compiled on 8 December 2020

Generalising Kripke Semantics for QuantifiedModal Logics*

Wolfgang Schwarz

We turn now to what is arguably one of the least well behavedmodal languages ever proposed: first-order modal logic.

[Blackburn and van Benthem 2007]

Contents

1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Counterpart models . . . . . . . . . . . . . . . . . . . . . . . . 33 Substitution . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Logics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315 Logics with explicit substitution . . . . . . . . . . . . . . . . . . . 436 Correspondence. . . . . . . . . . . . . . . . . . . . . . . . . . 607 Canonical models . . . . . . . . . . . . . . . . . . . . . . . . . 708 Completeness . . . . . . . . . . . . . . . . . . . . . . . . . . 84

1 Introduction

Modal logic has outgrown its philosophical origins. What used to be the logic of possibilityand necessity has become topic-neutral, with applications ranging from the validation ofcomputer programs to the study of mathematical proofs.

Along the way, modal predicate logic has lost its role as the centre of investigation, tothe point that it is hardly mentioned in many textbooks. Indeed, propositional modallogic itself has emerged as a fragment of first-order predicate logic, with the domainof “worlds” playing the role of “individuals”. As emphasized in [Blackburn et al. 2001],the distinctive character of modal logic is not its subject matter, but its perspective.Statements of modal logic describe relational structures from the inside perspective ofa particular node. Modal predicate logic emerges as a somewhat cumbersome hybrid,combining an internal perspective on one class of objects (the domain of the modaloperators) with an external perspective on a possibly different class of objects (thedomain of quantification).

∗ These notes were mostly written in 2009–2012, and slightly polished in 2020.

Nevertheless, this hybrid perspective is useful and natural for many applications. Forexample, when reasoning about time, it is natural to take a perspective that is internalto the structure of times (so that what is true at one point may be false at another), butexternal to the structure of sticks and stones and people existing at the various times.

Standard Kripke semantics assumes that each “world” w is associated with a domainof “individuals” Dw that somehow exist relative to this world. Formulas like ∃x3Fx thatmix the two kind of quantification have a straightforward interpretation: ∃x3Fx is trueat w iff the individual domain of w contains an object that satisfies Fx at some worldaccessible from w.

While conceptually simple, and possibly adequate for certain applications, this approachhas some limitations. For example, it makes identity and distinctness non-contingent.If the domain of w contains two individuals x and y, then there can be no other pointfrom the perspective of which these two individuals are identical: ∀x∀y(x,y ⊃ 2x,y) isvalid. For some applications, this is not desirable.

More generally, Kripke semantics is inadequate to characterise a wide range of quantifiedmodal logics. A major strength of Kripke semantics in propositional modal logic is thatmany interesting logics are characterised by some class of Kripke frames. This changeswhen quantifiers are added. For example, all systems in between S4.3 and S5 then becomeincomplete (see [Ghilardi 1991]).

David Lewis [1968] once proposed an alternative to Kripke semantics that promises toovercome these limitations. Lewis’s key idea was that modal operators simultaneouslyshift the modal point of evaluation and the reference of singular terms. Informally,∃x3Fx is true at w iff the domain of w contains an individual for which there is acounterpart at some accessible point w′ that satisfies Fx.

Lewis also swapped the traditional, hybrid perspective of Kripke semantics for athoroughly internal perspective, where statements are evaluated not relative to worlds,but relative to individuals at worlds (see esp. [Lewis 1986: 230-235]). As a consequences,the ‘necessity of existence’, 2∃y(x=y), comes out valid, while basic distribution principlessuch as 2(A ∧B) ⊃ 2A become invalid (as noted e.g. in [Hazen 1979] and [Woollaston1994]).

Lewis’s internalist semantics has been scrutinised and extended by Silvio Ghilardi,Giancarlo Meloni, and Giovanna Corsi, who have shown that it has many useful andinteresting properties (see [Ghilardi and Meloni 1988], [Ghilardi and Meloni 1991],[Ghilardi 2001] [Corsi 2002], [Braüner and Ghilardi 2007: 591–616]). However, it goesagainst the traditional conception of modal predicate logic.In this essay, I will investigate a semantics that combines the hybrid perspective

of classical Kripke semantics with the idea that individuals are tracked across worldsby a counterpart relation. Since I will not assume that the domain of individuals atdifferent worlds need not be distinct, Kripke semantics emerges as the special case where

counterparthood is identity. As we will see, allowing for counterpart relations otherthan identity results in a fairly simple and intuitive framework that overcomes severalshortcomings of standard Kripke semantics.1

2 Counterpart models

We want to reason about some “words”, each of which is associated with some “individuals”that are assumed to exist at the relevant world, so that 3∃xFx is true at a world iffthere is some accessible world at which there is an individual satisfying Fx.A familiar choice point in Kripke semantics is whether we want to allow different

individuals to exist at different worlds. This question won’t be important in counterpartsemantics. But we face an analogous question: whether every individual at some worldshould have a counterpart at every other world (or at every accessible world).

If we allows for individuals without counterparts at accessible worlds, the next questionis what can be said about things that don’t exist. The alternatives are well-known fromfree logic. One option is that if x doesn’t exist at w, then every atomic predication Fxis false at w. This is known as a negative semantics. Alternatively, one may hold thatnon-existence is no bar to satisfying predicates, so that Fx may be true at some worldswhere x doesn’t exist and false at others. The extension of F at a world must thereforebe specified not only for things that exist at that world, but also for things that don’texist. This is known as a positive semantics. Both approaches are attractive for certainapplications, so I will explore them in tandem.2

In positive models, terms are never genuinely empty. Worlds are associated with aninner domain of individuals existing at that world, and an outer domain of individualswhich, although they don’t exist, may still fall in the extension of atomic predicates.Every individual at any world will have at least one counterpart at every accessible world,if only in the outer domain.

In negative models, we want to do without the somewhat ghostly outer domains. Whenwe shift the point of evaluation to a world where the value of x has no counterpart, theterm becomes empty, and we stipulate that Fx is always false. 3Fx will then also be

1My proposal is inspired by [Kutz 2000], which in turn is inspired by [Skvortsov and Shehtman 1993].([Kracht and Kutz 2002] summarizes the main results of [Kutz 2000] in English.) Some of the keyresults announced in [Kutz 2000] and [Kracht and Kutz 2002] are incorrect; these problems willbe repaired. I will also offer a model theory for negative free logics without outer domains, andfor languages with individual constants and object-language substitution operators. To incorporateindividual constants, Kracht and Kutz [2005] switch from counterpart semantics to what Schurz [2011]calls worldline semantics, where quantifiers range over functions from worlds to individuals; see also[Kracht and Kutz 2007].

2 There are also non-valent options on which atomic predications with empty terms are neither truenor false. The account I will develop is easy to adapt to this approach; see [Schwarz 2012].

false. For suppose 3Fx could be true while 3Fy is false, although x and y are bothempty. we would then have to introduce outer domains after all, so that the referent of xhas an F -counterpart while the referent of y does not.

Single-domain counterpart models therefore validate the following principles that arenot derivable from standard axioms and rules of negative free logic combined with thoseof the basic modal logic K:

(NA) ¬Ex ⊃ 2¬Ex,

(TE) x=y ⊃ 2(Ex ⊃ Ey).

Here Ex abbreviates ∃y(x= y). (NA) reflects the fact that non-existent objects don’thave any counterparts. (TE) says that if x is identical to y, and x has a counterpartat some accessible world, then y also has a counterpart at that world. If we had outerdomains, an individual could have some existing and some non-existing counterparts at aworld, which would render (TE) false.

We can, of course, offer counterpart models for negative modal predicate logics without(NA) and (TE). These are dual-domain models in which the extension of all predicates,including identity, is restricted to the inner domain. (NA) then requires that individualswhich only figure in the outer domain of a world never have counterparts in the innerdomain of another world. (TE) requires that if an individual in the inner domain of aworld has a counterpart in the inner domain of another world, then all its counterpartsat that world are in the inner domain. The two requirements are obviously independentand non-trivial. Hence the axioms (NA) and (TE) are independent of one another andof the standard principles of basic negative free logic combined with K.A further question in counterpart-theoretic accounts is whether we want to allow for

what Allen Hazen calls “internal relations” (see [Hazen 1979: 328–330], [Lewis 1986:232f.]). Suppose Queen Elizabeth II is necessarily the daughter of George VI. Doesthat mean that at every world, every counterpart of Elizabeth is the daughter of everycounterpart of George? Arguably not, assuming that we want to allow George andElizabeth to have multiple counterparts at some worlds. For example, consider a worldthat embeds two copies of the actual world, a “left” copy and a “right” copy. Plausibly,both Elizabeth II and George VI have two counterparts in this world, but each of theElizabeth counterparts is only daughter of one of the George counterparts.To model this sort of situations, we need to allow for different ways of locating the

individuals from one world at another world. Formally, we will have multiple counterpartrelations. One relation will link Elizabeth and George to their counterparts in the leftcopy, another to their counterparts in the right copy. 2Gab will be true iff, on everycounterpart relation, all counterparts of a are G-related to all counterparts of b.3

3 [Hazen 1979] introduces models with multiple counterpart relations, but stipulates that each relation

Let’s define the two kinds of models. As usual, a model combines an abstract frameor structure with an interpretation of our language on that structure. The relevantstructures are defined as follows.

Definition 2.1 (Counterpart structure)A counterpart structure is a quintuple S = 〈W,R,U,D,K 〉, consisting of

1. a non-empty set W (of “points” or “worlds”),2. a binary (“accessibility”) relation R on W ,3. a (“outer domain”) function U that assigns to each w∈W a set Uw,4. a (“inner domain”) function D that assigns to each w∈W a set Dw ⊆ Uw,

and5. a (“counterpart-inducing”) function K that assigns to each pair of points〈w,w′ 〉 ∈ R a non-empty set Kw,w′ of binary (“counterpart”) relations fromUw × Uw′ ,

such that either (i) D = U , or (ii) all counterpart relations are “total” in the sensethat if C ∈ Kw,w′ , then for each d ∈ Uw there is a d′ ∈ Uw′ with dCd′. In case (i),S will be called a single-domain structure, in case (ii) it is a total structure.

(If all counterpart relations are total and D = U , the structure is both single-domainand total.)At first, the “counterpart-inducing function” with its associated many counterpart

relations may look unfamiliar. Think of this as constructed from a Lewisian counterpartrelation in two steps. First, we drop Lewis’s requirement of disjoint domains, so thatan individual can occur in the domain of many or all worlds. It is then not enoughto just specify which individuals are counterparts of other individuals. For example,d at w might have d′ as its only counterpart at w′, and it might have d′′ as its onlycounterpart at w′′, even though d′ also exists at w′′. Now is d′ a counterpart of d? Ineffect, counterparthood turns into a four-place relation between one individual at oneworld and another (or the same) individual at another (or the same) world. It provesconvenient to represent this by associating each pair of worlds with a “local” counterpartrelation between the individuals in the associated domains. In the second step, these localcounterpart relation give way to sets of relations in order to allow for internal relations.

is actually an injective function, in order to validate the necessity of identity and to get a traditionallogic for ‘actually’. Multiple counterpart relations are also used in [Kutz 2000] and [Kracht and Kutz2002]. It turns out that the introduction of multiple counterpart relations makes little difference tothe base logic. In particular, the logic of all positive or negative counterpart models is exactly thesame either way. However, multiple counterpart relations will help in the construction of canonicalmodels for stronger logics in section 7, where we will run into a form of Hazen’s “problem of internalrelations”.

The following terminology might help to make all this look more familiar. I will saythat in a given model, d′ at w′ is a counterpart of d at w iff there is a C ∈ Kw,w′ suchthat dCd′. Similarly, a pair of individuals 〈d′1, d′2 〉 at w′ is a counterpart of 〈d1, d2 〉 atw iff there is a C ∈ Kw,w′ such that d1Cd

′1 and d2Cd

′2. And so on for larger sequences.

(Note that an identity pair 〈d, d〉 at w has 〈d′1, d′2 〉 at w′ as counterpart iff there is aC ∈ Kw,w′ such that d is C-related to both d′1 and d′2.) As we will see, the interpretationof modal formulas can be spelled out directly in terms of this “counterpart relation”between sequences rather than the function Kw,w′ on which it is officially based.

That counterparthood should be extended to sequences is suggested in [Lewis 1983] and[Lewis 1986], in response to the problem of internal relations. In the present framework,counterparthood between sequences is a derivative notion. This has the advantage that itimmediately rules out some otherwise problematic possibilities. For example, it can neverhappen that a pair 〈d1, d2 〉 at w has 〈d′1, d′2 〉 at w′ as counterpart although by itself, d1at w does not have d′1 at w′ as counterpart. Similarly, it can never happen that 〈d1, d2 〉at w has 〈d′1, d′2 〉 at w′ as counterpart while 〈d2, d1 〉 at w does not have 〈d′2, d′1 〉 at w′

as counterpart. We also don’t have to worry about “gappy” sequences that arise whensome things fail to have counterparts. And we automatically get a sensible answer tothe question which sequences, in general, matter for the evaluation of a modal formula2A at a world: should we consider only individuals denoted by terms in 2A? In whatorder should the individuals be listed: in order of appearance in 2A? Should we includerepetitions if a term occurs more than once in A? And so on.

Next, we define interpretations of the language of quantified modal logic on counterpartstructures. To this end, we first have to say what that language is.

Definition 2.2 (Languages of QML)A set of formulas L is a standard language of quantified modal logic if there aredistinct sets of symbols Var(L) (the variables of L), Pred(L) (the predicates of L),and the logical constants {¬,⊃, ∀,=,2} such that Var(L) is countably infinite andL is generated by the rule

Px1 . . . xn | x=y | ¬A | (A ⊃ B) | ∀xA | 2A,

where P ∈ Pred(L), x, y, x1, . . . ∈ Var(L) and every predicate P is limited to afixed number n ≥ 0 of variables, called the arity of P .

