Godel God

by

Melvin Fitting

TYPES, TABLEAUS, AND GO DEL'S GOD

TRENDS IN LOGIC Studia Logica Library

VOLUME 13

Managing Editor Ryszard Wojcicki, Institute of Philosophy and Sociology,

Polish Academy of Sciences, Warsaw, Poland

Editors Daniele Mundici, Department of Computer Sciences, University of Milan, Italy

Ewa Orlowska, National Institute of Telecommunications, Warsaw, Poland

Graham Priest, Department of Philosophy, University of Queensland, Brisbane, Australia

Krister Segerberg, Department of Philosophy, Uppsala University, Sweden

Alasdair Urquhart, Department of Philosophy, University of Toronto, Canada Heinrich Wansing, Institute of Philosophy, Dresden University of Technology,

Germany

SCOPE OF THE SERIES

Trends in Logic is a bookseries covering essentially the same area as the journal Studia Logica - that is, contemporary formal logic and its applications and relations to other disciplines. These include artificial intelligence, informatics, cognitive science, philosophy of science, and the philosophy of language. However, this list is not exhaustive, moreover, the range of applications, comparisons and sources of inspiration is open and evolves over time.

Volume Editor Heinrich Wansing

The titles published in this series are listed at the end of this volume.

MELVIN FITTING Lehman College and the Graduate Center,

City University of New York, U.S.A.

