394

Analytic and Non-analytic Proofs

Fran k Plcnn iugDepartment of MathematicsCarnegie-Mellon University

Pittsburgh, PA 15213

o. Abstract

III au toruntcd theorem proving different kinds of proof systems have been used. Tradi~

t.ional proof systems, such as Hilbert-style proofs or nat urul deduct.ion we call non-analytic,while rosolut.ion or mal.ing proof systems we call analytic. There arc runny good reasons tostudy the connections between analytic and lion-analytic proofs. We would like a theoremprover to make officicnt use of both analytic and non-analytic methods to gel. the best ofboth worlds.

In this paper we present an algorithm for translating from a particular non-analyticproof system to analytic proofs. Moreover, some results about the translation in the otherdirection are reformulated and known algorithms improved. Implementation of the algorithmspresented for use in research and teaching logic is under way at Carnegie-Mellon Universityin the framework of TPS and its educational counterpart ETPS.

Finally we show how to obtain non-analytic proofs from resolution refutations. As anapplication, resolution refutations can be translated into comprehensible natural deductionproofs.

1. Introduction

In automated theorem proving different kinds of proof systems have been used. Tradi­tional proof systems, such as Hilbert-style proofs or natural deduction we call non-analytic,while resolution or mating proof systems we call analytic. There are many good reasons tostudy the connections between analytic and non-analytic proofs. We would like a theoremprover to make efficient use of both analytic and non-analytic methods to get the best ofboth worlds.

The advantages of analytic proofs are well known. One of the most important advantageis that they seem to be ideally suited for an efficient automatic search for a proof on thecom pu ter.

On the other hand there is much to gain from the use of non-analytic proof systemsin addition to analytic methods. Non-analytic proofs can be presented in a comprehensibleand pleasing format. If we can translate, say, resolution refutations into legible non-analyticproofs, we can help the mathematician understand the automatically generated proof. Valu­able work here has been done by Miller [10]. The natural deduction proofs obtained frommating refutations are often elegant and easy to understand and use such mathematicallycommon concepts as proof by contradiction and case-analysis, and make use of intuitive op­erations such as backchaining. Better translations which arc the object of current researchwould make this even more useful for a wider class of theorems.

The ability to freely translate between analytic and non-analytic proofs also gives us atool for creating a more elegant natural deduction style proof from a given one. We would

395

translate a given proof into an analytic proof, possibly transform this analytic proof into ashorter one, and then build a new natural deduction style proof from it in a canonical fashion.

Good translation procedures can also serve as a valuahle research tool. Heuristics andlemmas of use to a theorem prover can often be discovered and formulated naturally in somenon-analytic proof style. The ability to translate these into an analytic format may helpto incorporate them into a theorem prover. Moreover, if we can translate automatic proofsobtained with and without a certain heuristic , we may gain deeper insight int.o the natureand performance of the heuristics.

Another perhaps more immediately important application is in the use of these proce­dures in compnl.er-nidcd instruct.ion in logic. The student will at.tempt his proof in a deductiveformat, e.g. in a natural deduction style, on the computer. The analytic proof of the exercisecan he found beloreluuul by an automated theorem prover eiuploylug resolution or a matingprocedure, or even constructed from a sample natural deduction proof given by the teacher.This analytic proof can then be used to guide the student through his own attempts to provethe theorem by suggesting which inference rules may be appropriate when the student asks forhelp. Moreover, when the student is done, a "normalizing" procedure like the one describedabove can demonstrate to the student how he might have proven the theorem more elegantlyor efficiently. A system called ETPS, which will contain all these features, is currently underdevelopment at Carnegie-Mellon University.

There is also a very good complexity-theoretic reason why a theorem prover may wantto make use of non-analytic as well as analytic methods. A result by Statman [14] shows thatthere are theorems which have "short" non-analytic proofs, but no "short" analytic proofswhatsoever. He exhibits a sequence of theorems (from the theory of combinators) whose..,}shortest possible analytic proof is 22 " d. (d is the number of connectives and quantifiersof a theorem X, and I the length of a non-analytic proof for X.) This lower bound is notKalmar-elementary, and there are therefore theorems which cannot be practically proven bypurely analytic methods which have short non-analytic proofs.

Let us now try to make more precise the distinction between analytic and non-analyticproof systems. The term "analytic" was introduced by Smullyan in [13] and conveys the ideathat the proof (or refutation) procedure analyzes the given formula. An analytic proof hasa very strong subformula property: Only sub formulas of the theorem and their instances willappear in an analytic proof.

In the field of automated deduction the discovery of analytic proof systems such asresolution [12] went hand in hand with the beginning of research. The mating approach [3]and a similar method by Bibel [4] are other examples of analytic proof systems.

Examples of non-analytic methods in automated theorem proving can be found in Bled­soe's survey [6] of non-resolution theorem proving. This includes approaches like term­rewriting, built-in inequalities, forward-chaining, models, and even counterexamples. Someof these approaches may be called non-analytic, since they sometimes consider formulas notpart of the proposed theorem. Many of the stimuli here come from mathematics rather thanpure logic. Hilbert-style, Gentzen-style [7], or natural deduction style systems are all exam­ples of traditional non-analytic proof systems. In general they do not obey the subformulaproperty. Usually Cut or Modus Ponens is used to eliminate the helpful formulas, which arenot part of the theorem, but substitutivity of equivalence or equality may be used as well.The use of Cut itself does not characterize non-analytic proof systems, as can be seen fromthe case of resolution, where the cut formulas arc all suhformulas of the given theorem.

396

Andr ews has shown in 121 how to conve rt matin gs int.o natu ra l deduct ion proofs. Miller 19]took this work fur ther by generalizing it to higher-ord er logic an d also add ressing quest.ionsof sty le in th ese pro ofs. Som e rd at .,,) work was also done by Bihtd ill 151. Au algoritl uutran slati ng in th e other dir ect ion is the main contribu t ion of this paver. T he ability toreadil y translat e in either dir ection bet ween analytic and non-analyt ic proofs (in th e case oft he Imp lem en tat. iou ill Tl'S between expa nsion proofs and na t urnl dedu ct ion style proofs)gives us all the aforementioned adv aut ngcs.

