Cancelling and Overshadowing: Two Types of Defeasibility in Defeasible Deontic Logic

1 Introduction

In recent years defeasible deontic logic has become in­ creasingly popular as a tool to model legal reasoning in expert systems [McCarty, 1992; Meyer and Wieringa, 1994; Jones and Sergot, 1994], because defeasible reason­ ing is an important aspect of legal reasoning [Prakken, 1993]. Deontic logic is a modal logic in which the modal operator 0 is used to express that something is obligatory. 1 For example, if the proposition r stands for the fact that you are robbed, then O(·r) expresses that you ought not to be robbed. Dyadic modal logics were introduced to formalize deontic reasoning about subideal Yao-Hua Tan EURIDIS P.O. Box 1738 3000 DR Rotterdam Erasmus University Rotterdam The Netherlands behavior in, for example, the Chisholm 'Paradox' that we will discuss later. An example of a conditional obligation in a dyadic modal logic is O(h I r), which expresses that you ought to be helped (h) when you are robbed (r). If both 0( ·r I T) and r are true, then we say that the obli­ gation is violated by the fact r. In recent years it was ar­ gued by several authors that these dyadic obligations can be formalized in non-monotonic logics [McCarty, 1992; Horty, 1993; Ryu and Lee, 1994].

This research was partially supported by the ESPRIT III Basic Research Project No.6156 DRUMS II and the EsPRIT III Basic Research Working Group No.8319 MODELAGE.

1 The best known deontic logic is so-called 'standard' de­ ontic logic (SoL) , a normal modal system of type KD accord­ ing to the Chellas classification [Chellas, 1980]. It satisfies, besides the inference rules modus ponens 7 and necessitation .... ~fp), th~ propositional tautologies and the axioms K: (O(p -t q) 1\ O(p)) -t O(q) and D: ·(O(p) 1\ O(·p)).

In defeasible reasoning one can distinguish two types of defeasibility. To illustrate the difference between the two we consider the default rule :E. This default can be p defeated by the fact ·p, or it can be overridden by another more specific default q~;P , for example in Brewka's prioritized default logic [Brewka, 1994]. We call the first case factual defeasibility and the last one overridden de­ feasibility. In both these cases the default :E is cancelled p either by the fact ·p, or by the default rule q~;P respectively. By cancellation we mean, for example, that if ·p is true, then the default assumption that p is true is null and void. The truth of ·p implies that the default as­ sumption about p is completely falsified. To say that a fact is inconsistent with a default rule makes no sense literally, because a default rule has no truth value. How­ ever, if we consider the autoepistemic translation [Kono­ lige, 1988] -.L-.p --+ p of the default :E (with the auP toepistemic belief operator L), then -.L-.p 1\ ·P is inconsistent. In other words, the default assumption ·L·p is not consistent with the fact ·p. The fundamental difference between deontic logic and logics for defeasi­ ble reasoning is that O(p I T) 1\ ·p is not inconsistent. That is the reason why the deontic operator 0 had to be represented as a modal operator with a possible worlds semantics, to make sure that both the obligation and its violation could be true at the same time. Although the obligation O(p I T) is violated by the fact ·p, the obli­ gation still has its force. For example, even if you are robbed, you should not have been robbed. But if a pen­ guin cannot fly, it makes no sense to state that normally he can fly. We will refer to this relation between the obli­ gation and its violation as overshadowing to distinguish it from cancellation in the case of defeasible logics. 2

In this paper we defend two claims. First, that a num­ ber of notorious 'paradoxes' of deontic logic can be solved when they are analyzed as forms of defeasible reason­ ing. This has already been defended by other authors before us. Secondly, and this is a new claim, we argue that an analogous distinction between factual defeasibil­ ity and overridden defeasibility also holds for defeasible obligations. A defeasible obligation O(p I T) can be vi­ olated by a fact 'P, or overridden by another obligation 0( 'P I q) . However, the important difference is that in the case of default logics both types of defeasibility are cancellation, whereas in .the case of deontic logic only overriding leads to cancellation, while violation leads to overshadowing. Because of this difference between can­ cellation in the first case and overshadowing in the sec­ ond case, it becomes essential not to confuse the two types of defeasibility in analyzing the 'paradoxes'. We show that if they are confused, counterintuitive conclu­ sions follow for the Chisholm and Forrester 'Paradoxes'. The distinction between these two kinds of defeasibility is in our opinion the real paradox of defeasible deontic logic, because they have 90% overlap, but they are differ­ ent. This distinction will become clear when we analyze the detachment of absolute obligations from the dyadic obligations.

