CC BY
20First-order logics of branching time: on expressive power of temporal operators1
Ekaterina Kqtikqva, Mikhail Rybakqy
abstract. We consider the logic QCTL, a first-order extension of CTL defined as a logic of Kripke frames for CTL. We study the question about recursive enumerability of its fragments specified by a set of temporal modalities we use. Then we discuss some questions concerned axiomatizability and Kripke completeness.
Keywords: non-classical logic, temporal logic, branching time logic, first-order logic, recursive enumerability, Kripke completeness
1 Introduction
There are at least two reasons to study branching time logics: philosophical and originating in computer science. Such logics provides us with formalisms allowing to construct and verify sentences about indeterminate future (philosophical aspect) or about some state transition systems (in computer science).
There are a lot of propositional temporal logics, and they found their applications both in philosophy, and computer science, see [4]. Here we deal with first-order logics of branching time, more exactly, first-order extensions of the logic CTL introduced by A. Prior, see [10].2 It is known that such logics are undecidable and even not
xThe work was supported by Russian Foundation for Basic Research, Projects № 11-06-00456 and № 13-06-00861.
2The abbreviation 'CTL' means 'computational tree logic'. In [10] A. Prior does not introduce this abbreviation but he discuss logics of branching time, in particular, Cocchiarella's tense-logic (which may have the same abbreviation).
recursively enumerable; moreover for correspondent proofs it is sufficient to use only unary predicate letters, see [5, 6, 12].
The main aim of the paper is to show how one may prove that a logic (a fragment of a logic) is not recursively enumerable.
To do this we simulate positive integers with the relation 'less than'; this is the key part of the paper. Then, we use positive integers to embed the finite model theory (which is not recursively enumerable) into first-order branching time logic.
On the one hand, as a result we obtain that many fragments of logics we consider are not finitely (and even recursively) axiomati-zable. Note that we define these logics semantically by means of Kripke frames; therefore, on the other hand, it follows that many calculi are not Kripke complete.
Note that the results (as theorems) presented in this paper are quite expected; moreover, most of them are known or follow from other known facts. The feature of our proofs is that, in fact, we use only embeddings of logics and nothing more. Therefore, to understand our proofs it is sufficient to be familiar with the classical first-order logic (theory) of finite domains.
2 Definitions
To define the logic we deal with, first of all we need a language. Consider the language containing
• individual variables x0, x\, x2,...;
• predicate letters Pm, for every m,i € N;
• logical constant ±;
• logical connectives A, V,
• quantifier symbols V, 3;
• modality symbols A, E, X, G, F, U;
• symbols (, ), and comma.
Now define formulas we consider here. Atomic formulas are _L
and Pin(xk1,..., xkm) where m,i,k\,... ,km are positive integers.
If p and 0 are formulas then (p A 0), (p V 0), (p ^ 0), Vxp 3xip, AXp, EXp, AFp, EFp, AGp, EGp, (pAU0), and (pEU0) are formulas, too. We call such formulas temporal.
Also we use , , and as usual abbreviations:
-p = (p
T =
(p ° 0) = ((p ^ 0) A (0 ^ p)).
We omit parenthesis that can be recovered according to the following priority of the connectives: unary modalities, quantifiers, binary modalities, A, V, o,
We make a remark about modalities used in formulas. Any 'atomic' modality consists of two symbols: the first symbol is E or A and the second one is X, G, F, or U. Every of these symbols corresponds to some modality in more general language, see [2]. The intending meaning of the modalities E, A, X, G, F, U is as follows: let us imagine that we are in some situation (current state) and it is possible to define consequences of future states; then
E A
Xp Gp
Fp
pU 0
means
means
means
means
means means
'there is a consequence of future states (starting in the current one) such that...'; 'for every consequence of future states (starting in the current one) it is true that...';
'p is true in the next state of the consequence';
p is true in every state of the consequence';
' p is true in some state of the consequence'; ' 0 is true in at least one state of the consequence and p is true until 0 is true'.
Of course, since we use modalities only in pairs we have no formulas like Xp or pU0; but now we have some informal definition for our modalities. For example AFp means that for every consequence of future states (starting in the current one), p is true in some state of the consequence.
To make the meaning of the modalities more clear we need semantics. As semantics for this language we use Kripke frames and models.
A pair F = (W, R) is called Kripke frame if W is non-empty set and R is a binary relation on W. We call elements of W worlds or states; we call R accessibility relation on W. We write wRw' instead of (w,w') € R; if wRw' we say that w' is accessible from w.
We may understand a Kripke frame as a structure of (branching) time where wRw' means that w' is a possible next future state relative to w.
Here we consider mainly serial Kripke frames; recall that a frame F = (W, R) is said to be serial if, for any w € W, there is w' € W such that wRw'.
An infinite consequence n = w0,w1,w2,... is called a path in a frame F = (W,R) if, for any k € N, we have wk € W and wkRwk+i. We assume that denotes the k-th element of the path n. We say that a path n starts in a world w if no = w.
Note that if w is a world of a serial Kripke frame F then there is at least one path in F starting in w.
A triple F(D) = (W, R, D) is called predicate Kripke frame if (W,, R) is a Kripke frame and D is a map associating with every w € W some non-empty set Dw (i.e., D(w) = Dw) such that
wRw' D(w) C D(w'),
for any w, w' € W. Elements in Dw are called individuals of the world w, the set D(w) is called domain of w.
Now we need a tool connecting predicate frames with our language. As such tool we use two notions: interpretation of predicate letters and interpretation of individual variables.
Let F(D) = (W, R, D) be a predicate Kripke frame. A function I is called interpretation of predicate letters in F(D) if I(w,Pjn) is an m-ary relation on D(w), for every w € W and every predicate letter Pm.
A tuple M = (W, R, D, I) is called Kripke model if (W, R, D) is a predicate Kripke frame and I is an interpretation of predicate letters in (W, R,D).
Let F(D) = {W, R, D) be a predicate Kripke frame and let w be a world in it. A function a is called interpretation of individual variables in a world w € W if a(xi) € D(w), for every individual variable xi.
Note that if w' is accessible from w and a is an interpretation of individual variables in w then a is an interpretation of individual variables in w', too, because in this case we have D(w) C D(w').
For any individual variable xi, we define the binary relation = between interpretations. For interpretations a and / we put
a = / ^ a(xk) = 3(xk), for any k € N such that k = i.
