Click here to load reader

View

31Download

12

Tags:

Embed Size (px)

Proofs and Computations

Helmut Schwichtenberg (Munich)

and

Stanley S. Wainer (Leeds)

Preface

This book is about the deep connections between proof theory and re-cursive function theory. Their interplay has continuously underpinned andmotivated the more constructively-orientated developments in mathemat-ical logic ever since the pioneering days of Hilbert, Godel, Church, Tur-ing, Kleene, Ackermann, Gentzen, Peter, Herbrand, Skolem, Malcev, Kol-mogorov and others in the 1930s. They were all concerned in one way oranother with the links between logic and computability. Godels Theoremutilized the logical representability of recursive functions in number-theory;Herbrands Theorem extracted explicit loop-free programs (sets of witness-ing terms) from existential proofs in logic; Ackermann and Gentzen analysedthe computational content of -reduction and cut-elimination in terms oftransfinite recursion; Turing not only devised the classical machine-modelof computation, but (what is less well known) already foresaw the potentialof transfinite induction as a method for program verification; and of coursethe Herbrand-Godel-Kleene Equation Calculus presented computability asa formal system of equational derivation (with call by value being mod-elled by a substitution rule which itself is a form of cut but at the level ofterms).

That these two fields proof and recursion have developed side byside over the intervening seventyfive years so as to form now a cornerstonein the foundations of computer science, testifies to the power and impor-tance of mathematical logic in transferring what was originally a body ofphilosophically-inspired ideas and results, down to the frontiers of moderninformation technology. A glance through the contents of any good under-graduate text on the fundamentals of computing should lend conviction tothis argument, but we hope also that some of the examples and applicationsin this book will support it further.

Our book is not about technology transfer however, but rather abouta classical area of mathematical logic which underlies it, somewhat in thetradition of Kleenes Introduction to Metamathematics and Girards morerecent Proof Theory and Logical Complexity, though we would not pre-sume to compete with those excellent volumes. Rather, we aim to com-plement them and extend their range of proof-theoretic application, witha coherent, self-contained and up-to-date graduate-level treatment of top-ics which reflect our own personal interests over many years, and includingsome which have not previously been covered in text-book form. Thus thetheory of proofs, recursions, provably recursive functions, their subrecursivehierarchy classifications, and the computational significance and applicationof these, will constitute the driving theme. The methods will be those now-classical ones of cut elimination, normalization and their associated ordinal

iii

iv PREFACE

analyses, but restricted to the small-to-medium-sized range of mathemat-ically significant proof systems between Elementary Recursive Arithmeticand (restricted) 11-Comprehension or ID(< ). Within this range we feelwe have something new to contribute in terms of a unified (and we hope con-ceptually simple) presentational framework. Beyond it, the outer limitsof ordinal analysis and the emerging connections there with large cardinaltheory are presently undergoing rapid and surprising development. Whoknows where that will lead? others are far better equipped to comment.

The fundamental point of proof theory as we see it is Kreisels dictum: aproof of a theorem conveys more information than the mere statement thatit is true (at least it does if we know how to analyse its structure). In acomputational context, knowledge of the truth of a program specification

xN yN Spec(x, y)tells us that there is a while-program

y := 0; while Spec(x, y) do y := y + 1; p := ywhich satisfies it in the sense that

xN Spec(x, p(x)).However we know nothing about the complexity of the program withoutknowing why the specification was true in the first place. What we needis a proof! However even when we have one it might use lemmas of logicalcomplexity far greater than 01, and this would prevent us from analysingdirectly the computational structure embedded within it. So what is re-quired is a method of reducing the proof and the applications of lemmas init, to a computational (01) form, together with some means of measuringthe cost or complexity of that reduction. The method is cut elimination ornormalization and the measurement is achieved by ordinal analysis.

One may wonder why transfinite ordinals enter into the measurement ofprogram complexity. The reason is this :- a program, say over the naturalnumbers, is a syntactic description of a type-2 recursive functional whichtakes variable given functions g to output functions f . By unravelling theintended operation of the program according to the various function-calls itmakes in the course of evaluation, one constructs a tree of subcomputations,each branch of which is determined by an input number for the function fbeing computed together with a particular choice of given function g. Tosay that the program terminates everywhere is to say that every branchof the computation tree ends with an output value after finitely many steps.Thus

termination = well-foundedness .But what is the obvious way to measure the size of an infinite well-foundedtree? Of course, by its ordinal height or rank!

We thus have a natural hierarchy of total recursive functionals in termsof the (recursive) ordinal ranks of their defining programs. Kleene was al-ready aware in 1958 that this hierarchy continues to expand throughout therecursive ordinals i.e., for each recursive ordinal there is a total recur-sive functional which cannot be defined by any program of rank < . Thesubrecursive classification problem therefore has a perfectly natural and

PREFACE v

satisfying solution when viewed in the light of type-2 functionals, in starkcontrast to the rather disappointing state of affairs in the case of type-1functions where intensionality and the question what is a natural wellordering? are stumblingblocks which have long been a barrier to achiev-ing any useful hierarchy classification of all recursive functions (in one go).Nevertheless there has been good progress in classifying subclasses of therecursive functions which arise naturally in a proof-theoretic context, andthe later parts of this book will be much concerned with this.

The point is that, just as in other areas of mathematical logic, ordinals(in our case recursive ordinals) provide a fundamental abstract mathematicalscale against which we can measure and compare the logical complexity ofinductive proofs and the computational complexity of recursive programsspecified by them. The bridge is formed by the fast-, medium- and slow-growing hierarchies of proof-theoretic bounding functions which are quitenaturally associated with the ordinals themselves, and which also modelin a clear way the basic computational paradigms: functional, while-loop and term-reduction.

Our aim is to bring all these issues together as two sides of the samecoin :- on one the proof-theoretic aspects of computation, and on the otherthe computational aspects of proof. We shall try to do this in progressivestages through three distinct parts, keeping in mind that we want the bookto be self-contained, orderly and fairly complete in its presentation of ourmaterial, and also useful as a reference. Thus we begin with two basic chap-ters on proof theory and recursion theory, followed by Chapter 3 on Godelstheorems, providing the fundamental material without which any book withthis title would be incomplete. Part 2 deals with the, now, fairly classicalresults on hierarchies of provably recursive functions for a spectrum of theo-ries ranging between I0(exp) and 11-CA0. We also bring out connectionsbetween fast-growing functions and combinatorial independence results suchas the modified finite Ramsey theorem and Kruskals theorem. Part 3 givesthe fundamental theory underlying the first authors proof assistant andprogram extraction system Minlog1. The implementation is not discussedhere, but the underlying proof theoretic ideas and the various aspects ofconstructive logic involved are dealt with in some detail. Thus: the domainof continuous functionals in which higher type computation naturally arises,functional interpretations, and finally implicit complexity, where ideas de-veloped throughout the whole book are brought to bear on certain newerweak systems with more feasible provable functions. Every chapter is in-tended to contain some examples or applications illustrating our intendedtheme :- the link between proof theory, recursion and computation.

Although we have struggled with this book project over many years, wehave found the writing of it more and more stimulating as it got closer tofruition. The reason for this has been a divergence of our mathematicalstandpoints while one (S.W.) holds to a more pragmatic middle of theroad stance, the other (H.S.) holds a somewhat clearer and committed con-structive view of the mathematical world. The difference has led to manyhappy hours of dispute and this inevitably may be evident in the choice of

1See http://www.minlog-system.de

vi PREFACE

topics and their presentations which follow. Despite these differences, bothauthors believe (to a greater or lesser extent) that it is a rather extremeposition to hold that existence is really equivalent to the impossibility ofnon-existence. Foundational studies even if classically inspired shouldsurely investigate these positions to see what relative properties the strong() and weak () existential quantifiers might possess.

Acknowledgement. We would like to thank the many people whohave contributed to the book in one way or another. The material in parts 1and 2 has been used as a basis for graduate lecture courses by both authors,and we gratefully acknowledge the many useful student contributions toboth the exposition and the content. Simon Huber in his diploma thesis(2009) provided many improvements and/or corrections to part 3. Ourspecial thanks go to Josef Berger and Grigori Mints, who kindly agreed tocritically read the manuscript.

Preliminaries

Referencing. References are by chapter, section and subsection: i.j.krefers to subsection k of section j in chapter i. Theorems and the like arereferred to by their names or the number of the subsection they appear in.Equations are numbered within a chapter; reference to equation n in sectionj is in the form (j.n).

Mathematical notation. := is used for definitional equality. We writeY X for Y is a subset ofX. Application for terms is left associative, andlambda abstraction binds stronger than application. For example, MNKmeans (MN)K and notM(NK), and xMN means (xM)N , not x(MN).

We also save on parentheses by writing, e.g., Rxyz, Rt0t1t2 instead ofR(x, y, z), R(t0, t1, t2), where R is some predicate symbol. Similarly for aunary function symbol with a (typographically) simple argument, so fx forf(x), etc. In this case no confusion will arise. But readability requires thatwe write in full R(fx, gy, hz), instead of Rfxgyhz.

Binary function and relation symbols are usually written in infix nota-tion, e.g., x + y instead of +(x, y), and x < y instead of

Contents

Preface iii

Preliminaries vii

Part 1. Basic Proof Theory and Computability 1

Chapter 1. Logic 31.1. Natural Deduction 41.2. Normalization 151.3. Soundness and Completeness for Tree Models 281.4. Soundness and Completeness of the Classical Fragment 361.5. Tait Calculus 401.6. Notes 41

Chapter 2. Recursion Theory 432.1. Register Machines 432.2. Elementary Functions 462.3. The Normal Form Theorem 542.4. Recursive Definitions 582.5. Primitive Recursion and For-Loops 622.6. The Arithmetical Hierarchy 682.7. The Analytical Hierarchy 722.8. Recursive Type-2 Functionals and Well-Foundedness 752.9. Inductive Definitions 782.10. Notes 86

Chapter 3. Godels Theorems 873.1. I0(exp) 883.2. Godel Numbers 963.3. The Notion of Truth in Formal Theories 1033.4. Undecidability and Incompleteness 1053.5. Representability 1073.6. Unprovability of Consistency 1113.7. Notes 114

Part 2. Provable Recursion in Classical Systems 115

Chapter 4. The Provably Recursive Functions of Arithmetic 1174.1. Primitive Recursion and I1 1194.2. 0-Recursion in Peano Arithmetic 1234.3. Ordinal Bounds for Provable Recursion in PA 1384.4. Independence Results for PA 148

ix

x CONTENTS

4.5. Notes 154

Chapter 5. Accessible Recursive Functions 1555.1. The Subrecursive Stumblingblock 1555.2. Accessible Recursive Functions 1595.3. Proof Theoretic Characterizations of Accessibility 1725.4. ID

Part 1

Basic Proof Theory andComputability

CHAPTER 1

Logic

The main subject of Mathematical Logic is mathematical proof. In thisintroductory chapter we deal with the basics of formalizing such proofs and,via normalization, analysing their structure. The system we pick for therepresentation of proofs is Gentzens natural deduction from (1934). Ourreasons for this choice are twofold. First, as the name says this is a naturalnotion of formal proof, which means that the way proofs are representedcorresponds very much to the way a careful mathematician writing out alldetails of an argument would go anyway. Second, formal proofs in naturaldeduction are closely related (via the so-called Curry-Howard correspon-dence) to terms in typed lambda calculus. This provides us not only witha compact notation for logical derivations (which otherwise tend to becomesomewhat unmanagable tree-like structures), but also opens up a route toapplying (in part 3) the computational techniques which underpin lambdacalculus.

