Master’s thesis at the institute of mathematics at Freie Universität Berlin

Representation and Partial Automation of the Principia
Logico-Metaphysica in Isabelle/HOL

Daniel Kirchner
Matrikelnummer: 4387161

Supervisors:
Priv.-Doz. Dr.-Ing. Christoph Benzmüller
Dr. Edward N. Zalta

Berlin, May 26, 2024

Abstract
We present an embedding of the second-order fragment of the Theory of Abstract Objects
as described in Edward Zalta’s upcoming work Principia Logico-Metaphysica (PLM[12])in the automated reasoning framework Isabelle/HOL. The Theory of Abstract Objects
is a metaphysical theory that reifies property patterns, as they for example occur inthe abstract reasoning of mathematics, as abstract objects and provides an axiomatic
framework that allows to reason about these objects. It thereby serves as a fundamental metaphysical theory that can be used to axiomatize and describe a wide range ofphilosophical objects, such as Platonic forms or Leibniz’ concepts, and has the ambition
to function as a foundational theory of mathematics. The target theory of our embedding as described in chapters 7-9 of PLM[12] employs a modal relational type theory as
logical foundation for which a representation in functional type theory is known to bechallenging[8].
Nevertheless we arrive at a functioning representation of the theory in the functional
logic of Isabelle/HOL based on a semantical representation of an Aczel-model of thetheory. Based on this representation we construct an implementation of the deductive
system of PLM ([12, Chap. 9]) which allows to automatically and interactively find andverify theorems of PLM.
Our work thereby supports the concept of shallow semantical embeddings of logicalsystems in HOL as a universal tool for logical reasoning as promoted by Christoph
Benzmüller[1].
The most notable result of the presented work is the discovery of a previously unknown
paradox in the formulation of the Theory of Abstract Objects. The embedding of thetheory in Isabelle/HOL played a vital part in this discovery. Furthermore it was possible
to immediately offer several options to modify the theory to guarantee its consistency.
Thereby our work could provide a significant contribution to the development of a proper
grounding for object theory.

Contents
1. Introduction
7
1.1. Universal Logical Reasoning . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.2. Shallow Semantical Embeddings in HOL . . . . . . . . . . . . . . . . . . . 8
1.3. Relational Type Theory vs. Functional Type Theory . . . . . . . . . . . . 9
1.4. Overview of the following Chapters . . . . . . . . . . . . . . . . . . . . . . 10
2. The Theory of Abstract Objects
2.1. Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2. Basic Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3. The Language of PLM . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4. The Axioms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.5. Hyperintensionality of Relations . . . . . . . . . . . . . . . . . . . . . . .
2.6. The Aczel-Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11
11
13
14
16
16
17

3. The Embedding
3.1. The Framework Isabelle/HOL . . . . . . . . . . . . . . . . . . . . . . . . .
3.2. A Russell-style Paradox . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.3. Basic Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.4. The Representation Layer . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.5. Semantic Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.6. General All-Quantifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.7. Derived Language Elements . . . . . . . . . . . . . . . . . . . . . . . . . .
3.8. The Proving Method meta_solver . . . . . . . . . . . . . . . . . . . . . .
3.9. General Identity Relation . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.10. The Axiom System of PLM . . . . . . . . . . . . . . . . . . . . . . . . . .
3.11. The Deductive System PLM . . . . . . . . . . . . . . . . . . . . . . . . . .
3.12. Artificial Theorems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.13. Sanity Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

20
20
20
21
24
33
37
38
39
41
43
49
54
56

4. Technical Limitations of Isabelle/HOL
4.1. Limitations of Type Classes and Locales . . . . . . . . . . . . . . . . . . .
4.2. Case Distinctions by Type . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3. Structural Induction and Proof-Theoretic Reasoning . . . . . . . . . . . .

57
57
59
59

5. Discussion and Results
60
5.1. Differences between the Embedding and PLM . . . . . . . . . . . . . . . . 60
5.2. A Paradox in PLM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5

5.3.
5.4.
5.5.
5.6.

A Meta-Conjecture about Possible Worlds . . . . . . . . . . . . . . . . . .
Functional Object Theory . . . . . . . . . . . . . . . . . . . . . . . . . . .
Relations vs. Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

65
66
67
69

A. Isabelle Theory
70
A.1. Representation Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
A.2. Semantic Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
A.3. General Quantification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
A.4. Basic Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
A.5. MetaSolver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
A.6. General Identity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
A.7. The Axioms of PLM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
A.8. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
A.9. The Deductive System PLM . . . . . . . . . . . . . . . . . . . . . . . . . . 103
A.10.Possible Worlds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
A.11.Artificial Theorems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
A.12.Sanity Tests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
A.13.Paradox . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
Bibliography

6214

1. Introduction
Calculemus!
Leibniz1.1. Universal Logical Reasoning1
The concept of understanding rational argumentation and reasoning using formal logical systems has a long tradition and can already be found in the study of syllogistic
arguments by Aristotle. Since then a large variety of formal systems has evolved, eachusing different syntactical and semantical structures to capture specific aspects of logical reasoning (e.g. propositional logic, first-order/higher-order logic, modal logic, freelogic, etc.). This diversity of formal systems gives rise to the question, whether a universal logic can be devised, that would be capable of expressing statements of all existing
specialized logical systems and provide a basis for meta-logical considerations like theequivalence of or relations between those systems.
The idea of a universal logical framework is very prominent in the works of Gottfried Wilhelm Leibniz (1646-1716) with his concept of a characteristica universalis, i.e. a universal formal language able to express metaphysical, scientific and mathematical concepts.
Based thereupon he envisioned the calculus ratiocinator, a universal logical calculus withwhich the truth of statements formulated in the characteristica universalis could be decided purely by formal calculation and thereby in an automated fashion, an idea that
became famous under the slogan: Calculemus!
Nowadays with the rise of powerful computer systems such a universal logical framework
could have repercussions throughout the sciences and may be a vital part of humanmachine interaction in the future. Leibniz’ ideas have inspired recent efforts to use
functional higher-order logic (HOL) as such a universal logical language and to represent
various logical systems by the use of shallow semantical embeddings[1].
Notably this approach received attention due to the formalization, validation and analysis of Gödel’s ontological proof of the existence of God by Christoph Benzmüller[5],for which higher-order modal logic was embedded in the computerized logic framework
Isabelle/HOL.

1

This introductory section is based on the description of the topic in [1].

7

1.2. Shallow Semantical Embeddings in HOL

A semantic embedding of a target logical system defines the syntactic elements of thetarget language in a background logic (e.g. in a framework like Isabelle/HOL) basedon their semantics. This way the background logic can be used as meta-logic to argue
about the semantic truth of syntactic statements in the embedded logic.
A deep embedding represents the complete syntactic structure of the target language
separately from the background logic, i.e. every term, variable symbol, connective, etc.
of the target language is represented as a syntactic object and then the background logic
is used to evaluate a syntactic expression by quantifying over all models that can beassociated with the syntax. Variable symbols of the target logic for instance would be
represented as constants in the background logic and a proposition would be consideredsemantically valid if it holds for all possible denotations an interpretation function can
assign to them.
While this approach will work for most target logics, it has several drawbacks. It is
likely that there are principles that are shared between the target logic and the background logic, such as α-conversion for λ-expressions or the equivalence of terms withrenamed variables in general. In a deep embedding these principles usually have to be
explicitly shown to hold for the syntactic representation of the target logic, which isusually connected with significant complexity. Furthermore if the framework used forthe background logic allows automated reasoning, the degree of automation that canbe achieved in the embedded logic is limited, as any reasoning in the target logic will
have to consider the meta-logical evaluation process in the background logic which willusually be complex.
A shallow embedding uses a different approach based on the idea that most contemporary
logical systems are semantically characterized by the means of set theory. A shallow
embedding defines primitive syntactic objects of the target language such as variables or
propositions using a set theoretic representation. For example propositions in a modal
logic can be represented as functions from possible worlds to truth values in a non-modal
logic.
The shallow embedding aims to equationally define only the syntactic elements of thetarget logic that are not already present in the background logic or whose semantics
behaves differently than in the background logic, while preserving as much of the logicalstructure of the background logic as possible. The modal box operator for example can be
represented as a quantification over all possible worlds, satisfying an accessibility relation,
while negation and quantification can be directly represented using the negation andquantification of the background logic (preserving the dependency on possible worlds).
This way basic principles of the background logic (such as alpha conversion) can often
be directly applied to the embedded logic and the equational, definitional nature of
the representation preserves a larger degree of automation. Furthermore, axioms in theembedded logic can often be equivalently stated in the background logic, which makes the8construction of models for the system easier and again increases the degree of automationthat can be retained.
The shallow semantical embedding of modal logic was the basis for the analysis of Gödel’s
ontological argument[5] and the general concept has shown great potential as a universal
tool for logical embeddings while retaining the existing infrastructure for automation as
for example present in a framework like Isabelle/HOL2 .

1.3. Relational Type Theory vs. Functional Type Theory
The universality of this approach has since been challenged by Paul Oppenheimer and
Edward Zalta who argue in the paper Relations Versus Functions at the Foundations of
Logic: Type-Theoretic Considerations[8] that relational type theory is more general thanfunctional type theory. In particular they argue that the Theory of Abstract Objects,
which is founded in relational type theory, cannot be properly characterized in functional
type theory.
This has led to the question whether a shallow semantical embedding of the Theory of
Abstract Objects in a functional logic framework like Isabelle/HOL is at all possible,
which is the core question the work presented here attempts to examine and partiallyanswer.
One of their main arguments is that unrestricted λ-expressions as present in functional
type theory lead to an inconsistency when combined with one of the axioms of the theory
and indeed it has been shown for early attempts on embedding the theory that despite
significant efforts to avoid the aforementioned inconsistency by excluding problematic
λ-expressions in the embedded logic, it could still be reproduced using an appropriate
construction in the background logic3 .
The solution presented here circumvents this problem by identifying λ-expressions as
one element of the target language that behaves differently than their counterparts inthe background logic and consequently by representing λ-expressions of the target logic
using a new defined kind of λ-expressions. This forces λ-expressions in the embedded
logic to have a particular semantics that is inspired by the Aczel-model of the target
theory (see 2.6) and avoids prior inconsistencies. The mentioned issue and the employedsolution is discussed in more detail in sections 3.2 and 3.4.7.

2

See [1] for an overview and an description of the ambitions of the approach.
Early attempts of an embedding by Christoph Benzmüller (see https://github.com/cbenzmueller/
PrincipiaMetaphysica) were discussed in his university lecture Computational Metaphysics (FU Berlin,
SS2016) and the proof of their inconsistency in the author’s final project for the course inspired thecontinued research in this master’s thesis.
391.4. Overview of the following Chapters
The following chapters are structured as follows:• The second chapter gives an overview of the motivation and structure of the target
theory of the embedding, the Theory of Abstract Objects. It also introduces theAczel-model of the theory, that was adapted as the basis for the embedding.
• The third chapter is a detailed documentation of the concepts and technical structure of the embedding. This chapter references the Isabelle theory that can befound in the appendix.
• The fourth chapter consists of a technical discussion about some of the issues
encountered during the construction of the embedding due to limitations of thelogic framework Isabelle/HOL and the solutions that were employed.
• The last chapter discusses the relation between the embedding and the target
theory of PLM and describes some of the results achieved using the embedding.
Furthermore it states some open questions for future research.
This entire document is generated from an Isabelle theory file and thereby in particular
all formal statements in the third chapter are well-formed terms, resp. verified valid
theorems in the constructed embedding unless the contrary is stated explicitly.

102. The Theory of Abstract Objects
It is widely supposed that every
entity falls into one of two categories:
Some are concrete; the rest abstract.
The distinction is supposed to be offundamental significance formetaphysics and epistemology.
Stanford Encyclopedia of
Philosophy[9]2.1. Motivation
As the name suggests the Theory of Abstract Objects revolves around abstract objects
and is thereby a metaphysical theory. As Zalta puts it: “Whereas physics attempts asystematic description of fundamental and complex concrete objects, metaphysics attempts a systematic description of fundamental and complex abstract objects. [. . .] The
theory of abstract objects attempts to organize these objects within a systematic andaxiomatic framework. [. . .][We can] think of abstract objects as possible and actual
property-patterns. [. . .] Our theory of abstract objects will objectify or reify the groupof properties satisfying [such a] pattern.”[13]1
So what is the fundamental distinction between abstract and concrete objects? The analysis in the Theory of Abstract Objects is based on a distinction between two fundamental
modes of predication that is based on the ideas of Ernst Mally. Whereas objects that areconcrete (the Theory of Abstract Objects calls them ordinary objects) are characterized
by the classical mode of predication, i.e. exemplification, a second mode of predication is
introduced that is reserved for abstract objects. This new mode of predication is called
encoding and formally written as xF (x encodes F ) in contrast to Fx (x exemplifies F ).
Mally informally introduces this second mode of predication in order to represent sentences about fictional objects. In his thinking, concrete objects, that for example havea fixed spatiotemporal location, a body and shape, etc., only exemplify their properties
and are characterized by the properties they exemplify. Sentences about fictional objects
such as “Sherlock Holmes is a detective” have a different meaning. Stating that “Sherlock Holmes is a detective” does not imply that there is some concrete object that is
1
The introduction to the theory in this and the next section is based on the documentation of thetheory in [13] and [14], which is paraphrased and summarized throughout the sections. Further references
about the topic include [12], [11], [10].

11Sherlock Holmes and this object exemplifies the property of being a detective - it rather
states that the concept we have of the fictional character Sherlock Holmes includes theproperty of being a detective. Sherlock Holmes is not concrete, but an abstract object
that is determined by the properties Sherlock Holmes is given by the fictional works
involving him as character. This is expressed using the second mode of predication
Sherlock Holmes encodes the property of being a detective.
To clarify the difference between the two concepts note that any object either exemplifies
a property or its negation. The same is not true for encoding. For example it is notdeterminate whether Sherlock Holmes has a mole on his left foot. Therefore the abstract
object Sherlock Holmes neither encodes the property of having a mole on his left foot,nor the property of not having a mole on his left foot2 .
The theory even allows for an abstract object to encode properties that no object could
possibly exemplify and reason about them, for example the quadratic circle. In classicallogic meaningful reasoning about a quadratic circle is impossible - as soon as I supposethat an object exemplifies the properties of being a circle and of being quadratic, thiswill lead to a contradiction and every statement becomes derivable.
In the Theory of Abstract Objects on the other hand there is an abstract object that
encodes exactly these two properties and it is possible to reason about it. For example
we can state that this object exemplifies the property of being thought about by the readerof this paragraph. This shows that the Theory of Abstract Objects provides the means
to reason about processes of human thought in a much broader sense than classical logic
would allow.
It turns out that by the means of abstract objects and encoding the Theory of Abstract
Objects can be used to represent and reason about a large variety of concepts that
regularly occur in philosophy, mathematics or linguistics.
In [13] the principal objectives of the theory are summarized as follows:• To describe the logic underlying (scientific) thought and reasoning by extendingclassical propositional, predicate, and modal logic.
• To describe the laws governing universal entities such as properties, relations, andpropositions (i.e., states of affairs).
• To identify theoretical mathematical objects and relations as well as the natural
mathematical objects such as natural numbers and natural sets.
• To analyze the distinction between fact and fiction and systematize the various
relationships between stories, characters, and other fictional objects.
• To systematize our modal thoughts about possible (actual, necessary) objects,
states of affairs, situations and worlds.
• To account for the deviant logic of propositional attitude reports, explain theinformativeness of identity statements, and give a general account of the objective
and cognitive content of natural language.
2

12

see [14]

• To axiomatize philosophical objects postulated by other philosophers, such as
Forms (Plato), concepts (Leibniz), monads (Leibniz), possible worlds (Leibniz),nonexistent objects (Meinong), senses (Frege), extensions of concepts (Frege), noematic senses (Husserl), the world as a state of affairs (early Wittgenstein), momentsof time, etc.
The Theory of Abstract Objects has therefore the ambition and the potential to serve asa foundational theory of metaphysics as well as mathematics and can provide a simple
unified axiomatic framework that allows reasoning about a huge variety of concepts
throughout the sciences. This makes the attempt to represent the theory using theuniversal reasoning approach of shallow semantical embeddings outlined in the previous
chapter particularly challenging and at the same time rewarding, if successful.
A successful implementation of the theory which allows to utilize the existing sophisticated infrastructure for automated reasoning present in a framework like Isabelle/HOL
would not only strongly support the applicability of shallow semantical embeddings as auniversal reasoning tool, but could also aid in spreading the utilization of the theory itself
as a foundational theory for various scientific fields by enabling convenient interactive
and automated reasoning in a verified framework.

2.2. Basic Principles
Although the formal language of the theory is introduced in the next section, some of
the basic concepts of the theory are presented in advance to provide further motivation
for the formalism.
The following are the two most important principles of the theory (see [13]):• ∃ x(A!x & ∀ F (xF ≡ ϕ))• x = y ≡ ∀ F (xF ≡ yF )The first statement asserts that for every condition on properties ϕ there exists an
abstract object that encodes exactly those properties satisfying ϕ, whereas the second
statement holds for two abstract objects x and y and states that they are equal, if andonly if they necessarily encode the same properties.
Together these two principles clarify the notion of abstract objects as the reification ofproperty patterns: Any set of properties is objectified as a distinct abstract object.
Using these principles it is already possible to postulate interesting abstract objects.
For example the Leibnizian concept of an (ordinary) individual u can be defined as
the (unique) abstract object that encodes all properties that u exemplifies, formally:ιx A!x & ∀ F (xF ≡ Fu)

Other interesting examples include possible worlds, Platonic Forms or even basic logicalobjects like truth values. The theory allows to formulate purely syntactic definitions ofobjects like possible worlds and truth values and from these definitions it can be derived
that there are two truth values or that the application of the modal box operator to a13

proposition is equivalent to the proposition being true in all possible worlds (where beingtrue in a possible world is again defined syntactically).
This is an impressive property of the Theory of Abstract Objects: it can syntacticallydefine objects that are usually only considered semantically.

2.3. The Language of PLM
The target of the embedding is the second-order fragment of object theory as describedin chapter 7 of Edward Zalta’s upcoming Principia Logico-Metaphysica (PLM)[12]. The
logical foundation of the theory uses a second-order modal logic (without primitive
identity) formulated using relational type theory that is modified to admit encoding asa second mode of predication besides the traditional exemplification. In the following an
informal description of the important aspects of the language is provided; for a detailed
and fully formal description and the type-theoretic background refer to the respective
chapters of PLM[12].
A compact description of the language can be given in Backus-Naur Form (BNF)[12, Definition (6)],as shown in figure 2.1, in which the following grammatical categories are used:δ
individual constantsν
individual variables
Σn n-place relation constants (n ≥ 0)
Ωn n-place relation variables (n ≥ 0)αvariablesκ
individual termsnΠ
n-place relation terms (n ≥ 0)Φ∗ propositional formulasΦformulasτ
terms
The language distinguishes between two types of basic formulas, namely (non-propositional)
formulas that may contain encoding subformulas and propositional formulas that may
not contain encoding subformulas. Only propositional formulas may be used in λexpressions. The main reason for this distinction will be explained in section 3.2.
Note that there is a case in which propositional formulas can contain encoding expressions. This is due to the fact that subformula is defined in such a way that xQ is nota subformula of ιx(xQ)3 . Thereby F ιx(xQ) is a propositional formula and [λy F ιx(xQ)]a well-formed λ-expression. On the other hand xF is not a propositional formula andtherefore [λx xF ] not a well-formed λ-expression. This fact will become relevant in thediscussion in section 5.2, that describes a paradox in the formulation of the theory inthe draft of PLM at the time of writing4 .
3For a formal definition of subformula refer to definition (8) in [12].
At the time of writing several options are being considered that can restore the consistency of thetheory while retaining all theorems of PLM.
414

Figure 2.1.: BNF grammar of the language of PLM[12, p. 170]

Furthermore the theory contains a designated relation constant E! to be read as being
concrete. Using this constant the distinction between ordinary and abstract objects isdefined as follows:• O! =df [λx ♦E!x]• A! =df [λx ¬♦E!x]
So ordinary objects are possibly concrete, whereas abstract objects cannot possibly beconcrete.
The language does not contain a primitive identity, but defines an identity for each typeof term as follows:
ordinary objects
x =E y =df O!x & O!y & (∀ F Fx ≡ Fy)
individuals
x = y =df x =E y ∨ (A!x & A!y & (∀ F xF ≡ yF ))one-place relations
F 1 = G 1 =df (∀ x xF 1 ≡ xG 1 )zero-place relations
F 0 = G 0 =df [λy F 0 ] = [λy G 0 ]The identity for n -place relations for n ≥ 2 is defined in terms of the identity of one-place
relations, see (16)[12] for the full details.
The identity for ordinary objects follows Leibniz’ law of the identity of indiscernibles: Twoordinary objects that necessarily exemplify the same properties are identical. Abstract
objects, however, are only identical if they necessarily encode the same properties. As
mentioned in the previous section this goes along with the concept of abstract objects
as the reification of property patterns.
Notably the identity for properties has a different definition than one would expectfrom classical logic. Classically two properties are considered identical if and only ifthey necessarily are exemplified by the same objects. The Theory of Abstract Objects,
however, defines two properties to be identical if and only if they are necessarily encodedby the same (abstract) objects. This has some interesting consequences that will be

15

described in more detail in section 2.5 which describes the hyperintensionality of relationsin the theory.

2.4. The Axioms
Based on the language above, an axiom system is defined that constructs a S5 modal logic
with an actuality operator, axioms for definite descriptions that go along with Russell’sanalysis of descriptions, the substitution of identicals as per the defined identity, α-, β -,
η - and a special ι-conversion for λ-expressions, as well as dedicated axioms for encoding.
A full accounting of the axioms in their representation in the embedding is found insection 3.10. For the original axioms refer to [12, Chap. 8]. At this point the axioms of
encoding are the most relevant, namely:• xF → xF• O!x → ¬∃ F xF
• ∃ x (A!x & ∀ F (xF ≡ ϕ)),provided x doesn’t occur free in ϕ
So encoding is modally rigid, ordinary objects do not encode properties and most importantly the comprehension axiom for abstract objects that was already mentioned
above:For every condition on properties ϕ there exists an abstract object, that encodes exactly
those properties, that satisfy ϕ.

2.5. Hyperintensionality of Relations
An interesting property of the Theory of Abstract Objects results from the definition ofidentity for one-place relations. Recall that two properties are defined to be identical
if and only if they are encoded by the same (abstract) objects. The theory imposes norestrictions whatsoever on which properties an abstract object encodes. Let for example
F be the property being the morning star and G be the property being the evening star.
Since the morning star and the evening star are actually both the planet Venus, every
object that exemplifies F will also exemplify G and vice-versa: ∀ x Fx ≡ Gx. However
the concept of being the morning star is different from the concept of being the evening
star. The Theory of Abstract Objects therefore does not prohibit the existence of an
abstract object that encodes F, but does not encode G. Therefore by the definition ofidentity for properties it does not hold that F = G. As a matter of fact the Theory of
Abstract Objects does not force F = G for any F and G. It rather stipulates what needs
to be proven, if F = G is to be established, namely that they are necessarily encoded by
the same objects. Therefore if two properties should be equal in some context an axiom
has to be added to the theory that allows to prove that both properties are encoded by
the same abstract objects.

16

The fact that the following relation terms do not necessarily denote the same relations
illustrates the extent of this hyperintensionality:[λy p ∨ ¬p] and [λy q ∨ ¬q][λy p & q] and [λy q & p]

Of course the theory can be extended in such a way that these properties are equal.
However, without additional axioms their equality is not derivable.
Although the relations of object theory are hyperintensional entities, propositional reasoning is still governed by classical extensionality. For example properties that arenecessarily exemplified by the same objects can be substituted for each other in an
exemplification formula, the law of the excluded middle can be used in propositional
reasoning, etc.
The Theory of Abstract Objects is an extensional theory of intensional entities[12, (130)].

2.6. The Aczel-Model
When thinking about a model for the theory one will quickly notice the following problem: The comprehension axiom for abstract objects implies that for each set of properties
there exists an abstract object encoding exactly those properties. Considering the definition of identity there therefore exists an injective map from the power set of properties
to the set of abstract objects. On the other hand for an object y the term [λx Rxy]constitutes a property. If for distinct abstract objects these properties were distinct,
this would result in a violation of Cantor’s theorem, since this would mean that there
is an injective map from the power set of properties to the set of properties. So does
the Theory of Abstract Objects as constructed above have a model? An answer to thisquestion was provided by Peter Aczel5 who proposed the model structure illustrated infigure 2.2.
In the Aczel-model abstract objects are represented by sets of properties. This of course
validates the comprehension axiom of abstract objects. Properties on the other hand are
not naively represented by sets of objects, which would lead to a violation of Cantor’s
theorem, but rather as the sets of urelements. Urelements are partitioned into twogroups, ordinary urelements (C in the illustration) and special urelements (S in theillustration). Ordinary urelements can serve as the denotations of ordinary objects.
Every abstract object on the other hand has a special urelement as its proxy. Whichproperties an abstract object exemplifies depends solely on its proxy. However, the map
from abstract objects to special urelements is not injective; more than one abstract object
can share the same proxy. This way a violation of Cantor’s theorem is avoided. As aconsequence there are abstract objects, that cannot be distinguished by the properties
5

In fact to our knowledge Dana Scott proposed a first model for the theory before Peter Aczel that
we believe is a special case of an Aczel-model with only one special urelement.

17

Figure 2.2.: Illustration of the Aczel-Model, courtesy of Edward Zalta

Aczel Model of Object Theory

A = Abstract Objects = ℘(P)

P = Properties = ℘(U)
Define a mapping:||a|| : A → S

U = Urelements =Domain D = A U C
Define for x D, |x| =Define, for assignment to variables g,g ⊨ Fx iff |g(x)| g(F)g ⊨ xF iff g(F)

g(x)

C

S

{

x, when x C||x||, when x A

In this model, the following are true:ϕ))x (A! x &F (xFF x (Fxϕ), ϕ has no encoding subformulas

they exemplify. Interestingly the existence of abstract objects that are exemplificationindistinguishable is a theorem of PLM, see (197)[12].
Although the Aczel-model illustrated in figure 2.2 is non-modal, the extension to a modal
version is straightforward by introducing primitive possible worlds as in the Kripke
semantics of modal logic.
Further note that relations in the Aczel-model are extensional. Since properties are
represented as the power set of urelements, two properties are in fact equal if they are18exemplified by the same objects. Consequently statements like [λ p ∨ ¬p] = [λ q ∨ ¬q]
are true in the model, although they are not derivable from the axioms of object theory
as explained in the previous section.
For this reason an intensional variant of the Aczel-model is developed and used as thebasis of the embedding. The technicalities of this model are described in the next chapter(see 3.3.1).

19

3. The Embedding
3.1. The Framework Isabelle/HOL
The embedding is implemented in Isabelle/HOL, that provides a functional higher-orderlogic that serves as meta-logic. An introduction to Isabelle/HOL can be found in [7]1 .
For a general introduction to HOL and its automation refer to [2].
The Isabelle theory containing the embedding is included in the appendix and documented in this chapter. Throughout the chapter references to the various sections of theappendix can be found.
This document itself is generated from a separate Isabelle theory that imports the complete embedding. The terms and theorems discussed throughout this chapter (startingfrom 3.4) are well-formed terms or valid theorems in the embedding, unless the contrary
is stated explicitly. Furthermore the pretty printing facility of Isabelle’s document generation has been utilized to make it easier to distinguish between the embedded logic
and the meta-logic: all expressions that belong to the embedded logic are printed in blue
color throughout the chapter.
For technical reasons this color coding could not be used for the raw Isabelle theory in
the appendix. Still note the use of bold print for the quantifiers and connectives of theembedded logic.

3.2. A Russell-style Paradox
One of the major challenges of an implementation of the Theory of Abstract Objects
in functional logic is the fact that a naive representation of the λ-expressions of thetheory using the unrestricted, β -convertible λ-expressions of functional logic results inthe following paradox (see [8, pp. 24-25]):
Assume [λx ∃ F (xF & ¬Fx)] were a valid λ-expression denoting a relation. Now thecomprehension axiom of abstract objects requires the following:∃ x (A!x & ∀ F (xF ≡ F = [λx ∃ F (xF & ¬Fx)]))So there is an abstract object that encodes only the property [λx ∃ F (xF & ¬Fx)]. Let b
be such an object. Now first assume b exemplifies [λx ∃ F (xF & ¬Fx)]. By β -reduction
this implies that there exists a property, that b encodes, but does not exemplify. Since
1

An updated version is available at http://isabelle.in.tum.de/doc/tutorial.pdf or in the documentation of the current Isabelle release, see http://isabelle.in.tum.de/.

20

b only encodes [λx ∃ F (xF & ¬Fx)], but does also exemplify it by assumption this is acontradiction.
Now assume b does not exemplify [λx ∃ F (xF & ¬Fx)]. By β -reduction it follows that
there does not exist a property that b encodes, but does not exemplify. Since b encodes[λx ∃ F (xF & ¬Fx)] by construction and does not exemplify it by assumption this isagain a contradiction.
This paradox is prevented in the formulation of object theory by disallowing encoding
subformulas in λ-expressions, so in particular [λx ∃ F (xF & ¬Fx)] is not part of thelanguage. However during the construction of the embedding it was discovered that
this restriction is not sufficient to prevent paradoxes in general. This is discussed in
section 5.2. The solution used in the embedding is described in section 3.4.7.

3.3. Basic Concepts
The introduction mentioned that shallow semantical embeddings were used to successfully represent different varieties of modal logic by implementing them using Kripke
semantics. The advantage here is that Kripke semantics is well understood and there
are extensive results about its soundness and completeness that can be utilized in theanalysis of semantical embeddings (see [3]).
For the Theory of Abstract Objects the situation is different. Section 2.6 already established that even a modal version of the traditional Aczel-model is extensional andtherefore theorems are true in it, that are not derivable from the axioms of object theory. On the other hand the last section showed that care has to be taken to ensure theconsistency of an embedding of the theory in functional logic.
For this reason the embedding first constructs a hyperintensional version of the Aczelmodel that serves as a provably consistent basis for the theory. Then several abstraction
layers are implemented on top of the model structure in order to enable reasoning thatis independent of the particular representation. These concepts are described in moredetail in the following sections.

3.3.1. Hyperintensional Aczel-model
As mentioned in section 2.6 it is straightforward to extend the traditional (non-modal)
Aczel-model to a modal version by introducing primitive possible worlds following the
Kripke semantics for a modal S5 logic.
Relations in the resulting Aczel-model are, however, still extensional. Two relations
that are necessarily exemplified by the same objects are equal. The Aczel-model thatis used as the basis for the embedding therefore introduces states as another primitive
besides possible worlds. Truth values are represented as ternary functions from states andpossible worlds to booleans; relations as functions from urelements, states and possible
worlds to booleans.

21

Abstract objects are still defined as sets of one-place relations and the division of urelements into ordinary urelements and special urelements, that serve as proxies for abstract
objects, is retained as well. Consequently encoding can still be defined as set membershipof a relation in an abstract object. Exemplification is defined as function application ofa relation to the urelement corresponding to an individual, a state and a possible world.
The semantic truth evaluation of a proposition in a given possible world is defined as its
evaluation for a designated actual state and the possible world.
Logical connectives are defined to behave classically in the actual state, but have undefined behavior in other states.
The reason for this construction becomes apparent if one considers the definition of
the identity of relations: relations are considered identical if they are encoded by thesame abstract objects. In the constructed model encoding depends on the behavior of a
relation in all states. Two relations can necessarily be exemplified by the same objects inthe actual state, but still not be identical, since they can differ in other states. Therefore
hyperintensionality of relations is achieved.
The dependency on states is not limited to relations, but introduced to propositions,connectives and quantifiers as well, although the semantic truth conditions of formulas
only depend on the evaluation for the actual state. The reason for this is to be able todefine λ-expressions (see section 3.4.7) and to extend the hyperintensionality of relations
to them. Since the behavior of logical connectives is undefined in states other than
the actual state, the behavior of λ-expressions - although classical in the actual state remains undefined for different states.
In summary, since the semantic truth of a proposition solely depends on its evaluation forthe designated actual state, in which the logical connectives are defined to behave classically, the reasoning about propositions remains classical, as desired. On the other handthe additional dependency on states allows a representation of the hyperintensionalityof relations.
The technical details of the implementation are described in section 3.4.

3.3.2. Layered Structure
Although the constructed variant of the Aczel-model preserves the hyperintensionalityof relations in the theory, it is still known that there are true theorems in this modelthat are not derivable from the axioms of object theory (see 3.12).
Given this lack of a model with a well-understood degree of soundness and completeness,the embedding uses a different approach than other semantical embeddings, namely theembedding is divided into several layers as follows:• The first layer represents the primitives of PLM using the described hyperintensional and modal variant of the Aczel-model.
• In a second layer the objects of the embedded logic constructed in the first layer are
considered as primitives and some of their semantic properties are derived using
the background logic as meta-logic.

22• The third layer derives the axiom system of PLM mostly using the semantics ofthe second layer and partly using the model structure directly.
• Based on the third layer the deductive system PLM as described in [12, Chap. 9]
is derived solely using the axiom system of the third layer and the fundamental
meta-rules stated in PLM. The model structure and the constructed semantics
are explicitly not used in any proofs. Thereby the reasoning in this last layer is
independent of the first two layers.

The rationale behind this approach is the following: The first layer provides a representation of the embedded logic that is provably consistent. Only minimal axiomatizationis necessary, whereas the main construction is purely definitional. Since the subsequent
layers don’t contain any additional axiomatization (the axiom system in the third layer
is derived) their consistency is thereby guaranteed as well.
The second layer tries to abstract away from the details of the representation by implementing an approximation of the formal semantics of PLM2 . The long time goal would
be to arrive at the representation of a complete semantics in this layer, that would be
sufficient to derive the axiom system in the next layer and which any specific model
structure would have to satisfy. Unfortunately this could not be achieved so far, but it
was possible to lay some foundations for future work.
At the moment full abstraction from the representation layer is only achieved after deriving the axiom system in the third layer. Still it can be reasoned that in any modelof object theory the axiom system has to be derivable and therefore by disallowing all
further proofs to rely on the representation layer and model structure directly the derivation of the deductive system PLM is universal. The only exceptions are the primitive
meta-rules of PLM: modus ponens, RN (necessitation) and GEN (universal generalization), as well as the deduction rule. These rules do not follow from the axiom systemitself, but are derived from the semantics in the second layer (see 3.11.2). Still as thecorresponding semantical rules will again have to be derivable for any model, this does
not have an impact on the universality of the subsequent reasoning.
The technical details of the constructed embedding are described in the following sections.

2

Our thanks to Edward Zalta for supplying us with a preliminary version of the corresponding
unpublished chapter of PLM.

23

3.4. The Representation Layer
The first layer of the embedding (see A.1) implements the variant of the Aczel-model
described in section 3.3.1 and builds a representation of the language of PLM in the
logic of Isabelle/HOL. This process is outlined step by step throughout this section.

3.4.1. Primitives
The following primitive types are the basis of the embedding (see A.1.1):• Type i represents possible worlds in the Kripke semantics.
• Type j represents states as described in section 3.3.1.
• Type bool represents meta-logical truth values (True or False ) and is inherited from
Isabelle/HOL.
• Type ω represents ordinary urelements.
• Type σ represents special urelements.
Two constants are introduced:• The constant dw of type i represents the designated actual world.
• The constant dj of type j represents the designated actual state.
Based on the primitive types above the following types are defined (see A.1.2):• Type o is defined as the set of all functions of type j ⇒ i ⇒ bool and represents
propositions in the embedded logic.
• Type υ is defined as datatype υ = ωυ ω | συ σ . This type represents urelements
and an object of this type can be either an ordinary or a special urelement (withthe respective type constructors ωυ and συ ).
• Type Π0 is defined as a synonym for type o and represents zero-place relations.
• Type Π1 is defined as the set of all functions of type υ ⇒ j ⇒ i ⇒ bool and represents one-place relations (for an urelement a one-place relation evaluates to atruth value in the embedded logic; for an urelement, a state and a possible world
it evaluates to a meta-logical truth value).
• Type Π2 is defined as the set of all functions of type υ ⇒ υ ⇒ j ⇒ i ⇒ bool andrepresents two-place relations.
• Type Π3 is defined as the set of all functions of type υ ⇒ υ ⇒ υ ⇒ j ⇒ i ⇒ booland represents three-place relations.
• Type α is defined as a synonym of the type of sets of one-place relations Π1 set,i.e. every set of one-place relations constitutes an object of type α. This type
represents abstract objects.
• Type ν is defined as datatype ν = ων ω | αν α. This type represents individuals
and can be either an ordinary urelement of type ω or an abstract object of type α(with the respective type constructors ων and αν ).

24

• Type κ is defined as the set of all objects of type ν option and represents individual
terms. The type 0a option is part of Isabelle/HOL and consists of a type constructor
Some x for an object x of type 0a (in this case type ν ) and an additional special
element called None. None is used to represent individual terms that are definite
descriptions that are not logically proper (i.e. they do not denote an individual).
Remark. The Isabelle syntax typedef o = UNIV ::(j⇒i⇒bool) set morphisms evalo makeo.. found in the theory source in the appendix introduces a new abstract type o that isrepresented by the full set ( UNIV) of objects of type j ⇒ i ⇒ bool. The morphism evalo
maps an object of abstract type o to its representative of type j ⇒ i ⇒ bool, whereas themorphism makeo maps an object of type j ⇒ i ⇒ bool to the object of type o that is represented by it. Defining these abstract types makes it possible to consider the defined types
as primitives in later stages of the embedding, once their meta-logical properties are derived from the underlying representation. For a theoretical analysis of the representation
layer the type o can be considered a synonym of j ⇒ i ⇒ bool.
The Isabelle syntax setup-lifting type-definition-o allows definitions for the abstract type oto be stated directly for its representation type j ⇒ i ⇒ bool using the syntax lift-definition.
For the sake of readability in the documentation of the embedding the morphisms areomitted and definitions are stated directly for the representation types3 .

3.4.2. Individual Terms and Definite Descriptions
There are two basic types of individual terms in PLM: definite descriptions and individual variables (and constants). Every logically proper definite description denotes anindividual. A definite description is logically proper if its matrix is (actually) true for aunique individual.
In the embedding the type κ encompasses all individual terms, i.e. individual variables,
constants and definite descriptions. An individual (i.e. a variable or constant of type ν )can be used in place of an individual term of type κ via the decoration _P (see A.1.3):
x P = Some x

The expression x P (of type κ) is marked to be logically proper (it can only be substituted
by objects that are internally of the form Some x ) and to denote the individual x.
Definite descriptions are defined as follows:ιx . ϕ x = (if ∃ !x. (ϕ x) dj dw then Some (THE x. (ϕ x) dj dw) else None)

If the propriety condition of a definite description ∃ !x. ϕ x dj dw holds, i.e. there exists a
unique x, such that ϕ x holds for the actual state and the actual world, the term ιx. ϕ x
3
The omission of the morphisms is achieved using custom pretty printing rules for the document
generation facility of Isabelle. The full technical details without these minor omissions can be found in
the raw Isabelle theory in the appendix.

25

evaluates to Some (THE x. ϕ x dj dw). Isabelle’s THE operator evaluates to the unique
object, for which the given condition holds, if there is such a unique object, and isundefined otherwise. If the propriety condition does not hold, the term evaluates to
None.
The following meta-logical functions are defined to aid in handling individual terms:• proper x = (None 6= x)• rep x = the x
the maps an object of type 0a option that is of the form Some x to x and is undefinedfor None. For an object of type κ the expression proper x is true, if the term is logicallyproper, and if this is the case, the expression rep x evaluates to the individual of type νthat the term denotes.

3.4.3. Mapping from Individuals to Urelements
To map abstract objects to urelements (for which relations can be evaluated), a constant
ασ of type α ⇒ σ is introduced, which maps abstract objects (of type α) to special
urelements (of type σ ), see A.1.4.
To assure that every object in the full domain of urelements actually is an urelement for(one or more) individual objects, the constant ασ is axiomatized to be surjective.
Now the mapping νυ of type ν ⇒ υ can be defined as follows:νυ ≡ case-ν ωυ (συ ◦ ασ)

To clarify the syntax note that this is equivalent to the following:(∀ x. νυ (ων x) = ωυ x) ∧ (∀ x. νυ (αν x) = συ (ασ x))

So ordinary objects are simply converted to an urelements by the type constructor ωυ ,whereas for abstract objects the corresponding special urelement under ασ is converted
to an urelement using the type constructor συ .
Remark. Future versions of the embedding may introduce a dependency of the mappingfrom individuals to urelements on states (see 3.12).

3.4.4. Exemplification of n-place relations
Exemplification of n-place relations can now be defined. Exemplification of zero-place
relations is simply defined as the identity, whereas exemplification of n-place relations forn ≥ 1 is defined to be true, if all individual terms are logically proper and the function
application of the relation to the urelements corresponding to the individuals yields true
for a given possible world and state (see A.1.5):26

• (|p|) = p• (|F ,x|) = (λs w. proper x ∧ F (νυ (rep x)) s w)
• (|F ,x,y|) = (λs w. proper x ∧ proper y ∧ F (νυ (rep x)) (νυ (rep y)) s w)
• (|F ,x,y,z|) =(λs w. proper x ∧proper y ∧ proper z ∧ F (νυ (rep x)) (νυ (rep y)) (νυ (rep z)) s w)

3.4.5. Encoding
Encoding is defined as follows (see A.1.6):{|x,F |} = (λs w. proper x ∧ (case rep x of ων ω ⇒ False | αν α ⇒ F ∈ α))

For a given state s and a given possible world w it holds that an individual term x
encodes F, if x is logically proper, the denoted individual rep x is of the form αν α forsome object α (i.e. it is an abstract object) and F is contained in α (recall that abstract
objects are defined to be sets of one-place relations).
Encoding is represented as a function of states and possible worlds to ensure typecorrectness, but its evaluation does not depend on either. On the other hand whether F
is contained in α does depend on the behavior of F in all states.

3.4.6. Connectives and Quantifiers
Following the model described in section 3.3.1 the connectives and quantifiers are definedin such a way that they behave classically if evaluated for the designated actual state dj,
whereas their behavior is governed by uninterpreted constants in any other state4 .
For this purpose the following uninterpreted constants are introduced (see A.1.7):• I-NOT of type j ⇒ (i ⇒ bool) ⇒ i ⇒ bool
• I-IMPL of type j ⇒ (i ⇒ bool) ⇒ (i ⇒ bool) ⇒ i ⇒ bool
Modality is represented using the dependency on primitive possible worlds using a standard Kripke semantics for a S5 modal logic.
The basic connectives and quantifiers are defined as follows (see A.1.7):• ¬p = (λs w. s = dj ∧ ¬ p dj w ∨ s 6= dj ∧ I-NOT s (p s) w)• p→q=(λs w. s = dj ∧ (p dj w −→ q dj w) ∨ s 6= dj ∧ I-IMPL s (p s) (q s) w)• ∀ ν x . ϕ x = (λs w. ∀ x. (ϕ x) s w)
• ∀ 0 p . ϕ p = (λs w. ∀ p. (ϕ p) s w)
• ∀ 1 F . ϕ F = (λs w. ∀ F . (ϕ F ) s w)
• ∀ 2 F . ϕ F = (λs w. ∀ F . (ϕ F ) s w)
4
Early attempts in using an intuitionistic version of connectives and quantifiers based on [6] were
found to be insufficient to capture the full hyperintensionality of PLM, but served as inspiration for thecurrent construction.

27• ∀ 3 F . ϕ F = (λs w. ∀ F . (ϕ F ) s w)
• p = (λs w. ∀ v. p s v)
• Ap = (λs w. p s dw)
Note in particular that negation and implication behave classically if evaluated for theactual state s = dj, but are governed by the uninterpreted constants I-NOT and I-IMPL
for s 6= dj :• s = dj =⇒ ¬p s w = (¬ p s w)
• s 6= dj =⇒ ¬p s w = I-NOT s (p s) w
• s = dj =⇒ p → q s w = (p s w −→ q s w)
• s 6= dj =⇒ p → q s w = I-IMPL s (p s) (q s) w
Remark. Future research may conclude that non-classical behavior in states s 6= dj fornegation and implication is not sufficient for achieving the desired level of hyperintensionality for λ-expressions. It would be trivial to introduce additional uninterpreted constants to govern the behavior of the remaining connectives and quantifiers in such states
as well, though. The remainder of the embedding would not be affected, i.e. no assumption about the behavior of connectives and quantifiers in states other than dj is made in
the subsequent reasoning. At the time of writing non-classical behavior for negation andimplication is considered sufficient.

3.4.7. λ-Expressions
The bound variables of the λ-expressions of the embedded logic are individual variables,
whereas relations are represented as functions acting on urelements. Therefore the definition of the λ-expressions of the embedded logic is non-trivial. The embedding defines
them as follows (see A.1.8):• λ0 p = p• λx. ϕ x = (λu s w. ∃ x. νυ x = u ∧ (ϕ x) s w)
• λ2 (λx y. ϕ x y) = (λu v s w. ∃ x y. νυ x = u ∧ νυ y = v ∧ (ϕ x y) s w)
• λ3 (λx y z. ϕ x y z) =(λu v r s w. ∃ x y z. νυ x = u ∧ νυ y = v ∧ νυ z = r ∧ (ϕ x y z) s w)

Remark. For technical reasons Isabelle only allows λ-expressions for one-place relations
to use a nice binder notation. Although better workarounds may be possible, for now theissue is avoided by the use of the primitive λ-expressions of the background logic in
combination with the constants λ2 and λ3 as shown above.
The representation of zero-place λ-expressions as the identity is straight-forward; therepresentation of n-place λ-expressions for n ≥ 1 is illustrated for the case n = 1 :The matrix of the λ-expression ϕ is a function from individuals (of type ν ) to truth
values (of type o, resp. j ⇒ i ⇒ bool ). One-place relations are represented as functionsof type υ ⇒ j ⇒ i ⇒ bool though, where υ is the type of urelements.

28

The λ-expression λx. ϕ x evaluates to True for an urelement u, a state s and a world w,
if there is an individual x in the preimage of u under νυ and it holds that ϕ x s w .
λx. ϕ x u s w = (∃ x. νυ x = u ∧ ϕ x s w)

If restricted to ordinary objects, the definition can be simplified, since νυ is bijective on
the set of ordinary objects:
λx. ϕ x (ωυ u) s w = (ϕ (ων u)) s w

However in general νυ can map several abstract objects to the same special urelement,
so an analog statement for abstract objects does not hold for arbitrary ϕ. As describedin section 3.2 such a statement would in fact not be desirable, since it would lead toinconsistencies.
Instead the embedding introduces the concept of proper maps. A map from individuals
to propositions is defined to be proper if its truth evaluation for the actual state only
depends on the urelements corresponding to the individuals (see A.1.9):• IsProperInX ϕ = (∀ x v. (∃ a. νυ a = νυ x ∧ (ϕ (a P )) dj v) = (ϕ (x P )) dj v)• IsProperInXY ϕ =(∀ x y v.
(∃ a b. νυ a = νυ x ∧ νυ b = νυ y ∧ (ϕ (a P ) (bP )) dj v) =(ϕ (x P ) (y P )) dj v)• IsProperInXYZ ϕ =(∀ x y z v.
(∃ a b c.
νυ a = νυ x ∧ νυ b = νυ y ∧ νυ c = νυ z ∧ (ϕ (a P ) (bP ) (c P )) dj v) =(ϕ (x P ) (y P ) (z P )) dj v)

Now by the definition of proper maps the evaluation of λ-expressions behaves as expected
for proper ϕ:
IsProperInX ϕ = (∀ w x. λx. ϕ (x P ) (νυ x) dj w = ϕ (x P ) dj w)

Remark. The right-hand side of the equation above does not quantify over all states,
but is restricted to the actual state dj. This is sufficient given that truth evaluation only
depends on the actual state and goes along with the desired semantics of λ-expressions(see 3.5.5).
Maps that contain encoding formulas in their arguments are in general not proper andthereby the paradox mentioned in section 3.2 is prevented.
In fact proper maps are the most general kind of functions that may appear in a lambdaexpression, such that β -conversion holds. In what way proper maps correspond to theformulas that PLM allows as the matrix of a λ-expression is a complex question anddiscussed separately in section 5.1.1.

29

3.4.8. Validity
Semantic validity is defined as follows (see A.1.10):[ϕ in v] = ϕ dj v

A formula is considered semantically valid for a possible world v if it evaluates to Truefor the actual state dj and the given possible world v.
Remark. The Isabelle Theory in the appendix defines the syntax v |= p in the representation layer, following the syntax used in the formal semantics of PLM. The syntax[p in v] that is easier to use in Isabelle due to bracketing the expression is only introduced
after the semantics is derived in A.2.3. For simplicity only the latter syntax is used inthis documentation.

3.4.9. ConcretenessPLM defines concreteness as a one-place relation constant. For the embedding carehas to be taken that concreteness actually matches the primitive distinction between
ordinary and abstract objects. The following requirements have to be satisfied by the
introduced notion of concreteness:• Ordinary objects are possibly concrete. In the meta-logic this means that forevery ordinary object there exists at least one possible world, in which the object
is concrete.
• Abstract objects are not possibly concrete.
An additional requirement is enforced by axiom (32.4)[12], see 3.10.7. To satisfy thisaxiom the following has to be assured:• Possibly contingent objects exist. In the meta-logic this means that there exists anordinary object and two possible worlds, such that the ordinary object is concretein one of the worlds, but not concrete in the other.
• Possibly no contingent objects exist. In the meta-logic this means that there exists
a possible world, such that all objects that are concrete in this world, are concretein all possible worlds.
In order to satisfy these requirements a constant ConcreteInWorld is introduced, thatmaps ordinary objects (of type ω ) and possible worlds (of type i ) to meta-logical truth
values (of type bool ). This constant is axiomatized in the following way (see A.1.11):• ∀ x. ∃ v. ConcreteInWorld x v• ∃ x v. ConcreteInWorld x v ∧ (∃ w. ¬ ConcreteInWorld x w)
• ∃ w. ∀ x. ConcreteInWorld x w −→ (∀ v. ConcreteInWorld x v)
Concreteness can now be defined as a one-place relation:
E! = (λu s w. case u of ωυ x ⇒ ConcreteInWorld x w | συ σ ⇒ False)30

Whether an ordinary object is concrete is governed by the introduced constant, whereas
abstract objects are never concrete.

3.4.10. The Syntax of the Embedded Logic
The embedding aims to provide a readable syntax for the embedded logic that is as
close as possible to the syntax of PLM and clearly distinguishes between the embedded
logic and the meta-logic. Some concessions have to be made due to the limitations ofdefinable syntax in Isabelle, though. Moreover exemplification and encoding have to use
a dedicated syntax in order to be distinguishable from function application.
The syntax for the basic formulas of PLM used in the embedding is summarized in thefollowing table:

PLM
ϕ
¬ϕ
ϕ→ψ
ϕ
Aϕ
Πυ
Πx
Πυ 1 υ 2ΠxyΠυ 1 υ 2 υ 3
Πxyz
υΠ
ιxϕ
∀ x(ϕ)∀ p(ϕ)∀ F (ϕ)syntax in words
it holds that ϕ
not ϕ
ϕ implies ψnecessarily ϕactually ϕυ (an individual term) exemplifies Πx (an individual variable) exemplifies Πυ 1 and υ 2 exemplify Π
x and y exemplify Πυ 1 , υ 2 and υ 3 exemplify Πx, y and z exemplify Πυ encodes Π
the x, such that ϕ
for all individuals x it holds that ϕ
for all propositions p it holds that ϕ
for all relations F it holds that ϕ[λ p][λx ϕ][λxy ϕ][λxyz ϕ]being such that p
being x such that ϕbeing x and y such that ϕbeing x, y and z such that ϕembedded logic
ϕ
¬ϕ
ϕ→ψ
ϕ
Aϕ
(|Π,υ|)(|Π,x P |)(|Π,υ 1 ,υ 2 |)(|Π,x P ,y P |)(|Π,υ 1 ,υ 2 ,υ 3 |)(|Π,x P ,y P ,z P |){|υ,Π|}
ιx. ϕ x
∀ ν x. ϕ x∀ 0 p. ϕ p∀ 1F . ϕ F∀ 2F . ϕ F∀ 3F . ϕ F
λ0 p
λx. ϕ xλ2 (λx y. ϕ x y)
λ3 (λx y z. ϕ x y z)

type
o
o
o
o
o
o
o
o
o
o
o
o
κ
o
o
o

Π0
Π1
Π2
Π3

31

Several subtleties have to be considered:• n -place relations are only represented for n ≤ 3 . As the resulting language isalready expressive enough to represent the most interesting parts of the theory
and it would be trivial to add analog implementations for n > 3 , this is considered
to be sufficient. Future work may attempt to construct a general representation
for n -place relations for arbitrary n.
• Individual terms (that can be descriptions) and individual variables, resp. constants have different types. Exemplification and encoding is defined for individual
terms of type κ. Individual variables (i.e. variables of type ν ) or individual constants (i.e. constants of type ν ) can be converted to type κ using the decoration _P .
• In PLM a general term ϕ, as it occurs in definite descriptions, quantification formulas and λ-expressions above, can contain free variables. If such a term occurs
within the scope of a variable binding operator, free occurrences of the variable areconsidered to be bound by the operator. In the embedding this concept is replacedby representing ϕ as a function acting on the bound variables and using the native
concept of binding operators in Isabelle.
• The representation layer of the embedding defines a separate quantifier for every
type of variable in PLM. This is done to assure that only quantification ranging
over these types is part of the embedded language. The definition of a generalquantifier in the representation layer could for example be used to quantify overindividual terms (of type κ), whereas only quantification ranging over individuals(of type ν ) is part of the language of PLM. After the semantics is introduced in
section 3.5, a type class is constructed that is characterized by the semantics ofquantification and instantiated for all variable types. This way a general binderthat can be used for all variable types can be defined. The details of this approachare explained in section 3.6.
The syntax used for stating that a proposition is semantically valid is the following:[ϕ in v]

Here ϕ and v are free variables (in the meta-logic). Therefore, stating the expression
above as a lemma will implicitly be a quantified statement over all propositions ϕ and all
possible worlds v (unless ϕ or v are explicitly restricted in the current scope or globallydeclared as constants).

32

3.5. Semantic Abstraction
The second layer of the embedding (see A.2) abstracts away from the technicalities of
the representation layer and states the truth conditions for formulas of the embedded
logic in a similar way as the (at the time of writing unpublished) semantics of object
theory.

3.5.1. Domains and Denotation Functions
In order to do so the abstract types introduced in the representation layer κ, o resp. Π0 ,
Π1 , Π2 and Π3 are considered as primitive types and assigned semantic domains: Rκ , R0 ,R1 , R2 and R3 (see A.2.1.1).
For the embedding the definition of these semantic domains is trivial, since the abstract
types of the representation layer are already modeled using representation sets. Therefore
the semantic domain for each type can simply be defined as the type of its representatives.
As a next step denotation functions are defined that assign semantic denotations to theobjects of each abstract type (see A.2.1.2). The formal semantics of PLM does not apriori assume that every term has a denotation. Therefore, the denotation functions are
represented as functions that map to the option type of the respective domain. This way
they can either map a term to Some x, if the term denotes x, or to None, if the term does
not denote.
In the embedding all relation terms always denote, therefore the denotation functions
d 0 , . . . , d 3 for relations can simply be defined as the type constructor Some. Individual
terms on the other hand are already represented by an option type, so the denotation
function d κ can be defined as the identity.
Moreover the primitive type of possible worlds i is used as the semantic domain of
possible worlds W and the primitive actual world dw as the semantic actual world w 0(see A.2.1.3).
Remark. Although the definitions for semantic domains and denotations may seem
redundant, conceptually the abstract types of the representation layer now have the roleof primitive types. Although for simplicity the last section regarded the type o as synonymof j ⇒ i ⇒ bool, it was introduced as a distinct type for which the set of all functions oftype j ⇒ i ⇒ bool merely serves as the underlying set of representatives. An object of typeo cannot directly be substituted for a variable of type j ⇒ i ⇒ bool. To do so it first has
to be mapped to its representative of type j ⇒ i ⇒ bool by the use of the morphism evalothat was introduced in the type definition and omitted in the last section for the sake ofreadability. Therefore although the definitions of the semantic domains and denotation
functions may seem superfluous, the domains are different types than the corresponding
abstract type and the denotation functions are functions between distinct types (note theuse of lift-definition rather than definition for the denotation functions in A.2.1.2 thatallows to define functions on abstract types in the terms of the underlying representation
types).

33

3.5.2. Exemplification and Encoding Extensions
Semantic truth conditions for exemplification formulas are defined using exemplification
extensions. Exemplification extensions are functions relative to semantic possible worldsthat map objects in the domain of n -place relations to meta-logical truth values in thecase n = 0 and sets of n -tuples of objects in the domain of individuals in the case n ≥ 1 .
Formally they are defined as follows (see A.2.1.4):• ex0 p w = p dj w
• ex1 F w = {x | F (νυ x) dj w}• ex2 R w = {(x, y) | R (νυ x) (νυ y) dj w}• ex3 R w = {(x, y, z) | R (νυ x) (νυ y) (νυ z) dj w}
The exemplification extension of a 0 -place relation is its evaluation for the actual state
and the given possible world. The exemplification extension of n -place relations (n ≥ 1 )in a possible world is the set of all (tuples of) individuals that are mapped to urelements
for which the relation evaluates to true for the given possible world and the actual state.
This is in accordance with the constructed Aczel-model (see 3.3.1).
Conceptually, exemplification extensions as maps to sets of individuals are independentof the underlying model and in particular do not require the concept of urelements asthey are present in an Aczel-model. Their use in the definition of truth conditions for
exemplification formulas below is therefore an abstraction away from the technicalitiesof the representation layer.
Similarly to the exemplification extension for one-place relations an encoding extension
is defined as follows (see A.2.1.5):
en F = {x | case x of ων ω ⇒ False | αν y ⇒ F ∈ y}

The encoding extension of a relation is defined as the set of all abstract objects that
contain the relation. Since encoding is modally rigid the encoding extension does notneed to be relativized for possible worlds.

3.5.3. Truth Conditions of Formulas
Based on the definitions above it is now possible to define truth conditions for the atomic
formulas of the language.
For exemplification formulas of n -place relations it suffices to consider the case of oneplace relations, for which the truth condition is defined as follows (see A.2.1.7):[(|Π,κ|) in w] = (∃ r o1 . Some r = d 1 Π ∧ Some o1 = d κ κ ∧ o1 ∈ ex1 r w)

The relation term Π is exemplified by an individual term κ in a possible world w if bothterms have a denotation and the denoted individual is contained in the exemplification
extension of the denoted relation in w. The definitions for n -place relations (n > 1 ) and
0 -place relations are analog.

34

The truth condition for encoding formulas is defined in a similar manner (see A.2.1.8):[{|κ,Π|} in w] = (∃ r o1 . Some r = d 1 Π ∧ Some o1 = d κ κ ∧ o1 ∈ en r)

The only difference to exemplification formulas is that the encoding extension does notdepend on the possible world w.
The truth conditions for complex formulas are straightforward (see A.2.1.9):• [¬ψ in w] = (¬ [ψ in w])• [ψ → χ in w] = (¬ [ψ in w] ∨ [χ in w])• [ψ in w] = (∀ v. [ψ in v])• [Aψ in w] = [ψ in dw]• [∀ ν x. ψ x in w] = (∀ x. [ψ x in w])• [∀ 0 x. ψ x in w] = (∀ x. [ψ x in w])• [∀ 1 x. ψ x in w] = (∀ x. [ψ x in w])• [∀ 2 x. ψ x in w] = (∀ x. [ψ x in w])• [∀ 3 x. ψ x in w] = (∀ x. [ψ x in w])
A negation formula ¬ψ is semantically true in a possible world, if and only if ψ is not
semantically true in the given possible world. Similarly truth conditions for implication
formulas and quantification formulas are defined canonically.
The truth condition of the modal box operator ψ as ψ being true in all possible worlds,
shows that modality follows a S5 logic. A formula involving the actuality operator Aψ
is defined to be semantically true, if and only if ψ is true in the designated actual world.

3.5.4. Denotation of Definite Descriptions
The definition of the denotation of description terms (see A.2.1.10) can be presented ina more readable form by splitting it into its two cases and by using the meta-logicalquantifier for unique existence:• ∃ !x. [ψ x in w 0 ] =⇒ d κ ιx. ψ x = Some (THE x. [ψ x in w 0 ])• @ !x. [ψ x in w 0 ] =⇒ d κ ιx. ψ x = None
If there exists a unique x, such that ψ x is true in the actual world, the definite description
denotes and its denotation is this unique x. Otherwise the definite description fails todenote.
It is important to consider what happens if a non-denoting definite description occurs
in a formula: The only positions in which such a term could occur in a complex formula
is in an exemplification expression or in an encoding expression. Given the above truth
conditions it becomes clear, that the presence of non-denoting terms does not meanthat there are formulas without truth conditions: Since exemplification and encoding
formulas are defined to be true only if the contained individual terms have denotations,such formulas are False for non-denoting individual terms.

35

3.5.5. Denotation of λ-Expressions
The most complex part of the semantic abstraction is the definition of denotationsfor λ-expressions. The formal semantics of PLM is split into several cases and uses a
special class of Hilbert-Ackermann ε-terms that are challenging to represent. Therefore
a simplified formulation of the denotation criteria is used. Moreover the denotationsof λ-expressions are coupled to syntactical conditions. This fact is represented using
the notion of proper maps as a restriction for the matrix of a λ-expression that was
introduced in section 3.4.7. The definitions are implemented as follows (see A.2.1.11):• d 1 λx. (|Π,x P |) = d 1 Π• IsProperInX ϕ =⇒Some r = d 1 λx. ϕ (x P ) ∧ Some o1 = d κ x −→ (o1 ∈ ex1 r w) = [ϕ x in w]• Some r = d 0 λ0 ϕ −→ ex0 r w = [ϕ in w]

The first condition for elementary λ-expressions is straightforward. The general case in
the second condition is more complex: Given that the matrix ϕ is a proper map, therelation denoted by the λ-expression has the property, that for a denoting individual
term x, the denoted individual is contained in its exemplification extension for a possible
world w, if and only if ϕ x holds in w. At a closer look this is the statement of β conversion restricted to denoting individuals: the truth condition of the λ-expression
being exemplified by some denoting individual term, is the same as the truth conditionof the matrix of the term for the denoted individual. Therefore it is clear that theprecondition that ϕ is a proper map is necessary and sufficient. Given this consideration
the case for 0 -place relations is straightforward and the cases for n ≥ 2 are analog tothe case n = 1 .

3.5.6. Properties of the Semantics
The formal semantics of PLM imposes several further restrictions some of which arederived as auxiliary lemmas. Furthermore some auxiliary statements that are specific to
the underlying representation layer are proven.
The following auxiliary statements are derived (see A.2.1.12):
1. All relations denote, e.g.
∃ r. Some r = d 1 F

2. An individual term of the form x P denotes x :d κ x P = Some x

3. Every ordinary object is contained in the extension of the concreteness property
for some possible world:Some r = d 1 E! =⇒ ∀ x. ∃ w. ων x ∈ ex1 r w

4. An object that is contained in the extension of the concreteness property in any
world is an ordinary object:
Some r = d 1 E! =⇒ ∀ x. x ∈ ex1 r w −→ (∃ y. x = ων y)

5. The denotation functions for relation terms are injective, e.g.

36

d 1 F = d 1 G =⇒ F = G

6. The denotation function for individual terms is injective for denoting terms:
Some o1 = d κ x ∧ Some o1 = d κ y =⇒ x = y

Especially statements 5 and 6 are only derivable due to the specific construction of therepresentation layer: since the semantic domains were defined as the representation setsof the respective abstract types and denotations were defined canonically, objects thathave the same denotation are identical as objects of the abstract type. 3 and 4 arenecessary to connect concreteness with the underlying distinction between ordinary andabstract objects in the model.

