McCarthy’s starting point is the advice-taker programme: represent what a machine knows in logic, then let deductions guide action. This sounds straightforward until an action law is written. “If I enter the boat and row, I reach the other bank” is too strong. A leak, a missing oar or an unexpected obstacle defeats it. Adding those qualifications still leaves further possibilities. The defect is not merely that the author forgot a longer checklist. Ordinary environments are open-ended.

A human reader handles the gap by adopting a normal interpretation. Unless the description gives reason to suspect a defect, the boat is treated as usable. That conclusion is not a theorem of the sparse description. It is a conjecture licensed by the way the description is intended to be completed. McCarthy’s aim is to make this completion move visible rather than hide it in a procedural “common sense” routine.

The paper introduces a predicate such as prevents. Axioms state known conditions under which an entity prevents an action from succeeding. Circumscription then says, roughly, that the entities provably required to be preventers are all the preventers there are. If the theory forces no instance, the extension of prevents is empty. The boat plan may proceed: not because every imaginable hazard was disproved, but because no hazard is forced by the information deliberately taken into account.

This is a rule of conjecture, and McCarthy repeatedly treats it that way. In a puzzle, the convention that only mentioned objects exist may make the conclusion feel deductive. In the world, the same move is provisional and may require caution. Circumscription does not turn ignorance into certainty; it specifies which ignorance the reasoner is permitted to close.

Suppose a description names three blocks, A, B and C, and the reasoner circumscribes the predicate isBlock. The preferred interpretation contains exactly those required instances. From the completed theory the reasoner may conclude that every block is A, B or C. When a new fact says that D is also a block, the earlier universal conclusion is withdrawn. The new theory has a different minimal interpretation.

No classical derivation is being reversed within a fixed premise set. The old theory plus its circumscription had one set of consequences; the enlarged theory plus a newly computed circumscription has another. McCarthy therefore calls the method non-monotonic reasoning that augments ordinary first-order logic. In his later remarks he explicitly resists describing it as a replacement “nonmonotonic logic”.

The distinction matters for implementation. It is unsafe to materialise a circumscriptive conclusion and later treat it as an irrevocable fact. Its provenance must record which predicate was minimised, which theory was taken into account and which competing interpretations were excluded. Revision means recomputing that preference when relevant information changes.

It also matters epistemically. A negative conclusion such as “no other blocks exist” is not the same as having inspected the universe and found none. It expresses a closure policy. Different tasks may close different predicates, and a system may decline to close any predicate when the costs of surprise are high.

Let A(P) be a first-order sentence containing P. Write A(Φ) for the result of replacing occurrences of P by a predicate expression Φ of the same arity. The schema says: if A(Φ) holds and every Φ-instance is already a P-instance, then every P-instance is a Φ-instance. The two inclusions force P and Φ to coincide whenever Φ is a qualifying smaller candidate.

The subset condition is crucial. Without it, a merely different interpretation satisfying A could be compared as if it were smaller, and a disjunctive example could collapse into contradiction. McCarthy credits suggestions by Ashok Chandra and Patrick Hayes for the conjunct. This historical detail reveals that the final formula is not ornamental notation: each clause protects the intended partial order.

Φ is a predicate parameter. In a schema reading, each expressible predicate expression gives an instance. In a second-order reading, one can quantify over Φ directly. McCarthy discusses both, but the paper’s syntactic development emphasises the schema. Ordinary first-order theorem provers did not natively manage newly generated schemata, so the formal definition did not itself deliver a practical proof procedure.

The rule minimises extension, not description length, probability or numerical cost. P is “small” when its set of satisfying tuples is included in another candidate’s set. Two incomparable candidates may both be minimal. Circumscription therefore need not choose a single world.

For models M and N on the same domain, with identical interpretations for symbols other than P, M is at least as preferred as N when P’s extension in M is a subset of P’s extension in N. A model is P-minimal if no strictly smaller comparable model also satisfies A. A formula is minimally entailed when it is true in every such minimal model.

This qualification: holding the other vocabulary fixed: is easy to lose in a popular gloss. If another predicate changes while P shrinks, the models are not comparable under McCarthy’s basic definition. Later generalisations explicitly distinguish minimised, fixed and varying predicates. The 1980 paper already points towards the problem, and its author-hosted page says the treatment was substantially superseded by later work that handles non-minimised variables more carefully.