Apart from classical logic we will also deal with more constructive logics:minimal and intuitionistic logic. This will reveal some interesting aspects ofproofs, e.g., that it is possible and useful to distinguish beween existentialproofs that actually construct witnessing objects, and others that dont.

An essential point for Mathematical Logic is to fix a formal languageto be used. We take implication and the universal quantifier as basic.Then the logic rules correspond precisely to lambda calculus. The additionalconnectives: the existential quantifier , disjunction and conjunction ,can then be added either as rules or axiom schemes. It is natural to treatthem as rules, and that is what we do here. However later (in chapter 7) theywill appear instead as axioms formalizing particular inductive definitions. Inaddition to the use of inductive definitions as a unifying concept, anotherreason for that change of emphasis will be that it fits more readily with themore computational viewpoint adopted there.

We shall not develop sequent-style logics, except for Taits one-sidedsequent calculus for classical logic, it (and the associated cut eliminationprocess) being a most convenient tool for the ordinal analysis of classicaltheories, as done in part 2. There are many excellent treatments of sequentcalculus in the literature and we have little of substance to add. Rather, weconcentrate on those logical issues which have interested us. This chapterdoes not simply introduce basic proof theory, but in addition there is anunderlying theme: to bring out the constructive content of logic, particularlyin regard to the relationship between minimal and classical logic. For us thelatter is most appropriately viewed as a subsystem of the former.

3

4 1. LOGIC

1.1. Natural Deduction

Rules come in pairs: we have an introduction and an elimination rule foreach of the logical connectives. The resulting system is called minimal logic;it was introduced by Kolmogorov (1932), Gentzen (1934) and Johansson(1937). Notice that no negation is yet present. If we go on and requireex-falso-quodlibet for the nullary propositional symbol (falsum) we canembed intuitionistic logic with negation as A . To embed classical logic,we need to go further and add as an axiom schema the principle of indirectproof, also called stability (~x(R~x R~x ) for relation symbols R), butthen it is appropriate to restrict to the language based on , , and .The reason for this restriction is that we can neither prove xA xAnor (AB) AB, for there are countermodels to both (the former isMarkovs scheme). However, we can prove them for the classical existentialquantifier and disjunction defined by xA and A B . Thuswe need to make a distinction between two kinds of exists and two kindsof or: the classical ones are weak and the non-classical ones strongsince they have constructive content. In situations where both kinds occurtogether we must mark the distinction, and we shall do this by writing a tildeabove the weak disjunction and existence symbols thus , . Of course, in aclassical context this distinction does not arise and the tilde is not necessary.

1.1.1. Terms and formulas. Let a countably infinite set { vi | i N }of variables be given; they will be denoted by x, y, z. A first order languageL then is determined by its signature, which is to mean the following.(i) For every natural number n 0 a (possible empty) set of n-ary rela-

tion symbols (or predicate symbols). 0-ary relation symbols are calledpropositional symbols. (read falsum) is required as a fixed proposi-tional symbol. The language will not, unless stated otherwise, contain= as a primitive. Binary relation symbols can be marked as infix .

(ii) For every natural number n 0 a (possible empty) set of n-ary functionsymbols. 0-ary function symbols are called constants. Binary functionsysmbols can also be marked as infix.

We assume that all these sets of variables, relation and function symbols aredisjoint. L is kept fixed and will only be mentioned when necessary.

Terms are inductively defined as follows.

(i) Every variable is a term.(ii) Every constant is a term.(iii) If t1, . . . , tn are terms and f is an n-ary function symbol with n 1,

then f(t1, . . . , tn) is a term. (If r, s are terms and is a binary functionsymbol, then (r s) is a term.)

From terms one constructs prime formulas, also called atomic formulasor just atoms: If t1, . . . , tn are terms and R is an n-ary relation symbol, thenR(t1, . . . , tn) is a prime formula. (If r, s are terms and is a binary relationsymbol, then (r s) is a prime formula.)

Formulas are inductively defined from prime formulas by

(i) Every prime formula is a formula.

1.1. NATURAL DEDUCTION 5

(ii) If A and B are formulas, then so are (A B) (if A then B), (AB)(A and B) and (A B) (A or B).

(iii) If A is a formula and x is a variable, then xA (A holds for all x)and xA (there is an x such that A) are formulas.

Negation is defined byA := (A ).

We shall often need to do induction on the height, denoted |A|, offormulas A. This is defined as follows: |P | = 0 for atoms P , |A B| =max(|A|, |B|) + 1 for binary operators (i.e., ,,) and | A| = |A| + 1for unary operators (i.e., x, x).

1.1.2. Substitution, free and bound variables. Expressions E , E which differ only in the names of bound variables will be regarded as iden-tical. This is sometimes expressed by saying that E and E are -equivalent.In other words, we are only interested in expressions modulo renaming ofbound variables. There are methods of finding unique representatives forsuch expressions, for example the name-free terms of de Bruijn (1972). Forthe human reader such representations are less convenient, so we shall stickto the use of bound variables.

In the definition of substitution of expression E for variable x in ex-pression E, either one requires that no variable free in E becomes boundby a variable-binding operator in E , when the free occurrences of x are re-placed by E (also expressed by saying that there must be no clashes ofvariables), E is free for x in E, or the substitution operation is taken toinvolve a systematic renaming operation for the bound variables, avoidingclashes. Having stated that we are only interested in expressions modulorenaming bound variables, we can without loss of generality assume thatsubstitution is always possible.

Also, it is never a real restriction to assume that distinct quantifieroccurrences are followed by distinct variables, and that the sets of boundand free variables of a formula are disjoint.

Notation. FV is used for the (set of) free variables of an expression;so FV(t) is the set of variables free in the term t, FV(A) the set of variablesfree in formula A etc. A formula A is said to be closed if FV(A) = .E [x := t] denotes the result of substituting the term t for the variable

x in the expression E . Similarly, E [~x := ~t ] is the result of simultaneouslysubstituting the terms ~t = t1, . . . , tn for the variables ~x = x1, . . . , xn, respec-tively.

In a given context we shall adopt the following convention. Once aformula has been introduced as A(x), i.e., A with a designated variable x,we write A(t) for A[x := t], and similarly with more variables.

1.1.3. Subformulas. Unless stated otherwise, the notion of subfor-mula will be that defined by Gentzen.

Definition. (Gentzen) subformulas of A are defined by(a) A is a subformula of A;(b) if B C is a subformula of A then so are B, C, for = ,,;(c) if xB(x) or xB(x) is a subformula of A, then so is B(t).

6 1. LOGIC

Definition. The notions of positive, negative, strictly positive subfor-mula are defined in a similar style:(a) A is a positive and a strictly positive subformula of itself;(b) if B C or B C is a positive (negative, strictly positive) subformula

of A, then so are B, C;(c) if xB(x) or xB(x) is a positive (negative, strictly positive) subformula

of A, then so is B(t);(d) if B C is a positive (negative) subformula of A, then B is a negative

(positive) subformula of A, and C is a positive (negative) subformula ofA;

(e) if B C is a strictly positive subformula of A, then so is C.A strictly positive subformula of A is also called a strictly positive part(s.p.p.) of A. Note that the set of subformulas of A is the union of thepositive and negative subformulas of A.

Example. (P Q) R xS(x) has as s.p.p.s the whole formula,R xS(x), R, xS(x), S(t). The positive subformulas are the s.p.p.s andin addition P ; the negative subformulas are P Q, Q.

1.1.4. Examples of derivations.

(A B C) (A B) A C.Informal proof. Assume A B C. To show: (A B) A C.So assume A B. To show: A C. So finally assume A. To show: C.Using the third assumption twice we have B C by the first assumption,and B by the second assumption. From B C and B we then obtainC. Then A C, cancelling the assumption on A; (A B) A Ccancelling the second assumption; and the result follows by cancelling thefirst assumption.

x(A B) A xB, if x / FV(A).Informal proof. Assume x(A B). To show: A xB. So assume A. Toshow: xB. Let x be arbitrary; note that we have not made any assumptionson x. To show: B. We have A B by the first assumption. Hence alsoB by the second assumption. Hence xB. Hence A xB, cancelling thesecond assumption. Hence the result, cancelling the first assumption.

A characteristic feature of these proofs is that assumptions are intro-duced and eliminated again. At any point in time during the proof the freeor open assumptions are known, but as the proof progresses, free assump-tions may become cancelled or closed because of the implies-introductionrule.

We reserve the word proof for the informal level; a formal representationof a proof will be called a derivation.

An intuitive way to communicate derivations is to view them as labelledtrees each node of which denotes a rule application. The labels of the innernodes are the formulas derived as conclusions at those points, and the labelsof the leaves are formulas or terms. The labels of the nodes immediatelyabove a node k are the premises of the rule application. At the root ofthe tree we have the conclusion (or end formula) of the whole derivation.In natural deduction systems one works with assumptions at leaves of the

1.1. NATURAL DEDUCTION 7

tree; they can be either open or closed (cancelled). Any of these assump-tions carries a marker . As markers we use assumption variables denotedu, v, w, u0, u1, . . . . The variables of the language previously introduced willnow often be called object variables, to distinguish them from assumptionvariables. If at a node below an assumption the dependency on this as-sumption is removed (it becomes closed) we record this by writing down theassumption variable. Since the same assumption may be used more thanonce (this was the case in the first example above), the assumption markedwith u (written u : A) may appear many times. Of course we insist thatdistinct assumption formulas must have distinct markers. An inner node ofthe tree is understood as the result of passing from premises to the conclu-sion of a given rule. The label of the node then contains, in addition to theconclusion, also the name of the rule. In some cases the rule binds or closesor cancels an assumption variable u (and hence removes the dependency ofall assumptions u : A thus marked). An application of the -introductionrule similarly binds an object variable x (and hence removes the dependencyon x). In both cases the bound assumption or object variable is added tothe label of the node.

