Mathematics] [Computability Theory] - Types, Tableaus, And Godel's God. (Melvin Fitting)

Types,

Tableaus,

and Godel’s God

Melvin Fittinge-mail: [email protected]

url: comet.lehman.cuny.edu/fittingDepartment of Mathematics and Computer Science

Lehman College (CUNY)250 Bedford Park Boulevard West

Bronx, NY 10468-1589

Draft

August 10, 2000

Preface

What’s Here

The term formal logic covers a broad range of concoctions. At one end aresmall, special-purpose systems; at the other are rich, expressive ones. Higher-type modal logic is one of the rich ones. Originating with Carnap and Montague,it has been applied to provide a semantics for natural language, to model in-tensional notions, and to treat long-standing philosophical problems. RecentlyI’ve also applied it to provide a semantic foundation for some complex databasesystems, (Fitting 2000b, Fitting 2000a). Higher-type modal logic—also calledintensional logic—is the subject of this book.

There are two quite different aspects to a logic: the formal machinery for itsown sake; and the formal machinery applied to problems. The mechanism ofhigher-type modal logic is complex and requires serious mathematics to developproperly, but if one is primarily interested in applications, much of this mathe-matics can be taken on faith. One of the interesting applications of intensionallogic is the Godel ontological argument, which was formalized from the begin-ning. It provides the main example of applied higher-type modal logic that isconsidered here. On the other hand, if one is interested in the mathematicalunderpinnings of intensional logic, the details of this application can be omit-ted. It is a rare reader who will be equally interested in both the formal andthe applied aspects. In a sense, then, this book has no audience. Instead thereare (I hope) separate audiences for different parts of it.

Philosophers interested in the Godel ontological argument will find Part IIIpertinent. After a general survey of a few well-known ontological arguments,that of Godel is analyzed in detail. While Godel’s argument is formally correct,two fundamental flaws are pointed out. One, noted by Sobel, is that it is toostrong—the modal system collapses. This could be seen as showing that free willis incompatible with Godel’s assumptions. Some ways out of this are explored.The other flaw is equally serious: Godel assumes as an axiom something directlyequivalent to his desired conclusion. The problematic axiom is a version of aprinciple Leibniz proposed as a way of dealing with a hole in an ontologicalproof of Descartes. The observation that Descartes, Leibniz, and Godel all haveproofs that stick at the same point seems to be new in the literature. If you areinterested in ontological arguments for their own sakes, start with Part III, and

i

PREFACE ii

pick up material from earlier chapters as it is needed.If you are interested in the mathematical details of the formal system, its

semantics and its proof theory, Parts I and II will be of interest—you can skimpon reading Part III. Part I is entirely devoted to classical logic, and Part II tomodal. Now, here is a more detailed summary.

Part I is devoted to higher-type classical logic. It begins with a discussionof syntax matters, Chapter 1. I present types in Schutte style, rather thanfollowing Church. Types can be somewhat daunting and I’ve tried to makethings go as smoothly as I can.

Chapter 2 examines semantics in considerable detail. What are sometimescalled “true” higher-order models are presented first. After this, Henkin’s gen-eralization is given, and finally a non-extensional version of Henkin models isdefined. Henkin himself mentioned the possibility of such models, but knowl-edge of them is not widespread. They are quite natural, and should becomemore familiar to the logic community—the philosophical logic community inparticular.

Classical higher-order tableaus are formulated in Chapter 3. These are notoriginal here—versions can be found in several places. A number of worked outexamples of tableau proofs are given, and more are in exercises. The system isbest understood if used. I do not attempt a consideration of automation—thesystem is designed entirely for human application. There is even some discussionof why.

Soundness and completeness are proved in Chapter 4. Tableaus are completewith respect to non-extensional Henkin models. The completeness argumentis not original; it is, however, intricate, and detailed proofs are scarce in theliterature.

After the hard work has been done, equality and extensionality are easyto add using axioms, and this is done in Chapters 5 and 6. And this con-cludes Part I. Except for the explicit formulation of non-extensional models, thematerial in Part I is not original—see (Takahashi 1967, Prawitz 1968, Toledo1975, Andrews 1986, Shapiro 1991, Leivant 1994, Kohlhase 1995, Manzano1996), for example.

Part II is devoted to the complications that modality brings. Chapter 7 addsthe usual box and diamond to the syntax, and possible worlds to the semantics.It is now that choices must be made, since quantified modal logic is not a thing,but a multitude.

First of all, at ground level quantifiers could be actualist or possibilist—they can range over what actually exists at a world, or over what might exist.This corresponds to the varying domain, constant domain split familiar to manyfrom first-order modal discussions. However, either an actualist or a possibilistapproach can simulate the other. We opt for a possibilist approach, with anexplicit existence predicate, because it is technically simpler.

Next, we must go up the ladder of higher types. Doing so extensionally, asin classical logic, means we take subsets of the ground-level domain, subsets ofsubsets, and so on. Going up intensionally, as Montague did, means we introduce

PREFACE iii

functions from possible worlds to sets of ground-level objects, functions frompossible worlds to sets of such things, and so on. What is presented here mixesboth notions—both extensional and intensional objects are present.

Classical tableau rules are adapted in Chapter 8, using prefixes, to producemodal systems. While the modal tableau rules are rather straightforward, theyare new to the literature, and should be of interest. Since things are alreadyquite complex, no completeness proof is given. If it were given, it would be adirect extension of the classical proof of Part I.

Using modal semantics and tableaus, in Chapter 9 I discuss the relationshipsbetween rigidity, de re and de dicto usages, and what I call Godel’s stabilityconditions, which arise in his proof of the existence of God. I also relate theseto definite descriptions. While this is not deep material, much of it does notseem to have been noted before, and many should find it of some significance.

Finally, Part III is devoted to ontological arguments. Chapter 10 gives abrief history and analysis of arguments of Anselm, Descartes, and Leibniz. Thisis followed by a longer, still informal, presentation of the Godel argument itself.

Formal methods are applied in Chapter 11, where Godel’s argument is ex-amined in great detail, flaws are found, and alternatives are discussed. Thischapter brings together work from all parts of the book, but detailed knowledgeof, say, the completeness proof is not needed. If this is what you are interestedin, start here, and pick up earlier material as needed. Many of the uses of theformalism are relatively intuitive. Indeed, in Godel’s notes on his ontologicalargument, formal machinery is never discussed, yet it is possible to get a senseof what it is about anyway.

How Did This Get Written?

Having just completed work on a book about first-order modal logic, (Fitting &Mendelsohn 1998), a look at higher-order modal logic suggested itself. I thoughtI would use Godel’s ontological argument as a paradigm, because it is one ofthe few examples I have run across that makes essential use of higher-ordermodal constructs. Godel’s argument for the existence of God is not particularlywell-known, but there is a growing body of literature on it. This literaturesometimes gives formalizations of Godel’s rather sketchy ideas—generally alongnatural deduction or axiomatic lines. My idea was, I would design a tableausystem within which the argument could be formalized, and this might lead toa nice paper illustrating the use of tableau methods. First, give tableau rules,then give Godel’s proof.

One cannot really develop semantic tableaus without a semantics behind it.The semantics of higher-order modal logic turned out to be of considerable intri-cacy, far beyond what could even be sketched in a paper. Clearly, an extendeddiscussion of the semantics for higher-order modal logic was needed before thetableau rules could be motivated.

I soon realized that in presenting higher-order modal logic, I was tryingto explicate ideas coming from two quite different sources. On the one hand,

PREFACE iv

there are essentially modal problems, some of which already arise at the first-order level and have little to do with higher-order constructs. On the otherhand, a number of higher-order modal complexities also manifest themselvesin a classical setting, and can be discussed more clearly without modalitiescomplicating things. So I decided that before modal operators were introduced,I would give a thorough presentation of a semantics and tableau system forhigher-order classical logic. There are already treatments of tableau, or Gentzen,systems for higher-order classical logic in the literature, but I felt it would beuseful to give things in full here. Detailed completeness proofs are hard to find,for instance.

Higher-order classical logic already has its hidden pitfalls. It is commonknowledge, so to speak, that “true” higher-order classical models cannot cor-respond to any proof procedure. Henkin models are what is needed. But a“natural” formulation of tableaus is not complete with respect to Henkin mod-els either. This is something known to experts—it was not known to me whenI started this book. A broader notion of Henkin model (also due to Henkin) isneeded, a non-extensional version. Such models should be better known sincethey are actually quite natural, and address problems that, while not commonin mathematics, do arise in linguistic applications of logic.

In the 1960’s, cut-elimination theorems were proved for higher-order classicallogic, using semantic methods that relied on non-extensional models. In effect,these cut-elimination proofs concealed a completeness argument within them,but the general notion of non-extensional model was not formulated abstractly—only the specific structure constructed by the completeness argument was con-sidered. In short, a completeness theorem was never stated, only a consequence,albeit a very important one. So I found myself required to formulate a generalnotion of classical non-extensional Henkin model, then prove completeness for asuitable classical tableau system. After this I could move on to discuss modality.

What sort of modal features did I want? Formalizations of the Godel ar-gument by others had generally used some version of an intensional logic, withorigins in work of Carnap, (Carnap 1956), developed and applied by Montague,(Montague 1960, Montague 1968, Montague 1970), and formally elaborated in(Gallin 1975). After several preliminary attempts I decided this logic was notquite what I wanted. In it, semantically speaking, all objects are intensional. Idecided I needed a logic containing both intensional and extensional objects. Ofcourse, one could bring extensional objects into the Montague setting by iden-tifying them with objects that are rigid, in an appropriate sense, but it seemedmuch more natural to have extensional objects from the start. Thus the modallogic given in the second half of this book is somewhat different from what hasbeen previously considered.

Once I had formulated the modal logic I wanted, tableau rules were easy,and I could finally formalize the Godel argument. What began as a short paperhad turned into a book. My after-the-fact justification is that there are fewtreatments of higher-order logic at all, and fewer still of higher-order modallogic. It is a rare flower in a remote field. But it is a pretty flower.

Contents

Preface i

I Classical Logic 1

1 Classical Logic—Syntax 21.1 Terms and Formulas . . . . . . . . . . . . . . . . . . . . . . . . . 21.2 Substitutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2 Classical Logic—Semantics 92.1 Classical Models . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.2 Truth in a Model . . . . . . . . . . . . . . . . . . . . . . . . . . . 102.3 Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.3.1 Compactness . . . . . . . . . . . . . . . . . . . . . . . . . 132.3.2 Strong Completeness . . . . . . . . . . . . . . . . . . . . . 132.3.3 Weak Completeness . . . . . . . . . . . . . . . . . . . . . 142.3.4 And Worse . . . . . . . . . . . . . . . . . . . . . . . . . . 15

2.4 Henkin Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162.5 Unrestricted Henkin Models . . . . . . . . . . . . . . . . . . . . . 212.6 A Few Technical Results . . . . . . . . . . . . . . . . . . . . . . . 24

3 Classical Logic—Basic Tableaus 293.1 A Different Language . . . . . . . . . . . . . . . . . . . . . . . . . 293.2 Basic Tableaus . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303.3 Tableau Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 33

4 Soundness and Completeness 394.1 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394.2 Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

4.2.1 Hintikka Sets . . . . . . . . . . . . . . . . . . . . . . . . . 434.2.2 Pseudo-Models . . . . . . . . . . . . . . . . . . . . . . . . 444.2.3 Substitution and Pseudo-Models . . . . . . . . . . . . . . 464.2.4 Hintikka Sets and Pseudo-Models . . . . . . . . . . . . . . 534.2.5 Pseudo-Models and Models . . . . . . . . . . . . . . . . . 55

v

CONTENTS vi

4.2.6 Completeness At Last . . . . . . . . . . . . . . . . . . . . 564.3 Miscellaneous Model Theory . . . . . . . . . . . . . . . . . . . . . 59

5 Equality 625.1 Adding Equality . . . . . . . . . . . . . . . . . . . . . . . . . . . 625.2 Derived Rules and Tableau Examples . . . . . . . . . . . . . . . . 625.3 Soundness and Completeness . . . . . . . . . . . . . . . . . . . . 65

6 Extensionality 696.1 Adding Extensionality . . . . . . . . . . . . . . . . . . . . . . . . 696.2 A Derived Rule and an Example . . . . . . . . . . . . . . . . . . 696.3 Soundness and Completeness . . . . . . . . . . . . . . . . . . . . 70

II Modal Logic 72

7 Modal Logic—Syntax and Semantics 737.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737.2 Types and Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . 767.3 Constant Domains and Varying Domains . . . . . . . . . . . . . 787.4 Standard Modal Models . . . . . . . . . . . . . . . . . . . . . . . 797.5 Truth in a Model . . . . . . . . . . . . . . . . . . . . . . . . . . . 817.6 Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837.7 Related Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . 887.8 Henkin/Kripke Models . . . . . . . . . . . . . . . . . . . . . . . . 89

8 Modal Tableaus 928.1 The Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 928.2 Tableau Examples . . . . . . . . . . . . . . . . . . . . . . . . . . 978.3 A Few Derived Rules . . . . . . . . . . . . . . . . . . . . . . . . . 99

9 Miscellaneous Matters 1019.1 Equality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

9.1.1 Equality Axioms . . . . . . . . . . . . . . . . . . . . . . . 1019.1.2 Extensionality . . . . . . . . . . . . . . . . . . . . . . . . 103

9.2 De Re and De Dicto . . . . . . . . . . . . . . . . . . . . . . . . . 1039.3 Rigidity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1079.4 Stability Conditions . . . . . . . . . . . . . . . . . . . . . . . . . 1099.5 Definite Descriptions . . . . . . . . . . . . . . . . . . . . . . . . . 1109.6 Choice Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 112

III Ontological Arguments 116

10 Ontological Arguments, A Brief History 11710.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11710.2 Anselm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

CONTENTS vii

10.3 Descartes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11810.4 Leibniz . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12110.5 Godel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12210.6 Godel’s Argument, Informally . . . . . . . . . . . . . . . . . . . . 123

11 Godel’s Argument, Formally 12711.1 General Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12711.2 Positiveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12711.3 Possibly God Exists . . . . . . . . . . . . . . . . . . . . . . . . . 13211.4 Objections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13411.5 Essence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13611.6 Necessarily God Exists . . . . . . . . . . . . . . . . . . . . . . . . 14111.7 Going Further . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

11.7.1 Monotheism . . . . . . . . . . . . . . . . . . . . . . . . . . 14311.7.2 Positive Properties are Necessarily Instantiated . . . . . . 143

11.8 More Objections . . . . . . . . . . . . . . . . . . . . . . . . . . . 14411.9 A Solution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14511.10Anderson’s Alternative . . . . . . . . . . . . . . . . . . . . . . . . 14911.11Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151

Part I

Classical Logic

1

Chapter 1

Classical Logic—Syntax

1.1 Terms and Formulas

The formulation of a higher-order logic allows some freedom—there are certainplaces where choices can be made. Several of these choices produce equivalentresults. Before getting to the formal machinery, I informally set out my decisionson these matters. Other treatments may make different choices, but ultimatelyit is only a matter of convenience that is involved.

Often, classical first-order logic is formulated with a rich variety of terms,built up from constant symbols and variables using function symbols. Sincehigher-order constructs are already complicated, I have decided to have constantsymbols but not function symbols. If necessary for some purpose, it is not amajor issue to add them—doing so yields a conservative extension.

Higher-order logic can be formulated with or without explicit abstractionmachinery. Speaking informally, one wants to make sure that every formulaspecifies a class, but there are two ways of making this happen. One is toassume comprehension axioms, formulas of the general form:

(∃X)[X(x1, . . . , xn) ≡ ϕ(x1, . . . , xn)].

where ϕ(x1, . . . , xn) is a formula with free variables as indicated. Such axiomsensure that to each formula corresponds an ‘object.’ The other approach isto elaborate the term-forming machinery, so that there is an explicit name forthe object specified by a formula ϕ. This involves predicate abstraction, orλ-abstraction:

〈λx1, . . . , xn.ϕ(x1, . . . , xn)〉.

The two approaches are equivalent in a direct way. I have chosen to use explicitabstracts for several reasons. First, axioms are not as natural when tableausystems are the proof machinery of choice. And second, predicate abstractionhas already played a major role in earlier investigations of modal logic (Fitting

2

CHAPTER 1. CLASSICAL LOGIC—SYNTAX 3

& Mendelsohn 1998), and makes discussion of major issues considerably easierhere.

Finally, one can characterize higher-order formulas in more-or-less the way itis done in the first-order setting, taking quantifiers and connectives as “logicalconstants.” This is the approach of (Schutte 1960). Alternatively, following(Church 1940), one can think of quantifiers and connectives as constants of thelanguage, which itself is formulated in lambda-calculus style. In this book I takethe first approach, though one can make arguments for the second on groundsof elegance and economy. My justification is that doing things the way that hasbecome standard for first-order logic will be less confusing to the reader.

Recently one further alternative has become available. In a series of papers,(Gilmore 1998a, Gilmore 1998b, Gilmore 1999), Paul Gilmore has shown thatby a relatively simple change, a system of classical higher-order logic can bedeveloped allowing a controlled degree of impredicativity—typing rules can berelaxed to permit the formation of certain useful sentences that are not “legal” inthe approach presented here. This, in turn, allows a more natural developmentof arithmetic in the higher-order setting. I do not follow Gilmore’s approachhere, but I recommend it for study. Much of what I develop carries over quitedirectly.

So these are my choices: no function symbols, explicit predicate abstraction,quantifiers and connectives as in the first-order setting, and no impredicativity.With this out of the way I can begin presenting the formal syntactical machinery.

In first-order logic, relation symbols have an arity—some are one-place, someare two-place, and so on. In higher-order logic this simple idea gets replaced bya typing mechanism, which is considerably more complex. Terms, and certainother items, are assigned types, and rules of formation make use of these typesto ensure that things fit together properly. I begin by saying what the typesare.

Definition 1.1.1 [Type] 0 is a type. And if t1, . . . , tn are types, 〈t1, . . . , tn〉 isa type. t, t1, t2, t′, etc. are generally used to represent types.

An object of type 0 is intended to be a ground-level object—it correspondsto a constant symbol or variable in standard first-order logic. An object of type〈t1, . . . , tn〉 is a predicate that takes n arguments, of types t1, . . . , tn respec-tively. Thus a constant symbol of type 〈0, 0, 0〉, say, would be called a three-placerelation symbol in standard first-order logic—it takes three ground-level argu-ments. But now we can have relation symbols of types such as 〈〈0〉, 〈0, 0〉, 0〉, towhich nothing in first-order logic corresponds.

Definition 1.1.2 [L(C)] Let C be a set of constant symbols, containing atleast an equality symbol =〈t,t〉 for each type t. I denote the classical higher-order language built up from C by L(C). The rest of this section amounts tothe formal characterization of L(C).


For each type t I assume there are infinitely many variable symbols of thattype. (In addition to constant and variable symbols, certain other syntacticobjects will be assigned types as well.) I generally use letters from the begin-ning of the Greek alphabet to represent variables, with the type written as asuperscript: αt, βt, γt, . . . . Likewise I generally use letters from the uppercaseLatin alphabet as constant symbols, again with the type written as a super-script: At, Bt, Ct, Dt, . . . . As noted, equality is primitive, so for each type tthere is a constant symbol =〈t,t〉 of type 〈t, t〉. Often types can be inferred fromcontext, and so superscripts will be omitted where possible, in the interests ofuncluttered notation.

Sometimes it is helpful to refer to the order of a term or formula—first-order,second-order, and so on. It is simplest to define this terminology first for typesthemselves.

Definition 1.1.3 [Order] The type 0 is of order 0. The type 〈t1, . . . , tn〉 hasas its order the maximum of the orders of t1, . . . , tn, plus one.

Thus 〈0, 0〉 is of order 1, or first-order. Likewise 〈0, 〈0, 0〉〉 is of order 2,or second-order. Types will play the fundamental role, but order provides aconvenient way of referring to the maximum complexity of some construct.When I talk about the order of a constant or variable, I mean the order ofits type. Likewise once formulas are defined, I may refer to the order of theformula, by which I mean the highest order of a typed part of it.

Next I define the class of formulas, and their free variables. This definition ismore complex than the corresponding first-order version because the notion ofterm cannot be defined first; both term and formula must be defined together.And to define both, I need the auxiliary notion of predicate abstract which is,itself, part of a mutual recursion involving Definitions 1.1.4, 1.1.5, and 1.1.6.

Definition 1.1.4 [Predicate Abstract of L(C)] Suppose Φ is a formula of L(C)and α1, . . . , αn is a sequence of distinct variables of types t1, . . . , tn respectively.〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C). Its type is 〈t1, . . . , tn〉, and itsfree variable occurrences are the free variable occurrences in the formula Φ,except for occurrences of the variables α1, . . . , αn.

Definition 1.1.5 [Term of L(C)] Terms of each type are characterized as fol-lows.

1. A constant symbol of L(C) or variable is a term of L(C). If it is a constantsymbol, it has no free variable occurrences. If it is a variable, it has onefree variable occurrence, itself.

2. A predicate abstract of L(C) is a term of L(C). Its free variable occur-rences were defined above.

τ is used, with and without subscripts, to stand for terms.

Definition 1.1.6 [Formula of L(C)] The notion of formula is given as follows.


1. If τ is a term of type 〈t1, . . . , tn〉, and τ1, . . . , τn is a sequence of terms oftypes t1, . . . , tn respectively, then τ(τ1, . . . , τn) is a formula (atomic) ofL(C). The free variable occurrences in it are the free variable occurrencesof τ , τ1, . . . , τn.

2. If Φ is a formula of L(C) so is ¬Φ. The free variable occurrences of ¬Φare those of Φ.

3. If Φ and Ψ are formulas of L(C) so is (Φ∧Ψ). The free variable occurrencesof (Φ ∧Ψ) are those of Φ together with those of Ψ.

4. If Φ is a formula of L(C) and α is a variable then (∀α)Φ is a formula ofL(C). The free variable occurrences of (∀α)Φ are those of Φ, except foroccurrences of α.

Example 1.1.7 Suppose α〈0,0〉 is a variable of type 〈0, 0〉 (and so first-order),β0 is a variable of type 0, and γ〈〈0,0〉,0〉 is a variable of type 〈〈0, 0〉, 0〉 (second-order). Both β0 and γ〈〈0,0〉,0〉 are terms. Then γ〈〈0,0〉,0〉(α〈0,0〉, β0) is an atomicformula. Generally I will write the simpler looking γ(α, β), and give the infor-mation contained in the superscripts in a separate description. Since this atomicformula contains a variable γ of order 2, it is referred to as a second-order atomicformula.

Definition 1.1.8 [Sentence] A formula with no free variables is a sentence.

One can think of ∨, ⊃, ≡, and ∃ as defined symbols, with their usual defini-tions. But sometimes it is convenient to take them as primitive—I do whateveris most useful at the time. Also square and curly parentheses are used, as wellas the official round ones, to aid readability. And finally, I write the equalitysymbol in infix position, following standard convention. Thus, for example, Iwrite (αt =〈t,t〉 βt) in place of =〈t,t〉 (αt, βt).

Several examples involving just first and second-order notions will be con-sidered, so a few special alphabets are introduced informally, to make readingthe examples a little easier.

Order Constants Variables0 a, b, c, . . . x, y, z, . . .1 A, B, C, . . . X, Y , Z, . . .2 A, B, C, . . . X , Y, Z, . . .

Example 1.1.9 For this example I give explicit type information (in super-scripts), until the end of the example. After this I omit the superscripts, andsay in English what is needed to restore them.

Suppose x0, X〈0〉, and X 〈〈0〉〉 are variables (the first is of order 0, the secondis of order 1, and the third is of order 2). Also suppose P〈〈0〉〉 and g0 are constantsymbols of L(C) (the first is of order 2 and the second is of order 0).

1. Both X 〈〈0〉〉(X〈0〉) and X〈0〉(x0) are atomic formulas. All variables presenthave free occurrences.


2. 〈λX 〈〈0〉〉.X 〈〈0〉〉(X〈0〉)〉 is a predicate abstract, of type 〈〈〈0〉〉〉. Only theoccurrence of X〈0〉 is free.

3. Since P〈〈0〉〉 is of type 〈〈0〉〉, 〈λX 〈〈0〉〉.X 〈〈0〉〉(X〈0〉)〉(P〈〈0〉〉) is a formula.Only X〈0〉 is free.

4. [〈λX 〈〈0〉〉.X 〈〈0〉〉(X〈0〉)〉(P〈〈0〉〉) ⊃ X〈0〉(x0)] is a formula. The only freevariable occurrences are those of X〈0〉 and x0.

5. (∀X〈0〉)[〈λX 〈〈0〉〉.X 〈〈0〉〉(X〈0〉)〉(P〈〈0〉〉) ⊃ X〈0〉(x0)] is a formula. The onlyfree variable occurrence is that of x0.

6. 〈λx0.(∀X〈0〉)[〈λX 〈〈0〉〉.X 〈〈0〉〉(X〈0〉)〉(P〈〈0〉〉) ⊃ X〈0〉(x0)]〉 is a predicateabstract. It has no free variable occurrences, and is of type 〈0〉.

The type machinery is needed to guarantee that what is written is well-formed.Now that the exercise above has been gone through, I will display the predicateabstract without superscripts, as

〈λx.(∀X)[〈λX .X (X)〉(P) ⊃ X(x)]〉,

leaving types to be inferred, or explained in words, as necessary.

In first-order logic, facts about formulas and terms are often proved by in-duction based on complexity. And complexity for a formula is often measured bythe number of logical connectives and quantifiers, or what amounts to the samething, by how “far away” the formula is from being atomic. In a higher-ordersetting these notions diverge.

Definition 1.1.10 [Degree] By the degree of a formula or term is meant thenumber of propositional connectives, quantifiers, and lambda-symbols it con-tains.

Note that since an atomic formula can involve terms containing predicateabstracts which, in turn, involve other formulas, the degree of an atomic formulaneed not be 0, as in the first-order case.

1.2 Substitutions

Formulas can contain free variables, and terms that are much more complex canbe substituted for them. The notion of substitution is a fundamental one, andthis section is devoted to it. In a general way, I follow the treatment in (Fitting1996).

Definition 1.2.1 [Substitution] A substitution is a mapping from the set ofvariables to the set of terms of L(C) such that variables of type t map to termsof type t. Composition of substitutions is the usual composition of functions.


I generally denote substitutions by σ, with and without subscripts. Also Igenerally write xσ rather than σ(x). Most concern is with substitutions havingfinite support, that is, they are the identity on all but a finite number of variables.A special notation is used for the finite support substitution that maps each αi toτi and is the identity otherwise: α1/τ1, . . . , αn/τn. Clearly the composition oftwo substitutions with finite support is another substitution with finite support.

Finally, the action of substitutions on variables is readily extended to termsand formulas generally.

Definition 1.2.2 For a substitution σ, by σα1,... ,αn is meant the substitutionthat is like σ except that it is the identity on α1, . . . , αn.

Definition 1.2.3 Let σ be a substitution. The action of σ is extended recur-sively as follows.

1. Aσ = A for a constant symbol A.

2. 〈λα1, . . . , αn.Φ〉σ = 〈λα1, . . . , αn.Φσα1,... ,αn〉.

3. [τ(τ1, . . . , τn)]σ = τσ(τ1σ, . . . , τnσ).

4. [¬Φ]σ = ¬[Φσ].

5. (Φ ∧Ψ)σ = (Φσ ∧Ψσ).

6. [(∀α)Φ]σ = (∀α)[Φσα]

Example 1.2.4 Let Φ be the formula (∃α〈〈0〉〉)[α〈〈0〉〉(〈λβ0.γ〈0〉(β0)〉)] and letσ be any substitution such that γ〈0〉σ = τ 〈0〉. I compute Φσ. For convenience Iomit type-indicating superscripts, but even so, the notion is a bit much. Sorry.

(∃α)[α(〈λβ.γ(β)〉)]σ = (∃α)[α(〈λβ.γ(β)〉)]σα= (∃α)[ασα(〈λβ.γ(β)〉σα)]= (∃α)[α(〈λβ.γ(β)〉σα)]= (∃α)[α(〈λβ.[γ(β)]σα,β〉)]= (∃α)[α(〈λβ.(γσα,β)(βσα,β)〉)]= (∃α)[α(〈λβ.τ(β)〉)]

The connection between substitutions and free variable occurrences is simple:it is only the free occurrences that can be changed by substitutions. I leave theproof to you as an exercise.

Proposition 1.2.5 Let σ1 and σ2 be substitutions.

1. If σ1 and σ2 agree on the free variables of the term τ then τσ1 = τσ2.

2. If σ1 and σ2 agree on the free variables of the formula Φ then Φσ1 = Φσ2.


Not all substitutions are appropriate; some do not properly respect the roleof bound variables in the sense that they may replace a free occurrence of avariable in a formula with another variable that is “captured” by a quantifieror predicate abstract of the formula. The substitutions that are acceptable arecalled free substitutions. These play a significant role throughout what follows.

Definition 1.2.6 [Free Substitution] The following characterizes when a sub-stitution σ is free for a formula or term.

1. σ is free for a variable or constant.

2. σ is free for 〈λα1, . . . , αn.Φ〉 if σα1,... ,αn is free for Φ, and if β is any freevariable of 〈λα1, . . . , αn.Φ〉 then βσ does not contain any of α1, . . . , αnfree.

3. σ is free for ¬Φ if σ is free for Φ.

4. σ is free for (Φ ∧Ψ) if σ is free for Φ and σ is free for Ψ.

5. σ is free for (∀α)Φ if σα is free for Φ, and if β is a free variable of (∀α)Φthen βσ does not contain α free.

It is not generally the case that Φ(α1α2) = (Φα1)α2. But it is when appro-priate freeness conditions are imposed.

Theorem 1.2.7 Substitution is “compositional” under the following circum-stances.

1. If σ1 is free for the formula Φ, and σ2 is free for the formula Φσ1, then(Φσ1)σ2 = Φ(σ1σ2).

2. If σ1 is free for the term τ , and σ2 is free for the term τσ1, then (τσ1)σ2 =τ(σ1σ2).

The proof of this is essentially the same as in the first-order setting. Ratherthan giving it here, I refer you to the proof of Theorem 5.2.13 in (Fitting 1996).

Exercises

Exercise 1.2.1 Prove Proposition 1.2.5 by induction on degree. Conclude thatif Φ is a sentence then Φσ = Φ for every substitution σ.

Chapter 2

Classical Logic—Semantics

2.1 Classical Models

Defining the semantics of any higher-order logic is relatively complicated. Sincemodalities add special complexities, it is fortunate I can discuss underlying clas-sical issues before bringing them into the picture. In this Chapter the “real”notion of higher-order model is defined, after which truth in them is charac-terized. Then Henkin’s modification of these models is considered—sometimesthese are called general models—as well as a non-extensional version of them.

I don’t want just syntactic objects, terms, to have types. I want sets andrelations to have them too. After all, we think of terms as designating setsand relations, and we want type information to move back and forth betweensyntactic object and its designation.

Definition 2.1.1 [Relation Types] Let S be a non-empty set. For each type tthe collection [[ t, S ]] is defined as follows.

1. [[0, S ]] = S.

2. [[〈t1, . . . , tn〉, S ]] is the collection of all subsets of [[ t1, S ]] × · · · × [[ tn, S ]] .

O is an object of type t over S if O ∈ [[ t, S ]] . O is systematically used, with orwithout subscripts, to stand for objects in this sense.

For example, a member of [[〈0, 0〉, S ]] is a subset of S × S, and in standardfirst-order logic it would simply be called a two-place relation on S. But nowrelations of relations are allowed, and even more complex things as well, soterminology gets more complicated.

A classical model consists of an underlying domain, thought of as the “groundlevel objects,” and an interpretation, assigning some denotation in the model toeach constant symbol of the language. But that denotation must be consistentwith type information.

9

CHAPTER 2. CLASSICAL LOGIC—SEMANTICS 10

Definition 2.1.2 [Classical Model] A (higher-order) classical model for L(C)is a structureM = 〈D, I〉, where D is a non-empty set called the domain of themodel, and I is a mapping, the interpretation, meeting the following conditions.

1. If A is a constant symbol of L(C) of type t, I(A) ∈ [[ t,D ]] .

2. If = is the equality constant symbol of type 〈t, t〉 then I(=) is the equalityrelation on [[ t,D ]] .

2.2 Truth in a Model

Assume M = 〈D, I〉 is a classical model for a language L(C). It is time to saywhich sentences of the language, or more generally, which formulas with freevariables, are true in M. This is symbolized by M °v Φ. Informally it can beread: the formula Φ is true in the model M, with respect to the valuation vwhich assigns meanings to free variables. But as will be seen, to properly definethis one must also assign denotations to all terms. The denotation of a termof type t will be an object of type t over D. And this can not be done first,independently. The assignment of denotations to terms, and the determinationof formula truth constitutes a mutually recursive pair of definitions, just as wasthe case for the syntactic notions of term and formula in Section 2.1. Still, it isall rather straightforward.

Definition 2.2.1 [Valuation] The mapping v is a valuation in the classicalmodelM = 〈D, I〉 if v assigns to each variable αt of type t some object of typet, that is, v(αt) ∈ [[ t,D ]] .

Definition 2.2.2 [Variant] A valuation w is an α-variant of a valuation v ifv and w agree on all variables except possibly α. More generally, w is anα1, . . . , αn-variant if v and w agree on all variables except possibly α1, . . . , αn.

Now, the following two definitions constitute a single recursive characteriza-tion.

Definition 2.2.3 [Denotation of a Term] LetM = 〈D, I〉 be a classical model,and let v be a valuation in it. A mapping is defined, (v ∗ I), assigning to eachterm of L(C) a denotation for that term.

1. If A is a constant symbol of L(C) then (v ∗ I)(A) = I(A).

2. If α is a variable then (v ∗ I)(α) = v(α).

3. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type t, then (v ∗I)(〈λα1, . . . , αn.Φ〉) is the following member of [[ t,D ]] :

〈w(α1), . . . , w(αn)〉 | w is an α1, . . . , αn variant of v and Γ °w Φ


Definition 2.2.4 [Truth of a Formula] Again let M = 〈D, I〉 be a classicalmodel, and let v be a valuation in it. The notion of formula Φ of L(C) beingtrue in modelM with respect to v, denotedM °v Φ, is characterized as follows.

1. For terms τ , τ1, . . . , τn, M °v τ(τ1, . . . , τn) provided〈(v ∗ I)(τ1), . . . , (v ∗ I)(τn)〉 ∈ (v ∗ I)(τ).

2. M °v ¬Φ if it is not the case that M °v Φ.

3. M °v Φ ∧Ψ if M °v Φ and M °v Ψ.

4. M °v (∀α)Φ if M °v′ Φ for every α-variant v′ of v.

There is an alternative notation that makes evaluating the truth of formulasin models somewhat easier.

Definition 2.2.5 [Special Notation] Suppose v is a valuation, and w is the α1,. . . , αn variant of v such that w(α1) = O1, . . . , w(αn) = On. Then, ifM °w Φthis may be symbolized by

M °v Φ[α1/O1, . . . , αn/On].

Now part 3 of Definition 2.2.3 can be restated as follows.

3. (v ∗ I)(〈λα1, . . . , αn.Φ〉) = 〈O1, . . . , On〉 | M °v Φ[α1/O1, . . . , αn/On]

Likewise part 4 of Definition 2.2.4 becomes

4. M °v (∀α)Φ if M °v Φ[α/O] for every object O of the same type as α.

Defined symbols like ⊃ and ∃ have their expected behavior, which are ex-plicitly stated below. Alternately, this can be considered an extension of thedefinition above.

5. M °v Φ ∨Ψ if M °v Φ or M °v Ψ.

6. M °v Φ ⊃ Ψ if M °v Φ implies M °v Ψ.

7. M °v Φ ≡ Ψ if M °v Φ iff M °v Ψ.

8. M °v (∃α)Φ if M °v′ Φ for some α-variant v′ of v; equivalently ifM °v Φ[α/O] for some object O of the same type as α.

As in first-order logic, if Φ has no free variables, M °v Φ holds for some vif and only if it holds for every v. Thus for sentences (closed formulas), truth ina model does not depend on a choice of valuation.

Definition 2.2.6 [Validity, Satisfiability, Consequence] Let Φ be a formula andS be a set of formulas.

1. Φ is valid if M °v Φ for every classical model M and valuation v.


2. S is satisfiable if there is some model M and some valuation v such thatM °v ϕ for every ϕ ∈ S.

3. Φ is a consequence of S provided, for every modelM and every valuationv, if M °v ϕ for all ϕ ∈ S, then M °v Φ.

The definitions above are of some complexity. Here is an example to helpclarify their workings.

Example 2.2.7 This example shows a formula that is valid and involves equal-ity. In it, c is a constant symbol of type 0.

The expression 〈λX.(∃x)X(x)〉 is a predicate abstract of type 〈〈0〉〉, whereX is of type 〈0〉 and x is of type 0. Intuitively it is the “being instantiated”predicate. Likewise the expression 〈λx.x = c〉 is a predicate abstract of type〈0〉, where x and c are of type 0. Intuitively this is the “being c” predicate.Since this predicate is, in fact, instantiated (by whatever c designates), the firstpredicate abstract correctly applies to it. That is, one should have the validityof the following.

〈λX.(∃x)X(x)〉(〈λx.x = c〉) (2.1)

I now verify this validity. Suppose there is a model M = 〈D, I〉. I show theformula is true in M with respect to an arbitrary valuation v. To do this, Iinvestigate the behavior, inM, of parts of the formula, building up to the wholething.

First, recalling that the interpretation of an equality symbol is by the equal-ity relation of the appropriate type, we have the following.

(v ∗ I)(〈λx.x = c〉) = O | M °v (x = c)[x/O]= O | O = I(c)= I(c)

We also have the following.

(v ∗ I)(〈λX.(∃x)X(x)〉) = O | M °v (∃x)X(x)[X/O]= O | M °v X(x)[X/O, x/o] for some o= O | o ∈ O for some o= O | O 6= ∅

Now we have (2.1) because

M °v 〈λX.(∃x)X(x)〉(〈λx.x = c〉) ⇔(v ∗ I)(〈λx.x = c〉) ∈ (v ∗ I)(〈λX.(∃x)X(x)〉) ⇔ I(c) ∈ O | O 6= ∅.

You might try verifying, in a similar way, the validity of the following.

¬〈λX.(∃x)X(x)〉(〈λx.¬(x = x)〉)


2.3 Problems

First-order classical logic has many nice features that do not carry over tohigher-order versions. This is well-known, and partly accounts for the generalemphasis on first-order. I sketch a few of the problems here.

2.3.1 Compactness

The compactness theorem for first-order logic says a set of formulas is satisfiableif every finite subset is. The higher-order analog does not hold, and counter-examples are easy to come by.

The Dedekind characterization of infinity is: a set is infinite if it can be putinto a 1-1 correspondence with a proper subset. Consequently, a set is finiteif any 1-1 mapping from it to itself can not be to a proper subset, i.e. mustbe onto. This can be said easily, as a second-order formula. Since functionsymbols are not available, I make do with relation symbols in the usual way—sothe following formula is true in a model if and only if the domain of the modelis finite.

(∀X)[(function(X) ∧ one-one(X)) ⊃ onto(X)] (2.2)

In (2.2) the following abbreviations are used.

function(X) for (∀x)(∃y)(∀z)[X(x, z) ≡ (z = y)]one-one(X) for (∀x)(∀y)(∀z)[X(x, z) ∧X(y, z)] ⊃ (x = y)

onto(X) for (∀y)(∃x)X(x, y)

Also, define the following infinite list of formulas, where x 6= y abbreviates¬(x = y).

A2 = (∃x1)(∃x2)[x1 6= x2]A3 = (∃x1)(∃x2)(∃x3)[(x1 6= x2) ∧ (x1 6= x3) ∧ (x2 6= x3)]

......

...

So An is true in a model if and only if the domain of the model contains at leastn members.

Now, the set consisting of (2.2) and all of A2, A3, . . . , is certainly not sat-isfiable, but every finite subset is, so compactness fails. (In first-order classicallogic this example turns around, and shows finiteness has no first-order charac-terization.)

2.3.2 Strong Completeness

A proof procedure is said to be (sound and) strongly complete if Φ has a deriva-tion from a set S exactly when Φ is a logical consequence of S. Classical


first-order logic has many proof procedures that are strongly complete for it,but there is no such proof procedure for higher-order logic. To see this, onedoesn’t need an exact definition of proof procedure—it is enough that proofs befinite objects.

Let S be the set of formulas defined in Section 2.3.1, a set which is not satis-fiable though every finite subset is. The formula Φ∧¬Φ is a logical consequenceof S, since it is true in every model in which the members of S are true, namelynone. If there were a strongly complete proof procedure, Φ ∧ ¬Φ would have aderivation from S. That derivation, being a finite object, could only use a finitesubset of S, say S0. Then Φ ∧ ¬Φ would be a logical consequence of S0, and soS0 could not be satisfiable (otherwise there would be a model in which Φ ∧ ¬Φwere true). But every finite subset of S is satisfiable. Conclusion: no stronglycomplete proof procedure can exist for higher-order classical logic.

2.3.3 Weak Completeness

A proof procedure is (sound and) weakly complete if it proves exactly the validformulas. A strongly complete proof procedure is automatically weakly com-plete. Higher-order classical logic does not even possess a weakly complete proofprocedure. To show this, Godel’s Incompleteness Theorem can be used.

The idea is to write a single formula that characterizes the natural numbers—a second-order formula will do. One needs a constant symbol of type 0 torepresent the number 0, and to thoroughly overload notation, I use 0 for this.Also a successor function is needed, but since we do not have function symbolsin this language, it is simulated with a relation symbol S, technically a constantsymbol of type 〈0, 0〉. In addition to the abbreviations of Section 2.3.1, thefollowing is needed.

0-exclude(S) for (∀x)¬S(x, 0)inductive-set(P, S) for P (0) ∧ (∀x)[P (x) ⊃ (∃y)(S(x, y) ∧ P (y))]

induction(S) for (∀P )[inductive-set(P, S) ⊃ (∀x)P (x)]

Now, let integer(S) be the formula

function(S) ∧ one-one(S) ∧ 0-exclude(S) ∧ induction(S)

It is not hard to show that integer(S) is true in a model 〈D, I〉 if and only ifthe domain D is (isomorphic to) the natural numbers, using I(S) as successor.Consequently for any sentence Φ of arithmetic, Φ is true of the natural numbersif and only if integer(S) ⊃ Φ is valid.

It is a standard requirement that the set of (Godel numbers of) theorems of aproof procedure must be recursively enumerable, so if there were a weakly com-plete proof procedure for higher-order classical logic, the set of valid formulaswould be recursively enumerable. The recursive enumerability of the follow-ing set would then be an easy consequence: the set of sentences Φ such that


integer(S) ⊃ Φ is valid. But, as noted above, this is just the set of true sen-tences of arithmetic, and this is not a recursively enumerable set. Conclusion:no weakly complete proof procedure can exist for higher-order classical logic.

2.3.4 And Worse

I have been discussing higher-order classical logic, particularly its models, usingconventional informal mathematics of the sort that every mathematician uses inpapers and books. But certain areas of mathematics—certainly formal logic isamong them—are close to foundational issues, and one needs to be careful. It isgenerally understood that informal mathematics can be formalized in set theory,and this is commonly taken to be Zermelo-Fraenkel set theory, or a variant ofit. Let us suppose, for the time being, that the development so far has beenwithin such a framework.

