Mastering Mathematical Logic
Free self-study book

Mastering Mathematical Logic: Complete Edition

From absolute zero to proofs, predicate logic, metatheory, and a working logic engine.

How to use this book

How to use this book#

This is a self-study book. It was written for a reader who may know nothing about logic: not the symbols, not the vocabulary, not the habits of mathematical writing. Everything is explained before it is used. If you already know the connectives (∧, ∨, ¬, →) and can fill in truth tables, you can skip parts of Part Zero, but you are encouraged to skim them: many "obvious" things (what exactly a proposition is, why → behaves oddly, what a variable really is) are where later confusion starts.

The book has four layers.

Layer What it is Where
Part Zero Mathematics and reasoning from scratch: what an argument is, mathematical language, sets, functions, relations, sequences, trees; a complete atlas of every symbol and its variants; the many notations and proof formats used in textbooks and tools Chapters Z1–Z5
Core chapters The main line of the course: ideas, worked examples, strategy Chapters 0–9, sections numbered 1.1, 1.2, …
"Complete detail" companions At the end of each chapter's numbered sections, a companion that revisits the chapter from zero: every definition, every symbol and variant, every rule, every format, more examples and a quick-check with answers Sections 1.8, 2.9, 3.8, 4.7, 5.14, 6.7, 7.9, 8.8
Problems and appendices Graded problems at the end of each chapter; rule sheets; a mistakes catalogue; hints and solutions; a glossary; a typing and tool-syntax cheat sheet "Problems for Chapter N"; Appendices A–E

Suggested reading orders.

Structure of every chapter: ideas, then worked examples, then the companion, then problems.

Difficulty marks on problems:

Rules for effective study:

  1. Write proofs on paper. Reading a proof and producing a proof are different skills. Only the second one is the goal.
  2. Struggle first. Spend at least 15-20 minutes on a problem before opening the hints in Appendix C.
  3. Justify every line. In formal proofs, each line gets a rule name and line references. In informal proofs, each sentence should follow from earlier ones for a reason you could state.
  4. Redo, don't re-read. A week later, redo a proof you solved from a blank page. If you can't, you memorized it instead of understanding it.
  5. Keep an error log. Whenever you make a mistake (wrong quantifier order, illegal ∀-introduction, circular reasoning), write it down. Your mistakes are very repetitive, and the log makes them visible.
  6. Build the project in parallel (Chapter 8). Implementing a rule is the strictest test of whether you understood it.
  7. Use the quick-checks. Each companion ends with a quick-check with answers. Cover the answer, write yours, then compare.

Reading conventions in this book.

Companion files. The Chapter 8 starter kit is shipped as two files next to this document: logic_engine_starter.py (the engine) and test_starter.py (its 2,520 checks). Section 8.8 explains how to use them.

Suggested pace: about 12 weeks at 6-8 hours per week for the core text (Chapter 9, Section 9.3); about 16 weeks if you start from zero and read all of Part Zero and the companions (Section 9.4).



PART ZERO. Starting from absolute zero ↑ Top#

This part assumes nothing. If a word, a symbol, or a habit of mathematical writing appears later in the course, it is explained here first. Read it in order the first time. Later you can use it as a reference: Chapter Z4 is a complete atlas of symbols, and Appendix D is an A-Z glossary.


Chapter Z1. What logic is, and what we are trying to do ↑ Top#

Z1.1 Reasoning, statements and arguments#

Every day you move from things you accept to new things you accept:

"The shop closes at 6. It is now 6:30. So the shop is closed."

You did not look at the shop. You reasoned. Logic is the study of which such moves are correct, and why.

To study reasoning precisely we need names for its parts.

A statement (also called a proposition or declarative sentence) is a sentence that claims something is the case, so that it makes sense to ask "is it true or false?". Examples:

Statement Truth value
"Paris is the capital of France." true
"2 + 2 = 5" false
"There are infinitely many prime numbers." true
"Every even number greater than 2 is the sum of two primes." nobody knows yet (Goldbach's conjecture), but it is either true or false
"It is raining in Lviv right now." true or false depending on the moment

A statement has exactly one truth value: true or false. (In classical logic, which is the main subject of this course, there is no third option and no "both".)

Things that are not statements:

Sentence Why not
"What time is it?" a question, it does not claim anything
"Close the door!" a command
"Wow!" an exclamation
"x is greater than 3." its truth depends on what x is (an open sentence, see Z2)
"This sentence is false." it cannot consistently be assigned true or false (the liar paradox)

An argument is a collection of statements in which some, the premises, are offered as support for another, the conclusion. Words that often signal a conclusion: therefore, thus, hence, so, consequently, it follows that. Words that often signal a premise: because, since, given that, for, as.

Premise 1: All humans are mortal. Premise 2: Socrates is a human. Conclusion: Therefore, Socrates is mortal.

Z1.2 Validity: the central idea#

The most important concept in all of logic:

An argument is valid when it is impossible for all the premises to be true and the conclusion false at the same time.

Equivalently: if the premises were all true, the conclusion would have to be true. Validity is about the connection between premises and conclusion, not about whether the premises are actually true.

Study these four arguments carefully.

# Argument Premises true? Conclusion true? Valid?
1 All dogs are mammals. Rex is a dog. So Rex is a mammal. yes yes valid
2 All dogs are reptiles. Rex is a dog. So Rex is a reptile. no (first) no valid (!)
3 All dogs are mammals. Rex is a mammal. So Rex is a dog. yes maybe not invalid
4 Some cats are black. Tom is a cat. So Tom is black. yes maybe not invalid

Argument 2 is valid even though everything in it is false. The shape is perfect: if all dogs really were reptiles, and Rex really were a dog, then Rex would have to be a reptile. Argument 3 is invalid even though its premises and conclusion might all be true: the premises do not force the conclusion (Rex could be a cat, which is also a mammal).

Soundness of an argument (a different, everyday word that logicians also use): an argument is sound if it is valid and all its premises are true. A sound argument guarantees a true conclusion. Argument 1 is sound. Argument 2 is valid but unsound.

Warning on vocabulary. In everyday speech "valid" is used loosely ("that is a valid point"). In logic it has only the meaning above, and it applies to arguments, never to single statements. Single statements are called true/false (in one situation) or logically true/tautologies (in all situations). We will make this precise in Chapters 1 and 3. Also, in Chapter 6, "soundness" gets a second, technical meaning for proof systems.

Z1.3 Form versus content#

Why is argument 1 valid? Look at what happens when we erase the specific words and keep only the pattern:

text
All A are B.
x is an A.
Therefore x is a B.

Any argument with this shape is valid, whatever A, B, and x stand for:

Logic is the study of forms (patterns, schemas) of arguments. We replace words by letters (variables) so that the pattern is what remains. This is the reason logic uses symbols at all: not to look scary, but to isolate the pattern from the subject matter. A form is valid when every argument of that form is valid.

Invalid form (affirming the consequent):

text
If A then B.
B.
Therefore A.

Counterexample: "If it is raining, the street is wet. The street is wet. Therefore it is raining." (Perhaps a street cleaner passed by.)

A counterexample to an argument form is an argument of that exact form with true premises and a false conclusion. One counterexample proves invalidity. This idea (find a world where premises are true and conclusion is false) will return as the countermodel in Chapter 3.

Z1.4 Kinds of reasoning#

Kind What it does Example Guarantee
Deduction conclusion is forced by premises "All primes > 2 are odd. 17 is a prime > 2. So 17 is odd." If premises true, conclusion certainly true
Induction generalizes from observed cases "Every swan I saw was white, so all swans are white." Probable, not certain (and this one is false: black swans exist)
Abduction infers the best explanation "The grass is wet, so it probably rained." Plausible, not certain

Mathematical logic is about deduction. (Do not confuse mathematical induction, a deductive proof technique in Chapter 5, with inductive reasoning.)

Z1.5 Why make logic formal?#

Natural language is wonderful but ambiguous.

Sentence Two readings
"I saw the man with the telescope." I used a telescope / the man had a telescope
"All the students did not pass." none passed / not all passed
"Tea or coffee?" one of them (exclusive) / either or both
"Every student reads some book." each student has their own book / one particular book is read by all
"If you mow the lawn I'll give you $5." (also implies: otherwise no $5?)

To reason with total certainty we need a language where each sentence has exactly one meaning. That is a formal language: a collection of symbols, together with exact rules for which strings of symbols count as legitimate sentences (syntax), what each sentence means (semantics), and how to derive sentences from others using mechanical rules (proof theory, or deduction).

Advantages of formalization:

  1. No ambiguity. One formula, one meaning.
  2. Checkability. A proof becomes a finite object that a program can verify, step by step, with no understanding at all. (This is how proof assistants such as Lean work.)
  3. Generality. The same rules apply to arithmetic, geometry, software specifications, legal contracts, circuit design.
  4. Theorems about reasoning itself. Once reasoning is a mathematical object, we can prove things about it: that it is correct, that it is complete, that some questions cannot be settled by any algorithm (Chapter 6).

Z1.6 The three pillars#

Every logical system we study has three components. Keep this triangle in mind for the entire course:

text
                SYNTAX
        (symbols, formulas, rules
         for what is well-formed)
               /        \
              /          \
     SEMANTICS ────────── PROOF THEORY
   (meaning: truth,       (derivations:
    models, ⊨)             rules, proofs, ⊢)
Pillar Question it answers Chapters
Syntax Which strings of symbols are sentences? 1.1, 3.2, Z4
Semantics When is a sentence true? What follows from what in meaning? 1.2, 3.5
Proof theory What can be derived by rules, without looking at meaning? 2, 4, 7

The deepest results (soundness and completeness, Chapter 6) say that the last two pillars agree.

Z1.7 A map of the field#

Branch Studies Appears in
Propositional logic statements combined by and, or, not, if...then Ch. 1-2
Predicate / first-order logic objects, properties, relations, "for all", "there exists" Ch. 3-4
Proof techniques how mathematicians actually prove things Ch. 5
Model theory structures that make sentences true Ch. 3, 6
Proof theory proofs as mathematical objects Ch. 2, 4, 6
Computability what algorithms can and cannot do Ch. 6
Set theory the foundation in which mathematics is formalized Z3, Ch. 5-6
Automated reasoning making computers prove things Ch. 7-8
Non-classical logics modal, temporal, intuitionistic, many-valued... Ch. 2.7, 3, 6

Z1.8 A very short history#

When Who Contribution
c. 350 BC Aristotle Syllogisms: first systematic study of valid argument forms
c. 300 BC Stoics (Chrysippus) Logic of "if...then", "or", "and": early propositional logic
1847 George Boole Logic as algebra (the root of Boolean algebra and digital circuits)
1879 Gottlob Frege Begriffsschrift: the first full predicate logic with quantifiers
1889 Giuseppe Peano Axioms for the natural numbers; modern symbols such as ∈ and ∃
1901-10 Russell, Whitehead Russell's paradox; Principia Mathematica
1920s Hilbert and school Formal systems; the program to prove mathematics consistent
1929-31 Kurt Gödel Completeness theorem (FOL), then the incompleteness theorems
1934-35 Gerhard Gentzen Natural deduction and sequent calculus
1936 Church, Turing Undecidability of first-order validity; models of computation
1950s-60s Robinson, Davis, Putnam Resolution, unification, automated theorem proving
1960s-today Howard, de Bruijn, Martin-Löf, Coquand... Proofs as programs; proof assistants (Lean, Coq/Rocq, Isabelle)

Z1.9 Try it#

Q1. Which of these are statements? (a) "7 is prime." (b) "Is 7 prime?" (c) "x + 1 = 8." (d) "Every planet has a moon." (e) "Stop!" Q2. Is this argument valid? "If I win the lottery, I'll be rich. I am rich. Therefore I won the lottery." Why or why not? Q3. Give an example of a valid but unsound argument. Q4. What is the form of: "If the battery is dead then the car won't start. The battery is dead. So the car won't start."?

Answers. A1. (a) and (d) are statements ((d) is false but still a statement). (b) is a question, (e) a command, (c) is an open sentence (depends on x). A2. Invalid (affirming the consequent): one can be rich for other reasons (inheritance). A3. "All fish can fly. A shark is a fish. So a shark can fly." Valid form, false premise. A4. "If A then B. A. Therefore B." (modus ponens, valid).


Chapter Z2. The language of mathematics ↑ Top#

Mathematical writing has its own grammar and vocabulary. Misreading it is the most common source of mistakes for beginners. This chapter is a field guide.

Z2.1 Kinds of mathematical text#

Term Meaning Example
Definition Gives a precise meaning to a new word or symbol "An integer n is even if n = 2k for some integer k."
Axiom (or postulate) A statement accepted without proof, as a starting point "For any two points there is exactly one line through them."
Theorem An important statement that has been proved "√2 is irrational."
Proposition A less central theorem "The sum of two even integers is even."
Lemma A helper theorem, proved on the way to a bigger result "If n² is even then n is even."
Corollary A theorem that follows quickly from a previous one "No integer of the form 4k + 3 is a sum of two squares."
Conjecture A statement believed true but not yet proved Goldbach's conjecture
Claim A statement to be proved within a larger proof "Claim: x is positive."
Remark / Note Comment, not part of the logical chain
Example / Counterexample A specific case supporting / refuting a general statement
Proof A convincing, step-by-step argument that a statement follows from accepted facts

End-of-proof marks: ∎ (the "tombstone" or Halmos symbol), □, ■, Q.E.D. (Latin quod erat demonstrandum, "which was to be shown"), sometimes // or "as required". All mean "the proof is complete".

Defined terms vs. defining symbols. When a definition introduces notation, mathematicians use one of: :=, ≔, =:, ≝, ≜, def=, :⇔ (for statements), or just words ("we write ... for ..."). The colon sits on the side of the thing being defined: A := B defines A to be B.

A subtle but crucial convention: definitions are "if and only if", even when written with "if". "An integer is even if it is divisible by 2." really means even exactly when divisible by 2. It is a definition, so both directions hold. (Theorems written with "if" are one-directional. Context tells you which you are reading.)

Z2.2 A dictionary of mathematical English#

Phrase What it means (precisely) Logical form
if P then Q, P implies Q, P ⇒ Q Whenever P holds, Q holds. P → Q
P only if Q P can be true only when Q is; i.e., if P then Q. P → Q
P if Q If Q then P. (Arrow points the other way!) Q → P
P if and only if Q, P iff Q, P ⇔ Q, P is equivalent to Q They stand or fall together. P ↔ Q
P is sufficient for Q P guarantees Q. P → Q
P is necessary for Q Without P, no Q. Q → P
P unless Q If not Q then P. ¬Q → P
not P, it is not the case that P P is false. ¬P
P and Q, both P and Q Both hold. P ∧ Q
P or Q, P or Q or both At least one holds (inclusive or, the default in mathematics). P ∨ Q
either P or Q (but not both), exactly one of exclusive or. P ⊕ Q
neither P nor Q Both fail. ¬P ∧ ¬Q
for all x, for every x, for each x, for any x The claim holds no matter which x. ∀x
there exists x such that, for some x, there is an x At least one x makes it true. ∃x
there exists a unique x, exactly one x Exactly one. ∃!x
no x satisfies P None. ¬∃x P(x)
such that, s.t., with, where (sometimes also ∋, |, :) Introduces a condition on the object just named. (part of ∃ or set-builder)
Let x be ..., Suppose ..., Assume ... Introduces an object or hypothesis for the rest of the argument. ∀I, →I
WLOG, without loss of generality One case is stated, and the others follow by symmetry. (case reduction)
it suffices to show Proving this smaller thing proves everything.
hence, thus, therefore, so, consequently The next statement follows from what precedes.
since, because, as Introduces a reason already established.
i.e. (id est) "that is" (restating)
e.g. (exempli gratia) "for example"
in particular a special case of what was just said ∀E
conversely the reverse implication
vacuously true true only because the "if" part never occurs
trivial, obvious, clearly A signal that justification is routine (be careful!)
well-defined The definition does not depend on arbitrary choices
arbitrary but fixed A generic, unspecified element about which only the stated assumptions are known
contrapositive of "if P then Q" "if not Q then not P" (equivalent) ¬Q → ¬P
converse of "if P then Q" "if Q then P" (not equivalent) Q → P

Six traps that catch every beginner#

1. "Or" is inclusive. "n is even or n > 10" is true for n = 12 (both). Everyday "or" is often exclusive ("soup or salad"), so you must override your habit.

2. "Some" means "at least one" (possibly all). "Some primes are odd" is true. It does not suggest that some primes are not odd.

3. "A" can mean "any" or "some". "A prime greater than 2 is odd" means every prime greater than 2 is odd. "A prime is bigger than 100" means some prime. Always decide whether a hidden "for all" or "there exists" is present.

4. "Any" is slippery. "If any student fails, the class is delayed" (= some: if at least one fails). "Any student can answer this" (= every). Replace "any" by "every" or "some" explicitly when writing mathematics.

5. Order of quantifiers. "For every person there is someone they love" is not the same as "there is someone whom every person loves". Compare: ∀x ∃y L(x, y) and ∃y ∀x L(x, y). In ordinary mathematical prose the order of phrases is the order of quantifiers: read left to right.

6. "If...then" is not about causes. "If 2 + 2 = 5 then the moon is cheese" is true in logic. It is a claim about truth values only (we will explain why in Chapter 1.3).

Z2.3 The common shapes of mathematical statements#

Almost every theorem fits one of these shapes. Recognizing the shape tells you what the proof must look like (this becomes precise in Chapter 5).

Shape Example What you prove
Universal "for all x, P(x)" "Every square is nonnegative." Take an arbitrary x, show P(x)
Existential "there is x with P(x)" "There is a prime between 20 and 30." Exhibit one x (23), show P(x)
Conditional "if P then Q" "If n is even then n² is even." Assume P, show Q
Universal conditional "for all x, if P(x) then Q(x)" "Every even number's square is even." Take arbitrary x, assume P(x), show Q(x)
Biconditional "P iff Q" "n is even iff n² is even." Prove P → Q and Q → P
Uniqueness "exactly one x" "The identity element is unique." Existence, then: two such x are equal
Negation "not P" "√2 is not rational." Assume P, derive absurdity
Disjunction "P or Q" "x² = 4 ⇒ x = 2 or x = −2" Show one of them (often by cases)
Conjunction "P and Q" "n is even and positive." Prove each

How to negate each shape (essential skill)#

Statement Negation (in words) Symbolic
P and Q not P, or not Q (or both) ¬P ∨ ¬Q
P or Q not P, and not Q ¬P ∧ ¬Q
if P then Q P holds and Q fails P ∧ ¬Q
for all x, P(x) there is some x where P fails ∃x ¬P(x)
there exists x, P(x) for every x, P fails ∀x ¬P(x)
for all x there exists y, R(x, y) there is some x such that for every y, R fails ∃x ∀y ¬R(x, y)
P iff Q exactly one of P, Q holds (P ∧ ¬Q) ∨ (¬P ∧ Q)

Examples:

Z2.4 Anatomy of a proof (a first complete example, narrated)#

We prove this very simple statement and mark every move.

Theorem. If n is an even integer, then n + 1 is odd.

Definitions used. An integer n is even if there exists an integer k with n = 2k. An integer n is odd if there exists an integer k with n = 2k + 1.

Step What is written What it is doing
0 The statement has the shape "if P then Q": P = "n is even", Q = "n + 1 is odd". Identify the shape: to prove an "if...then", assume the "if" part.
1 "Let n be an even integer." Introduce the object and assume P. Here n is arbitrary: we know nothing about it except that it is even.
2 "By definition of even, there is an integer k with n = 2k." Unpack the definition of the hypothesis. It gives us a concrete equation to work with.
3 "Then n + 1 = 2k + 1." Calculation: we substitute equals for equals.
4 "Since k is an integer, this is of the form 2k + 1, so n + 1 is odd by definition." Repack: we match the result against the definition of the goal Q.
5 ∎ The goal was reached; the "if" part was used, so the conditional is proved.

The pattern identify the shape, unpack definitions, calculate, repack definitions is the heart of most introductory proofs. In Chapter 5 we make each move precise as a rule of logic.

Z2.5 How to read mathematics#

  1. Slowly, with a pencil. A page of mathematics can need an hour.
  2. Read definitions twice, and write examples. If a definition says "n is even if n = 2k", test n = 6 (k = 3), n = 7 (impossible), n = 0 (k = 0).
  3. When you meet a symbol you do not know, look it up (Chapter Z4) before continuing.
  4. For a theorem, find the hypotheses and the conclusion. Rewrite it as "Assume ... Then ...".
  5. Test with an example, then a non-example, then see where the proof uses each hypothesis. A proof that never uses a hypothesis is suspicious (or the hypothesis is redundant).
  6. Rewrite the proof in your own words from memory.

Z2.6 A note on notation habits#

Z2.7 Try it#

Q1. Rewrite using "if...then": (a) "n is divisible by 6 only if n is even." (b) "A number is positive if it is greater than 5." (c) "Passing the exam is necessary for graduating." Q2. Negate: (a) "All dogs bark." (b) "There is a number which is both even and prime greater than 2." (c) "If it is Monday then the shop is open." Q3. Is "If 2 is odd then 3 is even" true or false? Explain. Q4. What does "for every real x there is a real y with y > x" say? What does "there is a real y such that for every real x, y > x" say? Are both true? Q5. What is the contrapositive of "If n is prime and n > 2 then n is odd"?

Answers. A1. (a) If n is divisible by 6 then n is even. (b) If a number is greater than 5 then it is positive. (c) If you graduate then you passed the exam. A2. (a) Some dog does not bark. (b) Every number that is even is either not prime or is not greater than 2 (equivalently: every even prime is ≤ 2). (c) It is Monday and the shop is not open. A3. True: the "if" part (2 is odd) is false, so the conditional is vacuously true (Chapter 1.3). A4. The first says there is no largest real number (true). The second says there is a largest real number (false). So order of quantifiers changes the meaning. A5. If n is not odd (i.e., n is even) then n is not prime or n ≤ 2. (Negating a conjunction: ¬(n prime ∧ n > 2) = n not prime ∨ n ≤ 2.)



Chapter Z3. The mathematics you need first: sets, numbers, functions, relations, strings, trees ↑ Top#

Logic talks about things, collections of things, and connections between things. Mathematics gives us standard words for these. You need them for predicate logic (Chapter 3) and for every proof in Chapter 5. Everything below is introduced from scratch.

Z3.1 Sets#

Z3.1.1 What a set is#

A set is a collection of distinct objects, called its elements or members. What matters is which objects are in it. Not order, not repetition.

Notation Reads Meaning
a ∈ A "a is an element of A", "a belongs to A", "a in A" a is one of the members of A
a ∉ A "a is not an element of A" a is not a member of A
∋ "contains as a member" (rare) A ∋ a means a ∈ A

Z3.1.2 Ways to describe a set#

1. Listing (roster notation): {1, 2, 3}, {red, green, blue}. Order and repetition do not matter: {1, 2, 3} = {3, 2, 1} = {1, 1, 2, 3}.

2. Dots for pattern: {1, 2, 3, ..., 100}, {2, 4, 6, ...} (infinite). Only use when the pattern is obvious.

3. Set-builder notation: { x | P(x) } or { x : P(x) }, read "the set of all x such that P(x)". Examples:

Set-builder Reads Elements
{ x ∈ ℤ | x > 0 } the integers x such that x is positive 1, 2, 3, ...
{ n² : n ∈ ℕ } the squares n² where n is a natural number 0, 1, 4, 9, ...
{ x ∈ ℝ | x² = 4 } real solutions of x² = 4 { −2, 2 }
{ n ∈ ℤ | 2 divides n } even integers ..., −2, 0, 2, ...

Note: the vertical bar | here means "such that". Elsewhere | means "divides" (3 | 12) or absolute value (|x|). Context disambiguates, which is why many authors prefer the colon in set-builder.

4. By a rule or definition ("the set of all prime numbers").

Z3.1.3 Special sets#

Symbol Name Meaning
∅ or {} the empty set the set with no elements. Note ∅ ≠ {∅}: the second has one element (the empty set).
U or 𝒰 or Ω the universe (universal set) everything under discussion
{a} a singleton the set whose only member is a
{a, b} a pair set exactly two elements (if a ≠ b)

Z3.1.4 Equality, subsets, supersets#

Two sets are equal when they have exactly the same elements (extensionality):

A = B iff for every x: x ∈ A ↔ x ∈ B.

Subset. A ⊆ B ("A is a subset of B", "A is contained in B") means every element of A is also an element of B:

A ⊆ B iff ∀x (x ∈ A → x ∈ B).

Symbol Meaning Caution
A ⊆ B A is a subset of B (A may equal B)
A ⊂ B Ambiguous! Some books: same as ⊆. Other books: proper subset (A ⊆ B and A ≠ B). Check the author's convention
A ⊊ B proper subset: A ⊆ B and A ≠ B unambiguous
A ⊇ B A is a superset of B (B ⊆ A)
A ⊄ B A is not a subset of B

Facts: ∅ ⊆ A for every set A (vacuously true: there is no element of ∅ that could fail to be in A). A ⊆ A. If A ⊆ B and B ⊆ C then A ⊆ C. A = B iff A ⊆ B and B ⊆ A (this is how equality of sets is proved: show both inclusions).

Z3.1.5 Operations on sets#

Let A and B be sets, inside a universe U.

Operation Symbols (variants) Definition Reads
Union A ∪ B { x | x ∈ A ∨ x ∈ B } "A union B", "A cup B"
Intersection A ∩ B { x | x ∈ A ∧ x ∈ B } "A intersect B", "A cap B"
Difference A ∖ B, A − B, A \ B { x | x ∈ A ∧ x ∉ B } "A minus B", "A without B"
Complement Aᶜ, A′, Ā, ∁A, ~A, U ∖ A { x ∈ U | x ∉ A } "complement of A", "not A"
Symmetric difference A △ B, A ⊕ B, A Δ B (A ∖ B) ∪ (B ∖ A) elements in exactly one of them
Cartesian product A × B { (a, b) | a ∈ A ∧ b ∈ B } "A cross B" (see Z3.1.7)
Power set 𝒫(A), P(A), 2^A { S | S ⊆ A } set of all subsets of A
Cardinality |A|, #A, card(A) the number of elements (finite case) "size of A"

The correspondence with logic is exact (and worth memorizing):

Set operation Logical connective Condition for membership
A ∩ B and (∧) x ∈ A ∧ x ∈ B
A ∪ B or (∨, inclusive) x ∈ A ∨ x ∈ B
Aᶜ not (¬) ¬(x ∈ A)
A ∖ B and-not x ∈ A ∧ ¬(x ∈ B)
A △ B exclusive or (⊕) (x ∈ A) ⊕ (x ∈ B)
A ⊆ B implies (→) for all x ∀x (x ∈ A → x ∈ B)
A = B iff (↔) for all x ∀x (x ∈ A ↔ x ∈ B)

Because of this, every logical law has a set-theoretic twin: De Morgan's law ¬(P ∧ Q) ≡ ¬P ∨ ¬Q becomes (A ∩ B)ᶜ = Aᶜ ∪ Bᶜ.

Example. A = {1, 2, 3, 4}, B = {3, 4, 5}, U = {1, 2, 3, 4, 5, 6}.

Z3.1.6 Venn diagrams#

A Venn diagram draws sets as overlapping regions inside a rectangle (the universe). Text sketch for two sets:

text
 ┌──────────────────────────────────────┐
 │ U                                    │
 │      ╭──────────╮╭──────────╮        │
 │     ╱   A only   ╳  A ∩ B   ╲ B only│
 │     ╲            ╳           ╱       │
 │      ╰──────────╯╰──────────╯        │
 │                 outside both = (A ∪ B)ᶜ│
 └──────────────────────────────────────┘

The four regions are exactly the four rows of a two-variable truth table (A and B, A only, B only, neither). That is why Venn diagrams can verify propositional laws.

Z3.1.7 Ordered pairs, tuples, Cartesian products#

A set ignores order. When order matters we use an ordered pair (a, b): it satisfies (a, b) = (c, d) iff a = c and b = d. So (1, 2) ≠ (2, 1) but {1, 2} = {2, 1}. (Formally one can define (a, b) as the set {{a}, {a, b}}, but you only need the equality property.)

An n-tuple (a₁, a₂, ..., aₙ) generalizes: ordered, repetition allowed. A × B is the set of all pairs with first entry from A and second from B. Aⁿ is the set of n-tuples of elements of A: A² = A × A, ℝ³ is 3-dimensional space. If |A| = m and |B| = n then |A × B| = m·n.

Z3.1.8 Indexed families, big union, big intersection#

If for each i in an index set I we have a set Aᵢ:

Notice the pattern: big union is an existential statement, big intersection is a universal one. Same as ∃ and ∀.

Z3.1.9 Partitions#

A partition of a set S is a family of non-empty, pairwise disjoint sets whose union is S. Example: the even and the odd integers partition ℤ.

Z3.1.10 Intervals of real numbers#

Notation Set Name
[a, b] { x ∈ ℝ : a ≤ x ≤ b } closed interval
(a, b) { x ∈ ℝ : a < x < b } open interval
[a, b) , (a, b] half-open
(a, ∞), [a, ∞), (−∞, b), ... unbounded ∞ is a symbol, not a number

Warning: (a, b) also denotes an ordered pair. Context decides.

Z3.1.11 A caution: not every collection is a set#

If we allowed "the set of all sets that are not members of themselves", we would get Russell's paradox (it would belong to itself exactly when it does not). Modern set theory (ZFC) avoids this by restricting how sets can be formed. You will meet this again in Chapter 6.

Z3.2 Numbers and arithmetic notation#

Z3.2.1 The standard number systems#

Symbol Name Elements Notes
ℕ natural numbers 0, 1, 2, 3, ... or 1, 2, 3, ... Convention varies! Logic and computer science usually include 0. Many analysis texts start at 1. State your convention. Some write ℕ₀ = {0, 1, 2, ...} and ℕ⁺ or ℕ₁ = {1, 2, ...}.
ℤ integers ..., −2, −1, 0, 1, 2, ... from German Zahlen
ℚ rational numbers fractions p/q with p, q ∈ ℤ, q ≠ 0 from quotient
ℝ real numbers all points on the number line includes √2, π, e
ℂ complex numbers a + bi with a, b ∈ ℝ, i² = −1
ℙ prime numbers (sometimes) 2, 3, 5, 7, 11, ...
ℤ⁺, ℝ⁺, ℝ>0 positive integers / reals
ℤₙ, ℤ/nℤ integers modulo n {0, 1, ..., n − 1} "clock arithmetic"

Inclusions: ℕ ⊆ ℤ ⊆ ℚ ⊆ ℝ ⊆ ℂ.

Z3.2.2 Order and comparison#

Symbol Reads Meaning
< less than
> greater than
≤ less than or equal (also written ⩽, ≦)
≥ greater than or equal
≠ not equal
≪, ≫ much less / much greater informal
≈ approximately equal not exact

Z3.2.3 Operations and common functions#

Symbol Meaning Examples
+, − addition, subtraction
×, ·, juxtaposition ab multiplication 3 × 4 = 3·4 = 12
÷, /, a/b, fraction bar division 12 / 4 = 3
aⁿ, a^n, a**n exponentiation (n copies of a multiplied) 2⁵ = 32
√a, a^(1/2) square root √9 = 3
|x| absolute value |−5| = 5; |x − y| is the distance between x and y
n! factorial 5! = 5·4·3·2·1 = 120; 0! = 1
⌊x⌋ floor (round down) ⌊3.7⌋ = 3
⌈x⌉ ceiling (round up) ⌈3.2⌉ = 4
a mod n, a % n remainder of dividing a by n 17 mod 5 = 2
a ≡ b (mod n) a and b leave the same remainder when divided by n 17 ≡ 2 (mod 5)
a | b a divides b: there is an integer k with b = a·k 3 | 12 is true, 5 | 12 is false
a ∤ b a does not divide b
gcd(a, b) greatest common divisor gcd(12, 18) = 6
lcm(a, b) least common multiple lcm(4, 6) = 12
∑ᵢ₌₁ⁿ aᵢ sum a₁ + a₂ + ... + aₙ ∑ᵢ₌₁⁴ i = 1 + 2 + 3 + 4 = 10
∏ᵢ₌₁ⁿ aᵢ product a₁ · a₂ ··· aₙ ∏ᵢ₌₁⁴ i = 24
∞ infinity (a symbol meaning "unbounded") not a real number
min, max smallest, largest max(3, 7) = 7

The sign ≡ is overloaded: in logic it means "logically equivalent"; in number theory "congruent modulo n"; in some books "is defined as" or "identically equal". Always read it in context.

Z3.2.4 Basic number-theory vocabulary#

Term Definition
even n = 2k for some integer k (equivalently 2 divides n)
odd n = 2k + 1 for some integer k
prime an integer p > 1 whose only positive divisors are 1 and p
composite an integer > 1 that is not prime (it has a divisor strictly between 1 and itself)
rational a real number equal to p/q with p, q integers, q ≠ 0
irrational a real number that is not rational
divisor / factor a divides n
multiple n is a multiple of a if a divides n
coprime gcd(a, b) = 1

Note: 1 is not prime; 0 is even; negative integers can be even or odd (−4 = 2·(−2)).

Z3.3 Functions#

Z3.3.1 Definition#

A function f from a set A to a set B, written f : A → B, assigns to each element x of A exactly one element f(x) of B.

Term Meaning
domain (of f) A, the set of allowed inputs
codomain (of f) B, the set where outputs live
range or image (of f) { f(x) | x ∈ A }, the set of outputs that actually occur (a subset of the codomain)
x ↦ f(x) "x maps to f(x)": a way to describe the rule, e.g. x ↦ x²
f(x) = y "the value of f at x is y"

Example. f : ℤ → ℤ, f(x) = x². Domain ℤ, codomain ℤ, range {0, 1, 4, 9, ...}. Two things to note: every input has exactly one output (so f(2) = 4 only), but different inputs can share an output (f(2) = f(−2) = 4).

Functions with several inputs: f : A × B → C, written f(a, b). Equivalent: a function of an n-tuple. We say f has arity n. A constant is a function of arity 0 (no inputs): it just names an element.

Partial functions are defined only on part of the domain (division is a partial function on ℝ, undefined at 0). "Function" without qualification means total: defined everywhere on the domain.

Predicates as functions: a statement-valued function P : A → {true, false} is a predicate. For instance Even(n) is true exactly when n is even. The set { x ∈ A | P(x) } is the extension of P (the set of things the predicate holds of).

Z3.3.2 Composition, identity, inverse#

Concept Notation Meaning
Composition g ∘ f, "g after f" (g ∘ f)(x) = g(f(x)) (apply f first, then g)
Identity function id_A, 1_A, id id(x) = x
Inverse function f⁻¹ a function with f⁻¹(f(x)) = x for all x in A and f(f⁻¹(y)) = y for all y in B. Exists exactly when f is a bijection.
Image of a set f[S], f(S) { f(x) | x ∈ S }
Preimage of a set f⁻¹[T], f⁻¹(T) { x ∈ A | f(x) ∈ T }. Defined even when f has no inverse.

Caution: f⁻¹ can mean the inverse function or the preimage operation, and f⁻¹(x) is not 1/f(x).

Z3.3.3 Three key properties#

Property Meaning Formal statement
Injective (one-to-one, "1-1", an injection) different inputs give different outputs ∀a ∀b (f(a) = f(b) → a = b)
Surjective (onto, a surjection) every element of the codomain is hit ∀y ∈ B ∃x ∈ A (f(x) = y)
Bijective (a bijection, "one-to-one correspondence") both injective and surjective

Examples:

Z3.3.4 Counting with functions: cardinality#

Two sets have the same cardinality if there is a bijection between them. A set is finite if it has the same cardinality as {1, ..., n} for some n; otherwise infinite. A set is countably infinite if it has the same cardinality as ℕ ("it can be listed in a sequence"); ℤ and ℚ are countably infinite. Uncountable sets (like ℝ, and 𝒫(ℕ)) are infinite sets too big to list; Cantor proved this with a diagonal argument (Chapter 5.12). The cardinality of ℕ is written ℵ₀ ("aleph-null").

Z3.4 Relations#

Z3.4.1 Definition#

A binary relation R from A to B is a subset of A × B. If (a, b) ∈ R we say "a is related to b by R" and write a R b, R(a, b), or (a, b) ∈ R.

Examples (relations on a set, meaning A = B):

An n-ary relation on A is a subset of Aⁿ: e.g., the ternary relation "x is between y and z".

Relations are the semantics of predicates. The predicate "L(x, y): x loves y" corresponds to the set of pairs { (x, y) | x loves y }.

Z3.4.2 Properties of a relation R on a set A#

Property Meaning Symbolic
Reflexive everything is related to itself ∀x R(x, x)
Irreflexive nothing is related to itself ∀x ¬R(x, x)
Symmetric if x R y then y R x ∀x∀y (R(x, y) → R(y, x))
Antisymmetric if x R y and y R x then x = y ∀x∀y ((R(x, y) ∧ R(y, x)) → x = y)
Asymmetric if x R y then not y R x ∀x∀y (R(x, y) → ¬R(y, x))
Transitive if x R y and y R z then x R z ∀x∀y∀z ((R(x, y) ∧ R(y, z)) → R(x, z))
Total / connected (trichotomy-like) any two distinct elements are related one way or the other ∀x∀y (x = y ∨ R(x, y) ∨ R(y, x))
Serial everything has something it is related to ∀x ∃y R(x, y)

Examples: ≤ on ℤ is reflexive, antisymmetric, transitive, total. < is irreflexive, asymmetric, transitive, connected. "Is a sibling of" is symmetric, not reflexive (usually), not transitive in general. = is reflexive, symmetric, transitive.

Z3.4.3 Two especially important kinds of relation#

Equivalence relation: reflexive + symmetric + transitive. It formalizes "being the same in some respect". Example: congruence modulo n on ℤ ("a and b have the same remainder"). An equivalence relation splits the set into equivalence classes [a] = { x | x R a }, and these classes form a partition of the set (and every partition comes from an equivalence relation).

Partial order: reflexive + antisymmetric + transitive (like ≤ or ⊆). A strict partial order: irreflexive + transitive (like < or ⊂). A total (linear) order is a partial order in which every two elements are comparable. A well-order is a total order in which every non-empty subset has a least element (ℕ with ≤ is one; ℤ and ℝ are not, because they have no least element). Partial orders are drawn as Hasse diagrams, with a line going upward from x to y whenever x < y with nothing in between.

Z3.4.4 Graphs as relations (we will use them as examples)#

A directed graph is a set V of vertices (nodes) and a relation E ⊆ V × V of edges. Drawing: dots and arrows. An undirected graph has a symmetric E. A path is a sequence of vertices with an edge between consecutive ones. Graphs are the easiest nontrivial structures for practicing predicate logic: the sentence ∀x ∃y E(x, y) says "every vertex has an outgoing edge".

Z3.5 Sequences, strings, alphabets, languages#

A sequence is an ordered list a₁, a₂, ..., aₙ (finite) or a₁, a₂, ... (infinite). Same as a function from {1, ..., n} or ℕ.

An alphabet Σ is a finite non-empty set of symbols. A string (or word) over Σ is a finite sequence of symbols. Examples over Σ = {a, b}: a, abba, and the empty string (written ε or λ or ""), which has length 0. |w| is the length of w. Concatenation uv (or u · v) puts strings end to end: ab · ba = abba. Σ* is the set of all finite strings over Σ. A formal language is any subset of Σ*.

Why this matters for logic: a formula is a string of symbols from the logical alphabet. "Is this string a well-formed formula?" is a question about membership in a formal language, settled by exact formation rules (Chapter 1.1 and 3.2). The statement "(P → Q" is a string but not a formula (unbalanced bracket).

Z3.6 Trees and recursive (inductive) definitions#

Z3.6.1 Trees#

A tree is a graph with a designated root where every other node is reached from the root by exactly one path. Vocabulary: node, edge, parent / child, leaf (no children), depth (distance from the root), height (maximum depth). Trees are drawn upside-down, the root at the top:

text
          →             ← root (the main connective)
         / \
        ∧   R
       / \
      P   Q

This is the parse tree (syntax tree) of (P ∧ Q) → R. Every formula has such a tree. Reading a formula means reconstructing its tree.

Z3.6.2 Inductive definitions#

Many objects in logic are defined inductively: by stating (1) some base objects, (2) construction rules that build new objects from old ones, and (3) a closure clause: "nothing else is an object of this kind". Example, the set of propositional formulas over atoms p, q, r:

  1. (Base) p, q, r are formulas.
  2. (Rule) If A is a formula then ¬A is a formula.
  3. (Rule) If A and B are formulas then (A ∧ B) is a formula, and likewise (A ∨ B), (A → B), (A ↔ B).
  4. (Closure) Nothing else is a formula.

Two powerful consequences:

Unique readability. Each formula can be built in only one way, so its parse tree is unique. That is why the parentheses in the definition matter; without them P ∨ Q ∧ R would be ambiguous.

Z3.6.3 The same idea for numbers#

The natural numbers are inductively defined: 0 is a natural number; if n is, so is its successor n + 1; nothing else is. That is the source of mathematical induction (Chapter 5.8).

Z3.7 Try it#

Q1. Let A = {2, 4, 6}, B = {4, 6, 8, 10}, U = {1, ..., 10}. Compute A ∪ B, A ∩ B, A ∖ B, Aᶜ, |𝒫(A)|, and the number of elements of A × B. Q2. Is ∅ ⊆ {1, 2}? Is ∅ ∈ {1, 2}? Is ∅ ∈ {∅}? Q3. For f : ℤ → ℤ, f(n) = 2n: is f injective? surjective? What is its range? Q4. For each relation on ℤ decide reflexive / symmetric / transitive: (a) a R b iff a ≤ b; (b) a R b iff a − b is even; (c) a R b iff a ≠ b. Q5. Which of these is a well-formed formula built by Z3.6.2: (a) (P ∧ Q) (b) P ∧ Q (c) ¬¬P (d) (P ∧ ¬)?

Answers. A1. A ∪ B = {2, 4, 6, 8, 10}; A ∩ B = {4, 6}; A ∖ B = {2}; Aᶜ = {1, 3, 5, 7, 8, 9, 10}; |𝒫(A)| = 2³ = 8; |A × B| = 3·4 = 12. A2. ∅ ⊆ {1, 2}: yes (empty set is a subset of every set). ∅ ∈ {1, 2}: no (the elements are 1 and 2). ∅ ∈ {∅}: yes (the only element of {∅} is ∅). A3. Injective: yes (2a = 2b ⇒ a = b). Surjective: no (1 is not hit). Range: the even integers. A4. (a) reflexive, transitive, not symmetric. (b) all three: it is an equivalence relation (same parity). (c) symmetric only: not reflexive (a = a fails), not transitive (1 ≠ 2, 2 ≠ 1, but 1 = 1). A5. (a) yes; (b) no under the strict grammar of Z3.6.2 (binary connectives need parentheses; many books allow dropping the outermost pair, which is why we say "under the strict grammar"); (c) yes: ¬¬P is ¬ applied to the formula ¬P; (d) no: ¬ needs a formula after it.



Chapter Z4. The Symbol Atlas: every sign you will meet ↑ Top#

Logic is written in symbols. The same idea is often written in several different ways by different authors, and the same symbol sometimes means different things in different books. This chapter is the dictionary. Use it in three ways:

  1. First reading: skim to see the symbols once.
  2. Whenever you meet an unknown sign anywhere in the course: look it up here.
  3. When reading other books: use the "variants" columns and the tables in Z4.11 (ambiguities) and Z5 (dialects).

Columns: Symbol; Name; Read aloud; Meaning; Variants (other signs for the same idea); LaTeX (how to typeset it); Unicode (code point, so you can type or copy it).


Z4.1 The core connectives (propositional logic)#

Symbol Name Read aloud Meaning Variants LaTeX Unicode
¬A negation "not A", "it is not the case that A" true exactly when A is false ~A, ∼A, -A, !A (programming), Ā (overbar, Boolean algebra), A′ (prime, Boolean algebra), NOT A, Np (Polish) \neg A, \lnot A U+00AC
A ∧ B conjunction "A and B" true exactly when both are true A & B, A · B, A . B, AB (juxtaposition), A && B, A AND B, K A B (Polish) A \wedge B, A \land B U+2227
A ∨ B disjunction (inclusive or) "A or B", "A or B or both", "A vel B" true when at least one is true A | B, A + B (Boolean algebra), A || B, A OR B, A A B (Polish "Apq") A \vee B, A \lor B U+2228
A → B conditional (material implication) "if A then B", "A implies B", "A arrow B" false only when A is true and B is false A ⊃ B (older books), A ⇒ B, A ⟶ B, A -> B, A => B, A ≤ B (Boolean order), C A B (Polish) A \to B, A \rightarrow B, A \supset B, A \Rightarrow B, A \implies B U+2192 (also U+2283 ⊃, U+21D2 ⇒, U+27F6 ⟶)
A ↔ B biconditional "A if and only if B", "A iff B", "A is equivalent to B" true exactly when A and B have the same truth value A ≡ B (older books), A ⇔ B, A <-> B, A <=> B, A ~ B, A XNOR B, E A B (Polish) A \leftrightarrow B, A \iff B, A \Leftrightarrow B, A \equiv B U+2194 (also U+21D4 ⇔, U+2261 ≡)
A ⊕ B exclusive or (xor) "A xor B", "either A or B but not both" true exactly when A and B differ A ⊻ B, A ≢ B, A ≠ B (on truth values), A ^ B (bitwise in C/Java/Python), A XOR B A \oplus B, A \veebar B, A \not\equiv B U+2295 (⊕), U+22BB (⊻)
A ↑ B NAND, Sheffer stroke "A nand B", "not both A and B" ¬(A ∧ B) A | B (Sheffer's original stroke!), A ⊼ B A \uparrow B, A \barwedge B (⊼) U+2191, U+22BC
A ↓ B NOR, Peirce arrow "A nor B", "neither A nor B" ¬(A ∨ B) A ⊽ B A \downarrow B U+2193, U+22BD
⊤ verum, "true", top "top", "true" a statement that is always true T, 1, tt, True, ⊤ \top U+22A4
⊥ falsum, "false", absurdity, bottom "bottom", "falsum", "absurd", "contradiction" a statement that is always false F, 0, ff, False, ⊥, λ (older), # (some natural-deduction books) \bot U+22A5
A ← B converse conditional "A if B" B → A A ⊂ B (older books) A \leftarrow B, A \subset B U+2190
A ↛ B non-implication "A and not B" ¬(A → B), i.e. A ∧ ¬B A ⊅ B A \nrightarrow B U+219B
( ) [ ] { } brackets group subformulas dots as brackets in Principia style ( ) U+0028...

Z4.1.1 Where the variants come from#

Z4.1.2 Names of the parts#

Compound Parts are called
¬A negand (A)
A ∧ B conjuncts (A and B)
A ∨ B disjuncts (A and B)
A → B antecedent (A, the "if" part, also called hypothesis or premise) and consequent (B, the "then" part, also called conclusion)
A ↔ B the two sides (left and right)
main connective the connective that was applied last when building the formula (the root of the parse tree)

Symbol Name Read aloud Meaning Variants LaTeX Unicode
∀x A universal quantifier "for all x, A", "for every x", "for each x", "for any x" A holds for every object x in the domain (x) A (Principia, Quine), (∀x) A, ∀x. A, ∀x : A, ⋀ₓ A, Πx A (Polish/Łukasiewicz-Bocheński style), ALL x A (Prover9), ![X]: A (TPTP), forall x, A (Coq) \forall x\, A U+2200
∃x A existential quantifier "there exists x such that A", "for some x, A", "there is an x with A" A holds for at least one x in the domain (∃x) A, (Ex) A, ∃x. A, ⋁ₓ A, Σx A, EX x A, ?[X]: A (TPTP), exists x, A (Coq) \exists x\, A U+2203
∃!x A unique existence "there exists exactly one x such that A" exactly one x satisfies A ∃₁x A, ∃!x. A \exists! x\, A U+2203 + U+0021
∄x A non-existence "there is no x such that A" ¬∃x A \nexists x\, A U+2204
∀x ∈ S, A bounded (restricted) universal "for all x in S, A" shorthand for ∀x (x ∈ S → A) (∀x ∈ S) A, ∀x:S. A \forall x \in S,\ A
∃x ∈ S, A bounded existential "there is an x in S such that A" shorthand for ∃x (x ∈ S ∧ A) (∃x ∈ S) A \exists x \in S,\ A
ιx A or ℩x A definite description (iota operator) "the x such that A" the unique x satisfying A (if there is one) ι, ℩, the x. A \iota x\, A U+03B9, U+2129
εx A Hilbert's epsilon operator "some x such that A" an arbitrary witness for ∃x A ε \varepsilon x\, A U+03B5
λx. t lambda abstraction "lambda x, t" the function that maps x to t x ↦ t, \x -> t (Haskell), fun x => t (Lean, Coq) \lambda x.\ t U+03BB
μx A least-number operator "the least x such that A" the smallest natural number satisfying A μ \mu x\, A U+03BC
{ x : A } set-builder "the set of all x such that A" the set whose members are exactly the x satisfying A {x | A} \{x : A\}, \{x \mid A\}
∑ᵢ₌₁ⁿ, ∏ᵢ₌₁ⁿ sum, product binders "the sum from i = 1 to n" bind a running variable i \sum_{i=1}^n, \prod_{i=1}^n U+2211, U+220F
⋃ᵢ, ⋂ᵢ big union / intersection "union over i" ∃i / ∀i over a family of sets \bigcup_i, \bigcap_i U+22C3, U+22C2

All binders do the same job: they introduce a bound variable whose name does not matter (∀x P(x) and ∀y P(y) say the same). See Chapter 3.3.

Quantifier scope conventions differ. After ∀x, some authors apply the quantifier only to the next immediate formula (as with ¬); others extend it as far to the right as possible. Always parenthesize: ∀x (P(x) → Q(x)).


Z4.3 Symbols of consequence, proof and metalanguage#

These symbols are not part of the formulas. They are used to talk about formulas (metalanguage).

Symbol Name Read aloud Meaning LaTeX Unicode
Γ ⊢ A turnstile, derivability "Gamma proves A", "A is derivable from Γ" there is a formal proof of A from the premises Γ \Gamma \vdash A U+22A2
⊢ A theoremhood "A is a theorem", "A is provable" A is provable from no premises \vdash A U+22A2
Γ ⊬ A "Γ does not prove A" no proof exists \nvdash U+22AC
A ⊣⊢ B interderivability "A and B are provably equivalent" A ⊢ B and B ⊢ A A \dashv\vdash B U+22A3 U+22A2
Γ ⊨ A double turnstile, semantic consequence "Gamma entails A", "A is a logical consequence of Γ", "Γ semantically implies A" every model of Γ is a model of A \Gamma \models A, \vDash U+22A8 (also U+22A7)
⊨ A validity "A is valid", "A is a tautology" A is true in every model \models A U+22A8
Γ ⊭ A "Γ does not entail A" some model makes Γ true and A false \nvDash U+22AD
M ⊨ A satisfaction "M satisfies A", "A is true in M", "M is a model of A" A is true in the structure M \mathcal{M} \models A U+22A8
M, s ⊨ A satisfaction under an assignment "A is true in M under assignment s" for formulas with free variables \mathcal{M}, s \models A
⟦A⟧ᵥ, v(A), ⟦A⟧_M denotation / valuation "the truth value of A under v" semantic value [\![A]\!]_v (stmaryrd), \llbracket A \rrbracket_v U+27E6 U+27E7
⊩ forcing "forces" used in Kripke semantics, set theory \Vdash U+22A9
A ≡ B logical equivalence "A is logically equivalent to B" ⊨ A ↔ B A \equiv B U+2261
Γ, A comma in a premise list the set Γ together with A: Γ ∪ {A}
Γ ⇒ Δ sequent arrow (Gentzen) "Γ sequent Δ" in sequent calculus: if all of Γ hold, then some of Δ holds \Gamma \Rightarrow \Delta U+21D2
Γ ⊢ Δ sequent, alternate (many books write the turnstile for sequents)
⇒, ⟹ metalanguage implication "implies", "then" between statements about formulas \Rightarrow, \implies U+21D2, U+27F9
⇔, ⟺ metalanguage iff "if and only if" \Leftrightarrow, \iff U+21D4, U+27FA
∴ therefore "therefore" introduces a conclusion \therefore U+2234
∵ because "because", "since" introduces a reason \because U+2235
∎ end of proof marks the end of a proof \qed, \blacksquare, \square U+220E (∎), U+25A0 (■), U+25A1 (□)
⊦ Frege's judgement stroke "it is asserted that" historical U+22A6

Z4.3.1 Reading the notations out loud#

Z4.3.2 ⊢ versus ⊨ versus → versus ⇒ (the confusion table)#

Sign Level What it relates Example
→ object language (inside formulas) two formulas, forming a new formula P → Q is itself a formula
⇒ (or ⟹) metalanguage two statements about the world/logic "if A is a tautology, then A ∨ B is a tautology"
⊢ metalanguage a set of formulas and a formula: provable P, P → Q ⊢ Q
⊨ metalanguage a set of formulas and a formula: true in all models P, P → Q ⊨ Q
≡ metalanguage (usually) two formulas: same truth value always P → Q ≡ ¬P ∨ Q
↔ object language two formulas, forming a new formula P ↔ Q

Z4.4 The many signs of "equals", "defined as", and "equivalent"#

Symbol Meaning Where
= equality: the two things are the very same object everywhere
≠ not equal
:=, ≔, =:, ≝, ≜, \overset{\text{def}}{=} "is defined to be" definitions
:⇔, ⇔ (def) "is defined to hold iff" defining a property
≡ (i) logical equivalence, (ii) congruence mod n, (iii) "identical as functions/polynomials", (iv) sometimes defined-as context!
≈ approximately equal numerics
≅ isomorphic or congruent (as structures or shapes) algebra, model theory, geometry
≃ homotopy equivalent, or asymptotically equal, or isomorphic
∼ "is related to"; in probability "is distributed as"; in logic sometimes negation (∼p)
∝ proportional to
↔, ⇔ iff logic
≐ "is equal in the limit" or "by definition"
== equality test in programming Python, Java, C
=== strict equality (JavaScript), definitional equality (some proof assistants)
=?=, ≟ "is this equal?" (question)

Z4.5 Sets, functions, relations#

(Defined in Z3. This is the compact atlas.)

Symbol Name Read aloud Variants LaTeX Unicode
∈ element of "in", "belongs to" ε (Peano's original form of the symbol) \in U+2208
∉ not an element of "not in" \notin U+2209
∋ contains as an element "such that" in some texts \ni U+220B
∅ empty set "empty set" {}, Ø, ∅ \emptyset, \varnothing U+2205
⊆ subset or equal "is a subset of" ⊂, ⊑ \subseteq, \subset U+2286, U+2282
⊊ proper subset ⊂ \subsetneq U+228A
⊇, ⊃ superset \supseteq, \supset U+2287, U+2283
⊄, ⊈ not a subset \not\subset, \nsubseteq U+2284, U+2288
∪ union "cup" \cup U+222A
∩ intersection "cap" \cap U+2229
∖, −, \ set difference "minus" \setminus U+2216
Aᶜ, A′, Ā, ∁A complement "A complement" A^c, A', \overline{A}, \complement U+1D9C, U+2201
△, ⊕, Δ symmetric difference \triangle, \Delta, \oplus U+25B3, U+0394
× Cartesian product "cross" \times U+00D7
𝒫(A), ℘(A), 2^A power set "power set of A" P(A) \mathcal{P}(A), \wp(A), 2^A U+1D4AB, U+2118
|A|, #A, card A cardinality "size of A" \lvert A \rvert, \#A
f : A → B function type "f from A to B" f ∈ B^A, A →ᶠ B f \colon A \to B
x ↦ f(x) maps-to "x maps to f of x" x |→ f(x) x \mapsto f(x) U+21A6
g ∘ f composition "g after f", "g composed with f" g f, g·f g \circ f U+2218
f⁻¹ inverse / preimage "f inverse" f^{-1}
↪ injection (embedding) ↣, ⤖ \hookrightarrow U+21AA
↠ surjection ⤀ \twoheadrightarrow U+21A0
⤖, ≅, ↔ bijection \leftrightarrow, \cong
ℕ ℤ ℚ ℝ ℂ ℙ number sets "N, Z, Q, R, C, P" N, Z, Q, R, C (plain bold) \mathbb{N}, \mathbb{Z}, ... U+2115, U+2124, U+211A, U+211D, U+2102, U+2119
ℵ₀, ω smallest infinite cardinal / ordinal "aleph null", "omega" |ℕ| \aleph_0, \omega U+2135, U+03C9
R(a, b), a R b, (a, b) ∈ R relation holds "a is R-related to b"
[a], [a]_R, ā equivalence class of a [a]_R
a ≤ b, a ≼ b, a ⊑ b order \le, \preceq, \sqsubseteq U+2264, U+227C

Z4.6 Arithmetic and number-theory symbols#

Symbol Name Meaning LaTeX Unicode
+, −, ×, ·, ÷, / arithmetic operations add, subtract, multiply, divide +, -, \times, \cdot, \div, / U+00D7, U+22C5, U+00F7
aⁿ, a^n, a**n exponent a multiplied n times a^n U+207F (ⁿ)
√, ⁿ√ root square root, n-th root \sqrt{a}, \sqrt[n]{a} U+221A
<, >, ≤, ≥, ≠ order and non-equality <, >, \leq, \geq, \neq U+2264, U+2265, U+2260
≪, ≫ much smaller / larger \ll, \gg U+226A, U+226B
a ∣ b divides b is a multiple of a a \mid b U+2223 (also ASCII |)
a ∤ b does not divide a \nmid b U+2224
a ≡ b (mod n), a ≡ₙ b congruence modulo n n divides a − b a \equiv b \pmod n U+2261
a mod n, a % n remainder the remainder of a ÷ n a \bmod n
gcd(a, b), lcm(a, b) greatest common divisor, least common multiple \gcd, \operatorname{lcm}
n! factorial n·(n−1)···1 n!
(n over k) = C(n, k) binomial coefficient "n choose k" \binom{n}{k}
∑, ∏ sum, product \sum, \prod U+2211, U+220F
|x| absolute value (or cardinality, or divides) \lvert x \rvert
⌊x⌋, ⌈x⌉ floor, ceiling \lfloor x \rfloor, \lceil x \rceil U+230A.., U+2308..
∞ infinity \infty U+221E
min, max, sup, inf extremes
lim limit \lim_{x \to a}

Z4.7 Brackets, punctuation and layout#

Sign Typical uses in logic
( ) grouping; function arguments f(x); predicate arguments P(x, y); ordered pairs (a, b)
[ ] alternate grouping; intervals [a, b]; substitution A[t/x]; equivalence classes [a]; TPTP quantifier variable lists ![X]
{ } sets {1, 2}; set-builder {x : P}; grouping in LaTeX
⟨ ⟩ tuples ⟨a, b⟩; sequences; structures ⟨D, I⟩; inner products
⟦ ⟧ semantic brackets: denotation ⟦A⟧
⌜ ⌝ Gödel corner quotes: ⌜A⌝ is the Gödel number (code) of formula A
| | absolute value, cardinality, norm, "divides" (as one bar)
. (after a binder) ∀x. A the dot says "and now the body": scope extends as far right as possible
: (after a binder) ∀x : A or set-builder {x : P}
, list separator; between premises (A, B ⊢ C); sometimes "and" (x, y > 0)
; separator of different kinds of items (e.g., premises ; assumptions)
⋯, …, ... "and so on", ellipsis
_ and ^ subscript and superscript in text/LaTeX/ASCII (x_1, x^2)
' , ″ prime marks to create new names (x', x'')
/ in substitution A[t/x]: "replace x by t" (some books write A[x/t]: check the convention!)
→ inside [ ] A[x ↦ t] or A[t/x] or A(x := t) or A{t/x}: all mean "substitute t for x"

Substitution notation varies. The following all mean "A with t substituted for the free occurrences of x": A[t/x], A(t/x), A_x[t], A[x := t], A[x ↦ t], A{x ↦ t}, {x/t}A, A(t) (if A has been written as A(x)). In this course we use A[t/x].


