Gödel Blooming: the Incompleteness Theorems from a Paraconsistent Perspective

Gödel blooming: the Incompleteness Theorems from a paraconsistent perspective

Walter Carnielli Centre for Logic, Epistemology and the History of Science and Department of Philosophy University of Campinas - Unicamp, Campinas, SP, Brazil David Fuenmayor Department of Mathematics and Computer Science Freie Universität Berlin e-mail: [email protected], [email protected]

Abstract This paper explores the general question of the validity of Gödel’s incompleteness theorems by examining the respective arguments from a paraconsistent perspective, while employing combinations of modal logics with Logics of Formal Inconsistency (LFIs). For this purpose, abstract versions of the incompleteness theorems, employing provability logic, need to be carefully crafted. This analysis considers distinct variants of the notion of consistency for formal systems, which, together with the lighter character of the negation operator of the LFIs, enable new formalization variants of the Gödelian arguments, eventually leading to some thought-provoking conclusions. We show that the standard formulation of Gödel’s theorems is not valid under some weak LFIs: a valid reconstruction requires further premises corresponding to the consistency (in the sense of LFIs) of particular formulas. This readily leads us to a reformulation of Gödel’s theorems as an existence claim. In this paper we also aim at showcasing the convenience of working with modern proof assistants (in this case Isabelle/HOL), which enable much faster and accurate feedback on verifying or falsi- fying hypotheses during the process of formal proof reconstruction.

Keywords: Gödel’s incompleteness theorems; Provability Logic; paraconsistency; Logics of Formal Inconsistency; Isabelle/HOL.

1 1 How universal are Gödel’s arguments?

In a rough and intuitive formulation, Gödel’s first incompleteness theorem (G1) says that, for certain consistent formal systems, there are (true) sentences that they cannot decide, i.e., neither prove nor disprove; the second incompleteness theorem (G2) says that such a system cannot prove its own consistency. A formidable amount of papers deals with explanations or interpretations of the Gödelian arguments, but few of them touch on the limits of the Gödelian objection. Gödel formulated his incompleteness theorems1 employing notions such as axiomatic systems, primitive recursive arithmetic, arithmetization/numbering, representability/interpretability, consistency, completeness, diagonalization, etc; already a quick literature survey will reveal several different (and in some cases non-equivalent) ‘formalizations’, or more appropriately, explications, of these notions. In this paper we focus on the notions of consistency and negation from the point of view of paraconsistent logic. We aim at examining different, alternative notions of consistency employing both classical and paraconsistent negation, and then investigating their role in Gödel’s arguments with the help of the proof assistant Isabelle/HOL (henceforth Isabelle) [NPW02]. For this sake, we will abstract away the complexities of Gödel’s arithmetization procedure and assume the corresponding fixed-point (diagonalization) lemma as a premise. We will employ for this (a paraconsistent version of) provability logic [Ver17; Boo95]. It is important to note that we do not aim at a thorough formal reconstruction of Gödel’s proofs (including the arithmetization procedure) using a proof assistant, as previously done by Paulson [Pau15] in Isabelle and O’Connor in Coq [OCo05]. Special mention deserves the work of John Har- rison, who provides a formal reconstruction of G2 within his proof assistant HOL-Light by employing provability logic in a similar spirit as ours (cf. his related work [Har09, Ch. 7]). With our formal reconstruction work in Isabelle (Section 6), we aim rather at introducing a framework for experimenting, in the context of Gödel’s proofs, with different notions of consistency, and from a paraconsistent perspective. We employ modal logic, both as a paraconsistent and as a provability logic, drawing upon the shallow semantical embeddings (SSE) approach [Ben19]. SSE rests on the adoption of Church’s simple type theory (STT) [BA19] as an expressive higher-order meta-language into which the logical

1There is some controversy in referring to Gödel’s results as either ‘a theorem’ or ‘theorems’. Saul Kripke (in private conversation with the ﬁrst author) insists that we should refer jointly to both as ‘Gödel’s theorem’, since G2 is a corollary of G1. We prefer to maintain the plural.

2 connectives of (a combination of) target logics can be ‘translated’ or ‘embedded’, in such a way that the target logic becomes a fragment of STT.2 In doing this, we can employ the proof assistant Isabelle, whose logic conserva- tively extends STT, to reconstruct and assess different formalized variants of Gödel’s arguments. We make the Isabelle source files for this formalization work freely available [CF20] and encourage the interested reader to carry out further experiments (e.g. by varying the encoded logic or the notions of consistency), and thus to further expand and improve on this work. In view of the abundant literature and approaches towards Gödel’s results, we are obliged to restrict ourselves to considering only a few sources. Succinct, but self-contained and fairly detailed, discussions emphasizing most important points in Gödel’s proofs can be found e.g. in the works of Smoryński [Smo77, Sec. 1–2], Epstein & Carnielli [EC08, Ch. 23–24], and in the corresponding article in the Stanford Encyclopedia of Philosophy [Raa18]. We will draw upon them as sources for our formal reconstruction work in Section 6. Section 2 raises the question about the range of Gödel’s theorems, setting the stage for an analysis of the dependence of the Gödelian arguments on standard logical conventions. Section 3 introduces the paraconsistentist program, and foresees some difficulties as regards the validity of the Gödelian objection in more subtle logical scenarios. Section 4 discusses the Logics of Formal Inconsistency, and justifies the choice of the logic RmbC among eli- gible paraconsistent scenarios. Section 5 illustrates the mechanism by which we add a provability operator to RmbC, thus obtaining the logic RmbC⊕K, and analyzes several notions of consistency that emerge from this move. Sec- tion 6 is dedicated to the formal reconstruction of the Gödelian arguments with the help of Isabelle. This task requires a combination of modal and paraconsistent logics embodied in RmbC⊕K. Since such logics are not currently supported off-the-shelf by mainstream proof assistants, we discuss the changes that turn Isabelle into a flexible, high-level modal and paraconsistent logic reasoner. This section also contains the most relevant technical results. Finally, Section 7 offers the main conclusions of this paper.

2The SSE technique has been employed successfully in the logical analysis of argumentative discourse (e.g. in the formal reconstruction of another, more metaphysical Gödelian argument [BW16; FB17], or in formal ethics [FB19b]), where it has also inspired a computer-supported approach, computational hermeneutics [FB19a], which, adhering to the slogan: ‘every formalization is an interpretation’, aims at rendering explicit the tacit conceptualizations implicit in argumentative practices. SSE also has applications in AI and normative systems [BPT20], as it supports the reuse of existing reasoning infrastruc- ture for first-order and higher-order logics for seamlessly combining and reasoning with different quantified classical and non-classical logics (including modal, deontic, epistemic and paraconsistent), many of which are well suited for normative reasoning applications.

3 2 On the range of Gödel’s theorems

Gödel’s incompleteness theorems do not apply unrestrictedly to every mathematical system. G1 does not apply for instance to Euclidean geometry. Tarski proved in 1948 [Tar98] that the first-order theory of Euclidean geometry is complete and decidable,3 in the sense that every statement in its language is either a theorem (i.e., provable) or its negation is a theorem, and there is an algorithm to determine which is the case. Even non-Euclidean geometry falls outside the Gödelian barrier: if plane Euclidean geometry is a consistent theory, then so is plane hyperbolic geometry. Nor do Gödel’s theorems apply to systems of arithmetic with the addition operation only, such as Presburger arithmetic. It is necessary to have a certain critical mass of mathematical strength to be attacked by the Gödelian objection, or, in other words: to qualify as what Gödel himself defined as ‘a formal system’. Our aim in this paper is to give some first steps towards the analysis, using non-classical logics, of the applicability of Gödel’s theorems to formal systems, while exploiting the computing power of modern proof assistants. Very little investigation, if any, touches the validity of Gödel’s proofs in non- classical environments. For instance, [BS14] claims to be studying versions of Gödel’s arguments under the umbrella of non-classical logics, but just con- centrates on substructural logics: the authors show that the Gödelian reasoning presupposes a certain amount of contraction in the underlying logic, that is, the validity of the meta-rule ‘Γ, ψ, ψ ` ϕ implies Γ, ψ ` ϕ’. They then exhibit a modal system without contraction that invalidates Gödel’s argument. On the other hand, several authors including Kreisel, Feferman, Löb, Jeroslow, Bezboruah–Shepherdson, Pudlák, Wilkie–Paris, Adamowicz– Zdanowski, Willard, Friedman, and Visser, among others (see [BS14] for references) have studied abstract conditions that permit the incompleteness theorems to be derived in a way somewhat independent of logic, but without changing the underlying standard logic. The interested reader may further consult some book-length discussions on Gödel’s results, e.g. [Smi13] and [Smu92]; for a more philosophically-oriented discussion a good reference is [Fra05]. The intuition behind Gödel’s proof of G1 is basically the following: assume that the formal system F is consistent (otherwise it proves every sentence by the Principle of Explosion of classical logic, and thus it is trivially complete). By Gödel’s diagonal (or fixed-point) lemma, one can then construct a sentence GF (hinging on F) that is neither provable nor refutable in F, and that

3According to [McN+53], the results were obtained in 1930 and published privately in its full development in 1948.