Some notational conventions: I will often use ‘L ’ for a fixed but arbitrary language,‘x’, ‘y’, ‘z’, ‘v’ (sometimes with indices or dashes) for members of Var(L), and ‘F ’, ‘G’,‘P ’ for members of Pred(L) with arity 1, 2 and n, respectively. Formulas involving ‘∧’,‘∨’, ‘↔’, ‘∃’ and ‘3’ are defined by the usual metalinguistic abbreviations. The order of

precedence among connectives is ¬,∧,∨,⊃; association is to the right. For any variablex, ‘Ex’ abbreviates ‘∃y(y=x)’, where y is the alphabetically first variable other thanx. ‘A1 ∧ . . . ∧ An’ stands for ‘A1’ if n = 1, or for ‘(A1 ∧ . . . ∧ An−1) ∧ An’ if n > 1, orfor an arbitrary tautology > (say, ‘x=x ⊃ x=x’) if n = 0. For any expression or set ofexpressions A, Var(A) is the set of variables in (members of) A, and Varf(A) is the setof variables with free occurrences in (members of) A.

Definition 2.3 (Interpretation)Let S = 〈W,R,U,D,C 〉 be a counterpart structure and L a language of quantifiedmodal logic. An interpretation function V for L on S is a function that assigns toeach world w ∈W a function Vw such that(i) for every predicate P of L , Vw(P ) ⊆ Unw,(ii) Vw(=) = {〈d, d〉 : d ∈ Uw}, and(iii) for every variable x of L , Vw(x) is either undefined or in Uw.

If Vw(x) is undefined for some w and x, then V is called partial, otherwise it istotal.

For zero-ary predicates P , clause (i) says that Vw(P ) ⊆ U0w. For any Uw, there is exactly

one “zero-tuple” in U0w, which we may identify with the empty set. So U0

w has exactly twosubsets, the empty set ∅ = 0 and the unit set of the empty set {∅} = 1. It is convenientto think of these simply as truth-values.

Definition 2.4 (Counterpart model)A counterpart model M for a language L consists of a counterpart structure Stogether with an interpretation function V for L on S such that either S is single-domain or both S and V are total. In the first case, M is a negative model; in thesecond case, it is a positive model.

Thus a counterpart model is effectively a collection of free first-order models, withrelations R and C that link models and their domains. Since modal operators shiftthe point of evaluation from one world to another along the accessibility relation R, itnever matters what counterparts an individual at one world has at another world unlessthat other world is accessible. This is why I officially stipulated in definition 2.1 thatcounterparthood is only defined between accessible worlds. As a consequence, one couldactually drop the accessibility relation R from structures 〈W,R,U,D,K 〉, since R canbe recovered from K: 〈w,w′ 〉 ∈ R iff 〈w,w′ 〉 ∈ Dom(K).

Note that in a negative model, Dw = Uw can be empty. In positive models, Dw maybe empty, but Uw must have at least one member, since Vw(x) ∈ Uw.

Variables are non-rigid in the sense that their interpretation is world-relative. However,we will see at the end of this section that the truth-value of a formula A at a world wnever depends on what V assigns to variables at worlds other than w. For instance, whenwe evaluate 3Fx at w, we do not check whether Fx is true at some accessible worldw′, i.e. whether Vw′(x) ∈ Vw′(F ). Rather, we check whether some individual at w′ thatis counterpart-related to Vw(x) is in Vw′(F ). Vw′(x) only enters the picture when weevaluate formulas relative to w′. If we had a designated “actual world” in each model,we could drop the world-relativity of V for individual variables.

Now let’s specify how formulas of L are evaluated at worlds. For the semantics ofquantifiers, we need the concept of an x-variant of V .

Definition 2.5 (Variant)Let V and V ′ be interpretations on a structure S . V ′ is an x-variant of V on wif V ′ differs from V at most in the value assigned to x at w. V ′ is an existentialx-variant of V on w if in addition, V ′(x) ∈ Dw.

∀xA will be true at a world w under V iff A is true at w under all existential x-variantsV ′ of V on w. This approach allows us to dispose with assignment functions and to usefree variables as individual constants, which makes the semantics slightly simpler. Youmay have noticed that individual constants are not explicitly mentioned in definition 2.2.Whenever you want to use an individual constant, simply use a variable that never getsbound. If you want, you may also add a clause to the syntax to the effect that a certainclass of variables cannot be bound, and call these variables ‘individual constants’.Nothing hangs on this way of handling quantifiers and individual constants. If you

prefer a more traditional treatment with assignment functions and a clear separationbetween constants and variables, it is trivial to translate between the two approaches(see [Bostock 1997: 81–90]).

When modal operators shift the point of evaluation to another world, variables denotecounterparts of the things they originally denoted. So let’s introduce an operation thatshifts the value of terms to the counterparts of their original value.

Definition 2.6 (Image)Let V and V ′ be interpretations on a structure S . V ′ is a w′-image of V at w (forshort, Vw . V ′w′) iff(i) for every world w in S and predicate P , Vw(P ) = V ′w(P ), and

(ii) there is a C ∈ Kw,w′ such that for every variable x, if Vw(x) is C-related tosome d ∈ Uw′ , then V ′w′(x) is some such d, otherwise V ′w′(x) is undefined.

If (i) holds, I will also say that V and V ′ agree on all predicates.

V ′w′(x) can only be undefined in negative models. In positive models, this cannot happenbecause Vw(x) is always defined and counterpart relations are total.

Definition 2.7 (Truth)The relation w, V S A (“A is true at w in S under V ”) between a world w ina structure S , an interpretation function V on S , and a sentence A is defined asfollows.

w, V S Px1 . . . xn iff 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ).

w, V S ¬A iff w, V 6 S A.

w, V S A ⊃ B iff w, V 6 S A or w, V S B.

w, V S ∀xA iff w, V ′ S A for all existential x-variants V ′ of V on w.

w, V S 2A iff w′, V ′ S A for all w′, V ′ such that wRw′ and Vw . V ′w′ .

I will drop the subscript S when the structure is clear from context.As usual, truth at all worlds in a structure (or a class of structures) under all interpre-

tations is called validity.

Definition 2.8 (Validity)A set of L-formulas Γ is positively valid in a set Σ of total counterpart structuresif w, V S A for all A ∈ Γ, all S = 〈W,R,U,D,L〉 ∈ Σ, all w ∈ W , and all totalinterpretations V on S .

Γ is negatively valid in a set Σ of single-domain counterpart structures if w, V S A

for all A ∈ Γ, all S = 〈W,R,U,D,L〉 ∈ Σ, all w ∈W , and all interpretations V onS .

Now we can prove that the value that V assigns to variables at other worlds nevermatters when evaluating formulas at a given world. This follows from the followinglemma.

Lemma 2.9 (Coincidence lemma)Let A be a sentence in a language L of quantified modal logic, w a world in astructure S , and V, V ′ interpretations for L on S such that V and V ′ agree on allpredicates, and Vw(x) = V ′w(x) for every variable x that is free in A. (In this case,I will say that V and V ′ agree at w on the variables in A.) Then

w, V S A iff w, V ′ S A.

Proof by induction on A.

1. For atomic formulas, the claim is guaranteed directly by definition 2.7.

2. A is ¬B. w, V ¬B iff w, V 6 B by definition 2.7, iff w, V ′ 6 B by inductionhypothesis, iff w, V ′ ¬B by definition 2.7.

3. A is B ⊃ C. w, V B ⊃ C iff w, V 6 B or w, V C by definition 2.7, iff w, V ′ 6 B

or w, V ′ C by induction hypothesis, iff w, V ′ B ⊃ C by definition 2.7.

4. A is ∀xB. By definition 2.7, w, V ∀xB iff w, V ∗ B for all existential x-variants V ∗of V on w. Each such x-variant V ∗ agrees at w with the x-variant V ′∗ of V ′ on w suchthat V ′∗(x) = V ∗(x) on all variables in B. Conversely, each existential x-variant V ′∗

of V ′ on w agrees at w with the x-variant V ∗ of V on w with V ∗(x) = V ′∗(x) on all

variables in B. So by induction hypothesis, w, V ∗ B for all existential x-variants V ∗of V on w iff w, V ′∗ B for all existential x-variants V ′∗ of V ′ on w, iff w, V ′ ∀xBby definition 2.7.

5. A is 2B. By definition 2.7, w, V 2B iff w′, V ∗ B for all w′, V ∗ such that wRw′and Vw . V

∗w′ , where Vw . V ∗w′ means that there is a C ∈ Kw,w′ such that for every

variable x, either Vw(x)CV ∗w′(x) or Vw(x) has no C-counterpart at w′ and V ∗w′(x) isundefined. Since Vw(x) = V ′w(x) for all variables x, each w′-image of V at w agrees withsome w′-image of V ′ on all variables in B and vice versa. So by induction hypothesis,w′, V ∗ B for all w′, V ∗ such that wRw′ and Vw . V ∗w′ iff w′, V ′

∗ B for all w′, V ′∗

such that wRw′ and Vw . V ′∗w′ , iff w, V ′ 2B by definition 2.7.

Corollary 2.10 (Locality lemma)If two interpretations V and V ′ on a structure S agree on all predicates and if forall variables x, Vw(x) = V ′w(x), then for any formula A, w, V S A iff w, V ′ S A.

Proof Immediate from lemma 2.9.

Negative models can in a sense be “simulated” by positive models: starting withany negative model, we can create a corresponding positive model by adding a “null

individual” o to the outer domain Uw of every world w; o never satisfies any atomicpredicates and serves as referent of previously empty terms.

Definition 2.11 (Positive transpose)The positive transpose S+ of a counterpart structure S = 〈W,R,U,D,K 〉 is thestructure 〈W,R,U+, D,K+ 〉 with U+ and K+ constructed as follows. Let o bean arbitrary individual (say, the smallest ordinal) not in

⋃wDw. For all w ∈ W ,

U+w = Uw ∪ {o}. For all 〈w,w′ 〉 ∈ R, K+

w,w′ is the set of relations C+ ⊆ U+w × U+

w′

such that for some C ∈ Kw,w′ , C+ = C ∪ {〈d, o〉 : d ∈ U+w and there is no d′ ∈ Uw′

with dCd′ }.If V is a (partial or total) interpretation on a structure S , then the positive

transpose V + of V is the interpretation on S+ that coincides with V except thatwhenever Vw(x) is undefined for some w and x, then V +

w (x) = o.

Lemma 2.12 (Truth-preservation under transposes)If M is a counterpart model consisting of a structure S = 〈W,R,U,D,K 〉 andan interpretation V of L on S , and if S+ = 〈W,R,U+, D,K+ 〉 and V + are thepositive transposes of S and V respectively, then for any world w ∈W and formulaA of L ,

w, V S A iff w, V + S+ A.

Proof by induction on A.

1. A is Px1 . . . xn. By definition 2.7, w, V S Px1 . . . xn iff 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ).If all Vw(xi) are defined, then V +

w (xi) = Vw(xi) and V +w (P ) = Vw(P ) by definition

2.11, and so 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ) iff 〈V +w (x1), . . . , V +

w (xn)〉 ∈ V +w (P ), i.e. iff

w, V + S + Px1 . . . xn. If some Vw(xi) is undefined, then 〈Vw(x1), . . . , Vw(xn)〉 is unde-fined and not in Vw(P ); so w, V 6 S Px1 . . . xn. Moreover, in this case V +

w (xi) = o andsince Vw(P ) = V +

w (P ) never contains any tuples involving o, 〈V +w (x1), . . . , V +

w (xn)〉 <V +w (P ). So either way, w, V 6 S Px1 . . . xn iff w, V + S + Px1 . . . xn.

2. A is ¬B. w, V S ¬B iff w, V 6 S B by definition 2.7, iff w, V + 6 S + B by inductionhypothesis, iff w, V + S + ¬B by definition 2.7.

3. A is B ⊃ C. w, V S B ⊃ C iff w, V 6 S B or w, V S C by definition 2.7, iffw, V + 6 S + B or w, V + S + C by induction hypothesis, iff w, V + S + B ⊃ C bydefinition 2.7.

4. A is ∀xB. By definition 2.7, w, V S ∀xB iff w, V ′ S B for all existential x-variantsV ′ of V on w. These x-variants V ′ of V correspond one-one to the x-variants V +′

of V + with V +′w(x) = V ′w(x). Moreover, for each such pair V ′, V +′, 〈S +, V +′ 〉 is the

positive transpose of 〈S , V ′ 〉. By induction hypothesis, w, V ′ S B iff w, V +′ S + B.And so w, V S ∀xB iff w, V +′ S + B for all existential x-variants V +′ of V + on w, iffw, V + S + ∀xB by definition 2.7.

