MathLabs

Foundations of mathematics

Predicate logic

Predicate logic extends propositional logic with quantifiers ∀x P(x)\forall x\, P(x) ("for all xx, P(x)P(x)") and ∃x P(x)\exists x\, P(x) ("there exists xx such that P(x)P(x)"), letting us formalize statements about every element or some element of a domain, and reason about them with Tarski's satisfaction semantics.

IntuitionFor all vs. there exists

"Every student in this room passed the exam" and "some student in this room passed the exam" are very different claims, even though both are about the same room. Predicate logic makes this precision explicit: a predicate P(x)P(x) is a property that becomes a true/false proposition once xx is filled in with a specific object from a domain (a universe of discourse) MM. The universal quantifier ∀x P(x)\forall x\, P(x) asserts PP holds for every object in MM; the existential quantifier ∃x P(x)\exists x\, P(x) asserts PP holds for at least one object in MM.

Interactive dependency graph between quantified variables x and y showing witness dependency.
A dependency graph between variables xx and yy: an edge from xx to yy shows that the witness for yy may depend on which xx was chosen — drag the highlight to compare a "fixed witness" ∃y ∀x R(x,y)\exists y\, \forall x\, R(x,y) against a "moving witness" ∀x ∃y R(x,y)\forall x\, \exists y\, R(x,y).

UndergraduateFormal syntax and quantifier negation

Definition: Quantifiers and free/bound variables

Given a domain MM and a predicate P(x)P(x): ∀x P(x)\forall x\, P(x) ("for all xx, P(x)P(x)") is true in MM iff PP holds for every element of MM; ∃x P(x)\exists x\, P(x) ("there exists xx such that P(x)P(x)") is true iff PP holds for at least one element. A variable inside the scope of a quantifier binding it is bound; otherwise it is free. A formula with no free variables is a sentence, and has a definite truth value in a given structure.

¬(∀x P(x))≡∃x ¬P(x)\neg(\forall x\, P(x)) \equiv \exists x\, \neg P(x)

This law says: "not everyone has property PP" means exactly "someone lacks PP". Its dual, ¬(∃x P(x))≡∀x ¬P(x)\neg(\exists x\, P(x)) \equiv \forall x\, \neg P(x), says "no one has property PP" is the same as "everyone lacks PP". These two laws are the quantifier analogues of De Morgan's laws for ∧,∨\wedge, \vee, and are the key step for pushing all negations inward to reach prenex normal form — a formula with all quantifiers moved to the front, e.g. ∀x ∃y φ\forall x\, \exists y\, \varphi with φ\varphi quantifier-free.

¬(∃x P(x))≡∀x ¬P(x)\neg(\exists x\, P(x)) \equiv \forall x\, \neg P(x)
Prenex normal form: pushing negation and quantifiers
FormulaEquivalent prenex form
¬∀x P(x)\neg \forall x\, P(x)∃x ¬P(x)\exists x\, \neg P(x)
¬∃x P(x)\neg \exists x\, P(x)∀x ¬P(x)\forall x\, \neg P(x)
∀x P(x)∧∀x Q(x)\forall x\, P(x) \wedge \forall x\, Q(x)∀x (P(x)∧Q(x))\forall x\, (P(x) \wedge Q(x))
∃x P(x)∨∃x Q(x)\exists x\, P(x) \vee \exists x\, Q(x)∃x (P(x)∨Q(x))\exists x\, (P(x) \vee Q(x))

UndergraduateKey theorems: instantiation and quantifier order

For any structure M\mathcal{M} with domain MM, any assignment ss, and any term tt substitutable for xx in P(x)P(x): if M⊨s∀x P(x)\mathcal{M} \models_s \forall x\, P(x), then M⊨sP(t)\mathcal{M} \models_s P(t). In rule form: ∀x P(x)⊢P(t)\forall x\, P(x) \vdash P(t).

Why is it true?

∀x P(x)\forall x\, P(x) means "no matter what we plug in for xx, PP holds" — so plugging in any specific term tt must still make P(t)P(t) hold. This is the rule that turns general laws into concrete instances: from "∀x (Human(x)→Mortal(x))\forall x\, (\text{Human}(x) \to \text{Mortal}(x))" we instantiate at t=Socratest = \text{Socrates} to get "Human(Socrates)→Mortal(Socrates)\text{Human}(\text{Socrates}) \to \text{Mortal}(\text{Socrates})", the first premise of the classic syllogism.

Proof

We argue directly from Tarski's satisfaction semantics, which defines truth in a structure recursively on formula structure.

