Formal Software Verification

1.5. Natural Deduction🔗

Natural deduction derives a proposition from assumptions by rules that mirror how mathematicians argue. Dag Prawitz gave the system its proof-theoretic study.D. Prawitz, Natural Deduction: A Proof-Theoretical Study, Almqvist & Wiksell, Stockholm, 1965. Each rule has zero or more premises above a horizontal line and one conclusion below it, and it reads as follows. Given derivations of the premises, the line licenses the conclusion.

A derivation stands on assumptions. Some rules discharge an assumption, so a proposition assumed at the top of a subderivation no longer counts as an open assumption once the rule fires. We mark a discharged assumption with brackets, as [P], and write a vertical ⋮ for the intervening derivation. A proposition proved with no open assumptions is a theorem.

Each connective comes with introduction rules, which prove a proposition of that shape, and elimination rules, which use a proposition of that shape. This introduction and elimination discipline is exactly the structure that Lean's tactics follow in the next section.

1.5.1. Implication🔗

To introduce P → Q, assume P, derive Q, and discharge the assumption. To eliminate it, apply an implication to a proof of its antecedent, the rule of modus ponens.

   [P]
    ⋮
    Q                   P → Q    P
  ───────  →I          ─────────────  →E
   P → Q                     Q

1.5.2. Conjunction🔗

To introduce P ∧ Q, prove both conjuncts. Elimination projects either conjunct.

   P    Q              P ∧ Q            P ∧ Q
  ───────  ∧I         ───────  ∧E₁     ───────  ∧E₂
   P ∧ Q                 P                Q

1.5.3. Disjunction🔗

To introduce P ∨ Q, prove one disjunct. To eliminate it, prove a common conclusion R from each disjunct in turn, discharging the disjunct assumed in each branch.

     P                 Q                              [P]     [Q]
  ───────  ∨I₁      ───────  ∨I₂          P ∨ Q         ⋮       ⋮
   P ∨ Q             P ∨ Q                              R       R
                                        ──────────────────────────  ∨E
                                                     R

1.5.4. Negation and Falsehood🔗

The constant ⊥ is the absurdity, the proposition with no introduction rule. Negation abbreviates ¬P as P → ⊥, so the rules for negation are the implication rules read at ⊥. To introduce ¬P, assume P, derive ⊥, and discharge the assumption. To eliminate it, a proof of P and a proof of ¬P together yield ⊥. From ⊥, elimination proves any proposition C, the principle ex falso quodlibet.

   [P]
    ⋮
    ⊥                  P    ¬P               ⊥
  ───────  ¬I         ─────────  ¬E        ─────  ⊥E
    ¬P                    ⊥                   C

1.5.5. Constructive and Classical Rules🔗

The rules above are constructive, so a derivation of a disjunction exhibits which disjunct holds and a derivation of an existential exhibits a witness. They do not prove the law of excluded middle P ∨ ¬P or reduce a double negation ¬¬P to P. Classical natural deduction adds one further rule, equivalently the excluded middle or reductio ad absurdum, which discharges the assumption ¬P upon deriving ⊥.

   [¬P]
     ⋮
     ⊥
  ─────────  RAA               ───────────  EM
     P                          P ∨ ¬P

The De Morgan law ¬(P ∧ Q) ≡ ¬P ∨ ¬Q and Peirce's law depend on this rule, as the Lean proofs below make precise.

1.5.6. Examples🔗

The derivations below prove propositional theorems with the rules above. A numeral marks each discharged assumption together with the rule that discharges it, and each tree reads from its leaves down to its root.

Example 1. Implication is reflexive.

   [P]¹
  ──────  →I,¹
   P → P

Example 2. A conjunction entails each conjunct.

   [P ∧ Q]¹
  ──────────  ∧E₁
      P
  ────────────  →I,¹
   P ∧ Q → P

Example 3. A disjunct entails the disjunction.

     [P]¹
   ────────  ∨I₁
    P ∨ Q
  ────────────  →I,¹
   P → P ∨ Q

Example 4. Anything follows from absurdity, the principle ex falso quodlibet.

   [⊥]¹
  ──────  ⊥E
    P
  ────────  →I,¹
   ⊥ → P

Example 5. Modus ponens, packaged as a single implication.

   [(P→Q)∧P]¹            [(P→Q)∧P]¹
  ───────────── ∧E₁     ───────────── ∧E₂
      P → Q                   P
     ───────────────────────────── →E
                  Q
   ─────────────────────────────────── →I,¹
          (P → Q) ∧ P → Q

Example 6. Disjunction commutes.

                [P]²           [Q]²
   [P ∨ Q]¹    ─────── ∨I₂    ─────── ∨I₁
               Q ∨ P          Q ∨ P
  ────────────────────────────────────── ∨E,²
              Q ∨ P
  ─────────────────────── →I,¹
   P ∨ Q → Q ∨ P

Example 7. Double negation introduction.

    [¬P]²   [P]¹
   ────────────── ¬E
         ⊥
     ────────── ¬I,²
        ¬¬P
    ────────────── →I,¹
      P → ¬¬P

Example 8. Contraposition.

               [P→Q]¹  [P]³
   [¬Q]²      ─────────────── →E
                    Q
  ────────────────────── ¬E
           ⊥
     ──────────── ¬I,³
          ¬P
    ───────────────── →I,²
      ¬Q → ¬P
  ──────────────────────────── →I,¹
   (P → Q) → (¬Q → ¬P)

Example 9. Double negation elimination, which needs the classical rule.

    [¬P]²  [¬¬P]¹
   ──────────────── ¬E
          ⊥
     ─────────── RAA,²
          P
    ─────────────── →I,¹
     ¬¬P → P

Example 10. Currying turns a conjunctive hypothesis into nested implications.

                      [P]²  [Q]³
   [P∧Q→R]¹          ──────────── ∧I
                        P ∧ Q
      ────────────────────────── →E
                  R
               ─────────── →I,³
                Q → R
           ───────────────── →I,²
            P → (Q → R)
    ───────────────────────────────── →I,¹
     (P ∧ Q → R) → (P → (Q → R))