7.6  What First-Order Logic Can and Cannot Say

This section is optional, and nothing outside it depends on it. Every theorem in it is stated without proof, except where a short argument from a stated theorem is given and marked as such; its results carry no optional marker of their own, and the section as a whole is the unit a reader may skip.

Section 7.4 asked of a theory two questions that sound different: is it consistent, that is, does no finite list of its axioms derive ⊥? And has it a model? A model answers the first question (Proposition 7.4.2), but nothing so far says that a consistent theory must have one. This section states the theorem that says so, Gödel’s completeness theorem, and then follows its consequences. The first is compactness: a theory has a model as soon as each finite part of it has one. From compactness come the surprises. A first-order theory cannot fix the size of its infinite models; the true sentences about N have a model with an element larger than every number; and the property “finite” cannot be written as a sentence. The section ends with what can and cannot be decided by a mechanical procedure, and names the incompleteness theorem, which is a different matter from completeness.

Remark (Looking back). Section 4.8 proved that every valid propositional claim is derivable, and the optional Section 4.10 proved compactness for propositional logic. Both hold for predicate logic too; this section states them, and then shows what they cost: a first-order language cannot pin down the natural numbers.

7.6.1. Completeness

The soundness statement of Section 7.2 runs from derivations to truth: whatever a list of premises derives is true in every structure where the premises are true. The completeness theorem runs back.

Theorem 7.6.1 (Gödel’s Completeness Theorem)

For every theory T and sentence σ: T⊢σ if and only if T⊨σ. Equivalently, a theory is consistent if and only if it has a model.

This theorem is stated without proof. One direction is the soundness statement of Section 7.2; the other is new. Here T⊢σ and T⊨σ are those of Definition 7.4.1 and Definition 7.4.2: some finite list of axioms derives σ, and σ is true in every model of T. The two forms say the same thing. Take σ=⊥: T⊢⊥ says that T is inconsistent (Definition 7.4.3), and T⊨⊥ says that no model of T exists, since ⊥ is true in no structure. In the other direction, T⊨σ means that the theory T with ¬σ added, the counterexample set of the claim, has no model; and T⊢σ means that this theory is inconsistent, by ¬E in one direction and RAA in the other.

What the theorem means for this chapter is best said with its two halves side by side. Faced with a claim T⊢σ, Chapters 5 and 6 searched for a derivation, and this chapter searched for a counter-model, a model of T in which σ is false. Soundness says that both cannot succeed. Completeness says that one of them must: a stalled derivation search and a missing counter-model cannot both be real. The words “consistent” and “has a model”, which Section 7.4 kept apart and never swapped, are now known to coincide, but only here, and with a theorem stated and not proved. Nothing outside this section uses the coincidence.

Section 7.4’s group axioms show both outcomes. They derive that the identity is unique (Proposition 7.4.1), and that settles one claim by a derivation. They do not derive (Comm), and the triangle group of Example (The Six Symmetries of a Triangle), a model of the axioms in which (Comm) is false, settles that claim by a counter-model. Completeness says that every claim about groups is settled in one of these two ways, though it does not say which, or how long the search for either will take.

The theorem says nothing about how to find the derivation or the model, and the last part of this section states, without proof, that no method finds one of them in every case.

Second readingHow the proof goes: a model made of names

This is a sketch, not a proof. It follows the route of Section 4.10’s proof of propositional compactness through Lindenbaum’s lemma (Lemma 4.10.2).

Start from a consistent theory T; we want a model. The idea is to build the model out of the language itself, with the closed terms as its elements. Two difficulties arise, and each has a remedy.

Witnesses. A sentence ∃xφ of the theory may hold with no closed term to show for it. So add new constants, and for each sentence ∃xφ a witness axiom ∃xφ→φ[c/x], with c a constant new to everything so far. Adding it keeps the theory consistent, for the same reason the name in an ∃E box must be fresh: an old name already carries information, and a new one carries none, so assuming that it names a witness can lead to no contradiction that the bare ∃xφ did not already give. This is repeated, since the new constants make new sentences, each with its own witness.

