free-variable tableaux for propositional modal logics

Bernhard Beckert

Rajeev Gore

Free-variable Tableaux forPropositional Modal Logics

Abstract. Free-variable semantic tableaux are a well-established technique for first-

order theorem proving where free variables act as a meta-linguistic device for tracking

the eigenvariables used during proof search. We present the theoretical foundations to

extend this technique to propositional modal logics, including non-trivial rigorous proofs

of soundness and completeness, and also present various techniques that improve the effi-

ciency of the basic naive method for such tableaux.

Keywords: automated deduction, modal logics, modal theorem proving, free-variable

tableaux

1. Introduction

Free-variable semantic tableaux are a well-established technique for first-order theorem proving where free variables act as a meta-linguistic devicefor tracking the eigenvariables used during proof search [27, 13]. By allow-ing the choice of these free-variables to be deferred until more informationbecomes available, free variables reduce the search space and reduce thenon-determinism inherent in automated proof search. Free variables are themost important refinement of traditional tableaux for classical logic fromthe automated theorem proving perspective. It is therefore natural to inves-tigate whether free-variables can be used in automated theorem proving fornon-classical logics.

Kanger’s meta-linguistic indices for non-classical logics [20] have alreadybeen generalised by Gabbay into Labelled Deductive Systems [15], and re-cently, Massacci [22] and Russo [28] have shown the utility of using groundlabels for obtaining modular modal tableaux and natural deduction systems(respectively); see [16] for an introduction to labelled modal tableaux.

Here we present a rigorous account of free-variable tableaux for proposi-tional modal logics. We show how to use this theory to obtain modular proofsystems based upon free-variable tableaux for all 15 basic modal logics. Thispaper is a full version of [2]. It does not include further work on decidabilityissues which we have reported in [3, 4] as these aspects have not been fullyworked out yet.

Our object language uses labelled formulae like σ :A, where σ is a labeland A is a formula, with intuitive reading “the possible world σ satisfies theformula A”; see [12, 24, 16] for details. Thus, 1 :✷p says that the possible

Studia Logica 69: 59–96, 2001.c© 2001 Kluwer Academic Publishers. Printed in the Netherlands.

60 B. Beckert, R. Gore

world 1 satisfies the formula ✷p. Our box-rule then reduces the formula1 :✷p to the labelled formula 1.(x) : p which contains the universal variable xin its label and has an intuitive reading “the possible world 1.(x) satisfiesthe formula p”. Since different instantiations of x give different labels, thelabelled formula 1.(x) : p effectively says that “all successors of the possibleworld 1 satisfy p”, thereby capturing the usual Kripke semantics for ✷p(almost) exactly. But the possible world 1 may have no successors; so weenclose the variable in parentheses and read σ :A as “for all instantiationsof the variables in σ, if the world corresponding to that instantiation of σexists then the world satisfies the formula A”.

The use of variables as place-markers for eigenvariables has been used byvarious authors in the past where it has also been used in conjunction withspecialist unification algorithms to close branches. The earliest such work isprobably that of Wallen [29], but Wallen catered for only a very few simplemodal logics. Similar approaches using labels containing variables have beenexplored by Governatori [17], D’Agostino et al. [10] and Pitt and Cunning-ham [26]. D’Agostino et al. relate the labels to modal algebras, instead of tofirst-order logic as we do. Both Pitt and Cunningham and Governatori usestring unification over labels to detect complementary formulae, whereas wejust use matching. Consequently, our variables are of a simpler kind: theycapture all immediate children of a possible world (in a rooted tree model),but do not capture all R-successors; see [22, 16]. Note, however, that ex-tensions of our calculi using string unification are perfectly feasible. Indeed,such work is currently being persued by Bonnette [9].

The following techniques, in particular, are crucial:

Free variables: Applying the traditional ground box-rule requires guessingthe correct eigenvariables. Using (free) variables in labels as “wild-cards” that get instantiated “on demand” during branch closure allowsmore intelligent choices of these eigenvariables. To preserve soundnessfor worlds with no R-successors, variable positions in labels must beconditional.

Universal variables: Under certain conditions, a variable x introduced bya formula like ✷A is “universal” in that an instantiation of x on onebranch need not affect the value of x on other branches, thereby localis-ing the effects of a variable instantiation to one branch. The techniqueentails creating and instantiating local duplicates of labelled formulaeinstead of the originals.

Finite diamond-rule: Applying the diamond-rule to ✸A usually creates anew label. By using (a Godelisation of) the formula A itself as the la-

Free-variable Tableaux. . . 61

bel instead, we guarantee that only a finite number of different labels(of a certain length) are used in the proof. In particular, different (iden-tically labelled) occurrences of ✸A generate the same unique label.

The paper is structured as follows: In Sections 2 and 3 we introducethe syntax and semantics of labelled modal tableaux. In Section 4 we in-troduce our calculus and present an example; we prove its soundness andcompleteness in Sections 5 and 6, respectively. In Section 7 we present ourconclusions and discuss future work.

2. Syntax

The formulae of modal logics are built in the usual way from a denumer-able non-empty set P of primitive propositions, the classical connectives ∧(conjunction), ∨ (disjunction), ¬ (negation), → (implication), and the non-classical unary modal connectives ✷ (“box”) and ✸ (“diamond”).

To reduce the number of tableau rules and the number of case distinc-tions in proofs, we restrict all considerations to implication-free formulae innegated normal form (NNF); thus negation signs appear in front of primi-tive propositions only. Using NNF formulae is no real restriction since everyformula can be transformed into an equivalent NNF formula in linear time.

Labels are built from natural numbers and variables, with variables in-tended to capture the similarities between the ∀ quantifier of first-orderlogic and the ✷ modality of propositional modal logic. However, whereasfirst-order logic forbids an empty domain, the ✷ modality tolerates possibleworlds with no successors.1 To capture this (new) behaviour, variable po-sitions in labels are made “conditional” on the existence of an appropriatesuccessor by enclosing these conditional positions in parentheses.

Definition 2.1. Let Vars be a set of variables. Then, m is a label for m ∈ N;and if σ is a label, then so are σ.m and σ.(l) for m ∈ N and l ∈ Vars∪N.The length |σ| of a label σ is the number of dots it contains plus one. Theconstituents of a label σ are called positions in σ and terms like “the 1st po-sition” or “the n-th position” are defined in the obvious way. A position isconditional if it is of the form (l), and a label is conditional if it containsa conditional position. By ipr(σ) we mean the set of all non-empty initialprefixes of a label σ, excluding σ itself. A label is ground if it consists of(possibly conditional) members of N only. Let L be the set of all groundlabels.

1 To that extent, modal logics are similar to free logic, i.e., first-order logic where thedomains of models may be empty [8].


When dealing with ground labels, we often do not differentiate betweenthe labels σ.m and σ.(m), and we use σ.[m] to denote that the label may beof either form. Note that σ.x (parentheses around x omitted) is not a labelfor x ∈ Vars: the parentheses mark the positions that contain variables, orthat used to contain variables before a substitution was applied.

Definition 2.2. A set Γ of labels is strongly generated if:

1. there is some (root) label ρ ∈ Γ with ρ ∈ ipr(σ) for all σ ∈ Γ \ {ρ}; and2. σ ∈ Γ implies τ ∈ Γ for all τ ∈ ipr(σ).

Since we deal with mono-modal logics with semantics in terms of rootedframes (see Section 3), we always assume that our labels form a stronglygenerated set with root ρ = 1.

Definition 2.3. A labelled tableau formula (or just tableau formula) φ isa structure of the form X : ∆ :σ :A, where X is a subset of Vars∪N, ∆ isa set of labels, σ is a label, and A is a formula in NNF. If the set ∆ isempty, we use X :σ :A as an abbreviation for X : ∅ : σ :A. A tableau formulaX : ∆ :σ :A is ground if σ and all labels in ∆ are ground. If F is a set oflabelled tableau formulae, then lab(F) is the set {σ | X :∆ :σ :A ∈ F}.

The intuitions behind the different parts of our “tableau formulae” areas follows: The fourth part A is just a traditional modal formula. The thirdpart σ is a label, possibly containing variables introduced by the reductionof ✷ modalities. If the label σ is ground, then it corresponds to a particularpath in the intended rooted tree model; for example, the ground label 1.1.1typically represents the leftmost child of the leftmost child of the root 1.If σ contains variables, then it represents all the different paths (successors)that can be obtained by different instantiations of the variables, therebycapturing the semantics of the ✷ modalities that introduced them. Our rulefor splitting disjunctions allows us to retain these variables in the labels ofthe two disjuncts, but because ✷ does not distribute over ∨, such variablesthen lose their “universal” force, meaning that these “free” variables can beinstantiated only once in a tableau proof. We use the first component X torecord the variables in the tableau formula φ that are “universal”, meaningthat φ can be used multiply in the same proof with different instantiationsfor these variables. The free variables in φ (that do not appear in X) canbe used with only one instantiation since they have been pushed throughthe scope of an ∨ connective. The second part ∆, which can be empty, hasa significance only if our calculus is applied to one of the four logics KB,


K5, KB4, and K45 (that are non-serial, but are symmetric or euclidean).It is empty for the other logics. The intuition of ∆ is that the formula Ahas to be true in the possible world called σ only if the labels in ∆ namelegitimate worlds in the model under consideration. This feature has to beused, if (a) rule applications may shorten labels, which is the case if thelogic is symmetric or euclidean, and (b) the logic is non-serial and, thus, theexistence of successor worlds is not guaranteed. The set ∆ can contain bothuniversal and free variables, and some of them may appear in σ.

Definition 2.4. Given a tableau formula φ = X : ∆ :σ :A, Univ(φ) = X isthe set of universal variables of φ, while Free(φ) = {x | x appears in σ or ∆,x �∈ X} is the set of free variables of φ. These notions are extended in theobvious way to obtain the sets Free(T ) and Univ(T ) of free and universalvariables of a given tableau T (see Def. 2.5).

Definition 2.5. A tableau is a (finite) binary tree whose nodes are tableauformulae. A branch in a tableau T is a maximal path in T (where noconfusion can arise, we identify a tableau branch with the set of tableauformulae it contains). A branch may be marked as being closed. If it isnot marked as being closed, it is open. A tableau branch is ground if everyformula on it is ground, and a tableau is ground if all its branches are ground.

Since we deal with propositional modal logics, notions from first-orderlogic like variables and substitutions are needed only for handling semanticnotions like the accessibility relation between worlds. Specifically, whereassubstitutions in first-order logic assign terms to variables, here they assignnumbers or other variables (denoting possible worlds) to variables.

Definition 2.6. A substitution is a (partial) function µ : Vars→ N ∪Vars.Substitutions are extended to labels and formulae in the obvious way. A sub-stitution is grounding if its domain is the (whole) set Vars and its range is N;that is, if it maps all variables in Vars to natural numbers. The restrictionof a substitution µ to a set X of variables is denoted by µ|X . The concate-nation µ ◦ ν of substitutions µ and ν is defined by (µ ◦ ν)(x) = µ(ν(x)) forall variables x ∈ Vars.

Note, that applying the concatenation µ ◦ ν has the same effect as firstapplying ν and then applying µ, i.e., o(µ ◦ ν) = oνµ for all objects o (labels,formulae, etc.).

Definition 2.7. Given a tableau T containing a tableau formula X : ∆ : σ :A, a tableau formula X ′ :∆′ :σ′ :A is a T -renaming of X :∆ : σ :A if there


is a substitution µ such that (a) X ′ : ∆′ :σ′ :A = (X :∆ : σ :A)µ, (b) thedomain of µ is X (all other variables remain unchanged), and (c) µ replacesthe variables in X by distinct variables new to the tableau T .

3. Semantics

In this section we first introduce the Kripke semantics for modal logics, andthen extend these semantics to labelled tableau formulae and tableaux.

Definition 3.1. A Kripke frame is a pair 〈W,R〉, where W is a non-emptyset (of possible worlds) and R is a binary relation on W . A Kripke modelis a triple 〈W,R, V 〉, where the valuation V is a mapping from primitivepropositions to sets of worlds. Thus, V (p) is the set of worlds at which p is“true” under the valuation V . We write wRw′ iff (w,w′) ∈ R, and we saythat world w′ is reachable from world w, and that w′ is a successor of w.