3.5.7. Proper Maps
The definition of proper maps as described in section 3.4.7 is formulated in terms of themeta-logic. Since denotation conditions in the semantics and later some of the axioms
have to be restricted to proper maps, a method has to be devised by which the propriety
of a map can easily be shown without using meta-logical concepts.
Therefore introduction rules for IsProperInX, IsProperInXY and IsProperInXYZ are derived
and a proving method show-proper is defined that can be used to proof the propriety ofa map using these introduction rules (see A.2.2).
The rules themselves rely on the power of the unifier of Isabelle/HOL: Any map acting
on individuals that can be expressed by another map that solely acts on exemplification
expressions involving the individuals, is shown to be proper. This effectively means that
all maps whose arguments only appear in exemplification expressions are proper. Using
the provided introduction rules Isabelle’s unifier can derive the propriety of such maps
automatically.
For a discussion about the relation between this concept and admissible λ-expressionsin PLM see section 5.1.1.

3.6. General All-Quantifier
Since the last section established the semantic truth conditions of the specific versionsof the all-quantifier for all variable types of PLM, it is now possible to define a binding
symbol for general all-quantification.
This is done using the concept of type classes in Isabelle/HOL. Type classes define
constants that depend on a type variable and state assumptions about this constant. In
subsequent reasoning the type of an object can be restricted to a type of the introduced
type class. Thereby the reasoning can make use of all assumptions that have beenstated about the constants of the type class. A priori it is not assumed that any type
actually satisfies the requirements of the type class, so initially statements involving
types restricted to a type class can not be applied to any specific type.

37

To allow that the type class has to be instantiated for the desired type. This is done
by first providing definitions for the constants of the type class specific to the respective
type. Then each assumption made by the type class has to be proven given the particular
type and the provided definitions. After that any statement that was proven for the typeclass can be applied to the instantiated type.
In the case of general all-quantification for the embedding this concept can be utilized
by introducing the type class quantifiable that is equipped with a constant that is used as
the general all-quantification binder (see A.3.1). For this constant it can now be assumed
that it satisfies the semantic property of all quantification: [∀ x. ψ x in w] = (∀ x. [ψ x in w]).
Since it was already shown in the last section that the specific all-quantifier for eachvariable type satisfies this property, the type class can immediately be instantiated forthe types ν , Π0 , Π1 , Π2 and Π3 (see A.3.2). The instantiation proofs only need to refer tothe statements derived in the semantics section for the respective version of the quantifier
and are thereby independent of the representation layer.
From this point onward the general all-quantifier can completely replace the type specificquantifiers. This is true even if a quantification is meant to only range over objects ofa particular type: In this case the desired type (if it can not implicitly be deduced fromthe context) can be stated explicitly while still using the general quantifier.
Remark. Technically it would be possible to instantiate the type class quantifiable forany other type that satisfies the semantic criterion, thereby compromising the restrictionof the all-quantifier to the primitive types of PLM. However, this is not done in theembedding and therefore the introduction of a general quantifier using a type class is
considered a reasonable compromise.

3.7. Derived Language Elements
The language of the embedded logic constructed so far is limited to a minimal set ofprimitive elements. This section introduces further derived language elements that are
defined directly in the embedded logic.
Notably identity is not part of the primitive language, but introduced as a defined concept.

3.7.1. Connectives
The remaining classical connectives and the modal diamond operator are defined in the
traditional manner (see A.4.1):• ϕ & ψ = ¬(ϕ → ¬ψ)• ϕ ∨ ψ = ¬ϕ → ψ• ϕ ≡ ψ = (ϕ → ψ) & (ψ → ϕ)
• ♦ϕ = ¬¬ϕ38

Furthermore, the general all-quantifier is supplemented by an existential quantifier asfollows:• ∃ α . ϕ α = ¬(∀ α. ¬ϕ α)

3.7.2. Identity
The definitions for identity are stated separately for each type of term (see A.4.3):• x =E y = (|λ2 (λx y. (|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |))),x,y|)• F =1 G = (∀ x. {|x P ,F |} ≡ {|x P ,G|})• F =2 G =∀ x. (λy. (|F ,x P ,y P |)) =1 (λy. (|G,x P ,y P |)) & (λy. (|F ,y P ,x P |)) =1 (λy. (|G,y P ,x P |))• F =3 G = ∀ x y. (λz. (|F ,z P ,x P ,y P |)) =1 (λz. (|G,z P ,x P ,y P |)) & (λz. (|F ,x P ,z P ,y P |)) =1(λz. (|G,x P ,z P ,y P |)) & (λz. (|F ,x P ,y P ,z P |)) =1 (λz. (|G,x P ,y P ,z P |))• p =0 q = (λx. p) =1 (λx. q)
Similarly to the general all-quantifier it makes sense to introduce a general identity relation for all types of terms (κ, o resp. Π0 , Π1 , Π2 , Π3 ). However, whereas all-quantificationis characterized by a semantic criterion that can be generalized in a type class, identity
is defined independently for each type. Therefore a general identity symbol will only
be introduced in section 3.9, since it will then be possible to formulate and prove areasonable property shared by the identity of all types of terms.

3.8. The Proving Method meta_solver
3.8.1. General Concept
Since the semantics in section 3.5 constructed a first abstraction on top of the representation layer, it makes sense to revisit the general concept of the layered structure of theembedding.
The idea behind this structure is that reasoning in subsequent layers should - as far as
possible - only rely on the previous layer. However, the restriction of proofs to a specificsubset of the facts that are valid in the global context can be cumbersome for automatedreasoning. While it is possible to restrict automated reasoning tools to only consider
specific sets of facts, it is still an interesting question whether the process of automatedreasoning in the layered approach can be made easier.
To that end the embedding utilizes the Isabelle package Eisbach. This package allows toconveniently define new proving methods that are based on the systematic applicationof existing methods.
Remark. The Eisbach package even allows the construction of more complex proving
methods that involve pattern matching. This functionality is utilized in the constructionof a substitution method as described in section 3.11.5.

39

The idea is to construct a simple resolution prover that can deconstruct complex formulasof the embedded logic to simpler formulas that are connected by a relation in the metalogic as required by the semantics.
For example an implication formula can be deconstructed as follows:[ϕ → ψ in v] = ([ϕ in v] −→ [ψ in v])

Whereas the basic proving methods available in Isabelle cannot immediately prove[ϕ → ϕ in v] without any facts about the definitions of validity and implication, they
can prove [ϕ in v] −→ [ϕ in v] directly as an instance of p −→ p.

3.8.2. Implementation
Following this idea the method meta-solver is introduced (see A.5) that repeatedly applies
rules like the above in order to translate complex formulas of the embedded logic tometa-logical statements involving simpler formulas.
The formulation of appropriate introduction, elimination and substitution rules for the
logical connectives and quantifiers is straightforward. Beyond that the concept can beused to resolve exemplification and encoding formulas to their semantic truth conditions
as well, e.g. (see A.5.10):[(|F ,x|) in v] = (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v)

This way a large set of formulas can be decomposed to semantic expressions that can be
automatically proven without having to rely on the meta-logical definitions directly.
Additionally the meta-solver is equipped with rules for being abstract and ordinary andfor the defined identity.
Notably the representation layer has the property that the defined identities are equivalent to the identity in the meta-logic. Formally the following statements are true andderived as rules for the meta-solver :• [x =E y in v] =(∃ o1 o2 . Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ y ∧ o1 = o2 )• [x =κ y in v] = (∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o2 )• [F =1 G in v] = (F = G)
• [F =2 G in v] = (F = G)
• [F =3 G in v] = (F = G)
• [F =0 G in v] = (F = G)

The proofs for these facts (see A.5.15) are complex and do not solely rely on the propertiesof the formal semantics of PLM.
The fact that they are derivable has a distinct advantage: since identical terms inthe sense of PLM are identical in the meta-logic, proving the axiom of substitution(see 3.10.4) is trivial. A derivation that is solely based on the semantics on the other40

hand, would require a complex induction proof. For this reason it is considered a reasonable compromise to include these statements as admissible rules for the meta-solver.
However, future work may attempt to enforce the separation of layers more strictly andconsequently abstain from these rules.
Remark. Instead of introducing a custom proving method using the Eisbach package, asimilar effect could be achieved by instead supplying the derived introduction, eliminationand substitution rules directly to one of the existing proving methods like auto or clarsimp.
In practice, however, we found that the custom meta-solver produces more reliable results,
especially in the case that a proving objective cannot be solved completely by the supplied
rules. Moreover the constructed custom proving method serves as a proof of concept andmay inspire the development of further more complex proving methods that go beyond a
simple resolution prover in the future.

3.8.3. Applicability
Given the discussion above and keeping the layered structure of the embedding in mind,
it is important to precisely determine for which purposes it is valid to use the constructed
meta-solver.
The main application of the method in the embedding is to support the derivation of
the axiom system as described in section 3.10. Furthermore the meta-solver can aid in
examining the meta-logical properties of the embedding. The meta-solver is only suppliedwith rules that are reversible. Thereby it is justified to use it to simplify a statement
before employing a tool like nitpick in order to look for models or counter-models for astatement.
However it is not justified to assume that a theorem that can be proven with the aidof the meta-solver method is derivable in the formal system of PLM, since the result
still depends on the specific structure of the representation layer. However, based on
the concept of the meta-solver another proving method is introduced in section 3.11.3,
namely the PLM-solver. This proving method only employs rules that are derivable fromthe formal system of PLM itself. Thereby this method can be used in proofs without
sacrificing the universality of the result.

3.9. General Identity Relation
As already mentioned in section 3.6 similarly to the general quantification binder it isdesirable to introduce a general identity relation.
Since the identity of PLM is not directly characterized by semantic truth conditions, butinstead defined using specific complex formulas in the embedded logic for each type ofterm, some other property has to be found that is shared by the respective definitions
and can reasonably be used as the condition of a type class.

41

A natural choice for such a condition is the axiom of the substitution of identicals(see 3.10.4). The axiom states that if two objects are identical (in the sense of thedefined identity of PLM), then a formula involving the first object implies the formula
resulting from substituting the second object for the first object. This inspires thefollowing condition for the type class identifiable (see A.6.1):[α = β in v] ∧ [ϕ α in v] =⇒ [ϕ β in v]

Using the fact that in the last section it was already derived, that the defined identity
in the embedded-logic for each term implies the primitive identity of the meta-logicalobjects, this type class can be instantiated for all types of terms: κ, Π0 resp. o, Π1 , Π2 ,
Π3 (see A.6.2).
Since now general quantification and general identity are available, an additional quantifier for unique existence can be introduced (such a quantifier involves both quantificationand identity). To that end a derived type class is introduced that is the combinationof the quantifiable and the identifiable classes. Although this is straightforward for the
relation types, this reveals a subtlety involving the distinction between individuals oftype ν and individual terms of type κ: The type ν belongs to the class quantifiable, thetype κ on the other hand does not: no quantification over individual terms (that may
not denote) was defined. On the other hand the class identifiable was only instantiatedfor the type κ, but not for the type ν . This issue can be solved by noticing that it isstraightforward and justified to define an identity for ν as follows:x = y = x P = yP

This way type ν is equipped with both the general all-quantifier and the general identity
relation and unique existence can be defined for all variable types as expected:∃ ! α . ϕ α = ∃ α. ϕ α & (∀ β. ϕ β → β = α)Another subtlety has to be considered: at times it is necessary to expand the definitionsof identity for a specific type to derive statements in PLM. Since the defined identities
were introduced prior to the general identity symbol, such an expansion is therefore so
far not possible for a statement that uses the general identity, even if the types are fixedin the context.
To allow such an expansion the definitions of identity are equivalently restated for thegeneral identity symbol and each specific type (see A.6.3). This way the general identity
can from this point onward completely replace the type-specific identity symbols.

423.10. The Axiom System of PLM
The last step in abstracting away from the representation layer is the derivation of theaxiom system of PLM. Conceptionally the derivation of the axioms is the last momentin which it is deemed admissible to rely on the meta-logical properties of the underlying
model structure. Future work may even restrict this further to only allow the use of theproperties of the semantics in the proofs (if this is found to be possible).
To be able to distinguish between the axioms and other statements and theorems in theembedded logic they are stated using a dedicated syntax (see A.7):[[ ϕ ]] = (∀ v. [ϕ in v])

Axioms are unconditionally true in all possible worlds. The only exceptions are necessitationaverse, resp. modally-fragile axioms5 . Such axioms are stated using the following syntax:[ϕ] = [ϕ in dw]

3.10.1. Axioms as Schemata
Most of the axioms in PLM are stated as axiom schemata. They use variables that
range over and can therefore be instantiated for any formula and term. Furthermore
PLM introduces the notion of closures (see [12, (20)]). Effectively this means that thestatement of an axiom schema implies that the universal generalization of the schema,
the actualization of the schema and (except for modally-fragile axioms) the necessitationof the schema is also an axiom.
Since in Isabelle/HOL free variables in a theorem already range over all terms of thesame type no special measures have to be taken to allow instantiations for arbitrary
terms. The concept of closures is introduced using the following rules (see A.7.1):• [[ ϕ ]] =⇒ [ϕ in v]
V• ( x. [[ ϕ x ]]) =⇒ [[ ∀ x. ϕ x ]]• [[ ϕ ]] =⇒ [[ Aϕ ]]• [[ ϕ ]] =⇒ [[ ϕ ]]For modally-fragile axioms only the following rules are introduced:• [ϕ] =⇒ [ϕ in dw]
V• ( x. [ϕ x]) =⇒ [∀ x. ϕ x]
Remark. To simplify the instantiation of the axioms in subsequent proofs, a set of
attributes is defined that can be used to transform the statement of the axioms using therules defined above.
This way for example the axiom [[ ϕ → ϕ ]] can be directly transformed to [∀ x. ϕ x → ϕ x in v]
by not referencing it directly as qml-2, but by applying the defined attributes to it: qml-2 [axiom-universal,
axiom-instance]
5

Currently PLM uses only one such axiom, see 3.10.6.

43

3.10.2. Derivation of the Axioms
To simplify the derivation of the axioms a proving method axiom-meta-solver is introduced, that unfolds the dedicated syntax, then applies the meta-solver and if possible
resolves the proof objective automatically.
Most of the axioms can be derived by the axiom-meta-solver directly. Some axioms,
however, require more verbose proofs or their representation in the functional setting of
Isabelle/HOL requires special attention. Therefore in the following the complete axiom
system is listed and discussed in detail where necessary. Additionally each axiom is
associated with the numbering in the current draft of PLM[12].

3.10.3. Axioms for Negations and Conditionals
The axioms for negations and conditionals can be derived automatically and present nofurther issues (see A.7.2):• [[ ϕ → (ψ → ϕ) ]]• [[ ϕ → (ψ → χ) → (ϕ → ψ → (ϕ → χ)) ]]• [[ ¬ϕ → ¬ψ → (¬ϕ → ψ → ϕ) ]](21.1)(21.2)(21.3)

3.10.4. Axioms of Identity
The axiom of the substitution of identicals can be proven automatically, if additionallysupplied with the defining assumption of the type class identifiable. The statement is thefollowing (see A.7.3):• [[ α = β → (ϕ α → ϕ β) ]](25)

3.10.5. Axioms of Quantification
The axioms of quantification are formulated in a way that differs from the statementsin PLM, as follows (see A.7.4):• [[ (∀ α. ϕ α) → ϕ τ ]]• [[ (∀ α. ϕ (αP )) → ((∃ β. β P = τ ) → ϕ τ ) ]]• [[ (∀ α. ϕ α → ψ α) → ((∀ α. ϕ α) → (∀ α. ψ α)) ]]• [[ ϕ → (∀ α. ϕ) ]]• SimpleExOrEnc ψ =⇒ [[ ψ (ιx. ϕ x) → (∃ ν. ν P = (ιx. ϕ x)) ]]• SimpleExOrEnc ψ =⇒ [[ ψ τ → (∃ ν. ν P = τ ) ]](29.1a)(29.1b)(29.3)(29.4)(29.5a)(29.5b)The original axioms in PLM6 are the following:
6

Note that the axioms will in all likelihood be adjusted in future versions of PLM in order to preventthe paradox described in section 5.2.

44• ∀ αϕ → (∃ β(β = τ ) → ϕτ α )(29.1)• ∃ β(β = τ ), provided τ is not a description and β doesn’t occur free in τ .
(29.2)• ∀ α(ϕ → ψ) → (∀ α ϕ → ∀ α ψ)(29.3)• ϕ → (∀ α ϕ), provided α doesn’t occur free in ϕ(29.4)
ιxϕn• ψ µ → ∃ ν (ν = ιxϕ), provided (a) ψ is either an exemplification formula Π κ1 . . . κn(n ≥ 1 ) or an encoding formula κ1 Π1 , (b) µ is an individual variable that occursin ψ and only as one or more of the κi (1 ≤ i ≤ n ), and (c) ν is any individual
variable that doesn’t occur free in ϕ.
(29.5)In the embedding definite descriptions have the type κ that is different from the typefor individuals ν . Quantification is only defined for ν , not for κ.
Therefore, the restriction of (29.2) does not apply, since the type restriction of quantification ensures that τ cannot be a definite description. Consequently the inner preconditionof (29.1) can be dropped in (29.1a) - since a quantifier is used in the formulation, theproblematic case of definite descriptions is excluded and the dropped precondition would
always hold.
The second formulation (29.1b) for definite descriptions involves the type conversion _P
and keeps the inner precondition (since descriptions may not denote).
(29.5b) can be stated as a generalization of (29.5a) to general individual terms, since(29.2) already implies its right hand side for every term except descriptions.
Consequently (29.1b) and (29.5b) can replace the original axioms (29.1) and (29.5) for
individual terms. For individual variables and constants as well as relations the simplified
formulation (29.1a) can be used instead.
Future work may want to reconsider the reformulation of the axioms, especially considering the most recent developments described in section 5.2. At the time of writing thereformulation is considered a reasonable compromise, since due to the type restrictionsof the embedding the reformulated version of the axioms is an equivalent representationof the original axioms.
The predicate SimpleExOrEnc used as the precondition for (29.5) is defined as an inductive
predicate with the following introduction rules:• SimpleExOrEnc (λx. (|F ,x|))• SimpleExOrEnc (λx. (|F ,x,_|))• SimpleExOrEnc (λx. (|F ,_,x|))• SimpleExOrEnc (λx. (|F ,x,_,_|))• SimpleExOrEnc (λx. (|F ,_,x,_|))• SimpleExOrEnc (λx. (|F ,_,_,x|))• SimpleExOrEnc (λx. {|x,F |})This corresponds exactly to the restriction of ψ to an exemplification or encoding formulain PLM.

45

3.10.6. Axioms of Actuality
As mentioned in the beginning of the section the modally-fragile axiom of actuality isstated using a different syntax (see A.7.5):• [Aϕ ≡ ϕ](30)

Note that the model finding tool nitpick can find a counter-model for the formulation
as a regular axiom, as expected.
The remaining axioms of actuality are not modally-fragile and therefore stated as regularaxioms:• [[ A¬ϕ ≡ ¬Aϕ ]]• [[ A(ϕ → ψ) ≡ (Aϕ → Aψ) ]]• [[ A(∀ α. ϕ α) ≡ (∀ α. Aϕ α) ]]• [[ Aϕ ≡ AAϕ ]](31.1)(31.2)(31.3)(31.4)All of the above can be proven automatically by the axiom-meta-solver method.

3.10.7. Axioms of Necessity
The axioms of necessity are the following (see A.7.6):• [[ (ϕ → ψ) → (ϕ → ψ) ]]• [[ ϕ → ϕ ]]• [[ ♦ϕ → ♦ϕ ]]• [[ ♦(∃ x. (|E!,x P |) & ♦¬(|E!,x P |)) & ♦¬(∃ x. (|E!,x P |) & ♦¬(|E!,x P |)) ]](32.1)(32.2)(32.3)(32.4)

While the first three axioms can be derived automatically, the last axiom requires special
attention. On a closer look the formulation may be familiar. The axiom was alreadymentioned in section 3.4.9 while constructing the representation of the constant E!. To
be able to derive this axiom here the constant was specifically axiomatized. Consequently
the derivation requires the use of these meta-logical axioms stated in the representation
layer.

3.10.8. Axioms of Necessity and Actuality
The axioms of necessity and actuality can be derived automatically and require no further
attention (see A.7.7):• [[ Aϕ → Aϕ ]]• [[ ϕ ≡ A(ϕ) ]](33.1)(33.2)

3.10.9. Axioms of Descriptions
There is only one axiom dedicated to descriptions (note, however, that descriptions playa role in the axioms of quantification). The statement is the following (see A.7.8):

46

• [[ x P = (ιx. ϕ x) ≡ (∀ z. Aϕ z ≡ z = x) ]](34)

Given the technicalities of descriptions already discussed in section 3.10.5 it comes at nosurprise that this statement requires a verbose proof.

3.10.10. Axioms of Complex Relation Terms
The axioms of complex relation terms deal with the properties of λ-expressions.
Since the meta-solver was not equipped with explicit rules for λ-expressions, the statements rely on their semantic properties as described in section 3.5 directly.
The statements are the following (see A.7.9):• λx. ϕ x = λy. ϕ y• IsProperInX ϕ =⇒ [[ (|λx. ϕ (x P ),x P |) ≡ ϕ (x P ) ]]• IsProperInXY ϕ =⇒ [[ (|λ2 (λx y. ϕ (x P ) (y P )),x P ,y P |) ≡ ϕ (x P ) (y P ) ]]• IsProperInXYZ ϕ =⇒(36.1)(36.2)(36.2)(36.2)• [[ λ ϕ = ϕ ]](36.3)
P• [[ (λx. (|F ,x |)) = F ]](36.3)
2
P P• [[ λ (λx y. (|F ,x ,y |)) = F ]](36.3)
3
P P P• [[ λ (λx y z. (|F ,x ,y ,z |)) = F ]](36.3)V00• ( x. [A(ϕ x ≡ ψ x) in v]) =⇒ [[ λ (χ (ιx. ϕ x)) = λ (χ (ιx. ψ x)) ]](36.4)V• ( x. [A(ϕ x ≡ ψ x) in v]) =⇒ [[ (λx. χ (ιx. ϕ x) x) = (λx. χ (ιx. ψ x) x) ]](36.4)V2
2• ( x. [A(ϕ x ≡ ψ x) in v]) =⇒ [[ λ (χ (ιx. ϕ x)) = λ (χ (ιx. ψ x)) ]](36.4)V3
3• ( x. [A(ϕ x ≡ ψ x) in v]) =⇒ [[ λ (χ (ιx. ϕ x)) = λ (χ (ιx. ψ x)) ]](36.4)
The first axiom, α-conversion, could be omitted entirely. Since lambda-expressions aremodeled using functions with bound variables and α-conversion is part of the logic ofIsabelle/HOL, it already holds implicitly.
As explained in section 3.4.7 β -conversion has to be restricted to proper maps. In PLM
this restriction is implicit due to the fact that λ-expressions are only well-formed if theirmatrix is a propositional formula.
The formulation of the last class of axioms ((36.4), ι-conversion) has to be adjusted to be
representable in the functional setting. The original axiom is stated as follows in PLM:[[ (|λ3 (λx y z. ϕ (x P ) (y P ) (z P )),x P ,y P ,z P |) ≡ ϕ (x P ) (y P ) (z P ) ]]0

A(ϕ ≡ ψ) → ([λx 1 · · · x n χ∗ ] = [λx 1 · · · x n χ∗ 0]
χ∗ 0 is required to be the result of substituting ιxψ for zero or more occurrences of ιxϕin χ∗ . In the functional setting χ can be represented as function from individual termsof type κ to propositions of type o. Thereby substituting ιxψ for occurrences of ιxϕ canbe expressed by comparing the function application of χ to ιx. ϕ x with the function
application of χ to ιx. ψ x.

47

Since in this representation ϕ and ψ are functions as well (from type ν to type o) the
precondition has to be reformulated to hold for the application of ϕ and ψ to an arbitrary
individual x to capture the concept of A(ϕ ≡ ψ) in PLM, where ϕ and ψ may contain x
as a free variable.

3.10.11. Axioms of Encoding
The last class of axioms deals with encoding (see A.7.10):• [[ {|x,F |} → {|x,F |} ]]• [[ (|O!,x|) → ¬(∃ F . {|x,F |}) ]]• [[ ∃ x. (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F ) ]]

(37)
(38)
(39)

Whereas the first statement, encoding is modally rigid, is a direct consequence of thesemantics (recall that the encoding extension of a property was not relativized to possible worlds; see section 3.5), the second axiom, ordinary objects do not encode, is only
derivable by expanding the definition of the encoding extension and the meta-logicaldistinction between ordinary and abstract objects.
Similarly the comprehension axiom for abstract objects depends on the model structureand follows from the representation of abstract objects as sets of one-place relations andthe definition of encoding as set membership.
Furthermore in the functional setting ϕ has to be represented as a function and thecondition it imposes on F is expressed as its application to F. The formulation in PLM
on the other hand has to explicitly exclude a free occurrence of x in ϕ. In the functionalsetting this is not necessary. Since x is bound by the existential quantifier and not
explicitly given to ϕ as an argument, the condition ϕ imposes on F cannot depend on x
by construction.

3.10.12. Summary
Although some of the axioms have to be adjusted to be representable in the functional
environment, the resulting formulation faithfully represents the original axiom system
of PLM.
Furthermore a large part of the axioms can be derived independently of the technicalitiesof the representation layer with proofs that only depend on the representation of thesemantics described in section 3.5. Future work may explore available options to further
minimize the dependency on the underlying model structure.
To verify that the axiom system faithfully represents the reference system, the deductive
system PLM as described in [12, Chap. 9] is derived solely based on the formulation of
the axioms without falling back to the model structure or the semantics (see A.9).

48

3.11. The Deductive System PLM
The derivation of the deductive system PLM ([12, Chap. 9]) from the axiom systemconstitutes a major part of the Isabelle theory in the appendix (see A.9). Its extent ofover one hundred pages makes it infeasible to discuss every aspect in full detail.
Nevertheless it is worthwhile to have a look at the mechanics of the derivation and tohighlight some interesting concepts.

3.11.1. Modally Strict Proofs
PLM distinguishes between two sets of theorems: the theorems, that are derivable fromthe complete axiom system including the modally-fragile axiom, and the set of theorems,
that have modally-strict proofs (see [12, (42)]).
A proof is modally-strict, if it does not depend on any modally-fragile axioms.
In the embedding modally-strict theorems are stated to be true for an arbitrary semantic
possible world: [ϕ in v]
Here the variable v implicitly ranges over all semantic possible worlds of type i, including
the designated actual world dw. Since modally-fragile axioms only hold in dw, they
therefore cannot be used to prove a statement formulated this way, as desired.
Modally-fragile theorems on the other hand are stated to be true only for the designatedactual world: [ϕ in dw]
This way necessary axioms, as well as modally-fragile axioms can be used in their proofs.
However it is not possible to infer from a modally-fragile theorem that the same statement holds as a modally-strict theorem.
This representation of modally-strict and modally-fragile theorems is discussed in moredetail in section 5.1.3.

3.11.2. Fundamental Metarules of PLM
The primitive rule of PLM is the modus ponens rule (see A.9.2):• [ϕ in v] ∧ [ϕ → ψ in v] =⇒ [ψ in v](41)This rule is a direct consequence of the semantics of the implication.
Additionally two fundamental Metarules are derived in PLM, GEN and RN (see A.9.5):• ( α. [ϕ α in v]) =⇒ [∀ α. ϕ α in v]
V• [[ w. [ϕ in w] =⇒ [ψ in w]; [ϕ in v]]] =⇒ [ψ in v]
V

(49)
(51)

Although in PLM these rules can be derived by structural induction on the length of a
derivation, this proving mechanism cannot be reproduced in Isabelle. However, the rules

49are direct consequences of the semantics described in section 3.5. The same is true forthe deduction rule (see A.9.6):• ([ϕ in v] =⇒ [ψ in v]) =⇒ [ϕ → ψ in v](54)

Consequently this rule is derived from the semantics as well.
These rules are the only exceptions to the concept that the deductive system of PLM
is derived solely from the axiom system without relying on the previous layers of theembedding.

3.11.3. PLM Solver
Similarly to the meta-solver described in section 3.8 another proving method is introduced, namely the PLM-solver (see A.9.1).
This proving method is initially not equipped with any rules. Throughout the derivationof the deductive system, whenever an appropriate rule is derived as part of PLM directlyor becomes trivially derivable from the proven theorems, it is added to the PLM-solver.
Additionally the PLM-solver can instantiate any theorem of the deductive system PLM
as well as any axiom, if doing so resolves the current proving goal.
By its construction the PLM-solver has the property, that it can only prove statementsthat are derivable from the deductive system PLM. Thereby it is safe to use to aid in any
proof throughout the section. In practice it can automatically prove a variety of simple
statements and aid in more complex proofs throughout the derivation of the deductive
system.

3.11.4. Additional Type Classes
In PLM it is possible to derive statements involving the general identity symbol bycase distinction: if such a statement is derivable for all types of terms in the language
separately, it can be concluded that it is derivable for the identity symbol in general.
Such a case distinction cannot be directly reproduced in the embedding, since it cannot
be assumed that every instantiation of the type class identifiable is in fact one of thetypes of terms of PLM.
However, there is a simple way to still formulate such general statements. This is doneby the introduction of additional type classes. A simple example is the type class id-eq(see A.9.7). This new type class assumes the following statements to be true:• [α = α in v]• [α = β → β = α in v]• [α = β & β = γ → α = γ in v](71.1)(71.2)(71.3)

Since these statements can be derived separately for the types ν , Π0 , Π1 , Π2 and Π3 , thetype class id-eq can be instantiated for each of these types.

50

3.11.5. The Rule of Substitution
A challenge in the derivation of the deductive system that is worth to examine in detailis the rule of substitution. The rule is stated in PLM as follows (see (113)[12]):If ` ψ ≡ χ and ϕ 0 is the result of substituting the formula χ for zero or
more occurrences of ψ where the latter is a subformula of ϕ, then if Γ ` ϕ,then Γ ` ϕ 0. [Variant: If ` ψ ≡ χ, then ϕ ` ϕ 0]
A naive representation of the rule would be the following:V( v. [ψ ≡ χ in v]) =⇒ [ϕ ψ in v] = [ϕ χ in v]

However this statement is not derivable. The issue is connected to the restriction ofψ to be a subformula of ϕ in PLM. The formulation above would allow the rule to beinstantiated for any function ϕ from formulas to formulas.
Formulas in the embedding have type o which is internally represented by functions of
the type j ⇒ i ⇒ bool. Therefore the formulation above could be instantiated with afunction ϕ that has the following internal representation: λψ s w. ∀ s. ψ s w
So nothing prevents ϕ from evaluating its argument for a state different from the desigVnated actual state dj. The condition v. [ψ ≡ χ in v] on the other hand only requires ψand χ to be (necessarily) equivalent in the actual state - no statement about other states
is implied.
Another issue arises if one considers one of the example cases of legitimate uses of therule of substitution in PLM (see [12, (113)]):
If ` ∃ x A!x and ` A!x ≡ ¬♦E!x, then ` ∃ x ¬♦E!x.
This would not follow from the naive formulation above, even if it were derivable. Since
x is bound by the existential quantifier, in the functional representation ϕ has to have a
different type. In the example ϕ has to be λψ. ∃ x. ψ x which is of type (ν ⇒ o) ⇒ o. ψ andχ have to be functions as well: ψ = (λx. (|A!,x|)) and χ = (λx. ¬♦(|E!,x|)). ConsequentlyVthe equivalence condition for this case has to be reformulated to x v. [ψ x ≡ χ x in v]7 .
Solution
The embedding employs a solution that is complex, but can successfully address thedescribed issues.
The following definition is introduced (see A.9.10):
Substable cond ϕ = (∀ ψ χ v. cond ψ χ −→ [ϕ ψ ≡ ϕ χ in v])

Given a condition cond a function ϕ is considered Substable, if and only if for all ψ and χthat satisfy cond it follows in each possible world v that [ϕ ψ ≡ ϕ χ in v]8 .
78This is analog to the fact that x is a free variable in the condition ` A!x ≡ ¬♦E!x in PLM.
ψ and χ can have an arbitrary type. ϕ is a function from this type to formulas.

51

Now several introduction rules for this property are derived. The idea is to capture thenotion of subformula in PLM. A few examples are:• Substable cond (λϕ. Θ)• Substable cond ψ =⇒ Substable cond (λϕ. ¬ψ ϕ)• Substable cond ψ ∧ Substable cond χ =⇒ Substable cond (λϕ. ψ ϕ → χ ϕ)
These rules can be derived using theorems of PLM.
As illustrated above in the functional setting substitution has to be allowed not only
for formulas, but also for functions to formulas. To that end the type class Substable
is introduced that fixes a condition Substable-Cond to be used as cond in the definition
above and assumes the following:
Substable Substable-Cond ϕ ∧ Substable-Cond ψ χ ∧ Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v]

If ϕ is Substable (as per the definition above) under the condition Substable-Cond thatwas fixed in the type class, and ψ and χ satisfy the fixed condition Substable-Cond, theneverything that is true for [ϕ ψ in v] is also true for [ϕ χ in v].
As a base case this type class is instantiated for the type of formulas o with the following
definition of Substable-Cond :Substable-Cond ψ χ = (∀ v. [ψ ≡ χ in v])

Furthermore the type class is instantiated for functions from an arbitrary type to a typeof the class Substable with the following definition of Substable-Cond :Substable-Cond ψ χ = (∀ x. Substable-Cond (ψ x) (χ x))

Proving Methods
Although the construction above covers exactly the cases in which PLM allows substitutions, it does not yet have a form that allows to conveniently apply the rule ofsubstitution. In order to apply the rule, it first has to be established that a formula canbe decomposed into a function with the substituents as arguments and it further has tobe shown that this function satisfies the appropriate Substable condition. This complexity prevents any reasonable use cases. This problem is mitigated by the introduction ofproving methods. The main method is called PLM-subst-method.
This method uses a combination of pattern matching and automatic rule application toprovide a convenient way to apply the rule of substitution in practice.
For example assume the current proof objective is [¬¬♦(|E!,x|) in v]. Now it is possible
to apply PLM-subst-method as follows:
apply (PLM-subst-method (|A!,x|) (¬(♦(|E!,x|)))52

The method automatically analyzes the current proving goal, uses pattern matching tofind an appropriate choice for a function ϕ, applies the substitution rule and resolves thesubstitutability claim about ϕ.
Consequently it can resolve the current proof objective by producing two new proving
goals: ∀ v. [(|A!,x|) ≡ ¬♦(|E!,x|) in v] and [¬(|A!,x|) in v], as expected. The complexity of
the construction above is hidden away entirely.
Similarly assume the proof objective is [∃ x. ¬♦(|E!,x P |) in v]. Now the method PLM-subst-method
can be invoked as follows:
apply (PLM-subst-method λx . (|A!,x P |) λx . (¬(♦(|E!,x P |)))

This will result in the new proving goals: ∀ x v. [(|A!,x P |) ≡ ¬♦(|E!,x P |) in v] and [∃ x. (|A!,x P |) in v],
as desired.
Conclusion
Although an adequate representation of the rule of substitution in the functional setting
is challenging, the above construction allows a convenient use of the rule. Moreover it
is important to note that despite the complexity of the representation no assumptions
about the underlying model structure were made. The construction is completely derivable from the rules of PLM itself, so the devised rule is safe to use without compromising
the provability claim of the layered structure of the embedding.
All statements that are proven using the constructed substitution methods, remain derivable from the deductive system of PLM.

3.11.6. An Example Proof
To illustrate how the derivation of theorems in the embedding works in practice, consider
the following example9 :lemma [(ϕ → ϕ) → ((¬ϕ) ≡ ((¬ϕ))) in v]
proof (rule CP)
assume [(ϕ → ϕ) in v]
hence [(¬(¬ϕ)) ≡ ϕ in v]
by (metis sc-eq-box-box-1 diamond-def vdash-properties-10 )thus [((¬ϕ) ≡ ((¬ϕ))) in v]
by (meson CP ≡I ≡E ¬¬I ¬¬E)
qed

Since the statement is an implication it is derived using a conditional proof. To that end
the proof statement already applies the initial rule CP.
The proof objective inside the proof body is now [(ϕ → ϕ) in v] =⇒ [¬ϕ ≡ ¬ϕ in v],
so [¬ϕ ≡ ¬ϕ in v] has to be shown under the assumption [(ϕ → ϕ) in v]. Therefore
the first step is to assume [(ϕ → ϕ) in v].
9Since the whole proof is stated as raw Isabelle code, unfortunately no color-coding can be applied.

53

The second statement can now be automatically derived using the previously proventheorem sc-eq-box-box-1, the definition of the diamond operator and a deduction rule.
The final proof objective follows from a combination of introduction and elimination
rules.
The automated reasoning tool sledgehammer can find proofs for the second and final
statement automatically. It can even automatically find a proof for the entire theorem
resulting in the following one-line proof:lemma [(ϕ → ϕ) → ((¬ϕ) ≡ ((¬ϕ))) in v]
by (metis ≡I CP ≡E(1 ) ≡E(2 ) raa-cor-1 sc-eq-box-box-1 diamond-def )So it can be seen that the embedding can be used to interactively prove statements withthe support of automated reasoning tools and often even complete proofs for complex
statements can be found automatically.

3.11.7. Summary
A full representation of the deductive system PLM, as described in [12, Chap. 9], could
be derived without violating the layered structure of the embedding.
Although compromises affecting the degree of automation had to be made, the resulting
representation can conveniently be used for the interactive construction of complex proofs
while retaining the support of the automation facilities of Isabelle/HOL.

3.12. Artificial Theorems
The layered approach of the embedding provides the means to derive theorems independently of the representation layer and model structure. It is still interesting to consider
some examples of theorems that are not part of PLM, but can be derived in the embedding using its meta-logical properties.

3.12.1. Non-Standard λ-Expressions
The following statement involves a λ-expressions that contains encoding subformulas
and is consequently not part of PLM (see A.11):[(|λx. {|F P ,y|},x P |) ≡ {|F P ,y|} in v]

In this case traditional β -conversion still holds, since the λ-expression does not containencoding expressions involving its bound variable10 . On the other hand the following is
not a theorem in the embedding (the tool nitpick can find a counter-model):[(|λx. {|x P ,F |},x P |) → {|x P ,F |} in v]
1054Consequently the matrix is a proper map.

Instead the following generalized versions of β -conversion are theorems:• [(|λx. {|x P ,F |},z P |) in v] = (∃ y. νυ y = νυ z ∧ [{|y P ,F |} in v])• [(|λx. ϕ (x P ),z P |) in v] = (∃ y. νυ y = νυ z ∧ [ϕ (y P ) in v])
These theorems can be equivalently stated purely in the embedded logic:• [(|λx. {|x P ,F |},z P |) ≡ (∃ y. (∀ F . (|F ,z P |) ≡ (|F ,y P |)) & {|y P ,F |}) in v]• [(|λx. ϕ (x P ),z P |) ≡ (∃ y. (∀ F . (|F ,z P |) ≡ (|F ,y P |)) & ϕ (y P )) in v]
The second statement shows that in general λ-expressions in the embedding have a nonstandard semantics. As a special case, however, the behavior of λ-expressions is classicalif restricted to proper maps, which is due to the following theorem11 :IsProperInX ϕ =⇒ [(∃ y. (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P )) ≡ ϕ (x P ) in v]

As a consequence of the generalized β -conversion there are theorems in the embedding
involving λ-expressions that do contain encoding subformulas in the bound variable, e.g.:[(|λx. {|x P ,F |} ≡ {|x P ,F |},y P |) in v]

This topic is discussed in more detail in section 5.1.1.

3.12.2. Consequences of the Aczel-model
Independently the following theorem is a consequence of the constructed Aczel-model:[∀ F . (|F ,a P |) ≡ (|F ,bP |) in v] =⇒ λx. (|R,x P ,a P |) = λx. (|R,x P ,bP |)The reason for this theorem to hold is that the condition on a and b forces the embedding
to map both objects to the same urelement. By the definition of exemplification thepresented λ-expressions only depend on this urelement, therefore they are forced tobe equal. Neither the deductive system of PLM nor its formal semantics require thisequality.
Initial research suggests that this artificial theorem can be avoided by extending theembedding in the following way: the mapping from abstract objects to special urelements
constructed in section 3.4.3 can be modified to depend on states. This way the condition
used in the theorem only implies that a and b are mapped to the same urelement in theactual state. Since they can still be mapped to different urelements in different states,
the derived equality no longer follows.
This extension of the embedding increases the complexity of the representation layerslightly, but its preliminary analysis suggests that it presents no further issues, so futureversions of the embedding will in all likelihood include such a modification.
11

Note that for propositional formulas an equivalent statement is derivable in PLM as well.

55

3.13. Sanity Tests
The consistency of the constructed embedding can be verified by the model-finding tool
nitpick (see A.12.1). Since the main construction of the embedding is definitional andonly a minimal set of meta-logical axioms is used, this is expected.
The hyperintensionality of the constructed model can be verified for some simple example
cases. The following statements have counter-models (see A.12.2):• [(λy. q ∨ ¬q) = (λy. p ∨ ¬p) in v]• [(λy. p ∨ q) = (λy. q ∨ p) in v]
Furthermore the meta-logical axioms stated in section 3.4.9 can be justified (see A.12.4):• (∀ x. ∃ v. ConcreteInWorld x v) =(∀ y. [(|λu. ¬¬(|E!,u P |),y P |) in v] = (case y of ων z ⇒ True | αν z ⇒ False))• (∀ x. ∃ v. ConcreteInWorld x v) =(∀ y. [(|λu. ¬(|E!,u P |),y P |) in v] = (case y of ων z ⇒ False | αν z ⇒ True))• (∃ x v. ConcreteInWorld x v ∧ (∃ w. ¬ ConcreteInWorld x w)) =[¬(∀ x. (|E!,x P |) → (|E!,x P |)) in v]• (∃ w. ∀ x. ConcreteInWorld x w −→ (∀ v. ConcreteInWorld x v)) =[¬¬(∀ x. (|E!,x P |) → (|E!,x P |)) in v]

The first axiom is equivalent to the fact that concreteness matches the domains of ordinary, resp. abstract objects, whereas the second and third axiom correspond to the
conjuncts of axiom (32.4)[12].
Remark. Additionally some further desirable meta-logical properties of the embedding
are verified in A.12.5 and A.12.6.

56

4. Technical Limitations of Isabelle/HOL
Although the presented embedding shows that the generic proof assistant Isabelle/HOL
offers a lot of flexibility in expressing even a very complex and challenging theory as the
Theory of Abstract Objects, it has some limitations that required compromises in theformulation of the theory.
In this chapter some of these limitations and their consequences for the embedding are
discussed. Future versions of Isabelle may allow a clearer implementation especially of
the layered approach of the embedding.

4.1. Limitations of Type Classes and Locales
Isabelle provides a powerful tool for abstract reasoning called locale. Locales are used
for parametric reasoning. Type classes, as already described briefly in section 3.6 andfurther mentioned in sections 3.9 and 3.11.4, are in fact special cases of locales that are
additionally connected to Isabelle’s internal type system.
The definition of a locale defines a set of constants that can use arbitrary type variables1 .
Assumptions about these constants can be postulated that can be used in the reasoning
within the context of the locale. Similarly to the instantiation of a type class, a locale
can be interpreted for specific definitions of the introduced constants, if it can be proventhat the postulated assumptions are satisfied for the interpretation.
Thereby it is possible to reason about abstract structures that are solely characterized
by a specific set of assumptions. Given that it can be shown that these assumptions are
satisfied for a concrete case, an interpretation of the locale allows the use of all theorems
shown for the abstract case in the concrete application.
Therefore in principle locales would be a perfect fit for the layered structure of theembedding: If the representation of the formal semantics and the axiom system could
both be formulated as locales, it could first be shown that the axiom system is a sublocaleof the formal semantics, i.e. every set of constants that satisfies the requirements of theformal semantics also satisfies the requirements of the axiom system, and further theformal semantics could be interpreted for a concrete model structure.
Since the reasoning within a locale cannot use further assumptions that are only satisfied
by a specific interpretation, this way the universality of the reasoning based on the axiom
system could be formally guaranteed - no proof that is solely based on the axiom locale
1

Type classes on the other hand are restricted to only one type variable.

57could use any meta-logical statement tied to the underlying representation layer andmodel structure2 .
However, a major issue arises when trying to formulate the axiom system as a locale.
Constants in a locale have to be introduced with a fixed type. Although this type canuse type variables, e.g. 0a ⇒ 0a ⇒ 0o, the type variable 0a is fixed throughout the locale.
This makes it impossible to introduce a general binder for all-quantification or a general
identity symbol in a single axiom locale that could be used for the statement of theaxioms of quantification and the substitution of identicals.
Several solutions to this problem could be considered: the identity relation could be
introduced as a polymorphic constant outside the locale and the locale could assume
some properties for this constant for specific type variables. Before interpreting the
locale the polymorphic constant could then be overloaded for concrete types in order
to be able to satisfy the assumptions. However, it would still be impossible to provea general statement about identity: every statement would have to be restricted to a
specific type, because in general no assumptions about the properties of identity could
be made.
Another solution would be to refrain from using general quantifiers and identity relations altogether, but to introduce separate binders and identity symbols for the typeof individuals and each relation type. However, this would add a significant amountof notational complexity and would require to duplicate all statements that hold forquantification and identity in general for every specific type. Statements ranging overmultiple types would even have to be stated for every possible combination of types
separately.
It could also be considered to introduce the axioms of quantification and identity separately from the axiom locale in a type class. An interpretation of the complete axiom
system would then have to interpret the axiom locale, as well as instantiate the respective type classes. Since type classes can only use one type variable, this would makeit impossible to use a type variable for truth values in the definition of the respective
type classes, though. Consequently it is unclear how appropriate assumptions for such
type classes could be formulated. Using separate locales instead of type classes would
be connected with different issues.
Several other concepts were considered during the construction of the embedding, but
no solution was found that would both accurately represent the axiom system and still
be notationally convenient.
The most natural extension of Isabelle’s locale system that would solve the describedissues, would be the ability to introduce polymorphic constants in a locale that canbe restricted to a type class (resp. a sort). The type class could potentially even be
introduced simultaneously with the locale. However, such a construction is currently
not possible in Isabelle and as of yet it is unknown whether the internal type system ofIsabelle would allow such an extension in general.
2

Although the construction of chapter 3 provides the means for universal reasoning that is independent of a model as well, it depends on fair use of the provided layer structure.

58

4.2. Case Distinctions by Type
Although a general identity relation can be represented using type classes as described in
sections 3.6 and 3.9, this construction differs from the concept used in PLM. The identity
relation of PLM is not determined by some set of properties, but by its definition forthe specific concrete types.
Isabelle does not allow the restriction of a type variable in a statement to a specific setof types. Type variables can only be restricted to specific sorts, so effectively to typeclasses. As mentioned in section 3.11.4, this means that statements about the general
identity relation, that depend on the specific definitions for the concrete types, cannot
be proven as in PLM by case distinction on types. Instead additional type classes haveto be introduced that assume the statements and then have to be instantiated for theconcrete types.
Although this construction involves some technical overhead, the solution is elegant andprovides a flexible representation for such general statements.

4.3. Structural Induction and Proof-Theoretic Reasoning
As mentioned in section 3.11.2, some of the meta-rules that PLM can derive by induction
on the length of a derivation, have to be proven using the semantics instead in theembedding, e.g. the deduction theorem ([ϕ in v] =⇒ [ψ in v]) =⇒ [ϕ → ψ in v].
While the derivation of these fundamental rules using the semantics is justified, it would
be interesting to investigate whether the proof-theoretic reasoning PLM uses in thesecases can be reproduced in Isabelle/HOL. A related topic is the representation of theconcept of modally-strict proofs as described in sections 3.11.1 and 5.1.3.

59

5. Discussion and Results
5.1. Differences between the Embedding and PLM
Although the embedding attempts to represent the language and logic of PLM as precisely as possible, there remain some differences between PLM and its representation in
Isabelle/HOL. Some of the known differences are discussed in the following sections. A
complete analysis of the precise relation between PLM and the embedding unfortunately
goes beyond the scope of this thesis and will only be possible after PLM has recoveredfrom the discovered paradox (see 5.2). Such an analysis will be a highly interesting andrelevant topic for future research.

5.1.1. Propositional Formulas and λ-Expressions
The main difference between the embedding and PLM is the fact that the embedding
does not distinguish between propositional and non-propositional formulas.
This purely syntactic distinction is challenging to reproduce in a shallow embeddingthat does not introduce the complete term structure of the embedded language directly.
Instead the embedding attempts to analyze the semantic reason for the syntactic distinction and to devise a semantic criterion that can be used as a replacement for thesyntactic restriction.
The identified issue, that is addressed by the distinction in PLM, is described in section 3.2: Allowing non-propositional formulas in β -convertible λ-expressions without restriction leads to paradoxes.
Since the embedding is known to be consistent, the issue presents itself in a slightly
different fashion: the paradox is constructed under the assumption that β -conversion
holds unconditionally for all λ-expressions. In the embedding on the other hand ingeneral λ-expressions have a non-standard semantics and β -conversion only follows as a
special case (see 3.12.1). Thereby the consistency of the system is preserved.
With the definition of proper maps (see 3.4.7), the embedding constructs a necessary
and sufficient condition on functions that may serve as matrix of a λ-expression whileallowing β -conversion.
The idea is that every λ-expression that is syntactically well-formed in PLM should havea proper map as its matrix. Two subtleties have to be considered, though:It was discovered that there are λ-expressions which are part of PLM, whose matrix
does not correspond to a proper map in the embedding. The analysis of this issue led
to the discovery of a paradox in the formulation of PLM and is discussed in more detail60

in section 5.2. As a consequence these cases will not constitute proper λ-expressions infuture versions of PLM.
The remaining subtlety is the fact that there are proper maps, that do not correspond to
propositional formulas. Some examples have already been mentioned in section 3.12.1.
Therefore the embedding suggests that the theory of PLM can be consistently extended
to include a larger set of proper, β -convertible λ-expressions. Since the set of relationsof PLM already has to be adjusted to prevent the discovered paradox, such an extension
presents a viable option.
Once PLM has recovered from the paradox, future research can consider available options
to align the set of relations present in the embedding with the resulting set of relationsof the new version of PLM.

5.1.2. Terms and Variables
In PLM an individual term can be an individual variable, an individual constant or adefinite description. A large number of statements is formulated using specific objectlanguage variables instead of metavariables ranging over arbitrary terms. From such astatement its universal generalization can be derived using the rule GEN, which thencan be instantiated for any individual term, given that it denotes (∃ β β = τ ).
As already mentioned in sections 3.4.2 and 3.10.5 the embedding uses a slightly different
approach: In the embedding individuals and individual terms have different types.
The technicalities of this approach and a discussion about the accuracy of this representation were already given in the referenced sections, so at this point it suffices tosummarize the resulting differences between the embedding and PLM:
• The individual variables of PLM are represented as variables of type ν in theembedding.
• Individual constants can be represented by declaring constants of type ν .
• Meta-level variables (like τ ) ranging over all individual terms in PLM can be represented as variables of type κ.
• Objects of type ν have to be explicitly converted to objects of type κ using thedecoration _P , if they are to be used in a context that allows general individual
terms.
• The axioms of quantification are adjusted to go along with this representation(see 3.10.5).
In PLM the situation for relation variables, constants and terms is analog. However, theembedding uses the following simplification in order to avoid the additional complexity
introduced for individuals:
Since at the time of writing PLM unconditionally asserts ∃ β β = τ for any relation termby an axiom, the embedding uses only one type Πn for each arity of relations. Therefore
no special type conversion between variables and terms is necessary and every relation
term can immediately be instantiated for a variable of type Πn . This hides the additional61

steps PLM employs for such instantiations (the generalization by GEN followed by an
instantiation using quantification theory). Since ∃ β β = τ holds unconditionally for
relation terms, this simplification is justified.
However, the recent developments described in section 5.2 suggest that ∃ β β = τ will in
all likelihood no longer hold unconditionally for every relation term in future versionsof PLM. Therefore, future versions of the embedding will have to include a distinction
between relation terms and relation variables in a similar way as is already done forindividuals. An alternative approach that could result in a more elegant representation
would be to implement concepts of free logic based on the research in [4] for bothindividuals and relations.

5.1.3. Modally-strict Proofs and the Converse of RN
As described in section 3.11.1 modally-strict theorems in the embedding are stated in
the form [ϕ in v], so they are stated to be semantically true for an arbitrary possible
world v.
Modally-strict theorems in PLM are defined using a proof-theoretic concept: modallystrict proofs are not allowed to use modally-fragile axioms. They are solely derived fromaxioms whose necessitations are axioms as well (see 3.10.1).
The metarule RN states in essence that if there is a modally-strict proof for ϕ, thenϕ is derivable as a theorem. PLM proves this fact by induction on the length of thederivation. Remark (185)[12] gives an example of a case in which the converse is false:
if ϕ is derivable as a theorem, this does not imply that there is a modally-strict proof
for ϕ.
However, in the embedding the following is derivable from the semantics of the box
operator:[ϕ in dw] =⇒ ∀ v. [ϕ in v]

So although the converse of RN is not true in PLM, an equivalent statement for theoremsof the form [ϕ in v] in the embedding can be derived from the semantics.
The modally-strict theorems of PLM are a subset of a larger class of theorems, namely
the theorems that are necessarily true. Semantically a statement of the form [ϕ in v] inthe embedding is derivable, whenever ϕ is a necessary theorem.
Unfortunately there is no semantic criterion that allows to decide whether a statement
is a necessary theorem or a modally-strict theorem. Therefore, the embedding has toexpress modally-strict theorems as necessary theorems, for which the converse of RN isin fact true.
This still does not compromise the claim that any statement that is derived in A.9 isalso derivable in PLM: the basis for this claim is that no proofs in this layer may relyon the meta-logical properties of the embedding, but only the fundamental meta-rulesof PLM are allowed to derive theorems from the axioms. Since the converse of RN is

62

neither a fundamental meta-rule of PLM, nor derivable without using the semantics, it
is not stated as an admissible rule for these proofs. Thereby it is guaranteed that nostatement of the form [ϕ in v] is derived that is not a modally-strict theorem of PLM.
Unfortunately this has the consequence that the proving method PLM-solver cannot
be equipped with a reversible elimination rule for the box operator, which reduces its
power as a proving method. However, preserving the claim that theorems derived in theembedding are also theorems of PLM even when restricting to modally-strict theorems
was given preference over an increased level of automation.

5.2. A Paradox in PLM
During the analysis of the constructed embedding it was discovered that the formulationof the theory in PLM at the time of writing allowed paradoxical constructions.
This section first describes the process that led to the discovery of the paradox and therole the embedding played in it, after which the construction of the paradox is outlinedin the language of PLM.
The paradox has since been confirmed by Edward Zalta and a vivid discussion about its
repercussions and possible solutions has developed. At the time of writing it has become
clear that there are several options to recover from the paradox while in essence retaining
the full set of theorems of PLM. So far no final decision has been reached about which
option will be implemented in future versions of PLM.

5.2.1. Discovery of the Paradox
The discovery of the paradox originates in the analysis of the concept of proper maps
in the embedding and its relation to propositional formulas in PLM, which are the only
formulas PLM allows as the matrix of λ-expressions (see 5.1.1).
While trying to verify the conjecture, that the matrix of every λ-expression allowedin PLM corresponds to a proper map in the embedding, it was discovered, that λexpressions of the form [λy F ιx(y[λz Rxz])] in which the bound variable y occurs in an
encoding formula inside the matrix of a definite description, were part of PLM, but
their matrix was not a proper map in the embedding and therefore β -conversion was notderivable for these terms.
Further analysis showed that a modification of the embedding which would allow β conversion for such expressions, would have to involve a restriction of the Aczel-model(in particular of the map from abstract objects to urelements).
In order to understand how the Aczel-model could be adequately restricted, the consequences of allowing β -conversion in the mentioned cases by assumption were studied in
the embedding. This led to the first proof of inconsistency (see A.13.4):
V( G ϕ. IsProperInX (λx. (|G,ιy. ϕ y x|))) =⇒ False

63Under the assumption that λx. (|G,ιy. ϕ y x|) is a proper map for arbitrary G and ϕ, False
is derivable in the embedding. However λ-expressions with the equivalent of such maps
as matrix were in fact part of PLM.
Since the inconsistency can be derived without relying on the meta-logical properties ofthe embedding, it was immediately possible to translate the proof back to the languageof PLM. The resulting formulation then served as the basis for further discussions with
Edward Zalta.
Since then the issue leading to the paradox was identified as the description backdoor(see A.13.2) that can be used to construct a variety of paradoxical cases, e.g. the paradox
described in section 3.2 can be reconstructed. This refined version of the paradox is usedin the inconsistency proof in A.13.3 and is outlined in the language of PLM in the next
section. The general situation leading to the paradox is repeated without referring to
the particularities of the embedding.

5.2.2. Construction using the Language of PLM
Object theory distinguishes between propositional and non-propositional formulas. Propositional formulas are not allowed to contain encoding subformulas, so for example ∃ F xF
is not propositional. Only propositional formulas can be the matrix of a λ-expression,so [λx ∃ F xF ] is not a valid term of the theory - it is excluded syntactically.
The reason for this is that considering [λx ∃ F xF & ¬Fx] a valid, denoting λ-expression
for which β -conversion holds would result in a paradox as described in section 3.2.
Excluding non-propositional formulas in λ-expressions was believed to be sufficient toprevent such inconsistencies. This was shown to be incorrect, though.
The problem is the description backdoor. The term [λy F ιxψ] is well-formed, even if ψ
is not propositional. This is due to the definition of subformula: ψ is not a subformulaof F ιxψ , so ψ may contain encoding subformulas itself and F ιxψ is still a propositional
formula.
This was deemed to be no problem and for cases like [λy F ιx(xG)] as they are mentioned
and used in PLM this is indeed true.
It had not been considered that y may appear within the matrix of such a description
and more so, it may appear in an encoding expression, for example [λy F ιx(xG & yG)] isstill a propositional formula.
Therefore, the following construction is possible:[λy [λz ∀ p(p→p)]ιx(x = y & ψ)](1)

Here ψ can be an arbitrary non-propositional formula in which x and y may be free and(1) is still a valid, denoting λ-expression for which β -conversion holds.
By β -conversion and description theory the following is derivable:[λy [λz ∀ p(p→p)]ιx(x = y & ψ)]x ≡ ψ x y

64

(2)

Remark. Using a modally-strict proof only the following is derivable:[λy [λz ∀ p(p→p)]ιx(x = y & ψ)]x ≡ Aψ x y

For the construction of the paradox, the modally-fragile statement is sufficient. However,
it is possible to construct similar paradoxical cases without appealing to any modallyfragile axioms or theorems as well.
This effectively undermines the intention of restricting λ-expressions to only propositional formulas:
Although [λx ∃ F xF & ¬Fx] is not part of the language, it is possible to formulate thefollowing instead:[λy [λz ∀ p(p→p)]ιx(x = y & (∃ F yF & ¬Fy))](3)

If one considers (2) now, one can see that this λ-expressions behaves exactly the way that
[λx ∃ F xF & ¬Fx] would, if it were part of the language, i.e. the result of β -reduction
for [λx ∃ F xF & ¬Fx] would be the same as the right hand side of (2) when applied to(3). Therefore, the λ-expression in (3) can be used to reproduce the paradox describedin section 3.2.

5.2.3. Possible Solutions
Fortunately no theorems were derived in PLM, that actually use problematic λ-expressions
as described above. Therefore, it is possible to recover from the paradox without losing any theorems. At the time of writing, it seems likely that a concept of proper λexpressions will be introduced to the theory and only proper λ-expressions will be forced
to have denotations and allow β -conversion. Problematic λ-expressions that would leadto paradoxes, will not be considered proper. Several options are available to define the
propriety of λ-expressions and to adjust PLM in detail.
As a consequence the purely syntactical distinction between propositional and nonpropositional formulas is no longer sufficient to guarantee that every relation term hasa denotation. The embedding of the theory shows that an adequate definition of proper
λ-expressions can consistently replace this distinction entirely yielding a broader set of
relations. The philosophical implications of such a radical modification of the theory
have not yet been analyzed entirely though, and at the time of writing it is an open
question whether such a modification may be implemented in future versions of PLM.

5.3. A Meta-Conjecture about Possible Worlds
A conversation between Bruno Woltzenlogel Paleo and Edward Zalta about the Theoryof Abstract Objects led to the following meta-conjecture:65

“ For every syntactic possible world w, there exists a semantic point p which is thedenotation of w. ”1
Since the embedding constructs a representation of the semantics of PLM, it was possible
to formally analyze the relationship between syntactic and semantic possible worlds andarrive at the following theorems (see A.10):• ∀ x. [PossibleWorld (x P ) in w] −→ (∃ v. ∀ p. [x P |= p in w] = [p in v])• ∀ v. ∃ x. [PossibleWorld (x P ) in w] ∧ (∀ p. [p in v] = [x P |= p in w])
The first statement shows that for every syntactic possible world x there is a semantic
possible world v, such that a proposition is syntactically true in x, if and only if it issemantically true in v.
The second statement shows that for every semantic possible world v there is a syntactic
possible world x, such that a proposition is semantically true in v, if and only if it issyntactically true in x.
This result extends the following theorems already derived syntactically in PLM (w isrestricted to only range over syntactic possible worlds):• ♦p ≡ ∃ w(w |= p)(433.1)• p ≡ ∀ w(w |= p)(433.2)
Whereas the syntactic statements of PLM already show the relation between the modal
operators and syntactic possible worlds, the semantic statements derived in the embedding show that there is in fact a natural bijection between syntactic and semantic
possible worlds.
This example shows that a semantical embedding allows a detailed analysis of the semantical properties of a theory and to arrive at interesting meta-logical results.

5.4. Functional Object Theory
The first and foremost goal of the presented work was to show that the second-orderfragment of the Theory of Abstract Objects as described in PLM can be represented infunctional higher-order logic using a shallow semantical embedding.
As a result a theory was constructed in Isabelle/HOL that - although its faithfulness is
yet to be formally verified - is most likely able to represent and verify all reasoning in thetarget theory. A formal analysis of the faithfulness of the embedding is unfortunately
not possible at this time, since the theory of PLM first has to be adjusted to preventthe discovered paradox. Depending on the precise modifications of PLM the embedding
will have to be adjusted accordingly, after which the question can be revisited.
The embedding goes to great lengths to construct a restricted environment, in which it
is possible to derive new theorems that can easily be translated back to the reference
system of PLM. The fact that the construction of the paradox described in section 5.2
1This formulation originates in the resulting e-mail correspondence between Bruno Woltzenlogel
Paleo and Christoph Benzmüller.

66

could be reproduced in the target logic, strongly indicates the merits and success of thisapproach.
Independently of the relation between the embedding and the target system, a byproductof the embedding is a working functional variant of object theory that deserves to bestudied in its own right. To that end future research may want to drop the layered
structure of the embedding and dismiss all constructions that solely serve to restrict
reasoning in the embedding in order to more closely reproduce the language of PLM.
Automated reasoning in the resulting theory will be significantly more powerful and theinteresting properties of the original theory, that result from the introduction of abstract
objects and encoding, can still be preserved.

5.5. Relations vs. Functions
As mentioned in the introduction, Oppenheimer and Zalta argue that relational typetheory is more fundamental than functional type theory (see [8]). One of their mainarguments is that the Theory of Abstract Objects is not representable in functional typetheory. The success of the presented embedding, however, suggests that the topic has
to be examined more closely.
Their result is supported by the presented work in the following sense: it is impossible
to represent the Theory of Abstract Objects by representing its λ-expressions directly as
primitive λ-expressions in functional logic. Furthermore, exemplification cannot be represented classically as function application, while at the same time introducing encoding
as a second mode of predication.
This already establishes that the traditional approach of translating relational type theory to functional type theory in fact fails for the Theory of Abstract Objects. A simple
version of functional type theory, that only involves two primitive types (for individuals
and propositions), is insufficient for a representation of the theory.
The embedding does not share several of the properties of the representative functional
type theory constructed in [8, pp. 9-12]:• Relations are not represented as functions from individuals to propositions.
• Exemplification is not represented as simple function application.
• The λ-expressions of object theory are not represented as primitive λ-expressions.
To illustrate the general schema that the embedding uses instead assume that there isa primitive type for each arity of relations Rn . Let further ι be the type of individuals
and o be the type of propositions. The general construct is now the following:• Exemplification (of an n -place relation) is a function of type Rn ⇒ι⇒. . . ⇒ι⇒o.
• Encoding is a function of type ι⇒R1 ⇒o.
• To represent λ-expressions functions Λn of type (ι⇒. . . ⇒ι⇒o)⇒Rn are introduced.
The λ-expression [λx 1 . . . x n ϕ] of object theory is represented as Λn [λx 1 . . . x n ϕ].