One of the famous problems associated with set theory is Cantor’s continuumhypothesis. It is the statement that there are no sets intermediate in size betweena countable set and its powerset. A little more formally, it says:

Let X be a set, and let P(X) be its powerset. If X is countable,then any infinite subset Y of P(X) either is in a 1-1 correspondencewith X, or is in a 1-1 correspondence with P(X).

(The generalized continuum hypothesis is the natural extension of this touncountable infinite sets as well, but the simple continuum hypothesis will dofor present purposes.) Now, a difficulty for set theory is this: the continuumhypothesis has been proved to be undecidable on the basis of the generallyaccepted axioms for Zermelo-Fraenkel set theory. That is (assuming the axiomsfor set theory are consistent) there is a model of the Zermelo-Fraenkel axiomsin which the continuum hypothesis is true, and there is another in which it isfalse.

The problem for us is that the continuum hypothesis can be stated as asentence of higher-order classical logic. I briefly sketch how. First, one can saythe domain of a model is countable by saying there is a relation that orders itisomorphically to the natural numbers. Using a formula from Section 2.3.3, thefollowing will do: (∃α〈0,0〉)integer(α〈0,0〉). Next, one can identify a subset of thedomain with a relation of type 〈0〉. Then the collection of all subsets of thedomain is a relation of type 〈〈0〉〉, so the following says there is a powerset forthe domain of a model: (∃β〈〈0〉〉)(∀γ〈0〉)β〈〈0〉〉(γ〈0〉).

Having shown how to start, I leave the rest of the details to you. Writea sentence saying: if the domain is countable then there is a powerset for thedomain and, for every infinite subset of that powerset, either there is a 1-1correspondence between it and the domain, or there is a 1-1 correspondencebetween it and the powerset. You can say a set is infinite using the negation of aformula from Section 2.3.1. And the existence of a 1-1 correspondence amountsto the existence of a binary relation meeting certain appropriate conditions.Let us call the sentence that is the higher-order formalization of the continuumhypothesis CH.


Now, the real problem is: is the sentence CH valid or not? There are thefollowing not very palatable options.

1. Assume the foundations for informal mathematics is Zermelo-Fraenkel settheory, formulated axiomatically. In this case, neither CH nor its negationis valid.

2. Assume that informal mathematics is being done in some particular modelfor the Zermelo-Fraenkel axioms. In this case, CH is definitely valid, ornot, but it depends on which Zermelo-Fraenkel model is being considered.

3. Assume that higher-order classical logic itself supplies the theoretical foun-dations for mathematics. In this case CH either is valid or it is not, butwhich is it?

I have reached perhaps the most basic difficulty of all with classical higher-order logic. Not only is there no proof procedure that will allow us to proveevery valid formula, the very status of validity for some important formulas isunclear.

2.4 Henkin Models

As we saw in the previous section, higher-order classical logic is difficult to workwith. Indeed, the difficulties already appear at the second-order level. Not onlydoes it lack a complete proof procedure, but the very notion of validity toucheson profound foundational issues. Nonetheless, there are several sound proofprocedures for the logic—any formula that has a proof must be valid, thoughnot every valid formula will have a proof. So, there are certainly fragments ofhigher-order logic that we can hope to make use of.

In a sense, too many formulas of higher-order classical logic are valid, sono proof procedure can be adequate to prove them all. Henkin broadened thenotion of higher-order model (Henkin 1950) in a natural way, which will bedescribed shortly. With this broader notion there are more models, hence fewervalid formulas, since there are more candidates for counter-models. Henkincalled his extension of the semantics general models—I will call them Henkinmodels.

Henkin’s idea seems straightforward, after years of getting used to it. Givena domain D, a universal quantifier whose variable is of type 0, (∀x), rangesover the members of D. If we have a universal quantifier, (∀X), whose variableis of type 〈0〉, it ranges over the collection of properties of D, or equivalently,over the subsets of D. The problem of just what subsets an infinite set hasis actually a deep one. The independence of Cantor’s continuum hypothesis isone manifestation of this problem. Methods for establishing consistency andindependence results in set theory can be used to produce models with consid-erable variation in the powerset of an infinite set. Henkin essentially said that,instead of trying to work with all subsets of D, we should work with enough ofthem, that is, we should take (∀X) as ranging over some collection of subsets of


D, not necessarily all of them, but containing enough to satisfy natural closureproperties. Think of the collection as being intermediate between all subsetsand all definable subsets.

In a higher-order model as defined earlier, there is a domain, D, and thisdetermines the range of quantification for each type. Specifically, we thoughtof a quantifier (∀αt) as ranging over the members of [[ t,D ]] . This time arounda function is introduced, which I call a Henkin domain function and denote byH, explicitly giving us the range for each quantifier type. Then Henkin framesare defined. This basic machinery is needed before it can be specified what itmeans to have enough sets available at each type.

Definition 2.4.1 [Henkin Domain Function] H is a Henkin domain function ifH is any function whose domain is the collection of types and, for each type〈t1, . . . , tn〉, H(〈t1, . . . , tn〉) is some non-empty collection of subsets of H(t1)×· · · × H(tn).

Sets of the form H(t) are called Henkin domains. The function H(t) = [[ t,D ]]is a Henkin domain function. In fact, if H is any Henkin domain function, andH(0) = D, then for every type t, H(t) ⊆ [[ t,D ]] , with equality holding at t = 0.

Definition 2.4.2 [Henkin Frame] The structureM = 〈H, I〉 is a Henkin framefor a language L(C) if it meets the following conditions.

1. H is a Henkin domain function.

2. If A is a constant symbol of L(C) of type t, I(A) ∈ H(t).

3. I(=〈t,t〉) is the equality relation on H(t) for each type t.

The notion of valuation must be suitably restricted, of course.

Definition 2.4.3 [Valuation] v is a valuation in a Henkin frame M = 〈H, I〉if v maps each variable of type t to some member of H(t).

Now, what will make a Henkin frame into a Henkin model? Let’s try a firstattempt at a characterization. (This is not the “official” one, however. Thatwill come later.) Definition 2.2.3, for the meaning of a term, carries over wordfor word to a Henkin frame M. Also Definition 2.2.4, for truth in a model,carries over to M, with one restrictive change. Item 4, the universal quantifiercondition, gets replaced with the following.

4′. Let M = 〈H, I〉 be a Henkin frame and let αt be a variable of type t.M °v (∀αt)Φ if M °v Φ[αt/Ot] for every Ot ∈ H(t), or equivalently, ifM °v′ Φ for every αt-variant v′ of v such that v′(αt) ∈ H(t).

The revised version of item 4 above says that quantifiers of type t range overjust H(t) and not over all objects of type t.

But there is a fundamental problem. Let M = 〈H, I〉 be a Henkin frame,and suppose 〈λα1, . . . , αn.Φ〉 is a predicate abstract—to keep things simple for


now, assume Φ itself contains no abstracts. Then for any valuation v, the char-acterization above determines whether or not M °v Φ. Now, according toDefinition 2.2.3, the meaning (v ∗I)(〈λα1, . . . , αn.Φ〉), to be assigned to the ab-stract, is 〈O1, . . . , On〉 | Γ °v Φ[α1/O1, . . . , αn/On]. The trouble is, we haveno guarantee that this set will be a member of the appropriate Henkin domain.If it is not a member, quantifiers do not include it in their ranges. If this hap-pens, we lose the validity of formulas like (∀α)Ψ(α) ⊃ Ψ(〈λα1, . . . , αn.Φ〉). Thewhole business becomes somewhat problematic since formulas like this clearlyought to be valid.

What must be done is impose enough closure conditions on the Henkindomains of a Henkin frame to ensure that predicate abstracts always designateobjects that are present in Henkin domains. There are several ways this canbe done. Algebraic closure conditions can be formulated directly, though thistakes some effort. I follow a different route that is somewhat easier. Essentially,I first allow predicate abstracts to designate members of Henkin domains in somearbitrary way, then I add the requirement that they be the “right” members.

Definition 2.4.4 [Abstraction Designation Function] A function A is an ab-straction designation function in the Henkin frame M = 〈H, I〉 with respectto the language L(C) provided, for each valuation v in M, and for each predi-cate abstract 〈λα1, . . . , αn.Φ〉 of L(C) of type t, A(v, 〈λα1, . . . , αn.Φ〉) is somemember of H(t).

Think of an abstraction designation function as providing a “meaning” foreach predicate abstract. For the time being, such meanings can be quite ar-bitrary, except that they must be members of appropriate Henkin domains.Now earlier definitions get modified in straightforward ways (and these are the“official” versions). Definition 2.2.3 becomes the following.

Definition 2.4.5 [Denotation of a Term in a Henkin Frame] Let M = 〈H, I〉be a Henkin frame, let v be a valuation, and let A be an abstraction designationfunction. A mapping, (v ∗ I ∗ A), is defined assigning to each term of L(C) adenotation for that term.

1. If A is a constant symbol of L(C) then (v ∗ I ∗ A)(A) = I(A).

2. If α is a variable then (v ∗ I ∗ A)(α) = v(α).

3. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type t, then(v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉) = A(v, 〈λα1, . . . , αn.Φ〉).

And Definition 2.2.4 becomes the following.

Definition 2.4.6 [Truth of a Formula in a Henkin Frame] Let M = 〈H, I〉be a Henkin frame, let v be a valuation, and A be an abstraction designationfunction. A formula Φ of L(C) is true in model M with respect to v and A,denoted M °v,A Φ, if the following holds.


1. For terms τ , τ1, . . . , τn, M °v,A τ(τ1, . . . , τn) provided〈(v ∗ I ∗ A)(τ1), . . . , (v ∗ I ∗ A)(τn)〉 ∈ (v ∗ I ∗ A)(τ).

2. M °v,A ¬Φ if it is not the case that M °v,A Φ.

3. M °v,A Φ ∧Ψ if M °v,A Φ and M °v,A Ψ.

4. M °v,A (∀αt)Φ if M °v,A Φ[αt/O] for every O ∈ H(t).

Now we can impose a requirement that designations of predicate abstractsbe “correct.”

Definition 2.4.7 [Proper Abstraction Designation Function] LetM = 〈H, I〉be a Henkin frame and letA be an abstraction designation function in it, with re-spect to L(C). A is proper provided, for each predicate abstract 〈λα1, . . . , αn.Φ〉and valuation v we have

(v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉) =〈On, . . . , On〉 | M °v,A Φ[α1/O1, . . . , αn/On.

Definition 2.4.8 [Henkin Model] Let M be a Henkin frame, and let A be anabstraction designation function in M. If A is proper, 〈M,A〉 is a Henkinmodel.

For a given Henkin frame M it may be the case that no proper abstractiondesignation function exists. But, if one does exist it must be unique.

Proposition 2.4.9 Let M = 〈H, I〉 be a Henkin frame and let both A and A′be proper abstraction designation functions, with respect to L(C). Then A = A′.

Proof The following two items are shown simultaneously, by induction on de-gree (Definition 1.1.10). From this the Proposition follows immediately.

M °v,A Φ ⇔ M °v,A′ Φ (2.3)(v ∗ I ∗ A)(τ) = (v ∗ I ∗ A′)(τ) (2.4)

Suppose (2.3) and (2.4) are known for formulas and terms whose degree is< k. It will be shown they hold for degree k too, beginning with (2.4).

Suppose τ is a term of degree k. Since k could be 0, τ could be a constantsymbol or a variable. If it is a constant symbol, (v ∗ I ∗ A)(τ) = I(τ) =(v ∗ I ∗ A′)(τ). Similarly if τ is a variable. Finally, τ could be a predicateabstract, 〈λα1, . . . , αn.Φ〉, in which case Φ must be a formula of degree < k, sousing the induction hypothesis with (2.3) we have

(v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉) =〈O1, . . . , On〉 | M °v,A Φ[α1/O1, . . . , αn/On] =〈O1, . . . , On〉 | M °v,A′ Φ[α1/O1, . . . , αn/On] =

(v ∗ I ∗ A′)(〈λα1, . . . , αn.Φ〉)


Thus (2.4) holds for terms of degree ≤ k.Now assume Φ is a formula of degree k. There are several cases, depending

on the form of Φ.If Φ is atomic, it is τ(τ1, . . . , τn) where τ , τ1, . . . , τn are all of degree ≤ k.

Since (2.4) holds for terms of degree < k by assumption, and for terms ofdegree = k by the proof above,

M °v,A τ(τ1, . . . , τn) ⇔〈(v ∗ I ∗ A)(τ1), . . . , (v ∗ I ∗ A)(τn)〉 ∈ (v ∗ I ∗ A)(τ) ⇔〈(v ∗ I ∗ A′)(τ1), . . . , (v ∗ I ∗ A′)(τn)〉 ∈ (v ∗ I ∗ A′)(τ) ⇔

M °v,A′ τ(τ1, . . . , τn)

If Φ is a negation, conjunction, or universally quantified formula, the resultfollows easily using the fact that (2.3) holds for its subformulas, by the inductionhypothesis.

We thus have (2.3) for formulas of degree k, and this concludes the induction.

The pattern of the induction proof above will recur many times, with littlevariation of structure. We go from terms and formulas of degrees < k to termsof degrees ≤ k, and then to formulas of degrees ≤ k.

The Proposition above allows us to give the following extension of Defini-tion 2.4.8.

Definition 2.4.10 [Henkin Model] If 〈M,A〉 is a Henkin model, the properabstraction designation function A is uniquely determined, so we may say theHenkin frame M itself is a Henkin model, and write M °v Φ for M °v,A Φ.

Suppose D is some non-empty set, and we set H(t) = [[ t,D ]] for all types t.This gives us a Henkin domain function, as was noted earlier. And it is easy tosee that 〈D,H〉 will be a Henkin model. In fact, a sentence Φ is true in 〈D,H〉, asdefined in this section, exactly when it is true in the higher-order model 〈D, I〉,as defined in Section 2.2. This says that “true” higher-order models are amongthe Henkin models. The real question is, are there any other Henkin models?The answer is, yes. The proof of the completeness theorem for tableaus willyield this as a byproduct.

Definition 2.4.11 [Standard Model] The Henkin model M = 〈H, I〉 is calleda standard model if H(t) = [[ t,D ]] for all types t.

Since standard models are among the Henkin models, any formula that istrue in all Henkin models must be true in all standard models as well. Butthere is the possibility (a fact, as it happens) that there are formulas true inall standard models that are not true in all Henkin models. That is, the setof Henkin-valid formulas (Definition 2.5.9) is a subset of the set valid formulas(Definition 2.2.6), and in fact turns out to be a proper subset. By decreasingthe set of validities, it opens up the possibility (again a fact, as it happens) thatthere may be a complete proof procedure with respect to this more restrictedversion of validity.


2.5 Unrestricted Henkin Models

Unlike standard higher-order models, Henkin models are allowed to have some,but not necessarily all, of the relations permissible in principle at each type.This means there are more possibilities for Henkin models than for standardmodels. Even so, the objects in the domains of Henkin models are sets, and thisimposes a restriction that we may want to avoid in certain circumstances. Setsare extensional objects—that is, a set is completely determined by its mem-bership. Using the language of properties rather than sets, two extensionalproperties that apply to exactly the same things must be identical, and hencemust have the same properties applying to them. Working with sets is sufficientfor mathematics, but it is not always the right choice in every situation. Even ifthe terms “human being” and “featherless biped” happen to have the same ex-tension, we might not wish to identify them. As another example, the propertiesof being the morning star and being the evening star have the same extension,but were thought of as distinct properties by the ancient Babylonians.

Henkin himself (Henkin 1950) noted the possibility of a more general notionthan what I am calling a Henkin model, “The axioms of extensionality can bedropped if we are willing to admit models whose domains contain functionswhich are regarded as distinct even though they have the same value for everyargument.” Even so, extensionality has commonly been built into the treatmentof Henkin models in the literature—(Andrews 1972) is one of the rare instanceswhere a model without extensionality is constructed. As it happens, we willhave need for a non-extensional version in carrying out the completeness prooffor tableaus. Since such models are also of intrinsic interest, they are presentedin some detail in this section.

For Henkin frames, simply specifying the members of the Henkin domainstells us much. Since they are sets, there is a notion of membership, and it canbe used in the definition of truth for atomic formulas. That is, sets come withtheir extensions fully determined. If we move away from sets this machinerybecomes unavailable, and we must fill the gap with something else—I make useof an explicit extension function, denoted E . That is, for an arbitrary object O,E(O) gives us the extension of O. I also allow the possibility that equality maynot behave as expected—I allow for non-normal frames and models.

Definition 2.5.1 [Unrestricted Henkin Frame] M = 〈H, I, E〉 is called an un-restricted Henkin frame for a language L(C) if it meets the following conditions.

1. H is a function whose domain is the collection of types.

2. For each type t, H(t) is some non-empty collection of objects (not neces-sarily sets).

3. If A is a constant symbol of L(C) of type t, I(A) ∈ H(t).

4. For each type t = 〈t1, . . . , tn〉, E maps H(t) to subsets of H(t1) × · · · ×H(tn).


In addition,M is normal if E(I(=〈t,t〉)) is the equality relation on H(t) for eachtype t.

Much of this definition is similar to that of Henkin frame. The members ofH(t) are the objects of type t (which now need not be sets). The new item isthe mapping E . Think of E(O) as the extension of the object O.

Unrestricted Henkin models are built out of unrestricted Henkin frames.Much of the machinery is almost identical with that for Henkin models, butthere are curious twists, so things are presented in detail, rather than justreferring to earlier definitions. The definition of valuation is the same as before.

Definition 2.5.2 [Valuation] v is a valuation in an unrestricted Henkin frameM = 〈H, I, E〉 if v maps each variable of type t to some member of H(t).

Next, just as with Henkin models, a function is needed that provides des-ignations for predicate abstracts, then later we can require that it give us the“right” values. The wording is the same as before.

Definition 2.5.3 [Abstraction Designation Function] A function A is an ab-straction designation function in the unrestricted Henkin frameM = 〈H, I, E〉,with respect to the language L(C) provided, for each valuation v inM, and foreach predicate abstract 〈λα1, . . . , αn.Φ〉 of L(C) of type t, A(v, 〈λα1, . . . , αn.Φ〉)is some member of H(t).

Term denotation is the same as before—terms designate objects in the var-ious Henkin domains.

Definition 2.5.4 [Denotation of a Term in an Unrestricted Henkin Frame] LetM = 〈H, I, E〉 be an unrestricted Henkin frame, let v be a valuation, and letA be an abstraction designation function. A mapping, (v ∗ I ∗ A), is definedassigning to each term of L(C) a denotation for that term.

1. If A is a constant symbol of L(C) then (v ∗ I ∗ A)(A) = I(A).

2. If α is a variable then (v ∗ I ∗ A)(α) = v(α).

3. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type t, then(v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉) = A(v, 〈λα1, . . . , αn.Φ〉).

The following has a few changes from the earlier definition—to take theextension function into account the atomic case has been modified.

Definition 2.5.5 [Truth of a Formula in an Unrestricted Henkin Frame] AgainletM = 〈H, I, E〉 be an unrestricted Henkin frame, let v be a valuation, and Abe an abstraction designation function. A formula Φ of L(C) is true in modelM with respect to v and A, denoted M °v,A Φ, provided the following.

1. For an atomic formula, M °v,A τ(τ1, . . . , τn) provided〈(v ∗ I ∗ A)(τ1), . . . , (v ∗ I ∗ A)(τn)〉 ∈ E((v ∗ I ∗ A)(τ)).


2. M °v,A ¬Φ if it is not the case that M °v,A Φ.

3. M °v,A Φ ∧Ψ if M °v,A Φ and M °v,A Ψ.

4. M °v,A (∀αt)Φ if M °v,A Φ[αt/Ot] for every Ot ∈ H(t).

In item 1 above, τ(τ1, . . . , τn) is true if the designation of 〈τ1, . . . , τn〉 is inthe extension of the designation of τ . For Henkin frames, we were dealing withsets, and extensions were for free. Now we are dealing with arbitrary objects,and we must explicitly invoke the extension function E .

I am about to impose a “correctness” requirement, analogous to Defini-tion 2.4.7, but now there are three parts. The first part is similar to that forHenkin models, except that the extension function is invoked. The other partsneed some comment. Suppose we have two predicate abstracts 〈λα1, . . . , αn.Φ〉and 〈λα1, . . . , αn.Ψ〉. In a Henkin model, if Φ and Ψ are equivalent formulas,they will be true of the same objects and so the two predicate abstracts willdesignate the same thing, since they have the same extensions. But now weare explicitly allowing predicate abstracts having the same extension to denotedifferent objects. Still, we don’t want the designation of objects by predicateabstracts to be entirely arbitrary—I will require equi-designation under circum-stances of “structural similarity.”

Definition 2.5.6 LetM be an unrestricted Henkin frame (or a Henkin frame),and let A be an abstraction designation function in it. For each valuation v andsubstitution σ, define a new valuation vσ by:

αvσ = (v ∗ I ∗ A)(ασ).

Thus vσ assigns to a variable α the “meaning” of the term ασ.

Definition 2.5.7 [Proper Abstraction Designation Function]LetM = 〈H, I, E〉 be an unrestricted Henkin frame and let A be an abstractiondesignation function in it, with respect to L(C). A is proper provided, for eachpredicate abstract 〈λα1, . . . , αn.Φ〉 we have

1. E((v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉)) =〈O1, . . . , On〉 | Γ °v,A Φ[α1/O1, . . . , αn/On]

2. If v and w agree on the free variables of 〈λα1, . . . , αn.Φ〉 then

A(v, 〈λα1, . . . , αn.Φ〉) = A(w, 〈λα1, . . . , αn.Φ〉)

3. If σ is a substitution that is free for the term 〈λα1, . . . , αn.Φ〉, then

A(v, 〈λα1, . . . , αn.Φ〉σ) = A(vσ, 〈λα1, . . . , αn.Φ〉)

The technical significance of items 2 and 3 above will be seen in the nextsection. When using Henkin frames, if a proper abstraction designation function


exists, it is unique (Proposition 2.4.9). But with an unrestricted Henkin frame, itis entirely possible for there to be more than one proper abstraction designationfunction. Since there is this possibility, we must specify which one to use—theframe alone does not determine it.

Definition 2.5.8 [Unrestricted Henkin Model] Let M be an unrestrictedHenkin frame, and let A be an abstraction designation function in M. If A isproper, 〈M,A〉 is an unrestricted Henkin model.

Finally Definition 2.2.6 is broadened to the entire class of unrestricted Henkinmodels.

Definition 2.5.9 [Validity, Satisfiability, Consequence] Let Φ be a formula andS be a set of formulas of L(C).

1. Φ is valid in unrestricted Henkin models ifM °v,A Φ for every unrestrictedHenkin model 〈M,A〉 for L(C) and proper valuation v.

2. S is satisfiable in an unrestricted Henkin model 〈M,A〉 for L(C) if thereis some proper valuation v such that M °v,A ϕ for every ϕ ∈ S.

3. Φ is an unrestricted Henkin consequence of S provided, for every unre-stricted Henkin model 〈M,A〉 for L(C) and every proper valuation v, ifM °v,A ϕ for all ϕ ∈ S, then M °v,A Φ.

Similar terminology is used when confining things to unrestricted Henkin modelsthat are normal, or to Henkin models themselves.

We saw in Section 2.4 that the notion of Henkin model extended that of“true” higher-order model, since “true” models can be identified with standardHenkin models. In a similar way the notion of unrestricted Henkin model ex-tends that of Henkin model, since Henkin models correspond to what will becalled extensional unrestricted Henkin models (the definition is in the next sec-tion). Verifying this is postponed since it requires us to show that parts 2 and3 of Definition 2.5.7 hold for Henkin models, and this involves some technicalwork. Assuming the result for the moment, it follows that there are unrestrictedHenkin models because there are Henkin models; and we know there are Henkinmodels because there are standard models. The question is: have the variousgeneralizations really generalized anything? In fact, they have. It is a conse-quence of the completeness proofs, which are given later, that there are Henkinmodels that are not standard, and there are unrestricted Henkin models thatare not extensional Henkin models.

2.6 A Few Technical Results

There are several results of a rather technical nature that, nonetheless, areof fundamental importance. In fact, one of the technical propositions below


concerns us immediately—it allows us to show that Henkin models are (isomor-phically) among the unrestricted Henkin models. Since we do not yet know this,the first few items must treat Henkin models and unrestricted Henkin modelsseparately. I omit proofs because they are very similar to proofs in Section 4.2.3which are given fully.

Proposition 2.6.1 Let 〈M,A〉 be either a Henkin model or an unrestrictedHenkin model, and let v and w be valuations.

1. If v and w agree on the free variables of the term τ(v ∗ I ∗ A)(τ) = (w ∗ I ∗ A)(τ).

2. If v and w agree on the free variables of the formula ΦM °v,A Φ⇐⇒M °w,A Φ.

I leave the proof of the Proposition above as an exercise—see the proofof Proposition 4.2.8 as a guide. (For unrestricted Henkin models, part 2 ofDefinition 2.5.7 is needed.) Next I state a result that will be used in the nextChapter to establish the soundness of the tableau system.

Proposition 2.6.2 Let 〈M,A〉 be a Henkin model. For any substitution σ andvaluation v:

1. If σ is free for the term τ then(v ∗ I ∗ A)(τσ) = (vσ ∗ I ∗ A)(τ).

2. If σ is free for the formula Φ thenM °v,A Φσ ⇐⇒M °vσ,A Φ.

Once again I omit the proof, and refer you to the proof of Proposition 4.2.10for a similar argument.

Among Henkin models, the standard ones correspond to “true” higher-ordermodels. A similar phenomenon occurs here—among the unrestricted Henkinmodels certain ones correspond to Henkin models.

Definition 2.6.3 [Extensional] An unrestricted Henkin frame 〈H, I, E〉 is ex-tensional provided that E(O) = E(O′) implies O = O′ for all objects O and O′.An unrestricted Henkin model is extensional if its frame is.

Suppose M = 〈H, I〉 is a Henkin frame (Definition 2.4.2) and 〈M,A〉 is aHenkin model. M can be converted into an unrestricted Henkin frame M′ =〈H, I, E〉 by setting E(O) = O for each object O of non-zero type. That is,we specify an extension function that gives us the usual set-theoretic notion ofextension. It is easy to check that 〈M′,A〉 is an unrestricted Henkin frame—part 1 of Proposition 2.6.2 directly gives us part 3 of Definition 2.5.7, andlikewise Proposition 2.6.1 gives us part 2. Obviously the unrestricted Henkinmodel that results is extensional. And equally obviously, evaluation of truth inthe original Henkin model and in the unrestricted Henkin model just constructedis essentially the same.


Conversely, suppose M = 〈H, I, E〉 is an unrestricted Henkin frame thatis extensional. Inductively define a mapping θ as follows. For objects O oftype 0, θ(O) = O. And for an object O of type 〈t1, . . . , tn〉, set θ(O) =〈θ(O1), . . . , θ(On)〉 | 〈O1, . . . , On〉 ∈ E(O). Define a new domain functionH′ by setting H′(t) = θ(O) | O ∈ H(t). Using the fact that M is exten-sional, it is not hard to show that θ is 1-1 and onto between H(t) and H′(t),for each type t. Finally, for each term τ , set I ′(τ) = θ(I(τ)). This gives us aHenkin frame 〈H′, I ′〉. Thus, in effect, each unrestricted Henkin frame that isextensional is isomorphic to a Henkin frame as defined earlier.

From now on I will treat Henkin models as being unrestricted Henkin modelsthat are extensional, when it is convenient to do so.

A result similar to Proposition 2.6.2, but for unrestricted Henkin models, isquite easy to establish, given the previous work.

Proposition 2.6.4 Let 〈M,A〉 be an unrestricted Henkin model. For any sub-stitution σ and valuation v:

1. If σ is free for the term τ then(v ∗ I ∗ A)(τσ) = (vσ ∗ I ∗ A)(τ).

2. If σ is free for the formula Φ thenM °v,A Φσ ⇐⇒M °vσ,A Φ.

A proof of this is quite similar to that for Proposition 2.6.4 (which wasnot given), except for the induction step involving terms that are predicateabstracts, where a reduction to a simpler case is no longer possible. But forunrestricted Henkin models, we are given what we need for this step as part ofthe definition. (See part 3 of Definition 2.5.7).

Part of the definition of (unrestricted) Henkin model is that each predicateabstract must have an interpretation that is an object with the “right” exten-sion. But what predicate abstracts there are depends on what the language is.Given a language L(C), one would expect models to depend on the collectionof constants—members of C—which the interpretation function, I, deals with.One would not expect the choice of free variables of L(C) to matter, but this isnot entirely clear, since predicate abstracts can involve free variables. It is im-portant to know that the choice of free variables, in fact, does not matter, sincethe machinery of tableau proofs will require the addition of new free variablesto the language.

In what follows, L(C) is the basic language, and L+(C) is like L(C), withnew variables added, but with the understanding that these new variables arenever quantified or λ-bound. (This all takes on a significant role in the nextchapter.) I note the fundamental problem: even with the restrictions imposed onthe additional variables, the collection of predicate abstracts of L+(C) properlyextends that of L(C).


Proposition 2.6.5 Every unrestricted Henkin model with respect to L(C) canbe converted into an unrestricted Henkin model with respect to L+(C) so thattruth values for formulas of L(C) are preserved.

There are two immediate consequences of this Proposition that I want tostate, before I sketch its proof. First, any set S of sentences of L(C) that issatisfiable in some unrestricted Henkin model with respect to L(C) is also sat-isfiable in some unrestricted Henkin model with respect to L+(C). And second,any sentence Φ of L(C) that is valid in all unrestricted Henkin models withrespect to L+(C) is also valid in all unrestricted Henkin models with respect toL(C) (because a L(C) countermodel can be converted into a L+(C) counter-model).

Proof The proof basically amounts to replacing the new variables of L+(C) bysome from L(C), to determine behavior of predicate abstracts. I only sketchthe general outlines. Let M = 〈H, I, E〉 be an unrestricted Henkin frame, andlet 〈M,A〉 be an unrestricted Henkin model with respect to L(C).

Recall the following notational convention: β1/α1, . . . , βn/αn is the sub-stitution that replaces each βi by the corresponding αi. Also, if v is a valuationwith respect to L+(C), by v′ = vβ1/α1, . . . , βn/αn I mean the valuation withrespect to L(C) such that v′(αi) = v(βi), and on other free variables, v′ and vagree.

Now extendA to an abstraction designation function, A′, suitable for L+(C).For each predicate abstract 〈λγ1, . . . , γk.Φ〉 of L+(C), and for each valuation vwith respect to L+(C), do the following. Let β1, . . . , βn be all the free variablesof Φ that are in the language L+(C) but not in L(C), and let α1, . . . , αn bea list of variables of the same corresponding types, that do not occur in Φ, freeor bound. Now, set

A′(v, 〈λγ1, . . . , γk.Φ〉) =A(vβ1/α1, . . . , βn/αn, 〈λγ1, . . . , γk.Φβ1/α1, . . . , βn/αn〉)

It can be shown that this is a proper definition, in the sense that it does notdepend on the particular choice of free variables to replace the βi.

Now it is possible to show that 〈M,A′〉 is an unrestricted Henkin model withrespect to L+(C), and truth values of sentences of L(C) evaluate the same withrespect to A and A′. One must show a more general result, involving formulaswith free variables. The details are messy, and I omit them.

Finally, Proposition 2.6.5 has a kind of converse. Together they say thedifference between L(C) and L+(C) doesn’t matter semantically. I omit itsproof altogether.

Proposition 2.6.6 Every unrestricted Henkin model with respect to L+(C) canbe converted into an unrestricted Henkin model with respect to L(C) so that truthvalues for formulas of L(C) are preserved.


Exercises

Exercise 2.6.1 Give a proof of Proposition 2.6.1.



Exercise 2.6.4 Give a proper proof that each unrestricted Henkin frame thatis extensional is isomorphic to a Henkin frame.

Chapter 3

Classical Logic—BasicTableaus

Several varieties of proof procedures have been developed for first-order classicallogic. Among them the semantic tableau procedure has a considerable attrac-tion, (Smullyan 1968, Fitting 1996). It is intuitive, close to the intended seman-tics, and is automatable. For higher-order classical logic, semantic tableaus arerarely seen—most treatments in the literature are axiomatic. Among the no-table exceptions are (Toledo 1975, Smith 1993, Kohlhase 1995, Gilmore 1998b).In fact, semantic tableaus retain much of their first-order ability to charm,and they are what I present here. Automatability becomes more problematic,however, for reasons that will become clear as we proceed. Consequently thepresentation should be thought of as meant for human use, and intelligence inthe construction of proofs is expected.

This chapter examines what I call a basic tableau system; rules are lifted fromthose of first-order classical logic, and two straightforward rules for predicateabstracts are added. It is a higher-order version of the second-order systemgiven in (Toledo 1975). I will show it corresponds to the unrestricted Henkinmodels from Section 2.5 of Chapter 2. In Chapters 5 and 6 I make additions tothe system to narrow it to Henkin models.

3.1 A Different Language

In creating tableau proofs I use a modified version of the language defined inChapter 2. That is, I give tableau proofs of sentences from the original languageL(C), but the proofs themselves can involve formulas from a broader languagewhich is called L+(C). Before presenting the tableau rules, I describe the wayin which the language is extended for proof purposes.

Existential quantifiers are treated at higher orders exactly as they are in thefirst-order case. If we know an existentially quantified formula is true, a newsymbol is introduced into the language for which we say, in effect, let that be

29

CHAPTER 3. CLASSICAL LOGIC—BASIC TABLEAUS 30

something whose value makes the formula true. As usual, newness is critical.For this purpose it is convenient to enhance the collection of free variables byadding a second kind, called parameters.

Definition 3.1.1 [Parameters] In L(C), for each type t there is an infinitecollection of free variables of that type. The language L+(C) differs from L(C)in that, for each t there is also a second infinite list of free variables of type t,called parameters, a list disjoint from that of the free variables of L(C) itself.Parameters may appear in formulas in the same way as the original list of freevariables but they are never quantified or λ bound. p, q, P , Q, . . . are used torepresent parameters.

Parameters appear in tableau proofs. They do not appear in the sentencesbeing proved. Since they come from an alphabet distinct from the originalfree variables, an alphabet that is never quantified or λ bound, we never need toworry about whether the introduction of a parameter will lead to its inadvertentcapture by a quantifier or a λ—introducing them will always involve a freesubstitution. Thus rules that involve them can be relatively simple.

Special Terminology Technically, parameters are a special kind of free vari-able. But to keep terminology simple, I will continue to use the phrase freevariable for the free variables of L(C) only, and when I want to include param-eters in the discussion I will explicitly say so.

The notion of truth in unrestricted Henkin models must also be adjusted totake formulas of L+(C) into account. As I have just noted, parameters are spe-cial free variables, so when dealing semantically with L+(C), valuations must bedefined for parameters as well as for the free variables of L(C). Essentially, thedifference between an unrestricted Henkin frame and an unrestricted Henkinmodel lies in the requirement that the extension of a formula appearing in apredicate abstract correspond to the designation of that abstract, which is amember of the appropriate Henkin domain. In L+(C) there are parameters, sothere are more formulas and predicate abstracts than in L(C). Then requir-ing that something be an unrestricted Henkin model with respect to L+(C) isapparently a stronger condition than requiring it be one with respect to L(C),though Section 2.6 establishes that this is not actually so.

Definition 3.1.2 [Grounded] A term or a formula of L+(C) is grounded if itcontains no free variables of L(C), though it may contain parameters.

The notion of grounded extends the notion of closed. Specifically, a groundedformula of L+(C) that happens to be a formula of L(C) is a closed formula ofL(C), and similarly for terms.

3.2 Basic Tableaus

I now present the basic tableau system. It does not contain machinery fordealing with equality—that comes in the next chapter. The rules come from


(Toledo 1975), where they were given for second-order logic. These rules, inturn, trace back to the sequent-style higher-order rules of (Prawitz 1968) and(Takahashi 1967).

All tableau proofs are proofs of sentences—closed formulas—of L(C). Atableau proof of Φ is a tree that has ¬Φ at its root, grounded formulas ofL+(C) at all nodes, is constructed following certain branch extension rules tobe given below, and is closed, which means it embodies a contradiction. Such atree intuitively says ¬Φ cannot happen, and so Φ is valid.

The branch extension rules for propositional connectives are quite straight-forward and well-known. Here they are, including rules for various definedconnectives.

Definition 3.2.1 [Conjunctive Rules]

X ∧ YXY

¬(X ∨ Y )¬X¬Y

¬(X ⊃ Y )X¬Y

X ≡ YX ⊃ YY ⊃ X

For the conjunctive rules, if the formula above the line appears on a branchof a tableau, the items below the line may be added to the end of the branch.The rule for double negation is of the same nature, except that only a singleadded item is involved.

Definition 3.2.2 [Double Negation Rule]

¬¬XX

Next come the disjunctive rules. For these, if the formula above the lineappears on a tableau branch, the end node can have two children added, labeledrespectively with the two items shown below the line in the rule. In this caseone says there is tableau branching.

Definition 3.2.3 [Disjunctive Rules]

X ∨ YX Y

¬(X ∧ Y )¬X ¬Y

X ⊃ Y¬X Y

¬(X ≡ Y )¬(X ⊃ Y ) ¬(Y ⊃ X)

This completes the propositional connective rules. The motivation shouldbe intuitively obvious. For instance, if X ∧ Y is true in a model, both X and Yare true there, and so a branch containing X ∧ Y can be extended with X andY . If X ∨ Y is true in a model, one of them is true there. The corresponding


tableau rule says if X ∨ Y occurs on a branch, the branch splits using X and Yas the two cases. One or the other represents the “correct” situation.

Though the universal quantifier has been taken as basic, it is convenient, andjust as easy, to have tableau rules for both universal and existential quantifiersdirectly. To state the rules simply, I use the following convention. SupposeΦ(αt) is a formula in which the variable αt, of type t, may have free occurrences.And suppose τ t is a term of type t. Then Φ(τ t) is the result of carrying outthe substitution αt/τ t in Φ(αt), replacing all free occurrences of αt withoccurrences of τ t. Now, here are the existential quantifier rules.

Definition 3.2.4 [Existential Rules] In the following, pt is a parameter of typet that is new to the tableau branch.

(∃αt)Φ(αt)Φ(pt)

¬(∀αt)Φ(αt)¬Φ(pt)

The rules above embody the familiar notion of existential instantiation.Since the convention is that parameters are never quantified, we don’t haveto worry about accidental variable capture. More precisely, in the rules above,the substitution αt/pt is free for the formula Φ(αt).

The universal rules are somewhat more straightforward. Once again, notethat in them the substitution αt/τ t is free for the formula Φ(αt).

Definition 3.2.5 [Universal Rules] In the following, τ t is any grounded termof type t of L+(C).

(∀αt)Φ(αt)Φ(τ t)

¬(∃αt)Φ(αt)¬Φ(τ t)

Finally we have the rules for predicate abstracts. Earlier notation is extendeda bit so that, if Φ(α1, . . . , αn) is a formula, α1, . . . , αn are distinct free variables,and τ1, . . . , τn are grounded terms of the same respective types as α1, . . . , αn,then Φ(τ1, . . . , τn) is the result of simultaneously substituting each τi for all freeoccurrences of αi in Φ.

Definition 3.2.6 [Abstract Rules]

〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn)

Φ(τ1, . . . , τn)

¬〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn)

¬Φ(τ1, . . . , τn)

Now what, exactly, constitutes a proof.

Definition 3.2.7 [Closure] A tableau branch is closed if it contains Φ and ¬Φ,where Φ is a grounded formula. A tableau is closed if each branch is closed.


Definition 3.2.8 [Tableau Proof] For a sentence Φ of L(C), a closed tableaubeginning with ¬Φ is a proof of Φ.

Definition 3.2.9 [Tableau Derivation] A tableau derivation of a sentence Φfrom a set of sentences S, all of L(C), is a closed tableau beginning with ¬Φ,allowing the additional rule: at any point any member of S can be added to theend of any open branch.

This concludes the presentation of the tableau rules. In the next sectionI give several examples of tableaus. Classical first-order tableau rules, as in(Smullyan 1968, Fitting 1996) are analytic—they only involve subformulas ofthe formula being proved. (It is not the case with the cut rule, but this is aneliminable rule.) Higher-order rules, for the most part, have an analytic natureas well. The important exception is the rule for the universal quantifier. Itallows us to pass from (∀αt)Φ(αt) to Φ(τ t) where τ t is an arbitrary groundedterm. Since terms can involve predicate abstracts, applications of this rule canintroduce formulas that are not subformulas of the one being proved—indeed,they may be much more complicated. There is no way around this. In asense, the introduction of predicate abstracts embodies the “creative element”of mathematics.

3.3 Tableau Examples

Tableaus for first-order classical logic are well-known, but the abstraction rulesof the previous section are not widely familiar. I give a number of examplesillustrating their uses. The first embodies the principle behind many diagonalarguments in mathematics.

Example 3.3.1 Suppose there is a way of matching subsets of some set D withmembers of D. Let us call a member of D associated with a particular subseta code for that subset: every member of D must be a code, and nothing canbe a code for more than one subset, though it is allowed that some subsets canhave more than one code. Then, some subset of D must lack a code. (Oneconsequence of this is Cantor’s Theorem: a set and its power set cannot be ina 1-1 correspondence.)

To formulate this, let R(x, y) represent the relation: y is in the subset thathas x as its code; so 〈λy.R(x, y)〉 represents the set coded by x. Then thefollowing second-order sentence does the job.

(∀R)(∃X)(∀x)¬[〈λy.R(x, y)〉 = X] (3.1)

This formulation contains equality. I have not given rules for equality yet,so I give an alternative formulation that does not involve it.

(∀R)(∃X)(∀x)(∃y)[R(x, y) ∧ ¬X(y)] ∨ [¬R(x, y) ∧X(y)] (3.2)


I give a proof of (3.2). It is contained in Figure 3.3.1. In it, 2 is from 1by an existential rule (P is a new parameter); 3 is from 2 by a universal rule(〈λx.¬P (x, x)〉 is a grounded term); 4 is from 3 by an existential rule (p isanother new parameter); 5 is from 4 by a universal rule (p is a grounded term);6 and 7 are from 5 by a conjunction rule; 8 and 9 are from 6 by a disjunctionrule; 10 is from 9 by double negation; 11 and 12 are from 7 by a disjunction rule,as are 13 and 14; 15 is from 12 by an abstract rule, as is 16 from 10. Closure isby 8 and 11, 8 and 15, 13 and 16, and 10 and 14.

A key feature in the tableau proof of (3.2) is the use of 〈λx.¬P (x, x)〉 in anapplication of a universal rule. This, in fact, is the heart of diagonal argumentsand amounts to looking at the collection of things that do not belong to the setthey code. The choice of such abstracts at key points of proofs is the distilledessence of mathematical thinking—everything else is mechanical. It is the needfor such choices that stands in the way of fully automating higher-order proofsearch.

Next is an example that comes out of propositional modal logic. Some knowl-edge of Kripke semantics will be needed in order to understand the backgroundexplanation. See (Hughes & Cresswell 1996a, pp 188-190) for a fuller treatment.

