Introduction to Group Theory: The Axioms, and a Language for Computing with Symmetry

0. Key points

• A group is a set together with a binary operation on it, subject to only three conditions: associativity, the existence of an identity, and the existence of inverses. Precisely because there are only three, addition of integers, multiplication of matrices, composition of permutations, and the symmetry operations of a figure can all be handled in one language.
• From these three we deduce the uniqueness of the identity and of inverses, the cancellation laws, and $(ab)^{-1} = b^{-1}a^{-1}$. The multiplication table of a finite group is a “Latin square”: every element occurs exactly once in each row and in each column.
• $(\mathbb{Z}, +)$ and $(\mathbb{R}\setminus\{0\}, \times)$ are commutative, but the symmetric group $S_3$ and the general linear group $GL(2,\mathbb{R})$ are not. Group theory owes its richness to this noncommutativity.
• The six elements of $S_3$ correspond one-to-one with the 3 rotations and 3 reflections of an equilateral triangle. Writing out the multiplication table in full makes the noncommutativity visible.
• The order of an element $a$ is the least positive integer $n$ with $a^n = e$. In a finite group every element has finite order, and $a^m = e$ is equivalent to “the order divides $m$”.
• A group generated by a single element is called cyclic, and every cyclic group is abelian. The converse fails: among abelian groups of order 4 there is one that is not cyclic (the Klein four-group).

---

1. Motivation: from “permuting the roots” of an equation to abstract groups

Everyone knows the quadratic formula for $ax^2+bx+c=0$. Formulas exist for degrees 3 and 4 as well, complicated though they are. What about degree 5? The answer, which took more than two hundred years to reach, was: there is no general formula using only the four arithmetic operations and radicals.

The decisive change of viewpoint that led to this conclusion is due to Lagrange. In the 1770s he studied how many values a rational expression in the roots $\alpha_1, \ldots, \alpha_n$ of an equation takes when the roots are permuted. For instance $\alpha_1+\alpha_2+\alpha_3$ is unchanged by every permutation and so takes a single value, whereas $\alpha_1\alpha_2 + \alpha_3$ takes three values depending on the permutation. Lagrange’s insight was that whether a formula for the solutions can be built is decided by this behaviour under permutation.

The protagonist here is not the roots themselves but the totality of the permutations of the roots. Permutations can be performed one after another to give another permutation, each has a reverse, and there is one that does nothing. Ruffini and Abel proved that the general quintic is not solvable by radicals, and around 1830 Galois attached to each equation a collection of permutations — he called it a groupe — and saw that the structure of that collection completely determines solvability. For details see An invitation to Galois theory.

Later, in an 1854 paper, Cayley moved away from the concrete material of permutations and defined a group as “an abstract set equipped with a multiplication table”. By the end of the nineteenth century the axioms had been organized into the form seen in today’s textbooks. The dividend of abstraction was enormous. Compare the following four rows.

Set	Operation	The “do nothing” element	The “undo” element
Integers $\mathbb{Z}$	addition $+$	$0$	$-a$
Nonzero real numbers	multiplication $\times$	$1$	$1/a$
Symmetry operations of an equilateral triangle	perform one after another	the operation that moves nothing	the reverse operation
Invertible matrices	matrix product	identity matrix $I$	inverse matrix $A^{-1}$

The raw material is entirely different, yet the skeleton matches exactly. A group is what remains when only that skeleton is kept. So “learning group theory” means nothing other than proving theorems that apply simultaneously to all four rows. In this article we settle the axioms and the first examples; classification by substructure is taken up in Subgroups and cosets, and classification by structure-preserving maps in The isomorphism theorems for groups.

---

2. Preliminaries: binary operations and associativity

We assume the notation for sets and logic at the level of The grammar of mathematics — sets and logic. We begin by defining “operation” rigorously, as a map.

Definition 2.1（Binary operation）

A binary operation on a set $G$ is a map

$$\mu : G \times G \longrightarrow G .$$

We write $\mu(a,b)$ as $a \cdot b$, or simply $ab$.

Saying that the domain is $G\times G$ and the codomain is $G$ already demands two things. First, that a value is assigned to every pair of elements of $G$ (an operation defined only partially is not a binary operation). Second, that this value again belongs to $G$; this second condition is expressed by saying that ”$G$ is closed under the operation”. For example the odd numbers are not closed under addition ($1+1=2$ is not odd), so there is no binary operation “addition” on the set of odd numbers.

Note

When we write $a\cdot b$, the symbol for the operation changes with the context: $+$, $\times$, $\circ$, and so on. In this article we omit the symbol and write $ab$ when discussing the general theory (multiplicative notation), and write $a+b$ only when dealing with additive groups.

Combining three or more elements requires parentheses. The expression $a\cdot b\cdot c$ can be read either as $(ab)c$ or as $a(bc)$, and these two need not always agree. For real subtraction, for instance, $(5-3)-1 = 1$ while $5-(3-1)=3$. The requirement that the two always agree is called associativity. Associativity is not among the axioms merely because it is convenient: it holds because the prototype of all groups, composition of maps, satisfies it.

Proposition 2.2（Associativity of composition of maps）

For maps $f, g, h$ from a set $X$ to itself, $(f\circ g)\circ h = f\circ (g\circ h)$.

Proof（Proposition 2.2）

Two maps are equal precisely when their values agree at every point of the domain. Take an arbitrary $x\in X$. By the definition of composition,

$$\bigl((f\circ g)\circ h\bigr)(x) = (f\circ g)\bigl(h(x)\bigr) = f\Bigl(g\bigl(h(x)\bigr)\Bigr)$$

and likewise

$$\bigl(f\circ (g\circ h)\bigr)(x) = f\bigl((g\circ h)(x)\bigr) = f\Bigl(g\bigl(h(x)\bigr)\Bigr) .$$

Both equal $f(g(h(x)))$, so the values agree for every $x$. Hence the two maps are equal.

∎

Given associativity, the product $a_1a_2\cdots a_n$ is determined independently of how parentheses are inserted (this is proved by induction on $n$; it is a typical application of strong induction（Theorem 4.3）［Techniques of Proof］ from Techniques of proof). Below we use this fact without comment and omit parentheses.

---

3. The definition of a group and its first consequences

Definition 3.1（Group and abelian group）

A pair $(G, \cdot)$ consisting of a set $G$ and a binary operation $\cdot$ on it is a group when the following three conditions hold.