TYPES, TABLEAUS, ••

AND GO DEL'S GOD

~~~....

'' KLUWER ACADEMIC PUBLISHERS DORDRECHT/BOSTON/LONDON

A C.I.P. Catalogue record for this book is available from the Library of Congress.

ISBN 1-4020-0604-7

Published by Kluwer Academic Publishers, P.O. Box 17, 3300 AA Dordrecht, The Netherlands.

Sold and distributed in North, Central and South America by Kluwer Academic Publishers,

101 Philip Drive, Norwell, MA 02061, U.S.A.

In all other countries, sold and distributed by Kluwer Academic Publishers,

P.O. Box 322, 3300 AH Dordrecht, The Netherlands.

Printed on acid-free paper

All Rights Reserved © 2002 Kluwer Academic Publishers

No part of this work may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, microfilming, recording

or otherwise, without written permission from the Publisher, with the exception of any material supplied specifically for the purpose of being entered

and executed on a computer system, for exclusive use by the purchaser of the work.

Printed in the Netherlands.

Contents

PREFACE Xl

Part I CLASSICAL LOGIC

1. CLASSICAL LOGIC-SYNTAX 3

1 Terms and Formulas 3

2 Substitutions 8

2. CLASSICAL LOGIC-SEMANTICS 11

1 Classical Models 11

2 Truth in a Model 12

3 Problems 15 3.1 Compactness 15 3.2 Strong Completeness 16 3.3 Weak Completeness 16 3.4 And Worse 17

4 Henkin Models 19

5 Generalized Henkin Models 24

6 A Few Technical Results 29 6.1 Terms and Formulas 29 6.2 Extensional Models 29 6.3 Language Extensions 30

3. CLASSICAL LOGIC-BASIC TABLEAUS 33

1 A Different Language 33

2 Basic Tableaus 35

3 Tableau Examples 37

v

vi TYPES, TABLEAUS, AND GODEL'S GOD

4. SOUNDNESS AND COMPLETENESS 43 1 Soundness 43 2 Completeness 46

2.1 Hintikka Sets 47 2.2 Pseudo-Models 48 2.3 Substitution and Pseudo-Models 52 2.4 Hintikka Sets and Pseudo-Models 59 2.5 Pseudo-Models are Models 62 2.6 Completeness At Last 63

3 Miscellaneous Model Theory 66

5. EQUALITY 69

1 Adding Equality 69 2 Derived Rules and Tableau Examples 69 3 Soundness and Completeness 73

6. EXTENSIONALITY 77

1 Adding Extensionality 77 2 A Derived Rule and an Example 77 3 Soundness and Completeness 79

Part II MODAL LOGIC

7. MODAL LOGIC, SYNTAX AND SEMANTICS 83 1 Introduction 83 2 Types and Syntax 86 3 Constant Domains and Varying Domains 89 4 Standard Modal Models 90

5 Truth in a Model 92

6 Validity and Consequence 94

7 Examples 95

8 Related Systems 101

9 Henkin/Kripke Models 102

8. MODAL TABLEAUS 105 1 The Rules 105

1.1 Prefixes 105 1.2 Propositional Rules 107

Contents vii

1.3 Modal Rules 107 1.4 Quantifier Rules 108 1.5 Abstraction Rules 109 1.6 Atomic Rules 109 1.7 Proofs and Derivations 110

2 Tableau Examples 111

3 A Few Derived Rules 113

9. MISCELLANEOUS MATTERS 115

1 Equality 115 1.1 Equality Axioms 115 1.2 Extensionality 117

2 De Re and De Dicta 118

3 Rigidity 121

4 Stability Conditions 124

5 Definite Descriptions 125

6 Choice Functions 128

Part III ONTOLOGICAL ARGUMENTS

10. GODEL'S ARGUMENT, BACKGROUND 133

1 Introduction 133

2 Anselm 134

3 Descartes 134

4 Leibniz 137

5 Godel 138

6 Godel's Argument, Informally 139

11. GODEL'S ARGUMENT, FORMALLY 145

1 General Plan 145

2 Positiveness 145

3 Possibly God Exists 150

4 Objections 152

5 Essence 156

6 Necessarily God Exists 160

7 Going Further 162 7.1 Monotheism 162

viii TYPES, TABLEAUS, AND GODEL'S GOD

8

9

10

11

7.2 Positive Properties are Necessarily Instantiated

More Objections

A Solution

Anderson's Alternative

Conclusion

REFERENCES

INDEX

162

163

164

169

171

173

179

Truth did not come into the world naked, but it came in types and images.

One will not receive truth in any other way.

The Gospel of Philip [Rob77]

Preface

What's Here This is a book about intensional logic. It also provides a thorough

look at higher-type classical logic, including tableaus and a completeness proof for them. It also provides a formal examination of the Godel ontological argument. These are not disparate topics. Higher-type classical logic is intensional logic with the intensional features removed, so this is a good place to start. Ontological arguments, Godel's in particular, are natural examples of intensional logic at work, so this is a good place to finish.

The term formal logic covers a broad range of inventions. At one end are small, special-purpose systems; at the other are rich, expressive ones. Higher-type modal logic-intensional logic-is one of the rich ones. Originating with Carnap and Montague, it has been applied to provide a semantics for natural language, to model intensional notions, and to treat long-standing philosophical problems. Recently it has also supplied a semantic foundation for some complex database systems. But besides being rich and expressive, it is also tremendously complex, and requires patience and sympathy on the part of its students.

There are two quite different reasons to be interested in a logic. There is its formal machinery for its own sake, and there is using the formal machinery to address problems from the outside world. The mechanism of higher-type modal logic is complex and requires serious mathematics to develop properly. Models are not simple to define, and tableau systems are quite elaborate. A completeness argument, to connect the two, is difficult. But, the machinery is of considerable interest, if this is the sort of thing you have a considerable interest in. If you are such a reader, applications concerning the existence of God can simply be skipped. On the other hand, if philosophical applications are what you are after, the

xi

Xll TYPES, TABLEAUS, AND GO DEL'S GOD

Godel ontological argument is a prime example. If this is the kind of reader you are, much of the mathematical background can be taken on faith, so to speak. It is a rare reader who will be interested equally in both the formal and the applied aspects of intensional logic. In a sense, then, this book has no audience--there are separate audiences for different parts of it. (But I encourage these audiences to do some 'crossing over.')

If you are interested in ontological arguments for their own sakes, start with Part III, and pick up material from earlier chapters as it is needed. If you are interested in the mathematical details of the formal system, its semantics and its proof theory, Parts I and II will be of interest-you can skimp on reading Part III. Part I is entirely devoted to classical logic, and Part II to modal. Here is a more detailed summary.

Part I presents higher-type classical logic. It begins with a discussion of syntax matters, Chapter 1. I present types in Schutte's style, rather than following Church. Types can be somewhat daunting and I've tried to make things go as smoothly as I can.

Chapter 2 examines semantics in considerable detail. What are sometimes called "true" higher-order models are presented first. After this, Henkin's generalization is given, and finally a non-extensional version of Henkin models is defined. Henkin himself mentioned such models, but knowledge of them does not seem to be widespread. They are natural, and should become more familiar to the logic community-the philosophical logic community in particular.

Classical higher-order tableaus are formulated in Chapter 3. These are not original here--versions can be found in several places. A number of worked out examples of tableau proofs are given, and more are in exercises. The system is best understood if used. I do not attempt a consideration of automation-the system is designed entirely for human application. There is even some discussion of why.

Soundness and completeness are proved in Chapter 4. Tableaus are complete with respect to non-extensional Henkin models. The completeness argument is not original; it is, however, intricate, and detailed proofs are scarce in the literature.

After the hard work has been done, equality and extensionality are easy to add using axioms, and this is done in Chapters 5 and 6. And this concludes Part I. Except for the explicit formulation of non-extensional models, the material in Part I is not original-see [Tak67, Pra68, Tol75, And86, Sha91, Lei94, Koh95, Man96], for example.

Part II is devoted to the complications that modality brings. Chapter 7 adds the usual box and diamond to the syntax, and possible worlds

PREFACE xiii

to the semantics. It is now that choices must be made, since quantified modal logic is not a thing, but a multitude.

First, at ground level quantifiers could be actualist or possibilistthey can range over what actually exists at a world, or over what might exist. This corresponds to the varying domain, constant domain split familiar to many from first-order modal discussions. However, either an actualist or a possibilist approach can simulate the other. I opt for a possibilist approach, with an explicit existence predicate, because it is technically simpler.

Next, we must go up the ladder of higher types. Doing so extensionally, as in classical logic, means we take subsets of the ground-level domain, subsets of these, and so on. Going up intensionally, as Montague did, means we introduce functions from possible worlds to sets of groundlevel objects, functions from possible worlds to sets of such things, and so on. What is presented here mixes the two notions-both extensional and intensional objects are present. I refer you to [FitOOb, FitOOa] for applications of these ideas to database theory-intensional and extensional objects make natural sense even in such a context.

Classical tableau rules are adapted in Chapter 8, using prefixes, to produce modal systems. While the modal tableau rules are rather straightforward, they are new to the literature, and should be of interest. Since things are already quite complex, no completeness proof is given. If it were given, it would be a direct extension of the classical proof of Part I.

Using modal semantics and tableaus, in Chapter 9 I discuss the relationships between rigidity, de re and de dicto usages, and what I call Godel's stability conditions, which arise in his proof of the existence of God. I also relate all this to definite descriptions. While this is not deep material, much of it does not seem to have been noted before, and many should find it of some significance.

Finally, Part III is devoted to ontological proofs. Chapter 10 gives a brief history and analysis of arguments of Anselm, Descartes, and Leibniz. This is followed by a longer, still informal, presentation of the Godel argument itself. Formal methods are applied in Chapter 11, where Godel's proof is examined in great detail. While Godel's argument is formally correct, some fundamental flaws are pointed out. One, noted by Sobel, is that it is too strong-the modal system collapses. This could be seen as showing that free will is incompatible with Godel's assumptions. Some ways out of this are explored. Another flaw is equally serious: Godel assumes as an axiom something directly equivalent to a key conclusion of his argument. The problematic axiom is related to a principle Leibniz proposed as a way of dealing with a hole he found in an ontological proof of Descartes. Descartes, Leibniz, and Godel (and

XlV TYPES, TABLEAUS, AND GODEL'S GOD

also Anselm) all have proofs that stick at the same point: showing that the existence of God is possible.

If the Godel argument is what you are interested in, start with Part III, and pick up earlier material as needed. Many of the uses of the formalism are relatively intuitive. Indeed, in Godel's notes on his ontological argument, formal machinery is never discussed, yet it is possible to get a sense of what it is about anyway.

How Did This Get Written? Having just completed work on a book about first-order modal logic,

[FM98], a look at higher-order modal logic suggested itself. I thought I would use Godel's ontological argument as a paradigm, because it is one of the few examples I have run across that makes essential use of higherorder modal constructs. Godel's argument for the existence of God is not particularly well-known, but there is a growing body of literature on it. This literature sometimes gives formalizations of Godel's rather sketchy ideas-generally along natural deduction or axiomatic lines. My idea was, I would design a tableau system within which the argument could be formalized, and this might lead to a nice paper illustrating the use of tableau methods. First, give tableau rules, then give Godel's proof.

One cannot really develop semantic tableaus without a semantics behind it. The semantics of higher-order modal logic turned out to be of considerable intricacy, far beyond what could even be sketched in a paper. Clearly, an extended discussion of the semantics for higher-order modal logic was needed before the tableau rules could be motivated.

I soon realized that in presenting higher-order modal logic, I was trying to explicate ideas corning from two quite different sources. On the one hand, there are essentially modal problems, some of which already arise at the first-order level and have little to do with higher-order constructs. On the other hand, a number of higher-order modal complexities also manifest themselves in a classical setting, and can be discussed more clearly without modalities complicating things. So I decided that before modal operators were introduced, I would give a thorough presentation of a semantics and tableau system for higher-order classical logic. There are already treatments of tableau, or Gentzen, systems for higher-order classical logic in the literature, but I felt it would be useful to give things in full hr"e. Detailed completeness proofs are hard to find, for instance.

Higher-order classical logic already has its hidden pitfalls. It is common knowledge, so to speak, that "true" higher-order classical models cannot correspond to any proof procedure. Henkin models are what is needed. But a "natural" formulation of tableaus is not complete with respect to Henkin models either. This is something known to experts-

PREFACE XV

it was not known to me when I started this book. A broader notion of Henkin model (also due to Henkin) is needed, a non-extensional version. Such models should be better known since they are actually quite plausible things, and address problems that, while not common in mathematics, do arise in linguistic applications of logic.

In the 1960's, cut-elimination theorems were proved for higher-order classical logic, using semantic methods that relied on non-extensional models. In effect, these cut-elimination proofs concealed a completeness argument within them, but the general notion of non-extensional model was not formulated abstractly--only the specific structure constructed by the completeness argument was considered. In short, a completeness theorem was never stated, only a consequence, albeit a very important one. So I found myself required to formulate a general notion of classical non-extensional Henkin model, then prove completeness for a suitable classical tableau system. After this I could move on to discuss modality.

What sort of modal features did I want? Formalizations of the Godel argument by others had generally used some version of an intensional logic, with origins in work of Carnap, [Car 56], developed and applied by Montague, [Mon60, Mon68, Mon70], and formally elaborated in [Gal75]. After several preliminary attempts I decided this logic was not quite what I wanted. In it, semantically speaking, all objects are intensional. I decided I needed a logic containing both intensional and extensional objects. Of course, one could bring extensional objects into the Montague setting by identifying them with objects that are rigid, in an appropriate sense, but it seemed much more natural to have extensional objects from the start. Thus the modal logic given in the second part of this book is somewhat different from what has been previously considered.

Once I had formulated the modal logic I wanted, tableau rules were easy, and I could finally formalize the Godel argument. What began as a short paper had turned into a book. My after-the-fact justification is that there are few treatments of higher-order logic at all, and fewer still of higher-order modal logic. It is a rare flower in a remote field. But it is a pretty flower.

Acknowledgments An earlier draft of this work was on my web page for some time, and I

was given several helpful suggestions as a result. In particular I want to thank Peter Hajek, Oliver Kutz, Paul Gilmore, and especially Howard Sobel.

I

CLASSICAL LOGIC

M. Fitting, Types, Tableaus, and Gödel's God

© Kluwer Academic Publishers 2002

Chapter 1

CLASSICAL LOGIC-SYNTAX

1. Terms and Formulas The formulation of a higher-order logic allows some freedom-there

are certain places where choices can be made. Several of these choices produce equivalent results. Before getting to the formal machinery, I informally set out my decisions on these matters. Other treatments may make different choices, but ultimately it is largely a matter of convenience that is involved.

Often classical first-order logic is formulated with a rich variety of terms, built up from constant symbols and variables using function symbols. Since higher-order constructs are already complicated, I have decided to have constant symbols but not function symbols. If necessary for some purpose, it is not a major issue to add them-doing so yields a conservative extension.

Higher-order logic can be formulated with or without explicit abstraction machinery. Speaking informally, one wants to make sure that every formula specifies a class, but there are two ways of making this happen. One is to assume comprehension axioms, formulas of the general form:

where cp(x1, ... , xn) is a formula with free variables as indicated. Such axioms ensure that to each formula corresponds an 'object.' The other approach is to elaborate the term-forming machinery, so that there is an explicit name for the object specified by a formula cp. This involves predicate abstraction, or >-.-abstraction:

3

4 TYPES, TABLEAUS, AND GODEL'S GOD

The two approaches are equivalent in a direct way. I have chosen to use explicit abstracts for several reasons. First, axioms are not as natural when tableau systems are the proof machinery of choice. And second, predicate abstraction has already played a major role in earlier investigations of modal logic [FM98], and makes discussion of major issues considerably easier here.

Finally, one can characterize higher-order formulas more-or-less the way it is done in the first-order setting, taking quantifiers and connectives as "logical constants." This is the approach of [Sch60]. Alternatively, following [Chu40], one can think of quantifiers and connectives as constants of the language, which itself is formulated in lambda-calculus style. In this book I take the first approach, though one can make arguments for the second on grounds of elegance and economy. My justification is that doing things the way that has become standard for first-order logic will be less confusing to the reader.

Recently one further alternative has become available. In [Gil99, GilOl], Paul Gilmore has shown that by a relatively simple change, a system of classical higher-order logic can be developed allowing a controlled degree of impredicativity-typing rules can be relaxed to permit the formation of certain useful sentences that are not "legal" in the approach presented here. This, in turn, allows a more natural development of arithmetic in the higher-order setting. I do not follow Gilmore's approach here, but I recommend it for study. Much of what I develop carries over quite directly.

So these are my choices: no function symbols, explicit predicate abstraction, quantifiers and connectives as in the first-order setting, and no impredicativity. With this out of the way I can begin presenting the formal syntactical machinery.

In first-order logic, relation symbols have an arity--some are oneplace, some are two-place, and so on. In higher-order logic this simple idea gets replaced by a typing mechanism, which is considerably more complex. Terms, and certain other items, are assigned types, and rules of formation make use of these types to ensure that things fit together properly. I begin by saying what the types are.

DEFINITION 1.1 (TYPE) 0 is a type. If t1, ... , tn are types, (tl, ... , tn) is a type. I generally use t, t1, t2, t', etc. to represent types.

An object of type 0 is intended to be a ground-level object-it corresponds to the designation of a constant symbol or variable in standard first-order logic. An object of type (t1 , ... , tn) is a predicate that takes n arguments, of types t1 , ... , tn respectively. Thus a constant symbol of type (0, 0, 0), say, would be called a three-place relation symbol in

CLASSICAL LOGIC-SYNTAX 5

standard first-order logic-it applies to three ground-level arguments. But now we can have relation symbols of types such as ( (0), (0, 0), 0), to which nothing in first-order logic corresponds.

DEFINITION 1.2 (L(C)) Let C be a set of constant symbols with a type associated to each, containing at least an equality symbol =(t,t) for each type t. I denote the classical higher-order language built up from C by L( C). The rest of this section amounts to the formal characterization of L(C).

For each type t I assume there are infinitely many variable symbols of that type. I generally use letters from the beginning of the Greek alphabet to represent variables, with the type written as a superscript: at, j3t, '"'/, . . . . Likewise I generally use letters from the uppercase Latin alphabet as constant symbols, again with the type written as a superscript: At, Bt, ct, Dt, .... As noted, equality is primitive, so for each type t there is a constant symbol =(t,t) of type (t, t). Often types can be inferred from context, and so superscripts will be omitted where possible, in the interests of uncluttered notation.

Sometimes it is helpful to refer to the order of a term or formula-firstorder, second-order, and so on. It is simplest to define this terminology first for types themselves.

DEFINITION 1.3 (ORDER) Type 0 is of order 0. Type (t1, ... , tn) has as its order the maximum of the orders of t1, ... , tn, plus one.

Thus (0, 0) is of order 1, or first-order. Likewise (0, (0, 0)) is of order 2, or second-order. Types will play the fundamental role, but order provides a convenient way of referring to the maximum complexity of some construct. When I talk about the order of a constant or variable, I mean the order of its type. Likewise once formulas are defined, I may refer to the order of the formula, by which I mean the highest order of a typed part of it.

Next I define the class of formulas, and their free variables. This definition is more complex than the corresponding first-order version because the notion of term cannot be defined first; both term and formula must be defined together. And to define both, I need the auxiliary notion of predicate abstract which is, itself, part of a mutual recursion involving Definitions 1.4, 1.5, and 1.6.

DEFINITION 1.4 (PREDICATE ABSTRACT OF L(C)) Let <f? be a formula of L(C) and a1, ... , an be a sequence of distinct variables of types h, ... , tn respectively. (.Aa1, ... , an.<P) is a predicate abstract of

L( C). Its type is (t1, ... , tn), and its free variable occurrences are the free variable occurrences in the formula~' except for occurrences of the variables a1, . . . , an.

DEFINITION 1.5 (TERM OF L(C)) Terms of each type are characterized as follows.

1 A constant symbol of L(C) or variable is a term of L(C). If it is a constant symbol, it has no free variable occurrences. If it is a variable, it has one free variable occurrence, itself.

2 A predicate abstract of L( C) is a term of L( C). Its free variable occurrences were defined above.

T is used, with and without subscripts, to stand for terms.

DEFINITION 1. 6 (FORMULA OF L( C)) The notion of formula is given as follows.

1 If T is a term of type (t1, ... , tn), and TI, ... , Tn is a sequence of terms of types t1, ... , tn respectively, then r( TI, ... , Tn) is a formula (atomic) of L( C). The free variable occurrences in it are the free variable occurrences of r, ·n, ... , Tn·

2 If~ is a formula of L( C) so is ...,~. The free variable occurrences of ...,~ are those of«<>.

3 If~ and w are formulas of L(C) so is (~ 1\ w). The free variable occurrences of ( ~ 1\ w) are those of~ together with those of w.

4 If~ is a formula of L( C) and a is a variable then (\Ia)~ is a formula of L(C). The free variable occurrences of('v'a)~ are those of~, except for occurrences of a.

EXAMPLE 1. 7 Suppose a(o,o} is a variable of type (0, 0) (and so firstorder), (3° is a variable of type 0, and 'Y((O,O},O} is a variable of type ((0,0),0) (second-order). Both (3° and 'Y((O,O},o} are terms. Then the expression 'Y( (o,o} ,o} (a (O,O}, (3°) is an atomic formula. Generally I will write the simpler looking 'Y( a, (3), and give the information contained in the superscripts in a separate description. Since this atomic formula contains a variable 'Y of order 2, it is referred to as a second-order atomic formula.

DEFINITION 1.8 (SENTENCE) A formula with no free variables is a sentence.

CLASSICAL LOGIC-SYNTAX 7

One can think of V, ::=>,:=,and 3 as defined symbols, with their usual definitions. But sometimes it is convenient to take them as primitive-! do whatever is most useful at the time. Also square and curly parentheses are used, as well as the official round ones, to aid readability. And finally, I write the equality symbol in. infix position, following standard convention. Thus, for example, I write (a/ =(t,t) f3t) in place of =(t,t) ( 0 t, f3t).

Several examples involving just first and second-order notions will be considered, so a few special alphabets are introduced informally, to make reading the examples a little easier.

Order Constants Variables 0 a, b, c, ... x, y, z, ... 1 A,B,C, ... X, Y,Z, ... 2 A,B,C, ... X,Y,Z, ...

ExAMPLE 1.9 For this example I give explicit type information (in superscripts), until the end of the example. After this I omit the superscripts, and say in English what is needed to restore them.

Suppose x 0 , X(O), and X((O)) are variables (the first is of order 0, the second is of order 1, and the third is of order 2). Also suppose p((O)) and g0 are constant symbols of L(C) (the first is of order 2 and the second is of order 0).

1 Both X((O))(X(0)) and X(0)(x0) are atomic formulas. All variables present have free occurrences.

2 (>..X((o)).X((O))(X(0))) is a predicate abstract, of type (((0))). Only the occurrence of X(O) is free.

3 SinceP((O)) isoftype ((0)), (>..X((O)).X((O))(X(0)))(P((O))) is a formula. Only X(O) is free.

4 [(>..X((O)) .X((O))(X(0)))(P((O)))::) X(0)(x0)] is a formula. The only free variable occurrences are those of X(0) and x0 .

5 (VX(0))[(>..X((O)).X((O))(X(0)))(P((O))) ::=> X(0)(x0)] is a formula. The only free variable occurrence is that of x0 .

6 (>..x0 .(\fX(0))[(>..X((O)).X((O))(X(0)))(P((O))) ::=> X(0)(x0)]) is a predi-cate abstract. It has no free variable occurrences, and is of type (0).

The type machinery is needed to guarantee that what is written is wellformed. Now that the exercise above has been gone through, I will display the predicate abstract without superscripts, as

(>..x.('v'X)[(>..X.X(X))(P) ::=> X(x)]),

leaving types to be inferred, or explained in words, as necessary.

In first-order logic, facts about formulas and terms are often proved by induction based on complexity. And complexity for a formula is often measured by the number of logical connectives and quantifiers, or what amounts to the same thing, by how "far away" the formula is from being atomic. In a higher-order setting these notions diverge.

DEFINITION 1.10 (DEGREE) By the degree of a formula or term is meant the number of propositional connectives, quantifiers, and lambdasymbols it contains.

Note that since an atomic formula can involve terms containing predicate abstracts which, in turn, involve other formulas, the degree of an atomic formula need not be 0, as in the first-order case.

2. Substitutions Formulas can contain free variables, and terms that are very complex

can be substituted for them. The notion of substitution is a fundamental one, and this section is devoted to it. In a general way, I follow the treatment in [Fit96].

DEFINITION 1.11 (SUBSTITUTION) A substitution is a mapping from the set of variables to the set of terms of L( C) such that variables of type t map to terms of type t.

I generally denote substitutions by u, with and without subscripts. Also I generally write xu rather than u(x). Most concern is with substitutions having finite support, that is, they are the identity on all but a finite number of variables. A special notation is used for the finite support substitution that maps each O:i to Ti and is the identity otherwise: { o:l/r1, ... , O:n/Tn}·

The action of substitutions on variables is readily extended to terms and formulas generally.

DEFINITION 1.12 For a substitution u, by Ua 1 , ... ,an is meant the substitution that is like u except that it is the identity on 0:1, . . . , O:n.

DEFINITION 1.13 Let u be a substitution. The action of u is extended recursively as follows.

1 Au = A for a constant symbol A.

2 (.Ao:1, .. · , O:n.)u = (.Ao:1, .. · , O:n.Ua1, ... ,an)·

CLASSICAL LOGIC-SYNTAX

3 [7(71, ... , 7n)]u = 70"(710", ... , 7n0").

4 [•<P]u = •[<Pu].

5 (.,6°.')'(0)(,6°)))] and let u be any substitution such that 'Y(o) u = 7(o). I compute <Pu. For convenience I omit type-indicating superscripts, but even so, the notion is a bit much. Sorry.

(3a) [a( (>.,6. 1(,6))) ]u = (3a) [a( (>.,6. 1(,6))) ]u a

= (3a)[aua( (>.,6.')'(,6))ua)] = (3a)[a( (>.,6.')'(,6))ua)] = (3a)[a( (>.,6.['Y(,6)]ua,{J) )]

= (3a)[a( (>.,6.(!'ua,{J)(,6ua,{J)) )] = (3a)[a( (>.,6.7(,6)) )]

The connection between substitutions and free variable occurrences is simple: it is only the free occurrences that can be changed by substitutions. I leave the proof to you as an exercise.

PROPOSITION 1.15 Let 0"1 and 0"2 be substitutions.

1 If u1 and u2 agree on the free variables of the term 7 then 70"1 = 70"2.

2 If 0"1 and u2 agree on the free variables of the formula <P then <Pu1 = <Pu2.

Not all substitutions are appropriate in all settings; some do not properly respect the role of bound variables, in the sense that they may replace a free occurrence of a variable in a formula with another variable that is "captured" by a quantifier or predicate abstract of the formula. The substitutions that are acceptable are called free substitutions. These play a significant role throughout what follows.

DEFINITION 1.16 (FREE SUBSTITUTION) The following character-izes when a substitution u is free for a formula or term.

1 u is free for a variable or constant.

2 O" is free for (>.a1, ... , an.<P) if O"a1, ... ,an is free for <P, and if ,6 is any free variable of (>.a1, ... , an.<P) then ,6u does not contain any of a1, ... , an free.

3 a is free for ,q, if a is free for <P.

4 a is free for ( <P 1\ 'l1) if a is free for <P and a is free for 'l1.

5 a is free for (Ya)<P if CJ01 is free for <P, and if f3 is a free variable of (Ya)<P then f3a does not contain a free.

With the action of substitutions extended to all terms, composition of substitutions is easily defined.

DEFINITION 1.17 (SUBSTITUTION COMPOSITION) Let a1 and a2 be substitutions. Their composition is the mapping defined by: a(aw2) = (aa1)a2, for variables a.

It is not generally the case that T(a1a2) = (Ta1)a2, for terms T, and similarly for formulas. But it is when appropriate freeness conditions are imposed.

THEOREM 1.18 Substitution is <~compositional" under the following circumstances.

1 If a1 is free for the formula <P, and a2 is free for the formula <Pa1, then (<Pa1)a2 = <P(aw2).

2 If a1 is free for the term T, and a2 is free for the term TCJI, then (Ta1)a2 = T(a1a2).

The proof of this is essentially the same as in the first-order setting. Rather than giving it here, I refer you to the proof of Theorem 5.2.13 in [Fit96].

Exercises EXERCISE 2.1 Prove Proposition 1.15 by induction on degree. Conclude that if <P is a sentence then <Pa = <P for every substitution a.



Chapter 2

CLASSICAL LOGIC-SEMANTICS

1. Classical Models Defining the semantics of any higher-order logic is relatively compli

cated. Since modalities add special complexities, it is fortunate I can discuss underlying classical issues before bringing them into the picture. In this Chapter the "real" notion of higher-order model is defined first, and truth in them is characterized. Then Henkin's modification of these models is considered-sometimes these are called general models-as well as a non-extensional version of them.

I don't want just syntactic objects, terms, to have types. I want sets and relations to have them too. After all, we think of terms as designating sets and relations, and we want type information to move back and forth between syntactic object and its designation.

DEFINITION 2.1 (RELATION TYPES) Let 8 be a non-empty set. For each type t the collection [t, S] is defined as follows.

1 [0,8] = s.

2 [ (t1, ... , tn), S] is the collection of all subsets of [t1, S] X · · · x [tn, S].

0 is an object of type t over S if 0 E [t, S]. 0 is systematically used, with or without subscripts, to stand for objects in this sense.

For example, a member of [ (0, 0), S] is a subset of S x S, and in standard first-order logic it would simply be called a two-place relation on S. But now relations of relations are allowed, and even more complex things as well, so terminology gets more complicated.

A classical model consists of an underlying domain, thought of as the "ground level objects," and an interpretation, assigning some denota-

11

12 TYPES, TABLEAUS, AND GO DEL'S GOD

tion in the model to each constant symbol of the language. But that denotation must be consistent with type information.

DEFINITION 2.2 (CLASSICAL MODEL) A higher-order classical model for L(C) is a structure M = (D,I), where D is a non-empty set called the domain of the model, and I is a mapping, the interpretation, meeting the following conditions.

1 If A is a constant symbol of L(C) of type t, I(A) E [t, D].

2 If = is the equality constant symbol of type (t, t) then I(=) is the equality relation on [t, D].

2. Truth in a Model Assume M = (D,I) is a classical model for a language L(C). It is

time to say which sentences of the language, or more generally, which formulas with free variables, are true in M. This is symbolized by M lf-v <P. Informally it can be read: the formula <Pis true in the model M, with respect to the valuation v which assigns meanings to free variables. But as will be seen, to properly define this one must also assign denotations to all terms. The denotation of a term of type t will be an object of type t over D. And this can not be done first, independently. The assignment of denotations to terms, and the determination of formula truth constitutes a mutually recursive pair of definitions, just as was the case for the syntactic notions of term and formula in Section 1. Still, it is all rather straightforward.

DEFINITION 2.3 (VALUATION) The mapping v is a valuation in the classical model M = (D,I) if v assigns to each variable o/ of type t some object of type t, that is, v((i) E [t, D].

DEFINITION 2.4 (VARIANT) A valuation w is an o:-variant of a valuation v if v and w agree on all variables except possibly o:. More generally, w is an 0:1, ... , O:n-variant if v and w agree on all variables except possibly 0:1, ... , O:n ·

Now, the following two definitions constitute a single recursive characterization.

DEFINITION 2.5 (DENOTATION OF A TERM) Let M = (D,I) be a classical model, and let v be a valuation in it. A mapping is defined, ( v *I), assigning to each term of L( C) a denotation for that term.

1 If A is a constant symbol of L(C) then (v * I)(A) =I( A).


2 Ifa is a variable then (v*I)(a) =v(a).

3 If (.Aa1, ... ,an.q,) is a predicate abstract of L(C) of type t, then (v *I)( (.Aa1, ... , an.q,)) is the following member of [t, V]:

{ (w(a1), ... , w(an)) Jw is an a1, ... , an variant of v

and M if-w q,}

13

DEFINITION 2.6 (TRUTH OF A FORMULA) Again let M = (V,I) be a classical model, and let v be a valuation in it. The notion of formula q, of L(C) being true in model M with respect to v, denoted M if-v q,, is characterized as follows.

1 For terms T, T1, ... ,Tn, M if-v T(T1, ... ,Tn) provided ( ( v * I) ( T1) , .. . , ( v * I) ( T n)) E ( v * I) ( T) .

2 M if-v --,q, if it is not the case that M if-v q,,

3M if-v q, 1\ 'lt if M if-v q, and M if-v 'lt.

4 M if-v (Va)q, if M if-v' q, for every a-variant v' of v.

There is an alternative notation that makes evaluating the truth of formulas in models somewhat easier.

DEFINITION 2. 7 (SPECIAL NOTATION) Suppose v is a valuation, and w is the a1, ... , an variant ofv such that w(al) = 01, ... , w(an) =On. Then, if M if-w q, this may be symbolized by

Now part 3 of Definition 2.5 can be restated as follows.

3 (v*I)((.Aa1, ... ,an,q,)) = { (01, ... , On) J M if-v q,[al/01, ... , an/On]}

Likewise part 4 of Definition 2.6 becomes

4 M if-v (Va)q, if M if-v q,[a/0] for every object 0 of the same type as a.

Defined symbols like~ and 3 have their expected behavior, which are explicitly stated below. Alternately, this can be considered an extension of the definition above.

5 M if-v q, V 'lt if M if-v q, or M if-v 'lt.

6 M if-v q, ~ 'lt if M if-v q, implies M if-v 'lt.

7 M lf--v = W if M lf--v iff M lf--v W.

8 M lf--v (3a) for some a-variant v' of v; equivalently if M lf--v <P[a/0] for some object 0 of the same type as a.

As in first-order logic, if has no free variables, M lf--v holds for some v if and only if it holds for every v. Thus for sentences (closed formulas), truth in a model does not depend on a choice of valuation.

DEFINITION 2.8 (VALIDITY, SATISFIABILITY, CONSEQUENCE) Let <l> be a formula and S be a set of formulas.

1 is valid if M lf--v for every classical model M and valuation v.

2 S is satisfiable if there is some model M and some valuation v such that M If-v is a consequence of S provided, for every model M and every valuation v, if M lf--v .

The definitions above are of some complexity. Here is an example to help clarify their workings.

EXAMPLE 2.9 This example shows a formula that is valid and involves equality. In it, cis a constant symbol of type 0.

The expression (AX.(:lx)X(x)) is a predicate abstract of type ((0)), where X is of type (0) and x is of type 0. Intuitively it is the "being instantiated" predicate. Likewise the expression (>.x.x = c) is a predicate abstract of type (0), where x and care of type 0. Intuitively this is the "being c" predicate. Since this predicate is, in fact, instantiated (by whatever c designates), the fir:;;t predicate abstract correctly applies to it. That is, one should have the validity of the following.

(>.X.(3x)X(x))((>.x.x =c)) (2.1)

I now verify this validity. Suppose there is a model M = (V, I). I show the formula is true in M with respect to an arbitrary valuation v. To do this, I investigate the behavior, in M, of parts of the formula, building up to the whole thing.

First, recalling that the interpretation of an equality symbol is by the equality relation of the appropriate type, we have the following.

(v *I)((>.x.x =c))= {o I M lf--v (x = c)[x/o]}

= {o I o =I(c)}

= {I(c)}


We also have the following.

(v *I)((.AX.(3x)X(x))) = {0 I M 11-v (3x)X(x)[Xj0]}

= {0 I M 11-v X(x)[X/O,xjo] for some o} = { 0 I o E 0 for some o}

= {o I o # 0}

Now we have (2.1) because

M 11-v (.AX.(3x)X(x))((.Ax.x =c))¢:}

15

(v *I)((.Ax.x =c)) E (v *I)((.AX.(3x)X(x))) ¢:} {I(c)} E {0 I 0 # 0}.

You might try verifying, in a similar way, the validity of the following . . •(.AX.(3x)X(x))((.Ax.•(x = x)))

3. Problems First-order classical logic has many nice features that do not carry

over to higher-order versions. This is well-known, and partly accounts for the general emphasis on first-order. I sketch a few of the higher-order problems here.

3.1 Compactness The compactness theorem for first-order logic says a set of formu

las is satisfiable if every finite subset is. This is a fundamental tool for the construction of models of various kinds-non-standard models of analysis, for instance. The higher-order analog does not hold, and counter-examples are easy to come by. Here is one.

The Dedekind characterization of infinity is: a set is infinite if it can be put into a 1-1 correspondence with a proper subset. Consequently, a set is finite if any 1-1 mapping from it to itself can not be to a proper subset, i.e. must be onto. This can be said easily, as a second-order formula. Since function symbols are not available, I make do with relation symbols in the usual way-the following formula is true in a model if and only if the domain of the model is finite.

(\fX)[(function(X) 1\ one-one(X)) :J onto(X)] (2.2)

In (2.2) the following abbreviations are used.

function(X) for (\fx)(3y)(\fz)[X(x, z) = (z = y)] one-one(X) for (\fx)(\fy)(\fz){[X(x, z) 1\ X(y, z)] :J (x = y)}

onto(X) for (\fy)(3x)X(x, y)

Also, define the following infinite list of formulas, where x ol y abbreviates •(x = y).

A2 = (:3xl)(:Jx2)[xl ol x2] A3 = (:Jx1)(:Jx2)(:lx3)[(x1 ol x2) 1\ (x1 ol x3) 1\ (x2 ol x3)]

So An is true in a model if and only if the domain of the model contains at least n members.

Now, the set consisting of (2.2) and all of A2, A3, ... , is certainly not satisfiable, but every finite subset is, so compactness fails. (In firstorder classical logic this example turns around, and shows finiteness has no first-order characterization.)

3.2 Strong Completeness A proof procedure is said to be (sound and) strongly complete if <.!.>

has a derivation from a set S exactly when <.!.> is a logical consequence of S. Classical first-order logic has many proof procedures that are strongly complete for it, but there is no such proof procedure for higherorder logic. To see this, one doesn't need an exact definition of proof procedure-it is enough that proofs be finite objects.

Let S be the set of formulas defined in Section 3.1, a set that is not satisfiable though every finite subset is. And let j_ be <.!.> 1\ •<.!.>, for some formula <.!.>. The formula j_ is a logical consequence of S, since it is true in every model in which the members of S are true, namely none. If there were a strongly complete proof procedure, j_ would have a derivation from S. That derivation, being a finite object, could only use a finite subset of S, say So. Then j_ would be a logical consequence of So, and so So could not be satisfiable (otherwise there would be a model in which j_ was true). But every finite subset of S is satisfiable. Conclusion: no strongly complete proof procedure can exist for higher-order classical logic.

3.3 Weak Completeness A proof procedure is (sound and) weakly complete if it proves exactly

the valid formulas. A strongly complete proof procedure is automatically weakly complete (just use the empty set of premises). Higher-order classical logic does not even possess a weakly complete proof procedure. To show this the Incompleteness Theorem can be used.

The idea is to write a single formula that characterizes the natural numbers-a second-order formula will do. One needs a constant symbol

CLASSICAL LOGIC-SEMANTICS 17

of type 0 to represent the number 0 and, to thoroughly overload notation, I use 0 for this. Also a successor function is needed, but since we do not have function symbols in this language, it is simulated with a relation symbol S, technically a constant symbol of type (0, 0). In addition to the abbreviations of Section 3.1, the following is needed.

0-exclude(S) inductive-set(P, S)

induction(S)

for (Vx)-.S(x, 0) for P(O) 1\ (Vx)[P(x) :J (3y)(S(x, y) 1\ P(y))] for (VP)[inductive-set(P, S) :J (Vx)P(x)]

Now, let integer(S) be the formula

function(S) 1\ one-one(S) 1\ 0-exclude(S) 1\ induction(S)

It is not hard to show that integer(S) is true in a model (V,I) if and only if the domain Vis (isomorphic to) the natural numbers, with I(S) as successor. Consequently for any sentence <P of arithmetic, <P is true of the natural numbers if and only if integer( B) :J <P is valid.

It is a standard requirement that the set of ( Godel numbers of) theorems of a proof procedure must be recursively enumerable, so if there were a weakly complete proof procedure for higher-order classical logic, the set of valid formulas would be recursively enumerable. The recursive enumerability of the following set would then be an easy consequence: the set of sentences <P such that integer(S) :J <P is valid. But, as noted above, this is just the set of true sentences of arithmetic, and this is not a recursively enumerable set. Conclusion: no weakly complete proof procedure can exist for higher-order classical logic.

3.4 And Worse I have been discussing higher-order classical logic, particularly its

models, using conventional informal mathematics of the sort that every mathematician applies in papers and books. But certain areas of mathematics-certainly formal logic is among them-are close to foundational issues, and one needs to be careful. It is generally understood that informal mathematics can be formalized in set theory, and this is commonly taken to be Zermelo-Fraenkel set theory, or a variant of it. Let us suppose, for the time being, that the development so far has been within such a framework.

One of the famous problems associated with set theory is Cantor's continuum hypothesis. It is the statement that there are no sets intermediate in size between a countable set and its powerset. A little more formally, it says:


Let X be a set, and let P(X) be its powerset. If X is countable, then any infinite subset Y of P(X) either is in a 1-1 correspondence with X, or is in a 1-1 correspondence with P(X).

(The generalized continuum hypothesis is the natural extension of this to uncountable infinite sets as well, but the simple continuum hypothesis will do for present purposes.) Now, a difficulty for set theory is this: the continuum hypothesis has been proved to be undecidable on the basis of the generally accepted axioms for Zermelo-Fraenkel set theory. That is (assuming the axioms for set theory are consistent) there is a model of the Zermelo-Fraenkel axioms in which the continuum hypothesis is true, and there is another in which it is false.

The problem for us is that the continuum hypothesis can be stated as a sentence of higher-order classical logic. I briefly sketch how. First, one can say the domain of a model is countable by saying there is a relation that orders it isomorphically to the natural numbers. Using a formula from Section 3.3, the following will do: (3a(O,O))integer(a(O,O)).

Next, one can identify a subset of the domain with an object of type (0). Then the collection of all subsets of the domain is an object of type ( (0) ), so the following says there is a powerset for the domain of a model: (3,6( (o))) (v1 (o) ),B( (o)) ( 1 (o)).

Having shown how to start, I leave the rest of the details to you. Write a sentence saying: if the domain is countable then there is a powerset for the domain and, for every infinite subset of that powerset, either there is a 1-1 correspondence between it and the domain, or there is a 1-1 correspondence between it and the powerset. You can say a set is infinite using the negation of a formula from Section 3.1. And the existence of a 1-1 correspondence amounts to the existence of a binary relation meeting certain appropriate conditions. Let us call the sentence that is the higher-order formalization of the continuum hypothesis CH.

Now, the real problem is: is the sentence CH valid or not? There are the following not very palatable options.

1 Assume the foundation for informal mathematics is Zermelo-Fraenkel set theory, formulated axiomatically. In this case neither CH nor its negation can be shown to be valid, since the continuum hypothesis is consistent with, but independent of, the Zermelo-Fraenkel axioms.

2 Assume that informal mathematics is being done in some particular model for the Zermelo-Fraenkel axioms. In this case, CH is definitely valid, or its negation is, but it depends on which Zermelo-Fraenkel model is being considered.


3 Assume that higher-order classical logic itself supplies the theoretical foundations for mathematics. In this case CH either is valid or its negation is, but which is it?

I have reached perhaps the most basic difficulty of all with classical higher-order logic. Not only is there no proof procedure that will allow us to prove every valid formula, the very status of validity for some important formulas is unclear.

4. Henkin Models As we saw in the previous section, higher-order classical logic is diffi

