The Proof Theory and Semantics of Intuitionistic Modal Logic

Alex K. Simpson

Doctor of Philosophy University of Edinburgh

Abstract

Possible world semantics underlies many of the applications of modal logic in computer science and philosophy. The standard theory arises from interpreting the semantic definitions in the ordinary meta-theory of informal classical mathematics. If, however, the same semantic definitions are interpreted in an intuitionistic metatheory then the induced modal logics no longer satisfy certain intuitionistically invalid principles. This thesis investigates the intuitionistic modal logics that arise in this way.

Natural deduction systems for various intuitionistic modal logics are presented. From one point of view, these systems are self-justifying in that a possible world interpretation of the modalities can be read off directly from the inference rules. A technical justification is given by the faithfulness of translations into intuitionistic first-order logic. It is also established that, in many cases, the natural deduction systems induce well-known intuitionistic modal logics, previously given by Hilbertstyle axiomatizations.

The main benefit of the natural deduction systems over axiomatizations is their susceptibility to proof-theoretic techniques. Strong normalization (and confluence) results are proved for all of the systems. Normalization is then used to establish the completeness of cut-free sequent calculi for all of the systems, and decidability for some of the systems.

Lastly, techniques developed throughout the thesis are used to establish that those intuitionistic modal logics proved decidable also satisfy the finite model property. For the logics considered, decidability and the finite model property presented open problems.

Acknowledgements

I owe much to my supervisor, Gordon Plotkin. Not only has he taught me a great deal, but he has been enormously supportive throughout my ‘random walk’ towards a thesis.

I am indebted to my former colleagues, Fausto Giunchiglia and Luciano Serafini, for provoking my initial interest in modal logic. They have remained rich sources of ideas and intellectual stimulation.

The work in this thesis has benefited greatly from discussions with Valeria de Paiva, David Pym and Colin Stirling. The presentation of the thesis has benefited from the use of Paul Taylor’s Latex diagram package.

The Laboratory for the Foundations of Computer Science has provided a very stimulating (and distracting) environment for research. It has been my pleasure to discuss many subjects with many people. I mention in particular the Ben Alder team: John Longley, Savi Maharaj and Pete Sewell. I also thank my office mates, Pietro Cenciarelli, Christophe Raffalli and Andrew Wilson, for tolerating the many moods of writing up.

Above all, I thank my family and friends for their love and support over the last three years. This thesis is dedicated to the memory of my grandfather, Tom Edward Lewis.

Declaration

This thesis was composed by myself, and the work reported herein is my own.

Table of Contents

1. Introduction 1 1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Synopsis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2. Intuitionistic logic 9

2.1 Natural deduction for intuitionistic logic . . . . . . . . . . . . . . . 9 2.1.1 The natural deduction system . . . . . . . . . . . . . . . . . 9 2.1.2 Normalization . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 The semantics of intuitionistic logic . . . . . . . . . . . . . . . . . . 20 2.3 Geometric theories in intuitionistic logic . . . . . . . . . . . . . . . 24

3. Intuitionistic modal logic 32 3.1 Modal logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 3.2 What is intuitionistic modal logic? . . . . . . . . . . . . . . . . . . 38 3.3 Previous approaches to intuitionistic modal logic . . . . . . . . . . . 41 3.4 Our approach to intuitionistic modal logic . . . . . . . . . . . . . . 58

4. Natural deduction for intuitionistic modal logics 65 4.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 4.2 The basic modal natural deduction system . . . . . . . . . . . . . . 70 Table of Contents v

4.3 Conditions on the visibility relation . . . . . . . . . . . . . . . . . . 72 4.4 The consequence relation . . . . . . . . . . . . . . . . . . . . . . . . 76 4.5 Soundness relative to modal models . . . . . . . . . . . . . . . . . . 78 4.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

5. Meta-logical completeness 85 5.1 Meta-logical soundness . . . . . . . . . . . . . . . . . . . . . . . . . 86 5.2 A semantics for intuitionistic modal logics . . . . . . . . . . . . . . 88 5.3 Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 5.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

6. Axiomatizations 98 6.1 Correspondence with IK . . . . . . . . . . . . . . . . . . . . . . . . 98 6.2 Axiomatizations of other modal logics . . . . . . . . . . . . . . . . . 105 6.3 Problems with a more general scheme . . . . . . . . . . . . . . . . . 111 6.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

7. Normalization and its consequences 118 7.1 Strong normalization for N_{□♢}(T ) . . . . . . . . . . . . . . . . . . . 118 7.2 A cut-free sequent calculus . . . . . . . . . . . . . . . . . . . . . . . 125 7.3 Decidability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

7.3.1 The structure of sequents . . . . . . . . . . . . . . . . . . . 134 7.3.2 A preorder on sequents . . . . . . . . . . . . . . . . . . . . . 138 7.3.3 Irredundant derivations and decidability . . . . . . . . . . . 142

7.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144 Table of Contents vi 8. Birelation models and the finite model property 148

8.1 Interpreting N_{□♢} in birelation models . . . . . . . . . . . . . . . . . 148 8.1.1 Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . 150 8.1.2 Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153 8.1.3 Extension to N_{□♢}(T ) . . . . . . . . . . . . . . . . . . . . . . 155

8.2 The finite model property . . . . . . . . . . . . . . . . . . . . . . . 157 8.2.1 Constructing a bounded model . . . . . . . . . . . . . . . . 161 8.2.2 Quotienting a birelation model . . . . . . . . . . . . . . . . 167 8.2.3 Applying the quotienting technique . . . . . . . . . . . . . . 171

8.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174

9. Conclusions and further work 176 9.1 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176 9.2 Further work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

A. Proofs of strong normalization and confluence for N_{IL}(T ) 182 A.1 Proof of strong normalization . . . . . . . . . . . . . . . . . . . . . 182 A.2 Proof of confluence . . . . . . . . . . . . . . . . . . . . . . . . . . . 190

B. Sequence prefixes 194

List of Figures

2–1 Natural deduction for intuitionistic predicate logic. . . . . . . . . . 11 2–2 Proper reductions. . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2–3 Permutative reductions. . . . . . . . . . . . . . . . . . . . . . . . . 14 2–4 Derivation of χ from (R_{χ}). . . . . . . . . . . . . . . . . . . . . . . . 26 2–5 Derivation of (R_{χ}) from χ. . . . . . . . . . . . . . . . . . . . . . . . 26 2–6 Permutative reduction for (R_{χ}). . . . . . . . . . . . . . . . . . . . . 26

3–1 The modal logic K. . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3–2 Modal axioms and corresponding frame properties. . . . . . . . . . 35 3–3 Intuitionistic K without ♢. . . . . . . . . . . . . . . . . . . . . . . . 46 3–4 Wijesekera’s system. . . . . . . . . . . . . . . . . . . . . . . . . . . 47 3–5 Countermodel to Requirement 3. . . . . . . . . . . . . . . . . . . . 48 3–6 Axiomatization of IK. . . . . . . . . . . . . . . . . . . . . . . . . . 52 3–7 Intuitionistic modal axioms. . . . . . . . . . . . . . . . . . . . . . . 56

4–1 The basic modal natural deduction system, N_{□♢}. . . . . . . . . . . 69 4–2 Derivations of the IK axioms. . . . . . . . . . . . . . . . . . . . . . 71 4–3 Properties of the visibility relation. . . . . . . . . . . . . . . . . . . 73 4–4 Rules expressing properties of the visibility relation. . . . . . . . . . 73 4–5 Derivations using rules on the visibility relation. . . . . . . . . . . . 75 List of Figures viii

5–1 Translation of derivations. . . . . . . . . . . . . . . . . . . . . . . . 87

6–1 General form of G. . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 6–2 Dissection of T^{i}. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 6–3 Axioms for T, B, 4 and 5. . . . . . . . . . . . . . . . . . . . . . . . 108 6–4 Derivation of ♢^{k} □ A ⊃ □^{l}A using (R_{ϕ_{kl}}). . . . . . . . . . . . . . . . 108 6–5 Countermodel to axiomatization of directedness. . . . . . . . . . . . 115

7–1 Modal proper reductions. . . . . . . . . . . . . . . . . . . . . . . . . 119 7–2 Modal permutative reductions. . . . . . . . . . . . . . . . . . . . . . 120 7–3 The cut-free sequent calculus L_{□♢}(T ). . . . . . . . . . . . . . . . . 126 7–4 Rules for the modified sequent calculus, L′_{□♢}(T_{H}, T ). . . . . . . . . 126 7–5 Intuitionistic modal logics known to be decidable. . . . . . . . . . . 132

8–1 Counterexample to general soundness. . . . . . . . . . . . . . . . . 149

B–1 Derivations of the IK axioms using sequence prefixes. . . . . . . . . 200

Chapter 1

Introduction

1.1 Motivation

Classical modal logics are extensions of classical logic with new operators (modalities) whose operation is intensional (i.e. non truth-functional). Originally, modal logics were used by philosophers to model intensional notions such as necessity, possibility, belief, knowledge, obligation, etc. However, there was a great deal of controversy amongst philosophers, some of whom doubted whether the whole enterprise was even meaningful. The consolidation of modal logic came in the late 1950s and early 1960s with the development of an intuitive semantics based on ‘possible worlds’ by Kripke (after whom the semantics is often named), Kanger and Hintikka (see, e.g., [50,47,44]). In philosophy, possible world semantics has been used in support of elaborate metaphysical arguments (see, e.g., Kripke [52]); however, the philosophical controversy over modal logic is far from settled. Yet the development of possible world semantics has enabled modal logic to escape to other fields. First, the semantics is mathematically natural. Thus the model theory of modal logic has become an interesting subfield of mathematical logic in its own right (see, e.g., van Bentham [6]). Second, the semantics enabled modal logic to be applied to interesting mathematical problems such as Solovay’s Completeness Theorem [72]. Lastly, possible world models are closely related to the transition systems of computer science. This connection has led to many applications of modal logic in computer science such as dynamic logic [49] and Hennessy-Milner logic [42]. For a general introduction to modal logic see Hughes and Cresswell [46].

Intuitionism arose as a school of mathematics founded by the Dutch mathematician L. E. J. Brouwer. He rejected mathematical methods whose justification required appeal to an abstract concept of ‘truth’ interpreted in some mysterious Platonic realm of mathematical entities. Rather, Brouwer believed that mathematical meaning originates in the human act of ‘doing’ mathematics. Thus, for Brouwer, a mathematical object must be given by a (mental) construction, and there is no abstract sense in which a statement may be true unless we have a proof of it (or the means to find one). Furthermore, the steps taken in any proof must be legitimate according to this rigid interpretation of mathematics. As is well known, such considerations led Brouwer to reject various classical principles such as, most notoriously, the law of the excluded middle: that A ∨ ¬A holds for any proposition A.

In the 1930s, Heyting developed intuitionistic logic, a logic embodying the underlying principles of intuitionistic reasoning. Intuitionistic logic has been enormously successful. First, it is widely accepted as having achieved its original goal of isolating the intuitionistically acceptable methods of proof. Second, in providing a foundation for the metamathematical investigation of intuitionistic mathematics, it has revealed intuitionistic mathematics as being a field of remarkable coherence and mathematical beauty, whether or not one accepts its underlying philosophical tenets. Third, there are deep connections with computation theory that have recently been exploited in computer science (see Martin-Löf [54] and Scott [69] for two very different applications). The proof theory of intuitionistic logic has also found recent philosophical application. Dummett has argued that the proof theory justifies intuitionistic logic as the underlying logic of an anti-realist philosophy [17]. His argument gives an account of intuitionism which is substantially different from Brouwer’s and which applies to non-mathematical reasoning as well as to mathematical reasoning. For a general introduction to both the philosophy and mathematics of intuitionism and intuitionistic logic see Dummett [16].

In this thesis we study various intuitionistic modal logics obtained by extending intuitionistic logic with intensional operators. We give three reasons for considering such logics. First, it is mathematically natural to combine the two forms of logic. Second, there are promising computer science applications for intuitionistic modal logic. Third, for an intuitionistic philosopher, there is a self evident desire to have an intuitionistic account of the different intensional operators (particularly if one accepts Dummett’s arguments and applies intuitionistic logic in non-mathematical contexts).

Most of the previous work on intuitionistic modal logics (we shall give a survey in Section 3.3) seems to have been motivated by the first reason. Although there is probably some underlying philosophical intuition, much work describes formal systems obtained by combining intuitionistic logic with an apparently ad hoc choice of modal axioms and rules. Without philosophical guidance, there are a bewildering number of inequivalent such choices that can be made.

In the applications of intuitionistic modal logic to computer science (a survey is again given in Section 3.3) the methodology is somewhat different. Typically, one defines a modal logic over a model based on some computational situation. For certain forms of model (with an in-built partial order) and certain definitions of logical satisfaction, the modal logics so-induced are intuitionistic rather than classical. Thus the parameters are the notion of model and definition of satisfaction. The resulting modal logic is then forced.

In contrast, the interesting problem of giving an account of intuitionistic modal logic accessible to an intuitionistic philosopher has been largely ignored. (The closest approach is that of Ewald in his thesis [19], discussed further in Sections 3.3 and 3.4.) Indeed, it seems to us that many of the intuitionistic modal logics previously considered can not be so justified, for the condition of being compatible with an intuitionistic philosophy is rather a stringent requirement to place on a logic.

In this thesis, we attempt to provide such an intuitionistic account of intuitionistic modal logic. Our approach is based on the standard account of (classical) modal logics in terms of possible world models. However, we interpret the usual semantics from the viewpoint of an intuitionistic meta-theory. Thus the semantics no longer validates any intuitionistically invalid principles. Consequently, the induced logics are intuitionistic modal logics rather than classical ones.

One problem with the above outlined approach is the reliance upon an intuitionistic meta-theory to arrive at intuitionistic modal logic. (Other, more technical, problems will be raised in Section 3.4.) Although the desired account of intuitionistic modal logic must make sense intuitionistically, we should like it to also make sense classically. That is, we would like to describe intuitionistic modal logic from a philosophically neutral stance. We achieve this desire in two different ways.

One way is via a proof-theoretic definition of intuitionistic modal logic. We give a natural deduction system in which the possible world interpretation of the modalities is built into the inference rules. Following Dummett’s proof-theoretic justification of intuitionism, we thereby arrive at a proof system embodying the above account of intuitionistic modal logic. Then we can study intuitionistic modal logic by studying the proof system, and this can be done using either intuitionistic or classical mathematics.

The second way is via a formalized meta-theory. We circumscribe the intuitionistic reasoning allowed in the meta-theory by restricting it to intuitionistic first-order logic. Then we induce the intuitionistic modal logic as those modal formulae whose validity is provable in the formal meta-theory. Again, this definition of an intuitionistic modal logic can be understood equally well from either an intuitionistic or classical (informal) meta-theory. A routine, but important, result of the thesis is that the formalized meta-theory yields the same intuitionistic modal logic as the natural deduction system.

It turns out that many of the intuitionistic modal logics we induce occur already in work of Ewald [20], Fisher Servi [24] and Plotkin and Stirling [64]. However, their original definitions were semantic and not intuitionistically motivated. Further, despite being well known, it was an open question whether the logics were decidable. (A flawed proof of decidability was given by Ewald [20]. We discuss this in detail in Chapter 8.) Our natural deduction system enables us to prove the decidability of a number of the logics using proof normalization. The techniques used to prove decidability also allow us to establish the finite model property for the same class of intuitionistic modal logics relative to the models considered in the work of Ewald et al.

In summary, our intention is to provide an intuitionistic account of intuitionistic modal logic. To this end we give two different definitions of intuitionistic modal logic based on an intuitionistic interpretation of the standard possible world semantics. These definitions can be understood either intuitionistically or classically. We prove the equivalence of the two definitions and establish important properties of the induced modal logics including decidability.

Despite our good intentions, we resort to classical metamathematics in order to prove many of the results (including the equivalence of the two definitions of intuitionistic modal logic). This is largely a matter of convenience, for none of the important results is classical reasoning actually necessary (although intuitionistically acceptable proofs would often require different techniques). However, for some of the completeness results (not mentioned above) classical reasoning is necessary. To placate the intuitionist reader, we shall discuss, in appropriate places, what classical principles we are using and how proofs would have to be modified in order to avoid them. In such comments, we shall use ‘intuitionistic’ in a narrow sense to mean reasoning acceptable to any constructivist (except an ultra-finitist). (The reason we do not use the adjective ‘constructive’ is that it has a common alternative use to describe classical arguments in which additional information is provided.) We shall make explicit any further assumptions, e.g., if we require any of the classically invalid principles of Brouwer’s intuitionism. For full accounts of the different ‘constructive’ viewpoints see Troelstra and van Dalen [79]. In their terminology our default is ‘Bishop constructivism’, although none of our ‘intuitionistic’ proofs will require dependent choice. In fact, all our ‘intuitionistic’ proofs could be carried out in the internal logic of the free topos with natural numbers object [53].

Although we shall not concentrate on applications to computer science, some discussion of the applicability of the work is in order. We do not know if the particular intuitionistic modal logics discussed in this thesis are appropriate for applications to computer science. But we do believe that we present convincing arguments that the intuitionistic modal logics we consider are, in some sense, the true intuitionistic analogues of their corresponding classical modal logics. Perhaps their very naturalness is sufficient reason to believe in their applicability. Further, the arguments we give open the door to many philosophical applications; for example, in epistemic logic. Thus we expect the logics to be of use in artificial intelligence. However, even if the logics are not themselves applicable, we strongly believe that some of the techniques we use will nonetheless have computer science applications. One concrete proposal along these lines is given in Chapter 9.

Lastly, a remark on emphasis. The main achievements of the thesis are methodological (the approach to intuitionistic modal logic) and technical (especially the proofs of decidability and the finite model property). Despite the philosophical motivation guiding the methodology, the thesis does not provide the necessary arguments to properly justify any philosophical applications of the logics considered. However, we believe that the thesis does lay the technical foundations on which such arguments can be built.

1.2 Synopsis

In Chapter 2 we give basic results concerning three aspects of intuitionistic firstorder (and propositional) logic. The first is the proof theoretical analysis of natural deduction for intuitionistic logic. The second is its Kripke semantics. The third concerns some basic properties of so-called ‘geometric’ theories in intuitionistic logic, including a novel proof-theoretical analysis of such theories. These three aspects of intuitionistic logic underlie much of the work in the thesis.

In Chapter 3 we introduce intuitionistic modal logic. First, we give a short survey of classical modal logic. Then we discuss the question: What is intuitionistic modal logic? The previous work in the field is then surveyed, in the light of the preceding discussion. Lastly, we introduce our approach to intuitionistic modal logic.

In Chapter 4 we present our natural deduction systems for intuitionistic modal logics. There is a basic system, giving the rules for the connectives and modalities, which induces the intuitionistic analogue of the modal logic K. This system can be extended, in a principled way, with rules expressing conditions on the semantic ‘visibility’ relation to induce intuitionistic analogues of modal logics extending K. We define the consequence relations induced by the natural deduction systems and prove soundness relative to the standard interpretation in possible world models, using only intuitionistic reasoning. Lastly, we discuss the relationship with other work on proof systems for modal logics.

In Chapter 5 we prove that the intuitionistic modal logics induced by the natural deduction systems are the same as the modal logics induced via a translation into intuitionistic first-order logic. This amounts to the equivalence of the two methods, discussed above, of defining intuitionistic modal logics.

In Chapter 6 we derive complete Hilbert-style axiomatizations for many of the intuitionistic modal logics induced by the natural deduction systems. However, for some intuitionistic modal logics the natural axiomatizations are incomplete, and we do not know of any alternatives that work.

In Chapter 7 we give normalization results for the natural deduction systems. For all systems, strong normalization and confluence are proved via translations into intuitionistic first-order natural deduction. We use the normalization results to establish the completeness of induced cut-free sequent calculi. The sequent calculi are then used to prove the decidability of a number of the logics.

In Chapter 8 we consider a semantic framework due to Ewald [20], Fischer Servi [23] and Plotkin and Stirling [64]. We prove the finite model property for those logics proved decidable in the Chapter 7. (This fact gives an alternative, but more complicated, proof of decidability.)

In Chapter 9 we summarize the work in the thesis, and describe possible directions for future research.

There are two appendices.

Appendix A provides proofs of strong normalization and confluence for the proof system for geometric theories introduced in Chapter 2.

Appendix B reformulates the basic natural deduction system for intuitionistic modal logic of Chapter 4 in order to ease comparison with related work.

Intuitionistic logic

In this chapter we present those aspects of intuitionistic first-order (and propositional) logic that we shall use later. In Section 2.1 we review natural deduction for intuitionistic first-order logic and mention some of its applications, both technical and philosophical. In Section 2.2 we review Kripke’s semantics of intuitionistic logic. Lastly, in Section 2.3, we present some aspects of geometric theories in intuitionistic logic, including a novel proof-theoretical account of such theories.

2.1 Natural deduction for intuitionistic logic

2.1.1 The natural deduction system

The natural deduction system for intuitionistic first-order logic was introduced by Gentzen in his classic 1935 paper [36]. This system provides a very attractive formalization of intuitionistic logic for three intimately related reasons. First, it formalizes ordinary intuitive (intuitionistic) reasoning very closely. Second, it has an elegant meta-theory in which natural deduction derivations are treated as objects of mathematical interest in their own right. Third, one can view the inference rules themselves as providing the logical connectives and quantifiers with their meaning. From his paper, it seems that Gentzen’s main motivation in introducing natural deduction was the first consideration. For meta-theoretical analysis, Gentzen formulated his sequent calculus, which was better able to deal with classical logic. As regards the third consideration, Gentzen did make the highly influential remark that one can read off the meanings of the connectives from their natural deduction inference rules. However, there was no technical framework then in place within which this insight could be developed.

We now give a comprehensive, but informal, overview of Gentzen’s natural deduction system for intuitionistic first-order logic without equality. Henceforth, we write IL for intuitionistic first-order logic, and N_{IL} for its natural deduction system. The reader is referred to the works of Prawitz [65,66] for a more thorough treatment of natural deduction for IL. We assume given some first-order signature. We use: x, y … to range over variables; t, … to range over terms; a, b, … to range over atomic formulae; and ϕ, ψ, … to range over formulae, which are given by the grammar:

ϕ ::= a | ⊥ | ϕ ∧ ψ | ψ ∨ ψ | ϕ ⊃ ψ | ∀x. ϕ | ∃x. ϕ.

Thus we have as primitive: an absurdity constant, ⊥; conjunction, ∧; disjunction, ∨; implication, ⊃; the universal quantifier, ∀; and the existential quantifier, ∃. We shall use the term logical constants to refer collectively to these connectives and quantifiers. It is well known that no one of the above logical constants is definable from the others in intuitionistic logic (see, e.g., van Dalen [14, p. 271]). We define: negation by ¬ϕ = ϕ ⊃ ⊥; logical equivalence by ϕ ↔ ψ = (ϕ ⊃ ψ) ∧ (ψ ⊃ ϕ); and a truth constant by ⊤ = ⊥ ⊃ ⊥. We do not distinguish between formulae differing only in the names of their bound variables. We write ϕ[t/x] for the formula obtained by substituting the term t for all free occurrences of x in ϕ. A sentence is a formula with no free variables. The notion of subformula is defined inductively by: ϕ is a subformula of itself; if one of ϕ ∨ ψ, ϕ ∧ ψ and ϕ ⊃ ψ is a subformula of θ then so are ϕ and ψ; and, if either ∀x. ϕ or ∃x. ϕ is a subformula of ψ then so is ϕ[t/x], for any term t.

A prederivation is a tree of formulae together with a partial function, its discharge information, as specified below. The formulae occurring at leaves of the prederivation are called assumptions, and the root is called the conclusion. The discharge information is a partial function from the leaves of the tree (assumption

{⊥ \atop ϕ} (⊥E)
\begin{matrix}ϕ & ψ \\ ϕ ∧ ψ \end{matrix} (∧I)  {ϕ ∧ ψ \atop ϕ} (∧E1) {ϕ ∧ ψ \atop ψ} (∧E2)

{ϕ \atop ϕ ∨ ψ} (∨I1) {ψ \atop ϕ ∨ ψ} (∨I2) \begin{aligned}ϕ ∨ ψ & [ϕ] ; ⋮ . ; θ & [ψ] ; ⋮ . ; θ \\ & θ \end{aligned}(∨E)

[ϕ] ; ⋮ . ; ψ ; ϕ ⊃ ψ (⊃I) \begin{matrix}ϕ ⊃ ψ & ϕ \\ ψ \end{matrix} (⊃E)
{ϕ \atop ∀x. ϕ} ^{(∀I)^{∗}}  {∀x. ϕ \atop ϕ[t/x]} (∀E)

{ϕ[t/x] \atop ∃x. ϕ} (∃I)  \begin{matrix}∃x. ϕ & [ϕ] ; ⋮ . ; ψ \\ ψ \end{matrix}^{(∃E)^{†}}

∗Restriction on (∀I): x must not occur free in any open assumption. †Restriction on (∃E): x may neither occur free in ψ nor in any open assumption upon which ψ depends other than in the distinguished occurrences of ϕ.

Figure 2–1: Natural deduction for intuitionistic predicate logic. occurrences) to nodes of the tree such that each leaf in the domain of the function is mapped to a node below it in the tree. Such an assumption occurrence is said to be discharged (at the node). An assumption occurrence which is not discharged is said to be open.

A derivation is a prederivation generated by the rules in Figure 2–1 from (trivial) derivations consisting of a single open assumption. The discharge of assumptions is prescribed by applications of the (∨E), (⊃I), and (∃E) rules. Each of these rules applies to premises in whose derivations a set of open assumption occurrences is distinguished. These distinguished assumption occurrences are then discharged at the conclusion of the rule application. This discharge of assumptions may be vacuous in that the set of distinguished assumption occurrences may be empty. Further, the set is not required to contain all open occurrences of the appropriate assumptions (except when so demanded by the side-condition on (∃E)). We shall mark discharged assumption occurrences by enclosing them in square brackets. When we wish to make clear the rule at which an assumption occurrence is discharged we shall mark the occurrence and its rule with identical numerical superscripts.

We shall use Σ, Σ′, … to range over derivations in N_{IL}. When we wish to note that the conclusion of Σ is ϕ we write Σ ϕ . We write {ϕ \atop Σ} to distinguish a (possibly empty) set of occurrences of the open assumption ϕ in Σ.

A derivation shows that its conclusion follows logically from the open assumptions. The induced consequence relation, S ⊢_{IL} ϕ, between sets of formulae, S, and formulae, ϕ, is defined by: S ⊢_{IL} ϕ if there exists a derivation, Σ ϕ , in which all open assumptions are contained in the set S. We also say that Σ is a derivation of S ⊢_{IL} ϕ. A formula, ϕ, is said to be a theorem (of IL) if ∅ ⊢_{IL} ϕ, in which case we just write ⊢_{IL} ϕ. We shall adopt other standard notational conventions, such as using commas for set union in the antecedent of consequences, without further comment.

We call the variable x in the (∀I) and (∃E) rules the eigenvariable of the rule (Prawitz writes ‘proper parameter’). We say that the eigenvariable in an application of (∀I) is closed by the conclusion of the rule. The eigenvariable in an application of (∃E) is said to be closed by the right-hand premise of the rule as written in Figure 2–1 (its so-called minor premise). An occurrence of a free variable, x, in a formula occurrence, ϕ, in Σ is said to be closed in Σ if it is closed by some formula occurring beneath ϕ in Σ. If x is not closed, it is said to be open.

We define two notions of substitution on derivations. One is a substitution of terms for variables. The derivation Σ[t/x] is defined by: first, renaming the closed variables in Σ so that they are disjoint from the set of variables in t; and second, substituting t for all open occurrences of x in the renamed derivation. The second notion of substitution is one of derivations for assumptions. Given two derivations {ϕ \atop Σ} and {Σ′ \atop ϕ} , we write {Σ′ \atop ϕ} ; Σ for the derivation obtained by: first, renaming the closed variables in Σ so that they are disjoint from set of open variables in Σ′; and second, replacing each distinguished occurrence of the open assumption ϕ in the renamed derivation with the derivation Σ′. In both notions of substitution, the renaming of closed variables ensures that the side-conditions on the quantifier rules remain satisfied in the resulting derivation.

Henceforth, we shall not distinguish between two derivations differing only in the names of their closed variables. Both notions of substitution above define unique derivations up to this equivalence.

It is worth remarking that the system N_{IL} has a straightforward representation in the Edinburgh Logical Framework (LF) of Harper et al [41]. When encoded in LF, the side-conditions on the quantifier rules are handled very naturally by the binding mechanisms of the LF type theory. Also, the renaming of closed variables (which correspond to bound variables in LF) and the equivalence on derivations are subsumed by alpha conversion between lambda terms.

2.1.2 Normalization

Note how each logical constant has a finite set of introduction rules (suffixed by ‘I’) and a finite set of elimination rules (suffixed by ‘E’). The introduction rules conclude with a formula whose outermost logical constant is the appropriate one;

\begin{matrix}{Σ_{1} \atop ϕ} & {Σ_{2} \atop ψ} \\ ϕ ∧ ψ \end{matrix} ; ϕ  ⟹ {Σ_{1} \atop ϕ}  \begin{matrix}{Σ_{1} \atop ϕ} & {Σ_{2} \atop ψ} \\ ϕ ∧ ψ \end{matrix} ; ψ  ⟹ {Σ_{2} \atop ψ}

\begin{aligned}Σ ϕ ; ϕ ∨ ψ & & {[ϕ] \atop Σ_{1}} ; θ & {[ψ] \atop Σ_{2}} ; θ \\ & θ \end{aligned} ⟹ Σ ϕ ; Σ_{1} ; θ  \begin{aligned}Σ ψ ; ϕ ∨ ψ & & {[ϕ] \atop Σ_{1}} ; θ & {[ψ] \atop Σ_{2}} ; θ \\ & θ \end{aligned} ⟹ Σ ψ ; Σ_{2} ; θ

\begin{matrix}{[ϕ] \atop Σ_{1}} ; ψ ; ϕ ⊃ ψ & {Σ_{2} \atop ϕ} \\ ψ \end{matrix}  ⟹ {Σ_{2} \atop ϕ} ; Σ_{1} ; ψ  Σ ϕ ; ∀x. ϕ ; ϕ[t/x]  ⟹ {Σ[t/x] \atop ϕ[t/x]}

\begin{matrix}{Σ_{1} \atop ϕ[t/x]} ; ∃x. ϕ & {[ϕ] \atop Σ_{2}} ; ψ \\ ψ \end{matrix}  ⟹ {Σ_{1} \atop ϕ[t/x]} ; Σ_{2}[t/x] ; ψ

Figure 2–2: Proper reductions.

\begin{aligned}Σ ⊥ ; ϕ & & Ξ \\ & ψ \end{aligned} (r)  ⟹  Σ ⊥ ; ψ

\begin{matrix}\begin{aligned}{Σ \atop ϕ ∨ ψ} & {[ϕ] \atop Σ_{1}} ; θ & {[ψ] \atop Σ_{2}} ; θ \\ & θ \end{aligned} & Ξ \\ θ′ \end{matrix} (r) ⟹ \begin{aligned}{Σ \atop ϕ ∨ ψ} & \begin{aligned}{[ϕ] \atop Σ_{1}} ; θ & & Ξ \\ & θ′ \end{aligned} (r) & \begin{aligned}{[ψ] \atop Σ_{2}} ; θ & & Ξ \\ & θ′ \end{aligned} (r) \\ & θ′ \end{aligned}

\begin{matrix}\begin{matrix}{Σ_{1} \atop ∃x. ϕ} & {[ϕ] \atop Σ_{2}} ; ψ \\ ψ \end{matrix} & Ξ \\ θ \end{matrix} (r)  ⟹  \begin{aligned}{Σ_{1} \atop ∃x. ϕ} & & \begin{aligned}{[ϕ] \atop Σ_{2}} ; ψ & & Ξ \\ & θ \end{aligned} (r) \\ & θ \end{aligned}

Figure 2–3: Permutative reductions. moreover, the conclusion is built out of the premises of the rule, using the constant in question. The elimination rules contain a premise (the major premise) whose outermost logical constant is the appropriate one; moreover, the conclusion of the elimination rule either consists of or is inferred from subformulas of the major premise. (The other premises of an elimination rule are called minor premises.)

The major contribution of Prawitz was to realize that the duality between introduction and elimination rules provides the basis for a meta-theoretical analysis of the natural deduction system. Prawitz [65, p. 33] formulated his inversion principle that if a formula is derived by means of an introduction rule only to be eliminated by means of the associated elimination rule then the derivation must already implicitly contain a derivation of its conclusion not involving the detour through the formula in question. To show that the natural deduction system satisfies the inversion principle, Prawitz defined a simple rewrite operation to remove any such unnecessary detour from a proof. By repeated rewriting, any derivation can be rewritten to one in which no detours occur. The resulting derivation is said to be in normal form.

The simplest form of detour in a derivation is given by a formula occurrence that is both the conclusion of an introduction rule and the major premise of an elimination rule. We call such a formula occurrence a maximum formula.

The rewrite operation removing maximum formulae, which we call proper reduction, is defined in Figure 2–2 (using the notation for substitution in derivations introduced on page 13). In the presentation of the rewrite rules, the maximum formula removed by each rewrite is highlighted in bold. For convenience, we have omitted to include the lower parts of the derivations being rewritten. The rewrites can, of course, be applied to a maximum formula anywhere in a derivation, that part of the derivation not given in Figure 2–2 remaining unchanged.

The notion of maximum formula does not, however, identify all unnecessary detours in derivations. Problems are caused by the (⊥E), (∨E) and (∃E) rules. For example, each of the three derivations:

{⊥ \atop ϕ ∧ ψ} ; ϕ  \begin{aligned}θ ∨ θ′ & \begin{matrix}ϕ & ψ \\ ϕ ∧ ψ \end{matrix} & \begin{matrix}ϕ & ψ \\ ϕ ∧ ψ \end{matrix} \\ & ϕ ∧ ψ \end{aligned} ; ϕ  \begin{matrix}∃x. ϕ & \begin{matrix}ϕ & ψ \\ ϕ ∧ ψ \end{matrix} \\ ϕ ∧ ψ \end{matrix} ; ϕ

has no maximum formula, but none satisfies the subformula property (that every formula occurring in the derivation is either a subformula of the conclusion or of some open assumption). Further, in the second and third examples, the formula ϕ ∧ ψ is ‘morally’ a maximum formula — it is introduced by an introduction only to be eliminated by an elimination. But the introduction-elimination sequence is interrupted by an intermediate elimination so no proper reduction applies.

In the derivations above one could identify the problem in the first case as being the application of the (⊥E) rule to derive a non-atomic formula, and in the second and third cases as the vacuous applications of the (∨E) and (∃E) rules (in that no assumptions are discharged). Indeed such considerations are among those highlighted by Prawitz in his treatments of normalization [65,66]. However, these observations obscure a more elegant account of why the subformula property fails. In each of the examples above, the conclusion of the troublesome elimination is itself the major premise of another elimination. In the case of (⊥E) this clearly leads to problems in general. In the cases of (∨E) and (∃E) it leads to problems because, as in the derivations above, the (∨E) and (∃E) rules might interrupt an introduction-elimination sequence that uninterrupted would produce a maximum formula. A good discussion of the issues is given by Girard in [37, Ch. 10].

In order to address the problem we identify other combinations of inferences that can be removed from derivations. Let us call the three problematic rules, (⊥E), (∨E) and (∃E), indirect rules. An occurrence of a formula in a derivation is said to be permutable if it is both the conclusion of an indirect rule and the major premise of an elimination. Thus in each of the three examples above, the lowest occurrence of ϕ ∧ ψ is a permutable formula.

Again, permutable formulae are eliminated from derivations through the application of rewrite rules. This time the rewrite rules in question are the so-called permutative reductions (we use the terminology of Prawitz [66], Girard writes ‘commuting conversions’ [37]). As there are 7 elimination rules and 3 indirect rules, there are 21 cases to be eliminated by permutative reductions (although the symmetry between (∧E1) and (∧E2) means that there are only 18 essentially distinct cases). For conciseness, we represent the reductions schematically, giving one schema for each indirect rule. The schematic reductions are presented in Figure 2–3, where the permutable formulae removed are highlighted in bold. In the rules, we write:

\begin{aligned}ϕ & & Ξ \\ & ψ \end{aligned} (r)

for an application of an elimination rule (r) with major premise ϕ, where Ξ represents the finite sequence (of length 0, 1 or 2) of derivations of the minor premises of the rule.

We write ⟹ for the rewrite relation on derivations given by a single application of either a proper or a permutative reduction. We write ⟹^{+} for its transitive closure, and ⟹^{∗} for its transitive-reflexive closure. The full force of the inversion principle is brought out by Prawitz’ various normalization theorems. The most basic normalization theorem removes all maximum formulae and permutable formulae from a derivation by repeated applications of the rewrite relation. We say a derivation is in normal form if it contains no maximum formula and no permutable formula. Clearly a derivation is in normal form if and only if ⟹ is not applicable. We say that ⟹ is weakly normalizing if any derivation can be rewritten to one in normal form by repeated applications of ⟹.

Theorem 2.1.1 (Prawitz [65]) The relation ⟹ is weakly normalizing.

The proof is by a straightforward induction based on showing that the application of an appropriate rewrite always reduces a suitable complexity measure on derivations. Later Prawitz made two improvements to his result. The first is that the relation ⟹ is strongly normalizing, i.e., for any derivation Σ, there is a natural number, d, such that every sequence of applications of ⟹ starting from Σ is finite with length at most d. We call the smallest such d the reduction depth of Σ. (Classically, by König’s Lemma, the above definition of strongly normalizing is equivalent to the usual one that every sequence of applications of ⟹ is finite.

However, intuitionistically, it is appropriate to adopt the stated definition asserting the existence of a reduction depth.) The second improvement of Prawitz is that the relation ⟹ is confluent, i.e. if Σ ⟹^{∗} Σ_{1} and Σ ⟹^{∗} Σ_{2} then there exists a derivation Σ′ such that Σ_{1} ⟹^{∗} Σ′ and Σ_{2} ⟹^{∗} Σ′.

Theorem 2.1.2 (Prawitz [66]) The relation ⟹ is strongly-normalizing and confluent.

An important corollary (of confluence and weak normalization) is that every derivation rewrites to a unique weak normal form. The proof of strong normalization is by a complicated argument based on Tait’s ‘computability’ method (called ‘strong validity’ in [66]). Once strong normalization is established, confluence is proved by verifying the easily checked property of weak confluence (see Klop [48]). Strictly speaking, the theorems above are not the ones proved by Prawitz. He had more complex (but very similar) notions of reduction. The permutative reductions for (∨E) and (∃E) presented above are mentioned in passing by Prawitz [66, p.253], who attributes them to Martin-Löf. The application of the same methods to (⊥E) is taken from Girard [37, Chapter 10], where it is remarked that the proof techniques of Prawitz are applicable. In Appendix A we prove a result (Theorem 2.3.2) that implies Theorem 2.1.2 as stated.

There are stronger notions of normal form obtained by considering further rewrites such as the ‘simplifications’ and ‘expansions’ of Prawitz [66, §II 3.3.2– 3.3.3]. These are important if one wants to consider the equational theory of the corresponding functional calculus obtained via the Curry-Howard isomorphism [45]. In this context, the proper reductions correspond to ‘beta reductions’ on terms and proof expansions correspond to ‘eta expansions’. However, for our purposes, the above notions of reduction and normal form suffice.

The applications of normalization are similar to the applications of Gentzen’s cut-elimination theorem for his sequent calculus [36]. Two applications particular to intuitionistic logic are:

Proposition 2.1.3

1. If ⊢_{IL} ϕ ∨ ψ then either ⊢_{IL} ϕ or ⊢_{IL} ψ.

2. If ⊢_{IL} ∃x. ϕ then ⊢_{IL} ϕ[t/x] for some term t.

Statement 1 is known as the disjunction property and statement 2 is known as the existence property. For proofs (of more general results) see [65, Corollary 6, p. 55] and [65, Corollary 7 (ii), p. 56] respectively. Some other standard applications are: the subformula property [65, Corollary 1, p. 53], the interpolation theorem [65, Corollary 5, p. 55], and the independence of the intuitionistic connectives [65, Corollary 9, p. 59]. All these results follow from the weak normalization theorem. I do not know of any interesting applications of strong normalization, other than in obtaining a simple proof of confluence via weak confluence. But it is a pleasant fact to know that any reduction sequence terminates.

It is not surprising that the applications of (weak) normalization and cutelimination are similar as Prawitz showed that either result can be derived from the other [65, Appendix A]. (The proof that cut-elimination follows from normalization can be seen as another application of weak normalization, as the proof of Theorem 2.1.1 is, in some ways, easier than a direct proof of cut-elimination.) The major advantage of natural deduction over sequent calculus is that it provides a formalization of the intuitive notion of proof. Prawitz’ analysis of natural deduction derivations can therefore be seen as a mathematical analysis of the informal notion of proof. Although sequent calculus is perhaps more convenient for certain applications, Prawitz argues that it is a system of derived rules whereas the natural deduction rules are primitive [65, Appendix A].

The analysis of the intuitive notion of proof using normalization provides a mathematical foundation to the idea that the meaning of a logical constant is given by its inference rules. In order to specify the meaning of an arbitrary logical constant it is enough, so the argument goes, to give it a set of introduction and elimination rules. The introduction rules explain under what circumstances it is legitimate to assert a sentence formed using the constant. The elimination rules explain what may legitimately be inferred from the assertion of such a sentence. However, the introduction and elimination rules cannot be arbitrary, as arbitrary rules could lead to a meaningless formalism. In Dummett’s terminology, they must be in harmony with one another. In order to read off an intelligible meaning from the inference rules, we must know that the elimination rules do not allow us to infer more than permitted according to the meaning already invested in the logical constant through its introduction rules. In short, the inversion principle must apply. Indeed, Dummett argues that proof normalization in natural deduction both justifies the philosophy that the meaning of a logical constant is given by its inference rules and is a prerequisite for the philosophy to apply [17]. See Sundholm’s survey article, [76], for a general discussion of this argument and for further references.

When we come to modal logic, we shall be interested in propositional modal logic. Accordingly, we briefly review intuitionistic propositional logic (which we call IPL). Let Props be a countably infinite set of propositional constants. We use α, β, … to range over Props; and A, B, … to range over propositional formulae, which are given by the grammar:

A ::= α | ⊥ | A ∧ B | A ∨ B | A ⊃ B.

A natural deduction system for IPL is obtained by taking the evident subsystem of N_{IL}. Normalization results for the system for IPL follow from the analogous results for IL. A further consequence of normalization for IPL is the decidability of theoremhood (cf. Dummett [16, p. 146]).

2.2 The semantics of intuitionistic logic

The semantics we shall use for intuitionistic first-order logic was introduced by Kripke in [51], and was inspired by his earlier semantics for modal logic (which we shall discuss in Section 3.1). Kripke motivated the semantics as giving an intuitive account of the intuitionistic connectives. However, the completeness theorem for the semantics requires classical reasoning, so the resulting account of intuitionistic logic makes sense only from a classical viewpoint.

For simplicity, we assume a first-order language with no constants or function symbols. We use P, Q, R, … to range over the predicate symbols. An IL-model is a structure of the form (W, ≤, {D_{w}}_{w∈W} , {P_{w}}_{w∈W}) where:

1. W is a nonempty set (of ‘worlds’) partially ordered by ≤.

2. {D_{w}}_{w∈W} is a W -indexed family of nonempty sets such that w ≤ w′ implies D_{w} ⊆ D_{w′}.

3. For each n-ary predicate symbol P, the W -indexed family, {P_{w}}_{w∈W}, consists of n-ary relations P_{w} ⊆ D_{w}^{n} such that w ≤ w′ implies P_{w} ⊆ P_{w′}.

IL-models are usually called ‘Kripke models’. However, we shall be using also ‘Kripke models’ of modal logic, as well as various hybrid models of intuitionistic modal logics in which aspects of the Kripke models of modal and intuitionistic logics are combined. So, to avoid confusion, each kind of model will be named, in some appropriate way, according either to the logic it is intended to model or according to some distinguishing feature of its structure.

Let K be an arbitrary IL-model, (W, ≤, {D_{w}}_{w∈W} , {P_{w}}_{w∈W}). For any w ∈ W, a w-environment in K is a function, ρ, from variables to D_{w}. Clearly any such ρ is also a w′-environment for any w′ ≥ w. If d ∈ D_{w} then we write ρ[x := d] for the w-environment mapping the variable x to d and agreeing with ρ on all other variables. A satisfaction relation, w ⊩_{K}^{ρ} ϕ, between elements w ∈ W, formulae, ϕ, and w-environments, ρ, is defined inductively on the structure of ϕ by (we omit the subscript, K):

w ⊩^{ρ} P (x_{1}, …, x_{n}) iff P_{w}(ρ(x_{1}), …, ρ(x_{n}))
w ⊮^{ρ} ⊥
w ⊩^{ρ} ϕ ∧ ψ  iff w ⊩^{ρ} ϕ and w ⊩^{ρ} ψ
w ⊩^{ρ} ϕ ∨ ψ  iff w ⊩^{ρ} ϕ or w ⊩^{ρ} ψ
w ⊩^{ρ} ϕ ⊃ ψ  iff for all w′ ≥ w, w′ ⊩^{ρ} ϕ implies w′ ⊩^{ρ} ψ
w ⊩^{ρ} ∀x. ϕ  iff for all w′ ≥ w, for all d ∈ D_{w′}, w′ ⊩^{ρ[x:=d]} ϕ
w ⊩^{ρ} ∃x. ϕ  iff there exists d ∈ D_{w} such that w ⊩^{ρ[x:=d]} ϕ

For any set of formulae, S, we write w ⊩^{ρ} S to mean that, for all ϕ ∈ S, w ⊩^{ρ} ϕ. If S consists only of sentences then the relation w ⊩^{ρ} S is independent of ρ so we omit the environment superscript. For such an S we write K ⊧_{IL} S to mean, for all w ∈ W, w ⊩_{K} S. When K ⊧_{IL} S we say that K is an IL-model of S.

Intuitively, one thinks of the worlds as states of knowledge ordered by their information content. This is justified by the following important lemma, proved by a straightforward induction on the structure of ϕ.

Lemma 2.2.1 (Monotonicity) If w ≤ w′ and w ⊩^{ρ} ϕ then w′ ⊩^{ρ} ϕ.

So, as one ascends the order, new facts may accumulate but no previously accepted fact may ever be refuted. Thinking of the partial order as an information ordering also gives an intuitive reading to the logical constants. For example, we accept ϕ ⊃ ψ at our current state of knowledge if ψ holds at any possible enlarged state of knowledge at which ϕ holds. Similar interpretations of the other logical constants can be read off from their satisfaction clauses too.

The soundness and completeness of intuitionistic first-order logic is given by:

Theorem 2.2.2 (Kripke, [51]) Let T be a set of sentences and S a set of formulae. The following are equivalent.

1. T , S ⊢_{IL} ϕ.

2. For all models K such that K ⊧_{IL} T , for all worlds w in K, for all wenvironments ρ, if w ⊩_{K}^{ρ} S then w ⊩_{K}^{ρ} ϕ.

Soundness (1 ⟹ 2) is proved by the usual induction on derivations. The proof is perfectly intuitionistically acceptable. Completeness (2 ⟹ 1) is proved by showing the contrapositive via a standard Henkin-style construction of a model refuting underivable consequences. The completeness theorem is not intuitionistically valid as it both requires and implies Markov’s Principle (cf. Dummett [16, Theorem 5, p. 245]).

We shall also be interested in models of intuitionistic propositional logic. An IPL-model is a structure of the form K = (W, ≤, V) where W is a non-empty set partially ordered by ≤ and V is a monotone function from (W, ≤) to (℘(Props), ⊆). We say that K is a finite model if W is finite. The satisfaction relation w ⊩_{K} A is defined by:

w ⊩_{K} α iff α ∈ V (w),

for atomic formulae; and, for compound propositional formulae, by the evident inductive clauses taken from the definition of satisfaction in IL-models. As well as being sound and complete, IPL has the following important property: if A is not a theorem of IPL then there is a finite model K such that K |̸= A (see van Dalen [14, Theorem 4.2, p. 268]). We say that IPL has the finite model property. The finite model property implies decidability as it gives a way of enumerating the non-theorems of IPL [14, Theorem 4.3, p. 268].

We should say that there are many other forms of semantics for intuitionistic logic, e.g., topological semantics, algebraic semantics, Beth semantics and realizability semantics. For a good survey of these, as well as a thorough discussion of Kripke semantics, see van Dalen [14].

2.3 Geometric theories in intuitionistic logic

In this section we consider some properties of so-called geometric theories in intuitionistic logic. Geometric theories have played an important part in topos theory (see Vickers [80] for an introduction and references). However, we shall be interested in them for proof-theoretical reasons. It turns out that geometric theories are exactly the theories expressible by natural deduction rules in a certain simple form in which only atomic formulae play a critical part. We shall use such rules later in our natural deduction systems for intuitionistic modal logics.

A first-order formula is said to be geometric if it is built out of atomic formulae using only ⊥, ∧, ∨ and ∃. A geometric sequent is a first-order sentence of the form ∀\overline{x}. ϕ ⊃ ψ where \overline{x} is a (possibly empty) vector of variables and ϕ and ψ are geometric formulae. A theory is a set of sentences (thus we do not assume theories to be closed under logical consequence). A geometric theory is a set of geometric sequents.

The natural deduction rules will be given for certain geometric sequents built out of atomic formulae in a particularly simple way. A basic geometric sequent is one in the form (recall that a, b, … range over atomic formulae):

∀\overline{x}. ((a_{1} ∧ … ∧ a_{n}) ⊃ ∃\overline{y}. ⋁_{i=1}^{m}(b_{i1} ∧ … ∧ b_{in_{i}}))

where m, n ≥ 0 and n_{1}, …, n_{m} ≥ 1. (An empty conjunction is taken to be ⊤, an empty disjunction to be ⊥.) A basic geometric theory is a set of basic geometric sequents. By exploiting some elementary intuitionistic equivalences, it is easy to see that any geometric theory is equivalent to a basic geometric theory (in the sense that, for every geometric theory, there exists a basic geometric theory with the same consequences in IL). Therefore, it is no loss to restrict attention to basic geometric theories. We shall also be interested in restricted classes of basic geometric sequents. A Horn clause is a basic geometric sequent in which \overline{y} is empty, m = 1 and n_{1} = 1. A Horn clause theory is a set of Horn clauses.