As a rcp reseu t.ativc of non-an aly tic proof systems we pick I' , mainly for its couccpt.ualcla rity a nd simplicity of cu t-eliminat ion. I" which is described in section 2 is closely relatedto the sys te m [,[( of Gen tzen 171 an d a related system of Smu llyan 113].

Following Miller in [9j, who works in th e sctt.ing of higher ord er logic, we define a purelyan nlyl.ic proof syste m in sr-ct iou 3. Expan5ion proofs, as t. IICY arc ca lled , arc very nnturnl andconvenient and very conc isely represent the information contained in an analyt ic proof.

In section 4 we give a new exposi t ion of part .of Miller 's work in terms of our analyticand non -analytic first-order proof syst ems. This exposition prov ides th e reader with a self­contained and unified treatment of the translations between the vari ous proof styles. We alsohandle conjunction in a new way, thus creating stylistically different proofs.

As the main part of this paper, we give an explicit algorithm which t ran slates r-proofsinto expansion proofs in sections 5, G, and 7. Expansion pr oofs are very milch different fromthe kind of analytic proofs Gentz en or Smullyan cons idered, thou gh some of th eir ideas, inparticular for cut-elimination, are used. Our merge algorithm which deals with the inferencerul e Contraction is a significantly improved version of Miller 's [9] MERGE, which generallyprod uces much larger exp ansion trees.

Andrews in [1] has given an algorit hm which comp utes a mating from a resolu t ion refuta­tio n. In sectio n 8 we state and prove the correctn ess of a different algor ithm which tr ans lat esres olution refu t ations into expansion proofs, which do no t make use of Skolem -Iunct ions orconjunctive normal forms and satisfy a quite di fferent acceptability crit erion from An drews'.We thu s give a two-step procedure by which resolu tion refu ta tions can be tran slated intoI··proofs, or, in one more step , in to na tural deduction proofs.

Space does not permit to include he re non-trivial examples illustrating th e various algo­rithms. Detailed examples for all th e translation procedures pre sented here are given by theauthor in (11].

2. The Systems I and t:Our non-analytic proof system is r-, which builds up on simi lar syste ms of Gentzen (7]

and Smullyan [13]. 1· is particularly well suited for the description of our algori thms. Notice,for instance, that any theorem derived in 1 · is automatically in negation normal form. Thework done here can easily be generalized to other superficially riche r systems of first-orderlogic. To simplify some of our exp osition we introduce a system 1 which is identical to 1"but does not contain the rule of Mix (a vari ant of Cut).

Our formulation of first-order logic includes the proposit ional connectives V, A, -', thequantifiers 3 and \;f and an infinite number of individual vari ables and const an ts. Functionconstants of arb itrary finite arity are also permitted. An atomic formula is of the formPtJ _. . tn for an n-ary predicate P and term s t l , _. _, tn- A literal is of th e form A or -,A foran atomic formula A. A formula is in negation normal form if the scope of each negation is

397

atomic. l':ach first-order form ula has a classically equi valent formula in negation normal form,and we generally assume our form ulas to be in negation normal Iorm. X lv /a J is our notationfur the result of subst.il.ul.ing II for th e [rce occurrences of v ill X . We write n n fonnulafor a formula in negat ion norm al form . \Ve do not assume th at. formulas are alphabeticallynormal , exce pt in section 8 where we talk ab out resolu t ion refutatio ns. Sometimes we writ.eXX to indi cate th at an equation is valid for hoth conjunc t ion and dis] unction .

Nod es in a pro of-t.rce in 1 we call lines. A line in I is a multi-set of formulas . Thisform ula t.iou is halfway between Gent.zen 's (sequ ent.s) and Smullyau's (s<>l.s) . Th e reason forchoosing t his pnr t.icular repr esentation lies in the fact. th at contraction is an ext remely pow­orful inferenc e rule of our system , When we t.ry to an alyze how the d f"I,t. of a cont.radionind uces a change in au associated expa nsion tree, we will see th at I he t ransforma tion is reallyquite complica te d . T hus we can not. leave contraction imp licit , like Smullyan did , when heint roduced set s of Iorm ulus as object s in the pro of. St ructurul rules like exchange, however,have no imp act on the logical cont ents of the formul a or proof line, We therefore leave themimp licit in the multi-set. notation.

In general we let U and V stand for multi-sets of formulas, i.e, sets where we allow thesame formula to appear more th an once as a member. We often write U,X to mean U U {X}if U is a multi-set,

The axioms of 1 are of the formU,A,--,A

where A is an atomic formula.

The inference rules can be divid ed into structural rules, propo~ itional rules, and quantifi­cational ru les. The only structu ral rul e in 1 is contraction (0 ). T here is one prop ositionalTIlle for each propositional connect ive: V -int roduction (VI) and /\ -in troduction (1\1). There isalso exactl y one rule for th e quantifiers: 3-in troduetion (31) and V-introduction (VI) .

Structural rules

Propositional TIlles

Quant ificational rules

Con tr action:

U,X,Y VIU,XvY

U,X,X cU,X

U,X V,Y AIU,V,X 1\ Y

U,X [v/t ] 31 .U,3vX ,t a term free for v ill X.

U,X[v/a] VI free i U U XU,VvX ' a not ree 111 ,vV •

U,V contain the side -formulas of an inference rule . Th ey may be empty. The proposi­t ional and quantificational infer ence ru les correspond to Smullyan's [13] rul es Q, fl, "I, 6.

System 1 is complete in the sense th a t we can derive th e negati on normal form of everyvalid formula in classical first ord er logic. This follows almost inun cdiatcdly from Smullyan's

398

form of the completeness resu lt for Gen tzen syste ms an d we will no t re peat the argu menthere .

We shall a lso use th e sys tem I. " which contains the rule of Mix:

X ¢'U, X ,/-V

X is th e negatio n uormnl fOTlII of .X: Th ere must I" , at leas t, 0 111' 0",',111'1"'1 " :" of X, the rrrixformula , in the left pre mise and at leas t one occurrence of X ill th e figh t. premise. Mix wasintrod uced hy C"nlzen ami is a vnri aut . of t l" , rule of Out, and t Ill, two a n' ea sily shown tobe equl valent .

