数理解析研究所講究録
第 1874 巻 2014 年 174-182

174

DETECTING SQUAREFREE NUMBERS
ANDREW R. BOOKER(JOINT WITH GHAITH A. HIARY AND JON P. KEATING)

These notes are a transcript of my lecture at the conference on Analytic Number Theory at RIMS, describing my joint work with Hiary and Keating on detecting squarefree
numbers. For a more formal account of our results, see our paper, arXiv: 1304.6937.

Motivation. The problem of squarefree testing is no doubt a familiar one, but let us
state it here for the record. Given a polynomial , say with coefficients in some finite
field , there is an easy test to determine whether is squarefree:
$f$

$f$

$\mathbb{F}_{q}$is squarefree $\Leftrightarrow gcd(f, f’)=1.$
By way of analogy, one can ask the same question for the rings of integers of the otherkind of global field, i.e. number fields, and in particular for ordinary integers. It isis replaced byoften lamented that we know no direct analogue of this fact when
Personally I do not feel that this is the right analogy to make in this case, since we also
, ones that work provably in probabilistic
have very good factoring algorithms overpolynomial time (which is arguably the most relevant measure of complexity in actual
practice). That is to say that over the function field, the problem of squarefree testing is
not very far removed (in terms of complexity) from that of factoring, so why should we
expect that to be the case for the integers? Nevertheless, the question remains:is squarefree more easily than by factoring it?
Can one determine whether
In this lecture, will propose an algorithm for detecting squarefree integers based on Lfunctions. make no promises in advance about the features of the algorithm, other thanthat it seems to be significantly different from the approaches that people have consideredin the past.
$f\in \mathbb{F}_{q}[t]$$\mathbb{Z}.$$\mathbb{F}_{q}[t]$$\mathbb{F}_{q}[t]$$N\in \mathbb{Z}$

$I$

$I$

What do we know already? (theoretical aspects). Before describing our method in
detail, let me begin with some background on the problem of squarefree testing, startingwith the theoretical aspects.
isFirst, since it is easy to identify squares in , to determine whether. Next,squarefree it suffices to find all of its prime factors up to the cube root
there is an algorithm called Pollard-Strassen that finds all prime factors of a given $N$. Combining these two facts, one gets anin timebelow a given bound. By the way, with somealgorithm for squarefree testing with running time
improvements to Pollard-Strassen specific to this problem, one can improve this veryslightly to $O(N^{1/6-c/\log\log N})$ for some $c>0.$$N\in \mathbb{Z}_{>0}$$\mathbb{Z}$$\sqrt[3]{N}$$B$$O(N^{\epsilon}\sqrt{B})$$O(N^{1/6+\epsilon})$What do we know already? (practical aspects). Turning to more pragmatic matters, now that we have computers with very large memory (hundreds of gigabytes), it ispossible to implement Pollard-Strassen and realize some gains in speed over trial division.
, meaning that the
Unfortunately, those gains do not kick in until is of size at leastor so. On the otherbasic algorithm described above is only practical for $N$ up to$B$$10^{9}$$10^{70}$

Date: October 31st, 2012.

175
hand, any $N\leq 10^{70}$ can, in practice, almost surely be factored with a smartphone ina few minutes. For larger $N$ , finding the complete factorization remains the only viableoption.
In conclusion, at least with present algorithms and technology, it is always better totry to factor $N$ . One should not view this too negatively, since it is partly because ourfactoring algorithms have gotten so good. The best known algorithms (Elliptic Curve
Method, Quadratic Sieve, Number Field Sieve, . . .) are all expected to run in subexponential time $O(\exp[(\log N)^{\theta+o(1)}])$ . $(\theta=1/2 for ECM and QS, \theta=1/3 for NFS.)$ We
generally cannot prove the running time estimates of these algorithms (although one candescribe variants with provable subexponential probablistic running time under GRH).
But that does not stop them from working well in practice, in recent years enabling thefactorization of RSA moduli with over 200 digits.

