Abstract In this paper, we introduce the logic of a control action S4F and the logic of a continuous control action S4C on the state space of a dynami

Transcription

1 Modal Logics and Topological Semantics for Hybrid Systems Mathematical Sciences Institute Technical Report S. N. Artemov, J. M. Davoren y and A. Nerode z Mathematical Sciences Institute Cornell University Ithaca, NY 14850, U.S.A. artemov@math.cornell.edu jmd16@cornell.edu anil@math.cornell.edu June 1997 Supported in part by the Russian Foundation for Basic Research, grant No , and by the ARO under the MURI program \Integrated Approach to Intelligent Systems", grant number DAA H y American Association of University Women (AAUW) Educational Foundation International Fellow. z Research supported by the ARO under the MURI program \Integrated Approach to Intelligent Systems", grant number DAA H

2 Abstract In this paper, we introduce the logic of a control action S4F and the logic of a continuous control action S4C on the state space of a dynamical system. The state space here is represented by a topological space (X; T ) and the control action by a function f from X to X. We present an intended topological semantics and a Kripke semantics, give both a Hilbert-style and Gentzen-style axiomatization for S4F and S4C, prove completeness with respect to both semantics as well as a cut-elimination for the corresponding sequent calculi and show the logics to be decidable. 1 Introduction Let L 2 be the propositional modal language generated from a countable set PV of propositional variables, the propositional constant? (falsum), the propositional connective! (implication), and the modal operator 2. Let L 2a be the propositional language extending L 2 which includes, in addition, a new modal operator [a]. Let S4 denote the subset of L 2a consisting of all formulas derivable from a standard axiomatization of classical propositional logic together with the axiom schemes: 2('! )! (2'! 2 ), 2'! ' and 2'! 22', using the inference rules of modus ponens (MP) and 2-necessitation. We develop a bimodal extension of S4, which we call S4F, in the language L 2a with the single new modal operator [a]. In the intended topological semantics for this new logic, the S4 modality 2 is interpreted in the standard way as the topological interior operator, and [a] is interpreted as the inverse image f 1 () for a xed total function f : X! X on the state space X, equipped with a topology T. For each propositional formula ' of L 2a, k'k is a subset of X, and k[a]'k is the set of points x 2 X such that after applying the function f : X! X interpreting a, we have f(x) 2 k'k. So k[a]'k = f 1 (k'k). The set map f 1 commutes with all the Boolean operations on sets and the axiom schemes for S4F reect this: [a]('! )! ([a]'! [a] ) and :[a]' $ [a]:'. The [a]-necessitation inference rule corresponds to the totality of f. When the function f is continuous with respect to the topology T, k[a]'k is an open set (closed set) whenever k'k is open (closed), and f is continuous exactly when the formula [a]2'! 2[a]' is satised (evalutes as the whole space X) for each ' 2 L 2a. In application to continuous dynamics in hybrid control systems, we think of the symbol \a" as denoting a \control action", typically a vector eld applied for a xed duration, so that the function f interpreting a is a section of a ow on the state space (manifold). In dynamic or program logics (see, for eg. [Ha84] or [KT90]), formulas of the form '! [p] 2

3 where p denotes a program, express the Hoare partial correctness assertion f'g p f g: \if program p begins execution in a ' state then it will terminate in a state". In the logic S4F, formulas of the form:! [a]' can be read as: \whenever, then action a always makes it the case that '" or more succinctly, \action a always takes states to ' states". Such a formula is true (evaluates as the whole space) in a topological model T = (X; T ; f; ) exactly when, for all x 2 X: x 2 k k implies f(x) 2 k'k where is a valuation of atomic propositions as subsets of X. More generally,! [a] k ' reads \k iterations of action a always takes states to ' states", where [a] 0 ' is just ' and [a] k+1 ' is [a][a] k '. In this paper, we concentrate on the (classical) logic of a single control action. We present a topological semantics and a Kripke semantics, give both a Hilbert-style axiomatization and a Gentzen sequent calculus for the logic S4F, prove completeness with respect to both semantics as well as a semantic proof of cut-elimination for the sequent calculus and show the logic to be decidable. 2 Syntax and Topological Semantics Denition 2.1 Let L 2a be the propositional language generated from a countable set AP of atomic propositions, the propositional constant? (falsum), the propositional connective! (implication), and the modal operators 2 and [a]. Within the language L 2a, we can dene in the usual way the propositional constants and the other classical propositional connectives in terms of? and!, the diamond operators 3 and hai as the classical duals of 2 and [a], respectively: > $ :? :' $ '!? ' ^ $ :('! : ) ' _ $ :'! ' $ $ ('! ) ^ (! ') 3' $ :2:' hai' $ :[a]:' 3

4 Denition 2.2 A topological structure for the propositional language L 2a is a triple T = (X; T ; f) where X 6= ; is the state space; T P(X) is a topology on X (i.e. ;; X 2 T, and T is closed under arbitrary unions and nite intersections); and f : X! X is a total function. Note that at this stage, f is not assumed to be anything other than total; in particular, it is not assumed to be continuous w.r.t. T. Denition 2.3 A valuation for a topological structure T = (X; T ; f) is any map : AP! P(X) assigning a subset (p) X to each p 2 AP. Each such valuation uniquely extends to a valuation map kk : L 2a! P(X), satisfying the following clauses: kpk = (p) k?k = ; k'! k = k'k [ k k k2'k = int T k'k k[a]'k = f 1 k'k where int T is the interior operator determined by the topology T, i.e. for all A X, int T (A) = S fu 2 T j U Ag and f 1 is the inverse-image operator determined by the total function f: f 1 (A) = fx 2 X j f(x) 2 Ag Denition 2.4 A topological model for L 2a is a pair (T; ), where T = (X; T ; f) is a topological structure for L 2a and : AP! P(X) is a valuation for T. Denition 2.5 Let ' 2 L 2a be a propositional formula. ' is satised at a state x 2 X in a topological model (T; ) i x 2 k'k. ' is true in a topological model (T; ), written (T; ) j= ', i k'k = X; ' is valid in a topological structure T, written T j= ', i for all valuations for T, we have k'k = X; 4

5 ' is topologically valid i T j= ' for every topological structure T = (X; T ; f) for L 2a. The topological semantics for the dened constants, connectives and modal operators are as one would expect. k>k = X k:'k = k'k k' ^ k = \ k k k' _ k = k'k [ k k k3'k = cl T k'k khai'k = f 1 k'k where cl T is the closure operator determined by the topology T, i.e. for any A X, cl T (A) = T fc j C 2 T anda Cg Observe that for any topological structure T = (X; T ; f) and valuation for T, More generally, k'! k = X i k'k k k k'! k = fx 2 X j if x 2 k'k then x 2 k k g The proposed reading of formulas of the form:! [a]' as \action a always takes states to ' states" is based on the fact that in any topological model (T; ), (T; ) j=! [a]' i forallx 2 X; ifx 2 k k thenf(x) 2 k'k : We can embed Intuitionistic propositional logic Int within S4 via the standard Godel translation by "Boxing" all propositional variables, i.e. 2p, and dening Intuitionistic negation and Intuitionistic implication as: s ', 2(:') ', 2('! ) Topologically, this means that in the Intuitionistic semantics, all propositional variables denote open sets, Intuitionistic negation corresponds to the interior of the complement, and Intuitionistic implication corresponds to the interior of classical implication. 5

