Natural Deduction
Formal Methods in Verification of
Computer Systems
Jeremy Johnson
Outline
1. An example
1. Validity by truth table
2. Validity by proof
2. What’s a proof
1. Proof checker
3. Rules of natural deduction
4. Provable equivalence
5. Soundness and Completeness
An Example
• If the train arrives late and there are no
taxis at the station, then John is late for his
meeting. John is not late for his meeting.
The train did arrive late. Therefore, there
were taxis at the station.
• If it is raining and Jane does not have here
umbrella with her, then she will get wet.
Jane is not wet. It is raining. Therefore,
Jane has her umbrella with her.
An Example
• If the train arrives late and there are no
taxis at the station, then John is late for his
meeting. John is not late for his meeting.
The train did arrive late. Therefore, there
were taxis at the station.
• p = the train arrives late
• q = there are taxis at the station
• r = John is late for his meeting.
• 𝑝 ∧ ¬𝑞 → 𝑟, ¬𝑟, 𝑝 ⊢ 𝑞 [a sequent]
An Example
•
•
•
•
•
p = it is raining
q = Jane has her umbrella
r = Jane gets wet.
𝑝 ∧ ¬𝑞 → 𝑟, ¬𝑟, 𝑝 ⊢ 𝑞
If it is raining and Jane does not have here
umbrella with her, then she will get wet.
Jane is not wet. It is raining. Therefore,
Jane has her umbrella with her.
Validity by Truth Table
•
𝑝 ∧ ¬𝑞 → 𝑟, ¬𝑟, 𝑝 ⊢ 𝑞
p
q
r
q
r
pq
(pq)r
F
F
F
T
T
F
T
F
F
T
T
F
F
T
F
T
F
F
T
F
T
F
T
T
F
F
F
T
T
F
F
T
T
T
F
T
F
T
T
F
T
T
T
T
F
F
T
F
T
T
T
T
F
F
F
T
Proof
• By applying rules of inference to a set of
formulas, called premises, we derive
additional formulas and may infer a
conclusion from the premises
• A sequent is 1,…,n ⊢ 
• Premises 1,…,n
• Conclusion 
• The sequent is valid if a proof for it can be
found
Proof
• A proof is a sequence of formulas that are
either premises or follow from the
application of a rule to previous formulas
• Each formula must be labeled by it’s
justification, i.e. the rule that was applied
along with pointers to the formulas that
the rule was applied to
• It is relatively straightforward to check to
see if a proof is valid
Validity by Deduction
•
𝑝 ∧ ¬𝑞 → 𝑟, ¬𝑟, 𝑝 ⊢ 𝑞
1
𝑝 ∧ ¬𝑞 → 𝑟
premise
2
¬𝑟
premise
3
𝑝
premise
4
¬𝑞
assumption
5
𝑝 ∧ ¬𝑞
∧ i 3,4
6
r
→e 1,5
7
⊥
¬e 6,2
8
¬¬q
¬i 4-7
9
q
¬¬e 8
Rules of Natural Deduction
• Natural deduction uses a set of rules
formally introduced by Gentzen in 1934
• The rules follow a “natural” way of
reasoning about
• Introduction rules
• Introduce logical operators from premises
• Elimination rules
• Eliminate logical operators from premise
producing a conclusion without the operator
Conjunction Rules
• Introduction Rule
 

i
• Elimination Rule


 e1


 e2
Implication Rules
• Introduction Rule

…

Assume  and show 

i
• Elimination Rule (Modus Ponens)
 

e
Disjunction Rules
• Introduction Rule



 i1

 i2
• Elimination Rule (proof by case analysis)

…
 


…

e
Negation Rules
• Introduce the symbol (⊥ = bottom) to
encode a contradiction
• Bottom elimination
⊥
⊥ can prove anything
⊥ e.

