Reasoning

About

Objects

Using

a

Tableau

Method

Renwei

Li

and

Am

lcar

Sernadas

INESC

Rua

Alves

Redol

Lisboa

Portugal

Abstract

An

object

is

understood

as

a

dynamic

entity

whose

attributes

can

be

observed

and

modified

through

the

occurrences

of

its

events

In

order

to

reason

about

such

an

object

a

logical

language

and

a

tableau

method

are

presented

in

this

paper

Objects

and

their

properties

can

be

described

by

a

set

of

formulae

based

on

their

signatures

The

tableau

method

is

an

extension

and

a

development

of

first-order

tableau

method

To

confute

a

finite

set

of

formulae

is

to

construct

a

set

of

tableaux

and

define

some

dependency

relations

on

them

A

simple

illustrative

example

is

also

given

to

show

how

to

reason

about

objects

using

our

method

Introduction

Object-oriented

concepts

techniques

languages

and

tools

have

been

attracting

some

significant

parts

of

the

R&D

resources

within

the

broad

area

of

Software

Engineering

Databases

and

Artificial

Intelligence

-LSB-

-RSB-

By

object

we

mean

a

dynamic

entity

which

includes

a

set

of

variables

-LRB-

called

attributes

-RRB-

and

another

set

of

methods

-LRB-

called

events

-RRB-

The

values

of

the

attributes

can

be

observed

and

modified

by

the

events

We

can

take

the

values

held

by

the

attributes

of

an

object

as

a

state

of

the

object

The

states

of

the

objects

can

vary

with

the

occurrences

of

the

events

For

example

a

database

can

be

considered

as

an

object

Its

state

is

given

by

the

data

-LRB-

information

-RRB-

stored

in

it

and

the

events

may

be

among

create

destroy

query

insert

delete

modify

all

of

which

can

be

parameterized

The

occurrence

of

Published

in

Journal

of

Logic

and

Computation

pp

-LCB-

the

event

create

gives

birth

to

a

database

and

the

occurrence

of

the

event

destroy

can

remove

a

database

The

occurrences

of

events

insert

delete

and

modify

can

lead

the

database

from

one

state

to

another

different

state

since

they

can

change

the

data

-LRB-

information

-RRB-

in

the

database

The

event

query

can

be

considered

as

special

event

which

has

no

effects

on

its

attributes

A

computer

program

can

also

be

considered

as

an

object

whose

states

-LRB-

the

values

of

the

program

variables

-RRB-

can

vary

with

the

occurrences

-LRB-

executions

-RRB-

of

program

commands

An

elevator

a

vending

machine

and

other

dynamic

systems

can

all

be

considered

as

objects

The

reader

is

referred

to

-LSB-

-RSB-

for

more

discussions

and

background

This

paper

is

intended

to

treat

with

object

verification

problems

Object

verification

problems

have

arisen

with

the

increasing

interest

in

objectoriented

approaches

An

object

verification

problem

is

Given

a

description

of

an

object

and

a

property

does

the

object

have

the

property

In

order

to

do

object

verification

we

must

have

-LRB-

-RRB-

a

language

to

describe

objects

-LRB-

-RRB-

a

language

to

express

the

property

-LRB-

-RRB-

a

reasoning

method

which

enables

us

to

infer

from

the

description

of

objects

Approaches

to

descriptions

of

objects

depend

on

the

understanding

of

objects

-LSB-

-RSB-

Although

there

seems

to

be

little

agreement

on

what

is

meant

by

the

term

object

a

general

observation

on

objects

can

be

made

An

object

encapsulates

a

set

of

variables

-LRB-

called

attributes

-RRB-

with

another

set

of

methods

-LRB-

called

actions

or

events

-RRB-

for

changing

the

variables

The

values

of

the

variables

give

states

of

the

objects

Objects

can

evolve

from

one

state

to

another

with

occurrences

of

events

Therefore

a

description

of

an

object

should

at

least

tell

-LRB-

-RRB-

what

the

attributes

are

-LRB-

-RRB-

what

the

events

are

and

-LRB-

-RRB-

how

the

events

change

the

attributes

Sometimes

it

is

also

required

for

the

description

of

the

object

to

tell

how

the

events

of

the

object

happen

-LRB-

randomly

or

in

a

restricted/ruled

way

-RRB-

In

this

paper

we

will

describe

an

object

as

a

set

of

formulae

in

a

suitable

logical

language

Logical

descriptions

also

make

it

possible

and

convenient

to

express

the

properties

of

objects

and

perform

reasoning

in

the

same

logical

setting

Besides

logical

approach

to

descriptions

of

objects

there

are

of

course

some

other

approaches

For

example

an

object

can

be

viewed

as

an

observed

process

-LSB-

-RSB-

An

object

can

also

be

described

in

a

suitable

specification

language

such

as

OBLOG

-LSB-

-RSB-

Properties

about

objects

are

often

concerned

with

the

behaviour

of

objects

There

are

four

kinds

of

properties

which

we

are

especially

interested

in

-LRB-

-RRB-

properties

about

a

state

of

an

object

-LRB-

called

static

properties

-RRB-

-LRB-

-RRB-

properties

about

a

transition

of

an

object

from

one

state

to

another

-LRB-

called

transitional

properties

-RRB-

-LRB-

-RRB-

properties

about

a

lifecycle

of

an

object

-LRB-

called

temporal

properties

-RRB-

-LRB-

-RRB-

mixed

properties

about

states

transitions

and

lifecycles

of

objects

-LRB-

called

trajectory

properties

-RRB-

Obviously

it

is

convenient

to

express

properties

in

logical

formulae

For

properties

about

states

we

can

make

use

of

a

first-order

logic

for

properties

about

transitions

we

can

make

use

of

a

transitional

logic

or

event

logic

for

properties

about

lifecycles

we

can

make

use

of

a

first-order

temporal

logic

and

for

the

mixed

properties

we

can

make

use

of

a

mixed

logic

-LRB-

called

trajectory

logic

in

this

paper

-RRB-

of

the

transitional

logic

and

the

temporal

logic

A

transitional

logic

sometimes

also

called

event

logic

by

some

authors

is

a

logic

which

is

designed

to

deal

with

events/actions

and

their

effects

-LRB-

on

the

attributes

-RRB-

in

a

discrete

transitional

system

such

as

finite

state

automaton

An

event

can

lead

the

finite

state

automaton

from

one

state

to

another

and

output

something

The

effects

of

the

event

can

be

given

by

the

state

transition

function

and

the

output

function

of

the

finite

state

automaton

In

fact

an

object

can

be

modelled

as

a

finite

state

automaton

as

argued

in

-LSB-

-RSB-

In

this

paper

we

will

present

a

transitional

tableau

method

to

reason

about

the

transitional

properties

of

an

object

A

lifecycle

of

an

object

can

be

understood

as

an

admissible

sequence

of

admissible

states

of

the

object

Since

the

states

of

an

object

are

given

by

the

values

of

the

attributes

and

affected

by

the

events

of

the

object

a

lifecycle

can

also

be

understood

as

an

admissible

sequence

of

events

as

in

-LSB-

-RSB-

A

state

is

admissible

if

it

can

be

reached

through

the

occurrences

of

some

events

A

sequence

of

states

is

admissible

if

the

dynamic

constraints

on

the

object

are

satisfied

by

the

sequence

An

arbitrary

sequence

of

admissible

states

is

not

necessarily

admissible

Such

a

lifecycle

can

be

viewed

as

a

sequence

of

time

instants

Thus

the

properties

about

the

lifecycles

can

be

expressed

in

a

suitable

first-order

temporal

logic

with

the

lifecycles

as

the

underlying

time

structures

In

order

to

prove

properties

of

an

object

the

inference

rules

in

relevant

logics

can

be

used

For

example

properties

about

states

can

be

proved

by

first-order

inference

rules

Properties

about

lifecycles

can

be

proved

by

temporal

inference

rules

In

-LSB-

-RSB-

some

object

calculi

for

reasoning

about

objects

have

been

proposed

and

discussed

In

this

paper

we

will

focus

on

tableau

methods

as

reasoning

means

For

properties

about

states

first-order

tableaux

can

of

course

be

used

For

properties

about

lifecycles

we

will

present

temporal

tableaux

as

reasoning

method

for

properties

about

state

transitions

we

will

present

transitional

tableaux

for

mixed

properties

we

will

present

mixed

tableaux

called

trajectory

tableaux

Our

work

on

tableau

methods

for

object

verification

has

been

inspired

and

affected

by

the

work

on

object

calculus

in

-LSB-

-RSB-

An

object

calculus

is

given

by

a

set

of

axioms

and

inference

rules

These

axioms

and

inference

rules

have

served

as

the

start-point

for

our

research

on

reasoning

methods

for

object

verification

General

speaking

it

is

not

easy

to

find

a

proof

for

a

theorem

in

an

axiomatic

system

On

the

other

hand

it

is

unknown

how

to

mechanize

an

object

calculus

on

computers

Some

other

reasoning

methods

which

are

expected

to

be

more

efficient

and

able

to

be

mechanized

have

been

wanted

in

our

work

It

seemed

to

us

that

there

are

three

possible

choices

of

reasoning

methods

-LRB-

-RRB-

natural

deduction

-LRB-

-RRB-

modal

resolution

and

-LRB-

-RRB-

tableau

method

The

work

on

LCF

has

shown

that

a

natural

deduction

system

can

be

easily

mechanized

by

ML

language

to

obtain

a

proof

checker

-LSB-

-RSB-

LCF

can

also

help

develop

a

proof

interactively

on

computers

by

use

of

LCF

tactic/tacticals

In

-LSB-

-RSB-

an

interactive

theorem

proving

system

for

temporal

logic

was

introduced

In

-LSB-

-RSB-

our

work

on

natural

deduction

systems

for

object

verification

has

been

reported

However

it

is

semi-automatic

The

resolution

based

method

and

tableau

method

can

be

implemented

into

fully

automatic

reasoning

procedures

In

the

case

of

first-order

logic

the

resolution

method

is

much

more

efficient

than

the

tableau

method

since

the

resolution

method

consists

of

only

one

rule

but

the

tableau

method

consists

of

more

than

five

rules

-LRB-

which

requires

that

at

each

step

the

formulae

should

be

scanned

so

as

to

pick

out

a

suitable

tableau

rule

for

extending

the

current

tableau

-RRB-

In

the

case

of

modal

logic

however

it

is

very

hard

to

judge

which

of

the

resolution

method

and

the

tableau

method

is

more

efficient

It

is

because

both

the

resolution

method

and

the

tableau

method

consist

of

a

few

rules

At

each

step

of

the

two

methods

there

is

a

similar

time-consuming

choice

of

the

rules

for

the

next

action

What

is

more

our

logic

for

object

verification

involves

first-order

temporal

logic

and

logic

of

modal

terms

the

expected

unification

algorithm

is

very

complicated

and

time-consuming

Which

is

better

for

object

verification

after

all

has

not

been

known

to

us

yet

It

is

not

our

intention

to

discuss

or

debate

on

this

problem

in

this

paper

Instead

we

will

be

restricted

to

the

tableau

method

for

object

verification

A

modal

logical

language

which

can

be

used

to

describe

an

object

and

their

static

transitional

temporal

and

trajectory-based

properties

will

be

introduced

and

a

tableau

method

for

object

verification

will

be

presented

The

rest

of

this

paper

is

organized

as

follows

In

Section

we

will

introduce

a

logical

language

and

its

semantics

for

describing

objects

and

their

properties

This

language

is

in

essence

a

mixture

of

a

first-order

temporal

language

and

a

transitional

language

From

this

language

we

can

have

four

sub-languages

to

describe

four

kinds

of

properties

respectively

The

semantics

can

help

understand

the

tableau

rules

and

establish

the

soundness

of

the

tableau

method

In

Section

we

will

present

a

tableau

method

for

reasoning

about

objects

The

tableau

method

is

presented

by

giving

the

tableau

rules

and

condition

for

closed

nodes

The

tableau

rules

are

used

to

extend

the

current

tableau

To

confute

a

set

of

formulae

is

to

construct

a

set

of

tableaux

and

define

some

dependency

relations

on

them

If

we

succeed

to

confute

A

then

we

can

conclude

that

A

is

valid

Our

result

here

can

be

considered

as

development

and

extension

of

the

classical

tableau

method

for

first-order

logic

In

Section

we

will

give

vending

machine

as

a

simple

illustrative

example

to

show

the

usefulness

of

our

method

A

vending

machine

is

a

dynamic

entity

or

an

object

in

our

term

whose

states

can

change

with

the

coins

inserted

A

logical

language

In

this

section

we

will

introduce

a

logical

language

and

its

semantics

to

describe

objects

and

their

properties

In

Section

we

will

give

an

informal

understanding

of

the

concept

of

objects

By

object

we

mean

a

dynamic

entity

whose

attributes

can

be

observed

and

modified

by

its

events

In

Section

we

will

define

a

logical

language

which

is

in

essence

a

mixture

of

a

first-order

temporal

language

and

a

transitional

language

Modal

terms

of

-LSB-

-RSB-

have

been

adopted

in

our

language

We

understand

why

the

truth

of

a

formula

changes

is

because

the

values

of

the

terms

included

in

the

formula

have

been

changed

So

applying

some

modal

operators

to

terms

is

more

reasonable

and

useful

In

Section

we

will

give

the

semantics

for

our

language

The

semantics

is

defined

on

admissible

trajectories

of

the

object

Objects

Objects

in

the

sense

of

object-oriented

approaches

-LRB-

such

as

object-oriented

programming

-LSB-

-RSB-

object-oriented

databases

-LSB-

-RSB-

object-oriented

system

specification

and

design

-LSB-

-RSB-

-RRB-

can

be

understood

as

a

dynamic

entity

whose

attributes

can

be

observed

and

modified

by

its

events

Objects

seem

to

be

playing

a

more

and

more

important

role

in

programming

database

requirement

specification

and

system

design

The

concept

of

objects

can

be

traced

back

to

with

SIMULA

language

-LSB-

-RSB-

and

was

developed

with

-LSB-

-RSB-

According

to

Smalltalk

objects

are

understood

as

dynamic

entities

which

may

be

created

modified

and

destroyed

Only

the

events

declared

for

an

object

can

modify

the

values

of

its

attributes

and

lead

it

to

another

state

-LRB-

called

locality

of

objects

or

no

collateral

effects

principle

-LSB-

-RSB-

-RRB-

The

initial

state

of

an

object

can

be

given

by

an

occurrence

of

an

event

called

birth

event

Sometimes

an

object

can

be

destroyed

by

an

occurrence

of

an

event

called

death

event

Other

events

which

modify

the

values

of

the

attributes

are

called

modify

events

Elevators

vending

machines

program

variables

information

systems

can

all

be

considered

as

examples

of

objects

According

to

-LSB-

-RSB-

everything

is

an

object

Now

we

will

take

a

student

at

a

university

as

an

example

to

show

the

common

characteristics

of

objects

A

student

at

a

university

can

be

viewed

as

an

object

His/her

attributes

may

include

age

year

class

records

-LRB-

:-RRB-

classification

address

marital

status

and

his/her

events

may

include

register

-LRB-

name

age

address

:-RRB-

new

year

-LRB-

i

-RRB-

graduate

-LRB-

classification

-RRB-

get

married

move

to

-LRB-

address

-RRB-

and

so

on

The

attribute

records

is

an

array

and

has

all

the

courses

as

its

parameters

-LRB-

indices

-RRB-

The

events

register

new

year

move

to

and

graduate

have

their

own

parameters

respectively

In

general

all

the

attributes

and

events

of

any

object

are

allowed

to

have

their

own

parameters

When

the

event

register

occurs

the

boy/girl

as

object

STUDENT

is

created

-LRB-

he/she

is

now

a

formal

student

-RRB-

when

the

event

new

year

-LRB-

i

-RRB-

occurs

the

attribute

year

is

set

to

i

when

the

event

graduate

occurs

the

boy/girl

as

object

STUDENT

is

destroyed

-LRB-

now

he/she

is

not

a

student

-RRB-

The

event

register

is

called

a

birth

event

whose

occurrence

can

give

an

initial

state

to

object

STUDENT

On

the

contrary

the

event

graduate

is

called

a

death

event

Other

events

such

as

new

year

are

called

modify

events

No

events

are

allowed

to

occur

after

the

occurrence

of

a

death

event

If

a

birth

event

happens

after

a

death

event

the

entity

is

considered

as

a

new

object

different

from

the

old

one

A

boy/girl

can

be

the

object

STUDENT

several

times

in

his/her

life

In

general

an

object

can

have

more

than

one

birth

event

and

more

than

one

death

event

For

example

the

object

STUDENT

can

have

quit

or

dismissed

as

another

death

event

More

examples

can

be

found

in

literature

-LSB-

-RSB-

Objects

can

be

organized

into

object

groups

Objects

can

also

interact

with

each

other

by

means

of

message-passing

In

order

to

understand

and

make

clear

the

concept

of

objects

some

mathematical

models

and

object

specification

languages

have

been

proposed

in

literature

-LSB-

-RSB-

It

has

been

shown

that

a

group

of

interacting

objects

can

also

be

considered

as

a

single

object

and

captured

by

their

colimit

in

a

suitable

category

of

objects

-LSB-

-RSB-

So

it

is

significant

to

discuss

on

a

single

object

in

isolation

In

this

paper

we

will

restrict

ourselves

to

objects

in

isolation

An

object

can

be

specified

by

a

set

of

logical

formulae

Our

logical

formalism

for

describing

objects

follow

the

work

on

action

deontic

and

temporal

logic

in

literature

e.g.

in

-LSB-

-RSB-

A

logical

language

An

object

can

be

described

by

a

logical

language

The

logical

language

must

be

powerful

enough

to

describe

static

properties

about

states

of

objects

transitional

behaviours

of

objects

temporal

behaviours

of

objects

Now

we

start

with

the

definition

of

the

signature

-LRB-

of

an

object

-RRB-

then

define

our

terms

and

finally

define

formulae

on

the

signature

Let

S

be

a

set

we

denote

the

set

of

finite

sequences

of

elements

of

S

by

S

and

denote

the

empty

sequence

by

The

concatenation

on

S

and

the

size

j

y

j

of

a

sequence

y

of

elements

are

defined

as

usual

Let

A

-LRB-

x

-RRB-

be

a

formula

-LRB-

or

term

-RRB-

by

A

-LRB-

y

x

-RRB-

we

mean

that

x

in

A

-LRB-

x

-RRB-

is

partially

substituted

by

y

that

is

some

of

x

s

in

A

-LRB-

x

-RRB-

are

replaced

by

y.

By

A

-LRB-

y

-RRB-

we

mean

that

x

in

A

-LRB-

x

-RRB-

is

completely

substituted

by

y

that

is

all

of

x

s

in

A

-LRB-

x

-RRB-

are

replaced

by

y.