Something a little different. Still, we can hold out hope of finding a better algorithm
for squarefree testing. In order to give any algorithm that does not rely on factoring,
it is clear that we first need a characterization of the squarefree numbers that does not
mention their factorization. That is supplied by the following simple observation:$d\equiv 1(mod 4),$Given
is squarefree if and only if it is a fundamental
discriminant.
$d=(-1)^{\frac{N-1}{2}N}$
Note that if
is odd thensatisfies $d\equiv 1(mod 4)$ , so this restriction
entails no loss of generality.
That this is a useful characterization rests on two key points. First, given such awhether or not is a fundamental discriminant can be determined from values of thequadratic character$d$$d\in \mathbb{Z},$$N\in \mathbb{Z}$

$d,$

$d$

$\chi_{d}(n)=(\frac{d}{n})$,(where the right-hand side is the Kronecker symbol) since its conductor will be unexpectedly small if is not fundamental; will elaborate on this point in the next section.
Second (and also very simple but nonetheless important), we can computefor any
given without knowing the factorization of . Thus, there is no circular logic in what
have described (at least not so far). This is thanks to quadratic reciprocity, which is actually built in to the notation of the Kronecker symbol, since we think of it as a character$mod d$ , even though we write theon top. In particular, if is a prime number then the
Kronecker symbol reduces to the Legendre symbol, which can be evaluated quickly, e.g.
by Euler’s criterion.
$d$

$I$

$\chi_{d}(n)$

$n$

$d$

$I$

$d$

$n$

Elaboration of the first key point. We can express uniquely in the form
, whereis a fundamental discriminant and. We aim to show that is squarefree, i.e.
$\ell=1$ . More generally,
it suffices to show that is small, since at the end of the day wecan apply Pollard-Strassen, or even just trial division, to rule out small square divisorsof
To see how to use the values of the quadratic character to get information about its
conductor, consider the following series$d$$\triangle\ell^{2}$$\triangle$$d$$\ell\in \mathbb{Z}_{>0}$$\ell$$d.$$S_{\triangle}(x)= \frac{1}{\sqrt{x}}\sum_{n=1}^{\infty}\chi_{\Delta}(n)(\frac{n}{x})^{(1-\chi_{\Delta}(-1))/2}e^{-\pi(n/x)^{2}}$The alert reader will object that this expression depends on the unknown value of
However, as in the second key point above, we can computefor a given with$\triangle.$$\chi_{\triangle}(n)$

$n$

176
unlessknown factorization, even without knowledge of A–in fact we have
a
found
have
will
we
then
an
such
encouter
ever
.
If
we
has a common factor withthatsquare factor of , answering the original question. We might as well assume thatnever happens.
, just with a different
Note that the sum is essentially the -function associated tolike to think of it this way, since if one thinks of thenormalization of the variable.
as random ls then, thanks to the decay of the Gaussian, the sum is the resultof a random walk of length about , roughly speaking. By the philosophy of the central, solimit theorem, we should typically expect such a sum to have size on the order ofto oscillate randomly, without growing too large or decaying as
one might expect$\chi_{\Delta}(n)=\chi_{d}(n)$$n$$\ell$$n$$d$$\theta$$\chi_{\Delta}$

$I$

$\pm$

$\chi_{\Delta}(n)$$x$$\sqrt{x}$$S_{\Delta}(x)$$xarrow\infty.$

This turns out to be an accurate description forreason is Poisson summation, which imphes the symmetry$x\leq\sqrt{|\Delta|}$$S_{\Delta}(x)=S_{\Delta}(|\triangle|/x)$, but not after that. The.

, it is forced to do the same
displays up toThus, whatever random behavior$(In$
does decay for very large
particular,
thing in reverse for larger values of, contrary to the above philosophy.) Now, the point is that this symmetry gives us anand seeis not too small, it suffices to graph. To prove thatindication ofthat it does not “turn around” too early.
This hand-wavy argument can be completed to see that this gives another sourceof “square root running time”, as in Pollard-Strassen, so it essentially reproduces thetime mentioned above. Moreover, if we had a method of computing thesubstantially more quickly than the obvious approach by direct, in-orderfunctionsummation, we could break the 1/6 barrier in the exponent.
$\sqrt{|\Delta|}$$S_{\Delta}(x)$$S_{\Delta}(x)$

