premises and conclusions of justificatory steps) are allowed, and
which are disallowed, by the coherentist.

Olsson [], at pp. , is in emphatic agreement on this score.

P E R E N N I A L TO P I C S O F M A I N S T R E A M E P I S T E M O L O G Y

313

The problem of an inadequate or completely missing formal characterization

of coherentism is one that afflicts not only works of journal-article length.
Laurence BonJours influential book The Structure of Empirical Knowledge (BonJour []) aimed to defend a coherentist theory of epistemic justification. At
p. BonJour writes
For the sort of coherence theory which will be developed hereand indeed, I would
argue, for any comprehensive, nonskeptical epistemologyit is the issue of justification as
it arises at the global level which is in the final analysis decisive for the determination
of empirical justification in general.

This appears promising: an epistemologist apparently undertaking to give a precise account of those global patterns within the field of the justificatory relation
that are characteristic of coherentism. It is a heavy obligation to discharge; for
(p. )
the justification of a particular empirical belief finally depends, not on other particular
beliefs as the linear concept of justification would have it, but instead on the overall system
and its coherence.

The appearance of promise, however, turns out to be just that: an appearance.

On p. one reads
A fully adequate explication of coherence is unfortunately not possible within the scope of
this book (nor, one may well suspect, within the scope of any work of manageable length).

So: the reader is left with the impression that a defence is to be mounted of a view
that, it would appear, need not be characterized at all precisely. But BonJour does
provide some hints (pp. ):
Intuitively, coherence is a matter of how well a body of beliefs hangs together: how well
its component beliefs fit together, agree or dovetail with each other, so as to produce an
organized, tightly structured system of beliefs, rather than either a helter-skelter collection
or a set of conflicting subsystems. It is reasonably clear that this hanging together depends
on the various sorts of inferential, evidential, and explanatory relations which obtain among
the various beliefs, and especially on the more holistic and systematic of these. Thus
various detailed investigations by philosophers and logicians of such topics as explanation,
confirmation, probability, and so on, may be reasonably taken to provide some of the
ingredients for a general account of coherence. But the main work of giving such an
account, and in particular one which will provide some relatively clear basis for comparative
assessments of coherence, has scarcely begun, despite the long history of the concept.
My response to this problem, for the moment at least, is a deliberatethough, I think,
justifiedevasion. It consists in pointing out that the task of giving an adequate explication
of the concept of coherence is not uniquely or even primarily the job of coherence
theories. This is so because coherenceor something resembling it so closely as to be

314

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

subject to the same sort of problemis, and seemingly must be, a basic ingredient of
virtually all rival epistemological theories as well.

The rest of BonJours discussion in this section (Section .), titled The concept
of coherence, dwells on matters such as logical and probabilistic consistency,
and explanatory unification, without providing any of the sorts of structural
insights that the formal theorist would be seeking.
Nor has the passage of time, for the coherentists, brought greater clarity
at a formal level. The following quote from an authoritative survey article by
Kvanvig [] is also typical, and illustrates the same problem (of structural
unclarity) just as well:
Sometimes coherentism is described as the view that allows that justification can proceed
in a circle (as long as the circle is large enough), and that is one logically possible version
of the view (though it is very hard to find a defender of this version of coherentism). The
version of coherentism that is more popular, however, objects in a more fundamental way
to the regress argument. This version of coherentism denies that justification is linear in the
way presupposed by the regress argument. Instead, such versions of coherentism maintain
that justification is holistic in character, and the standard metaphors for coherentism are
intended to convey this aspect of the view. Neuraths boat metaphoraccording to which
our ship of beliefs is at sea, requiring the ongoing replacement of whatever parts are
defective in order to remain seaworthyand Quines web of belief metaphoraccording
to which our beliefs form an interconnected web in which the structure hangs or falls as
a wholeboth convey the idea that justification is a feature of a system of beliefs.

From the point of view of the formal modeler, learning that according to coherentism justification is a feature of a system of beliefs is not terribly helpful.
It hardly speaks to the question of what sort of structure of justification the
coherentist allows.
Kvanvig envisages a form of coherentism in which one can have recourse to
experiences (without propositional content) as playing some role in the overall
justification of an agents beliefs. It is important for the coherentist only to
(i) reckon any and all experience as insufficient for full justification of the whole
(so as to avoid collapsing into a form of foundationalism); and (ii) recognize
the important complementary role played, for any given belief, by its evidential
and logical relations to other beliefs in the system.
In our formal modeling, modest as it is, we seek to accommodate virtually
any constraining (or generating) of structural possibilities by a suitably rigorous
characterization of coherentism, should one ever be forthcoming from either its
advocates or its critics. We expressly allow for there to be nodes within a dependency network that are both initial or self-warrantingthat is, representing
P E R E N N I A L TO P I C S O F M A I N S T R E A M E P I S T E M O L O G Y

315

beliefs that are believed outrightand justified by appeal to yet other beliefs
functioning as premises in transitional steps with those beliefs as conclusions.
This allows one to accommodate both (i) and (ii) above, in whatever proportions they might find themselves in the right coherentist admixture. Although
Grdenfors [] has argued that AGM-theory is a belief-revision theory suitable for a coherentist epistemology, this claim has been disputed by Hansson
and Olsson []. Fortunately we do not need to take a stand on this issue.
We could instead invite the two sides to that debate to avail themselves of the
formalism of dependency networks in order to capture the essential features
either of foundationalism or of coherentism, howsoever they (especially the
latter) might end up being articulated.
FOUNDHERENTISM

Susan Haacks Evidence and Inquiry (Haack []) advances an interesting and
detailed case for foundherentism, a hybrid view that combines the virtues of
both foundationalism and coherentism. The main ingredients might have been
anticipated by Cornman [].2 But credit goes to Haack for the first booklength exposition of the view. Quite apart from certain drawbacks in Cornmans
account (see below), Haacks more incisive analyses and livelier style invite
scrutiny of the foundherentists position as she has laid it out.
For Haack, as for many other epistemologists (including Cornman and Sosa),
justification of a belief by evidence is relative to a person and a time, and comes
in degrees. (This mention of Sosa in this context is not to be understood as
implying that Sosa himself is a foundherentist.) The formally minded theorist,
however, will be disappointed by Cornmans definition, on p. , of the crucial
notion of an evidential series for a proposition p. For Cornman, this is a
series [E] of evidence sets, e1 , e2 , e3 , . . . , such that for each ei in E and e0 = p, each
sentence in ei1 is justified relative to ei . . . .

With this definition, Cornman erases, or loses sight of, the crucial branching structure of justification, which would be the basic ingredient in terms
of which to account, in a more subtle and insightful way, for the differences
between foundationalism and coherentism at the global level. If, for example, the justification of p had the following structure (in our diagramming
notation):

See especially Chapter : A Foundational Theory with Explanatory Coherence.

316

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

then for Cornman the evidential series e , e , e , e  (where e = p) would be

the cruder set-theoretic object
p, {f , g, h}, {a, b, c, d, e, g}, {a, b, c, d, e, g},
from which (as inspection will reveal) it is impossible to extract all the epistemologically crucial internal structure of the dependency network just displayed.
(Given Cornmans evidential series, can one, for example, say which premises
jointly suffice for f ? or for g? or for h? The answers are negative.)
On Haacks diagnosis of the impasse between the two major structural
views, each gets something right and each gets something wrong. Foundationalism is right to allow that experience contributes to justification of belief. But it
is wrong to insist on the unidirectionality of justification. Coherentism is right
to allow the structure of justification to be other than unidirectional. But it is
wrong to insist that experience (since it is non-propositional) cannot contribute
to justification of belief.
Foundherentism combines the two features that are right: experience can
contribute to justification of belief; and the structure of justification can be other
than unidirectional. As Haack adumbrates the view (p. ),
A subjects experience is relevant to the justification of his empirical beliefs, but there need
be no privileged class of empirical beliefs justified exclusively by the support of experience,
independently of the support of other beliefs;
Justification is not exclusively one-directional, but involves pervasive relations of mutual
support.