By the semantic clause for ∀\forall: M⊨s∀x P(x)  ⟺  for every d∈M, M⊨s[x↦d]P(x)\mathcal{M} \models_s \forall x\, P(x) \iff \text{for every } d \in M,\ \mathcal{M} \models_{s[x \mapsto d]} P(x). Assume the hypothesis M⊨s∀x P(x)\mathcal{M} \models_s \forall x\, P(x); by this clause, M⊨s[x↦d]P(x)\mathcal{M} \models_{s[x \mapsto d]} P(x) holds for every d∈Md \in M, with no exception.

Since the claim holds for every d∈Md \in M, it holds in particular for d=tM,sd = t^{\mathcal{M},s}, the element that the term tt denotes in M\mathcal{M} under ss. Substituting this specific dd gives M⊨s[x↦tM,s]P(x)\mathcal{M} \models_{s[x \mapsto t^{\mathcal{M},s}]} P(x).

By the Substitution Lemma (a standard result relating variable assignment to term substitution, provable by induction on the structure of PP): M⊨s[x↦tM,s]P(x)  ⟺  M⊨sP(t)\mathcal{M} \models_{s[x \mapsto t^{\mathcal{M},s}]} P(x) \iff \mathcal{M} \models_s P(t), valid precisely because tt is substitutable for xx in P(x)P(x) (no free variable of tt becomes accidentally bound). Applying the lemma converts M⊨s[x↦tM,s]P(x)\mathcal{M} \models_{s[x \mapsto t^{\mathcal{M},s}]} P(x) into M⊨sP(t)\mathcal{M} \models_s P(t).

Since M\mathcal{M}, ss, and tt were arbitrary, the inference from ∀x P(x)\forall x\, P(x) to P(t)P(t) preserves truth in every structure under every assignment: the rule is sound.

For any structure M\mathcal{M} and formula R(x,y)R(x,y): ∃y ∀x R(x,y)⇒∀x ∃y R(x,y)\exists y\, \forall x\, R(x,y) \Rightarrow \forall x\, \exists y\, R(x,y). The converse implication does not hold in general.

Why is it true?

∃y ∀x R(x,y)\exists y\, \forall x\, R(x,y) demands a single witness yy that works for every xx (a "fixed" witness), while ∀x ∃y R(x,y)\forall x\, \exists y\, R(x,y) only demands that each xx has some witness, possibly a different one for each xx (a "moving" witness). A fixed witness is automatically a moving witness (just reuse it), but not conversely — this is exactly the difference between "someone loves everybody" (one universal lover) and "everybody is loved by someone" (possibly different admirers), a classic source of ambiguity in natural language that predicate logic disambiguates.

Proof

Forward direction. Assume M⊨s∃y ∀x R(x,y)\mathcal{M} \models_s \exists y\, \forall x\, R(x,y). By the semantic clause for ∃\exists, M⊨s∃y φ  ⟺  there is d∈M with M⊨s[y↦d]φ\mathcal{M} \models_s \exists y\, \varphi \iff \text{there is } d \in M \text{ with } \mathcal{M} \models_{s[y \mapsto d]} \varphi; applying it here gives some d0∈Md_0 \in M with M⊨s[y↦d0]∀x R(x,y)\mathcal{M} \models_{s[y \mapsto d_0]} \forall x\, R(x,y).

By the clause for ∀\forall applied to this, M⊨s[y↦d0][x↦a]R(x,y)\mathcal{M} \models_{s[y \mapsto d_0][x \mapsto a]} R(x,y) holds for every a∈Ma \in M, since the ∀x\forall x ranges over all of MM regardless of which aa we later pick.

Now fix an arbitrary a∈Ma \in M to verify ∀x ∃y R(x,y)\forall x\, \exists y\, R(x,y). From the previous paragraph, taking x↦ax \mapsto a gives M⊨s[y↦d0][x↦a]R(x,y)\mathcal{M} \models_{s[y \mapsto d_0][x \mapsto a]} R(x,y), which exhibits d0d_0 itself as a witness for ∃y R(x,y)\exists y\, R(x,y) under x↦ax \mapsto a; hence M⊨s[x↦a]∃y R(x,y)\mathcal{M} \models_{s[x \mapsto a]} \exists y\, R(x,y).

Since a∈Ma \in M was arbitrary, M⊨s[x↦a]∃y R(x,y)\mathcal{M} \models_{s[x \mapsto a]} \exists y\, R(x,y) holds for every aa, which is exactly the semantic clause for M⊨s∀x ∃y R(x,y)\mathcal{M} \models_s \forall x\, \exists y\, R(x,y). This proves ∃y ∀x R(x,y)⇒∀x ∃y R(x,y)\exists y\, \forall x\, R(x,y) \Rightarrow \forall x\, \exists y\, R(x,y).

