A Hybrid Intuitionistic Logic: Semantics and Decidability

A Hybrid IntuitionisticLogic:SemanticsandDecidability

�

RohitChadha DamianoMacedonio Vladimiro Sassone

February12,2005

Abstract

An intuitionistic, hybrid modallogic suitablefor reasoningaboutdistri-bution of resourceswasintroducedin [14, 15]. The modalitiesof the logicallow usto validatepropertiesin a particular place, in someplaceandin allplaces. We give a soundandcompleteKripke semanticsfor the logic ex-tendedwith disjunctive connectives. The extendedlogic canbe seenasaninstanceof Hybrid IS5. We alsogive a soundandcompletebirelationalse-mantics, andshow thatthesemanticssatisfiesthefinite modelproperty:if ajudgementis not valid in thelogic, thenthereis a finite birelationalcounter-model.Hencewe provethatthelogic is decidable.

1 Intr oduction

In currentcomputingparadigmdistributedresourcesspreadoverandsharedamon-gstdi

�erentnodesof a computersystemarevery common.For example,printers

maybesharedin local areanetworks,or distributeddatamaystoredocumentsinpartsat di

�erentlocations.Thetraditionalreasoningmethodologiesarenot easily

scalableto thesesystemsasthey may lack implicitly trust-ableobjectssuchasacentralcontrol.

This hasresultedin the innovation of several reasoningtechniques.A popu-lar approachin the literaturehasbeenthe useof algebraicsystemssuchaspro-cessalgebra[18, 13, 9]. Thesealgebrashave rich theoriesin termsof semantics[18], logics [12, 20, 8, 7], and types[13]. Another approachis logic-oriented[14, 15, 30, 19]: intuitionistic modal logics areusedasfoundationsof type sys-temsby exploiting the propositions-as-types, proofs-as-programsparadigm[11].An instanceof this wasintroducedin [14, 15]. The logic introducedthereis thefocusof ourstudy.

Theformulaein this logic includenames,calledplaces. Assertionsin thelogicareassociatedwith places,andarevalidatedin places.In additionto considering�Researchpartially supportedby ‘MIKADO : Mobile Calculi basedon Domains’,EU FET-GC

IST-2001-32222,and‘MyThS: ModelsandTypesfor Securityin Mobile DistributedSystems’,EUFET-GCIST-2001-32617.

1

whethera formula is true, we arealso interestedin where a formula is true. Inorder to achieve this, the logic hasthreemodalities. The modalitiesallow us toinfer whethera propertyis validatedin a specificplaceof the system(@p), orin an unspecifiedplaceof the system( � ), or in any part of the system( � ). Themodality@p internalisesthemodelin the logic, andhencecanbeclassifiedasahybrid logic [1, 2, 3, 4, 5, 24, 25, 6].

An intuitionistic naturaldeductionfor the logic without the disjunctive con-nectivesis givenin [14, 15]. Thejudgementsin thelogic mentiontheplacesunderconsideration.The naturaldeductionrules for � and � resemblethosefor exis-tential and universalquantificationof first-order intuitionistic logic. We extendthelogic with disjunctive connectives,andextendthenaturaldeductionsystemtoaccountfor these.

As notedin [14, 15], thelogic canalsobeusedto reasonaboutdistribution ofresourcesin additionto servingasthefoundationof atypesystem.Thepapers[14,15], however, lackamodelto matchtheusageof thelogic asatool to reasonaboutdistributedresources.In thispaper, webridgethegapby presentingaKripke-stylesemantics[17] for the logic extendedwith disjunctive connectives. In Kripke-stylesemantics,formulaeareconsideredvalid if they remainvalid whentheatomsmentionedin theformulaechangetheir valuefrom falseto true. This is achievedby usinga partially orderedsetof possiblestates. Informally, moreatomsaretruein largerstates.

WeextendtheKripke semanticsof theintuitionistic logic [17], enrichingeachpossiblestatewith a setof places.Thesetof placesin Kripke statesarenot fixed,and di

�erentpossibleKripke statesmay have di� erent set of places. However,

the setof placesvary in a conservative way: larger Kripke statescontainlargersetof places.In eachpossiblestate,di

�erentplacessatisfydi

�erentformulae.In

themodel,we interpretatomicformulaeasresourcesof a distributedsystem,andplacementof atomsin apossiblestatecorrespondsto thedistribution of resources.

Theenrichmentof themodelwith placesrevealsthetruemeaningof themodal-ities in the logic. The modality @p expressesa propertyin a namedplace. Themodality � correspondsto a weakform of spatialuniversalquantificationandex-pressesapropertycommonto all places,andthemodality � correspondsto aweakform of spatialexistentialquantificationandexpressesapropertyvalid somewherein thesystem.For the intuitionistic connectives,the satisfactionof formulaeat aplacein apossiblestatefollows thestandarddefinition[17].

In orderto give semanticsto a logical judgement,we allow modelswith moreplacesthan thosementionedin the judgement. This admitsthe possibility thata usermay be awareof only a certainsubsetof namesin a distributed system.This is crucial in theproof of soundnessandcompletenessasit allows us to cre-atewitnessesfor theexistential( � ) andtheuniversal( � ) modalities.TheKripkesemanticsrevealsthat the extendedlogic canbe seenasthe hybridisationof thewell-known intuitionisticmodalsystemIS5[21, 26, 10, 28, 23, 29].

Following [10, 28, 23, 29], wealsointroduceasoundandcompletebirelationalsemanticsfor thelogic. Thereasonfor introducingbirelationalsemanticsis thatit

2

allows us to prove decidability. As in Kripke models,birelationalmodelshave apartially orderedset.Theelementsof this setarecalledworlds. In additionto thepartialorder, birelationalmodelsalsohaveanequivalencerelationamongstworlds,calledtheaccessibilityor reachability relation. Unlike theKripke semantics,wedo not enricheachworld with a setof places.Instead,we have a partial function,the evaluationfunction, which attachesa nameto a world in its domain. As weshallsee,thepartialityof thefunctionis crucialto theproof of decidability.

The partial evaluationfunction must satisfy two importantproperties. One,coherence, statesthat if the function associatesa nameto a world then it alsoassociatesthesamenameto all largerstates.Theother, uniqueness, statesthattwodi�

erentworlds accessiblefrom oneanotherdo not evaluateto the samename.Coherenceis essentialfor ensuringmonotonicityof thelogicalconnective@p, anduniquenessis essentialfor the ensuringsoundnessof introductionof conjunctionandimplication.

Following [29], we alsointroduceanencodingof theKripke modelsinto bire-lational models. The encodingmapsa placein a Kripke stateinto a world of abirelationalmodel. Theencodingensuresthat if a formula is validatedat a placein astateof theKripke model,thenit is alsovalidatedat thecorrespondingworld.The encodingallows us to concludesoundnessof Kripke semanticsfrom sound-nessof birelationalsemantics.It alsoallows us to concludecompletenessof thebirelationalmodelsfrom completenessof Kripke semantics.

Surprisingly, thesoundnessof thebirelationalmodelswasnotstraightforward.Theproblematiccasesaretheinferencerulesfor introductionof � andtheelimina-tion of � . In Kripke semantics,soundnessis usuallyprovedby duplicatingplacesin a conservative way [6, 29]. Thepartiality of theevaluationfunction,alongwiththecoherenceanduniquenessconditionshowever impededin obtainingsucha re-sult. It hasbeennotedin [29] that the soundnessis alsonon-trivial in the caseof birelationalmodelsfor intuitionistic modallogic. However, theproblemswithsoundnessherearisepurelybecauseof thehybrid natureof the logic. Soundnessis obtainedby using a mathematicalconstructionthat createsa new birelationalmodelfrom a givenone. In thenew model,thesetof worldsconsistof thereach-ability relationof theold model,andwe addnew worldsto witnesstheexistentialanduniversalproperties.

Theproofof completenessfollows standardtechniquesfrom intuitionistic log-ics, andgivena judgementthat is not provablein the logic we constructa canon-ical Kripke modelthat invalidatesthe judgement. However, following [29], theconstructionof this model is donein a carefulway so that it assistsin the proofof decidability. Theencodingof Kripke modelsinto birelationalmodelsgivesusacanonicalbirelationalmodel. Theworldsof canonicalbirelationalmodelsconsistsof triples: a finite setof placesQ, a finite setof sentences� , anda specialplaceqwhich is theevaluationof theworld.

Thesetof worldsin thecanonicalbirelationalmodelsmaybeinfinite. Weshowthatby identifying theworlds in thebirelationalmodelup-to renamingof places,wecanconstructanequivalentfinite model,calledthequotientmodel. Thisallows

3

usto deducethefinite modelpropertyfor thebirelationalsemantics:if ajudgementis notprovablein thelogic, thenwecanconstructafinite birelationalmodelwhichinvalidatesthe judgement. The proof is adaptedfrom the caseof intuitionisticmodallogic [29]. Thepartiality of theevaluationfunction is crucial in theproof.Thefinite modelpropertyallows usto concludethedecidabilityof thelogic.

The restof the paperis organisedasfollows. In Section2, we introducethelogic andtheKripke semantics.In Section3, we introducethebirelationalseman-tics,andprove thesoundnessof thelogic with respectto birelationalmodels.Theencodingof Kripke modelsinto birelationalmodelsis alsogivenwhich allows usto concludesoundnessof Kripke semantics.Theconstructionof canonicalmodelsandcompletenessis discussedin Section4. In Section5, weconstructthequotientmodelandprove thefinite modelpropertyfor birelationalmodels.Relatedwork isdiscussedin Section6, andour resultsaresummarisedin Section7. Weanticipatecollectingsomeof theproofsto anAppendixin thefinal version.

2 Logic

We now introduce,throughexamples,the logic presentedin [14, 15] extendedwith disjunctive connectives.Thereasonfor addingdisjunctive connectivesis thatit provides us with full expressivenessof intuitionistic logic. The logic can beusedto reasonaboutheterogeneousdistributedsystems.To gain someintuition,considera distributedpeerto peerdatabasewherethe informationis partitionedovermultiple communicatingnodes(peers).

Informally, the databasehasa setof nodes,or places, anda setof resources(data)distributedamongsttheseplaces.Thenodesarechosenfrom theelementsofafixedset,denotedby p� q� r � s�� . Resourcesarerepresentedby atomicformulaeA� B�� Atoms. Intuitively, anatomA is valid in aplacep if thatplacecanaccesstheresourceidentifiedby A.

Werewe reasoningabouta particularplace,the logical connectivesof the in-tuitionistic framework would besu cient. For example,assumethata particulardocument,doc, is partitionedin two parts,doc1 anddoc2, and in order to gainaccessto thedocumentaplacehasto accessbothof its parts.Thiscanbeformallyexpressedasthe logical formula: (doc1 � doc2) � doc, where � and � arethelogical conjunctionand implication. If doc1 anddoc2 arestoredin a particularplace,thentheusualintuitionistic rulesallow to infer thattheplacecanaccesstheentiredocument.

The intuitionistic framework is extendedin [15] in orderto reasonaboutdif-ferentplaces.An assertionin sucha logic takesthe form “ � at p”, meaningthatformula � is valid at placep. Theconstruct“at” is a meta-linguisticsymbolandpoints to the placewherethe reasoningis located. For example,doc1 at p anddoc2 at p formalisesthe notion that the partsdoc1 and doc2 are locatedat thenodep. If, in addition,theassertion((doc1 � doc2) � doc) at p is valid, we canconcludethatthedocumentdoc is availableat p.

4

Pleasenotethat in the formula � at p, � doesnot containany occurrencesoftheconstructat. Instead,� usesthemodality@p, onefor eachplacein thesystem,to castthemeta-linguisticat at thelanguagelevel. Themodality@p internalisesresourcesat thelocationp, andthemodalformula � @p meansthattheproperty�is valid at p, andnot necessarilyanywhereelse.Indeedboth � at p and � @p willhave thesamesemantics,andit is possibleto defineanequivalentlogic in whichtheconstructat is not needed.However, we will preferto keepthedistinctioninthe logic asthis wasthe casein [14, 15]. Also, the introductionandeliminationrulesfor themodality@ is moreelegantif we maintainthisdistinction.

An assertionof theform � @p at p� meansthatin theplacep� wearereasoningaboutthe property � valid at the placep. For example,supposethat the placephasgot the first half of the document,i.e., doc1 at p, and p� hasgot the secondone,i.e.,doc2 at p� . In thelogic wecanformalisethefactthat p� cansendthepartdoc2 to p by usingtheassertion(doc2 � (doc2@p)) at p� . Therulesof thelogicwill concludedoc2 at p andsodoc at p. The logic alsohastwo othermodalitiesto accommodatereasoningaboutthepropertiesvalid at di

�erentlocations,which

we discussbriefly.Knowing exactly wherea propertyholdsis a strongability, andwe mayonly

know that the propertyholds somewherewithout knowing the specific locationwhereit holds. In orderto dealwith this, the logic hasthemodality � : �� meansthattheformula � holdsin someplace.In theexampleabove, thelocationof doc2

is not importantaslong aswe know that this documentis locatedin someplacefrom whereit cansentto p. Formally, thiscanbeexpressedby thelogical formula� (doc2 � (doc2 � (doc2@p))) at p� . By assumingthis formula, we can inferdoc2 at p, andhencethedocumentdoc is availableat p.

Even if we deal with resourcesdistributed in heterogeneousplaces,certainpropertiesarevalid everywhere.For thispurpose,thelogic hasthemodality � : ��meansthat theformula � is valid everywhere.In theexampleabove, p canaccessthedocumentdoc, if thereis a placethathasthepartdoc2 andcansendit every-where.Thiscanbeexpressedby theformula � (doc2 � (doc2 �� doc2)) at p� . Therulesof thelogic wouldallow usto concludethatdoc2 is availableat p. Thereforethedocumentdoc is alsoavailableat p.

We now defineformally the logic. As mentionedabove, it is essentiallythelogic introducedin [15] enrichedwith the disjunctive connectives � and � , thusachieving thefull setof intuitionistic connectives. This allows usto expressprop-ertiessuchas: thedocumentdoc2 is locatedeitherat p itself or at q (n whichcasep hasto fetch it). This canbe expressedby the formula (doc2 � ((doc2@q) �doc2)) at p.

For therestof thepaper, we shallassumea fixedcountablesetof atomicfor-mulaeAtoms, andwe vary thesetof places.Givenacountablesetof placesPl, letFrm(Pl) bethesetof formulaebuilt from thefollowing grammar:

� ::� A �� !��!��!�� @p ��"�!��#�Herethe syntacticcategory p standsfor elementsfrom Pl, andthesyntacticcat-

5

egory A standsfor elementsfrom Atoms. The elementsin Frm(Pl) are said tobepure formulae, andaredenotedby smallGreekletters �#�$%�'&(�� An assertionof theform � at p is calledsentence. We denoteby capitalGreekletters)*�+) 1 ��(possiblyempty)finite setsof pureformulae,andby capitalGreekletters�,�-� 1 ��(possiblyempty)finite setsof sentences.

Eachjudgementin this logic is of theform

) ; �/. P � at p�

where

0 the global context ) is a (possiblyempty)finite setof pure formulae,andrepresentsthepropertiesassumedto holdat every placeof thesystem;

0 the local context � is a (possiblyempty)finite setof sentences;sincea sen-tenceis a pureformulaassociatedto a place,� representswhatwe assumeto bevalid in any particularplace.

0 thesentence� at p saysthat � is derivedto bevalid in theplacep by assum-ing ) ; � .

0 P is asetof places.It representsthepartof thesystemwe arefocusingon.

In the judgement,it is assumedthat the placesmentionedin ) and � aredrawnfrom thesetP. More formally, if PL(X) denotesthesetof placesthatappearin asyntacticobjectX, thenit mustbe thecasethatPL() ) 1 PL(� ) 1 PL( � at p) 2 P.Any judgementnot satisfyingthisconditionis assumedto beundefined.

A naturaldeductionsystemwithoutdisjunctiveconnectivesis givenin [14, 15].Thenaturaldeductionsystemwith disjunctiveconnectivesis givenin Figure1. Themostinterestingrulesare � E, theeliminationof � , and � I , the introductionof � .In theserules, P 3 p denotesthe disjoint union P 154 p6 , andwitnessesthe factthat the placep doesnot occur in both ) and � . If p � P, thenP 3 p, andanyjudgementcontainingsuchnotation,is assumedto beundefinedin orderto avoidasideconditionstatingthis requirement.

The rule � E explainshow we canuseformulaevalid at someunspecifiedlo-cation: we introducea new placeandextendthe local context by assumingthattheformula is valid there. If any assertionthatdoesnot mentionthenew placeisvalidatedthus,thenit is alsovalidatedusingtheold localcontext. Therule � I saysthat if a formula is validatedin somenew place,without any local assumptiononthatnew place,thenthatformulamustbevalid everywhere.

Therules � I and � E arereminiscentof theintroductionof theexistentialquan-tification,andtheeliminationof universalquantificationin first-orderintuitionisticlogic. This analogy, however hasto be taken carefully. For example,if ) ; �7. P��$ at p, thenwe canshow usingthe rulesof the logic that ) ; �8. P ��$ at p. Inotherwords,if a formula $ is truein someunspecifiedplace,thenevery placecandeducethatthereis someplacewhere$ is true.

