(Melvin Fitting) Types, Tableaus, and Gödel's God

by
Melvin Fitting
TYPES, TABLEAUS, AND GO DEL'S GOD
TRENDS IN LOGIC
Studia Logica Library

VOLUME 13
Managing Editor
Ryszard Wojcicki, Institute of Philosophy and Sociology,

Polish Academy of Sciences, Warsaw, Poland
Editors
Daniele Mundici, Department of Computer Sciences, University of Milan, Italy

Ewa Orlowska, National Institute of Telecommunications,
Warsaw, Poland
Graham Priest, Department of Philosophy, University of Queensland,

Brisbane, Australia
Krister Segerberg, Department of Philosophy, Uppsala University,

Sweden
Alasdair Urquhart, Department of Philosophy, University of Toronto, Canada

Heinrich Wansing, Institute of Philosophy, Dresden University of Technology,
Germany
SCOPE OF THE SERIES

Trends in Logic is a bookseries covering essentially the same area as the journal
Studia Logica - that is, contemporary formal logic and its applications and
relations to other disciplines. These include artificial intelligence, informatics,

cognitive science, philosophy of science, and the philosophy of language.
However, this list is not exhaustive, moreover, the range of applications, comparisons and sources of inspiration is open and evolves over time.
Volume Editor
Heinrich Wansing
The titles published in this series are listed at the end of this volume.
MELVIN FITTING
Lehman College and the Graduate Center,
City University of New York, U.S.A.
TYPES,TABLEAUS,
AND GO DEL'S GOD
~~~....
''
KLUWER ACADEMIC PUBLISHERS

DORDRECHT/BOSTON/LONDON
A C.I.P. Catalogue record for this book is available from the Library of Congress.
ISBN 1-4020-0604-7
Published by Kluwer Academic Publishers,

P.O. Box 17, 3300 AA Dordrecht, The Netherlands.
Sold and distributed in North, Central and South America
by Kluwer Academic Publishers,
101 Philip Drive, Norwell, MA 02061, U.S.A.
In all other countries, sold and distributed
by Kluwer Academic Publishers,
P.O. Box 322, 3300 AH Dordrecht, The Netherlands.
Printed on acid-free paper
All Rights Reserved

2002 Kluwer Academic Publishers
No part of this work may be reproduced, stored in a retrieval system, or transmitted
in any form or by any means, electronic, mechanical, photocopying, microfilming, recording
or otherwise, without written permission from the Publisher, with the exception
of any material supplied specifically for the purpose of being entered
and executed on a computer system, for exclusive use by the purchaser of the work.
Printed in the Netherlands.
Contents
PREFACE
Part I
Xl
CLASSICAL LOGIC
1. CLASSICAL LOGIC-SYNTAX
1
2
Terms and Formulas
3
3
Substitutions
2. CLASSICAL LOGIC-SEMANTICS
Classical Models
1
Truth in a Model
2
Problems
3
Compactness
3.1
Strong Completeness
3.2
Weak Completeness
3.3
And Worse
3.4
Henkin Models
4
Generalized Henkin Models
5
A Few Technical Results
6
6.1
Terms and Formulas
Extensional Models
6.2
Language Extensions
6.3
3. CLASSICAL LOGIC-BASIC TABLEAUS
A Different Language
1
Basic Tableaus
2
Tableau Examples
3
v
11
11
12
15
15
16
16
17
19
24
29
29
29
30
33
33
35
37
vi
TYPES, TABLEAUS, AND GODEL'S GOD
4. SOUNDNESS AND COMPLETENESS

Soundness
1
Completeness
2
2.1
Hintikka Sets
2.2
Pseudo-Models
2.3
Substitution and Pseudo-Models
2.4
Hintikka Sets and Pseudo-Models
2.5
Pseudo-Models are Models
2.6
Completeness At Last
Miscellaneous Model Theory
3
43
43
46
47
48
52
59
62
63
66
5. EQUALITY
Adding Equality
1
Derived Rules and Tableau Examples
2
Soundness and Completeness
3
69
69
69
73
6. EXTENSIONALITY
1
Adding Extensionality
A Derived Rule and an Example
2
3
77
Part II
77
77
79
MODAL LOGIC
7. MODAL LOGIC, SYNTAX AND SEMANTICS

Introduction
1
Types and Syntax
2
Constant Domains and Varying Domains
3
4
Standard Modal Models
Truth in a Model
5
Validity and Consequence
6
Examples
7
Related Systems
8
Henkin/Kripke Models
9
83
83
86
89
90
92
94
95
101
102
8. MODAL TABLEAUS
1
The Rules
1.1
Prefixes
Propositional Rules
1.2
105
105
105
107
vii
Contents
1.3
Modal Rules
1.4
Quantifier Rules
1.5
Abstraction Rules
1.6
Atomic Rules
1.7
Proofs and Derivations
Tableau Examples
107
108
109
109
110
111
A Few Derived Rules
113
9. MISCELLANEOUS MATTERS
Equality
1
1.1
Equality Axioms
1.2
Extensionality
115
115
115
117
De Re and De Dicta
3
4
Rigidity
118
121
Stability Conditions
124
Definite Descriptions
Choice Functions
125
128
Part III
ONTOLOGICAL ARGUMENTS
10. GODEL'S ARGUMENT, BACKGROUND

Introduction
1
2
Anselm
Descartes
3
Leibniz
4
Godel
5
6
Godel's Argument, Informally
133
133
134
134
137
138
139
11. GODEL'S ARGUMENT, FORMALLY
145
General Plan
145
Positiveness
145
Possibly God Exists
Objections
150
152
5
6
7
Essence
Necessarily God Exists
Going Further
Monotheism
7.1
156
160
162
162
viii
7.2
Positive Properties are Necessarily Instantiated
More Objections
162
9
10
A Solution
164
Anderson's Alternative
169
11
Conclusion
171
163
REFERENCES
173
INDEX
179
Truth did not come into the world naked,

but it came in types and images.
One will not receive truth in any other way.
The Gospel of Philip
[Rob77]
Preface
What's Here
This is a book about intensional logic. It also provides a thorough
look at higher-type classical logic, including tableaus and a completeness proof for them. It also provides a formal examination of the Godel
ontological argument. These are not disparate topics. Higher-type classical logic is intensional logic with the intensional features removed, so
this is a good place to start. Ontological arguments, Godel's in particular, are natural examples of intensional logic at work, so this is a good
place to finish.
The term formal logic covers a broad range of inventions. At one
end are small, special-purpose systems; at the other are rich, expressive
ones. Higher-type modal logic-intensional logic-is one of the rich ones.
Originating with Carnap and Montague, it has been applied to provide
a semantics for natural language, to model intensional notions, and to
treat long-standing philosophical problems. Recently it has also supplied
a semantic foundation for some complex database systems. But besides
being rich and expressive, it is also tremendously complex, and requires
patience and sympathy on the part of its students.
There are two quite different reasons to be interested in a logic. There
is its formal machinery for its own sake, and there is using the formal
machinery to address problems from the outside world. The mechanism
of higher-type modal logic is complex and requires serious mathematics
to develop properly. Models are not simple to define, and tableau systems are quite elaborate. A completeness argument, to connect the two,
is difficult. But, the machinery is of considerable interest, if this is the
sort of thing you have a considerable interest in. If you are such a reader,
applications concerning the existence of God can simply be skipped. On
the other hand, if philosophical applications are what you are after, the
xi
Xll
Godel ontological argument is a prime example. If this is the kind of

reader you are, much of the mathematical background can be taken on
faith, so to speak. It is a rare reader who will be interested equally in
both the formal and the applied aspects of intensional logic. In a sense,
then, this book has no audience--there are separate audiences for different parts of it. (But I encourage these audiences to do some 'crossing
over.')
If you are interested in ontological arguments for their own sakes, start
with Part III, and pick up material from earlier chapters as it is needed.
If you are interested in the mathematical details of the formal system,
its semantics and its proof theory, Parts I and II will be of interest-you
can skimp on reading Part III. Part I is entirely devoted to classical
logic, and Part II to modal. Here is a more detailed summary.
Part I presents higher-type classical logic. It begins with a discussion
of syntax matters, Chapter 1. I present types in Schutte's style, rather
than following Church. Types can be somewhat daunting and I've tried
to make things go as smoothly as I can.
Chapter 2 examines semantics in considerable detail. What are sometimes called "true" higher-order models are presented first. After this,
Henkin's generalization is given, and finally a non-extensional version of
Henkin models is defined. Henkin himself mentioned such models, but
knowledge of them does not seem to be widespread. They are natural,
and should become more familiar to the logic community-the philosophical logic community in particular.
Classical higher-order tableaus are formulated in Chapter 3. These
are not original here--versions can be found in several places. A number
of worked out examples of tableau proofs are given, and more are in
exercises. The system is best understood if used. I do not attempt a
consideration of automation-the system is designed entirely for human
application. There is even some discussion of why.
Soundness and completeness are proved in Chapter 4. Tableaus are
complete with respect to non-extensional Henkin models. The completeness argument is not original; it is, however, intricate, and detailed
proofs are scarce in the literature.
After the hard work has been done, equality and extensionality are
easy to add using axioms, and this is done in Chapters 5 and 6. And this
concludes Part I. Except for the explicit formulation of non-extensional
models, the material in Part I is not original-see [Tak67, Pra68, Tol75,
And86, Sha91, Lei94, Koh95, Man96], for example.
Part II is devoted to the complications that modality brings. Chapter 7 adds the usual box and diamond to the syntax, and possible worlds
PREFACE
xiii
to the semantics. It is now that choices must be made, since quantified

modal logic is not a thing, but a multitude.
First, at ground level quantifiers could be actualist or possibilistthey can range over what actually exists at a world, or over what might
exist. This corresponds to the varying domain, constant domain split
familiar to many from first-order modal discussions. However, either an
actualist or a possibilist approach can simulate the other. I opt for a
possibilist approach, with an explicit existence predicate, because it is
technically simpler.
Next, we must go up the ladder of higher types. Doing so extensionally, as in classical logic, means we take subsets of the ground-level
domain, subsets of these, and so on. Going up intensionally, as Montague
did, means we introduce functions from possible worlds to sets of groundlevel objects, functions from possible worlds to sets of such things, and
so on. What is presented here mixes the two notions-both extensional
and intensional objects are present. I refer you to [FitOOb, FitOOa] for applications of these ideas to database theory-intensional and extensional
objects make natural sense even in such a context.
Classical tableau rules are adapted in Chapter 8, using prefixes, to produce modal systems. While the modal tableau rules are rather straightforward, they are new to the literature, and should be of interest. Since
things are already quite complex, no completeness proof is given. If it
were given, it would be a direct extension of the classical proof of Part I.
Using modal semantics and tableaus, in Chapter 9 I discuss the relationships between rigidity, de re and de dicto usages, and what I call
Godel's stability conditions, which arise in his proof of the existence of
God. I also relate all this to definite descriptions. While this is not deep
material, much of it does not seem to have been noted before, and many
should find it of some significance.
Finally, Part III is devoted to ontological proofs. Chapter 10 gives
a brief history and analysis of arguments of Anselm, Descartes, and
Leibniz. This is followed by a longer, still informal, presentation of
the Godel argument itself. Formal methods are applied in Chapter 11,
where Godel's proof is examined in great detail. While Godel's argument
is formally correct, some fundamental flaws are pointed out. One, noted
by Sobel, is that it is too strong-the modal system collapses. This
could be seen as showing that free will is incompatible with Godel's
assumptions. Some ways out of this are explored. Another flaw is equally
serious: Godel assumes as an axiom something directly equivalent to a
key conclusion of his argument. The problematic axiom is related to a
principle Leibniz proposed as a way of dealing with a hole he found in
an ontological proof of Descartes. Descartes, Leibniz, and Godel (and
XlV
also Anselm) all have proofs that stick at the same point: showing that
the existence of God is possible.
If the Godel argument is what you are interested in, start with Part III,
and pick up earlier material as needed. Many of the uses of the formalism are relatively intuitive. Indeed, in Godel's notes on his ontological
argument, formal machinery is never discussed, yet it is possible to get
a sense of what it is about anyway.
How Did This Get Written?

Having just completed work on a book about first-order modal logic,
[FM98], a look at higher-order modal logic suggested itself. I thought I
would use Godel's ontological argument as a paradigm, because it is one
of the few examples I have run across that makes essential use of higherorder modal constructs. Godel's argument for the existence of God is not
particularly well-known, but there is a growing body of literature on it.
This literature sometimes gives formalizations of Godel's rather sketchy
ideas-generally along natural deduction or axiomatic lines. My idea
was, I would design a tableau system within which the argument could
be formalized, and this might lead to a nice paper illustrating the use of
tableau methods. First, give tableau rules, then give Godel's proof.
One cannot really develop semantic tableaus without a semantics behind it. The semantics of higher-order modal logic turned out to be
of considerable intricacy, far beyond what could even be sketched in a
paper. Clearly, an extended discussion of the semantics for higher-order
modal logic was needed before the tableau rules could be motivated.
I soon realized that in presenting higher-order modal logic, I was trying to explicate ideas corning from two quite different sources. On the
one hand, there are essentially modal problems, some of which already
arise at the first-order level and have little to do with higher-order constructs. On the other hand, a number of higher-order modal complexities
also manifest themselves in a classical setting, and can be discussed more
clearly without modalities complicating things. So I decided that before
modal operators were introduced, I would give a thorough presentation
of a semantics and tableau system for higher-order classical logic. There
are already treatments of tableau, or Gentzen, systems for higher-order
classical logic in the literature, but I felt it would be useful to give things
in full hr"e. Detailed completeness proofs are hard to find, for instance.
Higher-order classical logic already has its hidden pitfalls. It is common knowledge, so to speak, that "true" higher-order classical models
cannot correspond to any proof procedure. Henkin models are what is
needed. But a "natural" formulation of tableaus is not complete with
respect to Henkin models either. This is something known to experts-
PREFACE
XV
it was not known to me when I started this book. A broader notion

of Henkin model (also due to Henkin) is needed, a non-extensional version. Such models should be better known since they are actually quite
plausible things, and address problems that, while not common in mathematics, do arise in linguistic applications of logic.
In the 1960's, cut-elimination theorems were proved for higher-order
classical logic, using semantic methods that relied on non-extensional
models. In effect, these cut-elimination proofs concealed a completeness
argument within them, but the general notion of non-extensional model
was not formulated abstractly--only the specific structure constructed
by the completeness argument was considered. In short, a completeness
theorem was never stated, only a consequence, albeit a very important
one. So I found myself required to formulate a general notion of classical
non-extensional Henkin model, then prove completeness for a suitable
classical tableau system. After this I could move on to discuss modality.
What sort of modal features did I want? Formalizations of the Godel
argument by others had generally used some version of an intensional
logic, with origins in work of Carnap, [Car 56], developed and applied by
Montague, [Mon60, Mon68, Mon70], and formally elaborated in [Gal75].
After several preliminary attempts I decided this logic was not quite
what I wanted. In it, semantically speaking, all objects are intensional.
I decided I needed a logic containing both intensional and extensional objects. Of course, one could bring extensional objects into the Montague
setting by identifying them with objects that are rigid, in an appropriate
sense, but it seemed much more natural to have extensional objects from
the start. Thus the modal logic given in the second part of this book is
somewhat different from what has been previously considered.
Once I had formulated the modal logic I wanted, tableau rules were
easy, and I could finally formalize the Godel argument. What began as
a short paper had turned into a book. My after-the-fact justification is
that there are few treatments of higher-order logic at all, and fewer still
of higher-order modal logic. It is a rare flower in a remote field. But it
is a pretty flower.
Acknowledgments
An earlier draft of this work was on my web page for some time, and I
was given several helpful suggestions as a result. In particular I want to
thank Peter Hajek, Oliver Kutz, Paul Gilmore, and especially Howard
Sobel.
CLASSICAL LOGIC
Chapter 1
CLASSICAL LOGIC-SYNTAX
1.
Terms and Formulas
The formulation of a higher-order logic allows some freedom-there

are certain places where choices can be made. Several of these choices
produce equivalent results. Before getting to the formal machinery, I
informally set out my decisions on these matters. Other treatments may
make different choices, but ultimately it is largely a matter of convenience that is involved.
Often classical first-order logic is formulated with a rich variety of
terms, built up from constant symbols and variables using function symbols. Since higher-order constructs are already complicated, I have decided to have constant symbols but not function symbols. If necessary
for some purpose, it is not a major issue to add them-doing so yields
a conservative extension.
Higher-order logic can be formulated with or without explicit abstraction machinery. Speaking informally, one wants to make sure that every
formula specifies a class, but there are two ways of making this happen.
One is to assume comprehension axioms, formulas of the general form:
where cp(x1, ... , xn) is a formula with free variables as indicated. Such
axioms ensure that to each formula corresponds an 'object.' The other
approach is to elaborate the term-forming machinery, so that there is
an explicit name for the object specified by a formula cp. This involves
predicate abstraction, or >-.-abstraction:
3
M. Fitting, Types, Tableaus, and Gdel's God
Kluwer Academic Publishers 2002
The two approaches are equivalent in a direct way. I have chosen to use
explicit abstracts for several reasons. First, axioms are not as natural
when tableau systems are the proof machinery of choice. And second,
predicate abstraction has already played a major role in earlier investigations of modal logic [FM98], and makes discussion of major issues
considerably easier here.
Finally, one can characterize higher-order formulas more-or-less the
way it is done in the first-order setting, taking quantifiers and connectives as "logical constants." This is the approach of [Sch60]. Alternatively, following [Chu40], one can think of quantifiers and connectives as
constants of the language, which itself is formulated in lambda-calculus
style. In this book I take the first approach, though one can make
arguments for the second on grounds of elegance and economy. My justification is that doing things the way that has become standard for
first-order logic will be less confusing to the reader.
Recently one further alternative has become available. In [Gil99,
GilOl], Paul Gilmore has shown that by a relatively simple change, a
system of classical higher-order logic can be developed allowing a controlled degree of impredicativity-typing rules can be relaxed to permit
the formation of certain useful sentences that are not "legal" in the approach presented here. This, in turn, allows a more natural development
of arithmetic in the higher-order setting. I do not follow Gilmore's approach here, but I recommend it for study. Much of what I develop
carries over quite directly.
So these are my choices: no function symbols, explicit predicate abstraction, quantifiers and connectives as in the first-order setting, and
no impredicativity. With this out of the way I can begin presenting the
formal syntactical machinery.
In first-order logic, relation symbols have an arity--some are oneplace, some are two-place, and so on. In higher-order logic this simple
idea gets replaced by a typing mechanism, which is considerably more
complex. Terms, and certain other items, are assigned types, and rules
of formation make use of these types to ensure that things fit together
properly. I begin by saying what the types are.
DEFINITION 1.1 (TYPE) 0 is a type. If t1, ... , tn are types, (tl, ... , tn)
is a type. I generally use t, t1, t2, t', etc. to represent types.
An object of type 0 is intended to be a ground-level object-it corresponds to the designation of a constant symbol or variable in standard
first-order logic. An object of type (t 1 , ... , tn) is a predicate that takes
n arguments, of types t 1 , ... , tn respectively. Thus a constant symbol
of type (0, 0, 0), say, would be called a three-place relation symbol in
standard first-order logic-it applies to three ground-level arguments.

But now we can have relation symbols of types such as ( (0), (0, 0), 0), to
which nothing in first-order logic corresponds.
DEFINITION 1.2 (L(C)) Let C be a set of constant symbols with a type
associated to each, containing at least an equality symbol =(t,t) for each
type t. I denote the classical higher-order language built up from C by
L( C). The rest of this section amounts to the formal characterization of
L(C).
For each type t I assume there are infinitely many variable symbols
of that type. I generally use letters from the beginning of the Greek
alphabet to represent variables, with the type written as a superscript:
at, j3t, '"'/, . . . . Likewise I generally use letters from the uppercase
Latin alphabet as constant symbols, again with the type written as a
superscript: At, Bt, ct, Dt, .... As noted, equality is primitive, so for
each type t there is a constant symbol =(t,t) of type (t, t). Often types
can be inferred from context, and so superscripts will be omitted where
possible, in the interests of uncluttered notation.
Sometimes it is helpful to refer to the order of a term or formula-firstorder, second-order, and so on. It is simplest to define this terminology
first for types themselves.
DEFINITION 1.3 (ORDER) Type 0 is of order 0. Type (t1, ... , tn) has
as its order the maximum of the orders of t1, ... , tn, plus one.
Thus (0, 0) is of order 1, or first-order. Likewise (0, (0, 0)) is of order
2, or second-order. Types will play the fundamental role, but order
provides a convenient way of referring to the maximum complexity of
some construct. When I talk about the order of a constant or variable,
I mean the order of its type. Likewise once formulas are defined, I may
refer to the order of the formula, by which I mean the highest order of
a typed part of it.
Next I define the class of formulas, and their free variables. This
definition is more complex than the corresponding first-order version
because the notion of term cannot be defined first; both term and formula
must be defined together. And to define both, I need the auxiliary notion
of predicate abstract which is, itself, part of a mutual recursion involving
Definitions 1.4, 1.5, and 1.6.
DEFINITION 1.4 (PREDICATE ABSTRACT OF L(C))
Let <f? be a formula of L(C) and a1, ... , an be a sequence of distinct variables of
types h, ... , tn respectively. (.Aa1, ... , an.<P) is a predicate abstract of
L( C). Its type is (t1, ... , tn), and its free variable occurrences are the
free variable occurrences in the formula~' except for occurrences of the
variables a1, . . . , an.
DEFINITION 1.5 (TERM OF L(C)) Terms of each type are characterized as follows.
1 A constant symbol of L(C) or variable is a term of L(C). If it is a

constant symbol, it has no free variable occurrences. If it is a variable,
it has one free variable occurrence, itself.
2 A predicate abstract of L( C) is a term of L( C). Its free variable
occurrences were defined above.
T is used, with and without subscripts, to stand for terms.
DEFINITION 1. 6 (FORMULA OF L( C)) The notion of formula is given
as follows.
1 If T is a term of type (t1, ... , tn), and TI, ... , Tn is a sequence of

terms of types t1, ... , tn respectively, then r( TI, ... , Tn) is a formula
(atomic) of L( C). The free variable occurrences in it are the free
variable occurrences of r, n, ... , Tn
2
If~
...,~
is a formula of L( C) so is
are those of<>.
...,~.
The free variable occurrences of
and w are formulas of L(C) so is (~ 1\ w). The free variable

occurrences of (~ 1\ w) are those of~ together with those of w.
If~
If~
is a formula of L( C) and a is a variable then (\Ia)~ is a formula

of L(C). The free variable occurrences of('v'a)~ are those of~, except
for occurrences of a.
EXAMPLE 1. 7 Suppose a(o,o} is a variable of type (0, 0) (and so firstorder), (3 is a variable of type 0, and 'Y((O,O},O} is a variable of type
((0,0),0) (second-order). Both (3 and 'Y((O,O},o} are terms. Then the
expression 'Y( (o,o} ,o} (a (O,O}, (3) is an atomic formula. Generally I will
write the simpler looking 'Y( a, (3), and give the information contained
in the superscripts in a separate description. Since this atomic formula
contains a variable 'Y of order 2, it is referred to as a second-order atomic
formula.
DEFINITION 1.8 (SENTENCE) A formula with no free variables is a sentence.
One can think of V, ::=>,:=,and 3 as defined symbols, with their usual

definitions. But sometimes it is convenient to take them as primitive-!
do whatever is most useful at the time. Also square and curly parentheses are used, as well as the official round ones, to aid readability.
And finally, I write the equality symbol in. infix position, following standard convention. Thus, for example, I write (a/ =(t,t) f3t) in place of
=(t,t) ( 0 t, f3t).
Several examples involving just first and second-order notions will be

considered, so a few special alphabets are introduced informally, to make
reading the examples a little easier.
Order
0
1
Constants
Variables
a, b, c, ...
A,B,C, ...
x, y, z, ...
A,B,C, ...
X,Y,Z, ...
X, Y,Z, ...
ExAMPLE 1.9 For this example I give explicit type information (in superscripts), until the end of the example. After this I omit the superscripts, and say in English what is needed to restore them.
Suppose x 0 , X(O), and X((O)) are variables (the first is of order 0, the
second is of order 1, and the third is of order 2). Also suppose p((O)) and
g0 are constant symbols of L(C) (the first is of order 2 and the second
is of order 0).
1 Both X((O))(X( 0)) and X( 0)(x 0 ) are atomic formulas. All variables
present have free occurrences.
2 (>..X((o)).X((O))(X( 0 ))) is a predicate abstract, of type (((0))). Only
the occurrence of X(O) is free.
3 SinceP((O)) isoftype ((0)), (>..X((O)).X((O))(X( 0)))(P((O))) is a formula.
Only X(O) is free.
4 [(>..X((O)) .X((O))(X(0)))(P((O)))::) X( 0)(x 0 )] is a formula. The only free
variable occurrences are those of X( 0) and x 0 .
5 (VX( 0))[(>..X((O)).X((O))(X(0)))(P((O))) : => X( 0)(x0 )] is a formula. The
only free variable occurrence is that of x 0 .
6 (>..x 0 .(\fX(0))[(>..X((O)).X((O))(X(0)))(P((O))) : => X( 0)(x0 )]) is a predicate abstract. It has no free variable occurrences, and is of type (0).
The type machinery is needed to guarantee that what is written is wellformed. Now that the exercise above has been gone through, I will
display the predicate abstract without superscripts, as
(>..x.('v'X)[(>..X.X(X))(P) : => X(x)]),
leaving types to be inferred, or explained in words, as necessary.

In first-order logic, facts about formulas and terms are often proved
by induction based on complexity. And complexity for a formula is often
measured by the number of logical connectives and quantifiers, or what
amounts to the same thing, by how "far away" the formula is from being
atomic. In a higher-order setting these notions diverge.
1.10 (DEGREE) By the degree of a formula or term is
meant the number of propositional connectives, quantifiers, and lambdasymbols it contains.
DEFINITION
Note that since an atomic formula can involve terms containing predicate abstracts which, in turn, involve other formulas, the degree of an
atomic formula need not be 0, as in the first-order case.
2.
Substitutions
Formulas can contain free variables, and terms that are very complex
can be substituted for them. The notion of substitution is a fundamental
one, and this section is devoted to it. In a general way, I follow the
treatment in [Fit96].
1.11 (SUBSTITUTION) A substitution is a mapping from
the set of variables to the set of terms of L( C) such that variables of
type t map to terms of type t.
DEFINITION
I generally denote substitutions by u, with and without subscripts.

Also I generally write xu rather than u(x). Most concern is with substitutions having finite support, that is, they are the identity on all but a
finite number of variables. A special notation is used for the finite support substitution that maps each O:i to Ti and is the identity otherwise:
{o:l/r1, ... , O:n/Tn}
The action of substitutions on variables is readily extended to terms
and formulas generally.
1.12 For a substitution u, by Ua 1 , ... ,an is meant the substitution that is like u except that it is the identity on 0:1, . . . , O:n.
DEFINITION
1.13 Let u be a substitution. The action of u is extended

recursively as follows.
DEFINITION
1 Au
=A
for a constant symbol A.
2 (.Ao:1, .. , O:n.)u = (.Ao:1, .. , O:n.Ua1, ... ,an)
3 [7(71, ... , 7n)]u = 70"(710", ... , 7n0").
4 [<P]u = [<Pu].
5 (.,6.')'(0)(,6)))]

and let u be any substitution such that 'Y(o) u = 7(o). I compute <Pu.
For convenience I omit type-indicating superscripts, but even so, the
notion is a bit much. Sorry.
(3a) [a( (>.,6. 1(,6))) ]u = (3a) [a( (>.,6. 1(,6))) ]ua
= (3a)[aua( (>.,6.')'(,6))ua)]
= (3a)[a( (>.,6.')'(,6))ua)]
= (3a)[a( (>.,6.['Y(,6)]ua,{J) )]
= (3a)[a( (>.,6.(!'ua,{J)(,6ua,{J)) )]
= (3a)[a( (>.,6.7(,6)) )]
The connection between substitutions and free variable occurrences is
simple: it is only the free occurrences that can be changed by substitutions. I leave the proof to you as an exercise.
PROPOSITION
1.15 Let 0"1 and 0"2 be substitutions.
1 If u1 and u2 agree on the free variables of the term 7 then 70"1
= 70"2.
2 If 0"1 and u2 agree on the free variables of the formula <P then <Pu1 =
<Pu2.
Not all substitutions are appropriate in all settings; some do not properly respect the role of bound variables, in the sense that they may replace a free occurrence of a variable in a formula with another variable
that is "captured" by a quantifier or predicate abstract of the formula.
The substitutions that are acceptable are called free substitutions. These
play a significant role throughout what follows.
1.16 (FREE SUBSTITUTION)
The following characterizes when a substitution u is free for a formula or term.
DEFINITION
1 u is free for a variable or constant.

2
is free for (>.a1, ... , an.<P) if O"a1, ... ,an is free for <P, and if ,6 is
any free variable of (>.a1, ... , an.<P) then ,6u does not contain any of
a1, ... , an free.
O"
10
3 a is free for ,q, if a is free for <P.
4a
5
is free for (<P 1\ 'l1) if a is free for <P and a is free for 'l1.
a is free for (Ya)<P if CJ01 is free for <P, and if f3 is a free variable of
(Ya)<P then f3a does not contain a free.
With the action of substitutions extended to all terms, composition

of substitutions is easily defined.
1.17 (SUBSTITUTION COMPOSITION)

Let a 1 and a 2 be
substitutions. Their composition is the mapping defined by: a(aw2) =
(aa1)a2, for variables a.
DEFINITION
It is not generally the case that T(a1a2) = (Ta1)a2, for terms T, and
similarly for formulas. But it is when appropriate freeness conditions
are imposed.
1.18 Substitution is
cumstances.
THEOREM
<~compositional"
under the following cir-
1 If a1 is free for the formula <P, and a2 is free for the formula <Pa1,
then (<Pa1)a2 = <P(aw2).
2 If a1 is free for the term
(Ta1)a2
T,
and a2 is free for the term
TCJI,
then
= T(a1a2).
The proof of this is essentially the same as in the first-order setting.

Rather than giving it here, I refer you to the proof of Theorem 5.2.13 in
[Fit96].
Exercises
EXERCISE 2.1 Prove Proposition 1.15 by induction on degree. Conclude
that if <P is a sentence then <Pa = <P for every substitution a.
Chapter 2
CLASSICAL LOGIC-SEMANTICS
1.
Classical Models
Defining the semantics of any higher-order logic is relatively complicated. Since modalities add special complexities, it is fortunate I can
discuss underlying classical issues before bringing them into the picture.
In this Chapter the "real" notion of higher-order model is defined first,
and truth in them is characterized. Then Henkin's modification of these
models is considered-sometimes these are called general models-as
well as a non-extensional version of them.
I don't want just syntactic objects, terms, to have types. I want
sets and relations to have them too. After all, we think of terms as
designating sets and relations, and we want type information to move
back and forth between syntactic object and its designation.
2.1 (RELATION TYPES) Let 8 be a non-empty set.

each type t the collection [t, S] is defined as follows.
DEFINITION
1 [0,8] =
For
s.
2 [ (t1, ... , tn), S] is the collection of all subsets of [t1, S] X x [tn, S].
0 is an object of type t over S if 0 E [t, S]. 0 is systematically used,

with or without subscripts, to stand for objects in this sense.
For example, a member of [ (0, 0), S] is a subset of S x S, and in
standard first-order logic it would simply be called a two-place relation
on S. But now relations of relations are allowed, and even more complex
things as well, so terminology gets more complicated.
A classical model consists of an underlying domain, thought of as the
"ground level objects," and an interpretation, assigning some denota11
12
tion in the model to each constant symbol of the language. But that
denotation must be consistent with type information.
DEFINITION 2.2 (CLASSICAL MODEL) A higher-order classical model
for L(C) is a structure M = (D,I), where D is a non-empty set called
the domain of the model, and I is a mapping, the interpretation, meeting
the following conditions.
1 If A is a constant symbol of L(C) of type t, I(A) E [t, D].
2 If = is the equality constant symbol of type (t, t) then I(=) is the
equality relation on [t, D].
2.
Truth in a Model
Assume M = (D,I) is a classical model for a language L(C). It is

time to say which sentences of the language, or more generally, which
formulas with free variables, are true in M. This is symbolized by M lf-v
<P. Informally it can be read: the formula <Pis true in the model M, with
respect to the valuation v which assigns meanings to free variables. But
as will be seen, to properly define this one must also assign denotations
to all terms. The denotation of a term of type t will be an object of
type t over D. And this can not be done first, independently. The
assignment of denotations to terms, and the determination of formula
truth constitutes a mutually recursive pair of definitions, just as was the
case for the syntactic notions of term and formula in Section 1. Still, it
is all rather straightforward.
DEFINITION 2.3 (VALUATION) The mapping v is a valuation in the
classical model M = (D,I) if v assigns to each variable o/ of type t
some object of type t, that is, v((i) E [t, D].
DEFINITION 2.4 (VARIANT) A valuation w is an o:-variant of a valuation v if v and w agree on all variables except possibly o:. More generally,
w is an 0:1, ... , O:n-variant if v and w agree on all variables except possibly 0:1, ... , O:n
Now, the following two definitions constitute a single recursive characterization.
DEFINITION 2.5 (DENOTATION OF A TERM)
Let M = (D,I) be a
classical model, and let v be a valuation in it. A mapping is defined,
(v *I), assigning to each term of L( C) a denotation for that term.
1 If A is a constant symbol of L(C) then (v
* I)(A) =I( A).
13
2 Ifa is a variable then (v*I)(a) =v(a).

3 If (.Aa1, ... ,an.q,) is a predicate abstract of L(C) of type t, then
(v *I)( (.Aa1, ... , an.q,)) is the following member of [t, V]:
{(w(a1), ... , w(an)) Jw is an a1, ... , an variant of v

and M if-w q,}
2.6 (TRUTH OF A FORMULA) Again let M = (V,I) be a
classical model, and let v be a valuation in it. The notion of formula q,
of L(C) being true in model M with respect to v, denoted M if-v q,, is
characterized as follows.
DEFINITION
1 For terms T, T1, ... ,Tn, M if-v T(T1, ... ,Tn) provided
((v * I) (T1) , .. . , (v * I) (Tn)) E (v * I) (T) .
2 M if-v --,q, if it is not the case that M if-v q,,

3M if-v q,
4M
1\
'lt if M if-v q, and M if-v 'lt.
if-v (Va)q, if M if-v' q, for every a-variant v' of v.
There is an alternative notation that makes evaluating the truth of

formulas in models somewhat easier.
2. 7 (SPECIAL NOTATION) Suppose v is a valuation, and w

is the a1, ... , an variant ofv such that w(al) = 01, ... , w(an) =On.
Then, if M if-w q, this may be symbolized by
DEFINITION
Now part 3 of Definition 2.5 can be restated as follows.

3 (v*I)((.Aa1, ... ,an,q,)) =
{(01, ... , On) J M if-v q,[al/01, ... , an/On]}
Likewise part 4 of Definition 2.6 becomes
4 M if-v (Va)q, if M if-v q,[a/0] for every object 0 of the same type as
a.
Defined symbols like~ and 3 have their expected behavior, which are
explicitly stated below. Alternately, this can be considered an extension
of the definition above.
5 M if-v q, V 'lt if M if-v q, or M if-v 'lt.
6 M if-v q,
'lt if M if-v q, implies M if-v 'lt.
14
7 M lf--v = W if M lf--v iff M lf--v W.

8 M lf--v (3a) for some a-variant v' of v; equivalently if
M lf--v <P[a/0] for some object 0 of the same type as a.
As in first-order logic, if has no free variables, M lf--v holds for
some v if and only if it holds for every v. Thus for sentences (closed
formulas), truth in a model does not depend on a choice of valuation.
2.8 (VALIDITY, SATISFIABILITY, CONSEQUENCE)
be a formula and S be a set of formulas.
DEFINITION
Let <l>
1 is valid if M lf--v for every classical model M and valuation v.
2 S is satisfiable if there is some model M and some valuation v such
that M If-v is a consequence of S provided, for every model M and every
valuation v, if M lf--v .
The definitions above are of some complexity. Here is an example to
help clarify their workings.
2.9 This example shows a formula that is valid and involves
equality. In it, cis a constant symbol of type 0.
The expression (AX.(:lx)X(x)) is a predicate abstract of type ((0)),
where X is of type (0) and x is of type 0. Intuitively it is the "being
instantiated" predicate. Likewise the expression (>.x.x = c) is a predicate
abstract of type (0), where x and care of type 0. Intuitively this is the
"being c" predicate. Since this predicate is, in fact, instantiated (by
whatever c designates), the fir:;;t predicate abstract correctly applies to
it. That is, one should have the validity of the following.
EXAMPLE
(>.X.(3x)X(x))((>.x.x =c))
(2.1)
I now verify this validity. Suppose there is a model M = (V, I). I show
the formula is true in M with respect to an arbitrary valuation v. To do
this, I investigate the behavior, in M, of parts of the formula, building
up to the whole thing.
First, recalling that the interpretation of an equality symbol is by the
equality relation of the appropriate type, we have the following.
(v *I)((>.x.x =c))= {o I M lf--v (x = c)[x/o]}
= {o I o =I(c)}
= {I(c)}
15
We also have the following.
(v *I)((.AX.(3x)X(x))) = {0 I M 11-v (3x)X(x)[Xj0]}

= {0 I M 11-v X(x)[X/O,xjo] for some o}
= { 0 I o E 0 for some o}
= {o I o # 0}
Now we have (2.1) because
M 11-v (.AX.(3x)X(x))((.Ax.x =c)):}

(v *I)((.Ax.x =c)) E (v *I)((.AX.(3x)X(x))) :} {I(c)}
E {0
I 0 # 0}.
You might try verifying, in a similar way, the validity of the following .
(.AX.(3x)X(x))((.Ax.(x = x)))
3.
Problems
First-order classical logic has many nice features that do not carry
over to higher-order versions. This is well-known, and partly accounts
for the general emphasis on first-order. I sketch a few of the higher-order
problems here.
3.1
Compactness
The compactness theorem for first-order logic says a set of formulas is satisfiable if every finite subset is. This is a fundamental tool
for the construction of models of various kinds-non-standard models
of analysis, for instance. The higher-order analog does not hold, and
counter-examples are easy to come by. Here is one.
The Dedekind characterization of infinity is: a set is infinite if it can be
put into a 1-1 correspondence with a proper subset. Consequently, a set
is finite if any 1-1 mapping from it to itself can not be to a proper subset,
i.e. must be onto. This can be said easily, as a second-order formula.
Since function symbols are not available, I make do with relation symbols
in the usual way-the following formula is true in a model if and only if
the domain of the model is finite.
(\fX)[(function(X)
1\
one-one(X)) :J onto(X)]
In (2.2) the following abbreviations are used.

function(X)
one-one(X)
onto(X)
for
for
for
(\fx)(3y)(\fz)[X(x, z) = (z = y)]
(\fx)(\fy)(\fz){[X(x, z) 1\ X(y, z)] :J (x = y)}
(\fy)(3x)X(x, y)
(2.2)
16
Also, define the following infinite list of formulas, where x

ates (x = y).
A2
A3
ol y
abbrevi-
= (:3xl)(:Jx2)[xl ol x2]
=
(:Jx1)(:Jx2)(:lx3)[(x1 ol x2) 1\ (x1 ol x3) 1\ (x2 ol x3)]
So An is true in a model if and only if the domain of the model contains

at least n members.
Now, the set consisting of (2.2) and all of A2, A3, ... , is certainly
not satisfiable, but every finite subset is, so compactness fails. (In firstorder classical logic this example turns around, and shows finiteness has
no first-order characterization.)
3.2
Strong Completeness
A proof procedure is said to be (sound and) strongly complete if <.!.>

has a derivation from a set S exactly when <.!.> is a logical consequence
of S. Classical first-order logic has many proof procedures that are
strongly complete for it, but there is no such proof procedure for higherorder logic. To see this, one doesn't need an exact definition of proof
procedure-it is enough that proofs be finite objects.
Let S be the set of formulas defined in Section 3.1, a set that is not
satisfiable though every finite subset is. And let j_ be <.!.> 1\ <.!.>, for some
formula <.!.>. The formula j_ is a logical consequence of S, since it is true in
every model in which the members of S are true, namely none. If there
were a strongly complete proof procedure, j_ would have a derivation
from S. That derivation, being a finite object, could only use a finite
subset of S, say So. Then j_ would be a logical consequence of So, and so
So could not be satisfiable (otherwise there would be a model in which
j_ was true). But every finite subset of S is satisfiable. Conclusion: no
strongly complete proof procedure can exist for higher-order classical
logic.
3.3
Weak Completeness
A proof procedure is (sound and) weakly complete if it proves exactly

the valid formulas. A strongly complete proof procedure is automatically
weakly complete (just use the empty set of premises). Higher-order
classical logic does not even possess a weakly complete proof procedure.
To show this the Incompleteness Theorem can be used.
The idea is to write a single formula that characterizes the natural
numbers-a second-order formula will do. One needs a constant symbol
17
of type 0 to represent the number 0 and, to thoroughly overload notation,

I use 0 for this. Also a successor function is needed, but since we do not
have function symbols in this language, it is simulated with a relation
symbol S, technically a constant symbol of type (0, 0). In addition to
the abbreviations of Section 3.1, the following is needed.
0-exclude(S)
(Vx)-.S(x, 0)
for
inductive-set(P, S) for P(O) 1\ (Vx)[P(x) :J (3y)(S(x, y) 1\ P(y))]
induction(S)
for
(VP)[inductive-set(P, S) :J (Vx)P(x)]
Now, let integer(S) be the formula
function(S)
1\
one-one(S)
1\
0-exclude(S)
1\
induction(S)
It is not hard to show that integer(S) is true in a model (V,I) if and

only if the domain Vis (isomorphic to) the natural numbers, with I(S)
as successor. Consequently for any sentence <P of arithmetic, <P is true
of the natural numbers if and only if integer( B) :J <P is valid.
It is a standard requirement that the set of (Godel numbers of) theorems of a proof procedure must be recursively enumerable, so if there
were a weakly complete proof procedure for higher-order classical logic,
the set of valid formulas would be recursively enumerable. The recursive
enumerability of the following set would then be an easy consequence:
the set of sentences <P such that integer(S) :J <P is valid. But, as noted
above, this is just the set of true sentences of arithmetic, and this is
not a recursively enumerable set. Conclusion: no weakly complete proof
procedure can exist for higher-order classical logic.
3.4
And Worse
I have been discussing higher-order classical logic, particularly its

models, using conventional informal mathematics of the sort that every mathematician applies in papers and books. But certain areas of
mathematics-certainly formal logic is among them-are close to foundational issues, and one needs to be careful. It is generally understood
that informal mathematics can be formalized in set theory, and this is
commonly taken to be Zermelo-Fraenkel set theory, or a variant of it.
