Samuel R. Buss. Department of Mathematics. January 27, Abstract. -formulas disjoined with arbitrary formulas in which the

On Model Theory for Intuitionistic Bounded Arithmetic with Applications to Independence Results Samuel R. Buss Department of Mathematics University of California, San Diego January 27, 1999 Abstract IPV + is IPV (which is essentially IS 1 2 ) with polynomial-induction on b+ 1 -formulas disjoined with arbitrary formulas in which the induction variable does not occur. This paper proves that IPV + is sound and complete with respect to Kripke structures in which every world is a model of CPV (essentially S 1 2 ). Thus IPV is sound with respect to such structures. In this setting, this is a strengthening of the usual completeness and soundness theorems for rst-order intuitionistic theories. Using Kripke structures a conservation result is proved for PV 1 over IPV. Cook-Urquhart and Krajcek-Pudlak have proved independence results stating that it is consistent with IPV and PV that extended Frege systems are super. As an application of Kripke models for IPV, we give a proof of a strengthening of Cook and Urquhart's theorem using the model-theoretic construction of Krajcek and Pudlak. Supported in part by NSF Grant DMS-8902480. 1

1 Introduction An equational theory P V of polynomial time functions was introduced by Cook [4]; a classical rst-order theory S 1 2 for polynomial time computation was developed in Buss [1]; and intuitionistic theories IS 1 2 and IPV for polynomial time computation have been discussed by Buss [2] and by Cook and Urquhart [5]. This paper discusses (a) model theory for the intuitionistic fragments IPV and IPV + of Bounded Arithmetic (IPV is essentially IS 1 2 enlarged to the language of PV) and (b) the relationship between two recent independence results for IPV and CPV. The theories IPV and CPV have the same axioms but are intuitionistic and classical, respectively. Our model theory for IPV and IPV + is a strengthening of the usual Kripke semantics for intuitionistic rst-order logic: we consider Kripke structures in which each \world" is a classical model of CPV. The use of these so-called CPV-normal Kripke structures is in contrast to the usual Kripke semantics which instead require each world to intuitionistically satisfy (or \force") the axioms; the worlds of a CPV-normal Kripke structure must classically satisfy the axioms. The main new results of this paper establish the completeness and soundness of IPV + with respect to CPV-normal Kripke structures. The outline of this paper is as follows: in section 2, the denitions of PV 1, IPV and CPV are reviewed and the theory IPV + is introduced; in section 3, we develop model theory for IPV and IPV + and prove the soundness of these theories with respect to CPV-normal Kripke structures; in section 4 we apply the usual intuitionistic completeness theorem to prove a conservation result of PV 1 over IPV. Section 5 contains the completeness theorem for IPV + with respect to CPV-normal Kripke models. In section 6, we apply the soundness theorem to prove a strengthening of Cook and Urquhart's independence result for IPV and show that this strengthened result implies Krajcek and Pudlak's independence result. 2 The Feasible Theories Cook [4] dened an equational theory PV for polynomial time computation. Buss [1] introduced a rst-order theory S 1 2 with proof-theoretic strength corresponding to polynomial time computation and in which precisely the polynomial time functions could be b 1-dened. There is a very close 2

connection between S 1 2 and PV: let S2(PV) 1 (also called CPV) be the theory dened conservatively over S 1 2 by adding function symbols for polynomial time functions and adding dening equations (universal axioms) for the new function symbols; then S2(PV) 1 is conservative over PV [1]. Buss [2] dened an intuitionistic theory IS 1 2 for polynomial time computation and Cook and Urquhart [5] gave similarly feasible, intuitionistic proof systems PV! and IPV! for feasible, higher-type functionals. This paper will deal exclusively with the following theories, which are dened in more detail in the next paragraphs: (1) PV 1 is PV conservatively extended to rst-order classical logic PV 1 is dened by Krajcek-Pudlak- Takeuti [12] and should not be confused Cook's propositional expansion P V 1 of PV [4], (2) IPV is an intuitionistic theory in the language of PV and is essentially equivalent to IS 1 2, (3) CPV is S 1 2(PV), and (4) the intuitionistic theory IPV + is an extension of IPV and is dened below. We now review the denitions of these four theories it should be noted that our denitions are based on Bounded Arithmetic and not all of them are the historical denitions. Recall that S 1 2 is a classical theory of arithmetic with language 0, S, +,, b 1 2 xc, jxj, # and where jxj = dlog 2(x + 1)e is the length of the binary representation of x and x#y = 2 jxjjyj. A bounded quantier is of the form (Qx t) where t is a term not involving x; a sharply bounded quantier is one of the form (Qx jtj). A bounded formula is a rst-order formula in which every quantier is bounded. The bounded formulas are classied in a syntactic hierarchy b i, b i by counting alternations of bounded quantiers, ignoring sharply bounded quantiers. There is a close connection between this hierarchy of bounded formulas and the polynomial time hierarchy; namely, a set of integers is in the class p i of the polynomial time hierarchy if and only if it is denable by a b i -formula. The theory S 1 2 is axiomatized by some purely universal formulas dening basic properties of the non-logical symbols and by PIND (polynomial induction) on b 1-formulas: A(0) ^ (8x)(A(b 1 xc) A(x)) (8x)A(x) 2 for A any b 1-formula. A function f is b 1-denable in S 1 2 if and only if it is provably total in S 1 2 with a b 1-formula dening the graph of f. In [1] it is shown that a function is b -denable in 1 S1 2 if and only if it is polynomial time computable. Let S2(PV) 1 denote the conservative extension of S 1 2 obtained by adjoining a new function symbol for each polynomial time ( b 1-dened) 3