6

L

) ; �,�� at p . P � at p

G

)*�� ; �9. P � at p

:I

) ; �9. P � at p

;E

) ; �9. P � at p

) ; �9. P $ at p

< I

) ; �9. P � 1 at p) ; �9. P � 2 at p

) ; �9. P � 1 � � 2 at p

< Ei (i = 1> 2)

) ; �9. P � 1 � � 2 at p

) ; �9. P � i at p

?I (i = 1> 2)

) ; �9. P � i at p

) ; �9. P � 1 � � 2 at p

? E

) ; �9. P � 1 � � 2 at p) ; �,�� 2 at p . P $ at p) ; �,�� 1 at p . P $ at p

) ; �9. P $ at p

@ I

) ; �,�� at p . P $ at p

) ; �9. P ��A$ at p

@ E

) ; �9. P ��A$ at p) ; �9. P � at p

) ; �9.B$ at p

@I

) ; �9. P � at p

) ; �9. P � @p at p�

@E

) ; �9. P � @p at p�) ; �9. P � at p

CI

) ; �9. P � at p

) ; �9. P �� at p�

CE

) ; �9. P �� at p�) ; �,�� at q . PD q $ at p�E�) ; �9. P $ at p�F�

G I

) ; �9. PD q � at q

) ; �9. P �� at p

G E) ; �9. P �� at p)*�� ; �9. P $ at p�) ; �9. P $ at p�

Figure1: Naturaldeduction.

7

Also notethat the rule � E asstatedhasa local flavour: from � at p, we caninfer any otherpropertyin the sameplace,p. However, the rule hasa ”global”consequence.If we have � at p, thenwe caninfer � @q at p. Using@E, we cantheninfer � at q. Hence,if asetof assumptionsmakesaplaceinconsistent,thenitwill make all placesinconsistent.

As we shall seein section2.1, the Kripke semanticsof this logic would besimilar to theonegivenfor intuitionisticsystemIS5 [21, 26, 29]. Hencethis logiccanbeseenasaninstanceof Hybrid IS5[6].

2.1 Kripk eSemantics

Therearea numberof semanticsfor intuitionistic logic and intuitionistic modallogics that allow for a completenesstheorem[6, 16, 29, 10, 28, 21, 23]. In thisSection,we concentrateon the semanticsintroducedby Kripke [17, 31], as it isconvenientfor applicationsandfairly simple. This would provide a formalisationof theintuitive conceptsintroducedabove.

In Kripke semanticsfor intuitionisticpropositionallogic, logicalassertionsareinterpretedover Kripke models. The validity of an assertiondependson its be-haviour as the truth valuesof its atomschangefrom falseto true accordingto aKripkemodel.A Kripkemodelconsistsof apartially orderedsetof Kripke states,andan interpretation, I , thatmapsatomsinto states.Theinterpretationtellswhichatomsaretruein astate.It is requiredthatif anatomis truein astate,thenit mustremaintrue in all larger states.Hence,in a larger statemoreatomsmay becometrue.Considera logicalassertionbuilt from theatomsA1 ��*� An. Theassertionissaidto bevalid in astateif it continuesto remainvalid in all largerstates.

In order to expressthe full power of the logic introducedin above, we needto enrichthemodelby introducingplaces.We achieve this by associatinga setofplacesPk to eachKripke statek. The formulaeof the logic arevalidatedin theseplaces.Theinterpretationis indexedby theKripke states,andtheinterpretationIk

mapsatomsinto thesetPk. Sincewe consideratomsto beresources,themap Ik

tellshow resourcesaredistributedin theKripke statek.In thecaseof intuitionistic propositionallogic, anatomvalidatedin a Kripke

stateis validatedin all larger states.In orderto achieve thecorrespondingthing,we shall requirethatall placesappearingin a Kripke stateappearin every largerstate.Furthermore,we requirethat if Ik mapsanatominto a place,thenI l shouldmaptheatomin thesameplacefor all statesl larger thank. In termsof resources,it meansthatplacesin largerstateshave possiblymoreresources.

TheKripke modelsthatwe shall definenow aresimilar to theKripke modelsdefinedfor theintuitionisticmodalsystemIS5[10, 28, 21, 23, 6, 29]. In thedefini-tion, theK is thesetof Kripke states,whoseelementsaredenotedby k� l �� . Therelation H is thepartialorderon thesetof states.

Definition 1 (Distributed Kripk eModel) A quadrupleIJ� (K ��H%��4 Pk 6 kK K �4 Ik 6 kK K) is calledadistributedKripke modelif

8

0 K is a (nonempty)set;

0 H is apartialorderon K;

0 Pk is anon-emptysetof placesfor all k � K;

0 Pk 2 Pl if k H l;

0 Ik : Atoms� Pow(Pk) is suchthatif Ik(A) 2 I l(A) for all k H l.

Let Pls � kK K Pk. WeshallsaythatPls is thesetof placesof I .

Thedefinitiontellsonlyhow resources,i.e.atoms,aredistributedin thesystem.In orderto givesemanticsto thewholesetof formulaeFrm(Pls), weneedto extendIk. Theinterpretationof a formuladependson its compositeparts,andif it is validin aplacein agivenstate,thenit remainsvalid at thesameplacein all largerstates.For example,theformula � � $ is valid in astatek atplacep � Pk, if both � and $aretrueatplacep in all statesl L k.

Theintroductionof placesin themodelallows theinterpretationof thespatialmodalitiesof thelogic. Formula � @p is satisfiedata placein astatek, if it is trueat p in all statesl L k; �� and �"� aresatisfiedat a placein statek, if � is truerespectively at someor atevery placein all statesl L k.

We extend now the interpretationof atomsto interpretationof formulaebyusinginductionon thestructureof theformulae.Theinterpretationof formulaeissimilar to thatusedfor modalintuitionistic logic [10, 28, 21, 23, 6, 29].

Definition 2 (Semantics) Let IA� (K ��H%��4 Pk 6 kK K ��4 Ik 6 kK K) bea distributedKripkemodelwith setof placesPls. Given k � K, p � Pk, anda pureformula � withPL( � ) 2 Pls, wedefine(k� p) � �M� inductively as:

(k� p) � � A i�

p � Ik(A);(k� p) � � � i

�p � Pk;

(k� p) � � � never;(k� p) � � � � $ i

�(k� p) � �N� and(k� p) � �N$ ;

(k� p) � � �O� $ i�

(k� p) � �N� or (k� p) � �M$ ;(k� p) � � ��$ i

�(l L k and(l � p) � �N� ) implies � �N$ ;

(k� p) � � � @q i�

q � Pk and(k� q) � �M� ;(k� p) � � �� i

�(l L k andq � Pl) implies(l � q) � �P$ ;

(k� p) � � �� i�

thereexistsq � Pk suchthat(q� k) � �M� .Wepronounce(k� p) � �M� as(k� p) forces� , or (k� p) satisfies� . Wewrite k � �M� at pif (k� p) � �N� .

It is clearfrom thedefinition that if k � �Q� at p, thenPL( � at p) 2 Pk. Pleasenotethat in this extension,exceptfor logical implication andthemodality � , wehavenotconsideredlargerstatesin orderto interpretamodalityor aconnective. Itturnsout that thesatisfactionof a formula in a stateimplies thesatisfactionin alllargerstates.

9

Proposition 1 (Kripk eMonotonicity) Let IR� (K ��HS��4 Pk 6 kK K ��4 Ik 6 kK K) be a dis-tributedKripke modelwith setof placesPls. Therelation � � preservesthepartialorderonK, i.e., for each k� l � K, p � Pk, and �� Frm(Pk), if l L k then(k� p) � �M�implies(l � p) � �P� .

Proof: Standard,by inductionon thestructureof formulae. T

Considernow the distributed databasedescribedbefore. We canexpressthesamepropertiesthatwe inferredin Section2 by usinga distributedKripke model.Fix a Kripke statek. Theassumptionthat the two parts,doc1 � doc2, canbecom-bined in p in a statek to give the documentdoc can be expressedas (k� p) � �(doc1 � doc2) � doc. If theresourcesdoc1 anddoc2 areassignedto theplacep,i.e., (k� p) � � doc1 and(k� p) � � doc2, then,since(k� p) � � doc1 � doc2, it followsthat(k� p) � � doc.

Let usconsidera slightly morecomplex situation.Supposethatk � �5� ( doc2 �(doc2 � � doc2) ) at p� . According to the semanticsof � , thereis someplacer suchthat (k� r) � � doc2 � (doc2 � � doc2). The semanticsof � tells us that(k� r) � � doc2 and(k� r) � � (doc2 �A� doc2). Since(k� r) � � doc2, weknow from thesemanticsof � that(k� r) � �P� doc2, andfrom thesemanticsof � that(k� p) � � doc2.Therefore,if doc1 is placedat p in thestatek, thenthewholedocumentdoc wouldbecomesavailableatplacep in statek.

In orderto givesemanticsto thejudgementsof thelogic, weneedto extendthedefinitionof forcing relationto judgements.We begin by extendingthedefinitionto contexts.

Definition 3 (Forcing on Contexts) Let IU� (K ��HS��4 Pk 6 kK K ��4 Ik 6 kK K) bea distrib-utedKripkemodel.Givenastatek in K, afinite setof pureformulae) , andafinitesetof sentences� suchthat PL() ; � ) 2 Pk; we saythatk forcesthecontext ) ; �(andwe write k � �V) ; � ) if

1. for every ��W) andevery p � Pk: (k� p) � �P�� ;2. for every $ at q �W� : (k� q) � �P$ .

Finally, we extendthedefinitionof forcing to judgements.

Definition 4 (Satisfactionfor a Judgment) Let IX� (K ��H%��4 Pk 6 kK K ��4 Ik 6 kK K) beadistributedKripke model.Thejudgement) ; �/. P & at p is saidto bevalid in I if

0 PL() ) 1 PL(� ) 1 PL(& ) 1!4 p6S2 P;

0 for every k � K suchthatP 2 Pk, if k � �Y) ; � then(k� p) � �Z& .

Moreover, we saythat ) ; �[. P & at p is valid (andwe write ) ; �[��N& at p) if it isvalid in every distributedKripke model.

10

Although, it is possibleto obtainsoundnessandcompletenessof distributedKripke semanticsdirectly, we shall not do so in this paper. Instead,they willbe derived as corollaries. Soundnesswill follow from the soundnessof birela-tional semanticsandencodingof distributedKripke modelsinto birelationalmod-els. Completenesswill emergeasa corollary in theproof of constructionof finitecounter-model.

3 Bir elational Models

Oneothersemanticsgivenfor modalintuitionistic logicsin literatureis birelationalsemantics[10, 28, 23, 29]. Theadvantageof usingbirelationalmodelsis thattheyusuallyenjoy thefinite modelproperty, which thenimmediatelygivesthe decid-ability of the logic. Kripke semanticsfor intuitionistic modallogicsusuallydoesnot enjoy this property[22, 29], aswould be the casewith our Kripke semanticsalso.

Birelationalmodels,like Kripke models,have a setof partially orderedstates.Thepartially orderedstateswill becalledworlds, andwe useu� v� w�� to rangeover them.Formulaewill bevalidatedin worlds,andif a formulais validatedin aworld, thenit will bevalidatedin all largerworlds. In orderto validateatomswehave the interpretationI , which mapsatomsinto a subsetof worlds. If I mapsanatominto aworld, thenit will maptheatomin all largerworlds.

In additionto thepartialorder, however, thereis alsoa secondbinaryrelationonthesetof stateswhich is calledreachability or accessibilityrelation.Intuitively,uRwmeansthat w will be reachablefrom u. As our logic is a hybridisationforS5, the relationR will beanequivalencerelation. TherelationR will alsosatisfya technicalrequirement,reachability condition, that is necessaryfor ensuringthemonotonicityandsoundnessof thelogic.

Unlike thedistributedKripkesemantics,thestateswill nothaveasetof placesassociatedto them. Instead,we have a partial functionEval, which mapsa worldto a singleplace.In a sensewhichwe will make precisein Section3.2,a world ina birelationalmodelcorrespondsto a placein a specificKripke state.As we shallseelater, thepartiality of the functionEval is crucial in theproof of finite modelproperty. In thecaseEval(w) is definedandis p, we shall saythatw evaluatestop.

In additionto partiality, Eval will alsosatisfytwo otherproperties:coherenceanduniqueness. Coherencesaysthatif aworldevaluatesto p, thenall largerworldsevaluateto p. Togetherwith thereachabilitycondition,coherencewill ensurethemonotonicityof themodality@. Uniquenesswill saythatnotwo worldsreachablefrom eachothercanevaluateto t

hesameplace.Uniquenesswill beessentialfor thesoundnessof introductionof conjunction( � I ), andof implication( � I ). Wearenow readyto formally definebirelationalmodels.

11

Definition 5 (Bir elational Model) Givena setof placesPls, a birelationalmodelon Pls is aquintuple\ Pls � (W��H%� R � I � Eval), where

1. W is a (nonempty)set,rangedoverby v� v� � w� w� �� .2. H is apartial orderon W.

3. R 2 W ] W is anequivalencerelationandsatisfiesthe reachability condi-tion:

if w� L wRv thenthere existsv� such thatw� Rv� L v;

4. I : Atoms� Pow(W) is suchthatif w � I (A) thenw�� I (A) for all w�"L w.

5. Eval : W � Pls is a partial function. We write v if Eval(v) is not defined,v_ if Eval(v) is defined,andv_ p if Eval(v) is definedandequalto p.

Moreover, thefollowing propertieshold:

(a) coherence:for any v � W, if v_ p thenw_ p for every w L v;

(b) uniqueness:for every v � W suchthat v_ p, if vRv� andv�`_ p, thenv � v� .

In additionto thereachabilitycondition,usuallythereis anothersimilarcondi-tion in birelationalmodelsfor intuitionistic modallogics[10, 28, 23, 29]:

if wRv H v� thenthere existsw� such thatw H w� Rv�Pleasenotethat in our case,sinceR is anequivalencerelation,this follows imme-diatelyfrom thereachabilitycondition.

We arenow readyto extendthe interpretationof atomsto formulae.The for-mula � @p is true in a world w, if thereis a reachableworld which evaluatesto pandwhere� is valid. Theformula �� is validatedin a world w, if thereis a reach-ableworld (notnecessaryin thedomainof Eval) where� is valid. Theformula ��is valid in aworld w if � is valid in all worldsreachablefrom worldsw� largerthanw.

Definition 6 (Bi-forcing Semantics) Let \ Pls � (W��H%� R� I � Eval) be a birela-tionalmodelonPls. Givenw � W, andapureformula �!� Frm(Pls), wedefinetheforcing relationw � �P� inductively asfollows:

w � � A i�

w � I (A);w � �9� for all w � W;w � �9� never;w � �M� � $ i

�w � �M� andw � �M$ ;

w � �M�� $ i�

w � �M� or w � �P$ ;w � �M��A$ i

�(v L w andv � �M� ) impliesv � �N$ ;

w � �M� @q i�

thereexistsv suchthatwRv, v_ q andv � �N� ;w � �M�"� i

�(v L w andvRv� ) implies � �M� ;

w � �M�a� i�

thereexistsv � W suchthatwRvandv � �N� .

12

Wepronouncew � �M� asw forces� , or w satisfies� .Wehave themonotonicityof thelogic.

Proposition 2 (Monotonicity) Let \ Pls bea birelationalmodelon Pls. There-lation � � preservesthe partial order in W, namely, for every world w in W and�!� Frm(Pls), if v L w thenw � �M� impliesv � �M� .Proof: The proof is straightforward, andproceedsby inductionon the structureof formulae. Here,we just considerthe inductionstepin which � is of the form� 1@p. Supposethat w � �b� 1@p. Thenthereis a w� suchthat wRw� , w�c_ p andw� � �M� 1.

Considernow v L w. SincewRw� , weobtainby thereachabilityconditionthatthereis a world v� suchthatvRv� andv� L w� . Usinginductionhypothesis,sincew�d��e� 1, we obtainv�B��f� 1. Now, sincev�BL w� andw�`_ p, we getby coherenceproperty, v� _ p. Finally, sincev� Rv, wegetv � �N� 1@p by definition. T

As an example,considerthe birelationalmodel \ exam with two worlds, sayw1 andw2. We take w1 H w2, andbothworldsarereachablefrom eachother. Theworld w2 evaluatesto p, while theevaluationof w1 is undefined.Let A beanatom.We defineI (A) to bethesingleton4 w2 6 . For any formula � , we abbreviate �Y�g�as h%� .

Considerthe pure formula h A. Now, by definition, w2 � � A and thereforew2 i� �jh A. Also, asw1 H w2, we getw1 i� �bh A. This meansthatw2 � �bh"h A, andw1 � �9h"h A. Hence,wegetw1 � w2 � �N�kh�h A.

On the otherhand,considerthe formula h�h%� A. We have by definition thatw1 i� � A. As w1 is reachablefrom both w1 andw2, we deducethatw1 � w2 i� �[� A.Usingthesemanticsof � , we getthatw1 � w2 i� �9h"h%� A.

We now extend the semanticsto the judgementsof the logic. We begin byextendingthesemanticsto contexts.

Definition 7 (Bi-forcing on Contexts) Let \ Pls � (W��HS� R � I � Eval) be a bire-lational modelon Pls. Given a finite setof pure formulae ) , anda finite setofsentences� , suchthatPL() ; � ) 2 Pls; we saythatw � W forcesthecontext ) ; �(andwe write w � �P) ; � ) if

1. for every ��W) : w � �N�"� , and

2. for every $ at q �W� : w � �P$ @q.