Z4.8 Letters: the conventional use of Latin and Greek symbols#

These are habits, not laws. Always trust the author's declaration.

Letters Typical meaning in logic
p, q, r, s, t propositional variables (atoms), also P, Q, R, S
A, B, C, D metavariables for arbitrary formulas: "for any formulas A and B, A ∧ B is a formula"
φ, ψ, χ, θ (phi, psi, chi, theta) metavariables for formulas (phi is most common); φ(x) is a formula with x free
Γ, Δ (Gamma, Delta) sets (or lists) of formulas; Γ = premises, Δ = conclusions (sequents)
Σ, Π, Φ, Ψ other sets of formulas, theories; Σ sometimes the alphabet or signature
T a theory (a set of sentences)
x, y, z, u, v, w individual variables
a, b, c, d, e individual constants (names of particular objects); also c₀, c₁, ...
f, g, h function symbols; f(x, y)
P, Q, R, S, F, G, H predicate (relation) symbols; P(x), R(x, y)
s, t, u terms (when not variables)
α, β, γ, δ other formulas, ordinals (α, β, γ), or small quantities (ε, δ)
ε (epsilon) a small positive number in analysis; the empty string; Hilbert's choice operator
δ (delta) a small positive number in analysis
σ, τ, ρ (sigma, tau, rho) substitutions, assignments, valuations, or signatures
θ, μ substitutions; "most general unifier" is often θ or μ
v, w, ν valuations (assignments of truth values)
M, N, 𝔄, 𝔅, 𝒜, ℳ structures (models); domain written D, |M|, dom(M), or A
I, ·ᴹ, Pᴹ interpretation function; Pᴹ is the relation that P denotes in M
λ lambda (functions); the empty string in some books
ω (omega) the first infinite ordinal (the order type of ℕ); ℕ as a structure
ℵ (aleph) infinite cardinal numbers
i, j, k, l, m, n integers (indices, counters, sizes)
Σ* all strings over alphabet Σ
⊤, ⊥ true, false
□, ◇ modal operators: "necessarily", "possibly" (Z4.10)

Z4.9 Symbols with multiple meanings: the ambiguity table#

This is where most beginner confusion hides.

Sign Meaning 1 Meaning 2 Meaning 3
⊃ "implies" (older logic books) superset
⊂ proper subset any subset (⊆) "implied by" (older logic)
≡ logical equivalence biconditional connective (older) congruence mod n; "defined as"
→ conditional connective function type A → B "tends to" (limits), "maps to"
⇒ metalanguage implies conditional connective sequent arrow
⇔ metalanguage iff biconditional
⊥ falsum (contradiction) perpendicular (geometry) bottom element (lattices, types); independent
⊤ verum (true) top element
~ negation "is distributed as"; "is similar to"; "is equivalent to" tilde as approximate
| "such that" (set-builder) "divides" absolute value / cardinality; NAND (Sheffer stroke); "or" in programming
(x) before a formula universal quantifier ∀x a function argument f(x)
+ Boolean "or" addition exclusive or (modulo 2)
· or juxtaposition Boolean "and" multiplication function application (f x)
∘ composition ring/group operation
ε element of (historical ∈) small positive number empty string; Hilbert's operator
Δ symmetric difference change / increment Laplacian; a set of formulas (sequents)
σ, ρ substitution assignment / valuation signature
λ lambda abstraction empty string wavelength / eigenvalue
Σ sum alphabet / set of formulas Σ classes in the arithmetical hierarchy
Π product universal quantifier (Polish style) Π classes in the arithmetical hierarchy; dependent function type
ω ℕ as an ordinal omega-rule angular frequency
[x] equivalence class substitution list / bracket grouping integer part (floor)
Γ set of premises Gamma function; a context (type theory)
¯ (overbar) negation (Boolean) complement (sets) complex conjugate; mean

How to survive this: at the start of any text, look for a "Notation" section or the first definitions. When in doubt, ask yourself which kind of object each side of the sign is: formulas? sets? numbers? statements about formulas?


Z4.10 Symbols of other logics (preview)#

You will not need these for the core course, but you will meet them next.

Symbol Name Reads Logic
□A box, necessity "necessarily A" modal logic (also "A holds in all accessible worlds")
◇A diamond, possibility "possibly A" modal logic (◇A ≡ ¬□¬A)
○A, X A next "A holds at the next time step" temporal logic (LTL)
◇A, F A eventually, "future" "A holds at some future time" temporal logic
□A, G A always, "globally" "A holds at all future times" temporal logic
A U B until "A holds until B holds" temporal logic
A ⊗ B tensor ("times") "A and B together, both resources" linear logic
A ⅋ B par linear logic
A ⊸ B linear implication ("lollipop") "consume A to produce B" linear logic
!A, ?A of course, why not unlimited use of resource linear logic
A ⊕ B, A & B additive disjunction, conjunction linear logic
⟨a⟩A, [a]A dynamic modalities "after program a, possibly / necessarily A" dynamic logic, Hoare-style reasoning
{P} C {Q} Hoare triple "if P holds before command C, then Q holds after" program verification
∀P (P a predicate variable) second-order quantifier "for all properties P" second-order logic
Π x:A. B, Σ x:A. B dependent product / sum types "for all x of type A, B" / "exists x of type A with B" type theory (Curry-Howard)
t : A typing judgment "t has type A" / "t is a proof of A" type theory
Γ ⊢ t : A typing sequent "in context Γ, t has type A" type theory
⇝, →_β reduction / rewriting "reduces to" λ-calculus

Z4.11 Reading formulas aloud#

The skill of reading a formula in good English is the best test that you understand it.

Formula Reading
P ∧ Q "P and Q"
¬(P ∨ Q) "it is not the case that P or Q", "neither P nor Q"
P → (Q → R) "if P, then (if Q then R)"
(P ∧ Q) → R "if P and Q, then R"
¬P ∨ Q "not P, or Q"
∀x P(x) "for all x, P of x", "everything is P"
∃x P(x) "there is an x such that P of x", "something is P"
∀x (S(x) → P(x)) "for every x, if S of x then P of x" = "every S is P"
∃x (S(x) ∧ P(x)) "there is an x such that S of x and P of x" = "some S is P"
∀x ∃y R(x, y) "for every x there is a y such that R of x and y"
∃y ∀x R(x, y) "there is a y such that for every x, R of x and y"
∀ε>0 ∃δ>0 ∀x (|x − a| < δ → |f(x) − f(a)| < ε) "for every ε greater than zero there is a δ greater than zero such that for all x, if the distance from x to a is less than δ, then the distance from f of x to f of a is less than ε"
Γ ⊢ A "Gamma proves A"
Γ ⊨ A "Gamma entails A"
⟦A⟧ᵥ = T "the value of A under v is true"
A[t/x] "A with t substituted for x"
∃!x P(x) "there is exactly one x such that P of x"

Try it: decode and encode#

Q1. Read aloud (in plain English): (a) ¬∃x (P(x) ∧ ¬Q(x)) (b) ∀x ∀y (x < y → ∃z (x < z ∧ z < y)) (c) A, B ⊢ A ∧ B. Q2. Write in symbols: (a) "No S is P." (b) "If it rains or snows, the game is cancelled." (c) "Every number has a successor." Q3. Which sign: (i) "the empty set", (ii) "therefore", (iii) "is not a subset of", (iv) "is provable from", (v) "is true in every model of". Q4. What is the difference between A → B, A ⇒ B and A ⊢ B? Q5. Rewrite P ⊃ (Q ≡ R) (older style) in modern symbols.

Answers. A1. (a) "It is not the case that there is something that is P and not Q" (= every P is Q). (b) "For all x and y, if x is less than y then there is a z strictly between them." (c) "From A and B one can prove A and B." A2. (a) ∀x (S(x) → ¬P(x)) or ¬∃x (S(x) ∧ P(x)). (b) (R ∨ S) → C. (c) ∀n ∃m (m = n + 1) or ∀n ∃m Succ(n, m). A3. (i) ∅, (ii) ∴, (iii) ⊄ (or ⊈), (iv) ⊢, (v) ⊨. A4. A → B is a formula (object language). A ⇒ B usually means "if A [is true / holds] then B" said about statements (metalanguage). A ⊢ B says that a proof of B from A exists. A5. P → (Q ↔ R).



Chapter Z5. Dialects and formats: the same logic in many costumes ↑ Top#

Logic has one core and many costumes. Two things vary from book to book and tool to tool:

  1. Notation dialects: how formulas are written (which symbols, which precedence, prefix or infix).
  2. Proof formats: how proofs are laid out (a table, a tree, a boxed list, a one-sided tableau, a set of clauses...).

Nothing in this chapter adds new logical power. Everything here is a different way to write down the same truths. The skill you want is fluent translation: when a book or tool uses a different costume, you recognize it and mentally convert.


Z5.1 Notation dialects for formulas#

Z5.1.1 Precedence and associativity (how to drop brackets)#

A formula like P ∨ Q ∧ R is ambiguous unless we agree on binding strength. The most common convention:

Order (tightest first) Connective
1 ¬
2 ∧
3 ∨
4 → (right-associative)
5 ↔

So under this convention ¬P ∧ Q → R ∨ S means ((¬P) ∧ Q) → (R ∨ S), and P → Q → R means P → (Q → R).

Quantifiers are the troublemakers. Books disagree: some let ∀x bind only the next formula (like ¬), so ∀x P(x) → Q(x) means (∀x P(x)) → Q(x); others let the scope extend as far right as possible, so the same string means ∀x (P(x) → Q(x)). This course uses the second convention (Section 3.2), but you should never rely on it: always parenthesize the body of a quantifier.

Warnings.

Z5.1.2 Infix, prefix, postfix#

Style Example for "(P and Q) implies R" Where used
Infix (operator between) (P ∧ Q) → R standard mathematics
Prefix / Polish (operator first) → ∧ P Q R Łukasiewicz, Lisp-like systems, SMT-LIB, parsers
Postfix / Reverse Polish P Q ∧ R → stack machines, calculators
Fully parenthesized prefix (S-expression) (=> (and P Q) R) SMT-LIB, Lisp

Prefix and postfix need no brackets and no precedence rules: the structure is determined by the arity of each symbol.

Z5.1.3 Łukasiewicz (Polish) notation#

Jan Łukasiewicz (1920s) used capital letters as prefix operators:

Letter Connective Mnemonic
N ¬ Negation
K ∧ Konjunktion
A ∨ Alternative
C → Conditional (implication)
E ↔ Equivalence
D ↑ (NAND) Disjunction in Sheffer's sense
J ⊕ (xor, in some texts)
Π, Σ ∀, ∃

Atoms are lowercase: p, q, r.

Standard Polish
p → q Cpq
¬p Np
p ∧ q Kpq
(p ∧ q) → r CKpqr
p → (q → r) CpCqr
¬(p ∨ q) ↔ (¬p ∧ ¬q) ENApqKNpNq

How to read Polish notation: scan left to right; every operator "demands" its arguments: C wants two formulas. CKpqr: C takes (1) Kpq and (2) r. K takes p and q.

Z5.1.4 Principia Mathematica (dot notation)#

Whitehead and Russell avoided brackets by using dots whose number indicates the strength of the grouping.

Meaning Principia style
p and q p . q
p or q p ∨ q
p implies q p ⊃ q
p iff q p ≡ q
not p ~p
for all x (x)
there exists x (∃x)
(p ∨ q) ⊃ r p ∨ q . ⊃ . r

You rarely meet dots today, but ⊃, ≡, ~ and (x) survive in philosophy texts and older papers.

Z5.1.5 Boolean-algebra / engineering dialect#

Logic Boolean algebra
P ∧ Q P·Q or PQ
P ∨ Q P + Q
¬P P̄ or P'
⊤, ⊥ 1, 0
P ⊕ Q P ⊕ Q
P → Q P̄ + Q (no special symbol; you write out the disjunction)

Laws look like arithmetic but are not identical: in Boolean algebra P + P = P and P + 1 = 1.

Z5.1.6 ASCII and keyboard dialects#

Concept Common ASCII Python C/Java/JS Haskell
not ~P, -P, !P not P !P not p
and P & Q, P /\ Q, P && Q P and Q P && Q p && q
or P | Q, P \/ Q, P || Q P or Q P || Q p || q
implies P -> Q, P => Q (not P) or Q (no operator) !P || Q not p || q, or p <= q on Bool
iff P <-> Q, P <=> Q P == Q (on bools) P == Q p == q
xor P ^ Q, P xor Q P != Q, P ^ Q P ^ Q p /= q
true / false true/false, T/F True/False true/false True/False

Warning on programming languages. In programs && and || are usually short-circuit (they may skip evaluating the second argument), which has no counterpart in logic; and P -> Q is often not an implication at all (in C, -> is field access; in Haskell, -> is the function type). Programming "if" is control flow, not the logical conditional.

Z5.1.7 Theorem-prover input languages (a preview of Appendix E)#

Concept TPTP (FOF) Prover9 / Mace4 SMT-LIB 2 Lean 4 Coq / Rocq
not ~ P - P (not P) ¬ P or Not P ~ P
and P & Q P & Q (and P Q) P ∧ Q or P /\ Q P /\ Q
or P | Q P | Q (or P Q) P ∨ Q or P \/ Q P \/ Q
implies P => Q P -> Q (=> P Q) P → Q or P -> Q P -> Q
iff P <=> Q P <-> Q (= P Q) P ↔ Q or P <-> Q P <-> Q
forall ![X]: P(X) all x P(x) (forall ((x S)) (P x)) ∀ x, P x forall x, P x
exists ?[X]: P(X) exists x P(x) (exists ((x S)) (P x)) ∃ x, P x exists x, P x
equals X = Y x = y (= x y) x = y x = y
not equal X != Y x != y (distinct x y) x ≠ y x <> y

Conventions: in TPTP, variables start with an uppercase letter, constants and predicates with lowercase; in Prover9, variables are the lowercase letters u-z by default. We study these in detail in Appendix E and Chapter 8.

Z5.1.8 Typesetting dialects: LaTeX vs Unicode vs plain text#

You want LaTeX source Unicode text Plain ASCII
∀x ∃y (x < y) \forall x\, \exists y\, (x < y) ∀x ∃y (x < y) forall x exists y (x < y)
P → Q P \to Q P → Q P -> Q
Γ ⊢ A \Gamma \vdash A Γ ⊢ A G |- A
¬(A ∧ B) \neg (A \wedge B) ¬(A ∧ B) ~(A & B)

For notes, Unicode is easiest (copy from Z4). For papers, LaTeX. For machines, ASCII or the tool's own syntax.


Z5.2 Proof formats: an overview#

A proof format (or proof system, calculus) fixes the rules of the game: what a legal proof line looks like and how lines may be combined. The main families:

# Format Main idea Natural for
1 Semantic / truth tables try every valuation propositional, small
2 Informal mathematical proof prose reasoning in steps humans, mathematics
3 Hilbert (axiomatic) system many axioms, one or two rules (modus ponens) metatheory, theory
4 Natural deduction: tree (Gentzen) intro/elim rules arranged as a tree proof theory, Curry-Howard
5 Natural deduction: Fitch (flag/box) indented boxes for subproofs teaching, this course
6 Natural deduction: Lemmon (numbered with dependency sets) each line lists the assumptions it depends on British-tradition textbooks
7 Sequent calculus judgments Γ ⇒ Δ and rules acting on them; proof search by decomposition proof theory, automated search
8 Analytic tableaux refute by growing a tree of consequences hand-checking validity, automated provers
9 Resolution refute a set of clauses by resolving pairs automated theorem proving
10 Equational / calculational proof chain of equivalences, each justified algebra, program derivation
11 Type-theoretic (proof terms, tactics) proofs as programs; scripts that build them Lean, Coq, Agda

We now show one running example in all of them.

Running example (hypothetical syllogism). From P → Q and Q → R, conclude P → R. In sequent notation: P → Q, Q → R ⊢ P → R.


Z5.3 The running example in every format#

Format 1. Truth table (semantic)#

We want to show {P → Q, Q → R} ⊨ P → R: every row making both premises true makes the conclusion true. There are 2³ = 8 rows.

P Q R P→Q Q→R P→R premises both true?
T T T T T T yes, conclusion T ✓
T T F T F F no
T F T F T T no
T F F F T F no
F T T T T T yes, conclusion T ✓
F T F T F T no
F F T T T T yes, conclusion T ✓
F F F T T T yes, conclusion T ✓

Every row that makes both premises true makes the conclusion true. So the entailment holds. This shows ⊨, not ⊢ (it is not a derivation), and it does not scale to predicate logic (infinitely many structures).

Format 2. Informal mathematical proof#

Claim. If P → Q and Q → R, then P → R. Proof. Assume P → Q and Q → R. To show P → R, assume P. By P → Q and P we get Q. By Q → R and Q we get R. Since assuming P led to R, we conclude P → R. ∎

This is the style of real mathematics. Every step is secretly an instance of a formal rule (modus ponens, then implication introduction).

Format 3. Hilbert-style (axiomatic)#

Axiom schemes (for the → fragment):

Single rule: modus ponens (MP): from A and A → B, infer B.

# Line Justification
1 Q → R premise
2 (Q → R) → (P → (Q → R)) axiom K (A := Q→R, B := P)
3 P → (Q → R) MP 1, 2
4 (P → (Q → R)) → ((P → Q) → (P → R)) axiom S (A := P, B := Q, C := R)
5 (P → Q) → (P → R) MP 3, 4
6 P → Q premise
7 P → R MP 6, 5

Notice how unnatural this is: no assumptions can be made "temporarily". Hilbert systems are short to specify (good for proving metatheorems) but painful to use. The Deduction Theorem (Chapter 6) repairs this: it proves that if Γ, A ⊢ B then Γ ⊢ A → B, which is exactly what natural deduction builds in.

Format 4. Natural deduction, Gentzen tree style#

Each inference is a horizontal line; premises above, conclusion below; a bracketed [P]¹ is a discharged assumption and the superscript names the rule that discharges it.

text
             [P]¹   P → Q
             ──────────── →E
                  Q            Q → R
                  ─────────────────── →E
                            R
                  ─────────────────── →I¹
                          P → R

Read bottom-up: to get P → R, use →I discharging assumption 1 (P); this needs R; get R by →E from Q and Q → R; get Q by →E from P and P → Q. Premises P → Q and Q → R remain open (undischarged) hypotheses of the whole proof.

Format 5. Natural deduction, Fitch style (used in this course)#

text
1 │ P → Q                 premise
2 │ Q → R                 premise
3 │ ┌─ P                  assumption (for →I)
4 │ │  Q                  →E 1, 3
5 │ │  R                  →E 2, 4
6 │ └───
  │ P → R                 →I 3–5

The indented box (lines 3-5) is a subproof: inside it we may use P, but nothing derived inside escapes the box except through the closing rule (→I).

Format 6. Natural deduction, Lemmon style#

Each line carries the set of premise line numbers it depends on (left), a line number, the formula, and its justification.

text
{1}       (1)  P → Q    Premise
{2}       (2)  Q → R    Premise
{3}       (3)  P        Assumption
{1,3}     (4)  Q        1,3 →E (modus ponens)
{1,2,3}   (5)  R        2,4 →E
{1,2}     (6)  P → R    3,5 →I (conditional proof; discharges 3)

Line 6 depends on lines 1 and 2 only: the dependency on line 3 has been removed (discharged).

Format 7. Sequent calculus (Gentzen's LK, two-sided)#

A sequent Γ ⇒ Δ means: "if all formulas in Γ are true, then at least one in Δ is true". A proof is a tree of sequents whose leaves are axioms A, Γ ⇒ A, Δ. We search bottom-up:

text
                                       ─────────── ax            ───────────── ax
                                       Q, P ⇒ Q, R              R, Q, P ⇒ R
 ───────────────── ax                  ─────────────────────────────────────── →L
 P, Q→R ⇒ P, R                                  Q, P, Q→R ⇒ R
 ─────────────────────────────────────────────────────────────── →L
                   P, P→Q, Q→R ⇒ R
                   ──────────────────── →R
                   P→Q, Q→R ⇒ P→R

Reading bottom-up: →R moves the antecedent P to the left; →L on P→Q splits into two goals (prove P, or use Q); →L on Q→R again splits; every leaf closes by the axiom (the same formula appears on both sides). Each step only decomposes a formula, which is why sequent calculus is ideal for automatic proof search.

Format 8. Analytic tableau (refutation tree)#

To prove the entailment, assume the premises and the negation of the conclusion and look for a contradiction.

text
 P → Q                         (premise)
 Q → R                         (premise)
 ¬(P → R)                      (negated conclusion)
   │
   P                           (from ¬(P→R))
   ¬R                          (from ¬(P→R))
   ├── ¬P   ✗ (clashes with P)         (branch for P→Q)
   └── Q
        ├── ¬Q  ✗ (clashes with Q)     (branch for Q→R)
        └── R   ✗ (clashes with ¬R)

Rules used: ¬(A→B) yields A and ¬B (no branching); A→B branches into ¬A | B. Every branch closes, so the premises together with ¬(P→R) are unsatisfiable: the entailment holds.

Format 9. Resolution#

Convert premises and the negated conclusion to clauses (sets of literals; read as a disjunction):

Clause From
{¬P, Q} P → Q
{¬Q, R} Q → R
{P} ¬(P → R), first part
{¬R} ¬(P → R), second part

Resolve (cancel a literal against its negation):

  1. {P} and {¬P, Q} give {Q}
  2. {Q} and {¬Q, R} give {R}
  3. {R} and {¬R} give {} (the empty clause ⊥)

The empty clause means the clause set is unsatisfiable, so the entailment holds.

Format 10. Equational / calculational proof#

This format shines for equivalences rather than single entailments. Example: the contrapositive law P → Q ≡ ¬Q → ¬P.

text
      P → Q
  ≡     { definition of → }
      ¬P ∨ Q
  ≡     { commutativity of ∨ }
      Q ∨ ¬P
  ≡     { double negation: Q ≡ ¬¬Q }
      ¬¬Q ∨ ¬P
  ≡     { definition of →, read right to left }
      ¬Q → ¬P

Each step says "this equals that, because of <law>" in braces. Chains of equivalences are transitive, so the first and last lines are equivalent.

Format 11. Type-theoretic / proof assistant#

Under Curry-Howard, a proof of P → Q is a function turning proofs of P into proofs of Q.

Lean 4 (term mode):

lean
theorem hs (p q r : Prop) (h1 : p → q) (h2 : q → r) : p → r :=
  fun hp => h2 (h1 hp)

Lean 4 (tactic mode):

lean
theorem hs (p q r : Prop) (h1 : p → q) (h2 : q → r) : p → r := by
  intro hp
  apply h2
  apply h1
  exact hp

Coq / Rocq:

coq
Theorem hs : forall p q r : Prop, (p -> q) -> (q -> r) -> p -> r.
Proof.
  intros p q r h1 h2 hp.
  apply h2.
  apply h1.
  exact hp.
Qed.

intro hp is →I (assume p); apply h2 reduces goal r to goal q (backwards →E); exact hp closes the final goal.


Z5.4 Comparison: which format when?#

Format Pros Cons Use it when
Truth table mechanical, no creativity exponential; propositional only quick check of propositional validity
Informal proof fastest to read and write; real math no mechanical checker communicating with humans
Hilbert tiny rule set; easy metatheory proofs are long and opaque proving soundness/completeness
ND tree elegant; connects to λ-calculus wide, awkward to write proof theory; reading papers
ND Fitch readable; mirrors real reasoning; box = scope needs vertical space learning; writing proofs by hand
ND Lemmon compact; dependencies explicit dependency sets are fiddly UK-style textbooks
Sequent systematic; subformula property; terminates (propositional) verbose automated search; cut-elimination
Tableau very visual; finds countermodels from open branches tree can blow up decide validity by hand
Resolution single rule; the engine of provers needs clausal form (loses readability) automated provers (Chapter 7, 8)
Calculational clean for equivalences; great for algebra awkward for non-equational goals simplifying/normalizing formulas
Proof assistant machine-checked; scales learning curve serious formalization

Soundness and completeness cut across all of them: each of Formats 3-9 is a sound and complete calculus for classical propositional logic (and, with quantifier rules, for first-order logic). They differ only in convenience, never in what can be proved. This is Chapter 6.


Z5.5 Translating between formats: a cheat table#

Fitch / ND idea Hilbert counterpart Sequent counterpart Tableau counterpart
assume A (open box) deduction theorem move A to the left of ⇒ add A to the branch
→I (close box) deduction theorem →R n/a (refutation)
→E (modus ponens) MP →L (with cut/ax) A→B branches to ¬A | B
∧I / ∧E via axioms ∧R / ∧L A∧B yields A and B
∨E (cases) via axioms ∨L (two premises) A∨B branches to A | B
¬I / RAA (contradiction) axiom for ¬ ¬R / ¬L branch closes when A and ¬A both appear
goal is ⊥ goal is a contradiction empty right side Γ ⇒ closed tree

Z5.6 Quick-check#

Q1. Write (p ∨ q) → ¬r in Łukasiewicz notation. Q2. Insert all hidden brackets in ¬P ∧ Q → R ∨ S ↔ T. Q3. In which format would you naturally find a "closed branch"? "The empty clause"? "A discharged assumption with a superscript"? "Dependency set"? Q4. Translate ∀x (P(x) → Q(x)) into TPTP and into Prover9 syntax. Q5. Why can a truth table not serve as a proof format for predicate logic? Q6. What does Lean's intro hp correspond to in Fitch style?

Answers. A1. CApqNr. (C first; its first argument is Apq, its second is Nr.) A2. (((¬P) ∧ Q) → (R ∨ S)) ↔ T. The ↔ is loosest, so the whole implication is its left side. A3. Tableau; resolution; Gentzen-tree natural deduction; Lemmon. A4. TPTP: ![X]: (p(X) => q(X)). Prover9: all x (P(x) -> Q(x)). A5. A structure can have an infinite domain, and there are infinitely many structures; you cannot enumerate them all. Predicate logic needs proof calculi (or countermodel search), and by Church-Turing it is only semi-decidable (Chapter 6). A6. Opening a box with the assumption p (the start of an →I subproof).



Chapter 0. The big picture ↑ Top#

0.1 Two sides of logic#

Logic studies reasoning from two complementary angles.

Semantics (meaning, truth) Syntax / proof theory (form, derivation)
Question Is the statement true? Can the statement be derived?
Tool Truth tables, structures, models Inference rules, proofs
Symbol Γ ⊨ A ("Γ entails A") Γ ⊢ A ("Γ proves A")
Style "Check every possible world" "Build an argument step by step"
Weakness Infinitely many worlds (in predicate logic) Finding a proof is a search problem

Truth tables are semantic: you inspect every interpretation. A proof is syntactic: you start from premises and apply rules that preserve truth, never looking at a model at all.

The deep fact that connects the two sides is that, for first-order logic, Γ ⊨ A if and only if Γ ⊢ A (soundness and completeness, Chapter 6). This is why proofs are trustworthy and why they are enough.

0.2 Why a proof is a different skill from a truth table#

A truth table is an algorithm: follow the procedure and you get the answer. A proof is a search through a space of possible arguments. There is no mechanical recipe, but there are strategies, and the main one is:

The goal determines the shape of the proof. Look at the main connective of what you want to prove, and that tells you how to start.

This single idea, developed in Chapters 2 and 4, removes most of the apparent mystery.

0.3 Three levels#

  1. Formal proofs in a proof system (natural deduction). Every step is a named rule. This is how a computer checks a proof, and how you will learn the anatomy of proofs.
  2. Informal mathematical proofs ("Let ε > 0 be arbitrary. Choose δ = ε/2..."). These are the same arguments written in prose. Chapter 5 shows the translation precisely.
  3. Metatheory: theorems about logic itself (soundness, completeness, Gödel). Chapter 6.

You will move between the three constantly. Formal proofs teach you why informal proofs work. Informal proofs show you what formal proofs are for.

0.4 Object language vs. metalanguage#

When you write "P → Q", the arrow is a symbol inside the formal language (the object language). When you write "if A is a tautology then A ∨ B is a tautology" in English, you are reasoning about formulas in the metalanguage. Keep these separate. Confusing → (a connective) with ⊢ or ⊨ (relations between sets of formulas and formulas) is a classic beginner error.


Chapter 1. Propositional logic: precise foundations ↑ Top#

You know the basics. This chapter makes them precise, because precision is what proofs need.

1.1 Syntax: formulas are defined inductively#

Formulas are built from atoms p, q, r, ... by this grammar:

text
A ::= p | ⊤ | ⊥ | ¬A | (A ∧ A) | (A ∨ A) | (A → A) | (A ↔ A)

This is an inductive definition: every formula is either an atom or built from smaller formulas by exactly one connective. Two consequences matter a lot:

Precedence (tightest first): ¬, ∧, ∨, →, ↔. Implication is right-associative: P → Q → R means P → (Q → R). When in doubt, use parentheses.

1.2 Semantics#

A valuation v assigns T or F to each atom. It extends uniquely to all formulas using the truth tables. Write ⟦A⟧ᵥ for the value of A under v.

Concept Definition
A is a tautology (valid), written ⊨ A ⟦A⟧ᵥ = T for every valuation v
A is satisfiable ⟦A⟧ᵥ = T for some valuation v
A is a contradiction ⟦A⟧ᵥ = F for every valuation v
Γ ⊨ A (entailment) every valuation making all formulas in Γ true also makes A true
A ≡ B (equivalence) A and B have the same value under every valuation

Three facts you will use constantly:

Explosion. If Γ is unsatisfiable, then Γ ⊨ B for every B (there is no valuation to check, so the condition holds vacuously). This semantic fact is the reason the proof rule "from ⊥ derive anything" is sound.

1.3 Implication in depth#

Implication causes more confusion than all other connectives combined.

The promise reading. "If A then B" is a promise. It is broken (false) only when A happens and B does not. If A never happens, the promise is not broken, so it is true.

Why vacuous truth is forced. Consider the claim: "for every integer n, if n > 2 then n² > 4." This is true. Now test n = 1: the antecedent (1 > 2) is false, and the claim must not be refuted by it. A universal statement is a big conjunction of its instances, so each instance, including the ones with false antecedent, must come out true. That is exactly the truth table of →.

Four related statements (for "if A then B"):

Name Form Equivalent to the original?
Converse B → A No
Inverse ¬A → ¬B No (it is the contrapositive of the converse)
Contrapositive ¬B → ¬A Yes
Negation A ∧ ¬B It is the opposite of the original

English vocabulary dictionary:

English Logic
A implies B; if A then B; B if A A → B
A only if B A → B
A is sufficient for B A → B
B is necessary for A A → B
A if and only if B A ↔ B
A unless B ¬B → A (equivalently A ∨ B)
Not both A and B ¬(A ∧ B)
Neither A nor B ¬A ∧ ¬B

The pair "A only if B" versus "A if B" trips everyone at first: only if is the arrow pointing toward the necessary condition.

1.4 The laws you must know cold#

Law Statement
Double negation ¬¬A ≡ A
De Morgan ¬(A ∧ B) ≡ ¬A ∨ ¬B, ¬(A ∨ B) ≡ ¬A ∧ ¬B
Distributivity A ∧ (B ∨ C) ≡ (A ∧ B) ∨ (A ∧ C), A ∨ (B ∧ C) ≡ (A ∨ B) ∧ (A ∨ C)
Implication as disjunction A → B ≡ ¬A ∨ B
Negated implication ¬(A → B) ≡ A ∧ ¬B
Contrapositive A → B ≡ ¬B → ¬A
Exportation (A ∧ B) → C ≡ A → (B → C)
Biconditional A ↔ B ≡ (A → B) ∧ (B → A) ≡ (A ∧ B) ∨ (¬A ∧ ¬B)
Excluded middle ⊨ A ∨ ¬A
Non-contradiction ⊨ ¬(A ∧ ¬A)
Absorption A ∧ (A ∨ B) ≡ A, A ∨ (A ∧ B) ≡ A
Idempotence, commutativity, associativity for ∧ and ∨

1.5 Normal forms#

Algorithm to reach CNF:

  1. Eliminate ↔ and →: A → B becomes ¬A ∨ B, and A ↔ B becomes (¬A ∨ B) ∧ (¬B ∨ A).
  2. Push negations inward with De Morgan and double negation (this gives NNF).
  3. Distribute ∨ over ∧.

Example. Convert (P → Q) → R.

Step 3 can cause exponential blowup. Practical SAT tools use the Tseitin transformation, which introduces fresh atoms and produces a CNF that is only equisatisfiable (not equivalent) but linear in size. You will meet this again in Chapter 7.

1.6 Functional completeness#

A set of connectives is functionally complete if every truth function can be expressed with it. The sets {¬, ∧}, {¬, ∨}, {¬, →} are complete, and so is the single connective NAND (A | B ≡ ¬(A ∧ B)). On the other hand, {∧, ∨, →, ↔} is not complete (Problem 1.9). This matters later: a prover can restrict itself to a minimal set of connectives without losing expressive power.

1.7 Why truth tables are not enough#

A truth table for n atoms has 2ⁿ rows. That is already hopeless for n = 60 (SAT solvers do better, but the problem is NP-complete). For predicate logic it is worse: "every structure" includes infinite ones, so there is no finite table at all. We need a method that does not enumerate worlds. That method is proof.

1.8 Chapter 1 in complete detail (the from-zero companion)#

Sections 1.1-1.7 gave you the skeleton of propositional logic. This companion rebuilds the whole subject from absolute zero, slowly, with every definition spelled out, every connective examined, and every standard fact proved or demonstrated. If you already feel solid, skim the headings and use the tables as reference. If anything above felt too fast, read this section from the top.

1.8.1 What is a proposition?#

Definition. A proposition (also called a statement or sentence in the logician's sense) is a declarative sentence that is, in the situation under discussion, either true or false, but not both.

Two requirements are hidden in that sentence:

  1. Declarative: it asserts something about the world.
  2. Bivalent: it has exactly one of two truth values, True (T) or False (F). Classical logic assumes this (the principle of bivalence).
Sentence Proposition? Why
"7 is prime." yes (true) declarative, definite
"7 is even." yes (false) declarative, definite
"Paris is the capital of France." yes (true)
"Every even number greater than 2 is a sum of two primes." (Goldbach) yes it is either true or false even though nobody knows which
"Close the door." no a command, asserts nothing
"Is it raining?" no a question
"How beautiful!" no an exclamation
"x + 1 = 5" no (not yet) an open sentence: true for x = 4, false otherwise. It becomes a proposition when x is replaced by a value or quantified (Chapter 3)
"This sentence is false." no paradoxical (the liar), cannot consistently be given a truth value
"The present king of France is bald." disputed presupposes a king exists; logicians avoid such sentences
"Mozart's music is better than Beethoven's." not precisely vague and subjective; we must first make it exact

Key point: logic cares about truth conditions, not about whether we know the truth. "There is life on Mars" is a proposition even though we do not know its value.

Atomic and compound propositions#

Atoms are a choice. "John is tall" might be an atom T, or it might be analyzed in predicate logic as Tall(john). In propositional logic we decide where to stop.

Golden rule for choosing atoms:

  1. Each atom should be a complete declarative sentence (not a fragment).
  2. Use the same letter for the same statement every time.
  3. Make atoms as small as the argument requires, no smaller than necessary, and positive (prefer R = "it rains" over N = "it does not rain"; negation is the job of ¬).

1.8.2 The connectives, one at a time#

For each connective: its truth table, its English forms, its traps.

Negation ¬A#

A ¬A
T F
F T

English: "not A"; "it is not the case that A"; "it is false that A"; "A is not true"; "A fails". Traps:

Conjunction A ∧ B#

A B A ∧ B
T T T
T F F
F T F
F F F

English: "A and B"; "both A and B"; "A but B"; "A although B"; "A however B"; "A yet B"; "A while B"; "A moreover B"; "A, B" (comma); "not only A but also B"; "A as well as B". Traps:

Disjunction A ∨ B (inclusive or)#

A B A ∨ B
T T T
T F T
F T T
F F F

English: "A or B"; "A or B or both"; "at least one of A, B"; "A and/or B"; "either A or B" (often, but see below). Traps:

Conditional (implication) A → B#

A B A → B
T T T
T F F
F T T
F F T

Parts: A = antecedent (hypothesis, premise, "if-part"); B = consequent (conclusion, "then-part").

English forms, all meaning A → B:

English Note
if A, then B basic form
A implies B
B if A the if clause is the antecedent, wherever it stands
B provided that A; B given that A; B as long as A; B when A; B whenever A; B in case A all "if" words
A only if B only if introduces the consequent: A → B, not B → A
A is sufficient for B A suffices to guarantee B
B is necessary for A if A happens, B must have
B follows from A
A, therefore B (as a claim)
not A unless B (i.e. ¬A unless B) careful, see "unless" below

Why is the table the way it is? A → B says "you will never find A true and B false." It is violated only in row 2. In rows 3-4 the antecedent is false, so the promise "if A then B" is vacuously true (nothing was promised for those cases). This is the material conditional (also material implication). It is not the "because" or "causes" of ordinary speech:

These are the so-called paradoxes of material implication. They are not errors; they are the price of making → truth-functional (its value depends only on the values of A and B). Other logics (relevance logic, conditional logic, Chapter 7) refine →, but classical mathematics uses the material conditional, and so does this course.

Four statements around A → B (see Section 1.3): converse B → A, inverse ¬A → ¬B, contrapositive ¬B → ¬A (equivalent to the original), negation A ∧ ¬B.

Necessary vs. sufficient, once and for all: "A is sufficient for B" = having A is enough to get B = A → B. "B is necessary for A" = you can't have A without B = A → B. (Same statement, viewed from the two ends.) Example: "Being a square is sufficient for being a rectangle; being a rectangle is necessary for being a square."

Unless. "A unless B" has two readings; the standard logical reading is ¬B → A, equivalent to A ∨ B. ("You will fail unless you study" = if you don't study you fail = you fail or you study.) If you want to also say "if you study you pass", add the converse: that is a biconditional.

Biconditional A ↔ B#

A B A ↔ B
T T T
T F F
F T F
F F T

English: "A if and only if B"; "A iff B" (math shorthand); "A exactly when B"; "A precisely if B"; "A just in case B"; "A is necessary and sufficient for B"; "A is equivalent to B". Facts: A ↔ B ≡ (A → B) ∧ (B → A); it says A and B always have the same truth value; it is commutative and associative; ¬(A ↔ B) ≡ A ⊕ B. Trap: English "if" in definitions often means "iff" ("A number is even if it is divisible by 2" is a definition, meaning iff). In theorems, "if" means →.

Exclusive or A ⊕ B#

True exactly when A and B have different values: A ⊕ B ≡ ¬(A ↔ B) ≡ (A ∨ B) ∧ ¬(A ∧ B). Properties: commutative, associative, A ⊕ A ≡ ⊥, A ⊕ ⊥ ≡ A, A ⊕ ⊤ ≡ ¬A. It is addition modulo 2.

NAND (A ↑ B) and NOR (A ↓ B)#

A B A ↑ B (NAND) A ↓ B (NOR)
T T F F
T F T F
F T T F
F F T T

NAND = "not both": ¬(A ∧ B). NOR = "neither": ¬(A ∨ B). Each of them alone can express every other connective (Section 1.8.8). Real computer chips are built from NAND or NOR gates.

The constants ⊤ and ⊥#

⊤ is a formula that is always true; ⊥ is a formula that is always false. They are 0-ary connectives (take no arguments). They behave like identity/zero elements: A ∧ ⊤ ≡ A, A ∨ ⊥ ≡ A, A ∧ ⊥ ≡ ⊥, A ∨ ⊤ ≡ ⊤. Many proof systems define ¬A as an abbreviation for A → ⊥.

Summary: common English patterns#

English Formula
A and B; A but B; A although B A ∧ B
A or B (or both) A ∨ B
either A or B, but not both; A or else B A ⊕ B
not A ¬A
neither A nor B; not (A or B) ¬A ∧ ¬B, i.e. ¬(A ∨ B)
not both A and B ¬(A ∧ B), i.e. ¬A ∨ ¬B
A and not B; A but not B A ∧ ¬B
if A then B; B if A; A only if B A → B
A if and only if B A ↔ B
A unless B ¬B → A, i.e. A ∨ B
at least one of A, B, C A ∨ B ∨ C
exactly one of A, B A ⊕ B
at most one of A, B, C ¬(A ∧ B) ∧ ¬(A ∧ C) ∧ ¬(B ∧ C)
at least two of A, B, C (A ∧ B) ∨ (A ∧ C) ∨ (B ∧ C)
all of A, B, C A ∧ B ∧ C
none of A, B, C ¬A ∧ ¬B ∧ ¬C
A is necessary for B B → A
A is sufficient for B A → B
A is necessary and sufficient for B A ↔ B
if A then B, else C (A → B) ∧ (¬A → C)

1.8.3 Syntax in complete detail#

Syntax is the study of the form of formulas (what strings count as well-formed), with no mention of truth.

The alphabet (vocabulary)#

A propositional language has:

  1. Atoms (propositional variables): p, q, r, s, ... or p₀, p₁, p₂, ...; a countable (usually infinite) supply.
  2. Connectives: ¬ ∧ ∨ → ↔ (and optionally ⊤ ⊥ ⊕ ↑ ↓).
  3. Auxiliary symbols: parentheses ( and ).

Everything not in the alphabet is not part of the formal language. (When we write A, B, Γ we are using metavariables, which stand for formulas but are not themselves part of the language. Compare "Let n be any integer": n is not one specific integer.)

The formation rules (inductive definition)#

The set Form of formulas is the smallest set such that:

  1. Every atom is a formula; ⊤ and ⊥ are formulas.
  2. If A is a formula, so is ¬A.
  3. If A and B are formulas, so are (A ∧ B), (A ∨ B), (A → B), (A ↔ B).

"Smallest" means: nothing else is a formula. In BNF (the grammar notation used in Section 1.1):

text
A ::= p | ⊤ | ⊥ | ¬A | (A ∧ A) | (A ∨ A) | (A → A) | (A ↔ A)

Read ::= as "is defined as" and | as "or" (here | is part of BNF, not the logical connective).

Examples

String Formula? Why
p yes atom
¬¬p yes negation of a negation
(p ∧ q) yes rule 3
(p → (q ∨ ¬r)) yes built in 4 steps
p ∧ q yes by convention outer parentheses dropped (abbreviation)
(p ∧) no missing an argument
p q no two atoms side by side
∧ p q not in infix syntax but valid in Polish notation (Z5.1.3)
(p ∧ q ∨ r) no (strictly) ambiguous; needs brackets
p → → q no connective without argument
¬(p) informally ok redundant brackets are tolerated

Parse trees (syntax trees)#

Every formula has a unique tree: the main connective is the root, immediate subformulas are children, atoms are leaves.

Formula: (P ∧ ¬Q) → (R ∨ P)

text
            →
          /   \
        ∧       ∨
       / \     / \
      P   ¬   R   P
          |
          Q

Why the main connective matters: a rule or law only applies to the main connective. (P ∧ Q) → R is an implication, not a conjunction, even though it contains ∧. This is the source of error #5 in Section 2.8.

Unique readability#

Theorem (unique readability). Every formula can be parsed in exactly one way.

This is why brackets matter. Without them, P ∧ Q ∨ R has two parses with different meanings. Take the valuation P = F, Q = F, R = T:

so the two readings really differ. Precedence conventions (Z5.1.1) tell you which brackets may be omitted. Prefix (Polish) notation needs no brackets at all.

Defining functions by recursion on formulas#

Because formulas are built inductively, you can define a function on them by saying what it does to each kind of formula.

Number of connectives c(A):

Set of atoms atoms(A):

Truth value ⟦A⟧ᵥ (the semantics, next section) is defined the same way.

Example: c((P ∧ ¬Q) → (R ∨ P)) = 1 + c(P ∧ ¬Q) + c(R ∨ P) = 1 + (1 + 0 + 1) + (1 + 0 + 0) = 4. ✓.

Proving things by structural induction (preview of Chapter 5)#

To prove a property for all formulas, prove it for atoms (base case) and show it is preserved by each connective (inductive step). Example: every formula has as many "(" as ")".

Hence true for all formulas. ∎

1.8.4 Semantics in complete detail#

Semantics gives formulas meaning: which are true, in which situations.

Valuations#

A valuation (assignment, interpretation, "world") is a function v from atoms to {T, F}. It says, for each atom, whether it is true or false in the situation being considered. With n atoms there are exactly 2ⁿ valuations: one for each row of the truth table.

Truth value of a compound: the recursive definition#

The valuation extends uniquely to all formulas by:

Formula Value
atom p ⟦p⟧ᵥ = v(p)
⊤ ⟦⊤⟧ᵥ = T
⊥ ⟦⊥⟧ᵥ = F
¬A T iff ⟦A⟧ᵥ = F
A ∧ B T iff ⟦A⟧ᵥ = T and ⟦B⟧ᵥ = T
A ∨ B T iff ⟦A⟧ᵥ = T or ⟦B⟧ᵥ = T (or both)
A → B T iff ⟦A⟧ᵥ = F or ⟦B⟧ᵥ = T
A ↔ B T iff ⟦A⟧ᵥ = ⟦B⟧ᵥ

This is the only place truth tables come from. A truth table is just this definition tabulated for all valuations.

Evaluating a formula under one valuation#

Evaluate (P ∧ ¬Q) → (R ∨ P) under v: P = T, Q = F, R = F. Work bottom-up on the parse tree:

Subformula Computation Value
P given T
Q given F
¬Q not F T
P ∧ ¬Q T and T T
R given F
R ∨ P F or T T
whole T → T T

Building a truth table systematically#

  1. List the atoms: n of them. You need 2ⁿ rows.
  2. Fill the atom columns in a standard order so none is missed. Convention: first atom changes slowest, last atom changes fastest, starting with all T: TTT, TTF, TFT, TFF, FTT, FTF, FFT, FFF for n = 3.
  3. Add one column per subformula, smallest first, so every column only uses columns to its left.
  4. The last column is the formula's value for each row.

n atoms → 2ⁿ rows: 5 atoms → 32 rows; 10 atoms → 1 024; 20 atoms → 1 048 576; 60 atoms → 2⁶⁰ ≈ 10¹⁸ rows (Section 1.7).

Classification of formulas#

Kind Meaning Truth-table signature Example
Tautology (valid) ⊨ A true under every valuation last column all T P ∨ ¬P
Contradiction (unsatisfiable) false under every valuation last column all F P ∧ ¬P
Contingent true under some, false under some mixed P → Q
Satisfiable true under at least one valuation at least one T tautologies and contingent ones
Falsifiable false under at least one valuation at least one F contradictions and contingent ones

Relationships you should be able to recite:

Semantic relations between formulas#

Relation Notation Meaning
Entailment Γ ⊨ A every valuation that makes all of Γ true makes A true
Equivalence A ≡ B same value under every valuation (⇔ ⊨ A ↔ B)
Consistency (satisfiability) of a set Γ has a model some valuation makes every member of Γ true
Inconsistency Γ has no model e.g. {P, ¬P}; {P → Q, P, ¬Q}
Independence neither Γ ⊨ A nor Γ ⊨ ¬A Γ leaves A open

A valuation that makes Γ true is called a model of Γ (written v ⊨ Γ). Entailment is "truth-preservation in all models".

Important consequences (be able to prove each):

  1. Γ ⊨ A and Γ is inconsistent: holds vacuously (explosion).
  2. If ⊨ A then Γ ⊨ A for any Γ (a tautology follows from anything).
  3. Monotonicity: if Γ ⊨ A and Γ ⊆ Δ, then Δ ⊨ A. (More premises never hurt.)
  4. Cut/transitivity: if Γ ⊨ A and Γ, A ⊨ B then Γ ⊨ B.
  5. A ≡ B iff A ⊨ B and B ⊨ A.

Four methods to decide validity#

Method Idea Best for
Full truth table check all 2ⁿ rows n ≤ 4, or a sanity check
Short truth table (falsification search) assume the formula is false and try to force valuations; if forcing leads to contradiction, it is valid most hand work
Algebraic transform with equivalence laws until ⊤ when laws are handy
Refutation (F1) Γ ⊨ A iff Γ ∪ {¬A} unsatisfiable; try to build a model automation; Chapter 7

Short truth table demonstration. Is ((P → Q) ∧ (Q → R)) → (P → R) a tautology? Try to make it false:

If the forcing had not collided, the surviving valuation would be a countermodel, a concrete falsifying world.

Complexity note. Deciding satisfiability (SAT) is NP-complete (Cook-Levin, 1971); deciding validity is coNP-complete. All known algorithms are exponential in the worst case, yet modern SAT solvers routinely handle millions of variables on structured problems. Propositional logic is decidable (the truth table is an algorithm), unlike predicate logic (Chapter 6).

Proving an equivalence without a table (semantic argument template)#

Claim: ¬(A ∧ B) ≡ ¬A ∨ ¬B. Proof. Let v be an arbitrary valuation. Then

⟦¬(A ∧ B)⟧ᵥ = T ⇔ ⟦A ∧ B⟧ᵥ = F (def. of ¬) ⇔ not both ⟦A⟧ᵥ = T and ⟦B⟧ᵥ = T (def. of ∧) ⇔ ⟦A⟧ᵥ = F or ⟦B⟧ᵥ = F ⇔ ⟦¬A⟧ᵥ = T or ⟦¬B⟧ᵥ = T (def. of ¬) ⇔ ⟦¬A ∨ ¬B⟧ᵥ = T (def. of ∨). Since v was arbitrary, the formulas are equivalent. ∎

The pattern is: take an arbitrary valuation, unfold definitions, chain of ⇔. This is your first taste of a proof about logic, which prepares you for Chapter 6.

1.8.5 All truth functions#

A truth function (Boolean function) of n arguments is any rule giving T or F for each of the 2ⁿ combinations of inputs. The number of different n-ary truth functions is

2^(2ⁿ): n = 0 → 2 (the constants ⊤, ⊥); n = 1 → 4; n = 2 → 16; n = 3 → 256; n = 4 → 65 536.

The 4 unary functions#

A identity negation ¬A constant ⊤ constant ⊥
T T F T F
F F T T F

The 16 binary functions#

Patterns list the output for rows (A,B) = TT, TF, FT, FF in that order.

# Pattern Name Formula Notation
0 F F F F contradiction (constant false) ⊥ ⊥
1 F F F T NOR (joint denial) ¬(A ∨ B) A ↓ B
2 F F T F converse nonimplication ¬A ∧ B A ↚ B
3 F F T T negation of A ¬A ¬A
4 F T F F nonimplication (A but not B) A ∧ ¬B A ↛ B
5 F T F T negation of B ¬B ¬B
6 F T T F exclusive or (XOR) (A ∨ B) ∧ ¬(A ∧ B) A ⊕ B
7 F T T T NAND (alternative denial) ¬(A ∧ B) A ↑ B
8 T F F F conjunction A ∧ B A ∧ B
9 T F F T biconditional (XNOR) (A → B) ∧ (B → A) A ↔ B
10 T F T F projection onto B B B
11 T F T T conditional ¬A ∨ B A → B
12 T T F F projection onto A A A
13 T T F T converse conditional A ∨ ¬B A ← B
14 T T T F disjunction A ∨ B A ∨ B
15 T T T T tautology (constant true) ⊤ ⊤

Observations.

A ternary example: if-then-else ITE(A, B, C) ≡ (A ∧ B) ∨ (¬A ∧ C): "if A then B else C". Majority: MAJ(A,B,C) ≡ (A∧B) ∨ (A∧C) ∨ (B∧C).

1.8.6 The complete table of laws, with names#

Below, A, B, C are arbitrary formulas. Each line is an equivalence ≡ (and thus also a tautology after replacing ≡ by ↔).

Laws for ∧, ∨, ¬ (Boolean algebra)#

Name Law
Idempotence A ∧ A ≡ A; A ∨ A ≡ A
Commutativity A ∧ B ≡ B ∧ A; A ∨ B ≡ B ∨ A
Associativity (A ∧ B) ∧ C ≡ A ∧ (B ∧ C); (A ∨ B) ∨ C ≡ A ∨ (B ∨ C)
Distributivity A ∧ (B ∨ C) ≡ (A ∧ B) ∨ (A ∧ C); A ∨ (B ∧ C) ≡ (A ∨ B) ∧ (A ∨ C)
Absorption A ∧ (A ∨ B) ≡ A; A ∨ (A ∧ B) ≡ A
Identity A ∧ ⊤ ≡ A; A ∨ ⊥ ≡ A
Domination (annihilation) A ∨ ⊤ ≡ ⊤; A ∧ ⊥ ≡ ⊥
Complement A ∨ ¬A ≡ ⊤ (excluded middle); A ∧ ¬A ≡ ⊥ (non-contradiction)
Double negation ¬¬A ≡ A
De Morgan ¬(A ∧ B) ≡ ¬A ∨ ¬B; ¬(A ∨ B) ≡ ¬A ∧ ¬B
Constants and negation ¬⊤ ≡ ⊥; ¬⊥ ≡ ⊤

Laws for →#

Name Law
Material implication A → B ≡ ¬A ∨ B
Negated implication ¬(A → B) ≡ A ∧ ¬B
Contraposition A → B ≡ ¬B → ¬A
Exportation / importation (A ∧ B) → C ≡ A → (B → C)
Permutation of premises A → (B → C) ≡ B → (A → C)
Distribution over ∧ in consequent A → (B ∧ C) ≡ (A → B) ∧ (A → C)
Distribution over ∨ in consequent A → (B ∨ C) ≡ (A → B) ∨ (A → C)
Cases in antecedent (A ∨ B) → C ≡ (A → C) ∧ (B → C)
Antecedent conjunction (A ∧ B) → C ≡ (A → C) ∨ (B → C)
Reflexivity A → A ≡ ⊤
Trivial antecedents/consequents ⊤ → A ≡ A; A → ⊤ ≡ ⊤; ⊥ → A ≡ ⊤; A → ⊥ ≡ ¬A
Self-reference A → ¬A ≡ ¬A; ¬A → A ≡ A
Consequentia mirabilis (Clavius) (¬A → A) → A is a tautology
Peirce's law ((A → B) → A) → A is a tautology

Laws for ↔ and ⊕#

Name Law
Definition A ↔ B ≡ (A → B) ∧ (B → A) ≡ (A ∧ B) ∨ (¬A ∧ ¬B)
Commutativity A ↔ B ≡ B ↔ A
Associativity (A ↔ B) ↔ C ≡ A ↔ (B ↔ C)
Reflexivity A ↔ A ≡ ⊤
Contrary A ↔ ¬A ≡ ⊥
Negation ¬(A ↔ B) ≡ A ↔ ¬B ≡ ¬A ↔ B ≡ A ⊕ B
With constants A ↔ ⊤ ≡ A; A ↔ ⊥ ≡ ¬A
XOR A ⊕ B ≡ (A ∨ B) ∧ ¬(A ∧ B); also commutative, associative, A ⊕ A ≡ ⊥

Things that are not valid (common false laws)#

False "law" Counterexample (valuation making them differ)
A → B ≡ B → A (converse) A = T, B = F
A → B ≡ ¬A → ¬B (inverse) A = F, B = T
(A → B) → C ≡ A → (B → C) (→ is not associative) A = F, C = F (left: (T) → F = F; right: F → … = T)
¬(A ∧ B) ≡ ¬A ∧ ¬B A = T, B = F
¬(A ∨ B) ≡ ¬A ∨ ¬B A = T, B = F
A → (B ∨ C) ≡ (A → B) ∧ (A → C) A = T, B = T, C = F
(A ∨ B) → C ≡ (A → C) ∨ (B → C) A = T, B = F, C = F
A ∨ B, A ⊨ ¬B ("affirming a disjunct") A = B = T (for inclusive or)

Using the laws: a derivation by equational reasoning#

Prove absorption A ∨ (A ∧ B) ≡ A:

text
      A ∨ (A ∧ B)
  ≡     { identity: A ≡ A ∧ ⊤ }
      (A ∧ ⊤) ∨ (A ∧ B)
  ≡     { distributivity, factoring out A }
      A ∧ (⊤ ∨ B)
  ≡     { domination: ⊤ ∨ B ≡ ⊤ }
      A ∧ ⊤
  ≡     { identity }
      A

Two meta-theorems that make laws usable#

Replacement theorem. If B ≡ B′, then replacing an occurrence of B inside a formula C by B′ gives a formula equivalent to C. (Equivalent subformulas are interchangeable. This is what justifies chains of ≡.)