Definition 3.2. Given some model 〈W,R, V 〉, and some w ∈W , we writew |= p iff w ∈ V (p). This satisfaction relation |= is then extended to morecomplex formulae as usual. We say that w satisfies a formula A iff w |= A.A formula A is satisfied by a model 〈W,R, V 〉 if it is satisfied by some worldw ∈W ; it is valid in 〈W,R, V 〉, written as 〈W,R, V 〉 |= A, iff every worldin W satisfies A. A formula A is valid in a frame 〈W,R〉, iff it is valid inevery model 〈W,R, V 〉 based on that frame. An axiom A is valid in a frame〈W,R〉, iff every formula instance of it is valid in 〈W,R〉.

The first two columns of Table 2 show the axiomatisations of the 15 basiclogics that can be formed from the axioms shown in Table 1.

Definition 3.3. Given one of the logics L listed in Table 2, a frame 〈W,R〉is an L-frame if each axiom of L is valid in 〈W,R〉. A model 〈W,R, V 〉 is anL-model if 〈W,R〉 is an L-frame. A formula A is L-satisfiable if there is anL-model satisfying A.

The axioms listed in Table 1 are characterised by the properties of Rlisted next to them; see [16]. Thus, all KT-frames have a reflexive accessi-bility relation R, and if a frame has a reflexive accessibility relation then itwill validate axiom (T). Therefore, we associate these properties with logicsas well, and say, for example, that a logic L is serial if all L-frames have aserial accessibility relation. Some care is needed: for example the axiom (D)is not an axiom of KT, but it is valid in all KT-frames since it is impliedby (T). Consequently the reachability relation R of all KT-models is serial.


Name Axiom Property(K) ✷(A→ B)→ (✷A→ ✷B) —(T) ✷A→ A reflexive(D) ✷A→ ✸A serial(4) ✷A→ ✷✷A transitive(5) ✸A→ ✷✸A euclidean2

(B) A→ ✷✸A symmetric

Table 1. Basic axioms and the corresponding property of the reachability relation.

As we shall soon see, ground labels capture a basic reachability relationbetween the worlds they name, where the world named by σ.[n] is reachablefrom the world named by σ. A set of strongly generated ground labels canbe viewed as a tree with root ρ, where σ.[n] is an immediate child of σ (hencethe name “strongly generated”). We formalise this as follows.

Definition 3.4. Given a logic L and a set Γ of strongly generated groundlabels with root ρ = 1, a label τ ∈ Γ is L-accessible from a label σ ∈ Γ,written as σ ✄ τ , if the conditions set out in Table 2 for L are satisfied. Alabel σ ∈ Γ is an L-deadend, if no τ ∈ Γ is L-accessible from σ.

The following lemma shows that the L-accessibility relation ✄ on labelscaptures the reachability relation R of L-frames; see [16] for a proof. Inparticular, ✄ has the properties like reflexivity, transitivity, etc. that areappropriate for the axioms of L (see Table 1).

Lemma 3.5. If Γ is a strongly generated set of ground labels with root ρ = 1,then 〈Γ,✄〉 is an L-frame.

The traditional notion of satisfaction relates a world in a model with aformula or a set of formulae. When formulae are annotated with groundlabels, the notion of satisfaction must be extended by a further “interpreta-tion function” that maps ground labels to worlds; see [13, 16]. If the labelsare allowed to contain free variables, and in particular, universal variables,then the notion of satisfaction must also allow for all possible instantiationsof the universal variables, thus catering for many different “interpretationfunctions”. As usual, we define “satisfiability” so that our tableau expansionrules preserve this notion, and such that a “closed tableau” is not satisfiable.

We proceed incrementally by defining satisfiability for: ground labels;ground tableau formulae; non-ground tableau formulae; and whole tableaux.But first we enrich models by the “interpretation function” that maps labels

2 Relation R is euclidean iff: for all u, v, w ∈ R, uRv and uRw implies vRw.


Logic Axioms σ ✄ τ Logic Axioms σ ✄ τK (K) τ = σ.[n] KT (KT) τ = σ.[n] or τ = σKB (KB) τ = σ.[n] or

σ = τ.[m]K4 (K4) τ = σ.θ

K5 (K5) τ = σ.[n], or|σ| ≥ 2, |τ | ≥ 2

K45 (K45) τ = σ.θ, or|σ| ≥ 2, |τ | ≥ 2

KD (KD) K-condition, orσ is a K-deadendand σ = τ

KDB (KDB) KB-condition, or|Γ| = 1 andσ = τ = 1

KD4 (KD4) K4-condition, orσ is a K-deadendand σ = τ

KD5 (KD5) K5-condition, or|Γ| = 1 andσ = τ = 1

KD45 (KD45) K45-cond., or|Γ| = 1,σ = τ = 1

KB4 (KB4) |Γ| ≥ 2

B (KTB) τ = σ, orτ = σ.[n], orσ = τ.[m]

S4 (KT4) τ = σ.θ or τ = σ

S5 (KT5) for all σ, τ

Table 2. Basic logics, axiomatic characterisations, and L-accessibility ✄.

to worlds. Note that such interpretations give a meaning to all ground labels,not just to those that appear in a particular tableau. A label that does notcorrespond to a world in the model is mapped to the special symbol ⊥.

Definition 3.6. An L-interpretation is a pair 〈M, I〉, whereM = 〈W,R, V 〉,is a Kripke L-model and I is a function I : L →W ∪{⊥} interpreting groundlabels such that:

(i) I(1) ∈W

(ii) I(σ.(n)) = I(σ.n) for all σ.n and σ.(n) in L(iii) for all σ ∈ L, if I(τ) = ⊥ for some τ ∈ ipr(σ) then I(σ) = ⊥(iv) if σ ✄ τ , I(σ) ∈W , and I(τ) ∈W , then I(σ)R I(τ).

Definition 3.7. An L-interpretation 〈M, I〉, whereM = 〈W,R, V 〉, satisfiesa ground label σ, if for all labels τ.n ∈ ipr(σ) ∪ {σ} (that end in an uncon-ditional label position): I(τ) ∈W implies I(τ.n) ∈W . The L-interpretation〈M, I〉 satisfies a ground tableau formula X : ∆ :σ :A, if

(a) I(σ) = ⊥, or I(τ) = ⊥ for some τ ∈ ∆, or I(σ) |= A; and

(b) if I(τ) ∈W for all τ ∈ ∆, then 〈M, I〉 satisfies σ.3

3 In particular, 〈M, I〉 must satisfy σ if ∆ = ∅, which is the most frequent case.


Thus, a tableau formula is satisfied by default if its label σ is undefined(that is, if I(σ) = ⊥) or if one of the labels in ∆ is undefined. But be-cause we deal only with strongly generated sets of labels with root 1, thetwin requirements that every L-interpretation 〈M, I〉 define the label 1, andcondition (b) in the above definition force the interpretation function I to“define” as many members of ipr(σ) as is possible. However, for a condi-tional ground label of the form τ.(n), where n is parenthesised, it is perfectlyacceptable to have I(τ.(n)) = ⊥ even if I(τ) ∈W .

Example 3.8. If 〈M, I〉 satisfies σ = 1.1.1, then I(1), I(1.1), and I(1.1.1)must be defined. If σ = 1.(1).1, then I(1.(1)) need not be defined; but if itis, then I(1.(1).1) must be defined.

The domain of every interpretation function I is the set of all groundlabels L, but our tableaux contain labels with variables. We therefore intro-duce a definition of satisfiability for non-ground tableau formulae capturingour intuition that a label σ.(x) stands for all possible successors of the la-bel σ, and taking into account the special nature of universal variables.

Definition 3.9. Given an L-interpretation 〈M, I〉 and a grounding sub-stitution µ, a (non-ground) tableau formula φ = X :∆ : σ :A is satisfied by〈M, I, µ〉, written as 〈M, I, µ〉 |= φ, if for all grounding substitutions λ, theground formula φλ|Xµ is satisfied by 〈M, I〉 (Def. 3.7). A set F of tableauformulae is satisfied by 〈M, I, µ〉, if every member of F is simultaneouslysatisfied by 〈M, I, µ〉.

In the above definition, a ground formula φλ|Xµ is constructed from φin two steps, such that the definition of satisfiability for ground formulaecan be applied. To cater for the differences between the free variables anduniversal variables, we use two substitutions: a fixed substitution µ and anarbitrary substitution λ. The first step, applying λ|X to φ instantiates theuniversal variables x ∈ X . The second step, applying µ to φλ|X , instantiatesthe free variables. Therefore, the instantiation of universal variables x ∈ X isgiven by the arbitrary substitution λ, and the instantiation of free variablesx �∈ X is given by the fixed substitution µ. Quantifying over all λ capturesthe universal nature of the members of X.

Note, that in the following definition of satisfiable tableaux, there has tobe a single satisfying L-interpretation for all grounding substitutions µ.

Definition 3.10. A tableau T is L-satisfiable if there is an L-interpretation〈M, I〉 such that for every grounding substitution µ there is some openbranch B in T with 〈M, I, µ〉 |= B.


4. The Calculus

4.1. Overview

We now present an overview of our calculus, highlighting its main principles.

Refutation method. Our calculus is a refutation method: to prove that aformula A is a theorem of logic L, we first convert its negation ¬A into NNFobtaining a formula B, and then test if B is L-unsatisfiable. To do so, westart with the initial tableau whose single node is ∅ : ∅ : 1 :B and repeatedlyapply the tableau expansion rules, the substitution rule, and the closurerule until a closed tableau results. Since our rules preserve L-satisfiabilityof tableaux, a closed tableau indicates that B is indeed L-unsatisfiable, andhence that its negation A is L-valid. Since L-frames characterise the logicL we then know that A is a theorem of logic L. Constructing a tableaufor ∅ : ∅ : 1 :B can be seen as a search for an L-model for B. Each branchis a partial definition of a possible L-model, and different substitutions givedifferent L-models. Our tableau rules extend one particular branch usingone particular formula, thus differing crucially from the systematic methodsin [12, 16] where a rule extends all branches that pass through one particularformula.

Universal variables. In the following we explain the relationship between uni-versal variables in first-order logic (resp. universal quantifiers in first-orderlogic) and modal logics (resp. box-formulae in modal logics). To empha-sise the similarities, we use in this explanation a simplified notation σ :✷Ainstead of X : ∆ :σ :A for tableau formulae.

In first-order tableaux, a free variable x is used as a place marker foran eigenvariable whose value is unknown when reducing a formula ∀xϕ(x)to ϕ(x). In our calculus, a free variable x is used as a place marker for a suc-cessor world whose value is unknown when reducing a labelled formula σ :✷Ato σ.x :A. Because a world may have no successor, variable positions in la-bels in our calculus must be conditional to preserve soundness for non-seriallogics, but we ignore this aspect for the moment to simplify the exposition.In each calculus, the free variable x is used so that the actual value of xdoes not have to be guessed at the point where ∀xϕ(x) or σ :✷A is reduced.Instead, we defer the choice of x until enough information is available tomake a choice that immediately closes a branch of the respective tableau.

Since the free variable x is a proxy for one instance of x, or one particularsuccessor of σ respectively, x must be instantiated to the same value on allbranches. Moreover, one single instantiation of the free variables has to befound that allows us to close all branches of a tableau simultaneously, and


1 :✸¬p ∨✸¬q1 :✷(p ∧ q)

1.x1 : p ∧ q

1.x1 : p

1.x1 : q

1 :✸¬p1.1 :¬p{x1/1}

1 :✸¬q1.2 :¬q

1.x2 : p ∧ q

1.x2 : p

1.x2 : q{x2/2}

(a)

1 :✸¬p ∨✸¬q1 :✷(p ∧ q)

1.x : p ∧ q

1.x : p

1.x : q

1 :✸¬p1.1 :¬p{x/1}

1 :✸¬q1.2 :¬q{x/2}

(b)

Figure 1. Tableau proof (a) without and (b) with universal variables (see Example 4.1).

instantiating a free variable (in the wrong way) to close one branch, canmake it impossible to close other branches.

However, both ∀xϕ(x) and σ :✷A have a universal nature, and we mayrequire additional renamings ϕ(x1), . . . , ϕ(xn) and σ.x1 :A, . . . , σ.xn :A ofthe respective reduced formulae to construct a close tableau, correspondingto multiple different instances of ∀xϕ(x) and multiple different successorsof σ :✷A respectively.

