Guy Politzer

Jean Nicod

Deductive Reasoning Under Uncertainty: A Water Tank Analogy

Keywords: Uncertain reasoning, inference schemas, de Finetti's coherence, probability logic, qualitative reasoning

This paper describes a cubic water tank equipped with a movable partition receiving various amounts of liquid used to represent joint probability distributions. This device is applied to the investigation of deductive inferences under uncertainty. The analogy is exploited to determine by qualitative reasoning the limits in probability of the conclusion of twenty basic deductive arguments (such as Modus Ponens, And-introduction, Contraposition, etc.) often used as benchmark problems by the various theoretical approaches to reasoning under uncertainty. The probability bounds imposed by the premises on the conclusion are derived on the basis of a few trivial principles such as "a part of the tank cannot contain more liquid than its capacity allows", or "if a part is empty, the other part contains all the liquid". This stems from the equivalence between the physical constraints imposed by the capacity of the tank and its subdivisions on the volumes of liquid, and the axioms and rules of probability. The device materializes de Finetti's coherence approach to probability. It also suggests a physical counterpart of Dutch book arguments to assess individuals' rationality in probability judgments in the sense that individuals whose degrees of belief in a conclusion are out of the bounds of coherence intervals would commit themselves to executing physically impossible tasks.

Introduction

The main objective of the present paper is to describe in a diagrammatic form a physical implementation of the application of the laws of probability to deduction with uncertain premises, which will be shown to be identifiable with [START_REF] De Finetti | La prévision, ses lois logiques, ses sources subjectives[END_REF] coherence based theory of probability.

For a long time communicators have made use of various graphical representations that help acquire, process and mentally represent cross-classified categorical data (see Friendly, 2002, for an historical account). However helpful contingency tables may be, they do not count as diagrammatic representations because they are just typographical displays showing rows and columns of numbers that do not possess the analogical or computational qualities of diagrams. A crucial step is reached when the table is divided into rectangles whose areas are proportional to the quantities present in the joint distributions. This type of representation was developed in detail by [START_REF] Hartigan | Mosaics for contingency tables[END_REF] under the name of "mosaic", mainly as a tool to expose deviation from independence. It had been used earlier without elaboration by Bertin (1967 p. 256) and Edwards (1972, p. 47). Edwards' diagram (Figure 1) illustrates the joint distribution of boys and girls in a school crossed with long-haired and short-haired children. The fundamental characteristic of this diagram is that the areas of the various rectangles are proportional to the products of the marginal probabilities. More recently, Oldford (2003a[START_REF] Oldford | Probability, problems, and paradoxes pictured by eikosograms[END_REF]Oldford & Cherry, 2006) investigated the properties of diagrams of this type, which he called "eikosograms" (for "probability drawing"). He showed their usefulness to represent concepts such as conditional probability, conditional and unconditional dependence or independence. Considering a wide range of puzzles (e.g., the prisoner's dilemma, the Monty Hall, Simpson's paradox), classic problems (e.g., the Engineer-and-Lawyer problem) and applications (e.g., medical tests), his demonstration of the effectiveness of eikosograms to represent the information and calculate the solution is deeply impressive. In these papers Oldford mentioned an interpretation of the diagrams in terms of a "water container metaphor" to infer a marginal value when the joint probabilities are known but did not pursue this idea any further. Moreover, the use of the diagrams was strictly limited to problem solving. In fact, the way in which mosaic representations are commonly used is static. They display sets of data in which all values (generally frequencies) are known or determined, and aim to help exhibit relations of dependence leading to the solution.

The present paper too uses a diagrammatic representation of probability that belongs to the mosaic type, but concerns itself with a different domain. It is not devoted to statistical or probabilistic problem solving, but to probabilistic logic, and it adopts a dynamic representation, in which the values in the diagram can vary. Using a two-compartment water tank presented in a diagrammatic form, it develops an analogy of the laws of probability and conditional probability, subsequently applied to deductive schemas of inference. It will be used to derive and illustrate an answer to the major question posed by deduction with uncertain premises: what degrees of belief is it rational to attribute to the conclusion of an inference, given the probability of the premises?

In the first section of the paper the basic diagram, the probabilistic interpretation of its components, and the representation of elementary laws of conditional probability are presented. In the main part it is shown how inference schemas are interpreted in terms of the analogy and how the probability of their conclusion is obtained by virtual operations on the Uncertain Deduction by Analogy 6 device, while the validity of the inferences with respect to several criteria is systematically examined. The last section presents a brief discussion of the relationship between the physical principles used in the tank analogy and the axioms and rules of probability theory, in particular with [START_REF] De Finetti | La prévision, ses lois logiques, ses sources subjectives[END_REF][START_REF] De Finetti | Theory of probability[END_REF] theory.

The water tank analogy

2.1.The basic diagram

A cubic tank has a movable partition (parallel to one side) that divides it into two compartments, left (A) and right (A'). In what follows, all the diagrams represent a vertical cross-section of the tank perpendicular to the partition (see Figure 2). Each compartment can contain some amount of liquid independently of the other. The tank has a full capacity of 1 unit. Its overall content (occupying rate) is denoted by c (0 ≤ c ≤ 1).

The levels of liquid in A and A' are denoted by i and i', respectively. The volumes of liquid in A and A' are denoted by [ac] and [a'c], respectively. Similarly the volumes of the empty spaces in A and A' are denoted by [ac'] and [a'c'].

The contents (volumes of liquid) of A and A' are a x i and a'x i', respectively. a x i is a measure of [ac], and a'x i' of [a'c'].

Probabilistic interpretation

A is the event "the left compartment occupies the whole tank"; a is the probability of this event, that is, the degree to which the whole tank is occupied by A (which will also be denoted by P(A) ).

Calling C the event "the tank is filled up with liquid", c is the probability of C, that is, the degree to which the tank is filled with liquid (or the volume of liquid in the tank), which will also be denoted by P(C) 1,2 .