67

The Theory of Abstract Objects restricts the matrix of λ-expressions to propositional
formulas, so not all functions of type ι⇒. . . ⇒ι⇒o are supposed to denote relations.
However, since in classical functional type theory functions are total, Λn has to map
all these functions to some object of type Rn . To solve this problem concepts usedin the embedding of free logic can help2 . The function Λn can map functions of typeι⇒. . . ⇒ι⇒o that do not correspond to propositional formulas to objects of type Rn that
represent invalid (resp. non-existing) relations. For invalid relations the functions used
to represent encoding and exemplification can be defined to map to an object of type othat represents invalid propositions.
Oppenheimer and Zalta argue that using a free logic and letting non-propositional
formulas fail to denote is not an option, since it prevents classical reasoning for nonpropositional formulas3 . Although this is true for the case of a simple functional typetheory, it does not apply to the constructed theory: since only objects of type Rn may
fail to denote, non-propositional reasoning is unaffected.
Remark. Although the constructed functional type theory is based on the general structure of the presented embedding, instead of introducing concepts of free logic, λ-expressions
involving non-propositional formulas are assigned non-standard denotations, i.e. they
do denote, but β -conversion only holds under certain conditions (see 5.1.1). Although
this concept has merits as well, future versions of the embedding may instead utilize
the concepts described in [4] to replace this construction by a free logic implementationthat will more closely reflect the concepts of propositional formulas and λ-expressions in
object theory.
The constructed theory can represent the relations and λ-expressions of object theory,
as well as exemplification and encoding. Furthermore, the embedding shows that it hasa model and that an adequate intensional interpretation of propositions can be used topreserve the desired hyperintensionality of relations in λ-expressions.
In summary it can be concluded that a representation of object theory in functional typetheory is feasible, although it is connected with a fair amount of complexity (i.e. theintroduction of additional primitive types and the usage of concepts of intensional andfree logic). On the other hand, whether this result contradicts the philosophical claimthat relations are more fundamental than functions, is still debatable considering the factthat the proposed construction has to introduce new primitive types for relations4 andthe construction is complex in general. Further it has to be noted that so far only thesecond-order fragment of object theory has been considered and the full type-theoretic
version of the theory may present further challenges.
2

See the embedding of free logic constructed in [4].
See [8, pp. 30-31].
4Note, however, that the embedding can represent relations as functions acting on urelements following the Aczel-model.
3685.6. Conclusion
The presented work shows that shallow semantical embeddings in HOL have the potential
to represent even highly complex theories that originate in a fundamentally different
tradition of logical reasoning (e.g. relational instead of functional type theory). The
presented embedding represents the most ambitious project in this area so far and its
success clearly shows the merits of the approach.
Not only could the embedding uncover a previously unknown paradox in the formulationof its target theory, but it could contribute to the understanding of the relation between
functional and relational type theory and provide further insights into the general structure of the target theory, its semantics and possible models. It can even show that a
consistent extension of the theory is possible that can increase its expressibility.
For the field of mathematics an analysis of chapters 14 and 15 of PLM, that construct
natural numbers and theoretical mathematical objects and relations in object theory,is of particular interest. The embedding can be a significant aid in the study of thesechapters, since the properties of the derived objects and relations can immediately beanalyzed and verified using the extensive library for abstract mathematical reasoning
already present in Isabelle/HOL as a reference.
The presented work introduces novel concepts that can benefit future endeavors of semantical embeddings in general: a layered structure allows the representation of a target
theory without extensive prior results about its model structure and provides the means
to comprehensively study potential models. Custom proving methods can benefit automated reasoning in an embedded logic and provide the means to reproduce even complex
deductive rules of a target system in a user-friendly manner.
The fact that the embedding can construct a verified environment which allows to conveniently prove and verify theorems in the complex target system while retaining the
support of automated reasoning tools, shows the great potential of semantical embeddings in providing the means for a productive interaction between humans and computer
systems.

69

A. Isabelle Theory
A.1. Representation Layer
A.1.1. Primitives
typedecl i — possible worlds
typedecl j — states
consts dw :: i — actual world
consts dj :: j — actual state
typedecl ω — ordinary objects
typedecl σ — special urelements
datatype υ = ωυ ω | συ σ — urelements

A.1.2. Derived Types
typedef o = UNIV ::(j⇒i⇒bool) set
morphisms evalo makeo .. — truth values
type-synonym Π0 = o — zero place relations
typedef Π1 = UNIV ::(υ⇒j⇒i⇒bool) set
morphisms evalΠ1 makeΠ1 .. — one place relations
typedef Π2 = UNIV ::(υ⇒υ⇒j⇒i⇒bool) set
morphisms evalΠ2 makeΠ2 .. — two place relations
typedef Π3 = UNIV ::(υ⇒υ⇒υ⇒j⇒i⇒bool) set
morphisms evalΠ3 makeΠ3 .. — three place relations
type-synonym α = Π1 set — abstract objects
datatype ν = ων ω | αν α — individuals
typedef κ = UNIV ::(ν option) set
morphisms evalκ makeκ .. — individual terms
setup-lifting type-definition-osetup-lifting type-definition-κ
setup-lifting type-definition-Π1
setup-lifting type-definition-Π2
setup-lifting type-definition-Π3

A.1.3. Individual Terms and Definite Descriptions
lift-definition νκ :: ν⇒κ (-P [90 ] 90 ) is Some .
lift-definition proper :: κ⇒bool is (6=) None .
lift-definition rep :: κ⇒ν is the .
lift-definition that::(ν⇒o)⇒κ (binder ι [8 ] 9 ) is
λ ϕ . if (∃ ! x . (ϕ x) dj dw)
then Some (THE x . (ϕ x) dj dw)

70else None .

A.1.4. Mapping from Individuals to Urelements
consts ασ :: α⇒σaxiomatization where ασ-surj: surj ασdefinition νυ :: ν⇒υ where νυ ≡ case-ν ωυ (συ ◦ ασ)

A.1.5. Exemplification of n-place-Relations.
lift-definition exe0 ::Π0 ⇒o ((|-|)) is id .
lift-definition exe1 ::Π1 ⇒κ⇒o ((|-,-|)) isλ F x s w . (proper x) ∧ F (νυ (rep x)) s w .
lift-definition exe2 ::Π2 ⇒κ⇒κ⇒o ((|-,-,-|)) isλ F x y s w . (proper x) ∧ (proper y) ∧F (νυ (rep x)) (νυ (rep y)) s w .
lift-definition exe3 ::Π3 ⇒κ⇒κ⇒κ⇒o ((|-,-,-,-|)) isλ F x y z s w . (proper x) ∧ (proper y) ∧ (proper z) ∧F (νυ (rep x)) (νυ (rep y)) (νυ (rep z)) s w .

A.1.6. Encoding
lift-definition enc :: κ⇒Π1 ⇒o ({|-,-|}) is
λ x F s w . (proper x) ∧ case-ν (λ ω . False) (λ α . F ∈ α) (rep x) .

A.1.7. Connectives and Quantifiers
consts I-NOT :: j⇒(i⇒bool)⇒i⇒bool
consts I-IMPL :: j⇒(i⇒bool)⇒(i⇒bool)⇒(i⇒bool)
lift-definition not :: o⇒o (¬- [54 ] 70 ) is
λ p s w . s = dj ∧ ¬p dj w ∨ s 6= dj ∧ (I-NOT s (p s) w) .
lift-definition impl :: o⇒o⇒o (infixl → 51 ) is
λ p q s w . s = dj ∧ (p dj w −→ q dj w) ∨ s 6= dj ∧ (I-IMPL s (p s) (q s) w) .
lift-definition forall ν :: (ν⇒o)⇒o (binder ∀ ν [8 ] 9 ) is
λ ϕ s w . ∀ x :: ν . (ϕ x) s w .
lift-definition forall 0 :: (Π0 ⇒o)⇒o (binder ∀ 0 [8 ] 9 ) is
λ ϕ s w . ∀ x :: Π0 . (ϕ x) s w .
lift-definition forall 1 :: (Π1 ⇒o)⇒o (binder ∀ 1 [8 ] 9 ) is
λ ϕ s w . ∀ x :: Π1 . (ϕ x) s w .
lift-definition forall 2 :: (Π2 ⇒o)⇒o (binder ∀ 2 [8 ] 9 ) is
λ ϕ s w . ∀ x :: Π2 . (ϕ x) s w .
lift-definition forall 3 :: (Π3 ⇒o)⇒o (binder ∀ 3 [8 ] 9 ) is
λ ϕ s w . ∀ x :: Π3 . (ϕ x) s w .
lift-definition forall o :: (o⇒o)⇒o (binder ∀ o [8 ] 9 ) is
λ ϕ s w . ∀ x :: o . (ϕ x) s w .
lift-definition box :: o⇒o (- [62 ] 63 ) is
λpsw .∀ v .psv .
lift-definition actual :: o⇒o (A- [64 ] 65 ) is
λ p s w . p s dw .

Remark. The connectives behave classically if evaluated for the actual state dj, whereas their
behavior is governed by uninterpreted constants for any other state.

71

A.1.8. Lambda Expressions
Remark. Lambda expressions have to convert maps from individuals to propositions to relations
that are represented by maps from urelements to truth values.
lift-definition lambdabinder0 :: o⇒Π0 (λ0 ) is id .
lift-definition lambdabinder1 :: (ν⇒o)⇒Π1 (binder λ [8 ] 9 ) is
λ ϕ u s w . ∃ x . νυ x = u ∧ ϕ x s w .
lift-definition lambdabinder2 :: (ν⇒ν⇒o)⇒Π2 (λ2 ) is
λ ϕ u v s w . ∃ x y . νυ x = u ∧ νυ y = v ∧ ϕ x y s w .
lift-definition lambdabinder3 :: (ν⇒ν⇒ν⇒o)⇒Π3 (λ3 ) is
λ ϕ u v r s w . ∃ x y z . νυ x = u ∧ νυ y = v ∧ νυ z = r ∧ ϕ x y z s w .

A.1.9. Proper Maps
Remark. The embedding introduces the notion of proper maps from individual terms to propositions.
Such a map is proper if and only if for all proper individual terms its truth evaluation in theactual state only depends on the urelements corresponding to the individuals the terms denote.
Proper maps are exactly those maps that - when used as matrix of a lambda-expression - unconditionally allow beta-reduction.
lift-definition IsProperInX :: (κ⇒o)⇒bool is
λ ϕ . ∀ x v . (∃ a . νυ a = νυ x ∧ (ϕ (a P ) dj v)) = (ϕ (x P ) dj v) .
lift-definition IsProperInXY :: (κ⇒κ⇒o)⇒bool is
λ ϕ . ∀ x y v . (∃ a b . νυ a = νυ x ∧ νυ b = νυ y∧ (ϕ (a P ) (bP ) dj v)) = (ϕ (x P ) (y P ) dj v) .
lift-definition IsProperInXYZ :: (κ⇒κ⇒κ⇒o)⇒bool is
λ ϕ . ∀ x y z v . (∃ a b c . νυ a = νυ x ∧ νυ b = νυ y ∧ νυ c = νυ z
∧ (ϕ (a P ) (bP ) (c P ) dj v)) = (ϕ (x P ) (y P ) (z P ) dj v) .

A.1.10. Validity
lift-definition valid-in :: i⇒o⇒bool (infixl |= 5 ) is
λ v ϕ . ϕ dj v .

Remark. A formula is considered semantically valid for a possible world, if it evaluates to Truefor the actual state dj and the given possible world.

A.1.11. Concretenessconsts ConcreteInWorld :: ω⇒i⇒bool
abbreviation (input) OrdinaryObjectsPossiblyConcrete where
OrdinaryObjectsPossiblyConcrete ≡ ∀ x . ∃ v . ConcreteInWorld x v
abbreviation (input) PossiblyContingentObjectExists where
PossiblyContingentObjectExists ≡ ∃ x v . ConcreteInWorld x v∧ (∃ w . ¬ ConcreteInWorld x w)
abbreviation (input) PossiblyNoContingentObjectExists where
PossiblyNoContingentObjectExists ≡ ∃ w . ∀ x . ConcreteInWorld x w−→ (∀ v . ConcreteInWorld x v)
axiomatization where
OrdinaryObjectsPossiblyConcreteAxiom:

72OrdinaryObjectsPossiblyConcreteand PossiblyContingentObjectExistsAxiom:
PossiblyContingentObjectExists
and PossiblyNoContingentObjectExistsAxiom:
PossiblyNoContingentObjectExists

Remark. Care has to be taken that the defined notion of concreteness coincides with the metalogical distinction between abstract objects and ordinary objects. Furthermore the axioms about
concreteness have to be satisfied. This is achieved by introducing an uninterpreted constantConcreteInWorld that determines whether an ordinary object is concrete in a given possible world.
This constant is axiomatized, such that all ordinary objects are possibly concrete, contingent
objects possibly exist and possibly no contingent objects exist.
lift-definition Concrete::Π1 (E!) is
λ u s w . case u of ωυ x ⇒ ConcreteInWorld x w | - ⇒ False .

Remark. Concreteness of ordinary objects is now defined using this axiomatized uninterpreted
constant. Abstract objects on the other hand are never concrete.

A.1.12. Collection of Meta-Definitions
named-theorems meta-defs
declare not-def [meta-defs] impl-def [meta-defs] forall ν -def [meta-defs]
forall 0 -def [meta-defs] forall 1 -def [meta-defs]
forall 2 -def [meta-defs] forall 3 -def [meta-defs] forall o -def [meta-defs]
box-def [meta-defs] actual-def [meta-defs] that-def [meta-defs]
lambdabinder0-def [meta-defs] lambdabinder1-def [meta-defs]
lambdabinder2-def [meta-defs] lambdabinder3-def [meta-defs]
exe0-def [meta-defs] exe1-def [meta-defs] exe2-def [meta-defs]
exe3-def [meta-defs] enc-def [meta-defs] inv-def [meta-defs]
that-def [meta-defs] valid-in-def [meta-defs] Concrete-def [meta-defs]

A.1.13. Auxiliary Lemmata
named-theorems meta-aux
declare makeκ-inverse[meta-aux] evalκ-inverse[meta-aux]
makeo-inverse[meta-aux] evalo-inverse[meta-aux]
makeΠ1 -inverse[meta-aux] evalΠ1 -inverse[meta-aux]
makeΠ2 -inverse[meta-aux] evalΠ2 -inverse[meta-aux]
makeΠ3 -inverse[meta-aux] evalΠ3 -inverse[meta-aux]
lemma νυ-ων-is-ωυ[meta-aux]: νυ (ων x) = ωυ x by (simp add: νυ-def )lemma rep-proper-id[meta-aux]: rep (x P ) = x
by (simp add: meta-aux νκ-def rep-def )lemma νκ-proper[meta-aux]: proper (x P )by (simp add: meta-aux νκ-def proper-def )lemma no-αω[meta-aux]: ¬(νυ (αν x) = ωυ y) by (simp add: νυ-def )lemma no-σω[meta-aux]: ¬(συ x = ωυ y) by blast
lemma νυ-surj[meta-aux]: surj νυusing ασ-surj unfolding νυ-def surj-defby (metis ν.simps(5 ) ν.simps(6 ) υ.exhaust comp-apply)
lemma lambdaΠ1 -aux[meta-aux]:
makeΠ1 (λu s w. ∃ x. νυ x = u ∧ evalΠ1 F (νυ x) s w) = F

73

proof −Vhave
u s w ϕ . (∃ x . νυ x = u ∧ ϕ (νυ x) (s::j) (w::i)) ←→ ϕ u s w
using νυ-surj unfolding surj-def by metis
thus ?thesis apply transfer by simp
qedlemma lambdaΠ2 -aux[meta-aux]:
makeΠ2 (λu v s w. ∃ x . νυ x = u ∧ (∃ y . νυ y = v ∧ evalΠ2 F (νυ x) (νυ y) s w)) = F
proof −Vhaveu v (s ::j) (w::i) ϕ .
(∃ x . νυ x = u ∧ (∃ y . νυ y = v ∧ ϕ (νυ x) (νυ y) s w))←→ ϕ u v s w
using νυ-surj unfolding surj-def by metis
thus ?thesis apply transfer by simp
qedlemma lambdaΠ3 -aux[meta-aux]:
makeΠ3 (λu v r s w. ∃ x. νυ x = u ∧ (∃ y. νυ y = v ∧(∃ z. νυ z = r ∧ evalΠ3 F (νυ x) (νυ y) (νυ z) s w))) = F
proof −Vhaveu v r (s::j) (w::i) ϕ . ∃ x. νυ x = u ∧ (∃ y. νυ y = v∧ (∃ z. νυ z = r ∧ ϕ (νυ x) (νυ y) (νυ z) s w)) = ϕ u v r s w
using νυ-surj unfolding surj-def by metis
thus ?thesis apply transfer apply (rule ext)+ by metisqed

A.2. Semantic Abstraction
A.2.1. Semantics
locale Semantics
begin
named-theorems semantics

A.2.1.1. Semantic Domains
type-synonym Rκ = ν
type-synonym R0 = j⇒i⇒bool
type-synonym R1 = υ⇒R0
type-synonym R2 = υ⇒υ⇒R0
type-synonym R3 = υ⇒υ⇒υ⇒R0
type-synonym W = i

A.2.1.2. Denotation Functions
lift-definition d κ :: κ⇒Rκ option is id .
lift-definition d 0 :: Π0 ⇒R0 option is Some .
lift-definition d 1 :: Π1 ⇒R1 option is Some .
lift-definition d 2 :: Π2 ⇒R2 option is Some .
lift-definition d 3 :: Π3 ⇒R3 option is Some .

A.2.1.3. Actual Worlddefinition w 0 where w 0 ≡ dw

A.2.1.4. Exemplification Extensions
definition ex0 :: R0 ⇒W ⇒bool

74

where ex0 ≡ λ F . F dj
definition ex1 :: R1 ⇒W ⇒(Rκ set)
where ex1 ≡ λ F w . { x . F (νυ x) dj w }definition ex2 :: R2 ⇒W ⇒((Rκ ×Rκ ) set)
where ex2 ≡ λ F w . { (x,y) . F (νυ x) (νυ y) dj w }definition ex3 :: R3 ⇒W ⇒((Rκ ×Rκ ×Rκ ) set)
where ex3 ≡ λ F w . { (x,y,z) . F (νυ x) (νυ y) (νυ z) dj w }A.2.1.5. Encoding Extensions
definition en :: R1 ⇒(Rκ set)
where en ≡ λ F . { x . case x of αν y ⇒ makeΠ1 (λ x . F x) ∈ y| - ⇒ False }A.2.1.6. Collection of Semantic Definitions
named-theorems semantics-defs
declare d 0 -def [semantics-defs] d 1 -def [semantics-defs]
d 2 -def [semantics-defs] d 3 -def [semantics-defs]
ex0-def [semantics-defs] ex1-def [semantics-defs]
ex2-def [semantics-defs] ex3-def [semantics-defs]
en-def [semantics-defs] d κ -def [semantics-defs]
w 0 -def [semantics-defs]

A.2.1.7. Truth Conditions of Exemplification Formulas
lemma T1-1 [semantics]:(w |= (|F ,x|)) = (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r w)
unfolding semantics-defs
apply (simp add: meta-defs meta-aux rep-def proper-def )by (metis option.discI option.exhaust option.sel)lemma T1-2 [semantics]:(w |= (|F ,x,y|)) = (∃ r o1 o2 . Some r = d 2 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ (o1 , o2 ) ∈ ex2 r w)
unfolding semantics-defs
apply (simp add: meta-defs meta-aux rep-def proper-def )by (metis option.discI option.exhaust option.sel)lemma T1-3 [semantics]:(w |= (|F ,x,y,z|)) = (∃ r o1 o2 o3 . Some r = d 3 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ Some o3 = d κ z∧ (o1 , o2 , o3 ) ∈ ex3 r w)
unfolding semantics-defs
apply (simp add: meta-defs meta-aux rep-def proper-def )by (metis option.discI option.exhaust option.sel)lemma T3 [semantics]:(w |= (|F |)) = (∃ r . Some r = d 0 F ∧ ex0 r w)
unfolding semantics-defsby (simp add: meta-defs meta-aux)

A.2.1.8. Truth Conditions of Encoding Formulas
lemma T2 [semantics]:(w |= {|x,F |}) = (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ en r)
unfolding semantics-defs

75

apply (simp add: meta-defs meta-aux rep-def proper-def split: ν.split)by (metis ν.exhaust ν.inject(2 ) ν.simps(4 ) νκ.rep-eq option.collapse
option.discI rep.rep-eq rep-proper-id)

A.2.1.9. Truth Conditions of Complex Formulas
lemma T4 [semantics]: (w |= ¬ψ) = (¬(w |= ψ))by (simp add: meta-defs meta-aux)
lemma T5 [semantics]: (w |= ψ → χ) = (¬(w |= ψ) ∨ (w |= χ))by (simp add: meta-defs meta-aux)
lemma T6 [semantics]: (w |= ψ) = (∀ v . (v |= ψ))by (simp add: meta-defs meta-aux)
lemma T7 [semantics]: (w |= Aψ) = (dw |= ψ)by (simp add: meta-defs meta-aux)
lemma T8-ν[semantics]: (w |= ∀ ν x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)
lemma T8-0 [semantics]: (w |= ∀ 0 x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)
lemma T8-1 [semantics]: (w |= ∀ 1 x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)
lemma T8-2 [semantics]: (w |= ∀ 2 x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)
lemma T8-3 [semantics]: (w |= ∀ 3 x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)
lemma T8-o[semantics]: (w |= ∀ o x. ψ x) = (∀ x . (w |= ψ x))
by (simp add: meta-defs meta-aux)

A.2.1.10. Denotations of Descriptions
lemma D3 [semantics]:d κ (ιx . ψ x) = (if (∃ x . (w 0 |= ψ x) ∧ (∀ y . (w 0 |= ψ y) −→ y = x))then (Some (THE x . (w 0 |= ψ x))) else None)unfolding semantics-defsby (auto simp: meta-defs meta-aux)

A.2.1.11. Denotations of Lambda Expressions
lemma D4-1 [semantics]: d 1 (λ x . (|F , x P |)) = d 1 F
by (simp add: meta-defs meta-aux)
lemma D4-2 [semantics]: d 2 (λ2 (λ x y . (|F , x P , y P |))) = d 2 F
by (simp add: meta-defs meta-aux)
lemma D4-3 [semantics]: d 3 (λ3 (λ x y z . (|F , x P , y P , z P |))) = d 3 F
by (simp add: meta-defs meta-aux)
lemma D5-1 [semantics]:
assumes IsProperInX ϕ76

w o1 r . Some r = d 1 (λ x . (ϕ (x P ))) ∧ Some o1 = d κ x−→ (o1 ∈ ex1 r w) = (w |= ϕ x)
using assms unfolding IsProperInX-def semantics-defsby (auto simp: meta-defs meta-aux rep-def proper-def νκ.abs-eq)
shows

V

lemma D5-2 [semantics]:
assumes
V IsProperInXY ϕshows
w o1 o2 r . Some r = d 2 (λ2 (λ x y . ϕ (x P ) (y P )))∧ Some o1 = d κ x ∧ Some o2 = d κ y−→ ((o1 ,o2 ) ∈ ex2 r w) = (w |= ϕ x y)
using assms unfolding IsProperInXY-def semantics-defsby (auto simp: meta-defs meta-aux rep-def proper-def νκ.abs-eq)
lemma D5-3 [semantics]:
assumes
V IsProperInXYZ ϕshows
w o1 o2 o3 r . Some r = d 3 (λ3 (λ x y z . ϕ (x P ) (y P ) (z P )))∧ Some o1 = d κ x ∧ Some o2 = d κ y ∧ Some o3 = d κ z−→ ((o1 ,o2 ,o3 ) ∈ ex3 r w) = (w |= ϕ x y z)
using assms unfolding IsProperInXYZ-def semantics-defsby (auto simp: meta-defs meta-aux rep-def proper-def νκ.abs-eq)
Vlemma D6 [semantics]: ( w r . Some r = d 0 (λ0 ϕ) −→ ex0 r w = (w |= ϕ))by (auto simp: meta-defs meta-aux semantics-defs)

A.2.1.12. Auxiliary Lemmas
lemma propex 0 : ∃ r . Some r = d 0 F
unfolding d 0 -def by simp
lemma propex 1 : ∃ r . Some r = d 1 F
unfolding d 1 -def by simp
lemma propex 2 : ∃ r . Some r = d 2 F
unfolding d 2 -def by simp
lemma propex 3 : ∃ r . Some r = d 3 F
unfolding d 3 -def by simp
lemma d κ -proper: d κ (u P ) = Some u
unfolding d κ -def by (simp add: νκ-def meta-aux)
lemma ConcretenessSemantics1 :Some r = d 1 E! =⇒ (∃ w . ων x ∈ ex1 r w)
unfolding semantics-defs apply transfer
by (simp add: OrdinaryObjectsPossiblyConcreteAxiom νυ-ων-is-ωυ)lemma ConcretenessSemantics2 :Some r = d 1 E! =⇒ (x ∈ ex1 r w −→ (∃ y. x = ων y))unfolding semantics-defs apply transfer apply simpby (metis ν.exhaustV υ.exhaust υ.simps(6 ) no-αω)lemma d 0 -inject: x y. d 0 x = d 0 y =⇒ x = y
unfolding d 0 -defVby (simp add: evalo-inject)lemma d 1 -inject: x y. d 1 x = d 1 y =⇒ x = y
unfolding d 1 -defVby (simp add: evalΠ1 -inject)lemma d 2 -inject: x y. d 2 x = d 2 y =⇒ x = y
unfolding d 2 -defVby (simp add: evalΠ2 -inject)lemma d 3 -inject: x y. d 3 x = d 3 y =⇒ x = y
unfolding d 3 -defVby (simp add: evalΠ3 -inject)lemma d κ -inject: x y o1 . Some o1 = d κ x ∧ Some o1 = d κ y =⇒ x = y
proof −
fix x :: κ and y :: κ and o1 :: νassume Some o1 = d κ x ∧ Some o1 = d κ ythus x = y apply transfer by auto
qed

77

end

A.2.2. Introduction Rules for Proper Maps
Remark. Every map whose arguments only occur in exemplification expressions is proper.
named-theorems IsProper-intros
lemma IsProperInX-intro[IsProper-intros]:
IsProperInX (λ x . χ— one place: (λ F . (|F ,x|))— two place: (λ F . (|F ,x,x|)) (λ F a . (|F ,x,a|)) (λ F a . (|F ,a,x|))— three place three x: (λ F . (|F ,x,x,x|))— three place two x: (λ F a . (|F ,x,x,a|)) (λ F a . (|F ,x,a,x|))(λ F a . (|F ,a,x,x|))— three place one x: (λ F a b. (|F ,x,a,b|)) (λ F a b. (|F ,a,x,b|))(λ F a b . (|F ,a,b,x|)))
unfolding IsProperInX-defby (auto simp: meta-defs meta-aux)
lemma IsProperInXY-intro[IsProper-intros]:
IsProperInXY (λ x y . χ— only x— one place: (λ F . (|F ,x|))— two place: (λ F . (|F ,x,x|)) (λ F a . (|F ,x,a|)) (λ F a . (|F ,a,x|))— three place three x: (λ F . (|F ,x,x,x|))— three place two x: (λ F a . (|F ,x,x,a|)) (λ F a . (|F ,x,a,x|))(λ F a . (|F ,a,x,x|))— three place one x: (λ F a b. (|F ,x,a,b|)) (λ F a b. (|F ,a,x,b|))(λ F a b . (|F ,a,b,x|))— only y— one place: (λ F . (|F ,y|))— two place: (λ F . (|F ,y,y|)) (λ F a . (|F ,y,a|)) (λ F a . (|F ,a,y|))— three place three y: (λ F . (|F ,y,y,y|))— three place two y: (λ F a . (|F ,y,y,a|)) (λ F a . (|F ,y,a,y|))(λ F a . (|F ,a,y,y|))— three place one y: (λ F a b. (|F ,y,a,b|)) (λ F a b. (|F ,a,y,b|))(λ F a b . (|F ,a,b,y|))— x and y— two place: (λ F . (|F ,x,y|)) (λ F . (|F ,y,x|))— three place (x,y): (λ F a . (|F ,x,y,a|)) (λ F a . (|F ,x,a,y|))(λ F a . (|F ,a,x,y|))— three place (y,x): (λ F a . (|F ,y,x,a|)) (λ F a . (|F ,y,a,x|))(λ F a . (|F ,a,y,x|))— three place (x,x,y): (λ F . (|F ,x,x,y|)) (λ F . (|F ,x,y,x|))(λ F . (|F ,y,x,x|))— three place (x,y,y): (λ F . (|F ,x,y,y|)) (λ F . (|F ,y,x,y|))(λ F . (|F ,y,y,x|))— three place (x,x,x): (λ F . (|F ,x,x,x|))— three place (y,y,y): (λ F . (|F ,y,y,y|)))unfolding IsProperInXY-def by (auto simp: meta-defs meta-aux)
lemma IsProperInXYZ-intro[IsProper-intros]:
IsProperInXYZ (λ x y z . χ— only x— one place: (λ F . (|F ,x|))— two place: (λ F . (|F ,x,x|)) (λ F a . (|F ,x,a|)) (λ F a . (|F ,a,x|))78

— three place three x: (λ F . (|F ,x,x,x|))— three place two x: (λ F a . (|F ,x,x,a|)) (λ F a . (|F ,x,a,x|))(λ F a . (|F ,a,x,x|))— three place one x: (λ F a b. (|F ,x,a,b|)) (λ F a b. (|F ,a,x,b|))(λ F a b . (|F ,a,b,x|))— only y— one place: (λ F . (|F ,y|))— two place: (λ F . (|F ,y,y|)) (λ F a . (|F ,y,a|)) (λ F a . (|F ,a,y|))— three place three y: (λ F . (|F ,y,y,y|))— three place two y: (λ F a . (|F ,y,y,a|)) (λ F a . (|F ,y,a,y|))(λ F a . (|F ,a,y,y|))— three place one y: (λ F a b. (|F ,y,a,b|)) (λ F a b. (|F ,a,y,b|))(λ F a b . (|F ,a,b,y|))— only z— one place: (λ F . (|F ,z|))— two place: (λ F . (|F ,z,z|)) (λ F a . (|F ,z,a|)) (λ F a . (|F ,a,z|))— three place three z: (λ F . (|F ,z,z,z|))— three place two z: (λ F a . (|F ,z,z,a|)) (λ F a . (|F ,z,a,z|))(λ F a . (|F ,a,z,z|))— three place one z: (λ F a b. (|F ,z,a,b|)) (λ F a b. (|F ,a,z,b|))(λ F a b . (|F ,a,b,z|))— x and y— two place: (λ F . (|F ,x,y|)) (λ F . (|F ,y,x|))— three place (x,y): (λ F a . (|F ,x,y,a|)) (λ F a . (|F ,x,a,y|))(λ F a . (|F ,a,x,y|))— three place (y,x): (λ F a . (|F ,y,x,a|)) (λ F a . (|F ,y,a,x|))(λ F a . (|F ,a,y,x|))— three place (x,x,y): (λ F . (|F ,x,x,y|)) (λ F . (|F ,x,y,x|))(λ F . (|F ,y,x,x|))— three place (x,y,y): (λ F . (|F ,x,y,y|)) (λ F . (|F ,y,x,y|))(λ F . (|F ,y,y,x|))— three place (x,x,x): (λ F . (|F ,x,x,x|))— three place (y,y,y): (λ F . (|F ,y,y,y|))— x and z— two place: (λ F . (|F ,x,z|)) (λ F . (|F ,z,x|))— three place (x,z): (λ F a . (|F ,x,z,a|)) (λ F a . (|F ,x,a,z|))(λ F a . (|F ,a,x,z|))— three place (z,x): (λ F a . (|F ,z,x,a|)) (λ F a . (|F ,z,a,x|))(λ F a . (|F ,a,z,x|))— three place (x,x,z): (λ F . (|F ,x,x,z|)) (λ F . (|F ,x,z,x|))(λ F . (|F ,z,x,x|))— three place (x,z,z): (λ F . (|F ,x,z,z|)) (λ F . (|F ,z,x,z|))(λ F . (|F ,z,z,x|))— three place (x,x,x): (λ F . (|F ,x,x,x|))— three place (z,z,z): (λ F . (|F ,z,z,z|))— y and z— two place: (λ F . (|F ,y,z|)) (λ F . (|F ,z,y|))— three place (y,z): (λ F a . (|F ,y,z,a|)) (λ F a . (|F ,y,a,z|))(λ F a . (|F ,a,y,z|))— three place (z,y): (λ F a . (|F ,z,y,a|)) (λ F a . (|F ,z,a,y|))(λ F a . (|F ,a,z,y|))— three place (y,y,z): (λ F . (|F ,y,y,z|)) (λ F . (|F ,y,z,y|))(λ F . (|F ,z,y,y|))— three place (y,z,z): (λ F . (|F ,y,z,z|)) (λ F . (|F ,z,y,z|))(λ F . (|F ,z,z,y|))— three place (y,y,y): (λ F . (|F ,y,y,y|))— three place (z,z,z): (λ F . (|F ,z,z,z|))
—xyz

79

— three place (x,. . . ): (λ F . (|F ,x,y,z|)) (λ F . (|F ,x,z,y|))— three place (y,. . . ): (λ F . (|F ,y,x,z|)) (λ F . (|F ,y,z,x|))— three place (z,. . . ): (λ F . (|F ,z,x,y|)) (λ F . (|F ,z,y,x|)))
unfolding IsProperInXYZ-defby (auto simp: meta-defs meta-aux)
method show-proper = (fast intro: IsProper-intros)

A.2.3. Validity Syntax
abbreviation validity-in :: o⇒i⇒bool ([- in -] [1 ]) where
validity-in ≡ λ ϕ v . v |= ϕdefinition actual-validity :: o⇒bool ([-] [1 ]) where
actual-validity ≡ λ ϕ . dw |= ϕdefinition necessary-validity :: o⇒bool ([-] [1 ]) where
necessary-validity ≡ λ ϕ . ∀ v . (v |= ϕ)

A.3. General Quantification
Remark. In order to define general quantifiers that can act on individuals as well as relations
a type class is introduced which assumes the semantics of the all quantifier. This type class isthen instantiated for individuals and relations.

A.3.1. Type Class
class quantifiable = fixes forall :: ( 0a⇒o)⇒o (binder ∀ [8 ] 9 )assumes quantifiable-T8 : (w |= (∀ x . ψ x)) = (∀ x . (w |= (ψ x)))
begin
end
lemma (in Semantics) T8 : shows (w |= ∀ x . ψ x) = (∀ x . (w |= ψ x))
using quantifiable-T8 .

A.3.2. Instantiations
instantiation ν :: quantifiable
begin
definition forall-ν :: (ν⇒o)⇒o where forall-ν ≡ forall ν
instance proof
fix w :: i and ψ :: ν⇒oshow (w |= ∀ x. ψ x) = (∀ x. (w |= ψ x))
unfolding forall-ν-def using Semantics.T8-ν .
qed
end
instantiation o :: quantifiable
begin
definition forall-o :: (o⇒o)⇒o where forall-o ≡ forall oinstance proof
fix w :: i and ψ :: o⇒oshow (w |= ∀ x. ψ x) = (∀ x. (w |= ψ x))
unfolding forall-o-def using Semantics.T8-o .

80

qed
end
instantiation Π1 :: quantifiable
begin
definition forall-Π1 :: (Π1 ⇒o)⇒o where forall-Π1 ≡ forall 1
instance proof
fix w :: i and ψ :: Π1 ⇒oshow (w |= ∀ x. ψ x) = (∀ x. (w |= ψ x))
unfolding forall-Π1 -def using Semantics.T8-1 .
qed
end
instantiation Π2 :: quantifiable
begin
definition forall-Π2 :: (Π2 ⇒o)⇒o where forall-Π2 ≡ forall 2
instance proof
fix w :: i and ψ :: Π2 ⇒oshow (w |= ∀ x. ψ x) = (∀ x. (w |= ψ x))
unfolding forall-Π2 -def using Semantics.T8-2 .
qed
end
instantiation Π3 :: quantifiable
begin
definition forall-Π3 :: (Π3 ⇒o)⇒o where forall-Π3 ≡ forall 3
instance proof
fix w :: i and ψ :: Π3 ⇒oshow (w |= ∀ x. ψ x) = (∀ x. (w |= ψ x))
unfolding forall-Π3 -def using Semantics.T8-3 .
qed
end

A.4. Basic Definitions
A.4.1. Derived Connectives
definition conj::o⇒o⇒o (infixl & 53 ) whereconj ≡ λ x y . ¬(x → ¬y)definition disj::o⇒o⇒o (infixl ∨ 52 ) where
disj ≡ λ x y . ¬x → ydefinition equiv::o⇒o⇒o (infixl ≡ 51 ) where
equiv ≡ λ x y . (x → y) & (y → x)
definition diamond::o⇒o (♦- [62 ] 63 ) where
diamond ≡ λ ϕ . ¬¬ϕdefinition (in quantifiable) exists :: ( 0a⇒o)⇒o (binder ∃ [8 ] 9 ) where
exists ≡ λ ϕ . ¬(∀ x . ¬ϕ x)
named-theorems conn-defs
declare diamond-def [conn-defs] conj-def [conn-defs]
disj-def [conn-defs] equiv-def [conn-defs]
exists-def [conn-defs]

A.4.2. Abstract and Ordinary Objects
definition Ordinary :: Π1 (O!) where Ordinary ≡ λx. ♦(|E!,x P |)81

definition Abstract :: Π1 (A!) where Abstract ≡ λx. ¬♦(|E!,x P |)A.4.3. Identity Definitions
definition basic-identity E ::Π2 where
basic-identity E ≡ λ2 (λ x y . (|O!,x P |) & (|O!,y P |)& (∀ F . (|F ,x P |) ≡ (|F ,y P |)))
definition basic-identity E -infix::κ⇒κ⇒o (infixl =E 63 ) where
x =E y ≡ (|basic-identity E , x, y|)definition basic-identity κ (infixl =κ 63 ) where
basic-identity κ ≡ λ x y . (x =E y) ∨ (|A!,x|) & (|A!,y|)& (∀ F . {|x,F |} ≡ {|y,F |})definition basic-identity 1 (infixl =1 63 ) where
basic-identity 1 ≡ λ F G . (∀ x. {|x P ,F |} ≡ {|x P ,G|})definition basic-identity 2 :: Π2 ⇒Π2 ⇒o (infixl =2 63 ) where
basic-identity 2 ≡ λ F G . ∀ x. ((λy. (|F ,x P ,y P |)) =1 (λy. (|G,x P ,y P |)))& ((λy. (|F ,y P ,x P |)) =1 (λy. (|G,y P ,x P |)))
definition basic-identity 3 ::Π3 ⇒Π3 ⇒o (infixl =3 63 ) where
basic-identity 3 ≡ λ F G . ∀ x y. (λz. (|F ,z P ,x P ,y P |)) =1 (λz. (|G,z P ,x P ,y P |))& (λz. (|F ,x P ,z P ,y P |)) =1 (λz. (|G,x P ,z P ,y P |))& (λz. (|F ,x P ,y P ,z P |)) =1 (λz. (|G,x P ,y P ,z P |))definition basic-identity 0 ::o⇒o⇒o (infixl =0 63 ) where
basic-identity 0 ≡ λ F G . (λy. F ) =1 (λy. G)

A.5. MetaSolver
Remark. meta-solver is a resolution prover that translates expressions in the embedded logic toexpressions in the meta-logic, resp. semantic expressions. The rules for connectives, quantifiers,
exemplification and encoding are straightforward. Furthermore, rules for the defined identities
are derived. The defined identities in the embedded logic coincide with the meta-logical equality.
locale MetaSolver
begininterpretation Semantics .
named-theorems meta-intro
named-theorems meta-elim
named-theorems meta-subst
named-theorems meta-cong
method meta-solver = (assumption | rule meta-intro| erule meta-elim | drule meta-elim | subst meta-subst| subst (asm) meta-subst | (erule notE; (meta-solver; fail)))+

A.5.1. Rules for Implication
lemma ImplI [meta-intro]: ([ϕ in v] =⇒ [ψ in v]) =⇒ ([ϕ → ψ in v])
by (simp add: Semantics.T5 )82

lemma ImplE[meta-elim]: ([ϕ → ψ in v]) =⇒ ([ϕ in v] −→ [ψ in v])
by (simp add: Semantics.T5 )lemma ImplS[meta-subst]: ([ϕ → ψ in v]) = ([ϕ in v] −→ [ψ in v])
by (simp add: Semantics.T5 )A.5.2. Rules for Negation
lemma NotI [meta-intro]: ¬[ϕ in v] =⇒ [¬ϕ in v]
by (simp add: Semantics.T4 )lemma NotE[meta-elim]: [¬ϕ in v] =⇒ ¬[ϕ in v]
by (simp add: Semantics.T4 )lemma NotS[meta-subst]: [¬ϕ in v] = (¬[ϕ in v])
by (simp add: Semantics.T4 )A.5.3. Rules for Conjunction
lemma ConjI [meta-intro]: ([ϕ in v] ∧ [ψ in v]) =⇒ [ϕ & ψ in v]
by (simp add: conj-def NotS ImplS)lemma ConjE[meta-elim]: [ϕ & ψ in v] =⇒ ([ϕ in v] ∧ [ψ in v])
by (simp add: conj-def NotS ImplS)lemma ConjS[meta-subst]: [ϕ & ψ in v] = ([ϕ in v] ∧ [ψ in v])
by (simp add: conj-def NotS ImplS)

A.5.4. Rules for Equivalencelemma EquivI [meta-intro]: ([ϕ in v] ←→ [ψ in v]) =⇒ [ϕ ≡ ψ in v]
by (simp add: equiv-def NotS ImplS ConjS)
lemma EquivE[meta-elim]: [ϕ ≡ ψ in v] =⇒ ([ϕ in v] ←→ [ψ in v])
by (auto simp: equiv-def NotS ImplS ConjS)
lemma EquivS[meta-subst]: [ϕ ≡ ψ in v] = ([ϕ in v] ←→ [ψ in v])
by (auto simp: equiv-def NotS ImplS ConjS)

A.5.5. Rules for Disjunction
lemma DisjI [meta-intro]: ([ϕ in v] ∨ [ψ in v]) =⇒ [ϕ ∨ ψ in v]
by (auto simp: disj-def NotS ImplS)lemma DisjE[meta-elim]: [ϕ ∨ ψ in v] =⇒ ([ϕ in v] ∨ [ψ in v])
by (auto simp: disj-def NotS ImplS)lemma DisjS[meta-subst]: [ϕ ∨ ψ in v] = ([ϕ in v] ∨ [ψ in v])
by (auto simp: disj-def NotS ImplS)

A.5.6. Rules for NecessityVlemma BoxI [meta-intro]: ( v.[ϕ in v]) =⇒ [ϕ in v]
by (simp add: Semantics.T6 )Vlemma BoxE[meta-elim]: [ϕ in v] =⇒ ( v.[ϕ in v])
by (simp add: Semantics.T6 )lemma BoxS[meta-subst]: [ϕ in v] = (∀ v.[ϕ in v])
by (simp add: Semantics.T6 )A.5.7. Rules for Possibility
lemma DiaI [meta-intro]: (∃ v.[ϕ in v]) =⇒ [♦ϕ in v]
by (metis BoxS NotS diamond-def )lemma DiaE[meta-elim]: [♦ϕ in v] =⇒ (∃ v.[ϕ in v])
by (metis BoxS NotS diamond-def )83

lemma DiaS[meta-subst]: [♦ϕ in v] = (∃ v.[ϕ in v])
by (metis BoxS NotS diamond-def )A.5.8. Rules for QuantificationVlemma AllI [meta-intro]: ( x. [ϕ x in v]) =⇒ [∀ x. ϕ x in v]
by (auto simp: T8 )Vlemma AllE[meta-elim]: [∀ x. ϕ x in v] =⇒ ( x.[ϕ x in v])
by (auto simp: T8 )lemma AllS[meta-subst]: [∀ x. ϕ x in v] = (∀ x.[ϕ x in v])
by (auto simp: T8 )A.5.8.1. Rules for Existencelemma ExIRule: ([ϕ y in v]) =⇒ [∃ x. ϕ x in v]
by (auto simp: exists-def Semantics.T8 Semantics.T4 )lemma ExI [meta-intro]: (∃ y . [ϕ y in v]) =⇒ [∃ x. ϕ x in v]
by (auto simp: exists-def Semantics.T8 Semantics.T4 )lemma ExE[meta-elim]: [∃ x. ϕ x in v] =⇒ (∃ y . [ϕ y in v])
by (auto simp: exists-def Semantics.T8 Semantics.T4 )lemma ExS[meta-subst]: [∃ x. ϕ x in v] = (∃ y . [ϕ y in v])
by (auto simp: exists-def Semantics.T8 Semantics.T4 )lemma ExERule: assumes [∃ x. ϕ x in v] obtains x where [ϕ x in v]
using ExE assms by auto

A.5.9. Rules for Actuality
lemma ActualI [meta-intro]: [ϕ in dw] =⇒ [Aϕ in v]
by (auto simp: Semantics.T7 )lemma ActualE[meta-elim]: [Aϕ in v] =⇒ [ϕ in dw]
by (auto simp: Semantics.T7 )lemma ActualS[meta-subst]: [Aϕ in v] = [ϕ in dw]
by (auto simp: Semantics.T7 )A.5.10. Rules for Encoding
lemma EncI [meta-intro]:
assumes ∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ en rshows [{|x,F |} in v]
using assms by (auto simp: Semantics.T2 )lemma EncE[meta-elim]:
assumes [{|x,F |} in v]
shows ∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ en r
using assms by (auto simp: Semantics.T2 )lemma EncS[meta-subst]:[{|x,F |} in v] = (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ en r)by (auto simp: Semantics.T2 )A.5.11. Rules for Exemplification
A.5.11.1. Zero-place Relations
lemma Exe0I [meta-intro]:
assumes ∃ r . Some r = d 0 p ∧ ex0 r v
shows [(|p|) in v]
using assms by (auto simp: Semantics.T3 )lemma Exe0E[meta-elim]:

84

assumes [(|p|) in v]
shows ∃ r . Some r = d 0 p ∧ ex0 r v
using assms by (auto simp: Semantics.T3 )lemma Exe0S[meta-subst]:[(|p|) in v] = (∃ r . Some r = d 0 p ∧ ex0 r v)
by (auto simp: Semantics.T3 )A.5.11.2. One-Place Relations
lemma Exe1I [meta-intro]:
assumes ∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v
shows [(|F ,x|) in v]
using assms by (auto simp: Semantics.T1-1 )lemma Exe1E[meta-elim]:
assumes [(|F ,x|) in v]
shows ∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v
using assms by (auto simp: Semantics.T1-1 )lemma Exe1S[meta-subst]:[(|F ,x|) in v] = (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v)
by (auto simp: Semantics.T1-1 )A.5.11.3. Two-Place Relations
lemma Exe2I [meta-intro]:
assumes ∃ r o1 o2 . Some r = d 2 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ (o1 , o2 ) ∈ ex2 r v
shows [(|F ,x,y|) in v]
using assms by (auto simp: Semantics.T1-2 )lemma Exe2E[meta-elim]:
assumes [(|F ,x,y|) in v]
shows ∃ r o1 o2 . Some r = d 2 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ (o1 , o2 ) ∈ ex2 r v
using assms by (auto simp: Semantics.T1-2 )lemma Exe2S[meta-subst]:[(|F ,x,y|) in v] = (∃ r o1 o2 . Some r = d 2 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ (o1 , o2 ) ∈ ex2 r v)
by (auto simp: Semantics.T1-2 )A.5.11.4. Three-Place Relations
lemma Exe3I [meta-intro]:
assumes ∃ r o1 o2 o3 . Some r = d 3 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ Some o3 = d κ z∧ (o1 , o2 , o3 ) ∈ ex3 r v
shows [(|F ,x,y,z|) in v]
using assms by (auto simp: Semantics.T1-3 )lemma Exe3E[meta-elim]:
assumes [(|F ,x,y,z|) in v]
shows ∃ r o1 o2 o3 . Some r = d 3 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ Some o3 = d κ z∧ (o1 , o2 , o3 ) ∈ ex3 r v
using assms by (auto simp: Semantics.T1-3 )lemma Exe3S[meta-subst]:[(|F ,x,y,z|) in v] = (∃ r o1 o2 o3 . Some r = d 3 F ∧ Some o1 = d κ x∧ Some o2 = d κ y ∧ Some o3 = d κ z∧ (o1 , o2 , o3 ) ∈ ex3 r v)
by (auto simp: Semantics.T1-3 )85

A.5.12. Rules for Being Ordinarylemma OrdI [meta-intro]:
assumes ∃ o1 y. Some o1 = d κ x ∧ o1 = ων yshows [(|O!,x|) in v]
proof −
have IsProperInX (λx. ♦(|E!,x|))by show-proper
moreover have [♦(|E!,x|) in v]
apply meta-solverusing ConcretenessSemantics1 propex 1 assms by fast
ultimately show [(|O!,x|) in v]
unfolding Ordinary-def
using D5-1 propex 1 assms ConcretenessSemantics1 Exe1S
by blastqed
lemma OrdE[meta-elim]:
assumes [(|O!,x|) in v]
shows ∃ o1 y. Some o1 = d κ x ∧ o1 = ων yproof −
have ∃ r o1 . Some r = d 1 O! ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v
using assms Exe1E by simp
moreover have IsProperInX (λx. ♦(|E!,x|))by show-proper
ultimately have [♦(|E!,x|) in v]
using D5-1 unfolding Ordinary-def by fast
thus ?thesis
apply − apply meta-solverusing ConcretenessSemantics2 by blastqed
lemma OrdS[meta-cong]:[(|O!,x|) in v] = (∃ o1 y. Some o1 = d κ x ∧ o1 = ων y)using OrdI OrdE by blast

A.5.13. Rules for Being Abstract
lemma AbsI [meta-intro]:
assumes ∃ o1 y. Some o1 = d κ x ∧ o1 = αν yshows [(|A!,x|) in v]
proof −
have IsProperInX (λx. ¬♦(|E!,x|))by show-proper
moreover have [¬♦(|E!,x|) in v]
apply meta-solverusing ConcretenessSemantics2 propex 1 assms
by (metis ν.distinct(1 ) option.sel)
ultimately show [(|A!,x|) in v]
unfolding Abstract-def
using D5-1 propex 1 assms ConcretenessSemantics1 Exe1S
by blastqed
lemma AbsE[meta-elim]:
assumes [(|A!,x|) in v]
shows ∃ o1 y. Some o1 = d κ x ∧ o1 = αν yproof −
have 1 : IsProperInX (λx. ¬♦(|E!,x|))by show-proper
have ∃ r o1 . Some r = d 1 A! ∧ Some o1 = d κ x ∧ o1 ∈ ex1 r v

86using assms Exe1E by simp
moreover hence [¬♦(|E!,x|) in v]
using D5-1 [OF 1 ]unfolding Abstract-def by fast
ultimately show ?thesis
apply − apply meta-solverusing ConcretenessSemantics1 propex 1by (metis ν.exhaust)qedlemma AbsS[meta-cong]:[(|A!,x|) in v] = (∃ o1 y. Some o1 = d κ x ∧ o1 = αν y)using AbsI AbsE by blast

A.5.14. Rules for Definite Descriptions
lemma TheEqIV :assumes x. [ϕ x in dw] = [ψ x in dw]
shows (ιx. ϕ x) = (ιx. ψ x)
proof −
have 1 : d κ (ιx. ϕ x) = d κ (ιx. ψ x)
using assms D3 unfolding w 0 -def by simp{
assume ∃ o1 . Some o1 = d κ (ιx. ϕ x)
hence ?thesis using 1 d κ -inject by force}
moreover {assume ¬(∃ o1 . Some o1 = d κ (ιx. ϕ x))
hence ?thesis using 1 D3by (metis d κ .rep-eq evalκ-inverse)}
ultimately show ?thesis by blast
qed

A.5.15. Rules for Identity
A.5.15.1. Ordinary Objects
lemma Eq E I [meta-intro]:
assumes ∃ o1 o2 . Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ y ∧ o1 = o2
shows [x =E y in v]
proof −
obtain o1 o2 where 1 :Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ y ∧ o1 = o2
using assms by auto
obtain r where 2 :Some r = d 2 basic-identity E
using propex 2 by auto
have [(|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
proof −
have [(|O!,x|) in v] ∧ [(|O!,y|) in v]
using OrdI 1 by blast
moreover have [(∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
apply meta-solver using 1 by force
ultimately show ?thesis using ConjI by simp
qed
moreover have IsProperInXY (λ x y . (|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)))by show-proper87

ultimately have (ων o1 , ων o2 ) ∈ ex2 r v
using D5-2 1 2
unfolding basic-identity E -def by fast
thus [x =E y in v]
using Exe2I 1 2
unfolding basic-identity E -infix-def basic-identity E -defby blastqed
lemma Eq E E[meta-elim]:
assumes [x =E y in v]
shows ∃ o1 o2 . Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ y ∧ o1 = o2
proof −
have IsProperInXY (λ x y . (|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)))by show-proper
hence 1 : [(|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
using assms unfolding basic-identity E -def basic-identity E -infix-def
using D4-2 T1-2 D5-2 by meson
hence 2 : ∃ o1 o2 . Some (ων o1 ) = d κ x∧ Some (ων o2 ) = d κ yapply (subst (asm) ConjS)
apply (subst (asm) ConjS)
using OrdE by auto
then obtain o1 o2 where 3 :Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ yby autohave ∃ r . Some r = d 1 (λ z . makeo (λ w s . d κ (z P ) = Some (ων o1 )))using propex 1 by auto
then obtain r where 4 :Some r = d 1 (λ z . makeo (λ w s . d κ (z P ) = Some (ων o1 )))by autohence 5 : r = (λu s w. ∃ x . νυ x = u ∧ Some x = Some (ων o1 ))unfolding lambdabinder1-def d 1 -def d κ -proper
apply transfer
by simphave [(∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
using 1 using ConjE by blast
hence 6 : ∀ v F . [(|F ,x|) in v] ←→ [(|F ,y|) in v]
using BoxE EquivE AllE by fasthence ∀ v . ((ων o1 ) ∈ ex1 r v) = ((ων o2 ) ∈ ex1 r v)
using 2 4 unfolding valid-in-defby (metis 3 6 d 1 .rep-eq d κ -inject d κ -proper ex1-def evalo-inverse exe1 .rep-eq
mem-Collect-eq option.sel rep-proper-id νκ-proper valid-in.abs-eq)
moreover have (ων o1 ) ∈ ex1 r v
unfolding 5 ex1-def by simp
ultimately have (ων o2 ) ∈ ex1 r v
by autohence o1 = o2 unfolding 5 ex1-def by (auto simp: meta-aux)
thus ?thesis
using 3 by autoqed
lemma Eq E S[meta-subst]:[x =E y in v] = (∃ o1 o2 . Some (ων o1 ) = d κ x ∧ Some (ων o2 ) = d κ y∧ o1 = o2 )using Eq E I Eq E E by blast

A.5.15.2. Individuals
lemma EqκI [meta-intro]:

88

assumes ∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o2
shows [x =κ y in v]
proof −
have x = y using assms d κ -inject by meson
moreover have [x =κ x in v]
unfolding basic-identity κ -def
apply meta-solverby (metis (no-types, lifting) assms AbsI Exe1E ν.exhaust)
ultimately show ?thesis by autoqed
lemma Eqκ-prop:
assumes [x =κ y in v]
shows [ϕ x in v] = [ϕ y in v]
proof −
have [x =E y ∨ (|A!,x|) & (|A!,y|) & (∀ F . {|x,F |} ≡ {|y,F |}) in v]
using assms unfolding basic-identity κ -def by simp
moreover {assume [x =E y in v]
hence (∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o2 )using Eq E E by fast}
moreover {assume 1 : [(|A!,x|) & (|A!,y|) & (∀ F . {|x,F |} ≡ {|y,F |}) in v]
hence 2 : (∃ o1 o2 X Y . Some o1 = d κ x ∧ Some o2 = d κ y∧ o1 = αν X ∧ o2 = αν Y )using AbsE ConjE by meson
moreover then obtain o1 o2 X Y where 3 :Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = αν X ∧ o2 = αν Y
by automoreover have 4 : [(∀ F . {|x,F |} ≡ {|y,F |}) in v]
using 1 ConjE by blast
hence 6 : ∀ v F . [{|x,F |} in v] ←→ [{|y,F |} in v]
using BoxE AllE EquivE by fasthence 7 : ∀ v r. (∃ o1 . Some o1 = d κ x ∧ o1 ∈ en r)= (∃ o1 . Some o1 = d κ y ∧ o1 ∈ en r)
apply − apply meta-solverusing propex 1 d 1 -inject apply simp
apply transfer by simp
hence 8 : ∀ r. (o1 ∈ en r) = (o2 ∈ en r)
using 3 d κ -inject d κ -proper apply simpby (metis option.inject)hence ∀ r. (o1 ∈ r) = (o2 ∈ r)
unfolding en-def using 3
by (metis Collect-cong Collect-mem-eq ν.simps(6 )mem-Collect-eq makeΠ1 -cases)
hence (o1 ∈ { x . o1 = x }) = (o2 ∈ { x . o1 = x })by metishence o1 = o2 by simp
hence (∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o2 )using 3 by auto}
ultimately have x = yusing DisjS using Semantics.d κ -inject by auto
thus (v |= (ϕ x)) = (v |= (ϕ y)) by simp
qedlemma EqκE[meta-elim]:
assumes [x =κ y in v]
shows ∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o289proof −have ∀ ϕ . (v |= ϕ x) = (v |= ϕ y)using assms Eqκ-prop by blast
moreover obtain ϕ where ϕ-prop:
ϕ = (λ α . makeo (λ w s . (∃ o1 o2 . Some o1 = d κ x∧ Some o2 = d κ α ∧ o1 = o2 )))by autoultimately have (v |= ϕ x) = (v |= ϕ y) by metis
moreover have (v |= ϕ x)
using assms unfolding ϕ-prop basic-identity κ -defby (metis (mono-tags, lifting) AbsS ConjE DisjS
Eq E S valid-in.abs-eq)
ultimately have (v |= ϕ y) by auto
thus ?thesis
unfolding ϕ-propby (simp add: valid-in-def meta-aux)qedlemma EqκS[meta-subst]:[x =κ y in v] = (∃ o1 o2 . Some o1 = d κ x ∧ Some o2 = d κ y ∧ o1 = o2 )using EqκI EqκE by blast

A.5.15.3. One-Place Relations
lemma Eq 1 I [meta-intro]: F = G =⇒ [F =1 G in v]
unfolding basic-identity 1 -def
apply (rule BoxI , rule AllI , rule EquivI )by simplemma Eq 1 E[meta-elim]: [F =1 G in v] =⇒ F = G
unfolding basic-identity 1 -def
apply (drule BoxE, drule-tac x=(αν { F }) in AllE, drule EquivE)
apply (simp add: Semantics.T2 )unfolding en-def d κ -def d 1 -defusing νκ-proper rep-proper-idby (simp add: rep-def proper-def meta-aux νκ.rep-eq)
lemma Eq 1 S[meta-subst]: [F =1 G in v] = (F = G)using Eq 1 I Eq 1 E by auto
lemma Eq 1 -prop: [F =1 G in v] =⇒ [ϕ F in v] = [ϕ G in v]
using Eq 1 E by blast

A.5.15.4. Two-Place Relations
lemma Eq 2 I [meta-intro]: F = G =⇒ [F =2 G in v]
unfolding basic-identity 2 -def
apply (rule AllI , rule ConjI , (subst Eq 1 S)+)by simplemma Eq 2 E[meta-elim]: [F =2 G in v] =⇒ F = G
proof −
assume [F =2 G in v]
hence 1 : [∀ x. (λy. (|F ,x P ,y P |)) =1 (λy. (|G,x P ,y P |)) in v]
unfolding basic-identity 2 -def
apply − apply meta-solver by auto{
fix u v s w
obtain x where x-def : νυ x = v by (metis νυ-surj surj-def )obtain a where a-def :a = (λu s w. ∃ xa. νυ xa = u ∧ evalΠ2 F (νυ x) (νυ xa) s w)
by autoobtain b where b-def :90

b = (λu s w. ∃ xa. νυ xa = u ∧ evalΠ2 G (νυ x) (νυ xa) s w)
by autohave a = b unfolding a-def b-def
using 1 apply − apply meta-solverby (auto simp: meta-defs meta-aux makeΠ1 -inject)hence a u s w = b u s w by auto
hence (evalΠ2 F (νυ x) u s w) = (evalΠ2 G (νυ x) u s w)
unfolding a-def b-defby (metis (no-types, opaque-lifting) νυ-surj surj-def )hence (evalΠ2 F v u s w) = (evalΠ2 G v u s w)
unfolding x-def by auto}
hence (evalΠ2 F ) = (evalΠ2 G) by blast
thus F = G by (simp add: evalΠ2 -inject)qed
lemma Eq 2 S[meta-subst]: [F =2 G in v] = (F = G)using Eq 2 I Eq 2 E by auto
lemma Eq 2 -prop: [F =2 G in v] =⇒ [ϕ F in v] = [ϕ G in v]
using Eq 2 E by blast

A.5.15.5. Three-Place Relations
lemma Eq 3 I [meta-intro]: F = G =⇒ [F =3 G in v]
apply (simp add: meta-defs meta-aux conn-defs forall-ν-def basic-identity 3 -def )using MetaSolver.Eq 1 I valid-in.rep-eq by auto
lemma Eq 3 E[meta-elim]: [F =3 G in v] =⇒ F = G
proof −
assume [F =3 G in v]
hence 1 : [∀ x y. (λz. (|F ,x P ,y P ,z P |)) =1 (λz. (|G,x P ,y P ,z P |)) in v]
unfolding basic-identity 3 -def
apply − apply meta-solver by auto{
fix u v r s w
obtain x where x-def : νυ x = v by (metis νυ-surj surj-def )obtain y where y-def : νυ y = r by (metis νυ-surj surj-def )obtain a where a-def :a = (λu s w. ∃ xa. νυ xa = u ∧ evalΠ3 F (νυ x) (νυ y) (νυ xa) s w)
by autoobtain b where b-def :b = (λu s w. ∃ xa. νυ xa = u ∧ evalΠ3 G (νυ x) (νυ y) (νυ xa) s w)
by autohave a = b unfolding a-def b-def
using 1 apply − apply meta-solverby (auto simp: meta-defs meta-aux makeΠ1 -inject)hence a u s w = b u s w by auto
hence (evalΠ3 F (νυ x) (νυ y) u s w) = (evalΠ3 G (νυ x) (νυ y) u s w)
unfolding a-def b-defby (metis (no-types, opaque-lifting) νυ-surj surj-def )hence (evalΠ3 F v r u s w) = (evalΠ3 G v r u s w)
unfolding x-def y-def by auto}
hence (evalΠ3 F ) = (evalΠ3 G) by blast
thus F = G by (simp add: evalΠ3 -inject)qed
lemma Eq 3 S[meta-subst]: [F =3 G in v] = (F = G)using Eq 3 I Eq 3 E by auto
lemma Eq 3 -prop: [F =3 G in v] =⇒ [ϕ F in v] = [ϕ G in v]

91

using Eq 3 E by blast

A.5.15.6. Propositions
lemma Eq 0 I [meta-intro]: x = y =⇒ [x =0 y in v]
unfolding basic-identity 0 -def by (simp add: Eq 1 S)
lemma Eq 0 E[meta-elim]: [F =0 G in v] =⇒ F = G
proof −
assume [F =0 G in v]
hence [(λy. F ) =1 (λy. G) in v]
unfolding basic-identity 0 -def by simp
hence (λy. F ) = (λy. G)
using Eq 1 S by simp
hence (λu s w. (∃ x. νυ x = u) ∧ evalo F s w)
= (λu s w. (∃ x. νυ x = u) ∧ evalo G s w)
apply (simp add: meta-defs meta-aux)by (metis
V (no-types, lifting) UNIV-I makeΠ1 -inverse)
hence s w.(evalo F s w) = (evalo G s w)
by metishence (evalo F ) = (evalo G) by blast
thus F = G
by (metis evalo-inverse)qedlemma Eq 0 S[meta-subst]: [F =0 G in v] = (F = G)using Eq 0 I Eq 0 E by auto
lemma Eq 0 -prop: [F =0 G in v] =⇒ [ϕ F in v] = [ϕ G in v]
using Eq 0 E by blastend

A.6. General Identity
Remark. In order to define a general identity symbol that can act on all types of terms atype class is introduced which assumes the substitution property which is needed to derive thecorresponding axiom. This type class is instantiated for all relation types, individual terms andindividuals.