For

example

let

A

-LRB-

x

-RRB-

be

-LRB-

x

z

-RRB-

-LRB-

x

y

-RRB-

Then

A

-LRB-

w

x

-RRB-

may

be

-LRB-

w

z

-RRB-

-LRB-

x

y

-RRB-

or

-LRB-

x

z

-RRB-

-LRB-

w

y

-RRB-

or

-LRB-

w

z

-RRB-

-LRB-

w

y

-RRB-

But

A

-LRB-

w

-RRB-

must

be

-LRB-

w

z

-RRB-

-LRB-

w

y

-RRB-

Definition

-LRB-

Signature

-RRB-

A

signature

ss

is

a

quadruple

-LRB-

S

ff

-RRB-

where

ffl

S

is

a

set

of

sorts

including

a

special

sort

event

ffl

is

an

S

S

indexed

family

of

sets

of

function

symbols

ffl

is

an

S

S

indexed

family

of

attribute

generator

symbols

ffl

is

a

triple

-LRB-

BH

MY

DH

-RRB-

where

BH

MY

and

DH

are

three

disjoint

S

indexed

families

of

sets

of

event

generator

symbols

and

DH

is

possibly

empty

And

we

define

-LRB-

BH

-LSB-

MY

-LSB-

DH

>=-RRB-

and

sn

i

-LRB-

sn

i

-LSB-

sn

i

-LSB-

sn

i

-RRB-

All

the

above

S

and

are

assumed

to

be

disjoint

and

finite

The

above

definition

allows

us

to

distinguish

between

a

state-independent

component

and

a

state-dependent

component

The

state-independent

component

captured

by

algebraic

signature

-LRB-

S

-RRB-

provides

information

about

the

data

which

the

attributes

of

an

object

may

take

The

state-dependent

component

is

captured

by

The

values

which

the

attributes

of

the

object

hold

can

change

from

one

state

to

another

Note

that

attribute

generator

symbols

of

an

object

are

allowed

to

have

arguments

For

example

a

program

variable

is

state

-LRB-

execution

-RRB-

dependent

and

thus

its

value

may

change

with

the

execution

of

the

program

but

it

has

no

argument

An

array

in

a

program

is

also

state

dependent

but

it

has

arguments

-LRB-

indices

-RRB-

The

above

definition

also

allows

us

to

distinguish

among

events

An

event

is

called

a

birth

-LRB-

modify

or

death

respectively

-RRB-

event

if

it

is

generated

from

an

event

generator

in

BH

-LRB-

MY

or

DH

respectively

-RRB-

The

sort

event

will

allow

to

have

events

-LRB-

syntactical

events

-RRB-

as

special

terms

called

event

terms

In

the

following

we

do

not

allow

event

as

a

sort

of

arguments

or

ranges

of

functions

that

is

we

do

not

allow

the

function

symbols

such

as

f

event

sn

i

s

or

f

sn

i

event

In

order

to

define

our

terms

we

will

need

some

variables

Let

be

a

set

of

variables

disjoint

from

the

above

S

and

Definition

-LRB-

Classification

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

by

a

classification

we

mean

a

function

S

We

shall

denote

by

the

S

indexed

set

given

by

s

fx

j

-LRB-

x

-RRB-

sg

Since

S

includes

event

as

a

sort

we

have

set

event

of

variables

for

events

called

event

variables

Thus

existential

quantification

over

events

is

made

possible

In

the

following

we

will

use

event

variables

to

denote

only

the

modify

and

death

events

-LRB-

see

Section

for

semantics

-RRB-

Note

that

only

the

modify

and

death

events

can

lead

an

object

from

one

state

to

another

The

occurrence

of

a

birth

event

can

create

an

object

and

set

its

initial

state

Definition

-LRB-

Transitional

terms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

the

S

indexed

set

of

transitional

terms

T

p

-LRB-

ss

-RRB-

is

defined

as

the

minimal

set

satisfying

the

following

properties

s

T

p

-LRB-

ss

-RRB-

s

s

T

p

-LRB-

ss

-RRB-

s

if

f

sn

i

s

and

ti

T

p

-LRB-

ss

-RRB-

si

then

f

-LRB-

tn

-RRB-

T

p

-LRB-

ss

-RRB-

s

s

T

p

-LRB-

ss

-RRB-

s

If

a

s

we

say

that

term

a

contains

an

attribute

generator

symbol

if

a

sn

i

s

and

ti

T

p

-LRB-

ss

-RRB-

si

then

a

-LRB-

tn

-RRB-

T

p

-LRB-

ss

-RRB-

s

and

we

say

that

term

a

-LRB-

tn

-RRB-

contains

an

attribute

generator

symbol

T

p

-LRB-

ss

-RRB-

event

called

event

terms

Specifically

if

v

BH

-LRB-

MY

or

DH

respectively

-RRB-

v

is

called

a

birth

-LRB-

modify

or

death

respectively

-RRB-

event

term

if

e

sn

i

ti

T

p

-LRB-

ss

-RRB-

si

then

e

-LRB-

tn

-RRB-

T

p

-LRB-

ss

-RRB-

event

also

called

event

term

Specifically

if

e

sn

i

-LRB-

sn

i

or

sn

i

respectively

-RRB-

e

-LRB-

tn

-RRB-

is

called

a

birth

-LRB-

modify

or

death

respectively

-RRB-

event

term

if

e

T

p

-LRB-

ss

-RRB-

event

t

T

p

-LRB-

ss

-RRB-

s

then

-LRB-

-LSB-

e

-RSB-

t

-RRB-

T

p

-LRB-

ss

-RRB-

s

-LSB-

e

-RSB-

is

called

a

positional

operator

and

we

say

that

t

is

positionally

qualified

in

-LSB-

e

-RSB-

t

The

above

transitional

terms

can

be

used

as

terms

of

a

transitional

logic

See

-LSB-

-RSB-

for

a

background

and

more

discussions

on

terms

of

form

-LSB-

e

-RSB-

t

and

their

application

for

system

specification

and

verification

Informally

the

term

-LRB-

-LSB-

e

-RSB-

t

-RRB-

denotes

the

value

of

t

after

event

denoted

by

event

term

e

occurs

This

kind

of

modal

terms

is

very

useful

to

describe

the

transitional

effects

of

events

on

the

attributes

We

will

consider

transitional

terms

as

atomic

-LRB-

basic

-RRB-

terms

of

the

trajectory-based

terms

The

reason

for

having

transitional

terms

as

atomic

terms

is

that

the

positional

qualification

could

lead

us

out

of

the

real

trajectory

making

the

evaluation

of

temporal

operators

impossible

Definition

-LRB-

Trajectory-based

terms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

the

S

indexed

set

of

trajectory-based

terms

T

-LRB-

ss

-RRB-

is

defined

as

the

minimal

set

satisfying

the

following

properties

T

p

-LRB-

ss

-RRB-

s

T

-LRB-

ss

-RRB-

s

if

f

sn

i

s

and

ti

T

-LRB-

ss

-RRB-

si

then

f

-LRB-

tn

-RRB-

T

-LRB-

ss

-RRB-

s

if

a

sn

i

s

and

ti

T

-LRB-

ss

-RRB-

si

then

a

-LRB-

tn

-RRB-

T

-LRB-

ss

-RRB-

s

if

t

T

-LRB-

ss

-RRB-

s

then

-LRB-

t

-RRB-

T

-LRB-

ss

-RRB-

s

called

temporal

term

and

we

say

that

a

temporal

operator

appears

in

-LRB-

t

-RRB-

Informally

term

-LRB-

t

-RRB-

denotes

the

value

of

t

at

the

next

time

instant

Note

that

the

above

trajectory-based

terms

include

temporal

terms

of

form

-LRB-

t

-RRB-

of

-LSB-

-RSB-

and

positional

terms

of

form

-LRB-

-LSB-

e

-RSB-

t

-RRB-

of

-LSB-

-RSB-

Compared

with

the

terms

in

-LSB-

-RSB-

no

temporal

terms

of

form

-LRB-

t

BL

b

-RRB-

and

-LRB-

t

BM

b

-RRB-

are

included

here

-LRB-

t

BL

b

-RRB-

denotes

the

common

values

taken

by

t

in

every

instant

from

now

on

until

the

boolean

term

b

is

true

and

-LRB-

t

BM

b

-RRB-

denotes

all

the

values

taken

by

t

from

now

on

until

the

boolean

term

b

is

true

In

-LSB-

-RSB-

the

temporal

terms

of

form

-LRB-

Ft

-RRB-

and

-LRB-

Gt

-RRB-

were

considered

-LRB-

Ft

-RRB-

denotes

all

the

values

taken

by

t

in

the

future

and

-LRB-

Gt

-RRB-

denotes

all

the

common

values

taken

by

t

in

the

future

-LRB-

Ft

-RRB-

and

-LRB-

Gt

-RRB-

can

be

considered

as

special

cases

of

-LRB-

t

BL

b

-RRB-

and

-LRB-

t

BM

b

-RRB-

Note

that

we

can

easily

extend

the

following

tableau

method

for

the

logical

language

with

the

temporal

terms

of

form

-LRB-

t

BL

b

-RRB-

and

-LRB-

t

BM

b

-RRB-

if

we

want

Besides

the

transitional

terms

defined

in

Def

the

following

terms

can

be

obtained

from

the

terms

defined

above

first-order

terms

of

a

firstorder

logic

and

temporal

terms

of

a

first-order

temporal

logic

respectively

The

terms

defined

above

also

include

terms

of

form

-LRB-

-LRB-

-LSB-

e

-RSB-

t

-RRB-

-RRB-

which

is

neither

a

pure

transitional

term

nor

a

pure

temporal

term

Definition

-LRB-

Transitional

formulae

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

the

formulae

over

ss

and

are

defined

as

the

minimal

set

satisfying

the

following

properties

is

a

transitional

formula

if

T

p

-LRB-

ss

-RRB-

s

If

A

and

B

are

transitional

formulae

then

-LRB-

A

-RRB-

and

-LRB-

A

B

-RRB-

are

If

e

is

an

event

term

A

is

a

transitional

formula

then

-LRB-

-LSB-

e

-RSB-

A

-RRB-

is

a

transitional

formula

If

A

is

a

transitional

formula

s

is

a

sort

symbol

in

S

x

s

then

-LRB-

x

s

-RRB-

A

is

a

transitional

formula

and

we

say

that

x

is

a

quantified

variable

Definition

-LRB-

Atoms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

the

trajectory-based

atoms

are

defined

as

the

minimal

set

satisfying

the

following

properties

A

transitional

formula

is

a

trajectory-based

atom

is

a

trajectory-based

atom

if

T

-LRB-

ss

-RRB-

s

OCC

-LRB-

e

-RRB-

is

a

trajectory-based

atom

if

e

T

-LRB-

ss

-RRB-

event

Informally

for

a

birth

event

e

OCC

-LRB-

e

-RRB-

is

true

if

the

birth

event

e

happens

at

the

current

time

instant

and

for

a

modify

or

death

event

e

OCC

-LRB-

e

-RRB-

is

true

if

the

event

e

is

going

to

happen

at

the

next

time

instant

It

is

used

to

judge

the

occurrence

of

events

The

use

of

OCC

predicate

has

made

it

feasible

to

mix

the

transitional

logic

and

the

temporal

logic

so

as

to

obtain

a

so-called

trajectory

logic

In

-LSB-

-RSB-

the

event

occurrence

judgements

were

considered

at

the

term

level

by

introducing

two

attribute

generators

R

and

T

In

-LSB-

-RSB-

the

event

occurrence

judgements

were

considered

also

at

the

term

level

by

introducing

an

attribute

generator

symbol

Occ

Note

that

OCC

-LRB-

e

-RRB-

is

the

same

as

-LRB-

Occ

-LRB-

e

-RRB-

tt

-RRB-

We

do

not

distinguish

between

the

predicate

on

transitional

terms

and

on

trajectory

terms

since

a

transitional

term

is

also

a

trajectory

term

From

predicate

we

can

easily

define