cult to work with. Indeed, difficulties already appear at the second-order level. Not only does it lack a complete proof procedure, but the very notion of validity touches on profound foundational issues. Nonetheless, there are several sound proof procedures for the logic-any formula that has a proof must be valid, though not every valid formula will have a proof. So, there are certainly fragments of higher-order logic that we can hope to make use of.

In a sense, too many formulas of higher-order classical logic are valid, so no proof procedure can be adequate to prove them all. Henkin broadened the notion of higher-order model [Hen50] in a natural way, which will be described shortly. With this broader notion there are more models, hence fewer valid formulas, since there are more candidates for counter-models. Henkin called his extension of the semantics general models-! will call them Henkin models.

Henkin's idea seems straightforward, after years of getting used to it. Given a domain V, a universal quantifier whose variable is of type 0, (Vx), ranges over the members of V. If we have a universal quantifier, (VX), whose variable is of type (0), it ranges over the collection of properties of V, or equivalently, over the subsets of V. The problem of just what subsets an infinite set has is actually a deep one. The independence of Cantor's continuum hypothesis is one manifestation of this problem. Methods for establishing consistency and independence results in set theory can be used to produce models with considerable variation in the powerset of an infinite set. Henkin essentially said that, instead of trying to work with all subsets of V, we should work with enough of them, that is, we should take (V X) as ranging over some collection of subsets of V, not necessarily all of them, but containing enough to satisfy natural closure properties. Think of the collection as being intermediate between all subsets and all definable subsets.

In a higher-order model as defined earlier, there is a domain, V, and this determines the range of quantification for each type. Specifically,

we thought of a quantifier (Vo:t) as ranging over the members of [t, V]. This time around a function is introduced, which I call a Henkin domain function and denote by 'It, explicitly giving us the range for each quantifier type. Then Henkin frames are defined. This basic machinery is needed before it can be specified what it means to have enough sets available at each type.

DEFINITION 2.10 (HENKIN DOMAIN FUNCTION) 1t is a Henkin domain function if 1t is a function whose domain is the collection of types and, for each type (t1, ... , tn), 'It( (t1, ... ,tn)) is some non-empty collection of subsets of'Jt(ti) x · · · x 1t(tn)·

Sets of the form 1t(t) are called Henkin domains. The key point is allowing some of the subsets of 1t(t1) x · · · x 7t(tn)-the definition of [t, V] had the word all at the corresponding point. Obviously the function 1t(t) = [t, V] is a Henkin domain function. In fact, if 1t is any Henkin domain function, and 7t(O) = V, then for every type t, 1t(t) ~ [t, V], with equality holding at t = 0.

DEFINITION 2.11 (HENKIN FRAME) The structure M = (7t,I) is a Henkin frame for a language L( C) if it meets the following conditions.

1 1t is a Henkin domain function.

2 If A is a constant symbol of L(C) of type t, I(A) E 7t(t).

3 I(=(t,t}) is the equality relation on 1t(t) for each type t.

The notion of valuation must be suitably restricted, of course.

DEFINITION 2.12 (VALUATION) V is a valuation in a Henkin frame M = (7t,I) if v maps each variable of type t to some member of 1t(t).

Now, what will make a Henkin frame into a Henkin model? Let's try a first attempt at a characterization. (This is not the "official" one, however. That will come later.) Definition 2.5, for the meaning of a term, carries over almost word for word to a Henkin frame M. Also Definition 2.6, for truth in a model, carries over to M, with one restrictive change. Item 4, the universal quantifier condition, gets replaced with the following.

4'. Let M = ('It, I) be a Henkin frame and let o:t be a variable of type t. M lf-v (Vo:t) if M lf-v [o:t ;ot] for every ot E 1t(t), or equivalently, if M lf-v' <P for every at-variant v' of v such that v'(o:t) E 7t(t).

The revised version of item 4 above says that quantifiers of type t range over just 1t(t) and not over all objects of type t.

But there is a fundamental problem. Let M = (1t, I) be a Henkin frame, and suppose (.Xa1, ... , an.~) is a predicate abstract-to keep things simple for now, assume ~ itself contains no abstracts. Then for any valuation v, the characterization above determines whether or not M 11-v ~. Now, according to Definition 2.5, the meaning (v * I)((.Xa1, ... ,an.~)), to be assigned to the abstract, is {(01, ... ,On) I M 11-v ~[ai/01, ... , an/On]}. The trouble is, we have no guarantee that this set will be a member of the appropriate Henkin domain. If it is not a member, quantifiers cannot include it in their ranges. If this happens, we lose the validity of formulas like (Va) \]! (a) :::> \]! ( ( .Xa1, .. . , an.~)). The whole business becomes somewhat problematic since formulas like this clearly ought to be valid.

What must be done is impose enough closure conditions on the Henkin domains of a Henkin frame to ensure that predicate abstracts always designate objects that are present in the Henkin domains. There are several ways this can be done. Algebraic closure conditions can be formulated directly, though this takes some effort. I follow a different route that is somewhat easier. Essentially, I first allow predicate abstracts to designate members of Henkin domains in some arbitrary way, then. I add the requirement that they be the "right" members.

DEFINITION 2.13 (ABSTRACTION DESIGNATION FUNCTION) A is an abstraction designation function in the Henkin frame M = (1t, I) with respect to the language L (C) if, for each valuation v in M, and each type t predicate abstract (.Xa1, ... , an. <I?) of L(C), A(v, (.Xa1, ... , an.<P)) is some member of1t(t).

Think of an abstraction designation function as providing a "meaning" for each predicate abstract. For the time being, such meanings can be quite arbitrary, except that they must be members of appropriate Henkin domains. Now earlier definitions get modified in straightforward ways (and these are the "official" versions). Definition 2.5 becomes the following.

DEFINITION 2.14 (DENOTATION OF A TERM IN A HENKIN FRAME)

Let M = (1t,I) be a Henkin frame, let v be a valuation, and let A be an abstraction designation function. A mapping, (v *I* A), is defined assigning to each term of L( C) a denotation for that term.

1 If A is a constant symbol of L(C) then (v *I* A)(A) = I(A).

2 If a is a variable then (v *I* A)(a) = v(a).

3 If (.Xa1, ... , an.~) is a predicate abstract of L(C), then (v*I*A)((.Xa1, ... ,an.~)) =A(v,(.Xa1, ... ,an.~)).

And Definition 2.6 becomes the following.

DEFINITION 2.15 (TRUTH OF A FORMULA IN A HENKIN FRAME)

Let M = (H,I) be a Henkin frame, let v be a valuation, and A be an abstraction designation function. A formula <1> of L( C) is true in model M with respect to v and A, denoted M If-v,A <1>, if the following holds.

1 For terms T, T!, ... ,Tn, M lf-v,A T(TI, ... ,Tn) provided ((v *I* A)(TI), ... , (v *I* A)(Tn)) E (v *I* A)(T).

2 M lf-v,A --,q> if it is not the case that M lf-v,A <1>.

3M lf-v,A <1> 1\ \]i if M lf-v,A <1> and M lf-v,A W.

4 M lf-v,A ('v'at)<P if M lf-v,A <P[at /0] for every 0 E 1t(t).

Now we can impose a requirement that designations of predicate abstracts be "correct."

DEFINITION 2.16 (PROPER ABSTRACTION DESIGNATION FUNCTION)

Let M = (1t, I) be a Henkin frame and let A be an abstraction designation function in it, with respect to L( C). A is proper provided the following is the case. For each predicate abstract (Aal, ... , an.<P) (with ai of type ti) and for each valuation v we have

(v *I* A)( (Aal, ... , an.<P)) = { (01, ... , On) E 1t(t1) X · · · X 1t(tn) J M if-v,A <P[ai/01, ... , an/On]}.

DEFINITION 2.17 (HENKIN MODEL) Let M be a Henkin frame, and let A be an abstraction designation function in M. If A is proper, (M, A) is a Henkin model.

For a given Henkin frame M it may be the case that no proper abstraction designation function exists. But, if one does exist it must be unique.

PROPOSITION 2.18 Let M = (1t,I) be a Henkin frame and let both A and A' be proper abstraction designation functions, with respect to L( C). Then A= A'.

Proof The following two items are shown simultaneously, by induction on degree (Definition 1.10). From this the Proposition follows immediately.

M lf-v,A <1> ¢} M lf-v,A' <1>

(v*I*A)(T) = (v*I*A')(T)

(2.3) (2.4)

Suppose (2.3) and (2.4) are known for formulas and terms whose degree is < k. It will be shown they hold for degree k too, beginning with (2.4).

Suppose T is a term of degree k. Since k could be 0, T could be a constant symbol or a variable. If it is a constant symbol, ( v *I* A) ( T) = I( T) = ( v *I * A') ( T). Similarly if T is a variable. Finally, T could be a predicate abstract, (>.a1, ... , an.), in which case must be a formula of degree < k, so using the induction hypothesis with (2.3) we have

(v *I* A)( (>.a~, ... , an.)) = { (01, ... , On) I M 11-v,A [ai/01, ... , an/On]}=

{ (0~, ... , On) I M 11-v,A' [ai/01, ... , an/On]}=

(v*I*A')((>.a1,··· ,an.))

Thus (2.4) holds for terms of degree ~ k. Now assume is a formula of degree k. There are several cases,

depending on the form of . If is atomic, it is T( T1, ... , Tn) where T, T1, ... , Tn are all of degree ~

k. Since (2.4) holds for terms of degree< k by assumption, and for terms of degree = k by the proof above,

M 11-v,A T(T1, ... , Tn) {:} ((v *I* A)(T1), ... , (v *I* A)(Tn)) E (v *I* A)(T) {:}

((v*I*A')(T1), ... ,(v*I*A')(Tn)) E (v*I*A')(T) {:} M 11-v,A' T(T1, ... , Tn)

If is a negation, conjunction, or universally quantified formula, the result follows easily using the fact that (2.3) holds for its subformulas (which are of lower degree), by the induction hypothesis.

We thus have (2.3) for formulas of degree k, and this concludes the induction. •

Note on Induction Proofs The pattern of the induction proof above will recur many times, with little variation of structure. We go from terms and formulas of degrees < k to terms of degrees ~ k, and then to formulas of degrees ~ k.

The Proposition above allows us to give the following extension of Definition 2.17.

DEFINITION 2.19 (HENKIN MODEL) If (M,A) is a Henkin model, the proper abstraction designation function A is uniquely determined, so we

will say the Henkin frame M itself is a Henkin model, and write M lf-v <P forM lf-v,A <P.

Suppose (V, I) is some classical model, as defined in Section 1. Set H(t) = [t, V] for all types t. This gives us a Henkin domain function. And it is easy to see that (H, I) will be a Henkin model. In fact, a sentence <P is true in (H, I), as defined in this section, exactly when it is true in the classical model (V, I), as defined in Section 2. This says that "true" higher-order models are among the Henkin models. The real question is, are there any other Henkin models? The answer is, yes. The proof of the completeness theorem for tableaus will yield this as a byproduct.

DEFINITION 2.20 (STANDARD MODEL) A Henkin model M is a standard model if1i(t) = [t, V] for all types t.

(H,I)

Since standard models are among the Henkin models, any formula that is true in all Henkin models must be true in all standard models as well. But there is the possibility (a fact, as it happens) that there are formulas true in all standard models that are not true in all Henkin models. That is, the set of Henkin-valid formulas (Definition 2.29) is a subset of the set of valid formulas (Definition 2.8), and in fact turns out to be a proper subset. By decreasing the set of validities, it opens up the possibility (again a fact, as it happens) that there may be a complete proof procedure with respect to this more restricted version of validity.

5. Generalized Henkin Models Unlike standard higher-order models, Henkin models are allowed to

have some, but not necessarily all, of the relations permissible in principle at each type. This means there are more possibilities for Henkin models than for standard models. Even so, the objects in the domains of Henkin models are sets, and this imposes a restriction that we may want to avoid in certain circumstances. Sets are extensional objects-that is, a set is completely determined by its membership. Using the language of properties rather than sets, two extensional properties that apply to exactly the same things must be identical, and hence must have the same properties applying to them. Working with sets is sufficient for mathematics, but it is not always the right choice in every situation. Even if the terms "human being" and "featherless biped" happen to have the same extension, we might not wish to identify them. As another example, the properties of being the morning star and being the evening star have the same extension, but were thought of as distinct properties by the ancient Babylonians.


Henkin himself [Hen50] noted the possibility of a more general notion than what I am calling a Henkin model, "The axioms of extensionality can be dropped if we are willing to admit models whose domains contain functions which are regarded as d!stinct even though they have the same value for every argument." Even so, extensionality has commonly been built into the treatment of Henkin models in the literature-[And72] is one of the rare instances where a model without extensionality is constructed. As it happens, we will have need for a non-extensional version in carrying out the completeness proof for tableaus. Since such models are also of intrinsic interest, they are presented in some detail in this section.

For Henkin frames, simply specifying the members of the Henkin domains tells us much. Since they are sets, there is a notion of membership, and it can be used in the definition of truth for atomic formulas. That is, sets come with their extensions fully determined. If we move away from sets this machinery becomes unavailable, and we must fill the gap with something else-I make use of an explicit extension function, denoted E. That is, for an arbitrary object 0, E(O) gives us the extension of 0. I also allow the possibility that equality may not behave as expected-! allow for non-normal frames and models.

DEFINITION 2.21 (GENERALIZED HENKIN FRAME) M = (1-l,I,E) is called a generalized Henkin frame for a language L( C) if it meets the following conditions.

1 1t is a function whose domain is the collection of types.

2 For each type t, 1-l(t) is some non-empty collection of objects (not necessarily sets).

3 If A is a constant symbol of L(C) of type t, I(A) E 1-l(t).

4 For each type t = (h, ... , tn), E maps 1-l(t) to subsets of 1-l(tl) x ···X1t(tn)·

In addition, M is normal ifE(I(=(t,t))) is the equality relation on 1-l(t) for each type t.

Much of this definition is similar to that of Henkin frame. The members of 1-l(t) are the objects of type t (which now need not be sets). The new item is the mapping E. Think of E(O) as the extension of the object 0.

Generalized Henkin models are built out of generalized Henkin frames. Much of the machinery is almost identical with that for Henkin models,

but there are curious twists, so things are presented in detail, rather than just referring to earlier definitions. The definition of valuation is the same as before.

DEFINITION 2.22 (VALUATION) The function vis a valuation in a generalized Henkin frame M = ('H, I,£) if v maps each variable of type t to some member of1i(t).

Next, just as with Henkin models, a function is needed that provides designations for predicate abstracts, then later we can require that it give us the "right" values. The wording is the same as before.

DEFINITION 2.23 (ABSTRACTION DESIGNATION FUNCTION) A is an abstraction designation function in the generalized Henkin frame M = ('H, I,£), with respect to the language L( C) provided, for each valuation v in M, and for each predicate abstract (Aal, ... , an.<l?) of L(C) of type t, A(v, (Aal, ... ,an.)) is some member of1i(t).

Term denotation is like before-terms designate objects in the Henkin domains.

DEFINITION 2.24 (DENOTATION OF A TERM) Let M = ('H,I,£) be a generalized Henkin frame, let v be a valuation, and let A be an abstraction designation function. A mapping, (v *I* A), is defined assigning to each term of L( C) a denotation for that term.

1 If A is a constant symbol of L(C) then (v *I* A)(A) =I( A).

2 If a is a variable then (v *I* A)(a) = v(a).

3 If (Aal, ... , an. ) is a predicate abstract of L( C), then (v*I*A)((Aal,··· ,an.)) =A(v,(Aal,··· ,an-)).

The following has a few changes from the earlier definition-to take the extension function into account the atomic case has been modified.

DEFINITION 2.25 (TRUTH OF A FORMULA) Again let M = ('H,I,£) be a generalized Henkin frame, let v be a valuation, and A be an abstraction designation function. A formula of L( C) is true in model M with respect to v and A, denoted M lf-v,A , provided the following.

1 For an atomic formula, M lf-v,A T(TI, ... , Tn) provided ((v *I* A)(TI), ... , (v *I* A)(Tn)) E E((v *I* A)(T)).

2 M lf-v,A ...,<f> if it is not the case that M lf-v,A .

3 M If-v,A 1\ \ll if M If-v,A and M If-v,A \ll.

4 M lf-v,A (Vat)<P if M lf-v,A <P[at /Ot] for every ot E 7-l(t).

In item 1 above, T(Tl, ... , Tn) is true if the designation of (TI, ... , Tn) is in the extension of the designation of T. For Henkin frames, we were dealing with sets, and extensions were for free. Now we are dealing with arbitrary objects, and we must explicitly invoke the extension function £.

I am about to impose a "correctness" requirement, analogous to Definition 2.16, but now there are three parts. The first part is similar to that for Henkin models, except that the extension function is invoked. The other parts need some comment. Suppose we have two predicate abstracts ( >.a1, . . . , an. <P) and ( >.a1, . . . , an.\]!). In a Henkin model, if <P and \]! are equivalent formulas, they will be true of the same objects and so the two predicate abstracts will designate the same thing, since they have the same extensions. But now we are explicitly allowing predicate abstracts having the same extension to denote different objects. Still, we don't want the designation of objects by predicate abstracts to be entirely arbitrary-! will require equi-designation under circumstances of "structural similarity."

DEFINITION 2.26 Let M be a generalized Henkin frame (or a Henkin frame), and let A be an abstraction designation function in it. For each valuation v and substitution a-, define a new valuation vu by:

Thus vu assigns to a variable a the "meaning" of the term aa-.

DEFINITION 2.27 (PROPER ABSTRACTION DESIGNATION FUNCTION)

Let M = (7-l, I,£) be a generalized Henkin frame and let A be an abstraction designation function in it, with respect to L( C). A is proper provided, for each predicate abstract (>.a1, ... , an.<P) we have

1 £((v*I*A)((>.ab··· ,an.<P))) = { (01, ... , On) I M lf-v,A <P[ai/01, ... , an/On]}

2 If v and w agree on the free variables of (>.a1, ... , an.<P) then

A(v,(>.al,··· ,an.<P)) =A(w,(>.al,··· ,an.<P))

3 If a- is a substitution that is free for the term (>.a1, ... , an. <P), then

A( v, (>.a1, ... , an.<P)a-) = A(vu, (>.a1, ... , an.<P))

The technical significance of items 2 and 3 above will be seen in the next section. When using Henkin frames, if a proper abstraction designation function exists, it is unique (Proposition 2.18). But with a

generalized Henkin frame, it is entirely possible for there to be more than one proper abstraction designation function. Since there is this possibility, we must specify which one to use--the frame alone does not determine it.

DEFINITION 2.28 (GENERALIZED HENKIN MODEL) Let M be a generalized Henkin frame, and let A be an abstraction designation function in M. If A is proper, (M, A) is a generalized Henkin model.

Finally Definition 2.8 is broadened to the entire class of generalized Henkin models.

DEFINITION 2.29 (VALIDITY, SATISFIABILITY, CONSEQUENCE) Let 

be a formula and S be a set of formulas of L( C).

1 is valid in generalized Henkin models if M lf-v,A for every generalized Henkin model (M,A) for L(C) and valuation v.

2 S is satisfiable in a generalized Henkin model (M, A) for L( C) if there is some valuation v such that M If-v,A is a generalized Henkin consequence of S provided, for every generalized Henkin model (M,A) for L(C) and every valuation v, if M lf-v,A .

Similar terminology is used when confining things to generalized Henkin models that are normal, or to Henkin models themselves.

We saw in Section 4 that the notion of Henkin model extended that of "true" higher-order model, since "true" models can be identified with standard Henkin models. In a similar way the notion of generalized Henkin model extends that of Henkin model, since Henkin models correspond to what will be called extensional generalized Henkin models (the definition is in the next section). Verifying this is postponed since it requires us to show that parts 2 and 3 of Definition 2.27 hold for Henkin models, and this involves some technical work. Assuming the result for the moment, it follows that there are generalized Henkin models because there are Henkin models; and we know there are Henkin models because there are standard models. The question is: have the various generalizations really generalized anything? In fact, they have. It is a consequence of the completeness proofs, which are given later, that there are Henkin models that are not standard, and there are generalized Henkin models that are not extensional Henkin models.

6. A Few Technical Results There are several results of a rather technical nature that, nonetheless,

are of fundamental importance. In fact, one of the propositions below allows us to show that Henkin models are (isomorphically) among the generalized Henkin models. Since we do not yet know this, we must treat Henkin models and generalized Henkin models separately for the time being.

6.1 Terms and Formulas I leave the proof of the following Proposition as an exercise-see the

proof of Proposition 4.15 as a guide. The proof for generalized Henkin models is similar to that for Henkin models except for the induction step involving terms that are predicate abstracts, where a reduction to a simpler case is not possible. But for generalized Henkin models, we are given what we need for this step as part of the definition. (See part 2 of Definition 2.27).

PROPOSITION 2.30 Let (M, A} be either a Henkin model or a gener-alized Henkin model, and let v and w be valuations.

1 If v and w agree on the free variables of the term T

(v*I*A)(T) = (w*I*A)(T).

2 If v and w agree on the free variables of the formula <P M lf--v,A <P {=::} M lf--w,A <P.

Next I state a result that will be used in the next Chapter to establish the soundness of the tableau system.

PROPOSITION 2.31 Let (M, A} be either a Henkin model or a gener-alized Henkin model. For any substitution a and valuation v:

1 If a is free for the term T then (v *I*A)(Ta) = (vu *I*A)(T).

2 If a is free for the formula <P then M lf--v,A <Pa {=::} M lf--v,.,A <P.

Once again I omit the proof, and refer you to Proposition 4.16 for a similar argument. (For generalized Henkin models, part 3 of Definition 2.27 is needed.)

6.2 Extensional Models Among Henkin models the standard ones correspond to "true" higher

order models. A similar phenomenon occurs here-among the generalized Henkin models certain ones correspond to Henkin models.


DEFINITION 2.32 (EXTENSIONAL) The generalized Henkin frame ('H, I,£) is extensional provided that £(0) = £(0') implies 0 = O' for all objects 0 and O'. A generalized Henkin model is extensional if its frame is.

Suppose M = ('H, I) is a Henkin frame (Definition 2.11). M can be converted into a generalized Henkin frame M' = ('H, I,£) by setting £( 0) = 0 for each object 0 of non-zero type. That is, we specify an extension function that gives us the usual set-theoretic notion of extension. It is easy to check that if (M, A) is a Henkin model then (M', A) is a generalized Henkin model-part 1 of Proposition 2.31 directly gives us part 3 of Definition 2.27, and likewise Proposition 2.30 gives us part 2. Obviously (M', A) is extensional. And equally obviously, evaluation of truth in the original Henkin model and in the generalized Henkin model just constructed is essentially the same.

Conversely, suppose M = ('H, I,£) is a generalized Henkin frame that is extensional. Inductively define a mapping () as follows. For objects 0 of type 0, B(O) = 0. And for an object 0 of type (tt, ... ,tn), set B(O) = { (B(Ot), ... , B(On)) I (Ot, ... , On) E £(0)}. Define a new domain function 'H' by setting 'H'(t) = {B(O) I 0 E 'H(t)}. Using the fact that M is extensional, it is not hard to show that () is 1-1 and onto between 'H(t) and 'H'(t), for each type t. Finally, for each term T,

set I'(T) = B(I(T)). This gives us a Henkin frame ('H',I'). Thus, in effect, each generalized Henkin frame that is extensional is isomorphic to a Henkin frame as defined earlier.

From now on I will treat Henkin models as being generalized Henkin models that are extensional, when it is convenient to do so.

6.3 Language Extensions Part of the definition of (generalized) Henkin model is that each pred

icate abstract must have an interpretation that is an object with the "right" extension. But what predicate abstracts there are depends on what the language is. Given a language L( C), one would expect models to depend on the collection of constants-members of C-which the interpretation function, I, deals with. One would not expect the choice of free variables of L(C) to matter, but this is not entirely clear, since predicatr: abstracts can involve free variables. It is important to know that the choice of free variables, in fact, does not matter, since the machinery of tableau proofs will require the addition of new free variables to the language.

In what follows, L( C) is the basic language, and L + (C) is like L( C), with new variables added, but with the understanding that these new

variables are never quantified or >.-bound. (This all takes on a significant role in the next chapter.) I note the fundamental problem: even with the restrictions imposed on the additional variables, the collection of predicate abstracts of L + (C) properly extends that of L( C).

PROPOSITION 2.33 Each generalized Henkin model with respect to L(C) can be converted into a generalized Henkin model with respect to L+(c) so that truth values for formulas of L( C) are preserved.

There are two immediate consequences of this Proposition that I want to state, before I sketch its proof. First, any set S of sentences of L( C) that is satisfiable in some generalized Henkin model with respect to L( C) is also satisfiable in some generalized Henkin model with respect to L+(C). And second, any sentence of L(C) that is valid in all generalized Henkin models with respect to L + (C) is also valid in all generalized Henkin models with respect to L( C) (because an L( C) countermodel can be converted into a L+(c) countermodel).

Proof The proof basically amounts to replacing the new variables of L + (C) by some from L( C), to determine behavior of predicate abstracts. I only sketch the general outlines. Let M = (H, I,£) be a generalized Henkin frame, and let (M, A) be a generalized Henkin model with respect to L(C).

Recall the notational convention: {/h / a1, . . . , f3n /an} is the substitution that replaces each f3i by the corresponding ai. Also, if v is a valuation, by v{fil/al, ... , fin/an} I mean the valuation v' such that v'(ai) = v(fii), and on other free variables, v' and v agree.

Now we extend A to an abstraction designation function, A', suitable for L+(C). For each predicate abstract (A"Yl, ... ,')'k.) of L+(C), and for each valuation v with respect to L+(C), do the following. Let (31, . . . , fin be all the free variables of that are in the language L + (C) but not in L( C), and let a1, ... , an be a list of variables of L( C) of the same corresponding types, that do not occur in , free or bound. Now, set

A' ( v, (>.1'1, ... , '/'k·)) = A(v{(Jl/al, ... ,fin/an}, (A')'l, ... ,')'k.{fil/al, ... ,fin/an}))

It can be shown that this is a proper definition, in the sense that it does not depend on the particular choice of free variables to replace the f3i·

Now it is possible to show that (M, A') is a generalized Henkin model with respect to L + (C), and truth values of sentences of L( C) evaluate the same with respect to A and A'. One must show a more general result, involving formulas with free variables. The details are messy, and I omit them. •


Finally, Proposition 2.33 has a kind of converse. Together they say the difference between L(C) and L+(C) doesn't matter semantically. I omit its proof altogether.

PROPOSITION 2.34 A generalized Henkin model with respect to L+(c) can be converted into a generalized Henkin model with respect to L( C) so that truth values for formulas of L( C) are preserved.

Exercises EXERCISE 6.1 Give a proof of Proposition 2.30.

EXERCISE 6.2 Give a proof of Proposition 2.31.

EXERCISE 6.3 Supply details for a proof that each generalized Henkin frame that is extensional is isomorphic to a Henkin frame.



Chapter 3

CLASSICAL LOGIC-BASIC TABLEAUS

Several varieties of proof procedures have been developed for firstorder classical logic. Among them the semantic tableau procedure has a considerable attraction, [Smu68, Fit96]. It is intuitive, close to the intended semantics, and is automatable. For higher-order classical logic, semantic tableaus are not as often seen-most treatments in the literature are axiomatic. Among the notable exceptions are [Tol75, Smi93, Koh95, GilOl]. In fact, semantic tableaus retain much of their first-order ability to charm, and they are what I present here. Automatability becomes more problematic, however, for reasons that will become clear as we proceed. Consequently the presentation should be thought of as meant for human use, and intelligence in the construction of proofs is expected.

This chapter examines what I call a basic tableau system; rules are lifted from those of first-order classical logic, and two straightforward rules for predicate abstracts are added. It is a higher-order version of the second-order system given in [Tol75]. I will show it corresponds to the generalized Henkin models from Section 5 of Chapter 2. In Chapters 5 and 6 I make additions to the system to expand its class of theorems and narrow its semantics to Henkin models.

1. A Different Language In creating tableau proofs I use a modified version of the language

defined in Chapter 2. That is, I give tableau proofs of sentences from the original language L( C), but the proofs themselves can involve formulas from a broader language that is called L + (C). Before presenting the tableau rules, I describe the way in which the language is extended for proof purposes.

33


Existential quantifiers are treated at higher orders exactly as they are in the first-order case. If we know an existentially quantified formula is true, a new symbol is introduced into the language for which we say, in effect, let that be something whose value makes the formula true. As usual, newness is critical. For this purpose it is convenient to enhance the collection of free variables by adding a second kind, called parameters.

DEFINITION 3.1 (PARAMETERS) In L(C), for each type t there is an infinite collection of free variables of that type. The language L + (C) differs from L( C) in that, for each t there is also a second infinite list of free variables of type t, called parameters, a list disjoint from that of the free variables of L( C) itself. Parameters may appear in formulas in the same way as the original list of free variables but they are never quantified or A bound. p, q, P, Q, ... are used to represent parameters.

Parameters appear in tableau proofs. They do not appear in the sentences being proved. Since they come from an alphabet distinct from the original free variables, an alphabet that is never quantified or A bound, we never need to worry about whether the introduction of a parameter will lead to its inadvertent capture by a quantifier or a Aintroducing them will always involve a free substitution. Thus rules that involve them can be relatively simple.

Special Terminology Technically, parameters are a special kind of free variable. But to keep terminology simple, I will continue to use the phrase free variable for the free variables of L( C) only, and when I want to include parameters in the discussion I will explicitly say so.

The notion of truth in generalized Henkin models must also be adjusted to take formulas of £+(c) into account. As I have just noted, parameters are special free variables, so when dealing semantically with L + (C), valuations must be defined for parameters as well as for the free variables of L( C). Essentially, the difference between a generalized Henkin frame and a generalized Henkin model lies in the requirement that the extension of a formula appearing in a predicate abstract must correspond to the designation of that abstract, which is a member of the appropriate Henkin domain. In L + (C) there are parameters, so there are more formulas and predicate abstracts than in L( C). Then requiring that something be a generalized Henkin model with respect to L + (C) is apparently a stronger condition than requiring it be one with respect to L( C), though Section 6 establishes that this is not actually so.

DEFINITION 3.2 (GROUNDED) A term or a formula of £+(C) is grounded if it contains no free variables of L( C), though it may contain parameters.

CLASSICAL LOGIC-BASIC TABLEAUS 35

The notion of grounded extends the notion of closed. Specifically, a grounded formula of L + (C) that happens to be a formula of L( C) is a closed formula of L( C), and similarly for terms.

2. Basic Tableaus I now present the basic tableau system. It does not contain machinery

for dealing with equality-that comes in Chapter 5. The rules come from [Tol75], where they were given for second-order logic. These rules, in turn, trace back to the sequent-style higher-order rules of [Pra68] and [Tak67].

All tableau proofs are proofs of sentences-closed formulas-of L( C). A tableau proof of q> is a tree that has --,q> at its root, grounded formulas of L + (C) at all nodes, is constructed following certain branch extension rules to be given below, and is closed, which means it embodies a contradiction. Such a tree intuitively says --,q> cannot happen, and so q> is valid.

The branch extension rules for propositional connectives are quite straightforward and well-known. Here they are, including rules for various defined connectives.

DEFINITION 3.3 (CONJUNCTIVE RULES)

XI\Y X y

•(X V Y) -.x --,y

•(X =:J Y) X

--,y

For the conjunctive rules, if the formula above the line appears on a branch of a tableau, the items below the line may be added to the end of the branch. The rule for double negation is of the same nature, except that only a single added item is involved.

DEFINITION 3.4 (DOUBLE NEGATION RULE)

•• x X

Next come the disjunctive rules. For these, if the formula above the line appears on a tableau branch, the end node can have two children added, labeled respectively with the two items shown below the line in the rule. In this case one says there is tableau branching.

DEFINITION 3.5 (DISJUNCTIVE RULES)

XVY XIY

•(X A Y) ·Xi·Y

•(X = Y) ·(X ~ Y) I ·(Y ~ X)

This completes the propositional connective rules. The motivation should be intuitively obvious. For instance, if X A Y is true in a model, both X and Y are true there, and so a branch containing X A Y can be extended with X and Y. If X V Y is true in a model, one of them is true there. The corresponding tableau rule says if X V Y occurs on a branch, the branch splits using X and Y as the two cases. One or the other represents the "correct" situation.

Though the universal quantifier has been taken as basic, it is convenient, and just as easy, to have tableau rules for both universal and existential quantifiers directly. To state the rules simply, I use the following convention. Suppose ( li) is a formula in which the variable at, of type t, may have free occurrences. And suppose Tt is a term of type t. Then ( Tt) is the result of carrying out the substitution {at /Tt} in ( at), replacing all free occurrences of at with occurrences of Tt. Now, here are the existential quantifier rules.

DEFINITION 3.6 (EXISTENTIAL RULES) In the following, pt is a parameter of type t that is new to the tableau branch.

(:Jat)<P( at) <P(pt)

•(Vat)<P( at) ·(pt)

The rules above embody the familiar notion of existential instantiation. Since the convention is that parameters are never quantified or >.bound, we don't have to worry about accidental variable capture. More precisely, in the rules above, the substitution {at jpt} is free for the formula <P(at).

The universal rules are somewhat more straightforward. Once again, . note that in them the substitution {at /Tt} is free for the formula ( at).

DEFINITION 3.7 (UNIVERSAL RULES)

grounded term of type t of £+(C). In the following, Tt is any

(Vat) ( at) <l>(Tt)

•(3at)( at) •<l>( Tt)


Finally we have the rules for predicate abstracts. Earlier notation is extended a bit, so that if q,(a1, ... , an) is a formula, a1, ... , an are distinct free variables, and T1, ... , Tn are grounded terms of the same respective types as a1, ... , an, then q,(rl,··· ,Tn) is the result of simultaneously substituting each Ti for all free occurrences of ai in q,,

DEFINITION 3.8 (ABSTRACT RULES)

(Aal, ... , an.q,(a1, ... , ctn))(TI, ... , Tn)

q,(Tl, · · · , Tn)

•(Aa1, ... ,an.q,(a1, ... ,an))(r1, ... ,Tn)

--,q,(Tl, ... , Tn)

Now what, exactly, constitutes a proof.

DEFINITION 3.9 (CLOSURE) A tableau branch is closed if it contains q, and --,q,, where q, is a grounded formula. A tableau is closed if each branch is closed.

DEFINITION 3.10 (TABLEAU PROOF) For a sentence q, of L(C), a closed tableau beginning with ,q, is a proof of q,.

DEFINITION 3.11 (TABLEAU DERIVATION) A tableau derivation of a sentence q, from a set of sentences S, all of L( C), is a closed tableau beginning with --,q,, allowing the additional rule: at any point any member of S can be added to the end of any open branch.

This concludes the presentation of the tableau rules. In the next section I give several examples of tableaus. Classical first-order tableau rules, as in [Smu68, Fit96] are analytic~they only involve subformulas of the formula being proved. (It is not the case with the cut rule, but this is an eliminable rule.) Higher-order rules, for the most part, have an analytic nature as well. The important exception is the rule for the universal quantifier. It allows us to pass from (Vat)q,(at) to q,(rt) where Tt is an arbitrary grounded term. Since terms can involve predicate abstracts, applications of this rule can introduce formulas that are not subformulas of the one being proved~indeed, they may be much more complicated. There is no way around this. In a sense, the introduction of predicate abstracts embodies the "creative element" of mathematics.

3. Tableau Examples Tableaus for first-order classical logic are well-known, but the ab

straction rules of the previous section are not as widely familiar. I give


a number of examples illustrating their uses. The first embodies the principle behind many diagonal arguments in mathematics.

EXAMPLE 3.12 Suppose there is a way of matching subsets of some set V with members of V. Let us call a member of V associated with a particular subset a code for that subset. It is required that every member of V must be a code, and nothing can be a code for more than one subset, though it is allowed that some subsets can have more than one code. Then, some subset of V must lack a code. (One consequence of this is Cantor's Theorem: a set and its power set cannot be in a 1-1 correspondence.)

To formulate this, let R(x, y) represent the relation: y is in the subset that has x as its code; so (>.y.R(x,y)) represents the set coded by x. Then the following second-order sentence does the job.

('v'R)(3X)('v'x)•[(>.y.R(x, y)) =X] (3.1)

This formulation contains equality. I have not given rules for equality yet, so I give an alternative formulation that does not involve it.

('v'R)(3X)('v'x)(3y){[R(x, y) 1\ •X(y)] V [•R(x, y) 1\ X(y)]} (3.2)

I give a proof of (3.2). It is contained in Figure 3.1. In it, 2 is from 1 by an existential rule ( P is a new parameter); 3 is from 2 by a universal rule ((>.x.•P(x,x)) is a grounded term); 4 is from 3 by an existential rule (p is another new parameter); 5 is from 4 by a universal rule (p is a grounded term); 6 and 7 are from 5 by a conjunction rule; 8 and 9 are from 6 by a disjunction rule; 10 is from 9 by double negation; 11 and 12 are from 7 by a disjunction rule, as are 13 and 14; 15 is from 12 by an abstract rule, as is 16 from 10. Closure is by 8 and 11, 8 and 15, 13 and 16, and 10 and 14.

A key feature in the tableau proof of (3.2) is the use of (>.x. •P(x, x)) in an application of a universal rule. This, in fact, is the heart of diagonal arguments and amounts to looking at the collection of things that do not belong to the set they code. The choice of such abstracts at key points of proofs is the distilled essence of mathematical thinking-everything else is mechanical. It is the need for such choices that stands in the way of fully automating higher-order proof search.

Next is an example that comes out of propositional modal logic. Some knowledge of Kripke semantics will be needed in order to understand the background explanation, though not the tableau proof. See [HC96, pp 188-190] for a fuller treatment.

O'l M

~

~ os &S C,)

~

~ 0 ~

~

0 ~ ~

t3

-.(\IR)(:JX)(\Ix)(:Jy){[R(x, y) 1\ -.X(y)] V [-.R(x, y) 1\ X(y)]} 1. -.(:JX)(\Ix)(:Jy){[P(x, y) 1\ -.X(y)] V [-,P(x, y) 1\ X(y)]} 2. -.(\lx)(:Jy){[P(x, y) 1\ -.(>.x.-.P(x, x)}(y)] V [-.P(x, y) 1\ (>.x.-.P(x, x))(y)]} 3. -.(:Jy){[P(p, y) 1\ -.(>.x.-.P(x, x))(y)] V [-.P(p, y) 1\ (>.x.-.P(x, x))(y)]} 4. -.{[P(p,p) 1\ -.(>.x.-.P(x, x))(p)] V [-.P(p,p) 1\ (>.x.-.P(x, x))(p)]} 5. -.[P(p,p) 1\ -.(>.x.-.P(x,x))(p)] 6. ?,p) A {Ax.~P(x,~7

-.P(p,p) 8.

/ ~

-.-.(>.x.-.P(x, x))(p) 9. (>.x.-.P(x, x))(p) 10.

/ ~ -.-.P(p,p) 11. -.(>.x.-.P(x, x))(p) 12. -.-.P(p,p) 13. -.(>.x.-.P(x, x))(p) 14.

-.-.P(p,p) 15. -.P(p,p) 16.

Figure 3.1. Tableau Proof of (\fR)(3X)(\fx)(3y){[R(x, y) 1\ •X(y)] V [•R(x, y) 1\ X(y)]}


EXAMPLE 3.13 It is a well-known result of modal model theory that a relational frame is reflexive if and only if every instance of DP => P is valid in it. I want to give a formal version of this using the machinery of higher-order classical logic. Suppose we think of the type 0 domain of a higher-order classical model as being the set of possible worlds of a relational frame. Let us think of the atomic formula P(x) as telling us that P is true at world x, and R( x, y) as saying y is a world accessible from x. Then making use of the usual Kripke semantics, ('v'y)[R(x, y) => P(y)] corresponds to P being true at every world accessible from x, and hence to DP being true at world x, where R plays the role of the accessibility relation. Then further, saying DP => P is true at x corresponds to ('v'y)[R(x, y) => P(y)] => P(x). We want to say that if this happens at every world, and for all P, the relation R must be reflexive, and conversely. Specifically, I give a tableau proof of the following. In it, take R to be a constant symbol.

('v'x)R(x, x) = ('v'P)('v'x){('v'y)[R(x, y) => P(y)] => P(x)} (3.3)

Actually, the implication from left to right is straightforward-! supply a tableau proof from right to left.

--,{('v'P)('v'x){('v'y)[R(x, y) => P(y)] => P(x)} => ('v'x)R(x, x)} 1. ('v'P)('v'x){(Vy)[R(x,y) => P(y)] => P(x)} 2.

--,(\fx)R(x, x) 3. --,R(p, p) 4.

('v'x){('v'y)[R(x, y) => (Az.R(p, z))(y)] => (Az.R(p, z))(x)} 5. (\ly)[7 (Az.R(p,z))(y)] ::> (~)(p) 6.

--,(\fy)[R(p, y) => (Az.R(p, z))(y)] --,[R(p, q) => (Az.R(p, z))(q) 9.

R(p, q) 10. --,(Az.R(p, z))(q) 11. --,R(p, q) 12.

7. (Az.R(p, z))(p) 8. R(p,p) 13.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an existential rule (p is a new parameter); 5 is from 2 by a universal rule ( (Az.R(p, z)) is a grounded term); 6 is from 5 by a universal rule (p is a grounded term); 7 and 8 are from 6 by a disjunctive rule; 9 is from 7 by an existential rule ( q is a new parameter); 10 and 11 are from 9 by a conjunction rule; 12 is from 11 and 13 is from 8 by abstract rules.

The last example is a version of the famous Knaster-Tarski theorem [Tar55].

EXAMPLE 3.14 Let 1) be a set and let F be a function from its powerset to itself. F is called monotone provided, for each P, Q ~ 1), if P ~ Q then F(P) ~ F(Q). Theorem: any monotone function F on the powerset of 1) has a fixed point, that is, there is a set C such that F(C) =C. (Actually the Knaster-Tarski theorem says much more, but this will do for present purposes.)

I now give a formalization of this theorem. Since function symbols are not available, I restate it using relation symbols, and it is not even necessary to require functionality for them. Now, (Vx)(P(x) :J Q(x)) will serve to formalize P ~ Q. If F(P, x) is used to formalize that x is in the set F(P), then (Vx)(P(x) :J Q(x)) :J (Vx)(F(P,x) :J F(Q,x)) says we have monotonicity. Then, the following embodies a version of the Knaster-Tarski theorem (F is a constant symbol).

(VP)(VQ)[(Vx)(P(x) :J Q(x)) :J

(Vx)(F(P, x) :J F(Q, x))] :J (3S)('v'x)(F(S, x) = S(x)) (3.4)

I leave the construction of a tableau proof of this to you as an exercise, but I give the following hint. Let <P(P, x) abbreviate the formula (Vy)(F(P,y) :J P(y)) :J P(x). An appropriate term to consider during a universal rule application is: (>..x.(VP)<P(P, x)).

A comment on the hint above. Rewriting ('v'y) ( F( P, y) :J P(y)) using conventional function notation: it says F(P) ~ P. Then <P(P, x) says that x belongs to a set P if P meets the condition F(P) ~ P. Then further, (VP)<P(P, x) says that x is in n{P I F(P) ~ P}. So finally, (>..x.(VP)<P(P, x)) represents the set n{P I F(P) ~ P} itself. In the most common proof of the Knaster-Tarski theorem, one proceeds by showing this set, in fact, is a fixed point of F.

Example 3.14 once again illustrates a fundamental point about higherorder tableaus. They mechanize routine steps, but do not substitute for mathematical insight. The choice of which predicate abstract to use during an application of a universal rule really contains, in distilled form, the essence of a standard mathematical argument.

The problem of what choice to make when instantiating a universal quantifier also arises in first-order logic, but there is a way around it--one uses free variables when instantiating, then one determines later which values to choose for them [Fit96]. This last step, picking values, involves unification, the solving of equations involving first-order terms. There are several unification algorithms to do this, all of which accomplish


the following: given two terms, if there is a choice of values for their free variables that makes the terms identical, the algorithm finds the most general such choice; and if the terms cannot be made identical, the algorithm reports this fact. Unification is at the heart of every first-order theorem prover.

If we attempt a similar strategy in automating higher-order logic, we immediately run into an obstacle at this point. The problem of unification for higher-order terms is undecidable! This was shown for thirdorder terms in [Hue73], and improved to show unification for secondorder terms is already undecidable, in [Gol81]. This does not mean the situation is completely hopeless. While first-order unification is decidable, and second-order is not, still there is a kind of semi-decision procedure, [Hue75]. Two free-variable tableau systems for higher-order classical logic, using unification, are presented in [Koh95]. The use of higher-order unification in this way traces back to resolution work of [And71] and [Hue72]. But finally, technical issues aside, we always come back to the observation made above: the choice of predicate abstract to use in instantiating a universally quantified formula often embodies the mathematical "essence" of a proof. Too much should not be expected from the purely mechanical.

Exercises EXERCISE 3.1 Extending the ideas of Example 3.13, give tableau proofs of the following.

1 (symmetry)

('v'x)('v'y)[R(x,y) :J R(y,x)] = ('v'P)('v'x){(3y)[R(x, y) 1\ ('v'z)(R(y, z) :J P(z))] :J P(x)}

2 (transitivity)

('v'x)('v'y)('v'z)[(R(x, y) 1\ R(y, z)) :J R(x, z)] = ('v'P)('v'x){('v'y)[R(x,y) :J P(y)] :J