function. These new function symbols may be used freely in terms in induction axioms. Another name for the theory S 1 2(PV) is CPV and we shall use the latter name for most of this paper. We use b 1(PV) and b 1(PV) to denote hierarchy of classes of bounded formulas in the language of CPV. PV is the equational theory consisting of all (intuitionistic) sequents of atomic formulas provable in S 1 2(P V ), i.e., PV is the theory containing exactly those formulas of the form (r 1 = s 1 ^ ^ r k = s k ) t 1 = t 2 which are consequences of S 1 2 (P V ). PV 1 is the classical, rst-order thoery axiomatized by formulas in PV and is conservative over PV. Equivalently, PV 1 is the theory axiomatized by the b 1(PV)-consequences of S 1 2(P V ) (where b 1(P V ) means provably equivalent to a b 1(PV)- and to a b 1(PV)-formula). Since S 1 2(PV) has a function symbol for each polynomial time function symbol, the use of sharply bounded quantiers is not necessary; in particular, every b 1(PV)-formula is equivalent to a formula of the form (9x t)(r = s): Hence CPV = S 1 2 (PV) may be axiomatized by PIND on formulas in this latter form. IS 1 2 is an intuitionistic theory of arithmetic. A hereditarily b 1 -formula, or H b 1 -formula, is dened to be a formula in which every subformula is a b 1-formula. IS 1 2 is axiomatized like S 1 2 except with PIND restricted to H b 1-formulas. Any function denable in IS 1 2 is polynomial time computable and, conversely, every polynomial time computable function is H b -denable 1 in IS 1 2. Let IPV = IS2(PV) 1 be the conservative extension of IS 1 2 obtained by adjoining every polynomial time function with a H b 1-dening equation. Note IPV and CPV have the same language. An alternative denition of IPV is that it is the intuitionistic theory axiomatized by PV plus PIND for formulas of the form (9x t)(r = s). In this way, IPV and CPV can be taken to have precisely the same axioms; the former is intuitionistic and the latter is classical. The theories IPV and IS 1 2 have the law of the excluded middle for atomic formulas, that is to say, the law of the excluded middle holds for polynomial time computable predicates. This restricted law of excluded middle also applies to the theory IPV + dened next. 4

Denition IPV + is the intuitionistic theory which includes PV and has the PIND axioms for formulas (b; ~c) of the form '(~c) _ (9x t(b;~c))[r(x; b;~c) = s(x; b;~c)] where r, s and t are terms and '(~c) is an arbitrary formula in which the variable b does not occur. The induction axiom is with respect to the variable b and is: (0;~c) ^ (8z)( (b 1 zc;~c) (z;~c)) (8z) (z;~c): 2 Note that IPV + IPV since ' can be taken to be 0 = 1, for instance. In [3] a theory IS 1+ 2 was dened by allowing PIND on H b -formulas 1 where H b 1 -formulas are H b 1 -formulas disjoined with an arbitrary formula in which the induction variable does not occur. It is readily checked that IPV + is equivalent to the theory IS 1+ 2 extended to the language of PV 1 by introducing symbols for all polynomial functions via H b 1-denitions. We use `c and `i for classical and intuitionistic provability, respectively; thus we shall (redundantly) write CPV `c ' and IPV `i ' and IPV + `i '. Whenever we write? `i ' or? `c ', we require that? be a set of sentences; y however, ' may be a formula and may also involve constant symbols not occuring in any formula in?. Denition A positive formula is one in which no negation signs (:) and no implication symbols () appear. If is a positive formula and ' is an arbitrary formula, then ' is the formula obtained from by replacing every atomic subformula of by ( _ '). We do not allow free variables in ' to become bound in ' : this can be done either by using the conventions of the sequent calculus which has distinct sets of free and bound variables or by renaming bound variables in to be distinct from the free variables in '. Theorem 1 Let be a positive formula. If CPV `c : then IPV `i :. Theorem 2 Let be a positive formula and ' be an arbitrary formula. If CPV `c : then IPV + `i ' '. These theorems follow readily from the corresponding facts for S 1 2 and IS 1+ 2 which are proved in Buss [3]. Theorem 2 can be obtained as a corollary to Theorem 1 via Lemma 3.5.3(a) of [15]. y By convention, a rst-order theory is identied with the set of sentences provable in that theory. 5

3 Kripke structures for intuitionistic logic A classical model for PV 1 or CPV is dened as usual for classical rstorder logic using Tarskian semantics. The corresponding semantic notion for intuitionistic rst-order logic is that of a Kripke model. We briey dene Kripke models for IPV and IPV +, a slightly more general denition of Kripke models can be found in the textbook by Troelstra and van Dalen [15]. (Kripke models for IPV are slightly simpler than in the general case since IPV has the law of the excluded middle for atomic formulas.) A Kripke model K for the language of IPV is an ordered pair (fm i g i2i; 4) where fm i g i2i is a set of (not necessarily distinct) classical structures for the language of IPV indexed by elements of the set I and where 4 reexive and transitive binary relation on fm i g i2i. z Furthermore, whenever M i 4 M j then M i is a substructure of M j in that M i is obtainable from M j by restricting functions and predicates to the domain jm i j of M i. The M i 's are called worlds. If ' is a formula and if ~c 2 jm i j then we dene M i j= '(~c), M i classically satises '(~c), as usual, ignoring the rest of the worlds in the Kripke structure. To dene the intuitionistic semantics, M i '(~c), M i forces '(~c), is dened inductively on the complexity of ' as follows: x (1) If ' is atomic, M i ' if and only if M i j= '. (2) If ' is ^ then M i ' if and only if M i and M i. (3) If ' is _ then M i ' if and only if M i or M i. (4) If ' is then M i ' if and only if for all M j < M i, if M j then M j. (5) If ' is : then M i ' if and only if for all M j < M i, M j 1. Alternatively one may dene : to mean? where? is always false (not forced). z Strictly speaking,4 should be a relation on I since the Mi 's may not be distinct. However, we follow standard usage and write 4 as a relation on worlds. x A more proper notation would be (K;Mi) '(~c) or even (K; i) '(~c) but we use the simpler notation Mi '(~c) when K is specied by the context. is a 6