Beckert and Hahnle [5] noticed that under certain conditions, the freevariable x can be instantiated in one way to close one branch, but this bind-ing can be undone, and x can be instantiated in a different way to close an-other branch, without losing soundness. Such a variable x is said to be “uni-versal” since it allows the single formula ϕ(x) or σ.x :A respectively to standin for themultiple renamings ϕ(x1), . . . , ϕ(xn) and σ.x1 :A, . . . , σ.xn :Amen-tioned above. Indeed, if the number of required renamings n is large,then using a variable in this “universal” manner can shorten the tableaubranches considerably. The example below illustrates this point for ourmodal tableaux.

Example 4.1. Suppose that we are given a tableau branch containing thetableau formulae 1 :✸¬p ∨✸¬q and 1 :✷(p ∧ q).

In Figure 1(a) we reduce the second formula to obtain 1.x1 : p ∧ q, creat-ing the free variable x1. Applying the conjunctive rule to this formula gives


1.x1 : p and 1.x1 : q. Next we apply the disjunctive rule to the root and splitthe tableau into two branches, the first containing 1 :✸¬p and the secondcontaining 1 :✸¬q. We apply the diamond-rule to obtain 1.1 :¬p on the firstbranch where 1.1 is a label new to the tableau. We can now close the leftbranch by setting x1 := 1. All occurrences of x1 are now bound to 1.

To continue, we apply the diamond-rule to 1 :✸¬q on the second branchto obtain 1.2 :¬q where the label 1.2 is new to the tableau.

The only potential closure on this second branch is between 1.2 :¬q and1.x1 : q but this closure is not possible since x1 is bound to 1 so that the latterformula is actually 1.1 : q, and this does not contradict 1.2 :¬q. We thereforehave to apply the box-rule once again to 1 :✷(p ∧ q) to obtain 1.x2 : p ∧ qon the second branch thereby creating a second free variable x2. Applyingthe conjunctive rule to this formula allows us to close the second branch byputting x2 := 2 as shown.

In Figure 1(b) we proceed in exactly the same manner until we close thefirst branch, except that we create the free variable x rather than x1. Butbefore proceeding to process the second branch, we undo the binding for x.Consequently we can close the second branch much sooner by putting x := 2,without generating the extra renaming 1.x2 : p ∧ q required in Figure 1(a).Thus the variable x is instantiated in multiple ways.

How to detect such “universal” variables and use them only in a soundmanner? Here is one way. Every variable x is introduced into a label bythe reduction of a box-formula like ✷A. At some later stage of the tableauconstruction, in some particular formula ϕ(x) on some particular tableaubranch B, the variable x will be “universal” if a renaming ϕ′ = ϕ{x := x′}of ϕ could be added to B without generating additional branches. That is,the modified tableau would be no more difficult to close than the original.One way to generate the renaming is to repeat the rule applications thatlead to the generation of ϕ, starting from the box-rule application thatcreated x. Once renaming ϕ′ is present on B, the variable x never hasto be instantiated to close B because ϕ′ could be used instead of ϕ, thusinstantiating x′ instead of x. However, if x occurs on two separate branchesin the tableau then repeating these rule applications would generate at leastone additional branch, making the new tableau harder to close than theoriginal one.

All variables are obviously universal when they are created. So how cana universal variable become non-universal? The crucial criterion is that thesteps that generate the copy x′ of x must not cause the creation of additionalbranches to the tableau. This simply means that all occurrences of the


original x must occur on only one branch. Since the only rule that causesbranching is the disjunctive rule, occurrences of x on different branches canbe created only by a disjunctive rule application to a formula containing x.Therefore, an application of the disjunctive rule to a formula ψ causes theuniversal variables of ψ to become “non-universal” variables. That is, all“non-universal” variables are a result of a disjunction within the scope ofa ✷, corresponding to the fact that ✷ does not distribute over ∨.

Consider 1 :✷(p ∨ q) and suppose we reduce this to 1.x : p ∨ q. At thispoint, x is universal, but it will become “non-universal” once we apply thedisjunctive rule to obtain two branches, the first containing 1.x : p and thesecond containing 1.x : q. An instantiation of x to 1 (say) on the first branchmust now instantiate x to 1 on the second branch as well since x is nolonger universal. But it may also be necessary to reduce 1 :✷(p ∨ q) onceagain on the second branch to obtain 1.y : p ∨ q to obtain closure. Thereis clearly an interaction between the box-rule and the disjunctive rule. Wecapture this interaction by ensuring that when the disjunctive rule makesuniversal variables “non-universal”, an additional renaming (1.y : p ∨ q) ofthe disjunctive-formula (1.x : p ∨ q) that created these “non-universal” vari-ables is generated by the disjunctive rule itself (rather than the box-rule).

The diamond-rule. Our diamond-rule does not introduce a new label σ.n,when it is applied to X :∆ : σ :✸A. Instead, each formula ✸A is assignedits own unique label �A� which is a Godelisation of A itself.4 This rule iseasier to implement than the traditional one; and it guarantees that (upto renaming of free variables) only a limited number of different labels canoccur in a proof, which depends on the number of different sub-formulae inthe input formula.

The box-rule for symmetric or euclidean logics can shorten labels. For ex-ample, the tableau formula X ′ : ∆′ : 1 :A is obtainable from X : ∆ : 1.(1) :✷Afor symmetric logics. The semantics for serial logics guarantee that all labelsdefine worlds, but in non-serial logics, the label 1 may be defined when 1.(1)is undefined. To ensure that the formula X ′ : ∆′ : 1 :A or one of its descen-dants is used to close a branch only if the label 1.(1) is defined, the label 1.(1)is made part of ∆′ (see Section 4.3). Such problems do not occur when ruleapplications always lengthen labels since τ has to be defined if τ.l is defined.

All expansion rules are sound and invertible (some denominator of eachrule is L-satisfiable iff the numerator is L-satisfiable). Thus, unlike tradi-

4 Similar features were used in leanTAP [7] for first-order predicate logic, and in otherlabelled proof systems for modal logics, but within the context of ground labels; see [28].


tional modal tableau methods where the order of (their non-invertible) ruleapplications is crucial [12, 16], the order of rule application is immaterial.

The differences in the calculi for different logics L is mainly in the box-rule, with different denominators for different logics. In addition, a simplerversion of the closure rule can be used if the logic is serial.

4.2. Tableau Expansion Rules

There are four expansion rules, one for each class of complex (non-literal) for-mulae (conjunctive, disjunctive, box-, and diamond-formulae). If we wantedto avoid the restriction to NNF, we would have several types of formulaein each class and, accordingly, would need several (similar) rules for eachclass (and an extra rule for double negation). Since we assume that all ourformulae are in NNF, we need just one rule for each of the four classes.

As usual, in each rule, the formula above the horizontal line is its nu-merator (the premiss) and the formula(e) below the horizontal line, possiblyseparated by vertical bars, are its denominators (the conclusions). All ex-pansion rules (including the box-rule) are “destructive”; that is, once the(appropriate) rule has been applied to a formula occurrence to expand abranch, that formula occurrence is not used again to expand that branch.Note that we permit multiple occurrences of the same formula on the samebranch (nevertheless, when a branch is identified with the set of formulae itcontains, these occurrences collapse to one).

Definition 4.2. Given a tableau T , a new tableau T ′ may be constructedfrom T by applying one of the L-expansion rules from Table 3 as follows: Ifthe numerator of a rule occurs on a branch B in T , then the branch B is ex-tended by the addition of the denominators of that rule. For the disjunctiverule the branch splits and the formulae in the right and left denominator,respectively, are added to the two resulting sub-branches instead.

The box-rule(s) shown in Table 3 require explanation. The form of therule is determined by the index L in the accompanying table. But someof the denominators have side conditions that determine when they are ap-plicable. For example, the constraint σ5 = 1.l5 means that (5) is part ofthe denominator only when the numerator of the box-rule is of the formX : ∆ : 1.l5 :✷A. Similarly, the constraints σ2 = τ2.l2 and σ4 = τ4.l4 for the(4r) and (B) denominators mean these rules can be used only for a numer-ator of the form X : ∆ :σ :✷A where |σ| ≥ 2, thereby guaranteeing that thestrictly shorter labels τ2 and τ4 that appear in the respective denominatorsare properly defined. The table indicates that the rules for a logic L and its


X : ∆ :σ :A ∧BX : ∆ :σ :AX ′ : ∆′ :σ′ :B

Conjunctive rule. X ′ : ∆′ :σ′ :B is aT -renaming of X : ∆ :σ :B.

X : ∆ :σ :A ∨B∅ :∆1 :σ1 :A ∅ : ∆1 :σ1 :B

X2 : ∆2 :σ2 :A ∨B X3 : ∆3 :σ3 :A ∨B

Disjunctive rule. The formulaeXi : ∆i :σi :A ∨B are T -renamingsof X :∆ :σ :A ∨B (for 1 ≤ i ≤ 3)with disjoint Xi. If X = ∅ then therenamings for i = 2 and i = 3 areomitted.

X : ∆ :σ :✸AX :∆ :σ.�A� :A

Diamond-rule. �·� is an arbitrary butfixed bijection from the set of formu-lae to N.

X : ∆ :σ :✷AX ∪ {x} : ∆ :σ.(x) :A (K)

X1 ∪ {x1} : ∆1 :σ1.(x1) :✷A (4)X2 : ∆2 ∪ {σ2} : τ2 :✷A (4r)

X3 :∆3 :σ3 :A (T)X4 : ∆4 ∪ {σ4} : τ4 :A (B)

X5 ∪ {x5} : ∆5 ∪ {σ5} : 1.(x5) :✷A (5)

Box-rule. The formulaeXi : ∆i :σi :✷A are T -renamings ofX : ∆ :σ :✷A for 1 ≤ i ≤ 5. The vari-ables x, x1, x5 ∈ Vars are new to T .The sets X ∪ {x}, X1 ∪ {x1}, X2,X3, X4, X5 ∪ {x5} are disjoint. Also,σ2 = τ2.l2, σ4 = τ4.l4, and σ5 = 1.l5.The form of the denominator dependson the logic L, and is determined byincluding every denominator corres-ponding to the entry for L in the ta-ble below.

Logics Box-rule denominatorK, D (K)T (K), (T)KB, KDB (K), (B)a

K4, KD4 (K), (4)K5, KD5 (K), (4)a, (4r)a, (5)ba Only included if |σ| ≥ 2.

Logics Box-rule denominatorK45, K45D (K), (4), (4r)a

K4B, (K), (B)a, (4), (4r)a

B (K), (T), (B)a

S4 (K), (T), (4)S5 (K), (T), (4), (4r)ab Only included if |σ| = 2.

Table 3. Tableau expansion rules.


serial version LD are identical because these logics are distinguished by theform of our closure rule; see Definition 4.5. Various other ways to define thecalculi for serial logics exist; see [16].

The expansion rules rename the universal variables in the denominatorsto ensure that no two literals in a tableau, which may be used for closure,share the same universal variables. This is important because our closurerule uses a single instantiation of all universal variables. We could do withoutrenamings if the closure rule used separate instantiations of the universalvariables of the closing literals (including those literals used for justification).This is a technicality since all proofs would still go through with minorchanges.

4.3. The Substitution Rule and the Closure Rule

By definition, the substitution rule allows us to apply any substitution atany time to a tableau. In practice, however, it makes sense to apply only“useful” substitutions; that is, those most general substitutions which allowto close a branch of the tableau.

Definition 4.3. Substitution rule: Given a tableau T , a new tableau T ′ =T µ may be constructed from T by applying a substitution µ to T thatinstantiates free variables in T with other free variables or natural numbers.

In tableaux for modal logics without free variables as well as in free-variable tableaux for first-order logic, a tableau branch is closed if it con-tains complementary literals since this immediately implies the existence ofan inconsistency. Here, however, this is not always the case because thelabels of the complementary literals may be conditional. For example, the(apparently contradictory) pair ∅ : 1.(1) : p and ∅ : 1.(1) :¬p is not necessarilyinconsistent since the world I(1.(1)) may not exist in the chosen model. Be-fore declaring this pair to be inconsistent, we therefore have to ensure thatI(1.(1)) �= ⊥ for all L-interpretations satisfying the tableau branch B thatis to be closed. Fortunately, this knowledge can be deduced from other for-mulae on B. Thus in our example, a formula like ψ = X : 1.1 :A on B would“justify” the use of the literal pair ∅ : 1.(1) : p and ∅ : 1.(1) :¬p for closing thebranch B since any L-interpretation 〈M, I〉 satisfying B has to satisfy ψ,and, thus, I(1.(1)) = I(1.1) �= ⊥ has to be a world in the chosen model M.The crucial point is that the label 1.1 of ψ is unconditional exactly in theconditional positions of ∅ : 1.(1) : p and ∅ : 1.(1) :¬p. These observations arenow extended to the general case of arbitrary ground labels.


