Finite Models of Elementary Recursive

Finite Models of Elementary Recursive Nonstandard Analysis  Richard Sommer Patrick Suppes Stanford University Stanford University September 5, 1996 Abstract

This paper provides a new proof of the consistency of a formal system similar to the one presented by Chuaqui and Suppes in [2, 9]. First, a simpler, yet in some respects stronger, system, called Elementary Recursive Nonstandard Analysis (ERNA) will be provided. Indeed, it will be shown that ERNA proves the main axioms of the Chuaqui and Suppes system. Then a nitary consistency proof of ERNA will be given; in particular, we will show that PRA, the system of primitive recursive arithmetic, which is generally recognized as capturing Hilbert's notion of nitary, proves the consistency of ERNA. From the consistency proof we can extract a constructive method for obtaining nite approximations of models of nonstandard analysis. We present an isomorphism theorem for models that are nite substructures of in nite models.

1 Introduction This paper continues and extends the development of a constructive system of nonstandard analysis begun by Chuaqui and Suppes in [2, 9]. The approach

 This paper is dedicated to the memory of Rolando Chuaqui. The joint work of Rolando and the second author of the present paper goes back more than a decade, and our friendship many more years than that. In about 1985, we began working on formal rules of derivation for a computer-based calculus course. A long technical report of this period was reduced to manageable size in Chuaqui and Suppes [1]. The equational deductive system of this 1990 paper was rst presented at an International Conference on Computer Logic in Tallinn, Estonia, in 1988. Out of this concrete focus on computer implementation we came to the deeper problem of developing a system of constructive nonstandard analysis, which was rst presented at the IX Latin American Symposium on Mathematical Logic in Bahia Blanca, Argentina in 1992, and published as [9]. At the time of Rolando's death in the spring of 1994, we were working (by e-mail) on the rst notes for the isomorphism theorem presented in this paper, and we were planning to meet at Stanford in June, 1994, following a visit of mine to Santiago in January, 1994. His sudden and unexpected death left a still un lled void for many of us, both in Chile and in the United States. His wonderfully energetic and optimistic spirit is much missed.

1

is meant to provide a foundation that is close to the mathematical practice characteristic of theoretical physics. For detailed elaboration of this viewpoint see [9]. Perhaps the most important point to mention here is that many standard theorems are weakened in our constructive framework to proofs of approximate equality rather than exact equality. But an in nitesimal dierence is as good as equality for physical purposes. In part, the intention of this paper is to present a system of nonstandard analysis called elementary recursive nonstandard analysis, ERNA, which is a simpli ed, and more versatile, version of the system presented by Chuaqui and Suppes in [2, 9]. As in [2], we give a nitary consistency proof for our system; the proof here is free of many of the technical details present in the proof given in [2], hopefully making this proof more transparent. Also, we will clarify, precisely, to what extent this consistency proof is nitistic; in the terminology of proof theory, we measure the proof theoretic strength of ERNA. This paper will not present the details of developing mathematics in weak systems of nonstandard analysis. The reader is referred to [4] for a general development of nonstandard analysis, and to [2, 9] to see how a signi cant amount of the analysis that is relevant to applications in the physical sciences can be developed in ERNA. Although the work here is a continuation of the work presented in [2, 9], this paper is self-contained. The claim, stated above, that ERNA is more versatile than the system of Chuaqui and Suppes follows from the fact that ERNA allows for a form of de nition by recursion. Functions, such as factorial and summation, that are de ned using recursion, are built into the systems in [2, 9] individually; there is also an implicit use of de nition by recursion in the development of calculus given in these papers. Incorporating de nition by recursion directly into the system allows the simpli cation of not having to include axioms for several individual functions, and it justi es further use of this method for de ning additional functions. Another feature of ERNA that diers from the system of Chuaqui and Suppes is that ERNA contains a constant symbol " that is intended to denote an \unde ned element." Since the system includes division, we need to deal with the possibility that 0 will occur in the denominator. Also, some of the other function symbols of the language denote functions that are not total (i.e., functions that are not de ned on all real numbers). The constant symbol " denotes the value of a function for the cases that the function is \unde ned"; for example, 1=0 = ". In order to have a nitary consistency proof for the system it is necessary to restrict the form of de nition by recursion; it is well known that arithmetic with full primitive recursion cannot be nitisticly proven consistent. In ERNA recursion is restricted in the same way as in the development of Kalmar elementary arithmetic; hence the terminology elementary recursive nonstandard analysis (cf. [6]). This will be explained further in Section 2 where the details of ERNA are presented. In Section 3, we show that ERNA contains all of the 2

axioms of the system presented in [2] except external minimum. The version of external minimum in ERNA seems proof-theoretically weaker than the version of external minimum in the system of Chuaqui and Suppes (although we have not proved this), but, we believe, the version of external minimum included in ERNA is sucient for carrying out the kind of mathematics used in the physical sciences, as mentioned above. The consistency proof for ERNA is given in Section 4. The proof will use Herbrand's theorem, and it applies a construction modeled after techniques introduced by Paris and Kirby in [5], and applied by the rst author in [7] and [8]. What will be noted in Section 4, and then elaborated on in later sections, is the fact that the proof entails an algorithm for constructing a kind of nite model for the system, which is also the case for the consistency proof in [2]. A discussion of the limitations of this kind of construction is presented in Section 5. In Section 6, we go on to prove a theorem that asserts that the substructure determined by the interpretation of a nite set of terms in a \reasonably sound" in nite model of nonstandard analysis is isomorphic to nite substructures of the standard rational numbers. In that section we will discuss how this yields a partial isomorphism from the physically continuous to the physically discrete. The existence of such an isomorphism is surprising, but it supports the strong physical intuition that no experiments can distinguish between any physical quantities, even space and time, being continuous or discrete at a ne enough level. Philosophically, we can say that the continuum may be real for Platonists, but it can nowhere be unequivocally identi ed in the real world of physical experiments. Although the consistency proof is very constructive, the proof of the isomorphism theorem is not. This will be discussed in Section 7. But, in addition to negative results regarding the inability to construct the nite models referred to in the isomorphism theorem, we present a positive result, showing that in a certain special case such a model can be constructed. In particular, we present a very simple example taken from a physical problem.

2 Elementary Recursive Nonstandard Analysis 2.1 The language of ERNA

ERNA is formulated in a language with: 1. Variables: v0 , v1 , . .. . 2. Relation symbols: Inf, N , =, and . (The symbol Inf is intended to denote the set of in nitesimals and N is intended to denote the set of natural numbers.) 3. Individual constant symbols: 0, 1, 0, 0, and ". (The symbol 0 is intended to denote an in nite natural number and 0 denotes its reciprocal; 3

" is intended to denote the value of an \unde ned term" (such as 1=0), and x = " is read \x is unde ned".)