Definition. A formula A is called derivable (in minimal logic), writ-ten ` A, if there is a derivation of A (without free assumptions) usingthe natural deduction rules. A formula B is called derivable from assump-tions A1, . . . , An, if there is a derivation of B with free assumptions amongA1, . . . , An. Let be a (finite or infinite) set of formulas. We write ` B ifthe formula B is derivable from finitely many assumptions A1, . . . , An .

We now formulate the rules of natural deduction.

1.1.5. Introduction and elimination rules for and . First wehave an assumption rule, allowing to write down an arbitrary formula Atogether with a marker u:

u : A assumption.

The other rules of natural deduction split into introduction rules (I-rules forshort) and elimination rules (E-rules) for the logical connectives which, forthe time being, are just and . For implication there is an introductionrule + and an elimination rule also called modus ponens. The leftpremise A B in is called the major (or main) premise, and the rightpremise A the minor (or side) premise. Note that with an application of the+-rule all assumptions above it marked with u : A are cancelled (whichis denoted by putting square brackets around these assumptions), and theu then gets written alongside. There may of course be other uncancelledassumptions v : A of the same formula A, which may get cancelled at a laterstage.

[u : A]|MB +uA B

|MA B

| NA B

For the universal quantifier there is an introduction rule + (again marked,but now with the bound variable x) and an elimination rule whose right

8 1. LOGIC

premise is the term r to be substituted. The rule +x with conclusion xAis subject to the following (Eigen-)variable condition: the derivation M ofthe premise A should not contain any open assumption having x as a freevariable.

|MA +xxA

|MxA(x) r

A(r)

We now give derivations of the two example formulas treated informallyabove. Since in many cases the rule used is determined by the conclusion,we suppress in such cases the name of the rule.

u : A B C w : AB C

v : A B w : AB

C +wA C +v(A B) A C +u(A B C) (A B) A C

u : x(A B) xA B v : A

B +xxB +vA xB +ux(A B) A xBNote that the variable condition is satisfied: x is not free in A (and also notfree in x(A B)).

1.1.6. Properties of negation. Recall that negation is defined byA := (A ). The following can easily be derived.

A A,A A.

However, A A is in general not derivable (without stability we willcome back to this later on).

Lemma. The following are derivable.

(A B) B A,(A B) B,(A B) A B,( B) (A B) (A B),xA xA.

Derivations are left as an exercise.

1.1. NATURAL DEDUCTION 9

1.1.7. Introduction and elimination rules for disjunction , con-junction and existence . For disjunction the introduction and elimi-nation rules are

|MA +0

A B

|MB +1

A B|M

A B

[u : A]| NC

[v : B]| KC u, v

C

For conjunction we have

|MA

| NB +A B

|MA B

[u : A] [v : B]| NC u, v

C

and for the existential quantifier

r

|MA(r) +xA(x)

|MxA

[u : A]| NB x, u (var.cond.)

B

The rule x, u is subject to the following (Eigen-)variable condition: inthe derivation N the variable x should not occur free in B nor in any openassumption other than A.

Again, in each of the elimination rules , and the left premiseis called major (or main) premise, and the right premise is called the minor(or side) premise.

It is easy to see that for each of the connectives , , the rules and thefollowing axioms are equivalent over minimal logic; this is left as an exercise.For disjunction the introduction and elimination axioms are

+0 : A A B,+1 : B A B, : A B (A C) (B C) C.

For conjunction we have

+ : A B A B, : A B (A B C) Cand for the existential quantifier

+ : A xA, : xA x(A B) B (x / FV(B)).Remark. All these axioms can be seen as special cases of a general

schema, that of an inductively defined predicate, which is defined by someintroduction rules and one elimination rule. Later we will study this kindof definition in full generality.

We collect some easy facts about derivability; B A means A B.Lemma. The following are derivable.

(A B C) (A B C),(A B C) (A B) (A C),

10 1. LOGIC

(A B C) (A C) (B C),(xA B) x(A B) if x / FV(B),(A xB) x(A B) if x / FV(A),(xA B) x(A B) if x / FV(B),(A xB) x(A B) if x / FV(A).

The proof is left as an exercise.As already mentioned, we distinguish between two kinds of exists and

two kinds of or: the weak or classical ones and the strong or non-classical ones, with constructive content. In the present context both kindsoccur together and hence we must mark the distinction; we shall do this bywriting a tilde above the weak disjunction and existence symbols thus

:= A B , := xA.One can show easily that these weak variants of disjunction and the exis-tential quantifier are no stronger than the proper ones (in fact, they areweaker):

A B A B, xA xA.This can be seen easily by putting C := in and B := in .

1.1.8. Intuitionistic and classical derivability. In the definition ofderivability in 1.1.4 falsity plays no role. We may change this and requireex-falso-quodlibet axioms, of the form

~x( R~x )with R a relation symbol distinct from . Let Efq denote the set of all suchaxioms. A formula A is called intuitionistically derivable, written `i A, ifEfq ` A. We write `i B for Efq ` B.

We may even go further and require stability axioms, of the form

~x(R~x R~x )with R again a relation symbol distinct from . Let Stab denote the set ofall these axioms. A formula A is called classically derivable, written `c A,if Stab ` A. We write `c B for Stab ` B.

It is easy to see that intuitionistically (i.e., from Efq) we can derive A for an arbitrary formula A, using the introduction rules for theconnectives. A similar generalization of the stability axioms is only possiblefor formulas in the language not involving ,. However, it is still possibleto use the substitutes and .

Theorem (Stability, or principle of indirect proof).

(a) ` (A A) (B B) (A B) A B.(b) ` (B B) (A B) A B.(c) ` (A A) xA A.(d) `c A A for every formula A without ,.

1.1. NATURAL DEDUCTION 11

Proof. (a) is left as an exercise. (b). For simplicity, in the derivationto be constructed we leave out applications of + at the end.

u : B B

v : (A B)

u1 : Bu2 : A B w : A

B +u2(A B)

+u1BB

(c).

u : A A

v : xA

u1 : Au2 : xA x

A +u2xA

+u1AA

(d). Induction on A. The case R~t with R distinct from is given by Stab.In the case the desired derivation is

v : ( ) u : +u

In the cases A B, A B and xA use (a), (b) and (c), respectively.

Using stability we can prove some well-known facts about the interactionof weak disjunction and the weak existential quantifier with implication. Wefirst prove a more refined claim, stating to what extent we need to go beyondminimal logic.

Lemma. The following are derivable.

(xA B) x(A B) if x / FV(B),(1.1)(B B) x(A B) xA B if x / FV(B),(1.2)( B[x:=c]) (A xB) x(A B) if x / FV(A),(1.3)

x(A B) A xB if x / FV(A).(1.4)The last two items can also be seen as simplifying a weakly existentiallyquantified implication whose premise does not contain the quantified variable.In case the conclusion does not contain the quantified variable we have

(B B) x(A B) xA B if x / FV(B),(1.5)x(A A) (xA B) x(A B) if x / FV(B).(1.6)

Proof. (1.1)

xA B

u1 : xA xA A

+u1xAB

12 1. LOGIC

(1.2)

B B

xA

u2 : B

x(A B) xA B u1 : A

B +u1AxA

+u2BB

(1.3) Writing B0 for B[x:=c] we have

x(A B) c(A B0)

B0

A xB u2 : AxB

x(A B) x(A B)

u1 : BA B

+u1BxB

B0 +u2

A B0

(1.4)

x(A B)

xB xB

u1 : A B AB

+u1(A B)x(A B)

(1.5)

B B

x(A B)

u2 : Bu1 : A B

xA xA

B +u1(A B)

x(A B) +u2B

B

1.1. NATURAL DEDUCTION 13

(1.6) We derive x( A) (xA B) x(A B) A.Writing Ax,Ay for A(x), A(y) we have

x(Ax B) x(Ax B)

xAx B

y( Ay) y Ay

u1 : Ax u2 : Ax

Ay

yAyB +u2

Ax B +u1Ax

Using this derivation M we obtain

x(Ax B) x(Ax B)

xAx B

x(Ax Ax) xAx Ax

|MAx

AxxAx

BAx B

Since clearly ` (A A) A the claim follows.

Remark. An immediate consequence of (1.6) is the classical derivabilityof the drinker formula x(Px xPx), to be read in every non-emptybar there is a person such that, if this person drinks, then everybody drinks.To see this let A := Px and B := xPx in (1.6).

Corollary.

`c (xA B) x(A B) if x / FV(B) and B without ,,`i (A xB) x(A B) if x / FV(A),`c x(A B) (xA B) if x / FV(B) and A,B without ,.

There is a similar lemma on weak disjunction:

Lemma. The following are derivable.

(A B C) (A C) (B C),(C C) (A C) (B C) A B C,( B) (A B C) (A B) (A C),

(A B) (A C) A B C,(C C) (A C) (B C) A B C( C) (A B C) (A C) (B C)

14 1. LOGIC

Proof. The derivation of the final formula is

(B C)

C(A C)

A B C u1 : AB C u2 : B

C +u1A C

C +u2

B C

The other derivations are similar to the ones above, if one views as aninfinitary version of .

Corollary.

`c (A B C) (A C) (B C) for C without ,,`i (A B C) (A B) (A C),`c (A C) (B C) (A B C) for C without ,.

Remark. It follows that weak disjunction and the weak existentialquantifier satisfy the same axioms as the strong variants, if one restrictsthe conclusion of the elimination axioms to formulas without ,:

` A A B, ` B A B,`c A B (A C) (B C) C for C without ,,` A xA,`c xA x(A B) B if x / FV(B) and B is without ,.1.1.9. Godel-Gentzen translation. Classical derivability `c B was

defined in 1.1.8 by Stab ` B. This embedding of classical logic intominimal logic can be expressed in a somewhat different and very explicitform, namely as a syntactic translation A 7 Ag of formulas such that Ais derivable in classical logic if and only if its translation Ag is derivable inminimal logic.

Definition (Godel-Gentzen translation Ag).

P g := P for prime formulas P 6= (A B)g := Ag Bg(xA)g := xAg(A B)g := Ag Bg for = ,(xA)g := xAg.

Lemma. ` Ag Ag.Proof. Induction on A.Case R~t. We must show R~t R~t, which is a special case of

` B B.

1.2. NORMALIZATION 15

Case A B. We must show ` (Ag Bg) Ag Bg, which is aspecial case of ` (C D ) C D :

(C D )

u1 : C D CD D

+u1(C D )

Case xA. In this case we must show ` xAg xAg, but this is aspecial case of ` B B, because xAg is the negation xAg.