• (G1) Associativity: $(ab)c = a(bc)$ for all $a, b, c \in G$.
• (G2) Existence of an identity: there is an $e \in G$ such that $ea = ae = a$ for all $a\in G$.
• (G3) Existence of inverses: for the $e$ of (G2), and for every $a\in G$, there is a $b\in G$ with $ab = ba = e$.

If in addition

• (G4) Commutativity: $ab = ba$ for all $a,b\in G$

holds, then $G$ is called an abelian group (or commutative group). When $G$ is a finite set, $G$ is called a finite group, and the number $|G|$ of its elements is called the order of $G$.

There are only three axioms. Note that “the identity is unique” and “the inverse is unique” are not among them — because they need not be.

The hierarchy of algebraic systems: adding one condition at a time leads to a group.

Proposition 3.2（Basic properties of groups）

Let $(G,\cdot)$ be a group. Then the following hold.

1. The identity is unique: if $e$ and $e'$ both satisfy (G2), then $e = e'$.
2. For each $a\in G$ the element $b$ satisfying (G3) is unique; we write it $a^{-1}$.
3. (Cancellation laws) For $a, x, y \in G$: if $ax = ay$ then $x = y$, and if $xa = ya$ then $x=y$.
4. For all $a, b\in G$ we have $(a^{-1})^{-1} = a$ and $(ab)^{-1} = b^{-1}a^{-1}$.

Proof（Proposition 3.2）

(1) Let $e$ and $e'$ both be identities. Applying the identity property of $e'$ with $a = e$ gives $e e' = e$. Applying the identity property of $e$ with $a = e'$ gives $e e' = e'$. The left-hand sides are the same, so $e = e'$. All that was used is (G2), applied to each of the two elements.

(2) Suppose $b$ and $b'$ both satisfy $ab = ba = e$ and $ab' = b'a = e$. Then

$$b = be = b(ab') = (ba)b' = eb' = b' .$$

The first equality is (G2), the second is $ab' = e$, the third is associativity (G1), the fourth is $ba = e$, and the fifth is (G2) again.

(3) Suppose $ax = ay$. By (2) the inverse $a^{-1}$ of $a$ is well determined, so multiplying on the left by it gives

$$x = ex = (a^{-1}a)x = a^{-1}(ax) = a^{-1}(ay) = (a^{-1}a)y = ey = y .$$

We used (G2), (G3) and (G1). If $xa = ya$, multiply on the right by $a^{-1}$ in the same way.

(4) The identity $a^{-1}a = a a^{-1} = e$ reads directly as ”$a$ is an inverse of $a^{-1}$”. By the uniqueness of inverses in (2), $(a^{-1})^{-1} = a$. Next,

$$(ab)(b^{-1}a^{-1}) = a\bigl(b(b^{-1}a^{-1})\bigr) = a\bigl((bb^{-1})a^{-1}\bigr) = a(ea^{-1}) = aa^{-1} = e$$

(using (G1) twice, then (G3) and (G2)), and likewise

$$(b^{-1}a^{-1})(ab) = b^{-1}\bigl((a^{-1}a)b\bigr) = b^{-1}(eb) = b^{-1}b = e .$$

So $b^{-1}a^{-1}$ is an inverse of $ab$, and by uniqueness (2), $(ab)^{-1} = b^{-1}a^{-1}$.

∎

The reversal of order in (4) matters. The way to undo “put on socks, then put on shoes” is “take off shoes, then take off socks”: the order is reversed.

Corollary 3.3（The multiplication table is a Latin square）

Let $G = \{g_1, \ldots, g_n\}$ be a finite group, and form the $n\times n$ table (the multiplication table, or Cayley table) whose $(i,j)$ entry is $g_ig_j$. Then every element of $G$ appears exactly once in each row and exactly once in each column.

Proof（Corollary 3.3）

Fix $g\in G$ and define a map $\lambda_g : G\to G$ by $\lambda_g(x) = gx$. Composing with $\lambda_{g^{-1}}$, we get, for every $x$,

$$\lambda_{g^{-1}}\bigl(\lambda_g(x)\bigr) = g^{-1}(gx) = (g^{-1}g)x = ex = x$$

(using (G1), (G3) and (G2)), and similarly $\lambda_g(\lambda_{g^{-1}}(x)) = x$. Hence $\lambda_g$ is a bijection with inverse $\lambda_{g^{-1}}$. The entries in the $i$-th row of the table are $\lambda_{g_i}(g_1), \ldots, \lambda_{g_i}(g_n)$, so, being the image of a bijection, they consist of all elements of $G$, each occurring exactly once. For columns, run the same argument with $\rho_g(x) = xg$.

∎

This corollary is useful in practice: if, after writing out a multiplication table, some element appears twice in a row, a computation has gone wrong somewhere.

---

4. A catalogue of examples: commutative groups and noncommutative ones

Staring at the axioms will not teach you what a group is. Here are examples, alongside non-examples.

Example 4.1（Groups made from sets of numbers, and things that are not groups）

Groups.

• $(\mathbb{Z}, +)$, $(\mathbb{Q},+)$, $(\mathbb{R},+)$, $(\mathbb{C},+)$: the identity is $0$ and the inverse of $a$ is $-a$. All are abelian.
• $(\mathbb{Q}\setminus\{0\}, \times)$, $(\mathbb{R}\setminus\{0\},\times)$, $(\mathbb{C}\setminus\{0\},\times)$: the identity is $1$ and the inverse of $a$ is $1/a$. Without removing $0$ there would be no inverse for $0$ and (G3) would fail. These are abelian.
• $(\mathbb{R}_{>0}, \times)$: all positive reals. Closed under multiplication, and $a>0$ implies $1/a>0$, so inverses stay inside.
• A vector space $V$ over a field $K$ is an abelian group under addition (the part of the definition of a vector space（Definition 3.1）［Vector Spaces and Linear Maps］ in Vector spaces and linear transformations that concerns addition is exactly (G1)–(G4)).

Not groups.

• $(\mathbb{N}, +)$ with $\mathbb{N} = \{1,2,\ldots\}$: the identity $0$ is missing. Even after adjoining $0$, the inverse $-1$ of $1$ is not present, so (G3) fails.
• $(\mathbb{Z}\setminus\{0\}, \times)$: associativity holds and $1$ is an identity, but $2$ has no inverse, since $1/2 \notin \mathbb{Z}$.
• $(\mathbb{R}, -)$ with subtraction: $(5-3)-1 = 1 \ne 3 = 5-(3-1)$, so (G1) fails.