Haack provides one illustrative diagram (Figure . on p. ) of a case where

justificatory support is not unidirectional. It is not made clear, however, whether
a fragment therein such as
P E R E N N I A L TO P I C S O F M A I N S T R E A M E P I S T E M O L O G Y

317

is intended to represent three distinct single-premise steps to p from q, r and s,

respectively; or whether it represents a single three-premise step from q, r and
s, to p. Here we shall assume that it is the latter; not much hangs on this choice
for the point we are about to make. With our diagramming conventions, and
on this interpretative assumption, Haacks illustration is as follows:
p

t
..
.

v
..
.

w
..
.

x
..
.

y
..
.

..
.

..
.

Note how z is in the justificatory ancestry of p, while p in turn supports z.

Although Haack does not offer any account of belief revision, we can take her
foundherentist structures in our stride. It is safe to assume that our account of
belief dynamics could simply be adjoined to her account of the statics of foundherentism, without contradicting any aspect of it. (Haack does, to be surelike
Cornmanregard justificatory support as a matter of degree, whereas we are
modeling it as an all-or-nothing affair; but that is no obstacle to our coping
with the justificatory patterns within a foundherentist structure.)
Once again, we stress that our account is a catholic one. It is invariant across
differing doctrines concerning the permissible overall patterns of justificatory
support. The key insight has been to focus on the justificatory step as the data
type that drives all our thinking about how to contract and revise a belief
scheme. The one small step of the logician can be a very large step for epistemologists of all kinds: for it gives the epistemologist the most basic formal
ingredient in terms of which differences at the global, or macro-level, can be
characterized. Of our (finitely many) steps within a dependency network it is
318

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

required only that each premise either be self-justifying, or be the conclusion, in

turn, of some other step; and that premise sets of steps with the same conclusion
be pairwise non-inclusively distinct (that is, distinct from each other, without
either one of them including the other). That formal characterization is sufficient to subsume any foundationalist, coherentist, or foundherentist account.
Indeed, the formalization of their respective differentiae can be left to the aficionados of each position; for these differentiae find easy formal expression in
terms of the structural concepts that we have supplied.

12.3 Works that address the problem of belief

revision, and offer some formal modeling

12.3.1 Isaac Levis contractions
Isaac Levi is the philosopher in the area of belief revision who most directly
stands heir to the American tradition of pragmatism in epistemology and metaphysics. He incurs, then, a pragmatist standard of assessment for the theory he
offers. By this standard one may inquire after the usefulness, fruitfulness, and
simplicity of the theoretical posits that one employs in giving an account of the
basic phenomena. In this area, the basic phenomena consist largely of rational
intuitions that need to be systematized, and, if possible, developed into a canon.
Ideally, such a canon would be both empirically grounded and normatively
guiding. But for usmore so than for Leviit would also, ideally, admit of
computational implementation.
Levi [] puts forward an account of contraction that, as can be seen
from his discussion on pp. , is only a minor variant of that offered by
AGM-theory. Levis official term potential corpus Ksee pp. simply
means a theory in the language (what the AGM-theorists would call a belief set).
Wherever Levi writes K for a theory or A for a sentence, we shall henceforth
write K or A, respectively, even in quotations.
On p. Levi defines a saturatable contraction of K by removing A to be one
that, upon expansion by the negation of A, is maximally consistent. There is no
hint as to how to compute the spectrum (or indeed any one) of the saturatable
contractions. On p. Levi tells his reader that every contraction of a belief
set K by removing A is the meet (i.e. intersection) of certain saturatable subsets
of K not containing A.
THE PROBLEM OF BELIEF REVISION

319

Although Levi emphasizes a distinction between coerced and uncoerced contractions (p. ), it does not affect the mathematical constructs or methods
involved in the contraction process. So Levis account inherits the drawbacks of
the AGM account. The theories (or belief sets) that he deals with are infinitistic.
There is no guarantee that one can manipulate them computationally. This, of
course, is not meant to imply that Levi himself had entertained any aspirations
at all to be able to handle his models computationally. His interest lay rather
in how best one might formally model the full belief commitments of a rational
agent.
Now, to be sure, this is not by itself a telling criticism of Levis project, for
Levi, unlike the AGMers, has not claimed on behalf of his theory that it would
be of interest and use in the fields of computing science or AI. In raising the
issue of constructivity or computability we are merely seeking to emphasize
an important difference between Levis approach and ours. One would have to
judge on more global, pragmatist criteria whether a theory such as ours, which
seeks to keep everything computational, is to be preferred to a theory such as
Levis, which does not. In assessing this matter, it would be important to check
whether there is any intuitive example raised by Levi that cannot be handled
straightforwardly in the framework of finite dependency networks. If there are
no such examples, then there is a prima facie reason to prefer the more modest
theory over one that postulates infinitistic objects and invokes structures such
as probabilistic distributions over them.
The main innovation that Levi introducesa measure of so-called damped
informational valueis not of a constructive or computable character either.
Thus, when Levi finally offers his considered choice of contraction (p. ):
K
A (the admissible contraction of K by removing A) is the meet of all saturatable
contractions of K removing A that minimize loss of informational value among saturatable
contractions as determined by the given M function

the computationalist finds no succour in such slight variation of basically AGMstyle thinking, in which belief sets are treated as logically closed.
The M function is defined (p. ) as a probability distribution over belief
sets K (which, remember, are logically closed); and from M one defines a
measure of informational value in some inverse fashion. Three possibilities that
Levi mentions are M(K), /M(K) and log[M(K)], and he expresses a
preference for the first. But there is no hint there, either, of how to compute
these informational values from their arguments K (which cannot, in general,
be presented finitistically anyway).
320

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

In presenting this account of contraction, Levi is also making an important

assumption about how the alleged measure of damped informational value can
be relied on to behave. The assumption is the following:
any contraction that is the intersection of finitely many saturatable contractions (of a belief
set with respect to a given sentence) incurs a loss of (damped) informational value equal
to the greatest such loss incurred by any of the finitely many contractions in question.

Levi is not, however, detained by the question whether one is entitled to assume
the existence of such an underlying probability measure M as would vouchsafe
the satisfaction of this assumption. For all we know, the assumption just cited
could be inconsistent with the Kolmogorov axioms for probability. At the very
least, one would need some assurance to the contrary.
The prima facie problem is that informational value is said by Levi to be an
inverse function of probability, and the three mooted examples of such inverse
functions are all monotonic. Hence equality of losses of informational value
implies equality of the respective probabilities from which the informational
values are supposedly derived. This means (in light of the last quote above)
that the probability of an intersection of finitely many (saturatable) contractions
must be equal to the lowest probability of those finitely many contractions.
There is no guarantee that any of those finitely many contractions will be identical to their intersection. Hence any proposition in any contraction of lowest
probability among the contractions being intersected that does not lie in the
intersection in question must be assigned the informational value , hence
the probability value . The worry is not only that this cannot in general be
guaranteed, but that it would appear to be rather irrational to be giving up
(potentially very many) beliefs with prior probabilities of .
In Levi [], pp. , Levi modifies the foregoing assumption, but his
modification attracts the same misgiving by way of criticism. The assumption
now reads
any contraction that is the intersection of finitely many maxichoice contractions (of a belief
set with respect to a given sentence) incurs a loss of (damped) informational value equal
to the greatest such loss incurred by any of the finitely many contractions in question.

To repeat: even if one concedes the consistency of Levis assumption about

the properties of available measures of (damped) informational value, nothing in his high-level theoretical account offers the prospect of computational
implementation. Even though he rejects the AGM Postulate of Recoverywith
several well-chosen exampleshis methods carry heavy vestiges of AGM-style
thinking. It is worth pointing out that all the examples he adduces, including
THE PROBLEM OF BELIEF REVISION

321

the one about tainted hummus, discussed in Section .., receive intuitively
correct treatment with our method of dependency networks, and our contraction algorithm. So the continued resort to infinitistic theories, replete with conjectured probability- and associated informational-value measures, strikes the
present author as an unnecessary formal complication for the computationalist.