('v'y)('v'z)[(R(x, y) 1\ R(y, z)) :J P(z)]}

EXERCISE 3.2 Give the tableau proof to complete Example 3.14.

EXERCISE 3.3 ContinuingwithExample3.14, the set n{P I F(P) ~ P} is not only a fixed point of monotonic F, it is the smallest one. Dually, U{P I P ~ F(P)} is also a fixed point, the largest one. Give a tableau proof of (3.4) based on this idea.



Chapter 4

SOUNDNESS AND COMPLETENESS

This chapter contains a proof that the basic tableau rules are sound and complete with respect to generalized Henkin models. Soundness is by the "usual" argument, is straightforward, and is what I begin with. Completeness is something else altogether. For that I use the ideas developed simultaneously in [Tak67, Pra68], where they were applied to give a non-constructive proof of a cut elimination theorem.

1. Soundness Soundness means that any sentence having a tableau proof must be

valid. Tableau soundness arguments follow the same pattern for all logics: some notion of satisfiability is defined for tableaus; then satisfiability is shown to be preserved by each tableau rule application. Note that in the following, L + (C) is used rather than L( C), because formulas of the larger language L + (C) can occur in tableaus.

DEFINITION 4.1 (TABLEAU 8ATISFIABILITY) A tableau branch is satisfiable if the set of formulas on it is satisfiable in a generalized Henkin model for L+(C) (see Definition 2.29). A tableau is satisfiable if some branch is satisfiable.

Now, two key facts about these notions easily give us soundness. For the first, a closed tableau branch contains some formula and its negation, hence cannot be satisfiable. Since a closed tableau has every branch closed, we immediately have the following.

LEMMA 4.2 A closed tableau cannot be satisfiable.

The second key fact takes more work to prove, but the work is spread over several cases, each of which is rather simple.

43

LEMMA 4.3 If a branch extension rule is applied to a satisfiable tableau, the result is another satisfiable tableau.

Proof Suppose T is a satisfiable tableau. Then it has some satisfiable branch, say 13. Also suppose some branch extension rule is applied toT to produce a new tableau, T'. It must be shown that T' is satisfiable.

The rule that was applied to turn T into T' may have been applied on a branch other than 13. In this case 13 is still a branch of T', and of course is still satisfiable, so T' is satisfiable. Now, for the rest of the proof assume a branch extension rule has been applied to the satisfiable branch B itself. And to be specific, say all the grounded formulas on 13 are true in the generalized Henkin model (M, A) with respect to the valuation v, where M = (1t,I, E).

There are several cases, depending on which branch extension rule was applied. I consider only a few of these cases and leave the rest to you.

Disjunction Suppose the grounded formula X V Y occurred on 13 and a rule was applied to it. Then in T' the branch 13 has been replaced with two branches: 13 lengthened with X, and 13 lengthened with Y. All formulas on 13 are true in (M, A) with respect to valuation v, hence M lf--v,A XV Y. Then either M lf--v,A X or M lf--v,A Y. In the first case, all members of 13 lengthened with X, and in the second case, all members of B lengthened with Y, are true in (M, A) with respect to v. Either way, some branch ofT' is satisfiable.

Existential Quantifier Suppose the grounded formula (3a)<P(a) occurred on Band a rule was applied to it, so that in T' branch B has been lengthened with <P(p) where p is a parameter new to B, of the same type as a.

Since all formulas on Bare true in (M, A) with respect to v, M lf--v,A (3a)<P(a). Then, by definition of truth in a model, there must be some a-variant w of v such that M lf--w,A <P(a). Let a = {p/a}the substitution that replaces p by a-and consider the valuation wa (Definition 2.26). I claim all formulas on 13 extended with <P(p) are true in (M, A) with respect to wa, so the extended branch is satisfiable.

First of all, v and w agree on all variables except a. It is easy to see that w and wa agree on all variables except p, so the only variables on which v and wa can differ are a and p. But a does not occur free in any formula on B, since these formulas are all grounded. And p does not occur either, since p was new to the branch. Conse-

SOUNDNESS AND COMPLETENESS 45

quently all formulas on B are true in (M, A) with respect to wa, by Proposition 2.30.

Finally, note that since p did not occur in (:lo:)<P(o:), then <P(o:) = <P(p)a. We have M if-w,A <P(o:), and by Proposition 2.31

M if-w,A <P(o:) {:} M if-w,A <P(p)a {:} M if-wu,A <P(p).

This completes the argument for the existential case.

Abstraction Suppose the grounded formula

occurred on B, and a rule was applied to it, so that in T' branch B has been lengthened with <P(Tt, ... , Tn)· We are assuming that the formulas on B are all true in (M, A) with respect to valuation v. I will show that this extends to include <P(Tt, ... ,Tn) as well.

Let a = { o:l/Tt, ... , o:n/ Tn}. This is free for <P( 0:1, ... , o:n) because Tt, . . . , T n must be grounded, and parameters are never quantified or >.-bound. Now consider the valuation va. Note the following useful items.

1 va(o:i) = (v*I*A)(o:ia) = (v*I*A)(Ti)

2 If {3 is different from 0:1, ... , O:n, va ({3) = ( v * I * A) ({3a) = (v*I*A)(f3) =v({3).

For this to be the case

((v *I* A)(Tt), ... , (v *I* A)(Tn)) E

E((v*I*A)((>.o:l,··· ,o:n.<P(o:l,··· ,o:n)))).

Since we have a generalized Henkin model, A is proper, so

E((v*I*A)((>.o:l,··· ,o:n.<P(o:l,··· ,o:n)))) = { (w(o:1), ... , w(o:n)) I w is an 0:1, ... , O:n-variant of v and M if-w,A <P(o:1, · · · , O:n)}

and consequently M if-w,A <P(o:1, ... , O:n) where w is the 0:1, ... , an-variant of v such that w(o:t) = (v *I* A)(Tt), ... , w(o:n) =

(v *I* A)(Tn)· But, by items 1 and 2 above, vu itself is this a1, ... , an-variant of v. We thus have

Now, by Proposition 2.31,

that is,

There are other cases-! leave them to you. •

THEOREM 4.4 (SOUNDNESS) If a sentence <P of L(C) has a tableau proof, <P must be true in all generalized Henkin models with respect to L(C).

Proof Suppose <P has a tableau proof, but is not true in every generalized Henkin model with respect to L( C)-I derive a contradiction. Since <P is not true in every generalized Henkin model with respect to L( C), { -.<P} is satisfiable, and by Proposition 2.33, is so in a generalized Henkin model with respect to L + (C). A tableau proof of <P begins with a tableau consisting of a single branch, containing the single formula --.<P, so this must be a satisfiable tableau. As we apply branch extension rules, we continue to get satisfiable tableaus, by Lemma 4.3. Since <P is provable, we can get a closed tableau. Hence there must be a closed, satisfiable tableau, which is impossible according to Lemma 4.2. •

Essentially the same argument also establishes the following.

THEOREM 4.5 Let S be a set of sentences and <P be a single sentence of L(C). If <P has a tableau derivation from S, then <P is a generalized Henkin consequence of S.

2. Completeness The proof of completeness, for basic tableaus, with respect to gen

eralized Henkin models, is of considerable intricacy. It is spread over several subsections, each devoted to a single aspect of it. All the basic ideas go back to [Tak67, Pra68], where they were used to establish non-constructively a cut-elimination theorem for higher-order Gentzen systems. I also use aspects of the (second-order) presentation of [Tol75], in particular the central goal, for us, is to prove that something called

a Hintikka set is satisfiable. This contains the essence of the proofs of [Tak67, Pra68]. [And71] abstracted the Takahashi, Prawitz ideas to prove a higher-order Model Existence Theorem which could simply have been cited, but the ideas of the completeness proof are pretty and deserve to be better known, hence the full presentation.

In outline, the completeness proof is as follows. In Section 2.1 the notion of a Hintikka set is defined: it is a set of grounded formulas of L + (C) meeting certain closure conditions bearing an obvious relationship to the tableau rules. In Section 2.2 pseudo-models are introduced. These are the closest we come, in higher-order logic, to the Herbrand models familiar in the first-order setting. Unfortunately, they will not look like proper models in the higher-order sense, because objects assigned as meanings for predicate abstracts might lie outside the range allowed for quantifiers. In Section 2.3 some rather technical (but important) results about the behavior of substitution in pseudo-models are shown. In Section 2.4 it is established that each Hintikka set is satisfiable in some pseudo-model. Section 2.5 shows that pseudo-models, in fact, are proper generalized Henkin models after all, and so each Hintikka set is satisfiable in such a model. Finally in Section 2.6 it is shown how to extract a Hintikka set from a failed tableau proof attempt, and this puts the last step in place for the completeness proof.

2.1 Hintikka Sets Hintikka sets are fairly familiar from propositional and first-order

logics-see [Fit96] and [Smu68] for instance. They play a similar role in the higher-order case, though arguments about them are much more complex. You should note that the basic tableau rules all correspond directly to Hintikka set conditions (I omit the connective = as a small convenience).

DEFINITION 4.6 (HINTIKKA SET) A non-empty setH of grounded formulas of L + (C) is a Hintikka set if it meets the following conditions.

1 Atomic Case. If is atomic, not both E H and • E H.

2 Conjunctive Cases.

(a) If ( 1\ w) E H then E H and WE H.

{b) If •( V w) E H then • E H and •W E H.

{c) If •( :J w) E H then E H and •W E H.

3 Disjunctive Cases.

{a) If (<P V w) E H then either <P E H or WE H.

(b) If --, ( <P 1\ \ll) E H then either --,<fl E H or --, \ll E H.

(c) If (<P :J \ll) E H then either --,q, E H or \ll E H.

4 Double Negation Case. If --,--,q, E H then <P E H.

5 Universal Cases.

(a) If (Vat)<P(ci) E H then <P(rt) E H for every grounded term Tt.

(b) If •(3at)<P(at) E H then •<P(rt) E H for every grounded term Tt.

6 Existential Cases.

(a) If (3at)<P( at) E H then <P(pt) E H for at least one parameter pt.

(b) If •(Vat)<P(at) E H then •<P(pt) E H for at least one parameter pt.

7 Abstraction Cases.

(a) If (>.a1, ... , Ctn.<P(a~, ... , an))(rl, ... , Tn) E H, then <P(r1, ... , Tn) E H.

(b) If•(>.al,··· ,an.<P(a1, ... ,an))(TI,··· ,Tn) E H, then --,<fl(TI, ... ,Tn) E H.

This completes the definition of Hintikka sets. The task of relating them to models begins in the next subsection.

2.2 Pseudo-Models The eventual goal is to construct a generalized Henkin model, starting

with a Hintikka set. To do this a pseudo-model is first created, something that is much like a generalized Henkin model but with one significant difference: predicate abstracts are allowed to take on values that may lie outside the range of the quantifiers! This will pose no problems for the definition of truth in a pseudo-model since, for example, r1(r2) can still be taken to be true if the value assigned to T2 is in the extension of the value assigned to TI, whether or not these values are in quantifier ranges. Eventually it will be shown that we can dispose of the "pseudo" qualification on a pseudo-model.

I begin by defining entities of each type. These are the things that can serve as values of predicate abstracts. In some ways the collection of entities is an analog of a Herbrand universe, familiar from treatments of first-order logic.


DEFINITION 4. 7 (ENTITIES OF TYPE t) The notion of entity of type t is defined inductively, on the complexity oft.

1 Suppose t = 0. If T is a grounded term of type t (thus a constant or parameter of type 0}, T is an entity of type t.

2 Suppose t = (t1, ... , tn) and the collection of entities of type ti has been defined for each i = 1, ... , n. Then (T, S) is an entity of type t provided T is a grounded term of type t, and S is a set whose members are of the form (E1, ... , En), where each Ei is an entity of type ti.

I also define two mappings on entities.

DEFINITION 4.8 (£, T) If the entity E is of a type other than 0, it is of the form (T, S); then T(E) = T and E(E) = S. I refer to E(E) as the extension of E. The definition of T (but not of E) is extended to entities of type 0 as well. If E is of type 0 it is, itself, a grounded term of L+(C); in this case T(E) =E.

The idea is, if (T, S) is an entity of type t, it is something that could serve as a semantic value for the term T, with the extension explicitly coded in.

One problem with entities is that Hintikka sets play no role-the collection of entities is the same no matter what Hintikka set we may have. Presumably, if we are trying to construct a model from a given Hintikka set, that should place some restrictions on what entities we want to consider. The next definition separates out those entities that will be in the range of quantifiers-it makes direct use of a Hintikka set. It is these entities that will make up the Henkin domains of a model.

DEFINITION 4.9 (POSSIBLE VALUE) Let H be a Hintikka set. For each grounded term T, define a collection of possible values ofT relative to H. This is done inductively, on type complexity.

1 If T is a grounded term of type 0, the only possible value ofT relative to H is T itself.

2 Suppose T is a grounded term of type (t1, ... , tn), and possible values relative to H have been specified for all grounded terms of types t1, ... , tn. Then, an entity (T, S) is a possible value ofT relative to H provided, for all grounded terms TI, ... , Tn of types t1, ... , tn respectively, and for all possible values E1, ... , En of TI, ... , Tn:

(a) If T(TI, ... , Tn) E H then (E1, ... , En) E S.

(b) If •T(TI, ... , Tn) E H then (E1, ... , En) ~ S.


E is a possible value if it is a possible value for some grounded term.

Roughly the idea is, any possible value for T should have in its extension all those things the Hintikka set H requires, and should omit all the things H forbids. Any entity that meets these conditions will serve as a possible value. Clearly each possible value of a grounded term of type t, relative to a Hintikka set H, is an entity of type t. Item 1 of the definition of Hintikka set ensures that part 2 above is meaningful.

Now that we have the notion of possible value, Henkin domains for our pseudo-models can be defined.

DEFINITION 4.10 (RELATIVE HENKIN DOMAINS) Let H be a Hintikka set. A mapping, 'HH is defined, from types to entities, as follows. For each type t, 'HH(t) is the set of all entities of type t that are possible values relative to H.

The languages L( C) and L + (C) are allowed to contain constant symbols. How to interpret these is rather arbitrary, within broad limits.

DEFINITION 4.11 (ALLOWED INTERPRETATION) Let H be a Hintikka set. A mapping I is an allowed interpretation relative to H provided I assigns to each constant symbol A of type t some possible value for A, relative to H.

We now have all the machinery needed to characterize an important class of generalized Henkin frames arising from Hintikka sets.

DEFINITION 4.12 (RELATIVE GENERALIZED HENKIN FRAME) Let H be a Hintikka set. M = ('HH, I,£) is a generalized Henkin frame relative to H provided:

1 'HH is the relative Henkin domain function of Definition 4.10;

2 I is an allowed interpretation relative to H, Definition 4.11;

3 £ is the extension function of Definition 4.8.

To produce our pseudo-models we need some notion of an abstraction designation function. To define this we first need a little more machinery.

DEFINITION 4.13 (-v) Let v be a valuation in some generalized Henkin frame relative to a Hintikka set H. Define a substitution -v as follows: a'V = T(v(a)).

Thus, ifv(o:) = (T,S) then o:-v = T. Ifv(o:) = C, of type 0, then o:-v = C. Note that -v substitutes grounded terms of L+(C) for variables, and

so if T is an arbitrary term, T+v" must be a grounded term. Similarly for formulas. Then, for any formula and any valuation v, +v" is something that could potentially be a member of a Hintikka set.

Now everything is in place to define the notion of pseudo-model. Here is a simultaneous recursive definition of truth, and of an abstraction designation function. I denote the abstraction designation function by AH, reflecting its dependence on the Hintikka set H, and ( v *I* AH) is defined from it, a valuation v, and an interpretation I in the customary way. I note that valuations have their standard meaning: they map variables to members of Henkin domains. They do not map to arbitrary entities.

DEFINITION 4.14 (PSEUDO-MODEL) Let H be a Hintikka set and let M = (1-lH,I,£) be a generalized Henkin frame relative to H. Truth of formulas, and an abstraction designation function, are characterized as follows.

1 For atomic formulas of L+(C), M lf--v,AH T(TI, ... , Tn)) if ((v*I*AH)(TI), ... ,(v*I*AH)(Tn)) E£((v*I*AH)(T)),

2 M lf--v,AH •X if M IYv,AH X.

3M lf--v,AH X 1\ Y if M lf--v,AH X and M lf--v,AH Y.

4 M lf--v,AH (Vo/) if M lf--v,AH [o:t ;at] for every ot E 1-lH(t).

5 Let T = (>.o:1, ... , O:n.) be a predicate abstract of type (t1, ... , tn). SetAH(v,(>.o:l,··· ,o:n.)) = (T+v",S) where

S = { (01, ... , On) E 1iH(ti) X · · • X 1iH(tn) I M lf--v,AH [o:I/01, · · · , O:n/On]}.

The structure (M, AH) is a pseudo-model, relative to the Hintikka set H.

The definition above has the usual complex recursive structure, with truth at the atomic level needing ( v * I * AH) and hence AH, and the characterization of AH itself needing the notion of truth for formulas. Of course what makes it work is the fact that, in every case, behavior of some construct on a formula or term requires constructs involving simpler formulas and terms.

The key point is, why is this called a pseudo-model, and not simply a model? The answer is, we have the characterization of the abstraction designation function backwards here. In Chapter 2 we assumed we had a function A that mapped valuations and abstracts to members of Henkin

domains. Then we imposed a condition that A map to the "right" members, so that our intuitions concerning abstracts would be respected. Here we made that intuitive condition the defining property, reversing the usual order of things. But now we have no guarantee that AH must assign values that are in the Henkin domains. Looking at part 5 of the definition above, it is clear that, for an abstract T of type (t1, ... , tn), E(AH(v, T)) will be a subset of 'HH(tl) x · · · x 'HH(tn), but we do not know that AH(v,T) will be a possible value, and hence a member of 'HH( (t1, ... , tn) ). In short, while quantifiers range over Henkin domains (condition 4 above), for all we know some terms-abstracts-can have values that fall outside them. As a matter of fact, it will be proved that this does not happen, but it is not obvious, and it is not easy to establish.

Exercises EXERCISE 2.1 Show that if entity E is a possible value, then E must be a possible value of T(E).

2.3 Substitution and Pseudo-Models In this subsection valuations and substitutions are shown to be well

behaved with respect to pseudo-models. It should be noted again that valuations always mean valuations in a pseudo-model-they map variables to members of Henkin domains, to possible values. They do not map to arbitrary entities. The proofs below are rather technical, so I begin with the statements of the two Propositions to be established, after which their proofs are given, broken into a number of Lemmas. On a first reading you might want to just read the Propositions and skip over the proofs.

The first item should be compared with Proposition 2.30.

PROPOSITION 4.15 Let H be a Hintikka set, let M = ('HH,I,E) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Also let v and w be valuations.

1 If v and w agree on the free variables of the term T (v*I*AH)(T) = (w*I*AH)(T).

2 If v and w agree on the free variables of the formula 

M II-v,AH ¢::::::} M II-w,AH ·

The second item is an analog to Proposition 2.31. Definition 2.26 is carried over to the present setting: given (M, AH), for each valuation v and substitution CJ, the valuation vu is defined by o:va = ( v *I *AH) ( o:o-).

PROPOSITION 4.16 Again let H be a Hintikka set, let M = (1lH,I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. For any substitution CJ and valuation v:

1 If CJ is free for the term T then (v * T * AH)(TCJ) = (vu * T * AH)(T).

2 If CJ is free for the formula <P then M lf--v,AH <PCJ {::::::::} M lf--v",AH <P.

Now I turn to the proofs, which are given in considerable detail since these results are critical to the completeness argument, and I want the reasoning on record. On a first reading, skip the proofs and move on to the next section.

Proof of 4.15 Suppose the result is known for terms and formulas whose degree is < k. I show the result is also true for those of degree k itself, beginning with terms.

Assume Tis a term of degree k, and v and w agree on the free variables and parameters of T. If k happens to be 0, T is a constant symbol, variable, or parameter. In these cases the result is immediate.

Now suppose k =/= 0, and soT= (.Xa1, ... , an.<P), where <Pis of degree < k. Say (v *T*AH)((.Xal,··· ,an.<P)) = AH(v,(Aai,··· ,an.<P)) =

(a,S) and (w*T*AH)((Aal,··· ,an.<P)) =AH(w,(.Xal,··· ,an.<P)) = (a', S'). We must show a= a' and S = S'.

Suppose a is a variable or parameter that occurs free in T. Then air = T(v(a)) = T(w(a)) = a~, using the assumption that v and w must agree on a. By definition, a = T'v and a' = T~, and the substitutions 'v and ~ agree on the free variables of T, so a = a' by Proposition 1.15.

Next we suppose (E1, ... , En) E S, and so M lf--v,AH <P[al/ E1, ... , an/ En]· Since v and w agree on the free variables and parameters of (.Xa1, ... , an.<P), they agree on the free variables and parameters of <P, other than a1, ... , an. Then by the induction hypothesis, M lf--w,AH <P[al/ E1, ... , an/ En], and it follows that (E1, ... , En) E S'. Thus S ~ S'. A similar argument shows S' ~ S.

This completes the induction step for terms, and I turn next to formulas. Suppose <P is of degree k and v and w agree on the free variables and parameters of <P. By the induction hypothesis, we have the Proposition for terms and formulas of degree< k, and by what was just shown, we also have it for terms of degree k itself. Now we have several cases.

Suppose <Pis atomic, To(TI, ... , Tn), where each Ti must be of degree ~ k. Then, using the induction hypothesis and what was just proved,

M lf--v,AH To(T1, ... , Tn) ¢::>

((v *I* AH)(T1), ... , (v *I* AH)(Tn)) E £((v *I* AH)(To)) ¢::>

((w *I* AH)(T1), ... , (w *I* AH)(Tn)) E £((w *I* AH)(To)) ¢::>

M lf--w,AH To(T1, ... , Tn)·

The various non-atomic cases are left to you. •

Next we have several preliminary results, leading up to the proof of Proposition 4.16. Recall Definition 1.12: (Ja1, ... ,an is the substitution that is like(} except that it is the identity on 0:1, ... , O:n.

LEMMA 4.17 Let H be a Hintikka set, let M = (HH,I, £) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Let (..Xo:1, ... , O:n.<P) be a term of L+(C), and suppose the substitution (} is free for it, and is the identity map on parameters and variables that do not occur free in (..Xo:1, ... ,o:n.<P). Then, for any valuation v:

1 If w is an 0:1, ... , O:n variant of v then wu"'l···· ,a.n is an 0:1, ... , O:n variant of vu.

2 Conversely, if u is an 0:1, ... , O:n variant of vu then u = wu"'l , ... ·"'n for some 0:1, ... , O:n variant w of v.

3 vu<>1, ... ,<>n (o:i) = v(o:i), fori= 1, ... , n.

Proof Part 1. Suppose w is an 0:1, ... , O:n variant of v. Let {3 be a variable or parameter other than 0:1, ... , O:n. It must be shown that wu<>1>--· ,<>n ({3) = va({3). Here are the steps; the reasons follow.

w(T<>l, ... ,<>n ({3) = ( w *I* AH )(f3(Jal,··· ,an)

= ( w * I * AH) ({3(}) = (v*I*AH)(f3(}) = vu ({3)

(4.1)

(4.2)

(4.3)

(4.4)

Above, (4.1) is the definition of wu<>l, ... ,<>n, and (4.2) is because {3 is different from 0:1, ... , O:n. Also (4.4) follows from (4.3) by the definition of vu. The key item is the equality of (4.2) and (4.3), and for this it is enough to show v and w agree on the free variables and parameters of {3(}, and then appeal to Proposition 4.15. The argument for this follows.

If {3 does not occur free in (..Xo:1, ... , O:n.<P), {3(} = {3 by assumption. Also we are assuming {3 is different from o:1, ... , O:n, and v and w agree on all variables except o:1, . . . , O:n, so v and w must agree on {3, and


hence trivially they agree on the free variables and parameters of {JCJ in this case.

Now suppose {3 does occur free in (Ao:1, ... , O:n-~). Since CJ is free for (Ao:1, ... , O:n-~), {JCJ cannot contain any of 0:1, ... , O:n free. Once again v and w must agree on the free variables and parameters of {JCJ, since v and w can only differ on 0:1, . . . , O:n.

Part 2. Suppose u is an 0:1, ... , O:n variant of va. Define a valuation w as follows.

w(o:i) = u(o:i)

w(f3) = v(f3)

i = 1, ... ,n

{3 ::/= 0:1, . . . , O:n

By definition, w is an 0:1, ... , O:n variant of v. I will show wa"'I>--· •"'n = u. The argument is in two parts.

wa"'l·····"'n(o:i) = (w*L*AH)(O:Wat, ... ,aJ (4.5)

=(w*L*AH)(o:i) (4.6)

= w(o:i) (4.7)

= u(o:i) (4.8)

In this, (4.5) is by definition of wa"'l·· .. ·"'n. Then (4.6) is because CJa1 , ... ,an is the identity on O:i· Next, (4.7) is because o:i is a variable, and finally ( 4.8) is by definition of w.

Now suppose f3 ::/= 0:1, ... , O:n.

wa"'l>····"'n(f3) = (w*I*AH)(f3CJa 1 , •.• ,an) (4.9)

=(w*I*AH)(f3CJ) (4.10)

=(v*I*AH)(j3CJ) (4.11) = va(f3) (4.12)

= u(f3) (4.13)

Here (4.9) is by definition of wa"'l· .. ··"'n. Then (4.10) is by definition of CJat, ... ,an· Next, (4.11) follows exactly as (4.3) did above. Finally (4.12) is by definition of va, and (4.13) is because u and va are 0:1, ... , O:n variants.

Part 3. Va"'l>····"'n(o:i) = (V*L*AH)(o:iCJa 1 , ... ,an) = (v*L*AH)(o:i) = v(o:i)· •

LEMMA 4.18 Let H be a Hintikka set, let M = (1tH,I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. For any term T of L+(C), T~ = T((v *I* AH)(T)).

Proof Suppose first that T is a predicate abstract. Then by Definition 4.14, (v *I* AH)(T) = AH(v,T) = (T*v,S) for a certain setS, and so T((v *I* AH)(T)) = T*v. If T is a variable or parameter, T*v = T(v(T)) by definition of tv", and v(T) = (v *I* AH)(T) by definition of ( v * I * AH) again, for variables. If T is a constant symbol, T*v = T, and also T((v *I* AH)(T)) = T(I(T)) = T because I is an allowed interpretation. •

The proof of Proposition 4.16 is by an induction on degree. Since the steps are somewhat complex, I have separated the significant parts out, in the following two Lemmas.

LEMMA 4.19 Let H be a Hintikka set, let M = ('HH, I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Assume that for each formula of degree < k, whenever substitution C5 is free for then

M lf-v,A <l>C5 {::} M lf-v",A .

Then for each term T of degree k, and for each substitution C5 that is free forT,

( v *I * AH) ( TC5) = ( vu *I * AH) ( T).

Proof Assume the hypothesis concerning formulas, and suppose T is a term of degree k. If k is 0, T must be a constant symbol, a variable, or a parameter. If Tis a variable or parameter, say a, then (vu *I*AH)(a) = vu (a) = ( v *I* AH) ( ae5). The case of a constant symbol is trivial.

Now suppose k > 0, and so T must be of the form (>.a1, ... , an.), where is a formula whose degree is < k. And suppose C5 is free for (>.a1, ... , an. ). Using the definition of substitution and Definition 4.14:

where

(v*I*AH)((>.a1, ... ,an.)C5)

= (v*I*AH)((>.a1, ... ,an.C5a1 , ... ,an))

=AH(v,(>.a1,··· ,an.C5a1 , ... ,aJ) =(a, S)

a= (>.a1, ... ,an.C5a1 , ... ,an)+v S = { (01, ... , On) E 'HH(t1) X .. · X 'HH(tn) I

M lf-v,AH <l>C5a1 , ... ,an[al/01, · · · , an/On]}.

SOUNDNESS AND COMPLETENESS

Similarly:

where

I ( )+a a = >.a1. ... , an. v

S' = { (01, ... , On) E 'HH(tl) X · · · X 'HH(tn) J

M 11-v",AH [al/01, ... , an/On]}.

So, we must show a= a' and S = S'.

Part 1, a= a'. First of all,

a= (>.al, ... ,an.aal,···,an)1J = ((>.al,··· ,an.))a)1J = (>.a1, ... , an.)(a11)

57

(4.14)

(4.15)

In this, (4.14) is by definition of substitution. Recall we are assuming that a is free for (>.a1. ... , an. ). Also, since 11 replaces variables by grounded terms, and parameters are never bound, substitution 11 is free for (>.a1, ... , an.)a. Then (4.15) follows by Theorem 1.18.

So, to show a= a' it is enough to show the substitutions a11 and if are the same. Let (3 be a variable or parameter. f3(a11) = ([3a)11 by definition of composition for substitutions. And, using Definition 4.13, (3if = T(v17 ({3)) = T((v *I* AH)(f3a)). Finally, (f3a)1J and T((v *I* AH)(f3a)) are the same, by Lemma 4.18.

We thus have shown that a= a'.

Part 2, S = S'. Using Proposition 1.15 it can be assumed that a is the identity on

variables and parameters that do not occur free in (>.a1, ... , an. ).

8= {(01, ... 0n) I M lf-v,AH <Paa1 , ... ,an[o:I/01,··· ,o:n/On]} (4.16)

= { (w(o:1), ... , w(o:n)) I M lf-w,AH <Paa1 , ... ,an

where w is an 0:1, ... , O:n variant of v} ( 4.17)

= {(w(o:1), ... ,w(o:n)) I M lf-wu"l· .. ··"n,AH n (o:I), ... 'wa"l'"' ,<>n (o:n)) I M If-wO'"l•"' ,<>n ,AH 


= { (u(o:1), ... , u(o:n)) I M lf-u,AH <P

where u is an 0:1, ... , O:n variant of va} ( 4.20)

= { (01, .. · , On) I M lf-vu,AH <P[o:I/01, ... , O:n/On]} (4.21)

Above, (4.17) is just ( 4.16) rewritten. Since a is free for (Ao:~, ... , O:n.<P), by Definition 1.16, aa1 , ... ,an must be free for <P, and since <P must be of degree < k, ( 4.17) and ( 4.18) are equal by the hypothesis of the Lemma. Then (4.18) and (4.19) are equal by part 3 of Lemma 4.17. The equality of (4.19) and (4.20) follows by parts 1 and 2 of Lemma 4.17. Finally, (4.21) is (4.20) rewritten. •

LEMMA 4.20 Let H be a Hintikka set, let M = (HH,I,t:) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Assume that

( 4.22)

for each substitution a that is free for , provided is of degree < k. Also assume that

( v *I* AH) (TO") = ( va *I * AH) ( T) (4.23)

for each substitution that is free forT, provided T is of degree ::; k. Then (4.22} also holds for each formula <P of degree k itself.

Proof Assume the hypothesis. Suppose <P is a formula of degree k. There are several cases depending on the form of <P.

If is of the form r(r1, ... , Tn), each of the terms r, r1, ... , Tn must be of degree :=:; k. Then, using hypothesis ( 4.23) about terms,

M lf-v,AH a {:::> M lf-v,AH (r(TI, ... , Tn)))a

{:::> M lf-v,AH ra(r1a, ... ,Tna) {:::> ((v*I*AH)(rla), ... ,(v*I*AH)(rna))

E £((v *I* AH)(ra))

{:::> ( ( Va * I * A H) ( TI) , . . . , ( Va * I * A H) ( T n)) E £((va *I* AH)(r))

{:::> M lf-v",AH r(TI, ... , Tn)

{:::> M If-v" ,AH 

Next, if is a propositional combination of simpler formulas, the argument is straightforward using the hypothesis about formulas, and is left to you. Finally, if is of the form (Va)w the argument, in outline, is as follows.

M lf-v,AH [(Va)w]a {:::> M lf-v,AH (Va)[Waa]

{:::> M lf-w,AH Waa for every valuation

w that is an a-variant of v

{:::> M If-w"" ,AH W for every valuation

w that is an a-variant of v

{:::> M lf-u,AH W for every valuation

u that is an a-variant of va

{:::> M lf-v",AH (Va)w

(4.24)

( 4.25)

(4.26)

In this, the equivalence of ( 4.24) and ( 4.25) is by the hypothesis about formulas, and the equivalence of ( 4.25) and ( 4.26) is by a result similar to that stated in Lemma 4.17, but for quantified formulas rather than for predicate abstracts. •

Finally, the central item we have been aiming at.

Proof of 4.16 The proof, of course, is by induction on degree. Suppose the result is known for formulas and terms of degree < k. Then by Lemma 4.19 the result holds for terms of degree k, and then by Lemma 4.20 it holds for formulas of degree k as well. •

2.4 Hintikka Sets and Pseudo-Models Given a Hintikka set, we now know how to create a pseudo-model from

it. It would be nice if the various formulas in the Hintikka set turned

out to be true in that pseudo-model. This happens, and will be shown below. But we still have the troublesome feature of pseudo-models that quantifiers range over members of the Henkin domains, but predicate abstracts can have as values entities that might lie outside them. It would be nice if the values assigned to predicate abstracts turned out to be possible values after all. This too happens to be the case, and will also be shown below. In fact, both of the things we desire will be shown simultaneously, in one big result. Then we can conclude that each Hintikka set is satisfiable in a pseudo-model that actually is a generalized Henkin model.

THEOREM 4.21 Let H be a Hintikka set, let M = (HH,I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Also let v be a valuation in the pseudo-model.

1 For each term T of L + (C), ( v *I* AH) ( T) is a possible value for TlJ.

2 For each formula <J> of L+(C), if <J>"V E H then M lf-v,AH <J>.

Proof Both parts of the theorem are shown together by a simultaneous induction on degree. Assume they hold for formulas and terms of degree < k. It will first be shown that item 1 holds for terms of degree k; then it will be shown that item 2 holds for formulas of degree k.

Part 1. Let T be a term of degree k. If k happens to be 0, T is a constant symbol, variable, or parameter. If T is a constant symbol A, A"V =A, and (v *I* AH)(A) = I(A), which is a possible value of A because I is an allowed interpretation. If Tis a variable or parameter, a, ( v *I* AH) (a) = v( a) is some possible value E because v is a valuation in the pseudo-model. But then a"V = T(·v(a)) = T(E), and E is a possible value of T(E) by Exercise 2.1.

Now suppose T = (.Aa1, ... , an.). Then (v*I*AH)(r) = AH(v, r) = (r"V, S) where

S = { (Ot, ... , On) E HH(ti) X .. ·X HH(tn) I M lf-v,AH <J>[ai/01, .. · , an/On]}

= { (w(ai), ... , w(an)) I M lf-w,AH 

where w is an a1, ... , an variant of v}.

I show (r"V, S) is a possible value of r"V relative to H. To do this it must be shown that if E1 is a possible value for T1, ... , En is a possible value for Tn, then

2 •(71f)(71, ... , 7n) E H implies (E1, ... , En) fl. S.

I show the first of these; the second is similar. So assume E1 is a possible value for 71, . . . , En is a possible value for

7n, and (71f)(71,··. ,7n) E H. That is,

[(>.a1, ... ,an.)1f](71, ... ,7n) E H.

By definition of substitution we have

(.Xa1, · · · , an.+v a1 , ... ,an)(71, · · · , 7n) E H.

Since H is a Hintikka set, it follows that (Definition 4.6, part 7)

[+v a1, ... ,an]{al/71, ... , an/7n} E H.

Since 71, ... , 7n are grounded terms, they do not contain any of a1, ... , an free. Now, let w be the a1. ... , an-variant of v such that w(a1) = E1, ... , w(an) =En. Since Ei is a possible value for the grounded term 7i it follows that ai w = 7i. And if j3 f= a1, ... , an then j3w = j31J. Then [ tv a1 , ... ,an]{ al/71, ... , an/Tn} = w so

w E H.

 must be of lower degree than (>.a1, ... ,an.), that is, k, so the induction hypothesis applies and

M 11-w,AH .

Then (w(a1), ... , w(an)) E S, so (E1, ... , En) E S, which is what we wanted.

This concludes the induction step for terms.

Part 2. Let be a formula of degree k. By the induction hypothesis the result holds for formulas and terms of degree < k, and by part 1 of the proof it also holds for terms of degree k. Now we have several cases, depending on the form of . I only present a few of them.

Suppose is 7o(71, ... , 7n) and [To(71, ... , 7n)]tv E H. That is,

Each 7i is of degree ::; k so by the induction hypothesis, each ( v * I * AH)(7i) is a possible value for 7i1f. It follows immediately from the definition of possible value (Definition 4.9) and the definition of£ (Definition 4.8) that

and so

Suppose <P is X 1\ Y, and (X 1\ Y) 'v E H. By definition of substitution, (X'v 1\ Y'v) E H. Since H is a Hintikka set, X'v E H and Y'v E H. But each of X and Y is of lower degree than <P, so by the induction hypothesis, M 11-v,AH X and M 11-v,AH Y. It follows that M 11-v,AH X 1\ Y.

Suppose <P is (\io:)w(o:) and [(\io:)w(o:)]'v E H. By definition of substitution, (\io:)[w'v a](o:) E H. Let w be an arbitrary a-variant of v that assigns to o: the possible value E. Since E is a possible value, it is the possible value of some grounded term, say T. Now by definition of Hintikka set, [w'v a](T) E H. We have o:w = T, and if {3 -=f. o:, {Jw = {J'v, so [w(o:)]w = [w'v a](T), and hence [w(o:)]w E H. But W(o:) is oflower degree than <P, so by the induction hypothesis, M 11-w,AH w(o:). Since w was arbitrary, M 11-v,AH (\io:)w(o:).

The other cases are similar and are omitted. •

COROLLARY 4.22 Let H be a Hintikka set, let M = (1-lH,I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Then H is satisfied in the pseudo-model (M, AH). More specifically, let v be any valuation in this pseudo-model that assigns to each parameter p some possible value for p; then if <P E H, M lf-v,AH <P.

Proof If v assigns to each parameter p some possible value for p, then p'v = T(v(p)) = p. Consequently for each grounded formula <P we have <P'v = <P. The result then follows from part 2 of Theorem 4.21. •

2.5 Pseudo-Models are Models So far, a satisfiability result has been shown using pseudo-models.

But along the way everything needed to show that pseudo-models are actually models has been established. Since this is an important fact, I give it a section of its own though, as I said, the work has already been done.

THEOREM 4. 23 Let H be a Hintikka set, let M = (1-lH, I,£) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to H. Then (M, AH) is a generalized Henkin model.

Proof We need that AH is an abstraction designation function, Definition 2.23. Specifically, we need that it maps predicate abstracts to


members of Henkin domains. But part 1 of Theorem 4.21 takes care of this.

And we need that AH is a proper abstraction designation function, Definition 2.27. There are three conditions that must be met. The first, that abstracts map to the 'right' values, is taken care of by the way we defined AH in pseudo-models. The other two conditions have to do with the behavior of substitution, and these are taken care of by Propositions 4.15 and 4.16. •

COROLLARY 4.24 Henkin model.

Every Hintikka set is satisfiable in a generalized

Proof By Corollary 4.22 and the Theorem above. (Recall, it was shown in Section 6 that a choice between L( C) and L + (C) was not significant when considering models for formulas from the language L(C).) •

2.6 Completeness At Last Most of the work of showing completeness is over. All that is left is

to connect Hintikka sets with tableaus. This can be done in either of two ways. One could give a systematic tableau construction procedure, designed to ensure everything that can be done is eventually done in fact. Then one would show that the set of formulas on an unclosed branch of such a tableau is a Hintikka set. This approach involves considerable attention to detail, and is not what I have chosen to do here. The other technique involves maximal consistent sets, much like in the standard axiomatic approach. Things must be adapted to tableaus, of course, but this is the direction I picked because it is considerably simpler.

DEFINITION 4.25 (CONSISTENCY) Call a setS of grounded formulas of L + (C) consistent if no basic tableau beginning with any finite subset of S closes. If S is not consistent, call it inconsistent.

Thus a set S is inconsistent if there is a closed tableau beginning with some finite subset.

DEFINITION 4.26 (MAXIMAL CONSISTENCY) A set S is maximally consistent if it is consistent but no proper extension of it is consistent.

For propositional logic, working with maximal consistent sets is sufficient to prove completeness, but with quantifiers involved, more is needed.

DEFINITION 4.27 (E-COMPLETE) A set S of grounded formulas of L + (C) is E-complete if:


1 --{1/o:)cll(o:) E S implies --,cp(p) E S for some parameter p.

2 (3o:)cll(o:) E S implies cll(p) E S for some parameter p.

It will be shown that lots of maximal consistent, E-complete sets exist, and they are Hintikka sets. From this, completeness follows easily. The primary difference between a tableau completeness proof and an axiomatic one is that with tableaus, maximal consistency and Ecompleteness give us the implications that make up the definition of a Hintikka set, while in an axiomatic version, these implications become equivalences. The stronger version, in fact, is more than is needed. But now, to work.

PROPOSITION 4.28 If S is a consistent set of closed formulas of L(C), S can be extended to a maximal consistent, E-complete set of grounded formulas of L+(c).

Proof The set of grounded formulas of L + (C) is countable; let 'lT 1, 'lT 2,

W3, ... be an enumeration of all of them. Also, let PI, P2, P3, ... be an enumeration of all parameters of L+(C) of all types. Now we construct a sequence of sets of formulas. Each set in the sequence will meet two conditions: it is consistent, and infinitely many parameters of each type do not appear in it. Here is the construction.

Let 80 = S. This is consistent by hypothesis, and contains no parameters at all, so both of the conditions are met.

Suppose Sn has been defined, and the conditions are met.

1 If Sn U {'l'n+I} is not consistent, let Sn+l = Sn.

2 If Sn U {'l'n+I} is consistent, and Wn+l is not an existentially quantified formula or the negation of a universally quantified formula, let Sn+l = Sn U {'l'n+I}·

3 Finally, if Sn U {'l'n+I} is consistent, and Wn+l is (3o:)cll(o:), choose the first parameter p in the enumeration of parameters, of the same type as o:, that does not appear in Sn or in (3o:)cll(o:), and set Sn+l = Sn U {(3o:)cll(o:), cll(p)}. And similarly if Wn+l is •(Vo:)cll(o:).

Note that Sn+l meets the conditions again. In case 3, consistency needs a small argument, which I leave to you.

Finally, let 800 be SoUS1 US2U .... I leave to you the easy verification that 8 00 will be consistent, E-complete, and maximal. •

PROPOSITION 4.29 If S is a set of grounded formulas of L+(C) that is maximal consistent and E-complete, S is a Hintikka set.

Proof Let S satisfy the hypothesis of the Proposition. It is a simple matter to verify that S meets each of the Hintikka set conditions. One is presented as an example.

Suppose we have (>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn) E S, but (TI, ... , Tn) rf. S; we derive a contradiction.

If S U { (TI, ... , Tn)} were consistent, (TI, ... , Tn) would be in S, since S is maximally consistent. Consequently S U {( 71, ... , Tn)} is not consistent, so there is a closed tableau for some finite subset, which must include (TI, ... ,Tn), since S itself is consistent. Thus there are formulas X1, ... , Xk E S such that there is a closed tableau, call it T, beginning with xl, ... ' xk, (TI, ... 'Tn)· Now, since we have (>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn) E S we can construct a tableau as follows. Begin with

xk k. (>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn) k + 1. <l>(TI, ... , Tn) k + 2.

In this, the first k + 1 lines are members of S. Line k + 2 is from k + 1 by an abstract rule. Now continue this tableau to closure by copying over the steps of tableau T.

This shows there is a closed tableau for a finite subset of S itself, so S must be inconsistent, which is a contradiction. •

Now, finally, we get" the completeness results.

THEOREM 4.30 Let be a closed formula and letS be a set of closed formulas, all of L( C).

1 If is valid in generalized Henkin models, has a basic tableau proof.

2 If is a generalized Henkin consequence of S, has a basic tableau derivation from S.

Proof Suppose there is no basic tableau derivation of from S. Then there is no closed tableau for ...,<f>, allowing members of S to be added to the ends of open branches. It follows that S U { ...,<f>} is consistent. It can be extended to a maximal consistent, E-complete set H, by Proposition 4.28. The set His a Hintikka set, by Proposition 4.29. Then by Corollary 4.24, SU{ -,<f>} is satisfiable in some generalized Henkin model, and consequently is not a generalized Henkin consequence of S. This establishes part 2; part 1 has a simpler proof. •


3. Miscellaneous Model Theory Two of the main results about first-order logic are the Compactness

and the Lowenheim-Skolem theorem. I already noted, in Section 3, that compactness does not hold for "true" higher-order logic. It is also easy to verify that the Lowenheim-Skolem theorem does not hold, since one can write a formula asserting an uncountable object exists. But things are very different if generalized Henkin models are used, instead of standard models. Then both theorems hold, just as in the first-order case. Compactness is easy to verify, now that completeness has been shown. Lowenheim-Skolem takes more work.

THEOREM 4.31 (COMPACTNESS) LetS be a set of closed formulas of L( C). If every finite subset of S is satisfiable in some generalized Henkin model, so is S itself.

Proof Suppose S is not satisfiable in any generalized Henkin model-! show some finite subset of S is also not satisfiable.

Let ..L abbreviate X 1\ •X, where X is some arbitrary closed formula of L( C). Since S is not satisfiable in any generalized Henkin model, ..L is true in every model in which the members of S are true (since there are none), so ..Lis a generalized Henkin consequence of S. By Completeness, ..L has a basic tableau derivation from S. A closed tableau, being a finite object, can use only a finite subset So of S. Now ..L has a basic tableau derivation from So, so by Soundness, ..Lis a generalized Henkin consequence of So. If So were satisfiable in some generalized Henkin model, ..L would be true in it, which is not possible. Consequently S0 is unsatisfiable. •

The Lowenheim-Skolem theorem for first-order classical logic follows easily from the observation that models constructed in completeness proofs are countable. This does not apply directly to the generalized Henkin models constructed using tableaus. The reason is very simple. I showed how to construct a generalized Henkin frame M = (1-lH, I,£) starting with a Hintikka set H. In this frame, the Henkin domains consisted of possible values for grounded terms, Definition 4.9. It is easy to see that 1-lH(O) must be countable. But say T is a grounded term of type (0) such that no formulas of the form r(ro) or •r(ro) occur in H. (This can certainly happen-take the Hintikka set H to be the empty set!) Then (r, S) is a possible value for T for every subset S of 1-lH(O), so 1-lH( (0)) is uncountable.

We need some way around this difficulty. The main tool is contained in the following.

THEOREM 4.32 (CUT-ELIMINATION) LetS be a finite set of grounded formulas of L + (C). If there is a closed tableau beginning with S U { <P}, and a closed tableau beginning with S U { --,cp}, then there is a closed tableau beginning with S.

This Theorem is a version of Gentzen's famous Haputsatz, or cut elimination theorem, for higher-order logic. It is an important result about classical first-order logic that closed tableaus for SU{ <P} and for SU{ --,cp} can be constructively converted into one for S. There is no constructive proof for the higher-order case, but the result can be obtained provided we are willing to drop constructivity. Such a proof was given in [Pra68] and in [Tak67], and their argument has appeared here, in disguise, as a completeness proof. To finish things off I sketch the remaining ideas involved in a proof of the Theorem.

Proof Suppose there are closed tableaus for S U { <P} and for S U { --,cp}. Then neither set is satisfiable. It follows that S itself is not satisfiable, for if there were a generalized Henkin model in which its members were true, one of <P or --,cp would be true there. It remains to show that the unsatisfiability of S implies there must be a closed tableau beginning with S.

Suppose the contrary: there is no closed tableau beginning with S, so that S is a consistent set. Proposition 4.28 says a consistent set of L( C) sentences can be extended to a maximal consistent, E-complete set-the same proof can easily be made to work even if the set contains parameters, provided it omits infinitely many of them. Since S is finite, it certainly omits infinitely many parameters, so we can extend it to a maximal consistent, E-complete set, which must be a Hintikka set. Corollary 4.24 says Hintikka sets are satisfiable. Since Sis a subset of a satisfiable set, it too must be satisfiable, but it is not. This contradiction concludes the proof. •

This immediately gives us the following important result.

COROLLARY 4.33 (CUT RULE) The addition of the following Cut Rule to the basic tableau system does not change the class of provable formulas: at any point split a branch, and add --,cp to one fork, and has a tableau proof, can be added as a line to any tableau, without expanding the class of provable formulas.


