- •Contents
- •Foreword to the first edition
- •Preface to the second edition
- •Our motivation for (re)writing this book
- •What’s new and what’s gone
- •The interdependence of chapters and prerequisites
- •Acknowledgements
- •Added for second edition
- •1 Propositional logic
- •1.1 Declarative sentences
- •1.2 Natural deduction
- •1.2.1 Rules for natural deduction
- •1.2.2 Derived rules
- •1.2.3 Natural deduction in summary
- •1.2.4 Provable equivalence
- •1.2.5 An aside: proof by contradiction
- •1.3 Propositional logic as a formal language
- •1.4 Semantics of propositional logic
- •1.4.1 The meaning of logical connectives
- •1.4.2 Mathematical induction
- •1.4.3 Soundness of propositional logic
- •1.4.4 Completeness of propositional logic
- •1.5 Normal forms
- •1.5.1 Semantic equivalence, satisfiability and validity
- •1.5.2 Conjunctive normal forms and validity
- •1.5.3 Horn clauses and satisfiability
- •1.6 SAT solvers
- •1.6.1 A linear solver
- •1.6.2 A cubic solver
- •1.7 Exercises
- •1.8 Bibliographic notes
- •2 Predicate logic
- •2.1 The need for a richer language
- •2.2 Predicate logic as a formal language
- •2.2.1 Terms
- •2.2.2 Formulas
- •2.2.3 Free and bound variables
- •2.2.4 Substitution
- •2.3 Proof theory of predicate logic
- •2.3.1 Natural deduction rules
- •2.3.2 Quantifier equivalences
- •2.4 Semantics of predicate logic
- •2.4.1 Models
- •2.4.2 Semantic entailment
- •2.4.3 The semantics of equality
- •2.5 Undecidability of predicate logic
- •2.6 Expressiveness of predicate logic
- •2.6.1 Existential second-order logic
- •2.6.2 Universal second-order logic
- •2.7 Micromodels of software
- •2.7.1 State machines
- •2.7.2 Alma – re-visited
- •2.7.3 A software micromodel
- •2.8 Exercises
- •2.9 Bibliographic notes
- •3 Verification by model checking
- •3.1 Motivation for verification
- •3.2 Linear-time temporal logic
- •3.2.1 Syntax of LTL
- •3.2.2 Semantics of LTL
- •3.2.3 Practical patterns of specifications
- •3.2.4 Important equivalences between LTL formulas
- •3.2.5 Adequate sets of connectives for LTL
- •3.3 Model checking: systems, tools, properties
- •3.3.1 Example: mutual exclusion
- •3.3.2 The NuSMV model checker
- •3.3.3 Running NuSMV
- •3.3.4 Mutual exclusion revisited
- •3.3.5 The ferryman
- •3.3.6 The alternating bit protocol
- •3.4 Branching-time logic
- •3.4.1 Syntax of CTL
- •3.4.2 Semantics of computation tree logic
- •3.4.3 Practical patterns of specifications
- •3.4.4 Important equivalences between CTL formulas
- •3.4.5 Adequate sets of CTL connectives
- •3.5.1 Boolean combinations of temporal formulas in CTL
- •3.5.2 Past operators in LTL
- •3.6 Model-checking algorithms
- •3.6.1 The CTL model-checking algorithm
- •3.6.2 CTL model checking with fairness
- •3.6.3 The LTL model-checking algorithm
- •3.7 The fixed-point characterisation of CTL
- •3.7.1 Monotone functions
- •3.7.2 The correctness of SATEG
- •3.7.3 The correctness of SATEU
- •3.8 Exercises
- •3.9 Bibliographic notes
- •4 Program verification
- •4.1 Why should we specify and verify code?