Example 3.3.2 It is a well-known result of modal model theory that a rela-tional frame is reflexive if and only if every instance of ¤P ⊃ P is valid init. I want to give a formal version of this using the machinery of higher-orderclassical logic. Suppose we think of the type 0 domain of a higher-order classicalmodel as being the set of possible worlds of a relational frame. Let us think ofthe atomic formula P (x) as telling us that P is true at world x, and R(x, y)as saying y is a world accessible from x. Then making use of the usual Kripkesemantics, (∀y)[R(x, y) ⊃ P (y)] corresponds to P being true at every worldaccessible from x, and hence to ¤P being true at world x, where R plays therole of the accessibility relation. Then further, saying ¤P ⊃ P is true at x cor-responds to (∀y)[R(x, y) ⊃ P (y)] ⊃ P (x). We want to say that if this happensat every world, and for all P , the relation R must be reflexive. Specifically, Igive a tableau proof of the following. In it, take R to be a constant symbol.

(∀x)R(x, x) ≡ (∀P )(∀x)(∀y)[R(x, y) ⊃ P (y)] ⊃ P (x) (3.3)

Actually, the implication from left to right is straightforward—I supply atableau proof from right to left.


¬(∀R

)(∃X

)(∀x)(∃

y)[R(x,y)∧

¬X

(y)]∨[¬R

(x,y)∧

X(y)]

1.¬

(∃X

)(∀x)(∃

y)[P(x,y)∧

¬X

(y)]∨[¬P

(x,y)∧

X(y)]

2.

¬(∀x)(∃

y)[P(x,y)∧

¬〈λx.¬P

(x,x)〉(y)]∨

[¬P

(x,y)∧

〈λx.¬P

(x,x)〉(y)]

3.¬

(∃y)[P

(p,y)∧

¬〈λx.¬P

(x,x)〉(y)]∨

[¬P

(p,y)∧

〈λx.¬P

(x,x)〉(y)]

4.¬[P

(p,p)∧

¬〈λx.¬P

(x,x)〉(p)]∨

[¬P

(p,p)∧

〈λx.¬P

(x,x)〉(p)]

5.¬

[P(p,p)∧

¬〈λx.¬P

(x,x)〉(p)]

6.¬

[¬P

(p,p)∧

〈λx.¬P

(x,x)〉(p)]

7.

@@@@

¬P

(p,p)

8.¬¬〈λ

x.¬P

(x,x)〉(p)

9.〈λx.¬P

(x,x)〉(p)

10.

@@

@@

¬¬P

(p,p)

11.¬〈λ

x.¬P

(x,x)〉(p)

12.¬¬

P(p,p)

13.¬〈λ

x.¬P

(x,x)〉(p)

14.¬¬

P(p,p)

15.¬P

(p,p)

16.

Figure

3.1:T

ableauP

roofof

(∀R

)(∃X

)(∀x)(∃

y)[R(x,y)∧

¬X

(y)]∨[¬R

(x,y)∧

X(y)]


¬(∀P )(∀x)(∀y)[R(x, y) ⊃ P (y)] ⊃ P (x) ⊃ (∀x)R(x, x) 1.(∀P )(∀x)(∀y)[R(x, y) ⊃ P (y)] ⊃ P (x) 2.¬(∀x)R(x, x) 3.¬R(p, p) 4.

(∀x)(∀y)[R(x, y) ⊃ 〈λz.R(p, z)〉(y)] ⊃ 〈λz.R(p, z)〉(x) 5.(∀y)[R(p, y) ⊃ 〈λz.R(p, z)〉(y)] ⊃ 〈λz.R(p, z)〉(p) 6.

@

@@@

¬(∀y)[R(p, y) ⊃ 〈λz.R(p, z)〉(y)] 7. 〈λz.R(p, z)〉(p) 8.¬[R(p, q) ⊃ 〈λz.R(p, z)〉(q) 9. R(p, p) 13.R(p, q) 10.¬〈λz.R(p, z)〉(q) 11.¬R(p, q) 12.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an existentialrule (p is a new parameter); 5 is from 2 by a universal rule (〈λz.R(p, z)〉 is agrounded term); 6 is from 5 by a universal rule (p is a grounded term); 7 and 8are from 6 by a disjunctive rule; 9 is from 7 by an existential rule (q is a newparameter); 10 and 11 are from 9 by a conjunction rule; 12 is from 11 and 13 isfrom 8 by abstract rules.

The last example is a version of the famous Knaster-Tarski theorem.

Example 3.3.3 Let D be a set and let F be a function from its powerset toitself. F is called monotone provided, for each P,Q ⊆ D, if P ⊆ Q thenF(P ) ⊆ F(Q). Theorem: any monotone function F on the powerset of D hasa fixed point, that is, there is a set C such that F(C) = C. (Actually theKnaster-Tarski theorem says much more, but this will do for present purposes.)

I now give a formalization of this theorem. Since function symbols arenot available, I restate it using relation symbols, and it is not even neces-sary to require functionality. Now, (∀x)(P (x) ⊃ Q(x)) will serve to formal-ize P ⊆ Q. If F(P, x) is used to formalize that x is in the set F(P ), then(∀x)(P (x) ⊃ Q(x)) ⊃ (∀x)(F(P, x) ⊃ F(Q, x)) says we have monotonicity.Then, the following embodies a version of the Knaster-Tarski theorem (F is aconstant symbol).

(∀P )(∀Q)[(∀x)(P (x) ⊃ Q(x)) ⊃ (∀x)(F(P, x) ⊃ F(Q, x))] ⊃ (3.4)(∃S)(∀x)(F(S, x) ≡ S(x))

I leave the construction of a tableau proof of this to you as an exercise, butI give the following hint. Let Φ(P, x) abbreviate the formula (∀y)(F(P, y) ⊃P (y)) ⊃ P (x). An appropriate term to consider during a universal rule appli-cation is: 〈λx.(∀P )Φ(P, x)〉.


A comment on the hint above. Rewriting (∀y)(F(P, y) ⊃ P (y)) using con-ventional function notation: it says F(P ) ⊆ P . Then Φ(P, x) says that x belongsto a set P if P meets the condition F(P ) ⊆ P . Then further, (∀P )Φ(P, x) saysthat x is in ∩P | F(P ) ⊆ P. So finally, 〈λx.(∀P )Φ(P, x)〉 represents theset ∩P | F(P ) ⊆ P itself. In the most common proof of the Knaster-Tarskitheorem, one proceeds by showing this set, in fact, is a fixed point of F .

Example 3.3.3 once again illustrates a fundamental point about higher-ordertableaus. They mechanize routine steps, but do not substitute for mathematicalinsight. The choice of which predicate abstract to use during an application ofa universal rule really contains, in distilled form, the essence of a standardmathematical argument.

The problem of what choice to make when instantiating a universal quanti-fier also arises in first-order logic, but there is a way around it—one uses freevariables when instantiating, then one determines later which values to choosefor them (Fitting 1996). This last step, picking values, involves unification, thesolving of equations involving first-order terms. There are several unificationalgorithms to do this, all of which accomplish the following: given two terms, ifthere is a choice of values for their free variables that makes the terms identical,the algorithm finds the most general such choice; and if the terms cannot bemade identical, the algorithm reports this fact. Unification is at the heart ofevery first-order theorem prover.

If we attempt a similar strategy in automating higher-order logic, we im-mediately run into an obstacle at this point. The problem of unification forhigher-order terms is undecidable! This was shown for third-order terms in(Huet 1973), and improved to show unification for second-order terms is al-ready undecidable, in (Goldfarb 1981). This does not mean the situation iscompletely hopeless. While first-order unification is decidable, and second-orderis not, still there is a kind of semi-decision procedure, (Huet 1975). Two free-variable tableau systems for higher-order classical logic, using unification, arepresented in (Kohlhase 1995). The use of higher-order unification in this waytraces back to resolution work of (Andrews 1971) and (Huet 1972). But finally,technical issues aside, we always come back to the observation made above: thechoice of predicate abstract to use in instantiating a universally quantified for-mula often embodies the mathematical “essence” of a proof. Too much shouldnot be expected from the purely mechanical.

Exercises

Exercise 3.3.1 Continuing the ideas of Example 3.3.2, give tableau proofs ofthe following.

1. (symmetry)

(∀x)(∀y)[R(x, y) ⊃ R(y, x)] ≡(∀P )(∀x)(∃y)[R(x, y) ∧ (∀z)(R(y, z) ⊃ P (z))] ⊃ P (x)


2. (transitivity)

(∀x)(∀y)(∀z)[(R(x, y) ∧R(y, z)) ⊃ R(x, z)] ≡(∀P )(∀x)(∀y)[R(x, y) ⊃ P (y)] ⊃

(∀y)(∀z)[(R(x, y) ∧R(y, z)) ⊃ P (z)]

Exercise 3.3.2 Give the tableau proof to complete Example 3.3.3.

Exercise 3.3.3 Continuing with Example 3.3.3, the set ∩P | F(P ) ⊆ P isnot only a fixed point of monotonic F , it is the smallest one. Dually, ∪P |P ⊆ F(P ) is also a fixed point, the largest one. Give a tableau proof of (3.4)based on this idea.

Chapter 4

Soundness andCompleteness

This chapter contains a proof that the basic tableau rules are sound and com-plete with respect to unrestricted Henkin models. Soundness is by the “usual”argument, is straightforward, and is what I begin with. Completeness is some-thing else altogether. For that I use the ideas developed simultaneously in (Taka-hashi 1967, Prawitz 1968), where they were applied to give a non-constructiveproof of a cut elimination theorem.

4.1 Soundness

Soundness means that any sentence having a tableau proof must be valid.Tableau soundness arguments follow the same pattern for all logics: some no-tion of satisfiability is defined for tableaus; then satisfiability is shown to bepreserved by each tableau rule application. Note that in the following, L+(C)is used rather than L(C), because formulas of the larger language L+(C) canoccur in tableaus.

Definition 4.1.1 [Tableau Satisfiability] A tableau branch is satisfiable if theset of formulas on it is satisfiable in an unrestricted Henkin model for L+(C)(see Definition 2.5.9). A tableau is satisfiable if some branch is satisfiable.

Now, two key facts about these notions easily give us soundness. For the first,a closed tableau branch contains some formula and its negation, hence cannotbe satisfiable. Since a closed tableau has every branch closed, we immediatelyhave the following.

Lemma 4.1.2 A closed tableau cannot be satisfiable.

The second key fact takes more work to prove, but the work is spread overseveral cases, each of which is rather simple.

39

CHAPTER 4. SOUNDNESS AND COMPLETENESS 40

Lemma 4.1.3 If a branch extension rule is applied to a satisfiable tableau, theresult is another satisfiable tableau.

Proof Suppose T is a satisfiable tableau. Then it has some satisfiable branch,say B. Also suppose some branch extension rule is applied to T to produce anew tableau, T ′. It must be shown that T ′ is satisfiable.

The rule that was applied to turn T into T ′ may have been applied on abranch other than B. In this case B is still a branch of T ′, and of course is stillsatisfiable, so T ′ is satisfiable. Now, for the rest of the proof assume a branchextension rule has been applied to satisfiable branch B itself. And to be specific,say all the grounded formulas on B are true in the unrestricted Henkin model〈M,A〉 with respect to the valuation v, where M = 〈H, I, E〉.

There are several cases, depending on which branch extension rule was ap-plied. I consider only a few of these cases and leave the rest to you.

Disjunction Suppose the grounded formula X ∨ Y occurred on B and a rulewas applied to it. Then in T ′ the branch B has been replaced with twobranches: B lengthened with X, and B lengthened with Y . All formulason B are true in 〈M,A〉 with respect to valuation v, henceM °v,A X∨Y .Then either M °v,A X or M °v,A Y . In the first case, all members of Blengthened with X, and in the second case, all members of B lengthenedwith Y , are true in 〈M,A〉 with respect to v. Either way, some branch ofT ′ is satisfiable.

Existential Quantifier Suppose the grounded formula (∃α)Φ(α) occurred onB and a rule was applied to it, so that in T ′ branch B has been lengthenedwith Φ(p) where p is a parameter new to B, of the same type as α.

Since all formulas on B are true in 〈M,A〉 with respect to v, M °v,A(∃α)Φ(α). Then, by definition of truth in a model, there must be some α-variant w of v such that M °w,A Φ(α). Let σ = p/α—the substitutionthat replaces p by α—and consider the valuation wσ (Definition 2.5.6).I claim all formulas on B extended with Φ(p) are true in 〈M,A〉 withrespect to wσ, so the extended branch is satisfiable.

First of all, v and w agree on all variables except α. It is easy to see thatw and wσ agree on all variables except p, so the only variables on which vand wσ can differ are α and p. But α does not occur free in any formulaon B, since these formulas are all grounded. And p does not occur either,since p was new to the branch. Consequently all formulas on B are truein 〈M,A〉 with respect to wσ, by Proposition 2.6.1.

Finally, note that since p did not occur in (∃α)Φ(α), then Φ(α) = Φ(p)σ.We have M °w,A Φ(α), and by Proposition 2.6.4

M °w,A Φ(α) ⇔ M °w,A Φ(p)σ⇔ M °wσ,A Φ(p).

This completes the argument for the existential case.


Abstraction Suppose the grounded formula

〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn)

occurred on B, and a rule was applied to it, so that in T ′ branch B hasbeen lengthened with Φ(τ1, . . . , τn). We are assuming that the formulason B are all true in 〈M,A〉 with respect to valuation v. I will show thatthis extends to include Φ(τ1, . . . , τn) as well.

Let σ = α1/τ1, . . . , αn/τn. This substitution is free for Φ(α1, . . . , αn)because τ1, . . . , τn must be grounded, and parameters are never quantifiedor lambda-bound. Now consider the valuation vσ. Note the followinguseful items.

1. vσ(αi) = (v ∗ I ∗ A)(αiσ) = (v ∗ I ∗ A)(τi)

2. If β is different from α1, . . . , αn, vσ(β) = (v ∗ I ∗ A)(βσ) = (v ∗ I ∗A)(β) = v(β).

Since 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) is on B, we have

M °v,A 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn).

For this to be the case

〈(v ∗ I ∗ A)(τ1), . . . , (v ∗ I ∗ A)(τn)〉 ∈E((v ∗ I ∗ A)(〈λα1, . . . , αn.Φ(α1, . . . , αn)〉)).

Since we have an unrestricted Henkin model, A is proper, so

E((v ∗ I ∗ A)(〈λα1, . . . , αn.Φ(α1, . . . , αn)〉)) =〈w(α1), . . . , w(αn)〉 | w is an α1, . . . , αn-variant of vand M °w,A Φ(α1, . . . , αn)

and consequently M °w,A Φ(α1, . . . , αn) where w is the α1, . . . , αn-variant of v such that w(α1) = (v∗I ∗A)(τ1), . . . , w(αn) = (v∗I ∗A)(τn).But, by items 1 and 2 above, vσ itself is this α1, . . . , αn-variant of v. Wethus have

M °vσ,A Φ(α1, . . . , αn).

Now, by Proposition 2.6.4,

M °v,A Φ(α1, . . . , αn)σ,

that is,

M °v,A Φ(τ1, . . . , τn).

There are other cases—I leave them to you.


Theorem 4.1.4 (Soundness) If a sentence Φ of L(C) has a tableau proof, Φmust be true in all unrestricted Henkin models with respect to L(C).

Proof Suppose Φ has a tableau proof, but is not true in all unrestricted Henkinmodels with respect to L(C)—I derive a contradiction. Since Φ is not truein all unrestricted Henkin models with respect to L(C), ¬Φ is satisfiable,and by Proposition 2.6.5, is so in an unrestricted Henkin model with respectto L+(C). A tableau proof of Φ begins with a tableau consisting of a singlebranch, containing the single formula ¬Φ, so this must be a satisfiable tableau.As we apply branch extension rules, we continue to get satisfiable tableaus,by Lemma 4.1.3. Since Φ is provable, we must get a closed tableau. Hencethere must be a closed, satisfiable tableau, which is impossible according toLemma 4.1.2.

Essentially the same argument also establishes the following.

Theorem 4.1.5 Let S be a set of sentences and Φ be a single sentence ofL(C). If Φ has a tableau derivation from S, then Φ is an unrestricted Henkinconsequence of S.

4.2 Completeness

The proof of completeness, for basic tableaus, with respect to unrestrictedHenkin models, is of considerable intricacy. It is spread over several subsec-tions, each devoted to a single aspect of it. All the basic ideas go back to(Takahashi 1967, Prawitz 1968), where they were used to non-constructively es-tablish a cut-elimination theorem for higher-order Gentzen systems. I also useaspects of the (second-order) presentation of (Toledo 1975), in particular thecentral goal, for us, is to prove that something called a Hintikka set is satisfi-able. This contains the essence of the proofs of (Takahashi 1967, Prawitz 1968).(Andrews 1971) abstracted the Takahashi, Prawitz ideas to prove a higher-orderModel Existence Theorem which could have been appealed to, but the ideas ofthe completeness proof are pretty and deserve to be better known, hence thefull presentation.

In outline, the completeness proof is as follows. In Section 4.2.1 the notion ofa Hintikka set is defined: a set of grounded formulas of L+(C) meeting certainclosure conditions. These closure conditions bear an obvious relationship to thetableau rules. In Section 4.2.2 pseudo-models are introduced. These are theclosest we come, in higher-order logic, to the Herbrand models familiar in thefirst-order setting. Unfortunately, they are not true models in the higher-ordersense, because objects assigned as meanings for predicate abstracts might lieoutside the range allowed for quantifiers. In Section 4.2.3 some rather technical(but important) results about the behavior of substitution in pseudo-models areshown. In Section 4.2.4 it is established that each Hintikka set is satisfiable insome pseudo-model. Section 4.2.5 shows that pseudo-models can be convertedinto true unrestricted Henkin models, and so each Hintikka set is satisfiable in


such a model. Finally in Section 4.2.6 it is shown how to extract a Hintikka setfrom a failed tableau proof attempt, and this puts the last step in place for thecompleteness proof.

4.2.1 Hintikka Sets

Hintikka sets are fairly familiar from propositional and first-order logics—see(Fitting 1996) and (Smullyan 1968) for instance. They play a similar role in thehigher-order case, though arguments about them are much more complex. Youshould note that the basic tableau rules all correspond directly to Hintikka setconditions (I omit the connective ≡ as a small convenience).

Definition 4.2.1 [Hintikka Set] A non-empty set H of grounded formulas ofL+(C) is a Hintikka set if it meets the following conditions.

1. Atomic Case. If Φ is atomic, not both Φ ∈ H and ¬Φ ∈ H.

2. Conjunctive Cases.

(a) If (Φ ∧Ψ) ∈ H then Φ ∈ H and Ψ ∈ H.(b) If ¬(Φ ∨Ψ) ∈ H then ¬Φ ∈ H and ¬Ψ ∈ H.(c) If ¬(Φ ⊃ Ψ) ∈ H then Φ ∈ H and ¬Ψ ∈ H.

3. Disjunctive Cases.

(a) If (Φ ∨Ψ) ∈ H then either Φ ∈ H or Ψ ∈ H.(b) If ¬(Φ ∧Ψ) ∈ H then either ¬Φ ∈ H or ¬Ψ ∈ H.(c) If (Φ ⊃ Ψ) ∈ H then either ¬Φ ∈ H or Ψ ∈ H.

4. Double Negation Case. If ¬¬Φ ∈ H then Φ ∈ H.

5. Universal Cases.

(a) If (∀αt)Φ(αt) ∈ H then Φ(τ t) ∈ H for every grounded term τ t.(b) If ¬(∃αt)Φ(αt) ∈ H then ¬Φ(τ t) ∈ H for every grounded term τ t.

6. Existential Cases.

(a) If (∃αt)Φ(αt) ∈ H then Φ(pt) ∈ H for at least one parameter pt.(b) If ¬(∀αt)Φ(αt) ∈ H then ¬Φ(pt) ∈ H for at least one parameter pt.

7. Abstraction Cases.

(a) If 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) ∈ H, thenΦ(τ1, . . . , τn) ∈ H.

(b) If ¬〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) ∈ H, then¬Φ(τ1, . . . , τn) ∈ H.

This completes the definition of Hintikka sets. The task of relating them tomodels begins in the next subsection.


4.2.2 Pseudo-Models

The eventual goal is to construct an unrestricted Henkin model, starting with aHintikka set. To do this a pseudo-model is first created, something that is muchlike an unrestricted Henkin model but with some significant differences. Oneclear difference is in the treatment of predicate abstracts; they will be allowed totake on values that may lie outside the range of the quantifiers! This will poseno problems for the definition of truth in a pseudo-model since, for example,τ1(τ2) can still be taken to be true if the value assigned to τ2 is in the extensionof the value assigned to τ1, whether or not the value of τ1 is in quantifier range.Eventually, of course, it will be shown that we can dispose of the “pseudo” partof a pseudo-model.

We begin by defining entities of each type. These are the things that canserve as values of predicate abstracts. In some ways the collection of entities isan analog of a Herbrand universe, familiar from treatments of first-order logic.

Definition 4.2.2 [Entities of type t, Extension] The notion of entity of type tis defined inductively, on the complexity of t.

1. Suppose t = 0. If τ is a grounded term of type t (thus a constant orparameter of type 0), τ is an entity of type t.

2. Suppose t = 〈t1, . . . , tn〉 and the collection of entities of type ti has beendefined for each i = 1, . . . , n. Then 〈τ, S〉 is an entity of type t, providedτ is a grounded term of type t, and S is a set whose members are of theform 〈E1, . . . , En〉, where each Ei is an entity of type ti.

Define an extension mapping on entities of types other than 0 by setting E(〈τ, S〉)= S, and refer to S as the extension of entity 〈τ, S〉.

The idea is, if 〈τ, S〉 is an entity of type t, it is something that could serveas a semantic value for the term τ , with the extension explicitly coded in.One problem with entities as just defined is that Hintikka sets play no role—the collection of entities is the same no matter what Hintikka set we may have.Presumably, if we are trying to construct a model from a given Hintikka set, thatshould place some restrictions on what entities we want to consider. The nextdefinition separates out those entities that will be in the range of quantifiers—itmakes direct use of a Hintikka set. Eventually it is these entities that will makeup the Henkin domains of a model.

Definition 4.2.3 [Possible Value] Let H be a Hintikka set. For each groundedterm τ , define a collection of possible values relative to H. This is done induc-tively, on type complexity.

1. If τ is a grounded term of type 0, the only possible value of τ relative toH is τ itself.

2. Suppose τ is a grounded term of type 〈t1, . . . , tn〉, and possible valuesrelative to H have been specified for all grounded terms of types t1, . . . ,


tn. Then, an entity 〈τ, S〉 is a possible value of τ relative to H provided,for all grounded terms τ1, . . . , τn of types t1, . . . , tn respectively, and forall possible values E1, . . . , En of τ1, . . . , τn:

(a) If τ(τ1, . . . , τn) ∈ H then 〈E1, . . . , En〉 ∈ S.

(b) If ¬τ(τ1, . . . , τn) ∈ H then 〈E1, . . . , En〉 6∈ S.

E is a possible value if it is a possible value for some grounded term.

Roughly the idea is, any possible value for τ should have in its extension allthose things the Hintikka set H requires, and should omit all the things Hforbids. Any entity that meets these conditions will serve as a possible value.Clearly, each possible value of a grounded term of type t, relative to a Hintikkaset H, is an entity of type t. Item 1 of the definition of Hintikka set is neededfor part 2 above to be meaningful.

Valuations were defined earlier, in unrestricted Henkin models. That termi-nology is extended to pseudo-models as well. Note that arbitrary entities areallowed and not just possible values.

Definition 4.2.4 [Valuation] A mapping v from variables and parameters toentities is a valuation provided it assigns to each variable or parameter of typet some entity of type t.

The languages L(C) and L+(C) are allowed to contain constant symbols.How to interpret these is essentially arbitrary, within broad limits.

Definition 4.2.5 [Allowed Interpretation] Let H be a Hintikka set. A mappingI is an allowed interpretation relative to H provided I assigns to each constantsymbol A of type t some possible value for A, relative to H.

Grounded terms have entities associated with them. We also need somemachinery for going the other way, from entities back to grounded terms.

Definition 4.2.6 [T and ←−v ] A mapping T from entities E to grounded termsis defined as follows. If E is of type 0 it is, itself, a grounded term of L+(C); inthis case T (E) = E. If E is of type 〈t1, . . . , tn〉 it is of the form 〈τ, S〉; in thiscase T (E) = τ .

Next, let v be a valuation. Define a substitution ←−v as follows: α←−v =T (v(α)).

Note that ←−v substitutes grounded terms of L+(C) for variables, and so if τ isan arbitrary term, τ←−v must be a grounded term, and similarly for formulas.Then, for any formula Φ and any valuation v, Φ←−v is something that could bea member of a Hintikka set.

The next bit of business is to assign truth values to formulas, and entitiesto predicate abstracts—this is the fundamental construction. It is done via aninductive definition on formulas and terms.


Definition 4.2.7 [Pseudo-Model] Let H be a Hintikka set and let I be anallowed interpretation relative to H. For each valuation v, define another map-ping denoted by vH,I—and call vH,I a pseudo-model. The mapping vH,I mapsformulas of L+(C) to truth values true and false, and maps terms to entities.

Atomic vH,I(τ(τ1, . . . , τn)) = true if 〈vH,I(τ1), . . . , vH,I(τn)〉 ∈ E(vH,I(τ)),and otherwise vH,I(τ(τ1, . . . , τn)) = false.

Negation vH,I(¬X) = false if vH,I(X) = true and vH,I(¬X) = true if vH,I(X)= false.

Conjunction vH,I(X ∧ Y ) = true if vH,I(X) = true and vH,I(Y ) = true;otherwise vH,I(X ∧Y ) = false. (The other propositional cases are similar,and are omitted.)

Universal Quantification vH,I((∀α)Φ) = true if wH,I(Φ) = true for everyvaluation w that is an α-variant of v, and that assigns to α some possiblevalue relative to H. Otherwise vH,I((∀α)Φ) = false. (The existential caseis similar, and is omitted.)

Constant Symbols, Variables, Parameters vH,I(τ) = I(τ) if τ is a con-stant symbol. If τ is a a variable or a parameter, vH,I(τ) = v(τ).

Predicate Abstract If τ is the term 〈λα1, . . . , αn.Φ〉, set vH,I(τ) = 〈τ←−v , S〉where

S = 〈w(α1), . . . , w(αn)〉 | wH,I(Φ) = truewhere w is an α1, . . . , αn variant of v.

In the definition above, the quantification clause, in effect, says quantifiersare thought of as ranging over possible values, and not over arbitrary entities.On the other hand, values assigned to predicate abstracts can be entities thatmight not be possible values.

In the next subsection some significant technical facts about pseudo-modelsare shown. Once these are out of the way, it will be possible to extract a properunrestricted Henkin model from a pseudo-model.

Exercises

Exercise 4.2.1 Show that if entity E is a possible value, then E must be apossible value of T (E).

4.2.3 Substitution and Pseudo-Models

Pseudo-models are strange, hybrid, things, because of the mix of arbitrary en-tities and allowed values in interpreting quantifiers and predicate abstracts. Inthis subsection valuations and substitutions are shown to be well-behaved with


respect to pseudo-models. The proofs are rather technical, so I begin with thestatements of the two Propositions to be established, after which their proofsare given, broken into a number of Lemmas. On a first reading you might wantto just read the Propositions and skip over the proofs.

The first item should be compared with Proposition 2.6.1.

Proposition 4.2.8 Let H be a Hintikka set and let I be an allowed interpre-tation relative to H. Also, let v and v′ be two valuations, and let X be eithera term or a formula of L+(C). If v and v′ agree on the free variables andparameters of X then vH,I(X) = v′H,I(X).

The second item is an analog to Propositions 2.6.2 and 2.6.4. Of courseDefinition 2.5.6 must be modified to adapt it to present circumstances, sincethere is no explicit abstraction designation function in a pseudo-model.

Definition 4.2.9 Let v be a valuation, and vH,I be a pseudo-model. For asubstitution σ, by vσ now is meant the valuation given by vσ(α) = vH,I(ασ),where α is a variable or parameter.

Thus vσ(α) gives us the denotation of the term ασ in the pseudo-model vH,I .

Proposition 4.2.10 Let v be a valuation, and vH,I be a pseudo-model. For asubstitution σ, if σ is free for X, then vH,I(Xσ) = vσH,I(X) for every formulaand term X.

Now I turn to the proofs, which are given in considerable detail since theseresults are critical to the completeness argument, and I want the reasoning onrecord. On a first reading, skip the proofs and move on to the next section.

Proof of 4.2.8 Suppose the result is known for terms and formulas whose de-gree is < k. I show the result is also true for those of degree k itself, beginningwith terms.

Assume τ is a term of degree k, and v and v′ agree on the free variablesand parameters of τ . If k happens to be 0, τ is a constant symbol, variable, orparameter. In these cases the result is immediate.

Now suppose k 6= 0, and so τ = 〈λα1, . . . , αn.Φ〉, where Φ is of degree < k.Let us say vH,I(〈λα1, . . . , αn.Φ〉) = 〈a, S〉 and v′H,I(〈λα1, . . . , αn.Φ〉) = 〈a′, S′〉.We must show a = a′ and S = S′.

Suppose α is a variable or parameter that occurs free in τ . Then α←−v =T (v(α)) = T (v′(α)) = α

←−v′ , using the assumption that v and v′ must agree on

α. By definition, a = τ←−v and a′ = τ←−v′ , and ←−v and

←−v′ agree on the free

variables of τ , so a = a′ by Proposition 1.2.5.Next, suppose 〈E1, . . . , En〉 ∈ S. We must have wH,I(Φ) = true where w

is the α1, . . . , αn variant of v such that w(α1) = E1, . . . , w(αn) = En. Letw′ be the same as v′ except that w′(α1) = E1, . . . , w′(αn) = En. Since vand w agree on the free variables and parameters of 〈λα1, . . . , αn.Φ〉, then v′

and w′ must agree on the free variables and parameters of Φ. Then by the


induction hypothesis, w′H,I(Φ) = true, and it follows that 〈E1, . . . , En〉 ∈ S′.Thus S ⊆ S′. A similar argument shows S′ ⊆ S.

This completes the induction step for terms, and I turn next to formulas.Suppose Φ is of degree k and v and v′ agree on the free variables and parametersof Φ. By the induction hypothesis, we have the Proposition for terms andformulas of degree < k, and by what was just shown, we also have it for termsof degree k itself. Now we have several cases.

Suppose Φ is atomic, τ0(τ1, . . . , τn), where each τi must be of degree ≤ k.Then, using the induction hypothesis,

vH,I(τ0(τ1, . . . , τn)) = true ⇔ 〈vH,I(τ1), . . . , vH,I(τn)〉 ∈ E(vH,I(τ0))⇔ 〈v′H,I(τ1), . . . , v′H,I(τn)〉 ∈ E(v′H,I(τ0))⇔ v′H,I(τ0(τ1, . . . , τn)) = true.

The various non-atomic cases are left to you.

Next we have several preliminary results, leading up to the proof of Propo-sition 4.2.10.

Lemma 4.2.11 Let H be a Hintikka set, let I be an allowed interpretationrelative to H, and let v be a valuation. Also, suppose the substitution σ is freefor 〈λα1, . . . , αn.Φ〉, and further that σ is the identity map on parameters andvariables that do not occur free in 〈λα1, . . . , αn.Φ〉.

1. If w is an α1, . . . , αn variant of v then wσα1,... ,αn is an α1, . . . , αn variantof vσ.

2. Conversely, if u is an α1, . . . , αn variant of vσ then u = wσα1,... ,αn forsome α1, . . . , αn variant w of v.

3. vσα1,... ,αn (αi) = v(αi), for i = 1, . . . , n.

Proof Part 1. Suppose w is an α1, . . . , αn variant of v. Let β be a variable orparameter other than α1, . . . , αn. It must be shown that wσα1,... ,αn (β) = vσ(β).Here are the steps; the reasons follow.

wσα1,... ,αn (β) = wH,I(βσα1,... ,αn) (4.1)= wH,I(βσ) (4.2)= vH,I(βσ) (4.3)= vσ(β) (4.4)

Above, (4.1) is by Definition 4.2.9 for wσα1,... ,αn , and (4.2) is because β isdifferent from α1, . . . , αn. Also (4.4) follows from (4.3) by Definition 4.2.9again, for vσ. The key item is getting (4.3) from (4.2), and for this it is enoughto show v and w agree on the free variables and parameters of βσ, and thenappeal to Proposition 4.2.8. The argument for this follows.


If β does not occur free in 〈λα1, . . . , αn.Φ〉, βσ = β by hypothesis, we areassuming β is different from α1, . . . , αn, and v and w agree on all variables ex-cept α1, . . . , αn, so v and w trivially agree on the free variables and parametersof βσ in this case.

Now suppose β does occur free in 〈λα1, . . . , αn.Φ〉. Since σ is free for〈λα1, . . . , αn.Φ〉, βσ cannot contain any of α1, . . . , αn free. Once again vand w must agree on the free variables and parameters of βσ, since v and w canonly differ on α1, . . . , αn.

Part 2. Suppose u is an α1, . . . , αn variant of vσ. Define a valuation w asfollows.

w(αi) = u(αi) i = 1, . . . , nw(β) = v(β) β 6= α1, . . . , αn

By definition, w is an α1, . . . , αn variant of v. I will show wσα1,... ,αn = u. Theargument is in two parts.

wσα1,... ,αn (αi) = wH,I(αiσα1,... ,αn) (4.5)= wH,I(αi) (4.6)= w(αi) (4.7)= u(αi) (4.8)

In this, (4.5) is by definition of wσα1,... ,αn . Then (4.6) is because σα1,... ,αn isthe identity on αi. Next, (4.7) is because αi is a variable, and finally (4.8) is bydefinition of w.

Now suppose β 6= α1, . . . , αn.

wσα1,... ,αn (β) = wH,I(βσα1,... ,αn) (4.9)= wH,I(βσ) (4.10)= vH,I(βσ) (4.11)= vσ(β) (4.12)= u(β) (4.13)

Here (4.9) is by definition of wσα1,... ,αn . Then (4.10) is by definition of σα1,... ,αn .Next, (4.11) follows exactly as (4.3) did above. Finally (4.12) is by definition ofvσ, and (4.13) is because u and vσ are α1, . . . , αn variants.

Part 3. vσα1,... ,αn (αi) = vH,I(αiσα1,... ,αn) = vH,I(αi) = v(αi).

Lemma 4.2.12 Let vH,I be a pseudo-model. For any term τ of L+(C), τ←−v =T (vH,I(τ)).

Proof Suppose first that τ is a predicate abstract. Then by Definition 4.2.7,vH,I(τ) = 〈τ←−v , S〉 for a particular set S, and so T (vH,I(τ)) = τ←−v . If τ is avariable or parameter, τ←−v = T (v(τ)) by definition of ←−v , and v(τ) = vH,I(τ)by definition of vH,I again, for variables. Finally, the case of τ being a constantsymbol is straightforward.


The next two Lemmas will give us the induction steps of the main item weare after. In the interests of simple notation I have written vσH,I in place of(vσ)H,I .

Lemma 4.2.13 Let H be a Hintikka set and let I be an allowed interpretationrelative to H. Assume that if σ is free for X, then

vH,I(Xσ) = vσH,I(X) (4.14)

for each formula X of degree < k. Then (4.14) also holds for each term X ofdegree k itself.

Proof Assume the hypothesis, and suppose τ is a term of degree k. If k is 0,τ must be a constant symbol, a variable, or a parameter. If it is a variable orparameter, say α, then vσH,I(α) = vσ(α); and this, in turn, is vH,I(ασ), usingthe definition of vσ. The case of a constant symbol is trivial.

Now suppose k > 0, and so τ must be of the form 〈λα1, . . . , αn.Φ〉, whereΦ is a formula whose degree is < k. And suppose σ is free for 〈λα1, . . . , αn.Φ〉.Using the definition of substitution and Definition 4.2.7:

vH,I(〈λα1, . . . , αn.Φ〉σ) = vH,I(〈λα1, . . . , αn.Φσα1,... ,αn〉)= 〈a, S〉

where

a = 〈λα1, . . . , αn.Φσα1,... ,αn〉←−vS = 〈w(α1), . . . , w(αn)〉 | wH,I(Φσα1,... ,αn) = true

where w is an α1, . . . , αn variant of v.

Similarly:

vσH,I(〈λα1, . . . , αn.Φ〉) = 〈a′, S′〉

where

a′ = 〈λα1, . . . , αn.Φ〉←−vσ

S′ = 〈u(α1), . . . , u(αn)〉 | uH,I(Φ) = truewhere u is an α1, . . . , αn variant of vσ.

So, we must show a = a′ and S = S′.

Part 1, a = a′.


First of all,

a = 〈λα1, . . . , αn.Φσα1,... ,αn〉←−v= (〈λα1, . . . , αn.Φ〉)σ)←−v (4.15)= 〈λα1, . . . , αn.Φ〉(σ←−v ) (4.16)

In this, (4.15) is by definition of substitution. (Recall we are assuming that σ isfree for 〈λα1, . . . , αn.Φ〉.) Also, since ←−v replaces variables by grounded terms,and parameters are never bound, substitution ←−v is free for 〈λα1, . . . , αn.Φ〉σ.Then (4.16) follows by Theorem 1.2.7.

Then to show a = a′ it is enough to show the substitutions σ←−v and ←−vσ arethe same. Let β be a variable or parameter. β(σ←−v ) = (βσ)←−v by definitionof composition for substitutions. And, using Definitions 4.2.6 and 4.2.9, β←−vσ =T (vσ(β)) = T (vH,I(βσ)). Finally, (βσ)←−v and T (vH,I(βσ)) are the same, byLemma 4.2.12.

We thus have shown that a = a′.

Part 2, S = S′.Using Proposition 1.2.5 it can be assumed that σ is the identity on variables

and parameters that do not occur free in 〈λα1, . . . , αn.Φ〉.

S = 〈w(α1), . . . , w(αn)〉 | wH,I(Φσα1,... ,αn) = truewhere w is an α1, . . . , αn variant of v

= 〈w(α1), . . . , w(αn)〉 | wσα1,... ,αnH,I (Φ) = true (4.17)

where w is an α1, . . . , αn variant of v= 〈wσα1,... ,αn (α1), . . . , wσα1,... ,αn (αn)〉 | (4.18)

wσα1,... ,αnH,I (Φ) = true

where w is an α1, . . . , αn variant of v= 〈u(α1), . . . , u(αn)〉 | uH,I(Φ) = true (4.19)

where u is an α1, . . . , αn variant of vσ.

Since σ is free for 〈λα1, . . . , αn.Φ〉, by Definition 1.2.6, σα1,... ,αn must be freefor Φ. And since Φ must be of degree < k, we have (4.17) by the hypothesis ofthe Lemma. Then (4.18) is by part 3 of Lemma 4.2.11. Finally, (4.19) followsby parts 1 and 2 of Lemma 4.2.11

Lemma 4.2.14 Let H be a Hintikka set and let I be an allowed interpretationrelative to H. Assume that if σ is free for X, then

vH,I(Xσ) = vσH,I(X) (4.20)

for each formula X of degree < k and each term X of degree ≤ k. Then (4.20)also holds for each formula X of degree k itself.


Proof Assume the hypothesis. Suppose Φ is a formula of degree k. There areseveral cases depending on the form of Φ.

If Φ is of the form τ(τ1, . . . , τn), each of τ , τ1, . . . , τn must be of degree≤ n. Then, using the hypothesis about terms,

vH,I(Φσ) = true ⇔ vH,I((τ(τ1, . . . , τn))σ) = true⇔ vH,I(τσ(τ1σ, . . . , τnσ)) = true⇔ 〈vH,I(τ1σ), . . . , vH,I(τnσ)〉 ∈ E(vH,I(τσ))⇔ 〈vσH,I(τ1), . . . , vσH,I(τn)〉 ∈ E(vσH,I(τ))⇔ vσH,I(τ(τ1, . . . , τn)) = true⇔ vσH,I(Φ) = true

Next, if Φ is a propositional combination of simpler formulas, the argument isstraightforward using the hypothesis about formulas, and is left to you. Finally,if Φ is of the form (∀α)Ψ the argument, in outline, is as follows.

vH,I([(∀α)Ψ]σ) = true ⇔ vH,I((∀α)[Ψσα]) = true⇔ wH,I(Ψσα) = true for every

valuation w that is an α-variantof v where w(α) is a possiblevalue relative to H (4.21)

⇔ wσαH,I(Ψ) = true for everyvaluation w that is an α-variantof v where w(α) is a possiblevalue relative to H (4.22)

⇔ uH,I(Ψ) = true for everyvaluation u that is an α-variantof vσ where u(α) is a possiblevalue relative to H (4.23)

⇔ vσH,I((∀α)Ψ) = true

In this, the equivalence of (4.21) and (4.22) is by the hypothesis about formulas,and the equivalence of (4.22) and (4.23) is by a result similar to that stated inLemma 4.2.11, but for quantified formulas rather than for predicate abstracts.

Finally, the central item we have been aiming at.

Proof of 4.2.10 The proof, of course, is by induction on the degree of X.Suppose the result is known for formulas and terms of degree < k. Then byLemma 4.2.13 the result holds for terms of degree k, and then by Lemma 4.2.14it holds for formulas of degree k as well.


4.2.4 Hintikka Sets and Pseudo-Models

Given a Hintikka set, we know how to create a pseudo-model from it. It wouldbe nice if the various formulas in the Hintikka set turned out to map to truein that pseudo-model. This turns out to be the case, and will be shown below.But there is a troublesome feature of the definition of pseudo-model: quantifiersrange over possible values, but predicate abstracts can have general entitiesas values. It would also be nice if the values assigned to predicate abstractsturned out to be possible values after all. This too happens to be the case, andwill also be shown below. In fact, both of the things we desire will be shownsimultaneously, in one big result. Then we can conclude that each Hintikka setis satisfiable in a well behaved pseudo-model.

Definition 4.2.15 [Allowed Valuation] Let H be a Hintikka set. Call a valua-tion v allowed relative to H if, for each variable or parameter α, v(α) is somepossible value, relative to H.

Theorem 4.2.16 Let H be a Hintikka set, let I be an allowed interpretation,and let v be an allowed valuation, relative to H.

1. For each term τ of L+(C), vH,I(τ) is a possible value for τ←−v , relative toH.

2. For each formula Φ of L+(C), if Φ←−v ∈ H then vH,I(Φ) = true.

Proof Both parts of the theorem are shown by a simultaneous induction ondegree. Assume they hold for formulas and terms of degree < k. It will first beshown that item 1 holds for terms of degree k; then it will be shown that item 2holds for formulas of degree k.

Part 1. Let τ be a term of degree k. If k happens to be 0, τ is a constantsymbol, variable, or parameter. If τ is a constant symbol A, A←−v = A, andvH,I(A) = I(A), which is a possible value of A because I is an allowed inter-pretation. If τ is a variable or parameter, α, vH,I(α) = v(α) is some possiblevalue E because v is an allowed valuation. But then α←−v = T (v(α)) = T (E),and E is a possible value of T (E) by Exercise 4.2.1.