Proof Suppose ~ has a tableau proof, and so there is a closed tableau for ·~. And now suppose we are constructing another tableau, and we wish to use ~ in that construction, We can proceed as follows.

That is, we have used an application of a cut. Now, on the left branch, introduce the steps appropriate to close it, which exist because we are assuming there is a closed tableau for·~- This leaves the right branch. The net effect has been to add ~ to the tableau. •

Now, go back through the proof of completeness given earlier. Proposition 4.28 said we could extend a consistent set to a maximal consistent, E-complete one. Using the work above, it follows that a maximal consistent set must contain either ~ or --,~ for every grounded formula ~. Since this is the case, each grounded term can, in fact, have only one possible value associated with it. Thus the particular model constructed in the completeness argument must have countable Henkin domains, since the family of grounded terms for each type is countable. We thus have the following.

THEOREM 4.35 (LOWENHEIM-SKOLEM) Let 8 be a set of closed formulas of L(C). If S is satisfiable in some generalized Henkin model, S is satisfiable in a generalized Henkin model whose domain function 1t meets the condition that 1t(t) is countable for every type t.

The results above have both good and bad points. It is obviously good to be able to prove such powerful model-theoretic facts about a logic-it provides tools for the construction of useful models. The bad side is that Lindstrom's Theorem says, since the version of higher-order logic based on generalized Henkin models satisfies the theorems above, it is simply an equivalent of first-order logic. This does not mean nothing has been gained. The higher-order formalism is natural for the expression of things whose translation into first-order versions would be unnatural. And finally, if a sentence is not provable, it must have a generalized Henkin counter-model, but if it is provable, it must be true in all generalized Henkin models, and among these are the standard higher-order models! Thus we have a means of getting at higher-order validities-we just can't get at all of them this way.

Chapter 5

EQUALITY

The basic tableau rules of Chapter 3 do not give any special role to equality. It is time to bring it into the picture. This is done by adding axioms to the tableau system, which has the effect of narrowing things to normal generalized Henkin models. In addition, some useful derived tableau rules will be presented.

1. Adding Equality Leibniz's principle is that objects are equal just in case they have

the same properties. This principle is most easily embodied in axioms, rather than in tableau-style rules.

DEFINITION 5.1 (EQUALITY AXIOMS) Each sentence of the following form is an equality axiom:

(Va)(V,B)[(a =,B)= (V1)(1(a) :) 1(,8))]

In this, = is of type (t, t), for some t, then a and ,B are of type t and 1 is of type (t). EQ denotes the set of equality axioms.

I will show that a closed formula of L( C) is valid in normal generalized Henkin models if and only if has a tableau derivation from EQ. But before that is done I give some handy derived tableau rules, and examples of their use.

2. Derived Rules and Tableau Examples. There are two derived rules involving equality that are more "tableau

like" in flavor, and are what I primarily use in constructing tableau proofs and derivations. I do not know if they can serve as full replacements for the official Equality Axioms, since I have been unable to prove

69

a completeness theorem using them. Nonetheless, the derived rules below are the ones I generally use in practice.

DEFINITION 5.2 (DERIVED REFLEXIVITY RULE) For a grounded term T of L + (C), at any point in a proof ( T = T) may be added to the end of a tableau branch. Schematically,

Justification of Derived Reflexivity Rule Let T be a grounded term of type t. (T = T) can be added to the end of a branch via the following sequence of steps.

(\fa)(\f/3)[(a = /3) = (\f'Y)(r(a) :J 'Y(/3))] 1. (\ff3)[(T = /3) := (\f'Y)('y(T) :J 'Y(/3))] 2. [(T = T) := (\f'Y)('y(T) :J /(T))] 3. [(T = T) :J (\fr)(r(T) :J 'Y(T))] 4. [(\f'Y)('y(T) :J 'Y(T)) ::J (T = T)] 5.

/ ~ •(\f'Y)(/(T) :J 'Y(T)) 6. (T = T) 7.

In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal rules; 4 and 5 are from 3 by a conjunction rule; 6 and 7 are from 5 by a disjunction rule. Clearly the left branch continues to closure. The remaining open branch, the right one, indeed, has (T = T) on it.

The next rule embodies the familiar notion of substitutivity of equals for equals.

DEFINITION 5.3 (DERIVED SUBSTITUTIVITY RULE) Suppose <J?(a) is a formula of L + (C) in which the variable a may have free occurrences, but no other variables occur free. Also suppose Tl and T2 are grounded terms of the same type as a. As usual, let ( Tl) denote the result of replacing free occurrences of a in ( a) with occurrences of T1; and similarly for (T2). Then, if both <P(TI) and (Tl = T2) occur on a tableau branch, ( T2) can be added to the branch end. Schematically,

<J?( T1) (T1=T2)

<J?( T2)

Justification of Derived Substitutivity Rule Assume T1 and T2

are grounded terms of type t, and (TI) and (T1 = T2) occur on a tableau

EQUALITY

branch. I show <P( 72) can be added to the end of the branch.

(Va)(V,B)[(a = ,6) = (Vr)('y(a) ::::> 1(,6))] 1. (\f ,6) [ ( 71 = ,6) := (\fr) ('y( 71) ::::> 1'(,6))] 2. [(71 = 72) := (\7'1')(1'(71) ::::> 1'(72))] 3. [(71 = 72) ::::> (\f/)('y(7I) ::::> 1'(72))] 4. [('v'r)('y(7I) ::::> 1'(72)) ::::> (71 = 72)] 5.

/~ •(71 = 72) 6. (\f/)('y(7I) ::::> /(72)) 7.

(Aa.<P(a))(7I) ::::> (Aa.<l>(a))(72) 8.

/ ~ •(Aa. <P( a)) ( 7I) 9. (Aa.<P( a)) ( 72) 10. •<1>(71) 11. <1>(72) 12.

71

In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal rules; 4 and 5 are from 3 by a conjunction rule; 6 and 7 are from 4 by a disjunction rule; 8 is from 7 by a universal rule, using the term (Aa.<P(a)); 9 and 10 are from 8 by a disjunction rule; 11 is from 9 and 12 is from 10 by a predicate abstract rule. The two left branches are closed, leaving the right one which contains <1>(72)·

Now I give several examples of tableau derivations using the derived rules. The first example is (intentionally) a simple one. It appeared earlier as Example 2.9, where an informal reading was given, and validity was shown directly.

EXAMPLE 5.4 Here is a proof of (AX.(3x)X(x))((Ax.x =c)).

•(AX.(3x)X(x))( (Ax.x =c)) 1. •(3x)(Ax.x = c)(x) 2. •(Ax.x = c)(c) 3. •(c=c) 4.

(c=c) 5.

In this, 2 is from 1 by an abstract rule; 3 is from 2 by a universal rule; 4 is from 3 by an abstract rule, and 5 is by the derived reflexivity rule.

The next example shows how, by using the derived rules, we can reverse things and prove a version of the equality axioms.


EXAMPLE 5.5 I give a tableau proof (using derived rules, not axioms) of

(Va)(V,B)[(Vr)('y(a) ~ 1(,8)) ~(a= ,B)].

--,(\fa)(V,B)[(V')')('Y(a) ~ 1(,8)) ~ (a= ,B)] 1. --,(\f,B)[(Vr)(r(P) ~ 1(,8)) ~ (P =,B)] 2. --,[(Vr)('y(P) :::> r(Q)) ~ (P = Q)] 3.

(Vr)('y(P) ~ 1 (Q)) 4. --,(P = Q) 5.

(AX.--,(X = Q))(P) ~ (AX.--,(X = Q))(Q) 6.

/ ~ --,(AX.--,(X = Q))(P) 7. --,--,(P = Q) 9.

(AX.--,(X = Q))(Q) 8. --,( Q = Q) 10.

(Q = Q) 11.

Here 2 is from 1, and 3 is from 2 by an existential rule (P and Q are new parameters of the appropriate type); 4 and 5 are from 3 by a conjunctive rule; 6 is from 4 by a universal rule, using the grounded term (AX.--,(X = Q)); 7 and 8 are from 6 by a disjunction rule; 9 and 10 are from 7 and 8 by abstract rules; 11 is the derived reflexivity rule.

Though the derived tableau rules for equality allow us to prove the axioms, it does not follow they are their equivalent. To establish that, we would need to have a cut elimination theorem for the tableau system with the equality rules. And the way to prove cut elimination is to first have a completeness proof. I conjecture that such a completeness result is provable, but I don't know how to do it.

Exercises EXERCISE 2.1 Prove the following characterization of equality-it says it is the smallest reflexive relation.

(Vx)(Vy){(x = y) = (VR)[(Vz)R(z,z) ~ R(x,y)]}

EXERCISE 2.2 Give a tableau derivation of the following from EQ.

(Va)(V,B)[(a =,B) ~ (Vr)(a('y) = ,8(1))]

More generally, one can do the same with the following.

EQUALITY 73

3. Soundness and Completeness The results of this section combine to prove the following.

THEOREM 5.6 Let <P be a closed formula and let S be a set of closed formulas of L( C).

1 <P is valid in all normal generalized Henkin models if and only if <P has a tableau derivation from EQ.

2 <P is a consequence of S with respect to normal generalized Henkin models if and only if <P has a tableau derivation from S U EQ.

The theorem above combines soundness and completeness. One direction, soundness, is almost immediate. Every equality axiom is true in every normal generalized Henkin model, so the implications from right to left in Theorem 5.6 follow immediately from Theorems 4.4 and 4.5. As usual, the completeness direction is more work. The key item is to prove the following Proposition. Once we have it, completeness follows immediately using part 2 of Theorem 4.30.

PROPOSITION 5. 7 Given a generalized Henkin model in which all members ofEQ are true, there is a normal generalized Henkin model in which exactly the same closed formulas of L( C) are true.

The rest of this section is given over to a proof of Proposition 5. 7 -it is broken up into constructions and Lemmas. The ideas are the same as in Godel's original completeness proof for first-order logic with equalitybring equivalence classes into the picture.

For the rest of this section, assume (M, A) is a generalized Henkin model, M = (H,I,£), and all members of EQ are true in this model.

For 01,02 E H(t), let us write 01 =r 02 as a more readable alternative notation for (01,02) E I(=(t,t)). Thus =r is the interpretation of the equality constant symbol (of a particular type, which will be indicated only if needed). Since all equality axioms are true in (M, A), it is an easy consequence that =r is an equivalence relation.

For each 0 E H ( t), let 0 be the equivalence class determined by 0, that is, 0 = { O' I 0 =r O'}. Define a new Henkin domain mapping by setting H(t) = {0 I 0 E H(t)}. Also, define a new interpretation by setting I(A) to be the equivalence class containing I(A), that is, I(A) = I(A).

LEMMA 5.8 If 01 = 02 then £(01) = £(02)·


Proof Suppose 01 = 02, that is, 01 =I 02, and say 01 and 02 are of type (t). In Exercise 2.2 you were asked to give a tableau derivation of (Va)(Vj])[(a = (3) ::J (V'Y)(a('Y) = {3(/))] from EQ. Then by soundness, this sentence is valid in (M, A). It follows that (V'Y)(a('Y) = (3(!)) is also true with respect to any valuation assigning 01 to a and 02 to (3. From this we immediately get that the sets £(01) and £(02) must be the same. A similar argument applies if 01 and 02 are of type (tb ... , tn)·

• The Lemma above justifies the following. For 0 E 1{ ( (t1, ... , tn)), set

£(0) = { (01, ... , On) I (01, ... , On) E £(0)}. We have now created a new generalized Henkin frame M = (?t,I,£).

LEMMA 5.9 The generalized Henkin frame M = (1t,I, £) is normal.

Proof The following calculation establishes normality.

•

(01, 02) E E(I(=)) {:} (01, 02) E E(I(=))

{:} (01,02) E E(I(=))

{:} 01 =I 02

{:} 01 = 02

For each valuation v in M, let v be the corresponding valuation in M given by v(a) = v(a). It is easy to see that each valuation in M is v for some valuation v in M.

LEMMA 5.10 Let T be a predicate abstract. If v1 = v2 then A( v1, T) =I

A(v2, r).

Proof For convenience say T just has one free variable, 1; the more general case is treated similarly. From now on I'll write T as r('Y). Assume v1 = v2, hence in particular, v1 (!) =I v2 (!); I'll show A( v1, r('Y)) =I

A(v2, r('Y)). Let a and (3 be variables of the same type as 1, that do not occur

in r('Y) (free or bound). Since all members of EQ are true in (M, A), (Va)(Vf3)[(a = (3) ::J (r(a) = r((3))] is true in it, and hence r(a) = r((3) is true in (M, A) with respect to any valuation v such that v(a) =I v(f3).

Set w to be a particular valuation such that w(a) = v1(!), w(f3) = v2(!), and otherwise w is arbitrary. Since v1('Y) =I v2(!), we have w(a) =I w((3), so by the paragraph above, r(a) = r((3) is true in (M, A) with respect tow, in other words, A(w,r(a)) =I A(w,r(f3)). Also

EQUALITY 75

v~ah}(a) = v1(a{ah}) = v1(r) = w(a). Likewise v~,Bh}(,6) = w(,6). Thus v~ah} and w agree on the free variables of T(a), and v~,Bh} and w agree on the free variables of T(,6).

Now since A is proper, we can make use of the conditions of Definition 2.27, and we have the following.

•

A(v1,T(r)) = A(vi,T(a){ah})

= A(v~ah},T(a))

= A(w, T(a)) =I A( w, T(,6))

=A( v~,Bh}, T(,6))

= A( V2' T(,6){,6 h}) = A(v2, T(r))

This Lemma justifies the following. Define an abstraction designation function by A(v, (-Xa1, ... ,an.<P)) = A(v, (-Xa1, ... ,an.<P)).

Now the final step.

LEMMA 5.11 For each valuation v in M:

1 (v *I* A)(T) = (v *I* A)(T) for each term T of L(C);

2 M lf-v,A M lf-v,A <P for each formula <P of L(C);

3 A is proper, and hence (M, A) is a generalized Henkin model.

Proof Part 1 follows for variables, constant symbols, and predicate abstracts by definition of v, I, and A respectively.

Part 2 is by an induction on the degree of <P, which I leave to you. Finally, for part 3 it is necessary to verify the three parts of Defini

tion 2.27. I check part 3 and leave the other parts to you. Let 0' be a substitution that is free for (>.a1, ... , an.<P), a term which I abbreviate as T. It must be shown that A(v, TO') = A(W, T). We have the following.

A(v, TO')= A(v, TO')

= A(vu,T)

= A(vu,T)


But also we have the following, for each variable o:.

• Exercises

va ( o:) = va ( o:)

= v(o:o-)

= v(o:o-) = VU(o:)

EXERCISE 3.1 Give the details of the proof that =x is an equivalence relation.

EXERCISE 3.2 Supply the proof of part 2 of Lemma 5.11.

Chapter 6

EXTENSIONALITY

Extensionality says that properties applying to the same objects are identical. Just as was done with equality in Chapter 5, extensionality is added via axioms. Throughout this chapter it is, of course, assumed that equality is available.

1. Adding Extensionality The extensionality axioms simply assert the equality of co-extensional

properties.

DEFINITION 6.1 (EXTENSIONALITY AXIOMS) Each sentence of the following form is an extensionality axiom, where a and (3 are of type (tl,··· ,tn), '/'1 is oftypetl, ... , 'T'n is oftypetn.

EXT denotes the set of extensionality axioms.

I will show that a closed formula of L( C) is valid in normal Henkin models (note that I've dropped the qualifier "generalized") if and only if has a tableau derivation from EQ U EXT. But first some examples.

2. A Derived Rule and an Example Extensionality was embodied in a set of axioms. There is a derived

tableau rule that expresses the same idea in a rather more useful form.

DEFINITION 6.2 (DERIVED EXTENSIONALITY RULE) Suppose T1 and T2 are two grounded terms, both of type (t1, ... , tn)· At any point in a tableau construction the end of a branch can be split, with one fork labeled

77


(71 = 72), and the other fork labeled •(7I(PI, ... ,Pn) = 72(PI, ... ,Pn)) where Pl, ... , Pn are parameters (of appropriate types) new to the branch. Schematically, for new parameters:

The justification of this rule is quite straightforward, and I leave it as an exercise. Here is an example that illustrates the use of this Derived Extensionality Rule.

EXAMPLE 6.3 I give a proof of the following formula.

(\fx) [(>.X.X(x))(P) = (>.X.X(x))(Q)] :::> (>.X, X, Y.X(X) :::> X(Y))(P,P,Q)

•{(Vx) [(>.X.X(x))(P) = (>.X.X(x))(Q)] :::> (>.X, X, Y.X(X) :::> X(Y))(P, P, Q)} 1.

(\fx) [(>.X.X(x))(P) = (>.X.X(x))(Q)] 2. •(>.X,X,Y.X(X) :::> X(Y))(P,P,Q) 3. --, [P(P) :::> P(Q)] 4.

P(P) 5. •P(Q) 6.

~~ --, [P(p) = Q(p)] 7.

(.XX.X(p))(P) = (.XY.Y(p))(Q) 10.

P=Q 8. P(Q) 9.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an abstract rule; 5 and 6 are from 4 by a conjunctive rule. Now I apply the extensionality rule. Take 71 to be P and 72 to be Q, both of which are grounded, and take p to be a new parameter. We get a split to 7 and 8. Item 9 is from 5 and 8 by substitutivity, and the right branch is closed. Item 10 is from 2 by a universal rule. The left branch can be continued to closure. I leave this to you.

Exercises EXERCISE 2.1 Give a proof of formula (3.1) from Example 3.12.

EXERCISE 2.2 Show that the rule contained in Definition 6.2 is, in fact, a derived rule, using EXT.

EXTENSIONALITY 79

3. Soundness and Completeness I sketch a proof that the sentences having tableau proofs using EQ U

EXT as axioms are exactly the sentences valid in normal Henkin models (and similarly for derivability as well).

Soundness takes very little work. It just amounts to the observation that all members of EQ U EXT are valid in normal Henkin models.

Completeness also takes very little work. Using results of Chapter 4, if a sentence If? does not have a tableau proof using EQ U EXT as axioms, there is a generalized Henkin model in which If? is false, but in which all of EQ U EXT are true. I'll show it follows that If? is false in a normal Henkin model.

Say (M, A), where M = (1t, I,£), is a generalized Henkin model in which the members of EQ U EXT are true but If? is false. Since the members of EQ are true, by results of Chapter 5 we can take (M, A) to be normal. I claim it is also extensional in the sense of Definition 2.32, that is, if £(0) = £(0') then 0 = 0', where 0 and O' are objects in the model domain. I now show this.

Suppose £(0) = £(0'), where 0 and O' are of type (t) for simplicity (the general case is similar). The following is a member of EXT (in it, a and {3 are of type (t), and 1 is of type t)

(Va)(V,B){('v'!)[a(/) = ,8(/)] :) [a= ,8]}

and so this sentence is true in (M, A). Let v be a valuation such that v(a) = 0 and v(f3) = 0'. Then

But since £(0) = £(0') it is easy to see we also have

and so M lf-v,A a= ,6. Since (M,A) is normal, it follows that v(a) = v({3), that is, 0 = 0'.

Since (M, A) is extensional, it is isomorphic to a Henkin model, as was shown in Section 6. And trivially, isomorphism preserves sentence truth.

II

MODAL LOGIC



Chapter 7

MODAL LOGIC SYNTAX AND SEMANTICS

1. Introduction

The second part of this book investigates a logic of intensions and extensions, using a possible world semantics. For purposes of background discussion in this section, I will assume you have some general familiarity with possible worlds at least informally. Technical details are postponed till after that.

First, a point about terminology. The intensional/extensional distinction is an old one. Unfortunately, the word "extensionality" has already been given a technical meaning in Part I, where Henkin models that did or did not satisfy the extensionality axioms were considered. The use of "extension" in this part, while related, is not the same. I briefly tried using the word "denotation" here, but finally it seemed unnatural, and I resigned myself to using the word "extension" after all. As a matter of fact, the Axioms of Extensionality will be assumed throughout Part II for those terms that will be called extensional, so any confusion of meanings between the classical and the modal settings should be minimal.

The machinery in Part I had no place for intensions-meanings. In a normal Henkin model, if terms intended to denote the morning star and the evening star have the same extension, as they do in the real world, they are equal, and so share all properties. They cannot be distinguished. Montague and his students, notably Gallin, developed a purely intensional logic. In this, extensions could only be handled indirectlyin some sense an extension could be an intension that did not vary with circumstances. While this can be made to work, it treats extensions as second class objects, and leads to a rather complicated development.

83


What is presented here is a modification of the Montague/Gallin approach, in which both extensions and intensions are first class objects.

What are the underlying intuitions? An extensional object will be much as it was in Part I: a set or relation in the usual sense. The added construct is that of intensional object, or concept, and this is treated in the Carnap tradition. A phrase like, say, "the royal family of England," has a meaning, an intension. At any particular moment, that meaning can be used to determine a particular set of people, constituting its extension. But that extension will vary with time. For other phrases, there may be different mechanisms for determining extensions as circumstances vary. The one thing common to all such intensional phrases is that they, somehow, induce mappings from circumstances to extensions. Abstracting to the minimum useful structure, in a possible world model an intensional object will be a function from possible worlds to extensional objects.

Here is an example using the terminology just introduced. Suppose we take possible worlds as people, with an 85 accessibility relation~every person is accessible to every other person. And suppose the ground-level domain is a bunch of real-world objects. Any one person will classify some of those objects as being red. Because of differences in vision, and perhaps culture, this classification may vary from person to person. Nonetheless, there is a common concept of red, or else communication would not be possible. We can identify it with the function that maps each person to the set of objects that person classifies as red. And similarly for other colors. In addition, each person has a notion of color, though this too may vary from person to person. One person may think of ultra-violet as a color, another not. We can think of the color concept as a mapping from persons to the set of colors for that person. If we assert that red is a color for a particular person, we mean the red concept is in the extension of the color concept for that person. The extension of the red concept for that person plays no role for this purpose.

Sometimes extensions are needed too. Certainly if we ask someone whether or not some object is red, the extension of the red concept, for that person, is needed to answer the question. Here is another example in this direction. Assume the word "tall" has a definite, non-fuzzy, meaning. Say everybody gets together and votes on which people are tall, or say there is a tallness czar who decides to whom the adjective applies. The key point is that the meaning of "tall," even though precise, drifts with time. Average height of the general population has increased over the last several generations, so someone who once was considered tall might not be considered so today.

MODAL LOGIC, SYNTAX AND SEMANTICS 85

Now suppose I say, "Someday everybody will be tall." There is more than one ambiguity here. On the one hand I might mean that at some point in the future, everybody then alive will be a tall person. On the other hand I might mean that everybody now alive will grow, and so at some point everybody now alive will be a tall person. Let us now read modal operators temporally, so that OX informally means that X is true and will remain true, and OX means that X either is true or will be true at some point in the future. Also, let us use T(x) as a tallness predicate. (The examples that follow assume an actualist reading of the quantifiers, and eventually I will adopt a version of a possibilist reading. For present purposes, this is a point of no fundamental importance. For now, think in terms of varying domain models, with quantifiers ranging over different domains at different worlds.) The two readings of the sentence are easily expressed as follows.

('v'x)OT(x) 0(\lx)T(x)

(7.1)

(7.2)

Formula (7.1) refers to those alive now, and says at some point they will all be tall. Formula (7.2) refers to those alive at some point in the future and asserts, of them, that they will be tall. All this is standard; the problem is with the adjective "tall." Do we mean that at some point in the future everybody (read either way) will be tall as they use the word in the future, or as we use the word now? If we interpret things intensionally, T(x) at a possible world would be understood according to that world's meaning of tall. There is no way, using the present machinery, to formalize the assertion that, at some point in the future, everybody will be tall as we understand the term. But this is what is most likely meant if someone says, "Someday everybody will be tall."

Here is another example, one that goes the other way. Suppose a member of the Republican Party, call him R, says, "necessarily the proposed tax cut is a good thing." Suppose we take as the possible worlds of a model the collection of all Republicans, and assume a sentence is true at a world if that Republican thinks the sentence true. (We assume Republicans are entirely rational, so we don't have to worry about contradictory beliefs.) Let us now take OX to mean that every Republican thinks X is the case, which means X is necessary for Republicans. (Technically, this gives us an 85 modality.) How do we formalize the sentence above? Let c be a constant symbol whose intended meaning is, "the proposed tax cut," and let G be a "goodness" predicate. Then OG(c) seems reasonable as a formalization. What should it mean to say it is true for R?


One possibility is that R means every Republican thinks the tax cut is good, as R understands the word good. This may not be what was meant. After all, R might consider something good only if it personally benefitted him. Another Republican might think something good if it eventually benefitted the poor. Such a Republican probably would not think a tax cut good simply because it benefitted R but he might believe it would eventually benefit the poor, and so would be good in his own sense. Probably R is saying that every Republican thinks a tax cut is good, for his own personal reasons. The notion of what is good can vary from Republican to Republican, provided they all agree that the proposed tax cut is a good thing. But the mere fact that we can consider more than one reading tells us that a simple formalization like DG(c) is not sufficient.

Here will be presented a logic of both intension and extension, of both sense and reference. In one of the examples above, color is an intensional object. It is a function from persons to sets of concepts like red, blue, and so on. As such, it is the same function for each person. The extension of color for a particular person is the color function evaluated at that person, and thus it is a particular set of concepts, such as red but not infra-red, and so on, quite possibly different from person to person. We need a logic in which both intensions and extensions are first-class objects. The machinery for doing this makes for complicated looking formulas. But I point out, in everyday discourse all the machinery is present but hidden-we infer it from our knowledge of what we think must have been meant. Formalization naturally requires complex machinery-it is making explicit what our minds do automatically.

2. Types and Syntax Now begins the formal treatment, starting with the notion of type. I

want it to include the types of classical logic, as defined in Section 1. I also want it to include the purely intensional types of the Montague tradition, as given in [Gal75].

DEFINITION 7.1 (TYPE) The notion of a type, extensional and intensional, is given by the following.

1 0 is an extensional type.

2 If t1, ... , tn are types, extensional or intensional, (t1, ... , tn) is an extensional type.

3 If t is an extensional type, jt is an intensional type.

A type is an intensional or an extensional type.

The ideas behind the definition above are these. As usual, 0 is to be the type of ground-level objects, unanalyzed "things." The type (t1, ... , tn) is intended to be analogous to types in part I. The type jt is the new piece of machinery-an object of such a type will be a function on possible worlds. Recall the example involving colors from Section 1; it can be used to give a sense of how these types are intended to be applied. In that example, real-world objects are those of type 0. A set of real-world objects is of type (0) so, for instance, the set of objects some particular person considers red is of this type; this is the extension of red for that person. The intensional object red, mapping each person to that person's set ofred objects, is of type j(O). A set of such intensional objects is of type (j(O)), so for a particular person, that person's set of colors is of this type-the extension of color for that person. Finally, the intensional object color, mapping each person to that person's set of colors, is an object of type i(j(O)).

For another example, assume possible worlds are possible situations, and the ground-level objects include people. In each particular situation, there is a tallest person in the world. The tallest person, in each situation, is an object of type 0. The tallest person concept is an object of type jO-it associates with each possible world the tallest person in that possible world.

As a final example example, suppose t is an extensional type, so that jt is intensional. The two-place relation: the intensional object X of type jt has the extensional object y of type t as its extension, is a relation of type (jt, t).

The language of Part I must be expanded to allow for modality. Just as classically, C is a set of constant symbols of various types, containing at least an equality symbol =(t,t) for each type t, though the set of types is now larger. Note that the equality symbols themselves are of extensional type. Using them we can form the intensional terms (>.x, y.x = y) and (>.x, y.D(x = y)), as needed. We also have variables of each type. There is one new piece of machinery, an operator l, which plays a role in term formation. As usual, terms and formulas must be defined together in a mutual recursion.

DEFINITION 7.2 (TERM OF L(C)) Terms are characterized as follows.

1 A constant symbol or variable of L( C) of type t is a term of L( C) of type t. If it is a constant symbol, it has no free variable occurrences. If it is a variable, it has one free variable occurrence, itself.

2 If is a formula of L( C) and 0:1, ... , O:n is a sequence of distinct variables of types t1, ... , tn respectively, then (>..o:1, ... , O:n.) is a

term of L( C) of the intensional type j (t1, ... , tn). Its free variable occurrences are the free variable occurrences of , except for occurrences of the variables a1, ... , an.

3 If 7 is a term of L(C) of type jt then 17 is a term of type t. It has the same free variable occurrences that 7 has.

The predicate abstract (Aa1, ... , an. ) is of type j(t1, ... , tn) above, and not of type (t1, ... , tn), essentially because can vary its meaning from world to world, and so (Aa1, ... , an.) itself is world dependent.

Case 3 above makes use of what may be called an extension-of operator, converting a term of an intensional type to a term of the corresponding extensional one. Continuing with the color example, suppose r is the intensional notion of red, of type j(O), mapping each person to that person's set of red objects. Then for a particular person, 1r is that person's set of red objects-the extension of r for that person, and an extensional object of type (0).

Of course the symbols j and 1 were chosen to suggest their roles-in a sense 1 'cancels' j. Nonetheless, 1 is a symbol of the language, while j occurs in the metalanguage, as part of the typing mechanism.

DEFINITION 7.3 (MODAL FORMULA OF L(C)) The definition of for-mula of L( C) is as follows:

1 If 7 is a term of either type (t1, ... , tn) or type i (t1, ... , tn), and 71, ... , 7n is a sequence of terms of types t1, ... , tn respectively, then 7(71, ... , 7n) is a formula {atomic) of L(C). The free variable occurrences in it are the free variable occurrences of 7, 71, ... , 7n·

2 If is a formula of L( C) so is -,q>. The free variable occurrences of -,q> are those of .

3 If and \lT are formulas of L( C) so is ( 1\ \lf). The free variable occurrences of ( 1\ \lf) are those of together with those of \lf.

4 If is a formula of L(C) and a is a variable then (\fa) is a formula of L( C). The free variable occurrences of (\fa ) are those of , except for occurrences of a.

5 If is a formula of L( C) so is D. The free variable occurrences of D are those of .

Item 1 above needs some comment, and again the example concerning colors should help make things clear. Suppose r is the intensional notion of red, of type j(O). And suppose cis an extensional notion of color,


the set of colors for a particular person-call the person George. Also let C be the intensional version of color, mapping each person to that person's extension of color. cis of type (i(O) ), and Cis of type j(j(O)) I take both C(r) and c(r) to be atomic formulas. If we ask whether they are true for George, no matter which formula we use, we are asking if r is a color for George. But if we ask whether they are true for Natasha, we are asking different questions. C(r) is true for Natasha if r is a color for Natasha, while c(r) is true for Natasha if r is a color for George. No matter which, both c(r) and C(r) make sense, and are considered well-formed.

I use 0 to abbreviate ...,o..., in the usual way, or I tacitly treat it as primitive, as is convenient at the time. And of course other propositional connectives and the existential quantifier will be introduced as needed. Likewise outer parentheses will often be dropped.

3. Constant Domains and Varying Domains Should quantifiers range over what does exist, or over what might

exist? That is, should they be actualist or possibilist? This is really a first-order question. A flying horse may or may not exist. In the world of mythology, such a being does exist. In the present world, it does not. But the property of being a flying horse does not exist in some worlds and lack existence in others. In the present world nothing has the flying-horse property, but that does not mean the property itself is non-existent. Thus actual/possible existence issues really concern type 0 objects, so the discussion that follows assumes a first-order setting.

As presented in [HC96] and [FM98], the distinction between actualist and possibilist quantification can be seen to be that between varying domain modal models and constant domain ones. In a varying domain modal model, one can think of the domain associated with a world as what actually exists at that world, and it is this domain that a quantifier ranges over when interpreted at that world. In a constant domain model one can think of the common domain as representing what does or could exist, and this is the same from world to world. Of course a choice between constant and varying domain models makes a substantial difference: both the Barcan formula and its converse are valid in a constant domain setting, but neither is in a varying domain one.

As it happens, while a choice between constant and varying domain models makes a difference technically, at a deeper level such a choice is essentially an arbitrary one. If we choose varying domains as basic, we can restrict attention to constant domain models by requiring the Barcan formula and its converse to hold. (Technically this requirement involves an infinite set of formulas, but if equality is available a single formula will


do.) Thus when using actualist quantification, we can still determine constant domain validity. The other direction is even easier. If we have possibilist-constant domain-:-quantification we can also determine varying domain validity. And on this topic I present a somewhat more detailed discussion.

Suppose quantification is taken in a possibilist sense--domains are constant. Nonetheless, at each world we can intuitively divide the common domain into what 'actually' exists at that world and what does not. Introduce a predicate symbol E of type j(O) for this purpose. At a particular world, E(x) is true if x has as its value an object one thinks of as existing at that world, and is false otherwise. Then the effect of varying domain quantification can be had by relativising all quantifiers to E. That is, replace (Vx)r.p by (Vx)(E(x) :) r.p) and replace (3x)r.p by (3x)(E(x) 1\ r.p). What we get, at least intuitively, simulates an actualist version of quantification.

All this can be turned into a formal result. Suppose we denote the relativization of a first-order formula r.p, as described above, by r.pE. It can be shown that r.p is valid in all varying domain models if and only if r.pE is valid in all constant domain models. Possibilist quantification can simulate actualist quantification. I note in passing that [Coc69] actually has two kinds of quantifiers, corresponding to actualist and possibilist, though it is observed that a quantifier relativization of the sort described above could be used instead.

The discussion above was in a first-order setting. As observed earlier, when higher types are present the actualist/possibilist distinction is only an issue for type 0 objects. I have made the choice to use possibilist type 0 quantifiers. The justification is that, first, such quantifiers are easier to work with, and second, they can simulate actualist quantifiers, so nothing is lost. When I say they are easier to work with, I mean that both the semantics and the tableau rules are simpler. So there is considerable gain, and no loss.

Officially, from now on the formal language will be assumed to contain a special constant symbol, E, of type j (0), which will be understood informally as an existence predicate.

4. Standard Modal Models I begin the formal presentation of semantics for higher-order modal

logic with the modal analog of standard models. The new piece of semantical machinery added to that for classical logic is the possible world structure.


DEFINITION 7.4 (KRIPKE FRAME) A Kripke frame is a structure (Q, R). In it, g is a non-empty set (of possible worlds), and R is a binary relation on g (called accessibility). An augmented frame is a structure (Q, R, V) where (Q, R) is a frame, and V is a non-empty set, the (ground-level) domain.

The notion of a Kripke frame should be familiar from propositional modal logic treatments, and I do not elaborate on it. As usual, different restrictions on R give rise to different modal logics. The only two I will be interested in are K, for which there are no restrictions on R, and 85, for which R is an equivalence relation. Note that the ground-level domain, V, is not world dependent, since the choice was to take type-0 quantification as possibilist and not actualist.

Next I say what the objects of each type are, relative to a choice of ground-level domain. This is analogous to what was done in Part I, in Definition 2.1. To make things easier to state, I use some standard notation from set theory. The first item is something that was used before, but I include it here for completeness sake.

1 For sets A1, ... , An, A1 x · · · x An is the collection of all n-tuples of the form (a1, ... , an), where a1 E A1, ... , an E An. The 1-tuple (a) is generally identified with a.

2 For a set A, P(A) is the power set of A, the collection of all subsets of A.

3 For sets A and B, A B is the function space, the set of all functions from B to A.

DEFINITION 7.5 (OBJECTS, EXTENSIONAL AND INTENSIONAL) Let g be a non-empty set (of possible worlds) and let V be a non-empty set (the ground-level domain). For each type t, I define the collection [t, V, Q], of objects of type t with respect to V and Q, as follows.

1 [O,V,Q] =V.

2 [(t1, ... , tn), V, Q] = 'P([t1, V, Q] X"· X [tn, V, Q]).

3 [jt, V, Q] = [t, V, Q]g.

0 is an object of type t if 0 E [t, V, Q]. 0 is an intensional or extensional object according to whether its type is intensional or extensional. As before, 0 is used, with or without subscripts, to stand for objects.

Now the final notion of the section.

DEFINITION 7.6 (MODAL MODEL) A (higher-order) modal model for L(C) is a structure M = (Q, R, V,I), where (Q, R, V) is an augmented frame and I is an interpretation .. The interpretation I must meet the following conditions.

1 If At is a constant symbol of type t, I(At) is an object of type t, that is, I(At) E [t, V, Q].

2 If =(t,t) is an equality constant symbol, I( =(t,t)) is the equality relation on [t, V,Q].

5. Truth in a Model In this section I say how truth is to be assigned to formulas, at worlds,

in models, and how values should be assigned to terms. I lead up to a proper definition after a few preliminary notions.

DEFINITION 7.7 ((MODAL) VALUATION) The mapping v is a modal valuation in the modal model M = (9, R, V,I) if v assigns to each variable at of type t some object of type t, that is, v( at) E [t, V, Q]. The notion of a variant valuation is defined exactly as classically.

A term like lr is intended to designate the extension of the intensional object designated by T. To determine this a context is needed-the designation of T where, under what circumstances? The notation I'll use for a designation function is (v *I* f)(T), where vis a valuation, I is an interpretation, and r is a context, a possible world. (In fact the context only matters for terms of the form lT.)

In specifying the designation of a term, the predicate abstract case requires information about formula truth. This is more complex than classically, again because a context must be specified-truth under what circumstances, in which possible world. The notation for this is a modification of what was used earlier. I'll write M, r lf-v <P to mean formula <P is true, with respect to valuation v, in model M, at possible world r.

Just as classically, term designation and formula truth must be defined together, in one big recursion. Definitions 7.8 and 7.9 really are two parts of the same definition-they have been separated for pedagogical reasons only.

Recall the special notation that was introduced in Definition 2. 7. That is extended to the present setting in the obvious way:

means M, r lf-w <P where w is the a1, ... , an variant of v such that w(ai) = 01, ... , w(an) =On.

DEFINITION 7.8 (DESIGNATION OF A TERM) Let M = (Q, 'R, V,I) be a modal model, let v be a valuation in it, and let r E g be a possible world. Define a mapping ( v * I * r), assigning to each term an object that is the designation of that term.

1 If A is a constant symbol of L(C) then (v *I* r)(A) = I(A).

2 If a is a variable then (v *I* r)(a) = v(a).

31fT is a term oftype jt then (v*I*r)(lT) = (v*I*r)(T)(r)

4 If(>-.a1, ... ,an.4>) isapredicateabstractofL(C) oftypej(tl, ... ,tn), then ( v *I* r) ( (>-.a1, ... , an. 4>)) is the function f on possible worlds given by the following.

Item 3 is a little awkward to read. ( v *I * r) ( T) (r) means: evaluate T using ( v * I * r), getting a function, an intension, then evaluate that function at r. Generally the simpler notation ( v * I * r) ( T, r) will be used for this. Similarly for v(a, r) and I( A, r), when a and A are of intensional type.

Item 4 tells us this is part of a mutual recursion-Definition 7.9 below is the other part. Without using the special notation, part 4 of Definition 7.8 reads as follows.

4 If (>-.a1, ... , an.4>) is a predicate abstract of L(C) of type j(t1, ... , tn), then ( v * I * r) ( (>-.a1, ... , an. )) is the function that assigns to an arbitrary world~ the following member of [ (t1, ... , tn), V, Q]:

{(w(a1), ... ,w(an)) I w is an a1, ... ,an variant ofv

and M,~ 11--w }

The next item should be compared with Definition 2.6: worlds (contexts) must now be taken into account.

DEFINITION 7.9 (TRUTH OF A FORMULA) Let M = (Q, 'R, V,I) be a modal model, and let v be a valuation in it. The notion of formula 4> being true at world r of g in model M with respect to v, denoted M, r 11-v 4>, is characterized as follows.

1 For an atomic formula T( Tl, . .. , Tn),

{a) lfT is of an extensional type, M,r 11-v T(TI, ... ,Tn) provided ((v*I*r)(TI), ... ,(v*I*r)(Tn)) E (v*I*r)(T).

(b) If T is of an intensional type, M, r lf-v T(T1, ... 'Tn) provided M' r If-v (1 T) ( 71' . . . ' T n). This reduces things to the previous case.

2 M, r If-v --,<fl if it is not the case that M, r If-v <P.

3 M,r lf-v <P 1\ w if M,r lf-v <P and M,r lf-v w.

4 M, r lf-v (Va)<P if M, r lf-v <P[a/0] for all objects 0 of the same type as a.

5 M, r lf-v D<P if M, D. lf-v <P for all D. E g such that rnD..

As usual, other connectives, quantifiers, and modal operators can be introduced via definitions, with the expected behavior. For instance: M, r lf-v O<P if M, D. lf-v <P for some D. E g such that rnD..

Note that part 4, the quantifier case, can also be given as follows.

4 M, r lf-v (Va)<P if M, r lf-v' <P for every a-variant v' of v.

It follows from the definitions, that M, r lf-v D<P[ai/0~, ... , an/On] if and only if M, D. lf-v <P[ai/01, ... , an/On] for all D. such that rnD.. It also follows from the definitions that (.Aa.<P(a))(r) and <P(r) are equivalent under certain circumstances. For instance, this is the case if T is a constant symbol of either intensional or extensional type. It is not the case if T involves the extension-of operator, l· Rather than give exact conditions, I give the following, which is more useful for present purposes-it is an immediate consequence of the definitions above.

PROPOSITION 7.10 Suppose that (v *I* r)(rl) = 01, ... , (v *I* r)(rn) =On in model M. Then

M, r lf-v (.Aa1, ... 'an.<P)(TI, ... 'Tn) {:;} M, r lf-v <P[ai/01, ... 'an/On]·

6. Validity and Consequence Validity in a modal setting is now straightforward to define, but con

sequence has a few surprises, so I've devoted a separate section to the matter. Let us begin with what is simple.

DEFINITION 7.11 (VALIDITY) A formula is K-valid if it is valid in all models, and is S5-valid if it is valid in all models for which the accessibility relation is an equivalence relation.

I'll only be interested in sentences, for which the choice of valuation is essentially irrelevant. In addition to the notion of validity in models, a notion of frame validity can also be introduced. This is an important concept, but it is not needed for the purposes of this book and I omit discussion of it.

Logical consequence is inherently more complex than validity. When asking about the consequences of some set of sentences, one must distinguish between sentences like "it is raining" and "rain is wet." The first sentence, "it is raining" may be true in present circumstances, but certainly it is not the case always. The second sentence, "rain is wet," presumably is true no matter what-it is independent of circumstance. This gives rise to an important formal distinction. I'll say something is a global assumption if we take it to be the case at every possible world, and something is a local assumption if we take it to be the case in the current possible world. The two kinds of assumptions behave quite differently. Clearly global assumptions are taken to be not only true, but necessary. That is not the case with local assumptions.

In the following, I'll use the expression 'true at a world' with the obvious meaning.

DEFINITION 7.12 (CONSEQUENCE) LetL be one ofK orS5, letS and U be sets of sentences of L( C), and be a single sentence. is a consequence of global assumptions S and local assumptions U provided that for every L model M = (g, R, 'D,I), if members of S are true at every world in g, then is true at each world at which members of U are true.

Factual items would, most naturally, be local assumptions, while logical principles would be global. Tableau rules differ for the two kinds of assumptions. [Fit83] has a detailed discussion of the notions, including appropriate versions of the deduction theorem. [Fit93] has a somewhat more abbreviated treatment.

7. Examples Here is a simple informal example to start with. Suppose we take

possible worlds to be points in time (within a reasonable range from near past to near future). Also take the accessibility relation to always hold, so that D means holds at all times. Does there exist, now, somebody whose parents are necessarily not alive? Certainly-the oldest person in the world. After all, the oldest person can never have living parents. But on the other hand, there was a time when the oldest person had living parents. There seems to be a discrepancy here.