Case A B. We must show ` (Ag Bg) Ag Bg. By inductionhypothesis ` Ag Ag and ` Bg Bg. Now use part (a) of thestability lemma in 1.1.8.

The cases A B and xA are similar, using parts (b) and (c) of thestability lemma instead.

Theorem. (a) `c A implies g ` Ag.(b) g ` Ag implies `c A for , A without ,.

Proof. (a). We use induction on `c A. For a stability axiom~x(R~x R~x ) we must derive ~x(R~x R~x ), which is easy(as above). For the rules +, , +, , + and the claim followsimmediately from the induction hypothesis, using the same rule again. Thisworks because the Godel-Gentzen translation acts as a homomorphism forthese connectives. For the rules +i , , + and the claim follows fromthe induction hypothesis and the last lemma in 1.1.8. For example, in case the induction hypothesis gives

|MxAg

andu : Ag

| NBg

with x / FV(Bg). Now use ` (Bg Bg) xAg x(Ag Bg) Bg. Its premise Bg Bg is derivable by the lemma above.

(b). First note that `c (B Bg) if B is without ,. Now assume that, A are without ,. From g ` Ag we obtain `c A as follows. We argueinformally. Assume . Then g by the note, hence Ag because of g ` Ag,hence A again by the note.

1.2. Normalization

A derivation in normal form does not make detours, or more precisely,it cannot occur that an elimination rule immediately follows an introductionrule. We will use conversions to remove such local maxima of complex-ity, thus reducing any given derivation to normal form. However, there is adifficulty when we consider an elimination rule for , or . An introducedformula may be used as a minor premise of an application of , or, then stay the same throughout a sequence of applications of these rules,being eliminated at the end. This also constitutes a local maximum, whichwe should like to eliminate; permutative conversions are designed for exactlythis situation. In a permutative conversion we permute an E-rule upwardsover the minor premises of , or .

16 1. LOGIC

Derivation Term

u : A uA

[u : A]|MB +uA B

(uAMB)AB

|MA B

| NA B

(MABNA)B

|MA +x (with var.cond.)xA

(xMA)xA (with var.cond.)

|MxA(x) r

A(r)

(MxA(x)r)A(r)

Table 1. Derivation terms for and

We analyse the shape of derivations in normal form, and then prove the(crucial) subformula property, which says that every formula in a normalderivation is a subformula of the end-formula or else of an assumption.

It will be convenient to represent derivations as typed terms, wherethe derived formula is seen as the type of the term (and displayed as asuperscript). This representation is known under the name Curry-Howardcorrespondence. We give an inductive definition of such derivation terms forthe,-rules in table 1 where for clarity we have written the correspondingderivations to the left. In table 2 this is extended also to cover the rules for, and .

1.2.1. Conversions. A conversion eliminates a detour in a derivation,i.e., an elimination immediately following an introduction. We now spellout in detail which conversions we shall allow. This is done for derivationswritten in tree notation and also as derivation terms.

1.2. NORMALIZATION 17

Derivation Term

|MA +0

A B

|MB +1

A B(+0,BMA)AB (+1,AMB)AB

|MA B

[u : A]| NC

[v : B]| KC u, v

C

(MAB(uA.NC , vB.KC))C

|MA

| NB +A B

MA, NBAB

|MA B

[u : A] [v : B]| NC u, v

C

(MAB(uA, vB.NC))C

r

|MA(r) +xA(x)

(+x,ArMA(r))xA(x)

|MxA

[u : A]| NB x, u (var.cond.)

B

(MxA(uA.NB))B (var.cond.)

Table 2. Derivation terms for , and

-conversion.

[u : A]|MB +uA B

| NA B

7| NA|MB

18 1. LOGIC

or written as derivation terms (uM(uA)B)ABNA 7 M(NA)B. Thereader familiar with -calculus should note that this is nothing other than-conversion.-conversion.

|MA(x) +xxA(x) r

A(r)

7 |M

A(r)

or written as derivation terms (xM(x)A(x))xA(x)r 7M(r).-conversion.

|MA +0

A B

[u : A]| NC

[v : B]| KC u, v

C

7|MA| NC

or as derivation terms (+0,BMA)AB(uA.N(u)C , vB.K(v)C) 7 N(MA)C ,and similarly for +1 with K instead of N .-conversion.|MA

| NB +A B

[u : A] [v : B]| KC u, v

C

7|MA

| NB

| KC

or MA, NBAB(uA, vB.K(u, v)C) 7 K(MA, NB)C .-conversion.

r

|MA(r) +xA(x)

[u : A(x)]| NB x, u

B

7|M

A(r)| N B

or (+x,ArMA(r))xA(x)(uA(x).N(x, u)B) 7 N(r,MA(r))B.

1.2.2. Permutative conversions.-permutative conversion.

|MA B

| NC

| KC

C

| LC E-rule

D

7

|MA B

| NC

| LC E-rule

D

| KC

| LC E-rule

DD

or with for instance as E-rule (MAB(uA.NCD, vB.KCD))CDLC 7(MAB(uA.(NCDLC)D, vB.(KCDLC)D))D.

1.2. NORMALIZATION 19

-permutative conversion.|M

A B| NC

C

| KC E-rule

D

7

|MA B

| NC

| KC E-rule

DD

or (MAB(uA, vB.NCD))CDKC 7 (MAB(uA, vB.(NCDKC)D))D.-permutative conversion.

|MxA

| NB

B

| KC E-rule

D

7

|MxA

| NB

| KC E-rule

DD

or (MxA(uA.NCD))CDKC 7 (MxA(uA.(NCDKC)D))D.

1.2.3. Simplification conversions. These are somewhat trivial con-versions, which remove unnecessary applications of the elimination rules for, and . For we have

|MA B

[u : A]| NC

[v : B]| KC u, v

C

7 | NC

if u : A is not free in N , or (MAB(uA.NC , vB.KC))C 7 NC ; similar for thesecond component. For there is the conversion

|MA B

[u : A] [v : B]| NC u, v

C

7 | NC

if neither u : A nor v : B is free in N , or (MAB(uA, vB.NC))C 7 NC . For the simplification conversion is

|MxA

[u : A]| NB x, u

B

7 | NB

if again u : A is not free in N , or (MxA(uA.NB))B 7 NB.

20 1. LOGIC

1.2.4. Strong normalization. We now show that no matter in whichorder we apply the conversion rules, they will always terminate and producea derivation in normal form, where no further conversions can be applied.

We shall write derivation terms without formula super- or subscripts.For instance, we write + instead of +x,A. Hence we consider derivationterms M,N,K now of the forms

u | vM | yM | +0M | +1M | M,N | +rM |MN |Mr |M(v0.N0, v1.N1) |M(v, w.N) |M(v.N)

where, in these expressions, the variables v, y, v0, v1, w are bound.To simplify the technicalities, we restrict our treatment to the rules for

and . The argument easily extends to the full set of rules. Hence weconsider

u | vM | +rM |MN |M(v.N).The strategy for strong normalization is set out below, but a word about

notation is crucial here. Whenever we write an applicative term as M ~N :=MN1 . . . Nk the convention is that bracketing to the left operates. That is,M ~N = (. . . (MN1) . . . Nk).

We reserve the letters E,F,G for eliminations, i.e., expressions of theform (v.N), and R,S, T for both terms and eliminations. Using this notationwe obtain a second (and clearly equivalent) inductive definition of terms:

u ~M | u ~ME | vM | +rM |(vM)N ~R | +rM(v.N)~R | u ~MER~S.

Here only the final three forms are not normal: (vM)N ~R and +rM(v.N)~Rboth are -redexes, and u ~MER~S is a permutative redex . The conversionrules for them are

(vM(v))N 7 M(N) -conversion,+x,ArM(v.N(x, v)) 7 N(r,M) -conversion,M(v.N)R 7pi M(v.NR) permutative conversion.

In addition we also allow

M(v.N) 7 N if v : A is not free in N ; a simplification conversion.M(v.N) is then called a simplification redex .

The closure of these conversions is defined by(a) If M 7 M for = , pi, , then M M .(b) If M M , then MR M R, NM NM , N(v.M) N(v.M ),

vM vM , +rM +rM (inner reductions).SoM N means thatM reduces in one step to N , i.e., N is obtained fromM by replacement of (an occurrence of) a redex M of M by a conversumM of M , i.e., by a single conversion. The relation + (properly reducesto) is the transitive closure of , and (reduces to) is the reflexiveand transitive closure of . A term M is in normal form, or M is normal ,if M does not contain a redex. M has a normal form if there is a normal Nsuch that M N . A reduction sequence is a (finite or infinite) sequenceM0 M1 M2 . . . such that Mi Mi+1, for all i.

1.2. NORMALIZATION 21

We inductively define a set SN. In doing so we take care that for a givenM there is exactly one rule applicable to generate M SN. This will becrucial to make the later proofs work.

~M SN (Var0)u ~M SN

M SN ()vM SN

M SN ()+rM SN

~M,N SN(Var)

u ~M(v.N) SNu ~M(v.NR)~S SN

(Varpi)u ~M(v.N)R~S SN

M(N)~R SN N SN()

(vM(v))N ~R SN

.N(r,M)~R SN M SN

()+x,ArM(v.N(x, v))~R SN

In (Varpi) we require that x (from xA) and v are not free in R.It is easy to see that SN is closed under substitution for object variables:

if M(x) SN, then M(r) SN. The proof of this is by induction onM SN, applying the induction hypothesis first to the premise(es) andthen reapplying the same rule.

We write M to mean that M is strongly normalizing, i.e., that everyreduction sequence starting from M terminates. By analysing the possi-ble reduction steps we now show that the set {M | M } has the closureproperties of the definition of SN above, and hence SN {M |M }.

Lemma. Every term in SN is strongly normalizing.

Proof. We distinguish cases according to the generation rule of SNapplied last. The following rules deserve special attention.

Case (Varpi). We prove, as an auxiliary lemma, that

u ~M(v.NR)~S implies u ~M(v.N)R~S,by induction on u ~M(v.NR)~S (i.e., on the reduction tree of this term). Weconsider the possible reducts of u ~M(v.N)R~S. The only interesting case isu ~M(v.N)(v.N )T ~T , and we have a permutative conversion of (v.N ) withT , leading to the termM = u ~M(v.N)(v.N T )~T . We showM. Consider anarbitrary reduction sequence starting fromM ; for simplicity assume ~T = R.Reductions inside ~M , N , N T and R lead to u ~M1(v.N1)(v.K1)R1. Then wemay have a permutative conversion to u ~M1(v.N1)(v.K1R1) and afterwardsfurther inner reductions leading to u ~M2(v.N2)(v.K2). Such reductions mustterminate because any infinite reduction sequence caused by them wouldalso lead to an infinite reduction sequence for u ~M(v.N)(v.N )TR, whichcannot happen by induction hypothesis. Therefore we are left with thecase of a final permutative conversion to u ~M2(v.N2(v.K2)). But this termis also a reduct of u ~M(v.N)(v.K)TR (first three permutative conversionslead to u ~M(v.N)(v.KTR), and then inner reductions), which by inductionhypothesis is strongly normalizing.