5. A is 2B. Assume w, V S 2B. By definition 2.7, this means that w′, V ′ S B for allw′, V ′ with wRw′ and Vw . V ′w′ . We need to show that w′, V +′ S + B for all w′, V +′

with wRw′ and V +w .V +′

w′ . So let w′, V +′ be such that wRw′ and V +w .V +′

w′ . Since V +

is a total interpretation and S + a total structure, this means that for every variable xthere is a C+ ∈ K+

w,w′ with V +w (x)C+V +′

w′(x). Let V ′ be the interpretation on S thatcoincides with V +′ except that V ′w(x) is undefined for every world w ∈W and variablex for which V +′

w(x) = o. Let C = {〈d, d′ 〉 ∈ C : d , o and d′ , o}. Now assume thereare d, d′ with Vw(x) = d and dCd′. Then V +

w (x) = d and dC+d′ and thus V +′w′(x) , o,

for 〈d, o〉 ∈ C+ only if there is no d′ with 〈d, d′ 〉 ∈ C. So V ′w′(x) = V +′w′(x), and

Vw(x)CV ′w′(x). On the other hand, assume there are no d, d′ with Vw(x) = d anddCd′, either because Vw(x) is undefined or because Vw(x) = d and the only d′ with〈d, d′ 〉 ∈ C+ is o. Either way, then V +′

w′(x) = o, and so V ′w′(x) is undefined. So for allvariables x, if there are d, d′ with Vw(x) = d and dCd′ then Vw(x)CV ′w′(x), otherwiseV ′w′(x) is undefined. Since C ∈ Kw,w′ by construction of K+ (definition 2.11), thismeans that Vw . V ′w′ . But V +′ is the positive transpose of V ′. So we’ve shown thatwhenever V +

w . V +′w′ , then there is a V ′ such that V +′ is the positive transpose of V ′

and Vw . V ′w′ . We know that w′, V ′ S B. So by induction hypothesis, w′, V +′ S + B.That is, for each w′, V +′ with wRw′ and V +

w . V +′w′ , w′, V +′ S + B. By definition 2.7,

this means that w, V + S + 2B.In the other direction, assume w, V + S + 2B. That is, w′, V +′ S + B for each w′, V +′

with wRw′ and V +w .V +′

w′ . We have to show that w′, V ′ S B for all w′, V ′ with wRw′and Vw . V ′w′ . So let w′, V ′ be such that wRw′ and Vw . V ′w′ . The latter means thatthere is a C ∈ Kw,w′ such that for every variable x, either Vw(x)CV ′w′(x) or Vw(x) hasno C-counterpart at w′ and V ′w′(x) is undefined. Let V ′+ be the positive transformof V ′. Let C+ = C ∪ {〈d, o〉 : d ∈ U+

w and there is no d′ ∈ Uw′ with dCd′ }. Bydefinition 2.11, C+ ∈ K+

w,w′ . For any variable x, if Vw(x)CV ′w′(x), then both Vw(x) andV ′w′(x) are defined and thus V +

w (x) = Vw(x) and V ′+w′(x) = V ′w′(x) by definition 2.11;moreover, then V +

w (x)C+V ′+w′(x) since C ⊆ C+. On the other hand, if Vw(x) has no

C-counterpart at w′, so that V ′w′(x) is undefined, then by construction of C+ and V +w ,

V +w (x) (which equals Vw(x) if Vw(x) is defined, else o) has o as C+-counterpart at w′; andV ′

+w′(x) = o; so again V +

w (x)C+V ′+w′(x). So for every variable x, there is a C+ ∈ K+

w,w′

with V +w (x)C+V ′

+w′(x), and so V +

w . V ′+w′ . Now we know that w′, V +′ S + B for all

w′, V +′ with wRw′ and V +w . V +′

w′ . Hence w′, V ′+ S + B. By induction hypothesis,w′, V ′ S B. So we’ve shown that whenever wRw′ and Vw . V ′w′ , then w′, V ′ S B. Bydefinition 2.7, this means that w, V S 2B.

3 Substitution

Before we look at the logics determined by our models, we need to talk a little aboutsubstitution.Modal operators, we assume, shift the point of evaluation. In counterpart semantics,

when the point of evaluation is shifted from w to w′, the semantic value of every individualconstant and variable shifts to the counterpart of the previous value, following somecounterpart relation C. If an individual at w has no C-counterpart at w′, the relevantterms become empty. If an individual has multiple C-counterparts, we may think ofthe corresponding terms as becoming “ambiguous”, denoting all the counterparts at thesame time. To verify 2Fx, we require that Fx is true at all accessible worlds under all“disambiguations”.

An important question now is whether these disambiguations are uniform or mixed:should 2Gxx be true iff at all accessible worlds (relative to all counterpart relations), allx counterparts are G-related to themselves (uniform) or to one another (mixed)? Onthe mixed account, 2x=x becomes invalid, as does 2(Fx ∨ ¬Fx), even if x exists at allworlds. The semantics also becomes more complicated because a mixed disambiguationcannot be represented by a standard interpretation function. If we say that 2A is truerelative to interpretation V iff A is true at all accessible worlds under all interpretationfunctions V ′ suitably related to V , we automatically get uniform disambiguations. I havetherefore used uniform disambiguations in the previous section.

The present issue might remind you of the old observation that a sentence like ‘Brutuskilled himself’ can be understood either as an application of a monadic predicate ‘killinghimself’ to the subject Brutus, or as an application of the binary ‘killing’ to Brutusand Brutus. Peter Geach once suggested a syntactic mechanism for distinguishing thesereadings, by introducing an operator 〈z : x, y 〉 that turns a binary expression into a unaryexpression: while Gxy is satisfied by pairs of individuals, 〈z : x, y 〉Gxy is satisfied by asingle individual. The operator 〈z : x, y 〉, which might be read ‘z is an x and a y suchthat’ acts as a quantifier that binds both x and y.A similar trick can be used in our modal context. On the uniform reading, 2x=x

says that all counterparts of x are self-identical at all accessible worlds. To say thatat all accessible worlds (and under all counterpart relations), all x-counterparts areidentical to all x-counterparts we could instead say 〈x : y, z 〉2y = z. The effect of〈x : y, z 〉 is to introduce two variables y and z that co-refer with x. By using distinctbut co-refering variables in a modal context, we can express relations between possiblydistinct counterparts; by using the same variable, we make sure that the same counterpartmust be assigned to every occurrence.With 〈x : y, z 〉2y= z, we actually end up with three co-referring variables: y and z

are made to co-refer with x, but we also have x itself. The job can also be done with

〈x : y 〉2x=y – read: ‘x is a y such that . . . ’.To see the use of this operator, consider the following two sentences, which look at

first glance like simple applications of universal instantiation.

∀x2Gxy ⊃ 2Gyy; (1)∀x3Gxy ⊃ 3Gyy. (2)

Suppose for a moment that we have at most one counterpart relation from any worldto another, so that we can ignore the quantification over counterpart relations. Thefirst formula then says that if all things x are such that all x-counterparts are G-relatedto all y-counterparts, then all y-counterparts are G-related to themselves. That mustbe true. (2), however, is not valid. If all things x are such that some x-counterpart isG-related to some y-counterpart, it only follows that some y-counterpart is G-related tosome y-counterpart; it does not follow that some y-counterpart is G-related to itself.With the two distinct variables x and y, the formula 3Gxy looks at arbitrary combi-

nations of x-counterparts and y-counterparts, even if the variables co-refer. By contrast,3Gyy only looks at single y counterparts and checks whether one of them is G-relatedto itself. To prevent this accidental “capturing” of y in the consequent of (2), we can usethe Geach quantifier:

∀x3Gxy ⊃ 〈y : x〉3Gxy (2′)

Having multiple counterpart relations makes no essential difference to these considera-tions. 3Gyy is true at w iff Gyy is true at some accessible world under some assignmentof a y-counterpart to ‘y’. On the other hand, given x= y, 3Gxy is true at w iff thereis an accessible world at which some counterpart of the pair 〈x, y 〉 (= 〈x, x〉 = 〈y, y 〉)satisfies Gxy.The same issues arise for Leibniz’ Law. In the pair

x=y ⊃ 2Gxy ⊃ 2Gyy; (3)x=y ⊃ 3Gxy ⊃ 3Gyy, (4)

only the first sentence is valid. In (4), the substituted variable y again gets captured bythe other occurrence of y in the scope of the diamond. To avoid this, we could write

x=y ⊃ 3Gxy ⊃ 〈y : x〉3Gxy (4′)

in place of (4). The Geach quantifier 〈y : x〉 functions as an object-language substitutionoperator.

In some contexts, it may be useful to add this operator to our language.

Definition 3.1 (Languages of QML with substitution)A language of quantified modal logic with substitution is the standard language ofquantified modal logic (definition 2.2) with an added construct 〈 : 〉 and the rulethat whenever x, y are variables and A is a formula, then 〈y : x〉A is a formula.

As for the semantics: just as ∀xA is true relative to an interpretation V iff A is truerelative to all x-variants of V (on the relevant domain), 〈y : x〉A is true relative to V iffA is true relative to the x-variant of V that maps x to V (y). In our modal framework:

Definition 3.2 (Semantics for the substitution operator)w, V 〈y : x〉A iff w, V ′ A, where V ′ is the x-variant of V on w with V ′w(x) =

Vw(y).

Note that V ′ need not be an existential x-variant of V on w.The coincidence lemma 2.9 is easily adjusted to languages with substitution, and

corollary 2.10 follows as before. I won’t go through the whole proof again. Here is theonly new step in the induction:

A is 〈y : x〉B. w, V 〈y : x〉B iff w, V ∗ B where V ∗ is the x-variant of V onw with V ∗w(x) = Vw(y). Let V ′∗ be the x-variant of V ′ on w with V ′∗w(x) = V ′w(y).Then V ∗ and V ′∗ agree at w on all variables in B, so by induction hypothesis,w, V ∗ B iff V ′∗, w B. And this holds iff w, V ′ 〈y : x〉B by the semantics of〈y : x〉.

Substitution operators turn out to have significant expressive power. As [Kuhn 1980]shows (in effect), if a language has substitution operators, it no longer needs variables orindividual constants in its atomic formulas: instead of Fx, we can simply say F , with theconvention that the implicit variable is always x (for binary predicates, the first variableis x, the second y, etc.); Fy turns into 〈y : x〉F , Gyz into 〈y : x〉〈z : y 〉G. Similarly,∀xFx can be replaced by ∀F , and ∀yGxy by ∀〈y : z 〉〈x : y 〉〈z : x〉G. So we also don’tneed different quantifiers for different variables. In this essay, I will not exploit the fullpower of substitution operators – mainly for the sake of familiarity. Our languages withsubstitution operators will still have ordinary formulas Px1 . . . xn and quantifiers ∀x,∀y,etc.Substitution operators are close cousins of lambda abstraction and application, as

introduced to modal logic in [Stalnaker and Thomason 1968]. Lambda abstraction convertsa formula A into a predicate (λx.A), which can then be applied to a singular term y to

form a new formula (λx.A)y. Semantically, (λx.A)y is true under an interpretation Vat a world w iff A is true under the x-variant V ′ of V on w with V ′w(y) = Vw(x). So(λx.A)y is another way of writing 〈y : x〉A.

The standard use of lambda abstraction in modal logic is to resolve an ambiguity inmodal formulas with non-rigid terms. In English, sentences like ‘the pope could havebeen Italian’ have a de dicto reading and a de re reading. On the de dicto reading, thesentence says that it could have been that whoever is pope is Italian; on the de re reading,the sentence says of the actual pope that he could have been Italian. The ambiguityarises because ‘the pope’ is a non-rigid designator: relative to every world w, it picks outwhoever is pope at w. If α is such a non-rigid designator, then the obvious interpretationof 3Fα is the de dicto reading: 3Fα is true at w iff for some accessible world w′, thereferent of α at w′ falls in the extension of F at w′. To express the de re reading, lambdaabstraction can be used: (λx.3Fx)α.In counterpart semantics, the distinction between rigid and non-rigid designators is

less straightforward than in standard Kripke semantics. By the rules of the previoussection, 3Fx is true at w under interpretation V iff some counterpart of Vw(x) at someaccessible w′ is in Vw′(F ). If counterparthood is identity, then x functions as a standardrigid designator. On the other hand, if counterparthood is defined so that the pope atw has all and only the popes at other worlds as counterpart, and Vw(x) is the popeat w, then x looks much like ‘the pope’ in English. This is not a defect. A commonargument for counterpart treatments of ordinary modal discourse is precisely that thereare multiple legitimate ways of re-identifying an individual at our world at other possibleworlds (see e.g. [Lewis 1986: 251–255]).

On the other hand, it would be implausible to explain the ambiguity of ‘the pope couldhave been Italian’ as an ambiguity in the counterparthood relation associated with ‘thepope’. After all, there is no such ambiguity in ‘Jorge Mario Bergoglio could have been anItalian’. Definite descriptions like ‘the pope’ are non-rigid in a sense that does not carryover to names like ‘Jorge Mario Bergoglio’. If we wanted to add non-rigid singular termsα that function like ‘the pope’ to our modal language, we should say that 3Fα is trueat w under V iff there is some accessible w′ for which Vw′(α) ∈ Vw′(F ): on its non-rigidinterpretation, the referent of ‘the pope’ at a world w′ does not depend on its referent atthe actual world w; the term is in a sense directly evaluated at w′.

By the semantics of the previous section, all designators are in this sense rigid. Definitedescriptions like ‘the pope’ are therefore not adequately formalised as individual constantsin our modal language. We could add a new category of non-rigid “constants”, butI will not do consider such an expansion, partly for the sake of simplicity and partlybecause I think an adequate treatment of descriptions should treat them as compositesof a determiner (‘the’) and a predicate, rather than as atomic terms.

So we don’t need lambda abstraction or substitution operators to distinguish de dicto

and de re, because everything is always de re. Our main use of substitution operators israther to distinguish between “mixed” and “uniform” assignments of counterparts. Thiscomes in handy when we look at substitution principles such as Leibniz’s Law.It is well-known that in first-order logic, careless substitution of variables can cause

accidental capturing. For example,

x=y ⊃ (∃y(x,y) ⊃ ∃y(y,y)) (5)

is not a valid instance of Leibniz’s Law, because the variable y gets captured by thequantifier ∃y. There are two common ways to respond.

One is to define substitution as a simple replacement of variables, and restrict principleslike Leibniz’s Law:

x=y ⊃ (A ⊃ [y/x]A) provided x is free in A and y is free for x in A, (LL−)

where y is free for x in A if no occurrence of x in A lies in the scope of a y-quantifier.The other response is to use a more sophisticated definition of substitution on which∃y(y , y) does not count as a proper substitution instance of ∃y(x , y).Informally, [y/x]A should say about y exactly what A says about x. More precisely,

proper substitutions should satisfy the following condition, sometimes called the “substi-tution lemma”:

w, V [y/x]A iff w, V [y/x] A,

where V [y/x] is like V except that it assigns to x (at any world) the value V assigns to y.This goal can be achieved by applying the substitution to an alphabetic variant of the

original formula in which the bound variables have been renamed so that capturing can’thappen. For example, before x is replaced by y in ∃y(x , y), the variable y can be madefree for x by swapping all bound occurrences of y for some new variable z. Instead of(5), a legitimate instance of Leibniz’s Law then is

x=y ⊃ (∃y(x,y) ⊃ ∃z(y,z)). (5′)

The following definition uses this idea to prevent capturing of variables by quantifiers.4

Definition 3.3 (Classical Substitution)For any variables x, y, z let [y/x]z be y if z = x (i.e., z is the same variable as x),otherwise [y/x]z is z. For formulas A, define [y/x]A as A if x = y; otherwise

4 See [Bell and Machover 1977: 54-67], [Gabbay et al. 2009: 87–103] for alternative definitions withthe same goal. An unconventional aspect of the present definition is that [y/x]A can replace boundoccurrences of x. For example, [y/x]∀xF x is ∀yF y. This has the advantage of generalising nicely topolyadic substitutions and especially transformations, defined below.