$x.$

$x$

$S_{\Delta}(x)$$\triangle$$|\triangle|$$\theta-$$O(N^{1/6+\epsilon})$$S_{\Delta}(x)$The explicit formula. Although that would be a great result (the 1/6 has not been
improved upon since the discovery of $Po1lard-$Strassen over 40 years ago), it is still a far
cry from the subexponential time expected of our best factoring algorithms. There is a
simple reason for that, which has to do with the fact that we considered a sum over all
positive integers in the above. It is well-understood in problems of this type that one
can do better by considering sums over primes, at the expense of having to assume theGeneralized Riemann Hypothesis (GRH).
What I am talking about is the “explicit formula” for -functions. To be precise, let
us assume GRH and denote the non-trivial zeros of the Dirichlet -function. Further,, where, by
be a test function which is continuous of compact support, piecewise
let :cosine transform $h(t)=2 \int_{0}^{\infty}g(x)\cos(tx)dx$ . Then the exphcit
Fouriersmooth, and has
formula is the following distributional identity:
$n$

$L$

$L$

$\sum_{n=1}^{\infty}\chi_{\Delta}(n)n^{-s}$$\frac{1}{2}\pm i\gamma_{j}(\triangle)(j=1,2, \ldots)$$L(s, \chi_{\Delta})=$$0\leq\gamma_{1}(\triangle)\leq\gamma_{2}(\triangle)\leq\ldots$$[0, \infty)arrow \mathbb{C}$$g$$g(0) \log|\triangle|=2\sum_{j=1}^{\infty}h(\gamma_{j})+2\sum_{n=1}^{\infty}\frac{\Lambda(n)\chi_{\Delta}(n)}{\sqrt{n}}g(\log n)$$+g(0) \log(8\pi e^{\gamma})-\int_{0}^{\infty}\frac{g(0)-g(x)}{2\sinh(x/2)}dx+\chi_{\Delta}(-1)\int_{0}^{\infty}\frac{g(x)}{2\cosh(x/2)}dx.$

Here is the von Mangoldt function, so the sum over is supported on prime powers. The
integrals on the second line give, philosophically, the contribution from the “archimedean
prime”.
$\Lambda$

$n$

177
What the explicit formula is a formula for is in the eye of the beholder. To Riemann it
was a way of getting information about the primes in terms of the zeros of the function.
$\zeta-$More recently, people have turned the tables and tried to study statistical properties ofzeros using our knowledge of primes. In the formula as presented above it is neither;instead it is a formula for the conductor (or rather its logarithm) in terms of primes andzeros. Note that if not for the zero sum, this would be precisely what we seek, i.e. aformula for the conductor in terms of character values. With the zeros in there, we do
not get such a nice identity, but let us see what we can do with it anyway.

Using the explicit formula to boundfrom below. All terms in the explicit
formula are easily computed apart from the zeros . Actually, they can be computed aswell, but our methods of doing so rely on the standard technology of sums in additive form
meaning that they would be much too slow to be of any use in our current application. ’
However, for the purposes of a lower bound for(remember that’s what we want
to show thatis close ), we can simply ignore the problem, i.e. choose so that is
non-negative and ignore the zero contribution:$|\triangle|$$\gamma_{j}$$\log|\triangle|$$\triangle$

$d$

$h$

$g$

$\log|\triangle|\geq 2\sum_{n=1}^{\infty}\frac{\Lambda(n)\chi_{\triangle}(n)}{\sqrt{n}}g(\log n)+\log(8\pi e^{\gamma})$$- \int_{0}^{\infty}\frac{1-g(x)}{2\sinh(x/2)}dx+\chi_{\Delta}(-1)\int_{0}^{\infty}\frac{g(x)}{2\cosh(x/2)}dx.$

for any with $g(O)=1$ and non-negative cosine transform
Naturally, we pay a price for ignoring the zero sum, in that our estimate
foris a factor of
too small. However, we can remedy $thisJ$ by applying PollardStrassen to rule out up to , but that takes exponential timein the size of $S.$
On the other hand, we also face an exponential penalty for increasing the support of thetest function (recall that the explicit formula involves $g(\log n)$ ). If the support of is too
small then, by the uncertainty principle, the zero sum will typically be large.
Our first result is that there is a “best” test function to use for each $X$ , and thus an
optimal tradeoff between these two exponential penalties:
$g$

$h.$

$S= \sum h(\gamma\cdot)$$e^{2S}$$\triangle$$e^{S}$$\ell$$\gg e^{S/2}$$g$

Theorem. Let $C(X)$ be the class of functions :that are continuous
supported on $[0, X]$ , have non-negative cosine, and satisfy $g(0)=1$ . For
transform$g\in C(X)_{f}$ let
denote our lower bound. Then for any $X>0,$such that$g$$[0, \infty)arrow \mathbb{R}$$h$$\Lambda(g)$$\exists g_{X}\in C(X)$$\Lambda(g_{X})\geq\Lambda(g)\forall g\in C(X)$.