Say cp(x) is read as "x has no living parents." We are asking about the truth of (3x)Dcp(x). The key question is, what type of variable is x? If we think of the quantifier as ranging over objects-so x is of type 0-then when we say the oldest person in the world instantiates the existential quantifier we are saying a particular person does so. If we designate the oldest person now as the value of x, instantiating the existential quantifier, while cp(x) is certainly true now for this value of x, there are earlier worlds in which the person who is the oldest now had living parents. Thus we do not have Ocp(x), where x has as value the oldest person in the present world. The proposed instantiation for the existential quantifier does not work. More generally, it is easy to see that (3x)Dcp(x) can never be true, now or at any other point of time, provided we think of quantifiers as ranging over objects or individuals.

On the other hand if quantifiers range over individual concepts-so that x is of type jO-we would certainly have the truth of (3x)Dcp(x) since taking the value of x to be the oldest-person concept would serve as a correct instantiation of Ocp(x).

The type theory of [Bre72] makes intensional objects basic. The second-order logic of [Coc69] quantifies over extensional objects at the first-order level, and over intensional objects at the second-order level. The higher-order modal logic of [Fit98], which is a forerunner to this book, had quantification only over extensional objects. The first-order treatment of [FM98] involves a kind of mixed system, and more will be said about it shortly. The system of [FitOOb] has quantifiers over types 0 and jO. Clearly many variations are possible.

Now for some further examples, which will be treated more formally.

ExAMPLE 7.13 Suppose x is a variable of type 0 and P is a constant symbol of type j(O). The following formula is valid, where X is of type j(O).

(.XX.0(3x)X(x))(P) :::> 0(-AX.(:Jx)X(x))(P) (7.3)

I leave it to you to verify the validity of this-one way is to show both the antecedent and the consequent are equivalent to O(:Jx)P(x). On the other hand, the following formula is not valid, where X is of type (0).

(.XX.O(:Jx)X(x))(lP) :::> 0(-AX.(:Jx)X(x))(lP) (7.4)

Here is an informal illustration to help you understand intuitively why this formula is invalid. Suppose that on an island there are two societies,


optimists and pessimists, separated by a volcano. Let us say the optimists, while generally positive in their outlook, are quite insecure and don't accept something as possible (even if true) unless the pessimists believe it. Further, the optimists think the volcano is beautiful, while the pessimists think nothing is beautiful.

Take for P the concept of beauty-it maps each society to the set of things that society accepts as beautiful. For the optimists the formula (.XX.O(:Jx)X(x))(lP) is true for the following reasons. In the optimist society the extension of P is the set consisting of the volcano, so the formula asserts O(:Jx)X(x) is the case, when X is understood to be that set. For optimists, (3x)X(x) is possible if the pessimists believe it, and even the pessimists would agree that something is in the set consisting of the volcano. On the other hand, O(.XX.(:lx)X(x))(lP) is not true for the optimists, because (.XX.(:Jx)X(x))(lP) is not the case for the pessimists, and this happens because the pessimists do not think anything is beautiful.

This informal example can be turned into a formal argument. Here is a model, M = (g, 'R, 'D,I), in which (7.4) is not valid. The collection of worlds, Q, contains two members, r and ~' with rn~. Think of r as the optimists and ~ as the pessimists. The domain, 'D is the set {7} (think of the number 7 as the volcano). I show 7 available at both worlds as a reminder that domains are constant. The constant symbol P is interpreted to be a type j(O) object: the function that is {7} at r and 0 at ~. Thus I(P) is true of 7 at r, and of nothing at ~. This gives us the model presented schematically below.

r [2] I(P, r) = {7}

1 ~ [2] I(P,~) = 0

The first claim is that, for an arbitrary valuation v, we have

M, r 11-v (.XX.O(:lx)X(x))(lP). (7.5)

Since (v *I* r)(lP) = (v *I* r)(P, r) = I(P, r) = {7}, by Proposition 7.10 we will have (7.5) provided we have

M,r 11-v O(:lx)X(x)[X/{7}] (7.6)


which will be the case provided we have

M, ~ 11-v (3x)X(x)[X/{7}].

But, since 7 E {7}, we have

M, ~ 11-v X(x)[X/{7}, x/7]

and hence we have (7.7). We thus have established (7.5). Next it is shown that

M, r IYv O(.XX.(3x)X(x))(!P)

which, together with (7.5), gives us the invalidity of (7.4). Well, suppose otherwise, that is, suppose we had

M, r 11-v O(.XX.(3x)X(x))(lP).

Then we must have

M, ~ 11-v (.XX.(3x)X(x))(!P),

and so, since (v *I* ~)(!P) = 0,

M, ~ 11-v (3x)X(x)[X/0].

(7.7)

(7.8)

(7.9)

(7.10)

(7.11)

(7.12)

It is easy to see we can not have this, and thus we have (7.9).

EXAMPLE 7.14 This example is one that is unexpected on superficial consideration, although deeper thought says it should not be. The following formula is valid, with types of variables and constants as in ( 7.4).

(.XX.0(3x)X(x))(!P) :J (.XX.(3x)X(x))(!P) (7.13)

To show validity, suppose M = (Q, R, V,I) is an arbitrary model, r E g is an arbitrary world, and v is an arbitrary valuation. Suppose

M, r 11-v (.XX.0(3x)X(x))(tp). (7.14)

Then

M, r 11-v 0(3x)X(x)[X/O] (7.15)

where 0 = ( v *I* r) (lP) = I(P, r). Then, for some ~ E g such that rR~,

M, ~ 11-v (3x)X(x)[Xj0] (7.16)


and so, for some object o we have

M, Llll-v X(x)[X/0, xjo]. (7.17)

For (7.17) to be the case, we must have o E 0. Now,

M, r 11-v X(x)[X/0, xjo] (7.18)

since o E 0. Consequently

M, r 11-v (3x)X(x)[X/O] (7.19)

and finally,

M, r 11-v (>.X.(3x)X(X))(!P) (7.20)

since 0 = (v *I* f)(JP). Since we went from (7.14) to (7.20), the validity of (7.13) has been

established.

Some comments on the example above. The point is, the term 1 P is given broad scope in both the antecedent and the consequent of the implication. This essentially says its meaning in alternative worlds will be the same as in the present world. Under these circumstances, existence of something falling under 1P in an alternate world is equivalent to existence of something falling under !P in the present world. This is just a formal variation on the old observation that in Kripke models, if relation symbols could not vary their interpretation from world to world, modal operators would have no visible effect.

The distinction between intensional and extensional types is complex. The following two examples should help make clear the role of the 1 operator.

EXAMPLE 7.15 Let x and c be of type jO, and P be of type j(jO). The following formula is valid.

DP(c) :J (3x)DP(x) (7.21)

To show (7.21) is valid let M = (g, R, D,I) be an arbitrary model, r be an arbitrary world in g, and v be an arbitrary valuation. Suppose we had the following.

M, r 11-v DP(c) (7.22)

Let Ll be an arbitrary world such that fRLl. We must have


M, ~ 11-v P(c) (7.23)

from which it follows that

M, ~ 11-v P(x)[xji(c)]. (7.24)

Since ~ was arbitrary, we have

M, r 11-v DP(x)[x/I(c)] (7.25)

and hence

M, r 11-v (3x)OP(x) (7.26)

Since we went from (7.22) to (7.26), the validity of (7.21) has been established.

EXAMPLE 7.16 This continues the previous example. Let c again be of type jO, but now let x be of type 0 and P be of type j(O). The following formula is not valid.

DP(lc) :=) (3x)DP(x) (7.27)

To show the non-validity of (7.27) a specific model, M = (Q, n, 1J,I), is constructed. In this model, g consists of three possible worlds: r, ~' n. We have rn~, rnn, and R holds in no other cases. The domain 1J is {1, 2}. I interprets c by a function that is 1 at ~' 2 at n, and either 1 or 2 at r (it won't matter). Likewise I interprets P by the function that is {1} at ~' {2} at n, and some arbitrary value at r. Here is the model schematically.

~@J

I(c,~) = 1 I(P,~) = {1}

n@J I(c,n) = 2 I(P,O) = {2}


I leave it to you to check that (7.27) is not valid in this model.

EXAMPLE 7.17 The last example is in three parts. Consider the following three formulas, in which x, y, and z are of type 0, and X, Y, and Z are of type jO.

(V'Z)(..\x.D(..\y.x = y)(lZ))(lZ)

(V'z)(..\x.D(..\y.x = y)(z))(z) (V'Z)(..\X.D(..\Y.X = Y)(Z))(Z)

(7.28)

(7.29)

(7.30)

Of the formulas above, (7.28) is not valid, but (7.29) and (7.30) are both valid. I leave the work to you. I note that in [FM98] it was shown that, in a first-order setting, the constructions used above relate directly to rigidity. Both extensional and intensional objects, as such, are the same from world to world, but the extensional object designated by an intensional object can vary. This is what the example illustrates.

Exercises EXERCISE 7.1 Show that formula (7.3) is valid.

EXERCISE 7.2 This is a variation on formula (7.13); the formula looks the same, but the types are different. Show the validity of

(..\X.0(3x)X(x))(jP) :::> (..\X.(3x)X(x))(jP)

where xis of type jO and Pis of type j(jO). The fact that ground level quantification is possibilist---constant domain-will be needed.

EXERCISE 7.3 Show the validity of the following, which looks a little like a version of the Barcan formula: 0(3x)P(x) :::> (3X)OP(lX). In this x is of type 0, X is of type jO and P is of type j(O).

EXERCISE 7.4 Show the non-validity of the following, where x is of type 0, X is of type (0), and Pis of type j(O).

O(:lx)(..\X.X(x))(jP) :::> (:lx)(..\X.OX(x))(lP)

EXERCISE 7.5 Verify the claims made in Example 7.17.

8. Related Systems There have been many other versions of quantified modal logics in

the literature. Here I briefly say how a few of them relate to the one presented here.

First-order modal logic, as given in [Fit83] or [HC96] (which also contains a discussion of intensional objects) has variables and constant symbols of type 0, and predicate symbols of types j(O, 0, ... , 0). Thus quantification is over ground-level objects; constant symbols designate such objects and hence are rigid. Predicates, of course, vary in meaning from world to world-they are intensional. Treating them extensionally would force modal logic to collapse to classical.

In [FM98], conventional first-order modal logic is extended by allowing non-rigid terms, and an abstraction mechanism. Relating things to the present system, variables are still of type 0, but constant symbols are of type jO: they are individual concepts. Allowing intensional constant symbols greatly enhances the expressibility of the language. Predicate symbols are still of types j(O, 0, ... , 0). The fit between intension and extension is achieved by treating (Ax.) (c), where cis a constant symbol, as if it were (Ax.)(lc) in the present system. In effect, this means the logic of [FM98] can be embedded in the higher-type version given here. (Actually, this is not quite correct, since the logic of [FM98] allows function symbols, and partial designation, neither of which is the case here. But with these exceptions noted, the embedding claim is correct.)

Montague proposed a higher-order modal logic specifically as a logic of intensions, in [Mon60, Mon68, Mon70]. It is presented most fully in [Gal75]. Essentially it is the present system with only intensional types (except at the lowest level). More specifically, define a Gallin/Montague type, as follows.

1 0 is a Gallin/Montague type.

2 If t1, ... , tn are Gallin/Montague types, so is j(t1, ... , tn)·

Then the logic of [Gal75] can be identified with the sublogic of the system given here, in which all constant symbols and variables are restricted to be of some Gallin/Montague type. Indeed, the present system was created by adding extensional types to the logic of Gallin and Montague.

Bressan is a pioneer in the study of higher-order modal logics [Bre72]. I must confess that I do not fully understand his presentation. It is an 85 system rather like that of Gallin, though Gallin's is for a broader variety of logics. In it extensional objects are not explicitly present, but rather are identified with constant intensional objects. Also abstractions are not taken as primitive, but are defined in terms of definite descriptions.

9. Henkin/Kripke Models In the classical case there were good reasons for introducing non

standard higher-order models, and those same reasons apply in the


modal case as well. Since modal versions of Henkin and generalized Henkin models are relatively straightforward extensions of the classical versions, I confine things to a brief sketch, and refer to Part I and your intelligence for the details. ·

Definition 7.4 specified Kripke frames and augmented Kripke frames. What takes the place of augmented Kripke frames is the following.

DEFINITION 7.18 (HENKIN/KRIPKE FRAME) Let (Q, R) be a Kripke frame. 1t is a Henkin domain function in this frame if it is a function on the collection of types and:

1 'H(O) is some non-empty set.

2 'H((tl,··· ,tn)) ~ P('H(h) X··· X 'H(tn)); 'H((tl,··· ,tn)) =/= 0.

3 'H(jt) ~ ['H(t)]9; 'H(jt) =I= 0.

T is an interpretation if it maps each constant symbol of L( C) of type t to a member of'H(t). Finally, M = (Q, R, 'H,T) is a Henkin/Kripke frame for L(C).

If items 2 and 3 above hold with=, and not just ~.the Henkin/Kripke model is standard. Standard models correspond exactly to the models defined in Section 4.

DEFINITION 7.19 (ABSTRACTION DESIGNATION FUNCTION) Function A is an abstraction designation function in the Henkin/Kripke frame M = (Q, R, 1t, T), with respect to the language L(C), provided that for each valuation v in M and for each predicate abstract (>.a1, ... , an.cl>) of L(C) of type t, A(v, (>.a1, ... , an.cl>)) is some object of type t in M.

Term designation gets the obvious modification.

DEFINITION 7.20 (DESIGNATION OF A TERM)

Let M = (Q, R, 1t,T) be a Henkin/Kripke frame with A an abstraction designation function in it. For each valuation v, define a mapping ( v * T * r *A) assigning to each term a designation for that term, in the context (possible world} r. 1 If A is a constant symbol of L(C) then (v * T * r * A)(A) =I( A).

2 If a is a variable then (v * T * r * A)(a) = v(a).

3 Ifr is a term of type jt then (v*T*r*A)(lr) = (v*T*r*A)(r)(r).

4 If(>.al.··· ,an.cl>) isapredicateabstractofL(C) oftypej(tl,··· ,tn), then (v*T*r*A)((>.al,··· ,an.cl>)) =A(v,(>.al,··· ,an.cl>)).

As usual, (v *I* r * A)(T, r) is written for (v *I* r * A)(T)(r). Now truth, at a world, also has the expected characterization.

DEFINITION 7.21 (TRUTH OF A FoRMULA) Let M = (Q, R, 1l,I) be a Henkin/ Kripke frame, let A be an abstraction designation function, and let v be a valuation.

1 For an atomic formula T(TI, ... , Tn),

(a) lfT is of an intensional type, M,r lf-v T(TI, ... ,Tn) provided ((v*I*r*A)(TI), ... ,(v*I*r*A)(Tn)) E (v*I*r*A)(T,r).

{b) lfT is of an extensional type, M,r lf-v T(TI, ... ,Tn) provided ( ( v * I * r * A) ( TI)' .. . ' ( v * I * r * A) ( T n)) E ( v * I * r * A) ( T).

2 M, r lf-v,A • if it is not the case that M, r lf-v,A .

3 M, r lf-v,A 1\ w if M, r lf-v,A and M, r lf-v,A w. 4 For a of type t, M, r lf-v,A (Va) if M, r lf-v,A [ a/ OJ for every

0 E 1l(t).

5 M, r lf-v,A D if M, ~ lf-v,A for all~ E g such that rn~.

Finally, the following should be no surprise.

DEFINITION 7.22 (HENKIN/KRIPKE MODEL)

(M, A) is a Henkin/Kripke model provided that, for each predicate abstract (.Xa1, ... , an.) of L(C) of type jt, A(v, (.Xa1, ... , an.)) is the function f given by the following:

The various theorems concerning uniqueness of an abstraction designation function, if one exists, and the good behavior of substitution (Section 6) all carry over to the modal setting. I leave this to you.

The semantics just presented is extensional, in the sense of Part I. A modal analog of generalized Henkin models can also be developed, along the lines of Section 5. Objects in the Henkin domains are no longer sets, and an explicit extension function must be added. The generalization is straightforward but complex, and I also leave this to you.



Chapter 8

MODAL TABLEAUS

1. The Rules There are several varieties of tableaus for modal logic. This book uses

a version of prefixed tableaus. These incorporate a kind of naming device for possible worlds into the tableau mechanism, and do so in such a way that syntactic features of prefixes reflect semantic features of worlds. Prefixed tableau systems exist for most standard modal logics. Here I only give versions for K and 85 since these are the extreme cases. I refer you to the literature for modifications appropriate for other modal logics-see [FM98] for instance.

1.1 Prefixes There are two versions of what are called prefixes. The version for K

is more complex, and variations on it also serve for many other modal logics. The version for 85 is simplicity itself.

DEFINITION 8.1 (PREFIX) A K prefix is a finite sequence of positive integers, written with periods as separators {1.2.1.1 is an example). An 85 prefix is a single positive integer.

Think of prefixes as naming worlds in some (unspecified) model. Prefix structure is intended to embody information about accessibility between worlds. For K, think of the prefixes 1.2.1.1, 1.2.1.2, 1.2.1.3, etc. as naming worlds accessible from the world that 1.2.1 names. For 85 one can take each world as being accessible from each world, so prefixes are simpler. Prefixes have two uses in tableau proofs, qualifying formulas and qualifying terms. I begin with terms.

105

As was done classically, a larger language allowing parameters is used for tableau proofs, with parameters for each type. But in addition, an intensional term T is allowed to have a prefix. If we think of CJ as designating a possible world, we should think of CJ T as representing the extensional object that r designates at CT. Formally, if Tis of type jt, then CJ T is of type t. But writing prefixes in front of terms makes formulas even more unreadable than they already are. Instead, in an abuse of language, I have chosen to write prefixes on terms as subscripts, Tr,-, though of course the idea is the same, and I still often refer to them as prefixes. So, if one thinks of CJ as designating possible world r, and r as having the function f as its meaning, then Ta should be thought of as designating the object f(r).

By L + (C) is meant L( C) enlarged with parameters, and allowing prefixes (written as subscripts) on terms of intensional type (this includes parameters, but prefixes will not be needed on free variables that are not parameters). This extends the classical version of L + (C), since prefixes are permitted now. But just as classically, in proving a closed formula of L( C) it is formulas of L + (C) that will appear in proofs.

I said prefixes had two roles. Qualifying formulas is the main one.

DEFINITION 8.2 (PREFIXED FORMULA) A prefixed formula is an expression of the form CJ , where CJ is a prefix and is a formula of L+(c).

Think of CJ as saying that formula is true at the world that CJ

names. Note that this use of prefixes does not compound, that is, CJ is a prefixed formula if is a formula, and not something built up from prefixed formulas.

DEFINITION 8.3 (GROUNDED) l call a term or a formula of L+(C) grounded if it contains no free variables, though it may contain parameters.

As usual, tableau proofs are proofs of sentences--closed formulas-of L(C). In the tableau, prefixed grounded formulas of L+(C) may appear. To construct a tableau proof of , begin with a tree that has 1 • at its root, and nothing else. Think of 1 as an arbitrary world. This initial tableau intuitively asserts that is false at some world of some model, the world designated by 1. Next the tree is expanded according to branch extension rules to be given below. If we produce a tree that is closed, which means it embodies a contradiction, we have a proof of .

MODAL TABLEAUS 107

1.2 Propositional Rules Since the modal tableau rules are rather complex, I've divided their

presentation into categories, beginning here with the propositional ones. These are much as in the classical case, except that prefixes must be "carried along." In these, and throughout, I use a, a', and the like to stand for prefixes.

DEFINITION 8.4 (CONJUNCTIVE RULES) For any prefix a,

aXI\Y aX aY

a •(X V Y) a•X a•Y

a •(X ::) Y) aX a•Y

aX =:Y aX:=>Y aY:=>X

DEFINITION 8.5 (DOUBLE NEGATION RULE) For any prefix a,

a••X aX

DEFINITION 8.6 (DISJUNCTIVE RULES) For any prefix a,

aXVY aX laY

aX::)Y a .x I a Y

a •(X 1\ Y) a ·X I a ,y

a •(X = Y) a •(X ::) Y) I a ·(Y ::) X)

This completes the classical connective rules. The motivation should be intuitively obvious. For instance, if X 1\ Y is true at a world named by a, both X and Y are true there, and so a branch containing a X 1\ Y can be extended with a X and a Y.

1.3 Modal Rules Naturally the rules for modalities differ between the two logics we are

considering. It is here that the structure of prefixes plays a role. The idea is, if OX is true at a world, X is true at some accessible world, and we can introduce a name-prefix-for this world. The name should be a new one, and the prefix structure should reflect the fact that it is accessible from the world at which OX is true.

DEFINITION 8. 7 (POSSIBILITY RULES FOR K) If the prefix a.n is new to the branch,

a OX a.nX

a•DX a.n •X

DEFINITION 8.8 (POSSIBILITY RULES FOR 85) If the positive integer n is new to the branch,

aOX a•DX nX n•X

Notice that for both logics there is a newness condition. This implicitly treats 0 as a· kind of existential quantifier. Correspondingly, the following rules treat 0 as a version of the universal quantifier.

DEFINITION 8.9 (NECESSITY RULES FORK) If the prefix a.n already occurs on the branch,

a OX a.nX

a•OX a.n•X

DEFINITION 8.10 (NECESSITY RULES FOR 85) For any positive integer n that already occurs on the branch,

a OX nX

a•OX n•X

Many examples of the application of these propositional and modal rules can be found in [FM98J. I do not give any here. Rather, tableau examples will be given after the full higher-type system has been introduced.

1.4 Quantifier Rules For the existential quantifier rules parameters must be introduced,

just as in the classical case. Thus proofs of sentences of L( C) are forced to be in the larger language L + (C).

DEFINITION 8.11 (EXISTENTIAL RULES) In the following, pt is a parameter of type t that is new to the tableau branch.

a (:l<i)cJ>( oJ) a cf>(pt)

a •(Vo:t)cf>( o:t) a -,cf>(pt)

Terms of the form lT may vary their denotation from world to world of a model, because the extension of the intensional term T can change from world to world. Such terms should not be used when instantiating a universally quantified formula.

DEFINITION 8.12 (RELATIVIZED TERM) If T is a grounded intensional term, lT is a relativized term.

MODAL TABLEAUS 109

DEFINITION 8.13 (UNIVERSAL RULES) In the following, 7t is any grounded term of type t that is not relativized.

a ('v'at)<P(at) ·

a (7t)

1.5 Abstraction Rules

a •(3at)( at)

a •<l>( 7t)

The rules for predicate abstracts essentially correspond to Proposition 7.10. Note the presence of a subscript (prefix) on the predicate abstract. We must know at what world the abstract is to be evaluated before doing so. The next subsection provides machinery for the introduction of these subscripts. Note that the subscript on the abstract, and the prefix for the entire formula need not be the same.

DEFINITION 8.14 (ABSTRACT RULES) In the following, 71, ... ,7n are non-relativized terms.

a' (>.a1, ... , an.<P( a1, ... , an)) u( 71, ... , 7n)

a<fl(71, ... ,7n)

a' •(.Aa1, ... , an.<P( a1, ... , an)) u( 71, ... , 7n)

a --,<fl(71, ... , 7n)

1.6 Atomic Rules Unlike classically, much can be done with atomic formulas in a modal

tableau besides just using them to close branches. The first atomic rule says that, at a world, an intensional predicate applies to terms if those terms are in the extension of the predicate at that world. It corresponds to part 1a of Definition 7.9.

DEFINITION 8.15 (INTENSIONAL PREDICATION RULES) Let 7 be a grounded intensional term, and 71, ... , 7n be arbitrary grounded terms.

a7(71, ... , 7n) a•7(71,··· ,7n) a (17)(71, ... , 7n) a•(l7)(71,··· ,7n)

Relativized terms denote different objects in different worlds. In tableaus, their behavior depends on the prefix of the formula in which they appear. This leads us to the evaluation of relativized terms at prefixes. Think of 7@a as 7 evaluated at a. On non-relativized terms, such evaluation has no effect-their meaning is world independent.

DEFINITION 8.16 (EVALUATION AT A PREFIX) Let a be a prefix.

1 For a relativized term lT, set (lT)@O" = Tu.

2 For a non-relativized term T, set T@O" = T.

The next rule covers the case of an extensional predicate applying to terms. This corresponds to part lb of Definition 7.9.

DEFINITION 8.17 (EXTENSIONAL PREDICATION RULES) Let T be a grounded extensional term, and Tl, ... , Tn be arbitrary grounded terms.

Here is a simple example of how these rules work. Suppose A is of intensional type j(O) and b is of type 0. If O" A(b) occurs on a branch, we may add O" (lA)(b) by an Intensional Predication Rule. Now the Extensional Predication Rule applies; (lA)@O" = A,. and b@O" = b, so we may add O" Au(b). Think of this as saying, since A(b) is true at the world that O" designates, then b is in the extension of A at that world, an extension represented by Au.

Finally, there are atomic formulas that must evaluate the same way no matter what world is involved.

DEFINITION 8.18 (WORLD INDEPENDENT) We call an atomic formula T(T1, ... ,Tn) world independent if none ofT, Tl, ... , Tn is relativized, and T is of extensional type.

DEFINITION 8.19 (WORLD SHIFT RULES) Let T(Tl, ... , Tn) be world independent. If 0"1 already occurs on the branch,

O"T(Tl,. · · ,Tn) 0"1 T( Tt, ... , Tn)

0"-,T(Tl,··· ,Tn) 0"1 -,T( Tl, ... , Tn)

1. 7 Proofs and Derivations I'll begin with the easy part.

DEFINITION 8.20 (CLOSURE) A tableau branch is closed if it contains O" w and O" -.w, for some formula W of L+(C). A tableau is closed if each branch is closed.

DEFINITION 8.21 (TABLEAU PROOF) For a sentence <P of L(C), a closed tableau beginning with 1 -.<P is a proof of <P.

A brief discussion of the complexities of modal consequence is in Section 6. More discussion can be found in [Fit83, Fit93, FM98]. Corresponding to the local/global semantic distinction of Definition 7.12, we have the following tableau version.

MODAL TABLEAUS 111

DEFINITION 8.22 (LOCAL AND GLOBAL ASSUMPTIONS) Let 8 and U be sets of sentences of L( C). A tableau uses S as global assumptions and U as local assumptions if the following two tableau rules are admitted.

Local Assumption Rule If Y is any member of U then 1 Y can be added to the end of any open branch.

Global Assumption Rule If Y is any member of S then a Y can be added to the end of any open branch on which a appears as a prefix.

DEFINITION 8.23 (TABLEAU DERIVATION) A sentence has a derivation from global assumptions S and local assumptions U if there is a closed tableau beginning with 1 --,<]>, allowing the use of U and S as local and global assumptions respectively.

This concludes the presentation of the basic tableau rules. It is a rather complex system. In Section 2 I give a few examples of proofs using the rules. I omit soundness and completeness proofs. The arguments are elaborations of those given earlier for classical logic. Complexity of presentation goes up, but no fundamentally new ideas arise. Consequently they are left as a huge exercise.

There is one important consequence of the completeness proofs that we will need, however, and that is the fact that the system has the cutelimination property-see Theorem 4.32. Just as in the classical case (Corollary 4.34), it is a consequence of this that any previously proved result can simply be introduced into a tableau.

2. Tableau Examples Tableaus for classical logic are well-known, and even for propositional

modal logics they are rather familiar. The abstraction and predication rules of the previous section are new, and I give two examples illustrating their uses. The examples use the K rules; I do not give examples specifically for S5 here.

EXAMPLE 8.24 This provides a proof for (7.3) which was verified valid in Example 7.13. The formula is

(>.X.()(:Jx)X(x))(P) :J ()(>.X.(:lx)X(x))(P)

in which x is a variable of type 0 and X is a variable and P a constant symbol, both of type j(O).


1 ..,[(.XX.O(::Jx)X(x))(P) :J 0(-XX.(::Jx)X(x))(P)] 1. 1 (.XX.O(::Jx)X(x))(P) 2. 1 --,0(-XX.(::Ix)X(x))(P). 3. 1 l(.XX.O(::Jx)X(x))(P) 4. 1 (.XX.O(::Jx)X(x))I(P) 5. 1 O(::Jx)P(x) 6. 1.1 (::lx)P(x) 7. 1.1--,(.XX.(::Jx)X(x))(P) 8. 1.1--, l(.XX.(::Ix)X(x))(P) 9. 1.1--,(.XX.(::Jx)X(x))u(P) 10. 1.1--,(::lx)P(x) 11.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by intensional predication; 5 is from 4 by extensional predication; 6 is from 5 by predicate abstraction; 7 is from 6 by a possibility rule; 8 is from 3 by a necessitation rule; 9 is from 8 by intensional predication; 10 is from 9 by extensional predication; and 11 is from 10 by predicate abstraction.

It should be obvious that useful derived rules could be introduced. For instance, the passage from 2 to 4 to 5 to 6 could be collapsed. Such rules are given in the next section.

EXAMPLE 8.25 Here is a proof of (7.13), which was shown to be valid earlier.

{.XX.O(::Jx)X(x))(jP) :J (.XX.(::Ix)X(x))(jP)

See Example 7.14 for a discussion of the significance of this formula.

1 --,[(.XX.O(::Ix)X(x))(jP) :J (.XX.(::Jx)X(x))(jP)] 1. 1 (.XX.O(::Jx)X(x))(jP) 2. 1 --,(.XX.(:3x)X(x))(1P) 3. 1 1(-XX.O(::Ix)X(x))(jP) 4. 1 --, 1(-XX.(::Jx)X(x))(lP) 5. 1 (.XX.O(::Jx)X(x))I(Pl) 6. 1 --,(.XX.(::Ix)X(x))I(PI) 7. 1 O(::Jx)P1(x) 8. 1 --,(::Jx)PI(x) 9. 1.1 (:3x)P1(x) 10. 1.1 P1(p) 11. 1 P1(p) 12. 1 --,pl (p) 13.

In this, 2 and 3 are from 1 by a conjunction rule; 4 is from 2 and 5 is from 3 by intensional predication; 6 is from 4 and 7 is from 5 by extensional

MODAL TABLEAUS 113

predication; 8 is from 6 and 9 is from 7 by predicate abstraction; 10 is from 8 by a possibility rule; 11 is from 10 by an existential rule; 12 is from 11 by a world shift rule; and 13 is from 9 by a universal rule.

Exercises EXERCISE 2.1 Give a tableau proof of the following

(>.X.O(:lx)X(x))(tP) :J (>.X.(:lx)X(x))(lP)

where xis of type jO, X is of type (jO) and Pis of type j(jO).

EXERCISE 2.2 Give a tableau proof of the following

O(:lx)P(x) :J (:lX)OP(lX)

where x is of type 0, X is of type jO and Pis of type j(O).

3. A Few Derived Rules The tableau examples in the previous section are short, but already

quite complicated to read. In the interests of keeping things relatively simple, a few derived rules are introduced which serve to abbreviate routine steps.

DEFINITION 8.26 (DERIVED CLOSURE RULE) Suppose X is a world independent atomic formula. A branch closes if it contains a X and a' -,x.

The justification for this is easy. Using the World Shift Rule, if a X is on a branch, we can add a' X, and then the branch closes according to the official closure rule.

The official rule concerning intensional predication has a slightly more efficient version, in which we first apply intensional, then extensional predication rules.

DEFINITION 8.27 (DERIVED INTENSIONAL PREDICATION RULE) Let T be a grounded intensional term, and T1, ... , Tn be arbitrary grounded terms.

Also here are two derived rules for predicate abstracts, one in which the abstract has a prefix (subscript), one in which it does not.

DEFINITION 8.28 (DERIVED SUBSCRIPTED ABSTRACT RULE)

In the following, 71, ... , 7n are arbitrary grounded terms.

a' (.Xa1, ... , an.<P(a1, ... , an))u(71, ... , 7n) a<P(71@a', ... ,7n@a')

a'•(Aa1,··· ,an.<P(a1,··· ,an))u(71,··· ,7n) a -.<P(71 @a', ... , 7n@a')

This abbreviates the application of the extensional predication rule, followed by predicate abstraction.

DEFINITION 8.29 (DERIVED UNSUBSCRIPTED ABSTRACT RULE)

In the following, 71, ... , 7n are grounded terms.

a(.Aat, ... ,an.<P(a1,··· ,an))(7t, ... ,7n) a <P(71 @a, ... , 7n@a)

a •(.Xa1, ... , an.<P(a1, ... , an))( 71, ... , 7n) IT •iP( 71 @a, ... , 7n@a)

This rule abbreviates successive applications of intensional predication, extensional predication, and predicate abstraction.

Chapter 9

MISCELLANEOUS MATTERS

This chapter is something of a grab-bag. Some familiar topics, like equality, and some less familiar, like choice functions, are discussed.

1. Equality The tableau rules of the previous chapter do not mention equality or

extensionality. These are treated exactly as in the classical setting, via axioms, though as we will see, extensionality requires some care.

1.1 Equality Axioms If we want to take equality into account, we use the Equality Axioms,

Definition 5.1, as global assumptions. From here on these will be assumed in this book.

In Chapter 5 I presented some tableau rules that were derivable classically provided equality axioms were allowed. In the modal setting these rules (with prefixes added, of course) are also derived rules. They are stated again for reference.

Reflexivity Rule For a grounded, non-relativized term 7, and a prefix a that is already present on the branch,

Substitutivity Rule For grounded, non-relativized terms 71 and 72,

a <P(Tl) a (71 = 72)

a IP(72)

115


Here is an example that uses equality. To help understand what the example says, and see why it ought to be valid, I give an informal interpretation for it.

Suppose we read modal operators temporally, so that OX means X will be the case no matter what the future brings, and OX means the future could turn out to be one in which X is true. Let p be a type jO constant symbol intended to be read, "the President of the United States." Thus pis an individual concept, and designates different people in different possible futures.

Now, call a person Presidential material if the person could be President (say the person meets all the legal requirements, such as being at least 35, not having already served twice, and so on). Being Presidential material is a property of persons. If we assume we have a model whose domain is the population of the United States, being Presidential material is a type j (0) object and is expressed by the following abstract, where xis of type 0.

(>.x.O(lp = x))

Informally, this predicate applies to a person at a particular time if there is some possible future in which that person is the President of the United States.

Next, call a property of persons statesmanlike if it will always apply to the President. Thus we are using statesmanlike as a property of properties of persons-being diplomatic is hopefully a statesmanlike property, for instance. As such, being statesmanlike is of type j((O)). It is expressed by the following abstract, where X is of type (0), and applies to those properties that will always belong to the President, no matter who that will be.

(>.X.DX(lp))

Now, the extension of the property of being Presidential material is a statesmanlike property since, no matter who turns out to be President, that person must have been of Presidential material. The following gives a tableau verification for this.

EXAMPLE 9.1 Here is a proof of the formula:

(>.X.DX(lp))(t(>.x.O(lp = x)))

MISCELLANEOUS MATTERS 117

1 •(.AX.DX(lp))(l(.Ax.O(lp = x))) 1. 1 ·D(.Ax.O(lp = x))I(lp) 2. 1.1·(.Ax.O(lP = :t))I(lP) 3. 1.1•(Ax.O(lp = x))I(pu) 4. 1 •O(lP=pu) 5. 1.1•(1P = Pu) 6. 1.1•(Pu = Pu) 7. 1.1 (pu = Pu) 8.

In this 2 is from 1 by the derived unsubscripted abstraction rule; 3 is from 2 by a possibility rule; 4 is from 3 by extensional predication; 5 is from 4 by a predicate abstract rule; 6 is from 5 by a necessity rule; 7 is from 6 by extensional predication; 8 is by the derived reflexivity rule.

1.2 Extensionality Extensionality can, of course, be imposed by assuming the Extension

ality Axioms of Chapter 6, Definition 6.1, as global assumptions. The trouble is, doing so for intensional terms yields undesirable results, as the following shows.

PROPOSITION 9.2 Assume the Extensionality Axioms apply to intensional terms. If a and f3 are of intensional type j(t), then the following is valid.

(Va)(V,B)[(la =l/3) ~ (a= ,B)]

The proof of this is left to you. It is almost immediate, using the Intensional Predication Rules. The problem with this result is, it tells us that if two intensional objects happen to coincide in extension at some world, then they are identical and hence coincide at every world. Clearly this is undesirable, so extensionality for intensional terms is not assumed.

If two intensional objects agree in extension at every possible world of a model they are, in fact, the same. Saying this requires a quantification over possible worlds, which we cannot do. The following is as close as we can come.

DEFINITION 9.3 (EXTENSIONALITY FOR INTENSIONAL TERMS) For a and f3 of the same intensional type,

(Va)(V,B)[D(la =l/3) ~(a= ,B)]

I will assume this at some points, but I will be explicit when. For extensional terms, the extensionality axioms pose no difficulty and will always be assumed. Let me make this official.


Extensionality Assumptions From now on, the extensionality axioms will be assumed for extensional terms as global assumptions. For intensional terms extensionality, Definition 9.3, will only be assumed if explicitly stated.

I restate the extensionality axioms here for convenience.

DEFINITION 9.4 (EXTENSIONALITY FOR EXTENSIONAL TERMS)

Each sentence of the following form is an extensionality axiom, where a and {3 are of type (t1, ... , tn), 11 is of type t1, ... , In is of type tn.

('v'a)('v'{3){('v'11) · · · ('v'ln)[a(/'1, ·. · , In)= {3(/'1, ... , In)] :J [a= {3]}

In Chapter 6 a derived tableau rule for extensionality was given, assuming the extensionality axioms. Once again, it is still a derived rule for modal tableaus. Here is a statement of it.

Extensionality Rule For grounded, non-relativized extensional terms T1 and T2, and for parameters P1, ... , Pn that are new to the branch,

(}--, [T1(P1, · · · ,pn) = T2(P1, · · · ,Pn)JI (} (T1 = T2)

2. De Re and De Dicto

Loosely speaking, asserting the necessary truth of a sentence is a de dicta usage of necessity; for example, "it is necessary that the President of the United States is a citizen of the United States." This asserts the necessary truth of the sentence, "the President of the United States is a citizen of the United States." For this to be the case, it must be so under all circumstances, no matter who is President, and since being a citizen of the United States is a requirement for the Presidency, this is the case. Ascribing to an object a necessary property is a de re usage; for example, "it is a necessary truth, of the President of the United States, that he is at least 50 years old." This asserts, of the President, that he is and always will be at least 50 years old. Since the President, at the time of writing, is Bill Clinton, and he is at the moment 53 years old and will never be younger than this, this assertion is correct. But since the Constitution of the United States only requires that a President be at least 35, the assertion may not be true in the future, for a different President. If an object is identified using an intensional term, it makes a serious difference whether that term is used in a de dicta or a de re context, as the examples involving the Presidency illustrate. In this section the formal relationship between the two notions is explored. As will be seen over the next several sections, this also relates to other interesting concepts that have been part of historic philosophical discourse.

In the next few paragraphs, f3 is of some extensional type t, and Tis of the corresponding intensional type jt.

Consider the expression (.Xf3.D<l>(f3))(1 T), where <P(/3) is some formula with only f3 free (for simplicity). Say the expression is true at a world of a modal model. (I use a generalized Henkin/Kripke model, but what is said applies to any version--extensional, standard-just as well.) Thus suppose M, f lf-v,A (.Xf3.D<l>(f3))(lT). Let Or be the object that T designates at r, that is, (v*I*r*A)(T,f) =Or. Then we have M, r lf-v,A D<l>(/3)[/3/0r]. So at every alternative world, .6., we have M, .6. lf-v,A <P(/3)[!3/0r], that is <P(/3) is true, at .6., of the object that T

designates at r. The effect is that (.Xf3.D<l>(f3))(1T) asserts, of the object designated by T at r that it has a necessary property. This is a de re use of necessity-ascribing a necessary property to a thing.

Next consider the expression D(.Xf3.<l>(f3))(1 T). This asserts the necessity of a sentence. It is a de dicta use of necessity-applying it to a sentence, a dictum. And in general the behavior is quite different from the de re version. If M,r lf-v,A D(.Xf3.<l>(f3))(1 T), then at each alternative world .6. we have M, .6. lf-v,A (.Xf3.<l>(f3))(1 T), and so M, .6. lf-v,A <P(f3)[w/O.!l], where oil is the designation of T at .6., something that depends on .6.. We can thus think of the assertion D(.X/3.<1>(/3))(1 T) as being concerned with the sense ofT and not just with the object it happens to denote in "our" world-we use the local desigmrtion of T, which can vary from world to world.

One remarkable thing about de re and de dicta is that, if either happens to imply the other, for a particular term, then the two turn out to be equivalent for that term. The following makes this precise. In the next section the phenomena is linked to the notion of rigidity.

DEFINITION 9.5 (De Re/ De Dicta) LetT be a term of intensional type jt, f3 be a variable of type t, and o: be a variable of type j(t). In a model:

1 de re is equivalent to de dicto for T if the following is valid.

(Vo:)[(.Xf3.Do:(f3))(1T) = D(.Xf3.o:(f3))(1T)]

2 de re implies de dicto for T if the following is valid.

(Vo:)[(.Xf3.Do:(f3))(1T) ::) D(.Xf3.o:(f3))(1T)]

3 de dicto implies de re for T if the following is valid.

(Vo:)[D(.A,B.o:(,B))(lT) :J (.A,B.Do:(,B))(tr)]

The formulas above are allowed to be open--free variables may be present. Equivalently, one can work with universal closures. In [FM98]

we used schemas instead of the formulas given above, because that was a first-order treatment and we did not have the higher-type quantifier (Vo:) available. The interesting fact about the three notions above is: they all say the same thing.

PROPOSITION 9.6 For any intensional term T, the following are equivalent (in K).

1 de dicto is equivalent to de re for T

2 de dicto implies de re for T

3 de re implies de dicto for T

Proof Obviously item 1 implies items 2 and 3. I give a tableau proof, in K, showing that item 2 implies item 3. A similar argument, which I leave to you, shows that item 3 implies item 2, and this is enough to complete the proof of the Proposition. To keep things simple, assume T

has no free variables. Here is a closed tableau for •(Vo:)[(.A,B.Do:(,6))(l T) => D(.A,B.o:(,B))(lT)], (negation of) de re implies de dicto. In it, at a certain point, use is made of an instance of the de dicto implies de re schema. The tableau begins as follows.

1 •(Vo:) [(.A,B.Do:(,B))(lT) => O(.A,B.o:(,B))(lT)] 1. 1 ..., [(.A,B.D<P(,B))(lT) => D(.A,B.(,B))(lT)j 2. 1 (_A,6.0<l>(,6))(1T) 3. 1 •D(.A,B.<l>(,B))(lT) 4. 1 D( Tl) 5. 1.1•(A,6.<J?(,6))(1T) 6. 1.1·<l>(Tu) 7. 1.1 <f>(Tl) 8. 1 (Vo:)[O(.A,B.o:(,B))(lT) =:> (.A,B.Do:(,B))(lT)] 9. 1 D(.A,B.(AJ'.<l>(J') => <P(lT))(,B))(lT)

(.A,B.D(.A')'.<P(/') =:> <P(lT))(,6))(lT) 10.

Item 2 is from 1 by an existential rule, using <P as a new parameter of type j(t); items 3 and 4 are from 2 by a conjunctive rule; 5 is from 3 by an unsubscripted abstract rule; 6 is from 4 by a possibility rule; 7 is from 6 by an unsubscripted abstract rule; 8 is from 5 by a necessity rule. Item 9 is a de dicto implies de re formula; and item 10 is from 9 by a universal rule, using (.A')'.<P(/') =:> <P(lT)) to instantiate the quantifier.

Using item 10, the tableau splits into two branches. I first present the left one, and afterwards the right.


1 •D(.A,6.(A'Y.cf>(r) :) cf>(lT))(,6))(lT) 11. 1.2 •(A,6.(A/.cf>(r) :) cf>(lT))(,6))(1T) 12. 1.2 •(A/.cf>(r) :) cf>(lT))(Tl.2) 13. 1.2 •[cf>(TL2) :) cf>(lT)) 14. 1.2 cf>( TL2) 15. 1.2 --,cf>(lT) 16. 1.2 cf>1.2(T1.2) 17. 1.2 --,cf>L2( 71.2) 18.

121

Item 11 is from 10 by a disjunctive rule (recall, this is the left branch); 12 is from 11 by a possibility rule; 13 is from 12 and 14 is from 13 by an unsubscripted abstract rule; 15 and 16 are from 14 by a conjunctive rule; 17 is from 15 and 18 is from 16 by a derived intensional predication rule. The branch is closed because of 17 and 18.

Now I show the right branch, below item 10.

1 (.A,6.0(A/.cf>(r) :) cf>(lT))(,6))(1T) 19. 1 D(.A,.cf>('y) :) cf>(lT))(Tl) 20. 1.1 (A/.cf>(r) :) cf>(lT))(Tl) 21. 1.1 cf>(Tl) :) cf>(lT) 22.

/ ~ 1.1-.cf>(Tl) 23. 1.1 cf>(lT) 24.

1.1 cf>u ( Tu) 25. 1.1 •cf>u ( Tu) 26.

In this part, 19 is from 10 by a disjunctive rule; 20 is from 19 by an unsubscripted abstract rule; 21 is from 20 by a necessity rule; 22 is from 21 by an unsubscripted abstract rule; 23 and 24 are from 22 by a disjunctive rule; 25 is from 24 and 26 is from 7 by a derived intensional predication rule. Closure is by 8 and 23, and by 25 and 26. •

Exercises EXERCISE 2.1 Give the tableau proof needed to complete the argument for Proposition 9.6.

3. Rigidity In [Kri80] the philosophical ramifications of the notion of rigidity are

discussed at some length, with a key claim being that names are rigid. The setting is first-order modal logic, treated informally. A term is taken to be rigid if it designates the same thing in all possible worlds. In [FM98]


we modified this notion somewhat so that a formal investigation could more readily be carried out-we called a term rigid if it designated the same thing in any two possible worlds that were related by accessibility. The idea is that the behavior of a term in an unrelated world should have no "visible" effect. It is this modified notion of rigidity that is used here, and it will be seen that it can be expressed directly if equality is available. (Whether models are standard, Henkin, or generalized Henkin does not matter for what we are about to do, only that they are normal.) For the rest of this section, normality is assumed.

DEFINITION 9. 7 The intensional term T is rigid in a normal model if the following is valid in it.

It is easy to see that the formula asserting rigidity of T is true at a world r of a normal model if and only if, at each world accessible from r, T designates the same object that it designates at r itself. Thus asserting validity for the rigidity formula indeed captures the notion of rigidity for terms that we have in mind.

If an intensional term is rigid, it does not matter in which possible world we determine its designation. But then, if both necessitation and designation by a rigid intensional term are involved in the same formula, it should not matter whether we determine what the term designates before or after we move to alternative worlds when taking necessitation into account. In other words, for rigid intensional terms the de re/ de dicto distinction should vanish. In fact it does, and as it happens, the converse is also the case. The following is a higher order version of a first order argument from [FM98].

PROPOSITION 9.8 In K, the intensional term T is rigid if and only if the de re/de dicto distinction vanishes, that is, if and only if any (and hence all) parts of Proposition 9. 6 hold.

Proof This is shown by proving two implications, using tableau rules for K including rules for equality.

Let A be the formula (A,6.0(,8 =lT))(lT) and let B be the formula ('v'a)[D(A,6.a(,B))(T) :J (A,6.0a(,6))(T)]. A says T is rigid, while B says de dicto implies de re for T. I first give a tableau proof of A :J B.

1 •(A :J B) 1. 1 (,\,6.0(,6 =17))(17) 2. 1 •(Va)[0(,\,6.a(,6))(17) :J (>.,6.0a(,6)}(17)] 3. 1 •[0(>.,6.<1>(,6))(17) :J (>.,6.0<1>({3))(17)] 4. 1 0(,\,6.<1>(,6))(17) 5. 1 •(A,6.0(J3)}(17) 6. 1 ·D( 71) 7. 1.1•<1>(71) 8. 1.1 (,\,6.<1>({3))(17) 9. 1.1 <l>( 71.1) 10. 1 0(71 =17) 11. 1.1 (71 =17) 12. 1.1 71 = 71.1 13. 1.1 •<l> ( 71.1) 14.

123

In this tableau, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an existential rule, with as a new (intensional) parameter; 5 and 6 are from 4 by a conjunctive rule; 7 is from 6 by a derived unsubscripted abstract rule; 8 is from 7 by a possibility rule; 9 is from 5 by a necessity rule; 10 is from 9 and 11 is from 2 by a derived unsubscripted abstract rule; 12 is from 11 by a necessity rule; 13 is from 12 by a derived unsubscripted abstract rule; and 14 is from 8 and 13 by a derived substitutivity rule for equality.

Finally I give a tableau proof of B :=:> A.

1 •(B :J A) 1. 1 (Va)[D(>.,6.a(,6)}(17) :J (>.,6.0a(,6))(l7)] 2. 1 •(A,6.0(,6 =17)}(17) 3. 1 0(,\,6.(Af'. 17 = 1)(,6)}(17) :J (,\,6.0(Af'. 17 = /)(,6)}(17) 4. 1 •0(71 =17) 5. 1.1•(71 =17) 6. 1.1•(71 = 71.1) 7.

/ ~ 1 •0(>.,6.(Af'. 17 = /)(,6))(17)

8. 1.2 •(A,6.(Af'. 17 = 1)(,6))(17) 1.2•(Af'.l7 = 1)(71.2) 10. 1.2 •(17 = 71.2) 11. 1.2 ·( 71.2 = 71.2) 12. 1.2 71.2 = 71.2 13.

1 (,\,6.0(Af'. 17 = 1)(,6)}(17) 14.

9. 1 D(>.,. 17 = ,)( 71) 15. 1.1 (Af'.l7=f'}(71) 16. 1.1 (17=71) 17. 1.1 71.1 = 71 18. 1.1•(71 = 71) 19. 1.1 71 = 71 20.


• In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by a