6 3 Hilbert-style Axiomatization Denition 3.1 The Hilbert-style proof system for the logic S4F has the following axiom schemes, in the language L 2a : and the inference rules: CP : axioms of classical propositional logic in L 2a 2K : 2('! )! (2'! 2 ) 2T : 2'! ' 24 : 2'! 22' [a]k : [a]('! )! ([a]'! [a] ) [a]: : [a]:' $ :[a]' modus ponens : 2 necessitation : [a] necessitation : '; '! ' 2' ' [a]' We write S4F `H ' or say ' is S4F H provable, if the formula ' 2 L 2a has an S4F Hilbert-style derivation. The axiom schemes 2K, 2T and 24, together with CP, and the rules of modus ponens and 2-necessitation, constitute the standard Hilbert-style proof system for propositional S4. From McKinsey and Tarski [McK41], [MT44], the S4 axioms are true in every topological space (X; T ) and hence true in every topological structure T = (X; T ; f), and the inference rules are truth-preserving (i.e. if the hypotheses evaluate as the whole space X, then so does the conclusion). The axioms [a]k and [a]: for the [a] modality, together with the [a]-necessitation rule, can be found in [Lem77] 1, where the uni-modal logic is given the name KF (\F" for \function"). The logic KF is identied as characteristic for total (serial) and functional (deterministic) binary relations in the Kripke semantics. In a sense, the [a] operator is nothing more than the \next-time" or \next-state" modality of temporal logics 2, given a more abstract semantics. 1 The source manuscript of the \Lemmon Notes" [Lem77] is dated 1966, and was a collaboration of E. J. Lemmon and Dana Scott. It was edited for [Lem77] by Krister Segerberg. 2 The rst appearance of the KF axioms seems to be in A. N. Prior's [Pri57] as the axioms for the \tomorrow it will be the case that" modality, and appear again in that guise in [Seg67]. See also Appendix B of Prior's [Pri67]. 6

7 The novelty here lies in combining it with the S4 2 and 3 modalities to give symbolic representation to a topology as well as an arbitrary function. The converse of [a]k is derivable as follows: 1: [a]'! [a] hypothesis 2: :[a]' _ [a] from 1: by propositional logic 3: [a]:' _ [a] from 2: by [a]: and propositional logic 4: :'! ('! ) tautology of propositional logic 5: [a] (:'! ('! )) from 4: by [a] necessitation 6: [a]:'! [a]('! ) from 5: by [a]k 7:! ('! ) tautology of propositional logic 8: [a] (! ('! )) from 7: by [a] necessitation 9: [a]! [a]('! ) from 8: by [a]k 10: [a]('! ) from 3:;6: and 9: by propositional logic Hence [a] commutes with each of the classical (Boolean) propositional connectives. Thus as a modal operator, [a] is classically self-dual, since in S4F H, hai' $ :[a]:' $ ::[a]' $ [a]' The following are S4F H provable, for any formulas '; 2 L 2a and k 2 N, where if k > 0, [a] k ' denotes the formula [a][a]:::[a]', with k iterations of the [a] operator and if k = 0, then [a] k ' is just '. [a] k : : :[a] k ' $ [a] k :' [a] k!: [a] k ('! ) $ ([a] k '! [a] k ) [a] k^ : [a] k (' ^ ) $ ([a] k ' ^ [a] k ) [a] k _ : [a] k (' _ ) $ ([a] k ' _ [a] k ) [a] k > : [a] k > [a] k? : [a] k? $? [a] k 2 : [a] k 2'! [a] k ' [a] k 3 : [a] k '! [a] k 3' The following are admissible inference rules in S4F H, for any formulas '; ; 2 L 2a and k; l 2 N: [a] k ' necessitation : [a] k ' Monotonicity of [a] k : '! [a] k '! [a] k Hoare composition : '! [a] k ;! [a] l '! [a] k+l 7

8 Observe that there are no axioms for S4F containing both 2 and [a], so the behaviors of the two modalities are quite independent and the logic can be thought of as a \direct product" of S4 and KF. When we adjoin a true bimodal axiom such as Cont : [a]2'! 2[a]' the result is a richer \amalgamated product" of S4 and KF. Proposition 3.2 Topological Soundness of S4F Hilbert-style axiomatization For all formulas ' of L 2a, if S4F `H ' then ' is topologically valid. Proof. The topological validity of the S4 axioms for 2 plus the validity-preservation of modus ponens 2-necessitation follow trivially from the properties of the interior operator; see [McK41], [MT44]. The semantical validity of the [a]-necessitation rule translates as k'k = X implies f 1 k'k = X and the equation f 1 (X) = X holds exactly when f : X! X is a total function. The validity of the F axioms for [a] are immediate from the properties of the inverse-image operator. 4 Sequent Calculus We give a Gentzen-style sequent calculus for the logic S4F. In the following, ' and are arbitrary formulas of the language L 2a and and (with or without subscripts) are (possibly empty) multisets of formulas of L 2a (i.e. nite "sets" in which repetitions are allowed, so we can ignore the Exchange rules required in Gentzen systems that treat sequences of formulas rather than multisets). The join or union of two multisets and is written ;, and either ; ' or '; denote the multiset resulting from the join of and the multiset whose sole member is '. A sequent is an expression of the form ) ; the multiset on the left is called the antecedent, and the multiset on the right is called the succedent. If multisets of formulas and are ff' 1 ; :::; ' n gg and ff 1 ; :::; m gg, respectively, then the sequent ) translates as the propositional formula of L 2a, and is abbreviated as: (' 1 ^ ::: ^ ' n )! ( 1 _ ::: _ m ) ^! _ In addition, we use 2 and [a] as abbreviations for the multisets respectively. ff 2' 1 ; :::; 2' n gg and ff [a]' 1 ; :::; [a]' n gg 8

9 Denition 4.1 The Gentzen-style sequent calculus for the logic S4F has the following axioms and rules. 1. Classical propositional logic axioms and rules for f?;!g: (Axiom) : ' ) ' (? )) :? ) (!)) : 1 ) 1 ; ' ; 2 ) 2 '! ; 1 ; 2 ) 1 ; 2 ()!) : '; ) ; ) ; '! 2. Structural rules: ( Weak )) : ) '; ) () Weak) : ) ) ; ' (Contr )) : '; '; ) '; ) () Contr) : ) ; '; ' ) ; ' (Cut) : 1 ) 1 ; ' '; 2 ) 2 1 ; 2 ) 1 ; 2 3. S4 rules for 2: (2 )) : '; ) 2'; ) () 2) : 2 ) ' 2 ) 2' 4. KF rule for [a]: ([a] ) [a]) : ) [a] ) [a] We write S4F `G ) if the sequent ) in the language L 2a has a S4F sequent calculus derivation, and we write S4F ` G ) if the sequent ) in the language L 2a has a cut-free S4F sequent calculus derivation. Note, that 1., 2., 3. give a Gentzen-style axiomatization of S4 (cf. [TS96]). Proposition 4.2 Equivalence of Sequent Calculus and Hilbert-style proof system for S4F Let and be multisets of formulas of L 2a, and let ' be any formula of L 2a. 9