Substitution theorem. If A is a tautology and you replace every occurrence of an atom p in A uniformly by any formula B, the result is still a tautology. (So p ∨ ¬p being valid yields (Q ∧ R) ∨ ¬(Q ∧ R) being valid.)

Care: uniform is essential. Replacing only one of two occurrences of p in p → p by ¬p gives ¬p → p, which is not valid.

This is why laws are written with metavariables A, B, C: each is a schema with infinitely many instances.

1.8.7 Normal forms in complete detail#

Vocabulary#

Every formula is equivalent to a CNF and to a DNF.

Reading a DNF/CNF off a truth table (canonical forms)#

Canonical DNF: take every row where the formula is T; write the term that is true only on that row (atom if T, negated atom if F); OR them together. Canonical CNF: take every row where the formula is F; write the clause that is false only on that row (atom if F, negated atom if T); AND them together.

Example. Majority of three, MAJ(P,Q,R) = "at least two true":

P Q R MAJ
T T T T
T T F T
T F T T
T F F F
F T T T
F T F F
F F T F
F F F F

This construction proves functional completeness of {¬, ∧, ∨}: every truth function (every table) equals its canonical DNF. Two special cases: if there are no T rows the formula is ⊥; if no F rows, ⊤.

Conversion algorithm (syntactic), step by step#

  1. Eliminate ↔, ⊕, → : A ↔ B ⟹ (¬A ∨ B) ∧ (¬B ∨ A); A ⊕ B ⟹ (A ∨ B) ∧ (¬A ∨ ¬B); A → B ⟹ ¬A ∨ B.
  2. Push negations inward (reach NNF): ¬¬A ⟹ A; ¬(A ∧ B) ⟹ ¬A ∨ ¬B; ¬(A ∨ B) ⟹ ¬A ∧ ¬B; ¬⊤ ⟹ ⊥; ¬⊥ ⟹ ⊤.
  3. Distribute ∨ over ∧ to reach CNF (or ∧ over ∨ for DNF): A ∨ (B ∧ C) ⟹ (A ∨ B) ∧ (A ∨ C).
  4. Clean up: remove duplicates, drop clauses containing both p and ¬p (they are tautologies), apply absorption.

Worked example. Convert ¬((P ∨ Q) → (P ∧ R)) to CNF.

Already in CNF: two clauses P ∨ Q and ¬P ∨ ¬R. ✓.

Blow-up. Converting (a₁ ∧ b₁) ∨ (a₂ ∧ b₂) ∨ ... ∨ (aₙ ∧ bₙ) to CNF gives 2ⁿ clauses. That is why Tseitin exists.

Tseitin transformation (equisatisfiable CNF in linear size)#

Introduce a fresh atom xᵢ for each non-atomic subformula and assert that xᵢ is equivalent to it, written as clauses.

Gate clauses:

Definition Clauses
x ↔ (a ∧ b) (¬x ∨ a) ∧ (¬x ∨ b) ∧ (x ∨ ¬a ∨ ¬b)
x ↔ (a ∨ b) (¬x ∨ a ∨ b) ∧ (x ∨ ¬a) ∧ (x ∨ ¬b)
x ↔ ¬a (¬x ∨ ¬a) ∧ (x ∨ a)
x ↔ (a → b) (¬x ∨ ¬a ∨ b) ∧ (x ∨ a) ∧ (x ∨ ¬b)

Example. (P ∧ Q) ∨ R: name x₁ ↔ (P ∧ Q) and x₂ ↔ (x₁ ∨ R), then assert x₂:

text
(¬x₁ ∨ P) ∧ (¬x₁ ∨ Q) ∧ (x₁ ∨ ¬P ∨ ¬Q)        -- defines x₁
∧ (¬x₂ ∨ x₁ ∨ R) ∧ (x₂ ∨ ¬x₁) ∧ (x₂ ∨ ¬R)    -- defines x₂
∧ x₂                                            -- assert the whole formula

The result is satisfiable iff (P ∧ Q) ∨ R is satisfiable (equisatisfiable), but it is not equivalent (it mentions new atoms) and its size grows only linearly.

Why normal forms matter#

1.8.8 Functional completeness in complete detail#

A set of connectives is functionally complete (adequate) if every truth function is expressible using only them.

Proofs and expressions#

Some incomplete sets, and why#

Set Why incomplete
{∧, ∨} every formula is monotone (switching an input from F to T never makes the output go from T to F), but ¬ is not monotone
{∧, ∨, →, ↔, ⊤} every formula is T when all atoms are T, but ¬p is F there (Problem 1.9)
{⊕, ⊤} (or {⊕, ↔}) every formula is affine (a sum mod 2 of atoms and constants), but ∧ is not
{¬} only expresses p, ¬p, ¬¬p, ... : no binary function
{⊥} alone / {⊤} alone constants only

Post's criterion (Emil Post, 1941): a set of truth functions is complete iff it is not entirely contained in any one of five classes: functions that preserve F (T₀), preserve T (T₁), are monotone, are self-dual, or are affine. NAND and NOR escape all five. That is a classification theorem you can study later.

Why you care#

1.8.9 Arguments in propositional logic: valid forms and fallacies#

An argument is a list of premises A₁, ..., Aₙ and a conclusion C. It is valid iff A₁, ..., Aₙ ⊨ C. Validity depends on form only.

Named valid forms (rules of inference)#

Name Form Description
Modus ponens A → B, A ∴ B affirm the antecedent
Modus tollens A → B, ¬B ∴ ¬A deny the consequent
Hypothetical syllogism A → B, B → C ∴ A → C chain implications
Disjunctive syllogism A ∨ B, ¬A ∴ B eliminate one disjunct
Addition (∨ intro) A ∴ A ∨ B weaken
Simplification (∧ elim) A ∧ B ∴ A
Conjunction (∧ intro) A, B ∴ A ∧ B
Constructive dilemma A → C, B → D, A ∨ B ∴ C ∨ D
Destructive dilemma A → C, B → D, ¬C ∨ ¬D ∴ ¬A ∨ ¬B
Resolution A ∨ B, ¬A ∨ C ∴ B ∨ C basis of automated provers
Proof by cases A → C, B → C, A ∨ B ∴ C
Reductio ad absurdum A → B, A → ¬B ∴ ¬A
Explosion (ex falso) A, ¬A ∴ B anything follows from a contradiction
Absorption A → B ∴ A → (A ∧ B)

Named fallacies (invalid forms that look valid)#

Name Form Counter-valuation
Affirming the consequent A → B, B ∴ A A = F, B = T
Denying the antecedent A → B, ¬A ∴ ¬B A = F, B = T
Affirming a disjunct A ∨ B, A ∴ ¬B A = B = T
Illicit conversion A → B ∴ B → A A = F, B = T
Denying a conjunct ¬(A ∧ B), ¬A ∴ B A = B = F
Converting a disjunction A ∨ B ∴ A ∧ B A = T, B = F

Concrete English instances:

How to test any argument: (1) formalize premises and conclusion; (2) search for a valuation making all premises T and the conclusion F (short truth table). If one exists, the argument is invalid and that valuation is your counterexample. If none exists, it is valid.

1.8.10 Quick-check (with answers)#

Q1. Which of these are propositions: (a) "Is 7 prime?" (b) "7 is prime." (c) "x > 3." (d) "Every even number greater than 2 is a sum of two primes." Q2. Translate "You may enter only if you have a ticket and are not drunk" with E, T, D. Q3. What are the main connective, the immediate subformulas, and the number of connectives of ¬(P ∨ Q) → (R ↔ ¬S)? Q4. How many valuations are there for a formula with 7 distinct atoms? How many different 3-ary truth functions exist? Q5. Use the short-truth-table method on (P → Q) → (¬Q → ¬P). Valid? Q6. True or false: (a) A → B ≡ ¬B → ¬A; (b) A → (B → C) ≡ (A → B) → C; (c) {P ∨ Q, ¬P} ⊨ Q; (d) P ↔ Q ≡ (P ∧ Q) ∨ (¬P ∧ ¬Q). Q7. Give canonical DNF for P ⊕ Q and canonical CNF for P → Q. Q8. Express A → B using only NAND. Q9. Why does a conditional with a false antecedent count as true?

Answers. A1. (b) and (d). (a) is a question, (c) is an open sentence. A2. E → (T ∧ ¬D). ("Only if" gives the arrow from E to the conditions.) A3. Main connective: →. Immediate subformulas: ¬(P ∨ Q) and R ↔ ¬S. Connectives: ¬, ∨, →, ↔, ¬ = 5. A4. 2⁷ = 128 valuations. 2^(2³) = 2⁸ = 256 ternary functions. A5. To falsify: need P → Q = T and ¬Q → ¬P = F. The latter forces ¬Q = T (Q = F) and ¬P = F (P = T). Then P → Q = T → F = F, contradiction. So it is valid. A6. (a) True. (b) False (A = F, C = F). (c) True. (d) True. A7. P ⊕ Q: true rows TF and FT: (P ∧ ¬Q) ∨ (¬P ∧ Q). P → Q: only false row TF: (¬P ∨ Q). A8. A → B ≡ ¬A ∨ B ≡ A ↑ ¬B ≡ A ↑ (B ↑ B). Check: A ↑ (B ↑ B) = ¬(A ∧ ¬B) = ¬A ∨ B ✓. A9. Because → promises only that "A true and B false" never occurs. If A is false, that situation did not occur, so the promise is not broken. Also, a universal claim "for all n, if n > 2 then ..." must not be refuted by n = 1 (Section 1.3).

Problems for Chapter 1#

1.1 ★ Use a truth table to show that P → Q, ¬P ∨ Q, ¬(P ∧ ¬Q), and ¬Q → ¬P are all equivalent.

1.2 ★ State the converse, inverse, and contrapositive of "if a number is divisible by 6, then it is divisible by 3". Which of the four statements are true?

1.3 ★ Translate into propositional logic, naming your atoms:

1.4 ★★ Decide, with justification, whether each entailment holds:

1.5 ★★ Show that P → (Q → R) ≡ (P ∧ Q) → R using the laws of Section 1.4 (no truth table).

1.6 ★★ Convert (P ↔ Q) ∨ R to CNF and to DNF.

1.7 ★★ Using (F1), show {P → Q, Q → R} ⊨ P → R by proving that {P → Q, Q → R, ¬(P → R)} is unsatisfiable.

1.8 ★★ Show that NAND is functionally complete by expressing ¬P and P ∧ Q using only |.

1.9 ★★★ Prove that no formula built from atoms using only ∧, ∨, →, ↔ is equivalent to ¬P. (Hint: look at the valuation making every atom true.)

1.10 ★★★ On an island, knights always tell the truth and knaves always lie. A says "B is a knave." B says "A and I are of the same kind." Who is the knight and who is the knave? Formalize with atoms a = "A is a knight" and b = "B is a knight" and solve algebraically.


Chapter 2. Natural deduction for propositional logic ↑ Top#

2.1 What is a proof?#

A formal proof of A from premises Γ (written Γ ⊢ A) is a finite sequence of lines. Each line is either a premise, an assumption (temporarily made), or follows from earlier lines by an inference rule. The last line is A.

The point is that a proof is a purely mechanical object. A computer (or a skeptical friend) can check it line by line without understanding what the formulas mean. This is what makes it trustworthy.

We use natural deduction in Fitch style: nested sub-proofs, where each sub-proof opens with an assumption and ends when we discharge it.

2.2 Reading and writing Fitch proofs#

text
1.  P → Q              premise
2.  Q → R              premise
3.  |  P               assumption
4.  |  Q               →E 1,3
5.  |  R               →E 2,4
6.  P → R              →I 3-5

2.3 The rules#

Each connective has an introduction rule (how to prove a statement of that form) and an elimination rule (how to use a statement of that form). This pairing is the heart of natural deduction.

Connective Introduction (to prove it) Elimination (to use it)
∧ ∧I: from A and B, infer A ∧ B ∧E: from A ∧ B, infer A (or infer B)
∨ ∨I: from A, infer A ∨ B (or B ∨ A) ∨E (cases): from A ∨ B, a sub-proof A ⊢ C, and a sub-proof B ⊢ C, infer C
→ →I: sub-proof assuming A and reaching B; infer A → B →E (modus ponens): from A and A → B, infer B
¬ ¬I: sub-proof assuming A and reaching ⊥; infer ¬A ¬E: from A and ¬A, infer ⊥
⊥ (none) ⊥E (ex falso): from ⊥, infer any C
↔ ↔I: from A → B and B → A, infer A ↔ B ↔E: from A ↔ B and A, infer B (and symmetrically)
Classical RAA (reductio): sub-proof assuming ¬A and reaching ⊥; infer A

Two rules to treat with respect:

2.4 How to find proofs: the strategy#

Two questions, in this order:

1. What is my goal? Look at its main connective.

Goal looks like First move
A → B Assume A, aim for B (→I)
¬A Assume A, aim for ⊥ (¬I)
A ∧ B Prove A, prove B separately (∧I)
A ∨ B Try to prove A, or B, then ∨I. If neither is provable directly, use RAA (assume ¬(A ∨ B), derive ⊥)
A ↔ B Prove both directions (↔I)
Atom, or nothing else works Try RAA: assume ¬goal, aim for ⊥

2. What do I have? Look at the main connective of each available line.

Available line What to do with it
A ∧ B Extract A and B (∧E)
A → B If you can prove A, get B. Otherwise remember it for the contradiction
A ∨ B Do case analysis (∨E), usually aiming at your goal
¬A Useful for ¬E: if you get A anywhere, you get ⊥
⊥ You are done: ⊥E gives anything

Golden rule: work backwards from the goal and forwards from the premises, and meet in the middle. When stuck, ask "what would give me a contradiction?"

2.5 Worked examples#

Example 1. Hypothetical syllogism: P → Q, Q → R ⊢ P → R#

The goal is an implication, so assume the antecedent.

text
1.  P → Q              premise
2.  Q → R              premise
3.  |  P               assumption
4.  |  Q               →E 1,3
5.  |  R               →E 2,4
6.  P → R              →I 3-5

Example 2. Contrapositive: P → Q ⊢ ¬Q → ¬P#

Goal is an implication, so assume ¬Q. Its conclusion ¬P is a negation, so assume P and look for ⊥.

text
1.  P → Q              premise
2.  |  ¬Q              assumption
3.  |  |  P            assumption
4.  |  |  Q            →E 1,3
5.  |  |  ⊥            ¬E 4,2
6.  |  ¬P              ¬I 3-5
7.  ¬Q → ¬P            →I 2-6

Example 3. Disjunctive syllogism: P ∨ Q, ¬P ⊢ Q#

We use a disjunction, so do cases.

text
1.  P ∨ Q              premise
2.  ¬P                 premise
3.  |  P               assumption (case 1)
4.  |  ⊥               ¬E 3,2
5.  |  Q               ⊥E 4
6.  |  Q               assumption (case 2)
7.  Q                  ∨E 1, 3-5, 6-6

Case 1 is impossible (it contradicts ¬P), so ex falso gives Q. Case 2 is trivial.

Example 4. De Morgan: ¬(P ∨ Q) ⊢ ¬P ∧ ¬Q#

Goal is a conjunction, so prove each part. Each part is a negation, so assume and refute.

text
1.  ¬(P ∨ Q)           premise
2.  |  P               assumption
3.  |  P ∨ Q           ∨I 2
4.  |  ⊥               ¬E 3,1
5.  ¬P                 ¬I 2-4
6.  |  Q               assumption
7.  |  P ∨ Q           ∨I 6
8.  |  ⊥               ¬E 7,1
9.  ¬Q                 ¬I 6-8
10. ¬P ∧ ¬Q            ∧I 5,9

Example 5. Law of excluded middle: ⊢ P ∨ ¬P#

This is the classic "no obvious first move" proof. The goal is a disjunction, but we can prove neither P nor ¬P. So use RAA: assume the goal is false and derive a contradiction.

text
1.  |  ¬(P ∨ ¬P)       assumption (for RAA)
2.  |  |  P            assumption
3.  |  |  P ∨ ¬P       ∨I 2
4.  |  |  ⊥            ¬E 3,1
5.  |  ¬P               ¬I 2-4
6.  |  P ∨ ¬P          ∨I 5
7.  |  ⊥                ¬E 6,1
8.  P ∨ ¬P              RAA 1-7

Read it in words: "Suppose P ∨ ¬P failed. Then P can't hold (it would give P ∨ ¬P), so ¬P holds. But then P ∨ ¬P holds after all. Contradiction."

Example 6. Peirce's law: ⊢ ((P → Q) → P) → P#

Goal is an implication, so assume the antecedent. Then the goal P is an atom with nothing to build it from, so use RAA.

text
1.  |  (P → Q) → P      assumption
2.  |  |  ¬P            assumption (for RAA)
3.  |  |  |  P          assumption
4.  |  |  |  ⊥          ¬E 3,2
5.  |  |  |  Q          ⊥E 4
6.  |  |  P → Q         →I 3-5
7.  |  |  P              →E 1,6
8.  |  |  ⊥              ¬E 7,2
9.  |  P                 RAA 2-8
10. ((P → Q) → P) → P    →I 1-9

The key trick is line 5: from the contradiction at line 4 we derive Q (which we don't care about) in order to manufacture P → Q.

Example 7. Distribution: P ∧ (Q ∨ R) ⊢ (P ∧ Q) ∨ (P ∧ R)#

text
1.  P ∧ (Q ∨ R)        premise
2.  P                  ∧E 1
3.  Q ∨ R              ∧E 1
4.  |  Q               assumption (case 1)
5.  |  P ∧ Q           ∧I 2,4
6.  |  (P∧Q) ∨ (P∧R)   ∨I 5
7.  |  R               assumption (case 2)
8.  |  P ∧ R           ∧I 2,7
9.  |  (P∧Q) ∨ (P∧R)   ∨I 8
10. (P∧Q) ∨ (P∧R)      ∨E 3, 4-6, 7-9

Example 8. A proof you should try before reading: ¬¬P ⊢ P#

This requires RAA (it is not provable in intuitionistic logic). Assume ¬P, and combine it with ¬¬P to get ⊥.

text
1.  ¬¬P                premise
2.  |  ¬P              assumption (for RAA)
3.  |  ⊥               ¬E 2,1
4.  P                  RAA 2-3

(Here ¬E is applied to ¬P and ¬¬P, treating ¬P as the "A" and ¬¬P as "¬A".)

2.6 Useful derived results#

Once you have proved these, you may use them as shortcuts (in an exam, prove them first or cite them):

Name Statement
Modus tollens P → Q, ¬Q ⊢ ¬P
Contraposition P → Q ⊢ ¬Q → ¬P
Disjunctive syllogism P ∨ Q, ¬P ⊢ Q
Hypothetical syllogism P → Q, Q → R ⊢ P → R
Double negation intro P ⊢ ¬¬P
Double negation elim (classical) ¬¬P ⊢ P
Excluded middle (classical) ⊢ P ∨ ¬P
De Morgan ¬(P ∨ Q) ⊣⊢ ¬P ∧ ¬Q; ¬(P ∧ Q) ⊣⊢ ¬P ∨ ¬Q (the hard direction is classical)
Implication as disjunction P → Q ⊣⊢ ¬P ∨ Q (the direction → to ∨ is classical)

2.7 Classical vs. intuitionistic logic#

If you remove RAA (and everything equivalent to it), you get intuitionistic logic, in which a proof of A ∨ B must contain a proof of A or a proof of B, and ¬¬A is weaker than A. This is not a mere curiosity:

Each of these is equivalent (given the other rules): RAA, ¬¬P ⊢ P, excluded middle, Peirce's law.

2.8 Common mistakes#

  1. Using a line from a closed sub-proof. After line 6 in Example 1, lines 3-5 are gone.
  2. Forgetting to discharge. A proof of A → B must end with →I at the outer level.
  3. Confusing ¬I and RAA. To prove a negation, assume the positive statement. To prove a positive statement (by contradiction), assume its negation.
  4. Affirming the consequent. From A → B and B you cannot conclude A.
  5. Applying a rule to a sub-formula. Rules apply to the main connective only. From (P ∧ Q) → R you cannot "extract" P.
  6. Using ∨E with branches that prove different things. Both branches must end in the same formula.

2.9 Chapter 2 in complete detail (the from-zero companion)#

Sections 2.1-2.9 introduced natural deduction in Fitch style. This companion (a) explains what a formal proof system is and exactly what it means for a proof to be correct, (b) goes through every rule with its conditions, typical uses and typical misuses, (c) gives a proof-search method, (d) shows all the other proof formats with their complete rule sets (Gentzen tree, Lemmon, Hilbert, sequent calculus, tableaux, resolution), and (e) explains intuitionistic logic and the Curry-Howard correspondence properly.

2.9.1 What is a formal proof system?#

Truth tables (semantics) answer: "is this true in all worlds?". A proof system (also calculus, deductive system) answers a different question, purely by symbol manipulation: "can this formula be derived by following the rules?".

A proof system consists of:

  1. A formal language (the formulas, Chapter 1).
  2. A set of rules (and possibly axioms): each rule says "if you already have lines of these shapes, you may write a line of that shape".
  3. A definition of derivation (proof): a finite structure of lines, each justified by a rule.
  4. A derivability relation Γ ⊢ A: "there is a derivation of A from the premises Γ".

Vocabulary you must keep straight

Term Meaning
Premise (hypothesis, given) a formula in Γ, available for the entire proof
Assumption (supposition) a formula we temporarily suppose inside a subproof; it must later be discharged (closed)
Derived line a line obtained from earlier lines by a rule
Conclusion (goal, target) the formula we want on the last line
Theorem a formula derivable from no premises: ⊢ A
Derivable rule a rule that can be simulated by a chain of basic rules (e.g. modus tollens)
Admissible rule a rule whose addition does not enlarge the set of theorems, though it may not be simulable line-by-line
Sequent the pair "premises + conclusion", written Γ ⊢ A

Why proofs are trustworthy. Checking a proof requires no understanding: for each line, ask "does this line follow from the cited lines by the cited rule?". A computer can do this in a fraction of a second. The finding of a proof is hard (in predicate logic it is undecidable in general); the checking is trivial. This asymmetry is the foundation of everything in Chapters 7-8.

Two big questions about any proof system (answered in Chapter 6):

Every system in this chapter is sound and complete for classical propositional logic.

2.9.2 Anatomy of a Fitch proof#

A Fitch proof is a vertical list of numbered lines.

text
1 │ A → B                premise
2 │ ┌─ A                 assumption
3 │ │  B                 →E 1, 2
4 │ └──
5 │ A → B                →I 2-3

(The textual style | used elsewhere in the course is the same thing drawn with plain characters.)

Each line has:

  1. a line number;
  2. a formula;
  3. a justification: a rule name plus the numbers of the lines (or ranges of lines for subproofs) it uses;
  4. a depth (how many boxes enclose it), shown by the vertical bars.

The scope rule (the single most important rule about format)#

A line may cite an earlier line only if that line is in the same box or in a box that encloses the citing line. A line inside a closed box can never be cited from outside, except the whole box can be cited as a unit by the rule that closes it.

Picture: boxes are rooms. You can see out (use anything from your own room and the surrounding rooms) but not into closed rooms. The only communication from a closed room is through its "exit door", the discharging rule.

Formal version: let line m be in a box b. Line n > m may cite m iff b still contains n (i.e. b has not been closed before n).

Subproof citations#

A rule that discharges an assumption (→I, ¬I, ∨E, RAA) cites a range such as 3-5, meaning "the subproof starting at line 3 and ending at line 5". The subproof's first line is the assumption; its last line is what it concludes. The range must be a complete, closed subproof, immediately below the line at the same depth.

Premise versus assumption: the lines at the top#

Premises are written at the top, at depth 0, and are never discharged. Assumptions start boxes at deeper depth and are discharged by the closing rule.

The conclusion of the whole proof must be at depth 0 (outside all boxes). A proof that ends inside a box is incomplete.

Reiteration#

Some books (Barwise-Etchemendy Language, Proof and Logic, the Fitch program) require you to reiterate (copy) a line into a box before using it there. We do not: scoping already permits using outer lines. If your textbook or checker insists on Reit, add a copy line with justification Reit n.

2.9.3 Every rule in complete detail#

Notation: A, B, C are any formulas. A box means a subproof. Each rule is given as

Conjunction introduction (∧I)#

text
m │ A
n │ B
  │ A ∧ B           ∧I m, n

In words: if you have A and you have B, you may state "A and B". (The lines may be in either order, anywhere above, in scope.) Use it when the goal is a conjunction: prove each half, then glue. Misuse: citing a line that is out of scope; gluing in the wrong order (B ∧ A needs its own ∧I).

Conjunction elimination (∧E)#

text
m │ A ∧ B
  │ A               ∧E m          (left)
  │ B               ∧E m          (right)

In words: from "A and B", you may take out either part. Use it when a premise is a conjunction. Always extract both halves early; it costs nothing. Misuse: applying ∧E to a conjunction that is a subformula: from (A ∧ B) → C you cannot extract A.

Disjunction introduction (∨I)#

text
m │ A
  │ A ∨ B           ∨I m          (B is any formula whatsoever)
  │ B ∨ A           ∨I m

In words: if A is established, then "A or anything" is established (weakening). Use it when the goal is a disjunction and you can prove one disjunct. Also for manufacturing the formula needed by ¬E (P ∨ Q against ¬(P ∨ Q)). Misuse: believing it "adds knowledge": it only weakens. Also: ∨I needs a proved disjunct; you cannot choose a disjunct you cannot prove.

Disjunction elimination (∨E, proof by cases)#

text
m │ A ∨ B
  │ ┌─ A                  assumption (case 1)
  │ │  ...
  │ │  C
  │ └──
  │ ┌─ B                  assumption (case 2)
  │ │  ...
  │ │  C
  │ └──
  │ C                      ∨E m, (case-1 range), (case-2 range)

In words: if A or B holds, and either one alone leads to C, then C holds. Use it when you have a disjunction available and don't know which side holds. Conditions: both subproofs must end in the same formula C; the cases must be the two disjuncts of the cited disjunction. Misuse: ending the two cases in different formulas; assuming only one case; forgetting that the conclusion C escapes both boxes (that is the whole point).

Conditional introduction (→I, conditional proof)#

text
  │ ┌─ A                  assumption
  │ │  ...
  │ │  B
  │ └──
  │ A → B                  →I (range)

In words: to prove "if A then B", suppose A and derive B. Use it when the goal is an implication. It is almost always your first move on such a goal. Misuse: leaving the box open; thinking A is then "true" outside (it is not: it was only supposed).

Conditional elimination (→E, modus ponens)#

text
m │ A → B
n │ A
  │ B                     →E m, n

In words: if you know "A implies B" and you know A, you may conclude B. Misuse: affirming the consequent (having B and A → B and "concluding" A); applying it with A that is only a part of a larger formula.

Negation introduction (¬I)#

text
  │ ┌─ A                  assumption
  │ │  ...
  │ │  ⊥
  │ └──
  │ ¬A                     ¬I (range)

In words: to prove "not A", suppose A and derive a contradiction. Use it when the goal is a negation ¬A. (Equivalent presentation: define ¬A as A → ⊥ and treat ¬I as →I.)

Negation elimination (¬E, contradiction introduction)#

text
m │ A
n │ ¬A
  │ ⊥                     ¬E m, n

In words: a formula and its negation together yield the absurd ⊥. Use it when you want to close a box ending in ⊥. This is the only way to produce ⊥ in our system (besides citing an existing ⊥). Variants: some books call this rule "⊥I" or "contradiction introduction" or "¬ elimination"; some conclude "any formula B" directly (see 2.9.4).

Falsum elimination (⊥E, ex falso quodlibet)#

text
m │ ⊥
  │ C                     ⊥E m          (C is any formula)

In words: from a contradiction, anything follows ("from falsehood, anything"). Use it when you are inside a branch known to be impossible (like case 1 in disjunctive syllogism). Also to "pay off" a box that must end with some target formula: reach ⊥ and then write the target. This is not cheating: the branch it is used in is already contradicting something; the rule just records that.

Reductio ad absurdum (RAA, indirect proof; classical only)#

text
  │ ┌─ ¬A                 assumption
  │ │  ...
  │ │  ⊥
  │ └──
  │ A                      RAA (range)

In words: to prove A, suppose it is false and derive a contradiction. Use it when the goal is atomic or a disjunction/existential with no direct route, or when you are stuck. Alternative names: IP (indirect proof), proof by contradiction, ¬¬E, DNE. Misuse: using it to prove a negation (use ¬I there). If the goal is ¬A, do not assume ¬¬A; assume A.

Biconditional introduction (↔I)#

text
  │ ┌─ A                  assumption
  │ │  ...
  │ │  B
  │ └──
  │ ┌─ B                  assumption
  │ │  ...
  │ │  A
  │ └──
  │ A ↔ B                  ↔I (range 1), (range 2)

Or, if you already have the two implications as lines A → B and B → A, infer A ↔ B directly. Two subproofs (one each direction) is the usual practice.

Biconditional elimination (↔E)#

text
m │ A ↔ B
n │ A
  │ B                     ↔E m, n       (or from B infer A)

Constants#

⊤I: ⊤ may be written at any time (no premises needed). ⊤ elimination: nothing useful.

Summary table of rules and their discharge behaviour#

Rule Cites Opens/closes a box? Result
∧I 2 lines no A ∧ B
∧E 1 line no a conjunct
∨I 1 line no A ∨ B (any B)
∨E disjunction + 2 ranges closes 2 boxes C
→I 1 range closes 1 box A → B
→E 2 lines no B
¬I 1 range closes 1 box ¬A
¬E 2 lines no ⊥
⊥E 1 line no anything
RAA 1 range closes 1 box A
↔I 2 ranges closes 2 boxes A ↔ B
↔E 2 lines no the other side

Rule counting: every connective has an I and an E. The rules ∧I, ∧E, ∨I, ∨E, →I, →E, ¬I, ¬E, ⊥E, (↔I, ↔E) form the intuitionistic system; adding RAA gives the classical one.

2.9.4 Rule names in other books (translation table)#

Textbooks differ in names, not in power. Learn the equivalence once.

Idea This course Other names
∧I ∧I Conjunction (Conj), Adjunction, &I, ∧-intro
∧E ∧E Simplification (Simp), &E
∨I ∨I Addition (Add), ∨-intro
∨E ∨E Proof by cases, Constructive dilemma (variant), ∨-elim
→I →I Conditional proof (CP), Deduction, ⊃I, →-intro, Discharge
→E →E Modus ponens (MP), Detachment, MPP, ⊃E
¬I ¬I Reductio (Lemmon RAA), Negation intro, Proof of negation
¬E ¬E Contradiction (Contra), ⊥I, Negation elim
⊥E ⊥E Ex falso (EFQ), Explosion, Absurdity, Exfalso
RAA RAA Indirect proof (IP), Proof by contradiction, ¬¬E, DNE, Classical reductio
↔I / ↔E ↔I / ↔E ≡I, ≡E, Material equivalence
Iteration (not needed) Reit, R, Repeat

Three styles of negation rules (all equivalent in power once you add classical reasoning):

Style Negation rules Used by
Absurdity style (this course) ¬I (from A ⊢ ⊥ infer ¬A), ¬E (A, ¬A ⊢ ⊥), ⊥E, RAA Gentzen NJ/NK, Fitch, Barwise-Etchemendy
Contradiction-closes-anything style ¬I as above; ¬E: from A and ¬A infer any B; no ⊥ symbol Kalish-Montague, many intro books
Double-negation style ¬I as above; add DN: ¬¬A ⊢ A as a rule; no RAA Copi, Lemmon (via DN rule)

How RAA, DNE, LEM, and Peirce relate#

Over the intuitionistic rules, adding any one of the following gives classical logic: RAA; double-negation elimination ¬¬A ⊢ A; excluded middle ⊢ A ∨ ¬A; Peirce's law ⊢ ((A → B) → A) → A; ⊢ (¬A → A) → A (consequentia mirabilis). Each of these five gives full classical logic. Careful with a famous look-alike: adding Dummett's axiom ⊢ (A → B) ∨ (B → A) gives only the intermediate Gödel-Dummett logic, not full classical logic.

2.9.5 Finding proofs: a complete procedure#

You have two "directions" of work, to be interleaved:

The loop (try in this priority order)#

  1. Unpack everything safe (forward): from every conjunction available, take both halves (∧E). Apply →E / ↔E wherever the needed antecedent is already available. Use ⊥E if you reach ⊥ and need the goal.
  2. Check the goal's main connective (backward):
    • A → B: assume A, aim for B.
    • ¬A: assume A, aim for ⊥.
    • A ∧ B: two subgoals.
    • A ↔ B: two boxes.
    • A ∨ B: if one disjunct is derivable, ∨I. Otherwise go to 4.
    • ⊥: find a formula and its negation (¬E).
    • atom: go to 3.
  3. Use disjunctions (cases): if a disjunction A ∨ B is available, plan ∨E aiming at the current goal in each case.
  4. RAA: assume the negation of the goal and aim for ⊥. When you do this you gain a new available line (the assumption), and the new goal is ⊥. To reach ⊥ you need a formula and its negation: look at the negations and implications you have.
  5. Repeat inside each new box.

The loop always terminates for propositional logic (the search space is finite); for predicate logic it need not.

Checklist when stuck#

Narrated example 1: ⊢ (P → Q) → ((¬P → Q) → Q) (reasoning by cases on P)#

Thinking aloud. Goal is an implication: assume P → Q. New goal (¬P → Q) → Q: also an implication, assume ¬P → Q. New goal Q: an atom, nothing to unpack except two implications whose antecedents (P, ¬P) I don't have. Use RAA: assume ¬Q, aim for ⊥. Now: from P → Q and ¬Q I expect ¬P (modus tollens: assume P, get Q, contradiction). Then ¬P → Q gives Q, which clashes with ¬Q.

text
1.  |  P → Q                         assumption
2.  |  |  ¬P → Q                     assumption
3.  |  |  |  ¬Q                      assumption (for RAA)
4.  |  |  |  |  P                    assumption (for ¬I)
5.  |  |  |  |  Q                    →E 1,4
6.  |  |  |  |  ⊥                    ¬E 5,3
7.  |  |  |  ¬P                      ¬I 4-6
8.  |  |  |  Q                       →E 2,7
9.  |  |  |  ⊥                       ¬E 8,3
10. |  |  Q                          RAA 3-9
11. |  (¬P → Q) → Q                  →I 2-10
12. (P → Q) → ((¬P → Q) → Q)         →I 1-11

Informally: "either P or not P; whichever holds, Q." The proof avoids quoting LEM; RAA does the same work.

Narrated example 2: ¬(P ∧ Q) ⊢ P → ¬Q (no RAA needed)#

Thinking aloud. Goal is an implication: assume P. New goal ¬Q: a negation, assume Q and look for ⊥. Now I hold P and Q, so P ∧ Q, which clashes with the premise.

text
1.  ¬(P ∧ Q)            premise
2.  |  P                assumption
3.  |  |  Q             assumption
4.  |  |  P ∧ Q         ∧I 2,3
5.  |  |  ⊥             ¬E 4,1
6.  |  ¬Q               ¬I 3-5
7.  P → ¬Q              →I 2-6

This one is intuitionistically valid (no RAA). Its converse direction is also valid; compare ¬(P ∧ Q) ⊢ ¬P ∨ ¬Q, which needs classical logic.

Reading someone else's proof (checking)#

For each line, ask: (1) which rule? (2) are the cited lines in scope? (3) do the cited lines have exactly the shapes the rule demands? (4) if a box closed, was the right range cited? (5) does the last line, at depth 0, equal the goal, and do all premises used appear in the premise list? If all yes, the proof is correct.

2.9.6 Derived rules: tools that save time#

You can prove once, then reuse (an allowed abbreviation; the full proof is the abbreviation expanded).

Derived rule Premises → conclusion Proved by
Modus tollens (MT) A → B, ¬B ⊢ ¬A ¬I: assume A, →E, ¬E
Hypothetical syllogism (HS) A → B, B → C ⊢ A → C →I, →E twice
Disjunctive syllogism (DS) A ∨ B, ¬A ⊢ B ∨E with ⊥E in case 1
Double negation intro (DNI) A ⊢ ¬¬A ¬I: assume ¬A, ¬E
Double negation elim (DNE) ¬¬A ⊢ A RAA
Excluded middle (LEM) ⊢ A ∨ ¬A RAA (Example 5)
Contraposition A → B ⊢ ¬B → ¬A →I, ¬I
Reverse contraposition ¬B → ¬A ⊢ A → B classical (RAA)
Explosion A, ¬A ⊢ B ¬E, ⊥E
Commutation A ∧ B ⊢ B ∧ A; A ∨ B ⊢ B ∨ A ∧E, ∧I; ∨E, ∨I
De Morgan 1 ¬(A ∨ B) ⊣⊢ ¬A ∧ ¬B intuitionistically valid
De Morgan 2 ¬A ∨ ¬B ⊢ ¬(A ∧ B) intuitionistically valid
De Morgan 2 (converse) ¬(A ∧ B) ⊢ ¬A ∨ ¬B classical only
Implication to disjunction A → B ⊢ ¬A ∨ B classical only
Disjunction to implication ¬A ∨ B ⊢ A → B intuitionistically valid
Resolution A ∨ B, ¬A ∨ C ⊢ B ∨ C ∨E (nested)
Cut Γ ⊢ A and Γ, A ⊢ B gives Γ ⊢ B plug the first proof in for assumption A
Weakening Γ ⊢ A gives Γ, B ⊢ A extra premises are ignored

2.9.7 The other proof formats, with their complete rule sets#

(Z5.3 showed one example in each format. Here are the rules.)

Format A: Natural deduction in Gentzen's tree style (NJ / NK)#

In tree style an inference rule is drawn as

text
  premise₁   premise₂   ...
  ─────────────────────── rule name
         conclusion

Assumptions appear as leaves; those discharged are bracketed and labelled with a number, which is repeated at the rule that discharges them. Rules (⟨A⟩ means "A may be discharged here"):

text
 A   B               A ∧ B              A ∧ B
 ───── ∧I            ───── ∧E₁          ───── ∧E₂
 A ∧ B                 A                  B

   A                   B               A ∨ B   ⟨A⟩..C   ⟨B⟩..C
 ───── ∨I₁          ───── ∨I₂          ──────────────────────── ∨E
 A ∨ B              A ∨ B                          C

 ⟨A⟩..B             A   A → B           ⟨A⟩..⊥              ⊥
 ─────── →I         ───────── →E        ─────── ¬I          ─── ⊥E
 A → B                  B                 ¬A                 C

 A   ¬A             ⟨¬A⟩..⊥
 ────── ¬E          ─────── RAA (NK only)
   ⊥                   A

Full example: contrapositive in tree style (P → Q ⊢ ¬Q → ¬P)

text
                 [P]¹   P → Q
                 ──────────── →E
     [¬Q]²              Q
     ───────────────────── ¬E
                ⊥
              ─────── ¬I¹
                ¬P
          ────────────── →I²
             ¬Q → ¬P

Gentzen's insight (1934): this tree form displays exactly the dependency structure: what each conclusion rests on.

Format B: Lemmon style (numbered lines with assumption sets)#

Each line has the shape {assumption-line-numbers} (line) formula justification. Rules:

Rule Effect on assumption set
A (assumption) {n} (n) A A: depends only on itself
MPP (modus ponens) union of the assumption sets of the two cited lines
MTT (modus tollens) union of the two cited sets
DN same set as the cited line
CP (conditional proof) from line (m) assumption A, and line (n) B: conclude A → B; set = set of (n) minus m
∧I union of the two sets
∧E same set
∨I same set
∨E from A ∨ B, and subderivations from A to C and B to C: union of the sets, minus the two assumptions
RAA from assumption A deriving B ∧ ¬B (or ⊥): conclude ¬A, set = (set of contradiction line) minus the assumption

Example (contrapositive, Lemmon): P → Q ⊢ ¬Q → ¬P

text
{1}        (1)  P → Q         A
{2}        (2)  ¬Q            A
{3}        (3)  P             A
{1,3}      (4)  Q             1,3 MPP
{1,2,3}    (5)  Q ∧ ¬Q        4,2 ∧I
{1,2}      (6)  ¬P            3,5 RAA
{1}        (7)  ¬Q → ¬P       2,6 CP

The final line depends only on line 1 (the premise): exactly what we expect. A line with an empty assumption set {} is a theorem.

Format C: Hilbert systems (axioms + modus ponens)#

A Hilbert system has many axiom schemes and a very small set of rules (typically just MP). For classical logic with primitives → and ¬ (Łukasiewicz's system):

A derivation from premises Γ is a finite list where every line is an axiom instance, a premise, or follows by MP.

Warm-up: derive A → A (this takes five lines and shows why Hilbert systems are laborious):

text
1. (A → ((A → A) → A)) → ((A → (A → A)) → (A → A))     L2
2. A → ((A → A) → A)                                     L1
3. (A → (A → A)) → (A → A)                               MP 2,1
4. A → (A → A)                                           L1
5. A → A                                                 MP 4,3

Deduction theorem. If Γ, A ⊢ B then Γ ⊢ A → B. Proof idea: take a derivation of B from Γ, A; show by induction on the line number that Γ ⊢ A → (line) holds for every line:

The deduction theorem is precisely the Hilbert-system version of →I. Once it is available, proofs become almost as easy as natural deduction.

Other classical axiomatisations exist (Frege's six axioms; Mendelson's (¬B → ¬A) → ((¬B → A) → B) as third axiom; Hilbert-Ackermann with ∨ and ¬; Meredith's single axiom). All prove the same theorems.

Format D: Sequent calculus (Gentzen's LK; LJ for intuitionistic)#

A sequent Γ ⇒ Δ (Γ and Δ are finite lists or multisets of formulas) is read: "if all formulas of Γ are true, then at least one formula of Δ is true". Equivalently ⋀Γ → ⋁Δ. A derivation is a tree; we usually construct it bottom-up (from the goal sequent, decomposing).

Axioms and logical rules of LK (premises above the bar, conclusion below; Γ, Δ are the "context"):

text
Axiom:   Γ, A ⇒ A, Δ                    (any formula appearing on both sides)
Bottom:  Γ, ⊥ ⇒ Δ                       Top:   Γ ⇒ ⊤, Δ

 Γ, A, B ⇒ Δ                 Γ ⇒ A, Δ    Γ ⇒ B, Δ
 ─────────────── ∧L          ───────────────────── ∧R
 Γ, A ∧ B ⇒ Δ                    Γ ⇒ A ∧ B, Δ

 Γ, A ⇒ Δ    Γ, B ⇒ Δ          Γ ⇒ A, B, Δ
 ───────────────────── ∨L      ───────────── ∨R
   Γ, A ∨ B ⇒ Δ                Γ ⇒ A ∨ B, Δ

 Γ ⇒ A, Δ    Γ, B ⇒ Δ          Γ, A ⇒ B, Δ
 ───────────────────── →L      ───────────── →R
   Γ, A → B ⇒ Δ                Γ ⇒ A → B, Δ

 Γ ⇒ A, Δ                      Γ, A ⇒ Δ
 ─────────── ¬L                ─────────── ¬R
 Γ, ¬A ⇒ Δ                     Γ ⇒ ¬A, Δ

Additional structural rules (hidden when contexts are treated as sets): weakening, contraction, exchange, and cut:

text
 Γ ⇒ A, Δ    Γ, A ⇒ Δ
 ───────────────────── Cut
        Γ ⇒ Δ

Cut is eliminable (Gentzen's Hauptsatz, 1934): every provable sequent has a cut-free proof. Cut-free proofs have the subformula property (every formula in the proof is a subformula of the end sequent), which makes proof search finite and mechanical in propositional logic.

LJ (intuitionistic): the same rules but with at most one formula on the right (Γ ⇒ A or Γ ⇒). That single restriction removes LEM and Peirce.

Example 1 (excluded middle in LK): ⇒ P ∨ ¬P

text
   ───────── Axiom
   P ⇒ P
   ───────── ¬R
   ⇒ P, ¬P
   ────────── ∨R
   ⇒ P ∨ ¬P

In LJ this fails: after ∨R we would have to pick one disjunct (⇒ P or ⇒ ¬P), and neither is provable.

Example 2 (Peirce's law in LK): ⇒ ((P → Q) → P) → P

text
 ───────── Axiom
 P ⇒ Q, P
 ──────────── →R              ───────── Axiom
 ⇒ P → Q, P                   P ⇒ P
 ───────────────────────────────────────── →L
          (P → Q) → P ⇒ P
          ──────────────────── →R
          ⇒ ((P → Q) → P) → P

(Read bottom-up: →R moves the antecedent to the left; →L on (P → Q) → P gives the left premise ⇒ P → Q, P and the right premise P ⇒ P. The left premise is closed by →R and the axiom P ⇒ Q, P. Keeping P on the right of ⇒ while proving P → Q is exactly the classical move that LJ forbids.)

Reading of rules: left rules say how to use a formula (like elimination rules); right rules say how to prove it (like introduction rules). Every sequent-calculus rule removes a connective as you go upward, which is why search is so clean.

Format E: Analytic tableaux (refutation by branching)#

To show Γ ⊨ A, start a tree with Γ ∪ {¬A} at the root and try to derive a contradiction on every branch. Rules (unsigned version). α-rules extend the same branch; β-rules split it into two branches.

Type Formula on the branch Add
α ¬¬A A
α A ∧ B A and B
α ¬(A ∨ B) ¬A and ¬B
α ¬(A → B) A and ¬B
β A ∨ B branch A ∣ branch B
β ¬(A ∧ B) branch ¬A ∣ branch ¬B
β A → B branch ¬A ∣ branch B
β A ↔ B branch A, B ∣ branch ¬A, ¬B
β ¬(A ↔ B) branch A, ¬B ∣ branch ¬A, B

A branch is closed (marked ✗) if it contains some X and ¬X (or ⊥). A tableau is closed if all branches are closed; then Γ ⊨ A. If a branch is open and completed (all rules applied), it describes a countermodel: set every atom appearing as a positive literal to T, every atom appearing negated to F.

Example with a countermodel. Does P ∨ Q ⊨ P ∧ Q? Tableau for {P ∨ Q, ¬(P ∧ Q)}:

text
 P ∨ Q
 ¬(P ∧ Q)
 ├── P                         (from P ∨ Q)
 │   ├── ¬P   ✗  (P and ¬P)    (from ¬(P ∧ Q))
 │   └── ¬Q   open: P = T, Q = F
 └── Q
     ├── ¬P   open: P = F, Q = T
     └── ¬Q   ✗  (Q and ¬Q)

Two open branches, so no: the countermodels are P = T, Q = F and P = F, Q = T.

Format F: Resolution (clausal refutation)#

Work with sets of clauses (Section 1.8.7). The single rule:

text
 C₁ ∪ {L}      C₂ ∪ {¬L}
 ─────────────────────────  Resolution
        C₁ ∪ C₂

(L is a literal; C₁, C₂ are the remaining literals; the resolvent is the union.) A set of clauses is unsatisfiable iff the empty clause {} can be derived. The method is refutation-complete.

Procedure to prove Γ ⊨ A: (1) convert Γ and ¬A to CNF; (2) collect all clauses; (3) apply resolution until {} appears (then entailment holds) or no new clauses can be produced (then there is a countermodel).

Example: P ∨ Q, ¬P ∨ R, ¬Q ∨ R ⊨ R. Negated goal: ¬R.

Step Clauses resolved Resolvent
1 {P, Q}, {¬P, R} on P {Q, R}
2 {Q, R}, {¬R} on R {Q}
3 {Q}, {¬Q, R} on Q {R}
4 {R}, {¬R} on R {}

Empty clause reached. The entailment holds. (This is the same inference pattern as the derived rule "proof by cases" in 2.9.6.)

Comparison of formats: what each makes easy#

Question Best format
"Teach a beginner" Fitch
"Show the exact dependencies" Gentzen tree / Lemmon
"Prove a metatheorem about provability" Hilbert
"Study the structure of proofs; cut elimination" Sequent calculus
"Find a countermodel quickly" Tableau
"Write an automated prover" Resolution, tableau, or sequent search
"Machine-checked, large developments" Proof assistant (Lean, Coq, Isabelle)

2.9.8 Intuitionistic logic and the Curry-Howard correspondence#

The idea#

Classical logic assumes statements are true or false independently of whether we can find out. Intuitionistic (constructive) logic (Brouwer, Heyting) requires that truth means having a construction.

BHK interpretation (Brouwer-Heyting-Kolmogorov): what counts as a proof of each form:

Formula A proof of it is...
A ∧ B a pair: a proof of A and a proof of B
A ∨ B a proof of A or a proof of B, together with a tag saying which
A → B a method that turns any proof of A into a proof of B
⊥ there is no proof of ⊥
¬A a method that turns any proof of A into a proof of ⊥ (i.e. a proof of A → ⊥)
∃x A(x) a witness t together with a proof of A(t)
∀x A(x) a method that, given any t, produces a proof of A(t)

Under BHK, A ∨ ¬A is not a general truth: a proof of it would have to decide A, which is impossible for undecided statements (Goldbach, say).

What is and is not intuitionistically valid#

Valid in both Valid classically only
A → ¬¬A ¬¬A → A
¬¬¬A → ¬A A ∨ ¬A
¬(A ∨ B) ↔ (¬A ∧ ¬B) ¬(A ∧ B) → (¬A ∨ ¬B)
(¬A ∨ B) → (A → B) (A → B) → (¬A ∨ B)
(A → B) → (¬B → ¬A) (¬B → ¬A) → (A → B)
¬¬(A ∨ ¬A) ((A → B) → A) → A (Peirce)
¬(A ∧ ¬A) (A → B) ∨ (B → A)

Glivenko's theorem (1929): for propositional logic, ⊢_classical A if and only if ⊢_intuitionistic ¬¬A. So classical truths are intuitionistic truths "in disguise" as double negations. Gödel-Gentzen negative translation extends this to predicate logic.

Disjunction property. In intuitionistic logic, if ⊢ A ∨ B then ⊢ A or ⊢ B. (Fails classically: ⊢ P ∨ ¬P but neither disjunct is provable.)

Kripke semantics (preview): instead of a single valuation, a set of "stages of knowledge" ordered by growth of information; a formula is true at a stage if we have established it. Truth of A is persistent along growth, ¬A holds when A can never become true.

The Curry-Howard correspondence#

Propositions are types; proofs are programs.

Logic Type theory / programming
proposition A type A
proof of A a program (term) of type A
A ∧ B product (pair) type A × B
A ∨ B sum (tagged union) type A + B / Either A B
A → B function type A → B
⊤ unit type (one value)
⊥ empty type (no values)
¬A A → ⊥ (a function to the empty type)
∀x:T. A(x) dependent function type (Π-type)
∃x:T. A(x) dependent pair type (Σ-type)
→I (discharge) λ-abstraction λx. e
→E (modus ponens) function application f x
∧I / ∧E pair construction (a, b) / projections fst, snd
∨I / ∨E injections inl, inr / case expression
⊥E the empty-case eliminator (absurd)
normalization of proofs evaluation of programs
a proof of A exists the type A is inhabited

Hypothetical syllogism is function composition. The proof of (P → Q) → (Q → R) → (P → R) is the program

text
λ f. λ g. λ x. g (f x)

In Python-like syntax: def hs(f, g): return lambda x: g(f(x)). Each step in the Fitch proof corresponds to a step of the program: the assumption P is the parameter x; →E 1,3 is the call f(x); →E 2,4 is the call g(·); →I 3-5 is the lambda x.

Contraposition: λ f. λ nq. λ p. nq (f p), of type (P → Q) → (¬Q → ¬P).

Excluded middle and double-negation elimination have no such program in general, which is the precise computational content of "not constructively provable". Classical logic corresponds to programs with continuation operators (call/cc; Griffin 1990), a deep and beautiful link.

Why this matters for you: the logic engine you will build (Chapter 8) is a miniature type checker: checking that a proof term has a given type is proof checking. Proof assistants (Lean, Coq, Agda) are built on exactly this.

2.9.9 Metatheory preview: what can be said about all proofs at once#

Property Statement Where proved
Soundness Γ ⊢ A implies Γ ⊨ A induction on proof structure (Chapter 6)
Completeness Γ ⊨ A implies Γ ⊢ A propositional: Post 1921, Kalmár 1935; first-order: Gödel 1929, Henkin 1949 (Chapter 6)
Deduction theorem Γ, A ⊢ B iff Γ ⊢ A → B built in to ND; proved for Hilbert systems
Consistency not both Γ ⊢ A and Γ ⊢ ¬A for any A follows from soundness
Decidability there is an algorithm deciding Γ ⊢ A truth tables, tableaux, DPLL (propositional only)
Normalization / cut-elimination every proof can be transformed into a "direct" one Gentzen 1934; Prawitz 1965
Compactness Γ ⊨ A implies some finite Γ₀ ⊆ Γ has Γ₀ ⊨ A Chapter 6

2.9.10 Quick-check (with answers)#

Q1. In a Fitch proof, can you cite line 4 on line 9 if line 4 is inside a box that closed at line 6? What can you do instead? Q2. Which rule would you use to prove each goal first: (a) P ∧ Q, (b) ¬P, (c) P → Q, (d) P ∨ Q with nothing known, (e) an atom R with no obvious route? Q3. True or false: ∨E requires both cases to conclude the same formula. Q4. What is the difference between a premise and an assumption? Q5. What does the sequent P, Q ⇒ R, S mean? Q6. Which tableau rule branches: A ∧ B, A ∨ B, ¬(A → B), A → B? Q7. Name two classical-only theorems from the table in 2.9.8. Q8. Under Curry-Howard, what is a proof of A → A?

Answers. A1. No: line 4 is out of scope. Use the closing rule of the box (a range citation such as 2-6), or restructure so the needed line is derived outside the box. A2. (a) ∧I; (b) assume P, aim for ⊥, then ¬I; (c) assume P, aim for Q, then →I; (d) RAA (assume ¬(P ∨ Q)); (e) RAA (assume ¬R). A3. True. A4. A premise is given for the whole proof (depth 0, never discharged). An assumption is supposed only temporarily inside a box and is discharged when the box closes. A5. If both P and Q are true, then at least one of R, S is true. A6. A ∨ B and A → B branch (β-rules); A ∧ B and ¬(A → B) do not (α-rules). A7. E.g. ¬¬A → A, A ∨ ¬A, Peirce's law, (A → B) → (¬A ∨ B), ¬(A ∧ B) → ¬A ∨ ¬B. A8. The identity function λx. x.

Problems for Chapter 2#

2.1 ★ P ∧ Q ⊢ Q ∧ P

2.2 ★ P ⊢ ¬¬P

2.3 ★ P → Q, ¬Q ⊢ ¬P (modus tollens)

2.4 ★ ⊢ P → (Q → P)

2.5 ★ P ∨ Q ⊢ Q ∨ P

2.6 ★★ (P ∧ Q) → R ⊢ P → (Q → R) and the converse (exportation)

2.7 ★★ ⊢ (P → (Q → R)) → ((P → Q) → (P → R))

2.8 ★★ (P ∧ Q) ∨ (P ∧ R) ⊢ P ∧ (Q ∨ R) (the converse of Example 7)

2.9 ★★ ⊢ ¬(P ∧ ¬P)

2.10 ★★ ¬P ∨ ¬Q ⊢ ¬(P ∧ Q)

2.11 ★★ ¬P ∨ Q ⊢ P → Q

2.12 ★★ P ↔ Q, Q ↔ R ⊢ P ↔ R

2.13 ★★★ P → Q ⊢ ¬P ∨ Q (classical; the goal is a disjunction with no direct route)

2.14 ★★★ ¬(P ∧ Q) ⊢ ¬P ∨ ¬Q (classical)

2.15 ★★★ ⊢ (P → Q) ∨ (Q → P)

2.16 ★★★ (P → Q) → P ⊢ P

2.17 ★★★ P ∨ Q, ¬P ∨ R ⊢ Q ∨ R (the resolution rule)

2.18 ★★★ (meta) For each of 2.1-2.16, decide whether it is provable without RAA (intuitionistically). Justify your answers by finding where RAA is essential, or by giving an RAA-free proof.


Chapter 3. Predicate logic: language, translation, semantics ↑ Top#

3.1 Why propositional logic is not enough#

Consider the classic argument:

All men are mortal. Socrates is a man. Therefore Socrates is mortal.

In propositional logic the three sentences are three unrelated atoms (p, q, r), and r does not follow from p and q. The validity depends on the internal structure of the sentences: "all", "is a man", "Socrates". Predicate logic (first-order logic, FOL) exposes that structure by adding objects, properties, relations, and quantifiers.

3.2 Syntax#

A signature (vocabulary) consists of:

Terms denote objects. Formulas state things.

text
t ::= x | c | f(t₁, ..., tₙ)                         (variable, constant, function application)

A ::= P(t₁, ..., tₙ) | t₁ = t₂ | ⊥                   (atomic formulas)
    | ¬A | (A ∧ A) | (A ∨ A) | (A → A) | (A ↔ A)
    | ∀x A | ∃x A

Convention for quantifier scope. Textbooks differ. In this course, a quantifier's scope extends as far to the right as the parentheses allow, so ∀x P(x) → Q(x) would mean ∀x (P(x) → Q(x)). To avoid any ambiguity, always write the scope in parentheses.

3.3 Free and bound variables#

An occurrence of x in a formula is bound if it lies inside the scope of a quantifier ∀x or ∃x, and free otherwise. A formula with no free variables is a sentence. Only sentences are true or false in a structure. A formula with free variables is like an open expression ("x > 3"), whose truth depends on what x stands for.