The event relative to compartment A, "A is filled up with liquid" is a conditional event denoted by C/A. This is a conditional event because the filling is restricted to the compartment A. The probability of this event, that is, the degree to which A is filled with liquid, which is the level i of liquid in A, will also be denoted by P(C/A). In other words, the level i of liquid in A represents the probability of if A then C. (Similarly the level i' in A' represents the probability of the conditional event C/A', if A' then C).

The event relative to the liquid, "all the liquid is contained in A", is a conditional event denoted by A/C, its probability denoted by P(A/C) is the degree to which all of the liquid is in A, which is the probability of if C then A.

The joint probability of A and C, P(A AND C) is represented by the liquid common to A and C, that is, the volume of liquid in A, which is measured by a Notice that the conditional event C/A has been defined as filling up the compartment A.

When considering the extent to which the compartment A is filled, the most immediate indication of its value is the level of liquid in it. An indication in terms of volume is informative only indirectly, after considering the capacity of A and taking the ratio of the volume inside A to its capacity. In other words, it is more natural to choose the conditional probability as a primitive notion and derive the probability of the conjunction from it rather than the other way round.

The correspondence between the physical features constitutive of the water tank and the axioms of probability are the following:

1) The measures of volume or capacity are ≥ 0. This is the counterpart of the requirement that the probability of an event E defined on a sample space Ω be such that P(E) ≥ 0.

2) The tank (or a compartment) cannot contain more than its capacity. This is the counterpart of P(Ω) = 1 and P(A/A) = 1, respectively.

3) Given an amount of liquid in the tank (or in a compartment), adding some more liquid results in an amount whose volume is the sum of the two. This the counterpart of the axiom of additivity.

This extends the correspondence between the axioms of probability and the graphic features of eikosograms shown by Oldford & Cherry (2006).

Elementary rules

The water tank analogy allows an easy representation of the total probability rule. The water tank also allows a clear representation of Bayes' rule and probabilistic independence, as eikosograms do (Oldford & Cherry, 2006). With our current interpretation and notations, these are as follows.

2.3.1.The total probability rule

It is obtained by adding the contribution of each compartment to the whole (see Figure 2).

c = [ac] + [a'c] = (a x i) + (a' x i')

Uncertain Deduction by Analogy 9

Bayes' rule

The amount of liquid in A, [ac], can be viewed as the part of A that is filled, a x P(C/A), or the part of liquid that is in A, c x P(A/C) (see Figure 3a), hence: a x P(C/A) = c x P(A/C), or:

P(A/C) = (a x i ) / c

Representation of independence

The levels are the same in A and A': c = i = i', hence: c = [ac] / a = [a'c] / a' (see Figure 3b).

Boolean operations

Boolean operations on elementary sentences can be represented in the tank analogy. As already seen, the volume of liquid contained in A (the dark shaded area [ac] in Figure 4a) is, eo ipso, the volume common to the compartment A and to C, so that it represents the conjunction A AND C. Disjunction A OR C is represented by the volume occupied by A or by the liquid (the dark shaded area in Figure 4b). Similarly, NOT-A OR C is represented by the volume that is occupied by A' or by the liquid (Figure 4c).

Deduction under uncertainty

The correspondence between the tank constituents and logical sentences

The investigation of reasoning under uncertainty, more specifically of deductive reasoning with uncertain premises, has led to the elaboration of probabilistic logics by [START_REF] Adams | A primer of probability logic[END_REF] and by [START_REF] Hailperin | Sentential probability logic[END_REF] and independently to psychological studies [START_REF] George | The endorsement of the premises: Assumption-based or belief-based reasoning[END_REF][START_REF] George | Reasoning from uncertain premises[END_REF][START_REF] Oaksford | Bayesian rationality: The probabilistic approach to human rationality[END_REF][START_REF] Politzer | Deductive reasoning from uncertain conditionals[END_REF]. More recently, a different approach has been adopted that follows de Finetti's (1937) coherence-based probability theory (see [START_REF] Coletti | Probabilistic logic in a coherent setting[END_REF][START_REF] Gilio | Probabilistic reasoning under coherence in system P[END_REF][START_REF] Pfeifer | Inference in conditional probability logic[END_REF][START_REF] Pfeifer | Framing human inference by coherence based probability logic[END_REF] for a theoretical exposition, and [START_REF] Pfeifer | The conditional in mental probability logic[END_REF][START_REF] Pfeifer | Uncertain deductive reasoning[END_REF] for psychological studies) to which we will turn later.

The representation of inference schemas in the water tank is straightforward. It suffices to consider the atomic sentences before applying Boolean operations to produce compound sentences when applicable. The representation of atomic sentences is twofold: qualitative (the event) by a constituent of the tank, and quantitative (its probability) by a variable that measures the constituent. For the events, the constituents are compartments (such as A and A' whose capacities a and a' are the associated probabilities) and volumes of liquid or of void (such as C and C' whose amounts c and c' are the associated probabilities). For conditional events the constituents are fillings (such as C/A, C/A' whose levels i and i' are the associated conditional probabilities).

In principle, any number of atomic sentences (and the associated events) can be represented because adding a sentence only requires further division of each compartment vertically 3 into two parts, and so on recursively. Most inference schemas discussed in the literature involve two or three atomic sentences, which will be the case in what follows. As is the case with mosaic displays, the limitation in the number of variables is only practical.

Rationality and inference with uncertain premises

The fundamental question that we are going to address is ''How does the degree of belief in the premises affect the degree of belief in the conclusion?" This problem can be translated as follows. Given the values (capacity, volume, level) of some component(s) of the tank, how, and to which extent, do they determine the value of another specific component? The answer is clearly dictated by the physical constraints of conservation mentioned earlier on the different constituents. This will lead us to work out a solution to the problem of the definition of a notion of validity that may be the counterpart of logical validity in standard deductive logic, and to the associated philosophical question of defining a criterion of rationality for probabilistic logic. Standard logic has a straightforward answer: because valid inference schemas are truth preserving, it is expected of rational reasoners that they endorse their conclusions (and do not commit fallacies in endorsing the conclusions drawn from invalid schemas). But the question is open when inferring from uncertain premises.