equality

and

less-than

as

usual

Definition

-LRB-

Trajectory

formulae

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

the

trajectory-based

formulae

over

ss

and

are

defined

as

the

minimal

set

satisfying

the

following

properties

A

trajectory-based

atom

is

a

trajectory-based

formula

If

A

and

B

are

trajectory-based

formulae

then

-LRB-

A

-RRB-

and

-LRB-

A

B

-RRB-

are

If

A

and

B

are

trajectory-based

formulae

then

-LRB-

A

-RRB-

and

-LRB-

A

B

B

-RRB-

are

and

we

say

a

temporal

operator

appears

in

-LRB-

A

-RRB-

and

-LRB-

A

B

B

-RRB-

respectively

If

A

is

a

trajectory-based

formula

s

is

a

sort

symbol

in

S

but

not

event

x

s

then

-LRB-

x

s

-RRB-

A

is

a

trajectory-based

formula

and

we

say

that

x

is

a

quantified

variable

A

trajectory-based

formula

is

simply

called

a

formula

Other

operators

such

as

can

be

defined

as

usual

For

example

-LRB-

-RRB-

can

be

defined

as

-LRB-

A

B

-LRB-

B

B

-RRB-

-RRB-

and

-LRB-

-RRB-

as

A.

Informally

-LRB-

-LSB-

e

-RSB-

A

-RRB-

holds

if

A

will

hold

after

an

immediate

occurrence

of

event

e

-LRB-

-LRB-

x

event

-RRB-

A

-LRB-

x

-RRB-

-RRB-

holds

if

there

is

a

-LRB-

generated

-RRB-

modify

or

death

event

e

such

that

the

formula

A

-LRB-

e

-RRB-

holds

Note

that

we

only

consider

an

object

The

lifecycle

of

an

object

starts

with

only

a

birth

event

followed

by

modify

or

death

events

Thus

it

is

actually

meaningless

to

use

event

variables

for

birth

events

since

there

is

only

one

birth

event

in

a

lifecycle

-LRB-

A

-RRB-

holds

if

A

is

going

to

hold

at

next

time

instant

-LRB-

ABB

-RRB-

holds

if

A

will

hold

until

B

holds

from

now

on

and

B

are

two

temporal

operators

nexttime

operator

and

unless

operator

All

these

informal

interpretations

will

be

made

clear

in

Section

Semantics

For

the

sake

of

self-containedness

in

this

section

we

will

define

the

semantics

of

our

language

First

of

all

we

will

define

the

generated

events

Only

the

generated

events

can

change

the

values

of

the

attributes

and

lead

the

object

from

one

state

to

another

Definition

-LRB-

Generated

events

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

and

an

-LRB-

S

feventg

-RRB-

algebra

the

set

EVT

of

events

generated

from

ss

and

is

defined

as

follows

ae

EVT

Specifically

if

v

BH

-LRB-

MY

or

DH

respectively

-RRB-

v

is

called

a

birth

-LRB-

modify

or

death

respectively

-RRB-

event

if

e

sn

i

ti

si

then

e

-LRB-

tn

-RRB-

Specifically

if

e

sn

i

-LRB-

sn

i

or

sn

i

respectively

-RRB-

e

-LRB-

tn

-RRB-

is

called

a

birth

-LRB-

modify

or

death

respectively

-RRB-

event

Recall

that

only

the

events

declared

for

an

object

can

modify

the

values

of

its

attributes

and

lead

it

to

another

state

So

it

is

enough

only

to

consider

the

generated

events

and

their

effects

Note

that

the

set

EVT

of

generated

events

depends

not

only

on

the

event

generators

but

also

on

the

algebra

for

interpreting

the

state

independent

components

We

also

require

that

equality

-LRB-

which

satisfies

the

reflexivity

symmetry

and

transitivity

-RRB-

is

admissible

on

the

generated

events

We

require

that

birth

modify

and

death

events

can

not

be

equal

to

each

other

by

any

means

In

the

following

we

measure

time

by

occurrences

of

events

an

occurrence

of

an

event

is

a

lapse

of

a

time

unit

that

is

to

say

if

an

event

has

happened

then

time

has

elapsed

a

unit

Definition

-LRB-

Structure

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

interpretation

structure

I

for

ss

is

a

quadruple

I

-LRB-

EVT

M

E

-RRB-

where

is

an

-LRB-

S

feventg

-RRB-

algebra

and

is

admissible

on

every

carrier

set

s

EVT

is

the

set

of

events

generated

from

ss

and

and

is

admissible

on

EVT

M

maps

a

s

to

M

-LRB-

a

-RRB-

-LRB-

EVT

-RRB-

s

a

sn

i

s

to

M

-LRB-

a

-RRB-

sn

-LRB-

EVT

-RRB-

s

E

maps

a

natural

number

to

a

generated

event

such

that

E

-LRB-

-RRB-

is

a

birth

event

and

E

-LRB-

i

-RRB-

is

either

a

modify

event

or

a

death

event

for

i

If

E

-LRB-

m

-RRB-

is

a

death

event

for

some

m

then

E

-LRB-

n

-RRB-

is

undefined

for

n

m.

-LRB-

EVT

-RRB-

provides

all

the

possible

Kripke-states

in

the

interpretation

structure

A

sequence

in

-LRB-

EVT

-RRB-

denotes

a

possible

trajectory

of

the

object

The

empty

sequence

in

-LRB-

EVT

-RRB-

denotes

the

trajectory

of

the

object

which

has

not

yet

been

created

In

the

following

we

will

only

discuss

the

created

object

E

provides

the

information

about

the

trajectory

of

the

object

E

tells

what

event

happens

if

a

time

instant

is

given

From

E

we

can

see

that

for

a

natural

number

there

is

only

one

event

that

is

to

say

it

is

not

allowed

that

two

different

events

occur

at

the

same

time

E

can

be

extended

as

follows

if

m

is

the

greatest

natural

number

such

that

E

-LRB-

m

-RRB-

is

defined

then

E

-LRB-

-RRB-

hE

-LRB-

-RRB-

i

E

-LRB-

i

-RRB-

E

-LRB-

i

-RRB-

hE

-LRB-

i

-RRB-

i

for

i

m

and

E

-LRB-

n

-RRB-

E

-LRB-

m

-RRB-

for

n

m

otherwise

E

-LRB-

-RRB-

he

-LRB-

-RRB-

i

E

-LRB-

i

-RRB-

E

-LRB-

i

-RRB-

he

-LRB-

i

-RRB-

i

for

any

i

Recall

that

is

the

concatenation

operation

and

denotes

the

empty

sequence

So

E

is

defined

everywhere

on

natural

numbers

Definition

-LRB-

Assignment

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

assignment

A

for

a

classification

maps

each

set

s

-LRB-

except

event

-RRB-

to

s

and

event

to

generated

modify

and

death

events

in

EVT

In

order

to

interpret

our

terms

and

formulae

on

the

real

trajectory

given

by

E

first

of

all

we

will

interpret

the

transitional

terms

and

formulae

on

all

the

possible

trajectories

and

then

interpret

the

trajectory-based

terms

and

formulae

on

the

real

trajectory

given

by

E

Definition

-LRB-

Interpretation

of

transitional

terms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

a

classification

an

interpretation

structure

I

-LRB-

EVT

M

E

-RRB-

for

ss

and

an

assignment

A

for

we

define

for

each

sort

s

S

and

a

transitional

term

t

of

sort

s

a

mapping

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

from

-LRB-

EVT

-RRB-

to

s

or

EVT

as

follows

ffl

if

x

s

then

-LSB-

-LSB-

x

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

A

-LRB-

x

-RRB-

ffl

if

f

s

then

-LSB-

-LSB-

f

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

f

ffl

if

f

sn

i

s

then

-LSB-

-LSB-

f

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

f

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

ffl

if

a

s

then

-LSB-

-LSB-

a

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

M

-LRB-

a

-RRB-

-LRB-

y

-RRB-

ffl

if

a

sn

i

s

then

-LSB-

-LSB-

a

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

M

-LRB-

a

-RRB-

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

y

-RRB-

ffl

if

e

then

-LSB-

-LSB-

e

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

e

ffl

if

e

sn

i

then

-LSB-

-LSB-

e

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

e

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

ffl

if

e

BH

then

-LSB-

-LSB-

-LSB-

e

-RSB-

t

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

e

-RRB-

ffl

if

e

sn

i

then

-LSB-

-LSB-

e

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

e

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

-RRB-

ffl

if

e

MY

-LSB-

DH

then

-LSB-

-LSB-

-LSB-

e

-RSB-

t

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

y

e

-RRB-

ffl

if

e

sn

i

-LSB-

sn

i

then

-LSB-

-LSB-

e

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

y

e

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

-RRB-

From

the

above

definition

we

can

see

that

event

terms

-LRB-

syntactic

events

-RRB-

are

interpreted

as

generated

events

-LRB-

semantic

events

-RRB-

The

above

definition

provides

interpretations

of

transitional

terms

on

all

the

possible

trajectories

But

an

object

has

only

one

real

trajectory

From

the

above

definition

we

can

see

that

the

interpretations

of

the

transitional

terms

have

nothing

to

do

with

E

What

we

are

concerned

with

is

the

real

trajectory

of

the

object

In

the

following

we

will

give

the

interpretation

of

trajectory-based

terms

on

the

real

trajectory

given

by

E

Definition

-LRB-

Interpretation

of

terms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

interpretation

structure

I

-LRB-

EVT

M

E

-RRB-

for

ss

a

classification

and

an

assignment

A

for

we

define

for

each

sort

s

S

and

a

term

t

T

-LRB-

ss

-RRB-

s

a

mapping

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

from

to

s

or

EVT

as

follows

ffl

if

t

is

a

transitional

term

then

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

E

-LRB-

i

-RRB-

-RRB-

ffl

if

f

sn

i

s

then

-LSB-

-LSB-

f

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

f

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-RRB-

ffl

if

a

sn

i

s

then

-LSB-

-LSB-

a

-LRB-

tn

-RRB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

M

-LRB-

a

-RRB-

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

E

-LRB-

i

-RRB-

-RRB-

ffl

if

E

is

defined

everywhere

on

natural

numbers

then

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

any

i

If

m

is

the

greatest

natural

number

such

that

E

-LRB-

m

-RRB-

is

defined

then

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

any

i

m

and

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

t

-RSB-

-RSB-

I

A

-LRB-

m

-RRB-

for

any

i

m.

