DeepAI

# Reiter's Default Logic Is a Logic of Autoepistemic Reasoning And a Good One, Too

A fact apparently not observed earlier in the literature of nonmonotonic reasoning is that Reiter, in his default logic paper, did not directly formalize informal defaults. Instead, he translated a default into a certain natural language proposition and provided a formalization of the latter. A few years later, Moore noted that propositions like the one used by Reiter are fundamentally different than defaults and exhibit a certain autoepistemic nature. Thus, Reiter had developed his default logic as a formalization of autoepistemic propositions rather than of defaults. The first goal of this paper is to show that some problems of Reiter's default logic as a formal way to reason about informal defaults are directly attributable to the autoepistemic nature of default logic and to the mismatch between informal defaults and the Reiter's formal defaults, the latter being a formal expression of the autoepistemic propositions Reiter used as a representation of informal defaults. The second goal of our paper is to compare the work of Reiter and Moore. While each of them attempted to formalize autoepistemic propositions, the modes of reasoning in their respective logics were different. We revisit Moore's and Reiter's intuitions and present them from the perspective of autotheoremhood, where theories can include propositions referring to the theory's own theorems. We then discuss the formalization of this perspective in the logics of Moore and Reiter, respectively, using the unifying semantic framework for default and autoepistemic logics that we developed earlier. We argue that Reiter's default logic is a better formalization of Moore's intuitions about autoepistemic propositions than Moore's own autoepistemic logic.

• 22 publications
• 5 publications
• 25 publications
05/27/2011

### Complexity of Prioritized Default Logics

In default reasoning, usually not all possible ways of resolving conflic...
05/05/2014

### Implementing Default and Autoepistemic Logics via the Logic of GK

The logic of knowledge and justified assumptions, also known as logic of...
02/03/2000

### Uniform semantic treatment of default and autoepistemic logics

We revisit the issue of connections between two leading formalisms in no...
02/06/2013

### Sequential Thresholds: Context Sensitive Default Extensions

Default logic encounters some conceptual difficulties in representing co...
02/22/2016

### Enablers and Inhibitors in Causal Justifications of Logic Programs

To appear in Theory and Practice of Logic Programming (TPLP). In this pa...
05/12/2019

### Sequent-Type Proof Systems for Three-Valued Default Logic

Sequent-type proof systems constitute an important and widely-used class...
07/22/2019

### An Algebraic Approach for Action Based Default Reasoning

Often, we assume that an action is permitted simply because it is not ex...

## 1 Introduction

In this volume we celebrate the publication in 1980 of the special issue of the Artificial Intelligence Journal on Nonmonotonic Reasoning that included three seminal papers:

Logic for Default Reasoning by Reiter (1980), Nonmonotonic Logic I by McDermott and Doyle (1980), and Circumscription — a form of nonmonotonic reasoning by McCarthy (1980). While the roots of the subject go earlier in time, these papers are universally viewed as the main catalysts for the emergence of nonmonotonic reasoning as a distinct field of study. Soon after the papers were published, nonmonotonic reasoning attracted widespread attention of researchers in the area of artificial intelligence, and established itself firmly as an integral sub-area of knowledge representation. Over the years, the appeal of nonmonotonic reasoning went far beyond artificial intelligence, as many of its research challenges raised fundamental questions to philosophers and mathematical logicians, and stirred substantial interest in those communities.

The groundbreaking paper by McCarthy and Hayes (1969) about ten years before had captured the growing concern with the logical representation of common sense knowledge. Attention focused on the representation of defaults, propositions that are true for most objects, that commonly assume the form “most ’s are ’s.”111In this paper, we interpret the term “default” as an informal statement “most ’s are ’s” (Reiter, 1980). The term is sometimes interpreted more broadly to capture communication conventions, frame axioms in temporal reasoning, or statements such as “normally or typically, A’s are B’s”. Defaults arise in all applications involving common sense reasoning and require specially tailored forms of reasoning. For instance, a default “most ’s are ’s” under suitable circumstances should enable one to infer from the premise is an that is a .” This inference is defeasible. Its consequent “ is a ” may be false even if its premise “ is an ” is true. It may have to be withdrawn when new information is obtained. Providing a general, formal, domain independent and elaboration tolerant representation of defaults and an account of what inferences can be rationally drawn from them was the artificial intelligence challenge of the time.

The logics proposed by McCarthy, Reiter, and McDermott and Doyle were developed in an attempt to formalize reasoning where defaults are present. They went about it in different ways, however. McCarthy’s circumscription extended a set of first-order sentences with a second-order axiom asserting minimality of certain predicates, typically of abnormality predicates that capture the exceptions to defaults. This reflected the assumption that the world deviates as little as possible from the “normal” state. Circumscription has played a prominent role in nonmonotonic reasoning. In particular, it has been a precursor to preference logics (Shoham, 1987) that provided further important insights into reasoning about defaults.

Reiter (1980) and McDermott and Doyle (1980), on the other hand, focused on the inference pattern “most ’s are ’s.” In Reiter’s words (Reiter, 1980, p. 82):

‘We take it [that is, the default “Most birds can fly” — DMT to mean something like “If an is a bird, then in the absence of any information to the contrary, infer that can fly.”’

Thus, Reiter (and also McDermott and Doyle) quite literally equated a default “most ’s are ’s” with an inference rule that involves, besides the premise is an , an additional premise “there is no information to the contrary” or, more specifically, “there is no information indicating that “ is not a .” The role of this latter premise, a consistency condition, is to ensure the rationality of applying the default. In logic, inference rules are meta-logical objects that are not expressed in a logical language. Reiter, McDermott and Doyle sought to develop a logic in which such meta-logical inference rules could be stated in the logic itself. They equipped their logics with a suitable modal operator (in the case of Reiter, embedded within “his” default expression) to be able to express the consistency condition and, in place of a default “most ’s are ’s”, they used the statement “if is an and if it is consistent (with the available information) to assume that is a , then is a .” We will call this latter statement the Reiter-McDermott-Doyle (RMD, for short) proposition associated with the default.

Moore (1985) was one of the first, if not the first, who realized that defaults and their RMD propositions are of a different nature. This is how Moore (1985, p. 76) formulated RMD propositions in terms of theoremhood and non-theoremhood:

‘[In the approaches of McDermott and Doyle, and of Reiter — DMT] the inference that birds can fly is handled by having, in effect, a rule that says that, for any X, “X can fly” is a theorem if “X is a bird” is a theorem and “X cannot fly” is not a theorem.’

Moore then contended that RMD propositions are autoepistemic statements, that is, introspective statements referring to the reasoner’s own belief or the theory’s own theorems. He pointed out fundamental differences between the nature of default propositions and autoepistemic ones and argued that the logics developed by McDermott and Doyle (1980) and, in the follow-up paper, by McDermott (1982), are attempts at a logical formalization of of autoepistemic statements and not of defaults. Not finding the McDermott and Doyle formalisms quite adequate as autoepistemic logics, Moore (1984, 1985) proposed an alternative, the autoepistemic logic.

Unfortunately, Moore did not refer to the paper by Reiter (1980) but only to those by McDermott and Doyle (1980) and McDermott (1982), and his comments on this topic were not extrapolated to Reiter’s logic. Neither did Moore explain what could go wrong if a default is replaced by its RMD proposition. Yet, if Moore is right then given the close correspondence between Reiter’s and McDermott and Doyle’s views on defaults, also Reiter’s logic is an attempt at a formalization of autoepistemic rather than of default propositions. Moreover, if defaults are really fundamentally different from autoepistemic propositions, as Moore claimed, it should be possible to find demonstrable defects of Reiter’s default logic for reasoning about defaults that could be attributed to the different nature of a default and of its Reiter’s autoepistemic translation.

Our main objective in Section 2 is to argue that Moore was right. We show there two forms of such defects that (1) the RMD proposition is not always sound in the sense that inferences made from it are not always rational with respect to the original defaults, and (2) the RMD proposition is not always complete, that is, there are sometimes rational inferences from the original defaults that are not covered by this particular inference rule. In fact, both types of problems can be illustrated with examples long known in the literature.

In the remaining sections, we explain Reiter’s default logic as a formalization of autoepistemic propositions and show that in fact, Reiter’s default logic is a better formalization of Moore’s intuitions than Moore’s own autoepistemic logic. On a formal level, our investigations exploit the results on the unifying semantic framework for default logic and autoepistemic logic that we proposed earlier (Denecker, Marek, and Truszczyński, 2003). That work was based on a algebraic fixpoint theory for nonmonotone operators (Denecker, Marek, and Truszczyński, 2000). We show that the different dialects of autoepistemic reasoning stemming from our informal analysis can be given a principled formalization using these algebraic techniques. In our overview, we will stress the view on autoepistemic logic as a logic of autotheoremhood, in which theories can include propositions referring to the theory’s own theorems.

