the taming of the cut. classical refutations with analytic cut

The Taming of the Cut. ClassicalRefutations with Analytic Cut

MARCELLO D’AGOSTINO, Department of Computing, Imperial College,180 Queen’s Gate, London SW7 2BZ, UK.E-mail: [email protected]

MARCO MONDADORI, Istituto di Discipline Filosofiche, Universita diFerrara, via Savonarola 38, 44100 Ferrara, Italy.E-mail: [email protected]

AbstractThe method of analytic tableaux is a direct descendant of Gentzen’s cut-free sequent calculus and is regarded as a paradigmof the notion of analytic deduction in classical logic. However, cut-free systems are anomalous from the proof-theoretical,the semantical and the computational point of view. Firstly, they cannot represent the use of auxiliary lemmas in proofs.Secondly, they cannot express the bivalence of classical logic. Thirdly, they are extremely inefficient, as is emphasizedby the ‘computational scandal’ that such systemscannot polynomially simulate the truth-tables. None of these anomaliesoccurs if the cut rule is allowed. This raises the problem of formulating a proof system which incorporates a cut rule andyet can provide a suitable model of classical analytic deduction. For this purpose we present an alternative refutationsystem for classical logic, that we callKE. This system, though being ‘close’ to Smullyan’s tableau method, is notcut-freebut includes a classical cut rule which isnot eliminable. Analytic deductions are then obtained by restricting the cut ruleto analyticapplications, namely applications that do not violate the subformula principle. It turns out that this analyticrestriction of theKE system shares all the interesting properties of Smullyan’stableau method and of cut-free systems —it obeys the subformula principle and admitssystematicrefutation procedures — but uniformly and essentially improveson them from the complexity viewpoint. In particular, we show that the analyticKE system linearly simulates the tableaumethod, but the tableau method cannotp-simulate the analyticKE system. Finally, we show thateveryproof systemthat can simulate the cut rule in a constant number of steps isstrictly more powerful than cut-free systems, from thecomplexity viewpoint, even in the domain ofanalyticdeduction. Hence, the speed-up of the analyticKE system doesnot depend on the form of the operational rules but only on theanalytic cut rule.

Keywords: Analytic deduction, tableaux, complexity, cut rule.

1 The dilemma of ATP

The method of analytic tableaux is a direct descendant of Gentzen’s cut-free sequent calculusand is regarded as a paradigm of the notion of analytic deduction in classical logic. Moreover,it is today receiving considerable attention in the area of automated deduction as an alternativeto resolution which does not require reduction into clausalform. In particular, it is commonlyassumed that:

1. the tableau method provides an adequate formal model of classical deductions;

2. it reflects closely the semantics of classical logic;

3. it is well-suited to computational treatment.

In this paper we defy these assumptions and point out three basic anomalies which affectSmullyan’s analytic tableaux (and Gentzen’s cut-free sequent calculus) from the proof-theoretical,

J. Logic Computat., Vol. 4 No. 3, pp. 285–319 1994 c© Oxford University Press

286 The Taming of the Cut. Classical Refutations with Analytic Cut

the semantical and the computational point of view. We traceback all these anomalies to whatis usually considered the main merit of analytic tableaux, namely to their beingcut-free: cutscannot be eliminated without highly undesirable side-effects.

It is commonly argued, however, that introducing the cut rule would destroy theanalyticcharacter of proofs which would no longer obey thesubformula principle. So theirdiscoverywould become extremely difficult, and the resulting system would not be suitable for algorithmicpurposes. The set of formulae to which the cut rule can be applied coincides with the totalityof the formulae. Thus the introduction of cut among the ruleswould result in an uncontrollablesearch space. We seem, then, to be faced with adilemma: either we disallow the cut rule andtolerate the anomalies of cut-free proofs, or we allow the cut rule and give up the analytic propertyof deductions, so making any systematic search for proofs impossible. We argue that this is afalse dilemma which depends on a long-lasting dogma of proof-theory, namely the dogma thatGentzen’s formalization of analytic deduction in terms ofcut-freeproofs provides a definitiveparadigm. In fact, as Smullyan once remarked, ‘the real importance of cut-free proofs is notthe elimination of cuts per se, but rather that such proofs obey the subformula principle.’1 Thesubformula principle does not require theeliminationof cuts. It is sufficient that the applicationsof the cut rule are restricted to subformulae, i.e. only ‘analytic’ cuts are allowed. Apart fromSmullyan’s short paper cited above, however, the proof-theory of suchanalytic cutsystems, hasnot been adequately studied, and the same is true of their relative complexity.2 It turns outthat they are by no means equivalent to cut-free systems. Indeed, they significantly improve onthem both from the conceptual and from the computational viewpoint. From this vantage point,the traditional approach which identifies analytic deduction with cut-free proofs appears to bea logical overkill. The goal of this paper is to investigate the role of analytic cut in classicalproofs and present an alternative formalization of classical analytic deduction which avoids theconceptual and technical difficulties of the cut-free tradition.

After pointing out, in Section 2 the basic anomalies of cut-free systems, we address the prob-lem of formulating a refutation system for classical logic which is as close as possible to thetableau method but is not affected by its anomalies. For thispurpose, in Section 3 we presentan alternative refutation system for classical logic, thatwe call KE. This system, though being‘close’ to Smullyan’s tableau method, isnot cut-freebut incorporates a form of classical cut whichis not eliminable. This cut rule has the form of a branching rule correspondingto the classicalprinciple of bivalence (which, as argued in Section 2, cannot be expressed properly in the standardtableau method). As a result of allowing the cut rule, the analysis of the logical operators doesnot require the standard branching rules of tableaux but canbe carried out entirely in terms oflinear rules. Analytic deductions are then obtained by restricting the cut rule toanalytic appli-cations, i.e. applications that do not violate the subformula principle. In Section 4 we show thatsuch analytic restriction ofKE is complete and outline a canonical refutation procedure whichhas the same ‘mechanical’ character as the usual tableau procedure. In Section 5 we discussthe relative complexity ofKE and prove some simulation and separation results. In particular,we show that the analytic restriction ofKE, while preserving all the interesting properties ofSmullyan’s tableaux and of cut-free systems — like the subformula principle and the possibilityof systematic refutation procedures —uniformly and essentiallyimproves on them from thecomplexity viewpoint: the analyticKE linearly simulates the tableau method but the tableaumethod cannot polynomially simulate the analyticKE. Moreover, in Section 6, we show that a

1[31], p. 560.2For an exception see [38].

The Taming of the Cut. Classical Refutations with Analytic Cut 287

similar result holds true foranysystem which satisfies a very general condition on the feasibilityof (analytic) cut inferences.

2 Three anomalies of Smullyan’s tableaux

If we construe Smullyan’s analytic tableaux as a formalization of the notion of a classicalrefutation, we are faced with three, apparently independent, anomalies. We shall call them‘the proof-theoretical anomaly’, the ‘semantical anomaly’ and ‘the computational anomaly’respectively. It turns out that these anomalies are all related and depend on a single aspect ofSmullyan’s system, namely on its beingcut-free.

2.1 The proof-theoretical anomaly

Tableau proofs lack an important property of ordinary proofs, that is the possibility of ‘nesting’subproofs one into the other. Suppose we want to proveA from assumptions inΓ; the proof mayturn out to be easier if we first prove an auxiliary ‘lemma’B and then showA as a corollary ofB.So we obtain a proof by combining two simpler proofs, ofB from Γ and ofA from Γ, B. Thisis nothing but the transitivity property of ordinary deductions. In a sense, tableau proofs satisfythis property: the cut-elimination theorem provides an effective procedure for obtaining the finalproof from the auxiliary ones. But in another sense they do not: ‘combining’ two proofs viacut-elimination is no easier than throwing them away and starting the main proof from scratch.In contrast, to model the use of auxiliary conclusions or lemmata, we need a ‘simple’ procedure.So, from this point of view, the notion of formal derivability based on the tableau method doesnot satisfy the transitivity principle. To put it with Boolos: ‘modus ponens, or cut, is obviouslya valid derived rule of standard natural deduction systems,butnot obviouslya valid derived ruleof the method of trees’[4, p. 373]. We shall now make this claim more precise.

What do we mean by a ‘simple’ procedure? First, it seems reasonable to require that theprocedure beuniform, that is, does not depend on the particular proofs we want to combine.Second, it should bepurely structural, that is, it should not depend on the meaning of anyparticular logical constant. Since transitivity is a structural property, which does not depend onthe meaning of any logical constant, it should be seen to be valid by virtue of structural propertiesonly. But this is not the case with the tableau method: the cut-elimination procedure heavilydepends on thegivenrules for the logical operators. Cut is not eliminable if other rules are takenas primitive.

Finally, it is natural to require that a ‘simple’ procedure for implementing the transitivity ofordinary proofs befeasible. Concatenation of proofs is feasible in the ordinary deductive practiceand should be feasible in any realistic formal model of this practice. We are, therefore, led toformulate the following condition which has to be satisfied by any acceptable formal model ofthe notion of a classical proof:

STRONG TRANSITIVITY PRINCIPLE (STP) Proof-concatenation should be feasible and uniform.More precisely, let|T | denote the size of the proofT (i.e. the number of steps in it). There mustbe a uniform, structural procedure, which, given a proofT1 of A from Γ1, B and a proofT2 ofB from Γ2, yields a proofT3 of A from Γ1, Γ2 such that|T3| = |T1|+ |T2| + c, for some fixedconstantc depending on the system.

In other words we require that the transitivity property be avalid derived rule in a particularlystrict sense. (In [12] D’Agostino discusses this stricter notion of a derived rule and its implications


on the complexity of proof systems.) The tableau method fails to satisfy our strong transitivityprinciple and so cannot be considered an adequate formalization of our intuitions about classicalproofs. Of course, as we have pointed out above, the tableau method satisfies aweak transitivityprinciple, which requires only a procedure to constructT3 out ofT1 andT2, without any furtherconstraints. This procedure is the cut-elimination procedure. Given a closed tableauT1 forΓ1, B,¬A (a proof ofA from Γ1, B), and a closed tableauT2 for Γ2,¬B (a proof ofB fromΓ2), we can apply the cut-elimination procedure to construct aclosed tableau forΓ1, Γ2,¬A(a proof ofA from Γ1, Γ2). However, this procedure is not uniform, it depends on the specificform of the tableau rules for the logical operators, and doesnot satisfy the complexity constraint:in general|T3| is not even bounded above by any polynomial of|T1| + |T2|. This means thatthere is at least one form of argument that cannot be expressed effectively by cut-free systems.Thus, cut-free systems, as such, cannot be taken as adequateformalizations of ordinary deductivepractice, for which the cut rule is essential.

The obvious objection to this argument sounds as follows: cut-free systems do not claim toprovide an adequate formal model foranykind of arguments that may occur in ordinary deductivepractice, but only for a particular subclass of these arguments — those that Gentzen calledanalytic— characterized by the subformula property. However, as we shall see, the traditional claim thatclassical analytic deduction is adequately represented bycut-free proofs is higly questionable. Weshall argue that the difference between analytic and non-analytic deductions is best representednot in terms of the presence or absence of the cut rule, but in terms of different types of cut.