From

the

above

definition

we

can

see

that

the

functions

are

time-independent

while

the

attributes

are

time-dependent

The

temporal

nexttime

operator

is

interpreted

on

the

trajectory

-LRB-

a

sequence

of

generated

events

-RRB-

The

trajectory

has

been

viewed

as

a

linear

time

structure

The

above

two

definitions

are

consistent

-LRB-

well-defined

-RRB-

since

a

real

trajectory

is

one

of

all

the

possible

trajectories

that

is

a

real

trajectory

given

by

E

is

also

an

element

of

-LRB-

EVT

-RRB-

All

the

following

definitions

are

consistent

for

the

same

sake

Definition

-LRB-

Interpretation

of

transitional

formulae

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

interpretation

structure

I

-LRB-

EVT

M

E

-RRB-

for

ss

a

classification

and

an

assignment

A

for

we

define

for

each

transi

tional

formula

A

a

mapping

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

EVT

-RRB-

as

follows

ffl

A

is

or

A

or

-LRB-

B

C

-RRB-

As

usual

ffl

A

is

of

the

form

-LSB-

e

-RSB-

B

if

e

BH

then

-LSB-

-LSB-

-LSB-

e

-RSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

e

-RRB-

if

e

sn

i

then

-LSB-

-LSB-

-LSB-

e

-LRB-

tn

-RRB-

-RSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

e

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

-RRB-

if

e

MY

-LSB-

DH

then

-LSB-

-LSB-

-LSB-

e

-RSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

e

-RRB-

if

e

sn

i

-LSB-

sn

i

then

-LSB-

-LSB-

-LSB-

e

-LRB-

tn

-RRB-

-RSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

e

-LRB-

-LSB-

-LSB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LSB-

-LSB-

tn

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-RRB-

-RRB-

ffl

A

is

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

if

there

is

a

term

t

-LRB-

containing

no

attribute

symbols

-RRB-

of

sort

s

such

that

-LSB-

-LSB-

B

-LRB-

t

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

-LRB-

if

s

is

event

t

can

not

be

a

birth

event

term

-RRB-

then

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

else

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

Comments

on

the

interpretation

of

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

The

term

t

is

required

not

containing

any

attribute

symbols

in

the

interpretation

of

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

The

reason

is

that

our

variables

denote

only

state-independent

values

so

that

-LRB-

-LSB-

e

-RSB-

x

-RRB-

-LRB-

x

-RRB-

for

example

is

valid

for

any

variable

x

-LRB-

x

Nat

-RRB-

:-LRB-

-LRB-

-LSB-

e

-RSB-

x

-RRB-

-LRB-

x

-RRB-

-RRB-

is

not

satisfiable

If

t

were

allowed

to

contain

attribute

symbols

-LRB-

x

Nat

-RRB-

:-LRB-

-LRB-

-LSB-

e

-RSB-

x

-RRB-

-LRB-

x

-RRB-

-RRB-

would

be

satisfiable

It

is

still

the

case

in

temporal

logic

-LSB-

-RSB-

Note

that

the

term

t

still

needs

interpretation

into

a

value

since

it

is

within

the

scope

of

interpretation

notation

-LSB-

-LSB-

-RSB-

-RSB-

I

A

If

that

is

not

a

term

t

but

a

value

v

instead

v

must

be

kept

out

of

the

scope

of

-LSB-

-LSB-

-RSB-

-RSB-

I

A.

Strictly

speaking

the

interpretation

of

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

should

go

like

this

Let

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

be

the

unary

relation

i.e.

a

subset

of

s

If

it

is

not

empty

then

-LSB-

-LSB-

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

else

-LSB-

-LSB-

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

If

s

is

sort

event

t

can

not

be

a

birth

event

term

The

reason

is

that

birth

events

and

other

events

have

different

nature

and

event

variables

are

used

to

denote

only

modify

and

death

events

See

the

following

interpretation

of

OCC

-LRB-

e

-RRB-

Definition

-LRB-

Interpretation

of

atoms

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

interpretation

structure

I

-LRB-

EVT

M

E

-RRB-

for

ss

a

classification

and

an

assignment

A

for

we

define

for

each

atom

A

a

mapping

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

as

follows

ffl

A

is

a

transitional

formula

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

E

-LRB-

i

-RRB-

-RRB-

ffl

A

is

As

usual

ffl

A

is

OCC

-LRB-

e

-RRB-

if

e

is

a

birth

event

term

then

-LSB-

-LSB-

OCC

-LRB-

e

-RRB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

iff

E

-LRB-

i

-RRB-

-LSB-

-LSB-

e

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

else

-LSB-

-LSB-

OCC

-LRB-

e

-RRB-

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

iff

E

-LRB-

i

-RRB-

-LSB-

-LSB-

e

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

Note

that

-LSB-

-LSB-

e

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

must

be

a

generated

event

according

to

Definition

and

Definition

Let

a

lifecycle

of

an

object

be

hb

i

where

b

is

a

generated

birth

event

and

ei

is

a

generated

modify

or

death

event

Then

E

-LRB-

-RRB-

b

E

-LRB-

-RRB-

E

-LRB-

-RRB-

And

let

event

terms

b

be

interpreted

as

b

respectively

Thus

-LSB-

-LSB-

OCC

-LRB-

b

-RRB-

-RSB-

-RSB-

I

A

-LRB-

-RRB-

-LSB-

-LSB-

OCC

-LRB-

-RRB-

-RSB-

-RSB-

I

A

-LRB-

-RRB-

-LSB-

-LSB-

OCC

-LRB-

-RRB-

-RSB-

-RSB-

I

A

-LRB-

-RRB-

Notice

the

difference

of

interpretation

between

birth

events

and

other

events

We

should

stress

that

only

one

birth

event

is

allowed

in

a

lifecycle

of

an

object

Definition

-LRB-

Interpretation

of

formulae

-RRB-

Given

a

signature

ss

-LRB-

S

ff

-RRB-

an

interpretation

structure

I

-LRB-

EVT

M

E

-RRB-

for

ss

a

classification

and

an

assignment

A

for

we

define

for

each

formula

A

a

mapping

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

as

follows

ffl

A

is

a

trajectory-based

atom

see

the

above

definition

ffl

A

is

B

or

-LRB-

B

C

-RRB-

As

usual

ffl

A

is

B

If

E

is

totally

defined

everywhere

on

natural

numbers

then

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

any

i

otherwise

let

m

be

the

greatest

natural

number

such

that

E

-LRB-

m

-RRB-

is

defined

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

i

m

and

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

m

-RRB-

for

i

m.

ffl

A

is

B

B

C

If

E

is

defined

everywhere

on

natural

numbers

then

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

iff

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

every

j

-LRB-

i

j

k

-RRB-

where

k

i

k

is

the

smallest

natural

number

such

that

-LSB-

-LSB-

C

-RSB-

-RSB-

I

A

-LRB-

k

-RRB-

If

there

is

no

such

n

that

-LSB-

-LSB-

C

-RSB-

-RSB-

I

A

-LRB-

n

-RRB-

then

k

is

infinitely

great

If

E

is

defined

up

to

m

on

the

natural

numbers

then

for

i

m

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

iff

-LSB-

-LSB-

B

-RSB-

-RSB-

I

A

-LRB-

j

-RRB-

for

every

j

-LRB-

i

j

k

-RRB-

where

k

i

k

is

the

smallest

natural

number

such

that

-LSB-

-LSB-

C

-RSB-

-RSB-

I

A

-LRB-

k

-RRB-

-LRB-

If

there

is

no

such

n

i

n

m

that

-LSB-

-LSB-

C

-RSB-

-RSB-

I

A

-LRB-

n

-RRB-

then

k

m

-RRB-

And

for

i

m

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

-LSB-

-LSB-

A

-RSB-

-RSB-

I

A

-LRB-

m

-RRB-

ffl

A

is

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

As

usual

Interpretations

of

other

derived

operators

such

as

can

be

derived

Note

that

if

m

is

the

largest

number

such

that

E

is

defined

then

the

interpretation

of

any

term

or

formula

at

time

instant

i

-LRB-

i

m

-RRB-

is

the

same

as

that

at

m.