In orderto extendthesemanticsto judgements,we needonemoredefinition.Wesaythataplacep is reachablefromaworldv, if thereis aworldwhichevaluatesto p andis reachablefrom v. Thesetof all placesreachablefrom aworld v will bedenotedby Reach(v). More formally,

Reach(v) �54 p : w_ p for somew � W� vRw6It canbe easilyshown usingthe reachabilityconditionandcoherencethat if

v H w, thenevery placereachablefrom v is alsoreachablefrom w:

13

Proposition 3 (Reachability) Givenanybirelationalmodel,then:

1. If v H w, thenReach(v) 2 Reach(w).

2. If vRw, thenReach(v) � Reach(w).

Wearenow readyto extendthesatisfactionto judgements.

Definition 8 (Bi-satisfaction for Judgments) The sequent) ; �l. P � at p is saidto bevalid in thebirelationalmodel\ Pls � (W��HS� R � I � Eval) if:

0 PL() ) 1 PL(� ) 1!4 p6S2 P;

0 for any w � W suchthatP 2 Reach(w): w � �P) ; � impliesw � �P� @p.

Moreover, we saythat ) ; �m. P & at p is bi-valid (andwe write ) ; � �� P & at p) if itis valid in every birelationalmodel.

For example,considerthebirelationalmodel \ exam on two worldsw1 andw2

discussedbefore. We hadw1 � w2 � �8�kh�h A andw1 � w2 i� �nh"h%� A. Therefore,thejudgement; .+o pp �kh�h A at p is bi-valid in themodel \ exam, while the judgement; �kh�h A at p .+o pp h�h%� A at p is notbi-valid in \ exam.

In fact,we will lateron show that the judgement; �,h�h A at p . o pp h�hS� A at pis valid in everyfinite Kripkemodel.Therefore,thisexamplewill demonstratethatthefinite modelpropertydoesnot hold in thecaseof Kripke semantics.This ex-ampleis adaptedfrom theexamplesin [22, 29]. Weshallnow prove thesoundnessof thebirelationalsemantics.

3.1 Soundness

Theproofof soundnessof birelationalmodelshasseveralsubtleties,thatariseasaconsequenceof theinferencerulesfor theintroductionof � ( � I), andeliminationof � ( � E). Let us illustratethis for thecaseof � I . Recallthe inferencerule of � Ifrom Figure1:

) ; �5. PD q � at q

) ; �5. P �� at p

In orderto show thesoundnessof thisrule,wehaveto show thatthejudgement) ; �n. P �"� at p is bi-valid whenever the judgement) ; �n. PD q � at q is bi-valid.Now, to show that the judgement) ; �[. P �� at p is bi-valid, we have to consideran arbitraryworld, sayw, in an arbitrarybirelationalmodel,say \ Pls, suchthatP 2 Reach(w) andw � �M) ; � . We needto prove thatw � �/�� @p also.For this,weneedto show that for any world v in \ Pls suchthatw H w� Rv for somew� , it isthecasethatv � �N� . Pickonesuchv andfix it.

14

Pleasenote that without lossof generality, we canassumethat Pls doesnotcontainq (otherwise,we canalwaysrenameq in themodel). In orderto usethehypothesisthat ) ; �q. PD q � at q is bi-valid, we have to considera modificationof \ Pls. Onestrategy, that is adoptedin the caseof Kripke semantics[6], is toaddnew worlds v�q, onefor eachworld v��L v. The new worlds v�q duplicatev�in all respectsexceptthat they evaluateto q. If theresultingconstructionyieldsabirelationalmodel,thenReach(v�q) wouldcontainP aswell asq.

Thenext stepwould beto show thatany formula $ , thatdoesnot refer to theplaceq, is satisfiedby v�q if andonly if it is satisfiedby v� . Usingthis, thenext stepwould beto show thatv�q forcesthecontext ) ; � in thenew modelalso. Then,wecanusethehypothesisto obtainthatv�q satisfies� @q. Sincev�q evaluatesto q, wewill getthatv�q forces � . As � doesnot referto q, we will getthatv� forces � . Wecanthenconcludetheproofby observingthatv L v, andchoosingv� to bev.

In fact,if theworld v wasin thedomainof Eval, thentheabove outlinewouldhave worked. However, this breaksdown in casev . To illustrate this, supposethat thereis a world v� suchthatv H v� , v� ^ andvRv� . In theconstructionof theextension,we would thushave two worlds vq andv�q reachablefrom eachother,thatevaluateto thesameplaceq, whichwouldviolatetheuniquenesscondition.

Thisbreakdown is fatalfor theproofandcannotbefixed.Coherencedemandsthatv�q _ q if vq _ q. So,we cannotfiddle with theevaluation.We cannotevenrelaxuniquenessasthis will beneededfor soundnessof introductionof conjunction( �I) andof implication ( � I). Furthermore,we cannotrequirethat the evaluationis a total function: it is thepartiality of this functionthatgivesusthefinite modelproperty. Indeed,if thefunctionwastotal,theclassof birelationalmodelswouldbeequivalentto theclassof Kripke models,andwe would have not gainedanythingby usingbirelationalmodels.

Ourstrategy to provesoundnessis to constructabirelationalmodelfrom \ Pls,calledq-extension,whoseworldsaretheunionof two sets.Thefirst oneof thesesetsis the reachabilityrelation R of \ Pls. Thesecondonewill be theCartesianproduct 4 q6*] W, whereW is thesetof worldsof \ Pls. Hence,theworldsof theq-extensionareorderedpairs. A world (w�r� w) will evaluateto thesameplaceasw� , and(q� w) will evaluateto q. Two worlds will be reachablefrom eachotheronly if they agreein thesecondentry.

Theconstructionwouldguarantee(seeLemma2) thatgiven $V� Frm(Pls), theworld (w� � w) satisfies$ if andonly if w� does,andtheworld (q� w) satisfies$ ifandonly if w does.Theproof of soundnessof � I would work asfollows. Let vbeafixedworld. Considertheworld (q� v) in theq-extension.We will show thatvsatisfies) ; � , andhence(q� v) satisfies) ; � . Thesetof reachableplacesfrom (q� v)containP aswell asq , andwe canthusconcludethat (q� v) satisfies� @q. Since(q� v) evaluatesto q, we concludethat (q� v) satisfies� @q. As mentionedabove,this is equivalentto sayingthatv satisfies� .

We arereadyto carry out this proof formally. We begin by constructingtheq-extension,andshowing thatthis is abirelationalmodel.

15

Lemma 1 (q-Extension) Let \ Pls � (W��H%� R � I � Eval) be a birelational modelon Pls. Givena new placeq s Pls, we definetheq-extension\ut qv Plsw to be thequintuple(W�x��H*�r� R �r� I �x� Eval� ), where

1. Pls� def� Pls 1Z4 q6 .

2. W� def� R 1 ( 4 q6y] W).

3. H � 2 W� ] W� is definedas:

- (w�r� w) H*� (v�x� v) if andonly if w��H v� andw H v,

- (q� w) H#� (q� v) if andonly if w H v;

4. R � 2 W� ] W� is definedas:

- (w�r� w) R � (v�x� w),

- (w� � w) R � (q� w),

- (q� w) R � (w� � w), and

- (q� w) R � (q� w).

5. I � : Atoms� Pow(W� ) is definedas:

- I � (A)def�z4 (w�r� w) � w�"� I (A) � w� Rw 6{1!4 (q� w) � w � I (A) 6 ;

6. Eval� : W�� Pls� is definedas

- Eval� ((w� � w))def� Eval(w� ) for every(w� � w) � R,1

- Eval� ((q� w))def� q for everyw � W.

Theq-extensionis a birelationalmodel.

Proof: Weneedto show thefivepropertiesof Definition5.

1. ClearlyW� is anonemptysetif W is.

2. Since H is apartialorder, then H � is apartialordertoo.

3. The relation R � is anequivalenceby definition. We show that R � satisfiesthereachabilityconditionby cases.Therearefour possiblecases.

Casea. Assumethat(v�x� v) L*� (w�x� w) R � (w�E�r� w).

The hypothesissaysthat v L w, v��L w� , v� Rv, w� Rw andw�|� Rw.Since R is an equivalence,we get v� L w� Rw�|� . Using reachabilityconditionfor R, thereexists v�|�}� W suchthatv� Rv�|�~L w�|� . Hence,we conclude(v� � v) R � (v�E� � v) L (w� � w).

1In theequality, left handsideis definedonly if theright handsideis.

16

Caseb. Assumethat(q� v) L#� (q� w) R � (w�x� w).

This meansthat v L w andwRw� . By reachabilityconditionfor R,thereis a v� suchthat vRv�~L w� , andwe conclude(q� v) R � (v�r� v) L*�(w�r� w).

Casec. Assumethat(v�x� v) L*� (w�x� w) R � (q� w).

This meansv L w, andwe conclude(v�'� v) R � (q� v) L*� (q� w).

Cased. Assumethat(q� v) L#� (q� w) R � (q� w).

Wehave v L w, andweconclude(q� v) R � (q� v) L*� (q� w).

4. In orderto checkmonotonicityfor I � , weconsidertwo cases:

Casea. Assumethat(w�r� w) � I � (A).

This meansthatw�� I (A). If (v�'� v) L*� (w�x� w), thenv�}L w� . By themonotonicityof I , we getv� � I (A). Hence(v� � v) � I � (A).

Caseb. Assumethat(q� w) � I (A).

This meansthat w � I (A). If (q� v) L#� (q� w), then v L w. By themonotonicityof I , we getv � I (A). Hence(q� v) � I � (A).

5. Accordingto thedefinition,Eval� is apartialfunction.Weneedto verify thetwo propertiesrequiredfor abirelationalmodel.

Coherence. We have to show that if a world in the new model evaluatesto someplace,thenall the higherworlds evaluateto the sameplace.Therearetwo possiblecases.

Casea. Assumethat(v� � v) L � (w� � w), and(w� � w) _ pWe get by definition, v�ZL w� and w�c_ p. By coherenceon themodel \ Pls, we getv� _ p. Hence(v� � v) _ p.

Caseb. Assumethat(q� v) L � (q� w).Wehave by definition,(q� v) _ q and(q� w) _ q.

Uniqueness. Wehaveto show thattwo di�

erentworldsreachablefrom eachothercannotevaluateto thesameplace.As (q� v) alwaysevaluatesto q,two worlds (w� v) and(q� w) cannotevaluateto thesameplace.Therearetwo otherpossiblecases.

Casea. Suppose(v�'� v) R � (w�r� w), (w�r� w) _ p and(v�x� v) _ p.Wehaveby definitionv� Rv, w� Rw, v � w, w� _ p andv� _ p. SinceR is anequivalenceandv � w, we getv� Rw� . By uniquenesson\ Pls, we getv� � w� . Therefore(v� � v) � � (w� � w)

Caseb. Supposethat(q� v) R � (q� w), (q� w) _ q and(q� v) _ q.Wehave by definitionv � w, andhence(q� v) � (q� w). T

We will now show that if a pure formula, say $ , doesnot mentionq, then(w�r� w) satisfies$ only if w� does.Furthermore,(q� w) satisfies$ only if w does.

17

Lemma 2 (\ut u� qv Plsw is conservative) Let \ Pls � (W��H%� R � I � Eval) be a bire-lational model,andlet \ut qv Plsw � (W� ��H � � R � � I � � Eval� ) beits q-extension.Let � �and � �S� extendtheinterpretationof atomsin \ Pls and \ut qv Plsw respectively. Forevery �� Frm(Pls) andw � W, wehave:

1. for everyw� Rw, (w�x� w) � �y�'� if andonly if w�"��M� ; and

2. (q� w) � � � � if andonly if w � �N� .

Proof: We prove both thepointssimultaneouslyby inductionon thestructureofformulaein Frm(Pls).

Baseof induction. The two pointsareverified on atoms,on � , andon � bydefinition.

Inductivehypothesis.We considera formula �Q� Frm(Pls), andassumethatthetwo pointshold for all sub-formulae� i of � . In particular, we assumethat foreveryw � W:

1. for everyw� Rw, (w�x� w) � �y�'� i if andonly if w��P� i ; and

2. (q� w) � � � � i if andonly if w � �M� i.

Weshallprove theLemmaonly for themodalconnectivesandfor thelogical con-nective � . Theothercasescanbe treatedsimilarly. We shall alsoonly considerpoint 1, asthetreatmentof point 2 is analogous.We pick w � W andw� Rw, andfix them.

0 Case��N� 1 �� 2. Suppose(w� � w) � � � � 1 �� 2. Then

for every (v� � v) L � (w� � w), we have (v� � v) � � � � 1 implies(v� � v) � � � � 2 � (1)

We needto show thatw� � �Q� . Pick v� L w� suchthatv� � �� 1, andfix it. Itsu cesto show thatv��N� 2.

We have v�kL w� Rw. By thereachabilitycondition,thereexistsv � W suchthatv� Rv L w. Hence,(v�r� v) L*� (w�'� w).

Theinductionhypothesissaysthat(v�'� v) � �%�r� 1. We have (v�x� v) � �S�'� 2 by (1)above. Hencev� � �M� 2, by applyinginductionhypothesisonemoretime.

For theotherdirection,assumethatw� � �M� 1 �� 2. Then

for every v� L w� , we have v� � �P� 1 impliesv� � �M� 2 � (2)

Now consider(v� � v) L � (w� � w), andassume(v� � v) � � � � 1. From (v� � v) L �(w�r� w), we have v�(L w� . From (v�x� v) � ��r� 1 andinductionhypothesis,wehave v�� 1. Sincev��L w� , we get from (2) above, v�� 2. Therefore(v� � v) � � � � 2, by inductionhypothesisonceagain.We concludeby definitionthat(v�x� v) � �#�r� 1 �A� 2.

18

0 Case��N� 1@p. Since� 1@p � Frm(Pls), wehave p � q.

(w�r� w) � ��r� 1@p is equivalent to sayingthat thereis a world (v�'� w) � W�suchthat: (v� � w) R � (w� � w), (v� � w) _ p, and(v� � w) � � � � 1.

By inductionhypothesisanddefinition of q-extension,this is equivalent tosayingthat thereexistsv�d� W suchthat: vRw� , v�c_ p, andv�� 1. This isequivalentto sayingthatw � �N� 1@p by definition.

0 Case��N�a� 1.

Suppose(w�r� w) � ��'�� 1. Thenthereis a world in W� suchthat this world isreachablefrom (w�r� w), andwhich satisfies� 1. Therearetwo possibilitiesfor thisworld: it canbeof theform (v� w), or of theform (q� w).

If it is of the form (v� w), thenby definition we have vRw. Since R is anequivalenceandwRw� , we have vRw� . Furthermore,since(v� w) � ��x� , wegetby inductionhypothesisv � �N� 1. Therefore,w� � �M�a� 1 by definition.

If the world is of the form (q� w), thenby induction hypothesis,w � �� 1.Sincew� Rw, wegetw��M�a� 1.

For theotherdirection,if w��M�a� 1 thenthereexistsvRw� suchthatv � �M� 1.Since R is an equivalence,we have vRw. Hence(v� w) is a world of theq-extension,and(v� w) � � � � 1 by inductionhypothesis.Since(v� w) R(v� w� ),we conclude(w�r� w) � �#�r�� 1.

0 Case� �N�� 1. Supposethat(w� � w) � � � �"� 1. This meansthat � 1 is forcedbyevery world reachablefrom someworld larger that(w�r� w). In particular, wehave that

for every (v� � v) L (w� � w) � , if (v�F� � v) R � (v� � v) then(v�E� � v) � � � � 1 � (3)

We needto show thatw��f�"� 1. Pick v�x� v�E� suchthatv�BL w� , andv�|� Rv� ,andfix them.It su cesto show thatv�|� � �N� 1.

Sincev� L w� andw� Rw, reachabilityconditionfor R saysthatthereexistsv � W suchthat v� Rv L w. By transitivity, we have v�E� Rv too. Hence(v� � v) L � (w� � w) and(v�E� � v) R � (v� � v). Property(3) saysthat (v�E� � v) � � � � 1,andsov�E��P� 1 by inductionhypothesis.

For theotherdirection,assumew� � �M�� 1. Then

for every v� L w� , if v�E� Rv� thenv�E� � �N�*� (4)

Weneedto show that(w�x� w) � �#�'�"� 1.

Considera world (v�x� v) L*� (w�x� w), andfix it. We have v� Rv, v��L w� andv L w. Now, considerany world reachablefrom (v� � v). We needto showthatthisworld satisfies� 1. Therearetwo possiblecases.

19

This world is of the form (v�F�r� v). In this case,we have that v�F� Rv. Sincev� Rv, wegetv�E� Rv� . Sincev� L w� , wegetv�F� � �M� 1 by Property(4). Hence,(v�F�r� v) � �%�� 1, by inductionhypothesis.

In theothercase,theworld is of theform (q� v). SincevRv� andv��L w� , wehave v � �M� 1 by (4). Therefore,(q� v) � � � � 1 by inductionhypothesis. T

We needonemorepropositionwhich saysthat if a world satisfiesa context thenany world reachablefrom and� or greaterthanit alsosatisfiesthecontext.