2.2 The semantic anomaly

The truth-tables provide a definition of the meaning of the logical operators in terms of the truthand falsity of their operands, where the notions of truth andfalsity involved are the classical ones.These notion are governed by two basic principles:non-contradiction(no proposition can be trueand false at the same time) andbivalence(every proposition is either true or false, and there areno other possibilities). It is commonly assumed that there is a close correspondence between thetableau method and classical semantics. Tableaux, in turn,are closely related to cut-free proofsin a certain version of the classical sequent calculus (Kleene’s G4 in [22], for the details see[32]). If we think of Gentzen’s sequent rules in semantic terms, and adopt the usual intepretation,namely defineΓ ⊢ ∆ as valid if and only if, for every modelM , at least one formula in∆ istrue inM whenever all formulae inΓ are true inM , it is easy to see that the sequent rules canbe read upside-down as rules for constructing a countermodel to the endsequent, exactly as thetableau rules. Moreover, these rules are nothing but the classical truth-table rules expressed asif-and-only-if clauses (‘A∨B is true if and only ifA is true orB is true’, etc.) But what is, then,the semantic counterpart of the cut-elimination theorem? The rule which theHauptsatzshows tobe eliminable is the cut rule:

Γ, A ⊢ ∆ Γ ⊢ ∆, A

Γ ⊢ ∆

If we read this rule upside-down, following the same semantic interpretation that we adopt forthe operational rules, then what the cut rule says is:

In all models and for all propositionsA, eitherA is true orA is false.

But this is the principle of bivalence, one of the twofundamentalprinciples which characterize theclassical notions of truth and falsity. While the principleof non-contradiction is clearly embodied


in the rule for closing a branch, there is no rule in the tableau method (and in cut-free Gentzensystems) which corresponds to the principle of bivalence. While enumerating all the possiblecases, the tableau rules allow for the possibility of a proposition’s being something else other thantrue or false.3

2.3 The computational anomaly

It has been well-known since the origins of the studies on therelative complexity of proof systemsthat there are classes of propositional formulae whose shortest proofs in a cut-free system, likeSmullyan’s analytic tableaux, are significantly longer than their shortest proofs in systems, likenatural deduction or Hilbert-style axiomatic systems, that allow for some form of cut. (The firstproof of this fact was provided by [33], although it could already be read off some of the resultsreported in [10]. A discussion of the speed-up of unrestricted natural deduction over cut-freesystems, with reference to a class of first-order formulae, is contained in [4]. For further resultssee [36].) However, one might think (with some right) that that alleged speed-up of cut proofsover cut-free proofs is irrelevant from the point of view of automated deduction.

As stated by Fitting [18, pp. 93–94]:

An obvious problem with Hilbert systems, and with natural deduction systems as well, is that while a tautologymay have a short proof, it may not be easy to find one. In a Hilbert system a short proof ofY may beginwith short proofs ofX andX ⊃ Y , followed by an application of Modus Ponens. One can think ofX andX ⊃ Y as Lemmas for the proof ofY . But finding an appropriate formulaX when given the task of provingY , may be non-trivial. And certainlyX ⊃ Y is more complicated thanY so for a portion of the proof, formulacomplexity goes up instead of down. Consequently most attempts at automated theorem proving have reliedon mechanisms that build proofs entirely out of parts of the formula being proved, and do not require outsidelemmas. Both resolution and tableaux have this important property (called analytic in [30]).

For the same reasons, one might think that what we have called‘the proof-theoretical’ and the‘semantical’ anomalies are also totally irrelevant to the problem of mechanical proof. Tableau‘proofs’ do not satisfy our strong transitivity principle just because they enjoy thesubformulapropertywhich, on the other hand, is highly desirable for the formulation of mechanical proofprocedures. But is this an accurate picture? Here what we have called ‘the computationalanomaly’ comes into play. It takes the following, somewhat surprising, form: there are propo-sitional problems for which such a simple mechanical deviceas the truth-table method performsincomparably better (in a precise mathematical sense) thanSmullyan’s analytic tableaux. Infact, it can be shown thatanalytic tableaux cannot polynomially simulate the truth-table method.That a proof systemS2 polynomially simulates(orp-simulatesfor short) another proof systemS1

means, informally, that there is a function computable in polynomial time which maps every proofof a formulaA in S1 to a proof of the same formula inS2. Two proof-systems are consideredequally powerful, from the complexity viewpoint, if they can p-simulate each other. Of course,if S2 canp-simulateS1, then for every formulaA, the length of the shortestS2-proof ofA mustbe bounded above by a polynomial function of the length of theshortestS1-proof ofA. Thus, ifthere is an infinite setH of formulae withS1-proofs of sizeO(f(n)), and one can prove that thelength of their shortestS2-proofs cannot be bounded above by any polynomial function of f(n),then one can conclude thatS2 cannotp-simulateS1. (For the formal definitions and the resultingclassification see [10, 11, 37].)

The examples used in [13] to show the speed-up of the truth-tables over Smullyan’s tableauxare expressions in conjunctive normal form, defined as follows: given a sequence ofk atomic

3Indeed, the tableau rules are sound for some many-valued logics. The semantics of cut-free systems has been described interms of a 3-valued logic by Shutteand, more recently, by Girard. See the interesting discussion in [20]. See also [13].


variablesP1, . . . , Pk, consider all the possible clauses containing as members, for eachi =1, 2, . . . , k, eitherPi or ¬Pi and no other member. There are2k of such clauses. LetHP1,...,Pk

denote the set containing these2k clauses. The expression∧

HP1,...,Pkis unsatisfiable. For

instance,∧

HP1,P2is the following expression in CNF:

(P1 ∨ P2) ∧ (P1 ∨ ¬P2) ∧ (¬P1 ∨ P2) ∧ (¬P1 ∨ ¬P2).

Notice that in this case the truth-table procedure containsas many rows as clauses in the expres-sions, namely2k. In other words, this class of expressions is not ‘hard’ for the truth-table method.However it can be shown (see [13]) that it is hard for the tableau method. More precisely, letC(k) be the number ofinterior (i.e. non-leaf) nodes in aminimalclosed tableau forHP1,...,Pk

.Then, a simple analysis shows thatC(k) is determined exactly by the following equation:

C(k) = k + k · (k − 1) + k · (k − 1)(k − 2) + . . . + k · (k − 1) · . . . · (k − (k − 1))

= k! · (1 +1

2!+

1

3!+ · · · +

1

k!)

Sincek! grows faster than any polynomial function of2k, and there are2k rows in the truth-tableanalysis4 of HP1,...,Pk

, this is sufficient to prove:

PROPOSITION2.1Analytic tableaux cannotp-simulate the truth-table method.

For a proof and a discussion see [13]. Notice that forHP1,...,Pkthere are resolution refutations

in which the number of steps is linear in the number of clauses.This unexpected separation result fills a gap in the classification of conventional proof systems

in terms of thep-simulation relationship. Since the truth-tables obviously cannotp-simulatethe tableau method, we can conclude that the truth-tables and Smullyan’s analytic tableaux areincomparable proof systems.5

One immediate consequence of this result is that analytic tableaux do not even provide, atleast in their ‘pure’ form given them by Smullyan, auniform improvement on the truth-tablemethod as far as computational complexity is concerned. This anomaly appears to be muchmore compelling than the well-known speed-up of the sequentcalculus with cut over the sequentcalculus without cut. It is something of a ‘computational scandal’ that the cut-free system (andthe tableau method) should be, in some cases, so embarassingly outperformed by such a simpleandmechanicaldevice as the truth-table method. Moreover, the latter is nothing but a directimplementation of the very semantic definition of logical truth. Therefore, the result expressed inProposition 2.1 clearly brings out the computational content of the ‘semantic anomaly’ discussedabove, namely the discrepancy between the tableau rules andtheir intended semantics.

We relate this anomaly to a basic inadequacy of the tableau branching rules — and in general ofthe rules formulated in the tradition of Gentzen’s (cut-free) sequent calculus — which, as arguedabove, do not capture the essentials of classical semantics.

The elimination of bivalence from tableau proofs has the undesired effect that the possiblecases enumerated in the tableau analysis arenot mutually exclusive. When applying the typicaltableau branching rules:

4To be precise, the truth-table analysis involvesO(k · n · 2k) steps, wheren is the total number of occurrences of atomic letters and operators in the CNFexpression, which isO(k · 2k), so that the overall complexity isO(k2 · 22k).

5As Alasdair Urquhart has pointed out, this appears to be the only known example of such an incomparability among conventional proof-systems.


A ∨ B

A�� AA

B

A → B

¬A�� TT

B

¬(A ∧ B)

¬A�� TT

¬B

or

L1 ∨ . . . ∨ Ln

L1 · · ·�� @@

· · · Ln

for expressions in clausal form, it is obvious that the branches do not represent mutually incon-sistent alternatives. As a result, when expanding the tree,one may (and very often do) end upconsidering more cases than is necessary. For instance, after applying the rule for analysingA∨B, while expanding the tableau belowB one may have to consider possible models in whichA is true. But all these possible models are also enumerated below A, so that the enumerationprocess is redundant. On the other hand, bivalence is clearly incorporated in the truth-tableanalysis where all the possible assignments are mutually exclusive.

The situation is best illustrated as follows: let� be the partial ordering of the nodes of a tableauT , andl the labelling function ofT (namely for every noden, l(n) yields the formula whichlabelsn). Let us now define, for every noden:

∆n = {A : l(m) = A and m � n}.

In other words∆n is the set of all formulae which occur aboven in the same branch. Thus, inthe development of a tableau, every noden occurring in an open branch defines a set∆n whichmay or may not be expandable into a Hintikka (i.e. downward saturated) set. We have, of course,that for all nodesn, m

n � m implies ∆n ⊆ ∆m. (2.1)

It would be reasonable to require that theconversealso hold, namely

n 6� m implies ∆n 6⊆ ∆m (2.2)

so that nodes in different branches (i.e. nodesn, m such thatn 6� m andm 6� n) are associatedwith incomparable expansions of the input set (i.e. such that ∆n 6⊆ ∆m and ∆m 6⊆ ∆n).However, the tableau rules do not satisfy the simple non-redundancy condition in (2.2) and,therefore, lead to a very redundant enumeration of the possible cases. The reader can easilycheck that the failure of satisfying condition (2.2) is at the origin of the combinatorial explosionof analytic tableaux in the hard examples mentioned above. This kind of redundancy has beenoccasionally noticed, and several proof-engineering techniques have been proposed to avoid it(see below, Section 5.4). In the sequel we shall illustrate how this computational anomaly, aswell as the others, can be dealt with in proof-theoretical terms by reconsidering the role of the cutrule in analytic deductions.