Let F = {W, R) be a serial Kripke frame, M = {W, R, D, I) be a Kripke model on F. We define the truth relation ' a formula p is true at a world w € W in a model M under an interpretation a of individual variables in w' inductively (by constructing of p):
(M,w) =a ±;
(M, w) \=a Pm(x) a(x) G I(w, Pim) where x \ (xkl , ■ ■ ■ , xkm ), a(x) \ (a(xk!),■■■, a(xkm));
(M, w) \a <pi A <2 (M,w) \a pi and (M,w) \a <2;
(M, w) \a <1 V <2 (M,w) \a <i or (M,w) \a <2;
(M, w) \a <1 ^ <2 (M,w) \a <i or (M,w) \a <2;
(M, w) \a AX<i for any path n starting in w the relation (M, ni) !" <i is true;
(M, w) \a EX<1 there is a path n starting in w such that (M,ni) \a <i;
(M, w) \a AF<pi for any path n starting in w
there is some k G N such that (M,nk) \=a <i;
(M, w) |=a EFpi (M, w) |=a AGpi
(M, w) |=a EGpi
(M,w) |=a pi AU
(M,w) |=a piEUp2
(M, w) |=a Vxipi
(M, w) |=a 3xipi
The relations 'p is true F(D)', and ' p is true in
(M, w) \= p
^ there are a path n starting in w and k € N such that (M,nk) \=a p1;
^ for any path n starting in w and for any k € N the relation (M, nk) \=a p1 is true;
^ there is a path n starting in w such that for any k € N the relation (M, nk) \=a p1 is true;
^ for any path n starting in w there is some k € N such that (M,nk) \=a p2 and, for any j € N, such that j < k the relation (M, nj) \=a p1 is true;
^ for some path n starting in w and some k € N such that (M,nk) \=a p2 and, for any j € N, such that j < k the relation (M, nj) \=a p1 is true;
^ for any interpretation /3 such that (3 = a and /(xi) € D(w) the relation (M, w) \=@ p1 is true;
^ there is an interpretation /3 such that (3 = a, (3(xi) € D(w), and (M,w) = p1.
at w in M', ' p is true in M', ' p is true in
F' are defined as follows:
^ (M, w) \=a p, for any interpretation a of individual variables in w;
M | p
(M, w) | p, for any w € W;
F(D) \= p ^ M \= p, for any model M based on F(D);
F \= p ^ M \= p, for any model M based on F.
Note that any world w in a model M = (W, R, D, I) may be understood as a usual model for the classical first-order language. Indeed, as such model one may take the model Mw = (Dw ,Iw) where Dw = D(w) and Iw(P™) = I(w,P-n), for every predicate letter Pm.
We define the logic QCTL as the set of all temporal formulas that are true in any serial Kripke frame.
The logic CTL is a propositional fragment of QCTL. Let also QCL denote the classical first-order logic in the modalfree fragment of the language for QCTL and let QCLjira denote the logic of all finite models, i. e., the set of classical first-order formulas that are true in any model with finite domain.
3 Some facts
In this section we just recall some ' algorithmic' definitions and facts; so, the reader may omit this section.
Let U be some universal set (for example, a set of all formulas in some language). A set X is called decidable if there is an effective procedure (algorithm) A such that, for any x € U,
otherwise X is called undecidable.
A set X is called recursively enumerable if X = 0 or there is an effective procedure (algorithm) A such that A(n) is defined for every n € N and X = {A(n) : n € N}, in other words, if there is an effective enumeration for elements of X.
Note that if a logic is recursively (in particular, finitely) axiom-atizable then it is recursively enumerable because in this case it is possible to enumerate effectively all derivations, and hence, all derivable formulas.
For a logic L, let L denote the complement of L in the set of all formulas in the language of L.
Below we will use the following facts, see [1, 11]:
• the logic QCL is undecidable; QCL is recursively enumerable and QCL is not;
• the logic QCLfin is undecidable; QCLfin is recursively enumerable and QCLfin is not.
A set X is called recursively reducible to a set Y if there is an effective procedure (algorithm) A such that
x € X ^^ A(x) € Y,
for any x (in the appropriate universal set U).
Let X be recursively reducible to Y. It is not hard to see that
• if Y is decidable then X is decidable;
• if Y is recursively enumerable then X is recursively enumerable.
4 Main aim
Let M C {AX, EX, AG, EG, AF, EF, AU, EU} and let X be a set of formulas (in some language). We use the denotation X \ M for the set of formulas in X those modalities belong to the set M* (i.e., constructed only from modalities of M).
Our main aim is to describe some (algorithmic, semantical, deductive) properties of the logic QCTL \ M.
Of course, it is expected that properties of QCTL \ M depend on M. Indeed, it is not hard to see that QCTL \ 0 = QCL and hence QCTL \ 0 is finitely axiomatizable. But it follows from [12] that QCTL i {AX, AG} is not recursively enumerable, wherefore it is not finitely (and even recursively) axiomatizable. Below we prove the following statement.
Theorem 1. Let M be a set of modalities including only some of AX, EX, AG, EG, AF, EF, AU, EU. Then the following equivalence holds:
Then, using Theorem 1 (and its proof) we will be able to prove some statements about algorithmic, semantical, and deductive properties of some first-order extensions of CTL.
5 Recursively enumerable fragments of QCTL
In this section we prove the following part of Theorem 1: if M C {AX, EX} or M C {AG, EF} then QCTL \ M is recursively enumerable.
To do this let us observe that
Because of (a), the logic QCTL \ 0 is recursively enumerable and even finitely axiomatizable. Then, because of (b), it is sufficient to prove that QCTL \ {AX} and QCTL \ {AG} are recursively enumerable.
To prove the last statement we use the first-order modal logics QD and QS4.
The language of QD and QS4 contains the same symbols as the language of QCL and the modality symbol □. Also we have the following extra rule for formula constructing: if p is a formula then □p is a formula. We call formulas in this language modal formulas. The notions of Kripke frame and Kripke model are the same as they are defined in Section 2.
QCTL \ M is recursively enumerable
M C {AX, EX} or M C {AG, EF}.
(a) QCTL \ 0 = QCL;
(b) for any formula p,
AXp o -EX-p € QCTL,
EXp o -AX-p € QCTL,
AGp o -EF-p € QCTL,
EFp o -AG-p € QCTL.