Some history. We mentioned that Moore’s comments concerning the RMD proposition and the formalisms by McDermott and Doyle (1980) and McDermott (1982) have never been applied to Reiter’s logic. For example, Konolige (1988), who was the first to investigate the formal link between autoepistemic reasoning and default logic, wrote that “the motivation and formal character of these two systems [Reiter’s default and Moore’s autoepistemic logics – DMT] are different”. This bypasses the fact that Reiter, as we have seen, starts his enterprise of building default logic after translating a default into a proposition which Moore later identified as an autoepistemic proposition.

There may be several reasons why Moore’s comments have never been extrapolated to Reiter’s logic. As mentioned before, one is that Moore did not refer to the paper by Reiter (1980) but only to the papers by McDermott and Doyle (1980) and McDermott (1982). In addition, the logics of Reiter and, respectively, McDermott and Doyle were quite different; the formal connection was not known at that time (mid 1980s) and was established only about five years later (Truszczyński, 1991). Also autoepistemic and default logics seemed to be quite different (Marek and Truszczyński, 1989), and eventually turned out to be different in a certain precise sense (Gottlob, 1995). Moreover, the intuitions underlying the nonmonotonic logics of the time had not been so clearly articulated, not even in Moore’s work as we will see later in the paper, and were not easy to formalize. This was clearly demonstrated about ten years later by Halpern (1997), who reexamined the intuitions presented in the original papers of default logic, autoepistemic logic and Levesque’s (1990) related logic of only knowing and showed gaps and ambiguities in these intuitions, and various non-equivalent ways in which they could be formalized.

As a result, the nature of autoepistemic propositions, its relationship to defaults and what may go wrong when the latter are encoded by the first, was never well understood. The relevance of Moore’s claims for Reiter’s default logic has never become generally acknowledged. Reiter’s logic has never been thought of and has never been truly analyzed as a formalization of autoepistemic reasoning. The influence of Reiter’s paper has been so large, that even today, the default “most ’s are ’s” and the statement “if is an and if it is consistent to assume that is a , then is a 222 Or its propositional version“if and if it is consistent to assume , then . are still considered synonymous in some parts of the nonmonotonic reasoning community. Yet, in fact, they are quite different and, more importantly, a logical representation of the second is unsatisfactory for reasoning about the first.

## 2 Reiter’s Defaults Are Not Defaults But Autoepistemic Statements

Our goal below is to justify the claim in the title of the section. To avoid confusion, we emphasize that by a default we mean an informal expression of the type most ’s are ’s. In Reiter’s approach (similarly in that of McDermott and Doyle), the default is first translated into an RMD proposition if is an and if it is consistent with the available information to assume that is a , then is a , which is then expressed by a Reiter’s default expression in default logic:

 A(x):MB(x)B(x).

To explain the section title, let us assume a setting in which a human expert has knowledge about a domain that consists of propositions and defaults. In the approach of Reiter (the same applies to McDermott and Doyle), the expert builds a knowledge base by including in formal representations of the propositions (given as formulas in the language of classical logic) and of RMD propositions of the defaults (given by the corresponding Reiter’s default expressions). The presence of Reiter’s default expressions in means that contains propositions referring to its own information content, i.e., to what is consistent with , or dually to what entails or does not entail. Moore (1985) called such reflexive propositions autoepistemic and argued that they statements could be phrased in terms of theorems and non-theorems of .

Reiter developed a default expression as a formal expression of the RMD proposition rather than of the default itself (the same holds for McDermott and Doyle). This is why this logic expression does not capture the full informal content of the default. When considered more closely, it indeed becomes apparent that a default and its RMD proposition are not equivalent or even related in a strict logical sense. A straightforward possible-world analysis reveals this. The default might be true in the actual world (say 95% of the ’s are ’s) but if there is just one that is an and not a , and for which has no evidence that it is not a , the RMD proposition is false in this world and is a witness of this. Thus, it is obvious that in many applications where a default holds, its RMD proposition does not. Conversely, the default might not hold in the actual world (few ’s are in fact ’s) yet the expert knows all ’s that are not ’s, in which case the RMD proposition is true.

A fundamental difference pointed out by Moore between defaults and autoepistemic propositions, is that the latter are naturally nonmonotonic but inference rules used for reasoning with them are not defeasible. For example, extending the knowledge base containing an RMD proposition with new information, e.g., that some is not a , may indeed have a nonmonotonic effect and delete some previous inferences, e.g., that is a . The initial inference of is a , resulted in a fact that was false. However, that inference was not defeasible. The essential property of a defeasible inference is that it may derive a false conclusion from premises that are true in the actual world. For instance, the inference from most ’s are ’s and is an that is a is defeasible as its consequent may be false while the premises are true. In the context of our example above the theory, say , entailed the false fact that is a from the premises (i) the RMD proposition, (ii) is an and (iii) contained no evidence that is not a . It was not defeasible since one of its premises was false. Indeed, the RMD proposition was false and was a witness. The inference rules applied are not defeasible (they are, essentially, the introduction of conjunction and modus ponens). To sum up, an inference from a knowledge base involving an RMD proposition may be false but only if the RMD proposition itself is false.

To emphasize further consequences of equating defaults and RMD propositions we will look at well-known examples from the literature. First, we turn our attention to the question whether there are cases when applying the RMD proposition leads to inferences that do not seem rational (lack of “soundness” with respect to understood informally “rationality”). The Nixon Diamond example by Reiter and Criscuolo (1981) and reasoning problems with related inheritance networks illustrate the problems that arise.

###### Example 1

Richard M. Nixon, the 37th president of the United States, was a Republican and a Quaker. Most Republicans are hawks while most Quakers are doves (pacifists). Nobody is a hawk and a dove. Some people are neither hawks nor doves. Encoding the Reiter-McDermott-Doyle proposition of these defaults in default logic, we obtain the following theory:

 Republican(Nixon)∧Quaker(Nixon)\vskip6.0ptplus2.0ptminus2.0pt∀x(¬Dove(x)∨¬Quaker(x))Republican(x):M Hawk(x)Hawk(x)Quaker(x):M Dove(x)Dove(x).

In default logic, this theory gives rise to two extensions. In one of them Nixon is believed to be a hawk and not a dove, in the other one, a dove and not a hawk. But is this rational? As we mentioned above, the use of an RMD-proposition is rational when it is expected to hold for most , and hence, in absence of information, it is likely to hold for some specific . But in the case of Nixon, we know in advance that at least one of the two “Nixon” instances of the RMD propositions has to be wrong. As to which one is wrong, without further information one could as well throw a coin. Moreover, it is not unlikely that they are both wrong and that in fact, Nixon is neither dove nor hawk. And in fact, it seems more rational not to apply any of the defaults, leading to a situation where it is not known whether Nixon is a dove, a hawk or neither. The rationale of using the RMD proposition as a substitute for the default does not hold for Nixon or any other republican quaker for that matter.

###### Example 2

Let us assume now that all quakers are republicans. In this case, the default that most quakers (say 95%) are doves is more specific than and overrules the default that most republicans (say 95%) are hawks. It is rational here to give priority to the quaker default, leading to the defeasible conclusion that Nixon is a dove. However, this conclusion cannot be derived from the RMD propositions because their consistency premise “it is consistent to assume that is a dove (respectively a hawk)” is too general to take such information into account.

Such scenarios were studied in the context of inheritance hierarchies (Touretzky, 1986). To reason correctly on this sort of applications using Reiter’s logic, the consistency condition of the RMD propositions has to be tweaked to take the hierarchy into account and give priority to the quaker default. For example, we can reformulate the RMD proposition of the default “most republicans are hawks” as “if x is known to be a republican and it is consistent to assume that he is a hawk and it is consistent to assume that he is not a quaker, then is a hawk”, which takes additional information into account. Such modified rules can of course be represented in default logic. After all, the logic was developed for representing (defeasible) inference rules. But, as in the examples above, they cannot be inferred from the RMD propositions. And the inferences that can be drawn from the RMD propositions are not always the rational ones.

The next problem that arises is of a complementary nature and concerns (lack of) completeness with respect to “rational” inferences. Are there cases where rational albeit defeasible inferences can be drawn from defaults that cannot be inferred from RMD propositions? As suggested above by our general discussion, the answer is indeed positive. After all, the RMD proposition expresses only a single and quite specific type of inference that might be associated with a default.