A.6.1. Type Classes
class identifiable =fixes identity :: 0a⇒ 0a⇒o (infixl = 63 )assumes l-identity:w |= x = y =⇒ w |= ϕ x =⇒ w |= ϕ y
begin
abbreviation notequal (infixl 6= 63 ) where
notequal ≡ λ x y . ¬(x = y)endclass quantifiable-and-identifiable = quantifiable + identifiable
begin
definition exists-unique::( 0a⇒o)⇒o (binder ∃ ! [8 ] 9 ) where
exists-unique ≡ λ ϕ . ∃ α . ϕ α & (∀ β. ϕ β → β = α)declare exists-unique-def [conn-defs]

92

end

A.6.2. Instantiations
instantiation κ :: identifiable
begin
definition identity-κ where identity-κ ≡ basic-identity κ
instance proof
fix x y :: κ and w ϕshow [x = y in w] =⇒ [ϕ x in w] =⇒ [ϕ y in w]
unfolding identity-κ-defusing MetaSolver.Eqκ-prop ..
qed
end
instantiation ν :: identifiable
begin
definition identity-ν where identity-ν ≡ λ x y . x P = y P
instance proof
fix α :: ν and β :: ν and v ϕassume v |= α = βhence v |= αP = β P
unfoldingidentity-ν-def by autoVhence ϕ.(v |= ϕ (αP )) =⇒ (v |= ϕ (β P ))using l-identity by auto
hence (v |= ϕ (rep (αP ))) =⇒ (v |= ϕ (rep (β P )))by mesonthus (v |= ϕ α) =⇒ (v |= ϕ β)by (simp only: rep-proper-id)
qed
end
instantiation Π1 :: identifiable
begin
definition identity-Π1 where identity-Π1 ≡ basic-identity 1
instance proof
fix F G :: Π1 and w ϕshow (w |= F = G) =⇒ (w |= ϕ F ) =⇒ (w |= ϕ G)
unfolding identity-Π1 -def using MetaSolver.Eq 1 -prop ..
qed
end
instantiation Π2 :: identifiable
begin
definition identity-Π2 where identity-Π2 ≡ basic-identity 2
instance proof
fix F G :: Π2 and w ϕshow (w |= F = G) =⇒ (w |= ϕ F ) =⇒ (w |= ϕ G)
unfolding identity-Π2 -def using MetaSolver.Eq 2 -prop ..
qed
end
instantiation Π3 :: identifiable
begin
definition identity-Π3 where identity-Π3 ≡ basic-identity 3
instance proof
fix F G :: Π3 and w ϕshow (w |= F = G) =⇒ (w |= ϕ F ) =⇒ (w |= ϕ G)

93

unfolding identity-Π3 -def using MetaSolver.Eq 3 -prop ..
qed
end
instantiation o :: identifiable
begin
definition identity-o where identity-o ≡ basic-identity 0
instance proof
fix F G :: o and w ϕshow (w |= F = G) =⇒ (w |= ϕ F ) =⇒ (w |= ϕ G)
unfolding identity-o-def using MetaSolver.Eq 0 -prop ..
qed
end
instance ν :: quantifiable-and-identifiable ..
instance Π1 :: quantifiable-and-identifiable ..
instance Π2 :: quantifiable-and-identifiable ..
instance Π3 :: quantifiable-and-identifiable ..
instance o :: quantifiable-and-identifiable ..

A.6.3. New Identity Definitions
Remark. The basic definitions of identity use type specific quantifiers and identity symbols.
Equivalent definitions that use the general identity symbol and general quantifiers are provided.
named-theorems identity-defs
lemma identity E -def [identity-defs]:
basic-identity E ≡ λ2 (λx y. (|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |)))
unfolding basic-identity E -def forall-Π1 -def by simp
lemma identity E -infix-def [identity-defs]:
x =E y ≡ (|basic-identity E ,x,y|) using basic-identity E -infix-def .
lemma identity κ -def [identity-defs]:(=) ≡ λx y. x =E y ∨ (|A!,x|) & (|A!,y|) & (∀ F . {|x,F |} ≡ {|y,F |})unfolding identity-κ-def basic-identity κ -def forall-Π1 -def by simp
lemma identity ν -def [identity-defs]:(=) ≡ λx y. (x P ) =E (y P ) ∨ (|A!,x P |) & (|A!,y P |) & (∀ F . {|x P ,F |} ≡ {|y P ,F |})unfolding identity-ν-def identity κ -def by simp
lemma identity 1 -def [identity-defs]:(=) ≡ λF G. (∀ x . {|x P ,F |} ≡ {|x P ,G|})
unfolding identity-Π1 -def basic-identity 1 -def forall-ν-def by simp
lemma identity 2 -def [identity-defs]:(=) ≡ λF G. ∀ x. (λy. (|F ,x P ,y P |)) = (λy. (|G,x P ,y P |))& (λy. (|F ,y P ,x P |)) = (λy. (|G,y P ,x P |))unfolding identity-Π2 -def identity-Π1 -def basic-identity 2 -def forall-ν-def by simp
lemma identity 3 -def [identity-defs]:(=) ≡ λF G. ∀ x y. (λz. (|F ,z P ,x P ,y P |)) = (λz. (|G,z P ,x P ,y P |))& (λz. (|F ,x P ,z P ,y P |)) = (λz. (|G,x P ,z P ,y P |))& (λz. (|F ,x P ,y P ,z P |)) = (λz. (|G,x P ,y P ,z P |))unfolding identity-Π3 -def identity-Π1 -def basic-identity 3 -def forall-ν-def by simp
lemma identity o -def [identity-defs]: (=) ≡ λF G. (λy. F ) = (λy. G)
unfolding identity-o-def identity-Π1 -def basic-identity 0 -def by simp

A.7. The Axioms of PLM
Remark. The axioms of PLM can now be derived from the Semantics and the model structure.

94

locale Axioms
begininterpretation MetaSolver .
interpretation Semantics .
named-theorems axiom

Remark. The special syntax [[-]] is introduced for stating the axioms. Modally-fragile axioms
are stated with the syntax for actual validity [-].
definition axiom :: o⇒bool ([[-]]) where axiom ≡ λ ϕ . ∀ v . [ϕ in v]
method axiom-meta-solver = ((((unfold axiom-def )?, rule allI ) | (unfold actual-validity-def )?), meta-solver,(simp | (auto; fail))?)A.7.1. Closures
Remark. Rules resembling the concepts of closures in PLM are derived. Theorem attributes
are introduced to aid in the instantiation of the axioms.
lemma axiom-instance[axiom]: [[ϕ]] =⇒ [ϕ in v]
unfolding axiom-def by simpVlemma closures-universal[axiom]: ( x.[[ϕ x]]) =⇒ [[∀ x. ϕ x]]
by axiom-meta-solver
lemma closures-actualization[axiom]: [[ϕ]] =⇒ [[A ϕ]]by axiom-meta-solver
lemma closures-necessitation[axiom]: [[ϕ]] =⇒ [[ ϕ]]by axiom-meta-solver
lemma necessitation-averse-axiom-instance[axiom]: [ϕ] =⇒ [ϕ in dw]
by axiom-meta-solverVlemma necessitation-averse-closures-universal[axiom]: ( x.[ϕ x]) =⇒ [∀ x. ϕ x]
by axiom-meta-solver
attribute-setup axiom-instance = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm axiom-instance}))›
attribute-setup necessitation-averse-axiom-instance = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm necessitation-averse-axiom-instance}))›
attribute-setup axiom-necessitation = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm closures-necessitation}))›attribute-setup axiom-actualization = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm closures-actualization}))›attribute-setup axiom-universal = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm closures-universal}))›95

A.7.2. Axioms for Negations and Conditionals
lemma pl-1 [axiom]:[[ϕ → (ψ → ϕ)]]by axiom-meta-solver
lemma pl-2 [axiom]:[[(ϕ → (ψ → χ)) → ((ϕ → ψ) → (ϕ → χ))]]by axiom-meta-solver
lemma pl-3 [axiom]:[[(¬ϕ → ¬ψ) → ((¬ϕ → ψ) → ϕ)]]by axiom-meta-solver

A.7.3. Axioms of Identity
lemma l-identity[axiom]:[[α = β → (ϕ α → ϕ β)]]using l-identity apply − by axiom-meta-solver

A.7.4. Axioms of Quantification
lemma cqt-1 [axiom]:[[(∀ α. ϕ α) → ϕ α]]
by axiom-meta-solver
lemma cqt-1-κ[axiom]:[[(∀ α. ϕ (αP )) → ((∃ β . (β P ) = α) → ϕ α)]]proof −{
fix v
assume 1 : [(∀ α. ϕ (αP )) in v]
assume [(∃ β . (β P ) = α) in v]
then obtain β where 2 :[(β P ) = α in v] by (rule ExERule)hence [ϕ (β P ) in v] using 1 AllE by fasthence [ϕ α in v]
using l-identity[where ϕ=ϕ, axiom-instance]
ImplS 2 by simp}
thus [[(∀ α. ϕ (αP )) → ((∃ β . (β P ) = α) → ϕ α)]]unfolding axiom-def using ImplI by blastqed
lemma cqt-3 [axiom]:[[(∀ α. ϕ α → ψ α) → ((∀ α. ϕ α) → (∀ α. ψ α))]]by axiom-meta-solver
lemma cqt-4 [axiom]:[[ϕ → (∀ α. ϕ)]]by axiom-meta-solver
inductive SimpleExOrEnc
where SimpleExOrEnc (λ x . (|F ,x|))| SimpleExOrEnc (λ x . (|F ,x,y|))| SimpleExOrEnc (λ x . (|F ,y,x|))| SimpleExOrEnc (λ x . (|F ,x,y,z|))| SimpleExOrEnc (λ x . (|F ,y,x,z|))| SimpleExOrEnc (λ x . (|F ,y,z,x|))| SimpleExOrEnc (λ x . {|x,F |})lemma cqt-5 [axiom]:96

assumes SimpleExOrEnc ψshows [[(ψ (ιx . ϕ x)) → (∃ α. (αP ) = (ιx . ϕ x))]]
proof −
have ∀ w . ([(ψ (ιx . ϕ x)) in w] −→ (∃ o1 . Some o1 = d κ (ιx . ϕ x)))using assms apply induct by (meta-solver;metis)+thus ?thesis
apply − unfolding identity-κ-def
apply axiom-meta-solverusing d κ -proper by autoqed
lemma cqt-5-mod[axiom]:assumes SimpleExOrEnc ψshows [[ψ τ → (∃ α . (αP ) = τ )]]proof −
have ∀ w . ([(ψ τ ) in w] −→ (∃ o1 . Some o1 = d κ τ ))using assms apply induct by (meta-solver;metis)+thus ?thesis
apply − unfolding identity-κ-def
apply axiom-meta-solverusing d κ -proper by autoqed

A.7.5. Axioms of Actuality
lemma logic-actual[axiom]: [(Aϕ) ≡ ϕ]by axiom-meta-solver
lemma [[(Aϕ) ≡ ϕ]]nitpick[user-axioms, expect = genuine, card = 1 , card i = 2 ]oops — Counter-model by nitpick
lemma logic-actual-nec-1 [axiom]:[[A¬ϕ ≡ ¬Aϕ]]by axiom-meta-solver
lemma logic-actual-nec-2 [axiom]:[[(A(ϕ → ψ)) ≡ (Aϕ → Aψ)]]by axiom-meta-solver
lemma logic-actual-nec-3 [axiom]:[[A(∀ α. ϕ α) ≡ (∀ α. A(ϕ α))]]by axiom-meta-solver
lemma logic-actual-nec-4 [axiom]:[[Aϕ ≡ AAϕ]]by axiom-meta-solver

A.7.6. Axioms of Necessity
lemma qml-1 [axiom]:[[(ϕ → ψ) → (ϕ → ψ)]]by axiom-meta-solver
lemma qml-2 [axiom]:[[ϕ → ϕ]]by axiom-meta-solver
lemma qml-3 [axiom]:[[♦ϕ → ♦ϕ]]by axiom-meta-solver
lemma qml-4 [axiom]:[[♦(∃ x. (|E!,x P |) & ♦¬(|E!,x P |)) & ♦¬(∃ x. (|E!,x P |) & ♦¬(|E!,x P |))]]
unfolding axiom-def

97

using PossiblyContingentObjectExistsAxiom
PossiblyNoContingentObjectExistsAxiom
apply (simp add: meta-defs meta-aux conn-defs forall-ν-def
split: ν.split υ.split)by (metis νυ-ων-is-ωυ υ.distinct(1 ) υ.inject(1 ))A.7.7. Axioms of Necessity and Actuality
lemma qml-act-1 [axiom]:[[Aϕ → Aϕ]]by axiom-meta-solver
lemma qml-act-2 [axiom]:[[ϕ ≡ A(ϕ)]]by axiom-meta-solver

A.7.8. Axioms of Descriptions
lemma descriptions[axiom]:[[x P = (ιx. ϕ x) ≡ (∀ z.(A(ϕ z) ≡ z = x))]]
unfolding axiom-def
proof (rule allI , rule EquivI ; rule)
fix v
assume [x P = (ιx. ϕ x) in v]
moreover hence 1 :∃ o1 o2 . Some o1 = d κ (x P ) ∧ Some o2 = d κ (ιx. ϕ x) ∧ o1 = o2apply − unfolding identity-κ-def by meta-solver
then obtain o1 o2 where 2 :Some o1 = d κ (x P ) ∧ Some o2 = d κ (ιx. ϕ x) ∧ o1 = o2
by autohence 3 :(∃ x .((w 0 |= ϕ x) ∧ (∀ y. (w 0 |= ϕ y) −→ y = x)))∧ d κ (ιx. ϕ x) = Some (THE x. (w 0 |= ϕ x))
using D3 by (metis option.distinct(1 ))then obtain X where 4 :((w 0 |= ϕ X ) ∧ (∀ y. (w 0 |= ϕ y) −→ y = X ))by automoreover have o1 = (THE x. (w 0 |= ϕ x))
using 2 3 by auto
ultimately have 5 : X = o1
by (metis (mono-tags) theI )have ∀ z . [Aϕ z in v] = [(z P ) = (x P ) in v]
proof
fix z
have [Aϕ z in v] =⇒ [(z P ) = (x P ) in v]
unfolding identity-κ-def apply meta-solverusing 4 5 2 d κ -proper w 0 -def by auto
moreover have [(z P ) = (x P ) in v] =⇒ [Aϕ z in v]
unfolding identity-κ-def apply meta-solverusing 2 4 5
by (simp add: d κ -proper w 0 -def )ultimately show [Aϕ z in v] = [(z P ) = (x P ) in v]
by autoqed
thus [∀ z. Aϕ z ≡ (z) = (x) in v]
unfolding identity-ν-defby (simp add: AllI EquivS)
next
fix v

98

assumeV[∀ z. Aϕ z ≡ (z) = (x) in v]
hence z. (dw |= ϕ z) = (∃ o1 o2 . Some o1 = d κ (z P )∧ Some o2 = d κ (x P ) ∧ o1 = o2 )apply − unfolding identity-ν-def identity-κ-def by meta-solver
hence ∀ z . (dw |= ϕ z) = (z = x)by (simp add: d κ -proper)
moreover hence x = (THE z . (dw |= ϕ z)) by simp
ultimately have x P = (ιx. ϕ x)
using D3 d κ -inject d κ -proper w 0 -def by presburger
thus [x P = (ιx. ϕ x) in v]
using EqκS unfolding identity-κ-def by (metis d κ -proper)qed

A.7.9. Axioms for Complex Relation Terms
lemma lambda-predicates-1 [axiom]:(λ x . ϕ x) = (λ y . ϕ y) ..
lemma lambda-predicates-2-1 [axiom]:assumes IsProperInX ϕshows [[(|λ x . ϕ (x P ), x P |) ≡ ϕ (x P )]]apply axiom-meta-solverusing D5-1 [OF assms] d κ -proper propex 1
by metislemma lambda-predicates-2-2 [axiom]:assumes IsProperInXY ϕshows [[(|(λ2 (λ x y . ϕ (x P ) (y P ))), x P , y P |) ≡ ϕ (x P ) (y P )]]apply axiom-meta-solverusing D5-2 [OF assms] d κ -proper propex 2
by metislemma lambda-predicates-2-3 [axiom]:assumes IsProperInXYZ ϕshows [[(|(λ3 (λ x y z . ϕ (x P ) (y P ) (z P ))),x P ,y P ,z P |) ≡ ϕ (x P ) (y P ) (z P )]]proof −
have [[(|(λ3 (λ x y z . ϕ (x P ) (y P ) (z P ))),x P ,y P ,z P |) → ϕ (x P ) (y P ) (z P )]]apply axiom-meta-solver using D5-3 [OF assms] by auto
moreover have[[ϕ (x P ) (y P ) (z P ) → (|(λ3 (λ x y z . ϕ (x P ) (y P ) (z P ))),x P ,y P ,z P |)]]
apply axiom-meta-solverusing D5-3 [OF assms] d κ -proper propex 3by (metis (no-types, lifting))
ultimately show ?thesis unfolding axiom-def equiv-def ConjS by blastqed
lemma lambda-predicates-3-0 [axiom]:[[(λ0 ϕ) = ϕ]]unfolding identity-defs
apply axiom-meta-solverby (simp add: meta-defs meta-aux)
lemma lambda-predicates-3-1 [axiom]:[[(λ x . (|F , x P |)) = F ]]unfolding axiom-def
apply (rule allI )unfolding identity-Π1 -def apply (rule Eq 1 I )using D4-1 d 1 -inject by simp

99

lemma lambda-predicates-3-2 [axiom]:[[(λ2 (λ x y . (|F , x P , y P |))) = F ]]unfolding axiom-def
apply (rule allI )unfolding identity-Π2 -def apply (rule Eq 2 I )using D4-2 d 2 -inject by simp
lemma lambda-predicates-3-3 [axiom]:[[(λ3 (λ x y z . (|F , x P , y P , z P |))) = F ]]unfolding axiom-def
apply (rule allI )unfolding identity-Π3 -def apply (rule Eq 3 I )using D4-3 d 3 -inject by simp
lemma lambda-predicates-4-0[axiom]:V
assumes x.[(A(ϕ x ≡ ψ x)) in v]
shows [[(λ0 (χ (ιx. ϕ x)) = λ0 (χ (ιx. ψ x)))]]
unfolding axiom-def identity-o-def apply − apply (rule allI ; rule Eq 0 I )using TheEqI [OF assms[THEN ActualE, THEN EquivE]] by auto
lemma lambda-predicates-4-1[axiom]:V
assumes x.[(A(ϕ x ≡ ψ x)) in v]
shows [[((λ x . χ (ιx. ϕ x) x) = (λ x . χ (ιx. ψ x) x))]]
unfolding axiom-def identity-Π1 -def apply − apply (rule allI ; rule Eq 1 I )using TheEqI [OF assms[THEN ActualE, THEN EquivE]] by auto
lemma lambda-predicates-4-2[axiom]:V
assumes x.[(A(ϕ x ≡ ψ x)) in v]
shows [[((λ2 (λ x y . χ (ιx. ϕ x) x y)) = (λ2 (λ x y . χ (ιx. ψ x) x y)))]]
unfolding axiom-def identity-Π2 -def apply − apply (rule allI ; rule Eq 2 I )using TheEqI [OF assms[THEN ActualE, THEN EquivE]] by auto
lemma lambda-predicates-4-3[axiom]:V
assumes x.[(A(ϕ x ≡ ψ x)) in v]
shows [[(λ3 (λ x y z . χ (ιx. ϕ x) x y z)) = (λ3 (λ x y z . χ (ιx. ψ x) x y z))]]unfolding axiom-def identity-Π3 -def apply − apply (rule allI ; rule Eq 3 I )using TheEqI [OF assms[THEN ActualE, THEN EquivE]] by auto

A.7.10. Axioms of Encoding
lemma encoding[axiom]:[[{|x,F |} → {|x,F |}]]
by axiom-meta-solver
lemma nocoder[axiom]:[[(|O!,x|) → ¬(∃ F . {|x,F |})]]
unfolding axiom-def
apply (rule allI , rule ImplI , subst (asm) OrdS)
apply meta-solver unfolding en-defby (metis ν.simps(5 ) mem-Collect-eq option.sel)lemma A-objects[axiom]:[[∃ x. (|A!,x P |) & (∀ F . ({|x P ,F |} ≡ ϕ F ))]]
unfolding axiom-def
proof (rule allI , rule ExIRule)fix v
let ?x = αν { F . [ϕ F in v]}
have [(|A!,?x P |) in v] by (simp add: AbsS d κ -proper)
moreover have [(∀ F . {|?x P ,F |} ≡ ϕ F ) in v]

100

apply meta-solver unfolding en-def
using d 1 .rep-eq d κ -def d κ -proper evalΠ1 -inverse by auto
ultimately show [(|A!,?x P |) & (∀ F . {|?x P ,F |} ≡ ϕ F ) in v]
by (simp only: ConjS)
qed
end

A.8. Definitions
A.8.1. Property Negations
consts propnot :: 0a⇒ 0a (-− [90 ] 90 )overloading propnot 0 ≡ propnot :: Π0 ⇒Π0propnot 1 ≡ propnot :: Π1 ⇒Π1propnot 2 ≡ propnot :: Π2 ⇒Π2propnot 3 ≡ propnot :: Π3 ⇒Π3
begindefinition propnot 0 :: Π0 ⇒Π0 where
propnot 0 ≡ λ p . λ0 (¬p)
definition propnot 1 where
propnot 1 ≡ λ F . λ x . ¬(|F , x P |)definition propnot 2 where
propnot 2 ≡ λ F . λ2 (λ x y . ¬(|F , x P , y P |))definition propnot 3 where
propnot 3 ≡ λ F . λ3 (λ x y z . ¬(|F , x P , y P , z P |))end
named-theorems propnot-defs
declare propnot 0 -def [propnot-defs] propnot 1 -def [propnot-defs]
propnot 2 -def [propnot-defs] propnot 3 -def [propnot-defs]

A.8.2. Noncontingent and Contingent Relations
consts Necessary :: 0a⇒ooverloading Necessary 0 ≡ Necessary :: Π0 ⇒o
Necessary 1 ≡ Necessary :: Π1 ⇒o
Necessary 2 ≡ Necessary :: Π2 ⇒o
Necessary 3 ≡ Necessary :: Π3 ⇒o
begin
definition Necessary 0 where
Necessary 0 ≡ λ p . p
definition Necessary 1 :: Π1 ⇒o where
Necessary 1 ≡ λ F . (∀ x . (|F ,x P |))definition Necessary 2 where
Necessary 2 ≡ λ F . (∀ x y . (|F ,x P ,y P |))definition Necessary 3 where
Necessary 3 ≡ λ F . (∀ x y z . (|F ,x P ,y P ,z P |))end
named-theorems Necessary-defs
declare Necessary 0 -def [Necessary-defs] Necessary 1 -def [Necessary-defs]
Necessary 2 -def [Necessary-defs] Necessary 3 -def [Necessary-defs]
consts Impossible :: 0a⇒ooverloading Impossible 0 ≡ Impossible :: Π0 ⇒o
Impossible 1 ≡ Impossible :: Π1 ⇒o

101Impossible 2 ≡ Impossible :: Π2 ⇒o
Impossible 3 ≡ Impossible :: Π3 ⇒o
begin
definition Impossible 0 where
Impossible 0 ≡ λ p . ¬pdefinition Impossible 1 where
Impossible 1 ≡ λ F . (∀ x. ¬(|F ,x P |))definition Impossible 2 where
Impossible 2 ≡ λ F . (∀ x y. ¬(|F ,x P ,y P |))definition Impossible 3 where
Impossible 3 ≡ λ F . (∀ x y z. ¬(|F ,x P ,y P ,z P |))end
named-theorems Impossible-defs
declare Impossible 0 -def [Impossible-defs] Impossible 1 -def [Impossible-defs]
Impossible 2 -def [Impossible-defs] Impossible 3 -def [Impossible-defs]
definition NonContingent where
NonContingent ≡ λ F . (Necessary F ) ∨ (Impossible F )definition Contingent where
Contingent ≡ λ F . ¬(Necessary F ∨ Impossible F )definition ContingentlyTrue :: o⇒o where
ContingentlyTrue ≡ λ p . p & ♦¬p
definition ContingentlyFalse :: o⇒o where
ContingentlyFalse ≡ λ p . ¬p & ♦p
definition WeaklyContingent where
WeaklyContingent ≡ λ F . Contingent F & (∀ x. ♦(|F ,x P |) → (|F ,x P |))A.8.3. Null and Universal Objects
definition Null :: κ⇒o where
Null ≡ λ x . (|A!,x|) & ¬(∃ F . {|x, F |})definition Universal :: κ⇒o where
Universal ≡ λ x . (|A!,x|) & (∀ F . {|x, F |})definition NullObject :: κ (a∅ ) where
NullObject ≡ (ιx . Null (x P ))definition UniversalObject :: κ (aV ) where
UniversalObject ≡ (ιx . Universal (x P ))A.8.4. Propositional Properties
definition Propositional where
Propositional F ≡ ∃ p . F = (λ x . p)

A.8.5. Indiscriminate Properties
definition Indiscriminate :: Π1 ⇒o whereIndiscriminate ≡ λ F . ((∃ x . (|F ,x P |)) → (∀ x . (|F ,x P |)))

A.8.6. Miscellaneous
definition not-identical E :: κ⇒κ⇒o (infixl 6=E 63 )where not-identical E ≡ λ x y . (|(λ2 (λ x y . x P =E y P ))− , x, y|)102

A.9. The Deductive System PLM
declare meta-defs[no-atp] meta-aux[no-atp]
locale PLM = Axioms
begin

A.9.1. Automatic Solver
named-theorems PLM
named-theorems PLM-intro
named-theorems PLM-elim
named-theorems PLM-dest
named-theorems PLM-subst
method PLM-solver declares PLM-intro PLM-elim PLM-subst PLM-dest PLM= ((assumption | (match axiom in A: [[ϕ]] for ϕ ⇒ ‹fact A[axiom-instance]›)| fact PLM | rule PLM-intro | subst PLM-subst | subst (asm) PLM-subst| fastforce | safe | drule PLM-dest | erule PLM-elim); (PLM-solver)?)

A.9.2. Modus Ponens
lemma modus-ponens[PLM ]:[[[ϕ in v]; [ϕ → ψ in v]]] =⇒ [ψ in v]
by (simp add: Semantics.T5 )A.9.3. Axioms
interpretation Axioms .
declare axiom[PLM ]declare conn-defs[PLM ]A.9.4. (Modally Strict) Proofs and Derivations
lemma vdash-properties-6 [no-atp]:[[[ϕ in v]; [ϕ → ψ in v]]] =⇒ [ψ in v]
using modus-ponens .
lemma vdash-properties-9 [PLM ]:[ϕ in v] =⇒ [ψ → ϕ in v]
using modus-ponens pl-1 [axiom-instance] by blast
lemma vdash-properties-10 [PLM ]:[ϕ → ψ in v] =⇒ ([ϕ in v] =⇒ [ψ in v])
using vdash-properties-6 .
attribute-setup deduction = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm vdash-properties-10 }))›A.9.5. GEN and RN
lemma
rule-gen[PLM ]:V[[ α . [ϕ α in v]]] =⇒ [∀ α . ϕ α in v]
by (simp add: Semantics.T8 )lemma RN-2 [PLM ]:103

V( v . [ψ in v] =⇒ [ϕ in v]) =⇒ ([ψ in v] =⇒ [ϕ in v])
by (simp add: Semantics.T6 )lemma
RN [PLM ]:V( v . [ϕ in v]) =⇒ [ϕ in v]
using qml-3 [axiom-necessitation, axiom-instance] RN-2 by blast

A.9.6. Negations and Conditionals
lemma if-p-then-p[PLM ]:[ϕ → ϕ in v]
using pl-1 pl-2 vdash-properties-10 axiom-instance by blast
lemma deduction-theorem[PLM ,PLM-intro]:[[[ϕ in v] =⇒ [ψ in v]]] =⇒ [ϕ → ψ in v]
by (simp add: Semantics.T5 )lemmas CP = deduction-theorem
lemma ded-thm-cor-3 [PLM ]:[[[ϕ → ψ in v]; [ψ → χ in v]]] =⇒ [ϕ → χ in v]
by (meson pl-2 vdash-properties-10 vdash-properties-9 axiom-instance)lemma ded-thm-cor-4 [PLM ]:[[[ϕ → (ψ → χ) in v]; [ψ in v]]] =⇒ [ϕ → χ in v]
by (meson pl-2 vdash-properties-10 vdash-properties-9 axiom-instance)lemma useful-tautologies-1 [PLM ]:[¬¬ϕ → ϕ in v]
by (meson pl-1 pl-3 ded-thm-cor-3 ded-thm-cor-4 axiom-instance)lemma useful-tautologies-2 [PLM ]:[ϕ → ¬¬ϕ in v]
by (meson pl-1 pl-3 ded-thm-cor-3 useful-tautologies-1
vdash-properties-10 axiom-instance)lemma useful-tautologies-3 [PLM ]:[¬ϕ → (ϕ → ψ) in v]
by (meson pl-1 pl-2 pl-3 ded-thm-cor-3 ded-thm-cor-4 axiom-instance)lemma useful-tautologies-4 [PLM ]:[(¬ψ → ¬ϕ) → (ϕ → ψ) in v]
by (meson pl-1 pl-2 pl-3 ded-thm-cor-3 ded-thm-cor-4 axiom-instance)lemma useful-tautologies-5 [PLM ]:[(ϕ → ψ) → (¬ψ → ¬ϕ) in v]
by (metis CP useful-tautologies-4 vdash-properties-10 )lemma useful-tautologies-6 [PLM ]:[(ϕ → ¬ψ) → (ψ → ¬ϕ) in v]
by (metis CP useful-tautologies-4 vdash-properties-10 )lemma useful-tautologies-7 [PLM ]:[(¬ϕ → ψ) → (¬ψ → ϕ) in v]
using ded-thm-cor-3 useful-tautologies-4 useful-tautologies-5
useful-tautologies-6 by blast
lemma useful-tautologies-8 [PLM ]:[ϕ → (¬ψ → ¬(ϕ → ψ)) in v]
by (meson ded-thm-cor-3 CP useful-tautologies-5 )lemma useful-tautologies-9 [PLM ]:[(ϕ → ψ) → ((¬ϕ → ψ) → ψ) in v]
by (metis CP useful-tautologies-4 vdash-properties-10 )lemma useful-tautologies-10 [PLM ]:[(ϕ → ¬ψ) → ((ϕ → ψ) → ¬ϕ) in v]
by (metis ded-thm-cor-3 CP useful-tautologies-6 )104

lemma modus-tollens-1 [PLM ]:[[[ϕ → ψ in v]; [¬ψ in v]]] =⇒ [¬ϕ in v]
by (metis ded-thm-cor-3 ded-thm-cor-4 useful-tautologies-3
useful-tautologies-7 vdash-properties-10 )lemma modus-tollens-2 [PLM ]:[[[ϕ → ¬ψ in v]; [ψ in v]]] =⇒ [¬ϕ in v]
using modus-tollens-1 useful-tautologies-2
vdash-properties-10 by blast
lemma contraposition-1 [PLM ]:[ϕ → ψ in v] = [¬ψ → ¬ϕ in v]
using useful-tautologies-4 useful-tautologies-5
vdash-properties-10 by blast
lemma contraposition-2 [PLM ]:[ϕ → ¬ψ in v] = [ψ → ¬ϕ in v]
using contraposition-1 ded-thm-cor-3
useful-tautologies-1 by blast
lemma reductio-aa-1 [PLM ]:[[[¬ϕ in v] =⇒ [¬ψ in v]; [¬ϕ in v] =⇒ [ψ in v]]] =⇒ [ϕ in v]
using CP modus-tollens-2 useful-tautologies-1
vdash-properties-10 by blast
lemma reductio-aa-2 [PLM ]:[[[ϕ in v] =⇒ [¬ψ in v]; [ϕ in v] =⇒ [ψ in v]]] =⇒ [¬ϕ in v]
by (meson contraposition-1 reductio-aa-1 )lemma reductio-aa-3 [PLM ]:[[[¬ϕ → ¬ψ in v]; [¬ϕ → ψ in v]]] =⇒ [ϕ in v]
using reductio-aa-1 vdash-properties-10 by blast
lemma reductio-aa-4 [PLM ]:[[[ϕ → ¬ψ in v]; [ϕ → ψ in v]]] =⇒ [¬ϕ in v]
using reductio-aa-2 vdash-properties-10 by blast
lemma raa-cor-1 [PLM ]:[[[ϕ in v]; [¬ψ in v] =⇒ [¬ϕ in v]]] =⇒ ([ϕ in v] =⇒ [ψ in v])
using reductio-aa-1 vdash-properties-9 by blast
lemma raa-cor-2 [PLM ]:[[[¬ϕ in v]; [¬ψ in v] =⇒ [ϕ in v]]] =⇒ ([¬ϕ in v] =⇒ [ψ in v])
using reductio-aa-1 vdash-properties-9 by blast
lemma raa-cor-3 [PLM ]:[[[ϕ in v]; [¬ψ → ¬ϕ in v]]] =⇒ ([ϕ in v] =⇒ [ψ in v])
using raa-cor-1 vdash-properties-10 by blast
lemma raa-cor-4 [PLM ]:[[[¬ϕ in v]; [¬ψ → ϕ in v]]] =⇒ ([¬ϕ in v] =⇒ [ψ in v])
using raa-cor-2 vdash-properties-10 by blast

Remark. In contrast to PLM the classical introduction and elimination rules are proven before
the tautologies. The statements proven so far are sufficient for the proofs and using the derived
rules the tautologies can be derived automatically.
lemma intro-elim-1 [PLM ]:[[[ϕ in v]; [ψ in v]]] =⇒ [ϕ & ψ in v]
unfolding conj-def using ded-thm-cor-4 if-p-then-p modus-tollens-2 by blast
lemmas &I = intro-elim-1
lemma intro-elim-2-a[PLM ]:[ϕ & ψ in v] =⇒ [ϕ in v]
unfolding conj-def using CP reductio-aa-1 by blast
lemma intro-elim-2-b[PLM ]:105

[ϕ & ψ in v] =⇒ [ψ in v]
unfolding conj-def using pl-1 CP reductio-aa-1 axiom-instance by blast
lemmas &E = intro-elim-2-a intro-elim-2-b
lemma intro-elim-3-a[PLM ]:[ϕ in v] =⇒ [ϕ ∨ ψ in v]
unfolding disj-def using ded-thm-cor-4 useful-tautologies-3 by blast
lemma intro-elim-3-b[PLM ]:[ψ in v] =⇒ [ϕ ∨ ψ in v]
by (simp only: disj-def vdash-properties-9 )lemmas ∨I = intro-elim-3-a intro-elim-3-b
lemma intro-elim-4-a[PLM ]:[[[ϕ ∨ ψ in v]; [ϕ → χ in v]; [ψ → χ in v]]] =⇒ [χ in v]
unfolding disj-def by (meson reductio-aa-2 vdash-properties-10 )lemma intro-elim-4-b[PLM ]:[[[ϕ ∨ ψ in v]; [¬ϕ in v]]] =⇒ [ψ in v]
unfolding disj-def using vdash-properties-10 by blast
lemma intro-elim-4-c[PLM ]:[[[ϕ ∨ ψ in v]; [¬ψ in v]]] =⇒ [ϕ in v]
unfolding disj-def using raa-cor-2 vdash-properties-10 by blast
lemma intro-elim-4-d[PLM ]:[[[ϕ ∨ ψ in v]; [ϕ → χ in v]; [ψ → Θ in v]]] =⇒ [χ ∨ Θ in v]
unfolding disj-def using contraposition-1 ded-thm-cor-3 by blast
lemma intro-elim-4-e[PLM ]:[[[ϕ ∨ ψ in v]; [ϕ ≡ χ in v]; [ψ ≡ Θ in v]]] =⇒ [χ ∨ Θ in v]
unfolding equiv-def using &E(1 ) intro-elim-4-d by blast
lemmas ∨E = intro-elim-4-a intro-elim-4-b intro-elim-4-c intro-elim-4-d
lemma intro-elim-5 [PLM ]:[[[ϕ → ψ in v]; [ψ → ϕ in v]]] =⇒ [ϕ ≡ ψ in v]
by (simp only: equiv-def &I )lemmas ≡I = intro-elim-5
lemma intro-elim-6-a[PLM ]:[[[ϕ ≡ ψ in v]; [ϕ in v]]] =⇒ [ψ in v]
unfolding equiv-def using &E(1 ) vdash-properties-10 by blast
lemma intro-elim-6-b[PLM ]:[[[ϕ ≡ ψ in v]; [ψ in v]]] =⇒ [ϕ in v]
unfolding equiv-def using &E(2 ) vdash-properties-10 by blast
lemma intro-elim-6-c[PLM ]:[[[ϕ ≡ ψ in v]; [¬ϕ in v]]] =⇒ [¬ψ in v]
unfolding equiv-def using &E(2 ) modus-tollens-1 by blast
lemma intro-elim-6-d[PLM ]:[[[ϕ ≡ ψ in v]; [¬ψ in v]]] =⇒ [¬ϕ in v]
unfolding equiv-def using &E(1 ) modus-tollens-1 by blast
lemma intro-elim-6-e[PLM ]:[[[ϕ ≡ ψ in v]; [ψ ≡ χ in v]]] =⇒ [ϕ ≡ χ in v]
by (metis equiv-def ded-thm-cor-3 &E ≡I )lemma intro-elim-6-f [PLM ]:[[[ϕ ≡ ψ in v]; [ϕ ≡ χ in v]]] =⇒ [χ ≡ ψ in v]
by (metis equiv-def ded-thm-cor-3 &E ≡I )lemmas ≡E = intro-elim-6-a intro-elim-6-b intro-elim-6-c
intro-elim-6-d intro-elim-6-e intro-elim-6-f
lemma intro-elim-7 [PLM ]:[ϕ in v] =⇒ [¬¬ϕ in v]
using if-p-then-p modus-tollens-2 by blast
lemmas ¬¬I = intro-elim-7
lemma intro-elim-8 [PLM ]:[¬¬ϕ in v] =⇒ [ϕ in v]
using if-p-then-p raa-cor-2 by blast
lemmas ¬¬E = intro-elim-8

106context
begin
private lemma NotNotI [PLM-intro]:[ϕ in v] =⇒ [¬(¬ϕ) in v]
by (simp add: ¬¬I )private lemma NotNotD[PLM-dest]:[¬(¬ϕ) in v] =⇒ [ϕ in v]
using ¬¬E by blast
private lemma ImplI [PLM-intro]:([ϕ in v] =⇒ [ψ in v]) =⇒ [ϕ → ψ in v]
using CP .
private lemma ImplE[PLM-elim, PLM-dest]:[ϕ → ψ in v] =⇒ ([ϕ in v] =⇒ [ψ in v])
using modus-ponens .
private lemma ImplS[PLM-subst]:[ϕ → ψ in v] = ([ϕ in v] −→ [ψ in v])
using ImplI ImplE by blast
private lemmaVNotI [PLM-intro]:([ϕ in v] =⇒ ( ψ .[ψ in v])) =⇒ [¬ϕ in v]
using CP modus-tollens-2 by blast
private lemma NotE[PLM-elim,PLM-dest]:[¬ϕ in v] =⇒ ([ϕ in v] −→ (∀ ψ .[ψ in v]))using ∨I (2 ) ∨E(3 ) by blast
private lemma NotS[PLM-subst]:[¬ϕ in v] = ([ϕ in v] −→ (∀ ψ .[ψ in v]))using NotI NotE by blast
private lemma ConjI [PLM-intro]:[[[ϕ in v]; [ψ in v]]] =⇒ [ϕ & ψ in v]
using &I by blast
private lemma ConjE[PLM-elim,PLM-dest]:[ϕ & ψ in v] =⇒ (([ϕ in v] ∧ [ψ in v]))using CP &E by blast
private lemma ConjS[PLM-subst]:[ϕ & ψ in v] = (([ϕ in v] ∧ [ψ in v]))using ConjI ConjE by blast
private lemma DisjI [PLM-intro]:[ϕ in v] ∨ [ψ in v] =⇒ [ϕ ∨ ψ in v]
using ∨I by blast
private lemma DisjE[PLM-elim,PLM-dest]:[ϕ ∨ ψ in v] =⇒ [ϕ in v] ∨ [ψ in v]
using CP ∨E(1 ) by blast
private lemma DisjS[PLM-subst]:[ϕ ∨ ψ in v] = ([ϕ in v] ∨ [ψ in v])
using DisjI DisjE by blast
private lemma EquivI [PLM-intro]:[[[ϕ in v] =⇒ [ψ in v];[ψ in v] =⇒ [ϕ in v]]] =⇒ [ϕ ≡ ψ in v]
using CP ≡I by blast
private lemma EquivE[PLM-elim,PLM-dest]:[ϕ ≡ ψ in v] =⇒ (([ϕ in v] −→ [ψ in v]) ∧ ([ψ in v] −→ [ϕ in v]))using ≡E(1 ) ≡E(2 ) by blast
private lemma EquivS[PLM-subst]:[ϕ ≡ ψ in v] = ([ϕ in v] ←→ [ψ in v])

107using EquivI EquivE by blast
private lemma NotOrD[PLM-dest]:¬[ϕ ∨ ψ in v] =⇒ ¬[ϕ in v] ∧ ¬[ψ in v]
using ∨I by blast
private lemma NotAndD[PLM-dest]:¬[ϕ & ψ in v] =⇒ ¬[ϕ in v] ∨ ¬[ψ in v]
using &I by blast
private lemma NotEquivD[PLM-dest]:¬[ϕ ≡ ψ in v] =⇒ [ϕ in v] 6= [ψ in v]
by (meson NotI contraposition-1 ≡I vdash-properties-9 )
privatelemma BoxI [PLM-intro]:V( v . [ϕ in v]) =⇒ [ϕ in v]
using RN by blast
private lemma NotBoxD[PLM-dest]:¬[ϕ in v] =⇒ (∃ v . ¬[ϕ in v])
using BoxI by blast
privatelemma AllI [PLM-intro]:V( x . [ϕ x in v]) =⇒ [∀ x . ϕ x in v]
using rule-gen by blast
lemma NotAllD[PLM-dest]:¬[∀ x . ϕ x in v] =⇒ (∃ x . ¬[ϕ x in v])
using AllI by fastforce
end
lemma oth-class-taut-1-a[PLM ]:[¬(ϕ & ¬ϕ) in v]
by PLM-solver
lemma oth-class-taut-1-b[PLM ]:[¬(ϕ ≡ ¬ϕ) in v]
by PLM-solver
lemma oth-class-taut-2 [PLM ]:[ϕ ∨ ¬ϕ in v]
by PLM-solver
lemma oth-class-taut-3-a[PLM ]:[(ϕ & ϕ) ≡ ϕ in v]
by PLM-solver
lemma oth-class-taut-3-b[PLM ]:[(ϕ & ψ) ≡ (ψ & ϕ) in v]
by PLM-solver
lemma oth-class-taut-3-c[PLM ]:[(ϕ & (ψ & χ)) ≡ ((ϕ & ψ) & χ) in v]
by PLM-solver
lemma oth-class-taut-3-d[PLM ]:[(ϕ ∨ ϕ) ≡ ϕ in v]
by PLM-solver
lemma oth-class-taut-3-e[PLM ]:[(ϕ ∨ ψ) ≡ (ψ ∨ ϕ) in v]
by PLM-solver
lemma oth-class-taut-3-f [PLM ]:[(ϕ ∨ (ψ ∨ χ)) ≡ ((ϕ ∨ ψ) ∨ χ) in v]
by PLM-solver
lemma oth-class-taut-3-g[PLM ]:[(ϕ ≡ ψ) ≡ (ψ ≡ ϕ) in v]
by PLM-solver
lemma oth-class-taut-3-i[PLM ]:108

[(ϕ ≡ (ψ ≡ χ)) ≡ ((ϕ ≡ ψ) ≡ χ) in v]
by PLM-solver
lemma oth-class-taut-4-a[PLM ]:[ϕ ≡ ϕ in v]
by PLM-solver
lemma oth-class-taut-4-b[PLM ]:[ϕ ≡ ¬¬ϕ in v]
by PLM-solver
lemma oth-class-taut-5-a[PLM ]:[(ϕ → ψ) ≡ ¬(ϕ & ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-5-b[PLM ]:[¬(ϕ → ψ) ≡ (ϕ & ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-5-c[PLM ]:[(ϕ → ψ) → ((ψ → χ) → (ϕ → χ)) in v]
by PLM-solver
lemma oth-class-taut-5-d[PLM ]:[(ϕ ≡ ψ) ≡ (¬ϕ ≡ ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-5-e[PLM ]:[(ϕ ≡ ψ) → ((ϕ → χ) ≡ (ψ → χ)) in v]
by PLM-solver
lemma oth-class-taut-5-f [PLM ]:[(ϕ ≡ ψ) → ((χ → ϕ) ≡ (χ → ψ)) in v]
by PLM-solver
lemma oth-class-taut-5-g[PLM ]:[(ϕ ≡ ψ) → ((ϕ ≡ χ) ≡ (ψ ≡ χ)) in v]
by PLM-solver
lemma oth-class-taut-5-h[PLM ]:[(ϕ ≡ ψ) → ((χ ≡ ϕ) ≡ (χ ≡ ψ)) in v]
by PLM-solver
lemma oth-class-taut-5-i[PLM ]:[(ϕ ≡ ψ) ≡ ((ϕ & ψ) ∨ (¬ϕ & ¬ψ)) in v]
by PLM-solver
lemma oth-class-taut-5-j[PLM ]:[(¬(ϕ ≡ ψ)) ≡ ((ϕ & ¬ψ) ∨ (¬ϕ & ψ)) in v]
by PLM-solver
lemma oth-class-taut-5-k[PLM ]:[(ϕ → ψ) ≡ (¬ϕ ∨ ψ) in v]
by PLM-solver
lemma oth-class-taut-6-a[PLM ]:[(ϕ & ψ) ≡ ¬(¬ϕ ∨ ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-6-b[PLM ]:[(ϕ ∨ ψ) ≡ ¬(¬ϕ & ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-6-c[PLM ]:[¬(ϕ & ψ) ≡ (¬ϕ ∨ ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-6-d[PLM ]:[¬(ϕ ∨ ψ) ≡ (¬ϕ & ¬ψ) in v]
by PLM-solver
lemma oth-class-taut-7-a[PLM ]:[(ϕ & (ψ ∨ χ)) ≡ ((ϕ & ψ) ∨ (ϕ & χ)) in v]
by PLM-solver109lemma oth-class-taut-7-b[PLM ]:[(ϕ ∨ (ψ & χ)) ≡ ((ϕ ∨ ψ) & (ϕ ∨ χ)) in v]
by PLM-solver
lemma oth-class-taut-8-a[PLM ]:[((ϕ & ψ) → χ) → (ϕ → (ψ → χ)) in v]
by PLM-solver
lemma oth-class-taut-8-b[PLM ]:[(ϕ → (ψ → χ)) → ((ϕ & ψ) → χ) in v]
by PLM-solver
lemma oth-class-taut-9-a[PLM ]:[(ϕ & ψ) → ϕ in v]
by PLM-solver
lemma oth-class-taut-9-b[PLM ]:[(ϕ & ψ) → ψ in v]
by PLM-solver
lemma oth-class-taut-10-a[PLM ]:[ϕ → (ψ → (ϕ & ψ)) in v]
by PLM-solver
lemma oth-class-taut-10-b[PLM ]:[(ϕ → (ψ → χ)) ≡ (ψ → (ϕ → χ)) in v]
by PLM-solver
lemma oth-class-taut-10-c[PLM ]:[(ϕ → ψ) → ((ϕ → χ) → (ϕ → (ψ & χ))) in v]
by PLM-solver
lemma oth-class-taut-10-d[PLM ]:[(ϕ → χ) → ((ψ → χ) → ((ϕ ∨ ψ) → χ)) in v]
by PLM-solver
lemma oth-class-taut-10-e[PLM ]:[(ϕ → ψ) → ((χ → Θ) → ((ϕ & χ) → (ψ & Θ))) in v]
by PLM-solver
lemma oth-class-taut-10-f [PLM ]:[((ϕ & ψ) ≡ (ϕ & χ)) ≡ (ϕ → (ψ ≡ χ)) in v]
by PLM-solver
lemma oth-class-taut-10-g[PLM ]:[((ϕ & ψ) ≡ (χ & ψ)) ≡ (ψ → (ϕ ≡ χ)) in v]
by PLM-solver
attribute-setup equiv-lr = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm ≡E(1 )}))›
attribute-setup equiv-rl = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm ≡E(2 )}))›
attribute-setup equiv-sym = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm oth-class-taut-3-g[equiv-lr]}))›attribute-setup conj1 = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm &E(1 )}))

110

›
attribute-setup conj2 = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm &E(2 )}))›
attribute-setup conj-sym = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm oth-class-taut-3-b[equiv-lr]}))›A.9.7. Identity
lemma id-eq-prop-prop-1 [PLM ]:[(F ::Π1 ) = F in v]
unfolding identity-defs by PLM-solver
lemma id-eq-prop-prop-2 [PLM ]:[((F ::Π1 ) = G) → (G = F ) in v]
by (meson id-eq-prop-prop-1 CP ded-thm-cor-3 l-identity[axiom-instance])
lemma id-eq-prop-prop-3 [PLM ]:[(((F ::Π1 ) = G) & (G = H )) → (F = H ) in v]
by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
lemma id-eq-prop-prop-4-a[PLM ]:[(F ::Π2 ) = F in v]
unfolding identity-defs by PLM-solver
lemma id-eq-prop-prop-4-b[PLM ]:[(F ::Π3 ) = F in v]
unfolding identity-defs by PLM-solver
lemma id-eq-prop-prop-5-a[PLM ]:[((F ::Π2 ) = G) → (G = F ) in v]
by (meson id-eq-prop-prop-4-a CP ded-thm-cor-3 l-identity[axiom-instance])
lemma id-eq-prop-prop-5-b[PLM ]:[((F ::Π3 ) = G) → (G = F ) in v]
by (meson id-eq-prop-prop-4-b CP ded-thm-cor-3 l-identity[axiom-instance])
lemma id-eq-prop-prop-6-a[PLM ]:[(((F ::Π2 ) = G) & (G = H )) → (F = H ) in v]
by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
lemma id-eq-prop-prop-6-b[PLM ]:[(((F ::Π3 ) = G) & (G = H )) → (F = H ) in v]
by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
lemma id-eq-prop-prop-7 [PLM ]:[(p::Π0 ) = p in v]
unfolding identity-defs by PLM-solver
lemma id-eq-prop-prop-7-b[PLM ]:[(p::o) = p in v]
unfolding identity-defs by PLM-solver
lemma id-eq-prop-prop-8 [PLM ]:[((p::Π0 ) = q) → (q = p) in v]
by (meson id-eq-prop-prop-7 CP ded-thm-cor-3 l-identity[axiom-instance])
lemma id-eq-prop-prop-8-b[PLM ]:[((p::o) = q) → (q = p) in v]
by (meson id-eq-prop-prop-7-b CP ded-thm-cor-3 l-identity[axiom-instance])
lemma id-eq-prop-prop-9 [PLM ]:[(((p::Π0 ) = q) & (q = r)) → (p = r) in v]
by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
lemma id-eq-prop-prop-9-b[PLM ]:[(((p::o) = q) & (q = r)) → (p = r) in v]

111

by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
lemma eq-E-simple-1 [PLM ]:[(x =E y) ≡ ((|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|))) in v]
proof (rule ≡I ; rule CP)
assume 1 : [x =E y in v]
have [∀ x y . ((x P ) =E (y P )) ≡ ((|O!,x P |) & (|O!,y P |)& (∀ F . (|F ,x P |) ≡ (|F ,y P |))) in v]
unfolding identity E -infix-def identity E -def
apply (rule lambda-predicates-2-2 [axiom-universal, axiom-universal, axiom-instance])by show-proper
moreover have [∃ α . (αP ) = x in v]
apply (rule cqt-5-mod[where ψ=λ x . x =E y, axiom-instance,deduction])
unfolding identity E -infix-def
apply (rule SimpleExOrEnc.intros)
using 1 unfolding identity E -infix-def by auto
moreover have [∃ β . (β P ) = y in v]
apply (rule cqt-5-mod[where ψ=λ y . x =E y,axiom-instance,deduction])
unfolding identity E -infix-def
apply (rule SimpleExOrEnc.intros) using 1
unfolding identity E -infix-def by auto
ultimately have [(x =E y) ≡ ((|O!,x|) & (|O!,y|)& (∀ F . (|F ,x|) ≡ (|F ,y|))) in v]
using cqt-1-κ[axiom-instance,deduction, deduction] by meson
thus [((|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|))) in v]
using 1 ≡E(1 ) by blastnext
assume 1 : [(|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
have [∀ x y . ((x P ) =E (y P )) ≡ ((|O!,x P |) & (|O!,y P |)& (∀ F . (|F ,x P |) ≡ (|F ,y P |))) in v]
unfolding identity E -def identity E -infix-def
apply (rule lambda-predicates-2-2 [axiom-universal, axiom-universal, axiom-instance])by show-proper
moreover have [∃ α . (αP ) = x in v]
apply (rule cqt-5-mod[where ψ=λ x . (|O!,x|),axiom-instance,deduction])
apply (rule SimpleExOrEnc.intros)
using 1 [conj1 ,conj1 ] by auto
moreover have [∃ β . (β P ) = y in v]
apply (rule cqt-5-mod[where ψ=λ y . (|O!,y|),axiom-instance,deduction])
apply (rule SimpleExOrEnc.intros)
using 1 [conj1 ,conj2 ] by auto
ultimately have [(x =E y) ≡ ((|O!,x|) & (|O!,y|)& (∀ F . (|F ,x|) ≡ (|F ,y|))) in v]
using cqt-1-κ[axiom-instance,deduction, deduction] by meson
thus [(x =E y) in v] using 1 ≡E(2 ) by blastqed
lemma eq-E-simple-2 [PLM ]:[(x =E y) → (x = y) in v]
unfolding identity-defs by PLM-solver
lemma eq-E-simple-3 [PLM ]:[(x = y) ≡ (((|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)))∨ ((|A!,x|) & (|A!,y|) & (∀ F . {|x,F |} ≡ {|y,F |}))) in v]
using eq-E-simple-1
apply − unfolding identity-defs
by PLM-solver
lemma id-eq-obj-1 [PLM ]: [(x P ) = (x P ) in v]
proof −

112

have [(♦(|E!, x P |)) ∨ (¬♦(|E!, x P |)) in v]
using PLM .oth-class-taut-2 by simp
hence [(♦(|E!, x P |)) in v] ∨ [(¬♦(|E!, x P |)) in v]
using CP ∨E(1 ) by blast
moreover {assume [(♦(|E!, x P |)) in v]
hence [(|λx. ♦(|E!,x P |),x P |) in v]
apply (rule lambda-predicates-2-1 [axiom-instance, equiv-rl, rotated])by show-proper
hence [(|λx. ♦(|E!,x P |),x P |) & (|λx. ♦(|E!,x P |),x P |)& (∀ F . (|F ,x P |) ≡ (|F ,x P |)) in v]
apply − by PLM-solver
hence [(x P ) =E (x P ) in v]
using eq-E-simple-1 [equiv-rl] unfolding Ordinary-def by fast}
moreover {assume [(¬♦(|E!, x P |)) in v]
hence [(|λx. ¬♦(|E!,x P |),x P |) in v]
apply (rule lambda-predicates-2-1 [axiom-instance, equiv-rl, rotated])by show-proper
hence [(|λx. ¬♦(|E!,x P |),x P |) & (|λx. ¬♦(|E!,x P |),x P |)& (∀ F . {|x P ,F |} ≡ {|x P ,F |}) in v]
apply − by PLM-solver}
ultimately show ?thesis unfolding identity-defs Ordinary-def Abstract-def
using ∨I by blastqed
lemma id-eq-obj-2 [PLM ]:[((x P ) = (y P )) → ((y P ) = (x P )) in v]
by (meson l-identity[axiom-instance] id-eq-obj-1 CP ded-thm-cor-3 )lemma id-eq-obj-3 [PLM ]:[((x P ) = (y P )) & ((y P ) = (z P )) → ((x P ) = (z P )) in v]
by (metis l-identity[axiom-instance] ded-thm-cor-4 CP &E)
end

Remark. To unify the statements of the properties of equality a type class is introduced.
class id-eq = quantifiable-and-identifiable +assumes id-eq-1 : [(x :: 0a) = x in v]
assumes id-eq-2 : [((x :: 0a) = y) → (y = x) in v]
assumes id-eq-3 : [((x :: 0a) = y) & (y = z) → (x = z) in v]
instantiation ν :: id-eq
begin
instance proof
fix x :: ν and v
show [x = x in v]
using PLM .id-eq-obj-1
by (simp add: identity-ν-def )next
fix x y::ν and v
show [x = y → y = x in v]
using PLM .id-eq-obj-2
by (simp add: identity-ν-def )next
fix x y z::ν and v
show [((x = y) & (y = z)) → x = z in v]
using PLM .id-eq-obj-3

113

by (simp add: identity-ν-def )qed
end
instantiation o :: id-eq
begin
instance proof
fix x :: o and v
show [x = x in v]
using PLM .id-eq-prop-prop-7 .
next
fix x y :: o and v
show [x = y → y = x in v]
using PLM .id-eq-prop-prop-8 .
next
fix x y z :: o and v
show [((x = y) & (y = z)) → x = z in v]
using PLM .id-eq-prop-prop-9 .
qed
end
instantiation Π1 :: id-eq
begin
instance proof
fix x :: Π1 and v
show [x = x in v]
using PLM .id-eq-prop-prop-1 .
next
fix x y :: Π1 and v
show [x = y → y = x in v]
using PLM .id-eq-prop-prop-2 .
next
fix x y z :: Π1 and v
show [((x = y) & (y = z)) → x = z in v]
using PLM .id-eq-prop-prop-3 .
qed
endinstantiation Π2 :: id-eq
begin
instance proof
fix x :: Π2 and v
show [x = x in v]
using PLM .id-eq-prop-prop-4-a .
next
fix x y :: Π2 and v
show [x = y → y = x in v]
using PLM .id-eq-prop-prop-5-a .
next
fix x y z :: Π2 and v
show [((x = y) & (y = z)) → x = z in v]
using PLM .id-eq-prop-prop-6-a .
qed
end
instantiation Π3 :: id-eq
begin
instance proof

114

fix x :: Π3 and v
show [x = x in v]
using PLM .id-eq-prop-prop-4-b .
next
fix x y :: Π3 and v
show [x = y → y = x in v]
using PLM .id-eq-prop-prop-5-b .
next
fix x y z :: Π3 and v
show [((x = y) & (y = z)) → x = z in v]
using PLM .id-eq-prop-prop-6-b .
qed
end
context PLM
beginlemma id-eq-1 [PLM ]:[(x:: 0a::id-eq) = x in v]
using id-eq-1 .
lemma id-eq-2 [PLM ]:[((x:: 0a::id-eq) = y) → (y = x) in v]
using id-eq-2 .
lemma id-eq-3 [PLM ]:[((x:: 0a::id-eq) = y) & (y = z) → (x = z) in v]
using id-eq-3 .
attribute-setup eq-sym = ‹Scan.succeed (Thm.rule-attribute [](fn - => fn thm => thm RS @{thm id-eq-2 [deduction]}))›lemma all-self-eq-1 [PLM ]:[(∀ α :: 0a::id-eq . α = α) in v]
by PLM-solver
lemma all-self-eq-2 [PLM ]:[∀ α :: 0a::id-eq . (α = α) in v]
by PLM-solver
lemma t-id-t-proper-1 [PLM ]:[τ = τ 0 → (∃ β . (β P ) = τ ) in v]
proof (rule CP)
assume [τ = τ 0 in v]
moreover {assume [τ =E τ 0 in v]
hence [∃ β . (β P ) = τ in v]
apply −
apply (rule cqt-5-mod[where ψ=λ τ . τ =E τ 0, axiom-instance, deduction])subgoal unfolding identity-defs by (rule SimpleExOrEnc.intros)by simp}moreover {assume [(|A!,τ |) & (|A!,τ 0|) & (∀ F . {|τ ,F |} ≡ {|τ 0,F |}) in v]
hence [∃ β . (β P ) = τ in v]
apply −
apply (rule cqt-5-mod[where ψ=λ τ . (|A!,τ |), axiom-instance, deduction])subgoal unfolding identity-defs by (rule SimpleExOrEnc.intros)
by PLM-solver

115

}
ultimately show [∃ β . (β P ) = τ in v] unfolding identity κ -defusing intro-elim-4-b reductio-aa-1 by blastqed
lemma t-id-t-proper-2 [PLM ]: [τ = τ 0 → (∃ β . (β P ) = τ 0) in v]
proof (rule CP)
assume [τ = τ 0 in v]
moreover {assume [τ =E τ 0 in v]
hence [∃ β . (β P ) = τ 0 in v]
apply −
apply (rule cqt-5-mod[where ψ=λ τ 0 . τ =E τ 0, axiom-instance, deduction])subgoal unfolding identity-defs by (rule SimpleExOrEnc.intros)by simp}moreover {assume [(|A!,τ |) & (|A!,τ 0|) & (∀ F . {|τ ,F |} ≡ {|τ 0,F |}) in v]
hence [∃ β . (β P ) = τ 0 in v]
apply −
apply (rule cqt-5-mod[where ψ=λ τ . (|A!,τ |), axiom-instance, deduction])subgoal unfolding identity-defs by (rule SimpleExOrEnc.intros)
by PLM-solver}
ultimately show [∃ β . (β P ) = τ 0 in v] unfolding identity κ -defusing intro-elim-4-b reductio-aa-1 by blastqed
lemma id-nec[PLM ]: [((α:: 0a::id-eq) = (β)) ≡ ((α) = (β)) in v]
apply (rule ≡I )
using l-identity[where ϕ = (λ β . ((α) = (β))), axiom-instance]
id-eq-1 RN ded-thm-cor-4 unfolding identity-ν-def
apply blast
using qml-2 [axiom-instance] by blast
lemma id-nec-desc[PLM ]:[((ιx. ϕ x) = (ιx. ψ x)) ≡ ((ιx. ϕ x) = (ιx. ψ x)) in v]
proof (cases [(∃ α. (αP ) = (ιx . ϕ x)) in v] ∧ [(∃ β. (β P ) = (ιx . ψ x)) in v])
assume [(∃ α. (αP ) = (ιx . ϕ x)) in v] ∧ [(∃ β. (β P ) = (ιx . ψ x)) in v]
then obtain α and β where[(αP ) = (ιx . ϕ x) in v] ∧ [(β P ) = (ιx . ψ x) in v]
apply − unfolding conn-defs by PLM-solver
moreover {moreover have [(α) = (β) ≡ ((α) = (β)) in v] by PLM-solver
ultimately have [((ιx. ϕ x) = (β P ) ≡ ((ιx. ϕ x) = (β P ))) in v]
using l-identity[where ϕ=λ α . (α) = (β P ) ≡ ((α) = (β P )), axiom-instance]
modus-ponens unfolding identity-ν-def by metis}
ultimately show ?thesis
using l-identity[where ϕ=λ α . (ιx . ϕ x) = (α)≡ ((ιx . ϕ x) = (α)), axiom-instance]
modus-ponens by metis
nextassume ¬([(∃ α. (αP ) = (ιx . ϕ x)) in v] ∧ [(∃ β. (β P ) = (ιx . ψ x)) in v])
hence ¬[(|A!,(ιx . ϕ x)|) in v] ∧ ¬[(ιx . ϕ x) =E (ιx . ψ x) in v]∨ ¬[(|A!,(ιx . ψ x)|) in v] ∧ ¬[(ιx . ϕ x) =E (ιx . ψ x) in v]
unfolding identity E -infix-def
using cqt-5 [axiom-instance] PLM .contraposition-1 SimpleExOrEnc.intros