This paper is organized as follows . In Section 2 we give a detailed comparison of factual and overridden de­ feasibility in deontic reasoning, and we show that the Chisholm 'Paradox' can better be analyzed as a case of factual defeasibility rather than overridden defeasibility, as is usually done. In Section 3 we focus on the overshad­ owing aspect of factual defeasibility and the cancellation aspect of overridden defeasibility, and we show that in an adequate analysis of the Forrester 'Paradox' both these aspects have to be combined. In Section 4 we discuss further research.

2 Overridden versus Factual Defeasibility

In this section we give a general analysis of defeasi­ ble deontic logic by analyzing some intuitive inference patterns. 3 We show the fundamental difference between factual and overridden defeasibility.

2 The conceptual difference between cancelling and over­ shadowing is similar to the distinction between 'defeasibility' and 'violability' made in [Smith, 1993] and [Prakken and Ser­ got, 1994] . However, the essential difference between th~se papers and this one is that in this paper we ar?u.e. that VIO­ lability has to be considered as a type of defeasrbrhty too.

3 See [Tan and van der Torre, 1994b; 1995] for a semantic analysis of the two types. In the multi p.reference .sem~n­ tics there are two distinct preference ordenngs: one rdeahty preference ordering which can be used to formalize. deontic reasoning about subideal behavior and one normahty. pref­ erence ordering which can be used to formahze a notwn of overridden.

2.1 Contrary-To-Duty obligations

Deontic logic is plagued by many 'paradoxes', intuitively consistent sentences which are formally inconsistent, or derive counterintuitive sentences. The most notorious 'paradoxes' are caused by so-called Contrary-To-Duty (CTD) obligations, obligations that refer to subideal sit­ uations. For example, Lewis describes the CTD obliga­ tion that you ought to be helped when you are robbed:

Example 1 (Good Samaritan 'Paradox') 'It ought not to be that you are robbed. A fortiori , it ought not to be that you are robbed and then helped. But you ought to be helped, given that you have been robbed. This robbing excludes the best possibilities that might otherwise have been actualized, and the helping is needed in order to actualize the best of those that remain. Among the best possible worlds marred by the robbing, the best of the bad lot are some of those where the robbing is followed by helping.' [Lewis, 1974]

In the early seventies, several dyadic modal systems were introduced to formalize CTD obligations, see [Lewis, 1974] for an overview. Unfortunately, several techni­ cal problems related to CTD reasoning persisted in the dyadic logics, see [Tomberlin, 1981]. A dyadic obligation O(o: I {J) can be read as 'if {3 (the antecedent) is the case then a (the consequent) ought to be the case'. A CTD obligation is a dyadic obligation of which the antecedent contradicts the conclusion of another obligation. For ex­ ample, if we have O(a I {J) and 0(1 I ....,o:) then the last one is a CTD (alias secondary) obligation and the first one is called its primary obligation. CTD obligations re­ fer to optimal subideal situations. In the subideal situa­ tion that O(o: I {J) is violated by {31\ ....,o:, the best thing to do is I· Recently it was observed that the violation can be formalized in non-monotonic logics [McCarty, 1992; Horty, 1993], theories of diagnosis [Tan and van der Torre, 1994a; 1994c] and decision theories [Boutilier, 1994b]. We say that dyadic obligations satisfy the Kan­ tian principle 'ought implies can' when ought refers to 'the best of those that remain'. This will be explained in more detail in Section 2.3.