Let F = {W, R) be a Kripke frame, M = {W, R, D, I) be a Kripke model on F. Now we define the relation 'a modal formula p is true at a world w € W in a model M under an interpretation a of individual variables in w'. To differ the truth relation for modal formulas and the truth relation for temporal formulas we use the sign ' | \=' for the first of them. This relation is defined inductively (by constructing of p) in the same way as for temporal formulas, see page 72. The cases for the atomic formulas, for the connectives A, V, and for the quantifiers Vxi and 3xi are the same (the reader just must replace ' \=' with ' | \='). As for □, the definition looks as follows:
(M,w) I l=a □p1 ^ for any w' € W such that wRw' the relation (M,w') | I=a p1 is true.
The relations (M, w) = p, M = p, F(D) = p, and F = p are defined as on page 73.
Now we define the logic QD as the set of all modal formulas that are true in any serial frame and the logic QS4 as the set of all modal formulas that are true in any reflexive and transitive frame.
It is known that QD and QS4 are finitely axiomatizable and, in particular, recursively enumerable, see [3]. We are going to show that QCTL \ {AX} is recursively reducible to QD and QCTL \ {AG} is recursively reducible to QS4.
Let us define translations T1 and T2. Suppose a temporal formula p does not contain modalities different from AX and its iterations; then define T1(p) to be a modal formula obtained from p by replacing every occurrence of AX with □. Let p does not contain modalities different from AG and its iterations; then define T2(p) to be a modal formula obtained from p by replacing every occurrence of AG with □.
Observation 1. For any temporal formula p without modalities different from AX and its iterations, the following equivalence holds:
p € QCTL ^ T1 (p) € QD, i. e, T1 recursively reduces QCTL \ {AX} to QD.
Proof. Let p be a formula without modalities different from AX and its iterations.
Let p € QCTL. Then there is a serial model M = {W, R, D, I), a world w0 € W, and an interpretation a0 of individual variables in wo such that (M, w0) =a° p.
In this case, for any formula 0, any w € W, and any interpretation a of individual variables in w, the following equivalence holds:
(M, w) = 0 ^ (M, w) | =a Ti (0).
The proof proceeds by induction on constructing of 0 and we left the details to the reader.
As a result we obtain that (M,w0) | \=a° T1(p) and hence, Ti(p) € QD.
Let Ti(p) € QD. Then there is a serial model M = {W, R, D, I), a world w0 € W, and an interpretation a0 of individual variables in w0 such that (M,w0) | \=a° T1(p). With the same argumentation we obtain that (M, w0) =ao p, therefore, p € QCTL. □
Observation 2. For any temporal formula p without modalities different from AG and its iterations, the following equivalence holds:
p € QCTL ^ T2(p) € QS4,
i. e., T2 recursively reduces QCTL \ {AG} to QS4.
Proof. Let p be a formula without modalities different from AG and its iterations.
Let p € QCTL. Then there is a serial model M = {W, R, D, I), a world w0 € W, and an interpretation a0 of individual variables in w0 such that (M, w0) \=a° p.
Let R* be reflexive and transitive closure of R and let M* = {W, R*,D, I). Then, for any formula 0, any w € W, and any interpretation a of individual variables in w, the following equivalence holds:
(M,w)l=a 0 ^ (M*,w) |==a T2(0).
The proof proceeds by induction on constructing of 0 and we again left the details to the reader.
In particular, we have (M*,w0) | =a° T2(p). Because M* is a model for QS4, we obtain T2(p) € QS4.
Let T2(p) € QS4. Then there is a reflexive and transitive model M = (W,R,D,I), a world w0 € W, and an interpretation a0 of individual variables in w0 such that (M,w0) | =a° T1(p). Because M is reflexive, it is serial. Then, for any formula any w € W, and any interpretation a of individual variables in w,
(M,w) \=a ^ ^ (M,w) | \=a T2 (■$),
and hence, (M, wo) =a° p. Thus, p € QCTL. □
Because the logics QD and QS4 are recursively enumerable, from Observations 1 and 2 it follows that QCTL \ {AX} and QCTL \ {AG} are recursively enumerable. In fact, even more strong result holds.
Proposition 1. The temporal logics QCTL \ {AX} and QCTL \ {AG} are finitely axiomatizable.
Proof. It is sufficient to observe that the translation T1 is an isomorphism between QCTL \ {AX} and QD, the translation T2 is an isomorphism between QCTL \ {AG} and QS4. □
6 Main technical construction
Now we start to prove that if M £ {AX, EX} and M £ {AG, EF} then QCTL \ M is not recursively enumerable.
Here we present some technical constructions and statements; then we apply them to achieve the main aim.
Let us fix three binary letters and one unary letter; to make it easier to understand (and with according of their intending meaning) we denote them -<, and L. To explain the intending meaning of these predicate letters, let us imagine that we try to order equivalence classes of some set; then
x y means 'x and y are equivalent';
x — y means 'x is less than y';
x — 1 y means 'y is the next element after x';
L(x) means 'x is a label (for a current state)'.
With help of 'labels' and modalities we show how to describe the condition that equivalence classes are ordered as positive integers by the relation 'less than'.
Let us define some formulas. The formula A1 claims & to be an equivalence relation:
A1 = Vx(x & x) A VxVy(x & y — y & x) A
VxVyVz(x & y A y & z — x & z).
The formula A2 claims & to be a congruence relative to — :
A2 = sixsiysiusiv(x & u A y & v — (x — y — u — v)).
The formula A3 claims — to be a strict linear order (on equivalence classes):
A3 = yx-(x — x) A
VxVyVz(x — y A y — z — x — z) A
yx"iy(x — y V x & y V y — x).
The formula A4 defines — 1 as a successor relation with respect to —:
A4 = VxVy((x —1 y) o (x — y A —3z(x — z A z — y))).
The formula A5 means that any element has a successor:
A5 = Vx3y(x —1 y).
Let x & y be the abbreviation for —(x & y). The formulas Ae and A7 claim heredity for — 1 and &, correspondingly:
Ae = yxiy(x —1 y — AG(x —1 y)); A7 = yxyy(x & y — AG(x & y)).
The formula Ag means for a world that it has a unique label (if it has a label at all):
Ag = VxVy(L(x) A L(y) — x & y).
The formula Ag means that any next world has the next label:
A9 = VxVy(L(x) A x —1 y — AXL(y)).
Let
A = AG(Ai A ... A Ag). Let also
B = 3x(L(x) A-3y(y — x)).