With each basic geometric sequent, χ, in the format above, we associate the natural deduction rule:

\begin{aligned}a_{1}[\overline{t}/\overline{x}] & … & a_{n}[\overline{t}/\overline{x}] & [b_{11}[\overline{t}/\overline{x}]] … [b_{1n_{1}}[\overline{t}/\overline{x}]] ; ⋮ . ; ϕ & … & [b_{m1}[\overline{t}/\overline{x}]] … [b_{mn_{m}}[\overline{t}/\overline{x}]] ; ⋮ . ; ϕ \\ & & & ϕ \end{aligned} ; (R_{χ})

where: \overline{t} is any vector of terms of the same length as \overline{x}; none of the variables in \overline{y} appear in any of the terms in \overline{t}; and the variables in \overline{y} neither appear free in ϕ nor in any open assumptions upon which any subsidiary derivation of ϕ depends other than in the distinguished occurrences of b_{ij}[\overline{t}/\overline{x}]. (Again, these side-conditions would be catered for naturally if (R_{χ}) were represented in the Edinburgh Logical Framework [41], cf. the discussion on page 13.) Although it is not an elimination rule, we refer to a_{1}[\overline{t}/\overline{x}], …, a_{n}[\overline{t}/\overline{x}] as the major premises of (R_{χ}) and the others as the minor premises.

Let T be any basic geometric theory. The natural deduction system N_{IL}(T ) is obtained by extending N_{IL} with the set of rules {(R_{χ}) | χ ∈ T }. We write S ⊢_{IL}^{T} ϕ to mean that there is a derivation of ϕ from open assumptions in S in the system N_{IL}(T ).

Proposition 2.3.1 The following are equivalent:

1. S ⊢_{IL}^{T} ϕ.

2. T , S ⊢_{IL} ϕ.

Proof. Let χ be any basic geometric sequent, ∀\overline{x}. (ψ ⊃ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i}), where ψ is a_{1} ∧ … ∧ a_{n} and ψ_{i} is b_{i1} ∧ … ∧ b_{in_{i}}. In Figure 2–4 we show how to derive χ using the rule (R_{χ}) (for convenience, we bunch multiple applications of the same rule into one). Conversely, in Figure 2–5 we show how to derive (R_{χ}) using χ. Note how the side-conditions we gave on (R_{χ}) are exactly those required by the existential elimination in Figure 2–5. It is now a straightforward matter to give rigorous proofs of both implications by induction on the structure of derivations. ⊠

\begin{aligned}{[ψ]^{2} \atop a_{1}} & … & {[ψ]^{2} \atop a_{n}} & \begin{aligned}[b_{11}]^{1} & … & [b_{1n_{1}}]^{1} \\ & ψ_{1} \end{aligned} ; ⋁_{i=1}^{m} ψ_{i} ; ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i} & … & \begin{aligned}[b_{m1}]^{1} & … & [b_{mn_{m}}]^{1} \\ & ψ_{m} \end{aligned} ; ⋁_{i=1}^{m} ψ_{i} ; ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i} \\ & & & ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i} \end{aligned}_{1} ; ψ ⊃ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i}_{2} ; ∀\overline{x}. (ψ ⊃ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i})

Figure 2–4: Derivation of χ from (R_{χ}).

\begin{matrix}\begin{matrix}∀\overline{x}. (ψ ⊃ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i}) ; ψ[\overline{t}/\overline{x}] ⊃ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i}[\overline{t}/\overline{x}] & \begin{aligned}a_{1}[\overline{t}/\overline{x}] & … & a_{n}[\overline{t}/\overline{x}] \\ & ψ[\overline{t}/\overline{x}] \end{aligned} \\ ∃\overline{y}. ⋁_{i=1}^{m} ψ_{i}[\overline{t}/\overline{x}] \end{matrix} & \begin{aligned}[⋁_{i=1}^{m} ψ_{i}[\overline{t}/\overline{x}]]^{2} & {[ψ_{1}[\overline{t}/\overline{x}]]^{1} \atop b_{11}[\overline{t}/\overline{x}]} … {[ψ_{1}[\overline{t}/\overline{x}]]^{1} \atop b_{1n_{1}}[\overline{t}/\overline{x}]} ; ⋮ . ; ϕ & … & {[ψ_{m}[\overline{t}/\overline{x}]]^{1} \atop b_{m1}[\overline{t}/\overline{x}]} … {[ψ_{m}[\overline{t}/\overline{x}]]^{1} \atop b_{mn_{m}}[\overline{t}/\overline{x}]} ; ⋮ . ; ϕ \\ & ϕ \end{aligned}_{1} \\ ϕ \end{matrix}_{2}

Figure 2–5: Derivation of (R_{χ}) from χ.

\begin{matrix}\begin{aligned}{Σ_{1} \atop a_{1}[\overline{t}/\overline{x}]} & … & {Σ_{n} \atop a_{n}[\overline{t}/\overline{x}]} & \begin{aligned}[b_{11}[\overline{t}/\overline{x}]] & … & [b_{1n_{1}}[\overline{t}/\overline{x}]] \\ & Σ′_{1} \end{aligned} ; ϕ & … & \begin{aligned}[b_{m1}[\overline{t}/\overline{x}]] & … & [b_{mn_{m}}[\overline{t}/\overline{x}]] \\ & Σ′_{m} \end{aligned} ; ϕ \\ & & & ϕ \end{aligned} & Ξ \\ ψ \end{matrix} (r)

⟹

{Σ_{1} \atop a_{1}[\overline{t}/\overline{x}]} … {Σ_{n} \atop a_{n}[\overline{t}/\overline{x}]} \begin{matrix}\begin{aligned}[b_{11}[\overline{t}/\overline{x}]] & … & [b_{1n_{1}}[\overline{t}/\overline{x}]] \\ & Σ′_{1} \end{aligned} ; ϕ & Ξ \\ ψ \end{matrix} (r) … \begin{matrix}\begin{aligned}[b_{m1}[\overline{t}/\overline{x}]] & … & [b_{mn_{m}}[\overline{t}/\overline{x}]] \\ & Σ′_{m} \end{aligned} ; ϕ & Ξ \\ ψ \end{matrix} (r)

Figure 2–6: Permutative reduction for (R_{χ}).

ψ

The interest in representing geometric theories by a set of rules of the form (R_{χ}) is that, in such rules, only atomic formulae play an interesting rôle. Prawitz considered extensions of N_{IL} with rules whose premises and conclusion are atomic formulae [66, §1.5, p. 242], which he called atomic systems. Although not atomic systems in his sense (the conclusion of (R_{χ}) need not be an atomic formula), due to their manipulation of atomic formulae, our rules are in much the same spirit. Prawitz does not precisely delineate the scope of atomic systems, but they certainly include the evident rules for representing Horn clauses. Prawitz [66, Corollary 3.5.4, p. 256] shows that atomic systems satisfy the disjunction and existence properties (recall Proposition 2.1.3), neither of which are satisfied by arbitrary geometric theories (see below). So our rules can certainly express theories inexpressible by atomic systems. However, the theories expressible by atomic systems in their full generality are incomparable with geometric theories. Consider the atomic rule:

{a(x) \atop b}

with the restriction that x does not occur free in b or in any open assumption. This is equivalent to

(∀x. a(x)) ⊃ b,

which is not equivalent to any geometric theory (as can be shown using Theorem 2.3.4 below). Although one could imagine a still more general class of rules subsuming the two, the format of (R_{χ}) does seem rather natural. Indeed, we believe it to be an original observation that geometric theories can be characterized by a class of natural deduction rules manipulating only atomic formulae. We do not know how much light this sheds on geometric logic. Nevertheless, just as Prawitz was able to extend his normalization results for N_{IL} to atomic systems [66], we shall show that analogous normalization results obtain also for our systems.

First, we extend the treatment of eigenvariables to cover the new rules. The eigenvariables of (R_{χ}) are the variables occurring in \overline{y}. We say that the eigenvariables in an application of (R_{χ}) are closed by the minor premises of the rule. The notions of closed and open variable occurrences in a derivation are defined exactly as for N_{IL} (page 13). Similarly, the definitions of substitution in derivations (page 13) apply to N_{IL}(T ) without change. Again we do not distinguish between derivations differing only in the names of their closed variables.

We now extend normalization to the systems N_{IL}(T ). The new rules, (R_{χ}), are neither introductions nor eliminations, so no new maximum formulae are created. It is therefore unnecessary to add any new proper reductions to N_{IL}(T ). However, (R_{χ}) has the same capacity as (∨E) and (∃E) to interrupt a proof detour (recall the discussion on page 16). Therefore, in order to remove such interruptions, it is necessary to add new permutative reductions to N_{IL}(T ).

The various concepts associated with normalization for N_{IL}(T ) are related to those for N_{IL} as follows. The definition of maximum formula (page 15) remains the same. Maximum formulae are again removed by the proper reductions of Figure 2–2. We extend the notion of indirect rule (page 16) to include also the rules (R_{χ}) (as well as (⊥E), (∨E) and (∃E) as before). With this change, the definition of permutable formula (page 16) remains the same. Permutable formulae are removed by the permutative reductions of Figure 2–2 together with the new conversions of Figure 2–6. We again write ⟹ for the rewrite relation on derivations given by a single application of either a proper or permutative reduction. The definition of normal form (page 17) remains the same. Again, a derivation in N_{IL}(T ) is in normal form if and only if ⟹ is not applicable.

Theorem 2.3.2 The relation ⟹ on derivations in N_{IL}(T ) is strongly normalizing and confluent.

A proof of the theorem is given in Appendix A. We remark that a proof of weak normalization can be obtained more easily by following the standard inductive proof of Theorem 2.1.1

Normalization for N_{IL}(T ) has similar applications to those cited for N_{IL}. As an example, we prove the subformula property in so far as it holds for N_{IL}(T ). The subformula property only holds if suitable allowances are made for atomic formulae (cf. Prawitz [66, §3.2.4.5, p. 251]). We call an atomic formula T -atomic if it has the form a_{i}[\overline{t}/\overline{x}] or b_{ij}[\overline{t}/\overline{x}], where a_{i} and b_{ij} are the atomic formulae appearing in some basic geometric sequent χ ∈ T (as on page 24).

Proposition 2.3.3 Let Σ be a normal derivation of S ⊢_{IL}^{T} ϕ. Then every formula occurrence in Σ is either T -atomic or a subformula of some formula in S ∪ {ϕ}.

Proof. We show, by induction on the structure of Σ, that: if the last rule in Σ is either an introduction or an indirect rule then every formula occurring in Σ satisfies the property stated in the proposition; otherwise, every formula occurring in Σ is either T -atomic or a subformula of some formula in S. The proposition follows.

The proof is straightforward. We consider, as examples, the cases when the last rule in Σ is either (∃E) or (R_{χ}). If it is (∃E) then the Σ has the form:

\begin{matrix}{Σ_{1} \atop ∃x. ψ} & {[ψ] \atop Σ_{2}} ; ϕ \\ ϕ \end{matrix}

But, as Σ is normal, Σ_{1} cannot end in either an introduction or an indirect rule (otherwise ∃x. ψ would be either a maximum or a permutable formula respectively). Thus, as Σ_{1} is clearly normal, we have, by the induction hypothesis, that every formula in Σ_{1}, including ∃x. ψ, is either T -atomic or a subformula of some formula in S. But, also by the induction hypothesis, every formula in Σ_{2} is either T -atomic or a subformula of one in S, ϕ, ψ. However, ψ is a subformula of ∃x. ψ and therefore of some formula in S. So indeed every formula in Σ is either T - atomic or a subformula of one in S, ϕ.

If the last rule is (R_{χ}) then Σ has the form:

\begin{aligned}{Σ_{1} \atop a_{1}[\overline{t}/\overline{x}]} & … & {Σ_{n} \atop a_{n}[\overline{t}/\overline{x}]} & \begin{aligned}[b_{11}[\overline{t}/\overline{x}]] & … & [b_{1n_{1}}[\overline{t}/\overline{x}]] \\ & Σ′_{1} \end{aligned} ; ϕ & … & \begin{aligned}[b_{m1}[\overline{t}/\overline{x}]] & … & [b_{mn_{m}}[\overline{t}/\overline{x}]] \\ & Σ′_{m} \end{aligned} ; ϕ \\ & & & ϕ \end{aligned}

By the induction hypothesis every formula in each Σ_{i} is either T -atomic or a subformula of one in S, a_{i}[\overline{t}/\overline{x}]. Similarly, every formula in each Σ′_{i} is either T - atomic or a subformula of one in S, ϕ, b_{i1}[\overline{t}/\overline{x}], …, b_{in_{i}}[\overline{t}/\overline{x}]. But each a_{i}[\overline{t}/\overline{x}] is T -atomic as is each b_{ij}[\overline{t}/\overline{x}]. Also, the only subformula of any atomic formula is itself. Therefore it is indeed the case that every formula in Σ is either T -atomic or a subformula of one in S, ϕ. ⊠ Thus, by normalization, if S ⊢_{IL}^{T} ϕ then there exists a derivation of this consequence containing only formulae of the form specified in the proposition. An interesting corollary is that the rules of N_{IL} are redundant for consequences between atomic formulae. Any such consequence can be proved using just the (R_{χ}) rules of N_{IL}(T ).

Another application of normalization is to obtain sufficient conditions on T for the disjunction property to hold (i.e. conditions such that ⊢^{T} ϕ ∨ ψ implies ⊢^{T} ϕ or ⊢^{T} ψ). This does not hold for an arbitrary (basic) geometric T ; for example, it fails for T = {a ∨ b}. The normalization of N_{IL}(T ) can be used to show that the disjunction property does hold for any basic geometric theory containing only basic geometric sequents (in the form on page 24) satisfying m ≤ 1. However, with this restriction, the disjunction property follows also from Prawitz [65, Corollary 6, p. 55]. The existence property also fails in general. Sufficient conditions for it to hold are given by Prawitz [65, Corollary 7, p. 56].

We end this chapter with a rather different aspect of geometric theories concerning their IL-models. Let T be any geometric theory. Let K be any IL-model, (W, ≤, {D_{w}}_{w∈W} , {P_{w}}_{w∈W}). Now, each (D_{w}, {P_{w}}) is a classical structure of the first-order language. We write (D_{w}, {P_{w}}) ⊧_{CL} T to mean that (D_{w}, {P_{w}}) is a classical model of T . (Similarly, we write (D_{w}, {P_{w}}) ⊧_{CL}^{ρ} ϕ to mean that, the ϕ is classically true in (D_{w}, {P_{w}}) under the interpretation of variables in D_{w} induced by ρ.) We show that K is an IL-model of T if and only if it is built out of classical models of T .

Theorem 2.3.4 For any IL-model K = (W, ≤, {D_{w}}_{w∈W} , {P_{w}}_{w∈W}) and any geometric theory T , the following are equivalent:

1. K ⊧_{IL} T .

2. For all w ∈ W, (D_{w}, {P_{w}}) ⊧_{CL} T .

Proof. First note that, for any geometric formula ϕ, for any w ∈ W and for any w-environment ρ, we have that w ⊩_{K}^{ρ} ϕ if and only if (D_{w}, {P_{w}}) ⊧_{CL}^{ρ} ϕ (as ⊩_{K}^{ρ} is determined locally for the logical constants in ϕ). Now consider any geometric sequent ∀\overline{x}. (ϕ ⊃ ψ) in T . Then:

w ⊩_{K} ∀\overline{x}. (ϕ ⊃ ψ) iff for all w′ ≥ w, for all w′-environments ρ,
w′ ⊩_{K}^{ρ} ϕ implies w′ ⊩_{K}^{ρ} ψ,
iff for all w′ ≥ w, for all w′-environments ρ,
(D_{w}, {P_{w}}) ⊧_{CL}^{ρ} ϕ implies (D_{w}, {P_{w}}) ⊧_{CL}^{ρ} ψ,
iff for all w′ ≥ w, (D_{w}, {P_{w}}) ⊧_{CL} T ,

The theorem follows. ⊠ Surprisingly, I could not find a reference for this simple theorem, although essentially the same property is required to solve exercise 2.6.14 in Troelstra and van Dalen [79, p.110] (but beware that their terminology is different from ours).

Intuitionistic modal logic

The goal of this chapter is to introduce intuitionistic modal logic and, in particular, our approach to it. In Section 3.1 we review classical propositional modal logic and its possible world semantics. In Section 3.2 we discuss what it means to combine intuitionistic logic and modal logic into intuitionistic modal logic. Then in Section 3.3 we survey previous approaches to intuitionistic modal logic. Lastly, in Section 3.4 we present our approach.

3.1 Modal logic

The language of propositional modal logic extends that of propositional logic (see page 20). Again we use A, B, C, … to range over formulae, which are given by the grammar:

A ::= α | ⊥ | A ∧ B | A ∨ B | A ⊃ B | □A | ♢A.

Thus we have two new primitives, the modalities: necessity, □; and possibility, ♢. (The choice of primitive propositional connectives is, of course, motivated by our later application to intuitionistic modal logic.)

The possible world semantics of modal logic will be the foundation for all the work in this thesis. The idea behind it is that there are a number of different worlds at which the same formula may express different propositions (i.e., classically, it may have different truth values). The proposition expressed by a formula involving the usual logical connectives is determined locally in the usual fashion and is independent of the status of other worlds. However, the proposition expressed by a formula involving the modalities depends crucially on the status of other worlds. At a world w, the formula ♢A expresses the proposition that A is true in some world v deemed possible from the viewpoint of w. (Technically, the qualification that v is possible according to w will be modelled by a binary relation, see below.) Dually, the formula □A expresses the proposition (at w) that A is true in all worlds v deemed possible by w. Thus the meaning of the modalities □ and ♢ is given a clear reading based on the primitive notion of relative truth, i.e. truth at a world.

We now give a technical account of the interpretation sketched above. A modal model is a triple M = (W, R, V) where W is a non-empty set (of ‘worlds’), R is a binary relation on W (the ‘visibility’ relation) and V is a function from W to ℘(Props) (mapping each world to the set of propositional constants held to be true at the world). We say that M is a finite model if W is finite. The satisfaction relation, ⊩_{M}, between W and the set of formulae is defined inductively on formulae by (we use w, v, … to range over W):

w ⊩ α  iff α ∈ V (w)
w ⊮ ⊥
w ⊩ A ∧ B iff w ⊩ A and w ⊩ B
w ⊩ A ∨ B iff w ⊩ A or w ⊩ B
w ⊩ A ⊃ B iff w ⊩ A implies w ⊩ B
w ⊩ □A  iff for all v, wRv implies v ⊩ A
w ⊩ ♢A  iff there exists v such that wRv and v ⊩ A

We say that A is valid in M (notation M ⊧ A) if, for all w ∈ W, w ⊩_{M} A. Similarly, for a set of modal formulae, L, we write M ⊧ L to mean that, for every A ∈ L, M ⊧ A.

Classical modal logic arises from interpreting the above definitions of modal model, satisfaction and validity in the standard informal meta-theory of ordinary classical mathematics. (Actually, only the so-called normal modal logics arise in this way, see Chellas [13]. However, we take possible world semantics as fundamental. Therefore we shall only be interested in normal modal logics.) Modal models determine a natural ‘basic’ classical (normal) modal logic, whose theorems are the formulae valid in every model. An axiomatization of this logic, known as K, is given in Figure 3–1. The reason that axiom 0 is stated with respect to substitution instances is just to emphasize that certain modal formulae (such as □A ⊃ □A), although not in the strictly propositional fragment, should nevertheless still be counted as tautologies. As modus ponens is one of the inference rules, it is sufficient to restrict axiom 0 to substitution instances of axioms in some standard axiomatization of classical propositional logic. Equivalently, axiom 0 can be replaced with any of the usual sets of axiom schemas for classical propositional logic. Axiom 2 is just a definition of ♢ in terms of □. The other rule of inference, (Nec), is known as necessitation. Formally, the soundness and completeness of K is given by:

Theorem 3.1.1 The following are equivalent:

1. A is a theorem of K.

2. For all modal models M, M ⊧ A.

For a proof see Chellas [13].

Often, however, one is interested in a restricted class of modal models, and, correspondingly, in an enlarged class of modal theorems. The completeness theorem for K extends easily to a general completeness theorem. A normal modal logic is any set of modal formulae that: contains the theorems of K, is closed under (MP) and (Nec), and is closed under the substitution of formulae for propositional constants. For any normal modal logic, L, we have that A is a theorem of L if and only if, for all modal models M, M ⊧ L implies M ⊧ A. But this theorem is of little interest as it does not identify any structure in the class of models considered.

More interesting forms of completeness are obtained by considering completeness relative to classes of models determined according to properties of their visibility relations. A (modal) frame is a structure of the form (W, R) where W is a nonempty set and R is a binary relation on W. Thus a frame is a modal model Axioms

0. Any substitution instance of a propositional tautology.

1. □(A ⊃ B) ⊃ (□A ⊃ □B).

2. ♢A ↔ ¬ □ ¬A.

Rules

(MP) From A ⊃ B and A deduce B.

(Nec) From A deduce □A.

Figure 3–1: The modal logic K.

Axiom schema  Property
D ♢⊤  seriality  ∀x. ∃y. xRy
T □A ⊃ A  reflexivity  ∀x. xRx
B A ⊃ □ ♢ A  symmetry  ∀xy. xRy ⊃ yRx
4 □A ⊃ □ □ A transitivity  ∀xyz. xRy ∧ yRz ⊃ xRz
5 ♢A ⊃ □ ♢ A  Euclideanness ∀xyz. xRy ∧ xRz ⊃ yRz
2 ♢ □ A ⊃ □ ♢ A directedness ∀xyz. xRy ∧ xRz ⊃ ∃w. yRw ∧ zRw

Figure 3–2: Modal axioms and corresponding frame properties. less the valuation function V. For a frame, F, we say that A is valid in F if, for all functions, V, from W to ℘(Props), we have that A is valid in the evident modal model (F, V). Then various natural questions arise concerning the relationships between modal logics and classes of frames.

First, there are completeness questions. We say that a modal logic L is complete relative to a class of frames if the theorems of L are exactly the formulae valid in every frame in the class. The most basic completeness question asks of a normal modal logic L whether there exists a class of frames relative to which L is complete. As it turns out, not every normal modal logic is complete in this sense. However, the counterexamples are rather contrived. Many interesting variants of the completeness question are obtained by restricting the classes of frames considered. For example, one might ask whether L is complete relative to some first-order definable class of frames. For a survey of results in this area see van Bentham [5].

Second, there are the problems of correspondence theory. This concerns the relationship between properties of frames and modal formulae. One question in this area is the modal characterizability of a class of frames. A modal formula is said to characterize the class of frames in which it is valid. The characterizability question asks of a class of frames whether it is characterized by any modal formula (or set of modal formulae). The converse direction is also of interest. Given a modal formula, what can we determine about the class of frames it characterizes? For example, under what conditions is it first-order definable? See van Bentham [6] for discussion of these and related questions.

The above questions are natural if one considers the modal logics to be of principal interest, and their semantics to be of interest mainly in virtue of their ability to model the logics. This is a standard perspective on modal logic. There is, however, an alternative viewpoint, according to which one’s primary interest is in a particular class of frames. Such a class of frames induces a unique normal modal logic, namely the set of formulae validated by every frame in the class. But one is interested in this logic only in virtue of its connection with the frames of interest. This viewpoint is the natural one for applications of modal logic in which the class of frames is given by the application and one then seeks the matching modal logic. In this thesis we shall mainly approach intuitionistic modal logic from this viewpoint.

The kinds of question that arise from this viewpoint concern what can be determined about the induced modal logic. Basic questions are: Can we axiomatize it? Is it decidable? A more general programme is to attempt to give systematic answers to such questions. For example, is it possible to give uniform answers for all classes of frames specified in a certain way (e.g. by first-order formulae in particular form)?

Throughout this thesis, we shall use, as examples, intuitionistic analogues of classical modal logics which are particularly well-behaved. In Figure 3–2 we list six modal axiom schemas together with (first-order) properties defining classes of frames. We shall refer to the classical modal logic obtained by adding a subset of the listed axiom schemas to K by KS_{1}… S_{n}, where S_{1}… S_{n} are the names of the schemas added. The only exceptions are KT, KT4 and KT5 which are called by their standard names, T, S4 and S5 respectively. (S5 is also axiomatized by KTB4.) Any modal logic, KS_{1}… S_{n}, is complete relative to the class of frames satisfying the conjunction of the properties associated with S_{1}… S_{n} in Figure 3–2. (Further, the modal logic characterizes that class of frames.) Thus T, S4 and S5 are complete relative to the classes of frames in which R is respectively: reflexive, a preorder and an equivalence relation. Again see Chellas [13] for proofs.

Each of the modal logics listed above has the finite model property: if A is not a theorem then there exists a finite model (W, R, V) such that M |̸= A. As with IPL (recall the discussion on page 23), the finite model property enables the non-theorems of the logic to be recursively enumerated. Thus, if the theorems are also recursively enumerable (which, if we have an effective axiomatization, is always the case) then theoremhood is decidable. So all the modal logics obtained from Figure 3–2 are decidable. For proofs of the finite model property for these logics (using the powerful ‘filtration’ technique) see Chellas [13].

3.2 What is intuitionistic modal logic?

Classical modal logics (although often referred to as non classical logics) are classical in the sense that all are built on top of ordinary classical logic. Similarly, intuitionistic modal logics are modal logics whose underlying logic is intuitionistic. Although much work has been done in the field, there is as yet no consensus on the correct viewpoint for considering intuitionistic modal logic. In particular, there is no single semantic framework rivalling that of possible world semantics for classical modal logic. Indeed, there is not even any general agreement on what the intuitionistic analogue of the basic modal logic, K, is. As we shall see, several different candidates have been proposed.

In Section 3.3 we shall review the many conflicting approaches to intuitionistic modal logic that have appeared in the literature. First, in the present section, we discuss fairly informally some features that might be expected of an intuitionistic modal logic. The points raised in the discussion will serve as a basis for relating the different logics below.

Classical (propositional) modal logic is classical in that the propositional fragment is exactly classical propositional logic. In the same way, for an intuitionistic modal logic to deserve the title, a sine qua non is that its propositional fragment be just intuitionistic propositional logic. Thus we should expect of an intuitionistic modal logic, IML, that:

Requirement 1 IML is conservative over IPL.

Conservativity over IPL is a requirement only on the non modal fragment of IML. However, intuitionistic reasoning should be available for the whole language, e.g. one expects to be able to apply modus ponens even when the formulae involved contain embedded modal operators. Thus we should also expect:

Requirement 2 IML contains all substitution instances of theorems of IPL and is closed under modus ponens.

Of course the converse will not be expected to hold as A may well be a theorem of IML for some modal reasons invisible to IPL.

This much is uncontroversial, but so far we have hardly constrained IML at all. However, there are other important properties of intuitionistic logic that we might expect to transfer to IML. For example, it is a general feature of intuitionistic logics that the addition of the Law of the Excluded Middle gives rise to the corresponding classical logics. So we might expect:

Requirement 3 The addition of the schema A ∨ ¬A to IML yields a standard classical modal logic.

Another general feature of intuitionistic logics is the disjunction property:

Requirement 4 If A ∨ B is a theorem of IML then either A is a theorem of IML or B is.

This ought to be expected to hold, as it is important to the constructive reading of disjunction.

We have yet to consider any properties we should expect of the modalities. Here one might again proceed by analogy with intuitionistic logic. For example, just as ∧ and ∨ are independent connectives in intuitionistic propositional logic (in that neither is definable in terms of the other connectives) and ∀ and ∃ are independent quantifiers in intuitionistic first-order logic, one might expect the two modalities to be independent in intuitionistic modal logic. We list this as a requirement too.

Requirement 5 □ and ♢ are independent in IML.

A different way of proceeding by analogy is to observe properties common to classical modal logics for which there are no obvious reasons why they should fail intuitionistically. For example, it seems reasonable to assume that an intuitionistic modal logic ought to satisfy the necessitation rule. More generally, if A ⊃ B is a theorem then perhaps □A ⊃ □B and ♢A ⊃ ♢B should also be theorems. In a similar vein, classically □ distributes over finite conjunctions (i.e. □⊤ ↔ ⊤ and □(A ∧ B) ↔ (□A ∧ □B)), and ♢ distributes over finite disjunctions (i.e. ♢⊥ ↔ ⊥ and ♢(A ∨ B) ↔ (♢A ∨ ♢B)). Again, there is no obvious reason why such principles should fail intuitionistically. We do not, however, list any of these as formal requirements on IML. First, if we are to make a list of such requirements then why choose these particular ones? Although the above selection is quite natural, there could well be other equally natural requirements inadvertently left out. For example, it is not clear that the list above captures fully any desired relationship between □ and ♢. Second, the only reason we have given for accepting the principles is that there is no obvious reason for rejecting them. Perhaps, however, a closer analysis would reveal some subtle reason for doing so (although in fact it will not).

What is really lacking is any coherent framework within which the appropriateness of the various principles considered above can be evaluated. What we would like is an intended meaning for the modalities with respect to which the legitimacy of various candidate modal principles can be evaluated. Moreover, the meaning ascribed to the modalities should make sense intuitionistically. Further, IML, as well as being sound, should be complete in the sense that it should support any modal principle (intuitionistically) valid according to the meaning. We summarize these desires in:

Requirement 6 There is an intuitionistically comprehensible explanation of the meaning of the modalities, relative to which IML is sound and complete.

Note that this requirement is the first we have made which is not completely formal. However, it is the most fundamental of all, and the other requirements ought to be expected to follow from it.

Requirements 1–5 have all appeared before, either as formal requirements, or as meta-theorems about intuitionistic modal logics. (References to the many works in which some of the requirements are mentioned appear in the next section.) However, they have never previously been collected into one comprehensive list. We believe that Requirements 1–5 are natural, but we do not wish to place too much emphasis on their importance. Their use will be mainly to help compare the different intuitionistic modal logics considered in the next section. In contrast, we do wish to emphasize the importance of Requirement 6. This requirement has been almost entirely ignored in previous work, the most notable exception being Ewald [19], discussed in Section 3.4.

3.3 Previous approaches to intuitionistic modal

logic

In this section we review the large body of previous work on intuitionistic modal logic. We shall use the points raised in the previous section to compare the multitude of different approaches. We begin with a comprehensive but brief survey of the field. We then analyse some of the more semantic based work in greater detail, as the semantics will be of use to us later. Some of the other work will be considered in more detail at appropriate points later in the thesis.

The first paper on intuitionistic modal logic was published by Fitch in 1948 [25]. He defined a first-order intuitionistic version of the modal logic T with the Barcan formula. He gave the logic both a Hilbert-style axiomatization and a Gentzen-style sequent calculus formulation. Fitch provided no justification for his particular choice of axioms, his methodology being one of definition by analogy with classical modal logic. From a modern viewpoint, the choice of axioms seems rather arbitrary. Not only does ♢ not distribute over disjunction, but also Requirement 5 fails as the addition of the Law of the Excluded Middle does not enable either □A ↔ ¬ ♢ ¬A or ♢A ↔ ¬ □ ¬A to be derived (see the later discussion of Wijesekera’s system on page 48). Although pioneering, Fitch’s paper has not had much influence on subsequent work.

The second occurrence of an intuitionistic modal logic was in Prior’s 1957 book [67], where he defined an intuitionistic analogue of S5, which he called MIPQ. This logic does satisfy Requirements 1–5 of the previous section, and we shall see later that a good claim can be made that it also satisfies Requirement 6. MIPQ was the subject of two papers by Bull. In [9] (1965) he gave the logic an algebraic semantics in terms of Heyting algebras with additional structure and claimed a proof of the finite model property. A mistake in Bull’s proof was discovered and corrected both by Fischer Servi [22] (1978) and independently by Ono [61, Theorem 4.8] (1977). In his second paper [11] (1966), in which he calls the logic MIPC, Bull showed the faithfulness of a translation of MIPQ into intuitionistic first-order logic using Kripke’s semantics of the latter. This translation can be used to argue that MIPQ is the correct intuitionistic analogue of classical S5. We shall discuss this further in Section 3.4. The translation was also used in a 1988 paper of Ono and Suzuki, [62], to establish correspondences between extensions of MIPQ and intermediate predicate logics. A decision algorithm for MIPQ was given by Minc in a 1968 paper in Russian (for a reference see [73, ref. 21]).

A third paper of Bull [10] (1965), considered a different intuitionistic version of S5 which takes a classical view of the modalities (both □A ↔ ¬ ♢ ¬A and ♢A ↔ ¬ □ ¬A hold) but not of the other connectives. He also defined an intuitionistic analogue of S4 in which only □ is primitive. Algebraic semantics were given to both logics and the finite model property proved.

Intuitionistic analogues of S4 and S5 were also considered by Prawitz [65, Chapter VI] (1965). He gave natural deduction systems for the classical versions of the logics and obtained the corresponding intuitionistic logics by replacing the classical reductio ad absurdum rule with the standard intuitionistic false rule. (He also considered ‘minimal’ versions of the logics, obtained by omitting the false rule altogether.) Prawitz’ main result was a normalization theorem for the ♢- free fragment. He gave no further analysis of the induced intuitionistic modal logics. In a recent paper, [7] (1993), Bierman and de Paiva reformulated Prawitz’ system for S4 (without ♢) to give a simpler account of normalization. (They also gave a categorical semantics to the proof theory.) A different approach to natural deduction for intuitionistic modal logic (again with only the □ modality) is proposed by Benevides and Maibaum [4] (1992). A generalization of this approach to the ♢ operator is considered in the recent paper of Masini [55](1993). We shall discuss these approaches in more detail in Section 4.6.

Ono [61] (1977) continued the tradition of considering intuitionistic analogues of S4 and S5. He analysed several inequivalent variants of the two logics, especially the ♢-free fragments. He gave these both algebraic semantics and Kripke-style semantics, proving the finite model property in many cases. Some of these logics were later analysed in more detail by Font [30] (1986) who classified their different modalities, i.e. combinations of ¬ and □ (the intuitionistic analogue of S4 has 31 inequivalent such combinations, a fact that also appears in Došen [15] (1985) and Mihajlova [57] (1980)). In a later paper, Font and Verdú considered the abstract algebraic properties of (again ♢-free) intuitionistic analogues of S4 and S5 [31] (1989).

In the first of a series of papers, [21] (1977), Fischer Servi proposed a way of determining the correct intuitionistic analogue of a classical modal logic. Motivated by Gödel’s translation of intuitionistic propositional logic into classical S4 (see e.g. Fitting [29, p. 518]) she suggested that an intuitionistic modal logic should be determined by a similar translation into a classical ‘bimodal’ logic, a logic with two □ modalities: one inherited from the original modal logic, and the other an S4 modality to model the intuitionistic connectives. She showed that the intuitionistic analogue of S5 induced in this way is none other than Prior’s MIPQ. In her next paper, [23] (1981), Fischer Servi gave both algebraic and possible world semantics to the so-induced intuitionistic version of any classical modal logic with such a semantics. In the third paper, [24] (1984), she gave axiomatizations of some of the logics, using the possible world semantics to prove completeness. The same semantic framework and similar axiomatizations were discovered independently by Plotkin and Stirling [64] (1986) who also gave some results on the associated intuitionistic correspondence theory.

A more philosophical approach was taken by Ewald in his 1978 thesis on intuitionistic temporal logic [19]. He gave models for intuitionistic temporal logic based on Kripke’s models of intuitionistic first-order logic and motivated through an interpretation of Brouwer’s creative subject in which the epistemic ordering (the partial order of the models) is separated from the temporal ordering. He gave axiomatizations of the intuitionistic modal logics corresponding to various conditions on the temporal ordering and proved the appropriate completeness results (see his article [20] (1986)). He also introduced a different form of semantics in order to obtain the finite model property (and thereby prove decidability). However, Ewald’s proof of the finite model property is incorrect (we shall discuss this later in Chapter 8). Nevertheless, the ‘decidability’ models introduced by Ewald are the same as the possible world models of Fischer Servi [23] and Plotkin and Stirling [64]. Thus Ewald, Fischer Servi and Plotkin and Stirling all independently proposed the same semantics and gave complete axiomatizations of the corresponding modal logics (Ewald in their tense logic variants). Recently, Williamson [83] (1992) has used these intuitionistic modal logics as a basis for the development of anti-realist intuitionistic epistemic logics.

However, their semantic framework is not the only one that that has been considered. The notions of model proposed by Gabbay [33, §7] (1975), Ono [61] (1977), Sotirov [73] (1984), Božić and Došen [8,15] (1984–5), Yokota [84,85,86] (1985–6) and Wijesekera [82] (1990) all differ from each other as well as from those of Ewald et al, although there are also many similarities. We shall discuss some of the differences below. (Sotirov [73] also contains a useful survey of the Russian literature.) It is interesting to observe that the semantics discussed in Ono and Suzuki [62] (1988), although different in general, does, in the case of S5, coincide (under a suitable transformation) with Fischer Servi’s models of intuitionistic S5.

In computer science, various applications of intuitionistic modal logics have been described. In Stirling’s 1987 paper on modal logics for communicating systems [74], an intuitionistic modal logic was used to capture a bisimulation preorder on diverging processes (an idea attributed to Gordon Plotkin). A similar application appears also in Hennessy and Plotkin [43] (1987). A domain-theoretic application of intuitionistic modal logic is sketched by Plotkin and Stirling [64] (1986). More recently, Nerode and Wijesekera proposed an intuitionistic version of dynamic logic in order to build a logic on top of transition systems between partial states [60] (1990). Pitts has proposed using constructive logic with certain ‘evaluation’ modalities to reason about functional programs with side-effects [63] (1991). Lastly, in hardware design, an application of an intuitionistic ♢ modality to abstract from constraints has been suggested by Mendler [56] (1991).

In the remainder of this section we discuss some of the many possible world semantics of intuitionistic modal logic in more detail. The basic idea behind all of them is the same. Kripke’s possible worlds account of modal logic appeals to structures of the form (W, R, V) (our modal models of Section 3.1). Kripke’s account of intuitionistic propositional logic uses models of the form (W, ≤, V) (as in Section 2.2). It is (mathematically) natural to build a semantics of intuitionistic modal logic by combining the two Kripkean accounts. Thus one is led to consider structures of the form (W, ≤, R, V) in which W is partially ordered by ≤, R is a binary relation on W, and V is a monotonic function from the partial order (W, ≤) to (℘(Props), ⊆). Now a number of questions arise. How should one interpret the modalities? Should one consider arbitrary such structures, or should additional requirements be imposed (e.g. on the relationship between ≤ and R)? It is in their answers to these questions that the various semantic accounts differ.

At least the interpretation of the non modal connectives is uncontroversial. One expects the satisfaction clauses for these to be the usual ones (see page 22). The interpretation of the modalities is more interesting. One could take also the usual satisfaction clauses for the modalities in modal models (see page 33). However, an essential feature of intuitionistic models is the monotonicity lemma (Lemma 2.2.1). If the standard satisfaction clauses for the modalities are used then the monotonicity lemma does not hold. There are two possible remedies. One is to modify the satisfaction clauses. This might be a reasonable thing to do, for one might wish to use the partial order to give a more intuitionistic reading of the modalities. The other remedy is to impose conditions on models that ensure that the monotonicity lemma does hold. The eventual models we shall settle on will in fact adopt both these remedies.

We begin by considering the fragment with the single modality □. If the satisfaction of □A is defined by:

w ⊩ □A iff for all v, wRv implies v ⊩ A  (3.1)

Axioms

0. All substitution instances of theorems of IPL.

1. □(A ⊃ B) ⊃ (□A ⊃ □B).

Rules

(MP) From A ⊃ B and A deduce B.

(Nec) From A deduce □A.

Figure 3–3: Intuitionistic K without ♢.

then there is no reason that w ⊩ □A and w ≤ w′ should imply that w′ ⊩ □A. Božić and Došen [8,15] avoid the problem by requiring that models satisfy an extra condition: if w ≤ w′ and w′Rv′ then there exists v such that wRv and v ≤ v′. Diagrammatically, this condition is expressed by:

[figure: w′; R; v′; w; ≤; .; .; .; .; .; .; .; .; .; .; .; R; v; ^{. . . . . . . . . .≤}]

It is clear that in models satisfying the condition, the monotonicity property is satisfied by formulae in the (♢-free) fragment. Different conditions relating R and ≤, for avoiding the same problem, are considered by Ono [61] and Sotirov [73].

However, it would instead be possible to build the monotonicity property into the satisfaction clause for □A. If this clause were:

w ⊩ □A iff for all w′ ≥ w, for all v′, w′Rv′ implies v′ ⊩ A.  (3.2)

then the monotonicity lemma would hold for the fragment in arbitrary structures (with no conditions placed on R and ≤). Moreover, there is a clear analogy between the above interpretation of □ and the interpretation of universal quantification in intuitionistic predicate models (see page 22). Thus, intuitively, the above interpretation gives a plausible interpretation of an intuitionistic necessity modality.

Axioms

0. All substitution instances of theorems of IPL.

1. □(A ⊃ B) ⊃ (□A ⊃ □B).

2. □(A ⊃ B) ⊃ (♢A ⊃ ♢B).

3. ¬ ♢ ⊥.

Rules

(MP) From A ⊃ B and A deduce B.

(Nec) From A deduce □A.

Figure 3–4: Wijesekera’s system.

One possible way or sorting out the differences between the interpretations would be to consider the induced intuitionistic modal logics and argue between them on, e.g., the basis of intuitionistic plausibility. However, it turns out that both semantics induce the same intuitionistic modal logic. The logic axiomatized in Figure 3–3 is sound and complete with respect to both semantics. Only when the ♢ connective is added do the differences in the semantics become apparent. The logic of Figure 3–3 is uncontroversially the intuitionistic analogue of K in the ♢-free fragment.

Again with ♢ it is possible to build monotonicity into the definition of satisfaction by:

w ⊩ ♢A iff for all w′ ≥ v, there exists v′ such that w′Rv′ and v′ ⊩ A. (3.3)

This clause is adopted by Wijesekera [82] who considers it alongside (3.2) for □. However, with ♢ we can no longer justify the definition by appeal to Kripke’s interpretation of the existential quantifier, as the existential quantifier is interpreted locally (see page 22). In fact the intuitionistic modal logic induced by (3.2) and (3.3) in arbitrary models has some rather strange properties.

[figure: w_{3} . . . . . . . . . .  v_{3} {α} . . . . . . . . .; w_{2}; v_{2} {α}; w_{1}  v_{1} {α}; w_{0}; v_{0} {α}]

Figure 3–5: Countermodel to Requirement 3.

Wijesekera’s axiomatization of this logic [82, p. 281] is reproduced in Figure 3–4. (Actually, Wijesekera also included the axiom (□A ∧ ♢(A ⊃ B)) ⊃ ♢B, which is easily shown to be derivable from the others.) Wijesekera’s motivation for his definitions came from Constructive Concurrent Dynamic Logic in which the modalities are defined over a transition system of programs between partial states [60]. However, let us evaluate how the logic shapes up as an intuitionistic version of modal logic according to the points raised in section 3.2. Requirements 1 and 2 are obviously satisfied and it is a straightforward semantic exercise to show that Requirements 4 and 5 are too. However, □ and ♢ are not only non-interdefinable, they are hardly related at all. A good illustration of this is given by the following example showing also how Requirement 3 fails. We define a model (illustrated in Figure 3–5) by:

W = {w_{i} | i ∈ N} ∪ {v_{i} | i ∈ N}
≤ = {⟨u_{i}, u_{j}⟩ | u ∈ {v, w} and i ≤ j}
R = {⟨u_{2i}, u′_{2i}⟩ | u, u′ ∈ {v, w} and u ≠ u′} ∪ {⟨u_{2i+1}, u_{2i+1}⟩ | u ∈ {v, w}}
V (w_{i}) = ∅
V (v_{i}) = {α}

It is straightforward to show, by structural induction on A, that, for all i, j, we have both that w_{i} ⊩ A if and only if w_{j} ⊩ A and that v_{i} ⊩ A if and only if v_{j} ⊩ A. Therefore, w_{i} ⊩ A ∨ ¬A and v_{i} ⊩ A ∨ ¬A, for all i. However, it is easy to see that w_{i} ⊩ (¬ □ α) ∧ (¬ □ ¬α) ∧ (¬ ♢ α) ∧ (¬ ♢ ¬α). So this sentence is consistent, in Wijesekera’s logic, with the Law of the Excluded Middle. Hence, the Law of the Excluded Middle is not sufficient to derive the usual classical interrelationship between ♢ and □. (Wijesekera does not make this observation.) Another strange feature of Wijesekera’s logic is that ♢ distributes over 0-ary disjunctions (i.e. ⊥ ↔ ♢⊥ is a theorem) but not over binary ones (it is easy to find a countermodel to the ♢(A ∨ B) ⊃ (♢A ∨ ♢B) direction).

A different definition of satisfaction for ♢A, which again builds in monotonicity, is:

w ⊩ ♢A iff there exist w_{0}, v_{0} such that w ≥ w_{0}Rv_{0} and v_{0} ⊩ A. (3.4)

This definition is due to Plotkin and Stirling who, in unpublished work, have axiomatized the induced logic (again using (3.2) for □ and considering arbitrary models). The logic does satisfy Requirements 1–5 and ♢ distributes over disjunction. There is also a natural algebraic semantics using Kan corestrictions of monotone functions between complete Heyting algebras to interpret the modalities (see also Hennessy and Plotkin [43]). However, the axiomatization is rather complicated, and it is not clear that Requirement 6 is addressed.

As mentioned above, if one is guided by the Kripkean interpretation of existential quantification then the natural satisfaction clause for ♢ is the standard one:

w ⊩ ♢A iff there exists v such that wRv and v ⊩ A.  (3.5)

However, as with (3.1) for □, the monotonicity property does not hold in general with this definition. This time the condition we must place on models is: if w′ ≥ wRv then there exists v′ such that w′Rv′ ≥ v. Note that, in the presence of this condition, (3.5), (3.3) and (3.4) are all equivalent. However, it is (3.5) that leads one to the discovery of the condition.

Božić and Došen, [8, §7], axiomatize the □-free logic induced by the above interpretation of ♢ in models satisfying the property. Then in [8, §11] they combine their interpretations for □ and ♢. However, the resulting intuitionistic logic fails Requirements 4 and 5 as both ♢A ∨ □¬A and ♢A ↔ ¬ □ ¬A are theorems.

We now come to the models introduced independently by Ewald [20] (as ‘decidability models’), Fischer Servi [23] and Plotkin and Stirling [64]. Although these models are similar to those considered above, we introduce them in some detail as we shall make use of them in Chapters 6 and 8. We shall concentrate mainly on technical aspects. Although there is some intuitive motivation behind the definition of these models, which will be briefly discussed, we do not wish to emphasize it too strongly. The models will be of interest to us because they happen to model intuitionistic modal logics which we shall induce by way of other considerations.

A birelation model, B, is a 4-tuple, (W, ≤, R, V), where: W is a non-empty set (of ‘worlds’) partially ordered by ≤; R is a binary relation on W; V is a monotone function from (W, ≤) to (℘(P), ⊆); and the two ‘frame conditions’ below are satisfied:

(F1) If w′ ≥ wRv then there exists v′ such that w′Rv′ ≥ v.

(F2) If wRv ≤ v′ then there exists w′ such that w ≤ w′Rv′.

Diagrammatically these two conditions are:

[figure: w′; .; .; .; .; .; .; .; .; .; .; R; v′; w′; .; .; .; .; .; .; .; .; .; .; R; v′]
(F1)  (F2)
[figure: w; ≤; R; v; ^{. . . . . . . . . .≤}; w; ^{≤. . . . . . . . . .}; R; v; ≤]

Note that there is no requirement that the v′ and w′ required by the conditions are unique. A birelation model will be called universal if the required worlds are indeed always unique. The satisfaction relation, w ⊩_{B} A, between worlds, w, and modal formulae, A, is defined by the usual inductive clauses for the intuitionistic connectives (see page 22) and by the clauses below for the modalities.

w ⊩ □A iff for all w′ ≥ w, for all v′, w′Rv′ implies v′ ⊩ A

w ⊩ ♢A iff there exists v such that wRv and v ⊩ A

Again we write B ⊧ A to mean that, for all w ∈ W, w ⊩_{B} A.

The definition of satisfaction in a birelational model follows the analogy with the intuitionistic quantifiers by using (3.2) for □ and (3.5) for ♢. Moreover, as discussed above, (F1) ensures that the monotonicity lemma holds:

Lemma 3.3.1 (Monotonicity lemma) If w ≤ w′ and w ⊩ A then w′ ⊩ A.

Technically, (F2) means that formulae such as ¬ ♢ A ⊃ □¬A hold (see Plotkin and Stirling [64]).

However, a more conceptual justification of the two frame conditions is possible. Following the Kripkean paradigm for intuitionistic logic, atomic facts accumulate as we ascend the partial order. Now, it might reasonably be held that the fact that a world w sees another world v is a reasonable sort of atomic fact that should persist in this way. Thus any world w′ ≥ w should also, in effect, see v; but it is reasonable to expect that we might have accumulated more facts about v too which may therefore have ‘evolved’ into some world v′ ≥ v. Formalizing these considerations, we arrive at (F1). A dual argument based on v being seen by a world w justifies (F2). One might well dispute that the passive property of being seen by another world is the sort of fact which should persist. Thus (F2) seems to have less justification than (F1). (However, both conditions do have equal status in the context of Ewald’s ‘intuitionistic tense logics’ which have both ‘forwards’ and ‘backwards’ modalities [20].) Nevertheless, if one does accept both arguments then (F1) and (F2) should be seen as fundamental and not as artificial conditions imposed for purely technical reasons.

In Figure 3–6 we give Plotkin and Stirling’s axiomatization of the modal formulae valid in all birelation models (see [64]). A similar axiomatization is given by Ewald for his tense logic version [20]. Fischer Servi, [24], gives a slightly different axiomatization, emphasizing more the duality between □ and ♢. We call the resulting logic IK as in [24,64]. In Section 3.4 we shall argue that IK is the true intuitionistic analogue of K.

Axioms

0. All substitution instances of theorems of IPL.

1. □(A ⊃ B) ⊃ (□A ⊃ □B).

2. □(A ⊃ B) ⊃ (♢A ⊃ ♢B).

3. ¬ ♢ ⊥.

4. ♢(A ∨ B) ⊃ (♢A ∨ ♢B).

5. (♢A ⊃ □B) ⊃ □(A ⊃ B).

Rules

(MP) From A ⊃ B and A deduce B.

(Nec) From A deduce □A.

Figure 3–6: Axiomatization of IK.