(6) If ' is (9x) (x) then M i ' if and only if there is some b 2 jm i j such that M i (b). (7) If ' is (8x) (x) then M i ' if and only if for all M j < M i and all b 2 jm j j, M j '(b). An immediate consequence of the denition of forcing is that if M i ' and then M j '; this is proved by induction on the complexity of '. M i 4 M j Also, the law of the excluded middle for atomic formulas will be forced at every world M i because we required M i to be a substructure of M j whenever M i 4 M { j. In other words, both truth and falsity of atomic formulas are preserved in \reachable" worlds. Consequently, the law of the excluded middle for quantier-free formulas is also forced at each world. Hence, if ' is quantier-free, then M i ' if and only if M i '. A formula '(~x) is valid in K, denoted K '(~x), if and only if for all worlds M i and all ~c 2 jm i j, M i '(~c). A set of formulas? is valid in K, K?, if and only if every formula in? is valid in K.? ', ' is a Kripke consequence of?, if and only if for every Kripke structure K, if K? then K '. A Kripke model for IPV is one in which the axioms of IPV are valid. Likewise, a Kripke model for IPV + is one in which the axioms of IPV + are valid. The usual strong soundness and completeness theorems for intuitionistic logic state that for any set of sentences? and any sentence ',? ' if and only if? `i ' (see Troelstra and van Dalen [15] for a proof). Hence validity in Kripke models corresponds precisely to intuitionistic provability. A countable Kripke model is one in which there are countably many worlds each with a countable domain. The usual strong completeness theorem further states that if? is a countable set of formulas and? 0 i then there is a countable Kripke structure in which? is valid but is not. The usual strong soundness and completeness theorems give a semantics for the theory IPV in that for any formula ', IPV `i ' if and only if for all K, if K IPV then K '. It is, however, a little dicult to interpret directly what it means for K IPV to hold; and we feel that it is more natural to consider CPV-normal Kripke structures instead: Denition A Kripke model K = (fm i g i2i; 4) is CPV-normal if and only if for all i 2 I, the world M i is a classical model of CPV. { This diers from the usual denition of Kripke models for intuitionistic logic. 7

Theorem 3 (Soundness of IPV and IPV + for CPV-normal Kripke models.) (a) If K is a CPV-normal Kripke structure then K IPV. Hence for all ', if IPV `i ' then K '. (b) If K is a CPV-normal Kripke structure then K IPV +. Hence for all ', if IPV + `i ' then K '. The converse to Theorem 3(b) is proved in section 5 below. Proof It will clearly suce to prove only (b) since IPV + IPV. Suppose K is a CPV-normal Kripke structure. Since every world M i is a classical model of CPV and hence of PV 1, it follows immediately from the denition for forcing and from the fact that P V 1 is axiomatized by universal formulas that K PV 1. So it will suce to show that the PIND axioms of IPV + are valid in K. Let M i be a world and consider a formula '(b;~c) of the form (~c) _ (b;~c) where (b;~c) is a formula of the form (9x t(b;~c))(r(x; b;~c) = s(x; b;~c)) and where b is a variable, ~c 2 jm i j and (~c) is an arbitrary formula not involving b. We must show that M i '(0;~c) ^ (8z)('(b 1 zc;~c) '(z;~c)) (8x)'(x;~c): 2 To prove this, suppose that M i 4 M j and that M j '(0;~c) ^ (8z)('(b 1 zc;~c) '(z;~c)); 2 we must show M j (8x)'(x;~c). If M j (~c) then this is clear, so suppose M j 1 (~c). Note that for any b 2 jm j j, M j (b;~c) if and only if M j (b;~c). Hence, since M j '(0;~c) and M j 1 (~c), M j (0;~c). And similarly, by reexivity of 4, for each b 2 jm j j, if M j (b 1 bc;~c) then 2 M j (b;~c). In other words, M j (8z)((b 1 zc;~c) (z;~c)). But now 2 since M j CPV and CPV has PIND for (b;~c), M j (8z)(z;~c). We have established that either M j (b;~c) for every b 2 jm j j or M j (~c). The same reasoning applies to any world M k < M i and in particular, for any M k < M j, either M k (b;~c) for every b 2 jm k j or M k (~c). Hence by the denition of forcing, M j (8z)'(z;~c). We have shown that if K is a CPV-normal Kripke model then every axiom of IPV + is valid in K. It now follows by the usual soundness theorem for intuitionistic logic that every intuitionistic consequence of IPV + is valid in K. Q.E.D. Theorem 3 8

4 A conservation theorem The usual Godel-Kolmogorov \negative translations" don't seem to apply to IPV since we don't know whether the negative translations of the PIND axioms of IPV are consequences of IPV. However, the usual completeness theorem for Kripke models of IPV does allow us to prove the following substitute: Theorem 4 Let ' be a quantier-free formula. (a) If is a sentence of the form :(9x)(8y):(8z)' and PV 1 `c then IPV `i. (b) If is a sentence of the form :(9x 1 )(8y 1 )::(9x 2 )(8y 2 ):: ::(9x r )(8y r )' and PV 1 `c then IPV `i. This theorem is a statement about how strong IPV is; although IPV has stronger axioms than PV 1, it uses intuitionistic logic instead of classical logic so it makes sense to establish a conservation result for PV 1 over IPV. Of course, at least some of the negation signs in are required for Theorem 4 to be true; for example, PV 1 proves (8x)(9y)(8z)(jzj = x jyj = x) but IPV cannot prove this since otherwise, by the polynomial time realizability of IPV-provable formulas, y would be polynomial time computable in terms of x, which is false since y must be greater than or equal to 2 x?1. Proof Let's prove (1) rst. Suppose IPV 0 i :(9x)(8y):(8z)'; we must show PV 1 0 c (8x)(9y)(8z)'. By the usual completeness theorem for Kripke models for IPV, there is a Kripke model K = (fm i g i2i; 4) of IPV such that K 1 :(9x)(8y):(8z)' and such that each M i is countable. Hence there is a world, say M 0 such that M 0 (9x)(8y):(8z)'. Our stategy is to nd a chain of worlds M 0 4 M 1 4 M 2 4 such that their union is a model of PV 1 and of (9x)(8y)(9z):'. First of all note that each M i PV 1 since IPV includes the (purely universal) axioms of PV 1. Hence S i=0;1;2; M i is a model of PV 1, again because PV 1 has universal axioms. Let x 0 2 jm 0 j be such that M 0 (8y):(8z)'(x 0 ; y; z). It will suce to nd the M i 's so that ( S i2nm i ) (8y)(9z):'(x 0 ; y; z). Suppose we have already picked worlds 9