10 (i) If S4F `G ) then S4F `H V! W. (ii) If S4F `H ' then S4F `G ) '. Proof. (i) Proceed by induction on the complexity of the S4F G sequent calculus derivation of ). Since 1., 2., 3. axiomatize a sequent variant of S4 it suces to verify the rule concerning the modality [a]. So assume the last rule applied in the derivation of ) is ([a] ) [a]), and the result holds for the upper sequent of the rule: is [a] 0 and is [a] 0, and the sequent ) is derived from 0 ) 0 by the ([a] ) [a]) rule. By the induction hypothesis, V S4F `H! W V W. Then 0! 0 1: induction hypothesis V 2: [a] ( W 0! 0 ) from 1: by [a] necessitation 3: [a] V W 0! [a] 0 from 2: by [a]k 4: [a] W V 0 $ [a] 0 theorem of S4F H 5: [a] V W 0 $ W [a] 0 theorem of S4F H [a] 0! [a] 0 6: from 3:;4: and 5: by propositional logic (ii) We show that each of the axioms of S4F H are derivable in S4F G, and that each of the inference rules of S4F H are preserved in S4F G. For the axioms and rules of S4 this is known (cf. [TS96]). Consider [a]-necessitation. Assume S4F `G ) '. Then applying ([a] ) [a]) (with empty antecedent) we obtain S4F `G ) [a]'. Axiom [a]k: ' ) ' ) (Axioms) '; '! ) (!)) [a]'; [a]('! ) ) [a] ([a] ) [a]) [a]('! ) ) [a]'! [a] ()!) ) [a]('! )! ([a]'! [a] ) ()!) Axiom [a]:, the! direction (not an Intuitionistic derivation) ' ) ' (Axiom) ' ) ';? () W eak) ) '; ('!?) ()!) ) [a]'; [a]('!?) ([a] ) [a])? ) (? )) [a]'!? ) [a]('!?) (!)) ) ([a]'!?)! [a]('!?) ()!) 10

11 Axiom [a]:, the direction: ' ) ' (Axiom)? ) (? )) ('!?); ' ) (!)) [a]('!?); [a]' ) ([a] ) [a]) [a]('!?); [a]' )? () W eak) [a]('!?) ) [a]'!? ()!) ) [a]('!?)! ([a]'!?) ()!) We conclude this section with some rules admissible in the cut-free sequent calculus S4F G, which are used in the proof of completeness in Section 6. Proposition 4.3 Let and be multisets of formulas of L 2a, let '; be formulas of L 2a, and let k 2 N. The following rules are admissible in the cut-free sequent calculus S4F G. ([a] k!)) : ) [a] k ' [a] k ) [a] k ('! ); ) () [a] k!) : ([a] k 2 )) : [a] k '; ) ; [a] k ) ; [a] k ('! ) [a] k '; ) [a] k 2'; ) Proof. An argument is a pretty standard one for cut-free derivations. A straightforward strategy in each case should be to rst apply the appropriate connective/modality rule, (!)), ()!) and (2 )), respectively, then deal with the [a] k prex. We leave this to a reader as a routine exercise. 5 Kripke Semantics Denition 5.1 A Kripke frame for L 2a is a triple K = (W; R; F ), where W 6= ; is a set of \worlds"; R W W is a reexive and transitive binary relation on W ; and F : W! W is a total function on W. A Kripke frame K = (W; R; F ) is called nite i W is a nite set. 11

12 By standard arguments, reexive and transitive binary relations capture precisely the S4 2 modality. As in [Lem77], x4, pp , a total function F : W! W is used to interpret the [a] modality. If one prefers to interpret modalities with a binary relation on W, take Q = graph(f ). Then as a binary relation, Q is both \total" and \functional", i.e. for all w 2 W, there exists a unique v 2 W such that (w; v) 2 Q. The \totality" or \serial" condition: every w 2 W has at least one Q-successor, is characteristic for the deontic scheme: [a]d : [a]'! hai' The converse scheme: [a]d c : hai'! [a]' is characterized by the \functionality" or \determinism" condition: every w 2 W has at most one Q-successor. Denition 5.2 A valuation for a Kripke frame K = (W; R; F ) is a map : W! P(AP ) assigning a set of atomic propositions (w) AP to each world w 2 W. Each such valuation for K determines a forcing relation K = W AP dened by w p i p 2 (w) which uniquely extends a forcing relation W L 2a (with the same name) on all formulas of L 2a, by the following clauses: (i) w :' i w 1 '; (ii) w '! i w 1 ' or w ; (iii) w 2' i for all v 2 W, if (w; v) 2 R then v '; (iv) w [a]' i F (w) '. for all w 2 W, and all '; 2 L 2a. If Q = graph(f ), then by the total functionality of Q, this last clause is equivalent to w [a]' i for all v 2 W ; if (w; v) 2 Q then v ': Denition 5.3 A Kripke model for L 2a is a pair (K; ), where K = (W; R; F ) is a frame for L 2a and : W! P(AP ) is a valuation for K. Denition 5.4 Let ' be a propositional formula of L 2a. ' is satised (or forced) at a world w 2 W in a Kripke model (K; ) i w K '; 12

13 ' is true in a Kripke model (K; ), written (K; ) ', i for all worlds w 2 W, we have w K '; ' is valid in a frame K, written K ', i for all valuations : W! P(AP ) for K, we have (K; ) '; ' is Kripke valid i for all frames K for L 2a, K '. Proposition 5.5 Kripke Soundness of S4F Hilbert-style proof system For all formulas ' of L 2a, if S4F `H ' then ' is Kripke valid. Proof. The required verication is that each of the axioms of S4F H are Kripke valid, and that the inference rules of S4F H preserve Kripke validity. For the axioms CP of classical propositional logic and for modus ponens, this is trivial. The verication for the S4 axioms K, T and 4, and the 2-necessitation rule follow the standard proof of soundness of the class of transitive and reexive frames for S4; see, for example, [HC96], pp For the [a]-necessitation rule, suppose ' is Kripke valid, let K = (W; R; F ) be a frame for L 2a, and let be a valuation for K. Since ' is Kripke valid and F (w) 2 W since F is total, we have F (w) '. Hence w '. Hence [a]' is also Kripke valid. The verication of the validity of the [a]k and [a]f axioms is also straightforward, taking as a starting point the fact that for any formula ' and any w 2 W, either F (w) ' or F (w) 1 ', and then crunching through the denitions of forcing for :,! and [a]. Proposition 5.6 For all formulas ' of L 2a, if T j= ' for all topological structures T for L 2a, then K ' for all Kripke frames K for L 2a. Proof. Given a Kripke frame K = (W; R; F ) be a for L 2a, dene T R to be the topology on W which has as a basis the collection of all sets B w = fv 2 W j (w; v) 2 Rg 3 So B w is the set of all R-successors of w. Note that w 2 B w (by the reexivity of R) and v 2 B w implies B v B w (by the transitivity of R), so B w = S v2b w B v. It is readily veried that for any set A W, we have: int TR (A) = fw 2 W j B w Ag = fw 2 W j for all v 2 W ; if (w; v) 2 R then v 2 Ag 3 The topology TR is variously known as the \cone topology" (generated from R-cones B w ) and the \Alexandro topology" (from [Ale56], where R is a partial order). Grzegorczyk uses an equivalent topology in [Grz67]. 13