3 The system KE

The discussion in the previous section leaves us with the following problem:


PROBLEM 3.1Is there a refutation system which, though being ‘close’ to the tableau method, is not affected bythe anomalies of cut-free systems?

Observe that the non-redundancy condition in (2.2) is obviously fulfilled by any tree-methodsatisfying the stronger condition that distinct branches definemutually exclusivesituations, i.e.contain inconsistent sets of formulae. It is obvious that the simplest rule of the branching typewhich generates mutually inconsistent branches is a0-premiss rule, that we call PB, correspondingto the principle of bivalence:

PBTA

�� A

AAFA

A version for unsigned formulae can be obtained in the obvious way, as a 0-premiss branchingrule withA and¬A as alternative conclusions.

We could, of course, simply ‘throw in’ this rule, leaving thetableau rules unchanged. It iseasy to see that with this addition the tableau method is turned into a system which satisfies ourstrong transitivity principle and, therefore, overcomes what we have called ‘the proof-theoreticalproblem’. Moreover, the rule PB is nothing but a semantic reading of the cut rule as a principleof bivalence. Therefore, also the ‘semantic’ anomaly wouldbe solved. Furthermore, it is notdifficult, by using the above rule in conjunction with the usual tableau rules, to construct shortrefutations of our ‘hard examples’ described in the previous section. Indeed, any proof systemincluding a cut rule can polynomially simulate the truth-tables (see below, Section 5). Thus alsothe computational anomaly would be solved. However, such a ‘solution’ is not satisfactory. In thefirst place, it is clearlyad hoc. The tableau method is complete without the cut rule and it isnotclearwhensuch a rule should be used in a systematic refutation procedure. The ‘mechanics’ ofthe tableau method does not seem to accommodate the cut rule in any natural way. Secondly, thestandard branching rules do not satisfy our non-redundancycondition (2.2), which we identifiedas adesideratumfor a well-designed refutation system.

The above considerations suggest that in a well-designed tableau method: (a) the cut rule (PB)should not be redundant and (b) it should be theonly branching rule. Thus, a good solution toProblem 3.1 may consist in overturning the cut-free tradition: instead of eliminating cuts fromproofs we assign the cut rule a central role and reformulate the elimination rules accordingly.

Given (a) and (b) above, Problem 3.1 reduces to the following:

PROBLEM 3.2Are there simple elimination rules of linear type which combined with PB yield a refutationsystem for classical logic?

However, since a0-premiss rule like PB can introduce arbitrary formulae, we need also to solve:

PROBLEM 3.3Can we restrict ourselves toanalytic applications of PB, i.e. applications which do not violatethe subformula property, without affecting completeness?

Furthermore, if Problem 3.3 has a positive solution, we shall be anyway left with a large choiceof formulae as potential conclusions of an application of PB(let us call themPB-formulae). This


may be a problem for the development of systematic refutation procedures. Thus we have toaddress also the following:

PROBLEM 3.4Can we further restrict the set of potential PB-formulae so as to allow for simple systematicrefutation procedures, like the standard procedure for thetableau method?

In the sequel we shall see how all these problems have a simplepositive solution.To solve Problem 3.2 we need only to notice that the followingeleven facts hold true under

any Boolean valuation:

1. If A ∨ B is true andA is false, thenB is true.

2. If A ∨ B is true andB is false, thenA is true.

3. If A ∨ B is false then bothA andB are false.

4. If A ∧ B is false andA is true, thenB is false.

5. If A ∧ B is false andB is true, thenA is false.

6. If A ∧ B is true then bothA andB are true.

7. If A → B is true andA is true, thenB is true.

8. If A → B is true andB is false, thenA is false.

9. If A → B is false, thenA is true andB is false.

10. If ¬A is true, thenA is false.

11. If ¬A is false, thenA is true.

These facts can immediately be used to provide a set of expansion rules of the linear type which,with the addition of PB, constitute a complete set of rules for classical propositional logic.

These rules characterize the propositional fragment of thesystemKE (first proposed in [23, 24])and are shown below. Notice that those with two signed formulae below the line representa pairof expansion rules of the linear type, one for each signed formula.


Disjunction rules

TA ∨ BFATB

ET∨1

TA ∨ BFBTA

ET∨2

FA ∨ BFAFB

EF∨

Conjunction rules

FA ∧ BTAFB

EF∧1

FA ∧ BTBFA

EF∧2

TA ∧ BTATB

ET∧

Implication rules

TA → BTATB

ET →1

TA → BFBFA

ET →2

FA → BTAFB

EF →

Negation rules

T¬AFA

ET¬F¬ATA

EF¬

Principle of bivalence

T (A) F (A)PB

The rules involving the logical operators will be calledelimination rulesor E-rules.6

In contrast with the tableau rules for the same logical operators, the E-rules are all of the lineartype and arenot a complete set of rules for classical propositional logic. The reason is easy tosee. The E-rules, intended as ‘operational rules’ which govern our use of the logical operators,do not say anything about the bivalent structure of the intended models. If we add the rule PBas the only rule of the branching type, completeness is achieved. So PB isnot eliminablein thesystemKE. As pointed out in Section 2, there is a close correspondencebetween the semanticrule PB and the cut rule of the sequent calculus. We shall return to this point in Section 5.2.

We call an application of PB aPB-inferenceand the signed formulae which are the conclusionsof the PB-inferencePB-formulae. Finally, if TA andFA are the conclusions of a given PB-inference, we shall say that PB has been applied to the formulaA.

REMARK 3.5Notice that all the linear rules can be easily simulated by the tableau rules. This, of course, doesnot apply to PB.

6Quite independently, and with a different motivation, Cellucci [7] formulates the same set of rules (although he does not use signed formulae). Surprisingly,the two-premiss rules in the above list were already discovered by Chrysippus who claimed them to be the fundamental rules of reasoning (‘anapodeiktoi’), exceptthat disjunction was interpreted by him in an exclusive sense. Chrysippus also maintained that his ‘anapodeiktoi’ formed a complete set of inference rules (‘the

indemonstrables are those of which the Stoics say that they need no proof to be maintained. […] They envisage many indemonstrables but especially five, fromwhich it seems all others can be deduced’. See [2], pp.115–119 and [3], p.126).


DEFINITION 3.6Let S = {X1, . . . , Xm} be a set of signed formulae. ThenT is aKE-tree forS if there exists afinite sequence(T1, T2, . . . , Tn) such that (i)T1 is a one-branch tree consisting of the sequenceof X1, . . . , Xm; (ii) Tn = T , and (iii) for eachi < n, Ti+1 results fromTi by an application ofa rule ofKE.

DEFINITION 3.7

1. Given aKE-treeT of signed formulae, a branchφ of T is atomicallyclosedif for someatomic formulaP , bothTP andFP are inφ. Otherwise it isopen.

2. A KE-treeT of signed formulae isclosedif each branch ofT is closed. Otherwise it isopen.

3. A treeT is aKE-refutation ofS if T is a closedKE-tree forS.

4. A treeT is aKE-proof ofA from a setΓ of formulaeif T is aKE-refutation of{TB|B ∈∈} ∪ {FA}.

REMARK 3.8It is easy to prove that if a branchφ of T contains bothTA andFA for some non-atomic formulaA, φ can be extendedby means of the E-rules onlyto a branchφ′ which is atomically closed inthe sense of the previous definition. Hence, in what follows we shall consider a branch closed assoon as bothTA andFA appear in it, for an arbitrary formulaA.

REMARK 3.9If we impose the condition that the elimination rules have a linear format, i.e. they do not generatea branching in the tree, the E-rules ofKE are the only simple elimination rules which can beread off the truth-tables for the logical operators. On the other hand, PB expresses the bivalentcharacter of the underlying notion of truth, while the closure rule expresses the principle of non-contradiction. Therefore theKE rules are clearly rooted in the classical truth-tables. This is notthe case with the tableau rules which, as argued above, do notexpress the principle of bivalence.7

We can, of course, give a version ofKE which works with unsigned formulae. The rules areshown in Table 1. It is intended that all definitions be modified in the obvious way.

We can see from the unsigned version that the two-premise rules correspond to familiarprinciples of inference:modus ponens, modus tollens, disjunctive syllogismand the dual ofdisjunctive syllogism. ThusKE can be seen as a system of classical natural dedution usingelimination rules only. However, the classical operators are analysed as such and not as ‘stretched’versions of the constructive ones (like in [19] and [27]).

In Fig. 1 we give aKE-refutation (using unsigned formulae) and compare it with aminimaltableau for the same set of formulae; the reader can compare the different structure of the tworefutations and the crucial use of (the unsigned version of)PB to eliminate the redundancyexhibited by the tableau refutation. Notice that the thicker subtree in the tableau refutation isclearly redundant.

4 Completeness of KE

The completeness ofKE can be shown in several ways. One is by proving that the set ofKE-theorems includes some standard set of axioms for propositional logic and is closed undermodusponens.

7This does not mean, however, that theKE-rules are unsuitable for non classical logics. In fact, theclassical signs can be used in a non-standard interpretationin order to yield appropriate rules for a variety of non-classical logics. For many-valued logics see [21]. For substructural logics see [14].


Disjunction rules

A ∨ B

¬A

BE∨1

A ∨ B

¬B

AE∨2

¬(A ∨ B)

¬A

¬B

E¬∨

Conjunction rules

¬(A ∧ B)A

¬BE¬∧1

¬(A ∧ B)B

¬AE¬∧2

A ∧ B

A

B

E∧

Implication rules

A → B

A

BE→1

A → B

¬B

¬AE→2

¬(A → B)

A

¬B

E¬ →

Negation rule

¬¬A

AE¬¬

Principle of bivalence

A ¬APB

TABLE 1. KE rules for unsigned formulae.

PROPOSITION4.1If A is a valid formula than there is aKE-proof ofA.

This is an immediate consequence of the following facts which, at the same time, provideexamples ofKE-refutations (we write just⊢ for ⊢KE):

FACT 4.2⊢ A → (B → A)

FA → (B → A)TAFB → ATBFA×

FACT 4.3⊢ (A → (B → C)) → ((A → B) → (A → C))


A ∨ B

A ∨ ¬B

¬A ∨ C

¬A ∨ ¬C

A

¬A

�� L

LLC

¬A

�� L

LL¬C

,,, l

ll

B

A

¬A

�� L

LLC

¬A

�� L

LL¬C

�� L

LL¬B

A ∨ B

A ∨ ¬B

¬A ∨ C

¬A ∨ ¬C

¬A

B

¬B

�� A

AA¬¬A

C

¬C

FIG. 1: A minimal tableau (on the left) and aKE-refutation (on the right) of{A ∨ B, A ∨ ¬B,¬A ∨ C,¬A ∨ ¬C} . The thick subtree in the tableau refutation is redundant

F (A → (B → C)) → ((A → B) → (A → C))TA → (B → C)F (A → B) → (A → C)TA → BFA → CTAFCTB → CFBTB×

FACT 4.4⊢ (¬B → ¬A) → (A → B)


F (¬B → ¬A) → (A → B)T¬B → ¬AFA → B

TAFB

T¬B | F¬BT¬A TBFA ××

FACT 4.5If ⊢ A and⊢ A → B, then⊢ B

PROOF. It follows from the hypothesis that there are refutationsT1 and T2, respectively, of{F (A)} and{F (A → B)}. Then the following tree:

FBTA → B | FA → BFA T2

T1

is a refutation of{FB}.