Proposition 4 (Forcing in ReachablePlaces) Let \ Pls � (W��H%� R � V� Eval) beabirelationalmodelonPls. Let ) bea finitesetof pure formulae, � bea finitesetofsentences� , andw bea world in W such thatw � �Y) ; � . Then

1. v � �V) ; � for everyvRw, and

2. v � �V) ; � for everyv L w.

Proof: Thesecondpartof thePropositionis aneasyconsequenceof monotonicityof thelogic. For thefirst part,pick vRw andfix it. We needto show that if $ is aformulain ) thenv � �M$ , andthatif � at p is asentencein � thenv � �M� @p.

Now, if $��) , thenwe have thatw � �Q��$ . Let v� � v�|� betwo worldssuchthatv�E� Rv�"L v. Wewill show thatv�|��P$ . As v�|� is arbitrary, we will getthatv � �P��$ .

We have v�kL v andvRw. By reachabilitycondition,we getthereis a w� suchthat v� Rw� L w. Since,v�F� Rv� , and R is an equivalence,we get v�|� Rw� L w.Finally, sincew � �N�"$ , wegetv�E��M$ asrequired.

If � at p �(� , thenwe have thatw � �M� @p. Therefore,thereis aworld w� suchthatw�`_ p, wRw� andw�"��M� . SinceR is anequivalence,wegetvRw� . Thereforev � �P� @p, andwe aredone. T

Wearereadyto prove soundness,whichdependson Lemmas1 and2.

Theorem 1 (Bi-soundness)If the judgement ) ; ��. P & at p is derivablein thelogic, thenit is bi-valid.

Proof: Theproof proceedsby inductionon n, thenumberof inferencerules,ap-plied in the derivation of the judgement) ; �z. P & at p. The inferencerulesaregiven in Figure1. Thebasecase,whereonly oneinferencerule is usedto derivethejudgementfollows easilyfrom thedefinition.Wediscusstheinductionstep.

Inductivehypothesis(n � 1). Weassumethatthetheoremholdsfor any judge-ment that is deducibleby applying lessthan n instancesof inferencerules, andconsidera judgement) ; �8. P & at p derivablein the logic by usingexactly n in-stances.

We fix a model \ Pls � (W��HS� R � V� Eval) on Pls, and let � � be the forcingrelationin this model. Let w � W besuchthat P 2 Reach(w) andw � �m) ; � . Fixw for the restof theproof. We have to show w � �5& @p. We proceedby casesby

20

consideringthelastruleappliedto obtain) ; �9. P & at p. For thesakeof clarity, weconsideronly thecasesin which the last rule is introductionof implication(� I ),introductionof � ( � I), andeliminationof � ( � E).

0 Case � I . If the last inferencerule usedwas � I then & is of the form��A$ , andPL() ; � ) 1 PL( � ) 1 PL( $ ) 1�4 p6�2 P. Furthermore,) ; �,�� at p . P$ at p by using lessthann instancesof the inferencerules. By inductionhypothesis,) ; �,�� at p . P $ at p is bi-valid. We have to prove that thereexistsvRw suchthatv_ p, andv � �M�Z��$ .

SinceP 2 Reach(w), thereexists v � R(w) suchthat v_ p. We will provethatv � �f�/�u$ . Pick v� L v andfix it. We needshow that if v� � �e� , thenv��M$ also.

We have v� _ p by coherenceproperty, andv� � �9) ; � by Proposition4. Alsoas R is reflexive, we have v� Rv� . If we assumethat v�� , thenwe getby definitionthatv� � �� @p. Hence,we getv� � �5) ; �,�� at p. By inductionhypothesis) ; �,�� at p . P $ at p is bi-valid, andthereforev�"��M$ @p.

Therefore,thereis aworld reachablefrom v� whichevaluatesto p andwhichforces $ . Sincev��_ p andv� Rv� , uniquenesssaysthat this world mustbev�itself. Thereforev��N$ , asrequired.

0 Case� I . Then& is of theform �� . Moreover, PL() ; � ) 1 PL( � ) 1�4 p6�2 P,and ) ; ��. PD q � at q for someq s P by usinglessthat n instancesof therules.By inductionhypothesis,) ; �m. PD q � at q is bi-valid. Without lossofgenerality, we canassumethatq s Pls (otherwise,we canrenameq in Pls).

We have that w � �j) ; � , andwe needto show that w � �8�� @p. Note thatp � P, andP 2 Reach(w). Thereforethereis a w� � Reach(w) suchthatw�`_ p. Picksuchaw� , andfix it. By Proposition4, w�"��V) ; � . Weshallshowthatw�"��M�� , andwe will bedone.

In orderto show thatw�B��f�� , we have to show thatv��e� for every v� v�suchthat v� Rv L w. Pick suchv� v� andfix them. We have v�O��b) ; � byProposition 4. SinceP 2 Reach(w) andv� Rv L w, we get P 2 Reach(v� )by Proposition3.

Let Pls� � Pls 1�4 q6 , andlet \ut qv Plsw betheq-extensionof thebirelationalmodel. Let � �O� be the forcing relation on \ut u� qv . From the hypothesisv� � �P) ; � andLemma2, we get(v� � v� ) � � � ) ; � .

Fromdefinitionof q-extension,it is clearthatReach((v�'� v� )) � Reach(v� ) 14 q6 . HenceP 3 q 2 Reach((v� � v� )). We cannow apply the inductionhy-pothesison theworld (v�r� v� ), andobtain(v�x� v� ) � �#�r� @q. By thedefinitionoftheq-extension,this is equivalentto (q� v� ) � � � � . Lemma2 thenimpliesthatv��M� , asrequired.

0 Case � E. Thenfor somep�� P and �j� Frm(P) we canderive ) ; ��. P�a� at p� and ) ; �� at q . PD q & at p by using lessthann instancesof the

21

rules.By inductionhypothesis,) ; ��. P �� at p� and ) ; �,�� at q . PD q & at parebi-valid.

As is the caseof � I , we canassumethat q s Pls. We needto show thatw � �Y& @p. Sincew � �9) ; � , theinductionhypothesissaysthatw � �� @p� .Thereforeusingthedefinitionof forcing andequivalenceof therelation R,thereis a world w� suchthatwRw� andw��5� . SincewRw� , Proposition4impliesthatw�"��V) ; � .

Considernow the q-extension\ut qv of \ , with � �� asforcing relationontheq-extension.Sincew� � �M� andw� � �P) ; � , Lemma2 saysthat(q� w� ) � � � �and(q� w� ) � ��) ; � . As (q� w� ) _ q, we get (q� w� ) � ��r) ; �,�� at q. Finally, asP 3 q 2 Reach(w� ) 154 q6}� Reach((q� w� )), inductionhypothesisgivesus(q� w� ) � �#�F& @p. By Lemma 2, we getthatw�"��Z& @p.

Hence,thereis a w�|� suchthatw� Rw�|� suchthatw��M& andw�|�c_ p. SincewRw� and R is an equivalence,we get wRw�� . Thereforew � �[& @p, asrequired. T

3.2 Relating Kripk eand Bir elational Models

In thisSection,weshallpresentanencodingof Kripkemodelsin birelationalmod-elsthatpreservestheforcing relation.Thiswill allow usto prove thesoundnessofthelogic for Kripke models.

In particular, givena Kripke modelwith a setof statesK, we constructa bire-lational modelwhoseworlds arepairs(k� p) wherek � K and p is a placein theKripkestatek. Two worldswill berelatedif they comefrom thesameKripkestate.Theworld (l � p) will begreaterthat(k� q) only if l L k andp � q. Theworld (k� p)will evaluateto p, andanatomwill be interpretedin theworld (k� p) only if it isplacedin p in the Kripke statek. The constructionwill guaranteethat the world(k� p) forcesa formula $ if andonly if theKripke statek forcestheformula $ @p.

Onething that is worth pointingout is that in theresultingbirelationalmodel,the evaluation is total. This is no accident,and as we had pointedout before,partialityof theevaluationin birelationalmodelsis essentialfor theproof of finitemodelproperty. This is becausethepartiality allows worlds reachablefrom eachother to be ordered:a situationthat will be ruled out if the evaluationwastotalasa consequenceof coherenceanduniqueness.This wasillustratedby themodel\ exam whenwe definedbirelationalsemantics.In \ exam, it is thecasethatw1 Hw2, w1 Rw2, w1 ^ andw2 _ p. As discussedthere,thismodelallows usto refutethejudgement; �,h�h A at p . o pp h�hS� A at p. As we will seelater, the judgementwillbevalid in every finite distributedKripke model.

Indeed,if the evaluationin birelationalmodelswastotal andnot partial, theencodingthat we will give could be reversedgiving an encodingof birelationalmodelsin Kripkemodels.Wewouldhavenotgainedanythingby usingbirelationalmodels.

22

Proposition 5 (Encoding) Givena distributedKripkemodel,I�� (K ��H%��4 Pk 6 kK K �4 Ik 6 kK K) with setof placesPls, we defineits I -birelationalmodel \��Pls to be thequintuple(W�x��H*�r� R �r� I �x� Eval� ), where

1. W� def� kK K 4 (k� p) : p � Pk 6 ;2. H � 2 W� ] W� is definedas: (k� p) H � (l � q) if andonly if k H l and p � q;

3. R � : 2 W�*] W� is definedas: (k� p) R � (l � q) if andonly if k � l;

4. I � : Atoms� Pow(W� ) is definedas: I (A)def��4 (k� p) � p � Ik(A) 6 ;

5. Eval� : W�� Pls� is definedas: Eval(k� p)def� p.

\��Pls is a birelationalmodel.

Proof: We needto checkthat the constructionsatisfiesthe propertiesof a bire-lational model. The proof is straightforward, andwe just illustrate the proof ofreachabilityconditionhere.

Assumethat (k� � p� ) L � (k� p) R � (l � q). Thenit mustbe the casethat k� L k,k � l andq � Pl . Sincek � l, we getq � Pk. Furthermore,ask��L k, we havePk 2 Pkw . Thereforeq � Pkw .

Considertheworld (k� � q). Wegetby definition(k� � p� ) R � (k� � q) L � (k� q). T

Wenow show thattheencodingpreservestheforcing relation.

Proposition 6 (Forcing Preservation) Let I�� (K ��H%��4 Pk 6 kK K ��4 Ik 6 kK K) be a dis-tributedKripke modelwith setof placesPls. Let \��Pls � (W�x��H*�r� R �r� I �x� Eval� ) bethe I -birelationalmodel.Let � � � and � �� extendtheinterpretationof atomsin Iand \ �Pls respectively. For every �!� Frm(Pls), k � K, and p � Pk, wehave:

(k� p) � � � � if andonly if (k� p) � ��#�

Proof: We proceedby inductionon the formula �9� Frm(Pls). ThestatementofthePropositionis easilyverifiedon � , � andon atoms.

Inductivehypothesis.Weconsideraformula �� Frm(Pls), andassumethatthePropositionholdsfor eachof its sub-formulae.For sakeof clarity, wejust illustratethecasesof logical implication,andof modalities@p and � .

0 Case��N� 1 �� 2.

Suppose(k� p) � � � � 1 �� 2. We needto show that (k� p) � �� 1 �� 2.Pick (l � q) L*� (k� p) suchthat(l � q) � �%�g� 1, andfix it. It su cesto show that(l � q) � �%�� 2 also.

Since(l � q) L � (k� p), we have q � p and l L k. Also, as(l � q) � �%�� 1 andq � p, we get (l � p) � � � � 1 by inductionhypothesis.Since(k� p) � � � � 1 �

23

� 2 and l L k, we get (l � p) � � � � 2. By inductionhypothesisonceagain,weget(l � q) � (l � p) � ��X� 2, andwearedone.

For theotherdirection,supposethat (k� p) � �� 1 �� 2. We needto showthat (k� p) � � � � 1 �� 2. Pick l L k suchthat (l � p) � � � � 1, andfix it. Itsu cesto show that(l � p) � � � � 2.

As (l � p) � � � � 1, we have by inductionhypothesisthat (l � p) � �%�� 1. Sincel L k, we get p � Pl and(l � p) L#� (k� p). Therefore,as(k� p) � �� 1 �g� 2,we getthat(l � p) � ��X� 2. By inductionhypothesis,we get(l � p) � � � � 2.

0 Case��N� 1@q.

Then(k� p) � � � � meansthat q � Pk and(k� q) � � � � 1. By inductionhy-pothesisanddefinitionof q-extension,this is equivalentto sayingthat thereexists(k� q) R � (k� p) suchthat(k� q) _ q, and(k� q) � �%�¡� 1. This is equivalentto sayingthat(k� p) � ��X� 1@q.

0 Case��N�"� 1.

Then(k� p) � � � � meansthat for every l L k andevery q � Pl , we have(l � q) � � � � 1. By inductionhypothesisanddefinitionof q-extension,this isequivalent to: for every (l � p) L#� (k� p) and(l � q) R � (l � p), it is the casethat(l � q) � �%�� 1. This is equivalentto sayingthat(k� p) � �%�X�� 1. T

We shallnow usetheencodingandsoundnessof logic with respectto birela-tional modelsto show soundnessof Kripke semantics.

Corollary 1 (Soundness)If ) ; �/. P & at p is derivablein thelogic, thenit is validin everydistributedKripke model.

Proof: Supposethatthejudgement) ; �9. P & at p is derivable.Thenit mustbethecasethatPL() ) 1 PL(� ) 1 PL(& ) 1�4 p6,2 P. Let IX� (K ��H%��4 Pk 6 kK K ��4 Ik 6 kK K) beadistributedKripke modelwith setof placesPls. Let � � � extendthe interpretationof atomsto formulaeon this Kripke model. Let k bea Kripke stateof this modelsuchthatP � Pk andk � � � ) ; � . Weneedto show that(k� p) � � � & at p.

Considerthe encodingof the Kripke model I into a birelationalmodel. Let\��Pls � (W�r��H*�r� R �r� I �x� Eval� ) bethe I -birelationalmodel,andconsidertheworld(k� p) � W� . If � �� is the extensionof interpretationof atomsin this model,weclaim that(k� p) � �%�U) ; � .

If $N�() thenask � � � ) ; � , we getby definition(k� p) � � � ��$ . UsingProposi-tion 6, we getthat(k� p) � ��$ .

If $ at q �V) , thenwe have by definition (k� q) � � � $ . Using Proposition6,we get that (k� q) � �� $ . Now, by construction(k� p) R � (k� q), andhencewe get(k� p) � ��X$ @q.

Therefore,we get that (k� p) � �%�¢) ; � . As the logic is soundover birelationalmodels,we get(k� p) � ��& @p. This impliesusingProposition6 onceagainthat(k� p) � � � & @p. By definition,this is thesameas(k� p) � � � & , andwe aredone. T

24

4 Boundedcontextsand Completeness

In this Section,we shall prove completenessof the logic with respectto bothKripkeandbirelationalsemantics.Theproofwill follow amodificationof standardproofsof completenessof intuitionistic logics[17, 29, 6, 31], andwewill constructa particulardistributedKripke model: thecanonicalboundedKripke model. Thereasonfor term“bounded”shallbecomeclearlateron. Wewill prove thata judge-ment ) ; ��. P & at p is valid in the canonicalboundedmodel if andonly if it isderivable in the logic. Thenwe will usethe encodingof the Kripke modelsintobirelationalmodels(seeSection3.2), which will allow us to prove completenessof birelationalmodels.Theresultingmodelwill beusedto prove thefinite modelpropertyin Section5.3.Wealsopointout thatweshallprove thecompletenessre-sultsin thecasewhereP is finite. Weshallindicatelaterhow thiscanbeextendedto thecasewhereP is infinite. Theconstructionof themodelis adaptedfrom [29].

Webegin by definingsub-formulaeof apureformula.A sub-formulaof apureformula � is inductively generatedas:

0 � is asub-formulaof itself;

0 if any of � 1 � � 2, � 1 �� 2, and � 1 �� 2 is asub-formulaof � , thensoare � 1

and � 2; and

0 if any of �"� 1, �� 1, and � 1@p is asub-formulaof � , thensois � 1.

Given any setof pureformulae £ , the sub-formulaclosure £d¤ , is the setof sub-formulaeof eachof its members.Usingsub-formulaeclosure,we defineboundedcontexts:

Definition 9 (BoundedContexts) Givenafinite setof placesP anda finite setofpureformulae£j� Frm(P), apair (Q�-� ) is a (P�-£ ) ¥ boundedcontext if

0 Q is afinite setof placesthatcontainsP, i.e., P 2 Q; and

0 � is afinite setof sentencesof theform � at q, where��W£ ¤ andq � Q.

The boundedcontexts will be usedasKripke statesin the canonicalmodel.However, we will needparticularkindsof boundedcontexts.

Definition 10(Prime BoundedContexts) Let P beafinite setof places,and £~�+)2 Frm(P) betwo finite setsof pureformulae.A (P�-£ ) ¥ boundedcontext (Q�+� ) issaidto be )S¥ prime if

0 ) ; �¦. Q � at q for �/� £d¤ andq � Q, implies that � at q �§� (£ -deductiveclosure);

0 ) ; �!¨ Q � at q for every q � Q (Consistency);

0 ) ; �f. Q ��Z$ at q for �§�Z$/�©£ ¤ andq � Q, impliesthateither � at q �©�or $ at q �W� (£ -disjunctionproperty);and

25

0 ) ; �9. Q �� at q for ��(£ ¤ andq � Q, impliesthatthereexistsq�,� Q suchthat � at q� �W� (£ -diamondproperty).