14 In particular, an open set U 2 T R is a neighborhood of w i B w U. Since F : W! W is a total function, the induced structure T K = (W; T R ; F ) is a topological structure for L 2a. Given a valuation : W! P(AP ) for K, dene its dual valuation : AP! P(W ) for T K by: w 2 (p) i p 2 (w) for all p 2 AP and w 2 W. A simple induction on formulas establishes that for all ' 2 L 2a and all w 2 W, w 2 k'k i w ' Hence and the result follows. (T K ; ) j= ' i (K; ) ' 6 Kripke Completeness for S4F Our task in this section is Kripke completeness for S4F, together with the nite model property, and a semantic proof of cut-elimination. We prove that for all sequents 0 ) 0 in the language L 2a, if 0 ) 0 does not have a cut-free proof in S4F G, then there is a nite Kripke model (K; ) for L 2a such that at a world w 0 of K, we have w 0 V W 1 K 0! 0, i.e. w 0 K ' for each formula ' occurring in the antecedent 0, and w 0 1 K for each formula occurring in the succedent 0. The fundamental notion is that of a saturated sequent. A sequent ) in the language L 2a (in fact, in the language L 2 ) is called S4 saturated i each the following conditions hold: (1:) if '! 2 then either 2 or ' 2 ; (2:) if '! 2 then both ' 2 and 2 ; (3:) if 2' 2 then ' 2, for all '; 2 L 2a (L 2 ). Trivially, the empty sequent, ; ) ;, is S4 saturated. Variants of the notion of saturation for sequents are found throughout the modal and non-classical logic literature; see, for example, [AS93], [Av84]. This notion is intimately related with the notion of a set of signed formulas as a consistency property in [Fi83]. The saturation algorithm below is modelled on that of [AS93]. Here, we strengthen the notion of saturation to deal with the [a] operator. Denition 6.1 A sequent ) of L 2a is called S4F saturated i each the following conditions hold: 14

15 (1:) if [a] k ('! ) 2 then either [a] k 2 or [a] k ' 2 ; (2:) if [a] k ('! ) 2 then both [a] k ' 2 and [a] k 2 ; (3:) if [a] k 2' 2 then [a] k ' 2 ; for all '; 2 L 2a and k 2 N. It is immediate that if ) is S4F saturated, then ) is S4 saturated, since S4 saturation is just the case of k = 0 in each of conditions (1:), (2:) and (3:). In the stronger notion of S4F saturation, we require that subformulas behave \appropriately" with respect to iterated [a] k 's. Note that each of the conditions is reected in an admissible rule for S4F G, as given in Proposition 4.3. As a technical point, SubF orm( 0 [ 0 ) should be treated as a multiset: for each formula ' occurring in the multiset 0 [ 0, the multiset of all subformulas of ' is contained in SubF orm( 0 [ 0 ). In particular, expressions of the form [ SubF orm( 0 [ 0 ) (1) are to be read as multiset inclusion. Given a sequent 0 ) 0, there are only nitely many sequents ( ) ) of L 2a such that the equation above is satised. Lemma 6.2 S4F Saturation For each sequent 0 ) 0 of L 2a, if S4F 0 G 0 ) 0, then there is an S4F saturated sequent ) such that (a) 0 SubF orm( 0 [ 0 ); (b) 0 SubF orm( 0 [ 0 ); (c) S4F 0 G ). Moreover, by determinizing the algorithm which produces such a saturated sequent from input 0 ) 0, we may take the output ) to be unique, and denote it Sat( 0 ) 0 ), the S4F saturation of 0 ) 0. Proof. We expand on the saturation algorithm of [AS93], taking care to eliminate any nondeterminism. Given as input a sequent 0 ) 0 in the language L 2a such that S4F 0 G 0 ) 0, we construct a nite tree T( 0 ) 0 ) labelled with sequents of L 2a such that: (i) the root node of T( 0 ) 0 ) is labelled by 0 ) 0 ; (ii) all sequents ) labelling nodes in T( 0 ) 0 ) satisfy: 15

16 (a) 0 SubF orm( 0 [ 0 ); (b) 0 SubF orm( 0 [ 0 ). The algorithm requires a sub-routine Marking, which is a book-keeping device for keeping track of which formulas have been dealt with or are yet to be dealt with. Marking( ) ): Mark each occurrence of a formula in [ with either a \0" (yet to be dealt with) or a \1" (dealt with) as follows: Each occurrence of a propositional variable or? in [ is marked \1". For each occurrence of a formula [a] k ('! ) in, if there is no occurrence of [a] k in and there is also no occurrence of [a] k ' in, then mark the [a] k ('! ) with \0"; otherwise, mark it with \1". For each occurrence of a formula [a] k ('! ) in, if there is an occurrence of [a] k ' in and there is also an occurrence of [a] k in, then mark the [a] k ('! ) with \1"; otherwise, mark it with \0". For each occurrence of a formula [a] k 2' in, if there is no occurrence of [a] k ' in then mark the [a] k 2' with \0"; otherwise, mark it with \1". All remaining occurrences of formulas in [ are marked \1". Initialize: The current node is the root node labelled 0 ) 0. Run the sub-routine Marking( 0 ) 0 ). Repeat with each current node, labelled ) : 0. Axiom Test: Check if \ 6= ;, or if? 2. If either of these tests are satised, put a check mark \X" next to the current node then backtrack up the tree to the rst ancestor of the current node that is a branching node and has a child node without a check mark, then select the check-less (always the right) child as the new current node. [If all children of all branching ancestors of the current node are checked, then the tree T( 0 ) 0 ) can be easily transformed into a cut-free proof in S4F G of 0 ) 0 (using only (Axiom), (? )), the admissible rules ([a] k!)), () [a] k!) and ([a] k 2 )), plus the weakening and contraction rules), which contradicts the assumption that S4F 0 G 0 ) 0.] If \ = ; and? =2, proceed to 1. working with the current node. 1. Antecedent [a] k!: If contains an occurrence of a formula [a] k ('! ) marked \0", put a check mark \X" next to the current node, then create two child nodes: ) ; [a] k ' n = ) 16 ; [a] k ) X

17 labelled ) ; [a] k ' and ; [a] k ), respectively. Run the marking sub-routine on both child nodes: Marking( ) ; [a] k '), and Marking( ; [a] k ) ). Then select the left child node, labelled ) ; [a] k ', as the new current node. If contains no occurrences of any formula [a] k ('! ) marked \0", proceed to 2. working with the current node. 2. Succedent [a] k!: If contains an occurrence of a formula [a] k ('! ) marked \0", put a check mark \X" next to the current node, then create one child node: ; [a] k ' ) ; [a] k j ) X labelled ; [a] k ' ) ; [a] k. Run the sub-routine Marking( ; [a] k ' ) ; [a] k ). Select the child node labelled ; [a] k ' ) ; [a] k as the new current node. If contains no occurrences of any formula [a] k ('! ) marked \0", proceed to 3. working with the current node. 3. Antecedent [a] k 2: If contains an occurrence of a formula [a] k 2' marked \0", put a check mark \X" next to the current node, then create one child node: ; [a] k ' ) j ) X labelled ; [a] k ' ). Run the sub-routine Marking( ; [a] k ' ) ). Select the child node labelled ; [a] k ' ) as the new current node. If contains no occurrences of any formula [a] k 2' marked \0", then proceed to Terminate and return the label of the current node, ) (which does NOT have a check mark \X") as the saturation of 0 ) 0, i.e. Sat( 0 ) 0 ) = ) The saturation algorithm must terminate because SubF orm( 0 [ 0 ) is nite and there is at most two branches at each step. It is immediate from the construction that if ) = Sat( 0 ) 0 ) then (a) 0 SubF orm( 0 [ 0 ) and (b) 0 SubF orm( 0 [ 0 ) hold. To see that (c) S4F 0 G ) 17