The next example is the most basic source of finite groups. For equivalence relations and quotient sets we follow Relations and equivalence relations.

Example 4.2（Groups from congruence of integers）

Let $n$ be a positive integer. Integers $a, b$ are congruent modulo $n$ when $n \mid a-b$, written $a\equiv b \pmod n$. This is an equivalence relation on $\mathbb{Z}$ (see congruence mod n is an equivalence relation（Proposition 3.4）［関係と同値関係］); we write the equivalence class of $a$ as $[a] = \{a + kn : k\in\mathbb{Z}\}$ and the set of all classes as $\mathbb{Z}/n\mathbb{Z}$. Then $\mathbb{Z}/n\mathbb{Z} = \{[0],[1],\ldots,[n-1]\}$, which has $n$ elements.

Checking that addition is well defined. We want to set $[a]+[b] := [a+b]$, but the answer must not depend on the choice of representatives. Suppose $[a]=[a']$ and $[b]=[b']$, so $n \mid a-a'$ and $n\mid b-b'$. Then

$$(a+b)-(a'+b') = (a-a') + (b-b')$$

is also divisible by $n$, whence $[a+b] = [a'+b']$. So addition is unambiguously defined.

Checking the group axioms. Associativity reduces to associativity of integer addition: $([a]+[b])+[c] = [(a+b)+c] = [a+(b+c)] = [a]+([b]+[c])$. The identity is $[0]$, and the inverse of $[a]$ is $[-a]$. Since $[a]+[b]=[a+b]=[b+a]=[b]+[a]$, the group is abelian. We have obtained a finite abelian group $(\mathbb{Z}/n\mathbb{Z}, +)$ of order $n$.

The multiplicative group. Multiplication $[a][b] := [ab]$ is well defined by the same argument. However, all of $\mathbb{Z}/n\mathbb{Z}$ is not a group under multiplication, since $[0]$ has no inverse. The class $[a]$ has a multiplicative inverse if and only if $\gcd(a,n)=1$. Indeed, if $\gcd(a,n)=1$ then by Bézout’s identity there are integers $x,y$ with $ax+ny=1$, and $[a][x]=[1-ny]=[1]$. Conversely, if $[a][x]=[1]$ then $ax-1 = ny$, and $\gcd(a,n)$ divides the left-hand side of $ax-ny=1$, so it equals $1$. Setting

$$(\mathbb{Z}/n\mathbb{Z})^{\times} := \{[a] : \gcd(a,n)=1\} ,$$

we obtain an abelian group under multiplication (closure follows from the fact that $\gcd(a,n)=\gcd(b,n)=1$ implies $\gcd(ab,n)=1$). For instance, when $n=8$ we get $(\mathbb{Z}/8\mathbb{Z})^\times = \{[1],[3],[5],[7]\}$, of order 4.

Everything so far has been commutative. We now turn to a noncommutative example.

Example 4.3（The general linear group GL(2,R)）

Write $GL(2,\mathbb{R})$ for the set of all $2\times 2$ real matrices with $\det A \ne 0$, with matrix multiplication as the operation.

• Closure: since $\det(AB) = \det A \cdot \det B$ (see the product theorem（Theorem 6.1）［Determinants and Their Properties］ in Determinants and their properties), $\det A\ne 0$ and $\det B \ne 0$ imply $\det(AB)\ne 0$.
• (G1): matrix multiplication corresponds to composition of linear maps (see the product represents the composite（Theorem 4.2）［Matrices and Linear Systems］ in Matrices and systems of linear equations), so associativity follows from Proposition 2.2. It can also be checked entrywise.
• (G2): the identity matrix $I$.
• (G3): for $A = \begin{pmatrix} p & q \\ r & s\end{pmatrix}$ with $\det A = ps-qr \ne 0$, the matrix $$A^{-1} = \frac{1}{ps-qr}\begin{pmatrix} s & -q \\ -r & p \end{pmatrix}$$ is the inverse, and $\det(A^{-1}) = 1/\det A \ne 0$, so it again lies in $GL(2,\mathbb{R})$.

Noncommutativity. Put $A = \begin{pmatrix}1&1\\0&1\end{pmatrix}$ and $B = \begin{pmatrix}1&0\\1&1\end{pmatrix}$ (both of determinant $1$). Then

$$AB = \begin{pmatrix}1&1\\0&1\end{pmatrix}\begin{pmatrix}1&0\\1&1\end{pmatrix} = \begin{pmatrix}2&1\\1&1\end{pmatrix}, \qquad BA = \begin{pmatrix}1&0\\1&1\end{pmatrix}\begin{pmatrix}1&1\\0&1\end{pmatrix} = \begin{pmatrix}1&1\\1&2\end{pmatrix}$$

so $AB \ne BA$. Hence $GL(2,\mathbb{R})$ is not abelian.

Note also that the set $M_2(\mathbb{R})$ of all $2\times 2$ real matrices is not a group under multiplication: the zero matrix $O$ has $\det O = 0$, and there is no $X$ with $OX = I$. It is precisely the step of “collecting only the invertible ones” that makes (G3) hold.

Remark 4.4

If we considered only commutative groups, group theory would come to an end rather quickly (the theorem that a finite abelian group decomposes as a direct product of cyclic groups almost exhausts the subject). The symmetries that actually occur in mathematics — permutations of the roots of an equation, rotations of space, the symmetry operations of a crystal — are mostly noncommutative. Rotations and reflections give different results when their order is swapped, and two moves of a Rubik’s cube do not commute either. Noncommutativity is not an inconvenient exception; it is the very thing group theory is meant to handle.

---

5. Symmetric groups and the symmetry of an equilateral triangle

Last, and most important, we construct the group formed by the “rearrangements” of a set.

Theorem 5.1（Symmetric group）

Let $X$ be a nonempty set and let $\operatorname{Sym}(X)$ denote the set of all bijections from $X$ to $X$. Then $\operatorname{Sym}(X)$ is a group under composition $\circ$.