As an example,let A be an atom. Let P ��4 p6 , £��84 A@p6 andQ ��4 p� q6 .Considerthefollowing setsof sentences:

0 � 1 �/4 A at p� A at q� A@p at p6 ;0 � 2 �/4 A at p� A at q� A@p at p� A@p at q6 ; and

0 � 3 �/4 A at p� A at q� A@p at p� A@p at q�k� A at q6 .Clearly, we have that P 2 Q. If $ at r is a sentencein � 1 or � 2, then $ is asub-formulaof £ andr � Q. Therefore,(Q�+� 1) and(Q�+� 2) are(P�-£ ) ¥ boundedcontexts. On theotherhand,(Q�-� 3) is nota (P�-£ ) ¥ boundedcontext as � A is notasub-formulaof A@p.

If, we let ) to be the list A, thenit follows easilythat ) ; � 1 . Q A at p. Usingthe inferencerule of introductionof @, we get ) ; � 1 . Q A@p at q. However, wehave that A@p at q s§� 1. Therefore,(Q�-� 1) is not )S¥ prime. On theotherhand,(Q�-� 2) is )S¥ prime.

The canonicalmodelwill be built by choosingthe Kripke statesto be primeboundedcontexts. We will first show that boundedcontexts canbe extendedtoprimeboundedcontexts. Beforewe proceed,we statea propositionthatsaysthatthecut-ruleis admissiblein the logic. In [14], this hasbeenproved for the logicwithout thedisjunctive connectives. Theproof canbeextendedfor the logic withdisjunctive connectives:

Proposition 7 If ) ; �5. P & at p1 and ) ; ��'& at p1 . P $ at p, then ) ; �/. P $ at p.

Proof: Theproof is by inductionon thenumberof inferencerulesusedin deriva-tion of ) ; �,�x& at p1 . P $ at p. T

Wenow show theexistenceof primeextensions:

Lemma 3 (Prime BoundedExtension) Let (Q�+� ) be a (P�+£ ) ¥ boundedcontext,and $ bea pure formula in Frm(P). Givena finite subset)52 Frm(P) andq � Qsuch that ) ; �!¨ Q $ at q, there existsa (P�+£ ) ¥ boundedcontext (Q�r�-�%� ) such that

1. (Q� �-� � ) is )S¥ prime,

2. (Q� �-� � ) extends(Q�+� ), i.e., Q 2 Q� , and �52�� , and

3. ) ; ��{¨ Qw $ at q.

Proof: Pleasenotethatby definition P,£ and £ ¤ arefinite sets.Pick new placesqCxª , onefor eachformula �a��(£d¤ . Let QC bethesetof all suchplaces.As theset£ ¤ is finite, QC is alsoa finite set.Finally, let « bethesetof sentences� at q suchthat �!��£ ¤ andq � Q 1 QC . As £ ¤ � Q andQC arefinite sets,« is alsofinite.

26

Theset �%� requiredin theLemmawouldbeasubsetof « , andthesetQ� wouldbe a subsetof Q 1 QC . Thesesetswould be obtainedby a seriesof extensions� n � Qn whichwill satisfycertainproperties:

Property1 For everyn L 0

1. Qn 2 Q 1 QC , and � n 2Z« ;

2. Qn 2 QnD 1, � n 2�� nD 1;

3. (Qn �-� n) is (P�+£ )-boundedcontext; and

4. ) ; « n ¨ Qn $ at q.

Theseriesis constructedinductively. In the induction,at anoddstepwe willcreateawitnessfor a formulaof thetype �a� . At anevenstepwedealwith disjunc-tion property. Weshallalsoconstructtwo sets:

0 treatedCn, that will be the setof the formulae ��b�5£d¤ for which we have

alreadycreatedawitness.

0 treated?n , thatwill bethesetof theformulae $ 1 �Z$ 2 at q ��« which satisfy

thedisjunctionproperty.

Wepick anenumerationof £�¤ , andfix it. Westarto�

by definingtreatedC0 �¬ ,

treated?0 �M¬ , Q0 � Q, and � 0 �� . It is clearfrom thehypothesisof theLemma

thatQ0 andP0 satisfythefour pointsof Property1.Thenwe proceedinductively, andassumethat Qn �+� n (n L 0) have beencon-

structedsatisfyingProperty1. In stepn 3 1, we considertwo cases:

1. If n 3 1 is odd,thenpick thefirst formula $ 1 �Z$ 2 ��£d¤ in theenumerationof £ ¤ , suchthat

0 ) ; � n . Qn $ 1 � $ 2 at r, for somer � Qn;0 $ 1 ��$ 2 at r s treated

?n .

If no suchformula exists, thenlet QnD 1 � Qn and � nD 1 �e� n. In this caseQnD 1 and � nD 1 satisfythefour pointsof Property1 by induction.

Otherwise,if both ) ; � n �$ 1 at r . Qn $ at q and ) ; � n �$ 2 at r . Qn $ at q,thenwe candeduce) ; � n . Qn $ at q. However, we have that � n � Qn satisfyProperty1. Hence,it mustbethecasethateither ) ; � n �$ 1 at r ¨ Qn $ at q or) ; � n �$ 2 at r ¨ Qn $ at q.

We define � nD 1 �n� n 154®$ 1 at r 6 if ) ; � n �$ 1 at r ¨ Qn $ at p, and � nD 1 �� n 1P4®$ 2 at r 6 otherwise.We defineQnD 1 � Qn. We have by constructionQn 2 QnD 1, QnD 1 2 Q 1 QC and � n 2�� nD 1.

We have r � Qn. By definition, the set £d¤ is closedundersub-formulae.Thereforeas $ 1 �Z$ 2 ��£ ¤ , we have both $ 1 and $ 2 arein £ ¤ . This impliesthat $ 1 at r and $ 1 at r arein « , and(QnD 1 �+� n) is (P�-£ ) ¥ boundedcontext.

27

Also by construction) ; � nD 1 ¨ QnD 1 $ at q. Therefore,QnD 1 �+� nD 1 satisfies

Property1. Finally, we let treated?nD 1 � treated

?n 1f4®$ 1 ��$ 2 at r 6 and

treatedCnD 1 � treated

Cn.

2. If n 3 1 is even,pick thefirst formula �a� in theenumerationof £ ¤ suchthat

0 ) ; � n . Qn �� at r, for somer � Qn;0 �a��s treated

Cn.

Let QnD 1 � Qn 3 qCxª , � nD 1 �V� n 1�4®� at qCxª 6 , treatednD 1 � treatedn 1�4®��¯6 andtreated

?nD 1 � treated

?n . We have by constructionthat QnD 1 and � nD 1 satisfy

thefirst threepointsof Property1.Weclaim that ) ; � nD 1 ¨ Qn° 1 $ at q also.

Supposethat ) ; � nD 1 . Qn° 1 $ at q, i.e., ) ; � n �� at qCxª . QD q±x² $ at q. Wealsohave that ) ; � n . Qn �� at r. In fact,by theinferencerule � E:

) ; � n . Qn �� at r ) ; � n �� at qCxª . QD q±x² $ at q

) ; � n . Qn $ at q³E

This contradictsthe hypothesison Qn �-� n. Hence ) ; � nD 1 ¨ Qn° 1 $ at q.Therefore,QnD 1 and � nD 1 satisfyProperty1.

Therefore,we get by constructionthat Qn �-� n satisfyProperty1. We defineQ�(� n 0 Qn, and ��|�� n 0 � n. Now, usingProperty1, Q��2 Q 1 QC and� �E� 2« . This impliesthatQ� and � �E� arefinite sets.(Notethatthis meansthat theseries(Qn �-� n) is eventuallyconstant).UsingProperty1, we caneasilyshow that(Q�r�-��E� ) is a (P�-£ ) ¥ boundedcontext, and ) ; �%�F�µ¨ Qw $ at q.

Finally, wedefine� � to bethesetof all sentences� at s �W« suchthat ) ; � �F� . Qw� at s. As aconsequenceof Proposition7, we getthat

) ; � � . Qw & at r if andonly if ) ; � �|� . Qw & at r (5)

Clearly, �� extends��|� andhence� . Furthermore,by construction(Q�x�+�� ) is(P�-£ ) ¥ bounded.Also we get ) ; �%��¨ Qw $ at q, thanksto theequivalence(5). Weonly needto show that(Q� �-� � ) is ) -prime.

1. (Deductive Closure)Theset � � is deductively closed,by construction.

2. (DisjunctionProperty)Assumethat ) ; � � . Qw $ 1 �§$ 2 at r, for $ 1 ��$ 2 �W£d¤andq � Q� . Thenlet n betheleastnumbersuchthat ) ; � n . Qn $ 1 � $ 2 at r.Clearly, $ 1 �/$ 2 at q s treated

?n , and ) ; � m . Qm $ 1 �/$ 2 at q for every

m L n. Eventually $ 1 ��$ 2 at q hasto be treatedat someoddstageh L n.Hence,either $ 1 at r �� hD 1 or $ 2 at r �!� hD 1. Therefore,$ 1 at q �� or$ 2 at q ��%� .

3. (DiamondProperty)Assumethat ) ; �%�k. Qw �� at r, for ��Y��£ ¤ andr � Q� .Thenlet n betheleastnumbersuchthat ) ; � n . Qn �� at r. As in thepreviouscase,we assertthat �a� at q is treatedfor someevennumberh L n. We get� at qCxª �W�%� by construction.

28

4. (Consistency) If ) ; ��}. Qw � at r, then ) ; ��}. Qw $ @q at r by the inferencerule � E. Therefore,) ; � � . Qw $ at q by @E, whichcontradictsourconstruc-tion. Hence,) ; ��{¨ Qw � at q.

Weconcludethat(Q�r�-�%� ) is a ) -primeand(P�+£ ) ¥ boundedcontext extending(Q�-� ) suchthat ) ; �!¨ Qw � at p. T

We finally constructthe boundedcanonicalmodel. In the model, the setofKripke statesis thesetof primeboundedcontexts (Q�-� ) orderedby inclusion. Aplacebelongsto thestate(Q�-� ) only if it is in Q, andanatomA is placedin aplacer in thestate(Q�-� ) only if A at r �W� . More formally, we have

Definition 11(BoundedCanonical Model) Givenafinite setof placesP andtwofinite setsof pure formulae £}�+)�2 Frm(P), the ) -prime and (P�-£ ) ¥ bounded

canonicalmodelis thequadrupleI candef� (K ��HS��4 Pk 6 kK K ��4 Ik 6 kK K), where

0 thesetK is thesetof all (P�+£ ) ¥ boundedcontexts thatare ) -prime;

0 (Q1 �-� 1) H (Q2 �+� 2) if andonly if Q1 2 Q2 and � 1 2�� 2; and

0 P(Q>·¶ ) def� Q;

0 for k � (Q�-� ), thefunction Ik : Atoms� Pow(Pk) is definedas

I(Q>¸¶ )(A)def��4 q � Q : A at q �W��6®�

Givena finite setof placesP anda finite setof formulae )M� Frm(P), we saythat ) is consistentif ) ; ¨ P � at p for any p � P. If ) is consistent,thenLemma3guaranteesthatthesetof statesin thecanonicalmodelis non-empty. This ensuresthattheboundedcanonicalmodelis aKripke model.

Lemma 4 (CanonicalEvaluation) Givena finite setplacesP, andtwofinite setsof pure formulae£}�-)Y� Frm(P) such that ) is consistent,let I can bethe )S¥ primeand(P�+£ ) ¥ boundedcanonicalmodel.Then

1. I can is a distributedKripke model;and

2. if � � � is the forcing relationon I can, thenfor all �/�Z£ ¤ , and (Q�-� ) � K:(Q�-� ) � � � � at q if andonly if � at q �W� .

Proof: Clearly, all thepropertiesrequiredfor a distributedKripke modelareveri-fied. All we have to prove is thepart2 of theLemma.Theproof is standard,andwe proceedby inductionon thestructureof the formula �5��£d¤ . In the inductivehypothesis,we assumethatpart2 of theLemmais valid on all sub-formulaeof �thatarein £d¤ . Pleasenotethat if �Y�©£d¤ , thenof thesub-formulaeof � arein £�¤ .Hence,we canapplytheinductionhypothesison all thesub-formulaeof � . Here,we just illustratetheinductive casein which � is �� 1.

29

Case �� 1. Assumethat (Q�-� ) � � � �� 1 at q, where �"� 1 ��£ ¤ . By definition,this meansthat for every (Q� �+� � ) L (Q�-� ) andevery r � Q� , it is the casethat(Q�r�-�� ) � � � � 1 at r (andtherefore� 1 at r �W�� by inductive hypothesis).

Chosea new places s Q andfix it. We claim that ) ; �Q. QD s � 1 at s. Suppose) ; �5¨ QD s � 1 at s. Thenby Lemma3, thereis a setof placesQ� extendingQ 3 sand, a ) -prime and (P�+£ ) ¥ boundedcontext (Q� �-� � ) extending(Q�-� ) suchthat) ; �%�y¨ Qw � 1 at s. Thismeans� 1 at s sW�%� . Since(Q�'�+�� ) is greaterthan(Q�+� ), weobtainacontradiction.

Therefore,we concludethat ) ; �¦. PD q � 1 at s. By usingthe inferencerule ofintroductionof � ( � I ), we get that ) ; �[. Q �� 1 at q. Since(Q�-� ) is ) -primeand(P�-£ )-bounded,�"� 1 at q �W� .

For theotherdirection,let �"� 1 at q �(� . Pick a Kripke state(Q�'�+�� ) L (Q�-� ),andfix it. We needto show that (Q�x�-�%� ) � � � � 1 at q. Now �[2N�� , andtherefore�� 1 at q �� . We canapply the inferencerule of eliminationof � ( � E) to provethat )*�-��". Qw � 1 at s for every s � Q� .

By definitionof thecanonicalmodel,(Q� �+� � ) is ) -prime. Therefore,� 1 at s �� for every s � Q� . Henceby inductive hypothesis,(Q�'�-�%� ) � � � � 1 at s for everys � Q� . As (Q� �-� � ) is an arbitraryKripke statelarger than (Q�+� ), we get that(Q�-� ) � � � �"� 1 at q. T

Wearenow readyto prove completeness.It will imply thecompletenesstheo-remfor birelationalmodelsasa corollary. We will lateron recall theproof of thistheoremwhenwe dealwith finite modelproperty.

Theorem 2 (Completeness)If P is finiteandthejudgement) ; �/. P � at p is validin everyKripke model,thenit is provablein thelogic.

Proof: Assumethat ) ; �/�� P � at p is valid. Wehave:

1. PL() ) 1 PL(� ) 1 PL( � ) 1!4 p6S2 P.

2. If I�� (K ��HS��4 Pk 6 kK K ��4 Ik 6 kK K) is a distributedKripke model,thenfor everyk � K suchthatP 2 Pk, k � �N� at p whenever k � �P) ; � .

Weneedto show that ) ; �5. P � at p.

Assumethat ) ; �!¨ P � at p. Wefix £ def�z4®��$ : $N��)%6{1!4¸& : & at q �W�¹6y1!4®�S6 .Pleasenotethat £b� Frm(P) and(P�+� ) is a (P�-£ )-boundedcontext. By Lemma3,thereis a ) -prime and(P�-£ ) ¥ boundedcontext (Q�+« ) extending(P�+� ) suchthat) ; «O¨ Q � at p. Weget � at p sW« . Fix (Q�+« ).

Now considerthe ) -prime and(P�+£ )-boundedcanonicalmodel I can ascon-structedin Definition 11,andlet � � � betheforcing relationin I can. ConsidertheKripke state(Q�+« ). Weclaim that(Q�+« ) � � � ) ; � .

Pick $b�) , r � Q andfix them. We first show that ) ; «[. Q ��$ at r. In theproof, we first choosea new placem s Q, andthenusethe inferencerule G to

30

concludethat $ at r is derivable from )º�+« . We thenusethe inferencerule � I toobtain ) ; «. Q ��$ at r. More formally,

) ; «. QD m $ at mG

) ; «Y. Q ��$ at r» I

As $P�W) , wehave that �"$N�~£ . As r � Q, wehaveby definitionof primecontexts,��$ at r �W« . UsingLemma4, wegetthat(Q�+« ) � � � ��$ at r.

Furthermore,� is containedin « . Therefore,by Lemma4, (Q�-« ) � � � & at qwhenever & at q �W� .

Hence,we get that theKripke state(Q�-« ) � �9) ; � . By our assumption,we get(Q�-« ) � � � � at p also. By Lemma4, we get � at p �Z« . However our choiceofQ�-« wassuchthat � at p sZ« . We have just reacha contradiction,andhencewecanconcludethat ) ; �/. P � at p. T

Now, by theencodingof Kripke modelsinto birelationalmodels(seePropo-sition 6), if a judgementis valid in all birelationalmodelsthen it is valid in allKripke models.As theclassof Kripkemodelsis complete,we getthattheclassofbirelationalmodelsis alsocompletefor thelogic:

Corollary 2 If P is finite and the judgement) ; �¼. P � at p is bi-valid in everybirelationalmodel,thenit is provablein thelogic.