This kind of proof provides a simulation of a standard axiomatic system. In this simulationit is essential to apply the rule PB to formulae which are not subformulae of the theorem to beproved. We notice that such a simulation cannot be directly obtained by the tableau method,since it is non-analytic. This brings us back to our Problem 3.3 above: are such non-analyticapplications of PB necessary or can they be eliminated without loss of completeness? i.e. can werestrict ourselves toanalytic applications? Let us say that aKE-treeT for Γ is analytic if PBis applied inT only to (proper) subformulae of formulae inΓ. Let us callanalytic restrictionof KE the system in which the applications of PB are restricted to subformulae of the formulaeoccurring above in the same branch. So Problem 3.3 consists in asking: is the analytic restrictionof KE complete?

A positive answer to this question can be obtained by describing a systematic refutationprocedure for theKE-system in which the applications of PB are restricted to analytic ones. Thisprocedure, like the similar one for the standard tableau method, terminates either with a closedtree or with an open tree such that its open branches describecountermodels to the initial set offormulae.

It is convenient to use Smullyan’s unifying notation in order to reduce the number of cases tobe considered. This notation is summarized in the next two tables.

α α1 α2

TA ∧ B TA TBFA ∨ B FA FBFA → B TA FB

T¬A FA FAF¬A TA TA

β β1 β2

FA ∧ B FA FBTA ∨ B TA TBTA → B FA TB


So the E-rules ofKE can be ‘packed’ into the following three rules (whereβci , i = 1, 2 denotes

theconjugateof βi):

Rule Aαα1

α2

Rule B1ββc

1

β2

Rule B2ββc

2

β1

The rule A can be seen as a pair of branch-expansion rules, onewith conclusionα1 and the otherwith conclusionα2. In each application of the rules, the signed formulaeα andβ are calledmajor premises. In each application of rules B1 and B2 the signed formulaeβc

i , i = 1, 2, arecalledminor premises(rule A has no minor premise).

REMARK 4.6The unifying notation can be easily adapted to unsigned formulae: simply delete all the signs‘T ’ and replace all the signs ‘F ’ by ‘¬’. The ‘packed’ version of the rules then suggests a moreeconomical version ofKE for unsigned formulae whenβc

i is taken to denote thecomplementofβi defined as follows: thecomplementof anunsigned formulaA, is equal to¬B if A = B andto B if A = ¬B. In this version the rules E∨1, E∨2 and E→2 become:

A ∨ BAc

B

A ∨ BBc

A

A → BBc

Ac

This version is to be preferred for practical applications.

We now outline a simple refutation procedure forKE that we callthe canonical procedure.First we define some related notions.

DEFINITION 4.71. We say that a formula isE-analysedin a branchφ if either (i) it is of typeα and bothα1 and

α2 occur inφ; or (ii) it is of type β and the following are satisfied: (iia) ifβc1 occurs inφ,

thenβ2 occurs inφ; (iib) if βc2 occurs inφ, thenβ1 occurs inφ.

2. We say that a branch isE-completedif all the formulae occurring in it are E-analysed.

A branch which is E-completed is a branch in which the linear elimination rules ofKE havebeen applied in all possible ways. It may not be completed in the stronger sense of the followingdefinition.

DEFINITION 4.81. We say that a formula of typeβ is fulfilled in a branchφ if eitherβ1 or β2 occurs inφ.

2. We say that a branchφ is completedif it is E-completed and, moreover, every formula of typeβ occurring inφ is fulfilled.

3. We say that aKE-tree is completedif all its branches are completed.

PROCEDURE4.9Thecanonical procedure forKE starts from the one-branch tree consisting of the initial formulaeand applies theKE-rules until the resulting tree is either closed or completed. At each stage ofthe construction the following steps are performed:


1. select an open branchφ which is not yet completed (in the sense of Definition 4.8);

2. if φ is not E-completed, expandφ by means of the E-rules until it becomes E-completed;

3. if the resulting branchφ′ is neither closed nor completed then(a) select a formula of typeβ which is not yet fulfilled (in the in sense of Definition 4.8) inthe

branch;(b) apply PB withβ1 andβc

1 (or, equivalently,β2 andβc2) as PB-formulae and go to step 1.

otherwise, go to step 1.

PROPOSITION4.10The canonical procedure is complete.

PROOF. It is easy to see that the canonical procedure eventually yields aKE-tree which is eitherclosed or completed. The only crucial observation is that when one applies the rule PB asprescribed, withβi andβc

i as PB-formulae (withi equals 1 or 2 andβ a non-fulfilled formulaoccurring in the branch), then once the two resulting branches are E-completed as a result ofperforming step 2, each of them will contain eitherβ1 or β2. Therefore, eventually, each branchwill be either closed or completed. Since the formulae in a completed branch form a Hintikkaset, the completeness ofKE follows immediately via Hintikka’s lemma.

Of course, what we have called ‘the canonical procedure’ is not, strictly speaking, a completelydeterministic algorithm. Some steps involve a choice and different strategies for making thesechoices will lead to different algorithms. However, it describes a ‘mechanical version’ ofKEwhich is sufficient for our purpose of comparing it with the tableau method. We can look at it asas arestricted proof system, where the power of the cut rule is severely limited to allow for easyproof-search.8 The next three corollaries unfold the content of Proposition 4.10.

COROLLARY 4.11 (Analytic cut property)If S is unsatisfiable, then there is a closedKE-treeT ′ for S such that all the applications of PBpreserve the subformula property.

PROOF. All the PB-formulae involved in the canonical procedure are subformulae of formulaepreviously occurring in the branch.

Let us consider theanalytic restriction ofKE, i.e. the system obtained by restricting PB toanalytic applications. The above corollary says that the analytic restriction ofKE is complete.Since the elimination rules preserve the subformula property, the subformula principle followsimmediately. A constructive proof of the subformula principle, which yields a procedure fortransforming anyKE-proof in an equivalentKE-proof which enjoys the subformula property, isgiven in [24].

In fact the use of PB in the canonical procedure is even more restricted than it appears fromthe above corollary. Consider the following definition ofstrongly analyticapplication of PB.

DEFINITION 4.12An application of PB in a branchφ of a KE-tree isstrongly analyticif the PB-formulae of thisapplication areβi andβc

i for somei = 1, 2 and some non-fulfilled formula of typeβ occurringin φ. A KE-tree is strongly analyticif it contains only strongly analytic applications of PB.

All the applications of PB in the canonical procedure are strongly analytic. Thus, it follows fromthe completeness of the canonical procedure that:

8The reader should be aware that this is not theonly mechanical procedure and not necessarilythe best. In fact one of the advantages ofKE is that it can beused as a single proof-theoretical framework for a wide variety of proof-search strategies.


COROLLARY 4.13If S is unsatisfiable, then there is a closed strongly analyticKE-tree forS.

In other words, our argument establishes the completeness of the restricted system obtained byreplacing the ‘liberal’ version of PB with one which allows only strongly analytic applications.In general, analytic applications of PB do not need to be strongly analytic. The PB-formulae maywell be subformulae of some formula occurring above in the branch, and yet the application ofPB may not be strongly analytic. Therefore, Corollary 4.13 is stronger than Corollary 4.11. Onecan ask whether the strongly analytic restriction is as powerful, from the complexity viewpoint,as the analytic restriction. B. Beckert (personal communication) has recently conjectured that, infact, the strongly analytic restriction cannotp-simulate the analytic restriction and has exhibiteda class of formulae which admit polynomial size analytic proofs, but do not seem to admit anypolynomial size strongly analytic proof. These examples will be discussed in a subsequent work.

In fact, the canonical procedure imposes even more control on the applications of the cut-rulePB by requiring that it is applied on a branch only when the linear elimination rules are no furtherapplicable, i.e. when the branch is E-completed. This strategy avoids unnecessary branchingswhich may increase the size of proofs, very much like, in the standard tableau method, the basicstrategy consisting in applying theα-elimination rule before theβ-elimination rule, allows forslimmer tableaux.9 Such a stricter notion of an analyticKE-tree is captured by the followingdefinition:

DEFINITION 4.14An application ofPB in a branch φ is canonical if (i) it is strongly analytic, and (ii)φ isE-completed. AKE-tree is canonicalif all the applications of PB in it are canonical.

CanonicalKE-trees are exactly those which are generated by our canonical procedure describedabove. Hence:

COROLLARY 4.15If S is unsatisfiable, then there is a closed canonicalKE-tree forS.

The canonical procedure forKE is closely related to the Davis–Putnam procedure. This wasintroduced in 1960 [17] and later refined in [16]. It was meantas an efficient theorem provingmethod10 for (prenex normal form) first-order logic,but it was soon recognized that it combined anefficient test for truth-functional validity with a wasteful search through the Herbrand universe.11

This situation was later remedied by the emergence of unification. However, at the propositionallevel, the procedure is still considered among the most efficient, and is clearly connected withthe resolution method, so that Robinson’s resolution [28] can be viewed as a (non-deterministic)combination of the Davis–Putnam propositional module and unification, in a single inferencerule. It is not difficult to see that, if we extend our languageto deal with ‘generalized’ (n-ary) disjunctions and conjunctions, the Davis–Putnam procedure (in the version of [16] whichis also the one exposed in [9, Section 4.6] and in Fitting’s textbook [18, Section 4.4]), can berepresented as a special case of the canonical procedure forKE. So, from this point of view,the canonical procedure forKE provides a generalization of the Davis–Putnam procedure whichdoes not require reduction in clausal form. To see that the DPP is a special case of the canonical

9Since in our approachall the elimination rules are linear, it does not make any difference whether, in applying them, we give priority to formulaeof typeα

or β. Of course, one may describe a similar strategy for the standard tableau method, by giving priority toα-expansions orβ-expansions applied to formulaeβsuch that eitherβc

1or βc

2occurs above in the branch. In this way one of the branches of theβ-expansion closes immediately. In fact, it is much more natural to

describe such inferences in terms of theKE linear rules. But, when non-trivial branchings are involved, the tableau rules cannot simulate our PB-branchings.10The version given in [17] (like our canonical procedure outlined above) was not in fact a completely deterministic procedure: it involved the choice of which

literal to eliminate at each step. Such choices may crucially affect the complexity of the resulting refutation.11See [15].


procedure forKE observe that, if we restrict ourselves to formulae in clausal form, every branchin a canonicalKE-tree performs what essentially is aunit-resolutionrefutation [8]. On the otherhand, in this special case, PB corresponds to the splitting rule of the Davis–Putnam procedure(when represented in tree form, as in [9, Section 4.6] and in [18, Section 4.4]). All we need is togeneralize our language so as to includen-ary disjunctions, with arbitraryn, and modify the rulefor ∨-elimination in the obvious way.