The necessity of respecting physical constraints suggests that the value of some constituents may be constrained by others, so that not any value of the target constituent may be compatible with the values of the given constituents. But it may also be the case that in some occasions the knowledge of the value of a constituent has no bearing on the value of the target constituent (it can be arbitrary) so that knowledge of the former is uninformative. In sum, a rational agent is expected to recognize the physical dependencies between the constituents of the device.

In addition to this general principle, some more precise information may be of interest to an agent. The value of the target constituent (e.g., a level) may be higher, equal, or lower than that of an initial constituent. Or it my be relevant to know whether a high value of an initial constituent guaranties a high value in the target constituent. These refinements have the following counterparts for agents engaged in reasoning with uncertain premises.

In general, it seems desirable and possibly critical for reasoners to assess whether, or to be aware that:

1) Their degree of belief in the conclusion may be higher, equal, or lower than it is in the premises. When the probability of the conclusion is no lower than the probability of at least one of the premises we will call the inference "conservative", and "dissipative" when it is no higher. More formally, an inference is conservative just in case P(conclusion) ≥ min P(premises), and it is dissipative just in case P(conclusion) ≤ max P(premises). These properties are not the negation of each other. An inference can be neither conservative nor dissipative.

2) Highly believable premises may or may not warrant a highly believable conclusion. In case they do we will say that the inference is "robust". This is entailed by conservativeness but not reciprocally 4 .

We will consider below, on a case by case basis, some specifications of these broadly defined properties. In particular, what is meant by a "high" degree of belief will be specified (see sections 3.3, 3.12, and 3.13).

In sum, inference schemas will be viewed as a relation between premises and conclusion characterizable by the limits in the degree of belief that it is rational to assign to the conclusion as a function of the degree of belief in each premise. (In the extreme case where the probability of the conclusion is unconstrained, it is totally uninformative and the inference is useless).

We now turn to the examination of various inference schemas, chosen because they are extensively discussed in the logical and philosophical literatures, to which we apply the method and the correspondence detailed above.

Uncertain Deduction by Analogy 13

And-introduction: A; C ∴ A AND C

We wish to determine the probability of the conjunction A AND C knowing the probability of its components, A, and C. That is, given the capacity a and the amount c to be poured into the tank, what can be the part of C that is in A? (see Figure 2). Trivially the part of C that could be in A, [ac], cannot exceed a nor can it exceed c itself: [ac] ≤ min {a, c}. Does the content of A have a lower bound? Filling A' as much as we can, if c is smaller than its capacity (c ≤ 1 -a), A remains empty and [ac] = 0; if c > 1 -a, A receives c -(1 -a), so that:

[ac] ≥ max {a+c-1, 0 }. Hence:

P(a) = a; P(C) = c; P(A AND C) ∈ [max {0, a+c-1}, min {a, c}]

Breaking the upper bound amounts to committing the conjunction fallacy by which the conjunction of two events is estimated as more likely than one of the conjuncts. In the present case it amounts to either trying to pour more liquid into A than its capacity allows, or claiming that the liquid that is in A exceeds the whole volume of liquid.

This inference is dissipative, as the upper bound equals the minimum of either premise.

But it is robust, as the lower bound is close to 1 when both premises have a probability close to 1. Take for instance a value of .90 to conventionally represent a "high" probability for the conclusion. This probability is warranted if the mean of the premises' probabilities is ≥ .95.

And-elimination: A AND C ∴ A A AND C ∴ C

The amount of liquid in A, [ac], being fixed, it is trivially smaller than, or equal to, either the capacity of A, a, or the total amount of liquid c, that is: [ac] ≤ a, and [ac] ≤ c. Or equivalently, if A contains [ac], its capacity cannot be less than [ac] (but it can contain more); and similarly if some of the liquid is in A there cannot be less liquid overall but there can be some more in A'. Therefore this inference is conservative.

P(A), P(C) ∈ [ P(A AND C), 1]

'And' to 'if': A AND C ∴ IF A THEN C

What are the lowest and the highest levels in A, knowing the content of the left compartment? The lowest level is obtained when A has the greatest capacity, that is when A has the greatest base, a = 1 (Figure 5a). Now moving the partition leftwards (disregarding the content of A', c being free to vary), i can only increase (Figure 5b), showing that we always have i ≥ [ac]. The limit i = 1 is reached when [ac] = a (Figure 5c). (Arithmetically of course i ≥ [ac] because the ratio i = [ac] /a is ≥ 1). In other words, if an amount of liquid in A at least as great as [ac] is warranted, then a level i that is at least as high as [ac] is also warranted, meaning that the inference from and to if, is conservative.

P(C/A) ∈ [ P(A AND C), 1 ]

Figure 5. Inference from AND to IF.

Proof by cases: IF A THEN C; IF NOT-A THEN C ∴ C

The levels of liquid i in A and i' in A' being fixed, we are looking for the volume c (see Figure 6a). We consider what happens when a varies from 0 to 1. If i = i', there is independence and c is determined and equal to i and i'. If not, assume i > i'. When a reaches 0, the level in the tank equals the volume in A', c = i' and cannot be smaller (Figure 6b).

When a reaches 1 the level in the tank equals the volume in A, c = i and cannot be greater (Figure 6c). By continuity c varies between i' and i when a varies between 0 and 1 (Figure 6a), hence a conservative inference: The answer is that i can take any value from zero to one. This is because we can always choose the capacity of A smaller or equal to both the total volume of liquid and the empty space in the tank (a ≤ min{c, c'}). Consider the case where c ≥ c'. Assume A to be initially empty (Figure 7a). Then some liquid can be poured from A' into A until A becomes full (because a ≤ c), so that i increases continuously from zero to one (Figure 7b). This applies identically to the case where c ≤ c' (Figures 7c and7d). In brief, any confidence value can be given for the conclusion: There is one particular case of special interest that has not been considered, namely the case where the tank is full. At first sight, it would seem that, contrary to our result, a full tank implies that both compartments be full, so that i could take only the value 1 when c = 1. But this does not take into account the limiting case where the A compartment has a null capacity (a = 0). We differ this important situation to the general discussion.