[y/x]Px1 . . . xn = P [y/x]x1 . . . [y/x]xn[y/x]¬A = ¬[y/x]A;

[y/x](A ⊃ B) = [y/x]A ⊃ [y/x]B;

[y/x]∀zA =

∀v[y/x][v/z]A if z=y and x ∈ Varf(A), or z=x and y ∈ Varf(A),∀[y/x]z[y/x]A otherwise,

where v is the alphabetically first variable not in Var(A), x, y.

[y/x]〈y2 : z 〉A =

〈[y/x]y2 : v 〉[y/x][v/z]A if z=y and x ∈ Varf(A) or z=x and y ∈ Varf(A),〈[y/x]y2 : [y/x]z 〉[y/x]A otherwise,

where v is the alphabetically first variable not in Var(A), x, y, y2.

[y/x]2A = 2[y/x]A.

In standard predicate logic, the last two clauses are empty because there is neither a boxnor a substitution quantifier; I’ve added them because we’ll need them later. The clausesfor the substitution quantifier are exactly parallel to those for the universal quantifier,and the underlying motivation is the same. For example, [y/x]〈y2 : y 〉x,y is 〈y2 : z 〉y,zrather than 〈y2 : y 〉y,y.The clause for the box treats substitution into modal contexts as unproblematic.

However, as Lewis [1983] observed, in counterpart semantics modal operators effectivelyfunction as unselective binders that capture all variables in their scope. As a consequence,our definition of substitution does not satisfy the substitution lemma. For instance,w, V [y/x] 3Gxy does not imply w, V 3Gyy. Informally, 3Gxy says about theindividual x that at some world, one of its counterparts is G-related to some y-counterpart;3Gyy does not say the same thing about y, for it says that at some world, one of y’scounterparts is G-related to itself.The problem we face resembles the problem with naive substitution in classical first-

order logic. In response, we might try to either restrict principles like Leibniz’s Law oradjust the definition of substitution so that it satisfies the substitution lemma.

A suitable restriction for substitution principles is that when y is substituted for x inA, then y must be modally free for x in A, in the following sense.

Definition 3.4 (Modal separation and modal freedom)Two variables x and y are modally separated in a formula A if no free occurrencesof x and y in A lie in the scope of the same modal operator.y is modally free for x in A if either (i) x = y (i.e., x and y are the same variable),

or (ii) x and y are modally separated in A, or (iii) A has the form 2B and y ismodally free for x in B.

For example, x and y are modally separated in 2Fx ⊃ 3Fy and in ∀x2Gxy. y

is modally free for x in 2x= y and 22¬Gxy and 23¬∃xGxy, but not in 23¬Gxy.Correspondingly,

x=y ⊃ (2x=y ⊃ 2y=y) andx=y ⊃ (22¬Gxy ⊃ 22¬Gyy) andx=y ⊃ (22¬∃xGxy ⊃ 22¬∃zGyz)

are valid, whilex=y ⊃ (23¬Gxy ⊃ 23¬Gyy)

is invalid.If we don’t want to restrict the substitution principles, can we redefine substitution

so that it satisfies the substitution lemma? In standard languages of quantified modallogic, this is not easy, as we will see in a moment, after we’ve spelled out some specialconditions under which classical substitution (as defined in definition 3.11) does its jobeven in counterpart models.

Definition 3.5 (Interpretation under substitution)For any interpretation V of a language L on a structure S and variables x, y ofL , V [y/x] is the interpretation that is like V except that for any world w in S ,V

[y/x]w (x) = Vw(y).

Lemma 3.6 (Restricted substitution lemma, preliminary version)Let A be a sentence in a language L (with or without substitution), S a counterpartstructure for L , w a world in S , V an interpretation on S . Then

w, V [y/x] S A iff w, V S [y/x]A, provided y < Var(A).

Proof If y = x, then [y/x]A = A and V [y/x] = V , so the result is trivial. Assume then thaty , x. The proof is by induction on A.

1. A is Px1 . . . xn. w, V [y/x] Px1 . . . xn iff 〈V [y/x]w (x1), . . . , V [y/x]

w (xn)〉 ∈ V[y/x]w (P )

by definition 2.7, iff 〈Vw([y/x]x1), . . . , Vw([y/x]xn)〉 ∈ Vw(P ) by definition 3.5, iffw, V P [y/x]x1 . . . [y/x]xn by definition 2.7, iff w, V [y/x]Px1 . . . xn by definition3.3.

2. A is ¬B. w, V [y/x] ¬B iff w, V [y/x] 6 B by definition 2.7, iff w, V 6 [y/x]B byinduction hypothesis, iff w, V [y/x]¬B by definitions 2.7 and 3.3.

3. A is B ⊃ C. w, V [y/x] B ⊃ C iff w, V [y/x] 6 B or w, V [y/x] C By definition 2.7, iffw, V 6 [y/x]B or w, V [y/x]C by induction hypothesis, iff w, V [y/x](B ⊃ C) bydefinitions 2.7 and 3.3.

4. A is ∀zB. Since y < Var(A), [y/x]A = ∀[y/x]z[y/x]B. Assume first that z , x. Bydefinition 2.7, w, V [y/x] ∀zB iff w, V [y/x]′ B for all existential z-variants V [y/x]′ ofV [y/x] on w. These V [y/x]′ are precisely the functions V ′[y/x] where V ′ is an existentialz-variant of V on w. So, w, V [y/x] ∀zB iff w, V ′[y/x] B for all existential z-variants V ′ of V on w. By induction hypothesis, w, V ′[y/x] B iff w, V ′ [y/x]B. Sow, V [y/x] ∀zB iff w, V ′ ∀z[y/x]B by definition 2.7, iff w, V [y/x]∀zB by definition3.3.Alternatively, assume z = x. By definition 3.3, [y/x]∀zB is ∀y[y/x]B. Assume w, V 6 ∀y[y/x]B. By definition 2.7, then w, V ′ 6 [y/x]B for some existential y-variant V ′ ofV on w. By induction hypothesis, then w, V ′[y/x] 6 B. Let V ∗ be the (existential)x-variant of V on w with V ∗w(x) = V

′[y/x]w (x) = V ′w(y). V ∗ is a y-variant on w of V ′[y/x],

and y is not free in B, so by the coincidence lemma 2.9, w, V ∗ 6 B. But V ∗ is also anexistential x-variant of V [y/x] on w. So w, V [y/x] 6 ∀xB by definition 2.7.Conversely, assume w, V [y/x] 6 ∀xB. By definition 2.7, then w, V ∗ 6 B for someexistential x-variant of V [y/x] (and thus V ) on w. Let V ′ be the (existential) y-variantof V on w with V ′w(y) = V ∗w(x). Then V ′[y/x] and V ∗ agree at w on all variables excepty; in particular, V ′[y/x]

w (x) = V ′w(y) = V ∗w(x). Since y is not free in B, by the coincidencelemma 2.9, w, V ′[y/x] 6 B. By induction hypothesis, w, V ′ 6 [y/x]B. And since V ′ isan existential y-variant of V on w, then w, V 6 ∀y[y/x]B by definition 2.7.

5. A is 〈y2 : z 〉B. Since y < Var(A), [y/x]A = 〈[y/x]y2 : [y/x]z 〉[y/x]B by definition3.3. By definition 3.2, w, V 〈[y/x]y2 : [y/x]z 〉[y/x]B iff w, V ′ [y/x]B, whereV ′ is the [y/x]z-variant of V on w with V ′w([y/x]z) = Vw([y/x]y2). By inductionhypothesis, w, V ′ [y/x]B iff w, V ′[y/x] B. Let V [y/x]′ be the z-variant of V [y/x]

on w with V[y/x]′w (z) = V

[y/x]w (y2). Then V [y/x]′ and V ′[y/x] agree at w about all

variables v in A: for v = z, V [y/x]′w (z) = Vw([y/x]y2) = V ′w([y/x]z) = V

′[y/x]w (z);

for v = x , z, V [y/x]′w (x) = V

[y/x]w (x) = Vw(y) = V ′w(y) (because y , z and hence

[y/x]z , y) = V ′w([y/x]x) = V′[y/x]w (x); and for v < {x, y, z}, V [y/x]′

w (v) = V[y/x]w (v) =

Vw(v) = V ′w(v) = V′[y/x]w (v). So by the coincidence lemma 2.9, w, V ′[y/x] B iff

w, V [y/x]′ B. And by definition 3.2, w, V [y/x]′ B iff w, V [y/x] 〈y2 : z 〉B.

6. A is 2B. By definition 2.7, w, V [y/x] 2B iff w′, V [y/x]′ B for all w′, V [y/x]′ withwRw′ and V [y/x]

w . V[y/x]′w′ . On the other hand, w, V [y/x]2B iff w, V 2[y/x]B (by

definition 3.3), iff w′, V ′ [y/x]B for all w′, V ′ with wRw′ and Vw . V ′w′ . By inductionhypothesis, w′, V ′[y/x] B iff w′, V ′ [y/x]B. So we have to show that

w′, V [y/x]′ B for all w′, V [y/x]′ such that wRw′ and V [y/x]w . V

[y/x]′w′ (1)

iffw′, V ′[y/x] B for all w′, V ′ such that wRw′ and Vw . V ′w′ . (2)

(1) implies (2) because every interpretation V ′[y/x] with Vw .V ′w′ is also an interpretationV [y/x]′ with V [y/x]

w . V[y/x]′w′ .

Assume y is not free in 2B, and that (2) holds. In order to derive (1), considerany w′-image V [y/x]′ of V [y/x] at w. I.e., there is a counterpart relation C ∈ Kw,w′

such that for all z, V [y/x]′w′ (z) is a C-counterpart of V [y/x]

w (z). Let V ∗ be like V [y/x]′

except that V ∗w′(y) = V[y/x]′w′ (x). Let V ′ be like V ∗ except that V ′w′(x) is some C-

counterpart of Vw(x), or undefined if there is none. Then Vw . V′w′ . (In particular,

V ′w′(y) = V ∗w′(y) = V [y/x]′(x) is a C-counterpart of V [y/x]w (x) = Vw(y), or undefined if

there is none.) So by (2), w′, V ′[y/x] B. But V ′[y/x] = V ∗ (since V ∗w′(x) = V ∗w′(y)).So w′, V ∗ B. And since y is not free in B and V ∗ is a y-variant of V [y/x]′ on w′, bythe coincidence lemma 2.9, w′, V ∗ B iff w′, V [y/x]′ B.

A stronger version of this will be proved as lemma 3.9 below. We only need this versionto verify that renaming bound variables (a.k.a. α-conversion) does not affect truth-values.

Definition 3.7 (Alphabetic variant)A formula A′ of a language of quantified modal logic (with or without substitution)is an alphabetic variant of a formula A if one of the following conditions is satisfied.

1. A = A′.

2. A = ¬B, A′ = ¬B′, and B′ is an alphabetic variant of B.

3. A = B ⊃ C, A′ = B′ ⊃ C ′, and B′, C ′ are alphabetic variants of B,C,respectively.

4. A = ∀xB, A′ = ∀z[z/x]B′, B′ is an alphabetic variant of B, and either z = x

or z < Var(B′).

5. A = 〈y : x〉B, A′ = 〈y : z 〉[z/x]B′, B′ is an alphabetic variant of B, andeither z = x or z < Var(B′).

6. A = 2B, A′ = 2B′, and B′ is an alphabetic variant of A′.

Lemma 3.8 (alpha-conversion lemma)If a formula A′ is an alphabetic variant of a formula A, then for any world w inany structure S and any interpretation V on S ,

w, V S A iff w, V S A′.

Proof by induction on A.

1. A is atomic. Then A = A′ and the claim is trivial.

2. A is ¬B. Then A′ is ¬B′, where B′ is an alphabetic variant of B. By inductionhypothesis, w, V B iff w, V B′. So w, V ¬B iff w, V ¬B′ by definition 2.7.

3. A is B ⊃ C. Then A′ is B′ ⊃ C ′, where B′, C ′ are alphabetic variants of B,C,respectively. By induction hypothesis, w, V B iff w, V B′ and w, V C iffw, V C ′. So w, V B ⊃ C iff w, V B′ ⊃ C ′ by definition 2.7.

4. A is ∀xB. Then A′ is either ∀xB′ or ∀z[z/x]B′, where B′ is an alphabetic variant of Band z < Var(B′). If B is ∀xB′, then by definition 2.7, w, V ∀xB iff w, V ′ B for allexistential x-variants V ′ of V on w, which, by induction hypothesis, holds iff w, V ′ B′

for all such V ′, i.e. (by definition 2.7 again) iff w, V ∀xB′.Consider then the case where B is ∀z[z/x]B′, with z < Var(B′). This means that zis not free in B, because alphabetic variants never differ in their free variables. Nowif w, V 6 ∀z[z/x]B′, then by definition 2.7 there is an existential z-variant V ∗ of Von w such that w, V ∗ 6 [z/x]B′. And then w, (V ∗)[z/x] 6 B′ by lemma 3.6. Byinduction hypothesis, then w, (V ∗)[z/x] 6 B. Let V ′ be the x-variant of V on w withV ′(x) = (V ∗)[z/x](x) = V ∗(z). Since z is not free in B, V ′ and (V ∗)[z/x] agree at wabout all free variables in B. So by the coincidence lemma 2.9, w, V ′ 6 B. And sow, V 6 ∀xB by definition 2.7.The converse, that if w, V ∀z[z/x]B′, then w, V ∀xB, follows from the fact that∀xB is ∀x[x/z][z/x]B′ and thus an alphabetic variant of ∀z[z/x]B′.