18 also holds, observe that if ) had a cut-free proof in S4F G, then by saturation, we would have \ 6= ; or? 2 ; from such axiom sequents, we could reverse the steps in the saturation process to construct a cut-free proof of 0 ) 0, contradicting the assumption that S4F 0 G 0 ) 0. As a corollary of the proof (the Marking sub-routine), we have that for sequents ) of L 2a with S4F 0 G ), ) is saturated i Sat( ) ) = ) To deal with formulas having [a] as the main operator/connective, we dene an operation on sequents called \Strip". Denition 6.3 For any sequent ) of L 2a, dene Strip( ) ) $ ff' j [a]' 2 gg ) ff j [a] 2 gg where the double braces ff:::gg denote multi-set formation. So if Strip( ) ) = ( 0 ) 0 ), then for each occurrence of a formula [a]' in, there is a corresponding occurrence of ' in 0, and likewise, for each occurrence of a formula [a] in, there is a corresponding occurrence of in 0, and these are the only formulas occurring in 0 and 0 respectively. In particular, all formulas in [ that do not have [a] as the main operator/connective are erased completely by the Strip operator. Thus if there are no occurrences of formulas of the form [a]' in [, then Strip( ) ) = (; ) ;), the empty sequent. Lemma 6.4 For all sequents ) of L 2a, if Strip( ) ) = 0 ) 0, then for all ' 2 L 2a, (i) 0 SubF orm( ) and 0 SubF orm(); (ii) [a]' 2 i ' 2 0 ; (iii) [a]' 2 i ' 2 0 ; (iv) if S4F 0 G ), then S4F 0 G 0 ) 0 ; (v) if ) is S4F saturated, then 0 ) 0 is also S4F saturated. 18

19 Proof. Properties (i), (ii) and (iii) are immediate from the denition of Strip. For (iv), suppose S4F 0 G ), but S4F `G 0 ) 0. Then from a cut-free proof of 0 ) 0, one can construct a cut-free proof of ) using the ([a] ) [a]) rule followed by left (respectively, right) weakening of all the formulas in (respectively, ) that do not have [a] as the main operator/connective. For (v), suppose ) is S4F saturated, and consider 0 ) 0. Then for clause (1:) of S4F saturation, [a] k ('! ) 2 0, [a] k+1 ('! ) 2 by (ii) ) [a] k+1 2 or [a] k+1 ' 2 by S4F saturation of ), [a] k 2 0 or [a] k ' 2 0 by (ii) and (iii) The verication for clauses (2:) and (3:) proceeds similarly. As is suggested by the name, the Strip function \strips o" outermost [a]'s, thus reducing the complexity of the sequent with respect to the nesting of [a]'s. The following denition makes this more precise. Denition 6.5 For formulas ' of L 2a, dene [a]rank(') in the obvious way: [a]rank(q) = 0 for q 2 AP [ f?g [a]rank('! ) = maxf[a]rank('); [a]rank( )g [a]rank(2') = [a]rank(') [a]rank([a]') = [a]rank(') + 1 And for a sequent ) of L 2a, dene [a]rank( ) ) = maxf[a]rank(') j ' in [ g Lemma 6.6 For any sequent ) of L 2a, (a) if [ contains at least one formula of the form [a]', then [a]rank (Strip( ) )) [a]rank( ) ) 1 and otherwise [a]rank (Strip( ) )) = 0 (b) if [a]rank( ) ) = m then Strip m+1 ( ) ) = (; ) ;). Proof. Immediate from Denition

20 Denition 6.7 For each sequent 0 ) 0 in the language L 2a, dene Sub-S4F( 0 ) 0 ) to be the set of all sequents ) in L 2a satisfying the three properties: ) is S4F saturated; [ SubF orm( 0 [ 0 ); S4F 0 G ) : It is immediate from the second property that Sub-S4F( 0 ) 0 ) is nite; it is also nonempty since it always contains the empty sequent, (; ) ;). Note that if S4F 0 G 0 ) 0, then Sat( 0 ) 0 ) = 1 ) 1 is in Sub-S4F( 0 ) 0 ). Denition 6.8 For each sequent 0 ) 0 in the language L 2a, we dene a Kripke frame K ( 0 ) 0 ) = (W; R; F ) for 0 ) 0 as follows: W = Sub-S4F( 0 ) 0 ); ( ) ); ( 0 ) 0 ) 2 R i 2' 2 implies 2' 2 0 F = Strip The Kripke frame K ( 0 ) 0 ) is called the S4F saturation frame for 0 ) 0. Dene the canonical valuation : W! P(PV) for K ( 0 ) 0 ) by p 2 ( ) ) i p 2 It is readily veried that the S4F saturation frame K ( 0 ) 0 ) is a Kripke frame for L 2a. The reexivity and transitivity of R follow from the corresponding properties of implication, and by Lemma 6.4, F = Strip : W! W is a total function on W = Sub-S4F( 0 ) 0 ). Lemma 6.9 Main Semantic Lemma for S4F Let 0 ) 0 be any sequent in L 2a, let K = K ( 0 ) 0 ) be the S4F saturation frame for 0 ) 0, and let be the canonical valuation for K as in Denition 6.8. Then for all ( ) ) 2 W and for all formulas ' in L 2a, we have: ' 2 implies ( ) ) ' ' 2 implies ( ) ) 1 ' 20

21 Proof. We proceed by induction on the complexity of formulas ' in L 2a. Fix ( ) ) 2 W = Sub-S4F( 0 ) 0 ). For propositional variables p 2 PV, p 2 implies ( ) ) p, directly from the denition of atomic forcing, and p 2 implies p =2 since S4F 0 G ), hence ( ) ) 1 p from the denition of atomic forcing. For the constant?, the condition? 2 is impossible, since S4F 0 G ), and ( ) ) 1? by the denition of for?, hence the result holds for?. For!, assume by induction that the result holds for ' and, for all sequents in W. Fix ( ) ) 2 W and suppose '! 2. Then by the S4F saturation of ) (clause (1:), k = 0), we have either 2 or ' 2. Hence by the induction hypothesis, ( ) ) or ( ) ) 1 '. Hence ( ) ) '!. For the succeedent, suppose '! 2. Then by the S4F saturation of ) (clause (2:), k = 0), we have ' 2 and 2. Hence by the induction hypothesis, ( ) ) ' and ( ) ) 1. Hence ( ) ) 1 '!. For 2 in the antecedent, assume by induction that the result holds for ', for all sequents in W. Fix ( ) ) 2 W and suppose 2' 2. Now let ( 0 ) 0 ) 2 W be any sequent such that ( ) ); ( 0 ) 0 ) 2 R. Then 2' 2 0, by the denition of R, and then by the S4F saturation of 0 ) 0 (clause (3:), k = 0), we have ' 2 0. Hence by the induction hypothesis, ( 0 ) 0 ) '. Thus by the denition of for 2, we have ( ) ) 2'. For 2 in the succedent, assume by induction that the result holds for ', for all sequents in W. Fix ( ) ) 2 W and suppose 2' 2. Let 2 1 ; :::; 2 n be a list of all occurrences of formulas in which have 2 as their main connective/operator. Let 0 ) 0 be the sequent 2 1 ; :::; 2 n ) '. Then S4F 0 G 0 ) 0, for otherwise, from a cut-free proof of 0 ) 0, we could construct a cut-free proof of ) using the rule () 2) plus left and right weakening, thus contradicting S4F 0 G ). Now let ( 00 ) 00 ) = Sat( 0 ) 0 ). Then from Lemma 6.2, ( 00 ) 00 ) is S4F saturated; SubF orm( 0 ) SubF orm( 0 [ 0 ), and SubF orm( 0 ) SubF orm( 0 [ 0 ); and S4F 0 G 00 ) 00. Hence ( 00 ) 00 ) 2 W = Sub-S4F( 0 ) 0 ). Moreover, ( ) ); ( 00 ) 00 ) 2 R, since 2 i 2 implies 2 i Now ' 2 00, hence by the induction hypothesis, ( 00 ) 00 ) 1 '. Then by the denition of for 2, we have ( ) ) 1 2'. Finally for [a], assume by induction that the result holds for ', for all sequents in W. Fix ( ) ) 2 W, and let 0 ) 0 = F ( ) ) = Strip( ) ). Then [a]' 2 implies ' 2 0, by Lemma 6.4, hence by the induction hypothesis, ( 0 ) 0 ) '. Then by the denition of for [a], we have ( ) ) [a]'. Symmetrically, for the succeedent, 21