Deciding every sentence. A consistent theory may leave a sentence undecided, and a structure cannot. So extend the theory, one sentence at a time, to a maximal consistent set: list all sentences, and add each one if the result stays consistent. As in Lindenbaum’s lemma, the result decides every sentence, containing it or its negation.

The structure. Its elements are the closed terms, with two terms identified when the set contains their equation; a constant names itself, a function symbol builds the longer term, and a predicate holds of the terms for which the set says it holds. An induction on sentences, the propositional one of Section 4.10 with a case for each quantifier, where the witness axioms do their work, shows that this structure satisfies exactly the sentences of the set. It satisfies T in particular.

The details, for countably many symbols, fill a chapter of a logic text; this book stops at the outline.

7.6.2. Compactness

Completeness ties models to derivations, and a derivation uses only finitely many premises. That one fact has a consequence about models alone.

Theorem 7.6.2 (Compactness Theorem)

If every finite subset of a theory T has a model, then T has a model.

A short argument from completeness. Suppose T had no model. Then T is inconsistent, by Theorem 7.6.1, so some finite list of its axioms derives ⊥ (Definition 7.4.3). The finite subset made of those axioms is then itself an inconsistent theory, so by Proposition 7.4.2 it has no model, against the hypothesis.

Warning. “Every finite subset has a model” is not “has a finite model”. The finite subsets are finite lists of axioms; the models that satisfy them may be infinite, and the model the theorem gives may be infinite even when every finite subset has a finite model. Compactness never makes a structure smaller.

Read the theorem from the side of what a theory forbids. A structure fails to be a model of T when some axiom is false in it. The theorem says that a property needing infinitely many axioms at once to fail is never enforced by first-order sentences: whatever a theory forbids, some finite part of it already forbids. That is the source of everything below.

The standard tool is a list of sentences that count. For n≥2, let σn be the sentence “there are at least n elements”: n variables bound by ∃, followed by the conjunction of ¬(xi=xj) for all i<j. It is true in a structure exactly when the domain has n or more elements. Any finite set of the σn is true in a large enough finite structure; all of them together are true only in an infinite one. Every use of compactness below follows one pattern: add infinitely many axioms that no single intended structure satisfies all at once, check that each finite part of the result has a model, and conclude that the whole has one. The model it gives is then a new structure, with properties the intended ones lack.

Quick check. Let σn say “there are at least n elements”. Write σ3.

Solution. ∃x∃y∃z(¬(x=y)∧¬(x=z)∧¬(y=z)).

Quick check. Does compactness hold for propositional logic?

Solution. Yes: the optional Section 4.10 proved it; this section states the first-order version.

7.6.3. Large models and small ones

A set can be listed if its elements can be written as a sequence d0,d1,d2,… in which every element appears; N, Z and Q can, and so can every non-empty finite set (repeat its last element forever). “Listed” here has its everyday meaning.

Theorem 7.6.3 (Löwenheim–Skolem Theorem)

Let T be a theory in countably many symbols (the symbols can be listed s0,s1,s2,…). If T has an infinite model, then it has a model whose domain can be listed as d0,d1,d2,…, and also a model whose domain cannot be so listed.

This theorem is stated without proof. Two consequences show its force. First, take for T all the sentences true in (R;0,1,+,⋅,<). The theorem gives a structure that satisfies every one of them and whose elements can be listed, although the elements of R cannot be (a fact stated here, not proved). Every first-order property of the real numbers holds in that structure, so the property that separates R from a listable set is not first-order. Second, take for T the sentences true in (N;0,S,+,⋅,<), with S the successor. The theorem gives a model of all of them that cannot be listed: far too large to be N under other names.

So no first-order theory with an infinite model fixes the size of its models. Section 7.5 showed that isomorphic structures satisfy the same sentences; here are structures that satisfy the same sentences and are not isomorphic, since one can be listed and the other cannot.