The soundness of IK relative to birelation models is straightforward. Completeness can be established by a canonical model construction. We give an outline of the argument, which we shall need to refer to in Chapter 8. For a fully detailed proof see Fischer Servi [24]. We use X, Y, … to range over sets of modal formulae. We write X ⊢ Y to mean that there are finite X′ ⊆ X and Y′ ⊆ Y such that (⋀ X′) ⊃ (⋁ Y′) is a theorem of IK. The set X is said to be prime if it satisfies the following three conditions: X ⊢ A implies A ∈ X (it is deductively closed); X ⊬ ⊥ (it is consistent); and A ∨ B ∈ X implies either A ∈ X or B ∈ X (it satisfies the disjunction property). The canonical model is the birelation model B = (W, ≤, R, V) where:

W = {X | X is prime},
X ≤ X′ iff X ⊆ X′,
X R Y iff {♢A | A ∈ Y } ⊆ X and {B | □B ∈ X} ⊆ Y ,
V (X) = {α | α ∈ X}.

However, it takes some work to show establish that B satisfies the frame conditions. Crucial to this is the following lemma:

Lemma 3.3.2 (Prime lemma) If X ⊬ Y then there exists a prime X′ ⊇ X such that X′ ⊬ Y.

This is proved by a standard Lindenbaum construction. We now give the argument that B satisfies (F2). Suppose that X R Y and Y ≤ Y′. We must find a world X′ such that X ≤ X′ and X′ R Y. First define:

X′_{0} = X ∪ {♢A | A ∈ Y′}.

We claim that X′_{0} ⊬ {□B | B ∉ Y′}. For otherwise we would have:

X, (♢A_{1}), …, (♢A_{m}) ⊢ (□B_{1}), …, (□B_{n}),

where A_{i} ∈ Y′ and B_{j} ∉ Y′. Whence:

X, ♢(A_{1} ∧ … ∧ A_{m}) ⊢ □(B_{1} ∨ … ∨ B_{n})

so, defining A = A_{1} ∧…∧A_{m} and B = B_{1} ∨…∨B_{n}, we have that X ⊢ □(A ⊃ B) by axiom 5 of IK. But then, as X is prime, □(A ⊃ B) ∈ X so, because X R Y, we have that A ⊃ B is in Y and hence in Y′. Now A_{1}, …, A_{m} ∈ Y′ and Y′ is prime. So, by deductive closure, B ∈ Y′ whence, by the disjunction property, B_{j} ∈ Y′ for some j. This is a contradiction, so we have justified the claim that X′_{0} ⊬ {□B | B ∉ Y′}. But, by the prime lemma, there exists a prime X′ ⊇ X′_{0} such that X′ ⊬ {□B | B ∉ Y′}. It is easy to see that X′ is the world required by (F2). The other frame condition, (F1), is established similarly. The fundamental property of B is given by:

Lemma 3.3.3 (Canonical model lemma) X ⊩_{B} A if and only if A ∈ X,

which is proved by induction on the structure of A, using the prime lemma in the implication and necessity cases. We can now prove completeness by showing the contrapositive. If A is not a theorem of IK then, by the prime lemma, there is a prime X such that X ⊬ A and hence A ∉ X. So, by the canonical model lemma, X ⊮_{B} A. Thus indeed B |̸= A.

We now show that IK satisfies Requirements 1–5. We hope that the remainder of the thesis will convince the reader that Requirement 6 is also satisfied.

Requirement 1 is easily proved using a simple translation from modal formulae to propositional formulae defined by just omitting the modalities from the modal formula. It is clear from the axiomatization of IK that the translation maps theorems of IK to theorems of IPL. Conservativity follows because the translation is the identity on propositional formulae. (Alternatively, it can be proved semantically by extending arbitrary IPL-models to birelation models). Requirement 2 is immediate from the axiomatization of IK. For Requirement 3, as every theorem of IK is a theorem of K, it is sufficient to derive ♢A ↔ ¬ □ ¬A in IK together with the Law of the Excluded Middle. This is routine. The disjunction property, Requirement 4, is easily proved by the standard semantic method (see e.g. van Dalen [14, pp. 266-267]). It also follows from results we prove in Chapters 5 and 6. Lastly, we show Requirement 5, the independence of □ and ♢. Although simple, this property is not proved in the literature on IK. First, we show that ♢α is not equivalent to any modal formula in which ♢ does not occur, thus ♢ is not definable in terms of □ and the other connectives. Consider the birelation model:

\begin{matrix}w′ & \overline{R^{}} & v \{α\} \\ w & ≤ \end{matrix}

Then w′ ⊩ ♢α but w ⊮ ♢α. However, if A is any formula not containing ♢ then it is easily proved, by structural induction on A, that w ⊩ A if and only if w′ ⊩ A. So indeed A and ♢α are inequivalent. To see that □ is not definable in terms of ♢ and the other connectives, consider the two birelation models:

v′ {α}  v′ {α}
[figure: R; R]
w  w  \overline{R ^{}}v≤
B_{1}  B_{2}

First note that v′ ⊩_{B_{1}} A if and only if v′ ⊩_{B_{2}} A, for any modal formula A. Using this, one proves by structural induction on any □-free formula A, that w ⊩_{B_{1}} A if and only if w ⊩_{B_{2}} A. (The only interesting case is that w ⊩_{B_{2}} ♢A implies w ⊩_{B_{1}} ♢A, which follows from the monotonicity lemma and the fact noted above.) However, w ⊩_{B_{1}} □α but w ⊮_{B_{2}} □α. So indeed neither □ nor ♢ is definable in terms of the other.

Just as with classical modal logic, there are completeness and correspondence results relating extensions of IK with classes of birelation models. We present first some completeness results analogous to those presented in Section 3.1 for classical modal logics. In Figure 3–7 we give a list of axiom schemas named identically to those in Figure 3–2 on page 35 (we omit schema 2 for technical reasons, see Section 6.3). Classically the new axiom schemas are equivalent to their counterparts in Figure 3–2. However, in intuitionistic modal logic the schema □A ⊃ A, for example, is not equivalent to the schema A ⊃ ♢A, and the conjunction is needed for the completeness results below. We write IKS_{1}… S_{n} for the logic obtained by extending IK with the schemas S_{1}… S_{n} from Figure 3–7. As in the classical case, we write IT, IS4 and IS5 for IKT, IKT4 and IKT5 respectively. (Again IS5 is also axiomatized by IKTB4.) An important fact (see Fischer Servi [24, p. 193]) is that IS5 is an alternative axiomatization of Prior’s MIPQ [67,9,11]. Proofs that each IKS_{1}… S_{n} satisfies Requirements 1–5 closely follow those for IK (using the completeness result below).

We say that (W, ≤, R, V) is a birelation model of IKS_{1}… S_{n} if R satisfies the properties associated with S_{1}… S_{n} in Figure 3–2. Thus the birelation models for

\begin{matrix}D & ♢⊤ \\ T & (□A ⊃ A) ∧ (A ⊃ ♢A) \\ B & (♢ □ A ⊃ A) ∧ (A ⊃ □ ♢ A) \\ 4 & (□A ⊃ □ □ A) ∧ (♢ ♢ A ⊃ ♢A) \\ 5 & (♢ □ A ⊃ □A) ∧ (♢A ⊃ □ ♢ A) \end{matrix}

Figure 3–7: Intuitionistic modal axioms.

IT, IS4 and IS5 are those in which R is respectively reflexive, a preorder and an equivalence relation.

Theorem 3.3.4 The following are equivalent:

1. A is a theorem of IKS_{1}… S_{n}.

2. A is valid in all birelation models of IKS_{1}… S_{n}.

In each case the soundness direction is routine and the completeness direction is proved by showing that the canonical model, defined analogously to that used in the proof of the completeness of IK, is indeed a birelation model of IKS_{1}… S_{n}. The cases IK, IT, IKTB, IS4 and IS5 of Theorem 3.3.4 appear explicitly in Fischer Servi [24]. The other cases are straightforward.

It turns out that the above completeness results are not correspondence results. A birelation frame is a triple (W, ≤, R). Apart from in the trivial case of IK, none of the intuitionistic modal logics IKS_{1}… S_{n} characterizes the class of modal frames in which R satisfies the properties associated with S_{1}… S_{n} in Figure 3–2. For example, the schema for T in Figure 3–7 is valid in the frame:

\begin{matrix}w′ \\ w & [figure] \end{matrix}

where w ≤ w′, and in this frame R is not reflexive. Appropriate characterization results, covering all the logics above, are given by Plotkin and Stirling [64, Theorem 2.2]. They involve classes of frames determined by properties relating R and ≤. The characterization results enable schemas such as □A ⊃ A and A ⊃ ♢A to be distinguished. However, we shall never need such distinctions, so our classes of IKS_{1}… S_{n} models will suffice.

The finite model property for MIPQ relative to an algebraic semantics (see Fischer Servi [22] and Ono [61, Theorem 4.8]) implies the decidability of IS5. Further, by a prime filter construction, a finite birelation model of IS5 can be constructed from a finite algebraic model, Ono [61, Theorem 3.5] (although Ono uses a different, but equivalent, formulation of birelation models of IS5). Therefore IS5 has the finite model property relative to its birelation models. Ewald [20] claimed the finite model property (and hence decidability) for tense logics subsuming IK and any combination of D, T and 4. However, his proof has a serious flaw, which we shall discuss in detail in Chapter 8. Ewald also claimed that decidability could be established using Rabin’s monadic second-order theory, S2S, citing Rabin [68, p. 621] as substantiation. However, we believe that the relation between ≤ and R presents a serious obstacle to applying the techniques of Rabin (an obstacle which remains if one uses Ewald’s ‘intuitionistic tense structures’ [20] instead of birelation models). And, although we are acquainted with the usual applications of monadic second-order theories to prove the decidability of non classical logics (as in Gabbay [32]), we have been unable to adapt such techniques to IK and its extensions. Nevertheless, using different techniques, we shall prove that IK plus any combination of D, T and B is decidable (Theorem 7.3.1) and has the finite model property (Theorem 8.2.1). Decidability and the finite model property for the other logics (including IS4) remain open questions.

3.4 Our approach to intuitionistic modal logic

We have yet to consider Requirement 6. In this section we present our approach to intuitionistic modal logic, which addresses this requirement directly. We accept the standard possible world account of modality, but we understand it from an intuitionistic point of view. In many cases, the intuitionistic modal logics induced by our approach will be those in the scope of Theorem 3.3.4. Thus our approach provides a new justification to some well known intuitionistic modal logics.

As discussed in Chapter 1, the possible world account of modality gives a simple interpretation of modal logic which is well motivated both philosophically and technically. Thus we accept this framework, but we make the following important observation: there is nothing in the interpretation itself that induces classical modal logic. Classical modal logic arises only if we interpret the definitions in a classical meta-theory. However, the definition of modal model and satisfaction on page 33 could instead be understood from an intuitionistic point of view, in which case one should not expect principles such as the Law of the Excluded Middle to follow. So we propose that intuitionistic modal logic should be determined by the usual possible world semantics viewed from an intuitionistic meta-theory.

To take the proposal most literally, one would like to induce the intuitionistic analogue of K (say) via an exact analogue of Theorem 3.1.1. Let us refer to the desired intuitionistic analogue of K by IK. (For the moment it is irrelevant what IK actually is, however we shall be arguing below that it is indeed the logic IK of Figure 3–6.) We would like to prove equivalent:

1. A is a theorem of IK.

2. For all modal models M, M ⊧ A.

using the intuitionistic meta-theory. Soundness (1 ⟹ 2) will not be a problem, so long as IK contains only intuitionistically acceptable principles under the interpretation (which IK of Figure 3–6 does). Completeness, however, is problematic. In a classical meta-theory, the logic for which completeness holds is classical K. Therefore, in order to obtain an intuitionistic completeness theorem for IK it would, at least, be necessary to allow some classically invalid principles into the meta-theory. However, even once classically invalid principles are allowed, a further problem remains. In general, intuitionistic proofs of completeness require Markov’s principle which is intuitionistically unacceptable (see the discussion on internal completeness in Dummett [16, pp. 249 ff.]). But a more fundamental objection to the use of classically invalid principles is that such principles are not even accepted by all intuitionists. As a general aim, we should like any account of intuitionistic modal logic to be as philosophically neutral as possible. It must make sense intuitionistically, but it should also make sense classically. We therefore provide two alternative interpretations of our proposal, both of which can be understood equally well from either a classical or intuitionistic viewpoint. The first we discuss here uses intuitionistic first-order logic as a formalized meta-theory. The second defines intuitionistic modal logic by way of a natural deduction system.

For the first approach, we translate a modal sentence into a first-order formula expressing the possible world conditions for the modal sentence to be satisfied. With classical modal logic one has that a modal formula is a theorem if and only if its translation is a theorem of classical first-order logic. We suggest therefore that intuitionistic modal logic should be similarly determined by provability, under the same translation, in intuitionistic first-order logic.

The translation is into the standard first-order language, L_{m}, of modal models. This has one binary relation symbol, R, and a unary predicate symbol α for each α ∈ P. There are no function symbols or constants. Let x be a variable and A a modal formula. A first-order formula, A^{x}, with (at most) one free variable, x, is defined by:

α^{x} = α(x)
⊥^{x} = ⊥
(A ∧ B)^{x} = A^{x} ∧ B^{x}

(A ∨ B)^{x} = A^{x} ∨ B^{x}
(A ⊃ B)^{x} = A^{x} ⊃ B^{x}
(□A)^{x} = ∀x′. xRx′ ⊃ A^{x′}
(♢A)^{x} = ∃x′. xRx′ ∧ A^{x′}

Thus, thinking of variables as ranging over possible worlds and R as representing the visibility relation, A^{x} codes up the possible world conditions stating that A is satisfied at x. We suggest then that IK should be determined by:

A is a theorem of IK iff ⊢_{IL} ∀x. A^{x}.  (3.6)

We now have a precise definition of the desired intuitionistic modal logic which, moreover, is independent of the informal meta-theory from which it is viewed. The intuitionistic element is confined to a formal theory (intuitionistic first-order logic) about which we may reason either intuitionistically or classically. But what is the relation to the original proposal? In a classical meta-theory we have that ∀x. A^{x} is a theorem of classical first-order logic if and only if, for all modal models M, M ⊧ A, by the soundness and completeness of classical first-order logic (as modal models are in one-to-one correspondence with L_{m}-structures). So classically the translational approach is just a formalization of the semantic approach. In an intuitionistic meta-theory, although we cannot hope for the similar completeness result (again see Dummett’s discussion on internal completeness [16, pp. 249 ff.]), it seems reasonable to accept ⊢_{IL} ∀x. A^{x} as a fruitful alternative to semantic validity, for one might well accept, at least informally, that intuitionistic first-order logic does formalize all intuitionistically valid elementary reasoning.

As hinted above, the logic IK of Figure 3–6 does indeed satisfy the equivalence of (3.6). We call the left-to-right implication meta-logical soundness, and the rightto-left implication meta-logical completeness. The correspondence was first proved by Colin Stirling in unpublished work. Meta-logical soundness is easily proved by induction on derivations in IK. Stirling proved the interesting completeness direction using a complicated method of transforming any birelation model invalidating A into an intuitionistic predicate model invalidating ∀x. A^{x}. His proof used classical reasoning and relied on the completeness theorem for IK relative to birelation models.

Other modal logics can be handled in a similar fashion, so long as one takes the point of view that a modal logic should be determined by a class of frames (as motivated on page 36). The first-order language, L_{f}, of modal frames is the sublanguage of L_{m} with just the single predicate R. Many conditions on the visibility relation (e.g. all those in Figure 3–2 on page 35) can be expressed in L_{f}. Given a set of sentences T in L_{f}, we determine the intuitionistic modal logic of T -frames as that whose set of theorems is:

{A | T ⊢_{IL} ∀x. A^{x}}.  (3.7)

We propose that the induced intuitionistic modal logic is a natural analogue of the classical modal logic complete relative to the class of frames satisfying the conditions in T . (The intuitionistic modal logic is not determined by the classical modal logic itself, but by the theory expressing the class of frames we are interested in. Some subtleties are discussed below.)

This natural way of defining intuitionistic modal logics appears to be novel. The closest work is Bull’s translation of MIPQ into the first-order language obtained by removing R from L_{m} (the modalities being translated as direct quantifiers rather than relativized ones) [11]. From Bull’s results, it is easy to derive that MIPQ is the intuitionistic modal logic obtained by (3.7) when T is the axiom stating that R is an equivalence relation. Thus, by the remarks on page 55, IS5 satisfies meta-logical completeness. It will follow from the results of Chapters 5 and 6 that all the intuitionistic modal logics IKS_{1}… S_{n} of Theorem 3.3.4 satisfy meta-logical completeness. This provides justification that these logics do satisfy Requirement 6.

As a way of determining the intuitionistic analogue of the classical modal logic of T -frames, the present proposal still has a number of defects. One problem is that many interesting classical modal logics arise through conditions on R that are not first-order definable (e.g., the modal logic of provability used by Solovay [72]). A possible way of avoiding this problem would be to translate into intuitionistic higher-order logic rather than first-order logic. However, it is not clear that the translational approach is appropriate for higher-order conditions. For, in contrast to the first-order case, it is not so clear what the intuitionistically valid formulae of higher-order logic are. No formal system would be appropriate, as any formal system would run into the same incompleteness phenomena that occur with formal systems of classical higher-order logic. With classical logic, however, there is a perfectly adequate semantic notion of validity. I do not know of a generally accepted notion of intuitionistic validity for higher-order formulae. A different approach to dealing with higher-order conditions on R will be mentioned in Section 5.4, but from now on we shall be mainly concerned with first-order conditions.

A second feature, that one may consider a defect, is that the proposal does not determine a unique intuitionistic modal analogue to the classical modal logic of T -frames. For, in general, there will be many classically equivalent but intuitionistically inequivalent ways of formulating T , which may induce inequivalent intuitionistic modal logics. For example, in classical logic, reflexivity is expressed by both ∀x. xRx and ∀x. ¬¬xRx, which are intuitionistically inequivalent. However, the two sentences induce different intuitionistic modal logics as □A ⊃ A is valid according to the former but not the latter. In this case ∀x. xRx is clearly the correct statement of reflexivity. Similarly, one usually expects most conditions to have just one ‘correct’ intuitionistic formulation (cf. the last paragraph of Ch. 1, §3 in Troelstra and van Dalen [79, p. 16]). So in practice the choice amongst inequivalent intuitionistic analogues will be uncontroversial. But, in any case, these problems in determining a single intuitionistic analogue point out the potential diversity of intuitionistic modal logics. Although it is a common situation to have several intuitionistically inequivalent versions of a single classical notion, we shall be mainly concerned with the single most natural analogue of each classical modal logic. In Section 5.4 we shall suggest a semantic way of defining a unique intuitionistic counterpart to the classical modal logic determined by a given class of frames.

Perhaps the greatest defect of the present proposal is that it is subservient to the acceptance of intuitionistic first-order logic. One would prefer an a priori definition of intuitionistic modal logic in which the intended possible world interpretation of the modalities is built in. It should be possible to understand intuitionistic modal logic in its own right, not just as a fragment of an intuitionistic first-order theory. With the standard intuitionistic connectives and quantifiers, we argued in Section 2.1 that their meanings are given by their natural deduction introduction and elimination rules, moderated by the inversion principle. So, to give an a priori interpretation of the modalities, we shall give them introduction and elimination rules within the context of a natural deduction system for intuitionistic modal logic. It will turn out that the modal logics induced by the natural deduction system are in exact accord with those determined by the translational approach described above.

The two approaches described above and their equivalence will occupy Chapters 4 and 5. We believe that both approaches meet Requirement 6. Their subsequent equivalence gives the induced intuitionistic modal logics a very strong justification.

We end this chapter with a short discussion on a couple of related approaches. The approach adopted by Ewald in his thesis also addresses Requirement 6. He argued for an intuitionistic philosophy of tense based on Brouwer’s creative subject (see Dummett [16, pp. 335 ff.]). Notoriously, the creative subject introduces a temporal aspect to meaning, the temporal order in which facts are accumulated (theorems are proved). Ewald argued that this order is, in fact, an epistemic one and should be kept separate from the truly temporal order of temporal logic. He used these considerations to motivate his ‘intuitionistic tense structures’ (see [20]) in which his intuitionistic tense logics were interpreted. However, his intuitionistic tense structures are just IL-models. These give an approximation to a creative subject interpretation of intuitionistic logic, but, as we commented in Section 2.2, their interpretation of intuitionistic logic is valid only from a classical viewpoint. Thus, despite his intuitionistic motivation, Ewald’s technical development does not fulfil Requirement 6. This said, we shall see in Chapter 5 how close Ewald’s interpretation is to our meta-theoretic translation.

One other related approach is that of Fischer Servi [21] who also proposed a way of determining the intuitionistic analogue of a classical modal logic. She determined the intuitionistic modal logic by a translation into a classical bimodal logic based on the original classical modal logic. This approach is far from providing an intuitionistic explanation of the modalities, as it presupposes classical modal logic. Thus Requirement 6 is not addressed. However, it turns out that many of the intuitionistic modal logics generated by Fischer Servi’s translation agree with ones determined by our proposal. We shall discuss this in Section 6.4.

Natural deduction for intuitionistic modal logics

In this chapter we present natural deduction systems, for intuitionistic modal logics, in which the inference rules embody the possible world interpretation of the modalities. In Section 4.1 we motivate the definition of the systems. The basic natural deduction system, in which no properties are assumed of the visibility relation, is defined in Section 4.2. Then in Section 4.3 we give additional rules for imposing conditions on the visibility relation. The induced consequence relation is defined in Section 4.4, and is shown to be sound relative to standard modal models in Section 4.5.

4.1 Motivation

Our aim is to provide a natural deduction system for intuitionistic modal logic in which the standard possible world meanings of the modalities can be read off from their inference rules. We want, therefore, to give introduction and elimination rules for □ and ♢ which capture their possible world interpretations.

In the possible world semantics of modal logic, the primitive notion is relative truth. In order to directly build the possible world interpretation of the modalities into the proof system we therefore base the proof system on judgements asserting relative truth. The basic judgement of our natural deduction system is of the form x: A where x is some variable that, intuitively, denotes a world in a modal model and the assertion is to be read as: ‘A holds at x’. (There is a long history of such proof systems for modal logics, which will be discussed in Section 4.6.) One might object that we are importing too much semantics into the syntax. However, if we are to have a proof system that directly ascribes the usual meaning to the modalities, then there is no choice other than to found that proof system on the same primitive concept as the semantics. We offer two, more pragmatic, justifications. The first is that in informal modal reasoning it is very natural to make such a relativization of sentences to worlds/contexts/situations (as will be demonstrated by the example derivations in this thesis). The second is that technically the approach works. We obtain a natural deduction system with all the desirable meta-theoretical properties (as will be shown in Chapter 7).

The introduction rule for □ must express that if A holds at every world y visible from x then □A holds at x. That is, if, on the assumption that y is an arbitrary world visible from x, we can show that A holds at y then we can conclude that □A holds at x. To formalize this we require a second judgement form, xRy, asserting that a world y is visible from a world x. Then the rule is:

[xRy] ; ⋮ . ; y:A ; x:□A

where the variable y must represent an arbitrary world so it must be different from x and must not appear in assumptions other than xRy. Note that the assumption xRy is discharged in the standard natural deduction fashion, for the conclusion that □A holds at x is justified whether or not x actually does see any world y. The associated elimination rule is obvious:

\begin{matrix}x:□A & xRy \\ y:A \end{matrix}

That this rule is legitimate with respect to the □ introduction rule, in the sense that the inversion principle applies, will be shown in Chapter 7.

A simple derivation using the above rules is:

\begin{matrix}x:□(A ∧ B) & [xRy]^{1} \\ y:A ∧ B \end{matrix} ; y:A ; x:□A_{1}  (4.1)

From this derivation we can conclude that if □(A ∧ B) holds at any world x then □A also holds at x. Therefore, the rôle of the world y in the derivation is merely to act as a temporary, arbitrary world whose use enables the effects of the assumption that □(A ∧ B) holds at x to be determined.

The introduction rule for ♢ must express that if A holds at some world y visible from x then ♢A holds at x. The rule for this is simply:

\begin{matrix}y:A & xRy \\ x:♢A \end{matrix}

The associated elimination rule is more complicated. Suppose that we can deduce that B holds at some world z on the assumption that A holds at an arbitrary y visible from x. Then if ♢A holds at x we can conclude that indeed B does hold at z. Formally then the rule is:

\begin{aligned}x:♢A & [y:A] [xRy] ; ⋮ . ; z:B \\ & z:B \end{aligned} ; (♢E)

where again, as the variable y is to represent an arbitrary world, it must be different from x and z and must not appear in any assumptions other than xRy and y:A. Once more the inversion principle holds (again see Chapter 7).

A very simple derivation combining □ and ♢ is:

\begin{matrix}\begin{matrix}x:□A & xRy \\ y:A \end{matrix} & xRy \\ x:♢A \end{matrix}  (4.2)

From this derivation we can conclude that if □A holds at any world x that sees another world y then ♢A holds at x. Note that the conclusion is invalid without the assumption that there is a world y seen by x. Therefore assumptions of the form xRy must be taken as an integral part of logical consequence.

The rules given above allow the visibility relation to be an arbitrary relation. Often, one is interested only in visibility relations satisfying certain specified properties. Such assumptions on the visibility relation will in general mean that additional modal consequences hold. For example, if we assume that the visibility relation is serial (i.e. for every world x, there exists a world y visible from x, see Figure 3–2 on page 35) then we should be able to derive x:♢A from x:□A without making any additional assumptions, as the extra world demanded by (4.2) is now guaranteed to exist.

One benefit of using a proof system based on relative truth is that (at least in simple cases) it is rather easy to build such conditions on the visibility relation into the system. One just adds appropriate rules manipulating the relational assumptions. The rules for the logical connectives (including the modalities) remain unaltered. For example, the rule expressing seriality is:

[xRy] ; ⋮ . ; z:A ; z:A

with the restriction that y must be different from both x and z and may not appear in any open assumption other than xRy. Intuitively, the rule says that if A holds at z on the assumption that there is an arbitrary world y seen by x, then A holds at z without that assumption. The conclusion is clearly justified by the seriality of R. So, for example, the derivation of (4.2) can now be extended to:

\begin{matrix}\begin{matrix}x:□A & [xRy]^{1} \\ y:A \end{matrix} & [xRy]^{1} \\ x:♢A \end{matrix} ; x:♢A_{1}  (4.3)

yielding the conclusion discussed above.

It is possible to represent many other conditions on the visibility relation by similar rules on relational assumptions. Indeed, for any conditions on the visibility relation expressed by a geometric theory in the first-order language of modal frames, we can adapt the associated natural deduction rules introduced in Section 2.3

{x:⊥ \atop y:A} (⊥E)
\begin{matrix}x:A & x:B \\ x:A ∧ B \end{matrix} (∧I) {x:A ∧ B \atop x:A} (∧E1)  {x:A ∧ B \atop x:B} (∧E2)

{x:A \atop x:A ∨ B} (∨I1)  {x:B \atop x:A ∨ B} (∨I2)  \begin{aligned}x:A ∨ B & [x:A] ; ⋮ . ; y:C & [x:B] ; ⋮ . ; y:C \\ & y:C \end{aligned}(∨E)

[x:A] ; ⋮ . ; x:B ; x:A ⊃ B (⊃I)  \begin{matrix}x:A ⊃ B & x:A \\ x:B \end{matrix} (⊃E)

[xRy] ; ⋮ . ; y:A ; x:□A ^{(□I)^{∗}}  \begin{matrix}x:□A & xRy \\ y:A \end{matrix} (□E)

\begin{matrix}y:A & xRy \\ x:♢A \end{matrix} (♢I) \begin{aligned}x:♢A & [y:A] [xRy] ; ⋮ . ; z:B \\ & z:B \end{aligned} ; ^{(♢E)^{†}}

∗Restriction on (□I): y must be different from x and must not occur in any open assumptions other than the distinguished occurrences of xRy.

†Restriction on (♢E): y must be different from both x and z and must not occur in any open assumptions upon which z: B depends other than the distinguished occurrences of y:A and xRy.

Figure 4–1: The basic modal natural deduction system, N_{□♢}.

4.2 The basic modal natural deduction system

In this section we give a full description of the basic natural deduction for intuitionistic modal logic, in which no properties are assumed of the visibility relation. We shall proceed quite rapidly through the definitions, most of which are analogous to ones given in Section 2.1.

Assume given a countably infinite set of variables over which x, y, z … range. The rules of the natural deduction system manipulate two kinds of judgement: a main judgement form between variables and formulae written x:A, and a subsidiary judgement form between variables and variables written xRy. We call x:A a prefixed formula where x is the prefix (or variable) and A is the formula. We call xRy a relational assumption (these judgements will only ever appear in proofs as assumptions).

The rules for the basic modal natural deduction system, N_{□♢}, are given in Figure 4–1. Again we define the major premise of each elimination rule as that containing the connective or modality which is eliminated. The other premises are called the minor premises.

Derivations are defined as on page 12, except that we insist that the conclusion of a derivation be a prefixed formula. The only case excluded is that of the trivial tree consisting of a single relational assumption. (The idea behind this restriction is that relational assumptions are just tools to help us establish that that a formula holds at a world.) This time assumptions are discharged by applications of the of the (∨E), (⊃I), (□I) and (♢E) rules.

We use Π, Π′, … to range over derivations in N_{□♢}. Again, when we wish to note the conclusion of Π, we write {Π \atop x:A} and we write {x:A \atop Π} or {xRy \atop Π} to distinguish a set of occurrences of open assumptions in Π.

Some example derivations, using all of the modal rules, are given in Figure 4–2. These show how the axioms of IK are derivable in the natural deduction system.

1. □(A ⊃ B) ⊃ (□A ⊃ □B).

\begin{matrix}\begin{matrix}[x:□(A ⊃ B)]^{3} & [xRy]^{1} \\ y:A ⊃ B \end{matrix} & \begin{matrix}[x:□A]^{2} & [xRy]^{1} \\ y:A \end{matrix} \\ y:B \end{matrix} ; x:□B_{1} ; x:□A ⊃ □B_{2} ; x:□(A ⊃ B) ⊃ (□A ⊃ □B)_{3}

2. □(A ⊃ B) ⊃ (♢A ⊃ ♢B).

\begin{aligned}[x:♢A]^{2} & \begin{matrix}\begin{matrix}\begin{matrix}[x:□(A ⊃ B)]^{3} & [xRy]^{1} \\ y:A ⊃ B \end{matrix} & [y:A]^{1} \\ y:B \end{matrix} & [xRy]^{1} \\ x:♢B \end{matrix} \\ & x:♢B \end{aligned}_{1} ; x:♢A ⊃ ♢B_{2} ; x:□(A ⊃ B) ⊃ (♢A ⊃ ♢B)_{3}

3. ¬ ♢ ⊥.

\begin{matrix}\begin{matrix}[x:♢⊥]^{2} & {[y:⊥]^{1} \atop x:⊥} \\ x:⊥ \end{matrix} & 1 \\ x:¬ ♢ ⊥ \end{matrix}_{2}

4. ♢(A ∨ B) ⊃ (♢A ∨ ♢B).

\begin{aligned}[x:♢(A ∨ B)]^{3} & \begin{aligned}[y:A ∨ B]^{2} & \begin{matrix}[y:A]^{1} & [xRy]^{2} \\ x:♢A \end{matrix} ; x:♢A ∨ ♢B & \begin{matrix}[y:B]^{1} & [xRy]^{2} \\ x:♢B \end{matrix} ; x:♢A ∨ ♢B \\ & x:♢A ∨ ♢B \end{aligned}_{1} \\ & x:♢A ∨ ♢B \end{aligned}_{2} ; x:♢(A ∨ B) ⊃ (♢A ∨ ♢B)_{3}

5. (♢A ⊃ □B) ⊃ □(A ⊃ B).

\begin{matrix}\begin{matrix}[x:♢A ⊃ □B]^{3} & \begin{matrix}[y:A]^{1} & [xRy]^{2} \\ x:♢A \end{matrix} \\ x:□B \end{matrix} & [xRy]^{2} \\ y:B \end{matrix} ; y:A ⊃ B_{1} ; x:□(A ⊃ B)_{2} ; x:(♢A ⊃ □B) ⊃ □(A ⊃ B)^{3}

Figure 4–2: Derivations of the IK axioms.

In fact, in Chapter 6, we shall show that the theorems (in the appropriate sense) of the natural deduction system are precisely the theorems of IK.

We call the variable y in an application of (□I) or (♢E) the eigenvariable of the rule (by analogy with the (∀I) and (∃E) rules). The eigenvariable in an application of (□I) is closed by the conclusion of the rule. The eigenvariable in an application of (♢E) is closed by the minor premise. The notions of closed and open variable occurrences in a derivation are defined exactly as for N_{IL} (page 13). The notions of substitution, Π[y/x] and {Π′ \atop x:A} ; Π , are also defined as on page 13. Again we do not distinguish between derivations differing only in the names of their closed variables.

4.3 Conditions on the visibility relation

In this section we show how to extend the system with rules expressing conditions on the visibility relation. In order to do so, we have to restrict attention to conditions expressed in some formal language. We use the first-order language L_{f} defined in Section 3.4, so we shall not be able to express higher-order conditions. However, we do not know how to give rules for arbitrary conditions expressed in L_{f}. Instead we consider conditions expressed by (basic) geometric theories. Then we adapt the proof rules introduced in Section 2.3. Many interesting properties (such as all those in Figure 3–2 on page 35) are indeed expressed by basic geometric sequents.

The atomic formulae of L_{f} are just relational assumptions, so the form of a basic geometric sequent is:

∀\overline{x}. ((R_{1} ∧ … ∧ R_{n}) ⊃ ∃\overline{y}. ⋁_{i=1}^{m}(R_{i1} ∧ … ∧ R_{in_{i}})),

where m, n ≥ 0, n_{1}, …, n_{m} ≥ 1 and R_{i} and R_{ij} are relational assumptions. Although written in a formal language, in this chapter we understand the properties so-expressed both informally and, as we are interested in intuitionistic modal logics, intuitionistically.

\begin{matrix}χ_{D} & ∀x. ∃y. xRy \\ χ_{T} & ∀x. xRx \\ χ_{B} & ∀xy. xRy ⊃ yRx \\ χ_{4} & ∀xyz. xRy ∧ yRz ⊃ xRz \\ χ_{5} & ∀xyz. xRy ∧ xRz ⊃ yRz \\ χ_{2} & ∀xyz. xRy ∧ xRz ⊃ ∃w. yRw ∧ zRw \end{matrix}

Figure 4–3: Properties of the visibility relation.

\begin{matrix}[xRy] ; ⋮ . ; z:A ; z:A^{(R_{D})^{∗}} & [xRx] ; ⋮ . ; y:A ; y:A(R_{T}) \\ \begin{matrix}xRy & [yRx] ; ⋮ . ; z:A \\ z:A \end{matrix}(R_{B}) & \begin{aligned}xRy & yRz & [xRz] ; ⋮ . ; w:A \\ & w:A \end{aligned} (R_{4}) \\ \begin{aligned}xRy & xRz & [yRz] ; ⋮ . ; w:A \\ & w:A \end{aligned} (R_{5}) & \begin{aligned}xRy & xRz & [yRw] [zRw] ; ⋮ . ; v:A \\ & v:A \end{aligned} ; ^{(R_{2})^{†}} \end{matrix}

∗Restriction on (R_{D}): y must be different from both x and z and must not occur in any open assumptions other than the distinguished occurrences of xRy.

†Restriction on (R_{2}): w must be different from x,y,z, v and must not occur in any open assumptions other than the distinguished occurrences of yRw and zRw.

Figure 4–4: Rules expressing properties of the visibility relation.

Again, we associate to each basic geometric sequent, χ, a natural deduction rule, (R_{χ}), as on page 25. In the natural deduction system for modal logic, the only terms in relational assumptions are variables and relational assumptions may not appear as the conclusion of a derivation. Therefore the format of (R_{χ}) is:

\begin{aligned}R_{1}[\overline{z}/\overline{x}] & … & R_{n}[\overline{z}/\overline{x}] & [R_{11}[\overline{z}/\overline{x}]] … [R_{1n_{1}}[\overline{z}/\overline{x}]] ; ⋮ . ; x′:A & … & [R_{m1}[\overline{z}/\overline{x}]] … [R_{mn_{m}}[\overline{z}/\overline{x}]] ; ⋮ . ; x′:A \\ & & & x′:A \end{aligned} ; (R_{χ})

where: \overline{z} is any vector of variables of the same length as \overline{x}; neither x′ nor any of the variables in \overline{z} is contained in \overline{y}; and the variables in \overline{y} do not occur in any open assumption other than in the distinguished occurrences of R_{ij}.

Let T be a basic geometric theory in L_{f}. The natural deduction system N_{□♢}(T ) is obtained by extending N_{□♢} with the set of rules {(R_{χ}) | χ ∈ T }.

In Figure 4–3 we give names to the basic geometric sequents defining the properties in Figure 3–2. Then in Figure 4–4 we give the rules induced by the basic geometric sequents in Figure 4–3. An example derivation using (R_{D}) was already given as derivation (4.3) on page 68. In Figure 4–5 we give some example derivations using the other rules. For each (R_{χ}) considered the formula derived in Figure 4–5 is that which, in classical modal logic, characterizes the condition χ (see Figure 3–2 and the discussion in Section 3.1). The other halves of the axiom schemas in Figure 3–7 on page 56 can be derived similarly. It will follow from the results of Chapter 6 that, for any T ⊆ {χ_{D}, χ_{T} , χ_{B}, χ_{4}, χ_{5}}, the theorems (in the appropriate sense) of N_{□♢}(T ) are exactly the theorems of the corresponding IKS_{1}… S_{n} on page 55. We do not know an axiomatization of the theorems of N_{□♢}(χ_{2}) (see Section 6.3).

The eigenvariables of (R_{χ}) and their closing premises are defined as on page 27. The treatment of closed variables, substitution and the identity of derivations in N_{□♢}(T ) is exactly as in N_{□♢} (page 72).

Chapter 4. Natural deduction for intuitionistic modal logics 75

1. (R_{T}).

\begin{matrix}[x:□A]^{2} & [xRx]^{1} \\ x:A \end{matrix} ; x:A_{1} ; x:□A ⊃ A_{2}

2. (R_{B}).

\begin{aligned}[xRy]^{2} & \begin{matrix}[x:A]^{3} & [yRx]^{1} \\ y:♢A \end{matrix} \\ & y:♢A \end{aligned}_{1} ; x:□ ♢ A_{2} ; x:A ⊃ □ ♢ A_{3}

3. (R_{4}).

\begin{aligned}[xRy]^{3} & [yRz]^{2} & \begin{matrix}[x:□A]^{4} & [xRz]^{1} \\ z:A \end{matrix} \\ & z:A \end{aligned}_{1} ; y:□A_{2} ; x:□ □ A_{3} ; x:□A ⊃ □ □ A_{4}

4. (R_{5}).

\begin{aligned}[x:♢A]^{4} & \begin{aligned}[xRy]^{3} & [xRz]^{2} & \begin{matrix}[z:A]^{2} & [yRz]^{1} \\ y:♢A \end{matrix} \\ & y:♢A \end{aligned}_{1} \\ & y:♢A \end{aligned}_{2} ; x:□ ♢ A_{3} ; x:♢A ⊃ □ ♢ A_{4}

5. (R_{2}).

\begin{aligned}[x:♢ □ A]^{4} & \begin{aligned}[xRy]^{2} & [xRz]^{3} & \begin{matrix}\begin{matrix}[y:□A]^{2} & [yRw]^{1} \\ w:A \end{matrix} & [zRw]^{1} \\ z:♢A \end{matrix} \\ & & z:♢A \end{aligned}_{1} \\ & z:♢A \end{aligned}_{2} ; x:□ ♢ A_{3} ; x:♢ □ A ⊃ □ ♢ A_{4}

Figure 4–5: Derivations using rules on the visibility relation.

4.4 The consequence relation

In general, a derivation will have a prefixed formula as conclusion, which will have been derived from a number of open relational assumptions and a number of open non-relational assumptions. The rôle of the relational assumptions is quite different from that of the prefixed formulae. Intuitively, the relational assumptions amount to assuming a certain structure of possible worlds, whereas the other assumptions amount to assuming properties holding at these worlds. The structure on worlds, given by the relational assumptions, can be conveniently considered as a graph.

Henceforth, by a graph we shall mean a non-empty, directed graph whose underlying set of nodes is a set of variables. We use G, H, … to range over such graphs. Concretely, a graph is just a pair (X, R) where X is a non-empty set of variables and R is a binary relation on X. We write xRy to say that ⟨x, y⟩ ∈ R (confusion with relational assumptions should not be a problem). If G = (X, R) and G′ = (X′, R′) then we write: G ∪ G′ for the graph (X ∪ X′, R ∪ R′); and G ∪ X′ for the graph (X ∪ X′, R); and G ∪ {xRy} for the graph (X ∪ {x, y}, R ∪ {⟨x, y⟩}). We write G ⊆ G′ to mean that X ⊆ X′ and R ⊆ R′. The restriction of G to a subset X′ ⊆ X is the graph (X′, {⟨x, x′⟩ ∈ R | x, x′ ∈ X′}). The trivial graph is the graph ({x}, ∅), which we henceforth refer to as τ. A graph morphism from G to G′ is a function f : X → X′ such that xRy in G implies f(x)Rf(y) in G′. Note that our trivial graph has no categorical status in the category of graphs and graph morphisms. However, in applications we shall normally be interested (implicitly) in graphs with a distinguished node (e.g., the node prefixing the conclusion of a derivation) and in graph morphisms preserving this node. In the category of such pointed graphs and point-preserving morphisms, the trivial graph, τ, is the initial object.

The open non-relational assumptions are best treated as just a set of prefixed formulae. We shall use Γ, Δ, … to range over sets of prefixed formulae.

Let T be a basic geometric theory in L_{f}. We consider the natural deduction system N_{□♢}(T ) as generating a consequence relation of the form:

Γ ⊢_{G}^{T} x:A,

where Γ is a set of prefixed formulae and G is a graph containing every variable mentioned in Γ ∪ {x:A}, defined by: Γ ⊢_{G}^{T} x:A if there is a derivation, Π, of x:A from open assumptions y_{1}Rz_{1}, …, y_{m}Rz_{m}, x_{1} : A_{1}, …, x_{n}: A_{n} such that y_{1}Rz_{1} and … and y_{m}Rz_{m} in G, and {x_{1} : A_{1}, …, x_{n}: A_{n}} ⊆ Γ. We also say that Π is a derivation of Γ ⊢_{G}^{T} x: A. Intuitively, the consequence says that if, in a structure of worlds satisfying the conditions in T , we have a ‘substructure’, G, and each formula in Γ holds at the world named by its prefix then A holds at the world named by x. We shall formalize this interpretation in Section 4.5.

We use standard notational conventions for consequences, omitting set delimiters and the empty set from the left-hand side of the consequence relation and using comma for set union. Also when G is the trivial graph, τ, we omit both it and the (thereby determined) prefix attached to formulae, writing A_{1}, …, A_{n} ⊢^{T} A rather than x : A_{1}, …, x : A_{n} ⊢_{τ}^{T} x : A. We say A is a theorem (of the natural deduction system for T ) if ⊢^{T} A.

Clearly any particular choice of prefix names is irrelevant to the meaning of a consequence. However, although consequences could be considered up to graph isomorphism, in practice it is convenient to have a concrete representation. Consequences over different graphs can be related in a useful way by graph morphisms. Let Γ be a set of prefixed-formulae with all prefixes contained in the graph G. Given any function f from variables to variables we write f(Γ) for the set {f(x):A | x:A ∈ Γ}.

Proposition 4.4.1 For any graph morphism, f, from G to G′, if Γ ⊢_{G}^{T} x:A then f(Γ) ⊢_{G′}^{T} f(x):A.

Proof. Let Π be any derivation of Γ ⊢_{G}^{T} x:A. Let x_{1}, …, x_{n} be the variables with open occurrences in Π (x must be one of them). Then Π[f(x_{1}), …, f(x_{n})/x_{1}, …, x_{n}] is a derivation of f(Γ) ⊢_{G′}^{T} f(x):A. ⊠

4.5 Soundness relative to modal models

Although the intuitive correctness of the modal rules must be clear from the discussion and examples above, we have yet to back this up with a technical account of their correctness. In this section we formalize the intuitive interpretation of the consequence relation and justify the correctness of the rules by a soundness theorem for N_{□♢}(T ).

Our system was motivated by a desire to understand the modalities through an intuitionistic interpretation of their standard possible world meanings. Therefore it is natural to interpret the system in standard modal models, but to allow only intuitionistic meta-theoretic reasoning about the interpretation. Thus our interpretation will be identical to that we would give to a classical variant of the system, only we must take care to choose the correct intuitionistic formulation out of the many classically equivalent alternatives. Then we shall take care to keep our informal meta-theoretic reasoning intuitionistically acceptable.

The definition we gave of a modal model (see page 33) is already written in the correct intuitionistic form. Let T be a basic geometric theory in L_{f}. We call a model M = (W, R, V) a T -model if the relation R satisfies all the conditions stated in T , where we understand any basic geometric sequent as expressing its natural informal meaning under an intuitionistic reading.

Let G be a graph. A G-interpretation in M is a graph morphism, [[·]], from G to (W, R).

Theorem 4.5.1 (Soundness) Statement 1 below implies statement 2.

1. Γ ⊢_{G}^{T} x:A.

2. For all T -models M, for all G-interpretations [[·]] in M, if, for all z:B ∈ Γ, [[z]] ⊩_{M} B then [[x]] ⊩_{M} A.

Proof. By induction on the structure of derivations of Γ ⊢_{G}^{T} x:A. We treat only the modal rules and (R_{χ}).

(□I) We have a derivation:

{[xRy] \atop Π} ; y:A ; x:□A

of the consequence Γ ⊢_{G}^{T} x: □A. Moreover, by the restriction on (□I), we can assume that y is not in G. Now Π is a derivation of Γ ⊢_{G′}^{T} y: A where G′ = G ∪ {xRy}. So, by the induction hypothesis, for all G′-interpretations [[·]], if, for all z:B ∈ Γ, [[z]] ⊩ B then [[y]] ⊩ A. Let [[·]] be any G-interpretation such that, for all z:B ∈ Γ, [[z]] ⊩ B. We must show that [[x]] ⊩ □A.

Let v be any world such that [[x]]Rv. Now [[·]] can be trivially extended to an G′-interpretation (still called [[·]]) by setting [[y]] = v. Therefore, by the induction hypothesis, [[y]] ⊩ A; i.e. v ⊩ A. So indeed [[x]] ⊩ □A.

(□E) We have a derivation:

\begin{matrix}{Π \atop x:□A} & xRy \\ y:A \end{matrix}

of the consequence Γ ⊢_{G}^{T} y : A where xRy in G. Now Π is a derivation of Γ ⊢_{G}^{T} x: □A (whether or not the assumption xRy appears anywhere in Π). Let [[·]] be any G-interpretation such that, for all z: B ∈ Γ, [[z]] ⊩ B. Then, by the induction hypothesis, [[x]] ⊩ □A. But [[x]]R[[y]], so [[y]] ⊩ A, which is what we were required to show.

(♢I) We have a derivation:

\begin{matrix}{Π \atop y:A} & xRy \\ x:♢A \end{matrix}

of Γ ⊢_{G}^{T} x: ♢A where xRy in G. So Π is a derivation of Γ ⊢_{G}^{T} y: A. Let [[·]] be any G-interpretation such that, for all z: B ∈ Γ, [[z]] ⊩ B. Then, by the induction hypothesis, [[y]] ⊩ A. But [[x]]R[[y]], so [[x]] ⊩ ♢A as required.

(♢E) We have a derivation:

\begin{aligned}{Π_{1} \atop x:♢A} & \begin{matrix}[y:A] & [xRy] \\ Π_{2} \end{matrix} ; z:B \\ & z:B \end{aligned}

of Γ ⊢_{G}^{T} z : B where, by the restriction on (♢E), we can assume that y is not in G. Now Π_{1} is a derivation of Γ ⊢_{G}^{T} x: ♢A and Π_{2} is a derivation of Γ, y:A ⊢_{G′}^{T} z:B where G′ = G ∪ {xRy}. Let [[·]] be any G-interpretation such that, for all w:C ∈ Γ, [[w]] ⊩ C. We must show that [[z]] ⊩ B. By the induction hypothesis due to Π_{1} we have that [[x]] ⊩ ♢A. Therefore there exists a world v such that [[x]]Rv and v ⊩ A. Extend [[·]] to a G′- interpretation by setting [[y]] = v. Then, by the induction hypothesis due to Π_{2}, we have that [[z]] ⊩ B as required.

(R_{χ}) We have a derivation:

\begin{aligned}R_{1}[\overline{z}/\overline{x}] & … & R_{n}[\overline{z}/\overline{x}] & \begin{aligned}[R_{11}[\overline{z}/\overline{x}]] & … & [R_{1n_{1}}[\overline{z}/\overline{x}]] \\ & Π_{1} \end{aligned} ; x′:A & … & \begin{aligned}[R_{m1}[\overline{z}/\overline{x}]] & … & [R_{mn_{m}}[\overline{z}/\overline{x}]] \\ & Π_{m} \end{aligned} ; x′:A \\ & & & x′:A \end{aligned}

of Γ ⊢_{G}^{T} x′ : A where, because of the restriction on (R_{χ}), we can assume that no variable in \overline{y} appears in G. Now each Π_{i} (where 1 ≤ i ≤ m) is a derivation of Γ ⊢_{G_{i}}^{T} x′:A where G_{i} = G ∪ \{R_{i1}[\overline{z}/\overline{x}], …, R_{in_{i}}[\overline{z}/\overline{x}]\}. Let [[·]] be any G-interpretation such that, for all y′: B ∈ Γ, [[y′]] ⊩ B. We must show that [[x′]] ⊩ A. Now R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}] are all in G. So their interpretations under [[·]] all hold in M in the obvious sense. Then, by the property expressed by χ (recall the form of a basic geometric sequent in L_{f}, page 72) there exists a vector of worlds \overline{w} interpreting variables in \overline{y} such that one of the disjuncts R_{i1}[\overline{z}/\overline{x}]∧…∧R_{in_{i}}[\overline{z}/\overline{x}] holds in M under the induced interpretation. But if the i-th disjunct is the one that holds, we have an induced G_{i}-interpretation by assigning \overline{w} to \overline{y}. So, by the induction hypothesis given by Π_{i}, we have that [[x′]] ⊩ A as required.

⊠

The soundness result raises the question of completeness. However, a direct converse of Theorem 4.5.1 is probably not the most pertinent form of completeness, and, even if possible, would necessarily involve classically invalid meta-theoretic reasoning (see the discussion on page 59 in Section 3.4).