- •4.2 A framework for software verification
- •4.2.1 A core programming language
- •4.2.2 Hoare triples
- •4.2.3 Partial and total correctness
- •4.2.4 Program variables and logical variables
- •4.3 Proof calculus for partial correctness
- •4.3.1 Proof rules
- •4.3.2 Proof tableaux
- •4.3.3 A case study: minimal-sum section
- •4.4 Proof calculus for total correctness
- •4.5 Programming by contract
- •4.6 Exercises
- •4.7 Bibliographic notes
- •5 Modal logics and agents
- •5.1 Modes of truth
- •5.2 Basic modal logic
- •5.2.1 Syntax
- •5.2.2 Semantics
- •Equivalences between modal formulas
- •Valid formulas
- •5.3 Logic engineering
- •5.3.1 The stock of valid formulas
- •5.3.2 Important properties of the accessibility relation
- •5.3.3 Correspondence theory
- •5.3.4 Some modal logics
- •5.4 Natural deduction
- •5.5 Reasoning about knowledge in a multi-agent system
- •5.5.1 Some examples
- •5.5.2 The modal logic KT45n
- •5.5.3 Natural deduction for KT45n
- •5.5.4 Formalising the examples
- •5.6 Exercises
- •5.7 Bibliographic notes
- •6 Binary decision diagrams
- •6.1 Representing boolean functions
- •6.1.1 Propositional formulas and truth tables
- •6.1.2 Binary decision diagrams
- •6.1.3 Ordered BDDs
- •6.2 Algorithms for reduced OBDDs
- •6.2.1 The algorithm reduce
- •6.2.2 The algorithm apply
- •6.2.3 The algorithm restrict
- •6.2.4 The algorithm exists
- •6.2.5 Assessment of OBDDs
- •6.3 Symbolic model checking
- •6.3.1 Representing subsets of the set of states
- •6.3.2 Representing the transition relation
- •6.3.4 Synthesising OBDDs
- •6.4 A relational mu-calculus
- •6.4.1 Syntax and semantics
- •6.5 Exercises
- •6.6 Bibliographic notes
- •Bibliography
- •Index
328 |
5 Modal logics and agents |
respect to semantic entailment based on truth tables. We also pointed out that the proof rules PBC, LEM and ¬¬e are questionable in certain computational situations. If we disallow their usage in natural deduction proofs, we obtain a logic, called intuitionistic propositional logic, together with its own proof theory. So far so good; but it is less clear what sort of semantics one could have for such a logic – again with soundness and completeness in mind. This is where certain models of KT4 will do the job quite nicely. Recall that correspondence theory implies that a model M = (W, R, L) of KT4 is such that R is reflexive and transitive. The only additional requirement we impose on a model for intuitionistic propositional logic is that its labelling function L be monotone in R: R(x, y) implies that L(x) is a subset of L(y). This models that the truth of atomic positive formulas persist throughout the worlds that are reachable from a given world.
Definition 5.19 A model of intuitionistic propositional logic is a model M = (W, R, L) of KT4 such that R(x, y) always implies L(x) L(y). Given a propositional logic formula as in (1.3), we define x φ as in Definition 5.4 exception for the clauses → and ¬. For φ1 → φ2 we define x φ1 → φ2 i for all y with R(x, y) we have y φ2 whenever we have y φ1. For ¬φ we define x ¬φ i for all y with R(x, y) we have y φ.
As an example, consider the model W = {x, y} with accessibility relation R = {(x, x), (x, y), (y, y)}, which is indeed reflexive and transitive. For a labelling function L with L(x) = and L(y) = {p}, we claim that x p ¬p. (Recall that p ¬p is an instance of LEM which we proved in Chapter 1 with the full natural deduction calculus.) We do not have x p, for p is not in the set L(x) which is empty. Thus, Definition 5.4 for the case implies that x p ¬p can hold only if x ¬p holds. But x ¬p simply does not hold, since there is a world y with R(x, y) such that y p holds, for p L(y). The availability of possible worlds in the models of KT4 together with a ‘modal interpretation’ of → and ¬ breaks down the validity of the theorem LEM in classical logic.
One can now define semantic entailment in the same manner as for modal logics. Then, one can prove soundness and completeness of the reduced natural deduction system with respect to this semantic entailment, but those proofs are beyond the scope of this book.