M 0 ; : : : ; M k?1 and that y k 2 jm k?1j; we pick M k < M k?1 so that for some z k 2 jm k j, M k :'(x 0 ; y k ; z k ), or equivalently, M k :'(x 0 ; y k ; z k ). Such an M k and z k must exist since M 0 (8y):(8z)'(x 0 ; y k ; z k ) and M 0 4 M k?1 and thus M k?1 1 (8z)'(x 0 ; y k ; z). Since each M i is countable, we may choose the y k 's in the right order so that y 1 ; y 2 ; : : : enumerates every element in the union of the M i 's. Thus for every y in the union S i2nm i there is a z such that :'(x 0 ; y; z) holds. That gives a model of PV 1 in which is false, proving (1). The proof of (2) is similar but with more complicated bookkeeping. Let K be a Kripke model of IPV such that is not valid in K. Here if M 0 ; : : : M k?1 have already been chosen and if x k;1 ; : : : ; x k;i?1 and y k;1 ; : : : ; y k;i?1 are in M k?1 so that M k?1 ::(9x i )(8y i ) ::(9x r )(8y r ) '(x k;1 ; : : : ; x k;i?1; x i ; : : : ; x r ; y k;1 ; : : : ; y k;i?1; y i ; : : : ; y r ) then we may pick M k < M k?1 and x k;i 2 jm k j so that M k (8y i ) ::(9x r )(8y r ) '(x k;1 ; : : : ; x k;i ; x i+1 ; : : : ; x r ; y k;1 ; : : : ; y k;i?1; y i ; : : : ; y r ) By appropriately diagonalizing through the countably many choices for i and ~x and ~y we may ensure that S k2nm k is a model of P V 1 [ f: g. We omit the details. 2 5 A completeness theorem for IPV + We next establish the main theorem of this paper. Theorem 5 (Completeness Theorem for IPV + with respect to CPV-normal Kripke models) Let ' be any sentence. If IPV + 0 i ' then there is a CPV-normal Kripke model K such that K IPV + and K 1 '. Note that the conclusion \K IPV + " is superuous as this is already a consequence of Theorem 3. The proof of this theorem will proceed along the lines of the proof of the usual strong completeness theorem for intuitionistic 10

logic as exposited in section 2.6 of Troelstra and van Dalen [15]. The new ingredient and the most dicult part in our proof is Lemma 7 below which is needed to ensure that the Kripke model is CPV-normal. Although we shall not prove it here, Theorem 5 can be strengthened to require K to be countable. Denition Let C be a set of constant symbols. A C -formula or C -sentence is a formula or sentence in the language of PV 1 plus constant symbols in C. All sets of constants are presumed to be countable. Denition hold: A set of C -sentences? is C -saturated provided the following (1)? is intuitionistically consistent, (2) For all C -sentences ' and, if? `i ' _ then? `i ' or? `i. (3) For all C -sentences (9x)'(x), if? `i (9x)'(x) then for some c 2 C,? `i '(c). The next, well-known lemma shows that C -saturated sets can be readily constructed. Lemma 6 Let? be a set of sentences and ' be a sentence such that? 0 i '. If C is a set of constant symbols containing all constants in? plus countably innitely many new constant symbols, then there is a C -saturated set? containing? such that? 0 i '. The proof of Lemma 6 is quite simple, merely enumerate with repetitions all C -sentences which either begin with an existential quantier or are a disjunction and then form? by adding new sentences to? so that (2) and (3) of the denition of C -saturated are satised. This can be done so that ' is still not an intuitionistic consequence. (For a full proof, refer to lemma 2.6.3 of [15].) In the proof of the usual completeness theorem for Kripke models and intuitionistic logic, the C -saturated sets of sentences constructed with Lemma 6 specify worlds in a canonical Kripke model. However, Lemma 6 is not adequate for the proof of Theorem 5 and Lemma 7 below is needed instead. 11

A C -saturated set? denes a world with domain C in which an atomic formula ' is forced if and only? `i '. For the proof of Theorem 5, we shall only consider sets? which contain IPV + and hence imply the law of the excluded middle for atomic formulas; the C -saturation of? thus implies that for any atomic C -sentence ', either? `i ' or? `i :'. Thus? species a classical structure M? dened as follows: Denition Suppose? IPV,? is a C -saturated set, and for all distinct c; c 0 2 C,? `i c 6= c 0. Then M? is the classical structure in the language of PV plus constant symbols in C such that the domain of M? is C itself (so c M? = c) and such that for every atomic C -sentence ', M? ' if and only if? `i '. It is straightforward to check that M? is a classical structure: the only thing to check is that the equality axioms hold (it suces to do this for atomic formulas). Note the equality relation = M? in M? is true equality in that M c = c 0 if and only if c = c 0 because of the restriction that? `i c 6= c 0 if c and c 0 are distinct. This restriction is not very onerous as we will be able to make it hold by eliminating duplicate constant symbols. k In order to prove Theorem 5 we must construct sets? so that the structures M? are classical models of CPV; Lemma 7 is the crucial tool for this: Lemma 7 Suppose? is a set of C -sentences, ' is a C -sentence and? IPV +. Further suppose? 0 i ' and? `i c 6= c 0 for distinct c; c 0 2 C. Then there is a set? of sentences and a set C of constants such that (a)?? (b)? is C -saturated (c)? 0 i ' (d)? `i c 6= c 0 for all distinct c; c 0 2 C (e) M? CPV. k If we did not adopt this restiction, then the domain of M? would have to be equivalence classes of constants in C instead of just the set C. But this would cause some inconveniences later on in the denition of the canonical CPV -normal Kripke structure. 12