Definition

-LRB-

Validity

and

satisfiability

-RRB-

Let

ss

-LRB-

S

ff

-RRB-

be

a

signature

a

classification

F

a

formula

over

ss

and

I

-LRB-

EVT

M

E

-RRB-

an

interpretation

structure

for

ss

ffl

F

is

said

to

be

valid

in

I

denoted

by

I

j

F

iff

-LSB-

-LSB-

F

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

for

every

assignment

A

for

and

every

i

For

the

transitional

logic

If

F

is

a

transitional

formula

over

ss

and

then

we

define

I

j

F

iff

-LSB-

-LSB-

F

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

for

every

assignment

A

for

and

every

y

-LRB-

EVT

-RRB-

ffl

F

is

said

to

be

valid

denoted

by

j

F

iff

J

j

F

for

every

interpretation

structure

J

ffl

F

is

said

to

be

satisfied

in

I

and

A

if

there

is

an

i

such

that

-LSB-

-LSB-

F

-RSB-

-RSB-

I

A

-LRB-

i

-RRB-

For

the

transitional

logic

If

F

is

transitional

F

is

said

to

be

satisfied

in

I

and

A

if

there

is

a

y

-LRB-

EVT

-RRB-

such

that

-LSB-

-LSB-

F

-RSB-

-RSB-

I

A

-LRB-

y

-RRB-

ffl

F

is

said

to

be

satisfiable

if

there

is

an

interpretation

structure

J

and

an

assignment

A

such

that

F

is

satisfied

in

J

and

A

It

is

easy

to

show

the

following

lemma

Lemma

A

formula

A

is

valid

iff

A

is

not

satisfiable

So

if

we

want

to

prove

j

A

we

can

instead

prove

that

A

is

not

satisfiable

In

the

following

by

saying

that

a

set

of

formulae

Ang

is

valid

we

mean

An

is

valid

and

by

saying

that

Ang

is

satisfiable

we

mean

An

is

satisfiable

Lemma

if

A

is

satisfiable

then

fl

A

is

also

satisfiable

If

A

B

is

satisfiable

then

-LRB-

A

B

-RRB-

is

also

satisfiable

if

-LRB-

A

B

B

-RRB-

is

satisfiable

then

at

least

one

of

B

fl

-LRB-

A

B

B

-RRB-

and

B

A

is

also

satisfiable

If

-LRB-

A

B

B

-RRB-

is

satisfiable

then

at

least

one

of

B

and

A

-LRB-

A

B

B

-RRB-

is

also

satisfiable

If

-LRB-

A

C

-LRB-

B

A

-RRB-

-RRB-

is

satisfiable

then

A

-LRB-

B

B

C

-RRB-

is

also

satisfiable

If

An

is

satisfiable

then

An

is

also

satisfiable

This

lemma

can

be

proved

by

the

definition

of

the

satisfiability

The

following

lemma

concerns

the

satisfiability

of

the

transitional

formulae

Lemma

if

-LSB-

e

-RSB-

A

is

satisfiable

then

-LSB-

e

-RSB-

A

is

also

satisfiable

If

-LSB-

e

-RSB-

A

-LSB-

e

-RSB-

B

is

satisfiable

then

-LSB-

e

-RSB-

-LRB-

A

B

-RRB-

is

also

satisfiable

If

-LSB-

e

-RSB-

-LSB-

e

-RSB-

An

is

satisfiable

then

An

is

also

satisfiable

This

lemma

is

very

similar

to

the

clauses

-LRB-

-RRB-

-LRB-

-RRB-

and

-LRB-

-RRB-

of

Lemma

In

fact

an

occurrence

of

an

event

implies

a

lapse

of

a

time

unit

Now

suppose

that

all

the

event

generator

symbols

except

birth

generator

symbols

be

listed

as

en

If

an

event

is

known

to

have

happened

the

event

must

be

among

all

the

events

generated

by

en

Thus

we

can

prove

the

following

lemma

Lemma

If

a

formula

-LRB-

x

event

-RRB-

A

-LRB-

x

-RRB-

is

valid

in

an

interpretation

structure

I

then

-LRB-

-RRB-

A

-LRB-

-LRB-

-RRB-

-RRB-

-LRB-

pn

-RRB-

A

-LRB-

en

-LRB-

-RRB-

-RRB-

is

also

valid

in

I

where

en

MY

-LSB-

DH

all

the

event

generator

symbols

except

birth

generator

symbols

By

-LRB-

pk

-RRB-

A

-LRB-

ek

-LRB-

-RRB-

-RRB-

we

mean

that

all

the

parameters

in

ek

-LRB-

-RRB-

are

existentially

quantified

Note

that

our

event

generators

are

finite

In

general

an

event

generator

can

generate

an

infinite

number

of

events

That

is

why

we

want

to

existentially

quantify

all

the

parameters

of

an

event

term

All

the

above

lemmas

can

help

understand

and

establish

the

soundness

of

our

tableau

method

Tableau

method

In

order

to

prove

whether

a

formula

is

a

property

of

an

object

some

reasoning

methods

are

needed

General

speaking

six

reasoning

methods

for

modal

logics

are

known

-LRB-

-RRB-

Translation

deduction

First

map

a

modal

logical

language

into

a

simpler

logical

language

such

as

first-order

language

and

then

use

some

corresponding

automatic

methods

such

as

resolution

-LRB-

-RRB-

Semantic

diagrams

A

formula

is

valid

iff

it

is

true

in

every

state

in

every

structure

If

there

is

a

structure

in

which

there

is

a

state

such

that

the

formula

is

not

true

in

this

state

the

formula

is

not

valid

If

there

is

not

such

a

structure

the

formula

is

valid

The

semantic

diagram

method

is

very

similar

to

semantic

tableaux

-LSB-

-RSB-

-LRB-

-RRB-

Axiomatic

systems

In

an

axiomatic

system

a

proof

is

a

sequence

of

formulae

in

which

each

formula

is

either

an

axiom

or

a

result

of

applying

an

inference

rule

to

some

previous

formulae

in

the

same

sequence

-LSB-

-RSB-

-LRB-

-RRB-

Natural

deduction

In

a

natural

deduction

system

a

proof

is

a

sequence

of

lines

-LRB-

sequents

-RRB-

-LSB-

-RSB-

presented

a

Gentzen-type

system

for

verification

in

conceptual

modelling

In

constructing

natural

deduction

systems

of

temporal

logic

more

concepts

of

entailment

have

been

used

-LSB-

-RSB-

-LRB-

-RRB-

Modal

resolution

The

classical

resolution

rule

is

applied

to

a

set

of

modal

formulae

in

some

modal

contexts

-LSB-

-RSB-

In

addition

some

other

rules

are

needed

for

combining

the

modal

contexts

recursively

For

example

resolving

on

two

formulae

-LRB-

-LRB-

-RRB-

C

-RRB-

and

-LRB-

-RRB-

a

resolvent

-LRB-

-LRB-

B

D

-RRB-

C

-RRB-

can

be

obtained

by

use

of

a

modal

resolution

rule

But

-LRB-

-LRB-

A

B

-RRB-

C

-RRB-

and

-LRB-

A

D

-RRB-

can

not

be

resolved

-LRB-

-RRB-

Tableau

method

A

formula

is

not

satisfiable

if

it

is

not

true

in

any

state

in

any

structure

If

there

is

a

structure

in

which

there

is

a

state

such

that

the

formula

is

true

in

this

state

then

the

formula

is

satisfiable

If

we

can

not

find

such

a

structure

the

formula

is

not

satisfiable

If

a

formula

is

not

satisfiable

its

negation

is

valid

The

axiomatic

system

is

suitable

for

theoretical

discussion

The

other

five

methods

concern

the

question

of

automated/semi-automated

decision

for

modal

logic

All

of

them

work

for

modal

reasoning

But

which

is

the

best

one

It

is

very

hard

to

judge

for

modal

logics

It

seems

to

us

there

are

three

possible

answers

natural

deduction

method

resolution

based

method

and

tableau

method

The

natural

deduction

system

can

be

easily

mechanized

as

a

proof

checker

or

interactive

computer

theorem-proving

system

like

Edinburgh

LCF

-LSB-

-RSB-

and

INCAPS

-LSB-

-RSB-

An

interactive

theorem-proving

system

can

also

help

develop

a

proof

by

use

of

the

LCF

tactic/tactical

techniques

But

this

method

is

only

semi-automatic

The

resolution

method

is

very

efficient

for

first-order

logic

since

there

is

only

one

resolution

rule

However

if

we

extend

the

resolution

rule

for

modal

reasoning

we

will

get

quite

a

few

so-called

resolution

rules

At

each

step

we

have

to

scan

the

forms

of

the

formulae

and

select

a

suitable

rule

to

resolve

or

simplify

The

pioneering

work

on

resolution

based

method

for

normal

modal

logic

and

temporal

logic

can

be

found

in

-LSB-

-RSB-

In

order

to

reason

about

objects

much

more

resolution

and

simplification

rules

will

be

needed

in

addition

to

those

presented

in

-LSB-

-RSB-

since

four

kinds

of

behaviour

are

involved

and

the

logical

language

is

more

complicated

than

before

What

is

more

the

expected

unification

is

not

so

simple

-LRB-

thus

not

so

fast

-RRB-

as

that

for

first-order

logic

since

modal

terms

have

been

involved

It

is

not

our

intention

to

debate

on

which

method

is

best

for

object

verification

in

this

paper

Instead

we

will

report

our

work

on

a

tableau

method

The

tableaux

are

designed

as

a

strategy

for

showing

that

a

given

finite

set

of

formulae

is

not

satisfiable

Our

tableau

method

is

a

development

and

extension

of

the

tableau

method

for

first-order

logic

The

basic

idea

is

Let

F

be

a

finite

set

of

formulae

to

be

proved

unsatisfiable

If

it

is

satisfiable

we

can

decompose

it

into

a

group

of

sets

of

formulae

in

which

at

least

one

set

of

formulae

must

be

also

satisfiable

If

no

set

of

formulae

is

satisfiable

then

F

is

not

satisfiable

The

decision

procedure

based

on

the

tableau

method

is

very

simple

and

easy

to

understand

In

the

following

all

the

terms

and

formulae

are

defined

on

a

given

signature

and

classification

The

multiple

signatures

for

a

set

of

objects

and

the

logical

language

on

them

are

not

considered

in

this

paper

A

review

of

first-order

tableaux

First-order

tableaux

are

designed

as

a

strategy

for

showing

that

a

given

finite

set

of

first-order

formulae

is

not

satisfiable

A

first-order

tableau

is

a

tree

whose

root

is

associated

with

a

finite

set

of

first-order

formulae

to

be

proved

unsatisfiable

The

terminologies

about

tree

are

used

e.g.