4. Function symbols: a. +, ?,
, , exp, j j, d e, and k k. (The symbol j j is intended to denote absolute value, d e is intended to denote the least integer greater than or equal to its argument, and exp is intended to denote exponentiation with natural number powers. The symbol k k is a norm function that will be used to provide bounds for functions de ned by recursion and to give the ERNA version of external minimum, as will be explained further below; it is de ned to be the maximum of the numerator and denominator of the relatively prime representation of a rational number.) b. An l-ary function symbol l;i for each pair of positive integers l and i, where i  l. (l;i denotes a projection function.) c. An m-ary function symbol min' for each quanti er-free formula ' with m + 1 distinct free variables, that does not contain terms involving min. (The symbol min' denotes a minimum operator for the least natural number satisfying '. The restriction that min cannot occur in ' is necessary for the system to have a nitary consistency proof; this will be explained further in Section 2.4.) d. An m + 1-ary function symbol recb for each positive integer b and each pair ;  of terms, with arities m and m + 2, respectively, that do not involve min. Note:  and  may contain occurrences of rec. Also, the arity of a term is the number of distinct free variables in that term. (The symbol rec b denotes the function obtained from  and  by de nition by recursion. The parameter, b, is used to bound the growth rate of the function. This will be explained in more detail shortly. The restriction that min cannot occur in the terms  and  comes about for the same reason as the similar restriction in c, above.)

2.2 Conventions and De nitions

1. Throughout this paper we will use vector notation, such as ~x, to denote sequences of variables, terms, etc. For example, ~x is understood to abbreviate x1; : : :; xl , for some l that can be determined from the context. 2. x exp y will be abbreviated by xy . 3. A formula is internal if it does not contain occurrences of Inf or terms de ned using Inf. A formula is external if it contains occurrences of Inf or terms de ned using Inf. 4

4. The variables i, j, k, l, m, and n, will range, exclusively, over N ; for example, '(n) is an abbreviation for N (vi ) ! '(vi ) for the appropriate variable, vi . 5. x  y will be used to denote Inf(x?y), and will be read \x is approximately equal to y". Thus x  0 will be used to denote Inf(x), but may still be read \x is in nitesimal." 6. x  1 is used to denote x 6= 0 ^ Inf(1=x) and is read x is in nite. Also, x 6 1 is used to denote x = 0 _ :Inf(1=x), and is read x is nite. 7. For  a term, ( #) will be used to denote  6= ", and will be read \ is de ned". Also, ( ") may be written in place of  = ", and is read \ is unde ned."

2.3 The axioms of ERNA

(N) Natural number axioms: 1. N (0) and if N (x) then N (x + 1). 2. If N (x) then either x = 0 or N (x ? 1). 3. If N (x) then x  0. 4. N (0). (I) In nity axioms: 1. The sum of two in nitesimals is an in nitesimal: x  0 ^ y  0 ! x + y  0: 2. The product of an in nitesimal and a nite number is an in nitesimal: x  0 ^ y 6 1 ! xy  0: 3. In nitesimals are nite: x  0 ! x 6 1: 4. If jxj is less than an in nitesimal then x is an in nitesimal: jxj  y ^ y  0 ! x  0: 5. The sum of two nite numbers is nite: x 6 1 ^ y 6 1 ! x + y 6 1: 5

6. 0 is an in nitesimal:

0  0:

7. 0 = 1=0. (F) Axioms asserting that the elements, other than ", constitute an ordered eld of characteristic 0 with absolute value function. (A) Archimedean axiom: If x # then N (dxe) and dxe ? 1 < x  dxe. (This is called the Archimedean axiom since it implies the Archimedean principle that asserts that for each x there is a natural number n such that x  n.) (E) Recursive de ning equations for exponentiation for natural number powers: if x # then x0 = 1 and xn+1 = xn
x: (P) Axioms for the projection functions: if, for j = 1; : : :; l, xl # then l;i (~x) = xi: Next we provide some motivation that will make the de nition of recursion allowed in ERNA more transparent; this de nition is given in the form of the axioms (R) below. First consider the usual equations for de nition by recursion; the following de ne, by recursion, a function f, from functions g and h. () f(0;~x) = g(~x) and f(n + 1;~x) = h(f(n;~x); n;~x): Although these equations are easier to read if the parameters ~x are suppressed, we exhibit the parameters since it will be important to keep track of them in the version of recursion allowed in ERNA. Although recursion in the above form is very useful, and simple to present, it cannot be justi ed nitisticly (in the sense that if it is allowed as an axiom, the resulting system will not have a nitary consistency proof). This can be remedied by putting bounds on the growth rates of the functions obtained using this de nition. In particular, if we require functions given by () to be bounded in growth rate by, say, an exponential function, then the system has a nitary consistency proof (as will be demonstrated in Section 4). Observing that exponentiation is built into ERNA, in axiom (E), it is clear that ERNA allows for nite iterations of the exponential function. In particular, for each natural number k, the following function is given by a term in ERNA,


2x

x 7! 2xk =def |222{z } : k 20 s

6

By using terms of the form 2xk as bounds on the functions de ned by recursion we can insure that all terms, not involving min, are in some sense bounded by such a term. This is a key point for carrying out the consistency proof. Also it should be noted that exponential functions provide suitable bounds for the functions, de ned by recursion, that come up in practice. While the notion of exponentially bounded is quite clear for functions on the natural numbers, we run into trouble when we try to describe such bounds for functions on the real numbers. This can be illustrated by the problem of showing in what sense a function such as x?1 y is exponentially bounded, when x and y range over the reals. We are faced by the problem that the sizes of x and y, individually, do not seem to have anything to do with the size of x?1 y , for any reasonable notion of \size." This problem can be solved, however, if we restrict our arguments to rational numbers; in that case, we can take as our notion of \size" the norm function k k introduced in the list of symbols for ERNA. We will refer to kxk as the weight of x, and the following axiom properly de ne this function. The proposition that follows the statement of the axiom will clarify the meaning of kxk. (W) If (kxk #) then N (kxk) and kxk = 6 0. And if jxj = mn , where n 6= 0 (so x is rational), then (kxk #) and 1. if jxj  1 then N (kxk
jxj) and kxk  n, and 2. if jxj  1 then N ( kjxxjk ) and kxk  m. From the axioms we have listed so far we can prove.

Proposition 2.1 1. The norm

8 x = ab where a and b are > > < maxfjaj; jbjg ifrelatively prime integers kxk = > : " if for all integers a and b, x 6= ab :

2. If (kxk #) then kxk = k x1 k. 3. If (kxk #) and (kyk #) then

kx + yk; kx ? yk; kx
yk; k xy k  (kxk + 1)
(kyk + 1); and kxy k  (kxk + 1)kyk+1:

4. k0k = 1 and kn + 1k = n + 1. 5. If (kxk #) then jdxej = kdxek  kxk.

7

For ~x = x1 ; : : :; xl , de ne

k~xk =def maxfkx1k; kx2k; : : :; kxl kg: Using Proposition 2.1 it is easy to show

Proposition 2.2 For any term  of ERNA, not involving  ,  , rec or min, there is a k such that k(~x)k  2kk~xk : 0

0

The reader should be able to readily see that (R), below, is just a version of (), above, that incorporates exponential growth bounds de ned using the weight function. The term  appears in place of g,  appears in place of h, and recb appears in place of f. (R) Axioms for de nition by recursion: Suppose  and  do not involve min, then 1.  x) if k(~x)k  2kb ~xk , or (~x) = " b rec  (0;~x) = (~ 0 otherwise. 2. recb (n + 1;~x) = (recb (n;~x); n;~x) if k(recb (n;~x); n;~x)k  2kb ~x;n+1k or if (recb (n;~x); n;~x) = "; and recb (n + 1;~x) = 0, otherwise.