Example. In ∀x (P(x, y) → ∃y Q(y, z)) ∧ R(x):

The same letter can occur free in one place and bound in another, which is why we talk about occurrences.

Substitution and variable capture#

A[t/x] means "replace every free occurrence of x in A by the term t".

The danger is capture: if t contains a variable that becomes bound by a quantifier in A, the meaning changes. For example, let A = ∃y L(x, y) ("x loves someone") and substitute y for x:

We say t is free for x in A when no free occurrence of x in A lies inside the scope of a quantifier that binds a variable of t. Every proof rule that substitutes requires this (or implicitly renames bound variables). Capture-avoiding substitution is also the most common source of bugs in a logic engine (Chapter 8).

3.4 The art of translation#

Translating English into logic is a skill, and it is where most "predicate logic confidence" is won or lost.

The four basic patterns#

English Logic Note
All S are P ∀x (S(x) → P(x)) arrow, not ∧
Some S are P ∃x (S(x) ∧ P(x)) ∧, not arrow
No S is P ∀x (S(x) → ¬P(x)) ≡ ¬∃x (S(x) ∧ P(x))
Not all S are P ∃x (S(x) ∧ ¬P(x)) ≡ ¬∀x (S(x) → P(x))

The two classic errors:

Rule of thumb: ∀ goes with →, ∃ goes with ∧.

More patterns#

English Logic
Only S are P (nothing but S is P) ∀x (P(x) → S(x))
Every S that is P is also Q ∀x ((S(x) ∧ P(x)) → Q(x))
There are at least two P's ∃x ∃y (P(x) ∧ P(y) ∧ x ≠ y)
There is at most one P ∀x ∀y ((P(x) ∧ P(y)) → x = y)
There is exactly one P ∃x (P(x) ∧ ∀y (P(y) → y = x)), written ∃!x P(x)
There are at least three P's ∃x∃y∃z (P(x) ∧ P(y) ∧ P(z) ∧ x≠y ∧ x≠z ∧ y≠z)

(Counting needs equality. "x ≠ y" abbreviates ¬(x = y).)

Quantifier order matters#

Let L(x, y) mean "x loves y".

Sentence Meaning
∀x ∃y L(x, y) Everyone loves someone (each person has their own beloved)
∃y ∀x L(x, y) There is one person whom everybody loves
∀y ∃x L(x, y) Everyone is loved by someone
∃x ∀y L(x, y) Someone loves everybody

The second implies the first, but not conversely. In general: ∃∀ implies ∀∃, never the other way. Same-type quantifiers commute (∀x∀y ≡ ∀y∀x, ∃x∃y ≡ ∃y∃x).

A worked translation#

"Every student likes some teacher" with S, T, L as above:

∀x (S(x) → ∃y (T(y) ∧ L(x, y)))

"Some teacher is liked by every student":

∃y (T(y) ∧ ∀x (S(x) → L(x, y)))

These are not equivalent. The second has one teacher for all students, the first allows a different teacher per student.

Translation checklist#

  1. Decide the domain (what the variables range over) and the signature.
  2. Find the quantifier words ("every", "some", "no", "only", "exactly") and their scope.
  3. Pick ∀→ or ∃∧ for each restricted quantifier.
  4. Read your formula back into English and compare. Then test it on a small example world.

3.5 Semantics: structures and truth#

A structure (model) M = (D, I) consists of:

A variable assignment s maps variables to members of D. Truth is defined by recursion (Tarski):

Formula Satisfied in M under s iff...
P(t₁,...,tₙ) the tuple of values of the tᵢ is in the relation I(P)
t₁ = t₂ the two terms denote the same element
¬A, A ∧ B, A ∨ B, A → B as in propositional logic
∀x A A is satisfied under every modification of s that sets x to some d ∈ D
∃x A A is satisfied under some such modification

For a sentence, the assignment is irrelevant, so we just say M ⊨ A ("A is true in M").

Intuition. ∀x A(x) is a (possibly infinite) conjunction A(d₁) ∧ A(d₂) ∧ ..., and ∃x A(x) is a (possibly infinite) disjunction. In a finite domain this is literally true, so you can evaluate by expanding.

Example. Let D = {1, 2, 3}, and R = {(1,2), (2,3), (3,1)} (a cycle).

Validity, satisfiability, entailment#

Concept Meaning
A is valid (⊨ A) true in every structure (under every assignment)
A is satisfiable true in some structure
Γ ⊨ A every structure making all of Γ true makes A true
A ≡ B A ↔ B is valid

Non-empty domains. Standard FOL requires D ≠ ∅. This is why ∀x P(x) → ∃x P(x) is valid and why the drinker paradox (Example 5 of Section 4.3) is a theorem. Free logics drop this requirement.

Countermodels: how to show something is not valid#

To show A is not valid, exhibit a structure where A is false. To show Γ ⊭ A, exhibit a structure where Γ is true and A is false. Method:

  1. Try a tiny domain first ({1} or {1, 2}).
  2. Define each predicate by listing which elements (or pairs) satisfy it.
  3. Verify by expanding the quantifiers over the domain.

Example. Show (∃x P(x) ∧ ∃x Q(x)) → ∃x (P(x) ∧ Q(x)) is not valid. Take D = {1, 2}, P = {1}, Q = {2}. Then ∃x P(x) is true (x = 1), ∃x Q(x) is true (x = 2), but no element satisfies both, so the consequent is false.

Validity cannot be refuted that way for valid formulas, and, crucially, there is no algorithm that decides validity of arbitrary FOL formulas (Church-Turing, Chapter 6). Some formulas have only infinite models. For example,

∀x ∃y R(x, y) ∧ ∀x ¬R(x, x) ∧ ∀x ∀y ∀z ((R(x, y) ∧ R(y, z)) → R(x, z))

is satisfiable (take ℕ with <), but no finite structure satisfies it (Problem 3.11). So a countermodel search over finite structures can fail even when countermodels exist.

3.6 Quantifier laws#

Negation (De Morgan for quantifiers)#

To negate a long quantified statement, flip every quantifier and negate the matrix. Example, continuity of f at a:

∀ε>0 ∃δ>0 ∀x (|x − a| < δ → |f(x) − f(a)| < ε)

becomes

∃ε>0 ∀δ>0 ∃x (|x − a| < δ ∧ |f(x) − f(a)| ≥ ε)

(using ¬(A → B) ≡ A ∧ ¬B on the last step).

Distribution#

Valid equivalences
∀x (A ∧ B) ≡ ∀x A ∧ ∀x B
∃x (A ∨ B) ≡ ∃x A ∨ ∃x B
Valid implications (one direction only) Converse is not valid
∀x A ∨ ∀x B → ∀x (A ∨ B) ∀x (A ∨ B) → ∀x A ∨ ∀x B (false: D = {1,2}, A = {1}, B = {2})
∃x (A ∧ B) → ∃x A ∧ ∃x B ∃x A ∧ ∃x B → ∃x (A ∧ B)
∀x (A → B) → (∀x A → ∀x B) (∀x A → ∀x B) → ∀x (A → B)
∃x ∀y R → ∀y ∃x R ∀y ∃x R → ∃x ∀y R

Memory aid. ∀ distributes over ∧, ∃ distributes over ∨. The "wrong" pairings fail because a single witness (or a single element) cannot be asked to serve two different properties.

Moving quantifiers across a connective#

If x is not free in B:

(∀x A) ∧ B ≡ ∀x (A ∧ B) (∃x A) ∧ B ≡ ∃x (A ∧ B)
(∀x A) ∨ B ≡ ∀x (A ∨ B) (∃x A) ∨ B ≡ ∃x (A ∨ B)
B → ∀x A ≡ ∀x (B → A) B → ∃x A ≡ ∃x (B → A)
(∀x A) → B ≡ ∃x (A → B) (∃x A) → B ≡ ∀x (A → B)

The last row, where the quantifier flips when it leaves the antecedent, surprises everyone. Reason: "if everything is P then B" is the same as "there is some counterexample to P, or B", i.e., ∃x (P(x) → B).

3.7 Prenex normal form#

A formula is in prenex normal form if all quantifiers come first: Q₁x₁ ... Qₙxₙ M, where M has no quantifiers. Every formula is equivalent to one in prenex form. Procedure:

  1. Eliminate ↔ and →.
  2. Rename bound variables apart so no two quantifiers use the same variable.
  3. Push negations inward (flipping quantifiers).
  4. Pull quantifiers out using the rules of Section 3.6.

Example. (∀x P(x)) → (∃y Q(y)). Using (∀x A) → B ≡ ∃x (A → B): ∃x (P(x) → ∃y Q(y)), then ∃x ∃y (P(x) → Q(y)).

Prenex form is the first step on the way to automated proving (Chapter 7).

3.8 Chapter 3 in complete detail (the from-zero companion)#

Predicate logic is where most people lose confidence, usually because it was introduced as a pile of symbols without the picture behind it. This companion supplies the picture and then builds the formalism slowly: what each symbol is for, what counts as a well-formed expression and what does not, exactly what free and bound mean, how substitution works step by step, how to translate any English sentence, and how truth in a structure is computed.

3.8.1 The picture: objects, properties, relations, functions#

Imagine a world, a collection of things (people, numbers, points, sets...). Call the collection the domain. We want to say things about the things:

We want to say Kind of statement Logical device
"Socrates is a man." a property of one object unary predicate Man(socrates)
"Ann loves Bob." a relation between two objects binary predicate Loves(ann, bob)
"3 is between 2 and 5." a relation among three objects ternary predicate Between(3, 2, 5)
"Bob's father is tall." an object given by another object function father(bob), then Tall(father(bob))
"Everything is self-identical." statement about all objects universal quantifier
"Something is red." statement about at least one object existential quantifier

Propositional logic cannot see inside "Socrates is a man". Predicate logic can: it splits a sentence into names (terms) and what is said about them (predicates), and adds quantifiers to speak about unnamed objects.

First-order means: quantifiers range over objects of the domain only, never over properties or relations. (Quantifying over properties, "for every property P...", is second-order logic; see 3.8.11.)

3.8.2 The ingredients of the language#

A first-order language has these kinds of symbols. Learn the table; everything else is a combination of them.

Category Role Typical letters / examples Arity
Individual variables placeholders for "some object"; can be quantified x, y, z, u, v, w, x₁, x₂, ... n/a
Individual constants fixed names of particular objects a, b, c, d, e; also 0, 1, socrates, ∅, π 0
Function symbols build a new object from objects f, g, h; also +, ·, succ, father, sin n ≥ 1
Predicate (relation) symbols say something true or false of objects P, Q, R, S; also <, ≤, ⊆, Prime, Loves n ≥ 0
Equality = "is the very same object as" = 2
Connectives combine formulas ¬ ∧ ∨ → ↔ (and ⊤ ⊥) 1 or 2
Quantifiers speak about all / some objects ∀, ∃ binds a variable
Punctuation grouping, argument lists ( ) ,

Key points:

The collection of non-logical symbols (constants, function symbols, predicate symbols, each with arity) is the signature (or vocabulary, language) σ. The logical symbols (connectives, quantifiers, =, punctuation, variables) are the same in every language.

Examples of signatures

Subject Constants Functions Predicates
Arithmetic of ℕ 0, 1 +, · (binary), S (unary successor) < (binary) (and =)
Groups e · (binary), ⁻¹ (unary) (only =)
Graphs (none) (none) E (binary edge relation)
Sets (none) (none) ∈ (binary)
People socrates, plato father (unary) Man (unary), Loves (binary)
Ordered fields 0, 1 +, ·, − <

3.8.3 Terms#

Terms are the expressions that denote objects.

Definition.

  1. Every variable is a term.
  2. Every constant is a term.
  3. If f is an n-ary function symbol and t₁, ..., tₙ are terms, then f(t₁, ..., tₙ) is a term.
  4. Nothing else is a term.

Examples (signature: constants 0, 1; functions S (1-ary), + (2-ary); variables x, y):

Expression Term? Notes
x yes variable
0 yes constant
S(0) yes "the successor of 0", i.e. 1
S(S(x)) yes x + 2
+(x, S(y)) yes written x + S(y)
S(0, 1) no wrong arity
+(x) no wrong arity
<(x, y) no (not a term) this is a formula (a predicate application)
S(x < y) no you cannot put a formula inside a term

Ground (closed) terms contain no variables: 0, S(S(0)), +(S(0), S(0)). They denote specific objects once the structure is fixed. Term tree: like formula trees; S(x + y) is a root S whose child is a + node with children x, y.

Term substitution: t[s/x] replaces every x in t by s. Example: (x + S(y))[S(0)/x] = S(0) + S(y). For terms there is no capture problem (no binders).

The Herbrand universe of a language is the set of all ground terms (it matters in Chapter 7).

3.8.4 Formulas#

Atomic formulas are the smallest statements:

  1. P(t₁, ..., tₙ) where P is an n-ary predicate symbol and the tᵢ are terms;
  2. t₁ = t₂ for terms t₁, t₂;
  3. ⊤ and ⊥.

Compound formulas:

  1. if A is a formula, so is ¬A;
  2. if A, B are formulas, so are (A ∧ B), (A ∨ B), (A → B), (A ↔ B);
  3. if A is a formula and x a variable, then ∀x A and ∃x A are formulas.

Nothing else is a formula.

What is NOT a formula (and why). The most useful way to catch errors is to ask: "is this a term (an object) or a formula (a statement)? And is each part used in a place that accepts that kind?"

Expression Problem
P(Q(x)) where P, Q are predicates a predicate application is a formula, but arguments must be terms
f(x) ∧ P(x) f(x) is a term (object), not a statement; ∧ needs formulas
x ∨ y variables are terms, not formulas
P(x) = Q(x) = relates terms; this relates formulas (use ↔)
∀x quantifier with nothing in its scope
∀a P(a) where a is a constant only variables can be quantified
∀P P(a) quantifies a predicate: second-order, not allowed
∃x P(x) → ∀ incomplete
P(x, y) where P is unary wrong arity
1 + 2 a term, not a sentence (says nothing)
1 + 2 = 3 yes, a formula (= between terms)

Formula trees have the same shape as in propositional logic, with two additions: quantifier nodes have one child (the body) and are labelled with the bound variable.

Formula: ∀x (P(x) → ∃y R(x, y))

text
        ∀x
         │
         →
       /   \
    P(x)    ∃y
             │
           R(x,y)

Atomic formulas are the leaves. Main connective of the whole formula: ∀x (so it is a universal statement).

Precedence and scope convention in this course. Negation binds tightest; then ∧, ∨, →, ↔. The scope of a quantifier extends as far right as the parentheses allow. So ∀x P(x) → Q(x) means ∀x (P(x) → Q(x)). Many other books instead make a quantifier bind only the next formula, so the same string means (∀x P(x)) → Q(x): a different statement (with x free in Q(x))! Always write the body of a quantifier in parentheses and you will never be wrong.

3.8.5 Free and bound variables in depth#

The binding structure#

In ∀x A (or ∃x A), the quantifier binds x throughout A, the scope (or body, matrix). The variable x right after the quantifier is the binder. Inside A, occurrences of x are bound (unless captured by an inner quantifier on the same letter); occurrences of other variables are free unless some other quantifier binds them.

Computing free variables (definition by recursion)#

Formula FV(formula)
P(t₁, ..., tₙ) all variables occurring in t₁, ..., tₙ
t₁ = t₂ variables of t₁ and t₂
⊤, ⊥ ∅
¬A FV(A)
A ∧ B, A ∨ B, A → B, A ↔ B FV(A) ∪ FV(B)
∀x A, ∃x A FV(A) \ {x}

Example: FV(∀x (P(x, y) → ∃y Q(y, z)) ∧ R(x)), with the rule that the quantifier scope extends to the closing bracket:

Terminology

Term Meaning
Sentence (closed formula) FV = ∅; has a definite truth value in a structure
Open formula has free variables; like a predicate "x is even"
Universal closure ∀*A prefix ∀ for each free variable: makes a sentence
Existential closure prefix ∃ for each free variable
Free occurrence / bound occurrence refer to positions, not letters
Vacuous quantifier binds a variable not occurring: ∀x P(a) is equivalent to P(a) (given non-empty domain)

Meaning of a formula with free variables. x > 3 is neither true nor false until x is given a value; its truth depends on an assignment (3.8.8). In a proof, a free variable is a placeholder for an arbitrary object.

Renaming bound variables (α-conversion)#

The name of a bound variable carries no information: ∀x P(x) and ∀y P(y) say the same. Two formulas that differ only by a consistent renaming of bound variables are α-equivalent and are considered identical. Rules for renaming ∀x A to ∀z A[z/x]:

  1. z must not occur free in A (otherwise it would be captured).
  2. Replace the binder and every free occurrence of x in A.

Example: ∀x ∃y L(x, y) ≡α ∀u ∃v L(u, v), but not ≡α ∀y ∃y L(y, y) (that merges two different variables into one).

Standardizing apart: rename bound variables so all binders in a formula use different letters and none coincide with a free variable. Do this before pulling quantifiers (prenex), before substituting, and before writing a program.

Substitution A[t/x]: definition by recursion#

A[t/x] is "A with every free occurrence of x replaced by the term t, with renaming of bound variables where needed to avoid capture".

Case Result
P(t₁, ..., tₙ) P(t₁[t/x], ..., tₙ[t/x])
¬A ¬(A[t/x])
A ∘ B A[t/x] ∘ B[t/x]
(∀x A) ∀x A (x is not free here: nothing to do); same for ∃x
(∀y A), y ≠ x, and (y ∉ FV(t) or x ∉ FV(A)) ∀y (A[t/x])
(∀y A), y ≠ x, y ∈ FV(t) and x ∈ FV(A) pick fresh z; ∀z (A[z/y][t/x])

Same for ∃.

Worked example 1 (no capture): (∀y R(x, y))[c/x] = ∀y R(c, y).

Worked example 2 (capture, so rename): (∃y L(x, y))[y/x]. y ∈ FV(t) = {y} and x ∈ FV(L(x,y)), so rename the bound y to a fresh z: ∃z L(x, z); then substitute: ∃z L(y, z). Meaning: "y loves someone". The naive result ∃y L(y, y) ("someone loves themselves") is wrong.

Worked example 3 (term with function): (∀y (R(x, y) → ∃x S(x, y)))[f(y)/x].

Worked example 4 (term substitution into an atomic formula): (P(x, g(x, y)))[h(a)/x] = P(h(a), g(h(a), y)).

t is free for x in A means: substituting t for x in A needs no renaming, i.e. no free x of A lies in the scope of a quantifier binding a variable of t. Proof rules (Chapter 4) often state this as a side condition.

Notation reminder (Z4.7): substitution is written many ways: A[t/x], A(t/x), A[x := t], A[x ↦ t]. Check the author's convention; some write [x/t] with the opposite order.

3.8.6 Quantifiers in depth, and the English-to-logic dictionary#

What ∀ and ∃ really say#

Consequences, all worth memorizing:

  1. Vacuous truth of ∀ over an empty set. ∀x (Unicorn(x) → Rides(x)) is true if there are no unicorns.
  2. ∃ never holds vacuously: ∃x (Unicorn(x) ∧ Rides(x)) requires a real unicorn.
  3. Restricted quantifiers: to say "all S are P" you quantify over the whole domain and restrict with a condition: ∀x (S(x) → P(x)). To say "some S is P": ∃x (S(x) ∧ P(x)). Here is why: ∀x (S(x) ∧ P(x)) would say everything is an S, ∃x (S(x) → P(x)) is true whenever anything is not an S (a false antecedent makes the implication true).
  4. Quantifier alternation = dependence. In ∀x ∃y A(x, y) the y may depend on x; in ∃y ∀x A(x, y) the y is chosen first and must work for all x ("Skolem functions" in Chapter 7 make this explicit: ∀x A(x, f(x)) versus ∀x A(x, c)).

The big dictionary#

Let S, P, Q be unary predicates, a a constant. (Choose the domain "everything" and use S(x) to restrict, or use a sorted domain; see below.)

English Formula
Everything is P ∀x P(x)
Something is P ∃x P(x)
Nothing is P ∀x ¬P(x) ≡ ¬∃x P(x)
Not everything is P ¬∀x P(x) ≡ ∃x ¬P(x)
All S are P; every S is P; each S is P; any S is P ∀x (S(x) → P(x))
Some S is P; at least one S is P; there is an S which is P; an S is P (specific) ∃x (S(x) ∧ P(x))
No S is P; not a single S is P; there is no S that is P ∀x (S(x) → ¬P(x)) ≡ ¬∃x (S(x) ∧ P(x))
Not every S is P; some S is not P ∃x (S(x) ∧ ¬P(x))
All S are not P (usually meaning "no S is P") ∀x (S(x) → ¬P(x))
Only S are P; nothing but S is P; P only if S ∀x (P(x) → S(x))
All and only S are P ∀x (P(x) ↔ S(x))
Every S that is P is Q ∀x ((S(x) ∧ P(x)) → Q(x))
Every S is P or Q ∀x (S(x) → (P(x) ∨ Q(x)))
Every S except a is P ∀x ((S(x) ∧ x ≠ a) → P(x))
All S other than a are P and a is not ∀x ((S(x) ∧ x ≠ a) → P(x)) ∧ ¬P(a)
There are at least two P's ∃x ∃y (P(x) ∧ P(y) ∧ x ≠ y)
There is at most one P ∀x ∀y ((P(x) ∧ P(y)) → x = y)
There is exactly one P ∃x (P(x) ∧ ∀y (P(y) → y = x)), or ∃!x P(x)
There are exactly two P's ∃x ∃y (P(x) ∧ P(y) ∧ x ≠ y ∧ ∀z (P(z) → (z = x ∨ z = y)))
There are at most n S's ∀x₁ … ∀xₙ₊₁ ((S(x₁) ∧ … ∧ S(xₙ₊₁)) → ⋁_{i<j} xᵢ = xⱼ) (among any n+1 S's, two coincide)
The S is P (Russell) ∃x (S(x) ∧ ∀y (S(y) → y = x) ∧ P(x))
a is the only S S(a) ∧ ∀x (S(x) → x = a)
The set of S's has a largest uses an order relation ≤ (see below)

Ambiguities of English#

English Readings
"A dog is a mammal" generic: ∀x (Dog(x) → Mammal(x))
"A dog is barking outside" specific: ∃x (Dog(x) ∧ Barking(x))
"Any" "any S is P" is universal; "if any S is P" is existential in the antecedent: ∃x(S∧P) → R
"If anyone is at home, the light is on" ∃x H(x) → L, equivalent to ∀x (H(x) → L) (the quantifier flip of Section 3.6)
"Every farmer who owns a donkey beats it" (donkey sentence) ∀x ∀y ((F(x) ∧ D(y) ∧ O(x, y)) → B(x, y)) (note ∀ for "a donkey")
"Everybody loves somebody" ∀x ∃y L(x, y) (usual); ∃y ∀x L(x, y) is a strained reading
"Not all that glitters is gold" ¬∀x (G(x) → Au(x)) ≡ ∃x (G(x) ∧ ¬Au(x))
"All that glitters is not gold" ambiguous, avoid
"Most S are P", "few", "many", "more than half" not expressible in first-order logic (needs generalized quantifiers)
"Finitely many", "infinitely many" not expressible by a single FO sentence in general (compactness, Chapter 6)
"Every even number > 2 is a sum of two primes" a first-order sentence over arithmetic (Goldbach), 3.8.7

Definite descriptions (Russell)#

"The present king of France is bald" is analyzed (Russell, 1905) as three claims: there is a king, there is at most one, and he is bald:

∃x (K(x) ∧ ∀y (K(y) → y = x) ∧ B(x)).

False if there is no king. Its negation depends on scope: ¬∃x(K(x) ∧ ∀y(K(y) → y=x) ∧ B(x)) ("it is not true that the king is bald", true when there is no king) versus ∃x(K(x) ∧ ∀y(K(y) → y=x) ∧ ¬B(x)) ("the king is non-bald", false when there is no king). This resolves a classical puzzle about the law of excluded middle.

Many-sorted domains and relativization#

If your domain contains several kinds of things (people and numbers, points and lines), you can:

Both are the same logic; the relativization translation is mechanical, and it is exactly the "∀ with →, ∃ with ∧" pattern.

3.8.7 Translation workshop#

Method (always follow it).

  1. Fix the domain and the signature; write the dictionary of symbols.
  2. Find the quantifier words; decide each one's restrictor and scope.
  3. Build the formula from the outside in (main connective first).
  4. Read back into English, then test on a small world.

Example 1. Domain: people. Student(x), Teacher(x), Likes(x, y). "Every student likes some teacher." Outer: all students: ∀x (Student(x) → …). Inner: some teacher whom x likes: ∃y (Teacher(y) ∧ Likes(x, y)). ∀x (Student(x) → ∃y (Teacher(y) ∧ Likes(x, y))).

Example 2. "There is a teacher whom every student likes." ∃y (Teacher(y) ∧ ∀x (Student(x) → Likes(x, y))). Compare with Example 1: the order of the quantifiers changed the meaning.

Example 3. "No student likes every teacher." Negate "some student likes every teacher": ¬∃x (Student(x) ∧ ∀y (Teacher(y) → Likes(x, y))). Equivalent: ∀x (Student(x) → ∃y (Teacher(y) ∧ ¬Likes(x, y))).

Example 4. "Everyone loves someone who loves them back." Domain: people. ∀x ∃y (Loves(x, y) ∧ Loves(y, x)).

Example 5. "If someone is a thief, then someone is arrested." ∃x Thief(x) → ∃y Arrested(y).

Example 6. Mathematics. Signature {0, 1, +, ·, <}, domain ℕ.

Statement Formula
x is even ∃y (x = y + y)
x divides y (x ∣ y) ∃z (y = x · z)
x is prime x > 1 ∧ ∀y ∀z (x = y · z → (y = 1 ∨ z = 1))
there are infinitely many primes ∀n ∃p (p > n ∧ Prime(p))
every number has a successor ∀x ∃y (y = x + 1)
there is a least element ∃x ∀y (x ≤ y)
no largest element ∀x ∃y (x < y)
Goldbach ∀x ((Even(x) ∧ x > 2) → ∃p ∃q (Prime(p) ∧ Prime(q) ∧ x = p + q))

Here x > 1, x ≤ y are abbreviations (≤ as x < y ∨ x = y), Even, Prime abbreviations for the formulas above.

Example 7. Functions. Signature: a function symbol f, equality, domain arbitrary.

Statement Formula
f is injective (one-to-one) ∀x ∀y (f(x) = f(y) → x = y)
f is surjective (onto) ∀y ∃x (f(x) = y)
f is constant ∃c ∀x (f(x) = c)
f has a fixed point ∃x (f(x) = x)
f is idempotent ∀x (f(f(x)) = f(x))

Example 8. Relations (binary R):

Property Formula
reflexive ∀x R(x, x)
irreflexive ∀x ¬R(x, x)
symmetric ∀x ∀y (R(x, y) → R(y, x))
antisymmetric ∀x ∀y ((R(x, y) ∧ R(y, x)) → x = y)
transitive ∀x ∀y ∀z ((R(x, y) ∧ R(y, z)) → R(x, z))
total (connected) ∀x ∀y (R(x, y) ∨ R(y, x))
serial (every element has a successor) ∀x ∃y R(x, y)
functional ∀x ∀y ∀z ((R(x, y) ∧ R(x, z)) → y = z)
dense ∀x ∀y (R(x, y) → ∃z (R(x, z) ∧ R(z, y)))

Example 9. Analysis (ε-δ), Section 3.6. Using order and absolute value as symbols, "f is continuous at a": ∀ε (ε > 0 → ∃δ (δ > 0 ∧ ∀x (|x − a| < δ → |f(x) − f(a)| < ε))). The pattern of nested restricted quantifiers is ∀ε>0 = ∀ε (ε > 0 → …), ∃δ>0 = ∃δ (δ > 0 ∧ …).

Example 10. Sets. Predicate ∈. "A ⊆ B": ∀x (x ∈ A → x ∈ B). "A = B" (extensionality): ∀x (x ∈ A ↔ x ∈ B). "∅" characterized by ∀x ¬(x ∈ ∅). "x is in the union of A and B": x ∈ A ∨ x ∈ B.

Common translation errors

Error Why wrong
∀x (S(x) ∧ P(x)) for "all S are P" says everything is an S
∃x (S(x) → P(x)) for "some S is P" true if anything is not S
¬∀x P(x) read as "no x is P" that is ∀x ¬P(x)
using one variable twice in nested quantifiers by accident: ∀x (S(x) → ∃x P(x)) inner x shadows the outer x
leaving a free variable in what should be a sentence the statement is then not yet true or false
mixing up ∀x∃y and ∃y∀x dependence changes
translating "only S are P" as ∀x (S(x) → P(x)) direction reversed

3.8.8 Semantics in complete detail#

Structures#

A structure (model, interpretation) M for a signature σ consists of:

  1. a non-empty set D (also written |M|, dom(M), M's domain or universe);
  2. for each constant c: an element c^M ∈ D;
  3. for each n-ary function symbol f: a function f^M : Dⁿ → D;
  4. for each n-ary predicate symbol P: a set of n-tuples P^M ⊆ Dⁿ (the tuples for which P holds).

(For = we always use true identity on D.)

Example. Signature {a, f, P, R} (constant, unary function, unary predicate, binary predicate). Structure M: D = {1, 2, 3}; a^M = 1; f^M(1) = 2, f^M(2) = 3, f^M(3) = 3; P^M = {1, 2}; R^M = {(1,2), (2,3), (3,3)}.

Many different structures can interpret the same symbols; the same sentence may be true in one and false in another. Truth is always truth in a structure.

Assignments#

An assignment s assigns an element of D to each variable. We write s[x ↦ d] for the assignment that agrees with s except that x goes to d.

Value of a term ⟦t⟧^M_s:

In the structure above with s(x) = 2: ⟦f(f(x))⟧ = f^M(f^M(2)) = f^M(3) = 3.

Satisfaction (Tarski's definition)#

M, s ⊨ A ("A is satisfied in M under s") is defined by recursion:

Formula M, s ⊨ it iff
P(t₁, …, tₙ) (⟦t₁⟧, …, ⟦tₙ⟧) ∈ P^M
t₁ = t₂ ⟦t₁⟧ = ⟦t₂⟧
⊤ / ⊥ always / never
¬A not M, s ⊨ A
A ∧ B both
A ∨ B at least one
A → B not M, s ⊨ A, or M, s ⊨ B
A ↔ B both or neither
∀x A for every d ∈ D: M, s[x ↦ d] ⊨ A
∃x A for some d ∈ D: M, s[x ↦ d] ⊨ A

For a sentence the assignment is irrelevant and we write M ⊨ A ("A is true in M", "M is a model of A"). For a set of sentences Γ: M ⊨ Γ if M ⊨ A for every A ∈ Γ.

Coincidence lemma. The truth of A under s depends only on the values of s on FV(A).

Fully worked evaluation#

Structure M: D = {1, 2, 3}, P^M = {1, 2}, R^M = {(1,2), (2,3), (3,3)}.

(i) ∀x (P(x) → ∃y R(x, y)). For each d ∈ D:

x P(x)? ∃y R(x, y)? (witness) P(x) → ∃y R(x,y)
1 T T (y = 2) T
2 T T (y = 3) T
3 F T (y = 3) T (antecedent false)

All three T, so the sentence is true in M.

(ii) ∃y ∀x R(x, y). Try each y:

y ∀x R(x, y)? counter-x
1 F x = 1 (R(1,1) ∉ R)
2 F x = 2 (R(2,2) ∉ R)
3 F R(1,3) ∉ R: x = 1

No y works, so the sentence is false in M.

(iii) ∀x ∃y R(x, y): x = 1 → y = 2; x = 2 → y = 3; x = 3 → y = 3. True. Together with (ii) this shows ∀x ∃y R ⊭ ∃y ∀x R: M is a countermodel.

(iv) ∀x R(x, x): false (x = 1 fails). (v) ∃x R(x, x): true (x = 3).

The expansion trick (finite domains): replace ∀x A(x) by A(1) ∧ A(2) ∧ A(3) and ∃x A(x) by A(1) ∨ A(2) ∨ A(3); you get a propositional formula over atoms P(1), R(1,2), ….

Kinds of sentences and relations#

Concept Definition
Valid (logically true) ⊨ A true in every structure
Satisfiable true in some structure
Contradictory true in no structure
Contingent true in some, false in others
Γ ⊨ A every structure that makes all of Γ true makes A true
A ≡ B A ↔ B valid
Model of a theory a structure making every axiom true
Elementary equivalence M ≡ N M and N satisfy the same sentences
Isomorphism M ≅ N a bijection preserving all symbols; isomorphic structures satisfy the same sentences

Validity is much harder than in propositional logic: there are infinitely many structures of every infinite size; no truth table exists. Methods: proof (Chapter 4), countermodel search, tableaux/resolution (Chapter 7). By the Church-Turing theorem, validity of first-order sentences is undecidable (but semi-decidable).

Standard theories as lists of sentences#

Theory Signature Axioms (sentences) A model
Equivalence relation R ∀x R(x,x); ∀x∀y(R(x,y)→R(y,x)); ∀x∀y∀z(R(x,y)∧R(y,z)→R(x,z)) = on any set; "same remainder mod 5" on ℤ
Strict partial order < ∀x ¬(x<x); ∀x∀y∀z(x<y∧y<z→x<z) < on ℕ; ⊊ on sets
Group e, ·, ⁻¹ ∀x∀y∀z (x·y)·z = x·(y·z); ∀x x·e = x; ∀x e·x = x; ∀x x·x⁻¹ = e; ∀x x⁻¹·x = e (ℤ, 0, +, −); nonzero reals under ×; symmetries of a triangle
Graph (simple) E ∀x ¬E(x,x); ∀x∀y(E(x,y)→E(y,x)) a triangle: D={1,2,3}, all pairs of distinct elements
Dense linear order without endpoints < strict total order, ∀x∀y(x<y→∃z(x<z∧z<y)), ∀x∃y(x<y), ∀x∃y(y<x) (ℚ, <); also (ℝ, <)
Peano arithmetic (PA) 0, S, +, · ∀x S(x)≠0; ∀x∀y (S(x)=S(y)→x=y); x+0=x; x+S(y)=S(x+y); x·0=0; x·S(y)=x·y+x; induction schema for every formula A(x) ℕ (standard); nonstandard models exist (Chapter 6)

Which properties can first-order sentences express?#

3.8.9 Equality in detail#

= is a logical symbol: in every structure it means true identity. Principles ("laws of identity"):

Law Statement
Reflexivity ∀x x = x
Symmetry ∀x∀y (x = y → y = x)
Transitivity ∀x∀y∀z ((x = y ∧ y = z) → x = z)
Substitutivity (Leibniz) x = y → (A(x) → A(y)) for every formula A
Congruence for functions x = y → f(x) = f(y)

≠ abbreviates ¬(… = …). Equality is what lets first-order logic count ("at least/at most/exactly n") and define uniqueness (∃!). Without =, the sentence ∃x ∃y (P(x) ∧ P(y)) is satisfied by a structure with one P-element (take x = y), so it cannot enforce "two different objects".

Identity vs equivalence: = says the same object; an equivalence relation like "same height" is a different, user-defined predicate. Do not confuse x = y (identity) with A(x) ↔ A(y) (indiscernibility for a given formula).

3.8.10 From formulas to Skolem form (preview)#

A formula like ∀x ∃y R(x, y) asserts that for each x there is a y. We can name the dependency: introduce a Skolem function f and write ∀x R(x, f(x)). This preserves satisfiability (but not equivalence) and removes ∃ altogether; it is the key step for automation (Chapter 7). Example:

∃x ∀y ∃z R(x, y, z) becomes ∀y R(c, y, g(y)) with c a new constant and g a new unary function. A witness chosen before y is a constant; a witness chosen after y is a function of y.

3.8.11 First-order logic among other logics#

Logic Difference from first-order Consequences
Propositional no objects, no quantifiers decidable (SAT, coNP-complete)
First-order (FOL) quantify over objects complete (Gödel), compact, undecidable
Many-sorted FOL several domains/sorts reducible to one-sorted FOL
Second-order quantify over sets/relations: ∀X ∃x X(x) can express "finite", "well-ordering"; no complete proof system (with standard semantics); no compactness
Higher-order, type theory quantify over functions of functions Lean, Coq; Church's simple type theory
Modal operators □, ◇, Kripke worlds propositional modal logics are mostly decidable
Free logic allows empty domain or non-denoting terms ∀xP(x) → ∃xP(x) fails
Infinitary infinite conjunctions L_{ω₁ω} can express "finite"

3.8.12 Quick-check (with answers)#

Q1. Classify each as term, formula, or neither: (a) f(a), (b) P(f(a)), (c) f(P(a)), (d) ∀x (x + 0 = x), (e) ∀x + 1. Q2. Compute FV of ∃y (R(x, y) ∧ ∀x S(x, z)). Q3. Compute (∀y R(x, y))[y/x] with renaming. Q4. Translate: (a) "Every dog barks." (b) "Some dog does not bark." (c) "Only dogs bark." (d) "There is exactly one dog." Use D, B. Q5. In the structure D = {1, 2}, R^M = {(1,1), (1,2)}, evaluate ∃x ∀y R(x, y) and ∀x ∃y R(y, x). Q6. Why is ∃x (S(x) → P(x)) a poor translation of "some S is P"? Q7. Translate "the only even prime is 2" using Even, Prime, constant 2.

Answers. A1. (a) term; (b) formula; (c) neither (a formula inside a term); (d) formula (a sentence); (e) neither (incomplete). A2. FV(R(x,y) ∧ ∀x S(x,z)) = {x, y} ∪ ({x, z} \ {x}) = {x, y, z}; remove y for ∃y: {x, z}. (The x in R(x, y) is free; the x in S(x, z) is bound.) A3. y ∈ FV(y) and x is free in the body: rename the bound y to z: ∀z R(x, z), then substitute: ∀z R(y, z). A4. (a) ∀x (D(x) → B(x)); (b) ∃x (D(x) ∧ ¬B(x)); (c) ∀x (B(x) → D(x)); (d) ∃x (D(x) ∧ ∀y (D(y) → y = x)). A5. ∃x ∀y R(x, y): x = 1: R(1,1) and R(1,2) both hold. True. ∀x ∃y R(y, x): x = 1: y = 1 works. x = 2: y = 1 works (R(1,2)). True. A6. It is true as soon as anything is not an S (false antecedent), so it asserts almost nothing. A7. Even(2) ∧ Prime(2) ∧ ∀x ((Even(x) ∧ Prime(x)) → x = 2).

Problems for Chapter 3#

3.1 ★ Translate with S(x) = "x is a student", T(x) = "x is a teacher", L(x, y) = "x likes y":

3.2 ★ In ∀x (P(x, y) → ∃y Q(y, z)) ∧ R(x) list all free and bound occurrences (variable and position).

3.3 ★ Compute (a) (∃y L(x, y))[y/x] with proper renaming; (b) (∀x P(x, y))[f(z)/y]; (c) (∀x P(x, y))[f(x)/y].

3.4 ★★ Translate into FOL with the signature {0, 1, +, ·, <} over the natural numbers:

3.5 ★★ Negate and simplify so that ¬ appears only in front of atoms:

3.6 ★★ Express in FOL with equality: "at least 3 elements", "exactly 2 elements", "at most 2 elements".

3.7 ★★ For each, prove valid or give a countermodel (small finite structure):

3.8 ★★ Evaluate in the structure D = {1,2,3,4}, R(x,y) ⇔ x < y:

3.9 ★★ Convert to prenex normal form:

3.10 ★★ Is ∀x ∃y R(x, y) ∧ ∀x ∀y (R(x,y) → R(y,x)) satisfiable in a finite structure? In a one-element structure? Describe all models with exactly two elements.

3.11 ★★★ Show that the sentence ∀x ∃y R(x, y) ∧ ∀x ¬R(x, x) ∧ ∀x∀y∀z ((R(x,y) ∧ R(y,z)) → R(x,z)) has no finite model but does have an infinite one. (Hint: in a finite model, follow a chain x₀ R x₁ R x₂ ... and use pigeonhole plus transitivity and irreflexivity.)

3.12 ★★★ Prove carefully, using the semantic definition (no tricks), that ∃x ∀y R(x, y) ⊨ ∀y ∃x R(x, y), and explain exactly where the argument breaks for the converse.


Chapter 4. Natural deduction for predicate logic ↑ Top#

4.1 The four quantifier rules#

We keep all propositional rules and add rules for ∀, ∃ (and later =). Each follows the same intro/elim pattern.

Rule Form Informal meaning Side condition
∀E from ∀x A, infer A[t/x] "It holds for everything, so it holds for t" t is a term, free for x in A
∃I from A[t/x], infer ∃x A "t is an example, so something has the property" t is free for x in A
∀I open a sub-proof introducing a fresh name a (with no assumption about it), derive A[a/x], infer ∀x A "Let a be arbitrary... so it holds for all" a is fresh (see below)
∃E from ∃x A and a sub-proof that assumes A[a/x] for a fresh name a and reaches C, infer C "Let a be such an object... then C" a is fresh, and C does not contain a

The first two are easy (just instantiate or generalize with an explicit term). The last two are where proofs are won and lost, because they have conditions on names.

Format in Fitch notation for the name-introducing sub-proofs:

text
|  [a]                 (∀I: a is a fresh name, no assumption)
|  ...
|  A(a)
∀x A(x)                ∀I

∃x A(x)
|  [a]  A(a)           (∃E: fresh a with assumption A(a))
|  ...
|  C
C                      ∃E

4.2 What "fresh" means, and why it matters#

A name a is fresh in a rule if it does not occur in any premise, in any currently open assumption, in the formula ∀x A / ∃x A being used, or (for ∃E) in the conclusion C. In short: you know nothing about a except what the rule gives you.

Why this is necessary, and what goes wrong without it:

The side conditions are exactly what makes ∃∀ ⊢ ∀∃ provable and ∀∃ ⊬ ∃∀. They are the proof-theoretic shadow of quantifier order.

4.3 Worked examples#

Example 1. ∀x (P(x) → Q(x)), ∀x P(x) ⊢ ∀x Q(x)#

Goal is universal, so introduce an arbitrary a.

text
1.  ∀x (P(x) → Q(x))   premise
2.  ∀x P(x)            premise
3.  |  [a]                       (fresh a)
4.  |  P(a) → Q(a)      ∀E 1
5.  |  P(a)             ∀E 2
6.  |  Q(a)             →E 4,5
7.  ∀x Q(x)            ∀I 3-6

In words: "Let a be arbitrary. Since all P's are Q's, P(a) → Q(a). Since everything is P, P(a). So Q(a). As a was arbitrary, everything is Q."

Example 2. ∀x (P(x) → Q(x)), ∃x P(x) ⊢ ∃x Q(x)#

We use an existential, so introduce a witness.

text
1.  ∀x (P(x) → Q(x))   premise
2.  ∃x P(x)            premise
3.  |  [a]  P(a)        assumption (∃E)
4.  |  P(a) → Q(a)      ∀E 1
5.  |  Q(a)             →E 4,3
6.  |  ∃x Q(x)          ∃I 5
7.  ∃x Q(x)            ∃E 2, 3-6

Check the side condition: the conclusion ∃x Q(x) does not contain a. ✔

Example 3. ∃x ∀y R(x, y) ⊢ ∀y ∃x R(x, y)#

Goal is universal: introduce arbitrary b. Then use the premise by naming its witness a.

text
1.  ∃x ∀y R(x, y)      premise
2.  |  [b]                        (fresh b, for ∀I)
3.  |  |  [a]  ∀y R(a, y)        assumption (∃E; a fresh, a ≠ b)
4.  |  |  R(a, b)                ∀E 3
5.  |  |  ∃x R(x, b)             ∃I 4
6.  |  ∃x R(x, b)               ∃E 1, 3-5
7.  ∀y ∃x R(x, y)      ∀I 2-6

Order of introduction matters: b is introduced first, and a is introduced inside b's scope. The ∃E conclusion ∃x R(x, b) mentions b but not a. ✔

Example 4. ¬∀x P(x) ⊢ ∃x ¬P(x) (classical)#

The goal ∃x ¬P(x) cannot be built directly (we have no witness), so use RAA.

text
1.  ¬∀x P(x)           premise
2.  |  ¬∃x ¬P(x)        assumption (for RAA)
3.  |  |  [a]
4.  |  |  |  ¬P(a)       assumption (for RAA)
5.  |  |  |  ∃x ¬P(x)    ∃I 4
6.  |  |  |  ⊥           ¬E 5,2
7.  |  |  P(a)           RAA 4-6
8.  |  ∀x P(x)           ∀I 3-7
9.  |  ⊥                 ¬E 8,1
10. ∃x ¬P(x)            RAA 2-9

The other three quantifier-negation laws are easier; do them as Problems 4.6-4.8.

Example 5. The Drinker Paradox: ⊢ ∃x (D(x) → ∀y D(y))#

"In any non-empty pub there is someone such that, if they are drinking, then everybody is drinking."

Informal proof first (always find the idea before formalizing):

Case 1: everybody drinks. Then pick anyone; the implication holds because its consequent is true. Case 2: not everybody drinks. Then somebody is not drinking; pick that person. The implication holds because its antecedent is false.

Case 1 uses non-emptiness of the domain (we need someone to pick). The case split is on a statement and its negation, which is excluded middle, so this proof is classical.

Formal proof (via RAA, with the case analysis folded in):

text
1.  |  ¬∃x (D(x) → ∀y D(y))              assumption (for RAA)
2.  |  |  [b]
3.  |  |  |  ¬D(b)                       assumption (for RAA)
4.  |  |  |  |  D(b)                     assumption
5.  |  |  |  |  ⊥                        ¬E 4,3
6.  |  |  |  |  ∀y D(y)                  ⊥E 5
7.  |  |  |  D(b) → ∀y D(y)              →I 4-6
8.  |  |  |  ∃x (D(x) → ∀y D(y))         ∃I 7
9.  |  |  |  ⊥                           ¬E 8,1
10. |  |  D(b)                           RAA 3-9
11. |  ∀y D(y)                           ∀I 2-10
12. |  |  D(c)                           assumption  (c: any name; domain is non-empty)
13. |  |  ∀y D(y)                        reiteration of 11
14. |  D(c) → ∀y D(y)                    →I 12-13
15. |  ∃x (D(x) → ∀y D(y))               ∃I 14
16. |  ⊥                                 ¬E 15,1
17. ∃x (D(x) → ∀y D(y))                  RAA 1-16

Lines 2-11 show that the negated goal forces everyone to be a drinker (if some b weren't, b would be the witness). Lines 12-15 then use any name c to produce the witness, which is the place where the non-empty domain assumption is used. Using a name without a prior introduction is legitimate precisely because domains are non-empty.

Example 6. Russell's barber: ⊢ ¬∃x ∀y (R(x, y) ↔ ¬R(y, y))#

R(x, y): "x shaves y". There is no barber who shaves exactly those who do not shave themselves. (This is the logical core of Russell's paradox and of Cantor's theorem.)

text
1.  |  ∃x ∀y (R(x, y) ↔ ¬R(y, y))       assumption (for ¬I)
2.  |  |  [a]  ∀y (R(a, y) ↔ ¬R(y, y))  assumption (∃E)
3.  |  |  R(a, a) ↔ ¬R(a, a)            ∀E 2
4.  |  |  |  R(a, a)                    assumption
5.  |  |  |  ¬R(a, a)                   ↔E 3,4
6.  |  |  |  ⊥                          ¬E 4,5
7.  |  |  ¬R(a, a)                      ¬I 4-6
8.  |  |  R(a, a)                       ↔E 3,7
9.  |  |  ⊥                             ¬E 8,7
10. |  ⊥                                ∃E 1, 2-9
11. ¬∃x ∀y (R(x, y) ↔ ¬R(y, y))         ¬I 1-10

The magic is line 3: plug the barber into his own definition (y := a). No sophisticated idea is needed; the "paradox" is just the observation that P ↔ ¬P is contradictory.

Example 7. Socrates: ∀x (Man(x) → Mortal(x)), Man(s) ⊢ Mortal(s)#

text
1.  ∀x (Man(x) → Mortal(x))   premise
2.  Man(s)                    premise
3.  Man(s) → Mortal(s)        ∀E 1   (instantiate with the constant s)
4.  Mortal(s)                 →E 3,2

4.4 Equality#

Two extra rules:

Rule Form
=I infer t = t (no premises)
=E from s = t and A[s/x], infer A[t/x] (substitute equals for equals)

Derived: symmetry. s = t ⊢ t = s. Take A(x) to be "x = s":

text
1.  s = t              premise
2.  s = s              =I
3.  t = s              =E 1,2   (replace s by t in the first position of line 2, A(x) := x = s)

Derived: transitivity. s = t, t = u ⊢ s = u. Take A(x) := "s = x":

text
1.  s = t              premise
2.  t = u              premise
3.  s = u              =E 2,1   (A(x) := s = x; from t = u and s = t get s = u)

4.5 Proof strategy for quantifiers#

Extend the table from Chapter 2:

Goal Move
∀x A(x) Introduce arbitrary a (box), prove A(a), apply ∀I
∃x A(x) Find a witness term t, prove A(t), apply ∃I. If no witness is evident, use RAA.
Available line Move
∀x A(x) Instantiate (∀E) with every term that could help: usually the names already in your proof
∃x A(x) Name a witness (∃E): start a sub-proof with A(a) for fresh a, reach your goal (which must not mention a)

Order of operations. When a proof needs both ∀I and ∃E, think about which name depends on which. Usually: introduce the ∀I name first, then the ∃E name inside it. If the ∃E must happen first (because the existential premise has nothing to do with the goal's variable), do it first. Always double-check freshness.

4.6 Common mistakes#

  1. Illegal generalization (∀I with a name that appears in an open assumption). See Section 4.2.
  2. Letting the ∃E witness escape. The conclusion of an ∃E must not mention the witness name. If your conclusion does, you went wrong.
  3. Reusing a name. Introducing "a" twice for two different ∃E steps. Each existential gets its own fresh name.
  4. ∃I with a fake witness. From P(a) you can infer ∃x P(x), yes. But from ∃x P(x) you cannot infer P(a) for a name of your choice. You may only name the witness inside ∃E.
  5. Dropping scope. (∀x P(x)) → Q is not the same as ∀x (P(x) → Q) with Q having x free. Free-variable clashes cause subtle bugs. Rename bound variables apart.
  6. Applying quantifier rules to sub-formulas. In (∀x P(x)) ∧ Q you may use ∧E first. In (∀x P(x)) → Q you may not instantiate inside the antecedent.

4.7 Chapter 4 in complete detail (the from-zero companion)#

Chapter 4 added four quantifier rules to the propositional ones. They look small, but they carry all the subtlety of predicate logic. This companion explains why each rule has the shape it has, spells out its exact conditions, shows it in every proof format, walks through more proofs with the thinking made visible, displays a gallery of illegal "proofs" (the best way to learn the conditions), and gives the soundness argument in plain language.

4.7.1 The two kinds of names: arbitrary and specific#

Everything in this chapter is governed by one distinction.

Specific name Arbitrary name
Meaning refers to a particular, fixed object about which something may already be known refers to "some object, any object", about which nothing special is assumed
Examples socrates, 0, a constant in the premises, a witness named by ∃E the a introduced by ∀I
What you may do with it use whatever is known about it only things that hold for every object
Rules that produce it constants given in the problem ∀I box
Rules that consume it ∃I, ∀E accept any term ∀I generalizes an arbitrary name

The hard rules are the ones that cross the boundary:

Everything in 4.2 of the main text is a refinement of this one idea.

4.7.2 The four rules, one at a time#

Notation: A(x) is a formula in which x may occur free; A(t) abbreviates A[t/x]; t is a term (variable, constant or function application); a is a name used as a constant ("parameter").

∀E: universal elimination (instantiation)#

text
m │ ∀x A(x)
  │ A(t)                  ∀E m

In words: if every object satisfies A, then in particular the object denoted by t does. Condition: t must be free for x in A (no variable of t gets captured by a quantifier of A); otherwise rename bound variables first. Freedom: you may instantiate with any term, as many times as you like, including terms that contain function symbols: from ∀x P(x) you may infer P(a), P(f(a)), P(f(f(b))). Typical use: unpack a general law at the specific objects relevant to your goal. Example: from ∀x ∀y (x < y → ¬ y < x) infer, in two steps, ∀y (a < y → ¬ y < a) and a < b → ¬ b < a (instantiate the outer quantifier first, then the inner). Misuse: instantiating inside a formula: from (∀x P(x)) → Q you cannot get P(a) → Q. The main connective is →; ∀E applies only when ∀x is the main connective of the line.

∃I: existential introduction (generalization on a witness)#

text
m │ A(t)
  │ ∃x A(x)               ∃I m

In words: if the object t satisfies A, then something satisfies A. Condition: t free for x in A. A subtlety (choice of abstraction). The line A(t) can be viewed as A'[t/x] for several different A', depending on which occurrences of t you "abstract". From P(a, a):

You may infer Because it is ∃x A(x) with
∃x P(x, x) A(x) = P(x, x): both occurrences abstracted
∃x P(x, a) A(x) = P(x, a): only the first
∃x P(a, x) A(x) = P(a, x): only the second
∃x ∃y P(x, y) two applications of ∃I

Typical use: finish a proof whose goal is existential, after you have found a witness. Misuse: from ∃x P(x) trying to "go back" to P(a) for a chosen a. ∃I only goes into the quantifier. To go out you need ∃E.

∀I: universal introduction (generalization)#

text
  │ ┌─ [a]                 a fresh: "let a be arbitrary"
  │ │  ...
  │ │  A(a)
  │ └──
  │ ∀x A(x)                ∀I (range)

In words: if you have proved A for an arbitrary object a (one about which no assumption was made), then A holds for all objects. Condition (eigenvariable condition). The name a:

  1. does not occur in any premise,
  2. does not occur in any open assumption (any assumption of a box enclosing the ∀I box),
  3. does not occur in the formula ∀x A(x) being derived.

Typical use: the universal goal. Open a box with a new name, prove A for that name, close. Remark: in Fitch notation the name-introduction line [a] is a sub-proof header that carries no assumption (it is not a formula). Some books flag the variable instead ("flag a").

∃E: existential elimination (naming the witness)#

text
m │ ∃x A(x)
  │ ┌─ [a]  A(a)           a fresh: "let a be such a witness"
  │ │  ...
  │ │  C
  │ └──
  │ C                      ∃E m, (range)

In words: if something satisfies A, give it a name a (that is a new name, not one you've used) and assume A(a); if from that you can conclude C, and C does not mention a, then C follows outright. Condition (eigenvariable condition). The name a:

  1. does not occur in ∃x A(x),
  2. does not occur in any premise or open assumption outside the box,
  3. does not occur in the conclusion C.

Typical use: an existential premise (or a line already proved). Always do it as early as you can, because it adds usable facts about the witness. Why the box? Inside the box the name a is a specific object; outside, no such name exists. The conclusion C must be something that makes sense without a.

The pattern: intro/elim and the two kinds of quantifier#

Introduction (prove it) Elimination (use it)
∀ ∀I: prove for an arbitrary name ∀E: apply to any term
∃ ∃I: exhibit a term ∃E: name a fresh witness

Notice the duality: ∀I and ∃E are the "name-introducing" rules with restrictions; ∀E and ∃I are the "name-using" rules with none (apart from capture-avoidance).

4.7.3 The rules in other formats#

Here is the same example in each format: ∀x (P(x) → Q(x)), ∀x P(x) ⊢ ∀x Q(x), together with the quantifier rules for that format.

Natural deduction in Gentzen's tree style#

Rules (the bracketed side conditions are the eigenvariable conditions):

text
 ∀x A(x)                        A(a)
 ───────── ∀E                   ───────── ∀I   (a not free in any undischarged
  A(t)                           ∀x A(x)         assumption, nor in ∀x A(x))

  A(t)                          ∃x A(x)    ⟨A(a)⟩..C
 ───────── ∃I                   ───────────────────── ∃E   (a not free in C, in ∃x A(x),
 ∃x A(x)                                  C                  or in other undischarged assumptions)

Example:

text
 ∀x(P(x) → Q(x))              ∀x P(x)
 ─────────────── ∀E           ─────── ∀E
  P(a) → Q(a)                   P(a)
 ──────────────────────────────────── →E
                Q(a)
              ────────── ∀I
               ∀x Q(x)

Here the free variable a is the arbitrary name; it does not occur in either premise (they are closed formulas), so ∀I is legal.

Copi / Quine style (UI, UG, EI, EG) with flagging#

Many introductory books use four rules with different names:

Name This course Statement
UI (universal instantiation) ∀E from ∀x A(x) infer A(t)
EG (existential generalization) ∃I from A(t) infer ∃x A(x)
UG (universal generalization) ∀I from A(y) infer ∀x A(x), if y is a variable not free in any premise/assumption and was not introduced by EI
EI (existential instantiation) ∃E (flat version) from ∃x A(x) infer A(c) for a new constant c (not used before anywhere); then restrictions: c may not appear in the conclusion, and UG may not later be applied to a variable-name introduced by EI

The flat "EI" style is the same logic as the boxed ∃E, but the freshness restrictions are enforced by bookkeeping (flags) instead of boxes, which makes errors easy to commit. Example:

text
1. ∀x (P(x) → Q(x))      premise
2. ∀x P(x)               premise
3. P(a) → Q(a)           1 UI
4. P(a)                  2 UI
5. Q(a)                  3,4 MP
6. ∀x Q(x)               5 UG   (a is arbitrary: not from a premise, not introduced by EI)

Lemmon-style quantifier rules#

Same as Lemmon's propositional rules, with UI, UG, EI, EG, and with the assumption-set convention: UG is permitted only if the name does not occur in any assumption that the line depends on; EI introduces a new assumption A(a), and the dependency set of the final conclusion replaces that line number by the dependency of the existential premise (this is the Lemmon encoding of ∃E).