Proof: Supposethatthejudgement) ; �/. P � at p that is notprovablein thelogic.Thenby Theorem2, thereis a Kripke model I with a statek suchthat k forces) ; � but doesnot force � at p. Let \ �Pls bethe I -birelationalmodelobtainedbythe encodingof I asdefinedin Proposition5, andconsiderthe world (k� p). Itcanbe shown usingProposition6 that theworld (k� p) forces ) ; � but not � at p.Hence,thejudgement) ; �9. P � at p is notbi-valid. T

Now, if P is infinite thentheproofsin thisSectioncanbemodified.Theproofsactuallydo not requirethesetsin contexts to befinite. Therequirementfor finite-nessis actuallyfor theproofof finite modelproperty, andnot for completeness.

Thereis anotherway in which we candeducethecompletenessresultswhenP is infinite. For this, we take recourseto the following Propositionwhich statesthat for provability, it is su cient to just considerthe setof placesappearinginthe formulaeof the judgement.This wasproved for the logic without disjunctiveconnectivesin [14], andtheproof canbeextendedfor thewholelogic.

Proposition 8 Let P0 � PL( ) ) 1 PL(� ) 1 PL( � ) 1!4 p6 , andP0 2 P. Then) ; ��. P� at p if andonly if ) ; �/. P0 � at p.

Proof: Theproof is by inductionon thelengthof derivations. T

31

Now, we extend the completenessresult for Kripke semanticsto the infiniteP caseasfollows. Supposethat ) ; �N¨ P � at p. Thenby theabove Proposition,itmustbethecase) ; ��¨ P0 � at p, whereP0 � PL() ) 1 PL(� ) 1 PL( � ) 1d4 p6 . Theorem2 saysthatthereis a Kripke model I with a Kripke statek suchthatk forces) ; �but not � at p. Without lossof generality, we canassumethat I doesnot containany placein the setP ½ P0 (otherwisewe canrenamethem). Now pick p0 � P,andfix it. In eachKripkestateof I addnew placesP ½ P0, eachduplicatingp0. Itcanbeshown thatin theresultingmodeltheKripke statek still forces) ; � but not� at p. Hence,we obtaincompletenessfor Kripke semanticswhenP is infinite.For thebirelationalmodels,we canonceagainusetheencodingof Kripke modelsinto birelationalmodels.

5 Finite Model Property

In this Section,we will show that if a judgement) ; �z. P � at p is not provablein the logic, thenthereis a finite birelationalmodelthat invalidatesit. Theproofwill usethecounter-modelfrom theproof of completenessin Section4. Thebire-lationalmodelconstructedin theproof of completenessconsistsof worldsof theform (Q�-�� q), where(Q�+� ) areprime boundedcontexts andq � Q. The modelconstructedmay be infinite asit may containinfinite worlds. However, by usingtechniquessimilar to thoseusedin [29], wewill beableto constructafinite modelthatis equivalentto thecounter-model.Thekey techniquein theconstructionis theidentificationof triples (Q�+�,� q) that di

�er only in renamingof placesotherthan

thosein P. Westarttheproof by discussingrenamingfunctions.

5.1 Renamingfunctions

In this Section,we shall discussrenamingof placesin formulaeandjudgements.Givenany two setsof placesQ1 � Q2, a renamingfunction is a function f : Q1 �Q2. Intuitively, f renamesa placeq in Q1 as f (q).

Givena renamingfunction f : Q1 � Q2, we canextend f to a function fromthesetFrm(Q1) into thesetFrm(Q2) by replacingall occurrencesof placesq byf (q). More formally,

0 f (A)def� A for all atomsA;

0 f ( � 1 ¾ � 2)def� f ( � 1) ¾ f ( � 2) for ¾ ��4r�� /6 ;

0 f ( � @q)def� f ( � )@f (q);

0 f ( �� ) def�n� f ( � ) and f ( �� ) def�l� f ( � ).Furthermore,we canextend f to sentencesby defining f ( � at q)

def� f ( � ) at f (q).f canthenbeextendedto any context ) ; � by applying f to all the formulaeandsentence.

32

If f is a renamingfunction, then we can transforma proof of a judgement) ; �/. Q1 � at q to aproofof thejudgementf () ; � ) . Q2 f ( � ) at f (q):

Lemma 5 (Provability Preservation Under Renaming) Let f : Q1 � Q2 be arenamingfunction. Thenfor any setof pure formulae ) , any setof sentences� ,any formula � andanyplaceq such that PL() ) 1 PL( � ) 1 PL( � ) 1Y4 q6�2 Q1, wehave:

) ; �9. Q1 � at q implies f () ; � ) . Q2 f ( � ) at f (q) �Proof: Intuitively, in orderto obtaina proof of f () ; � ) . Q2 f ( � ) at f (q), replaceall occurrencesof placesr in theproof of ) ; �9. Q1 � at q by f (r).

More formally, we prove theLemmaby inductionon n, thenumberof infer-encerulesappliedto derive the judgement) ; �z. Q1 � at q. Pleasenotethat theinduction is on the numberof inferencerulesapplied,andwe will vary the setsQi �+� , and the formula � in the proof. Pleaserecall that the inferencerules aregivenin Figure1.

BaseCase(n � 1). Thenthe rule appliedis oneamongstL, G, and � I . Iftheappliedrule is L, then � at q �� . Hence f ( � ) at f (q) � f (� ). An applicationof the rule L gives us f ( ) ; � ) . Q2 f ( � ) at f (q). The casesof G and � I followimmediately.

Inductivehypothesis(n � 1). We proceedby cases,andconsiderthe last ruleappliedto obtain ) ; �[. Q1 � at q. Thetreatmentof therulesinvolving the logicalconnectivesis fairly straightforward,andweshow thethreemostinterestingcases:@I , � I , and � E.

@I : Assumethat the last rule appliedis @I . Then �j��$ @r, for somepureformula $5� Frm(Q1) andsomeplacer � Q1. Furthermore,) ; �m. Q1 $ at pis derivableby usinglessthann instancesof therules.

Theinductionhypothesissaysthat f () ; � ) . Q2 f ( $ ) at f (r). Usingtherule@I , we get ) ; ��. Q2 f ( $ )@f (r) at f (q). We concludeby observingthatf ( $ )@f (r) is f ( � ) by definition.

� I : Assumethatthelastruleappliedis � I . Then ��N�"$ for somepureformula$b� Frm(Q1). Moreover, thereis a q�1 s Q1 suchthat ) ; �n. Q1 D qw1 $ at q�1is derivableby usinglessthann instancesof theinferencerules. Let Q1� �Q1 1Z4 q1�c6 . Chooseq�2 s Q2, andlet Q2� � Q2 1Z4 q2�c6 . Wedefine f � : Q1� �Q2� as f � (r) � f (r) for r � Q1, and f � (q�1) � q�2.

The inductionhypothesissaysthat f � () ; � ) . Q2 D qw2 f � ( $ ) at q�2. As )º�+� and$ do not containq�1, we have f � () ; � ) � f ( ) ; � ) and f � ( $ ) � f ( $ ). There-fore, by usingthe inferencerule � I , we get f () ; � ) . Q2 � f ( $ ) at f (q). Weconcludeby observingthat f ( ��$ ) �N� f ( $ ).

� E: Assumethatthelastruleappliedis � E. Then ��N��$ for somepureformula$P� Frm(Q1). Moreover, thereexist q�1 s Q1, q�|�1 � Q1, and&Y� Frm(P) suchthat:

33

– ) ; �8. Q1 ��& at q�E�1 is derivableby usinglessthann instancesof infer-encerules;and

– ) ; �,�x& at q�1 . Q1 D qw1 $ at q is derivableby usinglessthann instancesofinferencerules.

Applying theinductionhypothesisonthefirst judgement,weget f () ; � ) . Q2

� f (& ) at f (q�F�1 ).

Now, let Q1� � Q1 1�4 q1�c6 and ��5�P14¸& at q�1 6 . We chooseq�2 s Q2. Wedefine f � : Q�1 � Q�2 as f � (r) � f (r) for r � Q1, and f � (q�1) � q�2.

Applying theinductionhypothesison thesecondjudgement,we obtainthatf � () ; �,�x& at q�1) . Q2 D qw2 f � ( $ ) at f � (q). Now, f � is thesameas f on Q1, andthereforeby definition f � ( ) ; ��'& at q�1) � f ( ) ; � ) � f (& ) at q�2. Hence,we getthat f () ; � ) � f (& ) at q�2 . Q2 D qw2 f ( $ ) at q.

Weconcludef () ; � ) . Q2 f ( $ ) at f (q), by usingtheinferencerule � E. T

For example,let usconsiderQ1 �54 p� q6 andlet Q2 �94 r 6 . Let f : Q1 � Q2 bethe function f (p) � r � f (q) � r. Let A beanatom,andlet ) to be theemptylist.Wehave ) ; A at p . Q1 A@p at q. Thenby theLemma5, ) ; A at r . Q2 A@r at r.

5.2 Pointed Contextsand Mor phisms

Let P� Q befinite setsof placessuchthatP 2 Q. Let £b2 Frm(P) bea finite setofpureformulaewith sub-formulaclosure£ ¤ . Pleaserecall thatgivena finite setofsentences� , we saythat (Q�-� ) is a (P�+£ ) ¥ boundedcontext if for every sentence� at r it is thecasethat ��W£ ¤ andr � Q. Givena (P�-£ ) ¥ boundedcontext (Q�-� ),wewill saythat(Q�-�� q) is apointed(P�+£ ) ¥ boundedcontext if q � Q. Henceforth,we refer to suchtriplesas(P�+£ ) ¥ pcontexts. Theelementq is saidto be thepointof thepcontext (Q�-�,� q). Following [29], we lift thenotionof renamingfunctionsto morphismsbetweenpcontexts:

Definition 12(Mor phism) Let w1 andw2 be two (P�+£ ) ¥ pcontexts, andlet wi �(Qi �+� i � qi) for i � 1� 2. A morphismfrom w1 to w2 is arenamingfunction f : Q1 �Q2 suchthat

1. f (p) � p for every p � P;

2. if � at q �W� 1 then � at f (q) �W� 2; and

3. f (q1) � q2.

We write w1 ¿ w2 whenever thereis a morphismfrom w1 to w2. Furthermore,wewrite w1 À w2 if w1 ¿ w2 andw2 ¿ w1.

Thefirst partof thedefinitionsaysthattherenamingfunctiondoesnot changetheplacesin P. Now for every sentence� at q �W� 1, it is thecasethat �!� Frm(P).

34

Therefore,the secondconditionis equivalent to sayingthat f ( � 1) 2m� 2. Hence,(Q1 �+� 1 � q1) ¿ (Q2 �+� 2 � q2) intuitively meansthat � 2 has”more” sentencesthan � 1

up-torenaming.Finally, thethird partsaysthata morphismpreservesthepoint ofapcontext.

For example,let P ��4 p6®�k£Q��4 A6 , andQ1 � Q2 ��4 p� q� r 6 . Let f : Q1 � Q2

betherenamingfunctiondefinedas f (p) � p� f (q) � r and f (r) � q. Considerthethreesetsof sentences:

0 � 1 �V� 2 �54 A at q� A at p6 , and

0 � � �/4 A at p� A at r 6 .We have f (A at q) � A at r. Now, we have that A at r s�� 2 andA at r �Z� � .

Therefore,f is not a morphismfrom (Q1 �-� 1) to (Q2 �-� 2). On theotherhand, f isamorphismfrom (Q1 �-� 1) to (Q2 �-�� ).

Clearly, ¿ is a preorder. The identity function givesreflexivity, andfunctioncompositiongivestransitivity. Thismakestherelation À anequivalencerelation.Ifw is apcontext, thenweshalluse[w] to denotetheclassof thepcontextsequivalentto w with respectto the relation À . We shall use theseequivalenceclassesasthe worlds of the finite counter-model,andthe orderamongstthe worlds will begivenby thepreorder¿ . Wewill now show thattherelation À partitionsthesetofpcontexts into finite numberof classes:

Lemma 6 (Finite Partition) Thesetof (P�+£ ) ¥ pcontextsis partitionedintoa finitenumberof equivalenceclassesby theequivalenceÀ .

Proof: Wewill show thatevery (P�-£ ) ¥ pcontext is equivalentto acanonicalpcon-text. Thesetof canonicalpcontexts will befinite. Beforewe proceed,pleasenotethat P and £ arefinite setsby definition. Hence,thesub-formulaclosure£ ¤ andthepowersetPow(£ ¤ ) mustbefinite sets.

Wewill now definethesetof canonicalpcontexts. For eachÁ¦2�£d¤ wechoose

a new place r Â�s P suchthat r Â 1 � r Â 2 if Á 1 �VÁ 2. Let Rdef�¼4 r Â : Ál2Y£�¤�6 .

Thecardinalityof R is thesameasthecardinalityof Pow(£ ¤ ), andhenceR is finite.A canonicalpcontext will have placesamongstP 1 R. Furthermore,thecanonicalpcontext will containthe sentence� at r Â if and only if r Â is a placein thepcontext and �V��Á . More formally, we saythat thetriple (Q�-«¯� q) is a canonical(P�-£ )-pcontext if

0 Q is asetof placessuchthatP 2 Q 2 P 1 R.

0 � is theunionof two sets� P and � R, where

1. � P is a setof sentencessuchthat � at s �Z� P meansthat �/�Z£d¤ ands � P; and

2. � R is thesetof all sentences� at r Â , where �V��Á and r Â � Q Ã R.

In otherwords, � Rdef�z4®� at r Â : �!�WÁ}� r Â � Q Ã R6 .

35

0 q � Q.

Clearly, a triple that satisfiestheabove pointsis a (P�-£ ) ¥ pcontext. Furthermore,asthesetsP� R�-£ ¤ arefinite, thesetof canonicalpcontexts mustbefinite also.

We will now show that for every pcontext w � (Q�-�,� q) thereis a canoni-cal pcontext equivalentto it. This would immediatelygive us that thenumberofequivalenceclassesinducedby À is finite.

Let w � (Q�+�,� q) bea (P�-£ ) ¥ pcontext, andfix it. For s � Q, let H(s) 2�£ ¤ bethesetof formulae� suchthat � at s �W� .

We now definew� � (Q� �-� � � q� ), the canonicalpcontext equivalent to w asfollows. P will be containedin Q� . For eachs � Q ½ P, we addthe place r H(s)

to Q� . For p � P, a sentence� at p will be in � � only if it is in � . A sentence� at r H(s) will be in Q� only if �N� H(s). Finally, thepoint q� will beq if q � P.Otherwisethepoint q� will be r H(q). More formally, we define:

0 Q� def� P 1!4 r H(s) : s � Q ½ P60 � � def�� P 1�� R, where

– � Pdef�z4®� at p : � at p �W� andp � P6

– � Rdef�74®� at r H(s) : s � Q ½ P and �� r H(s) 6

0 q� def� q if q � P;r H(q) if q � Q ½ P�

Clearly, (Q� �+� � � q� ) is a canonical(P�-£ ) ¥ pcontext. Moreover, the renamingfunctions

f : Q ¥Ä� Q� f (s)def� s if s � P;

r H(s) otherwise�

g : Q� ¥Ä� Q g(t)def�

t if t � P;q if t � q� ;l otherwise,wherel � Q ½ P is chosens.t.

t � r H(l) �aremorphismsfrom w to w� and from w� to w, respectively. We concludethatw À w� . T

5.3 The Finite Counter-Model

Given a finite set of placesP, two finite setsof pure formulae )*�-£X2 Frm(P),let I can be the )S¥ prime and(P�+£ ) ¥ boundedcanonicalKripke modelasdefinedin Section4 (seeDefinition 11). Now, let \ can � (W��HS� R � I � Eval) bethe I can¥birelationalmodelobtainedby usingtheencodingof I can into abirelationalmodel

36

(seeSection3.2). We call \ can the )S¥ primeand(P�-£ ) ¥ boundedcanonicalbire-lational model. Pleaserecall from theproof of completeness(seeSection4) thatif a judgement) ; «5. P � at p is not provable,then \ can providesthebirelationalcounter-modelfor thejudgementfor anappropriatechoiceof £ .

The worlds of \ can are pcontexts (Q�-�� q) where(Q�-� ) are )S¥ prime and(P�-£ ) ¥ bounded.Twoworldsw1 � (Q1 �-� 1 � q1) andw2 � (Q2 �-� 2 � q2) arereachablefrom eachotherif Q1 � Q2 and � 1 �N� 2. Furthermore,(Q1 �-� 1 � q1) H (Q2 �-� 2 � q2)if Q1 2 Q2, � 1 2Z� 2 andq1 � q2. A world w � (Q�-�� q) � I (A) for someatomA ifA at q �� . Theevaluationis a total function,andE((Q�-�� q)) � q. Furthermore,asa consequenceof definitionof canonicalmodels,a world w � (Q�-�� q) forcesaformula �!�W£d¤ if andonly if � at q �W� .

Even thoughthe worlds in canonicalbirelationalare composedof boundedpcontexts, thesetof theworldsmayitself befinite. Following [29], we shallcon-structa model,calledthequotientmodel, equivalentto thecanonicalmodel. Forthis model, we will usemorphismsbetweenpcontexts. Pleaserecall that givenpcontextsw1 andw2, w1 ¿ w2 if thereis amorphismfrom w1 into w2, andw1 À w2

if w1 ¿ w2 andw2 ¿ w1. Therelation ¿ is a preorderand À is anequivalence.Thesetof equivalenceclassesgeneratedby À is finite by Lemma6. We write [w] fortheequivalenceclassof w.