Definition 4.4. A ground label σ with j-th position [nj] (1 ≤ j ≤ |σ|) isjustified on a branch B if there is some set F ⊆ B of tableau formulae suchthat for every j:

1. some label in lab(F) has (an unconditional but otherwise identical) j-thposition nj; and

2. for all τ ∈ lab(F): if |τ | ≥ j then the j-th position in τ is nj or (nj).

Definition 4.5. Given a tableau T and a substitution λ : Univ(T )→ N thatinstantiates universal variables in T with natural numbers, the L-closure ruleallows to construct a new tableau T ′ from T by marking B in T as closedprovided that:

1. the branch Bλ of T λ contains a pair X :∆ :σ : p and X ′ : ∆′ :σ :¬p ofcomplementary literals; and

2. (a) the logic L is serial, or (b) all labels in {σ} ∪∆ ∪∆′ are ground andjustified on Bλ.

Note: the substitution λ that instantiates universal variables is not ap-plied to the tableau when the branch is closed; it must merely exist.

By definition, only complementary literals close tableau branches, butin theory, pairs of complementary complex formulae could be used as well(that, however, would lead to additional choice points in the proof search).

4.4. Tableau Proofs

We now have the ingredients to define the notion of a tableau proof.

Definition 4.6. A sequence T 0, . . . ,T r of tableaux is an L-proof for theL-unsatisfiability of a formula A if:

1. T 0 consists of the single node ∅ : ∅ : 1 :A;

2. for 1 ≤ m ≤ r, the tableau T m is constructed from T m−1 by applyingan L-expansion rule (Def. 4.2), the substitution rule (Def. 4.3), or theL-closure rule (Def. 4.5); and

3. all branches in T r are marked as closed.

Theorems 4.7 and 4.9 state soundness and completeness for our calculuswith respect to the Kripke semantics for logic L; proofs in Sections 5 and 6.

Theorem 4.7 (Soundness). Let A be a formula in NNF. If there is an L-proof T 0, . . . , T r for the L-unsatisfiability of A (Def. 4.6), then A is L-unsatisfiable.


We prove completeness for the non-deterministic and unrestricted versionof the calculus, and also for all tableau procedures based on this calculusthat deterministically choose the next formula for expansion (in a fair way)and that only apply most general closing substitutions.

Definition 4.8. Given an open tableau T , a tableau procedure Ψ determin-istically chooses an open branch B in T and a non-literal tableau formula ψon B for expansion.

The tableau procedure Ψ is fair if, in the (possibly infinite) tableau con-structed using Ψ (where no substitution is applied and no branch is closed),every formula is used for expansion of every branch on which it occurs.

Theorem 4.9 (Completeness). Let Ψ be a fair tableau procedure, and letA be an L-unsatisfiable formula in NNF. Then there is a (finite) tableauproof T 0, . . . , T r for the L-unsatisfiability of A, where T i is constructedfrom T i−1 (1 ≤ i ≤ r) by

1. applying the appropriate L-expansion rule to the branch B and the for-mula ψ on B chosen by Ψ from T i−1; or

2. applying a most general substitution such that the L-closure rule can beapplied to a previously open branch in T i−1.

When a tableau proof is constructed according to Theorem 4.9, i.e., usinga fair tableau procedure, the remaining choices are (1) whether a branch(that can be closed) is closed or further expanded and (2) in case thereare different possibilities to close a branch, which of different most generalclosing substitutions is applied. An implementation has to resolve this non-determinism (for example, using a backtracking mechanism). As long as nobranch is closed, the expansion is deterministic.

There is clearly an interaction between the box-rule, the closure rule andthe disjunctive rule. This interaction can be used to restrict the search spaceby ensuring that when the disjunctive rule “frees” universal variables, anadditional renaming (1.y : p ∨ q) of the disjunctive-formula (1.x : p ∨ q) thatcreated these “non-universal” variables is generated by the disjunctive rule,but only if demanded by the closure rule (that is, when the free variable xgets instantiated during branch closure). Applying this same criterion tothe copy (1.y : p ∨ q) will produce another copy (1.z : p ∨ q), but only upondemand, and so on.

Example 4.10. We prove that A = ✷(p→ q)→ (✷p→ (✷q ∧✷p)) is aK-theorem. To do this, we first transform the negation of A into NNF; the


[1;–] ∅ : 1 :✷(¬p ∨ q) ∧✷p ∧ (✸¬q ∨✸¬p)[2;1] ∅ : 1 :✷(¬p ∨ q)

[3;1] ∅ : 1 :✷p ∧ (✸¬q ∨✸¬p)[4;3] ∅ : 1 :✷p

[5;3] ∅ : 1 :✸¬q ∨✸¬p[6;2] {y} : 1.(y) :¬p ∨ q

[7;4] {x} : 1.(x) : p[8;5] ∅ : 1 :✸¬q

[10;8] ∅ : 1.�¬q� :¬q

[11;6] ∅ : 1.(y1) :¬p[13;6] {y2} : 1.(y2) :¬p ∨ q

B1

[12;6] ∅ : 1.(y1) : q

[14;6] {y3} : 1.(y3) :¬p ∨ q

B2

[9;5] ∅ : 1 :✸¬p[15;9] ∅ : 1.�¬p� :¬p

B3

Figure 2. The tableau T from Example 4.10.

result is

B = NNF(¬A) = ✷(¬p ∨ q) ∧✷p ∧ (✸¬q ∨✸¬p) .

The (fully expanded) tableau T , that is part of the proof for the K-unsatis-fiability of B is shown in Figure 2. The nodes of the tableau are numbered; apair [i; j] is attached to the i-th node, the number j denotes that node i hasbeen created by applying an expansion rule to the formula in node j. Note,that by applying the disjunctive rule to 6, the nodes 11 to 14 are added;13 and 14 are renamings of 6. The variable y1 is no longer universal in 11and 12.

When the substitution µ = {y1/�¬q�} is applied to T , the branches ofthe resulting tableau T µ can be closed as follows, thereby completing thetableau proof. The left branch B1 of T µ can be closed using the universal-variable substitution λ1 = {x/�¬q�} as B1λ1 contains the complementarypair {�¬q�} : 1.(�¬q�) : p and ∅ : 1.(�¬q�) :¬p in nodes 7 and 11, respectively.The label 1.(�¬q�) of these literals is justified on B1λ1 by label 1.�¬q� offormula 10. In this case, the complementary literals contain conditionallabels which are only justified by a third formula on the branch, so check-ing for justification is indispensable. The middle branch B2 of T µ can beclosed using the same universal-variable substitution λ2 = λ1 = {x/�¬q�}


[1;–] ∅ : ∅ : 1 :✷✷p ∧ ¬p[2;1] ∅ : ∅ : 1 :✷✷p

[3;1] ∅ : ∅ : 1 :¬p[4;2] {x} : ∅ : 1.(x) :✷p

[5;4] {x, y} : ∅ : 1.(x).(y) : p[6;4] {x} : {1.(x)} : 1 : p

Figure 3. The tableau T from Example 4.11.

as for the left branch. The branch B2λ2 then contains the complementaryliterals ∅ : 1.(�¬q�) :¬q and ∅ : 1.(�¬q�) : q in nodes 10 and 12. The label isagain justified by formula 10, which in this case is one of the complementaryliterals. Note that the middle branch B2 can be closed only by the substi-tution µ = {y1/�¬q�}, other choices will not suffice. The right branch B3

of T µ can be closed using the universal-variable substitution λ3 = {x/�¬p�}as B3λ3 then contains the pair {�¬p�} : 1.(�¬p�) : p and {�¬p�} : 1.�¬p� :¬pof complementary literals in nodes 7 resp. 15. The label 1.(�¬p�) of node 7is justified on B3 by formula 15.

The universal-variable substitution λ1 = λ2 = {x/�¬q�} that closes B1

and B2 is incompatible with the substitution λ3 = {x/�¬p� that closes B3.Therefore, if the variable x were not universal in formula 7, the tableau couldnot be closed; a second instance of formula 7 would have to be added.

In the above example, the only reason for instantiating free variables isto make the labels of closing literals identical. There are situations however,where a free variable has to be instantiated solely to make sure that thelabels of the closing literals are justified (and not to make them identical).5

Example 4.11. This example demonstrates why the second part ∆ oftableau formulae is needed. Consider the formula A = ✷✷p→ p, which is atheorem of the serial logic KDB but not of the non-serial logic KB. Thecalculi for both logics have the same tableau expansion rules (they only differin the closure rule); the tableau T for the NNF ✷✷p ∧ ¬p of ¬A shown inFigure 3 has been constructed using these rules.

The (single) branch of T contains the complementary literals φ1 = ∅ : ∅ :1 : ¬p and φ2 = {x} : {1.(x)} : 1 : p in nodes 3 and 6. Using the closure ruleof the calculus for KDB, that does not require a justification of labels, the

5 This happens, for example, during the construction of a tableau proof for the unsat-isfiability of the formula (✷q) ∧ (✸✷✸r) ∧ ✷((✸✷(p ∧ ¬p)) ∨ ¬q).


branch can be closed with φ1 and φ2. Thus, a tableau proof for the KDB-unsatisfiability of ¬A can be constructed from T . Using the closure rule ofthe calculus for the logic KB, however, the branch cannot be closed. Thatclosure rule requires the labels of the two complementary literals to be justi-fied on the branch, including all labels in the sets ∆1 = ∅ and ∆2 = {1.(x)}—but neither the label 1.(x) ∈ ∆2 nor any of its instances 1.(n) is justified.No tableau proof for the KB-unsatisfiability of A can be constructed, whichis correct as ¬A is, in fact, KB-satisfiable.

5. Soundness Proof

The following two lemmata, which will be used in the soundness proof, fol-low immediately from the definitions. The first one states that a tableauformula ψ and a renaming ψ′ of ψ are equivalent. The second lemma statesthat if a label σ is justified on a tableau branch B satisfied by an interpre-tation 〈M, I〉, then I(σ) has to be a world in M (even if σ is conditional).

Lemma 5.1. Let 〈M, I〉 be an L-interpretation, µ a grounding substitution,ψ a formula in a tableau T , and ψ′ a T -renaming of ψ. Then 〈M, I, µ〉 |= ψif and only if 〈M, I, µ〉 |= ψ′.

Lemma 5.2. Let 〈M, I〉 be an L-interpretation, where M = 〈W,R, V 〉, letB be a tableau branch, and let σ be a ground label. If 〈M, I, µ〉 satisfies B,and the label σ is justified on B, then I(σ) ∈W .

The crux of the proof is to show that L-satisfiability is preserved by theexpansion rule (Lemma 5.5), the substitution rule (Lemma 5.6), and theclosure rule (Lemma 5.7). Consequently, if the initial tableau consisting ofthe input formula A is L-satisfiable, then all tableaux for A are L-satisfiable.None can be closed as closed tableaux are not L-satisfiable. Hence, theexistence of a closed tableau for A implies the L-unsatisfiability of A.

For the soundness proof we restrict all considerations to standard inter-pretations, where (ground) labels are interpreted “in the right way,” suchthat the diamond-rule preserves L-satisfiability (in standard models). More-over, for serial logics, all ground labels are assigned a world by the interpre-tation function, which helps the closure rule to preserve L-satisfiability.

Definition 5.3. An L-interpretation 〈M, I〉, where M = 〈W,R, V 〉, is astandard interpretation provided that:

1. For all ground labels τ.[n]:

if I(τ) ∈W and I(τ) |= ✸An, then I(τ.[n]) ∈W and I(τ.[n]) |= An,


where An is the formula for which n = �An� (�·� is the bijection from theset of formulae to the set of natural numbers used for the diamond-rule).