McCarthy proves that every instance of the syntactic schema is true in every P-minimal model. Consequently, derivability from the circumscription schema is sound for minimal entailment. He does not prove that the schema captures every truth of every minimal model. The direction matters: soundness is not completeness.

Minimal models may fail to exist. Infinite descending chains can keep shrinking P without reaching a least admissible extension. The definition therefore cannot be treated as a guarantee that every theory produces an answer. Finite propositional examples avoid this existence problem because a finite partial order always has minimal elements among a non-empty set of models, but that is a restriction of the laboratory, not a theorem about the full first-order setting.

The familiar puzzle supplies a boat and a safety constraint. A solver is expected to search a compact state space. An “inventive dunce” can derail the task in either direction. It may propose a bridge, helicopter or winged horse never mentioned in the problem. It may also refuse the given boat because the text did not explicitly deny leaks, missing oars or a sea monster.

People understand a convention: the objects and abnormalities specified by the problem are the relevant ones. Domain circumscription can close the object inventory; predicate circumscription can close abnormality or prevention relations. Together they reconstruct the intended problem rather than the extravagant set of every logically possible situation.

McCarthy argues that probability and fuzzy logic do not automatically repair this omission. Before probabilities can be assigned, the relevant alternatives must be represented. A system that has not introduced helicopters or monsters into its sample space cannot solve the modelling problem by attaching them tiny probabilities. Conversely, a system that enumerates boundlessly many peculiarities cannot rely on a number alone to identify the intended normal interpretation.

The example is also a warning. The puzzle convention is supplied by authors and readers. Real environments do contain unmentioned objects. Circumscribing a domain in an emergency-planning system may be reckless. The formalism makes the closure assumption explicit enough to debate, scope and reverse.

Take a predicate isNat with axioms saying that zero is natural and the successor of a natural number is natural. Many interpretations satisfy those closure conditions, including supersets with unrelated elements. Circumscribing isNat selects the least successor-closed set containing zero. The resulting schema has the force of mathematical induction: any property containing zero and closed under successor contains every natural number.

A relational example begins with on and defines above as a transitive relation containing on. Without minimisation, above may contain arbitrary additional pairs. Circumscribing above leaves exactly the transitive closure forced by the direct on relations. If A is on B and B is on C, A must be above C; an unrelated pair need not be.

These examples clarify the mechanism. Circumscription does not always mean “assume abnormal things are false”. It is a general least-extension construction for a predicate constrained by a theory. Its conjectural status depends on whether the axioms fully characterise the intended closure. Natural-number induction is not withdrawn because an unexpected number appears; a boat-normality conjecture is.

They also reveal a computational pattern familiar today. Start with mandatory seeds, repeatedly apply closure rules until no new tuple appears, and reject gratuitous additions. For finite monotone rules this can be implemented directly. The first-order schema is broader and its proof-theoretic behaviour is correspondingly less tame.

Ordinary first-order semantics allows a model’s domain to contain unnamed elements. Even if isBlock is minimised, there may be objects outside the explicit list that do not satisfy it. For puzzles and finite scene descriptions, the intended interpretation may instead close the whole domain. McCarthy develops a comparison between models with smaller and larger domains, subject to agreement on their common part.

He then reduces the idea to predicate circumscription. Introduce a fresh predicate, often read as all, relativise quantifiers in A to it, and add axioms requiring every constant to be in all and every function to preserve membership in all. Circumscribing all selects the smallest subdomain closed under the language’s constants and functions that satisfies the relativised theory.

The function-closure condition prevents a fake domain from containing an input while omitting the value of a named function applied to it. With zero and successor, the smallest closed domain contains zero, its successor, the next successor and so on. Domain circumscription then again produces induction-like consequences.

Domain closure is powerful and dangerous. It can formalise the implicit inventory of a word problem. It can also suppress genuinely unknown entities. A robust knowledge system should distinguish “not in the closed task model” from “does not exist in the operating environment”.