The formula B means that there is a least element ('zero') and it is a label (in a world where B is true). Finally, let
C = VxEF L(x).
The formula C means that any element (of some current world) labels some future world.
As we will see below, the formula A A B A C provides us with a condition that is sufficient to prove that equivalence classes are ordered with — as positive integers with the relation 'less than'. But before this we show that the formula A A B A C is QCTL-satisfiable, i.e., -(A A B A C)£ QCTL. Let M0 = (Wo, R0, D0,I0} where
Wo = {Wi : i e N};
WiR0Wj ^ j = i + 1;
Do(wi) = N;
Io ( Wi, k) = {(m, m) : m e N};
Io(Wi, = {(m, k) : m,k e N and m < k};
Io (Wi, ^1) = {(m, m + 1) : m e N};
Io (Wi,L) = {(i))}-
1. It is true that (Mo, Wo) = A A B A C.
Proof is straightforward and left to the reader. Proposition 2. The formula A A B A C is QCTL-satisfiable.
□
Proof. It is sufficient to observe that the accessibility relation in the model M0 is serial and then use Lemma 1. □
Now let us turn to the key technical lemmas of the article. Let M = (W, R, D, I) be a serial model and w* be a world in W such that (M, w*) \= A A B A C.
For simplicity let us use the following abbreviations, for any w £ W:
&w = I(w, &), —w = I(w, —), —w= I(w, —1), Lw = I(w, L). Let also, for any w,w' £ W and any k £ N, wR°w' ^ w = w';
wRk+1 w' ^ wRku and uRw', for some u £ W; wR*w' ^ wRmw', for some m £ N.
Observe that (M, w) == A1 A ... A Ag, for any w £ W such that w*R*w; this is so because (M,w *) = AG(A1 A ... A Ag).
Lemma 2. Let w £ W and w*R*w. Then the relation ^ is a congruence with respect to the relation —w.
Proof immediately follows from (M,w) \= A1 A A2. □
Because of Lemma 2 we may define congruence classes: for any w £ W such that w*R*w and any a £ D(w) we put
[a]w = {b £ D(w) : b &w a}.
Note that the relations —w and —w on D(w) generate the relations —w and —w on equivalence classes defined in the following way:
[a]w —w [b]w ^ a —w b; [a]w —w [b]w ^ a —w b,
for any w £ W such that w*R*w and for any a,b £ D(w). Let also
[a]w [b]w ^ [a]w —w [b]w or [a]w = [b]w.
Let, for any w £ W such that w*R*w,
Dw = {[a]w : a £ D(w)}.
For the rest of this section our aim is to prove that (Dw*, —w*} is isomorphic to (N, <}.
Lemma 3. Let w e W and w*R*w. Then the relation —w is a strict linear order on Dw and —W is the successor relation on Dw with respect to —w.
Proof immediately follows from (M,w) = A3 A A4. □
Since (M,w*) = B, there is a0 e D(w*) such that Lw (a0) and [ao]W 4w* [a]w*, for any a e D(w*). Then, due to (M,w*) = A5, there are a1,a2,a3,... e D(w*) such that
w* w* w* w*
a0 —1 ai —1 a2 —1 a3 — 1 ...;
note by the way that equivalence classes generated by elements a0, a1,a2, a3,... in D(w*) are pairwise different.
Lemma 4. Let w e W and w*R*w. Then
a —w* b a —w b;
a^w* b a^w b,
for any a,b e D(w*).
Proof immediately follows from (M,w*) = A6 A A7. □
Lemma 5. Let w e W, k e N, and w*Rkw. Then Lw(ak) is true.
Proof proceeds by induction on k.
Let k = 0. Then we must prove that Lw* (a0) is true; but we have Lw a) to be true because of choosing of a0.
Let the statement be true for k; we prove it for k + 1. Let w*Rk+1w. Then there is u e W such that w*Rku and uRw. By induction hypothesis, Lu(ak) holds. By Lemma 4, we have
ak —U ak+1. Then, from (M, u) = Ag and uRw we obtain Lw(ak+1).
□
Lemma 6. Let b e D(w*). Then b &w* ak, for some k e N.
Proof. Because of (M, w*) == C, there is w £ W such that w*Rkw, for some k £ N, and Lw(b) is true. By Lemma 5, Lw(ak) is true. Then, from (M, w) \= Ag we obtain b &w ak and, by Lemma 4, we obtain b &w ak. □
As a corollary we obtain the next statement.
Proposition 3. The structures (Dw*, —w*) and (N, <) are isomorphic.
Proof. For any k £ N, let f (k) = [ak]w*. We show that f is the required isomorphism. Clearly, k < m implies [ak]w* —w* [am]w*. So, we must prove that f is injective and surjective.
Injectivity of f. Let k = m; without a loss of generality we may assume that k < m. But then [ak]w* —w* [am]w* and hence f (k) = f (m).
Surjectivity of f. Let b £ D(w*). Then, by Lemma 6, we have b &w* ak, for some k £ N; this means that [b]w* = [ak]w* = f (k). □
7 Embedding of QCLfin into QCTL
Let p be some closed classical first-order formula and let y be some individual variable not occurring in p. Let also x 4 y be an abbreviation for the formula (x — y V x & y). We define the translation Ty:
Ty (r) = ±
Ty (pm(xk1 ,...,Xkm)) = Pr(xk1 ,...,Xkm);
Ty(f A 0'') = Ty(f) A Ty(0'');
Ty(f V f') = Ty(f) V Ty(f'');
Ty(f ^ f') = Ty(f) ^ Ty(f');
Ty(Vxf) = Vx(x 4 y ^ Ty(f));
Ty(3xf) = 3x(x 4 y A Ty(f))
where f and f ' are subformulas of the formula p. Then we put T (p)= VyTy (p).
To explain the intending meaning of Ty(p) and T(p) let us imagine that we interpret individual variables as positive integers and 4 as the relation ^ on N. Then Ty(p) means 'p is true in any
model with elements 0,...,y' and T(<) means < is true in any finite model'.
Let Pmi,..., Pmk be the list of all predicate letters occurring
¿1 *k
in <. We define the formula Congr(<) as a conjunction of formulas in the following form:
. j
Vx1... Vxmj Vy1... Vymj( /\(xi tt yi) ^
^ (Pm (X1, ^xmj) ^ pm (y1,.. .,ym))) where j e {1,..., k}. Let
Emb(v) = A A B A C A Congr(<) ^ T(<). Lemma 7. < e QCL/in ^^ Emb(<) e QCTL.