Notice that the system resulting from this generalized version of KE by disallowing thebranching rule PB (so that all the rules are linear) includesunit resolution as aspecial case.This restricted version ofKE can then be seen as an extension of unit resolution (it is thereforea complete system for Horn-clauses, although it is not confined to formulae in clausal form).Although its scope largely exceeds that of unit resolution,the procedure is stillfeasibleas shownby Proposition 5.4 below.

In this paper we are concerned with propositional logic only. We just remark that an extensionof KE to first-order is trivially obtained by introducing the usual quantifier rules of the tableaumethod. In formulating a refutation procedure to be used in practical applications, Skolemfunctions, unification and other improvements can be employed exactly as with the standardtableau method. The reader is referred to [18] on this topic.Specific problems related to first-order logic (most interestingly to the use of function symbols in analytic deductions) will betreated in a subsequent paper.

5 The complexity of KE

In this section we discuss the complexity ofanalyticKE-refutations. We first show that, unlike thetableau method, the analyticKE system canp-simulate the truth-tables. Next we briefly discussthe complexity of proof-search in a hierarchy of subsystemsarising by allowing only a fixednumber of applications of the cut-rule (PB). Then we comparethe analytic, strongly analyticand canonical restrictions ofKE with other analytic proof systems (i.e. systems obeying thesubformula principle). Some systems of deduction — such as the tableau method and Gentzen’ssequent calculus without cut — yield only analytic proofs. Others — such as natural deduction,Gentzen’s sequent calculus with cut andKE— allow for a more general notion of proof whichincludes non-analytic proofs, although in all these cases the systems obtained by restricting thepotentially non-analytic rules to analytic applications are still complete. Since we are interested,for theoretical and practical reasons, in analytic proofs,we shall pay special attention to simulationprocedures which preserve the subformula property.

DEFINITION 5.1The lengthof a proofπ, denoted by|π|, is the total number of symbols occurring inπ (intendedas a string).

Theλ-complexity, of π, denoted byλ(π), is thenumber of linesin the proofπ (each ‘line’being a sequent, a formula, or any other expression associated with an inference step, dependingon the system under consideration). Finally, theρ-complexityof π, denoted byρ(π), is the length(total number of symbols) of a line of maximal length occurring inπ.

Our complexity measures are obviously connected by the relation

|π| ≤ λ(π) · ρ(π).

Now, observe that theλ-measure is sufficient to establish negative results about the p-simulationrelation, but is not sufficient in general for positive results. It may, however, be adequate


also for positive results whenever one can show that theρ-measure (the length of lines) is notsignificantly increased by the simulation procedure under consideration. All the procedures thatwe shall consider in the sequel will be of this kind. So we shall forget about theρ-measure andidentify the complexity of a proof system with theλ-measure.

As said before, we are interested in the complexity not of proofs in general but ofanalyticproofs. We shall then speak of theanalytic restrictionof a system when the rules are restricted toapplications which preserve the subformula property.

Notice that the analytic restrictions of Gentzen’s sequentcalculus and natural deduction arestrictly more powerful than the cut-free sequent calculus and normal natural deduction respec-tively. For instance, the analytic restriction of the sequent calculus allows cuts provided they arerestricted to subformule.

In what follows we shall consider the version ofKE which usesunsignedformulae.

5.1 KE and the truth-tables

The complexity of the truth-table procedure for a given formulaA is sometimes measured by thenumber of rows in the complete truth-table for that formula,i.e. 2k, wherek is the number ofdistinct atomic formulae inA. In fact, a better way of measuring the complexity of the truth-tablestakes into account also thelengthof the formula to be tested. In any case, it is important to noticethat the complexity of the truth-table procedure isnot alwaysexponential in the length of theformula. It is so only when the number of distinct atoms approaches the length of the formula.On the contrary, the complexity of tableau proofs depends more crucially on the length of theformula. Therefore, there might be (and in fact there are, aspointed out in Section 2 above)examples which are ‘easy’ for the truth-tables and ‘hard’ for the tableau method. We describedthis situation as unnatural. We can turn these considerations into a positive criterion and requirethat a well-designed proof system should be able, at least, to p-simulate the truth-tables, i.e. themost basic semantical and computational characterizationof classical propositional logic.

DEFINITION 5.2Let us say that a proof system isstandard if its complexity isO(nc · 2k), wheren is the lengthof the input formula,c is a fixed constant andk the number of distinct variables occurring in it.

The above definition requires that the complexity of the truth-table method be an upper bound onthe complexity of an acceptable proof system.

PROPOSITION5.3The analytic restriction ofKE is a standard proof system. In fact, for every tautologyA oflengthn and containingk distinct variables, there is aKE-refutationT of ¬A with λ(T ) =O(λ(T )) = O(n · 2k).

PROOF. [Sketched]There is an easyKE-simulation of the truth-table procedure. First apply PB toall atomic letters on each branch. This generates a tree with2k branches. Then each branch canbe closed by means of aKE-tree of linear size. (Hint: each truth-table rule can be simulated in afixed number of steps.) Notice that the applications of PB required for the proof, though analytic,are not strongly analytic.

It is easy to show that the task of E-completing a branch is computationally easy:

PROPOSITION5.4Let φ be a branch containingm nodes, each of which is an occurence of a formula of degreedm.The task of E-completing a branchφ (i.e. saturating it under theKE elimination rules) can be


performed in polynomial time, more precisely in timeO(n2) wheren =∑

m∈φ dm.

PROOF. The proposition trivially follows from the fact that the E-rules have the subformulaproperty and there are no more thatn distinct subformulae of the formulae inφ. It is not difficultto see that at mostO(n2) pattern matchings need to be performed.

Therefore, the complexity of a tautology depends entirely on the number of PB-branchingswhich are required in order to complete the tree. Let us callKE(k) the system obtained fromKE by allowing at mostk nestedanalytic applications of the cut-rule. We have just shown thatKE(0) has a decision procedure which runs in timeO(n2). The set for whichKE(0) is completeincludes the Horn-clause fragment of propositional logic.(HoweverKE(0) is not restricted toclausal form logic.) Moreover, it is not difficult to show that:

PROPOSITION5.5For every fixedk, KE(k) has a polynomial time decision procedure.

The proof is left to the reader. (Hint: in anyKE(k)-tree there are at most2k − 1 applications ofPB. Letn be the length of the initial set of formulae. There are at mostn distinct subformulae ofthe initial formulae and, therefore, at mostn(2k

−1) possible arrangements of the PB-applications.Recall thatk is a fixed constant and the task of E-completing a branch can beperformed inpolynomial time.)

It is obvious that the set of tautologies for whichKE(k) is complete tends to TAUT, the setof all the tautologies, ask tends to infinity. The crucial point is that low-degree cut-boundedsystems are powerful enough for a wide range of applications. In a subsequent paper we shallinvestigate this sequence of cut-bounded logics. Notice that in our approach, the source of thecomplexity of proving a tautology in the system is clearly identified, and quite large fragmentsof classical logic can be covered with a very limited number of applications of the branching rulePB. (Even with no applications of PB, most of the ‘textbook examples’ can be proved.) Nothingsimilar applies to the tableau method, where the fragments obtained by limiting the applicationof the branching rules are extremely weak.

5.2 KE versus the tableau method

First we notice that, given a tableau refutationT of Γ we can effectively construct astronglyanalyticKE-refutationT ′ of Γ which is not essentially longer.

PROPOSITION5.6If there is a tableau proofT of A from Γ, then there is astrongly analyticKE-proof T ′ of Afrom Γ such thatλ(T ′) ≤ 2λ(T ).

PROOF. Observe that the elimination rules ofKE, combined with PB, can easily simulate thebranching rules of the tableau method. For instance in the case of the branching rule foreliminating disjunctions either of the following two simulations can be used (all the other casesare similar):


A ∨ B

A�� L

LL¬A

B

or A ∨ B

B�� L

LL¬B

A

Notice that the applications of PB are strongly analytic. Such a simulation lengthens the originaltableau by one node for each application of a branching rule.Since the linear rules of thetableau method are also rules ofKE, it follows that there is aKE-refutationT ′ of Γ such thatλ(T ′) ≤ λ(T ) + k, wherek is the number of applications of branching rules inT . Sincek isobviously≤ λ(T ), thenλ(T ′) ≤ 2λ(T ).

It also follows from Proposition 5.6 and Proposition 5.4 that:

PROPOSITION5.7The canonical restriction ofKE p-simulates the tableau method.

We remark that, according to the above proposition, a particularly strong restriction ofKE,corresponding to a ‘mechanical procedure’, can easily simulate the tableau method.

Notice that theKE-simulation contains more information than the simulated tableau. In theKE-simulation of the branching rules, one of the branches contains a formula which does not occurin the corresponding branch of the tableau. These additional formulae never increase significantlythe size of refutations while, in many cases, can reduce it dramatically. The additional formulamay allow for the closure of branches that, in the simulated tableau, remain open and are closedonly after a long redundant computation. So, while all the tableau rules can be easily simulatedby means ofKE-rules,KE includes a rule, namely PB, which cannot be easily simulatedbymeans of the tableau rules. Although it is well-known that the addition of this rule to the tableaurules does not increase the stock of inferences that can be shown valid (since PB is classicallyvalid and the tableau method is classically complete), its absence, in some cases, is responsiblefor an explosive growth in the size of tableau proofs. In Section 2 we have already identified thesource of this combinatorial explosion. Here we discuss in some more detail the relation betweenthe inefficiency of the tableau rules and their failure to simulate ‘analytic cut’ inferences.

Suppose there is a tableau proof ofA from Γ, i.e. a closed tableauT1 for Γ,¬A and a tableauproof ofB from∆, A, i.e. a closed tableauT2 for ∆, A,¬B; then it follows from the eliminationtheorem (see [30]) that there is also a closed tableau forΓ, ∆,¬B. This fact can be seen as atypical ‘cut’ inference:

Γ ⊢ A∆, A ⊢ BΓ, ∆ ⊢ B

where ‘⊢’ stands for the tableau derivability relation. If the formula A is a subformula of someformula inΓ, ∆, or B the cut is ‘analytic’: no external formulae are involved. When a rule likePB is available, simulating this kind of ‘cut’ inference is relatively inexpensive in terms of proofsize as is shown by the diagram below:


Γ∆¬B

A

T2

�� TT¬A

T1

The above diagram shows thatKE satisfies thestrong transitivity principle(STP) formulated inSection 2. On the other hand if PB is not in the stock of rules, reproducing a cut inference (evenan analytic one) may be much harder. Let us assume, for instance, that¬A is used more thanonce, sayn times, inT1 to close a branch, so thatT1 containsn occurrences ofA in distinctbranches which will be left open if¬A is removed from the assumptions. Similarly, letA beused more than once, saym times, inT2 to close a branch, so thatT2 containsm occurrences of¬A in distinctbranches which will be left open ifA is removed from the assumptions. Then, insome cases, the shortest tableau refutation ofΓ, ∆,¬B will have one of the following two forms:

Γ∆¬BT1

A · · ·

T2

�� @@· · · A

T2

Γ∆¬BT2

¬A · · ·

T1

,, ll· · · ¬A

T1

where the subrefutationT2 is repeatedn times in the lefthand tree and the subrefutationT1 isrepeatedm times in the righthand tree. WhenA is a subformula of some formula inΓ, ∆,the ‘elimination of cuts’ from the tableau proof does not remove ‘impure’ inferences, involvingexternal formulae, but ‘pure’ analytic inferences, involving only elements contained in the data.