2. If the logic L is serial, then I(σ) ∈W for all ground labels σ.

The restriction to standard interpretations makes sense: every L-mo-del M that satisfies a formula A can be combined with a label interpreta-tion I, such that 〈M, I〉 is a standard interpretation and satisfies the initialtableau ∅ : ∅ : 1 :A.

Lemma 5.4. Given a formula A in NNF and an L-modelM that satisfies A,there is a standard L-interpretation 〈M, I〉 that satisfies the tableau consist-ing of the singleton tableau formula ∅ : ∅ : 1 :A.

Proof. As M = 〈W,R, V 〉 satisfies A, we know that there is some worldw1 ∈W such that w1 |= A. Now, for n ≥ 1, let An be the formula for whichn = �An� (where �·� is the bijection from the set of formulae to the set ofnatural numbers used for the diamond-rule) and create I as follows. PutI(1) = w1, and for every ground label of the form τ.n: (a) if there is aworld w ∈W such that I(τ)Rw and w |= An then put I(τ.n) = I(τ.(n)) = w;(b) else, if there is no such world w, but there is a world w′ that is reachablefrom I(τ), then put I(τ.n) = I(τ.(n)) = w′; (c) else, if there is no worldreachable from I(τ), put I(τ.n) = I(τ.(n)) = ⊥.

The L-interpretation 〈M, I〉 is a standard interpretation by way of itsdefinition, and in addition satisfies the tableau consisting of φ0 = ∅ : ∅ : 1 :A.To prove this, we have to show that for all grounding substitutions µ thereis a branch B in this tableau such that for all substitutions λ the groundformula φ0λ|∅µ is satisfied by 〈M, I〉. Since φ0λ|∅µ = φ0 this reduces toshowing that (a) I(1) = ⊥ or I(1) |= A, and (b) 〈M, I〉 satisfies the label 1.Condition (a) is satisfied since I(1) |= A by choice, and Condition (b) holdsbecause there are no labels τ.n in ipr(1) ∪ {1}.

Next we prove that satisfiability by standard interpretations is preservedby the tableau expansion rules, the substitution, and the closure rule.

In the proofs of Lemmata 5.5–5.7 we make use of the fact that, by defini-tion, a tableau formula X : ∆ :σ :F is satisfied by 〈M, I, µ〉 iff for all ground-ing substitutions λ:

I(σ) = ⊥, or I(ξ) = ⊥ for some ξ ∈ ∆, or I(σ) |= F ; (∗)and

if I(ξ) �= ⊥ for all ξ ∈ ∆, then 〈M, I〉 satisfies σ; (∗∗)


where σ = σλ|Xµ and ∆ = ∆λ|Xµ. We can also formulate (∗) as:

If I(σ) �= ⊥ and I(ξ) �= ⊥ for all ξ ∈ ∆, then I(σ) |= F .

Lemma 5.5. If the tableau T is satisfied by the standard L-interpretation〈M, I〉, and T ′ is constructed from T by applying an L-expansion rule, then〈M, I〉 satisfies T ′ as well.

Proof. We show that for each grounding substitution µ, there is a branch B′

in T ′ that is satisfied by 〈M, I〉.By assumption, 〈M, I, µ〉 satisfies some branch B of T . If T ′ is con-

structed from T by expanding a branch other than B, then B is a branchof T ′ as well, and we are through. For the case that T ′ is constructedfrom T by expanding the branch B, we show that 〈M, I, µ〉 satisfies one ofthe branches of T ′ by cases according to the expansion rule applied.Conjunctive rule. Let φ = X :∆ : σ : (A ∧B) be the formula on B, such thatT ′ is constructed from T by adding φ1 = X : ∆ :σ :A and φ′

2 = X ′ : ∆′ :σ′ :Bto B. Because 〈M, I, µ〉 |= φ, (∗) and (∗∗) hold for all grounding substitu-tions λ where σ = ζ = σλ|Xµ, ∆ = ∆λ|Xµ, and F = A ∧B. As I(ζ) |= A∧Bimplies I(ζ) |= A and I(ζ) |= B, the same is true for F = A and for F = B.Therefore, 〈M, I, µ〉 satisfies φ1 and φ2 and, by Lemma 5.1, the renaming φ′

2;thus, 〈M, I, µ〉 satisfies B ∪ {φ1, φ

′2}, which is a branch in T ′.

Disjunctive rule. Let φ = X : ∆ :σ : (A ∨B) be the formula in B, such thatT ′ is constructed from T by adding φ′

1 = ∅ : ∆1 : σ1 : A and φ′ =X2 :σ2 : ∆2 :A ∨B to B obtaining B′

1 and adding φ′2 = ∅ : ∆1 :σ1 :B and

φ′′ = X3 : ∆3 :σ3 :A ∨B to B obtaining B′2. 〈M, I, µ〉 |= φ implies that both

φ′ and φ′′ are satisfied by 〈M, I, µ〉 (using Lemma 5.1), and it implies that(∗) and (∗∗) hold for all grounding substitutions λ′ where σ = ζ = σλ′

|Xµ,∆ = ∆λ′

|Xµ, and F = A ∨B. Since I(ζ) |= A ∨B implies that I(ζ) |= Aor I(ζ) |= B, the same is true for F = A or for F = B. In particular, ifwe chose λ′ equal to µ, then (∗) and (∗∗) hold for σ = σµ|Xµ = σµ = σλ|∅µ,∆ = ∆λ′

|Xµ = ∆λ|∅µ, and F = A or F = B, where λ is an arbitrary ground-ing substitution. This implies that 〈M, I, µ〉 satisfies φ1 or φ2 and thus, byLemma 5.1, (at least) one of the renamings φ′

1 and φ′2. Therefore, 〈M, I, µ〉

satisfies one of the branches B′1 and B′

2 in T ′.Diamond-rule. Let φ = X :∆ : σ :✸A be the formula on B, such that T ′ isconstructed from T by adding φ1 = X :∆ : σ.�A� :A to B. 〈M, I, µ〉 |= φ im-plies that (∗) and (∗∗) hold for all grounding substitutions λ where σ =ζ = σλ|Xµ, ∆ = ∆λ|Xµ, and F = ✸A. Considering (∗), I(ζ) = ⊥ impliesI(ζ.�A�) = ⊥; and I(ζ) |= ✸A implies that w |= A for some w ∈W reachable


ψ σ ∆ F Condition

φ(K) = X ∪ {x} : ∆ :σ.(x) :A ζ.(n) ∆λ|Xµ A —φ(4) = X ∪ {x} : ∆ : σ.(x) : ✷A ζ.(n) ∆λ|Xµ ✷A L transitive,

orL euclideanand |σ| ≥ 2

φ(4r) = X : ∆ ∪ {σ} : τ : ✷A ζ′ (∆ ∪ {σ})λ|Xµ ✷A L euclideanφ(5) = X ∪ {x} : ∆ ∪ {σ} : 1.(x) : ✷A 1.(n) (∆ ∪ {σ})λ|Xµ ✷A L euclidean

and |σ| = 2φ(T) = X : ∆ :σ :A ζ ∆λ|Xµ A L reflexiveφ(B) = X : ∆ ∪ {σ} : τ :A ζ′ (∆ ∪ {σ})λ|Xµ A L symmetric

where n = µ(x), σ = τ.l, ζ = σλ|Xµ, ζ′ = τλ|Xµ.

Table 4. Formulae added by the box-rule.

from I(ζ). Because 〈M, I〉 is a standard interpretation, I(ζ.�A�) ∈W andI(ζ.�A�) |= A. Considering (∗∗), if I(ξ) �= ⊥ for all ξ ∈ ∆λ|Xµ, then 〈M, I〉satisfies ζ; in that case, (a) if I(ζ) = ⊥, then 〈M, I〉 satisfies ζ.�A� as well,because ζ has to be conditional, (b) if I(ζ) �= ⊥, then I(ζ) |= ✸A, which im-plies by definition of standard interpretations that I(ζ.�A�) ∈W . Therefore,(∗) and (∗∗) hold with σ = σ.�A�λ|Xµ and F = A as well, which implies that〈M, I, µ〉 satisfies φ1 and, therefore, satisfies the branch B ∪ {φ1} in T ′.

Box-rule. Let φ = X : ∆ :σ :✷A be the formula in B, such that T ′ is con-structed from T by adding to B—according to Table 3—renamings of one ormore of the formulae ψ shown in the first column of Table 4. The respectiveformulae ψ are only used if the corresponding conditions in the last columnof Table 4 is fulfilled. We show that these conditions imply that 〈M, I, µ〉satisfies ψ and thus, by Lemma 5.1, the renaming of ψ that is added to thebranch. Thus, 〈M, I, µ〉 satisfies the resulting new branch in T ′.

〈M, I, µ〉 |= φ implies that (∗) and (∗∗) hold for all grounding substi-tutions λ where σ = ζ = σλ|Xµ, ∆ = ∆λ|Xµ, and F = ✷A. For each ofthe formulae ψ in Table 4 we prove that 〈M, I, µ〉 satisfies ψ by showingthat (∗) and (∗∗) hold with the corresponding instances of σ, ∆, and F ,as shown in columns 2–4 in Table 4. Throughout the rest of this proof,we make use of the fact that the variable x does not occur in σ and ∆and, thus, σλ|Xµ = ζ = σλ|X∪{x}µ and ∆λ|Xµ = ∆λ|X∪{x}µ. Note also thatσ.(x)λ|X∪{x}µ = ζ.(n); and ζ = ζ ′.[m] where [m] = µ(l).

ψ = φ(K): (∗) If I(ζ.(n)) �= ⊥ then I(ζ) �= ⊥ and I(ζ)R I(ζ.(n)). If, in ad-dition, I(ξ) �= ⊥ for all ξ ∈ ∆λ|Xµ = ∆λ|X∪{x}µ, then we can conclude thatI(ζ) |= ✷A. By the definition of the box-operator, this implies I(ζ.(n)) |= A.


(∗∗) If I(ξ) �= ⊥ for all ξ ∈ ∆λ|Xµ, then 〈M, I〉 satisfies the label ζ.(n) be-cause it satisfies ζ and the extension (n) is conditional.

ψ = φ(4): (∗) If I(ζ.(n)) = w′ �= ⊥ then I(ζ) = w �= ⊥ and wRw′. If, in ad-dition, I(ξ) �= ⊥ for all ξ ∈ ∆λ|Xµ = ∆λ|X∪{x}µ, then we can conclude thatw |= ✷A. If w′ has no successors, then w′ |= ✷A for any A vacuously. Solet w′′ be any world such that w′Rw′′. (a) If R is transitive, this immediatelyimplies wRw′′. (b) If R is euclidean and |ζ| ≥ 2, then there is a world w0

such that w0Rw. We can derive wRw′′ as follows: w0Rw implies wRw,wRw′ and wRw implies w′Rw, w′Rw and w′Rw′′ implies wRw′′. Now, sincew |= ✷A we have w′′ |= A, and since w′′ is an arbitrary world reachablefrom w′, w′ |= ✷A. Condition (∗∗) can be proven in the same way as in theprevious sub-case.

ψ = φ(4r): (∗) If I(ζ) = ⊥ or there is some label ξ in ∆λ|Xµ such thatI(ξ) = ⊥, then there is a label ξ in (∆ ∪ {σ})λ|Xµ = ∆λ|Xµ ∪ {ζ} such thatI(ξ) = ⊥. Otherwise, if I(ζ) = w |= ✷A, then I(ζ ′) = w′ �= ⊥ and w′Rw. Ifw′ has no successors, then w′ |= ✷A for any A vacuously. So let w′′ beany world such that w′Rw′′. Since L is euclidean, w′Rw and w′Rw′′ im-plies wRw′′ and w′′Rw. Thus w |= ✷A implies w′′ |= A. This holds forall w′′ reachable from w′, so I(ζ ′) = w′ |= ✷A. (∗∗) If I(ξ) �= ⊥ for allξ ∈ (∆ ∪ {σ})λ|Xµ, then 〈M, I〉 satisfies the label ζ = σλ|Xµ and, thus, thelabel ζ ′ ∈ ipr(ζ).