P(C/A) = i; P(C/not-A) = i'; P(C) ∈ [ min {i, i'} , {max {i, i'} ]

When the antecedent of the conditional is introduced as an additional premise, the resulting inference, If-introduction, becomes informative (see [START_REF] Pfeifer | The new psychology of reasoning: A mental probability logical perspective[END_REF] as can be seen in the next section.

If-introduction: A; C ∴ IF A THEN C

We wish to determine the probability of the conditional if A then C knowing the probability of its components, A and C. The question amounts to the following: Given a (the capacity of A), and the amount c to be poured into the tank, what are 1) the highest, and 2) the lowest possible levels in A?

1) One fills up A first (see Figure 8a). Trivially, i = 1 if c ≥ a (A is filled up when there is as much or more liquid than A can receive), and i = c/a otherwise, hence: i ≤ min {c/a, 1}.

2) One fills up A' first. If c ≤ a', A remains empty and i = 0. If c > a', A' is filled up and the excess is poured into A (see Figure 8b) which receives c -a', hence its level (c -a') /a, that is, (c -1+a) / a. Hence : i ≥ max {0, (c -1+a) / a }. Therefore: This inference is neither conservative nor dissipative, as the bounds can reach 0 while a and c differ from 0, or reach 1 while a and c differ from 1. Whenever a and c are high, so is i, and the inference is robust.

P(a

'If' to 'not-A or C' ('if' to the material conditional): IF A THEN C ∴ NOT-A OR C

Knowing the level i in the left compartment A, what is the volume occupied by the whole right compartment A' or by the liquid? Its measure is never lower than the measure of i because, as shown in Figure 9, there is always some space in A' above the level i up to the top (the darker area whose measure equals (1-a)(1-i)). P(not-A or C) is measured by

(1x i) + (1-a)(1-i) = i + (1-a)(1-i).
The difference between the probabilities of the premise and the conclusion is (1-a)(1-i) which is positive or null. It is maximal when i = 0 and null when i = 1.

This inference is conservative: the probability of the conditional never exceeds that of the material conditional:

P(NOT-A OR C) ∈ [P(C/A), 1]

'Or' to 'if not-': A OR C ∴ IF NOT-A THEN C

The conclusion represents the level in the right compartment, while the premise represents the volume occupied by the left compartment or by the liquid, that is, the capacity of A augmented with the content of A' (Figure 11a). Obviously, the empty space [a'c'] in A' is greater (or equal) relatively to A' than it is relatively to the whole tank; taking the respective complementary ratios, it follows that i' is smaller than the disjunction (or equal, in the limiting case where a=0). The probability of the conclusion i' can reach but never exceed that of the premise A OR C: the inference is dissipative. To find the lower bound, we notice (Figure 11b) that when a is large enough the contribution of the content of A' to A OR C is negligeable, that is, i' can have any value, in particular it can be small and even null. Hence: Several authors have discussed how "reasonable" [START_REF] Stalnaker | Indicative conditionals[END_REF] or "plausible" [START_REF] Edgington | Do conditionals have truth conditions?[END_REF] it is to make this inference, or how "strong" it is [START_REF] Gilio | The psychology of inferring conditionals from disjunctions : A probabilistic study[END_REF] and have offered a justification for it. In the present framework, we have seen that a high probability for the premise does not warrant a high probability for the conclusion; in other words the inference is not robust. So, we ask whether there are special circumstances in Uncertain Deduction by Analogy 20 which a high probability for the conclusion could be warranted. We already know that the inference is dissipative, so we can only hope for a condition, if any, under which the loss in confidence will not be too great.

(
As already noticed, when A is large, i' can be low or even null. In this case it is possible for A or C to be highly believable while if not-A then C is not, there is a great loss in confidence and this is why the inference is not robust. To avoid this situation, it suffices that A be not too large (Figure 11a). When this is the case, a high value for the disjunction entails a relatively high level in A', that is, i' is relatively high, and so the loss in confidence from premise to conclusion is limited. In sum, when there is high belief in A or C, to warrant a close degree of belief in if not A then C, we have to make the assumption that A is not too large. This qualitative result can be made precise as follows. Denoting the probability of the When d is large, there is a possibility that i' be low (or even null) but this occurs only when a is large. The vertical lines show that for a given value of d (in particular when d is large as has been assumed) i' is all the greater as a decreases. In brief, for modarate values of a the inference behaves like a robust inference. Take for instance d=.95, then i'=.90 for a=.50; but for a=.95 i' collapses to zero 5 . This analysis concurs with Gilio & Over (2012) who discuss in depth the role of the magnitude of P(A) relative to P(A or C) (their measure of constructivity) in defining the weak and the strong inference 6 .

Contraposition: IF A THEN C ∴ IF NOT-C THEN NOT-A

The conclusion represents the degree to which the right compartment contributes to the vacuum (the emptiness of the tank). This degree will be denoted by i c .

Consider the two extreme cases. One, when the left compartment is full (i = 1, full belief in the premise) all the empty volume is in A' so that i c = 1 and the contrapositive is fully believable (see Figure 13a).

Two, when A occupies the whole tank (a = 1), the empty volume is entirely in A, and i c = 0. In the general case the contribution of the right compartment varies from zero when it is full (i c = 0, see Figure 13b) to a maximum when it is empty, yielding i c = (1 -a) / (1 -c) (Figure 13c). But this maximum is susceptible of variation depending on the relative size of the compartments: as A decreases A' increases and the contribution of A' increases until i c reaches 1. In sum, The contrapositive can have all the degrees of confidence between 0 and 1.

P(C/A) = i; P(NOT-C/NOT-A) ∈ [0, 1]

Figure 13. Contraposition.

The foregoing result has been obtained under the assumption that i is the only known variable. However, it is interesting to study the constraints superimposed by other variables (a and i') in order to know under which circumstances the contrapositive has different bounds. Strictly speaking, in doing so, we will be considering a new inference defined by the addition of two premises (a and i'). For this purpose it suffices to express i c as the ratio of the empty space in A', (1 -a)(1 -i') to the whole empty space 1-c:

i c = (1 -a)(1 -i') / (1 -c) i c = (1 -a)(1 -i') / [(1 -a)(1 -i') + a(1 -i)]
This is the fundamental equation for contraposition expressing the functional relation between the contrapositive i c and the conditional i, with a and i' as parameters. After the change of variable y = i c and x = i, it becomes:

y = (1 -a)(1 -i') / [(1 -a)(1 -i') + a(1 -x)] (Eq)
We rewrite (Eq) as: y = u /(v -ax), with u = (1-a)(1-i'), and v = u + a.