4.6 Discussion

In this chapter we have presented a family of proof systems for intuitionistic modal logics. The four interesting features of the proof systems are: first, they are natural deduction systems; second, the use of relative truth; third, they are intuitionistic; and, fourth, the uniform way of incorporating conditions on the visibility relation. As far as we know, there is no other work in which all four ingredients occur together. There is, however, a large body of related proof-theoretical work on modal logic (both classical and intuitionistic).

The work most directly related to ours is that on natural deduction systems for modal logic using relative truth. The approach was initiated by Fitch, see [26] (1952) and [27] (1966), who gave proof systems for several classical modal logics. His systems were generalized by Siemens to cover a still wider range of classical modal logics [71] (1977). A discussion of these systems is given by Fitting in his book [29, Ch. 4, §12–16] (1983). The approach seems to have been independently rediscovered by Gonzalez [39] (1985) and Tapscott [77] (1987). Similar ideas are used in a non-modal context in the ‘multilanguage systems’ of Giunchiglia and Serafini [38] (1994).

The application of the approach to intuitionistic modal logics has been a recent occurrence. Indeed, we developed our systems N_{□♢}(T ) without knowledge of any other work in this direction. However, since then two new papers have emerged: Benevides and Maibaum [4] (1992) and Masini [55] (1993).

Benevides and Maibaum give systems for a number of intuitionistic modal logics, but they do not consider the ♢ modality. Also, somewhat inexplicably, they include certain derivable rules as primitive [4, §3.2.2, p. 42], and thus break away from a pure introduction-elimination presentation. They do not go on to analyse the intuitionistic modal logics induced by their systems (their basic logic is the uncontroversial ♢-free fragment of IK discussed on page 47). Nor do they consider proof normalization (which we shall for N_{□♢}(T ) in Chapter 7). Indeed, without any analysis of proof normalization, their claim to have given a constructive explanation of □ in terms of its introduction rule lacks technical support (see the discussion on page 20).

Masini gives a system for an intuitionistic analogue of KD. He considers both □ and ♢ as primitive, giving rules that appear very similar to ours. However, he has strong (and unmotivated) restrictions on the rules which prevent the derivations of ♢(A ∨ B) ⊃ (♢A ∨ ♢B) and (♢A ⊃ □B) ⊃ □(A ⊃ B) from going through. (In Appendix B we give a possible technical explanation for Masini’s restrictions.) Therefore, Masini’s system induces a rather different intuitionistic modal logic from IKD. He provides no further analysis of this logic.

One way in which all the aforementioned work differs from ours is that, rather than using prefix variables and relational assumptions, the systems use different ad hoc notations for prefixes together with a convention determining the visibility relation between the different prefix notations. In Appendix B we show how N_{□♢} could be reformulated using such prefix notations. However, the use of variables and relational assumptions provides, we believe, a notable rationalization. Pragmatically, the system using relational assumptions is less complex than that using other notations (cf. Appendix B). Philosophically, it seems to us that the inference rules of N_{□♢} spell out more clearly the meanings of the modalities than the corresponding inference rules in the other styles. But most importantly, the use of variables and relational assumptions is fundamental to our definition of a family of systems, N_{□♢}(T ), parameterized on an arbitrary geometric theory, T .

The first use of relational assumptions that we are aware of was in Nerode’s tableau systems for classical modal logics [59]. However, Nerode only considered tableau systems for a few standard classical modal logics. Whereas, in our use of geometric theories, we exploit the potential generality of relational assumptions to the full. Our use of relational assumptions in this way is similar to the use of Horn clause ‘restriction theories’ made by Gent in his tableau systems for first-order logic with relativized quantifiers [35].

The use of prefixed formulae and relational assumptions means that our systems N_{□♢}(T ) are ‘labelled deductive systems’ in the sense of Gabbay [34]. Labelled deductive systems are proposed by Gabbay as providing a unifying framework for giving proof systems to many different logics. The work in this thesis shows that intuitionistic modal logic fits naturally into this general framework. Thus we provide a new example supporting Gabbay’s claim of the wide applicability of labelled deductive systems.

The obvious similarity between the modal rules in N_{□♢} and the quantifier rules in N_{IL} raises the question of what we gain by considering our special proof rules for the modalities, rather than just considering N_{IL} as a proof system for modal logic via the translation from modal formulae to first-order formulae. One philosophical gain is that the modal proof rules give direct interpretations of the meaning of the modalities which does not depend on a pre-existing understanding of first-order quantification. A possible gain in terms of theorem proving is that one would expect the search for a derivation of a modal consequence in N_{□♢} to be more constrained than the search for a derivation of the corresponding consequence in N_{IL}. Although we have not analysed the problem of proof search, proof systems based on relative truth have been important in the theorem proving literature for classical modal logics (see, e.g., Wallen [81]). But the most striking use of our specialized modal systems will be given by our later proof that, for certain T , the consequence relation of N_{□♢}(T ) is decidable (Section 7.3).

There are other forms of natural deduction for modal logic not based on relative truth, see Prawitz [65, Ch. VI], Bierman and de Paiva [7] and Segerberg [12, §9] for different approaches. However, all these approaches work only for a limited number of modal logics, as the systems rely on different ad hoc rules for each particular logic. Thus one advantage of our approach is again that we have a uniform family of systems applicable to a whole range of different modal logics. However, another reason for considering the systems based on relative truth is that, for the intuitionistic modal logics we consider, we do not know any other way of formulating a complete system with good proof-theoretical properties such as normalization and the subformula property. (Here all the problems are caused by the ♢ connective. Complete, well-behaved systems for the ♢-free fragments are easily obtained.)

A further advantage of our systems is that they can be given straightforward representations in the Edinburgh Logical Framework (LF) [41]. The various sideconditions on the modal rules (and on (R_{χ})) are all handled easily by the binding mechanisms of LF. Thus our inference rules are ‘pure’ in the sense of Avron [2]. For the difficulties that arise in representing other forms of proof system for modal logic in LF see Avron et al [3].

Meta-logical completeness

In this short chapter we prove the meta-theoretical soundness and completeness (see Section 3.4) of the natural deduction system N_{□♢}(T ). Recall the translation, (·)^{x}, on page 59 from modal formulae to L_{m}-formulae. We prove that the statements below are equivalent:

1. A is a theorem of N_{□♢}(T ).

2. T ⊢_{IL} ∀x. A^{x}.

As well as being of intrinsic interest for the justification it gives to N_{□♢}(T ), the equivalence also allows results about IL (and geometric theories in IL) to be transferred to N_{□♢}(T ). For example, if T satisfies the disjunction property in IL then N_{□♢}(T ) satisfies the disjunction property too. By the sufficient condition given on page 30 it is clear that, for any T built out of the basic geometric sequents in Figure 4–3 on page 73, the system N_{□♢}(T ) does satisfy the disjunction property.

In Section 5.1 we give a generalized statement of the equivalence of 1 and 2, and prove the easy soundness direction (1 ⟹ 2). In Section 5.2 we give a semantics for intuitionistic modal logic, based on IL-models, and we reduce meta-theoretical completeness to the completeness of N_{□♢}(T ) relative to the semantics. Then, in Section 5.3, we prove the required completeness theorem.

5.1 Meta-logical soundness

The main theorem of this chapter is the following generalized statement of metatheoretic soundness and completeness for N_{□♢}(T ).

Theorem 5.1.1 The following are equivalent:

1. Γ ⊢_{G}^{T} x:A.

2. T , {yRz | yRz ∈ G}, {B^{y} | y:B ∈ Γ} ⊢_{IL} A^{x}.

The result stated in the introduction to the chapter is clearly a special case.

The soundness direction (1 ⟹ 2) of Theorem 5.1.1 is proved by a straightforward translation from derivations in N_{□♢}(T ) to derivations in N_{IL}(T ). The translation maps a derivation, Π, of Γ ⊢_{G}^{T} x:A to a derivation, Π^{∗}, of:

{yRz | yRz ∈ G}, {B^{y} | y:B ∈ Γ} ⊢_{IL}^{T} A^{x}.

Soundness then follows from Proposition 2.3.1 on page 25.

The translation, (·)^{∗}, of derivations is defined inductively on the structure of Π. For the non-modal rules the translation is evident: each rule is mapped to the same rule in N_{IL}(T ) (see Sections 2.1 and 2.3). The clauses for the modal rules and are given in Figure 5–1.

The soundness direction of Theorem 5.1.1 is an immediate consequence of:

Proposition 5.1.2 If Π is a derivation of Γ ⊢_{G}^{T} x:A then Π^{∗} is indeed a derivation of {yRz | yRz ∈ G}, {B^{y} | y:B ∈ Γ} ⊢_{IL}^{T} A^{x}.

Proof. The proof is by a straightforward induction on the structure of Π. The cases in which one of the modal rules is applied use the trivial fact that A^{x}[y/x] is the same as A^{y}. We remark that the side-conditions on (□I) and (♢E) are exactly right to enable the side conditions on (∀I) and (∃E) to be satisfied in Π^{∗}. We omit further details. ⊠

( {[xRy] \atop Π} ; y:A ; x:□A )^{∗}  =  {[xRy] \atop Π^{∗}} ; A^{y} ; xRy ⊃ A^{y} ; ∀x′. xRx′ ⊃ A^{x′}

( \begin{matrix}{Π \atop x:□A} & xRy \\ y:A \end{matrix} )^{∗}  =  \begin{matrix}{Π^{∗} \atop ∀x′. xRx′ ⊃ A^{x′}} ; xRy ⊃ A^{y} & xRy \\ A^{y} \end{matrix}

( \begin{matrix}{Π \atop y:A} & xRy \\ x:♢A \end{matrix} )^{∗}  =  \begin{matrix}xRy & {Π^{∗} \atop A^{y}} \\ xRy ∧ A^{y} \end{matrix} ; ∃x′. xRx′ ∧ A^{x′}

( \begin{matrix}{Π_{1} \atop x:♢A} & \begin{matrix}[y:A] & [xRy] \\ Π_{2} \end{matrix} ; z:B \\ & z:B \end{matrix} )^{∗} = \begin{matrix}{Π_{1}^{∗} \atop ∃x′. xRx′ ∧ A^{x′}} & \begin{matrix}{[xRy ∧ A^{y}] \atop xRy} & {[xRy ∧ A^{y}] \atop A^{y}} \\ Π_{2}^{∗} \end{matrix} ; B^{z} \\ B^{z} \end{matrix}

Figure 5–1: Translation of derivations.

5.2 A semantics for intuitionistic modal logics

The remainder of the chapter will be devoted to the proof of the completeness (or faithfulness) direction of Theorem 5.1.1. This will be proved semantically using IL-models. In Section 2.2 we showed how to interpret a first-order language in such models. However, here we shall be using them as models of intuitionistic modal logic. It is therefore convenient to have a direct interpretation of modal formulae in IL-models.

Let K be any IL-model, (W, ≤, {D_{w}}_{w∈W} , {R_{w}}_{w∈W} , {α_{w}}_{w∈W}), of L_{m} (see Section 2.2). We define a satisfaction relation, w, d ⊩_{K} A, between worlds w ∈ W, elements d ∈ D_{w} and modal formulae A. This is defined inductively on the structure of A by:

w, d ⊩ α  iff α_{w}(d)

w, d ⊮ ⊥

w, d ⊩ A ∧ B iff w, d ⊩ A and w, d ⊩ B
w, d ⊩ A ∨ B iff w, d ⊩ A or w, d ⊩ B
w, d ⊩ A ⊃ B iff for all w′ ≥ w, w′, d ⊩ A implies w′, d ⊩ B
w, d ⊩ □A  iff for all w′ ≥ w, for all d′ ∈ D_{w′}, R_{w′}(d, d′) implies w′, d′ ⊩ A
w, d ⊩ ♢A  iff there exists d′ ∈ D_{w} such that R_{w}(d, d′) and w, d′ ⊩ A

This interpretation of modal formulae in IL-models follows Ewald’s interpretation of his intuitionistic tense logics in IL-models (which he called ‘intuitionistic tense structures’) [19,20]. For Ewald, the interpretation in intuitionistic tense structures provided a large part of the philosophical justification for his axiomatizations of intuitionistic tense logics.

We say that K is an IT -model if, for all w ∈ W, the graph (D_{w}, R_{w}) is a classical model of T . This definition is motivated by Theorem 2.3.4 on page 30.

Let G be a graph. For any world w, a G-w-interpretation is a graph morphism from G to (D_{w}, R_{w}).

Theorem 5.2.1 The following are equivalent.

1. Γ ⊢_{G}^{T} x:A.

2. T , {yRz | yRz ∈ G}, {B^{y} | y:B ∈ Γ} ⊢_{IL} A^{x}.

3. For all IT -models K, for all worlds w in K, for all G-w-interpretations ρ, if, for all z:B ∈ Γ, w, ρ(z) ⊩_{K} B then w, ρ(x) ⊩_{K} A.

This theorem combines two different forms of completeness for N_{□♢}(T ). The equivalence of statements 1 and 2 is just the meta-theoretic completeness of Theorem 5.1.1; whereas, the equivalence of statements 1 and 3 is a semantic completeness theorem relative to IT -models.

We have already proved that statement 1 implies statement 2. In the remainder of this section we show that statement 2 implies statement 3. Then in Section 5.3 we show that statement 3 implies statement 1, thereby completing the proof of Theorem 5.1.1 too.

To prove that statement 2 implies statement 3, we show (as Proposition 5.2.4 below) that the direct interpretation of modal consequence in IT -models is equivalent to the indirect interpretation induced by the translation of modal consequence into L_{m}. The required implication will then follow from the soundness of intuitionistic first-order logic in IL-models.

Let K be an arbitrary IL-model of L_{m} (it need not be an IT -model). Let w be any world in K. Let ρ be an arbitrary w-environment. We write ρ⌈_{G} for the restriction of ρ to the variables in the underlying set of G.

Lemma 5.2.2 w ⊩_{K}^{ρ} {yRz | yRz ∈ G} if and only if ρ⌈_{G} is a G-w-interpretation.

Proof. Immediate from the definitions. ⊠

Lemma 5.2.3 w ⊩_{K}^{ρ} A^{x} if and only if w, ρ(x) ⊩_{K} A.

Proof. By an easy induction on the structure of A. For example, if it is of the form □B then (□B)^{x} is ∀x′. R(x, x′) ⊃ B^{x′}. So w ⊩^{ρ} (□B)^{x} if and only if, for all w′ ≥ w, for all d′ ∈ D_{w′}, R_{w′}(ρ(x), d′) implies that w′ ⊩^{ρ[x′:=d′]} B^{x′}. But, by the induction hypothesis, w′ ⊩^{ρ[x′:=d′]} B^{x′} if and only if w′, d′ ⊩ B. So it is clear that indeed w ⊩^{ρ} (□B)^{x} if and only if w, ρ(x) ⊩ □B. ⊠

Proposition 5.2.4 Suppose all prefixes in Γ∪{x:A} are in G. Then the following are equivalent.

1. For all IT -models K, for all worlds w in K, for all G-w-interpretations ρ, if, for all z:B ∈ Γ, w, ρ(z) ⊩_{K} B then w, ρ(x) ⊩_{K} A.

2. For all IL-models K such that K ⊧_{IL} T , for all worlds w in K, for all wenvironments ρ, if w ⊩_{K}^{ρ} {yRz | yRz ∈ G}, {B^{y} | y:B ∈ Γ} then w ⊩_{K}^{ρ} A^{x}.

Proof. Immediate from the lemmas above and Theorem 2.3.4. ⊠ That statement 2 of Theorem 5.2.1 implies statement 3 now follows immediately from the soundness of IL in IL-models (Theorem 2.2.2 (1 ⟹ 2) on page 22). and the bottom-to-top implication of the above proposition.

Incidentally, it follows from the completeness direction of Theorem 2.2.2 that statement 3 of Theorem 5.2.1 implies statement 2. But this observation does not help us fill in the missing gap that statement 3 implies statement 1.

5.3 Completeness

We prove the completeness part (3 ⟹ 1) of Theorem 5.2.1 using a Henkin-style argument to construct a (canonical) countermodel to underivable sequents.

Let V be the countably infinite set of prefix variables. For any V′ ⊆ V, define W (V′) to be the free algebra generated from V′ by the following operators:

1. for each modal formula A, a unary operator x ↦ v_{x:♢A};

2. for each basic geometric sequent χ ∈ T (in the form on page 72) and each y ∈ \overline{y}, a k-ary operator x_{1}, …, x_{k} ↦ v_{χ_{(x_{1},...,x_{k})}}^{y}, where k is the length of \overline{x}.

Thus W (V′) satisfies the following: V′ ⊆ W (V′); for each element x ∈ W (V′) and modal formulae A, there is an element v_{x:♢A} ∈ W (V′); and, for each basic geometric sequent χ ∈ T (in the form on page 72) and each vector of elements \overline{z} in W (V′) of the same length as \overline{x}, there is a vector of distinct elements, \overline{v_{χ\overline{z}}}, of the same length as \overline{y}, in W (V′). Note also that V′ ⊆ V′′ implies W (V′) ⊆ W (V′′).

The elements in W (V)\V, which we shall refer to as witness variables, will play a role similar to that of Henkin-constants in standard proofs of completeness. We shall construct an IT -model in which each domain D_{w} will be a subset of W (V′) for some V′ (depending on w). An element of the form v_{x:♢A} ∈ D_{w} will witness that w, x ⊩ ♢A in the sense that both R_{w}(x, v_{x:♢A}) and w, v_{x:♢A} ⊩ A will hold. Similarly, the elements of the vector \overline{v_{χ\overline{z}}} will provide existential witnesses to show that (D_{w}, R_{w}) is a classical model of T (see below). The reason for restricting to a subset V′ ⊆ V is that, as we move from w to some w′ ≥ w, it will sometimes be necessary to introduce new elements in D_{w′} not contained in D_{w} (see the □B case in the proof of the canonical model lemma below). In order to always guarantee a supply of such new elements for D_{w′} we shall work below with V′ that are coinfinite subsets of V (i.e. subsets such that V \V′ is infinite).

Henceforth in this section we consider graphs whose underlying sets are subsets of W (V) and formulae prefixed with elements of W (V). We now introduce the structures out of which the canonical model will be built. A context is a pair (G, Γ) where: G is a graph containing every prefix in the set of prefixed formulae Γ, and the three conditions below are satisfied.

1. For some coinfinite subset V′ ⊆ V, the underlying set of G is contained in W (V′).

2. The witness variable v_{x:♢A} is in G only if xRv_{x:♢A} in G and v_{x:♢A}:A ∈ Γ.

3. For each basic geometric sequent χ ∈ T (in the form on page 72), each of the witness variables in \overline{v_{χ\overline{z}}} is in G only if the others are and, for some i (1 ≤ i ≤ m), the relations R_{i1}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}], …, R_{in_{i}}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}] all hold in G.

We write (G, Γ) ⊆ (H, Δ) to mean that G ⊆ H and Γ ⊆ Δ.

A context, (G, Γ), is said to be T -prime if G is a classical model of T and the following additional conditions are satisfied:

1. If Γ ⊢_{G}^{T} x:A then x:A ∈ Γ. (Deductive closure.)

2. For all x in G, it holds that Γ ⊬_{G}^{T} x:⊥. (Consistency.)

3. If x:A ∨ B ∈ Γ then x:A ∈ Γ or x:B ∈ Γ. (Disjunction property.)

4. If x:♢A ∈ Γ then there exists y such that xRy in G and y:A ∈ Γ. (Diamond property.)

Lemma 5.3.1 (Prime lemma) If (G, Γ) is a context and Γ ⊬_{G}^{T} x: A then there is a T -prime context (H, Δ) with (H, Δ) ⊇ (G, Γ) such that Δ ⊬_{H}^{T} x:A.

Proof. Suppose that (G, Γ) is a context such that Γ ⊬_{G}^{T} x: A. Let V′ be some coinfinite subset of V such that the underlying set of G is contained in W (V′) (as given by condition 1 on being a context). Suppose further that Γ ⊬_{G}^{T} x: A. Consider the set C of all contexts (G′, Γ′) ⊇ (G, Γ) such that the underlying set of G′ is contained in W (V′) and Γ′ ⊬_{G′}^{T} x:A. Let {(G_{i}, Γ_{i})}_{i∈I} be any chain in the set C partially ordered by inclusion. It is easily seen that (⋃_{i∈I} G_{i}, ⋃_{i∈I} Γ_{i}) is also in C. So every chain in C has an upper bound. Therefore, by Zorn’s Lemma, C has a maximal element (H, Δ). We show that (H, Δ) is T -prime and hence fulfils the requirements of the lemma.

First, we show that H is a classical model of T . Consider any basic geometric sequent χ ∈ T (in the form on page 72). We show that H ⊧_{CL} χ. Suppose that the relations R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}] hold in H. We must show that there is a vector \overline{v} of variables in H of the same length as \overline{y} such that, for some i (1 ≤ i ≤ m), the relations R_{i1}[\overline{z}/\overline{x}][\overline{v}/\overline{y}], …, R_{in_{i}}[\overline{z}/\overline{x}][\overline{v}/\overline{y}] all hold in H. We show that, in fact, \overline{v_{χ\overline{z}}} is the required vector.

Suppose, for contradiction, that the variables in \overline{v_{χ\overline{z}}} are not in H. Define:

H_{i} = H ∪ \{v | v ∈ \overline{v_{χ\overline{z}}}\} ∪ \{R_{i1}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}], …, R_{in_{i}}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}]\}.

Then it cannot be the case that Δ ⊢_{H_{1}}^{T} x: A and … and Δ ⊢_{H_{m}}^{T} x: A, because if it were then Δ ⊢_{H}^{T} x: A would be derivable by an application of (R_{χ}). Therefore, for some i, we have that Δ ⊬_{H_{i}}^{T} x: A. But then (H_{i}, Δ) is in C. Whence, by the maximality of (H, Δ), we have that H_{i} = H contradicting our assumption. So, as the variables in \overline{v_{χ\overline{z}}} are in H, it follows, from requirement 3 on contexts, that, for some i, the relations R_{i1}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}], …, R_{in_{i}}[\overline{z}/\overline{x}][\overline{v_{χ\overline{z}}}/\overline{y}] all hold in H. But this is what we had to show.

It remains to verify the four conditions. Consistency is immediate, because Δ ⊬_{H}^{T} x:A. For deductive closure, suppose that Δ ⊢_{H}^{T} y:B. Then Δ, y:B ⊬_{H} x:A (for otherwise would contradict that Δ ⊬_{H} x: A). Therefore (H, Δ ∪ {y: B}) is in C. So y : B ∈ Δ by the maximality of (H, Δ). For the disjunction property, suppose that y: B ∨ C ∈ Δ. Now either Δ, y: B ⊬_{H}^{T} x: A or Δ, y: C ⊬_{H}^{T} x: A, for otherwise we would have that Δ ⊢_{H}^{T} x: A by an application of (∨E). Therefore one of (H, Δ ∪ {y : B}) and (H, Δ ∪ {y : C}) is in C. So, by maximality, either y:B ∈ Δ or y:C ∈ Δ as required. Lastly, for the diamond property, suppose that y:♢B ∈ Δ. We show that v_{y:♢B} is in H. Suppose not. Then Δ, v_{y:♢B}:B ⊬_{H′}^{T} x:A where H′ = H ∪ {yRv_{y:♢B}}, because otherwise we could derive Δ ⊢_{H}^{T} x : A by an application of (♢E). But then, by maximality, H′ = H contradicting our assumption. So indeed v_{y:♢B} is in H. Whence, by requirement 2 on contexts, yRv_{y:♢B} in H and v_{y:♢B} : B ∈ Δ. Thus v_{y:♢B} is the variable required by the diamond property. ⊠ It is worth remarking that, as the set of formulae and the set W (V) are both denumerable, the prime lemma can actually be proved without using any form of the axiom of choice. However, in a choice-free proof, (H, Δ) would have to be obtained by a laborious iterative construction.

We now construct the canonical IT -model,

K^{T} = (W^{T} , ≤^{T} , {D_{w}^{T}}_{w∈W^{T}} , {R_{w}^{T}}_{w∈W^{T}} , {α_{w}^{T}}_{w∈W^{T}}).

Define:

W^{T} = the set of T -prime contexts,
(H, Δ) ≤^{T} (H′, Δ′) iff (H, Δ) ⊆ (H′, Δ′),

D_{(H,Δ)}^{T} = the underlying set of H,
R_{(H,Δ)}^{T}(x, y) iff xRy in H,
α_{(H,Δ)}^{T}(x) iff x:α ∈ Δ.

It is clear that all the conditions on being a model are satisfied by K^{T}. In particular, for all (H, Δ) ∈ W^{T}, (D_{(H,Δ)}^{T}, R_{(H,Δ)}^{T}) ⊧_{CL} T because (D_{(H,Δ)}^{T}, R_{(H,Δ)}^{T}) = H and H ⊧_{CL} T as (H, Δ) is T -prime.

Lemma 5.3.2 (Canonical model lemma) For all T -prime contexts (H, Δ), for all y in H, the relation (H, Δ), y ⊩_{K^{T}} B holds if and only if y:B ∈ Δ.

Proof. We show, by a case analysis on the structure of B, that the inductive clauses defining the satisfaction relation (H, Δ), y ⊩ B are mimicked by the membership relation y:B ∈ Δ. We consider a selection of cases.

B ∨ C. We show that y:B ∨ C ∈ Δ if and only if y:B ∈ Δ or y:C ∈ Δ.

⟹ Immediate by the disjunction property of (H, Δ).

⟸ Suppose that either y:B ∈ Δ or y:C ∈ Δ. Then clearly Δ ⊢_{H}^{T} y:B ∨C. So, by deductive closure, y:B ∨ C ∈ Δ.

B ⊃ C. We show that y: B ⊃ C ∈ Δ if and only if, for all (H′, Δ′) ≥^{T} (H, Δ), y:B ∈ Δ′ implies y:C ∈ Δ′.

⟹ Suppose y : B ⊃ C ∈ Δ, (H′, Δ′) ≥^{T} (H, Δ) and y : B ∈ Δ′. Now Δ′ ⊇ Δ so clearly Δ′ ⊢_{H′}^{T} y:C whence, by deductive closure, y:C ∈ Δ′. ⟸ Suppose, for all (H′, Δ′) ≥^{T} (H, Δ), y : B ∈ Δ′ implies y : C ∈ Δ′. Suppose, for contradiction, that Δ, y: B ⊬_{H}^{T} y: C. Then, by the prime lemma, there is a T -prime context (H′, Δ′) ⊇ (H, Δ ∪ {y : B}) such that Δ′ ⊬_{H′}^{T} y : C. But then (H′, Δ′) ≥^{T} (H, Δ) is a world such that y:B ∈ Δ′ and y:C ∉ Δ′, contradicting the initial supposition. So Δ, y : B ⊢_{H}^{T} y : C and thus, by (⊃I), Δ ⊢_{H}^{T} y : B ⊃ C whence, by deductive closure, y:B ⊃ C ∈ Δ.

□B. We show that y:□B ∈ Δ if and only if, for all (H′, Δ′) ≥^{T} (H, Δ) and all z, yRz in H′ implies z:B ∈ Δ′.

⟹ Suppose y:□B ∈ Δ, (H′, Δ′) ≥^{T} (H, Δ) and yRz in H′. Now Δ′ ⊇ Δ so Δ′ ⊢_{H′}^{T} y: □B and hence, by (□E), Δ′ ⊢_{H′}^{T} z: B. So, by deductive closure, z:B ∈ Δ′.

⟸ Suppose that, for all (H′, Δ′) ≥^{T} (H, Δ), we have that yRz in H′ implies z:B ∈ Δ′. Let V′ be a coinfinite subset of V such that the underlying set of H is contained in W (V′) (as given by requirement 1 on contexts). Take any z ∈ V \V′. Define H_{0} = H ∪ {yRz}. Clearly (H_{0}, Δ) is a context. Suppose, for contradiction, that Δ ⊬_{H_{0}} z : B. Then, by the prime lemma, there exists a T -prime context (H′, Δ′) ⊇ (H_{0}, Δ) such that Δ′ ⊬_{H′}^{T} z: B. But then (H′, Δ′) ≥^{T} (H, Δ) and yRz in H′, but clearly z:B ∉ Δ′, contradicting the initial assumption. So Δ ⊢_{H_{0}}^{T} z:B. But, as z ∈ V \V′, we have that z is not in H. Therefore, by an application of (□I), it holds that Δ ⊢_{H}^{T} y : □B. Whence, by deductive closure, y:□B ∈ Δ as required.

♢B. We show that y: ♢B ∈ Δ if and only if there exists z such that yRz in H and z:B ∈ Δ.

⟹ Immediate from the diamond property of (H, Δ). ⟸ Suppose, for some z, yRz in H and z: B ∈ Δ. Then Δ ⊢_{H}^{T} y: ♢B, by

the (♢I) rule. So, by deductive closure, y:♢B ∈ Δ. ⊠

It is now a simple matter to prove Theorem 5.2.1, 3 ⟹ 1. We show the contrapositive. Suppose then that Γ ⊬_{G}^{T} x: A. By the prime lemma, there is a T -prime context (H, Δ) ⊇ (G, Γ) such that Δ ⊬_{H}^{T} x:A. Now (H, Δ) is a world in K^{T}. Define a G-(H, Δ)-interpretation by ρ(y) = y. Then, by the canonical model lemma, for all y : B ∈ Γ, we have (H, Δ), ρ(y) ⊩_{K^{T}} B, but (H, Δ), ρ(x) ⊮_{K^{T}} A. This complete the proof Theorem 5.2.1. Thus we have also finished the proof of Theorem 5.1.1.

5.4 Discussion

As discussed in Section 3.4, Theorem 5.1.1 is a fundamental result showing the equivalence of two different ways of defining the intuitionistic modal logic determined by T . Unfortunately, our semantic proof of the completeness direction uses much intuitionistically invalid reasoning. However, Theorem 5.1.1 is a purely proof-theoretic statement, and it can be proved by intuitionistically acceptable proof-theoretic techniques.

We now sketch how such a proof of meta-theoretical completeness would go. The idea is to use a normalization result for N_{IL}(T ) similar to that discussed in Section 2.3. Ideally one would like to show that any normal derivation of {yRz|yRz ∈ G}, {B^{y}|y:B ∈ Γ} ⊢_{IL}^{T} A^{x} is of the form Π^{∗} for some derivation Π of Γ ⊢_{G}^{T} x: A (where (·)^{∗} is the translation of derivations from N_{□♢}(T ) to N_{IL}(T )). However, the definition of normal derivation in Section 2.3 is not strong enough for this result to obtain. Nevertheless, a proof along these lines is possible. We have carried out the proof for N_{□♢} using a stronger definition of normal form requiring further rewrite rules for normalization (specifically certain expansion rules, see Prawitz [66, §II 3.3.3], and some additional commuting conversions pushing introductions through indirect rules). We also found it necessary to modify the (·)^{∗} translation of Section 5.1. The resulting proof was rather messy.

So one reason for preferring the classical semantic proof is its relative cleanness. But we also gave this proof in order to establish the semantics for N_{□♢}(T ). As we said, the interpretation of modal formulae in IL-models is due to Ewald [19, 20]. He proved completeness for his Hilbert-style axiomatizations of intuitionistic tense logics. Because of the close relationship between modal completeness relative to IL-models and meta-logical completeness, it would have been a small step for Ewald to have deduced the meta-logical completeness of his tense logics. However, he did not formulate the result.

Although it uses standard techniques, our proof of completeness relative to IL-models is more straightforward than Ewald’s. The simplification is due to our use of a consequence relation between prefixed formulae and graphs, which yields a very natural model construction. We also work in the more general situation of a modal logic parameterized on an arbitrary geometric theory T .

A philosophical difference with Ewald is that for him the interpretation in ILmodels was a primary motivation for his intuitionistic modal logics, whereas for us it is just a meta-theoretic tool. Indeed, as discussed on page 63, the interpretation in IL-models cannot serve as the basis for an intuitionistic account of intuitionistic modal logic.

There are, nonetheless, some interesting technical possibilities that arise from taking the interpretation in IL-models as fundamental. For example, IL-models provide one way of addressing some of the issues raised in Section 3.4. Let F be an arbitrary class of frames. Then, just as F determines a unique classical modal logic (see Section 3.1); by way of IL-models, it also determines an intuitionistic analogue, namely the modal formulae valid in in all IL-models satisfying, for all w ∈ W, (D_{w}, R_{w}) ∈ F. This method associates a unique intuitionistic modal logic with F no matter how F is specified (so the problems of determining the correct intuitionistic formulation of a classical property are avoided). It also enables intuitionistic analogues of classical modal logics generated by non first-order definable classes F to be defined. We do not know how ‘reasonable’ the induced intuitionistic modal logics are in general. However, by the results in this chapter, when F is specified by a geometric theory T , the induced intuitionistic modal logic is just that of N_{□♢}(T ).

Axiomatizations

In this chapter we consider the problem of obtaining Hilbert-style axiomatizations of the modal logics induced by the natural deduction systems. In Section 6.1 we prove that the logic IK, introduced in Section 3.3, axiomatizes exactly the theorems of the basic natural deduction system, N_{□♢}. Having established this correspondence, it is natural to look for sets of additional axioms, Ax(T ), such that IK + Ax(T ) axiomatizes the theorems of N_{□♢}(T ). In Section 6.2 we give such axiomatizations for a fairly wide class of theories T . However, the general problem is more difficult. In Section 6.3 we show that a natural generalization of the methods of Section 6.2 does not always give complete axiomatizations. In particular the natural axiomatization of the intuitionistic modal logic of directed frames is incomplete.

6.1 Correspondence with IK

In this section we show that the intuitionistic modal logic IK, presented in Figure 3–6 on page 52, does indeed axiomatize the theorems of N_{□♢}.

Theorem 6.1.1 The following are equivalent:

1. A is a theorem of IK.

2. A is a theorem of N_{□♢}.

The easy direction of the theorem is that 1 implies 2. We need only show that N_{□♢} derives all the axioms of IK and is closed under its inference rules. As intuitionistic propositional natural deduction is a subsystem, it is clear that all substitution instances of theorems of IPL are derivable. Derivations of the remaining five modal axiom schemas have already been given in Figure 4–2 on page 71. It remains to show that the natural deduction system is closed under modus ponens and necessitation. Modus ponens is just an application of (⊃E). For necessitation, suppose there is a derivation Π showing that ⊢ A. Then:

{Π[y/x] \atop y:A} ; x:□A

is a derivation of ⊢ □A. So the system can indeed derive all the theorems of IK.

The converse direction could be proved semantically. One could prove the soundness, in a suitable sense, of N_{□♢} relative to the birelation models introduced in Section 3.3. (We shall do this in Chapter 8. It is not completely trivial.) The desired implication would then follow from the known completeness of IK with respect to birelation models [20,24,64]. Alternatively, as mentioned on page 60, Stirling has given an unpublished semantic proof of the meta-logical completeness of IK (also relying on the completeness of IK relative to birelation models). So the desired implication follows from the meta-logical soundness of N_{□♢}, which we established in Chapter 5. However, instead we shall give a self-contained, prooftheoretic proof. Our proof has the benefit of extending easily to establish the completeness of axiomatizations of theoremhood in N_{□♢}(T ) for certain nonempty T (see Section 6.2). It is also intuitionistically acceptable.

The proof works by establishing the interesting fact that, for suitable graphs G, entire prefixed consequences of the form Γ ⊢_{G} x:A are equivalently represented by single modal formulae.

The suitable graphs are finite trees, i.e., finite graphs with a node x_{0} (the root) such that, for every node x, there is a unique sequence of points, x_{1}, …, x_{m} (where m ≥ 0) with x = x_{m} and x_{0}Rx_{1}R … Rx_{m}. We say that m is the depth of x. Let G be a finite tree. Let Γ ∪ {x: A} be a finite set of prefixed formulae all

[figure: T_{1}^{0}; T^{0}; x_{0}; T_{n_{0}}^{0}; . . . . . . . .; T_{1}^{m−1}; ..............; T^{m−1}; x_{m−1}; T_{n_{m−1}}^{m−1}; . . . . . . . .; T_{1}^{m}; T^{m}; x_{m}; T_{n_{m}}^{m}; . . . . . . . . .]

Figure 6–1: General form of G.

of whose prefixes are in G. We shall define a modal formula, (Γ ⊢_{G} x: A)^{∗}, such that: Γ ⊢_{G} x: A if and only if (Γ ⊢_{G} x: A)^{∗} is a theorem of IK (although we shall only need to use the left-to-right implication); and such that (⊢_{τ} x: A)^{∗} ↔ A is a (trivial) theorem of IK. Therefore if A is a theorem of the natural deduction system then it is indeed a theorem of IK.

Without loss of generality, G has the form displayed in Figure 6–1 where m ≥ 0 is the depth of x_{m} and each T^{i} (0 ≤ i ≤ m) is the finite tree with root x_{i} and n_{i} immediate subtrees T_{1}^{i}, …, T_{n_{i}}^{i} (n_{i} ≥ 0). Note that, for i < m, the node x_{i} actually has n_{i} + 1 immediate successors for, in addition to the n_{i} apices of T_{1}^{i}, …, T_{n_{i}}^{i}, there is also the node x_{i+1}.

First we define a formula, Γ@T^{i}, for each T^{i} (0 ≤ i ≤ m). In fact let U be any subtree of G. Let y be the root of U and let U_{1}, …, U_{k} (where k ≥ 0) be the immediate subtrees below y in U. The formula Γ@U is defined inductively on the structure of U by:

Γ@U = ⋀{B | y:B ∈ Γ} ∧ (♢ Γ@U_{1}) ∧ … ∧ (♢ Γ@U_{k})

(the base case is when k is zero). When empty, the above conjunction is taken to be ⊤. We can now define the formula we have been working towards by:

(Γ ⊢_{G} x_{m}:A)^{∗} = Γ@T^{0} ⊃ □(Γ@T^{1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ A) …))

Example. Suppose G is the tree:

x  y

[figure]

z  \overline{}w

Then:

(x:♢A ⊃ □ □ B, y:A ⊢_{G} z:♢B)^{∗} = ((♢A ⊃ □ □ B) ∧ ♢A) ⊃ □(♢⊤ ⊃ ♢B)

(the ⊤ arises from the empty conjunction of {x: ♢A ⊃ □ □ B, y : A}@w). We can see that in this example x: ♢A ⊃ □ □ B, y: A ⊢_{G} z : ♢B holds and indeed ((♢A ⊃ □ □ B) ∧ (♢A)) ⊃ □(♢⊤ ⊃ ♢B) is a theorem of IK.

It is easy to see that (⊢_{τ} x: A)^{∗} is the formula ⊤ ⊃ A, so the equivalence of (⊢_{τ} x:A)^{∗} and A is trivial. It remains only to prove the lemma below.

Lemma 6.1.2 If G is a finite tree then Γ ⊢_{G} x:A if and only if (Γ ⊢_{G} x:A)^{∗} is a theorem of IK.

Proof. The left-to-right implication is proved by induction on the structure of derivations of Γ ⊢_{G} x : A. In the induction we must take care that we can always restrict attention to graphs that are trees. We consider only the cases in which the last rule of derivation is one of the four modal rules. Of the non-modal rules, all are straightforward except for (⊥E) and (∨E) which are quite intricate because their premises and conclusion may have prefixes arbitrarily far apart in G. However, the difficulties are similar to those encountered in the (♢E) case, which we do consider below. Throughout the proof we use, without further comment, obvious preservation properties of IK such as: if A ⊃ B is a theorem then so are (C ⊃ A) ⊃ (C ⊃ B) and □A ⊃ □B and ♢A ⊃ ♢B. Notation will be kept consistent with Figure 6–1, i.e. G will always be assumed to be of this form. We hope that this makes the proof comprehensible without too much formality.

(□I) We have a derivation:

{[x_{m}Ry] \atop Π} ; y:A ; x_{m}:□A

of the consequence Γ ⊢_{G} x_{m}:A where G is the tree in Figure 6–1. Thus Π is a derivation of Γ ⊢_{G∪{x_{m}Ry}} y: A, where, because of the restriction on (□I), G ∪ {x_{m}Ry} is also a tree. Now (Γ ⊢_{G∪{x_{m}Ry}} y:A)^{∗} is:

Γ@T^{0} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ □(⊤ ⊃ A)) …).  (6.1)

By the induction hypothesis, (6.1) is a theorem of IK. But (Γ ⊢_{G} x_{m}: □A)^{∗} is:

Γ@T^{0} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ □A) …),

which is clearly equivalent to (6.1). Hence it is a theorem of IK as required.

(□E) We have a derivation:

\begin{matrix}{Π \atop x_{m−1} :□A} & x_{m−1}Rx_{m} \\ x_{m}:A \end{matrix}

of Γ ⊢_{G} x_{m}: A. Then Π is a derivation of Γ ⊢_{G} x_{m−1} : □A. Now the formula (Γ ⊢_{G} x_{m−1} :□A)^{∗} is:

Γ@T^{0} ⊃ □(… (Γ@T^{m−1} ∧ ♢Γ@T^{m}) ⊃ □A) …),  (6.2)

which, by the induction hypothesis, is a theorem of IK. But (Γ ⊢_{G} x_{m}: A)^{∗} is:

Γ@T^{0} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ A) …).  (6.3)

And this follows from (6.2) by axiom 5 of IK.

(♢I) We have a derivation:

\begin{matrix}{Π \atop x_{m}:A} & x_{m−1}Rx_{m} \\ x_{m−1} :♢A \end{matrix}

[figure: U_{1}^{0}; U^{0}; x_{i}; U_{k_{0}}^{0}; . . . . . . . .; U_{1}^{1}; U^{1}; y_{1}; U_{k_{1}}^{1}; . . . . . . . .; U_{1}^{j}; ..............; U^{j}; y_{j}; U_{k_{j}}^{j}; . . . . . . . .]

Figure 6–2: Dissection of T^{i}.

of Γ ⊢_{G} x_{m−1} :♢A. Thus Π is a derivation of Γ ⊢_{G} x_{m}:A. Now (Γ ⊢_{G} x_{m}:A)^{∗} is formula (6.3) above, and, by the induction hypothesis, it is a theorem of IK. But (Γ ⊢_{G} x_{m−1} :♢A)^{∗} is:

Γ@T^{0} ⊃ □(… (Γ@T^{m−1} ∧ ♢Γ@T^{m}) ⊃ ♢A) …).

And this follows from (6.3) by axiom 2 of IK.

(♢E) We have a derivation:

\begin{matrix}{Π_{1} \atop y_{j}:♢A} & \begin{aligned}[y:A] & [y_{j}Ry] \\ & Π_{2} \end{aligned} ; x_{m}:B \\ x_{m}:B \end{matrix}

of the consequence Γ ⊢_{G} x_{m} : B. Thus Π_{1} is a derivation of Γ ⊢_{G} y_{j} : ♢A and Π_{2} is a derivation of Γ, y : A ⊢_{G∪{y_{j}Ry}} x_{m} : B, where, because of the restriction on (♢E), G ∪ {y_{j}Ry} is a tree. Suppose that the (unique) path from x_{0} to y_{j} in G is given by x_{0}Rx_{1} … x_{i}Ry_{1} … Ry_{j} where if j > 0 and i < m then j_{1} is different from x_{i+1}, and if j = 0 then by y_{j} we mean x_{i}. We now break up T^{i} as in Figure 6–2. Then (Γ ⊢_{G} y_{j}:♢A)^{∗} is:

Γ@T^{0} ⊃ □(Γ@T_{1} ⊃ □(… Γ@T^{i−1} ⊃ □(
(Γ@U^{0} ∧ ♢(Γ@T^{i+1} ∧ ♢(… Γ@T^{m−1} ∧ ♢Γ@T^{m}))) ⊃
□(Γ@U^{1} ⊃ □(… Γ@U^{j−1} ⊃ □(Γ@U^{j} ⊃ ♢A))) ))),

(6.4)

and (Γ, y:A ⊢_{G∪{y_{j}Ry}} x_{m}:B)^{∗} is:

Γ@T^{0} ⊃ □(Γ@T_{1} ⊃ □(… Γ@T^{i−1} ⊃ □(
(Γ@U^{0} ∧ ♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢(Γ@U^{j} ∧ ♢A)))) ⊃
□(Γ@T^{i+1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ B))) ))).

(6.5)

By the induction hypothesis, both (6.4) and (6.5) are theorems of IK. Now (Γ ⊢_{G} x_{m}:B)^{∗} is:

Γ@T^{0} ⊃ □(Γ@T_{1} ⊃ □(… Γ@T^{i−1} ⊃ □(
(Γ@U^{0} ∧ ♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢Γ@U^{j}))) ⊃
□(Γ@T^{i+1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ B))) ))).

(6.6)

We must show that this is a theorem of IK.

The derivation of (6.6) is slightly involved. First, we note the following two theorems of IK:

♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢Γ@U^{j})) ⊃
□(Γ@U^{1} ⊃ □(… Γ@U^{j−1} ⊃ □(Γ@U^{j} ⊃ ♢A))) ⊃
♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢(Γ@U^{j} ∧ ♢A))),

(6.7)

(♢(Γ@T^{i+1} ∧ ♢(… Γ@T^{m−1} ∧ ♢Γ@T^{m})) ⊃
□(Γ@T^{i+1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ B)))) ⊃
□(Γ@T^{i+1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ B))).

(6.8)

Formula (6.7) is derived by repeated applications of axiom 2 of IK (together with intuitionistic propositional reasoning), and (6.8) is derived by repeated applications of axiom 5.

We now show how (6.6) is derivable from (6.4) and (6.5). By (6.7) it is clear that the following formula is derivable from (6.4):

Γ@T^{0} ⊃ □(Γ@T_{1} ⊃ □(… Γ@T^{i−1} ⊃ □(
(Γ@U^{0} ∧ ♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢Γ@U^{j}))) ⊃
♢(Γ@T^{i+1} ∧ ♢(… Γ@T^{m−1} ∧ ♢Γ@T^{m})) ⊃
(Γ@U^{0} ∧ ♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢(Γ@U^{j} ∧ ♢A)))) ))).

Whence, using (6.5), one can derive:

Γ@T^{0} ⊃ □(Γ@T_{1} ⊃ □(… Γ@T^{i−1} ⊃ □(

(Γ@U^{0} ∧ ♢(Γ@U^{1} ∧ ♢(… Γ@U^{j−1} ∧ ♢Γ@U^{j}))) ⊃

♢(Γ@T^{i+1} ∧ ♢(… Γ@T^{m−1} ∧ ♢Γ@T^{m})) ⊃

□(Γ@T^{i+1} ⊃ □(… Γ@T^{m−1} ⊃ □(Γ@T^{m} ⊃ B))) ))).

But now, by (6.8), it is clear that (6.6) is indeed derivable.

This concludes the left-to-right implication of the lemma.

The right-to-left implication is somewhat easier. As we do not use the result we give only a sketch. One proves by induction on the structure of G, which we again assume to be in the form of Figure 6–1, that, for all Γ, x:A,

x_{0} :(Γ ⊢_{G} x:A)^{∗}, Γ ⊢_{G} x:A.  (6.9)

Now, if (Γ ⊢_{G} x: A)^{∗} is a theorem of IK then, as we showed earlier, it is also a theorem of the natural deduction system. So it follows from (6.9) that Γ ⊢_{G} x:A as required. ⊠

6.2 Axiomatizations of other modal logics

We now consider the problem of axiomatizing the theorems of N_{□♢}(T ) for nonempty T . Specifically, given a basic geometric theory T , is there a reasonable set of modal axioms, Ax(T ), such that the theorems of IK + Ax(T ) are exactly the theorems of N_{□♢}(T )? Of course, if T is recursively enumerable then the set of theorems of N_{□♢}(T ) is a recursively enumerable axiomatization of itself, and, by a standard trick, one can find a complete recursive subset (cf. Shoenfield [70, Ex.

5, p. 138]). However, in particular cases, we would like to find simpler and more elegant axiomatizations.

We shall consider certain theories T for which axiomatizations can be obtained in a particularly simple way. With certain basic geometric sequents, χ, we shall associate a single modal axiom schema A_{χ}. Then, for any T containing only such sentences, we define:

Ax(T ) = {A | A is an instance of A_{χ} for some χ ∈ T }.  (6.10)

For such theories, we shall prove that Ax(T ) is a complete axiomatization of the theorems of N_{□♢}(T ).

Unfortunately, we only know how to axiomatize the modal logics induced by some particularly simple theories in this way. First, with the axiom for seriality, ∀x. ∃y xRy, we associate the single modal axiom:

A_{χ_{D}} = ♢⊤.

(One could equivalently use the schema □A ⊃ ♢A. Earlier A_{χ_{D}} was just called D. Here we change name for the sake of the uniform definition of Ax(T ) as above.) We shall also associate a modal axiom schema with the frame axiom expressing the property:

∀xyz. xR^{k}y ∧ xR^{l}z ⊃ yRz

for any k, l ≥ 0. Here we write xR^{0}y to mean x = y and xR^{i+1}y to mean that there exists x′ such that xRx′ and x′R^{i}y. Although we do not have equality in L_{f}, the property above can be expressed by the basic geometric sequent (indeed Horn clause):

ϕ_{kl} = ∀xy_{1} … y_{k}z_{1} … z_{l}. (xRy_{1} ∧ y_{1}Ry_{2} ∧ … ∧ y_{k−1}Ry_{k} ∧
xRz_{1} ∧ z_{1}Rz_{2} ∧ … ∧ z_{l−1}Rz_{l}) ⊃ y_{k}Rz_{l}

where if k = 0 then y_{k} is x and if l = 0 then z_{l} is x. The axiom schema associated with ϕ_{kl} is:

A_{ϕ_{kl}} = (♢^{k} □ A ⊃ □^{l}A) ∧ (♢^{l}A ⊃ □^{k} ♢ A)

In classical modal logic, the two sides of the conjunction, taken individually, give equivalent schemas, so only half of the conjunction is required. In intuitionistic modal logic, the two schemas are not equivalent, and it is necessary to take their conjunction. Four of the frame conditions of Figure 4–3 (page 73) fit into the above scheme. We give these together with their induced axiom schemas in Figure 6–3. Note that the induced axiom schemas are exactly those given earlier in Figure 3–7 (page 56).

Let T be any frame theory containing only axioms of the form ϕ_{kl} and χ_{D}. Define Ax(T ) as in (6.10).