universal rule, instantiating with the term (>."f. l T = 'Y); 5 is from 3 by an unsubscripted abstract rule; 6 is from 5 by a possibility rule; 7 is from 6 by an unsubscripted abstract rule; 8 and 14 are from 4 by a disjunctive rule; 9 is from 8 by a possibility rule; 10 is from 9, and 11 is from 10 by an unsubscripted abstract rule; 12 is from 11 by an extensional predication rule; 13 is by reflexivity; 15 is from 14 by an unsubscripted abstract rule; 16 is from 15 by a necessity rule; 17 is from 16 by an unsubscripted abstract rule; 18 is from 17 by an extensional predication rule; 19 is from 7 and 18 by substitutivity; and 20 is by reflexivity.

4. Stability Conditions In his ontological argument Godel makes essential use of what he

called "positiveness," which is a property of properties of things. Hedoes not define the notion, instead he makes various axiomatic assumptions concerning it. Among these are: if a property is positive, it is necessarily so; and if a property is not positive, it is necessarily not positive. (His justification for these was the cryptic remark, "because it follows from the nature of the property.") Suppose we use the secondorder constant symbol P to represent positiveness, and take it to be of type j (i (0)). Godel stated his conditions more or less as follows, with quantifiers implied: P(X) ::J DP(X) and •P(X) ::J D•P(X). The second of these is equivalent to ()P(X) ::J P(X), and this form will be used in what follows. Positiveness is a second-order notion, but Godel's conditions can be extended to other orders as well. I call the resulting notion stability, which is not terminology that Godel used.

DEFINITION 9.9 (STABILITY) LetT be a term of type j(t). T satisfies the stability conditions in a model provided the following are valid in that model.

(Va)[T(a) :::> DT(a)] (Va)[()T(a) ::J T(a)]

The stability conditions come in pairs. In S5, however, these pairs collapse.

PROPOSITION 9.10 In S5, (\la)[T(a) ::J DT(a)] and (\la)[()T(a) :::> T(a)] are equivalent.

Proof Suppose (Va)[T(a) ::J DT(a)]. Contraposition gives (Va)[•DT(a) ::J •T(a)]. From necessitation and converse Barcan, (Va)D[•DT(a) :::>

•T(a)], and so ('v'a)[D•DT(a) :J D•T(a)], equivalently, ('v'a)[DO•T(a) :J D•T(a)]. But in S5, X :J DOX is valid, hence we have ('v'a)[•T(a) :J D•T( a)]. By contra position again, ('v' a)[ ·D•T( a) :J ••T( a)], and hence ('v'a)[OT(a) :J T(a)]. The converse direction is similar. •

In the stability conditions, T is being predicated of other things. On the other hand, to say T is rigid, or that the de re /de dicta distinction vanishes for T, involves other things being predicated of T. Here is the fundamental connection between stability and earlier items.

THEOREM 9.11 An intensional term T is rigid if and only if it satisfies the stability conditions.

Proof This is most easily established using tableaus. And it is a good workout. I leave it to you to supply the details. •

Exercises EXERCISE 4.1 Complete the proof of Theorem 9.11 by giving appropriate closed tableaus. Recall that extensionality is assumed for extensional terms, and we have the derived extensionality rule given in Definition 6.2.

5. Definite Descriptions As is well-known, Russell treated definite descriptions by translat

ing them away, [Rus05]. His familiar example, "The King of France is bald," is handled by eliminating the definite description, "the King of France," in context, to produce the sentence "exactly one thing Kings France, and that thing is bald." It is also possible to treat definite descriptions as first-class terms, making them a primitive part of the language. In [FM98] we showed how both of these approaches extend to first-order modal logic. Further extending this dual treatment to higherorder modal logic adds greatly to the complexity, so I confine things to a Russell-style version here.

Suppose we have a formula <P, and we form the expression m.<P, which is read as the a such that <P, and is called a definite description. Syntactically it is treated like a term. Its free variables are those of <P, except for a, and its type is the type of a. In a more formal presentation, all this would have been built into the definition of term and formula given earlier, but doing so adds much complexity at the start of the subject, so I am taking the easier route of explaining now what could have been done.

DEFINITION 9.12 (DESCRIPTION DESIGNATION) The definite description 1a.<P designates, or is defined at the possible world r of M =

(Q, R, 1-l,I) if

M, r 11-v (3,6)('v'8)[(>.a.<P)(8) = (,6 = 8)]

where ,6 and 8 are not free in <P.

Next, the behavior of definite descriptions in context is treated in Russell's style. As he so famously noted, scope issues are fundamental. There is a difference between "the King of France is non-bald," which is false since there is no King of France, and "it is not the case that the King of France is bald," which is true. Formally, it is the difference between (>.x.-.B(x))( 1y.K(y)) and •(>.x.B(x)) ( 1y.K(y) ). There is a similar distinction to be made between (>.x.DB(x))(1y.K(y)) and D(>.x.B(x))(1y.K(y)) since definite descriptions generally act nonrigidly, and so the de rej de dicta issue arises.

Note that in all the examples above, scope of a definite description was indicated by the use of a predicate abstract. Now (>.x.DB(x))(1y.K(y)) is atomic, as are (>.x.B(x))(1y.K(y)) and (>.x.-.B(x))(1y.K(y)). It is enough for us to specify how definite descriptions behave in atomic contexts, and everything else follows automatically. But even at the atomic level, a definite description can occur in a variety of ways. For instance, in To(TI) either, or both, of To and TI could be descriptions. There are several ways of dealing with this, all of which lead to equivalent results. I'll use a Russell-style translation directly in the simplest case, and reduce other situations to that.

DEFINITION 9.13 (DESCRIPTIONS IN ATOMIC CONTEXT) Let m..a.<P)(8) = (,6 = 8)] 1\ To(,6)}.

2 To(TI. ... , m.<P, ... , Tn) is an abbreviation for

(>.,6.To(TI, ... , ,6, ... , Tn))(7a.<fl).

3 (7a.<P)(TI,··· ,Tn) is an abbreviation/or

(>.,6.,6( TI, ... , Tn)) ( ?a.<fl).

4 To(TI, ... , l(m.<P), ... , Tn) is an abbreviation for

5 l( m. ) ( T1, . . . , T n) is an abbreviation for

(.\,8.(1,6) ( Tl, ... , Tn) )( m.).

The definition above provides a routine for the elimination of definite descriptions. The problem is, there may be more than one way of following the routine. For instance, consider the atomic formula (1x.A(x))(1y.B(y)), which contains two definite descriptions. If we eliminate (1y.B(y)) first, beginning with an application of part 1 of the definition, and then eliminate (1x.A(x)), we wind up with the following.

(:Jz1){('v'z2)[(.\y.B(y))(z2) = (z1 = z2)]/\ (3z4){('v'zs)[(.\x.A(x))(zs) = (z4 = zs)]/\ (.\z3.Z3(zl))(z4)}}

(9.1)

On the other hand, we might choose to eliminate 1x.A(x) first, beginning with part 3 of the definition. If so, after a few steps we wind up with the following.

(:Jz2){('v'z3)[(.\x.A(x))(z3) = (z2 = z3)]/\ (.\zl-(3z4){('v'zs)[(.\y.B(y))(zs) = (z4 = zs)]/\ z1(z4)})(z2)}

(9.2)

Fortunately, (9.1) and (9.2) are equivalent. In general, the elimination procedure is confluent-different reduction sequences for the same atomic formula always lead to equivalent results.

In a sense there are two kinds of definite descriptions, intensional and extensional, depending on the type of the variable a in 10:. . Extensional definite descriptions are rather well-behaved, and I say little about them, but for intensional ones, some interesting issues can be raised. In Definition 9. 7 I characterized a formal notion of rigidity. That definition can be extended to definite descriptions: call m. rigid at a world if the following is true at that world.

(.\,B.D(,B =1( 10:. ))) (l( m.)).

Informally speaking, to say this is true at a world r amounts to saying: m. designates at world r, m. designates at all worlds accessible from r, and at rand every world accessible from it, 1o:. designates the same thing. The following Proposition is an alternative characterization.

PROPOSITION 9.14 The formula (.\,8.0(,8 =1(m.)))(1(1o:.)) is equivalent in K to the conjunction of the following three formulas.

1 (:3,8) ('v'8) [(.\a. ) ( 8) = (,B = 8)]

2 (\1,6)[(-\a.<P)(,B) :J 0(-\a.<P)(,B)]

3 (\1,6)[0(-\a.<P)(,B) :J (-\a.<P)(,B)] ..

In other words, this Proposition says ( 1a. <P) is rigid if and only if ( m.<P) designates and (Aa.<P) satisfies the stability conditions.

Exercises EXERCISE 5.1 Show the equivalence of (9.1) and (9.2). (For this classical tableaus can be used, since modal operators do not explicitly appear.)

EXERCISE 5.2 Use K tableaus to prove Proposition 9.14. (This is a long exercise.)

6. Choice Functions In a Henkin/Kripke model, not all the objects of a standard model

need be present. We would like some mechanism to ensure that many are, so non-standard models may have a sufficiently rich universe. Abstraction provides one way of doing this. If <P is a formula, there must be an intensional object in a Henkin/Kripke model to serve as the designation for (-\a.<P), and so in turn there must be extensional objects to supply the designations for t (-\a.<P) at each particular world. But for some purposes this is still not enough. In effect, the example just given starts with an intensional object, and moves to extensional objects derivatively. We need some machinery for moving in the other direction as well.

Suppose, in a Henkin/Kripke model, we have somehow picked out an extensional object of the same type at each world-say we call the object we choose at world r, Or. It seems plausible that there should be an intensional object: the chosen object. That is, there should be an intensional object f whose value, at each world r, is the object Or. More generally, suppose at each world we have selected a non-empty set of extensional objects, all of the same type. Say at world r we select the set Sr. Again it seems plausible that there should be an intensional object-a selected object-a mapping f whose value at each world r is some member of Sr.

Given the formal machinery up to this point, the existence of the intensional objects posited above cannot be guaranteed. (At least, I believe this to be the case. I do not have a proof.) To postulate existence of such intensional objects using some sort of axiom requires quantification over possible worlds, which we cannot do, but we can approximate to it by use of the 0 operator. What we wind up with is the following

postulate, which I call a choice axiom because, in effect, it posits the existence of choice functions in the standard set-theoretic sense.

DEFINITION 9.15 (CHOICE AXIOM) Let t be an extensional type, and let o: be of type j(t), f3 be of type t, and 'Y be of type jt. The following is the choice axiom of type t.

(Vo:)[D(:3{3)o:(f3) ::::> (:3'Y)Do:(h)]

Informally, the axiom says that if, at each world the set of things such that o: is non-empty-0(:3f3)o:(f3)-then there is a choice function 'Y that picks out something such that o: at each world-(::l"f)Do:(h). I give one example of a Choice Axiom application. Suppose o: is an extensional variable, and m. designates in every possible world. That is, in each possible world, the is meaningful. Then, plausibly, there should be an intensional object that, in each world, designates the thing that is the of that world-that is, the term ?(.D(Ao:.)(t() should also designate. More loosely, the concept should also designate. Recall, Definition 9.12 says what it means for a definite description to designate, and since (A(.0(Ao:.)(K))("7) = D(Ao:.)(t'f]), things can be simplified a little.

PROPOSITION 9.16 Assume the Choice Axiom (Definition 9.15} and Extensionality for Intensional Terms (Definition 9.3). Assume a, {3, and 8 are of extensional type t, and 'Y and "7 are of type jt. The following is valid in all K models.

D(:3{3)(V8)[(Ao:.)(8) = ({3 = 8)] ::::> (:3'Y)(V"7)[D(Ao:.)(t"7) = ('Y = 17)]

Proof Assume D(:3f3)(V8)[(Ao:.)(8) = ({3 = 8)] is true at a possible world. I show that (:3'Y)(V7])[D(Ao:.)(1"7) = ('Y = 17)] must also be true there. Start with

D(:3f3)(V8)[(Ao:.)(8) = ({3 = 8)] (9.3)

which is equivalent to

0(:3{3){ (Ao:.)(f3) 1\ (V8)[(Ao:.)(8) ::::> ({3 = 8)]}. (9.4)

Instantiating the universal quantifier in the choice axiom with

(A"7.(Ao:.)("7) 1\ (V8)[(Ao:.)(8) ::::> ("7 = 8)])

(9.4) implies

(:l!)D{(>,a.<P)(h) 1\ (V8)[(>,a.<P)(8):) (h = 8)]} (9.5)


(:J!){D(>,a.<P)(h) 1\ D(V8)[(>,a.<P)(8) :) (h = 8)]}. (9.6)

Since the Barcan and converse Barcan formulas are valid in the semantics, this is equivalent to

(:3/){D(>,a.<P)(h) 1\ (V8)D[(>,a.<P)(8) :) (h = 8)]}. (9.7)

This, in turn, implies the following formula. I leave the justification to you.

(:l!){D(>,a.<P)(h) 1\ (V1J)D[(>,a.<P)(11J) :) (h =11J)]}. (9.8)

Using distributivity of necessity over implication, this implies

(:3/){D(>,a.<P)(h) 1\ (V1J)[O(>,a.<P)(11J) :) D(h =11J)]} (9.9)

and using Extensionality for Intensional Terms, this implies

(:l{){D(>,a.<P)(h) 1\ (V1J)[D(>.a.<P)(l1J) :) (t = 17)]} (9.10)


(:l!)(V1J)[O(>,a.<P)(11J) = (t = 17)] (9.11)

and we are done. •

Exercises EXERCISE 6.1 Give tableau proofs of the Barcan formula, and of the converse Barcan formula.

EXERCISE 6.2 Give a tableau proof to show (9. 7) implies (9.8).

III

ONTOLOGICAL ARGUMENTS



Chapter 10

.. GODEL'S ARGUMENT, BACKGROUND

1. Introduction

There are many directions from which people have tried to prove the existence of God. There have been arguments based on design: a complex universe must have had a designer. There have been attempts to show that the existence of an ethical sense implies the existence of God. There have been arguments based on causality: trace the chain of effect and cause backward and one must reach a first cause. Ontological arguments seek to establish the existence of God based on pure logic: the principles of reasoning require that God be part of ones ontology.

For religion, as contrasted with philosophy or logic, it does not matter if proofs for God's existence have holes. Religious belief, like much that is fundamentally human, is not really the product of reason. We are emotional animals, and one of the uses of proof, in the various senses above, is to sway emotion. Proof is often just a rhetorical device, one among many.

But this takes us too far afield. Here we are interested in ontological arguments only. Independently of whether one believes their conclusion to be true, the logical machinery used in such arguments is often ingenious, and merits serious study. It is generally accepted that such arguments contain flaws, but saying exactly where the flaw lies is not easy, and is subject to controversy. It happens that different analyses of the same argument will locate an error at different points. Often this happens because the notions involved in a particular ontological argument are vague and subject to interpretation. Godel's ontological argument is rather unique in that it is entirely precise-the premises are clearly set forth, and the reasoning can be formalized. But we will see

133


that here too there is room for interpretation, and things are not as clear as they first seem.

2. Anselm Historically, the first ontological argument is that of St. Anselm (1033

- 1109), given in his book Proslogion. Here is the argument itself, in a somewhat technical translation from [Cha79].

Even the Fool, then, is forced to agree that something-than-which-nothinggreater-can-be-thought exists in the mind, since he understands this when he hears it, and whatever is understood is in the mind. And surely thatthan-which-a-greater-cannot-be-thought cannot exist in the mind alone. For if it exists solely in the mind even, it can be thought to exist in reality also, which is greater. If then that-than-which-a-greater-cannot-be-thought exists in the mind alone, this same that-than-which-a-greater-cannot-be-thought is that-than-which-a-greater-can-be-thought. But this is obviously impossible. Therefore there is absolutely no doubt that something-than-which-a-greatercannot-be-thought exists both in mind and in reality.

Put into more modern terms, Anselm speaks of a maximally conceivable being. This term-maximally conceivable being-must denote something, since ''whatever is understood is in the mind." But a maximally conceivable being must have the property of existence, because if it did not, we could conceive of a greater being, namely one that also had the existence property.

My understanding of this is that, read with some charity, it shows the phrase "maximally conceivable being," if it designates anything, must designate something that exists. The flaw lies in the failure to properly verify that the phrase designates at all-to show it is not in the same category as "the round square." Indeed, Anselm's way of justifying this, by claiming that it exists in the mind, is exactly what was attacked by his contemporary Gaunilo, in his counter-argument, A Reply on Behalf of the Fool. A modern translation of this can also be found in [Cha79].

Anselm's argument was the ancestor of various later versions, all of which involve some notion of maximality. An easily accessible discussion of the family of ontological arguments in general is in the on-line Stanford Encyclopedia of Philosophy [Opp96b], and [Opp95, Pla65] are recommended as more detailed studies. A full examination of the Anselm argument can be found in [Har65]. In addition, a detailed book in progress is available on the internet, [SobOl]-the Anselm argument is discussed in Chapter 2, "Classical Ontological Arguments."

3. Descartes Descartes (1598 - 1650) gave different versions of an ontological ar

gument. Here is one, in which he defines God to be a being whose

GODEL'S ARGUMENT, BACKGROUND 135

necessary existence is part of the definition. It is from the Appendix to his replies to the Second Objections to his Meditations, [Des51]. I omit the Definitions and Axioms to which the quote refers.

Proposition I

The existence of God is known from the consideration of his nature alone.

Demonstration

To say that an attribute is contained in the nature or in the concept of a thing is the same as to say that this attribute is true of this thing, and that it may be affirmed to be in it (Definition IX).

But necessary existence is contained in the nature or in the concept of God (by Axiom X).

Hence it may with truth be said that necessary existence is in God, or that God exists.

Here is a somewhat different argument, using existence rather than necessary existence. This version is from The Meditations, book V, [Des51].

. . . because I cannot conceive God unless as existing, it follows that existence is inseparable from him, and therefore that he really exists; not that this is brought about by my thought, or that it imposes any necessity on things, but, on the contrary, the necessity which lies in the thing itself, that is, the necessity of the existence of God, determines me to think in this way, for it is not in my power to conceive a God without existence, that is a being supremely perfect, and yet devoid of an absolute perfection, as I am free to imagine a horse with or without wings.

Taking some liberties with the first of the Descartes proofs above: God is the most perfect being, the being having all perfections, and among these is necessary existence. Put a little differently, necessary existence is part of the essence of God. And here we have reached an ontological argument that can be easily formalized. Recall the discussion in Chapter 7, Section 3. The type-0 objects are possibilist-they represent what might exist, not what does. If we want to relativize things to what actually exists, we need a type-(0) "existence" predicate, E, about which nothing special need be postulated at this point. Now, suppose we define God to be the necessarily existent being, that is, the being g such that DE(g). If such a being exists, it must satisfy its defining property, and hence we have

E(g) ::::> DE(g). (10.1)

Given (10.1), using the rule of necessitation, we have the following.

D[E(g) ::::> DE(g)] (10.2)


From (10.2), using the K principle D(P :::) Q) :::) ( ()P :::) OQ) we have the next implication.

OE(g) :::) ODE(g) (10.3)

Finally we use something peculiar to 85 (and some slightly weaker logics, a point of no importance here). The principle needed is ODP :::) DP, and so from (10.3) we have the following.

OE(g) :::) DE(g) (10.4)

We thus have a proof that God's existence is necessary, if possible. And, again following Descartes loosely, God's existence is possible because possibility is identified with conceivability, and we may take it for granted that God is conceivable.

Russell's treatment of definite descriptions applies quite well in a modal setting-Chapter 9, Section 5. The use of g above was an informal way of avoiding a formal definite description-note that I gave no real prooffor (10.1). Let us recast the argument using definite descriptionsthe necessarily existent being is m.DE(a) and I assume g is an abbreviation for this type-0 term. Now (10.1) unabbreviates to the following.

E(10~.DE(a)) :::) DE(1a.DE(a)). (10.5)

This is not a valid formula of K, but that logic is too weak anyway, given the step from (10.3) to (10.4) above. But (10.5) is valid in 85, a fact I leave to you as an exercise. In fact, using 85, the argument above is entirely correct!

The real problem with the Descartes argument lies in the assumption that God's existence is possible. In 85 both OE(g) :::) E(g) and E(g) :::) OE(g) are trivially valid. Since OE(g) :::) DE(g) has been shown to be valid, we have the equivalence of E(g), OE(g), and DE(g)! Thus, assuming God's existence is possible is simply equivalent to assuming God exists. This is an interesting conclusion for its own sake, but as an argument for the existence of God, it is unconvincing.

Exercises EXERCISE 3.1 Give an 85 tableau proof of the following, where P and Q are type-(0) constant symbols.

P(m.DQ(a)) :::) DQ(m.DQ(a))

From this it follows that (10.5) is valid in 85.


EXERCISE 3.2 Construct a model to show

E(m.DE(a)) ~ DE(1a.OE(a)).

is not valid inK.

EXERCISE 3.3 Formula 10.5 can also be written as

(.X,8.E(,8))(1a.OE(a)) ~ D(.X,B.E(,B))(m.OE(a))

which, by the previous exercise, is not K valid. Show the following variant is valid (a K tableau proof is probably easiest).

(.X,8.E(,8))(1a.DE(a)) ~ (.X,B.OE(,B))(m.OE(a))

EXERCISE 3.4 Show why the valid K formula of Exercise 3.3 can not be used in a Descartes-style argument.

4. Leibniz Leibniz (1646 - 1716) partly accepted the Descartes argument from

The Meditations, mentioned in the previous section. But he also clearly identified the critical issue: one must establish the possibility of God's existence. The following is from Two Notations for Discussion with Spinoza, [Lei56].

Descartes' reasoning about the existence of a most perfect being assumed that such a being can be conceived or is possible. If it is granted that there is such a concept, it follows at once that this being exists, because we set up this very concept in such a way that it at once contains existence. But it is asked whether it is in our power to set up such a being, or whether such a concept has reality and can be conceived clearly and distinctly, without contradiction. For opponents will say that such a concept of a most perfect being, or a being which exists through its essence, is a chimera. Nor does it suffice for Descartes to appeal to experience and allege that he experiences this very concept in himself, clearly and distinctly. This is not to complete the demonstration but to break it off, unless he shows a way in which others can also arrive at an experience of this kind. For whenever we inject experience into our demonstrations, we ought to show how others can produce the same experience, unless we are trying to convince them solely through our own authority.

Leibniz's remedy amounted to an attempt to prove that God's existence is possible, where God is defined to be the being having all perfections-again a maximality notion. Intuitively, a perfection is an atomic property that is, in some sense, good to have, positive. Leibniz based his proof on the compatibility of all perfections, from which he took it to follow that all perfections could reside in a being-God's


existence is possible. Here is another quote from Two Notations for Discussion with Spinoza, [Lei56].

By a perfection I mean every simple quality which is positive and absolute or which expresses whatever it expresses without any limits. But because a quality of this kind is simple, it is unanalyzable or indefinable .... From this it is not difficult to show that all perfections are compatible with each other or can be in the same subject.

Leibniz goes on to provide a detailed proof of the compatibility of all perfections, though it is not a proof in any modern sense. Indeed, it is not clear how a proper proof could be given at all, using the vague notion of perfection presented above. I omit his proof here. The point for us is that, as we will see, precisely this point is central to Godel's argument as well.

5. Godel Godel (1906- 1978) was heir to the profound developments in math

ematics of the late nineteenth and early twentieth centuries, which often involved moves to greater degrees of abstraction. In particular, he was influenced by David Hilbert and his school. In the tradition of Hilbert's book, Foundations of Geometry, Godel avoided Leibniz's problems completely, by going around them. It is as if he said, "I don't know what a perfection is, but based on my understanding of it intuitively, it must have certain properties," and he proceeded to write out a list of axioms. This neatly divides his ontological argument into two parts. First, based on your understanding, do you accept the axioms. This is an issue of personal intuitions and is not, itself, subject to proof. Second, does the desired conclusion follow from the axioms. This is an issue of rigor and the use of formal methods, and is what will primarily concern us here.

Godel's particular version of the argument is a direct descendent of that of Leibniz, which in turn derives from one of Descartes. These arguments all have a two-part structure: prove God's existence is necessary, if possible; and prove God's existence is possible.

Godel worked on his ontological argument over many years. According to [Ada95], there is a partial version in his papers dated about 1941. In 1970, believing he would die soon, Godel showed his proof to Dana Scott. In fact Godel did not die until1978, but he never published on the matter. Information about the proof spread via a seminar conducted by Dana Scott, and his slightly different version became public knowledge.

Godel's proof appeared in print in [Sob87], based on a few pages of Godel's handwritten notes. Scott also wrote some brief notes, based on his conversation with Godel, and [Sob87] provides these as well. In fact, [Sob87] has served as something of a Bible (pun intended) for the


Godel ontological argument. Finally the publication of Godel's collected works has brought a definitive version before the public, [G70]. Still, the notion of a definitive version is rather elusive in this case. Godel's manuscript provides almost no explanation or motivation. It amounts to an invitation to others to elaborate.

Godel's argument is modal and at least second-order, since in his definition of God there is an explicit quantification over properties. Work on the Kripke semantics of modal logic was relatively new at the time Godel wrote his notes, and the complexity of quantification in modal contexts was perhaps not well appreciated. Consequently, the exact logic Godel had in mind is unclear.

Subsequently several people took up the challenge of putting the Godel argument on a firm foundation and exposing any hidden assumptions. People have generally used the second-order modal logic of [Coc69], sometimes rather informally. [Sob87], playing Gaunilo to Godel's Anselm, showed the argument could be applied to prove more than one would want. Sobel's discussion has been greatly extended in [SobOl], Chapter 4; Chapter 3 is also relevant here. [AG96] showed that one could view a part of the argument not as second-order, but as third-order. Many others contributed, among which I mention [And90, Haj96b]. Postings on the internet are, by nature, somewhat ephemeral, but interesting discussions of the Godel argument, intended for a general audience, can be found at [SmaOl] as well as at [OppOl]. In addition, there are [Opp96b] and [SobOl]. The present chapter and the next can be thought of as part of the continuing tradition of explicating Godel.

6. Godel's Argument, Informally

Before we get to precise details in the next Chapter, it would be good to run through Godel's argument informally to establish the general outline, since it is considerably more complex than the versions we have seen to this point.

To begin with, Godel takes over the notion of perfection, but with some changes. For Leibniz, perfections were atomic properties, and any combination of them was compatible and thus could apply to some object. They could be freely combined, a little like the atomic facts about the world that one finds in Wittgenstein's Tractatus. Since this is the case, why not form a new collection, consisting of all the various combinations of perfections, each combination of which Leibniz considers possible. Godel found it convenient to do this, and used the term positiveness for the resulting notion. Thus we should think of a positive property, in Godel's sense, as some conjunction of perfections in Leib-


niz's sense. At least, I am assuming this to be the case-Godel says nothing explicit about the matter.

The most notable difference between Godel and Leibniz is that, where Leibniz tried to use what are essentially informal notions in a rigorous way, Godel introduces formal axioms concerning them. Here are Godel's axioms (or their equivalents), and his argument, set forth in everyday English. A formalized version will be found in the next Chapter. The Godel argument has the familiar two-part structure: God's existence is possible; and God's existence is necessary, if possible. I'll take these in order.

I'll begin with the axioms for positiveness. The first is rather strong. (I have made no attempt to follow Godel's numbering of axioms and propositions, and in some cases I have adopted equivalents or elaborations of what Godel used.)

INFORMAL AXIOM 1 Exactly one of a property or its complement is positive.

It follows that there must be positive properties. If we call a property that is not positive negative, it also follows that there are negative properties. By Informal Axiom 1, a negative property can also be described as one whose complement is positive.

Suppose we say property P entails property Q if, necessarily, everything having P also has Q.

INFORMAL AXIOM 2 Any property entailed by a positive property is positive.

This brings us to our first interesting result.

INFORMAL PROPOSITION 1 Any positive property is possibly instantiated. That is, if P is positive, it is possible that something has property P.

Proof Suppose P is positive. Let N be some negative property (the complement of P will do). It cannot be that P entails N, or else N would be positive. So it is not necessary that everything having P has N, that is, it is possible that something has P without having N. So it is possible that something hasP. •

Leibniz attempted a proof that "all perfections are compatible with each other or can be in the same subject," that is, having all perfections is a possibly instantiated property. Godel instead simply takes


the following as an axiom-it is an immediate consequence, using Informal Proposition 1, that having all positive properties is a possibly instantiated property.

INFORMAL AXIOM 3 The conjunction of any collection of positive properties is positive.

This is a problematic axiom, in part because there are infinitely many positive properties, and we cannot form an infinite conjunction (unless we are willing to allow an infinitary language). There are ways around this, but there is a deeper problem as well-we will see that this axiom is equivalent to Godel's desired conclusion (given Godel's other assumptions). But further discussion of this point must wait till later on. For now we adopt the axiom and work with it in an informal sense.

Now Godel defines God, or rather, defines the property of being Godlike, essentially the same way Leibniz did.

INFORMAL DEFINITION 2 A God is any being that has every positive property.

This gives us part one of the argument rather easily.

INFORMAL PROPOSITION 3 It is possible that a God exists.

Proof By Informal Axiom 3, the conjunction of all positive properties is a positive property. But by Definition 2, this property-maximal positiveness-is what makes one a God. Since the property is positive, it is possibly instantiated, by Informal Proposition 1. •

There are also a few technical assumptions concerning positiveness, whose role is not apparent in the informal presentation given here. Their significance will be seen when we come to the formalization in the next Chapter. Here is one.

INFORMAL AXIOM 4 Any positive property is necessarily so, and any negative property is necessarily so.

Now we move on to the second part of the argument, showing God's existence is necessary, if possible. Here Godel's proof is quite different from that of Descartes, and rather ingenious. To carry out the argument, Godel introduces a pair of notions that are of interest in their own right.

INFORMAL DEFINITION 4 A property G is the essence of an object g if:

1 g has property G;


2 G entails every property of g.

Strictly speaking, in the definition above I should have said an essence rather than the essence, but it is an easy argument that essences are unique, if they exist at all. Very simply, if an object g had two essences, P and Q, each would be a property of g by part 1, and then each would entail the other by part 2. Godel does not, in general, assume that objects have essences, but for an object that happens to be a God, there is a clear candidate for the essence.

INFORMAL PROPOSITION 5 If g is a God, the essence of g is being a God.

Proof Let's state what we must show a little more precisely. Suppose G is the conjunction of all positive properties, so having property G is what it means to be a God. It must be shown that if an object g has property G, then G is the essence of g.

Suppose g has property G. Then automatically we have part 1 of Informal Definition 4.

Suppose also that P is some property of g. By Informal Axiom 1, if P were not positive its complement would be. Since g has all positive properties, g then would have the property complementary toP. Since we are assuming g has P itself, we would have a contradiction. It follows that P must be positive. Since G is the conjunction of all positive properties, clearly G entails P. Since P was arbitrary, G entails every property of g, and we have part 2 of Informal Definition 4. •

Here is the second of Godel's two new notions.

INFORMAL DEFINITION 6 An object g has the property of necessarily existing if the essence of g is necessarily instantiated.

And here is the last of G6del's axioms.

INFORMAL AXIOM 5 Necessary existence, itself, is a positive property.

INFORMAL PROPOSITION 7 If a God exists, a God exists necessarily.

Proof Suppose a God exists, say object g is a God. Then g has all positive properties, and these include necessary existence by Informal Axiom 5. Then the essence of g is necessarily instantiated, by Informal Definition 6. But the essence of g is being a God, by Informal Proposition 5. Thus the property of being a God is necessarily instantiated .

•


Now we present the second part of the ontological proof.

INFORMAL PROPOSITION 8 If it is possible that a God exists, it is necessary that a God exists (assuming the logic is 85).

Proof In any modal logic at least as strong as K, if P :::::> Q is valid, so is OP :::::> OQ. Then by Informal Proposition 7, if it is possible that a God exists, it is possibly necessary that a God exists. In 85, ODP :::::> DP is valid, and the conclusion follows. •

Finally, by Informal Propositions 3 and 8, we have our conclusion.

INFORMAL THEOREM 9 Assuming all the axioms, and assuming the underlying logic is 85, a God necessarily exists.

One final remark before moving on. I've been referring to a God, rather than to the God. As a matter of fact uniqueness is easy to establish, provided we make use of Leibniz's condition that having the same properties ensures identity. Let G be the property of being Godlikethe maximal positive property-and suppose both g1 and g2 possess this property. By Informal Proposition 5, G must be the essence of both g1

and g2. Now, if P is any property of g1, G must entail P, by part 2 of Informal Definition 4. Since G is a property of g2, by part 1 of the same Informal Definition, P must also be a property of g2. Similarly, any property of g2 must be a property of g1. Since g1 and g2 have the same properties, they are identical.

This concludes the informal presentation of Godel's ontological argument. It is clear it is of a more complex nature than those that historically preceded it. But an informal presentation is simply not enough. God is in the details, so to speak, and details demand a formal approach. In the next Chapter I'll go through the argument again, more slowly, working things through in the intensional logic developed earlier in Part II.

Exercises EXERCISE 6.1 Show that only God can have a positive essence. (This exercise is due to Ioachim Teodora Adelaida of Bucharest.)



Chapter 11

.. GODEL'S ARGUMENT, FORMALLY

1. General Plan

The last Chapter ended with an informal presentation of Godel's argument. This one is devoted to a formalized version. I'll also consider some objections and modifications. There are two kinds of objections. One amounts to saying that Godel committed the same fallacy Descartes did: assuming something equivalent to God's existence. Nonetheless, again as in the Descartes case, much of the argument is of interest even if it falls short of establishing the desired conclusion. The second kind of objection is that Godel's axioms are too strong, and lead to a collapse of the modal system involved. Various extensions and modifications of Godel's axioms have been proposed, to avoid this modal collapse. I'll discuss these, and propose a modification of my own. Now down to details, with the proof of God's possible existence coming first. I will not try to match the numbering of the informal axioms in the last chapter, but I will refer to them when appropriate.

2. Positiveness

God, if one exists, will be taken to be an object of type 0. We are interested in the intensional properties of this object, properties of type j(O). Among these properties are the ones Godel calls positive, and which we can think of as conjunctive combinations of Leibniz's perfections. At least that is how I understand positiveness. Godel's ideas on the subject are given almost no explanation in his manuscript-here is what is said, using the translation of [G70].

145


Positive means positive in the moral aesthetic sense (independently of the accidental structure of the world). Only then [are] the axioms true. It may also mean pure 'attribution' as opposed to 'privation' (or containing privation).

This is not something I profess to understand. But what is significant is that, rather than attempting to define positiveness, Godel characterized it axiomatically. In this section I present his basic axioms concerning the notion, and I explore some of their consequences.

DEFINITION 11.1 (POSITIVE) A constant symbol P of type j (j (0)) zs designated to represent positiveness. It is an intensional property of intensional properties. Informally, P is positive if we have P(P).

It is convenient to introduce the following abbreviation.

DEFINITION 11.2 (NEGATIVE) If T is a term of type j(O), take •T as short for (Ax.•T(x)). Call T negative if •T is positive.

Loosely, at a world in a model, •T denotes the complement of whatever T

denotes. It is easy to check formally that T = •( •T), given extensionality for intensional terms, Definition 9.3.

Godel assumes that, for each P, exactly one of it or its negation must be positive. Godel's axiom (which he actually stated using exclusive-or) can be broken into two implications. Here they have been formulated as two separate axioms, since they play different roles.

AXIOM 11.3 (FORMALIZING INFORMAL AXIOM 1) A (VX)[P(•X) :J •P(X)] B (VX)[•P(X) :J P(•X)]

Of these, Axiom 11.3A is certainly plausible: contradictory items should not both be positive. But Axiom 11.3B is more problematic: it says one of a property or its complement must be positive. We might think of the notion of a maximal consistent set of formulas-familiar from the Lindenbaum/Henkin approach to proving classical completeness-as suggestive of what Godel had in mind. There are some cryptic remarks of Godel relating disjunctive normal forms and positiveness, but these have not served as aids to my understanding. At any rate, these are the basic assumptions.

The next assumption concerning positiveness is a monotonicity condition: a property that is entailed by a positive property is, itself, positive. Here it is, more or less as Godel gave it.

[P(X) 1\ D(Vx)(X(x) :J Y(x))] :J P(Y)

GODEL'S ARGUMENT, FORMALLY 147

In this formula, x is a free variable of type 0. For us, type-0 quantification is possibilist, while for Godel it must have been actualist. I am assuming this because his conclusion, that God exists, is stated using an existential quantifier, and a possibilist quantifier would have been too weak for the purpose. For us, existence must be made explicit using the existence predicate E, relativizing the ('v'x) quantifier to E. Since this relativization comes up frequently, it is best to make an official definition.

DEFINITION 11.4 (EXISTENTIAL RELATIVIZATION) ('v'Ex) abbrevi-ates (Vx)[E(x) :J ], and (3Ex) abbreviates (3x)[E(x) 1\ ].

AXIOM 11.5 (FORMALIZING INFORMAL AXIOM 2) In the following, x is of type 0, X and Y are of type i(O).

('v'X)(VY){[P(X) 1\ D('v'Ex)(X(x) :J Y(x))] :J P(Y)}

At one point in his proof, Godel asserts that (>.x.x = x) must be positive if anything is, and (>.x.•x = x) must be negative. This is easy to see: P( (>.x.x = x)) is valid if anything is positive because anything strictly implies a validity, and we have Axiom 11.5. The assertion that (>.x.•x = x) is negative is equivalent to the assertion that (>.x.x = x) is positive. We thus have the following consequences of Axiom 11.5.

PROPOSITION 11.6 Assuming Axiom 11.5:

1 (3X)P(X) :J P((>.x.x = x));

2 (3X)P(X) :J P(•(Ax.•x = x)).

PROPOSITION 11.7 Assuming Axioms 11.3A and 11.5:

(3X)P(X) :J •P( (>.x.•x = x) ).

Now we have a result from which the possible existence of God will follow immediately, given one more key assumption about positiveness.

PROPOSITION 11.8 (FORMALIZING INFORMAL PROPOSITION 1) Assuming Axioms 11.3A and 11.5, ('v'X){P(X) :J 0(3Ex)X(x)}.

Proof The idea has already been explained, in the proof of Informal Proposition 1 in Section 6. This time I give a formal tableau, which is displayed in Figure 11.1. In it use is made of one of the Propositions above. Item 1 negates the proposition in unabbreviated form. Item 2 is from 1 by an existential rule (with P as a new parameter); 3 and 4 are from 2 by a conjunctive rule; 5 is Axiom 1; 6 is from 5 and 7 is from 6 by universal rules; 8 and 9 are from 7 by a disjunctive rule; 10 and 11


are from 8 by a disjunctive rule; 12 is from 11 by a possibility rule; 13 is from 12 by an existential rule (with pas a new parameter, and some tinkering with E); 14 and 15 are from 13 by a conjunctive rule; 16 is from 4 by a necessity rule; 17 is from 16 by a universal rule (and some tinkering with E again); 18 is Proposition 11.7; 19 and 20 are from 18 by a disjunctive rule; 21 is from 19 by a universal rule. •

Leibniz attempted to prove that perfections are mutually compatible, basing his proof on the idea that perfections can only be purely positive qualities and so none can negate the others. For Godel, rather than proving any two perfections could apply to the same object, Godel assumes the positive properties are closed under conjunction. This turns out to be a critical assumption. In stating the assumption, read X 1\ Y as abbreviating (.Xx.X(x) 1\ Y(x)).

AXIOM 11.9 (FORMALIZING INFORMAL AXIOM 3) (VX)(VY){[P(X) 1\ P(Y)] ::::> P(X 1\ Y)}

Godel immediately adds that this axiom should hold for any number of summands. Of course one can deal with a finite number of them by repeated use of Axiom 11.9 as stated-the serious issue is that of an infinite number, which Godel needs. [AG96] gives a version of the axiom which directly postulates that the conjunction of any collection of positive properties is positive. Note that it is a third-order axiom. For reading ease I use the following two abbreviations.

1 Z applies only to positive properties (Z, like P, is of type j(j(O))):

pos(Z) {::} (\iX)[Z(X) ::::> P(X)]

2 X applies to those objects which possess exactly the properties falling under Z-roughly, X is the (necessary) intersection of Z. (In this, Z is of type i(j(O)), X is of type j(O), and x is of type 0.)

(X intersection of Z) {::} D(\ix){X(x) = (W)[Z(Y) ::::> Y(x)]}

AXIOM 11.10 (ALSO FORMALIZING INFORMAL AXIOM 3) (\iZ){pos(Z) ::::> (\iX)[(Xintersection of Z) ::::> P(X)]}.

Axiom 11.10 implies Axiom 11.9. I leave the verification to you. I'll finish this section with two technical assumptions that Godel makes "because it follows from the nature of the property." I don't understand this terse explanation, but here are the assumptions.

(\iX)[P(X) ::::> DP(X)] (\iX)[•P(X) ::::> 0-.P(X)]


u


If the underlying logic is just K, equivalence of these two assumptions follows from Axioms 11.3A and 11.3B. And if the underlying logic is 85, as it must be for part of Godel's argument, equivalence also follows by Proposition 9.10. Consequently the version used here can be simplified.

AXIOM 11.11 (FORMALIZING INFORMAL AXIOM 4) ('v'X)[P(X) :J DP(X)].

P has been taken to be an intensional object, of type j(j(O)). Axiom 11.11 and Theorem 9.11 tells us that Pis rigid. In effect the intensionality of P is illusory-since it is rigid it could just as well have been an extensional object of type (j(O)).

Exercises EXERCISE 2.1 Give a tableau proof that •(.Ax.•(x = x)) = (.Ax.x = x). More generally, show that for a type (0) term T, •(•T) = T.

EXERCISE 2.2 Show that ('v'X)[•P(X) :J D•P(X)] follows from Axiom 11.11 together with Axioms 11.3A and 11.3B.

EXERCISE 2.3 Show Axiom 11.10 implies Axiom 11.9. Hint: use equality.

3. Possibly God Exists Godel defines something to be Godlike if it possesses all positive prop

erties.

DEFINITION 11.12 (FORMALIZING INFORMAL DEFINITION 2) G is the following type j(O) term, where Y is type j(O).

(.Ax.('v'Y)[P(Y) :J Y(x)]).

Given certain earlier assumptions, anything having all positive properties can only have positive properties. Perhaps the easiest way to state this formally is to introduce a second notion of Godlikeness, and prove equivalence.

DEFINITION 11.13 (ALSO FORMALIZING INFORMAL DEFINITION 2) G* is the type j(O) term

(>.x.(W)[P(Y) = Y(x)]).

The following result is easily proved; I leave it to you as an exercise.


PROPOSITION 11.14 Assume Axiom 11.3B, ('v'X)[•P(X) :J P(•X)]. InK, with this assumption, ('v'x)[G(x) = G*(x)].

Axiom 11.3B is a little problematic, but it is essential to the Proposition above. If, eventually, we show something having property G exists, and G and G* are equivalent, we will know that something having property G* exists. But the converse is also the case: if something having property G* exists, Axiom 11.3B is the case, even if the existence in question is possibilist. Here is a formal statement of this. Once again I leave the proof to you.

PROPOSITION 11.15 InK, (3x)G*(x) :J (VX)[•P(X) :J 'P(•X)].

Now we can show that God's existence is possible. Godel assumes the conjunction of any family of positive properties is positive. Since G* is, in effect, the conjunction of all positive properties, it must be positive, and hence so must G be.

PROPOSITION 11.16 InK Axiom 11.10 implies P(G).

Once again I leave the formal verification to you. What must be shown is the following.

('v'Z)('v'X){[pos(Z) 1\ (X intersection of Z)] :J P(X)} :J P(G)

Essentially, this is the case because, as is easy to verify, we have each of pos(P) and ( G intersection of P).

Now the possibility of God's existence is easy. In fact, it can be proved with an actualist quantifier, though only the weaker possibilist version is really needed for the rest of the argument.