Consider moving block A onto C in situation s₀. A law says that performing the move produces on(A,C) unless something prevents the move. Other axioms identify known preventers: the object is not a block, the destination is covered, or the moving block is too heavy. The reasoner takes the relevant facts into account and circumscribes the specialised prevention predicate for this action and situation.

If no object is forced to prevent the move, substituting the always-false predicate for Φ makes the antecedent of the schema provable. The reverse inclusion then yields that nothing prevents the action. The ordinary action law supplies the resulting on-relation. The chain is inspectable: minimisation establishes absence of a preventer; classical deduction uses that absence.

The premise that A is not too heavy may itself be explicit, or it may be another conjecture licensed by circumscribing a suitable abnormality predicate. Layering such moves requires care. What is fixed during one minimisation, and what is allowed to vary, affects the result. Later circumscription formalisms make priorities and varying predicates more systematic.

McCarthy also sketches a circumscriptive approach to the frame problem. Things not proved to move may be assumed to remain where they are. This can be more flexible than a long list of frame axioms, especially when attached objects must move together. But minimising change is a modelling choice; it cannot decide by itself which indirect effects count as necessary.

A blocks world can be described using on, above, heights and horizontal positions, or richer spatial relations. Minimising on retains only necessary direct contacts. Minimising above retains a necessary transitive relation. Minimising a position-change predicate supports persistence. These operations answer different closure questions.

McCarthy calls this an epistemological consequence of representation. Choosing predicates resembles choosing a coordinate system, but it goes further: some conjectures become natural and others awkward. A vocabulary organised around abnormalities makes “normally succeeds” cheap to express. A vocabulary that encodes every mechanism directly may distribute the same exception across many predicates.

This sensitivity is not necessarily a defect. Learning and reasoning always depend on which distinctions are represented. The merit of circumscription is that the dependence becomes formal enough to inspect. The danger is believing that two classically equivalent formulations will produce the same non-monotonic consequences. They need not.

Production systems therefore need a representation audit. Which symbols are minimised? Which are held fixed? Which may vary? Are two concepts merely definitionally related, or will minimising one privilege a different model order? What new observations are allowed to retract the resulting conjectures? These questions belong in the knowledge-base contract, not only in the theorem prover.

The disjunctive-block scenario requires Block(A) ∨ Block(B). It has two incomparable singleton minima. The sceptical intersection is empty, while the possible union contains both atoms. This separates “true in every preferred model” from “true in at least one”.

The preventer scenario imposes no positive requirement on leak, missing-oar or monster. The empty set satisfies the theory and is strictly below every non-empty assignment. It is the unique minimal model, reconstructing the normal puzzle completion. The output does not prove that the physical world is safe; it displays what follows from the chosen finite closure policy.

The closure scenario requires Above(A,B) and Above(B,C), plus a transitivity clause that forces Above(A,C) when both are true. Its unique minimum contains exactly those three pairs. The test demonstrates how minimisation removes gratuitous tuples after the closure rules determine what cannot be removed.

All three checks are exact for these inputs. Soundness verifies that each displayed assignment satisfies every clause. Minimality searches all proper subsets for a satisfying competitor. Completeness independently enumerates all satisfying assignments and confirms that every minimal one is displayed. This is stronger than sampling but only because each vocabulary has three atoms.

First, the schema is not a push-button algorithm. A reasoning programme needs domain-dependent heuristics for selecting the predicate, selecting the facts to include and deciding when revision is required. Sentence schemata were already awkward for general-purpose resolution provers, and a new schema produced for each situation adds control problems.

Second, irrelevant facts are benign only under a precise condition. Facts that do not contain the circumscribed predicate reappear unchanged on the antecedent side, so their original versions can help prove that side. Facts that do constrain the predicate are not irrelevant; they can alter the minima. Scope is semantic, not a bag-of-documents convenience.

Third, representation dependence is fundamental. A closure policy over one vocabulary can disagree with a policy over another. McCarthy treats useful circumscription as a criterion for choosing predicates, which turns ontology design into part of reasoning design.

Fourth, the later addendum compares circumscription with McDermott–Doyle nonmonotonic logic and Reiter’s default logic. McCarthy distinguishes minimal-model reasoning from systems concerned with arbitrary models and explores using schemata to internalise parts of model theory. His train-crossing example also exposes a case where cautious possibility: if a train may be present, do not cross: does not fit comfortable “normally false” minimisation.