• Elimination Rule
 
⊥
e
Negation Rules
• Introduction Rule

…
⊥
 leads to a contradiction
i

• Double negation
 

e
Proof by Contradiction
• Derived Rule

…
⊥

PBC
Assume  and derive a
a contradiction
• Derived rules can be used like the basic
rules and serve as a short cut (macro)
• Sometimes used as a negation elimination
rule instead of double negation
Law of the Excluded Middle
•
𝑝 ∨ ¬𝑝 [derived rule LEM]
1
 (p  p)
assumption
2
𝑝
Assumption
3
(p  p)
∨ i1 3,4
4
⊥
¬e 3,1
5
p
¬i 2-4
6
p  p
∨ i2 3,4
7
⊥
¬e 6,1
8
 (p  p)
¬i 1-7
9
p  p
¬¬e 8
ProofLab
• The ProofLab tool from the Logic and
Proofs course from the CMU online
learning initiative allows you to
experiment with natural deduction proofs
ProofLab
Provable Equivalence
•  and  are provably equivalent,  ⊣⊢ ,
iff the sequents  ⊢  and  ⊢  are both
valid
• Alternatively  ⊣⊢  iff the sequent
⊢        is valid
• A valid sequent with no premises is a
tautology
De Morgan’s Law
(P  Q)  P  Q
1
(P  Q)
premise
2
𝑃
assumption
3
PQ
i1 2
4
⊥
e 1,3
5
P
i 2-4
6
Q
assumption
7
PQ
i2 6
8
⊥
e 1,7
9
Q
i 6-8
10
P  Q
i 5,9
De Morgan’s Law
(P  Q)  P  Q
1
P  Q
premise
2
P
e1 1
3
Q
e2 1
4
PQ
assumption
5
P
assumption
6
⊥
e 2,5
7
Q
i2 6
8
⊥
e 3,7
9
⊥
e 4,5-6, 7-8
10
(P  Q)
i 4-9
Semantic Entailment
• If for all valuations (assignments of
variables to truth values) for which all
1,…,n evaluate to true,  also evaluates
to true then the semantic entailment
relation 1,…,n ⊨  holds
Soundness and Completeness
• 1,…,n ⊨  holds iff 1,…,n ⊢  is valid
• In particular, ⊨ , a tautology, ⊢  is valid.
I.E.  is a tautology iff  is provable
• Soundness – you can not prove things that are
not true in the truth table sense
• Completeness – you can prove anything that
is true in the truth table sense
Proof Outline
• For soundness show, using a truth table,
that each rule of inference implies the
conclusion is true when the assumptions
are true and use induction on the length of
the proof to chain together inferences
• For completeness
1. Reduce to proving tautologies
2. Provide a proof for a sequent for each entry
in the truth table for the conclusion using
induction on the formula in the conclusion
3. Construct proof from the proofs for each row
Illustrate Inductive Proof
Prove if p  q  r ⊢ p  (q  r) valid then
p  q  r ⊨ p  (q  r)
1
pqr
premise
2
𝑝
assumption
3
q
assumption
4
pq
i 2,3
5
r
e 1,5
6
qr
i 3-5
7
p  (q  r)
i 2-6
Smaller Proof
Remove last line
1
pqr
premise
2
𝑝
assumption
3
q
assumption
4
pq
i 2,3
5
r
e 1,5
6
qr
i 3-5
Inductive Hypothesis
Remove last line and change assumption to
premise to obtain proof of p  q  r, p ⊢ q  r
1
pqr
premise
2
𝑝
premise
3
q
assumption
4
pq
i 2,3
5
r
e 1,5
6
qr
i 3-5
By induction p  q  r, p ⊨ q  r
Inductive Step
p  q  r, p ⊨ q  r and correctness of i
Implies p  q  r ⊨ p  (q  r)

…


i



F
F
T
F
T
T
T
F
F
T
T
T
Proof of Soundness
• Use induction on the length of the proof
• Base case. When the proof has length 1,
premise and conclusion are the same. Clearly
the conclusion is T when the premise is T
• Look at the rule in the last line of the proof
• Obtain proofs for the premises and use
induction hypothesis to show entailment for
premises
• Use correctness of rule and truth of premises
to deduce truth of conclusion
Correctness of Rules of Inference