12.4 Works that address the problem of belief

revision, but do not offer any formal

modeling
12.4.1 Quine and Ullians Web of Belief
We have had occasions earlier in this work to cite Quine and Ullian [] in
places, tending to find agreement, where appropriate, with particular aspects of
their view: the idea that one can appeal to a relation of relative entrenchment
among beliefs that might need to be surrendered; the idea that beliefs deprived
of all support should be given up; and (see our ensuing discussion of Harman)
the idea that we can and should, as rational agents, keep track of the sources
and the derivational pedigrees of our beliefs.
Their work is also salutary in stressing the importance of observation sentences in an epistemological theory that deals with science. Yet they do not offer
a simple foundationalist account of scientific knowledge (or of justified beliefs
expressed in the language of science). There are clear indications of a coherentist
tendency: Your immediate concern must be with the comprehensiveness and
coherence of your belief body (pp. ; emphasis added); and Implication is
what makes our system of beliefs cohere. (p. ). Moreover, they claim (p. )
that mathematics is like physics in that
the truths of mathematics can be deduced not from self-evident axioms but only from
hypotheses which, like those of natural science, are to be judged by the plausibility of their
consequences. [Emphasis addedNT.]

This runs against the foundationalist grain, and is a distinctive mark of a coherentist view.
What distinguishes their discussion is their treatment of the five virtues
of scientific hypotheses: conservatism; modesty; simplicity; generality; and
refutability. Their analysis both of examples and of the general nature of these
virtues reveals both the role of logic in belief statics and some methodological
322

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

principles of belief dynamics. Two tenets from the latter are reiterated in various
places:
(i) when a set of beliefs is found to be inconsistent, there is a plurality of choices
of particular beliefs to surrender or reject; and
(ii) every belief can be made vulnerable to surrender or rejection, provided only
that one is prepared to make suitable adjustments elsewhere within ones belief
scheme.

Tenet (i) is what underlies the non-deterministic character of our algorithm for
contraction.
In our language, tenet (ii) would read: it is always possible to find a contraction of ones belief scheme, no matter which node within it is initially whitened.
We have seen also in Section .. how Quine and Ullians detailed example
of revision of beliefs about the identity of the murderer can be handled by our
account, using finitary dependency networks.
All in all, The Web of Belief sets out an epistemological account that is completely amenable to modeling by our formal methods, without violating any of
Quine and Ullians fundamental precepts.

12.4.2 Gilbert Harmans Change in View

After The Web of Belief, Gilbert Harmans Change in View (Harman []) is
perhaps the best known essay that examines a broad range of issues in connection with the topic of belief change. Here we shall not be concerned with
one of its more arresting theses, to the effect (p. ) that there is no clearly
significant way in which logic is specially relevant to reasoning. [emphasis in
original]. Rather, we shall look only at some of the issues that Harman raises
that are specifically relevant to our treatment of belief change. A more general
themeconcerning the relationship between the descriptive and the normative,
on which Harman has a distinctive viewwill also intrude on the discussion in
places. (By no means, however, can this brief discussion here do these themes,
or Harmans view on them, the justice they deserve.)
Harman states a principle of Clutter Avoidance (p. ): One should not
clutter ones mind with trivialities. This principle mitigates the demands of the
Logical Closure Principle, which is that ones beliefs should be closed under
logical implication. (If they were logically closed, then they would involve, for
example, a lot of disjunctive clutter.) From our finitary standpoint, the former
principle is a welcome one. It ensures that we represent by nodes in a depenTHE PROBLEM OF BELIEF REVISION

323

dency network only those beliefs that are focused and informative, and not
diluted by, say, unnecessary steps of disjunction introduction. But what Harman
gives with the right hand he takes away with the left. He claims that one can
and does believe infinitely many things, and gives as examples (for values of
n greater than ) sentences of the form the earth does not have n suns. So, in
order to accommodate this point, he restricts the Principle of Clutter Avoidance
to apply to what one believes explicitly.
This brings in its wake three distinctions among beliefs (which it is our task to
represent as nodes in the agents dependency network): explicit v. implicit; conscious v. unconscious; and occurrent v. dispositional. From our point of view,
the only interest in drawing these distinctions is to be aware of the difficulties
one might face in teasing out (on behalf of a rational agent) exactly what the
dependency network for her beliefs really is. Once we have the dependency
network in hand, these distinctions have no further normative bearing on the
ways in which she ought to change her mind when the occasion arises. Appeal
to these distinctions might be useful in order to explain shortfalls in an actual
(unidealized) agents performance when she tries, unsuccessfully, to make effective changes; but the distinctions do not bear on matters of competence (on the
part of an idealized agent) as opposed to performance, once the dependency
network has been identified.
Perhaps the single most important claim of Harmans that is inimical to the
project presented here is to be found on p. , where he writes that
although in revising ones view it would be useful to have a record of ones reasons for
various beliefs, this would involve too much record keeping.

In the alleged absence of adequate records of ones reasons for various beliefs,
he suggests that
one must make do with a principle of positive undermining, which takes any current belief
to be justified as long as there is no special reason to give it up.

If one really did keep no mental records at all of the reasons for ones beliefs,
then the dependency-network account on offer here would be over-ambitious
at best, and farcical at worst. There would just be a collection of nodes, with
no connections among them: no inference strokes, and no arrows (as in our
diagrams of them). This, however, is an unrealistic picture of the familiar phenomenon. Faced with strong evidence against ones former belief that p, most
rational agents can think of all sorts of justificatory connections, both to and
from p, that had moved them in their earlier thinking that led them to p.
324

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

(This is a methodological assumption held by many epistemologists. For a good

example of the assumption at work, see the opening discussion in Audi [].)
Moreover, the tracing of such connections iterates. So one has to follow through
when contracting with respect to p. Prompted by the need for such contraction,
one may have to jog ones memory, and bring to consciousness other beliefs,
and connections they bear to p, that may have dimmed with time into ones
unconsciousness. But they can easily be enlivened in response to an urgent call
for change.
Harman, however (personal communication), disagrees with the view that
rational agents can think of the connections that had moved them in their
earlier thinking that led them to p. The present author might perhaps be relying
too much here on introspective evidence; Harman may indeed be right that
there is evidence against the view. All the more reason, then, to draw a sharp
distinction between the competence of an idealized rational agent and the usual
performance of an actual agent.
While it might be too much to hope that reasonably thoughtful people should
be able to recall every single justificatory link that has played a role in the past in
acquiring for them their current corpus of beliefs, nevertheless it is too extreme
a position to represent them as devoid of all such linksas having only nodes,
as it were, rattling around freely in their belief boxes. Rather, a more middling
or moderate picture is called for: one according to which the important lines
of dependency are there, so to speak, available to be re-traced. As Quine and
Ullian put it,3
It can be useful to form the habit of filing in ones memory, as it were, the sources of
ones information. For it can happen that sources once trusted will lose their authority
for us, and one would then like to know which beliefs might merit reassessment. We may
come to mistrust a source on moral grounds, having found signs of private interests and
corruption, and we may also come to mistrust a source on methodological grounds, having
found signs of hasty thinking and poor access to data.

These considerations come from their chapter on testimony, and presumably

concern belief-nodes that are being treated as initial, owing to complete trust
in the asseverations of ones sources. It is by no means a stretch of theoretical
imagination to contemplate (possibly unconscious) mnemonics also for the
pedigrees of support supplied by ones own past ratiocinations. One would expect
such ability on the part of a highly evolved rational agent.

See Quine and Ullian [], at p. .