Now suppose τ = 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉. Then vH,I(τ) = 〈τ←−v , S〉where S = 〈w(α1), . . . , w(αn)〉 | wH,I(Φ) = true where w is an α1, . . . , αnvariant of v. I show 〈τ←−v , S〉 is a possible value of τ←−v relative to H. To dothis I must show that if E1 is a possible value for τ1, . . . , En is a possible valuefor τn, then

1. (τ←−v )(τ1, . . . , τn) ∈ H implies 〈E1, . . . , En〉 ∈ S;

2. ¬(τ←−v )(τ1, . . . , τn) ∈ H implies 〈E1, . . . , En〉 6∈ S.

I show the first of these; the second is similar.Assume (τ←−v )(τ1, . . . , τn) ∈ H. That is,

[〈λα1, . . . , αn.Φ(α1, . . . , αn)〉←−v ](τ1, . . . , τn) ∈ H.


By definition of substitution we have

〈λα1, . . . , αn.[Φ←−v α1,... ,αn ](α1, . . . , αn)〉(τ1, . . . , τn) ∈ H.

Since H is a Hintikka set, we also have

[Φ←−v α1,... ,αn ](τ1, . . . , τn) ∈ H

and since τ1, . . . , τn are grounded terms and so have no free occurrences of α1,. . . , αn

[Φ(τ1, . . . , τn)]←−v ∈ H.

Now, let w be the α1, . . . , αn-variant of v such that w(α1) = E1, . . . , w(αn) =En. Since Ei is a possible value for the grounded term τi it follows that αi←−w =τi. And if β 6= α1, . . . , αn then β←−w = β←−v . Then it follows that

[Φ(α1, . . . , αn)]←−w ∈ H.

Since Φ(α1, . . . , αn) must be of lower degree than k the induction hypothesisapplies, and

wH,I(Φ(α1, . . . , αn)) = true.

Then 〈w(α1), . . . , w(αn)〉 ∈ S, so 〈E1, . . . , En〉 ∈ S, which is what we wanted.This concludes the induction step for terms.

Part 2. Let Φ be a formula of degree k. By the induction hypothesis, theresult holds for formulas and terms of degree < k, and by part 1 it also holdsfor terms of degree k. Now we have several cases, depending on the form of Φ.I only present a few of them.

Suppose Φ is τ0(τ1, . . . , τn) and [τ0(τ1, . . . , τn)]←−v ∈ H. That is,

τ0←−v (τ1←−v , . . . , τn←−v ) ∈ H.

Each τi is of degree ≤ k so by the induction hypothesis, each vH,I(τi) is apossible value for τi←−v . It follows immediately from the definition of possiblevalue (Definition 4.2.3) that

〈vH,I(τ1), . . . , vH,I(τn)〉 ∈ E(vH,I(τ0))

and so

vH,I(τ0(τ1, . . . , τn) = true.

Suppose Φ is X ∧ Y , and (X ∧ Y )←−v ∈ H. By definition of substitution,(X←−v ∧ Y←−v ) ∈ H. Since H is a Hintikka set, X←−v ∈ H and Y←−v ∈ H. But


each of X and Y is of lower degree than Φ, so by the induction hypothesis,vH,I(X) = true and vH,I(Y ) = true. It follows that vH,I(X ∧ Y ) = true.

Suppose Φ is (∀α)Ψ(α) and [(∀α)Ψ(α)]←−v ∈ H. By definition of substitution,(∀α)[Ψ←−v α](α) ∈ H. Let w be an arbitrary α-variant of v that assigns to α somepossible value, say E, of the same type as α. Since E is a possible value, it isthe possible value of some grounded term, say τ . Now by definition of Hintikkaset, [Ψ←−v α](τ) ∈ H, and so [Ψ(τ)]←−v ∈ H, since τ does not contain α free. Wehave α←−w = τ , and if β 6= α, β←−w = β←−v , so [Ψ(α)]←−w ∈ H. But Ψ(α) is oflower degree than Φ, so by the induction hypothesis, wH,I(Ψ(α)) = true. Sincew was arbitrary, vH,I((∀α)Ψ(α)) = true.

The other cases are similar and are omitted.

Corollary 4.2.17 Let H be a Hintikka set, let I be an allowed interpretation,and let v be an allowed valuation, relative to H. Suppose further that v assignsto each parameter p some possible value for p. Then H is satisfied in the pseudo-model vH,I . That is, if Φ ∈ H then vH,I(Φ) = true.

Proof If v assigns to each parameter p some possible value for p, then p←−v =T (v(p)) = p. Consequently for each grounded formula Φ we have Φ←−v = Φ.The result then follows from the previous Theorem.

4.2.5 Pseudo-Models and Models

So far, a satisfiability result has been shown using pseudo-models. Now it isshown that a pseudo-model can be converted to an actual unrestricted Henkinmodel, and we get a much better version of the satisfiability result as a conse-quence. It starts with the construction of a candidate for an unrestricted Henkinmodel.

Definition 4.2.18 [Constructed Structure] Let H be a Hintikka set and let Ibe an allowed interpretation relative toH. For each type t, setH(t) to be the col-lection of all type t possible values relative to H. An extension function, E , wasdefined for entities in Definition 4.2.2. Then M = 〈H, I, E〉 is an unrestrictedHenkin frame. If v is a valuation inM then v is also an allowed valuation in thesense of Definition 4.2.15. Set A(v, 〈λα1, . . . , αn.Φ〉) = vH,I(〈λα1, . . . , αn.Φ〉).The structure 〈M,A〉 is said to be constructed from H and I.

Theorem 4.2.19 Let H be a Hintikka set and I be an allowed interpretationrelative to H. Let 〈M,A〉 be constructed from H and I.

1. For each term τ of L+(C), (v ∗ I ∗ A)(τ) = vH,I(τ), for any valuation vin M.

2. For each formula Φ of L+(C), M °v,A Φ ⇐⇒ vH,I(Φ) = true, for anyvaluation v in M.

3. The abstraction designation function A is proper, and hence 〈M,A〉 is anunrestricted Henkin model.


Proof Finally we have a simple proof. Part 1 has three cases, in each of which(v ∗ I ∗ A)(τ) and vH,I(τ) agree. If τ is a constant symbol, both functions aredefined to give I(τ). If τ is a variable or parameter, both functions are definedto give v(τ). And finally, if τ is a predicate abstract, (v ∗ I ∗ A)(τ) = A(v, τ)and this is vH,I(τ) by definition.

Part 2 also has several parts. If Φ = τ0(τ1, . . . , τn) is atomic, then using thefirst part,

M °v,A τ0(τ1, . . . , τn) ⇔ 〈(v ∗ I ∗ A)(τ1), . . . , (v ∗ I ∗ A)(τn)〉∈ E((v ∗ I ∗ A)(τ0))

⇔ 〈vH,I(τ1), . . . , vH,I(τn)〉 ∈ E(vH,I(τ0))⇔ vH,I(τ0(τ1, . . . , τn)) = true.

Beyond the atomic level, the argument is by a straightforward induction ondegree, using Definitions 2.5.5 and 4.2.7.

For part 3, there are three items that must be shown, according to Defini-tion 2.5.7.

The first is that E((v ∗ I ∗ A)(〈λα1, . . . , αn.Φ〉)) = 〈w(α1), . . . , w(αn)〉 | wis an α1, . . . , αn variant of v and Γ °w,A Φ. This is immediate from parts 1and 2 and the definition of vH,I on predicate abstracts.

The second is, if v and w agree on the free variables of 〈λα1, . . . , αn.Φ〉then A(v, 〈λα1, . . . , αn.Φ〉) = A(w, 〈λα1, . . . , αn.Φ〉). This follows from thedefinition given for A and Proposition 4.2.8.

The third, and last, item is that if σ is a substitution that is free for theterm 〈λα1, . . . , αn.Φ〉, then A(v, 〈λα1, . . . , αn.Φ〉σ) = A(vσ, 〈λα1, . . . , αn.Φ〉),and this follows using Proposition 4.2.10.

Corollary 4.2.20 Every Hintikka set is satisfiable in an unrestricted Henkinmodel.

Proof By Corollary 4.2.17 and the Theorem above. (Recall, it was shown inSection 2.6 that a choice between L(C) and L+(C) was not significant whenconsidering models for formulas from the language L(C).)

4.2.6 Completeness At Last

Most of the work of showing completeness is over. All that is left is to connectHintikka sets with tableaus. This can be done in either of two ways. One couldgive a systematic tableau construction procedure, designed to ensure everythingthat can be done is eventually done in fact. Then one would show that the setof formulas on an unclosed branch of such a tableau is a Hintikka set. Thisapproach involves considerable attention to detail, and is not what I have chosento do here. The other technique involves maximal consistent sets, much likein the standard axiomatic approach. Things must be adapted to tableaus, ofcourse, but this is the direction I have chosen because it is considerably simpler.


Definition 4.2.21 [Consistency] Call a set S of grounded formulas of L+(C)consistent if no basic tableau beginning with any finite subset of S closes. If Sis not consistent, call it inconsistent.

Thus a set S is inconsistent if there is a closed tableau beginning with somefinite subset.

Definition 4.2.22 [Maximal Consistency] A set S is maximally consistent if itis consistent but no proper extension of it is consistent.

For propositional logic, working with maximal consistent sets is sufficient toprove completeness, but with quantifiers involved, more is needed.

Definition 4.2.23 [E-Complete] A set S of grounded formulas of L+(C) isE-complete if:

1. ¬(∀α)Φ(α) ∈ S implies ¬Φ(p) ∈ S for some parameter p.

2. (∃α)Φ(α) ∈ S implies Φ(p) ∈ S for some parameter p.

It will be shown that lots of maximal consistent, E-complete sets exist, andthey are Hintikka sets. From this, completeness follows easily. The primarydifference between a tableau completeness proof and an axiomatic one is thatwith tableaus, maximal consistency and E-completeness give us the implicationsthat make up the definition of a Hintikka set, while in an axiomatic version, theseimplications become equivalences. The stronger version, in fact, is more than isneeded. But now, to work.

Proposition 4.2.24 If S is a consistent set of closed formulas of L(C), S canbe extended to a maximal consistent, E-complete set of grounded formulas ofL+(C).

Proof The set of formulas of L+(C) is countable; let Ψ1, Ψ2, Ψ3, . . . be anenumeration of all of them. Also, let p1, p2, p3, . . . be an enumeration ofall parameters of L+(C) of all types. Now we construct a sequence of sets offormulas. Each set in the sequence will meet two conditions: it is consistent,and infinitely many parameters of each type do not appear in it. Here is theconstruction.

Let S0 = S. This is consistent by hypothesis, and contains no parametersat all, so both of the conditions are met.

Suppose Sn has been defined, and the conditions are met.

1. If Sn ∪ Ψn+1 is not consistent, let Sn+1 = Sn.

2. If Sn ∪ Ψn+1 is consistent, and Ψn+1 is not an existentially quantifiedformula or the negation of a universally quantified formula, let Sn+1 =Sn ∪ Ψn+1.


3. Finally, if Sn ∪ Ψn+1 is consistent, and Ψn+1 is (∃α)Φ(α), choose thefirst parameter p in the enumeration of parameters, of the same type asα, that does not appear in Sn or in (∃α)Φ(α), and set Sn+1 = Sn ∪(∃α)Φ(α),Φ(p). And similarly if Ψn+1 is ¬(∀α)Φ(α).

Note that Sn+1 meets the conditions again. In case 3, consistency needs a smallargument, which I leave to you.

Finally, let S∞ be S0∪S1∪S2∪ . . . . I leave to you the easy verification thatS∞ will be consistent, E-complete, and maximal.

Proposition 4.2.25 If S is a set of grounded formulas of L+(C) that is max-imal consistent and E-complete, S is a Hintikka set.

Proof Let S satisfy the hypothesis of the Proposition. It is a simple matter toverify that S meets each of the Hintikka set conditions. One is presented as anexample.

Suppose 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) ∈ S, but Φ(τ1, . . . , τn) 6∈S; we derive a contradiction.

If S ∪ Φ(τ1, . . . , τn) were consistent, Φ(τ1, . . . , τn) would be in S, since Sis maximally consistent. Consequently S ∪ Φ(τ1, . . . , τn) is not consistent, sothere is a closed tableau for some finite subset, which must include Φ(τ1, . . . , τn),since S itself is consistent. Thus there are formulas X1, . . . , Xk ∈ S such thatthere is a closed tableau, call it T , beginning with X1, . . . , Xk, Φ(τ1, . . . , τn).Now, 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) ∈ S. Construct a tableau as fol-lows. Begin with

X1 1....

Xk k.〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn) k + 1.Φ(τ1, . . . , τn) k + 2.

In this, the first k + 1 lines are members of S. Line k + 2 is from k + 1 by anabstract rule. Now continue this tableau to closure by copying over the steps oftableau T .

This shows there is a closed tableau for a finite subset of S itself, so S mustbe inconsistent, which is a contradiction.

Now, finally, we get the completeness results.

Theorem 4.2.26 Let Φ be a closed formula and let S be a set of closed formu-las, all of L(C).

1. If Φ is valid in unrestricted Henkin models, Φ has a basic tableau proof.

2. If Φ is an unrestricted Henkin consequence of S, Φ has a basic tableauderivation from S.


Proof Suppose there is no basic tableau derivation of Φ from S. Then thereis no closed tableau for ¬Φ, allowing members of S to be added to the endsof open branches. It follows that S ∪ ¬Φ is consistent. It can be extendedto a maximal consistent, E-complete set H, by Proposition 4.2.24. The set His a Hintikka set, by Proposition 4.2.25. Then by Corollary 4.2.20, S ∪ ¬Φis satisfiable in some unrestricted Henkin model, and consequently Φ is not anunrestricted Henkin consequence of S. This establishes part 2; part 1 has asimpler proof.

4.3 Miscellaneous Model Theory

Two of the main results about first-order logic are the Compactness and theLowenheim-Skolem theorem. I already noted, in Section 2.3, that compactnessdoes not hold for higher-order logic. It is also easy to verify that the Lowenheim-Skolem theorem does not hold, since one can write a formula asserting an un-countable object exists. But things are very different if unrestricted Henkinmodels are used, instead of standard models. Then both theorems hold, justas in the first-order case. Compactness is easy to verify, now that completenesshas been shown. Lowenheim-Skolem takes more work.

Theorem 4.3.1 (Compactness) Let S be a set of closed formulas of L(C).If every finite subset of S is satisfiable in some unrestricted Henkin model, so isS itself.

Proof Suppose S is not satisfiable in any unrestricted Henkin model—I showsome finite subset of S is also not satisfiable.

Let ⊥ abbreviate X ∧ ¬X, where X is some arbitrary closed formula ofL(C). Since S is not satisfiable in any unrestricted Henkin model, ⊥ is true inevery model in which the members of S are true (since there are none), so ⊥is an unrestricted Henkin consequence of S. By Completeness, ⊥ has a basictableau derivation from S. A closed tableau, being a finite object, can use onlya finite subset S0 of S. Now ⊥ has a basic tableau derivation from S0, so bySoundness, ⊥ is an unrestricted Henkin consequence of S0. If S0 were satisfiablein some unrestricted Henkin model, ⊥ would be true in it, which is not possible.Consequently S0 is unsatisfiable.

The Lowenheim-Skolem theorem for first-order classical logic follows easilyfrom the observation that models constructed in completeness proofs are count-able. Unfortunately, this does not apply directly to the unrestricted Henkinmodels constructed using tableaus. The reason is very simple. I showed howto construct an unrestricted Henkin frame M = 〈H, I, E〉 starting with a Hin-tikka set H. In this frame, the Henkin domains consisted of possible values forgrounded terms, Definition 4.2.3. It is easy to see that H(0) must be countable.But say τ is a grounded term of type 〈0〉 such that no formulas of the form τ(τ0)or ¬τ(τ0) occur in H. (This can certainly happen—take the Hintikka set H to


be the empty set!) Then 〈τ, S〉 is a possible value for τ for every subset S ofH(0), so H(〈0〉) is uncountable.

We need some way around this difficulty. The main tool is contained in thefollowing.

Theorem 4.3.2 (Cut-Elimination) Let S be a finite set of grounded formu-las of L+(C). If there is a closed tableau beginning with S ∪ Φ, and a closedtableau beginning with S ∪ ¬Φ, then there is a closed tableau beginning withS.

This Theorem is a version of Gentzen’s famous Haputsatz, or cut eliminationtheorem, for higher-order logic. It is an important result about classical first-order logic that closed tableaus for S∪Φ and for S∪¬Φ can be constructivelyconverted into one for S. There is no constructive proof for the higher-order case,but the result can be obtained provided we are willing to drop constructivity.Such a proof was given in (Prawitz 1968) and in (Takahashi 1967), and theirargument has appeared here, in disguise, as a completeness proof. To finishthings off I sketch the remaining ideas involved in a proof of the Theorem.

Proof Suppose there are closed tableaus for S ∪ Φ and for S ∪ ¬Φ. Thenneither set is satisfiable. It follows that S itself is not satisfiable, for if therewere an unrestricted Henkin model in which its members were true, one of Φor ¬Φ would be true there. It remains to show that the unsatisfiability of Simplies there must be a closed tableau beginning with S.

Suppose the contrary: there is no closed tableau beginning with S, so thatS is a consistent set. Proposition 4.2.24 says a consistent set of L(C) sentencescan be extended to a maximal consistent, E-complete set—the same proof caneasily be made to work even if the set contains parameters, provided it omitsinfinitely many of them. Since S is finite, it certainly omits infinitely manyparameters, so we can extend it to a maximal consistent, E-complete set, whichmust be a Hintikka set. Corollary 4.2.20 says Hintikka sets are satisfiable. SinceS is a subset of a satisfiable set, it too must be satisfiable, but it is not. Thiscontradiction concludes the proof.

This immediately gives us the following important result.

Corollary 4.3.3 (Cut Rule) The addition of the following Cut Rule does notchange the class of provable formulas: at any point, split a branch, and add ¬Φto one side, and Φ to the other, where Φ is any grounded formula.

The way this result is most often used is embodied in the following.

Corollary 4.3.4 If Φ has a tableau proof, Φ can be added as a line to anytableau, without expanding the class of provable formulas.

Proof Suppose Φ has a tableau proof, and so there is a closed tableau for ¬Φ.And now suppose we are constructing another tableau, and we wish to use Φ in


that construction. We can proceed as follows.

...

@

@¬Φ Φ

That is, we have used an application of a cut. Now, on the left branch, introducethe steps appropriate to close it, which exist because we are assuming there isa closed tableau for ¬Φ. This leaves the right branch, and the effect was to addΦ to the tableau.

Now, go back through the proof of completeness given earlier. Proposi-tion 4.2.24 said we could extend a consistent set to a maximal consistent, E-complete one. Using the Lemma above, it follows that a maximal consistent setmust contain either Φ or ¬Φ for every grounded formula Φ. Since this is thecase, each grounded term can, in fact, have only one possible value associatedwith it. Thus the particular model constructed in the completeness argumentmust have countable Henkin domains, since the family of grounded terms foreach type is countable. We thus have the following.

Theorem 4.3.5 (Lowenheim-Skolem) Let S be a set of closed formulas ofL(C). If S is satisfiable in some unrestricted Henkin model, S is satisfiablein an unrestricted Henkin model whose domain function H meets the conditionthat H(t) is countable for every type t.

The results above have both good and bad points. It is obviously good to beable to prove such powerful model-theoretic facts about a logic. The bad side isthat Lindstrom’s Theorem says, since the version of higher-order logic based onunrestricted Henkin models satisfies the theorems above, it is simply an equiv-alent to first-order logic. This does not mean nothing has been gained. Thehigher-order formalism is natural for the expression of things whose translationinto first-order versions would be unnatural. And finally, if a sentence is notprovable, it must have an unrestricted Henkin counter-model, but if it is prov-able, it must be true in all unrestricted Henkin models, and among these are thestandard higher-order models! Thus we have a means of getting at higher-ordervalidities—we just can’t get at all of them this way.

Chapter 5

Equality

The basic tableau rules of Chapter 3 do not give any special role to equality. Itis time to bring it into the picture. This is done by adding axioms to the tableausystem, which has the effect of narrowing things to normal unrestricted Henkinmodels. In addition, some useful derived tableau rules will be presented.

5.1 Adding Equality

Leibniz’s principle is that objects are equal just in case they have the sameproperties. This principle is most easily embodied in axioms, rather than intableau-style rules.

Definition 5.1.1 [Equality Axioms] For each type t, the following sentence isan equality axiom:

(∀αt)(∀βt)[(αt =〈t,t〉 βt) ≡ (∀γ〈t〉)(γ〈t〉(αt) ⊃ γ〈t〉(βt))]

EQ denotes the set of equality axioms.

I will show that a closed formula Φ of L(C) is valid in normal unrestrictedHenkin models if and only if Φ has a tableau derivation from EQ. But beforethat is done I give some handy derived tableau rules, and examples of their use.

5.2 Derived Rules and Tableau Examples

There are two derived rules involving equality that are more “tableau-like” inflavor, and are what I primarily use in constructing tableau proofs and deriva-tions. I do not know if they can serve as full replacements for the official EqualityAxioms, since I have been unable to prove a completeness theorem using them.Nonetheless, the derived rules below are the ones I generally use in practice.

62

CHAPTER 5. EQUALITY 63

Definition 5.2.1 [Derived Reflexivity Rule] For a grounded term τ of L+(C),at any point in a proof (τ = τ) may be added to the end of a tableau branch.Schematically,

(τ = τ)

Justification of Derived Reflexivity Rule Let τ be a grounded term oftype t. (τ = τ) can be added to the end of a branch via the following sequenceof steps. (I omit type designations for variables, which are easy to restore if youfeel the need).

(∀α)(∀β)[(α = β) ≡ (∀γ)(γ(α) ⊃ γ(β))] 1.(∀β)[(τ = β) ≡ (∀γ)(γ(τ) ⊃ γ(β))] 2.[(τ = τ) ≡ (∀γ)(γ(τ) ⊃ γ(τ))] 3.[(τ = τ) ⊃ (∀γ)(γ(τ) ⊃ γ(τ))] 4.[(∀γ)(γ(τ) ⊃ γ(τ)) ⊃ (τ = τ)] 5.

@

@¬(∀γ)(γ(τ) ⊃ γ(τ)) 6. (τ = τ) 7.

In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal rules;4 and 5 are from 3 by a conjunction rule; 6 and 7 are from 5 by a disjunctionrule. Clearly the left branch continues to closure. The remaining open branch,the right one, indeed has (τ = τ) on it.

The next rule embodies the familiar notion of substitutivity of equals forequals.

Definition 5.2.2 [Derived Substitutivity Rule] Suppose Φ(α) is a formula ofL+(C) in which the variable α may have free occurrences, but no other variablesoccur free. Also suppose τ1 and τ2 are grounded terms of the same type as α. Asusual, let Φ(τ1) denote the result of replacing free occurrences of α in Φ(α) withoccurrences of τ1; and similarly for Φ(τ2). Then, if both Φ(τ1) and (τ1 = τ2)occur on a tableau branch, Φ(τ2) can be added to the branch end. Schematically,

Φ(τ1)(τ1 = τ2)

Φ(τ2)

Justification of Derived Substitutivity Rule Assume τ1 and τ2 aregrounded terms of type t, and Φ(τ1) and (τ1 = τ2) occur on a tableau branch.I show Φ(τ2) can be added to the end of the branch. Again I omit type desig-


nations.

Φ(τ1)(τ1 = τ2)...(∀α)(∀β)[(α = β) ≡ (∀γ)(γ(α) ⊃ γ(β))] 1.(∀β)[(τ1 = β) ≡ (∀γ)(γ(τ1) ⊃ γ(β))] 2.[(τ1 = τ2) ≡ (∀γ)(γ(τ1) ⊃ γ(τ2))] 3.[(τ1 = τ2) ⊃ (∀γ)(γ(τ1) ⊃ γ(τ2))] 4.[(∀γ)(γ(τ1) ⊃ γ(τ2)) ⊃ (τ1 = τ2)] 5.

@

@¬(τ1 = τ2) 6. (∀γ)(γ(τ1) ⊃ γ(τ2)) 7.

〈λα.Φ(α)〉(τ1) ⊃ 〈λα.Φ(α)〉(τ2) 8.

@

@¬〈λα.Φ(α)〉(τ1) 9. 〈λα.Φ(α)〉(τ2) 10.¬Φ(τ1) 11. Φ(τ2) 12.

In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal rules; 4and 5 are from 3 by a conjunction rule; 6 and 7 are from 4 by a disjunction rule;8 is from 7 by a universal rule, using the term 〈λα.Φ(α)〉; 9 and 10 are from 8 bya disjunction rule; 11 is from 9 and 12 is from 10 by a predicate abstract rule.The two left branches are closed, leaving the right one which contains Φ(τ2).

Now I give several examples of tableau derivations using the derived rules.The first example is (intentionally) a simple one. It appeared earlier as Exam-ple 2.2.7, where an informal reading was given, and validity was shown directly.

Example 5.2.3 Here is a proof of 〈λX.(∃x)X(x)〉(〈λx.x = c〉).

¬〈λX.(∃x)X(x)〉(〈λx.x = c〉) 1.¬(∃x)〈λx.x = c〉(x) 2.¬〈λx.x = c〉(c) 3.¬(c = c) 4.

(c = c) 5.

In this, 2 is from 1 by an abstract rule; 3 is from 2 by a universal rule; 4 is from3 by an abstract rule, and 5 is by the derived reflexivity rule.

The next example shows how, by using the derived rules, we can prove aversion of the equality axioms.

Example I give a tableau proof (using derived rules, not axioms) of

(∀α)(∀β)[(∀γ)(γ(α) ⊃ γ(β)) ⊃ (α = β)].


¬(∀α)(∀β)[(∀γ)(γ(α) ⊃ γ(β)) ⊃ (α = β)] 1.¬(∀β)[(∀γ)(γ(P ) ⊃ γ(β)) ⊃ (P = β)] 2.¬[(∀γ)(γ(P ) ⊃ γ(Q)) ⊃ (P = Q)] 3.

(∀γ)(γ(P ) ⊃ γ(Q)) 4.¬(P = Q) 5.〈λX.¬(X = Q)〉(P ) ⊃ 〈λX.¬(X = Q)〉(Q) 6.

@

@¬〈λX.¬(X = Q)〉(P ) 7. 〈λX.¬(X = Q)〉(Q) 8.¬¬(P = Q) 9. ¬(Q = Q) 10.

(Q = Q) 11.

Here 2 is from 1, and 3 is from 2 by an existential rule (P and Q are newparameters of the appropriate type); 4 and 5 are from 3 by a conjunctive rule;6 is from 4 by a universal rule, using the grounded term 〈λX.¬(X = Q)〉; 7 and8 are from 6 by a disjunction rule; 9 and 10 are from 7 and 8 by abstract rules;11 is the derived reflexivity rule.

Though the derived tableau rules for equality allow us to prove the axioms,it does not follow directly that they are their equivalent. To establish that,we would need to have a cut elimination theorem for the tableau system withthe equality rules. And the way to prove cut elimination is to first have acompleteness proof. I conjecture that such a completeness result is provable,but I don’t know how to do it.

Exercises

Exercise 5.2.1 Prove the following characterization of equality—it says it isthe smallest reflexive relation.

(∀x)(∀y)(x = y) ≡ (∀R)[(∀z)R(z, z) ⊃ R(x, y)]

Exercise 5.2.2 Give a tableau derivation of the following from EQ.

(∀α〈t〉)(∀β〈t〉)[(α〈t〉 = β〈t〉) ⊃ (∀γt)(α〈t〉(γt) ≡ β〈t〉(γt))]

More generally, one can do the same with the following.

(∀α〈t1,... ,tn〉)(∀β〈t1,... ,tn〉)[(α〈t1,... ,tn〉 = β〈t1,... ,tn〉) ⊃(∀γt11 ) · · · (∀γtnn )(α〈t1,... ,tn〉(γt11 , . . . , γ

tnn ) ≡ β〈t1,... ,tn〉(γt11 , . . . , γ

tnn ))]

5.3 Soundness and Completeness

The results of this section combine to prove the following.


Theorem 5.3.1 Let Φ be a closed formula and let S be a set of closed formulasof L(C).

1. Φ is valid in all normal unrestricted Henkin models if and only if Φ has atableau derivation from EQ.

2. Φ is a consequence of S with respect to normal unrestricted Henkin modelsif and only if Φ has a tableau derivation from S ∪ EQ.

The theorem above combines soundness and completeness. One direction,soundness, is almost immediate. Every equality axiom is true in every nor-mal unrestricted Henkin model, so the implications from right to left in The-orem 5.3.1 follow immediately from Theorems 4.1.4 and 4.1.5. As usual, thecompleteness direction is more work. The key item is to prove the followingProposition. Once we have it, completeness follows immediately using part 2 ofTheorem 4.2.26.

Proposition 5.3.2 Given an unrestricted Henkin model in which all membersof EQ are true, there is a normal unrestricted Henkin model in which exactlythe same closed formulas of L(C) are true.

The rest of this section is given over to a proof of Proposition 5.3.2—it isbroken up into constructions and Lemmas. The ideas are the same as in Godel’soriginal completeness proof for first-order logic with equality—bring equivalenceclasses into the picture.

For the rest of this section, assume 〈M,A〉 is an unrestricted Henkin model,M = 〈H, I, E〉, and all members of EQ are true in this model.

For O1, O2 ∈ H(t), let us write O1 =I O2 as a more readable alternativenotation for 〈O1, O2〉 ∈ I(=〈t,t〉). Thus =I is the interpretation of the equalityconstant symbol (of a particular type, which will be indicated only if needed).Since all equality axioms are true in 〈M,A〉, it is an easy consequence that =Iis an equivalence relation.

For each O ∈ H(t), let O be the equivalence class determined by O, thatis, O = O′ | O =I O′. Define a new Henkin domain mapping by settingH(t) = O | O ∈ H(t). Also, define a new interpretation by setting I(A) to bethe equivalence class containing I(A), that is, I(A) = I(A).

Lemma 5.3.3 If O1 = O2 then E(O1) = E(O2).

Proof Suppose O1 = O2, that is, O1 =I O2, and say O1 and O2 are of type 〈t〉.In Exercise 5.2.2 you were asked to give a tableau derivation of (∀α)(∀β)[(α =β) ⊃ (∀γ)(α(γ) ≡ β(γ))] from EQ. Then by soundness, this sentence is validin 〈M,A〉. It follows that (∀γ)(α(γ) ≡ β(γ)) is also true with respect to anyvaluation assigning O1 to α and O2 to β. From this we immediately get thatthe sets E(O1) and E(O2) must be the same. A similar argument applies if O1

and O2 are of type 〈t1, . . . , tn〉.


The Lemma above justifies the following. For O ∈ H(〈t1, . . . , tn〉), setE(O) = 〈O1, . . . , On〉 | 〈O1, . . . , On〉 ∈ E(O).

We have now created a new unrestricted Henkin frame M = 〈H, I, E〉.

Lemma 5.3.4 The unrestricted Henkin frame M = 〈H, I, E〉 is normal.

Proof The following calculation establishes normality.

〈O1, O2〉 ∈ E(I(=)) ⇔ 〈O1, O2〉 ∈ E(I(=))⇔ 〈O1, O2〉 ∈ E(I(=))⇔ O1 =I O2

⇔ O1 = O2

For each valuation v inM, let v be the corresponding valuation inM givenby v(α) = v(α). It is easy to see that each valuation inM is v for some valuationv in M.

Lemma 5.3.5 Let τ be a predicate abstract. If v1 = v2 then A(v1, τ) =IA(v2, τ).

Proof For convenience, say τ has a single free variable, γ. The more generalcase is treated similarly. From now on I’ll write τ as τ(γ).

Let α and β be variables of the same type as γ, that do not occur in τ(γ)(free or bound). Since 〈M,A〉 is normal, (∀α)(∀β)[(α = β) ⊃ (τ(α) = τ(β))]is valid in it, and hence τ(α) = τ(β) is true in 〈M,A〉 with respect to anyvaluation w such that w(α) =I w(β).

Let σ1 be the substitution α/γ. Then [τ(α)]σ1 = τ(γ), so A(v1, τ(γ)) =A(v1, τ(α)σ1) = A(vσ1

1 , τ(α)), since A is proper, Definition 2.5.7. Likewise, ifσ2 is the substitution β/γ, then A(v2, τ(γ)) = A(v2, τ(β)σ2) = A(vσ2

2 , τ(β)).Now let w be a valuation such that w(α) = vσ1

1 (α), w(β) = vσ22 (β), and

otherwise w is arbitrary. The only free variable of τ(α) is α, on which wand vσ1

1 agree, hence since A is proper, A(vσ11 , τ(α)) = A(w, τ(α)). Similarly

A(vσ22 , τ(β)) = A(w, τ(β)).Finally, w(α) = vσ1

1 (α) = v1(ασ1) = v1(γ). Similarly w(β) = v2(γ). Sincev1 = v2, v1(γ) =I v2(γ) so we have w(α) =I w(β). It now follows from theobservation at the start of the proof, that τ(α) = τ(β) is true in 〈M,A〉 withrespect to valuation w, and hence A(w, τ(α)) =I A(w, τ(β)). Combining thiswith items above, we have A(v1, τ(γ)) =I A(v2, τ(γ)).

This Lemma justifies the following. Define an abstraction designation func-tion by A(v, 〈λα1, . . . , αn.Φ〉) = A(v, 〈λα1, . . . , αn.Φ〉).

Now the final step.

Lemma 5.3.6 For each valuation v in M:

1. (v ∗ I ∗ A)(τ) = (v ∗ I ∗ A)(τ) for each term τ of L(C);


2. M °v,A Φ⇐⇒M °v,A Φ for each formula Φ of L(C);

3. A is proper, and hence 〈M,A〉 is an unrestricted Henkin model.

Proof Part 1 follows for variables, constant symbols, and predicate abstractsby definition of v, I, and A respectively.

Part 2 is by an induction on the degree of Φ, which I leave to you.Finally, for part 3 it is necessary to verify the three parts of Definition 2.5.7.

I check part 3 and leave the other parts to you. Let σ be a substitution thatis free for 〈λα1, . . . , αn.Φ〉, a term which I abbreviate as τ . It must be shownthat A(v, τσ) = A(vσ, τ). We have the following.

A(v, τσ) = A(v, τσ)= A(vσ, τ)= A(vσ, τ)

But also we have the following, for each variable α.

vσ(α) = vσ(α)= v(ασ)= v(ασ)= vσ(α)

Exercises

Exercise 5.3.1 Give the details of the proof that =I is an equivalence relation.

Exercise 5.3.2 Supply the proof of part 2 of Lemma 5.3.6.

Chapter 6

Extensionality

Extensionality says that properties applying to the same objects are identical.Just as was done with equality in Chapter 5, extensionality is added via axioms.Throughout this chapter it is, of course, assumed that equality is available.

6.1 Adding Extensionality

The extensionality axioms simply assert the equality of co-extensional proper-ties.

Definition 6.1.1 [Extensionality Axioms] Each sentence of the following formis an extensionality axiom, where α and β are of type 〈t1, . . . , tn〉, γ1 is of typet1, . . . , γn is of type tn.

(∀α)(∀β)(∀γ1) · · · (∀γn)[α(γ1, . . . , γn) ≡ β(γ1, . . . , γn)] ⊃ [α = β]EXT denotes the set of extensionality axioms.

I will show that a closed formula Φ of L(C) is valid in normal Henkin models(note that I’ve dropped the qualifier “unrestricted”) if and only if Φ has a tableauderivation from EQ ∪ EXT. But first some examples.

6.2 A Derived Rule and an Example

Extensionality was embodied in a set of axioms. There is a derived tableau rulethat expresses the same idea, in a rather more useful form.

Definition 6.2.1 [Derived Extensionality Rule] Suppose τ1 and τ2 are twogrounded terms, both of type 〈t1, . . . , tn〉. At any point in a tableau construc-tion the end of a branch can be split, with one fork labeled (τ1 = τ2), and theother fork labeled ¬(τ1(pt11 , . . . , p

tnn ) ≡ τ2(pt11 , . . . , p

tnn )) where pt11 , . . . , ptnn are

parameters new to the branch. Schematically, for new parameters:

¬ [τ1(p1, . . . , pn) ≡ τ2(p1, . . . , pn)] (τ1 = τ2)

69

CHAPTER 6. EXTENSIONALITY 70

The justification of this rule is quite straightforward, and I leave it as an ex-ercise. Here is an example that illustrates the use of this Derived ExtensionalityRule.

Example 6.2.2 I give a proof of the following formula.

(∀x) [〈λX.X(x)〉(P ) ≡ 〈λX.X(x)〉(Q)] ⊃〈λX , X, Y.X (X) ⊃ X (Y )〉(P, P,Q)

P = Q 8.P(Q) 9.

¬ [P (p) ≡ Q(p)] 7.〈λX.X(p)〉(P ) ≡〈λY.Y (p)〉(Q) 10.

aaaaaaa

!!!!!!!

¬(∀x) [〈λX.X(x)〉(P ) ≡ 〈λX.X(x)〉(Q)]⊃ 〈λX , X, Y.X (X) ⊃ X (Y )〉(P, P,Q) 1.

(∀x) [〈λX.X(x)〉(P ) ≡ 〈λX.X(x)〉(Q)] 2.¬〈λX , X, Y.X (X) ⊃ X (Y )〉(P, P,Q) 3.¬ [P(P ) ⊃ P(Q)] 4.P(P ) 5.¬P(Q) 6.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an abstractrule; 5 and 6 are from 4 by a conjunctive rule. Now I apply the extensionalityrule. Take τ1 to be P and τ2 to be Q, both of which are grounded, and take pto be a new parameter. We get a split to 7 and 8. Item 9 is from 5 and 8 bysubstitutivity, and the right branch is closed. Item 10 is from 2 by a universalrule. The left branch can be continued to closure. I leave this to you.

Exercises

Exercise 6.2.1 Give a proof of (3.1) from Example 3.3.1.

Exercise 6.2.2 Show that the rule contained in Definition 6.2.1 is, in fact, aderived rule, using EXT.

6.3 Soundness and Completeness

I sketch a proof that the sentences having tableau proofs using EQ ∪ EXT asaxioms are exactly the sentences valid in normal Henkin models (and similarlyfor derivability as well).

Soundness takes very little work. It just amounts to the observation that allmembers of EQ ∪ EXT are valid in normal Henkin models.

CHAPTER 6. EXTENSIONALITY 71

Completeness also takes very little work. Using results of Chapter 4, if asentence Φ does not have a tableau proof using EQ ∪ EXT as axioms, there isan unrestricted Henkin model 〈M,A〉 (where M = 〈H, I, E〉) in which Φ isfalse, but in which all of EQ ∪ EXT are true. Since the members of EQ aretrue, by results of Chapter 5, we can take 〈M,A〉 to be normal. I claim it isalso extensional in the sense of Definition 2.6.3, that is, if E(O) = E(O′) thenO = O′, where O and O′ are objects in the model domain. I now show this.

Suppose E(O) = E(O′), where O and O′ are of type 〈t〉 for simplicity (thegeneral case is similar). The following is a member of EXT (in it, α and β areof type 〈t〉, and γ is of type t)

(∀α)(∀β)(∀γ)[α(γ) ≡ β(γ)] ⊃ [α = β]

and so this sentence true in 〈M,A〉. Let v be a valuation such that v(α) = Oand v(β) = O′. Then

M °v,A (∀γ)[α(γ) ≡ β(γ)] ⊃ [α = β].

But since E(O) = E(O′) it is easy to see we also have

M °v,A (∀γ)[α(γ) ≡ β(γ)]

and so M °v,A α = β. Since 〈M,A〉 is normal, it follows that v(α) = v(β),that is, O = O′.

Since 〈M,A〉 is extensional it is isomorphic to a Henkin model, as was shownin Section 2.6. And trivially, isomorphism preserves sentence truth.

Part II

Modal Logic

72

Chapter 7

Modal Logic—Syntax andSemantics

7.1 Introduction

The second part of this book investigates a logic of intensions and extensions,using a possible world semantics. I will assume you have some familiarity withsuch semantics—technicalities can be postponed.

First, a point about terminology. The intensional/extensional distinction isan old one. Unfortunately, the word “extensionality” has already been given atechnical meaning in Part I, where Henkin models that did or did not satisfythe extensionality axioms were considered. The use of “extension” in this part,while related, is not the same. I briefly tried using the word “denotation”here, but finally it seemed unnatural, and I resigned myself to using the word“extension” after all. As a matter of fact, the Axioms of Extensionality will beassumed throughout Part II for those terms that will be called extensional, soany confusion of meanings between the classical and the modal settings shouldbe minimal.

The machinery in Part I had no place for intensions—meanings. In a normalHenkin model, if terms intended to denote the morning star and the eveningstar have the same extension, as they do in the real world, they are equal, and soshare all properties. They cannot be distinguished. Montague and his students,notably Gallin, developed a purely intensional logic. In this, extensions couldonly be handled indirectly—in some sense an extension could be an intensionthat did not vary with circumstances. While this can be made to work, ittreats extensions as second class objects, and leads to a rather complicateddevelopment. What is presented here is a modification of the Montague/Gallinapproach, in which both extensions and intensions are first class objects.

What are the underlying intuitions? An extensional object will be muchas it was in Part I: a set or relation in the usual sense. The added constructis that of intensional object, or concept, and this is treated in the Carnap

73

CHAPTER 7. MODAL LOGIC—SYNTAX AND SEMANTICS 74

tradition. A phrase like, say, “the royal family of England,” has a meaning, anintension. At any particular moment, that meaning can be used to determinea particular set of people, constituting its extension. But that extension willvary with time. For different phrases, there may be different mechanisms fordetermining extensions as circumstances vary. The one thing common to all suchintensional phrases is that they, somehow, induce mappings from circumstancesto extensions. Abstracting to the minimum useful structure, in a possible worldmodel an intensional object will be a function from possible worlds to extensionalobjects.

Here is an example using the terminology just introduced. Suppose we takepossible worlds as people, with an S5 accessibility relation—every person is ac-cessible to every other person. And suppose the ground-level domain is a bunchof real-world objects. Any one person will classify some of those objects as be-ing red. Because of differences in vision, and perhaps culture, this classificationmay vary from person to person. Nonetheless, there is a common concept ofred, or else communication would not be possible. We can identify it with thefunction that maps each person to the set of objects that person classifies asred. And similarly for other colors. In addition, each person has a notion ofcolor, though this too may vary from person to person. One person may thinkof ultra-violet as a color, another not. We can think of the color concept as amapping from persons to the set of colors for that person. If we assert that redis a color for a particular person, we mean the red concept is in the extensionof the color concept for that person. The extension of the red concept for thatperson plays no role here.

Sometimes extensions are needed too. Certainly if we ask someone whetheror not some object is red, the extension of the red concept, for that person,is needed to answer the question. Here is another example in this direction.Assume the word “tall” has a definite, non-fuzzy, meaning. Say everybody getstogether and votes on which people are tall, or say there is a tallness czar whodecides to whom the adjective applies. The key point is that the meaning of“tall,” even though precise, drifts with time. Average height of the generalpopulation has increased over the last several generations, so someone who oncewas considered tall might not be considered so today.