Because of this intrinsically inefficient way of dealing with analytic cut inferences, examplescan be found which require a great deal of duplication in the construction of a closed tableau.We have already discussed a class of hard examples in Section2 which are easy not only for(the canonical restriction of)KE but also for the truth-table method. By Proposition 2.1 above,the tableau method cannotp-simulate the truth-tables. Therefore, in spite of their similarity, theanalytic restriction ofKE is much more powerful than the tableau method, even in the domainof analytic deduction. This fact already follows from Proposition 2.1, Propositions 5.3 and 5.6.Moreover, it is not difficult to see that the class of hard examples for the tableau method usedin the proof of Proposition 2.1 is easy also for thecanonical restrictionof KE. Figure 2 showsa canonicalKE-refutation of the set of clausesHP1,P2,P3

. It is apparent that, in general, thenumber of branches in theKE-tree forHP1,...,Pk

, constructed according to the same pattern,is exactly2k−1 (which is the number of clauses in the expression divided by 2) and that therefutation trees have sizeO(k · 2k).

This is sufficient to establish:PROPOSITION5.8The tableau method cannotp-simulate the canonical restriction ofKE.

Propositions 5.7 and 5.8 taken together show that the canonical restriction ofKE is essentiallymore efficient than the tableau method. (We stress once againthat the canonical restriction is as‘mechanical’ as the tableau method.)


HP1,P2,P3

P1

P2 ∨ P3

P2 ∨ ¬P3

¬P2 ∨ P3

¬P2 ∨ ¬P3

P2

P3

¬P3

×

�� A

AA¬P2

P3

¬P3

×

�� @

@@¬P1

P2 ∨ P3

P2 ∨ ¬P3

¬P2 ∨ P3

¬P2 ∨ ¬P3

P2

P3

¬P3

×

�� A

AA¬P2

P3

¬P3

×

FIG. 2. A canonicalKE-refutation ofHP1,P2,P3

Another class of hard examples which is hard both for tableaux and for the truth-tables isdescribed in [10]: let

Hm = {±A1 ∨ ±A2± ∨ ±A3

±± ∨ . . . ∨ Am±...±}

where+A meansA and−A means¬A, and the subscript ofAi is a string ofi − 1 ‘+’s or‘−’s corresponding to the sequence of signs of the precedingAj , j < i. ThusHm contains2m disjunctions and2m − 1 distinct atomic letters. For instance,H2 = {A1 ∨ A2

+, A1 ∨∨A2

+,¬A1 ∨ A2−,¬A1 ∨ ¬A2

−}.In [10] Cook and Rechow report without proof a lower bound of22cm

on the number of nodesof a closed tableau for the conjunction of all disjunctions in Hm (a proof can be found in [26]).Moreover, since there are2m − 1 distinct atomic letters, this class of examples is hard alsoforthe truth-table method. In contrast, we can show that there are ‘easy’ canonicalKE-refutationsof Hm which contain2m + 2mm − 2 nodes. Such refutations have the following form: startwith Hm. This will be a set containingn(= 2m) disjunctions of whichn/2 start withA1 and


the remainingn/2 with its negation. Then apply PB to¬A1. This creates a branching with¬A1

in one branch and¬¬A1 in the other. Now, on the first branch, by means ofn/2 applicationsof the rule E∨1 we obtain a set of formulae which is of the same form asHm−1. Similarly onthe second branch we obtain another set of the same form asHm−1. By reiterating the sameprocedure we eventually produce a closed tree for the original setHm. It is easy to see that thenumber of nodes generated by the refutation can be calculated as follows (wheren is the numberof formulae inHm, namely2m):

λ(T ) = n +

log n−1∑

i=1

2i + n = n + 2 ·1 − 2log n−1

1 − 2+ n · (log n − 1)

= n + n logn − 2.

This result also shows that the truth-table method cannotp-simulateKE in non-trivial cases.12

Figure 3 shows theKE-refutation in the casem = 3.

REMARK 5.9This class of examples also illustrates an interesting phenomenon: while the complexity ofKE-refutations is not sensitive to the order in which the elimination rules are applied, it can be, incertain cases, highly sensitive to the choice of the PB formulae. If we make the ‘wrong’ choices,a combinatorial explosion may result when ‘short’ refutations are possible by making differentchoices. If, in Cook and Rechow’s examples, the rule PB is applied always to the ‘wrong’ atomicvariable, namely to the last one in each clause, it is not difficult to see that the size of the treebecomes exponential. To avoid this phenomenon an obvious criterion suggests itself from thestudy of this example, at least for the case in which the inputformulae are in clausal form. Weexpress it in the form of aheuristic principle:

HP Let φ be a branch to which none of the linearKE-rules is applicable. LetSφ be the set ofclauses occurring in the branchφ, and letP1, . . . , Pk be the list of all the atomic formulaeoccurring inSφ. LetNPI

be the number of clausesC such thatPI or¬Pi occurs inC. Thenapply PB to an atomPi such thatNPi

is maximal.

If this principle is applied, we can be sure that the ‘right’ PB-choices are always made.

A detailed study of proof-search in theKE-system will have to involve more sophisticatedcriteria for the choice of the PB-formulae. Here we just stress that, no matter how this choice ismade, the (canonical restriction of the)KE-system canneverperform significantly worse thanthe tableau method. This is a consequence of the fact that thesimulation of the tableau rules bymeans of theKE-rules is independent of the choice of the PB-formulae. On the other hand a goodchoice may sometimes be crucial for generating essentiallyshorter proofs than those generatedby the tableau method (sometimes it does not matter at all: the examples of Proposition 2.1 whichare ‘hard’ for the tableau method, are ‘easy’ for the canonical restriction ofKE no matter how thePB-formulae are chosen). In any case, our discussion shows that analytic cuts are often essentialfor the existence of short refutationswith the subformula property.13

12We mean that the exponential behaviour of the truth-tables in this case does not dependonlyon the large number of variables but also on the logical structure

of the expressions. So these examples are essentially different from the examples which are usually employed in textbooks to show that the truth-tables areintractable (a favourite one is the sequence of expressionsA ∨ ¬A whereA contains an increasing number of variables).13This can be taken as further evidence in support of Boolos’ plea for not eliminating cut [4]. (On this point, see also [25].) In that paper he gives a natural

example of a class of first order inference schemata which are‘hard’ for the tableau method while admitting ‘easy’ (non-analytic) natural deduction proofs.Boolos’ examples are a particularly clear illustration of the well-known fact that the elimination of cuts from proofs in a system in which cuts are eliminablecan greatly increase the complexity of proofs. (For a related technical result see [33].)KE provides an elegant solution to Boolos’ problem by making cut

non-eliminable while preserving the subformula property of proofs. Our discussion also shows that eliminatinganalytic cuts can result in a combinatorialexplosion.


H3

A1−

A2−

∨ A3−+

A2−

∨ ¬A3−+

¬A2−

∨ A3−−

¬A2−

∨ ¬A3−−

A2−

A3−+

¬A3−+

×

�� T

TT¬A2

−

A3−−

¬A3−−

×

,,, l

ll

¬A1

A2+

∨ A3++

A2+

∨ ¬A3++

¬A2+

∨ A3+−

¬A2+

∨ ¬A3+−

A2+

A3+−

¬A3+−

×

�� T

TT¬A2

+

A3++

¬A3++

×

FIG. 3. A KE-refutation ofH3

5.3 KE versus natural deduction

It can also be shown thatKE can linearly simulate natural deduction (in tree form). Moreoverthe simulation procedure preserves the subformula property. We shall sketch this procedure forthe natural deduction system given in [27], the procedure being similar for other formulations.

We want to give an effective proof of the following proposition (whereND stands for naturaldeduction):

PROPOSITION5.10If there is anND-proof T of A from Γ, then there is aKE-proof T ′ of A from Γ such thatλ(T ′) ≤ 3λ(T ) andT ′ contains only formulaeA such thatA occurs inT .

PROOF. By induction onλ(T ).If λ(T ) = 1, then theND-tree consists of only one node which is an assumption, sayC. ThecorrespondingKE-tree is the closed sequenceC,¬C.If λ(T ) = k, with k > 1, then there are several cases depending on which rule has been applied


in the last inference ofT . We shall consider only the cases in which the rule is elimination ofconjunction (E∧) and elimination of disjunction (E∨), and leave the others to the reader. If thelast rule applied inT is E∧, thenT has the form:

T =

∆

T1

A ∧ B

A

By inductive hypothesis there is aKE-refutationT ′1 of ∆,¬(A∧B) such thatλ(T ′

1 ) ≤ 3λ(T1).Then the followingKE-tree:

T ′ =

∆¬A

A ∧ B

A

×

�� S

SS¬(A ∧ B)

T ′1

is the requiredKE-proof and it is easy to verify thatλ(T ′) ≤ 3λ(T ).

If the last rule applied inT is the rule of elimination of disjunction, thenT has the form:

T =

∆1

T1

A ∨ B

∆2, [A]

T2

C

∆3, [B]

T3

C

C

By inductive hypothesis there areKE-refutationsT ′1 of ∆1,¬(A ∨ B), T ′

2 of ∆2, A,¬C, andT ′

3 of ∆3, B,¬C, such thatλ(T ′i ) ≤ 3λ(Ti), i = 1, 2, 3. Then the followingKE-tree:


T ′ =

∆1

∆2

∆3

¬C

A ∨ B

A

T ′2

�� L

LL¬A

B

T ′3

�� S

SS¬(A ∨ B)

T ′1

is the required proof and it is easy to verify thatλ(T ′) ≤ 3λ(T ).

5.4 KE and other refinements of analytic tableaux

The computational redundancy discussed in Section 2 is well-known to anybody who has workedwith Smullyan’s tableaux in the area of automated deduction. It is usually avoided by augmentingthe standard tableau rules with extra ‘control’ features which stop the expansion of redundantpaths in the tree or license the generation of ‘lemmas’ to be used in closing redundant branches.One consequence of the separation result in Proposition 2.1is that some correction of the tableaurules is not just a discretional ‘optimization’ step, but anecessary conditionfor a respectabletableau-like system.