Proof? and M? are constructed by a technique similar to Henkin's proof of Godel's completeness theorem. We pick C + to be C plus countably innitely many new constant symbols and enumerate the C + formulas as 1 ; 2 ; 3 ; : : : with each C + -formula appearing innitely many times in the enumeration. We shall form classically consistent sets of sentences 0 ; 1 ; 2 ; : : : so that 0 CPV and so that, for all k, k k?1 and either k 2 k or : k 2 k. Furthermore, if k = (9x)(x) and k 2 k?1 then for some constant symbol c, k `c (c). Thus, as usual in a Henkin-style model construction, the union of the k 's will specify a classical model M of CPV with domain formed of equivalence classes of constants in C +. This M will become M? after elimination of duplicate constant names. While dening the sets k we also dene sets 0 k,? k, C k and C 0 k so that k?1 0 k k and? =? 0? 1? 2 and such that C 0 union of the? i 's after elimination of duplicate constant names. is C, C k C 0 k C k?1, and C + = S k C k.? will be the Denition Let D be a set of constants and be a set of D-sentences. Then T h +' [; D] is the set f : is a positive D-sentence and `i ' g For us, the formula ' is xed, so we also denote this set by T h + [; D]. If is a classical theory then the [; D]-closure of is the classical theory axiomatized by [ T h + [; D]. Denition We dene? 0 to be?, C 0 to be C and 0 to be the [?; C]-closure of CPV. For k > 0, k, 0 k,? k, C k and C 0 k are inductively dened by: (1) Suppose k 2 k and k is of the form (9x) k (x). Then C 0 is k C k?1 plus an additional new constant symbol c 2 C + n C k?1. And 0 k is the [? k?1; Ck]-closure 0 of k?1 [ f k (c)g. (2) If Case (1) does not apply then C 0 k is C k?1 plus the constant symbols in k and: (a) Let 0 k consistent, be k?1 [ f k g [ T h + [? k?1; C 0 k] if this theory is classically 13

(b) Otherwise, let 0 k be k?1 [ f: k g [ T h + [? k?1; C 0 k] (3) If k is of the form (9x) k (x) and? k?1 `i k then C k is C 0 k [ fdg where d is a new constant symbol from C + n C 0 k,? k is? k?1 [ f k (d)g and k is the [? k ; C k ]-closure of 0 k. (4) If k is of the form k _ k and? k?1 `i k then C k is C 0 k and: (a) If the [? k?1 [ f k g; C k ]-closure of 0 k is classically consistent then k dened to be equal to this theory and? k is? k?1 [ f k g. (b) Otherwise,? k is? k?1 [ f k g and k is the [? k ; C k ]-closure of 0 k. Dene! = S k k and? k = S k? k. Note C + = S k C k. The point of cases (1) and (2) above is to make! a complete theory with witnesses for existential consequences. The point of cases (3) and (4) is to force?! to be C + -saturated. The requirement that k contain T h + [? k ; C k ] and 0 k contain T h + [? k?1; Ck] 0 serves to maintain the condition that? k 0 i '. Claim: For k = 0; 1; 2, (1) k is classically consistent for all k. (2)? k 0 i ' (so? k is intuitionistically consistent). Note that if? k `i ', then? k `i (0 = 1) ' and hence k `c 0 = 1 and k is inconsistent. So to prove the claim, it suces to show k is consistent which we do by induction on k. The base case is k = 0. Suppose for a contradiction that 0 is inconsistent. Then CPV `c : 1 _ : 2 : s for positive C -sentences j such that? `i ' j. By taking the conjunction of the j 's there is a single positive C -sentence such that CPV `c : and? `i '. But, by Theorem 2, IPV + `i ' ' and thus, since? IPV +,? `i '; which is a contradiction. For the induction step, we rst assume k?1 is consistent and show that 0 k is consistent. Referring to Case (1) of the denition of 0 k, suppose k = (9x) k (x) and that 0 k is inconsistent. This means that there is a positive C 0 k -sentence (c) such that k?1 `c k (c) :(c) and? k?1 `i (c) '. Then, since c was a new constant symbol, k?1 `c (9x) k (x) (9x):(x) 14