(IM) Quanti er-free internal minimum: For each quanti er-free internal formula ', that does not involve min, if '(n;~x) then

N (min' (~x)); min' (~x)  n; and '(min' (~x);~x): and if :'(min' (~x);~x) then min' (~x) = 0. This axiom speci es that min' is given by:  9n'(n;~x); min' (~x) = 0the least n such that '(n;~x) ifotherwise, whenever ' is a quanti er-free internal formula not involving min. (EM) Quanti er-free external minimum: For each quanti er-free external formula ', that does not involve 0, 0, or min, if k~x; nk 6 1 and '(n;~x) then

N (min' (~x)); min' (~x)  n; and '(min' (~x);~x): 8

and if :'(min' (~x);~x) then min' (~x) = 0. This axiom speci es that min' is given by: if k~xk 6 1 then  (9n 6 1)'(n;~x); min'(~x) = 0the least n such that '(n;~x) ifotherwise, whenever ' is a quanti er-free external formula not involving 0, 0, or min. (U) Unde ned Terms: 1. (0 #), (1 #), (0 #), and (0 #) 2. (jxj #) $ (x #) $ (dxe #) $ (kxk #). 3. (x + y #) $ (x ? y #) $ (xy #) $ ((x #) ^ (y #)). 4. (x  y #) $ ((x #) ^ (y #) ^ y 6= 0). 5. (xy #) $ ((x #) ^ (y #) ^ N (y)). 6. (l;i (~x) #) $ ((x1 #) ^ : : : ^ (xl #)). 7. :N (x) ! (recb (x; y~) "). 8. (min' (~x) #) $ ((x1 #) ^ : : : ^ (xl #)). Note that (U7) is of a dierent form than the other (U) axioms. This is justi ed by the fact that rec will use the other function symbols of the language when de ning a function; so, as a result of (R), the functions de ned using recursion will become \unde ned" exactly when they should.

2.4 Remarks about ERNA

1. Note that (P), (R), (IM), and (EM) are axiom schemata; i.e., they consist of in nitely many axioms. 2. Important for our consistency proof is that all of the axioms of ERNA are quanti er-free, with free variables. This is clear from an inspection of the statement of these axioms as given in Section 2.3, except for the eld axioms, which are not listed. The eld axioms that assert the existence of additive and multiplicative inverses are typically given as existential statements. In ERNA, we suppose they are given by:  x + (?x) = 0, where ?x =def (0 ? x), and  If x 6= 0, then x
x?1 = 1, where x?1 =def 1=x. Also, since we have the constants 0 and 1, we do not need existentially quanti ed axioms for the existence of additive and multiplicative identity elements. 9

3. As is the case in formalizations of number theory, having a minimum operator is equivalent to having induction; in particular, axioms (IM) and (EM) are equivalent to induction axioms for quanti er-free, internal and external, respectively, formulas that do not involve min. In the case of (EM), this is an induction axiom for the \ nite" natural numbers. 4. It is worth mentioning that in many formalizations of fragments of number theory, de nition by recursion can be proved from induction. This is not the case here since we do not have a coding apparatus for coding sequences of elements of the universe that would allow us to carry out the usual proof from number theory. 5. As was mentioned in Section 2.1, when introducing the symbols min' , the restriction of not allowing min to appear in ' is necessary in order to have a nitary consistency proof. The operator resulting from the removal of this restriction is equivalent to a minimum operator for formulas with natural number quanti ers (note: 9n'(n;~x) is equivalent to '(min' (~x);~x)). The strength of the resulting system would be the same as Peano Arithmetic, which does not have a nitary consistency proof. 6. In the following sections we will make use of the fact that the rational numbers are closed under all functions de ned by ERNA terms. This is stated precisely in Lemma 2.4 below; rst a preliminary lemma.

Lemma 2.3 In ERNA the set of natural numbers is closed under j j, k k, +, and
. This lemma is used mainly to prove the next lemma, Lemma 2.4, which plays an important role in later sections.

Proof of Lemma 2.3: That N is closed under j j follows directly from the eld axiom that asserts x  0 ! jxj = x and axiom (N3). That N is closed under k k follows from axiom (W). To see that N is closed under + and
, it is enough to carry

out the usual proof by induction, which can be carried out in ERNA. In particular, to get N (x) ^ N (y) ! N (x + y); x x such that N (x), and suppose, for a contradiction, that for some y, N (y) and :N (x + y). Use (IM) to get the least y such that N (y) and :N (x + y). Note that y 6= 0 since, by a eld axiom, x + 0 = x and we are assuming N (x). Using (N2), we have N (y ? 1). By the leastness of y, and using some eld axioms, N (x + (y ? 1)). Using (N1), and some eld axioms, we have N (x + y), the desired contradiction. The proof for multiplication is similar. This concludes the proof of Lemma 2.3. 10

It will be useful to de ne \x is rational" by the formula: 9m9n(n 6= 0 ^ jxj = mn ): Recall the convention, in clause 3 above, of using m and n to range over elements of N .

Lemma 2.4 In ERNA the rationals are closed under all \de ned" func-

tions in the language of ERNA. In particular, for any term, (~x), in the language of ERNA, where ~x includes all free variables of the term, ERNA proves that if (~x) # and \x1 ; : : :; xl are rational" then \(~x) is rational".

Proof of Lemma 2.4:

The proof goes by induction on the construction of ; more precisely, by induction on the depth of , where depth is de ned in the natural way (also, depth is de ned in Section 4). Clearly, using (N1), (N4), and (I8), ERNA proves that 0, 1, 0, and 0 are rational. Using the eld axioms, it is straightforward to show, using Lemma 2.3, that the absolute value, weight, sum, dierence, and product of rationals is rational. Also, it is nearly immediate to see that the application of d e, l;i , or min' to rationals is rational (note the default value 0 for min'). We have left to show that the rationals are closed under exponentiation (to integer powers), and under functions de ned by recursion using rec. The two cases are similar; they both use induction. First, suppose, for a contradiction, that for some x and y, xy # and :N (xy ). Using (IM), suppose N (x) and suppose y is least such that N (y) and :N (xy ). Since x0 = 1, we know that y 6= 0, so, by (N2), N (y ? 1), and, by the leastness of y, N (xy?1). By (E), xy = xy?1
x, but then, by Lemma 2.3, N (xy ), a contradiction. The proof for the more general case of terms involving rec, is very similar. This concludes the proof of Lemma 2.4.