4 can also be shown to be true. Thus F is incomplete, both in the sense that there is a sentence that it cannot ‘decide’, and in the sense that there is a true sentence that it cannot prove. G2, stating that F cannot prove its own consistency, follows as a corollary of G1. Alternatively, G2 can be derived directly from Löb’s theorem. As is well recognized, the notion of consistency employed in G1 is not the same in the different variants that have been presented; ranging from the so-called ω-consistency originally introduced by Gödel, through the (weaker) 1-consistency commonly used in the literature, while also including a more classical notion of consistency as in the variant introduced by Rosser in 1936. But what is the idea of consistency behind G2? At first sight, one can say that consistency means simply the imperative not to derive a contradiction (absence of contradiction, or universal validity of non-contradiction), which is the same as non-triviality, in view of the Principle of Explosion (PEx) of traditional logic. However, the PEx is an unnecessary burden that classical logic carries uselessly: it is not used, but to mark the ban on contradictions. Contrary to what some unsuspecting people may think, the PEx is not even used in reductio ad absurdum proofs: a little thought will convince them that what is at stake in such proofs is the rule of negation introduction. Indeed, any time we have a bottom particle ⊥, the rule α → ⊥ ` ¬α can be applied, as it involves the introduction of negation, and not any use of PEx. In classical logic the variant ¬α → ⊥ ` α also holds; notice, however, that this second variant does not hold in intuitionistic logic. This means that the beloved, and useful, reductio ad absurdum method of proof acquires its legitimacy independently of PEx. Paraconsistent logics, particularly the Logics of Formal Inconsistency (LFI), liberate logical systems from this burden by weakening the PEx, and for a good reason. As widely acknowledged (see e.g. [DP15]), in many situ- ations, we have no other choice but to reason from contradictory premises, and this is a critical issue, since large knowledge bases or complex arguments almost inevitably include contradictions. A consequence of weakening the PEx is that consistency does not coincide with non-contradiction anymore, nor does it coincide with non-triviality. This is already a major philosophical difficulty for the classical stance on G2, which also affects, to a lesser extent, G1. As pointed out in the literature, e.g. in [BS14], we cannot easily pin- point a class of formulas that expresses consistency. When we paraphrase G2 as saying that ‘a sufficiently strong consistent theory cannot prove its own consistency’ we are forced to remain vague, and more so in the domain of paraconsistent logics. A natural question thus emerges: is there a way to avoid Gödel’s results by changing the underlying logic? Admittedly, it is not very encouraging

5 to know that G1 and G2 are both intuitionistically valid; this is so because the usual proof of G1 is entirely constructive. Moreover, the usual proof of G2 consists in coding the proof of G1 using arithmetic, which is, again, constructive. This means that neither classical nor intuitionistic logic are free of the Gödelian objection. We show that the situation is diﬀerent for paraconsistent logics, while, at the same time, providing a means to recover the Gödelian results by adding further premises that concern the consistency (in the paraconsistent sense to be explained below) of particular formulas.

3 The paraconsistentist program

The Logics of Formal Inconsistency (LFIs) are a broad family of paraconsistent logics, which constitute a wide generalization of da Costa’s original hierarchy Cn by incorporating operators for consistency (◦) and inconsistency (•). LFIs turn out to be highly ﬂexible logic systems (see e.g. [CCR19] for references and discussion). The paraconsistent program is the investigation of logic systems endowed with a negation ¬, such that not every contradiction of the form α and ¬α entails everything; in other words, a paraconsistent logic does not suﬀer from deductive trivialism, in the sense that a contradiction does not necessarily trivialize the deductive machinery of the system by proving everything.4 Formalizing what has been said before, deductive trivialism stems from the fact that classical logic cannot stand contradictions, since it endorses the inference rule ex contradictione sequitur quodlibet, or Principle of Explosion:

(PEx) α, ¬α ` β, which authorizes to derive anything from a pair of contradictory propositions α, ¬α.5 The challenge for paraconsistent logics is to shun such an explosive negation, while still preserving resources for designing an expressive logic. As mentioned above, the language of LFIs internalizes a notion of consistency at the formula-level, independent of (but related to) negation. Consis- tency thus becomes represented in the logic by a new unary connective ◦. In the same vein, some LFIs internalize a notion of inconsistency employing the connective •. In this setting, the notion of inconsistency (•) not necessarily corresponds to the negation of consistency (¬◦).

4Deductive trivialism should not be confused with trivialism, according to which everything is true. 5This is independent from the fact that classical logic endorses the validity of the Principle of Non-Contradiction: ` ¬(α ∧ ¬α), see [CCR18].

6 In the LFIs, consistent statements are those too rigid to admit contradictions, errors or vagueness, as exemplified by yes–no statements (whether or not you are pregnant, or have a certain disease). Those statements are rigid, or ‘consistent’, in the sense that they cannot stand any contradiction. On the other hand, more flexible, ‘non-consistent’ or ‘inconsistent’ statements (like whether it is hot today) have the ability to resist to contradictions (by not entailing everything). This intuitive notion of consistency becomes expressed formally by means of the connective ◦, whose meaning is governed by axioms and rules. Anal- ogous ideas can be found in the notion of rigidity, as employed in computational ontologies, cf. OntoClean and UFO, as well as in the notion of rigid or stable predicates found in quantified modal logics (cf. [FB17] for an application in formal argument reconstruction). This indicates that the idea of formally abstracting a notion of consistency is a natural desideratum, and has instances in other fields. The basic intuition is that contradictions should not affect all sentences (or all judgments) in the same way, and this is why the sort of Principle of Explosion employed in the LFIs is restricted to a special set of consistent sentences. Hence a contradictory theory is not necessarily trivial, provided that the contradictions do not involve statements that have been tagged as ‘consistent’, by employing the connective ◦. This flexibility characterizing LFIs is expressed in the so-called Principle of Gentle Explosion, which is an essential part of the definition of LFIs, which we present below. Definition 3.1. Let L = hΘ, ì be a Tarskian, finitary and structural logic defined over a propositional signature Θ, which features a negation ¬ and a (primitive or defined) unary connective ◦. Then, L is said to be a Logic of Formal Inconsistency (LFI) with respect to ¬ and ◦, if the following holds:

(1) ϕ, ¬ϕ 0 ψ for some ϕ and ψ; (2) ◦ϕ, ϕ, ¬ϕ ` ψ for every ϕ and ψ; (3) there are two formulas α and β such that

(a) ◦α, α 0 β; (b) ◦α, ¬α 0 β. Condition (1) signals the failure of the Principle of Explosion. Condition (2) represents the Principle of Gentle Explosion. Condition (3) is required in order to prevent condition (2) from being trivially satisﬁed. As a consequence, and in contrast to classical logic, consistency in LFIs is not synonymous with freedom from contradiction, and here the role of

7 negation is fundamental. The meaning of consistency in the LFIs is dictated by its axioms, as occurs with negation (and the other connectives). For conceptual clarifications the reader is referred to [CCM07] and to [CC16a]. The LFI-hierarchy starts from a logic called mbC, which extends positive (i.e. ‘negation-less’) classical logic CPL+ by adding a (paraconsistent) negation ¬ and an unary consistency operator ◦ satisfying some minimal require- ments in order to define an LFI (as in Definition 3.1). Gödel’s theorems are, of course, crucially dependent on the properties of negation, and we will evaluate how this new perspective may affect their validity. It should from now on become clear that the statements ◦α (α is consistent) and ¬(α ∧ ¬α) (α is non-contradictory) are not equivalent for a paraconsistent negation ¬, that is, for a negation subject to the Principle of Gentle Explosion (instead of the classical Principle of Explosion). This separation between consistency and non-contradiction, contradiction and non-consistency, as well as inconsistency and non-consistency, together with the consequent distinction between contradiction and triviality, are the main tenets of LFIs. As we shall see in Sections 5 and 6, they will lead to distinct proposals for formalization variants of Gödel’s theorems, and thus affect their proofs accordingly.6

4 Choosing among paraconsistent scenarios

We start by introducing a ‘negation-less’ fragment of classical logic, or full classical positive logic:

Definition 4.1 (Classical Positive Logic). The classical positive logic CPL+ is deﬁned over the language containing {∧, ∨, →} by the following axioms and inference rule:

6We will investigate this aﬀectation only at an abstract level and by employing provability logic. In particular, we will not consider Gödel’s arithmetization procedure, nor the ﬁxed-point (diagonalization) lemma, which we simply assume. One can thus describe our work as formally reconstructing ‘the last mile’ of Gödel’s proofs.

8 Axiom schemas:

α → β → α (Ax1) α → β → γ → α → β → α → γ (Ax2) α → β → α ∧ β (Ax3) α ∧ β → α (Ax4) α ∧ β → β (Ax5) α → α ∨ β (Ax6) β → α ∨ β (Ax7) α → γ → (β → γ) → (α ∨ β) → γ (Ax8) α → β ∨ α (Ax9)

Inference rule: α α → β (MP) β Starting from CPL+ above as a base logic, we extend it with a (paraconsistent) negation ¬ and a (primitive or defined) consistency operator ◦ satisfying the conditions stated in Definition 3.1. We thus obtain the paraconsistent logic mbC, which is a basic LFI in the sense that its negation and consistency operators enjoy the minimal properties in order to satisfy the definition of LFIs.7

Definition 4.2. The logic mbC, deﬁned over the language containing {∧, ∨, →, ¬, ◦}, is an LFI obtained from CPL+ by adding the connectives ¬, ◦ and the following axiom schemas:

α ∨ ¬α (Ax10) ◦α → α → ¬α → β (bc1)

Moreover, we can use ¬ and ◦ to deﬁne bottom particles in the language of mbC, as well as classical negation, also called strong negation.

7Some strong extensions of mbC, such as the logic Cie (and its extensions), do not distinguish between inconsistency and contradiction as a consequence of their axiomatic presentation, and some may even allow for the reduction of double negations (this is, however, contrary to what happens in most other LFIs; see [CC16a] for a discussion). We will thus restrict ourselves to relatively weak systems starting from the minimal (weakest) Logic of Formal Inconsistency mbC.