Since the late seventies, several temporal deontic logics and deontic action logics were introduced, e.g. [Loewer and Belzer, 1983; Makinson, 1993; Alchourr6n, 1994], which formalize satisfactorily a special type of CTD obli­ gations. Temporal deontic logics formalize conditional obligations in which the consequent occurs later than the antecedent. The underlying principle of the formaliza­ tion of CTD obligations is that facts of the past are not in the 'context of judgment' [Loewer and Belzer, 1983]. Hence, they can formalize the Good Samaritan 'Para­ dox' in Example 1. However, they cannot formalize the variant of the 'paradox' described by Forrester (see Ex­ ample 3) and the Chisholm 'Paradox' (see Example 2), because"in these 'paradoxes' there are CTD obligations of which the consequent occurs at the same time or even before its antecedent.

2.2 Overridden defeasibility

A defeasible deontic logic can formalize obligations that can be overridden by other obligations. Overridden structures can be based on a notion of specificity, like in Harty's well-known example that you should not eat with your fingers, but if you are served asparagus you should eat with your fingers [Horty, 1993]. We say that an obligation is cancelled by exceptional circumstances when it is overridden. For example, the obligation not to eat with your fingers is cancelled by the exceptional circumstances that you are served asparagus.

In a defeasible deontic logic, conditional obligations are defeasible conditionals. In recent years several au­ thors have proposed to solve the Chisholm 'Paradox' by analyzing the problematic CTD obligation that occurs in it as a type of overridden defeasibility (see e.g. [Mc­ Carty, 1992; Ryu and Lee, 1994]). 4 The underlying idea is that a CTD obligation can be considered as a conflict­ ing obligation that overrides a primary obligation. Al­ though this idea seems to be very intuitive at first sight, we argue in this paper that this perspective of CTD obli­ gations as a kind of overridden defeasibility is mislead­ ing. It is misleading, because although this perspective yields most (but not all!) of the correct conclusions for the Chisholm 'Paradox', it does so for the wrong rea­ sons. We show that it is more appropriate to consider the CTD obligation as a kind of factual defeasibility. This does not mean that there is no place for overridden defeasibility in deontic logic. By a careful analysis of an extended version of another notorious paradox of dean­ tic logic, the Forrester 'Paradox', we show that some­ times combinations of factual and overridden defeasibil­ ity are needed to represent defeasible deontic reasoning. But first we give our analysis of the Chisholm 'Paradox'. First we present the 'paradox' in a normal dyadic deontic logic, to show its paradoxical character. Subsequently, we analyze the 'paradox' in a -defeasible deontic logic in which there is only overridden defeasibility, and discuss the shortcomings of this approach. Finally, we give an analysis of the Chisholm 'Paradox' in terms of factual defeasibility. To make our analysis as general as pos­ sible, we assume as little as possible about the deontic logic we use. The analyses given in this paper in terms of inference patterns are, in principle, applicable to any defeasible deontic logic.

Assume a deontic logic with a finite propositional base logic£ and dyadic modal obligations O(a I /3) , where fJ (the antecedent) and a (the consequent) are sentences of £. Assume further the unrestricted strengthening of the antecedent rule SA.

4 [McCarty, 1992) does not analyze the Chisholm 'Paradox' but the so-called Reykjavic 'paradox', which he considers to contain 'two instances of the Chisholm 'Paradox', each one interacting with the other'.

Finally, assume the deontic detachment (alias transi­ tivity) rule DD:

The notorious Chisholm 'Paradox' [Chisholm, 1963] (alias the CTD 'paradox', alias the 'paradox' of deontic detachment) is as follows: 5

Example 2.1 (Chisholm 'Paradox') Consider the premises O(a I T), O(t I a) and 0(-.t I -.a), where T stands for any tautology, a can be read as the fact that a certain man goes to the assistance of his neighbors and t as the fact that he tells them he is coming. The premise 0( -.t I --.a) is a CTD obligation of the (primary) obliga­ tion O(a I T) , because its antecedent is inconsistent with the consequent of the latter.