3 The Chuaqui and Suppes system vs. ERNA The aim of this section is to show that, with the exception of external minimum, ERNA is capable of proving all of the axioms of the system of Chuaqui and Suppes in [2]. The system in [2] has the following function symbols that are not contained in ERNA: X ; li; max ; ; and !:  The system in [2] also has symbols, and axioms, for dierentiation and integration, but it is shown (early in [2, Section 3]) that the system is a conservative 11

extension of the system without dierentiation and integration, and thus we need only concern ourselves with the latter system. Mainly, to show that the system in [2], except for its version of external minimum, is contained in ERNA, we need to show that the above functions are de nable, and their de ning axioms are provable in ERNA. In the process of doing so we will exhibit a list of basic functions that are de nable in ERNA. By de nable we mean that there is a term of the language that (provably in ERNA) has the properties of the function. 1. The identity function id is de nable in ERNA. In particular, id is simply 1;1. 2. For each closed term  there are constant functions Ck; of each arity k with value . In particular, k+1;k+1(x1 ; : : :; xk; ) is such a function. 3. There is a de nable function  such that,  x = 0, and (x) = x1 ifotherwise. In particular,  is obtained from the function r, de ned by recursion,  n = 0, and r(n) =def 01 ifotherwise. (r is rec10C2 1 ), by taking, (x) =def (x + 1) ? r(djxje): Note: it will be useful to use  in the event a denominator is potentially 0; an example of this occurs in the next item in this list. 4. The function 1 given by  x0 1 (x) = 10 ifotherwise, is de nable by xj + x : 1 (x) = j2(x) ;

5. The function, d , de ned by cases from the terms ,  and , is given by  x) if (~x)  0 d (~x) = (~ (~x) otherwise, is de nable in ERNA. In particular, d(~x) = 1 ((~x))(~x) + (1 ? 1 ((~x)))(~x): 12

Now, on to the functions of the system of [2]: 6. The function , from [2], given by  if x  0 (x) = ?11 otherwise, is de nable using de nition by cases, so is de nable in ERNA. 7. max , from [2], is given by 8 if n = 1. < 1 max (n) = : n + 1 if (max (n)) < (n + 1) if n > 1. max (n) if (max (n))  (n + 1). 



Since this is a combination of de nition by recursion and de nition by cases, it is justi ed in ERNA. 8. ! is de ned by recursion: 1! = 1 and (n + 1)! = n!
(n + 1). In particular, noting kn!k = n!  nn  nn log2 n  2n2  22 = 22k k ; it is clear that rec21 v
(w+1) de nes factorial. P 9. is de ned by recursion: 1 nX +1 n ! X X  = (1) and =  + (n + 1): n

k=1

k=1

n

k=1

10. li(x), an integer greater than x, can be taken to be dxe. We use the bound b (from Proposition 2.2) for the term (maxk k)n in the relevant instance of rec. Hence, all of the functions of the system of Chuaqui and Suppes in [2], except its version of external minimum, are de nable in ERNA. We do not give a comparison of the version of external minimum presented in [2], and the version of external minimum in ERNA. We believe that the version here is sucient for carrying out the mathematical arguments that are presented in [9]; our hope is to present a demonstration of that in future papers.

4 The consistency of ERNA This proof will use Herbrand's theorem in the same way as the consistency proof presented in [2]. In particular, an algorithm will be given for assigning a rational number value val() to each term  in a xed nite set of terms T ; we extend the rationals by including an element to represent an \unde ned value," i.e., 13

the interpretation of ". The val-assignment will then be used to assign truth values to atomic formulas. This will be done in such a way that any axiom of ERNA, that only involves terms in T , will be assigned true. Furthermore, all of the logical equality axioms will be true in this assignment. From Herbrand's theorem, we conclude ERNA is consistent. Also, it will be shown that the valassignment, in fact the entire consistency proof, can be carried out in primitive recursive arithmetic (PRA), and hence, ERNA has a nitary consistency proof. It is useful to view the assignment of the val function as the construction of a nite model. In particular, the elements of the range of val, when restricted to our xed nite set of terms, make up the universe of what can be construed as a nite approximation of a model of the theory. This will be explained and discussed in much greater detail in the following sections (it is the focus of the later sections of this paper); at this point, we mention this only to describe how we are using this terminology to explain and motivate the assignment of val. Now we describe the form of the nite sets of terms that will be handled in our construction. Suppose S is a nite set of function symbols in the language of ERNA. Let TiS denote the set of terms with depth less than or equal to i that only involve function symbols from S, where the depth d() of a term  is de ned inductively as follows.  If  is an individual constant then d() = 0.  d(f(~ )) = maxfd(1 ); d(2); : : :; d(l )g + 1, for each function symbol f in the language of ERNA. Note that '(~ ) may have occurrences of terms of depth strictly greater than the depth of 1 , 2, .. ., l . Clearly, TiS is nite; in fact if ti denotes the cardinality of TiS , and if A is a number at least one greater than the maximum arity of the ( nitely many) function symbols in S and A is greater than the number of function symbols in S, then ti  AA : This follows from the fact that there are fewer than A terms of depth 0, and the fact tj +1  tAj : We suppose a maximum depth D and a nite set of function symbols S are xed. The val-assignment will be given to terms in TDS inductively on the depth of terms, and it will satisfy the following homomorphism properties: Val1 For all functions, f, of ERNA, except min', 0 , and 0: i

val(f(1 ; : : :; l )) = f(val(1 ); : : :; val(l )): Individual constants are treated as 0-ary functions. 14

Val2 For all relations R of ERNA except Inf: val(R( ; : : :; l )) = true () R(val( ); : : :; val(l )): 1

1

The idea here is that, for the most part, val is computed by computing the corresponding functions in the usual way. It is important to note that in the case that f is of the form recb then we may need to know val as it is applied to terms other than the arguments of f; in particular, we need to know the value of any constants in  and ; this is only potentially troublesome in the event that  or  include the constants 0 and 0 . However, since val(0 ) and val(0 ) are given below, we are able to compute val, in the case f is of the form recb , in the natural way. At the start of this section we mentioned that val would assign rational number values to all terms in our xed nite set of terms. From Val1 it is clear that this will be the case once we note that all ERNA-terms take rationals to rationals. This fact appeared, in Section 2, as Lemma 2.4. Properties Val1 and Val2 determine the val assignment in almost all cases, and since the axioms (N1{3), (F), (A), (E), (P), (R), (W), and (U) all hold in the rationals (with "), Val1 and Val2 insure that our truth assignment will assign true to all instances of these axioms that only involve terms in TDS . For example, suppose 0, , and  + 1 are all in TDS , and consider the following instance of (N1) N (0) ^ (N () ! N ( + 1)): By Val1, val(0) = 0, and, by Val2, noting that N (0) is true, val(N (0)) = true, so the rst conjunct of the axiom is assigned true. If val() is not a natural number then, by Val2, val(N ()) = false, and so the second conjunct is also true. If val() is a natural number then, using Val1, val( + 1) = val() + 1 is also a natural number, and, by Val2, the second conjunct is again true. It remains to show how to assign val to 0, 0, min' , and Inf, so that (N4), (I), (IM), and (EM) hold. More speci cally, we need to deal with the following a. val(0) needs to be assigned a nite natural number value so that (N4) and (I6) are satis ed. To satisfy (I7), we will take val(0 ) = 1=val(0). b. Values have to be assigned to terms involving min' in a nitistic way. It is important to note that we cannot assign val to terms involving min' by using Val1 as we did with the other functions. This is because the computation of min' is not constructive | it involves an unbounded search. The val-assignment for min' will be made constructive, in fact nitistic, by bounding the search; although val(min' (~ )) may not receive its true value (in the sense of the standard rationals), it will receive a value that will lead to an assignment of true to the relevant instances of (IM) and (EM). 15