Theorem 6.2.1 The following are equivalent:

1. A is a theorem of IK + Ax(T ).

2. A is a theorem of N_{□♢}(T ).

For any T ⊆ {χ_{D}, χ_{T} , χ_{B}, χ_{4}, χ_{5}}, we have that IK+Ax(T ) is just the appropriate IKS_{1}… S_{n} as defined on page 55. Thus, IKS_{1}… S_{n} is a complete axiomatization of the theorems of N_{□♢}(T ), and therefore, by the results of Chapter 5, IKS_{1}… S_{n} is meta-logically sound and complete.

To prove Theorem 6.2.1, we first establish the equivalence of N_{□♢}(T ) with a system obtained by extending N_{□♢}, in a suitable way, with the axioms in Ax(T ). Then, by modifying the proof of Theorem 6.1.1, we show that IK + Ax(T ) axiomatizes the theorems of N_{□♢} + Ax(T ).

First we define the system N_{□♢} + Ax(T ). This is obtained by extending N_{□♢} with the rule:

{A ∈ Ax(T ) \atop x:A} (Ax_{T})

(Although A ∈ Ax(T ) is not a judgement in the system, we have written the rule in the form above for notational convenience. Strictly speaking, A ∈ Ax(T ) is a side-condition on the application of the rule.) We write Ax(T ); Γ ⊢_{G} x: A to mean that there is a derivation of x: A in the system N_{□♢} + Ax(T ) in which all

Name  Formula  k l  Axiom schema
χ_{T} ∀x. xRx  0 0 (□A ⊃ A) ∧ (A ⊃ ♢A)
χ_{B} ∀xy. xRy ⊃ yRx  1 0 (♢ □ A ⊃ A) ∧ (A ⊃ □ ♢ A)
χ_{4} ∀xyz. xRy ∧ yRz ⊃ xRz 0 2 (□A ⊃ □ □ A) ∧ (♢ ♢ A ⊃ ♢A)
χ_{5} ∀xyz. xRy ∧ xRz ⊃ yRz 1 1 (♢ □ A ⊃ □A) ∧ (♢A ⊃ □ ♢ A)

Figure 6–3: Axioms for T, B, 4 and 5.

\begin{aligned}[x:♢^{k} □ A]^{0′} & \begin{aligned}[y_{1} :♢^{k−1} □ A]^{k} & \begin{matrix}[y_{k−1} :♢ □ A]^{2} & \begin{aligned}R & \begin{matrix}[y_{k}:□A]^{1} & [y_{k}Rz_{l}]^{0} \\ z_{l}:A \end{matrix} \\ & z_{l}:A \end{aligned}_{0} \\ z_{l}:A \end{matrix}_{1} ; ⋮ . ; z_{l}:A \\ & z_{l}:A \end{aligned}_{k−1} \\ & z_{l}:A \end{aligned}_{k} ; z_{l−1} :□A_{1′} ; ⋮ . ; z_{1} :□^{l−1}A ; x:□^{l}A_{l′} ; x:♢^{k} □ A ⊃ □^{l}A_{0′}

We use R to abbreviate the following sequence of discharged assumptions:

[xRy_{1}]^{k} [y_{1}Ry_{2}]^{k−1} … [y_{k−1}Ry_{k}]^{1} [xRz_{1}]^{l′} … [z_{l−1}Rz_{l}]^{1′},

which are the major premises of the application of (R_{ϕ_{kl}}).

Figure 6–4: Derivation of ♢^{k} □ A ⊃ □^{l}A using (R_{ϕ_{kl}}).

open relational assumptions hold in G and all open non-relational assumptions are contained in Γ. The equivalence of N_{□♢}T and N_{□♢} + Ax(T ) is given by:

Lemma 6.2.2 Γ ⊢_{G}^{T} x:A if and only if Ax(T ); Γ ⊢_{G} x:A.

Proof. For the left-to-right direction it is enough to derive the axioms in Ax(T) using N_{□♢}(T ). If we have ϕ_{kl} in T then a derivation of ♢^{k} □ A ⊃ □^{l}A is given in Figure 6–4. The other half, ♢^{l}A ⊃ □^{k} ♢ A, of A_{ϕ_{kl}} is derived in a similar way (see also examples 2 and 4 in Figure 4–5, page 75). The derivation of χ_{D} using (R_{D}) is very easy (cf. (4.3) on page 68).

For the converse, we show how to translate a derivation in N_{□♢}(T ) into one of the same conclusion from the same open assumptions in N_{□♢} + Ax(T ). The translation is by induction on the structure of the derivation in N_{□♢}(T ). Applications of any rule other than (R_{ϕ}) are left unchanged. Thus the only interesting case is the translation of derivations ending in an application of (R_{ϕ}). First, we show how to translate an application of (R_{ϕ_{kl}}). Suppose we have a derivation:

\begin{aligned}xRy_{1} & y_{1}Ry_{2} & … & y_{k−1}Ry_{k} & xRz_{1} & … & z_{l−1}Rz_{l} & {[y_{k}Rz_{l}] \atop Π} ; w:A \\ & & & w:A \end{aligned}  (6.11)

in N_{□♢}(T ). By the induction hypothesis, we have a derivation:

{y_{k}Rz_{l} \atop Π^{∗}} ; w:A

in N_{□♢} + Ax(T ), obtained by translating Π. Now each relational assumption in Π^{∗}, in particular the open assumptions y_{k}Rz_{l}, must be the premise of either a (□E) application or a (♢I) application. The translation of (6.11) is obtained from Π^{∗} by replacing each application:

\begin{matrix}{Π′ \atop y_{k}:□B} & y_{k}Rz_{l} \\ z_{l}:B \end{matrix}

with the derivation:

\begin{matrix}\begin{matrix}\begin{matrix}x:♢^{k} □ B ⊃ □^{l}B & \begin{matrix}\begin{matrix}{Π′ \atop y_{k}:□B} & y_{k−1}Ry_{k} \\ y_{k−1} :♢ □ B \end{matrix} ; ⋮ . ; y_{1} :♢^{k−1} □ B & xRy_{1} \\ x:♢^{k} □ B \end{matrix} \\ x:□^{l}B \end{matrix} & xRz_{1} \\ z_{1} :□^{l−1}B \end{matrix} ; ⋮ . ; z_{l−1} :□B & z_{l−1}Rz_{l} \\ z_{l}:B \end{matrix}

using just the ♢^{k} □ B ⊃ □^{l}B half of A_{ϕ_{kl}}; and by replacing each application:

\begin{matrix}{Π′ \atop z_{l}:B} & y_{k}Rz_{l} \\ y_{k}:♢B \end{matrix}

in Π′ with a similar derivation of:

{Π′ \atop z_{l}:B} xRy_{1} y_{1}Ry_{2} … y_{k−1}Ry_{k} xRz_{1} … z_{l−1}Rz_{l} ; ⋮ . ; y_{k}:♢B

using the ♢^{l}B ⊃ □^{k} ♢ B half of A_{ϕ_{kl}}. The resulting transformation of Π^{∗} gives the required derivation of:

xRy_{1} y_{1}Ry_{2} … y_{k−1}Ry_{k} xRz_{1} … z_{l−1}Rz_{l} ; ⋮ . ; w:A

in N_{□♢} + Ax(T ).

It remains to translate applications of (R_{D}). Suppose we have a derivation:

{[xRy] \atop Π} ; z:A ; z:A  (6.12)

in N_{□♢}(T ) ending in an application of (R_{D}). By the induction hypothesis, we have a derivation:

{xRy \atop Π^{∗}} ; z:A

in N_{□♢} +Ax(T ), obtained by translating Π. Then the translation of (6.12) is just:

\begin{matrix}x:♢⊤ & {[xRy] \atop Π^{∗}} ; z:A \\ z:A \end{matrix}

⊠

By the lemma, it follows that the theorems of N_{□♢}(T ) and N_{□♢} + Ax(T ) coincide. So Theorem 6.2.1 now follows from:

Lemma 6.2.3 The following are equivalent:

1. A is a theorem of IK + Ax(T ) .

2. A is a theorem of N_{□♢} + Ax(T ).

This is proved by making trivial modifications to the proof of Theorem 6.1.1. In particular, Lemma 6.1.2 is modified to: if G is a finite tree then Ax(T ); Γ ⊢_{G} x:A if and only if (Γ ⊢_{G} x:A)^{∗} is a theorem of IK+Ax(T ). The proof applies verbatim, apart from one extra trivial case covering the use of an axiom.

6.3 Problems with a more general scheme

In this section we consider the problems that arise in trying to generalize Theorem 6.2.1 to wider classes of frame properties.

The property of klmn-incestuality is defined by:

ψ_{klmn} = ∀xyz. xR^{k}y ∧ xR^{l}z ⊃ ∃w. yR^{m}w ∧ zR^{n}w.

(see Chellas [13, p. 88]). This generalizes all the examples we have considered: the property ϕ_{kl} is expressed by ψ_{kl10}, seriality is expressed by ψ_{0011} and directedness is expressed by ψ_{1111}. In contrast to the case for ϕ_{kl}, the property ψ_{klmn} is not always expressible in our first-order language of modal frames, L_{f}, as sometimes equality is essential. A necessary and sufficient condition for ψ_{klmn} to be expressible in L_{f} is that m = n = 0 implies k = l = 0 (the necessity can be checked semantically), in which case it is expressible by a single basic geometric sequent in L_{f}. (In general, ψ_{klmn} is expressible by a single basic geometric sequent in the language extended with equality.) However, such considerations of expressibility with or without equality are distractions. So henceforth we consider only instances of ψ_{klmn} expressible in L_{f}. The purpose of this section is to give an example showing that, perhaps surprisingly, the natural axiomatization of the intuitionistic modal logic of klmn-incestual frames is, in general, incomplete.

In classical modal logic, a complete axiomatization of the modal logic valid in klmn-incestual frames is given by the axiom schema:

♢^{k} □^{m} A ⊃ □^{l} ♢^{n} A,

or equivalently by the schema:

♢^{l} □^{n} A ⊃ □^{k} ♢^{m} A.

Thus, in the intuitionistic case, it is natural to consider the axiom schema:

A_{ψ_{klmn}} = (♢^{k} □^{m} A ⊃ □^{l} ♢^{n} A) ∧ (♢^{l} □^{n} A ⊃ □^{k} ♢^{m} A).

Let T be any theory consisting of (the basic geometric sequents expressing) sentences of the form ψ_{klmn}. Define Ax(T ) as in (6.10). One might hope that the theorems of IK + Ax(T ) would be exactly the theorems of N_{□♢}(T ). Indeed, in Section 6.2, we showed that this is the case for a more restricted range of T ; as the axiomatizations obtained by way of ψ_{klmn} are equivalent to our earlier ones. However, although it is always the case that every theorem of IK + Ax(T ) is a theorem of N_{□♢}(T ), the converse does not hold in general. Thus the candidate axiomatization is not always complete.

To see that the theorems of IK + Ax(T ) are always theorems of N_{□♢}(T ), it is enough to derive A_{ψ_{klmn}} using (R_{ψ_{klmn}}). So far we have not even properly formalized ψ_{klmn}. We remark only that the formalization is straightforward and that the subsequent derivation of A_{ψ_{klmn}} using (R_{ψ_{klmn}}) is an easy generalization of the derivation of A_{ϕ_{kl}} from (R_{ϕ_{kl}}) in the proof of Lemma 6.2.2. Instead, we concentrate on the more interesting failure of completeness. One example for which completeness fails is directedness. This is expressed by ψ_{1111} (although we henceforth revert to its earlier name, χ_{2}), so its induced axiom schema is:

♢ □ A ⊃ □ ♢ A

(only one side of the conjunction is needed as both sides are the same), which is axiom schema 2 of Figure 3–2. It is easily checked that IK + 2, which we call IK2, is sound relative to birelation models whose visibility relation is directed (as in Figure 3–2). However, using the correspondence theorem of Plotkin and Stirling [64, Theorem 2.2] it is straightforward to show that the schema:

(♢(□(A ∨ B) ∧ ♢A) ∧ ♢(□(A ∨ B) ∧ ♢B)) ⊃ ♢(♢A ∧ ♢B)

is not a theorem of IK2, whereas it is easily seen to be valid in any birelation model whose visibility relation is directed and also in any IL-model of χ_{2}.

Actually, it is easily shown that any formula valid in all birelation models with directed visibility relation is valid in all IL-models of χ_{2}. Quite surprisingly, the converse does not hold. We shall show that the following schema is derivable in N_{□♢}(χ_{2}):

\begin{matrix}( ¬¬(□A ∨ □B) ∧ ♢((A ⊃ □D) ∧ (B ⊃ □C)) ) ⊃ \\ □( ((A ⊃ □C) ∧ (B ⊃ □D)) ⊃ ♢¬¬(C ∧ D) ), \end{matrix}  (6.13)

although there are instances of this schema that are not valid in all birelation models with directed visibility relation. Thus (6.13) is another example of the incompleteness of IK2 as an axiomatization of the theorems of N_{□♢}(χ_{2}).

First, we show that every instance of (6.13) is a theorem of N_{□♢}(χ_{2}). Let G be the graph:

y
[figure]
x  w
[figure]
z

and let Γ be {y: (A ⊃ □D) ∧ (B ⊃ □C), z: (A ⊃ □C) ∧ (B ⊃ □D)}. Then it is easy to derive:

Γ, x:□A ∨ □B ⊢_{G} w:C ∧ D

in N_{□♢}. From this it is straightforward to obtain:

Γ, x:¬¬(□A ∨ □B) ⊢_{G} w:¬¬(C ∧ D)

whence:

Γ, x:¬¬(□A ∨ □B) ⊢_{G} z:♢¬¬(C ∧ D).

We now apply (R_{2}) to obtain:

Γ, x:¬¬(□A ∨ □B) ⊢_{H}^{χ_{2}} z:♢¬¬(C ∧ D).

where H is the graph:

y

[figure]

x

[figure]

z

It is now a straightforward step to derive (6.13) as a theorem of N_{□♢}(χ_{2}).

However, the instance of (6.13) obtained by instantiating A, B, C, D with distinct propositional constants α, β, γ, δ is not valid in every birelation model with directed visibility relation. Consider Figure 6–5. This shows a birelation model in which R is directed. The partial order is the least partial order such that x ≤ x′, x ≤ x′′, y ≤ y′, y ≤ y′′, z ≤ z′, z ≤ z′′, w ≤ w′, w ≤ w′′ and v ≤ v′. Observe that x ⊩ ¬¬(□α ∨ □β) and y ⊩ (α ⊃ □δ) ∧ (β ⊃ □γ) and z ⊩ (α ⊃ □γ) ∧ (β ⊃ □δ) but w ⊮ ¬¬(γ ∧ δ). Then it is easy to see that indeed

x ⊮ ( ¬¬(□α ∨ □β) ∧ ♢((α ⊃ □δ) ∧ (β ⊃ □γ)) ) ⊃
□( ((α ⊃ □γ) ∧ (β ⊃ □δ)) ⊃ ♢¬¬(γ ∧ δ) ).

Chapter 6. Axiomatizations 115

[figure: y′ {α}; u_{1} {γ, δ}; y′′ {β}; x′; w′ {γ}; v′; x′′; w′′ {δ}; z′ {α}; z′′ {β}; u_{2} {γ, δ}; y; x; w; v; z] Figure 6–5: Countermodel to axiomatization of directedness.

Incidentally, the rationale behind the choice of model in Figure 6–5 is that it is not graph-consistent (and hence not cartesian) in the terminology of Section 8.1.

The problem of obtaining a complete axiomatization of the theorems of N_{□♢}(χ_{2}) is open, as is the problem of obtaining a complete axiomatization of the formulae valid in all birelation models with directed visibility relation.

6.4 Discussion

In this chapter we have established a reasonable class of ‘well-behaved’ intuitionistic modal logics which are both determined by N_{□♢}(T ) for some T and axiomatized by natural extensions of IK. One can look at the results either as establishing axiomatizations of theoremhood in N_{□♢}(T ), or alternatively as establishing the meta-logical completeness of the axiomatizations (in conjunction with the results of Chapter 5). In any case, as discussed in Section 3.4, we believe that N_{□♢}(T ) induces the ‘correct’ intuitionistic modal logic of modal frames satisfying T .

With the results of this chapter, we can compare some different approaches to determining the intuitionistic analogues of classical modal logics. The first approach of Fischer Servi [21] determined a unique intuitionistic counterpart to any classical modal logic, via a translation into a classical bimodal logic. Her second approach, [23], determined, for a class of modal frames, F, an intuitionistic analogue of the classical modal logic induced by F, namely the intuitionistic modal logic whose theorems are the formulae valid in any birelation model (W, ≤, R, V) such that (W, R) ∈ F. The main result of [23], is that, for a wide range of F (including all those covered by Theorem 3.3.4), the two approaches agree. Thus each of the intuitionistic modal logics IKS_{1}… S_{n} on page 55 is Fischer Servi’s intuitionistic modal logic of F-frames for the appropriate F. So, by the results of this chapter, when F is the class of frames determined by some T ⊆ {χ_{D}, χ_{T} , χ_{B}, χ_{4}, χ_{5}}, the theorems of N_{□♢}(T ) are the same as those of Fischer-Servi’s intuitionistic modal logic of F-frames.

By Theorem 5.2.1, for any T to which Theorem 6.2.1 applies, we have a complete axiomatization of the modal formulae valid in any IT -model. It is worthwhile noting in what sense the axiomatizations actually characterize the class of IT -models. First, we define the notion of an ‘I-frame’. An I-frame, (W, ≤, {D_{w}}_{w∈W} , {R_{w}}_{w∈W}), is just an arbitrary IL-model of L_{f}. A modal formula is said to be valid in an I-frame J if, for all IL-models, K, of L_{m} of the form (J , {α_{w}}_{w∈W}), we have that w, d ⊩_{K} A, for all w ∈ W and d ∈ D_{w}. The class of I-frames characterized by a modal formula A is the class of I-frames in which A is valid. The class of I-frames characterized by a set of modal formulae is defined similarly. It is easy to show that, for any T to which Theorem 6.2.1 applies, Ax(T ) characterizes the class of I-frames: {J | J ⊧_{IL} T }. Therefore Ax(T ) characterizes exactly the class of I-frames on which IT -models are based.

The notion of characterizability leads to some very straightforward incompleteness phenomena relative to I-frames. We say that an intuitionistic modal logic L (obtained by adding a set of axiom schemas to IK) is complete relative to a class of I-frames if the theorems of L are exactly the set of modal formulae valid in each I-frame in the class. We say that L is I-complete if there exists a class of I-frames relative to which L is complete. Thus, by the remarks above, all the modal logics to which Theorem 6.2.1 applies are I-complete. However, for a simple example of an intuitionistic modal logic which is not I-complete, take L to be IK extended with the schema □A ⊃ A. It is easy to show that this characterizes the class of I-frames: {J | J ⊧_{IL} χ_{T} }. But it is not I-complete because the schema A ⊃ ♢A is also valid in any such frame, but α ⊃ ♢α is not a theorem of L (see Plotkin and Stirling [64]).

The above discussion hints at a general theory of completeness and correspondence for intuitionistic modal logics based on I-frames. However, the interest of such a theory depends on how much importance one attaches to the semantics of intuitionistic modal logics in IT -models.

Lastly, we remark that all the proofs in this chapter were intuitionistically acceptable.

Normalization and its consequences

In this chapter we prove and exploit normalization results for the modal natural deduction systems. In Section 7.1 we define the reduction relation on derivations in N_{□♢}(T ) and prove it to be both strongly normalizing and confluent. In Section 7.2 we use the normalization of N_{□♢}(T ) to infer the completeness of a cut-free sequent calculus, L_{□♢}(T ), for deriving modal consequences. In Section 7.3 we use variants L_{□♢}(T ) to prove the decidability of the consequence relation of N_{□♢}(T ) for certain theories T .

7.1 Strong normalization for N_{□♢}(T )

In this section we present reduction rules for N_{□♢}(T ) and we prove strong normalization and confluence.

Once again, a formula occurrence in a derivation is a maximum formula if it is both the conclusion of an application of an introduction rule and the major premise of an application of an elimination rule. The indirect rules in N_{□♢}(T ) are (⊥E), (∨E), (♢E) and (R_{χ}). As before, a formula occurrence in a derivation is permutable if it is both the conclusion of an application of an indirect rule and the major premise of an application of an elimination rule. Again, a derivation in

\begin{matrix}{Π_{1} \atop x:A_{1}} & {Π_{2} \atop x:A_{2}} \\ x:A_{1} ∧ A_{2} \end{matrix} ; x:A_{i} ⟹ {Π_{i} \atop x:A_{i}}

\begin{aligned}{Π \atop x:A_{i}} ; x:A_{1} ∨ A_{2} & {[x:A_{1}] \atop Π_{1}} ; y:B & {[x:A_{2}] \atop Π_{2}} ; y:B \\ & y:B \end{aligned} ⟹ {Π \atop x:A_{i}} ; Π_{i} ; y:B

\begin{matrix}{[x:A] \atop Π_{1}} ; x:B ; x:A ⊃ B & {Π_{2} \atop x:A} \\ x:B \end{matrix} ⟹ {Π_{2} \atop x:A} ; Π_{1} ; x:B

\begin{matrix}{[xRy] \atop Π} ; y:A ; x:□A & xRy′ \\ y′:A \end{matrix} ⟹ {xRy′ \atop Π[y′/y]} ; y′:A

\begin{matrix}\begin{matrix}{Π_{1} \atop y:A} & xRy \\ x:♢A \end{matrix} & \begin{matrix}[y′:A] & [xRy′] \\ Π_{2} \end{matrix} ; z:B \\ z:B \end{matrix} ⟹ \begin{matrix}{Π_{1} \atop y:A} & xRy \\ Π_{2}[y/y′] \end{matrix} ; z:B

Figure 7–1: Modal proper reductions.

\begin{matrix}{Π \atop x:⊥} ; y:A & Ξ \\ z:B \end{matrix} (r) ⟹ {Π \atop x:⊥} ; z:B

\begin{matrix}\begin{aligned}{Π \atop x:♢A} & \begin{aligned}[y:A] & & [xRy] \\ & Π′ \end{aligned} ; z:B \\ & z:B \end{aligned} & Ξ \\ w:C \end{matrix} (r) ⟹ \begin{aligned}{Π \atop x:♢A} & \begin{matrix}\begin{aligned}[y:A] & & [xRy] \\ & Π′ \end{aligned} ; z:B & Ξ \\ w:C \end{matrix} (r) \\ & w:C \end{aligned}

\begin{matrix}\begin{aligned}{Π \atop x:A ∨ B} & {[x:A] \atop Π_{1}} ; y:C & {[x:B] \atop Π_{2}} ; y:C \\ & y:C \end{aligned} & Ξ \\ z:D \end{matrix} (r) ⟹ \begin{aligned}{Π \atop x:A ∨ B} & \begin{matrix}{[x:A] \atop Π_{1}} ; y:C & Ξ \\ z:D \end{matrix} (r) & \begin{matrix}{[x:B] \atop Π_{2}} ; y:C & Ξ \\ z:D \end{matrix} (r) \\ & z:D \end{aligned}

\begin{matrix}\begin{aligned}R_{1}[\overline{z}/\overline{x}] & … & R_{n}[\overline{z}/\overline{x}] & \begin{aligned}[R_{11}[\overline{z}/\overline{x}]] & … & [R_{1n_{1}}[\overline{z}/\overline{x}]] \\ & Π_{1} \end{aligned} ; w:A & … & \begin{aligned}[R_{m1}[\overline{z}/\overline{x}]] & … & [R_{mn_{m}}[\overline{z}/\overline{x}]] \\ & Π_{m} \end{aligned} ; w:A \\ & & & w:A \end{aligned} & Ξ \\ w′:B \end{matrix} (r)

⟹

\begin{aligned}R_{1}[\overline{z}/\overline{x}] & … & R_{n}[\overline{z}/\overline{x}] & \begin{matrix}\begin{aligned}[R_{11}[\overline{z}/\overline{x}]] & … & [R_{1n_{1}}[\overline{z}/\overline{x}]] \\ & Π_{1} \end{aligned} ; w:A & Ξ \\ w′:B \end{matrix} (r) & … & \begin{matrix}\begin{aligned}[R_{m1}[\overline{z}/\overline{x}]] & … & [R_{mn_{m}}[\overline{z}/\overline{x}]] \\ & Π_{m} \end{aligned} ; w:A & Ξ \\ w′:B \end{matrix} (r) \\ & & & w′:B \end{aligned}

Figure 7–2: Modal permutative reductions.

N_{□♢}(T ) is in normal form if it contains no maximum formula and no permutable formula.

Maximum formulae are removed by the proper reductions in Figure 7–1. Note that the reductions for the non-modal connectives are just the expected reductions from N_{IL} adapted to manipulate prefixed formulae. The reductions for the modalities show that the modal rules do indeed enjoy the inversion principle (recall the discussion on page 15). The permutable formulae are removed by the permutative reductions in Figure 7–2. The permutative reductions for the non-modal connectives are again the expected adaptations of those for N_{IL}(T ). For an example in the modal fragment, the permutative reduction permuting (♢E) and (□E) is:

\begin{matrix}\begin{aligned}{Π \atop x:♢A} & \begin{aligned}[y:A]^{1} & & [xRy]^{1} \\ & Π′ \end{aligned} ; z:□B \\ & z:□B \end{aligned}_{1} & zRw \\ w:B \end{matrix} ⟹ \begin{aligned}{Π \atop x:♢A} & \begin{matrix}\begin{aligned}[y:A]^{1} & & [xRy]^{1} \\ & Π′ \end{aligned} ; z:□B & zRw \\ w:B \end{matrix} \\ & w:B \end{aligned}_{1}

Again we write ⟹ for the rewrite relation on derivations in N_{□♢}(T ) given by a single application of either a proper or permutative reduction. As before, a derivation is in normal form if and only if ⟹ is not applicable.

Theorem 7.1.1 The relation ⟹ on derivations in N_{□♢}(T ) is strongly-normal-izing and confluent.

One philosophical application of normalization is that, as argued on page 20, it provides the technical justification for the claim in Section 4.1 that the modal inference rules determine the meaning of the modalities. Some mathematical applications will be given in Sections 7.2 and 7.3. Again, weak normalization is sufficient for all the applications we give. However, we establish strong normalization and confluence as they give further evidence for the naturalness of the systems N_{□♢}(T ) and their reduction rules.

The proof of Theorem 7.1.1 is by reduction to strong normalization and confluence for N_{IL}(T ) (Theorem 2.3.2). For this we use a translation of derivations in N_{□♢}(T ) into derivations in N_{IL}(T ). To prove strong normalization, it would be sufficient to work with the translation, (·)^{∗}, of Section 5.1. However, for the proof of confluence we shall require the translation of derivations to be injective. This is not satisfied by (·)^{∗} as, for example, the two derivations:

{x:⊥ \atop x:⊥}  {x:⊥ \atop y:⊥}

both have the same translation. The remedy is simple, we need only keep track of the prefixes attached to formulae. First, we modify the translation, (·)^{x}, on page 59 from modal formulae to L_{m}-formulae by redefining:

⊥^{x} = ⊥ ∧ xRx

and leaving the other clauses unchanged. For the remainder of this section, we use A^{x} to refer to the new translation of a modal formula A. (Note that the new translation is intuitionistically equivalent to the old, so the statement of Theorem 5.1.1 continues to hold under it.) Now, we redefine (·)^{∗} to take account of the new translation of formulae. The new Π^{∗} is again defined inductively on the structure of Π. For all inference rules other than (⊥E) the translation is as for the original (·)^{∗}, defined on page 86 and in Figure 5–1. For (⊥E) the new translation is:

( {Π \atop x:⊥} ; y:A )^{∗} = {Π^{∗} \atop ⊥ ∧ xRx} ; ⊥ ; A^{y}

Henceforth in this section we use (·)^{∗} to refer to the new translation.

Lemma 7.1.2 (Basic properties of (·)^{∗})

1. Π^{∗} is indeed a valid derivation in N_{IL}(T ).

2. (Π[y/x])^{∗} = Π^{∗}[y/x].

3. ( {Π′ \atop x:A} ; Π ; y:B )^{∗} = {Π^{′∗} \atop x:A} ; Π^{∗} ; y:B .

4. (·)^{∗} is injective.

Proof. Each statement is proved by a straightforward induction on the structure of Π (for 1 cf. Proposition 5.1.2). ⊠

We now give two lemmas leading to the proof of Theorem 7.1.1. As we shall be working with reduction in two systems, N_{□♢}(T ) and N_{IL}(T ), to avoid confusion, we label the reduction relations ⟹_{□♢} and ⟹_{IL} respectively. (Recall that we write ⟹^{+} for the transitive closure of a relation ⟹.)

Lemma 7.1.3 If Π_{1} ⟹_{□♢} Π_{2} then Π_{1}^{∗} ⟹_{IL}^{+} Π_{2}^{∗}.

Proof. In fact any proper (resp. permutative) reduction in N_{□♢}(T ) is mimicked by a non-empty sequence of proper (resp. permutative) reductions in N_{IL}(T ). The proof is just a matter of checking the different cases. The only interesting cases are those involving one of the rules: (⊥E), (□I), (□E), (♢I) and (♢E), as the other reductions in N_{□♢}(T ) transport trivially to N_{IL}(T ). We consider two cases as examples, one proper reduction and one permutative reduction.

For the proper reduction we show that:

( \begin{matrix}\begin{matrix}{Π_{1} \atop y:A} & xRy \\ x:♢A \end{matrix} & \begin{matrix}[y′:A] & [xRy′] \\ Π_{2} \end{matrix} ; z:B \\ z:B \end{matrix} )^{∗} ⟹_{IL}^{+} ( \begin{matrix}{Π_{1} \atop y:A} & xRy \\ Π_{2}[y/y′] \end{matrix} ; z:B )^{∗}  (7.1)

The left-hand side is the N_{IL}(T ) derivation:

\begin{matrix}\begin{matrix}xRy & {Π_{1}^{∗} \atop A^{y}} \\ xRy ∧ A^{y} \end{matrix} ; ∃x′. xRx′ ∧ A^{x′} & \begin{aligned}{[xRy′ ∧ A^{y′}] \atop A^{y′}} & {[xRy′ ∧ A^{y′}] \atop xRy′} \\ & Π_{2}^{∗} \end{aligned} ; B^{z} \\ B^{z} \end{matrix}

which reduces by one proper reduction to:

\begin{aligned}\begin{matrix}{Π_{1}^{∗} \atop A^{y}} & xRy \\ xRy ∧ A^{y} \end{matrix} ; A^{y} & \begin{matrix}{Π_{1}^{∗} \atop A^{y}} & xRy \\ xRy ∧ A^{y} \end{matrix} ; xRy \\ & Π_{2}^{∗}[y/y′] \end{aligned} ; B^{z}

and then by a (possibly empty) sequence of further proper reductions to:

\begin{aligned}{Π_{1}^{∗} \atop A^{y}} & xRy \\ & Π_{2}^{∗}[y/y′] \end{aligned} ; B^{z}

which, by Lemma 7.1.2(2 & 3), is indeed the right-hand side of (7.1).

For the permutative reduction, we consider the example on page 121. We must show that:

( \begin{matrix}\begin{aligned}{Π_{1} \atop x:♢A} & \begin{aligned}[y:A]^{1} & [xRy]^{1} \\ & Π_{2} \end{aligned} ; z:□B \\ & z:□B \end{aligned}_{1} & zRw \\ w:B \end{matrix} )^{∗} ⟹_{IL}^{+} ( \begin{aligned}{Π_{1} \atop x:♢A} & \begin{matrix}\begin{aligned}[y:A]^{1} & [xRy]^{1} \\ & Π_{2} \end{aligned} ; z:□B & zRw \\ w:B \end{matrix} \\ & w:B \end{aligned}_{1} )^{∗}

The left-hand side is:

\begin{matrix}\begin{matrix}{Π_{1}^{∗} \atop ∃x′. xRx′ ∧ A^{x′}} & \begin{aligned}{[xRy ∧ A^{y}] \atop A^{y}} & {[xRy ∧ A^{y}] \atop xRy} \\ & Π_{2}^{∗} \end{aligned} ; ∀z′. zRz′ ⊃ B^{z′} \\ ∀z′. zRz′ ⊃ B^{z′} \end{matrix} ; zRw ⊃ B^{w} & zRw \\ B^{w} \end{matrix}

which, by the application of two permutative reductions, does indeed reduce to the translation of the right-hand side:

\begin{aligned}{Π_{1}^{∗} \atop ∃x′. xRx′ ∧ A^{x′}} & \begin{matrix}\begin{aligned}{[xRy ∧ A^{y}] \atop A^{y}} & {[xRy ∧ A^{y}] \atop xRy} \\ & Π_{2}^{∗} \end{aligned} ; ∀z′. zRz′ ⊃ B^{z′} ; zRw ⊃ B^{w} & zRw \\ B^{w} \end{matrix} \\ & B^{w} \end{aligned}

⊠

Lemma 7.1.4 If Π is in normal form (in N_{□♢}(T )) then Π^{∗} is in normal form (in N_{IL}(T )).

Proof. First observe that the last rule in Π^{∗} is an introduction if and only if the last rule in Π is. Similarly, the last rule in Π^{∗} is indirect if and only if the last rule in Π^{∗} is. The proposition is now proved by a straightforward induction on the structure of Π. For example, if the last rule applied is (♢E) then Π has the form:

\begin{aligned}{Π_{1} \atop x:♢A} & \begin{matrix}[y:A] & [xRy] \\ Π_{2} \end{matrix} ; z:B \\ & z:B \end{aligned}

If Π is in normal form then so are Π_{1} and Π_{2} and thus, by the induction hypothesis, Π_{1}^{∗} and Π_{2}^{∗} are too. Moreover. Π_{1} cannot end in an application of either an introduction rule or an indirect rule (otherwise Π would not be in normal form). Hence, by the observation, Π_{1}^{∗} neither ends in an introduction nor in an indirect rule. It is now clear, from the definition of Π^{∗}, that Π^{∗} is in normal form as required. ⊠ Proof of Theorem 7.1.1. Let Π be a derivation in N_{□♢}(T ). By Theorem 2.3.2 there is an n such that all sequences of ⟹_{IL} reductions on Π^{∗} have length ≤ n. Then, by Lemma 7.1.3, all sequences of ⟹_{□♢} reductions on Π have length ≤ n. Thus ⟹_{□♢} is indeed strongly normalizing.

We now show that Π has a unique normal form. For suppose Π reduces to two normal form derivations, Π_{1} and Π_{2}. Then, by Lemma 7.1.3, Π^{∗} reduces to Π_{1}^{∗} and Π_{2}^{∗} which, by Lemma 7.1.4, are both in normal form. But, by Theorem 2.3.2, normal forms in N_{IL}(T ) are unique. Therefore Π_{1}^{∗} = Π_{2}^{∗} and thus, as (·)^{∗} is injective, Π_{1} = Π_{2}.

Confluence is an obvious consequence of (weak) normalization and the uniqueness of normal forms. ⊠

7.2 A cut-free sequent calculus

The application of normalization for N_{□♢}(T ) are similar to those for N_{IL}(T ) (see Sections 2.1 and 2.3). For example, a similar proof to that of Proposition 2.3.3 establishes the subformula property for N_{□♢}(T ). Rather than repeating the details, in this section we formulate a cut-free sequent calculus, which we call L_{□♢}(T ), in which the subformula property is built into the rules. The normalization result

G; Γ, x:A ⊢ x:A (Ass)  G; Γ, x:⊥ ⊢ z:A (⊥L)
{G; Γ, x:A, x:B ⊢ z:C \atop G; Γ, x:A ∧ B ⊢ z:C} (∧L)  \begin{matrix}G; Γ ⊢ x:A & G; Γ ⊢ x:B \\ G; Γ ⊢ x:A ∧ B \end{matrix} (∧R)
\begin{matrix}G; Γ, x:A ⊢ z:C & G; Γ, x:B ⊢ z:C \\ G; Γ, x:A ∨ B ⊢ z:C \end{matrix} (∨L)  {G; Γ ⊢ x:A_{i} \atop G; Γ ⊢ x:A_{1} ∨ A_{2}} (∨Ri)
\begin{matrix}G; Γ, x:B ⊢ z:C & G; Γ ⊢ x:A \\ G; Γ, x:A ⊃ B ⊢ z:C \end{matrix} (⊃L)  {G; Γ, x:A ⊢ x:B \atop G; Γ ⊢ x:A ⊃ B} (⊃R)
{G; Γ, y:A ⊢ z:B \atop G, xRy; Γ, x:□A ⊢ z:B} (□L)  {G, xRy; Γ ⊢ y:A \atop G; Γ ⊢ x:□A} ^{(□R)^{∗}}
{G, xRy; Γ, y:A ⊢ z:B \atop G; Γ, x:♢A ⊢ z:B} ^{(♢L)^{†}}  {G; Γ ⊢ y:A \atop G, xRy; Γ ⊢ x:♢A} (♢R)
\begin{matrix}G, R_{11}[\overline{z}/\overline{x}], …, R_{1n_{1}}[\overline{z}/\overline{x}]; Γ ⊢ x:A & … & G, R_{m1}[\overline{z}/\overline{x}], …, R_{mn_{m}}[\overline{z}/\overline{x}]; Γ ⊢ x:A \\ G, R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}]; Γ ⊢ x:A \end{matrix} ^{(S_{χ})^{‡}}

∗Restriction on (□R): y must not occur in G; Γ ⊢ x:□A. †Restriction on (♢L): y must not occur in G; Γ, x:♢A ⊢ z:B. ‡Restriction on (S_{χ}): none of the variables in \overline{y} occur in the sequent G, R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}]; Γ ⊢ x:A.

Figure 7–3: The cut-free sequent calculus L_{□♢}(T ).

\begin{matrix}G; Γ, y:A ⊢ z:B & xRy ∈ T_{H}-Cl(G) \\ G; Γ, x:□A ⊢ z:B \end{matrix} ^{(□L)^{T_{H}}} \begin{matrix}G; Γ ⊢ y:A & xRy ∈ T_{H}-Cl(G) \\ G; Γ ⊢ x:♢A \end{matrix} ^{(♢R)^{T_{H}}}

Figure 7–4: Rules for the modified sequent calculus, L′_{□♢}(T_{H}, T ). for N_{IL}(T ) is then used to establish the completeness of L_{□♢}(T ). In Section 7.3 we shall use variants of L_{□♢}(T ) to establish the decidability of the consequence relation of N_{□♢}(T ) for certain T .

A sequent is a formal entity of the form G; Γ ⊢ x:A, where G is a finite graph, Γ is a finite set of prefixed formulae and all prefixes in Γ∪{x:A} are in G. The rules of L_{□♢}(T ) are given in Figure 7–3. As with N_{□♢}(T ) we include only rules (S_{χ}) for χ ∈ T . Note that our choice to consider sets Γ means that the usual contraction rule is built in to the notation of the system. The formulation of (Ass) means that weakening is an admissible rule (this fact is a consequence Theorem 7.2.1 below).

The normalization property of the natural deduction system enables the completeness of the sequent calculus to be easily established. For convenience, we only consider consequences involving finite graphs and sets of prefixed formulae. The generalizations to the infinite case are obvious.

Theorem 7.2.1 G; Γ ⊢ x:A is derivable in L_{□♢}(T ) if and only if Γ ⊢_{G}^{T} x:A.

Proof. The soundness direction (that if the sequent G; Γ ⊢ x: A is derivable then Γ ⊢_{G}^{T} x : A) is proved by an easy induction on sequent derivations. We concentrate instead on the converse (completeness) direction. The proof is along the lines of that given by Prawitz [65, Appendix A], who uses normalization in natural deduction to prove the completeness of the cut-free fragment of Gentzen’s sequent calculus (relative to the corresponding natural deduction system).

The proof proceeds by induction on the number of rule applications in normal derivations of Γ ⊢_{G}^{T} x: A. The cases in which the last rule is an introduction are straightforward. For example, in the case of (♢I) we have a derivation of the form:

\begin{matrix}{Π \atop y:A} & xRy \\ x:♢A \end{matrix}

of Γ ⊢_{G}^{T} x : ♢A where xRy in G. Now Π is a derivation of Γ ⊢_{G}^{T} y : A. So, by the induction hypothesis, there is a sequent derivation of G; Γ ⊢ y : A. This is extended to the desired derivation of G; Γ ⊢ x:♢A by an application of (♢R).

Similarly, if the last rule applied is (R_{χ}) then we have a derivation of the form:

\begin{aligned}R_{1}[\overline{z}/\overline{x}] & … & R_{n}[\overline{z}/\overline{x}] & \begin{aligned}[R_{11}[\overline{z}/\overline{x}]] & … & [R_{1n_{1}}[\overline{z}/\overline{x}]] \\ & Π_{1} \end{aligned} ; x′:A & … & \begin{aligned}[R_{m1}[\overline{z}/\overline{x}]] & … & [R_{mn_{m}}[\overline{z}/\overline{x}]] \\ & Π_{m} \end{aligned} ; x′:A \\ & & & x′:A \end{aligned}

of Γ ⊢_{G}^{T} x′: A where G contains R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}]. Now each Π_{i} (where 1 ≤ i ≤ m) is a derivation of Γ ⊢_{G_{i}} x′:A where G_{i} = G ∪ \{R_{i1}[\overline{z}/\overline{x}], …, R_{in_{i}}[\overline{z}/\overline{x}]\}. So, by the induction hypothesis, we have derivations of G, R_{i1}[\overline{z}/\overline{x}], …, R_{in_{i}}[\overline{z}/\overline{x}]; Γ ⊢ x′:A for each i. Also, by the restriction on (R_{χ}), none of the variables in \overline{y} occur in G; Γ ⊢ x′ : A. Therefore the sequent G; Γ ⊢ x′ : A is indeed derivable by an application of (S_{χ}).

The cases in which the last rule is an elimination are more interesting. Suppose we have a normal derivation of Γ ⊢_{G}^{T} x_{0} : A_{0} whose last rule is an elimination. Because it is normal, the derivation must be of the form:

\begin{matrix}\begin{matrix}x_{n}:A_{n} & Ξ_{n} \\ x_{n−1} :A_{n−1} \end{matrix} (r_{n}) Ξ_{n−1} ; ⋮ . ; x_{1} :A_{1} & Ξ_{1} \\ x_{0} :A_{0} \end{matrix} (r_{1})  (7.2)

where: n ≥ 1; each rule (r_{i}) is a elimination with major premise x_{i}:A_{i} and subsidiary derivations Ξ_{i} of the minor premises (if any); and (r_{i}) is a direct elimination when i ≥ 2. Clearly x_{n}:A_{n} is an open assumption. Therefore x_{n}:A_{n} ∈ Γ.

We show that G; Γ ⊢ x_{0} : A_{0} is derivable by a case analysis on (r_{n}). First, if (r_{n}) is indirect then, as observed above, n = 1. We consider the case of (♢E), which is illustrative of the general case. The derivation is of the form:

\begin{matrix}x_{1} :♢B & \begin{aligned}[y:B] & [x_{1}Ry] \\ & Π \end{aligned} ; x_{0} :A \\ x_{0} :A_{0} \end{matrix}

Π is a normal derivation of Γ, y : B ⊢_{G∪{x_{1}Ry}}^{T} x_{0} : A_{0}. So, by the induction hypothesis, we have a sequent derivation of G, x_{1}Ry; Γ, y: B ⊢ x_{0} : A_{0}. The (♢L) rule extends this to a derivation of G; Γ, x_{1} : ♢B ⊢ x_{0} : A. This is the desired derivation of G; Γ ⊢ x_{0} :A_{0} (as x_{n}:A_{n} is x_{1} :♢B so x_{1} :♢B ∈ Γ).

Lastly, suppose (r_{n}) is a direct elimination. Then if it is removed from (7.2) we obtain a smaller (and still normal) derivation of Γ, x_{n−1} : A_{n−1} ⊢_{G}^{T} x_{0} : A_{0}. Therefore, by the induction hypothesis, G; Γ, x_{n−1} : A_{n−1} ⊢ x_{0} : A_{0} is derivable. We now proceed again by a case analysis on (r_{n}). Suppose, for example, that (r_{n}) is (⊃E). Then x_{n} : A_{n} is of the form x_{n−1} : C ⊃ A_{n−1}, and Ξ_{n} is a single normal derivation of Γ ⊢_{G}^{T} x_{n−1} :C. By the induction hypothesis there is a sequent derivation of G; Γ ⊢ x_{n−1} : C. This couples with the given derivation of the sequent G; Γ, x_{n−1} : A_{n−1} ⊢ x_{0} : A_{0} to obtain, by (⊃L), the desired derivation of G; Γ, x_{n−1} : C ⊃ A_{n−1} ⊢ z: B. The other direct eliminations are treated similarly. ⊠

In our application of the cut-free sequent calculus to establish decidability we shall, for technical reasons, use variants of L_{□♢}(T ). The variants are formulated in order to restrict the set of graphs that can appear in derivations of a given sequent. The problem with L_{□♢}(T ) is that the graph appearing in the conclusion of an application of (S_{χ}) might bear little relation to the graphs appearing in its prefixes. In the remainder of this section we show how L_{□♢}(T ) can be altered so that, for any Horn clause χ, the rule (S_{χ}) can be omitted.

Let T_{H} be a Horn clauses theory in L_{f}. The T_{H}-closure of a graph G, written T_{H}-Cl(G), is the smallest graph (under inclusion) satisfying:

1. G ⊆ T_{H}-Cl(G).

2. If ∀\overline{x}. ((R_{1} ∧ … ∧ R_{n}) ⊃ R′) is in T_{H} and R_{1}[\overline{z}/\overline{x}], …, R_{n}[\overline{z}/\overline{x}] all hold in T_{H}-Cl(G) then R′[\overline{z}/\overline{x}] in T_{H}-Cl(G).

T_{H}-Cl(G) is just the initial model of the evident Horn clause theory T_{H} ∪ G. Note that the underlying set of G is also the underlying set of T_{H}-Cl(G). Further, if T_{H} is finite then the relation xRy ∈ T_{H}-Cl(G) is decidable (because T_{H}-Cl(G) can be computed by iterating closure principle 2 above a finite number of times until a fixed point is reached).

We now define the modified sequent-calculus, which we call L′_{□♢}(T_{H}, T ). This is obtained from L_{□♢}(T_{H} ∪ T ) by omitting the rules (S_{χ}) for χ ∈ T_{H} and replacing the rules (□L) and (♢R) with the rules (□L)_{T_{H}} and (♢R)_{T_{H}} of Figure 7–4.

Lemma 7.2.2 The sequent G; Γ ⊢ x: A is derivable in L_{□♢}(T_{H} ∪ T ) if and only if the sequent T_{H}-Cl(G); Γ ⊢ x:A is.

Proof. The left-to-right direction is trivial as L_{□♢}(T_{H} ∪ T ) is closed under weakening. For the right-to-left implication, it is easy to show that a derivation of T_{H}-Cl(G); Γ ⊢ x: A can be extended to one of G; Γ ⊢ x: A by applications of the (S_{χ}) rules for χ ∈ T_{H} mimicking the generation of T_{H}-Cl(G) from G. ⊠

Proposition 7.2.3 A sequent G; Γ ⊢ x:A is derivable in L′_{□♢}(T_{H}, T ) if and only if it is derivable in L_{□♢}(T_{H} ∪ T ).

Proof. The left-to-right implication is proved by induction on the structure of derivations in L′_{□♢}(T_{H}, T ). If the last rule applied is any other than (□L)_{T_{H}} or (♢R)_{T_{H}} then the same rule applies in L_{□♢}(T_{H} ∪ T ). If the last rule applied is (□L)_{T_{H}} then the derivation has the form:

⋮ . ; G; Γ, y:A ⊢ z:B ; G; Γ, x:□A ⊢ z:B

where xRy ∈ T_{H}-Cl(G). By the induction hypothesis, G; Γ, y : A ⊢ z : B is derivable in L_{□♢}(T_{H} ∪ T ). Then, by Lemma 7.2.2, so is T_{H}-Cl(G); Γ, y:A ⊢ z:B. Now an application of (□R) derives T_{H}-Cl(G); Γ, x : □A ⊢ z : B. So, again by Lemma 7.2.2, the sequent G; Γ, x:□A ⊢ z:B is indeed derivable in L_{□♢}(T_{H} ∪ T ). The case for (♢R)_{T_{H}} is similar.

For the converse, the following more general statement is proved by a straightforward induction on the structure of derivations in L_{□♢}(T_{H} ∪ T ): if the sequent G; Γ ⊢ x: A is derivable in L_{□♢}(T_{H} ∪ T ) and G ⊆ T_{H}-Cl(G′) then G′; Γ ⊢ x: A is derivable in L′_{□♢}(T_{H}, T ). The generalized statement is to cover the case in which the last rule is an application of (S_{χ}) for some χ ∈ T_{H}, which it renders trivial. ⊠ Corollary 7.2.4 A sequent G; Γ ⊢ x:A is derivable in L′_{□♢}(T_{H}, T ) if and only if Γ ⊢_{G}^{T_{H} ∪ T} x:A.

Proof. By the above proposition and Theorem 7.2.1. ⊠

7.3 Decidability

In this section we prove the decidability of the consequence relation of N_{□♢}(T ) for any T in the family (recall Figure 4–3 on page 73):

Dec_{T} = {∅, {χ_{D}}, {χ_{T} }, {χ_{B}}, {χ_{D}, χ_{B}}, {χ_{T} , χ_{B}}}

(We do not consider any T containing both χ_{T} and χ_{D}, because χ_{T} implies χ_{D}.) Thus, including the known result about IS5 (see page 57), we have, by the results of Chapter 6, that theoremhood is decidable for any of the intuitionistic modal logics in Figure 7–5 (where the arrows represent inclusions). The most prominent logics for which decidability is left open are IK4, IKD4 and IS4. We shall discuss possible approaches to proving their decidability in Section 7.4 and in Chapter 9.

For obvious reasons, in this section we consider only finite graphs and finite sets of prefixed formulae. The main theorem is:

Theorem 7.3.1 For any theory T ∈ Dec_{T} the relation Γ ⊢_{G}^{T} x:A is decidable.

Although it would be possible to prove Theorem 7.3.1 by a direct analysis of normal derivations in N_{□♢}(T ) for appropriate T , we shall use instead the cutfree sequent calculi of Section 7.2. The sequent calculi seem more convenient for performing the crucial analysis of the graph structures appearing in derivations (see Section 7.3.1 below). Theorem 7.3.1 follows from:

Proposition 7.3.2 In each of the following modified sequent-calculi: L′_{□♢}(∅, ∅), L′_{□♢}(∅, {χ_{D}}), L′_{□♢}({χ_{T} }, ∅), L′_{□♢}({χ_{B}}, ∅), L′_{□♢}({χ_{B}}, {χ_{D}}), L′_{□♢}({χ_{T} , χ_{B}}, ∅), it is decidable whether a sequent, G; Γ ⊢ x:A, is derivable.