Converse fails: a counterexample. Let M\mathcal{M} have domain M=ZM = \mathbb{Z} (the integers) and interpret R(x,y)R(x,y) as "x<yx < y". Then ∀x ∃y R(x,y)\forall x\, \exists y\, R(x,y) is TRUE: for every integer xx, taking y=x+1y = x+1 gives x<yx < y. But ∃y ∀x R(x,y)\exists y\, \forall x\, R(x,y) is FALSE: it would require a single integer yy larger than every integer xx, and no such maximum integer exists (for any candidate yy, the integer y+1y+1 violates y+1<yy+1 < y). So ∀x ∃y R(x,y)\forall x\, \exists y\, R(x,y) holds while ∃y ∀x R(x,y)\exists y\, \forall x\, R(x,y) fails, showing the converse implication is false in general.

UndergraduateReal-World Applications and Worked Examples

SQL has no native "for all" keyword, so relational databases encode ∀x P(x)\forall x\, P(x) using the quantifier negation law: "∀x P(x)\forall x\, P(x)" becomes `NOT EXISTS (... WHERE NOT P ...)`, i.e. programmers implement ∀\forall via double negation of ∃\exists exactly as in ¬(∀x P(x))≡∃x ¬P(x)\neg(\forall x\, P(x)) \equiv \exists x\, \neg P(x). Formal specification languages (Z notation, Hoare logic pre/postconditions, TLA+) use ∀\forall and ∃\exists directly to state correctness properties like "every array index is within bounds" or "there exists a valid execution path", which verification tools then check by instantiation and quantifier-elimination techniques.

Example: Relational division: "bought every product"

A database has tables `Purchases(customer, product)` and `Products(product)`. Formalize "customer cc bought every product" in predicate logic, then translate into a SQL query using only `NOT EXISTS`.

Solution

Let Bought(c,p)\text{Bought}(c,p) mean "(c,p)(c,p) appears in Purchases" and Product(p)\text{Product}(p) mean "pp appears in Products". "Customer cc bought every product" is ∀p (Product(p)→Bought(c,p))\forall p\, (\text{Product}(p) \to \text{Bought}(c,p)).

SQL lacks ∀\forall, so apply the quantifier negation law ¬(∀x P(x))≡∃x ¬P(x)\neg(\forall x\, P(x)) \equiv \exists x\, \neg P(x) to ¬∃p ¬(Product(p)→Bought(c,p))\neg\exists p\,\neg(\text{Product}(p) \to \text{Bought}(c,p)), i.e. rewrite the universal as "there is NO product that customer cc did NOT buy": ¬∃p (Product(p)∧¬Bought(c,p))\neg \exists p\, (\text{Product}(p) \wedge \neg\text{Bought}(c,p)).

This translates directly: `SELECT c FROM Customers c WHERE NOT EXISTS (SELECT FROM Products p WHERE NOT EXISTS (SELECT FROM Purchases WHERE customer = c.c AND product = p.product))` — the classic "double NOT EXISTS" pattern implementing relational division, a direct application of universal-to-existential quantifier negation.

Example: Formal specification: sortedness invariant

A sorting routine's postcondition is specified as ∀i (0≤i<n−1→a[i]≤a[i+1])\forall i\, (0 \le i < n-1 \to a[i] \le a[i+1]) over an array aa of length nn. A verifier wants to check the specific instance at i=0i=0. Which inference rule justifies extracting a[0]≤a[1]a[0] \le a[1] from the postcondition, and what is the resulting formula?

Solution

Let P(i)P(i) denote 0≤i<n−1→a[i]≤a[i+1]0 \le i < n-1 \to a[i] \le a[i+1]. The postcondition is ∀i P(i)\forall i\, P(i).

By the soundness of universal instantiation proved above, ∀x P(x)⊢P(t)\forall x\, P(x) \vdash P(t) for any term tt in the domain — here take t=0t = 0: from ∀i P(i)\forall i\, P(i) we validly infer P(0)P(0), i.e. 0≤0<n−1→a[0]≤a[1]0 \le 0 < n-1 \to a[0] \le a[1].

Since 0≤0<n−10 \le 0 < n-1 is true whenever n≥2n \ge 2 (a side condition the verifier checks separately, e.g. from the array's declared length), Modus Ponens then yields a[0]≤a[1]a[0] \le a[1] as desired — exactly the instance the verifier wanted to check, obtained by chaining universal instantiation with Modus Ponens.

Which formula is logically equivalent to ¬(∀x P(x))\neg(\forall x\, P(x))?

With domain Z\mathbb{Z} and R(x,y)R(x,y) meaning "x<yx < y", which of these is TRUE?

SQL's `NOT EXISTS (... WHERE NOT P ...)` pattern implements which quantifier over PP?

Given ∀x P(x)\forall x\, P(x) is true in structure M\mathcal{M}, which conclusion is justified by universal instantiation for a term tt?

References

  1. Herbert B. Enderton (2001). A Mathematical Introduction to Logic
  2. David Hilbert, Wilhelm Ackermann (1928). Grundzüge der theoretischen Logik