It can be verified that this function is strictly increasing (first derivative strictly positive) and that it is concave (second derivative strictly positive).

Knowing whether the inference is conservative or not amounts to knowing the conditions under which ≥ x, that is: u /(v-ax) ≥ x, or:

ax 2 -vx + u ≥ 0 (Ineq)
The associated equation can be factorised as:

a(x-1)(x -u/a) = a(x-1)(x-j) where j = u/a = (1-a)(1-i') /a.
As a result, the sign of the difference y-x is determined as a function of a as follows:

• if j ≥ 1, there is no solution (other than x=1) within [0, 1], and (Ineq) is always satisfied, which means that for all i ∈ [0, 1], i c ≥ i.

• if j < 1, there is a solution smaller than 1 which means that (Ineq) is satisfied in an interval [0, j] and not satisfied in ]j, 1[. The condition j ≥ 1 is equivalent to i' ≤ (1-2a) / (1-a) or to a ≤ (1-i') / (2-i'), and similarly the condition j < 1 is equivalent to i' > (1-2a) / (1-a) or to a > (1-i') / (2-i'), so that in summary: when a ≤ (1-i') / (2-i'), the inference is conservative (i c ≥ i) for all i ∈ [0, 1],

when a > (1-i') / (2-i'), the inference is conservative (i c > i) for i ∈ [0 , (1-a)(1-i') /a] ,

and dissipative (i c < i) for i ∈ [(1-a)(1-i') /a , 1].

Figure 14 illustrates this discussion for the value of the parameter i' fixed arbitrarily at i' =

.4 and for several values of the parameter a ranging from 0.2 to 0.95. It appears that when i is high, inferring the contrapositive may be viewed as quite reasonable 7 . For instance, with a=0.5 and i'=0.4, for a probability of the conditional i=.95, the probability of the contrapositive i C equals 0.92.

Modus Ponens: IF A THEN C; A ∴ C

The combination of the premises a and i yields a x i = [ac] as the content of A. Obviously the content c of the whole tank cannot be less, which gives a lower bound for the confidence in C: one must not be less confident in the conclusion than in the product of the levels of confidence in the premises. On the other hand, A being limited to level i, the tank cannot be full; c cannot exceed the content of A, a x i, augmented with the capacity of A', that is, (a x i) +

(1 -a) (see Figure 15). Therefore: Modus Ponens (MP) is not conservative, as its lower bound a x i is smaller or equal to the confidence in either premise (a, i); it is not dissipative, as its upper bound is greater or equal to the confidence in one of the premises, i; but it is robust, as a high confidence in the premises (a, i) warrants a high confidence in the conclusion because c ≥ a x i. In other words, high confidence in both premises means that the left compartment is both large and filled up to a high level, so that the tank necessarily contains a large amount of liquid.

P(C/A) = i; P(A) = a; P(C) ∈ [a x i , (a x i) +1-a]

Notice that when A occupies the whole tank, the level in the tank is given by i: c = i and so c is known with the least uncertainty (as equal to i). Now suppose A decreases while i is fixed (say = 1). A' increases and because i' is unknown the uncertainty on c increases; when a becomes null A' occupies the whole tank and c can be anything between 0 and 1: this is the non probabilistic case of Denying the Antecedent (DA) where i=1 and a=0. This shows that MP and DA are the two sides of a same coin; the variable is A in one case and A' in the other case.

Denying the Antecedent IF A THEN C; NOT-A ∴ NOT-C

The same equation as for MP can be used, replacing c with c' =1-c, which yields:

P(NOT-C) ∈ [ a(1-i) , 1 -(a x i)]
This represents the degree of emptiness of the tank knowing the level in A and the size of A'. The equation shows that it is rational to have a level of confidence in the conclusion of DA that lies between the bounds indicated. In particular, trivially, it would be irrational to assess the total void as lower than a -(a x i), that is, lower than the void in A.

The result can also be given in terms of a' = P(NOT-A):

P(C/A) = i; P(NOT-A) = a' P(NOT-C) ∈ [(1-i)(1 -a') , 1 -i (1 -a')]

Affirming the Consequent: IF A THEN C; C ∴ A

Given the level in A and the content c, trivially there cannot be more liquid in A than the whole amount c, that is: a x i ≤ c, hence: a ≤ c / i (which is automatically satisfied when i ≤ c since a ≤ 1). Similarly, A cannot incorporate more void than the whole void in the tank, that is: For a given value of i, the range of a is obtained by referring to the triangle whose base is [0, 1] and the apex on the line a=1. For any value of c, the ordinate of the corresponding side of the triangle provides the range of a. It is noteworthy that when c nears 1 the upper limit of a decreases (and becomes null when c=1). If it is known that the left part is full to, say, three quarters but also that the tank is nearly full, the left part must be small. There is an exception to the decrease of a as c increases, which occurs when i=1 and c=1, in which case a ∈ [0, 1],

(1 -i) x a ≤ 1-c, hence a ≤ (1-c) / (1-i) (which is automatically satisfied when c ≤ i since a ≤ 1). It follows that: a ∈ [ 0, c / i ] if i ≥ c,
which is the non probabilistic fallacy of AC. This can be viewed as a special case of what happens when i and c are equal: the equality of the level in A with the degree of filling of the tank means independence, so that the position of the partition can be anywhere, in other words the inference is totally uninformative.

Suppose now that one has some belief in i (i > .5) and disbelieves c (c < .5): the range of a is measured by the ordinate on the left side of the triangle: the more c decreases, the more a decreases. This is the probabilistic form of Modus Tollens, showing its link with AC. In particular when i=1 a must be null: this is the non probabilistic MT. The solution of MT follows.