ψ = φ(5): (∗) If I(1.(n)) �= ⊥ then I(1) �= ⊥ and I(1)R I(1.(n)). If, in addi-tion, I(ξ) �= ⊥ for all ξ in ∆, then I(σλ|X∪{x}µ) = I(ζ) �= ⊥ and I(ξ) �= ⊥for all ξ in ∆λ|X∪{x}µ = ∆λ|Xµ, which implies I(ζ) |= ✷A. Also, sinceI(ζ) = I(1.[m]) �= ⊥, we have I(1)R I(ζ) and I(1.(n))R I(ζ) because the logicis euclidean. Now, for all worlds w such that I(1.(n))Rw, we have I(ζ)Rw(again because the logic is euclidean); and w |= A since I(ζ) |= ✷A. Thisholds for all w reachable from I(1.(n)); therefore I(1.(n)) |= ✷A. (∗∗) IfI(ξ) �= ⊥ for all ξ ∈ (∆ ∪ {σ})λ|Xµ, then 〈M, I〉 satisfies the label σλ|Xµ =ζ = 1.[m] and, thus, 1 ∈ ipr(1.[m]). Because the extension (n) is conditional,〈M, I〉 then also satisfies 1.(n).

ψ = φ(T): (∗) I(ζ) = ⊥, or I(ξ) = ⊥ for some ξ ∈ ∆λ|Xµ, or I(ζ) |= ✷Awhich implies I(ζ) |= A (by reflexivity). Condition (∗∗) is trivially satisfiedin this sub-case.

ψ = φ(B): (∗) If I(ζ) = ⊥ or there is some label ξ in ∆λ|Xµ such thatI(ξ) = ⊥, then there is a label ξ in (∆ ∪ {σ})λ|Xµ = ∆λ|Xµ ∪ {ζ} such thatI(ξ) = ⊥. Otherwise, if I(ζ) = w |= ✷A, then I(ζ ′) = w′ �= ⊥ and w′Rw(since ζ = ζ ′.[m]). Because R is symmetric this implies wRw′ and thus


I(ζ ′) = w′ |= A. Condition (∗∗) can be proven in the same way as in thesub-case ψ = φ(4r).

Lemma 5.6. If the tableau T is satisfied by the standard L-interpretation〈M, I〉, and T ′ is constructed from T by applying the substitution rule, then〈M, I〉 satisfies T ′ as well.

Proof. Let ν be the substitution applied to derive T ′ from T . We mustshow that for each grounding substitution µ, there is a branch B′ in T ′

that is satisfied by 〈M, I, µ〉. Let µ be an arbitrary but fixed groundingsubstitution. By assumption, 〈M, I, µ〉 satisfies some branch B of T . Letφ = X :∆ :σ :A be an arbitrary formula on B. Let λ be an arbitrary ground-ing substitution, and define the substitution λ′ = λ ◦ ν. Then the substi-tutions µ ◦ λ|X ◦ ν and µ ◦ λ′

|X are identical, because ν does not instanti-ate variables in X, and thus λ′

|X = (λ ◦ ν)|X = λ|X ◦ ν. As 〈M, I, µ〉 |= φ,

(∗) and (∗∗) hold with σ = σλ′|Xµ, ∆ = ∆λ′

|Xµ, and F = A. This im-plies, because µ ◦ λ|X ◦ ν = µ ◦ λ′

|X , that (∗) and (∗∗) hold as well withσ = σνλ|Xµ and ∆ = ∆νλ|Xµ. Thus, 〈M, I, µ〉 satisfies φν.

Lemma 5.7. If the tableau T is satisfied by the standard L-interpretation〈M, I〉, and T ′ is constructed from T by applying the L-closure rule, then〈M, I〉 satisfies T ′ as well.

Proof. T ′ is obtained from T by marking a branch B in T as closed,because it contains formulae φ1 = X1 :∆1 :σ1 : p and φ2 = X2 :∆2 :σ2 :¬p,and there is a substitution λ of the universal variables in T such thatσ1λ|X1

= σ2λ|X2= ξ and (a) the logic L is serial, or (b) all labels ζ in

{ξ} ∪∆1λ|X1∪∆2λ|X2

are ground and justified on B. Suppose the branch Bwere satisfied by 〈M, I, µ〉 for some grounding substitution µ. Then I(ζµ) ∈W , because (1) if the logic L is serial, then I(ζµ) ∈W since 〈M, I, µ〉 is astandard interpretation; (2) otherwise, ζ is ground and justified, and thusζµ = ζ and I(ζ) ∈W according to Lemma 5.2. Now we have a contradiction,because 〈M, I, µ〉 |= φ1 implies I(ξµ) = I(σ1λ|X1

µ) |= p, and 〈M, I, µ〉 |= φ2

implies I(ξµ) = I(σ2λ|X2µ) |= ¬p.

Thus, our assumption is wrong, and B is not satisfied by 〈M, I, µ〉 forany µ. But then there has to be a different branch B0 in T for all µ, thatoccurs in T ′ as well and is not affected by marking the branch B as closed.

Now we have everything needed to prove soundness of our calculus.

Theorem 5.8. Let A be a formula in NNF. If there is an L-proof T 0, . . . ,T r for the L-unsatisfiability of A (Def 4.6), then A is L-unsatisfiable.


Proof. For a contradiction, suppose there is an L-proof T 0, . . . , T r forthe L-unsatisfiability of A, but that A is L-satisfiable. Then there is anL-model M of A and by Lemma 5.4 there is a standard L-interpretationof T 0. Lemmata 5.5, 5.6 and 5.7 imply that satisfiability by standard L-interpretations is preserved in tableau proofs. Hence the tableau T r is sat-isfied by a standard L-interpretation as well. But by definition of a tableauproof, all branches in T r are marked as closed, thus the tableau T r cannotpossibly be L-satisfiable.

Note that if a tableau is L-satisfiable then it is satisfied by a standard L-interpretation. Thus, L-satisfiability is preserved in general; it is, however,quite difficult (if not impossible) to prove this directly without using thenotion of standard interpretations.

6. Completeness Proof

We now turn to the completeness of our calculus. The completeness theoremcan be stated in two contraposing ways (let A be a formula in NNF): “If Ais L-unsatisfiable, then there is a tableau proof T 0, . . . ,T r for ∅ : ∅ : 1 :A.”or equivalently “If there is no tableau proof for ∅ : ∅ : 1 :A then A is L-satisfiable.”

We prove the completeness theorem as stated in the paper viz: Let Ψ bea fair tableau procedure, and let A be an L-unsatisfiable formula in NNF.Then there is a (finite) tableau proof T 0, . . . ,T r for the L-unsatisfiabilityof A, where T i is constructed from T i−1 (1 ≤ i ≤ r) by

• applying the appropriate L-expansion rule to the branch B and the for-mula ψ on B chosen by Ψ from T i−1; or

• applying a most general substitution such that the L-closure rule can beapplied to a previously open branch in T i−1.

So suppose we are given a fair tableau procedure Ψ and an initial tableau∅ : ∅ : 1 :A. We prove the theorem in a rather roundabout way following themethod of Beckert and Posegga [7]:

Step 1: We define the notion of an L-Hintikka set of ground tableau for-mulae (Def. 6.1) and show that every Hintikka set is satisfied by some L-interpretation (Lemma 6.2).

Step 2: Consider the sequence (Tn)n≥0 deterministically constructed by thefair tableau procedure Ψ without closing branches or applying substitutions,and define the infinite tableau T∞ to be the limit of the Tn.


Assuming that no substitution of the variables in T∞ gives a closed in-stance of T∞, we define a particular substitution θ∞ and show that T∞θ∞contains at least one branch that forms a Hintikka set (Lemma 6.3). Step 1then gives an L-satisfiable set, and in particular an L-interpretation satisfy-ing the formula A in root ∅ : ∅ : 1 :A of T∞θ∞. Consequently, if there is nosubstitution that closes T∞ then A is L-satisfiable (Lemma 6.4).Step 3: Contraposing Lemma 6.4 gives: If A is L-unsatisfiable, there is somesubstitution θ that, when applied, allows to close all branches in T∞. Thus,for some n ∈ N, all branches in the finite tableau Tnθ can be closed.Step 4: To conclude the completeness proof, we show that if Tnθ can beclosed, then the substitution θ can be decomposed so that: θ = θ′◦ξr ◦ξr−1◦· · · ◦ ξ1 where ξi is a most general closing substitution for the instantiation(Bi)ξ1ξ2 . . . ξi−1 of the i-th branch Bi in Tn. (And θ′ is the part of θ that isnot actually needed to close T ′.) Thus the tableau Tn constructed using thefair procedure R can be closed by r applications of the substitution and theclosure rule.

6.1. Step 1: Hintikka Sets

Definition 6.1. A set X of ground tableau formulae is an L-Hintikka set,if it satisfies the following conditions:

1. lab(X ) is a strongly generated set of labels with root 1.

2. There is no primitive proposition p such that (a) X :∆1 : σ : p and Y : ∆2 :σ : ¬p are in X , and (b) the logic L is serial or all labels in {σ}∪∆1∪∆2

are justified in X .

3. If X : ∆ :σ :A ∧B ∈ X then X :∆ :σ :A ∈ X and X : ∆ :σ :B ∈ X .

4. If X : ∆ :σ :A ∨B ∈ X then X :∆ :σ :A ∈ X or X :∆ : σ :B ∈ X .

5. If X :∆ : σ :✷A ∈ X , then the following conditions have to be satisfiedfor the logic L as determined by Table 3:

(K) condition: X ∪ {n} :∆ : σ.(n) :A ∈ X for every n ∈ N;(4) condition: X ∪ {n} :∆ :σ.(n) :✷A ∈ X for every n ∈ N (for K5 and

KD5 only if σ = τ.l);(4r) condition: if σ = τ.l then X : ∆ ∪ {σ} : τ :✷A ∈ X ;(T) condition: X : ∆ :σ :A ∈ X ;(B) condition: if σ = τ.l then X : ∆ ∪ {σ} : τ :A ∈ X ;(5) condition: if σ = 1.l then X ∪ {n} : ∆ ∪ {σ} : 1.(n) :✷A ∈ X .

6. If X : ∆ :σ :✸A ∈ X then X : ∆ :σ.n :A ∈ X for some n ∈ N.


Lemma 6.2. Every L-Hintikka set X is satisfied by some L-interpretation〈M, I〉.

Proof. We define the L-model M = 〈W,R, V 〉 as follows. Put W = {[σ] |σ ∈ L} if L is serial and put W = {[σ] | σ ∈ lab(X ), σ is justified in X} if Lis not serial, where [σ] is the equivalence class of all labels that are identicalto σ up to (conditional) parentheses. For all [σ], [τ ] ∈W , let [σ]R[τ ] iff σ✄τ :that is, iff τ is L-accessible from σ (see Table 2). For each primitive proposi-tion p let V (p) be defined by: If L is serial, then V (p) = {[σ] | X :∆ :σ : p ∈X}. Otherwise, if L is not serial, then V (p) = {[σ] | X : ∆ :σ : p ∈ X ,I(σ) ∈ W , I(ξ) ∈ W for all ξ ∈ ∆}. The (identity) interpretation I isdefined by: I(σ) = [σ] if [σ] ∈W and I(σ) = ⊥ otherwise.

Lemma 3.5 then implies that M is an L-model. According to its con-struction 〈M, I〉 is, therefore, an L-interpretation.

We show by induction on the degree of tableau formulae φ = X :∆ : σ :Athat if φ ∈ X then (a) [σ] �∈W , or (b) [ξ] �∈W for some ξ ∈ ∆, or (c) [σ] |= A.This induction hypothesis implies that 〈M, I〉 satisfies φ. Thus X itself issatisfied by the L-interpretation 〈M, I〉.

Let the degree of a formula A be defined syntactically (as usual). Thedegree deg of a tableau formula is then defined by: deg(X : ∆ :σ :A) <deg(X ′ : ∆′ :σ′ :A′) iff (a) deg(A) < deg(A′) or (b) deg(A) = deg(A′) and|σ| < |σ′|.

Base case: Thus the traditional part A of φ is a literal. In case A = p,[σ] ∈W , and [ξ] ∈W for all ξ ∈ ∆, we have [σ] |= p by the definition of V .In case A = ¬p, we must show that if [σ] ∈W and [ξ] ∈W for all ξ ∈ ∆ then[σ] |= ¬p. That is, [σ] �∈ V (p). For a contradiction suppose that [σ] ∈ V (p).By the definition of V there has to be a tableau formula X ′ :∆′ : σ′ : p ∈ Xand, in addition, if L is not serial then [σ′] ∈W and [ξ′] ∈W for all ξ′ ∈ ∆′.By definition, if L is not serial, [σ′] ∈W iff σ′ is justified in X . Thus wehave two complementary and “completely justified” atomic formulae in X ;contradicting condition 2 in the definition of Hintikka sets.