###### Example 3

As an illustration, let us consider the defaults most Swedes are blond and most Japanese have black hair. Nobody is both Swede and Japanese, or has both blond and black hair. If we learn know that Boris is a Swede or a Japanese then, given that he cannot be both Swede and Japanese, it seems rational to conclude defeasibly that Boris’s hair is blond or black. In other words, defaults can (sometimes) be combined and together give rise to defeasible inference rules like:

 \it{Boris is Swede or Japanese: M Boris's hair is % blond or black}{\it Boris's hair is blond or black}.

If all we know is that Boris is Swede or Japanese, the conclusion of this rule cannot be drawn from the two original RMD propositions for the simple reason that for each, one of their premises is not satisfied: it is not known that Boris is a Swede, and neither is it known that he is Japanese. For instance, in the logic of Reiter, the two defaults would be encoded as

 Swede(x):MBlond(x)Blond(x)andJapanese(x):MBlack(x)Black(x).

If we only know , then neither nor can be established. Therefore, the premises of neither rule are established and no inference can be made. Even more, if we accept Reiter’s logic as a logic of autoepistemic propositions, these conclusions should not be drawn from these expressions.

This example shows a clear case of a desired defeasible inference that cannot be drawn from the rules expressed in the two RMD propositions. A default expression in Reiter’s logic that would do the job has to encode explicitly the combined inference rule:

 Swede(x)∨Japanese(x):M(Blond(x)∨Black(x))Blond(x)∨Black(x).

This expresses an inference rule which is not derivable from the original RMD propositions in the logics of Reiter, McDermott, Doyle, or Moore. Default logic does not support such reasoning unless the combined inference rule is explicitly encoded as well.

###### Example 4

Assume that we now find out that Boris has black hair. Given that he is Japanese or Swede, and given the defaults for both, it seems rational to assume that he is Japanese. Can we infer this from the combined inference rules expressed above and given that nobody can be blond and black, or Swede and Japanese? The answer is no and, consequently, yet another inference rule should be added to obtain this inference.

Problems of these kind were reported many times in the NMR literature and prompted attempts to “improve” Reiter’s default logic so as to capture additional defeasible inferences of the informal default. This is, however, a difficult enterprise, as it starts from a logic whose semantical apparatus is developed for a very specific form of reasoning, namely autoepistemic reasoning. And while at the formal level the resulting logics (Brewka, 1991; Schaub, 1992; Lukaszewicz, 1988; Mikitiuk and Truszczyński, 1995) capture some aspects of defaults that Reiter’s logic does not, also they formalize a small fragment only of what a default represents and, certainly, none has evolved into a method of reasoning about defaults. In the same time, theories in these logics entail formulas that cannot be justified from the point of view of default logic as an autoepistemic logic.

To summarize, an RMD proposition expresses one defeasible inference rule associated with a default. It often derives rational assumptions from the default but not always, and it may easily miss some useful and natural defeasible inferences. The RMD proposition is autoepistemic in nature; Reiter’s original default logic is therefore a formalism for autoepistemic reasoning. As a logic in which inference rules can be expressed, default logic is quite useful for reasoning on defaults. The price to be paid is that the human expert is responsible for expressing the desired defeasible inference rules stemming from the defaults and for fine-tuning the consistency conditions of the inference rules in case of conflicting defaults. This may require substantial effort and leads to a methodology that is not elaboration tolerant.

While our discussion shows that in general, RMD propositions and Reiter’s defaults do not align well with the informal concept of a default of the form most ’s are ’s, there are other nonmonotonic reasoning patterns that are correctly expressed through Reiter’s defaults. In particular, patterns such as communication conventions, database or information storage conventions and policy rules in the typology of McCarthy (1986), can be expressed well by true autoepistemic propositions and, consequently, are correctly formalized in Reiter’s logic. E.g., the convention that an airport customs database explicitly contains the nationality of only non-American passengers, is correctly specified by the Reiter default

 :MNationality(x)=USANationality(x)=USA.

Similarly, the policy rule that the departmental meetings are normally held on Wednesdays at noon, is correctly formalized by

 :MTime(meeting)="Wed, noon"Time(meeting)="Wed, noon".

In spite of such examples, the fact remains that default logic is not a logic of defaults. Are there other logics that could be regarded as such? There have been several interesting attempts at formalizing defaults most ’s a re ’s. Most important of them focused on defaults as conditional assertions and on abstract nonmonotonic consequence relations (Makinson, 1989; Lehmann, 1989; Pearl, 1990; Kraus, Lehmann, and Magidor, 1990; Lehmann and Magidor, 1992). This research direction resulted in elegant mathematical theories and deep insights into the nature of some forms of nonmonotonic reasoning. However, it is not directly related to our effort here. Thus, rather than to discuss it we refer to the papers we cited.

Instead, in the remainder of the paper, we focus on the second objective identified in the introduction. That is, we provide an informal basis to autoepistemic reasoning, we place Reiter’s default logic firmly among dialects of autoepistemic reasoning, and show that Reiter’s logic was a watershed point that pinpointed one of the most fundamental and most important forms of autoepistemic reasoning.

## 3 Studies of Relationships Between Default Logic and Autoepistemic Logic

Konolige (1988) was the first to investigate a formal link between default and autoepistemic logic. He proposed the following translation from default logic to autoepistemic logic:

 α:Mβ1,…,βnγ↦Kα∧¬K¬β1∧⋯∧¬K¬βn→γ

and argued that was equivalence preserving in the sense that default extensions of the default theory were exactly the autoepistemic expansions of its translation. This translation is intuitively appealing, essentially expressing formally the RMD proposition of the default in modal logic, and it indeed plays an important role in the story. Nevertheless, it turned out that this translation was only partially correct (Konolige, 1989). Later, Gottlob (1995) presented a correct translation from default logic to autoepistemic logic but also proved that no modular translation exists. The latter result showed that these two logics are essentially different in some important aspect. As a result, the autoepistemic nature of default logic, which Moore had implicitly pointed at, and his implicit criticism on default logic as a logic of defaults were never widely acknowledged.

But Reiter’s logic is just that — a logic of autoepistemic reasoning. Moreover, in many respects it is a better logic of autoepistemic reasoning than the one by Moore. Our goal now is to reconsider the intuitions of autoepistemic reasoning, to distinguish between different dialects of it and to develop principled formalizations for these dialects. In particular, we relate Reiter’s and Moore’s logics, and explain in what sense Reiter’s logic is better than Moore’s. Our discussion uses the formal results we developed in an earlier paper (Denecker et al., 2003). There we used the algebraic fixpoint theory for arbitrary lattice operators (Denecker et al., 2000) to define four different semantics of default logic and of autoepistemic logic. This theory can be summarized as follows.

A complete lattice induces a complete bilattice , where is the precision order on defined as follows: if and . Tuples are called exact. For any -monotone operator that is symmetric, that is, if and only if , we can define three derived operators. These four operators identify four different types of fixpoints or least fixpoints (when the derived operator is monotone). They are summarized in Table 1 (where the operator used to define is the projection of on the first coordinate).

By assumption, is a -monotone operator on and its -least fixpoint is called the Kripke-Kleene fixpoint of . Fixpoints of the operator correspond to exact fixpoints of ( is a fixpoint of if and only if is a fixpoint of ) and are called supported fixpoints of . The operator is an anti-monotone operator on . Its fixpoints yield exact fixpoints of (if is a fixpoint of then is a fixpoint of ). They are called stable fixpoints of the operator . It is clear that stable fixpoints are supported. The operator is a -monotone operator on and its -least fixpoint is called the well-founded fixpoint of (fixpoints of are also fixpoints of

). The names of these fixpoints reflect the well-known semantics of logic programming, where they were first studied by means of operators on lattices. Taking Fitting’s four-valued immediate consequence operator

(Fitting, 1985) for , we proved (Denecker et al., 2000) that the four different types of fixpoint correspond to four well-known semantics of logic programming: Kripke-Kleene semantics (Fitting, 1985), supported model semantics (Clark, 1978), stable semantics Gelfond and Lifschitz (1988) and well-founded semantics (Van Gelder et al., 1991).