3 . Expansion Trees

Analytic proofs in this paper ar e presented as expansion tr ees. Expansion trees veryconcisely and naturally represent th e informat ion contained in an an aly tic proof, as we hopeto show. They were first introduced by Miller [9] and are somewhat sim ilar to Herbrandexpansions [8]. Some redundancies can eas ily be eliminated for an actual implementation asdone by Mill er in the context of h igh er ord er logic . The shallow formula of an expansion treewill corresp ond to the th eorem; the deep formula is akin to a Herbrand-expansion provingthe theorem. Our formu la ti on of expansio n trees differs onl y triv ially from Miller's in [10] ,if restricted to first-order logic. At several pl aces it is convenient to allow n-ary conjunctionand disjunction ins tead of tr eating them as binary operat ions .

3.1. Definition. We define E xpansion Trees ind nctively. Simultaneous ly, we also defineQD, t he deep formula of an exp an sion tree, which is always quanti fier-free , and QS, theshallow formula of an expansion tree . We furth ermore place the res tr ict ion that no variablein an exp ansion tr ee may be selected more than once.

(i) A litera l l (signed atom ) is an exp ansion tree. QD(l) = QS(l) = l. Literals form t h eleaves of expansion t rees .

(ii) If Q I, .. . , Qn, n ~ 2, are exp ansion trees, so is

Thenand

Q= AQI Qn

(iii) If Q1J .. . , Q", are expansion tre es such th at If Qr = S [v/t l ] , ... , Q~ = S [v /t n ], t; a termfree for v in S for 1 ~ i ~ n, n ~ 1, then

Q= is an expansion tree. Thenand

QD = Qf V • . . V Q~,

QS =3vS.

3vS is called an expansion node; v is th e expanded variable; tl, "" t n are theexpansion terms.

(iv) If QIJ is an expansion tree such that Qg=S[v/a] for a variable a , so is

Then•mel

QV =QR,QS ~,VvS.

399

VvS is called a selection node; a is the variable selected for this occurrence of v.

To improve legibility of our diagrams we will frequently draw & for an expansiontree with QH = X.

Since traditional proof systems do not contain Skolcm-Iunctions, we need a differentmecbanism to insure the soundness of our proofs. Following an idea of Bibd 1'11, which waspicked up by Miller [9]' we introduce a relation <(J on occurrences of expansion terms. Thecondition that <o be acyclic replaces Skolemizru.iou in our analytic proof system. The reasonfor this definition will become clear in section 4. «J is dual to -< defined in [10], and it isshown ill [9] that they are equivalent. Later in section 8 we shall set' how this relates toSkolemization.

3.2. Definition. Let Q be an expansion tree. <~J is a relation on occurrences of expansionterms such that t <~ s iff there is a variable selected for a node below t in Q which is free inB. <(J, the dependency relation, is the transitive closure of <~.

We define clauses only for quantifier-free nnformulas, since this is the only case we willneed.

3.3. Definition. Let X be a quantifier-free nnformula. A clause in X is a list of literaloccurrences defined inductively by

(i) X = I, a literal. Then C = (I) is the only clause in X.

(ii) X = A VB. Then for all clauses (al,"" an) in A and (bl, ... , bm) in B, C = (al, ... , an,bl, ... , bm) is a clause in A V B.

(iii) X = A /\ B. Then all clauses in A and all clauses in B are clauses in A r. B.

3.4. Definition. A relation on literal occurrences in a quantifier-free nnformula X is amating .M if -.1 = k for every pair (I,k) E .M and there is at least one clause in X containingboth I and k. If (I,k) E.M, I and k are said to be .M-mated.

3.5. Definition. A mating .M is said to span a clause C if there are literals I, k E C suchthat (I, k) E .M. A mating .M is said to be clause-spanning on a quantifier-free nnformulaX if every clause in X is spanned by .M.

The significance of this definition is of course that a quantifier-free nnformula X istautologous iff there is a mating clause-spanning on X (see Andrews [3], [1], and Miller [9)).

3.6. Definition. A pair (Q,.M) is called an expansion tree proof for a nnformula X if

(i) QS = X.

(ii) No selected variable is free in QS.

(iii) <Q is acyclic.

(iv) .M, a mating on QD, is clause-spanning on QD.

Our translations establish soundness and completeness of expansion tree proofs withrespect to nnformulas. We rely on the soundness and completeness of 1*, which is a simpleconsequence of results by Smullyan [13]. A similar, but necessarily less constructive argumentwas carried out by Miller [9] for expansion tree proofs in higher-order logic.

400

4. Building I -P'roofs from Expansion Tree Proofs

The nlgorit.lun follows ideas or-Miller [9], but. we provide a different treatment of con­junction. Our algorit.luu results in shorter proofs than the more naive algorithm that alwaysapplies case (vii) below for a conjunction, but we do not achieve the full power of Miller'sfocusing method. In return, our method is computationally faster.

In the cxposil.ion below we somct.imcs assume that. there is a unique correspondencebetween the formulas in it line and an associated expansion tree, even t.hough we like to thinkof tho line as a multi-set where several identical members are indisl.inguishablc. In general itis sufficient t.o pick any correspondence between those multiple occurrences of a formula in aline nnd t.he unique subtrees of the ussociatcd expansion tree.

4.1. Definition. 11 pair (Q, M) is an expansion t.ree proof for a line L X], ... , X" in anI-proof iff (Q,M) is an expansion tree proof for Xl V··· V X".

4.2. Definition. Let (Q, M) be an expansion tree proof for a line L in an I -proof, andlet X be a subforrnula of ,U\ element in L. Then Qlx is the part of the expansion tree Qrepresenting X (Qli = X) , and Mix is the restriction of M to pairs both of whose elementslie in QI~. We will sometimes talk about X D instead of QI~, if the expansion tree Q is clearfrom the context.

We shall describe an algorithm which constructs an J -proof from an expansion treeproof, starting with the nnfornmla to be proven and working upwards until every branch inthe proof tree begins with an axiom. The cases given below can in principle be applied inany order. The ordering below will often, but not in general, result in the shortest proof thatcan be constructed with this algorithm.

If an X E L is such that QI~ has no literal in a pair in M, then X is to be ignored andcan only be part of a side-formula in an inference above L.

Now assume L is a given line in an I -proof, and (Q, M) is an expansion tree proof for L.

(i) L = U, A, -,A. Then L is an axiom.