Let us suppose, for the time being, that the development so far has been
within such a framework.
One of the famous problems associated with set theory is Cantor's
continuum hypothesis. It is the statement that there are no sets intermediate in size between a countable set and its powerset. A little more
formally, it says:
18

Let X be a set, and let P(X) be its powerset. If X is countable, then any
infinite subset Y of P(X) either is in a 1-1 correspondence with X, or is in a
1-1 correspondence with P(X).
(The generalized continuum hypothesis is the natural extension of this

to uncountable infinite sets as well, but the simple continuum hypothesis
will do for present purposes.) Now, a difficulty for set theory is this: the
continuum hypothesis has been proved to be undecidable on the basis of
the generally accepted axioms for Zermelo-Fraenkel set theory. That is
(assuming the axioms for set theory are consistent) there is a model of
the Zermelo-Fraenkel axioms in which the continuum hypothesis is true,
and there is another in which it is false.
The problem for us is that the continuum hypothesis can be stated
as a sentence of higher-order classical logic. I briefly sketch how. First,
one can say the domain of a model is countable by saying there is a
relation that orders it isomorphically to the natural numbers. Using a
formula from Section 3.3, the following will do: (3a(O,O))integer(a(O,O)).
Next, one can identify a subset of the domain with an object of type
(0). Then the collection of all subsets of the domain is an object of type
( (0) ), so the following says there is a powerset for the domain of a model:
(3 ,6( (o))) (v1 (o) ),B( (o)) (1 (o)).
Having shown how to start, I leave the rest of the details to you. Write
a sentence saying: if the domain is countable then there is a powerset
for the domain and, for every infinite subset of that powerset, either
there is a 1-1 correspondence between it and the domain, or there is
a 1-1 correspondence between it and the powerset. You can say a set
is infinite using the negation of a formula from Section 3.1. And the
existence of a 1-1 correspondence amounts to the existence of a binary
relation meeting certain appropriate conditions. Let us call the sentence
that is the higher-order formalization of the continuum hypothesis CH.
Now, the real problem is: is the sentence CH valid or not? There are
the following not very palatable options.
1 Assume the foundation for informal mathematics is Zermelo-Fraenkel
set theory, formulated axiomatically. In this case neither CH nor its
negation can be shown to be valid, since the continuum hypothesis is
consistent with, but independent of, the Zermelo-Fraenkel axioms.
2 Assume that informal mathematics is being done in some particular
model for the Zermelo-Fraenkel axioms. In this case, CH is definitely
valid, or its negation is, but it depends on which Zermelo-Fraenkel
model is being considered.
19
3 Assume that higher-order classical logic itself supplies the theoretical

foundations for mathematics. In this case CH either is valid or its
negation is, but which is it?
I have reached perhaps the most basic difficulty of all with classical
higher-order logic. Not only is there no proof procedure that will allow
us to prove every valid formula, the very status of validity for some
important formulas is unclear.
4.
Henkin Models
As we saw in the previous section, higher-order classical logic is difficult to work with. Indeed, difficulties already appear at the second-order
level. Not only does it lack a complete proof procedure, but the very
notion of validity touches on profound foundational issues. Nonetheless,
there are several sound proof procedures for the logic-any formula that
has a proof must be valid, though not every valid formula will have a
proof. So, there are certainly fragments of higher-order logic that we
can hope to make use of.
In a sense, too many formulas of higher-order classical logic are valid,
so no proof procedure can be adequate to prove them all. Henkin broadened the notion of higher-order model [Hen50] in a natural way, which
will be described shortly. With this broader notion there are more
models, hence fewer valid formulas, since there are more candidates for
counter-models. Henkin called his extension of the semantics general
models-! will call them Henkin models.
Henkin's idea seems straightforward, after years of getting used to
it. Given a domain V, a universal quantifier whose variable is of type
0, (Vx), ranges over the members of V. If we have a universal quantifier, (VX), whose variable is of type (0), it ranges over the collection of
properties of V, or equivalently, over the subsets of V. The problem of
just what subsets an infinite set has is actually a deep one. The independence of Cantor's continuum hypothesis is one manifestation of this
problem. Methods for establishing consistency and independence results
in set theory can be used to produce models with considerable variation
in the powerset of an infinite set. Henkin essentially said that, instead
of trying to work with all subsets of V, we should work with enough of
them, that is, we should take (VX) as ranging over some collection of
subsets of V, not necessarily all of them, but containing enough to satisfy
natural closure properties. Think of the collection as being intermediate
between all subsets and all definable subsets.
In a higher-order model as defined earlier, there is a domain, V, and
this determines the range of quantification for each type. Specifically,
20
we thought of a quantifier (Vo:t) as ranging over the members of [t, V].

This time around a function is introduced, which I call a Henkin domain function and denote by 'It, explicitly giving us the range for each
quantifier type. Then Henkin frames are defined. This basic machinery
is needed before it can be specified what it means to have enough sets
available at each type.
DEFINITION 2.10 (HENKIN DOMAIN FUNCTION) 1t is a Henkin domain function if 1t is a function whose domain is the collection of types
and, for each type (t1, ... , tn), 'It( (t1, ... ,tn)) is some non-empty collection of subsets of'Jt(ti) x x 1t(tn)
Sets of the form 1t(t) are called Henkin domains. The key point
is allowing some of the subsets of 1t(t1) x x 7t(tn)-the definition
of [t, V] had the word all at the corresponding point. Obviously the
function 1t(t) = [t, V] is a Henkin domain function. In fact, if 1t is
any Henkin domain function, and 7t(O) = V, then for every type t,
1t(t) ~ [t, V], with equality holding at t = 0.
DEFINITION 2.11 (HENKIN FRAME) The structure M = (7t,I) is a
Henkin frame for a language L( C) if it meets the following conditions.
1 1t is a Henkin domain function.
2 If A is a constant symbol of L(C) of type t, I(A) E 7t(t).

3 I(=(t,t}) is the equality relation on 1t(t) for each type t.
The notion of valuation must be suitably restricted, of course.

DEFINITION 2.12 (VALUATION) V is a valuation in a Henkin frame
M = (7t,I) if v maps each variable of type t to some member of 1t(t).
Now, what will make a Henkin frame into a Henkin model? Let's try
a first attempt at a characterization. (This is not the "official" one, however. That will come later.) Definition 2.5, for the meaning of a term,
carries over almost word for word to a Henkin frame M. Also Definition 2.6, for truth in a model, carries over to M, with one restrictive
change. Item 4, the universal quantifier condition, gets replaced with
the following.
4'. Let M = ('It, I) be a Henkin frame and let o:t be a variable of type t.
M lf-v (Vo:t) if M lf-v [o:t ;ot] for every ot E 1t(t), or equivalently,
if M lf-v' <P for every at-variant v' of v such that v'(o:t)
7t(t).
The revised version of item 4 above says that quantifiers of type t range
over just 1t(t) and not over all objects of type t.
21
But there is a fundamental problem. Let M = (1t, I) be a Henkin

frame, and suppose (.Xa1, ... , an.~) is a predicate abstract-to keep
things simple for now, assume ~ itself contains no abstracts. Then
for any valuation v, the characterization above determines whether or
not M 11-v ~. Now, according to Definition 2.5, the meaning (v *
I)((.Xa1, ... ,an.~)), to be assigned to the abstract, is {(01, ... ,On) I
M 11-v ~[ai/01, ... , an/On]}. The trouble is, we have no guarantee that
this set will be a member of the appropriate Henkin domain. If it is not
a member, quantifiers cannot include it in their ranges. If this happens,
we lose the validity of formulas like (Va) \]! (a) :::> \]! ( ( .Xa1, .. . , an.~)).
The whole business becomes somewhat problematic since formulas like
this clearly ought to be valid.
What must be done is impose enough closure conditions on the Henkin
domains of a Henkin frame to ensure that predicate abstracts always designate objects that are present in the Henkin domains. There are several
ways this can be done. Algebraic closure conditions can be formulated
directly, though this takes some effort. I follow a different route that is
somewhat easier. Essentially, I first allow predicate abstracts to designate members of Henkin domains in some arbitrary way, then. I add the
requirement that they be the "right" members.
DEFINITION 2.13 (ABSTRACTION DESIGNATION FUNCTION)
A is an
abstraction designation function in the Henkin frame M = (1t, I) with
respect to the language L (C) if, for each valuation v in M, and each
type t predicate abstract (.Xa1, ... , an. <I?) of L(C), A(v, (.Xa1, ... , an.<P))
is some member of1t(t).
Think of an abstraction designation function as providing a "meaning"

for each predicate abstract. For the time being, such meanings can
be quite arbitrary, except that they must be members of appropriate
Henkin domains. Now earlier definitions get modified in straightforward
ways (and these are the "official" versions). Definition 2.5 becomes the
following.
2.14 (DENOTATION OF A TERM IN A HENKIN FRAME)
Let M = (1t,I) be a Henkin frame, let v be a valuation, and let A be
an abstraction designation function. A mapping, (v *I* A), is defined
assigning to each term of L( C) a denotation for that term.
DEFINITION
1 If A is a constant symbol of L(C) then (v *I* A)(A) = I(A).

2 If a is a variable then (v *I* A)(a) = v(a).
3 If (.Xa1, ... , an.~) is a predicate abstract of L(C), then
(v*I*A)((.Xa1, ...
,an.~))
=A(v,(.Xa1, ...
,an.~)).
22
And Definition 2.6 becomes the following.

2.15 (TRUTH OF A FORMULA IN A HENKIN FRAME)
Let M = (H,I) be a Henkin frame, let v be a valuation, and A be an
abstraction designation function. A formula <1> of L( C) is true in model
M with respect to v and A, denoted M If-v,A <1>, if the following holds.
DEFINITION
1 For terms T, T!, ... ,Tn, M lf-v,A T(TI, ... ,Tn) provided
((v *I* A)(TI), ... , (v *I* A)(Tn)) E (v *I* A)(T).
2 M lf-v,A --,q> if it is not the case that M lf-v,A <1>.
3M lf-v,A
4M
<1> 1\ \]i
if M lf-v,A
<1>
and M lf-v,A W.
lf-v,A ('v'at)<P if M lf-v,A <P[at /0] for every 0 E 1t(t).
Now we can impose a requirement that designations of predicate abstracts be "correct."

2.16 (PROPER ABSTRACTION DESIGNATION FUNCTION)
Let M = (1t, I) be a Henkin frame and let A be an abstraction designation function in it, with respect to L( C). A is proper provided the
following is the case. For each predicate abstract (Aal, ... , an.<P) (with
ai of type ti) and for each valuation v we have
DEFINITION
(v *I* A)( (Aal, ... , an.<P)) =

{ (01, ... , On) E 1t(t1) X X 1t(tn) J M if-v,A <P[ai/01, ... , an/On]}.
2.17 (HENKIN MODEL) Let M be a Henkin frame, and let
A be an abstraction designation function in M. If A is proper, (M, A)
is a Henkin model.
DEFINITION
For a given Henkin frame M it may be the case that no proper abstraction designation function exists. But, if one does exist it must be
unique.
2.18 Let M = (1t,I) be a Henkin frame and let both A
and A' be proper abstraction designation functions, with respect to L( C).
Then A= A'.
PROPOSITION
Proof The following two items are shown simultaneously, by induction

on degree (Definition 1.10). From this the Proposition follows immediately.
M lf-v,A
<1>
(v*I*A)(T)
M lf-v,A'
<1>
= (v*I*A')(T)
(2.3)
(2.4)
23
Suppose (2.3) and (2.4) are known for formulas and terms whose degree is < k. It will be shown they hold for degree k too, beginning with
(2.4).
Suppose T is a term of degree k. Since k could be 0, T could be a
constant symbol or a variable. If it is a constant symbol, (v *I* A) (T) =
I( T) = (v *I * A') (T). Similarly if T is a variable. Finally, T could be a
predicate abstract, (>.a1, ... , an.), in which case must be a formula
of degree < k, so using the induction hypothesis with (2.3) we have
(v *I* A)( (>.a~, ... , an.)) =

{(01, ... , On) I M 11-v,A [ai/01, ... , an/On]}=
{ (0~, ... , On) I M 11-v,A' [ai/01, ... , an/On]}=
(v*I*A')((>.a1, ,an.))
Thus (2.4) holds for terms of degree ~ k.
Now assume is a formula of degree k. There are several cases,
depending on the form of .
If is atomic, it is T( T1, ... , Tn) where T, T1, ... , Tn are all of degree ~
k. Since (2.4) holds for terms of degree< k by assumption, and for terms
of degree = k by the proof above,
M 11-v,A T(T1, ... , Tn) {:}
((v *I* A)(T1), ... , (v *I* A)(Tn)) E (v *I* A)(T) {:}

((v*I*A')(T1), ... ,(v*I*A')(Tn)) E (v*I*A')(T) {:}
M 11-v,A' T(T1, ... , Tn)
If is a negation, conjunction, or universally quantified formula, the
result follows easily using the fact that (2.3) holds for its subformulas
(which are of lower degree), by the induction hypothesis.
We thus have (2.3) for formulas of degree k, and this concludes the
induction.
Note on Induction Proofs The pattern of the induction proof above

will recur many times, with little variation of structure. We go from
terms and formulas of degrees < k to terms of degrees ~ k, and then to
formulas of degrees ~ k.
The Proposition above allows us to give the following extension of
Definition 2.17.
DEFINITION 2.19 (HENKIN MODEL) If (M,A) is a Henkin model, the
proper abstraction designation function A is uniquely determined, so we
24
will say the Henkin frame M itself is a Henkin model, and write M lf-v <P
forM lf-v,A <P.
Suppose (V, I) is some classical model, as defined in Section 1. Set

= [t, V] for all types t. This gives us a Henkin domain function.
And it is easy to see that (H, I) will be a Henkin model. In fact, a
sentence <P is true in (H, I), as defined in this section, exactly when it
is true in the classical model (V, I), as defined in Section 2. This says
that "true" higher-order models are among the Henkin models. The
real question is, are there any other Henkin models? The answer is, yes.
The proof of the completeness theorem for tableaus will yield this as a
byproduct.
H(t)
DEFINITION
2.20 (STANDARD MODEL) A Henkin model M

= [t, V] for all types t.
(H,I)
is a standard model if1i(t)
Since standard models are among the Henkin models, any formula
that is true in all Henkin models must be true in all standard models
as well. But there is the possibility (a fact, as it happens) that there
are formulas true in all standard models that are not true in all Henkin
models. That is, the set of Henkin-valid formulas (Definition 2.29) is a
subset of the set of valid formulas (Definition 2.8), and in fact turns out
to be a proper subset. By decreasing the set of validities, it opens up the
possibility (again a fact, as it happens) that there may be a complete
proof procedure with respect to this more restricted version of validity.
5.
Generalized Henkin Models
Unlike standard higher-order models, Henkin models are allowed to

have some, but not necessarily all, of the relations permissible in principle at each type. This means there are more possibilities for Henkin
models than for standard models. Even so, the objects in the domains of
Henkin models are sets, and this imposes a restriction that we may want
to avoid in certain circumstances. Sets are extensional objects-that is,
a set is completely determined by its membership. Using the language
of properties rather than sets, two extensional properties that apply to
exactly the same things must be identical, and hence must have the same
properties applying to them. Working with sets is sufficient for mathematics, but it is not always the right choice in every situation. Even
if the terms "human being" and "featherless biped" happen to have the
same extension, we might not wish to identify them. As another example, the properties of being the morning star and being the evening star
have the same extension, but were thought of as distinct properties by
the ancient Babylonians.
25
Henkin himself [Hen50] noted the possibility of a more general notion

than what I am calling a Henkin model, "The axioms of extensionality
can be dropped if we are willing to admit models whose domains contain
functions which are regarded as d!stinct even though they have the same
value for every argument." Even so, extensionality has commonly been
built into the treatment of Henkin models in the literature-[And72]
is one of the rare instances where a model without extensionality is
constructed. As it happens, we will have need for a non-extensional
version in carrying out the completeness proof for tableaus. Since such
models are also of intrinsic interest, they are presented in some detail in
this section.
For Henkin frames, simply specifying the members of the Henkin domains tells us much. Since they are sets, there is a notion of membership,
and it can be used in the definition of truth for atomic formulas. That is,
sets come with their extensions fully determined. If we move away from
sets this machinery becomes unavailable, and we must fill the gap with
something else-I make use of an explicit extension function, denoted E.
That is, for an arbitrary object 0, E(O) gives us the extension of 0. I
also allow the possibility that equality may not behave as expected-!
allow for non-normal frames and models.
2.21 (GENERALIZED HENKIN FRAME) M = (1-l,I,E) is
called a generalized Henkin frame for a language L( C) if it meets the
following conditions.
DEFINITION
1 1t is a function whose domain is the collection of types.

2 For each type t, 1-l(t) is some non-empty collection of objects (not
necessarily sets).
3 If A is a constant symbol of L(C) of type t, I(A) E 1-l(t).
4 For each type t
(h, ... , tn), E maps 1-l(t) to subsets of 1-l(tl) x
X1t(tn)
In addition, M is normal ifE(I(=(t,t))) is the equality relation on 1-l(t)
for each type t.
Much of this definition is similar to that of Henkin frame. The members of 1-l(t) are the objects of type t (which now need not be sets). The
new item is the mapping E. Think of E(O) as the extension of the object
0.
Generalized Henkin models are built out of generalized Henkin frames.
Much of the machinery is almost identical with that for Henkin models,
26
but there are curious twists, so things are presented in detail, rather
than just referring to earlier definitions. The definition of valuation is
the same as before.
DEFINITION 2.22 (VALUATION) The function vis a valuation in a generalized Henkin frame M = ('H, I,) if v maps each variable of type t
to some member of1i(t).
Next, just as with Henkin models, a function is needed that provides
designations for predicate abstracts, then later we can require that it
give us the "right" values. The wording is the same as before.
DEFINITION 2.23 (ABSTRACTION DESIGNATION FUNCTION) A is an
abstraction designation function in the generalized Henkin frame M =
('H, I,), with respect to the language L( C) provided, for each valuation
v in M, and for each predicate abstract (Aal, ... , an.<l?) of L(C) of type
t, A(v, (Aal, ... ,an.)) is some member of1i(t).
Term denotation is like before-terms designate objects in the Henkin
domains.
DEFINITION 2.24 (DENOTATION OF A TERM) Let M = ('H,I,) be a
generalized Henkin frame, let v be a valuation, and let A be an abstraction designation function. A mapping, (v *I* A), is defined assigning
to each term of L( C) a denotation for that term.
1 If A is a constant symbol of L(C) then (v *I* A)(A) =I( A).
2 If a is a variable then (v *I* A)(a) = v(a).
3 If (Aal, ... , an. ) is a predicate abstract of L( C), then
(v*I*A)((Aal, ,an.)) =A(v,(Aal, ,an-)).

The following has a few changes from the earlier definition-to take
the extension function into account the atomic case has been modified.
DEFINITION 2.25 (TRUTH OF A FORMULA) Again let M = ('H,I,)
be a generalized Henkin frame, let v be a valuation, and A be an abstraction designation function. A formula of L( C) is true in model
M with respect to v and A, denoted M lf-v,A , provided the following.
1 For an atomic formula, M lf-v,A T(TI, ... , Tn) provided
((v *I* A)(TI), ... , (v *I* A)(Tn)) E E((v *I* A)(T)).
2 M lf-v,A ...,<f> if it is not the case that M lf-v,A .
3 M If-v,A 1\ \ll if M If-v,A and M If-v,A \ll.
27
4M
lf-v,A (Vat)<P if M lf-v,A <P[at /Ot] for every
ot E 7-l(t).
In item 1 above, T(Tl, ... , Tn) is true if the designation of (TI, ... , Tn)
is in the extension of the designation of T. For Henkin frames, we were
dealing with sets, and extensions were for free. Now we are dealing with
arbitrary objects, and we must explicitly invoke the extension function
.
I am about to impose a "correctness" requirement, analogous to Definition 2.16, but now there are three parts. The first part is similar to
that for Henkin models, except that the extension function is invoked.
The other parts need some comment. Suppose we have two predicate
abstracts (>.a1, . . . , an. <P) and (>.a1, . . . , an.\]!). In a Henkin model, if <P
and \]! are equivalent formulas, they will be true of the same objects and
so the two predicate abstracts will designate the same thing, since they
have the same extensions. But now we are explicitly allowing predicate
abstracts having the same extension to denote different objects. Still,
we don't want the designation of objects by predicate abstracts to be
entirely arbitrary-! will require equi-designation under circumstances
of "structural similarity."
DEFINITION 2.26 Let M be a generalized Henkin frame (or a Henkin
frame), and let A be an abstraction designation function in it. For each
valuation v and substitution a-, define a new valuation vu by:
Thus vu assigns to a variable a the "meaning" of the term aa-.

DEFINITION
2.27 (PROPER ABSTRACTION DESIGNATION FUNCTION)
Let M = (7-l, I,) be a generalized Henkin frame and let A be an abstraction designation function in it, with respect to L( C). A is proper
provided, for each predicate abstract (>.a1, ... , an.<P) we have
1 ((v*I*A)((>.ab ,an.<P))) =
{ (01, ... , On) I M lf-v,A <P[ai/01, ... , an/On]}
2 If v and w agree on the free variables of (>.a1, ... , an.<P) then
A(v,(>.al, ,an.<P)) =A(w,(>.al, ,an.<P))

3 If a- is a substitution that is free for the term (>.a1, ... , an. <P), then
A( v, (>.a1, ... , an.<P)a-) = A(vu, (>.a1, ... , an.<P))

The technical significance of items 2 and 3 above will be seen in the
next section. When using Henkin frames, if a proper abstraction designation function exists, it is unique (Proposition 2.18). But with a
28
generalized Henkin frame, it is entirely possible for there to be more

than one proper abstraction designation function. Since there is this
possibility, we must specify which one to use--the frame alone does not
determine it.
2.28 (GENERALIZED HENKIN MODEL)
Let M be a generalized Henkin frame, and let A be an abstraction designation function
in M. If A is proper, (M, A) is a generalized Henkin model.
DEFINITION
Finally Definition 2.8 is broadened to the entire class of generalized

Henkin models.
2.29 (VALIDITY, SATISFIABILITY, CONSEQUENCE) Let 
be a formula and S be a set of formulas of L( C).
DEFINITION
1 is valid in generalized Henkin models if M lf-v,A for every generalized Henkin model (M,A) for L(C) and valuation v.
2 S is satisfiable in a generalized Henkin model (M, A) for L( C) if
there is some valuation v such that M If-v,A is a generalized Henkin consequence of S provided, for every generalized Henkin model (M,A) for L(C) and every valuation v, if
M lf-v,A .
Similar terminology is used when confining things to generalized Henkin
models that are normal, or to Henkin models themselves.
We saw in Section 4 that the notion of Henkin model extended that

of "true" higher-order model, since "true" models can be identified with
standard Henkin models. In a similar way the notion of generalized
Henkin model extends that of Henkin model, since Henkin models correspond to what will be called extensional generalized Henkin models
(the definition is in the next section). Verifying this is postponed since it
requires us to show that parts 2 and 3 of Definition 2.27 hold for Henkin
models, and this involves some technical work. Assuming the result for
the moment, it follows that there are generalized Henkin models because
there are Henkin models; and we know there are Henkin models because
there are standard models. The question is: have the various generalizations really generalized anything? In fact, they have. It is a consequence
of the completeness proofs, which are given later, that there are Henkin
models that are not standard, and there are generalized Henkin models
that are not extensional Henkin models.
6.
29
A Few Technical Results
There are several results of a rather technical nature that, nonetheless,

are of fundamental importance. In fact, one of the propositions below
allows us to show that Henkin models are (isomorphically) among the
generalized Henkin models. Since we do not yet know this, we must
treat Henkin models and generalized Henkin models separately for the
time being.
6.1
Terms and Formulas
I leave the proof of the following Proposition as an exercise-see the

proof of Proposition 4.15 as a guide. The proof for generalized Henkin
models is similar to that for Henkin models except for the induction
step involving terms that are predicate abstracts, where a reduction to a
simpler case is not possible. But for generalized Henkin models, we are
given what we need for this step as part of the definition. (See part 2 of
Definition 2.27).
2.30
Let (M, A} be either a Henkin model or a generalized Henkin model, and let v and w be valuations.
PROPOSITION
1 If v and w agree on the free variables of the term
(v*I*A)(T)
(w*I*A)(T).
2 If v and w agree on the free variables of the formula <P

M lf--v,A <P {=::} M lf--w,A <P.
Next I state a result that will be used in the next Chapter to establish
the soundness of the tableau system.
2.31
Let (M, A} be either a Henkin model or a generalized Henkin model. For any substitution a and valuation v:
PROPOSITION
1 If a is free for the term T then

(v *I*A)(Ta) = (vu *I*A)(T).
2 If a is free for the formula <P then
M lf--v,A <Pa {=::} M lf--v,.,A <P.
Once again I omit the proof, and refer you to Proposition 4.16 for
a similar argument. (For generalized Henkin models, part 3 of Definition 2.27 is needed.)
6.2
Extensional Models
Among Henkin models the standard ones correspond to "true" higherorder models. A similar phenomenon occurs here-among the generalized Henkin models certain ones correspond to Henkin models.
30
DEFINITION 2.32 (EXTENSIONAL) The generalized Henkin frame ('H,

I,) is extensional provided that (0) = (0') implies 0 = O' for all
objects 0 and O'. A generalized Henkin model is extensional if its frame
is.
Suppose M = ('H, I) is a Henkin frame (Definition 2.11). M can be

converted into a generalized Henkin frame M' = ('H, I,) by setting
( 0) = 0 for each object 0 of non-zero type. That is, we specify an extension function that gives us the usual set-theoretic notion of extension.
It is easy to check that if (M, A) is a Henkin model then (M', A) is a
generalized Henkin model-part 1 of Proposition 2.31 directly gives us
part 3 of Definition 2.27, and likewise Proposition 2.30 gives us part 2.
Obviously (M', A) is extensional. And equally obviously, evaluation of
truth in the original Henkin model and in the generalized Henkin model
just constructed is essentially the same.
Conversely, suppose M = ('H, I,) is a generalized Henkin frame that
is extensional. Inductively define a mapping () as follows. For objects
0 of type 0, B(O) = 0. And for an object 0 of type (tt, ... ,tn), set
B(O) = { (B(Ot), ... , B(On)) I (Ot, ... , On) E (0)}. Define a new
domain function 'H' by setting 'H'(t) = {B(O) I 0 E 'H(t)}. Using the
fact that M is extensional, it is not hard to show that () is 1-1 and
onto between 'H(t) and 'H'(t), for each type t. Finally, for each term T,
set I'(T) = B(I(T)). This gives us a Henkin frame ('H',I'). Thus, in
effect, each generalized Henkin frame that is extensional is isomorphic
to a Henkin frame as defined earlier.
From now on I will treat Henkin models as being generalized Henkin
models that are extensional, when it is convenient to do so.
6.3
Language Extensions
Part of the definition of (generalized) Henkin model is that each predicate abstract must have an interpretation that is an object with the
"right" extension. But what predicate abstracts there are depends on
what the language is. Given a language L( C), one would expect models to depend on the collection of constants-members of C-which the
interpretation function, I, deals with. One would not expect the choice
of free variables of L(C) to matter, but this is not entirely clear, since
predicatr: abstracts can involve free variables. It is important to know
that the choice of free variables, in fact, does not matter, since the machinery of tableau proofs will require the addition of new free variables
to the language.
In what follows, L( C) is the basic language, and L + (C) is like L( C),
with new variables added, but with the understanding that these new
31
variables are never quantified or >.-bound. (This all takes on a significant

role in the next chapter.) I note the fundamental problem: even with
the restrictions imposed on the additional variables, the collection of
predicate abstracts of L + (C) properly extends that of L( C).
2.33 Each generalized Henkin model with respect to L(C)

can be converted into a generalized Henkin model with respect to L+(c)
so that truth values for formulas of L( C) are preserved.
PROPOSITION
There are two immediate consequences of this Proposition that I want

to state, before I sketch its proof. First, any set S of sentences of L( C)
that is satisfiable in some generalized Henkin model with respect to
L( C) is also satisfiable in some generalized Henkin model with respect to
L+(C). And second, any sentence of L(C) that is valid in all generalized Henkin models with respect to L +(C) is also valid in all generalized
Henkin models with respect to L( C) (because an L( C) countermodel
can be converted into a L+(c) countermodel).
Proof The proof basically amounts to replacing the new variables of

L + (C) by some from L( C), to determine behavior of predicate abstracts.
I only sketch the general outlines. Let M = (H, I,) be a generalized
Henkin frame, and let (M, A) be a generalized Henkin model with respect to L(C).
Recall the notational convention: {/h / a1, . . . , f3n /an} is the substitution that replaces each f3i by the corresponding ai. Also, if v is a
valuation, by v{fil/al, ... , fin/an} I mean the valuation v' such that
v'(ai) = v(fii), and on other free variables, v' and v agree.
Now we extend A to an abstraction designation function, A', suitable
for L+(C). For each predicate abstract (A"Yl, ... ,')'k.) of L+(C), and
for each valuation v with respect to L+(C), do the following. Let (31,
. . . , fin be all the free variables of that are in the language L + (C)
but not in L( C), and let a1, ... , an be a list of variables of L( C) of the
same corresponding types, that do not occur in , free or bound. Now,
set
A' (v, (>.1'1, ... , '/'k)) =

A(v{(Jl/al, ... ,fin/an}, (A')'l, ... ,')'k.{fil/al, ... ,fin/an}))
It can be shown that this is a proper definition, in the sense that it does
not depend on the particular choice of free variables to replace the f3i
Now it is possible to show that (M, A') is a generalized Henkin model
with respect to L + (C), and truth values of sentences of L( C) evaluate
the same with respect to A and A'. One must show a more general
result, involving formulas with free variables. The details are messy,
and I omit them.
32
Finally, Proposition 2.33 has a kind of converse. Together they say

the difference between L(C) and L+(C) doesn't matter semantically. I
omit its proof altogether.
PROPOSITION 2.34 A generalized Henkin model with respect to L+(c)
can be converted into a generalized Henkin model with respect to L( C)
so that truth values for formulas of L( C) are preserved.
Exercises
EXERCISE 6.1 Give a proof of Proposition 2.30.
EXERCISE 6.2 Give a proof of Proposition 2.31.
EXERCISE 6.3 Supply details for a proof that each generalized Henkin
frame that is extensional is isomorphic to a Henkin frame.
Chapter 3
CLASSICAL LOGIC-BASIC TABLEAUS
Several varieties of proof procedures have been developed for firstorder classical logic. Among them the semantic tableau procedure has
a considerable attraction, [Smu68, Fit96]. It is intuitive, close to the
intended semantics, and is automatable. For higher-order classical logic,
semantic tableaus are not as often seen-most treatments in the literature are axiomatic. Among the notable exceptions are [Tol75, Smi93,
Koh95, GilOl]. In fact, semantic tableaus retain much of their first-order
ability to charm, and they are what I present here. Automatability becomes more problematic, however, for reasons that will become clear
as we proceed. Consequently the presentation should be thought of as
meant for human use, and intelligence in the construction of proofs is
expected.
This chapter examines what I call a basic tableau system; rules are
lifted from those of first-order classical logic, and two straightforward
rules for predicate abstracts are added. It is a higher-order version of the
second-order system given in [Tol75]. I will show it corresponds to the
generalized Henkin models from Section 5 of Chapter 2. In Chapters 5
and 6 I make additions to the system to expand its class of theorems
and narrow its semantics to Henkin models.
1.
A Different Language
In creating tableau proofs I use a modified version of the language

defined in Chapter 2. That is, I give tableau proofs of sentences from the
original language L( C), but the proofs themselves can involve formulas
from a broader language that is called L + (C). Before presenting the
tableau rules, I describe the way in which the language is extended for
proof purposes.
33
34
Existential quantifiers are treated at higher orders exactly as they are

in the first-order case. If we know an existentially quantified formula is
true, a new symbol is introduced into the language for which we say, in
effect, let that be something whose value makes the formula true. As
usual, newness is critical. For this purpose it is convenient to enhance the
collection of free variables by adding a second kind, called parameters.
3.1 (PARAMETERS) In L(C), for each type t there is an
infinite collection of free variables of that type. The language L + (C)
differs from L( C) in that, for each t there is also a second infinite list
of free variables of type t, called parameters, a list disjoint from that
of the free variables of L( C) itself. Parameters may appear in formulas
in the same way as the original list of free variables but they are never
quantified or A bound. p, q, P, Q, ... are used to represent parameters.
DEFINITION
Parameters appear in tableau proofs. They do not appear in the

sentences being proved. Since they come from an alphabet distinct from
the original free variables, an alphabet that is never quantified or A
bound, we never need to worry about whether the introduction of a
parameter will lead to its inadvertent capture by a quantifier or a Aintroducing them will always involve a free substitution. Thus rules that
involve them can be relatively simple.
Special Terminology Technically, parameters are a special kind of

free variable. But to keep terminology simple, I will continue to use
the phrase free variable for the free variables of L( C) only, and when I
want to include parameters in the discussion I will explicitly say so.
The notion of truth in generalized Henkin models must also be adjusted to take formulas of +(c) into account. As I have just noted,
parameters are special free variables, so when dealing semantically with
L + (C), valuations must be defined for parameters as well as for the
free variables of L( C). Essentially, the difference between a generalized
Henkin frame and a generalized Henkin model lies in the requirement
that the extension of a formula appearing in a predicate abstract must
correspond to the designation of that abstract, which is a member of the
appropriate Henkin domain. In L + (C) there are parameters, so there
are more formulas and predicate abstracts than in L( C). Then requiring
that something be a generalized Henkin model with respect to L + (C) is
apparently a stronger condition than requiring it be one with respect to
L( C), though Section 6 establishes that this is not actually so.
DEFINITION 3.2 (GROUNDED)
A term or a formula of +(C) is
grounded if it contains no free variables of L( C), though it may contain parameters.
35
The notion of grounded extends the notion of closed. Specifically, a

grounded formula of L + (C) that happens to be a formula of L( C) is a
closed formula of L( C), and similarly for terms.
2.
Basic Tableaus
I now present the basic tableau system. It does not contain machinery
for dealing with equality-that comes in Chapter 5. The rules come
from [Tol75], where they were given for second-order logic. These rules,
in turn, trace back to the sequent-style higher-order rules of [Pra68] and
[Tak67].
All tableau proofs are proofs of sentences-closed formulas-of L( C).
A tableau proof of q> is a tree that has --,q> at its root, grounded formulas
of L + (C) at all nodes, is constructed following certain branch extension
rules to be given below, and is closed, which means it embodies a contradiction. Such a tree intuitively says --,q> cannot happen, and so q> is
valid.
The branch extension rules for propositional connectives are quite
straightforward and well-known. Here they are, including rules for various defined connectives.
DEFINITION
3.3 (CONJUNCTIVE RULES)
XI\Y
(X V Y)
-.x
--,y
--,y
(X
=:J
Y)
For the conjunctive rules, if the formula above the line appears on a
branch of a tableau, the items below the line may be added to the end of
the branch. The rule for double negation is of the same nature, except
that only a single added item is involved.
DEFINITION
3.4
(DOUBLE NEGATION RULE)
x
X
Next come the disjunctive rules. For these, if the formula above the
line appears on a tableau branch, the end node can have two children
added, labeled respectively with the two items shown below the line in
the rule. In this case one says there is tableau branching.
36
DEFINITION
3.5
(DISJUNCTIVE RULES)
XVY
XIY
(X A Y)
XiY
(X = Y)
(X ~ Y) I (Y ~ X)
This completes the propositional connective rules. The motivation

should be intuitively obvious. For instance, if X A Y is true in a model,
both X and Y are true there, and so a branch containing X A Y can
be extended with X and Y. If X V Y is true in a model, one of them
is true there. The corresponding tableau rule says if X V Y occurs on a
branch, the branch splits using X and Y as the two cases. One or the
other represents the "correct" situation.
Though the universal quantifier has been taken as basic, it is convenient, and just as easy, to have tableau rules for both universal and
existential quantifiers directly. To state the rules simply, I use the following convention. Suppose ( li) is a formula in which the variable at,
of type t, may have free occurrences. And suppose Tt is a term of type
t. Then ( Tt) is the result of carrying out the substitution {at /Tt} in
( at), replacing all free occurrences of at with occurrences of Tt. Now,
here are the existential quantifier rules.
3.6 (EXISTENTIAL RULES) In the following, pt is a parameter of type t that is new to the tableau branch.
DEFINITION
(:Jat)<P( at)
<P(pt)
(Vat)<P( at)
(pt)
The rules above embody the familiar notion of existential instantiation. Since the convention is that parameters are never quantified or >.bound, we don't have to worry about accidental variable capture. More
precisely, in the rules above, the substitution {at jpt} is free for the formula <P(at).
The universal rules are somewhat more straightforward. Once again, .
note that in them the substitution {at /Tt} is free for the formula ( at).
3.7 (UNIVERSAL RULES)

grounded term of type t of +(C).
DEFINITION
(Vat) ( at)

<l>(Tt)
In the following, Tt is any
(3at)( at)
<l>(Tt)
37
Finally we have the rules for predicate abstracts. Earlier notation

is extended a bit, so that if q,(a1, ... , an) is a formula, a1, ... , an
are distinct free variables, and T1, ... , Tn are grounded terms of the
same respective types as a1, ... , an, then q,(rl, ,Tn) is the result of
simultaneously substituting each Ti for all free occurrences of ai in q,,
DEFINITION 3.8 (ABSTRACT RULES)
(Aal, ... , an.q,(a1, ... , ctn))(TI, ... , Tn)

q,(Tl, , Tn)
(Aa1, ... ,an.q,(a1, ... ,an))(r1, ... ,Tn)
--,q,(Tl, ... , Tn)
Now what, exactly, constitutes a proof.
DEFINITION 3.9 (CLOSURE) A tableau branch is closed if it contains
q, and --,q,, where q, is a grounded formula. A tableau is closed if each

branch is closed.
DEFINITION 3.10 (TABLEAU PROOF)

For a sentence q, of L(C), a
closed tableau beginning with ,q, is a proof of q,.
DEFINITION 3.11 (TABLEAU DERIVATION) A tableau derivation of a
sentence q, from a set of sentences S, all of L( C), is a closed tableau
beginning with --,q,, allowing the additional rule: at any point any member
of S can be added to the end of any open branch.
This concludes the presentation of the tableau rules. In the next
section I give several examples of tableaus. Classical first-order tableau
rules, as in [Smu68, Fit96] are analytic~they only involve subformulas
of the formula being proved. (It is not the case with the cut rule, but
this is an eliminable rule.) Higher-order rules, for the most part, have
an analytic nature as well. The important exception is the rule for the
universal quantifier. It allows us to pass from (Vat)q,(at) to q,(rt) where
Tt is an arbitrary grounded term. Since terms can involve predicate
abstracts, applications of this rule can introduce formulas that are not
subformulas of the one being proved~indeed, they may be much more
complicated. There is no way around this. In a sense, the introduction
of predicate abstracts embodies the "creative element" of mathematics.
3.
Tableau Examples
Tableaus for first-order classical logic are well-known, but the abstraction rules of the previous section are not as widely familiar. I give
38
a number of examples illustrating their uses. The first embodies the

principle behind many diagonal arguments in mathematics.
3.12 Suppose there is a way of matching subsets of some
set V with members of V. Let us call a member of V associated with
a particular subset a code for that subset. It is required that every
member of V must be a code, and nothing can be a code for more than
one subset, though it is allowed that some subsets can have more than
one code. Then, some subset of V must lack a code. (One consequence
of this is Cantor's Theorem: a set and its power set cannot be in a 1-1
correspondence.)
To formulate this, let R(x, y) represent the relation: y is in the subset
that has x as its code; so (>.y.R(x,y)) represents the set coded by x.
Then the following second-order sentence does the job.
EXAMPLE
('v'R)(3X)('v'x)[(>.y.R(x, y)) =X]
(3.1)
This formulation contains equality. I have not given rules for equality
yet, so I give an alternative formulation that does not involve it.
('v'R)(3X)('v'x)(3y){[R(x, y)
1\
X(y)] V [R(x, y)
1\
X(y)]}
(3.2)
I give a proof of (3.2). It is contained in Figure 3.1. In it, 2 is from 1

by an existential rule (P is a new parameter); 3 is from 2 by a universal
rule ((>.x.P(x,x)) is a grounded term); 4 is from 3 by an existential
rule (p is another new parameter); 5 is from 4 by a universal rule (p is a
grounded term); 6 and 7 are from 5 by a conjunction rule; 8 and 9 are
from 6 by a disjunction rule; 10 is from 9 by double negation; 11 and 12
are from 7 by a disjunction rule, as are 13 and 14; 15 is from 12 by an
abstract rule, as is 16 from 10. Closure is by 8 and 11, 8 and 15, 13 and
16, and 10 and 14.
A key feature in the tableau proof of (3.2) is the use of (>.x. P(x, x))
in an application of a universal rule. This, in fact, is the heart of diagonal
arguments and amounts to looking at the collection of things that do not
belong to the set they code. The choice of such abstracts at key points
of proofs is the distilled essence of mathematical thinking-everything
else is mechanical. It is the need for such choices that stands in the way
of fully automating higher-order proof search.
Next is an example that comes out of propositional modal logic. Some
knowledge of Kripke semantics will be needed in order to understand the
background explanation, though not the tableau proof. See [HC96, pp
188-190] for a fuller treatment.
O'l
M
-.(\IR)(:JX)(\Ix)(:Jy){[R(x, y) 1\ -.X(y)] V [-.R(x, y) 1\ X(y)]} 1.

-.(:JX)(\Ix)(:Jy){[P(x, y) 1\ -.X(y)] V [-,P(x, y) 1\ X(y)]} 2.
-.(\lx)(:Jy){[P(x, y) 1\ -.(>.x.-.P(x, x)}(y)] V [-.P(x, y) 1\ (>.x.-.P(x, x))(y)]}
-.(:Jy){[P(p, y) 1\ -.(>.x.-.P(x, x))(y)] V [-.P(p, y) 1\ (>.x.-.P(x, x))(y)]} 4.
-.{[P(p,p) 1\ -.(>.x.-.P(x, x))(p)] V [-.P(p,p) 1\ (>.x.-.P(x, x))(p)]} 5.
-.[P(p,p) 1\ -.(>.x.-.P(x,x))(p)] 6.
?,p)
{Ax.~P(x,~7
os
-.P(p,p)
&S
C,)
-.-.P(p,p)
11.
-.-.(>.x.-.P(x, x))(p) 9.
(>.x.-.P(x, x))(p) 10.
8.