How can a listable structure satisfy every first-order sentence true in R, when R is “complete”: every non-empty set of reals bounded above has a supremum? The answer is the one the next two subsections give for N. Completeness of R speaks of all sets of reals. A first-order sentence can speak only of sets defined by formulas (Section 7.5): for each formula there is a sentence “if the set this formula defines is non-empty and bounded above, it has a supremum”, and each of these is true in R. The listable model satisfies all of them, and fails the statement about all sets, which is not a first-order sentence. It must fail it: the listable model is an ordered field, as R is, and any two complete ordered fields are isomorphic (Number Systems: From N to R, Chapter 6), so a complete listable model would make R listable, and R cannot be listed.

Quick check. A theory T in countably many symbols has the model (Q,<). Must it also have a model whose domain cannot be listed?

Solution. Yes: (Q,<) is an infinite model, so by Theorem 7.6.3 T also has a model that cannot be listed. For the strict order axioms, (R,<) is one.

7.6.4. Numbers that are not numerals

The symbols of arithmetic are 0, the one-place S for successor, +, ⋅ and <, read in N as usual. The numeral n― is the closed term S(S(⋯S(0)⋯)) with n letters S; its value in N is n.

Example (A Model of Arithmetic with an Infinite Number)

Let T be the set of all sentences in 0,S,+,⋅,< that are true in N. Add a new constant c, and to T add the axioms 0―<c,1―<c,2―<c,…, one for each n∈N. Call the result T′.

Every finite subset of T′ has a model. A finite subset contains finitely many sentences of T and finitely many axioms n―<c; let N be the largest n among them (or 0 if there is none). Read the symbols in N as usual and c as N+1. The sentences of T do not mention c, and they are true in N; each n―<c in the subset says n<N+1, which is true.

So T′ has a model. By Theorem 7.6.2 there is a structure M in which every sentence of T′ is true. In M every sentence true in N is true, and cM is above the value in M of every numeral. It differs from each of them: if cM were the value of n―, the axiom n―<c would put an element below itself, while ∀x¬(x<x) is true in N, so in T, so in M.

An element of M that is the value of no numeral is called non-standard; the values of numerals are the standard elements. M satisfies every first-order sentence that N satisfies, and still has an element that no numeral names. Its standard elements lie at the bottom: the sentences ∀x(x<n+1―→x=0―∨⋯∨x=n―), one for each n, together with ∀x¬(x<0―), are true in N and so in M, and they say that nothing non-standard lies below a standard element; since ∀x∀y(x<y∨x=y∨y<x) is also true in N and so in M, every standard element lies below every non-standard one.

The model M is not N under another name. In N itself, read as usual, no value of c works for the whole of T′: if c is read as the number n, the axiom n―<c says n<n. Each finite part of T′ is satisfied by N, each with its own value for c; the whole set is satisfied only by a structure that compactness supplies, and that structure has elements N lacks. Since M satisfies the same sentences in 0,S,+,⋅,< as N, no first-order sentence about arithmetic can tell the two apart; yet they are not isomorphic, since an isomorphism would send each numeral’s value to the same numeral’s value, and cM to an element of N above every number, and there is none.

Quick check. Is cM=SM(d) for some element d of M?

Solution. Yes. The sentence ∀x(¬(x=0)→∃y(S(y)=x)) is true in N, so it is true in M; and cM≠0M, since 0―<c is an axiom and ∀x¬(x<x) holds in M.

7.6.5. Induction: a schema and an axiom

How can M satisfy induction, when its standard elements contain 0, are closed under successor, and are not everything? The answer turns on what first-order induction says.

The induction schema of first-order arithmetic is one sentence for each formula φ with free variable x: (φ[0/x]∧∀x(φ→φ[S(x)/x]))→∀xφ, with its other free variables, if any, bound by ∀ in front. Each instance is true in N, by induction, so each is in T and true in the model M of Example (A Model of Arithmetic with an Infinite Number). Yet the set of standard elements of M contains 0M and is closed under SM, and is not all of the domain. There is no contradiction: the schema speaks only about sets defined by formulas (Section 7.5), with any other free variables fixed at elements of the domain, and the standard elements are not such a set.