and so k?1 `c :(8x)(x); also,? k?1 `i [(8x)(x)] '. But (8x)(x) is a positive C k?1-sentence and k?1 contains T h + [? k?1; C k?1], so k?1 contains (8x)(x) which contradicts our assumption that k?1 is consistent. Now suppose Case (2) of the denition applies. Let k = k (~e) where ~e denotes all the constant symbols in k that are not in C k?1 (so C 0 k = C k?1 [ f~eg). Let a k and b k be the [? k?1; C 0 k]-closures of k?1 [ f k g and k?1 [ f: k g, respectively. We need to show that at least one of these theories is classically consistent, so suppose that both are inconsistent. Then there are positive C 0 k -sentences a (~e) and b (~e) such that? k?1 `i a (~e) ',? k?1 `i b (~e) ', k?1 `c k (~e) : a (~e) and k?1 `c : k (~e) : b (~e) Then k?1 `c :(9~x)( a (~x) ^ b (~x)) and? k?1 `i [(8~x)( a (~x) ^ b (~x))] '. Since k?1 contains T h + [? k?1; C k?1], (8~x)( a (~x) ^ b (~x)) is in k?1, contradicting the consistency of k?1. To nish the induction step and prove the claim, we assume 0 k is consistent and show that k is consistent. First suppose Case (3) of the denition of? k and k applies and that k is inconsistent. Then there is a positive C k -sentence (d) such that 0 k `c :(d) and? k?1 `i k (d) ((d)) '. Since d is a new constant symbol, k?1 `c (8x):(x) and likewise, since? k?1 `i (9x) k (x),? k?1 `i (9x)(x) '. Hence (9x)(x) is in 0 k which contradicts the consistency of 0 k. Second, suppose Case (4) of the denition applies. Let c and k d be the [? k k?1[f k g; C k ]-closure and [? k?1[f k g; C k ]- closure of 0 k, respectively. Suppose, for sake of a contradiction, that both c k and d k are inconsistent. Then there are positive C k -sentences c and d such that? k?1 `i k ( c ) ' and? k?1 `i k ( d ) ' and such that 0 k `c : c and 0 k `c : d. Since? k?1 `i k,? k?1 `i ( c _ d ) ' and hence a _ b is in 0. But this contradicts the consistency of k 0 k and completes the proof of the claim. We are now ready to complete the proof of Lemma 7. Recall?! = S k? k and! = S k k. By choice of constant symbols, C + = S k C k. First note that if is an atomic C + -formula then! `c if and only if?! `i. This is readily by proved by noting that?! `i _ : since is atomic and hence?! `i or?! `i :. Now if?! `i then?! `i ' and hence! `c since! contains T h + [?! ; C + ]. Likewise, if?! `i : then! `c : since : is equivalent to an atomic formula. Clearly! is a consistent, complete theory and since the k 's enumerate all C + -formulas, whenever! `c (9x)(x) then! `c (c) for some c 2 C +. 15

Hence, the Henkin construction gives us a model M with domain a set of equivalence classes of C + and M CPV since M! and! CPV. The equivalence classes of C + which form the domain of M are dened by [c] = fc 0 :! `c c = c 0 g. The equivalence class [c] is also equal to fc 0 :?! `i c = c 0 g since c = c 0 is an atomic formula. In order to eliminate duplicate constant symbols we let C be a set of set of constant symbols so that C C C + and C contains exactly one constant symbol from each equivalence class. Such a C exists since no equivalence class can contain more than one constant symbol from C because?!? and? `i c 6= c 0 for distinct c; c 0 2 C. Now let? be the set of C -sentences which are intuitionistic consequences of?!. Let M C be M restricted to the language of PV plus the constant symbols in C ; obviously M? is isomorphic to M C by the mapping c 7! [c]. It remains to check that? satises conditions (a)-(e) of Lemma 7. (a)?? is immediate from our construction since?!? and C C. (b) To show? is C -saturated, suppose? `i (9x) (x) for a C -formula. Then?` `i (9x) (x) for some `; and because the k 's enumerate at C + -sentences with innitely many repetitions, (9x) (x) is k for some k `. Hence? k `i (d) for some d 2 C +. Also,?! `i c = d for some c 2 C so?! `i (c) and thus? `i (c) by the denition of?. Similar reasoning shows that if? `i _ then? `i or? `i where and are arbitrary C -sentences. (c)? 0 i ' by (2) of the Claim. (d)? `i c 6= c 0 for all distinct c; c 0 2 C since! `c c 6= c 0 (by denition of C ). (e) M? CPV since M? is isomorphic to M C and M is a model of! 0 = CPV. Q.E.D. Lemma 7 We are now ready to dene the CPV-normal Kripke model K for the proof of the completeness theorem. Recall that a CPV-normal Kripke model is an ordered pair (fm i g i2i; 4) where I is an index set, each M i CP V and 4 is the reachability relation. The index set I will be the set of sets? of sentences such that (a)? is C -saturated (where C is the set of constant symbols appearing in sentences in?, (b)? IPV +, (c)? `i c 6= c 0 for distinct c; c 0 2 C and 16

(d) M? CPV. As an additional technical condition we require the set C of constant symbols be a coinnite subset of some xed countable set of constant symbols: this makes I a set rather than a proper class. Note that I is non-empty by Lemma 7. The worlds of K are the structures M? such that? 2 I. By the Soundness Theorem proved above, K IPV +. The reachability relation 4 is dened by M?1 4 M?2 if and only if? 1? 2. It is easy to check from the denitions that, if? 1? 2 then M?1 is a substructure of M?2. Hence K is a CPV-normal Kripke model. We are now ready to nish the proof of Theorem 3. Suppose IPV + 0 i ' for ' an arbitrary sentence. By Lemma 7 there is a? 2 I such that? 0 i '. It will suce to prove that M? 1 ' since then K 1 '. This follows from the next lemma which also implies that for any sentence, IPV + `i if and only if K ; in other words, K is a CPV-normal, canonical Kripke model for IPV +. Lemma 8 For any C -saturated? 2 I and C -sentence, M?,? `i : Proof (This is exactly like lemma 2.6.5 of Troelstra and van Dalen [15].) The lemma is proved by induction on the complexity of : Case (1): is atomic. By denition of and K. Case (2): is ^. M? ^,M? and M?,? `i and? `i by ind. hyp.,? `i ^ Case (3): is _. Then M? _,M? or M?,? `i or? `i by ind. hyp.,? `i _ by C-saturation of? 17