c. Truth values need to be assigned to Inf so that the axioms (I) hold. Also, we will need these assignments to assign values to the external minimum operator. Satisfying a{c, above, involves selecting sequences of standard natural numbers, ai , bi, ci , and di , for i = 0; : : :; D. The construction carried out here is modeled after one that rst appeared in [5], and was developed further in [7] and [8]. How these sequences are used in the val-assignment, and how they are de ned, will be explained in detail below. Since we are simultaneously working to satisfy several axioms, and, at the same time, we are working to keep our construction nitistic, there are many considerations that need to be taken into account in this construction. We will proceed in the following steps: Step 1: The val-assignment for 0, 0, Inf, and min' will be given in terms of the sequences of a's, b's, c's, and d's. Step 2: Assuming certain properties of these sequences, the axioms of ERNA are shown to hold. Step 3: The construction of the sequences will be described. Step 4: The entire construction will be shown to be nitistic. In the following paragraph we give an informal description of some of the intuitions behind the construction. This description is intended to give the reader a better picture of the construction; it is not intended to constitute an essential part of the proof. We view the val-assignment and the construction of the sequences of a's, b's, c's, and d's as a D-stage construction, where in stage i terms of depth i are handled assuming that terms of depth less than i were assigned values at earlier stages. The numbers ai, bi , ci , and di are associated with stage i of the construction. All of the a's are less than all of the b's which are less than all of the c's which are less than all of the d's, and the ai 's and the ci's are increasing sequences, and the bi's and di's are decreasing sequences (this is expressed in P1, below in step 2). The interval [bi ; ci] represents the \in nite" part of the model at stage i in the sense that if  is of depth less than or equal to i and bi  jval()j  ci , then the formula   1 is assigned true. Implicit in this assertion is the fact that ci serves as an upper bound for jval()j, when  has depth i. So f0g[ [ c1 ; b1 ] represents the in nitesimal part of the model at stage i in the sense that if  2 TiS , and jval()j 2 f0g [ [ c1 ; b1 ] then val(Inf()) = true. And the interval [ a1 ; ai] represents the nite, non-in nitesimal part of the model; i.e., if  2 TiS and jval()j 2 [ a1 ; ai ] then val(Inf()) = false and val(  1) = false. In most cases, Val1 is used to assign values to terms. Property P2, below, insures that there will be \enough space" to carry this out; this is explained in step 3. i

i

i

i

i

16

i

Step 1: Now the remaining cases of the val-assignment are described. Val3 Set val( ) = b and val( ) = 1=b . Val4 Set val(Inf()) = true if and only if jval()j  b . 0

0

0

0

1

D

Note that in the above paragraph we asserted that the in nitesimal part of our models at stage i corresponds to f0g [ [ c1 ; b1 ], and so, when the construction is complete, the in nitesimal part of the model will correspond to f0g [ [ c1 ; b1 ]; note, however, that jval()j will not be in the interval (0; c1 ), so Val4 captures what we want (this is explained further below). To increase readability for the val-assignment for terms involving min' , we introduce two abbreviations. Let val(~ ) denote the sequence val(1 ), . .., val(l ), and let  least n  m such that '(n) if (9n  m)'; (n  m)' =def the 0 otherwise. Val5 For ' internal set val(min' (~ )) = (n  cD )(val('(n;~ )) = true) i

i

D

D

D

Val6 For ' external, and kval(~ )k  aD , set val(min'(~ )) = (n  aD )(val('(n;~ )) = true): Note that Val4 (together with Val1{3) gives us a way of evaluating val('(n;~ )) in the case ' is external. Also note that the de nition of val on min-terms seems to require that we know what aD and cD are, but in the description of the construction given above, these numbers are not de ned until the Dth stage of the construction, and we layed out the plan of setting the value of terms of depth i at stage i. Later, in step 3, we will show that indeed the value of min-terms of depth i can be determined at stage i, even though aD and cD are not known.

Step 2: Here we show that the axioms of ERNA, associated with min', 0, 0, and Inf, are satis ed by our val-assignment. For that we will assert some properties of the sequences ai, bi , ci , and di. For now the reader will have to take on faith that sequences with these properties can be constructed; in step 3, we show that sequences with these properties can, indeed, be constructed. P1 0 < ai?1  ai  bi  bi?1  ci?1  ci  di  di?1. P2 If  2 TiS then jval()j; jval1( )j ; kval()k 2 [0; ai] [ [bi; ci] [ f "g. P3 If 0 < i  D then 2ai?1 < ai .

17

P4 If 0 < i  D then (bi )2 < bi?1. Now onward to show that the axioms of ERNA are satis ed. (N1{3), (F), (A), (E), (P), (W), (R), and (U). As was pointed out in the discussion following the statements of Val1 and Val2, these axioms are all a direct consequence of Val1 and Val2. In the discussion of the remaining axioms, we assume that, for all terms , the rules given in (U) cannot be used to show val() = "; i.e., we assume that all terms are \de ned." The unde ned cases are handled in a straightforward way. (N4) Since b0 is a natural number, Val2 and Val3 insure that N (0 ) is assigned true. (I1) Suppose val(Inf()) = true, val(Inf()) = true, and  +  2 TDS . Then ;  2 TDS?1 , so, by P2, 1 ; 1 2 [0; a ] [ [b ; c ]: D?1 D?1 D?1 jval()j jval()j Using the facts val(Inf()) = true and val(Inf()) = true, we have jval1( )j  bD and jval1()j  bD , and so by the above and P1 we have 1 ; 1 b : jval()j jval()j D?1 Hence jval()j; jval()j  b 1?1 . Using Val1, and properties of absolute value, jval( + )j  b 2?1  b1 ; this last inequality follows from P4 with D in place of i and noting, from P1, P3, and P4, bD  2. Hence val(Inf( + )) = true. (I2) Suppose val(Inf()) = true, val() = 0 or val(Inf( 1 )) = false, and 
 2 TDS . In the case val() = 0, Val1 implies val(
) = 0, so, by Val4, val(Inf(
)) = true. Otherwise, note ;  2 TDS?1. Also, val(Inf( 1 )) = false implies jval()j < bD . Using P1 and P2, we have jval()j  aD?1 . Also, by an argument like the one used in (I1), jval()j  b 1?1 , so, using Val1 and properties of absolute value, jval(
)j  ab ??11  b1 ; this last inequality follows from P4 noting also that, from P1, aD?1  bD . Hence val(Inf(
)) = true. (I3) We need to show that if val() 6= 0 then Inf() and Inf(1=) cannot both be assigned true. By Val4, this is the same as saying jval()j  b1 and jval( 1 )j  b1 cannot both hold. This is clearly the case by Val1 and the fact bD > 1. (I4) This readily follows from Val4. (I5) Suppose val( 6 1) = true, val( 6 1) = true, and  +  2 TDS . Then ;  2 TDS?1, and, using Val4, P1, and P2 (in argument similar to the one carried out in the (I1) case) jval()j; jval()j  aD?1 . Thus, using Val1, and properties of absolute value, jval( + )j  2aD?1  aD ; this last inequality follows from P3 with D in place of i. So val( +  6 1) = true. D

D

D

D

D

D

D

D

D

18

(I6) This follows readily from Val3 and Val4. (I7) This is immediate from Val3. (IM) Suppose '(val(); val(~ )) holds for some  2 TDS . Then since all valassignments, for the elements of TDS , are less than or equal to cD , we have '(n; val(~ )) holds for some n < cD , and hence, by Val5, val(min' (~ )) = the least such n. This insures that (IM) holds. On the other hand, suppose '(val(); val(~ )) fails for all  2 TDS , then '(val(min' (~ )); val(~ )) fails, so, by Val5, val(min'(~ )) = 0, and again (IM) is seen to hold. (EM) The argument is to similar to that for (IM), but aD is used in place of cD , and we note that for  2 TDS if val( 6 1) = true then val()  aD .