Proof（Theorem 5.1）

Closure. Let $f, g \in \operatorname{Sym}(X)$. That $f\circ g$ is injective follows because $(f\circ g)(x) = (f\circ g)(y)$, that is $f(g(x)) = f(g(y))$, gives $g(x)=g(y)$ by injectivity of $f$ and then $x = y$ by injectivity of $g$. That it is surjective follows because, for any $z\in X$, surjectivity of $f$ provides a $y$ with $f(y)=z$ and surjectivity of $g$ provides an $x$ with $g(x)=y$, so that $(f\circ g)(x) = z$. Hence $f\circ g\in\operatorname{Sym}(X)$.

(G1): Proposition 2.2 applies verbatim.

(G2): the identity map $\mathrm{id}_X$ is a bijection, and for every $f$ and every $x$ we have $(\mathrm{id}_X\circ f)(x) = f(x)$ and $(f\circ \mathrm{id}_X)(x) = f(x)$, so $\mathrm{id}_X\circ f = f\circ\mathrm{id}_X = f$.

(G3): if $f$ is a bijection then the inverse map $f^{-1}$ exists and is again a bijection (its own inverse being $f$). By definition $f\circ f^{-1} = f^{-1}\circ f = \mathrm{id}_X$.

∎

Definition 5.2（Permutations and the symmetric group）

When $X = \{1,2,\ldots,n\}$, the group $\operatorname{Sym}(X)$ is called the symmetric group of degree $n$ and is written $S_n$; its elements are called permutations. A permutation $\sigma$ is written

$$\sigma = \begin{pmatrix} 1 & 2 & \cdots & n \\ \sigma(1) & \sigma(2) & \cdots & \sigma(n)\end{pmatrix} ,$$

and also, when it cycles $i_1 \mapsto i_2 \mapsto \cdots \mapsto i_k \mapsto i_1$ and fixes everything else, as $(i_1\, i_2\, \cdots\, i_k)$ (a cycle of length $k$). A cycle $(i\ j)$ of length 2 is called a transposition.

Caution

The product $\sigma\tau$ means the composite $\sigma\circ\tau$, that is, “apply $\tau$ first and then $\sigma$” (so $(\sigma\tau)(x) = \sigma(\tau(x))$). Some textbooks adopt the convention of applying maps from left to right, and in those the multiplication tables below appear transposed. This article uses right-to-left composition throughout.

Theorem 5.3（Order and noncommutativity of the symmetric group）

Let $n$ be a positive integer.

1. $|S_n| = n!$.
2. If $n \ge 3$ then $S_n$ is not abelian.

Proof（Theorem 5.3）

(1) We argue by induction on $n$. For $n=1$, $S_1$ consists of the identity map alone, so $|S_1| = 1 = 1!$. Let $n\ge 2$ and assume $|S_{n-1}| = (n-1)!$. Classify the elements of $S_n$ by the value of $\sigma(n)$, which can be any of the $n$ values $1,\ldots,n$. Fix $k$ and put $A_k = \{\sigma\in S_n : \sigma(n) = k\}$. Using the transposition $\tau_k = (k\ n)$ (the identity when $k=n$), define a map $A_k \to A_n$ by $\sigma\mapsto \tau_k\sigma$; since $(\tau_k\sigma)(n) = \tau_k(k) = n$, the image does lie in $A_n$. Because $\tau_k\tau_k = \mathrm{id}$, the map $\rho\mapsto\tau_k\rho$ is an inverse for it, so $A_k$ and $A_n$ have the same number of elements. On the other hand $A_n$ is the set of permutations fixing $n$, which may be identified with the set of all bijections of $\{1,\ldots,n-1\}$, so $|A_n| = (n-1)!$ by the induction hypothesis. The sets $A_1,\ldots,A_n$ are pairwise disjoint with union all of $S_n$, so

$$|S_n| = \sum_{k=1}^{n} |A_k| = n\cdot (n-1)! = n! .$$

(2) Let $n\ge 3$ and regard $\sigma = (1\ 2)$ and $\tau = (2\ 3)$ as elements of $S_n$ (they fix every number $\ge 4$). Then

$$(\sigma\tau)(1) = \sigma(\tau(1)) = \sigma(1) = 2, \qquad (\tau\sigma)(1) = \tau(\sigma(1)) = \tau(2) = 3 .$$

The values at $1$ differ, so $\sigma\tau \ne \tau\sigma$ and (G4) fails.

∎

5.1. The multiplication table of the symmetric group of degree 3

We write out the case $n=3$ completely. By Theorem 5.3, $|S_3| = 3! = 6$. Name the elements as follows.

$$e = \mathrm{id},\quad r = (1\,2\,3),\quad r^2 = (1\,3\,2),\quad a = (2\,3),\quad b = (1\,3),\quad c = (1\,2)$$

Let us verify that $r^2$ is $(1\,3\,2)$. Since $r$ sends $1\mapsto 2\mapsto 3\mapsto 1$, we get $r^2(1) = r(r(1)) = r(2) = 3$, $r^2(3) = r(r(3)) = r(1) = 2$, and $r^2(2) = r(3) = 1$. That is, $1\mapsto 3\mapsto 2\mapsto 1$, which is $(1\,3\,2)$. In the same way one checks $r^3 = e$.

As a representative computation, take $ra$. First apply $a=(2\,3)$, then apply $r$.

$$\begin{aligned} 1 &\xmapsto{\ a\ } 1 \xmapsto{\ r\ } 2, \\ 2 &\xmapsto{\ a\ } 3 \xmapsto{\ r\ } 1, \\ 3 &\xmapsto{\ a\ } 2 \xmapsto{\ r\ } 3. \end{aligned}$$

Hence $ra$ sends $1\mapsto 2$, $2\mapsto 1$, $3\mapsto 3$, that is, $ra = (1\,2) = c$. Computing $ar$ the same way, $1\xmapsto{r}2\xmapsto{a}3$, $2\xmapsto{r}3\xmapsto{a}2$, $3\xmapsto{r}1\xmapsto{a}1$, so $ar = (1\,3) = b$. Since $ra = c$ and $ar = b$ are different, $S_3$ is not commutative.

Example 5.4（The multiplication table of the symmetric group of degree 3）

Computing all products by the same procedure yields the following table. The $(i,j)$ entry is “row element $\cdot$ column element” (the row element being applied second).