The induction step depends on the form of the formula A in φ.

A = B ∧ C: According to condition 3 in the definition of Hintikka sets,there are formulae X : ∆ :σ :B ∈ X and X : ∆ :σ :C ∈ X . The inductionhypothesis applies to these formulae. Therefore, (a) [σ] �∈W , or (b) [ξ] �∈Wfor some ξ ∈ ∆, or [σ] |= B and [σ] |= C which implies [σ] |= B ∧ C.

A = B ∨ C: Similar to the case A = B ∧ C.

A = ✷B: Suppose (a) [σ] ∈W , and (b) [ξ] ∈W for all ξ ∈ ∆; we then haveto prove that [τ ] |= B for all [τ ] ∈W such that σ ✄ τ . We first show that


(certain combinations of) the sub-conditions laid out as part of condition 5of the definition of Hintikka sets imply this property for certain [τ ] ∈W :

(K) condition: for all τ of the form τ = σ.[n] where n ∈ N. Proof: By defi-nition of Hintikka sets, there is some X ′ : ∆ :σ.(n) :B ∈ X for every n ∈ N,to which the induction hypothesis applies. Thus, if [τ ] ∈W , then [τ ] |= B.

(K) and (4) conditions: for all τ of the form τk = σ.n1 . . . nk where k ≥ 1and n1, . . . , nk ∈ N (for logics K5 and KD5 only provided that |σ| ≥ 2).Proof: We use an induction on k. We show, that for all k ≥ 0 (with τ0 = σ)there is a formula Xk :∆ : τk :✷B ∈ X (for some Xk). Using the same argu-ment as above for the (K) condition, this implies [τk] |= B if [τk] ∈W for allk ≥ 1. For k = 0 we have X0 : ∆ : τ0 :✷B = X :∆ : σ :A ∈ X by assumption.Induction step: Xk :∆ : τk :✷B ∈ X implies Xk+1 :∆ : τk+1 :✷B ∈ X (withXk+1 = Xk ∪ {nk}), by the (4) condition.

(T) condition: for τ = σ. Proof: There has to be a formula X : ∆ :σ :B ∈ Xthat the induction hypothesis applies to. Thus, if [σ] ∈W , then [σ] |= B.

(B) condition: for τ such that σ = τ.l. Proof: There has to be a formulaX : ∆ ∪ {σ} : τ :B in X that the induction hypothesis applies to. Thus, if[τ ] ∈W , then [τ ] |= B.

(K), (4), (4r), (5) conditions: for all τ such that |τ | ≥ 2 in case |σ| ≥ 2, andfor all τ of the form 1.n where n ∈ N otherwise (i.e., in case σ = 1). Proof:If |σ| ≥ 2, we prove by induction on the length of τ using the (4r) condi-tion that for all τ ∈ ipr(σ) there is a formula X : ∆ : τ :✷B ∈ X . Using thesame argument as above for the (K) condition this implies [τ ] |= B for allτ such that |τ | = 2 and [τ ] ∈W . In addition, we have X : ∆ : 1.m :✷B ∈ Xfor some m ∈ N (where 1.m ∈ ipr(σ)); thus the (5) condition implies thatX ∪ {n} :∆ ∪ σ : 1.(n) :✷B ∈ X for all n ∈ N. Now, we can prove [τ ] |= Bfor all τ such that |τ | ≥ 3 and [τ ] ∈W as in the case of the (K) and (4)conditions. If σ = 1, we can derive [σ.n] |= B for all n ∈ N and [σ.n] ∈Wusing the (K) condition (see above).

(K), (4), (4r) conditions: for all τ such that |τ | ≥ 2. Proof: We prove byinduction on the length of τ using the (4r) condition that for all τ ∈ ipr(σ)there is a formula X :∆ : τ :✷B ∈ X . In particular, we have X :∆ : 1 :✷B ∈X . Now, we can proceed to prove [τ ] |= B for all τ such that |τ | ≥ 2 and[τ ] ∈W as in the case of the (K) and (4) conditions.

(K), (T), (4), (4r) conditions: for all τ . Proof: Similar to the case of condi-tions (K), (4) and (4r) we prove by induction that for all τ such that [τ ] ∈Wthere is a formula X :∆ : τ :✷B ∈ X , which then, using the same argumentas above for the (T) condition, implies [τ ] |= B.


By checking Table 2, it is obvious that the sub-conditions for box-formulaethat apply to an L-Hintikka set imply: if [τ ] ∈W and σ ✄ τ , then [τ ] |= B.

A = ✸B: According to condition 6 in the definition of Hintikka sets, there isa formula X :∆ : σ.n :B ∈ X . The induction hypothesis applies to this for-mula. Therefore, (a) [σ.n] �∈W or (b) [ξ] �∈W for some ξ ∈ ∆; or [σ.n] |= B.Now, since the label σ.n itself occurs in lab(X ), [σ.n] �∈W implies that σ.n isnot justified in X . Since the last position of σ.n is unconditional this impliesthat σ is not justified in X . Hence [σ] �∈W . Furthermore, if [σ.n] |= B then[σ] |= ✸B since σ ✄ σ.n for all L. Together, we have enough to prove that(a) [σ] �∈W or (b) [ξ] �∈W for some ξ ∈ ∆ or (c) [σ] |= ✸B as desired.

6.2. Step 2: Considering an Infinite Tableaux

Let T1, T2, etc. be the sequence of tableaux deterministically constructedusing Ψ without closing branches or applying a substitution. These tableauxapproximate the infinite tree T∞.

Now suppose that no substitution allows T∞ to be closed. Thus we canchoose any substitution θ, and we are guaranteed that T∞θ will containsome open branch. The branch may differ according to the choice of θ.

We now define a particular substitution θ∞ as follows: Let {B1,B2, . . .}be an enumeration of all the branches of T∞. Let Φ = {φ1, φ2, . . .} be anenumeration of the disjunctive formulae (formulae of the form Xi : ∆i : σi :Bi ∨ Ci) in T∞ excluding renamings. For every disjunctive formula, if φi

occurs on Bk then let φijk be the j-th renaming of φi on the k-th branch.The label σi of φi will be of finite length. Thus, the set of all ground

instances of σi is enumerable: let {σ1i , σ

2i , . . .} be such an enumeration.

Let x be a variable in Xijk and suppose it occurs in the p-th positionof σijk. Note that the sets Xijk of universal variables are all pairwise disjoint(even if only one of the formulae in the numerator of the conjunctive rule isrenamed). To ensure that the k-th branch Bk is a potential source of an L-model we ensure that the occurrences of φi on Bk “cover” all the instancesof σi. So choose θ∞ so that θ∞(x) = n, where n is the value of the p-thposition of σj

i . Thus if x is in the p-th position of σi1k, its value “covers” σ1i ,

if it is in the p-th position of σi2k, its value “covers” σ2i , and so on.

Lemma 6.3. If θ∞ is defined as above, and B is an open branch of thetableau T∞ that cannot be closed when θ∞ is applied then

X = {φλ|Xθ∞ | φ = X : ∆ :σ :A is a formula on B, andλ is a grounding substitution}

is an L-Hintikka set.


Proof. We have to check each clause of Definition 6.1 for the set X .

Condition 1. It is obvious that the root is 1, and fairly easy to see that wealways produce a strongly generated set.

Condition 2. Suppose this condition is violated by X . Then there have tobe formulae φ1 = X1 :∆1 :σ1 : p, φ2 = X2 : ∆2 : σ2 :¬p on B and groundingsubstitutions λ1 and λ2, such that σ1λ1|X1

θ∞ = σ2λ2|X2θ∞ = ζ, and (b) the

logic L is serial or all labels in {ζ} ∪∆1λ1|X1θ∞ ∪∆2λ2|X2

θ∞ are justifiedin X . Our expansion rules always use T -renamings of universal variables intheir numerator, hence X1 ∩X2 = ∅. Therefore, there is a single groundingsubstitution λ of the universal variables in T∞, such that σ1λ = σ1λ1|X1

andσ2λ = σ2λ2|X2

. In addition, λ ◦ θ∞ = θ∞ ◦ λ, since θ∞ only instantiated freevariables in T∞. Thus the branch B can be closed using the substitution λof the universal variables in T∞, which contradicts the choice of B.Condition 3. We must show that for all φ = X :∆ : σ :A ∧B ∈ B and allgrounding substitutions λ, and thus for all formulae of the form φλ|Xθ∞,the formulae φ1λ|Xθ∞ and φ2λ|Xθ∞ are in X , where φ1 = ∅ : ∆ :σ :A andφ2 = ∅ : ∆ : σ :B. Since the appropriate rule has been applied to φ, the for-mulae X :∆ :σ :A and X ′ :∆′ : σ′ :B are both on B. Thus, φ1λ|Xθ∞ ∈ X .For φ2, let µ be the substitution renaming the variables in X such thatX ′ : ∆′ : σ′ :B = (X : ∆ :σ :B)µ, and put λ′ = (λ ◦ µ), which implies λ′

|X′ =λ|X ◦µ. The substitution λ′ is grounding. Therefore, by definition the set Xcontains the formula φ′

2λ′|X′θ∞, which is identical to φ2λ|Xθ∞.

Condition 4. We have to show, that for all φ = X : ∆ :σ :A ∨B ∈ B and allgrounding substitutions λ, and thus for all formulae of the form φλ|Xθ∞, oneof the formulae φ1λ|Xθ∞ and φ2λ|Xθ∞ is in X , where φ1 = ∅ : ∆ : σ :A andφ2 = ∅ : ∆ : σ :B. If X = ∅ then this holds immediately by the special case ofthe disjunctive rule. Otherwise, according to the construction of T∞ and θ∞,there has to be a renaming φ′ = φν of φ on B (where ν is the renaming substi-tution) such that θ∞|X′ ◦ ν = λ|X , i.e., φ′θ∞ = φλ|Xθ∞. Since the appropri-ate rule has been applied to φ′, one of the formulae φ′

1 = φ1ν and φ′2 = φ2ν is

on B and thus φ′1λ|∅θ∞ = φ′

1θ∞ = φ1λ|Xθ∞ or φ′2λ|∅θ∞ = φ2λ|Xθ∞ is in X .

Conditions 5 and 6. Since these conditions closely resemble the tableau ex-pansion rules, the proof that they hold for X is similar to that for condition 3(conjunctive formulae).

Lemma 6.4. If there is no substitution θ such that all branches of T∞θ canbe closed, then the input formula for which the tableau sequence has beenconstructed is L-satisfiable.


Proof. Since T∞ cannot be closed using any substitution, it cannot beclosed by applying θ∞ as defined above. Thus there is some open branchin T∞θ∞. By Lemma 6.3 this branch forms an L-Hintikka set. By Lemma 6.2such a set gives an L-interpretation 〈M, I〉 that satisfies the root ∅ : ∅ : 1 :Aof T 0. But this means that in the L-model M we must have I(1) |= A.

6.3. Step 3: Constructing a Finite Closed Tableaux

Contraposing Lemma 6.4 gives: If A is L-unsatisfiable, then there is at leastone substitution θ that, when applied, allows to close all branches in T∞.

Lemma 6.5. If there is a substitution θ such that all branches of T∞θ canbe closed, then there is an n ∈ N such that all branches in the finite tableauTnθ can be closed.

Proof. According to Konig’s Lemma, the tableau T that results fromremoving from T∞θ all formulae that are not needed to close one of thebranches on which they occur (that includes justification) is finite. Thus,there is a finite n ∈ N such that T is an initial subtree of Tnθ.

6.4. Step 4: Decomposition of the Closing Substitution

Lemma 6.6. If T ′nθ is closed for some finite n, then the substitution θ can

be decomposed so that: θ = θ′ ◦ ξr ◦ ξr−1 ◦ · · · ◦ ξ1 where ξi is a most generalclosing substitution for the instantiation (Bi)ξ1ξ2 . . . ξi−1 of the i-th branch,Bi, in T ′

n. And θ′ is the part of θ that is not actually needed to close T ′n.