22 [a]' 2 implies ' 2 0, by Lemma 6.4, hence by the induction hypothesis, ( 0 ) 0 ) 1 '. Then by the denition of for [a], we have ( ) ) 1 [a]'. Theorem 6.10 Kripke completeness and nite model property for S4F Let 0 ) 0 be any sequent in L 2a. If S4F 0 G 0 ) 0, then there is a nite Kripke frame K and valuation for K such that (K; ) 1 V 0! W 0. Proof. Let K = K ( 0 ) 0 ) be the S4F saturation frame for 0 ) 0, let be the canonical valuation for K, as in Denition 6.8, and let ( 1 ) 1 ) = Sat( 0 ) 0 ). If S4F 0 G 0 ) 0 then ( 1 ) 1 ) 2 W. Since 0 1 and 0 1, we have by Lemma 6.9, hence ( 1 ) 1 ) ' for all ' 2 0 and ( 1 ) 1 ) 1 for all 2 0 (K; ) 1 ^ 0! _ 0 7 Consolidation Theorems for S4F We consolidate the major results of previous sections. Theorem 7.1 For all multisets ; of formulas of L 2a, the following are equivalent: (1:) S4F `G ) (2:) S4F `G ) (3:) S4F `H V! W (4:) T j= V! W for all topological structures T for L 2a, (5:) K V! W for all Kripke frames K for L 2a, (6:) K V! W for all nite Kripke frames K for L 2a. Proof. (1:) ) (2:) is trivial. (2:), (3:) is Proposition 4.2. (3:) ) (4:) is Proposition 3.2. (4:) ) (5:) is Proposition 5.6. (5:) ) (6:) is trivial. (6:) ) (1:) is Theorem Corollary 7.2 The sequent calculus S4F G admits cut-elimination. Corollary 7.3 The logic S4F is decidable. 22

23 8 Adding Continuity: S4C In our denition of a topological structure T = (X; T ; f) for the language L 2a, we place no restrictions on the function f : X! X, other than totality. The language itself is rich enough to express various properties of f, notably the continuity of f with respect to the topology T. We call the scheme Cont : [a]2'! 2[a]' the continuity axiom, in virtue of the following proposition. Proposition 8.1 [Kur66] I,x13; [RS63] III,x3. Let T = (X; T ; f) be a topological structure for L 2a. Then the following are equivalent: (a) for each ' 2 L 2a, T j= [a]2'! 2[a]' ; (b) for each ' 2 L 2a, T j= [a]2' $ 2[a]2' ; (c) the function f : X! X is continuous with respect to the topology T. Proof. Let ' be any formula of L 2a, let be any valuation for T, and let A = k'k X. Then k[a]2'! 2[a]'k = X i f 1 (int T (A)) int T (f 1 (A)) and k[a]2' $ 2[a]2'k = X Now the following equivalence is immediate: i f 1 (int T (A)) = int T (f 1 (int T (A))) (b) : f 1 (int T (A)) = int T (f 1 (int T (A))) for all A X i (c) : f 1 (U) = int T (f 1 (U)) for all U 2 T i:e: f is continuous w:r:t: the topology T since U 2 T i U = int T (U), and for any A X, we have int T (A) = U for some U 2 T. So rewriting (a) : f 1 (int T (A)) int T (f 1 (A)) for all A X it suces to show that (a) ) (c) and (b) ) (a). Assume (a) holds. Then for any U 2 T, we have U = int T (U), hence int T (f 1 (U)) f 1 (U) = f 1 (int T (U)) int T (f 1 (U)) and thus f 1 (U) = int T (f 1 (U)) 23

24 so (a) ) (c). Now, for any A X, we have int T (A) A, hence applying int T f 1, we have Thus if (b) holds, we have hence (b) ) (a), as required. int T (f 1 (int T (A))) int T (f 1 (A)) f 1 (int T (A)) = int T (f 1 (int T (A))) int T (f 1 (A)) The preceding proposition gives us an alternative, equivalent version of the continuity axiom, namely: Cont : [a]2'! 2[a]2' It is also readily established that over the Hilbert system S4F H, the schemes Cont and Cont are provably equivalent. The Cont scheme will be appealed to in devising a sequent calculus rule capturing continuity. From [RS63] and [Kur66], the converse of the Cont scheme, Open : 2[a]'! [a]2' characterizes the open mapping property. All instances of the Open scheme are true in a topological structure T = (X; T ; f), exactly when the function f : X! X is such that for all U 2 T, the image f(u) 2 T, since the latter condition holds exactly when int T (f 1 (A)) f 1 (int T (A)) for all A X; see [RS63], III,x3, p. 99, and [Kur66], I,x13,XIV. Thus the conjunction of the schemes Cont and Open, namely: 2[a]' $ [a]2' characterizes continuous and open maps f : X! X; equivalently, the set map f 1 : P(X)! P(X) is a (topological) homomorphism of the topological Boolean algebra B T (X) = (P(X); [; \; ; X; ;; int T ) into itself ([RS63], III,x3). In this study, our chief interest is in continuity. Next, we characterize the Kripke models which satisfy the continuity axiom. Proposition 8.2 Let K = (W; R; F ) be a Kripke frame for L 2a. Then the following are equivalent: (a) for each ' 2 L 2a, K [a]2'! 2[a]' ; 24