9 Definition 4.3. For any sentences α and γ:

•⊥ α := ◦α ∧ α ∧ ¬α act precisely as bottom particles, i.e., they satisfy ⊥α `mbC β, for every sentence β;

•∼ γα := α → ⊥γ act precisely as classical (strong) negations, i.e., they satisfy `mbC α ∨ ∼γα, and α ∧ ∼γα `mbC β for every sentence β.

Since ⊥α are equivalent for all α, and ∼γ are equivalent for all γ (see [CC16a, Ch. 2] for an elaborate discussion), we write simply ⊥ and ∼. It is worth remarking that mbC (as introduced below) both extends and is extended by classical logic. Indeed, on the one hand mbC is obviously a subclassical logic by definition, and on the other hand the defined connectives ⊥ and ∼, added to {∧, ∨, →}, completely encode classical logic. mbC can be (equivalently) expounded as a direct extension of classical logic, by incorporating an additional negation ¬ to the language, thus defining the logic mbC⊥. The equivalence between mbC⊥ and mbC is shown in [CC16a, Ch. 2]. mbC is the basis for a potentially infinite hierarchy of logics, going up to da Costa logics Cn, paraconsistent many-valued logics [CCM07], paraconsistent modal logics [Bue10; Bue12], and eventually reaching classical logic, all of them characterized by axiomatic systems extending mbC (see [CC16a, Ch. 3–4] for a detailed discussion). It has been proved that the logics in the da Costa’s hierarchy Cn (C1 included) are hardly algebraizable: This is partly due to the non-validity of a replacement meta-theorem which would establish the validity of intersubsti- tutivity of provable equivalents (IpE) for such logics. Indeed, Theorem 3.51 in [CM02] shows that IpE cannot hold in any paraconsistent extension of the logic Ci (or, for that matter, in any LFI) in which (¬α ∨ ¬β) ` ¬(α ∧ β) holds; or ¬(α ∧ β) ` (¬α ∨ ¬β) holds. We will sketch the main lines of RmbC, an extension of mbC (as mentioned, a minimal LFI extending CPL+) which satisfies the replacement property, a meta-property that grants that if α ↔ β is a theorem then γ[p/α] ↔ γ[p/β] is a theorem, for every formula γ(p). As mentioned, mbC does not generally satisfy replacement for sentences containing ¬ and ◦. By adding replacement for ¬ and ◦ as new global inference rules, full replacement can be recovered, in the sense that if α ↔ β is a theorem then ¬α ↔ ¬β is also a theorem, and if α ↔ β is a theorem then ◦α ↔ ◦β also is. As discussed in [CCF], this makes RmbC and its extensions fully algebraizable in the standard Lindenbaum-Tarski’s sense, which enables their combination with other similarly algebraizable logics by means of algebraic fibring [Car+08; CC16b]. This is very important for us, since we want to be able to

10 combine RmbC with other modal logics (e.g. extending K) for the sake of formally reconstructing Gödel’s arguments.

Definition 4.4. The logic RmbC, deﬁned over the language containing {∧, ∨, →, ¬, ◦} is obtained from mbC by adding the following inference rules: α ↔ β α ↔ β (R ) (R ) ¬α ↔ ¬β ¬ ◦α ↔ ◦β ◦ As observed in [CCF], where RmbC was introduced and from where we borrow its presentation, the rules that grant replacement are global instead of local rules; this means that in order to apply each global rule the corresponding premise must be a theorem. This is similar to what happens with the necessitation rule in modal logics. Observe that adding this kind of global rules requires special care with the deﬁnition of derivation from premises.

Definition 4.5 (Derivations in RmbC). • A derivation of a formula ϕ in RmbC is a finite sequence of formulas ϕ1 . . . ϕn such that ϕn is ϕ and, for every 1 ≤ i ≤ n, either ϕi is an instance of an axiom of RmbC, or ϕi is the consequence of some inference rule of RmbC whose premises appear in the sequence ϕ1 . . . ϕi−1. • We say that a formula ϕ is derivable in (or a theorem of) RmbC, denoted by `RmbC ϕ, if there exists a derivation of ϕ in RmbC. • Let Γ ∪ {ϕ} be a set of formulas over Σ. We say that ϕ is derivable in RmbC from Γ, and we write Γ `RmbC ϕ, if either ϕ is derivable in RmbC, or there exists a finite, non-empty subset {γ1, . . . , γn} of Γ such that the formula (γ1 ∧ γ2 ∧ ... ∧ γn) → ϕ is derivable in RmbC. By the properties of ∧ and → inherited from CPL+, and by the notion of derivation from premises just presented, it is easy to see that the deduction meta-theorem holds in RmbC, and that it is a Tarskian and finitary logic (see [CCF] for details). As presented in [CCF], a sound and complete semantics for RmbC can be given by means of a suitable class of Boolean algebras with LFI operators (BALFIs), a (non-additive) generalization of the standard Boolean algebras with operators (BAOs) used in algebraic semantics for (normal) modal logics. It is important to highlight that the possibility of such a semantic character- ization for paraconsistent logic RmbC opens the door to their combination with other logics (e.g. modal logics) by means of algebraic fibring [Car+08, Ch. 3], as well as its use in many other application areas for algebraic methods in logic.

11 Also important to our present purposes: a neighborhood semantics characterizing RmbC (and its extensions) has been introduced in [CCF], where it was shown that RmbC can be deﬁned within the minimal bimodal non- normal logic E [Che80]. In this respect, RmbC can indeed be considered as a (non-normal) modal logic. We will exploit this fact in Section 6, where we conduct automated reasoning with combinations of RmbC and other modal logics, by employing the technique of shallow semantical embeddings (SSE) [Ben19]. Before ﬁnishing this section, it is convenient to emphasize some properties of the consistency operator and of the paraconsistent negation in the logic mbC, and which are inherited by RmbC. Note that these properties concern particularly the notions of consistency and inconsistency:

Theorem 4.6. The following properties of mbC also hold in RmbC:

(1) α ∧ ¬α `mbC ¬◦α but ¬◦α 6`mbC α ∧ ¬α;

(2) ◦α `mbC ¬(α ∧ ¬α) but ¬(α ∧ ¬α) 6`mbC ◦α;

(3) ¬α → β `mbC α ∨ β but α ∨ β 6`mbC ¬α → β;

(4) ◦α, α ∨ β `mbC ¬α → β;

(5) α → β 0mbC ¬β → ¬α but ◦β, α → β `mbC ¬β → ¬α;

(6) α → ¬β 0mbC β → ¬α but ◦β, α → ¬β `mbC β → ¬α;

(7) ¬α → β 0mbC ¬β → α but ◦β, ¬α → β `mbC ¬β → α;

(8) ¬α → ¬β 0mbC β → α but ◦β, ¬α → ¬β `mbC β → α. Proof. Mechanically veriﬁed (see Isabelle sources in [CF20]). The proofs can also be easily adapted from [CC16a], Chapter 2, Propositions 2.3.3, 2.3.4, and 2.3.5. The above properties help us to understand the connections between consistency, non-consistency, contradictions, and non-contradictions, as well as to anticipate some of their eﬀects on Gödelian arguments. Item (1) shows that contradiction implies non-consistency, but not vice-versa. Item (2) shows that consistency implies non-contradiction, but not vice-versa. Items (3) and (4) show that disjunction cannot be fully recovered from negation and implication, as in the classical case (however this can be done when some parts are consistent). Items (5) to (8) show that some contraposition rules for implication do not hold when the paraconsistent negation is considered,

12 but will hold under the guarantee of consistency for the consequent in the original conditional form. The discussion in this section aimed at explaining our choice of a paraconsistent scenario to deal with the plethora of variants of Gödel’s theorems that emerge by weakening the Principle of Explosion and, in particular, when consistency is liberated from being deﬁned as non-contradiction. The following sections introduce a logic combination featuring both LFI operators and a (normal) modal operator aimed at capturing the notion of provability in formal systems like Peano Arithmetic, drawing upon systems of modal logic extending K. We also discuss some exemplary (though not exhaustive) conclusions achieved through the computer-supported logical analysis of the Gödelian arguments in a joint work with the proof assistant Isabelle.

5 A paraconsistent logic of provability: consistency abounds

We have so far introduced the logic RmbC as a candidate logic for the formalization of the Gödelian proofs. However, the most important compo- nent for such a logical system is still missing, namely, a provability operator, since we want to encode the notion of being derivable/provable directly in our object language. Following the tradition of provability logic [Ver17; Boo95], we will employ the modal operator for this purpose. But ﬁrst of all, what is this provability logic? Generally speaking, every time we apply modal logic to the study of formal provability (in some given expressive system) it becomes provability logic. However, not every system of modal logic is appropriate for modeling the notion of derivability in a system including (Peano) arithmetic (e.g. some common modal axioms like T or D are unqualiﬁed). Hence, the logics that usually come into consideration when it comes to provability are normal modal logics extending the well-known system K with either the axiom 4: ` φ → φ (logic K4) and/or the inference rule LR : ` φ → φ =⇒ ` φ (logic K(4)LR), or the axiom L : ` (φ → φ) → φ (logic GL). To get an idea of how these modal logics relate to provability, let us consider a formal system F that includes Peano Arithmetic. We write `F φ to indicate that φ is a theorem of F. If φ is an expression of the language of F (i.e. an F-formula), we shall let dφe denote the corresponding numeral for the Gödel number of φ (which we henceforth call the Gödel numeral of 8 φ). Given the F-formula P fF (y, x) stating that there is a proof in F with

8Recall that we can establish an injection between the set of F-formulas (and also

13 Gödel numeral y for the formula with Gödel numeral x, we can construct the formula P rF (x) := ∃y.P fF (y, x). Hence P rF (dψe) expresses that dψe is the Gödel numeral of a sentence ψ that is provable in F. The link between modal logic and provability in F (both sharing the primitive logical connectives ⊥ and →)9 becomes explicit by considering the following notion (cf. [Boo95, Ch. 3]).