Now suppose I say, “Someday everybody will be tall.” There is more thanone ambiguity here. On the one hand I might mean that at some point in thefuture, everybody then alive will be a tall person. On the other hand I mightmean that everybody now alive will grow, and so at some point everybody nowalive will be a tall person. Let us read modal operators temporally, so that¤X informally means that X is true and will remain true, and ♦X means thatX either is true or will be true at some point in the future. Also, let us useT (x) as a tallness predicate. (The examples that follow assume an actualistreading of the quantifiers, and eventually I will adopt a version of a possibilistreading. For present purposes, this is a point of no fundamental importance.For now, think in terms of varying domain models, with quantifiers rangingover different domains at different worlds.) The two readings of the sentenceare easily expressed as follows.


(∀x)♦T (x) (7.1)♦(∀x)T (x) (7.2)

Formula (7.1) refers to those alive now, and says at some point they willall be tall. Formula (7.2) refers to those alive at some point in the future andasserts, of them, that they will be tall. All this is standard; the problem is withthe adjective “tall.” Do we mean that at some point in the future everybody(read either way) will be tall as they use the word in the future, or as we use theword now? If we interpret things intensionally, T (x) at a possible world wouldbe understood according to that world’s meaning of tall. There is no way, usingpurely intensional machinery, to formalize the assertion that, at some point inthe future, everybody will be tall as we understand the term. But this is whatis most likely meant if someone says, “Someday everybody will be tall.”

Here is another example, one that goes the other way. Suppose a memberof the Republican Party, call him R, says, “necessarily the proposed tax cut isa good thing.” Suppose we take as the possible worlds of a model the collectionof all Republicans, and assume a sentence is true at a world if that Republicanthinks the sentence true. (We assume Republicans are entirely rational, so wedon’t have to worry about contradictory beliefs.) Let us assume ¤X meansthat every Republican thinks X is the case, which means X is necessary forRepublicans. (Technically, this gives us an S5 modality.) Now, how do weformalize the sentence above? Let c be a constant symbol whose intendedmeaning is, “the proposed tax cut,” and let G be a “goodness” predicate. Then¤G(c) seems reasonable as a formalization. What should it mean to say it istrue for R?

One possibility is that R means every Republican thinks the tax cut is good,as R understands the word good. This may not be what was meant. After all,R might consider something good only if it personally benefitted him. AnotherRepublican might think something good if it eventually benefitted the poor.Such a Republican probably would not think a tax cut good simply because itbenefitted R but he might believe it would eventually benefit the poor, and sowould be good in his sense. Probably R is saying every Republican thinks atax cut is good, for his own personal reasons. The notion of what is good canvary from Republican to Republican, provided they all agree that the proposedtax cut is a good thing. But the mere fact that we can consider more than onereading tells us that a simple formalization like ¤G(c) is not sufficient.

Here will be presented a logic of both intension and extension, of both senseand reference. In one of the examples above, color is an intensional object. Itis a function from persons to sets of concepts like red, blue, and so on. As such,it is the same function for each person. The extension of color for a particularperson is the color function evaluated at that person, and thus it is a particularset of concepts, such as red but not infra-red, and so on, quite possibly differentfrom person to person. We need a logic in which both intensions and extensionsare first-class objects. The machinery for doing this makes for complicated


looking formulas. But I point out, in everyday discourse all the machinery ispresent but hidden—we infer it from our knowledge of what we think must havebeen meant. Formalization naturally requires complex machinery—it is makingexplicit what our minds do automatically.

7.2 Types and Syntax

Now begins the formal treatment. And I begin by defining a notion of type. Iwant it to include the types of classical logic, as defined in Section 1.1. I alsowant it to include the purely intensional types of the Montague tradition, asgiven in (Gallin 1975).

Definition 7.2.1 [Type] The notion of a type, extensional and intensional, isgiven by the following.

1. 0 is an extensional type.

2. If t1, . . . , tn are types, extensional or intensional, 〈t1, . . . , tn〉 is an exten-sional type.

3. If t is an extensional type, ↑t is an intensional type.

A type is an intensional or an extensional type.

The ideas behind the definition above are these. As usual, 0 is to be the typeof ground-level objects, unanalysed “things.” The type 〈t1, . . . , tn〉 is intendedto be analogous to types in part I. The type ↑t is the new piece of machinery—anobject of such a type will be a function on possible worlds. Recall the exampleinvolving colors from Section 7.1; it can be used to give a sense of how thesetypes are intended to be applied. In that example, real-world objects are thoseof type 0. A set of real-world objects is of type 〈0〉 so, for instance, the set ofobjects some particular person considers red is of this type; this is the extensionof red for that person. The intensional object red, mapping each person to thatperson’s set of red objects, is of type ↑〈0〉. A set of such intensional objects isof type 〈↑〈0〉〉, so for a particular person, that person’s set of colors is of thistype—the extension of color for that person. Finally, the intensional objectcolor, mapping each person to that person’s set of colors, is an object of type↑〈↑〈0〉〉.

For another example, assume possible worlds are possible situations, andthe ground-level objects include people. In each particular situation, there is atallest person in the world. The tallest person, in each situation, is an objectof type 0. The tallest person concept is an object of type ↑0—it associates witheach possible world the tallest person in that possible world.

As a final example example, suppose t is an extensional type, so that ↑t isintensional. The two-place relation: the intensional object X of type ↑t has theextensional object y of type t as its extension, is a relation of type 〈↑t, t〉.


The language of Part I must be expanded to allow for modality. Just asclassically, C is a set of constant symbols containing at least an equality symbol=〈t,t〉 for each type t, though the set of types is now larger. Note that the equal-ity symbols are all of extensional type. Using them we can form the intensionalterms 〈λx, y.x = y〉 and 〈λx, y.¤(x = y)〉, as needed. We also have variables ofeach type. There is one new piece of machinery, an operator ↓, which plays arole in term formation. As usual, terms and formulas must be defined togetherin a mutual recursion.

Definition 7.2.2 [Term of L(C)] Terms are characterized as follows.

1. A constant symbol or variable of L(C) of type t is a term of L(C) of typet. If it is a constant symbol, it has no free variable occurrences. If it is avariable, it has one free variable occurrence, itself.

2. If Φ is a formula of L(C) and α1, . . . , αn is a sequence of distinct variablesof types t1, . . . , tn respectively, then 〈λα1, . . . , αn.Φ〉 is a term of L(C)of the intensional type ↑〈t1, . . . , tn〉. Its free variable occurrences are thefree variable occurrences of Φ, except for occurrences of the variables α1,. . . , αn.

3. If τ is a term of L(C) of type ↑t then ↓τ is a term of type t. It has thesame free variable occurrences that τ has.

The predicate abstract 〈λα1, . . . , αn.Φ〉 is of type ↑〈t1, . . . , tn〉 above, andnot of type 〈t1, . . . , tn〉, essentially because Φ can vary its meaning from worldto world, and so 〈λα1, . . . , αn.Φ〉 itself is world dependent.

Case 3 above makes use of what may be called an extension-of operator, con-verting a term of an intensional type to a term of the corresponding extensionalone. Continuing with the color example, suppose r is the intensional notionof red, of type ↑〈0〉, mapping each person to that person’s set of red objects.Then for a particular person, ↓r would be that person’s set of red objects—theextension of r for that person, and an extensional object of type 〈0〉.

Definition 7.2.3 [Modal Formula of L(C)] The definition of formula of L(C)is as follows:

1. If τ is a term of either type 〈t1, . . . , tn〉 or type ↑〈t1, . . . , tn〉, and τ1, . . . , τnis a sequence of terms of types t1, . . . , tn respectively, then τ(τ1, . . . , τn)is a formula (atomic) of L(C). The free variable occurrences in it are thefree variable occurrences of τ , τ1, . . . , τn.

2. If Φ is a formula of L(C) so is ¬Φ. The free variable occurrences of ¬Φare those of Φ.

3. If Φ and Ψ are formulas of L(C) so is (Φ∧Ψ). The free variable occurrencesof (Φ ∧Ψ) are those of Φ together with those of Ψ.


4. If Φ is a formula of L(C) and α is a variable then (∀α)Φ is a formula ofL(C). The free variable occurrences of (∀α)Φ are those of Φ, except foroccurrences of α.

5. If Φ is a formula of L(C) so is ¤Φ. The free variable occurrences of ¤Φare those of Φ.

Item 1 above needs some comment, and again the example concerning colorsshould help make things clear. Suppose r is the intensional notion of red, oftype ↑〈0〉. And suppose c is an extensional notion of color, the set of colors for aparticular person—call the person George. Also let C be the intensional versionof color, mapping each person to that person’s extension of color. c is of type〈↑〈0〉〉, and C is of type ↑〈↑〈0〉〉 I take both C(r) and c(r) to be atomic formulas.If we ask whether they are true for George, no matter which formula we use,we are asking if r is a color for George. But if we ask whether they are truefor Natasha, we are asking different questions. C(r) is true for Natasha if r isa color for Natasha, while c(r) is true for Natasha if r is a color for George. Nomatter which, both c(r) and C(r) make sense, and are considered well-formed.

I use ♦ to abbreviate ¬¤¬ in the usual way, or I tacitly treat it as primitive,as is convenient at the time.

7.3 Constant Domains and Varying Domains

Should quantifiers range over what does exist, or over what might exist? Thatis, should they be actualist or possibilist? This is really a first-order question.A flying horse may or may not exist. In the world of mythology, such a beingdoes exist. In the present world, it does not. But the property of being a flyinghorse does not exist in some worlds and lack existence in others. In the presentworld nothing has the flying-horse property, but that does not mean the propertyitself is non-existent. Thus actual/possible existence issues really concern type 0objects, so the discussion that follows assumes a first-order setting.

As presented in (Fitting & Mendelsohn 1998) and also in (Hughes & Cress-well 1996b), the distinction between actualist and possibilist quantification canbe seen to be that between varying domain modal models and constant domainones. In a varying domain modal model, one can think of the domain associatedwith a world as what actually exists at that world, and it is this domain thata quantifier ranges over when interpreted at that world. In a constant domainmodel one can think of the common domain as representing what does or couldexist, and this is the same from world to world. Of course a choice betweenconstant and varying domain models makes a substantial difference. Both theBarcan formula and its converse are valid in a constant domain setting, butneither is in a varying domain one.

As it happens, while a choice between constant and varying domain modelsmakes a difference technically, at a deeper level such a choice is essentially anarbitrary one. If we choose varying domains as basic, we can restrict attentionto constant domain models by requiring the Barcan formula and its converse


to hold. (Technically this requirement involves an infinite set of formulas butif equality is available, a single formula will do.) Thus when using actualistquantification we can still determine constant domain validity. The other direc-tion is even easier—if we have possibilist quantification we can also determinevarying domain validity. And on this topic I present a somewhat more detaileddiscussion.

Suppose quantification is taken in a possibilist sense—domains are constant.Nonetheless, at each world we can intuitively divide the (common) domain intowhat ‘actually’ exists at that world and what does not. Introduce a predicatesymbol E of type ↑〈0〉 for this purpose. At a world, E(x) is true if x has as itsvalue an object one thinks of as existing at that world, and is false otherwise.Then the effect of varying domain quantification can be had by relativising allquantifiers to E. That is, replace (∀x)ϕ by (∀x)(E(x) ⊃ ϕ) and replace (∃x)ϕ by(∃x)(E(x)∧ϕ). What we get, at least intuitively, simulates an actualist versionof quantification.

All this can be turned into a formal result. Suppose we denote the relativiza-tion of a first-order formula ϕ, as described above, by ϕE. It can be shown thatϕ is valid in all varying domain models if and only if ϕE is valid in all constantdomain models. Possibilist quantification can simulate actualist quantification.I note in passing that (Cocchiarella 1969) actually has two kinds of quantifiers,corresponding to actualist and possibilist, though it is observed that a quantifierrelativization of the sort described above could be used instead.

The discussion above was in a first-order setting. As observed earlier, whenhigher types are present the actualist/possibilist distinction is only an issue fortype 0 objects. I have made the choice to use possibilist type 0 quantifiers. Thejustification is that, first, such quantifiers are easier to work with, and second,they can simulate actualist quantifiers, so nothing is lost. When I say they areeasier to work with, I mean that both the semantics and the tableau rules aresimpler. So there is considerable gain, and no loss.

Officially, from now on the formal language will be assumed to contain aspecial constant symbol, E, of type ↑〈0〉, which will be understood informally asan existence predicate.

7.4 Standard Modal Models

I begin the formal presentation of semantics for higher-order modal logic withthe modal analog of standard models. The new piece of semantical machineryadded to that for classical logic is the possible world structure.

Definition 7.4.1 [Kripke Frame] A Kripke frame is a structure 〈G,R〉. In it,G is a non-empty set (of possible worlds), and R is a binary relation on G (calledaccessibility). An augmented frame is a structure 〈G,R,D〉 where 〈G,R〉 is aframe, and D is a non-empty set, the (ground-level) domain.

The notion of a Kripke frame should be familiar from propositional modallogic treatments, and I do not elaborate on it. As usual, different restrictions on


R give rise to different modal logics. The only two I will be interested in are K,for which there are no restrictions on R, and S5, for which R is an equivalencerelation. Note that the ground-level domain, D, is not world dependent, sincethe choice was to take type-0 quantification as possibilist and not actualist.

Next I say what the objects of each type are, relative to a choice of ground-level domain. This is analogous to what was done in Part I, in Definition 2.1.1.To make the definition easier to state, I use some standard notation from settheory. The first item is something that was used before, but I include it herefor completeness sake.

1. For sets A1, . . . , An, A1 × · · · × An is the collection of all n-tuples ofthe form 〈a1, . . . , an〉, where a1 ∈ A1, . . . , an ∈ An. The 1-tuple 〈a〉 isgenerally identified with a.

2. For a set A, P(A) is the power set of A, the collection of all subsets of A.

3. For sets A and B, AB is a function space, the set of all functions from Bto A.

Definition 7.4.2 [Objects, Extensional and Intensional] Let G be a non-emptyset (of possible worlds) and let D be a non-empty set (the ground-level domain).For each type t, I define the collection [[ t,D,G ]] , of objects of type t with respectto D and G, as follows.

1. [[0,D,G ]] = D.

2. [[〈t1, . . . , tn〉,D,G ]] = P( [[ t1,D,G ]] × · · · × [[ tn,D,G ]] ).

3. [[↑t,D,G ]] = [[ t,D,G ]]G .

O is an object of type t if O ∈ [[ t,D,G ]] . O is an intensional or extensional objectaccording to whether its type is intensional or extensional. As before, O is used,with or without subscripts, to stand for objects.

Now the final notion of the section.

Definition 7.4.3 [Modal Model] A (higher-order) modal model for L(C) is astructureM = 〈G,R,D, I〉, where 〈G,R,D〉 is an augmented frame and I is aninterpretation. The interpretation I must meet the following conditions.

1. IfAt is a constant symbol of type t, I(At) is an object of type t in 〈G,R,D〉.

2. If =〈t,t〉 is an equality constant symbol, I(=〈t,t〉) is the equality relationon [[ t,D,G ]] .


7.5 Truth in a Model

In this section I say how truth is to be assigned to formulas, at worlds, in models,and how values should be assigned to terms. I lead up to a proper definitionafter a few preliminary notions.

Definition 7.5.1 [(Modal) Valuation] The mapping v is a modal valuation inthe modal model M = 〈G,R,D, I〉 if v assigns to each variable αt of type tsome object of type t, that is, v(αt) ∈ [[ t,D,G ]] .

A variant of a valuation is defined exactly as classically. The definition ofterm designation needs modification, of course. A term like ↓τ is intended todesignate the extension of the intensional object designated by τ . To determinethis a context is needed—the designation of τ where, under what circumstances?Consequently the designation of a term is defined with respect to a valuation,an interpretation, and a context—a possible world.

Definition 7.5.2 [Designation of a Term] Let M = 〈G,R,D, I〉 be a modalmodel, let v be a valuation in it, and let Γ ∈ G be a possible world. Define amapping (v ∗ I ∗ Γ), assigning to each term an object that is the designation ofthat term.

1. If A is a constant symbol of L(C) then (v ∗ I ∗ Γ)(A) = I(A).

2. If α is a variable then (v ∗ I ∗ Γ)(α) = v(α).

3. If τ is a term of type ↑t then (v ∗ I ∗ Γ)(↓τ) = (v ∗ I ∗ Γ)(τ)(Γ)

4. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type ↑〈t1, . . . , tn〉,then (v∗I∗Γ)(〈λα1, . . . , αn.Φ〉) is the function that assigns to an arbitraryworld ∆ the following member of [[〈t1, . . . , tn〉,D,G ]] :

〈w(α1), . . . , w(αn)〉 | w is an α1, . . . , αn variant of v and M,∆ °w Φ

Item 4 tells us this definition is part of a mutual recursion—Definition 7.5.4below is the other part.

Item 3 is a little awkward to read. (v ∗ I ∗Γ)(τ)(Γ) means: evaluate τ using(v ∗ I ∗ Γ), getting a function, an intension, then evaluate that function at Γ.Generally the simpler notation (v ∗ I ∗ Γ)(τ,Γ) will be used for this. Similarlyfor v(α,Γ) and I(A,Γ), when α and A are of intensional type.

Classically, some alternative notation was introduced to make working withmodels easier, Definition 2.2.5. That carries over to a modal context in a naturalway

Definition 7.5.3 [Special Notation] Suppose v is a valuation, and w is theα1, . . . , αn variant of v such that w(α1) = O1, . . . , w(αn) = On. Then, ifM,Γ °w Φ this will generally be symbolized as follows.

M,Γ °v Φ[α1/O1, . . . , αn/On].


Part 4 of Definition 7.5.2 can be restated using the new notation:

4. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type ↑〈t1, . . . , tn〉,then (v ∗ I ∗Γ)(〈λα1, . . . , αn.Φ〉) is the function f given by the following.

f(Γ) = 〈O1, . . . , On〉 | M,Γ °v Φ[α1/O1, . . . , αn/On]

The next item should be compared with Definition 2.2.4: worlds must nowbe taken into account. And of course Definitions 7.5.2 and 7.5.4 involve a mutualrecursion, just as was the case classically.

Definition 7.5.4 [Truth of a Formula] LetM = 〈G,R,D, I〉 be a modal model,and let v be a valuation in it. The notion of formula Φ being true at world Γof G in model M with respect to v, denoted M,Γ °v Φ, is characterized asfollows.

1. For an atomic formula τ(τ1, . . . , τn),

(a) If τ is of an extensional type, M,Γ °v τ(τ1, . . . , τn) provided〈(v ∗ I ∗ Γ)(τ1), . . . , (v ∗ I ∗ Γ)(τn)〉 ∈ (v ∗ I ∗ Γ)(τ).

(b) If τ is of an intensional type, M,Γ °v τ(τ1, . . . , τn) providedM,Γ °v (↓τ)(τ1, . . . , τn). This reduces things to the previous case.

2. M,Γ °v ¬Φ if it is not the case that M,Γ °v Φ.

3. M,Γ °v Φ ∧Ψ if M,Γ °v Φ and M,Γ °v Ψ.

4. M,Γ °v (∀α)Φ if M,Γ °v′ Φ for every α-variant v′ of v.

5. M,Γ °v ¤Φ if M,∆ °v Φ for all ∆ ∈ G such that ΓR∆.

As usual, other connectives, quantifiers, and modal operators can be intro-duced via definitions, with the expected behavior. For instance: M,Γ °v ♦Φ ifM,∆ °v Φ for some ∆ ∈ G such that ΓR∆.

Note that part 4, the quantifier case, can be given in a different form usingthe alternative notation. It is often much handier to work with.

4. M,Γ °v (∀α)Φ if M,Γ °v Φ[α/O] for all objects O of the same type asα.

It follows from the definitions, that M,Γ °v ¤Φ[α1/O1, . . . , αn/On] if andonly if M,∆ °v Φ[α1/O1, . . . , αn/On] for all ∆ such that ΓR∆.

It also follows from the definitions that 〈λα.Φ(α)〉(τ) and Φ(τ) are equivalentunder certain circumstances. For instance, this is the case if τ is a constantsymbol of either intensional or extensional type. It is not the case if τ involvesthe extension-of operator, ↓. Rather than give exact conditions, I give thefollowing, which is more useful for present purposes.

Proposition 7.5.5 Suppose that (v ∗I ∗Γ)(τ1) = O1, . . . , (v ∗I ∗Γ)(τn) = Onin model M. Then

M,Γ °v 〈λα1, . . . , αn.Φ〉(τ1, . . . , τn)⇔M,Γ °v Φ[α1/O1, . . . , αn/On].


7.6 Examples

Here is a simple informal example to start with. Suppose we take possible worldsto be points in time (within a reasonable range from near past to near future).Also take the accessibility relation to always hold, so that ¤Φ means Φ holdsat all times. Does there exist, now, somebody whose parents are necessarily notalive? Certainly—the oldest person in the world. After all, the oldest personcan never have living parents. But on the other hand, there was a time whenthe oldest person had living parents. There seems to be a discrepancy here.

Say ϕ(x) is read as “x has no living parents. We are asking about thetruth of (∃x)¤ϕ(x). The key question is, what type of variable is x? If wethink of the quantifier as ranging over objects—so x is of type 0—then whenwe say the oldest person in the world instantiates the existential quantifier weare saying a particular person does so. If we designate the oldest person nowas the value of x, instantiating the existential quantifier, while ϕ(x) is certainlytrue now, for this value of x, there are earlier worlds in which the person whois the oldest now had living parents. Thus we do not have ¤ϕ(x), where x hasas value the oldest person in the present world. The proposed instantiation forthe existential quantifier does not work. More generally, it is easy to see that(∃x)¤ϕ(x) can never be true, now or at any other point of time, provided wethink of quantifiers as ranging over objects or individuals.

On the other hand if quantifiers range over individual concepts—so that xis of type ↑0—we would certainly have the truth of (∃x)¤ϕ(x) since taking thevalue of x to be the oldest-person concept would serve as a correct instantiationof ¤ϕ(x).

The type theory of (Bressan 1972) makes intensional objects basic. Thesecond-order logic of (Cocchiarella 1969) quantifies over extensional objects atthe first-order level, and over intensional objects at the second-order level. Thehigher-order modal logic of (Fitting 1998), which is a forerunner to this book,had quantification only over extensional objects. Finally, the first-order treat-ment of (Fitting & Mendelsohn 1998) involves a kind of mixed system, and morewill be said about it shortly.

Now for some further examples, which will be treated more formally.

Example 7.6.1 Suppose x is a variable of type 0 and P is a constant symbolof type ↑〈0〉. The following formula is valid, where X is of type ↑〈0〉.

〈λX.♦(∃x)X(x)〉(P ) ⊃ ♦〈λX.(∃x)X(x)〉(P ) (7.3)

I leave it to you to verify the validity of this—one way is to show both theantecedent and the consequent are equivalent to ♦(∃x)P (x). On the otherhand, the following formula is not valid, where X is of type 〈0〉.

〈λX.♦(∃x)X(x)〉(↓P ) ⊃ ♦〈λX.(∃x)X(x)〉(↓P ) (7.4)


Here is an informal illustration to help you understand intuitively why thisformula is invalid. Suppose that on an island there are two societies, optimistsand pessimists, separated by a volcano. The optimists, being nonetheless real-istic, accept something as really possible only if the pessimists believe it. Now,suppose the optimists think the volcano is beautiful, while the pessimists thinknothing is beautiful. (I know, it follows that the optimists, while thinking thevolcano is beautiful, also don’t think that is possible. That’s the set-up.)

Take for P the concept of beauty—it maps each society to the set of thingsthat society accepts as beautiful. For the optimists, 〈λX.♦(∃x)X(x)〉(↓P ) istrue, because in the optimist society the extension of P is the set consistingof the volcano, so the formula asserts that ♦(∃x)X(x) is the case, when X isunderstood to be that set, and indeed this is possible, since even the pessimistswould agree that something is in the set consisting of the volcano. Essentially,for the optimists the antecedent asserts that the pessimists believe the opti-mists think something is beautiful. On the other hand, ♦〈λX.(∃x)X(x)〉(↓P ) isnot true for the optimists, because 〈λX.(∃x)X(x)〉(↓P ) is not the case for thepessimists, and this happens because the pessimists do not think anything isbeautiful.

This informal example can be turned into a formal argument. Here is amodel, M = 〈G,R,D, I〉, in which (7.4) is not valid. The collection of worlds,G, contains two members, Γ and ∆, with ΓR∆. Think of Γ as the optimists and∆ as the pessimists. The domain, D is the set 7 (think of the number 7 asthe volcano). I show 7 available at both worlds as a reminder that domains areconstant and quantifiers are possibilist. The constant symbol P is interpretedto be a type ↑〈0〉 object: the function that is 7 at Γ and ∅ at ∆. Thus I(P )is true of 7 at Γ, and of nothing at ∆. This gives us the model—it is presentedschematically below.

I(P,∆) = ∅

I(P,Γ) = 7

∆

Γ

?

7

7

The first claim is that, for an arbitrary valuation v, we have

M,Γ °v 〈λX.♦(∃x)X(x)〉(↓P ). (7.5)

Since (v ∗ I ∗ Γ)(↓P ) = (v ∗ I ∗ Γ)(P,Γ) = I(P,Γ) = 7, by Proposition 7.5.5we will have (7.5) provided we have

M,Γ °v ♦(∃x)X(x)[X/7] (7.6)


which will be the case provided we have

M,∆ °v (∃x)X(x)[X/7]. (7.7)

But, since 7 ∈ 7, we have

M,∆ °v X(x)[X/7, x/7] (7.8)

and hence we have (7.7).We thus have established (7.5). Next it is shown that

M,Γ 6°v ♦〈λX.(∃x)X(x)〉(↓P ) (7.9)

which, together with (7.5), gives us the invalidity of (7.4).Well, suppose otherwise, that is, suppose we had

M,Γ °v ♦〈λX.(∃x)X(x)〉(↓P ). (7.10)

Then we must have

M,∆ °v 〈λX.(∃x)X(x)〉(↓P ), (7.11)

and so, since (v ∗ I ∗∆)(↓P ) = ∅,

M,∆ °v (∃x)X(x)[X/∅]. (7.12)

It is easy to see we can not have this, and thus we have (7.9).

Example 7.6.2 This example is one that is unexpected on superficial consid-eration, although deeper thought says it should not be. The following formulais valid, with types of variables and constants as in (7.4).

〈λX.♦(∃x)X(x)〉(↓P ) ⊃ 〈λX.(∃x)X(x)〉(↓P ) (7.13)

To show validity, suppose M = 〈G,R,D, I〉 is an arbitrary model, Γ ∈ G isan arbitrary world, and v is an arbitrary valuation. Suppose

M,Γ °v 〈λX.♦(∃x)X(x)〉(↓P ). (7.14)

Then

M,Γ °v ♦(∃x)X(x)[X/O] (7.15)

where O = (v ∗ I ∗ Γ)(↓P ) = I(P,Γ). Then, for some ∆ ∈ G such that ΓR∆,

M,∆ °v (∃x)X(x)[X/O] (7.16)


and so, for some object o we have

M,∆ °v X(x)[X/O, x/o]. (7.17)

For (7.17) to be the case, we must have o ∈ O. Now,

M,Γ °v X(x)[X/O, x/o] (7.18)

since o ∈ O. Consequently

M,Γ °v (∃x)X(x)[X/O] (7.19)

and finally,

M,Γ °v 〈λX.(∃x)X(X)〉(↓P ) (7.20)

since O = (v ∗ I ∗ Γ)(↓P ).Since we went from (7.14) to (7.20), the validity of (7.13) has been estab-

lished.

Some comments on the example above. The point is, the term ↓P is givenbroad scope in both the antecedent and the consequent of the implication. Thisessentially says its meaning in alternative worlds will be the same as in thepresent world. Under these circumstances, existence of something falling under↓P in an alternate world is equivalent to existence of something falling under↓P in the present world. This is just a formal variation on the old observationthat, in Kripke models, if relation symbols could not vary their interpretationfrom world to world, modal operators would have no visible effect.

The distinction between intensional and extensional types is complex. Thefollowing two examples should help make clear the role of the ↓ operator.

Example 7.6.3 Let x and c be of type ↑0, and P be of type ↑〈↑0〉. The followingformula is valid.

¤P (c) ⊃ (∃x)¤P (x) (7.21)

To show (7.21) is valid let M = 〈G,R,D, I〉 be an arbitrary model, Γ bean arbitrary world in G, and v be an arbitrary valuation. Suppose we had thefollowing.

M,Γ °v ¤P (c) (7.22)

Let ∆ be an arbitrary world such that ΓR∆. We must have

M,∆ °v P (c) (7.23)

from which it follows that


M,∆ °v P (x)[x/I(c)]. (7.24)

Since ∆ was arbitrary, we have

M,Γ °v ¤P (x)[x/I(c)] (7.25)

and hence

M,Γ °v (∃x)¤P (x) (7.26)

Since we went from (7.22) to (7.26), the validity of (7.21) has been estab-lished.

Example 7.6.4 This continues the previous example. Let c be of type ↑0, butnow let x be of type 0 and P be of type ↑〈0〉. The following formula is not valid.

¤P (↓c) ⊃ (∃x)¤P (x) (7.27)

To show the non-validity of (7.27) a specific model, M = 〈G,R,D, I〉, isconstructed. In this model, G consists of three possible worlds: Γ, ∆, Ω. Wehave ΓR∆, ΓRΩ, and R holds in no other cases. The domain D is 1, 2. Iinterprets c by a function that is 1 at ∆, 2 at Ω, and either 1 or 2 at Γ (it won’tmatter). Likewise I interprets P by the function that is 1 at ∆, 2 at Ω,and some arbitrary value at Γ. Here is the model schematically.

I(P,Ω) = 2I(P,∆) = 1I(c,Ω) = 2I(c,∆) = 1

@@@@@R

1, 2Ω1, 2∆

Γ 1, 2

I leave it to you to check that (7.27) is not valid in this model.

Example 7.6.5 The last example is in three parts. To make the type structurework out, let x, y, and z be of type 0, and X, Y , and Z be of type ↑0. Considerthe following three formulas.


(∀Z)〈λx.¤〈λy.x = y〉(↓Z)〉(↓Z) (7.28)(∀z)〈λx.¤〈λy.x = y〉(z)〉(z) (7.29)

(∀Z)〈λX.¤〈λY.X = Y 〉(Z)〉(Z) (7.30)

Of the formulas above, (7.28) is not valid, but (7.29) and (7.30) are both valid.I leave the work to you. I note that in (Fitting & Mendelsohn 1998) it wasshown that, in a first-order setting, the constructions used above relate directlyto rigidity. Both extensional and intensional objects, as such, are the same fromworld to world, but the extensional object designated by an intensional objectcan vary. This is what the example illustrates.

Exercises

Exercise 7.6.1 Show the formula (7.3) is valid.

Exercise 7.6.2 This is a variation on formula (7.13); the formula looks thesame, but the types are different. Show the validity of

〈λX.♦(∃x)X(x)〉(↓P ) ⊃ 〈λX.(∃x)X(x)〉(↓P )

where x is of type ↑0 and P is of type ↑〈↑0〉. The fact that ground levelquantification is possibilist—constant domain—will be needed.

Exercise 7.6.3 Show the validity of the following, which looks a little like aversion of the Barcan formula: ♦(∃x)P (x) ⊃ (∃X)♦P (↓X). x is of type 0, X isof type ↑0 and P is of type ↑〈0〉.

Exercise 7.6.4 Show the non-validity of the following, where x is of type 0, Xis of type 〈0〉, and P is of type ↑〈0〉.

♦(∃x)〈λX.X(x)〉(↓P ) ⊃ (∃x)〈λX.♦X(x)〉(↓P )

Exercise 7.6.5 Verify the claims made in Example 7.6.5.

7.7 Related Systems

There have been many other versions of quantified modal logics in the literature.Here I briefly say how a few of them relate to the one presented here.

First-order modal logic, as given in (Hughes & Cresswell 1996a) or (Fitting1983) say, has variables and constant symbols of type 0, and predicate symbolsof types ↑〈0, 0, . . . , 0〉. Thus quantification is over ground-level objects; constantsymbols designate such objects and hence are rigid. Predicates, of course, vary inmeaning from world to world—they are intensional. Treating them extensionallywould force modal logic to collapse to classical.


In (Fitting & Mendelsohn 1998), conventional first-order modal logic is ex-tended by allowing non-rigid terms, and an abstraction mechanism. Relatingthings to the present system, variables are still of type 0, but constant symbolsare of type ↑0: they are individual concepts. Allowing intensional constant sym-bols greatly enhances the expressibility of the language. Predicate symbols arestill of types ↑〈0, 0, . . . , 0〉. The fit between intension and extension is achievedby treating 〈λx.Φ〉(c), where c is a constant symbol, as if it were 〈λx.Φ〉(↓c) inthe present system. In effect, this means the logic of (Fitting & Mendelsohn1998) can be embedded in the higher-type version given here. (Actually, this isnot quite correct, since the logic of (Fitting & Mendelsohn 1998) allows functionsymbols, and partial designation, neither of which is the case here. But withthese exceptions, the embedding claim is correct.)

Montague proposed a higher-order modal logic specifically as a logic of inten-sions, in (Montague 1960, Montague 1968, Montague 1970). It is presented mostfully in (Gallin 1975). Essentially, it is the present system with only intensionaltypes (except at the lowest level). To be more specific, define a Gallin/Montaguetype, as follows.

1. 0 is a Gallin/Montague type.

2. If t1, . . . , tn are Gallin/Montague types, so is ↑〈t1, . . . , tn〉.

Then the logic of (Gallin 1975) can be identified with the sublogic of the systemgiven here, in which all constant symbols and variables are restricted to be ofsome Gallin/Montague type. Indeed, the present system was created by addingextensional types to the Gallin logic.

Bressan is a pioneer in the study of higher-order modal logics (Bressan 1972).I must confess that I do not fully understand his presentation. It is an S5 systemrather like that of Gallin, though Gallin’s is for a broader variety of logics. Init extensional objects are not explicitly present, but rather are identified withconstant intensional objects. Also abstractions are not taken as primitive, butrather are defined in terms of definite descriptions.

7.8 Henkin/Kripke Models

In the classical case there were good reasons for introducing non-standardhigher-order models, and those same reasons apply in the modal case as well.Since modal versions of Henkin and unrestricted Henkin models are relativelystraightforward extensions of the classical versions, I confine things to a briefsketch, and refer to Part I and your intelligence for the details.

Definition 7.4.1 specified Kripke frames and augmented Kripke frames. Whattakes the place of augmented Kripke frames is the following.

Definition 7.8.1 [Henkin/Kripke Frame] Let 〈G,R〉 be a Kripke frame. H isa Henkin domain function in this frame if it is a function on the collection oftypes and:


1. H(0) = D

2. H(〈t1, . . . , tn〉) ⊆ P(H(t1)× · · · × H(tn)).

3. H(↑t) ⊆ [H(t)]G .

I is an interpretation if it maps each constant symbol of L(C) of type t to amember of H(t). Finally,M = 〈G,R,H, I〉 is a Henkin/Kripke frame for L(C).

If items 2 and 3 above hold with =, and not just ⊆, the Henkin/Kripkemodel is standard. Standard models correspond exactly to the models definedin Section 7.4.

Definition 7.8.2 [Abstraction Designation Function] A function A is an ab-straction designation function in the Henkin/Kripke frame M = 〈G,R,H, I〉,with respect to the language L(C), provided A(v, 〈λα1, . . . , αn.Φ〉) is some ob-ject of type t in M, for each valuation v in M and for each predicate abstract〈λα1, . . . , αn.Φ〉 of L(C) of type t.

Term designation gets the obvious modification.

Definition 7.8.3 [Designation of a Term]Let M = 〈G,R,H, I〉 be a Henkin/Kripke frame with A an abstraction desig-nation function in it. For each valuation v in it, define a mapping (v ∗I ∗Γ ∗A)assigning to each term a designation for that term, in the context (possibleworld) Γ.

1. If A is a constant symbol of L(C) then (v ∗ I ∗ Γ ∗ A)(A) = I(A).

2. If α is a variable then (v ∗ I ∗ Γ ∗ A)(α) = v(α).

3. If τ is a term of type ↑t then (v ∗ I ∗ Γ ∗ A)(↓τ) = (v ∗ I ∗ Γ ∗ A)(τ)(Γ).

4. If 〈λα1, . . . , αn.Φ〉 is a predicate abstract of L(C) of type ↑〈t1, . . . , tn〉,then (v ∗ I ∗ Γ ∗ A)(〈λα1, . . . , αn.Φ〉) = A(v, 〈λα1, . . . , αn.Φ〉).

As usual, (v ∗ I ∗ Γ ∗A)(τ,Γ) is written for (v ∗ I ∗ Γ ∗A)(τ)(Γ). Now truth, ata world, also has the expected characterization.

Definition 7.8.4 [Truth of a Formula] Let M = 〈G,R,H, I〉 be a Henkin/Kripke frame, let A be an abstraction designation function, and let v be avaluation.

1. For an atomic formula τ(τ1, . . . , τn),

(a) If τ is of an intensional type, M,Γ °v τ(τ1, . . . , τn) provided〈(v ∗ I ∗ Γ ∗ A)(τ1), . . . , (v ∗ I ∗ Γ ∗ A)(τn)〉 ∈ (v ∗ I ∗ Γ ∗ A)(τ,Γ).

(b) If τ is of an extensional type, M,Γ °v τ(τ1, . . . , τn) provided〈(v ∗ I ∗ Γ ∗ A)(τ1), . . . , (v ∗ I ∗ Γ ∗ A)(τn)〉 ∈ (v ∗ I ∗ Γ ∗ A)(τ).


2. M,Γ °v,A ¬Φ if it is not the case that M,Γ °v,A Φ.

3. M,Γ °v,A Φ ∧Ψ if M,Γ °v,A Φ and M,Γ °v,A Ψ.

4. For α of type t, M,Γ °v,A (∀α)Φ if M,Γ °v′,A Φ for every α-variant v′

of v such that v′(α) ∈ H(t).

5. M,Γ °v,A ¤Φ if M,∆ °v,A Φ for all ∆ ∈ G such that ΓR∆.

Finally, the following should be no surprise.

Definition 7.8.5 [Henkin/Kripke Model] 〈M,A〉 is a Henkin/Kripke modelprovided that, for each predicate abstract 〈λα1, . . . , αn.Φ〉 of L(C) of type ↑t,(v ∗ I ∗ Γ ∗ A)(〈λα1, . . . , αn.Φ〉) is the function f given by the following:

f(∆) = 〈O1, . . . , On〉 ∈ H(t) | M,∆ °v Φ[α1/O1, . . . , αn/On].

The various theorems concerning uniqueness of an abstraction designationfunction, if one exists, and the good behavior of substitution (Section 2.6) allcarry over to the modal setting. I leave this to you.

The semantics just presented is extensional, in the sense of Part I. A modalanalog of unrestricted Henkin models can also be developed, along the lines ofSection 2.5. Objects in the Henkin domains are no longer sets, and an explicitextension function must be added. The generalization is straightforward butcomplex, and I also leave this to you.

Chapter 8

Modal Tableaus

8.1 The Rules

There are several varieties of tableau rules for modal logic. This book uses aversion of prefixed tableaus. These incorporate a kind of naming mechanismfor possible worlds into the tableau mechanism, and do so in such a way thatsyntactic features of prefixes reflect semantic features of worlds. Prefixed tableausystems exist for most standard modal logics. Here I only give versions for Kand S5 since these are the extreme cases. I refer you to the literature formodifications appropriate for other modal logics—see (Fitting & Mendelsohn1998) for instance.

There are two versions of what are called prefixes. The version for K ismore complex, and variations on it also serve for many other modal logics. Theversion for S5 is simplicity itself.

Definition 8.1.1 [Prefix] A K prefix is a finite sequence of positive integers,written with periods as separators (1.2.1.1 is an example). An S5 prefix is asingle positive integer.

Think of prefixes as naming worlds in some (unspecified) model. Prefix structureis intended to embody information about accessibility between worlds. For K,think of the prefixes 1.2.1.1, 1.2.1.2, 1.2.1.3, etc. as naming worlds accessiblefrom the world that 1.2.1 names. For S5 one can take each world as beingaccessible from each world, so prefixes are simpler. Prefixes have two uses intableau proofs, qualifying formulas and qualifying terms. I begin with terms.

As was done classically, a larger language allowing parameters is used fortableau proofs, with parameters for each type. But in addition, an intensionalterm τ is allowed to have a prefix. If we think of σ as designating a possibleworld, we should think of σ τ as representing the extensional object that τ des-ignates at σ. Formally, if τ is of type ↑t, then σ τ is of type t. But writingprefixes in front of terms makes formulas even more unreadable than they al-ready are. Instead, in an abuse of language, I have chosen to write prefixes on

92

CHAPTER 8. MODAL TABLEAUS 93

terms as subscripts, τσ, though of course the idea is the same, and I still oftenrefer to them as prefixes. So, if one thinks of σ as designating possible world Γ,and τ as having the function f as its meaning, then τσ should be thought of asdesignating the object f(Γ).

By L+(C) is meant L(C) enlarged with parameters, and allowing prefixes(written as subscripts) on intensional terms including parameters of intensionaltype (they will not be needed on free variables that are not parameters). Inproving a closed formula of L(C), it is formulas of L+(C) that will appear inproofs.

I said prefixes had two roles. I now turn to the one that gave them theirname.

Definition 8.1.2 [Prefixed Formula] A prefixed formula is an expression of theform σΦ, where σ is a prefix and Φ is a formula of L+(C).

Think of σΦ as saying that formula Φ is true at the world that σ names.Note that this use of prefixes does not compound, that is, σΦ is a prefixedformula if Φ is a formula, and not something built up from prefixed formulas.

Definition 8.1.3 [Grounded] I call a term or a formula of L+(C) grounded ifit contains no free variables, though it may contain parameters.

As usual, tableau proofs are proofs of sentences—closed formulas—of L(C).In the tableau, prefixed grounded formulas of L+(C) may appear. To constructa tableau proof of Φ, begin with a tree that has 1¬Φ at its root, and nothingelse. Think of 1 as an arbitrary world. This initial tableau intuitively assertsthat Φ is false at some world of some model, the world designated by 1. Nextthe tree is expanded according to branch extension rules to be given below. Ifwe produce a tree that is closed, which means it embodies a contradiction, wehave a proof of Φ.

Propositional and quantifier branch extension rules are just as in the classicalcase, except that prefixes must be “carried along.” I give the rules explicitly,to make sure this is understood. In these, and throughout, I use σ, σ′, and thelike to stand for prefixes.

Definition 8.1.4 [Conjunctive Rules] For any prefix σ,

σX ∧ YσXσ Y

σ ¬(X ∨ Y )σ ¬Xσ ¬Y

σ ¬(X ⊃ Y )σXσ ¬Y

σX ≡ YσX ⊃ Yσ Y ⊃ X

Definition 8.1.5 [Double Negation Rule] For any prefix σ,

σ ¬¬XσX


Definition 8.1.6 [Disjunctive Rules] For any prefix σ,

σX ∨ YσX σ Y

σ ¬(X ∧ Y )σ ¬X σ ¬Y

σX ⊃ Yσ ¬X σ Y

σ ¬(X ≡ Y )σ ¬(X ⊃ Y ) σ ¬(Y ⊃ X)

This completes the classical connective rules. The motivation should beintuitively obvious. For instance, if X ∧ Y is true at a world named by σ, bothX and Y are true there, and so a branch containing σX ∧ Y can be extendedwith σX and σ Y .