Hilbert-style (axioms for quantifiers)#

Add to the propositional axioms (L1-L3 of 2.9.7):

Existential quantification is defined: ∃x A := ¬∀x ¬A.

Example (same theorem): premises ∀x(P(x)→Q(x)), ∀x P(x).

text
1. ∀x (P(x) → Q(x))                    premise
2. ∀x (P(x) → Q(x)) → (P(x) → Q(x))    Q1 (t := x)
3. P(x) → Q(x)                         MP 1,2
4. ∀x P(x)                             premise
5. ∀x P(x) → P(x)                      Q1
6. P(x)                                MP 4,5
7. Q(x)                                MP 6,3
8. ∀x Q(x)                             Gen 7   (x is not free in premises 1 and 4: it is bound there)

Sequent calculus (LK) quantifier rules#

text
 Γ, A(t), ∀x A(x) ⇒ Δ                 Γ ⇒ A(a), Δ
 ───────────────────── ∀L             ────────────── ∀R    (a not free in Γ, Δ, ∀x A(x))
 Γ, ∀x A(x) ⇒ Δ                       Γ ⇒ ∀x A(x), Δ

 Γ, A(a) ⇒ Δ                          Γ ⇒ A(t), ∃x A(x), Δ
 ────────────── ∃L  (a not free       ───────────────────── ∃R
 Γ, ∃x A(x) ⇒ Δ      in Γ, Δ, ∃x A)  Γ ⇒ ∃x A(x), Δ

(In ∀L and ∃R the quantified formula is kept in the premise because it may need to be instantiated several times.)

Derivation search (read from the goal upward):

text
 (1) ∀x(P(x)→Q(x)), ∀x P(x) ⇒ ∀x Q(x)
 (2) ∀x(P(x)→Q(x)), ∀x P(x) ⇒ Q(a)                           ∀R   (a fresh)
 (3) P(a)→Q(a), ∀x(P(x)→Q(x)), ∀x P(x) ⇒ Q(a)                ∀L   (t := a)
 (4) P(a)→Q(a), ∀x(P(x)→Q(x)), P(a), ∀x P(x) ⇒ Q(a)          ∀L   (t := a)
 (5a) P(a), ... ⇒ P(a), Q(a)    Axiom          (5b) Q(a), P(a), ... ⇒ Q(a)   Axiom
 Step (4) follows from (5a) and (5b) by →L on P(a)→Q(a).

Analytic tableaux for quantifiers#

Two new kinds of rule:

Type Formula on the branch Action
γ (universal type) ∀x A(x) or ¬∃x A(x) add A(t) (or ¬A(t)) for any term t; keep the formula (may be reused with new terms)
δ (existential type) ∃x A(x) or ¬∀x A(x) add A(a) (or ¬A(a)) for a brand new constant a; the formula is then used up

Tableau for our example: the root is ∀x (P(x)→Q(x)), ∀x P(x), ¬∀x Q(x).

text
 ∀x (P(x) → Q(x))
 ∀x P(x)
 ¬∀x Q(x)
 ¬Q(a)                          (δ on ¬∀x Q(x), a new)
 P(a)                           (γ on ∀x P(x), t := a)
 P(a) → Q(a)                    (γ on ∀x (P(x)→Q(x)), t := a)
   ├── ¬P(a)  ✗  (clashes with P(a))
   └── Q(a)   ✗  (clashes with ¬Q(a))

All branches close, so the entailment holds. For formulas needing infinitely many γ-instances the tableau may not terminate (undecidability).

Resolution and Skolemization#

Resolution works on clauses with no quantifiers: existentials are replaced by Skolem terms and universals are left implicit (Chapter 7). The same example: clauses {¬P(x), Q(x)}, {P(x)}, and the negated goal Skolemized as {¬Q(c)} (c a new constant): resolve {P(x)} with {¬P(x), Q(x)} (unifier x) to get {Q(x)}; resolve with {¬Q(c)} (unifier x := c): empty clause.

Proof assistants#

Lean 4 (term mode and tactic mode):

lean
-- term mode: ∀I is "fun a => ...", ∀E is application
example (α : Type) (P Q : α → Prop)
    (h1 : ∀ x, P x → Q x) (h2 : ∀ x, P x) : ∀ x, Q x :=
  fun a => h1 a (h2 a)

-- tactic mode
example (α : Type) (P Q : α → Prop)
    (h1 : ∀ x, P x → Q x) (h2 : ∀ x, P x) : ∀ x, Q x := by
  intro a            -- ∀I: a is the fresh name
  exact h1 a (h2 a)  -- ∀E twice, →E

-- existential: obtain = ∃E, anonymous constructor = ∃I
example (α : Type) (P Q : α → Prop)
    (h1 : ∀ x, P x → Q x) (h2 : ∃ x, P x) : ∃ x, Q x := by
  obtain ⟨a, ha⟩ := h2   -- ∃E: name the witness a with ha : P a
  exact ⟨a, h1 a ha⟩     -- ∃I with witness a

Coq / Rocq:

coq
Theorem ex1 : forall (A : Type) (P Q : A -> Prop),
  (forall x, P x -> Q x) -> (forall x, P x) -> forall x, Q x.
Proof.
  intros A P Q h1 h2 a.   (* ∀I: a is fresh *)
  apply h1.               (* goal Q a becomes P a *)
  apply h2.               (* ∀E *)
Qed.

Theorem ex2 : forall (A : Type) (P Q : A -> Prop),
  (forall x, P x -> Q x) -> (exists x, P x) -> exists x, Q x.
Proof.
  intros A P Q h1 h2.
  destruct h2 as [a ha].  (* ∃E *)
  exists a.               (* ∃I *)
  apply h1. exact ha.
Qed.

In Lean/Coq the freshness conditions are enforced automatically by the scoping rules of the language: intro a makes a new variable; you literally cannot refer to it outside its scope. That is the deepest reason why freshness is a scoping idea.

Correspondence table: the quantifier rules across systems#

Idea Fitch (this course) Gentzen NK Hilbert Sequent (LK) Tableau Lean/Coq
use ∀ ∀E ∀E Q1 + MP ∀L γ application h t
prove ∃ ∃I ∃I defined via ¬∀¬ ∃R (refutation: γ on ¬∃) ⟨t, proof⟩ / exists t
prove ∀ ∀I (box) ∀I (eigenvariable) Gen ∀R (refutation: δ on ¬∀) intro a
use ∃ ∃E (box) ∃E (discharge) derived ∃L δ obtain ⟨a, h⟩ / destruct

4.7.4 Narrated proofs: thinking made visible#

Proof 1. ∃x (P(x) ∧ Q(x)), ∀x (Q(x) → S(x)) ⊢ ∃x (P(x) ∧ S(x))

Thinking. The goal is existential, but I don't know a witness. The premise is existential, so name its witness a (∃E) and then my goal's witness will be that same a. Inside the box I need P(a) ∧ S(a): P(a) comes from the witness; S(a) from instantiating the universal premise at a and using Q(a).

text
1.  ∃x (P(x) ∧ Q(x))        premise
2.  ∀x (Q(x) → S(x))        premise
3.  |  [a]  P(a) ∧ Q(a)     assumption (∃E)
4.  |  P(a)                  ∧E 3
5.  |  Q(a)                  ∧E 3
6.  |  Q(a) → S(a)           ∀E 2
7.  |  S(a)                  →E 6,5
8.  |  P(a) ∧ S(a)           ∧I 4,7
9.  |  ∃x (P(x) ∧ S(x))      ∃I 8
10. ∃x (P(x) ∧ S(x))        ∃E 1, 3-9

Check: a does not occur in the conclusion ∃x (P(x) ∧ S(x)) (line 10) ✓, nor in the premises ✓.

Proof 2. ∀x ∀y (R(x, y) → ¬R(y, x)) ⊢ ∀x ¬R(x, x) (asymmetric implies irreflexive)

Thinking. Goal is universal: introduce an arbitrary a. Goal inside: ¬R(a, a), a negation: assume R(a, a) and look for ⊥. The premise, instantiated twice at a (both x and y := a), gives R(a, a) → ¬R(a, a), which together with the assumption clashes.

text
1.  ∀x ∀y (R(x, y) → ¬R(y, x))     premise
2.  |  [a]                         (fresh a, for ∀I)
3.  |  ∀y (R(a, y) → ¬R(y, a))     ∀E 1
4.  |  R(a, a) → ¬R(a, a)          ∀E 3
5.  |  |  R(a, a)                  assumption (for ¬I)
6.  |  |  ¬R(a, a)                 →E 4,5
7.  |  |  ⊥                        ¬E 5,6
8.  |  ¬R(a, a)                    ¬I 5-7
9.  ∀x ¬R(x, x)                   ∀I 2-8

Note: instantiating a universal twice with the same term is perfectly legal and often essential.

Proof 3. ⊢ ∀x ∃y (x = y) (every object equals something; also uses equality)

Thinking. Goal is universal: arbitrary a. Inside, I need an existential: I have a witness, a itself, since a = a by reflexivity.

text
1.  |  [a]
2.  |  a = a                  =I
3.  |  ∃y (a = y)             ∃I 2   (abstract the second a)
4.  ∀x ∃y (x = y)            ∀I 1-3

Remark: no premises, so this is a theorem of first-order logic with equality. Note how the ∃I step needs a witness: the arbitrary name a itself serves, which is legitimate because every domain is non-empty (see 4.7.7).

Proof 4. ⊢ ∀x (P(x) → P(x)) ∧ (∃x P(x) → ∃y P(y))

Thinking. A conjunction of two things; each is easy. Second part: assume ∃x P(x); name the witness; re-abstract with a different bound variable.

text
1.  |  [a]
2.  |  |  P(a)                   assumption
3.  |  P(a) → P(a)              →I 2-2
4.  ∀x (P(x) → P(x))           ∀I 1-3
5.  |  ∃x P(x)                 assumption (for →I)
6.  |  |  [b]  P(b)            assumption (∃E)
7.  |  |  ∃y P(y)              ∃I 6
8.  |  ∃y P(y)                 ∃E 5, 6-7
9.  ∃x P(x) → ∃y P(y)          →I 5-8
10. ∀x (P(x) → P(x)) ∧ (∃x P(x) → ∃y P(y))     ∧I 4,9

Observe the harmless renaming: ∃x P(x) and ∃y P(y) are α-equivalent, and the proof just uses ∃E and ∃I to move between them.

Proof 5 (nesting order). ∃x ∀y R(x, y), ∀x ∀y (R(x, y) → S(y, x)) ⊢ ∀y ∃x S(y, x)

Thinking. Goal universal in y: introduce b. I need ∃x S(b, x). The first premise gives an x, say a, that relates to every y, in particular to b: R(a, b). The second premise turns that into S(b, a). I'll introduce b first (it comes from the goal), then the witness a inside.

text
1.  ∃x ∀y R(x, y)                    premise
2.  ∀x ∀y (R(x, y) → S(y, x))        premise
3.  |  [b]                          (fresh b, for ∀I)
4.  |  |  [a]  ∀y R(a, y)           assumption (∃E)
5.  |  |  R(a, b)                   ∀E 4
6.  |  |  ∀y (R(a, y) → S(y, a))     ∀E 2
7.  |  |  R(a, b) → S(b, a)         ∀E 6
8.  |  |  S(b, a)                   →E 7,5
9.  |  |  ∃x S(b, x)                ∃I 8
10. |  ∃x S(b, x)                   ∃E 1, 4-9
11. ∀y ∃x S(y, x)                   ∀I 3-10

Check: the ∃E conclusion ∃x S(b, x) mentions b, not a ✓; b does not occur in the premises ✓ and not in the open assumptions at line 11 ✓. (The nesting could also be reversed, with the ∃E box outside and the ∀I box inside; see the note after the gallery.)

Each "proof" below looks convincing. Learn to find the exact illegal step.

Gallery 1: "∃x P(x), ∀x (P(x) → Q(x)) ⊢ ∀x Q(x)" (invalid: some P, and P's are Q's, does not give everything is Q.)

text
1.  ∃x P(x)                 premise
2.  ∀x (P(x) → Q(x))        premise
3.  |  [a]  P(a)            assumption (∃E)
4.  |  P(a) → Q(a)          ∀E 2
5.  |  Q(a)                 →E 4,3
6.  |  ∀x Q(x)              ∀I 5     ← ILLEGAL
7.  ∀x Q(x)                 ∃E 1, 3-6

Error: at line 6 the name a occurs in the open assumption P(a) (line 3), so a is not arbitrary. ∀I needs a not to occur in any open assumption.

Gallery 2: "∀x ∃y x < y ⊢ ∃y ∀x x < y" (invalid: the converse of ∃∀ ⊢ ∀∃.)

text
1.  ∀x ∃y x < y            premise
2.  |  [b]                 (fresh b)
3.  |  ∃y b < y            ∀E 1
4.  |  |  [c]  b < c       assumption (∃E)
5.  |  |  ∀x (x < c)       ∀I 4     ← ILLEGAL (generalizing b)
6.  |  |  ∃y ∀x (x < y)    ∃I 5
7.  |  ∃y ∀x (x < y)       ∃E 3, 4-6

Error: to get ∀x (x < c) from b < c we generalize over b, but b occurs in the open assumption b < c (line 4). The witness c was chosen depending on b, so b is not arbitrary any more.

Gallery 3: "∃x P(x), ∃x Q(x) ⊢ ∃x (P(x) ∧ Q(x))" (invalid.)

text
1.  ∃x P(x)                premise
2.  ∃x Q(x)                premise
3.  |  [a]  P(a)           assumption (∃E on line 1)
4.  |  |  [a]  Q(a)       assumption (∃E on line 2)   ← ILLEGAL: a not fresh (occurs in P(a))

Error: each existential needs its own fresh name. The legal version uses a for the first and b for the second, and then the conjunction P(a) ∧ Q(b) does not yield ∃x (P(x) ∧ Q(x)); the proof correctly fails.

Gallery 4: "∃x P(x) ⊢ P(a)" (invalid.) The "rule" "from ∃x P(x) infer P(a)" for a name a of your choice is not a rule: names introduced by ∃E live inside the box and cannot escape. The conclusion P(a) contains the witness name, so ∃E is blocked (condition 3).

Gallery 5: "∃E conclusion contains the witness"

text
1.  ∃x P(x)                premise
2.  |  [a]  P(a)           assumption (∃E)
3.  P(a)                   ∃E 1, 2-2     ← ILLEGAL: conclusion mentions a

Error: exactly Gallery 4 in a different guise.

Gallery 6: capture. "From ∀x ∃y (x ≠ y) instantiate x := y to get ∃y (y ≠ y)."

Error: ∀E with t = y into a formula where y is bound by ∃y is a capture. The term y is not free for x. The correct instance (after renaming) is ∃z (y ≠ z), which is true in any domain with at least two elements; the capture would produce ∃y (y ≠ y), always false.

Gallery 7: applying a rule inside a formula. From (∀x P(x)) → Q, "infer P(a) → Q". Error: ∀E applies to a line whose main connective is the quantifier. Here the main connective is →. (In fact the inference is invalid: take a domain where P is true of a but not of everything, and Q false.)

Gallery 8: generalizing over a name from a premise. "From the premise P(a), infer ∀x P(x)."

text
1.  P(a)                   premise
2.  ∀x P(x)                ∀I 1     ← ILLEGAL

Error: a occurs in a premise, so it denotes a specific object about which we know something. "Socrates is a man, therefore everything is a man" is the absurd instance. (Compare the legal pattern: the name must be introduced by the ∀I box itself.)

A note on the order of boxes. When a proof needs both an ∃E box and a ∀I box (as in Example 3 of Section 4.3), several nestings may be legal. For ∃x ∀y R(x, y) ⊢ ∀y ∃x R(x, y) you may open the ∀I box for b first and the ∃E box for a inside it (the book's version), or open the ∃E box for a first and the ∀I box for b inside it: in the second version b is fresh (it does not occur in the open assumption ∀y R(a, y)), and the ∃E conclusion ∀y ∃x R(x, y) does not mention a. What matters is never the order as such but that every box satisfies its own conditions. The invalid converse fails in both orders, because some condition is violated each time (Gallery 2).

4.7.6 Why the rules are sound (the freshness argument in plain words)#

Soundness means: if the rule's premises are true in a structure, so is its conclusion. For the "easy" rules this is immediate:

For the two restricted rules we need freshness:

∀I. Suppose we have shown A(a) from the assumptions (premises and open assumptions) Γ, and a does not occur in Γ or in ∀x A. Take any structure M that satisfies Γ. Since a does not occur in Γ, we may reinterpret a as any element d of the domain without changing whether Γ holds. In each such reinterpretation A(a) is true (because the derivation is sound for every structure). Hence A holds of every d, which is the truth condition for ∀x A. If a occurred in Γ, we could not reinterpret it freely, and the argument breaks.

∃E. Suppose ∃x A(x) is true in M and Γ, A(a) ⊢ C where a occurs in neither Γ, nor ∃x A, nor C. Because ∃x A is true, some d satisfies A. Reinterpret a as that d (no harm, since a does not occur in Γ, ∃x A or C). Then Γ and A(a) are true, so C is true. Since C does not mention a, its truth is unaffected by the reinterpretation: C is true in the original M. If C mentioned a, the reinterpretation might change C's truth value.

The reinterpretation argument is the heart of the soundness theorem for first-order natural deduction (Chapter 6) and is why the conditions are exactly "does not occur in ..." and nothing more or less.

4.7.7 Non-empty domains and "names from nowhere"#

In standard first-order logic every structure has a non-empty domain. This is built into the rules: the following derivation is valid:

text
1.  ∀x P(x)       premise
2.  P(a)          ∀E 1      ← a: any name, even one not mentioned before
3.  ∃x P(x)       ∃I 2

If the domain could be empty, ∀x P(x) would be true (vacuously) and ∃x P(x) false. By allowing ∀E to instantiate with an arbitrary name, standard FOL builds in non-emptiness (equivalently the validity of ∃x (x = x)). In free logic the rules are restricted: ∀E requires an existence premise E!t.

The drinker paradox ⊢ ∃x (D(x) → ∀y D(y)) uses this: the line "pick any name c" in Example 5 of Section 4.3 is exactly an application of this convention.

4.7.8 Equality rules in detail#

Rule Schema Condition
=I (reflexivity) infer t = t (no premises) any term t
=E (substitution of equals, Leibniz) from s = t and A(s), infer A(t) A(x) is any formula; A(s), A(t) result from A(x) by replacing x with s, t (free for x)

Important: in =E you decide which occurrences to replace by choosing the formula A(x) with the right pattern of holes. Replacing only some occurrences is allowed.

Derived rules (prove them once, use freely):

Derived Statement Proof pattern
Symmetry s = t ⊢ t = s A(x) := x = s; from s = s (=I) and s = t infer t = s
Transitivity s = t, t = u ⊢ s = u A(x) := s = x
Function congruence s = t ⊢ f(s) = f(t) A(x) := f(s) = f(x); start from f(s) = f(s) (=I)
Predicate congruence s = t, P(s) ⊢ P(t) A(x) := P(x)
Uniqueness extraction ∃!x P(x) ⊢ ∃x P(x) ∧ ∀x ∀y ((P(x) ∧ P(y)) → x = y) ∃E, then ∀E and =E

Worked derivation (function congruence): s = t ⊢ f(s) = f(t)

text
1.  s = t               premise
2.  f(s) = f(s)         =I
3.  f(s) = f(t)         =E 1,2   (A(x) := f(s) = f(x); line 2 is A(s), so from A(s) and s = t infer A(t))

Worked derivation (uniqueness consequence): ∃x (P(x) ∧ ∀y (P(y) → y = x)) ⊢ ∀u ∀v ((P(u) ∧ P(v)) → u = v).

text
1.  ∃x (P(x) ∧ ∀y (P(y) → y = x))            premise
2.  |  [u]                                   (fresh u, for ∀I)
3.  |  |  [v]                                (fresh v, for ∀I)
4.  |  |  |  [c]  P(c) ∧ ∀y (P(y) → y = c)   assumption (∃E)
5.  |  |  |  |  P(u) ∧ P(v)                  assumption (for →I)
6.  |  |  |  |  ∀y (P(y) → y = c)            ∧E 4
7.  |  |  |  |  P(u)                         ∧E 5
8.  |  |  |  |  P(v)                         ∧E 5
9.  |  |  |  |  P(u) → u = c                 ∀E 6
10. |  |  |  |  P(v) → v = c                 ∀E 6
11. |  |  |  |  u = c                        →E 9,7
12. |  |  |  |  v = c                        →E 10,8
13. |  |  |  |  c = v                        symmetry 12
14. |  |  |  |  u = v                        transitivity 11,13
15. |  |  |  (P(u) ∧ P(v)) → u = v           →I 5-14
16. |  |  (P(u) ∧ P(v)) → u = v              ∃E 1, 4-15
17. |  ∀v ((P(u) ∧ P(v)) → u = v)            ∀I 3-16
18. ∀u ∀v ((P(u) ∧ P(v)) → u = v)            ∀I 2-17

(The names u, v are arbitrary; the witness c is introduced inside both. The ∃E conclusion at line 16 does not mention c, and u, v do not occur in the premise.)

4.7.9 Strategy reference for quantifier proofs#

Decision table (extends the one in 2.9.5)

Situation Move
Goal ∀x A(x) open a ∀I box with fresh a, aim for A(a)
Goal ∃x A(x) look for a witness t among the names/terms in your proof; prove A(t); ∃I. If none is evident: RAA (assume ¬∃x A(x), derive ∀x ¬A(x), instantiate...)
Goal ¬∀x A(x) assume ∀x A(x), aim for ⊥ (¬I). Instantiate it at useful terms.
Goal ¬∃x A(x) assume ∃x A(x), use ∃E to name the witness, aim for ⊥
Available ∀x A(x) instantiate at every relevant term: all constants/names in the proof, and any term your other facts mention
Available ∃x A(x) ∃E early: name the witness; its new facts help everything below
Available ¬∀x A(x) classical: convert (via RAA) to ∃x ¬A(x)
Available ¬∃x A(x) it gives ¬A(t) for any t (prove ∀x ¬A(x) first, or instantiate when you find A(t) to get ⊥)

Heuristics

  1. Prefer to introduce arbitrary names first, witnesses second. Do the ∀I boxes that the goal demands first, then use ∃E inside. Other nestings are often legal too, but this one makes the freshness conditions easiest to check.
  2. Instantiate universals only at names that exist. In a proof with names a, b, instantiate ∀x ∀y R(x,y) at all four pairs if needed. Don't invent terms unless required.
  3. A witness for ∃I is usually a name you already have. Look at the ∃E witness names and ∀I names in scope.
  4. Keep the goal in sight: when a box's goal is atomic, decide quickly whether you can reach it by →E from instantiated universals.
  5. Write the informal English proof first. Then transcribe: "Let a be arbitrary" = ∀I box; "let c be such that" = ∃E box; "in particular" = ∀E; "so there exists" = ∃I.

Dictionary: prose ↔ quantifier rule

Prose Rule
"Let n be an arbitrary natural number." start ∀I box
"Since this holds for all x, it holds for t." ∀E
"Hence this holds for every n." close ∀I box
"Choose c such that ..." / "Let c be such that ..." start ∃E box
"Take t, then ..." / "For example ..." / "So there is an x such that ..." ∃I
"Suppose, for contradiction, that for all x..." RAA / ¬I with ∀

4.7.10 Quick-check (with answers)#

Q1. Which of ∀E, ∃I, ∀I, ∃E have a freshness condition? What exactly must be fresh? Q2. From P(a, a) list all the existential formulas of the form ∃x … obtainable by one application of ∃I. Q3. What is wrong with: premise ∀x ∃y L(x, y); line 2: ∃y L(y, y) by ∀E with t := y? Q4. In ∃E, which formula must not mention the witness name? Q5. In Example 3 (∃x ∀y R ⊢ ∀y ∃x R), could you open the ∃E box first and the ∀I box inside it? Which conditions would you have to check? Q6. Why is ∀x P(x) ⊢ ∃x P(x) valid in standard first-order logic but not in free logic? Q7. Give the Lean tactic that corresponds to ∀I, to ∃E, to ∃I.

Answers. A1. ∀I: the new name must not occur in premises, open assumptions, or the conclusion ∀x A. ∃E: the witness name must not occur in ∃x A, in other premises/open assumptions, or in the conclusion C. A2. ∃x P(x, x), ∃x P(x, a), ∃x P(a, x). A3. The term y is captured by ∃y; the term is not free for x. The correct instance (rename first) is ∃z L(y, z). A4. The conclusion C of the ∃E (and the formulas ∃x A, premises). A5. Yes. Open ∃E for a with assumption ∀y R(a, y), then inside it open ∀I for b, derive R(a, b) and ∃x R(x, b), and close with ∀I to get ∀y ∃x R(x, y). Conditions to check: b is fresh (it does not occur in the open assumption ∀y R(a, y) or in any premise), and the ∃E conclusion ∀y ∃x R(x, y) does not mention a. Both hold, so this nesting is legal too. A6. In standard FOL, ∀E may instantiate with any name, which presupposes the domain is non-empty. Free logic allows an empty domain (then ∀x P(x) is vacuously true and ∃x P(x) false). A7. ∀I: intro a. ∃E: obtain ⟨a, h⟩ := hex (or rcases/cases). ∃I: exact ⟨t, proof⟩ or refine ⟨t, ?_⟩.

Problems for Chapter 4#

4.1 ★ ∀x (P(x) ∧ Q(x)) ⊢ ∀x P(x) ∧ ∀x Q(x), and the converse.

4.2 ★ ∀x P(x) ⊢ ∃x P(x)

4.3 ★ ∃x (P(x) ∧ Q(x)) ⊢ ∃x P(x) ∧ ∃x Q(x)

4.4 ★ ∀x ∀y R(x, y) ⊢ ∀y ∀x R(x, y)

4.5 ★ ∃x ∃y R(x, y) ⊢ ∃y ∃x R(x, y)

4.6 ★★ ∀x ¬P(x) ⊢ ¬∃x P(x)

4.7 ★★ ¬∃x P(x) ⊢ ∀x ¬P(x)

4.8 ★★ ∃x ¬P(x) ⊢ ¬∀x P(x)

4.9 ★★ ∀x (P(x) → Q(x)) ⊢ ∀x P(x) → ∀x Q(x)

4.10 ★★ ∀x P(x) ∨ ∀x Q(x) ⊢ ∀x (P(x) ∨ Q(x))

4.11 ★★ ∃x (P(x) ∨ Q(x)) ⊢ ∃x P(x) ∨ ∃x Q(x)

4.12 ★★ (x not free in B) ∀x (P(x) → B) ⊢ ∃x P(x) → B, and the converse

4.13 ★★ ∀x (P(x) ∨ Q(x)), ¬∃x P(x) ⊢ ∀x Q(x)

4.14 ★★ ∃x P(x) → ∀y Q(y) ⊢ ∀y (P(y) → Q(y))

4.15 ★★ s = t, t = u ⊢ s = u, and: ∀x ∀y (x = y → y = x)

4.16 ★★ ∃x (P(x) ∧ ∀y (P(y) → y = x)) ⊢ ∀x ∀y ((P(x) ∧ P(y)) → x = y) (existence-and-uniqueness implies at-most-one)

4.17 ★★★ ∀x ∃y R(x, y), ∀x ∀y (R(x, y) → R(y, x)), ∀x ∀y ∀z ((R(x, y) ∧ R(y, z)) → R(x, z)) ⊢ ∀x R(x, x) (symmetric + transitive + serial implies reflexive)

4.18 ★★★ ⊢ ∃x (P(x) → ∀y P(y)) (the drinker paradox; do it by cases on ∀y P(y) first as in the informal proof, then formalize without looking at Example 5)

4.19 ★★★ ⊢ ¬∃x ∀y (R(x, y) ↔ ¬R(y, y)) (Russell's barber, from a blank page)

4.20 ★★★ For each "proof" below, find the exact line that violates a rule, and say whether the conclusion is actually valid:


Chapter 5. Mathematical proof technique ↑ Top#

Formal proofs are a microscope. Real mathematics is written in prose, but every prose proof is a compressed formal proof. This chapter shows the dictionary.

5.1 The dictionary: logic to prose#

Formal rule What you write in prose
→I "Assume A. ... Therefore B."
∀I "Let x be arbitrary. ..." / "Let ε > 0 be given. ..."
∃I "Take x = ... (explicit witness)." / "Choose δ = ε/2."
∃E "Since there exists x with P(x), let a be such an x."
∨E "We consider two cases. Case 1: ... Case 2: ..."
¬I "Suppose, for contradiction, that A. ... This is absurd."
RAA "Suppose not. ... Contradiction."
∧I "We prove A. We prove B. Hence both."
↔I "(⇒) ... (⇐) ..."

The two-step method for any proof.

  1. Unpack the statement formally (write it with quantifiers and connectives, even in rough form). The logical form tells you the proof structure, exactly as in Chapters 2 and 4.
  2. Unpack the definitions of every defined term in the statement. Most "I don't know how to start" moments come from not having done this.

5.2 Direct proof#

To prove A → B, assume A and derive B.

Definitions. An integer n is even if ∃k ∈ ℤ (n = 2k), and odd if ∃k ∈ ℤ (n = 2k + 1).

Theorem. If m and n are even integers, then m + n is even.

Proof. Assume m and n are even. By definition, there are integers j, k with m = 2j and n = 2k (this is ∃E twice). Then m + n = 2j + 2k = 2(j + k). Since j + k is an integer, m + n is even (this is ∃I with witness j + k). ∎

Notice how the proof is literally the sequence: →I, ∃E, ∃E, ∃I.

5.3 Proof by contrapositive#

To prove A → B, prove ¬B → ¬A instead. Use it when ¬B gives you something concrete to work with.

Theorem. For an integer n, if n² is even then n is even.

Proof. We prove the contrapositive: if n is odd, then n² is odd. Let n = 2k + 1. Then n² = 4k² + 4k + 1 = 2(2k² + 2k) + 1, which is odd. ∎

A direct attempt would start with n² = 2k and get stuck, because you cannot "take a square root" within the integers by algebra alone. The contrapositive turns the hypothesis into something with algebraic content.

5.4 Proof by contradiction#

To prove A, assume ¬A and derive a contradiction. (To prove ¬A, assume A and derive a contradiction. That is ¬I and is not really "by contradiction" in the classical, RAA sense.)

Theorem. √2 is irrational.

Proof. Suppose √2 were rational. Then √2 = p/q for integers p, q with q ≠ 0, and we may assume p/q is in lowest terms (gcd(p, q) = 1). Squaring: p² = 2q², so p² is even, hence p is even (by 5.3). Write p = 2r. Then 4r² = 2q², so q² = 2r², so q² is even and hence q is even. Now both p and q are even, contradicting gcd(p, q) = 1. ∎

Theorem (Euclid). There are infinitely many primes.

Proof. Suppose there were only finitely many primes p₁, ..., pₙ. Consider N = p₁ · p₂ ··· pₙ + 1. N > 1, so N has a prime divisor q. This q must be one of the pᵢ, so q divides the product p₁···pₙ, and since q divides N it also divides N − p₁···pₙ = 1. But no prime divides 1. Contradiction. ∎

Warning. Do not use contradiction when a direct or contrapositive proof is as easy. "Proof by contradiction" that merely wraps a direct proof (assume ¬A, derive A directly, "contradiction") is correct but bad style.

5.5 Proof by cases#

To use A ∨ B (or a statement that is known to split into exhaustive cases), prove the conclusion in each case. Make sure the cases are exhaustive. Overlap is fine; gaps are fatal.

Theorem. For every integer n, n² mod 4 ∈ {0, 1}.

Proof. Case 1: n is even, n = 2k, so n² = 4k² ≡ 0. Case 2: n is odd, n = 2k + 1, so n² = 4k² + 4k + 1 ≡ 1. Every integer is even or odd, so the cases are exhaustive. ∎

Corollary. No integer of the form 4k + 3 is a sum of two squares. Proof. A sum of two squares is ≡ 0 + 0, 0 + 1, 1 + 0 or 1 + 1 (mod 4), i.e., 0, 1, or 2, never 3. ∎

5.6 Existence, uniqueness, and counterexamples#

Example. The equation 3x + 2 = 11 has exactly one solution. Existence: x = 3. Uniqueness: if 3a + 2 = 11 and 3b + 2 = 11, then 3a = 3b, so a = b. ∎

5.7 Proofs with nested quantifiers (ε-δ style)#

The structure of an ε-δ proof is a direct image of the logical form.

Claim. lim_{x → 2} (3x + 1) = 7, i.e., ∀ε > 0 ∃δ > 0 ∀x (|x − 2| < δ → |(3x + 1) − 7| < ε).

Scratch work (this part is not in the final proof): we need |3x − 6| = 3|x − 2| < ε, so |x − 2| < ε/3 suffices. Choose δ = ε/3.

Proof.

Observe the structure: ∀ introduces a name, ∃ provides a witness that may depend on every name introduced before it. The order ∀ε ∃δ ∀x tells you δ may depend on ε but not on x.

5.8 Mathematical induction#

Induction proves statements of the form ∀n ∈ ℕ, P(n). It is the standard tool for anything defined recursively.

Principle of (weak) induction. If

  1. Base case: P(0) (or P(1)) holds, and
  2. Inductive step: for every n, P(n) → P(n + 1),

then P(n) holds for all n ≥ the base.

Why it works. It is the logical statement ( P(0) ∧ ∀n (P(n) → P(n+1)) ) → ∀n P(n), which is an axiom of arithmetic (or a consequence of the well-ordering principle: a smallest counterexample would have a predecessor that is not a counterexample, which is absurd).

Template.

  1. State precisely the statement P(n).
  2. Base case: verify P(base).
  3. Inductive step: Assume P(n) for some arbitrary n ≥ base (this is the induction hypothesis, IH). Prove P(n + 1), and mark clearly where you use the IH.
  4. Conclude.

Example 1. 1 + 2 + ··· + n = n(n + 1)/2#

Proof. P(n): the identity holds.

Example 2. 1 + 3 + 5 + ··· + (2n − 1) = n²#

Proof. Base n = 1: 1 = 1². Step: assume P(n). Then the sum up to 2(n + 1) − 1 = 2n + 1 equals n² + (2n + 1) (IH) = (n + 1)². ∎

Example 3. For all n ≥ 1, n < 2ⁿ#

Base. 1 < 2. Step. Assume n < 2ⁿ. Then n + 1 < 2ⁿ + 1 ≤ 2ⁿ + 2ⁿ = 2ⁿ⁺¹ (since 2ⁿ ≥ 1). ∎

Example 4. 3 divides n³ − n for every integer n ≥ 0#

Base. n = 0: 0 is divisible by 3. Step. (n + 1)³ − (n + 1) = n³ + 3n² + 3n + 1 − n − 1 = (n³ − n) + 3(n² + n). The first term is divisible by 3 by IH, the second obviously. ∎

5.9 Strong induction#

When P(n + 1) needs not just P(n) but possibly any earlier case, use strong induction: assume P(k) for all k < n and prove P(n). (Base cases are sometimes handled automatically, since for the smallest n the hypothesis is vacuous. Be careful to handle them explicitly when the step needs them.)

Theorem. Every integer n ≥ 2 is a product of primes.

Proof. Let n ≥ 2 and assume the claim for all k with 2 ≤ k < n. If n is prime, it is a product of one prime. Otherwise n = ab with 2 ≤ a, b < n. By the IH, a and b are products of primes, so n = ab is as well. ∎

Theorem. Every integer n ≥ 12 can be written as 4a + 5b with a, b ≥ 0.

Proof. Base cases: 12 = 4·3, 13 = 4·2 + 5, 14 = 4 + 5·2, 15 = 5·3. For n ≥ 16, n − 4 ≥ 12, so by strong IH n − 4 = 4a + 5b, hence n = 4(a + 1) + 5b. ∎

Four base cases were needed because the step reaches back four places.

5.10 Structural induction#

Because formulas are defined inductively (Chapter 1), we can prove properties of all formulas by induction on their structure: prove it for atoms (base) and prove that if it holds for A and B then it holds for ¬A, (A ∧ B), etc. (step).

Theorem. Let formulas be built from atoms using ¬ and (A ∧ B). Then every formula has the same number of "(" as ")".

Proof. Atoms: 0 and 0. ¬A: parentheses are exactly those of A. (A ∧ B): one extra "(" and one extra ")" plus those of A and B, which are balanced by IH. ∎

Theorem. Let a formula use only atoms and binary connectives, and let it have n binary connective occurrences. Then it has n + 1 atom occurrences.

Proof. Atom: 0 connectives, 1 atom. (A ∘ B): if A has m connectives (m + 1 atoms) and B has k connectives (k + 1 atoms), then (A ∘ B) has m + k + 1 connectives and (m + 1) + (k + 1) = (m + k + 1) + 1 atoms. ∎

Structural induction is also the engine behind soundness proofs (induction on derivations, Chapter 6) and the correctness proofs of every recursive algorithm over ASTs you will write in Chapter 8.

5.11 Common induction errors#

5.12 Sets and functions: where logic meets mathematics#

Sets#

Set equality and inclusion are defined by logic:

So every set identity is a logical equivalence in disguise.

Theorem. A ∩ (B ∪ C) = (A ∩ B) ∪ (A ∩ C).

Proof. Let x be arbitrary. x ∈ A ∩ (B ∪ C) ⇔ x ∈ A ∧ (x ∈ B ∨ x ∈ C) ⇔ (x ∈ A ∧ x ∈ B) ∨ (x ∈ A ∧ x ∈ C) ⇔ x ∈ (A ∩ B) ∪ (A ∩ C), using distributivity from Chapter 1. ∎

Functions#

Let f: X → Y.

Theorem. If f: X → Y has a left inverse g: Y → X (so g(f(x)) = x for all x), then f is injective.

Proof. Let a, b ∈ X be arbitrary and assume f(a) = f(b). Apply g: g(f(a)) = g(f(b)). By the left-inverse property, a = b. ∎

Theorem. If g ∘ f is injective, then f is injective.

Proof. Let a, b be arbitrary with f(a) = f(b). Then g(f(a)) = g(f(b)), i.e., (g ∘ f)(a) = (g ∘ f)(b). Since g ∘ f is injective, a = b. ∎

Theorem (Cantor). There is no surjection from a set A onto its power set 𝒫(A).

Proof. Suppose h: A → 𝒫(A) is surjective. Let D = {x ∈ A : x ∉ h(x)}. Since h is surjective, D = h(d) for some d ∈ A. Then d ∈ D ⇔ d ∉ h(d) ⇔ d ∉ D, a contradiction. ∎

This is exactly Russell's barber (Chapter 4, Example 6) with R(x, y) := "y ∈ h(x)".

5.13 Writing proofs well#

5.14 Chapter 5 in complete detail (the from-zero companion)#

Chapter 5 gave you the main techniques with a few examples each. This companion is a proof-writing manual: it explains what mathematical statements are made of, gives a step-by-step procedure that works for almost any proof, supplies a skeleton (template) for every technique, treats induction in all its forms with fully worked examples, shows how proofs about sets, functions and relations are done mechanically, and finishes with a catalogue of fallacious proofs so that you can recognize bad reasoning, including your own.

5.14.1 The vocabulary of mathematical texts#

Term What it is Role
Definition an agreement on how a word is used not provable or refutable; it fixes meaning. "Even" means ∃k (n = 2k).
Axiom / postulate a statement accepted without proof within a theory the starting points
Theorem an important statement that has been proved the main results
Proposition a (usually less central) proved statement
Lemma a proved statement used as a stepping stone
Corollary a statement that follows quickly from a theorem
Claim a statement made inside a proof, then proved
Conjecture a statement believed true, not yet proved Goldbach, twin primes
Remark / Note / Example commentary
Counterexample an instance showing a universal statement false

Anatomy of a theorem. Every theorem is, logically, Hypotheses ⇒ Conclusion, usually with hidden universal quantifiers.

"The sum of two even integers is even."

Hidden form: ∀m ∈ ℤ ∀n ∈ ℤ ((Even(m) ∧ Even(n)) → Even(m + n)).

"If a function is differentiable then it is continuous."

Hidden form: ∀f ((Differentiable(f) → Continuous(f))), with more hidden quantifiers inside the definitions (continuity has ∀ε ∃δ ∀x).

Always make hidden quantifiers explicit. "x² ≥ 0" is the statement ∀x ∈ ℝ, x² ≥ 0; "the equation x² = 2 has a solution" is ∃x ∈ ℝ, x² = 2. A statement with no stated quantifier on a variable is usually universal in a theorem and usually existential only when it says "has a", "there is".

"If", "only if", "if and only if", "iff".

Phrase Logical form
"A if B" B → A
"A only if B" A → B
"A if and only if B" (iff) A ↔ B: prove both A → B and B → A
"A is necessary for B" B → A
"A is sufficient for B" A → B
"The following are equivalent: (a), (b), (c)" prove a cycle (a) → (b) → (c) → (a)

5.14.2 A procedure that works for (almost) every proof#

Step 0: Read and understand. Read the statement slowly. Is every word defined? Try a few concrete examples and a few non-examples. Draw a picture if there is one.

Step 1: Formalize the statement. Write it with quantifiers and connectives, even roughly. Identify the hypotheses (what you may assume) and the goal (what you must show).

Step 2: Unpack the definitions. Replace each defined term by its definition, both in the hypotheses and in the goal. Most proofs become routine after this.

Step 3: Choose the shape from the goal. Use the table below.

Step 4: Scratch work. Work backwards from the goal and forwards from the hypotheses on scrap paper. Find the key idea (the witness, the case split, the inequality). Scratch work is not the proof.

Step 5: Write the proof forward. From the assumptions to the conclusion, each sentence justified. Introduce every variable.

Step 6: Check. Re-read it as a skeptic. Did every ∀ start with "let ... be arbitrary"? Every ∃ have a witness? Every case covered? Is every use of the induction hypothesis marked? Was an assumption smuggled in?

The shape table: goal form ⇒ first move#

The goal looks like Standard first move Rule behind it
∀x P(x) "Let x be arbitrary." Prove P(x). ∀I
∀x ∈ S, P(x) "Let x ∈ S be arbitrary." ∀I + →I
∃x P(x) Find (construct) a witness t; show P(t). Or argue non-constructively. ∃I
A → B "Assume A." Prove B. (Or contrapositive: assume ¬B, prove ¬A.) →I
A ↔ B Prove A → B and B → A separately. ↔I
A ∧ B Prove A. Prove B. ∧I
A ∨ B Assume ¬A and prove B (equivalently the reverse). Or cases. ¬A → B
¬A "Suppose A." Derive an absurdity. ¬I
∃!x P(x) Existence and uniqueness: show P(t) and P(a) ∧ P(b) → a = b. ∃I, ∀I
A = B (sets) Show A ⊆ B and B ⊆ A (double inclusion). ↔I
A ⊆ B "Let x ∈ A." Show x ∈ B. ∀I, →I
f injective "Assume f(a) = f(b)." Show a = b. ∀I, →I
f surjective "Let y ∈ Y." Exhibit x with f(x) = y. ∀I, ∃I
P(n) for all n induction
Atomic statement, nothing works proof by contradiction RAA
What you have Standard first move Rule behind it
∀x P(x) instantiate at useful terms ∀E
∃x P(x) "Let a be such that P(a)." ∃E
A → B when you get A, you get B →E
A ∨ B split into cases ∨E
A ∧ B use both ∧E
¬A combine with A to get ⊥ ¬E
A ↔ B replace one by the other ↔E
x = y substitute =E

5.14.3 Catalogue of techniques with skeletons#

Each skeleton is a fill-in-the-blanks outline. ⟨…⟩ marks what you supply.

Direct proof#

text
Claim: if ⟨A⟩ then ⟨B⟩.
Proof. Assume ⟨A⟩. By definition, ⟨unpack A⟩.
       ⟨chain of justified steps⟩
       Hence ⟨B⟩. ∎

Example. If a ∣ b and b ∣ c then a ∣ c. Proof. Assume a ∣ b and b ∣ c. By definition there are integers j, k with b = aj and c = bk. Then c = (aj)k = a(jk), and jk is an integer, so a ∣ c. ∎

Contrapositive#

text
Claim: if ⟨A⟩ then ⟨B⟩.
Proof. We prove the contrapositive: if not ⟨B⟩ then not ⟨A⟩.
       Assume not ⟨B⟩. ⟨...⟩ Hence not ⟨A⟩. ∎

Use when ¬B is easier to use than A. Typical: statements with "even/odd", "divisible", "irrational".

Example. If n² − 6n + 5 is even, then n is odd. Proof. Contrapositive: if n is even then n² − 6n + 5 is odd. Let n = 2k. Then n² − 6n + 5 = 4k² − 12k + 5 = 2(2k² − 6k + 2) + 1, which is odd. ∎

Contradiction#

text
Claim: ⟨A⟩.
Proof. Suppose, for contradiction, that not ⟨A⟩. 
       ⟨...⟩ derive a statement ⟨C⟩ and also not ⟨C⟩ (or something false).
       This contradiction shows ⟨A⟩. ∎

Example (irrational √2 in the main text); another: there is no largest integer. Suppose N is the largest integer. Then N + 1 is an integer larger than N: contradiction. ∎

Contradiction is the technique for proving negative statements ("there is no...", "is irrational", "cannot") and uniqueness/infinitude statements. Beware of dressing a direct proof as a contradiction.

Cases (exhaustive)#

text
Claim: ⟨C⟩ for all x.
Proof. Cases: Case 1: ⟨D₁⟩.  Case 2: ⟨D₂⟩.  (Exhaustive because ⟨D₁ ∨ D₂ holds⟩.)
       Case 1. ⟨...⟩ ⟨C⟩.   Case 2. ⟨...⟩ ⟨C⟩. ∎

Example. For every real x, |x| ≥ x. Case x ≥ 0: |x| = x ≥ x. Case x < 0: |x| = −x > 0 > x. ∎

Without loss of generality (WLOG). If the problem is symmetric (e.g. in a and b), you may prove the case a ≤ b and say "the case b ≤ a is identical by symmetry". Use sparingly, and only when the symmetry is genuinely there (swapping the names really gives the same problem).

Existence#

Constructive: give the witness and verify. "There is an integer between 3 and 4.5: take 4." Non-constructive: show that non-existence is impossible. Classic: there exist irrational a, b with aᵇ rational. Consider √2^√2. If rational, take a = b = √2. If irrational, take a = √2^√2, b = √2: aᵇ = (√2^√2)^√2 = √2² = 2. Either way a pair exists, but the proof does not say which case holds.

Uniqueness#

text
Claim: there is exactly one x with ⟨P(x)⟩.
Proof. Existence: ⟨exhibit x, check P⟩.
       Uniqueness: Suppose P(a) and P(b). ⟨...⟩ Hence a = b. ∎

Counterexample#

To refute ∀x P(x), exhibit one x with ¬P(x), and check carefully that it really is a counterexample. "Every prime is odd" is false: 2 is prime and even.

To refute an implication A → B, exhibit a case where A holds and B fails.

Proof of an "if and only if"#

text
Claim: ⟨A⟩ iff ⟨B⟩.
Proof. (⇒) Assume ⟨A⟩. ⟨...⟩ Hence ⟨B⟩.
       (⇐) Assume ⟨B⟩. ⟨...⟩ Hence ⟨A⟩. ∎

Alternative: a chain of equivalences A ⇔ A₁ ⇔ A₂ ⇔ B, each step justified in both directions. Use only when each step is a genuine equivalence.

Proof of "the following are equivalent"#

For (a), (b), (c) prove (a) ⇒ (b), (b) ⇒ (c), (c) ⇒ (a). Three implications instead of six.

Pigeonhole principle#

If n + 1 objects are put into n boxes, some box holds at least two. (More generally, m objects into n boxes: some box has at least ⌈m/n⌉.) In logic: for a function f : A → B with |A| > |B| (finite), f is not injective.

Example. Among any 13 people, two share a birth month. (13 people, 12 months.) Example (less obvious). Among any n + 1 integers there are two whose difference is divisible by n: look at their remainders mod n (only n possible remainders). ∎

Extremal principle and minimal counterexample#

If a statement is false for some natural numbers, there is a smallest counterexample (well-ordering principle). Derive a contradiction by finding an even smaller one.

Example. Every integer n ≥ 2 has a prime divisor. Suppose not, and let n be the least counterexample. n is not prime (else n divides itself), so n = ab with 1 < a < n. By minimality a has a prime divisor p, which also divides n. Contradiction. ∎

Infinite descent#

A variant: if from a solution in positive integers you can always build a smaller solution, there is no solution (an infinite decreasing sequence of positive integers is impossible). Classic: √2 irrational, via "if p² = 2q² with positive integers, then (2q − p, p − q) is a smaller solution to p² = 2q²".

Proof by construction vs proof by existence argument#

A construction gives an algorithm for the object; an existence argument only proves it exists. A mathematician's taste favours constructive proofs, and proof assistants (Chapter 2.9.8) make the difference visible: constructive proofs are programs.

Proof by induction#

See 5.14.4.

Proof by exhaustion and computer assistance#

When the set of cases is finite and small, check each. When large, a computer may do it (four-colour theorem, 1976/2005 formally verified in Coq; Kepler conjecture, formal proof 2014; the "Boolean Pythagorean triples" problem, 2016, with a proof certificate of about 200 terabytes). Such proofs rely on formal logic engines, exactly the subject of Chapters 7-8.

5.14.4 Induction in complete detail#

The idea. To prove ∀n ≥ n₀, P(n) you cannot check infinitely many cases, but you can prove a ladder: the first rung (base case) and the step from each rung to the next (inductive step). Climbing is then automatic.

The forms of induction#

Form Statement Use when
Weak (ordinary) induction P(n₀) and ∀n ≥ n₀ (P(n) → P(n+1)) ⟹ ∀n ≥ n₀ P(n) step from n to n+1 uses only P(n)
Strong (complete) induction ∀n ≥ n₀ ((∀k, n₀ ≤ k < n → P(k)) → P(n)) ⟹ ∀n ≥ n₀ P(n) step may use any earlier case; recursive splits (divide into two parts)
Multiple base cases prove P(n₀), …, P(n₀+r−1); step from the previous r cases recurrences of order r (Fibonacci needs 2)
Induction with a shifted base start at any n₀ statements true only from n₀ on
Two-variable induction induct on n for fixed m, then on m; or on m + n statements about pairs
Induction on a strengthened statement prove a stronger Q(n) that implies P(n) when the plain statement's IH is too weak (tiling problem, 5.14)
Structural induction base: atoms/leaves; step: each constructor formulas, trees, lists, programs
Well-founded induction induction over any well-founded order (no infinite descending chains) termination proofs, lexicographic orders
Transfinite induction along ordinals set theory
Induction on derivations on the proof tree soundness (Chapter 6)
Backward ("Cauchy") induction prove for infinitely many n, then downwards AM-GM inequality

Why induction is valid#

The three statements below are equivalent (given the other axioms of the natural numbers):

  1. Weak induction
  2. Strong induction
  3. The well-ordering principle: every non-empty set of natural numbers has a least element.

Sketch of (3) ⇒ (1): Suppose the base case and the step hold but P(n) fails for some n. The set of counterexamples is non-empty, so it has a least element m. m ≠ n₀ (the base case holds), so m − 1 is not a counterexample, i.e. P(m − 1) holds, and the step gives P(m): contradiction. ∎

Strong ⇒ weak: trivial (weak is the special case where only P(n − 1) is used). Weak ⇒ strong: apply weak induction to Q(n) := ∀k ≤ n P(k).

The template (write it every time)#

text
Claim. For all n ≥ n₀, P(n), where P(n) is the statement ⟨…⟩.
Proof. By induction on n.
  Base case (n = n₀). ⟨verify P(n₀) directly⟩.
  Inductive step. Let n ≥ n₀ and assume P(n) (the induction hypothesis, IH).
       We must show P(n + 1). ⟨…use IH here, say so…⟩ 
  By induction, P(n) holds for all n ≥ n₀. ∎

Worked examples#

Example A (geometric sum). For r ≠ 1 and n ≥ 0: 1 + r + r² + ⋯ + rⁿ = (rⁿ⁺¹ − 1)/(r − 1).

Proof. P(n) is that identity. Base n = 0: LHS = 1, RHS = (r − 1)/(r − 1) = 1. ✔ Step. Assume P(n). Then 1 + ⋯ + rⁿ + rⁿ⁺¹ = (rⁿ⁺¹ − 1)/(r − 1) + rⁿ⁺¹ (IH) = (rⁿ⁺¹ − 1 + rⁿ⁺¹(r − 1))/(r − 1) = (rⁿ⁺² − 1)/(r − 1), which is P(n + 1). ∎

Example B (an inequality, Bernoulli). For x ≥ −1 and n ≥ 0: (1 + x)ⁿ ≥ 1 + nx.

Proof. Base n = 0: 1 ≥ 1. Step. Assume (1 + x)ⁿ ≥ 1 + nx. Since 1 + x ≥ 0, multiplying by 1 + x preserves the inequality: (1 + x)ⁿ⁺¹ ≥ (1 + x)(1 + nx) = 1 + (n + 1)x + nx² ≥ 1 + (n + 1)x, because nx² ≥ 0. ∎ (Note exactly where x ≥ −1 is used: to multiply an inequality by 1 + x.)

Example C (strong induction: binary representation). Every integer n ≥ 1 is a sum of distinct powers of 2.

Proof (strong induction). Let n ≥ 1 and assume the claim for all k with 1 ≤ k < n. If n = 1 = 2⁰, done. If n > 1, let 2^j be the largest power of 2 with 2^j ≤ n, so 2^j ≤ n < 2^(j+1). If n = 2^j, done. Otherwise m = n − 2^j satisfies 1 ≤ m < 2^j; by the IH m is a sum of distinct powers of 2, each at most m < 2^j, hence different from 2^j. Adding 2^j gives such a sum for n. ∎

Example D (structural induction: binary trees). A full binary tree is either a single leaf, or a root with two full binary trees as children. Claim: a full binary tree has exactly one more leaf than it has internal nodes.

Proof. Base (single leaf): 1 leaf, 0 internal nodes: 1 = 0 + 1. ✔ Step: a tree with root r and subtrees T₁, T₂. By IH T₁ has L₁ = I₁ + 1 leaves and T₂ has L₂ = I₂ + 1. The new tree has L₁ + L₂ leaves and I₁ + I₂ + 1 internal nodes (the root is internal). Then L₁ + L₂ = I₁ + I₂ + 2 = (I₁ + I₂ + 1) + 1. ✔ ∎

Example E (a recurrence, two base cases). Let a₀ = 1, a₁ = 2, and aₙ₊₂ = 5aₙ₊₁ − 6aₙ. Compute a few terms: a₂ = 10 − 6 = 4, a₃ = 20 − 12 = 8, a₄ = 40 − 24 = 16. The pattern suggests aₙ = 2ⁿ.

Claim. aₙ = 2ⁿ for all n ≥ 0.

Proof. Induction with two base cases, because the recurrence looks back two places. Base: a₀ = 1 = 2⁰ and a₁ = 2 = 2¹. Step: let n ≥ 0 and assume aₙ = 2ⁿ and aₙ₊₁ = 2ⁿ⁺¹ (both are needed). Then aₙ₊₂ = 5·2ⁿ⁺¹ − 6·2ⁿ = 10·2ⁿ − 6·2ⁿ = 4·2ⁿ = 2ⁿ⁺². ✔ ∎

(Lesson: compute small cases first to guess the formula, and test the guess against the base cases before trying to prove it. A wrong formula cannot be proved, and trying wastes time. If the base cases had given a₁ = 3, the pattern 2ⁿ would have failed immediately.)

Strengthening the induction hypothesis#

Sometimes P(n) is true but the step cannot be proved because the IH is too weak. The remedy is to prove a stronger statement Q(n).

Example. Claim: 1 + 1/4 + 1/9 + ⋯ + 1/n² < 2 for all n ≥ 1. Trying to prove it directly fails (adding 1/(n+1)² to something < 2 need not stay < 2). Strengthen to Q(n): the sum is ≤ 2 − 1/n. Base: 1 ≤ 1. Step: sum for n+1 is ≤ 2 − 1/n + 1/(n+1)², and 1/(n+1)² < 1/(n(n+1)) = 1/n − 1/(n+1), so the sum is < 2 − 1/n + 1/n − 1/(n+1) = 2 − 1/(n+1). ✔ Hence Q(n) for all n, and Q(n) implies the original claim. ∎

Common pitfalls (extended list)#

Pitfall Example / explanation
Missing or false base case "n = n + 1": the step holds (add 1 to both sides) but no base case
Wrong base case claim for n ≥ 0 but only n = 1 checked
Assuming what you want to prove using P(n + 1) inside the proof of the step
Proving the step only for particular n the step must hold for arbitrary n ≥ n₀
Hidden dependence on n being large "all horses have the same colour": step fails at n = 1
Not enough base cases for strong induction step reaches back r places ⇒ r base cases
Induction variable confusion induction on n for a statement with two variables; the IH must apply to the same other variables or be quantified (∀m)
Mixing up n and n + 1 indices check by writing P(n + 1) explicitly
Using induction when not needed a direct argument may be simpler
Forgetting to say what P(n) is always define it

5.14.5 Proofs about sets, functions and relations#

These proofs are mechanical: a definition unfolds into a quantified statement and the skeleton from the shape table does the rest.

Sets (element-chasing)#

text
To prove A ⊆ B:    Let x ∈ A be arbitrary. ⟨…⟩ Hence x ∈ B.
To prove A = B:    Show A ⊆ B and B ⊆ A.
To prove A ∩ B ⊆ C:   Let x ∈ A ∩ B. Then x ∈ A and x ∈ B. ⟨…⟩ x ∈ C.