-.(>.x.-.P(x, x))(p)
-.-.P(p,p) 15.
12.
-.-.P(p,p) 13.
-.P(p,p) 16.
-.(>.x.-.P(x, x))(p)
14.
~
~
0
~
t3
Figure 3.1.
Tableau Proof of (\fR)(3X)(\fx)(3y){[R(x, y) 1\ X(y)] V [R(x, y) 1\ X(y)]}
3.
40
EXAMPLE 3.13 It is a well-known result of modal model theory that a

relational frame is reflexive if and only if every instance of DP => P is
valid in it. I want to give a formal version of this using the machinery of
higher-order classical logic. Suppose we think of the type 0 domain of a
higher-order classical model as being the set of possible worlds of a relational frame. Let us think of the atomic formula P(x) as telling us that
P is true at world x, and R( x, y) as saying y is a world accessible from
x. Then making use of the usual Kripke semantics, ('v'y)[R(x, y) => P(y)]
corresponds to P being true at every world accessible from x, and hence
to DP being true at world x, where R plays the role of the accessibility relation. Then further, saying DP => P is true at x corresponds to
('v'y)[R(x, y) => P(y)] => P(x). We want to say that if this happens at
every world, and for all P, the relation R must be reflexive, and conversely. Specifically, I give a tableau proof of the following. In it, take
R to be a constant symbol.
('v'x)R(x, x)
=('v'P)('v'x){('v'y)[R(x, y) => P(y)] => P(x)}
(3.3)
Actually, the implication from left to right is straightforward-! supply a tableau proof from right to left.
--,{('v'P)('v'x){('v'y)[R(x, y) => P(y)] => P(x)} => ('v'x)R(x, x)} 1.

('v'P)('v'x){(Vy)[R(x,y) => P(y)] => P(x)} 2.
--,(\fx)R(x, x) 3.
--,R(p, p) 4.
('v'x){('v'y)[R(x, y) => (Az.R(p, z))(y)] => (Az.R(p, z))(x)} 5.
(Az.R(p,z))(y)] ::> (~)(p) 6.
(\ly)[7
--,(\fy)[R(p, y) => (Az.R(p, z))(y)]

--,[R(p, q) => (Az.R(p, z))(q) 9.
R(p, q) 10.
--,(Az.R(p, z))(q) 11.
--,R(p, q) 12.
7.
(Az.R(p, z))(p)
R(p,p) 13.
8.
In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an

existential rule (p is a new parameter); 5 is from 2 by a universal rule
( (Az.R(p, z)) is a grounded term); 6 is from 5 by a universal rule (p is
a grounded term); 7 and 8 are from 6 by a disjunctive rule; 9 is from 7
by an existential rule (q is a new parameter); 10 and 11 are from 9 by a
conjunction rule; 12 is from 11 and 13 is from 8 by abstract rules.
41
The last example is a version of the famous Knaster-Tarski theorem

[Tar55].
3.14 Let 1) be a set and let F be a function from its powerset
to itself. F is called monotone provided, for each P, Q ~ 1), if P ~
Q then F(P) ~ F(Q). Theorem: any monotone function F on the
powerset of 1) has a fixed point, that is, there is a set C such that
F(C) =C. (Actually the Knaster-Tarski theorem says much more, but
this will do for present purposes.)
I now give a formalization of this theorem. Since function symbols
are not available, I restate it using relation symbols, and it is not even
necessary to require functionality for them. Now, (Vx)(P(x) :J Q(x))
will serve to formalize P ~ Q. If F(P, x) is used to formalize that x is
in the set F(P), then (Vx)(P(x) :J Q(x)) :J (Vx)(F(P,x) :J F(Q,x))
says we have monotonicity. Then, the following embodies a version of
the Knaster-Tarski theorem (F is a constant symbol).
EXAMPLE
(VP)(VQ)[(Vx)(P(x) :J Q(x)) :J
(Vx)(F(P, x) :J F(Q, x))] :J (3S)('v'x)(F(S, x)
= S(x))
(3.4)
I leave the construction of a tableau proof of this to you as an exercise, but I give the following hint. Let <P(P, x) abbreviate the formula
(Vy)(F(P,y) :J P(y)) :J P(x). An appropriate term to consider during
a universal rule application is: (>..x.(VP)<P(P, x)).
A comment on the hint above. Rewriting ('v'y) (F( P, y) :J P(y)) using
conventional function notation: it says F(P) ~ P. Then <P(P, x) says
that x belongs to a set P if P meets the condition F(P) ~ P. Then
further, (VP)<P(P, x) says that x is in n{P I F(P) ~ P}. So finally,
(>..x.(VP)<P(P, x)) represents the set n{P I F(P) ~ P} itself. In the
most common proof of the Knaster-Tarski theorem, one proceeds by
showing this set, in fact, is a fixed point of F.
Example 3.14 once again illustrates a fundamental point about higherorder tableaus. They mechanize routine steps, but do not substitute
for mathematical insight. The choice of which predicate abstract to use
during an application of a universal rule really contains, in distilled form,
the essence of a standard mathematical argument.
The problem of what choice to make when instantiating a universal
quantifier also arises in first-order logic, but there is a way around it--one
uses free variables when instantiating, then one determines later which
values to choose for them [Fit96]. This last step, picking values, involves
unification, the solving of equations involving first-order terms. There
are several unification algorithms to do this, all of which accomplish
42
the following: given two terms, if there is a choice of values for their
free variables that makes the terms identical, the algorithm finds the
most general such choice; and if the terms cannot be made identical, the
algorithm reports this fact. Unification is at the heart of every first-order
theorem prover.
If we attempt a similar strategy in automating higher-order logic, we
immediately run into an obstacle at this point. The problem of unification for higher-order terms is undecidable! This was shown for thirdorder terms in [Hue73], and improved to show unification for secondorder terms is already undecidable, in [Gol81]. This does not mean
the situation is completely hopeless. While first-order unification is decidable, and second-order is not, still there is a kind of semi-decision
procedure, [Hue75]. Two free-variable tableau systems for higher-order
classical logic, using unification, are presented in [Koh95]. The use of
higher-order unification in this way traces back to resolution work of
[And71] and [Hue72]. But finally, technical issues aside, we always come
back to the observation made above: the choice of predicate abstract to
use in instantiating a universally quantified formula often embodies the
mathematical "essence" of a proof. Too much should not be expected
from the purely mechanical.
Exercises
EXERCISE 3.1 Extending the ideas of Example 3.13, give tableau proofs
of the following.
1 (symmetry)
('v'x)('v'y)[R(x,y) :J R(y,x)] =
('v'P)('v'x){(3y)[R(x, y) 1\ ('v'z)(R(y, z) :J P(z))] :J P(x)}
2 (transitivity)
('v'x)('v'y)('v'z)[(R(x, y) 1\ R(y, z)) :J R(x, z)]

('v'P)('v'x){('v'y)[R(x,y) :J P(y)] :J
('v'y)('v'z)[(R(x, y) 1\ R(y, z)) :J P(z)]}
EXERCISE 3.2 Give the tableau proof to complete Example 3.14.

EXERCISE 3.3 ContinuingwithExample3.14, the set n{P I F(P) ~ P}
is not only a fixed point of monotonic F, it is the smallest one. Dually,
U{P I P ~ F(P)} is also a fixed point, the largest one. Give a tableau
proof of (3.4) based on this idea.
Chapter 4
SOUNDNESS AND COMPLETENESS
This chapter contains a proof that the basic tableau rules are sound
and complete with respect to generalized Henkin models. Soundness is
by the "usual" argument, is straightforward, and is what I begin with.
Completeness is something else altogether. For that I use the ideas
developed simultaneously in [Tak67, Pra68], where they were applied to
give a non-constructive proof of a cut elimination theorem.
1.
Soundness
Soundness means that any sentence having a tableau proof must be

valid. Tableau soundness arguments follow the same pattern for all logics: some notion of satisfiability is defined for tableaus; then satisfiability
is shown to be preserved by each tableau rule application. Note that in
the following, L +(C) is used rather than L( C), because formulas of the
larger language L + (C) can occur in tableaus.
DEFINITION 4.1 (TABLEAU 8ATISFIABILITY) A tableau branch is satisfiable if the set of formulas on it is satisfiable in a generalized Henkin
model for L+(C) (see Definition 2.29). A tableau is satisfiable if some
branch is satisfiable.
Now, two key facts about these notions easily give us soundness. For
the first, a closed tableau branch contains some formula and its negation,
hence cannot be satisfiable. Since a closed tableau has every branch
closed, we immediately have the following.
LEMMA
4.2 A closed tableau cannot be satisfiable.
The second key fact takes more work to prove, but the work is spread
over several cases, each of which is rather simple.
43
44
4.3 If a branch extension rule is applied to a satisfiable tableau,

the result is another satisfiable tableau.
LEMMA
Proof Suppose T is a satisfiable tableau. Then it has some satisfiable

branch, say 13. Also suppose some branch extension rule is applied toT
to produce a new tableau, T'. It must be shown that T' is satisfiable.
The rule that was applied to turn T into T' may have been applied
on a branch other than 13. In this case 13 is still a branch of T', and
of course is still satisfiable, so T' is satisfiable. Now, for the rest of the
proof assume a branch extension rule has been applied to the satisfiable
branch B itself. And to be specific, say all the grounded formulas on
13 are true in the generalized Henkin model (M, A) with respect to the
valuation v, where M = (1t,I, E).
There are several cases, depending on which branch extension rule
was applied. I consider only a few of these cases and leave the rest to
you.
Disjunction Suppose the grounded formula X V Y occurred on 13 and
a rule was applied to it. Then in T' the branch 13 has been replaced
with two branches: 13 lengthened with X, and 13 lengthened with Y.
All formulas on 13 are true in (M, A) with respect to valuation v,
hence M lf--v,A XV Y. Then either M lf--v,A X or M lf--v,A Y. In the
first case, all members of 13 lengthened with X, and in the second
case, all members of B lengthened with Y, are true in (M, A) with
respect to v. Either way, some branch ofT' is satisfiable.
Existential Quantifier Suppose the grounded formula (3a)<P(a) occurred on Band a rule was applied to it, so that in T' branch B has
been lengthened with <P(p) where p is a parameter new to B, of the
same type as a.
Since all formulas on Bare true in (M, A) with respect to v, M lf--v,A
(3a)<P(a). Then, by definition of truth in a model, there must be
some a-variant w of v such that M lf--w,A <P(a). Let a = {p/a}the substitution that replaces p by a-and consider the valuation
wa (Definition 2.26). I claim all formulas on 13 extended with <P(p)
are true in (M, A) with respect to wa, so the extended branch is
satisfiable.
First of all, v and w agree on all variables except a. It is easy to
see that w and wa agree on all variables except p, so the only variables on which v and wa can differ are a and p. But a does not
occur free in any formula on B, since these formulas are all grounded.
And p does not occur either, since p was new to the branch. Conse-
45
quently all formulas on B are true in (M, A) with respect to wa, by

Proposition 2.30.
Finally, note that since p did not occur in (:lo:)<P(o:), then <P(o:)
<P(p)a. We have M if-w,A <P(o:), and by Proposition 2.31

M if-w,A <P(o:) {:} M if-w,A <P(p)a
{:} M if-wu,A <P(p).
This completes the argument for the existential case.
Abstraction Suppose the grounded formula
occurred on B, and a rule was applied to it, so that in T' branch B

has been lengthened with <P(Tt, ... , Tn) We are assuming that the
formulas on B are all true in (M, A) with respect to valuation v. I
will show that this extends to include <P(Tt, ... ,Tn) as well.
Let a = { o:l/Tt, ... , o:n/ Tn}. This is free for <P( 0:1, ... , o:n) because
Tt, . . . , T n must be grounded, and parameters are never quantified or
>.-bound. Now consider the valuation va. Note the following useful
items.
1 va(o:i) = (v*I*A)(o:ia) = (v*I*A)(Ti)

2 If {3 is different from 0:1, ... , O:n, va ({3) = ( v * I * A) ({3a) =
(v*I*A)(f3) =v({3).
For this to be the case

((v *I* A)(Tt), ... , (v *I* A)(Tn)) E
E((v*I*A)((>.o:l, ,o:n.<P(o:l, ,o:n)))).
Since we have a generalized Henkin model, A is proper, so
E((v*I*A)((>.o:l, ,o:n.<P(o:l, ,o:n)))) =
{ (w(o:1), ... , w(o:n)) I w is an 0:1, ... , O:n-variant of v
and M if-w,A <P(o:1, , O:n)}
and consequently M if-w,A <P(o:1, ... , O:n) where w is the 0:1, ... ,
an-variant of v such that w(o:t) = (v *I* A)(Tt), ... , w(o:n) =
46
(v *I* A)(Tn) But, by items 1 and 2 above, vu itself is this a1, ... ,
an-variant of v. We thus have
Now, by Proposition 2.31,
that is,
There are other cases-! leave them to you.

THEOREM 4.4 (SOUNDNESS) If a sentence <P of L(C) has a tableau
proof, <P must be true in all generalized Henkin models with respect to
L(C).
Proof Suppose <P has a tableau proof, but is not true in every generalized Henkin model with respect to L( C)-I derive a contradiction.
Since <P is not true in every generalized Henkin model with respect to
L( C), {-.<P} is satisfiable, and by Proposition 2.33, is so in a generalized
Henkin model with respect to L + (C). A tableau proof of <P begins with
a tableau consisting of a single branch, containing the single formula
--.<P, so this must be a satisfiable tableau. As we apply branch extension
rules, we continue to get satisfiable tableaus, by Lemma 4.3. Since <P
is provable, we can get a closed tableau. Hence there must be a closed,
satisfiable tableau, which is impossible according to Lemma 4.2.
Essentially the same argument also establishes the following.
4.5 Let S be a set of sentences and <P be a single sentence
of L(C). If <P has a tableau derivation from S, then <P is a generalized
Henkin consequence of S.
THEOREM
2.
Completeness
The proof of completeness, for basic tableaus, with respect to generalized Henkin models, is of considerable intricacy. It is spread over
several subsections, each devoted to a single aspect of it. All the basic ideas go back to [Tak67, Pra68], where they were used to establish
non-constructively a cut-elimination theorem for higher-order Gentzen
systems. I also use aspects of the (second-order) presentation of [Tol75],
in particular the central goal, for us, is to prove that something called
47
a Hintikka set is satisfiable. This contains the essence of the proofs

of [Tak67, Pra68]. [And71] abstracted the Takahashi, Prawitz ideas to
prove a higher-order Model Existence Theorem which could simply have
been cited, but the ideas of the completeness proof are pretty and deserve
to be better known, hence the full presentation.
In outline, the completeness proof is as follows. In Section 2.1 the
notion of a Hintikka set is defined: it is a set of grounded formulas of
L + (C) meeting certain closure conditions bearing an obvious relationship to the tableau rules. In Section 2.2 pseudo-models are introduced.
These are the closest we come, in higher-order logic, to the Herbrand
models familiar in the first-order setting. Unfortunately, they will not
look like proper models in the higher-order sense, because objects assigned as meanings for predicate abstracts might lie outside the range
allowed for quantifiers. In Section 2.3 some rather technical (but important) results about the behavior of substitution in pseudo-models are
shown. In Section 2.4 it is established that each Hintikka set is satisfiable in some pseudo-model. Section 2.5 shows that pseudo-models, in
fact, are proper generalized Henkin models after all, and so each Hintikka set is satisfiable in such a model. Finally in Section 2.6 it is shown
how to extract a Hintikka set from a failed tableau proof attempt, and
this puts the last step in place for the completeness proof.
2.1
Hintikka Sets
Hintikka sets are fairly familiar from propositional and first-order

logics-see [Fit96] and [Smu68] for instance. They play a similar role
in the higher-order case, though arguments about them are much more
complex. You should note that the basic tableau rules all correspond
directly to Hintikka set conditions (I omit the connective = as a small
convenience).
4.6 (HINTIKKA SET) A non-empty setH of grounded formulas of L + (C) is a Hintikka set if it meets the following conditions.
DEFINITION
1 Atomic Case. If is atomic, not both E H and E H.

2 Conjunctive Cases.
(a) If ( 1\ w) E H then E H and WE H.
{b) If ( V w) E H then E H and W E H.
{c) If ( :J w) E H then E H and W E H.
3 Disjunctive Cases.
{a) If (<P V w) E H then either <P E H or WE H.
48
(b) If --, (<P 1\ \ll) E H then either --,<fl E H or --, \ll E H.

(c) If (<P :J \ll) E H then either --,q, E H or \ll E H.
Double Negation Case. If --,--,q, E H then <P E H.
5 Universal Cases.
(a) If (Vat)<P(ci) E H then <P(rt) E H for every grounded term Tt.

(b) If (3at)<P(at) E H then <P(rt) E H for every grounded term
Tt.
6 Existential Cases.
(a) If (3at)<P( at) E H then <P(pt) E H for at least one parameter pt.
(b) If (Vat)<P(at) E H then <P(pt) E H for at least one parameter
pt.
7 Abstraction Cases.
(a) If (>.a1, ... , Ctn.<P(a~, ... , an))(rl, ... , Tn) E H, then

<P(r1, ... , Tn) E H.
(b) If(>.al, ,an.<P(a1, ... ,an))(TI, ,Tn) E H, then
--,<fl(TI, ... ,Tn) E H.
This completes the definition of Hintikka sets. The task of relating
them to models begins in the next subsection.
2.2
Pseudo-Models
The eventual goal is to construct a generalized Henkin model, starting

with a Hintikka set. To do this a pseudo-model is first created, something
that is much like a generalized Henkin model but with one significant
difference: predicate abstracts are allowed to take on values that may
lie outside the range of the quantifiers! This will pose no problems for
the definition of truth in a pseudo-model since, for example, r1(r2) can
still be taken to be true if the value assigned to T2 is in the extension
of the value assigned to TI, whether or not these values are in quantifier
ranges. Eventually it will be shown that we can dispose of the "pseudo"
qualification on a pseudo-model.
I begin by defining entities of each type. These are the things that
can serve as values of predicate abstracts. In some ways the collection
of entities is an analog of a Herbrand universe, familiar from treatments
of first-order logic.
49
DEFINITION 4. 7 (ENTITIES OF TYPE t) The notion of entity of type t

is defined inductively, on the complexity oft.
1 Suppose t = 0. If T is a grounded term of type t (thus a constant or
parameter of type 0}, T is an entity of type t.
2 Suppose t = (t1, ... , tn) and the collection of entities of type ti has
been defined for each i = 1, ... , n. Then (T, S) is an entity of type t
provided T is a grounded term of type t, and S is a set whose members
are of the form (E1, ... , En), where each Ei is an entity of type ti.
I also define two mappings on entities.

DEFINITION 4.8 (, T) If the entity E is of a type other than 0, it is
of the form (T, S); then T(E) = T and E(E) = S. I refer to E(E) as
the extension of E. The definition of T (but not of E) is extended to
entities of type 0 as well. If E is of type 0 it is, itself, a grounded term
of L+(C); in this case T(E) =E.
The idea is, if (T, S) is an entity of type t, it is something that could
serve as a semantic value for the term T, with the extension explicitly
coded in.
One problem with entities is that Hintikka sets play no role-the
collection of entities is the same no matter what Hintikka set we may
have. Presumably, if we are trying to construct a model from a given
Hintikka set, that should place some restrictions on what entities we
want to consider. The next definition separates out those entities that
will be in the range of quantifiers-it makes direct use of a Hintikka set.
It is these entities that will make up the Henkin domains of a model.
DEFINITION 4.9 (POSSIBLE VALUE)
Let H be a Hintikka set. For
each grounded term T, define a collection of possible values ofT relative
to H. This is done inductively, on type complexity.
1 If T is a grounded term of type 0, the only possible value ofT relative
to H is T itself.
2 Suppose T is a grounded term of type (t1, ... , tn), and possible values
relative to H have been specified for all grounded terms of types t1,
... , tn. Then, an entity (T, S) is a possible value ofT relative to
H provided, for all grounded terms TI, ... , Tn of types t1, ... , tn
respectively, and for all possible values E1, ... , En of TI, ... , Tn:
(a) If T(TI, ... , Tn) E H then (E1, ... , En) E S.
(b) If T(TI, ... , Tn) E H then (E1, ... , En) ~ S.
50
E is a possible value if it is a possible value for some grounded term.
Roughly the idea is, any possible value for T should have in its extension
all those things the Hintikka set H requires, and should omit all the
things H forbids. Any entity that meets these conditions will serve as a
possible value. Clearly each possible value of a grounded term of type
t, relative to a Hintikka set H, is an entity of type t. Item 1 of the
definition of Hintikka set ensures that part 2 above is meaningful.
Now that we have the notion of possible value, Henkin domains for
our pseudo-models can be defined.
4.10 (RELATIVE HENKIN DOMAINS) Let H be a Hintikka
set. A mapping, 'HH is defined, from types to entities, as follows. For
each type t, 'HH(t) is the set of all entities of type t that are possible
values relative to H.
DEFINITION
The languages L( C) and L +(C) are allowed to contain constant symbols. How to interpret these is rather arbitrary, within broad limits.
4.11 (ALLOWED INTERPRETATION) Let H be a Hintikka

set. A mapping I is an allowed interpretation relative to H provided I
assigns to each constant symbol A of type t some possible value for A,
relative to H.
DEFINITION
We now have all the machinery needed to characterize an important

class of generalized Henkin frames arising from Hintikka sets.
4.12 (RELATIVE GENERALIZED HENKIN FRAME) Let H
be a Hintikka set. M = ('HH, I,) is a generalized Henkin frame relative
to H provided:
DEFINITION
1 'HH is the relative Henkin domain function of Definition 4.10;

2 I is an allowed interpretation relative to H, Definition 4.11;
3 is the extension function of Definition
4.8.
To produce our pseudo-models we need some notion of an abstraction

designation function. To define this we first need a little more machinery.
DEFINITION 4.13 (-v) Let v be a valuation in some generalized Henkin
frame relative to a Hintikka set H. Define a substitution
as follows:
a'V = T(v(a)).
-v
Thus, ifv(o:) = (T,S) then o:-v = T. Ifv(o:) = C, of type 0, then o:-v =

C. Note that
substitutes grounded terms of L+(C) for variables, and
-v
51
so if T is an arbitrary term, T+v" must be a grounded term. Similarly

for formulas. Then, for any formula and any valuation v, +v" is
something that could potentially be a member of a Hintikka set.
Now everything is in place to define the notion of pseudo-model. Here
is a simultaneous recursive definition of truth, and of an abstraction
designation function. I denote the abstraction designation function by
AH, reflecting its dependence on the Hintikka set H, and (v *I* AH) is
defined from it, a valuation v, and an interpretation I in the customary
way. I note that valuations have their standard meaning: they map
variables to members of Henkin domains. They do not map to arbitrary
entities.
Let H be a Hintikka set and let

M = (1-lH,I,) be a generalized Henkin frame relative to H. Truth of
formulas, and an abstraction designation function, are characterized as
follows.
DEFINITION 4.14 (PSEUDO-MODEL)
1 For atomic formulas of L+(C), M lf--v,AH T(TI, ... , Tn)) if
((v*I*AH)(TI), ... ,(v*I*AH)(Tn)) E((v*I*AH)(T)),

2 M lf--v,AH X if M IYv,AH X.
3M lf--v,AH X
4M
1\
Y if M lf--v,AH X and M lf--v,AH Y.
lf--v,AH (Vo/) if M lf--v,AH [o:t ;at] for every
ot E 1-lH(t).
(>.o:1, ... , O:n.) be a predicate abstract of type (t1, ... , tn).

SetAH(v,(>.o:l, ,o:n.)) = (T+v",S) where
5 Let T =
S = { (01, ... , On) E 1iH(ti) X X 1iH(tn)

M lf--v,AH [o:I/01, , O:n/On]}.
The structure (M, AH) is a pseudo-model, relative to the Hintikka set

H.
The definition above has the usual complex recursive structure, with
truth at the atomic level needing (v * I * AH) and hence AH, and the
characterization of AH itself needing the notion of truth for formulas.
Of course what makes it work is the fact that, in every case, behavior
of some construct on a formula or term requires constructs involving
simpler formulas and terms.
The key point is, why is this called a pseudo-model, and not simply a
model? The answer is, we have the characterization of the abstraction
designation function backwards here. In Chapter 2 we assumed we had a
function A that mapped valuations and abstracts to members of Henkin
52
domains. Then we imposed a condition that A map to the "right"

members, so that our intuitions concerning abstracts would be respected.
Here we made that intuitive condition the defining property, reversing
the usual order of things. But now we have no guarantee that AH must
assign values that are in the Henkin domains. Looking at part 5 of the
definition above, it is clear that, for an abstract T of type (t1, ... , tn),
E(AH(v, T)) will be a subset of 'HH(tl) x x 'HH(tn), but we do not
know that AH(v,T) will be a possible value, and hence a member of
'HH( (t1, ... , tn) ). In short, while quantifiers range over Henkin domains
(condition 4 above), for all we know some terms-abstracts-can have
values that fall outside them. As a matter of fact, it will be proved
that this does not happen, but it is not obvious, and it is not easy to
establish.
Exercises
EXERCISE 2.1 Show that if entity E is a possible value, then E must
be a possible value of T(E).
2.3
Substitution and Pseudo-Models
In this subsection valuations and substitutions are shown to be wellbehaved with respect to pseudo-models. It should be noted again that
valuations always mean valuations in a pseudo-model-they map variables to members of Henkin domains, to possible values. They do not
map to arbitrary entities. The proofs below are rather technical, so I
begin with the statements of the two Propositions to be established, after which their proofs are given, broken into a number of Lemmas. On a
first reading you might want to just read the Propositions and skip over
the proofs.
The first item should be compared with Proposition 2.30.
PROPOSITION 4.15 Let H be a Hintikka set, let M = ('HH,I,E) be
a generalized frame relative to H, and let (M, AH) be a pseudo-model
relative to H. Also let v and w be valuations.
1 If v and w agree on the free variables of the term T
(v*I*AH)(T) = (w*I*AH)(T).
2 If v and w agree on the free variables of the formula 
M II-v,AH ::::::} M II-w,AH 
The second item is an analog to Proposition 2.31. Definition 2.26 is

carried over to the present setting: given (M, AH), for each valuation v
and substitution CJ, the valuation vu is defined by o:va = (v *I *AH) (o:o-).
53
4.16 Again let H be a Hintikka set, let M = (1lH,I,)

be a generalized frame relative to H, and let (M, AH) be a pseudo-model
relative to H. For any substitution CJ and valuation v:
PROPOSITION
1 If CJ is free for the term T then

(v * T * AH)(TCJ) = (vu * T * AH)(T).
2 If CJ is free for the formula <P then
M lf--v,AH <PCJ {::::::::} M lf--v",AH <P.
Now I turn to the proofs, which are given in considerable detail since
these results are critical to the completeness argument, and I want the
reasoning on record. On a first reading, skip the proofs and move on to
the next section.
Proof of 4.15 Suppose the result is known for terms and formulas
whose degree is < k. I show the result is also true for those of degree k
itself, beginning with terms.
Assume Tis a term of degree k, and v and w agree on the free variables
and parameters of T. If k happens to be 0, T is a constant symbol,
variable, or parameter. In these cases the result is immediate.
Now suppose k =/= 0, and soT= (.Xa1, ... , an.<P), where <Pis of degree
< k. Say (v *T*AH)((.Xal, ,an.<P)) = AH(v,(Aai, ,an.<P)) =
(a,S) and (w*T*AH)((Aal, ,an.<P)) =AH(w,(.Xal, ,an.<P)) =
(a', S'). We must show a= a' and S = S'.
Suppose a is a variable or parameter that occurs free in T. Then
air = T(v(a)) = T(w(a)) = a~, using the assumption that v and
w must agree on a. By definition, a = T'v and a' = T~, and the
substitutions 'v and ~ agree on the free variables of T, so a = a' by
Proposition 1.15.
Next we suppose (E1, ... , En) E S, and so M lf--v,AH <P[al/ E1, ... ,
an/ En] Since v and w agree on the free variables and parameters of
(.Xa1, ... , an.<P), they agree on the free variables and parameters of <P,
other than a1, ... , an. Then by the induction hypothesis, M lf--w,AH
<P[al/ E1, ... , an/ En], and it follows that (E1, ... , En) E S'. Thus S ~
S'. A similar argument shows S' ~ S.
This completes the induction step for terms, and I turn next to formulas. Suppose <P is of degree k and v and w agree on the free variables and
parameters of <P. By the induction hypothesis, we have the Proposition
for terms and formulas of degree< k, and by what was just shown, we
also have it for terms of degree k itself. Now we have several cases.
Suppose <Pis atomic, To(TI, ... , Tn), where each Ti must be of degree
~ k. Then, using the induction hypothesis and what was just proved,
54
M lf--v,AH To(T1, ... , Tn)

((v *I* AH)(T1), ... , (v *I* AH)(Tn)) E ((v *I* AH)(To))
((w *I* AH)(T1), ... , (w *I* AH)(Tn)) E ((w *I* AH)(To))
M lf--w,AH To(T1, ... , Tn)
::>
::>
::>
The various non-atomic cases are left to you.

Next we have several preliminary results, leading up to the proof of
Proposition 4.16. Recall Definition 1.12: (Ja 1,... ,an is the substitution
that is like(} except that it is the identity on 0:1, ... , O:n.
LEMMA 4.17 Let H be a Hintikka set, let M = (HH,I, ) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to
H. Let (..Xo:1, ... , O:n.<P) be a term of L+(C), and suppose the substitution (} is free for it, and is the identity map on parameters and variables
that do not occur free in (..Xo:1, ... ,o:n.<P). Then, for any valuation v:
1 If w is an 0:1, ... , O:n variant of v then wu"'l ,a.n is an 0:1, ... , O:n
variant of vu.
2 Conversely, if u is an 0:1, ... , O:n variant of vu then u = wu"'l ,... "'n
for some 0:1, ... , O:n variant w of v.
3 vu<>1, ... ,<>n (o:i) = v(o:i), fori= 1, ... , n.
Proof
Part 1. Suppose w is an 0:1, ... , O:n variant of v. Let {3 be a variable or
parameter other than 0:1, ... , O:n. It must be shown that wu<>1>-- ,<>n ({3) =
va({3). Here are the steps; the reasons follow.
w(T<>l, ... ,<>n ({3) = ( w *I* AH )(f3(Jal, ,an)
= (w * I * AH) ({3(})
(4.1)
(4.2)
= (v*I*AH)(f3(})
(4.3)
vu ({3)
(4.4)
Above, (4.1) is the definition of wu<>l, ... ,<>n, and (4.2) is because {3 is
different from 0:1, ... , O:n. Also (4.4) follows from (4.3) by the definition
of vu. The key item is the equality of (4.2) and (4.3), and for this it is
enough to show v and w agree on the free variables and parameters of
{3(}, and then appeal to Proposition 4.15. The argument for this follows.
If {3 does not occur free in (..Xo:1, ... , O:n.<P), {3(} = {3 by assumption.
Also we are assuming {3 is different from o: 1, ... , O:n, and v and w agree
on all variables except o: 1, . . . , O:n, so v and w must agree on {3, and
55
hence trivially they agree on the free variables and parameters of {JCJ in
this case.
Now suppose {3 does occur free in (Ao:1, ... , O:n-~). Since CJ is free for
(Ao:1, ... , O:n-~), {JCJ cannot contain any of 0:1, ... , O:n free. Once again
v and w must agree on the free variables and parameters of {JCJ, since v
and w can only differ on 0:1, . . . , O:n.
Part 2. Suppose u is an 0:1, ... , O:n variant of va. Define a valuation
w as follows.
w(o:i) = u(o:i) i = 1, ... ,n

w(f3) = v(f3) {3 ::/= 0:1, . . . , O:n
By definition, w is an 0:1, ... , O:n variant of v. I will show wa"'I>-- "'n = u.
The argument is in two parts.
wa"'l"'n(o:i) = (w*L*AH)(O:Wat, ... ,aJ

=(w*L*AH)(o:i)
= w(o:i)
= u(o:i)
(4.5)
(4.6)
(4.7)
(4.8)
In this, (4.5) is by definition of wa"'l .. "'n. Then (4.6) is because CJa 1 , ... ,an
is the identity on O:i Next, (4.7) is because o:i is a variable, and finally
(4.8) is by definition of w.
Now suppose f3 ::/= 0:1, ... , O:n.
wa"'l>"'n(f3) = (w*I*AH)(f3CJa 1 , . ,an)

=(w*I*AH)(f3CJ)
=(v*I*AH)(j3CJ)
= va(f3)
= u(f3)
(4.9)
(4.10)
(4.11)
(4.12)
(4.13)
Here (4.9) is by definition of wa"'l .. "'n. Then (4.10) is by definition of

CJat, ... ,an Next, (4.11) follows exactly as (4.3) did above. Finally (4.12)
is by definition of va, and (4.13) is because u and va are 0:1, ... , O:n
variants.
Part 3. Va"'l>"'n(o:i) = (V*L*AH)(o:iCJa 1 , ... ,an) = (v*L*AH)(o:i) =
v(o:i)
4.18 Let H be a Hintikka set, let M = (1tH,I,) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative
to H. For any term T of L+(C), T~ = T((v *I* AH)(T)).
LEMMA
56
Proof Suppose first that T is a predicate abstract. Then by Definition 4.14, (v *I* AH)(T) = AH(v,T) = (T*v,S) for a certain setS,
and so T((v *I* AH)(T)) = T*v. If T is a variable or parameter,
T*v = T(v(T)) by definition of tv", and v(T) = (v *I* AH)(T) by definition of (v * I * AH) again, for variables. If T is a constant symbol,
T*v = T, and also T((v *I* AH)(T)) = T(I(T)) = T because I is an
allowed interpretation.
The proof of Proposition 4.16 is by an induction on degree. Since the
steps are somewhat complex, I have separated the significant parts out,
in the following two Lemmas.
4.19 Let H be a Hintikka set, let M = ('HH, I,) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative to
H. Assume that for each formula of degree < k, whenever substitution
C5 is free for then
LEMMA
M lf-v,A <l>C5 {::} M lf-v",A .

Then for each term T of degree k, and for each substitution C5 that is free
forT,
(v *I * AH) (TC5) = (vu *I * AH) (T).
Proof Assume the hypothesis concerning formulas, and suppose T is a
term of degree k. If k is 0, T must be a constant symbol, a variable, or a
parameter. If Tis a variable or parameter, say a, then (vu *I*AH)(a) =
vu (a) = (v *I* AH) (ae5). The case of a constant symbol is trivial.
Now suppose k > 0, and so T must be of the form (>.a1, ... , an.),
where is a formula whose degree is < k. And suppose C5 is free for
(>.a1, ... , an. ). Using the definition of substitution and Definition 4.14:
(v*I*AH)((>.a1, ... ,an.)C5)

= (v*I*AH)((>.a1, ... ,an.C5a 1 , ... ,an))
=AH(v,(>.a1, ,an.C5a 1 , ... ,aJ)
=(a, S)
where
a= (>.a1, ... ,an.C5a 1 , ... ,an)+v

S = {(01, ... , On) E 'HH(t1) X .. X 'HH(tn) I
M lf-v,AH <l>C5a 1 , ... ,an[al/01, , an/On]}.
57
Similarly:
where
aI = ( >.a1. ... , an. )+a

v
S' = { (01, ... , On) E 'HH(tl) X X 'HH(tn)
M 11-v",AH [al/01, ... , an/On]}.
So, we must show a= a' and S = S'.
Part 1, a= a'.
First of all,
a= (>.al, ... ,an.aal,,an)1J

= ((>.al, ,an.))a)1J
= (>.a1, ... , an.)(a11)
(4.14)
(4.15)
In this, (4.14) is by definition of substitution. Recall we are assuming

that a is free for (>.a1. ... , an. ). Also, since 11 replaces variables by
grounded terms, and parameters are never bound, substitution 11 is free
for (>.a1, ... , an.)a. Then (4.15) follows by Theorem 1.18.
So, to show a= a' it is enough to show the substitutions a11 and if
are the same. Let (3 be a variable or parameter. f3(a11) = ([3a)11 by
definition of composition for substitutions. And, using Definition 4.13,
(3if = T(v 17 ({3)) = T((v *I* AH)(f3a)). Finally, (f3a)1J and T((v *I*
AH)(f3a)) are the same, by Lemma 4.18.
We thus have shown that a= a'.
Part 2, S = S'.
Using Proposition 1.15 it can be assumed that a is the identity on
variables and parameters that do not occur free in (>.a1, ... , an. ).
58
8= {(01, ... 0n) I M lf-v,AH <Paa 1 , ... ,an[o:I/01, ,o:n/On]}

= { (w(o:1), ... , w(o:n)) I M lf-w,AH <Paa 1 , ... ,an
where w is an 0:1, ... , O:n variant of v}
= {(w(o:1), ... ,w(o:n)) I M lf-wu"l .. "n,AH n (o:I), ... 'wa"l'"' ,<>n (o:n)) I M If-wO'"l"' ,<>n ,AH
= { (u(o:1), ... , u(o:n)) I M lf-u,AH 
(4.19)
(4.20)
(4.21)
Above, (4.17) is just (4.16) rewritten. Since a is free for (Ao:~, ... , O:n.<P),
by Definition 1.16, aa 1 , ... ,an must be free for <P, and since <P must be of
degree < k, (4.17) and (4.18) are equal by the hypothesis of the Lemma.
Then (4.18) and (4.19) are equal by part 3 of Lemma 4.17. The equality
of (4.19) and (4.20) follows by parts 1 and 2 of Lemma 4.17. Finally,
(4.21) is (4.20) rewritten.
4.20 Let H be a Hintikka set, let M = (HH,I,t:) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative
to H. Assume that
LEMMA
(4.22)
for each substitution a that is free for , provided is of degree < k.
Also assume that
(v *I* AH) (TO")
= ( va
*I * AH) (T)
(4.23)
for each substitution that is free forT, provided T is of degree ::; k. Then
(4.22} also holds for each formula is of the form r(r1, ... , Tn), each of the terms r, r1, ... , Tn must
be of degree :=:; k. Then, using hypothesis (4.23) about terms,
M lf-v,AH a {:::> M lf-v,AH (r(TI, ... , Tn)))a

{:::> M lf-v,AH ra(r1a, ... ,Tna)
{:::> ((v*I*AH)(rla), ... ,(v*I*AH)(rna))
E ((v *I* AH)(ra))
{:::> ( ( Va * I * A H) ( TI) , . . . , (Va * I * A H) ( Tn))
E ((va *I* AH)(r))
{:::> M lf-v",AH r(TI, ... , Tn)
{:::> M If- v" ,AH 
Next, if is a propositional combination of simpler formulas, the
argument is straightforward using the hypothesis about formulas, and is
left to you. Finally, if is of the form (Va)w the argument, in outline,
is as follows.
M lf-v,AH [(Va)w]a
M lf-v,AH (Va)[Waa]
{:::> M lf-w,AH Waa for every valuation
w that is an a-variant of v
(4.24)
{:::>
{:::>
M If- w"" ,AH W for every valuation
w that is an a-variant of v
{:::> M lf-u,AH W for every valuation
u that is an a-variant of va
{:::>
(4.25)
(4.26)
M lf-v",AH (Va)w
In this, the equivalence of (4.24) and (4.25) is by the hypothesis about

formulas, and the equivalence of (4.25) and (4.26) is by a result similar
to that stated in Lemma 4.17, but for quantified formulas rather than
for predicate abstracts.
Finally, the central item we have been aiming at.
Proof of 4.16 The proof, of course, is by induction on degree. Suppose the result is known for formulas and terms of degree < k. Then
by Lemma 4.19 the result holds for terms of degree k, and then by
Lemma 4.20 it holds for formulas of degree k as well.
2.4
Hintikka Sets and Pseudo-Models
Given a Hintikka set, we now know how to create a pseudo-model from

it. It would be nice if the various formulas in the Hintikka set turned
60
out to be true in that pseudo-model. This happens, and will be shown

below. But we still have the troublesome feature of pseudo-models that
quantifiers range over members of the Henkin domains, but predicate
abstracts can have as values entities that might lie outside them. It
would be nice if the values assigned to predicate abstracts turned out
to be possible values after all. This too happens to be the case, and
will also be shown below. In fact, both of the things we desire will be
shown simultaneously, in one big result. Then we can conclude that each
Hintikka set is satisfiable in a pseudo-model that actually is a generalized
Henkin model.
4.21 Let H be a Hintikka set, let M = (HH,I,) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative
to H. Also let v be a valuation in the pseudo-model.
THEOREM
1 For each term T of L +(C), (v *I* AH) (T) is a possible value for TlJ.
2 For each formula <J> of L+(C), if <J>"V E H then M lf-v,AH <J>.
Proof Both parts of the theorem are shown together by a simultaneous

induction on degree. Assume they hold for formulas and terms of degree
< k. It will first be shown that item 1 holds for terms of degree k; then
it will be shown that item 2 holds for formulas of degree k.
Part 1. Let T be a term of degree k. If k happens to be 0, T is a
constant symbol, variable, or parameter. If T is a constant symbol A,
A"V =A, and (v *I* AH)(A) = I(A), which is a possible value of A
because I is an allowed interpretation. If Tis a variable or parameter, a,
(v *I* AH) (a) = v( a) is some possible value E because v is a valuation
in the pseudo-model. But then a"V = T(v(a)) = T(E), and E is a
possible value of T(E) by Exercise 2.1.
Now suppose T = (.Aa1, ... , an.). Then (v*I*AH)(r) = AH(v, r) =
(r"V, S) where
S = { (Ot, ... , On) E HH(ti)
=
X .. X
HH(tn)
M lf-v,AH <J>[ai/01, .. , an/On]}

{ (w(ai), ... , w(an)) I M lf-w,AH 
where w is an a1, ... , an variant of v}.
I show (r"V, S) is a possible value of r"V relative to H. To do this it

must be shown that if E1 is a possible value for T1, ... , En is a possible
value for Tn, then
2 (71f)(71, ... , 7n) E H implies (E1, ... , En)
61
fl. S.
I show the first of these; the second is similar.

So assume E1 is a possible value for 71, . . . , En is a possible value for
7n, and (71f)(71,. ,7n) E H. That is,
[(>.a1, ... ,an.)1f](71, ... ,7n) E H.
By definition of substitution we have
(.Xa1, , an.+v a 1 , ... ,an)(71, , 7n) E H.
Since H is a Hintikka set, it follows that (Definition 4.6, part 7)
[+v a1, ... ,an]{al/71, ... , an/7n} E H.