Next come the modal rules. Naturally these differ between the two logicsbeing considered. It is here that the structure of prefixes plays a role. The ideais, if ♦X is true at a world, X is true at some accessible world, and we canintroduce a name—prefix—for this world. The name should be a new one, andthe prefix structure should reflect the fact that it is accessible from the worldat which ♦X is true.

Definition 8.1.7 [Possibility Rules for K] If the prefix σ.n is new to the branch,

σ ♦Xσ.nX

σ ¬¤Xσ.n¬X

Definition 8.1.8 [Possibility Rules for S5] If the positive integer n is new tothe branch,

σ ♦XnX

σ ¬¤Xn¬X

Notice that for both logics there is a newness condition. This implicitlytreats ♦ as a kind of existential quantifier. Correspondingly, the following rulestreat ¤ as a version of the universal quantifier.

Definition 8.1.9 [Necessity Rules for K] If the prefix σ.n already occurs onthe branch,

σ¤Xσ.nX

σ ¬♦Xσ.n¬X

Definition 8.1.10 [Necessity Rules for S5] For any positive integer n thatalready occurs on the branch,

σ¤XnX

σ ¬♦Xn¬X


Many examples of the application of these propositional rules can be foundin (Fitting & Mendelsohn 1998). I do not give any here.

For the existential quantifier rules, just as in the classical case, parametersmust be introduced. Thus proofs of sentences of L(C) are forced to be in thelarger language L+(C).

Definition 8.1.11 [Existential Rules] In the following, pt is a parameter oftype t that is new to the tableau branch.

σ (∃αt)Φ(αt)σΦ(pt)

σ ¬(∀αt)Φ(αt)σ ¬Φ(pt)

Terms of the form ↓τ may vary their denotation from world to world of amodel, because the extension of the intensional term τ can change from world toworld. Such terms should not be used when instantiating a universally quantifiedformula.

Definition 8.1.12 [Relativized Term] If τ is a grounded intensional term, ↓τis a relativized term.

Definition 8.1.13 [Universal Rules] In the following, τ t is any grounded termof type t that is not relativized.

σ (∀αt)Φ(αt)σΦ(τ t)

σ ¬(∃αt)Φ(αt)σ ¬Φ(τ t)

Now I give the rules for atomic formulas. The first rule essentially says that,at a world, an intensional predicate applies to terms if those terms are in theextension of the predicate at that world.

Definition 8.1.14 [Intensional Predication Rules] Let τ be a grounded inten-sional term, and τ1, . . . , τn be arbitrary grounded terms.

σ τ(τ1, . . . , τn)σ (↓τ)(τ1, . . . , τn)

σ ¬τ(τ1, . . . , τn)σ ¬(↓τ)(τ1, . . . , τn)

Relativized terms denote different objects in different worlds. In tableaus,their behavior depends on the prefix of the formula in which they appear. Thisleads us to the evaluation of relativized terms at prefixes. Think of τ@σ as τevaluated at σ. On non-relativized terms, such evaluation has no effect.

Definition 8.1.15 [Evaluation At a Prefix] Let σ be a prefix.

1. For a relativized term ↓τ , take (↓τ)@σ = τσ.

2. For a non-relativized term τ , take τ@σ = τ .

The next rule covers the case of an extensional predicate applying to terms.Essentially, it says we eliminate the relativized terms by evaluation.


Definition 8.1.16 [Extensional Predication Rules] Let τ be a grounded exten-sional term, and τ1, . . . , τn be arbitrary grounded terms.

σ τ(τ1, . . . , τn)σ (τ@σ)(τ1@σ, . . . , τn@σ)

σ ¬τ(τ1, . . . , τn)σ ¬(τ@σ)(τ1@σ, . . . , τn@σ)

Here is a simple example of how these rules work. Suppose A is of intensionaltype ↑〈0〉 and b is of type 0. If σ A(b) occurs on a branch, we may add σ (↓A)(b)by an Intensional Predication Rule. Now the Extensional Predication Ruleapplies; (↓A)@σ = Aσ and b@σ = b, so we may add σ Aσ(b). Think of thisas saying, since A(b) is true at the world that σ designates, then b is in theextension of A at that world.

There are atomic formulas that must evaluate the same way no matter whatworld is involved.

Definition 8.1.17 [World Independent] An atomic formula τ(τ1, . . . , τn) iscalled world independent if none of τ , τ1, . . . , τn is relativized, and τ is exten-sional.

Next is a rule that says sometimes the specific prefix does not really matter.

Definition 8.1.18 [World Shift Rules] Let τ(τ1, . . . , τn) be world independent.If σ′ already occurs on the branch,

σ τ(τ1, . . . , τn)σ′ τ(τ1, . . . , τn)

σ ¬τ(τ1, . . . , τn)σ′ ¬τ(τ1, . . . , τn)

Finally, rules intended to capture the meaning of predicate abstracts. Theycorrespond to Proposition 7.5.5. Note the presence of a prefix on the predicateabstract. We must know at what world the abstract is to be evaluated beforedoing so. Thus a previous application of an Extensional Predication Rule mustbe involved. And since this needs an extensional term, while predicate abstractsare intensional, a still prior application of Intensional Predication must be in-volved. Finally, σ and σ′ need not be the same—a World Shift Rule may alsohave been applied at some point.

Definition 8.1.19 [Predicate Abstract Rules] In the following, τ1, . . . , τn arenon-relativized terms.

σ′ 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉σ(τ1, . . . , τn)σΦ(τ1, . . . , τn)

σ′ ¬〈λα1, . . . , αn.Φ(α1, . . . , αn)〉σ(τ1, . . . , τn)σ ¬Φ(τ1, . . . , τn)

Finally what, exactly, constitutes a proof or a derivation.

Definition 8.1.20 [Closure] A tableau branch is closed if it contains σΨ andσ ¬Ψ, for some formula Ψ of L+(C).


Definition 8.1.21 [Tableau Proof] For a sentence Φ of L(C), a closed tableaubeginning with 1¬Φ is a proof of Φ.

In classical logic, when one says Φ follows semantically from a set S ofsentences, one means that Φ is true in all the models in which the members ofS are true. Modally things are more complex, since we not only have models,but possible worlds within them to deal with. Still, the semantical treatmentof local and global assumptions is sufficiently intuitive. Φ is said to followfrom a set S of global assumptions and a set U of local assumptions provided,for every modal model in which the members of S are true at every world,Φ is true at each world at which the members of U are true. An analysis ofthis notion, with special consideration to deduction theorems, can be found in(Fitting 1983, Fitting 1993, Fitting & Mendelsohn 1998). There is a notion ofderivation corresponding to this.

Definition 8.1.22 [Local and Global Assumptions] Let S and U be sets ofsentences of L(C). A tableau uses S as global assumptions and U as localassumptions if the following two tableau rules are admitted.

Local Assumption Rule If Y is any member of U then 1Y can be added tothe end of any open branch.

Global Assumption Rule If Y is any member of S then σ Y can be addedto the end of any open branch on which σ appears as a prefix.

Definition 8.1.23 [Tableau Derivation] A sentence Φ has a derivation fromglobal assumptions S and local assumptions U if there is a closed tableau be-ginning with 1¬Φ, allowing the use of U and S as local and global assumptionsrespectively.

This concludes the presentation of the basic tableau rules. It is a rathercomplex system. In Section 8.2 I give a few examples of proofs using the rules.I omit soundness and completeness proofs. The arguments are elaborations ofthose given earlier for classical logic. Complexity of presentation goes up, butno new ideas arise. Consequently they are left as a huge exercise.

There is one important consequence of the completeness proofs that we willneed, however, and that is the fact that the system has the cut-eliminationproperty—see Theorem4.3.2. It is a consequence of this that any previouslyproved result can simply be introduced into a tableau. The argument is simple.Suppose Φ has been given a tableau proof, and now, in a later tableau, we wishto introduce Φ onto a tableau branch (with

8.2 Tableau Examples

Tableaus for classical logic are well-known, and even for propositional modallogics they are rather familiar. The abstraction and predication rules of theprevious section are new, and I give two examples illustrating their uses. Theexamples use the K rules; I do not give examples specifically for S5.


Example 8.2.1 This provides a proof for (7.3) which was verified valid in Ex-ample 7.6.1. The formula is

〈λX.♦(∃x)X(x)〉(P ) ⊃ ♦〈λX.(∃x)X(x)〉(P )

in which x is a variable of type 0 and X is a variable and P a constant symbol,both of type ↑〈0〉.

1 ¬[〈λX.♦(∃x)X(x)〉(P ) ⊃ ♦〈λX.(∃x)X(x)〉(P )] 1.1 〈λX.♦(∃x)X(x)〉(P ) 2.1 ¬♦〈λX.(∃x)X(x)〉(P ) 3.1 ↓〈λX.♦(∃x)X(x)〉(P ) 4.1 〈λX.♦(∃x)X(x)〉1(P ) 5.1 ♦(∃x)P (x) 6.1.1 (∃x)P (x) 7.1.1¬〈λX.(∃x)X(x)〉(P ) 8.1.1¬ ↓〈λX.(∃x)X(x)〉(P ) 9.1.1¬〈λX.(∃x)X(x)〉1.1(P ) 10.1.1¬(∃x)P (x) 11.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by intensionalpredication; 5 is from 4 by extensional predication; 6 is from 5 by predicateabstraction; 7 is from 6 by a possibility rule; 8 is from 3 by a necessitation rule;9 is from 8 by intensional predication; 10 is from 9 by extensional predication;and 11 is from 10 by predicate abstraction.

It should be obvious that useful derived rules could be introduced. Forinstance, the passage from 2 to 4 to 5 to 6 could be collapsed. Such rules aregiven in the next section.

Example 8.2.2 Here is a proof of (7.13), which was shown to be valid earlier.

〈λX.♦(∃x)X(x)〉(↓P ) ⊃ 〈λX.(∃x)X(x)〉(↓P )

See Example 7.6.2 for a discussion of the significance of this formula.

1 ¬[〈λX.♦(∃x)X(x)〉(↓P ) ⊃ 〈λX.(∃x)X(x)〉(↓P )] 1.1 〈λX.♦(∃x)X(x)〉(↓P ) 2.1 ¬〈λX.(∃x)X(x)〉(↓P ) 3.1 ↓〈λX.♦(∃x)X(x)〉(↓P ) 4.1 ¬ ↓〈λX.(∃x)X(x)〉(↓P ) 5.1 〈λX.♦(∃x)X(x)〉1(P1) 6.1 ¬〈λX.(∃x)X(x)〉1(P1) 7.1 ♦(∃x)P1(x) 8.1 ¬(∃x)P1(x) 9.1.1 (∃x)P1(x) 10.1.1 P1(p) 11.1 P1(p) 12.1 ¬P1(p) 13.


In this, 2 and 3 are from 1 by a conjunction rule; 4 is from 2 and 5 is from 3 byintensional predication; 6 is from 4 and 7 is from 5 by extensional predication; 8is from 6 and 9 is from 7 by predicate abstraction; 10 is from 8 by a possibilityrule; 11 is from 10 by an existential rule; 12 is from 11 by a world shift rule;and 13 is from 9 by a universal rule.

Exercises

Exercise 8.2.1 Give a tableau proof of the following

〈λX.♦(∃x)X(x)〉(↓P ) ⊃ 〈λX.(∃x)X(x)〉(↓P )

where x is of type ↑0, X is of type 〈↑0〉 and P is of type ↑〈↑0〉.

Exercise 8.2.2 Give a tableau proof of the following

♦(∃x)P (x) ⊃ (∃X)♦P (↓X)

where x is of type 0, X is of type ↑0 and P is of type ↑〈0〉.

8.3 A Few Derived Rules

The tableau examples in the previous section are short, but already quite com-plicated to read. In the interests of keeping things relatively simple, a fewderived rules are introduced which serve to abbreviate routine steps.

Definition 8.3.1 [Derived Closure Rule] Suppose X is a world independentatomic formula. A branch closes if it contains σX and σ′ ¬X.

The justification for this is easy. Using the World Shift Rule, if σX is on abranch, we can add σ′X, and then the branch closes according to the officialclosure rule.

The official rule concerning intensional predication has a slightly more effi-cient version, in which we first apply intensional, then extensional predicationrules.

Definition 8.3.2 [Derived Intensional Predication Rule] Let τ be a groundedintensional term, and τ1, . . . , τn be arbitrary grounded terms.

σ τ(τ1, . . . , τn)σ τσ(τ1@σ, . . . , τn@σ)

σ ¬τ(τ1, . . . , τn)σ ¬τσ(τ1@σ, . . . , τn@σ)

Also here are two derived rules for predicate abstracts, one in which theabstract has a prefix (subscript), one in which it does not.


Definition 8.3.3 [Derived Subscripted Abstract Rule]In the following, τ1, . . . , τn are arbitrary grounded terms.

σ′ 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉σ(τ1, . . . , τn)σΦ(τ1@σ′, . . . , τn@σ′)

σ′ ¬〈λα1, . . . , αn.Φ(α1, . . . , αn)〉σ(τ1, . . . , τn)σ ¬Φ(τ1@σ′, . . . , τn@σ′)

This abbreviates the application of the extensional predication rule, followed bypredicate abstraction.

Definition 8.3.4 [Derived Unsubscripted Abstract Rule]In the following, τ1, . . . , τn are grounded terms.

σ 〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn)σΦ(τ1@σ, . . . , τn@σ)

σ ¬〈λα1, . . . , αn.Φ(α1, . . . , αn)〉(τ1, . . . , τn)σ ¬Φ(τ1@σ, . . . , τn@σ)

This rule abbreviates successive applications of intensional predication, exten-sional predication, and predicate abstraction.

Chapter 9

Miscellaneous Matters

This chapter is something of a grab-bag. Some familiar topics, like equality, andsome less familiar, like choice functions, are discussed.

9.1 Equality

The tableau rules of the previous section do not mention equality or extension-ality. These are treated exactly as in the classical setting, via axioms, thoughas we will see, extensionality requires some care.

9.1.1 Equality Axioms

If we want to take equality into account, we use the Equality Axioms, Defini-tion 5.1.1, as global assumptions. From here on these will be assumed withoutfurther comment.

In Chapter 5 I presented some tableau rules that were derivable providedequality axioms were allowed. In the modal setting these rules (with prefixesadded, of course) are also derived rules. They are stated again for reference.

Reflexivity Rule For a grounded, non-relativized term τ , and a prefix σ thatis already present on the branch,

σ (τ = τ)

Substitutivity Rule For grounded, non-relativized terms τ1 and τ2,

σΦ(τ1)σ (τ1 = τ2)σΦ(τ2)

Here is an example that uses equality. To help understand what the examplesays, and see why it ought to be valid, I give an informal interpretation for it.

101

CHAPTER 9. MISCELLANEOUS MATTERS 102

Suppose we read modal operators temporally, so that ¤X means X will bethe case no matter what the future brings, and ♦X means the future could turnout to be one in which X is true. Let p be a type ↑0 constant symbol intended tobe read, “the President of the United States.” Thus p is an individual concept,and designates different people in different possible futures.

Now, call a person Presidential material if the person could be President (saythe person meets all the legal requirements, such as being at least 35, not havingalready been elected twice, and so on). Being Presidential material is a propertyof persons. If we assume we have a model whose domain is the population of theUnited States, being Presidential material is a type ↑〈0〉 object and is expressedby the following abstract, where x is of type 0.

〈λx.♦(↓p = x)〉

Informally, this predicate applies to a person at a particular time if there issome possible future in which that person is the President of the United States.

Next, call a property of persons statesmanlike if it will always apply tothe President. Thus we are using statesmanlike as a property of properties ofpersons—being diplomatic is hopefully a statesmanlike property, for instance.As such, being statesmanlike is of type ↑〈〈0〉〉. It is expressed by the followingabstract, where X is of type 〈0〉.

〈λX.¤X(↓p)〉

Now, it is clear that the extension of the property of being Presidentialmaterial is a statesmanlike property since, no matter who turns out to be Pres-ident, that person was of Presidential material. The following gives a tableauverification for this.

Example 9.1.1 Here is a proof of the formula:

〈λX.¤X(↓p)〉(↓〈λx.♦(↓p = x)〉)

1 ¬〈λX.¤X(↓p)〉(↓〈λx.♦(↓p = x)〉) 1.1 ¬¤〈λx.♦(↓p = x)〉1(↓p) 2.1.1¬〈λx.♦(↓p = x)〉1(↓p) 3.1.1¬〈λx.♦(↓p = x)〉1(p1.1) 4.1 ¬♦(↓p = p1.1) 5.1.1¬(↓p = p1.1) 6.1.1¬(p1.1 = p1.1) 7.1.1 (p1.1 = p1.1) 8.

In this 2 is from 1 by the derived unsubscripted abstraction rule; 3 is from 2by a possibility rule; 4 is from 3 by extensional predication; 5 is from 4 by apredicate abstract rule; 6 is from 5 by a necessity rule; 7 is from 6 by extensionalpredication; 8 is by the derived reflexivity rule.


9.1.2 Extensionality

Extensionality can, of course, be imposed by assuming the Extensionality Ax-ioms of Chapter 6, Definition 6.1.1, as global assumptions. The trouble is, doingso for intensional terms yields undesirable results, as the following shows.

Proposition 9.1.2 Assume the Extensionality Axioms apply to intensionalterms. If α and β are of intensional type ↑〈t〉, then

(∀α)(∀β)[(↓α =↓β) ⊃ (α = β)]

The proof of this is left to you. It is almost immediate, using the IntensionalPredication Rules. The problem with this result is that it tells us that if twointensional objects happen to coincide at some world, then they are identicaland hence coincide at every world. Clearly this is undesirable, so extensionalityfor intensional terms is not assumed.

If two intensional objects agree at every possible world of a model, they are,in fact, the same. Saying this requires a quantification over possible worlds,which we cannot do. The following is as close as we can come.

Definition 9.1.3 [Extensionality for Intensional Terms] For α and β of thesame intensional type,

(∀α)(∀β)[¤(↓α =↓β) ⊃ (α = β)]

I will assume this at some points, but I will be explicit when.For extensional terms, the extensionality axioms pose no difficulty and will

always be assumed. I restate them here for convenience.

Definition 9.1.4 [Extensionality for Extensional Terms] Each sentence of thefollowing form is an extensionality axiom, where α and β are of type 〈t1, . . . , tn〉,γ1 is of type t1, . . . , γn is of type tn.

(∀α)(∀β)(∀γ1) · · · (∀γn)[α(γ1, . . . , γn) ≡ β(γ1, . . . , γn)] ⊃ [α = β]

In Chapter 6 a derived tableau rule for extensionality was given, assum-ing the extensionality axioms. Once again, it is still a derived rule for modaltableaus. Here is a statement of it.

Extensionality Rule For grounded, non-relativized extensional terms τ1 andτ2, and for parameters p1, . . . , pn that are new to the branch,

σ ¬ [τ1(p1, . . . , pn) ≡ τ2(p1, . . . , pn)] σ (τ1 = τ2)

9.2 De Re and De Dicto

Loosely speaking, asserting the necessary truth of a sentence is a de dicto usageof necessity. For example, “it is necessary that the President of the United


States is a citizen of the United States,” is a de dicto application of necessity. Itasserts the necessary truth of the sentence, “the President of the United Statesis a citizen of the United States.” For this to be the case, it must be so underall circumstances, no matter who is President, and since being a citizen of theUnited States is a requirement for the Presidency, this is the case. Ascribing toan object a necessary property is a de re usage. For example, “it is a necessarytruth, of the President of the United States, that he is at least 50 years old,” is ade re application of necessity. It asserts, of the President, that he is and alwayswill be at least 50 years old. Since the President, at the time of writing this, isBill Clinton, and he is at the moment 53 years old and will never be youngerthan this, this assertion is correct. But since the Constitution of the UnitedStates only requires that a President be at least 35, the assertion may not betrue in the future, with a different President. If an object is identified using anintensional term, it makes a serious difference whether that term is used in ade dicto or a de re context, as the examples involving the Presidency illustrate.In this section the formal relationships between the two notions is explored. Aswill be seen over the next several sections, this also relates to other interestingconcepts that have been part of historic philosophical discourse.

In what follows, β is of some extensional type t, and τ is of the correspondingintensional type ↑t.

Consider the expression 〈λβ.¤Φ(β)〉(↓τ), where Φ(β) is some formula withonly β free (for simplicity). Say the expression is true at a world of a modalmodel. (I use an unrestricted Henkin/Kripke model, but what is said appliesto any version—extensional, standard—just as well.) Thus suppose M,Γ °v,A〈λβ.¤Φ(β)〉(↓τ). Let O be the object that τ designates at Γ, that is, (v ∗ I ∗Γ ∗A)(τ,Γ) = O. Then we have M,Γ °v,A ¤Φ(β)[β/O]. So at every alternativeworld, Φ(β) is true of the object O that τ designates at Γ. The effect is that〈λβ.¤Φ(β)〉(↓τ) asserts, of the object designated by τ at Γ that it has a necessaryproperty. This is a de re use of necessity—applying a necessary property to athing.

Next consider the expression ¤〈λβ.Φ(β)〉(↓τ). This asserts the necessityof a sentence. It is a de dicto use of necessity—applying it to a sentence, adictum. And in general the behavior is quite different from the de re ver-sion. If M,Γ °v,A ¤〈λβ.Φ(β)〉(↓τ), then in each alternative world ∆ we haveM,∆ °v,A 〈λβ.Φ(β)〉(↓τ), and so M,∆ °v,A Φ(β)[w/O∆], where O∆ is thedesignation of τ at ∆, something that depends on ∆. We can thus think ofthe assertion ¤〈λβ.Φ(β)〉(↓τ) as being concerned with the sense of τ and notjust with the object it happens to denote in “our” world—we use the localdesignation of τ , which can vary from world to world.

One remarkable thing about de re and de dicto is that, if either happens toimply the other, for a particular term, then the two turn out to be equivalent forthat term. The following makes this precise. In the next section the phenomenais linked to the notion of rigidity.

Definition 9.2.1 [De Re/De Dicto] Let τ be a term of intensional type ↑t, βbe a variable of type t, and α be a variable of type 〈t〉. In a model:


1. de re is equivalent to de dicto for τ if the following valid.

(∀α)[〈λβ.¤α(β)〉(↓τ) ≡ ¤〈λβ.α(β)〉(↓τ)]

2. de re implies de dicto for τ if the following is valid.

(∀α)[〈λβ.¤α(β)〉(↓τ) ⊃ ¤〈λβ.α(β)〉(↓τ)]

3. de dicto implies de re for τ if the following is valid.

(∀α)[¤〈λβ.α(β)〉(↓τ) ⊃ 〈λβ.¤α(β)〉(↓τ)]

The formulas above are allowed to be open—free variables may be present.Equivalently, one can work with universal closures. In (Fitting & Mendelsohn1998) we used schemas instead of the formulas given above, because that wasa first-order treatment and we did not have the higher-type quantifier (∀α)available. The interesting fact about the three notions above is: they all say thesame thing.

Proposition 9.2.2 For any intensional term τ , the following are equivalent (inK).

1. de dicto is equivalent to de re for τ

2. de dicto implies de re for τ

3. de re implies de dicto for τ

Proof Obviously item 1 implies items 2 and 3. I give a tableau proof, in K,showing that item 2 implies item 3. A similar argument, which I leave to you,shows that item 3 implies item 2, and this is enough to complete the proof ofthe Proposition. To keep things simple, assume τ has no free variables. Here isa closed tableau for ¬(∀α)[〈λβ.¤α(β)〉(↓τ) ⊃ ¤〈λβ.α(β)〉(↓τ)], de re implies dedicto. In it, at a certain point, use is made of an instance of the de dicto impliesde re schema. The tableau begins as follows.

1 ¬(∀α) [〈λβ.¤α(β)〉(↓τ) ⊃ ¤〈λβ.α(β)〉(↓τ)] 1.1 ¬ [〈λβ.¤Φ(β)〉(↓τ) ⊃ ¤〈λβ.Φ(β)〉(↓τ)] 2.1 〈λβ.¤Φ(β)〉(↓τ) 3.1 ¬¤〈λβ.Φ(β)〉(↓τ) 4.1 ¤Φ(τ1) 5.1.1¬〈λβ.Φ(β)〉(↓τ) 6.1.1¬Φ(τ1.1) 7.1.1 Φ(τ1) 8.1 (∀α)[¤〈λβ.α(β)〉(↓τ) ⊃ 〈λβ.¤α(β)〉(↓τ)] 9.1 ¤〈λβ.〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(β)〉(↓τ)

〈λβ.¤〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(β)〉(↓τ) 10.


Item 2 is from 1 by an existential rule, using Φ as a new parameter; items 3 and4 are from 2 by a conjunctive rule; 5 is from 3 by an unsubscripted abstract rule;6 is from 4 by a possibility rule; 7 is from 6 by an unsubscripted abstract rule;8 is from 5 by a necessity rule. Item 9 is the de dicto implies de re formula; anditem 10 is from 9 by a universal rule, using 〈λγ.Φ(γ) ⊃ Φ(↓τ)〉 to instantiatethe quantifier.

Using item 10, the tableau splits into two branches. I first present the leftone, and afterward the right.

1 ¬¤〈λβ.〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(β)〉(τ) 11.1.2¬〈λβ.〈λγ.Φ(γ) ⊃ Φ(τ)〉(β)〉(↓τ) 12.1.2¬〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(τ1.2) 13.1.2¬[Φ(τ1.2) ⊃ Φ(↓τ)) 14.1.2 Φ(τ1.2) 15.1.2¬Φ(↓τ) 16.1.2¬Φ(τ1.2) 17.

Item 11 is from 10 by a disjunctive rule (recall, this is the left branch); 12 is from11 by a possibility rule; 13 is from 12 and 14 is from 13 by an unsubscriptedabstract rule; 15 and 16 are from 14 by a conjunctive rule; 17 is from 16 by anextensional predication rule. The branch is closed because of 15 and 17.

Now I show the right branch, below item 10.

1 〈λβ.¤〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(β)〉(↓τ) 18.1 ¤〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(τ1) 19.1.1 〈λγ.Φ(γ) ⊃ Φ(↓τ)〉(τ1) 20.1.1 Φ(τ1) ⊃ Φ(↓τ) 21.

@

@1.1¬Φ(τ1) 22. 1.1 Φ(↓τ) 23.

1.1 Φ(τ1.1) 24.

In this part, 18 is from 10 by a disjunctive rule; 19 is from 18 by an unsubscriptedabstract rule; 20 is from 19 by a necessity rule; 21 is from 20 by an unsubscriptedabstract rule; 22 and 23 are from 21 by a disjunctive rule; 24 is from 23 by anextensional predication rule. Closure is by 8 and 22, and by 7 and 24.

Exercises

Exercise 9.2.1 Give the tableau proof needed to complete the argument forProposition 9.2.2.


9.3 Rigidity

Kripke, in (Kripke 1980), discussed the philosophical ramifications of the notionof rigidity at some length, with a key claim being that names are rigid. Hissetting was first-order modal logic, treated informally. A term is taken to be rigidif it designates the same thing in all possible worlds. In (Fitting & Mendelsohn1998) we modified this notion somewhat so that a formal investigation couldmore readily be carried out—we called a term rigid if it designated the samething in any two possible worlds that were related by accessibility. The ideais that the behavior of a term in an unrelated world should have no “visible”effect. It is this modified notion of rigidity that is used here, and it will be seenthat it can be expressed directly if equality is available, that is, if we use normalmodels. (Whether they are standard, Henkin, or unrestricted Henkin does notmatter for what we are about to do, only that they are normal.) For the restof this section, normality is assumed.

Definition 9.3.1 The intensional term τ is rigid in a normal model if thefollowing is valid.

〈λβ.¤(β =↓τ)〉(↓τ)

It is easy to see that the formula asserting rigidity of τ is valid at a world Γof a normal model if and only if, at each world accessible from Γ, τ designatesthe same object that it designates at Γ itself. Thus asserting validity for therigidity formula indeed captures the notion of rigidity for terms that we have inmind.

If an intensional term is rigid, it does not matter in which possible world wedetermine its designation. But then, if both necessitation and designation bya rigid intensional term are involved in the same formula, it should not matterwhether we determine what the term designates before or after we move toalternative worlds when taking necessitation into account. In other words, forrigid intensional terms the de re/de dicto distinction should vanish. In fact itdoes, and as it happens, the converse is also the case. The following is a higherorder version of a first order argument from (Fitting & Mendelsohn 1998).

Proposition 9.3.2 In K, the intensional term τ is rigid if and only if the dere/de dicto distinction vanishes, that is, if and only if any (and hence all) partsof Proposition 9.2.2 hold.

Proof This is shown by proving two implications, using tableau rules for Kincluding rules for equality.

Let A be the formula 〈λβ.¤(β =↓τ)〉(↓τ) and let B be the formula(∀α)[¤〈λβ.α(β)〉(τ) ⊃ 〈λβ.¤α(β)〉(τ)]. A says τ is rigid, while B says de dictoimplies de re for τ . I first give a tableau proof of A ⊃ B.


1 ¬(A ⊃ B) 1.1 〈λβ.¤(β =↓τ)〉(↓τ) 2.1 ¬(∀α)[¤〈λβ.α(β)〉(↓τ) ⊃ 〈λβ.¤α(β)〉(↓τ)] 3.1 ¬[¤〈λβ.Φ(β)〉(↓τ) ⊃ 〈λβ.¤Φ(β)〉(↓τ)] 4.1 ¤〈λβ.Φ(β)〉(↓τ) 5.1 ¬〈λβ.¤Φ(β)〉(↓τ) 6.1 ¬¤Φ(τ1) 7.1.1¬Φ(τ1) 8.1.1 〈λβ.Φ(β)〉(↓τ) 9.1.1 Φ(τ1.1) 10.1 ¤(τ1 =↓τ) 11.1.1 (τ1 =↓τ) 12.1.1 τ1 = τ1.1 13.1.1¬Φ(τ1.1) 14.

In this tableau, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by anexistential rule, with Φ as a new parameter; 5 and 6 are from 4 by a conjunctiverule; 7 is from 6 by a derived unsubscripted abstract rule; 8 is from 7 by apossibility rule; 9 is from 5 by a necessity rule; 10 is from 9 and 11 is from 2by a derived unsubscripted abstract rule; 12 is from 11 by a necessity rule; 13is from 12 again by a derived unsubscripted abstract rule; and 14 is from 8 and13 by a derived substitutivity rule for equality.

Finally I give a tableau proof of B ⊃ A.

1 ¬(B ⊃ A) 1.1 (∀α)[¤〈λβ.α(β)〉(↓τ) ⊃ 〈λβ.¤α(β)〉(↓τ)] 2.1 ¬〈λβ.¤(β =↓τ)〉(↓τ) 3.1 ¤〈λβ.〈λγ. ↓τ = γ〉(β)〉(↓τ) ⊃ 〈λβ.¤〈λγ. ↓τ = γ〉(β)〉(↓τ) 4.1 ¬¤(τ1 =↓τ) 5.1.1¬(τ1 =↓τ) 6.1.1¬(τ1 = τ1.1) 7.

@

@1 ¬¤〈λβ.〈λγ. ↓τ = γ〉(β)〉(↓τ) 8. 1 〈λβ.¤〈λγ. ↓τ = γ〉(β)〉(↓τ) 14.1.2¬〈λβ.〈λγ. ↓τ = γ〉(β)〉(↓τ) 9. 1 ¤〈λγ. ↓τ = γ〉(τ1) 15.1.2¬〈λγ. ↓τ = γ〉(τ1.2) 10. 1.1 〈λγ. ↓τ = γ〉(τ1) 16.1.2¬(↓τ = τ1.2) 11. 1.1 (↓τ = τ1) 17.1.2¬(τ1.2 = τ1.2) 12. 1.1 τ1.1 = τ1 18.1.2 τ1.2 = τ1.2 13. 1.1¬(τ1 = τ1) 19.

1.1 τ1 = τ1 20.

In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by a universalrule, instantiating with the term 〈λγ. ↓τ = γ〉; 5 is from 3 by an unsubscripted


abstract rule; 6 is from 5 by a possibility rule; 7 is from 6 by an unsubscriptedabstract rule; 8 and 14 are from 4 by a disjunctive rule; 9 is from 8 by apossibility rule; 10 is from 9, and 11 is from 10 by an unsubscripted abstractrule; 12 is from 11 by an extensional predication rule; 13 is by reflexivity; 15 isfrom 14 by an unsubscripted abstract rule; 16 is from 15 by a necessity rule; 17is from 16 by an unsubscripted abstract rule; 18 is from 17 by an extensionalpredication rule; 19 is from 7 and 18 by substitutivity; and 20 is by reflexivity.

9.4 Stability Conditions

In his ontological argument Godel makes essential use of what he called “pos-itiveness,” which is a property of properties of things. He does not define thenotion, instead he makes various axiomatic assumptions concerning it. Amongthese are: if a property is positive, it is necessarily so; and if a property isnot positive, it is necessarily not positive. (His justification for these was thecryptic remark, “because it follows from the nature of the property.”) Supposewe use the second-order constant symbol P to represent positiveness, and takeit to be of type ↑〈↑〈0〉〉. Godel stated his conditions more or less as follows,with quantifiers implied: P(X) ⊃ ¤P(X) and ¬P(X) ⊃ ¤¬P(X). The secondof these is equivalent to ♦P(X) ⊃ P(X), and this form will be used in whatfollows. Positiveness is a second-order notion, but Godel’s conditions can beextended to other orders as well. I call the resulting notion stability, which isnot terminology that Godel used.

Definition 9.4.1 [Stability] Let τ be a term of type ↑〈t〉. τ satisfies the stabilityconditions in a model provided the following are valid in that model.

(∀α)[τ(α) ⊃ ¤τ(α)](∀α)[♦τ(α) ⊃ τ(α)]

The stability conditions come in pairs. In S5, however, these pairs collapse.

Proposition 9.4.2 In S5, (∀α)[τ(α) ⊃ ¤τ(α)] and (∀α)[♦τ(α) ⊃ τ(α)] areequivalent.

Proof Suppose (∀α)[τ(α) ⊃ ¤τ(α)]. Contraposition gives (∀α)[¬¤τ(α) ⊃¬τ(α)]. By necessitation and the converse Barcan formula, (∀α)¤[¬¤τ(α) ⊃¬τ(α)], and so (∀α)[¤¬¤τ(α) ⊃ ¤¬τ(α)], or equivalently, (∀α)[¤♦¬τ(α) ⊃¤¬τ(α)]. But in S5, X ⊃ ¤♦X is valid, hence we have (∀α)[¬τ(α) ⊃ ¤¬τ(α)].By contraposition again, (∀α)[¬¤¬τ(α) ⊃ ¬¬τ(α)], and hence (∀α)[♦τ(α) ⊃τ(α)]. The converse direction is similar.

In the stability conditions, τ is being predicated of other things. On theother hand, to say τ is rigid, or that the de re/de dicto distinction vanishesfor τ , involves other things being predicated of τ . Here is the fundamentalconnection between stability and earlier items.


Theorem 9.4.3 An intensional term τ is rigid if and only if it satisfies thestability conditions.

Proof This is most easily established using tableaus. And it is a good workout.I leave it to you to supply the details.

Exercises

Exercise 9.4.1 Complete the proof of Theorem 9.4.3 by giving appropriateclosed tableaus. Recall the derived extensionality rule given in Definition 6.2.1.

9.5 Definite Descriptions

As is well-known, Russell handled definite descriptions by translating them away,(Russell 1905). His familiar example, “The King of France is bald,” is handledby eliminating the definite description, “the King of France,” in context, toproduce the sentence “exactly one thing Kings France, and that thing is bald.”It is also possible to treat definite descriptions as first-class terms, making thema primitive part of the language. In (Fitting & Mendelsohn 1998) we showed howboth of these approaches extended to first-order modal logic. Further extendingthis to higher-order modal logic adds greatly to the complexity, so I confinethings to a Russell-style treatment here.

Suppose we have a formula Φ, and we form the expression ια.Φ, which isread as the α such that Φ, and is called a definite description. Syntactically itis treated like a term. Its free variables are those of Φ, except for α, and itstype is the type of α. In a more formal presentation, all this would have beenbuilt into the definition of term and formula given earlier, but doing so addsmuch complexity at the start of the subject, so I am taking the easier route ofexplaining now what could have been done.

Definition 9.5.1 [Description Designation] The definite description ια.Φ des-ignates, or is defined at possible world Γ of M = 〈G,R,H, I〉 if

M,Γ °v (∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)]

where β and δ are not free in Φ.

Next, the behavior of definite descriptions in context is treated in Rus-sell’s style. As he so famously noted, scope issues are fundamental. Thereis a difference between “the King of France is non-bald,” which is false sincethere is no King of France, and “it is not the case that the King of France isbald,” which is true. Formally, it is the difference between 〈λx.¬B(x)〉( ιy.K(y))and ¬〈λx.B(x)〉( ιy.K(y)). There is a similar distinction to be made between〈λx.¤B(x)〉( ιy.K(y)) and ¤〈λx.B(x)〉( ιy.K(y)) since definite descriptions gen-erally act non-rigidly, and so the de re/de dicto issue arises.


Note that in all the examples above, scope of a definite description was indi-cated by the use of a predicate abstract. Now 〈λx.¤B(x)〉( ιy.K(y)) is an atomicformula, as are 〈λx.B(x)〉( ιy.K(y)) and 〈λx.¬B(x)〉( ιy.K(y)). It is enough forus to specify how definite descriptions behave in atomic contexts, and everythingelse follows automatically. But even at the atomic level, a definite descriptioncan occur in a variety of ways. For instance, in τ0(τ1) either, or both, of τ0and τ1 could be descriptions. There are several ways of dealing with this, all ofwhich lead to equivalent results. I’ll use a Russell-style translation directly inthe simplest case, and reduce other situations to that.

Definition 9.5.2 [Descriptions In Atomic Context] Let ια.Φ be a definite de-scription, and let β and δ be variables of the same type as α, that do not occurfree in Φ or in any of the terms τi below.

1. τ0( ια.Φ) is an abbreviation for

(∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)] ∧ τ0(β).

2. τ0(τ1, . . . , ια.Φ, . . . , τn) is an abbreviation for

〈λβ.τ0(τ1, . . . , β, . . . , τn)〉( ια.Φ).

3. ( ια.Φ)(τ1, . . . , τn) is an abbreviation for

〈λβ.β(τ1, . . . , τn)〉( ια.Φ).

4. τ0(τ1, . . . , ↓( ια.Φ), . . . , τn) is an abbreviation for

〈λβ.τ0(τ1, . . . , ↓β, . . . , τn)〉( ια.Φ).

5. (↓ ια.Φ)(τ1, . . . , τn) is an abbreviation for

〈λβ.(↓β)(τ1, . . . , τn)〉( ια.Φ).

The definition above provides a routine for the elimination of definite de-scriptions. The problem is, there may be more than one way of following theroutine. For instance, consider the atomic formula ( ιx.A(x))( ιy.B(y)), whichcontains two definite descriptions. If we eliminate ( ιy.B(y)) first, beginningwith an application of part 1 of the definition, and then eliminate ( ιx.A(x)), wewind up with the following.

(∃z1)(∀z2)[〈λy.B(y)〉(z2) ≡ (z1 = z2)] ∧(∃z4)(∀z5)[〈λx.A(x)〉(z5) ≡ (z4 = z5)] ∧ 〈λz3.z3(z1)〉(z4) (9.1)

On the other hand, we might choose to eliminate ιx.A(x first, beginning withpart 3 of the definition. If so, after a few steps we wind up with the following.


(∃z2)(∀z3)[〈λx.A(x)〉(z3) ≡ (z2 = z3)] ∧〈λz1.(∃z4)(∀z5)[〈λy.B(y)〉(z5) ≡ (z4 = z5)] ∧ z1(z4)〉(z2) (9.2)

Fortunately, (9.1) and (9.2) are equivalent. In general, the elimination procedureis confluent—different reduction sequences for the same atomic formula alwayslead to equivalent results.

In a sense there are two kinds of definite descriptions, intensional and ex-tensional, depending on the type of the variable α in ια.Φ. Extensional definitedescriptions are rather well-behaved, and I say little about them, but for inten-sional ones, some interesting issues can be raised. In Definition 9.3.1 I defineda formal notion of rigidity. That definition can be extended to definite descrip-tions: call ια.Φ rigid at a world if the following is true at that world.

〈λβ.¤(β =↓( ια.Φ))〉(↓( ια.Φ)).

Semantically speaking, to say this is true at a world Γ amounts to saying: ια.Φdesignates at world Γ, ια.Φ designates at all worlds accessible from Γ, and atΓ and every world accessible from it, ια.Φ designates the same thing. Thefollowing Proposition makes this precise.

Proposition 9.5.3 The formula 〈λβ.¤(β =↓( ια.Φ))〉(↓( ια.Φ)) is equivalent inK to the conjunction of the following three formulas.

1. (∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)]

2. (∀β)[〈λα.Φ〉(β) ⊃ ¤〈λα.Φ〉(β)]

3. (∀β)[♦〈λα.Φ〉(β) ⊃ 〈λα.Φ〉(β)].

In other words, this Proposition says ( ια.Φ) is rigid if and only if ( ια.Φ)designates and 〈λα.Φ〉 satisfies the stability conditions.

Exercises

Exercise 9.5.1 Show the equivalence of (9.1) and (9.2). (Classical tableauscould be used, since modal operators do not explicitly appear.)

Exercise 9.5.2 Use K tableaus to prove Proposition 9.5.3. (This is a longexercise.)

9.6 Choice Functions

In a Henkin/Kripke model, not all objects of a standard model need be present.We need some mechanism to ensure that many are, so non-standard modelshave a sufficiently rich universe. Abstraction provides one way of doing this. If


Φ is a formula, there must be an intensional object in a Henkin/Kripke modelto serve as the designation for 〈λα.Φ〉, and so there must be extensional objectsto supply the designations for ↓〈λα.Φ〉 at each particular world. But for somepurposes this is still not enough. In effect, the example just given starts withan intensional object, and moves to extensional objects derivatively. We needsome machinery for moving in the other direction as well.

Suppose, in a Henkin/Kripke model, we have somehow picked out an exten-sional object of the same type at each world—say we call the object we chooseat world Γ, OΓ. It seems plausible that there should be an intensional object:the chosen object. That is, there should be an intensional object f whose value,at each world Γ, is the object OΓ. More generally, suppose at each world wehave selected a non-empty set of extensional objects, all of the same type. Sayat world Γ we select the set SΓ. Again it seems plausible that there should be anintensional object—a selected object—an mapping f whose value at each worldΓ is some member of SΓ.

Given the formal machinery up to this point, the existence of the intensionalobjects posited above cannot be guaranteed. (At least, I believe this to be thecase. I do not have a proof.) To postulate existence of such intensional objectsusing some sort of axiom requires quantification over possible worlds, which wecannot do, but we can approximate to it by use of the ¤ operator. What wewind up with is the following postulate, which I call a choice axiom because,in effect, it posits the existence of choice functions in the standard set-theoreticsense.

Definition 9.6.1 [Choice Axiom] Let t be an extensional type, and let α be oftype 〈t〉, β be of type t, and γ be of type ↑t. The following is the choice axiomof type t.