25 (b) the function F : W! W satises the condition: for all w; v 2 W. (w; v) 2 R implies (F (w); F (v)) 2 R Proof. For (b) ) (a), x ' 2 L 2a, w 2 W and a valuation for K. Then w 1 [a]2'! 2[a]', w [a]2' and w 1 2[a]', for all x 2 W ; if (F (w); x) 2 R then x '; and for some v 2 W ; (w; v) 2 R and F (v) 1 ' ) for some v 2 W ; (w; v) 2 R; but for all x 2 W ; if (F (w); x) 2 R then x 6= F (v), for some v 2 W ; (w; v) 2 R but (F (w); F (v)) =2 R For (a) ) (b), suppose (b) is false, so there exists w; v; u; z 2 W such that (w; v) 2 R, u = F (w), z = F (v) and (u; z) =2 R. (By reexivity, u 6= z, so W must have at least 2 elements, and so be non-degenerate.) Choose any p 2 AP and dene : W! P(AP ) by (x) = fpg if (u; x) 2 R ; otherwise By construction of, (u; z) =2 R implies z 1 p, hence F (v) 1 p, since z = F (v), and so v 1 [a]p. Since (w; v) 2 R, this means w 1 2[a]p. Our chosen valuation also gives us x p for all x 2 W such that (u; x) 2 R, hence u 2p; since u = F (w), we have w [a]2p. Hence w 1 [a]2p! 2[a]p. For comparative purposes, note that a Kripke frame K = (W; R; F ) forces all instances of the Open scheme exactly when the condition: (F (w); u) 2 R ) (9v 2 W )[ F (v) = u and (w; v) 2 R ] (F open) holds for all w; u 2 W. This condition is properly stronger than the converse of R- monotonicity: (F (w); F (v)) 2 R ) (w; v) 2 R since the (F open) condition can fail when F is not surjective; i.e. there is a u 2 W such that u 6= F (v) for all v 2 W. Denition 8.3 A topological structure T = (X; T ; f) for L 2a is called continuous i f is continuous with respect to T. A Kripke frame K = (W; R; F ) for L 2a is called continuous i F satises the condition: for all w; v 2 W ; i.e. F is R-monotone. (w; v) 2 R implies (F (w); F (v)) 2 R 25

26 Proposition 8.4 For all formulas ' of L 2a, if T j= ' for all continuous topological structures T for L 2a, then K ' for all continuous Kripke frames K for L 2a. Proof. From Proposition 5.6, it suces to show that for each continuous Kripke frame K = (W; R; F ) for L 2a, the induced topological structure T K = (W; T R ; F ) is such that F is continuous w.r.t. the topology T R. Now for arbitrary A W and w 2 W, we have: w 2 F 1 (int TR (A)), F (w) 2 int TR (A), (8z 2 W )[ (F (w); z) 2 R ) z 2 A ] ) (8v 2 W )[ (w; v) 2 R ) F (v) 2 A ] (), (8v 2 W )[ (w; v) 2 R ) v 2 F 1 (A) ], w 2 int TR (F 1 (A)) with the implication () a consequence of: (w; v) 2 R ) (F (w); F (v)) 2 R. (It is also readily veried that the converse also holds: F is continuous with respect to T R implies F is R-monotone.) Denition 8.5 The Hilbert-style proof system for the logic S4C has as its axiom schemes those of S4F (Denition 3.1) together with all instances of the scheme Cont : [a]2'! 2[a]' in the language L 2a ; the inference rules are the same as those of S4F. We write S4C `H ' or say ' is S4C H provable, if the formula ' 2 L 2a has an S4C Hilbert-style derivation. The following are derivable in S4C H, for any formula ' 2 L 2a and k 2 N. [a] k Cont : [a] k 2'! 2[a] k ' [a] k 3Cont : 3[a] k '! [a] k 3' The following is an admissible inference rule in S4C H, for any formulas '; ; 2 L 2a and k; l 2 N: Continuous Hoare composition: '! [a] k 2;! [a] l 2 '! [a] k+l 2 26

27 Proposition 8.6 Soundness of S4C Hilbert-style proof system For all formulas ' of L 2a, if S4C `H ', then T j= ' for all continuous topological structures T for L 2a and K ' for all continuous Kripke frames K for L 2a. Proof. Immediate from Propositions 3.2, 8.1 and 8.2. Denition 8.7 The Gentzen-style sequent calculus for the logic S4C has the same axioms and rules as those for S4F (Denition 4.1), and in addition, the rule: (Cont G ) : 2[a]2'; ) [a]2'; ) The rst point of note is that this new rule violates the sub-formula property, but it does so in a manageable way. To compensate, we have to deal with a larger class of psuedo-subformulas of a sequent. Denition 8.8 For each sequent 0 ) 0 of L 2a, dene 2 SubF orm( 0 [ 0 ) $ SubF orm( 0 [ 0 ) [ ff2' j ' 2 SubF orm( 0 [ 0 )gg where SubF orm( 0 [ 0 ) and 2-SubF orm( 0 [ 0 ) are multisets of formulas 4. Proposition 8.9 Equivalence of Sequent Calculus and Hilbert-style proof system for S4C Let and be multisets of formulas of L 2a, and let ' be any formula of L 2a. (i) If S4C `G ) then S4C `H V! W. (ii) If S4C `H ' then S4C `G ) '. Proof. For (i), beyond the proof of part (i) of Proposition 4.2, we need only consider the case where the last rule applied in the S4C G derivation of ) is the new (Cont G ) rule. So assume is [a]2'; 0 and the sequent ) is derived from 2[a]2'; 0 ) by the (Cont G ) rule. By the induction hypothesis, S4C `H 2[a]2' ^ ( V 0 )! W. Then 4 As in the discussion following Denition

28 1: 2[a]2' ^ ( V 0 )! W induction hypothesis 2: 2'! 22' axiom 24 3: [a](2'! 22') from 2: by [a] necessitation 4: [a]2'! [a]22' from 3: by [a]k 5: [a]22'! 2[a]2' axiom Cont 6: [a]2'! 2[a]2' from 4: and 5: 7:: [a]2' ^ ( V 0 )! W from 1: and 6: by propositional logic For (ii), beyond the proof of part (ii) of Proposition 4.2, we only need show that the Cont axiom [a]2'! 2[a]' is derivable in S4C G. Observe that the scheme ' ) ' (Axiom) 2' ) ' (2 )) [c]2' ) [c]' ([a] ) [a]) 2[c]2' ) [c]' (2 )) 2[c]2' ) 2[c]' () 2) [c]2' ) 2[c]' (Cont G ) ) [a]2'! 2[a]' ()!) [a] k Cont : [a] k [a]2'! [a] k 2[a]2' is derivable in S4C H : the derivation can be extracted from the proof of part (i) of the previous proposition, together with k applications of [a]-necessitation and an appeal to [a] k K $. Proposition 8.10 Let and be multisets of formulas of L 2a, let ' be a formula of L 2a, and let k 2 N. The following rule is admissible in the (cut-free) sequent calculus S4C G. ([a] k Cont G ) : [a] k 2[a]2'; ) [a] k [a]2'; ) Proof. Again, as in 4.3, a straightforward strategy should be to rst apply the rule Cont G and then deal with the [a] k prex. Without any loss of generality we may consider the case k = 1. Let [a]2[a]2'; ) be derived in S4C G and let D be a corresponding derivation. Consider a node in D where the formula [a]2[a]2' was introduced rst. There are three possibilities for a sequent assigned to this node: it is an axiom, an instant of the weakening or the [a] ) [a] rule. Let us treat the latter. The node under consideration is 2[a]2'; 0 ) 0 [a]2[a]2'; [a] 0 ) [a] 0 28

