The formula A(x) to which (R8a) has been applied at line (2) is d = x.

14.2 Soundness and Completeness

Let us now begin the proof of soundness, Theorem 14.1, according to which every derivable sequent is secure. We start with the observation that every (R0) sequent { A} { A} is clearly secure. It will then suffice to show that each rule (R1)–(R9) is sound in the sense that when applied to secure premisses it yields secure conclusions.

Consider, for instance, an application of (R1). Suppose is secure, where is a subset of and is a subset of , and consider any interpretation that makes all the sentences in true. What (R1) requires is that it should make some sentence in true, and we show that it does as follows. Since is a subset of , it makes all the sentences in true, and so by the security of it makes some sentence in

true and, since is a subset of , thereby makes some sentence of true. Each of the rules (R2)–(R9) must now be checked in a similar way. Since this proof

is perhaps the most tedious in our whole subject, it may be well to remark in advance that it does have one interesting feature. The feature is this: that as we argue for the soundness of the formal rules, we are going to find ourselves using something like the unformalized counterparts of those very rules in our argumentation. This means that a mathematical heretic who rejected one of another of the usual patterns of argument as employed in unformalized proofs in orthodox mathematics—and there have been benighted souls who have rejected the informal counterpart of (R9), for example— would not accept our proof of the soundness theorem. The point of the proof is not to convince such dissenters, but merely to check that, in putting everything into symbols, we have not made some slip and allowed some inference that, stated in unformalized terms, we ourselves would recognize as fallacious. (This is a kind of mistake that it is not hard to make, especially over the side conditions in the quantifier rule, and it is one that has been made in the past in some textbooks.) This noted, let us now return to the proof.

Consider (R2a). We suppose { A} is secure, and consider any interpretation that makes all the sentences in true. What (R2a) requires is that it should make some sentence in { A} true, and we show it does as follows. On the one hand, if the given interpretation also makes A true, then it makes all the sentences in{ A} true, and therefore by the security of { A} makes some sentence intrue, and therefore makes some sentence in { A} true. On the other hand, if the interpretation does not make A true, then it makes A true, and therefore it again makes some sentence in { A} true.

Consider (R2b). We suppose { A} is secure, and consider any interpretation making all sentences in { A} true. What (R2b) requires is that it should make some sentence in true, and we show it does as follows. The given interpretation makes all sentences in true, and so by the security of { A} makes some sentence in { A} true. But since the interpretation makes A true, it does not make A true, so it must be that it makes some sentence in true.

For (R3), we suppose that { A, B} is secure, and consider any interpretation making all sentences in true. By the security of { A, B} the interpretation makes some sentence in { A, B} true. This sentence must be either A or B or some sentence in . If the sentence is A or B, then the interpretation makes (A B) true, and so makes a sentence in {(A B)} true. If the sentence is one of those in , then clearly the interpretation makes a sentence in {(A B)} true. So in any case, some sentence in {(A B)} is made true, which is what (R3) requires.

For (R4), we suppose that { A} and {B} are secure, and consider any interpretation that makes all sentences in {(A B)} true. The interpretation in particular makes (A B) true, and so it must either make A true or make B true. In the former case it makes all sentences in { A} true, and by the security of{ A} it makes some sentence in true. Similarly in the latter case. So in either case it makes some sentence in true, which is what (R4) requires.

For (R5), we suppose that { A(s)} is secure and consider any interpretation that makes all sentences in true. By the security of { A(s)} it makes some sentence in { A(s)} true. If the sentence is one in , then clearly the interpretation makes some sentence in {x A(x)} true. If the sentence is A(s), then the interpretation makes x A(x) true, and so again the interpretation makes some sentence in {x A(x)} true. This suffices to show that {x A(x)} is secure, which is what (R5) requires.