(∀α)[¤(∃β)α(β) ⊃ (∃γ)¤α(↓γ)

Informally, the axiom says that if, at each world the set of things such thatα is non-empty—¤(∃β)α(β)—then there is a choice function γ that picks outsomething such that α at each world—(∃γ)¤α(↓γ). I give one example ofa Choice Axiom application. Suppose α is an extensional variable, and ια.Φdesignates in every possible world. That is, in each possible world, the Φ ismeaningful. Then, plausibly, there should be an intensional object that, ineach world, designates the thing that is the Φ of that world—that is, the term

ιζ.¤〈λα.Φ〉(↓ζ) should also designate. More loosely, the Φ concept should alsodesignate. Recall, Definition 9.5.1 says what it means for a definite descriptionto designate, and since 〈λζ.¤〈λα.Φ〉(↓ζ)〉(η) ≡ ¤〈λα.Φ〉(↓η), things can besimplified a little.

Proposition 9.6.2 Assume the Choice Axiom (Definition 9.6.1) and Exten-sionality for Intensional Terms (Definition 9.1.3). Assume α, β, and δ are ofextensional type t, and γ and η are of type ↑t. The following is valid in all Kmodels.

¤(∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)] ⊃ (∃γ)(∀η)[¤〈λα.Φ〉(↓η) ≡ (γ = η)]


Proof Assume ¤(∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)] is true at a possible world. Ishow that (∃γ)(∀η)[¤〈λα.Φ〉(↓η) ≡ (γ = η)] must also be true there. Start with

¤(∃β)(∀δ)[〈λα.Φ〉(δ) ≡ (β = δ)] (9.3)

which is equivalent to

¤(∃β)〈λα.Φ〉(β) ∧ (∀δ)[〈λα.Φ〉(δ) ⊃ (β = δ)]. (9.4)

Instantiating the universal quantifier in the choice axiom with

〈λη.〈λα.Φ〉(η) ∧ (∀δ)[〈λα.Φ〉(δ) ⊃ (η = δ)]〉

(9.4) implies

(∃γ)¤〈λα.Φ〉(↓γ) ∧ (∀δ)[〈λα.Φ〉(δ) ⊃ (↓γ = δ)] (9.5)


(∃γ)¤〈λα.Φ〉(↓γ) ∧¤(∀δ)[〈λα.Φ〉(δ) ⊃ (↓γ = δ)]. (9.6)

Since the Barcan and converse Barcan formulas are valid in the semantics, thisis equivalent to

(∃γ)¤〈λα.Φ〉(↓γ) ∧ (∀δ)¤[〈λα.Φ〉(δ) ⊃ (↓γ = δ)]. (9.7)

This, in turn, implies the following formula. I leave the justification to you.

(∃γ)¤〈λα.Φ〉(↓γ) ∧ (∀η)¤[〈λα.Φ〉(↓η) ⊃ (↓γ =↓η)]. (9.8)

Using distributivity of necessity over implication, this implies

(∃γ)¤〈λα.Φ〉(↓γ) ∧ (∀η)[¤〈λα.Φ〉(↓η) ⊃ ¤(↓γ =↓η)] (9.9)

and using Extensionality for Intensional Terms, this implies

(∃γ)¤〈λα.Φ〉(↓γ) ∧ (∀η)[¤〈λα.Φ〉(↓η) ⊃ (γ = η)] (9.10)


(∃γ)(∀η)[¤〈λα.Φ〉(↓η) ≡ (γ = η)] (9.11)

and we are done.


Exercises

Exercise 9.6.1 Give tableau proofs of the Barcan formula, and of the converseBarcan formula.

Exercise 9.6.2 Give a tableau proof to show (9.7) implies (9.8).

Part III

Ontological Arguments

116

Chapter 10

Ontological Arguments, ABrief History

10.1 Introduction

There are many directions from which people have tried to prove the existenceof God. There have been arguments based on design: a complex universe musthave had a designer. There have been attempts to show the existence of anethical sense implies the existence of God. There have been arguments basedon causality: trace the chain of effect and cause backward and one must reach afirst cause. Ontological arguments seek to establish the existence of God basedon pure logic: the principles of reasoning require that God be part of onesontology. It does not matter if such arguments have holes. Religious belief, likemuch that is fundamentally human, is not really the product of reason. We areemotional animals, and one of the uses of proof, in the various senses above, isto sway emotion. Proof is often just a rhetorical device, one among many.

But this takes us too far afield. Here we are interested in ontological argu-ments only. Independently of whether one believes their conclusion to be true,the logical machinery used in such arguments is often ingenious, and meritsserious study. It is generally accepted that such arguments contain flaws, butsaying exactly where the flaw lies is not easy, and is subject to controversy.It happens that different analyses of the same argument will locate an error atdifferent points. Often this happens because the notions involved in a particularontological argument are vague and subject to interpretation. Godel’s ontolog-ical argument is rather unique in that it is entirely precise—the premises areclearly set forth, and the reasoning can be formalized. But we will see that heretoo there is room for interpretation, and things are not as clear as they firstseem.

117

CHAPTER 10. ONTOLOGICAL ARGUMENTS, A BRIEF HISTORY 118

10.2 Anselm

Historically, the first ontological argument is that of St. Anselm (1033 – 1109),given in his book Proslogion. A detailed examination of his argument can befound in (Hartshorne 1965). Here is the argument itself, in a somewhat technicaltranslation from (Charlesworth 1979).

Even the Fool, then, is forced to agree that something-than-which-nothing-greater-can-be-thought exists in the mind, since heunderstands this when he hears it, and whatever is understood is inthe mind. And surely that-than-which-a-greater-cannot-be-thoughtcannot exist in the mind alone. For if it exists solely in the mindeven, it can be thought to exist in reality also, which is greater.If then that-than-which-a-greater-cannot-be-thought exists in themind alone, this same that-than-which-a-greater-cannot-be-thoughtis that-than-which-a-greater-can-be-thought. But this is obviouslyimpossible. Therefore there is absolutely no doubt that something-than-which-a-greater-cannot-be-thought exists both in mind and inreality.

Put into more modern terms, Anselm defined God to be a maximally conceiv-able being. This term—maximally conceivable being—must denote something,since “whatever is understood is in the mind.” But a maximally conceivable be-ing must have the property of existence, because if it did not, we could conceiveof a greater being, namely one that also had the existence property.

My understanding of this is that, read with some charity, it shows the phrase“maximally conceivable being,” if it designates anything, must designate some-thing that exists. The flaw lies in the failure to properly verify that the phrasedesignates at all—to show it is not in the same category as “the round square.”Indeed, Anselm’s way of justifying this, by claiming that it exists in the mind,is exactly what was attacked by his contemporary Gaunilo, in his counter-argument, A Reply on Behalf of the Fool. A modern translation of this canalso be found in (Charlesworth 1979).

Anselm’s argument was the ancestor of various later versions, all of whichinvolve some notion of maximality. An easily accessible discussion of the familyof ontological arguments in general is in the on-line Stanford Encyclopedia ofPhilosophy (Oppy 1996), and (Oppy 1995, Plantinga 1965) are recommendedas more detailed studies.

10.3 Descartes

Descartes (1598 – 1650) gave several different ontological arguments. Here isone version, in which he defines God to be a being whose necessary existence ispart of the definition. It is from the Appendix to The Principles of Philosophy,(Descartes 1951). I omit the Definitions and Axioms to which the quote refers.


Proposition I

The existence of God is known from the consideration of hisnature alone.

Demonstration

To say that an attribute is contained in the nature or in theconcept of a thing is the same as to say that this attribute is true ofthis thing, and that it may be affirmed to be in it (Definition IX).

But necessary existence is contained in the nature or in the con-cept of God (by Axiom X).

Hence it may with truth be said that necessary existence is inGod, or that God exists.

Here is another version of the same argument, this time from The Meditations,book V, (Descartes 1951).

. . . because I cannot conceive God unless as existing, it followsthat existence is inseparable from him, and therefore that he reallyexists; not that this is brought about by my thought, or that itimposes any necessity on things, but, on the contrary, the necessitywhich lies in the thing itself, that is, the necessity of the existence ofGod, determines me to think in this way, for it is not in my power toconceive a God without existence, that is a being supremely perfect,and yet devoid of an absolute perfection, as I am free to imagine ahorse with or without wings.

The underlying idea in this argument is starkly simple: God is the mostperfect being, the being having all perfections, and among these is necessaryexistence. Put a little differently, necessary existence is part of the essence ofGod. And here we have reached an ontological argument that can be easilyformalized. Recall the discussion in Chapter 7, Section 7.3. The type-0 objectsare possibilist—they are the same from world to world, and represent what mightexist, not what does. If we want to relativize things to what actually exists,we need a type-〈0〉 “existence” predicate, E, about which nothing special needbe postulated at this point. Now, suppose we define God to be the necessarilyexistent being, that is, the being g such that ¤E(g). If such a being exists, itmust satisfy its defining property, and hence we have

E(g) ⊃ ¤E(g). (10.1)

Given (10.1), using the rule of necessitation, we have the following.

¤[E(g) ⊃ ¤E(g)] (10.2)

From (10.2), using the K principle ¤(P ⊃ Q) ⊃ (♦P ⊃ ♦Q) we have thenext implication.

♦E(g) ⊃ ♦¤E(g) (10.3)


Finally we use something peculiar to S5 (and some slightly weaker logics, apoint of no importance here). The principle needed is ♦¤P ⊃ ¤P , and so from(10.3) we have the following.

♦E(g) ⊃ ¤E(g) (10.4)

We thus have a proof that God’s existence is necessary, if possible. And forDescartes, God’s existence is possible because possibility is identified with con-ceivability, and Descartes simply takes it for granted that God is conceivable.

Russell’s treatment of definite descriptions applies quite well in a modalsetting—Chapter 9, Section 9.5. The use of g above was an informal way ofavoiding a formal definite description—note that I gave no real proof for (10.1).Let us recast the argument using definite descriptions—the necessarily existentbeing is ια.¤E(α) and I assume g is an abbreviation for this type-0 term. Now(10.1) unabbreviates to the following.

E( ια.¤E(α)) ⊃ ¤E( ια.¤E(α)). (10.5)

This is not a valid formula of K, but that logic is too weak anyway, given thestep from (10.3) to (10.4) above. But (10.5) is valid in S5, a fact I leave to youas an exercise. In fact, using S5, the entire argument above is entirely correct!

The real problem with the Descartes argument lies in the assumption thatGod’s existence is possible. In S5 both ¤E(g) ⊃ E(g) and E(g) ⊃ ♦E(g) aretrivially valid. Since ♦E(g) ⊃ ¤E(g) has been shown to be valid, we havethe equivalence of E(g), ♦E(g), and ¤E(g)! Thus, assuming God’s existenceis possible is simply equivalent to assuming God exists. This is an interestingconclusion for its own sake, but as an argument for the existence of God, it isunconvincing.

Exercises

Exercise 10.3.1 Give an S5 tableau proof of the following, where P and Qare type-〈0〉 constant symbols.

P ( ια.¤Q(α)) ⊃ ¤Q( ια.¤Q(α))

From this it follows that (10.5) is valid in S5.

Exercise 10.3.2 Construct a model to show

E( ια.¤E(α)) ⊃ ¤E( ια.¤E(α)).

is not valid in K.

Exercise 10.3.3 Formula 10.5 can also be written as

〈λβ.E(β)〉( ια.¤E(α)) ⊃ ¤〈λβ.E(β)〉( ια.¤E(α))


which, by the previous exercise, is not K valid. Show the following variant isvalid (a K tableau proof is probably easiest).

〈λβ.E(β)〉( ια.¤E(α)) ⊃ 〈λβ.¤E(β)〉( ια.¤E(α))

Exercise 10.3.4 Show why the valid K formula of Exercise 10.3.3 can not beused in a Descartes-style argument.

10.4 Leibniz

Leibniz (1646 – 1716) accepted the Descartes argument, discussed at length inthe previous section, as being correct as far as it went. But he also clearly identi-fied the critical issue: one must establish the possibility of God’s existence. Thefollowing is from Two Notations for Discussion with Spinoza, (Leibniz 1956).

Descartes’ reasoning about the existence of a most perfect beingassumed that such a being can be conceived or is possible. If it isgranted that there is such a concept, it follows at once that thisbeing exists, because we set up this very concept in such a way thatit at once contains existence. But it is asked whether it is in ourpower to set up such a being, or whether such a concept has realityand can be conceived clearly and distinctly, without contradiction.For opponents will say that such a concept of a most perfect being,or a being which exists through its essence, is a chimera. Nor doesit suffice for Descartes to appeal to experience and allege that heexperiences this very concept in himself, clearly and distinctly. Thisis not to complete the demonstration but to break it off, unless heshows a way in which others can also arrive at an experience of thiskind. For whenever we inject experience into our demonstrations, weought to show how others can produce the same experience, unlesswe are trying to convince them solely through our own authority.

Leibniz’s remedy amounted to an attempt to prove that God’s existence ispossible, where God is defined to be the being having all perfections—again amaximality notion. Intuitively, a perfection is an atomic property that is, insome sense, good to have, positive. Leibniz based his proof on the compatibilityof all perfections, from which he took it to follow that all perfections couldreside in a being—God’s existence is possible. Here is another quote from TwoNotations for Discussion with Spinoza, (Leibniz 1956).

By a perfection I mean every simple quality which is positiveand absolute or which expresses whatever it expresses without anylimits. But because a quality of this kind is simple, it is unanalyzableor indefinable . . . . From this it is not difficult to show that allperfections are compatible with each other or can be in the samesubject.


Leibniz goes on to provide a detailed proof of the compatibility of all perfections,though it is not a proof in any modern sense. Indeed, it is not clear how a properproof could be given at all, using the vague notion of perfection presented above.I omit his proof here. The point for us is that, as we will see, precisely this pointis central to Godel’s argument as well.

10.5 Godel

Godel (1906 – 1978) was heir to the profound developments in mathematics ofthe late nineteenth and early twentieth centuries, which often involved moves togreater degrees of abstraction. In particular, he was influenced by David Hilbertand his school. In the tradition of Hilbert’s book, Foundations of Geometry,Godel avoided Leibniz’s problems completely, by going around them. It is as ifhe said, “I don’t know what a perfection is, but based on my understanding of itintuitively, it must have certain properties,” and he proceeded to write out a listof axioms. This neatly divides his ontological argument into two parts. First,based on your understanding, do you accept the axioms. This is an issue ofpersonal intuitions and is not, itself, subject to proof. Second, does the desiredconclusion follow from the axioms. This is an issue of rigor and the use of formalmethods, and is what will primarily concern us here.

Godel’s particular version of the argument is a direct descendent of that ofLeibniz, which in turn derives from one of Descartes. These arguments all havea two-part structure: prove God’s existence is necessary, if possible; and proveGod’s existence is possible.

Godel worked on his ontological argument over many years. According to(Adams 1995), there is a partial version in his papers dated about 1941. In1970, believing he would die soon, Godel showed his proof to Dana Scott. In factGodel did not die until 1978, but he never published on the matter. Informationabout the proof spread via a seminar conducted by Dana Scott, and his slightlydifferent version became public knowledge.

Scott’s version of the proof was published in (Scott 1987). Godel’s originalversion appeared in (Sobel 1987), based on a few pages of Godel’s handwrittennotes. Scott also wrote some brief notes, based on his conversation with Godel,and (Sobel 1987) provides these as well. In fact, (Sobel 1987) has served assomething of a Bible (pun intended) for the Godel ontological argument. Finallythe publication of Godel’s collected works has brought a definitive version beforethe public, (Godel 1970). Still, the notion of a definitive version is rather elusivein this case. Godel’s manuscript provides almost no explanation or motivation.It amounts to an invitation to others to elaborate.

Godel’s argument is modal and at least second-order, since in his definitionof God there is an explicit quantification over properties. Work on the Kripkesemantics of modal logic was relatively new at the time Godel wrote his notes,and the complexity of quantification in modal contexts was perhaps not wellappreciated. Consequently, the exact logic Godel had in mind is unclear.

Subsequently several people took up the challenge of putting the Godel argu-


ment on a firm foundation and exposing any hidden assumptions. (Sobel 1987),playing Gaunilo to Godel’s Anselm, showed the argument could be applied toprove more than one would want. I’ll discuss this point in the next Chapter.(Anderson & Gettings 1996) showed that one could view a part of the argumentnot as second-order, but as third-order. Many others contributed, among whichI mention (Anderson 1990, Hajek 1996a). The present Chapter can be thoughtof as part of the continuing tradition of explicating Godel. People have gener-ally used the second-order modal logic of (Cocchiarella 1969), sometimes ratherinformally.

10.6 Godel’s Argument, Informally

Before we get to precise details in the next Chapter, it would be good to runthrough Godel’s argument informally to establish the general outline, since it isconsiderably more complex than the versions we have seen to this point.

To begin with, Godel takes over the notion of perfection, but with somechanges. For Leibniz, perfections were atomic properties, and any combinationof them was compatible and thus could apply to some object. They could befreely combined, a little like the atomic facts about the world that one finds inWittgenstein’s Tractatus. Since this is the case, why not form a new collection,consisting of all the various combinations of perfections, each combination ofwhich Leibniz considers possible. Godel found it convenient to do this, andcalled the resulting notion positiveness. Thus we should think of a positiveproperty, in Godel’s sense, as some conjunction of perfections in Leibniz’s sense.At least, I am assuming this to be the case—Godel says nothing explicit aboutthe matter.

The most notable difference between Godel and Leibniz is that, where Leib-niz tried to use what are essentially informal notions in a rigorous way, Godelintroduces formal axioms concerning them. Here are Godel’s axioms, and hisargument, set forth in everyday English. A formalized version will be foundin the next Chapter. The Godel argument has the familiar two-part structure:God’s existence is possible; and God’s existence is necessary, if possible. I’lltake these in order.

I’ll begin with the axioms for positiveness. The first is rather strong. (Axiomnumbering is not that of Godel.)

Informal Axiom 1 Exactly one of a property or its complement is positive.

It follows that there must be positive properties. If we call a property neg-ative if it is not positive, it also follows that there are negative properties. ByInformal Axiom 1, a negative property can also be described as one whose com-plement is positive.

Suppose we say property P entails property Q if, necessarily, everythinghaving P also has Q.

Informal Axiom 2 Any property entailed by a positive property is positive.


This brings us to our first interesting result.

Informal Proposition 1 Any positive property is possibly instantiated. Thatis, if P is positive, it is possible that something has property P .

Proof Suppose P is positive. Let N be some negative property (the comple-ment of P will do). It cannot be that P entails N , or else N would be positive.So it is not necessary that everything having P has N , that is, it is possible thatsomething has P without having N . So it is possible that something has P .

Next, Godel simply takes the compatibility of perfections, which Leibnizattempted to prove, as an axiom. We will see later on that this is a problematicassumption.

Informal Axiom 3 The conjunction of any collection of positive properties ispositive.

Now Godel defines God, or rather, defines the property of being Godlike,essentially the same way Leibniz did.

Informal Definition 1 A God is any being that has every positive property.

This gives us part one of the argument rather easily.

Informal Proposition 2 It is possible that a God exists.

Proof By Informal Axiom 3, the conjunction of all positive properties is apositive property. But by Definition 1, this property—maximal positiveness—iswhat makes one a God. Since the property is positive, it is possibly instantiated,by Informal Proposition 1.

There are also a few technical assumptions concerning positiveness, whoserole is not apparent in the informal presentation given here. Their significancewill be seen when we come to the formalization in the next Chapter. They areas follows.

Informal Axiom 4 Any positive property is necessarily so, and any negativeproperty is necessarily so.

Now we move on to the second part of the argument, showing God’s exis-tence is necessary, if possible. Here Godel’s proof is quite different from that ofDescartes, and rather ingenious. To carry out the argument, Godel introducesa pair of notions that are of interest in their own right.

Informal Definition 2 A property G is the essence of an object g if:

1. g has property G;

2. G entails every property of g.


Strictly speaking, in the definition above I should have said an essence ratherthan the essence, but it is an easy argument that essences are unique, if theyexist at all. Very simply, if an object g had two essences, P and Q, each wouldbe a property of g by part 1, and then each would entail the other by part 2.Godel does not, in general, assume that objects have essences, but for an objectthat happens to be a God, there is a clear candidate for the essence.

Informal Proposition 3 If g is a God, the essence of g is being a God.

Proof Let’s state what we must show a little more precisely. Suppose G is theconjunction of all positive properties, so having property G is what it means tobe a God. It must be shown that if an object g has property G, then G is theessence of g.

Suppose g has property G. Then automatically we have part 1 of InformalDefinition 2.

Suppose also that P is some property of g. By Informal Axiom 1, if P werenot positive its complement would be. Since g has all positive properties, gthen would have the property complementary to P . Since we are assuming ghas P itself, we would have a contradiction. It follows that P must be positive.Since G is the conjunction of all positive properties, clearly G entails P . SinceP was arbitrary, G entails every property of g, and we have part 2 of InformalDefinition 2.

Here is the second of Godel’s two new notions.

Informal Definition 3 An object g has the property of necessarily existing ifthe essence of g is necessarily instantiated.

And here is the last of Godel’s axioms.

Informal Axiom 5 Necessary existence, itself, is a positive property.

Informal Proposition 4 If a God exists, a God exists necessarily.

Proof Suppose a God exists, say object g is a God. Then g has all positiveproperties, and these include necessary existence by Informal Axiom 5. Thenthe essence of g is necessarily instantiated, by Informal Definition 3. But theessence of g is being a God, by Informal Proposition 3. Thus the property ofbeing a God is necessarily instantiated.

Now we present the second part of the ontological proof.

Informal Proposition 5 If it is possible that a God exists, it is necessary thata God exists (assuming the logic is S5).

Proof In any modal logic at least as strong as K, if P ⊃ Q is valid, so is♦P ⊃ ♦Q. Then by Informal Proposition 4, if it is possible that a God exists,it is possibly necessary that a God exists. In S5, ♦¤P ⊃ ¤P is valid, and theconclusion follows.


Finally, by Informal Propositions 2 and 5, we have our conclusion.

Informal Theorem 6 Assuming all the axioms, and assuming the underlyinglogic is S5, a God necessarily exists.

One final remark before moving on. I’ve been referring to a God, ratherthan to the God. As a matter of fact, uniqueness is easy to establish. Let Gbe the property of being Godlike—the maximal positive property—and supposeboth g1 and g2 possess this property. By Informal Proposition 3, G must bethe essence of both g1 and g2. Now, if P is any property of g1, G must entailP , by part 2 of Informal Definition 2. Since G is a property of g2, by part 1of the same Informal Definition, P must also be a property of g2. Similarly,any property of g2 must be a property of g1. Since g1 and g2 have the sameproperties, they are identical.

This concludes the informal presentation of Godel’s ontological argument.It is clear it is of a more complex nature than those that historically precededit. But an informal presentation is simply not enough. God is in the details,so to speak, and details demand a formal approach. In the next Chapter I’llgo through the argument again, more slowly, working things through in theintensional logic developed earlier in Part II.

Exercises

Exercise 10.6.1 Show that only God can have a positive essence. (This exer-cise is due to Ioachim Teodora Adelaida of Bucharest.)

Chapter 11

Godel’s Argument,Formally

11.1 General Plan

The last Chapter ended with an informal presentation of Godel’s argument.This one is devoted to a formalized version. I’ll also consider some objectionsand modifications. There are two kinds of objections. One amounts to sayingthat Godel committed the same fallacy Descartes did: assuming somethingequivalent to God’s existence. Nonetheless, again as in the Descartes case, muchof the argument is of interest even if it falls short of the desired conclusion. Thesecond kind of objection is that Godel’s axioms are too strong, and lead to acollapse of the modal system involved. Various extensions and modifications ofGodel’s axioms have been proposed, to avoid this modal collapse. I’ll discussthese, and propose a modification of my own. Now down to details, with theproof of God’s possible existence coming first. I will not try to match thenumbering of the informal axioms in the last chapter, but I will refer to themwhen appropriate.

11.2 Positiveness

God, if one exists, will be taken to be an object of type 0. We are interested inthe intentional properties of this object, properties of type ↑〈0〉. Among theseproperties are those Godel calls positive, and which we can think of as conjunc-tive combinations of Leibniz’s perfections. At least that is how I understandpositiveness. Godel’s ideas on the subject are given almost no explanation inhis manuscript—here is what is said, using the translation of (Godel 1970).

Positive means positive in the moral aesthetic sense (indepen-dently of the accidental structure of the world). Only then [are]

127

CHAPTER 11. GODEL’S ARGUMENT, FORMALLY 128

the axioms true. It may also mean pure ‘attribution’ as opposed to‘privation’ (or containing privation).

This is not something I profess to understand. But what is significant is that,rather than attempting to define positiveness, Godel characterized it axiomat-ically. In this section I present his basic axioms concerning the notion, and Iexplore some of their consequences.

Definition 11.2.1 [Positive] A constant symbol P of type ↑〈↑〈0〉〉 is designatedto represent positiveness. It is an intentional property of intentional properties.Informally, P is positive if we have P(P ).

Godel assumes that each item must be exactly one of positive or negative.Godel’s axiom (which he actually stated using exclusive-or) can be broken intotwo implications. Here they have been formulated as two separate axioms, sincethey play different roles.

Axiom 11.2.2 (Corresponding to Informal Axiom 1)A (∀X)[P(¬X) ⊃ ¬P(X)]B (∀X)[¬P(X) ⊃ P(¬X)]

Of these, Axiom 11.2.2A is certainly plausible: if a property is negative, theproperty should not also be positive. But Axiom 11.2.2B is more problematic: itsays one of a property or its complement must be positive. Perhaps Godel had inmind something like the notion of a maximal consistent set of formulas, familiarfrom the Lindenbaum/Henkin approach to proving classical completeness. Atany rate, these are the assumptions.

The next assumption concerning positiveness is a monotonicity condition: aproperty that is entailed by a positive property is, itself, positive. Here it is,more or less as Godel gave it.

[P(X) ∧¤(∀x)(X(x) ⊃ Y (x))] ⊃ P(Y )

In this formula, x is a free variable of type 0. For us, type-0 quantification ispossibilist, while for Godel it must have been actualist. I am assuming thisbecause his conclusion, that God exists, is stated using an existential quantifier,and a possibilist quantifier would have been too weak for the purpose. For us,existence must be made explicit using the existence predicate E, relativizing the(∀x) quantifier to E. Since this relativization comes up frequently, it is best tomake an official definition.

Definition 11.2.3 [Existential Relativization] (∀Ex)Φ abbreviates (∀x)[E(x) ⊃Φ], and (∃Ex)Φ abbreviates (∃x)[E(x) ∧ Φ].

Axiom 11.2.4 (Corresponding to Informal Axiom 2)In the following, x is of type 0, X and Y are of type ↑〈0〉.

(∀X)(∀Y )[P(X) ∧¤(∀Ex)(X(x) ⊃ Y (x))] ⊃ P(Y )


At this point it is convenient to introduce the following abbreviation.

Definition 11.2.5 [Negative] If τ is a term of type ↑〈0〉, take ¬τ as short for〈λx.¬τ(x)〉. Call τ negative if ¬τ is positive.

Loosely, at a world in a model, ¬τ denotes the complement of whatever τdenotes. It is easy to check formally that τ = ¬(¬τ), given extensionality forintensional terms, Definition 9.1.3.

At one point in his proof, Godel asserts that 〈λx.x = x〉 must be positive ifanything is, and 〈λx.¬x = x〉 must be negative. This is easy to see: P(〈λx.x =x〉) is valid if anything is positive because anything strictly implies a validity,and we have Axiom 11.2.4. The assertion that 〈λx.¬x = x〉 is negative isequivalent to the assertion that 〈λx.x = x〉 is positive. We thus have thefollowing consequences of Axiom 11.2.4.

Proposition 11.2.6 Assuming Axiom 11.2.4:

1. (∃X)P(X) ⊃ P(〈λx.x = x〉);

2. (∃X)P(X) ⊃ P(¬〈λx.¬x = x〉).

Proposition 11.2.7 Assuming Axioms 11.2.2A and 11.2.4:

(∃X)P(X) ⊃ ¬P(〈λx.¬x = x〉).

Now we have a result from which the possible existence of God will followimmediately, given a key assumption about positiveness.

Proposition 11.2.8 (Corresponding to Informal Proposition 1)Assuming Axioms 11.2.2A and 11.2.4, (∀X)P(X) ⊃ ♦(∃Ex)X(x).

Proof The idea has already been explained, in the proof of Informal Proposi-tion 1 in Section 10.6. This time I give a formal tableau, which is displayed inFigure 11.1. In it use is made of one of the Propositions above. Item 1 negatesthe proposition in unabbreviated form. Item 2 is from 1 by an existential rule(with P as a new parameter); 3 and 4 are from 2 by a conjunctive rule; 5 isAxiom 1; 6 is from 5 and 7 is from 6 by universal rules; 8 and 9 are from 7 by adisjunctive rule; 10 and 11 are from 8 by a disjunctive rule; 12 is from 11 by apossibility rule; 13 is from 12 by an existential rule (with p as a new parameter,and some tinkering with E); 14 and 15 are from 13 by a conjunctive rule; 16 isfrom 4 by a necessity rule; 17 is from 16 by a universal rule (and some tinkeringwith E again); 18 is Proposition 11.2.7; 19 and 20 are from 18 by a disjunctiverule; 21 is from 19 by a universal rule.

Leibniz attempted to prove that perfections are mutually compatible, basinghis proof on the idea that perfections can only be purely positive qualities and sonone can negate the others. For Godel, rather than proving any two perfectionscould apply to the same object, Godel assumes the positive properties are closedunder conjunction. This turns out to be a critical assumption. In stating theassumption, read X ∧ Y as abbreviating 〈λx.X(x) ∧ Y (x)〉.


1¬(∀X

)P(X

)⊃♦

(∃Ex)X

(x)1.

1¬P(P

)⊃♦

(∃Ex)P

(x)2.

1P

(P)

3.1¬♦

(∃Ex)P

(x)4.

1(∀X

)(∀Y

)[P(X

)∧¤

(∀Ex)(X

(x)⊃Y

(x))]⊃P

(Y)

5.1

(∀Y

)[P(P

)∧¤

(∀Ex)(P

(x)⊃Y

(x))]⊃P

(Y)

6.1

[P(P

)∧¤

(∀Ex)(P

(x)⊃〈λx.¬x

=x〉(x))]⊃

P(〈λ

x.¬x

=x〉)

7.

@@@@

1¬[P

(P)∧¤

(∀Ex)(P

(x)⊃〈λx.¬x

=x〉(x))]

8.

@@@@

1¬P(P

)10.

1¬¤

(∀Ex)(P

(x)⊃〈λx.¬x

=x〉(x))

11.1.1¬

(∀Ex)(P

(x)⊃〈λx.¬x

=x〉(x))

12.1.1¬

((E(p)∧P

(p))⊃〈λx.¬x

=x〉(p))

13.1.1

E(p)∧P

(p)14.

1.1¬〈λx.¬x

=x〉(p)

15.1.1¬

(∃Ex)P

(x)16.

1.1¬(E(p)∧

P(p))

17.

1P(〈λ

x.¬x

=x〉)

9.1

(∃X

)P(X

)⊃¬P

(〈λx.¬x

=x〉)

18.

@@@@

1¬(∃X

)P(X

)19.

1¬P(〈λ

x.¬x

=x〉)

20.1¬P

(P)

21.

Figure

11.1:T

ableauP

roofof

(∀X

)[P(X

)⊃♦

(∃x)X

(x)]


Axiom 11.2.9 (Corresponding to Informal Axiom 3)(∀X)(∀Y )[P(X) ∧ P(Y )] ⊃ P(X ∧ Y )

Godel immediately adds that this axiom should hold for any number of sum-mands. Of course one can deal with a finite number of them by repeated use ofAxiom 11.2.9 as stated—the serious issue is that of an infinite number, whichGodel needs. (Anderson & Gettings 1996) gives a version of the axiom whichdirectly postulates that the conjunction of any collection of positive propertiesis positive. Note that it is a third-order axiom. For reading ease I use thefollowing two abbreviations.

1. Z applies only to positive properties (Z, like P, is of type ↑〈↑〈0〉〉):

pos(Z)⇔ (∀X)[Z(X) ⊃ P(X)]

2. X applies to those objects which possess exactly the properties fallingunder Z—roughly, X is the (necessary) intersection of Z. (In this, Z isof type ↑〈↑〈0〉〉, X is of type ↑〈0〉, and x is of type 0.)

(Xintersection of Z)⇔ ¤(∀x)X(x) ≡ (∀Y )[Z(Y ) ⊃ Y (x)]

Axiom 11.2.10 (Also Corresponding to Informal Axiom 3)(∀Z)pos(Z) ⊃ (∀X)[(Xintersection of Z) ⊃ P(X)].

Axiom 11.2.10 implies Axiom 11.2.9. I leave the verification to you. I’ll finishthis section with two technical assumptions that Godel makes “because it followsfrom the nature of the property.” I don’t understand this terse explanation, buthere are the assumptions.

P(X) ⊃ ¤P(X)¬P(X) ⊃ ¤¬P(X)

If the underlying logic is just K, equivalence of these two assumptions followsfrom Axioms 11.2.2A and 11.2.2B. And if the underlying logic is S5, as it mustbe for part of Godel’s argument, equivalence also follows by Proposition 9.4.2.Consequently the version used here can be simplified.

Axiom 11.2.11 (Corresponding to Informal Axiom 4)(∀X)[P(X) ⊃ ¤P(X)].

P has been taken to be an intentional object, of type ↑〈↑〈0〉〉. Axiom 11.2.11and Theorem 9.4.3 tells us that P is rigid. In effect the intentionality of P isillusory—since it is rigid it could just as well have been an extensional object oftype 〈↑〈0〉〉.


Exercises

Exercise 11.2.1 Give a tableau proof that ¬〈λx.¬(x = x)〉 = 〈λx.x = x〉.More generally, show that for a type 〈0〉 term τ , ¬(¬τ) = τ .

Exercise 11.2.2 Show (∀X)[¬P(X) ⊃ ¤¬P(X)] follows from Axiom 11.2.11together with Axioms 11.2.2A and 11.2.2B.

Exercise 11.2.3 Axiom 11.2.10 implies Axiom 11.2.9. Hint: use equality.

11.3 Possibly God Exists

Godel defines something to be Godlike if it possesses all positive properties.

Definition 11.3.1 [Corresponding to Informal Definition 1]G is the following type ↑〈0〉 term, where Y is type ↑〈0〉.

〈λx.(∀Y )[P(Y ) ⊃ Y (x)]〉.

Given certain earlier assumptions, anything having all positive properties canonly have positive properties. Perhaps the easiest way to state this formally isto introduce a second notion of Godlikeness, and prove equivalence.

Definition 11.3.2 [Also Corresponding to Informal Definition 1]G∗ is the type ↑〈0〉 term

〈λx.(∀Y )[P(Y ) ≡ Y (x)]〉.

The following result is easily proved; I leave it to you as an exercise.

Proposition 11.3.3 Assume Axiom 11.2.2B, (∀X)[¬P(X) ⊃ P(¬X)]. In K,with this assumption, (∀x)[G(x) ≡ G∗(x)].

Axiom 11.2.2B is a little problematic, but it is essential to the Propositionabove. If eventually we show something having property G exists, and G andG∗ are equivalent, we will know that something having property G∗ exists. Andfrom this Axiom 11.2.2B follows, even if the existence in question is possibilist.Here is a formal statement of this. Once again I leave the proof to you.

Proposition 11.3.4 In K, (∃x)G∗(x) ⊃ (∀X)[¬P(X) ⊃ P(¬X)].

Now we can show that God’s existence is possible. Godel assumes thatpositive properties are compatible. Since G∗ is, in effect, the conjunction of allpositive properties, it must be positive, and hence so must G be.

Proposition 11.3.5 In K Axiom 11.2.10 implies P(G).


Once again I leave the formal verification to you. What must be shown isthe following.

(∀Z)(∀X)[pos(Z) ∧ (X intersection of Z)] ⊃ P(X) ⊃ P(G)

Essentially, this is the case because, as is easy to verify, we have each of pos(P)and (G intersection of P).

Now the possibility of God’s existence is easy. In fact, it can be provedwith an actualist quantifier, though only the weaker possibilist version is reallyneeded for the rest of the argument.

Theorem 11.3.6 Assume Axioms 11.2.2A, 11.2.4, and 11.2.10. In K both ofthe following are consequences. ♦(∃Ex)G(x) and ♦(∃x)G(x).

Proof By Proposition 11.2.8,

(∀X)P(X) ⊃ ♦(∃Ex)X(x),

hence trivially,

(∀X)P(X) ⊃ ♦(∃x)X(x).

By the Proposition above, P(G). The result is immediate.

Note that the full strength of Proposition 11.2.8 was not really needed for thepossibilist conclusion. In fact, if we modify Axiom 11.2.4 so that quantificationis possibilist,

(∀X)(∀Y )[P(X) ∧¤(∀x)(X(x) ⊃ Y (x))] ⊃ P(Y )

we would still be able to prove Proposition 11.2.8 in the weaker form

(∀X)P(X) ⊃ ♦(∃x)X(x)

and the Godel proof would still go through.

Exercises

Exercise 11.3.1 Give a tableau proof that G entails any positive property:(∀X)P(X) ⊃ ¤(∀y)[G(y) ⊃ X(y)]. You will need Axiom 11.2.11.

Exercise 11.3.2 Give a tableau proof for Proposition 11.3.3.



Exercise 11.3.5 Give a tableau proof of

(∀Z)(∀X)[pos(Z) ∧ (X intersection of Z)] ⊃ P(X) ⊃ P(G).


11.4 Objections

Godel replaced Leibniz’s attempted proof of the compatibility of perfections byan outright assumption, given here as Axiom 11.2.10. Dana Scott noted thatthe only use Godel makes of this Axiom is to show being Godlike is positive,and proposed taking P(G) itself as an axiom. Indeed, Scott has always main-tained that the Godel argument really amounts to an elaborate begging of thequestion—God’s existence is simply being assumed in an indirect way. In fact,it is precisely at the present point in the argument that Scott’s claim can be lo-calized. Godel’s assumption concerning the compatibility of positive propertiesturns out to be equivalent to the possibility of God’s existence.

We will see later on that Godel’s proof that God’s existence is necessary, ifpossible, is correct. It is substantially different from that of Descartes, and hasmany points of intrinsic interest. What is curious is that the proof as a wholebreaks down at precisely the same point as that of Descartes: God’s possibleexistence is simply assumed, though in a disguised form.

The rest of this section provides a formal proof of the claims made above.Enough tableau proofs have been given in full by now, so that abbreviations canbe introduced as an aid to presentation. Before giving the main result of thissection, I introduce some simple conventions for shortening displayed tableauderivations.

If σX and σX ⊃ Y occur on a branch, σ Y can be added. Schematically,

σXσX ⊃ Yσ Y

The justification for this is as follows.

σX 1.σ X ⊃ Y 2.

@

@σ ¬X 3. σ Y 4.

The left branch is closed, and the branch below 4 continues as if we had usedthe derived rule.

Here are a few more derived rules, whose justification I leave to you.

σXσ (X ∧ Y ) ⊃ Zσ Y ⊃ Z

σ ¬Yσ X ⊃ Yσ ¬X

σXσX ≡ Yσ Y

σ ¬Xσ X ≡ Yσ ¬Y


σ (∀α1) · · · (∀αn)Φ(α1, . . . , αn)σΦ(τ1, . . . , τn)for any groundedterms τ1, . . . , τn

σ (∃α1) · · · (∃αn)Φ(α1, . . . , αn)σΦ(P1, . . . , Pn)for any new, distinctparameters P1, . . . , Pn

Now, here is the promised proof of equivalence.

Theorem 11.4.1 Assume all the Axioms to this point, except Axiom 11.2.10.The following are equivalent in S5:

1. Axiom 11.2.10;

2. P(G);

3. ♦(∃Ex)G(x);

4. ♦(∃x)G(x).

Proof We already know 1 implies 2, this is Proposition 11.3.5. Likewise 3follows from 2, by Theorem 11.3.6. And the implication of 4 from 3 is trivial.

Showing that 4 implies 2 is straightforward, using the fact that G and G∗ areequivalent, and the fact that positiveness is rigid. Here is a tableau derivation.

1 ♦(∃x)G(x) 1.1 ¬P(G) 2.1.1 (∃x)G(x) 3.1.1 G(g) 4.1.1 (∀x)[G(x) ≡ G∗(x)] 5.1.1 [G(g) ≡ G∗(g)] 6.1.1 G∗(g)] 7.1.1 〈λx.(∀Y )[P(Y ) ≡ Y (x)]〉(g) 8.1.1 (∀Y )[P(Y ) ≡ Y (g)] 9.1.1 [P(G) ≡ G(g)] 10.1.1 P(G) 11.1 (∀X)[¬P(X) ⊃ ¤¬P(X) 12.1 [¬P(G) ⊃ ¤¬P(G) 13.1 ¤¬P(G) 14.1.1¬P(G) 15.

Item 3 is from 2 by a possibility rule; 4 is from 3 by an existential rule, withg as a new parameter; 5 is Proposition 11.3.3, and note that the modal versionof Corollary 4.3.4 is being used here; 6 is from 5 by a universal rule; 7 is from4 and 6 by a derived rule; 8 is 7 unabbreviated; 9 is from 8 by an abstractionrule; 10 is from 9 by a universal rule; 11 is from 10 by a derived rule; 12 is anequivalent of Axiom 11.2.11; 13 is from 12 by a universal rule; 14 is from 2 and13 by a derived rule; 15 is from 14 by a universal rule.


Showing 2 implies 1 informally is also not hard. If C is any collection of pos-itive properties, G entails every member of C by Exercise 11.3.1. It follows thatG also entails the conjunction of C. Since 2 says G is positive, the conjunctionof C is positive by Axiom 11.2.4. The informal argument just sketched can beturned into a proper tableau proof. In Figure 11.2 I give a proof that 2 impliesAxiom 11.2.9, and I’ll leave the argument for Axiom 11.2.10 as an exercise.

In Figure 11.2, item 3 is from 2 by a (derived) existential rule; 4 and 5 arefrom 3, and 6 and 7 are from 4 by conjunctive rules; 8 is Axiom 11.2.4; 9 isfrom 8 by a derived rule; 10 is from 9 by a derived rule; 11 is from 5 and 10 bya derived rule; 12 is from 11 by a possibility rule; 13 is 12 unabbreviated; 14 isfrom 13 by an existential rule; 15 and 16 are from 14, and 17 and 18 are from16 by conjunctive rules; 19 is Axiom 11.2.11; 20 and 21 are from 19 by universalrules; 22 is from 6 and 20, and 23 is from 7 and 21, by derived rules; 24 is from22 and 25 is from 23 by universal rules; 26 is 17 unabbreviated; 27 is from 26by an abstraction rule; 28 and 29 are from 27 by universal rules; 30 is from 24and 28, and 31 is from 25 and 29 by derived rules; 32 is 18 unabbreviated; 33 isfrom 32 by an abstraction rule; 34 and 35 are from 33 by a disjunctive rule.

Exercises

Exercise 11.4.1 Give a tableau proof that ♦(∃x)G(x) implies Axiom 11.2.10.