The argument is short. Suppose a formula φ, with free variable x and its other free variables z1,…,zk (if any) fixed at elements e1,…,ek of M, defined the standard elements in M; every assignment below sends each zi to ei. By Lemma 7.3.1 (Section 7.3; 0 is closed, and S(x) is free for x in φ), φ[0/x] holds in M exactly when φ holds of 0M, and φ[S(x)/x] holds under an assignment ℓ exactly when φ holds of SM(ℓ(x)). Then φ[0/x] holds in M, since 0M is standard, and ∀x(φ→φ[S(x)/x]) holds, since the successor of a standard element is standard. The induction instance for φ is a sentence true in N, so it is in T and true in M; read with each zi at ei, it gives ∀xφ in M, so every element would be standard, against cM. (Exercise C2 reaches the same conclusion another way, by least elements.)

The induction principle of Section 4.2 (Axiom 4.2.1) is stated for every property of natural numbers. Read in a structure, that is a statement about all subsets of the domain, not only the definable ones: it quantifies over sets, and is a second-order statement. Applied to the set of standard elements, it would rule out non-standard elements at once, and so a structure satisfying it, with 0 and successor read as usual, has no room for cM. First-order logic can state the schema, not the axiom; compactness is the price of its completeness.

7.6.6. What can be decided

A question about sentences is decidable if a mechanical procedure answers it, correctly and in finitely many steps, for every sentence. Three facts, each stated without proof here, mark the boundary.

Remark. Decidable: propositional logic. Chapter 4’s search tree decides every propositional claim in finitely many steps (Proposition 4.6.1): it either closes, and the claim is valid, or it leaves an open branch, which gives a refuting row.

Remark. Undecidable: predicate logic (Church and Turing, 1936). No mechanical procedure decides, for every first-order sentence, whether it is derivable. With completeness, the boundary can be said exactly: listing all derivations, shortest first, finds one when one exists; what no procedure can do is announce, in every case, that none exists. A stalled search, the situation of Chapter 6, is the normal state of affairs and not a sign that more cleverness was needed.

Remark. Decidable: the monadic fragment. For sentences with only one-place predicate symbols and no constants, function symbols or =, the bound of Section 7.2’s remark makes the counter-model search finite: if such a sentence has a counter-model at all, it has one of bounded size, and there are finitely many structures of each size to try.

Remark. Incompleteness, named. Gödel showed in 1931 that no consistent theory whose axioms a mechanical procedure can list, and which derives the basic facts of arithmetic, derives every sentence true in N. Completeness says every sentence true in all models of a theory is derivable from it; incompleteness says that the sentences true in the intended model N are not all true in all models of any such theory. The two theorems do not conflict: the non-standard models are where they part.

Quick check. A sentence σ is true in N and false in some model of a theory T of arithmetic. Can T⊢σ?

Solution. No: by the soundness statement of Section 7.2, T⊢σ would make σ true in every model of T.

Remark (Looking ahead). Number Systems: From N to R, Chapter 1, takes the second-order induction principle as clause (P5) of a Peano system and proves that any two Peano systems are isomorphic; this section explains why no first-order list of axioms could do the same.

7.6.7. Exercises

A. Check your understanding

Exercise (A1)
  • (a) State Theorem 7.6.1 in its two forms.
  • (b) State Theorem 7.6.2, and give the short argument from completeness in three sentences.
  • (c) What is a non-standard element of a model of arithmetic?
  • (d) Why does the induction schema not rule non-standard elements out?
  • (e) Name one decidable and one undecidable question about sentences.

Solution. (a) For every theory T and sentence σ, T⊢σ if and only if T⊨σ. Equivalently, a theory is consistent if and only if it has a model.

(b) If every finite subset of T has a model, so has T. If T had no model, it would be inconsistent by completeness, so a finite list of its axioms would derive ⊥. That finite subset would be inconsistent, and so, by Proposition 7.4.2, without a model, against the hypothesis.