116vdash-properties-10 by meson
hence ¬[(ιx . ϕ x) = (ιx . ψ x) in v]
apply − unfolding identity-defs by PLM-solver
thus ?thesis apply − apply PLM-solverusing qml-2 [axiom-instance, deduction] by autoqed

A.9.8. Quantification
lemma rule-ui[PLM ,PLM-elim,PLM-dest]:[∀ α . ϕ α in v] =⇒ [ϕ β in v]
by (meson cqt-1 [axiom-instance, deduction])lemmas ∀ E = rule-ui
lemma rule-ui-2 [PLM ,PLM-elim,PLM-dest]:[[[∀ α . ϕ (αP ) in v]; [∃ α . (α)P = β in v]]] =⇒ [ϕ β in v]
using cqt-1-κ[axiom-instance, deduction, deduction] by blast
lemma cqt-orig-1 [PLM ]:[(∀ α. ϕ α) → ϕ β in v]
by PLM-solver
lemma cqt-orig-2 [PLM ]:[(∀ α. ϕ → ψ α) → (ϕ → (∀ α. ψ α)) in v]
by PLM-solver
lemma
universal[PLM ]:V( α . [ϕ α in v]) =⇒ [∀ α . ϕ α in v]
using rule-gen .
lemmas ∀ I = universal
lemma cqt-basic-1 [PLM ]:[(∀ α. (∀ β . ϕ α β)) ≡ (∀ β. (∀ α. ϕ α β)) in v]
by PLM-solver
lemma cqt-basic-2 [PLM ]:[(∀ α. ϕ α ≡ ψ α) ≡ ((∀ α. ϕ α → ψ α) & (∀ α. ψ α → ϕ α)) in v]
by PLM-solver
lemma cqt-basic-3 [PLM ]:[(∀ α. ϕ α ≡ ψ α) → ((∀ α. ϕ α) ≡ (∀ α. ψ α)) in v]
by PLM-solver
lemma cqt-basic-4 [PLM ]:[(∀ α. ϕ α & ψ α) ≡ ((∀ α. ϕ α) & (∀ α. ψ α)) in v]
by PLM-solver
lemma cqt-basic-6 [PLM ]:[(∀ α. (∀ α. ϕ α)) ≡ (∀ α. ϕ α) in v]
by PLM-solver
lemma cqt-basic-7 [PLM ]:[(ϕ → (∀ α . ψ α)) ≡ (∀ α.(ϕ → ψ α)) in v]
by PLM-solver
lemma cqt-basic-8 [PLM ]:[((∀ α. ϕ α) ∨ (∀ α. ψ α)) → (∀ α. (ϕ α ∨ ψ α)) in v]
by PLM-solver
lemma cqt-basic-9 [PLM ]:[((∀ α. ϕ α → ψ α) & (∀ α. ψ α → χ α)) → (∀ α. ϕ α → χ α) in v]
by PLM-solver
lemma cqt-basic-10 [PLM ]:[((∀ α. ϕ α ≡ ψ α) & (∀ α. ψ α ≡ χ α)) → (∀ α. ϕ α ≡ χ α) in v]
by PLM-solver
lemma cqt-basic-11 [PLM ]:117[(∀ α. ϕ α ≡ ψ α) ≡ (∀ α. ψ α ≡ ϕ α) in v]
by PLM-solver
lemma cqt-basic-12 [PLM ]:[(∀ α. ϕ α) ≡ (∀ β. ϕ β) in v]
by PLM-solver
lemma existential[PLM ,PLM-intro]:[ϕ α in v] =⇒ [∃ α. ϕ α in v]
unfolding exists-def by PLM-solver
lemmas ∃ I = existential
lemma instantiation-[PLM,PLM-elim,PLM-dest]:
V[[[∃ α . ϕ α in v]; ( α.[ϕ α in v] =⇒ [ψ in v])]] =⇒ [ψ in v]
unfolding exists-def by PLM-solver
lemma Instantiate:assumes [∃ x . ϕ x in v]
obtains x where [ϕ x in v]
apply (insert assms) unfolding exists-def by PLM-solver
lemmas ∃ E = Instantiate
lemma cqt-further-1 [PLM ]:[(∀ α. ϕ α) → (∃ α. ϕ α) in v]
by PLM-solver
lemma cqt-further-2 [PLM ]:[(¬(∀ α. ϕ α)) ≡ (∃ α. ¬ϕ α) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-3 [PLM ]:[(∀ α. ϕ α) ≡ ¬(∃ α. ¬ϕ α) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-4 [PLM ]:[(¬(∃ α. ϕ α)) ≡ (∀ α. ¬ϕ α) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-5 [PLM ]:[(∃ α. ϕ α & ψ α) → ((∃ α. ϕ α) & (∃ α. ψ α)) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-6 [PLM ]:[(∃ α. ϕ α ∨ ψ α) ≡ ((∃ α. ϕ α) ∨ (∃ α. ψ α)) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-10 [PLM ]:[(ϕ (α:: 0a::id-eq) & (∀ β . ϕ β → β = α)) ≡ (∀ β . ϕ β ≡ β = α) in v]
apply PLM-solverusing l-identity[axiom-instance, deduction, deduction] id-eq-2 [deduction]
apply blast
using id-eq-1 by auto
lemma cqt-further-11 [PLM ]:[((∀ α. ϕ α) & (∀ α. ψ α)) → (∀ α. ϕ α ≡ ψ α) in v]
by PLM-solver
lemma cqt-further-12 [PLM ]:[((¬(∃ α. ϕ α)) & (¬(∃ α. ψ α))) → (∀ α. ϕ α ≡ ψ α) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-13 [PLM ]:[((∃ α. ϕ α) & (¬(∃ α. ψ α))) → (¬(∀ α. ϕ α ≡ ψ α)) in v]
unfolding exists-def by PLM-solver
lemma cqt-further-14 [PLM ]:[(∃ α. ∃ β. ϕ α β) ≡ (∃ β. ∃ α. ϕ α β) in v]
unfolding exists-def by PLM-solver
lemma nec-exist-unique[PLM ]:118[(∀ x. ϕ x → (ϕ x)) → ((∃ !x. ϕ x) → (∃ !x. (ϕ x))) in v]
proof (rule CP)
assume a: [∀ x. ϕ x → ϕ x in v]
show [(∃ !x. ϕ x) → (∃ !x. ϕ x) in v]
proof (rule CP)
assume [(∃ !x. ϕ x) in v]
hence [∃ α. ϕ α & (∀ β. ϕ β → β = α) in v]
by (simp only: exists-unique-def )then obtain α where 1 :[ϕ α & (∀ β. ϕ β → β = α) in v]
by (rule ∃ E){
fix β
have [ϕ β → β = α in v]
by (metis 1 Semantics.T5 Semantics.T6 cqt-orig-1 oth-class-taut-9-b)}
hence [∀ β. ϕ β → β = α in v] by (rule ∀ I )moreover have [(ϕ α) in v]
using 1 &E(1 ) a vdash-properties-10 cqt-orig-1 [deduction]
by fastultimately have [∃ α. (ϕ α) & (∀ β. ϕ β → β = α) in v]
using &I ∃ I by fast
thus [(∃ !x. ϕ x) in v]
unfolding exists-unique-def by assumption
qed
qed

A.9.9. Actuality and Descriptions
lemma nec-imp-act[PLM ]: [ϕ → Aϕ in v]
apply (rule CP)
using qml-act-2 [axiom-instance, equiv-lr]
qml-2 [axiom-actualization, axiom-instance]
logic-actual-nec-2 [axiom-instance, equiv-lr, deduction]by blastlemma act-conj-act-1 [PLM ]:[A(Aϕ → ϕ) in v]
using equiv-def logic-actual-nec-2 [axiom-instance]
logic-actual-nec-4 [axiom-instance] &E(2 ) ≡E(2 )by metislemma act-conj-act-2 [PLM ]:[A(ϕ → Aϕ) in v]
using logic-actual-nec-2 [axiom-instance] qml-act-1 [axiom-instance]
ded-thm-cor-3 ≡E(2 ) nec-imp-actby blastlemma act-conj-act-3 [PLM ]:[(Aϕ & Aψ) → A(ϕ & ψ) in v]
unfolding conn-defsby (metis logic-actual-nec-2 [axiom-instance]
logic-actual-nec-1 [axiom-instance]≡E(2 ) CP ≡E(4 ) reductio-aa-2
vdash-properties-10 )lemma act-conj-act-4 [PLM ]:[A(Aϕ ≡ ϕ) in v]
unfolding equiv-defby (PLM-solver PLM-intro: act-conj-act-3 [where ϕ=Aϕ → ϕand ψ=ϕ → Aϕ, deduction])lemma closure-act-1a[PLM ]:119[AA(Aϕ ≡ ϕ) in v]
using logic-actual-nec-4 [axiom-instance]
act-conj-act-4 ≡E(1 )by blastlemma closure-act-1b[PLM ]:[AAA(Aϕ ≡ ϕ) in v]
using logic-actual-nec-4 [axiom-instance]
act-conj-act-4 ≡E(1 )by blastlemma closure-act-1c[PLM ]:[AAAA(Aϕ ≡ ϕ) in v]
using logic-actual-nec-4 [axiom-instance]
act-conj-act-4 ≡E(1 )by blastlemma closure-act-2 [PLM ]:[∀ α. A(A(ϕ α) ≡ ϕ α) in v]
by PLM-solver
lemma closure-act-3 [PLM ]:[A(∀ α. A(ϕ α) ≡ ϕ α) in v]
by (PLM-solver PLM-intro: logic-actual-nec-3 [axiom-instance, equiv-rl])lemma closure-act-4 [PLM ]:[A(∀ α1 α2 . A(ϕ α1 α2 ) ≡ ϕ α1 α2 ) in v]
by (PLM-solver PLM-intro: logic-actual-nec-3 [axiom-instance, equiv-rl])lemma closure-act-4-b[PLM ]:[A(∀ α1 α2 α3 . A(ϕ α1 α2 α3 ) ≡ ϕ α1 α2 α3 ) in v]
by (PLM-solver PLM-intro: logic-actual-nec-3 [axiom-instance, equiv-rl])lemma closure-act-4-c[PLM ]:[A(∀ α1 α2 α3 α4 . A(ϕ α1 α2 α3 α4 ) ≡ ϕ α1 α2 α3 α4 ) in v]
by (PLM-solver PLM-intro: logic-actual-nec-3 [axiom-instance, equiv-rl])lemma RA[PLM ,PLM-intro]:([ϕ in dw]) =⇒ [Aϕ in dw]
using logic-actual[necessitation-averse-axiom-instance, equiv-rl] .
lemma RA-2 [PLM ,PLM-intro]:([ψ in dw] =⇒ [ϕ in dw]) =⇒ ([Aψ in dw] =⇒ [Aϕ in dw])
using RA logic-actual[necessitation-averse-axiom-instance] intro-elim-6-a by blast
context
beginprivate lemma ActualE[PLM ,PLM-elim,PLM-dest]:[Aϕ in dw] =⇒ [ϕ in dw]
using logic-actual[necessitation-averse-axiom-instance, equiv-lr] .
private lemma NotActualD[PLM-dest]:¬[Aϕ in dw] =⇒ ¬[ϕ in dw]
using RA by metis
private lemma ActualImplI [PLM-intro]:[Aϕ → Aψ in v] =⇒ [A(ϕ → ψ) in v]
using logic-actual-nec-2 [axiom-instance, equiv-rl] .
private lemma ActualImplE[PLM-dest, PLM-elim]:[A(ϕ → ψ) in v] =⇒ [Aϕ → Aψ in v]
using logic-actual-nec-2 [axiom-instance, equiv-lr] .
private lemma NotActualImplD[PLM-dest]:¬[A(ϕ → ψ) in v] =⇒ ¬[Aϕ → Aψ in v]
using ActualImplI by blast120

private lemma ActualNotI [PLM-intro]:[¬Aϕ in v] =⇒ [A¬ϕ in v]
using logic-actual-nec-1 [axiom-instance, equiv-rl] .
lemma ActualNotE[PLM-elim,PLM-dest]:[A¬ϕ in v] =⇒ [¬Aϕ in v]
using logic-actual-nec-1 [axiom-instance, equiv-lr] .
lemma NotActualNotD[PLM-dest]:¬[A¬ϕ in v] =⇒ ¬[¬Aϕ in v]
using ActualNotI by blast
private lemma ActualConjI [PLM-intro]:[Aϕ & Aψ in v] =⇒ [A(ϕ & ψ) in v]
unfolding equiv-defby (PLM-solver PLM-intro: act-conj-act-3 [deduction])
private lemma ActualConjE[PLM-elim,PLM-dest]:[A(ϕ & ψ) in v] =⇒ [Aϕ & Aψ in v]
unfolding conj-def by PLM-solver
private lemma ActualEquivI [PLM-intro]:[Aϕ ≡ Aψ in v] =⇒ [A(ϕ ≡ ψ) in v]
unfolding equiv-defby (PLM-solver PLM-intro: act-conj-act-3 [deduction])
private lemma ActualEquivE[PLM-elim, PLM-dest]:[A(ϕ ≡ ψ) in v] =⇒ [Aϕ ≡ Aψ in v]
unfolding equiv-def by PLM-solver
private lemma ActualBoxI [PLM-intro]:[ϕ in v] =⇒ [A(ϕ) in v]
using qml-act-2 [axiom-instance, equiv-lr] .
private lemma ActualBoxE[PLM-elim, PLM-dest]:[A(ϕ) in v] =⇒ [ϕ in v]
using qml-act-2 [axiom-instance, equiv-rl] .
private lemma NotActualBoxD[PLM-dest]:¬[A(ϕ) in v] =⇒ ¬[ϕ in v]
using ActualBoxI by blast
private lemma ActualDisjI [PLM-intro]:[Aϕ ∨ Aψ in v] =⇒ [A(ϕ ∨ ψ) in v]
unfolding disj-def by PLM-solver
private lemma ActualDisjE[PLM-elim,PLM-dest]:[A(ϕ ∨ ψ) in v] =⇒ [Aϕ ∨ Aψ in v]
unfolding disj-def by PLM-solver
private lemma NotActualDisjD[PLM-dest]:¬[A(ϕ ∨ ψ) in v] =⇒ ¬[Aϕ ∨ Aψ in v]
using ActualDisjI by blast
private lemma ActualForallI [PLM-intro]:[∀ x . A(ϕ x) in v] =⇒ [A(∀ x . ϕ x) in v]
using logic-actual-nec-3 [axiom-instance, equiv-rl] .
lemma ActualForallE[PLM-elim,PLM-dest]:[A(∀ x . ϕ x) in v] =⇒ [∀ x . A(ϕ x) in v]
using logic-actual-nec-3 [axiom-instance, equiv-lr] .
lemma NotActualForallD[PLM-dest]:¬[A(∀ x . ϕ x) in v] =⇒ ¬[∀ x . A(ϕ x) in v]
using ActualForallI by blast
lemma ActualActualI [PLM-intro]:

121

[Aϕ in v] =⇒ [AAϕ in v]
using logic-actual-nec-4 [axiom-instance, equiv-lr] .
lemma ActualActualE[PLM-elim,PLM-dest]:[AAϕ in v] =⇒ [Aϕ in v]
using logic-actual-nec-4 [axiom-instance, equiv-rl] .
lemma NotActualActualD[PLM-dest]:¬[AAϕ in v] =⇒ ¬[Aϕ in v]
using ActualActualI by blastendlemma ANeg-1 [PLM ]:[¬Aϕ ≡ ¬ϕ in dw]
by PLM-solver
lemma ANeg-2 [PLM ]:[¬A¬ϕ ≡ ϕ in dw]
by PLM-solver
lemma Act-Basic-1 [PLM ]:[Aϕ ∨ A¬ϕ in v]
by PLM-solver
lemma Act-Basic-2 [PLM ]:[A(ϕ & ψ) ≡ (Aϕ & Aψ) in v]
by PLM-solver
lemma Act-Basic-3 [PLM ]:[A(ϕ ≡ ψ) ≡ ((A(ϕ → ψ)) & (A(ψ → ϕ))) in v]
by PLM-solver
lemma Act-Basic-4 [PLM ]:[(A(ϕ → ψ) & A(ψ → ϕ)) ≡ (Aϕ ≡ Aψ) in v]
by PLM-solver
lemma Act-Basic-5 [PLM ]:[A(ϕ ≡ ψ) ≡ (Aϕ ≡ Aψ) in v]
by PLM-solver
lemma Act-Basic-6 [PLM ]:[♦ϕ ≡ A(♦ϕ) in v]
unfolding diamond-def by PLM-solver
lemma Act-Basic-7 [PLM ]:[Aϕ ≡ Aϕ in v]
by (simp add: qml-2 [axiom-instance] qml-act-1 [axiom-instance] ≡I )lemma Act-Basic-8 [PLM ]:[A(ϕ) → Aϕ in v]
by (metis qml-act-2 [axiom-instance] CP Act-Basic-7 ≡E(1 )≡E(2 ) nec-imp-act vdash-properties-10 )lemma Act-Basic-9 [PLM ]:[ϕ → Aϕ in v]
using qml-act-1 [axiom-instance] ded-thm-cor-3 nec-imp-act by blast
lemma Act-Basic-10 [PLM ]:[A(ϕ ∨ ψ) ≡ Aϕ ∨ Aψ in v]
by PLM-solver
lemma Act-Basic-11 [PLM ]:[A(∃ α. ϕ α) ≡ (∃ α.A(ϕ α)) in v]
proof −
have [A(∀ α . ¬ϕ α) ≡ (∀ α . A¬ϕ α) in v]
using logic-actual-nec-3 [axiom-instance] by blast
hence [¬A(∀ α . ¬ϕ α) ≡ ¬(∀ α . A¬ϕ α) in v]
using oth-class-taut-5-d[equiv-lr] by blast
moreover have [A¬(∀ α . ¬ϕ α) ≡ ¬A(∀ α . ¬ϕ α) in v]
using logic-actual-nec-1 [axiom-instance] by blast
ultimately have [A¬(∀ α . ¬ϕ α) ≡ ¬(∀ α . A¬ϕ α) in v]

122using ≡E(5 ) by blast
moreover {have [∀ α . A¬ϕ α ≡ ¬Aϕ α in v]
using logic-actual-nec-1 [axiom-universal, axiom-instance] by blast
hence [(∀ α . A¬ϕ α) ≡ (∀ α . ¬Aϕ α) in v]
using cqt-basic-3 [deduction] by fasthence [(¬(∀ α . A¬ϕ α)) ≡ ¬(∀ α . ¬Aϕ α) in v]
using oth-class-taut-5-d[equiv-lr] by blast}
ultimately show ?thesisby (metis ∃ E MetaSolver.EquivI Semantics.T7 existential)qedlemma act-quant-uniq[PLM ]:[(∀ z . Aϕ z ≡ z = x) ≡ (∀ z . ϕ z ≡ z = x) in dw]
by PLM-solver
lemma fund-cont-desc[PLM ]:[(x P = (ιx. ϕ x)) ≡ (∀ z . ϕ z ≡ (z = x)) in dw]
using descriptions[axiom-instance] act-quant-uniq ≡E(5 ) by fastlemma hintikka[PLM ]:[(x P = (ιx. ϕ x)) ≡ (ϕ x & (∀ z . ϕ z → z = x)) in dw]
proof −
have [(∀ z . ϕ z ≡ z = x) ≡ (ϕ x & (∀ z . ϕ z → z = x)) in dw]
unfolding identity-ν-def apply PLM-solver using id-eq-obj-1 apply simp
using l-identity[where ϕ=λ x . ϕ x, axiom-instance,
deduction, deduction]using id-eq-obj-2 [deduction] unfolding identity-ν-def by fastforce
thus ?thesis using ≡E(5 ) fund-cont-desc by blastqed
lemma russell-axiom-a[PLM ]:[((|F , ιx. ϕ x|)) ≡ (∃ x . ϕ x & (∀ z . ϕ z → z = x) & (|F , x P |)) in dw](is [?lhs ≡ ?rhs in dw])
proof −{
assume 1 : [?lhs in dw]
hence [∃ α. αP = (ιx. ϕ x) in dw]
using cqt-5 [axiom-instance, deduction]
SimpleExOrEnc.intros
by blast
then obtain α where 2 :[αP = (ιx. ϕ x) in dw]
using ∃ E by auto
hence 3 : [ϕ α & (∀ z . ϕ z → z = α) in dw]
using hintikka[equiv-lr] by simp
from 2 have [(ιx. ϕ x) = (αP ) in dw]
using l-identity[where α=αP and β=ιx. ϕ x and ϕ=λ x . x = αP ,axiom-instance, deduction, deduction]
id-eq-obj-1 [where x=α] by auto
hence [(|F , αP |) in dw]
using 1 l-identity[where β=αP and α=ιx. ϕ x and ϕ=λ x . (|F ,x|),axiom-instance, deduction, deduction] by autowith 3 have [ϕ α & (∀ z . ϕ z → z = α) & (|F , αP |) in dw] by (rule &I )hence [?rhs in dw] using ∃ I [where α=α] by simp}
moreover {123

assume [?rhs in dw]
then obtain α where 4 :[ϕ α & (∀ z . ϕ z → z = α) & (|F , αP |) in dw]
using ∃ E by auto
hence [αP = (ιx . ϕ x) in dw] ∧ [(|F , αP |) in dw]
using hintikka[equiv-rl] &E by blast
hence [?lhs in dw]
using l-identity[axiom-instance, deduction, deduction]by blast}
ultimately show ?thesis by PLM-solverqedlemma russell-axiom-g[PLM ]:[{|ιx. ϕ x,F |} ≡ (∃ x . ϕ x & (∀ z . ϕ z → z = x) & {|x P , F |}) in dw](is [?lhs ≡ ?rhs in dw])
proof −{
assume 1 : [?lhs in dw]
hence [∃ α. αP = (ιx. ϕ x) in dw]
using cqt-5 [axiom-instance, deduction] SimpleExOrEnc.intros by blast
then obtain α where 2 : [αP = (ιx. ϕ x) in dw] by (rule ∃ E)
hence 3 : [(ϕ α & (∀ z . ϕ z → z = α)) in dw]
using hintikka[equiv-lr] by simp
from 2 have [(ιx. ϕ x) = αP in dw]
using l-identity[where α=αP and β=ιx. ϕ x and ϕ=λ x . x = αP ,axiom-instance, deduction, deduction]
id-eq-obj-1 [where x=α] by auto
hence [{|αP , F |} in dw]
using 1 l-identity[where β=αP and α=ιx. ϕ x and ϕ=λ x . {|x,F |},axiom-instance, deduction, deduction] by autowith 3 have [(ϕ α & (∀ z . ϕ z → z = α)) & {|αP , F |} in dw]
using &I by auto
hence [?rhs in dw] using ∃ I [where α=α] by (simp add: identity-defs)}
moreover {assume [?rhs in dw]
then obtain α where 4 :[ϕ α & (∀ z . ϕ z → z = α) & {|αP , F |} in dw]
using ∃ E by auto
hence [αP = (ιx . ϕ x) in dw] ∧ [{|αP , F |} in dw]
using hintikka[equiv-rl] &E by blast
hence [?lhs in dw]
using l-identity[axiom-instance, deduction, deduction]
by fast}ultimately show ?thesis by PLM-solverqedlemma russell-axiom[PLM ]:assumes SimpleExOrEnc ψshows [ψ (ιx. ϕ x) ≡ (∃ x . ϕ x & (∀ z . ϕ z → z = x) & ψ (x P )) in dw](is [?lhs ≡ ?rhs in dw])
proof −{
assume 1 : [?lhs in dw]
hence [∃ α. αP = (ιx. ϕ x) in dw]
using cqt-5 [axiom-instance, deduction] assms by blast124

then obtain α where 2 : [αP = (ιx. ϕ x) in dw] by (rule ∃ E)
hence 3 : [(ϕ α & (∀ z . ϕ z → z = α)) in dw]
using hintikka[equiv-lr] by simp
from 2 have [(ιx. ϕ x) = (αP ) in dw]
using l-identity[where α=αP and β=ιx. ϕ x and ϕ=λ x . x = αP ,axiom-instance, deduction, deduction]
id-eq-obj-1 [where x=α] by auto
hence [ψ (αP ) in dw]
using 1 l-identity[where β=αP and α=ιx. ϕ x and ϕ=λ x . ψ x,
axiom-instance, deduction, deduction] by autowith 3 have [ϕ α & (∀ z . ϕ z → z = α) & ψ (αP ) in dw]
using &I by auto
hence [?rhs in dw] using ∃ I [where α=α] by (simp add: identity-defs)}
moreover {assume [?rhs in dw]
then obtain α where 4 :[ϕ α & (∀ z . ϕ z → z = α) & ψ (αP ) in dw]
using ∃ E by auto
hence [αP = (ιx . ϕ x) in dw] ∧ [ψ (αP ) in dw]
using hintikka[equiv-rl] &E by blast
hence [?lhs in dw]
using l-identity[axiom-instance, deduction, deduction]
by fast}ultimately show ?thesis by PLM-solverqedlemma unique-exists[PLM ]:[(∃ y . y P = (ιx. ϕ x)) ≡ (∃ !x . ϕ x) in dw]
proof ((rule ≡I , rule CP, rule-tac[2 ] CP))assume [∃ y. y P = (ιx. ϕ x) in dw]
then obtain α where[αP = (ιx. ϕ x) in dw]
by (rule ∃ E)
hence [ϕ α & (∀ β. ϕ β → β = α) in dw]
using hintikka[equiv-lr] by auto
thus [∃ !x . ϕ x in dw]
unfolding exists-unique-def using ∃ I by fastnext
assume [∃ !x . ϕ x in dw]
then obtain α where[ϕ α & (∀ β. ϕ β → β = α) in dw]
unfolding exists-unique-def by (rule ∃ E)
hence [αP = (ιx. ϕ x) in dw]
using hintikka[equiv-rl] by auto
thus [∃ y. y P = (ιx. ϕ x) in dw]
using ∃ I by fastqedlemma y-in-1 [PLM ]:[x P = (ιx . ϕ) → ϕ in dw]
using hintikka[equiv-lr, conj1 ] by (rule CP)lemma y-in-2 [PLM ]:[z P = (ιx . ϕ x) → ϕ z in dw]
using hintikka[equiv-lr, conj1 ] by (rule CP)

125

lemma y-in-3 [PLM ]:[(∃ y . y P = (ιx . ϕ (x P ))) → ϕ (ιx . ϕ (x P )) in dw]
proof (rule CP)
assume [(∃ y . y P = (ιx . ϕ (x P ))) in dw]
then obtain y where 1 :[y P = (ιx. ϕ (x P )) in dw]
by (rule ∃ E)
hence [ϕ (y P ) in dw]
using y-in-2 [deduction] unfolding identity-ν-def by blast
thus [ϕ (ιx. ϕ (x P )) in dw]
using l-identity[axiom-instance, deduction,
deduction] 1 by fastqedlemma act-quant-nec[PLM ]:[(∀ z . (Aϕ z ≡ z = x)) ≡ (∀ z. AAϕ z ≡ z = x) in v]
by PLM-solver
lemma equi-desc-descA-1 [PLM ]:[(x P = (ιx . ϕ x)) ≡ (x P = (ιx . Aϕ x)) in v]
using descriptions[axiom-instance] apply (rule ≡E(5 ))using act-quant-nec apply (rule ≡E(5 ))using descriptions[axiom-instance]by (meson ≡E(6 ) oth-class-taut-4-a)lemma equi-desc-descA-2 [PLM ]:[(∃ y . y P = (ιx. ϕ x)) → ((ιx . ϕ x) = (ιx . Aϕ x)) in v]
proof (rule CP)
assume [∃ y. y P = (ιx. ϕ x) in v]
then obtain y where[y P = (ιx. ϕ x) in v]
by (rule ∃ E)
moreover hence [y P = (ιx. Aϕ x) in v]
using equi-desc-descA-1 [equiv-lr] by auto
ultimately show [(ιx. ϕ x) = (ιx. Aϕ x) in v]
using l-identity[axiom-instance, deduction, deduction]
by fastqed
lemma equi-desc-descA-3 [PLM ]:assumes SimpleExOrEnc ψshows [ψ (ιx. ϕ x) → (∃ y . y P = (ιx. Aϕ x)) in v]
proof (rule CP)
assume [ψ (ιx. ϕ x) in v]
hence [∃ α. αP = (ιx. ϕ x) in v]
using cqt-5 [OF assms, axiom-instance, deduction] by auto
then obtain α where [αP = (ιx. ϕ x) in v] by (rule ∃ E)
hence [αP = (ιx . Aϕ x) in v]
using equi-desc-descA-1 [equiv-lr] by auto
thus [∃ y. y P = (ιx. Aϕ x) in v]
using ∃ I by fastqedlemma equi-desc-descA-4 [PLM ]:assumes SimpleExOrEnc ψshows [ψ (ιx. ϕ x) → ((ιx. ϕ x) = (ιx. Aϕ x)) in v]
proof (rule CP)
assume [ψ (ιx. ϕ x) in v]

126

hence [∃ α. αP = (ιx. ϕ x) in v]
using cqt-5 [OF assms, axiom-instance, deduction] by auto
then obtain α where [αP = (ιx. ϕ x) in v] by (rule ∃ E)
moreover hence [αP = (ιx . Aϕ x) in v]
using equi-desc-descA-1 [equiv-lr] by auto
ultimately show [(ιx. ϕ x) = (ιx . Aϕ x) in v]
using l-identity[axiom-instance, deduction, deduction] by fastqedlemma nec-hintikka-scheme[PLM ]:[(x P = (ιx. ϕ x)) ≡ (Aϕ x & (∀ z . Aϕ z → z = x)) in v]
using descriptions[axiom-instance]
apply (rule ≡E(5 ))apply PLM-solverusing id-eq-obj-1 apply simp
using id-eq-obj-2 [deduction]l-identity[where α=x, axiom-instance, deduction, deduction]
unfolding identity-ν-def
apply blast
using l-identity[where α=x, axiom-instance, deduction, deduction]
id-eq-2 [where 0a=ν, deduction] unfolding identity-ν-def by mesonlemma equiv-desc-eq[PLM]:Vassumes x.[A(ϕ x ≡ ψ x) in v]
shows [(∀ x . ((x P = (ιx . ϕ x)) ≡ (x P = (ιx . ψ x)))) in v]
proof (rule ∀ I )fix x{
assume [x P = (ιx . ϕ x) in v]
hence 1 : [Aϕ x & (∀ z. Aϕ z → z = x) in v]
using nec-hintikka-scheme[equiv-lr] by auto
hence 2 : [Aϕ x in v] ∧ [(∀ z. Aϕ z → z = x) in v]
using &E by blast
{
fix z
{
assume [Aψ z in v]
hence [Aϕ z in v]
using assms[where x=z] apply − by PLM-solver
moreover have [Aϕ z → z = x in v]
using 2 cqt-1 [axiom-instance,deduction] by auto
ultimately have [z = x in v]
using vdash-properties-10 by auto}
hence [Aψ z → z = x in v] by (rule CP)}
hence [(∀ z . Aψ z → z = x) in v] by (rule ∀ I )moreover have [Aψ x in v]
using 1 [conj1 ] assms[where x=x]apply − by PLM-solver
ultimately have [Aψ x & (∀ z. Aψ z → z = x) in v]
by PLM-solver
hence [x P = (ιx. ψ x) in v]
using nec-hintikka-scheme[where ϕ=ψ, equiv-rl] by auto}
moreover {assume [x P = (ιx . ψ x) in v]
hence 1 : [Aψ x & (∀ z. Aψ z → z = x) in v]

127using nec-hintikka-scheme[equiv-lr] by auto
hence 2 : [Aψ x in v] ∧ [(∀ z. Aψ z → z = x) in v]
using &E by blast
{
fix z
{
assume [Aϕ z in v]
hence [Aψ z in v]
using assms[where x=z]
apply − by PLM-solver
moreover have [Aψ z → z = x in v]
using 2 cqt-1 [axiom-instance,deduction] by auto
ultimately have [z = x in v]
using vdash-properties-10 by auto}
hence [Aϕ z → z = x in v] by (rule CP)}
hence [(∀ z. Aϕ z → z = x) in v] by (rule ∀ I )moreover have [Aϕ x in v]
using 1 [conj1 ] assms[where x=x]apply − by PLM-solver
ultimately have [Aϕ x & (∀ z. Aϕ z → z = x) in v]
by PLM-solver
hence [x P = (ιx. ϕ x) in v]
using nec-hintikka-scheme[where ϕ=ϕ,equiv-rl]
by auto}ultimately show [x P = (ιx. ϕ x) ≡ (x P ) = (ιx. ψ x) in v]
using ≡I CP by autoqed
lemma UniqueAux:
assumes [(Aϕ (α::ν) & (∀ z . A(ϕ z) → z = α)) in v]
shows [(∀ z . (A(ϕ z) ≡ (z = α))) in v]
proof −{
fix z{
assume [A(ϕ z) in v]
hence [z = α in v]
using assms[conj2 , THEN cqt-1 [where α=z,axiom-instance, deduction],deduction] by auto}
moreover {assume [z = α in v]
hence [α = z in v]
unfolding identity-ν-defusing id-eq-obj-2 [deduction] by fasthence [A(ϕ z) in v] using assms[conj1 ]using l-identity[axiom-instance, deduction,
deduction] by fast}
ultimately have [(A(ϕ z) ≡ (z = α)) in v]
using ≡I CP by auto}
thus [(∀ z . (A(ϕ z) ≡ (z = α))) in v]
by (rule ∀ I )

128

qed
lemma nec-russell-axiom[PLM ]:assumes SimpleExOrEnc ψshows [(ψ (ιx. ϕ x)) ≡ (∃ x . (Aϕ x & (∀ z . A(ϕ z) → z = x))& ψ (x P )) in v](is [?lhs ≡ ?rhs in v])
proof −{
assume 1 : [?lhs in v]
hence [∃ α. (αP ) = (ιx. ϕ x) in v]
using cqt-5 [axiom-instance, deduction] assms by blast
then obtain α where 2 : [(αP ) = (ιx. ϕ x) in v] by (rule ∃ E)
hence [(∀ z . (A(ϕ z) ≡ (z = α))) in v]
using descriptions[axiom-instance, equiv-lr] by auto
hence 3 : [(Aϕ α) & (∀ z . (A(ϕ z) → (z = α))) in v]
using cqt-1 [where α=α and ϕ=λ z . (A(ϕ z) ≡ (z = α)),axiom-instance, deduction, equiv-rl]
using id-eq-obj-1 [where x=α] unfolding identity-ν-defusing hintikka[equiv-lr] cqt-basic-2 [equiv-lr,conj1 ]&I by fastfrom 2 have [(ιx. ϕ x) = (αP ) in v]
using l-identity[where β=(ιx. ϕ x) and ϕ=λ x . x = (αP ),axiom-instance, deduction, deduction]
id-eq-obj-1 [where x=α] by auto
hence [ψ (αP ) in v]
using 1 l-identity[where α=(ιx. ϕ x) and ϕ=λ x . ψ x,
axiom-instance, deduction,
deduction] by autowith 3 have [(Aϕ α & (∀ z . A(ϕ z) → (z = α))) & ψ (αP ) in v]
using &I by simp
hence [?rhs in v]
using ∃ I [where α=α]by (simp add: identity-defs)}
moreover {assume [?rhs in v]
then obtain α where 4 :[(Aϕ α & (∀ z . A(ϕ z) → z = α)) & ψ (αP ) in v]
using ∃ E by auto
hence [(∀ z . (A(ϕ z) ≡ (z = α))) in v]
using UniqueAux &E(1 ) by auto
hence [(αP ) = (ιx . ϕ x) in v] ∧ [ψ (αP ) in v]
using descriptions[axiom-instance, equiv-rl]
4 [conj2 ] by blast
hence [?lhs in v]
using l-identity[axiom-instance, deduction,
deduction]
by fast}ultimately show ?thesis by PLM-solverqedlemma actual-desc-1 [PLM ]:[(∃ y . (y P ) = (ιx. ϕ x)) ≡ (∃ ! x . A(ϕ x)) in v] (is [?lhs ≡ ?rhs in v])
proof −{
assume [?lhs in v]

129then obtain α where[((αP ) = (ιx. ϕ x)) in v]
by (rule ∃ E)
hence [(|A!,(ιx. ϕ x)|) in v] ∨ [(αP ) =E (ιx. ϕ x) in v]
apply − unfolding identity-defs by PLM-solver
then obtain x where[((Aϕ x & (∀ z . A(ϕ z) → z = x))) in v]
using nec-russell-axiom[where ψ=λx . (|A!,x|), equiv-lr, THEN ∃ E]
using nec-russell-axiom[where ψ=λx . (αP ) =E x, equiv-lr, THEN ∃ E]
using SimpleExOrEnc.intros unfolding identity E -infix-defby (meson &E)
hence [?rhs in v] unfolding exists-unique-def by (rule ∃ I )}moreover {assume [?rhs in v]
then obtain x where[((Aϕ x & (∀ z . A(ϕ z) → z = x))) in v]
unfolding exists-unique-def by (rule ∃ E)
hence [∀ z. Aϕ z ≡ z = x in v]
using UniqueAux by auto
hence [(x P ) = (ιx. ϕ x) in v]
using descriptions[axiom-instance, equiv-rl] by auto
hence [?lhs in v] by (rule ∃ I )}ultimately show ?thesis
using ≡I CP by autoqed
lemma actual-desc-2 [PLM ]:[(x P ) = (ιx. ϕ) → Aϕ in v]
using nec-hintikka-scheme[equiv-lr, conj1 ]by (rule CP)lemma actual-desc-3 [PLM ]:[(z P ) = (ιx. ϕ x) → A(ϕ z) in v]
using nec-hintikka-scheme[equiv-lr, conj1 ]by (rule CP)lemma actual-desc-4 [PLM ]:[(∃ y . ((y P ) = (ιx. ϕ (x P )))) → A(ϕ (ιx. ϕ (x P ))) in v]
proof (rule CP)
assume [(∃ y . (y P ) = (ιx . ϕ (x P ))) in v]
then obtain y where 1 :[y P = (ιx. ϕ (x P )) in v]
by (rule ∃ E)
hence [A(ϕ (y P )) in v] using actual-desc-3 [deduction] by fast
thus [A(ϕ (ιx. ϕ (x P ))) in v]
using l-identity[axiom-instance, deduction,
deduction] 1 by fastqedlemma unique-box-desc-1 [PLM ]:[(∃ !x . (ϕ x)) → (∀ y . (y P ) = (ιx. ϕ x) → ϕ y) in v]
proof (rule CP)
assume [(∃ !x . (ϕ x)) in v]
then obtain α where 1 :[ϕ α & (∀ β. (ϕ β) → β = α) in v]
unfolding exists-unique-def by (rule ∃ E)

130

{
fix y
{
assume [(y P ) = (ιx. ϕ x) in v]
hence [Aϕ α → α = y in v]
using nec-hintikka-scheme[where x=y and ϕ=ϕ, equiv-lr, conj2 ,THEN cqt-1 [where α=α,axiom-instance, deduction]] by simp
hence [α = y in v]
using 1 [conj1 ] nec-imp-act vdash-properties-10 by blast
hence [ϕ y in v]
using 1 [conj1 ] qml-2 [axiom-instance, deduction]l-identity[axiom-instance, deduction, deduction]
by fast}hence [(y P ) = (ιx. ϕ x) → ϕ y in v]
by (rule CP)}
thus [∀ y . (y P ) = (ιx. ϕ x) → ϕ y in v]
by (rule ∀ I )qedlemma unique-box-desc[PLM ]:[(∀ x . (ϕ x → (ϕ x))) → ((∃ !x . ϕ x)
→ (∀ y . (y P = (ιx . ϕ x)) → ϕ y)) in v]
apply (rule CP, rule CP)
using nec-exist-unique[deduction, deduction]unique-box-desc-1 [deduction] by blast

A.9.10. Necessitylemma
RM-1 [PLM ]:V( v.[ϕ → ψ in v]) =⇒ [ϕ → ψ in v]
using RN qml-1 [axiom-instance] vdash-properties-10 by blastlemma
RM-1-b[PLM ]:V( v.[χ in v] =⇒ [ϕ → ψ in v]) =⇒ ([χ in v] =⇒ [ϕ → ψ in v])
using RN-2 qml-1 [axiom-instance] vdash-properties-10 by blastlemma
RM-2 [PLM ]:V( v.[ϕ → ψ in v]) =⇒ [♦ϕ → ♦ψ in v]
unfolding diamond-def
using RM-1 contraposition-1 by autolemma
RM-2-b[PLM ]:V( v.[χ in v] =⇒ [ϕ → ψ in v]) =⇒ ([χ in v] =⇒ [♦ϕ → ♦ψ in v])
unfolding diamond-def
using RM-1-b contraposition-1 by blast
lemma KBasic-1 [PLM ]:[ϕ → (ψ → ϕ) in v]
by (simp only: pl-1 [axiom-instance] RM-1 )lemma KBasic-2 [PLM ]:[(¬ϕ) → (ϕ → ψ) in v]
by (simp only: RM-1 useful-tautologies-3 )lemma KBasic-3 [PLM ]:[(ϕ & ψ) ≡ ϕ & ψ in v]
apply (rule ≡I )apply (rule CP)131

apply (rule &I )using RM-1 oth-class-taut-9-a vdash-properties-6 apply blast
using RM-1 oth-class-taut-9-b vdash-properties-6 apply blast
using qml-1 [axiom-instance] RM-1 ded-thm-cor-3 oth-class-taut-10-aoth-class-taut-8-b vdash-properties-10
by blastlemma KBasic-4 [PLM ]:[(ϕ ≡ ψ) ≡ ((ϕ → ψ) & (ψ → ϕ)) in v]
apply (rule ≡I )
unfolding equiv-def using KBasic-3 PLM .CP ≡E(1 )apply blast
using KBasic-3 PLM .CP ≡E(2 )by blastlemma KBasic-5 [PLM ]:[((ϕ → ψ) & (ψ → ϕ)) → (ϕ ≡ ψ) in v]
by (metis qml-1 [axiom-instance] CP &E ≡I vdash-properties-10 )lemma KBasic-6 [PLM ]:[(ϕ ≡ ψ) → (ϕ ≡ ψ) in v]
using KBasic-4 KBasic-5 by (metis equiv-def ded-thm-cor-3 &E(1 ))lemma [(ϕ ≡ ψ) → (ϕ ≡ ψ) in v]
nitpick[expect=genuine, user-axioms, card = 1 , card i = 2 ]oops — countermodel as desired
lemma KBasic-7 [PLM ]:[(ϕ & ψ) → (ϕ ≡ ψ) in v]
proof (rule CP)
assume [ϕ & ψ in v]
hence [(ψ → ϕ) in v] ∧ [(ϕ → ψ) in v]
using &E KBasic-1 vdash-properties-10 by blast
thus [(ϕ ≡ ψ) in v]
using KBasic-4 ≡E(2 ) intro-elim-1 by blastqed
lemma KBasic-8 [PLM ]:[(ϕ & ψ) → (ϕ ≡ ψ) in v]
using KBasic-7 KBasic-3
by (metis equiv-def PLM .ded-thm-cor-3 &E(1 ))lemma KBasic-9 [PLM ]:[((¬ϕ) & (¬ψ)) → (ϕ ≡ ψ) in v]
proof (rule CP)
assume [((¬ϕ) & (¬ψ)) in v]
hence [((¬ϕ) ≡ (¬ψ)) in v]
using KBasic-8Vvdash-properties-10 by blast
moreover have v.[((¬ϕ) ≡ (¬ψ)) → (ϕ ≡ ψ) in v]
using CP ≡E(2 ) oth-class-taut-5-d by blast
ultimately show [(ϕ ≡ ψ) in v]
using RM-1 PLM .vdash-properties-10 by blastqed
lemma rule-sub-lem-1-a[PLM ]:[(ψ ≡ χ) in v] =⇒ [(¬ψ) ≡ (¬χ) in v]
using qml-2 [axiom-instance] ≡E(1 ) oth-class-taut-5-d
vdash-properties-10
by blastlemma rule-sub-lem-1-b[PLM ]:[(ψ ≡ χ) in v] =⇒ [(ψ → Θ) ≡ (χ → Θ) in v]
by (metis equiv-def contraposition-1 CP &E(2 ) ≡I
≡E(1 ) rule-sub-lem-1-a)lemma rule-sub-lem-1-c[PLM ]:132[(ψ ≡ χ) in v] =⇒ [(Θ → ψ) ≡ (Θ → χ) in v]
by (metis CP ≡I ≡E(3 ) ≡E(4 ) ¬¬I¬¬E rule-sub-lem-1-a)lemma
rule-sub-lem-1-d[PLM]:V( x.[(ψ x ≡ χ x) in v]) =⇒ [(∀ α. ψ α) ≡ (∀ α. χ α) in v]
by (metis equiv-def ∀ I CP &E ≡I raa-cor-1
vdash-properties-10 rule-sub-lem-1-a ∀ E)
lemma rule-sub-lem-1-e[PLM ]:[(ψ ≡ χ) in v] =⇒ [Aψ ≡ Aχ in v]
using Act-Basic-5 ≡E(1 ) nec-imp-act
vdash-properties-10
by blastlemma rule-sub-lem-1-f [PLM ]:[(ψ ≡ χ) in v] =⇒ [ψ ≡ χ in v]
using KBasic-6 ≡I ≡E(1 ) vdash-properties-9
by blast

named-theorems Substable-intros
definition Substable :: ( 0a⇒ 0a⇒bool)⇒( 0a⇒o) ⇒ boolwhere Substable ≡ (λ cond ϕ . ∀ ψ χ v . (cond ψ χ) −→ [ϕ ψ ≡ ϕ χ in v])
lemma Substable-intro-const[Substable-intros]:
Substable cond (λ ϕ . Θ)
unfolding Substable-def using oth-class-taut-4-a by blast
lemma Substable-intro-not[Substable-intros]:assumes Substable cond ψshows Substable cond (λ ϕ . ¬(ψ ϕ))using assms unfolding Substable-def
using rule-sub-lem-1-a RN-2 ≡E oth-class-taut-5-d by metis
lemma Substable-intro-impl[Substable-intros]:assumes Substable cond ψ
and Substable cond χshows Substable cond (λ ϕ . ψ ϕ → χ ϕ)using assms unfolding Substable-defby (metis ≡I CP intro-elim-6-a intro-elim-6-b)
lemma Substable-intro-box[Substable-intros]:assumes Substable cond ψshows Substable cond (λ ϕ . (ψ ϕ))using assms unfolding Substable-def
using rule-sub-lem-1-f RN by mesonlemma Substable-intro-actual[Substable-intros]:assumes Substable cond ψshows Substable cond (λ ϕ . A(ψ ϕ))using assms unfolding Substable-def
using rule-sub-lem-1-e RN by mesonlemma Substable-intro-all[Substable-intros]:assumes ∀ x . Substable cond (ψ x)shows Substable cond (λ ϕ . ∀ x . ψ x ϕ)using assms unfolding Substable-defby (simp add: RN rule-sub-lem-1-d)
named-theorems Substable-Cond-defs
endclass Substable =133

fixes Substable-Cond :: 0a⇒ 0a⇒bool
assumesrule-sub-nec:V
ϕ ψ χ Θ v . [[PLM .Substable Substable-Cond ϕ; Substable-Cond ψ χ]]=⇒ Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v]
instantiation o :: Substablebegin
definition Substable-Cond-o where [PLM .Substable-Cond-defs]:
Substable-Cond-o ≡ λ ϕ ψ . ∀ v . [ϕ ≡ ψ in v]
instance proof
interpret PLM .
fix ϕ :: o ⇒ o and ψ χ :: o and Θ :: bool ⇒ bool and v::iassume Substable Substable-Cond ϕmoreover assume Substable-Cond ψ χultimately have [ϕ ψ ≡ ϕ χ in v]
unfolding Substable-def by blast
hence [ϕ ψ in v] = [ϕ χ in v] using ≡E by blast
moreover assume Θ [ϕ ψ in v]
ultimately show Θ [ϕ χ in v] by simp
qed
end
instantiation fun :: (type, Substable) Substablebegin
definition Substable-Cond-fun where [PLM .Substable-Cond-defs]:
Substable-Cond-fun ≡ λ ϕ ψ . ∀ x . Substable-Cond (ϕ x) (ψ x)instance proof
interpret PLM .
fix ϕ:: ( 0a ⇒ 0b) ⇒ o and ψ χ :: 0a ⇒ 0b and Θ v
assume Substable Substable-Cond ϕmoreover assume Substable-Cond ψ χultimately have [ϕ ψ ≡ ϕ χ in v]
unfolding Substable-def by blast
hence [ϕ ψ in v] = [ϕ χ in v] using ≡E by blast
moreover assume Θ [ϕ ψ in v]
ultimately show Θ [ϕ χ in v] by simp
qed
end
context PLM
beginlemma Substable-intro-equiv[Substable-intros]:assumes Substable cond ψ
and Substable cond χshows Substable cond (λ ϕ . ψ ϕ ≡ χ ϕ)unfolding conn-defs by (simp add: assms Substable-intros)
lemma Substable-intro-conj[Substable-intros]:assumes Substable cond ψ
and Substable cond χshows Substable cond (λ ϕ . ψ ϕ & χ ϕ)unfolding conn-defs by (simp add: assms Substable-intros)
lemma Substable-intro-disj[Substable-intros]:assumes Substable cond ψ
and Substable cond χshows Substable cond (λ ϕ . ψ ϕ ∨ χ ϕ)unfolding conn-defs by (simp add: assms Substable-intros)
lemma Substable-intro-diamond[Substable-intros]:134

assumes Substable cond ψshows Substable cond (λ ϕ . ♦(ψ ϕ))unfolding conn-defs by (simp add: assms Substable-intros)
lemma Substable-intro-exist[Substable-intros]:assumes ∀ x . Substable cond (ψ x)shows Substable cond (λ ϕ . ∃ x . ψ x ϕ)
unfolding conn-defs by (simp add: assms Substable-intros)
lemma Substable-intro-id-o[Substable-intros]:
Substable Substable-Cond (λ ϕ . ϕ)unfolding Substable-def Substable-Cond-o-def by blast
lemma Substable-intro-id-fun[Substable-intros]:assumes Substable Substable-Cond ψshows Substable Substable-Cond (λ ϕ . ψ (ϕ x))
using assms unfolding Substable-def Substable-Cond-fun-def
by blast
method PLM-subst-method for ψ:: 0a::Substable and χ:: 0a::Substable =(match conclusion in Θ [ϕ χ in v] for Θ and ϕ and v ⇒‹(rule rule-sub-nec[where Θ=Θ and χ=χ and ψ=ψ and ϕ=ϕ and v=v],((fast intro: Substable-intros, ((assumption)+)?)+; fail),
unfold Substable-Cond-defs)›)
method PLM-autosubstV=(match premises in v . [ψ ≡ χ in v] for ψ and χ ⇒‹ match conclusion in Θ [ϕ χ in v] for Θ ϕ and v ⇒‹(rule rule-sub-nec[where Θ=Θ and χ=χ and ψ=ψ and ϕ=ϕ and v=v],((fast intro: Substable-intros, ((assumption)+)?)+; fail),
unfold Substable-Cond-defs)› ›)method PLM-autosubst1
V =(match premises in v x . [ψ x ≡ χ x in v]
for ψ:: 0a::type⇒o and χ:: 0a⇒o ⇒‹ match conclusion in Θ [ϕ χ in v] for Θ ϕ and v ⇒‹(rule rule-sub-nec[where Θ=Θ and χ=χ and ψ=ψ and ϕ=ϕ and v=v],((fast intro: Substable-intros, ((assumption)+)?)+; fail),
unfold Substable-Cond-defs)› ›)method PLM-autosubst2
V =(match premises in v x y . [ψ x y ≡ χ x y in v]
for ψ:: 0a::type⇒ 0a⇒o and χ:: 0a::type⇒ 0a⇒o ⇒‹ match conclusion in Θ [ϕ χ in v] for Θ ϕ and v ⇒‹(rule rule-sub-nec[where Θ=Θ and χ=χ and ψ=ψ and ϕ=ϕ and v=v],((fast intro: Substable-intros, ((assumption)+)?)+; fail),
unfold Substable-Cond-defs)› ›)method PLM-subst-goal-method for ϕ:: 0a::Substable⇒o and ψ:: 0a =(match conclusion in Θ [ϕ χ in v] for Θ and χ and v ⇒‹(rule rule-sub-nec[where Θ=Θ and χ=χ and ψ=ψ and ϕ=ϕ and v=v],((fast intro: Substable-intros, ((assumption)+)?)+; fail),
unfold Substable-Cond-defs)›)lemma rule-sub-nec[PLM ]:assumesVSubstable Substable-Cond ϕshows ( v.[(ψ ≡ χ) in v]) =⇒ Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v]
proof −

135

V
assume ( v.[(ψ ≡ χ) in v])
hence [ϕ ψ in v] = [ϕ χ in v]
using assms RN unfolding Substable-def Substable-Cond-defs
using ≡I CP ≡E(1 ) ≡E(2 ) by meson
thus Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v] by autoqed
lemma rule-sub-nec1 [PLM ]:assumesVSubstable Substable-Cond ϕshows ( v x .[(ψ x ≡ χ x) in v]) =⇒ Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v]
proof − Vassume ( v x.[(ψ x ≡ χ x) in v])
hence [ϕ ψ in v] = [ϕ χ in v]
using assms RN unfolding Substable-def Substable-Cond-defs
using ≡I CP ≡E(1 ) ≡E(2 ) by metis
thus Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v] by autoqed
lemma rule-sub-nec2 [PLM ]:assumesVSubstable Substable-Cond ϕshows ( v x y .[ψ x y ≡ χ x y in v]) =⇒ Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v]
proof − Vassume ( v x y .[ψ x y ≡ χ x y in v])
hence [ϕ ψ in v] = [ϕ χ in v]
using assms RN unfolding Substable-def Substable-Cond-defs
using ≡I CP ≡E(1 ) ≡E(2 ) by metis
thus Θ [ϕ ψ in v] =⇒ Θ [ϕ χ in v] by autoqed
lemma rule-sub-remark-1-autosubst:
V
assumes ( v.[(|A!,x|) ≡ (¬(♦(|E!,x|))) in v])
and [¬(|A!,x|) in v]
shows[¬¬♦(|E!,x|) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-1:
Vassumes ( v.[(|A!,x|) ≡ (¬(♦(|E!,x|))) in v])
and [¬(|A!,x|) in v]
shows[¬¬♦(|E!,x|) in v]
apply (PLM-subst-method (|A!,x|) (¬(♦(|E!,x|))))
apply (simp add: assms(1 ))by (simp add: assms(2 ))lemma rule-sub-remark-2:
Vassumes ( v.[(|R,x,y|) ≡ ((|R,x,y|) & ((|Q,a|) ∨ (¬(|Q,a|)))) in v])
and [p → (|R,x,y|) in v]
shows[p → ((|R,x,y|) & ((|Q,a|) ∨ (¬(|Q,a|)))) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-3-autosubst:
V
assumes ( v x.[(|A!,x P |) ≡ (¬(♦(|E!,x P |))) in v])
and [∃ x . (|A!,x P |) in v]
shows[∃ x . (¬(♦(|E!,x P |))) in v]
apply (insert assms) apply PLM-autosubst1 by auto
lemma rule-sub-remark-3:
Vassumes ( v x.[(|A!,x P |) ≡ (¬(♦(|E!,x P |))) in v])
and [∃ x . (|A!,x P |) in v]

136shows [∃ x . (¬(♦(|E!,x P |))) in v]
apply (PLM-subst-method λx . (|A!,x P |) λx . (¬(♦(|E!,x P |))))
apply (simp add: assms(1 ))by (simp add: assms(2 ))lemma rule-sub-remark-4:
Vassumes v x.[(¬(¬(|P,x P |))) ≡ (|P,x P |) in v]
and [A(¬(¬(|P,x P |))) in v]
shows [A(|P,x P |) in v]
apply (insert assms) apply PLM-autosubst1 by auto
lemma rule-sub-remark-5:
Vassumes v.[(ϕ → ψ) ≡ ((¬ψ) → (¬ϕ)) in v]
and [(ϕ → ψ) in v]
shows [((¬ψ) → (¬ϕ)) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-6:
Vassumes v.[ψ ≡ χ in v]
and [(ϕ → ψ) in v]
shows [(ϕ → χ) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-7:
Vassumes v.[ϕ ≡ (¬(¬ϕ)) in v]
and [(ϕ → ϕ) in v]
shows [((¬(¬ϕ)) → ϕ) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-8:
Vassumes v.[Aϕ ≡ ϕ in v]
and [(Aϕ) in v]
shows [(ϕ) in v]
apply (insert assms) apply PLM-autosubst by auto
lemma rule-sub-remark-9:
Vassumes v.[(|P,a|) ≡ ((|P,a|) & ((|Q,b|) ∨ (¬(|Q,b|)))) in v]
and [(|P,a|) = (|P,a|) in v]
shows [(|P,a|) = ((|P,a|) & ((|Q,b|) ∨ (¬(|Q,b|)))) in v]
unfolding identity-defs apply (insert assms)
apply PLM-autosubst oops — no match as desired— dr-alphabetic-rules implicitly holds— dr-alphabetic-thm implicitly holds
lemma KBasic2-1 [PLM ]:[ϕ ≡ (¬(¬ϕ)) in v]
apply (PLM-subst-method ϕ (¬(¬ϕ)))by PLM-solver+lemma KBasic2-2 [PLM ]:[(¬(ϕ)) ≡ ♦(¬ϕ) in v]
unfolding diamond-def
apply (PLM-subst-method ϕ ¬(¬ϕ))
by PLM-solver+lemma KBasic2-3 [PLM ]:[ϕ ≡ (¬(♦(¬ϕ))) in v]

137

unfolding diamond-def
apply (PLM-subst-method ϕ ¬(¬ϕ))
apply PLM-solverby (simp add: oth-class-taut-4-b)
lemmas Df = KBasic2-3
lemma KBasic2-4 [PLM ]:[(¬(ϕ)) ≡ (¬(♦ϕ)) in v]
unfolding diamond-defby (simp add: oth-class-taut-4-b)
lemma KBasic2-5 [PLM ]:[(ϕ → ψ) → (♦ϕ → ♦ψ) in v]
by (simp only: CP RM-2-b)
lemmas K♦ = KBasic2-5
lemma KBasic2-6 [PLM ]:[♦(ϕ ∨ ψ) ≡ (♦ϕ ∨ ♦ψ) in v]
proof −
have [((¬ϕ) & (¬ψ)) ≡ ((¬ϕ) & (¬ψ)) in v]
using KBasic-3 by blast
hence [(¬(♦(¬((¬ϕ) & (¬ψ))))) ≡ ((¬ϕ) & (¬ψ)) in v]
using Df by (rule ≡E(6 ))hence [(¬(♦(¬((¬ϕ) & (¬ψ))))) ≡ ((¬(♦ϕ)) & (¬(♦ψ))) in v]
apply − apply (PLM-subst-method (¬ϕ) ¬(♦ϕ))
apply (simp add: KBasic2-4 )apply (PLM-subst-method (¬ψ) ¬(♦ψ))
apply (simp add: KBasic2-4 )unfolding diamond-def by assumption
hence [(¬(♦(ϕ ∨ ψ))) ≡ ((¬(♦ϕ)) & (¬(♦ψ))) in v]
apply − apply (PLM-subst-method ¬((¬ϕ) & (¬ψ)) ϕ ∨ ψ)
using oth-class-taut-6-b[equiv-sym] by auto
hence [(¬(¬(♦(ϕ ∨ ψ)))) ≡ (¬((¬(♦ϕ))&(¬(♦ψ)))) in v]
by (rule oth-class-taut-5-d[equiv-lr])hence [♦(ϕ ∨ ψ) ≡ (¬((¬(♦ϕ)) & (¬(♦ψ)))) in v]
apply − apply (PLM-subst-method ¬(¬(♦(ϕ ∨ ψ))) ♦(ϕ ∨ ψ))
using oth-class-taut-4-b[equiv-sym] by auto
thus ?thesis
apply − apply (PLM-subst-method ¬((¬(♦ϕ)) & (¬(♦ψ))) (♦ϕ) ∨ (♦ψ))
using oth-class-taut-6-b[equiv-sym] by autoqed
lemma KBasic2-7 [PLM ]:[(ϕ ∨ ψ) → (ϕ ∨ ψ) in v]
proof −Vhave
v . [ϕ → (ϕ ∨ ψ) in v]
by (metis contraposition-1 contraposition-2 useful-tautologies-3 disj-def )hence [ϕ → (ϕ ∨ ψ) in v] using RM-1 by auto
moreoverV{have
v . [ψ → (ϕ ∨ ψ) in v]
by (simp only: pl-1 [axiom-instance] disj-def )hence [ψ → (ϕ ∨ ψ) in v]
using RM-1 by auto}
ultimately show ?thesis
using oth-class-taut-10-d vdash-properties-10 by blast
qed

138

lemma KBasic2-8 [PLM ]:[♦(ϕ & ψ) → (♦ϕ & ♦ψ) in v]
by (metis CP RM-2 &I oth-class-taut-9-aoth-class-taut-9-b vdash-properties-10 )lemma KBasic2-9 [PLM ]:[♦(ϕ → ψ) ≡ (ϕ → ♦ψ) in v]
apply (PLM-subst-method (¬(ϕ)) ∨ (♦ψ) ϕ → ♦ψ)using oth-class-taut-5-k[equiv-sym] apply simp
apply (PLM-subst-method (¬ϕ) ∨ ψ ϕ → ψ)using oth-class-taut-5-k[equiv-sym] apply simp
apply (PLM-subst-method ♦(¬ϕ) ¬(ϕ))using KBasic2-2 [equiv-sym] apply simp
using KBasic2-6 .
lemma KBasic2-10 [PLM ]:[♦(ϕ) ≡ (¬(♦(¬ϕ))) in v]
unfolding diamond-def apply (PLM-subst-method ϕ ¬¬ϕ)using oth-class-taut-4-b oth-class-taut-4-a by auto
lemma KBasic2-11 [PLM ]:[♦♦ϕ ≡ (¬((¬ϕ))) in v]
unfolding diamond-def
apply (PLM-subst-method (¬ϕ) ¬(¬((¬ϕ))))using oth-class-taut-4-b oth-class-taut-4-a by auto
lemma KBasic2-12 [PLM ]: [(ϕ ∨ ψ) → (ϕ ∨ ♦ψ) in v]
proof −
have [(ψ ∨ ϕ) → ((¬ψ) → ϕ) in v]
using CP RM-1-b ∨E(2 ) by blast
hence [(ψ ∨ ϕ) → (♦ψ ∨ ϕ) in v]
unfolding diamond-def disj-defby (meson CP ¬¬E vdash-properties-6 )thus ?thesis apply −apply (PLM-subst-method (♦ψ ∨ ϕ) (ϕ ∨ ♦ψ))
apply (simp add: PLM .oth-class-taut-3-e)
apply (PLM-subst-method (ψ ∨ ϕ) (ϕ ∨ ψ))
apply (simp add: PLM .oth-class-taut-3-e)by assumptionqedlemma TBasic[PLM ]:[ϕ → ♦ϕ in v]
unfolding diamond-def
apply (subst contraposition-1 )apply (PLM-subst-method ¬ϕ ¬¬¬ϕ)apply (simp add: PLM .oth-class-taut-4-b)using qml-2 [where ϕ=¬ϕ, axiom-instance]by simplemmas T♦ = TBasiclemma S5Basic-1 [PLM ]:[♦ϕ → ϕ in v]
proof (rule CP)
assume [♦ϕ in v]
hence [¬♦¬ϕ in v]
using KBasic2-10 [equiv-lr] by simp
moreover have [♦(¬ϕ) → ♦(¬ϕ) in v]