Since 71, ... , 7n are grounded terms, they do not contain any of a1, ... ,
an free. Now, let w be the a1. ... , an-variant of v such that w(a 1) = E 1,
... , w(an) =En. Since Ei is a possible value for the grounded term 7i
it follows that ai w = 7i. And if j3 f= a1, ... , an then j3w = j31J. Then
[ tv a 1 , ... ,an]{ al/71, ... , an/Tn} = w so
w E H.
 must be of lower degree than (>.a1, ... ,an.), that is, k, so the induction hypothesis applies and
M 11-w,AH .
Then (w(a1), ... , w(an)) E S, so (E1, ... , En) E S, which is what we
wanted.
This concludes the induction step for terms.
Part 2. Let be a formula of degree k. By the induction hypothesis
the result holds for formulas and terms of degree < k, and by part 1 of
the proof it also holds for terms of degree k. Now we have several cases,
depending on the form of . I only present a few of them.
Suppose is 7o(71, ... , 7n) and [To(71, ... , 7n)]tv E H. That is,
Each 7i is of degree ::; k so by the induction hypothesis, each (v * I *

AH)(7i) is a possible value for 7i1f. It follows immediately from the
definition of possible value (Definition 4.9) and the definition of (Definition 4.8) that
62
and so
Suppose <P is X 1\ Y, and (X 1\ Y) 'v E H. By definition of substitution,

(X'v 1\ Y'v) E H. Since H is a Hintikka set, X'v E H and Y'v E H.
But each of X and Y is of lower degree than <P, so by the induction
hypothesis, M 11-v,AH X and M 11-v,AH Y. It follows that M 11-v,AH
X 1\ Y.
Suppose <P is (\io:)w(o:) and [(\io:)w(o:)]'v E H. By definition of

substitution, (\io:)[w'v a](o:) E H. Let w be an arbitrary a-variant of v
that assigns to o: the possible value E. Since E is a possible value, it is
the possible value of some grounded term, say T. Now by definition of
Hintikka set, [w'v a](T) E H. We have o:w = T, and if {3 -=f. o:, {Jw =
{J'v, so [w(o:)]w = [w'v a](T), and hence [w(o:)]w E H. But W(o:) is
oflower degree than <P, so by the induction hypothesis, M 11-w,AH w(o:).
Since w was arbitrary, M 11-v,AH (\io:)w(o:).
The other cases are similar and are omitted.
4.22 Let H be a Hintikka set, let M = (1-lH,I,) be a
generalized frame relative to H, and let (M, AH) be a pseudo-model
relative to H. Then H is satisfied in the pseudo-model (M, AH). More
specifically, let v be any valuation in this pseudo-model that assigns to
each parameter p some possible value for p; then if <P E H, M lf-v,AH <P.
COROLLARY
Proof If v assigns to each parameter p some possible value for p, then

p'v = T(v(p)) = p. Consequently for each grounded formula <P we have
<P'v = <P. The result then follows from part 2 of Theorem 4.21.
2.5
Pseudo-Models are Models
So far, a satisfiability result has been shown using pseudo-models.

But along the way everything needed to show that pseudo-models are
actually models has been established. Since this is an important fact, I
give it a section of its own though, as I said, the work has already been
done.
4. 23 Let H be a Hintikka set, let M = (1-lH, I,) be a generalized frame relative to H, and let (M, AH) be a pseudo-model relative
to H. Then (M, AH) is a generalized Henkin model.
THEOREM
Proof We need that AH is an abstraction designation function, Definition 2.23. Specifically, we need that it maps predicate abstracts to
63
members of Henkin domains. But part 1 of Theorem 4.21 takes care of

this.
And we need that AH is a proper abstraction designation function,
Definition 2.27. There are three conditions that must be met. The
first, that abstracts map to the 'right' values, is taken care of by the
way we defined AH in pseudo-models. The other two conditions have
to do with the behavior of substitution, and these are taken care of by
Propositions 4.15 and 4.16.
COROLLARY 4.24
Henkin model.
Every Hintikka set is satisfiable in a generalized
Proof By Corollary 4.22 and the Theorem above. (Recall, it was shown
in Section 6 that a choice between L( C) and L + (C) was not significant
when considering models for formulas from the language L(C).)
2.6
Completeness At Last
Most of the work of showing completeness is over. All that is left is

to connect Hintikka sets with tableaus. This can be done in either of
two ways. One could give a systematic tableau construction procedure,
designed to ensure everything that can be done is eventually done in fact.
Then one would show that the set of formulas on an unclosed branch
of such a tableau is a Hintikka set. This approach involves considerable
attention to detail, and is not what I have chosen to do here. The other
technique involves maximal consistent sets, much like in the standard
axiomatic approach. Things must be adapted to tableaus, of course, but
this is the direction I picked because it is considerably simpler.
DEFINITION 4.25 (CONSISTENCY) Call a setS of grounded formulas of
L + (C) consistent if no basic tableau beginning with any finite subset of
S closes. If S is not consistent, call it inconsistent.
Thus a set S is inconsistent if there is a closed tableau beginning with
some finite subset.
DEFINITION 4.26 (MAXIMAL CONSISTENCY)
A set S is maximally
consistent if it is consistent but no proper extension of it is consistent.
For propositional logic, working with maximal consistent sets is sufficient to prove completeness, but with quantifiers involved, more is
needed.
DEFINITION 4.27 (E-COMPLETE)
L + (C) is E-complete if:
A set S of grounded formulas of
64
1 --{1/o:)cll(o:) E S implies --,cp(p) E S for some parameter p.

2 (3o:)cll(o:) E S implies cll(p) E S for some parameter p.
It will be shown that lots of maximal consistent, E-complete sets
exist, and they are Hintikka sets. From this, completeness follows easily. The primary difference between a tableau completeness proof and
an axiomatic one is that with tableaus, maximal consistency and Ecompleteness give us the implications that make up the definition of a
Hintikka set, while in an axiomatic version, these implications become
equivalences. The stronger version, in fact, is more than is needed. But
now, to work.
4.28 If S is a consistent set of closed formulas of L(C),

S can be extended to a maximal consistent, E-complete set of grounded
formulas of L+(c).
PROPOSITION
Proof The set of grounded formulas of L + (C) is countable; let 'lT 1, 'lT 2,
W3, ... be an enumeration of all of them. Also, let PI, P2, P3, ... be an
enumeration of all parameters of L+(C) of all types. Now we construct
a sequence of sets of formulas. Each set in the sequence will meet two
conditions: it is consistent, and infinitely many parameters of each type
do not appear in it. Here is the construction.
Let 8 0 = S. This is consistent by hypothesis, and contains no parameters at all, so both of the conditions are met.
Suppose Sn has been defined, and the conditions are met.
1 If Sn U {'l'n+I} is not consistent, let Sn+l = Sn.
2 If Sn U {'l'n+I} is consistent, and Wn+l is not an existentially quantified formula or the negation of a universally quantified formula, let
Sn+l = Sn U {'l'n+I}
3 Finally, if Sn U {'l'n+I} is consistent, and Wn+l is (3o:)cll(o:), choose
the first parameter p in the enumeration of parameters, of the same
type as o:, that does not appear in Sn or in (3o:)cll(o:), and set Sn+l =
Sn U {(3o:)cll(o:), cll(p)}. And similarly if Wn+l is (Vo:)cll(o:).
Note that Sn+l meets the conditions again. In case 3, consistency needs
a small argument, which I leave to you.
Finally, let 8 00 be SoUS1 US2U .... I leave to you the easy verification
that 8 00 will be consistent, E-complete, and maximal.
4.29 If S is a set of grounded formulas of L+(C) that is
maximal consistent and E-complete, S is a Hintikka set.
PROPOSITION
65
Proof Let S satisfy the hypothesis of the Proposition. It is a simple

matter to verify that S meets each of the Hintikka set conditions. One
is presented as an example.
Suppose we have (>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn) E S, but
(TI, ... , Tn) rf. S; we derive a contradiction.
If S U { (TI, ... , Tn)} were consistent, (TI, ... , Tn) would be in S,
since S is maximally consistent. Consequently S U {( 71, ... , Tn)} is
not consistent, so there is a closed tableau for some finite subset, which
must include (TI, ... ,Tn), since S itself is consistent. Thus there are
formulas X1, ... , Xk E S such that there is a closed tableau, call it
T, beginning with xl, ... ' xk, (TI, ... 'Tn) Now, since we have
(>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn) E S we can construct a tableau
as follows. Begin with
xk
k.
(>.a1, ... , an.(a1, ... , an)}(TI, ... , Tn)

<l>(TI, ... , Tn) k + 2.
k + 1.
In this, the first k + 1 lines are members of S. Line k + 2 is from k + 1 by

an abstract rule. Now continue this tableau to closure by copying over
the steps of tableau T.
This shows there is a closed tableau for a finite subset of S itself, so
S must be inconsistent, which is a contradiction.
Now, finally, we get" the completeness results.
THEOREM 4.30 Let be a closed formula and letS be a set of closed
formulas, all of L( C).
1 If is valid in generalized Henkin models, has a basic tableau proof.
2 If is a generalized Henkin consequence of S, has a basic tableau
derivation from S.
Proof Suppose there is no basic tableau derivation of from S. Then

there is no closed tableau for ...,<f>, allowing members of S to be added
to the ends of open branches. It follows that S U { ...,<f>} is consistent. It
can be extended to a maximal consistent, E-complete set H, by Proposition 4.28. The set His a Hintikka set, by Proposition 4.29. Then by
Corollary 4.24, SU{ -,<f>} is satisfiable in some generalized Henkin model,
and consequently is not a generalized Henkin consequence of S. This
establishes part 2; part 1 has a simpler proof.
66
3.
Miscellaneous Model Theory
Two of the main results about first-order logic are the Compactness
and the Lowenheim-Skolem theorem. I already noted, in Section 3,
that compactness does not hold for "true" higher-order logic. It is also
easy to verify that the Lowenheim-Skolem theorem does not hold, since
one can write a formula asserting an uncountable object exists. But
things are very different if generalized Henkin models are used, instead
of standard models. Then both theorems hold, just as in the first-order
case. Compactness is easy to verify, now that completeness has been
shown. Lowenheim-Skolem takes more work.
THEOREM 4.31 (COMPACTNESS) LetS be a set of closed formulas of
L( C). If every finite subset of S is satisfiable in some generalized Henkin
model, so is S itself.
Proof Suppose S is not satisfiable in any generalized Henkin model-!

show some finite subset of S is also not satisfiable.
Let ..L abbreviate X 1\ X, where X is some arbitrary closed formula
of L( C). Since S is not satisfiable in any generalized Henkin model, ..L is
true in every model in which the members of S are true (since there are
none), so ..Lis a generalized Henkin consequence of S. By Completeness,
..L has a basic tableau derivation from S. A closed tableau, being a
finite object, can use only a finite subset So of S. Now ..L has a basic
tableau derivation from So, so by Soundness, ..Lis a generalized Henkin
consequence of So. If So were satisfiable in some generalized Henkin
model, ..L would be true in it, which is not possible. Consequently S 0 is
unsatisfiable.
The Lowenheim-Skolem theorem for first-order classical logic follows
easily from the observation that models constructed in completeness
proofs are countable. This does not apply directly to the generalized
Henkin models constructed using tableaus. The reason is very simple.
I showed how to construct a generalized Henkin frame M = (1-lH, I,)
starting with a Hintikka set H. In this frame, the Henkin domains
consisted of possible values for grounded terms, Definition 4.9. It is easy
to see that 1-lH(O) must be countable. But say T is a grounded term of
type (0) such that no formulas of the form r(ro) or r(ro) occur in H.
(This can certainly happen-take the Hintikka set H to be the empty
set!) Then (r, S) is a possible value for T for every subset S of 1-lH(O),
so 1-lH( (0)) is uncountable.
We need some way around this difficulty. The main tool is contained
in the following.
67
THEOREM 4.32 (CUT-ELIMINATION) LetS be a finite set of grounded

formulas of L +(C). If there is a closed tableau beginning with S U { <P},
and a closed tableau beginning with S U { --,cp}, then there is a closed
tableau beginning with S.
This Theorem is a version of Gentzen's famous Haputsatz, or cut elimination theorem, for higher-order logic. It is an important result about
classical first-order logic that closed tableaus for SU{ <P} and for SU{ --,cp}
can be constructively converted into one for S. There is no constructive
proof for the higher-order case, but the result can be obtained provided
we are willing to drop constructivity. Such a proof was given in [Pra68]
and in [Tak67], and their argument has appeared here, in disguise, as
a completeness proof. To finish things off I sketch the remaining ideas
involved in a proof of the Theorem.
Proof Suppose there are closed tableaus for S U {<P} and for S U {--,cp}.
Then neither set is satisfiable. It follows that S itself is not satisfiable,
for if there were a generalized Henkin model in which its members were
true, one of <P or --,cp would be true there. It remains to show that the
unsatisfiability of S implies there must be a closed tableau beginning
with S.
Suppose the contrary: there is no closed tableau beginning with S,
so that S is a consistent set. Proposition 4.28 says a consistent set of
L( C) sentences can be extended to a maximal consistent, E-complete
set-the same proof can easily be made to work even if the set contains
parameters, provided it omits infinitely many of them. Since S is finite,
it certainly omits infinitely many parameters, so we can extend it to
a maximal consistent, E-complete set, which must be a Hintikka set.
Corollary 4.24 says Hintikka sets are satisfiable. Since Sis a subset of a
satisfiable set, it too must be satisfiable, but it is not. This contradiction
concludes the proof.
This immediately gives us the following important result.
4.33 (CUT RULE) The addition of the following Cut Rule
to the basic tableau system does not change the class of provable formulas:
at any point split a branch, and add --,cp to one fork, and has a tableau proof, can be added as a line to
any tableau, without expanding the class of provable formulas.
COROLLARY
68
Proof Suppose ~ has a tableau proof, and so there is a closed tableau

for ~. And now suppose we are constructing another tableau, and we
wish to use ~ in that construction, We can proceed as follows.
That is, we have used an application of a cut. Now, on the left branch,
introduce the steps appropriate to close it, which exist because we are
assuming there is a closed tableau for~- This leaves the right branch.
The net effect has been to add ~ to the tableau.
Now, go back through the proof of completeness given earlier. Proposition 4.28 said we could extend a consistent set to a maximal consistent,
E-complete one. Using the work above, it follows that a maximal consistent set must contain either ~ or --,~ for every grounded formula ~.
Since this is the case, each grounded term can, in fact, have only one possible value associated with it. Thus the particular model constructed in
the completeness argument must have countable Henkin domains, since
the family of grounded terms for each type is countable. We thus have
the following.
4.35 (LOWENHEIM-SKOLEM) Let 8 be a set of closed formulas of L(C). If S is satisfiable in some generalized Henkin model, S
is satisfiable in a generalized Henkin model whose domain function 1t
meets the condition that 1t(t) is countable for every type t.
THEOREM
The results above have both good and bad points. It is obviously good
to be able to prove such powerful model-theoretic facts about a logic-it
provides tools for the construction of useful models. The bad side is
that Lindstrom's Theorem says, since the version of higher-order logic
based on generalized Henkin models satisfies the theorems above, it is
simply an equivalent of first-order logic. This does not mean nothing has
been gained. The higher-order formalism is natural for the expression
of things whose translation into first-order versions would be unnatural.
And finally, if a sentence is not provable, it must have a generalized
Henkin counter-model, but if it is provable, it must be true in all generalized Henkin models, and among these are the standard higher-order
models! Thus we have a means of getting at higher-order validities-we
just can't get at all of them this way.
Chapter 5
EQUALITY
The basic tableau rules of Chapter 3 do not give any special role to
equality. It is time to bring it into the picture. This is done by adding
axioms to the tableau system, which has the effect of narrowing things
to normal generalized Henkin models. In addition, some useful derived
tableau rules will be presented.
1.
Adding Equality
Leibniz's principle is that objects are equal just in case they have
the same properties. This principle is most easily embodied in axioms,
rather than in tableau-style rules.
DEFINITION 5.1 (EQUALITY AXIOMS) Each sentence of the following
form is an equality axiom:
(Va)(V,B)[(a =,B)= (V1)(1(a) :) 1(,8))]

In this, = is of type (t, t), for some t, then a and ,B are of type t and 1
is of type (t). EQ denotes the set of equality axioms.
I will show that a closed formula of L( C) is valid in normal generalized Henkin models if and only if has a tableau derivation from
EQ. But before that is done I give some handy derived tableau rules,
and examples of their use.
2.
Derived Rules and Tableau Examples.
There are two derived rules involving equality that are more "tableaulike" in flavor, and are what I primarily use in constructing tableau
proofs and derivations. I do not know if they can serve as full replacements for the official Equality Axioms, since I have been unable to prove
69
70
a completeness theorem using them. Nonetheless, the derived rules below are the ones I generally use in practice.
DEFINITION 5.2 (DERIVED REFLEXIVITY RULE) For a grounded term
T of L +(C), at any point in a proof (T = T) may be added to the end of
a tableau branch. Schematically,
Justification of Derived Reflexivity Rule Let T be a grounded

term of type t. (T = T) can be added to the end of a branch via the
following sequence of steps.
(\fa)(\f/3)[(a = /3)
= (\f'Y)(r(a) :J 'Y(/3))]
(\ff3)[(T = /3) := (\f'Y)('y(T) :J 'Y(/3))]

[(T = T) := (\f'Y)('y(T) :J /(T))] 3.
[(T = T) :J (\fr)(r(T) :J 'Y(T))] 4.
[(\f'Y)('y(T) :J 'Y(T)) ::J (T = T)] 5.
(\f'Y)(/(T) :J 'Y(T)) 6. (T = T)
1.
2.
7.
In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal

rules; 4 and 5 are from 3 by a conjunction rule; 6 and 7 are from 5 by
a disjunction rule. Clearly the left branch continues to closure. The
remaining open branch, the right one, indeed, has (T = T) on it.
The next rule embodies the familiar notion of substitutivity of equals
for equals.
5.3 (DERIVED SUBSTITUTIVITY RULE)
Suppose <J?(a)
is a formula of L +(C) in which the variable a may have free occurrences, but no other variables occur free. Also suppose Tl and T2 are
grounded terms of the same type as a. As usual, let ( Tl) denote the
result of replacing free occurrences of a in ( a) with occurrences of T1;
and similarly for (T2). Then, if both <P(TI) and (Tl = T2) occur on a
tableau branch, ( T2) can be added to the branch end. Schematically,
DEFINITION
<J?( T1)
(T1=T2)
<J?( T2)
Justification of Derived Substitutivity Rule
Assume T1 and T2
are grounded terms of type t, and (TI) and (T1 = T2) occur on a tableau
71
EQUALITY
branch. I show <P( 72) can be added to the end of the branch.
(Va)(V,B)[(a = ,6) = (Vr)('y(a) ::::> 1(,6))] 1.

(\f ,6) [(71 = ,6) := (\fr) ('y(71) ::::> 1'(,6))] 2.
[(71 = 72) := (\7'1')(1'(71) ::::> 1'(72))] 3.
[(71 = 72) ::::> (\f/)('y(7I) ::::> 1'(72))] 4.
[('v'r)('y(7I) ::::> 1'(72)) ::::> (71 = 72)] 5.
(71
/~
72) 6. (\f/)('y(7I) ::::> /(72)) 7.

(Aa.<P(a))(7I) ::::> (Aa.<l>(a))(72) 8.
/
(Aa. <P( a)) (7I)
<1>(71) 11.
9.
(Aa.<P( a)) (72)

<1>(72) 12.
10.
In this, 1 is an equality axiom; 2 is from 1 and 3 is from 2 by universal

rules; 4 and 5 are from 3 by a conjunction rule; 6 and 7 are from 4
by a disjunction rule; 8 is from 7 by a universal rule, using the term
(Aa.<P(a)); 9 and 10 are from 8 by a disjunction rule; 11 is from 9 and
12 is from 10 by a predicate abstract rule. The two left branches are
closed, leaving the right one which contains <1>(72)
Now I give several examples of tableau derivations using the derived
rules. The first example is (intentionally) a simple one. It appeared
earlier as Example 2.9, where an informal reading was given, and validity
was shown directly.
EXAMPLE 5.4 Here is a proof of (AX.(3x)X(x))((Ax.x =c)).
(AX.(3x)X(x))( (Ax.x =c))

(3x)(Ax.x = c)(x) 2.
(Ax.x = c)(c) 3.
1.
(c=c) 4.
(c=c) 5.
In this, 2 is from 1 by an abstract rule; 3 is from 2 by a universal rule;
4 is from 3 by an abstract rule, and 5 is by the derived reflexivity rule.
The next example shows how, by using the derived rules, we can
reverse things and prove a version of the equality axioms.
72
EXAMPLE
5.5 I give a tableau proof (using derived rules, not axioms)
of
(Va)(V,B)[(Vr)('y(a)
1(,8))
~(a=
,B)].
--,(\fa)(V,B)[(V')')('Y(a) ~ 1(,8)) ~ (a= ,B)] 1.

--,(\f,B)[(Vr)(r(P) ~ 1(,8)) ~ (P =,B)] 2.
--,[(Vr)('y(P) :::> r(Q)) ~ (P = Q)] 3.
(Vr)('y(P) ~ 1 (Q)) 4.
--,(P = Q) 5.
(AX.--,(X = Q))(P) ~ (AX.--,(X = Q))(Q) 6.
--,(AX.--,(X = Q))(P)
--,--,(P = Q) 9.
7.
(AX.--,(X = Q))(Q)
--,( Q = Q) 10.
(Q = Q) 11.
8.
Here 2 is from 1, and 3 is from 2 by an existential rule (P and Q

are new parameters of the appropriate type); 4 and 5 are from 3 by a
conjunctive rule; 6 is from 4 by a universal rule, using the grounded term
(AX.--,(X = Q)); 7 and 8 are from 6 by a disjunction rule; 9 and 10 are
from 7 and 8 by abstract rules; 11 is the derived reflexivity rule.
Though the derived tableau rules for equality allow us to prove the
axioms, it does not follow they are their equivalent. To establish that,
we would need to have a cut elimination theorem for the tableau system
with the equality rules. And the way to prove cut elimination is to first
have a completeness proof. I conjecture that such a completeness result
is provable, but I don't know how to do it.
Exercises
2.1 Prove the following characterization of equality-it says
it is the smallest reflexive relation.
EXERCISE
(Vx)(Vy){(x = y)
EXERCISE
= (VR)[(Vz)R(z,z)
R(x,y)]}
2.2 Give a tableau derivation of the following from EQ.
(Va)(V,B)[(a =,B) ~ (Vr)(a('y)
= ,8(1))]
More generally, one can do the same with the following.
EQUALITY
3.
73

The results of this section combine to prove the following.
THEOREM 5.6 Let <P be a closed formula and let S be a set of closed
formulas of L( C).
1 <P is valid in all normal generalized Henkin models if and only if <P
has a tableau derivation from EQ.
2 <P is a consequence of S with respect to normal generalized Henkin

models if and only if <P has a tableau derivation from S U EQ.
The theorem above combines soundness and completeness. One direction, soundness, is almost immediate. Every equality axiom is true in
every normal generalized Henkin model, so the implications from right
to left in Theorem 5.6 follow immediately from Theorems 4.4 and 4.5.
As usual, the completeness direction is more work. The key item is to
prove the following Proposition. Once we have it, completeness follows
immediately using part 2 of Theorem 4.30.
PROPOSITION 5. 7 Given a generalized Henkin model in which all members ofEQ are true, there is a normal generalized Henkin model in which
exactly the same closed formulas of L( C) are true.
The rest of this section is given over to a proof of Proposition 5. 7-it is

broken up into constructions and Lemmas. The ideas are the same as in
Godel's original completeness proof for first-order logic with equalitybring equivalence classes into the picture.
For the rest of this section, assume (M, A) is a generalized Henkin
model, M = (H,I,), and all members of EQ are true in this model.
For 01,02 E H(t), let us write 01 =r 02 as a more readable alternative notation for (01,02) E I(=(t,t)). Thus =r is the interpretation
of the equality constant symbol (of a particular type, which will be indicated only if needed). Since all equality axioms are true in (M, A), it
is an easy consequence that =r is an equivalence relation.
For each 0 E H (t), let 0 be the equivalence class determined by 0,
that is, 0 = {O' I 0 =r O'}. Define a new Henkin domain mapping
by setting H(t) = {0 I 0 E H(t)}. Also, define a new interpretation
by setting I(A) to be the equivalence class containing I(A), that is,
I(A) = I(A).
LEMMA 5.8 If 01 = 02 then (01) = (02)
74
Proof Suppose 01 = 02, that is, 01 =I 02, and say 01 and 02 are of
type (t). In Exercise 2.2 you were asked to give a tableau derivation of
(Va)(Vj])[(a = (3) ::J (V'Y)(a('Y) = {3(/))] from EQ. Then by soundness,
this sentence is valid in (M, A). It follows that (V'Y)(a('Y) = (3(!)) is
also true with respect to any valuation assigning 01 to a and 02 to (3.
From this we immediately get that the sets (01) and (02) must be the
same. A similar argument applies if 01 and 02 are of type (tb ... , tn)
The Lemma above justifies the following. For 0 E 1{ ( (t1, ... , tn)), set
(0) = {(01, ... , On) I (01, ... , On) E (0)}.
We have now created a new generalized Henkin frame M = (?t,I,).
LEMMA
5.9 The generalized Henkin frame M
= (1t,I, )
is normal.
Proof The following calculation establishes normality.

(01, 02) E E(I(=)) {:} (01, 02) E E(I(=))
{:} (01,02) E E(I(=))
{:} 01 =I 02
{:} 01 = 02
For each valuation v in M, let v be the corresponding valuation in

M given by v(a) = v(a). It is easy to see that each valuation in M is
v for some valuation v in M.
LEMMA
5.10 Let T be a predicate abstract. If v1
= v2
then A( v1, T)
=I
A(v2, r).
Proof For convenience say T just has one free variable, 1; the more general case is treated similarly. From now on I'll write T as r('Y). Assume
v1 = v2, hence in particular, v1 (!) =I v2 (!); I'll show A( v1, r('Y)) =I
A(v2, r('Y)).
Let a and (3 be variables of the same type as 1, that do not occur
in r('Y) (free or bound). Since all members of EQ are true in (M, A),
(Va)(Vf3)[(a = (3) ::J (r(a) = r((3))] is true in it, and hence r(a) = r((3)
is true in (M, A) with respect to any valuation v such that v(a) =I v(f3).
Set w to be a particular valuation such that w(a) = v1(!), w(f3) =
v2(!), and otherwise w is arbitrary. Since v1('Y) =I v2(!), we have
w(a) =I w((3), so by the paragraph above, r(a) = r((3) is true in (M, A)
with respect tow, in other words, A(w,r(a)) =I A(w,r(f3)). Also
75
EQUALITY
v~ah}(a) = v1(a{ah}) = v1(r) = w(a). Likewise v~,Bh}(,6) = w(,6).

Thus v~ah} and w agree on the free variables of T(a), and v~,Bh} and
w agree on the free variables of T(,6).
Now since A is proper, we can make use of the conditions of Definition 2.27, and we have the following.
A(v1,T(r)) = A(vi,T(a){ah})
=
A(v~ah},T(a))
A(w, T(a))
=I A(w, T(,6))
=
=A( v~,Bh}, T(,6))

A(V2' T(,6){,6 h})
= A(v2, T(r))
=
This Lemma justifies the following. Define an abstraction designation

function by A(v, (-Xa1, ... ,an.<P)) = A(v, (-Xa1, ... ,an.<P)).
Now the final step.
LEMMA
5.11 For each valuation v in M:
1 (v *I* A)(T) = (v *I* A)(T) for each term T of L(C);

2 M lf-v,A 
M lf-v,A <P for each formula <P of L(C);
3 A is proper, and hence (M, A) is a generalized Henkin model.
Proof Part 1 follows for variables, constant symbols, and predicate abstracts by definition of v, I, and A respectively.
Part 2 is by an induction on the degree of <P, which I leave to you.
Finally, for part 3 it is necessary to verify the three parts of Definition 2.27. I check part 3 and leave the other parts to you. Let 0' be a
substitution that is free for (>.a1, ... , an.<P), a term which I abbreviate
as T. It must be shown that A(v, TO') = A(W, T). We have the following.
A(v, TO')= A(v, TO')

=
A(vu,T)
= A(vu,T)
76
But also we have the following, for each variable o:.

va (o:) = va (o:)
v(o:o-)
= v(o:o-)
= VU(o:)
=
Exercises
EXERCISE 3.1 Give the details of the proof that
=x is an equivalence
relation.
EXERCISE 3.2 Supply the proof of part 2 of Lemma 5.11.
Chapter 6
EXTENSIONALITY
Extensionality says that properties applying to the same objects are

identical. Just as was done with equality in Chapter 5, extensionality
is added via axioms. Throughout this chapter it is, of course, assumed
that equality is available.
1.
Adding Extensionality
The extensionality axioms simply assert the equality of co-extensional

properties.
6.1 (EXTENSIONALITY AXIOMS) Each sentence of the following form is an extensionality axiom, where a and (3 are of type
(tl, ,tn), '/'1 is oftypetl, ... , 'T'n is oftypetn.
DEFINITION
EXT denotes the set of extensionality axioms.
I will show that a closed formula of L( C) is valid in normal Henkin

models (note that I've dropped the qualifier "generalized") if and only
if has a tableau derivation from EQ U EXT. But first some examples.
2.
A Derived Rule and an Example
Extensionality was embodied in a set of axioms. There is a derived

tableau rule that expresses the same idea in a rather more useful form.
DEFINITION
6.2 (DERIVED EXTENSIONALITY RULE)
Suppose T1 and
T2 are two grounded terms, both of type (t1, ... , tn) At any point in a
tableau construction the end of a branch can be split, with one fork labeled
77
78
(71 = 72), and the other fork labeled (7I(PI, ... ,Pn)
72(PI, ... ,Pn))

where Pl, ... , Pn are parameters (of appropriate types) new to the
branch. Schematically, for new parameters:
The justification of this rule is quite straightforward, and I leave it as

an exercise. Here is an example that illustrates the use of this Derived
Extensionality Rule.
EXAMPLE 6.3 I give a proof of the following formula.
(\fx) [(>.X.X(x))(P) (>.X.X(x))(Q)] :::>

(>.X, X, Y.X(X) :::> X(Y))(P,P,Q)
=
=
{(Vx) [(>.X.X(x))(P) (>.X.X(x))(Q)]

:::> (>.X, X, Y.X(X) :::> X(Y))(P, P, Q)} 1.
(\fx) [(>.X.X(x))(P) (>.X.X(x))(Q)] 2.
(>.X,X,Y.X(X) :::> X(Y))(P,P,Q) 3.
--, [P(P) :::> P(Q)]
P(P) 5.
P(Q) 6.
4.
~~
P=Q
--, [P(p) = Q(p)] 7.

(.XX.X(p))(P)
(.XY.Y(p))(Q) 10.
P(Q)
8.
9.
In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3 by an

abstract rule; 5 and 6 are from 4 by a conjunctive rule. Now I apply the
extensionality rule. Take 71 to be P and 72 to be Q, both of which are
grounded, and take p to be a new parameter. We get a split to 7 and 8.
Item 9 is from 5 and 8 by substitutivity, and the right branch is closed.
Item 10 is from 2 by a universal rule. The left branch can be continued
to closure. I leave this to you.
Exercises
EXERCISE 2.1 Give a proof of formula (3.1) from Example 3.12.
EXERCISE 2.2 Show that the rule contained in Definition 6.2 is, in fact,
a derived rule, using EXT.
79
EXTENSIONALITY
3.
I sketch a proof that the sentences having tableau proofs using EQ U

EXT as axioms are exactly the sentences valid in normal Henkin models
(and similarly for derivability as well).
Soundness takes very little work. It just amounts to the observation
that all members of EQ U EXT are valid in normal Henkin models.
Completeness also takes very little work. Using results of Chapter 4,
if a sentence If? does not have a tableau proof using EQ U EXT as axioms,
there is a generalized Henkin model in which If? is false, but in which all
of EQ U EXT are true. I'll show it follows that If? is false in a normal
Henkin model.
Say (M, A), where M = (1t, I,), is a generalized Henkin model
in which the members of EQ U EXT are true but If? is false. Since the
members of EQ are true, by results of Chapter 5 we can take (M, A) to
be normal. I claim it is also extensional in the sense of Definition 2.32,
that is, if (0) = (0') then 0 = 0', where 0 and O' are objects in the
model domain. I now show this.
Suppose (0) = (0'), where 0 and O' are of type (t) for simplicity
(the general case is similar). The following is a member of EXT (in it, a
and {3 are of type (t), and 1 is of type t)
(Va)(V,B){('v'!)[a(/)
= ,8(/)] :) [a= ,8]}
and so this sentence is true in (M, A). Let v be a valuation such that
= 0 and v(f3) = 0'. Then
v(a)
But since (0) = (0') it is easy to see we also have
and so M lf-v,A a= ,6. Since (M,A) is normal, it follows that v(a) =

v({3), that is, 0 = 0'.
Since (M, A) is extensional, it is isomorphic to a Henkin model, as
was shown in Section 6. And trivially, isomorphism preserves sentence
truth.
II
MODAL LOGIC
Chapter 7
MODAL LOGIC
SYNTAX AND SEMANTICS
1.
Introduction
The second part of this book investigates a logic of intensions and

extensions, using a possible world semantics. For purposes of background
discussion in this section, I will assume you have some general familiarity
with possible worlds at least informally. Technical details are postponed
till after that.
First, a point about terminology. The intensional/extensional distinction is an old one. Unfortunately, the word "extensionality" has already
been given a technical meaning in Part I, where Henkin models that did
or did not satisfy the extensionality axioms were considered. The use of
"extension" in this part, while related, is not the same. I briefly tried
using the word "denotation" here, but finally it seemed unnatural, and
I resigned myself to using the word "extension" after all. As a matter of
fact, the Axioms of Extensionality will be assumed throughout Part II
for those terms that will be called extensional, so any confusion of meanings between the classical and the modal settings should be minimal.
The machinery in Part I had no place for intensions-meanings. In a
normal Henkin model, if terms intended to denote the morning star and
the evening star have the same extension, as they do in the real world,
they are equal, and so share all properties. They cannot be distinguished. Montague and his students, notably Gallin, developed a purely
intensional logic. In this, extensions could only be handled indirectlyin some sense an extension could be an intension that did not vary with
circumstances. While this can be made to work, it treats extensions
as second class objects, and leads to a rather complicated development.
83
84
What is presented here is a modification of the Montague/Gallin approach, in which both extensions and intensions are first class objects.
What are the underlying intuitions? An extensional object will be
much as it was in Part I: a set or relation in the usual sense. The added
construct is that of intensional object, or concept, and this is treated
in the Carnap tradition. A phrase like, say, "the royal family of England," has a meaning, an intension. At any particular moment, that
meaning can be used to determine a particular set of people, constituting its extension. But that extension will vary with time. For other
phrases, there may be different mechanisms for determining extensions
as circumstances vary. The one thing common to all such intensional
phrases is that they, somehow, induce mappings from circumstances to
extensions. Abstracting to the minimum useful structure, in a possible
world model an intensional object will be a function from possible worlds
to extensional objects.
Here is an example using the terminology just introduced. Suppose we
take possible worlds as people, with an 85 accessibility relation~every
person is accessible to every other person. And suppose the ground-level
domain is a bunch of real-world objects. Any one person will classify
some of those objects as being red. Because of differences in vision,
and perhaps culture, this classification may vary from person to person.
Nonetheless, there is a common concept of red, or else communication
would not be possible. We can identify it with the function that maps
each person to the set of objects that person classifies as red. And
similarly for other colors. In addition, each person has a notion of color,
though this too may vary from person to person. One person may think
of ultra-violet as a color, another not. We can think of the color concept
as a mapping from persons to the set of colors for that person. If we
assert that red is a color for a particular person, we mean the red concept
is in the extension of the color concept for that person. The extension
of the red concept for that person plays no role for this purpose.
Sometimes extensions are needed too. Certainly if we ask someone
whether or not some object is red, the extension of the red concept, for
that person, is needed to answer the question. Here is another example
in this direction. Assume the word "tall" has a definite, non-fuzzy,
meaning. Say everybody gets together and votes on which people are
tall, or say there is a tallness czar who decides to whom the adjective
applies. The key point is that the meaning of "tall," even though precise,
drifts with time. Average height of the general population has increased
over the last several generations, so someone who once was considered
tall might not be considered so today.
MODAL LOGIC, SYNTAX AND SEMANTICS
85
Now suppose I say, "Someday everybody will be tall." There is more

than one ambiguity here. On the one hand I might mean that at some
point in the future, everybody then alive will be a tall person. On the
other hand I might mean that everybody now alive will grow, and so
at some point everybody now alive will be a tall person. Let us now
read modal operators temporally, so that OX informally means that X
is true and will remain true, and OX means that X either is true or will
be true at some point in the future. Also, let us use T(x) as a tallness
predicate. (The examples that follow assume an actualist reading of the
quantifiers, and eventually I will adopt a version of a possibilist reading.
For present purposes, this is a point of no fundamental importance. For
now, think in terms of varying domain models, with quantifiers ranging
over different domains at different worlds.) The two readings of the
sentence are easily expressed as follows.
('v'x)OT(x)
0(\lx)T(x)
(7.1)
(7.2)
Formula (7.1) refers to those alive now, and says at some point they
will all be tall. Formula (7.2) refers to those alive at some point in the
future and asserts, of them, that they will be tall. All this is standard;
the problem is with the adjective "tall." Do we mean that at some point
in the future everybody (read either way) will be tall as they use the
word in the future, or as we use the word now? If we interpret things
intensionally, T(x) at a possible world would be understood according
to that world's meaning of tall. There is no way, using the present
machinery, to formalize the assertion that, at some point in the future,
everybody will be tall as we understand the term. But this is what is
most likely meant if someone says, "Someday everybody will be tall."
Here is another example, one that goes the other way. Suppose a
member of the Republican Party, call him R, says, "necessarily the proposed tax cut is a good thing." Suppose we take as the possible worlds
of a model the collection of all Republicans, and assume a sentence is
true at a world if that Republican thinks the sentence true. (We assume Republicans are entirely rational, so we don't have to worry about
contradictory beliefs.) Let us now take OX to mean that every Republican thinks X is the case, which means X is necessary for Republicans.
(Technically, this gives us an 85 modality.) How do we formalize the
sentence above? Let c be a constant symbol whose intended meaning
is, "the proposed tax cut," and let G be a "goodness" predicate. Then
OG(c) seems reasonable as a formalization. What should it mean to say
it is true for R?
86
One possibility is that R means every Republican thinks the tax cut
is good, as R understands the word good. This may not be what was
meant. After all, R might consider something good only if it personally
benefitted him. Another Republican might think something good if it
eventually benefitted the poor. Such a Republican probably would not
think a tax cut good simply because it benefitted R but he might believe
it would eventually benefit the poor, and so would be good in his own
sense. Probably R is saying that every Republican thinks a tax cut is
good, for his own personal reasons. The notion of what is good can
vary from Republican to Republican, provided they all agree that the
proposed tax cut is a good thing. But the mere fact that we can consider
more than one reading tells us that a simple formalization like DG(c) is
not sufficient.
Here will be presented a logic of both intension and extension, of
both sense and reference. In one of the examples above, color is an intensional object. It is a function from persons to sets of concepts like
red, blue, and so on. As such, it is the same function for each person.
The extension of color for a particular person is the color function evaluated at that person, and thus it is a particular set of concepts, such
as red but not infra-red, and so on, quite possibly different from person
to person. We need a logic in which both intensions and extensions are
first-class objects. The machinery for doing this makes for complicated
looking formulas. But I point out, in everyday discourse all the machinery is present but hidden-we infer it from our knowledge of what we
think must have been meant. Formalization naturally requires complex
machinery-it is making explicit what our minds do automatically.
2.
Types and Syntax
Now begins the formal treatment, starting with the notion of type. I
want it to include the types of classical logic, as defined in Section 1.
I also want it to include the purely intensional types of the Montague
tradition, as given in [Gal75].
DEFINITION 7.1 (TYPE) The notion of a type, extensional and inten-
sional, is given by the following.
1 0 is an extensional type.
2 If t1, ... , tn are types, extensional or intensional, (t1, ... , tn) is an
extensional type.
3 If t is an extensional type, jt is an intensional type.
A type is an intensional or an extensional type.
87
The ideas behind the definition above are these. As usual, 0 is to

be the type of ground-level objects, unanalyzed "things." The type
(t1, ... , tn) is intended to be analogous to types in part I. The type jt is
the new piece of machinery-an object of such a type will be a function
on possible worlds. Recall the example involving colors from Section 1;
it can be used to give a sense of how these types are intended to be
applied. In that example, real-world objects are those of type 0. A set
of real-world objects is of type (0) so, for instance, the set of objects some
particular person considers red is of this type; this is the extension of
red for that person. The intensional object red, mapping each person to
that person's set ofred objects, is of type j(O). A set of such intensional
objects is of type (j(O)), so for a particular person, that person's set of
colors is of this type-the extension of color for that person. Finally,
the intensional object color, mapping each person to that person's set of
colors, is an object of type i(j(O)).
For another example, assume possible worlds are possible situations,
and the ground-level objects include people. In each particular situation, there is a tallest person in the world. The tallest person, in each
situation, is an object of type 0. The tallest person concept is an object
of type jO-it associates with each possible world the tallest person in
that possible world.
As a final example example, suppose t is an extensional type, so that
jt is intensional. The two-place relation: the intensional object X of type
jt has the extensional object y of type t as its extension, is a relation of
type (jt, t).
The language of Part I must be expanded to allow for modality. Just
as classically, C is a set of constant symbols of various types, containing
at least an equality symbol =(t,t) for each type t, though the set of types is
now larger. Note that the equality symbols themselves are of extensional
type. Using them we can form the intensional terms (>.x, y.x = y) and
(>.x, y.D(x = y)), as needed. We also have variables of each type. There
is one new piece of machinery, an operator l, which plays a role in term
formation. As usual, terms and formulas must be defined together in a
mutual recursion.
DEFINITION
7.2
(TERM OF
L(C)) Terms are characterized as follows.
1 A constant symbol or variable of L( C) of type t is a term of L( C) of

type t. If it is a constant symbol, it has no free variable occurrences.
If it is a variable, it has one free variable occurrence, itself.
2 If is a formula of L( C) and 0:1, ... , O:n is a sequence of distinct
variables of types t1, ... , tn respectively, then (>..o:1, ... , O:n.) is a
88
term of L( C) of the intensional type j (t1, ... , tn). Its free variable
occurrences are the free variable occurrences of , except for occurrences of the variables a1, ... , an.
3 If 7 is a term of L(C) of type jt then 17 is a term of type t. It has
the same free variable occurrences that 7 has.
The predicate abstract (Aa1, ... , an. ) is of type j(t1, ... , tn) above,
and not of type (t1, ... , tn), essentially because can vary its meaning
from world to world, and so (Aa1, ... , an.) itself is world dependent.