(c) An element that is not the value of any numeral n―.

(d) Each instance speaks of a set defined by a formula, and the standard elements are not such a set (the argument in “Induction: a schema and an axiom”).

(e) Decidable: validity of a propositional claim (or of a monadic sentence). Undecidable: derivability of a first-order sentence.

Exercise (A2: Drill)

Each part takes a line or two. The parts run from writing a counting sentence, through naming the theorem that answers a question, to judging what a theorem does and does not say.

  • (a) Write σ2, “there are at least two elements”.
  • (b) Write “there are at most two elements”.
  • (c) Which theorem says “every consistent theory has a model”?
  • (d) Which says “if every finite part of T has a model, T has one”?
  • (e) True or false: completeness says that every sentence true in (N;0,S,+,⋅,<) is derivable with no premises.
  • (f) True or false: a theory with models of every finite size has an infinite model.
  • (g) Is “the domain is finite” expressible by one sentence?
  • (h) True or false: in a model of all sentences true in N, every element is the value of a numeral.
  • (i) Over what does the second-order induction principle quantify that the schema does not?
  • (j) Is derivability of a propositional claim decidable? Of a monadic first-order sentence (one-place predicate symbols only; no constants, function symbols or =)? Of a first-order sentence in general?
  • (k) Does (R;0,1,+,⋅,<) have a model of the same sentences whose domain can be listed?
  • (l) Why is a theory whose models are exactly the structures of size 3 possible, and one whose models are exactly the finite structures not?

Solution.

  • (a) ∃x∃y¬(x=y).

  • (b) ∀x∀y∀z(x=y∨x=z∨y=z).

  • (c) Completeness, in its second form.

  • (d) Compactness.

  • (e) False: with no premises, completeness makes derivable only the sentences true in every structure. ∀x¬(S(x)=0) is true in N and false in a one-element structure (Section 7.2).

  • (f) True, by compactness, as in B1.

  • (g) No (C1).

  • (h) False: Example (A Model of Arithmetic with an Infinite Number) gives such a model with a non-standard element.

  • (i) All sets (properties) of elements, not only those defined by formulas.

  • (j) Yes; yes; no.

  • (k) Yes, by Theorem 7.6.3.

  • (l) “At least 3 and at most 3 elements” is one sentence, σ3 with the “at most” sentence. No theory can do it for “finite”: such a theory would have a model of every finite size (the structures built in the solution of C1), so by Exercise (B1: Arbitrarily large finite models) it would have an infinite model, which is not finite.

B. Practice

Exercise (B1: Arbitrarily large finite models)

Prove: if a theory T has, for every n, a finite model with at least n elements, then T has an infinite model. Apply it to the theory of an equivalence relation R in which every class has exactly two elements, with that last condition written as one sentence.

Solution. Let T′ be T with every σn, n≥2, added. A finite subset of T′ contains only finitely many σn; let N be the largest such n (or 2 if there is none). By hypothesis T has a finite model with at least N elements, and it satisfies every σn with n≤N, so it is a model of the finite subset. By Theorem 7.6.2 T′ has a model. It satisfies every σn, so it has at least n elements for every n: it is infinite. And it is a model of T.

Application. The axioms are (Refl), (Sym), (Trans) for R and ∀x∃y(¬(x=y)∧R(x,y)∧∀z(R(x,z)→(z=x∨z=y))), “each x is related to exactly one element besides itself”. For each k≥1, a set of 2k elements split into k pairs, with R “in the same pair”, is a model, so there are models with at least n elements for every n. So an infinite model exists; Z with R(x,y) read as “x and y lie in the same pair {2m,2m+1} for some m∈Z” is one.

Marking scheme. (10 points) 3 for T′ defined by adding axioms that force infinitely many elements (the σn, or distinct new constants ci, the model then cut back to T’s symbols). 3 for every finite subset having a model, with the size argument. 2 for compactness applied and the model shown infinite. 2 for the application’s sentence and models. Fatal error (0 for the proof): applying compactness to T′ without checking its finite subsets.