$\cdot$	$e$	$r$	$r^2$	$a$	$b$	$c$
$e$	$e$	$r$	$r^2$	$a$	$b$	$c$
$r$	$r$	$r^2$	$e$	$c$	$a$	$b$
$r^2$	$r^2$	$e$	$r$	$b$	$c$	$a$
$a$	$a$	$b$	$c$	$e$	$r$	$r^2$
$b$	$b$	$c$	$a$	$r^2$	$e$	$r$
$c$	$c$	$a$	$b$	$r$	$r^2$	$e$

A check. As Corollary 3.3 asserts, each of $e, r, r^2, a, b, c$ occurs exactly once in every row and every column. For instance row $b$ reads $b, c, a, r^2, e, r$, which lists all six elements, and column $a$ reads $a, c, b, e, r^2, r$, again all six.

Confirming noncommutativity. The table is not symmetric about the diagonal: the $(r,a)$ entry is $c$ while the $(a,r)$ entry is $b$. In general, elements of $\{r,r^2\}$ do not commute with elements of $\{a,b,c\}$ (the identity $e$, of course, commutes with everything).

Partial commutativity. On the other hand the upper-left $3\times 3$ block (products among $e, r, r^2$) is symmetric. These three elements are closed under the operation and form, by themselves, a commutative group of order 3. This is our first example of a “subgroup”, treated in earnest in Subgroups and cosets.

5.2. Reinterpretation as the symmetry of an equilateral triangle

$S_3$ has a geometric meaning. Label the vertices of an equilateral triangle $1,2,3$ and consider the congruences (symmetry operations) that map the triangle onto itself. Each symmetry operation induces a rearrangement of the vertex set, so it corresponds to an element of $S_3$. Conversely, all six rearrangements do come from actual symmetry operations.

Symmetries of an equilateral triangle. The three dashed lines are the mirror axes through vertices 1, 2 and 3, corresponding to the transpositions (2 3), (1 3) and (1 2). The arrow at the centre is the 120-degree rotation r = (1 2 3).

The correspondence is as follows.

Element of $S_3$	Cycle	Geometric operation
$e$	—	leave the triangle alone
$r$	$(1\,2\,3)$	rotation by $120^\circ$ about the centre
$r^2$	$(1\,3\,2)$	rotation by $240^\circ$ about the centre
$a$	$(2\,3)$	reflection in the axis through vertex 1
$b$	$(1\,3)$	reflection in the axis through vertex 2
$c$	$(1\,2)$	reflection in the axis through vertex 3

The equation $ra = c$ states the geometric fact that “flip in the axis through vertex 1, then rotate by $120^\circ$” is the same operation as “flip in the axis through vertex 3”. And $ar = b$ shows that reversing the order gives a different reflection. Compare the abstract multiplication table with what happens when you turn a triangle over in your hands. This group is also known as the dihedral group $D_3$ of the equilateral triangle.

---

6. The order of an element, and cyclic groups

We now consider multiplying an element $a$ of a group by itself repeatedly. First we define powers: $a^0 := e$, $a^{n} := a^{n-1}a$ for $n \ge 1$, and $a^{-n} := (a^{-1})^{n}$. With these definitions, for all integers $m, n$,

$$a^{m+n} = a^m a^n, \qquad (a^m)^n = a^{mn}$$

hold (for $m,n\ge 0$ by induction on $n$; for negative exponents by a case analysis using part (4) of Proposition 3.2). We use these freely below.

Definition 6.1（Order of an element）

Let $a$ be an element of a group $G$. If there is a positive integer $n$ with $a^n = e$, the least such $n$ is called the order of $a$ and written $\operatorname{ord}(a)$. If no such $n$ exists, we say $a$ has infinite order and write $\operatorname{ord}(a) = \infty$.

We have $\operatorname{ord}(a) = 1$ only for $a = e$ (since $a^1 = a = e$). An element of order 2 is one with $a \ne e$ and $a^2 = e$, that is, $a^{-1} = a$. The reflections $a, b, c$ in $S_3$ are of this kind.

Proposition 6.2（Elements of a finite group have finite order）

Let $G$ be a finite group and $a\in G$. Then $\operatorname{ord}(a)$ is finite and $\operatorname{ord}(a)\le |G|$.

Proof（Proposition 6.2）

Put $|G| = N$ and consider the $N+1$ elements $a^0, a^1, a^2, \ldots, a^{N}$. All lie in $G$, but $G$ has only $N$ elements. By the pigeonhole principle there are indices $0\le i < j \le N$ with $a^i = a^j$. Multiplying both sides on the left by $(a^{i})^{-1} = a^{-i}$ and using the laws of exponents,

$$e = a^{-i}a^{i} = a^{-i}a^{j} = a^{j-i}$$

(one may equally view this as an application of the cancellation law, part (3) of Proposition 3.2). Here $1 \le j-i \le N$, so a positive integer $n$ with $a^n = e$ does exist, and the least such, $\operatorname{ord}(a)$, is at most $j-i \le N = |G|$.

∎

Theorem 6.3（Testing powers by the order）

Let $G$ be a group and $a\in G$ with $\operatorname{ord}(a) = n$ finite. Then for every integer $m$,

$$a^m = e \iff n \mid m .$$

Proof（Theorem 6.3）

($\Leftarrow$) If $n\mid m$ then $m = nq$ for some integer $q$, and by the laws of exponents $a^m = (a^n)^q = e^q = e$ (that $e^q = e$ follows by induction when $q\ge 0$, and from $e^{-1}=e$ when $q<0$).

($\Rightarrow$) Suppose $a^m = e$. By the division theorem for integers there are unique integers $q, s$ with $m = qn + s$ and $0\le s < n$. Then

$$e = a^m = a^{qn+s} = (a^n)^q a^s = e^q a^s = a^s .$$

If $s > 0$, then $a^s = e$ with $0 < s < n$, contradicting that $n = \operatorname{ord}(a)$ is the least positive integer $k$ with $a^k = e$. Hence $s = 0$, that is $m = qn$, so $n\mid m$.

∎

This theorem replaces the question “is $a^{100} = e$?” by the arithmetic question “does the order divide $100$?”. In a group of order 6, the corollary of Lagrange’s theorem we shall meet later (the order of an element divides the order of the group（Corollary 7.1）［Subgroups and Cosets］) restricts element orders to $1,2,3,6$, which makes computations much easier.

Definition 6.4（Generated subgroup and cyclic group）

For an element $a$ of a group $G$, put

$$\langle a\rangle := \{a^k : k \in \mathbb{Z}\}$$

and call it the set generated by $a$. It is closed under the operation of $G$ (since $a^ia^j = a^{i+j}$), contains $e = a^0$, and contains the inverse $a^{-k}$ of $a^k$, so it is itself a group. If $G = \langle a\rangle$ for some element $a$, then $G$ is called a cyclic group and $a$ a generator of it.