THEOREM 11.17 Assume Axioms 11.3A, 11.5, and 11.10. InK both of the following are consequences. 0(3Ex)G(x) and 0(3x)G(x).

Proof By Proposition 11.8,

('v'X){P(X) :J 0(3Ex)X(x)},

hence trivially,

('v'X){P(X) :J 0(3x)X(x)}.

By the Proposition above, P(G). The result is immediate. •

Note that the full strength of Proposition 11.8 was not really needed for the possibilist conclusion. In fact, if we modify Axiom 11.5 so that quantification is possibilist,

(VX)(W){[P(X) 1\ D('v'x)(X(x) :J Y(x))J :J P(Y)}


we would still be able to prove Proposition 11.8 in the weaker form

(\fX){P(X) :J 0(:3x)X(x)}

and the Godel proof would still go through.

Exercises EXERCISE 3.1 Give a tableau proof that G entails any positive property: (\fX){P(X) :J D(\fy)[G(y) :J X(y)]}. You will need Axiom 11.11.

EXERCISE 3.2 Give a tableau proof for Proposition 11.14.



EXERCISE 3.5 Give a tableau proof of

(\fZ)(\fX){[pos(Z) 1\ (X intersection of Z)] :J P(X)} :J P(G).

4. Objections Godel replaced Leibniz's attempted proof of the compatibility of per

fections by an outright assumption, given here as Axiom 11.10. Dana Scott, apparently noting that the only use Godel makes of this Axiom is to show being Godlike is positive, proposed taking P( G) itself as an axiom. Indeed, Scott maintains that the Godel argument really amounts to an elaborate begging of the question-God's existence is simply being assumed in an indirect way. In fact, it is precisely at the present point in the argument that Scott's claim can be localized. Godel's assumption that the family of positive properties is closed under conjunction turns out to be equivalent to the possibility of God's existence, a point also made in [SobOl].

We will see, later on, Godel's proof that God's existence is necessary, if possible, is correct. It is substantially different from that of Descartes, and has many points of intrinsic interest. What is curious is that the proof as a whole breaks down at precisely the same point as that of Descartes: God's possible existence is simply assumed, though in a disguised form.

The rest of this section provides a formal proof of the claims just made. Enough tableau proofs have been given in full, by now, so that abbreviations can be introduced as an aid to presentation. Before giving the main result of this section, I introduce some simple conventions for shortening displayed tableau derivations.

If a X and a X :J Y occur on a branch, a Y can be added. Schematically,

aX aX :J Y aY

The justification for this is as follows.

aX 1. a X :J Y 2.

a •X 3. aY 4.

The left branch is closed, and the branch below 4 continues as if we had used the derived rule.

Here are a few more derived rules, whose justification I leave to you.

aX a (X 1\ Y) :J Z aY :J Z

aX aX=:Y aY

a ('v'o:1) · · · ('v'o:n)<P( 0:1, · · · , O:n) a<P(T1, ... ,Tn) for any grounded terms T1, ... , Tn

a•X a X=:Y a--,Y

a (:lo:1) · · · (:lo:n)<P( 0:1, · · · , O:n) a<P(P1, ... ,Pn) for any new, distinct parameters P1, ... , Pn

Now, here is the promised proof of equivalence.

THEOREM 11.18 Assume all the Axioms to this point, except for Axiom 11.10 and Axiom 11.9. The following are equivalent, using 85:

1 Axiom 11.10;

2 P(G);

3 O(:JEx)G(x);


4 0(3x)G(x).

Proof We already know 1 implies 2, this is Proposition 11.16. Likewise 3 follows from 2, by Theorem 11.17. And the implication of 4 from 3 is trivial.

Showing that 4 implies 2 is straightforward, using the fact that G and G* are equivalent, and the fact that positiveness is rigid. Here is a tableau derivation.

1 0(3x)G(x) 1. 1 •P(G) 2. 1.1 (3x)G(x) 3. 1.1 G(g) 4. 1.1 ('v'x)[G(x) = G*(x)] 5. 1.1 [G(g) = G*(g)] 6. 1.1 G*(g) 7. 1.1 (>.x.('v'Y)[P(Y) = Y(x)])(g) 8. 1.1 (W)[P(Y) = Y(g)] 9. 1.1 [P(G) = G(g)] 10. 1.1 P(G) 11. 1 (VX)[•P(X) :J 0-.P(X) 12. 1 •P( G) :J D·P( G) 13. 1 D·P( G) 14. 1.1•P(G) 15.

Item 3 is from 1 by a possibility rule; 4 is from 3 by an existential rule, with g as a new parameter; 5 is Proposition 11.14, and note that the modal version of Corollary 4.34 is being used here; 6 is from 5 by a universal rule; 7 is from 4 and 6 by a derived rule; 8 is 7 unabbreviated; 9 is from 8 by an abstraction rule; 10 is from 9 by a universal rule; 11 is from 10 and 4 by a derived rule; 12 is an equivalent of Axiom 11.11; 13 is from 12 by a universal rule; 14 is from 2 and 13 by a derived rule; 15 is from 14 by a necessity rule.

Showing 2 implies 1 informally is also not hard. If C is any collection of positive properties, G entails every member of C by Exercise 3.1. It follows that G also entails the conjunction of C. Since 2 says G is positive, the conjunction of C is positive by Axiom 11.5. The informal argument just sketched can be turned into a proper tableau proof. In Figure 11.2 I give a proof that 2 implies Axiom 11.9, and I'll leave the argument for Axiom 11.10 as an exercise.

In Figure 11.2, item 3 is from 2 by a (derived) existential rule; 4 and 5 are from 3, and 6 and 7 are from 4 by conjunctive rules; 8 is Axiom 11.5; 9 is from 8 by a derived universal rule; 10 is from 1 and 9 by a derived

GODEL'S ARGUMENT, FORMALLY

1 P(G) 1. 1 -{v'X)(W){[P(X) 1\ P(Y)] :::> P(X 1\ Y)} 2. 1 •{[P(A) 1\ P(B)] :::> P(A 1\ B)} 3. 1 P(A) 1\ P(B) 4. 1 •P(A 1\ B) 5. 1 P(A) 6. 1 P(B) 7. 1 ('v'X)('v'Y){[P(X) 1\ D('v'Ex)(X(x) :::> Y(x))] :::> P(Y)} 8. 1 [P(G) 1\ D('v'Ex)(G(x) :::>(A 1\ B)(x))] :::> P(A 1\ B) 9. 1 D('v'Ex)(G(x) :::>(A 1\ B)(x)) :::> P(A 1\ B) 10. 1 •D('v'Ex)(G(x) :::>(A 1\ B)(x)) 11. 1.1•(\:IEx)(G(x) :::>(A 1\ B))(x) 12. 1.1•(\:lx)[E(x) :::> (G(x) :::> (A 1\ B)(x))] 13. 1.1-,[E(c) :::> (G(c) :::>(A 1\ B)(c))] 14. 1.1 E(c) 15. 1.1•(G(c) :::> (A 1\ B)( c)) 16. 1.1 G(c) 17. 1.1-,(AAB)(c) 18. 1 ('v'X)[P(X) :::> DP(X)] 19. 1 P(A) :::> DP(A) 20. 1 P(B) :::> DP(B) 21. 1 DP(A) 22. 1 DP(B) 23. 1.1 P(A) 24. 1.1 P(B) 25. 1.1 (>.x.('v'Y)[P(Y) :::> Y(x)])(c) 26. 1.1 ('v'Y)[P(Y) :::> Y(c)] 27. 1.1 P(A) :::> A(c) 28. 1.1 P(B) :::> B(c) 29. 1.1 A(c) 30. 1.1 B(c) 31. 1.1•(.\x.A(x) 1\ B(x))(c) 32. 1.1•[A(c) 1\ B(c)] 33.

/~ 1.1·A(c) 34. 1.1•B(c) 35.

Figure 11.2. Proof that item 2 implies Axiom 11.9

155


rule; 11 is from 5 and 10 by a derived rule; 12 is from 11 by a possibility rule; 13 is 12 unabbreviated; 14 is from 13 by an existential rule; 15 and 16 are from 14, and 17 and 18 are from 16 by conjunctive rules; 19 is Axiom 11.11; 20 and 21 are from 19 by universal rules; 22 is from 6 and 20, and 23 is from 7 and 21, by derived rules; 24 is from 22 and 25 is from 23 by necessity rules; 26 is 17 unabbreviated; 27 is from 26 by an abstraction rule; 28 and 29 are from 27 by universal rules; 30 is from 24 and 28, and 31 is from 25 and 29 by derived rules; 32 is 18 unabbreviated; 33 is from 32 by an abstraction rule; 34 and 35 are from 33 by a disjunctive rule. •

Exercises EXERCISE 4.1 Give a tableau proof showing that 0(3x)G(x) implies Axiom 11.10.

5. Essence Even though we ran into the old Descartes problem with half of the

Godel argument, we should not abandon the enterprise. The other half contains interesting concepts and arguments. This is the half in which it is shown that God's existence is necessary, if possible. For starters, Godel defines a notion of essence that plays a central role, and is of interest in its own right. [Haz98] makes a case for calling Godel's notion character, reserving the term essence for something else. I follow Godel's terminology. The essence of something, x, is a property that entails every property that x possesses. Godel says it as follows.

cp Ess x = (\17/!){7/J(x) ~ 0(\fy)[cp(y) ~ 7/J(y)]}

As just given, it does not follow that the essence of x must be a property that x possesses. Dana Scott assumed this was simply a slip on the part of Godel, and inserted a conjunct cp(x) into the definition. I will follow him in this.

cp Ess x = cp(x) 1\ (V7j!){7j!(x) ~ D('v'y)[cp(y) ~ 7/J(y)]}

Godel states cp Ess x as a formula rather than a term-in the version in this book an explicit predicate abstract is used. Also, I assume the type-0 quantifier that appears is actualist, and so in my version the existence predicate, E, must appear. £(P, q) is intended to assert that P is the essence of q.

DEFINITION 11.19 (ESSENCE, FORMALIZING INFORMAL DEF. 4) £ abbreviates the following type i (i (0), 0) term, in which Z is of type

GODEL'S ARGUMENT, FORMALLY

i(O) and w is of type 0:

(.XY,x.Y(x) A ('v'Z){Z(x):) O('v'Ew)[Y(w):) Z(w)]})

157

The property of being Godlike was defined earlier, Definition 11.12. A central fact about Godlikeness, from Godel's notes, is that it is the essence of any being that is Godlike.

THEOREM 11.20 (FORMALIZING INFORMAL PROPOSITION 5) Assume Axioms 11.3B and 11.11. InK the following is provable. (Note that x is of type 0.)

('v'x)[G(x) :) £( G, x)].

Rather than giving a direct proof, if we use Proposition 11.14 it follows from a similar result concerning G*, provided Axiom 11.3B is assumed. Since such a result has a somewhat simpler proof, this is what is actually shown.

THEOREM 11.21 InK the following is provable, assuming Axiom 11.11.

(\fx)[G*(x):) £(G*,x)].

Proof Here is a closed K tableau to establish the theorem.

1 •('v'x )[G* (x) :) £( G*, x )] 1. 1 -.., [ G* (g) :) £ ( G*, g)] 2. 1 G*(g) 3. 1-.E(G*,g) 4. 1-.{G*(g) A ('v'Z){Z(g):) D('v'Ew)[G*(w):) Z(w)]}} 5.

/~ 1-.G*(g) 6. 1•(\IZ){Z(g):) O('v'Ew)[G*(w):) Z(w)]} 7.

Item 2 is from 1 by an existential rule, with g a new parameter; 3 and 4 are from 2 by a conjunction rule; 5 is from 4 by a derived unsubscripted abstract rule; 6 and 7 are from 5 by a disjunction rule. The left branch is closed. I continue with the right branch, below item 7.


1 •{Q(g) :J D(VEw)[G*(w) :J Q(w)]} 8. 1 Q(g) 9. 1 ·D(VEw)[G*(w) j Q(w)] 10. 1.1·(V'Ew)[G*(w) :J Q(w)] 11. 1.1•{E(a) :J [G*(a) :J Q(a)]} 12. 1.1 E(a) 13. 1.1--,[G*(a) :J Q(a)] 14. 1.1 G*(a) 15. 1.1 •Q( a) 16. 1 (VY)[P(Y) = Y(g)] 17. 1 P(Q) = Q(g) 18. 1 P(Q) 19. 1.1 (VY)[P(Y) = Y(a)] 20. 1.1 P(Q) = Q(a) 21. 1 (VY)[P(Y) :J DP(Y)] 22. 1 P( Q) :J DP( Q) 23. 1 DP(Q) 24. 1.1 P(Q) 25. 1.1 Q(a) 26.

Item 8 is from 7 by an existential rule, with Q a new parameter; 9 and 10 are from 8 by a conjunction rule; 11 is from 10 by a possibility rule; 12 is from 11 by an existential rule; 13 and 14 are from 12 by a conjunctive rule, as are 15 and 16 from 14; 17 is from 3 by a derived unsubscripted abstract rule; 18 is from 17 by a universal rule; 19 is from 9 and 18 by an earlier derived rule; 20 is from 15 by a derived unsubscripted abstract rule; 21 is from 20 by a universal rule; 22 is Axiom 11.11; 23 is from 22 by a universal rule; 24 is from 19 and 23 by a derived rule; 25 is from 24 by a necessity rule; 26 is from 21 and 25 by a derived rule. The branch is closed by 16 and 26. •

In the notes Dana Scott made when Godel showed him his proof, there are two observations concerning essences. One is that something can have only one essence. The other is that an essence must be a complete characterization. Here are versions of these results. I begin by showing that any two essences of the same thing are necessarily equivalent.

THEOREM 11.22 Assume the modal logic is K. The following is provable.

(VX)(VY)(Vz){[t'(X, z) 1\ t'(Y, z)] :J D(VEw)[X(w) = Y(w)]}

Proof The idea behind the proof is straightforward. If P and Q are essences of the same object, each must entail the other. I give a tableau


proof mainly to provide another example of such. It starts by negating the formula, applying existential rules three times, introducing new parameters P, Q, and a, then applying various propositional rules. Omitting all this, we get to items 1 - 3 below.

1 E(P, a) 1. 1 E(Q, a) 2. 1•D('v'Ew)[P(w) = Q(w)] 3. 1 P(a) 4. 1 ('v'Z)[Z(a) :J D('v'Ew)[P(w) :J Z(w)]] 5. 1 Q(a) 6. 1 ('v'Z)[Z(a) :J D('v'Ew)[Q(w) :J Z(w)Jl 7. 1 Q(a) :J D('v'Ew)[P(w) :J Q(w)] 8. 1 P(a) :J D('v'Ew)[Q(w) :J P(w)] 9.

/~ 1•Q(a) 10. 1 D('v'Ew)[P(w) :J Q(w)] 11.

/~ 1•P(a) 12. 1 D('v'Ew)[Q(w) :J P(w)] 13.

Items 4 and 5 are from 1 by an abstraction rule (and a propositional rule), 6 and 7 are from 2 the same way; 8 is from 5 and 9 is from 7 by universal rules; 10 and 11 are from 8, and 12 and 13 are from 9 by disjunction rules. The left branch is closed, by 6 and 10. The middle branch is closed by 4 and 12. I continue with the rightmost branch, below item 13.

1.1•('v'Ew)[P(w) = Q(w)] 14. 1.1·{E(b) :J [P(b) = Q(b)]} 15. 1.1 E(b) 16. 1.1·[P(b) = Q(b)] 17.

/~ 1.1 P(b) 18. 1.1·P(b) 20. 1.1·Q(b) 19. 1.1 Q(b) 21.

Item 14 is from 3 by a possibility rule; 15 is from 14 by an existential rule; 16 and 17 are from 15 by a conjunction rule; 18, 19, 20, 21 are from 17 by successive propositional rules. I show how the left branch can be continued to closure; the right branch has a symmetric construction which I omit.


1.1 (VEw)[P(w) :J Q(w)] 22. 1.1 E(b) :J [P(b) :J Q(b)] 23.

/~ 1.1--,E(b) 24. 1.1 P(b) :J Q(b) 25.

/~ 1.1--,P(b) 26. 1.1 Q(b) 27.

Item 22 is from 11 by a necessitation rule; 23 is from 22 by a universal rule; 24 and 25 are from 23 by a disjunction rule, as are 26 and 27 from 25. The left branch is closed by 16 and 24, the middle branch is closed by 18 and 26, and the right branch is closed by 19 and 27. •

Now, here is the second of Scott's observations: if X is the essence of y, only y can have X as a property.

THEOREM 11.23 Assume the modal logic is K, including equality. The following is valid.

(VX)(Vy){ £(X, y) :J D(VEz)[X(z) :J (y = z)]}

This can be proved using tableaus-! leave it to you as an exercise.

Exercises EXERCISE 5.1 Give a tableau proof for Theorem 11.23. Hint: for a parameter c, one can consider the property of being, or not being, c, that is, (.Xx.x =c) and (.Xx.x #c). Either property can be used in the proof.

EXERCISE 5.2 Give a tableau proof to establish Theorem 11.20 directly, without using G*.

6. Necessarily God Exists In this section I present a version of Godel's argument that God's

possible existence implies His necessary existence. It begins with the introduction of an auxiliary notion that Godel calls necessary existence.

DEFINITION 11.24 (NECESSARY EXISTENCE) (Formalizing Informal Definition 6) N abbreviates the following type i(O) term:

(.Xx.(VY)[£(Y, x) :J 0(3Ez)Y(z)]).


The idea is, something has the property N of necessary existence provided any essence of it is necessarily instantiated. Godel now makes a crucial assumption: necessary existence is positive.

AXIOM 11.25 (FORMALIZING INFORMAL AXIOM 5) 'P(N).

Given this final axiom, Godel shows that if (some) God exists, that existence cannot be contingent. An informal sketch of the proof was given in Section 6 of Chapter 10, and it can be turned into a formal proof-see Informal Propositions 7 and 8. I will leave the details as exercises, since you have seen lots of worked out tableaus now. Here is a proper statement of Godel's result, with all the assumptions explicitly stated. Nate that the necessary actualist existence of God follows from His possibilist existence.

THEOREM 11.26 (FORMALIZING INFORMAL PROPOSITION 7) Assume Axioms 11.3B, 11.11, and 11.25. In the logic K,

(3x)G(x) ::) D(3Ex)G(x).

I leave it to you to prove this, using the informal sketch as a guide. Now Godel's argument can be completed.

THEOREM 11.27 (FORMALIZING INFORMAL PROPOSITION 8) Assume Axioms 11.3B, 11.11, and 11.25. In the logic 85,

0(3x)G(x) ::) D(3Ex)G(x).

Proof From Theorem 11.26,

(3x)G(x) ::) D(3Ex)G(x).

By necessitation,

D[(3x)G(x) ::) D(3Ex)G(x)].

By the K validity D(A::) B)::) (OA::) OB),

0(3x)G(x) ::) OD(3Ex)G(x).

Finally, in 85, ODA::) DA, so we conclude

0(3x)G(x) ::) D(3Ex)G(x) .

• Now we are at the end of the argument.

COROLLARY 11.28 Assume all the Axioms. In the logic 85,

D(3Ex)G(x).

Proof By Theorems 11.27 and 11.17. •


Exercises EXERCISE 6.1 Give a tableau proof to show Theorem 11.26. Use various earlier results as assumptions in the tableau.

7. Going Further Godel's axioms admit more consequences than just those of the onto

logical argument. In this section a few of them are presented.

7.1 Monotheism Does there exist exactly one God? The following says "yes." You are

asked to prove it, as Exercise 7.1.

PROPOSITION 11.29 (3x)('v'y)[G(y) =: (y = x)j.

This Proposition has a curious Corollary. Since type-0 quantification is possibilist, it makes sense to ask if there are gods that happen to be non-existent. But Corollary 11.28 tells us there is an existent God, and the Proposition above tells us it is the only one God, existent or not. Consequently we have the following.

COROLLARY 11.30 ('v'x)[G(x) :J E(x)j.

Proposition 11.29 tells us we can apply the machinery of definite descriptions. By Definition 9.12, 1x.(W)[P(Y) :J Y(x)] always designates, and consequently so does 1x.G(x). Proposition 9.14 tells us this will be a rigid designator provided G(x) is stable. It follows from Sobel's argument in Section 8 that it, and everything else, is. But alternative versions of Godel's axioms have been proposed-! will discuss some below-and using them the stability of G(x) does not seem to be the case. That is, it seems to be compatible with the axioms of Godel (as modified by others) that, while the existence of God is necessary, a particular being that is God need not be God necessarily. If this is not the case, and a proof has been missed, I invite the reader to correct the situation.

7.2 Positive Properties are Necessarily Instantiated

Proposition 11.8 says that positive properties are possibly instantiated. In [Sob87], it is observed that a consequence of Corollary 11.28 is that every positive property is necessarily instantiated.

PROPOSITION 11.31 ('v'X){'P(X) :J 0(3Ex)X(x)}.

I leave the easy proof of this to you.


Exercises EXERCISE 7.1 Give a tableau proof for Proposition 11.29. Hint: you will need Corollary 11.28, Theorem 11.20, and Theorem 11.23.

EXERCISE 7.2 Provide a tableau proof for Proposition 11.31. Hint: by Corollary 11.28, a Godlike being necessarily exists. Such a being has all positive properties, so every positive property is instantiated. Now, build this into a tableau.

8. More Objections In Section 4 we saw that one of Godel's Axioms was equivalent to

the possible existence of God. Other objections have been raised that are equally as serious. Chapter 4 of [SobOl] discusses problems with Axiom 11.25, that necessary existence is positive. I do not take this point up here. But also in [SobOl], and earlier in [Sob87], it was argued that Godel's axiom system is so strong it implies that whatever is the case is so of necessity, Q ::J DQ. In other words, the modal system collapses. In still other, more controversial, words, there is no free will. Roughly speaking, the idea of Sobel's proof is this. God, having all positive properties, must possess the property of having any given truth be the case. Since God's existence is necessary, anything that is a truth must necessarily be a truth.

Here is a version of the argument given by Sobel. For simplicity, assume Q is a formula that contains no free variables. By Theorem 11.20,

(\fx)[G(x) ::J £( G, x)]. (11.1)

Using the definition of£, we have as a consequence

(\fx){G(x) ::J ('v'Z){Z(x) ::J D('v'Ew)[G(w) ::J Z(w)]}}. (11.2)

There is a minor nuisance to deal with. In the formula (11.2) I would like to instantiate the quantifier ('v'Z) with Q, but this is not a 'legal' term, so instead I use the term (>..y.Q) to instantiate. In it, y is of type 0, and so (>..y.Q) is of type i(O). We get the following consequence.

(\fx){G(x) ::J {(>..y.Q)(x) ::J D('v'Ew)[G(w) ::J (>..y.Q)(w)]}}. (11.3)

Now to undo the technicality just introduced, note that since y does not occur free in Q, (>..y.Q)(x) = (>..y.Q)(w) = Q, and so we have

(\fx){G(x) ::J {Q ::J D('v'Ew)[G(w) ::J Q]}}. (11.4)


Since x does not occur free in the consequent, (11.4) is equivalent to the following:

(3x)G(x) :::> {Q :::> D('v'Ew)(G(w) :::> Q)}. (11.5)

We have Corollary 11.28, from which

(3x)G(x) (11.6)

follows. Then from (11.5) and (11.6) we have

Q :::> D('v'Ew) ( G( w) :::> Q). (11.7)

Since Q has no free variables, (11.7) is equivalent to the following:

Q :::> D[(3Ew)G(w) :::> Q]. (11.8)

Using the distributivity of D over implication, (11.8) gives us

Q :::> [D(3Ew)G(w) :::> DQ]. (11.9)

Finally (11.9), and Corollary 11.28 again, give the intended result,

Q :::> DQ. (11.10)

Most people have taken this as a counter to Godel's argument-if the axioms are strong enough to admit such a consequence, something is wrong. In the next two sections I explore some ways out of the difficulty.

9. A Solution Sobel's demonstration that the Godel axioms imply no free will rather

takes the fun out of things. In this section I propose one solution to the problem. I don't profess to understand its implications fully. I am presenting it to the reader, hoping for comments and insights in return.

Throughout, it has been assumed that Godel had in mind intensional properties when talking about positiveness and essence. But, suppose not-suppose extensional properties were intended. I reformulate Godel's argument under this alternative interpretation. It is one way of solving the problem Sobel raised.


In this section only I will take P to be a constant symbol of type i((O)). Axiom 11.5 gets replaced with the following.

Revised Axiom 11.5 In the formula below, xis of type 0, and X and Y are of type (0).

(VX)(VY){[P(X) A D(V'Ex)(X(x) :J Y(x))] :J P(Y)}

Note that this has the same form as Axiom 11.5, but the types of variables X and Y are now extensional rather than intensional. This will be the general pattern for changes. The definition of negative, for instance, is modified as follows. For a term T of type (0), take •T as short for l(.Xx.•T(x)). Then Axioms 11.3A and 11.3B, 11.10, and 11.11, all have their original form, but with variables changed from intensional to extensional type.

The analog of Proposition 11.8 still holds, but with extensional variables involved.

(VX){P(X) :J 0(3Ex)X(x)}

Analogs of G and G* are defined in the expected way. G is the following type j(O) term, where Y is type (0) and, as noted before, Pis of type j((O)).

(.Xx.(VY)[P(Y) :J Y(x)])

Likewise G* is the type i(O) term

(.Xx.(W)[P(Y) = Y(x)]).

One can still prove (Vx)[G(x) = G*(x)]. Essence must be redefined, but again it is only variable types that are

changed. £ now abbreviates the following type j( (0), 0) term, in which Z is of type (0) and w is of type 0:

(.XY, x.Y(x) A (VZ){Z(x) :J D(V'Ew)[Y(w) :J Z(w)]})

Theorem 11.21 plays an essential role in the Godel proof, and it too continues to hold, in a slightly modified form:

(Vx)[G*(x) :J £(1G*, x)] . . I leave the proof of this to you-it is similar to the earlier one.

Of course we must modify the definition of Necessary Existence, to use the revised version of essence, and Axiom 11.25 as well, to use the modified definition of Necessary Existence. For this section, N abbreviates the following type j(O) term, in which Y is of type (0):

(>.x.('VY)[E(Y, x) :J D(3Ez)Y(z)).


Revised Axiom 11.25 is P(lN), where N is as just modified. With this established, the rest of Godel's argument carries over di

rectly, giving us the following.

0(:3E z) {tG*) (z)

The final step is the easy proof that this implies the desired 0(:3Ez)G*(z), and hence O(::JEz)G(z), and I leave this to you.

So, we have the conclusion of Godel's argument. Finally, here is a model, adapted from [And90], that shows Sobel's continuation no longer applies.

EXAMPLE 11.32 Construct a standard S5 model as follows. There are two possible worlds, call them r and D.. The accessibility relation always holds. The type-0 domain is the set {a, b}. Since this is a standard model, the remaining types are fully determined.

The existence predicate, E, is interpreted to have extension {a, b} at r and {a} at D.. Informally, all type-0 objects exist at r, but only a exists at D..

Call a type-(0) object positive if it applies to a. Interpret P so that at each world its extension is the collection of positive type-(0) objects; that is, at each world P designates {{a}, {a, b}}.

This finishes the definition of the model. I leave the following facts about it for you to verify.

1 The designation of G in this model is rigid, with {a} as its extension at both worlds.

2 The designation of £ is also rigid, with extension { ( {a}, a), ( { b}, b)} at each world. Loosely, the essence of a is {a} and the essence of b is {b}.

3 The designation of N is also rigid, with extension {a} at each world.

4 All the Axioms are valid, as modified in this section.

Now take Q to be the closed formula (::JEx)(::JEy)-,(x = y). Since it asserts two objects actually exist, it is true at r, but not at D., and hence Q :J OQ is not true at r.

We now know that Sobel's argument must break down in the present system, but it is instructive to try to reproduce the earlier proof, and see just where things go wrong. The attempted argument takes on a rather formidable appearance--you might want to skip to the last paragraph and read the conclusion, before going through the details.


We try to prove Q ::) DQ, starting more or less as we did before.

(Vx)[G(i) ::) £(lG, x)] (11.11)

which, unabbreviated, is

(Vx)[G(x) ::)

(.XY,x.Y(x) 1\ (VZ){Z(x)::) D(VEw)[Y(w)::) Z(w)]})(1G,x)] (11.12)

where Y and Z are of type (0), unlike in (11.2) where they were of type j(O).

The variable xis of type 0, and it is easy to show the following simpler formula is a consequence of (11.12).

(\ix)[G(x) ::)

(.XY.Y(x) 1\ (VZ){Z(x) ::) D(VEw)[Y(w) ::) Z(w)]})(1G)] (11.13)

From this we trivially get the following.

(Vx)[G(x) ::)

(.XY.(VZ){Z(x)::) D(VEw)[Y(w)::) Z(w)]})(1G)] (11.14)

Next, in the argument of Section 8, we instantiated the quantifier (V Z) with the term (.Xy.Q). Of course we cannot do that now, since (.Xy.Q) is an intensional term, while the present quantifier (V Z) is extensional. Apply the extension-of operator, getting 1(-Xy.Q), and use this instead. But universal instantiation involving relativized terms is a little tricky. If 1 T is a relativized term of the same type as Z, (VZ)cp(Z) ::) cp(l T) is not generally valid. What is valid is ('v'Z)cp(Z) ::) (.XZ.cp(Z))(1T). So what we get from formula (11.14) when we instantiate the quantifier is the following consequence.

(Vx)[G(x) ::)

(.XY, Z.Z(x) ::) D(VEw)[Y(w) ::) Z(w)])(1G, 1(-Xy.Q) )] (11.15)

Distributing the abstraction, this is equivalent to the following.

(Vx ){ G(x) ::)

[(.XY, Z.Z(x))(lG, 1(-Xy.Q))::) (11.16)

(.XY, Z.D('v'Ew)(Y(w)::) Z(w)))(lG, 1(-Xy.Q))]}


The variable x does not occur free in (>.y.Q) and Y does not occur in Z(x), so (>.Y,Z.Z(x))(lG,l(>.y.Q)) is simply equivalent to Q, and (11.16) reduces to the following.

('v'x){G(x) :J

[Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) )]} (11.17)

From this we get

(3x)G(x) :J

[Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) )] (11.18)

and since we have (3x)G(x), we also have

Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) ). (11.19)

Since Q has no free variables, (11.19) can be shown to be equivalent to the following (where a constant symbol a has been introduced to keep formula formation correct).

Q :J (>.Y, Z.D((3Ew)Y(w) :J Z(a)))(lG, l(>.y.Q)).

Using the distributivity of 0 over implication, (11.20) gives us

Q :J (>.Y, Z.D(3Ew)Y(w) :J DZ(a))(lG, l(>.y.Q)).

From (11.21) we get

Q :J[(>.Y, Z.D(3Ew)Y(w))(lG, l(>.y.Q)) :J (>.Y, Z.DZ(a))(lG, l(>.y.Q) )].

(11.20)

(11.21)

(11.22)

Because Z has no free occurrences in D(3Ew)Y(w) and Y has no free occurrences in Z(a), (11.22) can be simplified to

Q :J[(>.YD(3Ew)Y(w))(lG) :J (>.Z.DZ(a))(l(>.y.Q) )].

(11.23)

I don't know the status of (>.Y.D(3Ew)Y(w))(lG), that is, whether or not it follows from the axioms used in this section. It does hold provided


G is rigid, so in particular, it holds in the model of Example 11.32. Consequently, in settings like that model (11.23) reduces to the following.

Q:) (>.Z.DZ(a))(l(>.y.Q)). (11.24)

But (>.Z.DZ(a))(l (.>.y.Q)) is not equivalent to DQ, and that's an end of it. Expressing the essential idea of (.>.Z.DZ(a))(l(.>.y.Q)) with somewhat informal notation, we might write it as (>.Z.DZ)(lQ), and so what has been established, assuming rigidity of G, is

Q :) (.>.Z.DZ)(lQ) (11.25)

and this is quite different from Q :) DQ. In the abstract, the variable Z is assigned the current version of Q-its truth value in the present world. Perhaps an example will make clear what is happening. Suppose it is the case, in the real world, that it is raining-take this as Q. If we had validity of Q :) DQ, it would necessarily be raining-DQ-and so in every alternative world, it would be raining. But what we have is Q :) (.>.Z.DZ)(lQ), and since Q is assumed to hold in the real world, we conclude (>.Z.DZ)(lQ). This conclusion asserts something more like: if it is raining in the real world, then in every alternative world it is true that it is raining in the real world. As it happens, this is trivially correct, and says nothing about whether or not it is raining in any alternative world.

10. Anderson's Alternative One solution to the objection Sobel raised has been presented. In

[And90] some different, quite reasonable, modifications to the Godel axioms are proposed that also manage to avoid Sobel's conclusion. For this section I return to the use of intensional variables.

Axiom 11.3B is something of a problem. Essentially it says, everything must be either positive or negative. As Anderson observes, why can't something be indifferent? Anderson drops Axiom 11.3B.

The most fundamental change, however, is elsewhere. Definition 11.12 and its alternative, Definition 11.13, are discarded. Instead there is a requirement that a Godlike being have positive properties necessarily.

DEFINITION 11.33 (GODLIKE, ANDERSON VERSION) GA is the type j (0) term

(.Xx.(W)[P(Y) := DY(x)]).

There is a corresponding change in the definitions of essence and necessary existence. Definition 11.19 gets replaced by the following


DEFINITION 11.34 (ESSENCE, ANDERSON VERSION) [A abbreviates the following type i(i(O), 0) term:

(.XY, x.(VZ){DZ(x) =: D(VEw)[Y(w) :J Z(w)]})

Notice several key things about this definition. The Scott addition, that the essence of an object actually apply to the object, is dropped. A necessity operator has been introduced that was not present in the definition of £. And finally, an implication in the definition of £ has been replaced by an equivalence.

The definition of necessary existence, Definition 11.24, is replaced by a version of the same form, except that Anderson's definition of essence is used in place of that of Godel.

DEFINITION 11.35 (NECESSARY EXISTENCE, ANDERSON VERSION) NA abbreviates the following type j(O) term:

(.Xx.(VY)[£A(Y, x) :J D(3Ez)Y(z)).

Now, what happens to earlier reasoning? Of course Proposition 11.8 still holds, since Axioms 11.3A and 11.5 remain unaffected. Theorem 11.20 turns into the following.

THEOREM 11.36 In S5 the following is provable.

(Vx)[GA(x) :J eA(GA,x)].

I leave it to you to verify the theorem, using tableaus say. Next, Anderson replaces Axiom 11.25 with a corresponding version

asserting that his modification of necessary existence is positive.

AXIOM 11.37 (ANDERSON'S VERSION OF 11.25) P(NA).

Now Theorem 11.26 turns into the following.

THEOREM 11.38 Assume Axioms 11.11 and 11.37. In the logic S5,

(3x)GA(x) :J 0(3Ex)GA(x).

Once again, I leave the proof to you. These are the main items. The rest of the ontological argument goes through as before. At the end, we have the following.

THEOREM 11.39 Assume all the Axioms 11.3A, 11.5, 11.10, 11.11, and 11.37. In the logic S5,

Thus the desired necessary existence follows, and with one fewer axiom (though with more complex definitions). And a model, closely related to the one given in the previous section, can be constructed to show that these axioms do not yield Sobel's undesirable conclusion-see [And90] for details.

Exercises EXERCISE 10.1 Supply a tableau argument for Theorem 11.36. Do the same for Theorem 11.38.

11. Conclusion Godel's proof, and criticisms of it, have inspired interesting work.

Some was mentioned above. More remains to be done. Here I briefly summarize some directions that might profitably be explored.

[Haj95] studies the role of the comprehension axioms-work that is summarized in [Haj96b]. Completely general comprehension axioms are implicit in my presentation, they are present as the assumption that every abstract has a meaning. Hajek confines things to a second-order intensional logic, augmented with one third-order constant to handle positiveness. In this setting Hajek introduces what he calls a cautious comprehension schema:

('v'x)[G(x) :J (D(x) V 0-.(x))] :J (:3Y)D('v'x)[Y(x) = (x)].

Hajek shows that Godel's axioms do not lead to a proof of Q :J DQ, provided cautious comprehension replaces full comprehension, but the necessary existence of God still can be concluded.

Hajek refutes a claim by Magari, [Mag88], that a subset of Godel's axiom system is sufficient for the ontological argument. But he also shows Magari's claim does apply to Anderson's system. And he shows that Godel's axioms, with cautious comprehension, can be interpreted in Anderson's system, with full comprehension.

The results of Hajek assume an underlying model with constant domains but no existence predicate, and only intensional properties. It is not clear what happens if these assumptions are modified.

In Section 7, some further consequences of Godel's axioms were discussed. I don't know what happens to these when the axioms are modified in the various ways suggested here and in the previous two sections. Nor do I know the relationships, if any, between the extensional-property approach I suggested, and Anderson's version.

Finally, and most entertainingly, I refer you to an examination of ontological arguments and counter-arguments in the form of a series of


puzzles, in [Smu83], Chapter 10. You should find this fun, and a bit of a relief after the rather heavy going of the book you just finished.

References

(Ada95]

(AG96]

(And71]

[And72]

[And86]

[And90]

(Bre72]

(Car 56]

(Cha79]

[Chu40]

Note to reader: At the end of each bibliography item is a list of the pages on which there is a reference to the item. Robert Merrihew Adams. Introductory note to *1970. In Feferman et al. (FJWDG+95], pages 388-402. pages 138

C. Anthony Anderson and Michael Gettings. Gooel's ontological proof revisited. pages 167-172, 1996. In [Haj96a]. pages 139, 148

Peter B. Andrews. Resolution in type theory. Journal of Symbolic Logic, 36(3):414-432, 1971. pages 42, 47

Peter B. Andrews. General models and extensionality. Journal of Symbolic Logic, 37(2):395-397, 1972. pages 25

Peter B. Andrews. An Introduction to Mathematical Logic and Type Theory: To Truth Through Proof Academic Press, Orlando, Florida, 1986. pages xii

C. Anthony Anderson. Some emendations of Gooel's ontological proof. Faith and philosophy, 7:291-303, 1990. pages 139, 166, 169, 171

Aldo Bressan. A General Interpreted Modal Calculus. Yale University Press, 1972. pages 96, 102

Rudolph Carnap. Meaning and Necessity. University of Chicago Press, Chicago, 2 edition, 1956. pages xv

M. J. Charlesworth. St. Anselm's Proslogion. University of Notre Dame Press, Notre Dame, IN, 1979. First edition, Oxford University Press, 1965. pages 134, 134

Alonzo Church. A formulation of the simple theory of types. Journal of Symbolic Logic, 5:56-68, 1940. pages 4

173

174

[Coc69]

[Des51]

[Fit83]

[Fit93]

[Fit96]

[Fit98]

[FitOOa]

[FitOOb]

[FJWDG+95]

[FM98]

[G70]

[Gal75]

[GHR94]

TYPES, TABLEAUS, AND GODEL'S GOD

Nino B. Cocchiarella. A completeness theorem in second order modal logic. Theoria, 35:81-103, 1969. pages 90, 96, 139

Rene Descartes. A Discourse on Method and Selected Writings. Everyman's Library. E. P. Dutton, New York, 1951. Translation by John Veitch. pages 135, 135

Melvin C. Fitting. Proof Methods for Modal and Intuitionistic Logics. D. Reidel Publishing Co., Dordrecht, 1983. pages 95, 102, 110

Melvin C. Fitting. Basic modal logic. pages 368-448. 1993. In [GHR94] Volume 1. pages 95, 110

Melvin C. Fitting. First-Order Logic and Automated Theorem Proving. Springer-Verlag, 1996. First edition, 1990. pages 8, 10, 33, 37, 41, 47

Melvin C. Fitting. Higher-order modal logic-a sketch. In Ricardo Caferra and Gernot Salzer, editors, Automated Deduction in Classical and Non-Classical Logics, pages 23-38. Springer Lecture Notes in Artificial Intelligence, 1761, 1998. pages 96

Melvin C. Fitting. Databases and higher types. In John Lloyd, Veronica Dahl, Ulrich Furbach, Manfred Kerber, Kung-Kiu Lau, Catuscia Palamidessi, Luis Moniz Pereira, Yehoshua Sagiv, and Peter Stuckey, editors, Computational Logic-CL 2000, pages 41-52. Springer Lecture Notes in Artificial Intelligence, 1861, 2000. pages xiii

Melvin C. Fitting. Modality and databases. In Roy Dyckhoff, editor, Automated Reasoning with Analytic Tableaux and Related Methods, pages 19-39. Springer Lecture Notes in Artificial Intelligence, 1847, 2000. pages xiii, 96

Solomon Feferman, Jr. John W. Dawson, Warren Goldfarb, Charles Parsons, and Robert N. Solovay, editors. Kurt Godel Collected Works, Volume III, Unpublished Essays and Lectures. Oxford University Press, New York, 1995. pages 173, 174

Melvin C. Fitting and Richard Mendelsohn. First-Order Modal Logic. Kluwer, 1998. Paperback, 1999. pages xiv, 4, 89, 96, 101, 102, 102, 102, 105, 108, 110, 119, 122, 122, 125

Kurt Gooel. Ontological proof. In Feferman et al. [FJWDG+95], pages 403-404. pages 139, 145

D. Gallin. Intensional and Higher-Order Modal Logic. NorthHolland, 1975. pages xv, 86, 102, 102

Dov M. Gabbay, C. J. Hogger, and J. A. Robinson, editors. Handbook of Logic in Artificial Intelligence and Logic Programming. Oxford University Press, 1993-94. pages 17 4, 176

REFERENCES 175

[Gil99] Paul C. Gilmore. Partial functions in an impredicative simple theory of types. In Neil V. Murray, editor,. Automated Reasoning with Analytic Tableaux and Related Methods, number 1617 in Lecture Notes in Artificial Intelligence, pages 186--201, Berlin, 1999. Springer. pages 4

[Gil01] Paul C. Gilmore. An intensional type theory: motivation and cutelimination. To appear, Journal of Symbolic Logic, 2001. pages 4, 33

[Gol81] Warren D. Goldfarb. The undecidability of the second-order unification problem. Theoretical Computer Science, 13:225-230, 1981. pages 42

[Haj95] Petr Hajek. Der Mathematiker und die Frage der Existenz Gottes. To appear in Wahrheit und Beweisbarkeit- Leben und Werk von K. Godel, Buld, Kohler, and Schimanowicz., 1995. pages 171

[Haj96a] Petr Hajek, editor. Godel '96, Berlin, 1996. Springer. pages 173

[Haj96b] Petr Hajek. Magari and others on Gooel's ontological proof. In Ursini and Agliano, editors, Logic and Algebra, pages 125-136. Marcel Dekker, Inc., 1996. pages 139, 171

[Har65] Charles Hartshorne. Anselm's Discovery: A Re-Examination of the Ontological Proof for God's Existence. Open Court, LaSalle, IL, 1965. pages 134

[Haz98] A. P. Hazen. On Gooel's ontological proof. Australasian Journal of Philosophy, 76(3):361-377, 1998. pages 156

[HC96] G. E. Hughes and M. J. Cresswell. A New Introduction to Modal Logic. Routledge, London and New York, 1996. pages 38, 89, 102

[Hen50] Leon Henkin. Completeness in the theory of types. Journal of Symbolic Logic, 15:81-91, 1950. pages 19, 25

[Hue72] Gerard P. Huet. Constrained Resolution: A Complete Method for Higher Order Logic. PhD thesis, Case Western Reserve University, 1972. pages 42

[Hue73] Gerard P. Huet. The undecidability of unification in third-order logic. Information and Control, 22:257-267, 1973. pages 42

[Hue75] Gerard P. Huet. A unification algorithm for typed >.-calculus. Theoretical Computer Science, 1:27-57, 1975. pages 42

[Koh95] Michael Kohlhase. Higher-order tableaux. In Peter Baumgartner, Reiner Hiihnle, and Joachim Posegga, editors, Theorem Proving with Analytic Tableaux and Related Methods, volume 918 of Lecture Notes in Artificial Intelligence, pages 294-309, Berlin, 1995. Springer-Verlag. pages xii, 33, 42

176

[Kri80]

(Lei 56]

[Lei94]

(Mag88]

[Man96]

(Mon60]

(Mon68]

(Mon70]

(Opp95]

[Opp96a]

[Opp96b]

(Opp01]

(Pla65]

(Pra68]

[Rob77]

TYPES, TABLEAUS, AND GODEL'S GOD

Saul Kripke. Naming and Necessity. Harvard University Press, 1980. pages 121

Gottfried Wilhelm Leibniz. Philosophical Papers and Letters. D. Reidel, Dordrecht-Holland, 2 edition, 1956. Translated and Edited by Leroy E. Loemker. pages 137, 138

Daniel Leivant. Higher order logic. pages 229-321. 1994. In [GHR94] Volume 2. pages xii

R. Magari. Logica e teofilia. Notizie di logica, VII(4), 1988. pages 171

Maria Manzano. Extensions of First Order Logic. Cambridge University Press, Cambridge, UK, 1996. pages xii

Richard Montague. On the nature of certain philosophical entities. The Monist, 53:159-194, 1960. Reprinted in (Tho74], 148-187. pages xv, 102

Richard Montague. Pragmatics. pages 102-122. 1968. In Contemporary Philosophy: A Survey, R. Klibansky editor, Florence, La Nuova Italia Editrice, 1968. Reprinted in [Tho74], 95-118. pages xv, 102

Richard Montague. Pragmatics and intensional logic. Synthese, 22:68-94, 1970. Reprinted in [Tho74], 119-147. pages xv, 102

Graham Oppy. Ontological Arguments and Belief in God. Cambridge University Press, Cambridge, UK, 1995. pages 134

Graham Oppy. Gooelian ontological arguments. Analysis, 56(4):226-230, October 1996. pages 176

Graham Oppy. Ontological arguments. The Stanford Encyclopedia of Philosophy, Edward N. Zalta (ed.), March 13 1996. Available on the internet. URL = http:/ /plato.stanford.edu/entries/ontologicalarguments/. pages 134, 139

Graham Oppy. Gooelian ontological arguments. Available on the Internet. URL = http://www .infidels.org/library /modern/ graham_oppy / godel.ht, 2001. Originally published as (Opp96a]. pages 139

Alvin Plantinga. The ontological argument, from St. Anselm to contemporary philosophers. Anchor-Doubleday, Garden City, NY, 1965. pages 134

Dag Prawitz. Hauptsatz for higher order logic. Journal of Symbolic Logic, 33:452-457, 1968. pages xii, 35, 43, 46, 47, 67

The Gospel of Philip. In James M. Robinson, editor, The Nag Hammadi Library in English. Harper and Row, New York, 1977. pages ix

REFERENCES 177

[Rus05] Bertrand Russell. On denoting. Mind, 14:479-493, 1905. Reprinted in Robert C. Marsh, ed., Logic and Knowledge: Essays 1901-1950, by Bertmnd Russell, Allen & Unwin, London, 1956. pages 125

[Sch60] Kurt Schutte. Syntactical and semantical properties of simple type theory. Journal of Symbolic Logic, 25(4):305-326, December 1960. pages 4

[Sha91] Stewart Shapiro. Foundations Without Foundationalism: A Case for Second-Order Logic. Number 17 in Oxford Logic Guides. Oxford University Press, Oxford, UK, 1991. pages xii

[SmaOl]

[Smi93]

[Smu68]

[Smu83]

(Sob87]

(SobOl]

[Tak67]

[Tar 55]

[Tho74]

(Tho87]

(Tol75]

Christopher Small. Kurt Gooel's ontological argument. Available on the internet. URL = http:/ /www.stats.uwaterloo.ca/ "-'Cgsmall/ontology.html, 2001. pages 139

Perry Smith. Higher-order logic, model theory, recursion theory, and proof theory. Unpublished manuscript, 1993. pages 33

Raymond M. Smullyan. First-Order Logic. Springer-Verlag, Berlin, 1968. Revised Edition, Dover Press, New York, 1994. pages 33, 37, 47

Raymond M. Smullyan. 5000 B. C. and Other Philosophical Fantasies. St. Martin's Press, New York, 1983. pages 172

Jordan Howard Sobel. Gooel's ontological proof. pages 241-261. 1987. In [Tho87]. pages 138, 138, 138, 139, 162, 163

Jordan Howard Sobel. Logic and Theism. Available on the internet. URL = www.scar.utoronto.ca/"-'sobel/, 2001. pages 134, 139, 139, 152, 163, 163

Moto-o Takahashi. A proof of cut-elimination theorem in simple type theory. J. Math. Soc. Japan, 19:399-410, 1967. pages xii, 35, 43, 46, 47, 67

Alfred Tarski. A lattice-theoretical theorem and its applications. Pacific Journal of Mathematics, 5:285-309, 1955. pages 41

Richmond H. Thomason, editor. Formal Philosophy, Selected Papers of Richard Montague. Yale University Press, New Haven and London, 1974. pages 176, 176, 176

Judith Jarvis Thomson. On Being and Saying: Essays for Richard Cartwright. MIT Press, Cambridge, MA, 1987. pages 177

Sue Toledo. Tableau Systems for First Order Number Theory and Certain Higher Order Theories. Number 447 in Lecture Notes in Mathematics. Springer-Verlag, Berlin, Heidelberg, NY, 1975. pages xii, 33, 33, 35, 46

Index

abstraction designation function, 21, 26, 103

proper, 22, 27 accessibility, 91 Anderson, C. A., 169-171 Anselm, 134

cautious comprehension, 171 character, 156 choice axiom, 129 choice function, 128-130 closed, 37, 110 compact, 15, 66 complete, 46, 73

strong, 16 weak, 16

composition, 10 comprehension axiom, 3 concept, 84 consequence, 14, 28, 95 consistent, 63

maximal, 63 constant domain, 89 constant symbol, 5, 87 continuum hypothesis, 17 cut rule, 67 cut-elimination, 66

de dicto, 118-121 de re, 118-121 Dedekind, R., 15 defined at, 125 definite description, 125-128 degree, 8 Descartes, R., 134-136, 152, 156 description designation, 125 designates, 125 domain, 91 domain function

Henkin, 20, 103

179

E-complete, 63 entity, 48, 49 equality, 115 equality axioms, 69, 115 essence, 141, 142, 156, 170 evaluation at a prefix, 109 existential relativization, 147 extensional object, 84, 91 extensionality, 117

assumptions, 118 axioms, 77 for extensional terms, 118 for intensional terms, 117

finite support, 8 formula, 6

modal, 88 prefixed, 106 truth, 13, 22, 26, 93, 104

frame augmented, 91 extensional, 30 Henkin, 20

generalized, 25 relative generalized, 50

Henkin/Kripke, 103 Kripke, 91

free, 9 free variable, 6

Gaunilo, 134 global assumption, 95, 111 Gi:idel, K., 138-143, 145, 147, 148, 150,

152, 156, 158, 162-164, 166, 171

grounded, 34, 106

Hajek, P., 171 Henkin domain

180

relative, 50 Hintikka set, 47

impredicativity, 4 inconsistent, 63 intensional object, 84, 91 interpretation, 11, 30, 51, 73, 92, 103

allowed, 50

K, 105

L(C), 5 .X abstraction, 3 Leibniz, G., 137-140, 145, 148, 152 Lindstrom, P., 68 local assumption, 95, 111 Liiwenheim-Skolem, 66, 68

Magari, R., 171 model

classical, 12 extensional, 30 general, 19 generalized Henkin, 28, 104 Henkin, 19, 22, 23 Henkin/Kripke, 104 modal, 91 standard, 24

monotheism, 162

necessary existence, 142, 160, 170 negative, 141, 146 non-rigid, 102 normal, 25

order, 5

parameter, 34, 108 perfection, 137-139 positive, 138-142, 145, 146, 162 possible value, 49 possible world, 91 predicate abstract, 5 predicate abstraction, 3 prefix, 105 pseudo-model, 47, 48, 51

quantification actualist, 89, 91 possibilist, 89, 91

rigid, 121-124 rule

abstract, 37, 109 branch extension, 35 conjunctive, 35, 107 derived

TYPES, TABLEAUS, AND GO DEL'S GOD

closure, 113 extensionality, 77 intensional predication, 113 reflexivity, 70 subscripted abstract, 114 substitutivity, 70 unsubscripted abstract, 114

disjunctive, 36, 107 double negation, 35, 107 existential, 36, 108 extensional, 118 extensional predication, 110 intensional predication, 109 necessity, 108 possibility, 107, 108 reflexivity, 115 substitutivity, 115 universal, 36, 109 world shift, 110

Russell, B., 125, 126, 136

85, 105 satisfiability, 14, 28 Scott, D., 138, 152, 156, 158 sentence, 6 Sobel, J. H., 163, 164, 166, 171 sound, 43, 46, 73 stability, 124-125 substitution, 8

free, 9

tableau, 33 basic, 35 derivation, 37, 111 prefixed, 105 proof, 37, 110 satisfiable, 43

term, 6, 87 denotation, 12, 21, 26 designation, 93, 103 relativized, 108

type, 4, 86 extensional, 86 Gallin/Montague, 102 intensional, 86 relation, 11

validity, 14, 28, 94 valuation, 12, 20, 26, 92 variable, 5 variant, 12 varying domain, 89

Wittgenstein, L., 139 world independent, 110

Zermelo-Fraenkel set theory, 17

TRENDS IN LOGIC

1. G. Schurz: The Is-Ought Problem. An Investigation in Philosophical Logic. 1997 ISBN 0-7923-4410-3

2. E. Ejerhed and S. Lindstrom (eds.): Logic, Action and Cognition. Essays in Philo-sophical Logic. 1997 ISBN 0-7923-4560-6

3. H. Wansing: Displaying Modal Logic. 1998 ISBN 0-7923-5205-X

4. P. Hajek: Metamathematics of Fuzzy Logic. 1998 ISBN 0-7923-5238-6

5. H.J. Ohlbach and U. Reyle (eds.): Logic, Language and Reasoning. Essays in Honour ofDov Gabbay. 1999 ISBN 0-7923-5687-X

6. K. Dosen: Cut Elimination in Categories. 2000 ISBN 0-7923-5720-5

7. R.L.O. Cignoli, I.M.L. D' Ottaviano and D. Mundici: Algebraic Foundations of many-valued Reasoning. 2000 ISBN 0-7923-6009-5

8. E.P. Klement, R. Mesiar and E. Pap: Triangular Norms. 2000 ISBN 0-7923-6416-3

9. V.F. Hendricks: The Convergence of Scientific Knowledge. A View From the Limit. 2001 ISBN 0-7923-6929-7

10. J. Czelakowski: Protoalgebraic Logics. 2001 ISBN 0-7923-6940-8

11. G. Gerla: Fuzzy Logic. Mathematical Tools for Approximate Reasoning. 2001 ISBN 0-7923-6941-6

12. M. Fitting: Types, Tableaus, and Godel's God. 2002 ISBN 1-4020-0604-7

KLUWER ACADEMIC PUBLISHERS - DORDRECHT I BOSTON I LONDON

Godel God

Documents

Transcript of Godel God