139

by (simp add: qml-3 [axiom-instance])
ultimately have [¬♦¬ϕ in v]
by (simp add: PLM .modus-tollens-1 )thus [ϕ in v]
unfolding diamond-def apply −apply (PLM-subst-method ¬¬ϕ ϕ)using oth-class-taut-4-b[equiv-sym] apply simp
unfolding diamond-def using oth-class-taut-4-b[equiv-rl]
by simpqed
lemmas 5♦ = S5Basic-1
lemma S5Basic-2 [PLM ]:[ϕ ≡ ♦ϕ in v]
using 5♦ T♦ ≡I by blast
lemma S5Basic-3 [PLM ]:[♦ϕ ≡ ♦ϕ in v]
using qml-3 [axiom-instance] qml-2 [axiom-instance] ≡I by blast
lemma S5Basic-4 [PLM ]:[ϕ → ♦ϕ in v]
using T♦[deduction, THEN S5Basic-3 [equiv-lr]]by (rule CP)lemma S5Basic-5 [PLM ]:[♦ϕ → ϕ in v]
using S5Basic-2 [equiv-rl, THEN qml-2 [axiom-instance, deduction]]by (rule CP)lemmas B♦ = S5Basic-5
lemma S5Basic-6 [PLM ]:[ϕ → ϕ in v]
using S5Basic-4 [deduction] RM-1 [OF S5Basic-1 , deduction] CP by auto
lemmas 4 = S5Basic-6
lemma S5Basic-7 [PLM ]:[ϕ ≡ ϕ in v]
using 4 qml-2 [axiom-instance] by (rule ≡I )lemma S5Basic-8 [PLM ]:[♦♦ϕ → ♦ϕ in v]
using S5Basic-6 [where ϕ=¬ϕ, THEN contraposition-1 [THEN iffD1 ], deduction]
KBasic2-11 [equiv-lr] CP unfolding diamond-def by auto
lemmas 4♦ = S5Basic-8
lemma S5Basic-9 [PLM ]:[♦♦ϕ ≡ ♦ϕ in v]
using 4♦ T♦ by (rule ≡I )lemma S5Basic-10 [PLM ]:[(ϕ ∨ ψ) ≡ (ϕ ∨ ψ) in v]
apply (rule ≡I )apply (PLM-subst-goal-method λ χ . (ϕ ∨ ψ) → (ϕ ∨ χ) ♦ψ)using S5Basic-2 [equiv-sym] apply simp
using KBasic2-12 apply assumption
apply (PLM-subst-goal-method λ χ .(ϕ ∨ χ) → (ϕ ∨ ψ) ψ)using S5Basic-7 [equiv-sym] apply simp

140

using KBasic2-7 by auto
lemma S5Basic-11 [PLM ]:[(ϕ ∨ ♦ψ) ≡ (ϕ ∨ ♦ψ) in v]
apply (rule ≡I )apply (PLM-subst-goal-method λ χ . (ϕ ∨ ♦ψ) → (ϕ ∨ χ) ♦♦ψ)using S5Basic-9 apply simp
using KBasic2-12 apply assumption
apply (PLM-subst-goal-method λ χ .(ϕ ∨ χ) → (ϕ ∨ ♦ψ) ♦ψ)using S5Basic-3 [equiv-sym] apply simp
using KBasic2-7 by assumption
lemma S5Basic-12 [PLM ]:[♦(ϕ & ♦ψ) ≡ (♦ϕ & ♦ψ) in v]
proof −
have [((¬ϕ) ∨ (¬ψ)) ≡ ((¬ϕ) ∨ (¬ψ)) in v]
using S5Basic-10 by auto
hence 1 : [(¬((¬ϕ) ∨ (¬ψ))) ≡ ¬((¬ϕ) ∨ (¬ψ)) in v]
using oth-class-taut-5-d[equiv-lr] by auto
have 2 : [(♦(¬((¬ϕ) ∨ (¬(♦ψ))))) ≡ (¬((¬(♦ϕ)) ∨ (¬(♦ψ)))) in v]
apply (PLM-subst-method ¬ψ ¬♦ψ)using KBasic2-4 apply simp
apply (PLM-subst-method ¬ϕ ¬♦ϕ)using KBasic2-4 apply simp
apply (PLM-subst-method (¬((¬ϕ) ∨ (¬ψ))) (♦(¬((¬ϕ) ∨ ((¬ψ))))))
unfolding diamond-def
apply (simp add: RN oth-class-taut-4-b rule-sub-lem-1-a rule-sub-lem-1-f )using 1 by assumption
show ?thesis
apply (PLM-subst-method ¬((¬ϕ) ∨ (¬♦ψ)) ϕ & ♦ψ)using oth-class-taut-6-a[equiv-sym] apply simp
apply (PLM-subst-method ¬((¬(♦ϕ)) ∨ (¬♦ψ)) ♦ϕ & ♦ψ)using oth-class-taut-6-a[equiv-sym] apply simp
using 2 by assumptionqedlemma S5Basic-13 [PLM ]:[♦(ϕ & (ψ)) ≡ (♦ϕ & (ψ)) in v]
apply (PLM-subst-method ♦ψ ψ)using S5Basic-2 [equiv-sym] apply simp
using S5Basic-12 by simp
lemma S5Basic-14 [PLM ]:[(ϕ → (ψ)) ≡ (♦ϕ → ψ) in v]
proof (rule ≡I ; rule CP)
assume [(ϕ → ψ) in v]
moreoverV {have v.[(ϕ → ψ) → (♦ϕ → ψ) in v]
proof (rule CP)
fix v
assume [(ϕ → ψ) in v]
hence [♦ϕ → ♦ψ in v]
using K♦[deduction] by auto
thus [♦ϕ → ψ in v]
using B♦ ded-thm-cor-3 by blast
qed
hence [((ϕ → ψ) → (♦ϕ → ψ)) in v]
by (rule RN )141

hence [((ϕ → ψ)) → ((♦ϕ → ψ)) in v]
using qml-1 [axiom-instance, deduction] by auto}
ultimately show [(♦ϕ → ψ) in v]
using S5Basic-6 CP vdash-properties-10 by mesonnext
assume [(♦ϕ → ψ) in v]
moreover {fix v{
assume [(♦ϕ → ψ) in v]
hence 1 : [♦ϕ → ψ in v]
using qml-1 [axiom-instance, deduction] by auto
assume [ϕ in v]
hence [♦ϕ in v]
using S5Basic-4 [deduction] by auto
hence [ψ in v]
using 1 [deduction] by auto}
hence [(♦ϕ → ψ) in v] =⇒ [ϕ → ψ in v]
using CP by auto}
ultimately show [(ϕ → ψ) in v]
using S5Basic-6 RN-2 vdash-properties-10 by blastqed
lemma sc-eq-box-box-1 [PLM ]:[(ϕ → ϕ) → (♦ϕ ≡ ϕ) in v]
proof (rule CP)
assume 1 : [(ϕ → ϕ) in v]
hence [(♦ϕ → ϕ) in v]
using S5Basic-14 [equiv-lr] by auto
hence [♦ϕ → ϕ in v]
using qml-2 [axiom-instance, deduction] by auto
moreover from 1 have [ϕ → ϕ in v]
using qml-2 [axiom-instance, deduction] by auto
ultimately have [♦ϕ → ϕ in v]
using ded-thm-cor-3 by blast
moreover have [ϕ → ♦ϕ in v]
using qml-2 [axiom-instance] T♦by (rule ded-thm-cor-3 )ultimately show [♦ϕ ≡ ϕ in v]
by (rule ≡I )qedlemma sc-eq-box-box-2 [PLM ]:[(ϕ → ϕ) → ((¬ϕ) ≡ ((¬ϕ))) in v]
proof (rule CP)
assume [(ϕ → ϕ) in v]
hence [(¬(¬ϕ)) ≡ ϕ in v]
using sc-eq-box-box-1 [deduction] unfolding diamond-def by auto
thus [((¬ϕ) ≡ ((¬ϕ))) in v]
by (meson CP ≡I ≡E(3 )≡E(4 ) ¬¬I ¬¬E)
qedlemma sc-eq-box-box-3 [PLM ]:[((ϕ → ϕ) & (ψ → ψ)) → ((ϕ ≡ ψ) → (ϕ ≡ ψ)) in v]

142

proof (rule CP)
assume 1 : [((ϕ → ϕ) & (ψ → ψ)) in v]{
assume [ϕ ≡ ψ in v]
hence [(ϕ & ψ) ∨ ((¬(ϕ)) & (¬(ψ))) in v]
using oth-class-taut-5-i[equiv-lr] by auto
moreover {assume [ϕ & ψ in v]
hence [(ϕ ≡ ψ) in v]
using KBasic-7 [deduction] by auto}
moreover {assume [(¬(ϕ)) & (¬(ψ)) in v]
hence [(¬ϕ) & (¬ψ) in v]
using 1 &E &I sc-eq-box-box-2 [deduction, equiv-lr]
by metishence [((¬ϕ) & (¬ψ)) in v]
using KBasic-3 [equiv-rl] by auto
hence [(ϕ ≡ ψ) in v]
using KBasic-9 [deduction] by auto}
ultimately have [(ϕ ≡ ψ) in v]
using CP ∨E(1 ) by blast}
thus [ϕ ≡ ψ → (ϕ ≡ ψ) in v]
using CP by autoqed
lemma derived-S5-rules-1-a[PLM]:Vassumes v. [χ in v] =⇒ [♦ϕ → ψ in v]
shows [χ in v] =⇒ [ϕ → ψ in v]
proof −
have [χ in v] =⇒ [♦ϕ → ψ in v]
using assms RM-1-b by metis
thus [χ in v] =⇒ [ϕ → ψ in v]
using S5Basic-4 vdash-properties-10 CP by metisqedlemma derived-S5-rules-1-b[PLM]:Vassumes v. [♦ϕ → ψ in v]
shows [ϕ → ψ in v]
using derived-S5-rules-1-a all-self-eq-1 assms by blast
lemma derived-S5-rules-2-a[PLM]:Vassumes v. [χ in v] =⇒ [ϕ → ψ in v]
shows [χ in v] =⇒ [♦ϕ → ψ in v]
proof −
have [χ in v] =⇒ [♦ϕ → ♦ψ in v]
using RM-2-b assms by metis
thus [χ in v] =⇒ [♦ϕ → ψ in v]
using B♦ vdash-properties-10 CP by metisqedlemma derived-S5-rules-2-b[PLM]:Vassumes v. [ϕ → ψ in v]
shows [♦ϕ → ψ in v]
using assms derived-S5-rules-2-a all-self-eq-1 by blast

143

lemma BFs-1 [PLM ]: [(∀ α. (ϕ α)) → (∀ α. ϕ α) in v]
proof (rule derived-S5-rules-1-b)
fix v{
fix α V
have v.[(∀ α . (ϕ α)) → (ϕ α) in v]
using cqt-orig-1 by metis
hence [♦(∀ α. (ϕ α)) → ♦(ϕ α) in v]
using RM-2 by metis
moreover have [♦(ϕ α) → (ϕ α) in v]
using B♦ by auto
ultimately have [♦(∀ α. (ϕ α)) → (ϕ α) in v]
using ded-thm-cor-3 by blast}
hence [∀ α . ♦(∀ α. (ϕ α)) → (ϕ α) in v]
using ∀ I by metis
thus [♦(∀ α. (ϕ α)) → (∀ α. ϕ α) in v]
using cqt-orig-2 [deduction] by autoqed
lemmas BF = BFs-1
lemma BFs-2 [PLM ]:[(∀ α. ϕ α) → (∀ α. (ϕ α)) in v]
proof −
{
fix α
{
fix v
have [(∀ α. ϕ α) → ϕ α in v] using cqt-orig-1 by metis}
hence [(∀ α . ϕ α) → (ϕ α) in v] using RM-1 by auto}
hence [∀ α . (∀ α . ϕ α) → (ϕ α) in v] using ∀ I by metis
thus ?thesis using cqt-orig-2 [deduction] by metisqedlemmas CBF = BFs-2
lemma BFs-3 [PLM ]:[♦(∃ α. ϕ α) → (∃ α . ♦(ϕ α)) in v]
proof −
have [(∀ α. (¬(ϕ α))) → (∀ α. ¬(ϕ α)) in v]
using BF by metis
hence 1 : [(¬((∀ α. ¬(ϕ α)))) → (¬(∀ α. (¬(ϕ α)))) in v]
using contraposition-1 by simp
have 2 : [♦(¬(∀ α. ¬(ϕ α))) → (¬(∀ α. (¬(ϕ α)))) in v]
apply (PLM-subst-method ¬(∀ α . ¬(ϕ α)) ♦(¬(∀ α. ¬(ϕ α))))using KBasic2-2 1 by simp+
have [♦(¬(∀ α. ¬(ϕ α))) → (∃ α . ¬((¬(ϕ α)))) in v]
apply (PLM-subst-method ¬(∀ α. (¬(ϕ α))) ∃ α. ¬((¬(ϕ α))))using cqt-further-2 apply metis
using 2 by metis
thus ?thesis
unfolding exists-def diamond-def by autoqed
lemmas BF♦ = BFs-3
lemma BFs-4 [PLM ]:[(∃ α . ♦(ϕ α)) → ♦(∃ α. ϕ α) in v]

144

proof −have 1 : [(∀ α . ¬(ϕ α)) → (∀ α. (¬(ϕ α))) in v]
using CBF by auto
have 2 : [(∃ α . (¬((¬(ϕ α))))) → (¬((∀ α. ¬(ϕ α)))) in v]
apply (PLM-subst-method ¬(∀ α. (¬(ϕ α))) (∃ α . (¬((¬(ϕ α))))))
using cqt-further-2 apply blast
using 1 using contraposition-1 by metis
have [(∃ α . (¬((¬(ϕ α))))) → ♦(¬(∀ α . ¬(ϕ α))) in v]
apply (PLM-subst-method ¬((∀ α. ¬(ϕ α))) ♦(¬(∀ α. ¬(ϕ α))))using KBasic2-2 apply blast
using 2 by assumption
thus ?thesis
unfolding diamond-def exists-def by autoqed
lemmas CBF♦ = BFs-4
lemma sign-S5-thm-1 [PLM ]:[(∃ α. (ϕ α)) → (∃ α. ϕ α) in v]
proof (rule CP)
assume [∃ α . (ϕ α) in v]
then obtain τ where [(ϕ τ ) in v]
by (rule ∃ E)
moreover {fix v
assume [ϕ τ in v]
hence [∃ α . ϕ α in v]
by (rule ∃ I )}ultimately show [(∃ α . ϕ α) in v]
using RN-2 by blastqed
lemmas Buridan = sign-S5-thm-1
lemma sign-S5-thm-2 [PLM ]:[♦(∀ α . ϕ α) → (∀ α . ♦(ϕ α)) in v]
proof −
{
fix α
{
fix v
have [(∀ α . ϕ α) → ϕ α in v]
using cqt-orig-1 by metis}
hence [♦(∀ α . ϕ α) → ♦(ϕ α) in v]
using RM-2 by metis}
hence [∀ α . ♦(∀ α . ϕ α) → ♦(ϕ α) in v]
using ∀ I by metis
thus ?thesis
using cqt-orig-2 [deduction] by metisqedlemmas Buridan♦ = sign-S5-thm-2
lemma sign-S5-thm-3 [PLM ]:[♦(∃ α . ϕ α & ψ α) → ♦((∃ α . ϕ α) & (∃ α . ψ α)) in v]
by (simp only: RM-2 cqt-further-5 )lemma sign-S5-thm-4 [PLM ]:145[(((∀ α. ϕ α → ψ α)) & ((∀ α . ψ α → χ α))) → (∀ α. ϕ α → χ α) in v]
proof (rule CP)
assume [(∀ α. ϕ α → ψ α) & (∀ α. ψ α → χ α) in v]
hence [((∀ α. ϕ α → ψ α) & (∀ α. ψ α → χ α)) in v]
using KBasic-3 [equiv-rl] by blast
moreover {fix v
assume [((∀ α. ϕ α → ψ α) & (∀ α. ψ α → χ α)) in v]
hence [(∀ α . ϕ α → χ α) in v]
using cqt-basic-9 [deduction] by blast}
ultimately show [(∀ α. ϕ α → χ α) in v]
using RN-2 by blastqed
lemma sign-S5-thm-5 [PLM ]:[(((∀ α. ϕ α ≡ ψ α)) & ((∀ α. ψ α ≡ χ α))) → ((∀ α. ϕ α ≡ χ α)) in v]
proof (rule CP)
assume [(∀ α. ϕ α ≡ ψ α) & (∀ α. ψ α ≡ χ α) in v]
hence [((∀ α. ϕ α ≡ ψ α) & (∀ α. ψ α ≡ χ α)) in v]
using KBasic-3 [equiv-rl] by blast
moreover {fix v
assume [((∀ α. ϕ α ≡ ψ α) & (∀ α. ψ α ≡ χ α)) in v]
hence [(∀ α . ϕ α ≡ χ α) in v]
using cqt-basic-10 [deduction] by blast}
ultimately show [(∀ α. ϕ α ≡ χ α) in v]
using RN-2 by blastqed
lemma id-nec2-1 [PLM ]:[♦((α:: 0a::id-eq) = β) ≡ (α = β) in v]
apply (rule ≡I ; rule CP)
using id-nec[equiv-lr] derived-S5-rules-2-b CP modus-ponens apply blast
using T♦[deduction] by auto
lemma id-nec2-2-Aux:[(♦ϕ) ≡ ψ in v] =⇒ [(¬ψ) ≡ (¬ϕ) in v]
proof −
assume [(♦ϕ) ≡ V
ψ in v]moreover have ϕ ψ. [(¬ϕ) ≡ ψ in v] =⇒ [(¬ψ) ≡ ϕ in v]
by PLM-solver
ultimately show ?thesis
unfolding diamond-def by blastqed
lemma id-nec2-2 [PLM ]:[((α:: 0a::id-eq) 6= β) ≡ (α 6= β) in v]
using id-nec2-1 [THEN id-nec2-2-Aux] by auto
lemma id-nec2-3 [PLM ]:[(♦((α:: 0a::id-eq) 6= β)) ≡ (α 6= β) in v]
using T♦ ≡I id-nec2-2 [equiv-lr]
CP derived-S5-rules-2-b by metis
lemma exists-desc-box-1 [PLM ]:[(∃ y . (y P ) = (ιx. ϕ x)) → (∃ y . ((y P ) = (ιx. ϕ x))) in v]

146

proof (rule CP)
assume [∃ y. (y P ) = (ιx. ϕ x) in v]
then obtain y where [(y P ) = (ιx. ϕ x) in v]
by (rule ∃ E)
hence [(y P = (ιx. ϕ x)) in v]
using l-identity[axiom-instance, deduction, deduction]
cqt-1 [axiom-instance] all-self-eq-2 [where 0a=ν]modus-ponens unfolding identity-ν-def by fast
thus [∃ y. ((y P ) = (ιx. ϕ x)) in v]
by (rule ∃ I )qedlemma exists-desc-box-2 [PLM ]:[(∃ y . (y P ) = (ιx. ϕ x)) → (∃ y .((y P ) = (ιx. ϕ x))) in v]
using exists-desc-box-1 Buridan ded-thm-cor-3 by fastlemma en-eq-1 [PLM ]:[♦{|x,F |} ≡ {|x,F |} in v]
using encoding[axiom-instance] RN
sc-eq-box-box-1 modus-ponens by blast
lemma en-eq-2 [PLM ]:[{|x,F |} ≡ {|x,F |} in v]
using encoding[axiom-instance] qml-2 [axiom-instance] by (rule ≡I )lemma en-eq-3 [PLM ]:[♦{|x,F |} ≡ {|x,F |} in v]
using encoding[axiom-instance] derived-S5-rules-2-b ≡I T♦ by auto
lemma en-eq-4 [PLM ]:[({|x,F |} ≡ {|y,G|}) ≡ ({|x,F |} ≡ {|y,G|}) in v]
by (metis CP en-eq-2 ≡I ≡E(1 ) ≡E(2 ))lemma en-eq-5 [PLM ]:[({|x,F |} ≡ {|y,G|}) ≡ ({|x,F |} ≡ {|y,G|}) in v]
using ≡I KBasic-6 encoding[axiom-necessitation, axiom-instance]
sc-eq-box-box-3 [deduction] &I by simp
lemma en-eq-6 [PLM ]:[({|x,F |} ≡ {|y,G|}) ≡ ({|x,F |} ≡ {|y,G|}) in v]
using en-eq-4 en-eq-5 oth-class-taut-4-a ≡E(6 ) by mesonlemma en-eq-7 [PLM ]:[(¬{|x,F |}) ≡ (¬{|x,F |}) in v]
using en-eq-3 [THEN id-nec2-2-Aux] by blast
lemma en-eq-8 [PLM ]:[♦(¬{|x,F |}) ≡ (¬{|x,F |}) in v]
unfolding diamond-def apply (PLM-subst-method {|x,F |} ¬¬{|x,F |})using oth-class-taut-4-b apply simp
apply (PLM-subst-method {|x,F |} {|x,F |})using en-eq-2 apply simp
using oth-class-taut-4-a by assumption
lemma en-eq-9 [PLM ]:[♦(¬{|x,F |}) ≡ (¬{|x,F |}) in v]
using en-eq-8 en-eq-7 ≡E(5 ) by blast
lemma en-eq-10 [PLM ]:[A{|x,F |} ≡ {|x,F |} in v]
apply (rule ≡I )
using encoding[axiom-actualization, axiom-instance,
THEN logic-actual-nec-2 [axiom-instance, equiv-lr],
deduction, THEN qml-act-2 [axiom-instance, equiv-rl],
THEN en-eq-2 [equiv-rl]] CP
apply simp
using encoding[axiom-instance] nec-imp-act ded-thm-cor-3 by blast147

A.9.11. The Theory of Relations
lemma beta-equiv-eq-1-1 [PLM ]:assumes IsProperInX ϕ
and IsProperInXψV
and x.[ϕ (x P ) ≡ ψ (x P ) in v]
shows [(|λ y. ϕ (y P ), x P |) ≡ (|λ y. ψ (y P ), x P |) in v]
using lambda-predicates-2-1 [OF assms(1 ), axiom-instance]
using lambda-predicates-2-1 [OF assms(2 ), axiom-instance]
using assms(3 ) by (meson ≡E(6 ) oth-class-taut-4-a)lemma beta-equiv-eq-1-2 [PLM ]:assumes IsProperInXY ϕand IsProperInXYψV
and x y.[ϕ (x P ) (y P ) ≡ ψ (x P ) (y P ) in v]
shows [(|λ2 (λ x y. ϕ (x P ) (y P )), x P , y P |)≡ (|λ2 (λ x y. ψ (x P ) (y P )), x P , y P |) in v]
using lambda-predicates-2-2 [OF assms(1 ), axiom-instance]
using lambda-predicates-2-2 [OF assms(2 ), axiom-instance]
using assms(3 ) by (meson ≡E(6 ) oth-class-taut-4-a)lemma beta-equiv-eq-1-3 [PLM ]:assumes IsProperInXYZ ϕand IsProperInXYZ
ψV
and x y z.[ϕ (x P ) (y P ) (z P ) ≡ ψ (x P ) (y P ) (z P ) in v]
shows [(|λ3 (λ x y z. ϕ (x P ) (y P ) (z P )), x P , y P , z P |)≡ (|λ3 (λ x y z. ψ (x P ) (y P ) (z P )), x P , y P , z P |) in v]
using lambda-predicates-2-3 [OF assms(1 ), axiom-instance]
using lambda-predicates-2-3 [OF assms(2 ), axiom-instance]
using assms(3 ) by (meson ≡E(6 ) oth-class-taut-4-a)lemma beta-equiv-eq-2-1 [PLM ]:assumes IsProperInX ϕ
and IsProperInX ψ
shows [((∀ x . ϕ (x P ) ≡ ψ (x P ))) →((∀ x . (|λ y. ϕ (y P ), x P |) ≡ (|λ y. ψ (y P ), x P |))) in v]
apply (rule qml-1 [axiom-instance, deduction])
apply (rule RN )proof (rule CP, rule ∀ I )fix v xassumeV[∀ x. ϕ (x P ) ≡ ψ (x P ) in v]
hence x.[ϕ (x P ) ≡ ψ (x P ) in v]
by PLM-solver
thus [(|λ y. ϕ (y P ), x P |) ≡ (|λ y. ψ (y P ), x P |) in v]
using assms beta-equiv-eq-1-1 by autoqed
lemma beta-equiv-eq-2-2 [PLM ]:assumes IsProperInXY ϕand IsProperInXY ψshows [((∀ x y . ϕ (x P ) (y P ) ≡ ψ (x P ) (y P ))) →((∀ x y . (|λ2 (λ x y. ϕ (x P ) (y P )), x P , y P |)≡ (|λ2 (λ x y. ψ (x P ) (y P )), x P , y P |))) in v]
apply (rule qml-1 [axiom-instance, deduction])
apply (rule RN )proof (rule CP, rule ∀ I , rule ∀ I )fix v x yassume [∀ x y. ϕ (x P ) (y P ) ≡ ψ (x P ) (y P ) in v]

148

V
hence ( x y.[ϕ (x P ) (y P ) ≡ ψ (x P ) (y P ) in v])
by (meson ∀ E)
thus [(|λ2 (λ x y. ϕ (x P ) (y P )), x P , y P |)≡ (|λ2 (λ x y. ψ (x P ) (y P )), x P , y P |) in v]
using assms beta-equiv-eq-1-2 by autoqed
lemma beta-equiv-eq-2-3 [PLM ]:assumes IsProperInXYZ ϕand IsProperInXYZ ψshows [((∀ x y z . ϕ (x P ) (y P ) (z P ) ≡ ψ (x P ) (y P ) (z P ))) →((∀ x y z . (|λ3 (λ x y z. ϕ (x P ) (y P ) (z P )), x P , y P , z P |)≡ (|λ3 (λ x y z. ψ (x P ) (y P ) (z P )), x P , y P , z P |))) in v]
apply (rule qml-1 [axiom-instance, deduction])
apply (rule RN )proof (rule CP, rule ∀ I , rule ∀ I , rule ∀ I )fix v x y z
assumeV[∀ x y z. ϕ (x P ) (y P ) (z P ) ≡ ψ (x P ) (y P ) (z P ) in v]
hence ( x y z.[ϕ (x P ) (y P ) (z P ) ≡ ψ (x P ) (y P ) (z P ) in v])
by (meson ∀ E)
thus [(|λ3 (λ x y z. ϕ (x P ) (y P ) (z P )), x P , y P , z P |)≡ (|λ3 (λ x y z. ψ (x P ) (y P ) (z P )), x P , y P , z P |) in v]
using assms beta-equiv-eq-1-3 by autoqed
lemma beta-C-meta-1 [PLM ]:assumes IsProperInX ϕshows [(|λ y. ϕ (y P ), x P |) ≡ ϕ (x P ) in v]
using lambda-predicates-2-1 [OF assms, axiom-instance] by auto
lemma beta-C-meta-2 [PLM ]:assumes IsProperInXY ϕshows [(|λ2 (λ x y. ϕ (x P ) (y P )), x P , y P |) ≡ ϕ (x P ) (y P ) in v]
using lambda-predicates-2-2 [OF assms, axiom-instance] by auto
lemma beta-C-meta-3 [PLM ]:assumes IsProperInXYZ ϕshows [(|λ3 (λ x y z. ϕ (x P ) (y P ) (z P )), x P , y P , z P |) ≡ ϕ (x P ) (y P ) (z P ) in v]
using lambda-predicates-2-3 [OF assms, axiom-instance] by auto
lemma relations-1 [PLM ]:assumes IsProperInX ϕshows [∃ F . (∀ x. (|F ,x P |) ≡ ϕ (x P )) in v]
using assms apply − by PLM-solver
lemma relations-2 [PLM ]:assumes IsProperInXY ϕshows [∃ F . (∀ x y. (|F ,x P ,y P |) ≡ ϕ (x P ) (y P )) in v]
using assms apply − by PLM-solver
lemma relations-3 [PLM ]:assumes IsProperInXYZ ϕshows [∃ F . (∀ x y z. (|F ,x P ,y P ,z P |) ≡ ϕ (x P ) (y P ) (z P )) in v]
using assms apply − by PLM-solver
lemma prop-equiv[PLM ]:shows [(∀ x . ({|x P ,F |} ≡ {|x P ,G|})) → F = G in v]
proof (rule CP)

149

assume 1 : [∀ x. {|x P ,F |} ≡ {|x P ,G|} in v]{
fix x
have [{|x P ,F |} ≡ {|x P ,G|} in v]
using 1 by (rule ∀ E)
hence [({|x P ,F |} ≡ {|x P ,G|}) in v]
using PLM .en-eq-6 ≡E(1 ) by blast}
hence [∀ x. ({|x P ,F |} ≡ {|x P ,G|}) in v]
by (rule ∀ I )thus [F = G in v]
unfolding identity-defs
by (rule BF [deduction])qedlemma propositions-lemma-1 [PLM ]:[λ0 ϕ = ϕ in v]
using lambda-predicates-3-0 [axiom-instance] .
lemma propositions-lemma-2 [PLM ]:[λ0 ϕ ≡ ϕ in v]
using lambda-predicates-3-0 [axiom-instance, THEN id-eq-prop-prop-8-b[deduction]]
apply (rule l-identity[axiom-instance, deduction, deduction])by PLM-solver
lemma propositions-lemma-4[PLM ]:
V
assumes x.[A(ϕ x ≡ ψ x) in v]
shows [(χ::κ⇒o) (ιx. ϕ x) = χ (ιx. ψ x) in v]
proof −
have [λ0 (χ (ιx. ϕ x)) = λ0 (χ (ιx. ψ x)) in v]
using assms lambda-predicates-4-0 [axiom-instance]by blast
hence [(χ (ιx. ϕ x)) = λ0 (χ (ιx. ψ x)) in v]
using propositions-lemma-1 [THEN id-eq-prop-prop-8-b[deduction]]
id-eq-prop-prop-9-b[deduction] &Iby blast
thus ?thesis
using propositions-lemma-1 id-eq-prop-prop-9-b[deduction] &Iby blastqed
lemma propositions[PLM ]:[∃ p . (p ≡ p 0) in v]
by PLM-solver
lemma pos-not-equiv-then-not-eq[PLM ]:[♦(¬(∀ x. (|F ,x P |) ≡ (|G,x P |))) → F 6= G in v]
unfolding diamond-def
proof (subst contraposition-1 [symmetric], rule CP)
assume [F = G in v]
thus [(¬(¬(∀ x. (|F ,x P |) ≡ (|G,x P |)))) in v]
apply (rule l-identity[axiom-instance, deduction, deduction])by PLM-solverqedlemma thm-relation-negation-1-1 [PLM ]:[(|F − , x P |) ≡ ¬(|F , x P |) in v]
unfolding propnot-defs

150apply (rule lambda-predicates-2-1 [axiom-instance])by show-properlemma thm-relation-negation-1-2 [PLM ]:[(|F − , x P , y P |) ≡ ¬(|F , x P , y P |) in v]
unfolding propnot-defs
apply (rule lambda-predicates-2-2 [axiom-instance])by show-properlemma thm-relation-negation-1-3 [PLM ]:[(|F − , x P , y P , z P |) ≡ ¬(|F , x P , y P , z P |) in v]
unfolding propnot-defs
apply (rule lambda-predicates-2-3 [axiom-instance])by show-properlemma thm-relation-negation-2-1 [PLM ]:[(¬(|F − , x P |)) ≡ (|F , x P |) in v]
using thm-relation-negation-1-1 [THEN oth-class-taut-5-d[equiv-lr]]
apply − by PLM-solver
lemma thm-relation-negation-2-2 [PLM ]:[(¬(|F − , x P , y P |)) ≡ (|F , x P , y P |) in v]
using thm-relation-negation-1-2 [THEN oth-class-taut-5-d[equiv-lr]]
apply − by PLM-solver
lemma thm-relation-negation-2-3 [PLM ]:[(¬(|F − , x P , y P , z P |)) ≡ (|F , x P , y P , z P |) in v]
using thm-relation-negation-1-3 [THEN oth-class-taut-5-d[equiv-lr]]
apply − by PLM-solver
lemma thm-relation-negation-3 [PLM ]:[(p)− ≡ ¬p in v]
unfolding propnot-defs
using propositions-lemma-2 by simp
lemma thm-relation-negation-4 [PLM ]:[(¬((p::o)− )) ≡ p in v]
using thm-relation-negation-3 [THEN oth-class-taut-5-d[equiv-lr]]
apply − by PLM-solver
lemma thm-relation-negation-5-1 [PLM ]:[(F ::Π1 ) 6= (F − ) in v]
using id-eq-prop-prop-2 [deduction]l-identity[where ϕ=λ G . (|G,x P |) ≡ (|F − ,x P |), axiom-instance,
deduction, deduction]oth-class-taut-4-a thm-relation-negation-1-1 ≡E(5 )oth-class-taut-1-b modus-tollens-1 CP
by mesonlemma thm-relation-negation-5-2 [PLM ]:[(F ::Π2 ) 6= (F − ) in v]
using id-eq-prop-prop-5-a[deduction]l-identity[where ϕ=λ G . (|G,x P ,y P |) ≡ (|F − ,x P ,y P |), axiom-instance,
deduction, deduction]oth-class-taut-4-a thm-relation-negation-1-2 ≡E(5 )oth-class-taut-1-b modus-tollens-1 CP
by meson151lemma thm-relation-negation-5-3 [PLM ]:[(F ::Π3 ) 6= (F − ) in v]
using id-eq-prop-prop-5-b[deduction]l-identity[where ϕ=λ G . (|G,x P ,y P ,z P |) ≡ (|F − ,x P ,y P ,z P |),axiom-instance, deduction, deduction]oth-class-taut-4-a thm-relation-negation-1-3 ≡E(5 )oth-class-taut-1-b modus-tollens-1 CP
by mesonlemma thm-relation-negation-6 [PLM ]:[(p::o) 6= (p− ) in v]
using id-eq-prop-prop-8-b[deduction]l-identity[where ϕ=λ G . G ≡ (p− ), axiom-instance,
deduction, deduction]oth-class-taut-4-a thm-relation-negation-3 ≡E(5 )oth-class-taut-1-b modus-tollens-1 CP
by mesonlemma thm-relation-negation-7 [PLM ]:[((p::o)− ) = ¬p in v]
unfolding propnot-defs using propositions-lemma-1 by simp
lemma thm-relation-negation-8 [PLM ]:[(p::o) 6= ¬p in v]
unfolding propnot-defs
using id-eq-prop-prop-8-b[deduction]l-identity[where ϕ=λ G . G ≡ ¬(p), axiom-instance,
deduction, deduction]oth-class-taut-4-a oth-class-taut-1-b
modus-tollens-1 CP
by mesonlemma thm-relation-negation-9 [PLM ]:[((p::o) = q) → ((¬p) = (¬q)) in v]
using l-identity[where α=p and β=q and ϕ=λ x . (¬p) = (¬x),
axiom-instance, deduction]
id-eq-prop-prop-7-b using CP modus-ponens by blast
lemma thm-relation-negation-10 [PLM ]:[((p::o) = q) → ((p− ) = (q − )) in v]
using l-identity[where α=p and β=q and ϕ=λ x . (p− ) = (x − ),axiom-instance, deduction]
id-eq-prop-prop-7-b using CP modus-ponens by blast
lemma thm-cont-prop-1 [PLM ]:[NonContingent (F ::Π1 ) ≡ NonContingent (F − ) in v]
proof (rule ≡I ; rule CP)
assume [NonContingent F in v]
hence [(∀ x.(|F ,x P |)) ∨ (∀ x.¬(|F ,x P |)) in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
hence [(∀ x. ¬(|F − ,x P |)) ∨ (∀ x. ¬(|F ,x P |)) in v]
apply −
apply (PLM-subst-method λ x . (|F ,x P |) λ x . ¬(|F − ,x P |))using thm-relation-negation-2-1 [equiv-sym] by auto
hence [(∀ x. ¬(|F − ,x P |)) ∨ (∀ x. (|F − ,x P |)) in v]
apply −
apply (PLM-subst-goal-method
λ ϕ . (∀ x. ¬(|F − ,x P |)) ∨ (∀ x. ϕ x) λ x . ¬(|F ,x P |))152

using thm-relation-negation-1-1 [equiv-sym] by auto
hence [(∀ x. (|F − ,x P |)) ∨ (∀ x. ¬(|F − ,x P |)) in v]
by (rule oth-class-taut-3-e[equiv-lr])thus [NonContingent (F − ) in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
nextassume [NonContingent (F − ) in v]
hence [(∀ x. ¬(|F − ,x P |)) ∨ (∀ x. (|F − ,x P |)) in v]
unfolding NonContingent-def Necessary-defs Impossible-defs
by (rule oth-class-taut-3-e[equiv-lr])hence [(∀ x.(|F ,x P |)) ∨ (∀ x.(|F − ,x P |)) in v]
apply −
apply (PLM-subst-method λ x . ¬(|F − ,x P |) λ x . (|F ,x P |))using thm-relation-negation-2-1 by auto
hence [(∀ x. (|F ,x P |)) ∨ (∀ x. ¬(|F ,x P |)) in v]
apply −
apply (PLM-subst-method λ x . (|F − ,x P |) λ x . ¬(|F ,x P |))using thm-relation-negation-1-1 by auto
thus [NonContingent F in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
qedlemma thm-cont-prop-2 [PLM ]:[Contingent F ≡ ♦(∃ x . (|F ,x P |)) & ♦(∃ x . ¬(|F ,x P |)) in v]
proof (rule ≡I ; rule CP)
assume [Contingent F in v]
hence [¬((∀ x.(|F ,x P |)) ∨ (∀ x.¬(|F ,x P |))) in v]
unfolding Contingent-def Necessary-defs Impossible-defs .
hence [(¬(∀ x.(|F ,x P |))) & (¬(∀ x.¬(|F ,x P |))) in v]
by (rule oth-class-taut-6-d[equiv-lr])hence [(♦¬(∀ x.¬(|F ,x P |))) & (♦¬(∀ x.(|F ,x P |))) in v]
using KBasic2-2 [equiv-lr] &I &E by meson
thus [(♦(∃ x.(|F ,x P |))) & (♦(∃ x. ¬(|F ,x P |))) in v]
unfolding exists-def apply −apply (PLM-subst-method λ x . (|F ,x P |) λ x . ¬¬(|F ,x P |))using oth-class-taut-4-b by auto
next
assume [(♦(∃ x.(|F ,x P |))) & (♦(∃ x. ¬(|F ,x P |))) in v]
hence [(♦¬(∀ x.¬(|F ,x P |))) & (♦¬(∀ x.(|F ,x P |))) in v]
unfolding exists-def apply −apply (PLM-subst-goal-method
λ ϕ . (♦¬(∀ x.¬(|F ,x P |))) & (♦¬(∀ x. ϕ x)) λ x . ¬¬(|F ,x P |))using oth-class-taut-4-b[equiv-sym] by auto
hence [(¬(∀ x.(|F ,x P |))) & (¬(∀ x.¬(|F ,x P |))) in v]
using KBasic2-2 [equiv-rl] &I &E by meson
hence [¬((∀ x.(|F ,x P |)) ∨ (∀ x.¬(|F ,x P |))) in v]
by (rule oth-class-taut-6-d[equiv-rl])thus [Contingent F in v]
unfolding Contingent-def Necessary-defs Impossible-defs .
qedlemma thm-cont-prop-3 [PLM ]:[Contingent (F ::Π1 ) ≡ Contingent (F − ) in v]
using thm-cont-prop-1
unfolding NonContingent-def Contingent-def
by (rule oth-class-taut-5-d[equiv-lr])
lemma lem-cont-e[PLM ]:153[♦(∃ x . (|F ,x P |) & (♦(¬(|F ,x P |)))) ≡ ♦(∃ x . ((¬(|F ,x P |)) & ♦(|F ,x P |)))in v]
proof −
have [♦(∃ x . (|F ,x P |) & (♦(¬(|F ,x P |)))) in v]= [(∃ x . ♦((|F ,x P |) & ♦(¬(|F ,x P |)))) in v]
using BF♦[deduction] CBF♦[deduction] by fast
also have ... = [∃ x . (♦(|F ,x P |) & ♦(¬(|F ,x P |))) in v]
apply (PLM-subst-method
λ x . ♦((|F ,x P |) & ♦(¬(|F ,x P |)))
λ x . ♦(|F ,x P |) & ♦(¬(|F ,x P |)))
using S5Basic-12 by auto
also have ... = [∃ x . ♦(¬(|F ,x P |)) & ♦(|F ,x P |) in v]
apply (PLM-subst-method
λ x . ♦(|F ,x P |) & ♦(¬(|F ,x P |))λ x . ♦(¬(|F ,x P |)) & ♦(|F ,x P |))using oth-class-taut-3-b by auto
also have ... = [∃ x . ♦((¬(|F ,x P |)) & ♦(|F ,x P |)) in v]
apply (PLM-subst-method
λ x . ♦(¬(|F ,x P |)) & ♦(|F ,x P |)λ x . ♦((¬(|F ,x P |)) & ♦(|F ,x P |)))
using S5Basic-12 [equiv-sym] by auto
also have ... = [♦ (∃ x . ((¬(|F ,x P |)) & ♦(|F ,x P |))) in v]
using CBF♦[deduction] BF♦[deduction] by fast
finally show ?thesis using ≡I CP by blastqed
lemma lem-cont-e-2 [PLM ]:[♦(∃ x . (|F ,x P |) & ♦(¬(|F ,x P |))) ≡ ♦(∃ x . (|F − ,x P |) & ♦(¬(|F − ,x P |))) in v]
apply (PLM-subst-method λ x . (|F ,x P |) λ x . ¬(|F − ,x P |))using thm-relation-negation-2-1 [equiv-sym] apply simp
apply (PLM-subst-method λ x . ¬(|F ,x P |) λ x . (|F − ,x P |))using thm-relation-negation-1-1 [equiv-sym] apply simp
using lem-cont-e by simp
lemma thm-cont-e-1 [PLM ]:[♦(∃ x . ((¬(|E!,x P |)) & (♦(|E!,x P |)))) in v]
using lem-cont-e[where F =E!, equiv-lr] qml-4 [axiom-instance,conj1 ]by blastlemma thm-cont-e-2 [PLM ]:[Contingent (E!) in v]
using thm-cont-prop-2 [equiv-rl] &I qml-4 [axiom-instance, conj1 ]KBasic2-8 [deduction, OF sign-S5-thm-3 [deduction], conj1 ]KBasic2-8 [deduction, OF sign-S5-thm-3 [deduction, OF thm-cont-e-1 ], conj1 ]by fastlemma thm-cont-e-3 [PLM ]:[Contingent (E!− ) in v]
using thm-cont-e-2 thm-cont-prop-3 [equiv-lr] by blast
lemma thm-cont-e-4 [PLM ]:[∃ (F ::Π1 ) G . (F 6= G & Contingent F & Contingent G) in v]
apply (rule-tac α=E! in ∃ I , rule-tac α=E!− in ∃ I )using thm-cont-e-2 thm-cont-e-3 thm-relation-negation-5-1 &I by auto
context
beginqualified definition L where L ≡ (λ x . (|E!, x P |) → (|E!, x P |))154

lemma thm-noncont-e-e-1 [PLM ]:[Necessary L in v]
unfolding Necessary-defs L-def apply (rule RN , rule ∀ I )apply (rule lambda-predicates-2-1 [axiom-instance, equiv-rl])
apply show-proper
using if-p-then-p .
lemma thm-noncont-e-e-2 [PLM ]:[Impossible (L− ) in v]
unfolding Impossible-defs L-def apply (rule RN , rule ∀ I )apply (rule thm-relation-negation-2-1 [equiv-rl])
apply (rule lambda-predicates-2-1 [axiom-instance, equiv-rl])
apply show-proper
using if-p-then-p .
lemma thm-noncont-e-e-3 [PLM ]:[NonContingent (L) in v]
unfolding NonContingent-def using thm-noncont-e-e-1by (rule ∨I (1 ))lemma thm-noncont-e-e-4 [PLM ]:[NonContingent (L− ) in v]
unfolding NonContingent-def using thm-noncont-e-e-2
by (rule ∨I (2 ))lemma thm-noncont-e-e-5 [PLM ]:[∃ (F ::Π1 ) G . F 6= G & NonContingent F & NonContingent G in v]
apply (rule-tac α=L in ∃ I , rule-tac α=L− in ∃ I )using ∃ I thm-relation-negation-5-1 thm-noncont-e-e-3
thm-noncont-e-e-4 &I
by simplemma four-distinct-1 [PLM ]:[NonContingent (F ::Π1 ) → ¬(∃ G . (Contingent G & G = F )) in v]
proof (rule CP)
assume [NonContingent F in v]
hence [¬(Contingent F ) in v]
unfolding NonContingent-def Contingent-def
apply − by PLM-solver
moreover {assume [∃ G . Contingent G & G = F in v]
then obtain P where [Contingent P & P = F in v]
by (rule ∃ E)
hence [Contingent F in v]
using &E l-identity[axiom-instance, deduction, deduction]by blast}
ultimately show [¬(∃ G. Contingent G & G = F ) in v]
using modus-tollens-1 CP by blastqed
lemma four-distinct-2 [PLM ]:[Contingent (F ::Π1 ) → ¬(∃ G . (NonContingent G & G = F )) in v]
proof (rule CP)
assume [Contingent F in v]
hence [¬(NonContingent F ) in v]
unfolding NonContingent-def Contingent-def

155

apply − by PLM-solver
moreover {assume [∃ G . NonContingent G & G = F in v]
then obtain P where [NonContingent P & P = F in v]
by (rule ∃ E)
hence [NonContingent F in v]
using &E l-identity[axiom-instance, deduction, deduction]by blast}
ultimately show [¬(∃ G. NonContingent G & G = F ) in v]
using modus-tollens-1 CP by blastqed
lemma four-distinct-3 [PLM ]:[L 6= (L− ) & L 6= E! & L 6= (E!− ) & (L− ) 6= E!
& (L− ) 6= (E!− ) & E! 6= (E!− ) in v]
proof (rule &I )+show [L 6= (L− ) in v]
by (rule thm-relation-negation-5-1 )next{
assume [L = E! in v]
hence [NonContingent L & L = E! in v]
using thm-noncont-e-e-3 &I by auto
hence [∃ G . NonContingent G & G = E! in v]
using thm-noncont-e-e-3 &I ∃ I by fast}
thus [L 6= E! in v]
using four-distinct-2 [deduction, OF thm-cont-e-2 ]modus-tollens-1 CPby blast
next{
assume [L = (E!− ) in v]
hence [NonContingent L & L = (E!− ) in v]
using thm-noncont-e-e-3 &I by auto
hence [∃ G . NonContingent G & G = (E!− ) in v]
using thm-noncont-e-e-3 &I ∃ I by fast}
thus [L 6= (E!− ) in v]
using four-distinct-2 [deduction, OF thm-cont-e-3 ]modus-tollens-1 CPby blast
next{
assume [(L− ) = E! in v]
hence [NonContingent (L− ) & (L− ) = E! in v]
using thm-noncont-e-e-4 &I by auto
hence [∃ G . NonContingent G & G = E! in v]
using thm-noncont-e-e-3 &I ∃ I by fast}
thus [(L− ) 6= E! in v]
using four-distinct-2 [deduction, OF thm-cont-e-2 ]modus-tollens-1 CPby blast
next{
assume [(L− ) = (E!− ) in v]

156

hence [NonContingent (L− ) & (L− ) = (E!− ) in v]
using thm-noncont-e-e-4 &I by auto
hence [∃ G . NonContingent G & G = (E!− ) in v]
using thm-noncont-e-e-3 &I ∃ I by fast}
thus [(L− ) 6= (E!− ) in v]
using four-distinct-2 [deduction, OF thm-cont-e-3 ]modus-tollens-1 CPby blast
next
show [E! 6= (E!− ) in v]
by (rule thm-relation-negation-5-1 )qed
endlemma thm-cont-propos-1 [PLM ]:[NonContingent (p::o) ≡ NonContingent (p− ) in v]
proof (rule ≡I ; rule CP)
assume [NonContingent p in v]
hence [p ∨ ¬p in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
hence [(¬(p− )) ∨ (¬p) in v]
apply −
apply (PLM-subst-method p ¬(p− ))using thm-relation-negation-4 [equiv-sym] by auto
hence [(¬(p− )) ∨ (p− ) in v]
apply −
apply (PLM-subst-goal-method λϕ . (¬(p− )) ∨ (ϕ) ¬p)
using thm-relation-negation-3 [equiv-sym] by auto
hence [(p− ) ∨ (¬(p− )) in v]
by (rule oth-class-taut-3-e[equiv-lr])thus [NonContingent (p− ) in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
nextassume [NonContingent (p− ) in v]
hence [(¬(p− )) ∨ (p− ) in v]
unfolding NonContingent-def Necessary-defs Impossible-defs
by (rule oth-class-taut-3-e[equiv-lr])hence [(p) ∨ (p− ) in v]
apply −
apply (PLM-subst-goal-method λϕ . ϕ ∨ (p− ) ¬(p− ))using thm-relation-negation-4 by auto
hence [(p) ∨ (¬p) in v]
apply −
apply (PLM-subst-method p− ¬p)using thm-relation-negation-3 by auto
thus [NonContingent p in v]
unfolding NonContingent-def Necessary-defs Impossible-defs .
qedlemma thm-cont-propos-2 [PLM ]:[Contingent p ≡ ♦p & ♦(¬p) in v]
proof (rule ≡I ; rule CP)
assume [Contingent p in v]
hence [¬(p ∨ (¬p)) in v]
unfolding Contingent-def Necessary-defs Impossible-defs .
hence [(¬p) & (¬(¬p)) in v]
by (rule oth-class-taut-6-d[equiv-lr])157

hence [(♦¬(¬p)) & (♦¬p) in v]
using KBasic2-2 [equiv-lr] &I &E by meson
thus [(♦p) & (♦(¬p)) in v]
apply − apply PLM-solver
apply (PLM-subst-method ¬¬p p)using oth-class-taut-4-b[equiv-sym] by auto
next
assume [(♦p) & (♦¬(p)) in v]
hence [(♦¬(¬p)) & (♦¬(p)) in v]
apply − apply PLM-solver
apply (PLM-subst-method p ¬¬p)using oth-class-taut-4-b by auto
hence [(¬p) & (¬(¬p)) in v]
using KBasic2-2 [equiv-rl] &I &E by meson
hence [¬((p) ∨ (¬p)) in v]
by (rule oth-class-taut-6-d[equiv-rl])thus [Contingent p in v]
unfolding Contingent-def Necessary-defs Impossible-defs .
qedlemma thm-cont-propos-3 [PLM ]:[Contingent (p::o) ≡ Contingent (p− ) in v]
using thm-cont-propos-1
unfolding NonContingent-def Contingent-def
by (rule oth-class-taut-5-d[equiv-lr])
context
beginprivate definition p0 wherep0 ≡ ∀ x. (|E!,x P |) → (|E!,x P |)lemma thm-noncont-propos-1 [PLM ]:[Necessary p0 in v]
unfolding Necessary-defs p0 -def
apply (rule RN , rule ∀ I )using if-p-then-p .
lemma thm-noncont-propos-2 [PLM ]:[Impossible (p0 − ) in v]
unfolding Impossible-defs
apply (PLM-subst-method ¬p0 p0 − )using thm-relation-negation-3 [equiv-sym] apply simp
apply (PLM-subst-method p0 ¬¬p0 )using oth-class-taut-4-b apply simp
using thm-noncont-propos-1 unfolding Necessary-defs
by simplemma thm-noncont-propos-3 [PLM ]:[NonContingent (p0 ) in v]
unfolding NonContingent-def using thm-noncont-propos-1by (rule ∨I (1 ))lemma thm-noncont-propos-4 [PLM ]:[NonContingent (p0 − ) in v]
unfolding NonContingent-def using thm-noncont-propos-2by (rule ∨I (2 ))lemma thm-noncont-propos-5 [PLM ]:158[∃ (p::o) q . p 6= q & NonContingent p & NonContingent q in v]
apply (rule-tac α=p0 in ∃ I , rule-tac α=p0 − in ∃ I )using ∃ I thm-relation-negation-6 thm-noncont-propos-3
thm-noncont-propos-4 &I by simp
private definition q 0 whereq 0 ≡ ∃ x . (|E!,x P |) & ♦(¬(|E!,x P |))lemma basic-prop-1 [PLM ]:[∃ p . ♦p & ♦(¬p) in v]
apply (rule-tac α=q 0 in ∃ I ) unfolding q 0 -defusing qml-4 [axiom-instance] by simp
lemma basic-prop-2 [PLM ]:[Contingent q 0 in v]
unfolding Contingent-def Necessary-defs Impossible-defs
apply (rule oth-class-taut-6-d[equiv-rl])
apply (PLM-subst-goal-method λ ϕ . (¬(ϕ)) & ¬¬q 0 ¬¬q 0 )using oth-class-taut-4-b[equiv-sym] apply simp
using qml-4 [axiom-instance,conj-sym]
unfolding q 0 -def diamond-def by simp
lemma basic-prop-3 [PLM ]:[Contingent (q 0 − ) in v]
apply (rule thm-cont-propos-3 [equiv-lr])using basic-prop-2 .
lemma basic-prop-4 [PLM ]:[∃ (p::o) q . p 6= q & Contingent p & Contingent q in v]
apply (rule-tac α=q 0 in ∃ I , rule-tac α=q 0 − in ∃ I )using thm-relation-negation-6 basic-prop-2 basic-prop-3 &I by simp
lemma four-distinct-props-1 [PLM ]:[NonContingent (p::Π0 ) → (¬(∃ q . Contingent q & q = p)) in v]
proof (rule CP)
assume [NonContingent p in v]
hence [¬(Contingent p) in v]
unfolding NonContingent-def Contingent-def
apply − by PLM-solver
moreover {assume [∃ q . Contingent q & q = p in v]
then obtain r where [Contingent r & r = p in v]
by (rule ∃ E)
hence [Contingent p in v]
using &E l-identity[axiom-instance, deduction, deduction]by blast}
ultimately show [¬(∃ q. Contingent q & q = p) in v]
using modus-tollens-1 CP by blastqed
lemma four-distinct-props-2 [PLM ]:[Contingent (p::o) → ¬(∃ q . (NonContingent q & q = p)) in v]
proof (rule CP)
assume [Contingent p in v]
hence [¬(NonContingent p) in v]
unfolding NonContingent-def Contingent-def
apply − by PLM-solver

159moreover {assume [∃ q . NonContingent q & q = p in v]
then obtain r where [NonContingent r & r = p in v]
by (rule ∃ E)
hence [NonContingent p in v]
using &E l-identity[axiom-instance, deduction, deduction]by blast}
ultimately show [¬(∃ q. NonContingent q & q = p) in v]
using modus-tollens-1 CP by blastqed
lemma four-distinct-props-4 [PLM ]:[p0 6= (p0 − ) & p0 6= q 0 & p0 6= (q 0 − ) & (p0 − ) 6= q 0& (p0 − ) 6= (q 0 − ) & q 0 6= (q 0 − ) in v]
proof (rule &I )+show [p0 6= (p0 − ) in v]
by (rule thm-relation-negation-6 )next{assume [p0 = q 0 in v]
hence [∃ q . NonContingent q & q = q 0 in v]
using &I thm-noncont-propos-3 ∃ I [where α=p0 ]by simp}thus [p0 6= q 0 in v]
using four-distinct-props-2 [deduction, OF basic-prop-2 ]modus-tollens-1 CPby blast
next{
assume [p0 = (q 0 − ) in v]
hence [∃ q . NonContingent q & q = (q 0 − ) in v]
using thm-noncont-propos-3 &I ∃ I [where α=p0 ] by simp}
thus [p0 6= (q 0 − ) in v]
using four-distinct-props-2 [deduction, OF basic-prop-3 ]modus-tollens-1 CPby blast
next{
assume [(p0 − ) = q 0 in v]
hence [∃ q . NonContingent q & q = q 0 in v]
using thm-noncont-propos-4 &I ∃ I [where α=p0 − ] by auto}
thus [(p0 − ) 6= q 0 in v]
using four-distinct-props-2 [deduction, OF basic-prop-2 ]modus-tollens-1 CPby blast
next{
assume [(p0 − ) = (q 0 − ) in v]
hence [∃ q . NonContingent q & q = (q 0 − ) in v]
using thm-noncont-propos-4 &I ∃ I [where α=p0 − ] by auto}
thus [(p0 − ) 6= (q 0 − ) in v]
using four-distinct-props-2 [deduction, OF basic-prop-3 ]modus-tollens-1 CP160

by blastnext
show [q 0 6= (q 0 − ) in v]
by (rule thm-relation-negation-6 )qedlemma cont-true-cont-1 [PLM ]:[ContingentlyTrue p → Contingent p in v]
apply (rule CP, rule thm-cont-propos-2 [equiv-rl])
unfolding ContingentlyTrue-def
apply (rule &I , drule &E(1 ))using T♦[deduction] apply simpby (rule &E(2 ))lemma cont-true-cont-2 [PLM ]:[ContingentlyFalse p → Contingent p in v]
apply (rule CP, rule thm-cont-propos-2 [equiv-rl])
unfolding ContingentlyFalse-def
apply (rule &I , drule &E(2 ))apply simp
apply (drule &E(1 ))using T♦[deduction] by simp
lemma cont-true-cont-3 [PLM ]:[ContingentlyTrue p ≡ ContingentlyFalse (p− ) in v]
unfolding ContingentlyTrue-def ContingentlyFalse-def
apply (PLM-subst-method ¬p p− )using thm-relation-negation-3 [equiv-sym] apply simp
apply (PLM-subst-method p ¬¬p)by PLM-solver+lemma cont-true-cont-4 [PLM ]:[ContingentlyFalse p ≡ ContingentlyTrue (p− ) in v]
unfolding ContingentlyTrue-def ContingentlyFalse-def
apply (PLM-subst-method ¬p p− )using thm-relation-negation-3 [equiv-sym] apply simp
apply (PLM-subst-method p ¬¬p)by PLM-solver+lemma cont-tf-thm-1 [PLM ]:[ContingentlyTrue q 0 ∨ ContingentlyFalse q 0 in v]
proof −
have [q 0 ∨ ¬q 0 in v]
by PLM-solver
moreover {assume [q 0 in v]
hence [q 0 & ♦¬q 0 in v]
unfolding q 0 -defusing qml-4 [axiom-instance,conj2 ] &I
by auto}moreover {assume [¬q 0 in v]
hence [(¬q 0 ) & ♦q 0 in v]
unfolding q 0 -defusing qml-4 [axiom-instance,conj1 ] &I
by auto}161

ultimately show ?thesis
unfolding ContingentlyTrue-def ContingentlyFalse-def
using ∨E(4 ) CP by autoqed
lemma cont-tf-thm-2 [PLM ]:[ContingentlyFalse q 0 ∨ ContingentlyFalse (q 0 − ) in v]
using cont-tf-thm-1 cont-true-cont-3 [where p=q 0 ]cont-true-cont-4 [where p=q 0 ]apply − by PLM-solver
lemma cont-tf-thm-3 [PLM ]:[∃ p . ContingentlyTrue p in v]
proof (rule ∨E(1 ); (rule CP)?)show [ContingentlyTrue q 0 ∨ ContingentlyFalse q 0 in v]
using cont-tf-thm-1 .
next
assume [ContingentlyTrue q 0 in v]
thus ?thesis
using ∃ I by metis
nextassume [ContingentlyFalse q 0 in v]
hence [ContingentlyTrue (q 0 − ) in v]
using cont-true-cont-4 [equiv-lr] by simp
thus ?thesis
using ∃ I by metisqedlemma cont-tf-thm-4 [PLM ]:[∃ p . ContingentlyFalse p in v]
proof (rule ∨E(1 ); (rule CP)?)show [ContingentlyTrue q 0 ∨ ContingentlyFalse q 0 in v]
using cont-tf-thm-1 .
next
assume [ContingentlyTrue q 0 in v]
hence [ContingentlyFalse (q 0 − ) in v]
using cont-true-cont-3 [equiv-lr] by simp
thus ?thesis
using ∃ I by metis
nextassume [ContingentlyFalse q 0 in v]
thus ?thesis
using ∃ I by metisqedlemma cont-tf-thm-5 [PLM ]:[ContingentlyTrue p & Necessary q → p 6= q in v]
proof (rule CP)
assume [ContingentlyTrue p & Necessary q in v]
hence 1 : [♦(¬p) &  q in v]
unfolding ContingentlyTrue-def Necessary-defs
using &E &I by blast
hence [¬p in v]
apply − apply (drule &E(1 ))unfolding diamond-def
apply (PLM-subst-method ¬¬p p)using oth-class-taut-4-b[equiv-sym] by auto
moreover {162

assume [p = q in v]
hence [p in v]
using l-identity[where α=q and β=p and ϕ=λ x .  x,
axiom-instance, deduction, deduction]
1 [conj2 ] id-eq-prop-prop-8-b[deduction]by blast}
ultimately show [p 6= q in v]
using modus-tollens-1 CP by blastqed
lemma cont-tf-thm-6 [PLM ]:[(ContingentlyFalse p & Impossible q) → p 6= q in v]
proof (rule CP)
assume [ContingentlyFalse p & Impossible q in v]
hence 1 : [♦p & (¬q) in v]
unfolding ContingentlyFalse-def Impossible-defs
using &E &I by blast
hence [¬♦q in v]
unfolding diamond-def apply − by PLM-solver
moreover {assume [p = q in v]
hence [♦q in v]
using l-identity[axiom-instance, deduction, deduction] 1 [conj1 ]id-eq-prop-prop-8-b[deduction]by blast}
ultimately show [p 6= q in v]
using modus-tollens-1 CP by blastqed
endlemma oa-contingent-1 [PLM ]:[O! 6= A! in v]
proof −{
assume [O! = A! in v]
hence [(λx. ♦(|E!,x P |)) = (λx. ¬♦(|E!,x P |)) in v]
unfolding Ordinary-def Abstract-def .
moreover have [(|(λx. ♦(|E!,x P |)), x P |) ≡ ♦(|E!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately have [(|(λx. ¬♦(|E!,x P |)), x P |) ≡ ♦(|E!,x P |) in v]
using l-identity[axiom-instance, deduction, deduction] by fast
moreover have [(|(λx. ¬♦(|E!,x P |)), x P |) ≡ ¬♦(|E!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately have [♦(|E!,x P |) ≡ ¬♦(|E!,x P |) in v]
apply − by PLM-solver}
thus ?thesis
using oth-class-taut-1-b modus-tollens-1 CPby blastqed
lemma oa-contingent-2 [PLM ]:[(|O!,x P |) ≡ ¬(|A!,x P |) in v]
proof −