This elegant picture extends to default logic and autoepistemic logic Denecker et al. (2003). In that paper, we identified the semantic operator for a default theory , and the semantic operator for an autoepistemic theory . Both operators where defined on the bilattice of possible-world sets, which we introduce formally in the following section. Just as for logic programming, each operator determines three derived operators and so, for each logic we obtain four types of fixpoints, each inducing a semantics. Some of these semantics turned out to correspond to semantics proposed earlier; other semantics were new. Importantly, it turned out that the operators and are identical. Hence, Konolige’s mapping turned out to be equivalence preserving for each of the four types of semantics! Table 2 summarizes the results. The first two lines align the theories and the corresponding operators. The last four lines describe the matching semantics (the new semantics for autoepistemic and default logics obtained from this operator-based approach Denecker et al. (2000) are in bold font).

From this purely mathematical point of view Konolige’s intuition seems basically right. His mapping failed to establish a correspondence between Reiter extensions and Moore expansions only because they are on different levels in the hierarchy of the semantics. Once we correctly align the dialects, his transformation works perfectly. Conversely, we also proved that the standard method to eliminate nested modalities in the modal logic S5 can be used to translate any autoepistemic logic theory into a default theory that is equivalent to under each of the four semantics.

While the non-modularity result by Gottlob (1995) had shown that default logic and autoepistemic logic are essentially different logics, our results summarized above unmistakenly point out that default and autoepistemic logics are tightly connected logical systems. They suggest that the four semantics formalize different dialects of autoepistemic reasoning and that Reiter and Moore formalized different dialects. Therefore, in the rest of the paper, we will view Reiter’s logic simply as a fragment of modal logic, as identified by Konolige’s mapping.

## 4 Formalizing Autoepistemic Reasoning — an Informal Perspective

In our paper (Denecker et al., 2003) we developed a purely algebraic, abstract study of semantics. The study identified the (nonmonotone) operators of autoepistemic and default logic theories, and applied the different notions of fixpoints to them. What that paper was missing was an account of what these fixpoint constructions mean at the informal level and how the different dialects in the framework differ. Being as clear as possible about the informal semantics of autoepistemic theories is essential, as it is there where problems with formal accounts start.

This is the gap that we close in the rest of this paper. To this end we first return to the original concern of Reiter, and of McDermott and Doyle. Let us suppose that we have incomplete knowledge about the actual world, represented in, say, a first order theory , and that we know that most ’s are ’s. Following the Reiter, McDermott and Doyle approach, we would like to assert the following proposition:

If for some , and is consistent with (that is, ), then .

In fact, we would like to express this statement in the logic and, moreover, to add this proposition, with its references to what entails or does not entail, to itself. What we obtain is a theory that refers to its own theorems. In this view then, modal literals in an autoepistemic theory are to be interpreted informally as statements , and the theory itself as having the form , emphasizing the intuition of the self-referential nature of autoepistemic theories.

This view reflects what seems to us the most precise intuition that Moore proposed: to view autoepistemic propositions as inference rules. Specializing the discussion above to the autoepistemic formula

 Kα1∧⋯∧Kαn∧¬Kβ1∧⋯∧¬Kβm→γ (1)

we can write it (informally) as:

 T⊨α1∧⋯∧T⊨αn∧T⊭β1∧⋯∧T⊭βm→γ,

and understand it (informally) as an inference rule:

 if α1,…,αn are theorems and β1,…,βm are not theorems (2) then γ holds.

which is consistent with Moore’s (1985, p. 76) position we cited earlier. Alternatively, can be read as “ can be derived, or proven” (again, from the theory itself), which amounts at the informal level just to a different wording. We will refer to this notion of theorem and derivation as autotheorem and autoderivation, respectively. Accordingly, we will call the basic Moore’s perspective as that of autotheoremhood.

The autotheoremhood view can be seen as a special case of a more generic view, also proposed by Moore, based on autoepistemic agents. In this view which, incidentally, is the reason behind the name autoepistemic logic, an autoepistemic theory is seen as a set of introspective propositions, believed by the agent, about the actual world and his own beliefs about it. The crucial assumption is the one which Levesque (1990) dubbed later the All I Know Assumption: the assumption that all that is known by the agent is grounded in his theory, in the sense that it belongs to it or can be derived from it. In the case of the autotheoremhood view, the agent is nothing else than a personification of the theory itself, and what it knows is what it entails. We discuss alternative instances of this agent-based view in the next section.

But let us now focus on developing the autotheoremhood perspective. We regard it as a more precise intuition that is more amenable to formalization despite the fact that self-reference, which is evidently present in the notion of autotheoremhood, is a notoriously complex phenomenon. It plagued, albeit in a different form, the theory of truth in philosophical logic with millennia-old paradoxes (Tarski, 1983; Kripke, 1975; Barwise and Etchemendy, 1987). The best known example is the famous liar paradox:

“This sentence is false.”

An autoepistemic theory that is clearly reminiscent of this paradox is:

 Tliar={¬KP→P}.

In the autotheoremhood view, this theory states that if it does not entail then holds. However, if is not entailed, then we have an argument for , and if is entailed, the unique proposition of the theory is trivially satisfied; no argument for can be constructed. This is mutatis mutandis the argument for the inconsistency of the liar sentence. In view of the difficulties that self-reference has posed to the development of the theory of truth, it would be naive to hope that a crisp, unequivocal formalization of autoepistemic logic existed.

Moore (1985, p. 82) explained the difficulty of defining the semantics for autoepistemic inference rules (2) as follows. When the inference rules are monotonic, that is, when ,

‘once a formula has been generated at a given stage, it remains in the generated set of formulas at every subsequent stage. […] The problem with attempting to follow this pattern with nonmonotonic inference rules [that is, when (note of the authors)] is that we cannot draw nonmonotonic inferences reliably at any particular stage, since something inferred at a later stage may invalidate them.’

To put it differently, the problem is that when a rule (2) is applied to derive at some stage when all ’s have been inferred to be theorems and none of the ’s has been derived, later inferences may derive some and hence, invalidate the derivation of . In such case, Moore argues, all we can do is to characterize the desired result as the solution of a fixpoint equation instead of computing it by a fixpoint construction:

‘Lacking such an iterative structure, nonmonotonic systems often use nonconstructive “fixed point” definitions, which do not directly yield algorithms for enumerating the “derivable” formulas, but do define sets of formulas that respect the intent of the nonmonotonic inference rules.’

This was an extremely clear and compelling representation of intuitions behind not only the Moore’s own autoepistemic logic, but also behind the formalisms of McDermott and Doyle, and of Reiter, too, for that matter.

It is useful now to look at these ideas from a more formal point of view. Let us consider a modal theory over some vocabulary . Let consist of “inference rules” of the form (2), where for simplicity we assume that all formulas are objective (that is, contain no modal operator).333Our approach works equally well for arbitrary modal theories. The inference processes that Moore had in mind are syntactic in nature and are derivations of formulas. Yet, it is straightforward to cast these inference processes in semantical terms.

Let be the set of all -interpretations. A state of belief is represented as a set of possible worlds.444A possible-world set is a special Kripke structure in which the accessibility relation is total. Intuitively, each element represents a possible world, a state of affairs that satisfies the agent’s beliefs. A world represents an impossible world, a state of affairs that violates at least one proposition of the agent. Given a set representing the worlds held possible by an agent, the following, standard, definition formalizes which (modal) formulas the agent believes (or knows — we do not distinguish between these two modalities in our discussion).

###### Definition 1

We define the satisfiability relation as in the modal logic S5 by the standard recursive rules of propositional satisfaction augmented with one additional rule:

 B,w⊨Kφ if for every v∈B,B,v⊨φ.

We then define ( is believed or known in state ) if for every , .

This definition extends the standard definition of truth in the sense that if is an objective formula then if and only if . We define and the restriction of to objective formulas. These sets represent all modal formulas and all objective formulas, respectively, known in the state of belief .

It is natural to order belief states according to “how much” they believe or know. For two belief states and , we define if or, equivalently, if . The ordering is often called the knowledge ordering. We observe that does not entail , due to the nonmonotonicity of modal literals expressing ignorance, some of which may be true in and false in .

We can see Moore’s inference processes as sequences of possible-world sets such that , the possible-world set of maximum ignorance in which only tautologies are known. In each derivation step , some worlds might be found to be impossible and eliminated in ; other worlds might be established to be possible and added to . This process is described through Moore’s semantic operator , which maps a possible-world set to the possible-world set . For theories consisting of formulas (1), is exactly the set of all possible worlds that satisfy the conclusions of all inference rules that are “active” in , that is, for which , , and , .