root

node

-LRB-

or

root

-RRB-

interior

node

leaf

node

-LRB-

or

leaf

-RRB-

parent

node

-LRB-

or

parent

-RRB-

child

node

-LRB-

or

child

-RRB-

branch

In

the

following

by

saying

a

node

is

satisfiable

we

mean

that

the

set

of

the

formulae

on

it

are

satisfiable

and

by

saying

a

branch

is

satisfiable

we

mean

that

the

set

of

the

formulae

on

all

the

nodes

of

the

branch

are

satisfiable

Let

F

be

a

finite

set

of

first-order

formulae

to

be

proved

unsatisfiable

The

tableaux

can

be

constructed

step

by

step

by

the

following

decision

procedure

Step

To

have

a

node

associated

with

F

the

set

of

formulae

to

be

proved

unsatisfiable

Step

To

check

whether

the

root

is

closed

A

leaf

node

is

said

to

be

closed

if

there

are

two

formulae

B

and

B

on

the

branch

from

the

root

to

the

leaf

An

interior

node

is

said

to

be

closed

if

all

its

children

nodes

are

closed

A

root

is

said

to

be

closed

if

all

its

children

are

closed

If

the

root

is

closed

then

stop

and

say

the

current

tableau

-LRB-

tree

-RRB-

is

a

confutation

of

F

To

confute

F

is

to

construct

such

a

confutation

of

F

If

the

root

is

not

closed

then

go

on

to

the

next

step

Step

To

expand

the

tableau

into

a

new

one

by

use

of

the

following

rules

The

new

tableau

will

have

all

the

nodes

of

the

old

one

plus

some

new

nodes

generated

by

application

of

the

rules

If

no

rules

are

applicable

then

stop

and

say

there

is

no

confutation

of

F

The

rules

-LRB-

called

first-order

tableau

rules

-RRB-

are

-LRB-

:-RRB-

If

there

is

a

formula

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fAg

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

A

B

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

two

new

nodes

associated

with

f

Ag

and

fBg

respectively

as

children

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

A

B

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fA

Bg

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

x

s

-RRB-

A

-LRB-

x

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fA

-LRB-

t

-RRB-

g

as

a

child

of

N

can

be

added

where

t

is

a

term

of

sort

s

not

appearing

in

any

formula

on

the

branch

from

the

root

to

the

leaf

N

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

x

s

-RRB-

A

-LRB-

x

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

A

-LRB-

t

-RRB-

g

as

a

child

of

N

can

be

added

where

t

is

any

term

of

sort

s

The

following

inequality

rules

are

also

admitted

if

the

first-order

language

includes

inequality

-LRB-

thus

equality

also

admitted

-RRB-

-LRB-

Ref

-RRB-

A

new

node

associated

with

ft

tg

or

ft

tg

as

a

child

of

N

can

be

added

to

any

branch

from

the

root

to

a

leaf

N

-LRB-

Trans

-RRB-

If

there

are

two

formulae

and

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

as

a

child

of

N

can

be

added

-LRB-

SF

-RRB-

If

there

are

formulae

t

tn

t

n

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ff

-LRB-

tn

-RRB-

f

-LRB-

t

t

n

-RRB-

g

as

a

child

of

N

can

be

added

where

f

sn

i

s

and

tn

are

terms

of

sort

sn

respectively

-LRB-

SP

-RRB-

If

there

are

formulae

t

tn

t

n

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fF

-LRB-

tn

-RRB-

F

-LRB-

t

t

n

-RRB-

g

as

a

child

of

N

can

be

added

where

F

-LRB-

tn

-RRB-

is

a

formula

and

tn

are

terms

of

sort

sn

respectively

We

can

represent

the

above

rules

for

example

-LRB-

:-RRB-

and

-LRB-

-RRB-

schematically

as

follows

where

-LRB-

n

-RRB-

-LRB-

m

-RRB-

-LRB-

-RRB-

and

-LRB-

-RRB-

serve

as

numbers

-LRB-

identities

-RRB-

of

the

formulae

in

the

tableau

-LRB-

n

-RRB-

-LRB-

:-RRB-

and

-LRB-

n

-RRB-

-LRB-

-RRB-

serve

as

justifications

of

the

new

nodes

respectively

Justifications

tell

how

the

nodes

are

obtained

The

rules

-LRB-

:-RRB-

-LRB-

-RRB-

and

-LRB-

-RRB-

are

propositional

tableau

rules

Sometimes

we

represent

a

set

of

formulae

Ang

into

An

for

convenience

Based

on

these

tableau

rules

we

can

have

more

derived

first-order

tableau

rules

such

as

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

and

-LRB-

-RRB-

The

reader

is

referred

to

-LSB-

-RSB-

for

more

discussions

on

first-order

tableaux

The

decision

procedure

based

on

the

first-order

tableau

rules

is

not

so

efficient

as

that

based

on

the

resolution

principle

for

first-order

logic

The

main

reason

is

that

at

each

step

of

the

tableau

method

all

the

formulae

need

to

be

scanned

and

a

suitable

tableau

rule

must

be

picked

out

while

only

one

-LRB-

resolution

-RRB-

rule

is

needed

in

the

resolution

method

for

first-order

logic

However

once

they

are

extended

for

modal

logic

both

the

tableau

method

and

the

resolution-based

method

have

to

scan

the

formulae

and

select

the

suitable

rule

for

the

next

action

Propositional

temporal

tableaux

Propositional

temporal

tableaux

are

designed

to

confute

a

set

of

propositional

temporal

formulae

It

is

a

basis

of

the

first-order

temporal

tableaux

To

confute

a

set

of

propositional

temporal

formulae

is

to

construct

a

set

of

propositional

temporal

tableaux

and

define

some

dependency

relations

on

them

Let

F

be

a

set

of

propositional

temporal

formulae

to

be

proved

unsatisfiable

The

tableaux

for

F

can

be

constructed

by

use

of

the

propositional

tableau

rules

and

the

following

ones

all

called

propositional

temporal

tableau

rules

-LRB-

fl

-RRB-

If

there

is

a

formula

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ffl

Ag

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

A

B

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ffl

-LRB-

A

B

-RRB-

g

as

a

child

of

N

can

be

added

-LRB-

B

-RRB-

If

there

is

a

formula

-LRB-

ABB

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

two

new

nodes

associated

with

f

B

Ag

and

f

B

fl

-LRB-

ABB

-RRB-

g

respectively

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

ABB

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

two

new

nodes

associated

with

fBg

and

fA

-LRB-

ABB

-RRB-

g

respectively

as

children

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

A

-LRB-

C

-LRB-

B

A

-RRB-

-RRB-

-RRB-

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fA

-LRB-

BBC

-RRB-

g

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

An

are

all

the

formulae

of

form

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

then

it

is

allowed

to

construct

a

new

tableau

T

with

the

root

associated

with

Ang

and

mark

that

N

is

dependent

on

T

Closed

Node

A

node

is

said

to

be

closed

if

it

satisfies

one

of

the

following

conditions

ffl

A

leaf

is

said

to

be

closed

if

there

are

two

formulae

B

and

B

on

the

branch

from

the

root

to

the

leaf

ffl

An

interior

node

is

said

to

be

closed

if

all

its

children

are

closed

ffl

A

root

is

said

to

be

closed

if

all

its

children

are

closed

ffl

A

node

is

closed

if

it

is

dependent

on

another

tableau

T

and

the

root

of

T

is

closed

All

the

above

rules

are

syntactical

Different

from

the

semantical

diagram

method

-LSB-

-RSB-

our

syntactical

tableau

method

does

not

make

any

use

of

the

knowledge

of

semantics

A

tableau

rule

is

said

to

be

sound

iff

if

-LRB-

the

set

of

all

the

formulae

on

-RRB-

a

branch

from

the

root

to

a

leaf

is

satisfiable

then

-LRB-

the

set

of

all

the

formulae

on

-RRB-

at

least

one

of

the

new

branches

obtained

by

applying

the

rule

is

also

satisfiable

or

if

-LRB-

the

set

of

all

the

formulae

on

-RRB-

a

branch

from

the

root

to

a

node

N

is

satisfiable

and

N

is

dependent

on

a

new

tableau

with

the

root

R

then

-LRB-

the

set

of

all

the

formulae

on

-RRB-

R

is

also

satisfiable

Theorem

-LRB-

Soundness

-RRB-

All

the

above

propositional

temporal

tableau

rules

are

sound

in

the

following

sense

-LRB-

-RRB-

if

a

branch

from

the

root

to

a

leaf

is

satisfiable

then

at

least

one

of

the

new

branches

obtained

by

applying

the

rule

is

also

satisfiable

or

-LRB-

-RRB-

if

a

branch

from

the

root

to

a

node

N

is

satisfiable

and

N

is

dependent

on

a

new

tableau

with

the

root

R

then

R

is

also

satisfiable

This

theorem

can

be

proved

by

extending

Lemma

For

example

the

clause

-LRB-

-RRB-

of

Lemma

can

be

extended

to

if

Q

-LSB-

f

Ag

is

satisfiable

where

Q

is

a

set

of

formulae

then

Q

-LSB-

f

A

fl

Ag

is

also

satisfiable

The

clauses

-LRB-

-RRB-

to

-LRB-

-RRB-

of

Lemma

can

be

extended

in

a

similar

way

As

to

the

soundness

of

the

rule

-LRB-

-RRB-

note

that

if

Q

-LSB-

Ang

is

satisfiable

then

An

is

satisfiable

thus

An

is

also

satisfiable

according

to

the

clause

-LRB-

-RRB-

of

Lemma

It

can

also

be

shown

that

the

above

tableau

method

for

propositional

temporal

logic

is

complete

in

the

sense

that

if

a

formula

A

is

valid

then

A

can

be

confuted

Theorem

-LRB-

Completeness

-RRB-

The

above

tableau

method

for

propositional

temporal

logic

is

complete

in

the

sense

that

if

a

formula

A

is

valid

then

A

can

be

confuted

Proof

Sketch

The

proof

of

the

completeness

can

go

in

this

way

-LRB-

-RRB-

to

pick

up

an

axiomatic

system

of

propositional

temporal

logic

which

is

known

to

be

complete

in

the

sense

that

if

a

formula

is

valid

then

there

is

a

proof

in

the

axiomatic

system

-LRB-

-RRB-

to

construct

the

tableaux

for

all

its

axioms

-LRB-

-RRB-

If

An

j

B

is

an

inference

rule

then

construct

the

tableaux

for

the

formula

-LRB-

-LRB-

An

-RRB-

B

-RRB-

that

is

to

construct

the

tableaux

for

the

set

of

formulae

-LRB-

An

-RRB-

Bg

The

following

theorem

is

very

useful

in

practice

and

can

also

be

easily

proved

Theorem

Let

F

be

a

set

of

formulas

and

A

B

An

any

formula

Then

Given

a

confutation

of

F

we

can

confute

F

-LSB-

fAg

Given

a

confutation

of

F

-LSB-

fBg

we

can

confute

F

-LSB-

fA

A

Bg

Given

a

confutation

of

Ang

we

can

confute

Ang

Given

confutations

of

F

-LSB-

fBg

and

F

-LSB-

f

Bg

we

can

confute

F

Example

To

confute

f

B

A

-LRB-

A

C

-RRB-

Bg

the

tableaux

are

as

follows

The

root

of

tree

T

is

closed

We

mark

and

a

number

beneath

the

leaf

if

it

is

closed

The

number

is

used

to

represent

that

the

formula

with

the

number

and

a

formula

on

the

leaf

take

the

forms

B

and

B

respectively

Note

that

leaf

-LRB-

-RRB-

is

closed

since

it

is

dependent

on

T

and

the

root

of

T

is

closed

So

the

root

of

the

first

tree

is

also

closed

and

the

two

consecutive

trees

are

a

confutation

for

f

B

A

-LRB-

A

C

-RRB-

Bg

From

the

above

rules

and

the

definition

of

and

we

can

have

rules

-LRB-

derived

rules

-RRB-

about

and

as

shown

as

follows

-LRB-

-RRB-

If

there

is

a

formula

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

fA

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

two

new

nodes

associated

with

f

Ag

and

ffl

Ag

respectively

as

children

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

two

new

nodes

associated

with

fAg

and

respectively

as

children

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

A

fl

Ag

as

a

child

of

N

can

be

added

First-order

temporal

tableaux

The

construction

of

first-order

temporal

tableaux

is

similar

to

that

of

propositional

temporal

tableaux

The

first-order

tableau

rules

can

all

be

used

as

well

But

in

the

quantifier

rules

-LRB-

-RRB-

and

-LRB-

-RRB-

the

term

t

is

now

required

not

containing

any

attribute

symbols

See

the

comments

on

the

interpretation

of

-LRB-

x

s

-RRB-

B

-LRB-

x

-RRB-

for

the

reason

In

addition

to

the

first-order

tableau

rules

and

propositional

temporal

tableau

rules

we

admit

the

following

first-order

temporal

tableau

rules

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

x

s

-RRB-

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ffl

-LRB-

x

s

-RRB-

Ag

as

a

child

of

N

can

be

added

-LRB-

t

-RRB-

A

new

node

associated

with

f

-LRB-

c

-RRB-

cg

or

f

-LRB-

v

-RRB-

vg

or

f

-LRB-

-LRB-

f

-LRB-

tn

-RRB-

-RRB-

-RRB-

f

-LRB-

tn

-RRB-

g

as

a

child

of

N

can

be

added

to

any

branch

from

the

root

to

a

leaf

N

where

c

is

a

constant

v

is

a

variable

and

f

is

a

function

symbol

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

u

v

-RRB-

-LRB-

or

-LRB-

u

v

-RRB-

respectively

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LRB-

u

-RRB-

-LRB-

v

-RRB-

g

-LRB-

or

f

-LRB-

u

-RRB-

-LRB-

v

-RRB-

g

respectively

-RRB-

as

a

child

of

N

can

be

added

where

u

and

v

are

two

arbitrary

terms

-LRB-

-RRB-

If

there

is

a

formula

-LRB-

u

-RRB-

-LRB-

v

-RRB-

-LRB-

or

-LRB-

u

-RRB-

-LRB-

v

-RRB-

respectively

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ffl

-LRB-

u

v

-RRB-

g

-LRB-

or

ffl

-LRB-

u

v

-RRB-

g

respectively

-RRB-

as

a

child

of

N

can

be

added

where

u

and

v

are

two

arbitrary

terms

Closed

Node

The

same

as

that

for

propositional

temporal

tableaux

From

these

rules

we

can

have

more

derived

rules

For

example

the

following