Step 3: In order to de ne the ai's, bi 's, ci's and di 's, rst let B be a natural number such that for any  that is either a function symbol in S, or is a term that occurs as  or  where recb  is in S, or is a term that occurs in ', where min' is in S, we have (using Proposition 2.2) kf(~x)k  2kB~xk : We will use the following hierarchy of functions de ned on natural numbers.  f0 (x) = 2xB .  fn+1 (x) = fnT (x), where T = 3tD + 3. Note: the exponent, T, indicates T-fold iteration; i.e., fnT (x) = f|n (


fn (f {zn (x))


}). T fn0 s

In addition to properties P1{4, we will show that the ai 's, bi's, ci's, and di 's satisfy the following properties. These are needed in the induction hypothesis to continue the construction from stage to stage. P5 For i = 1; : : :; D, bi = fD?i+1 (ai ). P6 For i = 1; : : :; D, di = fD?i+1 (ci ). By setting a0 = 1, b0 = fD+1 (a0 ), c0 = b0 , and d0 = fD+1 (c0 ), it is straightforward to check that P1{6 hold for i = 0. Suppose that a0 ; : : :; ai , b0; : : :; bi, c0; : : :; ci, and d0; : : :; di have been selected such that P1{6 hold, and suppose i < D. We need to show how to select ai+1, bi+1 , ci+1 , and di+1 so that P1{6 are satis ed with i + 1 in place of i. Using P5, and the de nition of the fn 's we see that the interval [ai; bi] can be partitioned into 3tD + 3 intervals of the form () (fDj ?i (ai ); fDj +1 ?i (ai)] for j = 0; : : :; T ? 1 = 3tD + 2. Similarly, using P6, the interval [ci; di] can likewise be partitioned. Now, consider a term f(~ ) 2 TiS+1 . If f is any function 19

of ERNA, except min' , we can compute val(f(~ )). Val5 and Val6 cannot be used to compute val(min' (~ )) since we do not yet know what aD and cD are. Using P1 and P2, it is easy to see, noting that min' (~ ) 2 TiS+1 , that Val5 is equivalent to Val50 For ' internal val(min' (~ )) = (n  ci+1 )(val('(n;~ )) = true) and Val6 is equivalent to Val60 For ' external, and kval(~ )k  ai+1 , val(min' (~ )) = (n  ai+1)(val('(n;~ )) = true): The plan is to pick ai+1 and ci+1 carefully so that we can be sure that P2 is satis ed when  is of the form min'(~ ). This will be done by considering all possible values of min'(~ ) and using the partition of [ai ; bi] given by (), along with the corresponding partition of [ci; di]. In this direction, we compute n'(~ ) = (n  di )'(n; val(~ )); if ' is internal, and

n'(~ ) = (n  bi )'(n; val(~ )); if kval(~ )k  ai and ' is external. It is clear that n'(~ ) can be computed in the case that ' is internal, but it is important to explain how to compute n'(~ ) in the external case; in particular, without knowing bD we need to say how we are going to compute the value of Inf-terms. The fact of the matter is that we will get the right value, for such terms, if we set all terms of the form Inf(), in '(n; val(~ )), to false. This works since all of the parameters have norms less than or equal to ai. Also, all numbers n that are to be considered as possible values of min' (~ ), in the case that ' is external, can be considered to be less than ai+1 and so all terms , involved in the computation, will have norm less than or equal to 2Ba +1 . By choosing bD to be at least 2aBa +1 , we will have that j val1() j  bD and hence jval()j  b1 . The fact that 2B +1  bD follows from P1 and P5. So the goal is to simply make sure that none of the n'(~ ) 's end up in (ai+1 ; bi+1) [ (ci+1 ; di+1). Let V be the set of all of the numbers n' together with all of the values of f(~ ) in TiS+1 for the cases where f is not min' . Also, close V under taking reciprocals and norms; i.e., if x 2 V and x 6= 0, put 1=x 2 V and for all x 2 V put kxk 2 V . Since there are tD terms in TDS , there are at most 3tD elements in V (note that by Proposition 2.1, kxk = k x1 k. Now note that there are 3tD + 3 intervals of the form given in (); using the pigeon-hole principle, pick one that i

i

i

D

20

has empty intersection with V . Since there are at least three more intervals of the form () than there are elements of V , we can suppose 1  j  3tD +1. For such a j, let () ai+1 = fDj ?i (ai ) and bi+1 = fDj +1 ?i (ai ): The numbers ci+1 and di+1 are chosen in a similar manner. Now we show that P1{6 hold with i replaced by i + 1. From the construction, [ai+1; bi+1] is a subinterval of [ai; bi] and so ai  ai+1  bi+1  bi holds. Similarly, ci  ci+1  di+1  di. Since, by the induction hypothesis, 0 < ai and bi  ci, we have P1. To get P2, rst note that, if f is any function in S other than min' and f(~ ) 2 TiS then

kval(~ )k  ci implies kval(f(~ ))k  2cB : i

By the de nition of the fn 's, and noting that ci+1 = fDj ?i (ci) for some i < D and j  1, it follows that ci+1  2cB : So by P2, in the induction hypothesis, if f(~ ) 2 TiS+1, then kval(~ )k  ci , so, if f is not min' , then kval(f(~ ))k  ci+1 ; and hence, by Proposition 2.1, jval(1f (~ ))j ; jval(f(~ ))j  ci+1 . If f is min' then, by de nition, jval(f(~ ))j  di+1; since (ci+1 ; di+1] was selected to have empty intersection with V , we have jval(f(~ ))j  ci+1 , and jval(f(~ ))j 2= (ai+1 ; bi+1 ) is a direct consequence of our choice of ai+1 and bi+1 ; i.e., they were chosen so that the interval (ai+1 ; bi+1] has empty intersection with V . This completes the proof that P2 holds with i in place of i + 1. The proofs of conditions P3 and P4 are similar to each other. They follow from the fact that ai+1 and bi+1 were chosen to be suciently far away from ai and bi , respectively. Since j  1 in (), we know that ai+1  fD?i (ai ); by the de nition of the fn 's, we clearly have P3. And since j  3tD + 1, we have fD?i (bi+1)  fDT ?i (ai ) = bi , and P4 readily follows. P5 and P6 are immediate from () and the corresponding equations that are used to de ne ci+1 and di+1. i

Step 4: Finally we will show that the above construction is nitistic, and explain how this gives a PRA proof of the consistency of ERNA. See [10] for a discussion of the generally recognized fact that PRA captures Hilbert's notion of nitary. The construction, including the val-assignment, only involved computing the functions of ERNA on rational numbers. The only such function that is not primitive recursively computable is min' , but the versions of this that needed to be computed in the construction incorporated search bounds that 21

made it computable. Note that in order to compute these versions of min' we needed to evaluate ' with rational number instantiations of its variables. Again this can be done primitive recursively since ' does not contain occurrences of min. Also, in the case of the external minimum, we relied on the fact that we had a way of computing truth values for atomic formulas involving Inf. The sequences ai , bi, ci , and di were de ned using the hierarchy of functions fn. The function f0 was de ned as a xed nite iteration of exponentiation base 2; this is de ned in PRA, and for n > 0, the fn 's are obtained by iterating the previous function nitely many times. Clearly, each fn is bounded by a xed nite iteration of exponentiation base 2, so not only are these functions de nable in PRA, they are de nable in elementary recursive arithmetic. That is, for each nite n, fn is de nable in elementary recursive arithmetic, yet elementary recursive arithmetic does not prove a formalization of the statement \for all n, fn is de nable". So the consistency proof cannot be carried out in elementary recursive arithmetic. For a detailed account of elementary recursive arithmetic see [6]. Also, it is straightforward to see that the additional details of dividing the intervals into subintervals and applying the pigeon-hole principle can all be carried out in PRA. For example, the set V , de ned just above (), can be coded in PRA. In addition to noting that the construction can be carried out in PRA, we note that PRA proves a version of Herbrand's theorem. In particular, it is provable in PRA that if for any nite collection of instances of the axioms of ERNA there is a truth assignment that makes each axiom true, then ERNA is consistent. See [3] to see how theorems of this form are proved in PRA and weaker systems.