Definition 5.1 (Realization). A realization r(p) is a function that assigns to each sentence letter p a sentence of the language of F. A realization r induces a translation (·)r as follows:

1. (p)r = r(p)

2. (⊥)r = ⊥

3. (φ → ψ)r = (φ)r → (ψ)r

r r 4. (φ) = P rF (d(φ) e) Remark 5.2. Since we aim at obtaining a paraconsistent provability logic, we need to add the following additional items to Deﬁnition 5.1 above:

5. (¬φ)r = ¬(φ)r (for LFIs only)

6. (◦φ)r = ◦(φ)r (for LFIs only)

Observe that, in adding the last two items, we assume the existence of counterparts for ¬ and ◦ in the language of F. Since F is also assumed to contain (Peano) arithmetic, we can, at least in principle, articulate arithmetic formulas featuring ¬ or ◦. This prima facie ability to employ a paraconsistent negation, as well as a consistency operator, in arithmetic formulas has interesting philosophical repercussions. Their analysis is however out of the scope of this paper. An interesting discussion can be found in [Sha02].

The link between theoremhood in both systems, i.e., between a system F containing Peano Arithmetic and some extensions of K, is given by the three results below.

r Proposition 5.3. `GL φ if and only if for every realization r, `F (φ) . their sequences) and the set of natural numbers, in such a way that each natural number is recursively associated with at most one formula according to Gödel’s arithmetization procedure. Also recall that a numeral corresponding to some natural number n is the F-formula consisting of the symbol 0 preceded by n occurrences of the symbol S. 9Recall that ∼φ can be deﬁned as φ → ⊥. Other connectives can be deﬁned employing ∼ and → as usual.

14 r Proposition 5.4. If `K4 φ, then for every realization r, `F (φ) .

r Corollary 5.5. If `K φ, then for every realization r, `F (φ) . Proof. Proposition 5.3 is Solovay’s arithmetical completeness theorem for logic GL [Sol76]. Proposition 5.4 (arithmetical soundness theorem for K4) and its Corollary 5.5 (arithmetical soundness for K) are earlier results. See [Ver17] and [Boo95] for a discussion.

We now recall the well-known derivability conditions for P rF (x) (drawing on the ones introduced by M.H. Löb [Löb55]) and their counterpart axioms in modal logic K4 (note that logic GL is an extension of K4 [Boo95]).

Proposition 5.6 (Derivability conditions). Let F be a formal system containing Peano Arithmetic, we have:

1. `F φ implies `F P rF (dφe)

2. `F P rF (dφe) ∧ P rF (dφ → ψe) → P rF (dψe)

3. `F P rF (dφe) → P rF (dP rF (dφe)e) Proof. Consult e.g. [Löb55] or [Boo95, Ch. 2].

Remark 5.7. Observe that the previous results apply in general to every system F which contains (classical) Peano Arithmetic. Hence it also applies for arithmetic systems featuring LFI operators ¬ and ◦; recall from Deﬁnition 4.3 that ⊥ (and in consequence ∼) is deﬁnable in the LFIs.

Definition 5.8. The conditions above are encoded in K as follows:

1. Necessitation rule: ` φ implies ` φ

2. Axiom K: ` (φ → ψ) → (φ → ψ) Moreover, we have in modal logic K4:

3. Axiom 4: ` φ → φ Furthermore, we can enrich our logic with another postulate further re- stricting the behavior of the provability operator . This postulate draws upon the following result:

Proposition 5.9 (Löb’s Theorem). Let φ be any sentence of the language of F. Then: if `F P rF (dφe) → φ then `F φ

15 Proof. Consult M.H. Löb’s original result [Löb55] (see also [Boo95]).

Definition 5.10. Löb’s theorem can be encoded in (extensions of) modal logic K as follows:

• Löb’s rule LR: ` φ → φ =⇒ ` φ

• Löb’s axiom L: ` (φ → φ) → φ The modal logic KLR is obtained by extending K with the inference rule LR above; similarly, the logic K4LR is obtained by extending K4 with rule LR. The modal logic GL (Gödel–Löb logic, or provability logic in the strict sense) is obtained by extending K with axiom L. Note that axiom 4 follows from L, and also that logics K4LR and GL validate the same formulas (consult [Boo95] for this and other interesting results). Concerning our present purposes, we define a paraconsistent logic of provability RmbC⊕K by means of algebraic fibring (which generalizes fusion of normal modal logics) [Car+08, Ch. 3] between the logic RmbC and the logic K, sharing the connectives {∧, ∨, →, ⊥}.10 It is evident that RmbC⊕K is an LFI (Def. 3.1), as well as its extensions featuring axioms 4 and L. As we know, Gödel’s incompleteness results concern (expressive enough) formal systems that are consistent. But what does it mean for a theory to be consistent (i) classically, and (ii) under the paraconsistent perspective? As we will see, we can identify (at least) five ways to answer (i) in the context of Gödel’s proofs. As for (ii) our choices are not fewer. We present an overview:

Definition 5.11. Diﬀerent notions of consistency: (1) A system is consistent (simpliciter, in the sense of non-contradictory) when it cannot derive both a sentence and its classical (resp. paraconsistent) negation, i.e. 6` ∼φ ∧ φ (resp. 6` ¬φ ∧ φ).

(2) A system is ∗-consistent when it cannot derive for the same sentence both its classical (resp. paraconsistent) negation and its provability, i.e. 6` ∼φ ∧ φ (resp. 6` ¬φ ∧ φ). 10Recall that the classical negation ∼ and the bottom particle ⊥ are definable in logic RmbC, see Definition 4.3. Observe that we can combine both logics by means of algebraic fibring, since, as recently shown in [CCF], RmbC is just another (non-normal) modal logic with an algebraic semantics based on Boolean algebras with additional operators. Further modal axioms such as 4 and L can be formulated upon this logic combination (as we do in Section 6). Results concerning the preservation of meta-properties (soundness, completeness, interpolation, etc.) for combinations of logics employing the algebraic fibring approach can be consulted in [Car+08, Ch. 2–3].

16 (3) A system is S-consistent when it can derive every sentence of which its provability is derivable, i.e. ` φ =⇒ ` φ. (4) A system is P-consistent when it cannot derive a blatantly false or ‘impossible’ statement ⊥ (neither in the classical nor in the paraconsistent sense). Observe that this vague requirement can be given diﬀerent non-equivalent formalizations: (a) 6` ⊥; (b) ` ∼⊥ resp. ` ¬⊥. (5) A system is ◦-consistent when all of its sentences are (or can be proven) consistent in the sense of the ◦ operator of LFIs, i.e. when ` ◦φ. Observe that this corresponds to a whole family of consistency conditions, depending on which underlying LFI has been chosen.

Remark 5.12. Some observations are worth mentioning: • φ, ψ, etc. (appearing free in formulas) act as meta-variables over formulas of the object logic, and are always implicitly all-quantiﬁed.

• The term ‘∗-consistent’ comes from the terms ‘ω-consistency’ and ‘1- consistency’. Observe that at the present level of abstraction (i.e. employing modal logic to model provability) their idiosyncratic properties become abstracted away.

• In the context of modal logics, S-consistency corresponds to the so- called denecessitation rule (characterizing converse-serial frames). This condition is employed as a further premise in the variant presented by Smoryński [Smo77, Ch. 2] (where it is referred to simply as ‘an additional assumption’). The S in term ‘S-consistent’ comes from there. Observe that the related (stronger) condition ` φ → φ is the well- known modal axiom T (characterizing reﬂexive frames). This condition is in fact undesirable in the context of provability logic; moreover it is inconsistent (in the most classical and traditional sense) with Löb’s condition L := ` (φ → φ) → φ. • The P in the term ‘P -consistent’ comes from provability (logic), since this is the formalization usually employed there for system’s consistency [Ver17; Boo95]. Variants (a) and (b) come from the notions of weak resp. strong representability (see e.g. [Raa18]) when applied to the negation of ⊥ (which can be understood intuitively as inconsistency). Some inferential relationships between the notions introduced in Deﬁni- tion 5.11 are presented in Theorems 5.13 and 5.14 below, employing classical and paraconsistent negation respectively.

17 11 Theorem 5.13. For as in classical modal logic K (and also K4): (i) (1) is a tautology: 6` ∼φ ∧ φ (consistency simpliciter) is a tautology.

(ii) (2) and (4.a) are equivalent: 6` ∼φ ∧ φ (∗-consistency) and 6` ⊥ (P -consistency-a) are logically equivalent.

(iii) (3) implies (2)/(4.a): ` φ =⇒ ` φ (S-consistency) is stronger than both 6` ∼ψ ∧ ψ (∗-consistency) and 6` ⊥ (P -consistency-a).

(iv) (4.b) implies (2)/(4.a): ` ∼⊥ (P -consistency-b) is stronger than 6` ⊥ (P -consistency-a) and therefore also than 6` ∼φ∧φ (∗-consistency).

(v) (3) and (4.b) are incomparable: ` φ =⇒ ` φ (S-consistency) and ` ∼⊥ (P -consistency-b) are incomparable (i.e. neither implies the other).