Proof. Suppose < £ QCL/in. Then there is a classical model S = (S, J} where S is a finite set, J is an interpretation of predicate letters in S, such that S = <. Without a loss of generality we may assume that S = {0,..., n}, for some n e N.
Let M0 be Kripke model defined on page 81. We extend I0 on predicate letters occurring in < ; let
I0(w0,pmj) = {(k1,...,km} : (k1,...,km} e J(Pm)},
for any j e {1,...,k}, i.e., I0(w0,Pi-nj) = J(P). Let also I0(wi, Pmj) = 0, for any i e N+.
Then we claim (M0,w0) == Emb(<). Since the letter tt is interpreted with the identity relation on D(w0), it is clear that (M0,w0) \= Congr(v). By Lemma 1, we have (M0,w0) \= AaBAC. Hence we just must prove that (M0,w0) == VyTy(<). It is sufficient to interpret y as n. More exactly, the following condition holds: for any subformula 0 of the formula <, for any interpretation a such that a(x) e {0,..., n}, for any individual variable x, and a(y) = n,
S=a 0 ^ (M0,w0) \=a Ty(0).
We left the proof of the condition to the reader; it proceeds by induction on constructing of 0. Thus, (M0,w0) \=a Ty(<), for any
such interpretation a. Therefore (Mo, wo) = VyTy(p) and hence (Mo,wo) = Emb(p).
Since the model M0 is serial, we have Emb(p) £ QCTL. Now suppose Emb(p) £ QCTL. Then there is a serial model M = (W, R, D, I) such that (M, w*) = Emb(p), for some w* £ W. From (M,w*) = Emb(p) we obtain (M,w*) \= A A B A C and hence we may use results of Section 6. Let
Let also
= I(w*, -w = I(w*, -).
[a] = {b G D(w*) : b &w* a};
Dw* = {[a] : a G D(w*)};
[a] -w* [b] ^ a -w* b.
Then, by Proposition 3, the structures {Dw , -<w ) and (N, <) are isomorphic. Let g : Dw N be an isomorphism between the structures. Let us define an interpretation J for predicate letters occurring in T(p). Let P be a predicate letter occurring in T(<p), i.e., P is one of the letters Pmi,..., Pmk, œ, and —, and let m be the arity of P. We put
J(p) = {(g([bi]),...,g([bm])) : (bi,...,bm)e i(w*,p)}.
From (M, w*) = Emb(p) it follows that (M, w*) \= Congr(p) and hence the relation œw* is a congruence relative to I(w*,pimj), for any j g {1,..., k}. This means that J is well defined. Note that, in particular, J(œ) is the identity relation on N and J(—) is the relation < on N.
Let S = (N, J).
We claim S = T(p). Let a be an interpretation of individual variables in D(w*) and /3 be an interpretation of individual variables in N; we call a and / agreed interpretations if /(x) = g([a(x)}), for any variable x. Then
(Mo, wo) =a x ^ S\ x,
for any agreed interpretations a and /3 and for any classical formula
Dmi p mi
ii , ' ' ' , ik
X containing no predicate letters different from Pm1,..., pm
and —; the details are left to the reader. Since (M,w*) = Emb(p), we have (M,w*) = T(p), and hence, S = T(p).
It follows from S = T(p) that S =a Ty(p), for some interpretation a. Let n = a(y) and S' = ({0,... ,n}, J') where J' is a restriction of J on {0,... ,n}. Then, for any subformula 0 of the formula p, for any interpretation / such that /(x) £ {0,..., n}, for any variable x, and / (y) = n,
S'= 0 ^^ S = Ty (0).
The details of the proof are left to the reader.
Since S ==a Ty(p) we obtain S' = p. The model S' is finite, therefore p £ QCLfin. □
Corollary 1. The logic QCTL is not recursively enumerable.
Corollary 2. The logic QCTL \ {AX, AG} is not recursively enumerable.
8 Modifications for other fragments
Now we have got a 'weak Theorem 1': just for the case M C {AX, EX, AG, EF}. What about other modalities? In this section we show that the fragment of QCTL with any of the modalities AF, EG, AU, and EU is not recursively enumerable. Since, for any formula p,
EGp o -AF-p £ QCTL; AFp o -EG-p £ QCTL; AFp o TAUp £ QCTL,
it is sufficient to prove that QCTL \ {EU} is not recursively enumerable and that at least one of QCTL \ {AF} and QCTL \ {EG} is not recursively enumerable. We consider the first and the second fragments.
To prove that these fragments are not recursively enumerable, it is sufficient to construct some embeddings of QCLfin into the fragments. To construct such embeddings we modify the embedding Emb defined on page 85. Our modifications do not concern 'classical' part of Emb(p), i.e., we modify only the formulas A, B,
and C defined in Section 6. The aim is to prove a statement like Lemma 7. Observe that the formulas A, B, and C are used in the proof of Lemma 7 only once: we need just Proposition 3 to be true. Therefore for our purposes it is sufficient to modify A, B, and C so that Proposition 3 remains to be true for resulting formulas. Finally, observe that the key condition in the proof of Proposition 3 is Lemma 6.
8.1 Fragments with EU
Let AR be the dual modality for EU; we define it as the following abbreviation:
(<AR0) = -(-<EU-0), for any formulas < and 0. Observe that, for any <,
AG< o ±AR< e QCTL; EF< o TEU< e QCTL,
and therefore we may use AG and EF as corresponding abbreviations. Then, we may define all formulas A1,..., Ag, B, and C but not A9 because A9 contains the modality AX. Instead of A9 we take the formula A'9:
A*9 = VxVy(L(x) A x -<1 y ^ L(y)AR(L(x) V L(y))).
Let A = AG(A1 A ... A Ag A A!g).
Proposition 4. The formula A' A B A C is QCTL-satisfiable.
Proof. It is sufficient to check that (M0,w0) \= AGA'9 and use Lemma 1. □
Let us use the notations introduced in Section 6 where M is a model and w* is a world in it such that (M, w*) \= A A B A C. It is clear that Lemmas 2, 3, and 4 are true. Lemma 5 is not true but we will prove a similar statement.
Lemma 8. Let w e W, k e N, and w*Rkw. Then Lw(am) is true, for some m e {0,... ,k}.