5 Finite Models In the previous section we referred to the val assignment as a construction of a nite model. In this section we will elaborate on the meaning of that association. Clearly, the assignment of the val function, on a nite set of terms TDS yields a nite set of rational numbers, and an assignment of truth values for relations on those rational numbers. Further, since our set of terms is closed under subterms, we can view val as giving an interpretation of the function symbols of the language. Of course, typically, val will not interpret a function to be de ned on all of the elements of the universe of the nite model; i.e., the functions will not be total in the model. None the less, we can view these as nite models of the relational structure of the language. The existence of such nite models, corresponding to sets of terms TDS , for arbitrary positive integers D, implies the consistency of the theory (that is Herbrand's theorem). The fact that this can be shown nitisticly is the essence of our nitary consistency proof. However, it is useful to view this from an 22

in nitary point of view. In particular, consider the set of all such nite models ordered by substructure; this ordering yields a tree. The consistency proof of the previous section shows that this tree is in nite. Also, since there are only nitely many terms of a given depth, we can structure the tree so that it is nitely branching. Konig's lemma then implies the tree has an in nite branch. It is straightforward to see that the union of all of the nite models along an in nite branch is an in nite model of the theory (terms of arbitrary depth are interpreted). Also, it is clear that the nite models along any in nite branch are substructures (as relational models) of the in nite model obtained as the union. These facts inspire the following questions: 1. To what extent can we nd nite models that are substructures of in nite models? 2. Does the algorithm, of the previous section, for assigning val, yield such models? The answers to these questions are primarily negative, and we will explain how so in this section. In the following sections we consider related questions, with the focus of the nal section on positive partial results. Although the construction of the previous section proves that there are nite models that are substructures of in nite models, there is no way to be sure that the models that are constructed are themselves substructures of in nite models. The models are produced to satisfy conditions on a xed nite set of terms, but it may very well be the case that a given model cannot be \expanded" to interpret additional terms. We will illustrate this with an example, but rst note that in the tree picture described above, it may be the case that the constructed model is an end node (leaf) of the tree. Keeping in mind that Konigs lemma is non-constructive, there is no seeming contradiction in the fact that constructing substructures of in nite models is impossible. For a simple example of a nite model that cannot be expanded to an in nite one, consider the following set of terms: T = f0; 1; 1 + 1; 0; (1 + 1)0 ; (0)1+1g: By setting val(0) = 4, and taking val(Inf()) = true if and only if jval()j  1=4, an assignment is determined in which all axioms involving the terms in T are assigned true. However, in this assignment, 20 = (0 )2; which can be refuted by the axioms, and hence this nite model is not a substructure of any in nite model. Note that in order to refute this statement, additional terms must be brought in, and once enough additional terms are brought in the above val-assignment cannot be used. 23

6 The Isomorphism Theorem In this section we state and prove the isomorphism theorem mentioned in the introduction. To amplify what was said earlier, the theorem supports the strong physical intuition that no experiment can successfully test when a physical quantity, such as time or density, is, when represented by a mathematical function, necessarily mathematically continuous or discrete. In particular, the theorem shows that the nite set of terms of a physical problem and its solution, expressible in the language of ERNA, must have, isomorphic to the standard interpretation of these terms, a nite set of rational numbers. The theorem also supports another intuition. The powerful results of classical analysis, so widely used in physics and other sciences, do not re ect directly actual properties of physical quantities, but rather ecient computational schemes for analyzing and predicting natural phenomena. In summary, the classical representation of many physical quantities as functions having strong smoothness properties is not something given in nature, but is computationally convenient, in the sense that one frame of reference is selected rather than another strictly for computational purposes. The following de nition is used in the statement of the isomorphismtheorem. A model of ERNA is reasonably sound if whenever 9n is satis ed in the natural numbers of the model (the interpretation of N in the model), where  is quanti er-free and does not involve Inf, 0, or 0, then 9n' is also true in the standard natural numbers. This is a version of what is sometimes called 1-consistency. By \standard natural numbers" we mean the natural numbers of the \meta-theory"; that is, in the theory in which all arguments of this paper take place. The standard natural numbers are isomorphic to the subset of the interpretation of N that consists of numbers that can be represented by ( nite) terms of the form 0 + 1 + 1 +


+ 1. Note that there may be elements n of a model M of ERNA, such that, in the model, n is nite and n is a natural number, i.e., () M j= n 6 1 ^ N (n); but n is not actually nite (in the sense that it cannot be represented by a nite term of the form 0 + 1 + 1 +


+ 1). Elements n of M that satisfy () are called M- nite. Sometimes we will use the terminology truly nite or truly standard for the nite elements of the standard model. We assume a similar de nition for standard rational number.

Theorem 6.1 Isomorphism Theorem Let M be a reasonably sound model of nonstandard analysis, and let T be a nite set of terms in the language of ERNA, closed under subterms. Then there are arbitrarily large (truly) nite natural numbers b, such that there is an isomorphism f from T M = f M :  2 T g, the M interpretations of the elements of T , to a nite subset of the (truly) def

standard rationals that satis es the following:

24

1. f(g(1 ; : : :; l )) = g(f(1 ); : : :; f(l )), where g is any function symbol of the language other than 0 and 0. 2. f(0 ) = n0 and f(0 ) = 1=n0, for some n0  b. 3. Inf() holds in M if and only if jf()j  1b . 4. N () holds in M if and only if f() is a natural number. 5.    holds in M if and only if f()  f(). Corollary 6.2 Let M and T be as in the statement of the theorem, and let f , f 0 be two isomorphisms given by the theorem. Then the nite models determined by f and f 0 are isomorphic.

The corollary follows readily from the transitivity of the isomorphism relation.