Later research sharpened the computational picture. Propositional circumscriptive inference is generally high in the polynomial hierarchy, minimal-model checking is coNP-complete in broad settings, and counting minimal models can be harder still. Nested abnormality theories support modular representations but may reach PSPACE complexity with unrestricted nesting. These are later results, not claims of the 1980 article.

McCarthy’s Stanford landing page places another boundary on the source itself. The author-hosted PDF is a later version with an addendum that was absent from the published article, and the page says the formalism was substantially superseded by his 1986 applications paper, especially in its treatment of variables not minimised. This companion uses the 1980 publication as the primary historical unit while labelling later additions as such.

Begin by naming the target predicate. “Assume normality” is too vague. Is the system minimising faults, exceptions, object inventory, change events, direct relations or all of them? Each target induces a different order over models and a different revision surface.

Separate forced content from preferred completion. Store observations and strict constraints in the base theory. Compute minimal extensions as a derived layer, and retain links from each conclusion to the theory snapshot and minimisation policy that produced it. When a new fact arrives, the system can invalidate the affected completion without erasing the underlying observation.

Expose plurality. If there are incomparable minimal models, show them or declare the projection policy. Sceptical reporting returns only what every minimal model shares. Possible reporting returns what at least one contains. Choosing one model requires an additional priority, cost, probability or decision rule that circumscription alone does not provide.

Audit comparability. Record which symbols are fixed and which may vary. A smaller abnormality set achieved by silently changing the patient, time, action or background relation is not necessarily a preferred model under the intended policy. The comparison contract is as important as the minimised predicate.

Bound computation honestly. A finite propositional enumerator can certify completeness by visiting every assignment, as the laboratory does. A first-order system cannot borrow that guarantee. Production documentation should state the language fragment, solver strategy, timeout behaviour and meaning of “no answer”.

Finally, attach risk to closure. In a puzzle, an empty preventer set is the intended convention. In medical, industrial or transport settings, unknown hazards may demand open-world caution. Circumscription is a disciplined way to close a world; it is not a universal argument that the world should be closed.

Review one: formal fidelity and pedagogy. The reconstruction was checked across the complete 19-page author-hosted version: qualification, the missionaries-and-cannibals discussion, predicate replacement, the subset conjunct, block examples, induction, transitive closure, domain circumscription, minimal-model semantics, the soundness theorem, action prevention, frame persistence, eight remarks, references and the later addendum.

The largest formal risk was calling a model “smaller” while allowing unrelated vocabulary to change. The article now states McCarthy’s comparability condition before presenting minimality. A second risk was turning soundness into equivalence. The paper proves that schema instances hold in minimal models; the companion makes no completeness claim.

Review two: evidence boundaries and executable delivery. The primary publication date and DOI are tied to the 1980 journal record. The Stanford PDF’s later addendum and revision date are identified instead of being silently attributed to the original article. Complexity results, varying-predicate formalisms and nested circumscription are labelled as later context.

All ten figures have accessible titles, descriptions, captions and scoped source notes. Animation is redundant and disabled for reduced-motion users. The finite laboratory enumerates every candidate, checks clause satisfaction, verifies subset minimality and independently confirms completeness in all nine scenario/report combinations. It does not claim first-order coverage.

Reiter’s extensions are fixed points generated by strict facts and applicable defaults. McCarthy’s preferred interpretations are models in which selected properties or relations have no unnecessary instances. Both formalise conclusions that can disappear when information grows, yet their explanatory units differ: one exposes defeasible rules, the other exposes a minimisation policy.

The 1980 journal issue placed circumscription, McDermott–Doyle nonmonotonic logic and Reiter’s default logic in direct conversation. McCarthy’s later addendum explicitly compares their concern with minimal or arbitrary models and their use of schemata or model-level conditions. The canon therefore treats them as neighbours, not interchangeable notations.

Canon 0095 moves to Drew McDermott and Jon Doyle’s “Non-Monotonic Logic I”. Its modal account of consistency and truth-maintenance tradition will supply a third architecture for beliefs that survive only while their supporting state remains coherent.