(ii)

(iii)

L = U,X V Y. Infer L by!/'J'VYy VI. (Q, M) is an expansion tree proof for U,X, Y.,

L = U,VvS. Infer L by U,S[v/a] VIU,VvS '

where a is the variable selected for this occurrence of S[v/aJ.

In Q we replace the corresponding subtree

Infer L by

By definition 3.6 and the inductive assumption that (Q, M) forms an expansion treeproof for U,VvS, a cannot be free in U or VvS, since a is a selected variable in Q.

(iv) L = U, :JvS and :JvS has n, n 2: 2 successors in Q.

U,:JvS, ... ,3vS... (n-1)xC.

U,3vS

401

Change Q =

Since QD = RD , (R, M) is ag..in an expansion tree proof for V, 3vS, ... , 311S.

(v) L CO" U,JvS, and JvS has exactly one successor SlvjtJ, and no free variable in t is avariable to be selected in Q.

3vS

Infer L by %~J~~] 31, and replace t ill Q by AS[v/t]

(vi)

(vii)

From the restriction on t it is clear that no variable to be selected will be free in S[11/t),and therefore by inductive hypothesis in V,8[11/tJ.

L = V, V, X 1\ Y such that M Mjff,XU MIv,Y, i.e. no literal in V D or X D is M-matedto any literal in V D or yD.

Here we have to consider three subcases,

(a) Miff is clause-spanning for VD. Then restrict the mating to )J = Mlu. Thenno literal in V, X 1\ Y is involved in the mating and they will only appear as sideformulas in any inference above L.

(b) M!v is clause-spanning on yD. This case is symmetric to case (a): Let )J:= Mly.

(c) Neither case (a) nor case (b) apply. Then infer Lby ViT:ir, X :; AI.

Since the problem is symmetric, we will simply show that (Q!ff,X, Mlu,x) is anexpansion tree prooffor V,X. It then follows analogously that (Qlv,y, Mlv,¥) is anexpansion tree proof for y, Y. The only condition we have to test is whether Mlu,xis clause-spanning on QlfJ,x' Let P be a clause in QI{J,x. Since neither case (3)nor case (b) applies, there is a clause 0 in yD not spanned by .M. Let P' be theextension of P to a clause in QD such that P'jv = 0 and P'!u,x P. By inductiveassumption, pi is spanned by (I, k) E M. Not both I and"k are in v>, since M doesnot span O. We also assumed M:::= Mlff,x U M\v,Y and hence (I,k) E MhT,X.

L =V,X 1\ Y and case (vi) does not apply.

Th . r L b V, U, X 1\ Y 0en mer y V,XAY .

V V

Modify Q ~ A'>... to go' R ~

Li/~For every occurrence of a literal I in V, there are two occurrences of I in U,V. Callthese 11 and 12 for the occurrences in the left and right copies of V, respectively. Let

402

MII,.x I}.{Ifr.l·1be th e resu lt of replacing eve ry occurrenc e of a literal l Irom U D in M1/1.xIMlv.yl hy [I 1[2]. TllCn ),f = }.{Ilu : U }.1I ~.l' spans every cla use in R D. To sec th is,

Jet P he a clause in R V . Theil P contains lite ral s from either X or Y, but not bo th.Withou t loss of generality , assume l ' contains lite ral s in X , and let 0 be th e clause inQD which agrees with P on X and contains a literal I in U D iff [I is in P . By inductiveassumption, 0 is closed hy a pa ir (k, m) E N . But th en a lso (k l , m) E Mlk x C ),f (if mis in QI~) , or (kl,rn 1

) C .M II,.x c » (ifm is in QI/?) . T hu s I' is spa n ned hy N. Since/ ' was a rhit.rary, N spans eVNy d an s" in tt" ,Now the case (vi) can h e applied lnuu cdiatcdly, thus red ucing th e complexity of L =lJ, X /\ Y to the complexities of 1.Ju, lines I I, X a url V, Y .

Since the size of connected suhfon uulas of th e unju stified lines ill t he I -proo f is dlmin­is hed in each step, all we need to show to prov e correct.ne ss is (.]I al. a t. k-ast, on e of till< casesalways applies. One can sec that onl y on e problem may ari se: a ll top' level nnforrnulas areexi stentially quantified, each of them has ju st one subst.itution term , and all of the substitu­tion terms contain a free variable which is still to be selected. Since <q has no cycles, thereis a term t such that for no 5, 5 « J t. If t contained a free vari nb!e a, which were still tobe selected, then the node whe re a is selected has to lie below on e of th e top-level existentialquantifiers in Q. But if 5 is th e substit ut ion term for this node, th en by definition 3.2, 5 <Q t.This is a contradiction, since <o is acyclic and therefore case (v) mu st apply for at least oneof th e quantifiers.

5. Building Expansion Tree Proofs from I -proofs

In this section we show how to construct an expansion tree proof from a proof in I. Thistransla tion plays an imp or tant role in giving a translation procedure from I· into expansiontree proofs. Some ideas of Mill er [9] are used, but we proceed enti rely construct ively, Also,th e procedure for merge presented in case (vi) below results in mu ch smaller exp ansion treesthan the ones obtained by Mill er 's MERGE alg orithm. M or eover , because of the way we setup I· , a merge is nec essary only for contra ct ion and not inherently ti ed to any quantifier orlogical connective. This allows a clearer exposition of the ideas wh ich underly the translationfrom I-proofs in to expansion tree proofs.

The construction proceeds by induction on the I -pro of t ree. Not e tha t all cases except forContraction are very simple. This supports our claim that th e exp an sion t ree proof inducedby an I -proof corresponds to the I -proof "in a natural way" . The basic "idea" underlyingthe original proof is retained.

We now as sume we are given an in Ierence (or axiom) in I , and we have already con­structed expansion tree proofs for the premise. We shall call this expans ion tree proof (Q, M)((QJ,Mil and (Q2, M2) in the case of III). The expansion tr ee proof for the conclusion willbe (R, ),f).

(i) We have an axiom U, A, -,A.V

Then N = {(-'A,A)} and 17. = ~6/ 1 ~

In Qlu , let each existentially quantified variable expand to itself, and select a new uniquevariable for each universall y qu antified variable.

(ii) V[:

(iii) /\J:

403

iJ,:'-f-tlv' Here (H, lJ) '"" (Q,.M).