Example 1. (A ∖ B) ∩ B = ∅. Proof. Suppose x ∈ (A ∖ B) ∩ B. Then x ∈ A ∖ B (so x ∉ B) and x ∈ B: contradiction. So no such x exists. ∎

Example 2 (De Morgan for sets). (A ∩ B)ᶜ = Aᶜ ∪ Bᶜ (complement in a universe U). Proof. For arbitrary x ∈ U: x ∈ (A ∩ B)ᶜ ⇔ ¬(x ∈ A ∧ x ∈ B) ⇔ x ∉ A ∨ x ∉ B ⇔ x ∈ Aᶜ ∪ Bᶜ. ∎ (Set identities are propositional laws applied to membership statements.)

Example 3 (power set). If A ⊆ B then 𝒫(A) ⊆ 𝒫(B). Proof. Let X ∈ 𝒫(A); then X ⊆ A ⊆ B, so X ⊆ B (transitivity of ⊆), i.e. X ∈ 𝒫(B). ∎

Russell's paradox as a proof. There is no set R with ∀x (x ∈ R ↔ x ∉ x). Proof. Suppose R is such a set. Instantiate x := R: R ∈ R ↔ R ∉ R. Impossible (P ↔ ¬P). ∎ (This is Chapter 4, Example 6 with R(x, y) := y ∈ x.)

Functions#

Let f : X → Y, g : Y → Z.

Property To prove it
f injective assume f(a) = f(b), show a = b
f surjective given y, find x with f(x) = y
f bijective both
g ∘ f injective/surjective usually: unpack, apply the properties of f and g in turn
f has an inverse show bijective; define f⁻¹(y) = the unique x with f(x) = y

Example 4. If f : X → Y and g : Y → Z are injective, so is g ∘ f. Proof. Let g(f(a)) = g(f(b)). Since g is injective, f(a) = f(b). Since f is injective, a = b. ∎

Example 5 (a bijection). h : ℝ → ℝ, h(x) = 2x + 3 is bijective. Injective: 2a + 3 = 2b + 3 ⇒ a = b. Surjective: given y, take x = (y − 3)/2; then h(x) = y. ∎

Example 6 (images and preimages). f(A ∩ B) ⊆ f(A) ∩ f(B), but equality can fail for non-injective f. Proof of ⊆: if y ∈ f(A ∩ B), then y = f(x) with x ∈ A ∩ B, so y ∈ f(A) and y ∈ f(B). Counterexample for ⊇: f(x) = x², A = {−1}, B = {1}: f(A ∩ B) = f(∅) = ∅, but f(A) ∩ f(B) = {1}. ∎

Relations#

An equivalence relation is reflexive, symmetric, transitive; to prove ~ is one, prove all three.

Example 7. On ℤ define a ≡ b (mod n) iff n ∣ (a − b). Reflexive: n ∣ 0. Symmetric: if n ∣ (a − b), then n ∣ −(a − b) = (b − a). Transitive: if n ∣ (a − b) and n ∣ (b − c), then n ∣ (a − b) + (b − c) = (a − c). ∎

Equivalence classes partition. If ~ is an equivalence relation on S, then the classes [a] = {x : x ~ a} are pairwise disjoint or equal, and cover S. Proof of "disjoint or equal": suppose z ∈ [a] ∩ [b], so z ~ a and z ~ b. By symmetry and transitivity, a ~ b. Then for any x ∈ [a]: x ~ a ~ b, so x ∈ [b]; similarly [b] ⊆ [a]. ∎

5.14.6 Proofs about ε-δ and limits (in more detail)#

The general shape of an ε-δ limit proof: lim_{x → a} f(x) = L means ∀ε > 0 ∃δ > 0 ∀x (0 < |x − a| < δ → |f(x) − L| < ε).

text
Proof. Let ε > 0 be given.
       Choose δ = ⟨expression in ε⟩ (found by scratch work). Note δ > 0.
       Let x be such that 0 < |x − a| < δ.
       Then |f(x) − L| = ⟨…⟩ < ε. ∎

Scratch work for lim_{x → 2} x² = 4: |x² − 4| = |x − 2||x + 2|. To control |x + 2|, first restrict |x − 2| < 1, so 1 < x < 3 and |x + 2| < 5. Then |x² − 4| < 5|x − 2|. We want < ε, so ask |x − 2| < ε/5. Take δ = min(1, ε/5).

Proof. Let ε > 0. Put δ = min(1, ε/5) > 0. If 0 < |x − 2| < δ, then |x − 2| < 1 gives |x + 2| < 5, and |x − 2| < ε/5, so |x² − 4| = |x − 2||x + 2| < (ε/5)·5 = ε. ∎

Negating the definition (proving a limit does not exist or is not L). ¬∀ε ∃δ ∀x … becomes ∃ε > 0 ∀δ > 0 ∃x (0 < |x − a| < δ ∧ |f(x) − L| ≥ ε). To use it: you pick ε (cleverly), then for each δ that the adversary names, you produce an x.

5.14.7 Mathematical writing: style and phrases#

Intention Phrase
begin an arbitrary argument "Let x be an arbitrary element of S."
assume the hypothesis "Assume (Suppose) that ..."
introduce a witness "Since ∃x P(x), choose a such that P(a)."
state what you will prove "We must show that ..." / "It suffices to show that ..."
use a definition "By definition, ..."
a derived fact "Hence", "Therefore", "Thus", "It follows that"
a cause "Because", "Since"
case split "We distinguish two cases."
contradiction "Suppose, for contradiction, that ... This contradicts ..."
contrapositive "We prove the contrapositive."
induction "We argue by induction on n."
end "This completes the proof." / ∎ / □
caution avoid "clearly", "obviously", "trivially" unless truly so; they hide gaps

Quantifier discipline in prose. Never use a variable before introducing it. Never reuse a letter for two different objects in the same scope. Say "for every ε > 0 there is δ > 0 such that" with the order intact, because the order of quantifiers is the content.

Learning to see a false proof is learning logic. For each, find the error before reading the diagnosis.

1. "1 = 2". Let a = b. Then a² = ab, a² − b² = ab − b², (a + b)(a − b) = b(a − b). Cancel (a − b): a + b = b; since a = b, 2b = b, so 2 = 1. Error: dividing by a − b = 0. (A false step hides inside an equivalence-looking chain.)

2. Circular reasoning. "Claim: √2 is irrational. Proof: √2 is not a fraction, hence irrational." Error: assumes the conclusion in other words.

3. The converse. "If n is even then n² is even. Since n² is even, n is even." Error: uses the converse. (The converse is true here, but needs its own proof, via contrapositive.)

4. Generalizing from examples. "n² + n + 41 is prime for n = 0, 1, …, 39, so for all n." Error: examples never prove a universal. (For n = 40: 40² + 40 + 41 = 1681 = 41².)

5. Illegal ∀I. "Let x be an even integer; x = 2k. So every integer is of the form 2k." Error: the name x was assumed even, so it is not arbitrary.

6. Quantifier swap. "For every integer n there is an integer m with m > n. So there is an integer m with m > n for all n." Error: ∀∃ turned into ∃∀.

7. Illegal use of WLOG. "To show that a/b ≥ 1 for all positive reals a, b, assume without loss of generality that a ≥ b." Error: the statement is not symmetric: swapping a and b turns it into b/a ≥ 1, a different claim (and the original claim is false for a < b). WLOG is allowed only when swapping the names gives the same statement.

8. Horse fallacy (induction): see 5.11.

9. Hidden assumption. "Let x be a real number. Then x² ≥ x." Error: false for 0 < x < 1. (A tacit assumption x ≥ 1.)

10. Equality sign abuse. "(−1)(−1) = 1, so (−1)(−1) = 1 = √1 = √((−1)(−1)) = √(−1)√(−1) = i·i = −1." Error: √(ab) = √a√b holds only for non-negative a, b.

5.14.9 Quick-check (with answers)#

Q1. Write the hidden quantifiers of "If x > 1 then x² > x". Q2. Which technique would you try first for: (a) "if n² is divisible by 5 then n is divisible by 5"; (b) "there are infinitely many primes of the form 4k + 3" (hint: like Euclid); (c) "A ∪ B = B ∪ A"; (d) "∑ᵢ₌₁ⁿ i³ = (n(n+1)/2)²"? Q3. What exactly is wrong with: "Base case n = 1 ✔. Step: assume P(n). Then P(n + 1) because P(n + 1) is P(n) with n replaced by n + 1." Q4. What does the proof of an "iff" require? Q5. How many base cases does a strong-induction proof need if the step reaches back to n − 3? Q6. Negate: "f is injective." Q7. What is a minimal counterexample argument?

Answers. A1. ∀x ∈ ℝ (x > 1 → x² > x). A2. (a) contrapositive (if n is not divisible by 5 then n² is not); or cases on the remainder mod 5. (b) contradiction (assume finitely many, consider 4p₁⋯pₙ − 1). (c) element-chasing, or the commutativity of ∨. (d) induction. A3. It "proves" P(n + 1) by renaming, not by argument: the step must actually derive P(n + 1) from P(n) using algebra or reasoning. A4. Both directions, A → B and B → A, each with its own argument. A5. Three base cases, n₀, n₀ + 1, n₀ + 2. Then every n ≥ n₀ + 3 has n − 3 ≥ n₀, so the step can look back three places. (In general: reaching back r places needs r base cases, as in the 4a + 5b example, which needed four.) A6. ∃a ∃b (f(a) = f(b) ∧ a ≠ b). A7. Assume the statement fails for some natural number; take the least such; derive a contradiction using the statement's truth for smaller values.

Problems for Chapter 5#

5.1 ★ Prove: the sum of two odd integers is even.

5.2 ★ Prove: if n² is odd then n is odd. (Hint: which technique?)

5.3 ★ Prove: the product of two odd integers is odd.

5.4 ★★ Prove: if n is an integer and n² is divisible by 3, then n is divisible by 3. Deduce that √3 is irrational.

5.5 ★★ Prove: if q is a nonzero rational and r is irrational, then q·r is irrational. (Is the same true for q + r? For r + s with both irrational?)

5.6 ★★ Prove by cases: for all integers n, n(n + 1) is even.

5.7 ★★ Prove by induction: 1² + 2² + ··· + n² = n(n + 1)(2n + 1)/6.

5.8 ★★ Prove by induction: for all n ≥ 0, 2ⁿ⁺¹ − 1 = 1 + 2 + 4 + ··· + 2ⁿ.

5.9 ★★ Prove by induction: for all n ≥ 5, 2ⁿ > n². (Mind the base case!)

5.10 ★★ Let F₁ = F₂ = 1 and Fₙ₊₂ = Fₙ₊₁ + Fₙ. Prove F₁ + F₂ + ··· + Fₙ = Fₙ₊₂ − 1.

5.11 ★★ Prove the set identities: (a) A ⊆ B ⇔ A ∩ B = A; (b) (A ∪ B)ᶜ = Aᶜ ∩ Bᶜ.

5.12 ★★ Prove: if f: X → Y and g: Y → Z are both surjective, then g ∘ f is surjective. And: if f has a right inverse h (f(h(y)) = y for all y), then f is surjective.

5.13 ★★ Prove: every integer n ≥ 2 has a prime divisor. (Strong induction or well-ordering.)

5.14 ★★★ Prove: for every n ≥ 1, a 2ⁿ × 2ⁿ chessboard with one square removed can be tiled by L-shaped trominoes. (Induction, and the strengthened hypothesis matters: it must hold for any removed square.)

5.15 ★★★ Find the error in this "proof" that all horses have the same color: "Induct on the number of horses. One horse: trivial. Assume any n horses have the same color. Given n + 1 horses, remove one: the remaining n have the same color; remove a different one: those n also have the same color. The two groups overlap, so all n + 1 have the same color."

5.16 ★★★ Prove using the ε-δ definition: lim_{x → 2} x² = 4. (Hint: restrict δ ≤ 1 first to bound |x + 2|, then choose δ = min(1, ε/5).)

5.17 ★★★ Prove Cantor's theorem for A = ℕ by constructing the diagonal set explicitly, then explain in one paragraph why the argument is the barber paradox.


Chapter 6. Metatheory: what logic can and cannot do ↑ Top#

This chapter is more conceptual. You should be able to state each theorem precisely, explain why it matters, and prove the easy ones. (The big proofs, notably completeness, are in Enderton or Huth-Ryan; sketches are given here.)

6.1 Soundness and completeness#

Recall: Γ ⊨ A (semantic): every model of Γ satisfies A. Γ ⊢ A (syntactic): there is a derivation of A from Γ.

Theorem Statement Meaning
Soundness Γ ⊢ A ⇒ Γ ⊨ A The proof system proves only truths
Completeness (Gödel 1929) Γ ⊨ A ⇒ Γ ⊢ A The proof system proves all truths (of this kind)

Soundness proof idea (structural induction on derivations). Show every rule preserves the property "if all premises are true in M, so is the conclusion". For ∧I: if Γ ⊨ A and Γ ⊨ B, then any model of Γ satisfies both A and B, hence A ∧ B. For →I: use the semantic deduction theorem (F2). For ∀I: the freshness condition is exactly what makes the argument go through, since a name about which nothing is assumed can be reinterpreted as any element. This is why every side condition matters.

Completeness proof idea (Henkin). Suppose Γ ⊬ A. Then Γ ∪ {¬A} is consistent. Extend it to a maximal consistent set that also has "witnesses" for existentials (add new constants c with ∃x B → B[c/x]). Then build a model whose domain is made of the terms themselves. This model satisfies Γ ∪ {¬A}, so Γ ⊭ A.

Why this is remarkable. Truth quantifies over all structures (a vast, infinite notion). Completeness says that finite, checkable derivations suffice to capture it. For second-order logic this fails (no complete proof system).

6.2 Consistency, theories, and compactness#

Compactness theorem. A set Γ of sentences is satisfiable iff every finite subset of Γ is satisfiable.

Why it follows from completeness: if Γ were unsatisfiable, then Γ ⊢ ⊥, and the derivation uses only finitely many premises.

Consequences:

6.3 Löwenheim-Skolem#

If a countable first-order theory has an infinite model, it has a model of every infinite cardinality. In particular, ZFC (if consistent) has a countable model, which thinks it contains uncountable sets (the Skolem paradox). FOL cannot distinguish "countable" from "uncountable".

6.4 Decidability#

Logic Is validity decidable?
Propositional Yes (truth tables, SAT algorithms; the problem is co-NP-complete)
Monadic FOL (only unary predicates) Yes
FOL, Bernays-Schönfinkel fragment (satisfiability of ∃∀ sentences, no function symbols; validity of the dual ∀∃ class) Yes
Full FOL No (Church-Turing 1936). But validity is semi-decidable: a program can enumerate all proofs and halt when it finds one.

Semi-decidable means: if the formula is valid, a prover will eventually find a proof. If it is not valid, the prover may run forever. This is why every real prover needs timeouts, and why "the prover didn't answer" never proves invalidity.

The theorem connects to everything above: completeness gives you the enumeration of proofs (hence semi-decidability), and the Church-Turing reduction shows no algorithm can always decide.

6.5 Gödel's incompleteness theorems#

Do not confuse these with the completeness theorem (different notion of "complete").

Not contradictory with completeness: completeness says "true in all models of T ⇔ provable in T". G is true in some models of T and false in others (e.g., non-standard ones), so it is not true in all models, so nothing contradicts. What fails is that no first-order theory of arithmetic can make ℕ the only model.

6.6 Other semantic and syntactic notions worth knowing#

6.7 Chapter 6 in complete detail (the from-zero companion)#

Chapter 6 states the big theorems about logic. This companion explains what is being claimed and why it is plausible, proves the easy parts completely, gives the proof of completeness in checkable steps, builds the computability background you need for decidability and Gödel, explains Gödel's theorems properly (and the misconceptions around them), and opens the door to other logics (modal, many-valued, and more) so that you know where to go after this course.

6.7.1 Why study logic itself? The two levels again#

Until now you have used logic: you proved theorems inside a proof system. Metatheory (metalogic) proves theorems about proof systems and about the languages they describe. The questions:

Question Meaning
Soundness Can the system prove something false?
Completeness Is there something true that the system can't prove?
Consistency Can the system prove a contradiction?
Decidability Is there an algorithm that, given A, tells whether it is provable?
Expressiveness What can the language say (and not say)?
Categoricity Do the axioms pin down one structure?
Compactness, interpolation, definability structural properties of the logic

Vocabulary of theories#

Term Definition
Theory T a set of sentences (axioms), often taken closed under consequence
Th(T) or Cn(T) the deductive closure: all sentences A with T ⊢ A
Mod(T) the class of all structures that satisfy every sentence of T
Th(M) the complete theory of a structure M: all sentences true in M
Consistent T ⊬ ⊥
Complete (of a theory) for every sentence A: T ⊢ A or T ⊢ ¬A (do not confuse with completeness of a proof system!)
Axiomatizable / recursively axiomatizable the axioms can be listed (generated) by an algorithm
Decidable theory {A : T ⊢ A} is a decidable set
Conservative extension T' ⊇ T proves no new sentences in the language of T
Definitional extension adds new symbols with defining axioms (conservative)
Categorical all models are isomorphic; κ-categorical: all models of cardinality κ are isomorphic
Elementary equivalence M ≡ N Th(M) = Th(N)
Independent sentence neither A nor ¬A follows from T (e.g. the continuum hypothesis for ZFC)

Two different "completenesses". (1) Completeness of a proof system (Gödel 1929): everything valid is provable. (2) Completeness of a theory: every sentence is decided. Gödel's incompleteness theorems are about sense (2).

6.7.2 Soundness proved in full (propositional natural deduction)#

Theorem. If Γ ⊢ A then Γ ⊨ A.

Setup. A derivation is a sequence of lines. For each line n let Γₙ be the set of formulas that are open at that line: the premises plus the assumptions of all boxes enclosing line n. Claim (by strong induction on the line number): for every line n with formula Aₙ, we have Γₙ ⊨ Aₙ.

The theorem follows: at the last line (depth 0) Γₙ is the set of premises and Aₙ is the conclusion.

Cases (by the rule justifying line n):

  1. Premise or assumption. Aₙ ∈ Γₙ, so every valuation making Γₙ true makes Aₙ true. ✔
  2. ∧I from lines i, j with Aₙ = Aᵢ ∧ Aⱼ. Here Γᵢ ⊆ Γₙ and Γⱼ ⊆ Γₙ (lines i, j are visible at n). By IH, Γᵢ ⊨ Aᵢ and Γⱼ ⊨ Aⱼ. A valuation satisfying Γₙ satisfies Γᵢ and Γⱼ, hence Aᵢ and Aⱼ, hence Aᵢ ∧ Aⱼ. ✔ (Uses monotonicity: more premises can only help.)
  3. ∧E, ∨I, →E, ↔E: the same style: a valuation satisfying Γₙ satisfies the cited lines (by IH), hence the conclusion by the truth table.
  4. →I from a box [i … j] with Aᵢ = A, Aⱼ = B, Aₙ = A → B. In the box Γⱼ = Γₙ ∪ {A}, so the IH gives Γₙ ∪ {A} ⊨ B. Take v ⊨ Γₙ. If v ⊭ A then A → B is true. If v ⊨ A then v ⊨ Γₙ ∪ {A}, so v ⊨ B. Either way v ⊨ A → B. ✔ (This is the semantic deduction theorem F2.)
  5. ∨E from A ∨ B and boxes with A ⊢ C and B ⊢ C: IH gives Γₙ ⊨ A ∨ B, Γₙ ∪ {A} ⊨ C, Γₙ ∪ {B} ⊨ C. Take v ⊨ Γₙ. Then v ⊨ A or v ⊨ B; in either case v satisfies C. ✔
  6. ¬I from a box with A ⊢ ⊥: IH gives Γₙ ∪ {A} ⊨ ⊥, so no valuation satisfies Γₙ ∪ {A}. Hence every v ⊨ Γₙ has v ⊭ A, i.e. v ⊨ ¬A. ✔
  7. ¬E from lines A and ¬A: the IH gives Γₙ ⊨ A and Γₙ ⊨ ¬A. A valuation satisfying Γₙ would satisfy both A and ¬A, which is impossible; so Γₙ has no model, and Γₙ ⊨ ⊥ holds vacuously. ✔
  8. ⊥E from ⊥: Γₙ ⊨ ⊥ means Γₙ has no model, so Γₙ ⊨ C vacuously. ✔
  9. RAA from a box ¬A ⊢ ⊥: Γₙ ∪ {¬A} has no model, so every model of Γₙ satisfies A. ✔ (This is the step that uses classical two-valued semantics.)

∎ This proof is short because the rules are designed to mirror the semantics. For first-order logic the new cases are ∀I and ∃E, handled by the reinterpretation argument of 4.7.6, plus ∀E, ∃I (substitution lemma: ⟦A[t/x]⟧_s = ⟦A⟧_{s[x ↦ ⟦t⟧]}) and the equality rules.

Corollary (consistency). If Γ has a model, then Γ ⊬ ⊥. (If Γ ⊢ ⊥, soundness gives Γ ⊨ ⊥, so Γ has no model.) This is how one proves, say, that group theory is consistent: exhibit a group.

6.7.3 Completeness: the proof in steps#

Theorem (propositional case). If Γ ⊨ A then Γ ⊢ A.

It suffices to prove the model existence lemma: every consistent set of formulas is satisfiable. Indeed, suppose Γ ⊨ A but Γ ⊬ A. Then Γ ∪ {¬A} is consistent (if Γ, ¬A ⊢ ⊥ then Γ ⊢ A by RAA). By the lemma, Γ ∪ {¬A} has a model, contradicting Γ ⊨ A.

Proof of the model existence lemma.

Step 1 (Lindenbaum's lemma). Every consistent Γ extends to a maximal consistent set Δ: consistent, and for every formula B, either B ∈ Δ or ¬B ∈ Δ. Construction. Enumerate all formulas B₁, B₂, …. Put Δ₀ = Γ. If Δₙ ∪ {Bₙ₊₁} is consistent, let Δₙ₊₁ = Δₙ ∪ {Bₙ₊₁}; otherwise Δₙ₊₁ = Δₙ ∪ {¬Bₙ₊₁}. This keeps consistency: if both Δₙ, B ⊢ ⊥ and Δₙ, ¬B ⊢ ⊥, then Δₙ ⊢ ¬B (¬I) and Δₙ ⊢ B (RAA), so Δₙ ⊢ ⊥. Let Δ = ⋃ Δₙ. It is consistent (a derivation of ⊥ uses only finitely many premises, all in some Δₙ).

Step 2 (properties of maximal consistent sets). For Δ maximal consistent:

Step 3 (the canonical valuation). Define v(p) = T iff p ∈ Δ.

Step 4 (truth lemma). For every formula B: ⟦B⟧ᵥ = T iff B ∈ Δ. Induction on B: atoms by definition; each connective by (b)-(e) and the truth tables. ∎

Hence v satisfies Δ ⊇ Γ, and the model existence lemma holds.

First-order completeness (Henkin's method; outline)#

The same plan, with three additions:

  1. Henkin witnesses. Add infinitely many new constants c₁, c₂, … and, for each formula ∃x B(x), an axiom ∃x B(x) → B(cᵢ) (a "witness axiom"). The extended theory remains consistent (this is where the freshness conditions of ∃E and ∀I are used).
  2. Maximal consistent extension Δ, now also witnessed: whenever ∃x B(x) ∈ Δ, some B(c) ∈ Δ.
  3. The term model. Domain: the set of closed terms (modulo s ~ t iff s = t ∈ Δ, to handle equality). Interpret each function symbol syntactically and each predicate by P^M = {(t₁,…,tₙ) : P(t₁,…,tₙ) ∈ Δ}. The truth lemma is proved by induction on formulas; the ∃ case uses the witnesses, the ∀ case uses the maximality.

The resulting structure is a model of Γ, countable if the language is countable. This proves Gödel's completeness theorem (1929; Henkin's proof 1949).

Consequences of the proof method#

6.7.4 Compactness in complete detail#

Theorem (compactness). A set Γ of sentences has a model iff every finite subset of Γ has a model.

Equivalent form: if Γ ⊨ A, then Γ₀ ⊨ A for some finite Γ₀ ⊆ Γ.

Proof from completeness. (⇒) trivial. (⇐) Suppose Γ has no model. By completeness Γ ⊢ ⊥; the derivation uses finitely many premises Γ₀, so Γ₀ ⊢ ⊥, so by soundness Γ₀ has no model. ∎

(There are other proofs: via ultraproducts (Łoś), and for propositional logic via Tychonoff's theorem or the compactness of Cantor space.)

Applications, with proofs#

1. Non-standard models of arithmetic. Let T = Th(ℕ) (all true sentences of arithmetic) and add a new constant c with axioms c ≠ 0, c ≠ 1, c ≠ 2, … (more precisely c > n̄ for each numeral). Every finite subset has a model: ℕ itself, with c interpreted as a number larger than the finitely many constraints. By compactness the whole set has a model *ℕ, which satisfies every first-order truth of ℕ but contains an element c greater than all standard numerals. First-order logic cannot characterize ℕ up to isomorphism.

2. Finiteness is not first-order expressible. Suppose T had exactly the finite structures as models (over =). Let λₙ say "there are at least n elements". Every finite subset of T ∪ {λₙ : n ≥ 1} has a (large enough finite) model. By compactness T ∪ {λₙ} has a model, which is infinite: contradiction with T having only finite models. ∎

3. The de Bruijn-Erdős theorem (an application of propositional compactness). An infinite graph is k-colourable iff every finite subgraph is. Proof. For each vertex v and colour i ≤ k take an atom p_{v,i} ("v has colour i"). Clauses: p_{v,1} ∨ ⋯ ∨ p_{v,k} (some colour); ¬p_{v,i} ∨ ¬p_{v,j} for i ≠ j (at most one); ¬p_{u,i} ∨ ¬p_{v,i} for each edge uv (adjacent vertices differ). A finite subset of these clauses mentions finitely many vertices, so it is satisfiable if the corresponding finite subgraph is k-colourable. By compactness the whole set is satisfiable: a k-colouring. ∎

4. Connectedness is not first-order expressible. If it were, φ = "the graph is connected". Add constants a, b and sentences dist(a, b) > n for all n (each is first-order: "no path of length ≤ n"). Every finite subset is satisfiable in a large connected graph (a long path), so the whole set has a model: a connected graph (by φ) with a, b at infinite distance: impossible. ∎

5. Ordering and well-ordering. "< is a well-order" is not first-order expressible: add constants c₀, c₁, … with cₙ₊₁ < cₙ; any finite subset is satisfiable in ℕ; so there is a model with an infinite descending sequence.

6.7.5 Löwenheim-Skolem and categoricity#

Downward L-S. Every structure for a countable language has a countable elementary substructure. In particular, a satisfiable countable theory has a countable model. Upward L-S. If a theory has an infinite model it has models of every larger cardinality (by compactness, adding κ many new constants).

Consequences.

Theory Categorical in
Pure equality, "infinitely many elements" every infinite cardinal
Dense linear orders without endpoints ℵ₀ only (Cantor's back-and-forth); (ℚ,<) vs (ℝ,<) differ in size
Algebraically closed fields of characteristic 0 every uncountable cardinal (Steinitz), not ℵ₀
Vector spaces over a fixed field every cardinality larger than the field's
Peano arithmetic none: non-standard models in every infinite size

Łoś-Vaught test. A theory with no finite models, in a countable language, that is κ-categorical for some infinite κ, is complete. Hence dense linear orders without endpoints and algebraically closed fields of characteristic 0 are complete theories, and (since axiomatizable complete theories are decidable) decidable.

Tarski-Vaught test, elementary substructures, ultraproducts are the main tools of model theory, the study of the relation between theories and their models. A good first book: Chang and Keisler, or Marker, Model Theory: an Introduction.

6.7.6 Computability background (just enough)#

An algorithm is a finite, mechanical procedure. A formalization (Turing machines, λ-calculus, recursive functions) gives the Church-Turing thesis: every intuitively computable function is computable by a Turing machine.

Notion Definition
Decidable (recursive) set S an algorithm that on input x halts and answers yes/no correctly for "x ∈ S?"
Semi-decidable (r.e., recursively enumerable) set an algorithm that halts with yes exactly when x ∈ S (may loop if not)
Co-r.e. complement is r.e.
Fact S is decidable iff both S and its complement are r.e.
Halting problem K the set of (program, input) pairs that halt: r.e. but not decidable (Turing 1936)
Reduction S ≤ T if an algorithm converts instances of S into instances of T preserving answers; if T decidable then so is S. Contrapositive: to show T undecidable, reduce a known undecidable S to it.

Why the halting problem is undecidable (diagonal argument, the same form as Cantor's theorem and Russell's barber). Suppose a program H(p, x) decides whether program p halts on input x. Define D(p): if H(p, p) says "halts", loop forever; otherwise halt. Then D(D) halts iff H(D, D) says "does not halt" iff D(D) does not halt. Contradiction. ∎

The Church-Turing theorem for first-order logic#

Theorem (Church 1936, Turing 1936). The set of valid first-order sentences is not decidable, though it is r.e.

Why r.e.: by completeness every valid sentence has a finite derivation; enumerate all strings, check each for being a derivation (mechanically checkable), and print its last line. Why not decidable: one reduces the halting problem (or the word problem, or Post's correspondence problem) to validity: for each Turing machine M and input x one can effectively write a sentence φ_{M,x} that is valid iff M halts on x. A decision procedure for validity would decide halting.

Decidable and undecidable theories and fragments#

Theory or fragment Decidable? Remark
Propositional logic yes SAT is NP-complete
Quantified Boolean formulas (QBF) yes PSPACE-complete
Monadic first-order logic (unary predicates only) yes Löwenheim 1915
Bernays-Schönfinkel-Ramsey class (∃*∀* prefix, no function symbols) yes satisfiability NEXPTIME-complete
Two-variable fragment FO² yes Mortimer 1975, NEXPTIME-complete
Guarded fragment yes Andréka-van Benthem-Németi 1998
Presburger arithmetic (ℕ, +, 0, 1, <) yes Presburger 1929
Real closed fields (ℝ, +, ·, 0, 1, <) yes Tarski 1951 (quantifier elimination)
Theory of dense linear orders yes complete theory
Theory of algebraically closed fields yes Tarski, Robinson
Abelian groups yes Szmielew 1955
Full FOL (validity) no Church-Turing; r.e.
FOL with a single binary relation symbol (no functions) no already undecidable: the undecidability of full FOL survives such drastic restriction
Arithmetic (ℕ, +, ·), Th(ℕ) no not even r.e. (Gödel/Tarski)
Group theory (all groups) no Tarski
Finite satisfiability / validity in finite models no Trakhtenbrot 1950 (the set of sentences valid in all finite models is not r.e.)
Second-order logic validity no not even arithmetical

The map of decidable fragments is the reason why SMT solvers (which decide combinations of decidable theories such as linear arithmetic, arrays and bit-vectors) are so useful in practice, even though full first-order logic is undecidable.

6.7.7 Gödel's incompleteness theorems, explained#

The setting#

Let T be a theory in the language of arithmetic that is (1) consistent, (2) effectively axiomatized (an algorithm can decide whether a sentence is an axiom), and (3) strong enough to prove basic facts about + and · (for instance Robinson arithmetic Q, a small finite fragment of Peano arithmetic). Examples: PA, ZFC.

Ingredient 1: arithmetization (Gödel numbering)#

Assign each symbol a number, and each finite string a number, so that syntactic operations become arithmetic operations. One scheme: give the symbols codes c(¬) = 1, c(→) = 2, c(∀) = 3, c(=) = 4, c(0) = 5, c(S) = 6, c(+) = 7, c(·) = 8, c(() = 9, c()) = 10, and c(xᵢ) = 10 + i for the variables x₁, x₂, … (so the variable codes start at 11 and never clash with the other symbols). The code of a string s₁ s₂ … sₖ is ⌜s₁…sₖ⌝ = 2^{c(s₁)} · 3^{c(s₂)} · 5^{c(s₃)} ⋯ pₖ^{c(sₖ)} (pᵢ the i-th prime), and uniqueness of prime factorization makes decoding possible. A derivation is a sequence of formulas, coded likewise. Then relations such as "x is the code of a formula", "x is the code of a derivation of the formula with code y" are primitive recursive, hence expressible by arithmetic formulas. In particular there is a formula Prov_T(y), "there exists a code of a derivation of the formula with code y", expressing provability in T. Write ⌜A⌝ for the numeral denoting the code of A.

Ingredient 2: the diagonal (fixed-point) lemma#

Lemma. For every formula B(y) with one free variable there is a sentence G such that T ⊢ G ↔ B(⌜G⌝).

Idea. "Substitute the code of a formula into itself" is an arithmetic operation d. Let A(x) be the formula B(d(x)) and let G be A(⌜A⌝). Then G says B(d(⌜A⌝)), and d(⌜A⌝) = ⌜A(⌜A⌝)⌝ = ⌜G⌝, so G ↔ B(⌜G⌝). This is the same self-reference trick as the barber, Cantor's diagonal, and the halting problem.

The first incompleteness theorem#

Apply the lemma to B(y) := ¬Prov_T(y). We get a sentence G with T ⊢ G ↔ ¬Prov_T(⌜G⌝): "G says: I am not provable in T."

Theorem (Gödel 1931, Rosser 1936). If T is consistent, effectively axiomatized and extends Q, there is a sentence G with T ⊬ G and T ⊬ ¬G.

The second incompleteness theorem#

Let Con_T := ¬Prov_T(⌜⊥⌝) ("T is consistent"). The proof of the first theorem can be formalized inside T, giving T ⊢ Con_T → G. If T ⊢ Con_T then T ⊢ G, contradicting the first theorem. So:

Theorem. If T is consistent (and satisfies the Hilbert-Bernays-Löb derivability conditions), then T ⊬ Con_T.

Löb's theorem. If T ⊢ Prov_T(⌜A⌝) → A then T ⊢ A. (A theory cannot prove "if provable then true" for any sentence unless it already proves the sentence.)

Theorem Statement
Tarski's undefinability of truth there is no arithmetical formula True(x) with ℕ ⊨ True(⌜A⌝) ↔ A for all sentences A
Church-Turing validity of FOL is undecidable (6.7.6)
Halting problem undecidable
Gödel + Church Th(ℕ) is not r.e., not even arithmetical
Rosser removes the ω-consistency assumption
Gentzen (1936) consistency of PA follows from transfinite induction up to the ordinal ε₀ (a theory beyond PA can prove Con(PA))
Paris-Harrington (1977) a natural combinatorial sentence true in ℕ but unprovable in PA
Goodstein's theorem true, but unprovable in PA

Common misconceptions (and the correct statement)#

Misconception Reality
"Gödel showed that some truths are unprovable, so mathematics is unreliable." For each fixed consistent effective theory, some arithmetical truths are unprovable in that theory. A stronger theory can prove them (and has its own unprovable truths).
"G is neither true nor false." G is true in the standard model ℕ (if T is consistent). It is unprovable in T.
"Incompleteness contradicts completeness." No: they concern different notions (6.7.1). Completeness: T ⊨ A ⇒ T ⊢ A. G is not a consequence of T (true in ℕ, false in some non-standard models of T).
"Humans can see the truth of G, so minds are not machines." We see G is true assuming T is consistent; we have no proof that our own reasoning is consistent. Not a valid argument for non-mechanism (Lucas-Penrose argument is widely rejected).
"Incompleteness only affects exotic theories." It affects every consistent effective theory that interprets basic arithmetic (PA, ZFC), but not, e.g., Presburger arithmetic or the theory of real closed fields.
"Therefore everything is relative." The theorems are precise mathematical statements with hypotheses.

6.7.8 More metatheorems at a glance#

Theorem Statement Why it matters
Herbrand's theorem ∃-free universal S is unsatisfiable iff some finite set of its ground instances is propositionally unsatisfiable basis of resolution (Chapter 7)
Skolem normal form each formula is equisatisfiable with a universal formula in an expanded language automated reasoning
Cut-elimination (Gentzen's Hauptsatz) every LK proof can be converted into a cut-free proof consistency, subformula property
Craig interpolation if ⊨ A → B there is I in the shared vocabulary with ⊨ A → I, ⊨ I → B modularity, verification
Beth definability implicit definability implies explicit definability
Łoś's theorem truth in an ultraproduct = truth in "almost all" factors compactness; nonstandard analysis
Lindström's theorem FOL is the strongest logic satisfying both compactness and downward L-S characterizes FOL
Gödel's β-function lemma finite sequences can be coded in arithmetic arithmetization
Löb's theorem T ⊢ Prov(⌜A⌝) → A implies T ⊢ A provability logic
Rice's theorem every nontrivial semantic property of programs is undecidable program analysis
Cook-Levin SAT is NP-complete computational complexity

6.7.9 Other logics: a guided tour#

You now know classical first-order logic, the "standard" logic. The rest of logic studies variations and extensions. Here is a map with enough detail to start reading.

Intuitionistic and substructural logics#

Logic Change Idea
Intuitionistic drop LEM / RAA truth = constructibility (2.9.8)
Minimal logic also drop ex falso
Linear logic (Girard 1987) drop weakening and contraction formulas are resources used exactly once: A ⊸ B, A ⊗ B, !A
Relevance logic demand that premises are relevant to conclusions avoids A → (B → A) paradoxes
Paraconsistent logic no explosion tolerate contradictions without triviality

Many-valued logics#

Allow truth values beyond T and F.

Kleene's strong three-valued logic K₃ (values T, U ("unknown"), F with order F < U < T): ¬ swaps T and F and fixes U; ∧ is the minimum; ∨ the maximum.

∧ T U F
T T U F
U U U F
F F F F

A → B is defined as ¬A ∨ B. In K₃ there are no tautologies (set every atom to U). Łukasiewicz's L₃ differs in U → U = T, so A → A is valid. Fuzzy logic uses values in [0, 1] with ∧ = min (or product), ∨ = max, ¬x = 1 − x. Belnap's four-valued logic adds "both" for conflicting information.

Add operators □A ("necessarily A") and ◇A ("possibly A", defined ¬□¬A).

Kripke semantics. A frame is (W, R): a set W of "worlds" and an accessibility relation R ⊆ W × W. A model adds a valuation V saying which atoms are true at which worlds. Truth at a world w:

Formula M, w ⊨ it iff
p w ∈ V(p)
¬A, A ∧ B, … as usual, at w
□A M, u ⊨ A for every u with wRu
◇A M, u ⊨ A for some u with wRu

Axioms and the frame conditions they correspond to:

Axiom Name Valid on a frame iff R is...
□(A → B) → (□A → □B) K (all frames)
□A → A T reflexive
□A → □□A 4 transitive
A → □◇A B symmetric
◇A → □◇A 5 Euclidean (wRu ∧ wRv ⇒ uRv)
□A → ◇A D serial (∀w ∃u wRu)
□(□A → A) → □A GL (Löb) transitive and conversely well-founded

Standard systems: K, T (= KT), S4 (= KT4), S5 (= KT5; R an equivalence relation, "all worlds see each other"). Rule: necessitation: if ⊢ A then ⊢ □A.

Modal logics embed in first-order logic via the standard translation ST(□A, x) = ∀y (R(x, y) → ST(A, y)), and live in the decidable "guarded" fragment; that is why they are (mostly) decidable. Applications: epistemic logic (□ = "agent knows"), deontic logic (□ = "obligatory"), provability logic (□ = "provable in PA", logic GL), temporal logic, program logics.

Temporal logic (LTL: X next, F eventually, G always, U until; CTL adds path quantifiers A, E): specifications for model checking hardware and software. Dynamic logic: [a]A "after every run of program a, A". Hoare logic: {P} C {Q} "if P holds before command C, Q holds after". Separation logic: reasoning about pointer programs.

Higher-order logic and type theory#

Second-order logic quantifies over sets/relations. With full semantics it can characterize ℕ and ℝ up to isomorphism but has no complete proof system and no compactness. Higher-order logic and type theories (simple type theory, Martin-Löf type theory, the Calculus of Constructions) underlie Isabelle/HOL, Lean, Coq, Agda. In the Curry-Howard view (2.9.8), proofs are programs and propositions are types.

Logics for knowledge representation and computation#

Logic Used for
Description logics (ALC, SROIQ) ontologies (OWL, semantic web); decidable fragments of FOL
Datalog database queries: Horn clauses, no function symbols, always terminating
Answer set programming nonmonotonic reasoning, default logic
Non-monotonic logic conclusions can be retracted when new information arrives
Probabilistic logic, Markov logic uncertainty
Fixed-point logics, finite model theory database theory, complexity (descriptive complexity: NP = existential second-order logic, Fagin 1974)

6.7.10 Where to go next (study roadmap)#

Goal Read
A rigorous first course in mathematical logic Enderton, A Mathematical Introduction to Logic; or van Dalen, Logic and Structure
Proof theory Troelstra & Schwichtenberg, Basic Proof Theory; Negri & von Plato, Structural Proof Theory
Computability and incompleteness Boolos, Burgess & Jeffrey, Computability and Logic; Smith, An Introduction to Gödel's Theorems
Model theory Marker, Model Theory: An Introduction; Hodges, A Shorter Model Theory
Set theory Jech; Kunen
Type theory and formalization Software Foundations (Coq); Theorem Proving in Lean 4; Natural Number Game
Automated reasoning Harrison, Handbook of Practical Logic and Automated Reasoning; Robinson & Voronkov (eds.), Handbook of Automated Reasoning; Kroening & Strichman, Decision Procedures; Biere et al., Handbook of Satisfiability
Modal logic Blackburn, de Rijke & Venema, Modal Logic
Philosophy of logic Priest, Introduction to Non-Classical Logic; Sider, Logic for Philosophy

6.7.11 Quick-check (with answers)#

Q1. State soundness and completeness in one line each, using ⊢ and ⊨. Q2. Why does the soundness proof for →I use the semantic deduction theorem? Q3. What is a maximal consistent set, and why is it useful? Q4. Show, using compactness, that there is no set of first-order sentences whose models are exactly the finite graphs. Q5. Is validity of first-order logic decidable? Semi-decidable? Explain the difference. Q6. Which is true: "G is true but unprovable in PA" or "G is neither true nor false"? Q7. What does it mean for a modal logic to be "S5"? Which frame condition? Q8. Name two decidable fragments of first-order logic.

Answers. A1. Soundness: Γ ⊢ A ⇒ Γ ⊨ A. Completeness: Γ ⊨ A ⇒ Γ ⊢ A. A2. Because the box for →I has assumption A and conclusion B; the IH is Γ ∪ {A} ⊨ B, and the semantic deduction theorem turns it into Γ ⊨ A → B. A3. A consistent set Δ such that for every formula, either it or its negation belongs to Δ. It is useful because its members define a valuation/structure directly (the truth lemma), which gives completeness. A4. Same pattern as 6.7.4 Application 2: add λₙ ("at least n vertices"); each finite subset has a finite model; compactness gives an infinite model of a theory that has only finite models. A5. Not decidable (Church-Turing), but semi-decidable: if a sentence is valid a proof-enumerating program eventually finds a proof; if it is not valid, it may run forever. A6. "True but unprovable in PA" (assuming PA is consistent). A7. S5 = KT5: accessibility is an equivalence relation (reflexive, symmetric, transitive); every world sees every world in its class. A8. E.g., monadic first-order logic; the Bernays-Schönfinkel class; the two-variable fragment; the guarded fragment; Presburger arithmetic (a theory).

Problems for Chapter 6#

6.1 ★ In your own words, explain the difference between A ⊨ B and A → B being a theorem of a proof system. What do soundness and completeness say about the relation between A ⊨ B, A ⊢ B, and ⊢ A → B?

6.2 ★ Which of the following are true statements of the metalanguage and which are formulas of the object language: (a) P → Q; (b) P ⊨ Q; (c) ⊢ P ∨ ¬P; (d) "P ∨ ¬P is a tautology"; (e) ∀x P(x)?

6.3 ★★ Prove soundness for the rules ∧E, ∨I, and →E: show that if the premises hold in a model, so does the conclusion.

6.4 ★★ Explain, using the completeness theorem, why the set of valid FOL sentences is recursively enumerable. Then explain why a recursively enumerable set need not be decidable, and which direction a prover can answer reliably.

6.5 ★★★ Use compactness to prove that there is no set of FOL sentences (over the empty signature plus =) whose models are exactly the finite sets. (Hint: let λₙ say "there are at least n elements" and consider {λₙ : n ≥ 1} together with the supposed theory.)

6.6 ★★★ Use compactness to show there is a model of the true arithmetic of ℕ containing an element larger than every standard natural number.

6.7 ★★★ Explain why the freshness condition in ∀I is needed for soundness, by giving an explicit model and assignment that refutes the invalid inference "from P(a), infer ∀x P(x)" when a is not fresh.

6.8 ★★★ (Discussion) The statement "ZFC proves that there are uncountably many reals" and "ZFC has a countable model" both hold. Explain why they are not in conflict.


Chapter 7. Automated reasoning: from formulas to resolution ↑ Top#

Chapters 2 and 4 taught you to find proofs by hand, with insight. This chapter teaches how a machine finds proofs with no insight at all, only systematic search. It is also the theory behind the prover you will build in Chapter 8.

7.1 The refutation idea#

By (F1) of Chapter 1 (and its first-order version), Γ ⊨ A iff Γ ∪ {¬A} is unsatisfiable. So a prover does not try to build a proof of A. It negates A, adds it to the premises, and tries to derive a contradiction (the empty clause). Pipeline:

text
 premises + ¬goal
        │
        ▼
 1. eliminate ↔, →
 2. negation normal form (NNF)
 3. standardize variables apart
 4. Skolemize (remove ∃)
 5. drop ∀, convert to CNF  ──►  a set of clauses
        │
        ▼
 6. resolution with unification, searching for the empty clause □
        │
        ▼
 □ derived  ⇒  premises ⊨ goal      (otherwise: no answer, or ⊭)

7.2 Propositional resolution and DPLL#

A clause is a disjunction of literals, written as a set: {P, ¬Q, R} means P ∨ ¬Q ∨ R. The empty clause □ is false (a disjunction with no true disjunct). A set of clauses means their conjunction.

The resolution rule:

text
   C ∨ A        D ∨ ¬A
  ─────────────────────        (resolvent: C ∨ D)
         C ∨ D

It is sound: if both premises are true, then in the valuation either A is true, so D must be true, or A is false, so C must be true; either way C ∨ D holds. (You proved it in Problem 2.17.) Special cases: modus ponens (C empty: from A and ¬A ∨ D get D), and contradiction (A and ¬A give □).

Example. Refute {P ∨ Q, ¬P ∨ R, ¬Q ∨ R, ¬R}:

  1. P ∨ Q (given)
  2. ¬P ∨ R (given)
  3. ¬Q ∨ R (given)
  4. ¬R (given)
  5. Q ∨ R (resolve 1, 2 on P)
  6. R (resolve 5, 3 on Q)
  7. □ (resolve 6, 4 on R)

Propositional resolution is complete for refutation: if the clause set is unsatisfiable, □ is derivable.

DPLL is the classic algorithm behind modern SAT solvers:

text
def dpll(clauses):
    clauses = unit_propagate(clauses)      # a clause {l} forces l; simplify everything
    if [] in clauses: return UNSAT         # empty clause: conflict
    if not clauses:   return SAT           # nothing left to satisfy
    l = choose_literal(clauses)
    return dpll(clauses + [[l]]) or dpll(clauses + [[-l]])    # branch

Modern solvers add conflict-driven clause learning (CDCL), but the skeleton is this. Tseitin's transformation (Chapter 1) lets you feed any formula into such a solver in linear size.

7.3 From first-order formulas to clauses#

Step 1-2: eliminate → and ↔, push negations in (NNF)#

Exactly as in propositional logic, plus the quantifier rules ¬∀ ≡ ∃¬ and ¬∃ ≡ ∀¬.

Step 3: standardize variables apart#

Rename bound variables so every quantifier binds a distinct variable. Example: ∀x P(x) ∧ ∃x Q(x) becomes ∀x P(x) ∧ ∃y Q(y).

Step 4: Skolemization (eliminating ∃)#

Replace each existentially quantified variable by a fresh function symbol applied to the universally quantified variables whose scope it lies in (a Skolem function). If no ∀ encloses it, the function has no arguments, i.e., a Skolem constant.

Before After
∃x P(x) P(c)
∀x ∃y R(x, y) ∀x R(x, f(x))
∃x ∀y R(x, y) ∀y R(c, y)
∀x ∃y ∀z ∃w S(x, y, z, w) ∀x ∀z S(x, f(x), z, g(x, z))

The dependency structure is exactly the quantifier-order story from Chapters 3-4: in ∀x ∃y the witness may depend on x (so f(x)), in ∃x ∀y it may not (so c).

Skolemization preserves satisfiability, not equivalence. A is satisfiable iff its Skolemized form is, but ∃x P(x) and P(c) are not equivalent (P(c) says more: about a specific, named object). This is exactly why the refutation approach works: we only ever ask "is this set unsatisfiable?".

Step 5: drop universal quantifiers and convert to CNF#

After Skolemization, all remaining quantifiers are ∀ (after pulling them out, which is why variables were standardized apart). Drop them, since free variables in clauses are implicitly universal. Convert the matrix to CNF. Each conjunct becomes a clause. Variables in different clauses are independent (they are separately universally quantified), so you may rename them freely.

Worked example: the negated drinker paradox#

We want to prove ∃x (D(x) → ∀y D(y)). Negate it and look for a contradiction.

  1. ¬∃x (D(x) → ∀y D(y))
  2. Push negation: ∀x ¬(D(x) → ∀y D(y)) ≡ ∀x (D(x) ∧ ¬∀y D(y)) ≡ ∀x (D(x) ∧ ∃y ¬D(y))
  3. Skolemize y := f(x): ∀x (D(x) ∧ ¬D(f(x)))
  4. Clauses: C₁ = {D(x)}, C₂ = {¬D(f(x))}

Resolve C₁ with C₂: unify D(x) with D(f(x′)) (after renaming apart): x ↦ f(x′). Result: □. Proved, in one step.

7.4 Unification#

To resolve {P(x)} against {¬P(f(a))}, we must make the atoms equal by substituting for variables. That is unification.

A substitution θ maps variables to terms. A unifier of terms s and t is θ with sθ = tθ. A most general unifier (MGU) is a unifier from which every other unifier can be obtained by further substitution. If a unifier exists, an MGU exists and is unique up to renaming of variables.

Examples:

Terms Result
P(x, f(y)) and P(g(z), w) MGU {x ↦ g(z), w ↦ f(y)}
P(x, x) and P(a, b) fails (x = a, then a = b clash of constants)
P(x, f(x)) and P(y, y) fails: y = x, then f(x) = x, and x occurs in f(x) (occurs check)
R(x, g(x), y) and R(a, z, f(z)) MGU {x ↦ a, z ↦ g(a), y ↦ f(g(a))}

Robinson's algorithm (sketch):

  1. Start with the set of equations {s = t}.
  2. Pick an equation:
    • identical terms: delete it;
    • f(s₁..sₙ) = f(t₁..tₙ): replace by s₁ = t₁, ..., sₙ = tₙ;
    • f(...) = g(...) with f ≠ g (or different arity): fail;
    • x = t where x is a variable: if x occurs in t (and t ≠ x), fail (occurs check); otherwise substitute x ↦ t in all remaining equations and record it.
  3. Repeat until no equations remain.

The occurs check matters: without it x ↦ f(x) would create an infinite term and make the prover unsound. (Prolog famously omits it for speed. A theorem prover must not.)

7.5 First-order resolution#

Resolution rule with unification. Given clauses C ∨ A and D ∨ ¬B, where the two clauses have been renamed apart (no shared variables) and A, B unify with MGU θ, derive the resolvent (C ∨ D)θ.

Factoring. If two literals of the same sign in one clause unify with MGU θ, derive the clause with θ applied (and the duplicate merged). Factoring is not optional: without it resolution is incomplete (see Example 3 below).

Theorem (Robinson 1965). A set of clauses is unsatisfiable iff □ is derivable by resolution and factoring. (Refutation completeness, proven via Herbrand's theorem and lifting propositional resolution.)

Example 1. Socrates#

Clauses: {¬Man(x), Mortal(x)}, {Man(s)}, {¬Mortal(s)}. Resolve the first two with x ↦ s: {Mortal(s)}. Resolve with the third: □.

Example 2. ∃x ∀y R(x, y) ⊨ ∀y ∃x R(x, y)#

Premise ∃x∀y R(x, y) → {R(c, y)}. Negated conclusion ¬∀y∃x R(x, y) ≡ ∃y∀x ¬R(x, y) → {¬R(x, d)}. Unify R(c, y) with R(x, d): {x ↦ c, y ↦ d}. Result: □. ✔

Example 2′. The converse fails: ∀y ∃x R(x, y) ⊭ ∃x ∀y R(x, y)#

Premise → {R(f(y), y)}. Negated conclusion ¬∃x∀y R(x, y) ≡ ∀x∃y ¬R(x, y) → {¬R(x, g(x))}. Try to resolve: unify R(f(y), y) with R(x, g(x)): x ↦ f(y), then y = g(x) = g(f(y)), which fails the occurs check. No other resolvents exist, the set is saturated without □, so (by refutation completeness) it is satisfiable, and the entailment fails. The occurs check is the quantifier-order asymmetry.

Example 3. Why factoring is needed (Russell's barber)#

Refute the barber: ∃x ∀y (R(x, y) ↔ ¬R(y, y)). Skolemize x := a: ∀y (R(a, y) ↔ ¬R(y, y)). Split ↔ into two implications:

Binary resolution alone on C₁ and C₂ never produces a clause with fewer than two literals, so it can never reach □. Instead factor: in C₁, unify R(a, y) with R(y, y) (that is, y ↦ a), giving {¬R(a, a)}. In C₂, unify likewise, giving {R(a, a)}. Resolve the two unit clauses: □. ∎ (This is the same contradiction as Chapter 4, Example 6, found mechanically.)

7.6 Search strategy and why provers can run forever#

Resolution is complete but the search space is huge. Practical provers use a given-clause loop:

text
def prove(clauses, limit):
    passive = priority_queue(clauses)     # unprocessed
    active  = []                          # processed
    while passive and within(limit):
        given = passive.pop_best()        # heuristic: shortest/lightest clause first
        if given == EMPTY: return PROVED
        if subsumed_by_any(given, active): continue      # redundancy elimination
        for c in active:
            for r in resolvents(given, c) + factors(given):
                if r == EMPTY: return PROVED
                if not is_tautology(r): passive.add(r)
        active.append(given)
    return UNKNOWN            # *never* "invalid": FOL is only semi-decidable

Key ideas used by real provers (Vampire, E, Prover9):

Why can't the prover be made to terminate? Because FOL validity is undecidable (Chapter 6.4). Resolution may generate infinitely many clauses on a satisfiable set, e.g. {P(a)}, {¬P(x), P(f(x))} saturates only in an infinite model. You can only add resource limits and report "unknown".

7.7 The Herbrand connection (why it works)#

For a set S of clauses, the Herbrand universe is the set of ground terms built from its constants and function symbols. Herbrand's theorem: S is unsatisfiable iff some finite set of ground instances of its clauses is propositionally unsatisfiable.

Example. S = {P(a)}, {¬P(x), P(f(x))}, {¬P(f(f(a)))}. Ground instances with x := a and x := f(a):

This propositional set is unsatisfiable: P(a) forces P(f(a)), which forces P(f(f(a))), contradicting the last clause. Early provers (Gilmore, Davis-Putnam) literally enumerated ground instances and called a SAT procedure. Resolution with unification does the same job lazily, instantiating only as much as needed.

7.9 Chapter 7 in complete detail (the from-zero companion)#

Chapter 7 explained how a machine proves theorems. This companion widens the picture: the landscape of automated reasoning tools, SAT solving step by step (with a tested program), a complete clause-form conversion example, unification traced by hand, resolution strategies and Prolog, SMT solvers, finite model finding, and a full worked puzzle (the Dreadbury Mansion mystery) from English to proof. Every worked example in this section was checked with an independent solver (Z3).

7.9.1 The landscape of automated reasoning#

Family Problem solved Typical tools Strength
SAT solvers is a propositional CNF satisfiable? MiniSat, CaDiCaL, Kissat, Glucose millions of variables on structured instances
SMT solvers satisfiability modulo theories (arithmetic, arrays, bit-vectors, strings) with quantifiers Z3, CVC5, Yices, MathSAT verification, symbolic execution, planning
Automated theorem provers (ATP) for FOL is this first-order conjecture a consequence of the axioms? Vampire, E, SPASS, Prover9, iProver resolution/superposition, equational reasoning
Model finders find a finite model (countermodel) Mace4, Paradox, Kodkod/Alloy complements ATPs
Interactive theorem provers (proof assistants) human-guided, machine-checked proofs Lean, Coq/Rocq, Isabelle, Agda, HOL Light large formalizations (4-colour theorem, Kepler, Feit-Thompson)
Model checkers does a finite-state system satisfy a temporal-logic spec? SPIN, NuSMV, TLA+/TLC hardware and protocol verification
Logic programming run Horn clauses as programs Prolog, Datalog, ASP queries, rules
Hybrids ("hammers") proof assistant calls ATP/SMT Sledgehammer (Isabelle), CoqHammer automation inside interactive proofs

All of them are built on the ideas in Chapters 1-7: normal forms, refutation, unification, search with pruning.

Typical architecture of an ATP: (1) parse; (2) clausify (7.3); (3) saturation loop with a heuristic given clause strategy (7.6); (4) output a proof or "unknown/timeout"; (5) optionally check the proof with an independent checker.

Landmark results found by automated reasoning: the Robbins conjecture (about a variant of Boolean algebra) proved by the equational prover EQP in 1996; the Boolean Pythagorean triples problem resolved by SAT solving in 2016 (the natural numbers can be 2-coloured up to 7824 without a monochromatic Pythagorean triple, but not up to 7825; the proof certificate takes about 200 terabytes); formal proofs of the four-colour theorem (Gonthier, Coq, 2005) and the Kepler conjecture (Flyspeck, HOL Light and Isabelle, 2014).