Case (4): is (9x)(x). Then M? (9x)(x),9c 2 C; M? (c),9c 2 C;? `i (c) by ind. hyp.,? `i (9x)(x) by C-saturation of? Case (5): is. (() First suppose? `i. We must show that if M? 4 M?2 and M?2 then M?2. Since? 2?,? 2 `i. Hence, if M?2 then, by the induction hypothesis? 2 `i, so? 2 `i and, again by the induction hypothesis, M?2. ()) Second suppose? 0 i. By Lemma 7, since? [ fg 0 i, there is a M?2 < M? such that 2? 2 and? 2 0 i. Now, by the induction hypothesis twice, M?2 and M?2 1 ; so M? 1. Case (6): is (8x)(x). (() First suppose? `i (8x)(x). Further suppose M?2 < M?,? 2 is C 2 -saturated and c 2 C 2. Then? 2 `i (c) since? 2? and by the induction hypothesis, M?2 (c). Hence M? (8x)(x). ()) Second suppose? 0 i (8x)(x). If c is a new constant symbol not in C, then? 0 i (c). By Lemma 7 there is a world M?2 < M? such that? 2 0 i (c) with c a constant symbol in the language of? 2. Now by the induction hypothesis, M?2 1 (c) so M? 1 (8x)(x). Q.E.D. Lemma 8 and the Completeness Theorem. It is interesting to ask whether there are analogues of our completeness and soundness theorems for IPV + w.r.t. CPV-normal Kripke models that apply to Peano arithmetic (P A) and Heyting arithmetic (HA). Let P A and HA be formulated in the rst-order language of P RA so there is a function symbol for every primitive recursive function symbol: as usual, P A and HA have induction axioms for all arithmetic (rst-order) formulas. P A is a classical theory and HA is an intutionistic theory and has the law of excluded middle for quantier-free formulas. If we dene a P A-normal Kripke model to be one in which each world is a classical model of Peano arithmetic, then it is natural to inquire whether Heyting arithmetic is complete and sound with respect to P A-normal Kripke models. It turns out that with some minor modications the proof above shows that Heyting arithmetic is complete with respect to P A-normal Kripke models: 18

Theorem 9 (Completeness Theorem for HA with respect to P A-normal Kripke models) Let ' be any sentence. If HA 0 i ' then there is a P A-normal Kripke model K such that K HA and K 1 '. We shall give the proof of Theorem 9 is a future paper; we also shall show that the converse fails: that is to say, there is a P A-normal Kripke model which is not a model of Heyting arithmetic. 6 On Independence Results 6.1 Independence Results in Computational Complexity from Feasible Theories The main motivation for the independence results discussed below comes from the question of whether P = NP. Hartmanis and Hopcroft [8] suggested that P =?NP might be independent of set theory. Although this question is still open (and the natural conjecture is that it is not independent of set theory) there have been a number of results on independence of P =?NP and NP =?conp from theories related to Bounded Arithmetic. DeMillo and Lipton [6, 7] proved that P = NP is consistent with the fragment of arithmetic ET which has function symbols for addition, subtraction, multiplication, exponentiation, maximization and minimization and has a predicate symbol for each polynomial time function. Sazanov [13] proved that there is a model of the true universal sentences of PV in which exponentiation is not total and yet there is a deterministic Turing machine which can nd satisfying assignments to satisable propositional formulas. Recently, Cook and Urquhart [5] and Krajcek and Pudlak [11] have independently proved that it is consistent with IPV and PV 1 that extended Frege proof systems are almost super. By \almost super" is meant that for suciently large tautologies there are extended Frege proofs with size bounded by any provably super-polynomial growth rate function. The point of these independence results is not to provide exidence that perhaps P = NP or the polynomial time hierarchy collapses; instead, the goal is to show why it seems so dicult to prove that P 6= NP. However, it is dicult to know how much signicance to attach to these independence 19

results. DeMillo and Lipton's construction was criticized extensively by Joseph [10]; in particular, the standard integers are denable in DeMillo and Lipton's model by an atomic formula with a nonstandard parameter and hence induction fails for such formulas. Sazanov's model does have induction for all atomic (polynomial time) formulas with parameters, but his model only indirectly satises P = NP in that there is no polynomial time predicate that denes the set of satisable formulas. Furthermore, in Sazanov's model there is a polynomial time function mapping the set unary integers onto the integers in binary notation in spite of the fact that exponentiation is not total. The constructions of Cook and Urquhart and of Krajcek and Pudlak avoid such overtly pathological features but they only indirectly make NP = conp. They show that there is a 3 -formula NPB which is not a consequence of either PV 1 or IPV; NPB states that an extended Frege proof system is not super. It is open whether the theory CPV = S2(P 1 V ) can prove NPB. It seems that PV 1 and IPV are too weak for these latter independence results to be very meaningful. There are a number of other independence results in computer science which we have not discussed because they are not related to Bounded Arithmetic; Joseph [9] contains a survey of this area. 6.2 Independence Results for PV 1 and IPV via Kripke models Let f(x) be a unary integer function such that the predicates y = f(x) and y f(x) are polynomial time computable and hence denable by atomic formulas in PV 1. Also suppose f is provably an increasing function and provably dominates any polynomial growth rate function; i.e., for each n 2 N, there is an m 2 N such that PV 1 `c (8y m)(8z)(f(y) = z jzj jyj n ): Since this is a universal statement, IPV also proves this. Note that this growth rate implies that f is not provably total in PV 1 or IPV. An example of such a function is f(x) = x jxj. The independence results of Krajcek-Pudlak and Cook-Urquhart state that it is not the case that f(x) is provably not an upper bound to the size of extended Frege proofs of tautologies: more precisely, let NPB (\Not 20