Proof. Mechanically verified (see Isabelle sources in [CF20]). As the results in Theorem 5.13 above show, the idea of differentiating between consistency and non-contradiction (which is a main tenet of the LFIs) is indeed readily presupposed in the literature on Gödel’s arguments. Non-contradiction, corresponding to consistency simpliciter, is shown (unsurprisingly) to be a tautology (i). In contrast, all other notions of consistency are shown to be strictly stronger (i.e. non-trivial). Indeed, two of them (∗-consistency and P -consistency-a), though quite different-looking, end up being equivalent (ii), while the two others (S-consistency and P -consistency- b) are shown to be strictly stronger than them (iii)–(iv), while remaining independent (v).

Theorem 5.14. We have for the combination RmbC⊕K (also K4):

(i) (1) is not a tautology: 6` ¬φ ∧ φ (consistency simpliciter) is not a tautology (anymore).

(ii) (2) implies (1): 6` ¬φ ∧ φ (∗-consistency) is stronger than 6` ¬ψ ∧ ψ (consistency simpliciter).

(iii) (5) implies (1): ` ◦φ (◦-consistency) is stronger than 6` ¬ψ ∧ ψ (consistency simpliciter).

11Note that the results are valid in both logics K and K4. Observe that these statements are presented from the viewpoint of a (classical) meta-logic, to which belong the symbols: `, 6`, =⇒, ∧. It is interesting to note that these results could be automatically veriﬁed in milliseconds by the proof assistant Isabelle (employing the SSE technique [Ben19]).

18 (iv) (2) implies (4.a): 6` ¬φ ∧ φ (∗-consistency) is stronger than 6` ⊥ (P -consistency-a).

(v) (3) implies (4.a): ` φ =⇒ ` φ (S-consistency) is stronger than 6` ⊥ (P -consistency-a). (vi) (2) & (3), (3) & (1) and (4.a) & (1) are pairwise incomparable.

(vii) (4.b) incomparable to all others: ` ¬⊥ (P -consistency-b) is neither implied by nor implies any other.

(viii) (5) incomparable to others excepting (1): ` ◦φ (◦-consistency) is neither implied by nor implies any other, excepting 1 (see iii).

Proof. Mechanically veriﬁed (see Isabelle sources in [CF20]). We can observe from Theorem 5.14 above that, in the paraconsistent setting, the inability to derive a contradiction (consistency simpliciter) is no longer a trivial tautology (i), while still remaining a weaker notion than ∗-consistency and than the (LFI) ◦-consistency (ii)–(iii). ∗-consistency, which was equivalent to P -consistency-a in the classical setting (Theorem 5.13 (ii)) is now strictly stronger (iv). S-consistency remains strictly stronger than P -consistency-a (v). However, other inferential relationships are no longer valid (vi). Notice, in particular, that P -consistency-b (which is the notion employed in the formalization of G2) has become, in the paraconsistent setting, incomparable to P -consistency-a and ∗-consistency (vii). Last but not least, the newly introduced LFI notion of ◦-consistency is only related to consistency simpliciter (viii).

6 Pruning the Gödelian garden

The formal reconstruction work presented in this section employs the proof assistant Isabelle/HOL [NPW02], whose logic HOL is classic and extends Church’s symple type theory STT [BA19]. We will strictly diﬀerentiate between object-logical and meta-logical expressions. Object logics are: classical modal logic K in Sections 6.2.1 and 6.3.1, and the paraconsistent (LFI) RmbC⊕K in Sections 6.2.2 and 6.3.2. Meta-logical expressions are those belonging to Isabelle’s language HOL. The source ﬁles for this work have been made freely available under [CF20]. We encourage the interested reader to carry out further experiments (e.g. by varying the encoded logic or the notions of consistency) and also to further expand and improve on this work.

19 6.1 Encoding RmbC⊕K in Isabelle/HOL The formal reconstruction of the Gödelian arguments poses a challenging task that requires the combination of modal and paraconsistent logics, which are currently not supported off-the-shelf by mainstream proof assistants (e.g. Is- abelle, Coq, Lean). In order to turn Isabelle into a flexible modal and paraconsistent logic reasoner, we have adopted the shallow semantical embeddings (SSE) approach, which harnesses the expressive power of higher-order logic as a meta-language allowing the faithful encoding of the semantics of quantified modal logics (among other non-classical logics) in STT/HOL, thereby turning higher-order theorem proving systems into universal reasoning en- gines (see [Ben19] and references therein). SSE involves the semantical definition of the logical vocabulary of the object logic (shown below boldface) in terms of the non-logical vocabulary (λ-expressions) of the higher-order meta-logic. In this approach, propositions become encoded via (characteristic functions of) their truth-sets. We thus have for the classical Boolean operators:12

⊥ := λw. F alse;

ϕ ∧ ψ := λw. (ϕ w) ∧ (ψ w); ϕ → ψ := λw. (ϕ w) −→ (ψ w); ∼ϕ := λw. ∼(ϕ w). Notice how, in virtue of the shallow nature of SSE, the meta-logical operators (F alse, ∧, −→, ∼) become reused on the right-hand-side of the definitions. This feature greatly improves computing performance, as well as user experi- ence, by eliminating the need for recursive definitions and proofs. As regards modal operators, the embedding meta-logical expressions are constructed by drawing upon the well-known standard translation into first-order logic:

ϕ := λw. ∀v. (R w v) −→ (ϕ v); where R denotes the accessibility relation associated with . LFI operators become embedded as follows (note that without further constraints they correspond to those of RmbC):

¬ϕ := λw. (ϕ w) −→ ((S1 ϕ) w);

12Unsurprisingly, there are many diﬀerent, but equivalent, ways to formulate SSEs for the object-logical operators. We show a particular alternative for illustrative purposes, which does not (syntactically) correspond to the one provided in the sources [CF20]. In particular, we tolerate some redundancy in the formulations when we think it may help to make the exposition clear.

20 ◦ϕ := ∼(ϕ ∧ ¬ϕ) ∧ (S2 ϕ); where S1 and S2 denote (unconstrained) neighborhood functions (see [CCF]). Observe that we reuse previous definitions in the formulation of ◦, which (together with ¬) is a primitive operator, since it features a primitive neighborhood function in its semantical definition; this is characteristic for RmbC. As the previous exposition shows, by employing the SSE technique, object- logical formulas become encoded as STT/HOL-expressions of type w ⇒ bool (where w is a special type for worlds or states), i.e., the type of characteristic functions for their corresponding truth-sets. Another important element in SSE is the definition of validity for object-logical formulas. Given a formula ϕ (of type w ⇒ bool) in the object (modal) logic, we can define the expression:

[` ϕ] := ∀w. (ϕ w); as corresponding to logical validity (and thus theoremhood) in the object logic. In particular, in the case of modal logic K, theoremhood follows from the completeness of K with respect to Kripke frames, together with the faithfulness of their embedding into Henkin general frames for STT (see e.g. [BP10] and the references in [Ben19]). As regards RmbC, completeness with respect to its neighborhood semantics has been shown in [CCF]; the faithfulness of the embedding of its corresponding neighborhood structures into Henkin general frames is conjectured at the present time (similar faithfulness results for non-normal deontic logics with neighborhood semantics exist, e.g. [BFP18]). Be that as it may, it is not diﬃcult to manually verify the proofs reconstructed in this section employing the calculus introduced in Section 4.

A note on Isabelle/HOL setup: As mentioned before, we strictly dif- ferentiate between the (modal) object logics (K and RmbC⊕K) and the (meta-)logic HOL of Isabelle. Object-logical connectives are written using boldface symbols and appear [` inside turnstile brackets]. Meta-logical expressions are those belonging to the (classical) HOL language and include the connectives ∼ (classical HOL negation), −→ (HOL material implication, particularly useful to model object-logical inference rules), and ∀ (HOL higher-order quantification). Moreover, Isabelle also provides some proof di- rectives (assume, show, hence, using, by, etc.) which are part of Isabelle’s domain-specific proof language Isar (see [NPW02]). In particular, observe the use of Isabelle’s keyword by followed by a proof tactic (or the name of a solver program). Some of the solvers we employ here are: simp (term rewriting engine), blast (tableaux prover), presburger (Presburger arithmetic solver) and smt (satisfiability modulo theories, SMT ). It is worth mentioning

21 that in many cases these tactics were automatically suggested by Isabelle’s meta-prover Sledgehammer [BBP13], which also supports the invocation of external state-of-the-art theorem provers.13 Notably, both Isabelle and the (external) Leo-III higher-order theorem prover [SB18] were able to prove all variants of Gödel’s theorems fully automatically, i.e. without requiring proof reconstructions (which we carry out for illustrative purposes). Leo-III also managed to prove several other conjectures that eluded Isabelle’s internal solvers. In most cases, non-theorems could be refuted by Isabelle’s integrated model ﬁnder Nitpick [BN10]. We will point out the exceptional cases in the below discussion.

6.2 First incompleteness theorem (G1) We take as starting point the variant of Gödel’s theorem presented in Theo- rem 6.1 below. This variant, as well as its corresponding proof, draws upon the analysis by Smoryński [Smo77, Sec. 2], Raatikainen [Raa18], and Epstein & Carnielli [EC08, Ch. 24]. It is worth mentioning that these three variants (as well as many others) are indeed very similar, up to an additional premise (which we will discuss below).