22 1. LOGIC

Case (). We show thatM(N)~R and N imply (vM(v))N ~R. Thisis done by induction on N, with a side induction on M(N)~R. We needto consider all possible reducts of (vM(v))N ~R. In case of an outer -reduction use the assumption. If N is reduced, use the induction hypothesis.Reductions in M and in ~R as well as permutative reductions within ~R aretaken care of by the side induction hypothesis.

Case (). We show that

N(r,M)~R and M together imply +rM(v.N(x, v))~R.This is done by a threefold induction: first on M, second on N(r,M)~Rand third on the length of ~R. We need to consider all possible reductsof +rM(v.N(x, v))~R. In case of an outer -reduction it must reduce toN(r,M)~R, hence the result by assumption. If M is reduced, use the firstinduction hypothesis. Reductions in N(x, v) and in ~R as well as permutativereductions within ~R are taken care of by the second induction hypothesis.The only remaining case is when ~R = S~S and (v.N(x, v)) is permuted withS, to yield +rM(v.N(x, v)S)~S, in which case Apply the third inductionhypothesis applies.

For later use we prove a slightly generalized form of the rule (Varpi):

Proposition. If M(v.NR)~S SN, then M(v.N)R~S SN.Proof. Induction on the generation of M(v.NR)~S SN. We distin-

guish cases according to the form of M .Case u~T (v.NR)~S SN. If ~T = ~M (i.e., ~T consists of derivation terms

only), use (Varpi). Else we have u ~M(v.N )~R(v.NR)~S SN. This must begenerated by repeated applications of (Varpi) from u ~M(v.N ~R(v.NR)~S) SN, and finally by (Var) from ~M SN and N ~R(v.NR)~S SN. Theinduction hypothesis for the latter fact yields N ~R(v.N)R~S SN, henceu ~M(v.N ~R(v.N)R~S) SN by (Var) and finally u ~M(v.N )~R(v.N)R~S SNby (Varpi).

Case +rM ~T (v.N(x, v)R)~S SN. Similar, with () instead of (Varpi).In detail: If ~T is empty, by () this came from N(r,M)R~S SN andM SN, hence +rM(v.N(x, v))R~S SN again by (). Otherwisewe have +rM(v.N (x, v))~T (v.NR)~S SN. This must be generatedby () from N (r,M)~T (v.NR)~S SN. The induction hypothesis yieldsN (r,M)~T (v.N)R~S SN, hence +rM(v.N (x, v))~T (v.N)R~S SN by().

Case (vM(v))N ~R(w.NR)~S SN. By () this came from N SN and M(N )~R(w.NR)~S SN. But the induction hypothesis yieldsM(N )~R(w.N)R~S SN, hence (vM(v))N ~R(w.N)R~S SN by ().

We show, finally, that every term is in SN and hence is strongly normal-izing. Given the definition of SN we only have to show that SN is closedunder and . But in order to prove this we must prove simultaneouslythe closure of SN under substitution.

Theorem (Properties of SN). For all formulas A,

1.2. NORMALIZATION 23

(a) for all M SN, if M proves A = A0A1 and N SN, then MN SN,(b) for all M SN, if M proves A = xB and N SN, then M(v.N) SN,(c) for all M(v) SN, if NA SN, then M(N) SN.

Proof. Induction on |A|. We prove (a) and (b) before (c), and hencehave (a) and (b) available for the proof of (c). More formally, by inductionon A we simultaneously prove that (a) holds, that (b) holds and that (a),(b) together imply (c).

(a). By side induction on M SN. Let M SN and assume that Mproves A = A0 A1 and N SN. We distinguish cases according to howM SN was generated. For (Var0), (Varpi), () and () use the samerule again.

Case u ~M(v.N ) SN by (Var) from ~M,N SN. Then N N SN byside induction hypothesis for N , hence u ~M(v.N N) SN by (Var), henceu ~M(v.N )N SN by (Varpi).

Case (vM(v))A0A1 SN by () from M SN. Use (); for this weneed to know M(N) SN. But this follows from induction hypothesis (c)for M , since N derives A0.

(b). By side induction on M SN. Let M SN and assume that Mproves A = xB and N SN. The goal is M(v.N) SN. We distinguishcases according to how M SN was generated. For (Varpi), () and ()use the same rule again.

Case u ~M SN by (Var0) from ~M SN. Use (Var).Case (+rM)xA SN by () from M SN. We must show that

+rM(v.N(x, v)) SN. Use (); for this we need to know N(r,M) SN.But this follows from induction hypothesis (c) for N(r, v) (which is in SNby the remark above), since M derives A(r).

Case u ~M(v.N ) SN by (Var) from ~M,N SN. Then N (v.N) SNby side induction hypothesis for N , hence u ~M(v.N (v.N)) SN by (Var)and therefore u ~M(v.N )(v.N) SN by (Varpi).

(c). By side induction onM(v) SN. Let NA SN; the goal isM(N) SN. We distinguish cases according to how M(v) SN was generated. For(), (), () and () use the same rule again, after applying the inductionhypothesis to the premise(es).

Case u ~M(v) SN by (Var0) from ~M(v) SN. Then ~M(N) SN byside induction hypothesis (c). If u 6= v, use (Var0) again. If u = v, we mustshow N ~M(N) SN. Note that N proves A; hence the claim follows from~M(N) SN by (a) with M = N .

Case u ~M(v)(v.N (v)) SN by (Var) from ~M(v), N (v) SN. If u 6= v,use (Var) again. If u = v, we must show N ~M(N)(v.N (N)) SN. Notethat N proves A; hence in case ~M(v) is empty the claim follows from (b)with M = N , and otherwise from (a), (b) and the induction hypothesis.

Case u ~M(v)(v.N (v))R(v)~S(v) SN has been obtained by (Varpi) fromu ~M(v)(v.N (v)R(v))~S(v) SN. If u 6= v, use (Varpi) again. If u = v, fromthe side induction hypothesis we obtain N ~M(N)(v.N (N)R(N))~S(N) SN. Now use the proposition above with M := N ~M(N).

24 1. LOGIC

Corollary. Every derivation term is in SN and therefore strongly nor-malizing.

Proof. Induction on the (first) inductive definition of derivation terms.In cases u, vM and +rM the claim follows from the definition of SN, andin cases MN and M(v.N) from parts (a), (b) of the previous theorem.

1.2.5. On disjunction. Incorporating the full set of rules adds noother technical complications but merely increases the length. For the ener-getic reader, however, we include here the details necessary for disjunction.The conjunction case is entirely straightforward.

We have additional -conversions

+i M(v0.N0, v1.N1) 7 M [vi := Ni] i-conversion.The definition of SN needs to be extended by

M SN (i)+i M SN

~M,N0, N1 SN (Var)u ~M(v0.N0, v1.N1) SN

u ~M(v0.N0R, v1.N1R)~S SN (Var,pi)u ~M(v0.N0, v1.N1)R~S SN

Ni[vi :=M ]~R SN N1i ~R SN M SN (i)+i M(v0.N0, v1.N1)~R SN

The former rules (Var), (Varpi) should then be renamed into (Var), (Var,pi).The lemma above stating that every term in SN is strongly normalizable

needs to be extended by an additional clause:Case (i). We show that Ni[vi :=M ]~R, N1i ~R andM together im-

ply +i M(v0.N0, v1.N1)~R. This is done by a fourfold induction: first onM,second onNi[vi :=M ]~R, N1i ~R, third onN1i ~R and fourth on the lengthof ~R. We need to consider all possible reducts of +i M(v0.N0, v1.N1)~R. Incase of an outer -reduction use the assumption. If M is reduced, use thefirst induction hypothesis. Reductions in Ni and in ~R as well as permutativereductions within ~R are taken care of by the second induction hypothesis.Reductions in N1i are taken care of by the third induction hypothesis. Theonly remaining case is when ~R = S~S and (v0.N0, v1.N1) is permuted withS, to yield (v0.N0S, v1.N1S). Apply the fourth induction hypothesis, since(NiS)[v :=M ]~S = Ni[v :=M ]S~S.

Finally the theorem above stating properties of SN needs an additionalclause:

for all M SN, if M proves A = A0 A1 and N0, N1 SN, thenM(v0.N0, v1.N1) SN.

Proof. The new clause is proved by induction onM SN. LetM SNand assume that M proves A = A0 A1 and N0, N1 SN. The goal isM(v0.N0, v1.N1) SN. We distinguish cases according to how M SN wasgenerated. For (Var,pi), (Var,pi), (), () and (i) use the same ruleagain.

1.2. NORMALIZATION 25

Case u ~M SN by (Var0) from ~M SN. Use (Var).Case (+i M)A0A1 SN by (i) from M SN. Use (i); for this we

need to know Ni[vi := M ] SN and N1i SN. The latter is assumed,and the former follows from main induction hypothesis (with Ni) for thesubstitution clause of the theorem, since M derives Ai.

Case u ~M(v.N ) SN by (Var) from ~M,N SN. For brevity letE := (v0.N0, v1.N1). Then N E SN by side induction hypothesis forN , so u ~M(v.N E) SN by (Var) and therefore u ~M(v.N )E SN by(Var,pi).

Case u ~M(v0.N 0, v1.N 1) SN by (Var) from ~M,N 0, N 1 SN. LetE := (v0.N0, v1.N1). ThenN iE SN by side induction hypothesis forN i , sou ~M(v0.N 0E, v1.N 1E) SN by (Var) and therefore u ~M(v0.N 0, v1.N 1)E SN by (Var,pi).

Clause (c) now needs additional cases, e.g.,Case u ~M(v0.N0, v1.N1) SN by (Var) from ~M,N0, N1 SN. If u 6= v,

use (Var). If u = v, we show N ~M [v := N ](v0.N0[v := N ], v1.N1[v := N ]) SN. Note that N proves A; hence in case ~M empty the claim follows from(b), and otherwise from (a) and the induction hypothesis.

1.2.6. The structure of normal derivations. To analyse normalderivations, it will be useful to introduce the notions of a segment and of atrack in a proof tree, which make sense for non-normal derivations as well.