Proposition 6.5（Structure of cyclic groups）

Let $G$ be a group and $a\in G$.

1. If $\operatorname{ord}(a) = n$ is finite, then $\langle a\rangle = \{e, a, a^2, \ldots, a^{n-1}\}$ and these $n$ elements are pairwise distinct. In particular $|\langle a\rangle| = \operatorname{ord}(a)$.
2. If $\operatorname{ord}(a) = \infty$, then $a^i \ne a^j$ for integers $i \ne j$, and $\langle a\rangle$ is infinite.
3. Every cyclic group is abelian.

Proof（Proposition 6.5）

(1) For any integer $k$, the division theorem gives $k = qn+s$ with $0\le s<n$. The same computation as in the proof of Theorem 6.3 gives $a^k = (a^n)^qa^s = a^s$. Hence $\langle a\rangle \subseteq \{e,a,\ldots,a^{n-1}\}$. The reverse inclusion holds because each $a^s$ for $s = 0,1,\ldots,n-1$ is exactly the case $k = s$ of the definition. So the two sets are equal. Next, suppose $0\le i<j\le n-1$ with $a^i = a^j$; then $a^{j-i} = e$ with $0 < j-i \le n-1 < n$, contradicting the minimality of $n$. Hence the $n$ elements are distinct.

(2) If $a^i = a^j$ with $i<j$, then $a^{j-i} = e$ with $j-i>0$, so $a$ would have finite order, contrary to hypothesis. Hence all powers are distinct and $\langle a\rangle$ is an infinite set of the same cardinality as $\mathbb{Z}$.

(3) Let $G = \langle a\rangle$. Any two elements can be written $a^i, a^j$, and by the laws of exponents together with commutativity of integer addition,

$$a^ia^j = a^{i+j} = a^{j+i} = a^ja^i .$$

Hence (G4) holds.

∎

Taking the contrapositive, a noncommutative group is not cyclic. Since $S_3$ is noncommutative by Theorem 5.3, $S_3$ is not cyclic. Indeed, no element of $S_3$ has powers that produce all six elements. The next example confirms this.

Example 6.6（Computing orders）

The case of $S_3$. We find the order of each element using the table of Example 5.4.

• $e$: $e^1 = e$, so $\operatorname{ord}(e) = 1$.
• $r$: $r^2 \ne e$, and $r^3 = r^2\cdot r$, whose entry $(r^2, r)$ in the table is $e$. Hence $\operatorname{ord}(r) = 3$. Similarly $\operatorname{ord}(r^2) = 3$ (since $(r^2)^2 = r$ and $(r^2)^3 = e$).
• $a$: the $(a,a)$ entry is $e$, so $a^2 = e$, and $a\ne e$, giving $\operatorname{ord}(a) = 2$. Likewise $b$ and $c$ have order 2.

So the orders are $1,3,3,2,2,2$. The largest is 3, short of $|S_3| = 6$. By part (1) of Proposition 6.5, $|\langle x\rangle| = \operatorname{ord}(x) \le 3 < 6$, so $\langle x\rangle \ne S_3$ for every $x$; that is, $S_3$ is not cyclic. Note that $\langle r\rangle = \{e,r,r^2\}$ and $\langle a\rangle = \{e,a\}$.

The case of $\mathbb{Z}/12\mathbb{Z}$. This is an additive group, so powers are written $m[k] = [mk]$. Putting $d = \gcd(k,12)$, we have

$$\operatorname{ord}([k]) = \frac{12}{d} .$$

Here is why. The condition $m[k] = [0]$ is equivalent to $12 \mid mk$. Writing $12 = d\cdot(12/d)$ and $k = d\cdot(k/d)$, the condition $12\mid mk$ is equivalent to $(12/d) \mid m(k/d)$. Since $\gcd(12/d, k/d) = 1$, this is in turn equivalent to $(12/d)\mid m$, whose least positive solution $m$ is $12/d$. Carrying out the computation gives the following table.

$k$	0	1	2	3	4	5	6	7	8	9	10	11
$\gcd(k,12)$	12	1	2	3	4	1	6	1	4	3	2	1
$\operatorname{ord}([k])$	1	12	6	4	3	12	2	12	3	4	6	12

There are four elements of order 12, namely $[1],[5],[7],[11]$, and these are the generators. For instance $\langle [5]\rangle$ runs through $[5],[10],[3],[8],[1],[6],[11],[4],[9],[2],[7],[0]$ — all twelve elements — and so equals all of $\mathbb{Z}/12\mathbb{Z}$. The generators correspond to those $k$ coprime to $12$, and their number is Euler’s totient $\varphi(12) = 4$.

Example 6.7（Groups of order 4: the cyclic group and the Klein four-group）

Here is the smallest instance of the phenomenon that two groups can have the same order and yet differ as groups.

$\mathbb{Z}/4\mathbb{Z}$. By the same computation as in Example 6.6, $\operatorname{ord}([1]) = 4$. So $\langle [1]\rangle$ has 4 elements and equals all of $\mathbb{Z}/4\mathbb{Z}$. This group is cyclic.

$(\mathbb{Z}/8\mathbb{Z})^\times = \{[1],[3],[5],[7]\}$. As seen in Example 4.2, this is a group of order 4. Compute the square of each element:

$$3^2 = 9 = 8+1,\qquad 5^2 = 25 = 3\cdot 8 + 1, \qquad 7^2 = 49 = 6\cdot 8+1$$

so $[3]^2 = [5]^2 = [7]^2 = [1]$. That is, all three non-identity elements have order 2, and there is no element of order 4. By part (1) of Proposition 6.5, $|\langle x\rangle| = \operatorname{ord}(x)\le 2 < 4$, so this group is not cyclic. It is called the Klein four-group. Its multiplication table is as follows.

$\cdot$	$[1]$	$[3]$	$[5]$	$[7]$
$[1]$	$[1]$	$[3]$	$[5]$	$[7]$
$[3]$	$[3]$	$[1]$	$[7]$	$[5]$
$[5]$	$[5]$	$[7]$	$[1]$	$[3]$
$[7]$	$[7]$	$[5]$	$[3]$	$[1]$

(For example $3\cdot 5 = 15 = 8+7$, so $[3][5] = [7]$. The table is symmetric about the diagonal, which shows that the group is abelian.)