Proof. We construct the ξi inductively as follows: Define ξ′0 = θ. For1 ≤ i ≤ r, let ξi be a most general substitution, such that (a) ξ′i−1 is a spe-cialisation of ξi; that is, there is a substitution ξ′i such that ξ′i−1 = ξ′i ◦ ξi;and (b) ξi is a closing substitution for (Bi)ξ1ξ2 . . . ξi−1.

Then ξi is a most general closing substitution. For otherwise, there mustbe a closing substitution ξ′′i that is more general than ξi. The is-more-generalrelation is transitive hence ξ′′i is more general than ξ′i−1, which contradictsour choice of ξi as a most general substitution satisfying the two conditions.

Finally, define θ′ = ξ′r.

We can now conclude the proof of the completeness theorem (Theo-rem 4.9) as follows:

The formula A is L-unsatisfiable and T∞ is constructed using a fair proofprocedure so there is a substitution θ such that all branches of T∞θ can beclosed (Lemma 6.4). Then there is a finite tableau Tn such that all branches


of Tnθ can be closed (Lemma 6.5). The tableau Tn can be constructedwith n expansion rule applications using the procedure Ψ. Since θ can bedecomposed into r most general closing substitutions (Lemma 6.6), a closedtableau can be constructed from Tn by r applications of the substitution andclosure rules satisfying the conditions of the completeness theorem.

7. Conclusion and Future Work

The advantages of free variables. We believe that labels with variables de-liver the following advantages:

– The use of variables generates a smaller search space since a label cannow stand in for all its ground instances. This is in stark contrast to themodular systems of [22, 16], where only ground labels are used.

– The use of a Godelisation function in the diamond-rule leads to a smallernumber of labels than in other labelled tableau methods since two dif-ferent occurrences of the formula X :∆ :σ :✸A lead to the same formulaX : ∆ :σ.�A� :A. We therefore do not need to delete duplicate occurrencesof a formula as is done in some tableau implementations for modal logics.This is particularly important since the world σ.�A� may be the root ofa large sub-model and duplicating it is likely to be extremely inefficient.

Experiences with a lean implementation. Tableau-based theorem proversdeveloped during the last decade for first-order logic have been complex andhighly sophisticated, typified by systems like Setheo [21] and 3TAP [6]. Onthe other hand, free-variable tableaux, and their extensions like universal-variable tableaux, have been used successfully for lean Prolog implementa-tions, as typified by leanTAP [7] and ileanTAP [25]. A “lean” implementationis an extremely compact program that exploits Prolog’s built-in clause in-dexing scheme and backtracking mechanisms instead of relying on elaborateheuristics. Such compact lean provers are much easier to understand thantheir more complex stablemates, and hence easier to adapt to special needs.

We have implemented our calculus as a “lean” theorem prover writtenin Prolog (the source code is available at i12www.ira.uka.de/~beckert/modlean on theWorld Wide Web). It makes extensive use of Prolog featureslike unification and backtracking.6 The basic version for the logic K is calledleanK, and consists of just eleven Prolog clauses and 45 lines of code. The

6 When the prover is ported to other languages, the Prolog mechanisms may have to beimplemented; but even then the advantage of lean provers remains, namely that (the mainpart of) the prover is compact and thus easy to understand and to adapt to special needs.


version for the logic KD which does not demand justified labels, is evenshorter: it consists of only 6 clauses and 27 lines of code.

Our initial results with this lean implementation are encouraging. How-ever, as a comparison with state-of-the-art theorem provers for modal logics[1] has shown, modal logics differ from first-order logic: the free-variabletechnique is not enough. Because of the propositional flavour of modal log-ics, techniques such as simplification [23] are needed to implement an efficientprover.

We have developed the theory of how to obtain modular proof systemsbased upon free-variable tableaux for modal logics; but it is future work tovalidate the usefulness of the free-variable technique in the modal frameworkby combining it with other techniques.

Future work. Our method is really a very clever translation of propositionalmodal logics into first-order logic, and most of the complications arise be-cause some worlds may have no successors. The new notion of conditionallabels allows us to keep track of these complications, and thus handle thenon-serial logics that frustrate other “general frameworks” [14, 19]. Never-theless, our method can also handle second-order “provability” logics like Gand Grz; see [16]. Furthermore, specialised versions of these tableau sys-tems can match the theoretical lower bounds for particular logics like K45,G and Grz if we give up modularity; see [16, 22]. We intend to extend ourinitial implementation of leanK along these lines.

The 15 basic normal modal logics are decidable and techniques from [12,16, 22, 18] can be used to extend our method into a decision procedure (wehave reported first results in [3, 4]).

Fitting [11] shows how to view the original leanTAP program for classicalpropositional logic as an unusual sequent calculus dirseq. He also showshow to extend dirseq to handle the modal logics K, KT, K4, and S4.As with traditional modal tableaux, however, dirseq does not handle thesymmetric logics like S5 and B. Our work can be extended to give a modularfree-variable version of dirseq that does handle these logics.

It is also possible to extend our method to deal with the notions of globaland local logical consequence [12].

An alternative approach [17] uses different unification algorithms to findcomplementary labelled literals for branch closure. The interactions betweenmodalities, variable labels, and unification algorithms, however, is by nomeans easy to disentangle. Extending our method to utilise special unifica-tion algorithms is perfectly possible, now that correctness and completenesshave been proved for the interactions between modalities and variable labels.


Acknowledgements. We thank the anonymous referees and Nicolette Bon-nette for useful comments on earlier versions of this paper.

References

[1] Balsinger, P., and A. Heuerding, ‘Comparison of theorem provers for modal logics:

Introduction and summary’, in Proceedings, International Conference on Theorem

Proving with Analytic Tableaux and Related Methods, Oisterwijk, The Netherlands,

LNCS 1397, Springer, 1998.

[2] Beckert, B., and R. Gore, ‘Free variable tableaux for propositional modal logics’,

in Proceedings, International Conference on Theorem Proving with Analytic Tableaux

and Related Methods, Pont-a-Mousson, France, LNCS 1227, pages 91–106, Springer,

1997.

[3] Beckert, B., and R. Gore, ‘leanK 2.0: Description for the comparison of theorem

provers for modal logics’, in Proceedings, International Conference on Theorem Prov-

ing with Analytic Tableaux and Related Methods, Oisterwijk, The Netherlands, LNCS

1397, pages 33–34, Springer, 1998.

[4] Beckert, B., and R. Gore, ‘System description: leanK 2.0’, in Proceedings, 15th In-

ternational Conference on Automated Deduction (CADE), Lindau, Germany, LNCS

1421, pages 51–55, Springer, 1998.

[5] Beckert, B., and R. Hahnle, ‘Analytic tableaux’, in W. Bibel and P. H. Schmitt,

editors, Automated Deduction – A Basis for Applications, volume I: Foundations,

Kluwer, Dordrecht, 1998.

[6] Beckert, B., R. Hahnle, P. Oel, and M. Sulzmann, ‘The tableau-based theorem

prover 3TAP , version 4.0’, in Proceedings, 13th International Conference on Automated

Deduction (CADE), New Brunswick, NJ, USA, LNCS 1104, pages 303–307, Springer,

1996.

[7] Beckert, B., and J. Posegga, ‘leanTAP : Lean tableau-based deduction’, Journal of

Automated Reasoning 15(3):339–358, 1995.

[8] Bencivenga, E., ‘Free logic’, in D. Gabbay and F. Gunthner, editors, Handbook of

Philosophical Logic, volume 3, Kluwer, Dordrecht, 1986.

[9] Bonnette, N., ‘KF Vt : A free variable sequent system for tense logic Kt’, Australian

Computational Logic Workshop, February 2000.

[10] D’Agostino, M., D. Gabbay, and A. Russo, ‘Grafting modalities onto substructural

implication systems’, Studia Logica 59:65–102, 1997.

[11] Fitting, M., ‘leanTAP revisited’, Journal of Logic and Computation 8(1):33–47,

1998.

[12] Fitting, M. C., Proof Methods for Modal and Intuitionistic Logics, volume 169 of

Synthese Library, D. Reidel, Dordrecht, Holland, 1983.


[13] Fitting, M. C., First-Order Logic and Automated Theorem Proving, Springer, second

edition, 1996.

[14] Frisch, A., and R. Scherl, ‘A general framework for modal deduction’, in J. Allen,

R. Fikes, and E. Sandewall, editors, Proceedings, 2nd Conference on Principles of

Knowledge Representation and Reasoning, Morgan-Kaufmann, 1991.

[15] Gabbay, D., Labelled Deductive Systems, Oxford University Press, 1996.

[16] Gore, R., ‘Tableau methods for modal and temporal logics’, in M. D’Agostino,

D. Gabbay, R. Hahnle, and J. Posegga, editors, Handbook of Tableau Methods, Kluwer,

Dordrecht, 1999.

[17] Governatori, G., ‘A reduplication and loop checking free proof system for S4’, in

Short Papers: TABLEAUX’96, number 154-96 in RI-DSI, Via Comelico 39, 20135

Milan, Italy, 1996, Department of Computer Science, University of Milan.

[18] Heuerding, A., M. Seyfried, and H. Zimmermann, ‘Efficient loop-check for back-

ward proof search in some non-classical logics’, in P. Miglioli, U. Moscato, D. Mundici,

and M. Ornaghi, editors, Proceedings, 5th Workshop on Theorem Proving with An-

alytic Tableaux and Related Methods, Terrasini, Palermo, Italy, LNCS 1071, pages

210–225, Springer, 1996.

[19] Jackson, P., and H. Reichgelt, ‘A general proof method for first-order modal

logic’, in Proceedings, International Joint Conference on Artificial Intelligence (IJ-

CAI), pages 942–944, 1987.

[20] Kanger, S., Provability in Logic, Stockholm Studies in Philosophy, University of

Stockholm, Almqvist and Wiksell, Sweden, 1957.

[21] Letz, R., J. Schumann, S. Bayerl, and W. Bibel, ‘SETHEO: A high-performance

theorem prover’, Journal of Automated Reasoning 8(2):183–212, 1992.

[22] Massacci, F., ‘Strongly analytic tableaux for normal modal logics’, in A. Bundy,

editor, Proceedings, 12th International Conference on Automated Deduction (CADE),

Nancy, France, LNCS 814, pages 723–737, Springer, 1994.

[23] Massaci, F., ‘Simplification: A general constraint propagation technique for propo-

sitional and modal tableaux’, in Proceedings, International Conference on Theorem

Proving with Analytic Tableaux and Related Methods, Oisterwijk, The Netherlands,

LNCS 1397. Springer, 1998.

[24] Mints, G., A Short Introduction to Modal Logic, CSLI, Stanford, 1992.

[25] Otten, J., ‘ileanTAP: An intuitionistic theorem prover’, in Proceedings, International

Conference on Theorem Proving with Analytic Tableaux and Related Methods, Pont-

a-Mousson, France, LNCS 1227, Springer, 1997.

[26] Pitt, J., and J. Cunningham, ‘Distributed modal theorem proving with KE’, in

M. Miglioli, U. Moscato, D. Mundici, and M. Ornaghi, editors, Proceedings, Interna-

tional Conference on Theorem Proving with Analytic Tableaux and Related Methods,

Terrasini, Palermo, Italy, LNCS 1071, pages 160–176, Springer, 1996.


[27] Reeves, S. V., ‘Semantic tableaux as a framework for automated theorem-proving’,

in C. Mellish and J. Hallam, editors, Advances in Artificial Intelligence (Proceedings

of AISB-87), pages 125–139, Wiley, 1987.

[28] Russo, A., ‘Generalising propositional modal logic using labelled deductive systems’,

in F. Baader and K. Schulz, editors, Proceedings, Frontiers of Combining Systems

(FroCoS), Munich, Germany, volume 3 of Applied Logic Series, Kluwer, Dordrecht,

1996.

[29] Wallen, L. A., Automated Deduction in Nonclassical Logics: Efficient Matrix Proof

Methods for Modal and Intuitionistic Logics, MIT Press, 1989.

Bernhard Beckert

Inst. for Logic, Complexity and Deduction SystemsUniversity of KarlsruheD-76128 Karlsruhe, [email protected]/˜beckert

Rajeev Gore

Automated Reasoning ProjectAustralian National UniversityCanberra, ACT, 0200, [email protected]/˜rpg

free-variable tableaux for propositional modal logics

Documents