In thequotientcanonicalmodel,thesetof worldswill beWÅcÆ , thesetof equiv-alenceclassesgeneratedby À on W. We have thatWÅcÆ is finite. Our constructionwill ensurethatw in thecanonicalbirelationalmodelforcesa formula �!��£ ¤ onlyif [w] forces� .

In thequotientmodel,[w1] will be lessthan[w2] only if w1 ¿ w2. As ¿ is apreorder, it followseasilythatthisorderingis well-defined.If R is thereachabilityrelationon the canonicalmodel,then[w1] is reachablefrom [w2] in the quotientmodel only if thereis somew�1 � [w1] and w�2 � [w2] suchthat w�1 Rw�2. Theequivalenceof À ensuresthatreachabilityrelationis well-defined.If I is theinter-pretationof atomsin thecanonicalmodelandw � (Q�-�� q), thenanatomA willbeplacedin a world [w] only if A at q �� . Sincea morphismbetweenpcontextsalwayspreservespoints,theinterpretationfunctionis alsowell-defined.

Finally, the evaluationof a world [w] in the canonicalmodelwill be partial.It is definedonly if the point of w is in P, andin that casethe evaluationof [w]is the point of w. Pleasenotethat asmorphismsbetweenpcontexts alwaysfixeselementsin P, andthereforetheevaluationis alsowell-defined.Theotherthing tonoteis thatit is in thewell-definednessof theevaluationthatwe needpartiality (amorphismof pcontexts doesnotneedto preserve placesotherthanthesetP).

We startby definingthequotientmodelformally, andthenwe will prove thatthis is indeeda birelationalmodel.

Definition 13(Quotient CanonicalModel) Givena finite setof placesP, two fi-nite setsof pure formulae )*�-£�2 Frm(P), let \ can � (W��HS� R � I � Eval) be the)%¥ primeand(P�+£ ) ¥ boundedcanonicalbirelationalmodelwith setof placesPls.Thequotientmodelof \ can hassetof placesP, andis definedto bethequintuple

37

(WÅ`ÆÇ��H*�È� R �È� I �'� Eval� ), where

1. ThesetWÅcÆ is thesetof theequivalenceclassesgeneratedby therelation Àon W.

2. Thebinaryrelation H � is definedas:[w1] H � [w2] if andonly if w1 ¿ w2.

3. Thebinaryrelation R � is definedas: [w1] R � [w2] if andonly if thereexistsw�1 � [w1] andw�2 � [w2] suchthatw�1 Rw�2.

4. Thefunction I � : Atoms� Pow(WÅcÆ ) is definedas:

I � (A)def�z4 [w] : w � I (A) 6

5. ThepartialfunctionEval� : WÅcÆ©� P is definedas:

Eval� ([w])def� p if w � (Q�-�� p) andp � P;

notdefined otherwise.

As we discussedbefore, H#� , R � , I � andEval� in thequotientmodelarewell-defined.We will show that thequotientmodelthat we just constructedis a bire-lational model. In order to show this, we first show that the relation R � is anequivalence:

Lemma 7 (Reachability is an Equivalence) Given a finite set of placesP, twofinite setsof pure formulae )*�-£É2 Frm(P), let \ can � (W��HS� R � I � Eval) be the)%¥ primeand(P�-£ ) ¥ boundedcanonicalbirelationalmodel.Let \ ÅcÆ � (WÅcÆ ��H � �R �r� I �r� Eval� ) bethequotientmodelof \ can. ThenR � is an equivalence.

Proof: The reflexivity andsymmetryof R � follow from thereflexivity andsym-metryof R in themodel\ can. Weneedto show that R � is transitive.

Pick [w1] � [w2] � [w3] � WÅ`Æ suchthat [w1] R � [w2] R � [w3], andfix them. Bydefinition,theassumption[w1] R � [w2] R � [w3] is equivalentto sayingthattherearew�1 � w�2 � w��2 � w�3 � W suchthatw1 À w�1 Rw�2 À w2 andw2 À w��2 Rw�3 À w3. As À isanequivalence,weget

w�1 Rw�2 À w��2 Rw�3 � (6)

In orderto provetransitivity, wewill first show thattherearetwo worldsv1 andv3 in W suchthatw�1 À v1 Rv3 À w�3. This will give usby definition [w�1] R � [w�3],andhence[w1] R � [w3].

Now, theassumptionsin (6) andthedefinitionof R saythat

1. w�1 � (Q1 �-� 1 � q1) andw�2 � (Q1 �-� 1 � q2), where(Q1 �+� 1) is a ) -prime and(P�-£ ) ¥ boundedcontext, andq1 � q2 � Q1.

2. w�E�2 � (Q2 �+� 2 � q�2) andw��3 � (Q2 �-� 2 � q3), where(Q2 �-� 2) is a ) -prime and(P�-£ ) ¥ boundedcontext, andq�2 � q3 � Q2.

38

3. (Q1 �-� 1 � q2) À (Q2 �+� 2 � q�2), i.e., thereexist two morphismsf : Q1 � Q2 andg : Q2 � Q1 suchthat f (q2) � q�2 andg(q�2) � q2.

Without lossof generality, wecanassumethatQ1 � P 1 R1 andQ2 � P 1 R2 withR1 Ã R2 �!¬ (otherwise,we canrenametheplacesin � 2 andR2).

(Q1 1 Q2 �-� 1 1� 2) is (P�+£ ) ¥ boundedas(Q1 �-� 1) and(Q2 �-� 2) arebounded

contexts. We let v1def� (Q1 1 Q2 �-� 1 1�� 2 � q1) andv3

def� (Q1 1 Q2 �-� 1 1�� 2 � q3).Now, considerthetriple v1 � (Q1 1 Q2 �+� 1 1�� 2 � q1). Wehave (Q1 1 Q2 �-� 1 1

� 2 � q1) À (Q1 �+� 1 � q1), by consideringthetwo renamingfunctions

G1 : Q1 1 Q2 ¥Ä� Q1 G2 : Q1 ¥Ä� Q1 1 Q2

G1(q)def� q if q � Q1;

g(q) if q � Q2G2(q)

def� q

Pleasenotethat asg is a morphism,g(q) � q if q � Q1 Ã Q2 � P. Therefore,G1 is well-definedandG1(q1) � q1. Now, supposethat � at q �m� 1 1P� 2. If� at q � � 1, then � at G1(q) �� 1 asG1(q) � q in thatcase.If � at q � � 2, then� at G1(q) �W� 1 becausein thiscaseG1(q) � g(q) andg is amorphism.Therefore,G1 is a morphismof pcontexts. G2 is a morphismbetweenpcontexts trivially, andhencewegetw�1 À v1.

Similarly, (Q1 1 Q2 �-� 1 1�� 2 � q3) À (Q2 �-� 2 � q3) by consideringthemorphisms

F1 : Q1 1 Q2 ¥Ä� Q2 F2 : Q2 ¥Ä� Q1 1 Q2

F1(q)def� f (q) if q � Q1;

q if q � Q2F2(q)

def� q

Wegetthatv3 À w�3.If v1 andv3 areworldsin \ can, thenv1 Rv3 by definition.In thatcasev1 andv3

aretheworldswearelookingfor. In orderto show thatv1 andv3 areindeedworldsin \ can we needto show that the (P�+£ ) ¥ boundedcontext (Q1 1 Q2 �-� 1 1Z� 2) is) -prime.

In orderto show that(Q1 1 Q2 �+� 1 1�� 2) is )S¥ primewe needto show thefourpropertiesrequiredby Definition 10. We will prove hereonly the £ -deductiveclosureproperty. Thetreatmentof otherpropertiesis similar.

Assumethat ) ; � 1 1N� 2 . Q1Ê Q2 � at q for some ��e£ . We considertwocases.If q � Q1, thenconsidertherenamingfunctionG1 definedabove. Now G1

fixesQ1 andappliesg to Q2. Therefore,G1( ) ) �Q) , G1(� 1 1�� 2) �f� 1 1 g(� 2),G1( � ) �� andG1(q) � q. Now, asg is a morphismwe get that g(� 2) 2b� 1.Therefore,usingLemma5 andapplyingtherenamingfunctionG1 to thejudgement) ; � 1 1§� 2 . Q1Ê Q2 � at q, we get that ) ; � 1 . Q1 � at q. As � 1 is ) -prime, � at q �� 1 2Z� 1 1�� 2. Likewise,if q � Q2, weconcludethat � at q �W� 2 2�� 1 1�� 2. TWenow show thatthequotientmodelis abirelationalmodel.

Proposition 9 (Bir elational Preservation) Let \ can � (W��HS� R � I � Eval) be the)%¥ primeand(P�-£ ) ¥ boundedcanonicalbirelationalmodelwith setof placesPls.

39

Let \�ÅcÆ�� (WÅ`ÆÇ��H*�r� R �x� I �r� Eval� ) bethequotientmodelof \ can. Then\�ÅcÆ is afinitebirelationalmodelwith setof placesP.

Proof: The finitenessof \ ÅcÆ follows from Lemma6. We needto verify all thepropertieslistedin Definition 5.

1. ClearlyWÅcÆ is anonemptyset.

2. Therelation H � is a partialordersince ¿ is a preorder, and À is theequiva-lenceinducedby ¿ .

3. R � is an equivalenceby Lemma7. We prove the reachabilitycondition.Consider[w1] � [w�1] � [w2] � WÅ`Æ suchthat [w2] L#� [w1] R � [w�1]. We needtoprove thatthereexists[w�2] � WÅcÆ suchthat[w2] R � [w�2] L � [w�1].

Now, thehypothesis[w2] L � [w1] R � [w�1] means:

0 w1 � (Q1 �-� 1 � q1) andw�1 � (Q1 �+� 1 � q�1) where(Q1 �-� 1) is a )S¥ primeand(P�-£ ) ¥ boundedcontext, andq1 � q�1 � Q1;

0 w2 � (Q2 �-� 2 � q2) where(Q2 �-� 2) is a )S¥ prime and (P�-£ ) ¥ boundedcontext, andq2 � Q2; and

0 thereis amorphismf : Q1 � Q2 from w1 to w2.

We definew�2def� (Q2 �+� 2 � f (q�1)). Clearlyw2 � W, w2 Rw�2, and f is alsoa

morphismfrom w�1 to w�2. Therefore[w2] R � [w�2] L � [w�1], asrequired.

4. In orderto checkthemonotonicityof I � , consider[w1] � [w2] � WÅcÆ suchthat[w1] H*� [w2]. Thenw1 � (Q1 �-� 1 � q1), w2 � (Q2 �-� 2 � q2), andthereexistsamorphismf from w1 to w2 suchthat f (q1) � q2.

We needto prove that if [w1] � I � (A), then[w2] � I � (A) also. Now assumethat [w1] � I � (A). By definition, this meansthat A at q1 �Q� 1. As f isa morphism,we get A at f (q1) �5� 2, andhenceA at q2 �5� 2. Therefore[w2] � I � (A) asrequired.

5. According to the definition, Eval� is a partial function. We needto verifycoherenceanduniqueness.

Coherence. Consider[w1] � [w2] � WÅcÆ suchthat [w1] H � [w2], andassumethat[w1] _ q. Thenq � P, andw1 � (Q1 �-� 1 � q) for someQ1 �+� 1. [w1] H*�[w2] meansthat is a morphismfrom w1 to w2 thatfixesq. Therefore,w2 � (Q2 �-� 2 � q) for someQ2 and � 2. By definition,we concludethat[w2] _ q.

Uniqueness Consider[w1] � [w2] � WÅcÆ suchthat [w1] R � [w2]. This meansthatthereexist w�1 � w�2 � W suchthatw1 À w�1 Rw�2 À w2. Assumethat[w1] _ q and[w2] _ q. Thenw�1 _ q andw�2 _ q in \ can. Theuniquenessproperty in \ can saysthat w�1 � w�2. Hencew1 À w�1 À w2. Weconclude[w1] � [w2] asrequired. T

40

Wewill show thataworld w forcesaformulain £ ¤ in thecanonicalbirelationalmodel if andonly if [w] forcesthe formula in the quotientmodel. For this, wewill needthefollowing propositionwhich statesthatgivenworldsw1 ¿ w2 in thecanonicalmodel,if w1 forcesa formulain £�¤ thensodoesw2:

Proposition 10(Forcing Preservation Under Mor phisms) Givena finite set ofplacesP, twofinite setsof pure formulae)*�+£j2 Frm(P), let \ can � (W��HS� R � I �Eval) bethe )S¥ primeand(P�-£ ) ¥ boundedcanonicalbirelationalmodel.Let � ��be theextensionof interpretation I to formulae. Thenfor everyw1 � w2 � W, and�!�W£d¤ :

1. If w1 ¿ w2, thenw1 � ��X� impliesw2 � ��X� .2. If w1 À w2, thenw1 � ��X� if andonly if w2 � ��X� .

Proof: We prove thefirst point asthesecondoneis straightforward consequenceof thefirst one. Considerw1 � w2 � W, suchthatw1 ¿ w2. This meansthatw1 �(Q1 �+� 1 � q1) andw2 � (Q2 �+� 2 � q2) where(Qi �+� i) are ) -primeand(P�+£ )-boundedcontexts for i � 1� 2. Moreover, thereis a morphism f : Q1 � Q2 suchthatf (q1) � q2.

Assumethat w1 � �� for some �Q�£ ¤ . This meansfrom the definition ofcanonicalbirelationalmodelthat � at q1 �� 1. Since f is a morphismfrom w1 tow2, we get that � at q2 �� 2. Onceagain,we get from thedefinitionof canonicalbirelationalmodelthatw2 � ��X� . T

We are now readyto prove that if the world w in the canonicalbirelationalmodelforces �N� £d¤ , thentheworld [w] in thequotientmodelalsoforces � , andvice-versa.

Lemma 8 (Quotient Forcing Preservation) Givena finitesetof placesP, twofi-nite setsof pure formulae )*�-£�2 Frm(P), let \ can � (W��HS� R � I � Eval) be the)%¥ primeand(P�-£ ) ¥ boundedcanonicalbirelationalmodel.Let \ ÅcÆ � (WÅcÆ ��H#�x�R � � I � � Eval� ) bethequotientmodelof \ can. Let � �� and � � ÅcÆ extendtheinterpre-tationsI andI � to formulaerespectively. Then,for every ��W£ ¤ andw � W:

w � ��X� if andonly if [w] � � ÅcÆ �*�

Proof: Theproof proceedsby inductionon thestructureof theformula �!��£�¤ .Basecase. TheLemmais verifiedon � , andon � by definition.Considernow

the casewhen �f� A � Atoms. Thenw � �%� A meansw � (Q�+�,� q) for someQ�-�� q andA at q �W� . Hence,[w] � I � (A), andtherefore[w] � � ÅcÆ A.

Inductivehypothesis.We considera formula ��f£ ¤ , and we assumethatthe Lemmaholds for eachsub-formulaof � that is in £�¤ . We will proceedbycaseson thestructureof � . For thesake of clarity, we will just considerthecaseof implication and the modalities. The other casescan be dealt with similarly.

41

Pleasenotethatas £ ¤ is closedundersub-formulae,the inductionhypothesiscanbeappliedto all sub-formulaeof � .

Beforewe proceedwith the cases,we observe that if w1 � (Q1 �+� 1 � q1) andw2 � (Q2 �+� 2 � q2) are two worlds in W suchw1 H w2, then w1 ¿ w2. This isbecauseby definitionw1 H w2 meansthat Q1 2 Q2, � 1 2�� 2 andq1 � q2. Themorphismbetweenw1 andw2 is givenby theinjectionof Q1 into Q2.

Case��P� 1 �A� 2. Let w � �%� � . We needto show that [w] � � ÅcÆ � . Consider[w� ] L*� [w]. Then w��Ë w. By Proposition10, we have w� ��%� � . As��N� 1 �� 2, we getthatw� � ��X� 2 whenever w� � �� 1.

If we assume[w� ] � � ÅcÆ � 1 thenw� � �%�� 1 by inductionhypothesis.Hencew�}��Ì� 2. The inductionhypothesissaysthat [w� ] � � ÅcÆ � 2. As [w� ] is anarbitraryworld largerthat[w], wecanconcludethat[w] � � ÅcÆ � 1 �A� 2.

For theotherdirection,let [w] � � ÅcÆ � . Thismeansthatfor every [w� ] L � [w]:if [w� ] � � ÅcÆ � 1, then[w� ] � � ÅcÆ � 2.

Considernow w��L*� w. We have [w� ] Ë [w] also. If we assumew�� 1,thentheinductionhypothesissaysthat [w� ] � �%ÅcÆ�� 1. Then[w� ] � �%ÅcÆ�� 2, andsow� � ��X� 2 by inductionhypothesis.Weconcludethatw � �%�� 1 �A� 2.

Case��P�� 1. Let w � �� . We needto show that [w] � � Å`Æ �"� 1. Consider[w1] L � [w] and [w2] R � [w1]. It su cesto show that [w2] � � ÅcÆ � 1. Thehypothesis[w2] R � [w1] L#� [w] meansthatw1 Ë w andw2 À w3 Rw4 À w1

for someworldsw3 � w4 � W. Wegetthatw4 Ë w as ¿ is apreorder.