Case 3 above makes use of what may be called an extension-of operator, converting a term of an intensional type to a term of the corresponding extensional one. Continuing with the color example, suppose
r is the intensional notion of red, of type j(O), mapping each person to
that person's set of red objects. Then for a particular person, 1r is that
person's set of red objects-the extension of r for that person, and an
extensional object of type (0).
Of course the symbols j and 1 were chosen to suggest their roles-in
a sense 1 'cancels' j. Nonetheless, 1 is a symbol of the language, while j
occurs in the metalanguage, as part of the typing mechanism.
DEFINITION 7.3 (MODAL FORMULA OF L(C))
mula of L( C) is as follows:
The definition of for-
1 If 7 is a term of either type (t1, ... , tn) or type i (t1, ... , tn), and
71, ... , 7n is a sequence of terms of types t1, ... , tn respectively,
then 7(71, ... , 7n) is a formula {atomic) of L(C). The free variable
occurrences in it are the free variable occurrences of 7, 71, ... , 7n
2 If is a formula of L( C) so is -,q>. The free variable occurrences of
-,q> are those of .
3 If and \lT are formulas of L( C) so is ( 1\ \lf). The free variable
occurrences of ( 1\ \lf) are those of together with those of \lf.
4 If is a formula of L(C) and a is a variable then (\fa) is a formula

of L( C). The free variable occurrences of (\fa ) are those of , except
for occurrences of a.
5 If is a formula of L( C) so is D. The free variable occurrences of
D are those of .
Item 1 above needs some comment, and again the example concerning
colors should help make things clear. Suppose r is the intensional notion
of red, of type j(O). And suppose cis an extensional notion of color,
89
the set of colors for a particular person-call the person George. Also
let C be the intensional version of color, mapping each person to that
person's extension of color. cis of type (i(O) ), and Cis of type j(j(O)) I
take both C(r) and c(r) to be atomic formulas. If we ask whether they
are true for George, no matter which formula we use, we are asking if r
is a color for George. But if we ask whether they are true for Natasha,
we are asking different questions. C(r) is true for Natasha if r is a color
for Natasha, while c(r) is true for Natasha if r is a color for George.
No matter which, both c(r) and C(r) make sense, and are considered
well-formed.
I use 0 to abbreviate ...,o..., in the usual way, or I tacitly treat it as
primitive, as is convenient at the time. And of course other propositional
connectives and the existential quantifier will be introduced as needed.
Likewise outer parentheses will often be dropped.
3.
Constant Domains and Varying Domains
Should quantifiers range over what does exist, or over what might
exist? That is, should they be actualist or possibilist? This is really a
first-order question. A flying horse may or may not exist. In the world
of mythology, such a being does exist. In the present world, it does
not. But the property of being a flying horse does not exist in some
worlds and lack existence in others. In the present world nothing has
the flying-horse property, but that does not mean the property itself is
non-existent. Thus actual/possible existence issues really concern type 0
objects, so the discussion that follows assumes a first-order setting.
As presented in [HC96] and [FM98], the distinction between actualist
and possibilist quantification can be seen to be that between varying
domain modal models and constant domain ones. In a varying domain
modal model, one can think of the domain associated with a world as
what actually exists at that world, and it is this domain that a quantifier ranges over when interpreted at that world. In a constant domain
model one can think of the common domain as representing what does
or could exist, and this is the same from world to world. Of course a
choice between constant and varying domain models makes a substantial difference: both the Barcan formula and its converse are valid in a
constant domain setting, but neither is in a varying domain one.
As it happens, while a choice between constant and varying domain
models makes a difference technically, at a deeper level such a choice is
essentially an arbitrary one. If we choose varying domains as basic, we
can restrict attention to constant domain models by requiring the Barcan
formula and its converse to hold. (Technically this requirement involves
an infinite set of formulas, but if equality is available a single formula will
90
do.) Thus when using actualist quantification, we can still determine

constant domain validity. The other direction is even easier. If we
have possibilist-constant domain-:-quantification we can also determine
varying domain validity. And on this topic I present a somewhat more
detailed discussion.
Suppose quantification is taken in a possibilist sense--domains are
constant. Nonetheless, at each world we can intuitively divide the common domain into what 'actually' exists at that world and what does
not. Introduce a predicate symbol E of type j(O) for this purpose. At a
particular world, E(x) is true if x has as its value an object one thinks
of as existing at that world, and is false otherwise. Then the effect of
varying domain quantification can be had by relativising all quantifiers
to E. That is, replace (Vx)r.p by (Vx)(E(x) :) r.p) and replace (3x)r.p by
(3x)(E(x) 1\ r.p). What we get, at least intuitively, simulates an actualist
version of quantification.
All this can be turned into a formal result. Suppose we denote the
relativization of a first-order formula r.p, as described above, by r.pE. It
can be shown that r.p is valid in all varying domain models if and only if
r.pE is valid in all constant domain models. Possibilist quantification can
simulate actualist quantification. I note in passing that [Coc69] actually
has two kinds of quantifiers, corresponding to actualist and possibilist,
though it is observed that a quantifier relativization of the sort described
above could be used instead.
The discussion above was in a first-order setting. As observed earlier,
when higher types are present the actualist/possibilist distinction is only
an issue for type 0 objects. I have made the choice to use possibilist
type 0 quantifiers. The justification is that, first, such quantifiers are
easier to work with, and second, they can simulate actualist quantifiers,
so nothing is lost. When I say they are easier to work with, I mean
that both the semantics and the tableau rules are simpler. So there is
considerable gain, and no loss.
Officially, from now on the formal language will be assumed to contain
a special constant symbol, E, of type j (0), which will be understood
informally as an existence predicate.
4.
Standard Modal Models
I begin the formal presentation of semantics for higher-order modal

logic with the modal analog of standard models. The new piece of semantical machinery added to that for classical logic is the possible world
structure.
91
DEFINITION 7.4 (KRIPKE FRAME)

A Kripke frame is a structure
(Q, R). In it, g is a non-empty set (of possible worlds), and R is a
binary relation on g (called accessibility). An augmented frame is a
structure (Q, R, V) where (Q, R) is a frame, and V is a non-empty set,
the (ground-level) domain.
The notion of a Kripke frame should be familiar from propositional
modal logic treatments, and I do not elaborate on it. As usual, different
restrictions on R give rise to different modal logics. The only two I will
be interested in are K, for which there are no restrictions on R, and
85, for which R is an equivalence relation. Note that the ground-level
domain, V, is not world dependent, since the choice was to take type-0
quantification as possibilist and not actualist.
Next I say what the objects of each type are, relative to a choice of
ground-level domain. This is analogous to what was done in Part I,
in Definition 2.1. To make things easier to state, I use some standard
notation from set theory. The first item is something that was used
before, but I include it here for completeness sake.
1 For sets A1, ... , An, A1 x x An is the collection of all n-tuples of
the form (a1, ... , an), where a1 E A1, ... , an E An. The 1-tuple (a)
is generally identified with a.
2 For a set A, P(A) is the power set of A, the collection of all subsets
of A.
3 For sets A and B, A B is the function space, the set of all functions
from B to A.
DEFINITION 7.5 (OBJECTS, EXTENSIONAL AND INTENSIONAL)
Let
g be a non-empty set (of possible worlds) and let V be a non-empty
set (the ground-level domain). For each type t, I define the collection
[t, V, Q], of objects of type t with respect to V and Q, as follows.
1 [O,V,Q] =V.
2 [(t1, ... , tn), V, Q]
= 'P([t1, V, Q] X" X [tn, V, Q]).
3 [jt, V, Q] = [t, V, Q]g.

0 is an object of type t if 0 E [t, V, Q]. 0 is an intensional or extensional object according to whether its type is intensional or extensional.
As before, 0 is used, with or without subscripts, to stand for objects.
Now the final notion of the section.
92
DEFINITION 7.6 (MODAL MODEL) A (higher-order) modal model for

L(C) is a structure M = (Q, R, V,I), where (Q, R, V) is an augmented
frame and I is an interpretation .. The interpretation I must meet the
following conditions.
1 If At is a constant symbol of type t, I(At) is an object of type t, that

is, I(At) E [t, V, Q].
2 If =(t,t) is an equality constant symbol, I( =(t,t)) is the equality relation
on [t, V,Q].
5.
Truth in a Model
In this section I say how truth is to be assigned to formulas, at worlds,

in models, and how values should be assigned to terms. I lead up to a
proper definition after a few preliminary notions.
DEFINITION 7.7 ((MODAL) VALUATION) The mapping v is a modal
valuation in the modal model M = (9, R, V,I) if v assigns to each
variable at of type t some object of type t, that is, v( at) E [t, V, Q]. The
notion of a variant valuation is defined exactly as classically.
A term like lr is intended to designate the extension of the intensional

object designated by T. To determine this a context is needed-the
designation of T where, under what circumstances? The notation I'll
use for a designation function is (v *I* f)(T), where vis a valuation,
I is an interpretation, and r is a context, a possible world. (In fact the
context only matters for terms of the form lT.)
In specifying the designation of a term, the predicate abstract case
requires information about formula truth. This is more complex than
classically, again because a context must be specified-truth under what
circumstances, in which possible world. The notation for this is a modification of what was used earlier. I'll write M, r lf-v <P to mean formula
<P is true, with respect to valuation v, in model M, at possible world r.
Just as classically, term designation and formula truth must be defined
together, in one big recursion. Definitions 7.8 and 7.9 really are two parts
of the same definition-they have been separated for pedagogical reasons
only.
Recall the special notation that was introduced in Definition 2. 7. That
is extended to the present setting in the obvious way:
means M, r lf-w <P where w is the a1, ... , an variant of v such that
w(ai) = 01, ... , w(an) =On.
93
Let M = (Q, 'R, V,I)

be a modal model, let v be a valuation in it, and let r E g be a possible
world. Define a mapping (v * I * r), assigning to each term an object
that is the designation of that term.
DEFINITION 7.8 (DESIGNATION OF A TERM)
1 If A is a constant symbol of L(C) then (v *I* r)(A) = I(A).
2 If a is a variable then (v *I* r)(a) = v(a).

31fT is a term oftype jt then (v*I*r)(lT) = (v*I*r)(T)(r)
If(>-.a1, ... ,an.4>) isapredicateabstractofL(C) oftypej(tl, ... ,tn),

then (v *I* r) ( (>-.a1, ... , an. 4>)) is the function f on possible worlds
given by the following.
Item 3 is a little awkward to read. (v *I * r) (T) (r) means: evaluate

T using (v * I * r), getting a function, an intension, then evaluate that
function at r. Generally the simpler notation (v * I * r) (T, r) will be
used for this. Similarly for v(a, r) and I( A, r), when a and A are of
intensional type.
Item 4 tells us this is part of a mutual recursion-Definition 7.9 below is the other part. Without using the special notation, part 4 of
Definition 7.8 reads as follows.
4 If (>-.a1, ... , an.4>) is a predicate abstract of L(C) of type j(t1, ... , tn),
then (v * I * r) ( (>-.a1, ... , an. )) is the function that assigns to an
arbitrary world~ the following member of [ (t1, ... , tn), V, Q]:
{(w(a1), ... ,w(an)) I w is an a1, ... ,an variant ofv

and M,~ 11--w }
The next item should be compared with Definition 2.6: worlds (contexts) must now be taken into account.
DEFINITION 7.9 (TRUTH OF A FORMULA) Let M =
(Q, 'R, V,I) be a
modal model, and let v be a valuation in it. The notion of formula

4> being true at world r of g in model M with respect to v, denoted
M, r 11-v 4>, is characterized as follows.
1 For an atomic formula T( Tl, . .. , Tn),
{a) lfT is of an extensional type, M,r 11-v T(TI, ... ,Tn) provided
((v*I*r)(TI), ... ,(v*I*r)(Tn)) E (v*I*r)(T).
94

(b) If T is of an intensional type, M, r lf-v T(T1, ... 'Tn) provided
M' r If-v (1 T) (71' . . . ' Tn). This reduces things to the previous
case.
2 M, r If- v --,<fl if it is not the case that M, r If- v <P.

3
M,r lf-v <P 1\ w if M,r lf-v <P
4 M, r
and M,r lf-v
w.
lf-v (Va)<P if M, r lf-v <P[a/0] for all objects 0 of the same type
as a.
5 M, r lf-v D<P if M, D. lf-v <P for all D. E g such that
rnD..
As usual, other connectives, quantifiers, and modal operators can be

introduced via definitions, with the expected behavior. For instance:
M, r lf-v O<P if M, D. lf-v <P for some D. E g such that rnD..
Note that part 4, the quantifier case, can also be given as follows.
4 M, r lf-v (Va)<P if M, r lf-v' <P for every a-variant v' of v.
It follows from the definitions, that M, r lf-v D<P[ai/0~, ... , an/On]

if and only if M, D. lf-v <P[ai/01, ... , an/On] for all D. such that rnD..
It also follows from the definitions that (.Aa.<P(a))(r) and <P(r) are equivalent under certain circumstances. For instance, this is the case if T is
a constant symbol of either intensional or extensional type. It is not
the case if T involves the extension-of operator, l Rather than give
exact conditions, I give the following, which is more useful for present
purposes-it is an immediate consequence of the definitions above.
PROPOSITION 7.10 Suppose that (v *I* r)(rl) = 01, ... , (v *I*
r)(rn) =On in model M. Then

M, r lf-v (.Aa1, ... 'an.<P)(TI, ... 'Tn) {:;} M, r lf-v <P[ai/01, ... 'an/On]
6.
Validity and Consequence
Validity in a modal setting is now straightforward to define, but consequence has a few surprises, so I've devoted a separate section to the
matter. Let us begin with what is simple.
DEFINITION 7.11 (VALIDITY) A formula is K-valid if it is valid in all models, and is S5-valid if it is valid in
all models for which the accessibility relation is an equivalence relation.
95
I'll only be interested in sentences, for which the choice of valuation

is essentially irrelevant. In addition to the notion of validity in models,
a notion of frame validity can also be introduced. This is an important
concept, but it is not needed for the purposes of this book and I omit
discussion of it.
Logical consequence is inherently more complex than validity. When
asking about the consequences of some set of sentences, one must distinguish between sentences like "it is raining" and "rain is wet." The
first sentence, "it is raining" may be true in present circumstances, but
certainly it is not the case always. The second sentence, "rain is wet,"
presumably is true no matter what-it is independent of circumstance.
This gives rise to an important formal distinction. I'll say something is
a global assumption if we take it to be the case at every possible world,
and something is a local assumption if we take it to be the case in the
current possible world. The two kinds of assumptions behave quite differently. Clearly global assumptions are taken to be not only true, but
necessary. That is not the case with local assumptions.
In the following, I'll use the expression 'true at a world' with the
obvious meaning.
DEFINITION 7.12 (CONSEQUENCE) LetL be one ofK orS5, letS and
U be sets of sentences of L( C), and be a single sentence. is a
consequence of global assumptions S and local assumptions U provided
that for every L model M = (g, R, 'D,I), if members of S are true at
every world in g, then is true at each world at which members of U
are true.
Factual items would, most naturally, be local assumptions, while logical principles would be global. Tableau rules differ for the two kinds of
assumptions. [Fit83] has a detailed discussion of the notions, including
appropriate versions of the deduction theorem. [Fit93] has a somewhat
more abbreviated treatment.
7.
Examples
Here is a simple informal example to start with. Suppose we take

possible worlds to be points in time (within a reasonable range from near
past to near future). Also take the accessibility relation to always hold,
so that D means holds at all times. Does there exist, now, somebody
whose parents are necessarily not alive? Certainly-the oldest person
in the world. After all, the oldest person can never have living parents.
But on the other hand, there was a time when the oldest person had
living parents. There seems to be a discrepancy here.
96
Say cp(x) is read as "x has no living parents." We are asking about
the truth of (3x)Dcp(x). The key question is, what type of variable
is x? If we think of the quantifier as ranging over objects-so x is of
type 0-then when we say the oldest person in the world instantiates
the existential quantifier we are saying a particular person does so. If
we designate the oldest person now as the value of x, instantiating the
existential quantifier, while cp(x) is certainly true now for this value of
x, there are earlier worlds in which the person who is the oldest now
had living parents. Thus we do not have Ocp(x), where x has as value
the oldest person in the present world. The proposed instantiation for
the existential quantifier does not work. More generally, it is easy to see
that (3x)Dcp(x) can never be true, now or at any other point of time,
provided we think of quantifiers as ranging over objects or individuals.
On the other hand if quantifiers range over individual concepts-so
that x is of type jO-we would certainly have the truth of (3x)Dcp(x)
since taking the value of x to be the oldest-person concept would serve
as a correct instantiation of Ocp(x).
The type theory of [Bre72] makes intensional objects basic. The
second-order logic of [Coc69] quantifies over extensional objects at the
first-order level, and over intensional objects at the second-order level.
The higher-order modal logic of [Fit98], which is a forerunner to this
book, had quantification only over extensional objects. The first-order
treatment of [FM98] involves a kind of mixed system, and more will be
said about it shortly. The system of [FitOOb] has quantifiers over types
0 and jO. Clearly many variations are possible.
Now for some further examples, which will be treated more formally.
ExAMPLE 7.13 Suppose x is a variable of type 0 and P is a constant
symbol of type j(O). The following formula is valid, where X is of type
j(O).
(.XX.0(3x)X(x))(P) :::> 0(-AX.(:Jx)X(x))(P)
(7.3)
I leave it to you to verify the validity of this-one way is to show both

the antecedent and the consequent are equivalent to O(:Jx)P(x). On the
other hand, the following formula is not valid, where X is of type (0).
(.XX.O(:Jx)X(x))(lP) :::> 0(-AX.(:Jx)X(x))(lP)
(7.4)
Here is an informal illustration to help you understand intuitively why

this formula is invalid. Suppose that on an island there are two societies,
97
optimists and pessimists, separated by a volcano. Let us say the optimists, while generally positive in their outlook, are quite insecure and
don't accept something as possible (even if true) unless the pessimists
believe it. Further, the optimists think the volcano is beautiful, while
the pessimists think nothing is beautiful.
Take for P the concept of beauty-it maps each society to the set of
things that society accepts as beautiful. For the optimists the formula
(.XX.O(:Jx)X(x))(lP) is true for the following reasons. In the optimist
society the extension of P is the set consisting of the volcano, so the
formula asserts O(:Jx)X(x) is the case, when X is understood to be
that set. For optimists, (3x)X(x) is possible if the pessimists believe
it, and even the pessimists would agree that something is in the set
consisting of the volcano. On the other hand, O(.XX.(:lx)X(x))(lP) is
not true for the optimists, because (.XX.(:Jx)X(x))(lP) is not the case
for the pessimists, and this happens because the pessimists do not think
anything is beautiful.
This informal example can be turned into a formal argument. Here
is a model, M = (g, 'R, 'D,I), in which (7.4) is not valid. The collection
of worlds, Q, contains two members, r and ~' with rn~. Think of
r as the optimists and ~ as the pessimists. The domain, 'D is the set
{7} (think of the number 7 as the volcano). I show 7 available at both
worlds as a reminder that domains are constant. The constant symbol
P is interpreted to be a type j(O) object: the function that is {7} at r
and 0 at ~. Thus I(P) is true of 7 at r, and of nothing at ~. This
gives us the model presented schematically below.
[2]
1
[2]
I(P, r)
= {7}
I(P,~) = 0
The first claim is that, for an arbitrary valuation v, we have
M, r 11-v (.XX.O(:lx)X(x))(lP).
(7.5)
Since (v *I* r)(lP) = (v *I* r)(P, r) = I(P, r) = {7}, by Proposition 7.10 we will have (7.5) provided we have
M,r 11-v O(:lx)X(x)[X/{7}]
(7.6)
98
which will be the case provided we have
M, ~ 11-v (3x)X(x)[X/{7}].
(7.7)
But, since 7 E {7}, we have
M, ~ 11-v X(x)[X/{7}, x/7]
(7.8)
and hence we have (7.7).

We thus have established (7.5). Next it is shown that
M, r IYv O(.XX.(3x)X(x))(!P)
(7.9)
which, together with (7.5), gives us the invalidity of (7.4).

Well, suppose otherwise, that is, suppose we had
M, r 11-v O(.XX.(3x)X(x))(lP).
(7.10)
M, ~ 11-v (.XX.(3x)X(x))(!P),
(7.11)
Then we must have
and so, since (v *I* ~)(!P) =
0,
M, ~ 11-v (3x)X(x)[X/0].
(7.12)
It is easy to see we can not have this, and thus we have (7.9).
EXAMPLE
7.14 This example is one that is unexpected on superficial
consideration, although deeper thought says it should not be. The following formula is valid, with types of variables and constants as in ( 7.4).
(.XX.0(3x)X(x))(!P) :J (.XX.(3x)X(x))(!P)
(7.13)
To show validity, suppose M = (Q, R, V,I) is an arbitrary model,

E g is an arbitrary world, and v is an arbitrary valuation. Suppose
M, r 11-v (.XX.0(3x)X(x))(tp).
(7.14)
M, r 11-v 0(3x)X(x)[X/O]
(7.15)
Then
where 0 = (v *I* r) (lP) = I(P, r). Then, for some
~ E
g such that
rR~,
M, ~ 11-v (3x)X(x)[Xj0]
(7.16)
99
and so, for some object o we have
M, Llll-v X(x)[X/0, xjo].
(7.17)
For (7.17) to be the case, we must have o E 0. Now,
M, r 11-v X(x)[X/0, xjo]
(7.18)
since o E 0. Consequently
M, r 11-v (3x)X(x)[X/O]
(7.19)
M, r 11-v (>.X.(3x)X(X))(!P)
(7.20)
and finally,
since 0 = (v *I* f)(JP).

Since we went from (7.14) to (7.20), the validity of (7.13) has been
established.
Some comments on the example above. The point is, the term 1P
is given broad scope in both the antecedent and the consequent of the
implication. This essentially says its meaning in alternative worlds will
be the same as in the present world. Under these circumstances, existence of something falling under 1P in an alternate world is equivalent
to existence of something falling under !P in the present world. This is
just a formal variation on the old observation that in Kripke models, if
relation symbols could not vary their interpretation from world to world,
modal operators would have no visible effect.
The distinction between intensional and extensional types is complex.
The following two examples should help make clear the role of the 1
operator.
EXAMPLE 7.15 Let x and c be of type jO, and P be of type j(jO). The
following formula is valid.
DP(c) :J (3x)DP(x)
(7.21)
To show (7.21) is valid let M = (g, R, D,I) be an arbitrary model,

be an arbitrary world in g, and v be an arbitrary valuation. Suppose
we had the following.
M, r 11-v DP(c)
Let Ll be an arbitrary world such that fRLl. We must have
(7.22)
100
M, ~ 11-v P(c)
(7.23)
M, ~ 11-v P(x)[xji(c)].
(7.24)
from which it follows that
Since
was arbitrary, we have
M, r 11-v DP(x)[x/I(c)]
(7.25)
M, r 11-v (3x)OP(x)
(7.26)
and hence
Since we went from (7.22) to (7.26), the validity of (7.21) has been
established.
7.16 This continues the previous example. Let c again be of
type jO, but now let x be of type 0 and P be of type j(O). The following
formula is not valid.
EXAMPLE
DP(lc)
:=)
(7.27)
(3x)DP(x)
To show the non-validity of (7.27) a specific model, M = (Q, n, 1J,I),

is constructed. In this model, g consists of three possible worlds: r, ~'
n. We have rn~, rnn, and R holds in no other cases. The domain 1J
is {1, 2}. I interprets c by a function that is 1 at ~' 2 at n, and either
1 or 2 at r (it won't matter). Likewise I interprets P by the function
that is {1} at ~' {2} at n, and some arbitrary value at r. Here is the
model schematically.
~@J
I(c,~) =
I(P,~) =
{1}
n@J
I(c,n) = 2
I(P,O) = {2}
101
I leave it to you to check that (7.27) is not valid in this model.

EXAMPLE 7.17 The last example is in three parts. Consider the following three formulas, in which x, y, and z are of type 0, and X, Y, and Z
are of type jO.
= y)(lZ))(lZ)
(7.28)
(V'z)(..\x.D(..\y.x = y)(z))(z)
(7.29)
(V'Z)(..\X.D(..\Y.X = Y)(Z))(Z)
(7.30)
(V'Z)(..\x.D(..\y.x
Of the formulas above, (7.28) is not valid, but (7.29) and (7.30) are both
valid. I leave the work to you. I note that in [FM98] it was shown
that, in a first-order setting, the constructions used above relate directly
to rigidity. Both extensional and intensional objects, as such, are the
same from world to world, but the extensional object designated by an
intensional object can vary. This is what the example illustrates.
Exercises
EXERCISE 7.1 Show that formula (7.3) is valid.
EXERCISE 7.2 This is a variation on formula (7.13); the formula looks
the same, but the types are different. Show the validity of
(..\X.0(3x)X(x))(jP) :::> (..\X.(3x)X(x))(jP)
where xis of type jO and Pis of type j(jO). The fact that ground level
quantification is possibilist---constant domain-will be needed.
EXERCISE 7.3 Show the validity of the following, which looks a little
like a version of the Barcan formula: 0(3x)P(x) :::> (3X)OP(lX). In
this x is of type 0, X is of type jO and P is of type j(O).
EXERCISE 7.4 Show the non-validity of the following, where x is of type
0, X is of type (0), and Pis of type j(O).

O(:lx)(..\X.X(x))(jP) :::> (:lx)(..\X.OX(x))(lP)
EXERCISE 7.5 Verify the claims made in Example 7.17.
8.
Related Systems
There have been many other versions of quantified modal logics in

the literature. Here I briefly say how a few of them relate to the one
presented here.
102
First-order modal logic, as given in [Fit83] or [HC96] (which also

contains a discussion of intensional objects) has variables and constant
symbols of type 0, and predicate symbols of types j(O, 0, ... , 0). Thus
quantification is over ground-level objects; constant symbols designate
such objects and hence are rigid. Predicates, of course, vary in meaning
from world to world-they are intensional. Treating them extensionally
would force modal logic to collapse to classical.
In [FM98], conventional first-order modal logic is extended by allowing
non-rigid terms, and an abstraction mechanism. Relating things to the
present system, variables are still of type 0, but constant symbols are
of type jO: they are individual concepts. Allowing intensional constant
symbols greatly enhances the expressibility of the language. Predicate
symbols are still of types j(O, 0, ... , 0). The fit between intension and
extension is achieved by treating (Ax.) (c), where cis a constant symbol,
as if it were (Ax.)(lc) in the present system. In effect, this means
the logic of [FM98] can be embedded in the higher-type version given
here. (Actually, this is not quite correct, since the logic of [FM98] allows
function symbols, and partial designation, neither of which is the case
here. But with these exceptions noted, the embedding claim is correct.)
Montague proposed a higher-order modal logic specifically as a logic
of intensions, in [Mon60, Mon68, Mon70]. It is presented most fully in
[Gal75]. Essentially it is the present system with only intensional types
(except at the lowest level). More specifically, define a Gallin/Montague
type, as follows.
1 0 is a Gallin/Montague type.
2 If t1, ... , tn are Gallin/Montague types, so is j(t1, ... , tn)
Then the logic of [Gal75] can be identified with the sublogic of the system
given here, in which all constant symbols and variables are restricted
to be of some Gallin/Montague type. Indeed, the present system was
created by adding extensional types to the logic of Gallin and Montague.
Bressan is a pioneer in the study of higher-order modal logics [Bre72].
I must confess that I do not fully understand his presentation. It is an 85
system rather like that of Gallin, though Gallin's is for a broader variety
of logics. In it extensional objects are not explicitly present, but rather
are identified with constant intensional objects. Also abstractions are
not taken as primitive, but are defined in terms of definite descriptions.
9.
Henkin/Kripke Models
In the classical case there were good reasons for introducing nonstandard higher-order models, and those same reasons apply in the
103
modal case as well. Since modal versions of Henkin and generalized

Henkin models are relatively straightforward extensions of the classical
versions, I confine things to a brief sketch, and refer to Part I and your
intelligence for the details.
Definition 7.4 specified Kripke frames and augmented Kripke frames.

What takes the place of augmented Kripke frames is the following.
DEFINITION 7.18 (HENKIN/KRIPKE FRAME) Let (Q, R) be a Kripke
frame. 1t is a Henkin domain function in this frame if it is a function on the collection of types and:
1 'H(O) is some non-empty set.

2 'H((tl, ,tn)) ~ P('H(h) X X 'H(tn)); 'H((tl, ,tn)) =/=
3 'H(jt) ~ ['H(t)]9; 'H(jt) =I=
0.
0.
T is an interpretation if it maps each constant symbol of L( C) of type

t to a member of'H(t). Finally, M = (Q, R, 'H,T) is a Henkin/Kripke
frame for L(C).
If items 2 and 3 above hold with=, and not just ~.the Henkin/Kripke
model is standard. Standard models correspond exactly to the models
defined in Section 4.
7.19 (ABSTRACTION DESIGNATION FUNCTION) Function

A is an abstraction designation function in the Henkin/Kripke frame
M = (Q, R, 1t, T), with respect to the language L(C), provided that for
each valuation v in M and for each predicate abstract (>.a1, ... , an.cl>)
of L(C) of type t, A(v, (>.a1, ... , an.cl>)) is some object of type t in M.
DEFINITION
Term designation gets the obvious modification.

DEFINITION 7.20 (DESIGNATION OF A TERM)
Let M = (Q, R, 1t,T) be a Henkin/Kripke frame with A an abstraction
designation function in it. For each valuation v, define a mapping (v *

T * r *A) assigning to each term a designation for that term, in the
context (possible world} r.
1 If A is a constant symbol of L(C) then (v * T * r * A)(A) =I( A).
2 If a is a variable then (v * T * r * A)(a) = v(a).
3 Ifr is a term of type jt then (v*T*r*A)(lr)
(v*T*r*A)(r)(r).
If(>.al. ,an.cl>) isapredicateabstractofL(C) oftypej(tl, ,tn),

then (v*T*r*A)((>.al, ,an.cl>)) =A(v,(>.al, ,an.cl>)).
104
As usual, (v *I* r * A)(T, r) is written for (v *I* r * A)(T)(r). Now

truth, at a world, also has the expected characterization.
7.21 (TRUTH OF A FoRMULA) Let M = (Q, R, 1l,I) be

a Henkin/ Kripke frame, let A be an abstraction designation function,
and let v be a valuation.
DEFINITION
1 For an atomic formula T(TI, ... , Tn),

(a) lfT is of an intensional type, M,r lf-v T(TI, ... ,Tn) provided
((v*I*r*A)(TI), ... ,(v*I*r*A)(Tn)) E (v*I*r*A)(T,r).
{b) lfT is of an extensional type, M,r lf-v T(TI, ... ,Tn) provided
( (v * I * r * A) (TI)' .. . ' (v * I * r * A) (Tn)) E (v * I * r * A) (T).
2 M,
lf-v,A if it is not the case that M, r lf-v,A .
3 M, r lf-v,A 1\ wif M, r lf-v,A and M, r lf-v,A
For
w.
of type t, M, r lf-v,A (Va) if M, r lf-v,A [ a/ OJ for every
E 1l(t).
5 M, r lf-v,A D if M, ~ lf-v,A for all~ E g such that rn~.
Finally, the following should be no surprise.

DEFINITION
7.22
(HENKIN/KRIPKE MODEL)
(M, A) is a Henkin/Kripke model provided that, for each predicate abstract (.Xa1, ... , an.) of L(C) of type jt, A(v, (.Xa1, ... , an.)) is the
function f given by the following:
The various theorems concerning uniqueness of an abstraction designation function, if one exists, and the good behavior of substitution
(Section 6) all carry over to the modal setting. I leave this to you.
The semantics just presented is extensional, in the sense of Part I. A
modal analog of generalized Henkin models can also be developed, along
the lines of Section 5. Objects in the Henkin domains are no longer sets,
and an explicit extension function must be added. The generalization is
straightforward but complex, and I also leave this to you.
Chapter 8
MODAL TABLEAUS
1.
The Rules
There are several varieties of tableaus for modal logic. This book uses
a version of prefixed tableaus. These incorporate a kind of naming device
for possible worlds into the tableau mechanism, and do so in such a way
that syntactic features of prefixes reflect semantic features of worlds.
Prefixed tableau systems exist for most standard modal logics. Here I
only give versions for K and 85 since these are the extreme cases. I
refer you to the literature for modifications appropriate for other modal
logics-see [FM98] for instance.
1.1
Prefixes
There are two versions of what are called prefixes. The version for K
is more complex, and variations on it also serve for many other modal
logics. The version for 85 is simplicity itself.
DEFINITION 8.1 (PREFIX) A K prefix is a finite sequence of positive
integers, written with periods as separators {1.2.1.1 is an example). An
85 prefix is a single positive integer.
Think of prefixes as naming worlds in some (unspecified) model. Prefix
structure is intended to embody information about accessibility between
worlds. For K, think of the prefixes 1.2.1.1, 1.2.1.2, 1.2.1.3, etc. as
naming worlds accessible from the world that 1.2.1 names. For 85 one
can take each world as being accessible from each world, so prefixes are
simpler. Prefixes have two uses in tableau proofs, qualifying formulas
and qualifying terms. I begin with terms.
105
106
As was done classically, a larger language allowing parameters is used

for tableau proofs, with parameters for each type. But in addition,
an intensional term T is allowed to have a prefix. If we think of CJ as
designating a possible world, we should think of CJ T as representing the
extensional object that r designates at CT. Formally, if Tis of type jt, then
CJ T is of type t. But writing prefixes in front of terms makes formulas
even more unreadable than they already are. Instead, in an abuse of
language, I have chosen to write prefixes on terms as subscripts, Tr,-,
though of course the idea is the same, and I still often refer to them as
prefixes. So, if one thinks of CJ as designating possible world r, and r as
having the function f as its meaning, then Ta should be thought of as
designating the object f(r).
By L + (C) is meant L( C) enlarged with parameters, and allowing
prefixes (written as subscripts) on terms of intensional type (this includes
parameters, but prefixes will not be needed on free variables that are not
parameters). This extends the classical version of L +(C), since prefixes
are permitted now. But just as classically, in proving a closed formula
of L( C) it is formulas of L + (C) that will appear in proofs.
I said prefixes had two roles. Qualifying formulas is the main one.
DEFINITION 8.2 (PREFIXED FORMULA) A prefixed formula is an expression of the form CJ , where CJ is a prefix and is a formula of
L+(c).
Think of CJ as saying that formula is true at the world that CJ
names. Note that this use of prefixes does not compound, that is, CJ 
is a prefixed formula if is a formula, and not something built up from
prefixed formulas.
DEFINITION 8.3 (GROUNDED) l call a term or a formula of L+(C)
grounded if it contains no free variables, though it may contain parameters.
As usual, tableau proofs are proofs of sentences--closed formulas-of
L(C). In the tableau, prefixed grounded formulas of L+(C) may appear.

To construct a tableau proof of , begin with a tree that has 1 at
its root, and nothing else. Think of 1 as an arbitrary world. This initial
tableau intuitively asserts that is false at some world of some model,
the world designated by 1. Next the tree is expanded according to branch
extension rules to be given below. If we produce a tree that is closed,
which means it embodies a contradiction, we have a proof of .
107
MODAL TABLEAUS
1.2
Propositional Rules
Since the modal tableau rules are rather complex, I've divided their
presentation into categories, beginning here with the propositional ones.
These are much as in the classical case, except that prefixes must be
"carried along." In these, and throughout, I use a, a', and the like to
stand for prefixes.
DEFINITION
8.4 (CONJUNCTIVE RULES) For any prefix a,
aXI\Y
aX
aY
DEFINITION
a (X V Y)
a (X ::) Y)
aX
aY
aX
aY
aX =:Y
aX:=>Y
aY:=>X
8.5 (DOUBLE NEGATION RULE) For any prefix a,
aX
aX
DEFINITION
8.6 (DISJUNCTIVE RULES) For any prefix a,
aXVY
aX laY
aX::)Y
a .x a Y
a (X 1\ Y)
X a ,y
(X
a (X ::) Y)
= Y)
I a (Y ::) X)
This completes the classical connective rules. The motivation should

be intuitively obvious. For instance, if X 1\ Y is true at a world named
by a, both X and Y are true there, and so a branch containing a X 1\ Y
can be extended with a X and a Y.
1.3
Modal Rules
Naturally the rules for modalities differ between the two logics we are
considering. It is here that the structure of prefixes plays a role. The
idea is, if OX is true at a world, X is true at some accessible world,
and we can introduce a name-prefix-for this world. The name should
be a new one, and the prefix structure should reflect the fact that it is
accessible from the world at which OX is true.
8. 7 (POSSIBILITY RULES FOR K) If the prefix a.n is new

to the branch,
DEFINITION
a OX
a.nX
aDX
a.n X
108
DEFINITION 8.8 (POSSIBILITY RULES FOR
85) If the positive integer
n is new to the branch,

aOX
nX
aDX
nX
Notice that for both logics there is a newness condition. This implicitly treats 0 as a kind of existential quantifier. Correspondingly, the
following rules treat 0 as a version of the universal quantifier.
8.9 (NECESSITY RULES FORK) If the prefix a.n already
occurs on the branch,
DEFINITION
OX
a.nX
aOX
a.nX
8.10 (NECESSITY RULES FOR 85) For any positive integer n that already occurs on the branch,
DEFINITION
a OX
nX
aOX
nX
Many examples of the application of these propositional and modal

rules can be found in [FM98J. I do not give any here. Rather, tableau
examples will be given after the full higher-type system has been introduced.
1.4
Quantifier Rules
For the existential quantifier rules parameters must be introduced,

just as in the classical case. Thus proofs of sentences of L( C) are forced
to be in the larger language L + (C).
8.11 (EXISTENTIAL RULES) In the following, pt is a parameter of type t that is new to the tableau branch.
DEFINITION
a (:l<i)cJ>( oJ)
a cf>(pt)
a (Vo:t)cf>( o:t)
a -,cf>(pt)
Terms of the form lT may vary their denotation from world to world
of a model, because the extension of the intensional term T can change
from world to world. Such terms should not be used when instantiating
a universally quantified formula.
8.12 (RELATIVIZED
is a relativized term.
DEFINITION
term,
lT
TERM)
If T is a grounded intensional
MODAL TABLEAUS
109
DEFINITION 8.13 (UNIVERSAL RULES)
In the following, 7t is any

grounded term of type t that is not relativized.
a ('v'at)<P(at)
a (7t)
1.5
a (3at)( at)
a
<l>( 7t)
Abstraction Rules
The rules for predicate abstracts essentially correspond to Proposition 7.10. Note the presence of a subscript (prefix) on the predicate
abstract. We must know at what world the abstract is to be evaluated
before doing so. The next subsection provides machinery for the introduction of these subscripts. Note that the subscript on the abstract, and
the prefix for the entire formula need not be the same.
DEFINITION 8.14 (ABSTRACT RULES) In the following, 71, ...
,7n
are
non-relativized terms.
a' (>.a1, ... , an.<P( a1, ... , an)) u( 71, ... , 7n)
a<fl(71, ... ,7n)
a' (.Aa1, ... , an.<P( a1, ... , an)) u( 71, ... , 7n)
a --,<fl(71, ... , 7n)
1.6
Atomic Rules
Unlike classically, much can be done with atomic formulas in a modal

tableau besides just using them to close branches. The first atomic rule
says that, at a world, an intensional predicate applies to terms if those
terms are in the extension of the predicate at that world. It corresponds
to part 1a of Definition 7.9.
DEFINITION 8.15 (INTENSIONAL PREDICATION RULES)
Let 7 be a
grounded intensional term, and 71, ... , 7n be arbitrary grounded terms.
a7(71, ... , 7n)
a (17)(71, ... , 7n)
a7(71, ,7n)
a(l7)(71, ,7n)
Relativized terms denote different objects in different worlds. In

tableaus, their behavior depends on the prefix of the formula in which
they appear. This leads us to the evaluation of relativized terms at prefixes. Think of 7@a as 7 evaluated at a. On non-relativized terms, such
evaluation has no effect-their meaning is world independent.
DEFINITION 8.16 (EVALUATION AT A PREFIX) Let a be a prefix.
110
1 For a relativized term lT, set (lT)@O" = Tu.
2 For a non-relativized term T, set T@O"
= T.
The next rule covers the case of an extensional predicate applying to

terms. This corresponds to part lb of Definition 7.9.
DEFINITION 8.17 (EXTENSIONAL PREDICATION RULES)
Let T be a
grounded extensional term, and Tl, ... , Tn be arbitrary grounded terms.
Here is a simple example of how these rules work. Suppose A is of

intensional type j(O) and b is of type 0. If O" A(b) occurs on a branch,
we may add O" (lA)(b) by an Intensional Predication Rule. Now the
Extensional Predication Rule applies; (lA)@O" = A,. and b@O" = b, so
we may add O" Au(b). Think of this as saying, since A(b) is true at the
world that O" designates, then b is in the extension of A at that world,
an extension represented by Au.
Finally, there are atomic formulas that must evaluate the same way
no matter what world is involved.
DEFINITION 8.18 (WORLD INDEPENDENT) We call an atomic formula
T(T1, ... ,Tn) world independent if none ofT, Tl, ... , Tn is relativized,
and T is of extensional type.
DEFINITION 8.19 (WORLD SHIFT RULES) Let T(Tl, ... , Tn) be world
independent. If 0"1 already occurs on the branch,
O"T(Tl,. ,Tn)
0" 1 T( Tt, ... , Tn)
1. 7
0"-,T(Tl, ,Tn)
0"1 -,T(Tl, ... , Tn)
Proofs and Derivations
I'll begin with the easy part.

DEFINITION 8.20 (CLOSURE) A tableau branch is closed if it contains
O" w and O" -.w, for some formula W of L+(C). A tableau is closed if each
branch is closed.
DEFINITION 8.21 (TABLEAU PROOF)
For a sentence <P of L(C), a
closed tableau beginning with 1 -.<P is a proof of <P.
A brief discussion of the complexities of modal consequence is in Section 6. More discussion can be found in [Fit83, Fit93, FM98]. Corresponding to the local/global semantic distinction of Definition 7.12, we
have the following tableau version.
MODAL TABLEAUS
111
DEFINITION 8.22 (LOCAL AND GLOBAL ASSUMPTIONS) Let 8 and U

be sets of sentences of L( C). A tableau uses S as global assumptions and
U as local assumptions if the following two tableau rules are admitted.
Local Assumption Rule If Y is any member of U then 1 Y can be

added to the end of any open branch.
Global Assumption Rule If Y is any member of S then a Y can be

added to the end of any open branch on which a appears as a prefix.
DEFINITION 8.23 (TABLEAU DERIVATION) A sentence has a derivation from global assumptions S and local assumptions U if there is a
closed tableau beginning with 1 --,<]>, allowing the use of U and S as local
and global assumptions respectively.