163

have [(|(λx. ¬♦(|E!,x P |)), x P |) ≡ ¬♦(|E!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
hence [(¬(|(λx. ¬♦(|E!,x P |)), x P |)) ≡ ♦(|E!,x P |) in v]
using oth-class-taut-5-d[equiv-lr] oth-class-taut-4-b[equiv-sym]≡E(5 ) by blast
moreover have [(|(λx. ♦(|E!,x P |)), x P |) ≡ ♦(|E!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately show ?thesis
unfolding Ordinary-def Abstract-def
apply − by PLM-solverqedlemma oa-contingent-3 [PLM ]:[(|A!,x P |) ≡ ¬(|O!,x P |) in v]
using oa-contingent-2
apply − by PLM-solver
lemma oa-contingent-4 [PLM ]:[Contingent O! in v]
apply (rule thm-cont-prop-2 [equiv-rl], rule &I )subgoalunfolding Ordinary-def
apply (PLM-subst-method λ x . ♦(|E!,x P |) λ x . (|λx. ♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])
apply show-proper
using BF♦[deduction, OF thm-cont-prop-2 [equiv-lr, OF thm-cont-e-2 , conj1 ]]by (rule T♦[deduction])subgoalapply (PLM-subst-method λ x . (|A!,x P |) λ x . ¬(|O!,x P |))using oa-contingent-3 apply simp
using cqt-further-5 [deduction,conj1 , OF A-objects[axiom-instance]]by (rule T♦[deduction])done
lemma oa-contingent-5 [PLM ]:[Contingent A! in v]
apply (rule thm-cont-prop-2 [equiv-rl], rule &I )subgoalusing cqt-further-5 [deduction,conj1 , OF A-objects[axiom-instance]]by (rule T♦[deduction])subgoalunfolding Abstract-def
apply (PLM-subst-method λ x . ¬♦(|E!,x P |) λ x . (|λx. ¬♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])
apply show-proper
apply (PLM-subst-method λ x . ♦(|E!,x P |) λ x . ¬¬♦(|E!,x P |))using oth-class-taut-4-b apply simp
using BF♦[deduction, OF thm-cont-prop-2 [equiv-lr, OF thm-cont-e-2 , conj1 ]]by (rule T♦[deduction])done
lemma oa-contingent-6 [PLM ]:[(O!− ) 6= (A!− ) in v]
proof −{
assume [(O!− ) = (A!− ) in v]

164

hence [(λx. ¬(|O!,x P |)) = (λx. ¬(|A!,x P |)) in v]
unfolding propnot-defs .
moreover have [(|(λx. ¬(|O!,x P |)), x P |) ≡ ¬(|O!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately have [(|λx. ¬(|A!,x P |),x P |) ≡ ¬(|O!,x P |) in v]
using l-identity[axiom-instance, deduction, deduction]
by fasthence [(¬(|A!,x P |)) ≡ ¬(|O!,x P |) in v]
apply −
apply (PLM-subst-method (|λx. ¬(|A!,x P |),x P |) (¬(|A!,x P |)))
apply (safe intro!: beta-C-meta-1 )by show-proper
hence [(|O!,x P |) ≡ ¬(|O!,x P |) in v]
using oa-contingent-2 apply − by PLM-solver}
thus ?thesis
using oth-class-taut-1-b modus-tollens-1 CPby blastqed
lemma oa-contingent-7 [PLM ]:[(|O!− ,x P |) ≡ ¬(|A!− ,x P |) in v]
proof −
have [(¬(|λx. ¬(|A!,x P |),x P |)) ≡ (|A!,x P |) in v]
apply (PLM-subst-method (¬(|A!,x P |)) (|λx. ¬(|A!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])
apply show-proper
using oth-class-taut-4-b[equiv-sym] by auto
moreover have [(|λx. ¬(|O!,x P |),x P |) ≡ ¬(|O!,x P |) in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately show ?thesis
unfolding propnot-defs
using oa-contingent-3
apply − by PLM-solverqedlemma oa-contingent-8 [PLM ]:[Contingent (O!− ) in v]
using oa-contingent-4 thm-cont-prop-3 [equiv-lr] by auto
lemma oa-contingent-9 [PLM ]:[Contingent (A!− ) in v]
using oa-contingent-5 thm-cont-prop-3 [equiv-lr] by auto
lemma oa-facts-1 [PLM ]:[(|O!,x P |) → (|O!,x P |) in v]
proof (rule CP)
assume [(|O!,x P |) in v]
hence [♦(|E!,x P |) in v]
unfolding Ordinary-def apply −apply (rule beta-C-meta-1 [equiv-lr])by show-proper
hence [♦(|E!,x P |) in v]
using qml-3 [axiom-instance, deduction] by auto
thus [(|O!,x P |) in v]
unfolding Ordinary-def

165

apply −apply (PLM-subst-method ♦(|E!,x P |) (|λx. ♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])by show-properqedlemma oa-facts-2 [PLM ]:[(|A!,x P |) → (|A!,x P |) in v]
proof (rule CP)
assume [(|A!,x P |) in v]
hence [¬♦(|E!,x P |) in v]
unfolding Abstract-def apply −apply (rule beta-C-meta-1 [equiv-lr])by show-proper
hence [¬(|E!,x P |) in v]
using KBasic2-4 [equiv-rl] 4[deduction] by auto
hence [¬♦(|E!,x P |) in v]
apply −
apply (PLM-subst-method ¬(|E!,x P |) ¬♦(|E!,x P |))using KBasic2-4 by auto
thus [(|A!,x P |) in v]
unfolding Abstract-def
apply −
apply (PLM-subst-method ¬♦(|E!,x P |) (|λx. ¬♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])by show-properqedlemma oa-facts-3 [PLM ]:[♦(|O!,x P |) → (|O!,x P |) in v]
using oa-facts-1 by (rule derived-S5-rules-2-b)
lemma oa-facts-4 [PLM ]:[♦(|A!,x P |) → (|A!,x P |) in v]
using oa-facts-2 by (rule derived-S5-rules-2-b)
lemma oa-facts-5 [PLM ]:[♦(|O!,x P |) ≡ (|O!,x P |) in v]
using oa-facts-1 [deduction, OF oa-facts-3 [deduction]]T♦[deduction, OF qml-2 [axiom-instance, deduction]]≡I CP by blast
lemma oa-facts-6 [PLM ]:[♦(|A!,x P |) ≡ (|A!,x P |) in v]
using oa-facts-2 [deduction, OF oa-facts-4 [deduction]]T♦[deduction, OF qml-2 [axiom-instance, deduction]]≡I CP by blast
lemma oa-facts-7 [PLM ]:[(|O!,x P |) ≡ A(|O!,x P |) in v]
apply (rule ≡I ; rule CP)
apply (rule nec-imp-act[deduction, OF oa-facts-1 [deduction]]; assumption)
proof −
assume [A(|O!,x P |) in v]
hence [A(♦(|E!,x P |)) in v]
unfolding Ordinary-def apply −apply (PLM-subst-method (|λx. ♦(|E!,x P |),x P |) ♦(|E!,x P |))apply (safe intro!: beta-C-meta-1 )166

by show-proper
hence [♦(|E!,x P |) in v]
using Act-Basic-6 [equiv-rl] by auto
thus [(|O!,x P |) in v]
unfolding Ordinary-def apply −apply (PLM-subst-method ♦(|E!,x P |) (|λx. ♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])by show-properqedlemma oa-facts-8 [PLM ]:[(|A!,x P |) ≡ A(|A!,x P |) in v]
apply (rule ≡I ; rule CP)
apply (rule nec-imp-act[deduction, OF oa-facts-2 [deduction]]; assumption)
proof −
assume [A(|A!,x P |) in v]
hence [A(¬♦(|E!,x P |)) in v]
unfolding Abstract-def apply −apply (PLM-subst-method (|λx. ¬♦(|E!,x P |),x P |) ¬♦(|E!,x P |))apply (safe intro!: beta-C-meta-1 )by show-proper
hence [A(¬(|E!,x P |)) in v]
apply −
apply (PLM-subst-method (¬♦(|E!,x P |)) (¬(|E!,x P |)))
using KBasic2-4 [equiv-sym] by auto
hence [¬♦(|E!,x P |) in v]
using qml-act-2 [axiom-instance, equiv-rl] KBasic2-4 [equiv-lr] by auto
thus [(|A!,x P |) in v]
unfolding Abstract-def apply −apply (PLM-subst-method ¬♦(|E!,x P |) (|λx. ¬♦(|E!,x P |),x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])by show-properqedlemma cont-nec-fact1-1 [PLM ]:[WeaklyContingent F ≡ WeaklyContingent (F − ) in v]
proof (rule ≡I ; rule CP)
assume [WeaklyContingent F in v]
hence wc-def : [Contingent F & (∀ x . (♦(|F ,x P |) → (|F ,x P |))) in v]
unfolding WeaklyContingent-def .
have [Contingent (F − ) in v]
using wc-def [conj1 ] by (rule thm-cont-prop-3 [equiv-lr])
moreover {{fix xassume [♦(|F − ,x P |) in v]
hence [¬(|F ,x P |) in v]
unfolding diamond-def apply −apply (PLM-subst-method ¬(|F − ,x P |) (|F ,x P |))using thm-relation-negation-2-1 by auto
moreover {assume [¬(|F − ,x P |) in v]
hence [¬(|λx. ¬(|F ,x P |),x P |) in v]
unfolding propnot-defs .
hence [♦(|F ,x P |) in v]
unfolding diamond-def
apply − apply (PLM-subst-method (|λx. ¬(|F ,x P |),x P |) ¬(|F ,x P |))apply (safe intro!: beta-C-meta-1 )167

by show-proper
hence [(|F ,x P |) in v]
using wc-def [conj2 ] cqt-1 [axiom-instance, deduction]
modus-ponens by fast}
ultimately have [(|F − , x P |) in v]
using ¬¬E modus-tollens-1 CP by blast}
hence [∀ x . ♦(|F − ,x P |) → (|F − , x P |) in v]
using ∀ I CP by fast}
ultimately show [WeaklyContingent (F − ) in v]
unfolding WeaklyContingent-def by (rule &I )next
assume [WeaklyContingent (F − ) in v]
hence wc-def : [Contingent (F − ) & (∀ x . (♦(|F − ,x P |) → (|F − ,x P |))) in v]
unfolding WeaklyContingent-def .
have [Contingent F in v]
using wc-def [conj1 ] by (rule thm-cont-prop-3 [equiv-rl])moreover {{fix xassume [♦(|F ,x P |) in v]
hence [¬(|F − ,x P |) in v]
unfolding diamond-def apply −apply (PLM-subst-method ¬(|F ,x P |) (|F − ,x P |))using thm-relation-negation-1-1 [equiv-sym] by auto
moreover {assume [¬(|F ,x P |) in v]
hence [♦(|F − ,x P |) in v]
unfolding diamond-def
apply − apply (PLM-subst-method (|F ,x P |) ¬(|F − ,x P |))using thm-relation-negation-2-1 [equiv-sym] by auto
hence [(|F − ,x P |) in v]
using wc-def [conj2 ] cqt-1 [axiom-instance, deduction]
modus-ponens by fast}
ultimately have [(|F , x P |) in v]
using ¬¬E modus-tollens-1 CP by blast}
hence [∀ x . ♦(|F ,x P |) → (|F , x P |) in v]
using ∀ I CP by fast}
ultimately show [WeaklyContingent (F ) in v]
unfolding WeaklyContingent-def by (rule &I )qedlemma cont-nec-fact1-2 [PLM ]:[(WeaklyContingent F & ¬(WeaklyContingent G)) → (F 6= G) in v]
using l-identity[axiom-instance,deduction,deduction] &E &I
modus-tollens-1 CP by metis
lemma cont-nec-fact2-1 [PLM ]:[WeaklyContingent (O!) in v]
unfolding WeaklyContingent-def
apply (rule &I )using oa-contingent-4 apply simp
using oa-facts-5 unfolding equiv-def

168

using &E(1 ) ∀ I by fastlemma cont-nec-fact2-2 [PLM ]:[WeaklyContingent (A!) in v]
unfolding WeaklyContingent-def
apply (rule &I )using oa-contingent-5 apply simp
using oa-facts-6 unfolding equiv-def
using &E(1 ) ∀ I by fastlemma cont-nec-fact2-3 [PLM ]:[¬(WeaklyContingent (E!)) in v]
proof (rule modus-tollens-1 , rule CP)
assume [WeaklyContingent E! in v]
thus [∀ x . ♦(|E!,x P |) → (|E!,x P |) in v]
unfolding WeaklyContingent-def using &E(2 ) by fastnext{
assume 1 : [∀ x . ♦(|E!,x P |) → (|E!,x P |) in v]
have [∃ x . ♦((|E!,x P |) & ♦(¬(|E!,x P |))) in v]
using qml-4 [axiom-instance,conj1 , THEN BFs-3 [deduction]] .
then obtain x where [♦((|E!,x P |) & ♦(¬(|E!,x P |))) in v]
by (rule ∃ E)
hence [♦(|E!,x P |) & ♦(¬(|E!,x P |)) in v]
using KBasic2-8 [deduction] S5Basic-8 [deduction]&I &E by blast
hence [(|E!,x P |) & (¬(|E!,x P |)) in v]
using 1 [THEN ∀ E, deduction] &E &I
KBasic2-2 [equiv-rl] by blast
hence [¬(∀ x . ♦(|E!,x P |) → (|E!,x P |)) in v]
using oth-class-taut-1-a modus-tollens-1 CP by blast}
thus [¬(∀ x . ♦(|E!,x P |) → (|E!,x P |)) in v]
using reductio-aa-2 if-p-then-p CP by mesonqedlemma cont-nec-fact2-4 [PLM ]:[¬(WeaklyContingent (PLM .L)) in v]
proof −{
assume [WeaklyContingent PLM .L in v]
hence [Contingent PLM .L in v]
unfolding WeaklyContingent-def using &E(1 ) by blast}
thus ?thesis
using thm-noncont-e-e-3
unfolding Contingent-def NonContingent-def
using modus-tollens-2 CP by blastqed
lemma cont-nec-fact2-5 [PLM ]:[O! 6= E! & O! 6= (E!− ) & O! 6= PLM .L & O! 6= (PLM .L− ) in v]
proof ((rule &I )+)show [O! 6= E! in v]
using cont-nec-fact2-1 cont-nec-fact2-3
cont-nec-fact1-2 [deduction] &I by simp
nexthave [¬(WeaklyContingent (E!− )) in v]

169

using cont-nec-fact1-1 [THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cont-nec-fact2-3 by auto
thus [O! 6= (E!− ) in v]
using cont-nec-fact2-1 cont-nec-fact1-2 [deduction] &I by simp
nextshow [O! 6= PLM .L in v]
using cont-nec-fact2-1 cont-nec-fact2-4
cont-nec-fact1-2 [deduction] &I by simp
nexthave [¬(WeaklyContingent (PLM .L− )) in v]
using cont-nec-fact1-1 [THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cont-nec-fact2-4 by auto
thus [O! 6= (PLM .L− ) in v]
using cont-nec-fact2-1 cont-nec-fact1-2 [deduction] &I by simp
qedlemma cont-nec-fact2-6 [PLM ]:[A! 6= E! & A! 6= (E!− ) & A! 6= PLM .L & A! 6= (PLM .L− ) in v]
proof ((rule &I )+)show [A! 6= E! in v]
using cont-nec-fact2-2 cont-nec-fact2-3
cont-nec-fact1-2 [deduction] &I by simp
nexthave [¬(WeaklyContingent (E!− )) in v]
using cont-nec-fact1-1 [THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cont-nec-fact2-3 by auto
thus [A! 6= (E!− ) in v]
using cont-nec-fact2-2 cont-nec-fact1-2 [deduction] &I by simp
nextshow [A! 6= PLM .L in v]
using cont-nec-fact2-2 cont-nec-fact2-4
cont-nec-fact1-2 [deduction] &I by simp
nexthave [¬(WeaklyContingent (PLM .L− )) in v]
using cont-nec-fact1-1 [THEN oth-class-taut-5-d[equiv-lr],
equiv-lr] cont-nec-fact2-4 by auto
thus [A! 6= (PLM .L− ) in v]
using cont-nec-fact2-2 cont-nec-fact1-2 [deduction] &I by simp
qedlemma id-nec3-1 [PLM ]:[((x P ) =E (y P )) ≡ (((x P ) =E (y P ))) in v]
proof (rule ≡I ; rule CP)
assume [(x P ) =E (y P ) in v]
hence [(|O!,x P |) in v] ∧ [(|O!,y P |) in v] ∧ [(∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
using eq-E-simple-1 [equiv-lr] using &E by blast
hence [(|O!,x P |) in v] ∧ [(|O!,y P |) in v]∧ [(∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
using oa-facts-1 [deduction] S5Basic-6 [deduction] by blast
hence [((|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |))) in v]
using &I KBasic-3 [equiv-rl] by presburger
thus [((x P ) =E (y P )) in v]
apply −
apply (PLM-subst-method((|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |)))(x P ) =E (y P ))using eq-E-simple-1 [equiv-sym] by auto
next

170

assume [((x P ) =E (y P )) in v]
thus [((x P ) =E (y P )) in v]
using qml-2 [axiom-instance,deduction] by simp
qedlemma id-nec3-2 [PLM ]:[♦((x P ) =E (y P )) ≡ ((x P ) =E (y P )) in v]
proof (rule ≡I ; rule CP)
assume [♦((x P ) =E (y P )) in v]
thus [(x P ) =E (y P ) in v]
using derived-S5-rules-2-b[deduction] id-nec3-1 [equiv-lr]
CP modus-ponens by blastnext
assume [(x P ) =E (y P ) in v]
thus [♦((x P ) =E (y P )) in v]
by (rule TBasic[deduction])qedlemma thm-neg-eqE[PLM ]:[((x P ) 6=E (y P )) ≡ (¬((x P ) =E (y P ))) in v]
proof −
have [(x P ) 6=E (y P ) in v] = [(|(λ2 (λ x y . (x P ) =E (y P )))− , x P , y P |) in v]
unfolding not-identical E -def by simp
also have ... = [¬(|(λ2 (λ x y . (x P ) =E (y P ))), x P , y P |) in v]
unfolding propnot-defs
apply (safe intro!: beta-C-meta-2 [equiv-lr] beta-C-meta-2 [equiv-rl])by show-proper+
also have ... = [¬((x P ) =E (y P )) in v]
apply (PLM-subst-method(|(λ2 (λ x y . (x P ) =E (y P ))), x P , y P |)(x P ) =E (y P ))apply (safe intro!: beta-C-meta-2 )unfolding identity-defs by show-proper
finally show ?thesis
using ≡I CP by presburgerqedlemma id-nec4-1 [PLM ]:[((x P ) 6=E (y P )) ≡ ((x P ) 6=E (y P )) in v]
proof −
have [(¬((x P ) =E (y P ))) ≡ (¬((x P ) =E (y P ))) in v]
using id-nec3-2 [equiv-sym] oth-class-taut-5-d[equiv-lr]
KBasic2-4 [equiv-sym] intro-elim-6-e by fast
thus ?thesis
apply −
apply (PLM-subst-method (¬((x P ) =E (y P ))) (x P ) 6=E (y P ))using thm-neg-eqE[equiv-sym] by autoqed
lemma id-nec4-2 [PLM ]:[♦((x P ) 6=E (y P )) ≡ ((x P ) 6=E (y P )) in v]
using ≡I id-nec4-1 [equiv-lr] derived-S5-rules-2-b CP T♦ by simp
lemma id-act-1 [PLM ]:[((x P ) =E (y P )) ≡ (A((x P ) =E (y P ))) in v]
proof (rule ≡I ; rule CP)
assume [(x P ) =E (y P ) in v]
hence [((x P ) =E (y P )) in v]

171using id-nec3-1 [equiv-lr] by auto
thus [A((x P ) =E (y P )) in v]
using nec-imp-act[deduction] by fastnext
assume [A((x P ) =E (y P )) in v]
hence [A((|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |))) in v]
apply −
apply (PLM-subst-method(x P ) =E (y P )((|O!,x P |) & (|O!,y P |) & (∀ F . (|F ,x P |) ≡ (|F ,y P |))))
using eq-E-simple-1 by auto
hence [A(|O!,x P |) & A(|O!,y P |) & A((∀ F . (|F ,x P |) ≡ (|F ,y P |))) in v]
using Act-Basic-2 [equiv-lr] &I &E by meson
thus [(x P ) =E (y P ) in v]
apply − apply (rule eq-E-simple-1 [equiv-rl])using oa-facts-7 [equiv-rl] qml-act-2 [axiom-instance, equiv-rl]&I &E by mesonqedlemma id-act-2 [PLM ]:[((x P ) 6=E (y P )) ≡ (A((x P ) 6=E (y P ))) in v]
apply (PLM-subst-method (¬((x P ) =E (y P ))) ((x P ) 6=E (y P )))using thm-neg-eqE[equiv-sym] apply simp
using id-act-1 oth-class-taut-5-d[equiv-lr] thm-neg-eqE intro-elim-6-e
logic-actual-nec-1 [axiom-instance,equiv-sym] by mesonendclass id-act = id-eq +assumes id-act-prop: [A(α = β) in v] =⇒ [(α = β) in v]
instantiation ν :: id-act
begin
instance proof
interpret PLM .
fix x::ν and y::ν and v::iassume [A(x = y) in v]
hence [A(((x P ) =E (y P )) ∨ ((|A!,x P |) & (|A!,y P |)& (∀ F . {|x P ,F |} ≡ {|y P ,F |}))) in v]
unfolding identity-defs by auto
hence [A(((x P ) =E (y P ))) ∨ A(((|A!,x P |) & (|A!,y P |)& (∀ F . {|x P ,F |} ≡ {|y P ,F |}))) in v]
using Act-Basic-10 [equiv-lr] by auto
moreover {assume [A(((x P ) =E (y P ))) in v]
hence [(x P ) = (y P ) in v]
using id-act-1 [equiv-rl] eq-E-simple-2 [deduction] by auto}
moreover {assume [A((|A!,x P |) & (|A!,y P |) & (∀ F . {|x P ,F |} ≡ {|y P ,F |})) in v]
hence [A(|A!,x P |) & A(|A!,y P |) & A((∀ F . {|x P ,F |} ≡ {|y P ,F |})) in v]
using Act-Basic-2 [equiv-lr] &I &E by meson
hence [(|A!,x P |) & (|A!,y P |) & ((∀ F . {|x P ,F |} ≡ {|y P ,F |})) in v]
using oa-facts-8 [equiv-rl] qml-act-2 [axiom-instance,equiv-rl]&I &E by meson
hence [(x P ) = (y P ) in v]
unfolding identity-defs using ∨I by auto}172ultimately have [(x P ) = (y P ) in v]
using intro-elim-4-a CP by meson
thus [x = y in v]
unfolding identity-defs by autoqed
end
instantiation Π1 :: id-act
begin
instance proof
interpret PLM .
fix F ::Π1 and G::Π1 and v::ishow [A(F = G) in v] =⇒ [(F = G) in v]
unfolding identity-defs
using qml-act-2 [axiom-instance,equiv-rl] by autoqed
end
instantiation o :: id-act
begin
instance proof
interpret PLM .
fix p :: o and q :: o and v::ishow [A(p = q) in v] =⇒ [p = q in v]
unfolding identity o -def using id-act-prop by blastqed
end
instantiation Π2 :: id-act
begin
instance proof
interpret PLM .
fix F ::Π2 and G::Π2 and v::iassume a: [A(F = G) in v]{
fix x
have [A((λy. (|F ,x P ,y P |)) = (λy. (|G,x P ,y P |))& (λy. (|F ,y P ,x P |)) = (λy. (|G,y P ,x P |))) in v]
using a logic-actual-nec-3 [axiom-instance, equiv-lr] cqt-basic-4 [equiv-lr] ∀ E
unfolding identity 2 -def by fasthence [((λy. (|F ,x P ,y P |)) = (λy. (|G,x P ,y P |)))& ((λy. (|F ,y P ,x P |)) = (λy. (|G,y P ,x P |))) in v]
using &I &E id-act-prop Act-Basic-2 [equiv-lr] by metis}
thus [F = G in v] unfolding identity-defs by (rule ∀ I )qed
end
instantiation Π3 :: id-act
begin
instance proof
interpret PLM .
fix F ::Π3 and G::Π3 and v::iassume a: [A(F = G) in v]
let ?p = λ x y . (λz. (|F ,z P ,x P ,y P |)) = (λz. (|G,z P ,x P ,y P |))& (λz. (|F ,x P ,z P ,y P |)) = (λz. (|G,x P ,z P ,y P |))& (λz. (|F ,x P ,y P ,z P |)) = (λz. (|G,x P ,y P ,z P |)){173

fix x{fix yhave [A(?p x y) in v]
using a logic-actual-nec-3 [axiom-instance, equiv-lr]
cqt-basic-4 [equiv-lr] ∀ E[where 0a=ν]
unfolding identity 3 -def by blast
hence [?p x y in v]
using &I &E id-act-prop Act-Basic-2 [equiv-lr] by metis}
hence [∀ y . ?p x y in v]
by (rule ∀ I )}thus [F = G in v]
unfolding identity 3 -def by (rule ∀ I )qed
end
context PLM
beginlemma id-act-3 [PLM ]:[((α::( 0a::id-act)) = β) ≡ A(α = β) in v]
using ≡I CP id-nec[equiv-lr, THEN nec-imp-act[deduction]]
id-act-prop by metis
lemma id-act-4 [PLM ]:[((α::( 0a::id-act)) 6= β) ≡ A(α 6= β) in v]
using id-act-3 [THEN oth-class-taut-5-d[equiv-lr]]
logic-actual-nec-1 [axiom-instance, equiv-sym]
intro-elim-6-e by blast
lemma id-act-desc[PLM ]:[(y P ) = (ιx . x = y) in v]
using descriptions[axiom-instance,equiv-rl]
id-act-3 [equiv-sym] ∀ I by fastlemma eta-conversion-lemma-1 [PLM ]:[(λ x . (|F ,x P |)) = F in v]
using lambda-predicates-3-1 [axiom-instance] .
lemma eta-conversion-lemma-0 [PLM ]:[(λ0 p) = p in v]
using lambda-predicates-3-0 [axiom-instance] .
lemma eta-conversion-lemma-2 [PLM ]:[(λ2 (λ x y . (|F ,x P ,y P |))) = F in v]
using lambda-predicates-3-2 [axiom-instance] .
lemma eta-conversion-lemma-3 [PLM ]:[(λ3 (λ x y z . (|F ,x P ,y P ,z P |))) = F in v]
using lambda-predicates-3-3 [axiom-instance] .
lemma lambda-p-q-p-eq-q[PLM ]:[((λ0 p) = (λ0 q)) ≡ (p = q) in v]
using eta-conversion-lemma-0
l-identity[axiom-instance, deduction, deduction]
eta-conversion-lemma-0 [eq-sym] ≡I CP
by metis174

A.9.12. The Theory of Objects
lemma partition-1 [PLM ]:[∀ x . (|O!,x P |) ∨ (|A!,x P |) in v]
proof (rule ∀ I )fix xhave [♦(|E!,x P |) ∨ ¬♦(|E!,x P |) in v]
by PLM-solver
moreover have [♦(|E!,x P |) ≡ (|λ y . ♦(|E!,y P |), x P |) in v]
apply (rule beta-C-meta-1 [equiv-sym])by show-proper
moreover have [(¬♦(|E!,x P |)) ≡ (|λ y . ¬♦(|E!,y P |), x P |) in v]
apply (rule beta-C-meta-1 [equiv-sym])by show-proper
ultimately show [(|O!, x P |) ∨ (|A!, x P |) in v]
unfolding Ordinary-def Abstract-def by PLM-solverqedlemma partition-2 [PLM ]:[¬(∃ x . (|O!,x P |) & (|A!,x P |)) in v]
proof −{
assume [∃ x . (|O!,x P |) & (|A!,x P |) in v]
then obtain b where [(|O!,bP |) & (|A!,bP |) in v]
by (rule ∃ E)
hence ?thesis
using &E oa-contingent-2 [equiv-lr]
reductio-aa-2 by fast}
thus ?thesis
using reductio-aa-2 by blastqed
lemma ord-eq-Eequiv-1 [PLM ]:[(|O!,x|) → (x =E x) in v]
proof (rule CP)
assume [(|O!,x|) in v]
moreover have [(∀ F . (|F ,x|) ≡ (|F ,x|)) in v]
by PLM-solver
ultimately show [(x) =E (x) in v]
using &I eq-E-simple-1 [equiv-rl] by blastqed
lemma ord-eq-Eequiv-2 [PLM ]:[(x =E y) → (y =E x) in v]
proof (rule CP)
assume [x =E y in v]
hence 1 : [(|O!,x|) & (|O!,y|) & (∀ F . (|F ,x|) ≡ (|F ,y|)) in v]
using eq-E-simple-1 [equiv-lr] by simp
have [(∀ F . (|F ,y|) ≡ (|F ,x|)) in v]
apply (PLM-subst-method
λ F . (|F ,x|) ≡ (|F ,y|)λ F . (|F ,y|) ≡ (|F ,x|))using oth-class-taut-3-g 1 [conj2 ] by auto
thus [y =E x in v]
using eq-E-simple-1 [equiv-rl] 1 [conj1 ]&E &I by meson
qed

175

lemma ord-eq-Eequiv-3 [PLM ]:[((x =E y) & (y =E z)) → (x =E z) in v]
proof (rule CP)
assume a: [(x =E y) & (y =E z) in v]
have [((∀ F . (|F ,x|) ≡ (|F ,y|)) & (∀ F . (|F ,y|) ≡ (|F ,z|))) in v]
using KBasic-3 [equiv-rl] a[conj1 , THEN eq-E-simple-1 [equiv-lr,conj2 ]]a[conj2 , THEN eq-E-simple-1 [equiv-lr,conj2 ]] &I by blast
moreover {{fix w
have [((∀ F . (|F ,x|) ≡ (|F ,y|)) & (∀ F . (|F ,y|) ≡ (|F ,z|)))→ (∀ F . (|F ,x|) ≡ (|F ,z|)) in w]
by PLM-solver}
hence [(((∀ F . (|F ,x|) ≡ (|F ,y|)) & (∀ F . (|F ,y|) ≡ (|F ,z|)))→ (∀ F . (|F ,x|) ≡ (|F ,z|))) in v]
by (rule RN )}ultimately have [(∀ F . (|F ,x|) ≡ (|F ,z|)) in v]
using qml-1 [axiom-instance,deduction,deduction] by blast
thus [x =E z in v]
using a[conj1 , THEN eq-E-simple-1 [equiv-lr,conj1 ,conj1 ]]using a[conj2 , THEN eq-E-simple-1 [equiv-lr,conj1 ,conj2 ]]eq-E-simple-1 [equiv-rl] &I
by presburgerqedlemma ord-eq-E-eq[PLM ]:[((|O!,x P |) ∨ (|O!,y P |)) → ((x P = y P ) ≡ (x P =E y P )) in v]
proof (rule CP)
assume [(|O!,x P |) ∨ (|O!,y P |) in v]
moreover {assume [(|O!,x P |) in v]
hence [(x P = y P ) ≡ (x P =E y P ) in v]
using ≡I CP l-identity[axiom-instance, deduction, deduction]
ord-eq-Eequiv-1 [deduction] eq-E-simple-2 [deduction] by metis}
moreover {assume [(|O!,y P |) in v]
hence [(x P = y P ) ≡ (x P =E y P ) in v]
using ≡I CP l-identity[axiom-instance, deduction, deduction]
ord-eq-Eequiv-1 [deduction] eq-E-simple-2 [deduction] id-eq-2 [deduction]
ord-eq-Eequiv-2 [deduction] identity-ν-def by metis}
ultimately show [(x P = y P ) ≡ (x P =E y P ) in v]
using intro-elim-4-a CP by blastqed
lemma ord-eq-E[PLM ]:[((|O!,x P |) & (|O!,y P |)) → ((∀ F . (|F ,x P |) ≡ (|F ,y P |)) → x P =E y P ) in v]
proof (rule CP; rule CP)
assume ord-xy: [(|O!,x P |) & (|O!,y P |) in v]
assume [∀ F . (|F ,x P |) ≡ (|F ,y P |) in v]
hence [(|λ z . z P =E x P , x P |) ≡ (|λ z . z P =E x P , y P |) in v]
by (rule ∀ E)
moreover have [(|λ z . z P =E x P , x P |) in v]
apply (rule beta-C-meta-1 [equiv-rl])

176unfolding identity E -infix-def
apply show-proper
using ord-eq-Eequiv-1 [deduction] ord-xy[conj1 ]unfolding identity E -infix-def by simp
ultimately have [(|λ z . z P =E x P , y P |) in v]
using ≡E by blast
hence [y P =E x P in v]
unfolding identity E -infix-def
apply (safe intro!:
beta-C-meta-1 [where ϕ = λ z . (|basic-identity E ,z,x P |), equiv-lr])by show-properthus [x P =E y P in v]
by (rule ord-eq-Eequiv-2 [deduction])qedlemma ord-eq-E2 [PLM ]:[((|O!,x P |) & (|O!,y P |)) →((x P 6= y P ) ≡ (λz . z P =E x P ) 6= (λz . z P =E y P )) in v]
proof (rule CP; rule ≡I ; rule CP)
assume ord-xy: [(|O!,x P |) & (|O!,y P |) in v]
assume [x P 6= y P in v]
hence [¬(x P =E y P ) in v]
using eq-E-simple-2 modus-tollens-1 by fast
moreover {assume [(λz . z P =E x P ) = (λz . z P =E y P ) in v]
moreover have [(|λz . z P =E x P , x P |) in v]
apply (rule beta-C-meta-1 [equiv-rl])
unfolding identity E -infix-def
apply show-proper
using ord-eq-Eequiv-1 [deduction] ord-xy[conj1 ]unfolding identity E -infix-def by presburger
ultimately have [(|λz . z P =E y P , x P |) in v]
using l-identity[axiom-instance, deduction, deduction] by fasthence [x P =E y P in v]
unfolding identity E -infix-def
apply (safe intro!:
beta-C-meta-1 [where ϕ = λ z . (|basic-identity E ,z,y P |), equiv-lr])by show-proper}
ultimately show [(λz . z P =E x P ) 6= (λz . z P =E y P ) in v]
using modus-tollens-1 CP by blastnext
assume ord-xy: [(|O!,x P |) & (|O!,y P |) in v]
assume [(λz . z P =E x P ) 6= (λz . z P =E y P ) in v]
moreover {assume [x P = y P in v]
hence [(λz . z P =E x P ) = (λz . z P =E y P ) in v]
using id-eq-1 l-identity[axiom-instance, deduction, deduction]
by fast}ultimately show [x P 6= y P in v]
using modus-tollens-1 CP by blastqed
lemma ab-obey-1 [PLM ]:[((|A!,x P |) & (|A!,y P |)) → ((∀ F . {|x P , F |} ≡ {|y P , F |}) → x P = y P ) in v]
proof (rule CP; rule CP)
assume abs-xy: [(|A!,x P |) & (|A!,y P |) in v]

177

assume enc-equiv: [∀ F . {|x P , F |} ≡ {|y P , F |} in v]{
fix P
have [{|x P , P|} ≡ {|y P , P|} in v]
using enc-equiv by (rule ∀ E)
hence [({|x P , P|} ≡ {|y P , P|}) in v]
using en-eq-2 intro-elim-6-e intro-elim-6-f
en-eq-5 [equiv-rl] by meson}
hence [(∀ F . {|x P , F |} ≡ {|y P , F |}) in v]
using BF [deduction] ∀ I by fast
thus [x P = y P in v]
unfolding identity-defs
using ∨I (2 ) abs-xy &I by presburgerqedlemma ab-obey-2 [PLM ]:[((|A!,x P |) & (|A!,y P |)) → ((∃ F . {|x P , F |} & ¬{|y P , F |}) → x P 6= y P ) in v]
proof (rule CP; rule CP)
assume abs-xy: [(|A!,x P |) & (|A!,y P |) in v]
assume [∃ F . {|x P , F |} & ¬{|y P , F |} in v]
then obtain P where P-prop:[{|x P , P|} & ¬{|y P , P|} in v]
by (rule ∃ E){
assume [x P = y P in v]
hence [{|x P , P|} ≡ {|y P , P|} in v]
using l-identity[axiom-instance, deduction, deduction]oth-class-taut-4-a by fasthence [{|y P , P|} in v]
using P-prop[conj1 ] by (rule ≡E)}
thus [x P 6= y P in v]
using P-prop[conj2 ] modus-tollens-1 CP by blastqed
lemma ordnecfail[PLM ]:[(|O!,x P |) → (¬(∃ F . {|x P , F |})) in v]
proof (rule CP)
assume [(|O!,x P |) in v]
hence [(|O!,x P |) in v]
using oa-facts-1 [deduction] by simp
moreover hence [((|O!,x P |) → (¬(∃ F . {|x P , F |}))) in v]
using nocoder[axiom-necessitation, axiom-instance] by simp
ultimately show [(¬(∃ F . {|x P , F |})) in v]
using qml-1 [axiom-instance, deduction, deduction] by fastqedlemma o-objects-exist-1 [PLM ]:[♦(∃ x . (|E!,x P |)) in v]
proof −
have [♦(∃ x . (|E!,x P |) & ♦(¬(|E!,x P |))) in v]
using qml-4 [axiom-instance, conj1 ] .
hence [♦((∃ x . (|E!,x P |)) & (∃ x . ♦(¬(|E!,x P |)))) in v]
using sign-S5-thm-3 [deduction] by fasthence [♦(∃ x . (|E!,x P |)) & ♦(∃ x . ♦(¬(|E!,x P |))) in v]
using KBasic2-8 [deduction] by blast
thus ?thesis using &E by blast

178

qed
lemma o-objects-exist-2 [PLM ]:[(∃ x . (|O!,x P |)) in v]
apply (rule RN ) unfolding Ordinary-def
apply (PLM-subst-method λ x . ♦(|E!,x P |) λ x . (|λy. ♦(|E!,y P |), x P |))apply (safe intro!: beta-C-meta-1 [equiv-sym])
apply show-proper
using o-objects-exist-1 BF♦[deduction] by blast
lemma o-objects-exist-3 [PLM ]:[(¬(∀ x . (|A!,x P |))) in v]
apply (PLM-subst-method (∃ x. ¬(|A!,x P |)) ¬(∀ x. (|A!,x P |)))
using cqt-further-2 [equiv-sym] apply fast
apply (PLM-subst-method λ x . (|O!,x P |) λ x . ¬(|A!,x P |))using oa-contingent-2 o-objects-exist-2 by auto
lemma a-objects-exist-1 [PLM ]:[(∃ x . (|A!,x P |)) in v]
proof −{
fix v
have [∃ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (F = F )) in v]
using A-objects[axiom-instance] by simp
hence [∃ x . (|A!,x P |) in v]
using cqt-further-5 [deduction,conj1 ] by fast}
thus ?thesis by (rule RN )qedlemma a-objects-exist-2 [PLM ]:[(¬(∀ x . (|O!,x P |))) in v]
apply (PLM-subst-method (∃ x. ¬(|O!,x P |)) ¬(∀ x. (|O!,x P |)))
using cqt-further-2 [equiv-sym] apply fast
apply (PLM-subst-method λ x . (|A!,x P |) λ x . ¬(|O!,x P |))using oa-contingent-3 a-objects-exist-1 by auto
lemma a-objects-exist-3 [PLM ]:[(¬(∀ x . (|E!,x P |))) in v]
proof −{
fix v
have [∃ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (F = F )) in v]
using A-objects[axiom-instance] by simp
hence [∃ x . (|A!,x P |) in v]
using cqt-further-5 [deduction,conj1 ] by fastthen obtain a where[(|A!,a P |) in v]
by (rule ∃ E)
hence [¬(♦(|E!,a P |)) in v]
unfolding Abstract-def
apply (safe intro!: beta-C-meta-1 [equiv-lr])by show-proper
hence [(¬(|E!,a P |)) in v]
using KBasic2-4 [equiv-rl] qml-2 [axiom-instance,deduction]
by simphence [¬(∀ x . (|E!,x P |)) in v]
using ∃ I cqt-further-2 [equiv-rl]

179

by fast}
thus ?thesisby (rule RN )qedlemma encoders-are-abstract[PLM ]:[(∃ F . {|x P , F |}) → (|A!,x P |) in v]
using nocoder[axiom-instance] contraposition-2
oa-contingent-2 [THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
useful-tautologies-1 [deduction]
vdash-properties-10 CP by metis
lemma A-objects-unique[PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F ) in v]
proof −
have [∃ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F ) in v]
using A-objects[axiom-instance] by simp
then obtain a where a-prop:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ ϕ F ) in v] by (rule ∃ E)
moreover have [∀ y . (|A!,y P |) & (∀ F . {|y P , F |} ≡ ϕ F ) → (y = a) in v]
proof (rule ∀ I ; rule CP)
fix bassume b-prop: [(|A!,bP |) & (∀ F . {|bP , F |} ≡ ϕ F ) in v]{
fix P
have [{|bP ,P|} ≡ {|a P , P|} in v]
using a-prop[conj2 ] b-prop[conj2 ] ≡I ≡E(1 ) ≡E(2 )CP vdash-properties-10 ∀ E by metis}
hence [∀ F . {|bP ,F |} ≡ {|a P , F |} in v]
using ∀ I by fast
thus [b = a in v]
unfolding identity-ν-defusing ab-obey-1 [deduction, deduction]
a-prop[conj1 ] b-prop[conj1 ] &I by blast
qed
ultimately show ?thesis
unfolding exists-unique-def
using &I ∃ I by fastqedlemma obj-oth-1 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (|F , y P |)) in v]
using A-objects-unique .
lemma obj-oth-2 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ((|F , y P |) & (|F , z P |))) in v]
using A-objects-unique .
lemma obj-oth-3 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ((|F , y P |) ∨ (|F , z P |))) in v]
using A-objects-unique .
lemma obj-oth-4 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ((|F , y P |))) in v]
using A-objects-unique .

180lemma obj-oth-5 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (F = G)) in v]
using A-objects-unique .
lemma obj-oth-6 [PLM ]:[∃ ! x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (∀ y . (|G, y P |) → (|F , y P |))) in v]
using A-objects-unique .
lemma A-Exists-1 [PLM ]:[A(∃ ! x :: ( 0a :: id-act) . ϕ x) ≡ (∃ ! x . A(ϕ x)) in v]
unfolding exists-unique-def
proof (rule ≡I ; rule CP)
assume [A(∃ α. ϕ α & (∀ β. ϕ β → β = α)) in v]
hence [∃ α. A(ϕ α & (∀ β. ϕ β → β = α)) in v]
using Act-Basic-11 [equiv-lr] by blast
then obtain α where[A(ϕ α & (∀ β. ϕ β → β = α)) in v]
by (rule ∃ E)
hence 1 : [A(ϕ α) & A(∀ β. ϕ β → β = α) in v]
using Act-Basic-2 [equiv-lr] by blast
have 2 : [∀ β. A(ϕ β → β = α) in v]
using 1 [conj2 ] logic-actual-nec-3 [axiom-instance, equiv-lr] by blast{
fix βhave [A(ϕ β → β = α) in v]
using 2 by (rule ∀ E)
hence [A(ϕ β) → (β = α) in v]
using logic-actual-nec-2 [axiom-instance, equiv-lr, deduction]id-act-3 [equiv-rl] CP by blast}
hence [∀ β . A(ϕ β) → (β = α) in v]
by (rule ∀ I )thus [∃ α. Aϕ α & (∀ β. Aϕ β → β = α) in v]
using 1 [conj1 ] &I ∃ I by fastnext
assume [∃ α. Aϕ α & (∀ β. Aϕ β → β = α) in v]
then obtain α where 1 :[Aϕ α & (∀ β. Aϕ β → β = α) in v]
by (rule ∃ E){
fix β
have [A(ϕ β) → β = α in v]
using 1 [conj2 ] by (rule ∀ E)
hence [A(ϕ β → β = α) in v]
using logic-actual-nec-2 [axiom-instance, equiv-rl] id-act-3 [equiv-lr]
vdash-properties-10 CP by blast}
hence [∀ β . A(ϕ β → β = α) in v]
by (rule ∀ I )hence [A(∀ β . ϕ β → β = α) in v]
using logic-actual-nec-3 [axiom-instance, equiv-rl] by fasthence [A(ϕ α & (∀ β . ϕ β → β = α)) in v]
using 1 [conj1 ] Act-Basic-2 [equiv-rl] &I by blast
hence [∃ α. A(ϕ α & (∀ β. ϕ β → β = α)) in v]
using ∃ I by fast
thus [A(∃ α. ϕ α & (∀ β. ϕ β → β = α)) in v]
using Act-Basic-11 [equiv-rl] by fast
qed

181

lemma A-Exists-2 [PLM ]:[(∃ y . y P = (ιx . ϕ x)) ≡ A(∃ !x . ϕ x) in v]
using actual-desc-1 A-Exists-1 [equiv-sym]
intro-elim-6-e by blast
lemma A-descriptions[PLM ]:[∃ y . y P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )) in v]
using A-objects-unique[THEN RN , THEN nec-imp-act[deduction]]
A-Exists-2 [equiv-rl] by auto
lemma thm-can-terms2 [PLM ]:[(y P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )))→ ((|A!,y P |) & (∀ F . {|y P ,F |} ≡ ϕ F )) in dw]
using y-in-2 by auto
lemma can-ab2 [PLM ]:[(y P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F ))) → (|A!,y P |) in v]
proof (rule CP)
assume [y P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )) in v]
hence [A(|A!,y P |) & A(∀ F . {|y P ,F |} ≡ ϕ F ) in v]
using nec-hintikka-scheme[equiv-lr, conj1 ]Act-Basic-2 [equiv-lr] by blast
thus [(|A!,y P |) in v]
using oa-facts-8 [equiv-rl] &E by blastqed
lemma desc-encode[PLM ]:[{|ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F ), G|} ≡ ϕ G in dw]
proof −
obtain a where[a P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )) in dw]
using A-descriptions by (rule ∃ E)
moreover hence [{|a P , G|} ≡ ϕ G in dw]
using hintikka[equiv-lr, conj1 ] &E ∀ E by fast
ultimately show ?thesis
using l-identity[axiom-instance, deduction, deduction] by fastqedlemma desc-nec-encode[PLM ]:[{|ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F ), G|} ≡ A(ϕ G) in v]
proof −
obtain a where[a P = (ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )) in v]
using A-descriptions by (rule ∃ E)
moreover {hence [A((|A!,a P |) & (∀ F . {|a P ,F |} ≡ ϕ F )) in v]
using nec-hintikka-scheme[equiv-lr, conj1 ] by fasthence [A(∀ F . {|a P ,F |} ≡ ϕ F ) in v]
using Act-Basic-2 [equiv-lr,conj2 ] by blast
hence [∀ F . A( {|a P ,F |} ≡ ϕ F ) in v]
using logic-actual-nec-3 [axiom-instance, equiv-lr] by blast
hence [A({|a P , G|} ≡ ϕ G) in v]
using ∀ E by fasthence [A{|a P , G|} ≡ A(ϕ G) in v]
using Act-Basic-5 [equiv-lr] by fasthence [{|a P , G|} ≡ A(ϕ G) in v]
using en-eq-10 [equiv-sym] intro-elim-6-e by blast

182

}ultimately show ?thesis
using l-identity[axiom-instance, deduction, deduction] by fast
qed
notepadbegin
fix v
let ?x = ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (∃ q . q & F = (λ y . q)))have [(∃ p . ContingentlyTrue p) in v]
using cont-tf-thm-3 RN by auto
hence [A(∃ p . ContingentlyTrue p) in v]
using nec-imp-act[deduction] by simp
hence [∃ p . A(ContingentlyTrue p) in v]
using Act-Basic-11 [equiv-lr] by auto
then obtain p1 where[A(ContingentlyTrue p1 ) in v]
by (rule ∃ E)
hence [Ap1 in v]
unfolding ContingentlyTrue-def
using Act-Basic-2 [equiv-lr] &E by fasthence [Ap1 & A((λ y . p1 ) = (λ y . p1 )) in v]
using &I id-eq-1 [THEN RN , THEN nec-imp-act[deduction]] by fasthence [A(p1 & (λ y . p1 ) = (λ y . p1 )) in v]
using Act-Basic-2 [equiv-rl] by fasthence [∃ q . A( q & (λ y . p1 ) = (λ y . q)) in v]
using ∃ I by fasthence [A(∃ q . q & (λ y . p1 ) = (λ y . q)) in v]
using Act-Basic-11 [equiv-rl] by fast
moreover have [{|?x, λ y . p1 |} ≡ A(∃ q . q & (λ y . p1 ) = (λ y . q)) in v]
using desc-nec-encode by fast
ultimately have [{|?x, λ y . p1 |} in v]
using ≡E by blastendlemma Box-desc-encode-1 [PLM ]:[(ϕ G) → {|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|} in v]
proof (rule CP)
assume [(ϕ G) in v]
hence [A(ϕ G) in v]
using nec-imp-act[deduction] by auto
thus [{|ιx . (|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F ), G|} in v]
using desc-nec-encode[equiv-rl] by simp
qedlemma Box-desc-encode-2 [PLM ]:[(ϕ G) → ({|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|} ≡ ϕ G) in v]
proof (rule CP)
assume a: [(ϕ G) in v]
hence [({|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|} → ϕ G) in v]
using KBasic-1 [deduction] by simp
moreover {have [{|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|} in v]
using a Box-desc-encode-1 [deduction] by auto
hence [{|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|} in v]
using encoding[axiom-instance,deduction] by blast
hence [(ϕ G → {|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|}) in v]
using KBasic-1 [deduction] by simp

183

}
ultimately show [({|(ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )), G|}≡ ϕ G) in v]
using &I KBasic-4 [equiv-rl] by blastqed
lemma box-phi-a-1 [PLM ]:assumes [(∀ F . ϕ F → (ϕ F )) in v]
shows [((|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )) → ((|A!,x P |)& (∀ F . {|x P , F |} ≡ ϕ F )) in v]
proof (rule CP)
assume a: [((|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )) in v]
have [(|A!,x P |) in v]
using oa-facts-2 [deduction] a[conj1 ] by auto
moreover have [(∀ F . {|x P , F |} ≡ ϕ F ) in v]
proof (rule BF [deduction]; rule ∀ I )fix F
have ϑ: [(ϕ F → (ϕ F )) in v]
using assms[THEN CBF [deduction]] by (rule ∀ E)
moreover have [({|x P , F |} → {|x P , F |}) in v]
using encoding[axiom-necessitation, axiom-instance] by simp
moreover have [{|x P , F |} ≡ (ϕ F ) in v]
proof (rule ≡I ; rule CP)
assume [{|x P , F |} in v]
hence [{|x P , F |} in v]
using qml-2 [axiom-instance, deduction] by blast
hence [ϕ F in v]
using a[conj2 ] ∀ E[where 0a=Π1 ] ≡E by blast
thus [(ϕ F ) in v]
using ϑ[THEN qml-2 [axiom-instance, deduction], deduction] by simp
next
assume [(ϕ F ) in v]
hence [ϕ F in v]
using qml-2 [axiom-instance, deduction] by blast
hence [{|x P , F |} in v]
using a[conj2 ] ∀ E[where 0a=Π1 ] ≡E by blast
thus [{|x P , F |} in v]
using encoding[axiom-instance, deduction] by simp
qed
ultimately show [({|x P ,F |} ≡ ϕ F ) in v]
using sc-eq-box-box-3 [deduction, deduction] &I by blast
qed
ultimately show [((|A!,x P |) & (∀ F . {|x P ,F |} ≡ ϕ F )) in v]
using &I KBasic-3 [equiv-rl] by blastqed
lemma box-phi-a-2 [PLM ]:assumes [(∀ F . ϕ F → (ϕ F )) in v]
shows [y P = (ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F ))→ ((|A!,y P |) & (∀ F . {|y P , F |} ≡ ϕ F )) in v]
proof −
let ?ψ = λ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )have [∀ x . ?ψ x → (?ψ x) in v]
using box-phi-a-1 [OF assms] ∀ I by fasthence [(∃ ! x . ?ψ x) → (∀ y . y P = (ιx . ?ψ x) → ?ψ y) in v]
using unique-box-desc[deduction] by fasthence [(∀ y . y P = (ιx . ?ψ x) → ?ψ y) in v]
using A-objects-unique modus-ponens by blast184

thus ?thesis by (rule ∀ E)
qedlemma box-phi-a-3 [PLM ]:assumes [(∀ F . ϕ F → (ϕ F )) in v]
shows [{|ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F ), G|} ≡ ϕ G in v]
proof −
obtain a where[a P = (ιx . (|A!,x P |) & (∀ F . {|x P , F |} ≡ ϕ F )) in v]
using A-descriptions by (rule ∃ E)
moreover {hence [(∀ F . {|a P , F |} ≡ ϕ F ) in v]
using box-phi-a-2 [OF assms, deduction, conj2 ] by blast
hence [{|a P , G|} ≡ ϕ G in v] by (rule ∀ E)}
ultimately show ?thesis
using l-identity[axiom-instance, deduction, deduction] by fastqedlemma null-uni-uniq-1 [PLM ]:[∃ ! x . Null (x P ) in v]
proof −
have [∃ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (F 6= F )) in v]
using A-objects[axiom-instance] by simp
then obtain a where a-prop:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ (F 6= F )) in v]
by (rule ∃ E)
have 1 : [(|A!,a P |) & (¬(∃ F . {|a P , F |})) in v]
using a-prop[conj1 ] apply (rule &I )proof −{
assume [∃ F . {|a P , F |} in v]
then obtain P where[{|a P , P|} in v] by (rule ∃ E)
hence [P 6= P in v]
using a-prop[conj2 , THEN ∀ E, equiv-lr] by simp
hence [¬(∃ F . {|a P , F |}) in v]
using id-eq-1 reductio-aa-1 by fast}
thus [¬(∃ F . {|a P , F |}) in v]
using reductio-aa-1 by blast
qed
moreover have [∀ y . ((|A!,y P |) & (¬(∃ F . {|y P , F |}))) → y = a in v]
proof (rule ∀ I ; rule CP)
fix yassume 2 : [(|A!,y P |) & (¬(∃ F . {|y P , F |})) in v]
have [∀ F . {|y P , F |} ≡ {|a P , F |} in v]
using cqt-further-12 [deduction] 1 [conj2 ] 2 [conj2 ] &I by blast
thus [y = a in v]
using ab-obey-1 [deduction, deduction]&I [OF 2 [conj1 ] 1 [conj1 ]] identity-ν-def by presburger
qed
ultimately show ?thesis
using &I ∃ I
unfolding Null-def exists-unique-def by fastqedlemma null-uni-uniq-2 [PLM ]:185

[∃ ! x . Universal (x P ) in v]
proof −
have [∃ x . (|A!,x P |) & (∀ F . {|x P , F |} ≡ (F = F )) in v]
using A-objects[axiom-instance] by simp
then obtain a where a-prop:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ (F = F )) in v]
by (rule ∃ E)
have 1 : [(|A!,a P |) & (∀ F . {|a P , F |}) in v]
using a-prop[conj1 ] apply (rule &I )using ∀ I a-prop[conj2 , THEN ∀ E, equiv-rl] id-eq-1 by fast
moreover have [∀ y . ((|A!,y P |) & (∀ F . {|y P , F |})) → y = a in v]
proof (rule ∀ I ; rule CP)
fix yassume 2 : [(|A!,y P |) & (∀ F . {|y P , F |}) in v]
have [∀ F . {|y P , F |} ≡ {|a P , F |} in v]
using cqt-further-11 [deduction] 1 [conj2 ] 2 [conj2 ] &I by blast
thus [y = a in v]
using ab-obey-1 [deduction, deduction]&I [OF 2 [conj1 ] 1 [conj1 ]] identity-ν-def
by presburger
qed
ultimately show ?thesis
using &I ∃ I
unfolding Universal-def exists-unique-def by fastqedlemma null-uni-uniq-3 [PLM ]:[∃ y . y P = (ιx . Null (x P )) in v]
using null-uni-uniq-1 [THEN RN , THEN nec-imp-act[deduction]]
A-Exists-2 [equiv-rl] by auto
lemma null-uni-uniq-4 [PLM ]:[∃ y . y P = (ιx . Universal (x P )) in v]
using null-uni-uniq-2 [THEN RN , THEN nec-imp-act[deduction]]
A-Exists-2 [equiv-rl] by auto
lemma null-uni-facts-1 [PLM ]:[Null (x P ) → (Null (x P )) in v]
proof (rule CP)
assume [Null (x P ) in v]
hence 1 : [(|A!,x P |) & (¬(∃ F . {|x P ,F |})) in v]
unfolding Null-def .
have [(|A!,x P |) in v]
using 1 [conj1 ] oa-facts-2 [deduction] by simp
moreover have [(¬(∃ F . {|x P ,F |})) in v]
proof −{
assume [¬(¬(∃ F . {|x P ,F |})) in v]
hence [♦(∃ F . {|x P ,F |}) in v]
unfolding diamond-def .
hence [∃ F . ♦{|x P ,F |} in v]
using BF♦[deduction] by blast
then obtain P where [♦{|x P ,P|} in v]
by (rule ∃ E)
hence [{|x P , P|} in v]
using en-eq-3 [equiv-lr] by simp
hence [∃ F . {|x P , F |} in v]
using ∃ I by fast186}thus ?thesis
using 1 [conj2 ] modus-tollens-1 CP
useful-tautologies-1 [deduction] by metis
qed
ultimately show [Null (x P ) in v]
unfolding Null-def
using &I KBasic-3 [equiv-rl] by blastqed
lemma null-uni-facts-2 [PLM ]:[Universal (x P ) → (Universal (x P )) in v]
proof (rule CP)
assume [Universal (x P ) in v]
hence 1 : [(|A!,x P |) & (∀ F . {|x P ,F |}) in v]
unfolding Universal-def .
have [(|A!,x P |) in v]
using 1 [conj1 ] oa-facts-2 [deduction] by simp
moreover have [(∀ F . {|x P ,F |}) in v]
proof (rule BF [deduction]; rule ∀ I )fix F
have [{|x P , F |} in v]
using 1 [conj2 ] by (rule ∀ E)
thus [{|x P , F |} in v]
using encoding[axiom-instance, deduction] by autoqed
ultimately show [Universal (x P ) in v]
unfolding Universal-def
using &I KBasic-3 [equiv-rl] by blastqed
lemma null-uni-facts-3 [PLM ]:[Null (a∅ ) in v]
proof −
let ?ψ = λ x . Null x
have [((∃ ! x . ?ψ (x P )) → (∀ y . y P = (ιx . ?ψ (x P )) → ?ψ (y P ))) in v]
using unique-box-desc[deduction] null-uni-facts-1 [THEN ∀ I ] by fast
have 1 : [(∀ y . y P = (ιx . ?ψ (x P )) → ?ψ (y P )) in v]
using unique-box-desc[deduction, deduction] null-uni-uniq-1
null-uni-facts-1 [THEN ∀ I ] by fast
have [∃ y . y P = (a∅ ) in v]
unfolding NullObject-def using null-uni-uniq-3 .
then obtain y where [y P = (a∅ ) in v]
by (rule ∃ E)
moreover hence [?ψ (y P ) in v]
using 1 [THEN ∀ E, deduction] unfolding NullObject-def by simp
ultimately show [?ψ (a∅ ) in v]
using l-identity[axiom-instance, deduction, deduction] by blastqed
lemma null-uni-facts-4 [PLM ]:[Universal (aV ) in v]
proof −
let ?ψ = λ x . Universal x
have [((∃ ! x . ?ψ (x P )) → (∀ y . y P = (ιx . ?ψ (x P )) → ?ψ (y P ))) in v]
using unique-box-desc[deduction] null-uni-facts-2 [THEN ∀ I ] by fast
have 1 : [(∀ y . y P = (ιx . ?ψ (x P )) → ?ψ (y P )) in v]
using unique-box-desc[deduction, deduction] null-uni-uniq-2

187

null-uni-facts-2 [THEN ∀ I ] by fast
have [∃ y . y P = (aV ) in v]
unfolding UniversalObject-def using null-uni-uniq-4 .
then obtain y where [y P = (aV ) in v]
by (rule ∃ E)
moreover hence [?ψ (y P ) in v]
using 1 [THEN ∀ E, deduction]
unfolding UniversalObject-def by simp
ultimately show [?ψ (aV ) in v]
using l-identity[axiom-instance, deduction, deduction] by blastqed
lemma aclassical-1 [PLM ]:[∀ R . ∃ x y . (|A!,x P |) & (|A!,y P |) & (x 6= y)& (λ z . (|R,z P ,x P |)) = (λ z . (|R,z P ,y P |)) in v]
proof (rule ∀ I )fix R
obtain a where ϑ:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ (∃ y . (|A!,y P |)& F = (λ z . (|R,z P ,y P |)) & ¬{|y P , F |})) in v]
using A-objects[axiom-instance] by (rule ∃ E){
assume [¬{|a P , (λ z . (|R,z P ,a P |))|} in v]
hence [¬((|A!,a P |) & (λ z . (|R,z P ,a P |)) = (λ z . (|R,z P ,a P |))& ¬{|a P , (λ z . (|R,z P ,a P |))|}) in v]
using ϑ[conj2 , THEN ∀ E, THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cqt-further-4 [equiv-lr] ∀ E by fasthence [(|A!,a P |) & (λ z . (|R,z P ,a P |)) = (λ z . (|R,z P ,a P |))→ {|a P , (λ z . (|R,z P ,a P |))|} in v]
apply − by PLM-solver
hence [{|a P , (λ z . (|R,z P ,a P |))|} in v]
using ϑ[conj1 ] id-eq-1 &I vdash-properties-10 by fast}hence 1 : [{|a P , (λ z . (|R,z P ,a P |))|} in v]
using reductio-aa-1 CP if-p-then-p by blast
then obtain b where ξ:[(|A!,bP |) & (λ z . (|R,z P ,a P |)) = (λ z . (|R,z P ,bP |))& ¬{|bP , (λ z . (|R,z P ,a P |))|} in v]
using ϑ[conj2 , THEN ∀ E, equiv-lr] ∃ E by blast
have [a 6= b in v]
proof −{
assume [a = b in v]
hence [{|bP , (λ z . (|R,z P ,a P |))|} in v]
using 1 l-identity[axiom-instance, deduction, deduction] by fasthence ?thesis
using ξ[conj2 ] reductio-aa-1 by blast}
thus ?thesis using reductio-aa-1 by blast
qed
hence [(|A!,a P |) & (|A!,bP |) & a 6= b
& (λ z . (|R,z P ,a P |)) = (λ z . (|R,z P ,bP |)) in v]
using ϑ[conj1 ] ξ[conj1 , conj1 ] ξ[conj1 , conj2 ] &I by presburger
hence [∃ y . (|A!,a P |) & (|A!,y P |) & a 6= y
& (λz. (|R,z P ,a P |)) = (λz. (|R,z P ,y P |)) in v]
using ∃ I by fast
thus [∃ x y . (|A!,x P |) & (|A!,y P |) & x 6= y
& (λz. (|R,z P ,x P |)) = (λz. (|R,z P ,y P |)) in v]

188

using ∃ I by fastqedlemma aclassical-2 [PLM ]:[∀ R . ∃ x y . (|A!,x P |) & (|A!,y P |) & (x 6= y)& (λ z . (|R,x P ,z P |)) = (λ z . (|R,y P ,z P |)) in v]
proof (rule ∀ I )fix R
obtain a where ϑ:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ (∃ y . (|A!,y P |)& F = (λ z . (|R,y P ,z P |)) & ¬{|y P , F |})) in v]
using A-objects[axiom-instance] by (rule ∃ E){
assume [¬{|a P , (λ z . (|R,a P ,z P |))|} in v]
hence [¬((|A!,a P |) & (λ z . (|R,a P ,z P |)) = (λ z . (|R,a P ,z P |))& ¬{|a P , (λ z . (|R,a P ,z P |))|}) in v]
using ϑ[conj2 , THEN ∀ E, THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cqt-further-4 [equiv-lr] ∀ E by fasthence [(|A!,a P |) & (λ z . (|R,a P ,z P |)) = (λ z . (|R,a P ,z P |))→ {|a P , (λ z . (|R,a P ,z P |))|} in v]
apply − by PLM-solver
hence [{|a P , (λ z . (|R,a P ,z P |))|} in v]
using ϑ[conj1 ] id-eq-1 &I vdash-properties-10 by fast}hence 1 : [{|a P , (λ z . (|R,a P ,z P |))|} in v]
using reductio-aa-1 CP if-p-then-p by blast
then obtain b where ξ:[(|A!,bP |) & (λ z . (|R,a P ,z P |)) = (λ z . (|R,bP ,z P |))& ¬{|bP , (λ z . (|R,a P ,z P |))|} in v]
using ϑ[conj2 , THEN ∀ E, equiv-lr] ∃ E by blast
have [a 6= b in v]
proof −{
assume [a = b in v]
hence [{|bP , (λ z . (|R,a P ,z P |))|} in v]
using 1 l-identity[axiom-instance, deduction, deduction] by fasthence ?thesis using ξ[conj2 ] reductio-aa-1 by blast}
thus ?thesis using ξ[conj2 ] reductio-aa-1 by blast
qed
hence [(|A!,a P |) & (|A!,bP |) & a 6= b
& (λ z . (|R,a P ,z P |)) = (λ z . (|R,bP ,z P |)) in v]
using ϑ[conj1 ] ξ[conj1 , conj1 ] ξ[conj1 , conj2 ] &I by presburger
hence [∃ y . (|A!,a P |) & (|A!,y P |) & a 6= y
& (λz. (|R,a P ,z P |)) = (λz. (|R,y P ,z P |)) in v]
using ∃ I by fast
thus [∃ x y . (|A!,x P |) & (|A!,y P |) & x 6= y
& (λz. (|R,x P ,z P |)) = (λz. (|R,y P ,z P |)) in v]
using ∃ I by fastqedlemma aclassical-3 [PLM ]:[∀ F . ∃ x y . (|A!,x P |) & (|A!,y P |) & (x 6= y)& ((λ0 (|F ,x P |)) = (λ0 (|F ,y P |))) in v]
proof (rule ∀ I )fix R
obtain a where ϑ:[(|A!,a P |) & (∀ F . {|a P , F |} ≡ (∃ y . (|A!,y P |)189