Proof proceeds by induction on k. If k = 0 then with the same argumentation as in Lemma 5 we obtain Lw (a0).
Let the statement is true for k; we prove it for k+1. Let w*Rk+1 w. Then there is u € W such that w*Rku and uRw. By induction hypothesis, there is m € {0,..., k} such that Lu(am) holds. By Lemma 4, we have am -<U am+1. Then, from (M, u) = and uRw we obtain Lw (am) or Lw (am+1). □
The next lemma is like Lemma 6. Lemma 9. Let b € D(w*). Then b am, for some m € N.
Proof. Because of (M, w*) = C, there is w € W such that w*Rkw, for some k € N, and Lw(b) is true. By Lemma 8, Lw (am) is true, for some m € {0,... ,k}. Then, from (M, w) = we obtain b
^^ am
and, by Lemma 4, we obtain b ak. □
From Lemma 9 we obtain a statement like Proposition 3.
Proposition 5. The structures {Dw*, <w*) and (N, <} are isomorphic.
Proof. Follow to the proof of Proposition 3. □
Let p be some closed classical first-order formula. We define Emb' (p):
Emb'(p) = A' A B A C A Congr(p) ^ T(p). Lemma 10. p e QCLfin ^^ Emb'(p) e QCTL.
Proof proceeds with the same argumentation as the proof for Lemma 7; the difference is in use Proposition 5 instead of Proposition 3. □
Corollary 3. The logic QCTL \ {EU} is not recursively enumerable.
8.2 Fragments with AF
Observe that we may use the modality EG as an abbreviation because EG< o —AF—< e QCTL, for any formula <.
Let p be a propositional variable (i.e., some 0-ary predicate letter). We need it to define ' heredity' formulas:
A'6 = VxVy((x -1 y o AF(x -1 y A p)) A (x -1 y o AF(x -1 y A —p)));
A'7 = VxVy((x tt y o AF(x tt y A p)) A (x tt y o AF (x tt y A—p))).
Let us also define A'9':
A9 = VxVy(L(x) A x -1 y — AFL(y)) A
Vy (AFL(y) — 3x(x 4 y A L(x)))
where x 4 y is an abbreviation for (x - y V x tt y). Finally, let
A'' = A1A ... A A5 A A6a A^A Ag A A); B'' = 3x(L(x) A EG(A'' A—3y(y - x))); C = VxAFL(x).
Proposition 6. The formula B'' A C" is QCTL-satisfiable.
Proof. Let M0 be the model defined on page 6. We extend I0 on p so that
(M0,wi) \= p ^^ i = 2k, for some k e N,
i.e., we put p to be true exactly in 'even' worlds.
Then (M0, w0) \= B A C ; corresponding check is left to the reader. □
Let us use again the notations introduced in Section 6. Let M = (W, R, D, I} be a model and w* be a world in it such that (M, w*) \= B A C .
Since (M,w*) \= B'', there are a0 e D(w*) and a path n starting in w* such that
• Lno (a0) is true;
• b —nk a0 does not true, for any k € N and for any b € D(nk);
• (M,nk) = A'', for any k € N.
Lemma 11. The relation K,nk is a congruence with respect to the relation —nk, for any k € N.
Proof immediately follows from (M,nk) = Ai A A2. □
Because of Lemma 11, we again may define congruence classes but just for worlds in the path n.
Lemma 12. The relation —nk is a strict linear order on Dnk and is the successor relation on Dnk with respect to —nk, for any k € N.
Proof immediately follows from (M,nk) = A3 A A4. □
From the condition (M, no) = A5 it follows that there are a1,a2,a3,... € D(n0) such that
and equivalence classes generated by a0,a1,a2,a3,... are pairwise different.
Lemma 13. For any k € N and for any a,b € D(n0),
Proof. Let a b, for some a,b € D(n0). We prove that a —Jk b by induction on k. If k = 0 then the statement is trivial.
Let a —Jk b and let a be an interpretation of variables in D(nk) such that a(x) = a, a(y) = b. There are two possible cases:
(M,nk) =a p and (M,nk) =a p.
Case (M,nk) =a p. Suppose a —\k+1 b. Since (M,nk+1) = A6, we have (M,nk+1) =a AF(x — y A —p). This means that there
ao X"0 ai X"0 a2 Xl>0 a3 X
no
no
a X?0 b a Xlk b;
a^no b a b.
is a path a starting in nk+1 such that (M,am) =a (x - y A —p), for any m e N. We define the path t: t0 = nk and Tn+1 = an, for any n e N; i.e., t starts in nk and then goes along a. Since (M, t0) \=a p, we have (M, t0) \=a (x - y A —p) and from the same condition for all states in a we obtain (M,Tn) \=a (x - y A —p), for any n e N. But then (M,t0) =a AF(x - y A —p), i.e., (M,nk) =a AF(x - y A —p). Then, since (M,nk) \= A6, we have (M,nk) \=a x - y, i.e., a b. But, by induction hypothesis, it is not the case, hence the assumption a -{k+1 b is not true, and we have a <\k+1 b.
Case (M, nk) \=a p. We have (M, nk) \=a —p and with the same argumentation (using p instead of —p and vice versa) we again obtain a -1k+1 b.
Let a ttb, for some a,b e D(n0). The proof that a <1[k b proceeds by induction on k in the same way (with use of A7 instead of A6); we left the details to the reader. □
Lemma 14. Let k e N. Then there is m e {0,...,k} such that Lnk (am) is true.
Proof proceeds by induction on k.
Let k = 0. Then we must prove that Ln° (a0) is true; but we have Ln° (a0) to be true by choosing of a0.
Let the statement be true for k; we prove it for k + 1. By induction hypothesis, we have Lnk(am), for some m e {0,... ,k}. Let a be an interpretation of variables in nk such that a(x) = am, a(y) = am+1. By Lemma 13, we have am <\k am+1 and hence (M,nk) \=a AFL(y) because (M,nk) \= A''.
Suppose Lnk+1 (a0),..., Lnk+1 (ak+1) are not true. Then, in particular, Lnk+1 (a0),..., Lnk+1 (am+1) are not true and hence (M,nk+1) \=a 3x(x 4 y A L(x)). Since (M,nk+1) = A', we obtain (M,nk+1) \=a AFL(y). This means that there is a path a starting in nk+1 such that (M, ai) \=a L(y), for any l e N.
We define the path t: t0 = nk and Tn+1 = an, for any n e N.