Modus Tollens: IF A THEN C; NOT-C ∴ NOT-A

Knowing the level in the compartment A and the size of the vacuum in the tank, what are the limits of the compartment A'? When A has a lower limit, A' has an upper limit, and viceversa, so that we can use the result for the Affirmation of the Consequent after introducing a'

= 1 -a and c' = 1 -c :

a' ∈ [(i -1 + c') / i , 1] if i ≥ 1 -c' ; and a' ∈ [(1 -i -c') / (1 -i) , 1] if i ≤ 1 -c'
, which can be summarize by:

P(C/A) = i; P(NOT-C) = c'; P(NOT-A) ∈ [ max { (1 -i -c') / (1 -i), (i -1 + c') / i } , 1]

MT is robust. This can be verified with a couple of values such as 0.92 for the premises i and c', which yields a lower bound of 0.91. A high level in the compartment A together with a large vacuum in the tank necessitates that the capacity of A be limited, failing which there would be a large amount of liquid in A and therefore in the tank.

Hypothetical syllogism: IF A THEN B; IF B THEN C ∴ IF A THEN C

The tank is initially filled with a liquid B (Figure 17a) and then some part of B is replaced by a liquid C. (We assume that the liquids are non miscible). In the certain case the compartment A is entirely filled with liquid B and then the whole of liquid B is replaced by liquid C, so that in the end A is filled with C and the inference is valid. In the probabilistic case, even if the level in A is high (i BA = P(B/A) high) and a part of the volume B is replaced (respecting P(C/B)), the replacement of the liquid B could be done by removing it from A while little or no liquid B is removed from A', making the level of C in AB low or even null (Figure 17b). On the other hand, when liquid C is poured, some of it may also be introduced in B' and this amount introduced in AB' could occupy all this empty space so that P(C/A) need not be limited to P(B/A) and could reach 1 (the top of A). In brief, any confidence value can be given for the conclusion: This is to be contrasted with the next inference, CUT.

CUT: IF A THEN B; IF A AND B, THEN C ∴ IF A THEN C

Uncertain Deduction by Analogy

29

The difference with the hypothetical syllogism is that, as indicated by the second premise, when liquid C is introduced to replace B, this cannot be done without pouring at least some of it into A, so warranting that A will not be empty, that is, the probability of the conclusion cannot be null. The limits can be assessed as follows (Figure 17b):

Let i CB stand for P(C/AB). Notice that the related level is relative to AB. As just explained, the amount in A cannot be less than the amount in AB, hence the minimum i BA x i CB . Now, the maximum is obtained when in addition to the minimal amount the empty space AB' (=1-i BA )

is totally filled with liquid C, that is: i BA x i CB + (1-i BA ), hence:

P(B/A) = i BA ; P(C/AB) = i CB ; P(C/A) ∈ [ i BA x i CB , (i BA x i CB )+(1-i BA ) ]
This inference is not conservative, the lower bound being smaller than the confidence in either premise. It is not dissipative because the upper bound cannot be lower than the probability of one of the premises (i CB ). It is robust since the lower bound warrants a high value if both premises have a high probability.

Strengthening (Monotonicity): IF A THEN C ∴ IF A AND B, THEN C

Compartment A is devided into two sub-compartments B and B'. In the sure case (Figure 18a) A is assumed to be full so that any subpart of it such as AB will be full as well and the conclusion follows with full confidence.

Figure 18. Strengthening of the antecedent.

In the probabilistic case there is no guarantee that A is full and the sub-compartments AB and AB' have levels i BA = P(C/AB) and i B'A = P(C/AB'), respectively (Figure 18b). P(C/A) = i A is a weighted value between i BA and i B'A . Strengthening the antecedent with B can increase or decrease the probability of the conditional P(C/A). In the case of Figure 18b, i BA shows a higher probability than i A .

To study the possible values of the conclusion it suffices to focus on the compartment A in which B and B' stand for new compartments and c is known; in other words, we conditionalize with respect to A, and the problem is now an inference already familiar (see section 3.8) from consequent C to 'if B then C' with B and B' as events within A. We know that no confidence value can be given, so that

P(C/A) = i; P(C/ (A AND B)) ∈ [0, 1]

The extreme case where the level i BA in AB equals 0 (Figure 18c) is of particular interest because, when dealing with causal conditionals, it coincides with a strict invalidating condition (or defeater). Assume a highly believable conditional if A, C asserted as a probable cause. As we have seen, for the level i BA to be null when i A is high, B must be small: this coincides with the well-known case where a conditional assertable with antecedent A must be retracted when A is qualified by an unexpected, or rare, or atypical defeater B.

The indeterminacy of the conclusion can be suppressed if the size of the AB compartment becomes a fixed parameter: adding if A then B as a premise yields the next schema, moving from monotonicity to cautious monotonicity.

Cautious monotonicity: IF A THEN C; IF A THEN B ∴ IF A AND B, THEN C

The level in A is i, then A is partitioned into B and B'. The width of B in A is a x b (see Figures 18b and18c). To know the level of liquid i BA in AB we need to know how the liquid can be shared between AB and AB'.

1) AB contains an amount a x b x i; it can be emptied provided the empty space a(1-b)(1-i) is large enough to receive this extra liquid. In this case the minimum is 0. If not, there will remain in AB an amount equal to a x b x i -a(1-b)(1-i) = a(i + b-1), hence the level (i+b-1)/b.

2) AB can be filled up provided the amount of liquid in AB', i x a(1-b), is large enough.

Otherwise the volume in AB equals i x a, hence the level i/b. In summary: A conditional is represented by a level and its consequent by a amount of liquid. In the premise of this inference the component "if B then C" is a level qua conditional but at the same time it must be an amount qua consequent of a conditional. At first sight, it would seem that this ambiguity prevents nested conditionals, and therefore the inference, to be represented in the system. However, a level is a relative amount and the level "C relatively to B" can be regarded as an amount taken in turn relatively to A, so that one may interpret the complex expression as a formulation of the conditional "if B then C" within the event A. That is, "if B then C" is conditioned on A and this allows the interpretation of the nested conditional. We start by representing the event A and then construct the partition (B, B'), each part of which accommodates its share of liquid. This procedural interpretation yields the same diagram as strengthening, and because it is reversible the inference is established as an equivalence. This equivalence can be translated in terms of conditional events. The premise is (C/B)/A (which is a well-formed expression in de Finetti's formalism), the conclusion is C/(A&B) and these denote the same conditional event (de Finetti, 1975, p. 328).