The main ‘enhancements’ of Smullyan’s tableaux which are currently taken into considerationin the area of automated deduction are usually calledmergingandlemma generation(see [5, 21]).The technique called ‘merging’ can be easily defined in termsof our discussion of the redundancyof analytic tableaux. If for any two nodesn, m, such thatn 6� m (namelyn andm lie ondifferent branches), we have

∆n ⊆ ∆m

then one can stop pursuing the branch throughm without loss of completeness.On the other hand, it is easy to see that if merging is employed, the hard examples of Section

2.3 can be solved by tableaux of polynomial size. This is sufficient to establish the followingfact:

COROLLARY 5.11The standard tableau method cannot p-simulate the tableau method with merging.

Moreover, as discussed above in Section 2, the use of PB as a branching rule, instead of thestandard branching rules of tableaux, removes the redundancy of the tableau rules by making allthe branches in the tree mutually inconsistent. As a result,the redundant branches which arestopped via merging arenot generated in aKE-tree (see the example in Fig. 4). The exampleshows that the applications of PB required to simulate merging are strongly analytic. Theseconsiderations establish the following fact:


A ∨ B

A ∨ C

A

φ1

�� AAB

A

φ2

�� AAC

A ∨ B

A ∨ C

A�� TT

¬A

B

C

FIG. 4: In the tableau in the left-hand side the branchφ2 is not further expanded (it is ‘merged’with branchφ1). In the correspondingKE-tree shown in the right-hand side, the redundantbranch is not generated

PROPOSITION5.12The strongly analytic restriction ofKE linearly simulates the tableau method with merging.

Notice that the redundancy of the tableau method is avoided by the very nature of theKE-ruleswithout any need for externalad hocmoves.

What is usually called ‘lemma generation’ is equivalent to replacing the branching rules ofthe standard tableau method with corresponding asymmetricones. For instance, the rules foreliminating disjunction might have the following form:

A ∨ B

A�� AA

B

¬A

or A ∨ B

B�� AA

A

¬B

Again, it is not difficult to see that the hard examples of Section 2 have polynomial size refutationsif these asymmetric rules are employed.

COROLLARY 5.13The standard tableau method cannot p-simulate the tableau method with lemma generation.

Moreover, it is obvious that such asymmetric rules are equivalent to a combination of stronglyanalytic applications of PB and of theKE-elimination rules, as shown in the diagram used toillustrate Proposition 5.6 above. Hence:

PROPOSITION5.14The strongly analytic restriction ofKE linearly simulates the tableau method with lemma gener-ation.

It is misleading, however, to refer to tableaux with the asymmetric rules as to ‘tableaux withlemma generation’. The use of this terminology conveys the idea that the additional formula


appendend to one side of the branching rules is a ‘lemma’, namely that the sub-tableau below theother side is closed or may be closed. In contrast, tableau rules can be used also for enumeratingall the models of a satisfiable set of formulae, and not only for refuting unsatisfiable sets. In theformer case the sub-tableau in question may well be open, so that the appended formula is not a‘lemma’. The fact that we can append it without loss of soundness, does not depend on its beinga lemma, but merely on the principle of bivalence. In any case, the appended formula providesadditional information which can be used below to close every branch containing its complement.As a result, the enumeration of models is non-redundant, in the sense that it does not generatemodels which are subsumed one by the other, since all the models resulting from the enumerationare mutually exclusive.

Thus the strongly analytic restriction ofKE is sufficient to simulate efficiently the best knownenhancements of the tableau method, simply by making an appropriate use of the cut rule. Westress once again that theKE-system cannot be identified with its strongly analytic restriction.In fact, less restricted notions of proof may be more powerful from the complexity viewpointand still obey the subformula principle. We have mentioned Beckert’s examples (Section 3above) suggesting that the analytic restriction ofKE might be strictly more powerful than itsstrongly analytic restriction (therefore also than tableaux with merging and tableaux with lemmageneration) with respect to thep-simulation relationship.

6 A more general view

As seen in the previous section, the speed-up ofKE over the tableau method can be traced to thefact thatKE, unlike the tableau method, can easily simulate inference steps based on ‘cuts’, asin the example on p. 306. In other words, it satisfies our strong transitivity principle (STP), therequired procedure being the one described in the same section. Some formal systems (like thetableau method and the cut-free sequent calculus) do not satisfy the STP, some others satisfy itin a non-obvious way. Notice that the existence of a uniform procedure for grafting proofs ofsubsidiary conclusions orlemmata, in the proof of a theorem is just one condition of the STP.The other condition requires that such a procedure be computationally easy. In natural deduction,for instance, replacingevery occurrenceof an assumptionA with its proof provides an obviousgrafting method which, though very perspicuous, is highly inefficient, leading to much unwantedduplication in the resulting proof-tree. We also require the method to be also computationallyfeasible. So, the standard way of grafting proofs of subsidiary conclusions in natural deductionproofs, though providing a uniform method, does not satisfythe feasibility condition. The rules ofNatural Deduction, however, permit us to bypass this difficulty and produce a method satisfyingthe whole of STP. Consider the rule ofnon-constructive dilemma(NCD):

Γ, [A]···

B

∆, [¬A]···

B

B

This is a derived rule in Prawitz’s style natural deduction which yields classical logic if added tothe intuitionistically valid rules (see [35, section 4.5]). By ‘derived rule’ here we mean that everyapplication of NCD can be eliminated in a fixed number of steps(the expression ‘derived rule’ isoften used in the literature in a much more liberal sense), asshown by the following construction:


A ∨ ¬A

Γ, [A]···

B

∆, [¬A]···

B

B

(Notice thatA ∨ ¬A can always be proved in a fixed number of steps.)NCD is a classical version of the cut-rule. We can show that natural deduction satisfies the

STP by means of the following construction:

Γ, [A]···

B

∆···

A [¬A]

F

B

B

Notice that the construction does not depend on the number ofoccurrences of the assumptionAin the subproof ofB from Γ, A.

In analogy with the STP we can formulate a condition requiring a proof system to simulateefficiently another form of cut which holds for classical systems and is closely related to the rulePB:

(C) Let π1 be a proof ofB from Γ, A and π2 be a proof ofB from ∆,¬A. Then there isa uniform method for constructing fromπ1 andπ2 a proofπ3 of B from Γ, ∆ such thatλ(π3) ≤ λ(π1) + λ(π2) + c for some constantc.

Similarly, the next condition requires that proof systems can efficiently simulate theex falsoinference scheme:

(XF) Let π1 be a proof ofA from Γ andπ2 be a proof of¬A from ∆. Then there is a uniformmethod for constructing fromπ1 andπ2 a proofπ3 of B from Γ, ∆, for anyB, such thatλ(π3) ≤ λ(π1) + λ(π2) + c for some constantc.

So, let us say that a proof system is aclassical cut systemif (i) it is sound and complete forclassical logic, and (ii) it satisfies conditions (C) and (XF). It is easy to show that every classicalcut system satisfies also the STP and, therefore, allows for an efficient implementation of thetransitivity property of ordinary proofs. Notice that the definition of a classical cut system is verygeneral and does not assume anything about the form of the inference rules. For instance, asshown above, classical natural deduction in tree form is a classical cut system.

The next proposition shows thateveryclassical cut system can simulateKE without a significantincrease in proof complexity. The simulation procedure shows that the cut inferences are restrictedto formulae which occur in the simulated proof.

PROPOSITION6.1If S is a classical cut system, thenS can linearly simulateKE.

To prove the proposition it is convenient to assume that our language includes a0-ary operatorF(falsum) and that the proof systems include suitable rules to deal with it.14 For KE this involvesonly adding the obvious rule which allows us to appendF to any branch containing bothA and

14Systems which are not already defined over a language containing F can usually be redefined over such an extended language without difficulty.


¬A for some formulaA, so that every closed branch in aKE-tree ends with a node labelled withF . The assumption is made only for convenience’s sake and can be dropped without consequence.Moreover we shall make the obvious assumption that, for every systemS, the complexity of aproof ofA from A in S is equal to 1.

Let τ(π) denote the number of nodesgeneratedby aKE-refutationπ of Γ (i.e. the assumptionsare not counted).15 Let S be a classical cut system. IfS is complete, then for every ruler of KEthere is anS-proof πr of the conclusion ofr from its premises. Letb1 = Maxr(λ(πr)) andlet b2 andb3 be the constants representing, respectively, theλ-cost of simulating classical cut inS — associated with condition (C) above — and theλ-cost of simulating theex falsoinferencescheme inS — associated with condition (XF) above. As mentioned before, every classical cutsystem satisfies also condition STP and it is easy to verify that the constant associated with thiscondition, representing theλ-cost of simulating ‘absolute’ cut inS, is ≤ b2 + b3 + 1. We setc = b1 + b2 + b3 + 1.

The proposition is an immediate consequence of the following lemma:

LEMMA 6.2For every classical cut systemS, if there is aKE-refutationπ of Γ, then there is anS-proofπ′ ofF from Γ with λ(π′) ≤ c · τ(π).

PROOF. The proof is by induction onτ(π), whereπ is aKE-refutation ofΓ.τ(π) = 1. ThenΓ is explicitly inconsistent, i.e. contains a pair of complementary formulae,

sayB and¬B, and the only node generated by the refutation isF , which is obtained by meansof an application of theKE-rule forF to B and¬B. Since there is anS-proof of theKE-rule forF , we can obtain anS-proofπ′ of the particular application contained inπ simply by performingthe suitable substitutions andλ(π′) ≤ b1 < c.

τ(π) > 1. Case 1. TheKE-refutationπ has the form:

Γ

C

T1

whereC follows from premises inΓ by means of an E-rule. So there is aKE-refutationπ1 ofΓ, C such thatτ(π) = τ(π1) + 1. By inductive hypothesis, there is anS-proof π′

1 of F fromΓ, C such thatλ(π′

1) ≤ c · τ(π1). Moreover, there is anS-proofπ2 of C from the premises fromwhich it is inferred inπ such thatλ(π2) ≤ b1. So, from the hypothesis thatS is a classical cutsystem, it follows that there is anS-proofπ′ of F from Γ such that

λ(π′) ≤ c · τ(π1) + b1 + b2 + b3 + 1

≤ c · τ(π1) + c

≤ c · (τ(π1) + 1)

≤ c · τ(π)

Case 2.π has the following form:

15The reader should be aware that ourτ -measure applies toKE-refutations andnot to trees: the same tree can represent different refutationsyielding differentvalues of theτ -measure.


Γ

C

T1

�� L

LL¬C

T2

So there areKE-refutationsπ1 and π2 of Γ, C and Γ,¬C respectively such thatτ(π) =τ(π1) + τ(π2) + 2. Now, by inductive hypothesis there is anS-proofπ′

1 of F from Γ, C and anS-proofπ′

2 of F from Γ,¬C with λ(π′i) ≤ c · τ(πi), i = 1, 2. SinceS is a classical cut system,

it follows that there is anS-proofπ′ of F from Γ such that

λ(π′) ≤ c · τ(π1) + c · τ(π2) + b2

< c · τ(π1) + c · τ(π2) + c

< c · (τ(π1) + τ(π2) + 2)

< c · τ(π)

Notice that in the simulation used in the proof of the previous proposition the cut formulais always a formula which occurs in theKE-refutation. So, if the latter enjoys the subformulaproperty, its simulation in the cut system will be such that the cut formulae are all subformulae ofthe conclusion or of the assumptions. This holds true even ifthe proof as a whole does not enjoythe subformula property (for instance when the cut system inquestion is a Hilbert-style system).In fact, the simulation given above provides a means for transforming every proof-procedurebased on theKE-rules into a proof-procedure of comparable complexity based on the rules of thegiven cut system.