rule

also

called

-LRB-

t

-RRB-

can

be

easily

derived

-LRB-

t

-RRB-

If

there

is

a

formula

-LRB-

u

-RRB-

v

-LRB-

or

-LRB-

u

-RRB-

v

respectively

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

-LRB-

u

v

-RRB-

-LRB-

or

-LRB-

u

v

-RRB-

respectively

-RRB-

as

a

child

of

N

can

be

added

where

v

is

a

term

containing

no

attribute

symbols

Another

useful

rule

is

substitution

rule

-LRB-

sub

-RRB-

If

there

are

two

formulae

u

v

and

A

-LRB-

u

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

A

-LRB-

v

u

-RRB-

as

a

child

of

N

can

be

added

where

u

and

v

are

two

terms

It

is

required

that

v

in

A

-LRB-

v

u

-RRB-

can

not

appear

within

the

scope

of

temporal

operators

The

soundness

of

the

above

first-order

temporal

tableau

rules

can

be

proved

from

the

definition

of

satisfiability

The

statement

of

the

soundness

of

the

first-order

temporal

tableau

rules

is

the

same

as

that

for

propositional

temporal

tableaux

Theorem

-LRB-

Soundness

-RRB-

All

the

above

first-order

temporal

tableau

rules

are

sound

in

the

following

sense

-LRB-

-RRB-

if

a

branch

from

the

root

to

a

leaf

is

satisfiable

then

at

least

one

of

the

new

branches

obtained

by

applying

the

rule

is

also

satisfiable

or

-LRB-

-RRB-

if

a

branch

from

the

root

to

a

node

N

is

satisfiable

and

N

is

dependent

on

a

new

tableau

with

the

root

R

then

R

is

also

satisfiable

Note

that

we

can

show

that

our

tableau

method

for

first-order

temporal

logic

is

relatively

complete

with

respect

to

the

axiomatic

system

of

firstorder

temporal

logic

with

the

same

temporal

operators

in

the

sense

that

if

a

formula

is

provable

in

the

axiomatic

system

then

its

negation

can

be

confuted

For

discussion

on

the

completeness

of

first-order

temporal

logic

the

reader

is

referred

to

-LSB-

-RSB-

It

should

be

stressed

that

rule

-LRB-

-RRB-

is

necessary

in

some

cases

For

example

if

we

know

-LRB-

u

v

-RRB-

and

-LRB-

v

w

-RRB-

we

can

have

-LRB-

u

w

-RRB-

But

note

that

it

is

possible

to

apply

the

rules

-LRB-

-RRB-

and

-LRB-

-RRB-

alternatively

and

repeatedly

so

that

the

proof

would

not

be

ended

The

practical

implementation

techniques

-LRB-

for

example

how

to

make

it

efficient

and

how

to

terminate

it

-RRB-

are

out

of

the

scope

of

this

paper

Transitional

tableaux

The

construction

of

transitional

tableaux

is

similar

to

that

of

propositional

temporal

tableaux

To

confute

a

finite

set

of

transitional

formulae

is

to

construct

a

set

of

transitional

tableaux

and

define

some

dependency

relations

on

them

A

transitional

tableau

can

be

constructed

by

the

following

transitional

tableau

rules

and

the

first-order

tableau

rules

Note

that

it

is

required

that

t

does

not

contain

any

attribute

symbols

in

rules

-LRB-

-RRB-

and

-LRB-

-RRB-

The

substitution

rule

-LRB-

sub

-RRB-

also

holds

but

the

term

substituted

is

required

not

appearing

within

the

scope

of

any

positional

operator

-LRB-

e

-RRB-

If

there

is

a

formula

-LSB-

e

-RSB-

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LSB-

e

-RSB-

Ag

as

a

child

of

N

can

be

added

-LRB-

e

-RRB-

If

there

is

a

formula

-LSB-

e

-RSB-

A

-LSB-

e

-RSB-

B

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LSB-

e

-RSB-

-LRB-

A

B

-RRB-

g

as

a

child

of

N

can

be

added

-LRB-

e

-RRB-

If

there

is

a

formula

-LRB-

x

s

-RRB-

-LSB-

e

-RSB-

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

and

x

does

not

appear

in

e

a

new

node

associated

withf

-LSB-

e

-RSB-

-LRB-

s

-RRB-

Ag

as

a

child

of

N

can

be

added

-LRB-

ext

-RRB-

If

there

is

a

formula

-LRB-

x

event

-RRB-

A

-LRB-

x

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

n

nodes

associated

with

f

-LRB-

-RRB-

A

-LRB-

-LRB-

-RRB-

-RRB-

g

f

-LRB-

pn

-RRB-

A

-LRB-

en

-LRB-

pn

-RRB-

-RRB-

g

respectively

as

children

of

N

can

be

added

where

en

MY

-LSB-

DH

all

the

event

generator

symbols

except

birth

generator

symbols

By

-LRB-

-RRB-

A

-LRB-

en

-LRB-

pk

-RRB-

-RRB-

we

mean

that

all

the

parameters

in

en

-LRB-

pk

-RRB-

are

existentially

quantified

-LRB-

et

-RRB-

A

new

node

associated

with

f

-LRB-

-LSB-

e

-RSB-

c

-RRB-

cg

or

f

-LRB-

-LSB-

e

-RSB-

v

-RRB-

vg

or

f

-LRB-

-LSB-

e

-RSB-

-LRB-

f

-LRB-

tn

-RRB-

-RRB-

-RRB-

f

-LRB-

-LSB-

e

-RSB-

-LSB-

e

-RSB-

tn

-RRB-

g

as

a

child

of

N

can

be

added

to

any

branch

from

the

root

to

a

leaf

N

where

c

is

a

constant

v

is

a

variable

and

f

is

a

function

symbol

-LRB-

-LSB-

e

-RSB-

-RRB-

If

there

is

a

formula

-LSB-

e

-RSB-

-LRB-

u

v

-RRB-

-LRB-

or

-LSB-

e

-RSB-

-LRB-

u

v

-RRB-

respectively

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LRB-

-LSB-

e

-RSB-

u

-RRB-

-LRB-

-LSB-

e

-RSB-

v

-RRB-

g

-LRB-

or

f

-LRB-

-LSB-

e

-RSB-

u

-RRB-

-LRB-

-LSB-

e

-RSB-

v

-RRB-

g

respectively

-RRB-

as

a

child

of

N

can

be

added

where

u

and

v

are

two

arbitrary

terms

-LRB-

-LSB-

e

-RSB-

-RRB-

If

there

is

a

formula

-LRB-

-LSB-

e

-RSB-

u

-RRB-

-LRB-

-LSB-

e

-RSB-

v

-RRB-

-LRB-

or

-LRB-

-LSB-

e

-RSB-

u

-RRB-

-LRB-

-LSB-

e

-RSB-

v

-RRB-

respectively

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LSB-

e

-RSB-

-LRB-

u

v

-RRB-

g

-LRB-

or

f

-LSB-

e

-RSB-

-LRB-

u

v

-RRB-

g

respectively

-RRB-

as

a

child

of

N

can

be

added

where

u

and

v

are

two

arbitrary

terms

-LRB-

e

-RRB-

If

-LSB-

e

-RSB-

-LSB-

e

-RSB-

An

are

all

the

formulae

of

form

-LSB-

e

-RSB-

A

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

it

is

allowed

to

start

the

construction

of

a

new

tableau

T

with

the

root

associated

with

the

set

of

formulae

Ang

and

mark

that

N

is

dependent

on

T

Closed

Node

The

same

as

that

for

propositional

temporal

tableaux

Note

that

the

rule

-LRB-

ext

-RRB-

depends

on

the

signature

Different

objects

have

different

signatures

Example

To

confute

f

-LSB-

-RSB-

-LRB-

a

b

-RRB-

-LSB-

-RSB-

A

-LSB-

-RSB-

B

-LSB-

-RSB-

A

-LRB-

-LRB-

s

-RRB-

-LSB-

-RSB-

-LRB-

a

x

-RRB-

-RRB-

-LSB-

-RSB-

-LRB-

a

b

-RRB-

g

the

tableaux

are

as

follows

The

tableaux

and

consist

of

only

one

closed

node

respectively

-LRB-

-RRB-

is

closed

since

it

is

dependent

on

-LRB-

-RRB-

is

also

closed

since

it

is

dependent

on

Note

that

-LRB-

-RRB-

is

also

dependent

on

another

tableau

with

fA

Bg

as

root

but

is

not

closed

The

soundness

theorem

is

the

same

as

before

However

the

completeness

has

not

been

known

to

us

Trajectory

tableaux

A

trajectory

tableau

is

a

mixture

of

a

first-order

temporal

tableau

and

a

transitional

tableau

To

confute

a

finite

set

of

trajectory-based

formulae

is

to

construct

a

set

of

trajectory

tableaux

and

define

some

dependency

relations

on

them

In

order

to

construct

trajectory

tableaux

in

addition

to

all

the

above

rules

we

can

use

the

following

rules

-LRB-

-RRB-

If

there

are

two

formulae

OCC

-LRB-

-RRB-

and

OCC

-LRB-

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

where

and

are

modify

or

death

events

a

new

node

associated

with

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

OCC

-LRB-

d

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

-LRB-

t

t

-RRB-

g

as

a

child

of

N

can

be

added

where

d

is

a

death

event

term

-LRB-

-RRB-

If

there

is

a

formula

OCC

-LRB-

b

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

ft

-LRB-

-LSB-

b

-RSB-

t

-RRB-

g

as

a

child

of

N

can

be

added

where

b

is

a

birth

event

term

-LRB-

-RRB-

If

there

is

a

formula

OCC

-LRB-

e

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

f

-LRB-

t

-RRB-

-LRB-

-LSB-

e

-RSB-

t

-RRB-

g

as

a

child

of

N

can

be

added

where

e

is

not

a

birth

event

term

-LRB-

-RRB-

If

there

are

two

formulae

-LRB-

t

-RRB-

u

and

-LRB-

x

event

-RRB-

-LRB-

OCC

-LRB-

x

-RRB-

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

withf

-LRB-

x

event

-RRB-

-LRB-

-LRB-

-LSB-

x

-RSB-

t

u

-RRB-

OCC

-LRB-

x

-RRB-

-RRB-

g

as

a

child

of

N

can

be

added

-LRB-

-RRB-

If

there

is

a

formula

OCC

-LRB-

d

-RRB-

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

a

new

node

associated

with

-LRB-

x

event

-RRB-

-LRB-

OCC

-LRB-

x

-RRB-

-RRB-

g

as

a

child

of

N

can

be

added

where

d

is

a

death

event

term

The

rule

-LRB-

-RRB-

says

that

it

is

forbidden

that

two

different

events

happen

at

the

same

time

We

should

point

out

that

it

is

allowed

for

two

different

events

to

happen

in

a

group

of

objects

The

behaviour

of

a

group

of

interacting

objects

can

be

captured

by

their

colimit

in

a

suitable

category

of

objects

-LSB-

-RSB-

which

is

why

we

restrict

ourselves

to

a

single

object

In

general

for

a

group

of

objects

-LRB-

-RRB-

is

not

sound

-LRB-

-RRB-

says

that

if

the

trajectory

is

finite

and

the

values

held

by

terms

will

remain

unchanged

after

the

time

instant

reached

by

a

death

event

Note

that

the

values

held

by

terms

at

the

time

instant

reached

by

a

death

event

are

subject

to

the

rule

-LRB-

-RRB-

-LRB-

-RRB-

says

that

the

birth

event

gives

a

startpoint

of

the

lifetime

of

objects

Note

that

birth

events

are

different

from

modify

or

death

events

in

the

sense

that

birth

events

do

not

lead

an

object

from

one

state

to

another

Their

effect

is

to

set

the

initial

state

of

the

object

Recall

the

interpretation

of

OCC

-LRB-

e

-RRB-

-LRB-

-RRB-

says

that

the

next

values

held

by

terms

are

affected

by

the

event

which

causes

a

state

transition

of

objects

at

that

time

The

lapse

of

a

time

unit

is

measured

by

an

occurrence

of

an

event

in

our

formalism

-LRB-

-RRB-

says

that

if

the

lifetime

of

objects

elapses

a

time

unit

then

there

must

exist

an

event

which

causes

a

state

transition

of

objects

-LRB-

-LRB-

x

event

-RRB-

-LRB-

OCC

-LRB-

x

-RRB-

-RRB-

-RRB-

means

that

some

-LRB-

modify

or

death

-RRB-

events

will

happen

sometimes

in

the

future

It

guarantees

that

the

object

has

not

died

yet

-LRB-

-RRB-

says

that

no

event

will

happen

after

a

death

event

happens

The

conditions

for

closed

nodes

and

the

soundness

theorem

are

the

same

as

those

for

propositional

temporal

tableaux

So

far

we

have

presented

the

tableau

rules

for

object

verification

In

the

following

section

we

will

give

a

simple

example

to

show

the

usefulness

of

our

tableau

method

Vending

machine

an

example

Now

let

us

consider

a

chocolate

vending

machine

as

an

example

to

show

the

usefulness

of

our

method

A

chocolate

vending

machine

can

be

considered

as

a

dynamic

entity

when

a

coin

is

inserted

it

will

give

a

chocolate

and

the

number

of

chocolates

kept

in

the

machine

will

decrease

by

one

when

the

trader

replenish

the

machine

with

n

chocolates

the

number

of

chocolates

kept

in

the

machine

will

increase

by

n

Such

a

chocolate

vending

machine

can

be

considered

as

an

object

We

suppose

that

a

chocolate

vending

machine

will

always

work

after

it

is

created

That

is

to

say

the

vending

machine

as

object

will

never

die

The

above-stated

chocolate

vending

machines

can

be

made

more

useful

in

the

market

by

allowing

multiple

categories

of

chocolates

with

different

prices

and

accept

coins

with

different

values

But

for

the

simplicity

of

illustration

we

only

consider

such

a

simple

chocolate

vending

machine

model

it

accepts

a

coin

and

gives

a

chocolate

The

other

models

can

be

easily

obtained

by

extending

this

model

The

chocolate

vending

machine

as

object

can

be

described

in

our

logical

language

The

chocolate

vending

machine

signature

ss

-LRB-

S

ff

-RRB-

where

Sorts

S

fNat

eventg

Function

symbols

Nat

Nat

Nat

Nat

Nat

Nat

Nat

Nat

Attribute

generator

symbols

coins

Nat

chocs

Nat

choc

on

stock

Nat

Event

generator

symbols

BH

create

MY

coin

insert

choc

output

replenish

Nat

There

is

no

death

event

for

the

vending

machine

In

the

above

signature

chocs

accounts

for

the

number

of

chocolates

that

have

already

been

sold

and

coins

for

the

number

of

coins

that

have

been

accepted

The

other

attribute

generator

and

event

generator

symbols

are

self-explanatory

From

the

above

signature

we

can

have

terms

and

formulae

according

to

the

definitions

of

terms

and

formulae

in

Section

The

chocolate

vending

machine

as

object

can

be

logically

specified

by

the

following

problem-specific

axioms

PSA

-LRB-

-RRB-

An

axiomatization

of

natural

numbers

-LRB-

-RRB-

The

effects

of

events

on

attributes

-LRB-

-LSB-

create

-RSB-

coins

-RRB-

-LRB-

-RRB-

-LRB-

-LSB-

create

-RSB-

chocs

-RRB-

-LRB-

-RRB-

-LRB-

-LSB-

create

-RSB-

choc

on

stock

-RRB-

-LRB-

-RRB-

-LRB-

-LSB-

coin

insert

-RSB-

coins

-RRB-

coins

-LRB-

-RRB-

-LRB-

-LSB-

coin

insert

-RSB-

chocs

-RRB-

chocs

-LRB-

-RRB-

-LRB-

-LSB-

coin

insert

-RSB-

choc

on

stock

-RRB-

choc

on

stock

-LRB-

-RRB-

-LRB-

-LSB-

choc

output

-RSB-

chocs

-RRB-

chocs

-LRB-