5. A is 〈y : x〉B. Then A′ is either 〈y : x〉B′ or 〈y : z 〉[z/x]B′, where B′ is an alphabeticvariant of B and z < Var(B′). Assume first that B is 〈y : x〉B′. By definition 3.2,w, V 〈y : x〉B iff w, V ′ B where V ′ is the x-variant of V on w with V ′w(x) = Vw(y).By induction hypothesis, this holds iff w, V ′ B′, i.e. (by definition 2.7 again) iffw, V 〈y : x〉B′.Consider then the case where B is 〈y : z 〉[z/x]B′, with z < Var(B′). This means thatz is not free in B, because alphabetic variants never differ in their free variables. Bydefinition 2.7, w, V 〈y : x〉B iff w, V ′ B, where V ′ is the x-variant of V on w

with V ′w(x) = Vw(y). Let V ∗ be the z-variant of V on w with V ∗w(z) = V ′w(x) = Vw(y).Since z is not free in B, V ′ and (V ∗)[z/x] agree at w about all variables in B. So bythe coincidence lemma 2.9, w, V ′ B iff w, (V ∗)[z/x] B. By induction hypothesis,w, (V ∗)[z/x] B iff w, (V ∗)[z/x] B′. By lemma 3.6, w, (V ∗)[z/x] B′ iff w, V ∗ [z/x]B′. And by definition 2.7, w, V ∗ [z/x]B′ iff w, V 〈y : z 〉[z/x]B′.

6. A is 2B. Then A′ is 2B′, where B′ is an alphabetic variant of B. By definition 2.7,w, V 2B iff w′, V ′ B for all w′, V ′ with wRw′ and Vw . V ′w′ , and w, V 2B′ iffw′, V ′ B′ for all such w′, V ′. By induction hypothesis, w′, V ′ B iff w′, V ′ B′. Sow, V 2B iff w, V 2B′ by definition 2.7.

Now for the more general version of lemma 3.6.

Lemma 3.9 (Restricted substitution lemma)Let A be a sentence in a language L of quantified modal logic (with or withoutsubstitution), S a counterpart structure for L , w a world in S , V an interpretationon S . Then(i) w, V [y/x] S A iff w, V S [y/x]A, provided that either

(a) y and x are modally separated in A, or(b) there is no world w′ ∈W and counterpart relation C ∈ Kw,w′ such that

Vw(y) has multiple C-counterparts at w′.(ii) if w, V [y/x] S A, then w, V S [y/x]A, provided that y is modally free for x

in A.

(Proviso (i).(b) is meant to include cases where Vw(y) is undefined.)

Proof If y and x are the same variable, then V [y/x] is V , and [y/x]A is A; so triviallyw, V [y/x] A iff w, V [y/x]A. Assume then that y and x are different variables. The proofis by induction on A.

For the base case, the provisos can be ignored: w, V [y/x] Px1 . . . xn iff w, V [y/x]Px1 . . . xnby the same reasoning as in lemma 3.6. For complex A, the induction hypothesis is that (i)and (ii) hold for formulas of lower complexity, in particular for subformulas of A. Note that ifone of the provisos of (i) and (ii) applies to A, then it also applies to subformulas for A. (Forexample, if y is modally free for x in A, then y is modally free for x in every subformula ofA.) Moreover, if A is not of the form 2B, then the proviso of (ii) entails proviso (a) of (i),because y is modally free for x in A , 2B only if y and x do not occur together in the scopeof a modal operator in A.

1. A is ¬B. By definition 2.7, w, V [y/x] ¬B iff w, V [y/x] 6 B. Since a proviso of (i) or(ii) applies to A and therefore a proviso of (i) applies to B, by induction hypothesis,w, V [y/x] 6 B iff w, V 6 [y/x]B. And the latter holds iff w, V [y/x]¬B by definitions2.7 and 3.3.

2. A is B ⊃ C. By definition 2.7, w, V [y/x] B ⊃ C iff w, V [y/x] 6 B or w, V [y/x] C.Since a proviso of (i) or (ii) applies to A and therefore a proviso of (i) applies to Band C, by induction hypothesis, w, V [y/x] 6 B iff w, V 6 [y/x]B, and w, V [y/x] C iffw, V [y/x]C. So w, V [y/x] B ⊃ C iff w, V [y/x](B ⊃ C) by definitions 2.7 and3.3.

3. A is ∀zB. Assume first that [y/x]∀zB is ∀[y/x]z[y/x]B, i.e. (by definition 3.3) neitherz = y and x ∈ Varf(B) nor z = x and y ∈ Varf(B). By definition 2.7, w, V ∀[y/x]z[y/x]B iff w, V ′ [y/x]B for all existential [y/x]z-variants V ′ of V on w. Since aproviso of (i) or (ii) applies to A and therefore a proviso of (i) applies to B, by inductionhypothesis, w, V ′ [y/x]B iff w, V ′[y/x] B.Now assume z < {x, y}. Then V ′[y/x]

w (x) = V′[y/x]w (y) = V ′w(y) = Vw(y) and V ′[y/x]

w (z) =V′[y/x]w ([y/x]z) is some arbitrary member of Dw. So the interpretations V ′[y/x] coincide

with the existential z-variants V [y/x]′ of V [y/x] on w. Alternatively, if z = x, andthus y < Varf(B), then V

′[y/x]w (x) is some arbitrary member of Dw, as is V [y/x]′

w (x).Similarly, if z = y and thus x < fvar(B), then V

′[y/x]w (y) is some arbitrary member

of Dw, as is V [y/x]′w (y). In either case, the interpretations V ′[y/x]

w can be paired withthe interpretations V [y/x]′ such that the members of each pair agree at w about allfree variables in B. So by the coincidence lemma 2.9, w, V ′[y/x] B for all existential[y/x]z-variants V ′ of V on w iff w, V [y/x]′ B for all existential z-variants V [y/x]′ ofV [y/x] on w, iff w, V [y/x] ∀zB by definition 2.7.Second, assume [y/x]∀zB is ∀v[y/x][v/z]B, for some new variable v. By the α-conversionlemma 3.8, w, V [y/x] ∀zB iff w, V [y/x] ∀v[v/z]B. Since v < {x, y}, we can reasonas above, with [v/z]B in place of B, to show that w, V ∀v[y/x][v/z]B iff w, V [y/x] ∀v[v/z]B.

4. A is 〈y2 : z 〉B. This case is similar to the previous one. Assume first that [y/x]〈y2 : z 〉Bis 〈[y/x]y2 : [y/x]z 〉[y/x]B, i.e. (by definition 3.3) neither z = y and x ∈ Varf(B)nor z = x and y ∈ Varf(B). By definition 2.7, w, V 〈[y/x]y2 : [y/x]z 〉[y/x]B iffw, V ′ [y/x]B, where V ′ is the [y/x]z-variant of V on w with V ′w([y/x]z) = Vw([y/x]y2).Since a proviso of (i) or (ii) applies to A and therefore a proviso of (i) applies to B, byinduction hypothesis, w, V ′ [y/x]B iff w, V ′[y/x] B.Let V ∗ be the z-variant of V [y/x] on w with V ∗w(z) = Vw([y/x]y2). If z < {x, y},then V ∗w(x) = V ∗w(y) = Vw(y) and V ∗(z) = Vw([y/x]y2). Moreover, V ′[y/x]

w (x) =V′[y/x]w (y) = Vw(y) and V ′[y/x]

w (z) = V′[y/x]w ([y/x]z) = Vw([y/x]y2). So V ′[y/x] and V ∗

agree about all variables at w. Alternatively, if z = x, and thus y < Varf(B), thenV′[y/x]w (x) = Vw([y/x]y2) = V ∗w(x). Similarly, if z = y, and thus x < Varf(B), thenV′[y/x]w (y) = Vw([y/x]y2) = V ∗w(y). Either way, V ′[y/x] and V ∗ agree at w about all

free variables in B. By the coincidence lemma 2.9, w, V ′[y/x] B iff w, V ∗ B, iffw, V [y/x] 〈[y/x]y2 : z 〉B by definition 2.7.

5. A is 2B. This is the interesting part. We have to go piecemeal.(i). By definition 2.7, w, V [y/x] 2B iff w′, V [y/x]′ B for all w′, V [y/x]′ with wRw′ andV

[y/x]w . V

[y/x]′w′ . On the other hand, w, V [y/x]2B iff w, V 2[y/x]B (by definition

3.3), iff w′, V ′ [y/x]B for all w′, V ′ with wRw′ and Vw . V ′w′ . Since the provisos of (i)carry over from 2B to B, by induction hypothesis, w′, V ′[y/x] B iff w′, V ′ [y/x]B.So we have to show that

w′, V [y/x]′ B for all w′, V [y/x]′ such that wRw′ and V [y/x]w . V

[y/x]′w′ (1)

iffw′, V ′[y/x] B for all w′, V ′ such that wRw′ and Vw . V ′w′ . (2)

(1) implies (2) because every interpretation V ′[y/x] with Vw .V ′w′ is also an interpretationV [y/x]′ with V [y/x]

w . V[y/x]′w′ . The converse, however, may fail: both V ′[y/x]

w′ and V [y/x]′w′

assign to x and y some counterpart of Vw(y) (if there is any). But while V ′[y/x]w′ assigns

the same counterpart to x and y, V [y/x]′w′ may choose different counterparts for x and y

relative to the same counterpart relation.

If there is no counterpart relation relative to which Vw(y) has multiple counterparts,then this cannot happen. Thus under proviso (b), each V [y/x]′ with V [y/x]

w . V[y/x]′w′ is

also a V ′[y/x] with V ′w . V′[y/x]w′ , and so (2) implies (1).

For proviso (a), assume x and y do not both occur in the scope of a modal operatorin 2B. Then either x or y does not occur at all in 2B. Assume first that x doesnot occur in 2B. Then [y/x]2B is 2B (by definition 3.3), and w, V [y/x] 2B iffw, V [y/x]2B by the coincidence lemma 2.9. Alternatively, assume that y doesnot occur in 2B, and that (2) holds. In order to derive (1), consider any w′-imageV [y/x]′ of V [y/x] at w; i.e. for some counterpart relation C ∈ Kw,w′ and all variables z,V

[y/x]′w′ (z) is a C-counterpart of V [y/x]

w (or undefined if there is none). Let V ∗ be likeV [y/x]′ except that V ∗w′(y) = V

[y/x]′w′ (x). Let V ′ be like V ∗ except that V ′w′(x) is some

C-counterpart of Vw(x), or undefined if there is none. Then Vw . V ′w′ . (In particular,V ′w′(y) = V ∗w′(y) = V [y/x]′(x) is some C-counterpart of V [y/x]

w (x) = Vw(y), or undefinedif there is none.) So by (2), w′, V ′[y/x] B. But V ′[y/x] = V ∗ (since V ∗w′(x) = V ∗w′(y)).So w′, V ∗ B. And since y < Var(B) and V ∗ is a y-variant of V [y/x]′ on w′, by thecoincidence lemma 2.9, w′, V ∗ B iff w′, V [y/x]′ B.(ii). Assume w, V [y/x] 2B. By definition 2.7, then w′, V [y/x]′ B for all w′, V [y/x]′

with wRw′ and V [y/x]w . V

[y/x]′w′ . As before, every interpretation V ′[y/x] with Vw . V ′w′ is

also an interpretation V [y/x]′ with V [y/x]w . V

[y/x]′w′ . So w′, V ′[y/x] B for all w′, V ′[y/x]

with wRw′ and Vw . V ′w′ .If y is modally free for x in 2B, then y is modally free for x in B. Then by inductionhypothesis, w′, V ′ [y/x]B if w′, V ′[y/x] B. So w′, V ′ [y/x]B for all w′, V ′ withwRw′ and Vw . V ′w′ . By definition 2.7, this means that w, V 2[y/x]B, and sow, V [y/x]2B by definition 3.3.

The converse of (ii) is not true. For example, w, V [y/x]2x= y does not implyw, V [y/x] 2x=y. So the operation [y/x], as defined in definition 3.3, does not alwayssatisfy the “substitution lemma”, not even when y is modally free for x.Can we fix the definition? No – at least not if we allow for positive models. There is

no operation Φ on sentences in the standard language of quantified modal logic such thatin any (positive) model, w, V [y/x] A iff w, V Φ(A). That is, there is no general wayof translating 〈y : x〉A. To prove this, we show that there are distinctions one can drawwith 〈y : x〉 that cannot be drawn without it. In particular, the substitution quantifierallows us to say that an individual y has multiple counterparts at some accessible world(under the same counterpart relation): 〈y : x〉3y,x.

(In negative models, 〈y : x〉A can be translated into ∃x(x=y ∧A) ∨ (¬Ey ∧ [y/x]A),which still has the downside of being very impractical, since the translation Φ(A) canhave much greater syntactic complexity than A.)It is clear that 3y , y is not an adequate translation of 〈y : x〉3x , y. Before

substituting y for x in 3x , y, we would have to make x free for y by renaming themodally bound occurrence of y. However, the diamond, unlike the quantifier ∀y, bindsy in such a way that the domain over which it ranges (the counterparts of y’s original

referent) depends on the previous reference of y. So we can’t just replace y by some othervariable z, translating 〈y : x〉3x,y as 3y,z. This only works if z happens to coreferwith y. Since we can’t presuppose that there is always another name available for anygiven individual, we would somehow have to introduce a name z that corefers with y. Forinstance, if we could transform 3x,y into ∃z(y=z ∧3x,z), the variable x would havebecome free for y in the scope of the diamond, so we could translate 〈y : x〉3x, y as∃z(y=z ∧3x,y). The problem is that the quantifier ∃ ranges only over existing objects,while 〈y : x〉 bears no such restriction. In positive models, Vw(y) can have multiplecounterparts even if it lies outside Dw, so that ∃z(y=z ∧3x,y) is false. (One wouldneed an “outer quantifier” in place of ∃.)Here is the full proof.

Theorem 3.10 (Undefinability of substitution)There is no operation Φ on formulas A in a standard language L of quantifiedmodal logic such that for all worlds w in all positive counterpart models 〈S , V 〉,w, V S Φ(A) iff w, V [y/x] S A.

Proof Let M1 = 〈S1, V 〉 be a positive counterpart model with W = {w}, R = {〈w,w〉},Uw = {x, y, y∗}, Dw = {x}, Kw,w = {{〈d, d〉 : d ∈ Uw}}, Vw(y) = y, Vw(z) = x for everyvariable z , y, and Vw(P ) = ∅ for all non-logical predicates P . Let M2 = 〈S2, V 〉 be like M1except that y∗ is also a counterpart of y, i.e. Kw,w′ = {{〈x, x〉, 〈y, y 〉, 〈y∗, y∗ 〉, 〈y, y∗ 〉}}. Thenw, V [y/x] S2 3y,x, but w, V [y/x] 6 S1 3y,x.