Theorem 6.1 (Gödel’s ﬁrst incompleteness theorem G1). Assume F is a consistent formal system which contains Peano Arithmetic. Let GF be a formula that satisﬁes `F GF ↔ ∼P rF (dGF e), we have:

• 6`F GF ; (non-provable)

• under an additional premise, 6`F ∼GF . (non-refutable) Proof. To be discussed below. The additional premise in Theorem 6.1 above corresponds to a sort of consistency requirement: For [EC08, Ch. 24] it is ω-consistency (as in Gödel’s original variant), and for [Raa18] it is the weaker 1-consistency, both of which are formally modeled here employing the notion of ∗-consistency introduced in Deﬁnition 5.11 (see Figures 2 and 5). Regarding the variant by [Smo77, Sec. 2], the consistency requirement (referred to as ‘an additional assumption’) is ∀φ. `F P rF (dφe) =⇒ `F φ, which we have formally modeled as S-consistency in Deﬁnition 5.11 (see Figures 3 and 6). The reconstructed proofs for G1, presented in Figures 1 to 3 below, employ a classical modal logic K (i.e. featuring only classical negation ∼).

13The provers can be invoked on a local installation or remotely via System on TPTP (http://www.tptp.org/cgi-bin/SystemOnTPTP).

22 Figures 4 to 6 below are devoted to reconstructing the proof for the par corresponding paraconsistent variant G1 employing the logic combination RmbC⊕K (featuring the paraconsistent negation ¬) as introduced in Sec- tion 5.

6.2.1 Proof reconstruction of G1 (using classical negation) The reconstructed proof for lemma non_provable in Figure 1 draws mainly from [Raa18] and [Smo77, Sec. 2]. Observe that this is a straightforward proof by reductio ad absurdum,14 where no further assumption is made concerning consistency. ` GF is obtained from ` GF (see line 28) by necessitation (which the term rewriting solver simp evidently exploits). The contradicting statement ` ∼GF is obtained from it (line 29) by using the first (and only) premise (Isabelle notation: assms(1)) corresponding to the fixed-point lemma (for an arbitrary but fixed GF , see lines 23–24).

Figure 1: Proof of non-provability of GF in Isabelle/HOL

The proof for lemma non_refutable_v1 in Figure 2 draws from [Raa18], which employs 1-consistency as additional premise, and which we model as ∗- consistency (Def. 5.11). Similarly to the previous one, this proof is by reductio ad absurdum. Here ` GF is obtained (by the tableaux prover blast, line 41) from ` ∼GF exploiting the ﬁxed-point lemma (line 36), thus obtaining a formula (line 43) which clearly conﬂicts (line 44) with the instantiation of ∗-consistency for GF (line 42).

14Note that all presented proofs are acceptable from the viewpoint of intuitionistic logic.

23 Figure 2: Proof of non-refutability of GF employing ∗-consistency

The proof for lemma non_refutable_v2 in Figure 3 draws from [Smo77, Sec. 2]), whose ‘additional assumption’ is modeled as S-consistency or denecessitation (formalized as: ` ϕ =⇒ ` ϕ, cf. Def. 5.11). The proof is similar to the previous one, ﬁrst obtaining ` GF (line 55), and then instantiating S-consistency for GF (line 56) in order to obtain the contradicting formula ` GF by modus ponens (line 57).

Figure 3: Proof of non-refutability of GF employing S-consistency

Furthermore, G1 can also be proven employing the other notions of consistency. In doing this, lemma non_provable remains unchanged, while the consistency premise in lemma non_refutable gets replaced by either 6` ⊥ (P -consistency-a) or ` ∼⊥ (P -consistency-b). Employing Isabelle we can verify the validity of G1 in both cases by automated means (see [CF20]).

24 par 6.2.2 Proof reconstruction of G1 (using paraconsistent negation) par In Figures 4 to 6 we reconstruct the proof for G1 , employing ¬ as the paraconsistent negation of RmbC, while ◦ corresponds to the primitive RmbC consistency operator (note that ∼ remains as the meta-logical classical negation). As discussed in Section 5, we are dealing in this setting with the logic combination RmbC⊕K (an instance of algebraic fibring between RmbC and modal logic K, cf. [Car+08, Ch. 3]). The proofs for lemmas non_provable (Figure 4) and non_refutable_v1(2) (Figures 5 and 6) are similar to their classical counterparts (cf. Figures 1–3) but for the additional premises ` ◦GF and ` ◦GF respectively. They indicate that GF and GF are now to be considered as ‘contradiction-intolerant’, par in order for the proof of G1 to succeed (otherwise we can find counterexamples employing Isabelle’s integrated model finder Nitpick [BN10]).

par Figure 4: Proof of non-provability of GF (¬ behaves paraconsistently)

Notice in Figure 4 (line 27) that the (LFI) consistency assumption for GF (line 21) is required as an additional premise for lemma non_provable, this is in order to derive ` ¬GF from ` GF and the ﬁxed-point lemma employing contraposition. Recall from Theorem 4.6 that contraposition is not valid in logic RmbC (nor generally in LFIs), unless the consequent is consistent.

25 par Figure 5: Proof of non-refutability of GF , employing ∗-consistency

Similarly, observe that for lemmas non_refutable_v1(2) in Figures 5 and 6 (in lines 41–42 and 57–58 resp.) the consistency of GF needs to be assumed in order to license the corresponding contraposition step. Moreover, notice in Figure 6 how the ﬁnal step involves the LFIs’ deﬁnition of ⊥ (Def. 4.3).15

par Figure 6: Proof of non-refutability of GF , employing S-consistency

par It is worth mentioning that G1 (more speciﬁcally the non-refutable lemma) can also be proved mechanically in Isabelle employing the notion par of P -consistency-a 6` ⊥. The variant of G1 employing ◦-consistency 15Recall that, while the rule of negation introduction ` ϕ → ⊥ =⇒ ` ¬ϕ holds for LFIs, its converse ` ¬ϕ =⇒ ` ϕ → ⊥ does not hold in general, unless ◦ϕ is assumed.

26 ∀ϕ. ` ◦ϕ can be falsified (i.e. a countermodel is found by Nitpick). Inter- estingly, the question concerning the validity of the variant featuring P - consistency-b ` ∼⊥ has been answered affirmatively by the higher-order prover Leo-III.16 par Another interesting question concerns the validity of G1 in logic combinations featuring LFIs stronger than RmbC, after dropping any of the additional premises ` ◦G or ` ◦G. We know that both premises are necessary when considering the logic RmbC (since Nitpick can find countermodels otherwise). Moreover, we could also verify that both premises are still necessary when considering the extension RmbCciw, which is the weakest LFI in which ◦ is a non-primitive connective, defined as: ◦ϕ := ∼(ϕ ∧ ¬ϕ). However, this question still remains open for stronger LFIs, as we could not yet find proofs or countermodels using automated tools.

6.3 Second incompleteness theorem (G2)

We formalize two variants of the proof for G2, the ﬁrst one draws from [Smo77] and [Raa18] (see Figures 7 and 9), and the second one draws from Boolos [Boo95, Ch. 3] (see Figures 8 and 10).

Theorem 6.2 (Gödel’s second incompleteness theorem G2). Assume F is a consistent formal system which contains Peano Arithmetic. Let ConsF be a formula of F representing the consistency of the system. We also assume the derivability conditions on P rF from Proposition 5.6. We have two variants:

(i) Let GF be some formula which satisﬁes `F GF ↔ ∼P rF (dGF e). We have `F GF ↔ ConsF . As a corollary it follows by (the ﬁrst part of) G1 that 6`F ConsF .

(ii) From Löb’s theorem (Proposition 5.9), it follows that 6`F ConsF . Proof. To be discussed below. Throughout this section we will employ the notion of P -consistency-b as a working formalization for ConsF above, following the established practice (cf. [Boo95]). Other choices (drawing upon Deﬁnition 5.11) are possible, but they require some questionable modiﬁcations (see the discussion at the end of this section).

16Leo-III [SB18], when invoked via Isabelle’s meta-prover Sledgehammer [BBP13], indeed reported a proof, which, however, could not be automatically reconstructed employing Isabelle’s trusted kernel calculus. This situation may (hopefully) change in the future, as the integration between Isabelle and external theorem proving systems keeps improving.

27 6.3.1 Proof reconstruction of G2 (using classical negation)

The reconstructed proofs for G2 presented in Figures 7 and 8 employ classical modal logic K. Observe that under the premises for variant (i) we ﬁnd ∀ϕ. ` ϕ → ϕ (modal axiom 4), while under the premises for (ii) we ﬁnd ∀ϕ. ` (ϕ → ϕ) → ϕ (axiom L). The logic of formalization can thus be seen as K4 and GL for variants (i) (Figure 7) and (ii) (Figure 8) respectively.

Figure 7: Proof of (i) (equivalence of GF and ConsF ) in Isabelle/HOL

The variant (i) in Figure 7 shows that ConsF (defined employing P - consistency-b: ∼⊥) is equivalent to GF (line 23) as a consequence of the fixed-point lemma and the derivability conditions for P rF (i.e. assuming logic K4, see Section 5). As mentioned before, given the first half of G1 (6`F GF ), the second incompleteness theorem G2 (6`F ConsF ) follows im- mediately (using replacement of equivalents, see Section 4). The proof has been divided into two parts: left-to-right (LtoR, lines 25–29) and right-to-left (RtoL, lines 31–32). The former has been reconstructed formally for illustra- tion purposes (by now the reader should be able to follow the steps guided by the provided comments); the latter has been proved employing the SMT solvers integrated into Isabelle (e.g. Z3 and CVC4 ).17

17The required premises have been suggested by Sledgehammer. We take this oppor- tunity to showcase the use of automated tools in the veriﬁcation of complex proof steps. The concerned reader can easily ﬁnd the skipped proof steps, e.g. in [Smo77].