THE PROBLEM OF BELIEF REVISION

325

The lines of dependency of derived beliefs on the more immediate are certainly needed by a paragon, or rational agent. The question concerns only the
extent to which it would be the paragons richer dependency network, or the
rattling belief box, that provided the more accurate model of what goes on in
the mind of a reasonably thoughtful person. The contention here is that it is the
dependency network. It is an empirical question, to be sure.
We contend further that the likeliest empirical answerat least concerning
really reflective and thoughtful people, who are well trained in the weighing
of evidence and the drawing of inferencesis likely to be encouraging to the
dependency-network theorist. The answerconcerning the justificatory pedigrees of the beliefs held by the best experts among usis likely to be one that is
easily generalized and strengthened so as to make the dependency network of
the paragon the most reasonable ideal to which we should aspire if we wish to
be truly rational, and accountable by our own standards, when we contract and
expand our belief systems. Similar qualifications have to be entered on behalf of,
say, the rules of natural deduction and the structure of proofs in mathematics.
Not only are most ordinary thinkers unacquainted with formal deductive rules
of inference; they commit many fallacies of deductive reasoning, and they even
fail at times to appreciate that certain formally correct steps of inference are
indeed correct. But the best-trained experts among uslogicians and mathematicians, for examplereason deductively (and respond to proofs) in a way
that makes the best description of their performance invoke rules drawn from
the normative canon.
A related claim of Harmans with which we take issue is the following:
We could not in practice make use of a principle of negative undermining, which has one
abandon any belief for which one does not have a current justification. Following that
principle would lead one to abandon almost everything one believes.

Again, it is the bleak picture of a rattling belief box, filled with unconnected
nodes, that is at work here. If Harman is wrong (empirically) about the extent to
which thoughtful people descry justificatory connections among their beliefs,
then they should be beholden to a principle of negative undermining. This is
especially the case if we say that one should abandon any belief for which we
would not have any present justification in terms of justificatory relations that one
has brought to bear in the past. On Harmans pessimistic and opposing picture,
the downward sweeps of our contraction algorithm would not whiten any nodes
that had not already been whitened in an earlier upward sweep, as members of
an occluder.

326

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

Harman also has a rather unusual view (p. ) connected with his refusal to
set any store by justificatory links among beliefs (or the agents potential access
to them as needed). He characterizes the distinction between foundationalism
and coherentism in the following rather unorthodox way:
The key issue is whether one needs to keep track of ones original justifications for beliefs.
What I am calling the foundations theory says yes; what I am calling the coherence theory
says no.

By contrast with Harman, on our account of the matter, it is not that the foundationalist does, while the coherentist does not, acknowledge and make use
of justificatory relations among beliefs when changing ones mind. Rather, the
distinction between the two is to be found in the overall patterns of justification
that are permitted or prohibitedpatterns that very definitely need justificatory
relations to be in place, so that their overall structural features can be read off.
On our account, the intuitive idea is the right one: the foundationalist sees justifications as tree-like in structure (or like chicken wire,4 with all arrows tending
downwards), whereas the coherentist sees justifications as web-liketangled
skeins, allowing loops. The great advantage of our account is that our method
of contraction (and therefore also of revision) is indifferent to the distinction
between the two positions, and is invariant across them. One and the same
method works for both.
On some other important matters, our account accords with Harmans. He
maintains that one has only a finite number of explicit beliefs (p. ). He also
takes belief to be an all-or-nothing matter (p. ). This, however, is because he
thinks that if beliefs are represented as having degrees (or probablility values),
then the task of updating by conditionalization would be too complicated in
practice. By contrast, we take belief to be an all-or-nothing affair only because
we are concerned to keep matters as simple as possible in this, our first detailed
attempt to model a difficult subject matter. Moreover, Harman is making an
intuitive judgement about complication (or complexity) not backed by such
formal work as would be necessary in order to justify it. And that summary
judgement would appear to be undermined by such formal work on probabilistic belief nets as has been done in this area, such as Pearl []. Harman claims
Todays politically correct synonym is poultry netting, which one presumes is intended to avoid
giving any offence to turkeys, ducks, geese or swansor to any breeders thereof, who might have
suffered twinges of guilt over the impropriety of bending bits of chicken wire in their husbandry of
these other species.

THE PROBLEM OF BELIEF REVISION

327

(personal communication) that such methods apply only to very restricted

problems. But, if human thinking is by and large confined to those restricted
(types of) problemsperhaps because those are the only areas where the updating of probabilities is a feasible operation?then at least we have a prima facie
need for a modeling that takes degrees of belief into account. By the same token,
those theorists who think that all beliefs are held only in degrees would definitely
need to explain how it is feasible for a rational agent to re-distribute probability
values in response to new information that is learned.
In Harmans characterization of the foundations theory he enters some
claims (pp. ) that, on our account, apply across the board, regardless of
the overall pattern of justificatory relations (which could be coherentist, if one
wished):
A belief is a basic belief if it has an intrinsic justification which does not appeal to other
beliefs. A basic belief can also have one or more nonintrinsic justifications which do appeal
to other beliefs. So, a basic belief can have its intrinsic justification defeated and still remain
justified as long as it retains at least one justification that is not defeated there are only
finitely many beliefs than can be appealed to for purposes of justification, and so infinite
justifications are ruled out.

Despite Harmans reluctance to appeal to justificatory relations when framing

the epistemic norms governing changes of belief, he agrees with us on the basic
data type, as it were: that of a justificatory step that holds for the agent concerned.
He writes (p. )
I am inclined to suppose that the basic notions are
P, Q, . . . , R immediately imply S for A
and
P, Q, . . . , R are immediately inconsistent for A.

Note the crucial relativization for A. This is in agreement with our account.
The main difference is that we seek to work with these basic materials, in order
to give a richer framework of norms for belief change. Moreover, we investigate
just how computationally complex the process of changing ones mind (i.e. ones
belief system) actually is. And those results go against the general tenor of
Harmans account, which is a curious combination of empirical pessimism and
theoretical hesitancy. In making his account hostage to empirical fortune, he
will be left (if the empirical facts turn out to be disconfirming) with no normative account of how a rational agent ought to change her beliefs.
328

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

12.5 Works that do not explicitly address the

problem of belief revision, except perhaps

in passing
12.5.1 Peter Klein on infinite regress
Peter Klein has a novel, if not to say maverick, view that challenges a broad
consensus among epistemologists. That consensus is that infinite regresses of
justification either do not exist, or are to be avoided like the plague. For Klein,
on the contrary, the ideal epistemic agent would always be obliged to keep on
going when giving justifications for her beliefs. Clearly, for any theorist of belief
change who is concerned to deal only with finitary structures, Kleins is a view
to be reckoned with. In Klein [], at p. , he states a Principle of Avoiding
Arbitrariness (PAA):
For all x, if a person, S, has a justification for x, then there is some reason, r1 , available to S
for x; there is some reason, r2 , available to S for r1 ; etc.

The intended reading, of course, is that for i < j, we have ri  = rj . For Klein is
explicitly envisaging the possibility of infinitely regressing chains of reasons for
Ss belief that x. The chain of reasons, he writes (for any belief), cannot end with
an arbitrary reasonone for which there is no further reason. And in meeting
this requirement, one cannot have recourse to coherentist loops, since these
have been ruled out (p. ) by the Principle of Avoiding Circularity (PAC):
For all x, if a person, S, has a justification for x, then for all y, if y is in the evidential ancestry
of x for S, then x is not in the evidential ancestry of y for S.

The combined effect of PAC and PAA is that for every belief node x for a rational
agent S, there will be an infinite partial ordering of yet further nodes with x as
its minimum. The node x will be less than each node in any premise set of other
nodes offered in support of x. Any node x in any such premise set will in turn
be less than each node in any premise set of other nodes offered in support of
x ; and so on. This infinite partial ordering with x as its minimum need not be
a tree, since a justificatory ancestor y of x, lying above x in this ordering, might
be reached by following two distinct paths generated by the less than relation:
Klein makes it clear that he is not envisaging an infinity of actually entertained
reasons regressing upwards in the way indicated in our diagram. His contention
(interpreted in terms of our diagrams) is only that no node in the diagram should
ever be taken as initial.
THE PROBLEM OF BELIEF REVISION

329

..
.