Let us come back to Moore’s claims. The nonmonotonicity of the inference rules (2), or more precisely, formulas (1) is due to the negative conditions ( not known, not proved, not a theorem). So let us assume that for all inference rules in .555For arbitrary theories , the corresponding assumption is that there are no modal literals occurring positively in . One can show that under this assumption is a monotone operator with respect to : if , then . This can be rephrased in terms of knowledge ordering: if , then . In other words, the operator is also monotone in terms of the knowledge ordering . Moore’s inference process is now an increasing sequence in the knowledge order . It yields a least fixpoint in the knowledge order (equivalently, the greatest fixpoint of in the subset order ). Every other fixpoint of contains more knowledge than . The fixpoint is the intended belief state associated with the theory of monotonic inference rules.

In the general case of nonmonotonic inference rules (, for some rules), the operator may not be monotone. The inference process constructed with may oscillate and never reach a fixpoint, or may reach an unintended fixpoint due to the fact that it may derive that a world is impossible on the basis of an assumption which is later withdrawn. In such case, stated Moore, all we can do is to focus on possible-world sets that “respect the intent of the nonmonotonic inference rules” as expressed by a fixpoint equation associated to , rather than being the result of a fixpoint construction. In this way Moore arrived at his semantics of autoepistemic logic, summarized in the following definition.

###### Definition 2

An autoepistemic expansion of a modal theory over is a possible-world set such that .

We agree with Moore that the condition of being a fixpoint of is a necessary condition for a belief state to be a possible-world model of . However, it is obviously not a sufficient one, at least not in the autotheoremhood view on . This is obvious, as this semantics does not coincide with Moore’s own ideas on the semantics of monotonic inference rules. A counterexample is the following theory:

 T={KP→P}.

This theory consists of a unique monotonic inference rule, albeit a rather useless one as it says “if is a theorem then holds”. According to Moore’s account of monotonic inference rules, the intended possible-world model of this theory is (we assume that ). Yet, has two autoepistemic expansions, the second being the self-supported possible-world set .

It is worth noting that this theory is related to yet another famous problematic statement in the theory of truth, namely the truth sayer:

“This sentence is true.”

The truth value of this statement can be consistently assumed to be true, or equally well, to be false. Therefore, in Kripke’s (1975) three-valued truth theory, the truth value of the truth sayer is undetermined u. In case of the related autoepistemic theory , also Moore’s semantics does not determine whether is known or not. But in the autotheoremhood view, it is clear that should not be known and this transpires from Moore’s own explanations on monotonic inference rules.666There does not seem to be an analogous strong argument why the truth sayer sentence should be false. Yet, Fitting (1997) proposed a refinement of Kripke’s theory of truth in which truth is minimized and the truth sayer statement is false. For this, he used the same well-founded fixpoint construction that we will use below to obtain a semantics that minimizes knowledge for autotheoremhood theories. We come back to the issue of self-supported expansions in Section 5, where we explore alternative perspectives on autoepistemic propositions, in which such self-supported expansions might be acceptable.

The main question then is: Can we improve Moore’s method to build inference processes in the presence of nonmonotonic inference rules in ? In this respect, the situation has changed since 1984. The algebraic fixpoint theory for nonmonotone lattice operators (Denecker et al., 2000), which we developed and then used to build the unifying semantic framework for default and autoepistemic logics (Denecker et al., 2003), gives us new tools for defining fixpoint constructions and fixpoint equations which can be applied to Moore’s problem.

We illustrate now these tools in an informal way and refer to these intuitions later when we introduce major concepts for a formal treatment. Let us consider the theory:

 T={P,¬KP→Q,KQ→Q}.

Informally, the theory expresses that holds, that if is not a theorem then holds, and that if is a theorem, then holds. Intuitively, it is clear what the model of this theory should be: is a theorem, hence the second formula cannot be used to derive and neither can the truth sayer proposition . Therefore, the intended possible-world set is , that is, is entailed, is unknown.

It is easily verified that is a fixpoint of . Yet has a second, unintended fixpoint which contains more knowledge than . This is a problem as it is this unintended fixpoint that is obtained by iterating starting with . The reason for this mistake is that the second, nonmonotonic inference rule applies in the initial stage when holds. Later, when is derived, the conclusion that is a theorem continues to reproduce itself through the third truth sayer rule.

The problem above is that at each step and for each world an assumption is made of whether is possible or impossible. Each such an assumption might be right or wrong. These assumptions are revised by iterated application of . In the context of monotonic inference rules, the only wrong assumptions that might be made during the monotonic fixpoint construction starting in are that some world is possible, while in fact it turns out to be impossible. But these wrong assumptions can never lead to an erroneous application of an inference rule: if a condition of an inference rule holds when is assumed to be possible, then it will still hold when turns out to be impossible. But in the context of nonmonotonic inference rules, an inference rule may fire due to an erroneous assumption and its conclusion might be maintained through a circular argument in all later iterations. In our scenario, it is the initial assumption that worlds in which is false are possible that lead to the assumption that worlds in which is false are impossible, and this assumption is later reproduced by a circular reasoning using the third truth sayer proposition for .

The solution to this problem is very simple: never make any unjustified assumption about the status of a world. Start without any assumption about the status of any worlds and only assign a specific status when certain. We will elaborate this idea in two steps. In the first step, we illustrate this idea for a simplification of , in which the third axiom has been deleted.

1. Initially, no world is known to be possible or impossible. At this stage, the truth value of the unique modal literal in cannot be established. Yet, some things are clear. First, all worlds in which is false, that is, and , are certainly impossible since they violate the first formula, , of . Second, the world is definitely possible since no matter whether is a theorem or not, this world satisfies the two formulas of . All this can be established without making a single unsafe assumption. Thus, the only world about which we are uncertain at this stage is the world in which is false. Due to the second axiom, this world is possible if is known and impossible otherwise.

2. In the next pass, we first use the knowledge that we gained in the previous step to re-evaluate the modal literal . In particular, it can be seen that is true in all possible worlds and in the last remaining world of unknown status, . This suffices to establish that is a theorem, that is, that is true.

With this newly gained information, we can establish the status of the last world and see that satisfies the two axioms of . Hence this world is possible.

The construction stops here. The next pass will not change anything, and we obtain the possible-world set . Now, let us add the third axiom back and consider the full theory .

1. The first step of the construction is identical to the one above and determines the status for all worlds except : is possible, and and are impossible.

2. As before, in the second pass, can be established to be true. The second modal literal in cannot be established yet since its truth depends on the status of the world . The literal would be false if is possible, and true otherwise. Thus the truth of the third axiom in is still undetermined. We are blocked here.

3. But there is a way out of the deadlock. So far, the methods to determine whether a world is possible or impossible were perfectly symmetrical. The solution lies in breaking this symmetry. In , we have a truth-sayers axiom: it is consistent to assume that is a theorem, and also to assume that is not a theorem. In semantical terms, both assumptions on world are consistent: if this world is chosen possible, then is false and all axioms are satisfied in ; if it is chosen impossible, then is true. Since we want to interpret the modal operator as a theoremhood modality, it is clear what assumption to make: that is not a theorem. We should make the assumption of ignorance and take it that the world is possible (and is not a theorem). Thus, we obtain again the possible world model .

From these two examples, we can extract the concepts necessary to formalize the above informal reasoning processes. At each step, we have partial information about the status of worlds that was gained so far. This naturally formalizes as a 3-valued set of worlds. We call such a set a partial possible-world set. Formally, a partial possible-world set is a function

 B:W→{\bf t,\bf f,\bf u% },

where is the collection of all interpretations. Standard, total possible-world sets can be viewed as special cases, where the only two values in the range of the function are t and f. In the context of a partial possible world , we call a world certainly possible if and potentially possible if or u. Likewise, we call a world certainly impossible if and potentially impossible if or u. If , is potentially possible and potentially impossible. We define as the set of certainly possible worlds of , as the set of potentially possible worlds, and likewise, and as the sets of certainly impossible, respectively potentially impossible worlds of .

At each inference step , we evaluated the propositions of in one or more unknown worlds , given the partial information available in . When all propositions of turned out to be true in , was derived to be possible; if some evaluated to false, was inferred to be impossible. To capture this formally, we need a three-valued truth function to evaluate theories in the context of a world , the one we are examining, and a partial possible-world set . The value of this truth function on a theory , denoted as , is selected from . There are some obvious properties that this function should satisfy.

1. The three-valued truth function should coincide with the standard (implicit) truth function for modal logic in total possible-world sets. In particular, when is a total possible-world set, that is, has no unknown worlds, then should be true precisely when (and false, otherwise).