IS5

IKTB^{}
[figure]
IT  IKDB
[figure]
[figure: IKD; IKB]
[figure]

IK

Figure 7–5: Intuitionistic modal logics known to be decidable.

For the proof of the proposition we fix T_{H} and T so that L′_{□♢}(T_{H}, T ) is one of the listed systems. We also fix G, Γ and x : A. We shall give an algorithm that decides whether the sequent G; Γ ⊢ x: A is derivable in L′_{□♢}(T_{H}, T ). The algorithm works by searching backwards from G; Γ ⊢ x:A for possible derivations of it. Thus the search runs through a space of incomplete derivations ending in G; Γ ⊢ x:A. We begin by defining such incomplete derivations formally.

A pseudo-derivation (of G; Γ ⊢ x:A) in L′_{□♢}(T_{H}, T ) is a derivation of G; Γ ⊢ x:A from arbitrary sequent axioms. Thus any derivation of G; Γ ⊢ x: A is trivially a pseudo-derivation. We define the size of a pseudo-derivation to be the number of rule applications in it.

The decision procedure will work by searching a space of pseudo-derivations until a genuine derivation is found. However, the set of all of pseudo-derivations is infinite, so we must find a finite subset that will suffice. The set of all pseudoderivations is infinite for two reasons. First, the hypotheses of a sequent rule need not be structurally less complex than its conclusion (this is partly because of the built-in contraction and partly because of the rules manipulating graphs), so there is no bound on the depth of pseudo-derivations. Second, the set of all sequents occurring in pseudo-derivations is infinite (even up to graph isomorphism). This is because the graphs appearing in a pseudo-derivation can be arbitrarily large.

The first problem already occurs with Gentzen’s cut-free sequent calculus for intuitionistic propositional logic, in which the contraction rule is necessary for completeness. There the usual solution (see e.g. Dummett [16, p.146]) is to introduce a notion of redundancy such that any derivable sequent has an irredundant derivation and, moreover, there are only a finite number of irredundant pseudoderivations. In intuitionistic propositional logic the notion of redundancy is a simple one based on the same sequent occurring twice in the same branch of a pseudo-derivation. However, because of the second problem identified above, this will not work in our case.

Instead we proceed as follows. The formulation of the modified sequent systems listed in Proposition 7.3.2 enables us to give a good account of the structure of the sequents we need consider (Section 7.3.1). Exploiting this structure, we define a decidable preorder on sequents for which the induced equivalence relation has a finite number of equivalence classes (Section 7.3.2). This preorder is then used to define an appropriate notion of redundancy, restricting the search to a finite space (Section 7.3.3).

Before embarking on the proof we give some preliminary definitions. The modal depth, ||A||, of a modal formula, A, is defined inductively by: ||α|| = 0; ||A ∧ B|| = ||A ∨ B|| = ||A ⊃ B|| = max(||A||, ||B||); || □ A|| = || ♢ A|| = 1 + ||A||. The modal depth, ||Θ||, of a finite non-empty set of formulae, Θ, is the maximum modal depth of any formula in Θ. The set of subformulae of a modal formula A is defined inductively by: A is a subformula of itself; if any of B ∧ C, B ∨ C and B ⊃ C are subformulae of A then so are both B and C; if either □B or ♢B is a subformula of A then so is B. The subformula closure, Θ^{∗}, of Θ is the least set containing Θ that contains the set of subformulae of each of its members. We write Θ_{n}^{∗} for the set of all modal formulae in the subformula closure of Θ with modal depth ≤ n (the n-bounded subformula closure of Θ).

Henceforth, we fix Θ = {B | y: B ∈ Γ} ∪ {A}. Define d = ||Θ||. Let X be the underlying set of G.

7.3.1 The structure of sequents

In this subsection we analyse the structure of sequents that need appear in derivations of G; Γ ⊢ x: A in L′_{□♢}(T_{H}, T ). It turns out that we need only consider sequents H; Δ ⊢ y: B in which: H is a graph extending G in a particular way, and, for any y′ in H, the modal formulae prefixed by y′ in Δ∪{y:B} are restricted according to the position of y′ in H.

The notion of a graph being a G-extension is defined inductively by:

1. G is a G-extension.

2. If H is a G-extension and z is not in H then H ∪ {yRz} is a G-extension.

In the second clause y need not (but may) be a node in H. Let H be a G-extension with underlying set Y. Note that the restriction of H to X is G. We say that a node, y, in H has depth m ≥ 0 if there exists a sequence y_{0}Ry_{1} … Ry_{m} in H such that: y_{0} ∈ X, y_{i+1} ∈ Y \X and y_{m} = y. Note that any node in H has at most one accessing sequence satisfying the conditions and so its depth, if it exists, is unique. Clearly the depth of any x′ ∈ X exists and is 0. We say that H is bounded if every node in H has a depth ≤ d. Intuitively a bounded G-extension is given by G together with a set of trees of depth ≤ d each rooted at some x′ ∈ X. The bounded-restriction of an arbitrary G-extension, H, is defined to be the restriction of H to the set {y ∈ H | y has a depth ≤ d}. Clearly the bounded-restriction of H is indeed a bounded G-extension.

Let Δ be a set of prefixed formulae with all prefixes contained in the graph H. We say that the pair (H, Δ) is a bounded context if:

1. H is a bounded G-extension, and

2. if y:B ∈ Δ then B ∈ Θ_{d−n}^{∗} where n is the depth of y in H.

A sequent, H; Δ ⊢ y:B, is said to be admissible if (H, Δ ∪ {y:B}) is a bounded context. Note that the sequent G; Γ ⊢ x: A is admissible. A (pseudo-)derivation is said to be admissible if every sequent in it is admissible. The main result of this subsection is:

Proposition 7.3.3 The sequent G; Γ ⊢ x: A is derivable in L′_{□♢}(T_{H}, T ) if and only if it has an admissible derivation.

Establishing the bounded aspect of admissibility depends crucially on the lemma below. This lemma is the reason that we are proving decidability for such a limited range of logics. If T_{H} contains either χ_{4} or χ_{5} then the lemma fails.

Lemma 7.3.4 Let H be a G-extension with nodes y and z of depths d_{y} ≤ d and d_{z} ≤ d respectively. Let H′ be the bounded-restriction of H. Then:

1. yRz in T_{H}-Cl(H) implies d_{z} ≤ 1 + d_{y}.

2. yRz in T_{H}-Cl(H) implies yRz in T_{H}-Cl(H′).

Proof. Suppose that yRz in T_{H}-Cl(H). Then, depending on T_{H}, one of the following holds: yRz in H, or zRy in H, or y = z. In each case it is clear that d_{z} ≤ 1 + d_{y}, so 1 holds. For 2, as d_{y} ≤ d and d_{z} ≤ d, then one of the following holds: yRz in H′, or zRy in H′, or y = z. So indeed yRz in T_{H}-Cl(H′). ⊠ Proposition 7.3.3 follows immediately from:

Lemma 7.3.5 If there is a pseudo-derivation of G; Γ ⊢ x:A from the axioms:

H_{1}; Δ_{1} ⊢ y_{1} :B_{1} … H_{k}; Δ_{k} ⊢ y_{k}:B_{k}

then:

1. For each i with 1 ≤ i ≤ k, H_{i} is a G-extension and if z: C ∈ Δ_{i} ∪ {y_{i}: B_{i}} then z has a depth n ≤ d in H_{i} and C ∈ Θ_{d−n}^{∗}.

2. There is an admissible pseudo-derivation of G; Γ ⊢ x:A from the axioms:

H′_{1}; Δ_{1} ⊢ y_{1} :B_{1} … H′_{k}; Δ_{k} ⊢ y_{k}:B_{k}

where each H′_{i} is the bounded-restriction of H_{i}.

Proof. The proof is by induction on the size of the pseudo-derivation. For a pseudo-derivation of size 0 the result is immediate, for the only sequent in the derivation is G; Γ ⊢ x: A itself. For the induction step, any pseudo-derivation of size n + 1, is obtained from one of size n by adding a new rule application to its top. We consider below the cases in which this rule is one of: (□L)_{T_{H}}, (□R), (♢L), (♢R)_{T_{H}} and (S_{D}). The other cases are dealt with more easily.

If the rule is (□R) then the pseudo-derivation has the form:

{H, yRz; Δ ⊢ z:B \atop H; Δ ⊢ y:□B}  …; ⋮ . ; G; Γ ⊢ x:A  (7.3)

where z is not in H. By the induction hypothesis (1), we have that H is a Gextension and the depth of y in H is n ≤ d − 1 as □B ∈ Θ_{d−n}^{∗}. But H ∪ {yRz} is a G-extension (as z is not in H), the depth of z in H ∪ {yRz} is n + 1 ≤ d and B ∈ Θ_{d−(n+1)}^{∗} (as □B ∈ Θ_{d−n}^{∗}). So (7.3) does indeed satisfy 1. For 2, we have, by the induction hypothesis, an admissible pseudo-derivation:

H′; Δ ⊢ y:□B …; ⋮ . ; G; Γ ⊢ x:A

But H′ ∪ {yRz} is the bounded-restriction of H ∪ {yRz} and H′, yRz; Δ ⊢ z: B is admissible (as H′; Δ ⊢ y:□B is). Therefore:

{H′, yRz; Δ ⊢ z:B \atop H′; Δ ⊢ y:□B} …; ⋮ . ; G; Γ ⊢ x:A

is a pseudo-derivation fulfilling the conditions required by 2. The case for (♢L) is similar.

If the rule is (♢R)_{T_{H}} then the pseudo-derivation has the form:

{H; Δ ⊢ z:B \atop H; Δ ⊢ y:♢B}  …; ⋮ . ; G; Γ ⊢ x:A  (7.4)

where yRz in T_{H}-Cl(H). By the induction hypothesis (1), we have that H is a G-extension and the depth of y in H is n ≤ d − 1 as ♢B ∈ Θ_{d−n}^{∗}. But, by Lemma 7.3.4(1), the depth of z in H is n′ ≤ n + 1 ≤ d, so indeed B ∈ Θ_{d−n′}^{∗}. Therefore (7.4) does indeed satisfy 1. For 2, we have, by the induction hypothesis, an admissible pseudo-derivation:

H′; Δ ⊢ y:♢B …; ⋮ . ; G; Γ ⊢ x:A

where H′ is the bounded-restriction of H. But then, by Lemma 7.3.4(2):

{H′; Δ ⊢ z:B \atop H′; Δ ⊢ y:♢B} …; ⋮ . ; G; Γ ⊢ x:A

is an admissible pseudo-derivation fulfilling the conditions required by 2. The case for (□L)_{T_{H}} is similar.

If the rule is (S_{D}) then the pseudo-derivation has the form:

{H, zRz′; Δ ⊢ y:B \atop H; Δ ⊢ y:B} …; ⋮ . ; G; Γ ⊢ x:A

where z′ is not in H. For 1, we have, by the induction hypothesis, that H is a Gextension. But then so is H∪{zRz′}. For 2, we have, by the induction hypothesis, an admissible pseudo-derivation:

H′; Δ ⊢ y:B …; ⋮ . ; G; Γ ⊢ x:A

where H′ is the bounded-restriction of H. If z does not have a depth ≤ d − 1 in H then H′ is also the bounded-restriction of H ∪ {zRz′} and so the above pseudoderivation already fulfills condition 2. If z does have a depth n ≤ d − 1 in H then the depth of z′ in H ∪ {zRz′} is n + 1 ≤ d. So the bounded-restriction of H ∪ {zRz′} is H′ ∪ {zRz′} and

{H′, zRz′; Δ ⊢ y:B \atop H′; Δ ⊢ y:B} (S_{D}) …; ⋮ . ; G; Γ ⊢ x:A

is the pseudo-derivation required by condition 2. ⊠

It is worth commenting that many of the complications in the formulation and proof of Proposition 7.3.3 come from the occurrence of the (S_{D}) rule in the systems L′_{□♢}(∅, {χ_{D}}) and L′_{□♢}({χ_{B}}, {χ_{D}}). For the other systems, a stronger statement than Proposition 7.3.3 holds: every pseudo-derivation is admissible. The proof still depends on Lemma 7.3.4, but is more straightforward.

7.3.2 A preorder on sequents

We define the preorder on sequents via a slightly circuitous route which will save us from having to repeat definitions in Chapter 8. Henceforth in this proof, we refer to bounded contexts as just contexts. A pointed context (henceforth pcontext) is a triple (H, Δ, y) where (H, Δ) is a context and y is any node in H. A pcontext morphism from (H, Δ, y) to (H′, Δ′, y′) is a graph morphism f : H → H′ such that:

1. for all x ∈ X, f(x) = x (i.e. f preserves G);

2. if z:B ∈ Δ then f(z):B ∈ Δ′; and

3. f(y) = y′.

A preorder, ≾, on pcontexts is given by the preorder collapse of the category of pcontexts and pcontext morphisms; i.e.

(H, Δ, y) ≾ (H′, Δ′, y′) iff there exists a pcontext morphism from (H, Δ, y)
to (H′, Δ′, y′).

The relation ≾ is clearly decidable (by enumerating all functions from H to H′ and checking whether any is a pcontext morphism). We write ≂ for the equivalence relation induced by ≾.

Finally, we induce a preorder, ≾, and equivalence relation, ≂, on admissible sequents (again we henceforth drop the adjective “admissible”).^{1} The preorder is defined by:

H; Δ ⊢ y:B ≾ H′; Δ′ ⊢ y′:B′ iff B = B′ and (H, Δ, y) ≾ (H′, Δ′, y′).

Once more ≾ is clearly decidable (this fact is important). The equivalence relation is again the induced equivalence.

Proposition 7.3.6 The set of pcontexts is partitioned into a finite number of equivalence classes by ≂. Similarly the set of sequents.

Proof. We show the proposition for pcontexts, by constructing a finite set S of ‘canonical’ pcontexts and showing that every pcontext is equivalent to a canonical one. The proposition for sequents obviously follows.

In a canonical pcontext (H_{ϕ}, Δ_{ϕ}, s), the components H_{ϕ} and Δ_{ϕ} will be determined by a function ϕ mapping each node x′ of G to the associated tree of variables rooted at x′, labelled at each node with the set of formulae prefixed there. First sets T_{n} (0 ≤ n ≤ d) of all inequivalent labelled trees with nodes of depths from n to d are defined by:

T_{d} = ℘(Θ_{0}^{∗}) × {∅}
T_{n<d} = ℘(Θ_{d−n}^{∗}) × ℘(T_{n+1})

H_{ϕ} and Δ_{ϕ} are then determined by a function ϕ : X → T_{0}. The underlying set of H_{ϕ} is (we use π_{1} and π_{2} as the first and second projections from a cartesian product):

Y_{ϕ} = {(x′, p_{0}, …, p_{m}) | 0 ≤ m ≤ d, x′ ∈ X, p_{0} = ϕ(x′), p_{n+1} ∈ π_{2}(p_{n})}.

(As defined Y_{ϕ} does not contain X, hence H_{ϕ} is not properly a G-extension. However, think of (x′, p_{0}) as x′ and see the discussion below.) The relation on H_{ϕ} is:

1It will always be clear when we mean the preorder/equivalence to be on pcontexts and when on sequents.

{⟨(x′, p_{0}), (x′′, p′_{0})⟩ | x′Rx′′ in G} ∪ {⟨(x′, p_{0}, …, p_{m}), (x′, p_{0}, …, p_{m}, p_{m+1})⟩}.

The set of prefixed formulae is extracted by:

Δ_{ϕ} = {(x′, p_{0}, …, p_{m}):B | B ∈ π_{1}(p_{m})}.

We can now define the desired set S by:

S = {(H_{ϕ}, Δ_{ϕ}, (x′, p_{0}, …, p_{m})) | H_{ϕ} and Δ_{ϕ} are determined by some
ϕ : X → T_{0} and (x′, p_{0}, …, p_{m}) ∈ Y_{ϕ}}

It is clear by construction that S is finite. Moreover it is clear that an upper bound on its cardinality can be easily calculated. We do not bother to do so.

The elements of S are not officially pcontexts for the inessential reason (mentioned above) that the H_{ϕ}, as defined, do not extend G. The reader is asked to identify (x′, p_{0}) in H_{ϕ} with x′ in G. We do not do this formally, as it is useful to have the uniform sequence notation for all nodes in H_{ϕ}. It is clear that the elements of S do satisfy the other requirements on being a pcontext.

We now show how, given an arbitrary pcontext (H, Δ, y), we can find an element of S equivalent to it. First we must extract the generating ϕ : X → T_{0}. For each m with 0 ≤ m ≤ d we define an auxiliary function ϕ_{m} mapping nodes in H of depth m to trees in T_{m} by:

ϕ_{d}(y′) = ⟨{B | y′:B ∈ Δ}, ∅⟩
ϕ_{m<d}(y′) = ⟨{B | y′:B ∈ Δ}, {ϕ_{m+1}(y′′) | y′Ry′′ in H}⟩.

Then ϕ : X → T_{0} is just ϕ_{0}. Next we define a function f : Y → Y_{ϕ} by:

f(y′) = (y_{0}, ϕ(y_{0}), ϕ_{1}(y_{1}), …, ϕ_{m}(y_{m}))

where y_{0}, y_{1}, …, y_{m} is the unique sequence determining the depth of y′. The element of S equivalent to (H, Δ, y) is (H_{ϕ}, Δ_{ϕ}, f(y)). It is easily checked that f is a pcontext morphism so we know that (H, Δ, y) ≾ (H_{ϕ}, Δ_{ϕ}, f(y)).

It remains to define a pcontext morphism from (H_{ϕ}, Δ_{ϕ}, f(y)) to (H, Δ, y). Let y_{0}, y_{1}, …, y_{m} be the unique sequence determining the depth of y. (Note that y_{m} = y.) The morphism, g, is defined first on nodes of depth 0 in H_{ϕ}, then on nodes of depth i + 1 by a finite choice depending on the action of g on nodes of depth i.

g(x′, p_{0}) = x′

g(x′, p_{0}, …, p_{i+1}) = \{ \begin{matrix}y_{i+1} & if i + 1 ≤ m and f(y_{i+1}) = (x′, p_{0}, …, p_{i+1}), \\ any y′ such that g(x′, p_{0}, …, p_{i})Ry′ in H and \\ f(y′) = (x′, p_{0}, …, p_{i+1}), if the clause above \\ does not apply. \end{matrix}

To show that g is well defined, we must show that if the second clause in the definition of g(x′, p_{0}, …, p_{i+1}) applies then a y′ satisfying the stated conditions exists. First we can assume that g(x′, p_{0}, …, p_{i}) is well defined and it is clear (whatever clause is used in its definition) that f(g(x′, p_{0}, …, p_{i})) = (x′, p_{0}, …, p_{i}). It now follows from the definition of f that p_{i} = ϕ_{i}(g(x′, p_{0}, …, p_{i})). But p_{i+1} ∈ π_{2}(p_{i}), by the definition of H_{ϕ}. So p_{i+1} ∈ π_{2}(ϕ_{i}(g(x′, p_{0}, …, p_{i}))). Then, by the definition of ϕ_{i}, we have that p_{i+1} = ϕ_{i+1}(y′) for some y′ such that g(x′, p_{0}, …, p_{i})Ry′ in H. It is clear that this is the y′ required.

Before proceeding we note a simple fact about g, namely: if i + 1 ≤ m then g(x′, p_{0}, …, p_{i+1}) is defined (to be y_{i+1}) by the first clause if and only if x′ = y_{0} and, for all j (0 ≤ j ≤ i+1), p_{j} = ϕ_{j}(y_{j}) (because f(y_{i+1}) = (y_{0}, ϕ_{0}(y_{0}), …, ϕ_{i+1}(y_{i+1}))).

To complete the proof, g must be shown to be a pcontext morphism. First, as a function, g preserves G in that g(x′, p_{0}) = x′. It is clear then that the restriction of g to G is a graph morphism to H. So for g to be a graph morphism from H_{ϕ} to H we need only show that g(x′, p_{0}, …, p_{i})Rg(x′, p_{0}, …, p_{i+1}) in H. This is clear when g(x′, p_{0}, …, p_{i+1}) is obtained by the second clause in its definition. If it is obtained by the first clause then, by the fact noted above, (x′, p_{0}, …, p_{i+1}) = (y_{0}, ϕ_{0}(y_{0}), …, ϕ_{i+1}(y_{i+1})) and so, again by the fact, g(x′, p_{0}, …, p_{i}) = y_{i}. But g(x′, p_{0}, …, p_{i+1}) = y_{i+1} and y_{i}Ry_{i+1} as required.

Thus g is indeed a graph morphism from H_{ϕ} to H. We must also show that g(f(y)) = y, but this is immediate from the fact above. It remains to show that, for all (x′, p_{0}, …, p_{i}):B ∈ Δ_{ϕ}, g(x′, p_{0}, …, p_{i}):B ∈ Δ. Accordingly, suppose that (x′, p_{0}, …, p_{i}) : B ∈ Δ_{ϕ}. Then B ∈ π_{1}(p_{i}), by the definition of Δ_{ϕ}. So (as in the argument that g was well defined) B ∈ π_{1}(ϕ_{i}(g(x′, p_{0}, …, p_{i}))). But then, by the definition of ϕ_{i}, we have that g(x′, p_{0}, …, p_{i}):B ∈ Δ as required. ⊠

7.3.3 Irredundant derivations and decidability

We now turn to the promised notion of redundancy on pseudo-derivations. An admissible pseudo-derivation is said to be redundant if it contains two sequents H; Δ ⊢ y : B and H′; Δ′ ⊢ y′ : B, with the former occurring strictly above the latter, such that H; Δ ⊢ y:B ≾ H′; Δ′ ⊢ y′:B. An admissible pseudo-derivation is irredundant if it is not redundant. The last stage in our preparation for proving decidability is to show that if G; Γ ⊢ x:A is derivable then it has an irredundant (admissible) derivation.

Lemma 7.3.7 If H; Δ ⊢ y : B ≾ H′; Δ′ ⊢ y′ : B and H; Δ ⊢ y : B has an admissible derivation of size n then so does H′; Δ′ ⊢ y′:B′.

Proof. The lemma is essentially a sequent calculus version of Proposition 4.4.1. Let f be a pcontext morphism witnessing that H; Δ ⊢ y: B ≾ H′; Δ′ ⊢ y′: B. Given an admissible derivation of H; Δ ⊢ y:B, we can assume that the set of all variables not in H that occur in the derivation (essentially, the set of eigenvariables of the derivation) is disjoint from the set of variables in H′. Then the admissible derivation of H′; Δ′ ⊢ y′:B′ is obtained by replacing each sequent, H′′; Δ′′ ⊢ z:C in the derivation of H; Δ ⊢ y:B with the sequent:

f(H′′) ∪ H′; f(Δ′′) ∪ Δ′ ⊢ f(z):C

where f is extended to behave as the identity on variables not in H. It is easily checked that the resulting tree of sequents is indeed a derivation of H′; Δ′ ⊢ y′:B′. Moreover, by its construction, its size is that of the original derivation. ⊠ Proposition 7.3.8 If G; Γ ⊢ x:A is derivable then it has an irredundant derivation.

Proof. By induction on the size of the derivation of G; Γ ⊢ x : A. If the derivation is irredundant then we are done. Otherwise it contains two sequents H; Δ ⊢ y : B and H′; Δ′ ⊢ y′ : B with the former strictly above the latter such that H; Δ ⊢ y: B ≾ H′; Δ′ ⊢ y′: B. Let m be the size of the subderivation of H; Δ ⊢ y: B. Clearly the size of the subderivation of H′; Δ′ ⊢ y′: B is strictly greater than m. But, by the lemma, H′; Δ′ ⊢ y′:B also has a derivation of size m. So the subderivation of H′; Δ′ ⊢ y′: B can be replaced with the one of size m to obtain a new derivation of G; Γ ⊢ x:A which clearly has size strictly less than n. Whence, by the induction hypothesis, G; Γ ⊢ x:A has an irredundant derivation. ⊠

We are now in a position to give the decision algorithm. This will be an exhaustive search for an irredundant derivation of G; Γ ⊢ x : A. The decision procedure performs the following loop starting with the sequent G; Γ ⊢ x : A which is the only irredundant pseudo-derivation of size 0. Given (essentially) all the irredundant pseudo-derivations of size n (the caveat will be explained below), these are checked to see if any is a genuine derivation. If so, the decision algorithm succeeds. Otherwise, the finite set of (essentially) all the irredundant pseudoderivations of size n+1 is constructed. It is clear that, given any sequent, there are (modulo the inessential choice of eigenvariable in the rules: (□R), (♢L) and, when present, (S_{D}) — and this explains the repeated qualification of ‘essentially’) only a finite number of possible rule applications whose conclusion can be that sequent and whose premises are admissible sequents. Moreover the finite set of different possibilities can be effectively calculated. Therefore, assuming a canonical choice of eigenvariable for different applications of the (□R), (♢L) and (S_{D}) rules, there are only a finite number of admissible pseudo-derivations of size n + 1 (extending the irredundant ones of size n) and this set can be effectively calculated. From this set the redundant ones are weeded out. This is possible because the ≾ relation on sequents is decidable. We are left with (essentially) all the irredundant derivations of size n + 1. If this set is empty then the decision algorithm fails. Otherwise the loop is repeated with the new set.

The algorithm is guaranteed to terminate because eventually the maximum height of an irredundant pseudo-derivation (which is clearly bounded by the number of equivalence classes of ≂ for sequents) will be exceeded. The algorithm does not need to know the bound. If the algorithm succeeds then G; Γ ⊢ x: A is indeed derivable, as we have found a derivation of it. If the algorithm fails then G; Γ ⊢ x: A is not derivable, for otherwise an irredundant derivation would eventually have been found.

The proof of decidability is complete.

7.4 Discussion

Despite the many Fitch-style natural deduction systems for modal logic which have appeared in the literature (see Section 4.6), the only treatment of normalization has been in the recent paper of Masini [55]. Perhaps one explanation for this avoidance of normalization is that most authors have considered classical modal logic and normalization does not work particularly well for classical natural deduction. (For example, in his treatment of classical first-order logic, Prawitz was forced to omit the, admittedly definable, logical constants ∨ and ∃ [65, Ch. III].) Masini deals only with a single system which, though intuitionistic, yields a different modal logic from any of the systems we consider. Also, he considers only weak normalization.

In Section 7.1, we proved strong normalization and confluence for the whole family of systems N_{□♢}(T ). The reduction of the proof to the corresponding result for N_{IL}(T ) shows how proof systems for modal logics can be analysed without the theoretical overhead of having to reprove basic properties.

The first sequent calculus based on relative truth was Kanger’s system for S5 using ‘spotted’ formulae [47] (1957). The approach has been generalized by Fitting with his prefixed tableau systems [28] (1972) and [29, Ch. 8] (1983) (which are closely related to cut-free sequent calculi).

The sequent calculi presented in Section 7.2 differ in two ways from those in the aforementioned work. First, they are intuitionistic. Second, as in the tableau systems of Nerode [59], they use relational assumptions rather than ad hoc prefix notations (see the discussion in Section 4.6 and Appendix B). Indeed, our basic sequent calculus, L_{□♢}, could have been discovered as the single-conclusioned restriction of a cut-free sequent calculus derived from Nerode’s tableau system for K. (Although, in fact, it was derived from N_{□♢}.) But again, our use of geometric theories to give a uniform family of sequent systems for many different intuitionistic modal logics is novel.

As with natural deduction, modal logics are often given sequent calculi not based on relative truth. These manipulate the usual sequents of formulae, rather than prefixed formulae. With such systems, cut-elimination and the subformula property yield very easy proofs of decidability. For a survey of such techniques see Goré [40] (1992). However, as in the case of natural deduction, we do not know how to apply such techniques to any of the intuitionistic modal logics we are interested in. (Again, it is the ♢ modality that causes problems.) But see Chapter 9 for a tentative proposal.

The proof of decidability in Section 7.3 is quite long. Nevertheless, the underlying argument is straightforward (once the proof theory is in place). The technical complications arise in establishing two things: the structure of sequents and the properties of the preorder. The difficulties in restricting to derivations containing only admissible sequents could have been avoided by formulating the original sequent calculi in such a way that only admissible sequents arose. We did not do this, however, because we preferred to derive the uniform family of sequent calculi L_{□♢}(T ) parameterized on an arbitrary (basic) geometric theory T . The extra work in establishing properties of derivations was a price paid for this generality. The effort invested in establishing the properties of the preorder will be shown, in Section 8.2, to have been doubly worthwhile. The same preorder will be used to help establish the finite model property for those logics proved decidable in this chapter.

The use of prefixed proof systems to establish the decidability of modal logics originates in Fitting’s book [29, Ch. 8, §7]. There, on pp. 410–413, he gives a proof of the decidability of classical K. Fitting proceeds as we do by (essentially) searching backwards for a proof of the goal sequent. However, in the classical setting the whole problem of having a potentially infinite search space is avoided by the convenient fact that the contraction rule is redundant in the propositional fragment. Just as we limit the depth of the trees of eigenvariables in a G-extension by the maximum modal depth of a formula in the goal sequent, Fitting limits also their breadth by the number of modalities in the goal sequent. Therefore, the proof is considerably simpler in the classical case than in the intuitionistic case.

One interesting question is whether the contraction rule can be avoided in the intuitionistic modal system. It is well known that the standard sequent calculus rules for the intuitionistic propositional connectives are not complete without contraction. However, there are ways of modifying the implication rules to overcome this problem (see, e.g., the recent paper of Dyckhoff [18]). We do not know if such techniques can be extended to the modal sequent calculi we consider.

It is rather unfortunate that our decidability proof is restricted to such a limited class of intuitionistic modal logics. In view of the traditional importance of S4, our failure to capture IS4 is especially embarrassing. The problem with adding transitivity to T_{H} is that it enables the (□L)_{T_{H}} and (♢R)_{T_{H}} rules to transport a formula arbitrarily deep into a G-extension. Therefore it is no longer possible to bound the G-extensions.

Fitting [29, pp. 413–416] gives a proof of the decidability of classical K4 based on a prefixed tableau system. He avoids the problem of not being able to bound the depth of (in his case) trees of prefixes by incorporating a suitable check to prevent the construction of periodic infinite trees. We conjecture that it is possible to adapt such an approach to establish the decidability of IK4, IS4 and other combinations. However, once again, any proof in our setting would be complicated by the necessity of contraction. Also, Fitting makes crucial use of a systematic proof procedure that allows one to infer the periodicity of an infinite tree from a finite portion of it. We are not sure how to define such proof procedures for our intuitionistic sequent calculi. It looks certain that any such approach to decidability would be complicated.

In Chapter 9 we shall outline another possible approach to proving the decidability of IS4, which looks more promising.

In contrast to IS4, it is straightforward to adapt the proof-theoretic techniques of this chapter to prove the known result that IS5 is decidable. Actually, the proof of the decidability of IS5 is considerably easier than the proofs in the cases we considered. For the easiest proof, it is probably best to use a sequent calculus with sequents of the form Γ ⊢ x:A. There is no need to keep account of any graph structure because, for IS5, the visibility relation can be assumed to be total. (The resulting proof system is just the intuitionistic restriction of Kanger’s sequent calculus for classical S5 [47].) Again, cut-free proofs contain only subformulae of formulae appearing in the goal sequent. But this time, rather than contending with graph-indexed sets of subformulae as we had to do, one works with plain indexed sets of subformulae instead. Consequently, an appropriate notion of redundancy on derivations is easily established. It is also straightforward to adapt these methods to obtain the decidability of the full consequence relation of N_{□♢}({χ_{T} , χ_{B}, χ_{4}}).

Lastly, we remark that all the proofs in this chapter have been intuitionistically acceptable.

Birelation models and the finite model property

In this chapter we consider two aspects of the birelation models introduced in Section 3.3. First, in Section 8.1, we consider the problem of giving direct interpretations of the natural deduction systems N_{□♢}(T ) in birelation models. Second, in Section 8.2, we prove that each of the intuitionistic modal logics proved decidable in Chapter 7 enjoys the finite model property relative to birelation models.

8.1 Interpreting N_{□♢} in birelation models

In Chapter 5 we proved the soundness and completeness of an interpretation of N_{□♢}(T ) in IL-models. In Section 3.3 we stated the soundness of the various axiomatized IKS_{1}… S_{n} relative to appropriate classes of birelation models, and we sketched the proof of completeness. So far, the only tie-up between the two semantics has been via the results of Sections 6.1 and 6.2, showing that certain systems IKS_{1}… S_{n} give complete axiomatizations of the theorems of the appropriate N_{□♢}(T ). However, Section 6.3 pointed out a discrepancy between the two semantics, not every modal formula valid in IL-models of χ_{2} (expressing directedness) is valid in every birelation model with directed visibility relation.

In this section we consider how well birelation models fare when considered directly as models of the natural deduction systems. It turns out that, even for

[figure: y′ {α}; y′′; x′; z′; x′′; z′′ {α}; y; x; z]

Figure 8–1: Counterexample to general soundness.

the basic system N_{□♢}, there are problems in interpreting the natural deduction consequence relation in arbitrary birelation models.

It is natural to consider the following definition of G-interpretation in a birelation model. A G-interpretation in (W, ≤, R, V) is a graph morphism, [[·]], from G to (W, R). However, now there is a surprise. The obvious statement of soundness for N_{□♢} fails. There is a consequence Γ ⊢_{G} x : A, a birelation model B and a G-interpretation [[·]] in B such that, for all z:B ∈ Γ, [[z]] ⊩_{B} B, but [[x]] ⊮_{B} A.

Let G be the graph:

y
[figure]
x  \overline{}z

Then it is easy to derive the following consequence in N_{□♢}:

y:α ⊃ □¬α ⊢_{G} x:¬ □ α.

However, this consequence does not hold semantically. Consider the model in Figure 8–1. The order is the least partial order such that: x ≤ x′, x ≤ x′′, y ≤ y′, y ≤ y′′, z ≤ z′ and z ≤ z′′. It is easy to check that the two frame conditions are satisfied, indeed the model is universal. It is clear that y ⊩ α ⊃ □¬α, but x′ ⊩ □α so x ⊮ ¬ □ α. Thus taking the evident (and unique) G-interpretation, soundness fails.

It might be possible to avoid this problem by changing the notion of Ginterpretation. However, we believe that the present definition is natural so, instead, we consider the forms of soundness and completeness that do hold. There are two options. One is to work with arbitrary birelation models and consider restricted forms of consequence. The theorem obtained is quite natural.

Theorem 8.1.1 Let G be a tree. Then the following are equivalent:

1. Γ ⊢_{G} x:A.

2. For all birelation models B, for all G-interpretations [[·]] in B, if, for all z:B ∈ Γ, [[z]] ⊩_{B} B then [[x]] ⊩_{B} A.

The second option is to restrict the notion of model (ruling out e.g. the model of Figure 8–1) so that soundness is obtained for arbitrary consequences. We shall discuss this possibility later.

In Section 8.1.1 we prove the completeness direction of Theorem 8.1.1. In Section 8.1.2 we prove the soundness direction. In Section 8.1.3 we consider the problem of extending the interpretation in birelation models to N_{□♢}(T ) when T is nonempty.

8.1.1 Completeness

We show the completeness direction of Theorem 8.1.1 by reducing it to completeness for IL-models. Suppose we have an IL-model:

K = (W, ≤, {D_{w}}_{w∈W} , {R_{w}}_{w∈W} , {α_{w}}_{w∈W})

Then we define a birelation model B_{K} = (W′, ≤′, R′, V′) by:

W′ = {⟨w, d⟩ | w ∈ W and d ∈ D_{w}},
⟨w, d⟩ ≤′ ⟨w′, d′⟩ iff w ≤ w′ and d = d′,
⟨w, d⟩R′⟨w′, d′⟩ iff w = w′ and R_{w}(d, d′),
V′(⟨w, d⟩) = {α | α_{w}(d)}.

Clearly ≤′ is indeed a partial order and V′ is monotonic. To see that the frame conditions hold:

[figure: ⟨w′, d⟩; .; .; .; .; .; R′; ⟨w′, d′⟩; ⟨w′, d⟩; .; .; .; .; .; R′; ⟨w′, d′⟩]
(F1)  (F2)
[figure: ⟨w, d⟩; ≤′; R′; ⟨w, d′⟩; ^{. . . . . . . .≤′}; ⟨w, d⟩; ^{≤′. . . . . . . . .}; R′; ⟨w, d′⟩; ≤′]

In fact the selected worlds are the unique ones satisfying the conditions. So the model B_{K} is universal.

Lemma 8.1.2 w, d ⊩_{K} A if and only if ⟨w, d⟩ ⊩_{B_{K}} A.

Proof. By an easy induction on the structure of A. We consider only the case that A is of the form □B. Then w, d ⊩_{K} □B if and only if, for all w′ ≥ w, for all d′ ∈ D_{w′}, R_{w′}(d, d′) implies w′, d′ ⊩_{K} B if and only if, for all ⟨w′, d⟩ ≥′ ⟨w, d⟩, for all ⟨w′, d′⟩ ∈ W′, ⟨w′, d⟩R′⟨w′, d′⟩ implies w′, d′ ⊩_{K} B. But, by the induction hypothesis, w′, d′ ⊩_{K} B if and only if. ⟨w′, d′⟩ ⊩_{B_{K}} B. So indeed w, d ⊩_{K} □B if and only if ⟨w, d⟩ ⊩_{B_{K}} □B. ⊠ Proof of Theorem 8.1.1 (2 ⟹ 1). First note that, given any world w in an arbitrary IL-model K and any G-w-interpretation ρ in K, then [[x]] = ⟨w, ρ(x)⟩ is a G-interpretation in B_{K}. Using this fact and the lemma above, it is easily seen that the completeness direction of Theorem 8.1.1 follows from the completeness direction of Theorem 5.2.1. ⊠ Note that nowhere in the proof of completeness have we used the assumption that G is a tree. Thus the completeness direction of Theorem 8.1.1 holds for arbitrary consequences.

As B_{K} is universal, we also have the completeness of N_{□♢} relative to universal models. However, we can cut down the class of birelation models considered much further. Let B = (W, ≤, R, V) be any birelation model. We write ≤^{∼} and R^{∼} for the equivalence-closures of ≤ and R respectively. We say that B is cartesian if w ≤^{∼} vR^{∼}w implies w = v. Not every universal model is cartesian. For example, in the model of Figure 8–1 we have that x′ ≤^{∼} x′′R^{∼}x′. However, it is obvious that every cartesian birelation model is universal. It is also clear that, for any IL-model K, the birelation model B_{K} is cartesian. Therefore, N_{□♢} is complete relative to the class of cartesian models.

The interest in cartesian models is that every cartesian birelation model is isomorphic to one of the form B_{K} (under the natural notion of isomorphism). Thus those birelation models obtained from IL-models are characterized (up to isomorphism) as exactly the cartesian models. This characterization is inspired by a similar one, attributed to P. Idziac, in Ono and Suzuki [62, Lemma 3.4, p. 73] for (their formulation of) birelation models of IS5. We shall not prove the characterization in detail. However, let us at least outline the interesting parts.

First, given a cartesian birelation model B = (W, ≤, R, V), we sketch the construction of an IL-model, K, such that B_{K} is isomorphic to B. Define:

K = (W′, ≤′, {D_{w}}_{w∈W′}, {R_{w}}_{w∈W′}, {α_{w}}_{w∈W′})

where:

W′ = W/R^{∼},
[w] ≤′ [w′] iff there exists v′ such that w ≤ v′R^{∼}w′,
D_{[w]} = {[v] ∈ W/≤^{∼} | there exists w′ such that wR^{∼}w′ ≤^{∼} v},
R_{[w]}([v_{1}], [v_{2}]) iff wR^{∼}w_{1} ≤^{∼} v_{1} and wR^{∼}w_{2} ≤^{∼} v_{2} implies w_{1}Rw_{2},
α_{[w]}([v]) iff wR^{∼}w′ ≤^{∼} v implies α ∈ V (w′).

The proof that K is indeed an IL-model depends upon the following fact: for any [v] ∈ D_{[w]}, there is a unique w′ such that wR^{∼}w′ ≤^{∼} v. The fact follows from B being cartesian. The isomorphism from B to B_{K} is determined by the function mapping w ∈ W to ⟨[w], [w]⟩. Its inverse is determined by the function mapping ⟨[w], [v]⟩ to the unique w′ such that wR^{∼}w′ ≤^{∼} v. A detailed proof is routine, and is similar to that of [62, Lemma 3.4, p. 73].

The notion of cartesian birelation model is due to Fischer Servi [23, p. 69], from whom we take the terminology. However, her definition was (essentially) via the construction of B_{K}. She did not give our intrinsic (and hence invariant under isomorphism) definition.

8.1.2 Soundness

For the proof of the soundness direction of Theorem 8.1.1 we work with an arbitrary (but henceforth fixed) birelation model B = (W, ≤, R, V).

The simple but crucial lemma that enables things to work is:

Lemma 8.1.3 (Lifting lemma) Let G be a tree. Given any G-interpretation [[·]], any x in G and any w ≥ [[x]], there exists another G-interpretation, [[·]]′, such that [[x]]′ = w and, for all z ∈ G, [[z]]′ ≥ [[z]].

The model of Figure 8–1 demonstrates that the lemma can fail when G is not a tree.

Proof. We assume G has the form in Figure 6–1 on page 100. Given a Ginterpretation [[·]] and w ≥ [[x_{m}]] we define [[·]]′ satisfying the lemma for x = x_{m}.

First define [[x_{m}]]′ = w. Next we find a suitable value for [[x_{m−1}]]′ using the frame condition (F2). This process is iterated another m − 1 times to find in turn: [[x_{m−2}]]′, …, [[x_{1}]]′ and [[x_{0}]]′. We must still interpret those prefixes in G not of the form x_{i}. Each of these, y, has a unique path from x_{0} of the form x_{0}Rx_{1} … x_{i_{y}}Ry_{1} … y_{j} = y where j ≥ 1 and y_{1} is different from x_{i_{y}+1}. First [[y]]′ is defined for those y for which j = 1 from (the already determined) [[x_{i_{y}}]]′ using frame condition (F1). Again the process is iterated to define, in turn, [[y_{2}]]′, …, [[y_{j}]]′. ⊠ Proof of Theorem 8.1.1 (1 ⟹ 2). By the usual induction on derivations. The only extra difficulty is that we must ensure that throughout the induction we can restrict attention to graphs that are trees. However, this is indeed possible, as already seen in the proof of Lemma 6.1.2. We consider only those cases that require the lifting lemma. The other cases can be copied mutatis mutandis from the corresponding cases in the proof of Theorem 4.5.1.

(⊃I) We have a derivation:

{[x:A] \atop Π} ; x:B ; x:A ⊃ B

of the consequence Γ ⊢_{G} x:A ⊃ B where G is a tree. Then Π is a derivation of Γ, x:A ⊢_{G} x:B. So, by the induction hypothesis, for all G′-interpretations [[·]], if, for all z : C ∈ Γ ∪ {x : A}, [[z]] ⊩ C then [[x]] ⊩ B. Let [[·]] be any G-interpretation such that, for all z: C ∈ Γ, [[z]] ⊩ C. We must show that [[x]] ⊩ A ⊃ B.

Let w ≥ [[x]] be such that w ⊩ A. By the lifting lemma there is a Ginterpretation, [[·]]′ such that [[x]]′ = w and, for all z ∈ G, [[z]]′ ≥ [[z]]. But then [[x]]′ ⊩ A and, by the monotonicity lemma, for all z: C ∈ Γ, [[z]]′ ⊩ C. So, by the induction hypothesis, [[x]]′ ⊩ B, i.e. w ⊩ B. Thus [[x]] ⊩ A ⊃ B as required.

(□I) We have a derivation:

{[xRy] \atop Π} ; y:A ; x:□A

of the consequence Γ ⊢_{G} x : □A where G is a tree. Let G′ = G ∪ {xRy} which is a tree as y is not in G. Now Π is a derivation of Γ ⊢_{G′} y:A. So, by the induction hypothesis, for all G′-interpretations [[·]], if, for all z: B ∈ Γ, [[z]] ⊩ B then [[y]] ⊩ A. Let [[·]] be any G-interpretation such that, for all z:B ∈ Γ, [[z]] ⊩ B. We must show that [[x]] ⊩ □A.

Let w,v be any worlds such that w ≥ [[x]] and wRv. By the lifting lemma, there is an G-interpretation, [[·]]′, such that [[x]]′ = w and, for all z in G, [[z]]′ ≥ [[z]]. Again, by the monotonicity lemma, for all z: C ∈ Γ, [[z]]′ ⊩ C.

Now [[·]]′ can be trivially extended to an G ∪{xRy}-interpretation (still called [[·]]′) by setting [[y]]′ = v. Therefore, by the induction hypothesis, [[y]]′ ⊩ A, i.e. v ⊩ A. So indeed [[x]] ⊩ □A.

⊠

From the above proof, it can be seen that the failure of the lifting lemma is the only obstruction to a general soundness theorem for arbitrary graphs. It is easily seen that, in any cartesian birelation model, the property of the lifting lemma does hold for arbitrary graphs. So the class of cartesian models gives a sound and complete interpretation to the full consequence relation of N_{□♢}. But, given the connection between cartesian birelation models and IL-models, this is hardly surprising. One might as well work with IL-models.

However, the lifting lemma suggests considering a wider class of birelation models. Call a birelation model graph consistent if, for all graphs G, the property of the lifting lemma is satisfied. It is easy to see that the class of cartesian models is strictly contained in the class of graph consistent models. But the problematic model of Figure 8–1 is clearly not graph consistent. Indeed, by the remarks above, the class of graph consistent models also gives a sound and complete interpretation to the full consequence relation of N_{□♢}. However, the notion of graph consistency is rather inelegant, and we lack at present a more reasonable reformulation. So, apart from the odd remark, we shall not consider the class of graph consistent models further.

Instead, we shall consider arbitrary birelation models and restrict attention to consequences over trees, or even theoremhood. (The close connection between consequences over trees and theoremhood was brought out in Chapter 6.)

8.1.3 Extension to N_{□♢}(T )

The first problem in extending Theorem 8.1.1 to N_{□♢}(T ) for arbitrary T is which class of birelation models to consider. The natural candidate is the class of all birelation models, (W, ≤, R, V), such that (W, R) ⊧_{CL} T . Let us call such models the birelation models of T . However, the example of Section 6.3 shows that even theoremhood in N_{□♢}(χ_{2}) is not sound relative to the class of all birelation models of χ_{2}.

A second problem arises with completeness. Given an IT -model K, it is not necessarily the case that B_{K} is a birelation model of T . For example, consider what happens if T = {∀xy. xRy}.

In general, we do not have a good solution to these problems. (Although the problem with soundness can be avoided by restricting to the class of graphconsistent birelation models of T , relative to which the full consequence relation of N_{□♢}(T ) is sound.) Instead we state a solution for a restricted class of T . Let T be any of the basic geometric theories within the scope of Theorem 6.2.1. Then:

Theorem 8.1.4 Let G be a tree. Then the following are equivalent:

1. Γ ⊢_{G}^{T} x:A.

2. For all birelation models B of T , for all G-interpretations [[·]] in B, if, for all z:B ∈ Γ, [[z]] ⊩_{B} B then [[x]] ⊩_{B} A.

Completeness follows from the observation that, for the T considered, given any IT -model K, the model B_{K} is indeed a birelation model of T . Soundness is more difficult because the use of (R_{χ}) rules means that derivations in N_{□♢}(T ) involving excursions through non-tree consequences are unavoidable. The easiest proof of soundness uses the modified sequent system L′_{□♢}(T , ∅) when χ_{D} ∉ T and the system L′_{□♢}(T \{χ_{D}}, {χ_{D}}) when χ_{D} ∈ T . For in these systems, excursions through non-tree graphs can be avoided by the use of T -closure in the (□L)_{T_{H}} and (♢R)_{T_{H}} rules.

Note that, for any T ⊆ {χ_{D}, χ_{T} , χ_{B}, χ_{4}, χ_{5}}, Theorems 6.2.1 and 8.1.4 imply the soundness and completeness of the corresponding IKS_{1}… S_{n} relative to its birelation models. However, these results are obtained more easily by considering the Hilbert systems directly (as in Section 3.3).

8.2 The finite model property

In this section we show that birelation models do have at least one significant advantage over IL-models. Define:

Dec_{L} = {IK, IKD, IKB, IT, IKDB, IKTB, IS5}.

Thus Dec_{L} is just the set of intuitionistic modal logics highlighted in Figure 7–5 (page 132) as those known to be decidable.

Theorem 8.2.1 (Finite model property) Let L be any logic in Dec_{L}. If A is not a theorem of L then there exists a finite birelation model, B, of L such that B |̸= A.

Because of the problems highlighted in Section 8.1, we do not consider an analogue for the corresponding natural deduction consequence relations. However, for consequences over trees, there is no problem in doing so. (Indeed, the corresponding theorem follows from Theorem 8.2.1 and the equivalence between theoremhood and consequences over trees established in Chapter 6.)

First we give a simple example to show that the finite model property fails for IL-models.

Proposition 8.2.2 □¬¬A ⊃ ¬¬ □ A is valid in any IL-model:

(W, ≤, {D_{w}}_{w∈W} , {R_{w}}_{w∈W} , {α_{w}}_{w∈W})

in which W is finite.

Proof. Suppose W is finite. Suppose that w, d ⊩ □¬¬A for some w ∈ W and d ∈ D_{w}. Consider any maximal w′ ≥ w and d′ ∈ D_{w′} such that R_{w′}(d, d′). Then w′, d′ ⊩ ¬¬A and so w′, d′ ⊩ A as w′ is maximal. So w′, d ⊩ □A (again as w′ is maximal). But then w′, d ⊩ □A for all maximal w′ ≥ w and, as W is finite, for every w′′ ≥ w there is some maximal w′ ≥ w′′. So indeed w, d ⊩ ¬¬ □ A. ⊠ However, for any L in Dec_{L}, the formula □¬¬α ⊃ ¬¬ □ α is not a theorem of L. A finite birelation model invalidating the formula is given by the two point model:

\begin{matrix}w′ \{α\} \\ w & [figure] \end{matrix}

where w ≤ w′. This is clearly a birelation model of any L in Dec_{L}. Furthermore, w ⊩ □¬¬α and w ⊮ ¬¬ □ α so indeed w ⊮ □¬¬α ⊃ ¬¬ □ α. It is also easy to find infinite IL-models invalidating the formula. This simple counterexample to the finite model property for IL-models was observed (in the case of IS5) by Ono and Suzuki [62, p. 85].