The intuitive obligation O(t I T) can be derived by DD from the first two obligations. It seems intuitive, because in the ideal situation the man goes to the assistance of his neighbors and he tells them he is coming. Hence, if he does not tell them, the ideal situation is no longer reachable. However, from O(t I T) the counterintuitive O(t I -.a) can be derived by SA. This is counterintuitive, because there is no reason to tell them he is coming when the man does not go. Moreover, in many deontic logics 0 ( -.t I -.p) and 0 ( t I -.p) are inconsistent.

This counterintuitive obligation cannot be derived in a defeasible deontic logic with overridden defeasibility. For our argument we use a notion of overridden based on specificity. Assume that SA is replaced by the following restricted strengthening of the antecedent rule RSAo. RSAo contains the so-called non-overridden condition Co, which represents that O(a I fJ) is not overridden by some O(a' I {J') for fJ 1\ I · It is based on a simpli­ fied notion of specificity, because background knowledge is not taken into account and· an obligation cannot be overridden by more than one obligation.

where condition Co is defined as follows:

Co: there is no premise O(a' I {3') such that {3 1\ I logically implies {3'' {3' logically implies {3 and not vice versa and a and a' are inconsis­ tent.

The following solution can now be given for the 'para­ dox':

Example 2.2 The intuitive obligation O(t I T) can still be derived by DD from the first two obligations. From O(t I T) the counterintuitive O(t I -,a) cannot be derived by RSAo, because O(t I T) is overridden for -,a by the CTD obligation 0(---,t I -,a), i.e. Co is false. Hence, the counterintuitive obligation is cancelled by the exceptional circumstances that the man does not go to the assistance.

5 The original 'paradox' was given in a monadic modal logic, here we give the obvious formalization in a dyadic logic. See [Tomberlin, 1981) for a discussion of the Chisholm 'Para­ dox' in several conditional deontic logics.

Though this yields intuitive results from the set of premises, we think that it does so for the wrong reasons. A simple counterargument against the solution of the 'paradox' above is that overriding based on specificity does not work anymore when the first premise is O(a I i), where i can be read as the fact that the man is personally invited to assist. Another counterargument against the solution of the 'paradox' for any definition of overridden is that the trick does not work either when the set of premises contains only the first two obligations, as is the case in the following example.

Example 2.3 Consider only the premises O(a I T) and O(t I a) . Again the intuitive obligation O(t I T) can be derived by D D. From this derived obligation the coun­ terintuitive 0 ( t I -,a) can again be derived by RS Ao , because there is no CTD obligation which cancels the counterintuitive obligation.

In [Tan and van der Torre, 1994c] we dubbed the in­ tuition that the obligation 0( t I T) is intuitive and the obligation O(t I -,a) is counterintuitive as 'deontic de­ tachment as a defeasible rule'. The obligation O(t I T), that is derived by DD, lacks unrestricted strengthening of the antecedent, the characteristic property of defeasi­ ble conditionals. The underlying assumption of the in­ tuition is that the inference of the obligation of the man to tell his neighbors that he is coming is made on the as­ sumption that he goes to their assistance. If he does not go, then this assumption is violated and the obligation based on this assumption is factually defeated.

The problematic character of DD is well-known from the Chisholm 'Paradox' and it is therefore usually not accepted for deontic logics. However, the same phenom­ ena occurs when SA (or RSAo) and the following rule of consequential closure CC is accepted, and this rule is accepted by many deontic logics. 6

This is shown by the following variant of the exam­ ple, where the conditional obligation is represented as an absolute obligation: 7

6 For examples of deontic logics not satisfying the CC rule, see Chellas' CKD [Chellas, 1980] (a nonnormal modal deontic logic) and Hansson's Preference Deontic Logic (PDL) [Hans­ son, 1990].