28 Figure 8: Proof of (ii) (i.e. G2) in Isabelle/HOL

Observe that the variant (ii) in Fig. 8 proves G2 directly in logic GL as a corollary of Löb’s axiom (which formalizes Löb’s theorem in modal logic, see Proposition 5.9). It is worth mentioning that formulations of the notion of system’s consistency (ConsF ) other than ∼⊥ (which draws upon P -consistency-b, as introduced in Deﬁnition 5.11) could be used to try to formalize G2 (i − ii) above. In doing this, they would need to be rendered as object-logical formulas (i.e. inside the turnstile brackets [` ... ]). For instance, we could try to rephrase ∀φ. ` φ =⇒ ` φ (S-consistency) in the object (second-order) modal logic as ∀φ. φ → φ, arguably honoring its intuitive interpretation. Notice, however, that the frames characterized by the former (converse- serial) are quite diﬀerent from the ones characterized by the latter (dense). In a similar vein, other variants like ∀ψ. 6` ∼ψ ∧ ψ (∗-consistency) and 6` ⊥ (P -consistency-a) could become rendered as the object-logical formulas ∀ψ. ∼(∼ψ ∧ ψ) and ∼⊥ respectively. However, the adequacy of such paraphrasing is also questionable, and the obtained formulations for ConsF do not validate variant (i), as we could verify by generating countermodels with the help of Nitpick. As regards variant G2 (ii), we found that the formulations drawing on variants P -consistency-a and ∗-consistency can be proved automatically by Leo-III (though not by Isabelle, cf. Footnote 16). As for the variant drawing on S-consistency, its status remains unsettled, as it could not be proved or refuted by automated means.18

18At the present time, the conjectures cannot be proved either by Isabelle or by Leo-III, while model ﬁnder Nitpick cannot ﬁnd a counterexample. A manual proof reconstruction might need to be attempted. Isabelle-acquainted readers are encouraged to download the sources [CF20] and try themselves with higher chances of success.

29 par 6.3.2 Proof reconstruction of G2 (using paraconsistent negation) par The reconstructed proofs for G2 presented in Figures 9 and 10 are formulated in the logic RmbC⊕K (which features the paraconsistent negation ¬). They illustrate how some further (implicit) assumptions, concerning the ◦-consistency of particular formulas, are required in order to reconstruct the proof as logically valid.

par Figure 9: Proof of G2 (i) (equivalence of GF and ConsF )

par Like its classical counterpart in Figure 7, the paraconsistent variant G2 (i) in Figure 9 derives the equivalence of ConsF (¬⊥) and GF in K4. Notice par that, similarly to the proof reconstruction of G1 , some further (implicit) premises are required in order for contraposition steps to succeed, namely, the ◦-consistency of GF (lines 25–27) and of ⊥ (required by the SMT solver, lines 29–30). Note that we can obtain countermodels (employing model ﬁnder Nitpick) if we drop any of these assumptions.

30 par Figure 10: Proof of G2 (ii)

Like its classical counterpart (cf. Figure 8), the variant (ii) in Figure 10 par derives G2 directly in the logic GL. Observe that this time the ◦-consistency of ⊥ (line 36) is required as sole further (implicit) premise, in order to get the step from ` ¬⊥ to ` ⊥ → ⊥ off the ground (line 40) as well as the last step, which hinges on the LFIs’ definition of ⊥ (Def. 4.3). It is worth mentioning that we can additionally employ ∀ϕ. ◦ϕ (drawing upon ◦-consistency) as yet another well-formed object-logical formulation of par ConsF in the reconstruction of G2 (similarly to the discussion at the end of Section 6.3.1 regarding G2). Here, too, we obtain similar results. None of the alternative formulations of ConsF (in their paraconsistent versions) par can validate G2 (i), since we could generate respective counterexamples us- par ing Nitpick. As regards G2 (ii), it cannot be validated by employing the formulation of ConsF drawing on ◦-consistency mentioned above, nor by employing ¬⊥ (drawing on P -consistency-a). As for the formulations of ConsF : ∀ψ. ¬(¬ψ ∧ ψ) (drawing on ∗-consistency) and ∀φ. φ → φ par (drawing on S-consistency), the status of G2 (ii) remains unsettled (recall the discussion in Footnote 18). We refer the reader to the corresponding Isabelle sources in [CF20] for detailed (and updated) information. Similarly to the discussion at the end of Section 6.2.2, the question con- par cerning the validity of G2 in logic combinations featuring LFIs stronger than RmbC, after dropping any of the additional premises (` ◦⊥ or ` ◦G), still remains open, as we could not yet find proofs or countermodels employing automated tools.19

19Thus far we haven’t meticulously tried to reconstruct such proofs, so chances are that Isabelle-acquainted readers will have better luck here.

31 7 A long story short: conclusions

The gist of our analysis appears in Sections 6.2.2 and 6.3.2. Our results show that a necessary and sufficient condition to validate a paraconsistent ver- par sion G1 of Gödel’s first incompleteness theorem is to assume that both GF and GF (i.e. P rF (GF )) are consistent in the LFI sense of ‘contradiction- intolerant’; such conditions are clearly sufficient, and also necessary,20 since par otherwise we can find counterexamples to G1 by exploiting the model gen- eration capabilities of Isabelle. This is mainly due to the failure of explosion and contraposition in the logic RmbC (and generally in LFIs), unless the ◦-consistency of certain sentences is assumed. par Similarly to the proof reconstruction of G1 , the paraconsistent ver- par sion G2 of Gödel’s second incompleteness theorem requires some further premises in order for contraposition steps to succeed, namely, the ◦-consistency par of GF and ⊥ for the first presented variant (i). In this variant, G2 fol- par lows as a corollary of (the first part of) G1 , and thus the ◦-consistency of par GF and ⊥ constitute sufficient conditions for obtaining G2 . As regards par the second variant (ii) of G2 , we have seen that only the ◦-consistency of ⊥ is required. Recall that, in contrast to the first variant (i), variant (ii) par of G2 does not depend on G1, but relies on Löb’s theorem instead. We may summarize, in a sketchy form, the ideas above as follows:

FP (GF ) and ◦GF and ◦GF imply G1; where FP (GF ) stands for ‘GF is a ﬁxed-point for ¬(·)’ and G1 stands for 21 ‘ConsistencyF implies IncompletenessF ’. Reasoning by contraposition:

FP (GF ) and not G1 imply not ◦GF or not ◦GF .

A similar reasoning applies to G2, as the reader can verify. Based on this, in an exercise of counterfactual imagination, we can envision that, if things had been diﬀerent in the thirties (e.g. if logics like LFIs already existed), the Gödelian results could have been presented along the following lines: Theorem 7.1 (Gödel’s Existence Theorem). For every consistent (6= non- contradictory) and complete formal system F, which includes Peano Arith- metic, a sentence GF can be constructed such that it or its provability P rF (GF ) is a non-consistent statement (i.e. it is ‘contradiction-tolerant’). Moreover, if F can prove its own consistency, then P rF (⊥) is also a non-consistent statement. 20We mean, necessary and suﬃcient within the present line of reasoning – we don’t claim ours is the unique way to formulate the problem. 21We can do this, since our reasoning (meta-logic) is taken to be classical.

32 A less technical, more conceptual conclusion is that, by adopting a lighter, more flexible negation (such as the paraconsistent negation featured in RmbC), we genuinely avoid the Gödelian objection, which is mistakenly taken to be universal (although Gödel himself never saw it this way). To be sure, Gödel’s argumentation is still sound, it just becomes interpreted, more appropriately, as an existence claim. Limitations of the Gödelian objection are totally understandable, spe- cially if we take into account that the objection was directed against the foundations of mathematics, whose notion of negation is the classical one, with its brutal simplification, conflating negation, denial, subtraction and falsity in just one idea. But the Gödelian objection was not directed against the subtle linguistic and pragmatic usage of negation, nor at its usage in contemporary areas like knowledge representation in computer science. The non-mathematical usage of negation needs to adhere to some additional pos- tulates to fall prey of Gödel’s arguments; we have shown that the consistency (in the sense of LFIs, namely, ‘contradiction-intolerance’) of the formulas GF and P rF (GF ) is among them. In this respect, an interesting question is whether there are any ‘natural’ mathematical statements (i.e. not involv- ing the numerical coding of logical notions) which could be shown to be undecidable in our basic paraconsistent systems, as much as the celebrated Paris–Harrington theorem is a ‘natural’ undecidable combinatorial statement in the standard case. This and similar issues deserve further investigation. It is important to note that our experiments in Section 6 have been far from exhaustive, and thus further attempts may reveal an adequate formulation (or combination) of these, and other, consistency notions which (possibly par together with some additional premises) validly reconstructs G2 and G2 .A par similar observation applies, to a lesser extent, to G1 and G1 . In particular, we did not investigate formalizations featuring both classical and paraconsistent negations inside a same formula or appearing in premises of a same argument. Such experiments are straightforward to realize using our Isabelle sources [CF20]. However, the interpretation of the results is not always ap- parent, and a proper analysis for every combination variant (let alone picking out the relevant or reasonable ones) exceeds the scope of this paper. Another interesting set of experiments involves strengthening our base logic RmbC with further axioms (i.e. employing stronger logics in the LFI hierarchy) and then using automated tools to verify whether Gödel’s theorems can be proved in this setting without recurring to additional premises. As mentioned at the end of Sections 6.2.2 and 6.3.2, there are still open questions in this regard, as this task requires quite more effort as well as familiarity with the Isabelle environment. The present study aims at paving the way for tackling these and similar fascinating challenges.