Proof of Theorem:

To prove the theorem we use the fact that the rationals are closed under all of the functions of ERNA; this is spelled out precisely in Lemma 2.4. From that lemma we will conclude that all closed terms, that are de ned in a model, are interpreted by rationals, in that model. This fact will allow us to show that the assertion of properties (1{5), for the terms in T , can be expressed by a formula of the form 9n', where ' is quanti er-free. The reasonable soundness condition thus implies that this formula is realized in the standard rationals. This implies that all of the terms, together with b and n0, can be interpreted by standard rationals in such a way that (1{5) are satis ed. This implies the theorem. This is worked out in greater detail below. Let T be a nite set of terms in the language of ERNA, closed under subterms. Suppose T = f1; : : :; k g: By Lemma 2.4, each term in T is realized by a rational number. We will use a standard pairing function to express this fact as well as the statement that all of the relationships between the terms in T as expressed in (1{5) in the statement of the theorem, hold. In particular, we coded the pair (m; n), using the standard pairing function (m; n) 7! (n + m)(n2 + m + 1) + m: Using this coding of pairs, we can code sequences of xed nite length (this will be sucient for our purposes; of course, ERNA has coding machinery to handle the coding of sequences, of natural numbers, of arbitrary length). Also, this pairing function has decoding functions that are de nable in ERNA. So, there is a formula of ERNA that expresses \there exists an n such that  n codes a sequence (b; n0; m1; n1; : : :; mk ; nk ) 25

 For i = 1; : : :; k,

  mi = ( )f mi1 ; : : :; mi ; i ni ni1 ni whenever i = f(i1 ; : : :; i ), f is not 0 or 0 , and (i ) is 1 or ?1 according to whether i  0 or i < 0, respectively, in M.  mn  mn if and only if i  j is true in M. l

l

l

i

j

i

j

 N ( mn ) if and only if N (i ) is true in M.  mn < 1b if and only if Inf(i ) is true in M. i

i

i

i

The formula just described is a formula that is of the form 9n' where ' is quanti er-free. Clearly, it is true in M, and so, by the reasonable soundness of M, it is true in the standard rationals. That means that n is realized by a truly standard natural number. Note further that we can incorporate into the above formula a condition b > B, where B is any closed term with the truly nite value B. The formula is still true in M, and hence, realized in the standard rationals. This implies that there are arbitrarily large nite values of b that work. This concludes the proof of the Isomorphism Theorem.

7 Constructing Finite Models In Section 4 we introduced a construction for obtaining nite models of ERNA, but in Section 5 we showed that the construction does not necessarily lead to a model that is a substructure of an in nite model. In Section 6, the isomorphism theorem asserts the existence of models that are substructures of reasonably sound models. In light of the discussion in Section 5, we cannot expect to algorithmically construct such nite substructures, and in a moment we will give a short proof of that claim. However, we note that in some cases one can nd such models, and we will illustrate this with an example. A construction of nite models that were substructures of reasonably sound models would entail a decision procedure for formulas of the form 9n' where ' is a quanti er-free formula of ERNA that does not involve min, Inf, 0, or 0. To see that this is the case, note that by constructing an interpretation, n' , of a term of the form min' (~m), we could then test the truth of 9n' by checking to see if '(n' ; m ~ ) holds. By the reasonable soundness condition, we would be evaluating the truth of 9n' in the standard model. But we cannot expect to evaluate such formulas in general since that would entail a decision procedure for arbitrary recursively enumerable sets. This follows from the fact that any recursively enumerable set can be represented in the form

fm : 9n'(m; n)g 26

for the appropriate quanti er-free formula ' in the language of ERNA with no occurrences of min', 0 , or 0 . For some of the details of the argument needed to show this see [6]. As an example of a construction of a nite model, we consider the terms that are involved in the analysis of the physical problem of a freely falling body, which involves a very simple dierential equation. We take as very restricted but computationally simple physical premises the antecedent of the following conditional statement, which we can then prove in ERNA. (8t)(1  t  2 ^ x  32 ^ x(1) = 0 ^ x(1) _ = 0 ! x(t)  16t2 ? 32t + 16)): Replacing the derivatives as de ned in [9] we get: x(t+20)?x(t+0 ) ? x(t+0 )?x(t) 0 0

(8t)(1  t  2 ^  32 ^ 0 x(1) = 0 ^ x(1 + 0 ) ? x(1)  0 ! x(t)  16t2 ? 32t + 16): 0 Negating the immediately preceding result, we obtain an existential statement, and we eliminate the existential quanti er with a constant c, to obtain + 0) + x(c)  32 () 1  c  2 ^ x(c + 20 ) ? 2x(c 20 ^x(0) = 0 ^ x(1 + 0 ) ? x(1)  0^ 0 2 x(c) 6 16c ? 32c + 16 Looking at () we have the following:  Finite non-in nitesimal terms: 16c2, 32, 32c, 32(c + 0), 32(c + 20)c, c2, c + 0, c + 20, 16, 16(c + 0 ), 16(c + 0)2 , 16(c + 20), 16(c + 20)2 , where x(c), x(c + 0 ), x(c + 20), 2x(c + 0 ), x(1 + 0), x(1) are replaced using x(t)  16t2 ? 32c+16, which we can prove is monotonically increasing for t  1.  In nitesimal terms in (): 0, 20 , 160, 320, 640, 32c0, 64c0, 1620, 6420. Since c  1, 64c0 is obviously the maximal in nitesimal term. Also, 16(c+20 )2 is the maximal nite term. Noting that c  2, this maximal term is bounded from above by 65 for 0 small, and so we take b = 26 + 1 = 65. Then 64c0  1280  1b , so 1 = 1 = 1 0  128b 128
65 27 (26 + 1) : 27

so the n0 required for c = 2 must satisfy: 128
65  n0; and we assume equality. To show what happens as the upper bound of t increases, we give approximate values for b and n0. For t = 1, the case just computed, take b = 26 and n0 = 213 as good approximations. Similarly, for t = 28, b = 220 and n0 = 234, and for t = 220, b = 244 and n0 = 270, so in this example, convergence of the natural sequence of nite models to the in nite model is rapid.

References [1]

Rolando Chuaqui and Patrick Suppes. An equational deductive system for the integral calculus. In P. Martin-Lof and G. Mints (Eds.) Lecture Notes

in Computer Science, Proceedings of COLOG-88, International Conference on Computer Logic, Tallinn, USSR. Berlin Heidelberg, Springer Ver-

[2] [3] [4] [5] [6] [7] [8] [9]

lag. pp. 25{49. Rolando Chuaqui and Patrick Suppes. Free-variable axiomatic foundations of in nitesimal analysis: a fragment with nitary consistency proof. JSL, 60(1):122{159, 1995. P. Hajek and Pavel Pudlak. Metamathematics of First Order Arithmetic. Springer-Verlag, 1993. A. E. Hurd and P. A. Loeb. An Introduction to Nonstandard Real Analysis. Academic Press, 1985. Je B. Paris and L.A.S. Kirby. Initial segments of models of Peano's axioms. In Springer-Verlag Lecture Notes in Mathematics, volume 619, pages 211{226. Springer-Verlag, 1977. H. E. Rose. Subrecursion: Functions and Hierarchies. Clarendon Press, 1984. Richard Sommer Trans nite Induction and Hierarchies Generated by Trans nite Recursion within Peano Arithmetic. PhD thesis, U. C. Berkeley, 1990. Richard Sommer Trans nite Induction within Peano Arithmetic. Annals of Pure and Applied Logic 76 (1995) 231{289. Patrick Suppes and Rolando Chuaqui. A nitarily consistent free-variable positive fragment of in nitesimal analysis. Proceedings of the IX Latin American Symposium on Mathematical Logic, Notas de Logica Mathematica, 38:1{59, Universidad Nacional del Sur, Bahia Blanca, Argentina, 1993. 28

[10] G. Takeuti. Proof Theory. North Holland, 1987.

29