7 1t may be argued that the premise O(a -+ t I T) does not represent the conditional obligation correctly. How­ ever, [Horty, 1993] gave an example (adapted from an ex­ ample of [van Fraassen, 1973]) in which similar inferences are made from the premises O(a V s I T) and 0( ·a I T), where a

Example 2.4 Consider the premises O(a I T) and O(a ~ t I T). The intuitive obligation O(t I T) is de­ rived from the two premises by CC. However, from this derived obligation the counterintuitive O(t I -,a) can be derived by SA or RSAo .

The examples show that CTD reasoning, i.e. reason­ ing about subideal behavior, cannot be formalized sat­ isfactorily in a defeasible deontic logic with only over­ ridden defeasibility. Hence, we cannot accept SA (or RSAo), represent (a-temporal) CTD obligations and ac­ cept DD or CC.

2.3 Factual defeasibility

As an illustrative example of a formalization of factual defeasibility, we discuss the so-called non-violability con­ dition Cv of our deontic logic DIODE, see [Tan and van der Torre, 1994a; 1994c]. DIODE is a diagnostic model for deontic reasoning based on Reiter's theory of diagnosis [Reiter, 1987]. The underlying idea of DIODE is that violated obligations are analogous to faulty components in diagnostic reasoning. In DIODE, the assumption-based reasoning discussed in Example 2.3 is related to the assumptions about faulty components made in diagnostic reasoning.

Assume a finite propositional base logic £ and labeled dyadic conditional obligations O(a I f3)L with a, {3 and L sentences of£. Roughly speaking, the label Lis a record of the consequences of the premises that are used in the derivation of O(a I {3). Each formula occurring as a premise has its own consequent in its label. We assume that the antecedent and the label of an obligation are always consistent. The label of an obligation derived by an inference rule is the conjunction of the labels of the premises used in this inference rule. The non-violability condition Cv is used to realize the K antian principle that 'ought implies can'. Informally, the premises used in the derivation tree are not violated by the antecedent of the derived obligation, or, alternatively, the derived obligation is not a CTD obligation of these premises.

can be read as the fact that you are in the army and s as the fact that you perform alternative service. Moreover, when DD is not accepted and CC is, then this leads to semantic problems as [Tomberlin, 1981] showed for Mott's solution of the Chisholm 'Paradox' [Mott, 1973].

It can easily be checked that for example RSAv is better than RSAa, because RSAv yields all of the in­ tended conclusions of the Examples 2.1-2.4, but none of the counterintuitive conclusions produced by RSA0 .

The reader might wonder why we consider condition Cv to be a type of factual defeasibility. In this section, we only discuss conditional obligations, and how these can be derived from each other . Facts do not seem to come into the picture. However, a closer analysis reveals that factual defeasibility is indeed the underlying mech­ anism. First of all, the antecedent of a dyadic obligation restricts the focus to possibilities in which the antecedent is assumed to be factually true, and the consequent rep­ resent what is obligatory, given that these facts are as­ sumed. Hence, the consequent refers to 'the best of those possibilities that remain'. The Kantian principle 'ought implies can' states essentially that what ought to be the case (i .e. the consequent) has to be possible given these assumed-to-be-true facts (i.e. the antecedent). This is the meaning of 'can' here. An analogy that illustrates that the Kantian Principle induces factual defeasibility is to compare the DDv rule with its default logic coun­ terpart. The order of application of default rules in the generation of an extension can be compared to the tran­ sitivity of obligations in the DDv rule. For example, the default ~ can be applied after the default 7/-, because the consequent of the first can be used to obtain the pre­ requisite of the second. But this chain would be broken, if 'Y would factually defeat (3 (and assuming there is no other way to obtain (3).

The Examples 2.1-2.4 show that CTD structures sometimes look like overridden defeasible reasoning structures , but a careful analysis shows that they are actually cases of factual defeasibility. The difference be­ tween the conditions Co and Cv explains the confusion between CTD structures and overridden structures in Example 2.2, because in this example the two restric­ tions coincide for strengthening of the antecedent.