Discussion

We have presented a device based on a physical implementation of probability theory (in the finite case) which allows the execution of deductions under uncertainty. At the basis of the derivation of the conclusions there are physical principles. We cannot get out of a compartment more than its actual content (no negative probability) nor can we pour an amount greater than its capacity (no probability greater than 1). It is also noteworthy that the physical constraint of conservation of the liquid (deeply supported by intuition) acts through operations such as (1) after filling up a compartment some extra liquid (if any) must be allocated to the other compartment, or (2) after moving the partition until the current level reaches the top requires that the extra liquid be accommodated in the other compartment.

These operations, which have been used throughout, implement the total probability rule.

We aimed to answer the question of the determination of the value (volume or level) of a target constituent knowing the point values of one or more other constituents. In the cases investigated we found that the value must lie in an interval (which in some cases is [0, 1]). It appears that the results coincide exactly with the coherence intervals that can be computed by means of systems of linear equations [START_REF] Coletti | Probabilistic logic in a coherent setting[END_REF]. This reflects that the device also satisfies the axioms for conditional events defined by these authors 8 . Note that because the partition is movable, and so the compartment A variable, conditioning on the event A means conditioning on an uncertain event, a specific feature of the coherence approach [START_REF] Paneni | Multi-valued conditional events avoid Lewis' triviality results[END_REF].

One difference between the coherence approach and classical probability theory that is worthy of attention concerns the propagation of probability. In section 3.8 we found that the coherence interval for the conclusion If A then C inferred from C was equal to [0, 1]. In the special case where P(C) = 1 this result is at variance with classical probability theory for which P(C/A) = 1 if P(A) ≠ 0 and is undefined if P(A) = 0. Indeed, from the latter point of view, assuming the tank to be full (P(C) = 1) while the partition occupies any position such that 0 < a ≤ 1, each compartment must be full, and in particular the level in compartment A must equal 1; but when a = 0 (see Pfeifer,204), the compartment has no capacity and so there is no more notion of its content or level, which may be regarded as equivalent to a lack of definition. contrast, the conditional event being a primitive notion, it can be assessed without the constraint that P(A) ≠ 0. To see this, consider the tank filled with a volume c and examine the possible values of P(C/A) as has been done for the Consequent to 'if' inference.

We have already seen that the condition for A to be empty or full (or to be occupied by any volume in between, meaning that the level i is free to take any value on [0, 1]) is that a ≤ min{c,1-c}, which is always possible to choose. For the sake of simplicity we assume that we are in the limiting case a = 1 -c. The level in A can be anything between 1 (Figure 19a) and 0 (Figure 19b), c being fixed. Now starting from the position shown in Figure 19b we increase the volume C while correlatively diminishing the capacity of A in such a way that we maintain the value a = 1 -c. In doing so, we guarantee that the level in A can take all the possible values between 0 and 1 whatever the value of c. This obtains even for infinitesimal values close to 1 and the corresponding infinitesimal values close to 0, since we have a + c = 1. In sum, we see that c being fixed, P(C/A) can take any value in the interval [0, 1], including when c = 1 (full tank, P(C) = 1) in which case a = 0 (capacity of A null, P(A) = 0). In brief, in the present case the tank analogy captures the coherence view of the conditional event such that P(C/A) ∈ [0, 1] when P(A) = 0. This can can be verified more generally in the formula 3.8 for If-introduction 9 .

From a computational point of view, no claim to novelty of the results is made. The novelty with the tank analogy, besides the method, lies in the limited amount of computation and its simplicity. This is no wonder: once the components that represent the premises have been selected, the variation of the component of interest can be read off the diagram because the device incorporates the laws of probability. It is only when reading the bounds that the four elementary arithmetical operations are generally needed to express the value of the constituent of interest (the conclusion of the schema).

The tank analogy can be considered from a practical and a theoretical point of view.

Practically, one advantage linked to the operational procedure of the analogy over formal methods of calculation is that it provides both a basis for the quantitative calculation of the bounds and a qualitative method which opens didactic perspectives. The analogy may be a valuable tool to explain why, for instance, it is irrational to have too low or too high confidence in the conclusion of Modus Ponens, why contraposition is unwarranted (but which additional information/premise can warrant some confidence and how much), under which conditions Affirming the Consequent may not be a fallacy, and so on. Take for instance Modus Ponens. Individuals whose confidence in the conclusion is lower than the lower bound P(A)xP(C/A) commit themselves to the belief that the amont of liquid in the whole tank is less than the amount in one of its parts (the left compartment). Similarly, those whose confidence in the conclusion is higher than the upper bound P(A)xP(C/A) +1-P(A) commit themselves to the belief that there can be more liquid in the tank than its overall capacity.

Theoretically, the main interest of the analogy is to provide an interpretation of the meaning of probabilistic deductive inferences. Atomic sentences are interpreted in terms of volumes or capacity of compartments, and conditionals in terms of levels. Boolean expressions have their interpretation in terms of union or intersection of volumes or compartments so that the logical operations have their physical counterparts. Varying the value of the constituents (volumes, capacities and levels) provides the probability measures.

Overall, an inference is viewed as a procedure which consists of singling out some of the constituents of the device (the premises) and examining whether their values constrain another specified constituent (the conclusion). The absence of constraint means that any value of the constituent is physically possible, the confidence in the associated sentence can be anywhere in the interval [0, 1] and so the inference is uninformative. The existence of a constraint means that some values of the constituent are excluded because they are physically impossible; this results in an interval of possible values that provide the limits in confidence in the conclusion and so the inference is informative.