5.4 Natural deduction
Verifying semantic entailment Γ L ψ by appealing to its definition directly would be rather di cult. We would have to consider every Kripke model
5.4 Natural deduction |
329 |
that satisfies all formulas of Γ and every world in it. Fortunately, we have a much more usable approach, which is an extension, respectively adaptation, of the systems of natural deduction met in Chapters 1 and 2. Recall that we presented natural deduction proofs as linear representations of proof trees which may involve proof boxes which control the scope of assumptions, or quantifiers. The proof boxes have formulas and/or other boxes inside them. There are rules which dictate how to construct proofs. Boxes open with an assumption; when a box is closed – in accordance with a rule – we say that its assumption is discharged. Formulas may be repeated and brought into boxes, but may not be brought out of boxes. Every formula must have some justification to its right: a justification can be the name of a rule, or the word ‘assumption,’ or an instance of the proof rule copy; see e.g. page 13.
Natural deduction works in a very similar way for modal logic. The main di erence is that we introduce a new kind of proof box, to be drawn with dashed lines. This is required for the rules for the connective . The dashed proof box has a completely di erent role from the solid one. As we saw in Chapter 1, going into a solid proof box means making an assumption. Going into a dashed box means reasoning in an arbitrary accessible world. If at any point in a proof we have φ, we could open a dashed box and put φ in it. Then, we could work on this φ, to obtain, for example, ψ. Now we could come out of the dashed box and, since we have shown ψ in an arbitrary accessible world, we may deduce ψ in the world outside the dashed box.
Thus, the rules for bringing formulas into dashed boxes and taking formulas out of them are the following:
Wherever φ occurs in a proof, φ may be put into a subsequent dashed box.
Wherever ψ occurs at the end of a dashed box, ψ may be put after that dashed box.
We have thus added two rules, introduction and elimination:





. 



.
.
φ |
|
φ |
||
|
|
|||
|
i |
|
e |
|
φ |
. |
|||
|
|
|||
|
|
|
||
|
|
. |
|
|
|
|
. |
|
|
|
|
φ |
||
|
|
. |
|
|
|
|
. |
|
|
|
|
. |
|
|
330 |
5 Modal logics and agents |
In modal logic, natural deduction proofs contain both solid and dashed boxes, nested in any way. Note that there are no explicit rules for , which must be written ¬ ¬ in proofs.
The extra rules for KT45 The rules i and e are su cient for capturing semantic entailment of the modal logic K. Stronger modal logics, e.g. KT45, require extra rules if one wants to capture their semantic entailment via proofs. In the case of KT45, this extra strength is expressed by rule schemes for the axioms T, 4 and 5:
φ |
T |
φ |
4 |
¬ φ |
5 |
|
φ |
φ |
¬ φ |
||||
|
|
|
An equivalent alternative to the rules 4 and 5 would be to stipulate relaxations of the rules about moving formulas in and out of dashed boxes. Since rule 4 allows us to double-up boxes, we could instead think of it as allowing us to move formulas beginning with into dashed boxes. Similarly, axiom 5 has the e ect of allowing us to move formulas beginning with ¬ into dashed boxes. Since 5 is a scheme and since φ and ¬¬φ are equivalent in basic modal logic, we could write ¬φ instead of φ throughout without changing the expressive power and meaning of that axiom.
Definition 5.20 Let L be a set of formula schemes. We say that Γ L ψ is valid if ψ has a proof in the natural deduction system for basic modal logic extended with the axioms from L and premises from Γ.
Examples 5.21 We show that the following sequents are valid:
1. |−K p q → (p q).
1 |
p q |
assumption |
2 |
p |
e1 1 |
3 |
q |
e2 1 |
4 |
p |
e 2 |
5 |
q |
e 3 |
6 |
p q |
i 4, 5 |
7 |
(p q) |
i 4−6 |
8 |
p q → (p q) →i 1−7 |
|