29 We replace this node by a pair of nodes 2[a]2'; 0 ) 0 [a]2'; 0 ) 0 (Cont G ) [a][a]2'; [a] 0 ) [a] 0 ([a] ) [a]) Now replace everywhere in the path from this node to the root sequent all corresponding occurrences of [a]2[a]2' by [a][a]2'. Perform this operation with all the nodes where [a]2[a]2' was introduced, adjust some weakenings and get an S4C G derivation of the desired sequent [a][a]2'; ). We leave the remaining cases to a reader as routine exercises. 9 Kripke Completeness for S4C To prove completeness for S4C, we modify the proof of Kripke completeness (and the nite model property) for S4F by further strengthening the notion of saturation to behave well with new Cont G rule, and force the "[a]-stripping" Strip function to be monotone with respect to the accessibility relation: ( ) ); ( 0 ) 0 ) 2 R i [ 2' 2 implies 2' 2 0 ] Let's start with a stronger notion of saturation. Denition 9.1 A sequent ) in the language L 2a is called S4C saturated i each the following conditions hold: (1:) if [a] k ('! ) 2 then either [a] k 2 or [a] k ' 2 ; (2:) if [a] k ('! ) 2 then both [a] k ' 2 and [a] k 2 ; (3:) if [a] k 2' 2 then [a] k ' 2 ; (4:) if [a] k [a]2' 2 then [a] k 2[a]2' 2, for all '; 2 L 2a and k 2 N. Note that if ) is S4C saturated, then ) is S4F saturated, since S4F saturation is just clauses (1:), (2:) and (3:) of S4C saturation. Clause (4:) of S4C saturation is reected in the S4F G admissible rule given in Proposition

30 Lemma 9.2 S4C Saturation For each sequent 0 ) 0 in the language L 2a, if S4C 0 G 0 ) 0, then there is an S4C saturated sequent ) such that (a) 0 2-SubF orm( 0 [ 0 ); (b) 0 2-SubF orm( 0 [ 0 ); (c) S4C 0 G ). Moreover, by determinizing the algorithm which produces such a saturated sequent from input 0 ) 0, we may take the output ) to be unique, and denote it Sat S4C ( 0 ) 0 ), the S4C saturation of 0 ) 0. Proof. The saturation algorithm and its verication are analogous with those in the proof of Lemma 6.2. In the Marking( ) ) sub-routine, add an extra line: For each occurrence of a formula [a] k [a]2' in, if there is no occurrence of [a] k 2[a]2' in then mark the [a] k [a]2' with \0"; otherwise, mark it with \1". In the main body of the algorithm, we add extra clauses: 4. Antecedent [a] k [a]2: If contains an occurrence of a formula [a] k [a]2' marked \0", put a check mark \X" next to the current node, then create one child node: ; [a] k 2[a]2' ) j ) X labelled ; [a] k 2[a]2' ). Run the sub-routine Marking( ; [a] k 2[a]2' ) ). Select the child node labelled ; [a] k 2[a]2' ) as the new current node. If contains no occurrences of any formula [a] k [a]2' marked \0", then proceed to Terminate and return the label of the current node, ) (which does NOT have a check mark \X") as the saturation of 0 ) 0, i.e. Sat S4C ( 0 ) 0 ) = ) As before, the saturation algorithm must terminate because 2-SubF orm( 0 [ 0 ) is nite and there is at most two branches at each step. It is immediate from the construction that if ) = Sat S4C ( 0 ) 0 ) then (a) 0 2-SubF orm( 0 [ 0 ) and 30

31 (b) 0 2-SubF orm( 0 [ 0 ) hold, and (c) S4C 0 G ) by the same argument as in Lemma 6.2. Next, we summarize the relevant properties of the Strip function in this setting. Lemma 9.3 Let ) be a sequent of L 2a, and let ( 0 ) 0 ) = Strip( ) ). Then for all ' 2 L 2a and k 2 N, (i) 0 SubF orm( ) and 0 SubF orm(); (ii) [a] k+1 ' 2 i [a] k ' 2 0 ; (iii) [a] k+1 ' 2 i [a] k ' 2 0 ; (iv) if S4C 0 G ), then S4C 0 G 0 ) 0 ; (v) if ) is S4C saturated, then 0 ) 0 is also S4C saturated. Proof. Properties (i), (ii) and (iii) are as in Lemma 6.4, and the argument for (iv) is identical to that in the proof of that lemma. For (v), we only need check clause (4:) of S4C saturation. Suppose ) is S4C saturated, and consider 0 ) 0. Then Hence 0 ) 0 is S4C saturated. [a] k [a]2' 2 0, [a] k+1 [a]2' 2 by (ii) ) [a] k+1 2[a]2' 2 by S4C saturation of ), [a] k 2[a]2' 2 0 by (ii) Denition 9.4 For each sequent 0 ) 0 in the language L 2a, dene Sub-S4C( 0 ) 0 ) to be the set of all sequents ) in L 2a satisfying the three properties: ) is S4C saturated; [ 2-SubF orm( 0 [ 0 ); S4C 0 G ) : Denition 9.5 For each sequent 0 ) 0 in the language L 2a, we dene a Kripke frame K ( 0 ) 0 ) = (W; R; F ) for 0 ) 0 as follows: 31

32 W = Sub-S4C( 0 ) 0 ); ( ) ); ( 0 ) 0 ) 2 R i 2' 2 implies 2' 2 0 F = Strip The Kripke frame K ( 0 ) 0 ) is called the S4C saturation frame for 0 ) 0. Dene the canonical valuation : W! P(PV) for K ( 0 ) 0 ) by p 2 ( ) ) i p 2 By Lemma 9.3, W = Sub-S4C( 0 ) 0 ) is closed under F = Strip, and R is reexive and transitive, hence K ( 0 ) 0 ) is a Kripke frame for L 2a. Our real interest is in the monotonicity of Strip with respect to R. Lemma 9.6 Let 0 ) 0 be a sequent of L 2a such that S4C 0 G 0 ) 0, and let K ( 0 ) 0 ) be the S4C saturation frame for 0 ) 0, as in Denition 9.5. Then F = Strip is monotone with respect to the relation R, where (( 1 ) 2 ); ( 2 ) 2 )) 2 R, 2' 2 1 implies 2' 2 2 Hence K ( 0 ) 0 ) is a continuous Kripke frame. Proof. Assume ( 1 ) 1 ); ( 2 ) 2 ) 2 W C, and (( ( 0 ) 0 ) 1 ) 1 ); ( 2 ) 2 )) 2 R. Let Strip( i ) i ) = ( 0 i ) 0 i), for i = 1; 2. Then x ' 2 L 2a. Then 2' 2 0 1, [a]2' 2 1 by (ii) of Lemma 9:3 ) 2[a]2' 2 1 by S4C saturation; clause (4:) with k = 0 ) 2[a]2' 2 2 by denition of R ) [a]2' 2 2 by S4C saturation; clause (3:) with k = 0, 2' by (ii) of Lemma 9:3 Hence (( 0 1 ) 0 1); ( 0 2 ) 0 2)), as required. Lemma 9.7 Main Semantic Lemma for S4C Let 0 ) 0 be any sequent in L 2a, let K = K ( 0 ) 0 ) = (W; R; F ) be the S4C saturation frame for 0 ) 0, and let be the canonical valuation for K as in Denition 9.5. Then for all ( ) ) 2 W and for all formulas ' in L 2a, we have: ' 2 implies ( ) ) ' ' 2 implies ( ) ) 1 ' 32