We introduced Cv in DIODE to deal with CTD obli­ gations. This condition is analogous to a proposal of Van Fraassen [van Fraassen, 1973], which was formal­ ized by Horty [Horty, 1993] in Reiter's default logic. They introduced it to represent moral dilemmas, de­ antic inconsistencies like O(p I T) and 0( ·P I T) . See [Horty, 1993] for the motivation and [Tan and van der Torre, 1994a] for the comparison with DIODE. For other proposals of factual defeasibility, see Hansson's dyadic deontic logic [Hansson, 1971] (no strengthening ofthe antecedent) and Boutilier's extension of Hansson's logic [Boutilier , 1994b].

2.4 Facticity

As discussed in Section 2.1, in dyadic deontic logic ought refers to 'the best of those that remain'. Dyadic obliga­ tions O(a I /3) can be read as 'a is the case in the best states where (3 is the case'. The following rule of facti city F is intuitive under this reading of conditional obliga­ tions. As has been pointed out many times, see e.g. [Al­ chourr6n, 1994], F is counterintuitive with the original reading of the dyadic obligations, because it says that 'if a is the case then a ought to be the case'.

The next example shows a possible use of F.

Example 2.5 Consider the single premise O(a ---+ t I T). The obligation O(a ---+ t I a) is derived from the premise by RSAv and the obligation O(a I a) is derived by F. From these two obligations the intuitive obligation O(t I a) is derived by CCv.

3 Cancelling versus Overshadowing

In this section we analyze the derivation of absolute obli­ gations from the dyadic obligations in a defeasible dean­ tic logic. To keep our analysis as general as possible, we only accept the inference pattern RSAo for the dyadic obligations. The inference pattern that derives absolute obligations from conditional obligations is called factual detachment . To represent the detached absolute obliga­ tions we assume monadic modal obligations O(a). No further properties of the monadic operator are assumed. The simplest definition of factual detachment is the fol­ lowing rule FD, alias deontic modus ponens.

Obviously, FD is not acceptable in a defeasible deontic logic, because it detaches overridden obligations. The following exact factual detachment rule EFD does not derive overridden obligations. Here, it is formalized with Levesque's All-I-Know (alias only knowing) operator A (see [Boutilier, 1994a]) . A(a) is true when a is logically equivalent with the conjunction of all factual premises that are given.

Note that EFD yields a kind of overridden defeasi­ bility with respect to factual detachment. If we have, for example, as premises O(a I /3) and 0(-.a I (3 1\ "f) , then EFD derives the conclusion O(a) if we only have as factual premises (3. However, if we have as factual premise (3 1\ 'Y, then EFD derives from these two obli­ gations 0 (-.a) . If EFD is accepted then the relation between facts and absolute obligations is identical to the relation between antecedent and consequent of the con­ ditional obligations.

The following so-called fence example was introduced in [Prakken and Sergot, 1994]. It is an extended version of the so-called Forrester 'Paradox': you should not kill, but if you kill you should do it gently [Forrester, 1984].

Example 3.1 (Forrester 'Paradox) Consider the premises O(·f I T), O(w I f) and O(w I c) with back­ ground knowledge w -+ f, where f can be read as the fact that there is a fence around your house, w similarly for a white fence and c for a cliff next to your house. We assume that the background knowledge is incorporated in the definitions of Co and Cv in the obvious way. Notice that O(w I f) is a CTD obligation of O(·f I T) and O(w I c) is not.

Let F be the conjunction of all factual premises. When there is a fence and a cliff, F = f /\ c, the first premise is intuitively overridden, and therefore it is not violated. Hence, the obligation 0(-.J) should not be derivable. If there is a fence without a cliff, F = f, the first premise is intuitively not overridden, and therefore it is violated. Hence, the obligation 0( ·f) should be derivable.

The obligation 0( ·f I f /\c) is not derived from 0( ·f I T) by RSAo, because it is overridden by O(w I c). The counterintuitive obligation 0( ·f) can therefore not be derived by RSAo and EFD from 0( ·f I T) and F = f /\c. However, the obligation 0( ·f I f) is not derived either from 0( ·f I T) by RSAo, because it is overridden by 0( w I f) according to Co. Because 0( ·f I f) is not derivable, the intuitive obligation 0( ·f) cannot be derived by RSAo and EFD from 0( ·f I T) and F = f.