2. The three-valued truth function should be monotone with respect to the precision of the partial possible-world sets. A more precise partial possible-world set is one with fewer (with respect to inclusion) unknown worlds.

The intuition presented in (2) can be formalized as follows. We define if , where the latter (partial) order on truth values is the one generated by and .

A three-valued truth function is monotone in if implies that . In particular, if is monotone in and is a total possible-world set such that , then implies that , and implies that .

Designing such a three-valued truth function is routine, the problem is that there is more than one sensible solution. One approach, originally proposed by Denecker et al. (1998), extends Kleene’s (1952) three-valued truth evaluation to modal logic.

###### Definition 3

For a formula , world and partial possible-world set , we define using the standard Kleene truth evaluation rules of three-valued logic augmented with one additional rule:

 |Kφ|B,w=⎧⎪ ⎪⎨⎪ ⎪⎩\bf f % if |φ|B,w′=\bf f, for some w′ such that B(w′)=\bf t\bf t if |φ|B,w′=\bf t, for all w′ such that B(w′)=\bf t or \bf u\bf u otherwise.

For a theory , we define in the standard way of three-valued logic:

 |T|B,w=⎧⎪ ⎪⎨⎪ ⎪⎩\bf f if |φ|B,w=\bf f, for some φ∈T\bf t if |φ|B,w=\bf t, % for all φ∈T\bf u otherwise.

To illustrate the use of this truth function, let us evaluate the formula , where is objective, in the context of a partial possible-world set and an arbitrary world . We have if , that is, if all potentially possible worlds satisfy . Likewise, we have if , that is, at least one certainly possible world violates . Let be a more precise total possible world set; that is, or equivalently, . Then, obviously, if holds true in , the formula is true in , and if is false in then it is false in as well. In general this truth function is conservative (that is, -monotone) in the sense that if a formula evaluates to true or false in some partial possible-world set, then it has the same truth value in every more precise possible-world set thus, in particular, in every total possible-world set such that .

It is easy to see (and it was proven formally by Denecker et al. (2003)) that this truth function satisfies the two desiderata listed above. We also note that this is not the only reasonable way in which the three-valued truth function can be defined. We will come back on this topic in Section 4.5.

We now review the framework of semantics of autoepistemic reasoning we introduced in our study of the relationship between the default logic of Reiter and the autoepistemic logic of Moore (Denecker et al., 2003). We listed these semantics in the previous section. All semantics in the framework require that a (partial) possible-world model of an autoepistemic theory be justified by some type of an inference process:

 B0→B1→⋯→Bn=B.

At each step , modal literals appearing in are evaluated in . When such literals are derived to be true or false, this might lead to further inferences in . Taking the semantic point of view, we understand an inference here as a step in which some worlds of undetermined status are derived to be possible and some others are derived impossible.

Dialects of autoepistemic logic, and so of default logic, too, differ from each other in the nature of the derivation step , and in initial assumptions they make. Some dialects make no initial assumptions at all; in some others making certain initial “guesses” is allowed. In this way, we obtain autoepistemic logics of different degrees of groundedness. In the following sections, we describe inference processes underlying each of the four semantics in the framework described in Section 3.

Finally, we link the above concepts with the algebraic lattice theoretic concepts sketched in the previous section and used in the semantic framework of Denecker et al. (2003). There, the different semantics of an autoepistemic theory emerged as different types of fixpoints of a -monotone operator on the bilattice consisting of arbitrary pairs of possible-world sets. The partial possible-world sets correspond to the consistent pairs in this bilattice; a pair is consistent if , that is, certainly possible worlds are potentially possible. Inconsistent pairs give rise to possible-world sets that in addition to truth values t, f and u require the fourth one i for “inconsistency”. The Kleene truth function defined above can be extended easily to a four-valued truth function on the full bilattice.

The operator on that bilattice was then defined as follows:

 DT(B)=B′, if for every w∈W, B′(w)=|T|B,w.

We observe that this operator maps partial possible-world sets into partial possible-world sets and that it coincides with Moore’s derivation operator when applied on total possible-world sets.

In the sequel, we will often represent a partial possible-world set in its bilattice representation, as the pair of respectively potentially possible and certainly possible worlds. For example, the least precise partial possible-world set for will be written as : all worlds are potentially possible; no world is certainly possible.

We will now discuss the four semantics discussed above that define different dialects of autoepistemic reasoning.

### 4.1 The Kripke-Kleene semantics

This semantics is a direct formalization of the discussion above. We are given a finite modal theory (we adopt the assumption of finiteness to simplify presentation, but it can be omitted). A Kripke-Kleene inference process is a sequence

 B0→⋯→Bn

of partial possible-world sets such that:

1. is the totally unknown partial possible-world set. That is, for every , . We denote this partial possible-world set by . This choice of the starting point indicates that Kripke-Kleene inference process does not make any initial assumptions.

2. For each , there is a set of worlds such that for every , , and , and for every , . Thus, in each step of the derivation the status of the worlds that are certainly possible and certainly impossible does not change. All that can change is the status of some worlds of unknown status (worlds, that are potentially possible and potentially impossible). This set is denoted by above. It is not necessary that contains all worlds that are unknown in . In the derivation, worlds in become certainly possible or certainly impossible, depending on how the theory evaluates in them. If for such a potentially possible world , , becomes certainly possible. If , becomes certainly impossible. Otherwise, the status of does not change. As such a derivation starts from the least precise, hence assumption-free, partial possible-world set , all these derivations are assumption-free.

3. The halting condition: no more inferences can be made once we reach the state . Here this means that for each unknown , . The process terminates.

This precise definition formalizes and generalizes the informal construction we presented in the previous section. When applied to the theory we considered there,

 T′={P,¬KP→Q},

one Kripke-Kleene inference process that might be produced is (we represent here worlds, or interpretations, as sets of atoms they satisfy, and partial possible-world sets as pairs ):

 ⊥p→B1=({∅,{P},{P,Q}},∅){Q} certainly impossible→B2=({{P},{P,Q}},∅)∅ certainly impossible→B3=({{P},{P,Q}},{{P,Q}}){P,Q} certainly possible→B4=({{P},{P,Q}},{{P},{P,Q}})%${P}$certainlypossible.

The first derivation can be made since , for (in fact, for every , in which is false). The second derivation is justified similarly as the first one. The third derivation follows as , for , and the forth one as , for . Let us explain one more detail of the last of these claims. Here, holds because holds in . Moreover, as holds in every world that is potentially possible in . Thus, and so indeed, .

The shortest derivation sequence that corresponds exactly to the informal construction of the previous section is:

 ⊥p→({{P},{P,Q}},{{P,Q}})→({{P},{P,Q}},{{P},{P,Q}}).

The fact that there may be multiple Kripke-Kleene inferences processes is not a problem as all of them end in the same partial possible-world.

###### Proposition 1

For every modal theory , all Kripke-Kleene inference processes converge to the same partial possible-world set, which is the -least fixpoint of the operator .

We call this special partial possible-world set the Kripke-Kleene extension of the modal theory .

While the Kripke-Kleene construction is an intuitively sound construction, it has an obvious disadvantage: in general, its terminating partial belief state may not match the intended belief state even if consists of “monotonic” inference rules (no negated modal atoms in the antecedents of formulas of the form (1)). An example where this happens is the truth sayer theory:

 T={KP→P}.

It consists of a single monotonic inference rule, and its intended total possible-world set is , which in the current notation corresponds to

 ({{∅,{P}},{{∅,{P}}).

However, the one and only Kripke-Kleene construction is

 ⊥p→({∅,{P}},{{P}}).

Then the construction halts. No more Kripke-Kleene inferences on the status of worlds can be made and the intended possible-world set is not reached.

We conclude with a historical note. The name Kripke-Kleene semantics was used for the first time in the context of the semantics of logic programs by Fitting (1985). Fitting built on ideas in an earlier work by Kleene (1952), and on Kripke’s (1975) theory of truth, where Kripke discussed how to handle the liar paradox.

### 4.2 Moore’s autoepistemic logic

Moore’s autoepistemic logic has a simple formalization in our framework. A possible-world set is an autoepistemic expansion of if there is a one-step derivation for it:

 B0→B1,

where . Clearly, here we allow the inference process to make initial assumptions. Moreover, in the derivation step we simply verify that we made no incorrect assumptions and that no additional inferences can be drawn. The inference (more accurately here, the verification) process works as follows:

1. A world is derived to be possible if .

2. A world is derived to be impossible if .

Thus, formally, . Consequently, the limits of this derivation process are indeed precisely the fixpoints of the Moore’s operator (we stress that we talk here only about total possible-world sets).