This concludes the presentation of the basic tableau rules. It is a
rather complex system. In Section 2 I give a few examples of proofs using the rules. I omit soundness and completeness proofs. The arguments
are elaborations of those given earlier for classical logic. Complexity of
presentation goes up, but no fundamentally new ideas arise. Consequently they are left as a huge exercise.
There is one important consequence of the completeness proofs that
we will need, however, and that is the fact that the system has the cutelimination property-see Theorem 4.32. Just as in the classical case
(Corollary 4.34), it is a consequence of this that any previously proved
result can simply be introduced into a tableau.
2.
Tableau Examples
Tableaus for classical logic are well-known, and even for propositional
modal logics they are rather familiar. The abstraction and predication
rules of the previous section are new, and I give two examples illustrating their uses. The examples use the K rules; I do not give examples
specifically for S5 here.
EXAMPLE 8.24 This provides a proof for (7.3) which was verified valid
in Example 7.13. The formula is
(>.X.()(:Jx)X(x))(P) :J ()(>.X.(:lx)X(x))(P)
in which x is a variable of type 0 and X is a variable and P a constant
symbol, both of type j(O).
112
1 ..,[(.XX.O(::Jx)X(x))(P) :J 0(-XX.(::Jx)X(x))(P)]
1 (.XX.O(::Jx)X(x))(P) 2.
1 --,0(-XX.(::Ix)X(x))(P). 3.
1
l(.XX.O(::Jx)X(x))(P) 4.
1 (.XX.O(::Jx)X(x))I(P) 5.
1
O(::Jx)P(x) 6.
1.1 (::lx)P(x) 7.
1.1--,(.XX.(::Jx)X(x))(P) 8.
1.1--, l(.XX.(::Ix)X(x))(P) 9.
1.1--,(.XX.(::Jx)X(x))u(P) 10.
1.1--,(::lx)P(x) 11.
1.
In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by intensional predication; 5 is from 4 by extensional predication; 6 is from 5 by
predicate abstraction; 7 is from 6 by a possibility rule; 8 is from 3 by a
necessitation rule; 9 is from 8 by intensional predication; 10 is from 9 by
extensional predication; and 11 is from 10 by predicate abstraction.
It should be obvious that useful derived rules could be introduced.
For instance, the passage from 2 to 4 to 5 to 6 could be collapsed. Such
rules are given in the next section.
EXAMPLE
8.25 Here is a proof of (7.13), which was shown to be valid
earlier.
{.XX.O(::Jx)X(x))(jP)
:J
(.XX.(::Ix)X(x))(jP)
See Example 7.14 for a discussion of the significance of this formula.
1
1
1
1
1
1
1
1
--,[(.XX.O(::Ix)X(x))(jP) :J (.XX.(::Jx)X(x))(jP)]
(.XX.O(::Jx)X(x))(jP) 2.
--,(.XX.(:3x)X(x))(1P) 3.
1(-XX.O(::Ix)X(x))(jP) 4.
--, 1(-XX.(::Jx)X(x))(lP) 5.
(.XX.O(::Jx)X(x))I(Pl) 6.
--,(.XX.(::Ix)X(x))I(PI) 7.
O(::Jx)P1(x) 8.
1 --,(::Jx)PI(x) 9.
1.1 (:3x)P1 (x) 10.
1.1 P1(p) 11.
1
P1(p) 12.
1
--,pl (p)
1.
13.
In this, 2 and 3 are from 1 by a conjunction rule; 4 is from 2 and 5 is from

3 by intensional predication; 6 is from 4 and 7 is from 5 by extensional
113
MODAL TABLEAUS
predication; 8 is from 6 and 9 is from 7 by predicate abstraction; 10 is

from 8 by a possibility rule; 11 is from 10 by an existential rule; 12 is
from 11 by a world shift rule; and 13 is from 9 by a universal rule.
Exercises
EXERCISE 2.1 Give a tableau proof of the following
(>.X.O(:lx)X(x))(tP) :J (>.X.(:lx)X(x))(lP)
where xis of type jO, X is of type (jO) and Pis of type j(jO).
EXERCISE 2.2 Give a tableau proof of the following
O(:lx)P(x) :J (:lX)OP(lX)
where x is of type 0, X is of type jO and Pis of type j(O).
3.
A Few Derived Rules
The tableau examples in the previous section are short, but already
quite complicated to read. In the interests of keeping things relatively
simple, a few derived rules are introduced which serve to abbreviate
routine steps.
DEFINITION 8.26 (DERIVED CLOSURE RULE) Suppose X is a world
independent atomic formula. A branch closes if it contains a X and
a' -,x.
The justification for this is easy. Using the World Shift Rule, if a X
is on a branch, we can add a' X, and then the branch closes according
to the official closure rule.
The official rule concerning intensional predication has a slightly more
efficient version, in which we first apply intensional, then extensional
predication rules.
DEFINITION 8.27 (DERIVED INTENSIONAL PREDICATION RULE) Let
be a grounded intensional term, and T1 , ... , Tn be arbitrary grounded
terms.
Also here are two derived rules for predicate abstracts, one in which
the abstract has a prefix (subscript), one in which it does not.
114
8.28 (DERIVED SUBSCRIPTED ABSTRACT RULE)

In the following, 71, ... , 7n are arbitrary grounded terms.
DEFINITION
a' (.Xa1, ... , an.<P(a1, ... , an))u(71, ... , 7n)
a<P(71@a', ... ,7n@a')

a'(Aa1, ,an.<P(a1, ,an))u(71, ,7n)
a -.<P(71 @a', ... , 7n@a')
This abbreviates the application of the extensional predication rule, followed by predicate abstraction.
8.29 (DERIVED UNSUBSCRIPTED ABSTRACT RULE)

In the following, 71, ... , 7n are grounded terms.
DEFINITION
a(.Aat, ... ,an.<P(a1, ,an))(7t, ... ,7n)

a <P(71 @a, ... , 7n@a)
a
(.Xa1, ... , an.<P(a1, ... , an))( 71, ... , 7n)

IT iP( 71 @a, ... , 7n@a)
This rule abbreviates successive applications of intensional predication,

extensional predication, and predicate abstraction.
Chapter 9
MISCELLANEOUS MATTERS
This chapter is something of a grab-bag. Some familiar topics, like

equality, and some less familiar, like choice functions, are discussed.
1.
Equality
The tableau rules of the previous chapter do not mention equality or

extensionality. These are treated exactly as in the classical setting, via
axioms, though as we will see, extensionality requires some care.
1.1
Equality Axioms
If we want to take equality into account, we use the Equality Axioms,

Definition 5.1, as global assumptions. From here on these will be assumed
in this book.
In Chapter 5 I presented some tableau rules that were derivable classically provided equality axioms were allowed. In the modal setting these
rules (with prefixes added, of course) are also derived rules. They are
stated again for reference.
Reflexivity Rule For a grounded, non-relativized term 7, and a prefix

a
that is already present on the branch,
Substitutivity Rule For grounded, non-relativized terms 71 and 72,

a <P(Tl)
a
(71 = 72)
IP(72)
115
116
Here is an example that uses equality. To help understand what the

example says, and see why it ought to be valid, I give an informal interpretation for it.
Suppose we read modal operators temporally, so that OX means X
will be the case no matter what the future brings, and OX means the
future could turn out to be one in which X is true. Let p be a type
jO constant symbol intended to be read, "the President of the United
States." Thus pis an individual concept, and designates different people
in different possible futures.
Now, call a person Presidential material if the person could be President (say the person meets all the legal requirements, such as being at
least 35, not having already served twice, and so on). Being Presidential
material is a property of persons. If we assume we have a model whose
domain is the population of the United States, being Presidential material is a type j (0) object and is expressed by the following abstract,
where xis of type 0.
(>.x.O(lp = x))
Informally, this predicate applies to a person at a particular time if
there is some possible future in which that person is the President of the
United States.
Next, call a property of persons statesmanlike if it will always apply to the President. Thus we are using statesmanlike as a property
of properties of persons-being diplomatic is hopefully a statesmanlike
property, for instance. As such, being statesmanlike is of type j((O)).
It is expressed by the following abstract, where X is of type (0), and
applies to those properties that will always belong to the President, no
matter who that will be.
(>.X.DX(lp))
Now, the extension of the property of being Presidential material is a
statesmanlike property since, no matter who turns out to be President,
that person must have been of Presidential material. The following gives
a tableau verification for this.
EXAMPLE
9.1 Here is a proof of the formula:
(>.X.DX(lp))(t(>.x.O(lp = x)))
117
1 (.AX.DX(lp))(l(.Ax.O(lp = x)))
1 D(.Ax.O(lp = x))I(lp) 2.
1.1(.Ax.O(lP = :t))I(lP) 3.
1.1(Ax.O(lp = x))I(pu) 4.
1 O(lP=pu) 5.
1.1(1P = Pu) 6.
1.1(Pu = Pu) 7.
1.1 (pu = Pu) 8.
1.
In this 2 is from 1 by the derived unsubscripted abstraction rule; 3 is

from 2 by a possibility rule; 4 is from 3 by extensional predication; 5 is
from 4 by a predicate abstract rule; 6 is from 5 by a necessity rule; 7 is
from 6 by extensional predication; 8 is by the derived reflexivity rule.
1.2
Extensionality
Extensionality can, of course, be imposed by assuming the Extensionality Axioms of Chapter 6, Definition 6.1, as global assumptions. The
trouble is, doing so for intensional terms yields undesirable results, as
the following shows.
9.2
Assume the Extensionality Axioms apply to intensional terms. If a and f3 are of intensional type j(t), then the following
is valid.
PROPOSITION
(Va)(V,B)[(la =l/3) ~ (a= ,B)]
The proof of this is left to you. It is almost immediate, using the

Intensional Predication Rules. The problem with this result is, it tells
us that if two intensional objects happen to coincide in extension at
some world, then they are identical and hence coincide at every world.
Clearly this is undesirable, so extensionality for intensional terms is not
assumed.
If two intensional objects agree in extension at every possible world of
a model they are, in fact, the same. Saying this requires a quantification
over possible worlds, which we cannot do. The following is as close as
we can come.
9.3 (EXTENSIONALITY FOR INTENSIONAL TERMS) For a

and f3 of the same intensional type,
DEFINITION
(Va)(V,B)[D(la
=l/3)
~(a= ,B)]
I will assume this at some points, but I will be explicit when. For
extensional terms, the extensionality axioms pose no difficulty and will
always be assumed. Let me make this official.
118
Extensionality Assumptions From now on, the extensionality axioms will be assumed for extensional terms as global assumptions. For
intensional terms extensionality, Definition 9.3, will only be assumed if
explicitly stated.
I restate the extensionality axioms here for convenience.
9.4 (EXTENSIONALITY FOR EXTENSIONAL TERMS)
Each sentence of the following form is an extensionality axiom, where
a and {3 are of type (t1, ... , tn), 11 is of type t1, ... , In is of type tn.
DEFINITION
('v'a)('v'{3){('v'11) ('v'ln)[a(/'1, . , In)= {3(/'1, ... , In)] :J [a= {3]}

In Chapter 6 a derived tableau rule for extensionality was given, assuming the extensionality axioms. Once again, it is still a derived rule
for modal tableaus. Here is a statement of it.
Extensionality Rule For grounded, non-relativized extensional terms

T1 and T2, and for parameters P1, ... , Pn that are new to the branch,
(}--, [T1(P1, ,pn)
2.
= T2(P1, ,Pn)JI (} (T1 = T2)
De Re and De Dicto
Loosely speaking, asserting the necessary truth of a sentence is a de

dicta usage of necessity; for example, "it is necessary that the President
of the United States is a citizen of the United States." This asserts the
necessary truth of the sentence, "the President of the United States is
a citizen of the United States." For this to be the case, it must be so
under all circumstances, no matter who is President, and since being a
citizen of the United States is a requirement for the Presidency, this is
the case. Ascribing to an object a necessary property is a de re usage; for
example, "it is a necessary truth, of the President of the United States,
that he is at least 50 years old." This asserts, of the President, that he
is and always will be at least 50 years old. Since the President, at the
time of writing, is Bill Clinton, and he is at the moment 53 years old
and will never be younger than this, this assertion is correct. But since
the Constitution of the United States only requires that a President be
at least 35, the assertion may not be true in the future, for a different
President. If an object is identified using an intensional term, it makes a
serious difference whether that term is used in a de dicta or a de re context, as the examples involving the Presidency illustrate. In this section
the formal relationship between the two notions is explored. As will be
seen over the next several sections, this also relates to other interesting
concepts that have been part of historic philosophical discourse.
119
In the next few paragraphs, f3 is of some extensional type t, and Tis

of the corresponding intensional type jt.
Consider the expression (.Xf3.D<l>(f3))(1 T), where <P(/3) is some formula with only f3 free (for simplicity). Say the expression is true at
a world of a modal model. (I use a generalized Henkin/Kripke model,
but what is said applies to any version--extensional, standard-just as
well.) Thus suppose M, f lf-v,A (.Xf3.D<l>(f3))(lT). Let Or be the object
that T designates at r, that is, (v*I*r*A)(T,f) =Or. Then we have
M, r lf-v,A D<l>(/3)[/3/0r]. So at every alternative world, .6., we have
M, .6. lf-v,A <P(/3)[!3/0r], that is <P(/3) is true, at .6., of the object that T
designates at r. The effect is that (.Xf3.D<l>(f3))(1T) asserts, of the object
designated by T at r that it has a necessary property. This is a de re
use of necessity-ascribing a necessary property to a thing.
Next consider the expression D(.Xf3.<l>(f3))(1 T). This asserts the necessity of a sentence. It is a de dicta use of necessity-applying it
to a sentence, a dictum. And in general the behavior is quite different from the de re version. If M,r lf-v,A D(.Xf3.<l>(f3))(1 T), then
at each alternative world .6. we have M, .6. lf-v,A (.Xf3.<l>(f3))(1 T), and
so M, .6. lf-v,A <P(f3)[w/O.!l], where oil is the designation of T at .6.,
something that depends on .6.. We can thus think of the assertion
D(.X/3.<1>(/3))(1 T) as being concerned with the sense ofT and not just
with the object it happens to denote in "our" world-we use the local
desigmrtion of T, which can vary from world to world.
One remarkable thing about de re and de dicta is that, if either happens to imply the other, for a particular term, then the two turn out to
be equivalent for that term. The following makes this precise. In the
next section the phenomena is linked to the notion of rigidity.
DEFINITION
9.5 (De Re/ De Dicta) LetT be a term of intensional type

t, and o: be a variable of type j(t). In a model:
jt, f3 be a variable of type
1 de re is equivalent to de dicto for T if the following is valid.
(Vo:)[(.Xf3.Do:(f3))(1T)
= D(.Xf3.o:(f3))(1T)]
2 de re implies de dicto for T if the following is valid.
(Vo:)[(.Xf3.Do:(f3))(1T) ::) D(.Xf3.o:(f3))(1T)]

3 de dicto implies de re for T if the following is valid.
(Vo:)[D(.A,B.o:(,B))(lT)
:J
(.A,B.Do:(,B))(tr)]
The formulas above are allowed to be open--free variables may be

present. Equivalently, one can work with universal closures. In [FM98]
120
we used schemas instead of the formulas given above, because that was
a first-order treatment and we did not have the higher-type quantifier
(Vo:) available. The interesting fact about the three notions above is:
they all say the same thing.
PROPOSITION
9.6 For any intensional term
T,
the following are equiv-
alent (in K).

1 de dicto is equivalent to de re for
2 de dicto implies de re for
3 de re implies de dicto for
Proof Obviously item 1 implies items 2 and 3. I give a tableau proof,

in K, showing that item 2 implies item 3. A similar argument, which
I leave to you, shows that item 3 implies item 2, and this is enough to
complete the proof of the Proposition. To keep things simple, assume T
has no free variables. Here is a closed tableau for (Vo:)[(.A,B.Do:(,6))(l
T) => D(.A,B.o:(,B))(lT)], (negation of) de re implies de dicto. In it, at a
certain point, use is made of an instance of the de dicto implies de re
schema. The tableau begins as follows.
1 (Vo:) [(.A,B.Do:(,B))(lT) => O(.A,B.o:(,B))(lT)] 1.

1 ..., [(.A,B.D<P(,B))(lT) => D(.A,B.(,B))(lT)j 2.
1 (_A,6.0<l>(,6))(1T) 3.
1 D(.A,B.<l>(,B))(lT) 4.
1 D( Tl) 5.
1.1(A,6.<J?(,6))(1T) 6.
1.1<l>(Tu) 7.
1.1 <f>(Tl) 8.
1 (Vo:)[O(.A,B.o:(,B))(lT) =:> (.A,B.Do:(,B))(lT)] 9.
1 D(.A,B.(AJ'.<l>(J') => <P(lT))(,B))(lT)
(.A,B.D(.A')'.<P(/') =:> <P(lT))(,6))(lT) 10.
Item 2 is from 1 by an existential rule, using <P as a new parameter of
type j(t); items 3 and 4 are from 2 by a conjunctive rule; 5 is from 3
by an unsubscripted abstract rule; 6 is from 4 by a possibility rule; 7 is
from 6 by an unsubscripted abstract rule; 8 is from 5 by a necessity rule.
Item 9 is a de dicto implies de re formula; and item 10 is from 9 by a
universal rule, using (.A')'.<P(/') =:> <P(lT)) to instantiate the quantifier.
Using item 10, the tableau splits into two branches. I first present the
left one, and afterwards the right.
121
1 D(.A,6.(A'Y.cf>(r) :) cf>(lT))(,6))(lT) 11.

1.2 (A,6.(A/.cf>(r) :) cf>(lT))(,6))(1T) 12.
1.2 (A/.cf>(r) :) cf>(lT))(Tl.2) 13.
1.2 [cf>(TL2) :) cf>(lT)) 14.
1.2 cf>( TL2) 15.
1.2 --,cf>(lT) 16.
1.2 cf>1.2(T1.2) 17.
1.2 --,cf>L2(71.2) 18.
Item 11 is from 10 by a disjunctive rule (recall, this is the left branch);
12 is from 11 by a possibility rule; 13 is from 12 and 14 is from 13 by
an unsubscripted abstract rule; 15 and 16 are from 14 by a conjunctive
rule; 17 is from 15 and 18 is from 16 by a derived intensional predication
rule. The branch is closed because of 17 and 18.
Now I show the right branch, below item 10.
1 (.A,6.0(A/.cf>(r) :) cf>(lT))(,6))(1T)
1 D(.A,.cf>('y) :) cf>(lT))(Tl) 20.
1.1 (A/.cf>(r) :) cf>(lT))(Tl) 21.
1.1 cf>(Tl) :) cf>(lT) 22.
/
1.1-.cf>(Tl)
19.
23. 1.1 cf>(lT) 24.

1.1 cf>u (Tu) 25.
1.1 cf>u (Tu) 26.
In this part, 19 is from 10 by a disjunctive rule; 20 is from 19 by an

unsubscripted abstract rule; 21 is from 20 by a necessity rule; 22 is
from 21 by an unsubscripted abstract rule; 23 and 24 are from 22 by a
disjunctive rule; 25 is from 24 and 26 is from 7 by a derived intensional
predication rule. Closure is by 8 and 23, and by 25 and 26.
Exercises
EXERCISE 2.1 Give the tableau proof needed to complete the argument
for Proposition 9.6.
3.
Rigidity
In [Kri80] the philosophical ramifications of the notion of rigidity are

discussed at some length, with a key claim being that names are rigid.
The setting is first-order modal logic, treated informally. A term is taken
to be rigid if it designates the same thing in all possible worlds. In [FM98]
122
we modified this notion somewhat so that a formal investigation could

more readily be carried out-we called a term rigid if it designated the
same thing in any two possible worlds that were related by accessibility.
The idea is that the behavior of a term in an unrelated world should
have no "visible" effect. It is this modified notion of rigidity that is used
here, and it will be seen that it can be expressed directly if equality is
available. (Whether models are standard, Henkin, or generalized Henkin
does not matter for what we are about to do, only that they are normal.)
For the rest of this section, normality is assumed.
9. 7 The intensional term T is rigid in a normal model if

the following is valid in it.
DEFINITION
It is easy to see that the formula asserting rigidity of T is true at a

world r of a normal model if and only if, at each world accessible from
r, T designates the same object that it designates at r itself. Thus
asserting validity for the rigidity formula indeed captures the notion of
rigidity for terms that we have in mind.
If an intensional term is rigid, it does not matter in which possible
world we determine its designation. But then, if both necessitation and
designation by a rigid intensional term are involved in the same formula,
it should not matter whether we determine what the term designates
before or after we move to alternative worlds when taking necessitation
into account. In other words, for rigid intensional terms the de re/ de
dicto distinction should vanish. In fact it does, and as it happens, the
converse is also the case. The following is a higher order version of a
first order argument from [FM98].
9.8 In K, the intensional term T is rigid if and only if

the de re/de dicto distinction vanishes, that is, if and only if any (and
hence all) parts of Proposition 9. 6 hold.
PROPOSITION
Proof This is shown by proving two implications, using tableau rules

for K including rules for equality.
Let A be the formula (A,6.0(,8 =lT))(lT) and let B be the formula
('v'a)[D(A,6.a(,B))(T) :J (A,6.0a(,6))(T)]. A says T is rigid, while B says
de dicto implies de re for T. I first give a tableau proof of A :J B.
123
1 (A :J B) 1.
1
(,\,6.0(,6 =17))(17) 2.
1 (Va)[0(,\,6.a(,6))(17) :J (>.,6.0a(,6)}(17)]
1 [0(>.,6.<1>(,6))(17) :J (>.,6.0<1>({3))(17)] 4.
1
0(,\,6.<1>(,6))(17) 5.
1 (A,6.0(J3)}(17) 6.
1 D( 71) 7.
1.1<1>(71) 8.
1.1 (,\,6.<1>({3))(17) 9.
1.1 <l>( 71.1) 10.
1
0(71 =17) 11.
1.1 (71 =17) 12.
1.1 71 = 71.1 13.
1.1 <l> (71.1) 14.
3.
In this tableau, 2 and 3 are from 1 by a conjunctive rule; 4 is from 3

by an existential rule, with as a new (intensional) parameter; 5 and 6
are from 4 by a conjunctive rule; 7 is from 6 by a derived unsubscripted
abstract rule; 8 is from 7 by a possibility rule; 9 is from 5 by a necessity
rule; 10 is from 9 and 11 is from 2 by a derived unsubscripted abstract
rule; 12 is from 11 by a necessity rule; 13 is from 12 by a derived unsubscripted abstract rule; and 14 is from 8 and 13 by a derived substitutivity
rule for equality.
Finally I give a tableau proof of B :=:> A.
1 (B :J A) 1.
1
(Va)[D(>.,6.a(,6)}(17) :J (>.,6.0a(,6))(l7)] 2.
1 (A,6.0(,6 =17)}(17) 3.
1
0(,\,6.(Af'. 17 = 1)(,6)}(17) :J (,\,6.0(Af'. 17 = /)(,6)}(17)
1 0(71 =17) 5.
1.1(71 =17) 6.
1.1(71 = 71.1) 7.
4.
1 0(>.,6.(Af'. 17 = /)(,6))(17)
1
(,\,6.0(Af'. 17 = 1)(,6)}(17)
8.
14.
D(>.,. 17 = ,)( 71) 15.
1.2 (A,6.(Af'. 17 = 1)(,6))(17) 9. 1
1.1 (Af'.l7=f'}(71) 16.
1.2(Af'.l7 = 1)(71.2) 10.
1.1 (17=71) 17.
1.2 (17 = 71.2) 11.
1.1 71.1 = 71 18.
1.2 (71.2 = 71.2) 12.
1.1(71 = 71) 19.
1.2 71.2 = 71.2 13.
1.1 71 = 71 20.
124
In this, 2 and 3 are from 1 by a conjunctive rule; 4 is from 2 by a

universal rule, instantiating with the term (>."f. l T = 'Y); 5 is from 3
by an unsubscripted abstract rule; 6 is from 5 by a possibility rule; 7
is from 6 by an unsubscripted abstract rule; 8 and 14 are from 4 by
a disjunctive rule; 9 is from 8 by a possibility rule; 10 is from 9, and
11 is from 10 by an unsubscripted abstract rule; 12 is from 11 by an
extensional predication rule; 13 is by reflexivity; 15 is from 14 by an
unsubscripted abstract rule; 16 is from 15 by a necessity rule; 17 is from
16 by an unsubscripted abstract rule; 18 is from 17 by an extensional
predication rule; 19 is from 7 and 18 by substitutivity; and 20 is by
reflexivity.
4.
Stability Conditions
In his ontological argument Godel makes essential use of what he

called "positiveness," which is a property of properties of things. Hedoes not define the notion, instead he makes various axiomatic assumptions concerning it. Among these are: if a property is positive, it is
necessarily so; and if a property is not positive, it is necessarily not positive. (His justification for these was the cryptic remark, "because it
follows from the nature of the property.") Suppose we use the secondorder constant symbol P to represent positiveness, and take it to be
of type j (i (0)). Godel stated his conditions more or less as follows,
with quantifiers implied: P(X) ::J DP(X) and P(X) ::J DP(X). The
second of these is equivalent to ()P(X) ::J P(X), and this form will be
used in what follows. Positiveness is a second-order notion, but Godel's
conditions can be extended to other orders as well. I call the resulting
notion stability, which is not terminology that Godel used.
DEFINITION 9.9 (STABILITY) LetT be a term of type j(t). T satisfies

the stability conditions in a model provided the following are valid in
that model.
(Va)[T(a) :::> DT(a)]

(Va)[()T(a) ::J T(a)]
The stability conditions come in pairs. In S5, however, these pairs
collapse.
PROPOSITION 9.10 In S5, (\la)[T(a) ::J DT(a)] and (\la)[()T(a) :::> T(a)]
are equivalent.
Proof Suppose (Va)[T(a) ::J DT(a)]. Contraposition gives (Va)[DT(a)

::J T(a)]. From necessitation and converse Barcan, (Va)D[DT(a) :::>
125
T(a)], and so ('v'a)[DDT(a) :J DT(a)], equivalently, ('v'a)[DOT(a)

:J DT(a)]. But in S5, X :J DOX is valid, hence we have ('v'a)[T(a) :J
DT( a)]. By contraposition again, ('v'a)[DT(a) :J T( a)], and hence
('v'a)[OT(a) :J T(a)]. The converse direction is similar.
In the stability conditions, T is being predicated of other things. On
the other hand, to say T is rigid, or that the de re /de dicta distinction
vanishes for T, involves other things being predicated of T. Here is the
fundamental connection between stability and earlier items.
THEOREM 9.11 An intensional term T is rigid if and only if it satisfies
the stability conditions.
Proof This is most easily established using tableaus. And it is a good

workout. I leave it to you to supply the details.
Exercises
EXERCISE 4.1 Complete the proof of Theorem 9.11 by giving appropriate closed tableaus. Recall that extensionality is assumed for extensional
terms, and we have the derived extensionality rule given in Definition 6.2.
5.
Definite Descriptions
As is well-known, Russell treated definite descriptions by translating them away, [Rus05]. His familiar example, "The King of France is
bald," is handled by eliminating the definite description, "the King of
France," in context, to produce the sentence "exactly one thing Kings
France, and that thing is bald." It is also possible to treat definite
descriptions as first-class terms, making them a primitive part of the
language. In [FM98] we showed how both of these approaches extend to
first-order modal logic. Further extending this dual treatment to higherorder modal logic adds greatly to the complexity, so I confine things to
a Russell-style version here.
Suppose we have a formula <P, and we form the expression m.<P, which
is read as the a such that <P, and is called a definite description. Syntactically it is treated like a term. Its free variables are those of <P, except
for a, and its type is the type of a. In a more formal presentation, all
this would have been built into the definition of term and formula given
earlier, but doing so adds much complexity at the start of the subject,
so I am taking the easier route of explaining now what could have been
done.
DEFINITION 9.12 (DESCRIPTION DESIGNATION) The definite description 1a..a.<P)(8)
=(,6
= 8)]
where ,6 and 8 are not free in <P.

Next, the behavior of definite descriptions in context is treated in
Russell's style. As he so famously noted, scope issues are fundamental. There is a difference between "the King of France is non-bald,"
which is false since there is no King of France, and "it is not the
case that the King of France is bald," which is true. Formally, it is
the difference between (>.x.-.B(x))( 1y.K(y)) and (>.x.B(x)) (1y.K(y) ).
There is a similar distinction to be made between (>.x.DB(x))(1y.K(y))
and D(>.x.B(x))(1y.K(y)) since definite descriptions generally act nonrigidly, and so the de rej de dicta issue arises.
Note that in all the examples above, scope of a definite description was
indicated by the use of a predicate abstract. Now (>.x.DB(x))(1y.K(y))
is atomic, as are (>.x.B(x))(1y.K(y)) and (>.x.-.B(x))(1y.K(y)). It is
enough for us to specify how definite descriptions behave in atomic contexts, and everything else follows automatically. But even at the atomic
level, a definite description can occur in a variety of ways. For instance,
in To(TI) either, or both, of To and TI could be descriptions. There are
several ways of dealing with this, all of which lead to equivalent results.
I'll use a Russell-style translation directly in the simplest case, and reduce other situations to that.
9.13 (DESCRIPTIONS IN ATOMIC CONTEXT) Let m.<P be

a definite description, and let ,6 and 8 be variables of the same type as
a, that do not occur free in .a.<P)(8)
= (,6 = 8)] 1\ To(,6)}.
2 To(TI. ... , m.<P, ... , Tn) is an abbreviation for

(>.,6.To(TI, ... , ,6, ... , Tn))(7a.<fl).
3 (7a.<P)(TI, ,Tn) is an abbreviation/or
(>.,6.,6( TI, ... , Tn)) (?a.<fl).
4 To(TI, ... , l(m.<P), ... , Tn) is an abbreviation for
127
5 l( m. ) (T1, . . .
, Tn)
is an abbreviation for
(.\,8.(1,6) (Tl, ... , Tn) )( m.).

The definition above provides a routine for the elimination of definite descriptions. The problem is, there may be more than one way
of following the routine. For instance, consider the atomic formula
(1x.A(x))(1y.B(y)), which contains two definite descriptions. If we eliminate (1y.B(y)) first, beginning with an application of part 1 of the definition, and then eliminate (1x.A(x)), we wind up with the following.
(:Jz1){('v'z2)[(.\y.B(y))(z2)
(3z4){('v'zs)[(.\x.A(x))(zs)
=(z1 = z2)]/\
= (z4 =
zs)]/\ (.\z3.Z3(zl))(z4)}}
(9.1)
On the other hand, we might choose to eliminate 1x.A(x) first, beginning

with part 3 of the definition. If so, after a few steps we wind up with
the following.
(:Jz2){('v'z3)[(.\x.A(x))(z3)
(.\zl-(3z4){('v'zs)[(.\y.B(y))(zs)
= (z2 =
= (z4 =
z3)]/\
zs)]/\ z1(z4)})(z2)}
(9.2)
Fortunately, (9.1) and (9.2) are equivalent. In general, the elimination procedure is confluent-different reduction sequences for the same
atomic formula always lead to equivalent results.
In a sense there are two kinds of definite descriptions, intensional and
extensional, depending on the type of the variable a in 10:. . Extensional
definite descriptions are rather well-behaved, and I say little about them,
but for intensional ones, some interesting issues can be raised. In Definition 9. 7 I characterized a formal notion of rigidity. That definition
can be extended to definite descriptions: call m. rigid at a world if the
following is true at that world.
(.\,B.D(,B =1( 10:. ))) (l( m.)).

Informally speaking, to say this is true at a world r amounts to saying:
m. designates at world r, m. designates at all worlds accessible from
r, and at rand every world accessible from it, 1o:. designates the same
thing. The following Proposition is an alternative characterization.
9.14 The formula (.\,8.0(,8 =1(m.)))(1(1o:.)) is equivalent in K to the conjunction of the following three formulas.
PROPOSITION
1 (:3,8) ('v'8) [(.\a. ) (8)
= (,B =
8)]
128
2 (\1,6)[(-\a.<P)(,B) :J 0(-\a.<P)(,B)]
3 (\1,6)[0(-\a.<P)(,B) :J (-\a.<P)(,B)] ..
In other words, this Proposition says (1a. <P) is rigid if and only if
(m.<P) designates and (Aa.<P) satisfies the stability conditions.
Exercises
EXERCISE 5.1 Show the equivalence of (9.1) and (9.2). (For this classical tableaus can be used, since modal operators do not explicitly appear.)
EXERCISE 5.2 Use K tableaus to prove Proposition 9.14. (This is a
long exercise.)
6.
Choice Functions
In a Henkin/Kripke model, not all the objects of a standard model

need be present. We would like some mechanism to ensure that many
are, so non-standard models may have a sufficiently rich universe. Abstraction provides one way of doing this. If <P is a formula, there must
be an intensional object in a Henkin/Kripke model to serve as the designation for (-\a.<P), and so in turn there must be extensional objects
to supply the designations for t (-\a.<P) at each particular world. But
for some purposes this is still not enough. In effect, the example just
given starts with an intensional object, and moves to extensional objects
derivatively. We need some machinery for moving in the other direction
as well.
Suppose, in a Henkin/Kripke model, we have somehow picked out
an extensional object of the same type at each world-say we call the
object we choose at world r, Or. It seems plausible that there should
be an intensional object: the chosen object. That is, there should be
an intensional object f whose value, at each world r, is the object Or.
More generally, suppose at each world we have selected a non-empty set
of extensional objects, all of the same type. Say at world r we select
the set Sr. Again it seems plausible that there should be an intensional
object-a selected object-a mapping f whose value at each world r is
some member of Sr.
Given the formal machinery up to this point, the existence of the
intensional objects posited above cannot be guaranteed. (At least, I believe this to be the case. I do not have a proof.) To postulate existence
of such intensional objects using some sort of axiom requires quantification over possible worlds, which we cannot do, but we can approximate
to it by use of the 0 operator. What we wind up with is the following
129
postulate, which I call a choice axiom because, in effect, it posits the

existence of choice functions in the standard set-theoretic sense.
9.15 (CHOICE AXIOM) Let t be an extensional type, and

let o: be of type j(t), f3 be of type t, and 'Y be of type jt. The following is
the choice axiom of type t.
DEFINITION
(Vo:)[D(:3{3)o:(f3)
::::>
(:3'Y)Do:(h)]
Informally, the axiom says that if, at each world the set of things such
that o: is non-empty-0(:3f3)o:(f3)-then there is a choice function 'Y that
picks out something such that o: at each world-(::l"f)Do:(h). I give one
example of a Choice Axiom application. Suppose o: is an extensional
variable, and m. designates in every possible world. That is, in each
possible world, the is meaningful. Then, plausibly, there should be an
intensional object that, in each world, designates the thing that is the 
of that world-that is, the term ?(.D(Ao:.)(t() should also designate.
More loosely, the concept should also designate. Recall, Definition 9.12
says what it means for a definite description to designate, and since
(A(.0(Ao:.)(K))("7) = D(Ao:.)(t'f]), things can be simplified a little.
9.16 Assume the Choice Axiom (Definition 9.15} and

Extensionality for Intensional Terms (Definition 9.3). Assume a, {3,
and 8 are of extensional type t, and 'Y and "7 are of type jt. The following is valid in all K models.
PROPOSITION
D(:3{3)(V8)[(Ao:.)(8)
= ({3 =
8)]
::::>
(:3'Y)(V"7)[D(Ao:.)(t"7)
Proof Assume D(:3f3)(V8)[(Ao:.)(8)
= ('Y =
17)]
= ({3
= 8)] is true at a possible

world. I show that (:3'Y)(V7])[D(Ao:.)(1"7) = ('Y = 17)] must also be true
there. Start with
D(:3f3)(V8)[(Ao:.)(8)
= ({3 =
(9.3)
8)]
which is equivalent to
0(:3{3){ (Ao:.)(f3)
1\
(V8)[(Ao:.)(8)
::::>
({3
= 8)]}.
Instantiating the universal quantifier in the choice axiom with

(A"7.(Ao:.)("7)
(9.4) implies
1\
(V8)[(Ao:.)(8)
::::>
("7
= 8)])
(9.4)
130
(:l!)D{(>,a.<P)(h) 1\ (V8)[(>,a.<P)(8):) (h = 8)]}
(9.5)
(:J!){D(>,a.<P)(h) 1\ D(V8)[(>,a.<P)(8) :) (h = 8)]}.
(9.6)
Since the Barcan and converse Barcan formulas are valid in the semantics, this is equivalent to
(:3/){D(>,a.<P)(h) 1\ (V8)D[(>,a.<P)(8) :) (h = 8)]}.
(9.7)
This, in turn, implies the following formula. I leave the justification to

you.
(:l!){D(>,a.<P)(h) 1\ (V1J)D[(>,a.<P)(11J) :) (h =11J)]}.
(9.8)
Using distributivity of necessity over implication, this implies
(:3/){D(>,a.<P)(h) 1\ (V1J)[O(>,a.<P)(11J) :) D(h =11J)]}
(9.9)
and using Extensionality for Intensional Terms, this implies
(:l{){D(>,a.<P)(h) 1\ (V1J)[D(>.a.<P)(l1J) :) (t = 17)]}
(9.10)
(:l!)(V1J)[O(>,a.<P)(11J)
= (t = 17)]
(9.11)
and we are done.
Exercises
EXERCISE 6.1 Give tableau proofs of the Barcan formula, and of the
converse Barcan formula.
EXERCISE 6.2 Give a tableau proof to show (9. 7) implies (9.8).
III
ONTOLOGICAL ARGUMENTS
Chapter 10
..
GODEL'S ARGUMENT, BACKGROUND
1.
Introduction
There are many directions from which people have tried to prove the
existence of God. There have been arguments based on design: a complex universe must have had a designer. There have been attempts to
show that the existence of an ethical sense implies the existence of God.
There have been arguments based on causality: trace the chain of effect
and cause backward and one must reach a first cause. Ontological arguments seek to establish the existence of God based on pure logic: the
principles of reasoning require that God be part of ones ontology.
For religion, as contrasted with philosophy or logic, it does not matter
if proofs for God's existence have holes. Religious belief, like much that
is fundamentally human, is not really the product of reason. We are
emotional animals, and one of the uses of proof, in the various senses
above, is to sway emotion. Proof is often just a rhetorical device, one
among many.
But this takes us too far afield. Here we are interested in ontological
arguments only. Independently of whether one believes their conclusion to be true, the logical machinery used in such arguments is often
ingenious, and merits serious study. It is generally accepted that such
arguments contain flaws, but saying exactly where the flaw lies is not
easy, and is subject to controversy. It happens that different analyses
of the same argument will locate an error at different points. Often
this happens because the notions involved in a particular ontological
argument are vague and subject to interpretation. Godel's ontological
argument is rather unique in that it is entirely precise-the premises are
clearly set forth, and the reasoning can be formalized. But we will see
133
134
that here too there is room for interpretation, and things are not as clear
as they first seem.
2.
Anselm
Historically, the first ontological argument is that of St. Anselm (1033

- 1109), given in his book Proslogion. Here is the argument itself, in a
somewhat technical translation from [Cha79].
Even the Fool, then, is forced to agree that something-than-which-nothinggreater-can-be-thought exists in the mind, since he understands this when
he hears it, and whatever is understood is in the mind. And surely thatthan-which-a-greater-cannot-be-thought cannot exist in the mind alone. For
if it exists solely in the mind even, it can be thought to exist in reality also,
which is greater. If then that-than-which-a-greater-cannot-be-thought exists
in the mind alone, this same that-than-which-a-greater-cannot-be-thought is
that-than-which-a-greater-can-be-thought. But this is obviously impossible.
Therefore there is absolutely no doubt that something-than-which-a-greatercannot-be-thought exists both in mind and in reality.
Put into more modern terms, Anselm speaks of a maximally conceivable being. This term-maximally conceivable being-must denote
something, since ''whatever is understood is in the mind." But a maximally conceivable being must have the property of existence, because if
it did not, we could conceive of a greater being, namely one that also
had the existence property.
My understanding of this is that, read with some charity, it shows the
phrase "maximally conceivable being," if it designates anything, must
designate something that exists. The flaw lies in the failure to properly
verify that the phrase designates at all-to show it is not in the same
category as "the round square." Indeed, Anselm's way of justifying this,
by claiming that it exists in the mind, is exactly what was attacked by
his contemporary Gaunilo, in his counter-argument, A Reply on Behalf
of the Fool. A modern translation of this can also be found in [Cha79].
Anselm's argument was the ancestor of various later versions, all of
which involve some notion of maximality. An easily accessible discussion
of the family of ontological arguments in general is in the on-line Stanford
Encyclopedia of Philosophy [Opp96b], and [Opp95, Pla65] are recommended as more detailed studies. A full examination of the Anselm argument can be found in [Har65]. In addition, a detailed book in progress
is available on the internet, [SobOl]-the Anselm argument is discussed
in Chapter 2, "Classical Ontological Arguments."
3.
Descartes
Descartes (1598 - 1650) gave different versions of an ontological argument. Here is one, in which he defines God to be a being whose
135
necessary existence is part of the definition. It is from the Appendix to

his replies to the Second Objections to his Meditations, [Des51]. I omit
the Definitions and Axioms to which the quote refers.
Proposition I
The existence of God is known from the consideration of his nature alone.
Demonstration
To say that an attribute is contained in the nature or in the concept of a
thing is the same as to say that this attribute is true of this thing, and that
it may be affirmed to be in it (Definition IX).
But necessary existence is contained in the nature or in the concept of God
(by Axiom X).
Hence it may with truth be said that necessary existence is in God, or that
God exists.
Here is a somewhat different argument, using existence rather than necessary existence. This version is from The Meditations, book V, [Des51].
. . . because I cannot conceive God unless as existing, it follows that existence is inseparable from him, and therefore that he really exists; not that
this is brought about by my thought, or that it imposes any necessity on
things, but, on the contrary, the necessity which lies in the thing itself, that
is, the necessity of the existence of God, determines me to think in this way,
for it is not in my power to conceive a God without existence, that is a being
supremely perfect, and yet devoid of an absolute perfection, as I am free to
imagine a horse with or without wings.
Taking some liberties with the first of the Descartes proofs above: God
is the most perfect being, the being having all perfections, and among
these is necessary existence. Put a little differently, necessary existence
is part of the essence of God. And here we have reached an ontological argument that can be easily formalized. Recall the discussion in
Chapter 7, Section 3. The type-0 objects are possibilist-they represent
what might exist, not what does. If we want to relativize things to what
actually exists, we need a type-(0) "existence" predicate, E, about which
nothing special need be postulated at this point. Now, suppose we define
God to be the necessarily existent being, that is, the being g such that
DE(g). If such a being exists, it must satisfy its defining property, and
hence we have
E(g)
::::>
DE(g).