/I, X V, Y--U;-V; X /\ y-' Hen' lJ = .M 1 U .M 2 and

v

r,"mQ,~h"'" AW,g'IR~~In the new tree we JIIay have to rename the selections for some universal variahles, tomake sure that no free or selected variable from one branch of the I -proof tree is selectedin the other branch.

(iv) 31: UU~~~D, t free for u in S.

v

FwmQ~APM"roR~~~S[u/t]

If u does not appear in S, we pick a new variable a to be t, a not selected in Q and notfree in U,S.

Since R D = QD, we can take lJ = .M. What remains to be shown in this case is that <nis acyclic. Let a be a variable selected below 3uS in R. There may be expansion terms8i, t <~ 8i, but there is no term 8 such that 8 <~ t. If s <'k t would hold, there had to bea variable b selected in R, and b free in t. But then also b free in S[u/tJ (otherwise twasselected to he a new variable), and hence b free in QS which contradicts the assumptionthat (Q,.M) is an expansion tree proof for U, S[u/tJ.

(v) VI: UU~~:~!!l, a a variable not free in Uor "IuS.

V

FwmQ~ A ~P~roR~~"SL!J~ ~

£If u docs not appear in S, we pick a new variable a not free in U or S or selected in Q.

Since R D =QD, we can take lJ = .M. Moreove~, since a is not free in U,"IuS, a is a validselection. Moreover, a could not have been. selected in Q, since a occurs free in S[u/aJor had been chosen not to be selected in Q. Thus a is selected in R only once.

404

(vi) C;

Let Q I , Q2 be th e subtrees of Q with the root nod e being th e left and right occurren cesof X in th e pr em ise, r cspcct.ivcly, We apply a recu rsive mer ging algor ithm to obtain anexpansion t ree Q I ED Qz for the sing le occur rence of X in the conclus ion. We will p assfrom

v V

Q =' ~ to li = /1\d / ci l ~z & QI"mQZ

In order to apply ED to two exp ansion t rees PI , Pz, we req uire p i'i = p2'i, wh ich iscertuinly true or QI and Qz.

and Pz =

PI ED Pz = l. We say we identify th e distinct

AA

PI =' II = l = lz = Pz . Thenoccurrences of the literal l ,

A(a)

(b)

(c)

Y I EB Z I Yn EB Zn"IuS "IuS

PI = laand Pz = IbY l Yz

VFYl EB Yz[b/a)

Yz[b/a] is the result of repl acing every occurrence of b in th e expansion tree Yz bya. But not onl y do we have to apply this change of names in Yz, but in th e wholeexp ansion tree in wh ich ou r merge takes place.

3uS 3uS

and Pz =

405

Here T I, ... ,Tk arc the expansion terms which appear only in one of t I, ... ,tTl ands j , ••• ,8m; TI'+I, ... ,Tk.H are the expansion terms which appear in both. 8 1 [82 )

stands for the occurrence of a subtree in 1'1 l/'2]. If Tk+h -- t; .c: 8 J we say that Tk+h

is the result of identifying the distinct occurrences of the expansion terms ti andBj.

We now show by induction on the number of identifications of expansion terms in QI G1Q2that <II. is acyclic. We define a sequence of relations, «r"'<o, <I, ... , <" '--=<11. suchthat each <i, 1 <::: i <::: n, is acyclic.

Note first that <n is acyclic, since «J is acyclic. If no two literal occurrences wereidentified during the merge, <n=-o<1I. and we arc done. Otherwise let PI,P2, ... ,P" beall the literal occurrences in R which result from ident ifying expansion terms in QI and(J2 ordered in such a way that i < j whenever Pi is above /'J in U. Now assume wehave already defined <i. Let ql in Q 1 and q2 in Q2 be the expansion terms which wereidentified to form Pi. We define t <i+l 8 iff t <i 8 or t == Pi and q2 <i 8 or ql <i 8 bearingin mind that each variable selected below ql is also selected below q2 after merging, sinceql and q2 arc identfied. This can only introduce a cycle into <i+1 if Pi <i+l Pi whichin turn can only happen if ql <i q2 or q2 <i ql. But if for some 8, 8 <i qJ, then also8 <i qz, since ql and q2 have the sallie free variables. Thus this would mean ql <i ql orq2 <i in, which is a contradiction to the inductive hypothesis that <i has no cycles.

One can finally see that <11.=<", since t <II. 8 either since t <o 8 or because of oneof the identifications of distinct expansion term occurrences. The case where selectedvariables are being renamed and identified does not contribute any new pairs to <11.,since a selection is below a given expansion before identifying the selections iff it is belowthat expansion after identifying the selections.

To obtain )./ on R from M on Q, we simply identify in M all literal occurrences whichwere identified to form one literal occurrence. Then )./ spans every clause on R: Let IGJbe defined as I G1 k, if I and k are literal occurrences which were identifed using case (a)above when forming QI G1Q2, otherwise IEB = I. Then )./ = {(IEB, kEB ) : (I, k) EM}. Nowlet C be a clause in RD. Then there is a corresponding clause D in QD such that lEDiff IEB E C. D is spanned by a pair (I, k) E M. But then (IGJ, kEB ) E )./ and consequently)./ spans C.

6. Cut Elimination in I"

Our cut elimination algorithm is based on similar algorithms of Gentzen [7] and Smullyan[13]. We reformulate these algorithms in terms of the system I" in order to give a completelyself-contained and unified treatment to all the translations between analytic and non-analyticproofs. If one wanted to write out the details of a procedure which computes an expansiontree proof for a formula B, given those for A and ...,A V B directly in terms of expansiontree proofs, one could usc the cases below in an inductive proof to show that such a directprocedure will result in the same expansion tree proof for B as the less direct proceduredescribed in section 7.

The proof of termination relies on a double induction argument: At each step we trans­form one mix (which has no other mixes above it) into one or several mixes with lower degree,or, if the degree stays the same, with smaller rank. The degree of a mix is the number ofquantifiers and connectives in the mix formula (the formula being eliminated). The left [right]

406

rank of a mix is the number of lines in the left [right] premise of a mix which contain the mixformulas. The rank of a mix is the SUIll of left and right rank.