& F = (λ z . (|R,y P |)) & ¬{|y P , F |})) in v]
using A-objects[axiom-instance] by (rule ∃ E){
assume [¬{|a P , (λ z . (|R,a P |))|} in v]
hence [¬((|A!,a P |) & (λ z . (|R,a P |)) = (λ z . (|R,a P |))& ¬{|a P , (λ z . (|R,a P |))|}) in v]
using ϑ[conj2 , THEN ∀ E, THEN oth-class-taut-5-d[equiv-lr], equiv-lr]
cqt-further-4 [equiv-lr] ∀ E by fasthence [(|A!,a P |) & (λ z . (|R,a P |)) = (λ z . (|R,a P |))→ {|a P , (λ z . (|R,a P |))|} in v]
apply − by PLM-solver
hence [{|a P , (λ z . (|R,a P |))|} in v]
using ϑ[conj1 ] id-eq-1 &I vdash-properties-10 by fast}hence 1 : [{|a P , (λ z . (|R,a P |))|} in v]
using reductio-aa-1 CP if-p-then-p by blast
then obtain b where ξ:[(|A!,bP |) & (λ z . (|R,a P |)) = (λ z . (|R,bP |))& ¬{|bP , (λ z . (|R,a P |))|} in v]
using ϑ[conj2 , THEN ∀ E, equiv-lr] ∃ E by blast
have [a 6= b in v]
proof −{
assume [a = b in v]
hence [{|bP , (λ z . (|R,a P |))|} in v]
using 1 l-identity[axiom-instance, deduction, deduction] by fasthence ?thesis
using ξ[conj2 ] reductio-aa-1 by blast}
thus ?thesis using reductio-aa-1 by blast
qed
moreover {have [(|R,a P |) = (|R,bP |) in v]
unfolding identity o -defusing ξ[conj1 , conj2 ] by auto
hence [(λ0 (|R,a P |)) = (λ0 (|R,bP |)) in v]
using lambda-p-q-p-eq-q[equiv-rl] by simp}
ultimately have [(|A!,a P |) & (|A!,bP |) & a 6= b
& ((λ0 (|R,a P |)) =(λ0 (|R,bP |))) in v]
using ϑ[conj1 ] ξ[conj1 , conj1 ] ξ[conj1 , conj2 ] &I
by presburger
hence [∃ y . (|A!,a P |) & (|A!,y P |) & a 6= y
& (λ0 (|R,a P |)) = (λ0 (|R,y P |)) in v]
using ∃ I by fast
thus [∃ x y . (|A!,x P |) & (|A!,y P |) & x 6= y
& (λ0 (|R,x P |)) = (λ0 (|R,y P |)) in v]
using ∃ I by fastqedlemma aclassical2 [PLM ]:[∃ x y . (|A!,x P |) & (|A!,y P |) & x 6= y & (∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
proof −
let ?R1 = λ2 (λ x y . ∀ F . (|F ,x P |) ≡ (|F ,y P |))have [∃ x y . (|A!,x P |) & (|A!,y P |) & x 6= y
& (λz. (|?R1 ,z P ,x P |)) = (λz. (|?R1 ,z P ,y P |)) in v]
using aclassical-1 by (rule ∀ E)
then obtain a where190[∃ y . (|A!,a P |) & (|A!,y P |) & a 6= y
& (λz. (|?R1 ,z P ,a P |)) = (λz. (|?R1 ,z P ,y P |)) in v]
by (rule ∃ E)
then obtain b where ab-prop:[(|A!,a P |) & (|A!,bP |) & a 6= b
& (λz. (|?R1 ,z P ,a P |)) = (λz. (|?R1 ,z P ,bP |)) in v]
by (rule ∃ E)
have [(|?R1 , a P , a P |) in v]
apply (rule beta-C-meta-2 [equiv-rl])
apply show-proper
using oth-class-taut-4-a[THEN ∀ I ] by fasthence [(|λ z . (|?R1 , z P , a P |), a P |) in v]
apply − apply (rule beta-C-meta-1 [equiv-rl])
apply show-properby autohence [(|λ z . (|?R1 , z P , bP |), a P |) in v]
using ab-prop[conj2 ] l-identity[axiom-instance, deduction, deduction]
by fasthence [(|?R1 , a P , bP |) in v]
apply (safe intro!: beta-C-meta-1 [where ϕ=
λz . (|λ2 (λx y. ∀ F . (|F ,x P |) ≡ (|F ,y P |)),z,bP |), equiv-lr])by show-proper
moreover have IsProperInXY (λx y. ∀ F . (|F ,x|) ≡ (|F ,y|))by show-proper
ultimately have [∀ F . (|F ,a P |) ≡ (|F ,bP |) in v]
using beta-C-meta-2 [equiv-lr] by blast
hence [(|A!,a P |) & (|A!,bP |) & a 6= b & (∀ F . (|F ,a P |) ≡ (|F ,bP |)) in v]
using ab-prop[conj1 ] &I by presburger
hence [∃ y . (|A!,a P |) & (|A!,y P |) & a 6= y & (∀ F . (|F ,a P |) ≡ (|F ,y P |)) in v]
using ∃ I by fast
thus ?thesis using ∃ I by fastqed

A.9.13. Propositional Properties
lemma prop-prop2-1 :[∀ p . ∃ F . F = (λ x . p) in v]
proof (rule ∀ I )fix phave [(λ x . p) = (λ x . p) in v]
using id-eq-prop-prop-1 by auto
thus [∃ F . F = (λ x . p) in v]
by PLM-solverqedlemma prop-prop2-2 :[F = (λ x . p) → (∀ x . (|F ,x P |) ≡ p) in v]
proof (rule CP)
assume 1 : [F = (λ x . p) in v]
{
fix v
{
fix x
have [(|(λ x . p), x P |) ≡ p in v]
apply (rule beta-C-meta-1 )by show-proper}
hence [∀ x . (|(λ x . p), x P |) ≡ p in v]

191

by (rule ∀ I )}hence [(∀ x . (|(λ x . p), x P |) ≡ p) in v]
by (rule RN )thus [(∀ x. (|F ,x P |) ≡ p) in v]
using l-identity[axiom-instance,deduction,deduction,
OF 1 [THEN id-eq-prop-prop-2 [deduction]]] by fastqedlemma prop-prop2-3 :[Propositional F → (Propositional F ) in v]
proof (rule CP)
assume [Propositional F in v]
hence [∃ p . F = (λ x . p) in v]
unfolding Propositional-def .
then obtain q where [F = (λ x . q) in v]
by (rule ∃ E)
hence [(F = (λ x . q)) in v]
using id-nec[equiv-lr] by auto
hence [∃ p . (F = (λ x . p)) in v]
using ∃ I by fast
thus [(Propositional F ) in v]
unfolding Propositional-def
using sign-S5-thm-1 [deduction] by fastqedlemma prop-indis:[Indiscriminate F → (¬(∃ x y . (|F ,x P |) & (¬(|F ,y P |)))) in v]
proof (rule CP)
assume [Indiscriminate F in v]
hence 1 : [((∃ x. (|F ,x P |)) → (∀ x. (|F ,x P |))) in v]
unfolding Indiscriminate-def .
{assume [∃ x y . (|F ,x P |) & ¬(|F ,y P |) in v]
then obtain x where [∃ y . (|F ,x P |) & ¬(|F ,y P |) in v]
by (rule ∃ E)
then obtain y where 2 : [(|F ,x P |) & ¬(|F ,y P |) in v]
by (rule ∃ E)
hence [∃ x . (|F , x P |) in v]
using &E(1 ) ∃ I by fasthence [∀ x . (|F ,x P |) in v]
using 1 [THEN qml-2 [axiom-instance, deduction], deduction] by fasthence [(|F ,y P |) in v]
using cqt-orig-1 [deduction] by fasthence [(|F ,y P |) & (¬(|F ,y P |)) in v]
using 2 &I &E by fasthence [¬(∃ x y . (|F ,x P |) & ¬(|F ,y P |)) in v]
using pl-1 [axiom-instance, deduction, THEN modus-tollens-1 ]oth-class-taut-1-a by blast}
thus [¬(∃ x y . (|F ,x P |) & ¬(|F ,y P |)) in v]
using reductio-aa-2 if-p-then-p deduction-theorem by blastqed

lemma prop-in-thm:[Propositional F → Indiscriminate F in v]

192

proof (rule CP)
assume [Propositional F in v]
hence [(Propositional F ) in v]
using prop-prop2-3 [deduction] by auto
moreover {fix w
assume [∃ p . (F = (λ y . p)) in w]
then obtain q where q-prop: [F = (λ y . q) in w]
by (rule ∃ E){
assume [∃ x . (|F ,x P |) in w]
then obtain a where [(|F ,a P |) in w]
by (rule ∃ E)
hence [(|λ y . q, a P |) in w]
using q-prop l-identity[axiom-instance,deduction,deduction] by fasthence q: [q in w]
apply (safe intro!: beta-C-meta-1 [where ϕ=λy. q, equiv-lr])
apply show-properby simp{fix x
have [(|λ y . q, x P |) in w]
apply (safe intro!: q beta-C-meta-1 [equiv-rl])by show-proper
hence [(|F ,x P |) in w]
using q-prop[eq-sym] l-identity[axiom-instance, deduction, deduction]
by fast}hence [∀ x . (|F ,x P |) in w]
by (rule ∀ I )}hence [(∃ x . (|F ,x P |)) → (∀ x . (|F , x P |)) in w]
by (rule CP)}
ultimately show [Indiscriminate F in v]
unfolding Propositional-def Indiscriminate-def
using RM-1 [deduction] deduction-theorem by blastqed
lemma prop-in-f-1 :[Necessary F → Indiscriminate F in v]
unfolding Necessary-defs Indiscriminate-def
using pl-1 [axiom-instance, THEN RM-1 ] by simp
lemma prop-in-f-2 :[Impossible F → Indiscriminate F in v]
proof −{
fix w
have [(¬(∃ x . (|F ,x P |))) → ((∃ x . (|F ,x P |)) → (∀ x . (|F ,x P |))) in w]
using useful-tautologies-3 by auto
hence [(∀ x . ¬(|F ,x P |)) → ((∃ x . (|F ,x P |)) → (∀ x . (|F ,x P |))) in w]
apply − apply (PLM-subst-method ¬(∃ x. (|F ,x P |)) (∀ x. ¬(|F ,x P |)))
using cqt-further-4 unfolding exists-def by fast+}
thus ?thesis
unfolding Impossible-defs Indiscriminate-def using RM-1 CP by blast
qed

193

lemma prop-in-f-3-a:[¬(Indiscriminate (E!)) in v]
proof (rule reductio-aa-2 )show [¬(∀ x. (|E!,x P |)) in v]
using a-objects-exist-3 .
nextassume [Indiscriminate E! in v]
thus [¬¬(∀ x . (|E!,x P |)) in v]
unfolding Indiscriminate-def
using o-objects-exist-1 KBasic2-5 [deduction,deduction]
unfolding diamond-def by blastqed
lemma prop-in-f-3-b:[¬(Indiscriminate (E!− )) in v]
proof (rule reductio-aa-2 )assume [Indiscriminate (E!− ) in v]
moreover have [(∃ x . (|E!− , x P |)) in v]
apply (PLM-subst-method λ x . ¬(|E!, x P |) λ x . (|E!− , x P |))using thm-relation-negation-1-1 [equiv-sym] apply simp
unfolding exists-def
apply (PLM-subst-method λ x . (|E!, x P |) λ x . ¬¬(|E!, x P |))using oth-class-taut-4-b apply simp
using a-objects-exist-3 by auto
ultimately have [(∀ x. (|E!− ,x P |)) in v]
unfolding Indiscriminate-def
using qml-1 [axiom-instance, deduction, deduction] by blast
thus [(∀ x. ¬(|E!,x P |)) in v]
apply −
apply (PLM-subst-method λ x . (|E!− , x P |) λ x . ¬(|E!, x P |))using thm-relation-negation-1-1 by auto
next
show [¬(∀ x . ¬(|E!, x P |)) in v]
using o-objects-exist-1
unfolding diamond-def exists-def
apply −
apply (PLM-subst-method ¬¬(∀ x. ¬(|E!,x P |)) ∀ x. ¬(|E!,x P |))using oth-class-taut-4-b[equiv-sym] by autoqed
lemma prop-in-f-3-c:[¬(Indiscriminate (O!)) in v]
proof (rule reductio-aa-2 )show [¬(∀ x . (|O!,x P |)) in v]
using a-objects-exist-2 [THEN qml-2 [axiom-instance, deduction]]by blast
next
assume [Indiscriminate O! in v]
thus [(∀ x . (|O!,x P |)) in v]
unfolding Indiscriminate-def
using o-objects-exist-2 qml-1 [axiom-instance, deduction, deduction]
qml-2 [axiom-instance, deduction] by blastqed
lemma prop-in-f-3-d:[¬(Indiscriminate (A!)) in v]
proof (rule reductio-aa-2 )194

show [¬(∀ x . (|A!,x P |)) in v]
using o-objects-exist-3 [THEN qml-2 [axiom-instance, deduction]]by blast
next
assume [Indiscriminate A! in v]
thus [(∀ x . (|A!,x P |)) in v]
unfolding Indiscriminate-def
using a-objects-exist-1 qml-1 [axiom-instance, deduction, deduction]
qml-2 [axiom-instance, deduction] by blastqed
lemma prop-in-f-4-a:[¬(Propositional E!) in v]
using prop-in-thm[deduction] prop-in-f-3-a modus-tollens-1 CP
by mesonlemma prop-in-f-4-b:[¬(Propositional (E!− )) in v]
using prop-in-thm[deduction] prop-in-f-3-b modus-tollens-1 CP
by mesonlemma prop-in-f-4-c:[¬(Propositional (O!)) in v]
using prop-in-thm[deduction] prop-in-f-3-c modus-tollens-1 CP
by mesonlemma prop-in-f-4-d:[¬(Propositional (A!)) in v]
using prop-in-thm[deduction] prop-in-f-3-d modus-tollens-1 CP
by mesonlemma prop-prop-nec-1 :[♦(∃ p . F = (λ x . p)) → (∃ p . F = (λ x . p)) in v]
proof (rule CP)
assume [♦(∃ p . F = (λ x . p)) in v]
hence [∃ p . ♦(F = (λ x . p)) in v]
using BF♦[deduction] by auto
then obtain p where [♦(F = (λ x . p)) in v]
by (rule ∃ E)
hence [♦(∀ x. {|x P ,F |} ≡ {|x P ,λx. p|}) in v]
unfolding identity-defs .
hence [(∀ x. {|x P ,F |} ≡ {|x P ,λx. p|}) in v]
using 5♦[deduction] by auto
hence [(F = (λ x . p)) in v]
unfolding identity-defs .
thus [∃ p . (F = (λ x . p)) in v]
by PLM-solverqedlemma prop-prop-nec-2 :[(∀ p . F 6= (λ x . p)) → (∀ p . F 6= (λ x . p)) in v]
apply (PLM-subst-method¬(∃ p . (F = (λ x . p)))(∀ p . ¬(F = (λ x . p))))using cqt-further-4 apply blast
apply (PLM-subst-method¬♦(∃ p. F = (λx. p))
¬(∃ p. F = (λx. p)))195

using KBasic2-4 [equiv-sym] prop-prop-nec-1
contraposition-1 by auto
lemma prop-prop-nec-3 :[(∃ p . F = (λ x . p)) → (∃ p . F = (λ x . p)) in v]
using prop-prop-nec-1 derived-S5-rules-1-b by simp
lemma prop-prop-nec-4 :[♦(∀ p . F 6= (λ x . p)) → (∀ p . F 6= (λ x . p)) in v]
using prop-prop-nec-2 derived-S5-rules-2-b by simp
lemma enc-prop-nec-1 :[♦(∀ F . {|x P , F |} → (∃ p . F = (λ x . p)))→ (∀ F . {|x P , F |} → (∃ p . F = (λ x . p))) in v]
proof (rule CP)
assume [♦(∀ F . {|x P ,F |} → (∃ p. F = (λx. p))) in v]
hence 1 : [(∀ F . ♦({|x P ,F |} → (∃ p. F = (λx. p)))) in v]
using Buridan♦[deduction] by auto{
fix Q
assume [{|x P ,Q|} in v]
hence [{|x P ,Q|} in v]
using encoding[axiom-instance, deduction] by auto
moreover have [♦({|x P ,Q|} → (∃ p. Q = (λx. p))) in v]
using cqt-1 [axiom-instance, deduction] 1 by fast
ultimately have [♦(∃ p. Q = (λx. p)) in v]
using KBasic2-9 [equiv-lr,deduction] by auto
hence [(∃ p. Q = (λx. p)) in v]
using prop-prop-nec-1 [deduction] by auto}
thus [(∀ F . {|x P , F |} → (∃ p . F = (λ x . p))) in v]
apply − by PLM-solverqedlemma enc-prop-nec-2 :[(∀ F . {|x P , F |} → (∃ p . F = (λ x . p))) → (∀ F . {|x P , F |}→ (∃ p . F = (λ x . p))) in v]
using derived-S5-rules-1-b enc-prop-nec-1 by blastend
end

A.10. Possible Worlds
locale PossibleWorlds = PLM
begin

A.10.1. Definitions
definition Situation whereSituation x ≡ (|A!,x|) & (∀ F . {|x,F |} → Propositional F )definition EncodeProposition (infixl Σ 70 ) wherexΣp ≡ (|A!,x|) & {|x, λ x . p|}
definition TrueInSituation (infixl |= 10 ) wherex |= p ≡ Situation x & xΣp
definition PossibleWorld where
PossibleWorld x ≡ Situation x & ♦(∀ p . xΣp ≡ p)

196

A.10.2. Auxiliary Lemmas
lemma possit-sit-1 :[Situation (x P ) ≡ (Situation (x P )) in v]
proof (rule ≡I ; rule CP)
assume [Situation (x P ) in v]
hence 1 : [(|A!,x P |) & (∀ F . {|x P ,F |} → Propositional F ) in v]
unfolding Situation-def by auto
have [(|A!,x P |) in v]
using 1 [conj1 , THEN oa-facts-2 [deduction]] .
moreover have [(∀ F . {|x P ,F |} → Propositional F ) in v]
using 1 [conj2 ] unfolding Propositional-def
by (rule enc-prop-nec-2 [deduction])
ultimately show [Situation (x P ) in v]
unfolding Situation-def
apply cut-tac apply (rule KBasic-3 [equiv-rl])by (rule intro-elim-1 )next
assume [Situation (x P ) in v]
thus [Situation (x P ) in v]
using qml-2 [axiom-instance, deduction] by autoqed
lemma possworld-nec:[PossibleWorld (x P ) ≡ (PossibleWorld (x P )) in v]
apply (rule ≡I ; rule CP)
subgoal unfolding PossibleWorld-def
apply (rule KBasic-3 [equiv-rl])
apply (rule intro-elim-1 )using possit-sit-1 [equiv-lr] &E(1 ) apply blast
using qml-3 [axiom-instance, deduction] &E(2 ) by blast
using qml-2 [axiom-instance,deduction] by auto
lemma TrueInWorldNecc:[((x P ) |= p) ≡ ((x P ) |= p) in v]
proof (rule ≡I ; rule CP)
assume [x P |= p in v]
hence [Situation (x P ) & ((|A!,x P |) & {|x P ,λx. p|}) in v]
unfolding TrueInSituation-def EncodeProposition-def .
hence [(Situation (x P ) & (|A!,x P |)) & {|x P , λx. p|} in v]
using &I &E possit-sit-1 [equiv-lr] oa-facts-2 [deduction]
encoding[axiom-instance,deduction] by metis
thus [((x P ) |= p) in v]
unfolding TrueInSituation-def EncodeProposition-def
using KBasic-3 [equiv-rl] &I &E by metis
nextassume [(x P |= p) in v]
thus [x P |= p in v]
using qml-2 [axiom-instance,deduction] by autoqed

lemma PossWorldAux:[((|A!,x P |) & (∀ F . ({|x P ,F |} ≡ (∃ p . p & (F = (λ x . p))))))→ (PossibleWorld (x P )) in v]
proof (rule CP)
assume DefX : [(|A!,x P |) & (∀ F . ({|x P ,F |} ≡(∃ p . p & (F = (λ x . p))))) in v]

197

have [Situation (x P ) in v]
proof −
have [(|A!,x P |) in v]
using DefX [conj1 ] .
moreover have [(∀ F . {|x P ,F |} → Propositional F ) in v]
proof (rule ∀ I ; rule CP)
fix F
assume [{|x P ,F |} in v]
moreover have [{|x P ,F |} ≡ (∃ p . p & (F = (λ x . p))) in v]
using DefX [conj2 ] cqt-1 [axiom-instance, deduction] by auto
ultimately have [(∃ p . p & (F = (λ x . p))) in v]
using ≡E(1 ) by blast
then obtain p where [p & (F = (λ x . p)) in v]
by (rule ∃ E)
hence [(F = (λ x . p)) in v]
by (rule &E(2 ))hence [(∃ p . (F = (λ x . p))) in v]
by PLM-solver
thus [Propositional F in v]
unfolding Propositional-def .
qedultimately show [Situation (x P ) in v]
unfolding Situation-def by (rule &I )qed
moreover have [♦(∀ p. x P Σ p ≡ p) in v]
unfolding EncodeProposition-def
proof (rule TBasic[deduction]; rule ∀ I )fix qhave EncodeLambda:[{|x P , λx. q|} ≡ (∃ p . p & ((λx. q) = (λ x . p))) in v]
using DefX [conj2 ] by (rule cqt-1 [axiom-instance, deduction])moreover {assume [q in v]
moreover have [(λx. q) = (λ x . q) in v]
using id-eq-prop-prop-1 by auto
ultimately have [q & ((λx. q) = (λ x . q)) in v]
by (rule &I )hence [∃ p . p & ((λx. q) = (λ x . p)) in v]
by PLM-solver
moreover have [(|A!,x P |) in v]
using DefX [conj1 ] .
ultimately have [(|A!,x P |) & {|x P , λx. q|} in v]
using EncodeLambda[equiv-rl] &I by auto}
moreover {assume [(|A!,x P |) & {|x P , λx. q|} in v]
hence [{|x P , λx. q|} in v]
using &E(2 ) by auto
hence [∃ p . p & ((λx. q) = (λ x . p)) in v]
using EncodeLambda[equiv-lr] by auto
then obtain p where p-and-lambda-q-is-lambda-p:[p & ((λx. q) = (λ x . p)) in v]
by (rule ∃ E)
have [(|(λ x . p), x P |) ≡ p in v]
apply (rule beta-C-meta-1 )by show-proper
hence [(|(λ x . p), x P |) in v]

198

using p-and-lambda-q-is-lambda-p[conj1 ] ≡E(2 ) by auto
hence [(|(λ x . q), x P |) in v]
using p-and-lambda-q-is-lambda-p[conj2 , THEN id-eq-prop-prop-2 [deduction]]l-identity[axiom-instance, deduction, deduction] by fast
moreover have [(|(λ x . q), x P |) ≡ q in v]
apply (rule beta-C-meta-1 ) by show-proper
ultimately have [q in v]
using ≡E(1 ) by blast}
ultimately show [(|A!,x P |) & {|x P ,λx. q|} ≡ q in v]
using &I ≡I CP by autoqed
ultimately show [PossibleWorld (x P ) in v]
unfolding PossibleWorld-def by (rule &I )qed

A.10.3. For every syntactic Possible World there is a semantic Possible World
theorem SemanticPossibleWorldForSyntacticPossibleWorlds:∀ x . [PossibleWorld (x P ) in w] −→(∃ v . ∀ p . [(x P |= p) in w] ←→ [p in v])
proof
fix x
{
assume PossWorldX : [PossibleWorld (x P ) in w]
hence SituationX : [Situation (x P ) in w]
unfolding PossibleWorld-def apply cut-tac by PLM-solver
have PossWorldExpanded:[(|A!,x P |) & (∀ F . {|x P ,F |} → (∃ p. F = (λx. p)))& ♦(∀ p. (|A!,x P |) & {|x P ,λx. p|} ≡ p) in w]
using PossWorldX
unfolding PossibleWorld-def Situation-def
Propositional-def EncodeProposition-def .
have AbstractX : [(|A!,x P |) in w]
using PossWorldExpanded[conj1 ,conj1 ] .
have [♦(∀ p. {|x P ,λx. p|} ≡ p) in w]
apply (PLM-subst-method
λp. (|A!,x P |) & {|x P ,λx. p|}
λ p . {|x P ,λx. p|})subgoal using PossWorldExpanded[conj1 ,conj1 ,THEN oa-facts-2 [deduction]]using Semantics.T6 apply cut-tac by PLM-solverusing PossWorldExpanded[conj2 ] .
hence ∃ v. ∀ p. ([{|x P ,λx. p|} in v])= [p in v]
unfolding diamond-def equiv-def conj-def
apply (simp add: Semantics.T4 Semantics.T6 Semantics.T5
Semantics.T8 )by autothen obtain v where PropsTrueInSemWorld:∀ p. ([{|x P ,λx. p|} in v]) = [p in v]
by auto
{
fix p
{

199

assume [((x P ) |= p) in w]
hence [((x P ) |= p) in v]
using TrueInWorldNecc[equiv-lr] Semantics.T6 by simp
hence [Situation (x P ) & ((|A!,x P |) & {|x P ,λx. p|}) in v]
unfolding TrueInSituation-def EncodeProposition-def .
hence [{|x P ,λx. p|} in v]
using &E(2 ) by blast
hence [p in v]
using PropsTrueInSemWorld by blast}
moreover {assume [p in v]
hence [{|x P ,λx. p|} in v]
using PropsTrueInSemWorld by blast
hence [(x P ) |= p in v]
apply cut-tac unfolding TrueInSituation-def EncodeProposition-def
apply (rule &I ) using SituationX [THEN possit-sit-1 [equiv-lr]]subgoal using Semantics.T6 by auto
apply (rule &I )subgoal using AbstractX [THEN oa-facts-2 [deduction]]using Semantics.T6 by autoby assumption
hence [((x P ) |= p) in v]
using TrueInWorldNecc[equiv-lr] by simp
hence [(x P ) |= p in w]
using Semantics.T6 by simp}
ultimately have [p in v] ←→ [(x P ) |= p in w]
by auto}hence (∃ v . ∀ p . [p in v] ←→ [(x P ) |= p in w])
by blast}
thus [PossibleWorld (x P ) in w] −→(∃ v. ∀ p . [(x P ) |= p in w] ←→ [p in v])
by blast
qed

A.10.4. For every semantic Possible World there is a syntactic Possible World
theorem SyntacticPossibleWorldForSemanticPossibleWorlds:∀ v . ∃ x . [PossibleWorld (x P ) in w] ∧(∀ p . [p in v] ←→ [((x P ) |= p) in w])
proof
fix v
have [∃ x. (|A!,x P |) & (∀ F . ({|x P ,F |} ≡(∃ p . p & (F = (λ x . p))))) in v]
using A-objects[axiom-instance] by fastthen obtain x where DefX :[(|A!,x P |) & (∀ F . ({|x P ,F |} ≡ (∃ p . p & (F = (λ x . p))))) in v]
by (rule ∃ E)
hence PossWorldX : [PossibleWorld (x P ) in v]
using PossWorldAux[deduction] by blast
hence [PossibleWorld (x P ) in w]
using possworld-nec[equiv-lr] Semantics.T6 by auto
moreover have (∀ p . [p in v] ←→ [(x P ) |= p in w])
proof
fix q

200

{
assume [q in v]
moreover have [(λ x . q) = (λ x . q) in v]
using id-eq-prop-prop-1 by auto
ultimately have [q & (λ x . q) = (λ x . q) in v]
using &I by auto
hence [(∃ p . p & ((λ x . q) = (λ x . p))) in v]
by PLM-solver
hence 4 : [{|x P , (λ x . q)|} in v]
using cqt-1 [axiom-instance,deduction, OF DefX [conj2 ], equiv-rl]
by blast
have [(x P |= q) in v]
unfolding TrueInSituation-def apply (rule &I )using PossWorldX unfolding PossibleWorld-def
using &E(1 ) apply blast
unfolding EncodeProposition-def apply (rule &I )using DefX [conj1 ] apply simp
using 4 .
hence [(x P |= q) in w]
using TrueInWorldNecc[equiv-lr] Semantics.T6 by auto}
moreover {assume [(x P |= q) in w]
hence [(x P |= q) in v]
using TrueInWorldNecc[equiv-lr] Semantics.T6
by autohence [{|x P , (λ x . q)|} in v]
unfolding TrueInSituation-def EncodeProposition-def
using &E(2 ) by blast
hence [(∃ p . p & ((λ x . q) = (λ x . p))) in v]
using cqt-1 [axiom-instance,deduction, OF DefX [conj2 ], equiv-lr]
by blast
then obtain p where 4 :[(p & ((λ x . q) = (λ x . p))) in v]
by (rule ∃ E)
have [(|(λ x . p),x P |) ≡ p in v]
apply (rule beta-C-meta-1 )by show-proper
hence [(|(λ x . q),x P |) ≡ p in v]
using l-identity[where β=(λ x . q) and α=(λ x . p),
axiom-instance, deduction, deduction]using 4 [conj2 ,THEN id-eq-prop-prop-2 [deduction]] by meson
hence [(|(λ x . q),x P |) in v] using 4 [conj1 ] ≡E(2 ) by blast
moreover have [(|(λ x . q),x P |) ≡ q in v]
apply (rule beta-C-meta-1 )by show-proper
ultimately have [q in v]
using ≡E(1 ) by blast}
ultimately show [q in v] ←→ [(x P ) |= q in w]
by blastqed
ultimately show ∃ x . [PossibleWorld (x P ) in w]∧ (∀ p . [p in v] ←→ [(x P ) |= p in w])
by auto
qed
end

201

A.11. Artificial Theorems
Remark. Some examples of theorems that can be derived from the model structure, but which
are not derivable from the deductive system PLM itself.
locale ArtificialTheorems
beginlemma lambda-enc-1 :[(|λx . {|x P , F |} ≡ {|x P , F |}, y P |) in v]
by (auto simp: meta-defs meta-aux conn-defs forall-Π1 -def )lemma lambda-enc-2 :[(|λ x . {|y P , G|}, x P |) ≡ {|y P , G|} in v]
by (auto simp: meta-defs meta-aux conn-defs forall-Π1 -def )Remark. The following is not a theorem and nitpick can find a countermodel. This is expected
and important. If this were a theorem, the theory would become inconsistent.
lemma lambda-enc-3 :[((|λ x . {|x P , F |}, x P |) → {|x P , F |}) in v]
apply (simp add: meta-defs meta-aux conn-defs forall-Π1 -def )nitpick[user-axioms, expect=genuine]
oops — countermodel by nitpick

Remark. Instead the following two statements hold.
lemma lambda-enc-4 :[(|(λ x . {|x P , F |}), x P |) in v] = (∃ y . νυ y = νυ x ∧ [{|y P , F |} in v])
by (simp add: meta-defs meta-aux)
lemma lambda-ex:[(|(λ x . ϕ (x P )), x P |) in v] = (∃ y . νυ y = νυ x ∧ [ϕ (y P ) in v])
by (simp add: meta-defs meta-aux)

Remark. These statements can be translated to statements in the embedded logic.
lemma lambda-ex-emb:[(|(λ x . ϕ (x P )), x P |) ≡ (∃ y . (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P )) in v]
proof (rule MetaSolver.EquivI )interpret MetaSolver .
{assume [(|(λ x . ϕ (x P )), x P |) in v]
then obtain y where νυ y = νυ x ∧ [ϕ (y P ) in v]
using lambda-ex by blast
moreover hence [(∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
apply − apply meta-solverby (simp add: Semantics.d κ -proper Semantics.ex1-def )ultimately have [∃ y . (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
using ExIRule ConjI by fast}
moreover {assume [∃ y . (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
then obtain y where y-def : [(∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
by (rule ExERule)

202

V
hence
F . [(|F ,x P |) in v] = [(|F ,y P |) in v]
apply − apply (drule ConjE) apply (drule conjunct1 )apply (drule AllE) apply (drule EquivE) by simp
hence [(|makeΠ1 (λ u s w . νυ y = u),x P |) in v]= [(|makeΠ1 (λ u s w . νυ y = u),y P |) in v] by auto
hence νυ y = νυ x by (simp add: meta-defs meta-aux)
moreover have [ϕ (y P ) in v] using y-def ConjE by blast
ultimately have [(|(λ x . ϕ (x P )), x P |) in v]
using lambda-ex by blast}
ultimately show [(|λx. ϕ (x P ),x P |) in v]= [∃ y. (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
by autoqed
lemma lambda-enc-emb:[(|(λ x . {|x P , F |}), x P |) ≡ (∃ y . (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & {|y P , F |}) in v]
using lambda-ex-emb by fast

Remark. In the case of proper maps, the generalized β -conversion reduces to classical β conversion.
lemma proper-beta:
assumes IsProperInX ϕshows [(∃ y . (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P )) ≡ ϕ (x P ) in v]
proof (rule MetaSolver.EquivI ; rule)interpret MetaSolver .
assume [∃ y. (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
then obtain y where y-def : [(∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v] by (rule ExERule)hence [(|makeΠ1 (λ u s w . νυ y = u), x P |) in v] = [(|makeΠ1 (λ u s w . νυ y = u), y P |) in v]
using EquivS AllE ConjE by blast
hence νυ y = νυ x by (simp add: meta-defs meta-aux)
thus [ϕ (x P ) in v]
using y-def [THEN ConjE[THEN conjunct2 ]]assms IsProperInX .rep-eq valid-in.rep-eq
by blast
next
interpret MetaSolver .
assume [ϕ (x P ) in v]
moreover have [∀ F . (|F ,x P |) ≡ (|F ,x P |) in v] apply meta-solver by blast
ultimately show [∃ y. (∀ F . (|F ,x P |) ≡ (|F ,y P |)) & ϕ (y P ) in v]
by (meson ConjI ExI )qed

Remark. The following theorem is a consequence of the constructed Aczel-model, but not partof PLM. Separate research on possible modifications of the embedding suggest that this artificial
theorem can be avoided by introducing a dependency on states for the mapping from abstract
objects to special urelements.
lemma lambda-rel-extensional:
assumes [∀ F . (|F ,a P |) ≡ (|F ,bP |) in v]
shows (λx. (|R,x P ,a P |)) = (λx . (|R,x P , bP |))proof −
interpret MetaSolver .
obtain F where F-def : F = makeΠ1 (λ u s w . u = νυ a) by auto
have [(|F , a P |) ≡ (|F , bP |) in v] using assms by (rule AllE)

203

moreover have [(|F , a P |) in v]
unfolding F-def by (simp add: meta-defs meta-aux)
ultimately have [(|F , bP |) in v] using EquivE by auto
hence νυ a = νυ b using F-def by (simp add: meta-defs meta-aux)
thus ?thesis by (simp add: meta-defs meta-aux)
qed

end

A.12. Sanity Tests
locale SanityTests
begin
interpretation MetaSolver.
interpretation Semantics.

A.12.1. Consistency
lemma True
nitpick[expect=genuine, user-axioms, satisfy]
by autoA.12.2. Intensionality
lemma [(λy. (q ∨ ¬q)) = (λy. (p ∨ ¬p)) in v]
unfolding identity-Π1 -def conn-defs
apply (rule Eq 1 I ) apply (simp add: meta-defs)
nitpick[expect = genuine, user-axioms=true, card i = 2 ,card j = 2 , card ω = 1 , card σ = 1 ,sat-solver = MiniSat, verbose, show-all]oops — Countermodel by Nitpick
lemma [(λy. (p ∨ q)) = (λy. (q ∨ p)) in v]
unfolding identity-Π1 -def
apply (rule Eq 1 I ) apply (simp add: meta-defs)
nitpick[expect = genuine, user-axioms=true,sat-solver = MiniSat, card i = 2 ,card j = 2 , card σ = 1 , card ω = 1 ,card υ = 2 , verbose, show-all]oops — Countermodel by Nitpick

A.12.3. Concreteness coindices with Object Domains
lemma OrdCheck:[(|λ x . ¬(¬(|E!, x P |)), x|) in v] ←→(proper x) ∧ (case (rep x) of ων y ⇒ True | - ⇒ False)using OrdinaryObjectsPossiblyConcreteAxiom
apply (simp add: meta-defs meta-aux split: ν.split υ.split)
using νυ-ων-is-ωυ by fastforce
lemma AbsCheck:[(|λ x . (¬(|E!, x P |)), x|) in v] ←→(proper x) ∧ (case (rep x) of αν y ⇒ True | - ⇒ False)using OrdinaryObjectsPossiblyConcreteAxiom
apply (simp add: meta-defs meta-aux split: ν.split υ.split)
using no-αω by blast

204

A.12.4. Justification for Meta-Logical Axioms
Remark. OrdinaryObjectsPossiblyConcreteAxiom is equivalent to "all ordinary objects are possibly concrete".
lemma OrdAxiomCheck:
OrdinaryObjectsPossiblyConcrete ←→(∀ x. ([(|λ x . ¬(¬(|E!, x P |)), x P |) in v]←→ (case x of ων y ⇒ True | - ⇒ False)))unfolding Concrete-def
apply (simp add: meta-defs meta-aux split: ν.split υ.split)
using νυ-ων-is-ωυ by fastforce

Remark. OrdinaryObjectsPossiblyConcreteAxiom is equivalent to "all abstract objects are necessarily not concrete".
lemma AbsAxiomCheck:
OrdinaryObjectsPossiblyConcrete ←→(∀ x. ([(|λ x . (¬(|E!, x P |)), x P |) in v]←→ (case x of αν y ⇒ True | - ⇒ False)))apply (simp add: meta-defs meta-aux split: ν.split υ.split)
using νυ-ων-is-ωυ no-αω by fastforce

Remark. PossiblyContingentObjectExistsAxiom is equivalent to the corresponding statementin the embedded logic.
lemma PossiblyContingentObjectExistsCheck:
PossiblyContingentObjectExists ←→ [¬((∀ x. (|E!,x P |) → (|E!,x P |))) in v]
apply (simp add: meta-defs forall-ν-def meta-aux split: ν.split υ.split)by (metis ν.simps(5 ) νυ-def υ.simps(1 ) no-σω υ.exhaust)

Remark. PossiblyNoContingentObjectExistsAxiom is equivalent to the corresponding statementin the embedded logic.
lemma PossiblyNoContingentObjectExistsCheck:
PossiblyNoContingentObjectExists ←→ [¬((¬(∀ x. (|E!,x P |) → (|E!,x P |)))) in v]
apply (simp add: meta-defs forall-ν-def meta-aux split: ν.split υ.split)
using νυ-ων-is-ωυ by blast

A.12.5. Relations in the Meta-Logic
Remark. Material equality in the embedded logic corresponds to equality in the actual state in
the meta-logic.
lemma mat-eq-is-eq-dj:[∀ x . ((|F ,x P |) ≡ (|G,x P |)) in v] ←→((λ x . (evalΠ1 F ) x dj) = (λ x . (evalΠ1 G) x dj))
proof
assume 1 : [∀ x. ((|F ,x P |) ≡ (|G,x P |)) in v]
{
fix v
fix y
obtain x where y-def : y = νυ x
by (meson νυ-surj surj-def )205

have (∃ r o1 . Some r = d 1 F ∧ Some o1 = d κ (x P ) ∧ o1 ∈ ex1 r v) =(∃ r o1 . Some r = d 1 G ∧ Some o1 = d κ (x P ) ∧ o1 ∈ ex1 r v)
using 1 apply − by meta-solver
moreover obtain r where r-def : Some r = d 1 F
unfolding d 1 -def by auto
moreover obtain s where s-def : Some s = d 1 G
unfolding d 1 -def by auto
moreover have Some x = d κ (x P )using d κ -proper by simp
ultimately have (x ∈ ex1 r v) = (x ∈ ex1 s v)
by (metis option.inject)hence (evalΠ1 F ) y dj v = (evalΠ1 G) y dj v
using r-def s-def y-def by (simp add: d 1 .rep-eq ex1-def )}thus (λx. evalΠ1 F x dj) = (λx. evalΠ1 G x dj)
by autonext
assume 1 : (λx. evalΠ1 F x dj) = (λx. evalΠ1 G x dj){
fix y vobtain x where x-def : x = νυ yby simphence evalΠ1 F x dj = evalΠ1 G x dj
using 1 by metis
moreover obtain r where r-def : Some r = d 1 F
unfolding d 1 -def by auto
moreover obtain s where s-def : Some s = d 1 G
unfolding d 1 -def by auto
ultimately have (y ∈ ex1 r v) = (y ∈ ex1 s v)
by (simp add: d 1 .rep-eq ex1-def νυ-surj x-def )hence [(|F ,y P |) ≡ (|G,y P |) in v]
apply − apply meta-solverusing r-def s-def by (metis Semantics.d κ -proper option.inject)}thus [∀ x. ((|F ,x P |) ≡ (|G,x P |)) in v]
using T6 T8 by fast
qed

Remark. Materially equivalent relations are equal in the embedded logic if and only if they also
coincide in all other states.
lemma mat-eq-is-eq-if-eq-forall-j:
assumes [∀ x . ((|F ,x P |) ≡ (|G,x P |)) in v]
shows [F = G in v] ←→(∀ s . s 6= dj −→ (∀ x . (evalΠ1 F ) x s = (evalΠ1 G) x s))
proofinterpret MetaSolver .
assume [F = G in v]
hence F = G
apply − unfolding identity-Π1 -def by meta-solver
thus ∀ s. s 6= dj −→ (∀ x. evalΠ1 F x s = evalΠ1 G x s)
by autonextinterpret MetaSolver .
assume ∀ s. s 6= dj −→ (∀ x. evalΠ1 F x s = evalΠ1 G x s)
moreover have ((λ x . (evalΠ1 F ) x dj) = (λ x . (evalΠ1 G) x dj))using assms mat-eq-is-eq-dj by auto
ultimately have ∀ s x. evalΠ1 F x s = evalΠ1 G x s

206

by metis
hence evalΠ1 F = evalΠ1 G
by blast
hence F = G
by (metis evalΠ1 -inverse)
thus [F = G in v]
unfolding identity-Π1 -def using Eq 1 I by auto
qed

Remark. Under the assumption that all properties behave in all states like in the actual state
the defined equality degenerates to material equality.
lemma assumes ∀ F x s . (evalΠ1 F ) x s = (evalΠ1 F ) x djshows [∀ x . ((|F ,x P |) ≡ (|G,x P |)) in v] ←→ [F = G in v]
by (metis (no-types) MetaSolver.Eq 1 S assms identity-Π1 -def
mat-eq-is-eq-dj mat-eq-is-eq-if-eq-forall-j)

A.12.6. Lambda Expressions
lemma lambda-interpret-1 :assumes [a = b in v]
shows (λx. (|R,x P ,a|)) = (λx . (|R,x P , b|))proof −
have a = b
using MetaSolver.EqκS Semantics.d κ -inject assms
identity-κ-def by auto
thus ?thesis by simp
qedlemma lambda-interpret-2 :assumes [a = (ιy. (|G,y P |)) in v]
shows (λx. (|R,x P ,a|)) = (λx . (|R,x P , ιy. (|G,y P |)|))
proof −
have a = (ιy. (|G,y P |))using MetaSolver.EqκS Semantics.d κ -inject assms
identity-κ-def by auto
thus ?thesis by simp
qed
end
theory TAO-99-Paradox
imports TAO-9-PLM TAO-98-ArtificialTheorems
begin

A.13. Paradox
Under the additional assumption that expressions of the form λx. (|G,ιy. ϕ y x|) for arbitrary ϕ
are proper maps, for which β -conversion holds, the theory becomes inconsistent.

A.13.1. Auxiliary Lemmas
lemma exe-impl-exists:[(|(λx . ∀ p . p → p), ιy . ϕ y x|) ≡ (∃ !y . Aϕ y x) in v]
proof (rule ≡I ; rule CP)
fix ϕ :: ν⇒ν⇒o and x :: ν and v :: i207assume [(|(λx . ∀ p . p → p),ιy . ϕ y x|) in v]
hence [∃ y. Aϕ y x & (∀ z. Aϕ z x → z = y)
& (|(λx . ∀ p . p → p), y P |) in v]
using nec-russell-axiom[equiv-lr] SimpleExOrEnc.intros by auto
then obtain y where[Aϕ y x & (∀ z. Aϕ z x → z = y)
& (|(λx . ∀ p . p → p), y P |) in v]
by (rule Instantiate)
hence [Aϕ y x & (∀ z. Aϕ z x → z = y) in v]
using &E by blast
hence [∃ y . Aϕ y x & (∀ z. Aϕ z x → z = y) in v]
by (rule existential)
thus [∃ !y. Aϕ y x in v]
unfolding exists-unique-def by simp
next
fix ϕ :: ν⇒ν⇒o and x :: ν and v :: iassume [∃ !y. Aϕ y x in v]
hence [∃ y. Aϕ y x & (∀ z. Aϕ z x → z = y) in v]
unfolding exists-unique-def by simp
then obtain y where[Aϕ y x & (∀ z. Aϕ z x → z = y) in v]
by (rule Instantiate)
moreover have [(|(λx . ∀ p . p → p),y P |) in v]
apply (rule beta-C-meta-1 [equiv-rl])
apply show-proper
by PLM-solver
ultimately have [Aϕ y x & (∀ z. Aϕ z x → z = y)
& (|(λx . ∀ p . p → p),y P |) in v]
using &I by blast
hence [∃ y . Aϕ y x & (∀ z. Aϕ z x → z = y)
& (|(λx . ∀ p . p → p),y P |) in v]
by (rule existential)
thus [(|(λx . ∀ p . p → p), ιy. ϕ y x|) in v]
using nec-russell-axiom[equiv-rl]
SimpleExOrEnc.intros by autoqed
lemma exists-unique-actual-equiv:[(∃ !y . A(y = x & ψ (x P ))) ≡ Aψ (x P ) in v]
proof (rule ≡I ; rule CP)
fix x v
let ?ϕ = λ y x. y = x & ψ (x P )assume [∃ !y. A?ϕ y x in v]
hence [∃ α. A?ϕ α x & (∀ β. A?ϕ β x → β = α) in v]
unfolding exists-unique-def by simp
then obtain α where[A?ϕ α x & (∀ β. A?ϕ β x → β = α) in v]
by (rule Instantiate)
hence [A(α = x & ψ (x P )) in v]
using &E by blast
thus [A(ψ (x P )) in v]
using Act-Basic-2 [equiv-lr] &E by blastnext
fix x v
let ?ϕ = λ y x. y = x & ψ (x P )assume 1 : [Aψ (x P ) in v]
have [x = x in v]
using id-eq-1 [where 0a=ν] by simp

208

hence [A(x = x) in v]
using id-act-3 [equiv-lr] by fasthence [A(x = x & ψ (x P )) in v]
using 1 Act-Basic-2 [equiv-rl] &I by blast
hence [A?ϕ x x in v]
by simpmoreover have [∀ β. A?ϕ β x → β = x in v]
proof (rule ∀ I ; rule CP)
fix β
assume [A?ϕ β x in v]
hence [A(β = x) in v]
using Act-Basic-2 [equiv-lr] &E by fast
thus [β = x in v] using id-act-3 [equiv-rl] by fastqed
ultimately have [A?ϕ x x & (∀ β. A?ϕ β x → β = x) in v]
using &I by fasthence [∃ α. A?ϕ α x & (∀ β. A?ϕ β x → β = α) in v]
by (rule existential)
thus [∃ !y. A?ϕ y x in v]
unfolding exists-unique-def by simp
qed

A.13.2. Fake β-Conversion using Description Backdoor
definition backdoor where
backdoor ≡ λ ψ . λx . (|(λx . ∀ p . p → p), ιy . y = x & ψ (x P )|)lemma fake-beta:Vassumes
G ϕ. IsProperInX (λx . (|G,ιy . ϕ y x|))shows [(|backdoor (λ x . ψ x), x P |) ≡ Aψ (x P ) in v]
proof (rule ≡I ; rule CP)
assume [(|backdoor ψ,x P |) in v]
hence [(|λx. ∀ p. p → p,ιy. y = x & ψ (x P )|) in v]
using beta-C-meta-1 [equiv-lr, OF assms]
unfolding backdoor-def identity-ν-def by fasthence [∃ !y. A (y = x & ψ (x P )) in v]
using exe-impl-exists[equiv-lr] by fast
thus [Aψ (x P ) in v]
using exists-unique-actual-equiv[equiv-lr] by blastnext
assume [Aψ (x P ) in v]
hence [∃ !y. A (y = x & ψ (x P )) in v]
using exists-unique-actual-equiv[equiv-rl] by blast
hence [(|λx. ∀ p. p → p,ιy. y = x & ψ (x P )|) in v]
using exe-impl-exists[equiv-rl] by fast
thus [(|backdoor ψ,x P |) in v]
using beta-C-meta-1 [equiv-rl, OF assms]
unfolding backdoor-def unfolding identity-ν-def by fastqedlemma fake-beta-act:Vassumes
G ϕ. IsProperInX (λx . (|G,ιy . ϕ y x|))shows [(|backdoor (λ x . ψ x), x P |) ≡ ψ (x P ) in dw]
using fake-beta[OF assms]
logic-actual[necessitation-averse-axiom-instance]
intro-elim-6-e by blast

209

A.13.3. Resulting Paradox
lemma paradox:Vassumes
G ϕ. IsProperInX (λx . (|G,ιy . ϕ y x|))shows False
proof −
obtain K where K-def :K = backdoor (λ x . ∃ F . {|x,F |} & ¬(|F ,x|)) by auto
have [∃ x. (|A!,x P |) & (∀ F . {|x P ,F |} ≡ (F = K )) in dw]
using A-objects[axiom-instance] by fastthen obtain x where x-prop:[(|A!,x P |) & (∀ F . {|x P ,F |} ≡ (F = K )) in dw]
by (rule Instantiate){assume [(|K ,x P |) in dw]
hence [∃ F . {|x P ,F |} & ¬(|F ,x P |) in dw]
unfolding K-def using fake-beta-act[OF assms, equiv-lr]
by blast
then obtain F where F-def :[{|x P ,F |} & ¬(|F ,x P |) in dw] by (rule Instantiate)
hence [F = K in dw]
using x-prop[conj2 , THEN ∀ E[where β=F ], equiv-lr]&E unfolding K-def by blast
hence [¬(|K ,x P |) in dw]
using l-identity[axiom-instance,deduction,deduction]
F-def [conj2 ] by fast}hence 1 : [¬(|K ,x P |) in dw]
using reductio-aa-1 by blast
hence [¬(∃ F . {|x P ,F |} & ¬(|F ,x P |)) in dw]
using fake-beta-act[OF assms,
THEN oth-class-taut-5-d[equiv-lr],
equiv-lr]
unfolding K-def by blast
hence [∀ F . {|x P ,F |} → (|F ,x P |) in dw]
apply − unfolding exists-def by PLM-solver
moreover have [{|x P ,K |} in dw]
using x-prop[conj2 , THEN ∀ E[where β=K ], equiv-rl]
id-eq-1 by blast
ultimately have [(|K ,x P |) in dw]
usingV∀ E vdash-properties-10 by blast
hence ϕ. [ϕ in dw]
using raa-cor-2 1 by blast
thus False using Semantics.T4 by autoqed

A.13.4. Original Version of the Paradox
Originally the paradox was discovered using the following construction based on the comprehension theorem for relations without the explicit construction of the description backdoor andthe resulting fake-β -conversion.
Vlemma assumes
G ϕ. IsProperInX (λx . (|G,ιy . ϕ y x|))shows Fx-equiv-xH : [∀ H . ∃ F . (∀ x. (|F ,x P |) ≡ {|x P ,H |}) in v]
proof (rule ∀ I )fix H
let ?G = (λx . ∀ p . p → p)
obtain ϕ where ϕ-def : ϕ = (λ y x . (y P ) = x & {|x,H |}) by auto210

have [∃ F . (∀ x. (|F ,x P |) ≡ (|?G,ιy . ϕ y (x P )|)) in v]
using relations-1 [OF assms] by simp
hence 1 : [∃ F . (∀ x. (|F ,x P |) ≡ (∃ !y . Aϕ y (x P ))) in v]
apply − apply (PLM-subst-method
λ x . (|?G,ιy . ϕ y (x P )|) λ x . (∃ !y. Aϕ y (x P )))using exe-impl-exists by auto
then obtain F where F-def : [(∀ x. (|F ,x P |) ≡ (∃ !y . Aϕ y (x P ))) in v]
by (rule Instantiate)V
moreover have 2 :v x . [(∃ !y . Aϕ y (x P )) ≡ {|x P ,H |} in v]
proof (rule ≡I ; rule CP)
fix x vassume [∃ !y. Aϕ y (x P ) in v]
hence [∃ α. Aϕ α (x P ) & (∀ β. Aϕ β (x P ) → β = α) in v]
unfolding exists-unique-def by simp
then obtain α where [Aϕ α (x P ) & (∀ β. Aϕ β (x P ) → β = α) in v]
by (rule Instantiate)
hence [A(αP = x P & {|x P ,H |}) in v]
unfolding ϕ-def using &E by blast
hence [A({|x P ,H |}) in v]
using Act-Basic-2 [equiv-lr] &E by blast
thus [{|x P ,H |} in v]
using en-eq-10 [equiv-lr] by simp
next
fix x vassume [{|x P ,H |} in v]
hence 1 : [A({|x P ,H |}) in v]
using en-eq-10 [equiv-rl] by blast
have [x = x in v]
using id-eq-1 [where 0a=ν] by simp
hence [A(x = x) in v]
using id-act-3 [equiv-lr] by fasthence [A(x P = x P & {|x P ,H |}) in v]
unfolding identity-ν-def using 1 Act-Basic-2 [equiv-rl] &I by blast
hence [Aϕ x (x P ) in v]
unfolding ϕ-def by simp
moreover have [∀ β. Aϕ β (x P ) → β = x in v]
proof (rule ∀ I ; rule CP)
fix β
assume [Aϕ β (x P ) in v]
hence [A(β = x) in v]
unfolding ϕ-def identity-ν-defusing Act-Basic-2 [equiv-lr] &E by fast
thus [β = x in v] using id-act-3 [equiv-rl] by fastqed
ultimately have [Aϕ x (x P ) & (∀ β. Aϕ β (x P ) → β = x) in v]
using &I by fasthence [∃ α. Aϕ α (x P ) & (∀ β. Aϕ β (x P ) → β = α) in v]
by (rule existential)
thus [∃ !y. Aϕ y (x P ) in v]
unfolding exists-unique-def by simp
qed
have [(∀ x. (|F ,x P |) ≡ {|x P ,H |}) in v]
apply (PLM-subst-goal-method
λϕ . (∀ x. (|F ,x P |) ≡ ϕ x)
λ x . (∃ !y . Aϕ y (x P )))using 2 F-def by auto
thus [∃ F . (∀ x. (|F ,x P |) ≡ {|x P ,H |}) in v]
by (rule existential)

211

qed

lemma
V
assumes is-propositional: ( G ϕ. IsProperInX (λx. (|G,ιy. ϕ y x|)))and Abs-x: [(|A!,x P |) in v]
and Abs-y: [(|A!,y P |) in v]
and noteq: [x 6= y in v]
shows diffprop: [∃ F . ¬((|F ,x P |) ≡ (|F ,y P |)) in v]
proof −
have [∃ F . ¬({|x P , F |} ≡ {|y P , F |}) in v]
using noteq unfolding exists-def
proof (rule reductio-aa-2 )assume 1 : [∀ F . ¬¬({|x P ,F |} ≡ {|y P ,F |}) in v]{
fix F
have [({|x P ,F |} ≡ {|y P ,F |}) in v]
using 1 [THEN ∀ E] useful-tautologies-1 [deduction] by blast}
hence [∀ F . {|x P ,F |} ≡ {|y P ,F |} in v] by (rule ∀ I )thus [x = y in v]
unfolding identity-ν-defusing ab-obey-1 [deduction, deduction]
Abs-x Abs-y &I by blastqed
then obtain H where H-def : [¬({|x P , H |} ≡ {|y P , H |}) in v]
by (rule Instantiate)
hence 2 : [({|x P , H |} & ¬{|y P , H |}) ∨ (¬{|x P , H |} & {|y P , H |}) in v]
apply − by PLM-solver
have [∃ F . (∀ x. (|F ,x P |) ≡ {|x P ,H |}) in v]
using Fx-equiv-xH [OF is-propositional, THEN ∀ E] by simp
then obtain F where [(∀ x. (|F ,x P |) ≡ {|x P ,H |}) in v]
by (rule Instantiate)
hence F-prop: [∀ x. (|F ,x P |) ≡ {|x P ,H |} in v]
using qml-2 [axiom-instance, deduction] by blast
hence a: [(|F ,x P |) ≡ {|x P ,H |} in v]
using ∀ E by blast
have b: [(|F ,y P |) ≡ {|y P ,H |} in v]
using F-prop ∀ E by blast{
assume 1 : [{|x P , H |} & ¬{|y P , H |} in v]
hence [(|F ,x P |) in v]
using a[equiv-rl] &E by blast
moreover have [¬(|F ,y P |) in v]
using b[THEN oth-class-taut-5-d[equiv-lr], equiv-rl] 1 [conj2 ] by auto
ultimately have [(|F ,x P |) & (¬(|F ,y P |)) in v]
by (rule &I )hence [((|F ,x P |) & ¬(|F ,y P |)) ∨ (¬(|F ,x P |) & (|F ,y P |)) in v]
using ∨I by blast
hence [¬((|F ,x P |) ≡ (|F ,y P |)) in v]
using oth-class-taut-5-j[equiv-rl] by blast}
moreover {assume 1 : [¬{|x P , H |} & {|y P , H |} in v]
hence [(|F ,y P |) in v]
using b[equiv-rl] &E by blast
moreover have [¬(|F ,x P |) in v]
using a[THEN oth-class-taut-5-d[equiv-lr], equiv-rl] 1 [conj1 ] by auto212

ultimately have [¬(|F ,x P |) & (|F ,y P |) in v]
using &I by blast
hence [((|F ,x P |) & ¬(|F ,y P |)) ∨ (¬(|F ,x P |) & (|F ,y P |)) in v]
using ∨I by blast
hence [¬((|F ,x P |) ≡ (|F ,y P |)) in v]
using oth-class-taut-5-j[equiv-rl] by blast}
ultimately have [¬((|F ,x P |) ≡ (|F ,y P |)) in v]
using 2 intro-elim-4-b reductio-aa-1 by blast
thus [∃ F . ¬((|F ,x P |) ≡ (|F ,y P |)) in v]
by (rule existential)qedlemma original-paradox:Vassumes is-propositional: ( G ϕ. IsProperInX (λx. (|G,ιy. ϕ y x|)))shows False
proof −
fix v
have [∃ x y. (|A!,x P |) & (|A!,y P |) & x 6= y & (∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
using aclassical2 by auto
then obtain x where[∃ y. (|A!,x P |) & (|A!,y P |) & x 6= y & (∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
by (rule Instantiate)
then obtain y where xy-def :[(|A!,x P |) & (|A!,y P |) & x 6= y & (∀ F . (|F ,x P |) ≡ (|F ,y P |)) in v]
by (rule Instantiate)
have [∃ F . ¬((|F ,x P |) ≡ (|F ,y P |)) in v]
using diffprop[OF assms, OF xy-def [conj1 ,conj1 ,conj1 ],OF xy-def [conj1 ,conj1 ,conj2 ],OF xy-def [conj1 ,conj2 ]]by autothen obtain F where [¬((|F ,x P |) ≡ (|F ,y P |)) in v]
by (rule Instantiate)
moreover have [(|F ,x P |) ≡ (|F ,y P |) in v]
using xy-def [conj2
V ] by (rule ∀ E)
ultimately have ϕ.[ϕ in v]
using PLM .raa-cor-2 by blast
thus False
using Semantics.T4 by auto
qed
end

213

Bibliography[1] C. Benzmüller. Universal reasoning, rational argumentation and human-machineinteraction. CoRR, abs/1703.09620, 2017.
[2] C. Benzmüller and D. Miller. Automation of higher-order logic. In D. M. Gabbay,
J. H. Siekmann, and J. Woods, editors, Handbook of the History of Logic, Volume
9 — Computational Logic, pages 215–254. North Holland, Elsevier, 2014.
[3] C. Benzmüller and L. Paulson. Quantified multimodal logics in simple type theory.
Logica Universalis (Special Issue on Multimodal Logics), 7(1):7–20, 2013.
[4] C. Benzmüller and D. S. Scott. Axiomatizing category theory in free logic. CoRR,
abs/1609.01493, 2016.
[5] C. Benzmüller and B. Woltzenlogel Paleo. Automating Gödel’s ontological proofof God’s existence with higher-order automated theorem provers. In T. Schaub,
G. Friedrich, and B. O’Sullivan, editors, ECAI 2014, volume 263 of Frontiers in
Artificial Intelligence and Applications, pages 93 – 98. IOS Press, 2014.
[6] I. M. L. D’Ottaviano and H. de Araújo Feitosa. On gödel’s modal interpretationof the intuitionistic logic. In Universal Logic: An Anthology, pages 71–88. Springer
Basel, 2012.
[7] T. Nipkow, L. C. Paulson, and M. Wenzel. Isabelle/HOL — A Proof Assistant forHigher-Order Logic, volume 2283 of LNCS. Springer, 2002.
[8] P. E. Oppenheimer and E. N. Zalta. Relations versus functions at the foundations of logic: Type-theoretic considerations. Journal of Logic and Computation,(21):351–374, 2011.
[9] G. Rosen. Abstract objects. In E. N. Zalta, editor, The Stanford Encyclopedia of
Philosophy. Metaphysics Research Lab, Stanford University, spring 2017 edition,
2017.
[10] E. Zalta. Abstract Objects: An Introduction to Axiomatic Metaphysics. Synthese
Library. Springer, 1983.
[11] E. Zalta. Intensional Logic and the Metaphysics of Intentionality. A Bradford book.
MIT Press, 1988.
[12] E. N. Zalta. Principia logico-metaphysica. http://mally.stanford.edu/principia.pdf.
[Draft/Excerpt; accessed: April 01, 2017].
[13] E. N. Zalta. The theory of abstract objects. http://mally.stanford.edu/theory.html.
Accessed: April 04, 2017.
[14] E. N. Zalta. The theory of abstract objects. http://mally.stanford.edu/distinction.
html. Accessed: April 04, 2017.

214

Selbstständigkeitserklärung
Name:

Kirchner

Vorname:Danielgeb.am:22.05.1989

Matr.Nr.:

4387161

Hiermit versichere ich, dass ich die vorliegende Arbeit selbstständig verfasst und keine
anderen als die angegebenen Quellen und Hilfsmittel benutzt habe.
Alle Ausführungen, die wörtlich oder inhaltlich aus fremden Quellen übernommen sind,habe ich als solche kenntlich gemacht.
Diese Arbeit wurde in gleicher oder ähnlicher Form noch bei keiner anderen Universität
als Prüfungsleistung eingereicht und ist auch noch nicht veröffentlicht.

Daniel Kirchner215