..
.

..
.

..
.

..
.

y
..
.

..
.

..
.

..
.

..
.

Let x be any node. Then, according to Klein, x would have an inference stroke
above it, and the agent might5 be able to find at least one more belief nodeone
that is both subjectively and objectively availablefrom which to supply an
arrow extending down to that inference stroke. Call such a further belief node w.
Klein does not claim that the agent need ever have considered or entertained
w at any time before acquiring the justified belief x. He carefully distinguishes
(following Fumertonsee p. ) between xs having a justification proceeding
via w, and xs being justified (for the agent) in virtue of a train of past justificatory
thought proceeding via w.
This concession by Klein, it seems to the present author, takes the infinitist
sting out of any objection to our finitary approach to contraction and revision.
It is all that we need seize upon in order to avert any principled objection by the
infinitist to our accounting for contraction (and revision) in terms of finitary
dependency networks. Ours has always been an agent-relative, though normative, account. It holds the agent accountable to the steps that she has recognized,
and the justifications that she has put together for her various finitely many,
actually formed, beliefs. So, confronted with a potentially infinite Kleinian tree
of justifications that a resourceful agent might be disposed to generate upon
challengeeven if such justifications had never been entertained before forming the beliefs in questionwe can simply prune it down by considering only
those nodes that have played a justification-transmitting role for the agent. The
As Klein has clarified (personal communication), certainly there will be times when at least
for a while (a good long whilelonger than the agents lifetime) the agent wont be able to locate
the next highest node.

330

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

result of such pruning, Klein concedes, is finite. In the language of Klein [],
the result consists of the doxastic justifications possessed by the agent, regardless
of how infinitely various and infinitely regressive the so-called propositional
justifications might be. The infinitist will take the belief that p to be doxastically
justified for S just in case S has engaged in providing enough reasons along an
endless path of reasons. (Loc. cit., p. .) Presumably what counts as enough
here will always be finite. In more detail (p. ):
Infinitism is committed to an account of propositional justification such that a proposition,
p, is justified for S iff there is an endless series of non-repeating propositions available to
S such that beginning with p, each succeeding member is a reason for the immediately
preceding one. It is committed to an account of doxastic justification such that a belief
is doxastically justified for S iff S has engaged in tracing the reasons in virtue of which
the proposition p is justified far forward enough to satisfy the contextually determined
requirements.

Actual tracing takes time; so the set of beliefs that enjoy doxastic justification
for the agent is finite.
It follows that we shall always be able to keep abreast with the agent who
is re-thinking any matter, since, ex hypothesi, the agent will only ever have
generated but finitely many of those nodes that Klein imagines as crystallizing
out indefinitely at ever-higher levels within a potentially infinite diagram.

12.5.2 Anil Guptas Empiricism and Experience

Gupta [] is a work that provides an inviting niche for the account presented
hereor at least for some extension of it.
Like almost all treatises in epistemology, Guptas is a mainly discursive treatment. It resorts to occasional uses of abbreviatory formalism mainly in order
to exhibit the applicability, to the material at hand, of the theory of mutually
dependent definitions that he had developed earlier, in collaboration with Nuel
Belnap, to handle certain problems concerning truth and paradox. The latter
theory is to be found in their book The Revision Theory of Truth (Gupta and
Belnap []). In Empiricism and Experience, Gupta appeals to such definitions in order to characterize the interplay between knowledge and subjective
experience on the part of a rational agent. It is important to realize that the
revision adverted to in the title of the earlier work has nothing to do with
the process of belief revision that is the main topic here. Nevertheless, there
is an important role to be played by the latter kind of belief revision within
Guptas epistemological account. He clearly indicates where, in the overarching
THE PROBLEM OF BELIEF REVISION

331

framework, it would fit in; but he does not provide any details. It is as though
he is telling his reader where exactly to put the black box, but is not venturing
to open it, or even speculate about its internal structure.
The following passage (on p. ) in effect extends an invitation to supply a
workable account of the belief-revision process. We cautiously offer the present
account (or some appropriate extension of it) as a plug-in for Guptas epistemology:
Suppose that an experience e yields, when conjoined with a view v, a class of judgments
that contains Q. Let us represent this as follows:
(2) Q e (v).
Suppose further that we have a rational being who holds the view v and suffers the
experience e. This being has to cope with the rational constraint expressed in (2). In most
cases, the constraint is met simply by accepting Q, but in some cases this may require
a modification of the view v. I shall sometimes read (2) as saying that the experience e
and the view v entail the judgment Q.[fn] The present point, then, is that the character of
this entailment is similar to that of logical entailment: it does not always yield entitlement.
A rational being that holds the view v and suffers the experience e is not automatically
entitled by (2) to the perceptual judgment Q. Constraint (2) forces the rational being
to adjust its view v in light of Q (and the other judgments in e (v)). Most often this is
achieved simply by adding Q to v. But sometimes it requires a substantial revision of the
original view v to a new view v . It is possible that v does not sustain the judgment Qit
may even be that e and v entail the negation of Q. In such a case, the total effect of e
and v precludes entitlement to Q.

Gupta seems here to be painting a more complicated picture allowing for

defeaters of Q to be lurking within view v alongside e (v), and undermining
or undercutting Q in particular. One might think that if e (v) had Q as its sole
member, then the newly revised view v would have to contain Q. But this is not
so. As Gupta has made clear (personal communication)
the revision v e (v) may fail to preserve all of e (v); in fact, it may under exceptional
circumstances reject all of e (v) [emphasis addedNT]. My motivation here is that
perceptual judgments yielded by experience (relative to a view), though they carry great
epistemic authority, can under certain cases be rationally rejected in light of the antecedent
view. So I would not want to impose success as an a priori condition on revisions.

This clarification by Gupta raises the following considerations. If K J need not

have any member of J in it, then the revision problem at hand boils down to
the problem of simply eliminating inconsistency from the union of K and J.
And if the emphasized part of the foregoing quote is correct, then there need
not be any symmetry breaking in favor of (even a part of) J, the way there is in
332

C O N N E C T I O N S W I T H E P I S T E M O L O G I C A L AC C O U N T S

the usual accounts of revision. Yet there is an asymmetry of sorts already built
in, on Guptas approach, since the set J is of the form e (K) (taking K as the
prior view v). And by making J depend thus on K, one would have thought
that the -function would somehow have recourse to K in order to ensure that
its output e (K) would not be so contrary to K that it could turn out that no
part of J = e (K) need survive in K J.
Does Gupta really want this extreme possibility to remain a possibility? Or
can the recency of e be held to be a consideration in favor of retaining at least
some of e (K) within the revision K e (K)?
If the answer to this last question is negative, as Gupta thinks it is, then
what we can offer Gupta is only our account of inconsistency-eliminating
contractionwhich is all that he would be seeking, anyway. On this account
our aim is to whiten absurdity () at the initial stage, and then to perform
upward and downward sweeps according to the algorithm(s) we have provided.
In performing such consistency-restoring contractions, no great store would
be set by e (K), despite its recency (for the rational agent in question).
If, on the other hand, the answer to our last question is affirmative, then our
account of contraction can be applied in full. We would need only to have some
non-empty but proper subset I of e (K) chosen for initial whitening; and the
contraction algorithm could then be applied in the usual way so as to compute
contractions of K (| e (K)) with respect to I. (Here the notation | U, for U a
set of nodes, is the set of all initial beliefs of the form | u, for u U.)
Either way, it would seem that our account (or, if necessary, some extension
of it that would allow for defeaters) would be the appropriate filling-in of the
details of the black box whose position within Guptas overall account is made
so clear by the foregoing quote from Empiricism and Experience.