This is only an existence result. To actually find a goodwhere has many parameters, e.g.
$f$

$g$

in practice, we let $g=f*f$$f(x)= \sum_{n=-M}^{M}a_{n}1_{(-1/2,1/2)}(\frac{2M+1}{X}x-n) , a_{-n}=a_{n}\in \mathbb{R}.$(This is perhaps better stated in words:
is a step function, with steps on a fine gridof points between $X/2$ and $X/2$ , and with the height of the steps treated as
variables.)Then
is a positive-definite quadratic form in the parameters , and we cancompute the whole matrix of the form directly from the explicit formula. The
condition$g(O)=1$ amounts to an
normalization, so we are asking for the smallest eigenvalue ofthe quadratic form, which is readily computed using standard software forlinear algebra.
$f$-$\sum h(\gamma_{j})$$a_{n}$$L^{2}$

178
It is not hard to see that this family of test functions comes arbitrarily close to the
optimal as $Marrow\infty$ . However, the optimal might be highly oscillatory, meaning that
we would have to take $M$ very large.
$g$

$g$

for a
by
Twisting. Another strategy is to “twist” our given quadratic character
known fundamental discriminant . In other words, if we run out of luck with our given
then we can multiply by and ask if the product is fundamental. This is related to thefirst strategy since, by Fourier analysis, varying the test function amounts to considering
for various
combinations of the twists by
On the surface this might seem like a bad idea, since we are making the number large, we have torather thanby multiplying by ; in fact to get a bound for$\chi_{d}$$\chi_{q}$

$q$

$d$

$q$

$t.$

$n^{it}$$\log|q\triangle|$$\log|\Delta|$$q$

subtract $\log|q|$ :$\log|\triangle|\geq 2\sum_{n=1}^{\infty}\frac{\Lambda(n)\chi_{q\Delta}(n)}{\sqrt{n}}g(\log n)+\log|\frac{8\pi e^{\gamma}}{q}|$$- \int_{0}^{\infty}\frac{1-g(x)}{2\sinh(x/2)}dx+\chi_{q\Delta}(-1)\int_{0}^{\infty}\frac{g(x)}{2\cosh(x/2)}dx.$

However, we do gain something by this approach, as we discuss next.

When is this likely to work? Either approach (varying the test function or using
to be small, but with the support
twists) has two opposing goals: We wantof also not too large. Typically (for carelessly chosen of small support), the zero sum
will dominate the right-hand side of the explicit formula, since the left-hand side justreflects the average zero density and, by the uncertainty principle, must be relatively“wide”
However, if there is a region where the zeros are unusually sparse then we can hope toachieve both goals. What we are relying on is the (empirical) observation that the zeros
do not rigidly line up according to their average density; sometimes they are much closer
together than average and sometimes much farther apart. The simplest idea is to look
for a large gap between zeros:$\sum h(\gamma_{j}(q\triangle))$

$g$

$g$

$h$

. Set $X=$
has no zeros with imaginary part in
Theorem. Suppose that$(A+$ log log
for some $A\geq 0$ . Then there is an explicit $g\in C(X)$ whose cosine$(-\delta, \delta)$$L(s, \chi_{q\Delta})$$2\delta^{-1}$$|q\triangle|)$transform satisfies$h$$\sum_{j=1}^{\infty}h(\gamma_{j}(q\triangle))\ll\frac{e^{-A}X}{(\log\log|q\triangle|)^{3/2}}.$

In other words, there is an explicit test with support of size inversely proportional to
the size of the zero gap for which the zero sum is relatively small. (Note that it is enoughfor the zero sum to be less than $X$ , since then the work done in computing the terms ofis already enough to rule out small values ofthe explicit formula for all primes up tosquarefree.)
The parameter is present to show thatand complete the proof that isone can defeat even a lazily-derived implied constant at the expense of only a modest
increase in the size of $X.$
The proposition also suggests another strategy for finding good test functions: Fix achoice of , anticipating a gap of a certain size, and twist by various choices of . Oncea suitable has been found, we can refine our choice of test function using the quadratic
form approach with a relatively small matrix.
$e^{X}$$d$$\ell$