On the other hand, every L-sentence has the same truth-value at w under V in bothmodels. We prove this by showing that for every L-sentence A, w, V S1 A iff w, V S2 A iffw, V ∗ S2 A, where V ∗ is the y-variant of V on w with V ∗w(y) = Vw(y∗).

1. A is Px1 . . . xn. It is clear that w, V S1 Px1 . . . xn iff w, V S2 Px1 . . . xn becausecounterpart relations do not figure in the evaluation of atomic formulas. Moreover,for non-logical P , w, V 6 S2 Px1 . . . xn and w, V ∗ 6 S2 Px1 . . . xn, because Vw(P ) =V ∗w(P ) = ∅. For the identity predicate, observe that w, V 6 S2 u=v iff exactly one ofu, v is y, since Vw(z) = x for all terms z , y. For the same reason, w, V ∗ 6 S2 u=v iffexactly one of u, v is y. So w, V S2 u=v iff w, V ∗ S2 u=v.

2. A is ¬B. w, V S1 ¬B iff w, V 6 S1 B by definition 2.7, iff w, V 6 S2 B by inductionhypothesis, iff w, V S2 ¬B by definition 2.7. Moreover, w, V 6 S2 B iff w, V ∗ 6 S2 B byinduction hypothesis, iff w, V ∗ S2 ¬B by definition 2.7.

3. A is B ⊃ C. w, V S1 B ⊃ C iff w, V 6 S1 B or w, V S1 C by definition 2.7, iffw, V 6 S2 B or w, V S2 C by induction hypothesis, iff w, V S2 B ⊃ C by definition2.7. Moreover, w, V 6 S2 B or w, V S2 C, iff w, V ∗ 6 S2 B or w, V ∗ S2 C by inductionhypothesis, iff w, V ∗ S2 B ⊃ C by definition 2.7.

4. A is ∀zB. Let v be a variable not in Var(B) ∪ {y}. By lemma 3.8, w, V S1 ∀zB iffw, V S1 ∀v[v/z]B. By definition 2.7, w, V S1 ∀v[v/z]B iff w, V ′ S1 [v/z]B for allexistential v-variants V ′ of V on w. As Dw = {x} and V (v) = x, the only such v-variantis V itself. So w, V S1 ∀zB iff w, V S1 [v/z]B. By the same reasoning, w, V S2 ∀zBiff w, V S2 [v/z]B. But by induction hypothesis, w, V S1 [v/z]B iff w, V S2 [v/z]B.So w, V S1 ∀zB iff w, V S2 ∀zB. Moreover, by induction hypothesis, w, V S2 [v/z]Biff w, V ∗ S2 [v/z]B, iff w, V ∗ S2 ∀v[v/z]B because V ∗ is the only existential v-variantof V ∗ on w, iff w, V ∗ S2 ∀zB by lemma 3.8.

5. A is 2B. In both structures, the only world accessible from w is w itself. Also in S1, Vis the only w-image of V at w. So by definition 2.7, w, V S1 2B iff w, V S1 B. In S2,there are two w-images of V at w: V and V ∗. So w, V S2 2B iff both w, V S2 B andw, V ∗ S2 B. By induction hypothesis, w, V S1 B iff both w, V S2 B and w, V ∗ S2 B.So w, V S1 2B iff w, V S2 2B. Moreover, in S2, V ∗ is the only w-image of V ∗ at w.So w, V ∗ S2 2B iff w, V ∗ S2 B. By induction hypothesis, w, V ∗ S2 B iff w, V S2 B.So w, V ∗ S2 2B iff both w, V ∗ S2 B and w, V S2 B, which as we just saw holds iffw, V S2 2B.

What we can do instead is introduce a new syntactic construction into the language thatsatisfies the substitution lemma by stipulation. This is what the substitution quantifierdoes. I have given its semantics in definition 3.2 by saying that w, V 〈y : x〉A iffw, V ′ A, where V ′ is the x-variant of V on w with V ′w(x) = Vw(y). By the localitylemma (corollary 2.10 of lemma 2.9), it immediately follows that

w, V 〈y : x〉A iff w, V [y/x] A.

In the following, I will consider both systems in extended languages that include thesubstitution quantifier 〈y : x〉 and systems in standard languages that exclude it. Theadvantage of having the substitution quantifier is that it not only adds welcome expressiveresources to the language, but also makes the logic and model theory somewhat morestreamlined, because the corresponding versions of principles like Leibniz’s Law,

x=y ⊃ (A ⊃ 〈y : x〉A)

hold without restrictions.It will be useful to have a notion of substitution that applies to several variables at

once. To this end, let’s generalise definition 3.3 (classical substitution).

Definition 3.11 (Classical substitution, generalised)A substitution on a language L is a total function σ : Var(L) → Var(L). If σis injective, it is called a transformation. I write [y1, . . . , yn/x1, . . . , xn] for thesubstitution that maps x1 to y1, . . . , xn to yn, and every other variable to itself.Application of a substitution σ to a formula A is defined as follows.

σ(Px1 . . . xn) = Pσ(x1) . . . σ(xn)

σ(¬A) = ¬σ(A);

σ(A ⊃ B) = σ(A) ⊃ σ(B);

σ(∀zA) =

∀vσ′([v/z]A) if there is an x free in ∀zA with σ(x) = σ(z),∀σ(z)σ(A) otherwise,

where σ′ is like σ except that σ′(v) = v, and v is the alphabeticallyfirst variable not in σ(A);

σ(〈y2 : z 〉A) =

〈σ′(y2) : v 〉σ([v/z]A) if there is an x , v in Varf(A) with σ(x) = σ(z),〈σ(y2) : σ(z)〉σ(A) otherwise,

where σ′ is like σ except that σ′(v) = v, and v is the alphabeticallyfirst variable not in σ(A);

σ(2A) = 2σ(A).

I will also write σA or Aσ instead of σ(A). If Γ is a set of formulas, I write σ(Γ)or Γσ for {Cτ : C ∈ Γ}.

Here is the corresponding generalisation of V [y/x].

Definition 3.12 (Interpretation under substitution, generalised)For any interpretation V on a structure S and substitution σ, V σ is the in-terpretation that is like V except that for any world w in S and variable x,V σw (x) = Vw(σ(x)).

Substitutions can be composed. If σ and τ are substitutions, then τ ·σ is the substitutionthat maps each variable x to τ(σ(x)). Observe that composition appears to behavedifferently in superscripts of formulas than in superscripts of interpretations: for formulasA,

(Aσ)τ = τ(σ(A)) = Aτ ·σ,

but for interpretations V ,

(V σ)τ = V σ·τ .

That’s because (V σ)τw(x) = V σw (τ(x)) = Vw(σ(τ(x)) = Vw(σ · τ(x)) = V σ·τ

w (x).Definition 3.11 draws attention to the class of injective substitutions, or transforma-

tions. A transformation never substitutes two distinct variables by the same variable.

For instance, the identity substitution [x/x] or the swapping operation [x, y/y, x] aretransformations. What’s special about such substitutions is that they make capturingimpossible: for the free variable y in ∀xA(y) to be captured by the initial quantifier ∀xafter substitution, x and y have to be replaced by the same variable. Correspondingly,definition 3.11 entails that if σ is a transformation, then σ(A) is simply A with all vari-ables simultaneously replaced by their σ-value. Transformations satisfy the substitutionlemma without any restrictions, even for modal formulas.

Lemma 3.13 (Transformation Lemma)For any world w in any structure S , any interpretation V on S , any formula A andtransformation τ , w, V τ A iff w, V Aτ .

Proof by induction on A.

1. A = Px1 . . . xn. w, V τ Px1 . . . xn iff 〈V τw (x1), . . . , V τw (xn)〉 ∈ V τw (P ), iff 〈Vw(xτ1), . . . , Vw(xτn)〉 ∈Vw(P ), iff w, V (Px1 . . . xn)τ .

2. A = ¬B. w, V τ ¬B iff w, V τ 6 B, iff w, V 6 Bτ by induction hypothesis, iffw, V (¬B)τ .

3. A = B ⊃ C. w, V τ B ⊃ C iff w, V τ 6 B or w, V τ C, iff w, V 6 Bτ or w, V Cτ

by induction hypothesis, iff w, V (B ⊃ C)τ .

4. A = 〈y : x〉B. By definition 3.2, w, V τ 〈y : x〉B iff w, (V τ )[y/x] B. Now(V τ )[y/x]

w (x) = V τw (y) = Vw(yτ ) = V[yτ/xτ ]w (xτ ) = (V [yτ/xτ ])τw(x). And for any variable

z , x, (V τ )[y/x]w (z) = V τw (z) = Vw(zτ ) = V

[yτ/xτ ]w (zτ ) (because zτ , xτ , by injectivity of

τ) = (V [yτ/xτ ])τw(z). So (V τ )[y/x] coincides with (V [yτ/xτ ])τ at w. By the locality lemma2.10, w, (V τ )[y/x] B iff w, (V [yτ/xτ ])τ B. By induction hypothesis, the latter holdsiff w, V [yτ/xτ ] Bτ , iff w, V 〈yτ : xτ 〉Bτ by definition 3.2, iff w, V (〈y : x〉B)τ bydefinition 3.11.

5. A = ∀xB. Assume w, V τ 6 ∀xB. Then w, V ∗ 6 B for some existential x-variant V ∗of V τ on w. Let V ′ be the (existential) xτ -variant of V on w with V ′w(xτ ) = V ∗w(x).Then V ′τw(x) = V ∗w(x), and for any variable z , x, V ′τw(z) = V ′w(zτ ) = Vw(zτ ) (becausezτ , xτ , by injectivity of τ) = V τw (z) = V ∗w(z). So V ′τ coincides with V ∗ on w, and bylocality (lemma 2.10), w, V ′τ 6 B. By induction hypothesis, then w, V ′ 6 Bτ . So thereis an existential xτ -variant V ′ of V on w such that w, V ′ 6 Bτ . By definition 2.7, thismeans that w, V 6 ∀xτBτ , and hence w, V 6 (∀xB)τ by definition 3.11.In the other direction, assume w, V 6 (∀xB)τ , and thus w, V 6 ∀xτBτ . Then w, V ′ 6 Bτ for some existential xτ -variant V ′ of V on w, and by induction hypothesis w, V ′τ 6 B. Let V ∗ be the (existential) x-variant of V τ on w with V ∗w(x) = V ′w(xτ ). ThenV ∗w(x) = V ′τw (x), and for any variable z , x, V ∗w(z) = V τw (z) = Vw(zτ ) = V ′w(zτ )(because zτ , xτ , by injectivity of τ) = V ′τw (z). So V ∗ coincides with V ′τ on w, and bylocality (lemma 2.10), w, V ∗ 6 B. So there is an existential x-variant V ∗ of V τ on wsuch that w, V ∗ 6 B. By definition 2.7, this means that w, V τ 6 ∀xB.

6. A = 2B. Assume w, V 6 2Bτ . Then w′, V ′ 6 Bτ for some w′, V ′ with wRw′ and V ′ aw′ image of V at w. This means that there is a counterpart relation C ∈ Kw,w′ suchthat for all variables x, V ′w′(x) is some C-counterpart at w′ of Vw(x) at w (if any, elseundefined). By induction hypothesis, w′, V ′τ 6 B. Since for all x, V ′τw′(x) = V ′w′(xτ )and V τw (x) = Vw(xτ ), it follows that V ′τw′(x) is a C-counterpart of V τw (x) (if any, elseundefined). So V ′τ is a w′-image of V τ at w. Hence w′, V ′τ 6 B for some w′, V ′τ withwRw′ and V ′τ a w′-image of V τ at w. So w, V τ 6 2B.In the other direction, assume w, V τ 6 2B. Then w′, V ∗ 6 B for some w′, V ∗ withwRw′ and V ∗ a w′ image of V τ at w. This means that there is a counterpart relationC ∈ Kw,w′ such that for all variables x, V ∗w′(x) is some C-counterpart at w′ of V τw (x) at w(if any, else undefined). Let V ′ be like V except that for all variables x, V ′w′(xτ ) = V ∗w′(x),and for all x < Ran(τ), V ′w′(x) is an arbitrary C-counterpart of Vw(x), or undefined ifthere is none. V ′ is a w′ image of V at w. Moreover, V ∗ is V ′τ . By induction hypothesis,w′, V ′ 6 Bτ . So w′, V ′ 6 Bτ for some w′, V ′ with wRw′ and V ′ a w′ image of V at w.So w, V 6 (2B)τ .

For the substitution quantifier, we could introduce primitive polyadic quantifiers like〈y1, y2 : x1, x2 〉, which says ‘y1 is an x1 and y2 an x2 such that’, and stipulate that

w, V 〈y1, y2 : x1, x2 〉A iff w, V [y1,y2/x1,x2] A.

Geach’s 〈x : y, z 〉 is then equivalent to 〈x, x : y, z 〉. But it turns out that 〈y1, y2 : x1, x2 〉is definable.We can’t simply say that 〈y1, y2 : x1, x2 〉A is 〈y1 : x1 〉〈y2 : x2 〉A, since the bound

variable x1 might capture y2, as in the swapping operator 〈x, y : y, x〉. We must storethe original value of y2 in a temporary variable z: 〈y2 : z 〉〈y1 : x1 〉〈z : x2 〉.

Definition 3.14 (Substitution sequences)For any n > 1, sentence A and variables x1, . . . , xn and y1, . . . , yn such that thex1, . . . , xn are pairwise distinct, let 〈y1, . . . , yn : x1, . . . , xn 〉A abbreviate 〈yn :z 〉〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈z : xn 〉A, where z is the alphabetically first variablenot in A or x1, . . . , xn.

Lemma 3.15 (Substitution sequence semantics)For any world w in any structure S , any interpretation V on S ,

w, V S 〈y1, . . . , yn : x1, . . . , xn 〉A iff w, V [y1,...,yn/x1,...,xn] S A.