For many of the following cases there is an obvious symmetric case which can be treatedcompletely analogously. It is to be understood that there could be more occurrences of themix formula in the premises of a mix, hut we .do not write this out to keep the diagrams assimple as possible. First we consider the case that one of the premises of the mix is an axiom.

(i) The mix formula is the side-formula of the axiom. Then we eliminate the mix immcdi-atedly:

U,V,A"AU,A,~A,X V,X.---V;V,-A~-::;A----M,x

(ii) The mix formula is not the side-formula of the axiom. Then we also eliminate the mix:

U,A V,A,~AM'U,V,A lX

Add V as a side­formula to every inference

above U,AU,V, A

We will now treat the case that the rank of the mix (which contains no other mix above it)is 2.

(i) The mix formula is a literal A. Since the rank of the mix is 2, one of the previous twocases must apply.

(ii) C = X V Y, C = X I-.}'.

U,X,Y VI,X M'U,VI,Y ,:z: V.,V M'

U,VJ,V. ,:Z:

Each of the two new mixes has smaller degree.

(iii) C = VvS, C = 3vS.

U, B[vla]VIU,VvS

U,V

V,S[v~13IV,3vS Mix

V,S[vlt] M''x

U,A,B,X V,X M'U, V, A, B VI ,:z:

U,V,AvB(i)

Now we consider the case where the rank is greater than 2. We treat the case where theleft rank is greater than 1. The case where the right rank is greater than 1 can be treatedanalogously.

This case again breaks up into two subcases. The new formula on the left hand side ofthe premise mayor may not be the same as the mix formula. First we show how to reducea mix in case the new formula is not the same as the mix formula. Here we generally reducethe mix to a mix with the same degree but lower rank.

U,A,B,X VIU,AvB,X V,X M'

U,V,AVB ,:z:

407

(ii)

If X appears in only one premise of the 1\1, this case simplifies in the obvious way.

(iii)U,A[l,/t],X"U,-3;;A~X- J[ V,X Mix

ll,V,311A

ll,Afll/tj,X V,X.-------.----------- M 1X

U, !':!....~1':(!131U,V,JvA

(iv)u, AllI/a], XV;VvA;X-' V1 V X-'--U",....V",V7';;"A"--'-'- Mix *

U,A[lI/aj,X V,X.- -.-.- ..~-.-- -.-.- M1xU,V, Alv/a] VIU,V,VvA

If a happens to be free in V, replace a by a new variable b everywhere above V, X,

(v)U,A,A,X C _U,A,X V,X M'

U,V, A 1X *U,A,A,X v,X

M,

U 1X,V,A,ACU,V,A

U,A,B,Av B VIU,AvB,AvB

U,V(i)

The last case remaining occurs when the mix formula is also the formula introduced bythe last inference rule on the left-hand side, The cases are analogous to the previous ones,except that one mix is now reduced to one mix of lower rank and another mix of left rank 1.

U,A,B,AVB V,AI\B M'U,V,A,B VI _ 1~

U, V, A v B V, A /\ B M'U,V,V C 1Z

U,V

(ii)Ul,A,A/\B U2,B,AI\B /\1

U1,U2,A /\ B, A /\ B,A/\ BUl,U2,V

V,AVBM,'LZ

This case simplifies if the mix formula does not appear in both premises of the /\1.

U, 3v8, 8[v/t]· V,VvS M'U, 3v8, 8[v/t] 31 U,V,8[v/t]31 1~

(iii) U,3v8,3v8 V,\lvS M' * U,V, 3v8 V, \lv8 M'U,V 1X

U,V,V 0 1Z

U,V

U,Vv8,S[v/a] V,VvS M'U,Vv8, S[vla] VI U,V, S[vla] VI ~

(iv) U,VvS,VvS V,VvS M' * U,V,Vv8 V,VvS M'U,V 1X

U,V,V 0 1Z

U,V

U,X,X,XC U,X,X,X V,X

M,(v) U,X,X V,X M' * U,V 1Z

U,V 1X

408

7. Building E xpansion Tree Proofs from 1"- p ro ofs

Since we already showed how to con st ru ct expansio n tree proofs from I -pro ofs we haveonly to show how to constru ct an ex pansion t ree proo f, given expansion tree proofs for thetwo premises of a mix. We emphasize the constructiven ess of our approach. Of course wecould simpl y use any theo rem pr oving procedure a nd arrive a t a pro of, since we already knowwe are dealing wi th a th eorem. Our goa l, however, is t.o construct an exp ans ion tree proofwhi ch most closely reflects the st ructu re of t.he two given or igina l pr oofs, an d moreover canh e explicit.ly olrtainerl from the m.

Here is onr pr ocednre: If we do Hot alread y have mix-free I -p roofs for b oth premises,construct th em wit h the algor ithm described in section 1 . El iminate t.11(' mix [rm u the res ult­ing proof in 1" t.o obtain a proof in I usin g th e algor ithm in secti on G. Fin all y, cons truct anexpansion tr ee proof from th is I-proof usin g the proced ure given in section 5.

In practice we do not have to exp licitly contruct these I-pr oofs. The proced ure may bereformulated in terms of the expansion tree proofs themselves, bu t sp ace does not permit towri te out the rather laborious details here.

By looking at one of the cr it ica l cases, case (i) where a mix of rank I is eliminated, onecan see the following: If d is the number of quantifiers and conn ectives in the mix formula(degree of the mix), l is the length of the proof (say, above the leftv pr em ise) , and f(d,l) isa wors t cas e lower bound of the leng th of the resulting mix-free proof, the following relation

must hold: f(d,l) 2': f(~ ,f(~,l» . Thus we get f(d,l) 2': 22"'" }d.Since an I -proof is at most exponentially bigg er than a corresponding expansion tree

proof, the lower bound rem ains non- Kalm ar-e leme ntary wh en the re su lt ing I -proof is trans­lated into an expansion tree pr oof. A resul t by Statm an [14J mention ed in the introductiontells us that this can no t be sign ificantly improved. There cannot be a Kalmar-elementarytranslation from L"-proofs into I -proofs,

In practice, however, th e trans la t ion is oft en feasible and it is not clear which class oftheorems will ac tually blow up the size of the proof by as mu ch as J(d, l).