Definition. A segment of (length n) in a derivation M is a sequenceA1, . . . , An of occurrences of a formula A such that(a) for 1 i < n, Ai is a minor premise of an application of , or ,

with conclusion Ai+1;(b) An is not a minor premise of , or .(c) A1 is not the conclusion of , or .Notice that a formula occurrence (f.o.) which is neither a minor premisenor the conclusion of an application of , or always constitutes asegment of length 1. A segment is maximal or a cut (segment) if An is themajor premise of an E-rule, and either n > 1, or n = 1 and A1 = An is theconclusion of an I-rule.

We use , for segments. is called a subformula of if the formulaA in is a subformula of B in .

The notion of a track is designed to retain the subformula property incase one passes through the major premise of an application of a ,,-rule. In a track, when arriving at an Ai which is the major premise of anapplication of such a rule, we take for Ai+1 a hypothesis discharged by thisrule.

Definition. A track of a derivationM is a sequence of f.o.s A0, . . . , Ansuch that(a) A0 is a top f.o. in M not discharged by an application of an ,,-

rule;(b) Ai for i < n is not the minor premise of an instance of , and either

(i) Ai is not the major premise of an instance of a ,,-rule andAi+1 is directly below Ai, or

26 1. LOGIC

(ii) Ai is the major premise of an instance of a ,,-rule andAi+1 is an assumption discharged by this instance;

(c) An is either(i) the minor premise of an instance of , or(ii) the end formula of M , or(iii) the major premise of an instance of a ,,-rule in case there

are no assumptions discharged by this instance.

Lemma. In a derivation each formula occurrence belongs to some track.

Proof. By induction on derivations. For example, suppose a derivationK ends with an -application:

|MxA

[u : A]| NB x, u

B

B in N belongs to a track pi (induction hypothesis); either this does notstart in u : A, and then pi,B is a track in K which ends in the end formula;or pi starts in u : A, and then there is a track pi inM (induction hypothesis)such that pi, pi, B is a track in K ending in the end formula. The other casesare left to the reader.

Definition. A track of order 0, or main track , in a derivation is atrack ending either in the end formula of the whole derivation or in themajor premise of an application of a , or -rule, provided there areno assumption variables discharged by the application. A track of ordern + 1 is a track ending in the minor premise of an -application, withmajor premise belonging to a track of order n.

A main branch of a derivation is a branch pi (i.e., a linearly orderedsubtree) in the proof tree such that pi passes only through premises of I-rules and major premises of E-rules, and pi begins at a top node and endsin the end formula.

Since by simplification conversions we have removed every applicationof an , or -rule that discharges no assumption variables, each trackof order 0 in a normal derivation is a track ending in the end formula ofthe whole derivation. Note also that if we search for a main branch goingupwards from the end formula, the branch to be followed is unique as longas we do not encounter an +-application. Now let us consider normalderivations. Recall the notion of a strictly positive part of a formula, definedin 1.1.3.

Proposition. Let M be a normal derivation, and let pi = 0, . . . , n bea track in M . Then there is a segment i in pi, the minimum segment orminimum part of the track, which separates two (possibly empty) parts of pi,called the E-part ( elimination part) and the I-part ( introduction part) of pisuch that(a) for each j in the E-part one has j < i, j is a major premise of an

E-rule, and j+1 is a strictly positive part of j, and therefore each jis a s.p.p. of 0;

1.2. NORMALIZATION 27

(b) for each j which is the minimum segment or is in the I-part one hasi j, and if j 6= n, then j is a premise of an I-rule and a s.p.p. ofj+1, so each j is a s.p.p. of n.

Proof. By tracing through the definitions.

Theorem (Subformula property). Let M be a normal derivation. Theneach formula occurring in the derivation is a subformula of either the endformula or else an (uncancelled) assumption formula.

Proof. As noted above, each track of order 0 in M is a track endingin the end formula of M . Furthermore each track has an E-part above anI-part. Therefore any formula on a track of order 0 is either a subformulaof the end formula or else a subformula of an (uncancelled) assumption. Wecan now prove the theorem for tracks of order n, by induction on n. Soassume the result holds for tracks of order n. If A is any formula on a trackof order n + 1, either A lies in the E-part in which case it is a subformulaof an assumption, or else it lies in the I-part and is therefore a subformulaof the minor premise of an whose main premise belongs to a track oforder n. In this case A is a subformula of a formula on a track of order nand we can apply the induction hypothesis.

Theorem (Disjunction property). If no strictly positive part of a for-mula in is a disjunction, then ` A B implies ` A or ` B.

Proof. Consider a normal derivation M of A B from assumptions not containing a disjunction as s.p.p. The end formula A B is thefinal formula of a (main) track. If the I-part of this track is empty, thenthe structure of main tracks ensures that A B would be a s.p.p. of anassumption in , but this is not allowed. Hence A B lies in the I-partof a main track. If above A B this track goes through a minor premiseof an , then the major premise would again be a disjunctive s.p.p. of anassumption, which is not allowed. Thus A B belongs to a segment withinthe I-part of the track, above which there can only be finitely many and followed by an +i . Its premise is either A or B, and therefore we canreplace the segment of ABs by a segment of As or a segment of Bs, thustransforming the proof into either a proof into either a proof of A or a proofof B.

There is a similar theorem for the existential quantifier:

Theorem (Explicit definability under hypotheses). If no strictly pos-itive part of a formula in is existential, then ` xA(x) implies `A(r1) A(rn) for some terms r1, . . . , rn. If in addition no s.p.p. of aformula in is disjunctive then ` xA(x) implies there is even a singleterm r such that ` A(r).

Proof. Consider a normal derivation M of xA(x) from assumptions not containing an existential s.p.p. We use induction on the derivation,and distinguish cases on the last rule.

28 1. LOGIC

By assumption the last rule cannot be , using a similar argument tothe above. Again as before, the only critical case is when the last rule is .

|MB C

[u : B]| N0

xA(x)

[v : C]| N1

xA(x) u, vxA(x)By assumption again neither B nor C can have an existential s.p.p. Applyingthe induction hypothesis to N0 and N1 we obtain

|MB C

[u : B]|n

i=1A(ri) +n+mi=1 A(ri)

[v : C]|n+m

i=n+1A(ri) +n+mi=1 A(ri) u, vn+m

i=1 A(ri)

The remaining cases are left to the reader.The second part of the theorem is proved similarly; by assumption the

last rule can be neither nor , so it may be an . In that case there isonly one minor premise and so no need to duplicate instances of A(x).

1.3. Soundness and Completeness for Tree Models

It is an obvious question to ask whether the logical rules we have beenconsidering suffice, i.e., whether we have forgotten some necessary rules. Toanswer this question we first have to fix the meaning of a formula, i.e., pro-vide a semantics. This will be done by means of the tree models introducedby Beth (1956). Using this concept of a model we will prove soundness andcompleteness.

1.3.1. Tree models. Consider a finitely branching tree of possibleworlds. The worlds are represented as nodes in this tree. They may bethought of as possible states such that all nodes above a node k are theways in which k may develop in the future. The worlds are increasing, thatis, if an atomic formula R~s is true in a world k, then R~s is true in all futureworlds k.

More formally, each tree model is based on a finitely branching tree T . Anode k over a set S is a finite sequence k = a0, a1, . . . , an1 of elements ofS; lh(k) is the length of k. We write k k if k is an initial segment of k. Atree on S is a set of nodes closed under initial segments. A tree T is finitelybranching if every node in T has finitely many immediate successors. A treeT is infinite if for every n N there is a node k T such that lh(k) = n.A branch of T is a linearly ordered subtree of T . A leaf is a node withoutsuccessors in T .

For the proof of the completeness theorem, the completeness tree over{0, 1} (whose branches constitute Cantor space) will suffice. The nodes willbe all the finite sequences of 0s and 1s, and the ordering is as above. Theroot is the empty sequence and k0 is the sequence k with the element 0added at the end; similarly for k1.

1.3. SOUNDNESS AND COMPLETENESS FOR TREE MODELS 29

For the rest of this section, fix a countable formal language L.Definition. Let T be a finitely branching tree. A tree model on T is a

triple T = (D, I0, I1) such that(a) D is a nonempty set;(b) for every n-ary function symbol f (in the underlying language L), I0

assigns to f a map I0(f) : Dn D;(c) for every n-ary relation symbol R and every node k T , I1(R, k) Dn

is assigned in such a way that monotonicity is preserved:

k k I1(R, k) I1(R, k).If n = 0, then I1(R, k) is either true or false. There is no special re-

quirement set on I1(, k). (Recall that minimal logic places no particularconstraints on falsum .) We write RT (~a, k) for ~a I1(R, k), and |T | todenote the domain D.

It is obvious from the definition that any tree T can be extended to acomplete tree T without leaves, in which for every leaf k T all sequencesk0, k00, k000, . . . are added to T . For every node k0 . . . 0, we then addI1(R, k0 . . . 0) := I1(R, k).

An assignment (or variable assignment) in D is a map assigning toevery variable x dom() a value (x) D. Finite assignments will bewritten as [x1 := a1, . . . , xn := an] or else as [a1/x1, . . . , an/xn], with distinctx1, . . . , xn. If is an assignment in D and a D, let ax be the assignmentin D mapping x to a and coinciding with elsewhere:

ax(y) :=

{(y), if y 6= xa, if y = x.

Let a tree model T = (D, I0, I1) and an assignment in D be given. Wedefine a homomorphic extension of (denoted by as well) to terms t whosevariables lie in dom() by

(c) := I0(c),

(f(t1, . . . , tn)) := I0(f)((t1), . . . , (tn)).

Observe that the extension of depends on T ; we often write tT [] for (t).Definition. T , k A[] (T forces A at node k for an assignment ) is

defined inductively. We write k A[] when it is clear from the context whatthe underlying model T is, and knkA for kk(lh(k) = lh(k) + n A).

k (R~s )[] := nknkRT (~sT [], k)k (A B)[] := nknk(k A[] k B[])k (xA)[] := nknka|T |(k A[ax])k (A B)[] := kk(k A[] k B[])k (A B)[] := k A[] k B[]k (xA)[] := a|T |(k A[ax]).

Thus in the atomic, disjunctive and existential cases, the set of k whoselength is lh(k) + n acts as a bar in the complete tree. Note that the im-plicational case is treated differently, and refers to the unbounded future.

30 1. LOGIC

In this definition, the logical connectives ,,,, on the left handside are part of the object language, whereas the same connectives on theright hand side are to be understood in the usual sense: they belong tothe metalanguage. It should always be clear from the context whether aformula is part of the object or the metalanguage.