Wehavew4 Ë w, andhencew4 � �� 1 by Proposition10. By definitionofforcing,w3 � �%�¡� 1. Thereforew2 � ��¡� 1 by Proposition10. Theinductionhypothesissaysthat[w2] � � ÅcÆ � 1, andsowe conclude[w] � � Å`Æ �"� 1.

For theotherdirection,let [w] � � Å`Æ �� 1. Considerw1 L w andw2 Rw1. Wehave to show thatw2 � �P� 1.

We have w1 Ë w, andhence[w1] L [w]. We alsohave by thedefinitionofthequotientmodelthat[w2] R � [w1]. Therefore,as[w] � � ÅcÆ �� 1, we getthat[w2] � �%ÅcÆ � 1. Hencew2 � ��Í� 1 by inductionhypothesis.We concludethatw � ��X�"� 1.

Case��P�� 1. Let w � �� . Thenthereexistsw1 Rw suchthatw1 � �%�� 1. Sowehave [w1] R � [w] by the definition of quotientmodel. Also [w1] � � ÅcÆ � 1 byinductionhypothesis.Hence[w] � � ÅcÆ �� 1.

For theotherdirection,let [w] � � Å`Æ � . Thenthereexists[w1] R � [w] suchthat[w1] � � ÅcÆ � 1. This meansthat therearew�1 andw� suchthatw1 À w�1 Rw� Àw, andw1 � �%�� 1 by inductionhypothesis.By Proposition 6, we get thatw�1 � �%�g� 1. Therefore,by definitionof forcing,w��%�g�a� 1. By Proposition6 onceagain,w � ��X�a� 1.

42

Case��P� 1@q. As �!�W£ ¤ and £ ¤ 2 Frm(P), we getthatq � P.

Now, if w � �%� � thenthereexists w1 Rw suchthat w1 � �� 1 andw1 _ q.Wehave [w1] R � [w] by definitionof quotientmodel.As q � P, wealsohave[w1] _ q. Therefore,[w] � � Å`Æ � 1@q.

For theotherdirection,let [w] � � Å`Æ � . Thenthereexists[w1] R � [w] suchthat[w1] � � ÅcÆ � 1, and[w1] _ q. Thismeansthattherearew�1 andw� suchthatw1 Àw�1 Rw� À w, andw1 � �%�� 1 by inductionhypothesis.Furthermore,w1 _ qandw�1 _ q. By Proposition 6, we get thatw�1 � �� 1. Hence,by definitionof forcing,w� � �%�� 1@q. By Proposition6 onceagain,w � ��X� 1@q. T

Finally, we have thefinite modelproperty:

Theorem 3 (Finite Model Property) Assumethat P is a finite set of places. Ifthejudgement) ; �Q. P � at p is not provable, thenthere existsa finite birelationalmodel\ with setof placesP, such that ) ; �9. P � at p is not valid in \ .

Proof: Wefix £ def��4®�"$ ; $N�W)S6Î1�)©1�4®$ : $ at q �W�¹6a1 PL( � ) 1�4 p6 . Considerthe) -primeand(P�+£ ) ¥ boundedcanonicalbirelationalmodel \ can. Fromtheproofof completenessin Section4 thereis aworld of \ can, sayw, suchthatw evaluatesto P andw forces) ; � but not � .

Considerthe quotient \�Å`Æ of \ can. \�Å`Æ is a finite birelationalmodelandhassetof placesP. Theworld [w] evaluatesto p. Furthermore,asa consequenceof Lemma8, we caneasilyshow that[w] forces) ; � but not � . Therefore,\ ÅcÆ istherequiredfinite counter-model. T

Pleaserecall from Section4 that for the provability of a judgement,we justneedto considertheplacesappearingin theformulaeof thejudgement(seePropo-sition 8). Using this fact and the finite modelproperty, we get that the logic isdecidable:

Corollary 3 (Decidability) Theprovability of thejudgement) ; �/. P � at p is de-cidablein thelogic.

Proof: Let P� bePL( ) ) 1 PL(� ) 1 PL( � ) 14 p6 . By Proposition8, ) ; �[. P � at pif andonly if ) ; ��. Pw � at p. As thefunctionPL canbee

�ectively computed,we

justneedto considerthejudgement) ; �9. Pw � at p for thedecidabilityresult.We canenumerateall proofsin thelogic in which thesetof placesconsidered

is finite. Hence,weobtainane�

ectiveenumerationof all provablejudgements.Wecanalsoe

�ectively enumerateall finite birelationalmodels,ande

�ectively check

whetherthe judgement) ; �J. Pw � at p is refutablein a given finite birelationalmodel. As a consequenceof finite modelpropertyproved above, ) ; �8. Pw � at pis refutableonly if it is refutablein somefinite birelationalmodel. By perform-ing theseenumerationsandcheckssimultaneously, we obtainane

�ective testfor

provability of ) ; �9. Pw � at p. T

43

The proceduredetailedin the Corollary above would not have worked if wehadusedKripke modelsinsteadof birelationalmodels.This is becausethefinitemodel property fails for Kripke models. For example,considerthe judgement; �kh�h A at p . o pp h�hS� A at p. We claim thatthis judgementis valid for every finitedistributedKripke model.

Indeed,let k bea Kripke statein somefinite distributedKripke model I suchthat (k� p) � ��kh�h A. Pick l L k in I suchthat l is maximalwith respectto theorderingof Kripkestates.As (k� p) � �N�kh"h A, wegetby definitionthat(l � r) � �/h�h Afor every placer in thestatel. Fromthesemanticsof implicationandthefactthatl is amaximalstate,it mustbethecasethat(l � r) � � A for every placer in thestatel. Again,asl is maximal,we get(l � p) � �� A. As l L k, we get that(l � p) � �Qh"h%� Afrom thesemanticsof implication.

On the other hand,we showed that the judgementis not valid in the finitemodel \ exam in Section3. The model \ exam hastwo worlds w1 andw2 suchthat w1 H w2 � w1 Rw2 � I (A) ��4 w2 6®� w1 ^ and w2 _ p. As we discussedthere,w2 � �e�kh"h A andw2 i� �jh�hS� A. As we mentionedbefore,this exampleis adaptedfrom [22, 29].

6 RelatedWork

Thelogic westudiedis anextensionof thelogic introducedin [14, 15]. In [14, 15],it wasusedasthe foundationof a typesystemfor a distributed Ï -calculusby ex-ploiting theproofs-as-termsandpropositions-as-typesparadigm.Theproof termscorrespondingto modalitieshave computationalinterpretationin termsof remoteprocedurecalls(@p), commandsto broadcastcomputations( � ), andcommandstouseportablecode( � ). Theauthorsalsointroducea sequentcalculusfor the logicwithoutdisjunctive connectives,andprove thatit enjoys cutelimination.Althoughtheauthorsdemonstratetheusefulnessof logic in reasoningaboutthedistributionof resources,they do nothave acorrespondingmodel.

Froma logical point of view, this logic canbeviewedasa hybrid modallogic[1, 2, 3, 4, 5, 24, 25]. A hybrid logic internalisesthemodelin the logic by usingmodalitiesbuilt from purenames.Theoriginal ideaof internalisingthemodelintoformulaewasproposedin [24, 25], andhasbeenfurtherinvestigatedin [1, 2, 3, 4,5]. This work hasbeenmostlycarriedout in theclassicalsetting.More recently,intuitionisticversionsof hybrid logicswereinvestigatedin [6, 14, 15].

Thereareseveralintuitionisticmodallogicsin theliterature,and[29] is agoodsourceon them. The modalitiesin [29] have a temporalflavour, andthe spatialinterpretationwasnot recognisedthen.Thework in [6] extendsthemodalsystemsin [29], andcreateshybridversionsof themodalsystemsby introducingnominals.A naturaldeductionsystemfor thesehybrid systemsalongwith a normalisationresultis alsogivenin [6]. A Kripkesemanticsalongwith aproofof soundnessandcompletenessis alsointroduced.

Theextensionwe gave to the logic in [14, 15] is a hybrid versionof the intu-

44

itionistic modalsystemIS5 [21, 26, 29]. Themodality@p internalisesthemodelin thelogic. In themodalsystemIS5, first introducedin [26], theaccessibilityre-lation amongplacesis total. Themaindi

�erencein thelogic presentedin [6] and

the logic in [14, 15] is that namesin [14, 15] only occurin themodality@p. In[6], namesalsooccuraspropositions.

From the point of view of semantics,Kripke semanticswerefirst introducedin [17] for intuitionisticfirst-orderlogic. Kripke semanticsfor intuitionisticmodalsystemsweredevelopedin [10, 21, 23, 28, 29]. Birelationalmodelsfor intuitionis-tic modallogic wereintroducedindependentlyin [10, 28, 23]. They arein generalusefulto prove finite modelpropertyasdemonstratedin [22, 29]. Thefinite modelpropertyfails for Kripke semantics[29, 22], andtheexamplefor this wasadaptedto ourdistributedKripke semantics.

Someotherexamplesof work on logicsof resourcesareseparationlogics[27]andlogic of bunchedimplications[20]. In [20], theauthorsgive a Kripke modelbasedonmonoids.Theformulaeof thelogic aretheresources,andareinterpretedaselementsof themonoid.Thefocusof this work is thesharingof resources,andnot theirdistribution. Thereis nonotionof places,andthelogic hasnomodalities.

In theclassicalsetting,thereareanumberof logicsusedto studyspatialprop-erties.In [7, 8], for example,theauthorsuseprocesscalculi astheir models.Theyhave aclassicalmodallogic to studyspatialandtemporalpropertiesof processes.

7 Conclusionsand Futur eWork

We studiedthe hybrid modal logic presentedin [14, 15], andextendedthe logicwith disjunctive connectives. Formulaein the logic containnames,also calledplaces.Thelogic is usefulto reasonaboutplacementof resourcesin a distributedsystem.Wegave two soundandcompletesemanticsfor thelogic.

In onesemantics,we interpretedthejudgementsof thelogic overKripke-stylemodels[17]. Typically, Kripke models[17] consistof partially orderedKripkestates.In ourcase,eachKripkestatehasasetof places,anddi

�erentplacessatisfy

di�

erentformulae. Larger Kripke stateshave larger setsof places,andthe satis-factionof atomscorrespondsto theplacementof resources.Themodalitiesof thelogic allow formulaeto be satisfiedin a namedplace(@p), someplace( � ) andevery place( � ). The Kripke semanticscanbe seenasan instanceof hybrid IS5[21, 26,6, 29].

In thesecondsemantics,we interpretedthejudgementsover birelationalmod-els [10, 28, 23, 29]. Typically, birelationalmodelshave a setof partially orderedworlds. In additionto thepartialorder, thereis alsoareachabilityrelationamongstworlds. In orderto interpretthemodality@p in thesystem,we alsointroducedapartialevaluationfunctiononthesetof worlds.Thehybridnatureof thelogic pre-senteddi cultiesin theproof of soundness.Thedi cultiesareaddressedusingamathematicalconstructionthatcreatesa new modelfrom a givenone. Thesetofworld in the constructedmodelis the unionof two sets. Oneof thesesetsis the

45

reachabilityrelation,andthe worlds in the secondsetwitnessthe existentialanduniversalproperties.

As in thecaseof intuitionistic modalsystems[10, 28,21, 23, 29], we demon-stratedthatthebirelationalmodelsintroducedhereenjoy thefinite modelproperty:a judgementis not provablein thelogic if andonly if it is refutablein somefinitemodel.Thefinite modelpropertyallowedusto concludedecidability. Thepartial-ity of theevaluationfunctionwasessentialin theproofof finite modelproperty.

As future work, we are consideringother extensionsof the logic. A majorlimitation of the logic presentedin [14, 15] is that if a formula � is validatedatsomenamedplace,say p, then the formula � @p canbe inferredat every otherplace.Similarly, if �a� or �"� canbeinferredatoneplace,thenthey canbeinferredat any otherplace.In a largedistributedsystem,we maywantto restricttherightsof accessinginformationin a place. This canbe doneby addingan accessibilityrelationasis donein thecaseof otherintuitionistic modalsystems[29, 6]. Wearecurrentlyinvestigatingif theproof of finite modelpropertycanbeadaptedto thehybridversionsof otherintuitionisticmodalsystems.Wearealsoinvestigatingthecomputationalinterpretationof theseextensions.This would result in extensionsof Ï -calculuspresentedin [14, 15].

Acknowledgements. We thank AnnalisaBossi, Giovanni Conforti, Valeria dePaiva, Matthew Hennessy, andBernhardReusfor interestingandusefuldiscus-sions.

References

[1] C.ArecesandP. Blackburn. Bringingthemall together. Journalof Logic andComputation, 11(5):657–669,2001.

[2] C. Areces,P. Blackburn, and M. Marx. Hybrid logics: Characterization,interpolationandcomplexity. JournalofSymbolicLogic, 66:997–1010,2001.

[3] P. Blackburn. Internalizinglabelleddeduction.Journalof Logic andCompu-tation, 10:137–168,2000.

[4] P. Blackburn. Representation,reasoning,andrelationalstructures:a hybridlogic manifesto.Logic Journal of theIGPL, 8:339–365,2000.

[5] P. Blackburn andJ. Seligman. What arehybrid languages?In M. Kracht,M. deRijke,H. Wansing,andM. Zakharyaschev, editors,Advancesin modallogic, volume1, pages41–62.CSLI, 1996.

[6] T. Brauner and V. de Paiva. Towardsconstructive hybrid logic (extendedabstract).In Elec.Proc.of Methodsfor Modalities3, 2003.

[7] L. CairesandL. Cardelli.A spatiallogic for concurrency (partI). In TACS’01,volume2215of LNCS, pages1–37.SpringerVerlag,2001.

46

[8] L. CardelliandA.D. Gordon. Anytime, anywhere.Modal logics for mobileambients.In POPL’00, pages365–377.ACM Press,2000.

[9] L. CardelliandA.D. Gordon. Mobile ambients.Theoretical ComputerSci-ence, SpecialIssueonCoordination, 240(1):177–213,2000.

[10] W. B. Ewald. Time, Modality and Intuitionism. PhD thesis,University ofOxford,1978.

[11] J.-Y. Girard. ProofsandTypes. CambridgeUniversityPress,1989.

[12] M. HennessyandR. Milner. Algebraiclaws for nondeterminismandconcur-rency. Journalof theACM, 32(1):137–161,1985.

[13] M. Hennessyand J. Riely. Resourceaccesscontrol in systemsof mobileagents.InformationandComputation, 173:82–120,2002.

[14] L. JiaandD. Walker. Modalproofsasdistributedprograms.TechnicalReportTR-671-03,PrincetonUniversity, 2003.

[15] L. Jia andD. Walker. Modal proofsasdistributedprograms(extendedab-stract).In ESOP’04, volume2986of LNCS, pages219–233.SpringerVerlag,2004.

[16] S.A. Kripke. Semanticalanalysisof modal logic I: Normal modalproposi-tional calculi. In Zeitschrift fur Mathematische Logik und Grundlagen derMathematik, volume9, pages67–96,1963.

[17] S.A. Kripke. Semanticalanalysisof intuitionistic logic, I. In Proc. of LogicColloquium,Oxford, 1963, pages92–130.North-HollandPublishingCom-pany, 1965.

[18] R. Milner, J.Parrow, andD. Walker. A calculusof mobileprocesses,partsIandII. InformationandComputation, 100(1):1–77,1992.

[19] J. Moody. Modal logic as a basisfor distributed computation. TechnicalReportCMU-CS-03-194,Carnegie Mellon University, 2003.

[20] P.W. O’HearnandD. Pym. The logic of bunchedimplications. Bulletin ofSymbolicLogic, 5(2):215–244,1999.

[21] H. Ono. On SomeIntuitionistic Modal Logics, volume13, pages687–722.Publicationsof RIMS, KyotoUniversity, 1977.

[22] H. OnoandN.-Y. Suzuki. Relationsbetweenintuitionistic modallogicsandintermediatepredicatelogics. Reportson MathematicalLogic, 22:65–87,1988.

47

[23] G. D Plotkin and C. P Stirling. Theoretical Aspectsof ReasoningAboutKnowledge, chapterA Framework for Intuititionistic Modal Logic. J. Y.Halpern,1986.

[24] A. Prior. Past,PresentandFuture. OxfordUniversityPress,1967.

[25] A. Prior. Papers on TimeandTense. OxfordUniversityPress,1968.

[26] A. N. Prior. TimeandModality. OxfordUniversityPress,1957.

[27] J.Reynolds. Separationlogic: a logic for sharedmutabledatastructures.InLICS’02, pages55–74.IEEEComputerSocietyPress,2002.

[28] G. FisherServi. Semanticsfor a classof intuitionistic modal calculi. InM. L. dallaChiara,editor, Italian Studiesin thePhilosophyof Science, pages59–72.ReidelPublishingCompany, 1981.

[29] A.K. Simpson. The Proof Theory and Semanticsof Intuitionistic ModalLogic. PhDthesis,Universityof Edinburgh,1994.

[30] K. CraryT. Murphy, R. Harper, andF. Pfenning.A symmetricmodallambdacalculusfor distributedcomputing.In LICS’04, 2004.To appear.

[31] D. van Dalen. Logic and Structure. SpringerVerlag,4th extendededition,2004.

48

A Hybrid Intuitionistic Logic: Semantics and Decidability

Documents