-RRB-

-LRB-

-LSB-

choc

output

-RSB-

choc

on

stock

-RRB-

choc

on

stock

-LRB-

-RRB-

-LRB-

-LSB-

choc

output

-RSB-

coins

-RRB-

coins

-LRB-

-RRB-

-LRB-

n

Nat

-RRB-

-LRB-

-LRB-

-LSB-

replenish

-LRB-

n

-RRB-

-RSB-

choc

on

stock

-RRB-

choc

on

stock

n

-RRB-

-LRB-

-RRB-

-LRB-

n

Nat

-RRB-

-LRB-

-LRB-

-LSB-

replenish

-LRB-

n

-RRB-

-RSB-

chocs

-RRB-

chocs

-RRB-

-LRB-

-RRB-

-LRB-

n

Nat

-RRB-

-LRB-

-LRB-

-LSB-

replenish

-LRB-

n

-RRB-

-RSB-

coins

-RRB-

coins

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Constraints

on

the

attributes

coins

-LRB-

-RRB-

choc

on

stock

-LRB-

-RRB-

chocs

-LRB-

-RRB-

-LRB-

x

Nat

-RRB-

-LRB-

-LRB-

x

coins

-RRB-

-LRB-

x

coins

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

x

Nat

-RRB-

-LRB-

-LRB-

x

chocs

-RRB-

-LRB-

x

chocs

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Constraints

on

the

life

cycles

OCC

-LRB-

coin

insert

-RRB-

-LRB-

chocs

coins

-RRB-

-LRB-

-RRB-

OCC

-LRB-

choc

output

-RRB-

-LRB-

chocs

coins

-RRB-

-LRB-

-RRB-

OCC

-LRB-

coin

insert

-RRB-

-LRB-

choc

on

stock

-RRB-

-LRB-

-RRB-

-LRB-

chocs

coins

-RRB-

OCC

-LRB-

choc

output

-RRB-

-LRB-

-RRB-

-LRB-

-RRB-

Equalities

on

events

-LRB-

coin

insert

choc

output

-RRB-

-LRB-

-RRB-

-LRB-

x

Nat

-RRB-

-LRB-

choc

output

replenish

-LRB-

x

-RRB-

-RRB-

-LRB-

-RRB-

-LRB-

x

Nat

-RRB-

-LRB-

replenish

-LRB-

x

-RRB-

coin

insert

-RRB-

-LRB-

-RRB-

We

should

point

out

that

the

axioms

of

-LRB-

-RRB-

are

actually

related

to

the

unique

name

assumptions

all

the

names

differ

by

their

syntactical

differences

Some

of

axioms

in

-LRB-

-RRB-

can

be

omitted

if

the

common-sense

inertia

law

related

to

the

so-called

frame

problem

is

adopted

Many

solutions

to

the

frame

problem

have

been

proposed

in

the

AI

field

For

the

sake

of

simplicity

in

this

example

-LRB-

and

this

paper

-RRB-

we

have

deliberately

avoided

discussions

on

the

unique

name

assumptions

and

the

common-sense

inertia

law

Let

F

be

a

formula

If

F

is

derivable

from

the

above

logical

description

of

the

chocolate

vending

machine

then

F

is

said

to

be

a

property

of

the

vending

machine

or

a

behaviour

of

the

vending

machine

Now

let

us

consider

for

example

the

following

simple

and

intuitive

property

A

chocolate

can

be

obtained

from

the

vending

machine

if

a

coin

is

inserted

This

property

can

be

formulated

as

-LRB-

P

-RRB-

OCC

-LRB-

coin

insert

-RRB-

-LRB-

n

Nat

-RRB-

-LRB-

-LRB-

chocs

n

-RRB-

-LRB-

chocs

n

-RRB-

-RRB-

In

order

to

prove

the

property

-LRB-

P

-RRB-

it

suffices

to

prove

the

following

set

is

not

satisfiable

-LRB-

PSA

-RRB-

-LRB-

P

-RRB-

g

where

-LRB-

PSA

-RRB-

is

the

set

of

formulae

included

in

and

Let

F

be

a

set

of

formulae

Ang

By

we

mean

A

set

of

formulae

Ang

can

also

be

denoted

by

An

in

this

paper

Combining

rule

-LRB-

-RRB-

and

rule

-LRB-

-RRB-

we

can

get

a

new

derived

rule

also

called

-LRB-

-RRB-

as

follows

-LRB-

-RRB-

If

An

are

all

the

formulae

of

forms

A

and

among

the

formulae

on

a

branch

from

the

root

to

a

leaf

N

then

it

is

allowed

to

construct

a

new

tableau

T

with

the

root

associated

with

An

Bmg

And

we

say

that

N

is

dependent

on

T

This

rule

will

be

used

in

the

tableaux

for

-LRB-

P

-RRB-

The

tableaux

for

-LRB-

P

-RRB-

are

shown

as

follows

The

above

proof

is

very

primitive

From

the

above

proof

we

can

see

that

at

every

step

it

is

possible

to

pick

up

a

rule

and

apply

it

to

the

same

formula

over

and

over

again

indefinitely

so

that

the

proof

would

be

never-ending

The

discussion

on

practical

implementation

questions

such

as

efficiency

and

termination

is

out

of

the

scope

of

this

paper

Our

tableau

method

provides

in

fact

a

decision

procedure

for

the

trajectory

logic

Concluding

remarks

An

object

is

understood

as

a

dynamic

entity

whose

attributes

can

be

observed

and

modified

through

occurrences

of

its

events

Only

the

events

declared

for

the

object

can

modify

its

attributes

called

locality

of

objects

or

no

collateral

effects

principle

The

values

of

the

attributes

give

states

of

the

object

With

the

occurrences

of

events

the

object

evolves

from

one

state

to

another

In

order

to

reason

about

such

an

object

we

have

presented

a

logical

language

and

a

tableau

method

The

logical

language

is

in

fact

a

mixture

of

a

temporal

language

and

a

transitional

language

An

object

can

be

described

by

a

set

of

formulae

based

on

its

signature

The

signature

is

composed

of

its

static

-LRB-

state-independent

-RRB-

component

and

its

state-dependent

component

The

static

component

provides

the

information

about

the

data

which

the

attributes

of

the

object

may

take

The

state-dependent

component

provides

information

about

the

attributes

of

the

object

These

attributes

can

change

with

the

occurrences

of

the

events

Different

objects

may

have

different

signatures

The

properties

to

be

proved

can

also

be

described

by

certain

formulae

based

on

the

same

signature

The

tableau

method

is

an

extension

and

a

development

of

first-order

tableau

method

Note

that

the

tableau

method

is

signature-dependent

in

the

sense

that

some

rules

-LRB-

for

example

rule

-LRB-

ext

-RRB-

-RRB-

depend

on

the

signature

To

confute

a

finite

set

of

formulae

is

to

construct

a

set

of

tableaux

and

define

some

dependency

relations

on

them

It

can

be

proved

that

our

tableau

method

is

sound

in

the

sense

that

if

a

branch

from

the

root

to

a

leaf

N

is

satisfiable

then

at

least

one

of

the

new

branches

obtained

by

applying

the

rules

is

also

satisfiable

or

if

a

branch

from

the

root

to

a

node

N

is

satisfiable

and

N

is

dependent

on

a

new

tableau

with

the

root

R

then

R

is

also

satisfiable

It

can

also

be

proved

that

the

set

of

propositional

temporal

tableau

rules

is

complete

for

propositional

temporal

logic

including

the

nexttime

operator

and

unless

operator

in

the

sense

that

if

a

propositional

temporal

formula

F

is

valid

then

F

can

be

confuted

However

the

set

of

the

trajectory

tableau

rules

is

not

complete

since

the

first-order

temporal

logic

can

not

be

finitely

and

completely

axiomatized

The

relative

completeness

with

respect

to

other

logical

systems

for

example

with

respect

to

that

in

-LSB-

-RSB-

can

be

proved

The

detailed

discussion

on

the

completeness

is

out

of

the

scope

of

this

paper

Based

on

the

tableau

method

a

decision

procedure

can

be

given

In

order

to

implement

this

procedure

some

practical

techniques

can

be

developed

For

example

some

criteria

can

be

given

in

order

to

determine

whether

or

not

a

formula

should

be

split

The

techniques

developed

with

the

propositional

tableaux

for

the

same

purpose

can

be

used

The

discussion

on

the

practical

implementation

techniques

was

not

given

in

this

paper

that

is

another

topic

Our

method

can

also

be

easily

extended

for

modal

languages

with

past

temporal

operators

and

temporal

terms

such

as

-LRB-

tBLb

-RRB-

and

-LRB-

tBM

b

-RRB-

For

the

same

purpose

the

resolution-based

method

can

be

used

As

to

the

first-order

logic

the

first-order

resolution

method

is

much

more

efficient

than

the

first-order

tableau

method

When

the

first-order

resolution

rule

is

extended

for

our

language

there

will

be

quite

a

few

rules

What

is

more

the

unification

algorithm

for

our

language

is

not

so

simple

as

that

for

first-order

language

since

the

modal

terms

have

been

involved

in

our

language

But

we

should

stress

that

it

is

not

our

opinion

that

the

tableau

method

has

been

known

to

be

better

than

the

resolution

based

method

for

object

verification

In

fact

the

detailed

comparison

has

not

been

done

yet

We

hope

to

report

our

work

on

the

resolution

based

method

for

object

verification

in

the

future

Acknowledgements

We

wish

to

thank

all

the

other

members

of

the

Project

at

INESC

Special

thanks

are

due

to

Prof.

Cristina

Sernadas

Dr.

Jos?e

Fiadeiro

and

Dr.

Jos?e

Carmo

for

the

useful

discussions

We

would

also

like

to

thank

the

anonymous

referees

for

their

useful

and

helpful

comments

The

work

of

Renwei

Li

was

supported

by

a

scholarship

of

the

Orient

Foundation

This

work

was

also

partially

supported

by

the

CEC

through

the

ESPRIT-II

BRA

No.

-LRB-

IS-CORE

-RRB-

References

-LSB-

-RSB-

M.

Abadi

Z.

Manna

Non-clausal

temporal

deduction

LNCS

Springer-Verlag

-LSB-

-RSB-

P.

America

Object-oriented

programming

A

theoretical

introduction

ESTCS

Bulletin

-LSB-

-RSB-

J.

L.

Bell

M.

Macttover

A

Course

in

Mathematical

Logic

Elsevier

Science

Publishers

B.

V.

-LSB-

-RSB-

U.

Dayal

K.

Dittrich

-LRB-

eds

-RRB-

Proceedings

of

the

International

Workshop

on

Object-oriented

Database

Systems

Pacific

Grove

Calif.

IEEE

New

York

-LSB-

-RSB-

O.-J

Dahl

B.

Myhrhaug

K.

Nygaard

SIMULA

Common

Base

Language

Norwegian

Computing

Centre

Oslo

-LSB-

-RSB-

E.

Dubois

Logical

support

for

reasoning

about

the

specification

and

the

elaboration

of

requirements

Proc

of

the

Role

of

Artificial

Intelligence

in

Databases

and

Information

Systems

Guangzhou

China

-LSB-

-RSB-

H.

D.

Ehrich

A.

Sernadas

Algebraic

implementation

of

objects

over

objects

Proc

of

REX

Workshop

on

Stepwise

Refinement

of

Distributed

Systems

Models

Formalisms

Correctness

Springer-Verlag

-LRB-

in

print

-RRB-

-LSB-

-RSB-

H.-D

Ehrich

A.

Sernadas

C.

Sernadas

From

data

types

to

object

types

J.

Information

Processing

and

Cybernetics

EIK

No.

-LSB-

-RSB-

P.

Enjalbert

L.

F.

Cerro

Modal

resolution

in

clausal

form

Theoretical

Computer

Science

-LSB-

-RSB-

J.

Fiadeiro

C?alculo

de

Objectos

e

Eventos

PhD

Dissertation

IST

Technical

University

of

Lisbon

Lisbon

-LSB-

-RSB-

J.

Fiadeiro

T.

Maibaum

Towards

formal

descriptions

of

objects

Technical

Report

Imperial

College

London

-LSB-

-RSB-

J.

Fiadeiro

T.

Maibaum

Temporal

Reasoning

over

Deontic

Specifications

J.

of

Logic

and

Computation

-LSB-

-RSB-

J.

Fiadeiro

T.

Maibaum

Describing

structuring

and

implementing

objects

Foundation

of

Object-Oriented

Languages

de

Bakker

de

Roever

and

Rozenberg

-LRB-

eds

-RRB-

Springer-Verlag

-LRB-

in

print

-RRB-

-LSB-

-RSB-

J.

Fiadeiro

A.

Sernadas

Logics

of

modal

terms

for

system

specification

J.

of

Logic

and

Computation

-LSB-

-RSB-

A.

Goldberg

D.

Robson

Smalltalk

The

Language

and

its

Implementation

Addison-Wesley

Reading

Mass.

-LSB-

-RSB-

Gordon

M.

J.

C.

Milner

R.

Wadsworth

C.

P.

Edinburgh

LCF

A

mechanised

logic

of

computation

LNCS

Springer-Verlag

-LSB-

-RSB-

S.

J.

Greenspan

A.

Borgida

J.

Mylopoulos

A

requirements

modeling

language

and

its

logic

Information

Systems

-LSB-

-RSB-

G.

E.

Hughes

M.

J.

Gresswell

An

Introduction

to

Modal

Logic

Methuen

and

co.

Ltd.

-LSB-

-RSB-

P.

Jeremeas

S.

Khosla

T.

Maibaum

A

modal

-LRB-

action

-RRB-

logic

for

requirements

specification

in

D.

Barnes

and

P.

Brown

eds.

Proc

Software

Engineering

IEEE

Computing

Series

Peter

Peregrinus

-LSB-

-RSB-

S.

Khosla

T.

Maibaum

M.

Sadler

Database

specification

in

T.

Steel

and

R.

Meersman

eds.

Database

Semantics

North-Holland

-LSB-

-RSB-

R.

Li

A

natural

deduction

system

of

temporal

logic

Journal

of

Computer

Science

and

Technology

ISSN

-LSB-

-RSB-

R.

Li

INCAPS

An

interactive

computer-aided

theorem

proving

system

The

Chinese

Computer

Journal

-LRB-

in

Chinese

-RRB-

-LSB-

-RSB-

R.

Li

A.

Sernadas

A

trajectory-based

logic

for

object

verification

INESC

report

Lisbon

-LSB-

-RSB-

Z.

Manna

A.

Pnueli

Verification

of

concurrent

programs

the

temporal

framework

in

R.

S.

Boyer

J.

S.

Moore

eds.

Correctness

Problem

in

Computer

Science

International

Lecture

Series

in

Computer

Science

Academic

Press

London

-LSB-

-RSB-

Z.

Manna

A.

Pnueli

Verification

of

concurrent

programs

Temporal

proof

principles

in

Logic

of

Programs

LNCS

Springer-Verlag

-LSB-

-RSB-

A.

Sernadas

H.-D

Ehrich

What

is

an

object

after

all

in

R.

Meersman

and

W.

Kent

eds.

Proc

Object-oriented

Databases

Analysis

Design

and

Construction

UK

-LSB-

-RSB-

A.

Sernadas

J.

Fiadeiro

C.

Sernadas

H.-D

Ehrich

Abstract

object

types

A

temporal

perspective

in

B.

Banieqbal

H.

Barringer

and

A.

Pnueli

eds.

Temporal

Logic

in

Specification

Springer-Verlag

-LSB-

-RSB-

A.

Sernadas

J.

Fiadeiro

C.

Sernadas

H.-D

Ehrich

The

Basic

Building

Blocks

of

Information

systems

in

E.

Falkenberg

and

P.

Lindgreen

eds.

Information

System

Concepts

North-Holland

-LSB-

-RSB-

C.

Sernadas

P.

Gouveia

and

A.

Lopes

Gentzen-type

System

for

verification

in

conceptual

modelling

and

knowledge

representation

INESC

report

Lisbon

-LSB-

-RSB-

A.Szalas

Concerning

the

semantic

consequence

relation

in

first-order

temporal

logic

Theoretical

Computer

Science

specification
tableaux
temporal logic
transitional logic
verification

conceptual modelling and behaviour
object-orientation