7.9.2 SAT solving in detail#

The input format: DIMACS CNF#

SAT solvers read this plain-text format. Atoms are numbered 1, 2, 3, …; a negative number is a negated literal; each clause ends with 0. Example: the clause set {P ∨ Q, ¬P ∨ R, ¬Q ∨ R, ¬R} with P = 1, Q = 2, R = 3:

text
c this line is a comment
p cnf 3 4
1 2 0
-1 3 0
-2 3 0
-3 0

(p cnf 3 4 = 3 variables, 4 clauses.) The solver answers UNSATISFIABLE here; a satisfiable instance returns SATISFIABLE and a line v 1 -2 3 0 giving a model.

Unit propagation and pure literals#

Trace 1 (no branching needed). {P, Q}, {¬P, R}, {¬Q, R}, {¬R}.

  1. {¬R} is a unit: set R = F. Remove ¬R clauses (satisfied); delete R from {¬P, R} and {¬Q, R}: now {P, Q}, {¬P}, {¬Q}.
  2. {¬P} is a unit: P = F. {P, Q} becomes {Q}; {¬P} satisfied.
  3. {Q} and {¬Q} are both units: setting Q = T turns {¬Q} into the empty clause. Conflict: UNSAT.

Trace 2 (satisfiable, one decision). {P, Q}, {¬P, Q}, {P, ¬Q}.

  1. No unit clauses; no pure literals (P and Q both occur in both polarities). Decide P = T.
  2. {P, Q} and {P, ¬Q} satisfied. {¬P, Q} becomes {Q}: a unit.
  3. Q = T. All clauses satisfied. SAT, model P = Q = T.

The DPLL algorithm (Davis-Putnam-Logemann-Loveland, 1960/62)#

text
DPLL(clauses):
    repeat unit propagation until no unit clause remains
    if the empty clause is present:  return UNSAT
    apply the pure-literal rule
    if no clauses remain:           return SAT
    choose a literal l (the "decision")
    return DPLL(clauses ∧ l)  or  DPLL(clauses ∧ ¬l)

A complete, tested Python implementation (clauses are lists of nonzero integers as in DIMACS; the function returns a model as a dictionary, or None if unsatisfiable):

python
def simplify(clauses, lit):
    """Assume `lit` is true: drop satisfied clauses, shrink the others."""
    out = []
    for c in clauses:
        if lit in c:
            continue                          # clause is satisfied
        out.append([l for l in c if l != -lit])
    return out


def dpll(clauses, assignment=None):
    assignment = dict(assignment or {})
    # 1. unit propagation
    while True:
        unit = next((c[0] for c in clauses if len(c) == 1), None)
        if unit is None:
            break
        assignment[abs(unit)] = unit > 0
        clauses = simplify(clauses, unit)
    if any(len(c) == 0 for c in clauses):     # empty clause: conflict
        return None
    # 2. pure literals
    lits = {l for c in clauses for l in c}
    pure = next((l for l in lits if -l not in lits), None)
    while pure is not None:
        assignment[abs(pure)] = pure > 0
        clauses = simplify(clauses, pure)
        lits = {l for c in clauses for l in c}
        pure = next((l for l in lits if -l not in lits), None)
    if not clauses:                           # everything satisfied
        return assignment
    # 3. branch on some literal
    l = clauses[0][0]
    for choice in (l, -l):
        result = dpll(simplify(clauses, choice), {**assignment, abs(choice): choice > 0})
        if result is not None:
            return result
    return None


P, Q, R = 1, 2, 3
print(dpll([[P, Q], [-P, R], [-Q, R], [-R]]))   # None  (unsatisfiable)
print(dpll([[P, Q], [-P, Q], [P, -Q]]))         # {1: True, 2: True}

(This program was checked against brute-force truth tables on 2000 random clause sets; variables absent from the returned dictionary are unconstrained.)

Beyond DPLL: conflict-driven clause learning (CDCL)#

Modern solvers (MiniSat onwards, 2003-) add:

Technique Idea
Implication graph record which decisions and clauses forced each assigned literal
Conflict analysis, clause learning when a conflict occurs, derive a new clause (a resolvent of the clauses involved) that rules out the whole cause, and add it permanently
Non-chronological backjumping jump back to the decision level where the learned clause becomes unit, skipping irrelevant decisions
Decision heuristics (VSIDS) prefer variables recently involved in conflicts
Restarts periodically restart the search, keeping learned clauses
Two-watched-literal scheme make unit propagation fast by watching only two literals per clause
Preprocessing, inprocessing subsumption, variable elimination, equivalent-literal substitution

The deep fact: a CDCL run that answers UNSAT is a resolution proof: every learned clause is obtained by resolution. Unsatisfiability certificates (DRAT proofs) can be checked independently.

Encoding problems as SAT#

To solve a problem with a SAT solver, encode it as CNF.

Example: graph colouring. Variables c_{v,i} ("vertex v has colour i"). Clauses: each vertex has at least one colour; (optional) at most one colour; adjacent vertices do not share a colour. For a triangle with 2 colours the clause set is unsatisfiable (a triangle needs 3 colours).

Example: "exactly one of x₁, …, xₙ" needs an at-least-one clause x₁ ∨ … ∨ xₙ and pairwise at-most-one clauses ¬xᵢ ∨ ¬xⱼ for i < j (that is n(n−1)/2 clauses; better encodings use auxiliary variables).

Example: pigeonhole. n + 1 pigeons, n holes, pᵢⱼ = "pigeon i in hole j". Every pigeon is in some hole; no hole has two pigeons. Unsatisfiable, but every resolution refutation is exponentially long in n (Haken 1985), so resolution-based solvers struggle on it: an example of a gap between "obvious to a human" and "short in the proof system".

Other applications: hardware equivalence checking, bounded model checking of software, planning, test generation, cryptanalysis, scheduling, package dependency solving (your package manager may be using a SAT solver), solving Sudoku.

Complexity facts#

Problem Complexity
SAT (CNF, any clause length) NP-complete (Cook-Levin 1971)
3-SAT NP-complete
2-SAT solvable in linear time (implication graph, strongly connected components)
Horn-SAT (each clause has at most one positive literal) solvable in linear time (unit propagation)
Tautology checking (validity) coNP-complete
QBF (quantified Boolean formulas) PSPACE-complete
Random 3-SAT with clause/variable ratio r easy for r small (almost always SAT) and large (almost always UNSAT); hardest near the phase transition r ≈ 4.27

7.9.3 Clause-form conversion: a complete worked example#

Problem. Convert to clauses, showing every step, the sentence φ = ∀x ( ∃y R(x, y) → ∃z ( R(z, x) ∧ ∀w ¬S(w, z) ) ).

  1. Eliminate →: ∀x ( ¬∃y R(x, y) ∨ ∃z ( R(z, x) ∧ ∀w ¬S(w, z) ) ).
  2. Push negations in (NNF): ¬∃y R(x, y) becomes ∀y ¬R(x, y): ∀x ( ∀y ¬R(x, y) ∨ ∃z ( R(z, x) ∧ ∀w ¬S(w, z) ) ).
  3. Standardize variables apart: all binders already use different letters (x, y, z, w). ✔
  4. Skolemize (outermost first). Existentials: z lies inside ∀x only (the ∀y and ∀w do not enclose it: they are in separate subformulas). So z := f(x): ∀x ( ∀y ¬R(x, y) ∨ ( R(f(x), x) ∧ ∀w ¬S(w, f(x)) ) ).
  5. Pull out the universal quantifiers (prenex): ∀x ∀y ∀w ( ¬R(x, y) ∨ ( R(f(x), x) ∧ ¬S(w, f(x)) ) ). (Valid because the variables are standardized apart.)
  6. Drop the quantifiers; convert the matrix to CNF (distribute ∨ over ∧): ( ¬R(x, y) ∨ R(f(x), x) ) ∧ ( ¬R(x, y) ∨ ¬S(w, f(x)) ).
  7. Clauses: C₁ = { ¬R(x, y), R(f(x), x) } C₂ = { ¬R(x, y), ¬S(w, f(x)) }

Reading: C₁ says "if x has an R-successor then f(x) is R-related to x". The Skolem function f is the witness z chosen as a function of x.

Where students go wrong:

Mistake Correction
Skolemizing before pushing negations in do NNF first, otherwise ∃ and ∀ are swapped incorrectly
Using a Skolem constant for an ∃ under a ∀ the witness may depend on the universals above it: use a function
Giving an ∃ too many arguments only the universal variables whose scope contains the ∃ count
Reusing a Skolem symbol each ∃ needs a fresh symbol (f₁, f₂, …)
Forgetting to rename clause variables apart before resolution, the two clauses must share no variables
Treating Skolemization as an equivalence it is only equisatisfiable

Structure-preserving (definitional) CNF for first-order formulas. As in the propositional Tseitin transformation (1.8.7), introduce a fresh predicate symbol for a complex subformula to avoid exponential blow-up when distributing ∨ over ∧.

Miniscoping pushes quantifiers inward before Skolemization so that Skolem functions get fewer arguments (simpler terms, easier search).

7.9.4 Unification traced by hand#

Substitutions and their composition#

A substitution is a finite map θ = {x₁ ↦ t₁, …, xₙ ↦ tₙ}; Eθ applies it simultaneously to every variable of E. The composition θσ is "first θ, then σ": E(θσ) = (Eθ)σ. Example: θ = {x ↦ f(y)}, σ = {y ↦ a}. Then θσ = {x ↦ f(a), y ↦ a}: apply σ to the right-hand sides of θ, then add the bindings of σ for variables not already in θ's domain.

A substitution θ is more general than σ if σ = θτ for some τ. An MGU is more general than every other unifier. For P(x) and P(f(y)): {x ↦ f(y)} is an MGU; {x ↦ f(a), y ↦ a} is also a unifier but less general.

Robinson's algorithm, with a trace#

Unify P(x, g(y), z) with P(f(w), g(a), h(x)).

Step Equations (to solve) Action Substitution so far
0 x = f(w), g(y) = g(a), z = h(x) start {}
1 pick x = f(w): x a variable, x not in f(w) bind x ↦ f(w), apply to the rest {x ↦ f(w)}
remaining: g(y) = g(a), z = h(f(w))
2 g(y) = g(a): same head symbol decompose into y = a
3 y = a: bind y ↦ a {x ↦ f(w), y ↦ a}
4 z = h(f(w)): z not in the term bind z ↦ h(f(w)) {x ↦ f(w), y ↦ a, z ↦ h(f(w))}

Result: the MGU θ = {x ↦ f(w), y ↦ a, z ↦ h(f(w))}. Check: P(x, g(y), z)θ = P(f(w), g(a), h(f(w))) and P(f(w), g(a), h(x))θ = P(f(w), g(a), h(f(w))) ✔.

Failure cases:

Terms Why it fails
f(x) and g(y) clash of function symbols
f(x) and f(x, y) different arities
a and b (constants) clash
x and f(x) occurs check: no finite term equals a term containing itself
P(x, x) and P(a, b) x ↦ a, then a = b clashes
Notion Description
Matching (one-way unification) find θ with sθ = t, instantiating only s (used in rewriting, subsumption)
Subsumption clause C subsumes D if Cθ ⊆ D for some θ
E-unification unification modulo equations (associativity, commutativity, ...)
Higher-order unification undecidable in general; used in proof assistants
Complexity the naive algorithm may take exponential time (terms as trees); with DAG sharing, unification is linear (Paterson-Wegman)

7.9.5 Resolution strategies, refinements and Prolog#

Resolution is complete but an uninformed search generates enormous numbers of clauses. Strategies restrict the search while keeping (or deliberately sacrificing) completeness.

Strategy / refinement Idea Complete?
Binary resolution + factoring basic rule (7.5) yes
Subsumption (forward and backward) delete clauses that are instances of existing ones yes (with fairness)
Tautology deletion delete clauses containing L and ¬L yes
Set of support (SOS) resolve only if one parent descends from the negated goal yes
Unit resolution one parent is a unit clause complete only for Horn clauses
Input resolution one parent is an original clause complete for Horn
Linear resolution / model elimination each step uses the previous resolvent yes
Hyperresolution resolve a "nucleus" with several positive "satellites" at once yes
Ordered resolution resolve only on literals maximal in a term ordering yes
Paramodulation / superposition built-in treatment of equality (rewriting) yes (superposition: refutationally complete for equational FOL)
Demodulation simplify clauses by oriented equations
Selection functions, saturation the modern calculus (Bachmair-Ganzinger) behind Vampire/E yes

Horn clauses and Prolog#

A Horn clause has at most one positive literal. Three kinds:

Kind Form Reading
Fact (definite, unit) P(t) P(t) holds
Rule (definite) ¬A₁ ∨ ⋯ ∨ ¬Aₙ ∨ B, i.e. A₁ ∧ ⋯ ∧ Aₙ → B if all Aᵢ then B
Goal / query (negative) ¬A₁ ∨ ⋯ ∨ ¬Aₙ to prove A₁ ∧ ⋯ ∧ Aₙ

Prolog executes by SLD resolution: it resolves the current goal with the first matching program clause (top to bottom), depth-first, with backtracking.

prolog
parent(tom, bob).
parent(bob, ann).
ancestor(X, Y) :- parent(X, Y).
ancestor(X, Y) :- parent(X, Z), ancestor(Z, Y).

?- ancestor(tom, ann).      % true
?- ancestor(tom, W).        % W = bob ; W = ann

In Prolog :- is ← (read "if"), the comma is ∧, and variables begin with a capital. The program above is the logic formulas parent(tom,bob), parent(bob,ann), ∀x∀y (parent(x,y) → ancestor(x,y)), ∀x∀y∀z (parent(x,z) ∧ ancestor(z,y) → ancestor(x,y)).

How Prolog differs from a theorem prover: (1) Horn clauses only; (2) fixed search order (depth-first, left-to-right), so incomplete: a left-recursive rule can loop forever; (3) usually no occurs check (for speed), hence unsound in rare cases; (4) negation as failure (\+) is not logical negation; (5) built-in arithmetic and side effects. Datalog is the terminating subset (no function symbols), the basis of deductive databases.

7.9.6 SMT solvers: first-order logic modulo theories#

A theory fixes the meaning of some symbols (e.g. +, <, array select/store). An SMT solver decides satisfiability of formulas mixing Boolean structure with theory atoms.

DPLL(T): a SAT solver handles the Boolean skeleton; when it proposes a full assignment to the theory atoms, a theory solver checks consistency (e.g. simplex for linear arithmetic; congruence closure for equality with uninterpreted functions; bit-blasting for bit-vectors) and returns a conflict clause if inconsistent.

Theory Example atoms Decidable?
Equality + uninterpreted functions (EUF) f(a) = b yes (congruence closure)
Linear integer/real arithmetic (LIA, LRA) 2x + 3y ≤ 7 yes
Non-linear real arithmetic x·y > 1 yes (but expensive)
Non-linear integer arithmetic x·y = z no
Arrays select(store(a, i, v), i) = v yes (quantifier-free)
Bit-vectors x & y = 0 yes
Strings len(s) > 3 partially

SMT-LIB is the standard input language (prefix notation, like Lisp). Satisfiability:

text
(set-logic QF_LIA)
(declare-const x Int)
(declare-const y Int)
(assert (> x 0))
(assert (< y 0))
(assert (= (+ x y) 0))
(check-sat)          ; sat
(get-model)          ; e.g. x = 1, y = -1

To check validity, assert the negation and look for unsat:

text
(declare-const x Int)
(declare-const y Int)
(assert (not (=> (and (> x 0) (> y 0)) (> (+ x y) 0))))
(check-sat)          ; unsat  => the implication is valid

Quantifiers in SMT are handled heuristically (E-matching, model-based instantiation), so the solver may answer unknown.

Resolution proves entailments; to show a non-entailment you need a model. Model finders (Mace4, Paradox, Kodkod) search for a finite model by encoding the problem in SAT:

  1. Fix a domain size n, with domain {0, …, n−1}.
  2. Create a Boolean variable for each ground atom: for a binary predicate R, variables r_{ij} for 0 ≤ i, j < n.
  3. Replace ∀x A(x) by A(0) ∧ ⋯ ∧ A(n−1) and ∃x A(x) by A(0) ∨ ⋯ ∨ A(n−1); replace function symbols by relations with functionality clauses.
  4. Hand the resulting propositional formula to a SAT solver; a satisfying assignment is a model.
  5. If none exists, try n + 1. Break symmetries (isomorphic relabellings) to prune the search.

Example. To refute ∀y ∃x R(x, y) ⊨ ∃x ∀y R(x, y), try n = 1: with a single element 0, R(0,0) is either true (then both sentences are true) or false (then the premise is false). So there is no countermodel of size 1. Try n = 2: choose R = {(0,0), (1,1)}. Premise ∀y ∃x R(x, y): for y = 0 take x = 0; for y = 1 take x = 1. ✔. Conclusion ∃x ∀y R(x, y): for x = 0, R(0, 1) fails; for x = 1, R(1, 0) fails. ✘. So this 2-element structure is a countermodel. (Z3 also finds one.)

Limits. Finite model search is complete for finite satisfiability but not for sentences that have only infinite models (3.5). A prover/model-finder pair running in parallel is a standard combination: either proves or refutes most "small" problems.

7.9.8 A complete worked puzzle: the Dreadbury Mansion mystery#

This is a classic benchmark (Pelletier's problem 55) that every first-order prover can solve in milliseconds.

Someone who lives in Dreadbury Mansion killed Aunt Agatha. Agatha, the butler, and Charles live in Dreadbury Mansion, and are the only people who live there. A killer always hates his victim, and is never richer than his victim. Charles hates no one that Aunt Agatha hates. Agatha hates everyone except the butler. The butler hates everyone not richer than Aunt Agatha. The butler hates everyone Agatha hates. No one hates everyone. Agatha is not the butler. Who killed Agatha?

Step 1: Signature#

Constants a (Agatha), b (butler), c (Charles). Unary predicate Lives(x). Binary predicates Killed(x, y), Hates(x, y), Richer(x, y).

Step 2: Formalization#

# English Formula
1 Someone living there killed Agatha ∃x (Lives(x) ∧ Killed(x, a))
2 Agatha, the butler and Charles live there Lives(a) ∧ Lives(b) ∧ Lives(c)
3 They are the only residents ∀x (Lives(x) → (x = a ∨ x = b ∨ x = c))
4 A killer hates his victim ∀x ∀y (Killed(x, y) → Hates(x, y))
5 A killer is never richer than the victim ∀x ∀y (Killed(x, y) → ¬Richer(x, y))
6 Charles hates no one Agatha hates ∀x (Hates(a, x) → ¬Hates(c, x))
7 Agatha hates everyone except the butler ∀x (x ≠ b → Hates(a, x))
8 The butler hates everyone not richer than Agatha ∀x (¬Richer(x, a) → Hates(b, x))
9 The butler hates everyone Agatha hates ∀x (Hates(a, x) → Hates(b, x))
10 No one hates everyone ∀x ∃y ¬Hates(x, y)
11 Agatha is not the butler a ≠ b

Goal: Killed(a, a).

Step 3: The human proof#

By (1), (2), (3) the killer is one of a, b, c.

(Note where (11) is used: in the Charles case. Without it the axioms would not entail the conclusion; Z3 confirms that dropping a ≠ b makes the problem satisfiable with a different killer.)

Step 4: Give it to a prover (Prover9 syntax)#

text
formulas(assumptions).
  exists x (Lives(x) & Killed(x, agatha)).
  Lives(agatha). Lives(butler). Lives(charles).
  all x (Lives(x) -> (x = agatha | x = butler | x = charles)).
  all x all y (Killed(x, y) -> Hates(x, y)).
  all x all y (Killed(x, y) -> -Richer(x, y)).
  all x (Hates(agatha, x) -> -Hates(charles, x)).
  all x (x != butler -> Hates(agatha, x)).
  all x (-Richer(x, agatha) -> Hates(butler, x)).
  all x (Hates(agatha, x) -> Hates(butler, x)).
  all x exists y -Hates(x, y).
  agatha != butler.
end_of_list.

formulas(goals).
  Killed(agatha, agatha).
end_of_list.

(In Prover9, &, |, ->, - are ∧, ∨, →, ¬; all/exists are quantifiers; identifiers starting with u..z are variables, the others constants.) The prover negates the goal, clausifies everything (Skolemizing 1 and 10), and finds the refutation almost instantly.

Step 5: What the clauses look like#

Skolemize (1) with constant k and (10) with a function g:

text
{Lives(k)}                     {Killed(k, agatha)}
{¬Lives(x), x = agatha, x = butler, x = charles}
{¬Killed(x, y), Hates(x, y)}   {¬Killed(x, y), ¬Richer(x, y)}
{¬Hates(agatha, x), ¬Hates(charles, x)}
{x = butler, Hates(agatha, x)}
{Richer(x, agatha), Hates(butler, x)}
{¬Hates(agatha, x), Hates(butler, x)}
{¬Hates(x, g(x))}              {agatha ≠ butler}
{¬Killed(agatha, agatha)}      (negated goal)

Each human case above becomes a short resolution/paramodulation derivation.

7.9.9 One more resolution proof: reflexivity from symmetry, transitivity and seriality#

Show: ∀x ∀y (R(x,y) → R(y,x)), ∀x ∀y ∀z ((R(x,y) ∧ R(y,z)) → R(x,z)), ∀x ∃y R(x,y) ⊨ ∀x R(x,x).

Clauses. C₁ = {¬R(x, y), R(y, x)} (symmetry) C₂ = {¬R(x, y), ¬R(y, z), R(x, z)} (transitivity) C₃ = {R(x, f(x))} (seriality, Skolemized) C₄ = {¬R(c, c)} (negated goal: ¬∀x R(x,x) Skolemized with constant c)

Derivation.

Step Resolve Unifier Resolvent
5 C₃ with C₁ (on R(x,f(x)) vs ¬R(x′,y′)) x′ ↦ x, y′ ↦ f(x) C₅ = {R(f(x), x)}
6 C₃ with C₂ (first literal) x′ ↦ x, y′ ↦ f(x) C₆ = {¬R(f(x), z), R(x, z)}
7 C₆ with C₅′ (a renamed copy R(f(x′), x′)) z ↦ x′, x ↦ x′ C₇ = {R(x′, x′)}
8 C₇ with C₄ x′ ↦ c □

Reading: from "everything has an R-successor f(x)" and symmetry we get R(f(x), x); transitivity then yields R(x, x), contradicting the negated goal. (Z3 independently confirms the entailment.) Compare with the natural-deduction proof you construct in Problem 4.17: the same idea, a different format.

7.9.10 Quick-check (with answers)#

Q1. What does the DIMACS line -3 1 0 mean? Q2. Run unit propagation on {A, B}, {¬A}, {¬B, C}. What happens? Q3. Skolemize ∀x ∃y ∀z ∃w S(x, y, z, w). Q4. Find an MGU of Q(f(x), y) and Q(z, g(a)). Q5. Why does Prolog usually omit the occurs check, and what can go wrong? Q6. True or false: a Horn clause set is satisfiable iff unit propagation does not derive the empty clause. Q7. Why must the SAT solver answer for a validity question be read as "unsat means valid"? Q8. In the Dreadbury puzzle, which axiom rules out Charles as the killer, and which fact is needed to apply it?

Answers. A1. The clause ¬x₃ ∨ x₁. A2. {¬A} is a unit: A = F. Then {A, B} becomes {B}: unit, B = T. Then {¬B, C} becomes {C}: unit, C = T. All clauses satisfied: SAT with A = F, B = T, C = T. A3. ∀x ∀z S(x, f(x), z, g(x, z)). A4. {z ↦ f(x), y ↦ g(a)}. A5. For speed: checking x ∈ t costs time. Without it, X = f(X) "succeeds" by creating a cyclic term, so the answer can be unsound (and the program may loop). A6. True: unit propagation is complete for Horn clauses (Horn-SAT is solved by it). A7. Because Γ ⊨ A iff Γ ∪ {¬A} is unsatisfiable (F1): asserting the negated goal and getting UNSAT means the goal follows. A8. Axiom 6 (Charles hates no one Agatha hates), applied with x := a; it needs Hates(a, a), which comes from axiom 7 and a ≠ b.

Problems for Chapter 7#

7.1 ★★ Convert to clause form (show Skolemization):

7.2 ★★ Find an MGU or show none exists:

7.3 ★★ Prove by resolution: ∀x (P(x) → Q(x)), ∀x (Q(x) → R(x)), P(a) ⊨ R(a).

7.4 ★★ Prove by resolution: ∀x (P(x) → Q(x)), ∃x P(x) ⊨ ∃x Q(x).

7.5 ★★ Prove the propositional resolution rule is sound: if C ∨ A and D ∨ ¬A are both true under a valuation, so is C ∨ D.

7.6 ★★★ Show by resolution that ∀y ∃x R(x, y) ⊭ ∃x ∀y R(x, y), i.e., show that the clause set saturates with no empty clause, and say which unification step fails.

7.7 ★★★ Prove the drinker paradox ∃x (D(x) → ∀y D(y)) by resolution from scratch. Then prove Russell's barber, observing where factoring is needed.

7.8 ★★★ Explain why Skolemization preserves satisfiability but not equivalence. Give an explicit example of a formula φ with φ_Sk ⊭ φ or φ ⊭ φ_Sk, and a model-theoretic sketch of why φ satisfiable ⇒ φ_Sk satisfiable.

7.9 ★★★ Consider the clause set {P(a)}, {¬P(x), P(f(x))}, {¬P(f(f(f(a))))}. Using Herbrand's theorem, list a finite set of ground instances that is propositionally unsatisfiable. How many instances of the second clause are needed? Then refute the set by first-order resolution and compare how many steps each approach takes.


Chapter 8. Project: build your own logic engine ↑ Top#

Building the engine is not a side activity: it is the most efficient way to test your understanding. You cannot implement ∀-introduction without understanding freshness, or capture-avoiding substitution without understanding free and bound variables.

8.1 Goal and scope#

Goal: a program in which you can state a theorem in predicate logic and either (a) check a proof you wrote step by step, (b) build a proof interactively with goal-directed tactics, or (c) ask the machine to find a proof automatically, or a countermodel.

Recommended languages: any language with algebraic data types and pattern matching.

I recommend prototyping the whole stack in Python first, then (optionally) rewriting the kernel (the proof checker) in a typed language.

8.2 Architecture#

text
   ┌──────────────────────────── UI / CLI / web ─────────────────────────────┐
   │                                                                          │
   │  Tactics layer (intro, apply, cases, exists, ...)      Automated prover  │
   │            │                                    (NNF → Skolem → CNF →     │
   │            ▼                                     unification → resolution)│
   │   Proof objects (Fitch-style derivations)                    │           │
   │            │                                                 │           │
   │            ▼                                                 ▼           │
   │   ┌────────────────────────────────────┐        ┌──────────────────────┐ │
   │   │   KERNEL: proof checker (small,    │        │  Semantics:           │ │
   │   │   trusted, ~300 lines)             │        │  finite models,       │ │
   │   └────────────────────────────────────┘        │  countermodel finder  │ │
   │            │                                    └──────────────────────┘ │
   │            ▼                                                 │           │
   │   Core: AST, parser/printer, free vars, substitution, alpha-equivalence ◄┘ │
   └──────────────────────────────────────────────────────────────────────────┘

The LCF principle. Only the kernel can create "theorems". Everything above it (tactics, automation) may be buggy or heuristic, but if it ever produces a proof, the kernel re-checks it. This is the architecture of Lean, Coq/Rocq and Isabelle, and it is why you can trust their output.

8.3 Milestones#

Each milestone ends with tests. Do not move on until the tests pass.

M1. Syntax: AST, parser, pretty-printer#

M2. Core operations: free variables, substitution, alpha-equivalence#

M3. Semantics: model evaluator and countermodel finder#

M4. Propositional engine#

M5. Proof checker (the kernel)#

This is the heart of the project. See Section 8.5 for design.

M6. Tactics and interactive mode (proof assistant)#

M7. Automated FOL prover (resolution)#

M8. Equality, proof output, and cross-checking#

M9. Usability and polish#

8.4 Core data structures (Python)#

python
from __future__ import annotations
from dataclasses import dataclass
from itertools import count

# ---------- Terms ----------
@dataclass(frozen=True)
class Var:
    name: str

@dataclass(frozen=True)
class Fn:                      # constants are Fn with no arguments
    name: str
    args: tuple = ()

# ---------- Formulas ----------
@dataclass(frozen=True)
class Pred:
    name: str
    args: tuple = ()

@dataclass(frozen=True)
class Not:     f: object
@dataclass(frozen=True)
class And:     l: object; r: object
@dataclass(frozen=True)
class Or:      l: object; r: object
@dataclass(frozen=True)
class Implies: l: object; r: object
@dataclass(frozen=True)
class Iff:     l: object; r: object
@dataclass(frozen=True)
class Forall:  var: str; body: object
@dataclass(frozen=True)
class Exists:  var: str; body: object
@dataclass(frozen=True)
class Eq:      l: object; r: object
@dataclass(frozen=True)
class Bottom:  pass

Free variables:

python
def free_vars(x) -> set[str]:
    match x:
        case Var(n):                       return {n}
        case Fn(_, args) | Pred(_, args):  return set().union(*map(free_vars, args))
        case Eq(l, r) | And(l, r) | Or(l, r) | Implies(l, r) | Iff(l, r):
            return free_vars(l) | free_vars(r)
        case Not(f):                       return free_vars(f)
        case Forall(v, b) | Exists(v, b):  return free_vars(b) - {v}
        case Bottom():                     return set()

Capture-avoiding substitution x[t/v] (the single most bug-prone function in the project):

python
_fresh = count()
def fresh(base: str) -> str:
    return f"{base}_{next(_fresh)}"

def subst(x, v: str, t):
    match x:
        case Var(n):          return t if n == v else x
        case Fn(f, args):     return Fn(f, tuple(subst(a, v, t) for a in args))
        case Pred(p, args):   return Pred(p, tuple(subst(a, v, t) for a in args))
        case Eq(l, r):        return Eq(subst(l, v, t), subst(r, v, t))
        case Not(f):          return Not(subst(f, v, t))
        case And(l, r):       return And(subst(l, v, t), subst(r, v, t))
        case Or(l, r):        return Or(subst(l, v, t), subst(r, v, t))
        case Implies(l, r):   return Implies(subst(l, v, t), subst(r, v, t))
        case Iff(l, r):       return Iff(subst(l, v, t), subst(r, v, t))
        case Bottom():        return x
        case Forall(n, body) | Exists(n, body):
            ctor = type(x)
            if n == v:                                  # v is bound here: nothing to replace
                return x
            if n in free_vars(t) and v in free_vars(body):
                n2 = fresh(n)                           # rename the bound variable to avoid capture
                body = subst(body, n, Var(n2))
                n = n2
            return ctor(n, subst(body, v, t))

Unification (works for terms and atoms, since both have .name and .args; the substitution is kept in triangular form, so apply it with walk recursively):

python
def walk(t, s):
    while isinstance(t, Var) and t.name in s:
        t = s[t.name]
    return t

def occurs(v, t, s) -> bool:
    t = walk(t, s)
    if isinstance(t, Var):
        return t.name == v
    return any(occurs(v, a, s) for a in t.args)

def unify(a, b, s=None):
    s = {} if s is None else s
    a, b = walk(a, s), walk(b, s)
    if a == b:
        return s
    if isinstance(a, Var):
        return None if occurs(a.name, b, s) else {**s, a.name: b}
    if isinstance(b, Var):
        return unify(b, a, s)
    if a.name != b.name or len(a.args) != len(b.args):
        return None
    for x, y in zip(a.args, b.args):
        s = unify(x, y, s)
        if s is None:
            return None
    return s

def apply(s, t):
    t = walk(t, s)
    if isinstance(t, Var):
        return t
    return type(t)(t.name, tuple(apply(s, a) for a in t.args))

Resolution (clauses are frozensets of (positive?, atom) literals):

python
_ids = count()

def rename_apart(clause):
    suffix = f"#{next(_ids)}"            # globally unique, so repeated renaming never clashes
    def rt(t):
        if isinstance(t, Var):
            return Var(t.name + suffix)
        return type(t)(t.name, tuple(rt(a) for a in t.args))
    return frozenset((sign, rt(atom)) for sign, atom in clause)

def resolvents(c1, c2):
    c2 = rename_apart(c2)
    for (s1, a1) in c1:
        for (s2, a2) in c2:
            if s1 != s2:
                theta = unify(a1, a2)
                if theta is not None:
                    rest = (c1 - {(s1, a1)}) | (c2 - {(s2, a2)})
                    yield frozenset((s, apply(theta, a)) for s, a in rest)

def factors(c):
    lits = list(c)
    for i, (s1, a1) in enumerate(lits):
        for (s2, a2) in lits[i + 1:]:
            if s1 == s2:
                theta = unify(a1, a2)
                if theta is not None:
                    yield frozenset((s, apply(theta, a)) for s, a in c)

(A real implementation adds subsumption, tautology checks, variable normalization to keep clause sets finite up to renaming, and resource limits.)

Java 21 alternative for the AST:

java
sealed interface Formula permits Pred, Not, And, Or, Implies, Iff, Forall, Exists, Eq, Bottom {}
record Pred(String name, List<Term> args) implements Formula {}
record Not(Formula f) implements Formula {}
record And(Formula l, Formula r) implements Formula {}
// ...
record Forall(String var, Formula body) implements Formula {}

with switch pattern matching giving you exhaustiveness checking from the compiler. If you forget a case when writing subst, it will not compile.

8.5 Designing the proof checker (the kernel)#

Representation. A proof is a tree of blocks. A block has an optional opening (an assumption formula, or a fresh-name introduction, or both for ∃E) and a list of items, each of which is a line or a nested block. A line is (formula, rule, references).

Scope rule. When checking a line, the lines it may cite are exactly those in the same block or in enclosing blocks, appearing earlier. A block may be cited as a whole (a range) by →I, ¬I, RAA, ∨E, ∀I, ∃E. Implement this with a stack of scopes as you traverse the proof.

Per-rule check = pattern match + side condition. Each rule is a small function check_rule(line, cited_lines) -> None | error. For example:

text
→E:    cited lines: φ and ψ.  Require ψ == Implies(φ, line.formula)         (modulo alpha-equivalence)
→I:    cited block: opens with assumption φ, last line ψ.  Require line.formula == Implies(φ, ψ)
∨E:    cited: line (φ ∨ ψ), block opening φ ending χ, block opening ψ ending χ'.
       Require χ == χ' == line.formula
∀E:    cited: ∀x φ.   Require line.formula == subst(φ, x, t) for some term t that is free for x in φ.
       (Simplest: try t = every term occurring in the conclusion; or require the user to give t.)
∃I:    cited: φ[t/x].  Require line.formula == ∃x φ for some t. (Ask the user for t, or search.)
∀I:    cited block: opens with fresh name a (no assumption), ends with φ(a).
       Require line.formula == ∀x ψ where ψ[a/x] == φ(a), and
         a does not occur in: any premise, any assumption of an ENCLOSING open block, or ∀x ψ.
∃E:    cited: ∃x ψ at line i; block opening ψ[a/x] with name a, ending χ.
       Require line.formula == χ, and
         a does not occur in: ∃x ψ, χ, any premise, any assumption of an enclosing open block.
RAA:   cited block: opens with ¬φ, ends ⊥.  Require line.formula == φ.

The side conditions are the most valuable lines of code in the project. Write them, test them with the bad proofs of Section 4.2, and you will never again confuse a legal ∀I with an illegal one.

Comparing formulas. Use alpha_eq, not ==, wherever formulas are matched (a substitution may rename bound variables).

Error reporting. Return structured errors: line number, rule, which condition failed. Good error messages are what turn the checker into a teaching tool.

8.6 Testing strategy#

8.7 Extensions#

8.8 Chapter 8 in complete detail: the starter kit#

Sections 8.1–8.7 describe what to build. This section hands you a working, tested reference implementation of the hardest milestones, so that you can read real code, break it on purpose, and then write your own better version. It is deliberately small (one Python file, no dependencies) and deliberately incomplete: tactics, paramodulation and a user interface are left as your exercises.

The two files are:

Both ship alongside this document. Requirement: Python 3.10 or newer, because the code uses match statements (structural pattern matching).

8.8.1 What is inside, milestone by milestone#

Milestone Functions you will find What it demonstrates
M1 Syntax parse, pretty, tokenize, the dataclasses Var Fn Pred Not And Or Implies Iff Forall Exists Eq Bottom Recursive-descent parsing with precedence; an immutable AST; parse(pretty(f)) == f
M2 Substitution free_vars, subst, fresh_var, alpha_eq Capture-avoiding substitution; equality up to renaming of bound variables
M3 Semantics Structure, holds, signature, structures, find_countermodel Tarski's definition executed literally over finite domains; refuting invalid arguments
M4 Propositional truth_table, is_tautology, elim_arrows, nnf, nnf_to_clauses, tseitin, dpll, sat The whole SAT pipeline, from formula to model
M5 Kernel check_proof, ProofError A Fitch proof checker with scoping and freshness conditions
M7 Prover clausify, skolemize, unify, resolvents, factors, subsumes, prove Resolution refutation with a given-clause loop

Milestones M6 (tactics), M8 (equality by paramodulation) and M9 (user interface) are not implemented. prove can handle equality only by adding explicit equality axioms (with_equality=True), which is slow and incomplete in practice — that weakness is the motivation for M8.

8.8.2 The input language#

The parser accepts ASCII and Unicode interchangeably.

Meaning ASCII Unicode also accepted
not ~P ¬P
and P & Q P ∧ Q
or P | Q P ∨ Q
implies P -> Q P → Q, P ⇒ Q
iff P <-> Q P ↔ Q, P ⇔ Q
false false ⊥
for all forall x. P(x) ∀x P(x)
exists exists x. P(x) ∃x P(x)
equals, not equals a = b, a != b a ≠ b

Two conventions you must know, because they decide how input is read:

  1. Variables versus constants. An identifier that starts with one of the letters u v w x y z is a variable. Every other identifier (a, socrates, f, P) is a constant, function or predicate symbol. This mirrors the usual textbook convention (Section Z4.8) and keeps the grammar simple.
  2. Quantifier scope. forall x. A (with a dot) extends as far right as possible. ∀x A (no dot) binds tightly, like ~. So forall x. P(x) -> Q(x) is ∀x (P(x) → Q(x)), while ∀x P(x) → Q is (∀x P(x)) → Q.

Precedence from loosest to tightest: <->, then -> (right-associative), then |, then &, then ~ and quantifiers.

8.8.3 Using it from the command line#

text
$ python3 logic_engine_starter.py parse 'forall x. P(x) -> exists y. R(x,y)'
forall x. P(x) -> (exists y. R(x, y))
Forall(var='x', body=Implies(l=Pred(name='P', ...), r=Exists(var='y', ...)))

The pretty-printer adds parentheses around the inner quantifier. That is harmless and safe: printing never has to guess how far a quantifier reaches.

text
$ python3 logic_engine_starter.py prove 'forall x. (H(x) -> M(x))' 'H(socrates)' '|-' 'M(socrates)'
proved
  1. {~H(x_0), M(x_0)}                             input
  2. {H(socrates)}                                 input
  3. {M(socrates)}                                 resolve
  4. {~M(socrates)}                                input
  5. []                                            resolve

Read this as a resolution proof (Section 7.9.9). Lines 1, 2 and 4 are the clauses of the premises and of the negated goal. Line 3 resolves lines 1 and 2 (unifier x_0 ↦ socrates). Line 5 resolves 3 and 4 and produces the empty clause []: a contradiction, so the argument is valid.

text
$ python3 logic_engine_starter.py countermodel 'exists x. P(x)' '|-' 'forall x. P(x)'
D = [0, 1]; P = [(1,)]

A two-element world where something is P (element 1) but not everything is. This is exactly the semantic refutation you learned in Chapter 3.

text
$ python3 logic_engine_starter.py prove 'forall x. exists y. R(x,y)' '|-' 'exists y. forall x. R(x,y)'
saturated

This is the classic invalid quantifier swap. The prover returns saturated: it ran out of new clauses without finding the empty clause. For a finite, saturated clause set that means the set is satisfiable, i.e. the argument is invalid. The prover never says "invalid" outright, because in general first-order validity is only semi-decidable (Section 6.7.6); limit means "I gave up", which tells you nothing.

8.8.4 Walking through the proof checker (the kernel)#

check_proof(text, goal=None) returns a list of error messages; an empty list means the proof is accepted. This is the LCF idea in miniature: everything else in your engine (tactics, automation) may be clever and buggy, but nothing counts as a theorem until this small, simple function accepts it.

Proof format. One line per step:

text
1. P -> Q  premise
2. Q -> R  premise
3. | P  assumption
4. | Q  ->E 1,3
5. | R  ->E 2,4
6. P -> R  ->I 3-5

Rule names (ASCII or Unicode): premise assumption &I &E |I |E ->I ->E ~I ~E falseE RAA <->I <->E forallE forallI existsI existsE =I =E Reit.

What the kernel checks, rule by rule. For propositional rules it checks that the cited lines have exactly the required shapes, e.g. ->E needs A -> B and A, concluding B. Formulas are compared up to alpha-equivalence, so forall x. P(x) and forall y. P(y) are the same.

For quantifier rules it adds the side conditions that make first-order logic sound:

Four proofs the test-suite checks.

  1. Hypothetical syllogism (above) — accepted.
  2. The same proof with ->E 1,4 in line 5 — rejected, with the message line 5 (impE): need A -> B and A, concluding B.
  3. A ∀I proof of ∀x Q(x) from ∀x (P(x) → Q(x)) and ∀x P(x) — accepted.
  4. A "proof" of ∀x P(x) from the single premise P(a) that opens a ∀I box with the name a — rejected, because a occurs in a premise. This is the mechanical form of the warning "you cannot generalise from a particular".
text
1. exists x. P(x)  premise
2. exists x. Q(x)  premise
3. | [a] P(a)  assumption
4. | | [a] Q(a)  assumption         <- REJECTED: name 'a' already introduced by the enclosing box
5. | | P(a) & Q(a)  &I 3,4
...

This is the invalid inference ∃x P(x), ∃x Q(x) ⊢ ∃x (P(x) ∧ Q(x)). A naive checker would accept it; yours must not.

8.8.5 Walking through the prover#

prove(premises, goal) does the textbook pipeline of Sections 7.9.3–7.9.5:

  1. elim_arrows removes -> and <->.
  2. nnf pushes negations inward (De Morgan, quantifier duality).
  3. standardize_apart gives every quantifier its own variable name (x_0, x_1, …).
  4. skolemize replaces each ∃y by a fresh Skolem term sk1(x1,…,xk) over the enclosing universal variables.
  5. drop_universals forgets the ∀ prefix (all remaining variables are implicitly universal).
  6. nnf_to_clauses distributes | over & to get clauses: frozensets of (sign, atom).
  7. The given-clause loop: pick the lightest unprocessed clause; discard it if an active clause subsumes it; resolve it against every active clause and itself; add factors; delete tautologies and duplicates (compared after renaming variables canonically). Stop when the empty clause appears (proved), when nothing is left (saturated), or when resources run out (limit).

Three engineering details worth studying, because they are where beginners' provers go wrong:

8.8.6 Testing strategy (copy it)#

test_starter.py uses four kinds of test; every engine should:

Kind Example in the file Why it catches bugs
Unit tests with known answers P | Q & R parses as P | (Q & R) Locks in conventions
Round-trip properties parse(pretty(f)) == f on 300 random formulas Catches printer/parser disagreements
Oracle comparison sat(f) (Tseitin+DPLL) versus brute-force truth tables on 300 random formulas A slow, obviously correct implementation checks the fast one
Negative tests the unsound proofs listed in 8.8.4 must be rejected A checker that accepts everything passes every positive test
Cross-checks between components if prove says valid, find_countermodel must find nothing Components agree or one is wrong

8.8.7 Exercises for the starter kit#

  1. Read first. Without running anything, predict what pretty(parse("~(P & Q) -> R | S")) prints. Then run it.
  2. Break the occurs check. Delete the occurs check from unify, then run unify(Var("x"), Fn("f", (Var("x"),))). What happens, and which test in the file would you write to catch it?
  3. Break renaming. Comment out rename_apart in resolvents. Find a small problem that prove solved before and now fails or misbehaves.
  4. Add a rule. Add the derived rule MT (modus tollens: from A -> B and ~B conclude ~A) to the kernel as a primitive, then explain why you would rather add it as a derived rule that expands into primitive steps.
  5. Add Reit-free scoping. The kernel allows a line to cite any earlier line in an enclosing box. Write a test proving that citing a line inside a closed box is rejected.
  6. Better output. Write explain(proof_text) that, for each accepted line, prints an English sentence such as "Line 4: from lines 1 and 3 by modus ponens, Q."
  7. Countermodel quality. find_countermodel enumerates every structure of size n. For n = 3 and a binary predicate this is 512 structures; for n = 4 it is 65,536. Estimate the count for one binary predicate and one binary function at n = 3, then explain why you would switch to a SAT-based search (Section 7.9.7).
  8. Tactics (M6). Write a function intro(goal) that, given a goal A -> B, returns the new assumption A and new goal B. Then write apply_rule(goal, hyps) for ->E, and use them to implement a tiny interactive prover on top of the kernel.
  9. Equality (M8). Implement a demodulation step: given a unit equation l = r and a clause containing an instance of l, replace it by the instance of r. Show it solves a = b, P(a) ⊢ P(b) without equality axioms.
  10. Stress test. Generate random Horn problems, solve them with prove, and compare against a simple forward-chaining implementation. Any disagreement is a bug.

8.8.8 Quick-check#

  1. Why does the kernel compare formulas up to alpha-equivalence rather than with ==? (Because renaming a bound variable does not change meaning; ∀x P(x) and ∀y P(y) are the same formula and a proof should not fail because of the bound variable's spelling.)
  2. What does the status saturated tell you, and why can prove never say "invalid"? (That no empty clause can be derived, so premises plus negated goal are satisfiable and the argument is invalid — but only when no clauses were discarded. First-order validity is semi-decidable, so a general procedure may simply run forever; "limit" is not evidence of invalidity.)
  3. Name two reasons the freshness conditions exist. (Without them, ∀I would generalise from a particular object and ∃E would let a witness name leak out of its box; both make the system unsound.)
  4. Why do we test that bad proofs are rejected? (A kernel that accepts everything passes all positive tests; only negative tests show it actually checks something.)
  5. What would you change so that prove can solve f(f(x)) = x, f(f(f(a))) = b ⊢ f(a) = b? (Replace equality axioms by a rule built into the calculus — paramodulation/superposition with term orderings — Milestone M8.)

Chapter 9. Beyond the basics, resources, and a 12-week plan ↑ Top#

9.1 Where to go next#

Topic What it is Why it matters Prerequisites
Computability Turing machines, halting problem, Rice's theorem, reductions Explains why FOL is undecidable and why verification is hard Ch. 5-6
Gödel's theorems (in depth) Arithmetization, representability, the fixed-point lemma The limits of formal systems Computability
Model theory Types, elementary equivalence, ultraproducts, Łoś, quantifier elimination What first-order theories can and cannot say; applications to algebra Ch. 3, 6
Set theory ZFC axioms, ordinals, cardinals, the axiom of choice, independence of CH The foundation of mathematics Ch. 5
Proof theory Sequent calculus, cut elimination, normalization Structure of proofs; basis of proof assistants Ch. 2, 4
Type theory / Curry-Howard λ-calculus, simple types, dependent types, Martin-Löf type theory Programs are proofs. Lean, Coq/Rocq, Agda Ch. 2, 4
Proof assistants Lean 4, Rocq, Isabelle Machine-checked mathematics and verified software Ch. 4, 5
SAT / SMT CDCL, DPLL(T), theory solvers (arithmetic, arrays, bitvectors) Industrial verification, symbolic execution, planning Ch. 1, 7
Modal and temporal logic Kripke semantics; LTL, CTL; model checking Specifying and verifying concurrent and distributed systems (TLA+) Ch. 3
Program verification Hoare logic, weakest preconditions, separation logic Proving programs correct Ch. 4
Logic programming / Datalog Horn clauses, SLD resolution, Prolog, Datalog Queries, rules engines, program analysis Ch. 7
Description logics / ontologies Decidable fragments of FOL (OWL) Knowledge graphs, semantic web Ch. 3
Higher-order logic Quantification over predicates and functions Isabelle/HOL, formalized mathematics Ch. 3-4
Intuitionistic and linear logic Constructive reasoning; resource-sensitive logic Type systems (Rust's ownership has linear-logic roots) Ch. 2

A natural next sequence after this course: computability → Gödel's theorems → model theory or type theory (depending on whether you lean toward mathematics or programming languages). Since you want to build engines, Lean 4 + type theory is the path that most directly reuses your project.

9.2 Resources#

Textbooks (roughly in order of use):

Interactive tools:

9.3 The 12-week plan#

Assumes 6-8 hours per week. Each week: 2-3 hours reading and worked examples, 2-3 hours problems, 2 hours project. Redo one old proof each week from a blank page.

Week Theory Problems Project milestone
1 Ch. 0-1: foundations, implication, normal forms 1.1-1.10 M1 start: AST, parser
2 Ch. 2.1-2.5: Fitch proofs, rules, strategy 2.1-2.8 M1 finish: pretty-printer, round-trip tests
3 Ch. 2.6-2.9: derived rules, classical vs. intuitionistic 2.9-2.18 M4: truth tables, CNF, DPLL
4 Ch. 3.1-3.4: syntax, free/bound, translation 3.1-3.6 M2: free vars, substitution, alpha-eq
5 Ch. 3.5-3.8: semantics, countermodels, laws, prenex 3.7-3.12 M3: model evaluator, countermodel search
6 Ch. 4.1-4.4: quantifier rules, freshness, worked proofs 4.1-4.9 M5 start: checker for propositional rules
7 Ch. 4.5-4.7: strategy, equality, mistakes 4.10-4.20 M5: quantifier rules, side conditions, tests
8 Ch. 5.1-5.7: informal proof techniques 5.1-5.6 M5 polish; start M6 (tactics)
9 Ch. 5.8-5.13: induction (weak, strong, structural), sets, functions 5.7-5.17 M6: tactic layer
10 Ch. 6: soundness, completeness, compactness, undecidability 6.1-6.8 M7 start: NNF, Skolemization, CNF
11 Ch. 7: unification, resolution 7.1-7.9 M7: resolution prover, Pelletier problems
12 Review; redo the hardest problems; choose next topic Error-log review M8/M9: equality, cross-checks, polish

Readiness checkpoints (be honest with yourself):

If you meet these, you have mastered the basics of logic and proofs in the sense you asked for, and you are ready for the topics in 9.1.

9.4 Pace for the Complete Edition (starting from absolute zero)#

The 12-week plan above assumes you read only the core sections of each chapter. The Complete Edition adds Part Zero (Chapters Z1–Z5) and a "complete detail" companion at the end of every chapter's numbered sections (1.8, 2.9, 3.8, 4.7, 5.14, 6.7, 7.9, 8.8). Here is how to fold them in.

Stage Read Notes
Before week 1 (3–5 days) Z1, Z2, Z3 Reasoning, mathematical language, sets, functions, relations, sequences, trees. Do the quick-checks. Skip nothing if any word is unfamiliar.
Before week 1 (1–2 days) Z4 (skim), Z5 (skim) Treat the Symbol Atlas as a reference; read it fully once, then come back whenever a sign puzzles you. Z5 shows the same logic in other notations; skim it now, study it when you meet those formats.
Weeks 1–2 Ch. 0–1, then 1.8 Read the companion after the core sections, then do the problems.
Weeks 3–4 Ch. 2, then 2.9 The companion has the full rule tables, the proof-search procedure and the other proof formats.
Weeks 5–6 Ch. 3, then 3.8 Do the translation workshop in 3.8.7 on paper.
Weeks 7–8 Ch. 4, then 4.7 Study the gallery of illegal proofs in 4.7.5 until you can state the violated condition at a glance.
Weeks 9–10 Ch. 5, then 5.14 Induction in complete detail (5.14.4) is the most reusable material in the book.
Weeks 11–12 Ch. 6, 7, then 6.7, 7.9 Metatheory and automated reasoning; run the SAT and unification traces by hand.
Weeks 13–16 Ch. 8, then 8.8 Run the starter kit, read its tests, do the exercises, then extend it.

Use Appendix D (glossary) whenever a term is unfamiliar and Appendix E when you need to type a symbol or write a formula in some tool's syntax. Total: about 16 weeks at 6–8 hours per week if you start from zero; fewer if you already know the Part Zero material.


Appendix A. Rule cheat sheet ↑ Top#

A.1 Natural deduction: propositional rules#

Rule Premises Conclusion
∧I A, B A ∧ B
∧E A ∧ B A (or B)
∨I A A ∨ B (or B ∨ A)
∨E A ∨ B; sub-proof A ⊢ C; sub-proof B ⊢ C C
→I sub-proof A ⊢ B A → B
→E A, A → B B
¬I sub-proof A ⊢ ⊥ ¬A
¬E A, ¬A ⊥
⊥E ⊥ any C
↔I A → B, B → A A ↔ B
↔E A ↔ B, A (or B) B (or A)
RAA (classical) sub-proof ¬A ⊢ ⊥ A

A.2 Quantifier and equality rules#

Rule Premises Conclusion Side condition
∀E ∀x A A[t/x] t free for x in A
∃I A[t/x] ∃x A t free for x in A
∀I sub-proof (fresh a) ⊢ A[a/x] ∀x A a does not occur in any premise, any open assumption, or ∀x A
∃E ∃x A; sub-proof (fresh a, assume A[a/x]) ⊢ C C a does not occur in ∃x A, C, any premise, or any other open assumption
=I (none) t = t
=E s = t, A[s/x] A[t/x]

A.3 Proof-finding strategy at a glance#

Goal Move
A → B assume A, prove B
¬A assume A, derive ⊥
A ∧ B prove both
A ∨ B prove one disjunct; else RAA
A ↔ B prove both directions
∀x A fresh a, prove A(a)
∃x A find a witness t, prove A(t); else RAA
anything stuck RAA: assume the negation, derive ⊥
Have Move
A ∧ B ∧E
A → B →E when you have A
A ∨ B cases (∨E)
¬A combine with A to get ⊥
∀x A ∀E with useful terms
∃x A ∃E with a fresh witness name
⊥ ⊥E: anything

A.4 Translation patterns#

English Logic
All S are P ∀x (S(x) → P(x))
Some S are P ∃x (S(x) ∧ P(x))
No S is P ∀x (S(x) → ¬P(x))
Not all S are P ∃x (S(x) ∧ ¬P(x))
Only S are P ∀x (P(x) → S(x))
At most one P ∀x∀y ((P(x) ∧ P(y)) → x = y)
Exactly one P ∃x (P(x) ∧ ∀y (P(y) → y = x))

A.5 Key equivalences#

A.6 Symbol glossary#

Symbol Reads Level
¬, ∧, ∨, →, ↔ not, and, or, implies, iff object language
⊤, ⊥ true, false (absurdity) object language
∀, ∃, ∃! for all, there exists, there exists exactly one object language
⊨ semantically entails / is valid metalanguage
⊢ proves / is derivable from metalanguage
≡ is logically equivalent to metalanguage
⊣⊢ is provably equivalent to metalanguage
A[t/x] A with t substituted for free x metalanguage
∎ end of proof prose

Appendix B. Common mistakes catalog ↑ Top#

Use this as a checklist when reviewing your own work.

Propositional logic and proofs#

  1. Reading "A only if B" as B → A. (It is A → B.)
  2. Affirming the consequent: from A → B and B, concluding A.
  3. Denying the antecedent: from A → B and ¬A, concluding ¬B.
  4. Treating P → Q as false when P is false.
  5. Confusing the converse with the contrapositive.
  6. Proving a negation by assuming the negation (¬I needs you to assume the positive statement).
  7. Using RAA to prove a statement but forgetting that you must assume the negation of the goal.
  8. Using a line from a closed sub-proof.
  9. Forgetting to discharge an assumption.
  10. Applying a rule to a sub-formula instead of the main connective.
  11. ∨E with branches that end in different formulas.

Predicate logic#

  1. Translating "All S are P" with ∧, or "Some S are P" with →.
  2. Swapping quantifier order: ∀∃ and ∃∀ are different, and only ∃∀ ⇒ ∀∃.
  3. Forgetting that ∀x (A → B) is not equivalent to ∀x A → ∀x B.
  4. Moving a quantifier out of an antecedent without flipping it.
  5. Variable capture in substitution.
  6. Assuming a domain is non-empty when working in a free logic, or forgetting it when working in standard FOL.
  7. Illegal ∀I: generalizing over a name that occurs in an open assumption or premise.
  8. Letting the ∃E witness escape into the conclusion.
  9. Reusing one witness name for two different existentials.
  10. Concluding P(a) from ∃x P(x) with a name of your own choosing.
  11. Proving ∀x P(x) by checking examples. (Examples prove ∃, and counterexamples disprove ∀.)

Informal mathematical proofs#

  1. Starting without unpacking the definitions.
  2. Assuming what is to be proved (circular reasoning).
  3. Using the same letter for two different objects.
  4. Introducing a variable "arbitrary" and then silently assuming a special property of it ("WLOG" without justification).
  5. Proof by contradiction where no contradiction is derived, or the contradiction is with something not assumed.
  6. Missing cases in a case analysis.
  7. Induction: no base case, wrong base case, an inductive step that uses P(n + 1), or a step that fails for small n.
  8. Induction hypothesis not strong enough: you may need to strengthen the claim (tromino problem).

Metatheory#

  1. Confusing ⊨ with ⊢ (before soundness/completeness are invoked).
  2. Confusing Gödel's completeness theorem (about FOL provability) with the incompleteness theorems.
  3. Believing a prover's timeout means the formula is invalid.

Engineering the logic engine#

  1. Substitution that does not rename bound variables.
  2. Unification without occurs check.
  3. Forgetting to rename clauses apart before resolution.
  4. Resolution without factoring.
  5. Comparing formulas with == instead of alpha-equivalence.
  6. A checker that verifies the final formula but not scope or freshness conditions.
  7. Skolemizing with Skolem constants where Skolem functions of the enclosing universals are needed.