Proof By definition 3.14, w, V 〈y1, . . . , yn : x1, . . . , xn 〉A iff w, V 〈yn : z 〉〈y1, . . . , yn−1 :x1, . . . , xn−1 〉〈z : xn 〉A, for some z not in x1, . . . , xn−1, A. By definition 3.2, w, V 〈yn :z 〉〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈z : xn 〉A iff w, V [yn/z] 〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈z :xn 〉A, which by induction hypothesis holds iff w, V [yn/z]·[y1,...,yn−1/x1,...,xn−1] 〈z : xn 〉A. Bydefinition 3.2 again, w, V [yn/z]·[y1,...,yn−1/x1,...,xn−1] 〈z : xn 〉A iff w, V [yn/z]·[y1,...,yn−1/x1,...,xn−1]·[z/xn] A. Now [yn/z] · [y1, . . . , yn−1/x1, . . . , xn−1] · [z/xn] is the function σ : V ar → V ar such that

σ(x) = [yn/z]([y1, . . . , yn−1/x1, . . . , xn−1]([z/xn](x))).

Since z < x1, . . . , xn−1, this means that

σ(xn) = yn,

σ(xi) = yi for xi ∈ {x1, . . . , xn−1},σ(z) = yn,

and σ(x) = x for every other variable x. Since z < Var(A), V σ agrees at w with V [y1,...,yn/x1,...,xn]

about all variables in A. So by the coincidence lemma 2.9, w, V σ A iff w, V [y1,...,yn/x1,...,xn] A.

4 Logics

I now want to describe the minimal logics that are characterised by our semantics.Following tradition, a logic (or system) in this context is simply a set of formulas, and Iwill describe such sets by recursive clauses corresponding to the axioms and rules of aHilbert-style calculus.Recall that we have two kinds of models: positive models with two domains, and

negative models with a single domain. Accordingly we have two kinds of logics.The logic of all positive models is essentially the combination of standard positive

free logic with the propositional modal logic K. The only place to be careful is withsubstitution principles like Leibniz’ Law, which either have to be expressed with object-language substitution or restricted as explained in the previous section. (If we add theunrestricted principles, we get logics for functional structures, as we’ll see later.)

For a non-modal first-order language L , standard positive free logic can be characterizedas the smallest set of formulas L that contains

(Taut) all propositional tautologies in L ,

as well as all L-instances of

(UD) ∀xA ⊃ (∀x(A ⊃ B) ⊃ ∀xB),

(VQ) A ⊃ ∀xA, provided x is not free in A,

(FUI) ∀xA ⊃ (Ey ⊃ [y/x]A),

(∀Ex) ∀xEx,

(=R) x = x,

(LL) x=y ⊃ A ⊃ [y/x]A,

and that is closed under modus ponens, universal generalisation, and variable substitution:

(MP) if `L A and `L A ⊃ B, then `L B,

(UG) if `L A, then `L ∀xA,

(Sub) if `L A, then `L [y/x]A.

Here, as always, `L A means A ∈ L.5

In the logic of positive counterpart structures (without object-language substitution),(LL), (FUI) and (Sub) are restricted to cases where y is modally free for x in A:

(FUI∗) ∀xA ⊃ (Ey ⊃ [y/x]A), provided y is modally free for x in A,

(LL∗) x=y ⊃ A ⊃ [y/x]A, provided y is modally free for x in A,

(Sub∗) if `L A, then `L [y/x]A, provided y is modally free for x in A.

In addition, we include the modal schema

(K) 2A ⊃ (2(A ⊃ B) ⊃ 2B),

and closure under necessitation,

(Nec) if `L A, then `L 2A.

Definition 4.1 (Minimal positive (quantified modal) logic)Given a standard language L , the minimal positive (quantified modal) logic P inL is the smallest set L ⊆ L that contains all L-instances of (Taut), (UD), (VQ),(FUI∗), (∀Ex), (=R), (LL∗), (K), and that is closed under (MP), (UG), (Nec) and(Sub∗).

We shall also be interested in stronger logics adequate for various classes of counterpartstructures. As a first stab, I will adopt the following definition.

5 [Fitting and Mendelsohn 1998] use ∀xA↔ A in place of (VQ), which precludes empty inner domains(as [Kutz 2000: 38] points out). Neither the positive nor the semantics I have presented validatesthe claim that something exists. If we ruled out empty inner domains in positive or negative models,∃xEx would be needed as extra axiom.

Definition 4.2 (Positive logics)Given a standard language L , a positive (quantified modal) logic in L is a anextension L ⊇ P of the minimal positive logic P in L such that L is closed under(MP), (UG), (Nec) and (Sub∗).

As it stands, definition 4.2 allows for “logics” in which (say) F1x is a theorem butnot F2x. This clashes with the idea that logical truths should be independent of theinterpretation of non-logical terms. A more adequate definition would add a second-orderclosure condition to the effect that, roughly, whenever `L A then `L [B/Px1 . . . xn]A,where [B/Px1 . . . xn]A is A with all occurrences of the atomic formula Px1 . . . xn replacedby (the arbitrary formula) B. Making this precise requires some care, especially oncewe look at negative logics where Fx ⊃ Ex is valid, but ¬Fx ⊃ Ex is not. Definition4.2 will do as long as we start off with a class of counterpart structures and look for acorresponding positive logic; that logic will always satisfy definition 4.2.

The first-order closure condition (Sub∗) excludes logics in which, for example, Fx is atheorem but not Fy. To see why (Sub∗) needs the proviso (’y is modally free for x in A’),note that we could otherwise move from the (FUI∗) instance `L ∀x3Gxy ⊃ 3Gzy to`L ∀x3Gx ⊃ 3Gyy, which is invalid as long as individuals can have multiple counterparts.You may wonder whether (Sub∗) is really needed in definition 4.1, given that the

axioms are stated as schemas: doesn’t this mean that every substitution instance of anaxiom is itself an axiom, and isn’t this property of closure under substitution preservedby (MP), (UG) and (Nec)? Not quite. For example,

v=y ⊃ (v=z ⊃ y=x) (6)

is an instance of (LL∗), andx=y ⊃ (x=x ⊃ y=x) (7)

follows from (6) by (Sub∗), but (7) is not itself an instance of (LL∗). Of course it ispossible to axiomatise P without (Sub∗), and nothing really hangs on it. I have chosenthe above axiomatisation just because I find it comparatively intuitive and convenientfor the purposes of this paper.

Theorem 4.3 (Soundness of P)Every member of P is valid in every positive counterpart model.

Proof We show that all P axioms are valid in every positive model, and that validity isclosed under (MP), (UG), (Nec) and (Sub∗).

1. (Taut). Propositional tautologies are valid in every model by the standard satisfactionrules for the connectives.

2. (UD). Assume w, V ∀x(A ⊃ B) and w, V ∀xA in some model. By definition 2.7,then w, V ′ A ⊃ B and w, V ′ A for every existential x-variant V ′ of V on w, and sow, V ′ B for every such V ′. Hence w, V ∀xB.

3. (VQ). Suppose w, V 6 A ⊃ ∀xA in some model. Then w, V A and w, V 6 ∀xA. Ifx is not free in A, then by the coincidence lemma 2.9, w, V ′ A for every x-variant V ′of V on Dw; so w, V ∀xA. Contradiction. So if x is not free in A, then A ⊃ ∀xA isvalid in every model.

4. (FUI∗). Assume w, V ∀xA and w, V Ey in some model. By definition 2.7, thenw, V ′ A for all existential x-variants V ′ of V on w. So in particular, w, V [y:x] A. Ify is modally free for x in A, then by lemma 3.9, w, V [y/x]A.

5. (∀Ex). By definition 2.7, w, V ∀xEx iff w, V ′ Ex for all existential x-variants V ′of V on w, iff for all existential x-variants V ′ of V on w there is an existential y-variantV ′′ of V ′ on w such that w, V ′′ x=y. But this is always the case: for any V ′, let V ′′be V ′[x/y].

6. (=R). By definition 2.3, Vw(=) = {〈d, d〉 : d ∈ Uw}, and by definition 2.3, Vw(x) ∈ Uwin every positive model. So w, V x=x in every such model, by definition 2.7.

7. (LL∗). Assume w, V x = y, w, V A, and y is modally free for x in A. SinceVw(x) = Vw(y), V coincides with V [y/x] at w. So w, V [y/x] A by the coincidencelemma 2.9. By lemma 3.9, w, V [y/x] A only if w, V [y/x]A. So w, V [y/x]A.

8. (K). Assume w, V 2(A ⊃ B) and w, V 2A. Then w′, V ′ A ⊃ B and w′, V ′ A

for every w′, V ′ such that wRw′ and V ′ is a w′-image of V at w. Then w′, V ′ B forany such w′, V ′, and so w, V 2B.

9. (MP). Assume w, V A ⊃ B and w, V A in some model. By definition 2.7, thenw, V B as well. So for any world w in any model, (MP) preserves truth at w.

10. (UG). Assume w, V 6 ∀xA in some model M . Then w, V ′ 6 A for some existential x-variant V ′ of V on w. So A is invalid in a model like M but with V ′ as the interpretationfunction in place of V . Hence if A is valid in all positive models, then so is ∀xA.

11. (Nec). Assume w, V 6 M 2A in some model M . Then w′, V ′ 6 A for some w′ withwRw′ and V ′ some w′-image of V at w. Let M ∗ be like M except with V ′ in place ofV . M ∗ is a positive model. Since A is not valid in M ∗, it follows contrapositively thatwhenever A is valid in all positive models, then so is 2A.

12. (Sub∗). Assume w, V 6 [y/x]A in some model 〈S , V 〉, and y is modally free for x in A.By lemma 3.9, then w, V [y/x] 6 A. So A is invalid in the model 〈S , V [y/x] 〉. Hence if Ais valid in all positive models, then so is [y/x]A.

Let’s move on to negative logics. Standard negative free logic replaces (=R) and (∀Ex)by

(∀=R) ∀x(x=x),

(Neg) Px1 . . . xn ⊃ Ex1 ∧ . . . ∧ Exn.

In our single-domain models, we need two further axioms, as mentioned on p. 4:

(NA) ¬Ex ⊃ 2¬Ex,

(TE) x=y ⊃ 2(Ex ⊃ Ey).

As I said in section 2, (NA) should not be confused with the claim that no individualexists at an accessible world that isn’t a counterpart of something at the present world.This is rather expressed by the Barcan Formula,

∀x2A ⊃ 2∀xA, (BF)

which is not valid in the class of negative models. For example, if W = {w,w′}, wRw′,Dw = ∅ and Dw′ = {0}, then w, V ∀x2x,x, but w, V 6 2∀x x,x.

Definition 4.4 (Minimal (strongly) negative (quantified modal) logic)Given a standard language L , the minimal (strongly) negative (quantified modal)logic N in L is the smallest set L ⊆ L that contains all L-instances of (Taut), (UD),(VQ), (FUI∗), (Neg), (LL∗), (∀=R), (K), (NA), (TE), and that is closed under(MP), (UG), (Nec) and (Sub∗).

Definition 4.5 (Negative logics)Given a standard language L , a negative (quantified modal) logic in L is a anextension L ⊇ N of the minimal negative logic N in L such that L is closed under(MP), (UG), (Nec) and (Sub∗).

Theorem 4.6 (Soundness of N)Every member of N is valid in every negative counterpart model.

Proof We show that all N axioms are valid in every negative model, and that validity isclosed under (MP), (UG), (Nec) and (Sub∗). The proofs for (Taut), (UD), (VQ), (FUI∗),(LL∗), (K), (MP), (UG), (Nec) and (Sub∗) are just as in theorem 4.3. The remaining cases are

1. (Neg). Assume w, V Px1 . . . xn in some model. By definition 2.3, Vw(P ) ⊆ Unw, andby definition 2.4, Uw = Dw in negative models. So Vw(P ) ⊆ Dn

w. By definition 2.7,w, V Px1 . . . xn therefore entails that Vw(xi) ∈ Dw for all xi ∈ x1, . . . , xn, and thatw, V Exi for all such xi.

2. (∀=R). w, V ∀x(x=x) iff w, V ′ x=x for all existential x-variants V ′ of V on w.This is always the case, since by definition 2.3 and 2.3, Vw(=) = {〈d, d〉 : d ∈ Dw} innegative models.

3. (NA). Assume w, V ¬Ex. By definition 2.7, this means that Vw(x) < Dw, andtherefore that Vw(x) is undefined if the model is negative. But if Vw(x) is undefined,then there is no world w′, individual d and counterpart relation C ∈ Kw,w′ such that〈Vw(x), w〉C〈d,w′ 〉. By definitions 2.7 and 2.6, it follows that there is no world w′ andinterpretation V ′ with wRw′ and Vw .V ′w′ such that w′, V ′ Ex. So then w, V 2¬Exby definition 2.7. Thus w, V ¬Ex ⊃ 2¬Ex.

4. (TE). Assume w, V x=y. Then Vw(x) = Vw(y) by definitions 2.3 and 2.7. Let w′, V ′be such that wRw′ and Vw . V ′w′ , and w′, V ′ Ex. By definition 2.7, the latter meansthat V ′w′(x) is some member of Dw. Moreover, Vw .V ′w′ means that there is a C ∈ Kw,w′

such that this V ′w′(x) ∈ Dw is a C-counterpart of Vw(x). It follows that Vw(y) = Vw(x)has at least one C-counterpart at w′, so V ′w′(y) must be some such counterpart, whichcan only be in Dw. So w′, V ′ Ey. So if w, V x=y, then w, V 2(Ex ⊃ Ey), bydefinition 2.7, and so w, V x=y ⊃ 2(Ex ⊃ Ey).

In the remainder of this section, I will prove a few properties derivable from the aboveaxiomatisations. (Some of these will be needed later on in the completeness proof.) Tothis end, let L range over standard languages of quantified modal logic, and L over anarbitrary positive or negative logic in L .

Lemma 4.7 (Closure under propositional consequence)For all L-formulas A1, . . . , An, B,

(PC) if `L A1, . . . ,`L An, and B is a propositional consequence of A1, . . . , An,then `L B.

Proof If B is a propositional consequence of A1, . . . , An, then A1 ⊃ (. . . ⊃ (An ⊃ B) . . .) isa tautology. So by (Taut), `L A1 ⊃ (. . . ⊃ (An ⊃ B) . . .). If `L A1, . . . ,`L An, then by napplications of (MP), `L B.

When giving proofs, I will often omit reference to (PC).