Since coincides with on total possible-world sets, all autoepistemic expansions are fixpoints of . Thus, we have the following result.

###### Proposition 2

The Kripke-Kleene extension is less precise than any other autoepistemic expansion of . If the Kripke-Kleene extension is total, then it is the unique autoepistemic expansion of .

The weakness of Moore’s logic from the point of view of modeling the autotheoremhood view has been argued above. In Section 5, we will discuss another interpretation of autoepistemic logic in which his semantics may be more adequate.

### 4.3 The well-founded knowledge derivation

The problem with the Kripke-Kleene derivation is that it treats ignorance and knowledge in the same way. Ignorance is reflected by the presence of possible worlds. Knowledge is reflected by the presence of impossible worlds. In the Kripke-Kleene derivation, both possible and impossible worlds are derived in a symmetric way, by evaluating the theory in the context of a world , given the partial knowledge .

What we would like to do is to impose ignorance as a default. That a world is possible should not have to be derived. A world should be possible unless we can show that it is impossible. In other words, we need to impose a principle of maximizing ignorance, or equivalently, minimizing knowledge. Under such a principle, it is obvious that the possible-world set cannot be a model of the truth sayer theory . It does not minimize knowledge while the other candidate for a model, the possible-world set , does.

To refine the Kripke-Kleene construction of knowledge, we need an additional derivation step that allows us to introduce the assumption of ignorance. Intuitively, in such a derivation step, we consider a set of unknown worlds, which are turned into certainly possible worlds to maximize ignorance.

Formally, a well-founded inference process is a derivation process that satisfies the same conditions as a Kripke-Kleene inference process except that some derivation steps may also be justified as follows (by the maximize-ignorance principle):

• There is a set of worlds such that for all and for all , and .

In other words, in such a step we pick a set of unknown words, assume that they are certainly possible, and verify that this assumption was justified, that is, under the increased level of ignorance, all of them turn out to be certainly possible. To put it yet differently, we select a set of unknown worlds, for which it is consistent to assume that they are certainly possible, and we turn them into certainly possible worlds (increasing our ignorance). By analogy with the notion of an unfounded set of atoms (Van Gelder et al., 1991), we call the set of worlds , with respect to which the maximize-ignorance principle applies at the partial belief state , an unfounded set for .

We also note that the halting condition of a well-founded inference process is stronger than that for a Kripke-Kleene process. This means that for each unknown world of , and in addition, does not allow a MI inference step, that is, it has no non-empty unfounded set.

There are two properties of well-founded inference processes that are worth noting.

###### Proposition 3

All well-founded inference processes converge to the same (partial) possible-world set.

This property gives rise to the well-founded extension of the modal theory defined as the limit of any well-founded inference process. This limit can be shown to coincide with the well-founded fixpoint of , that is, the -least fixpoint of the operator defined in the previous section.

Another important property concerns theories with no positive occurrences of the modal operator (for instance, theories consisting of formulas (1) with no modal literals in the antecedent).

###### Proposition 4

If contains only negative occurrences of the modal operator, then the well-founded extension is the -least fixpoint of .

This property shows that the well-founded extension semantics has all key properties of the desired semantics of sets of “monotonic inference rules.” Let us revisit the truth sayer theory:

 T={KP→P}.

The Kripke-Kleene construction is

 ⊥p→({∅,{P}},{{P}}).

The inference that is possible is also sanctioned under the rules of the well-founded inference process. However, while there is no Kripke-Kleene derivation that applies now, the maximize-ignorance principle does apply and the well-founded inference process can continue. Namely, in the belief state given by , there is one world of unknown status (neither certainly impossible, nor certainly possible): . Taking and applying the maximize-ignorance principle to , we see that the well-founded inference process extends and yields . This possible-world set is total and so, necessarily, the limit of the process. Thus, this (total) possible-world set is the well-founded extension of the theory .

The well-founded extension is total not only for monotonic theories. For instance, let us consider the theory:

 T={KP↔Q}\ \ \ or equivalently,  {KP→Q,¬KP→¬Q}.

Intuitively, there is nothing known about , hence should be false. The unique Kripke-Kleene inference process ends where it starts, that is, with . Indeed, when is unknown, no certainly possible or certainly impossible worlds can be derived. However, the possible-world set is unfounded with respect to . Indeed, if both worlds are assumed possible, evaluates to false, and both worlds satisfy . Thus, in the well-founded derivation we can establish that and then, in the next two steps, we can derive the impossibility of the two remaining unknown worlds, first of and then of . This yields the following well-founded inference process:

 ⊥p→B1=({∅,{P},{Q},{P,Q}},{∅,{P}})→B2=({∅,{P},{P,Q}},{∅,{P}})→B3=({∅,{P}},{∅,{P}}).

In other cases, the well-founded extension is a partial possible-world set. An example is the theory:

 {¬KP→Q,¬KQ→P}}.

In this case, there is only one well-founded inference process, which derives that is a certainly possible world and derives no certainly impossible worlds. That is, the well-founded extension is: .

### 4.4 Stable possible-world sets

We recall that a partial possible-world set corresponds to the pair of total possible-worlds sets: , where is the set of potentially possible worlds and is the set of certainly possible worlds.

We now define a stable derivation for a possible-world set as a sequence of partial belief states of the form:

 (W,B)→(PP1,B)→⋯→(PPn−1,B)→(PPn,B),

where:

1.

2. For every , and for every , . That is, some worlds in which is false with respect to become certainly impossible and are removed from to form .

3. Halting condition: for every , or u.

If a total belief set has a stable derivation then we call a stable extension. This concept captures the idea of the Reiter’s extension of a default theory.

We recall that an inference rule (1) evaluates to false in world with respect to if , , for all , , and , for all , . We see here an asymmetric treatment of prerequisites and justifications which are evaluated in two different possible world sets. The same feature shows up, not coincidentally, in Reiter’s definition of extension of a default theory.

The intuition underlying a stable derivation comes from a different implementation of the idea that ignorance does not need to be justified and that only knowledge must be justified. In a partial possible-world set , the component sets and have different roles. Since determines the certainly impossible worlds, this is the possible-world set that determines what is definitely known. On the other hand the set of certainly possible worlds determines what is definitely not known by .

A stable derivation for is a justification for each impossible world of (each world is initially potentially possible but eventually determined not to be in , that is, determined impossible in ). The key point is that this justification may use the assumption of the ignorance in . By fixing to be , it takes the ignorance in for granted. What is justified in a stable inference process is the impossible worlds of , not the possible worlds.

We saw above that the theory

 {¬KP→Q,¬KQ→P}

has a partial well-founded extension. It turns out that it has two stable extensions and . For instance, the following stable derivation reconstructs . Note that in any partial possible-world set (that is, where the worlds of are certainly possible), evaluates to false. In all such cases, evaluates to false in any world in which is false. Hence we have the following very short stable derivation:

 (W,B)→(B,B).

We now have two key results. The first one links up well-founded and stable extensions.

###### Proposition 5

If the well-founded extension is a total possible-world set, it is the unique stable extension.

The second result shows that indeed, the Konolige’s translation works if the semantics of default logic of Reiter and the autoepistemic logic of Moore are correctly aligned. Here we state the result for the most important case of default extensions and stable extensions, but it extends, as we noted earlier, to all semantics we considered.

###### Proposition 6

For every default theory , is an extension of if and only is a stable extension of .

### 4.5 Discussion

We have obtained a framework with four different semantics. This framework is parameterized by the truth function. We have concentrated on the Kleene truth function but other viable choices exist. One is super-valuation (van Fraassen, 1966) which defines in terms of the evaluation of in all possible world sets approximated by . In particular,

 |T|B,w=Min≤p{|T|B,w|B≤pB}.

In this way we obtain another instance of the framework, the family of ultimate semantics (Denecker et al., 2004). For many theories, the corresponding semantics of the two families coincide but ultimate semantics are sometimes more precise. An example is the theory . It’s Kripke-Kleene and well-founded extension is the partial possible world set and there are no stable extensions. But the premise is a propositional tautology, making true if and false otherwise. As a consequence, the ultimate Kripke-Kleene, well-founded and unique stable extension is .

For a scientist interested in the formal study of the informal semantics of a certain type of (informal) propositions this diversity is troubling. Indeed, what is then the nature of autoepistemic reasoning, and which of the semantics that we defined and that can be defined by means of other truth functions is the “correct” one? It is necessary to bring some order to this diversity.