THE PROBLEM OF BELIEF REVISION

333

This page intentionally left blank

REFERENCES

Carlos Alchourrn and David Makinson. On the logic of theory change: contraction
functions and their associated revision functions. Theoria, :, .
Carlos Alchourrn and David Makinson. On the logic of theory change: Safe contraction. Studia Logica, :, .
Carlos Alchourrn, Peter Grdenfors, and David Makinson. On the logic of theory
change: partial meet contractions and revision functions. Journal of Symbolic Logic,
:, .
Alan Ross Anderson and Nuel D. Belnap. Entailment: The Logic of Relevance and Necessity. Vol. I. Princeton University Press, Princeton, NJ, .
Robert Audi. The Architecture of Reason: The Structure and Substance of Rationality.
Oxford University Press, Oxford, .
Alfred J. Ayer. Language, Truth and Logic, nd edn. Gollancz, London, .
David Bayles and Ted Orland. Art & Fear: Observations On The Perils (and Rewards) of
Artmaking. The Image Continuum, Santa Cruz, CA & Eugene, OR, .
Laurence BonJour. The Structure of Empirical Knowledge. Harvard University Press,
Cambridge MA, .
Alonzo Church. A note on the Entscheidungsproblem. Journal of Symbolic Logic,
:, a.
Alonzo Church. Correction. Journal of Symbolic Logic, :, b.
Alonzo Church. Review of Ayers language, truth and logic, nd edition. Journal of Symbolic Logic, ():, .
S. A. Cook. The complexity of theorem-proving procedures. Proc. rd Annual ACM
Symposium on Theory of Computing, pages , .
James W. Cornman. Skepticism, Justification, and Explanation: with a Bibliographic Essay
by Walter N. Gregory. Reidel, Dordrecht, .
Donald Davidson. Actions, Reasons, and Causes. The Journal of Philosophy, LX():
, .
REFERENCES

335

J. de Kleer. An assumption-based TMS. Artificial Intelligence, :, .

W. F. Dowling and J. H. Gallier. Linear-time alrgorithms for testing the satisfiability of
propositional Horn formulae. Journal of Logic Programming, :, .
John Doyle. A truth maintenance system. Artificial Intelligence, :, .
Michael Dummett. Elements of Intuitionism. Clarendon Press, Oxford, .
Thomas Eiter and Georg Gottlob. The Complexity of Propositional Knowledge Base
Revision, Updates, and Counterfactuals. Artificial Intelligence, ():,
.
D. W. Etherington. Formalizing Nonmonotonic Reasoning Systems. Logic Journal of the
IGPL, ():, .
Richard Foley. Justified Inconsistent Beliefs. American Philosophical Quarterly,
:, .
K. Forbus and J. de Kleer. Building Problem-Solvers. MIT Press, Cambridge, MA, .
Gottlob Frege. Grundgesetze der Arithmetik. I. Band. Georg Olms Verlagsbuchhandlung,
Hildesheim, ; reprinted .
Andr Fuhrmann. Theory contraction through base contraction. Journal of Philosophical
Logic, ():, .
Peter Grdenfors. The Dynamics of Belief Systems: Foundations vs. Coherence Theories.
Revue Internationale de Philosophie, :, .
Michael R. Garey and David S. Johnson. Computers and Intractability: A Guide to the
Theory of NP-Completeness. Bell Laboratories, Murray Hill, NJ, .
Gerhard Gentzen. Untersuchungen ber das logische Schliessen. Mathematische
Zeitschrift, I, II:, , , . Translated as Investigations into Logical Deduction, in The Collected Papers of Gerhard Gentzen, edited by M. E. Szabo,
North-Holland, Amsterdam, , pp. .
Peter Grdenfors. Epistemic importance and minimal changes of belief. Australasian
Journal of Philosophy, :, .
Peter Grdenfors. Belief revision and the Ramsey test for conditionals. Philosophical
Review, :, .
Peter Grdenfors. Knowledge in Flux. MIT Press, Cambridge, MA, .
Kurt Gdel. Die Vollstndigkeit der Axiome des logischen Funktionenkalkls. Monatshefte fr Mathematik under Physik, :, .
Georg Gottlob. Complexity Results for Nonmonotonic Logics. Journal of Logic and
Computation, ():, .
Anil Gupta. Empiricism and Experience. Oxford University Press, New York, .
Anil Gupta and Nuel Belnap. The Revision Theory of Truth. MIT Press, Cambridge, MA,
.
Susan Haack. Evidence and Inquiry: Towards Reconstruction in Epistemology. Blackwell
Publishing, Oxford, .

336

REFERENCES

Sven Ove Hansson. Belief Contraction Without Recovery. Studia Logica, :,

.
Sven Ove Hansson. Knowledge-Level Analysis of Belief Base Operations. Artificial Intelligence, :, .
Sven Ove Hansson and Erik J. Olsson. Providing Foundations for Coherentism. Erkenntnis, ():, .
Sven Ove Hansson and Hans Rott. How Not to Change the Theory of Theory Change:
A Reply to Tennant. British Journal for Philosophy of Science, :, .
G. H. Hardy. A Mathematicians Apology. Cambridge University Press, Cambridge, .
Gilbert Harman. Change in View: Principles of Reasoning. MIT Press, Cambridge, MA,
.
Vincent F. Hendricks. Mainstream and Formal Epistemology. Cambridge University
Press, Cambridge, .
Leon Henkin. The completeness of the first order functional calculus. Journal of Symbolic
Logic, :, .
Ingebrigt Johansson. Der Minimalkalkl, ein reduzierter intuitionistischer Formalismus. Compositio Mathematica, :, .
Robert Kanigel. The Man Who Knew Infinity: A Life of the Genius Ramanujan. Charles
Scribners Sons, New York, .
Peter Klein. Human Knowledge and the Infinite Regress of Reasons. Philosophical Perspectives, :, .
Peter Klein. Human Knowledge and the Infinite Progress of Reasoning. Philosophical
Studies, :, .
Jonathan Kvanvig. Coherentist theories of epistemic justification. In Edward N. Zalta,
editor, The Stanford Encyclopedia of Philosophy. Fall edition, .
Isaac Levi. The Fixation of Belief and Its Undoing: Changing Beliefs Through Inquiry.
Cambridge University Press, .
Isaac Levi. Mild Contraction: Evaluating Loss of Information due to Loss of Belief. Oxford
University Press, .
D. Lubell. A short proof of Sperners lemma. Journal of Combinatorial Theory, ():,
.
David Makinson. Review of Tennant []. Mathematical Reviews, i:, .
V. Wiktor Marek and Miroslaw Truszczynski. Modal logic for default reasoning. Annals
of Mathematics and Artificial Intelligence, :, .
David Matuszek. Greedy Algorithms. Powerpoint file on web, .
D. McDermott and J. Doyle. Non-Monotonic Logic I. Artificial Intelligence, :,
.
R. C. Moore. Semantical Considerations on Nonmonotonic Logic. Artificial Intelligence,
:, .

REFERENCES

337

R. Niedere. Multiple contraction. a further case against Grdenfors Principle of

Recovery. In A. Fuhrmann and M. Morreau, editors, The Logic of Theory Change.
Lecture Notes in Artifical Intelligence . Springer Verlag, Berlin, Heidelberg, New
York, .
Erik J. Olsson. Against Coherence: Truth, Probability, and Justification. Clarendon Press,
Oxford, .
Rohit Parikh. Beth definability, interpolation and language splitting. Synthese,
():, .
Judea Pearl. Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference
(nd edn.). Morgan Kaufmann, San Francisco, CA, .
John Pollock. Interest-Driven Reasoning. Synthese, ():, .
John Pollock and Anthony Gillies. Belief Revision and Epistemology. Synthese,
():, .
Dag Prawitz. Natural Deduction: A Proof-Theoretical Study. Almqvist & Wiksell,
Stockholm, .
W. V. Quine and J. S. Ullian. The Web of Belief, second edition. Random House, New York,
.
R. Reiter. A Logic for Default Reasoning. Artificial Intelligence, :, .
Jean-Paul Sartre. The Reprieve, tr. Eric Sutton. Alfred A. Knopf, New York, .
John R. Searle. What Is an Intentional State? Mind, ():, .
John R. Searle. Intentionality, an Essay in the Philosophy of Mind. Cambridge University
Press, Cambridge, .
John R. Searle. Mind, Language and Society: Philosophy in the Real World. Basic Books,
New York, .
Stewart Shapiro. Foundations without Foundationalism: a Case for Second-order Logic.
Clarendon Press, Oxford, .
D. J. Shoesmith and T. J. Smiley. Multiple-conclusion Logic. Cambridge University Press,
Cambridge, .
Ernest Sosa. The Raft and the Pyramid: Coherence versus Foundations in the Theory of
Knowledge. Midwest Studies in Philosophy, ():, .
Richard Statman. Intuitionistic propositional logic is polynomial-space complete. Theoretical Computer Science, :, .
Alfred Tarski. The Concept of Truth in Formalized Languages. In J. H. Woodger, editor, Logic, Semantics, Metamathematics, pages . Clarendon Press, Oxford,
.
Neil Tennant. Minimal Logic is Adequate for Popperian Science. British Journal for
Philosophy of Science, :, .
Neil Tennant. Natural Deduction and Sequent Calculus for Intuitionistic Relevant Logic.
Journal of Symbolic Logic, :, a.