Theorem 8.2.1 is already known in the case that L is IS5 (see page 57 for discussion and references). For the other logics, the finite model property would follow from claims made by Ewald [20] for his intuitionistic tense logics. Indeed Ewald’s motivation for introducing birelation models (as ‘decidability’ models) was in order to establish the finite model property. However, as pointed out to me by Colin Stirling, the ‘proof’ given by Ewald [20, §4] is incorrect. We now outline Ewald’s argument, pinpointing his mistake and showing the difficulty in patching his proof. For the purpose of the discussion, we restrict attention to IK.

Ewald’s attempted proof adapts the filtration technique of classical modal logic (see, e.g., Chellas [13]). Suppose A is not a theorem of IK. Let B = (W, ≤, R, V) be the canonical birelation model of IK as defined on page 52. (Throughout this discussion we use the notation established on page 52.) Let Φ be the closure of the set of subformulae of A under the propositional connectives: ⊥, ∧, ∨ and ⊃. We define an equivalence relation, ∼, on W by:

X ∼ Y iff X ∩ Φ = Y ∩ Φ

The structure B/∼ = (W/∼, ≤′, R′, V′) is defined by:

[X] ≤′ [Y] iff there exist X′ and Y′ such that X ∼ X′ ≤ Y′ ∼ Y
[X] R′ [Y] iff there exist X′ and Y′ such that X ∼ X′ R Y′ ∼ Y
V′([X]) = V (X) ∩ Φ

Ewald claims that B/∼ is a finite birelation model invalidating A. However, although it is a birelation model invalidating A, it is not in general finite. Ewald’s claim is based on the false statement that the quotient of Φ by intuitionistic equivalence is finite [20, bottom of p. 173]. The quotient is infinite because it is the free Heyting algebra on a finite set of generators and, despite Ewald’s statement to the contrary, it is well known that the free Heyting algebra on even a single generator is infinite (see, e.g., van Dalen [14, p. 262]). (Ewald mistakenly cites references to the free distributive lattice, which, although it is a finite Heyting algebra, is not a free one.)

It is clear that B/∼ would not be infinite if the set Φ were not infinite. Indeed, in filtration proofs in classical modal logic, the equivalence relation on the canonical model is usually based on the finite set of subformulae of A. However, we now show why Ewald required Φ to be closed under the propositional connectives. The problem arises in showing that B/∼ is indeed a birelation model. For this, one must show that ≤′ is a partial order and that B/∼ satisfies the frame conditions. As on page 174 of [20], these requirements follow from:

Lemma 8.2.3 (Ewald [20, Lemma 11]) If X ≤ X′ and X ∼ Y then there exists Y′ such that Y ≤ Y′ and X′ ∼ Y′.

Proof. Suppose that X ≤ X′ and X ∼ Y. Define

Y′_{0} = Y ∪ (X′ ∩ Φ).

We claim that Y′_{0} ⊬ {C ∈ Φ | C ∉ X′}. For otherwise we would have:

Y, B_{1}, …, B_{m} ⊢ C_{1}, …, C_{n}

where B_{i} ∈ X′ ∩ Φ and C_{j} ∈ {C ∈ Φ | C ∉ X′}. Whence Y ⊢ B ⊃ C where B = B_{1} ∧…∧B_{m} and C = C_{1} ∨…∨C_{n}. Then, by deductive closure, B ⊃ C ∈ Y.

Now B ⊃ C ∈ Φ, as Φ is closed under the propositional connectives. So, because X ∼ Y, we have that B ⊃ C ∈ X. Then B ⊃ C ∈ X′, whence C ∈ X′, by the deductive closure of X′. So it follows from the disjunction property for X′ that some C_{j} ∈ X′. This is a contradiction, so the claim that Y′_{0} ⊬ {C ∈ Φ | C ∉ X′} is justified. Therefore, by Lemma 3.3.2, there exists a prime Y′ ≥ Y_{0} such that Y′ ⊬ {C ∈ Φ | C ∉ X′}. Clearly this is the required Y′ such that Y ≤ Y′ and X′ ∼ Y′. ⊠ Thus the closure of Φ under the propositional connectives is crucial to the proof of the lemma.

We have not shown that there is no variant of B/∼, based on a finite Φ, that will work. For example, using different definitions, it might be possible to circumvent the above proof. However, it seems that, whatever approach one takes, it really is necessary to build up logically complex formulae in order to establish the frame conditions. For example, the proof on page 53 that B satisfies (F2) again involves the construction of a formula of the form (A_{1} ∧ … ∧ A_{m}) ⊃ (B_{1} ∨ … ∨ B_{n}). Thus the possibility of using a finite Φ seems unlikely.

There still remains the possibility of using the infinite Φ defined above, but quotienting it by a coarser relation than intuitionistic equivalence so that a finite quotient of the free Heyting algebra is obtained. Suppose we have such a finite Heyting algebra. (Such quotients exist as, e.g., the free distributive lattice generated by the subformulae of A is one.) Let Φ′ ⊆ Φ be the set of formulae equivalent to the top element in the resulting algebra. The aim is to quotient B by the partial equivalence relation:

X ∼′ Y iff Φ′ ⊆ X ∩ Y and X ∩ Φ = Y ∩ Φ,

constructing a birelation model B/∼′ analogously to B/∼. If Φ′ ⊬ A in IK, one can show that B/∼′ is indeed a finite birelation model invalidating A. The problem lies in finding a finite quotient of Φ such that Φ′ ⊬ A. We do not know how to achieve this. For example, there seems to be no guarantee that the intuitionistically invalid equivalences in the free distributive lattice interact safely with the modalities so that indeed Φ′ ⊬ A in IK.

We turn instead to our proof of Theorem 8.2.1. As the theorem is already known for IS5, we consider only the other cases (for which we can give a uniform proof). In Section 8.3, we shall indicate how our techniques can also be extended to IS5.

Henceforth, we fix L as any logic in Dec_{L} other than IS5. Let T be its associated basic geometric theory. Thus T ⊆ {χ_{D}, χ_{T} , χ_{B}}. Let A be any modal formula.

Our proof proceeds as follows. First (in Section 8.2.1) we construct an IT - model out of bounded contexts (as defined in Section 7.3.1), where the bounding depth is determined by the modal depth of A. The model has the property that, whenever A is not a theorem of L, it invalidates A. (Thus we reprove known completeness results using a ‘bounded’ model.) Although the constructed model is in general infinite (which Proposition 8.2.2 shows to be unavoidable), the boundedness enables the eventual construction of a finite birelation model to go through. From the IT -model we obtain a birelation model of L using the construction of Section 8.1. Again this model is, in general, infinite. The desired finite model is obtained by quotienting the infinite one by a preorder (actually the preorder on pcontexts used in the decidability proof of Section 7.3). In Section 8.2.2 we present the general quotienting technique applied. The application of the technique to obtain the required finite model from our constructed model is given in Section 8.2.3.

8.2.1 Constructing a bounded model

In this subsection we construct an infinite IT model, K, in which, whenever A is not a theorem of L, there is a world w with an element e ∈ D_{w} such that w, e ⊮_{K} A. The construction closely follows the earlier completeness proof of Section 5.3. However, this time we build the model out of the bounded contexts introduced in Section 7.3.1. From it we obtain an infinite birelation model of L by the construction of Section 8.1

Henceforth we fix: G = τ (the trivial graph); X = {x} (its underlying set); Θ = {A, ♢⊤}. (The inclusion of ♢⊤ in Θ is to enable a smooth treatment of seriality, as will be seen below.) Recall the notation for modal depth and (bounded) subformula closure on page 133. Define d = ||Θ||. The model will be constructed out of bounded contexts as defined on page 134. However, as G = τ we can give the following simplified definition of bounded contexts. A bounded context is a pair (H, Δ) (with all prefixes in Δ contained in H) such that:

1. H is a finite tree of depth ≤ d with root x, and

2. if y:B ∈ Δ then B ∈ Θ_{d−n}^{∗} where n is the depth of y in H.

As in Section 5.3, we write (H, Δ) ⊆ (H′, Δ′) to mean that H ⊆ H′ and Δ ⊆ Δ′. A bounded context (H, Δ) is said to be T -prime if it satisfies the following conditions.

1. If y has depth n in H and B ∈ Θ_{d−n}^{∗} then Δ ⊢_{H}^{T} y : B implies y : B ∈ Δ. (Bounded deductive closure.)

2. Δ ⊬_{H}^{T} x:⊥. (Consistency.)

3. If y:B ∨ C ∈ Δ then y:B ∈ Δ or y:C ∈ Δ. (Disjunction property.)

4. If y:♢B ∈ Δ then there exists z such that yRz in H and z:B ∈ Δ. (Diamond property.)

Lemma 8.2.4 (Bounded prime lemma) If (H, Δ) is a bounded context and Δ ⊬_{H}^{T} y:B then there is a T -prime bounded context (H′, Δ′) with (H′, Δ′) ⊇ (H, Δ) such that Δ′ ⊬_{H′}^{T} y:B.

Proof. Suppose (H, Δ) is a bounded context and Δ ⊬_{H}^{T} y : B. We define a sequence of bounded contexts: (H_{−1}, Δ_{−1}) ⊆ (H_{0}, Δ_{0}) ⊆ … ⊆ (H_{d}, Δ_{d}) starting with (H_{−1}, Δ_{−1}) = (H, Δ). Then we define (H′, Δ′) = (H_{d}, Δ_{d}).

Each (H_{m}, Δ_{m}) (where 0 ≤ m ≤ d) is itself defined by iterative approximations from (H_{m−1}, Δ_{m−1}). Consider the finite set:

{x′:A′ ∈ Θ_{d−m}^{∗}|x′ has depth m in H_{m−1}}

which we write as {x_{m}^{1} : A_{m}^{1}, …, x_{m}^{n_{m}} : A_{m}^{n_{m}}}. The approximations, (H_{m}^{i}, Δ_{m}^{i}) (0 ≤ i ≤ n_{m}) are defined by:

(H_{m}^{0}, Δ_{m}^{0}) = (H_{m−1}, Δ_{m−1})

(H_{m}^{i+1}, Δ_{m}^{i+1}) = \{ \begin{matrix}(H_{m}^{i}, Δ_{m}^{i}) if Δ_{m}^{i}, x_{m}^{i+1} :A_{m}^{i+1} ⊢_{H_{m}^{i}}^{T} y:B, \\ (H_{m}^{i}, Δ_{m}^{i} ∪ \{x_{m}^{i+1} :A_{m}^{i+1}\}) if Δ_{m}^{i}, x_{m}^{i+1} :A_{m}^{i+1} ⊬_{H_{m}^{i}}^{T} y:B and \\ A_{m}^{i+1} is not of the form ♢A′, \\ (H_{m}^{i} ∪ \{x_{m}^{i+1}Rz\}, Δ_{m}^{i} ∪ \{x_{m}^{i+1} :A_{m}^{i+1}, z:A′\}) \\ if Δ_{m}^{i}, x_{m}^{i+1} :A_{m}^{i+1} ⊬_{H_{m}^{i}}^{T} y:B and A_{m}^{i+1} is of the form ♢A′, where \\ z is any chosen variable not in H_{m}^{i}. \end{matrix}

(H_{m}, Δ_{m}) is defined to be (H_{m}^{n_{m}}, Δ_{m}^{n_{m}}).

By construction (H_{d}, Δ_{d}) is clearly a bounded context. Before showing that it is T -prime, we prove a useful property. Suppose that x′ has depth m in H_{d} and A′ ∈ Θ_{d−m}^{∗}. Then:

x′:A′ ∈ Δ_{d} if and only if Δ_{d}, x′:A′ ⊬_{H_{d}}^{T} y:B.  (8.1)

For the ‘if’ direction suppose that Δ_{d}, x′ : A′ ⊬_{H_{d}}^{T} y : B. We must have that x′ : A′ = x_{m}^{i+1} : A_{m}^{i+1} for some i (0 ≤ i ≤ n_{m} − 1) so, by the assumption, it is clear that Δ_{m}^{i}, x′ : A′ ⊬_{H_{m}^{i}}^{T} y : B. Then, by the definition of Δ_{m}^{i+1}, we have that x′:A′ ∈ Δ_{m}^{i+1}. Therefore x′:A′ ∈ Δ_{d}.

The converse just says that Δ_{d} ⊬_{H_{d}}^{T} y: B. For this it is enough to show that Δ_{m}^{i+1} ⊬_{H_{m}^{i+1}}^{T} y:B given that Δ_{m}^{i} ⊬_{H_{m}^{i}}^{T} y:B. This is clear if (Δ_{m}^{i+1}, H_{m}^{i+1}) is obtained by either of the first two clauses in its definition. For the third clause we have that Δ_{m}^{i}, x_{m}^{i+1} : ♢A′ ⊬_{H_{m}^{i}}^{T} y : B, that H_{m}^{i+1} = H_{m}^{i} ∪ {x_{m}^{i+1}Rz} for some z not in H_{m}^{i}, and that Δ_{m}^{i+1} = Δ_{m}^{i} ∪ {x_{m}^{i+1} : ♢A′, z: A′}. Suppose, for contradiction, that Δ_{m}^{i+1} ⊢_{H_{m}^{i+1}}^{T} y:B. Then Δ_{m}^{i}, x_{m}^{i+1} :♢A′, z:A′ ⊢_{H_{m}^{i}∪{x_{m}^{i+1}Rz}}^{T} y:B from which it follows by the (♢E) rule that Δ_{m}^{i}, x_{m}^{i+1} :♢A′ ⊢_{H_{m}^{i}}^{T} y:B, giving the required contradiction.

We now prove that the bounded context (H_{d}, Δ_{d}) is indeed T -prime. We have just seen that Δ_{d} ⊬_{H_{d}}^{T} y:B from which consistency trivially follows. For deductive closure, suppose that Δ_{d} ⊢_{H_{d}}^{T} x′: A′ where x′ has depth m in Θ^{∗} and A′ ∈ Θ_{d−m}^{∗}. Then clearly Δ_{d}, x′ : A′ ⊬_{H_{d}}^{T} y : B. So, by (8.1) above, x′ : A′ ∈ Δ_{d} as required. For the disjunction property, suppose, for contradiction, that x′ : A′ ∨ B′ ∈ Δ_{d}, x′ : A′ ∉ Δ_{d} and x′ : B′ ∉ Δ_{d}. Then, by (8.1) above, Δ_{d}, x′ : A′ ⊢_{H_{d}}^{T} y : B and Δ_{d}, x′ : B′ ⊢_{H_{d}}^{T} y : B. But trivially Δ_{d} ⊢_{H_{d}}^{T} x′ : A′ ∨ B′ so, by the (∨E) rule, Δ_{d} ⊢_{H_{d}}^{T} y:B, giving the required contradiction. Lastly, for the diamond property, suppose that x′ : ♢A′ ∈ Δ_{d}. Then, setting m to be the depth of x′ we have x′: ♢A′ = x_{m}^{i+1} : A_{m}^{i+1} for some i (0 ≤ i ≤ n_{m} − 1). It is clear, from the definition of Δ_{m}^{i+1} by the third clause, that for some z, z:A′ ∈ Δ_{m}^{i+1} ⊆ Δ_{d}. ⊠

The bounded IT -model will be constructed out of T -prime bounded contexts analogously to the construction of K^{T} on page 93. However, for non-empty T , it necessary first to complete H from a T -prime bounded context, (H, Δ), into a classical model of T . Let Y be the underlying set of H. The T -completion, T -Comp(H), of H is the graph whose underlying set is Y and whose relation is defined by: yRz in T -Comp(H) if one of:

1. yRz in H,

2. y = z and either χ_{T} ∈ T or both χ_{D} ∈ T and y has depth d in H,

3. zRy in H and χ_{B} ∈ T .

Thus if χ_{D} ∉ T then T -Comp(H) is the T -closure of H as defined on page 129. Note that if yRz in T -Comp(H) and if the depths of y and z in H are d_{y} and d_{z} respectively then d_{z} ≤ 1 + d_{y} (cf. Lemma 7.3.4). Note also that H ⊆ H′ implies T -Comp(H) ⊆ T -Comp(H′).

Lemma 8.2.5 If (H, Δ) is a T -prime bounded context then T -Comp(H) ⊧_{CL} T .

Proof. It is easy to see that T -Comp(H) is reflexive if χ_{T} ∈ T and is symmetric if χ_{B} ∈ T . We show that if χ_{D} ∈ T then T -Comp(H) is serial. Let y be any node in H. We must show that there exists z such that yRz in T -Comp(H). If y has depth n < d then ♢⊤ ∈ Θ_{n−d}^{∗} and ⊢_{H}^{T} y: ♢⊤. So, by bounded deductive closure, y: ♢⊤ ∈ Δ. But then, by the diamond property, there exists z such that yRz in H. So yRz in T -Comp(H). Otherwise, if y has depth d then yRy in T -Comp(H). ⊠

We now construct the bounded canonical model,

K = (W, ≤, {D_{w}}_{w∈W} , {R_{w}}_{w∈W} , {α_{w}}_{w∈W}).

Define:

W = the set of T -prime bounded contexts,
(H, Δ) ≤ (H′, Δ′) iff (H, Δ) ⊆ (H′, Δ′),
D_{(H,Δ)} = the underlying set of H,
R_{(H,Δ)}(x, y) iff xRy in T -Comp(H),
α_{(H,Δ)}(x) iff x:α ∈ Δ.

Clearly all the conditions on being a IT -model are satisfied by K, in particular, by Lemma 8.2.5, each (D_{(H,Δ)}, R_{(H,Δ)}) is a classical model of T

Lemma 8.2.6 (Bounded canonical model lemma) Let (H, Δ) be any T -prime bounded context. If y has depth n in H and B ∈ Θ_{d−n}^{∗} then (H, Δ), y ⊩_{K} B if and only if y:B ∈ Δ.

Proof. As in the proof of Lemma 5.3.2, we show, by a case analysis on the structure of B, that the inductive clauses defining the satisfaction relation (H, Δ), y ⊩ B are mimicked by the membership relation y: B ∈ Δ (where y has depth n in H and B ∈ Θ_{d−n}^{∗}). The cases in which the main connective in B is not a modality are similar to their counterparts in Lemma 5.3.2. So we consider only the modal cases, which differ because of the definition of R_{(H,Δ)}.

□B. We show that y: □B ∈ Δ if and only if, for all (H′, Δ′) ≥ (H, Δ) and all z, yRz in T -Comp(H′) implies z:B ∈ Δ′.

⟹ Suppose y: □B ∈ Δ, (H′, Δ′) ≥ (H, Δ) and yRz in T -Comp(H′). Let d_{y} and d_{z} be respectively the depths of y and z in H′. Note that, as y:□B ∈ Δ, we have that d_{y} < d. We shall show that Δ′ ⊢_{H′}^{T} z:B, from which z:B ∈ Δ′ follows by bounded deductive closure, as d_{z} ≤ d_{y} + 1.

Clearly Δ′ ⊢_{H′}^{T} y:□B. The derivation of Δ′ ⊢_{H′}^{T} z:B from this depends on the reason why yRz in T -Comp(H′). If yRz in H′ then Δ′ ⊢_{H′}^{T} z:B is derived by an application of (□E). If y = z then, as d_{y} < d, we have χ_{T} ∈ T , so Δ′ ⊢_{H′}^{T} z:B is derived by (□E) followed by (R_{T}). Similarly if zRy in H′ then χ_{B} ∈ T and the consequence is derived by way of (□E) and (R_{B}).

⟸ Suppose that, for all (H′, Δ′) ≥ (H, Δ), we have that yRz in H′ implies z:B ∈ Δ′. Let z be some variable not in H. Suppose, for contradiction, that Δ ⊬_{H∪{yRz}}^{T} z : B. Then, by the bounded prime lemma, there is a T -prime bounded context (H′, Δ′) ⊇ (H ∪ {yRz}, Δ) such that Δ′ ⊬_{H′}^{T} z:B. But then (H′, Δ′) ≥ (H, Δ), and yRz in H′ and z:B ∉ Δ′, contradicting the initial supposition. So Δ ⊢_{H∪{yRz}}^{T} z: B where z not in H. Hence, by (□I), we have that Δ ⊢_{H}^{T} y:□B. So, by deductive closure, y:□B ∈ Δ.

♢B. We show that y : ♢B ∈ Δ if and only if there exists z such that yRz in T -Comp(H) and z:B ∈ Δ.

⟹ Immediate from the diamond property of (H, Δ). ⟸ Suppose, for some z, yRz in T -Comp(H) and z:B ∈ Δ. Then using the

(♢I) rule together with, when appropriate, (R_{T}) or (R_{D}), one derives that Δ ⊢_{H}^{T} y:♢B. So, by deductive closure, y:♢B ∈ Δ.

⊠

For the proof of the finite model property we begin with the cartesian birelation model constructed from K above by the method of Section 8.1.1. A more explicit description of this model, B_{K} = (W_{K}, ≤_{K}, R_{K}, V_{K}), is (recall the definition of pcontext on page 138):

W_{K} = the set of pcontexts, (H, Δ, y), such that

(H, Δ) is T -prime,

(H, Δ, y) ≤_{K} (H′, Δ′, y′) iff (H, Δ) ⊆ (H′, Δ′) and y = y′,
(H, Δ, y)R_{K}(H′, Δ′, y′) iff (H, Δ) = (H′, Δ′) and yRy′ in T -Comp(H),
V (H, Δ, y) = {α | y:α ∈ Δ}.

By the remarks in Section 8.1.3, B_{K} is indeed a birelation model of L.

By its construction, B_{K} is, in general, infinite. Just as in the earlier proof of decidability we had to contend with a possibly infinite number of sequents, here we have a possibly infinite number of (T -prime) pcontexts. Once more we appeal to the preorder on pcontexts defined in Section 7.3.2. We shall use this to quotient B_{K} into a finite model.

8.2.2 Quotienting a birelation model

First we describe the general quotienting technique. Let B = (W, ≤, R, V) be an arbitrary birelation model. Let ≾ be any preorder on W. We write ≂ for the equivalence relation induced by ≾. We say that ≾ is a birelation simulation (henceforth just simulation) if the conditions below are satisfied.

1. w ≾ w′ implies V (w) ⊆ V (w′).

2. w ≤ w′ implies w ≾ w′.

3. w ≾ \overline{w}′ implies there exists w′ such that w ≤ w′ ≂ \overline{w}′.

4. w ≾ \overline{w} and wRv implies there exists \overline{v} such that v ≾ \overline{v} and \overline{w}R\overline{v}.

5. w ≾ \overline{w}R\overline{v} implies there exist w′, v′ such that w ≤ w′Rv′ ≾ \overline{v}.

Diagrammatically, 3, 4 and 5 are:

[figure: \overline{w}′; ^{. . . . . . . . . . ≂}; w′; \overline{w}; .; .; .; .; .; .; .; .; .; .; .; R; \overline{v}; \overline{w}; R; \overline{v}]
3. \begin{matrix}. & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . & . \\ ≤ \end{matrix}  5.
4.  w′ . . . . . . . . . .^{R ^{}}v′^{. . . . . . . . .≾}

\begin{aligned}. & . & . & . & . & . & . & . & . & . & . & . & . & . \\ & & & & & & & ≤ \end{aligned}

w ≾  w ≾  \overline{R ^{}}v^{. . . . . . . . . . . . . . . . . . . . . . .≾}  w ≾

The reason for imposing these conditions is that they are the weakest, natural conditions we could find that both apply to our intended application (the pcontext preorder on the birelation model B_{K}) and which enable the following construction and ‘quotient lemma’ to go through.

Henceforth let ≾ be a simulation. Define B/≾ = (W/≂, ≾/≂, \overline{R}, \overline{V}) where:

[w]\overline{R}[v] iff there exist w′, v′ such that w ≂ w′Rv′ ≂ v,
\overline{V} ([w]) = V (w).

(Henceforth we write ≾ for ≾ /≂.) That \overline{V} is well defined follows from condition 1 on ≾ being a simulation. To see that the frame conditions hold:

(F1) Suppose [w] ≾ [w′] and [w]\overline{R}[v]. Consider the diagram:

[figure: w′; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; .; R; v′; w; ≾; \overline{≂}; \overline{w}; R; \overline{v}; ^{. . . . . . . . . .≾}; \overline{≂}; v]

Here \overline{w} and \overline{v} exist because [w]\overline{R}[v]. Then \overline{w} ≾ w′ so, by condition 4, there exists v′ such that \overline{v} ≾ v′ and w′Rv′. But then [v′] is the required world as [v] ≾ [v′] and [w′]\overline{R}[v′].

(F2) Suppose that [w]\overline{R}[v] ≾ [v′]. Consider the diagram:

[figure: \overline{w}′; .; .; .; .; .; .; .; .; .; .; R; \overline{v}′; ^{. . . . . . . . . . . ≂}; v′; w; \overline{≂}; \overline{w}; ^{≤. . . . . . . . . .}; R; \overline{v}; ^{≤. . . . . . . . . .}; \overline{≂}; v; ≾]

Here \overline{w} and \overline{v} exist because because [w]\overline{R}[v]. Then \overline{v} ≾ v′, so \overline{v}′ can be found by condition 3. \overline{w}′ is then found by (F2) in B. Now [w] ≾ [\overline{w}′]\overline{R}[v′], so [\overline{w}′] is the required world.

Note that (F1) for B/≾ can also be proved using condition 3 together with (F1) for B in a manner analogous to the proof of (F2) above.

Next we show that if B is a birelation model of L then so is B/≾.

Lemma 8.2.7 If R is serial, reflexive or symmetric then \overline{R} is serial, reflexive or symmetric respectively.

Proof. Seriality and reflexivity are trivially inherited. For symmetry, suppose that [w]\overline{R}[v]. Then there exist w′, v′ such that w ≂ w′Rv′ ≂ v. So v′Rw′, by the symmetry of R. Thus v ≂ v′Rw′ ≂ w and indeed [v]\overline{R}[w]. ⊠ Interestingly, it is not in general the case that \overline{R} is transitive if R is. However, we are not dealing with any logic requiring a transitive visibility relation.

The important connection between B and B/≾ is:

Lemma 8.2.8 (Quotient lemma) For all w ∈ W, w ⊩_{B} B if and only if [w] ⊩_{B/≾} B.

Proof. By induction on the structure of B. We consider a selection of cases.

α. For atomic α we have w ⊩_{B} α if and only if α ∈ V (w) if and only if α ∈ \overline{V} ([w]) if and only if [w] ⊩_{B/≾} α.

B ⊃ C. ⟹ Suppose w ⊩_{B} B ⊃ C, i.e. for all w′ ≥ w, w′ ⊩_{B} B implies w′ ⊩_{B} C. Consider an arbitrary [w′] ≿ [w] such that [w′] ⊩_{B/≾} B. We must show that [w′] ⊩_{B/≾} C.

By condition 3 there exists u such that w ≤ u ≂ w′. Now [u] ⊩_{B/≾} B (as [u] = [w′]) so, by the induction hypothesis, u ⊩_{B} B whence, by the initial supposition, u ⊩_{B} C. Thus, again by the induction hypothesis,

[u] ⊩_{B/≾} C, i.e. [w′] ⊩_{B/≾} C as required.

⟸ Suppose [w] ⊩_{B/≾} B ⊃ C, i.e. for all [w′] ≿ [w], [w′] ⊩_{B/≾} B implies [w′] ⊩_{B/≾} C. Consider an arbitrary w′ ≥ w such that w′ ⊩_{B} B. We must show that w′ ⊩_{B} C. Now, by condition 2, [w′] ≿ [w] and, by the induction hypothesis, [w′] ⊩_{B/≾} B so [w′] ⊩_{B/≾} C. Thus, again by the induction hypothesis, w′ ⊩_{B} C.

□B. ⟹ Suppose w ⊩_{B} □B, i.e. for all w′, v′, w ≤ w′Rv′ implies v′ ⊩_{B} B. Consider an arbitrary [w′], [v′] with [w] ≾ [w′]\overline{R}[v′]. We must show that [v′] ⊩_{B/≾} B. As [w′]\overline{R}[v′], there exist \overline{w}′, \overline{v}′ such that w′ ≂ \overline{w}′R\overline{v}′ ≂ v′. Now w ≾ \overline{w}′ so, by condition 5, there exist w′′, v′′ such that w ≤ w′′Rv′′ ≾ \overline{v}′. But then, by the initial assumption, v′′ ⊩_{B} B. So, by the induction hypothesis, [v′′] ⊩_{B/≾} B. But [v′′] ≾ [v′] so, by the monotonicity lemma, [v′] ⊩_{B/≾} B.

⟸ Suppose [w] ⊩_{B/≾} □B, i.e. for all [w′], [v′], [w] ≾ [w′]\overline{R}[v′] implies [v′] ⊩_{B/≾} B. Consider an arbitrary w′, v′ with w ≤ w′Rv′. We must show that v′ ⊩_{B} B. By condition 2, [w] ≾ [w′] and clearly [w′]\overline{R}[v′] so [v′] ⊩_{B/≾} B. Thus, by the induction hypothesis, v′ ⊩_{B} B as required.

♢B. ⟹ Suppose w ⊩_{B/≾} ♢B, i.e. there exists v such that wRv and v ⊩_{B} B. Then [w]\overline{R}[v] and, by the induction hypothesis, [v] ⊩_{B/≾} B so indeed [w] ⊩_{B/≾} ♢B.

⟸ Suppose [w] ⊩_{B/≾} ♢B, i.e. there exists [v] such that [w]\overline{R}[v] and [v] ⊩_{B/≾} B. So there exist \overline{w}, \overline{v} such that w ≂ \overline{w}R\overline{v} ≂ v. Then, by condition 4, there exists \overline{v}′ ≿ \overline{v} such that wR\overline{v}′. But clearly v ≾ \overline{v}′ so, by the monotonicity lemma, [\overline{v}′] ⊩_{B/≾} B. Hence, by the induction hypothesis, \overline{v}′ ⊩_{B} B and thus w ⊩_{B} ♢B as required.

⊠ Note that condition 4 was only used in the, apparently weaker, form: if w ≂ \overline{w} and wRv then there exists \overline{v} such that v ≾ \overline{v} and \overline{w}R\overline{v}. However, using condition 3 together with (F1) for B, it can be shown that the two formulations are equivalent.

8.2.3 Applying the quotienting technique

We now proceed with the proof of the finite model property. The preorder on B_{K} is just the preorder, ≾, on pcontexts defined on page 138.

Lemma 8.2.9 ≾ is a simulation on B_{K}.

Proof. We show that conditions 1–5 are satisfied.

1. Immediate from the definitions of ≾ and V_{K}.

2. Trivial as the inclusion function gives the required morphism.

3. Suppose that (H, Δ, y) ≾ (H′, Δ′, z) on account of the pcontext morphism f. We define a world, (H′′, Δ′′, y), in B_{K} such that (H, Δ, y) ≤_{K} (H′′, Δ′′, y) ≂ (H′, Δ′, z).

Let Y and Z be the underlying sets of H and H′ respectively. We assume (for notational convenience) that Y ∩ Z = {x}. We use y′, y′′, … to range over Y and z′, z′′, … to range over Z. Let y_{0}Ry_{1} … Ry_{m} be the unique sequence in H such that y_{0} = x, y_{i+1} ∈ Y \{x} and y_{m} = y. The underlying set of H′′ is:

W = Y ∪ {z ∈ Z | z ≠ f(y_{i}) for any i such that 0 ≤ i ≤ m}.

The relation on H′′ is:

{⟨y′, y′′⟩ | y′Ry′′ in H} ∪ {⟨z′, z′′⟩ | z′Rz′′ in H′} ∪ {⟨y_{i}, z′⟩ | f(y_{i})Rz′ in H′}.

We define functions g : W → Z and h : Z → W by:

g(w) = \{ \begin{matrix}f(w) & if w ∈ Y, \\ w & if w ∈ Z; \end{matrix}

h(z′) = \{ \begin{matrix}y_{i} & if z′ = f(y_{i}) for some i (1 ≤ i ≤ m), \\ z′ & otherwise. \end{matrix}

These are well defined: g because f(x) = x, and h because f(y_{i}) = f(y_{j}) implies i = j = depth of f(y_{i}). Further, it is clear from the definition of H′′ that g is a graph morphism from H′′ to H′ and h is one from H′ to H′′. Note also that g(h(z′)) = z′, for all z′ ∈ Z.

Define Δ′′ by:

Δ′′ = {w:B | g(w):B ∈ Δ′}.

We must show that (H′′, Δ′′, y) is indeed a pcontext. By its construction, it is clear that H′′ is a finite tree of depth ≤ d with root x. That w: B ∈ Δ′′ implies B ∈ Θ_{d−n}^{∗}, where n is the depth of w in H′′, follows because n is the depth of g(w) in H′ and (H′, Δ′) is a bounded context.

For (H′′, Δ′′, y) to be a world in B_{K} we must show that (H′′, Δ′′) is T -prime. For bounded deductive closure, consider any B ∈ Θ_{d−n}^{∗}, where n is the depth of w in H′′, such that Δ′′ ⊢_{H′′}^{T} w : B. Then, by Proposition 4.4.1, g(Δ′′) ⊢_{H′}^{T} g(w) : B, and so (by the definition of Δ′′) Δ′ ⊢_{H′}^{T} g(w) : B. But (H′, Δ′) is T -prime so, by bounded deductive closure, g(w) : B ∈ Δ′. Thus (again by the definition of Δ′′) w : B ∈ Δ′′ as required. For the diamond property, suppose w : ♢B ∈ Δ′′. Then g(w) : ♢B ∈ Δ′. So, by the diamond property for (H′, Δ′), there exists z′ ∈ Z such that g(w)Rz′ in H′ and z′ : B ∈ Δ′. Then clearly h(z′) is the required element of W such that wRh(z′) in H′′ and, as g(h(z′)) = z′, we have that h(z′) : B ∈ Δ′′. Consistency and the disjunction property are shown (more easily) by similar arguments.

It is now obvious that (H, Δ, y) ≤_{K} (H′′, Δ′′, y). To see that (H′′, Δ′′, y) ≂ (H′, Δ′, z) we show that g and h give the required pcontext morphisms. We already know that g is a graph morphism from H′′ to H′. Also, if w:B ∈ Δ′′ then g(w) : B ∈ Δ′ by the definition of Δ′′. Lastly, g(y) = z because g(y) = f(y) and f is a pcontext morphism from (H, Δ, y) to (H′, Δ′, z). Similarly, we already know that h is a graph morphism from H′ to H′′. Also, if z′ : B ∈ Δ′ then, as g(h(z′)) = z′, we have that h(z′) : B ∈ Δ′′ by the definition of Δ′′. Lastly, h(z) = y by the definition of h.

4. Suppose that (H, Δ, y) ≾ (H′, Δ′, z) on account of the pcontext morphism f. Suppose further that (H, Δ, y)R_{K}(H, Δ, y′) (it is immediate from the definition of R_{K} that this is the most general case). Then yRy′ in T -Comp(H). So, depending on T , one of the following holds: yRy′ in H, or y = y′, or y′Ry in H. Thus, correspondingly, one of the following holds: zRf(y′) in H′, or z = f(y′), or f(y′)Rz in H′. So zRf(y′) in T -Comp(H′). Therefore (H, Δ, f(y′)) is the sought world as (H, Δ, z)R_{K}(H, Δ, f(y′)) and, again on account of the morphism f, (H, Δ, y′) ≾ (H′, Δ′, f(y′)).

5. Suppose that (H, Δ, y) ≾ (H′, Δ′, z) on account of the pcontext morphism f, and that (H′, Δ′, z)R_{K}(H′, Δ′, z′). Then zRz′ in T -Comp(H′), and, depending on T , one of the following holds: zRz′ in H′, or z = z′, or z′Rz in H′. We consider each case separately.

If zRz′ in H′ then consider the world (H′′, Δ′′, y) constructed as in the proof of 3 above. We know already that (H, Δ, y) ≤_{K} (H′′, Δ′′, y). It is clearly the case that (H′′, Δ′′, y)R_{K}(H′′, Δ′′, z′). It is also clear that the function g, defined in the proof of 3, is a pcontext morphism witnessing that (H′′, Δ′′, z′) ≾ (H′, Δ′, z′). Thus (H′′, Δ′′, y) and (H′′, Δ′′, z′) are the required worlds.

If z = z′ then yRy in T -Comp(H) and we have that:

(H, Δ, y) ≤_{K} (H, Δ, y) R_{K} (H, Δ, y) ≾ (H′, Δ′, z′).

So both the required worlds are given by (H, Δ, y).

Lastly, if z′Rz in H′ then consider the unique node y′ such that y′Ry in H. Now f(y) = z and z′ is the unique node such that z′Rz in H so, as f is a graph morphism from H to H′, it must be the case that f(y′) = z′. Also, yRy′ in T -Comp(H), as χ_{B} ∈ T . Therefore we have that:

(H, Δ, y) ≤_{K} (H, Δ, y) R_{K} (H, Δ, y′) ≾ (H′, Δ′, z′), the last of these on account of f. So (H, Δ, y) and (H, Δ, y′) are the required worlds.

⊠ Proof of Theorem 8.2.1. Suppose that A is not a theorem of L. We show that A is not valid in B_{K}/≾, which, by Proposition 7.3.6, is finite.

First, by Theorem 6.2.1, we have that ⊬_{τ}^{T} x : A. So, by the bounded prime lemma, there exists a T -prime bounded context, (H, Δ), such that Δ ⊬_{H}^{T} x: A. Now A ∉ Δ so, by the bounded canonical model lemma, (H, Δ), x ⊮_{K} A. Then, by Lemma 8.1.2, (H, Δ, x) ⊮_{B_{K}} A. So, by the quotient lemma, [(H, Δ, x)] ⊮_{B_{K}/≾} A. Thus indeed A is not valid in B_{K}/≾. ⊠ Note that an effective way of computing a bound on the size of B_{K}/≾ from A is implicit in the proof of Proposition 7.3.6.

8.3 Discussion

In Section 8.1 we presented some of the difficulties inherent in using birelation models to directly interpret N_{□♢}(T ). In view of these problems, we believe that IT -models are preferable for this purpose. Indeed, we have only been able to use birelation models to interpret (a restriction of) the natural deduction consequence relation in those cases in which we also happen to have axiomatizations of the theorems of the natural deduction system.

However, in Section 8.2, we showed that birelation models do have one significant advantage over IL-models. With them, it is possible to obtain the finite model property.

Again, it is embarrassing that our method of proving the finite model property does not readily extend to other intuitionistic modal logics, especially IK4, IKD4 and IS4. As in Section 7.3, the technique falls down because of the impossibility of bounding contexts. It seems as though some sort of construction involving cyclic visibility relations ought to work. But so far, we have been unable to succeed in finding one that does.

As in Section 7.3, our techniques do extend to establish the known result that IS5 has the finite model property. Again, the proof for IS5 is quite simple, because contexts can be set-indexed rather than tree-indexed (cf. the discussion on page 147). The potential problem noted on page 169, that the quotient of a transitive birelation model by a simulation need not be transitive, does not arise because for the particular model and simulation of interest the quotient is transitive.

It is interesting to note that, despite appearances, the proof of the finite model property is intuitionistically acceptable. The only non-overtly intuitionistic steps are in the proofs of the bounded prime lemma and the bounded canonical model lemma. However, the intuitionistic validity of these proofs is ensured by the decidability of the modal consequence relation (which was established in Chapter 7 by an intuitionistically acceptable argument). Specifically, in the proof of the bounded prime lemma, decidability rescues the definition of (H_{m}^{i+1}, Δ_{m}^{i+1}) which is by case analysis. Decidability must also be used in establishing the disjunction property for (H_{d}, Δ_{d}) later in the lemma. In the proof of the bounded canonical model lemma, decidability is required in the uses of the bounded prime lemma, which are by contraposition. Lastly, decidability is used once more in obtaining the statement of completeness from its contrapositive.

From a classical point of view, however, no part of the proof of the finite model property relies on the earlier decidability result. Therefore, the proof of the finite model property gives an alternative classical proof of decidability.

Conclusions and further work

9.1 Conclusions

In this thesis we have defined and analysed the proof theory and semantics of a family of intuitionistic modal logics. Moreover, we have presented arguments justifying the naturalness of the particular family of logics considered. As well as resolving open technical questions, we believe that the thesis has provided a valuable structured and coherent account of intuitionistic modal logic.

Our methodology was motivated by the desire to present an account of intuitionistic modal logic acceptable to an intuitionist. This was more than a philosophical whim. It gave crucial orientation when sorting through the many intuitionistically inequivalent choices available. Thus the philosophical desire had direct bearing on the technical development. Our presentation, however, has not always been intuitionistically acceptable. Nevertheless, we have at least taken some care to point out the classical steps in proofs and, whenever possible, how they could be avoided.

Methodologically, the major contributions of the thesis are the two different ways of defining intuitionistic modal logics: by way of the natural deduction system and by way of the translation into intuitionistic first-order logic, and their subsequent equivalence.

Technically, the major contributions of the thesis are: the proof theory of geometric theories; the uniform family of natural deduction systems for intuitionistic modal logics (based on geometric theories) and their normalization results; the meta-logical completeness of the natural deduction systems; the equivalence (and inequivalence) between natural deduction systems and axiomatizations; and, above all, the proofs of decidability and the finite model property.

9.2 Further work

The natural deduction systems presented in this thesis were restricted to intuitionistic modal logics generated by geometric theories of the visibility relation. Similarly, the translational definition of intuitionistic modal logics was restricted to those given by first-order theories. It would be nice to be able to relax these restrictions to yield intuitionistic analogues of classical modal logics defined via higher-order conditions on the visibility relation. One tentative proposal was discussed in Section 5.4. However, we have not investigated this in any depth. Also, we have not investigated ways of extending the natural deduction systems beyond geometric theories of the visibility relation.

However, even remaining within the paradigm of geometric theories, there are natural ways of generalizing the conditions that may be expressed. One such generalization is to geometric theories in the language obtained by extending L_{f} with equality. Then, in order to induce corresponding natural deduction rules, it is necessary to extend the natural deduction systems with a third form of judgement of the form x = y. Again, such judgements need only appear as assumptions. Associated with them is the new inference rule:

\begin{matrix}x = y & x:A \\ y:A \end{matrix}

Then inference rules expressing basic geometric sequents can be be induced exactly as before. One (perhaps not very intuitionistic) example requiring equality is the trichotomy property:

∀xy. xRy ∨ yRx ∨ x = y,

which is represented by the rule:

\begin{aligned}[xRy] ; ⋮ . ; z:A & [yRx] ; ⋮ . ; z:A & [x = y] ; ⋮ . ; z:A \\ & z:A \end{aligned}

We believe that the meta-theoretic properties of N_{□♢}(T ) should extend easily to the system with equality.

Another direction for generalization would be to consider other modal operators. For example, the intuitionistic tense logics of Ewald [20] have ‘backwards’ necessity and possibility operators. These are easily dealt with. The rules for a backwards necessity operator are:

[yRx] ; ⋮ . ; y:A ; x:\overline{□}A  \begin{matrix}x:\overline{□}A & yRx \\ y:A \end{matrix}

where the restriction on the introduction rule is that y must not appear in any open assumptions other than the distinguished occurrences of yRx. The rules for the backwards possibility operator can be easily imagined. Again, the meta-theoretic properties of N_{□♢}(T ) should extend easily to cover the new operators.

We do not really know what the overall limitations of the approach are. But at least the examples above demonstrate some of its potential flexibility.

One major open question left by this thesis is the decidability of those intuitionistic modal logics we were unable to deal with in Chapter 7. We now sketch an alternative approach, which we hope will lead to a proof of the decidability of IS4. We believe that it should be possible to develop a standard cutfree sequent calculus for IS4 (not using relative truth) satisfying the subformula property. Decidability would be an immediate consequence. The major problem with developing a cut-free sequent calculus seems to be the IK axiom schema: (♢A ⊃ □B) ⊃ □(A ⊃ B). However, if we define two subclasses of formula by mutual induction:

P ::= ⊥ | P_{1} ∧ P_{2} | P_{1} ∨ P_{2} | Q ⊃ P | □A
Q ::= ⊥ | Q_{1} ∧ Q_{2} | Q_{1} ∨ Q_{2} | P ⊃ Q | ♢A

and then extend Gentzen’s one-sided sequent calculus for IPL with the rules:

\begin{matrix}{P_{1}, …, P_{k} ⊢ A \atop P_{1}, …, P_{k} ⊢ □A} & {A_{1}, …, A_{k}, A ⊢ B \atop A_{1}, …, A_{k}, □A ⊢ B} \\ {A_{1}, …, A_{k} ⊢ B \atop A_{1}, …, A_{k} ⊢ ♢B} & {P_{1}, …, P_{k}, A ⊢ Q \atop P_{1}, …, P_{k}, ♢A ⊢ Q} \end{matrix}

then, together with the cut rule, the resulting system is sound and complete for IS4. The soundness of the modal rules relies on:

Lemma 9.2.1 P ⊃ □P and ♢Q ⊃ Q are theorems of IS4.

This is proved by a straightforward induction on the structure of P and Q. The system is obviously closed under necessitation and closure under modus ponens is by an application of cut. So completeness follows from easy (cut-free) derivations of the axioms of IS4. But, unfortunately, the cut rule is not eliminable from the system. For example, it is required to derive the sequent:

A, ♢B ⊃ (A ⊃ □C) ⊢ □(B ⊃ C).

However, we have strong reasons (based on a preliminary analysis of a corresponding natural deduction system) to believe that a generalization of the system to one using higher-order sequents (of the form considered in Avron [1]) will satisfy cutelimination. We also have tentative proposals for extending this approach to IK4, IKD4 (and, indeed, the known cases of IK, IKD and IKT).

We do not, however, have any positive suggestions to make regarding the finite model property for IK4, IKD4 and IS4. We believe that it might be possible to extend the techniques of Chapter 8 to deal with these cases. But we have not seen how to do so. In fact we believe that it is plausible, though unlikely, that the finite model property fails for (some of) these logics.

Lastly, we suggest how some of the techniques used in the thesis may be of use in computer science. Modal logic has proved to be a useful tool for the specification of properties of processes arising from process calculi such as Milner’s CCS [58]. Processes are modelled by labelled transition systems, which are, in turn, models of (multi-)modal logic (see, e.g., Stirling [75]). Thus one naturally ascribes modal properties to processes, and one may speak of a process satisfying a formula of a modal program logic such as Hennessy-Milner logic [42].

A typical use of such a modal logic is to formally verify that a process p satisfies a formula A. Therefore it is natural to formulate proof systems manipulating judgements of the form p:A, to be used in establishing such satisfaction relations. For example, Stirling [74] goes to some length to provide such a proof system for CCS processes. However, Stirling’s proof rules are rather ad hoc and it is not clear how they generalize to different process combinators and other process calculi.

We propose to use natural deduction rules like those of N_{□♢} as part of a generic proof system for arbitrary process calculi. The idea is to combine such rules for the connectives and modalities with new introduction and elimination rules for each combinator of the process algebra. The envisaged proof system has two forms of judgement: prefixed formulae of the form p: A where p is any process term (possibly with free variables); and relational judgements of the form p ⟹^{a} p′ (where p and p′ are process terms). Intuitively, the former states that p satisfies A, the latter that p can perform an action a to become p′.

The rules for the connectives and modalities are similar to those of N_{□♢}. As an example, we give the introduction rule for the necessity modality, [a], of Hennessy-Milner logic [42]. The rule is:

[p ⟹^{a} x] ; ⋮ . ; x : A ; p : [a]A

where the process variable x must not occur free in any open assumptions other than in the distinguished occurrences of p ⟹^{a} x.

The introduction and elimination rules for the process combinators are more interesting. These are derived from the operational semantics of the process calculus. Indeed, the introduction rule for a combinator is taken directly from the operational semantics. For example, the introduction rule for the ‘prefixing’ combinator of CCS is:

a.p ⟹^{a} p.

which is just the usual rule defining its operational behaviour [58, p. 46]. The elimination rules for a combinator can be derived automatically from the introduction rules. In the case of prefixing these are:

\begin{matrix}a.p ⟹^{a} q & c[p] : A \\ c[q] : A \end{matrix}  {a.p ⟹^{b} q \atop c[q] : A} b ≠ a

where c[·] is an arbitrary processor context. The elimination rules express that the transition relation is inductively defined as the least relation closed under the rules of the operational semantics.

The proposed proof system is both modular and generic. It is modular in that each connective, modality and process combinator has its own independent set of inference rules and can therefore be included or not as desired. It is generic in that a wide class of process combinators (any whose operational semantics is given in a certain general format) can be provided with introduction and elimination rules in a uniform way. From preliminary investigations, it seems that the ad hoc inference rules of Stirling [74] can be recovered in our system. Moreover, we do not need special tricks to deal with CCS features such as ‘parallel composition’ and ‘restriction’.

Our system also provides an interesting approach to the old problem of ‘compositionality’. A compositional proof system is one which establishes that p satisfies A by establishing appropriate properties of the subprocesses out of which p is constructed. In our proof system a form of compositionality should follow from a proof normalization result eliminating introduction/elimination combinations in both the logical and process fragments.

However, it is not clear that intuitionistic modal logic is the appropriate basis for such a proof system. Therefore, it might be preferable to add a classical rule such as reductio ad absurdum, or even to work with a classical sequent calculus. Nevertheless, whether intuitionistic modal logic is used or not, we hope to have at least hinted at the potential applicability of some of the methods considered in the thesis.

Appendix A

Proofs of strong normalization and confluence for N_{IL}(T )

In this appendix we give the deferred proof of Theorem 2.3.2. It is quite easy to reduce strong normalization for N_{IL}(T ) to strong normalization for N_{IL} using the translation defined in the proof of Proposition 2.3.1 (page 25). The reduction is similar to that used to prove the strong normalization of N_{□♢}(T ) in Section 7.1. However, to make the thesis self-contained, we give, in Section A.1, a direct proof of strong normalization for N_{IL}(T ). (This is also worthwhile because we have not found a proof of strong normalization for N_{IL} in the literature that uses exactly the same reduction relation as ours.) The confluence of reduction in N_{IL}(T ) is proved in Section A.2.

Because of our definition of strong normalization in terms of reduction depth (page 17), the proofs in this appendix are all intuitionistically acceptable.

A.1 Proof of strong normalization

Appendix A. Proofs of strong normalization and confluence for N_{IL}(T ) 183

The proof of strong normalization for N_{IL} given by Prawitz [66, §A.3] (see also Troelstra [78, §IV.1] for a more detailed exposition of the same proof) adapts easily to N_{IL}(T ). We give essentially the same proof, but we reformulate the definitions and the statements of the lemmas to bring out more clearly the uniformity in the proof. (In this respect, our definition of ‘computability’ is a particular improvement on Prawitz’ definition of ‘strong validity’.) The proof is uniform enough that we need never treat applications of (R_{χ}) explicitly. Instead, the required properties of applications of (R_{χ}) follow from general properties of indirect rules.