So there are two kinds of abelian group of order 4. To assert that there are genuinely “two kinds”, we must formalize what it means for $\mathbb{Z}/4\mathbb{Z}$ and the Klein four-group to be essentially different. That is the notion of isomorphism (isomorphisms and isomorphic groups（Definition 3.2）［群の準同型定理］), the subject of The isomorphism theorems for groups. For now, understand that the two are distinguished by the property “is there an element of order 4?”, which does not change under any renaming of elements.

Remark 6.8

We now have the axioms of a group, its basic properties, a representative supply of examples, and the notions of order and cyclic group. At the next stage we learn how to divide a whole group by a small group contained in it (a subgroup). In Subgroups and cosets we prove Lagrange’s theorem, that the order of a subgroup divides the order of the whole group, and in Normal subgroups and quotient groups we put a group structure on the set of cosets itself (quotient group（Theorem 5.1）［Normal Subgroups and Quotient Groups］). Going further, objects carrying not one but two operations (addition and multiplication) lead to Foundations of rings and fields. The fact that $\mathbb{Z}/n\mathbb{Z}$ appeared both as an additive group and as an object with a multiplication was a foretaste of this.

---

7. Exercises

Exercise 7.1Easy

Suppose every element $x$ of a group $G$ satisfies $x^2 = e$. Show that $G$ is abelian.

Solution

First, for any $x\in G$ the relation $x^2 = e$ reads $xx = e$, so by the definition of an inverse, $x^{-1} = x$ (and by the uniqueness of inverses, part (2) of Proposition 3.2, there is no other inverse of $x$).

Take arbitrary $a,b\in G$. The hypothesis applies to $ab\in G$ as well, so $(ab)^{-1} = ab$. On the other hand part (4) of Proposition 3.2 gives $(ab)^{-1} = b^{-1}a^{-1}$, and by what we just showed $b^{-1} = b$ and $a^{-1} = a$. Hence

$$ab = (ab)^{-1} = b^{-1}a^{-1} = ba ,$$

so (G4) holds and $G$ is abelian.

(The Klein four-group, Example 6.7, is an example satisfying this condition. By contrast $\mathbb{Z}/4\mathbb{Z}$ does not, since $[1]+[1] = [2]\ne [0]$.)

Exercise 7.2Standard

Using the multiplication table of Example 5.4, compute $xax^{-1}$ for every element $x$ of $S_3$, where $a = (2\,3)$. What can you conclude from the result?

Solution

First read off the inverses from the table: $e^{-1}=e$, $r^{-1} = r^2$ (since $rr^2 = e$), $(r^2)^{-1} = r$, $a^{-1}=a$, $b^{-1}=b$, $c^{-1}=c$.

• $x = e$: $eae^{-1} = a$.
• $x = r$: $rar^{-1} = (ra)r^2$. From the table $ra = c$, and the $(c, r^2)$ entry is $b$, so $rar^{-1} = b$.
• $x = r^2$: since $(r^2)^{-1} = r$, we have $r^2a(r^2)^{-1} = (r^2a)r$. From the table $r^2a = b$, and the $(b,r)$ entry is $c$, so $r^2a(r^2)^{-1} = c$.
• $x = a$: $aaa^{-1} = a$ (from $aa = e$ and then $ea = a$).
• $x = b$: $bab^{-1} = (ba)b$. From the table $ba = r^2$, and the $(r^2, b)$ entry is $c$, so $bab^{-1} = c$.
• $x = c$: $cac^{-1} = (ca)c$. From the table $ca = r$, and the $(r,c)$ entry is $b$, so $cac^{-1} = b$.

Every result is one of $a, b, c$; we never leave $\{a,b,c\}$. In other words, the set $\{a,b,c\}$ of all reflections is closed under the operation $g \mapsto xgx^{-1}$ (conjugation). The element $a$ had order 2, and the elements $b, c$ obtained also have order 2. This is no accident: since $(xax^{-1})^k = xa^kx^{-1}$, conjugation preserves order. Conjugation plays a central role in Normal subgroups and quotient groups.

Exercise 7.3Standard

For the elements

$$A = \begin{pmatrix} 0 & -1 \\ 1 & 0\end{pmatrix}, \qquad B = \begin{pmatrix} 1 & 1 \\ 0 & 1 \end{pmatrix}$$

of $GL(2,\mathbb{R})$, determine $\operatorname{ord}(A)$ and $\operatorname{ord}(B)$.

Solution

Both have determinant $1$, so both lie in $GL(2,\mathbb{R})$.

For $A$. Compute in turn:

$$A^2 = \begin{pmatrix} 0 & -1 \\ 1 & 0\end{pmatrix}\begin{pmatrix} 0 & -1 \\ 1 & 0\end{pmatrix} = \begin{pmatrix} -1 & 0 \\ 0 & -1\end{pmatrix} = -I .$$

Hence $A^3 = A^2A = -A \ne I$ and $A^4 = (A^2)^2 = (-I)^2 = I$. Since $A\ne I$, $A^2 = -I \ne I$, $A^3 = -A\ne I$ and $A^4 = I$, we get $\operatorname{ord}(A) = 4$. (Here $A$ is the matrix of the $90^\circ$ rotation about the origin, so this agrees with the geometric fact that four turns bring you back to the start.)

For $B$. We show by induction on $n$ that for every positive integer $n$,

$$B^n = \begin{pmatrix} 1 & n \\ 0 & 1\end{pmatrix} .$$

The case $n=1$ is the definition. Assuming $B^n$ has the stated form,

$$B^{n+1} = B^nB = \begin{pmatrix}1 & n\\ 0 & 1\end{pmatrix}\begin{pmatrix}1&1\\0&1\end{pmatrix} = \begin{pmatrix}1 & n+1 \\ 0 & 1\end{pmatrix}$$

which proves the claim. Therefore, for $n\ge 1$ the $(1,2)$ entry is $n \ne 0$, so $B^n \ne I$. Hence $\operatorname{ord}(B) = \infty$.

This exercise shows that the hypothesis “finite group” in Proposition 6.2 cannot be dropped. Inside the infinite group $GL(2,\mathbb{R})$, elements of finite order and elements of infinite order live side by side.