The problem in this example is that both 0( w I f) and O(w I c) are treated as more specific obligations that override the obligation 0( ·f I T) , i.e. both are treated as cases of overridden defeasibility. However, this is not correct for O(w I f). This last obligation should be treated as a CTD obligation, i.e. as a case of fac­ tual defeasibility. What is most striking about the For­ rester 'Paradox' is the observation that when the premise 0( ·f I T) is violated by f, then the obligation 0( ·f) should be derivable, but not when 0( ·f I T) is overrid­ den by f /\ c. This means that violation or overriding of 0( ·f I T) are quite different in the sense that they have different consequences. This overriding can be viewed as a type of overridden defeasibility and the violation as a type of factual defeasibility. Hence, also the Forrester 'Paradox' shows that factual and overridden defeasibility lead to different conclusions. Moreover, it is exactly the difference between cancellation and overshadowing that we discussed in the introduction of this paper. Overrid­ ing of 0( ·f I T) by f /\ c means that 0( ·f) is cancelled and has no force anymore. Violation of 0( ·f I T) by f means that 0( ·f) has still its force , it is only over­ shadowed and not cancelled. Hence, this is a kind of factual defeasibility which differs from its counterpart in default logic in the sense that it is overshadowing factual defeasibility rather than cancelling factual defeasibility.

One obvious way to solve the problem mentioned in Example 3.1. is to say that condition Co is too strong. In [van der Torre, 1994] we gave an ad hoc solution of the previous problem by weakening the definition of overrid­ den with an additional condition which represents that a CTD obligation cannot override its primary obligations.

C0: there is no premise O(o:' I (3') such that (3 /\ 1 logically implies (3', (3' logically implies (3 and not vice versa, o: and o:' are inconsistent and o: and (3' are consistent. [van der Torre, 1994]

This definition gives the intuitive conclusions and not the counterintuitive ones with EFD, as the following ex­ ample shows.

Example 3.2 RSAo with C0 derives 0( ·f I f) from 0( ·f I T), but it does not derive 0( ·f I f /\ c). The counterintuitive obligation 0(-, f) still cannot be derived by RSAo and EFD from 0( ·f I T) and :F = f /\ c. The intuitive obligation 0( -.f) can be derived by EFD from 0( ·f I f) and :F = f . Hence, RSAo with C0 and EFD derive exactly the intuitive obligations.

Another more sophisticated solution is to change the EFD rule instead of Co. The most important advan­ tage of changing EFD is that this is also a solution when RSAov is accepted. The condition Cv of RSAov ensures that the consequent and the antecedent of a dyadic obligation are always consistent . This consistency is a formalization of the Kantian principle 'ought im­ plies can', as we discussed in Section 2.3. However, with RSAov and EFD, o: and 0(-.o:) will never be true at the same time, so violated obligations are not represented by the absolute obligations. Another advantage of changing EFD instead of Co is that it is less ad hoc. In [van der Torre, 1994], we had to further adapt the definition of C0 for another notorious (and highly ambiguous) 'para­ dox', the so-called Reykjavic 'Paradox' [Belzer, 1986]. A third advantage of changing the EFD rule is that EFD cannot formalize fulfilled obligations satisfactorily. A fulfilled obligation is something that ought to be the case and that is also factually the case. For example, in the Forrester 'Paradox' the obligation 0( ·f) /\ ·f could represent that there is no fence, and the obligation that there ought to be no fence is fulfilled. However , when the weakening of the consequent rule WC: 0~~~~1) is accepted, then O(f I f) can be derived from O(w I f) . From O(f I f) and :F = f the absolute obligation O(f) can be derived by EFD, although the fence is certainly not a fulfilled obligation. Moreover, if the inference rule F is accepted, then all facts are detached as absolute obli­ gations by EFD. We will show that this can be solved by changing the definition of EFD.