33 Acknowledgements: The ﬁrst author acknowledges support from the Na- tional Council for Scientiﬁc and Technological Development (CNPq), Brazil, under research grant 307376/2018-4. We are indebted to Marcelo Coniglio for early discussions on these ideas and to Christoph Benzmüller for advice on utilizing automated reasoning systems.

References

[BA19] C. Benzmüller and P. Andrews. “Church’s Type Theory”. In: Zalta, Edward N. Summer 2019. Metaphysics Research Lab, Stan- ford University, 2019, 1–62 (in pdf version). [BBP13] J. C. Blanchette, S. Böhme, and L. C. Paulson. “Extending Sledgehammer with SMT solvers”. In: Journal of automated reasoning 51.1 (2013), pp. 109–128. [Ben19] C. Benzmüller. “Universal (Meta-)Logical Reasoning: Recent Suc- cesses”. In: Science of Computer Programming 172 (2019), pp. 48– 62. [BFP18] C. Benzmüller, A. Farjami, and X. Parent. Faithful Semanti- cal Embedding of a Dyadic Deontic Logic in HOL. Tech. rep. arXiv:1802.08454. CoRR, 2018. [BN10] J. C. Blanchette and T. Nipkow. “Nitpick: A counterexample generator for higher-order logic based on a relational model ﬁnder”. In: International conference on interactive theorem proving. Springer. 2010, pp. 131–146. [Boo95] G. Boolos. The Logic of Provability. Cambridge University Press, 1995. [BP10] C. Benzmüller and L. C. Paulson. “Multimodal and Intuitionistic Logics in Simple Type Theory”. In: The Logic Journal of the IGPL 18.6 (2010), pp. 881–892. doi: 10.1093/jigpal/jzp080. [BPT20] C. Benzmüller, X. Parent, and L. van der Torre. “Designing Normative Theories of Ethical and Legal Reasoning: LogiKEy Framework, Methodology, and Tool Support”. In: Artiﬁcial In- telligence (to appear) (2020). Preprint: https://arxiv.org/ abs/1903.10187, pp. 1–50. [BS14] L. Beklemishev and D. Shamkanov. “Some abstract versions of Gödel’s second incompleteness theorem based on non-classical logics”. 2014. arXiv:1602.05728 [math.LO].

34 [Bue10] J. Bueno-Soler. “Two semantical approaches to paraconsistent modalities”. In: Logica Universalis 4.1 (2010), pp. 137–160. [Bue12] J. Bueno-Soler. “Models for anodic and cathodic multimodali- ties”. In: Logic Journal of IGPL 20.2 (2012), pp. 458–479. [BW16] C. Benzmüller and B. Woltzenlogel Paleo. “The Inconsistency in Gödel’s Ontological Argument: A Success Story for AI in Meta- physics”. In: IJCAI 2016. Ed. by S. Kambhampati. Vol. 1-3. AAAI Press, 2016, pp. 936–942. [Car+08] W. A. Carnielli et al. Analysis and Synthesis of Logics. Sringer, 2008. [CC16a] W. A. Carnielli and M. E. Coniglio. Paraconsistent Logic: Con- sistency, Contradiction and Negation. Springer, 2016. [CC16b] W. Carnielli and M. E. Coniglio. “Combining Logics”. In: The Stanford Encyclopedia of Philosophy. Ed. by E. N. Zalta. Winter 2016. Metaphysics Research Lab, Stanford University, 2016. [CCF] W. Carnielli, M. E. Coniglio, and D. Fuenmayor. “Logics of For- mal Inconsistency enriched with replacement: an algebraic and modal account”. Submitted for publication, preprint available from https://www.cle.unicamp.br/eprints/index.php/ CLE_e-Prints. [CCM07] W. Carnielli, M. E. Coniglio, and J. Marcos. “Logics of Formal Inconsistency”. In: Handbook of Philosophical Logic. Ed. by D. Gabbay and F. Guenthner. Vol. 14. Amsterdam: Springer, 2007, pp. 1–93. [CCR18] W. A. Carnielli, M. E. Coniglio, and A. Rodrigues. “On formal aspects of the epistemic approach to paraconsistency”. In: Logic and Philosophy of Logic: Recent Trends in Latin America and Spain. Ed. by M. Freund, M. F. de Castro, and M. Ruﬃno. College Publications, 2018, pp. 48–74. [CCR19] W. A. Carnielli, M. E. Coniglio, and A. Rodrigues. “Recovery operators, paraconsistency and duality”. In: Logic Journal of the IGPL (2019). First published online at https://doi.org/10. 1093/jigpal/jzy054. [CF20] W. Carnielli and D. Fuenmayor. Isabelle/HOL sources associated with this paper. Online available at Github: https://github. com/davfuenmayor/Goedel-Incompleteness-Isabelle. 2020.

35 [Che80] B. F. Chellas. Modal logic: an introduction. Cambridge university press, 1980. [CM02] W. A. Carnielli and J. Marcos. “A taxonomy of C-systems”. In: Paraconsistency - the Logical Way to the Inconsistent. Ed. by W. A. Carnielli, M. E. Coniglio, and I. M. L. D’Ottaviano. Vol. 228. Lecture Notes in Pure and Applied Mathematics. New York: Marcel Dekker, 2002, pp. 1–94. [DP15] D. Dubois and H. Prade. “Inconsistency management from the standpoint of possibilistic logic”. In: International Journal of Un- certainty, Fuzziness and Knowledge-Based Systems 23 (2015), pp. 15–30. [EC08] R. L. Epstein and W. A. Carnielli. Computability: Computable Functions, Logic, and the Foundations of Mathematics. 3rd Edi- tion. Advanced Reasoning Forum, 2008. [FB17] D. Fuenmayor and C. Benzmüller. “Automating Emendations of the Ontological Argument in Intensional Higher-Order Modal Logic”. In: KI 2017: Advances in Artiﬁcial Intelligence. Ed. by G. Kern-Isberner, J. Fürnkranz, and M. Thimm. Vol. 10505. LNAI. Springer, 2017, pp. 114–127. [FB19a] D. Fuenmayor and C. Benzmüller. “A Computational-Hermeneutic Approach for Conceptual Explicitation”. In: Model-Based Rea- soning in Science and Technology – Inferential Models for Logic, Language, Cognition and Computation. Ed. by A. Nepomuceno et al. Vol. 49. SAPERE. Springer, 2019, pp. 441–469. [FB19b] D. Fuenmayor and C. Benzmüller. “Harnessing Higher-Order (Meta-)Logic to Represent and Reason with Complex Ethical Theories”. In: PRICAI 2019: Trends in Artiﬁcial Intelligence. Ed. by A. Nayak and A. Sharma. Vol. 11670. LNAI. Springer, 2019, pp. 418–432. doi: 10.1007/978-3-030-29908-8_34. [Fra05] T. Franzén. Gödel’s Theorem: An Incomplete Guide to its Use and Abuse. AK Peters, Wellesley, 2005. [Har09] J. Harrison. Handbook of practical logic and automated reasoning. Cambridge University Press, 2009. [Löb55] M. H. Löb. “Solution of a problem of Leon Henkin 1”. In: The Journal of Symbolic Logic 20.2 (1955), pp. 115–118. [McN+53] R. McNaughton et al. “Alfred Tarski, A decision method for elementary algebra and geometry”. In: Bulletin of the American Mathematical Society 59.1 (1953), pp. 91–93.

36 [NPW02] T. Nipkow, L. Paulson, and M. Wenzel. Isabelle/HOL: A Proof Assistant for Higher-Order Logic. Vol. 2283. LNCS. Springer, 2002. [OCo05] R. O’Connor. “Essential incompleteness of arithmetic veriﬁed by Coq”. In: International Conference on Theorem Proving in Higher Order Logics. Springer. 2005, pp. 245–260. [Pau15] L. C. Paulson. “A mechanised proof of Gödel’s incompleteness theorems using Nominal Isabelle”. In: Journal of Automated Rea- soning 55.1 (2015), pp. 1–37. [Raa18] P. Raatikainen. “Gödel’s Incompleteness Theorems”. In: The Stan- ford Encyclopedia of Philosophy. Ed. by E. N. Zalta. Fall 2018. Metaphysics Research Lab, Stanford University, 2018. [SB18] A. Steen and C. Benzmüller. “The Higher-Order Prover Leo-III”. In: Automated Reasoning. IJCAR 2018. Ed. by D. Galmiche, S. Schulz, and R. Sebastiani. Vol. 10900. LNCS. Springer, 2018, pp. 108–116. doi: 10.1007/978-3-319-94205-6_8. [Sha02] S. Shapiro. “Incompleteness and inconsistency”. In: Mind 111.444 (2002), pp. 817–832. [Smi13] P. Smith. An introduction to Gödel’s theorems. Cambridge Uni- versity Press, 2013. [Smo77] C. Smoryński. “The incompleteness theorems”. In: Handbook of mathematical logic. Ed. by J. Barwise. Vol. 4. North-Holland Publishing Company, 1977, pp. 821–865. [Smu92] R. M. Smullyan. Gödel’s incompleteness theorems. Oxford Uni- versity Press, 1992. [Sol76] R. M. Solovay. “Provability interpretations of modal logic”. In: Israel journal of mathematics 25.3-4 (1976), pp. 287–304. [Tar98] A. Tarski. “A decision method for elementary algebra and geometry”. In: Quantiﬁer elimination and cylindrical algebraic de- composition. Springer, 1998, pp. 24–84. [Ver17] R. Verbrugge. “Provability Logic”. In: The Stanford Encyclope- dia of Philosophy. Ed. by E. N. Zalta. Fall 2017. Metaphysics Research Lab, Stanford University, 2017.