We shall use Π, Σ, Υ, … to range over derivations, Λ, … to range over derivations ending in the application of an introduction rule and Ξ, … to range over finite sequences of derivations. If Ξ is Π_{1}, …, Π_{i}, …, Π_{n} then we write Ξ ⟹ Ξ′ to mean that Ξ′ is Π_{1}, …, Π′_{i}, …, Π_{n} where Π_{i} ⟹ Π′_{i}. An immediate reduction of Π is one such that the maximum or permutable formula removed is the major premise of the last rule in Π.

The indirect contexts of Π are defined inductively by:

1. Π is an indirect context of itself.

2. If Σ is an indirect context of Π then so is any derivation ending in the application of an indirect rule with Σ as the derivation of one of its minor premises.

Note that if Σ is an indirect context of Π then the conclusions of Σ and Π are the same. We write Ind [Π] for an arbitrary indirect context of Π.

We now define the notion of the ‘computability’ of a derivation by induction on the logical structure of its conclusion. A derivation, Π, is computable if it is strongly normalizing (SN) and, whenever Π ⟹^{∗} Ind [Λ], it holds that the relevant condition below is satisfied:

1. If Λ is \begin{matrix}{Σ_{1} \atop ϕ_{1}} & {Σ_{2} \atop ϕ_{2}} \\ ϕ_{1} ∧ ϕ_{2} \end{matrix} then {Σ_{1} \atop ϕ_{1}} and {Σ_{2} \atop ϕ_{2}} are computable.

2. If Λ is {Σ \atop ϕ_{i}} ; ϕ_{1} ∨ ϕ_{2} then {Σ \atop ϕ_{i}} is computable.

3. If Λ is {[ϕ_{1}] \atop Σ_{2}} ; ϕ_{2} ; ϕ_{1} ⊃ ϕ_{2} then, for every computable derivation {Σ_{1} \atop ϕ_{1}} , the derivation

{Σ_{1} \atop ϕ_{1}} ; Σ_{2} ; ϕ_{2} is computable.

4. If Λ is Σ ϕ ; ∀x.ϕ then, for all terms t, the derivation {Σ[t/x] \atop ϕ[t/x]} is computable.

5. If Λ is {Σ \atop ϕ[t/x]} ; ∃x.ϕ then {Σ \atop ϕ[t/x]} is computable.

Lemma A.1.1 (Properties of computability)

1. If Π is computable and Π ⟹ Π′ then Π′ is computable.

2. Each trivial derivation, ϕ, is computable.

3. If the last rule applied in Π is a non-introduction, (r), then Π is computable if and only if it satisfies both the following conditions:

(a) If Π ⟹ Π′ then Π′ is computable.

(b) If (r) is indirect then the derivation of each of its minor premises is computable.

Proof. 1 and 2 are trivial. For the ‘only if’ direction of 3, suppose that Π is computable. Then (a) holds by virtue of 1. For (b) suppose that (r) is indirect. Let Σ be the derivation of a minor premise. It is SN because it is a subderivation of Π and Π is SN. And if Σ ⟹^{∗} Ind [Λ] then, by applying the same reductions, Π ⟹^{∗} Ind [Λ] so Λ satisfies the required property because Π is computable.

For the converse, suppose that (a) and (b) hold. We must show that Π is computable. First, it is SN because, by (a), every one-step reduct of it is SN. Suppose then that Π ⟹^{∗} Ind [Λ]. If the reduction path has length ≥ 1 then we have Π ⟹ Π′ ⟹^{∗} Ind [Λ], in which case Λ satisfies the required property as, by (a), Π′ is computable. Otherwise, if the reduction path has length 0 then Π is itself Ind [Λ]. So, as the last rule in Λ is an introduction, (r) must be indirect with a minor premise whose derivation is an indirect context of Λ. So, by (b), Λ satisfies the required property. ⊠

Lemma A.1.2 If the last rule applied in Π is a non-introduction, (r), then Π is computable if the following three conditions are satisfied:

1. The derivation of each premise of (r) is SN.

2. If (r) is indirect then the derivation of each of its minor premises is computable.

3. If (r) is an elimination, in which case Π is of the form \begin{aligned}Σ & & Ξ \\ & ϕ \end{aligned} where Σ is the derivation of the major premise and Ξ is the sequence of derivations of the minor premises, then, whenever Σ ⟹^{∗} Ind [Λ], it holds that the immediate proper reduct of \begin{aligned}Λ & & Ξ \\ & ϕ \end{aligned} is computable.

Proof. Let Π be a derivation, whose last rule is a non-introduction (r), satisfying 1–3. The complexity of Π is a triple d_{1}, h, d_{2} where: d_{1} is the sum of the reduction depths of the major premises of (r), h is the maximum height of a derivation of a major premise of (r), and d_{2} is the sum of the reduction depths of the minor premises of (r). We shall prove that Π is computable by lexicographic induction on its complexity. As condition 2 is satisfied, by the ‘if’ direction of Lemma A.1.1(3), we need only show that Π ⟹ Π′ implies that Π′ is computable. There are 4 cases.

Case 1. Π′ is obtained by a reduction in one of the major premises of (r).

Clearly Π′ satisfies 1–3. Moreover its complexity is d′_{1}, h′, d_{2} where d′_{1} < d_{1}. It is therefore computable by the induction hypothesis.

Case 2. Π′ is obtained by a reduction in one of the minor premises of (r).

Clearly Π′ satisfies 1. It satisfies 2 by Lemma A.1.1(1). For 3, suppose that (r) is an elimination. Then Π′ has the form \begin{aligned}Σ & & Ξ′ \\ & ϕ \end{aligned} where Ξ ⟹ Ξ′. Suppose that Σ ⟹^{∗} Ind [Λ]. We must show the computability of the immediate proper reduct, Υ′, of \begin{aligned}Λ & & Ξ′ \\ & ϕ \end{aligned} . But the immediate proper reduct, Υ, of \begin{aligned}Λ & & Ξ \\ & ϕ \end{aligned} is computable, because Π satisfies 3. Moreover, Υ ⟹^{∗} Υ′ (see the second paragraph in the proof of Proposition A.2.1). So, by Lemma A.1.1(1), Υ′ is indeed computable. So Π′ satisfies 3. Lastly, the complexity of Π′ is d_{1}, h, d′_{2} where d′_{2} < d_{2}. Therefore, by the induction hypothesis, Π′ is computable.

Case 3. Π′ is obtained by an immediate proper reduction.

The computability of Π′ follows immediately from Π satisfying 3.

Case 4. Π′ is obtained by an immediate permutative reduction.

Then (r) is an elimination, and the reduction of Π to Π′ has the form:

\begin{matrix}\begin{aligned}Ξ_{1} & Σ_{1} & & … & Σ_{n} \\ & & ψ \end{aligned} (r′) & Ξ_{2} \\ ϕ \end{matrix} (r)

⟹

Ξ_{1} \begin{aligned}Σ_{1} & & Ξ_{2} \\ & ϕ \end{aligned} (r) … \begin{aligned}Σ_{n} & & Ξ_{2} \\ & ϕ \end{aligned} (r) ϕ

(r′)

where Ξ_{1} is the sequence of derivations of the major premises of the indirect rule (r′), and Σ_{1}, …, Σ_{n} are the derivations of the minor premises of (r′), and where Ξ_{2} is the sequence of derivations of the minor premises of (r). We shall show below that Π′ satisfies 1–3. Then its complexity is d′_{1}, h′, d′_{2} where d′_{1} ≤ d_{1} and h′ < h. So it is computable, by the induction hypothesis.

It remains to show that Π′ satisfies 1–3.

1. Clearly the derivations in Ξ_{1} are SN. That \begin{aligned}Σ_{i} & & Ξ_{2} \\ & ϕ \end{aligned} is SN for 1 ≤ i ≤ n will follow when we establish 2.

2. We must show that \begin{aligned}Σ_{i} & & Ξ_{2} \\ & ϕ \end{aligned} is computable. It clearly satisfies 1 and 2, because they were satisfied by Π. Moreover its complexity is d′_{1}, h′, d_{2} where d′_{1} ≤ d_{1} and h′ < h. So the computability of \begin{aligned}Σ_{i} & & Ξ_{2} \\ & ϕ \end{aligned} will follow from the induction hypothesis when we show it satisfies 3. For this, suppose that Σ_{i} ⟹^{∗} Ind [Λ]. Then \begin{aligned}Ξ_{1} & Σ_{1} & & … & Σ_{n} \\ & & ψ \end{aligned} ⟹^{∗} Ind [Λ], by the same reductions. Therefore the computability of the required proper reduct follows from Π satisfying 3.

3. If (r′) is an elimination then it is one of: (⊥E), (∨E) or (∃E). The (⊥E) case is trivial. Of the other two cases, we just consider (∨E), the argument for (∃E) being similar. The reduction of Π to Π′ is of the form:

\begin{matrix}\begin{aligned}{Σ \atop θ_{1} ∨ θ_{2}} & {[θ_{1}] \atop Σ_{1}} ; ψ & {[θ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned} & Ξ_{2} \\ ϕ \end{matrix} (r) ⟹ \begin{aligned}{Σ \atop θ_{1} ∨ θ_{2}} & \begin{aligned}{[θ_{1}] \atop Σ_{1}} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r) & \begin{aligned}{[θ_{2}] \atop Σ_{2}} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r) \\ & ϕ \end{aligned}

Suppose that:

Σ ⟹^{∗} Ind [ {Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2} ]

We must show that the derivation:

\begin{aligned}{Σ′ \atop θ_{i}} ; Σ_{i} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r)

(which we henceforth call Υ), obtained by the application of the appropriate proper reduction, is computable. Note first that, by applying some permutative reductions followed by a proper reduction, we have that

\begin{aligned}{Σ \atop θ_{1} ∨ θ_{2}} & {[θ_{1}] \atop Σ_{1}} ; ψ & {[θ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned} ⟹^{+} Ind [ {Σ′ \atop θ_{i}} ; Σ_{i} ; ψ ].  (A.1)

Therefore the major premise of Υ is SN and its reduction depth is d′_{1} < d_{1}. So Υ satisfies conditions 1 and 2, because, for the minor premises, Π does. Moreover its complexity is d′_{1}, h′, d_{2}, which is below the complexity of Π. So the computability of Υ will follow from the induction hypothesis when we establish that it satisfies 3. For this, suppose that

{Σ′ \atop θ_{i}} ; Σ_{i} ; ψ ⟹^{∗} Ind [Λ].

Then, by (A.1),

\begin{aligned}{Σ \atop θ_{1} ∨ θ_{2}} & {[θ_{1}] \atop Σ_{1}} ; ψ & {[θ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned} ⟹^{∗} Ind [Λ].

Therefore the computability of the required proper reduct follows from Π satisfying 3.

⊠

A derivation is said to be a substitution instance of Π if, for some \overline{t}, it is obtained from Π[\overline{t}/\overline{x}] by replacing some of the open assumptions with computable derivations of them. We say that Π is computable under substitutions if every substitution instance of Π is computable.

Proposition A.1.3 Every derivation in N_{IL}(T ) is computable under substitutions.

Proof. By induction on the structure of derivations, Π, in N_{IL}(T ). The base case, in which Π consists of a single assumption, is trivial by the definition of computability under substitution and by Lemma A.1.1(2).

Of the cases in which the last rule is an introduction, we consider only (⊃I), the arguments for the other introduction rules being similar. We use without comment some trivial properties of reduction (see Prawitz [66, Lemmas 4.4.1–2, p. 294]). Π has the form:

{[ϕ_{1}] \atop Σ_{2}} ; ϕ_{2} ; ϕ_{1} ⊃ ϕ_{2}

where, by the induction hypothesis, Σ_{2} is computable under substitutions. Let Π̃ be any substitution instance of Π. We must show that Π̃ is computable. Now Π̃ has the form:

[ϕ_{1}] ; Σ̃_{2} ; ϕ_{2} ; ϕ_{1} ⊃ ϕ_{2}

where Σ̃_{2} is a substitution instance of Σ_{2}. So Σ̃_{2} is computable and hence SN. Therefore Π̃ is SN. Now suppose that Π̃ ⟹^{∗} Ind [Λ]. Then Λ has the form:

\begin{matrix}[ϕ_{1}] \\ Σ̃_{2} & ′ \end{matrix} ; ϕ_{2} ; ϕ_{1} ⊃ ϕ_{2}

where Σ̃_{2} ⟹^{∗} Σ̃_{2}′. We must show that, for every computable {Σ_{1} \atop ϕ_{1}} , the derivation:

{Σ_{1} \atop ϕ_{1}} ; Σ̃_{2}′ ; ϕ_{2}

is computable. However, the derivation:

{Σ_{1} \atop ϕ_{1}} ; Σ̃_{2} ; ϕ_{2}

is computable, as it is a substitution instance of Σ_{2}. And, because Σ̃_{2} ⟹^{∗} Σ̃_{2}′, we have that:

{Σ_{1} \atop ϕ_{1}} ; Σ̃_{2} ; ϕ_{2} ⟹^{∗} {Σ_{1} \atop ϕ_{1}} ; Σ̃_{2}′ ; ϕ_{2}

So the latter derivation is indeed computable by Lemma A.1.1(1). Thus we have shown that Π̃ is computable, as required.

Lastly, suppose that Π has the form {Ξ \atop ϕ} (r) where (r) is a non-introduction.

Then any substitution instance, Π̃, of Π has the form Ξ̃ ; ϕ (r) where Ξ̃ is a sequence of substitution instances of the derivations in Ξ. We use Lemma A.1.2 to show that Π̃ is computable as required. By the induction hypothesis, every derivation in Ξ̃ is computable so conditions 1 and 2 of Lemma A.1.2 are satisfied. It remains to show that Π̃ satisfies condition 3. We consider only the case in which (r) is (∨E), the other cases being proved by similar arguments. Π has the form:

\begin{aligned}{Σ \atop ϕ_{1} ∨ ϕ_{2}} & {[ϕ_{1}] \atop Σ_{1}} ; ψ & {[ϕ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned}

and Π̃ has the form:

\begin{aligned}Σ̃ ; ϕ_{1} ∨ ϕ_{2} & [ϕ_{1}] ; Σ̃_{1} ; ψ & [ϕ_{2}] ; Σ̃_{2} ; ψ \\ & ψ \end{aligned}

where the premises are substitution instances of the corresponding premises in Π. Suppose that:

Σ̃ ⟹^{∗} Ind [ {Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2} ]

By the induction hypothesis, Σ̃ is computable. So, by Lemma A.1.1(1) and the ‘only if’ direction of Lemma A.1.1(3), we have that:

{Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2}

is computable, whence Σ′ is too (by the definition of computability). We must show that the derivation:

{Σ′ \atop θ_{i}} ; Σ̃_{i} ; ψ

obtained by the application of the appropriate proper reduction, is computable. However, as Σ′ is computable, this is just a substitution instance of Σ_{i}. So, by the induction hypothesis, it is indeed computable. ⊠ It is an immediate consequence that every derivation in N_{IL}(T ) is computable and hence strongly normalizing.

A.2 Proof of confluence

We outline the easy proof that ⟹ is weakly confluent:

Proposition A.2.1 If Π ⟹ Π_{1} and Π ⟹ Π_{2} then there exists a derivation Π′ such that Π_{1} ⟹^{∗} Π′ and Π_{2} ⟹^{∗} Π′.

Proof. By induction on the structure of Π.

Suppose that Π ⟹ Π_{1} and Π ⟹ Π_{2} and Π_{1} is different from Π_{2}. If neither of these reductions is immediate then both must be in the premises of the last rule and the required Π′ is found easily using the induction hypothesis.

If one reduction, that to Π_{1} say, is an immediate proper reduction then an immediate permutative reduction is not possible so Π_{2} must be obtained by a reduction in one of the premises of the last rule in Π. Let Π′ be the immediate proper reduct of Π_{2} (it is easily seen that an immediate proper reduction of Π_{2} is possible). We claim that Π_{1} ⟹^{∗} Π′ as required. The claim is proved by a case analysis on the last rule in Π, which must be an elimination. For example, if the rule is (⊃E) then Π has the form

\begin{matrix}{[ψ_{1}] \atop Σ_{2}} ; ψ_{2} ; ψ_{1} ⊃ ψ_{2} & {Σ_{1} \atop ψ_{1}} \\ ψ_{2} \end{matrix}

and Π_{2} is, for example,

\begin{matrix}{[ψ_{1}] \atop Σ_{2}} ; ψ_{2} ; ψ_{1} ⊃ ψ_{2} & {Σ′_{1} \atop ψ_{1}} \\ ψ_{2} \end{matrix}

where Σ_{1} ⟹ Σ′_{1} (although it may be obtained by a reduction in Σ_{2} instead). Thus indeed Π_{1} ⟹^{∗} Π′ as this is just:

{Σ_{1} \atop ψ_{1}} ; Σ_{2} ; ψ_{2} ⟹^{∗} {Σ′_{1} \atop ψ_{1}} ; Σ_{2} ; ψ_{2}

The cases for the other elimination rules are proved similarly.

Lastly, suppose that one reduction, again that to Π_{1} say, is an immediate permutative reduction. Then the reduction of Π to Π_{1} has the form:

\begin{matrix}\begin{aligned}Ξ_{1} & Σ_{1} & & … & Σ_{n} \\ & & ψ \end{aligned} (r′) & Ξ_{2} \\ ϕ \end{matrix} (r)

⟹

Ξ_{1} \begin{aligned}Σ_{1} & & Ξ_{2} \\ & ϕ \end{aligned} (r) … \begin{aligned}Σ_{n} & & Ξ_{2} \\ & ϕ \end{aligned} (r) ϕ

(r′)

where (r) is an elimination and (r′) is an indirect rule. Again the reduction of Π to Π_{2} must be obtained by a reduction in one of the premises of (r). If this reduction is not an immediate reduction of the major premise, then it must be via a reduction in one of the derivations in Ξ_{1}, Σ_{1}, …, Σ_{n}, Ξ_{2}. In which case, define Π′ by making the corresponding reductions in Π_{1}. Then it is easy to see Π_{2} reduces to Π′ by a permutative reduction. If, instead, the reduction of Π to Π_{2} is obtained by an immediate reduction of the major premise of (r) then there are two cases to consider depending on whether the reduction is proper or permutative.

In the first case we have that (r) is either (∨E) or (∃E). If it is (∨E) then the reduction of Π to Π_{1} is of the form:

\begin{matrix}\begin{aligned}{Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2} & {[θ_{1}] \atop Σ_{1}} ; ψ & {[θ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned} & Ξ_{2} \\ ϕ \end{matrix} (r) ⟹ \begin{aligned}{Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2} & \begin{aligned}{[θ_{1}] \atop Σ_{1}} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r) & \begin{aligned}{[θ_{2}] \atop Σ_{2}} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r) \\ & ϕ \end{aligned}

and that of Π to Π_{2} is of the form:

\begin{matrix}\begin{aligned}{Σ′ \atop θ_{i}} ; θ_{1} ∨ θ_{2} & {[θ_{1}] \atop Σ_{1}} ; ψ & {[θ_{2}] \atop Σ_{2}} ; ψ \\ & ψ \end{aligned} & Ξ_{2} \\ ϕ \end{matrix} (r) ⟹ \begin{aligned}{Σ′ \atop θ_{i}} ; Σ_{i} ; ψ & & Ξ_{2} \\ & ϕ \end{aligned} (r)

Thus Π_{2} is the required derivation as Π_{1} ⟹ Π_{2} by a proper reduction. The case of (∃E) is treated similarly.

It remains to deal with the case in which Π_{2} is obtained by an immediate permutative reduction of the major premise of (r). Then Π has the form:

\begin{matrix}\begin{aligned}Ξ′_{1} & Σ′_{1} & & … & Σ′_{m} \\ & & θ \end{aligned} (r′′) & Σ_{1} & … & Σ_{n} \\ ψ \end{matrix} (r′) Ξ_{2}

ϕ (r)

where (r) is an elimination, (r′) is an indirect elimination and (r′′) is an indirect rule with Ξ′_{1} the sequence of derivations of its major premises. So Π_{1} has the form:

\begin{aligned}Ξ′_{1} & Σ′_{1} & & … & Σ′_{m} \\ & & θ \end{aligned} (r′′) \begin{aligned}Σ_{1} & & Ξ_{2} \\ & ϕ \end{aligned} (r) … \begin{aligned}Σ_{n} & & Ξ_{2} \\ & ϕ \end{aligned} (r)

ϕ (r′)

and Π_{2} has the form:

Ξ′_{1} \begin{aligned}Σ′_{1} & Σ_{1} & & … & Σ_{n} \\ & & ψ \end{aligned} (r′) … \begin{aligned}Σ′_{m} & Σ_{1} & & … & Σ_{n} \\ & & ψ \end{aligned} (r′)

ψ (r′′) Ξ_{2}

ϕ (r)

Then define Π′ to be:

Ξ′_{1} Σ′_{1} \begin{aligned}Σ_{1} & & Ξ_{2} \\ & ϕ \end{aligned} (r) … \begin{aligned}Σ_{n} & & Ξ_{2} \\ & ϕ \end{aligned} (r) ϕ (r′) … Σ′_{m} \begin{aligned}Σ_{1} & & Ξ_{2} \\ & ϕ \end{aligned} (r) … \begin{aligned}Σ_{n} & & Ξ_{2} \\ & ϕ \end{aligned} (r) ϕ (r′)

ϕ (r′′)

and indeed Π_{1} ⟹ Π′ by a single permutative reduction, and Π_{2} ⟹^{+} Π′ by a sequence of m + 1 permutative reductions. ⊠ By Newman’s Lemma (see Klop [48, Theorem 2.0.7(2), p. 7]), confluence follows from weak confluence and strong normalization.

Appendix B

Sequence prefixes

In this appendix we show how the basic system N_{□♢} could be reformulated without relational assumptions, more in the traditional style of proof systems based on relative truth. The reformulation will illuminate some interesting problems that arise in adapting the traditional systems to intuitionistic modal logic.

As we commented in Section 4.6, the traditional natural deduction systems for modal logic based on relative truth do not use relational assumptions. Instead they use ad hoc notations for prefixes together with a convention determining the visibility relation between the different prefix notations. The visibility convention depends on the modal logic considered, but each prefix notation has a basic convention common to all modal logics and used alone in the system for K. Actually, Fitch [26,27], Siemens [71] and Fitting [29, Ch. 4, §12–16] do not use prefixes at all, but write their proofs in a nested sequence of boxes (called ‘strict subordinate proofs’), which serve the same purpose. Their visibility convention is that any given proof box ‘sees’ the box nested immediately inside it. Masini [55] uses natural numbers to prefix formulae, as, in effect, do Benevides and Maibaum [4]. Their visibility convention is that a natural number ‘sees’ its successor. Gonzalez [39] and Tapscott [77] use finite sequences of natural numbers as prefixes, an idea which first appears in the prefixed tableau systems of Fitting [28](1972) (see also [29, Ch. 8]). Their visibility convention is that a given sequence sees any sequence obtained by appending one natural number to its end.

Some of these differences in prefix notation are inessential. The systems using proof boxes could equally well be formulated using natural numbers and vice-versa. (This is due to the linear presentation of derivations used by the Fitch school, by which the proof boxes are nested in sequence. A natural generalization would use derivation trees through a tree structure of nested proof boxes. This generalization would then be equivalent to the use of sequences of natural numbers for prefixes.) Further, the systems using natural numbers can be easily translated into systems using sequence prefixes (just by translating the prefix n as, e.g., the sequence of n zeros). However, we shall see below that the use of sequence prefixes is more powerful than the use of natural numbers.

In this appendix, we develop a variant of N_{□♢} based on sequence prefixes. We write s, t, … for finite sequences of natural numbers, using ϵ for the empty sequence. The concatenation of two sequences s and s′ is written ss′. The sequence obtained by adjoining a number i to the end of a sequence s is written si. To aid understanding, we shall give the proof systems interpretations in modal models. For this purpose, we use X to range over sets of sequences closed under initial subsequences (i.e. sets such that ss′ ∈ X implies s ∈ X, and, in particular, ϵ ∈ X). An X-interpretation in a modal model (W, R, V) is a function [[·]] from X to W such that, for all si ∈ X, [[s]]R[[si]].

First we consider a simple system for the ♢-free fragment. The inference rules for the propositional connectives are just the natural generalizations of the usual ones to formulae prefixed by sequences. However, with the (⊥E) and (∨E) rules there is a choice in formulation depending on whether restrictions are placed on the prefix of the conclusion. We begin by considering the ‘local’ formulations:

{s:⊥ \atop s:A}  \begin{aligned}s:A ∨ B & [s:A] ; ⋮ . ; s:C & [s:B] ; ⋮ . ; s:C \\ & s:C \end{aligned}

which are the ones used in most of the literature (the only exception being Masini [55]). The rules for □ are:

{si:A \atop s:□A}  {s:□A \atop si:A}

where the (□I) rule has the restriction that si: A must not depend on any open assumption prefixed by si. We say that A is a theorem of the system is there is a derivation of ϵ:A with no open assumptions.

To explain the meaning of the rules, we give an interpretation of the induced consequence relation in modal models. A derivation of s: A from open assumptions s_{1} : A_{1}, …, s_{n} : A_{n} says that, for all modal models M, for all X containing s, s_{1}, …, s_{n}, for all X-interpretations, [[·]], in M, if [[s_{1}]] ⊩_{M} A_{1} and … and [[s_{n}]] ⊩_{M} A_{n} then [[s]] ⊩_{M} A.

An important observation about this system is that, in any derivation with conclusion s: A, all the open assumptions are prefixed by initial subsequences of s. Because of this, any derivation can be rewritten to an ‘equivalent’ one using just sequences of zeros as prefixes. Thus the system could be formulated equally well using natural number prefixes. Similarly, the semantic interpretation can be reformulated using finite chains of worlds through modal models.

In its natural number formulation, the system is essentially that of Benevides and Maibaum [4] (but without their unnecessary additional rules [4, §3.2.2]). Together with a classical rule, such as reductio ad absurdum, the system is essentially the standard Fitch-style system for K that one finds in Siemens [71] and Fitting [29][Ch. 4, §15].

Regarding normalization, a maximum formula involving the modal rules is removed by the proper reduction:

{Π \atop si:A} ; s:□A ; sj:A ⟹  {Π[sj/si] \atop sj:A}

(Again this reduction applies equally well to the formulation using natural number prefixes.) However, the local formulation of the (⊥E) and (∨E) rules prevents the commuting conversions from working. For example, one cannot perform a commuting conversion on the derivation:

{s:⊥ \atop s:□A} ; si:A

In fact, there is no derivation of si:A from s:⊥ satisfying the subformula property. However, the subformula property does hold for theorems: if there is a derivation of s: A with no open assumptions, then there is a derivation in which only subformulae of A appear. (This fact is essentially due to Luciano Serafini, private communication.) To obtain a full subformula property for arbitrary consequences, the (⊥E) and (∨E) rules should be generalized to:

{s:⊥ \atop ss′:A}  \begin{aligned}s:A ∨ B & [s:A] ; ⋮ . ; ss′:C & [s:B] ; ⋮ . ; ss′:C \\ & ss′:C \end{aligned}

The addition of rules for ♢ complicates matters. Indeed all the systems for classical modal logic in the literature have exploited the classical interdefinability of □ and ♢. However, in a system for intuitionistic modal logic, it is necessary to have independent primitive rules for ♢. The only other work in which such rules are considered is that of Masini [55]. However, his system has some strong restrictions on the application of rules, resulting in a system with different properties from that presented below.

To begin with we just consider the introduction rule for ♢:

{si:A \atop s:♢A}

Now the system no longer satisfies the property that the prefixes of the open assumptions are subsequences of the prefixes of the conclusions. This has serious ramifications concerning soundness. Consider the derivations below corresponding to (4.1) and (4.2) on page 67.

{s:□(A ∧ B) \atop si:A ∧ B} ; si:A ; s:□A  {s:□A \atop si:A} ; s:♢A

We wish to draw similar conclusions from these derivations to those drawn earlier from (4.1) and (4.2). Thus in the first case we wish to conclude that if □(A ∧ B) holds at any world (denoted by s) then □A also holds there. In the second case we wish to conclude that if □A holds at any world (denoted by s) that can see another world (denoted by si) then ♢A also holds there. Therefore we have to distinguish between si being irrelevant to logical consequence in the first case, but relevant in the second case. This distinction can be made using a mechanism for discharging prefixes from derivations, similar to the usual discharge of assumptions. Thus we consider derivations in which, as well as marking assumptions as discharged, we also mark certain prefix occurrences as being discharged. Before describing the rules which discharge prefixes, we give the interpretation of derivations involving discharged prefixes. A derivation of s:A from open assumptions s_{1} :A_{1}, …, s_{n}:A_{n} says that, for all modal models M, for all X containing every undischarged prefix in the derivation, for all X-interpretations, [[·]], in M, if [[s_{1}]] ⊩_{M} A_{1} and … and [[s_{n}]] ⊩_{M} A_{n} then [[s]] ⊩_{M} A. (The prefixes s_{1}, …, s_{n}, s are necessarily in X as it will never be the case that the the prefix of an open assumptions or of the conclusion is marked as discharged.) As a result of this interpretation, we say that A is a theorem if there is a derivation of ϵ: A with no open assumptions in which all occurrences of prefixes other than ϵ are discharged. (Incidentally, the need for discharging prefixes disappears if the visibility relation is assumed to be serial. Indeed Masini [55] accepts □A ⊃ ♢A as a theorem, and thus avoids the complications of prefix discharge.)

The discharge of prefixes is performed by applications of (□I) and (♢E). In an application of (□I), in order to register that the prefix of the premise represents an arbitrary world, all occurrences of the prefix are discharged from the derivation. We write the resulting rule thus:

{[si]:A \atop s:□A}

Further, it is necessary to strengthen the restriction on the application of (□I). The new restriction is: si must be the only undischarged prefix of the form sis′ in the derivation of si:A and it must not occur as the prefix of an open assumption. Similarly, the (♢E) rule is:

\begin{matrix}s:♢A & [[si]:A] ; ⋮ . ; t:B \\ t:B \end{matrix}

with the restriction: si must be the only open prefix of the form sis′ in the derivation of t: B, it must not occur as the prefix of an open assumption other than si : A, and t must be different from si. An application of the (♢E) rule discharges all occurrences of the prefix si in the subderivation of t:B.

For an example of prefix discharge, consider the new version of the earlier derivation of s:□A from s:□(A ∧ B):

{s:□(A ∧ B) \atop [si]^{1} :A ∧ B} ; [si]^{1} :A ; s:□A_{1}

So the unwanted prefix is discharged from the derivation, which is therefore interpreted correctly.

Note that the (♢E) rule has been formulated as a non-local rule whose conclusion can have an (almost) arbitrary prefix t. Similarly, because the assumptions are not necessarily prefixed by initial subsequences of the prefix of the conclusion, the (⊥E) and (∨E) rules should be generalized further to:

{s:⊥ \atop t:A}  \begin{aligned}s:A ∨ B & [s:A] ; ⋮ . ; t:C & [s:B] ; ⋮ . ; t:C \\ & t:C \end{aligned}

Whereas, in the ♢-free system, non-local elimination rules were only needed for the subformula property, once ♢ is included they seem essential for completeness. In Figure B–1 we give derivations of the IK axioms in the system using sequence prefixes (these should be compared with the derivations in Figure 4–2 on page 71). The non-locality of (⊥E) is used in the derivation of ¬ ♢ ⊥ and the non-locality of (∨E) is used in the derivation of ♢(A ∨ B) ⊃ (♢A ∨ ♢B). Note that no prefixes are used other than ϵ and 0. Indeed, it is easily shown that all the theorems of IK can be derived using only sequences of zeros. (Sequences of arbitrary length are needed for iterated applications of necessitation.) Thus a complete system could be formulated using natural numbers for prefixes.

However, in the system with ♢, the full generality of sequence prefixes is necessary for proof normalization. The proper reduction of a maximum formula 1. □(A ⊃ B) ⊃ (□A ⊃ □B).

\begin{matrix}{[ϵ:□(A ⊃ B)]^{3} \atop [0]^{1} :A ⊃ B} & {[ϵ:□A]^{2} \atop [0]^{1} :A} \\ [0]^{1} :B \end{matrix} ; ϵ:□B_{1} ; ϵ:□A ⊃ □B_{2} ; ϵ:□(A ⊃ B) ⊃ (□A ⊃ □B) ^{3}

2. □(A ⊃ B) ⊃ (♢A ⊃ ♢B).

\begin{aligned}[ϵ:♢A]^{2} & \begin{matrix}{[ϵ:□(A ⊃ B)]^{3} \atop [0]^{1} :A ⊃ B} & [[0]^{1} :A]^{1} \\ [0]^{1} :B \end{matrix} ; ϵ:♢B \\ & ϵ:♢B \end{aligned}_{1} ; ϵ:♢A ⊃ ♢B_{2} ; ϵ:□(A ⊃ B) ⊃ (♢A ⊃ ♢B)_{3}

3. ¬ ♢ ⊥.

\begin{matrix}[ϵ:♢⊥]^{2} & {[[0]^{1} :⊥]^{1} \atop ϵ:⊥} \\ ϵ:⊥ \end{matrix}_{1} ; ϵ:¬ ♢ ⊥_{2}

4. ♢(A ∨ B) ⊃ (♢A ∨ ♢B).

\begin{aligned}[ϵ:♢(A ∨ B)]^{3} & \begin{aligned}[[0]^{2} :A ∨ B]^{2} & {[[0]^{2} :A]^{1} \atop ϵ:♢A} ; ϵ:♢A ∨ ♢B & {[[0]^{2} :B]^{1} \atop ϵ:♢B} ; ϵ:♢A ∨ ♢B \\ & ϵ:♢A ∨ ♢B \end{aligned} ^{1} \\ & ϵ:♢A ∨ ♢B \end{aligned}_{2} ; ϵ:♢(A ∨ B) ⊃ (♢A ∨ ♢B)_{3}

5. (♢A ⊃ □B) ⊃ □(A ⊃ B).

\begin{matrix}[ϵ:♢A ⊃ □B]^{3} & {[[0]^{2} :A]^{1} \atop ϵ:♢A} \\ ϵ:□B \end{matrix} ; [0]^{2} :B ; [0]^{2} :A ⊃ B_{1} ; ϵ:□(A ⊃ B)_{2} ; ϵ:(♢A ⊃ □B) ⊃ □(A ⊃ B) ^{3}

Figure B–1: Derivations of the IK axioms using sequence prefixes. involving the ♢-rules is:

\begin{matrix}{Π_{1} \atop si : A} ; s : ♢A & {[[sj] : A] \atop Π_{2}} ; t : B \\ t : B \end{matrix} ⟹  {Π_{1} \atop si : A} ; Π_{2}[sis′/sjs′] ; t : B

In order for the restrictions on the (□I) and (♢E) rules to be satisfied in the rewritten derivation it may be necessary to rename some of the discharged prefixes in Π_{2} (this corresponds to the renaming of the closed variables in N_{IL}(T ) and N_{□♢}(T ) derivations). (Similar renamings may also be required in the proper reductions of ⊃ and ∨.) Thus even when the original derivation uses only sequences of zeros, the rewritten derivation may require other forms of sequence. Indeed, there are examples of valid consequences between formulae prefixed by sequences of zeros which have no normal derivation involving only such prefixes. For example, the normal derivation:

\begin{aligned}{0:A \atop ϵ:♢A} & ϵ:♢A ⊃ □(B ∧ C) \\ & ϵ:□(B ∧ C) \end{aligned} ; [1]^{1} :B ∧ C ; [1]^{1} :B ; ϵ:□B_{1}

makes crucial use of the distinct prefixes 0 and 1. Another example is given by the theorem

( ((♢A ∧ ♢B) ⊃ □C) ∧ (□(A ⊃ C) ⊃ □D) ) ⊃ □(B ⊃ D)

which also has no normal derivation using only sequences of zeros. Therefore, in order treat normalization, it is essential that the system is formulated using sequences for prefixes rather than natural numbers. (Interestingly, Masini [55] does prove normalization for a system with natural number prefixes. We believe that the problems highlighted above explain the need for the strong restrictions that Masini places on the application of his rules. His restrictions prevent him from deriving axioms 4 and 5 of IK.)

This completes our reformulation of N_{□♢} using sequence prefixes. One reason for preferring the original presentation with variables and relational assumptions is that the usual natural deduction mechanism of discharging assumptions suffices.

However, as remarked above, prefix discharge is unnecessary if the seriality of the visibility relation is assumed. Thus the prefix system for IKD is rather simpler than that for IK.

It is possible to generalize the approach to give systems for other intuitionistic modal logics. Many simple conditions on the visibility relation, such as reflexivity and transitivity, can be incorporated by minor modifications to the modal introduction and elimination rules (see the prefixed tableau systems of Fitting [28] and [29, Ch. 8] for hints on how to do this). However, it is not clear that there is a similar uniform way of dealing with such a wide class of visibility conditions as those handled by N_{□♢}(T ). In particular, the sequence prefixes seem tied down to visibility relations generated by a tree structure on worlds. So conditions such as directedness would probably be hard to incorporate. However, we believe that sequence prefixes can be used to give a proof system for any intuitionistic modal logic induced by a arbitrary Horn-clause theory, T_{H}, in L_{f} (possibly together with seriality), by formulating the modal rules in terms of the T_{H}-closure of the basic visibility relation on prefixes (much as in Section 7.2).

Bibliography

[1] A. Avron. Gentzenizing Schroeder-Heister’s natural extension of natural deduction. Notre Dame Journal of Formal Logic, 31:127–135, 1990.

[2] A. Avron. Simple consequence relations. Information and Computation, 92:105–139, 1991.

[3] A. Avron, I. Mason F. Honsell, and R. Pollack. Using typed lambda calculus to implement formal systems on a machine. Journal of Automated Reasoning, 9:309–354, 1992.

[4] M. R. F. Benevides and T. S. E. Maibaum. A constructive presentation for the modal connective of necessity. Journal of Logic and Computation, 2(1):31–50, 1992.

[5] J. F. A. K. van Bentham. Some kinds of modal completeness. Studia Logica, 39:125–141, 1980.

[6] J. F. A. K. van Bentham. Correspondence theory. In D. Gabbay and F. Guenther, editors, Handbook of Philosophical Logic, volume II, pages 167 – 47. D. Reidel Publishing Company, 1984.

[7] G. Bierman and V. de Paiva. Intuitionistic necessity revisited. In Proceedings of Logic at Work Conference, Amsterdam, 1992. To appear as Chapter 13, ‘Arrow Logic and Multi-modal Logics’, eds. Plos, Masuch and Marx, forthcoming.

[8] M. Božić and K. Došen. Models for normal intuitionistic modal logics. Studia Logica, 43:217–245, 1984.

[9] R. A. Bull. A modal extension of intuitionistic logic. Notre Dame Journal of Formal Logic, VI(2):142–146, 1965.

[10] R. A. Bull. Some modal calculi based on IC. In Formal Systems and Recursive Functions, pages 3–7, Amsterdam, 1965. North Holland.

[11] R. A. Bull. MIPC as the formalisation of an intuitionistic concept of modality. Journal of Symbolic Logic, 31(4):609–616, 1966.

[12] R. A. Bull and K. Segerberg. Basic Modal Logic. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, volume II, pages 1–88. D. Reidel Publishing Company, 1984.

[13] B. Chellas. Modal Logic. Cambridge University Press, 1980.

[14] D. van Dalen. Intuitionistic Logic. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, volume III, pages 225–339. D. Reidel Publishing Company, 1986.

[15] K. Došen. Models for stronger normal intuitionistic modal logics. Studia Logica, 44:39–70, 1985.

[16] M. A. E. Dummett. Elements of Intuitionism. Clarendon Press, Oxford, 1977.

[17] M. A. E. Dummett. The Logical Basis of Metaphysics. Duckworth, London, 1991.

[18] R. Dyckhoff. Contraction-free sequent calculi for intuitionistic logic. Journal of Symbolic Logic, 57(3):795–807, 1992.

[19] W. B. Ewald. Time, Modality and Intuitionism. D. Phil. thesis, University of Oxford, 1978.

[20] W. B. Ewald. Intuitionistic tense and modal logic. Journal of Symbolic Logic, 51, 1986.

[21] G. Fischer Servi. On modal logic with an intuitionistic base. Studia Logica, 36:141–149, 1977.

[22] G. Fischer Servi. The finite model property for MIPQ and some consequences. Notre Dame Journal of Formal Logic, XIX:687–692, 1978.

[23] G. Fischer Servi. Semantics for a class of intuitionistic modal calculi. In M. L. dalla Chiara, editor, Italian Studies in the Philosophy of Science, pages 59–72. D. Reidel Publishing Company, 1981.

[24] G. Fischer Servi. Axiomatizations for some intuitionistic modal logics. Rend. Sem. Mat. Univers. Politecn. Torino, 42:179–194, 1984.

[25] F. B. Fitch. Intuitionistic modal logic with quantifiers. Portugaliae Mathematicae, 7:113–118, 1948.

[26] F. B. Fitch. Symbolic Logic, an Introduction. The Ronald Press, New York, 1952.

[27] F. B. Fitch. Natural deduction rules for obligation. American Philosophical Quarterly, 3, 1966.

[28] M. C. Fitting. Tableau methods of proof for modal logics. Notre Dame Journal of Formal Logic, 13:237–247, 1972.

[29] M. C. Fitting. Proof Methods for Modal and Intuitionistic Logics. D. Reidel Publishing Co., Dortrecht, 1983.

[30] J. M. Font. Modality and possibility in some intuitionistic modal logics. Notre Dame Journal of Formal Logic, 27:533–546, 1986.

[31] J. M. Font and V. Verdú. An abstract approach to modal logics. Journal of Symbolic Logic, 54(3):1042–1062, 1989.

[32] D. M. Gabbay. Decidability results in non-classical logics. Annals of Mathematical Logic, 8:237–295, 1975.

[33] D. M. Gabbay. Model theory for tense logics. Annals of Mathematical Logic, 8:185–236, 1975.

[34] D. M. Gabbay. Labelled Deductive Systems. Oxford University Press, forthcoming.

[35] I. P. Gent. Analytic Proof Systems for Classical and Modal Logics of Restricted Quantification. Ph.D. thesis, University of Warwick, 1992.

[36] G. Gentzen. Investigations into logical deduction. In M.E. Szabo, editor, The collected papers of Gerard Gentzen, pages 68–128. North Holland Publishing Company, 1969.

[37] J.-Y. Girard, P. Taylor, and Y. Lafont. Proofs and Types. Cambridge Tracts in Theoretical Computer science. Cambridge University Press, 1989.

[38] F. Giunchiglia and L. Serafini. Multilanguage hierarchical logics (or: how we can do without modal logics). Artificial Intelligence, 65:29–70, 1994.

[39] H. J. M. Gonzalez. Analytic tableau calculi and natural deduction for propositional modal systems using subindexed formulae. Journal of Symbolic Logic, 52:330–331, 1987. Abstract of talk presented at Paris, 1985.

[40] R. P. Goré. Cut-free sequent and tableau systems for propositional normal modal logics. Ph.D. Thesis, University of Cambridge, England, 1992. Available as Technical Report No. 257, Computer Laboratory, University of Cambridge.

[41] R. Harper, F. Honsell, and G. D. Plotkin. A framework for defining logics. Journal of the Association for Computing Machinery, 40(1):143–184, 1992.

[42] M. Hennessy and R. Milner. Algebraic laws for nondeterminism and concurrency. J. Assoc. Comput. Mach., 32:137–161, 1985.

[43] M. Hennessy and G. D. Plotkin. Finite conjunctive nondeterminism. In K. Voss, H. J. Genrich, and G. Rozenberg, editors, Concurrency and Nets, pages 233–244. Springer-Verlag, 1987.

[44] J. Hintikka. Knowledge and Belief, an Introduction to the Logic of the Two Notions. Cornell University Press, 1962.

[45] W. A. Howard. The formulae as types notion of construction. In J. P. Seldin and J. R. Hindley, editors, To H.B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism. Academic Press, New York, 1980. Unpublished manuscript of 1969.

[46] G. E. Hughes and M. J.Cresswell. An Introduction to Modal Logic. Methuen, London, 1968.

[47] S. Kanger. Provability in Logic. Almquist and Wiksell, Stockholm, 1957.

[48] J. W. Klop. Term rewriting systems. In S. Abramsky, D. M. Gabbay, and T. S. E. Maibaum, editors, Handbook of Logic in Computer Science, volume 2, pages 1–116. Clarendon Press, Oxford, 1992.

[49] D. Kozen and J. Tiuryn. Logics of programs. In Handbook of Theoretical Computer Science. North Holland, Amsterdam, 1990.

[50] S. A. Kripke. Semantical analysis of modal logic I: Normal propositional calculi. Zeit. Math. Logik. Grund., 9:67–96, 1963.

[51] S. A. Kripke. Semantical analysis of intuitionistic logic I. In Formal Systems and Recursive Functions, pages 92–130, Amsterdam, 1965. North Holland.

[52] S. A. Kripke. Naming and Necessity. Blackwell, Oxford, 1980.

[53] J. Lambek and P. J. Scott. Introduction to Higher Order Categorical Logic. Number 7 in Cambridge studies in advanced mathematics. Cambridge University Press, 1986.

[54] P. Martin-Löf. Constructive mathematics and computer programming. In Proceedings 6th International Congress for Logic, Methodology and Philosophy of science, Amsterdam, 1982. North Holand.

[55] A. Masini. 2-sequent calculus: Intuitionism and natural deduction. Journal of Logic and Computation, 3(5):533–562, 1993.

[56] M. Mendler. Constrained proofs: a logic for dealing with behavioural constraints in formal hardware verification. In G. Jones and M. Sheeran, editors, Proceedings of Workshop on Designing Correct Circuits, Oxford 1990. Springer-Verlag, 1991.

[57] M. Mihajlova. Reduction of modalities in several intuitionistic modal logics. Comptes Rendus de l’Académie Bulgare des Science, 33:743–745, 1980.

[58] R. Milner. Communication and Concurrency. Prentice Hall international series in computer science. Prentice Hall, 1989.

[59] A. Nerode. Some lectures on modal logic. In F. L. Bauer, editor, Logic, Algebra and Computation, volume 79 of NATO Advanced Science Institutes, Series F: Computer and Systems Sciences, pages 281–334. Springer, Berlin, 1991.

[60] A. Nerode and D. Wijesekera. Constructive concurent dynamic logic. Mathematics and Artificial Intelligence, 1(2), 1990.

[61] H. Ono. On some intuitionistic modal logics. Publications of RIMS, Kyoto University, 13:687–722, 1977.

[62] H. Ono and N.-Y. Suzuki. Relations between intuitionistic modal logics and intermediate predicate logics. Reports on Mathematical Logic, 22:65–87, 1988.

[63] A. M. Pitts. Evaluation logic. In G. Birtwistle, editor, IVth Higher Order Workshop, Banff 1990. Springer, 1991.

[64] G. D. Plotkin and C. P. Stirling. A framework for intuitionistic modal logic. In J. Y. Halpern, editor, Theoretical Aspects of Reasoning About Knowledge, 1986.

[65] D. Prawitz. Natural Deduction - A proof theoretical study. Almquist and Wiksell, Stockholm, 1965.

[66] D. Prawitz. Ideas and results in proof theory. In J.E. Fenstad, editor, Proc. 2nd Scandinavian logic symposium. North Holland, 1971.

[67] A. N. Prior. Time and Modality. Oxford, 1957.

[68] M. O. Rabin. Decidable theories. In J. Barwise, editor, Handbook of Mathematical Logic, pages 595–629. North Holland, Amsterdam, 1987.

[69] D. S. Scott. Relating theories of the λ-calculus. In J. P. Seldin and J. R. Hindley, editors, To H. B. Curry: Essays on Combinatory Logic, Lambda Calculus and Formalism. Academic Press, New York, 1980.

[70] J. R. Shoenfield. Mathematical logic. Addison Wesley, London, 1967.

[71] D. F. Siemens. Fitch-style rules for many modal logics. Notre Dame Journal of Formal Logic, 18:631–636, 1977.

[72] R. M. Solovay. Provability interpretations of modal logic. Israel J. Math., 25:287–304, 1976.

[73] V. H. Sotirov. Modal theories with intuitionistic logic. In Proceedings of the Confenence on Mathematical Logic, Sofia 1980, pages 139–171. Bulgarian Academy of Sciences, 1984.

[74] C. P. Stirling. Modal logics for communicating systems. Theoretical Computer Science, 49:311–347, 1987.

[75] C. P. Stirling. Modal and temporal logics. In S. Abramsky, D. M. Gabbay, and T. S. E. Maibaum, editors, Handbook of Logic in Computer Science, volume 2, pages 477–563. Clarendon Press, Oxford, 1992.

[76] G. Sundholm. Proof theory and meaning. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, volume III, pages 471–506. D. Reidel Publishing Company, 1986.

[77] B. L. Tapscott. A simplified natural deduction approach to certain modal systems. Notre Dame Journal of Formal Logic, 28(3):371–384, 1987.

[78] A. S. Troelstra. Metamathematical Investigations of intuitionistic arithmetic and analysis. Number 344 in Lecture notes in mathematics. Springer Verlag, 1973.

[79] A. S. Troelstra and D. van Dalen. Constructivism in Mathematics, volume I. North Holland, Amsterdam, 1988.

[80] S. Vickers. Geometric logic in computer science. In Burn, Gay, and Ryan, editors, Theory and Formal Methods 1993. Springer Verlag, 1993.

[81] L. A. Wallen. Automated Proof Search in Non-classical Logics. MIT Press, 1989.

[82] D. Wijesekera. Constructive modal logics I. Annals of Pure and Applied Logic, 50:271–301, 1990.

[83] T. Williamson. On intuitionistic modal epistemic logic. Journal of Philosophical Logic, 21:63–89, 1992.

[84] S. Yokota. General characterization results on intuitionistic modal propositional logics. Commentarii Mathematici Universitatis Sancti Pauli, 34:177– 199, 1985.

[85] S. Yokota. Modal Heyting algebras with comodal operator. Commentarii Mathematici Universitatis Sancti Pauli, 35:59–64, 1986.

[86] S. Yokota. Some intuitionistic versions of the modal propositional logic K(S). Commentarii Mathematici Universitatis Sancti Pauli, 35:65–67, 1986.