To formalize a notion of factual detachment that ig­ nores overridden defeasibility in case of violated obliga­ tions, we introduce the following so-called retraction test

(R-test). The test says that if we consider whether a:: is absolutely obligatory, we have to consider possibilities in which a:: is true and possibilities in which a:: is false.

R-test: a:: is obligatory (O(a::) is an absolute obligation) iff a:: ought to be the case on the assumption that ·a:: and a:: are not the case, i.e. on the assumption that a:: is contingent.

The R-test can be considered as a version of the Kan­ tian principle for factual detachment. In this interpre­ tation of 'ought implies can', ought refers to the abso­ lute obligations and can means that neither ·a:: nor a:: is factually the case. The R-test can be formalized as follows, where '-' is a retraction operator satisfying the Giirdenfors postulates [Gardenfors, 1988]. For simplicity we write retraction as a::= /3- {'Y;}, where a::, /3 and ri are sentences of .C. a:: is the result of the retraction of the ri from /3, and therefore 0:: does not derive any of these ri·

Notice that this formalization inherits problems of retraction, i.e. that it is not unique and computa­ tionally complex. For this reason, we will use a very simple notion of retraction, that suffices for our pur­ poses. We only consider cases where (3 is a conjunc­ tion of literals (atoms, possibly preceded by a negation sign) and a:: a literal. For this simple case, the retrac­ tion (3 - {a::, ·a::} is simply the deletion of a:: and ·a:: from (3. This type of retraction can be illustrated with the following examples. If a:: = ·f and (3 = f, then O(·f I f- {·f,f}) = O(·f I T) . If a:: = ·f and f3 = f 1\ c, then O(·f If 1\ c- {·f, !}) = O(·f I c). So, if we want to derive 0( ·f) with RFD and the premise A(f 1\ c), then we need O(·f I c) as other premise.

We reconsider the Forrester 'Paradox' with this simpli­ fied notion of retraction and we show that RFD derives exactly the intuitive conclusions.

Example 3.3 Let :F be the conjunction of the factual premises. First consider the situation when there is a fence but not a cliff, i.e. :F = f. The absolute obliga­ tion 0( ·f) can be derived from 0( ·f I T) and A (f) by RFD.

Now consider the situation when there is a fence and a cliff, i.e. :F = f 1\ c. The absolute obligation 0( ·f) cannot be derived by RFD, because the derivation via 0( ·f I c) from 0( ·f I T) is blocked by Co.

In the previous example, RFD and RSAov yield ex­ actly the same intuitive conclusions as EFD and RSAo with C0. The rules RFD and RSAov are in our opin­ ion more appropriate to model defeasible deontic reason­ ing than the rules EFD and RSAo with C0, because RSAov is preferred over RSAo, as we argued in the previous section. Another advantage of RFD is that the R-test is very intuitive and not an ad hoc like solution of the problem like the adaptation of Co. Finally, RFD also formalizes an intuitive notion of fulfilled obligations, because it deals with fulfilled obligations in exactly the same way as with violated obligations.

The relation between EFD and RFD is given by the following lemma.

Lemma 1 Let :F be the conjunction of the factual premises. If a:: and ·O:: are not in Cn[:F], where Cn stands for consequence set, then O(a::) is derived by EFD iff it is derived by RFD.

Proof From the Giirdenfors postulates follows that Cn[:F- {a::}]= Cn[:F] when F 1\ ·O:: is consistent.

4 Further research

In this paper we only considered examples in which overridden defeasibility is always of the cancelling type. However, Ross gave in [Ross, 1930] also examples of so­ called prima facie obligations that can be considered as overridden defeasibility of the overshadowing type. We will study how this can be analyzed in our framework. We will also study the relation between the R-test and the Ramsey test in conditional logic. The crucial differ­ ence between the R-test and the Ramsey test is that in the R-test the consequence is taken into account.

Acknowledgement

We thank Patrick van der Laag for several discussions on the issues raised in this paper, and Henry Prakken for his critical comments.