8. Building Expansion Tree Proofs from Resolution Refutations

When describing the tr an sla tion procedure from resolution refuta t ions into exp ansiontree proofs care mus t be taken to avoid confus ion between th e different nnformulas and theclauses in them . Resolution refuta tio ns are sta t ed for th e n egation of a theorem ; expansiontree proofs ar e defined for the th eorem itself. In both cas es clau ses playa central role. Thuswe will call clauses in an expansion tr ee paths, while clau ses in a resolut ion refutation will becalled clauses. We say a path intersects a clause if they have a literal occurrence in common.Notice that our definition of a clause is slightly different from the cus tomary definition as aset. Since matings are rel ations on literal occurrences, we cannot afford to regard differentoccurrences of the same literal as identical. During a resolution of two clauses we delete alloccurrences of the literal res olved upon . Gen erally in this section we will assume nnformulasals o to be a,B-normal, i.e, no variable occurs both free and bound and ea ch variable is boundat most once.

Andrews [IJ described an algorithm which translates resolu tio n refutati on int o matings,but the setting here is essentially difTer en t. We do not work with conj unct ive normal formsor Skolem-terms in expansion tr ee proofs and the condition th at matings in expansion tree

409

proofs must be clause-spanning is also qui te different from Andrews' condition that everycycle in a mating must have a merg.e.

W ith the aid of thi s algorithm a resolu tion refutation can be t ran sla ted into a non­analyt ic proof hy first t ranslating it into an expansion tree proof and then into a proof in I"using th e alg orithm in sect ion 5. This can be carried even further by t ranslating the I" -proofinto a proof in natural dedu ction sty le. A procedure for this tr ansla tion is given by Miller in[101. This can help a mathemat ician underst and a proof by a reso lut ion theorem prover sincehe ca n study it in a familiar format . It may also he a valuahle research tool as ind icated inthe introduction.

8 .1. Definition. Let X be au o:,B-normal nnformula. T hen X" , th e Skolem-forrn of X,is the resul t of replacing every subformula of th e form 311S hy S[II/f,,(v'l""'w,,)], whereW j , .. . ,W" are all the univ ersally qu antified variables in whose scope :JvS lies, and thendeleting all the universal qu antifiers. f ,,(wj, ... ,w..) and instances thereof arc called Skolem­terms , Iv the Skolem-function for v.

8 .2. Definition. Let X be an o:j9-normal nnformula. A resolution refutation of X is alist of clauses C1, ..• ,c" such that

(i) 3m such that {c; : 1 :S j :Sm} is a sub set of the set of clauses of X" ,

(ii) for each j > m either

(a) c; is a subs t itu t ion instance ,pc; for some i $ i,

(b) c; is the resol vent of C"i and Chi ' where a;, b; $ i, an d c; is formed by appendingthe resul ts of del etin g all occurr ences of a literal /; from c", an d -. /; from Chi '

(c) cn = 0 (the empty clau se).

In our t ransla ti on we will have to select unique variabl es for Skolem-functions and theirarguments. In general, if I(W I ' .. . , w,,) is a Skolem-term for ar b itrary terms WI,,,., W n ,

then I(wj, . . . ,wn ) is a unique corr esponding var iable. Note th at this is just a notationalconveni en ce in our metalanguage. We must also occasionally mod el the effect of a subst itut ioninto a Skolem-tenn on the corr esponding variables.

8.3. Definition. Let I(W I , • .• ,wn ) be a vari able, ,p a substitution for var iables whichdo not come from Skolem-terms. We ext end ,p to te rm s an d form ulas in the usual way,but also ex tend it to act on variables wh ich come from Skolem- tenns. R ecursively define,pf(wj , .. . ,w,,) := J( rf>wl ,"" rf>wn ).

We are now ready to define what it means to apply a subst itut ion to an expansion tree.Note that (,pQ)S = ,p(QS).

8 .4. Definition. Let Q be an expansion tree. Then we define ,pQ inductively.

Th en ,pQ =

Q is a literal I. Then ,pQ = ,pI.

AQ =

(i)

(ii)

410

(iii) Q =

We leave the original expansions intact, and add all terms which change under thesubst.itut.ion as new expansion terms. Let til"'" tim be all t.he expansions terms Ii suchthat <pli of ti. Then

3vS

<lQ= ~t,.Q1 <PQi l <PQi...

VvS

(iv) Q = /f(Wb ... ,wn)

Qo

VvS

Then <PQ = 1<Pf(Wb . .. ,Wn)

<PQo

During the translation from resolution refutations to expansion tree proofs we associatean expansion tree and a mating with each line in the resolution refutation. These expansiontrees have to satisfy all of the conditions of expansion tree proofs except that the mating doesnot have to be clause-spanning. We therefore define:

8.5. Definition. A partial expansion tree proof (Q,.M) for a nnformula X is an orderedpair consisting of an expansion tree Q and a mating .M on QD such that

(i) QS = X.

(ii) No selected variable is free in QS.

(iii) <Q is acyclic.

A particular partial expansion tree will correspond to the part of the resolution proofwhich is constructed solely from the clauses in the negated and Skolemized theorem.

8.6. Definition. Let X be an al9-normal nnformula. The initial expansion tree Q(X)for X is inductively defined for parts Y of X by

(i) Y =1 for a literal I. Then Q(Y) = I.

(ii) Y = Y1)O( .. ·)O(Yn . Then Q(Y) =

3vS

(iii) Y = 3vS. Then Q(Y) = IvQ(S)

411

VvS

(iv) Y =VvS. Then Q(Y) = If1J(Wl, ... ,Wn)

Q(S[v/ f1J(Wl,"" wn )])

where f1J(Wl,"" wn)is the Skolem-term for v in X.Now we construct an expansion tree proof from a resolution refutation. Let a resolution

refutation Cll"" C""Cm + l , " " Cn C~ LJ he given. For each clause Cj, j 2: m we will recursivelyconstruct a partial expansion tree proof (Qj, Mj) with the following property:

(*)j Let Ci, i :S j be a clause in the resolution refutation. Then every path through Qfwhich does not intersect c, contains a pair of Mj-mated literals.

If we can show that (*)j holds for all m :S j :S n, the correctness of our translation isproven, since Cn 0 and therefore no path through Q;; intersects Cn by (*)n' Hence everypath through Q:? must be spanned by Mn and (Q:?, Mn ) is an expansion tree proof for X.

Now we come to the construction of (Qj, Mj).