A related interest of the analogy is that it helps understand and compare various criteria of rational inference with uncertain premises. Compared with standard logic which is based on truth preservation and leads to establishing a partition between inferences that warrant and do not warrant the truth of the conclusion, the probabilistic logic approach, and more specifically the Finettian coherence approach, involves a drastic change of point of view on the use of inference schemas. Rather, they lead to qualify the conclusion by determining the limits of the degrees of belief that rational reasoners should entertain, given their belief in the premises, if they are to abide by a practical criterion of rationality, namely the avoidance of a Dutch book. That the reasoner's belief in the conclusion should remain within the limits of the coherence interval is a basic requirement but stricter criteria can then be superimposed and they may be used to categorize the schemas. Take for instance robust schemas (those that warrant a high degree of belief in the conclusion if there is high belief in the premises).

Reasoners who can identify and apply these schemas have an advantage for deliberation or argumentation purposes akin to reasoners who can identify and use deductively valid schemas. Note incidentally that the analogy allows an easy interpretation of a property such as robustness.

In summary, we possess an operational procedure to evaluate normatively, that is, from the viewpoint of probability theory, deductive inferences under uncertainty. It can be seen that the evaluation of the value of the concluding constituent amounts to a search for the conditions of compatibility or coherence between this and the set of values permitted by the premises' constituents. It would be incoherent to accept the premises' constituents' values and expect a value for the concluding constituent that turns out to be physically impossible.

This materializes de Finetti's notion of coherence and offers a counterpart of betting situations and Dutch book arguments used to assess individuals' rationality in their probability judgments: in a similar way that individuals whose bets do not conform to coherent probability bounds are doomed to losing their money, the same individuals are doomed to failure in attempting to execute fillings that are physically impossible.

Notes

1. The device can be described as a Cartesian product of two Bernouilli random variables Ω 1

x Ω 2 with Ω 1 = {left, right} and Ω 2 = {(volume of) liquid, (volume of) empty space}.

2. Strictly speaking, the two events just denoted by A and C should receive different respective notations to distinguish them from the material constituents of the device, namely the compartment A and the liquid C. We keep a single notation so long as there is no risk of confusion.

3. The division may also be applied horizontally. This is a basic property of mosaic displays.

Here the division may be applied horizontally to the filled and empty volumes of the compartments (see for instance section 3.18).

4. Robustness and conservativeness are equivalent to Adams' (1996) High probability preservation and Minimum probability preservation, respectively.

5. By considering the values of a as a parameter, we have implicitly added a premise A, so that in this part of the discussion we have in fact considered the inference from A or C; A to if not-A then C.

6. Because there is asymmetry in the diagram between A and C, one may wonder whether the results remain identical after exchanging A and C in the conclusion (yielding an inference from A OR C to IF NOT-C THEN A). It can be verified easily that the answer is affirmative. That is, the inference is robust provided C is not too high. This shows again that the allocation of a sentence to one role, "vertical" (the partition) or "horizontal" (the liquid) is only a matter of visual presentation.

7. This discussion highlights that there is some ambiguity in referring to the contrapositive. The strict sense refers to the case where the conditional is considered in the absence of information about the belief in other events, in which case we have seen that the coherence interval is [0, 1]. In the wide sense, we still refer to the formally identical sentence if not-C then not-A, but now it is affected by the belief in other events (A and if not-A then not-C) and its probability interval changes accordingly.

Uncertain Deduction by Analogy 38 8. The first two axioms are trivially satisfied and the third one, P((E&A)/H) = P(E/H) x P(A/(E&H)), can be verified using the basic diagram with H and E and an additional partition to represent A. 9. Notice also that the thought experiment by which the partition moves to the left until it reaches zero materializes the fact that we are dealing with possible events of null probability, not with an impossible event (which could be represented by moving the partition outside the tank (or by filling the tank above the brim).

Figure 1 .

 1 Figure 1. Edward's (1972) representation of a two-way distribution.

Figure 2 .

 2 Figure 2. The basic analogy.

  x i: P(A AND C) = P(A) x P(C/A) (also denoted by [ac]). Similarly, P(NOT-A AND C) = P(NOT-A) x P(C/ NOT-A) (also denoted by [a'c]); Uncertain Deduction by Analogy 8 P(A AND NOT-C) = P(A) x P(NOT-C/A) (also denoted by [ac']); P(NOT-A AND NOT-C) = P(NOT-A) x P(NOT-C/ NOT-A) (also denoted by [a'c']).

Figure 3 .

 3 Figure 3. (a) Bayes' rule. (b) Independence

Figure 4 .

 4 Figure 4. Boolean operations.

Figure 6 .

 6 Figure 6. Proof by cases.

Figure 7 .

 7 Figure 7. Inference from Consequent to IF.

  Figure 8. IF-introduction.

Figure 9 .

 9 Figure 9. Inference from IF to NOT-A OR C.

  Figure 11. Inference from OR to IF-NOT.

  Figure 12. It shows the linear increase of i' as a function of d. It illustrates that we always

Figure 12 .

 12 Figure 12. Inference from OR to IF-NOT. Variation of i' = P(C/NOT-A) as a function of d = P(A OR C) for various values of a = P(A).

Figure 14 .

 14 Figure 14. Probability of the contrapositive i c plotted against i = P(C/A) for various values of a = P(A) and for i' = P(C/not A) fixed arbitrarily at 0.4. i c ≥ i for 0 ≤ i ≤ j (j = intersect of f(i) and the diagonal).

Figure 15 .

 15 Figure 15. Modus Ponens.

Figure 16

 16 Figure 16 represents the graph of a plotted against c for two values of i as a parameter.

Figure 16 .

 16 Figure 16. Inference of Affirming the Consequent. Graph of the conclusion a = P(A) as a function of the minor premise c = P(C) for two values of the major premise i = P(C/A).

Figure 17 .

 17 Figure 17. The hypothetical syllogism.

  With the addition of the premise if A then B the inference has become robust: we can have high confidence in if A and B, then C when, in addition to a high confidence in if A then C we have high confidence in if A then B. This inference is neither conservative nor dissipative, as the bounds can reach 0 while i and b differ from 0 or 1 while i and b

Figure 19 .

 19 Figure 19. Assessing P(C/A) when P(A) = 0.

Acknowledgement

The author is grateful to Jean Baratgin, Paul Egré, and Bernard Walliser for their very helpful comments on a first version of this manuscript.