$h$

$q$

$A$

$q$

179
Zero gaps and running time. The previous theorem tells us that it is sufficient to finda large zero gap. To make this precise and to understand how quickly we can expect themethod to work, we define$M_{\Delta}( \theta)=\max\{\gamma_{1}(q\triangle)$:$q$fund. disc.,$|q|\leq\exp((\log|\triangle|)^{\theta})\},$$\eta_{\Delta}(\theta)=-\frac{\log M_{\Delta}(\theta)}{\log\log|\triangle|}, \eta_{\infty}(\theta)=\lim_{|\Delta|arrow}\sup_{\infty}\eta_{\Delta}(\theta)$,$\theta^{*}=\inf\{\theta>0:\eta_{\infty}(\theta)\leq\theta\}.$In other words, we consider the largest zero gap that we can find among the twists by
all values of up to(anticipating a subexponential running time comparable tothat of the factoring algorithms), and renormalize it on a logarthmic scale. Recall thatthe average gap between zeros is proportional to, which corresponds to $\eta=1.$
We might think of a large gap as having size on the order of, say, which would
correspond to $\eta=1/2$ . Finally, since our only information abouta priori is that itis large, we consider the worst case by taking thesup. Then our precise result is thefollowing:$e^{(\log|\triangle|)^{\theta}}$$q$$1/\log|\triangle|$$1/\sqrt{\log|\triangle|}$$|\triangle|$$\lim$

Theorem. Assume $GRH$ for quadratic Dirichlet -functions. There is an algorithm
that takes as input a positive integer $N$ and outputs either a non-trivial square factor
of $N$ or a proof that $N$ is squarefree. If $N$ is squarefree then the algorithm runs in time$O(\exp[(\log N)^{\theta^{*}+o(1)}])$ .
$L$

This looks great of course. It is a proof of deterministic subexponential running time,
but there is a catch–the result is only non-trivial if it turns out that
. That isprobably true (more on that in a bit), but seems to be beyond our technology to prove atpresent, even assuming the GRH. (We can prove thatby a simple computationof the 1-level density.)$\theta^{*}<1$$\theta^{*}\in[0,1]$

Random matrix theory. This does not stop us from making a reasonable conjectureof the value of . The tool of choice for this is random matrix theory, which we explain
as follows.
Any $N\cross N$ unitary matrix is conjugate to a unique matrix of the form$\theta^{*}$$A$$(\begin{array}{lll}e^{i\theta_{1}} \ddots e^{i\theta_{N}}\end{array}),$where $0\leq\theta_{1}\leq\theta_{2}\leq\cdots\leq\theta_{N}<2\pi$ . The angles
are called the eigenphasesof . On the other hand, assuming GRH, an interval of length
along the critical lineof any -function contains roughly log(conductor) zeros, which one may also regard as
eigenphases of some unitary matrix. The philosophy of random matrix theory assertsthat properly phrased statistical questions regarding zeros of families of -functions canbe modeled by analogous questions about matrices chosen randomly from an ensemble
such as $U(N),$ $Sp(2N),$ $O(2N),$
according to Haar measure.
There is by now a lot of empirical evidence for this philosophy. think it is fair to saythat nobody really has as inkling for why it is true, though as noted above, that does
not stop us from putting it to good use. For the particular family of quadratic twists,
it is expected (from comparison of 1-level densities) that the right ensemble to consider
is symplectic, i.e. $Sp(2N)$ , with. To conjecture a value for , we have thefollowing result:$\theta_{N}$$\theta_{1},$$\ldots,$$A$$2\pi$

$L$

$L$

$($

$\ldots)$$I$$2N\approx\log|\triangle|$$\theta^{*}$

180
Theorem. Fix $\beta\in(0,2)$ , and define$M_{\beta}(N):=\lfloor\exp((2N)^{\beta})\rfloor, s_{\epsilon,\beta}^{\pm}(N):=(4\pm\epsilon)(2N)^{\beta/2-1}.$

Let$A_{1},$$\ldots,$$A_{M_{\beta}(N)}\in Sp(2N)$

measure. Then, for fixed

be chosen independently and uniformly with respect to Haar
, as $Narrow\infty$ we have$\epsilon>0$$\mathbb{P}_{USp(2N)}(s_{\epsilon,\beta}^{-}(N)<\max_{1\leq m\leq M_{\beta}(N)}\theta_{1}(A_{m})\leq s_{\epsilon,\beta}^{+}(N))arrow 1.$

In other words,$(2N)^{1-\beta/2} \max_{1\leq m\leq M_{\beta}(N)}\theta_{1}(A_{m})$converges in distribution to 4.