In the autotheoremhood view, the formal semantics should capture the information content of an autoepistemic theory that contains propositions referring to ’s own information content; the semantics should determine whether a world is possible or impossible, or equivalently, whether a formula is or is not entailed by . As we saw, Moore’s semantics of expansions and the Kripke-Kleene extension semantics are arguably less suited in the case of monotonic inference rules with cyclic dependencies (cf. the truth sayer theory). This leaves us with four contenders only: the well-founded and the stable extension semantics and their ultimate versions. All employ a technique to maximize ignorance and correctly handle autoepistemic theories with monotonic inference rules. Which of these semantics is to be preferred?

Let us first consider the choice of the truth function. The semantics based on the Kleene truth function and the ones induced by super-valuation make different trade-offs: the higher precision of the ultimate semantics, which is good, comes at the price of higher complexity of reasoning, which is bad (Denecker et al., 2004). When there is a trade-off between different desired characteristics, there is per definition no best solution. Yet, when looking closer, the question of the choice between these two truth functions turns out to be largely academic and without much practical relevance. There are classes of autoepistemic theories for which the Kleene and the super-valuation truth functions coincide, and hence, so do the semantics they induce. Denecker et al. (2004, Proposition 6.14) provide an example of such a class. Even more importantly, the semantics induced by Kleene’s truth function and by super-valuation differ only when case-based reasoning on modal literals is necessary to make certain inferences. Except for our own artificial examples introduced to illustrate the formal difference between both semantics (Denecker et al., 2004), we are not aware of any reasonable autoepistemic or default theory in the literature where such reasoning would be necessary. They may exist, but if they do, they will constitute an insignificant fringe. The take-home message here is that in all practical applications that we are aware of, the Kleene truth function suffices and there is no need to pay for the increased complexity of super-valuation. This limits the number of semantics still in the running to only two. Of the remaining two, the most faithful formalization of the autotheoremhood view seems to be the well-founded extension semantics. As we view a theory as a set of inference rules, the construction of the well-founded extension formalizes the process of the application of the inference rules more directly than the construction of the stable extension semantics.

Nevertheless, there are some commonsense arguments for not overemphasizing the differences between these semantics. First, we should keep in mind that theories of interest are those that are developed by human experts, and hence, are meaningful to them. What are the meaningful theories in the autotheoremhood? Not every syntactically correct modal theory makes sense in this view. “Paradoxical” theories such as the liar theory can simply not be ascribed an information content in a consistent manner and are not a sensible theory in the autotheoremhood view. For theories viewed as sets of inference rules, the inference process associated with the theory should be able to determine the possibility of each world and hence, for each proposition, whether it is a theorem or not of . In particular, this is the case when the well-founded extension is total. We view theories with theorems that are subject to ambiguity and speculation with suspicion. And so, methodologies based on the autotheoremhood view will naturally tend to produce theories with a total well-founded extension. From a practical point of view, the presence of a unique, constructible state of belief for an autoepistemic theory is a great advantage. For instance, unless the polynomial hierarchy collapses, for such theories the task to construct the well-founded extension and so, also the unique stable expansion, is easier than that of computing a stable expansion of an arbitrary theory or to determine that none exists. Further, for such theories, skeptical and credulous reasoning (with respect to stable extension) coincide and are easier, again assuming that the polynomial hierarchy does not collapse, than they are in the general case.

For all the reasons above, a human expert using autoepistemic logic in the autotheoremhood view, will be naturally inclined to build an autoepistemic knowledge base with a well-founded extension that is total. When the well-founded semantics induced by the Kleene truth function is total, the four semantics — the two stable semantics and the two well-founded semantics — coincide! It is so, in particular for the class of theories built of formulas (1) with no recursion through negated modal literals (the so-called stratified theories (Gelfond, 1987)). Hence, such a methodology could be enforced by imposing syntactical conditions.

All these arguments notwithstanding, the fact is that many default theories discussed in the literature or arising in practical settings do not have a unique well-founded extension and that the stable and well-founded extension semantics do not coincide777Some researchers believe that multiple extensions are needed for reasoning in the context of incomplete knowledge. Our point of view is different. The essence of incomplete knowledge is that different states of affairs are possible. Therefore, the natural — and standard — representation of a belief state with incomplete knowledge is by one possible-world set with multiple possible worlds, and not by multiple possible-world sets, which to us would reflect the state of mind of an agent that does not know what to believe.. We have seen it above in the Nixon Diamond example. More generally, it is the case whenever the theory includes conflicting defaults and no guidance on how to resolve conflicts. Such conflicts may arise inadvertently for the programmer, in which case a good strategy seems to be to analyze the conflicts (potentially by studying the stable extensions) and to refine the theory by building in conflict-resolution in the conditions of default rules. Otherwise, when conflicts are a deliberate decision of the programmer who indeed does not want to offer rules to resolve conflicts, all we can do is to accept each of the multiple stable extensions as a possible model of the theory and also accept that none of them is in any way preferred to others.

In conclusion, rather than pronouncing a strong preference for the well-founded extension over stable extensions or vice versa, what we want to point out is the attractive features of theories for which these two semantics coincide, and advantages of methodologies that lead to such theories.

## 5 Autoepistemic Logics in a Broader Landscape

In this section, we use the newly gained insights on the nature of autoepistemic reasoning to clarify certain aspects of autoepistemic logic and its position in the spectrum of logics, in particular in the families of logics of nonmonotonic reasoning and classical modal logics.

A good start for this discussion is Moore’s “second” view on autoepistemic logic. Later in his paper, when developing the expansion semantics, Moore rephrased his views on autoepistemic reasoning in terms of the background concept of an autoepistemic agent. Such an agent is assumed to be ideally rational and have the powers of perfect introspection. An autoepistemic theory is viewed as a set of propositions that are known by this agent. Modal literals in now mean “I (that is, the agent) know . The most important assumption, the one on which this informal view of autoepistemic logic largely rests, is that the agent’s theory represents all the agent knows (Levesque, 1990) or, in Moore’s terminology, what the agent knows is grounded in the theory. We will call this implicit assumption the All I Know Assumption.

Without the All I Know Assumption, the theory would be just a list of believed introspective propositions. The state of belief of the agent might then correspond to any possible-world set such that , for each (where if for all ). But in many such possible-world sets , the agent would know much more than what can be derived from . In this setting, nonmonotonic inference rules such as would not be useful for default reasoning since conclusions drawn from them would not be derived from the information given in . So the problem is to model the All I Know Assumption in the semantics. Moore implemented this condition by imposing that for any model , if , then is possible according to , i.e., . Combining both conditions, models that satisfy the All I Know Assumption are fixpoints of , that is Moore’s expansions.

Moore’s expansion semantics does not violate the assumptions underlying the autoepistemic agent view. Expansions do correspond to belief states of an ideally rational, fully introspective agent that believes all axioms in and, in a sense, does not believe more that what he can justify from . But the same can be said for the autotheoremhood view as implemented in the well-founded and stable extension semantics. We may identify the theory with what the agent knows, and the theoremhood operator with the agent’s epistemic operator , and see the well-founded extension (if it is total) or stable extensions as representing belief states of an agent that can be justified from .

As we stated in the previous section, Moore’s expansion semantics does not formalize the autotheoremhood view, but it formalizes a dialect of autoepistemic reasoning, based on an autoepistemic agent that accepts states of belief with a weaker notion of justification, allowing for self-supporting states of belief. While not appropriate for modeling default reasoning, the semantics may work well in other domains. Indeed, humans sometimes do hold self-supporting beliefs. For example, self-confidence, or lack of self-confidence often are to some extend self-supported. Believing in one’s own qualities makes one perform better. And a good performance supports self-confidence (and self-esteem). Applied to a scientist, this loop might by represented by the theory consisting of the following formulas:

.

Along similar lines, the placebo effect is a medically well-researched fact often attributed to self-supporting beliefs. The self-supporting aspect underlying the placebo-effect can be described by the theory consisting of the rules:

.

Taking a placebo just flips the patients into the belief that they are getting better. In this form of autoepistemic reasoning of an agent, self-supporting beliefs are justified and Moore’s expansion semantics, difficult to reconcile with the notion of derivation and theorem, may be suitable.

There are yet other instances of the All I Know Assumption in the autoepistemic agent view. For example, let us consider the theory In the autotheoremhood view, this theory is clearly inconsistent, for there is no way this theory can prove . The situation is not so clear-cut in the agent view. We see no obvious argument why the agent could not be in a state of belief in which he believes and its consequences and nothing more than that. In fact, the logic of minimal knowledge (Halpern and Moses,