For (R6), we suppose that { A(c)} is secure and consider any interpretation making all sentences in {x A(x)} true. Since the interpretation makes x A(x) true, there is some element i in the domain of the interpretation that satisfies A(x). If c does not occur in or or A(x), then while leaving the denotations of all symbols that occur in and and A(x) unaltered, we can alter the interpretation so that the denotation of c becomes i. By extensionality, in the new interpretation every sentence in will still be true, i will still satisfy A(x) in the new interpretation, and every sentence in will have the same truth value as in the old interpretation. But since i is now the denotation of c, and i satisfies A(x), it follows that A(c) will be true in the new interpretation. And since the sentences in are still true and A(c) is now true, by the security of { A(c)} , some sentence in true will be true in the

176 PROOFS AND COMPLETENESS

new interpretation and hence will have been true in old interpretation. This suffices to show that { x A(x)} is secure.

For (R7), we suppose {s = s} is secure, and consider any interpretation of a language containing all symbols in and that makes all sentences in true. If there is some symbol in s not occurring in or to which this interpretation fails to assign a denotation, alter it so that it does. The new interpretation will still make every sentence in true by extensionality, and will make s = s true. By the security of {s = s} , the new interpretation will make some sentence in true, and extensionality implies that the original interpretation already made this same sentence in true. This suffices to show that is secure.

For (R8a), we suppose { A(t)} is secure and consider any interpretation making all sentences in {s = t} true. Since it makes every sentence in true, by the security of { A(t)} it must make some sentence in { A(t)} true. If this sentence is one of those in , then clearly the interpretation makes a sentence in { A(s)} true. If the sentence is A(t), then note that since the interpretation makes s = t true, it must assign the same denotation to s and to t, and therefore by the must also make A(s) true by extensionality. Thus again it makes some sentence in { A(s)} true. This suffices to show that {s = t} { A(s)} is secure. (R8b) is entirely similar.

(R9) is just like (R2), to finish the proof of soundness.

Now, for completeness, Theorem 14.2, according to which every secure sequent is derivable. We begin with a quick reduction of the problem. Write for the set of negations of sentences in .

14.14 Lemma. is derivable if and only if is inconsistent.

Proof: If

{C1, . . . , Cm } {D1, . . . , Dn }

is derivable, then

{C1, . . . , Cm , D1} {D2, . . . , Dn } {C1, . . . , Cm , D1, D2} {D3, . . . , Dn }

.

.

.

{C1, . . . , Cm , D1, . . . , Dn }

are derivable by repeated application of (R2b). If the last of these is derivable, then

{C1, . . . , Cm , D2, . . . , Dn } {D1} {C1, . . . , Cm , D3, . . . , Dn } {D1, D2}

.

.

.

{C1, . . . , Cm } {D1, . . . , Dn }

are derivable by repeated application of (R9a).

Since it is easily seen that secures if and only if is unsatisfiable, proving that if secures , then is derivable, which is what we want to do, reduces to showing that any consistent set is satisfiable. (For if secures , thenis unsatisfiable, and supposing we have succeeded in showing that it would be satisfiable if it were consistent, it follows is inconsistent, and so by the preceding lemma is derivable.) By the main lemma of the preceding chapter, in order to show every consistent set is satisfiable, it will suffice to show that the set S of all consistent sets has the satisfiability properties (S0)–(S8). (For any consistent set will by definition belong to S, and what Lemma 13.3 tells us is that if S has the satisfaction properties, then any element of S is satisfiable.) This we now proceed to verify, recalling the statements of properties (S0)–(S8) one by one as we prove S has them.

Consider (S0). This says that if is in S and 0 is a subset of , then 0 is in S. So what we need to prove is that if is not derivable, and 0 is a subset of , then 0 is not derivable. Contraposing, this is equivalent to proving:

(S0) If 0 is derivable, and 0 is a subset of , then is derivable.

We show this by indicating how to extend any given derivation of 0 to a derivation of . In fact, only one more step need be added, as follows:

(Here the three dots represent the earlier steps of the hypothetical derivation of0 .)

For each of (S1)–(S8) we are going to give a restatement, in contraposed form, of what is to be proved, and then show how to prove it by extending a given derivation to a derivation of the sequent required. First (S1)

(S1) If A and A are both in , then is derivable.

The hypothesis may be restated as saying that { A, A} is a subset of . We then have

As for (S2), literally, this says that:

(S2) If is not derivable and B is in , then {B} is not derivable.

Contraposing, this says that if {B} is derivable and B is in , thenis derivable. What we actually show is that if {B} is derivable, then