, the -aspect takes over, so(forforThis suggests thatis constant after that), leading to the conjecture $\theta^{*}=2/3.$
presumably$\theta>1$$\theta\in[0,1]$$\eta_{\infty}(\theta)=1-\theta/2$$q$$\eta_{\infty}(\theta)$. More generally, we
byMore general twists. We considered twists oftwists by the given
theirconsiderand-functions
automorphic
may take any family of. The explicit formula for the twisted family may again be used to produce
character. Natural examples of twist families include:
a lower bound for
Elliptic curve L–functions. Can we take advantage of the occurrence of high-orderzeros (under BSD) to force zero repulsion?
Dedekind -functions. Can we make use of the existence of towers of number fields
of bounded root discriminant?
Rankin-Selberg -functions. Can we make use of the algebraic structure of thecoefficients of -functions implied by the Langlands conjectures to find correlating
twists quickly?
All of these are ideas for future investigations. Nevertheless, it would be a fair criticism
at this point that the method seems to do worse than existing factoring algorithms, since
2/3 is larger than the expected complexity exponents for factoring. There are a coupleof saving graces. First, our method at least has the virtue of relying on a different setof heuristics (random matrix theory as opposed to distributional questions about smooth
numbers), and it is reasonable to hope that we will one day be able to substantiate enoughof those heuristics to give a proof of determinstic subexponential running time. Second,and more tangibly, our method gives partial information that one does not obtain from afailed attempt at factoring, as illustrated in the following.
$L(s, \chi_{\Delta})$$\chi_{q}$$L$$\chi_{\Delta}$$\log|\triangle|$$\bullet$$\bullet$$\zeta$$L$$\bullet$$L$

Sample numerical result.

Theorem. Assume $GRH$ for quadratic Dirichlet$L$-functions. Then

$RSA-210=245246644900278211976517663573088018467026$$787678332759743414451715061600830038587216$$952208399332071549103626827191679864079776$$723243005600592035631246561218465817904100$$131859299619933817012149335034875870551067$

is not squarefull, $i.e$ . it has at least one simple prime factor.

The challenge number $RSA-210$ is significant because, at 210 digits, it is the smallest
that has not yet been factored. Certainly the technology to factor it exists, and infact the slightly longer $RSA-704$ (212 digits) and $RSA-768$ ( $232$ digits) were factored in2012 and 2009, respectively. However, it remains prohibitively expensive to perform suchfactorizations routinely. By constrast, the proof of the theorem above could be obtained

181
using a desktop $PC$ in a couple of months. To my knowledge, this is the first statement
to be proven about the factorization of a composite integer without exhibiting any of
its factors. (The alert reader might protest that, by construction, RSA-210 must be a
product of two distinct primes and therefore squarefree. The point is that we have no
proof of that fact, since its prime factors were never recorded.)
The proof of the theorem is contained in the following graph, which shows our lower
bound for(i.e. RSA-210 divided by its largest square factor) as a function of the sizeof the prime sum, for the particular twist $q=-9334602088654580277283$ . The graph ison a log-log scale, i.e. using the primes up to
in the explicit formula, we get a lower
bound of. Also shown is the lower bound that one obtains from trial division using
the same primes (we checked that RSA-210 is not a perfect square, so it must have atleast one prime factor of odd multiplicity; ruling out small prime factors thus gives thelower bound $y=x$ ) and that obtained from a theoretically perfect implementation of
Pollard-Strassen (which runs in square root time, corresponding to the bound $y=2x$ ;in reality, practical implementations of Pollard-Strassen only surpass trial division by asmall margin near the end of the graph). Although for a fixed choice of our method
initially does worse (since we make things harder when multiplying by ), in the end we
get nearly a four-fold improvement in the lower bound (i.e.
as opposed to).
$|\triangle|$$10^{x}$$10^{y}$$q$$q$$10^{60}$$10^{15}$

182$\underline{o}$$(O\circ$$\circ L\Omega$$\triangleleft O$$[O\circ$$c\triangleleft\circ$