(10.1)
Given (10.1), using the rule of necessitation, we have the following.
D[E(g)
::::>
DE(g)]
(10.2)
136
From (10.2), using the K principle D(P :::) Q) :::) (()P :::) OQ) we have
the next implication.
OE(g) :::) ODE(g)
(10.3)
Finally we use something peculiar to 85 (and some slightly weaker

logics, a point of no importance here). The principle needed is ODP :::)
DP, and so from (10.3) we have the following.
OE(g) :::) DE(g)
(10.4)
We thus have a proof that God's existence is necessary, if possible.

And, again following Descartes loosely, God's existence is possible because possibility is identified with conceivability, and we may take it for
granted that God is conceivable.
Russell's treatment of definite descriptions applies quite well in a
modal setting-Chapter 9, Section 5. The use of g above was an informal
way of avoiding a formal definite description-note that I gave no real
prooffor (10.1). Let us recast the argument using definite descriptionsthe necessarily existent being is m.DE(a) and I assume g is an abbreviation for this type-0 term. Now (10.1) unabbreviates to the following.
E(10~.DE(a))
:::) DE(1a.DE(a)).
(10.5)
This is not a valid formula of K, but that logic is too weak anyway, given
the step from (10.3) to (10.4) above. But (10.5) is valid in 85, a fact
I leave to you as an exercise. In fact, using 85, the argument above is
entirely correct!
The real problem with the Descartes argument lies in the assumption that God's existence is possible. In 85 both OE(g) :::) E(g) and
E(g) :::) OE(g) are trivially valid. Since OE(g) :::) DE(g) has been shown
to be valid, we have the equivalence of E(g), OE(g), and DE(g)! Thus,
assuming God's existence is possible is simply equivalent to assuming
God exists. This is an interesting conclusion for its own sake, but as an
argument for the existence of God, it is unconvincing.
Exercises
EXERCISE 3.1 Give an 85 tableau proof of the following, where P and
Q are type-(0) constant symbols.

P(m.DQ(a)) :::) DQ(m.DQ(a))
From this it follows that (10.5) is valid in 85.
137
EXERCISE 3.2 Construct a model to show
E(m.DE(a))
DE(1a.OE(a)).
is not valid inK.

EXERCISE 3.3 Formula 10.5 can also be written as
(.X,8.E(,8))(1a.OE(a))
D(.X,B.E(,B))(m.OE(a))
which, by the previous exercise, is not K valid. Show the following

variant is valid (a K tableau proof is probably easiest).
(.X,8.E(,8))(1a.DE(a))
(.X,B.OE(,B))(m.OE(a))
K formula of Exercise 3.3 can not

be used in a Descartes-style argument.
EXERCISE 3.4 Show why the valid
4.
Leibniz
Leibniz (1646 - 1716) partly accepted the Descartes argument from

The Meditations, mentioned in the previous section. But he also clearly
identified the critical issue: one must establish the possibility of God's
existence. The following is from Two Notations for Discussion with
Spinoza, [Lei56].
Descartes' reasoning about the existence of a most perfect being assumed
that such a being can be conceived or is possible. If it is granted that there
is such a concept, it follows at once that this being exists, because we set up
this very concept in such a way that it at once contains existence. But it
is asked whether it is in our power to set up such a being, or whether such
a concept has reality and can be conceived clearly and distinctly, without
contradiction. For opponents will say that such a concept of a most perfect
being, or a being which exists through its essence, is a chimera. Nor does
it suffice for Descartes to appeal to experience and allege that he experiences
this very concept in himself, clearly and distinctly. This is not to complete the
demonstration but to break it off, unless he shows a way in which others can
also arrive at an experience of this kind. For whenever we inject experience
into our demonstrations, we ought to show how others can produce the same
experience, unless we are trying to convince them solely through our own
authority.
Leibniz's remedy amounted to an attempt to prove that God's existence is possible, where God is defined to be the being having all
perfections-again a maximality notion. Intuitively, a perfection is an
atomic property that is, in some sense, good to have, positive. Leibniz based his proof on the compatibility of all perfections, from which
he took it to follow that all perfections could reside in a being-God's
138
existence is possible. Here is another quote from Two Notations for

Discussion with Spinoza, [Lei56].
By a perfection I mean every simple quality which is positive and absolute
or which expresses whatever it expresses without any limits. But because a
quality of this kind is simple, it is unanalyzable or indefinable .... From this
it is not difficult to show that all perfections are compatible with each other
or can be in the same subject.
Leibniz goes on to provide a detailed proof of the compatibility of all

perfections, though it is not a proof in any modern sense. Indeed, it
is not clear how a proper proof could be given at all, using the vague
notion of perfection presented above. I omit his proof here. The point
for us is that, as we will see, precisely this point is central to Godel's
argument as well.
5.
Godel
Godel (1906- 1978) was heir to the profound developments in mathematics of the late nineteenth and early twentieth centuries, which often
involved moves to greater degrees of abstraction. In particular, he was
influenced by David Hilbert and his school. In the tradition of Hilbert's
book, Foundations of Geometry, Godel avoided Leibniz's problems completely, by going around them. It is as if he said, "I don't know what
a perfection is, but based on my understanding of it intuitively, it must
have certain properties," and he proceeded to write out a list of axioms.
This neatly divides his ontological argument into two parts. First, based
on your understanding, do you accept the axioms. This is an issue of
personal intuitions and is not, itself, subject to proof. Second, does the
desired conclusion follow from the axioms. This is an issue of rigor and
the use of formal methods, and is what will primarily concern us here.
Godel's particular version of the argument is a direct descendent of
that of Leibniz, which in turn derives from one of Descartes. These arguments all have a two-part structure: prove God's existence is necessary,
if possible; and prove God's existence is possible.
Godel worked on his ontological argument over many years. According
to [Ada95], there is a partial version in his papers dated about 1941.
In 1970, believing he would die soon, Godel showed his proof to Dana
Scott. In fact Godel did not die until1978, but he never published on the
matter. Information about the proof spread via a seminar conducted by
Dana Scott, and his slightly different version became public knowledge.
Godel's proof appeared in print in [Sob87], based on a few pages of
Godel's handwritten notes. Scott also wrote some brief notes, based
on his conversation with Godel, and [Sob87] provides these as well. In
fact, [Sob87] has served as something of a Bible (pun intended) for the
139
Godel ontological argument. Finally the publication of Godel's collected

works has brought a definitive version before the public, [G70]. Still,
the notion of a definitive version is rather elusive in this case. Godel's
manuscript provides almost no explanation or motivation. It amounts
to an invitation to others to elaborate.
Godel's argument is modal and at least second-order, since in his
definition of God there is an explicit quantification over properties. Work
on the Kripke semantics of modal logic was relatively new at the time
Godel wrote his notes, and the complexity of quantification in modal
contexts was perhaps not well appreciated. Consequently, the exact
logic Godel had in mind is unclear.
Subsequently several people took up the challenge of putting the
Godel argument on a firm foundation and exposing any hidden assumptions. People have generally used the second-order modal logic
of [Coc69], sometimes rather informally. [Sob87], playing Gaunilo to
Godel's Anselm, showed the argument could be applied to prove more
than one would want. Sobel's discussion has been greatly extended in
[SobOl], Chapter 4; Chapter 3 is also relevant here. [AG96] showed
that one could view a part of the argument not as second-order, but as
third-order. Many others contributed, among which I mention [And90,
Haj96b]. Postings on the internet are, by nature, somewhat ephemeral,
but interesting discussions of the Godel argument, intended for a general
audience, can be found at [SmaOl] as well as at [OppOl]. In addition,
there are [Opp96b] and [SobOl]. The present chapter and the next can
be thought of as part of the continuing tradition of explicating Godel.
6.
Godel's Argument, Informally
Before we get to precise details in the next Chapter, it would be good

to run through Godel's argument informally to establish the general
outline, since it is considerably more complex than the versions we have
seen to this point.
To begin with, Godel takes over the notion of perfection, but with
some changes. For Leibniz, perfections were atomic properties, and any
combination of them was compatible and thus could apply to some object. They could be freely combined, a little like the atomic facts about
the world that one finds in Wittgenstein's Tractatus. Since this is the
case, why not form a new collection, consisting of all the various combinations of perfections, each combination of which Leibniz considers
possible. Godel found it convenient to do this, and used the term positiveness for the resulting notion. Thus we should think of a positive
property, in Godel's sense, as some conjunction of perfections in Leib-
140
niz's sense. At least, I am assuming this to be the case-Godel says

nothing explicit about the matter.
The most notable difference between Godel and Leibniz is that, where
Leibniz tried to use what are essentially informal notions in a rigorous
way, Godel introduces formal axioms concerning them. Here are Godel's
axioms (or their equivalents), and his argument, set forth in everyday
English. A formalized version will be found in the next Chapter. The
Godel argument has the familiar two-part structure: God's existence is
possible; and God's existence is necessary, if possible. I'll take these in
order.
I'll begin with the axioms for positiveness. The first is rather strong.
(I have made no attempt to follow Godel's numbering of axioms and
propositions, and in some cases I have adopted equivalents or elaborations of what Godel used.)
INFORMAL AXIOM 1
Exactly one of a property or its complement is pos-
itive.
It follows that there must be positive properties. If we call a property
that is not positive negative, it also follows that there are negative properties. By Informal Axiom 1, a negative property can also be described
as one whose complement is positive.
Suppose we say property P entails property Q if, necessarily, everything having P also has Q.
INFORMAL AXIOM 2
Any property entailed by a positive property is pos-
itive.
This brings us to our first interesting result.

1 Any positive property is possibly instantiated. That is, if P is positive, it is possible that something has property
INFORMAL PROPOSITION
P.
Proof Suppose P is positive. Let N be some negative property (the
complement of P will do). It cannot be that P entails N, or else N
would be positive. So it is not necessary that everything having P has
N, that is, it is possible that something has P without having N. So it
is possible that something hasP.
Leibniz attempted a proof that "all perfections are compatible with
each other or can be in the same subject," that is, having all perfections is a possibly instantiated property. Godel instead simply takes
141
the following as an axiom-it is an immediate consequence, using Informal Proposition 1, that having all positive properties is a possibly
instantiated property.
INFORMAL AXIOM 3 The conjunction of any collection of positive properties is positive.
This is a problematic axiom, in part because there are infinitely many
positive properties, and we cannot form an infinite conjunction (unless
we are willing to allow an infinitary language). There are ways around
this, but there is a deeper problem as well-we will see that this axiom
is equivalent to Godel's desired conclusion (given Godel's other assumptions). But further discussion of this point must wait till later on. For
now we adopt the axiom and work with it in an informal sense.
Now Godel defines God, or rather, defines the property of being Godlike, essentially the same way Leibniz did.
INFORMAL DEFINITION 2 A God is any being that has every positive
property.
This gives us part one of the argument rather easily.
INFORMAL PROPOSITION 3 It is possible that a God exists.
Proof By Informal Axiom 3, the conjunction of all positive properties

is a positive property. But by Definition 2, this property-maximal
positiveness-is what makes one a God. Since the property is positive,
it is possibly instantiated, by Informal Proposition 1.
There are also a few technical assumptions concerning positiveness,
whose role is not apparent in the informal presentation given here. Their
significance will be seen when we come to the formalization in the next
Chapter. Here is one.
INFORMAL AXIOM 4 Any positive property is necessarily so, and any
negative property is necessarily so.
Now we move on to the second part of the argument, showing God's
existence is necessary, if possible. Here Godel's proof is quite different
from that of Descartes, and rather ingenious. To carry out the argument,
Godel introduces a pair of notions that are of interest in their own right.
INFORMAL DEFINITION 4 A property G is the essence of an object g if:
1 g has property G;
142
2 G entails every property of g.
Strictly speaking, in the definition above I should have said an essence

rather than the essence, but it is an easy argument that essences are
unique, if they exist at all. Very simply, if an object g had two essences,
P and Q, each would be a property of g by part 1, and then each would
entail the other by part 2. Godel does not, in general, assume that
objects have essences, but for an object that happens to be a God, there
is a clear candidate for the essence.
INFORMAL PROPOSITION 5 If g is a God, the essence of g is being a
God.
Proof Let's state what we must show a little more precisely. Suppose
G is the conjunction of all positive properties, so having property G is
what it means to be a God. It must be shown that if an object g has
property G, then G is the essence of g.
Suppose g has property G. Then automatically we have part 1 of
Informal Definition 4.
Suppose also that P is some property of g. By Informal Axiom 1, if
P were not positive its complement would be. Since g has all positive
properties, g then would have the property complementary toP. Since
we are assuming g has P itself, we would have a contradiction. It follows
that P must be positive. Since G is the conjunction of all positive
properties, clearly G entails P. Since P was arbitrary, G entails every
property of g, and we have part 2 of Informal Definition 4.
Here is the second of Godel's two new notions.
INFORMAL DEFINITION 6 An object g has the property of necessarily
existing if the essence of g is necessarily instantiated.
And here is the last of G6del's axioms.
INFORMAL AXIOM 5 Necessary existence, itself, is a positive property.
INFORMAL PROPOSITION 7 If a God exists, a God exists necessarily.
Proof Suppose a God exists, say object g is a God. Then g has all
positive properties, and these include necessary existence by Informal
Axiom 5. Then the essence of g is necessarily instantiated, by Informal
Definition 6. But the essence of g is being a God, by Informal Proposition 5. Thus the property of being a God is necessarily instantiated .
143
Now we present the second part of the ontological proof.

INFORMAL PROPOSITION 8 If it is possible that a God exists, it is necessary that a God exists (assuming the logic is 85).
:::::> Q is valid, so is
OQ. Then by Informal Proposition 7, if it is possible that a God
Proof In any modal logic at least as strong as K, if P
OP
:::::>
exists, it is possibly necessary that a God exists. In 85, ODP

valid, and the conclusion follows.
:::::>
DP is
Finally, by Informal Propositions 3 and 8, we have our conclusion.

INFORMAL THEOREM 9 Assuming all the axioms, and assuming the underlying logic is 85, a God necessarily exists.
One final remark before moving on. I've been referring to a God,
rather than to the God. As a matter of fact uniqueness is easy to establish, provided we make use of Leibniz's condition that having the same
properties ensures identity. Let G be the property of being Godlikethe maximal positive property-and suppose both g1 and g2 possess this
property. By Informal Proposition 5, G must be the essence of both g1
and g2. Now, if P is any property of g1, G must entail P, by part 2
of Informal Definition 4. Since G is a property of g2, by part 1 of the
same Informal Definition, P must also be a property of g2. Similarly,
any property of g2 must be a property of g1. Since g1 and g2 have the
same properties, they are identical.
This concludes the informal presentation of Godel's ontological argument. It is clear it is of a more complex nature than those that historically preceded it. But an informal presentation is simply not enough.
God is in the details, so to speak, and details demand a formal approach. In the next Chapter I'll go through the argument again, more
slowly, working things through in the intensional logic developed earlier
in Part II.
Exercises
EXERCISE 6.1 Show that only God can have a positive essence. (This
exercise is due to Ioachim Teodora Adelaida of Bucharest.)
Chapter 11
..
GODEL'S ARGUMENT, FORMALLY
1.
General Plan
The last Chapter ended with an informal presentation of Godel's argument. This one is devoted to a formalized version. I'll also consider some
objections and modifications. There are two kinds of objections. One
amounts to saying that Godel committed the same fallacy Descartes did:
assuming something equivalent to God's existence. Nonetheless, again
as in the Descartes case, much of the argument is of interest even if it
falls short of establishing the desired conclusion. The second kind of
objection is that Godel's axioms are too strong, and lead to a collapse
of the modal system involved. Various extensions and modifications of
Godel's axioms have been proposed, to avoid this modal collapse. I'll
discuss these, and propose a modification of my own. Now down to details, with the proof of God's possible existence coming first. I will not
try to match the numbering of the informal axioms in the last chapter,
but I will refer to them when appropriate.
2.
Positiveness
God, if one exists, will be taken to be an object of type 0. We are

interested in the intensional properties of this object, properties of type
j(O). Among these properties are the ones Godel calls positive, and which
we can think of as conjunctive combinations of Leibniz's perfections. At
least that is how I understand positiveness. Godel's ideas on the subject
are given almost no explanation in his manuscript-here is what is said,
using the translation of [G70].
145
146
Positive means positive in the moral aesthetic sense (independently of the

accidental structure of the world). Only then [are] the axioms true. It may also
mean pure 'attribution' as opposed to 'privation' (or containing privation).
This is not something I profess to understand. But what is significant is

that, rather than attempting to define positiveness, Godel characterized
it axiomatically. In this section I present his basic axioms concerning
the notion, and I explore some of their consequences.
DEFINITION 11.1 (POSITIVE) A constant symbol P of type j (j (0)) zs
designated to represent positiveness. It is an intensional property of
intensional properties. Informally, P is positive if we have P(P).
It is convenient to introduce the following abbreviation.
DEFINITION 11.2 (NEGATIVE) If T is a term of type j(O), take
short for (Ax.T(x)). Call T negative if T is positive.
as
Loosely, at a world in a model, T denotes the complement of whatever T

denotes. It is easy to check formally that T = ( T), given extensionality
for intensional terms, Definition 9.3.
Godel assumes that, for each P, exactly one of it or its negation must
be positive. Godel's axiom (which he actually stated using exclusive-or)
can be broken into two implications. Here they have been formulated as
two separate axioms, since they play different roles.
AXIOM 11.3 (FORMALIZING INFORMAL AXIOM 1)
A (VX)[P(X) :J P(X)]
B (VX)[P(X) :J P(X)]
Of these, Axiom 11.3A is certainly plausible: contradictory items should
not both be positive. But Axiom 11.3B is more problematic: it says
one of a property or its complement must be positive. We might think
of the notion of a maximal consistent set of formulas-familiar from
the Lindenbaum/Henkin approach to proving classical completeness-as
suggestive of what Godel had in mind. There are some cryptic remarks
of Godel relating disjunctive normal forms and positiveness, but these
have not served as aids to my understanding. At any rate, these are the
basic assumptions.
The next assumption concerning positiveness is a monotonicity condition: a property that is entailed by a positive property is, itself, positive.
Here it is, more or less as Godel gave it.
[P(X)
1\
D(Vx)(X(x) :J Y(x))] :J P(Y)
147
In this formula, x is a free variable of type 0. For us, type-0 quantification

is possibilist, while for Godel it must have been actualist. I am assuming
this because his conclusion, that God exists, is stated using an existential
quantifier, and a possibilist quantifier would have been too weak for the
purpose. For us, existence must be made explicit using the existence
predicate E, relativizing the ('v'x) quantifier to E. Since this relativization
comes up frequently, it is best to make an official definition.
DEFINITION
11.4
(EXISTENTIAL RELATIVIZATION)
('v'Ex) abbrevi-
ates (Vx)[E(x) :J ], and (3Ex) abbreviates (3x)[E(x) 1\ ].
11.5 (FORMALIZING INFORMAL AXIOM 2)

In the following, x is of type 0, X and Y are of type i(O).
AXIOM
('v'X)(VY){[P(X) 1\ D('v'Ex)(X(x) :J Y(x))] :J P(Y)}

At one point in his proof, Godel asserts that (>.x.x = x) must be
positive if anything is, and (>.x.x = x) must be negative. This is easy
to see: P( (>.x.x = x)) is valid if anything is positive because anything
strictly implies a validity, and we have Axiom 11.5. The assertion that
(>.x.x = x) is negative is equivalent to the assertion that (>.x.x = x) is
positive. We thus have the following consequences of Axiom 11.5.
PROPOSITION
11.6 Assuming Axiom 11.5:
1 (3X)P(X) :J P((>.x.x = x));
2 (3X)P(X) :J P((Ax.x = x)).

PROPOSITION
11.7 Assuming Axioms 11.3A and 11.5:

(3X)P(X) :J P( (>.x.x = x) ).
Now we have a result from which the possible existence of God will
follow immediately, given one more key assumption about positiveness.
PROPOSITION
11.8
(FORMALIZING INFORMAL PROPOSITION
1)
Assuming Axioms 11.3A and 11.5, ('v'X){P(X) :J 0(3Ex)X(x)}.
Proof The idea has already been explained, in the proof of Informal
Proposition 1 in Section 6. This time I give a formal tableau, which is
displayed in Figure 11.1. In it use is made of one of the Propositions
above. Item 1 negates the proposition in unabbreviated form. Item 2 is
from 1 by an existential rule (with P as a new parameter); 3 and 4 are
from 2 by a conjunctive rule; 5 is Axiom 1; 6 is from 5 and 7 is from 6
by universal rules; 8 and 9 are from 7 by a disjunctive rule; 10 and 11
148
are from 8 by a disjunctive rule; 12 is from 11 by a possibility rule; 13

is from 12 by an existential rule (with pas a new parameter, and some
tinkering with E); 14 and 15 are from 13 by a conjunctive rule; 16 is
from 4 by a necessity rule; 17 is from 16 by a universal rule (and some
tinkering with E again); 18 is Proposition 11.7; 19 and 20 are from 18
by a disjunctive rule; 21 is from 19 by a universal rule.
Leibniz attempted to prove that perfections are mutually compatible,
basing his proof on the idea that perfections can only be purely positive
qualities and so none can negate the others. For Godel, rather than
proving any two perfections could apply to the same object, Godel assumes the positive properties are closed under conjunction. This turns
out to be a critical assumption. In stating the assumption, read X 1\ Y
as abbreviating (.Xx.X(x) 1\ Y(x)).
(VX)(VY){[P(X) 1\ P(Y)] ::::> P(X 1\ Y)}
Godel immediately adds that this axiom should hold for any number
of summands. Of course one can deal with a finite number of them
by repeated use of Axiom 11.9 as stated-the serious issue is that of
an infinite number, which Godel needs. [AG96] gives a version of the
axiom which directly postulates that the conjunction of any collection
of positive properties is positive. Note that it is a third-order axiom.
For reading ease I use the following two abbreviations.
1 Z applies only to positive properties (Z, like P, is of type j(j(O))):
pos(Z) {::} (\iX)[Z(X)
::::>
P(X)]
2 X applies to those objects which possess exactly the properties falling

under Z-roughly, X is the (necessary) intersection of Z. (In this,
Z is of type i(j(O)), X is of type j(O), and x is of type 0.)
(X intersection of Z) {::} D(\ix){X(x)
= (W)[Z(Y)
::::>
Y(x)]}
AXIOM 11.10 (ALSO FORMALIZING INFORMAL AXIOM 3)

(\iZ){pos(Z) ::::> (\iX)[(Xintersection of Z) ::::> P(X)]}.
Axiom 11.10 implies Axiom 11.9. I leave the verification to you. I'll
finish this section with two technical assumptions that Godel makes
"because it follows from the nature of the property." I don't understand
this terse explanation, but here are the assumptions.
(\iX)[P(X)
::::>
(\iX)[P(X)
::::>
DP(X)]
0-.P(X)]
149
150
If the underlying logic is just K, equivalence of these two assumptions

follows from Axioms 11.3A and 11.3B. And if the underlying logic is 85,
as it must be for part of Godel's argument, equivalence also follows by
Proposition 9.10. Consequently the version used here can be simplified.
('v'X)[P(X) :J DP(X)].
P has been taken to be an intensional object, of type j(j(O)). Axiom 11.11 and Theorem 9.11 tells us that Pis rigid. In effect the intensionality of P is illusory-since it is rigid it could just as well have been
an extensional object of type (j(O)).
Exercises
EXERCISE 2.1 Give a tableau proof that (.Ax.(x = x)) = (.Ax.x
More generally, show that for a type (0) term T, (T) = T.
= x).
EXERCISE 2.2 Show that ('v'X)[P(X) :J DP(X)] follows from Axiom 11.11 together with Axioms 11.3A and 11.3B.
EXERCISE 2.3 Show Axiom 11.10 implies Axiom 11.9. Hint: use equality.
3.
Possibly God Exists
Godel defines something to be Godlike if it possesses all positive properties.

DEFINITION 11.12 (FORMALIZING INFORMAL DEFINITION 2)
G is the following type j(O) term, where Y is type j(O).
(.Ax.('v'Y)[P(Y) :J Y(x)]).
Given certain earlier assumptions, anything having all positive properties can only have positive properties. Perhaps the easiest way to state
this formally is to introduce a second notion of Godlikeness, and prove
equivalence.
DEFINITION 11.13 (ALSO FORMALIZING INFORMAL DEFINITION 2)
G* is the type j(O) term
(>.x.(W)[P(Y)
= Y(x)]).
The following result is easily proved; I leave it to you as an exercise.
151
PROPOSITION 11.14 Assume Axiom 11.3B, ('v'X)[P(X) :J P(X)].
InK, with this assumption, ('v'x)[G(x)
=G*(x)].
Axiom 11.3B is a little problematic, but it is essential to the Proposition above. If, eventually, we show something having property G exists,
and G and G* are equivalent, we will know that something having property G* exists. But the converse is also the case: if something having
property G* exists, Axiom 11.3B is the case, even if the existence in
question is possibilist. Here is a formal statement of this. Once again I
leave the proof to you.
PROPOSITION 11.15 InK, (3x)G*(x) :J (VX)[P(X) :J 'P(X)].
Now we can show that God's existence is possible. Godel assumes the
conjunction of any family of positive properties is positive. Since G* is,
in effect, the conjunction of all positive properties, it must be positive,
and hence so must G be.
PROPOSITION 11.16 InK Axiom 11.10 implies P(G).
Once again I leave the formal verification to you. What must be
shown is the following.
('v'Z)('v'X){[pos(Z)
1\
(X intersection of Z)] :J P(X)} :J P(G)
Essentially, this is the case because, as is easy to verify, we have each of
pos(P) and (G intersection of P).

Now the possibility of God's existence is easy. In fact, it can be proved
with an actualist quantifier, though only the weaker possibilist version
is really needed for the rest of the argument.
THEOREM 11.17 Assume Axioms 11.3A, 11.5, and 11.10. InK both
of the following are consequences. 0(3Ex)G(x) and 0(3x)G(x).

Proof By Proposition 11.8,
('v'X){P(X) :J 0(3Ex)X(x)},
hence trivially,
('v'X){P(X) :J 0(3x)X(x)}.
By the Proposition above, P(G). The result is immediate.
Note that the full strength of Proposition 11.8 was not really needed
for the possibilist conclusion. In fact, if we modify Axiom 11.5 so that
quantification is possibilist,
(VX)(W){[P(X) 1\ D('v'x)(X(x) :J Y(x))J :J P(Y)}
152
we would still be able to prove Proposition 11.8 in the weaker form
(\fX){P(X) :J 0(:3x)X(x)}
and the Godel proof would still go through.
Exercises
EXERCISE 3.1 Give a tableau proof that G entails any positive property:
(\fX){P(X) :J D(\fy)[G(y) :J X(y)]}. You will need Axiom 11.11.
EXERCISE 3.2 Give a tableau proof for Proposition 11.14.
EXERCISE 3.5 Give a tableau proof of
(\fZ)(\fX){[pos(Z)
4.
1\
(X intersection of Z)] :J P(X)} :J P(G).
Objections
Godel replaced Leibniz's attempted proof of the compatibility of perfections by an outright assumption, given here as Axiom 11.10. Dana
Scott, apparently noting that the only use Godel makes of this Axiom
is to show being Godlike is positive, proposed taking P( G) itself as an
axiom. Indeed, Scott maintains that the Godel argument really amounts
to an elaborate begging of the question-God's existence is simply being
assumed in an indirect way. In fact, it is precisely at the present point
in the argument that Scott's claim can be localized. Godel's assumption
that the family of positive properties is closed under conjunction turns
out to be equivalent to the possibility of God's existence, a point also
made in [SobOl].
We will see, later on, Godel's proof that God's existence is necessary,
if possible, is correct. It is substantially different from that of Descartes,
and has many points of intrinsic interest. What is curious is that the
proof as a whole breaks down at precisely the same point as that of
Descartes: God's possible existence is simply assumed, though in a disguised form.
The rest of this section provides a formal proof of the claims just
made. Enough tableau proofs have been given in full, by now, so that
abbreviations can be introduced as an aid to presentation. Before giving
the main result of this section, I introduce some simple conventions for
shortening displayed tableau derivations.
153
If a X and a X :J Y occur on a branch, a Y can be added. Schematically,

aX
aX :J Y
aY
The justification for this is as follows.

aX 1.
a X :J Y
a X 3.
2.
4.
aY
The left branch is closed, and the branch below 4 continues as if we had
used the derived rule.
Here are a few more derived rules, whose justification I leave to you.
aX
a (X 1\ Y) :J Z
aY :J Z
aX
aX=:Y
aY
('v'o:1) ('v'o:n)<P( 0:1, , O:n)
a<P(T1, ... ,Tn)

for any grounded
terms T1, ... , Tn
aX
a X=:Y
a--,Y
(:lo:1) (:lo:n)<P( 0:1, , O:n)

a<P(P1, ... ,Pn)
for any new, distinct

parameters P1, ... , Pn
Now, here is the promised proof of equivalence.
11.18 Assume all the Axioms to this point, except for Axiom 11.10 and Axiom 11.9. The following are equivalent, using 85:
THEOREM
1 Axiom 11.10;
2 P(G);
3 O(:JEx)G(x);
154
0(3x)G(x).
Proof We already know 1 implies 2, this is Proposition 11.16. Likewise

3 follows from 2, by Theorem 11.17. And the implication of 4 from 3 is
trivial.
Showing that 4 implies 2 is straightforward, using the fact that G
and G* are equivalent, and the fact that positiveness is rigid. Here is a
tableau derivation.
0(3x)G(x) 1.
1
1 P(G) 2.
1.1 (3x)G(x) 3.
1.1 G(g) 4.
1.1 ('v'x)[G(x) = G*(x)] 5.
1.1 [G(g) = G*(g)] 6.
1.1 G*(g) 7.
1.1 (>.x.('v'Y)[P(Y) Y(x)])(g) 8.
1.1 (W)[P(Y) = Y(g)] 9.
1.1 [P(G) = G(g)] 10.
1.1 P(G) 11.
1
(VX)[P(X) :J 0-.P(X) 12.
1 P( G) :J DP( G) 13.
1
DP( G) 14.
1.1P(G) 15.
Item 3 is from 1 by a possibility rule; 4 is from 3 by an existential

rule, with g as a new parameter; 5 is Proposition 11.14, and note that
the modal version of Corollary 4.34 is being used here; 6 is from 5 by a
universal rule; 7 is from 4 and 6 by a derived rule; 8 is 7 unabbreviated;
9 is from 8 by an abstraction rule; 10 is from 9 by a universal rule; 11 is
from 10 and 4 by a derived rule; 12 is an equivalent of Axiom 11.11; 13
is from 12 by a universal rule; 14 is from 2 and 13 by a derived rule; 15
is from 14 by a necessity rule.
Showing 2 implies 1 informally is also not hard. If C is any collection
of positive properties, G entails every member of C by Exercise 3.1.
It follows that G also entails the conjunction of C. Since 2 says G is
positive, the conjunction of C is positive by Axiom 11.5. The informal
argument just sketched can be turned into a proper tableau proof. In
Figure 11.2 I give a proof that 2 implies Axiom 11.9, and I'll leave the
argument for Axiom 11.10 as an exercise.
In Figure 11.2, item 3 is from 2 by a (derived) existential rule; 4 and 5
are from 3, and 6 and 7 are from 4 by conjunctive rules; 8 is Axiom 11.5;
9 is from 8 by a derived universal rule; 10 is from 1 and 9 by a derived
1 P(G) 1.
1 -{v'X)(W){[P(X) 1\ P(Y)] :::> P(X 1\ Y)} 2.
1 {[P(A) 1\ P(B)] :::> P(A 1\ B)} 3.
1
P(A) 1\ P(B) 4.
1 P(A 1\ B) 5.
1
P(A) 6.
1
P(B) 7.
1
('v'X)('v'Y){[P(X) 1\ D('v'Ex)(X(x) :::> Y(x))] :::> P(Y)} 8.
1
[P(G) 1\ D('v'Ex)(G(x) :::>(A 1\ B)(x))] :::> P(A 1\ B) 9.
1
D('v'Ex)(G(x) :::>(A 1\ B)(x)) :::> P(A 1\ B) 10.
1 D('v'Ex)(G(x) :::>(A 1\ B)(x)) 11.
1.1(\:IEx)(G(x) :::>(A 1\ B))(x) 12.
1.1(\:lx)[E(x) :::> (G(x) :::> (A 1\ B)(x))] 13.
1.1-,[E(c) :::> (G(c) :::>(A 1\ B)(c))] 14.
1.1 E(c) 15.
1.1(G(c) :::> (A 1\ B)( c)) 16.
1.1 G(c) 17.
1.1-,(AAB)(c) 18.
1
('v'X)[P(X) :::> DP(X)] 19.
1
P(A) :::> DP(A) 20.
1 P(B) :::> DP(B) 21.
1
DP(A) 22.
1
DP(B) 23.
1.1 P(A) 24.
1.1 P(B) 25.
1.1 (>.x.('v'Y)[P(Y) :::> Y(x)])(c) 26.
1.1 ('v'Y)[P(Y) :::> Y(c)] 27.
1.1 P(A) :::> A(c) 28.
1.1 P(B) :::> B(c) 29.
1.1 A(c) 30.
1.1 B(c) 31.
1.1(.\x.A(x) 1\ B(x))(c) 32.
1.1[A(c) 1\ B(c)] 33.
/~
1.1A(c)
34. 1.1B(c)
Figure 11.2.
35.
Proof that item 2 implies Axiom 11.9
155
156
rule; 11 is from 5 and 10 by a derived rule; 12 is from 11 by a possibility

rule; 13 is 12 unabbreviated; 14 is from 13 by an existential rule; 15
and 16 are from 14, and 17 and 18 are from 16 by conjunctive rules; 19
is Axiom 11.11; 20 and 21 are from 19 by universal rules; 22 is from 6
and 20, and 23 is from 7 and 21, by derived rules; 24 is from 22 and
25 is from 23 by necessity rules; 26 is 17 unabbreviated; 27 is from 26
by an abstraction rule; 28 and 29 are from 27 by universal rules; 30 is
from 24 and 28, and 31 is from 25 and 29 by derived rules; 32 is 18
unabbreviated; 33 is from 32 by an abstraction rule; 34 and 35 are from
33 by a disjunctive rule.
Exercises
EXERCISE 4.1 Give a tableau proof showing that 0(3x)G(x) implies
Axiom 11.10.
5.
Essence
Even though we ran into the old Descartes problem with half of the
Godel argument, we should not abandon the enterprise. The other half
contains interesting concepts and arguments. This is the half in which
it is shown that God's existence is necessary, if possible. For starters,
Godel defines a notion of essence that plays a central role, and is of
interest in its own right. [Haz98] makes a case for calling Godel's notion
character, reserving the term essence for something else. I follow Godel's
terminology. The essence of something, x, is a property that entails every
property that x possesses. Godel says it as follows.
cp Ess x = (\17/!){7/J(x)
0(\fy)[cp(y)
7/J(y)]}
As just given, it does not follow that the essence of x must be a property
that x possesses. Dana Scott assumed this was simply a slip on the part
of Godel, and inserted a conjunct cp(x) into the definition. I will follow
him in this.
cp Ess x
= cp(x) 1\ (V7j!){7j!(x)
D('v'y)[cp(y)
7/J(y)]}
Godel states cp Ess x as a formula rather than a term-in the version

in this book an explicit predicate abstract is used. Also, I assume the
type-0 quantifier that appears is actualist, and so in my version the
existence predicate, E, must appear. (P, q) is intended to assert that
P is the essence of q.
DEFINITION 11.19 (ESSENCE, FORMALIZING INFORMAL DEF. 4)
abbreviates the following type i (i (0), 0) term, in which Z is of type
157
i(O) and w is of type 0:

(.XY,x.Y(x) A ('v'Z){Z(x):) O('v'Ew)[Y(w):) Z(w)]})
The property of being Godlike was defined earlier, Definition 11.12.
A central fact about Godlikeness, from Godel's notes, is that it is the
essence of any being that is Godlike.
11.20 (FORMALIZING INFORMAL PROPOSITION 5)
Assume Axioms 11.3B and 11.11. InK the following is provable. (Note
that x is of type 0.)
THEOREM
('v'x)[G(x) :) ( G, x)].
Rather than giving a direct proof, if we use Proposition 11.14 it follows
from a similar result concerning G*, provided Axiom 11.3B is assumed.
Since such a result has a somewhat simpler proof, this is what is actually
shown.
THEOREM
11.21 InK the following is provable, assuming Axiom 11.11.
(\fx)[G*(x):) (G*,x)].
Proof Here is a closed K tableau to establish the theorem.
1 ('v'x )[G* (x) :) ( G*, x )] 1.
1 -.., [G* (g) :) (G*, g)] 2.
1 G*(g) 3.
1-.E(G*,g) 4.
1-.{G*(g) A ('v'Z){Z(g):) D('v'Ew)[G*(w):) Z(w)]}}
5.
/~
1-.G*(g)
6. 1(\IZ){Z(g):) O('v'Ew)[G*(w):) Z(w)]}
7.
Item 2 is from 1 by an existential rule, with g a new parameter; 3 and

4 are from 2 by a conjunction rule; 5 is from 4 by a derived unsubscripted
abstract rule; 6 and 7 are from 5 by a disjunction rule. The left branch
is closed. I continue with the right branch, below item 7.
158
1 {Q(g) :J D(VEw)[G*(w) :J Q(w)]}

1
Q(g) 9.
1 D(VEw)[G*(w) j Q(w)] 10.
1.1(V'Ew)[G*(w) :J Q(w)] 11.
1.1{E(a) :J [G*(a) :J Q(a)]} 12.
1.1 E(a) 13.
1.1--,[G*(a) :J Q(a)] 14.
1.1 G*(a) 15.
1.1 Q( a) 16.
1
(VY)[P(Y) = Y(g)] 17.
1
P(Q) = Q(g) 18.
1
P(Q) 19.
1.1 (VY)[P(Y) = Y(a)] 20.
1.1 P(Q) Q(a) 21.
1
(VY)[P(Y) :J DP(Y)] 22.
1
P( Q) :J DP( Q) 23.
1
DP(Q) 24.
1.1 P(Q) 25.
1.1 Q(a) 26.
8.
Item 8 is from 7 by an existential rule, with Q a new parameter; 9 and

10 are from 8 by a conjunction rule; 11 is from 10 by a possibility rule; 12
is from 11 by an existential rule; 13 and 14 are from 12 by a conjunctive
rule, as are 15 and 16 from 14; 17 is from 3 by a derived unsubscripted
abstract rule; 18 is from 17 by a universal rule; 19 is from 9 and 18 by an
earlier derived rule; 20 is from 15 by a derived unsubscripted abstract
rule; 21 is from 20 by a universal rule; 22 is Axiom 11.11; 23 is from 22
by a universal rule; 24 is from 19 and 23 by a derived rule; 25 is from 24
by a necessity rule; 26 is from 21 and 25 by a derived rule. The branch
is closed by 16 and 26.
In the notes Dana Scott made when Godel showed him his proof, there
are two observations concerning essences. One is that something can
have only one essence. The other is that an essence must be a complete
characterization. Here are versions of these results. I begin by showing
that any two essences of the same thing are necessarily equivalent.
THEOREM
11.22 Assume the modal logic is K. The following is prov-
able.
(VX)(VY)(Vz){[t'(X, z)
1\
t'(Y, z)] :J D(VEw)[X(w)
= Y(w)]}
Proof The idea behind the proof is straightforward. If P and Q are

essences of the same object, each must entail the other. I give a tableau
159
proof mainly to provide another example of such. It starts by negating

the formula, applying existential rules three times, introducing new parameters P, Q, and a, then applying various propositional rules. Omitting all this, we get to items 1 - 3 below.
1 E(P, a) 1.
1 E(Q, a) 2.
1D('v'Ew)[P(w) Q(w)] 3.
1 P(a) 4.
1 ('v'Z)[Z(a) :J D('v'Ew)[P(w) :J Z(w)]]
1 Q(a) 6.
1 ('v'Z)[Z(a) :J D('v'Ew)[Q(w) :J Z(w)Jl
1 Q(a) :J D('v'Ew)[P(w) :J Q(w)] 8.
1 P(a) :J D('v'Ew)[Q(w) :J P(w)] 9.
1Q(a)
5.
7.
/~
10. 1 D('v'Ew)[P(w) :J Q(w)]
1P(a)
11.
/~
12. 1 D('v'Ew)[Q(w) :J P(w)]
13.
Items 4 and 5 are from 1 by an abstraction rule (and a propositional

rule), 6 and 7 are from 2 the same way; 8 is from 5 and 9 is from 7
by universal rules; 10 and 11 are from 8, and 12 and 13 are from 9 by
disjunction rules. The left branch is closed, by 6 and 10. The middle
branch is closed by 4 and 12. I continue with the rightmost branch,
below item 13.
1.1('v'Ew)[P(w) = Q(w)] 14.

1.1{E(b) :J [P(b) = Q(b)]} 15.
1.1 E(b) 16.
1.1[P(b) = Q(b)] 17.
/~
1.1 P(b)
1.1Q(b)
18. 1.1P(b)
19. 1.1 Q(b)
20.
21.
Item 14 is from 3 by a possibility rule; 15 is from 14 by an existential

rule; 16 and 17 are from 15 by a conjunction rule; 18, 19, 20, 21 are from
17 by successive propositional rules. I show how the left branch can
be continued to closure; the right branch has a symmetric construction
which I omit.
160
1.1 (VEw)[P(w) :J Q(w)]

1.1 E(b) :J [P(b) :J Q(b)]
22.
23.
/~
1.1--,E(b)
24.
1.1 P(b) :J Q(b)
25.
/~
1.1--,P(b)
26.
1.1 Q(b)
27.
Item 22 is from 11 by a necessitation rule; 23 is from 22 by a universal

rule; 24 and 25 are from 23 by a disjunction rule, as are 26 and 27 from
25. The left branch is closed by 16 and 24, the middle branch is closed
by 18 and 26, and the right branch is closed by 19 and 27.
Now, here is the second of Scott's observations: if X is the essence of
y, only y can have X as a property.
THEOREM 11.23 Assume the modal logic is K, including equality. The
following is valid.
(VX)(Vy){ (X, y) :J D(VEz)[X(z) :J (y = z)]}
This can be proved using tableaus-! leave it to you as an exercise.
Exercises
EXERCISE 5.1 Give a tableau proof for Theorem 11.23. Hint: for a
parameter c, one can consider the property of being, or not being, c,
that is, (.Xx.x =c) and (.Xx.x #c). Either property can be used in the
proof.
EXERCISE 5.2 Give a tableau proof to establish Theorem 11.20 directly,
without using G*.
6.