…
 

…

e






 
F
F
F
T
T
F
F
F
T
T
T
F
F
T
F
T
F
T
F
T
T
T
T
T
T
F
F
F
T
T
T
F
T
T
T
T
T
T
F
F
F
T
T
T
T
T
T
T
Correctness of Rules of Inference

…
⊥
 

i

e


F



F
T
T
F
T
F
T
F
F
T
F
T
Induction for Implication
Elimination
• Given a proof of length k for the sequent
1,…,n ⊢  and assume the rule at step k
is e and the premise
• Then we obtain proofs for (replace open
assumptions by premises)
• 1,…,n ⊢ 1  2
• 1,…,n, 1 ⊢ 
• 1,…,n, 2 ⊢ 
Inductive Step
• Since the proofs are shorter by induction
• 1,…,n⊨1  2
• 1,…,n, 1 ⊨ 
• 1,…,n, 2 ⊨
• By correctness of the e rule, we conclude
• 1,…,n ⊨ 
• A similar proof must be carried out for
each of the rules of inference
Proof of Completeness
1. Reduce to tautologies
1,…,n ⊨  is equivalent to  = 1 (2  …
(n  ) … )
•
•
This follows from (A  B) C  A  (B  C)
2. Prove 𝑝1 , … , 𝑝𝑛 ⊢  for each row in the
truth table for 
3. Combine the proofs in (2) using case
analysis and the LEM to obtain a proof for
the tautology ⊨ 
Key Lemma for Proof of
Completeness
Proposition. Let  be a boolean formula with
propositional atoms p1, …,pn. Let l be any
row in the truth table for . Let 𝑝𝑖 be pi if
the entry for pi is T and pi if the entry if F.
Then
𝑝1 , … , 𝑝𝑛 ⊢  is provable if  in row l is T
𝑝1 , … , 𝑝𝑛 ⊢  is provable if  in row l is T
Proof of Lemma
• Use structural induction on the formula 
• Base case.  is a propositional atom. In this
case the proofs of p ⊢ p and p ⊢ p are
trivial.
• For boolean operators assume proofs for the
operands and then construct a proof from
them for each of the operators , ,  and .
• This is shown for . The other cases are
similar.
Inductive Step for Implication
To prove 𝑝1 , … , 𝑝𝑛 ⊢ 1  2
For each entry in the truth table for 1  2
• Assume proofs for
• 𝑝1 , … , 𝑝𝑛 ⊢ 1 [ 1 ] and 𝑝1 , … , 𝑝𝑛 ⊢ 2 [ 2 ]
Prove
•
•
•
•
1  2 ⊢ 1  2 [1 F, 2 F, 1  2 T]
1  2 ⊢ 1  2 [1 F, 2 T, 1  2 T]
1  2 ⊢  (1  2) [1 T, 2 F, 1  2 F]
1  2 ⊢ 1  2 [1 T, 2 T, 1  2 T]
Inductive Step for Implication
1  2 ⊢ 1  2
1
1  2
premise
2
1
e1 1
3
1
assumption
4
⊥
e 2,3
5
2
⊥e 4
6
1  2
i 3-5
Inductive Step for Implication
1  2 ⊢ 1  2
1
1  2
premise
2
1
e1 1
3
1
assumption
4
⊥
e 2,3
5
2
⊥e 4
6
1  2
i 3-5
Inductive Step for Implication
1  2 ⊢ 1  2
1
1  2
premise
2
2
e2 1
3
1  2
i 3-5
1  2 ⊢  (1  2)
1
1  2
premise
2
1
e1 1
3
2
e2 1
4
(1  2)
assumption
5
2
e 4,2
6
⊥
e 3,5
7
(1  2)
i 4-6
Combining Proofs
Combine proofs for
 = 1 (2  … (n  ) … )
1
p1 p1
2
p1
assumption
p1
assumption
3
p2 p2
LEM
p2 p2
LEM
4
p2
p2
p2
p2
5
…
…
…
…
6




7

e

e
8

LEM
e