Polynomially Bounded") be the formula (8x)(9y x)[t aut(y) ^ (8z)(z f(y) :z `ef y)] where T aut(y) states that y is the Godel number of a propositional tautology and \z `ef y" states that z is the Godel number of an extended Frege proof of the formula coded by y. So NPB states that there are arbitrarily large tautologies y whose shortest (if any) extended Frege proofs have Godel number greater than f(y). Theorem 10 (a) (Cook-Urquhart [5]) IPV 0 i NPB. (b) (Krajcek-Pudlak [11]) PV 1 0 c NPB. In other words, IPV and PV 1 do not prove that extended Frege systems are not super. (Cook and Urquhart state their result for IPV! but this is equivalent since they also show that IPV! is conservative over IPV.) Both parts of Theorem 10 were proved with the aid of Cook's theorem that PV-provable polynomial time identities give rise to tautologies with polynomial size extended Frege proofs. Krajcek and Pudlak proved part (b) by constructing a chain of models M 0 ; M 1 ; : : : of CPV such that for i j, M i is a substructure of M j and such that for any d 2 M i there is a j i such that M j (9z)(z `ef d) or M j :T aut(d). Furthermore, there is a nonstandard element a 2 jm 0 j such that a, a#a, a#a#a,... is conal in every M i. By taking the union of the M i 's a model of PV 1 is obtained in which NPB is false; thus proving Theorem 10(b). The natural question then arises of what is true in the Kripke model (fm i g i2n; 4) where M i 4 M j if and only if i j. Since it is CPV-normal, IPV + is valid in this Kripke model; it turns out that NPB is not valid. By pulling out the universal quantiers and combining like quantiers we rewrite NPB as (8x)(9y)(8z)NPB M where NPB M (x; y; z) is an atomic formula formalizing \y x and z is not a satisfying assignment of y and if z f(y) then z is not an extended Frege proof of y". 21

Theorem 11 (a) IPV + 0 i ::NPB (b) IPV + 0 i :(9x)(8y):(8z)NPB M (x; y; z) (c) IPV + 0 i :(9x)(8y)::(9z):NPB M (x; y; z). Of course, Theorem 11 represents a slight strengthening of Theorem 10(a); rstly, because IPV has been replaced by IPV + and, secondly, since negation signs have been introduced. Proof Let K be the Kripke model (fm i g i2n; 4) as above. Since K is CPV-normal and hence IPV + is valid in K it will suce to show that the formulas (a), (b) and (c) are not valid in K. For (a), suppose for a contradiction that K ::NPB. Then by the denition of forcing, M i NPB for suciently large i. But taking x = a where a; a#a; : : : is conal in M i, M i (9y)(8z)NPB M (a; y; z) and so for some y 0 2 jm i j such that y 0 a and M i (8z)NPB M (a; y 0 ; z). But, by contruction of the M i 's, there is some j i and some z 0 2 M j such that z 0 is either an extended Frege proof of y 0 or z 0 is not an satisfying assignment for y 0. Also, z 0 f(y 0 ) as y 0 a, f is increasing, and jzj jaj n < jf(a)j for some standard n. Thus M j 1 NPB M (a; y 0 ; z 0 ), contradicting M i (8z)NPB M (a; y 0 ; z). That proves that (a) is not valid in K. The proofs for (b) and (c) are similar. 2. Note that Theorems 4(a) and 11(b) imply Theorem 10(b). What we have done is adapted Krajcek and Pudlak's proof technique to to prove a strengthening of Cook and Urquhart's independence result and then used Theorem 4 to rederive Krajcek and Pudlak's theorem. This shows that there is a very close link between their two independence results. It is open whether :(9x)(8y)(9z):NPB M is independent of IPV; if so, then it is also independent of CPV and S 1 2. This is immediate from Theorem 1 since (9z)(8y)(9z):NPB m is equivalent to a positive formula. References [1] S. R. Buss, Bounded Arithmetic, Bibliopolis, 1986. Revision of 1985 Princeton University Ph.D. thesis. 22

[2], The polynomial hierarchy and intuitionistic bounded arithmetic, in Structure in Complexity, Lecture Notes in Computer Science #223, Springer-Verlag, 1986, pp. 77{103. [3], A note on bootstrapping intuitionistic bounded arithmetic, in Proof Theory: A selection of papers from the Leeds Proof Theory Programme 1990, Cambridge University Press, 1992, pp. 149{169. [4] S. A. Cook, Feasibly constructive proofs and the propositional calculus, in Proceedings of the Seventh Annual ACM Symposium on Theory of Computing, 1975, pp. 83{97. [5] S. A. Cook and A. Urquhart, Functional interpretations of feasibly constructive arithmetic, Annals of Pure and Applied Logic, 63 (1993), pp. 103{200. [6] R. A. DeMillo and R. J. Lipton, Some connections between mathematical logic and complexity theory, in Proceedings of the 11th ACM Symposium on Theory of Computing, 1979, pp. 153{159. [7], The consistency of \P=NP" and related problems with fragments of number theory, in Proceedings of the 12th ACM Symposium on Theory of Computing, 1980, pp. 45{57. [8] J. Hartmanis and J. Hopcroft, Independence results in computer science, SIGACT News, 8 (1976), pp. 13{24. [9] D. Joseph, On the Power of Formal Systems for Analyzing Linear and Polynomial Time Program Behavior, PhD thesis, Purdue University, August 1981. [10], Polynomial time computations in models of ET, Journal of Computer and System Sciences, 26 (1983), pp. 311{338. [11] J. Krajcek and P. Pudlak, Propositional provability and models of weak arithmetic. Typewritten manuscript, 1989. [12] J. Krajcek, P. Pudlak, and G. Takeuti, Bounded arithmetic and the polynomial hierarchy, Annals of Pure and Applied Logic, 52 (1991), pp. 143{153. 23

[13] V. Y. Sazanov, A logical approach to the problem \P=NP?", in Mathematics Foundations of Computer Science, Lecture Notes in Computer Science #88, Springer-Verlag, 1980, pp. 562{575. There is an unxed problem with the proof of the main theorem in this article; see [14] for a correction. [14], On existence of complete predicate calculus in matemathematics without exponentiation, in Mathematics Foundations of Computer Science, Lecture Notes in Computer Science #118, Springer-Verlag, 1981, pp. 383{390. [15] A. S. Troelstra and D. van Dalen, Constructivism in Mathematics: An Introduction, vol. I, North-Holland, 1988. 24