1.3.2. Covering lemma. It is easily seen (using the definition andmonotonicity) that from k A[] and k k we can conclude k A[].The converse is also true:

Lemma (Covering).

knk(k A[]) k A[].Proof. Induction on A. We write k A for k A[].Case R~s. Assume

knk(k R~s ),hence by definition

knkmkmkRT (~sT [], k).Since T is a finitely branching tree,

mkmkRT (~sT [], k).Hence k R~s.

The cases A B and xA are handled similarly.Case A B. Let k A B for all k k with lh(k) = lh(k) + n.

We showlk(l A l B).

Let l k and l A. We must show l B. To this end we apply theinduction hypothesis to B and m := max(lh(k) + n, lh(l)). So assume l land lh(l) = m. It is sufficient to show l B. If lh(l) = lh(l), then l = land we are done. If lh(l) = lh(k) + n > lh(l), then l is an extension of l aswell as of k and has length lh(k)+n, and hence l A B by assumption.Moreover, l A, since l l and l A. It follows that l B.

The cases A B and xA are easy. 1.3.3. Soundness.

Lemma (Coincidence). Let T be a tree model, t a term, A a formulaand , assignments in |T |.(a) If (x) = (x) for all x vars(t), then (t) = (t).(b) If (x) = (x) for all x FV(A), then T , k A[] if and only ifT , k A[].Proof. Induction on terms and formulas. Lemma (Substitution). Let T be a tree model, t, r terms, A a formula

and an assignment in |T |. Then(a) (r(t)) = (t)x (r(x)).(b) T , k A(t)[] if and only if T , k A(x)[(t)x ].

Proof. Induction on terms and formulas.

1.3. SOUNDNESS AND COMPLETENESS FOR TREE MODELS 31

Theorem (Soundness). Let {A} be a set of formulas such that ` A.Then, if T is a tree model, k any node and an assignment in |T |, it followsthat T , k [] implies T , k A[].

Proof. Induction on derivations.We begin with the axiom schemes +0 , +1 , , +, , + and .

k C[] is abbreviated k C, when is known from the context.Case +0 : A AB. We show k A AB. Assume for k k that

k A. Show: k A B. This follows from the definition, since k A.The case +1 : B A B is symmetric.

Case : A B (A C) (B C) C. We show thatk A B (A C) (B C) C. Assume for k k thatk A B, k A C and k B C (we can safely assume that kis the same for all three premises.) Show that k C. By definition, thereis an n s.t. for all k n k, k A or k B. In both cases it followsthat k C, since k A C and k B C. By the covering lemma,k C.

The cases +, are easy.Case + : A xA. We show k (A xA)[]. Assume k k and

k A[]. We show k (xA)[]. Since = (x)x there is an a |T |(namely a := (x)) such that k A[ax]. Hence, k (xA)[].

Case : xA x(A B) B and x / FV(B). We show thatk (xA x(A B) B)[]. Assume that k k and k (xA)[]and k x(A B)[]. We show k B[]. By definition, there isan n such that for all k n k we have a |T | and k A[ax]. Fromk x(A B)[] it follows that k B[ax], and since x / FV(B), fromthe coincidence lemma, k B[]. Then, finally, by the covering lemmak B[].

This concludes the treatment of the axioms. We now consider the rules.In case of the assumption rule u : A we have A and the claim is obvious.

Case +. Assume k . We show k A B. Assume k k andk A. Our goal is k B. We have k {A}. Thus, k B byinduction hypothesis.

Case . Assume k . The induction hypothesis gives us k A Band k A. Hence k B.

Case +. Assume k [] and x / FV(). We show k (xA)[], i.e.,k A[ax] for an arbitrary a |T |. We have

k [ax] by the coincidence lemma, since x / FV()k A[ax] by induction hypothesis.

Case . Let k []. We show that k A(t)[]. This follows fromk (xA(x))[] by induction hypothesisk A(x)[(t)x ] by definitionk A(t)[] by the substitution lemma.

This concludes the proof. 1.3.4. Counter models. With soundness at hand, it is easy to build

counter models for derivations not valid in minimal or intuitionistic logic. A

32 1. LOGIC

tree model for intuitionistic logic is a tree model T = (D, I0, I1) in which is never forced, and consequently T , Efq. This is equivalent to sayingI1(, k) is false for all k.

Lemma. Given any tree model T , T (k) is false at all nodes k if andonly if k 6 for all nodes k.

Proof. Clearly if k 6 then is false at node k. Conversely, supposeT (k) is false at all nodes k. We must show k(k 6 ). Let k be given.Then, since T (k) is false at all nodes k, is is certainly false at somek n k, for every n. This means k 6 by definition.

Therefore by unravelling the implication clause in the forcing definition,one sees that in any tree model for intuitionistic logic,

(k A) kk(k 6 A),(k A) kk(k 6 A)

kkkk(k A).As an example we show that 6`i P P . We describe the desired

tree model by means of a diagram below. Next to every node we write allpropositions forced at that node.

@@

P @@

P @@

P ..

.

This is a tree model because monotonicity clearly holds. Observe also thatI1(, k) is false at all nodes k. Hence this is an intuitionistic tree model, andmoreover 6 P . Using the remark above, it is easily seen that P .Thus 6 (P P ) and hence 6`i (P P ). The model also shows thatthe Peirce formula ((P Q) P ) P is not derivable in intuitionisticlogic.

As another example we show that the drinker formula x(Px xPx)from 1.1.8 is intuitionistically underivable, using a quite different tree model.In this case the underlying tree is the full binary one, i.e., its nodes are thefinite sequences k = i0, i1, . . . , in1 of numbers 0 or 1. For the languagedetermined by and a unary predicate symbol P consider T := (D, I1)with I1(, k) false, D := N andI1(P, i0, . . . , in1) := { a D | i0, . . . , in1 contains at least a zeros }.

Cleary T is an intuitionistic tree model (monotonicity is easily checked),k 6 xPx for every k, and a,klk(l Px[x := a]). Therefore

a,k(k 6 (Px xPx)[x := a]) x(Px xPx).

Hence 6`i x(Px xPx).

1.3. SOUNDNESS AND COMPLETENESS FOR TREE MODELS 33

1.3.5. Completeness.

Theorem (Completeness). Let {A} be a set of formulas. Then thefollowing propositions are equivalent.(a) ` A.(b) A, i.e., for all tree models T , nodes k and assignments

T , k [] T , k A[].Proof. Soundness already gives (a) implies (b). For the other direc-

tion we employ a technique due to Harvey Friedman and construct a treemodel T (over the set T01 of all finite 0-1-sequences) whose domain D is theset of all terms of the underlying language, with the property that ` Bis equivalent to T , B[id]. We can assume here that and also A areclosed.

In order to define T , we will need an enumeration A0, A1, A2, . . . of theunderlying language L (assumed countable), in which every formula occursinfinitely often. We also fix an enumeration x0, x1, . . . of distinct variables.Since is countable it can we written =

n n with finite sets n such

that n n+1. With every node k T01, we associate a finite set k offormulas and a set Vk of variables, by induction on the length of k.

Let := and V := . Take a node k such that lh(k) = n andsuppose that k, Vk are already defined. Write `n B to mean that thereis a derivation of length n of B from . We define k0, Vk0 and k1, Vk1as follows:

Case 0. FV(An) 6 Vk. Then letk0 := k1 := k and Vk0 := Vk1 := Vk.

Case 1. FV(An) Vk and n,k 6`n An. Letk0 := k and k1 := k {An},Vk0 := Vk1 := Vk.

Case 2. FV(An) Vk and n,k `n An = An An. Letk0 := k {An, An} and k1 := k {An, An},Vk0 := Vk1 := Vk.

Case 3. FV(An) Vk and n,k `n An = xAn(x). Letk0 := k1 := k {An, An(xi)} and Vk0 := Vk1 := Vk {xi},

where xi is the first variable / Vk.Case 4. FV(An) Vk and n,k `n An, with An neither a disjunction

nor an existentially quantified formula. Let

k0 := k1 := k {An} and Vk0 := Vk1 := Vk.Obviously FV(k) Vk, and k k implies that k k . Notice

also that because of ` x( ) and the fact that this formula is repeatedinfinitely often in the given enumeration, for every variable xi there is an msuch that xi Vk for all k with lh(k) = m.

We note that

(1.7) knk (,k ` B) ,k ` B, provided FV(B) Vk.

34 1. LOGIC

It is sufficient to show that, for FV(B) Vk,(,k0 ` B) (,k1 ` B) (,k ` B).

In cases 0, 1 and 4, this is obvious. For case 2, the claim follows imme-diately from the axiom schema . In case 3, we have FV(An) Vk andn,k `n An = xAn(x). Assume ,k {An, An(xi)} ` B with xi / Vk,and FV(B) Vk. Then xi / FV(k {An, B}), hence ,k {An} ` Bby and therefore ,k ` B.

Next, we show

(1.8) ,k ` B nknk (B k), provided FV(B) Vk.Choose n lh(k) such that B = An and n,k `n An. For all k k, iflh(k) = n+ 1 then An k (cf. the cases 2-4).

Using the sets k we can define a tree model T as (Ter, I0, I1) whereTer denotes the set of terms of the underlying language, I0(f)(~s ) := f~s and

RT (~s, k) = I1(R, k)(~s ) := R~s k.Obviously, tT [id] = t for all terms t.

Now write k B for T , k B[id]. We show:Claim. ,k ` B k B provided FV(B) Vk.The proof is by induction on B.Case R~s. Assume FV(R~s ) Vk. The following are equivalent.

,k ` R~snknk (R~s k) by (1.8) and (1.7)nknk RT (~s, k) by definition of Tk R~s by definition of , since tT [id] = t.

Case B C. Assume FV(B C) Vk. For the implication let,k ` B C. Choose an n lh(k) such that n,k `n An = B C.Then, for all k k s.t. lh(k) = n,

k0 = k {B C,B} and k1 = k {B C,C},and therefore by induction hypothesis

k0 B and k1 C.Then by definition, we have k BC. For the reverse implication argueas follows.

k B Cnknk(k B k C)nknk((,k ` B) (,k ` C)) by induction hypothesisnknk (,k ` B C),k ` B C by (1.7).

Case B C is evident.Case B C. Assume FV(B C) Vk. For let ,k ` B C.

We must show k B C, i.e.,kk(k B k C).

1.3. SOUNDNESS AND COMPLETENESS FOR TREE MODELS 35

Let k k be such that k B. By induction hypothesis, it follows that,k ` B, and ,k ` C follows by assumption. Then again by inductionhypothesis k C.

For let k B C, i.e., kk(k B k C). We show that,k ` B C, using (1.7). Choose n lh(k) such that B = An. For allk m k with m := n lh(k) we show that ,k ` B C.