We claim (M,Tn) \=a L(y), for any n e N. Indeed, it is the case for any n e N+ by the choice of a. As for n = 0, we have t0 = nk and hence (M,t0) \=a L(x). Supposing (M,t0) \=a L(y), we obtain (M,Tn) \=a x tt y because (M, t0) \= Ag. But then
am am+1. From Lemmas 11 and 12 we obtain am Xnk am+1, in particular, am am+1, but this is impossible by Lemma 13. Thus (M,To) =a L(y).
Since (M,Tn) =a L(y) holds for any n € N, we obtain (M,To) =a AFL(y), i.e., {M,nk) =a AFL(y), but this is not so. Hence our assumption is not true, therefore at least one of LKk+1 (a0),.. .,Lnk+1 (ak+1) is true. □
Now we are ready to prove a lemma that is similar to Lemmas 6 and 9. Recall that n0 = w*.
Lemma 15. Let b € D(w*). Then b am, for some m € N.
Proof. Since (M,w*) = C, in any path starting in w* there is a world w such that Lw (b) is true. In particular, this is true for the path n. Hence Lnk (b) is true, for some k € N. Then, by Lemma 15, there is m € {0,... ,k} such that Lnk(am) is true. Since (M,nk) = As, we have b ^ am,.
By Lemma 13, we obtain b am, i.e., b am. □
Proposition 7. The structures (Dw*, Xw*} and (N, <} are isomorphic.
Proof. Follow to the proof of Proposition 3. □
Let p be some closed classical first-order formula. We define Emb' '(p):
Emb'(p) = B'' A C'' A Congr(p) — T(p). Lemma 16. p € QCLfin ^^ Emb''(p) € QCTL.
Proof proceeds with the same argumentation as the proof of Lemma 7; the difference is in use Proposition 7 instead of Proposition 3. □
Corollary 4. The logic QCTL \ {AF} is not recursively enumerable.
9 Corollaries
First of all, now we are able to give a proof for Theorem 1. Indeed, let M be a set of modalities as in Theorem 1. If M C {AX, EX} or M C {AG, EF} then the logic QCTL \ M is recursively enumerable and even finitely axiomatizable by Proposition 1. Suppose M C {AX, EX} and M C {AG, EF}. Then at least one of the following conditions holds:
• M contains AX or EX and M contains AG or EF;
• M contains EU;
• M contains AU, or AF, or EG.
In every of these cases the logic QCTL \ M is not recursively enumerable by Corollaries 2, 3, and 4.
Now we give some other corollaries of Theorem 1 and its proof. Below let M C {AX, EX, AG, EG, AF, EF, AU, EU}.
9.1 Finite axiomatizability
Note that any recursively enumerable fragment we consider here is also finitely axiomatizable; thus we have the following statement.
Corollary 5. The logic QCTL \ M is finitely axiomatizable if and only if M C {AX, EX} or M C {AG, EF}.
We make a remark. From Theorem 1 and Corollary 5 it follows that a fragment QCTL \ M is recursively enumerable if and only if it is finitely axiomatizable. In general, recursive enumerability of a logic is not equivalent to its finite axiomatizability; it is equivalent just to its recursive axiomatizability. In our case such criterion is possible maybe because of finite number of fragments we consider.
Now let us turn to the other side of axiomatizability. We mean completeness.
9.2 Kripke completeness
Recall that a logic L is called Kripke complete if there is a class C of (predicate) Kripke frames such that L = {^ : C \= where C \= <p means p is true in any frame in C.
Any fragment QCTL \ M is Kripke complete by its definition; so, the question about Kripke completeness makes sense just for logics defined in other ways. Here we concern calculi.
We specify what we understand under a calculus. We assume a calculus to be defined by means of two sets: a set A of axioms and a set R of inference rules. These sets assumed to be recursively enumerable, moreover any inference rule assumed to be effective, i.e., as an algorithm computing the resulting formula. Of course, finite axiomatizations provides us with calculi.
Note that the set of all derivable formulas in a calculus (in our understanding) is recursively enumerable: to get an algorithm enumerating derivable formulas we may use an algorithm constructing a consequence of all derivations. The last algorithm exists because of algorithmic conditions we claim for the sets of axioms and inference rules.
Let R be a set of inference rules, X be a set of formulas. We denote by Cr(X) the least set of formulas containing X and closed under inference rules in R, generalization, modus ponens, and substitution (in an appropriate language). Let also XY = CR(XUY).
Let L be a logic (a set of formulas). Let us call a set R of inference rules L-admissible if Cr(L) C L.
Let us call a set M of modalities quite expressive if the modalities in at least one of the sets {AX, AG}, {EU}, {AF} can be expressed via the ones in M (maybe with use of the connectives).
Corollary 6. Let M be a quite expressive set of modalities, S be a recursively enumerable set of propositional formulas in the language of CTL \ M such that S C CTL \ M, and R be a QCTL-admissible set of inference rules. Then the logic QCL S is not Kripke complete.
Proof. We give just a sketch of a proof. Let us use the denotation QS = QCL S. The logic QS may be viewed as a calculus with the axiom set QCL U S, therefore it is recursively enumerable. Suppose it is Kripke complete. Then there is a class C of Kripke frames such that QS = {p : C \= p}.
First of all observe that (modulo modality equivalence) at least one of the formulas A A B A C, A' A B A C, B" A C" is a formula in
the language of QS; this is so because M is quite expressive. Let us denote it by $. We claim
p € QCLfin ^^ $ A Congr(p) — T(p) € QS,
for any closed classical first-order formula p.
Suppose p € QCLfin. Then there is a classical model S = (S, J} such that S is finite and S = p; we may assume S = {0,..., n}, for some n € N.
Observe that -$ € QS. Indeed, it follows from Propositions 2, 4, and 6 that -$ € QCTL. But QCL c QCTL and S C CTL \ M c QCTL, therefore QS C QCTL because R is QCTL-admissible.
Since -$ € QS, there is a frame F(D) = (W, R, D} such that F(D) € C (or F € C where F = (W, R}) and F(D) = -$. Then there is a model M = (W, R, D, I} and a world w* € W such that (M, w*) = -$, i. e., (M, w*) = $.