11.5 Essence

Even though we ran into the old Descartes problem with half of the Godelargument, we should not abandon the enterprise. The other half contains in-teresting concepts and arguments. This is the half in which it is shown thatGod’s existence is necessary, if possible. For starters, Godel defines a notion ofessence that plays a central role, and is of interest in its own right. (Hazen 1998)makes a case for calling Godel’s notion character, reserving the term essence forsomething else. I follow Godel’s terminology. The essence of something, x, is aproperty that entails every property that x possesses. Godel says it as follows.

ϕ Ess x ≡ (∀ψ)ψ(x) ⊃ ¤(∀y)[ϕ(y) ⊃ ψ(y)]

As given, it does not follow that the essence of x must be a property that xpossesses. Dana Scott assumed this was simply a slip on the part of Godel, andinserted a conjunct ϕ(x) into the definition. I will follow him in this.

ϕ Ess x ≡ ϕ(x) ∧ (∀ψ)ψ(x) ⊃ ¤(∀y)[ϕ(y) ⊃ ψ(y)]

Godel states ϕ Ess x as a formula rather than a term—in the version in thisbook an explicit predicate abstract is used. Also, I assume the type-0 quantifierthat appears is actualist, and so in my version the existence predicate, E, mustappear. E(P, q) is intended to assert that P is the essence of q.


1 P(G) 1.1 ¬(∀X)(∀Y )[P(X) ∧ P(Y )] ⊃ P(X ∧ Y ) 2.1 ¬[P(A) ∧ P(B)] ⊃ P(A ∧B) 3.1 P(A) ∧ P(B) 4.1 ¬P(A ∧B) 5.1 P(A) 6.1 P(B) 7.1 (∀X)(∀Y )[P(X) ∧¤(∀Ex)(X(x) ⊃ Y (x))] ⊃ P(Y ) 8.1 [P(G) ∧¤(∀Ex)(G(x) ⊃ (A ∧B)(x))] ⊃ P(A ∧B) 9.1 ¤(∀Ex)(G(x) ⊃ (A ∧B)(x)) ⊃ P(A ∧B) 9.1 ¬¤(∀Ex)(G(x) ⊃ (A ∧B)(x)) 11.1.1¬(∀Ex)(G(x) ⊃ (A ∧B))(x) 12.1.1¬(∀x)[E(x) ⊃ (G(x) ⊃ (A ∧B)(x))] 13.1.1¬[E(c) ⊃ (G(c) ⊃ (A ∧B)(c))] 14.1.1 E(c) 15.1.1¬(G(c) ⊃ (A ∧B)(c) 16.1.1 G(c) 17.1.1¬(A ∧B)(c) 18.1 (∀X)[P(X) ⊃ ¤P(X)] 19.1 P(A) ⊃ ¤P(A) 20.1 P(B) ⊃ ¤P(B) 21.1 ¤P(A) 22.1 ¤P(B) 23.1.1 P(A) 24.1.1 P(B) 25.1.1 〈λx.(∀Y )[P(Y ) ⊃ Y (x)]〉(c) 26.1.1 (∀Y )[P(Y ) ⊃ Y (c)] 27.1.1 P(A) ⊃ A(c) 28.1.1 P(B) ⊃ B(c) 29.1.1 A(c) 30.1.1 B(c) 31.1.1¬〈λx.A(x) ∧B(x)〉(c) 32.1.1¬[A(c) ∧B(c)] 33.

@

@1.1¬A(c) 34. 1.1¬B(c) 35.

Figure 11.2: Proof that item 2 implies Axiom 11.2.9


Definition 11.5.1 [Essence, Corresponding to Informal Definition 2]E abbreviates the following type ↑〈↑〈0〉, 0〉 term, in which Z is of type ↑〈0〉 andw is of type 0:

〈λY, x.Y (x) ∧ (∀Z)Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉

The property of being Godlike was defined earlier, Definition 11.3.1. Acentral fact about Godlikeness, from Godel’s notes, is that it is the essence ofany being that is Godlike.

Theorem 11.5.2 (Corresponding to Informal Proposition 3)Assume Axioms 11.2.2B and 11.2.11. In K the following is provable. (Notethat x is of type 0.)

(∀x)[G(x) ⊃ E(G, x)].

Rather than giving a direct proof, if we use Proposition 11.3.3 it follows froma similar result concerning G∗, provided Axiom 11.2.2B is assumed. Since sucha result has a somewhat simpler proof, that is what is actually shown.

Theorem 11.5.3 In K the following is provable, assuming Axiom 11.2.11.

(∀x)[G∗(x) ⊃ E(G∗, x)].

Proof Here is a closed K tableau to establish the theorem.

1¬(∀x)[G∗(x) ⊃ E(G∗, x)] 1.1¬[G∗(g) ⊃ E(G∗, g)] 2.1 G∗(g) 3.1¬E(G∗, g) 4.1¬G∗(g) ∧ (∀Z)Z(g) ⊃ ¤(∀Ew)[G∗(w) ⊃ Z(w)] 5.

@

@1¬G∗(g) 6. 1¬(∀Z)Z(g) ⊃ ¤(∀Ew)[G∗(w) ⊃ Z(w)] 7.

Item 2 is from 1 by an existential rule, with g a new parameter; 3 and 4 arefrom 2 by a conjunction rule; 5 is from 4 by a derived unsubscripted abstractrule; 6 and 7 are from 5 by a disjunction rule. The left branch is closed. Icontinue with the right branch, below item 7.


1 ¬Q(g) ⊃ ¤(∀Ew)[G∗(w) ⊃ Q(w)] 8.1 Q(g) 9.1 ¬¤(∀Ew)[G∗(w) ⊃ Q(w)] 10.1.1¬(∀Ew)[G∗(w) ⊃ Q(w)] 11.1.1¬E(a) ⊃ [G∗(a) ⊃ Q(a)] 12.1.1 E(a) 13.1.1¬[G∗(a) ⊃ Q(a)] 14.1.1 G∗(a) 15.1.1¬Q(a) 16.1 (∀Y )[P(Y ) ≡ Y (g)] 17.1 P(Q) ≡ Q(g) 18.1 P(Q) 19.1.1 (∀Y )[P(Y ) ≡ Y (a)] 20.1.1 P(Q) ≡ Q(a) 21.1 (∀Y )[P(Y ) ⊃ ¤P(Y )] 22.1 P(Q) ⊃ ¤P(Q) 23.1 ¤P(Q) 24.1.1 P(Q) 25.1.1 Q(a) 26.

Item 8 is from 7 by an existential rule, with Q a new parameter; 9 and 10are from 8 by a conjunction rule; 11 is from 10 by a possibility rule; 12 is from11 by an existential rule; 13 and 14 are from 12 by a conjunctive rule, as are15 and 16 from 14; 17 is from 3 by a derived unsubscripted abstract rule; 18 isfrom 17 by a universal rule; 19 is from 9 and 18 by an earlier derived rule; 20 isfrom 15 by a derived unsubscripted abstract rule; 21 is from 20 by a universalrule; 22 is Axiom 3; 23 is from 22 by a universal rule; 24 is from 19 and 23 by aderived rule; 25 is from 24 by a necessity rule; 26 is from 21 and 25 by a derivedrule. The branch is closed by 16 and 26.

In the notes Dana Scott made when Godel showed him his proof, there aretwo observations concerning essences. One is that something can have only oneessence. The other is that an essence must be a complete characterization. Hereare versions of these results. I begin by showing that any two essences of thesame thing are necessarily equivalent.

Theorem 11.5.4 Assume the modal logic is K. The following is provable.

(∀X)(∀Y )(∀z)[E(X, z) ∧ E(Y, z)] ⊃ ¤(∀Ew)[X(w) ≡ Y (w)]

Proof The idea behind the proof is straightforward. If P and Q are essencesof the same object, each must entail the other. I give a tableau proof mainly toprovide another example of such. It starts by negating the formula, applyingexistential rules three times, introducing new parameters P , Q, and a, thenapplying various propositional rules. Omitting all this, we get to items 1 – 3below.


1 E(P, a) 1.1 E(Q, a) 2.1¬¤(∀Ew)[P (w) ≡ Q(w)] 3.1 P (a) 4.1 (∀Z)[Z(a) ⊃ ¤(∀Ew)[P (w) ⊃ Z(w)]] 5.1 Q(a) 6.1 (∀Z)[Z(a) ⊃ ¤(∀Ew)[Q(w) ⊃ Z(w)]] 7.1 Q(a) ⊃ ¤(∀Ew)[P (w) ⊃ Q(w)] 8.1 P (a) ⊃ ¤(∀Ew)[Q(w) ⊃ P (w)] 9.

@

@1¬Q(a) 10. 1¤(∀Ew)[P (w) ⊃ Q(w)] 11.

@

@1¬P (a) 12. 1¤(∀Ew)[Q(w) ⊃ P (w)] 13.

Items 4 and 5 are from 1 by an abstraction rule (and a propositional rule),6 and 7 are from 2 the same way; 8 is from 5 and 9 is from 7 by universal rules;10 and 11 are from 8, and 12 and 13 are from 9 by disjunction rules. The leftbranch is closed, by 6 and 10. The middle branch is closed by 4 and 12. Icontinue with the rightmost branch, below item 13.

1.1¬(∀Ew)[P (w) ≡ Q(w)] 14.1.1¬E(b) ⊃ [P (b) ≡ Q(b)] 15.1.1 E(b) 16.1.1¬[P (b) ≡ Q(b)] 17.

@

@1.1 P (b) 18. 1.1¬P (b) 20.1.1¬Q(b) 19. 1.1 Q(b) 21.

Item 14 is from 3 by a possibility rule; 15 is from 14 by an existential rule;16 and 17 are from 15 by a conjunction rule; 18, 19, 20, 21 are from 17 bysuccessive propositional rules. I show how the left branch can be continued toclosure; the right branch has a symmetric construction which I omit.

1.1 (∀Ew)[P (w) ⊃ Q(w)] 22.1.1 E(b) ⊃ [P (b) ⊃ Q(b)] 23.

@

@1.1¬E(b) 24. 1.1P (b) ⊃ Q(b) 25.

@

@1.1¬P (b) 26. 1.1Q(b) 27.


Item 22 is from 11 by a necessitation rule; 23 is from 22 by a universal rule;24 and 25 are from 23 by a disjunction rule, as are 26 and 27 from 25. The leftbranch is closed by 16 and 24, the middle branch is closed by 18 and 26, andthe right branch is closed by 19 and 27.

Now, here is the second of Scott’s observations: if X is the essence of y, onlyy can have X as a property.

Theorem 11.5.5 Assume the modal logic is K, including equality. The follow-ing is valid.

(∀X)(∀y)E(X, y) ⊃ ¤(∀Ez)[X(z) ⊃ (y = z)]

This can be proved using tableaus—I leave it to you as an exercise.

Exercises

Exercise 11.5.1 Give a tableau proof for Theorem 11.5.5. Hint: for a parame-ter c, one can consider the property of being, or not being, c, that is, 〈λx.x = c〉and 〈λx.x 6= c〉. Either can be used.

Exercise 11.5.2 Give a tableau proof to establish Theorem 11.5.2 directly,without using G∗.

11.6 Necessarily God Exists

In this section I present a version of Godel’s argument that God’s possibleexistence implies His existence necessarily. It begins with the introduction ofan auxiliary notion that Godel calls necessary existence.

Definition 11.6.1 [Necessary Existence, Corresponding to Informal Defini-tion 3] N abbreviates the following type ↑〈0〉 term:

〈λx.(∀Y )[E(Y, x) ⊃ ¤(∃Ez)Y (z)]〉.

The idea is, something has the property N of necessary existence provided anyessence of it is necessarily instantiated. Godel now makes a crucial assumption:necessary existence is positive.

Axiom 11.6.2 (Corresponding to Informal Axiom 5)P(N).

Given this final axiom, Godel shows that if (some) God exists, that existencecannot be contingent. An informal sketch of the proof was given in Section 10.6of Chapter 10, and it can be turned into a formal proof—see Informal Propo-sitions 4 and 5. I will leave the details as exercises, since you have seen lots ofworked out tableaus now. Here is a proper statement of Godel’s result, with allthe assumptions explicitly stated. Note that the necessary actualist existenceof God follows from His possibilist existence.


Theorem 11.6.3 (Corresponding to Informal Proposition 4)Assume Axioms 11.2.2B, 11.2.11, and 11.6.2. In the logic K,

(∃x)G(x) ⊃ ¤(∃Ex)G(x).

I leave it to you to prove this, using the informal sketch as a guide. NowGodel’s argument can be completed.

Theorem 11.6.4 (Corresponding to Informal Proposition 5)Assume Axioms 11.2.2B, 11.2.11, and 11.6.2. In the logic S5,

♦(∃x)G(x) ⊃ ¤(∃Ex)G(x).

Proof From Theorem 11.6.3,

(∃x)G(x) ⊃ ¤(∃Ex)G(x).

By necessitation,

¤[(∃x)G(x) ⊃ ¤(∃Ex)G(x)].

By the K validity ¤(A ⊃ B) ⊃ (♦A ⊃ ♦B),

♦(∃x)G(x) ⊃ ♦¤(∃Ex)G(x).

Finally, in S5, ♦¤A ⊃ ¤A, so we conclude

♦(∃x)G(x) ⊃ ¤(∃Ex)G(x).

Now we are at the end of the argument.

Corollary 11.6.5 Assume all the Axioms. In the logic S5,

¤(∃Ex)G(x).

Proof By Theorems 11.6.4 and 11.3.6.

Exercises

Exercise 11.6.1 Give a tableau proof to show Theorem 11.6.3. Use variousearlier results as assumptions in the tableau.

11.7 Going Further

Godel’s axioms admit more consequences than just those of the ontologicalargument. In this section a few of them are presented.


11.7.1 Monotheism

Does there exist exactly one God? The following says “yes.” You are asked toprove it, as Exercise 11.7.1.

Proposition 11.7.1 (∃x)(∀y)[G(y) ≡ (y = x)].

This Proposition has a curious Corollary. Since type-0 quantification ispossibilist, it makes sense to ask if there are gods that happen to be non-existent.But Corollary 11.6.5 tells us there is an existent God, and the Proposition abovetells us it is the only one, existent or not. Consequently we have the following.

Corollary 11.7.2 (∀x)[G(x) ⊃ E(x)].

Proposition 11.7.1 tells us we can apply the machinery of definite descrip-tions. By Definition 9.5.1, ιx.(∀Y )[P(Y ) ⊃ Y (x)] always designates, and conse-quently so does ιx.G(x). Proposition 9.5.3 tells us this will be a rigid designatorprovided G(x) is stable. It follows from Sobel’s argument in Section 11.8 thatit, and everything else, is. But alternative versions of Godel’s axioms have beenproposed—I will discuss some below—and using them the stability of G(x) doesnot seem to be the case. That is, it seems to be compatible with the axiomsof Godel (as modified by others) that, while the existence of God is necessary,a particular being that is God need not be God necessarily. If this is not thecase, and a proof has been missed, I invite the reader to correct the situation.

11.7.2 Positive Properties are Necessarily Instantiated

Proposition 11.2.8 says that positive properties are possibly instantiated. In(Sobel 1987), it is observed that a consequence of Corollary 11.6.5 is that everypositive property is necessarily instantiated.

Proposition 11.7.3 (∀X)P(X) ⊃ ¤(∃Ex)X(x).

I leave the easy proof of this to you.

Exercises

Exercise 11.7.1 Give a tableau proof for Proposition 11.7.1. Hint: you willneed Corollary 11.6.5, Theorem 11.5.2, and Theorem 11.5.5.

Exercise 11.7.2 Provide a tableau proof for Proposition 11.7.3. Hint: byCorollary 11.6.5, a Godlike being necessarily exists. Such a being has all posi-tive properties, so every positive property is instantiated. Now, build this intoa tableau.


11.8 More Objections

In Section 11.4 we saw that one of Godel’s Axioms was equivalent to the possibleexistence of God. Other objections have been raised that are equally as serious,and one of these is taken up now. (Sobel 1987) showed that Godel’s axiomsystem is so strong it implies that whatever is the case is so of necessity, Q ⊃ ¤Q.In other words, the modal system collapses. In still other, more controversial,words, there is no free will. Roughly speaking, the idea of Sobel’s proof is this.God, having all positive properties, must have the property of having any giventruth be the case. Since God’s existence is necessary, anything that is a truthmust necessarily be a truth.

Here is a slightly informal version of the argument given by Sobel. Forsimplicity, assume Q is a formula that contains no free variables. By Theo-rem 11.5.2,

(∀x)[G(x) ⊃ E(G, x)]. (11.1)

Using the definition of E , we have as a consequence

(∀x)G(x) ⊃ (∀Z)Z(x) ⊃ ¤(∀Ew)[G(w) ⊃ Z(w)]. (11.2)

There is a minor nuisance to deal with. In the formula (11.2) I would like toinstantiate the quantifier (∀Z) with Q, but this is not a ‘legal’ term, so insteadI use the term 〈λy.Q〉 to instantiate. In it, y is of type 0, and so 〈λy.Q〉 is oftype ↑〈0〉. We get the following consequence.

(∀x)G(x) ⊃ 〈λy.Q〉(x) ⊃ ¤(∀Ew)[G(w) ⊃ 〈λy.Q〉(w)]. (11.3)

Now to undo the technicality just introduced, note that since y does not occurfree in Q, 〈λy.Q〉(x) ≡ 〈λy.Q〉(w) ≡ Q, and so we have

(∀x)G(x) ⊃ Q ⊃ ¤(∀Ew)[G(w) ⊃ Q]. (11.4)

Since x does not occur free in the consequent, (11.4) is equivalent to the follow-ing:

(∃x)G(x) ⊃ Q ⊃ ¤(∀Ew)(G(w) ⊃ Q). (11.5)

We have Corollary 11.6.5, from which

(∃x)G(x) (11.6)

follows. Then from (11.5) and (11.6) we have


Q ⊃ ¤(∀Ew)(G(w) ⊃ Q). (11.7)

Since Q has no free variables, (11.7) is equivalent to the following:

Q ⊃ ¤[(∃Ew)G(w) ⊃ Q]. (11.8)

Using the distributivity of ¤ over implication, (11.8) gives us

Q ⊃ [¤(∃Ew)G(w) ⊃ ¤Q]. (11.9)

Finally (11.9), and Corollary 11.6.5 again, give the intended result,

Q ⊃ ¤Q. (11.10)

Most people have taken this as a counter to Godel’s argument—if the axiomsare strong enough to admit this consequence, something is wrong. In the nexttwo sections I explore some ways out of the difficulty.

11.9 A Solution

Sobel’s demonstration that the Godel axioms imply no free will rather takes thefun out of things. In this section I propose one solution to the problem. I don’tprofess to understand its implications fully. I am presenting it to the reader,hoping for comments and insights in return.

Throughout, it has been assumed that Godel had in mind intensional prop-erties when talking about positiveness and essence. But, suppose not—supposeextensional properties were intended. In this section I reformulate Godel’s argu-ment under this alternative interpretation. It is one way of solving the problemSobel raised.

In this section only I will take P to be a constant symbol of type ↑〈〈0〉〉.Axiom 11.2.4 gets replaced with the following.

Revised Axiom 11.2.4 In the following, x is of type 0, X and Y are of type〈0〉, and (∀Ex)Φ abbreviates (∀x)[E(x) ⊃ Φ].

(∀X)(∀Y )[P(X) ∧¤(∀Ex)(X(x) ⊃ Y (x))] ⊃ P(Y )

Note that this has the same form as Axiom 11.2.4, but the types of variablesX and Y are now extensional rather than intensional. This will be the generalpattern for changes. The definition of negative, for instance, is modified asfollows. For a term τ of type 〈0〉, take ¬τ as short for ↓〈λx.¬τ(x)〉. ThenAxioms 11.2.2A and 11.2.2B, 11.2.10, and 11.2.11, all have their original form,but with variables changed from intensional to extensional type.


The analog of Proposition 11.2.8 still holds, but with extensional variablesinvolved.

(∀X)P(X) ⊃ ♦(∃Ex)X(x)

Analogs of G and G∗ are defined in the expected way. G is the followingtype ↑〈0〉 term, where Y is type 〈0〉.

〈λx.(∀Y )[P(Y ) ⊃ Y (x)]〉

Likewise G∗ is the type ↑〈0〉 term

〈λx.(∀Y )[P(Y ) ≡ Y (x)]〉.

One can still prove (∀x)[G(x) ≡ G∗(x)].Essence must be redefined, but again it is only variable types that are

changed. E now abbreviates the following type ↑〈〈0〉, 0〉 term, in which Z isof type 〈0〉 and w is of type 0:

〈λY, x.Y (x) ∧ (∀Z)Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉

Theorem 11.5.3 plays an essential role in the Godel proof, and it too contin-ues to hold, in a slightly modified form:

(∀x)[G∗(x) ⊃ E(↓G∗, x)].

I leave the proof of this to you—it is similar to the earlier one.Of course we must modify the definition of Necessary Existence, to use the

revised version of essence, and Axiom 11.6.2 as well, to use the modified defini-tion of Necessary Existence. For this section, N abbreviates the following type↑〈0〉 term, in which Y is of type 〈0〉:

〈λx.(∀Y )[E(Y, x) ⊃ ¤(∃Ez)Y (z)〉.

Revised Axiom 11.6.2 is P(N), where N is as just modified.With this established, the rest of Godel’s argument carries over directly,

giving us the following.

¤(∃Ez)(↓G∗)(z)

The final step is the easy proof that this implies the desired ¤(∃Ez)G∗(z), andhence ¤(∃Ez)G(z), and I leave this to you.

So, we have the conclusion of Godel’s argument. Finally, here is a model,adapted from (Anderson 1990), that shows Sobel’s continuation no longer ap-plies.

Example 11.9.1 Construct a standard S5 model as follows. There are twopossible worlds, call them Γ and ∆. The accessibility relation always holds. The


type-0 domain is the set a, b. Since this is a standard model, the remainingtypes are fully determined.

The existence predicate, E, is interpreted to have extension a, b at Γ anda at ∆. Informally, all type-0 objects exist at Γ, but only a exists at ∆.

Call a type-〈0〉 object positive if it applies to a. Interpret P so that at eachworld its extension is the collection of positive type-〈0〉 objects; that is, at eachworld P designates a, a, b.

This finishes the definition of the model. I leave the following facts about itfor you to verify.

1. The designation of G in this model is rigid, with a as its extension atboth worlds.

2. The designation of E is also rigid, with extension 〈a, a〉, 〈b, b〉 ateach world. Loosely, the essence of a is a and the essence of b is b.

3. The designation of N is also rigid, with extension a at each world.

4. All the Axioms are valid, as modified in this section.

Now take Q to be the closed formula (∃Ex)(∃Ey)¬(x = y). Since it assertstwo objects actually exist, it is true at Γ, but not at ∆, and hence Q ⊃ ¤Q isnot true at Γ.

We now know that Sobel’s argument must break down in the present system,but it is instructive to try to reproduce the earlier proof, and see just wherethings go wrong. The inferences now are more complex. I leave it to you toverify their correctness, using tableaus. Once again, assume Q contains no freevariables. We try to prove Q ⊃ ¤Q, starting more or less as we did before.

(∀x)[G(x) ⊃ E(↓G, x)] (11.11)

which, unabbreviated, is

(∀x)[G(x) ⊃ (11.12)〈λY, x.Y (x) ∧ (∀Z)Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉(↓G, x)]

where Y and Z are of type 〈0〉, unlike in (11.2) where they were of type ↑〈0〉.The variable x is of type 0, and it is easy to show the following simpler

formula is a consequence of (11.12).

(∀x)[G(x) ⊃ 〈λY.Y (x) ∧ (∀Z)Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉(↓G)] (11.13)

From this we trivially get the following.

(∀x)[G(x) ⊃ 〈λY.(∀Z)Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉(↓G)] (11.14)


Next, in the argument of Section 11.8, we instantiated the quantifier (∀Z)with the term 〈λy.Q〉. Of course we cannot do that now, since 〈λy.Q〉 is an inten-sional term, while the present quantifier is extensional. Apply the extension-ofoperator, getting ↓〈λy.Q〉, and use this instead. But universal instantiationinvolving relativized terms is a little tricky. If ↓τ is a relativized term of thesame type as Z, (∀Z)ϕ(Z) ⊃ ϕ(↓τ) is not generally valid. What is valid is(∀Z)ϕ(Z) ⊃ 〈λZ.ϕ(Z)〉(↓τ). So what we get from formula (11.14) when weinstantiate the quantifier is the following consequence.

(∀x)[G(x) ⊃ 〈λY, Z.Z(x) ⊃ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉(↓G, ↓〈λy.Q〉)] (11.15)

Distributing the abstraction, this is equivalent to the following.

(∀x)G(x) ⊃ (11.16)[〈λY, Z.Z(x)〉(↓G, ↓〈λy.Q〉) ⊃ 〈λY, Z.¤(∀Ew)(Y (w) ⊃ Z(w))〉(↓G, ↓〈λy.Q〉)]

The variable x does not occur free in 〈λy.Q〉 and Y does not occur in Z(x), so〈λY, Z.Z(x)〉(↓G, ↓〈λy.Q〉) is simply equivalent to Q, so (11.16) reduces to thefollowing.

(∀x)G(x) ⊃ (11.17)[Q ⊃ 〈λY, Z.¤(∀Ew)(Y (w) ⊃ Z(w))〉(↓G, ↓〈λy.Q〉)]

From this we get

(∃x)G(x) ⊃ (11.18)[Q ⊃ 〈λY, Z.¤(∀Ew)(Y (w) ⊃ Z(w))〉(↓G, ↓〈λy.Q〉)]

and since we have (∃x)G(x), we also have

Q ⊃ 〈λY, Z.¤(∀Ew)(Y (w) ⊃ Z(w))〉(↓G, ↓〈λy.Q〉). (11.19)

Since Q has no free variables, (11.19) can be shown to be equivalent to the fol-lowing, where a is a new constant symbol introduced to keep formula formationcorrect.

Q ⊃ 〈λY, Z.¤((∃Ew)Y (w) ⊃ Z(a))〉(↓G, ↓〈λy.Q〉). (11.20)

Using the distributivity of ¤ over implication, (11.20) gives us

Q ⊃ 〈λY, Z.¤(∃Ew)Y (w) ⊃ ¤Z(a)〉(↓G, ↓〈λy.Q〉). (11.21)


From (11.21) we get

Q ⊃ (11.22)[〈λY, Z.¤(∃Ew)Y (w)〉(↓G, ↓〈λy.Q〉) ⊃ 〈λY, Z.¤Z(a)〉(↓G, ↓〈λy.Q〉)].

Because Z has no free occurrences in ¤(∃Ew)Y (w) and Y has no free occurrencesin Z(a), (11.22) can be simplified to

Q ⊃ (11.23)[〈λY.¤(∃Ew)Y (w)〉(↓G) ⊃ 〈λZ.¤Z(a)〉(↓〈λy.Q〉)].

I don’t know the status of 〈λY.¤(∃Ew)Y (w)〉(↓G), that is, whether or not itfollows from the axioms used in this section. It does hold provided G is rigid, soin particular, it holds in the model of Example 11.9.1. Consequently, in settingslike that model (11.23) reduces to the following.

Q ⊃ 〈λZ.¤Z(a)〉(〈λy.Q〉). (11.24)

But 〈λZ.¤Z(a)〉(〈λy.Q〉) is not equivalent to ¤Q, and that’s an end of it.Expressing the essential idea of 〈λZ.¤Z(a)〉(〈λy.Q〉) with somewhat informalnotation, we might write it as 〈λZ.¤Z〉(Q), and so what has been established,assuming rigidity of G, is

Q ⊃ 〈λZ.¤Z〉(Q) (11.25)

and this is quite different from Q ⊃ ¤Q. In ¤Z, the variable Z is given thecurrent version of Q—its truth value in the present world. Perhaps an examplewill make clear what is happening. Suppose it is the case, in the real world, thatit is raining—take this as Q. If we had validity of Q ⊃ ¤Q, it would necessarilybe raining—¤Q—and so in every alternative world, it would be raining. Butwhat we have is Q ⊃ 〈λZ.¤Z〉(Q), and since Q is assumed to hold in thereal world, we conclude 〈λZ.¤Z〉(Q). This asserts something more like: if itis raining in the real world, then in every alternative world it is true that itis raining in the real world. As it happens, this is trivially correct, and saysnothing about whether or not it is raining in any alternative world.

11.10 Anderson’s Alternative

One solution to the objection Sobel raised has been presented. In (Anderson1990) some different, quite reasonable, modifications to the Godel axioms areproposed that manage to avoid Sobel’s conclusion. For this section I return tothe use of intensional variables.

Axiom 11.2.2B is something of a problem. Essentially it says, everythingmust be either positive or negative. As Anderson observes, why can’t somethingbe indifferent? Anderson drops Axiom 11.2.2B.


The most fundamental change, however, is elsewhere. Definition 11.3.1 andits alternative, Definition 11.3.2, are discarded. Instead there is a requirementthat a Godlike being have positive properties essentially.

Definition 11.10.1 [Godlike, Anderson Version] GA is the type ↑〈0〉 term

〈λx.(∀Y )[P(Y ) ≡ ¤Y (x)]〉.

There is a corresponding change in the definitions of essence and necessaryexistence. Definition 11.5.1 gets replaced by the following

Definition 11.10.2 [Essence, Anderson Version] EA abbreviates the followingtype ↑〈↑〈0〉, 0〉 term:

〈λY, x.(∀Z)¤Z(x) ≡ ¤(∀Ew)[Y (w) ⊃ Z(w)]〉

Notice several key things about this definition. The Scott addition, that theessence of an object actually apply to the object, is dropped. A necessity opera-tor has been introduced that was not present in the definition of E . And finally,an implication in the definition of E has been replaced by an equivalence.

The definition of necessary existence, Definition 11.6.1, is replaced by aversion of the same form, except that Anderson’s definition of essence is usedin place of that of Godel.

Definition 11.10.3 [Necessary Existence, Anderson Version] NA abbreviatesthe following type ↑〈0〉 term:

〈λx.(∀Y )[EA(Y, x) ⊃ ¤(∃Ez)Y (z)〉.

Now, what happens to earlier reasoning? Of course Proposition 11.2.8 stillholds, since Axioms 11.2.2A and 11.2.4 remain unaffected. Theorem 11.5.2 turnsinto the following.

Theorem 11.10.4 In S5 the following is provable.

(∀x)[GA(x) ⊃ EA(GA, x)].

I leave it to you to verify the theorem, using tableaus say.Next, Anderson replaces Axiom 11.6.2 with a corresponding version asserting

that his modification of necessary existence is positive.

Axiom 11.10.5 (Anderson’s Version of 11.6.2) P(NA).

Now Theorem 11.6.3 turns into the following.

Theorem 11.10.6 Assume Axioms 11.2.11 and 11.10.5. In the logic S5,

(∃x)GA(x) ⊃ ¤(∃Ex)GA(x).


Once again, I leave the proof to you. These are the main items. The rest of theontological argument goes through as before. At the end, we have the following.

Theorem 11.10.7 Assume all the Axioms 11.2.2A, 11.2.4, 11.2.10, 11.2.11,and 11.10.5. In the logic S5,

¤(∃Ex)GA(x).

Thus the desired necessary existence follows, and with one fewer axiom(though with more complex definitions). And a model, closely related to theone given in the previous section, can be constructed to show that these axiomsdo not yield Sobel’s undesirable conclusion—see (Anderson 1990) for details.

Exercises

Exercise 11.10.1 Supply a tableau argument for Theorem 11.10.4. Do thesame for Theorem 11.10.6.

11.11 Conclusion

Godel’s proof, and criticisms of it, have inspired interesting work. Some wasmentioned above. More remains to be done. Here I briefly summarize somedirections that might profitably be explored.

(Hajek 1995) studies the role of the comprehension axioms—work that issummarized in (Hajek 1996a). Completely general comprehension axioms areimplicit in my presentation, they are present as the assumption that every ab-stract has a meaning. Hajek confines things to a second-order intensional logic,augmented with one third-order constant to handle positiveness. In this settingHajek introduces what he calls a cautious comprehension schema:

(∀x)[G(x) ⊃ (¤Φ(x) ∨¤¬Φ(x))] ⊃ (∃Y )¤(∀x)[Y (x) ≡ Φ(x)].

Hajek shows that Godel’s axioms do not lead to a proof of Q ⊃ ¤Q, providedcautious comprehension replaces full comprehension, but the necessary existenceof God still can be concluded.

Hajek refutes a claim by Magari, (Magari 1988), that a subset of Godel’saxiom system is sufficient for the ontological argument. But he also showsMagari’s claim does apply to Anderson’s system. And he shows that Godel’saxioms, with cautious comprehension, can be interpreted in Anderson’s system,with full comprehension.

The results of Hajek assume an underlying model with constant domainsbut no existence predicate, and only intensional properties. It is not clear whathappens if these assumptions are modified.

In Section 11.7, some further consequences of Godel’s axioms were discussed.I don’t know what happens to these when the axioms are modified in the various


ways suggested here and in the previous two sections. Nor do I know the re-lationships, if any, between the extensional-property approach I suggested, andAnderson’s version.

Finally, and most entertainingly, I refer you to an examination of ontologicalarguments and counter-arguments in the form of a series of puzzles, in (Smullyan1983), Chapter 10. You should find this fun, and a bit of a relief after the ratherheavy going of the book you just finished.

Bibliography

Adams, R. M. (1995), Introductory note to *1970, in Feferman, John W. Daw-son, Goldfarb, Parsons & Solovay (1995), pp. 388–402.

Anderson, C. A. (1990), ‘Some emendations of Godel’s ontological proof’, Faithand philosophy 7, 291–303.

Anderson, C. A. & Gettings, M. (1996), Godel’s ontological proof revisited,pp. 167–172. In (Hajek 1996b).

Andrews, P. B. (1971), ‘Resolution in type theory’, Journal of Symbolic Logic36(3), 414–432.

Andrews, P. B. (1972), ‘General models and extensionality’, Journal of SymbolicLogic 37(2), 395–397.

Andrews, P. B. (1986), An Introduction to Mathematical Logic and Type Theory:To Truth Through Proof, Academic Press, Orlando, Florida.

Bressan, A. (1972), A General Interpreted Modal Calculus, Yale UniversityPress.

Carnap, R. (1956), Meaning and Necessity, 2 edn, University of Chicago Press,Chicago.

Charlesworth, M. J. (1979), St. Anselm’s Proslogion, University of Notre DamePress, Notre Dame, IN. First edition, Oxford University Press, 1965.

Church, A. (1940), ‘A formulation of the simple theory of types’, Journal ofSymbolic Logic 5, 56–68.

Cocchiarella, N. B. (1969), ‘A completeness theorem in second order modallogic’, Theoria 35, 81–103.

Descartes, R. (1951), A Discourse on Method and Selected Writings, Everyman’sLibrary, E. P. Dutton, New York. Translation by John Veitch.

Feferman, S., John W. Dawson, J., Goldfarb, W., Parsons, C. & Solovay, R. N.,eds (1995), Kurt Godel Collected Works, Volume III, Unpublished Essaysand Lectures, Oxford University Press, New York.

153

BIBLIOGRAPHY 154

Fitting, M. C. (1983), Proof Methods for Modal and Intuitionistic Logics, D.Reidel Publishing Co., Dordrecht.

Fitting, M. C. (1993), Basic modal logic, in D. M. Gabbay, C. J. Hogger &J. A. Robinson, eds, ‘Handbook of Logic in Artificial Intelligence and LogicProgramming’, Vol. 1, Oxford University Press, pp. 368–448.

Fitting, M. C. (1996), First-Order Logic and Automated Theorem Proving,Springer-Verlag. First edition, 1990.

Fitting, M. C. (1998), Higher-order modal logic—a sketch, in R. Caferra &G. Salzer, eds, ‘Automated Deduction in Classical and Non-Classical Log-ics’, Springer Lecture Notes in Artificial Intelligence, 1761, pp. 23–38.

Fitting, M. C. (2000a), Databases and higher types, in J. Lloyd, V. Dahl, U. Fur-bach, M. Kerber, K.-K. Lau, C. Palamidessi, L. M. Pereira, Y. Sagiv &P. Stuckey, eds, ‘Computational Logic—CL 2000’, Springer Lecture Notesin Artificial Intelligence, 1861, pp. 41–52.

Fitting, M. C. (2000b), Modality and databases, in R. Dyckhoff, ed., ‘AutomatedReasoning with Analytic Tableaux and Related Methods’, Springer LectureNotes in Artificial Intelligence, 1847, pp. 19–39.

Fitting, M. C. & Mendelsohn, R. (1998), First-Order Modal Logic, Kluwer.Paperback, 1999.

Gallin, D. (1975), Intensional and Higher-Order Modal Logic, North-Holland.

Gilmore, P. C. (1998a), Cut-elimination for an impredicative simple theory oftypes, Available at http://www.cs.ubc.ca/spider/gilmore To appear, Jour-nal of Symbolic Logic.

Gilmore, P. C. (1998b), An impredicative simple theory of types, Presentedat the Fourteenth Workshop on Mathematical Foundations for Program-ming Systems, Queen Mary College, London, May 1998. Available at:http://www.cs.ubc.ca/spider/gilmore.

Gilmore, P. C. (1999), Partial functions in an impredicative simple theory oftypes, in N. V. Murray, ed., ‘Automated Reasoning with Analytic Tableauxand Related Methods’, number 1617 in ‘Lecture Notes in Artificial Intelli-gence’, Springer, Berlin, pp. 186–201.

Godel, K. (1970), Ontological proof, in Feferman et al. (1995), pp. 403–404.

Goldfarb, W. D. (1981), ‘The undecidability of the second-order unificationproblem’, Theoretical Computer Science 13, 225–230.

Hajek, P. (1995), Der Mathematiker und die Frage der Existenz Gottes, Toappear in Wahrheit und Beweisbarkeit – Leben und Werk von K. Godel,Buld, Kohler, and Schimanowicz.

BIBLIOGRAPHY 155

Hajek, P. (1996a), Magari and others on Godel’s ontological proof, in Ursini &Agliano, eds, ‘Logic and Algebra’, Marcel Dekker, Inc., pp. 125–136.

Hajek, P., ed. (1996b), Godel ’96, Springer, Berlin.

Hartshorne, C. (1965), Anselm’s Discovery: A Re-Examination of the Ontolog-ical Proof for God’s Existence, Open Court, LaSalle, IL.

Hazen, A. P. (1998), ‘On Godel’s ontological proof’, Australasian Journal ofPhilosophy 76(3), 361–377.

Henkin, L. (1950), ‘Completeness in the theory of types’, Journal of SymbolicLogic 15, 81–91.

Huet, G. P. (1972), Constrained Resolution: A Complete Method for HigherOrder Logic, PhD thesis, Case Western Reserve University.

Huet, G. P. (1973), ‘The undecidability of unification in third-order logic’, In-formation and Control 22, 257–267.

Huet, G. P. (1975), ‘A unification algorithm for typed λ-calculus’, TheoreticalComputer Science 1, 27–57.

Hughes, G. E. & Cresswell, M. J. (1996a), A New Introduction to Modal Logic,Routledge, London and New York.

Hughes, G. E. & Cresswell, M. J. (1996b), A New Introduction to Modal Logic,Routledge, London.

Kohlhase, M. (1995), Higher-order tableaux, in P. Baumgartner, R. Hahnle &J. Posegga, eds, ‘Theorem Proving with Analytic Tableaux and RelatedMethods’, Vol. 918 of Lecture Notes in Artificial Intelligence, Springer-Verlag, Berlin, pp. 294–309.

Kripke, S. (1980), Naming and Necessity, Harvard University Press.

Leibniz, G. W. (1956), Philosophical Papers and Letters, 2 edn, D. Reidel,Dordrecht-Holland. Translated and Edited by Leroy E. Loemker.

Leivant, D. (1994), Higher order logic, in D. M. Gabbay, C. J. Hogger & J. A.Robinson, eds, ‘Handbook of Logic in Artificial Intelligence and Logic Pro-gramming’, Vol. 2, Clarendon Press, Oxford, pp. 229–321.

Magari, R. (1988), ‘Logica e teofilia’, Notizie di logica.

Manzano, M. (1996), Extensions of First Order Logic, Cambridge UniversityPress, Cambridge, UK.

Montague, R. (1960), ‘On the nature of certain philosophical entities’, TheMonist 53, 159–194. Reprinted in (Thomason 1974), 148–187.

BIBLIOGRAPHY 156

Montague, R. (1968), Pragmatics, pp. 102–122. In Contemporary Philosophy:A Survey, R. Klibansky editor, Florence, La Nuova Italia Editrice, 1968.Reprinted in (Thomason 1974), 95–118.

Montague, R. (1970), ‘Pragmatics and intensional logic’, Synthese 22, 68–94.Reprinted in (Thomason 1974), 119–147.

Oppy, G. (1995), Ontological Arguments and Belief in God, Cambridge Univer-sity Press, Cambridge, UK.

Oppy, G. (1996), ‘Ontological arguments’, The Stanford Encyclopedia of Phi-losophy, Edward N. Zalta (ed.). Available only on the internet. Ver-sion March 13, 1996. URL = http://plato.stanford.edu/entries/ontological-arguments/.

Plantinga, A. (1965), The ontological argument, from St. Anselm to comtempo-rary philosophers, Anchor-Doubleday, Garden City, NY.

Prawitz, D. (1968), ‘Hauptsatz for higher order logic’, Journal of Symbolic Logic33, 452–457.

Russell, B. (1905), ‘On denoting’, Mind 14, 479–493. Reprinted in Robert C.Marsh, ed., Logic and Knowledge: Essays 1901-1950, by Bertrand Russell,Allen & Unwin, London, 1956.

Schutte, K. (1960), ‘Syntactical and semantical properties of simple type the-ory’, Journal of Symbolic Logic 25(4), 305–326.

Scott, D. S. (1987), Godel’s ontological proof, pp. 257–258. In (Thomson 1987).

Shapiro, S. (1991), Foundations Without Foundationalism: A Case for Second-Order Logic, number 17 in ‘Oxford Logic Guides’, Oxford University Press,Oxford, UK.

Smith, P. (1993), Higher-order logic, model theory, recursion theory, and prooftheory.

Smullyan, R. M. (1968), First-Order Logic, Springer-Verlag, Berlin. RevisedEdition, Dover Press, New York, 1994.

Smullyan, R. M. (1983), 5000 B.C. and Other Philosophical Fantasies, St. Mar-tin’s Press, New York.

Sobel, J. (1987), Godel’s ontological proof, pp. 241–261. In (Thomson 1987).

Takahashi, M. (1967), ‘A proof of cut-elimination theorem in simple type the-ory’, J. Math. Soc. Japan 19, 399–410.

Thomason, R. H., ed. (1974), Formal Philosophy, Selected Papers of RichardMontague, Yale University Press, New Haven and London.

BIBLIOGRAPHY 157

Thomson, J. J. (1987), On being and saying: essays for Richard Cartwright,MIT Press, Cambridge, MA.

Toledo, S. (1975), Tableau Systems for First Order Number Theory and CertainHigher Order Theories, number 447 in ‘Lecture Notes in Mathematics’,Springer-Verlag, Berlin, Heidelberg, NY.

Mathematics] [Computability Theory] - Types, Tableaus, And Godel's God. (Melvin Fitting)

Documents

Transcript of Mathematics] [Computability Theory] - Types, Tableaus, And Godel's God. (Melvin Fitting)