Let (Qm,Mm) (Q(X),O). Since every path in Q(X)D intersects every clause in X·,(Qm, Mm) is a partial expansion tree proof for X and satisfies (*)m'

Now assume (Qm, Mm ) , ••• , (Qj-b Mj-I) are partial expansion tree proofs for X and(*)i is satisfied for m :S i :Sj -1. We have to distinguish cases, since Cj could either be asubstitution instance or a resolvent of earlier clauses.

(i) Assume Cj is a substitution instance </>Ci for some 1 :S i :S j 1, </> a substitution forthe free variables in Ci. If a variable is free in c, it must be existentially quantified inX. Now we pass to a substitution (J such that (} agrees with </> if the substituent is not aSkolem-term, and (Jv == f(Wl, .•. ,wn) if </>v = f(Wb'" ,wn).

Let Qj = (}Qj-l. (Qj, Mj) is a partial expansion tree proof for X (Mj to be contructedlater):

(a) QJ =QJ-l X by inductive assumption.

(b) From the way selections for universal variables in X are chosen and from the factthat X was a,B-normal, it is clear that every variable is selected at most once andthat no selected variable is free in QJ.

(c) <Q, is acyclic. Assume, to the contrary, that there is a cycle

The first relation means that there is a variable selected below t l which is free int2 • Since the variable is selected below t1 in the expansion tree, it has the form ofa variable corresponding to a Skolem-term which contains tl. Thus t2 contains aterm of the form ft( ... ,tb . ..). Hence in the Skolem-form </> of the substitution, tlis free in t2 The next relation would say that there is a variable selected below t2which is free in t3' Thus a term of the form 12(... ,t2,"') is free in t3' Combinedwith the previous conclusion this gives us that t 1 is free in t3. Iterating this processwe finally arrive at the conclusion that tl is free in t n tl. But this would meanthat the original substitution </> was not legal, which is a contradiction. Therefore<Q, must be acyclic.

upon the literal Ii E Ca" .ii E Cbi' where.Mi-I U {(I,k) : I an occurrence of ij in Ca"

(ii)

9.

412

Now we show how to construct .Mj. First note that because of definition 8.4 any literaloccurrence in Qi'-l is still present in Qf. Each new literal occurrence in Qf is of the

form Oi for some l in Qf-l' Then we simply let.Mj .Mj-l U HOi,Ok): (I,k) E; .Mj-l}'

(a) Consider Ch, h < j, P a path through Qf not intersecting CI<' Since paths in Qi'can only be longer than paths in Qf-l' there is a projection 1" of P-in Qf-l' P'may be obtained by deleting all the new literals from P. Then 1" is spanned byM j _ 1 by inductive hypothesis and hence P by M j ::J Mi-l.

(b) Consider Cj, P a path through Qf not intersecting ci' Construct a path 1" throughQf-l as follows: Every literal occurrence i in Qf-I such that there is a new literaloccurrence Oi E P is included. Furthermore all Iitcral occurrences such that there isno new literal occurrence 01 in Qf, but l E P are also included. Then 1" does notintersect Ci and is therefore spanned by a pair (i,k) E .Mi-l' But then OI,Ok E P(neither necessarily new) and (Oi, Ok) E .Mj. Hence Pis spanned by .M j •

Assume Cj is the resolvent of ca j and Cbj

aj, bj < j. Define Qj = Qj-l and let .Mjk an occurrence of ..,lj in Cbj} '

Since Qi =Qj-l, Qj is a partial expansion tree proof for X. What remains to be shownis that Mi spans every path through Qf which does not intersect Ci, for all i ~ j. Fori < j this is obvious by the inductive hypothesis and the fact that M j ::J M j - 1 .

Now consider a path P through Qj not intersecting Cj' There are three cases:

[a] P does not intersect ca j ' By inductive hypothesis Mj-l c .Mj spans P.

(b) P does not intersect Cbi' By inductive hypothesis M j _ 1 C Mi spans P.

(c) P intersects both Ca, and Cbi' Since P does not intersect ci, P must intersectCa, in one of the literal occurrences Ii resolved upon, and Cbl in one of the literaloccurrences .li' But then .Mi spans P since (lb·li) E .Mi'

References

(1) Peter B. Andrews. Refutations by Matings. IEEE Transactions on Computers C·25 (1976).801-807.

(2) Peter B.Andrews. Transforming Matings into Natural Deduction Proofs. in 5th Conferenceon AutomatedDeduction. Les Arcs. France. edited by W. Bibel and R. Kowalski. LectureNotes in Computer Science 87. Springer-Verlag. 1980.281-292.

[3] Peter B.Andrews. Theorem Proving viaGeneral Matings, Journal ofthe Association forComputing Machinery 28 (1981). 193-214.

[4) Wolfgang Bibel, Automatic Theorem Proving. Vieweg. Braunschweig. 1982.

(5] W. Bibel and J. Schreiber. Proofsearch ina Gentzen-like system a/first-orderlogic.Proceedings of the International Computing Symposium. 1975.pp, 205-212.

(6] W. W. Bledsoe. Non-resolution Theorem Proving. ArtificiallntclIigence 9 (1977).1-35.

413

[7] G. Gentzen, Investigations into Logical Deductions. In The Collected Papersa/GerhardGentzen, M. E.Szabo, Ed.,North -Holland Publishing Co., Amsterdam, 1969, pp. 68-131.

[8] J. Herbrand, LogicalWritings, Harvard University Press. 1972.

[9] Dale A. Miller, Proofsin HigherOrderLogic,Ph.D. Th., Carnegie-Mellon University,August 1983.

[10] Dale A. Miller, Expansion Tree Proofs and TheirConversion to Natural DeductionProofs.7th Conference on Automated Deduction, Napa, May 1984.

[II] Frank Pfenning. Conversions between Analytic and Non-anal ytic Proofs. Tech. Report,Carnegie-Mellon University, 1984. (to appear)

[12] J. A. Robinson, A machine-oriented logicbasedon the resolution principle, Journal of theAssociation for Computing Machinery 12 (1965), 23-41.

[13] R. M. Smullyan, First-Order Logic. Springer-Verlag, Berlin, 1968.

[14] R. Statman, LowerBoundson Herbrand's Theorem, Proceedings of the AmericanMathematical Society 75 (1979),104'107.