It follows from Propositions 6, 5, and 7 that the structures (Dw , Xw } and (N, <} are isomorphic, i.e., there is an isomorphism f : N — Dw* for the structures. Let us consider the model M' = (W, R, D, I'} where I' is defined as I with the only difference for predicate letters occurring in p: if P is m-ary letter occurring in p and b1,... ,bm € D(w*) then we put
(b1,..., bm} € I'(w*,P) ^ there are k1,... ,km € S such
that (k1,...,km} € J (P ) and bi € f (ki), for any i € {1,..., m}.
Then we obtain (M',w*) = $ A Congr(p) — T(p), and hence $ A Congr(p) — T(p) € QS; the details are left to the reader.
Now suppose $ A Congr(p) — T(p) € QS. Since QS C QCTL, we have $ A Congr(p) — T(p) € QCTL, and hence p € QCLfin by Lemmas 6, 9, and 15.
But then QS is not recursively enumerable, and we have a contradiction. Hence QS is not Kripke complete. □
9.3 The case of constant domains
Kripke frame F(D) = (W,, R, D) is said to be a frame with constant domains if
wRw' D(w) = D(w' ),
for any w,w' € W. The constant domain condition means that new elements do not appear when we go from one state to another, i. e., any element we may deal with in some future state is available in the current state, too.
Let QCTLcd be a logic of serial Kripke frames with constant domains. Note that the propositional fragment of QCTLcd is the logic CTL, i.e., QCTLcd as well as QCTL is a conservative firstorder extension of CTL. Here we put and answer the following question: do the presented results remain to be true if we replace QCTL with QCTLcd? And the answer is 'yes, of course'.
Indeed, it is sufficient to observe that the formulas A A B A C, A A B A C, and B" A C'' are satisfiable in some models based on a serial frame with constant domains; see the proofs of Propositions 2, 4, and 6.
9.4 More simple fragments
We make remarks about fragments with restrictions on predicate letters. First of all, observe that it is possible to define œ and — via L. So, for example in w* (see Section 6)
X tt y means AG(L(x) o L(y)); x — y means AF(L(x) A —L(y) A AFL(y)).
As for the QCLfin, its fragment with a binary predicate letter P is not recursively enumerable. It is known, see [8], that a binary predicate letter may be simulated with two unary letters: for example P(x,y) may be simulated with EX(P'(x) A P''(y)). This means that three unary letters are sufficient to prove that the correspondent fragment of QCTL is not recursively enumerable.
Moreover even two unary letters are enough. It is known that the theory of finite models with symmetric irreflexive binary relation is not recursively enumerable; see [9]. But if a letter P corresponds to such relation then P(x, y) may be simulated with EX ((P' (x) A -P' (y)) V (-P' (x) A P' (y))).
As for number of individual variables, it seems to be truthful that three ones are enough. But in view of [7], we think that even two variables are enough.
10 Conclusion remarks
Let M be some quite expressive set of modalities. Suppose we are asked: why the fragment QCTL \ M is not recursively enumerable? As a possible answer we may say that this is because one may simulate positive integers using the language of the fragment. But why one may do this?
To answer the question let us turn to the notion of path. A path n in a frame F = (W,R) is an infinite consequence of worlds n0,n1,n2,... with the condition wkRwk+1, for any k € N. This means that any path is a map from N into W. Thus, we have positive integers as paths. Some modalities allow us to 'catch' them because of their definition in Kripke models.
But it is not the case for the pairs AX, EX and AG, EF. This is so because these modalities are quite 'simple': accessibility relations for them are first-order definable. For example, for AX we need just seriality of R. The modality AG seems to be more complicated. It corresponds to the reflexive and transitive closure of R which is not first-order definable via R. And indeed, if we use AX and AG simultaneously then we are able to 'catch' positive integers. But if we use AG only then we 'lose' R and, in fact, we have just some reflexive and transitive accessibility relation.
11 Acknowledgements
We are thankful to all participant of the seminar on mathematical logic at Tver State University (Russia, Tver), especially to Alexander Chagrov and Lilia Chagrova, for their attention to details, interesting discussions and questions. We are also thankful to the researchers working at IRIT (Institut de Recherche en Informatique de Toulouse, Universite Paul Sabatier, Toulouse, France) who participated in our seminar (in spite of holidays) for their interest to the subject; our special thanks to Philippe Balbiani and Sergei Soloviev for discussions at the seminar (and out of it), for good questions, and for a warm welcome.
References
[1] Boolos, G. S., Burgess, J. P., and R. C. Jeffrey, Computability and Logic, Cambridge University Press, 2007.
[2] Clarke, E. M., Grumberg, O., and D. A. Peled, Model Cheking, The MIT Press, 1999.
[3] Gabbay, D., Shehtman, V., and D. Skvortsov, Quantification in Nonclassical Logic. Preliminary draft.
[4] Hodkinson, I., and M. Reynolds, Temporal Logic, in P. Blackburn, J. Van Benthem and F. Wolter (eds.), Handbook of Modal Logic, Elsevier, 2007, pp. 655-720.
[5] Hodkinson, I., Wolter, F., and M. Zakharyaschev, Decidable fragments of first-order temporal logics, Annals of Pure and Apllied Logic 106:85-134, 2000.
[6] Hodkinson, I., Wolter, F., and M. Zakharyaschev, Decidable and undecidable fragments of first-order branching temporal logics, Proceedings of the 17th Annual IEEE Symposium on Logic in Computer Science, LICS, 2002, pp. 393-402.
[7] Kontchakov, R., Kurucz, A., and M. Zakharyaschev, Undecida-bility of First-Order Intuitionistic and Modal Logics with Two Variables, Bulletin of Symbolic Logic 11(3):428-438, 2005.
[8] Kripke, S. A., The Undecidability of Monadic Modal Quantification Theory, Zeitschrift für mathematische Logik und Grundlagen der Mathematik 8:113-116, 1962.
[9] Nerode, A., and R. Shore, Second Order Logic and First Order Theories of Reducibility Orderings, in J.Barwise, H. J.Keisler, K.Kuner (eds.), The Kleene Symposium, North-Holland, Amsterdam, 1980, pp. 181-200.
[10] Prior, A. N., Past, present and future, Oxford University press, 1967.
[11] Trakhtenbrot, B. A., The Impossibility of an Algorithm for the Decidability Problem on Finite Classes, Proceedings of the USSR Academy of Sciences 70(4):569-572, 1950. (in Russian)
[12] Wolter, F., and M. Zakharyaschev, Decidable fragments of firstorder modal logics, Journal of Symbolic Logic 66:1415-1438, 2001.