Appendix C. Hints and solutions ↑ Top#

How to use: read the hint, close the file, and try again. Read the full solution only after a real attempt. Where a solution is only a sketch, you should be able to expand it into a full formal or informal proof; if you cannot, that is exactly the thing to practice.


Chapter 1#

1.1 Rows (P,Q) = TT, TF, FT, FF. P → Q: T F T T. ¬P ∨ Q: T F T T. P ∧ ¬Q: F T F F, so ¬(P ∧ ¬Q): T F T T. ¬Q → ¬P: T F T T. All four columns agree.

1.2 Original: true. Converse ("if divisible by 3 then by 6"): false (3). Inverse ("if not divisible by 6 then not divisible by 3"): false (3 again). Contrapositive ("if not divisible by 3 then not divisible by 6"): true. As expected, the original and its contrapositive are equivalent, and the converse and inverse are equivalent to each other.

1.3

1.4 (a) Yes (modus ponens twice). (b) No: P = F, Q = T makes both premises true and P false (affirming the consequent). (c) Yes (disjunctive syllogism). (d) No: P = F, Q = T makes P → Q true, ¬P true, and ¬Q false.

1.5 P → (Q → R) ≡ ¬P ∨ (¬Q ∨ R) ≡ (¬P ∨ ¬Q) ∨ R ≡ ¬(P ∧ Q) ∨ R ≡ (P ∧ Q) → R. (Steps: implication as disjunction twice, associativity, De Morgan, implication as disjunction.)

1.6 P ↔ Q ≡ (¬P ∨ Q) ∧ (¬Q ∨ P). CNF: (¬P ∨ Q ∨ R) ∧ (P ∨ ¬Q ∨ R). DNF: (P ∧ Q) ∨ (¬P ∧ ¬Q) ∨ R.

1.7 Suppose all three hold. ¬(P → R) forces P true and R false. Then P → Q gives Q true, and Q → R gives R true. Contradiction with R false. So the set is unsatisfiable, and by (F1) the entailment holds.

1.8 ¬P ≡ P | P. P ∧ Q ≡ ¬(P | Q) ≡ (P | Q) | (P | Q). Since {¬, ∧} is complete, so is NAND.

1.9 Let v⊤ make every atom true. By structural induction, every formula built from atoms with ∧, ∨, →, ↔ is true under v⊤ (each connective maps T, T to T). But ¬P is false under v⊤. So no such formula is equivalent to ¬P.

1.10 Let a = "A is a knight", b = "B is a knight". A's statement is ¬b; a person is a knight iff their statement is true, so a ↔ ¬b. B's statement is (a ↔ b), so b ↔ (a ↔ b). If b were true, then a ↔ b would have to be true, so a is true; but then a ↔ ¬b is T ↔ F, false. So b is false. Then (a ↔ b) must be false, so a ≠ b, so a is true. Check a ↔ ¬b: T ↔ T ✔. A is the knight, B is the knave.


Chapter 2#

(Fitch notation as in Chapter 2. "Reit" means reiteration of an earlier line into a sub-proof.)

2.1 ∧E (get Q), ∧E (get P), ∧I.

2.2 P ⊢ ¬¬P: assume ¬P; ¬E with P gives ⊥; ¬I gives ¬¬P.

2.3 Assume P; →E gives Q; ¬E with ¬Q gives ⊥; ¬I gives ¬P.

2.4 ⊢ P → (Q → P):

text
1.  |  P               assumption
2.  |  |  Q            assumption
3.  |  |  P            reit 1
4.  |  Q → P           →I 2-3
5.  P → (Q → P)        →I 1-4

2.5 ∨E on P ∨ Q: case P → ∨I gives Q ∨ P; case Q → ∨I gives Q ∨ P.

2.6 (P ∧ Q) → R ⊢ P → (Q → R): assume P, assume Q, ∧I, →E, →I, →I. Converse: assume P ∧ Q, ∧E twice, →E with P gives Q → R, →E with Q gives R, →I.

2.7 Assume (1) P → (Q → R), (2) P → Q, (3) P. →E 2,3: Q. →E 1,3: Q → R. →E: R. Discharge 3, 2, 1 with →I three times.

2.8 ∨E on the premise. Case P ∧ Q: ∧E gives P and Q; ∨I gives Q ∨ R; ∧I gives P ∧ (Q ∨ R). Case P ∧ R: symmetric.

2.9 Assume P ∧ ¬P; ∧E twice; ¬E gives ⊥; ¬I gives ¬(P ∧ ¬P).

text
1.  |  P ∧ ¬P          assumption
2.  |  P               ∧E 1
3.  |  ¬P              ∧E 1
4.  |  ⊥               ¬E 2,3
5.  ¬(P ∧ ¬P)          ¬I 1-4

2.10 Assume P ∧ Q. ∨E on ¬P ∨ ¬Q with goal ⊥: case ¬P: ∧E gives P; ¬E gives ⊥. Case ¬Q: ∧E gives Q; ¬E gives ⊥. So ⊥. Discharge with ¬I.

2.11 Assume P. ∨E on ¬P ∨ Q with goal Q: case ¬P: ¬E with P gives ⊥, ⊥E gives Q. Case Q: Q. So Q. →I.

2.12 ↔I needs P → R and R → P. For P → R: assume P; ↔E with P ↔ Q gives Q; ↔E with Q ↔ R gives R. For R → P: assume R; ↔E (the other direction) with Q ↔ R gives Q, then with P ↔ Q gives P.

2.13

text
1.  P → Q              premise
2.  P ∨ ¬P             LEM (Example 5)
3.  |  P               assumption
4.  |  Q               →E 1,3
5.  |  ¬P ∨ Q          ∨I 4
6.  |  ¬P              assumption
7.  |  ¬P ∨ Q          ∨I 6
8.  ¬P ∨ Q             ∨E 2, 3-5, 6-7

2.14

text
1.  ¬(P ∧ Q)           premise
2.  P ∨ ¬P             LEM
3.  |  P               assumption
4.  |  |  Q            assumption
5.  |  |  P ∧ Q       ∧I 3,4
6.  |  |  ⊥           ¬E 5,1
7.  |  ¬Q              ¬I 4-6
8.  |  ¬P ∨ ¬Q        ∨I 7
9.  |  ¬P              assumption
10. |  ¬P ∨ ¬Q        ∨I 9
11. ¬P ∨ ¬Q            ∨E 2, 3-8, 9-10

2.15

text
1.  P ∨ ¬P                         LEM
2.  |  P                          assumption
3.  |  |  Q                       assumption
4.  |  |  P                       reit 2
5.  |  Q → P                      →I 3-4
6.  |  (P → Q) ∨ (Q → P)          ∨I 5
7.  |  ¬P                         assumption
8.  |  |  P                       assumption
9.  |  |  ⊥                       ¬E 8,7
10. |  |  Q                       ⊥E 9
11. |  P → Q                      →I 8-10
12. |  (P → Q) ∨ (Q → P)          ∨I 11
13. (P → Q) ∨ (Q → P)             ∨E 1, 2-6, 7-12

(Intuition: for any two statements, one implies the other. Surprising, but it is a consequence of classical truth values: either P is true, so everything implies it, or P is false, so it implies everything.)

2.16 Assume ¬P (for RAA). Assume P; ¬E gives ⊥; ⊥E gives Q; →I gives P → Q. →E with the premise gives P. ¬E with ¬P gives ⊥. RAA gives P.

2.17 ∨E on P ∨ Q with goal Q ∨ R. Case P: ∨E on ¬P ∨ R: sub-case ¬P gives ⊥ (with P) then Q ∨ R by ⊥E; sub-case R gives Q ∨ R by ∨I. Case Q: ∨I gives Q ∨ R.

2.18 Provable intuitionistically (no RAA, no LEM needed): 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.17. Check: none of the proofs above uses RAA or LEM. Not provable intuitionistically: 2.13 (P → Q ⊢ ¬P ∨ Q), 2.14 (De Morgan, hard direction), 2.15 ((P → Q) ∨ (Q → P)), 2.16 (Peirce's law). Each of our proofs uses LEM or RAA, and they genuinely require it. A rigorous proof of unprovability needs Kripke semantics or Heyting algebras (a good topic to learn later). (Example 8 of Chapter 2, ¬¬P ⊢ P, is likewise classical only.)


Chapter 3#

3.1

3.2 Binding occurrences: x in P(x, y) (bound by ∀x), y in Q(y, z) (bound by ∃y). Free: y in P(x, y), z in Q(y, z), x in R(x). (The quantifier symbols themselves are binders, not occurrences in this sense.)

3.3 (a) ∃y′ L(y, y′). (b) ∀x P(x, f(z)). (c) ∀x′ P(x′, f(x)): the bound x must be renamed, otherwise the x in f(x) would be captured.

3.4

3.5

3.6 At least 3: ∃x∃y∃z (x≠y ∧ x≠z ∧ y≠z). Exactly 2: ∃x∃y (x ≠ y ∧ ∀z (z = x ∨ z = y)). At most 2: ∀x∀y∀z (x = y ∨ x = z ∨ y = z).

3.7

3.8 (a) False (element 4 has no larger element). (b) True (take x = 1). (c) False (take x = 1, y = 2: nothing lies strictly between).

3.9

3.10 Yes: satisfiable in finite structures. One-element model: R = {(1,1)}. The sentence says "R is symmetric, and every element has an R-neighbour". For D = {1, 2}, let a = [R(1,1)], b = [R(2,2)], c = [R(1,2) and R(2,1)] (symmetry forces both together). Element 1 needs a or c, and element 2 needs b or c. If c is true, a and b are free: 4 models. If c is false, both a and b must be true: 1 model. Total: 5 models.

3.11 Infinite model: (ℕ, <). No finite model: in a finite model with n elements, seriality lets us build x₀ R x₁ R x₂ ... R x_n (n + 1 terms). By pigeonhole xᵢ = xⱼ for some i < j. Applying transitivity along the chain gives R(xᵢ, xⱼ), i.e., R(xᵢ, xᵢ), contradicting irreflexivity.

3.12 Let M ⊨ ∃x ∀y R(x, y): there is d ∈ D such that for every e ∈ D, (d, e) ∈ R. To show M ⊨ ∀y ∃x R(x, y), take any e ∈ D. Then x := d witnesses ∃x R(x, e), since (d, e) ∈ R. As e was arbitrary, done. For the converse, ∀y ∃x R(x, y) provides for each e some d_e, and d_e may vary with e; nothing forces one d to work for all e. Countermodel: D = {1, 2}, R = {(1,2), (2,1)}.


Chapter 4#

4.1 (⇒) For ∀x P: open [a], ∀E on the premise gives P(a) ∧ Q(a), ∧E gives P(a), ∀I. Same for ∀x Q. ∧I. (⇐) Open [a], ∀E on both conjuncts of the premise, ∧I, ∀I.

4.2 ∀E with any name c gives P(c) (this is where non-emptiness enters); ∃I gives ∃x P(x).

4.3 ∃E with fresh a: P(a) ∧ Q(a); ∧E gives P(a), Q(a); ∃I gives ∃x P(x) and ∃x Q(x); ∧I. The conclusion contains no a. ✔

4.4 Open [b]; inside it open [a]; ∀E on ∀x ∀y R(x, y) with a gives ∀y R(a, y); ∀E with b gives R(a, b); close [a] with ∀I: ∀x R(x, b); close [b] with ∀I: ∀y ∀x R(x, y).

4.5 ∃E on ∃x ∃y R(x, y) with a: assume ∃y R(a, y); ∃E with b: assume R(a, b); ∃I gives ∃x R(x, b); ∃I gives ∃y ∃x R(x, y). That formula mentions neither a nor b, so both ∃E steps are legal.

4.6 Assume ∃x P(x). ∃E with fresh a: P(a). ∀E on the premise: ¬P(a). ¬E: ⊥. ∃E exports ⊥ (no a in ⊥). ¬I gives ¬∃x P(x).

4.7 Open [a]. Assume P(a). ∃I gives ∃x P(x). ¬E with the premise gives ⊥. ¬I gives ¬P(a). Close [a] with ∀I.

4.8 Assume ∀x P(x). ∃E on the premise with a: ¬P(a). ∀E gives P(a). ¬E gives ⊥. Export ⊥ from ∃E. ¬I gives ¬∀x P(x).

4.9 Assume ∀x P(x). Open [a]: ∀E on both hypotheses gives P(a) → Q(a) and P(a); →E gives Q(a). ∀I. →I.

4.10 ∨E on the premise. Each case: open [a], ∀E, ∨I, ∀I. Both branches conclude ∀x (P(x) ∨ Q(x)).

4.11 ∃E with a: P(a) ∨ Q(a). ∨E: case P(a): ∃I gives ∃x P(x), then ∨I gives ∃x P(x) ∨ ∃x Q(x); case Q(a): symmetric. The conclusion has no a.

4.12 (⇒) Assume ∃x P(x). ∃E with a: P(a). ∀E on the premise: P(a) → B. →E: B. B does not contain a (x not free in B, a fresh), so ∃E exports B. →I. (⇐) Assume the premise ∃x P(x) → B. Open [a]. Assume P(a). ∃I gives ∃x P(x). →E gives B. →I gives P(a) → B. ∀I.

4.13 Open [a]. ∀E: P(a) ∨ Q(a). ∨E with goal Q(a): case P(a): ∃I gives ∃x P(x), ¬E with the premise ¬∃x P(x) gives ⊥, ⊥E gives Q(a). Case Q(a): trivial. ∀I.

4.14 Open [a]. Assume P(a). ∃I gives ∃x P(x). →E on the premise gives ∀y Q(y). ∀E with a gives Q(a). →I gives P(a) → Q(a). ∀I.

4.15 s = t, t = u ⊢ s = u: by =E with A(x) := s = x (Chapter 4, Section 4.4). For ∀x ∀y (x = y → y = x): open [a], [b]; assume a = b; =I gives a = a; =E with A(x) := x = a gives b = a; →I; ∀I twice.

4.16 ∃E with a name c: assume P(c) ∧ ∀y (P(y) → y = c). Open [a], [b]; assume P(a) ∧ P(b). ∀E on the second conjunct: P(a) → a = c, P(b) → b = c; →E: a = c, b = c. Symmetry on b = c gives c = b; transitivity: a = b. →I; ∀I; ∀I. Export the universal conclusion from ∃E (it does not contain c).

4.17 Open [a]. ∀E on the first premise: ∃y R(a, y). ∃E with b: R(a, b). Symmetry (∀E twice, →E): R(b, a). Transitivity with R(a, b), R(b, a): R(a, a). This conclusion has no b, so ∃E exports it. ∀I.

4.18 Informal first: either ∀y D(y) or not. Case 1: ∀y D(y): for any name c, D(c) → ∀y D(y) holds because the consequent is a premise; ∃I. Case 2: ¬∀y D(y): by Example 4, ∃x ¬D(x); ∃E with a: ¬D(a); then D(a) → ∀y D(y) (assume D(a), ¬E gives ⊥, ⊥E gives ∀y D(y)); ∃I gives the goal; ∃E exports it. Combine the two cases with ∨E applied to the LEM instance ∀y D(y) ∨ ¬∀y D(y). Formal version: Example 5 (via RAA) or the one built from this outline.

4.19 Example 6 of Chapter 4.

4.20


Chapter 5#

5.1 Let m = 2j + 1, n = 2k + 1. Then m + n = 2(j + k + 1), even.

5.2 Contrapositive: if n is even, then n² is even. n = 2k gives n² = 2(2k²).

5.3 (2j + 1)(2k + 1) = 4jk + 2j + 2k + 1 = 2(2jk + j + k) + 1.

5.4 Contrapositive: if 3 ∤ n, then n = 3k ± 1, so n² = 9k² ± 6k + 1 = 3(3k² ± 2k) + 1, not divisible by 3. For √3: suppose √3 = p/q in lowest terms. Then p² = 3q², so 3 | p² and hence 3 | p, p = 3r. Then 9r² = 3q², so q² = 3r², 3 | q² and 3 | q, contradicting lowest terms.

5.5 If qr = s were rational, then r = s/q would be rational (q ≠ 0): contradiction. For q + r the same trick works (r = s − q). For r + s with both irrational, no: √2 + (−√2) = 0 is rational. (Likewise √2 · √2 = 2.)

5.6 Case n even: n = 2k, so n(n + 1) = 2k(n + 1) is even. Case n odd: n + 1 is even, n + 1 = 2k, so n(n + 1) = 2nk is even. Exhaustive.

5.7 Base n = 1: 1 = 1·2·3/6. Step: n(n+1)(2n+1)/6 + (n+1)² = (n+1)[n(2n+1) + 6(n+1)]/6 = (n+1)(2n² + 7n + 6)/6 = (n+1)(n+2)(2n+3)/6.

5.8 Base n = 0: 2¹ − 1 = 1. Step: 2ⁿ⁺² − 1 = 2·2ⁿ⁺¹ − 1 = (2ⁿ⁺¹ − 1) + 2ⁿ⁺¹ = (1 + 2 + ... + 2ⁿ) + 2ⁿ⁺¹.

5.9 Base n = 5: 32 > 25. (It fails for n = 3, 4: 8 < 9 and 16 = 16.) Step: assume 2ⁿ > n² with n ≥ 5. Then 2ⁿ⁺¹ > 2n² = n² + n² ≥ n² + 2n + 1 = (n + 1)², using n² ≥ 2n + 1 for n ≥ 3.

5.10 Base n = 1: F₁ = 1 = F₃ − 1 = 2 − 1. Step: F₁ + ... + Fₙ + Fₙ₊₁ = (Fₙ₊₂ − 1) + Fₙ₊₁ = Fₙ₊₃ − 1.

5.11 (a) (⇒) Assume A ⊆ B. A ∩ B ⊆ A is trivial. If x ∈ A then x ∈ B, so x ∈ A ∩ B. (⇐) Assume A ∩ B = A. If x ∈ A then x ∈ A ∩ B, so x ∈ B. (b) x ∈ (A ∪ B)ᶜ ⇔ ¬(x ∈ A ∨ x ∈ B) ⇔ x ∉ A ∧ x ∉ B ⇔ x ∈ Aᶜ ∩ Bᶜ (De Morgan).

5.12 Let z ∈ Z. g is surjective, so g(y) = z for some y. f is surjective, so f(x) = y for some x. Then (g ∘ f)(x) = z. For the right inverse: given y ∈ Y, take x := h(y); then f(x) = f(h(y)) = y.

5.13 Strong induction on n ≥ 2. If n is prime, n divides itself. Otherwise n = ab with 1 < a < n; by the IH a has a prime divisor p, and p divides a, hence n.

5.14 Claim P(n): for every choice of removed square, the 2ⁿ × 2ⁿ board can be tiled. Base n = 1: a 2×2 board minus one square is exactly one L-tromino. Step: split the 2ⁿ⁺¹ board into four 2ⁿ quadrants. The removed square lies in one quadrant. Place one L-tromino at the centre covering one square from each of the other three quadrants. Now each quadrant has exactly one "missing" square, so the IH tiles each. (The strengthening "for every choice" is essential.)

5.15 The step "the two groups overlap" fails for n = 1: with 2 horses, the two groups of 1 horse are disjoint. So P(1) → P(2) is false and the induction collapses (P(n) → P(n + 1) holds for n ≥ 2, but the chain never starts).

5.16 Let ε > 0 and δ = min(1, ε/5). Suppose |x − 2| < δ. Then |x − 2| < 1, so 1 < x < 3 and |x + 2| < 5. Hence |x² − 4| = |x − 2||x + 2| < δ · 5 ≤ ε.

5.17 Suppose f: ℕ → 𝒫(ℕ). Let D = {n ∈ ℕ : n ∉ f(n)}. For each n, n ∈ D ⇔ n ∉ f(n), so D ≠ f(n) (they differ on the element n). Hence D is not in the range of f, so f is not surjective. Barber connection: read "n ∈ f(m)" as "m shaves n". D is the set of people shaved by the "barber" who shaves exactly those who do not shave themselves; if D = f(d) then d would shave himself iff he does not.


Chapter 6#

6.1 A ⊨ B is a semantic statement about all models. "⊢ A → B" is a syntactic statement: a derivation exists. By the deduction theorem, A ⊢ B iff ⊢ A → B. By soundness and completeness, A ⊢ B iff A ⊨ B. So all three are equivalent, but they are different definitions, and the equivalence is a theorem (not a triviality).

6.2 Object language: (a) P → Q, (e) ∀x P(x). Metalanguage: (b) P ⊨ Q, (c) ⊢ P ∨ ¬P, (d) the English sentence about tautologies.

6.3 ∧E: if M ⊨ A ∧ B then, by the truth condition for ∧, M ⊨ A (and M ⊨ B). ∨I: if M ⊨ A then M ⊨ A ∨ B. →E: if M ⊨ A and M ⊨ A → B then M ⊨ B, since a true implication with a true antecedent has a true consequent.

6.4 By completeness, valid = provable. Proofs are finite strings over a finite alphabet and can be checked mechanically. Enumerate all strings in order, check each, and output those that are proofs; every valid sentence eventually appears. So the set is recursively enumerable. But an r.e. set need not be decidable: to decide non-membership you would need to know when to stop searching. (By Church-Turing, validity is undecidable.) A prover can reliably answer "valid" (it eventually halts with a proof), but it cannot reliably answer "invalid".

6.5 Suppose a theory T has exactly the finite structures as models. Let λₙ say "at least n elements" and Γ = T ∪ {λₙ : n ≥ 1}. Any finite subset of Γ mentions only λ₁, ..., λₖ, and is satisfied by a finite structure of size k (which satisfies T). By compactness, Γ has a model. This model satisfies every λₙ so is infinite, yet satisfies T, so it should be finite. Contradiction.

6.6 Let T = Th(ℕ) be the set of all sentences true in ℕ, and add a new constant c and sentences c > n̄ for every numeral n̄. Any finite subset is satisfied in ℕ by interpreting c as a large enough number. By compactness the whole set has a model; it satisfies all true arithmetic, and contains an element c larger than every standard natural number.

6.7 Take D = {1, 2}, P = {1}, and interpret the constant a as 1. Then P(a) is true but ∀x P(x) is false. The inference is invalid because the premise says something about the specific object a. In the soundness proof for ∀I, freshness lets you re-interpret a as any element without affecting the open assumptions, so A(a) must hold for every element, giving ∀x A(x).

6.8 Cardinality is not absolute. "Uncountable" inside a model means "no bijection with ℕ exists as an element of that model". The countable model (as seen from outside) simply lacks the bijections that would reveal the sets as countable. This is the Skolem paradox: a relativity of first-order notions, not a contradiction.


Chapter 7#

7.1

7.2

7.3 Clauses: 1. {¬P(x), Q(x)}; 2. {¬Q(x), R(x)}; 3. {P(a)}; 4. {¬R(a)}. Resolve 1, 3 (x ↦ a): {Q(a)}. Resolve with 2 (x ↦ a): {R(a)}. Resolve with 4: □.

7.4 Premises: {¬P(x), Q(x)}, {P(c)} (Skolem constant c). Negated conclusion ¬∃x Q(x) ≡ ∀x ¬Q(x): {¬Q(x)}. Resolve {¬P(x), Q(x)} with {P(c)}: {Q(c)}. Resolve with {¬Q(x)}: □.

7.5 Suppose C ∨ A and D ∨ ¬A are true under valuation v. If A is true under v, then ¬A is false, so D must be true, hence C ∨ D is true. If A is false, then C must be true, so C ∨ D is true.

7.6 See Example 2′ in Chapter 7. The clause set is {R(f(y), y)} and {¬R(x, g(x))}. The only candidate resolution unifies R(f(y), y) with R(x, g(x)): x ↦ f(y), then y must equal g(f(y)), which fails the occurs check. No resolvent exists and no factors exist, so the set saturates without □, hence is satisfiable, and the entailment fails.

7.7 Drinker: Example in Section 7.3. Barber: Example 3 in Section 7.5. Factoring is needed because each clause C₁ and C₂ contains two unifiable literals of the same sign, and binary resolution alone cannot reduce the number of literals.

7.8 If φ is satisfiable, say M ⊨ φ. For ∃y inside the scope of ∀x₁..xₙ, define the Skolem function f_M(d₁..dₙ) := some witness for y, which exists by the semantic truth of ∃. Interpret f this way (choice). Then M extended with f satisfies φ_Sk. Conversely φ_Sk ⊨ φ, because from the Skolem witnesses you get ∃. But φ ⊭ φ_Sk (e.g., φ = ∃x P(x); φ_Sk = P(c); in D = {1, 2}, P = {1}, c ↦ 2, φ is true and φ_Sk false). So Skolemization is equisatisfiable but not equivalent.

7.9 Instances of the second clause for x := a, f(a), f(f(a)); in total 3 instances are needed: P(a); ¬P(a) ∨ P(f(a)); ¬P(f(a)) ∨ P(f(f(a))); ¬P(f(f(a))) ∨ P(f(f(f(a)))); ¬P(f(f(f(a)))). That is propositionally unsatisfiable. First-order resolution: resolve {P(a)} with the second clause (x ↦ a): {P(f(a))}; again: {P(f(f(a)))}; again: {P(f(f(f(a))))}; resolve with the goal: □. Four resolution steps in both approaches, but the first-order version never had to guess the instances: unification found them.


End of the course. Send me your solutions to any problem (formal proofs line by line, informal proofs in prose, or code from the project) and I will check them, point out the exact line where something goes wrong, and suggest the next problem.


Appendix D. Glossary of logic terms (A–Z) ↑ Top#

Short definitions, in plain words, with a pointer to where the idea is developed. Symbols are in Section Z4 and Appendix A.6; tool syntax is in Appendix E. When a term has two common names, both are listed and cross-referenced. "Prop." means propositional logic, "FOL" first-order (predicate) logic.

A#

Absurdity — see Contradiction and Falsum.

Alpha-conversion (α-conversion) — renaming a bound variable (and every occurrence it binds) without changing meaning: ∀x P(x) and ∀y P(y) are α-equivalent. Capture must be avoided. (Z1, 3.8.5)

Antecedent — the "if" part A of a conditional A → B. See Consequent.

Argument — a list of premises together with a conclusion. It is valid when the conclusion is true in every situation where all premises are true. (1.8.9)

Arity — the number of arguments a function or predicate symbol takes. P(x) has arity 1, R(x, y) arity 2; a symbol of arity 0 is a constant (function) or a proposition letter (predicate). (3.8.2)

Assignment (valuation) — in prop. logic, a choice of true/false for every proposition letter; in FOL, a map from variables to domain elements, written s, with s[x↦d] for "the same except x goes to d". (1.8.4, 3.8.8)

Assumption — a statement temporarily supposed true inside a subproof; it is discharged when the subproof closes (for example by →I). Not the same as a premise. (2.9.2)

Atom, atomic formula — a formula with no connective or quantifier: a proposition letter P, a predicate applied to terms R(a, f(x)), or an equation s = t. (1.8.3, 3.8.4)

Axiom — a formula accepted without proof inside a given system or theory. In Hilbert-style systems the axioms are schemas such as A → (B → A). (2.9.7, 3.8.8)

Axiom schema — a template that yields infinitely many axioms, one for each way of filling in its metavariables. Induction in Peano arithmetic is a schema. (2.9.7, 6.7.1)

B#

Biconditional — A ↔ B: true exactly when A and B have the same truth value. Read "if and only if" (iff). (1.8.2)

Bound variable — an occurrence of a variable inside the scope of a quantifier that names it. Opposite of free. (3.8.5)

Box — in Fitch notation, the indented block that holds a subproof. Lines inside are visible only inside it. (2.9.2)

BHK interpretation — Brouwer–Heyting–Kolmogorov: the constructive reading of connectives as operations on proofs ("a proof of A → B is a method turning proofs of A into proofs of B"). (2.9.8)

C#

Calculus — a formal system of rules for manipulating formulas; "sequent calculus", "natural deduction", "tableau calculus". (2.9.1)

Canonical form — a unique-up-to-order normal form of a Boolean function: full DNF (one term per true row) or full CNF (one clause per false row). (1.8.7)

Capture — the error where substituting a term puts one of its free variables under a quantifier that binds the same name, changing the meaning. Avoided by α-conversion. (3.8.5)

Categorical (theory) — has exactly one model up to isomorphism. First-order theories with infinite models are never categorical, but may be categorical in a cardinality. (6.7.5)

Clause — a disjunction of literals, often written as a set: {P, ¬Q, R}. The empty clause [] is false. (1.8.7, 7.9.5)

Closed formula — see Sentence.

CNF (conjunctive normal form) — a conjunction of clauses (an AND of ORs of literals). Input format of SAT solvers. (1.8.7)

Compactness theorem — a set of FOL sentences has a model iff every finite subset has one. Consequences: non-standard models, no first-order definition of "finite". (6.7.4)

Completeness — of a system: every semantically valid formula is provable (⊨ A implies ⊢ A). Gödel 1929 for FOL. Not to be confused with negation-completeness of a theory (which fails by Gödel's first theorem for arithmetic). (6.7.3)

Conclusion — the statement an argument or proof aims to establish.

Conditional — A → B; false only when A is true and B false. Also called material implication or material conditional. (1.8.2)

Congruence — an equivalence relation compatible with the function symbols; the basis of the equality axioms. (4.7.8)

Conjunction — A ∧ B, "and"; true when both are. A and B are conjuncts. (1.8.2)

Connective — a symbol combining formulas into a bigger formula: ¬ ∧ ∨ → ↔ (and ⊥ ⊤ as 0-ary connectives). (1.8.2)

Consequence (semantic) — Γ ⊨ A: every model of all of Γ is a model of A. (1.8.9, 3.8.8)

Consequence (syntactic) — Γ ⊢ A: there is a proof of A from Γ. (2.9.1)

Consequent — the "then" part B of A → B.

Consistent — a set Γ is consistent if Γ ⊬ ⊥: nothing contradictory can be proved from it. A set with a model is consistent (soundness); the converse is completeness. (6.7.3)

Constant — a function symbol of arity 0; names one particular object. (3.8.2)

Constructive logic — see Intuitionistic logic.

Contingent — true in some situations and false in others (neither a tautology nor a contradiction). (1.8.4)

Contradiction — a formula false in every situation (e.g. P ∧ ¬P); also the act of deriving ⊥. (1.8.4)

Contraposition, contrapositive — ¬B → ¬A is the contrapositive of A → B; the two are equivalent. Not the same as the converse B → A. (1.8.6)

Converse — B → A for the conditional A → B. Not equivalent. (1.8.6)

Counterexample — a situation that makes all premises true and the conclusion false; proves invalidity. (1.8.9)

Countermodel — a model (structure) serving as a counterexample in FOL. (3.8.8, 8.8.3)

Curry–Howard correspondence — propositions are types, proofs are programs: A → B is a function type, A ∧ B a pair type, A ∨ B a sum type. (2.9.8)

Cut — a proof step that introduces and then eliminates a lemma; cut-elimination (Gentzen) shows it is dispensable in sequent calculus. (2.9.7)

D#

Decidable — there is an algorithm that always halts with the right yes/no answer. Prop. validity is decidable; FOL validity is not (Church–Turing). (6.7.6)

Deduction theorem — if Γ, A ⊢ B then Γ ⊢ A → B; the metatheorem behind →I. (2.9.7)

Definite description — a phrase "the unique x such that …", formalised as ∃x (P(x) ∧ ∀y (P(y) → y = x)) (Russell) or with the symbol ιx. (3.8.6)

De Morgan's laws — ¬(A ∧ B) ≡ ¬A ∨ ¬B, ¬(A ∨ B) ≡ ¬A ∧ ¬B; and for quantifiers ¬∀x A ≡ ∃x ¬A, ¬∃x A ≡ ∀x ¬A. (1.8.6)

Derivation — see Proof.

Derived rule — a rule whose use can always be replaced by a fixed sequence of primitive rules. (2.9.6)

Disjunction — A ∨ B, inclusive "or"; false only when both are false. (1.8.2)

Discharge — closing an assumption: after →I the assumed A no longer counts as an open premise. (2.9.2)

Disjunctive syllogism — from A ∨ B and ¬A infer B. (1.8.9)

DNF (disjunctive normal form) — an OR of ANDs of literals. (1.8.7)

Domain (universe, domain of discourse) — the non-empty set of objects the quantifiers range over in a structure. (3.8.8)

Double negation — ¬¬A ≡ A classically; only A → ¬¬A holds intuitionistically. (1.8.6, 2.9.8)

DPLL, CDCL — complete backtracking SAT algorithms based on unit propagation (DPLL) and conflict-driven clause learning (CDCL). (7.9.2)

E#

Eigenvariable — the fresh variable or name in ∀I/∃E (Gentzen's term). See Fresh name. (4.7.1)

Elementary equivalence — two structures satisfy the same first-order sentences. Isomorphic structures are elementarily equivalent; the converse fails. (6.7.5)

Entailment — see Consequence.

Equivalence (logical) — A ≡ B: A ↔ B is a tautology/valid; they have the same truth value in every model. (1.8.4)

Equisatisfiable — one formula is satisfiable iff the other is; weaker than equivalence. Skolemization and Tseitin produce equisatisfiable results. (7.9.3)

Ex falso quodlibet (explosion) — from a contradiction anything follows: ⊥ ⊢ A. Rule ⊥E. (2.9.3)

Excluded middle — A ∨ ¬A; classically valid, rejected by intuitionists. (2.9.8)

Existential quantifier — ∃x A: some element of the domain satisfies A. (3.8.6)

Extensionality — objects are equal when they have the same members/values; for sets, A = B iff same elements. (Z3)

F#

Factoring — in resolution, unifying and merging two literals of the same clause. (7.9.5)

Falsum, absurdum (⊥) — the constant "false". (2.9.3)

Finitary / finitistic — using only finite, constructive reasoning (Hilbert's program).

First-order logic — logic whose quantifiers range over individuals (not over predicates or sets). Also predicate logic, quantification theory, FOL. (Ch. 3)

Fitch system — natural deduction written with indented boxes for subproofs. (2.9.2)

Formal language — the set of well-formed formulas over a fixed alphabet and grammar. (1.8.3)

Formal system — a language plus axioms and/or rules plus a notion of proof. (2.9.1)

Formula (well-formed formula, wff) — a string built by the grammar's formation rules. (1.8.3, 3.8.4)

Free variable — an occurrence not bound by any quantifier; a formula with free variables is open. (3.8.5)

Fresh name — a constant (or variable) that occurs nowhere else in the proof's relevant context; required by ∀I and ∃E. (4.7.1)

Function symbol — a symbol that forms terms: f(x), +. (3.8.2)

Functional completeness — a set of connectives able to express every truth function, e.g. {¬, ∧}, {NAND}. (1.8.8)

G#

Gentzen systems — natural deduction (NJ/NK) and sequent calculi (LJ/LK), both by Gerhard Gentzen (1935). (2.9.7)

Gödel numbering — assigning each formula/proof a natural number so arithmetic can talk about syntax. (6.7.7)

Gödel's theorems — Completeness (1929) and Incompleteness (1931; two theorems). (6.7.3, 6.7.7)

H#

Herbrand universe/theorem — the set of ground terms; a set of clauses is unsatisfiable iff some finite set of its ground instances is propositionally unsatisfiable. Basis of automated provers. (7.9.5)

Hilbert system — a proof system with many axiom schemas and (usually) modus ponens as the only rule. (2.9.7)

Horn clause — a clause with at most one positive literal; the logic of Prolog. Horn satisfiability is decidable in linear time (prop. case). (7.9.5)

Hypothetical syllogism — from A → B and B → C infer A → C. (1.8.9)

I#

Identity — see Equality.

Implication — the connective →; also the relation "A implies B", meaning A → B is valid. (1.8.2)

Inconsistent — proves ⊥; the opposite of consistent.

Independence — a statement is independent of a theory if neither it nor its negation is provable (e.g. the continuum hypothesis in ZFC). (6.7.7)

Induction — proving a statement for all naturals (or all objects built by a recursive definition) via a base case and an inductive step. (5.14.4)

Inference rule — a pattern "from these formulas (premises) conclude that formula". (2.9.1)

Instance — the result of substituting terms for variables: P(a) is an instance of ∀x P(x). (3.8.5)

Interpretation — see Structure.

Intuitionistic logic — logic without excluded middle and double-negation elimination; "provable" means "constructively demonstrated". (2.9.8)

Invalid — an argument/formula that has a counterexample.

Isomorphism — a bijection between structures preserving all functions and relations. (6.7.5)

K#

Kripke semantics — models for modal and intuitionistic logic: sets of "worlds" with an accessibility relation. (6.7.9)

L#

Lemma — a helper theorem proved on the way to a larger result.

Literal — an atom or a negated atom: P, ¬P. (1.8.7)

Logical consequence — see Consequence.

Logical constant — a symbol whose meaning is fixed by the logic: connectives, quantifiers, (usually) equality.

Löwenheim–Skolem theorems — a first-order theory with an infinite model has models of every infinite cardinality (upward) and a countable one (downward). (6.7.5)

M#

Many-valued logic — logic with more than two truth values (Łukasiewicz, Kleene, fuzzy). (6.7.9)

Material implication — see Conditional. "Material" means truth-functional, defined purely by truth values.

Metalanguage / object language — the language we use to talk about a logic versus the logic's own language. ⊢ and ⊨ live in the metalanguage. (Z4.3)

Metatheorem, metatheory — a theorem about a system (soundness, completeness, compactness). (Ch. 6)

Model — a structure in which a given sentence/set of sentences is true. M ⊨ A. (3.8.8)

Modal logic — logic with □ ("necessarily") and ◇ ("possibly"). (6.7.9)

Modus ponens (MP, →E) — from A → B and A infer B. (2.9.3)

Modus tollens (MT) — from A → B and ¬B infer ¬A. (1.8.9)

N#

Natural deduction — proof systems with introduction and elimination rules for every connective, designed to mirror human reasoning. (Ch. 2)

Necessary / sufficient condition — in A → B, A is sufficient for B and B is necessary for A. (1.8.2)

Negation — ¬A, "not". (1.8.2)

NNF (negation normal form) — negations apply only to atoms. (1.8.7)

Non-standard model — a model of true arithmetic containing "infinite" numbers; exists by compactness. (6.7.4)

Normal form — a restricted syntactic shape every formula can be converted to: NNF, CNF, DNF, prenex, Skolem. (1.8.7, 7.9.3)

O#

Omega-consistency — a strengthening of consistency used in Gödel's original first theorem.

Open formula — contains free variables; neither true nor false until the variables are assigned. (3.8.5)

P#

Paradoxes of material implication — B ⊢ A → B and ¬A ⊢ A → B are valid though they sound odd in English. (1.8.9)

Peano arithmetic (PA) — the first-order theory of the natural numbers with an induction schema. (3.8.8)

Peirce's law — ((A → B) → A) → A: classically valid, equivalent to excluded middle, intuitionistically unprovable. (1.8.6)

Predicate — a symbol for a property (arity 1) or relation (arity ≥ 2); applied to terms it yields an atomic formula. (3.8.2)

Premise — a formula given as true at the start of a proof or argument.

Prenex normal form — all quantifiers at the front, followed by a quantifier-free matrix. (7.9.3)

Proof — a finite, rule-governed sequence/tree of formulas ending in the conclusion, each step justified. (2.9.1)

Proof by cases — ∨E: if A ∨ B, and C follows from A and also from B, then C. (2.9.3)

Proof by contradiction — assume ¬A, derive ⊥, conclude A (RAA). Distinguish from proof of negation (assume A, derive ⊥, conclude ¬A; fine intuitionistically). (5.14.3)

Proposition — a statement that is definitely true or false. In formal logic, a formula of prop. logic. (1.8.1)

Propositional logic (sentential logic, Boolean logic) — the logic of connectives alone. (Ch. 1)

Q#

Quantifier — ∀ or ∃; binds a variable. (3.8.6)

Quantifier scope — the sub-formula a quantifier governs. (3.8.5, Z5.1.1)

R#

RAA (reductio ad absurdum) — see Proof by contradiction.

Refutation — a proof that a set of formulas is unsatisfiable; resolution is a refutation method. (7.9.5)

Relation — a set of tuples; the semantic value of a predicate symbol. (Z3)

Resolution — an inference rule on clauses: from C ∨ L and D ∨ ¬L infer C ∨ D; refutation-complete. (7.9.5)

Rule of inference — see Inference rule.

S#

SAT problem — decide whether a prop. formula (usually CNF) is satisfiable; NP-complete (Cook–Levin). (7.9.2)

Satisfiable — true under at least one assignment/model. (1.8.4)

Schema — see Axiom schema.

Scope — see Quantifier scope.

Semantics — the study of meaning/truth of formulas: valuations, structures. (1.8.4, 3.8.8)

Sentence — a formula with no free variables; the only kind with a definite truth value in a structure. Also closed formula. (3.8.5)

Sequent — Γ ⊢ Δ: from the assumptions listed in Γ, at least one of Δ follows. (2.9.7)

Signature (vocabulary, language) — the list of constant, function and predicate symbols with arities. (3.8.2)

Skolemization — eliminating ∃ by introducing fresh function symbols (Skolem functions) of the preceding universal variables. (7.9.3)

SMT — satisfiability modulo theories: SAT combined with arithmetic, arrays, etc. (7.9.6)

Soundness — of a system: everything provable is valid (⊢ A implies ⊨ A). Of an argument (everyday sense): valid with true premises. (6.7.2)

Structure — a domain plus an interpretation of each symbol of a signature; also model (when it satisfies given sentences) or interpretation. (3.8.8)

Substitution — replacing free occurrences of a variable by a term: A[t/x]. Also a map from variables to terms in unification. (3.8.5, 7.9.4)

Syllogism — a three-line argument with two premises, in Aristotle's logic, e.g. Barbara: all M are P, all S are M, so all S are P. (Z1)

Syntax — the study of the form of formulas and proofs, apart from meaning. (1.8.3)

T#

Tableau (truth tree) — a refutation method that breaks formulas apart along branches; a closed tableau refutes. (2.9.7)

Tarski's definition of truth — truth of a formula in a structure by recursion on its structure. (3.8.8)

Tautology — true under every assignment (prop.). The FOL analogue is validity. (1.8.4)

Term — an expression naming an object: variable, constant, or function applied to terms. (3.8.3)

Theory — a set of sentences closed under consequence (or its axiomatisation). (3.8.8)

Theorem — a statement with a proof; in a formal system, a formula derivable from the axioms. (2.9.1)

Truth function — a function from truth values to truth values; there are 2^(2^n) of them with n inputs. (1.8.5)

Truth table — a listing of a formula's value under every assignment. (1.8.4)

Tseitin transformation — converts any prop. formula into an equisatisfiable CNF of linear size by naming sub-formulas. (7.9.3)

Turing machine — the standard formal model of computation behind decidability results. (6.7.6)

U#

Unification — finding a substitution that makes two terms/atoms identical; the most general such is the mgu. (7.9.4)

Uniqueness quantifier ∃! — "exactly one": ∃x (P(x) ∧ ∀y (P(y) → y = x)). (3.8.6)

Universal closure — prefixing ∀ for every free variable, turning a formula into a sentence. (3.8.5)

Universal quantifier — ∀x A: every element of the domain satisfies A. (3.8.6)

Unsatisfiable — no model/assignment makes it true. (1.8.4)

V#

Valid, validity — of a formula: true in every structure (FOL) or assignment (prop.). Of an argument: conclusion true whenever premises are. (1.8.4, 1.8.9)

Valuation — see Assignment.

Variable — a placeholder ranging over the domain; either free or bound. (3.8.2)

W–Z#

Well-formed formula (wff) — see Formula.

Well-ordering principle — every non-empty set of naturals has a least element; equivalent to induction. (5.14.4)

Witness — an object shown to satisfy an existential statement. (4.7.1)

Zermelo–Fraenkel set theory (ZF, ZFC) — the standard first-order theory in which most mathematics is formalised; ZFC adds the axiom of choice. (6.7.7)


Appendix E. Typing symbols and tool syntax: a cheat sheet ↑ Top#

This appendix answers the practical questions: How do I type ∀? How do I write the same formula for Prover9, Z3, Lean or LaTeX? What does the input file for a SAT solver look like? Prover installation is not covered, only what you write once you have one. Where a tool was run while preparing this book (Z3 via Python and SMT-LIB), the snippet is marked tested; the others follow the tools' documented syntax and you should expect to adjust minor details for your version.

E.1 Typing logic symbols#

Method 1: copy and paste. Every symbol in this book can be pasted from here: ¬ ∧ ∨ → ↔ ⊥ ⊤ ∀ ∃ ⊢ ⊨ ≡ ∈ ∉ ⊆ ∪ ∩ ∅ ≠ ≤ ≥ ⇒ ⇔ □ ◇ ∴ ∎ ℕ ℤ ℚ ℝ λ.

Method 2: operating-system shortcuts by code point. Each symbol has a Unicode code point (a hexadecimal number). Typical entry methods:

System How to enter a code point such as U+2200
Linux (GTK apps, many terminals) Ctrl+Shift+U, type 2200, press Space or Enter
macOS Enable "Unicode Hex Input" keyboard, hold Option, type 2200
Windows Hold Alt, type +2200 on the numeric pad (needs the registry setting "EnableHexNumpad"), or use Win+. (emoji/symbol panel) and search
Any system Use the Character Map / Character Viewer / Emoji & Symbols picker

Method 3: editor abbreviations (fastest if you write a lot). In Lean's editor mode, in Emacs/TeX input mode, and in VS Code with a LaTeX-abbreviation extension, you type a backslash name and the symbol appears. The Lean/TeX names below work in Lean 4's VS Code and Emacs modes.

Symbol Name Unicode LaTeX Lean abbreviation ASCII in this book
¬ negation U+00AC \neg (\lnot) \not, \neg ~
∧ and U+2227 \land (\wedge) \and &
∨ or U+2228 \lor (\vee) \or |
→ implies U+2192 \to (\rightarrow) \to, \r ->
↔ iff U+2194 \leftrightarrow \iff, \lr <->
⊥ falsum U+22A5 \bot \bot false
⊤ verum U+22A4 \top \top true
∀ for all U+2200 \forall \forall, \all forall
∃ exists U+2203 \exists \exists, \ex exists
⊢ proves U+22A2 \vdash \vdash |-
⊨ models U+22A8 \models (\vDash) \models |=
≡ equivalent U+2261 \equiv \== ==
= equals U+003D = = =
≠ not equal U+2260 \neq (\ne) \ne !=
∈ element of U+2208 \in \in in
∉ not element U+2209 \notin \notin not in
⊆ subset U+2286 \subseteq \sub=, \subseteq subseteq
∪ union U+222A \cup \cup, \union union
∩ intersection U+2229 \cap \cap, \inter inter
∅ empty set U+2205 \emptyset (\varnothing) \empty {}
≤ at most U+2264 \le (\leq) \le <=
⇒ double arrow U+21D2 \Rightarrow \=> =>
⇔ double iff U+21D4 \Leftrightarrow \<=> <=>
□ box (necessarily) U+25A1 \Box \box []
◇ diamond (possibly) U+25C7 \Diamond \di <>
∴ therefore U+2234 \therefore \therefore therefore
∎ end of proof U+220E \qed / \blacksquare \qed QED
ℕ ℤ ℚ ℝ number sets U+2115 U+2124 U+211A U+211D \mathbb{N} etc. \N \Z \Q \R N Z Q R
λ lambda U+03BB \lambda \lam, \fun fun

Subscripts and superscripts: x₁ is U+2081; type x\_1 in Lean. In LaTeX write x_1, x^2.

E.2 LaTeX in practice#

Minimal document with a proof environment:

latex
\documentclass{article}
\usepackage{amsmath, amssymb, amsthm}
\newtheorem{theorem}{Theorem}
\begin{document}

\begin{theorem}
For all sets $A, B$: $A \cap B \subseteq A$.
\end{theorem}
\begin{proof}
Let $x \in A \cap B$. Then $x \in A$ and $x \in B$; in particular $x \in A$.
\end{proof}

A formula: $\forall x\,\bigl(P(x) \to \exists y\, R(x,y)\bigr)$.

A derivation line: $P \to Q,\; Q \to R \vdash P \to R$.

\[
\frac{A \to B \quad A}{B}\ {\to}E
\]
\end{document}

Notes: \, inserts a thin space after a quantifier; \bigl( … \bigr) makes brackets taller; \frac{top}{bottom} draws an inference-rule bar; {\to}E stops LaTeX treating \to as a binary relation with spaces. For Fitch boxes, packages such as fitch (or logicproof) draw the vertical rules.

E.3 One formula in every syntax#

The formula: for every x, if P(x) holds then there exists y with R(x, y).

Syntax Writing it
Math (Unicode) ∀x (P(x) → ∃y R(x, y))
This book's ASCII (and the Chapter 8 starter) forall x. P(x) -> exists y. R(x, y)
LaTeX \forall x\,(P(x) \to \exists y\, R(x,y))
TPTP (FOF) ![X]: (p(X) => ?[Y]: r(X,Y))
Prover9 / Mace4 all x (P(x) -> exists y R(x,y)).
SMT-LIB (forall ((x D)) (=> (P x) (exists ((y D)) (R x y))))
Z3 Python ForAll([x], Implies(P(x), Exists([y], R(x, y))))
Lean 4 ∀ x, P x → ∃ y, R x y
Coq / Rocq forall x, P x -> exists y, R x y
Isabelle/HOL ∀x. P x ⟶ (∃y. R x y)
Prolog not expressible directly (Horn clauses only); a rule such as q(X) :- p(X).
Polish notation ΠxCPxΣyRxy (Π = for all, Σ = exists, C = implies)

E.4 The connectives in every syntax#

Meaning TPTP Prover9 SMT-LIB Z3 Python Lean 4 Coq
not ~A -A (not A) Not(A) ¬A ~A
and A & B A & B (and A B) And(A, B) A ∧ B A /\ B
or A | B A | B (or A B) Or(A, B) A ∨ B A \/ B
implies A => B A -> B (=> A B) Implies(A, B) A → B A -> B
iff A <=> B A <-> B (= A B) A == B (Bool) A ↔ B A <-> B
for all ![X]: A all x A (forall ((x S)) A) ForAll([x], A) ∀ x, A forall x, A
exists ?[X]: A exists x A (exists ((x S)) A) Exists([x], A) ∃ x, A exists x, A
equals a = b a = b (= a b) a == b a = b a = b
not equal a != b a != b (distinct a b) a != b a ≠ b a <> b
false / true $false / $true $F / $T false / true BoolVal(False) False / True False / True

Two warnings: in Prover9, symbols beginning with u through z are variables by default (the same convention as Chapter 8's starter kit); in TPTP, variables start with an upper-case letter and predicates/functions with lower-case.

E.5 Z3 from Python (tested)#

Install with pip install z3-solver. To check whether an argument is valid, assert the premises and the negated conclusion, and ask for satisfiability: unsat means valid.

python
from z3 import *

D = DeclareSort('D')                  # a domain with no further structure
P = Function('P', D, BoolSort())      # a unary predicate
Q = Function('Q', D, BoolSort())
x = Const('x', D)
a = Const('a', D)

s = Solver()
s.add(ForAll([x], Implies(P(x), Q(x))), P(a))   # premises
s.add(Not(Q(a)))                                # negated conclusion
print(s.check())                                # unsat  => the argument is valid

Output: unsat. An invalid argument yields a countermodel:

python
s2 = Solver()
s2.add(Exists([x], P(x)), Not(ForAll([x], P(x))))
print(s2.check())     # sat
print(s2.model())     # for example: [P = [D!val!1 -> False, else -> True]]

Output: sat, followed by a model in which P holds of some element but not another. For propositional tautologies, Z3's helper prove(formula) prints proved or a counterexample:

python
p, q = Bools('p q')
prove(Implies(And(Implies(p, q), p), q))     # prints: proved

E.6 SMT-LIB (tested)#

The same argument as a stand-alone file argument.smt2, runnable with any SMT solver (z3 argument.smt2, cvc5 argument.smt2):

text
(declare-sort D 0)
(declare-fun P (D) Bool)
(declare-fun Q (D) Bool)
(declare-const a D)
(assert (forall ((x D)) (=> (P x) (Q x))))
(assert (P a))
(assert (not (Q a)))
(check-sat)

Output: unsat. Reading rules: everything is a parenthesised prefix expression (function arg1 arg2 …); declare-sort, declare-fun, declare-const introduce vocabulary; assert adds a fact; check-sat asks for sat, unsat or unknown; add (get-model) after a sat answer to see the model. Arithmetic uses sort Int or Real and operators + - * <= <.

E.7 DIMACS CNF for SAT solvers#

A SAT solver reads clauses of integers: variable n means atom number n, -n its negation, and 0 ends a clause. The header gives the number of variables and clauses.

text
c (P or Q) and (not P or Q) and (P or not Q)   with P = 1, Q = 2
p cnf 2 3
1 2 0
-1 2 0
1 -2 0

This is satisfiable (take P = Q = true). Add the clause -1 -2 0 and update the header to p cnf 2 4 to make it unsatisfiable. Lines starting with c are comments. The chapter 8 starter's dpll takes the same clauses as lists, e.g. dpll([[1, 2], [-1, 2], [1, -2]]).

E.8 TPTP and Prover9 files#

TPTP (.p file; run with eprover --auto socrates.p or vampire socrates.p):

text
fof(all_men_mortal, axiom, ![X]: (man(X) => mortal(X))).
fof(socrates_man,  axiom, man(socrates)).
fof(goal, conjecture, mortal(socrates)).

Prover9 (prover9 -f socrates.in):

text
formulas(assumptions).
  all x (man(x) -> mortal(x)).
  man(socrates).
end_of_list.

formulas(goals).
  mortal(socrates).
end_of_list.

To search for a countermodel instead, use Mace4 on the same input with the goal that you suspect is false. If a clause set is satisfiable, a refutation prover such as these may run forever without answer; that is the semi-decidability of Section 6.7.6, not a bug.

E.9 Lean 4 cheat sheet#

A first proof, in tactic style (each · marks a case; hover in the editor to see the goal):

lean
theorem hyp_syllogism (P Q R : Prop) (h1 : P → Q) (h2 : Q → R) : P → R := by
  intro hp
  apply h2
  apply h1
  exact hp

theorem and_comm' (P Q : Prop) : P ∧ Q → Q ∧ P := by
  intro ⟨hp, hq⟩
  exact ⟨hq, hp⟩

theorem exists_mono (P Q : Nat → Prop) (h : ∀ x, P x → Q x) :
    (∃ x, P x) → ∃ x, Q x := by
  intro ⟨a, ha⟩
  exact ⟨a, h a ha⟩

Which tactic does which proof rule?

Goal or hypothesis Tactic Natural-deduction rule
goal A → B intro h →I
goal ∀ x, A x intro a ∀I (fresh a)
goal A ∧ B constructor (then two goals) or exact ⟨ha, hb⟩ ∧I
goal A ∨ B left / right ∨I
goal ∃ x, A x exact ⟨t, h⟩ or use t ∃I
goal ¬A intro h (h : A, goal False) ¬I
goal False from A and ¬A exact h2 h1 ¬E
any goal from False exfalso or contradiction ⊥E
goal A, by contradiction by_contra h RAA (classical)
hypothesis h : A ∧ B obtain ⟨ha, hb⟩ := h ∧E
hypothesis h : A ∨ B rcases h with ha | hb ∨E
hypothesis h : ∃ x, A x obtain ⟨a, ha⟩ := h ∃E
hypothesis h : ∀ x, A x have := h t ∀E
hypothesis h : A → B, have ha : A have := h ha →E
equation h : a = b rw [h] =E
induction on n : Nat induction n with | zero => … | succ k ih => … induction
arithmetic and cleanup omega, simp, decide, linarith (Mathlib) —

E.10 Coq / Rocq cheat sheet#

text
Theorem hyp_syllogism : forall P Q R : Prop, (P -> Q) -> (Q -> R) -> P -> R.
Proof.
  intros P Q R h1 h2 hp.
  apply h2. apply h1. exact hp.
Qed.
Goal or hypothesis Tactic Rule
goal A -> B or forall x, A x intro / intros →I, ∀I
goal A /\ B split ∧I
goal A \/ B left / right ∨I
goal exists x, A x exists t ∃I
hypothesis h : A /\ B destruct h as [ha hb] ∧E
hypothesis h : A \/ B destruct h as [ha | hb] ∨E
hypothesis h : exists x, A x destruct h as [a ha] ∃E
hypothesis h : A -> B apply h (backward) or specialize (h ha) →E
False anywhere contradiction or exfalso ⊥E
equation rewrite h, reflexivity =E, =I
induction induction n as [| k ih] induction
automation auto, tauto, lia (arithmetic), firstorder —

Classical reasoning (excluded middle, RAA) needs Require Import Classical. and the lemma classic; Coq's default logic is intuitionistic, matching Section 2.9.8.

E.11 Prolog (Horn clauses in practice)#

text
mortal(X) :- man(X).      % for all X: man(X) implies mortal(X)
man(socrates).
?- mortal(socrates).      % query; the system answers: true.

:- reads "if", a comma means "and", and each clause ends with a period. Variables start with a capital letter. Prolog proves a goal by SLD resolution (Section 7.9.5). It cannot express ∨ in the conclusion or an unrestricted ∃ in the premises, which is why it is not a general first-order prover.

E.12 Choosing a tool#

Your goal Use
Check a propositional formula or build a CNF for a solver The Chapter 8 starter (sat, tseitin), or a SAT solver with DIMACS input
Decide arithmetic, arrays, bit-vectors, "find me a counterexample" Z3 or cvc5 (SMT-LIB)
Prove a pure first-order statement automatically Vampire, E (TPTP), Prover9
Find a small finite countermodel Mace4, Z3 model(), the starter's find_countermodel
Write proofs checked by a tiny trusted kernel Lean 4, Coq/Rocq, Isabelle
Learn proof construction interactively with Fitch boxes A Fitch-style checker (the Chapter 8 starter's check_proof, or a textbook's web checker)
Logic programming and deductive databases Prolog, Datalog