Necessarily God Exists
In this section I present a version of Godel's argument that God's

possible existence implies His necessary existence. It begins with the
introduction of an auxiliary notion that Godel calls necessary existence.
DEFINITION 11.24 (NECESSARY EXISTENCE)
(Formalizing Informal Definition 6) N abbreviates the following
type i(O) term:
(.Xx.(VY)[(Y, x)
:J
0(3Ez)Y(z)]).
161
The idea is, something has the property N of necessary existence provided any essence of it is necessarily instantiated. Godel now makes a
crucial assumption: necessary existence is positive.
AXIOM
11.25 (FORMALIZING INFORMAL AXIOM 5)
'P(N).
Given this final axiom, Godel shows that if (some) God exists, that
existence cannot be contingent. An informal sketch of the proof was
given in Section 6 of Chapter 10, and it can be turned into a formal
proof-see Informal Propositions 7 and 8. I will leave the details as
exercises, since you have seen lots of worked out tableaus now. Here is
a proper statement of Godel's result, with all the assumptions explicitly
stated. Nate that the necessary actualist existence of God follows from
His possibilist existence.
Assume Axioms 11.3B, 11.11, and 11.25. In the logic K,
THEOREM
(3x)G(x) ::) D(3Ex)G(x).

I leave it to you to prove this, using the informal sketch as a guide.
Now Godel's argument can be completed.
Assume Axioms 11.3B, 11.11, and 11.25. In the logic 85,
THEOREM
0(3x)G(x) ::) D(3Ex)G(x).

Proof From Theorem 11.26,
(3x)G(x) ::) D(3Ex)G(x).

By necessitation,
D[(3x)G(x) ::) D(3Ex)G(x)].

By the K validity D(A::) B)::) (OA::) OB),
0(3x)G(x) ::) OD(3Ex)G(x).

Finally, in 85, ODA::) DA, so we conclude
0(3x)G(x) ::) D(3Ex)G(x) .
Now we are at the end of the argument.

COROLLARY
11.28 Assume all the Axioms. In the logic 85,
D(3Ex)G(x).
Proof By Theorems 11.27 and 11.17.
162
Exercises
EXERCISE 6.1 Give a tableau proof to show Theorem 11.26. Use various
earlier results as assumptions in the tableau.
7.
Going Further
Godel's axioms admit more consequences than just those of the ontological argument. In this section a few of them are presented.
7.1
Monotheism
Does there exist exactly one God? The following says "yes." You are
asked to prove it, as Exercise 7.1.
PROPOSITION 11.29 (3x)('v'y)[G(y) =: (y = x)j.
This Proposition has a curious Corollary. Since type-0 quantification
is possibilist, it makes sense to ask if there are gods that happen to be
non-existent. But Corollary 11.28 tells us there is an existent God, and
the Proposition above tells us it is the only one God, existent or not.
Consequently we have the following.
COROLLARY 11.30 ('v'x)[G(x) :J E(x)j.
Proposition 11.29 tells us we can apply the machinery of definite descriptions. By Definition 9.12, 1x.(W)[P(Y) :J Y(x)] always designates,
and consequently so does 1x.G(x). Proposition 9.14 tells us this will be
a rigid designator provided G(x) is stable. It follows from Sobel's argument in Section 8 that it, and everything else, is. But alternative versions
of Godel's axioms have been proposed-! will discuss some below-and
using them the stability of G(x) does not seem to be the case. That
is, it seems to be compatible with the axioms of Godel (as modified by
others) that, while the existence of God is necessary, a particular being
that is God need not be God necessarily. If this is not the case, and a
proof has been missed, I invite the reader to correct the situation.
7.2
Positive Properties are Necessarily

Instantiated
Proposition 11.8 says that positive properties are possibly instantiated. In [Sob87], it is observed that a consequence of Corollary 11.28 is
that every positive property is necessarily instantiated.
PROPOSITION 11.31 ('v'X){'P(X) :J 0(3Ex)X(x)}.
I leave the easy proof of this to you.
163
Exercises
EXERCISE 7.1 Give a tableau proof for Proposition 11.29. Hint: you
will need Corollary 11.28, Theorem 11.20, and Theorem 11.23.
EXERCISE 7.2 Provide a tableau proof for Proposition 11.31. Hint: by
Corollary 11.28, a Godlike being necessarily exists. Such a being has

all positive properties, so every positive property is instantiated. Now,
build this into a tableau.
8.
More Objections
In Section 4 we saw that one of Godel's Axioms was equivalent to

the possible existence of God. Other objections have been raised that
are equally as serious. Chapter 4 of [SobOl] discusses problems with
Axiom 11.25, that necessary existence is positive. I do not take this
point up here. But also in [SobOl], and earlier in [Sob87], it was argued
that Godel's axiom system is so strong it implies that whatever is the
case is so of necessity, Q ::J DQ. In other words, the modal system
collapses. In still other, more controversial, words, there is no free will.
Roughly speaking, the idea of Sobel's proof is this. God, having all
positive properties, must possess the property of having any given truth
be the case. Since God's existence is necessary, anything that is a truth
must necessarily be a truth.
Here is a version of the argument given by Sobel. For simplicity,
assume Q is a formula that contains no free variables. By Theorem 11.20,
(\fx)[G(x) ::J ( G, x)].
(11.1)
Using the definition of, we have as a consequence
(\fx){G(x) ::J ('v'Z){Z(x) ::J D('v'Ew)[G(w) ::J Z(w)]}}.
(11.2)
There is a minor nuisance to deal with. In the formula (11.2) I would

like to instantiate the quantifier ('v'Z) with Q, but this is not a 'legal'
term, so instead I use the term (>..y.Q) to instantiate. In it, y is of type
0, and so (>..y.Q) is of type i(O). We get the following consequence.
(\fx){G(x) ::J {(>..y.Q)(x) ::J D('v'Ew)[G(w) ::J (>..y.Q)(w)]}}.
(11.3)
Now to undo the technicality just introduced, note that since y does not
occur free in Q, (>..y.Q)(x) = (>..y.Q)(w) = Q, and so we have
(\fx){G(x) ::J {Q ::J D('v'Ew)[G(w) ::J Q]}}.
(11.4)
164
Since x does not occur free in the consequent, (11.4) is equivalent to the
following:
(3x)G(x) :::> {Q :::> D('v'Ew)(G(w) :::> Q)}.
(11.5)
We have Corollary 11.28, from which
(3x)G(x)
(11.6)
follows. Then from (11.5) and (11.6) we have
Q :::> D('v'Ew) (G( w) :::> Q).
(11.7)
Since Q has no free variables, (11.7) is equivalent to the following:
Q :::> D[(3Ew)G(w) :::> Q].
(11.8)
Using the distributivity of D over implication, (11.8) gives us
Q :::> [D(3Ew)G(w) :::> DQ].
(11.9)
Finally (11.9), and Corollary 11.28 again, give the intended result,
Q :::> DQ.
(11.10)
Most people have taken this as a counter to Godel's argument-if the

axioms are strong enough to admit such a consequence, something is
wrong. In the next two sections I explore some ways out of the difficulty.
9.
A Solution
Sobel's demonstration that the Godel axioms imply no free will rather
takes the fun out of things. In this section I propose one solution to the
problem. I don't profess to understand its implications fully. I am
presenting it to the reader, hoping for comments and insights in return.
Throughout, it has been assumed that Godel had in mind intensional properties when talking about positiveness and essence. But,
suppose not-suppose extensional properties were intended. I reformulate Godel's argument under this alternative interpretation. It is one
way of solving the problem Sobel raised.
165
In this section only I will take P to be a constant symbol of type
i((O)). Axiom 11.5 gets replaced with the following.

Revised Axiom 11.5 In the formula below, xis of type 0, and X and
Y are of type (0).
(VX)(VY){[P(X) A D(V'Ex)(X(x)
:J
Y(x))]
:J
P(Y)}
Note that this has the same form as Axiom 11.5, but the types of
variables X and Y are now extensional rather than intensional. This
will be the general pattern for changes. The definition of negative, for
instance, is modified as follows. For a term T of type (0), take T as
short for l(.Xx.T(x)). Then Axioms 11.3A and 11.3B, 11.10, and 11.11,
all have their original form, but with variables changed from intensional
to extensional type.
The analog of Proposition 11.8 still holds, but with extensional variables involved.
(VX){P(X)
:J
0(3Ex)X(x)}
Analogs of G and G* are defined in the expected way. G is the following type j(O) term, where Y is type (0) and, as noted before, Pis of
type j((O)).
(.Xx.(VY)[P(Y)
:J
Y(x)])
Likewise G* is the type i(O) term
(.Xx.(W)[P(Y)
= Y(x)]).
One can still prove (Vx)[G(x) = G*(x)].

Essence must be redefined, but again it is only variable types that are
changed. now abbreviates the following type j( (0), 0) term, in which
Z is of type (0) and w is of type 0:
(.XY, x.Y(x) A (VZ){Z(x)
:J
D(V'Ew)[Y(w)
:J
Z(w)]})
Theorem 11.21 plays an essential role in the Godel proof, and it too
continues to hold, in a slightly modified form:
(Vx)[G*(x) :J (1G*, x)] .
I leave the proof of this to you-it is similar to the earlier one.

Of course we must modify the definition of Necessary Existence, to use
the revised version of essence, and Axiom 11.25 as well, to use the modified definition of Necessary Existence. For this section, N abbreviates
the following type j(O) term, in which Y is of type (0):
(>.x.('VY)[E(Y, x) :J D(3Ez)Y(z)).
166
Revised Axiom 11.25 is P(lN), where N is as just modified.

With this established, the rest of Godel's argument carries over directly, giving us the following.
0(:3E z) {tG*) (z)

The final step is the easy proof that this implies the desired 0(:3Ez)G*(z),
and hence O(::JEz)G(z), and I leave this to you.
So, we have the conclusion of Godel's argument. Finally, here is a
model, adapted from [And90], that shows Sobel's continuation no longer
applies.
EXAMPLE 11.32 Construct a standard S5 model as follows. There are
two possible worlds, call them r and D.. The accessibility relation always
holds. The type-0 domain is the set {a, b}. Since this is a standard
model, the remaining types are fully determined.
The existence predicate, E, is interpreted to have extension {a, b} at
r and {a} at D.. Informally, all type-0 objects exist at r, but only a
exists at D..
Call a type-(0) object positive if it applies to a. Interpret P so that
at each world its extension is the collection of positive type-(0) objects;
that is, at each world P designates {{a}, {a, b}}.
This finishes the definition of the model. I leave the following facts
about it for you to verify.
1 The designation of G in this model is rigid, with {a} as its extension

at both worlds.
2 The designation of is also rigid, with extension { ({a}, a), ({b}, b)}
at each world. Loosely, the essence of a is {a} and the essence of b is
{b}.
3 The designation of N is also rigid, with extension {a} at each world.
4 All the Axioms are valid, as modified in this section.
Now take Q to be the closed formula (::JEx)(::JEy)-,(x = y). Since it
asserts two objects actually exist, it is true at r, but not at D., and hence
Q :J OQ is not true at r.
We now know that Sobel's argument must break down in the present
system, but it is instructive to try to reproduce the earlier proof, and see
just where things go wrong. The attempted argument takes on a rather
formidable appearance--you might want to skip to the last paragraph
and read the conclusion, before going through the details.
167
We try to prove Q ::) DQ, starting more or less as we did before.
(Vx)[G(i) ::) (lG, x)]
(11.11)
which, unabbreviated, is
(Vx)[G(x) ::)
(.XY,x.Y(x) 1\ (VZ){Z(x)::) D(VEw)[Y(w)::) Z(w)]})(1G,x)]
(11. 12 )
where Y and Z are of type (0), unlike in (11.2) where they were of type
j(O).
The variable xis of type 0, and it is easy to show the following simpler
formula is a consequence of (11.12).
(\ix)[G(x) ::)
(.XY.Y(x) 1\ (VZ){Z(x) ::) D(VEw)[Y(w) ::) Z(w)]})(1G)]
(11.13)
From this we trivially get the following.
(Vx)[G(x) ::)
(.XY.(VZ){Z(x)::) D(VEw)[Y(w)::) Z(w)]})(1G)]
(11.14)
Next, in the argument of Section 8, we instantiated the quantifier (V Z)

with the term (.Xy.Q). Of course we cannot do that now, since (.Xy.Q)
is an intensional term, while the present quantifier (V Z) is extensional.
Apply the extension-of operator, getting 1(-Xy.Q), and use this instead.
But universal instantiation involving relativized terms is a little tricky.
If 1T is a relativized term of the same type as Z, (VZ)cp(Z) ::) cp(l T)
is not generally valid. What is valid is ('v'Z)cp(Z) ::) (.XZ.cp(Z))(1T). So
what we get from formula (11.14) when we instantiate the quantifier is
the following consequence.
(Vx)[G(x) ::)
(.XY, Z.Z(x) ::) D(VEw)[Y(w) ::) Z(w)])(1G, 1(-Xy.Q) )]
(11.15)
Distributing the abstraction, this is equivalent to the following.
(Vx ){ G(x) ::)

[(.XY, Z.Z(x))(lG, 1(-Xy.Q))::)
(.XY, Z.D('v'Ew)(Y(w)::) Z(w)))(lG, 1(-Xy.Q))]}
(11.16)
168
The variable x does not occur free in (>.y.Q) and Y does not occur
in Z(x), so (>.Y,Z.Z(x))(lG,l(>.y.Q)) is simply equivalent to Q, and
(11.16) reduces to the following.
('v'x){G(x) :J
[Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) )]}
(11.17)
From this we get
(3x)G(x) :J
[Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) )]
(11.18)
and since we have (3x)G(x), we also have
Q :J (>.Y, Z.D('v'Ew)(Y(w) :J Z(w)))(lG, l(>.y.Q) ).
(11.19)
Since Q has no free variables, (11.19) can be shown to be equivalent to

the following (where a constant symbol a has been introduced to keep
formula formation correct).
Q :J (>.Y, Z.D((3Ew)Y(w) :J Z(a)))(lG, l(>.y.Q)).
(11.20)
Using the distributivity of 0 over implication, (11.20) gives us
Q :J (>.Y, Z.D(3Ew)Y(w) :J DZ(a))(lG, l(>.y.Q)).
(11.21)
From (11.21) we get
Q :J[(>.Y, Z.D(3Ew)Y(w))(lG, l(>.y.Q)) :J

(>.Y, Z.DZ(a))(lG, l(>.y.Q) )].
(11.22)
Because Z has no free occurrences in D(3Ew)Y(w) and Y has no free

occurrences in Z(a), (11.22) can be simplified to
Q :J[(>.YD(3Ew)Y(w))(lG) :J
(>.Z.DZ(a))(l(>.y.Q) )].
(11.23)
I don't know the status of (>.Y.D(3Ew)Y(w))(lG), that is, whether or

not it follows from the axioms used in this section. It does hold provided
169
G is rigid, so in particular, it holds in the model of Example 11.32.

Consequently, in settings like that model (11.23) reduces to the following.
Q:) (>.Z.DZ(a))(l(>.y.Q)).
(11.24)
But (>.Z.DZ(a))(l (.>.y.Q)) is not equivalent to DQ, and that's an

end of it. Expressing the essential idea of (.>.Z.DZ(a))(l(.>.y.Q)) with
somewhat informal notation, we might write it as (>.Z.DZ)(lQ), and so
what has been established, assuming rigidity of G, is
Q :) (.>.Z.DZ)(lQ)
(11.25)
and this is quite different from Q :) DQ. In the abstract, the variable
Z is assigned the current version of Q-its truth value in the present
world. Perhaps an example will make clear what is happening. Suppose
it is the case, in the real world, that it is raining-take this as Q. If
we had validity of Q :) DQ, it would necessarily be raining-DQ-and
so in every alternative world, it would be raining. But what we have is
Q :) (.>.Z.DZ)(lQ), and since Q is assumed to hold in the real world, we
conclude (>.Z.DZ)(lQ). This conclusion asserts something more like: if
it is raining in the real world, then in every alternative world it is true
that it is raining in the real world. As it happens, this is trivially correct,
and says nothing about whether or not it is raining in any alternative
world.
10.
Anderson's Alternative
One solution to the objection Sobel raised has been presented. In

[And90] some different, quite reasonable, modifications to the Godel
axioms are proposed that also manage to avoid Sobel's conclusion. For
this section I return to the use of intensional variables.
Axiom 11.3B is something of a problem. Essentially it says, everything
must be either positive or negative. As Anderson observes, why can't
something be indifferent? Anderson drops Axiom 11.3B.
The most fundamental change, however, is elsewhere. Definition 11.12
and its alternative, Definition 11.13, are discarded. Instead there is a
requirement that a Godlike being have positive properties necessarily.
DEFINITION 11.33 (GODLIKE, ANDERSON VERSION) GA is the type j
(0) term
(.Xx.(W)[P(Y) := DY(x)]).
There is a corresponding change in the definitions of essence and necessary existence. Definition 11.19 gets replaced by the following
170
DEFINITION 11.34 (ESSENCE, ANDERSON VERSION)

the following type i(i(O), 0) term:
[A abbreviates
(.XY, x.(VZ){DZ(x) =: D(VEw)[Y(w) :J Z(w)]})

Notice several key things about this definition. The Scott addition,
that the essence of an object actually apply to the object, is dropped.
A necessity operator has been introduced that was not present in the
definition of . And finally, an implication in the definition of has
been replaced by an equivalence.
The definition of necessary existence, Definition 11.24, is replaced by
a version of the same form, except that Anderson's definition of essence
is used in place of that of Godel.
DEFINITION 11.35 (NECESSARY EXISTENCE, ANDERSON VERSION)
NA abbreviates the following type j(O) term:

(.Xx.(VY)[A(Y, x) :J D(3Ez)Y(z)).
Now, what happens to earlier reasoning? Of course Proposition 11.8
still holds, since Axioms 11.3A and 11.5 remain unaffected. Theorem 11.20 turns into the following.
THEOREM 11.36 In S5 the following is provable.
(Vx)[GA(x) :J eA(GA,x)].
I leave it to you to verify the theorem, using tableaus say.
Next, Anderson replaces Axiom 11.25 with a corresponding version
asserting that his modification of necessary existence is positive.
AXIOM 11.37 (ANDERSON'S VERSION OF 11.25) P(NA).

Now Theorem 11.26 turns into the following.
THEOREM 11.38 Assume Axioms 11.11 and 11.37. In the logic S5,
(3x)GA(x) :J 0(3Ex)GA(x).
Once again, I leave the proof to you. These are the main items. The
rest of the ontological argument goes through as before. At the end, we
have the following.
THEOREM 11.39 Assume all the Axioms 11.3A, 11.5, 11.10, 11.11, and
11.37. In the logic S5,
171
Thus the desired necessary existence follows, and with one fewer axiom
(though with more complex definitions). And a model, closely related to
the one given in the previous section, can be constructed to show that
these axioms do not yield Sobel's undesirable conclusion-see [And90]
for details.
Exercises
10.1 Supply a tableau argument for Theorem 11.36. Do the
same for Theorem 11.38.
EXERCISE
11.
Conclusion
Godel's proof, and criticisms of it, have inspired interesting work.

Some was mentioned above. More remains to be done. Here I briefly
summarize some directions that might profitably be explored.
[Haj95] studies the role of the comprehension axioms-work that is
summarized in [Haj96b]. Completely general comprehension axioms are
implicit in my presentation, they are present as the assumption that
every abstract has a meaning. Hajek confines things to a second-order
intensional logic, augmented with one third-order constant to handle
positiveness. In this setting Hajek introduces what he calls a cautious
comprehension schema:
('v'x)[G(x) :J (D(x) V 0-.(x))] :J (:3Y)D('v'x)[Y(x)
=(x)].
Hajek shows that Godel's axioms do not lead to a proof of Q :J DQ,

provided cautious comprehension replaces full comprehension, but the
necessary existence of God still can be concluded.
Hajek refutes a claim by Magari, [Mag88], that a subset of Godel's
axiom system is sufficient for the ontological argument. But he also
shows Magari's claim does apply to Anderson's system. And he shows
that Godel's axioms, with cautious comprehension, can be interpreted
in Anderson's system, with full comprehension.
The results of Hajek assume an underlying model with constant domains but no existence predicate, and only intensional properties. It is
not clear what happens if these assumptions are modified.
In Section 7, some further consequences of Godel's axioms were discussed. I don't know what happens to these when the axioms are modified in the various ways suggested here and in the previous two sections.
Nor do I know the relationships, if any, between the extensional-property
approach I suggested, and Anderson's version.
Finally, and most entertainingly, I refer you to an examination of
ontological arguments and counter-arguments in the form of a series of
172
puzzles, in [Smu83], Chapter 10. You should find this fun, and a bit of
a relief after the rather heavy going of the book you just finished.
References
Note to reader: At the end of each bibliography item is a list of the pages on which there
is a reference to the item.
(Ada95]
Robert Merrihew Adams. Introductory note to *1970. In Feferman

et al. (FJWDG+95], pages 388-402. pages 138
(AG96]
C. Anthony Anderson and Michael Gettings. Gooel's ontological

proof revisited. pages 167-172, 1996. In [Haj96a]. pages 139, 148
(And71]
Peter B. Andrews. Resolution in type theory. Journal of Symbolic

Logic, 36(3):414-432, 1971. pages 42, 47
[And72]
Peter B. Andrews. General models and extensionality. Journal of

Symbolic Logic, 37(2):395-397, 1972. pages 25
[And86]
Peter B. Andrews. An Introduction to Mathematical Logic and Type

Theory: To Truth Through Proof Academic Press, Orlando, Florida,
1986. pages xii
[And90]
C. Anthony Anderson. Some emendations of Gooel's ontological

proof. Faith and philosophy, 7:291-303, 1990. pages 139, 166, 169,
171
(Bre72]
Aldo Bressan. A General Interpreted Modal Calculus. Yale University Press, 1972. pages 96, 102
(Car 56]
Rudolph Carnap. Meaning and Necessity. University of Chicago

Press, Chicago, 2 edition, 1956. pages xv
(Cha79]
M. J. Charlesworth. St. Anselm's Proslogion. University of Notre

Dame Press, Notre Dame, IN, 1979. First edition, Oxford University
Press, 1965. pages 134, 134
[Chu40]
Alonzo Church. A formulation of the simple theory of types. Journal

of Symbolic Logic, 5:56-68, 1940. pages 4
173
174
[Coc69]
Nino B. Cocchiarella. A completeness theorem in second order

modal logic. Theoria, 35:81-103, 1969. pages 90, 96, 139
[Des51]
Rene Descartes. A Discourse on Method and Selected Writings.

Everyman's Library. E. P. Dutton, New York, 1951. Translation by
John Veitch. pages 135, 135
[Fit83]
Melvin C. Fitting. Proof Methods for Modal and Intuitionistic Logics. D. Reidel Publishing Co., Dordrecht, 1983. pages 95, 102,
110
[Fit93]
Melvin C. Fitting. Basic modal logic. pages 368-448. 1993. In

[GHR94] Volume 1. pages 95, 110
[Fit96]
Melvin C. Fitting. First-Order Logic and Automated Theorem Proving. Springer-Verlag, 1996. First edition, 1990. pages 8, 10, 33, 37,
41, 47
[Fit98]
Melvin C. Fitting. Higher-order modal logic-a sketch. In Ricardo

Caferra and Gernot Salzer, editors, Automated Deduction in Classical and Non-Classical Logics, pages 23-38. Springer Lecture Notes
in Artificial Intelligence, 1761, 1998. pages 96
[FitOOa]
Melvin C. Fitting. Databases and higher types. In John Lloyd,

Veronica Dahl, Ulrich Furbach, Manfred Kerber, Kung-Kiu Lau,
Catuscia Palamidessi, Luis Moniz Pereira, Yehoshua Sagiv, and Peter Stuckey, editors, Computational Logic-CL 2000, pages 41-52.
Springer Lecture Notes in Artificial Intelligence, 1861, 2000. pages
xiii
[FitOOb]
Melvin C. Fitting. Modality and databases. In Roy Dyckhoff, editor,

Automated Reasoning with Analytic Tableaux and Related Methods,
pages 19-39. Springer Lecture Notes in Artificial Intelligence, 1847,
2000. pages xiii, 96
[FJWDG+95]
Solomon Feferman, Jr. John W. Dawson, Warren Goldfarb, Charles

Parsons, and Robert N. Solovay, editors. Kurt Godel Collected
Works, Volume III, Unpublished Essays and Lectures. Oxford University Press, New York, 1995. pages 173, 174
[FM98]
Melvin C. Fitting and Richard Mendelsohn. First-Order Modal

Logic. Kluwer, 1998. Paperback, 1999. pages xiv, 4, 89, 96, 101,
102, 102, 102, 105, 108, 110, 119, 122, 122, 125
[G70]
Kurt Gooel. Ontological proof. In Feferman et al. [FJWDG+95],

pages 403-404. pages 139, 145
[Gal75]
D. Gallin. Intensional and Higher-Order Modal Logic.

Holland, 1975. pages xv, 86, 102, 102
[GHR94]
Dov M. Gabbay, C. J. Hogger, and J. A. Robinson, editors. Handbook of Logic in Artificial Intelligence and Logic Programming. Oxford University Press, 1993-94. pages 174, 176
North-
REFERENCES
175
[Gil99]
Paul C. Gilmore. Partial functions in an impredicative simple theory of types. In Neil V. Murray, editor,. Automated Reasoning
with Analytic Tableaux and Related Methods, number 1617 in Lecture Notes in Artificial Intelligence, pages 186--201, Berlin, 1999.
Springer. pages 4
[Gil01]
Paul C. Gilmore. An intensional type theory: motivation and cutelimination. To appear, Journal of Symbolic Logic, 2001. pages 4,
33
[Gol81]
Warren D. Goldfarb. The undecidability of the second-order unification problem. Theoretical Computer Science, 13:225-230, 1981.
pages 42
[Haj95]
Petr Hajek. Der Mathematiker und die Frage der Existenz Gottes.
To appear in Wahrheit und Beweisbarkeit- Leben und Werk von K.
Godel, Buld, Kohler, and Schimanowicz., 1995. pages 171
[Haj96a]
Petr Hajek, editor. Godel '96, Berlin, 1996. Springer. pages 173
[Haj96b]
Petr Hajek. Magari and others on Gooel's ontological proof. In

Ursini and Agliano, editors, Logic and Algebra, pages 125-136. Marcel Dekker, Inc., 1996. pages 139, 171
[Har65]
Charles Hartshorne. Anselm's Discovery: A Re-Examination of the

Ontological Proof for God's Existence. Open Court, LaSalle, IL,
1965. pages 134
[Haz98]
A. P. Hazen. On Gooel's ontological proof. Australasian Journal of

Philosophy, 76(3):361-377, 1998. pages 156
[HC96]
G. E. Hughes and M. J. Cresswell. A New Introduction to Modal

Logic. Routledge, London and New York, 1996. pages 38, 89, 102
[Hen50]
Leon Henkin. Completeness in the theory of types.

Symbolic Logic, 15:81-91, 1950. pages 19, 25
[Hue72]
Gerard P. Huet. Constrained Resolution: A Complete Method for

Higher Order Logic. PhD thesis, Case Western Reserve University,
1972. pages 42
[Hue73]
Gerard P. Huet. The undecidability of unification in third-order

logic. Information and Control, 22:257-267, 1973. pages 42
[Hue75]
Gerard P. Huet. A unification algorithm for typed >.-calculus. Theoretical Computer Science, 1:27-57, 1975. pages 42
[Koh95]
Michael Kohlhase. Higher-order tableaux. In Peter Baumgartner,

Reiner Hiihnle, and Joachim Posegga, editors, Theorem Proving
with Analytic Tableaux and Related Methods, volume 918 of Lecture Notes in Artificial Intelligence, pages 294-309, Berlin, 1995.
Springer-Verlag. pages xii, 33, 42
Journal of
176
[Kri80]
Saul Kripke. Naming and Necessity. Harvard University Press, 1980.

pages 121
(Lei 56]
Gottfried Wilhelm Leibniz. Philosophical Papers and Letters. D.

Reidel, Dordrecht-Holland, 2 edition, 1956. Translated and Edited
by Leroy E. Loemker. pages 137, 138
[Lei94]
Daniel Leivant. Higher order logic. pages 229-321. 1994. In [GHR94]

Volume 2. pages xii
(Mag88]
R. Magari. Logica e teofilia. Notizie di logica, VII(4), 1988. pages
171
[Man96]
Maria Manzano. Extensions of First Order Logic. Cambridge University Press, Cambridge, UK, 1996. pages xii
(Mon60]
Richard Montague. On the nature of certain philosophical entities. The Monist, 53:159-194, 1960. Reprinted in (Tho74], 148-187.
pages xv, 102
(Mon68]
Richard Montague. Pragmatics. pages 102-122. 1968. In Contemporary Philosophy: A Survey, R. Klibansky editor, Florence, La Nuova
Italia Editrice, 1968. Reprinted in [Tho74], 95-118. pages xv, 102
(Mon70]
Richard Montague. Pragmatics and intensional logic. Synthese,

22:68-94, 1970. Reprinted in [Tho74], 119-147. pages xv, 102
(Opp95]
Graham Oppy. Ontological Arguments and Belief in God. Cambridge University Press, Cambridge, UK, 1995. pages 134
[Opp96a]
Graham Oppy.
Gooelian ontological arguments.
56(4):226-230, October 1996. pages 176
[Opp96b]
Graham Oppy. Ontological arguments. The Stanford Encyclopedia

of Philosophy, Edward N. Zalta (ed.), March 13 1996. Available on
the internet. URL = http:/ /plato.stanford.edu/entries/ontologicalarguments/. pages 134, 139
(Opp01]
Graham Oppy. Gooelian ontological arguments. Available on the

Internet. URL =
http://www .infidels.org/library/modern/ graham_oppy / godel.ht,
2001. Originally published as (Opp96a]. pages 139
(Pla65]
Alvin Plantinga. The ontological argument, from St. Anselm to contemporary philosophers. Anchor-Doubleday, Garden City, NY, 1965.
pages 134
(Pra68]
Dag Prawitz. Hauptsatz for higher order logic. Journal of Symbolic

Logic, 33:452-457, 1968. pages xii, 35, 43, 46, 47, 67
[Rob77]
The Gospel of Philip. In James M. Robinson, editor, The Nag Hammadi Library in English. Harper and Row, New York, 1977. pages
ix
Analysis,
REFERENCES
177
[Rus05]
Bertrand Russell. On denoting. Mind, 14:479-493, 1905. Reprinted

in Robert C. Marsh, ed., Logic and Knowledge: Essays 1901-1950,
by Bertmnd Russell, Allen & Unwin, London, 1956. pages 125
[Sch60]
Kurt Schutte. Syntactical and semantical properties of simple type

theory. Journal of Symbolic Logic, 25(4):305-326, December 1960.
pages 4
[Sha91]
Stewart Shapiro. Foundations Without Foundationalism: A Case

for Second-Order Logic. Number 17 in Oxford Logic Guides. Oxford
University Press, Oxford, UK, 1991. pages xii
[SmaOl]
Christopher Small. Kurt Gooel's ontological argument. Available

on the internet. URL =
http:/ /www.stats.uwaterloo.ca/ "-'Cgsmall/ontology.html,
2001.
pages 139
[Smi93]
Perry Smith. Higher-order logic, model theory, recursion theory,

and proof theory. Unpublished manuscript, 1993. pages 33
[Smu68]
Raymond M. Smullyan. First-Order Logic. Springer-Verlag, Berlin,

1968. Revised Edition, Dover Press, New York, 1994. pages 33, 37,
47
[Smu83]
Raymond M. Smullyan. 5000 B. C. and Other Philosophical Fantasies. St. Martin's Press, New York, 1983. pages 172
(Sob87]
Jordan Howard Sobel. Gooel's ontological proof. pages 241-261.

1987. In [Tho87]. pages 138, 138, 138, 139, 162, 163
(SobOl]
Jordan Howard Sobel. Logic and Theism. Available on the internet.

URL = www.scar.utoronto.ca/"-'sobel/, 2001. pages 134, 139, 139,
152, 163, 163
[Tak67]
Moto-o Takahashi. A proof of cut-elimination theorem in simple

type theory. J. Math. Soc. Japan, 19:399-410, 1967. pages xii, 35,
43, 46, 47, 67
[Tar55]
Alfred Tarski. A lattice-theoretical theorem and its applications.

Pacific Journal of Mathematics, 5:285-309, 1955. pages 41
[Tho74]
Richmond H. Thomason, editor. Formal Philosophy, Selected Papers of Richard Montague. Yale University Press, New Haven and
London, 1974. pages 176, 176, 176
(Tho87]
Judith Jarvis Thomson. On Being and Saying: Essays for Richard

Cartwright. MIT Press, Cambridge, MA, 1987. pages 177
(Tol75]
Sue Toledo. Tableau Systems for First Order Number Theory and
Certain Higher Order Theories. Number 447 in Lecture Notes in
Mathematics. Springer-Verlag, Berlin, Heidelberg, NY, 1975. pages
xii, 33, 33, 35, 46
Index
abstraction designation function, 21, 26,

103
proper, 22, 27
accessibility, 91
Anderson, C. A., 169-171
Anselm, 134
E-complete, 63
entity, 48, 49
equality, 115
equality axioms, 69, 115
essence, 141, 142, 156, 170
evaluation at a prefix, 109
existential relativization, 147
extensional object, 84, 91
extensionality, 117
assumptions, 118
axioms, 77
for extensional terms, 118
for intensional terms, 117
cautious comprehension, 171

character, 156
choice axiom, 129
choice function, 128-130
closed, 37, 110
compact, 15, 66
complete, 46, 73
strong, 16
weak, 16
composition, 10
comprehension axiom, 3
concept, 84
consequence, 14, 28, 95
consistent, 63
maximal, 63
constant domain, 89
constant symbol, 5, 87
continuum hypothesis, 17
cut rule, 67
cut-elimination, 66
finite support, 8
formula, 6
modal, 88
prefixed, 106
truth, 13, 22, 26, 93, 104
frame
augmented, 91
extensional, 30
Henkin, 20
generalized, 25
relative generalized, 50
Henkin/Kripke, 103
Kripke, 91
free, 9
free variable, 6
de dicto, 118-121
de re, 118-121
Dedekind, R., 15
defined at, 125
definite description, 125-128
degree, 8
Descartes, R., 134-136, 152, 156
description designation, 125
designates, 125
domain, 91
domain function
Henkin, 20, 103
Gaunilo, 134
global assumption, 95, 111
Gi:idel, K., 138-143, 145, 147, 148, 150,
152, 156, 158, 162-164, 166,
171
grounded, 34, 106
Hajek, P., 171
Henkin domain
179
180
relative, 50
Hintikka set, 47
impredicativity, 4
inconsistent, 63
intensional object, 84, 91
interpretation, 11, 30, 51, 73, 92, 103
allowed, 50
K, 105
L(C), 5
.X abstraction, 3
Leibniz, G., 137-140, 145, 148, 152
Lindstrom, P., 68
local assumption, 95, 111
Liiwenheim-Skolem, 66, 68
Magari, R., 171
model
classical, 12
extensional, 30
general, 19
generalized Henkin, 28, 104
Henkin, 19, 22, 23
Henkin/Kripke, 104
modal, 91
standard, 24
monotheism, 162
necessary existence, 142, 160, 170
negative, 141, 146
non-rigid, 102
normal, 25
order, 5
parameter, 34, 108
perfection, 137-139
positive, 138-142, 145, 146, 162
possible value, 49
possible world, 91
predicate abstract, 5
predicate abstraction, 3
prefix, 105
pseudo-model, 47, 48, 51
quantification
actualist, 89, 91
possibilist, 89, 91
rigid, 121-124
rule
abstract, 37, 109
branch extension, 35
conjunctive, 35, 107
derived

closure, 113
extensionality, 77
intensional predication, 113
reflexivity, 70
subscripted abstract, 114
substitutivity, 70
unsubscripted abstract, 114
disjunctive, 36, 107
double negation, 35, 107
existential, 36, 108
extensional, 118
extensional predication, 110
intensional predication, 109
necessity, 108
possibility, 107, 108
reflexivity, 115
substitutivity, 115
universal, 36, 109
world shift, 110
Russell, B., 125, 126, 136
85, 105
satisfiability, 14, 28
Scott, D., 138, 152, 156, 158
sentence, 6
Sobel, J. H., 163, 164, 166, 171
sound, 43, 46, 73
stability, 124-125
substitution, 8
free, 9
tableau, 33
basic, 35
derivation, 37, 111
prefixed, 105
proof, 37, 110
satisfiable, 43
term, 6, 87
denotation, 12, 21, 26
designation, 93, 103
relativized, 108
type, 4, 86
extensional, 86
Gallin/Montague, 102
intensional, 86
relation, 11
validity, 14, 28, 94
valuation, 12, 20, 26, 92
variable, 5
variant, 12
varying domain, 89
Wittgenstein, L., 139
world independent, 110
Zermelo-Fraenkel set theory, 17
TRENDS IN LOGIC
1.
G. Schurz: The Is-Ought Problem. An Investigation in Philosophical Logic. 1997

ISBN 0-7923-4410-3
2.
E. Ejerhed and S. Lindstrom (eds.): Logic, Action and Cognition. Essays in Philosophical Logic. 1997
ISBN 0-7923-4560-6
3.
H. Wansing: Displaying Modal Logic. 1998
ISBN 0-7923-5205-X
4.
P. Hajek: Metamathematics of Fuzzy Logic. 1998
ISBN 0-7923-5238-6
5.
H.J. Ohlbach and U. Reyle (eds.): Logic, Language and Reasoning. Essays in Honour
ofDov Gabbay. 1999
ISBN 0-7923-5687-X
6.
K. Dosen: Cut Elimination in Categories. 2000
7.
ISBN 0-7923-5720-5
R.L.O. Cignoli, I.M.L. D' Ottaviano and D. Mundici: Algebraic Foundations ofmanyISBN 0-7923-6009-5
valued Reasoning. 2000

8.
E.P. Klement, R. Mesiar and E. Pap: Triangular Norms. 2000

ISBN 0-7923-6416-3
9.
V.F. Hendricks: The Convergence of Scientific Knowledge. A View From the Limit.
2001
ISBN 0-7923-6929-7
10.
J. Czelakowski: Protoalgebraic Logics. 2001
11.
G. Gerla: Fuzzy Logic. Mathematical Tools for Approximate Reasoning. 2001

ISBN 0-7923-6941-6
12.
M. Fitting: Types, Tableaus, and Godel's God. 2002
ISBN 0-7923-6940-8
ISBN 1-4020-0604-7
KLUWER ACADEMIC PUBLISHERS - DORDRECHT I BOSTON I LONDON

(Melvin Fitting) Types, Tableaus, and Gödel's God

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

(Melvin Fitting) Types, Tableaus, and Gödel's God

Caricato da

Copyright:

Formati disponibili

by

TYPES, TABLEAUS, AND GO DEL'S GOD

Studia Logica Library

Ryszard Wojcicki, Institute of Philosophy and Sociology,

Daniele Mundici, Department of Computer Sciences, University of Milan, Italy

Graham Priest, Department of Philosophy, University of Queensland,

Krister Segerberg, Department of Philosophy, Uppsala University,

Alasdair Urquhart, Department of Philosophy, University of Toronto, Canada

SCOPE OF THE SERIES

relations to other disciplines. These include artificial intelligence, informatics,

KLUWER ACADEMIC PUBLISHERS

Published by Kluwer Academic Publishers,

Printed on acid-free paper

All Rights Reserved

Terms and Formulas

TYPES, TABLEAUS, AND GODEL'S GOD

4. SOUNDNESS AND COMPLETENESS

7. MODAL LOGIC, SYNTAX AND SEMANTICS

A Few Derived Rules

10. GODEL'S ARGUMENT, BACKGROUND

11. GODEL'S ARGUMENT, FORMALLY

Possibly God Exists

TYPES, TABLEAUS, AND GODEL'S GOD

Truth did not come into the world naked,

TYPES, TABLEAUS, AND GO DEL'S GOD

Godel ontological argument is a prime example. If this is the kind of

to the semantics. It is now that choices must be made, since quantified

TYPES, TABLEAUS, AND GODEL'S GOD

How Did This Get Written?

it was not known to me when I started this book. A broader notion

Terms and Formulas

The formulation of a higher-order logic allows some freedom-there

TYPES, TABLEAUS, AND GODEL'S GOD

standard first-order logic-it applies to three ground-level arguments.

TYPES, TABLEAUS, AND GODEL'S GOD

1 A constant symbol of L(C) or variable is a term of L(C). If it is a

1 If T is a term of type (t1, ... , tn), and TI, ... , Tn is a sequence of

The free variable occurrences of

and w are formulas of L(C) so is (~ 1\ w). The free variable

is a formula of L( C) and a is a variable then (\Ia)~ is a formula

One can think of V, ::=>,:=,and 3 as defined symbols, with their usual

Several examples involving just first and second-order notions will be

TYPES, TABLEAUS, AND GODEL'S GOD

leaving types to be inferred, or explained in words, as necessary.

I generally denote substitutions by u, with and without subscripts.

1.13 Let u be a substitution. The action of u is extended

for a constant symbol A.

2 (.Ao:1, .. , O:n.<I>)u = (.Ao:1, .. , O:n.<I>Ua1, ... ,an)

3 [7(71, ... , 7n)]u = 70"(710", ... , 7n0").

EXAMPLE 1.14 Let <P be the formula (3a((O)))[o/(0))((>.,6.')'(0)(,6)))]

1.15 Let 0"1 and 0"2 be substitutions.

1 If u1 and u2 agree on the free variables of the term 7 then 70"1

1 u is free for a variable or constant.

TYPES, TABLEAUS, AND GODEL'S GOD

3 a is free for ,q, if a is free for <P.

With the action of substitutions extended to all terms, composition

1.17 (SUBSTITUTION COMPOSITION)

under the following cir-

and a2 is free for the term

The proof of this is essentially the same as in the first-order setting.

2.1 (RELATION TYPES) Let 8 be a non-empty set.

0 is an object of type t over S if 0 E [t, S]. 0 is systematically used,

TYPES, TABLEAUS, AND GO DEL'S GOD

1 If A is a constant symbol of L(C) then (v I A)(A) = I(A).

(v I A)( (Aal, ... , an.<P)) =

(v I A)( (>.a~, ... , an.<I>)) =

((v I A)(T1), ... , (v I A)(Tn)) E (v I A)(T) {:}

(vIA)((Aal, ,an.<I>)) =A(v,(Aal, ,an-<I>)).