DEFINITION 6.3We say that a proof systemS is an analytic cut systemif (i) S is the analytic restriction of aclassical cut system, and (ii)S is complete for classical logic.

Then, the proof of Proposition 6.1 also shows that:

COROLLARY 6.4Every analytic cut system can linearly simulate the analytic restriction ofKE.

This implies that it is only the possibility of representing(analytic)cutsand not the form of theoperational ruleswhich is crucial from a complexity viewpoint.

It follows from the above corollary and Proposition 5.3 that:

COROLLARY 6.5Every analytic cut system is a standard proof system. In fact, for every tautologyA of lengthn

and containingk distinct variables there is a proofπ, with λ(π) = O(n · 2k).

Moreover, Corollary 6.4, Proposition 5.6 and Proposition 5.8 imply that:

COROLLARY 6.6Every analytic cut system can linearly simulate the tableaumethod, but the tableau method cannotp-simulate any analytic cut system.


Since (the classical version of) Prawitz’s style natural deduction is a classical cut system, it followsthat it can linearly simulateKE. Moreover, for all these systems, the simulation preservesthesubformula property (i.e. it maps analytic proofs to analytic proofs). Therefore Proposition 6.1,together with Proposition 5.10, imply that Prawitz’s stylenatural deduction andKE can linearlysimulate each other with a procedure which preserves the subformula property. Corollary 6.6implies that both these systems cannot bep-simulated by the tableau method, even if we restrictour attention to analytic proofs (the tableau method cannotp-simulate any analytic cut system).Finally Corollary 6.5 implies that, unlike the tableau method, the analytic restriction of both thesesystems have the sameupper boundas the truth-table method.

7 Conclusions

We have shown that the paradigm which identifies the subformula principle with theeliminationof cuts from proofs is affected by serious anomalies, both ofa conceptual and of a technical nature.On the other hand, proof systems which allow ‘analytic cuts’are free from such anomalies whilesharing all the desirable properties of cut-free systems. In this sense analytic cut systemssupersedecut-free systems as models of analytic deduction in classical logic. We have presented our ownimprovement of Smullyan’s analytic tableau, the systemKE, in which a suitably restricted useof the cut rule (PB), plays a crucial role in the formalization of classical analytic deduction. Onthe other hand, it is obvious that any more liberal use of the cut rule yields a proof system whichmay be more powerful. It may be asked whether this additionalinferential power ever leads to asignificant complexity improvement, that is whether more liberal versions would lift the systemto a better complexity class in the classification of proof systems in terms of thep-simulationrelationship. Presently a positive answer can be given onlyfor the case of the totally unrestrictedversion of the rule. In this case the resultingKE-system is equivalent to the sequent calculus withunrestricted cut. It can be shown that there are classes of formulae, including those encoding theso-called ‘pigeon-hole principle’, that have polynomial size proofs in the unrestrictedKE-system(as a consequence of a result of Buss [6]) and no polynomial size proof if the rule PB is restrictedto subformulae of the theorem (as a consequence of a result byAjtai [1] implying that there areno polynomial size proofs of the pigeon-hole principle if the cut formulae are of bounded depth,i.e. with a bounded number of alternations of∨ and∧). However, it is obvious that the lack ofcontrol resulting from a totally unrestricted use of PB would make it useless from the point ofview of implementation. It is an open problem whether between the totally unrestricted versionof PB, and the very restricted one which we called ‘canonical’, there is room for a more liberal,yet ‘analytic’, version which is strictly more powerful in terms of thep-simulation relationship.16

Acknowledgements

We wish to thank Alasdair Urquhart for important suggestions. We also thank Krysia Broda andRoy Dyckhoff for useful comments on an earlier version. Thisresearch was supported in part byCNR grant 92.04034.ct08 and by MURST (40% 1992).

References[1] M. Ajtai. The complexity of the pigeonhole principle. InProceedings of the 29th Annual Symposium on the

16As mentioned above, B.Beckert has found examples (to be discussed in a future work) which seem to imply that the strongly analytic restriction — andafortiori the canonical restriction — ofKE cannotp-simulate the analytic restriction.


Foundations of Computer Science, 1988. Preliminary version.

[2] R. Blanche.La logique et son histoire. Armand Colin, Paris, 1970.

[3] I. M. Bochensky.A History of Formal Logic. University of Notre Dame, Notre Dame (Indiana), 1961.

[4] G. Boolos. Don’t eliminate cut.Journal of Philosophical Logic, 7, 373–378, 1984.

[5] K. Broda. The Application of Semantic Tableaux with Unification to Automated Deduction. PhD thesis, Technicalreport, Department of Computing, Imperial College, 1991.

[6] S. R. Buss. Polynomial size proofs of the pigeon-hole principle.The Journal of Symbolic Logic, 52, 916–927, 1987.

[7] C. Cellucci. Using full first order logic as a programminglanguage. InRendiconti del Seminario MatematicoUniversita e Politecnico di Torino. Fascicolo Speciale 1987. Proceedings of the conference on ‘Logic and ComputerScience: New Trends and Applications’, pp. 115–152, 1987.

[8] C. L. Chang. The unit proof and the input proof in theorem proving. Journal of the Association for ComputingMachinery, 17, 698–707, 1970.

[9] C. L Chang and R. C. T. Lee.Symbolic Logic and Mechanical Theorem Proving. Academic Press, Boston, 1973.

[10] S. A. Cook and R. Reckhow. On the length of proofs in the propositional calculus. InProceedings of the 6th AnnualSymposium on the Theory of Computing, pp. 135–148, 1974.

[11] S. A. Cook and R. Reckhow. The relative efficiency of propositional proof systems.The Journal of Symbolic Logic,44, 36–50, 1979.

[12] M. D’Agostino. Proper derived rules and the relative complexity of formal proofs. InNuovi Problemi della Logicae della Filosofia della Scienza. CLUEB, Bologna, 1991. Proceedings of the SILFS Symposium, Viareggio, pp.275–282, 1990.

[13] M. D’Agostino. Are tableaux an improvement on truth-tables? Journal of Logic, Language and Information, 1,235–252, 1992.

[14] M. D’Agostino and D. Gabbay. Labelled refutation systems: a case study. Extended abstract. In D. Basin, R. Hahnle,B. Fronhofer, J. Posegga, and C. Schwind, editors,Proceedings of the Workshop on Theorem Proving with AnalyticTableaux and Related Methods, Marseille, France, April 28–30,1993, Max-Plank-Institut fur Informatik. TechnicalReport MPI-I-93-213, pp. 67–70, March 1993.

[15] M. Davis. The prehistory and early history of automated deduction. InAutomation of Reasoning, eds J. Siekmannand G. Wrightson, Springer-Verlag, New York, pp. 1–28, 1983.

[16] M. Davis, G. Logemann, and D. Loveland. A machine program for theorem proving.Communications of theAssociation for Computing Machinery, 5, 394–397, 1962. Reprinted inAutomation of Reasoning, eds J. Siekmannand G. Wrightson, Springer-Verlag, New York, pp. 267–270, 1983.

[17] M. Davis and H. Putnam. A computing procedure for quantification theory.Journal of the Association for ComputingMachinery, 7:201–215, 1960. Reprinted inAutomation of Reasoning, eds J. Siekmann and G. Wrightson, Springer-Verlag, New York, pp. 125–139, 1983.

[18] M. Fitting. First-Order Logic and Automated Theorem Proving. Springer-Verlag, Berlin, 1990.

[19] G. Gentzen. Unstersuchungen uber das logische Schliessen.Mathematische Zeitschrift, 39, 176–210, 1935. Englishtranslation in [34].

[20] I. Girard. Proof Theory and Logical Complexity. Bibliopolis, Napoli, 1987.

[21] R. Hahnle. Tableau-based Theorem-proving in Multiple-valued Logics. PhD thesis, Department of ComputerScience, University of Karlsruhe, 1992. Oxford UniversityPress, in press.

[22] S. C. Kleene.Mathematical Logic. John Wiley & Sons, Inc., New York, 1967.

[23] M. Mondadori. Classical analytical deduction. Annalidell’Universita di Ferrara; Sez. III; Discussion paper series 1,Universita di Ferrara, 1988.

[24] M. Mondadori. Classical analytical deduction, part II. Annali dell’Universita di Ferrara; Sez. III; Discussionpaperseries 5, Universita di Ferrara, 1988.

[25] M. Mondadori. A solution to a problem of Boolos. InNuovi problemi della logica e della filosofia della scienza.CLUEB, Bologna, 1991.Proceedings of the SILFS Symposium, Viareggio, pp. 313–319,1990.

[26] N. V. Murray and E. Rosenthal. On the computational intractability of analytic tableau methods. Technical ReportTR 92-1, Dept. of Computer Science, SUNY at Albany, 1992.

[27] D. Prawitz.Natural Deduction. A Proof-Theoretical Study. Almqvist & Wilksell, Uppsala, 1965.

[28] J. A. Robinson. A machine-oriented logic based on the resolution principle.Journal of the Association for ComputingMachinery, 12, 23–41, 1965.

[29] J. Siekman and G. Wrightson, eds.Automation of Reasoning. Springer-Verlag, New York, 1983.

[30] R. Smullyan.First-Order Logic. Springer, Berlin, 1968.


[31] R. M. Smullyan. Analytic cut.The Journal of Symbolic Logic, 33, 560–564, 1968.

[32] R. M. Smullyan. Uniform Gentzen systems.The Journal of Symbolic Logic, 33, 549–559, 1968.

[33] R. Statman. Bounds for proof-search and speed-up in thepredicate calculus.Annals of Mathematical Logic, 15,225–287, 1978.

[34] M. Szabo, ed.The Collected Papers of Gerhard Gentzen. North-Holland, Amsterdam, 1969.

[35] N. Tennant.Natural Logic. Edimburgh University Press, Edinburgh, 1978.

[36] A. Urquhart. The complexity of Gentzen systems for propositional logic.Theoretical Computer Science, 66, 87–97,1989.

[37] A. Urquhart. Complexity of proofs in classical propositional logic. In Logic from Computer Science,ed.Y. Moschovakis, Springer-Verlag, pp. 596–608. 1992.

[38] A. Urquhart. The relative complexity of resolution and cut-free Gentzen systems.Annals of Mathematics andArtificial Intelligence, 6, 157–168, 1992.

Received 14 February 1993

the taming of the cut. classical refutations with analytic cut

Documents