Exercise 7.4Hard

Let $G$ be a nonempty finite set equipped with an associative binary operation which in addition satisfies the two-sided cancellation laws

$$ax = ay \Rightarrow x = y, \qquad xa = ya \Rightarrow x = y \qquad (a,x,y\in G) .$$

Show that $G$ is a group. Also show by a counterexample that the assertion fails when $G$ is infinite.

Solution

Existence of an identity. Fix an element $a\in G$. The map $\lambda_a : G\to G$, $\lambda_a(x) = ax$, is injective, immediately by the left cancellation law. Since $G$ is finite and $\lambda_a$ maps $G$ to $G$, injectivity implies surjectivity. Likewise $\rho_a(x) = xa$ is a bijection.

Since $\lambda_a$ is surjective, there is an $e\in G$ with $ae = a$. We show this $e$ is a right identity. For any $b\in G$, surjectivity of $\rho_a$ gives a $y\in G$ with $b = ya$. Then, by associativity,

$$be = (ya)e = y(ae) = ya = b .$$

So $e$ is a right identity for every element. Running the same argument starting from surjectivity of $\rho_a$, we obtain an $e'$ with $e'a = a$, and using surjectivity of $\lambda_a$ we find that $e'b = b$ for all $b$. Taking $b = e$ gives $e'e = e$; on the other hand applying the right-identity property of $e$ to $e'$ gives $e'e = e'$. Hence $e = e'$, and $e$ is a two-sided identity.

Existence of inverses. Take $a\in G$. Since $\lambda_a$ is surjective there is a $b$ with $ab = e$, and since $\rho_a$ is surjective there is a $c$ with $ca = e$. Then

$$c = ce = c(ab) = (ca)b = eb = b$$

(the first step because $e$ is a right identity, the second by $ab=e$, the third by associativity, the fourth by $ca=e$, and the fifth because $e$ is a left identity). So $b = c$ is a two-sided inverse of $a$. Associativity was assumed, so (G1), (G2) and (G3) all hold and $G$ is a group.

A counterexample in the infinite case. Take $\mathbb{N} = \{1,2,3,\ldots\}$ with addition. Associativity holds, and $a+x = a+y$ as well as $x+a = y+a$ imply $x=y$, so both cancellation laws hold. But the only $e$ with $n + e = n$ is $e=0$, and $0\notin\mathbb{N}$, so there is no identity and $\mathbb{N}$ is not a group. Looking back at where finiteness was used in the proof, it enters at exactly one point: the inference “injective implies surjective”. For infinite sets that inference is unavailable (the map $x\mapsto x+1$ is injective on $\mathbb{N}$ but not surjective).

---

References

• Kazuo Matsuzaka, Daisūkei Nyūmon, Iwanami Shoten, 1976 — Chapter 2, “Groups”. A standard introduction that proceeds from the group axioms to the isomorphism theorems with carefully chosen examples (in Japanese).
• Akihiko Yukie, Daisūgaku 1: Gunron Nyūmon, Nippon Hyoronsha, 2010 — Chapters 1 and 2. Rich in computations with symmetric groups and concrete finite groups (in Japanese).
• Toshiyuki Katsura, Daisūgaku I: Gun to Kan, University of Tokyo Press, 2004 — Chapter 1. Concise, with a clear link to linear algebra (in Japanese).
• Michael Artin, Algebra, 2nd ed., Pearson, 2011 — Chapter 2, “Groups”. Builds group theory around matrix groups and symmetry, with a substantial treatment of $GL(n,\mathbb{R})$.
• Joseph J. Rotman, An Introduction to the Theory of Groups, 4th ed., Springer (GTM 148), 1995 — Chapters 1–2. Contains a detailed treatment of permutation groups.
• Arthur Cayley, “On the theory of groups, as depending on the symbolic equation $\theta^n = 1$”, Philosophical Magazine (4th series) 7 (1854) — the original paper in which the definition of an abstract group and its multiplication table first appear.

---

Appendix: How far can the group axioms be weakened?

Are one-sided axioms enough? In Definition 3.1 we required both the identity and the inverses to be two-sided. This is in fact redundant: assuming only one side suffices, provided the sides match (both left, or both right).

Proposition 7.5（A left identity and left inverses suffice）

Let a binary operation on a nonempty set $G$ satisfy associativity (G1) together with

• (G2’) there is an $e\in G$ with $ea = a$ for all $a\in G$ (a left identity);
• (G3’) for each $a\in G$ there is an $a'\in G$ with $a'a = e$ (a left inverse).

Then $(G,\cdot)$ is a group.

Proof（Proposition 7.5）

Take $a\in G$, use (G3’) to get $a'$ with $a'a = e$, and apply (G3’) again to $a'$ to get $a''$ with $a''a' = e$.

First we show $aa' = e$:

$$aa' = e(aa') = (a''a')(aa') = a''\bigl((a'a)a'\bigr) = a''(ea') = a''a' = e .$$

The first equality is (G2’), the second is $a''a'=e$, the third is a regrouping by associativity (G1), the fourth is $a'a = e$, the fifth is (G2’), and the sixth is $a''a'=e$. So $a'$ is also a right inverse of $a$.

Next we show $ae = a$. Using the relation $aa' = e$ just proved together with $a'a=e$ from (G3’),

$$ae = a(a'a) = (aa')a = ea = a$$

(using (G1) and (G2’)). So $e$ is also a right identity. This establishes (G2) and (G3), and $G$ is a group.

∎

The sides must not be mixed. Weakening to “left identity + right inverse” destroys the statement. On a set $G$ with $|G|\ge 2$, define the operation $x\cdot y := y$ (return the right-hand argument). Associativity holds, since $(xy)z = z$ and $x(yz) = z$. Every $u\in G$ is a left identity (as $u\cdot x = x$). Fixing some $e\in G$, we have $a\cdot e = e$ for every $a$, so if we regard $e$ as the left identity, every element has $e$ as a right inverse. Yet this $G$ is not a group. If it were, the cancellation law, part (3) of Proposition 3.2, would hold; but for two elements $x \ne y$ we have $x\cdot e = e = y\cdot e$ while $x \ne y$, so right cancellation fails. When weakening the axioms, the “side” of the identity and of the inverses must be kept consistent.

Why do textbooks state both sides? Even though Proposition 7.5 is available, the definition is given in two-sided form because, when working with concrete groups, one wants to use the two-sided identities directly. A weaker definition reduces the number of items to verify but forces you to route every use through this proposition. Conversely, when the task is to prove that some set is a group, Proposition 7.5 halves the work.