Exercise (B2: Which theorem settles it?)

For each question, say which statement of this section or of Section 7.2 settles it (or that none does), and answer it.

  • (i) ⊨σ is known. Is ⊢σ?
  • (ii) T⊬⊥. Has T a model?
  • (iii) σ is true in every finite structure. Is σ valid?
  • (iv) Is there a structure satisfying every sentence true in N, with an element above the value of every numeral?
  • (v) Is there a procedure that decides validity for sentences built from one-place predicate symbols only (no constants, function symbols or =)?

Solution.

Marking scheme. (10 points) 2 for each part: 1 for the statement named (in (iii), for saying that no statement settles it), 1 for the answer (in (iii), “no”, with a counter-model). Fatal error (0 for (iii)): answering “yes, by completeness”.

C. Going deeper

Exercise (C1: “Finite” is not first-order)

Prove that no sentence φ is true in exactly the finite structures for its symbols.

Solution (Hint 2). Suppose φ were one, and consider the theory T={φ}.

Solution. Suppose φ is true in every finite structure for its symbols and in no infinite one. For each n≥1 there is a structure of size n for the symbols of φ: take any n-element set, read each constant as one fixed element a of it, each function symbol as the function with the constant value a, and each predicate symbol as the empty relation. It is finite, so φ is true in it. So T={φ} has finite models of every size, and by Exercise (B1: Arbitrarily large finite models) it has an infinite model, in which φ is true: a contradiction.

Marking scheme. (10 points) 3 for the supposition stated precisely. 4 for models of every finite size exhibited. 3 for B1 (or compactness directly) applied, and the contradiction named. Fatal error (0 for the proof): a “proof” that only shows that one particular sentence fails.

Exercise (C2: Challenge: least elements in a non-standard model)

Let M be the model of Example (A Model of Arithmetic with an Infinite Number).

  • (a) For a formula ψ with free variable x, write a sentence saying “if some element satisfies ψ, some least element satisfies ψ”, and explain why it is true in M.
  • (b) Take ψ=¬φ, where φ is a formula supposed to define the standard elements in M. The sentence of (a) then names a least non-standard element e. Choose an element below e that is also non-standard, and conclude, without using the induction argument of this section, that no such φ exists.

Solution. (a) Choose a variable y that does not occur in ψ, free or bound; no quantifier of ψ is on y, so y is free for x in ψ (Definition 5.2.6). The sentence is ∃xψ→∃x(ψ∧∀y(y<x→¬ψ[y/x])), with any other free variables of ψ bound by ∀ in front. By Lemma 7.3.1 (Section 7.3; y is free for x), ¬ψ[y/x] is satisfied under ℓ exactly when ψ fails of ℓ(y), so the sentence says what (a) asks, in N and in M alike. It is true in N by the least-number principle (every non-empty set of natural numbers has a least element), whatever set ψ defines there. So it belongs to T, and it is true in M.

(b) ¬φ is satisfied by cM, which is non-standard, so (a) gives a least e satisfying ¬φ: a least non-standard element. e≠0M, since 0M is standard; and ∀x(¬(x=0)→∃y(S(y)=x)) is true in N, so in M. Choose d with SM(d)=e. Then d<e in M, since ∀y(y<S(y)) is true in N. And d is non-standard: if d were the value of n―, then e=SM(d) would be the value of n+1―. So d satisfies ¬φ and lies below e, against the choice of e.

Marking scheme. (10 points) 4 for (a): the sentence, with y chosen not to occur in ψ, so that it is free for x, and the reading of ¬ψ[y/x] by Lemma 7.3.1, its truth in N by the least-number principle, and the transfer to M through T. 4 for (b): the predecessor d obtained from a sentence true in N, with d<e and d non-standard both argued. 2 for the contradiction named. Fatal error (0 for (a)): the least-number principle used for an arbitrary subset of M rather than through a sentence of T.