338

REFERENCES

Neil Tennant. Anti-Realism and Logic: Truth as Eternal. Clarendon Library of Logic and
Philosophy, Oxford University Press, Oxford b.
Neil Tennant. Autologic. Edinburgh University Press, Edinburgh, .
Neil Tennant. Changing the Theory of Theory Change: Towards a Computational
Approach. British Journal for Philosophy of Science, ():, a.
Neil Tennant. Intuitionistic Mathematics Does Not Need Ex Falso Quodlibet. Topoi,
pages , b.
Neil Tennant. Changing the Theory of Theory-Change: Reply to my Critics. British
Journal for Philosophy of Science, :, a.
Neil Tennant. On Having Bad Contractions: or, No Room for Recovery. Journal of
Applied Non-Classical Logics, :, b.
Neil Tennant. The Taming of The True. Oxford University Press, c.
Neil Tennant. Negation, Absurdity and Contrariety. In Dov Gabbay and Heinrich
Wansing, editors, What is Negation?, pages . Kluwer, Dordrecht, .
Neil Tennant. Deductive v. Expressive Power: A Pre-Gdelian Predicament. Journal of
Philosophy, XCVII():, .
Neil Tennant. Theory-Contraction is NP-Complete. The Logic Journal of the IGPL, ():
, .
Neil Tennant. Contracting Intuitionistic Theories. Studia Logica, :, .
Neil Tennant. New Foundations for a Relational Theory of Theory-Revision. Journal of
Philosophical Logic, ():, a.
Neil Tennant. A Degeneracy Theorem for the Full AGM-Theory of Theory-Revision.
Journal of Symbolic Logic, ():, b.
Neil Tennant. Belief-Revision, the Ramsey Test, Monotonicity, and the so-called Impossibility Results. Review of Symbolic Logic, ():, .
Neil Tennant. Cut for Core Logic. Review of Symbolic Logic, forthcoming.
Paul Thagard. Computational Philosophy of Science. MIT Press, Cambridge, MA,
.
Paul Thistlewaite, Michael A. MacRobbie, and Robert K. Meyer. Automated TheoremProving in Non-Classical Logics. Research Notes in Theoretical Computer Science.
Pitman, London and Wiley, New York, .
J. Ullian. A Note on Scheffler on Nidditch. Journal of Philosophy, :, .
Alasdair Urquhart. The undecidability of entailment and relevant implication. Journal of
Symbolic Logic, :, .
Alasdair Urquhart. The Complexity of Decision Procedures in Relevance Logic. In
J. Michael Dunn and Anil Gupta, editors, Truth or Consequences: Essays in Honor
of Nuel Belnap, pages . Kluwer, Dordrecht, .
Iris van Rooij. The Tractable Cognition Thesis. Cognitive Science: A Multidisciplinary
Journal, ():, .

REFERENCES

339

T. S. Verma. Causal networks: Semantics and expressiveness. Technical Report R-. Cognitive Systems Laboratory, University of California, Los Angeles, .
Florian von Schilcher and Neil Tennant. Philosophy, Evolution and Human Nature. Routledge & Kegan Paul, London, .

340

REFERENCES

INDEX

<-violation,
LR,
AGM-theory, viii, ix, , ,
, , , , , ,
, ,
laxity of,
Absurdity Rule,
CR,
DNE,
EFQ,
Ex Falso Quodlibet,
IR,
perfection constraint,
,
(honesty), ,
(success), ,
closure,
consistency constraint,
,
inclusion,
macro-structural
constraint,
minimal mutilation, , ,
,
preservation,
recovery,
success, , , ,
vacuity,
absolutely bizarre revisions,

absolutist,
absurdity constant,

Action Types, , ,
Action Type ,
Action Type ,
Action Type ,
Action Type ,
admissible contraction,

adopting, , , , , ,
, ,
agent-relativity, ,
Alchourrn, Carlos, viii, ,
,
algorithm
exponential-time,
for existential closure,
greedy, , , ,
,
non-deterministic, , ,
, ,
polynomial-time,
staining, ,
Anderson, Alan Ross,
,
Arl-Costa, Horacio, xi
Arora, Anish, xi,
assumption-retraction,
Axioms of Coloration, , ,
, , , , ,
, ,
Axioms of Configuration,
, , , , ,
Ayer, Alfred J., viii, ,

baffle, , ,
bafflement,
base
irredundant, , ,
basic beliefs, ,
Bayesian networks, , ,
, , ,
belief nets, ,
belief scheme, ,
belief set, , , , ,
, , , , ,

Belnap, Nuel, , ,
binary search,
bloating,
maximal,
minimal, ,
BonJour, Laurence, , ,

Buss, Sam, xi
Carnap, Rudolf,
Carter, Eric, xi
casualty, , ,
categorical description, ,

Chain, , ,
chains, infinitely descending,

Chandrasekaran, B., xi
Churchs Theorem,
Church, Alonzo, viii,
Circle, , ,

INDEX

341

classical propositional
calculus,
Classical Reductio ad
Absurdum,
closure
T-closure, , , ,
,
downwards,
existential, , , ,
, , ,
existential, algorithm for,

logical, , , , , , ,
, , , ,
under known steps, , ,
, ,
universal, , , ,
, ,
upwards,
cluster, , , ,
, , , ,
Clutter Avoidance, ,
co-NPNP -complete,
co-NP-complete,
cognitive significance,
coherentism, , , , ,
,
Cole, Julian, xi
collapse
of indirect verifiability, ix
of AGM-theory, viii
collapse proof,
coloration of diagram, , ,
, , , , , , ,
, , , , ,
, , ,
competence, vii
completeness,
components of stage of
computation,
comprehensiveness,
computational complexity, ,
, ,
computational saint, ,
condition (M< ),
conjunctive normal form,

connectives,
conservatism,
constraint (),
contingent sentence,
proposition or belief,

342

INDEX

, , , , ,
,
contraction, , , , ,
, ,
algorithm, , , , ,
, , , , , , ,
, , , , ,
, , , ,
, , ,
, , ,
, , , , ,
, , , , ,
, , ,
clear intuitions about,
computational complexity,
,
Cook, S. A.,
Core Logic, , , , , ,
, , , , ,
, , ,
Cornman, James W., ,

Cut Elimination for Core

Proof,
damped informational value,

data type, x, , , , ,
, ,
Davidson, Donald,
de Kleer, J., , , , ,
, ,
decision problem, , , ,
, ,
for classical propositional
logic,
for contraction,
for intuitionistic
propositional logic,
for minimal propositional
logic,
for relevant propositional
logics,
for theoremhood,
for truth-table satisfiability,

for LR.,
deducibility,
defeater
rebutting,
undercutting, ,
degeneracy

of AGM-theory,
Degeneracy Theorem, ix,
dependency network, , ,
, , , , , ,
, , , , , , ,
, , ,
, , , ,
, , , ,
, , , , ,
, , , , ,
, , ,
, , ,
, ,
formally defined,
dependency networks
examples of,
formally defined,
deterministic polynomial
time,
directed acyclic graph, ,