If ,k `n An, then k B by induction hypothesis, and k Cby assumption. Hence ,k ` C again by induction hypothesis and thus,k ` B C.

If ,k 6`n An, then by definition k1 = k{B}. Hence ,k1 ` B,and thus k1 B by induction hypothesis. Now k1 C by assumption,and finally ,k1 ` C by induction hypothesis. From k1 = k {B} itfollows that ,k ` B C.

Case xB(x). Assume FV(xB(x)) Vk. For let ,k ` xB(x).Fix a term t. Then ,k ` B(t). Choose n such that FV(B(t)) Vk for allk n k. Then knk (,k ` B(t)), hence knk (k B(t)) by inductionhypothesis, hence k B(t) by the covering lemma. This holds for everyterm t, hence k xB(x).

For assume k xB(x). Pick k n k such that Am = x( ),for m := lh(k) + n. Then at height m we put some xi into the variablesets: for k n k we have xi / Vk but xi Vkj . Clearly kj B(xi),hence ,kj ` B(xi) by induction hypothesis, hence (since at this heightwe consider the trivial formula x( )) also ,k ` B(xi). Sincexi / Vk we obtain ,k ` xB(x). This holds for all k n k, hence,k ` xB(x) by (1.7).

Case xB(x). Assume FV(xB(x)) Vk. For let ,k ` xB(x).Choose an n lh(k) such that n,k `n An = xB(x). Then, for all k kwith lh(k) = n

k0 = k1 = k {xB(x), B(xi)}where xi / Vk . Hence by induction hypothesis for B(xi) (applicable sinceFV(B(xi)) Vkj for j = 0, 1)

k0 B(xi) and k1 B(xi).It follows by definition that k xB(x).

For assume k xB(x). Then knktTer (k B(x)[idtx]) for somen, hence knktTer (k B(t)). For each of the finitely many k n k pickan m such that kmk (FV(B(tk)) Vk). Let m0 be the maximum of allthese m. Then

km0+nktTer ((k B(t)) FV(B(t)) Vk).The induction hypothesis for B(t) yields

km0+nktTer (,k ` B(t))km0+nk (,k ` xB(x)),k ` xB(x) by (1.7)

and this completes the proof of the claim.Now we can finish the proof of the completeness theorem by showing (b)

implies (a). We apply (b) to the tree model T constructed above from ,

36 1. LOGIC

the empty node and the assignment = id. Then T , [id] by theclaim (since each formula in is derivable from ). Hence T , A[id] by(b) and therefore ` A by the claim again.

Completeness of intuitionistic logic follows as a corollary.

Corollary. Let {A} be a set of formulas. The following proposi-tions are equivalent.

(a) `i A.(b) ,Efq A, i.e., for all tree models T for intuitionistic logic, nodes k

and assignments

T , k [] T , k A[].

1.4. Soundness and Completeness of the Classical Fragment

We give a proof of completeness of classical logic relying on the com-pleteness proof for minimal logic above.

1.4.1. Models. We define the notion of a (classical) model (or moreaccurately, L-model), and what the value of a term and the meaning ofa formula in a model should be. The latter definition is by induction onformulas, where in the quantifier case we need a quantifier in the definition.

For the rest of this section, fix a countable formal language L; we do notmention the dependence on L in the notation. Since we deal with classicallogic, we only consider formulas built without ,.

Definition. A model is a tripleM = (D, I0, I1) such that(a) D is a nonempty set;(b) for every n-ary function symbol f , I0 assigns to f a map I0(f) : Dn D;(c) for every n-ary relation symbol R, I1 assigns to R an n-ary relation on

Dn. In case n = 0, I1(R) is either true or false. We require that I1()is false.

We write |M| for the carrier set D ofM and fM, RM for the interpre-tations I0(f), I1(R) of the function and relation symbols. Assignments and their homomorphic extensions are defined as in 1.3.1. Again we writetM[] for (t).

Definition (Validity). For every model M, assignment in |M| andformula A such that FV(A) dom() we defineM |= A[] (read: A is validinM under the assignment ) by induction on A.

M |= (R~s )[] := RM(~sM[]),M |= (A B)[] := ((M |= A[]) (M |= B[])),M |= (A B)[] := ((M |= A[]) (M |= B[])),M |= (xA)[] := a|M|(M |= A[ax]).

Since I1() is false, we haveM 6|= [].

1.4. SOUNDNESS AND COMPLETENESS OF THE CLASSICAL FRAGMENT 37

1.4.2. Soundness of classical logic.

Lemma (Coincidence). Let M be a model, t a term, A a formula and, assignments in |M|.(a) If (x) = (x) for all x vars(t), then (t) = (t).(b) If (x) = (x) for all x FV(A), then M |= A[] if and only if M |=

A[].

Proof. Induction on terms and formulas.

Lemma (Substitution). LetM be a model, t, r terms, A a formula and an assignment in |M|. Then(a) (r(t)) = (t)x (r(x)).(b) M |= A(t) if and only ifM |= A(x)[(t)x ].

Proof. Induction on terms and formulas.

A model M is called classical if RM(~a ) RM(~a ) for all relationsymbols R and all ~a |M|. We prove that every formula derivable inclassical logic is valid in an arbitrary classical model.

Theorem (Soundness of classical logic). Let {A} be a set of formulassuch that `c A. Then, if M is a classical model and an assignment in|M|, it follows thatM |= [] impliesM |= A[].

Proof. Induction on derivations. We begin with the axioms in Staband the axiom schemes +, . M |= C[] is abbreviatedM |= C when is known from the context.

For the stability axiom ~x(R~x R~x ) the claim follows from ourassumption that M is classical, i.e., RM(~a ) RM(~a ) for all ~a |M|.The axioms +, are clearly valid.

This concludes the treatment of the axioms. We now consider the rules.In case of the assumption rule u : A we have A and the claim is obvious.

Case +. Assume M |= . We show M |= (A B). So assume inaddition M |= A. We must show M |= B. By induction hypothesis (with {A} instead of ) this clearly holds.

Case . Assume M |= . We must show M |= B. By inductionhypothesis, M |= (A B) and M |= A. The claim follows from thedefinition of |=.

Case +. AssumeM |= [] and x / FV(). We showM |= (xA)[],i.e.,M |= A[ax] for an arbitrary a |M|. We have

M |= [ax] by the coincidence lemma, since x / FV()M |= A[ax] by induction hypothesis.

Case . LetM |= []. We show thatM |= A(t)[]. This follows fromM |= (xA(x))[] by induction hypothesisM |= A(x)[(t)x ] by definitionM |= A(t)[] by the substitution lemma.

This concludes the proof.

38 1. LOGIC

1.4.3. Completeness of classical logic. We give a constructive anal-ysis of the completeness of classical logic by using, in the metatheory below,constructively valid arguments only, mentioning explicitly any assumptionswhich go beyond. When dealing with the classical fragment we of courseneed to restrict to classical models. The only non-constructive principlewill be the use of the axiom of dependent choice for the weak existentialquantifier

xA(0, x) n,x(A(n, x) yA(n+ 1, y)) fnA(n, fn).Recall that we only consider formulas without ,.

Theorem (Completeness of classical logic). Let {A} be a set offormulas. Assume that for all classical modelsM and assignments ,

M |= []M |= A[].Then there must exist a derivation of A from Stab.

Proof. Since there must exist a derivation expresses the weak ex-istential quantifier in the metalanguage, we need to prove a contradictionfrom the assumption ,Stab 6` A.

By the completeness theorem for minimal logic, there must be a treemodel T = (Ter, I0, I1) on the complete binary tree T01 and a node l0 suchthat l0 ,Stab and l0 6 A.

Call a node k consistent if k 6 , and stable if k Stab. We prove(1.9) k 6 B kk(k B k 6 ) (k stable).Let k be a stable node, and B a formula (without , ). Then Stab `B B by the stability lemma, and therefore k B B. Hencefrom k 6 B we obtain k 6 B. By a remark in 1.3.4 this implies thatkk(k B k ), which proves (1.9).

Let be a branch in the underlying tree T01. We define

A := k(k A), is consistent := 6 , is stable := k(k Stab).

Note that from ~A and ` ~A B it follows that B. To see this,consider ~A. Then k ~A for a k , since is linearly ordered. From` ~A B it follows that k B, i.e., B.

A branch is generic (in the sense that it generates a classical model)if it is consistent and stable, if in addition for all formulas B

(1.10) ( B) ( B),and if for all formulas ~yB(~y ) with B(~y ) not a universal formula,(1.11) ~sTer( B(~s )) ~yB(~y ).For a branch , we define a classical modelM = (Ter, I0, I1 ) as

I1 (R)(~s ) := kI1(R, k)(~s ) (R 6= ).Since is used in this definition,M is stable.

1.4. SOUNDNESS AND COMPLETENESS OF THE CLASSICAL FRAGMENT 39

We show that for every generic branch and formula B (without , )(1.12) B M |= B.The proof is by induction on the logical complexity of B.

Case R~s with R 6= . Then (1.12) holds for all .Case . We have 6 since is consistent.Case B C. Let B C and M |= B. We must show that

M |= C. Note that B by induction hypothesis, hence C, henceM |= C again by induction hypothesis. Conversely let M |= B C.Clearly (M |= B) (M 6|= B). If M |= B, then M |= C. Hence C by induction hypothesis and therefore B C. If M 6|= Bthen 6 B by induction hypothesis. Hence B by (1.10) and therefore B C, since is stable (and ` (C C) C). [Note that forthis argument to be contructively valid one needs to observe that the formula B C is a negation, and therefore we can argue by the case distinctionbased on . This is because, with P1 := M |= B, P2 := M 6|= B andQ := B C, the formula (P1 P2) (P1 Q) (P2 Q) Q isderivable in minimal logic.]

Case B C. Easy.Case ~yB(~y ) (~y not empty) where B(~y ) is not a universal formula. The

following are equivalent.

~yB(~y )~sTer( B(~s )) by (1.11)~sTer(M |= B(~s )) by induction hypothesisM |= ~yB(~y ).

This concludes the proof of (1.12).Next we show that for every consistent and stable node k there must be

a generic branch containing k:

(1.13) k 6 k Stab ( generic k ).For the proof, let A0, A1, . . . enumerate all formulas. We define a sequencek = k0 k1 k2 . . . of consistent stable nodes by dependent choice. Letk0 := k. Assume that kn is defined. We write An in the form ~yB(~y ) (with~y possibly empty) where B is not a universal formula. In case kn ~yB(~y )let kn+1 := kn. Otherwise we have kn 6 B(~s ) for some ~s, and by (1.9) theremust be a consistent node k kn such that k B(~s ). Let kn+1 := k.Since kn kn