Double-Negation
Elimination, ,
Double Twig,
downward amplification, ,
, , , ,

Downward pass, , ,
, , , ,
, , ,
, , , ,
, ,
downward sweep,
doxastic justifications,
doxastic status,
Doyle, J., , , , ,
,
Duhem, Pierre, ,
Duo, ,
dynamics
Newtonian,
of belief, , , , ,

of theory change, ,
Eiter, Thomas, xi,
entrenchment, , , ,

entrenchment, relative, , ,
, , , ,
entry (in a belief scheme),
, ,

evidential series, ,
excision set, , ,
, , ,
,
existence claim,
expansion, , , , ,
, , , , , ,
, , , , ,

finitary predicament, viii, ,

, ,
finite development, ,
first-order language,
Florio, Salvatore, xi
FNP, ,
FNP-complete,
FNP-hard,
FNP-oracle,
Forbus, K., , , ,
foundationalism, , , ,
, ,
foundherentism, , , ,

Frege, Gottlob, ,
Friedman, Harvey M., xi, ,
, , , ,
Fuller, Timothy, xi
Fumerton, Richard,
Grdenfors, Peter, viii, ,
,
generality,
geometry of network, , ,

Gerhard, Gentzen,
Gottlob, Georg, xi, , ,

Gupta, Anil, xi, ,

Gdel, Kurt,
Haack, Susan, xi, ,
Hansson, Sven Ove, xi, ,
Harman, Gilbert, xi, ,

Henkin, Leon,
heuristics, ,
Hexagon, , , ,

Heyting, Arend,
Hilbert, David,
hitter, ,

perfect,
Hobsons choice, ,
Hume,
idealizing assumptions,
infinite regress,
infinitism,
informational economy,
criterion of,
intuitionist, , ,
intuitionist, cheeky,
intuitionistic relevant logic,
,
inviolable core of logic, ,
, , ,
item, justified in a belief
scheme,
Johannson, Ingebricht,
JTMS, , , ,
JTMS-theory, , ,
justificatory steps,
Kanigel, Robert,
kernel, , , , , ,
, ,
Kim, Joongol, xi
Klein, Peter, xi, ,
Kolmogorov axioms,
Komalatammal,
Kripke, Saul,
Kuhn, Thomas,
Kvanvig, Jonathan,
Law of Commutativity of
Addition, ,
Law of Excluded Middle, ,

Law of Non-Contradiction,
, ,
Left-rules,
Levi identity, ,
Levi, Isaac, xi, , , ,
, ,
Lewiss First Paradox, , ,

Lock
Black, , , , , , ,
, , ,
White, , , , ,
, , , , ,

logic
autoepistemic,
classical, , , , ,

classical first-order,
classical propositional, ,

core, , , , , , ,
, , , , ,
, ,
default,
intuitionistic, , ,
intuitionistic first-order,

minimal propositional,
non-monotonic,
relevant propositional,
Logical Closure Principle,

logical consequence,
logical falsehood,
logical reform, ,
logical truth,
logically minimal implying
set, , ,
MacPherson, James, xi
macro-level, , ,
Makinson, David, viii, ,
, ,
Marek, Viktor, xi, , ,

maxichoice contraction,
McDermott, D.,
melanism, ,
memory space, ,
methodological
requirements,
Meyer, Robert,
micro-level, ,
model,
modesty,
Moisa, Christina, xi
Moore, R. C.,
mutilating,
mutilation,
en bloc,
maximal,
minimal, , , , , ,
, , , , ,
, , , , ,
, , , ,

INDEX

343

Namagiri, ,
Narasimha, ,
natural deduction rules, ,

network, stratified,
Neurath, Otto,
neuropsychological reality,
,
Niedere, R., , ,
nodes, , , , , ,
, ,
black, ,
white, ,
non-monotonicity, ,
non-well-foundedness,
normal form (of proof), ,

NP-complete, , , , ,
, , , ,
, ,
NP-hard, ,
NP-oracle,
occluder, , , , ,
,
occluder, example,
Ogden, William, xi
optimization,
Osherson, Daniel, xi
outlist,
P=NP problem,
PA,
Pappas, George, xi
paradigm shifts,
paragon
logical,
paragon, logical, , , ,
, , ,
Parikh, Rohit, ix, xi
partial meet contraction
function,
Pascal, Blaise, xii
Peano Arithmetic,
Pearl, Judea, xi,
pedigree, justificatory or
epistemic, , , , ,
, , , ,

pluralist,
Poincar, Henri,
Pollock, John,

344

INDEX

polynomial hierarchy, , ,
, , ,
preferences, sacrificial,
Principle of Avoiding
Arbitrariness,
Principle of Avoiding
Circularity,
principle of positive
undermining,
Prolog, x, , , , , ,
, , , ,
propositional justifications,

PSPACE-complete,
pyramid, ,
quantifiers,
quietist,
Quine, Willard Van Orman,
vii, , , , , ,
, ,
QuineDuhem Problem, ,

Raffman, Diana, xi
Rajagopolan, T. K.,
Ramunajan, ,
Ramunajan*, , ,
rationality maxim,
rationality of belief revision,

Recovery, viii, , , , ,
, ,
reflexive stability, , , ,
,
refutability,
regress, justificatory, , ,
, ,
Reiter, R.,
relativity theory,
relevance logic R of Anderson
and Belnap,
relevantist, ,
Representation Theorem, ,
,
revision, , , , ,

algorithm,
logical,
Rhombus, , , ,
Right-rules,
Roche, William, xi

Russell, Bertrand,
Ryan, Mark, xi
safe contraction,
saint
computational, ,
logical, , , , , , , ,

Sartre, Jean-Paul,
satisficing, ,
saturatable contraction,

Scharp, Kevin, xi
Schumm, George, xi
search problem, , ,
,
Searle, John,
Segerberg, Krister, xi
selection function,
sequent rules,
Shapiro, Stewart, xi, ,
Simon, Herbert,
simplicity, ,
skepticism, ,
Skinner, Quentin, x
Smiley, Timothy, xi,
Smith, Ian, xi
Solo, ,
Sophies choices, doxastic,
Sosa, Ernest, , ,
soundness,
spectrum,
Sperner, Emanuel,
Spohn, Wolfgang, xi
Sprig, , ,
statics, , ,
Statman, R.,
step, , , , ,
initial, ,
transitional, , ,
steps, , , , , ,
,
informally explained,
initial v. transitional, ,

transitional,
subnetwork, , ,
, , , ,
, , , ,
, ,
T-closed,
Supowit, Ken, xi,

supplementary
AGM-postulates, ,
,
surrendering, , , ,
, ,
steps,
switching, , ,
syndrome
Chapter , vii
Firth of Forth Bridge, x
Tarski, Alfred,
Thagard, Paul, xi,
theoretical finitude,
thoroughgoing,
theory
in the logicians sense, ,
Thistlewaite, P.,
time, , , , , , ,

non-deterministic
polynomial, ,
polynomial,

TMS, , , ,
assumption-based,
transitivity of proof, ,
Truszczynski, M.,
truth tables,
Twig, , , ,
Ullian, Joseph, , , ,
,
undecidability
of first-order logic,
undecidability of R,
undecidability of first-order
logic,
unwanted,
Upward pass, , ,
, , , , ,
, , ,

Urquhart, A.,
Uzquiano-Cruz, Gabriel, xi
vacuous discharge,

van Rooij, Iris,

Vee, , , ,
Vertex Cover Problem,
violations of Axioms of
Coloration, , ,
,
detecting, , ,
resolving, , , ,

virtues of scientific
hypotheses,
Washatka, John, xi
web of belief, , ,
Wedge, ,
well-foundedness,
Whitehead, Alfred North,

ZermeloFraenkel Set
Theory,
ZFC,
Zigzag, , , ,

INDEX

345