Lemma 4.8 (Redundant axioms)For any L-formulas A and variables x,

(∀Ex) `L ∀xEx,

(∀=R) `L ∀x(x=x).

Proof If L is positive, then (∀Ex) is an axiom. In N, we have `L x=x ⊃ Ex by (Neg); soby (UG) and (UD), `L ∀x(x=x) ⊃ ∀xEx. Since `L ∀x(x=x) by (=R), `L ∀xEx.

If L is negative, then (∀=R) is an axiom. In P, we have `L x=x by (=R), and so (∀=R)by (UG).

Lemma 4.9 (Existence and Self-Identity)If L is negative, then for any L-variable x,

(EI) `L Ex↔ x=x;

Proof By (FUI∗), `L ∀x(x=x) ⊃ (Ex ⊃ x=x). By (∀=R), `L ∀x(x=x). So `L Ex ⊃ x=x. Conversely, x=x ⊃ Ex by (Neg).

Lemma 4.10 (Symmetry and transitivity of identity)For any L-variables x, y, z,

(=S) `L x=y ⊃ y=x;

(=T) `L x=y ⊃ y=z ⊃ x=z.

Proof For (= S), let v be some variable < {x, y}. Then

1. `L v=y ⊃ (v=x ⊃ y=x). (LL∗)2. `L x=y ⊃ (x=x ⊃ y=x). (1, (Sub∗))3. `L x=y ⊃ x=x. ((=R), or (Neg) and (∀=R))4. `L x=y ⊃ y=x. (2, 3)

For (= T),

1. `L x=y ⊃ y=x. (=S)2. `L y=x ⊃ (y=z ⊃ x=z). (LL∗)3. `L x=y ⊃ (y=z ⊃ x=z). (1, 2)

Next we have proof-theoretic analogues of lemmas 3.8 and 3.13:

Lemma 4.11 (Syntactic alpha-conversion)If A,A′ are L-formulas, and A′ is an alphabetic variant of A, then

(AC) `L A↔ A′.

Proof by induction on A.

1. A is atomic. Then A = A′ and A↔ A′ is a propositional tautology.

2. A is ¬B. Then A′ is ¬B′, where B′ is an alphabetic variant of A′. By inductionhypothesis, `L B ↔ B′. So by (PC), `L ¬B ↔ ¬B′.

3. A is B ⊃ C. Then A′ is B′ ⊃ C ′, where B′, C ′ are alphabetic variants of B,C,respectively. By induction hypothesis, `L B ↔ B′ and `L C ↔ C ′. So by (PC),`L (B ⊃ C)↔ (B′ ⊃ C ′).

4. A is ∀xB. Then A′ is either ∀xB′ or ∀z[z/x]B′, where B′ is an alphabetic variant of Band z < Var(B′). Assume first that A′ is ∀xB′. By induction hypothesis, `L B ↔ B′.So by (UG) and (UD), `L ∀xB ↔ ∀xB′.Alternatively, assume B is ∀z[z/x]B′ and z < Var(B′). Since B′ differs from B at mostin renaming bound variables, if z were free in B, then z ∈ Var(B′). So z is not free inB. Then

1. `L B ↔ B′ (induction hypothesis)2. `L [z/x]B ↔ [z/x]B′ (1, (Sub∗))3. `L ∀xB ⊃ Ez ⊃ [z/x]B (FUI∗)4. `L ∀xB ⊃ Ez ⊃ [z/x]B′ (2, 3)5. `L ∀z∀xB ⊃ ∀zEz ⊃ ∀z[z/x]B′ (4, (UG), (UD))6. `L ∀zEz (∀Ex)7. `L ∀z∀xB ⊃ ∀z[z/x]B′ (5, 6)8. `L ∀xB ⊃ ∀z∀xB ((VQ), z not free in B)9. `L ∀xB ⊃ ∀z[z/x]B′. (7, 8)

Conversely,

10. `L ∀z[z/x]B′ ⊃ Ex ⊃ [x/z][z/x]B′ (FUI∗)11. `L ∀z[z/x]B′ ⊃ Ex ⊃ B (1, 10, z < Var(B′))12. `L ∀x∀z[z/x]B′ ⊃ ∀xB (11, (UG), (UD), (∀Ex))13. `L ∀z[z/x]B′ ⊃ ∀x∀z[z/x]B′ (VQ)14. `L ∀z[z/x]B′ ⊃ ∀xB (12, 13)

5. A is 2B. Then A′ is 2B′, where B′ is an alphabetic variant of B. By inductionhypothesis, `L B ↔ B′. Then by (Nec), `L 2(B ↔ B′), and by (K) and (PC),`L 2B ↔ 2B′.

Lemma 4.12 (Closure under transformations)For any L-formula A and transformation τ on L ,

(Subτ ) `L A iff `L Aτ .

Proof Assume `L A. Let x1, . . . , xn be the variables in A. If n = 0, then A = Aτ and theresult is trivial. If n = 1, then Aτ is [xτ1/x1]A, and xτ1 is either x1 itself or does not occur inA. In the first case, [xτ1/x1]A = A and the result is again trivial. In the second case, xτ1 ismodally free for x1 in A, and thus `L [xτ1/x1]A by (Sub∗).

Assume then that n > 1. Note first that Aτ = [xτn/vn] . . . [xτ2/v2][xτ1/x1][v2/x2] . . . [vn/xn]A,where v2, . . . , vn are distinct variables not in A or Aτ . This is easily shown by induction onthe subformulas B of A (ordered by complexity). To keep things short, let Σ abbreviate[xτn/vn] . . . [xτ2/v2][xτ1/x1][v2/x2] . . . [vn/xn].

1. If B is Pxj . . . xk, then xj , . . . , xk are variables from x1, . . . , xn, and ΣB = Pxτj . . . xτk =

Bτ , by definitions 3.3 and 3.11.

2. If B is ¬C, then by induction hypothesis, ΣC = Cτ , and hence ¬ΣC = ¬Cτ . But Σ¬Cis ¬ΣC by definition 3.3, and (¬C)τ is ¬Cτ by definition 3.11.

3. The case for C ⊃ D is analogous.

4. If B is ∀zC, then by induction hypothesis, ΣC = Cτ . Since τ is injective, Σ∀zC is∀ΣzΣC by definition 3.3, and (∀zC)τ is ∀zτCτ by definition 3.11. Moreover, since z isone of x1, . . . , xn, Σz = zτ .

5. If B is 2C, then by induction hypothesis, ΣC is Cτ , and hence 2ΣC is 2Cτ . But Σ2C

is 2ΣC by definition 3.3, and (2C)τ is 2Cτ by definition 3.11.

Now we show that L contains all “segments” of [xτn/vn] . . . [xτ2/v2][xτ1/x1][v2/x2] . . . [vn/xn]A,beginning with the rightmost substitution, [vn/xn]A. Since vn is modally free for xn inA, by (Sub∗), `L [vn/xn]A. Likewise, for each 1 < i < n, vi is modally free for xi in[vi+1/xi+1] . . . [vn/xn]A. So `L [v2/x2] . . . [vn/xn]A.

With respect to [xτ1/x1], we distinguish three cases. First, if x1 = xτ1 , then `L [xτ1/x1][v2/x2] . . . [vn/xn]A,because [xτ1/x1][v2/x2] . . . [vn/xn]A is [v2/x2] . . . [vn/xn]A. Second, if x1 , x

τ1 and xτ1 < Var(A),

then xτ1 < Var([v2/x2] . . . [vn/xn]A), since the v1, . . . , vn are not in Var(A) or Var(Aτ ). So xτ1is modally free for x1 in [v2/x2] . . . [vn/xn]A, and by (Sub∗), `L [xτ1/x1][v2/x2] . . . [vn/xn]A.Third, if x1 , xτ1 and xτ1 ∈ Var(A), then xτ1 must be one of x2, . . . , xn. Then againxτ1 < Var([v2/x2] . . . [vn/xn]A), and so `L [xτ1/x1][v2/x2] . . . [vn/xn]A by (Sub∗).

Next, xτ2 is modally free for v2 in [xτ1/x1][v2/x2] . . . [vn/xn]A, because τ is injective andhence xτ2 , xτ1 , so xτ2 does not occur in [xτ1/x1][v2/x2] . . . [vn/xn]A. Hence `L [xτ2/v2][xτ1/x1][v2/x2] . . . [vn/xn]A. By the same reasoning, for each 2 < i ≤ n, xτi is modally free for vi in[xτi−1/vi−1] . . . [xτ2/v2][xτ1/x1][v2/x2] . . . [vn/xn]A. So `L [xτn/vn] . . . [xτ2/v2][xτ1/x1][v2/x2] . . .[vn/xn]A, i.e. `L Aτ .

This proves the left-to-right direction of (Subτ ). The other direction immediately follows.Let xτ1 , . . . , xτn be the variables in Aτ , and let σ be an arbitrary transformation that maps

each xτi back to xi (i.e., to (xτi )τ−1). By the left-to-right direction of (Subτ ), `L Aτ entails`L (Aτ )σ, and (Aτ )σ is simply A.

Lemma 4.13 (Leibniz’ Law with partial substitution)Let A be a formula of L , and x, y variables of L . Let [y//x]A be A with one ormore occurrences of x replaced by y.

(LL∗p) `L x=y ⊃ A ⊃ [y//x]A, provided the following conditions are satisfied.(i) [y//x]A does not replace any occurrence of x in the scope of a quantifier

binding x or y.(ii) Either y is modally free for x in A, or [y//x]A does not replace any

occurrence of x in the scope of a modal operator in A that also containsy.

(iii) In the scope of any modal operator in A, [y//x]A either replaces allor no occurrences of x by y.

Proof Let v , y be a variable not in Var(A), and let [v//x]A be like [y//x]A except thatall new occurrences of y are replaced by v: if [y//x]A satisfies (i)–(iii), then so does [y//x]Awith all new occurrences of y replaced by v. Moreover, in the resulting formula [v//x]A alloccurrences of v are free and free for y, by clause (i); so [y/v][v//x]A = [y//x]A by definition3.3. By (LL∗),

`L v=y ⊃ [v//x]A ⊃ [y/v][v//x]A, (1)

provided that y is modally free for v in [v//x]A, i.e. provided that either y is modally freefor x in A, or [v//x]A (and thus [y//x]A) does not replace any occurrence of x in the scopeof a modal operator in A that also contains y. This is guaranteed by condition (ii). Since[y/v][v//x]A is [y//x]A, (1) can be shortened to

`L v=y ⊃ [v//x]A ⊃ [y//x]A. (2)

By (Sub∗), it follows that

`L [x/v](v=y ⊃ [v//x]A ⊃ [y//x]A), (3)

provided that x is modally free for v in v=y ⊃ [v//x]A ⊃ [y//x]A. Since this isn’t a formulaof the form 2B, x is modally free for v here iff no free occurrences of x and v lie in the scope ofthe same modal operator in [v//x]A. So whenever [v//x]A (and thus [y//x]A) replaces someoccurrences of x in the scope of a modal operator in A, then it must replace all occurrences ofx in the scope of that operator. This is guaranteed by condition (iii). By definition 3.3, (3)can be simplified to

`L x=y ⊃ A ⊃ [y//x]A. (4)

I will never actually use (LL∗p). I mention it only because Leibniz’ Law is often statedfor partial substitutions, and you may have wondered what that would look like in oursystems. Now you know. We could indeed have used (LL∗p) as basic axiom instead of(LL∗); (LL∗) would then be derivable, because every formula A has an alphabetic variantA′ such that [y/x]A is an instance of [y//x]A′ that satisfies (i)–(iii) iff y is modally freefor x in A, and because (LL∗) is not used in the proof of lemma 4.11. I have chosen(LL∗) as basic due to its much greater simplicity.6

Lemma 4.14 (Leibniz’ Law with sequences)For any L-formula A and variables x1, . . . , xn, y1, . . . , yn such that the x1, . . . , xnare pairwise distinct,

(LL∗n) `L x1 =y1 ∧ . . . ∧ xn=yn ⊃ A ⊃ [y1, . . . , yn/x1, . . . , xn]A, provided each yiis modally free for xi in [y1, . . . , yi−1/x1, . . . , xn−1]A.

For i = 1, the proviso is meant to say that y1 is modally free for x1 in A.

Proof By induction on n. For n = 1, (LL∗n) is (LL∗). Assume then that n > 1 and that eachyi in y1, . . . , yn is modally free for xi in [y1, . . . , yi−1/x1, . . . , xn−1]A. Let z be some variablenot in A, x1, . . . , xn, y1, . . . , yn. So z is modally free for xn in A. By (LL∗),

`L xn=z ⊃ A ⊃ [z/xn]A. (1)

By induction hypothesis,

`L x1 =y1 ∧ . . . ∧ xn−1 =yn−1 ⊃ [z/xn]A ⊃ [y1, . . . , yn−1/x1, . . . , xn−1][z/xn]A. (2)

By assumption, yn is modally free for xn in [y1, . . . , yn−1/x1, . . . , xn−1]A. Then yn is alsomodally free for z in [y1, . . . , yn−1/x1, . . . , xn−1][z/xn]A. So by (LL∗),

`L z=yn ⊃ [y1, . . . , yn−1/x1, . . . , xn−1][z/xn]A ⊃[yn/z][y1, . . . , yn−1/x1, . . . , xn−1][z/xn]A. (3)

6 Kutz’s system uses the following version of (LL∗p) ([Kutz 2000: 43]):

(LLKp ) ` x=y ⊃ A ⊃ [y//x]A, provided that

(i) x is free in A and y is free for x in A,(ii) y is not free in the scope of a modal operator in A, and(iii) in the scope of any modal operator in A, [y//x]A either replaces all or no occurrences

of x by y.

Evidently, this is a lot more restrictive than (LL∗p). For example, (LL∗p) validates

` x=y ⊃ 2Gxy ⊃ 2Gyy and` x=y ⊃ (F x ∨3Gxy) ⊃ (F y ∨3Gxy),

which can’t be derived in Kutz’s system (which is therefore incomplete).

But [yn/z][y1, . . . , yn−1/x1, . . . , xn−1][z/xn]A is [y1, . . . , yn/x1, . . . , xn]A. Combining (1)–(3),we therefore have

`L x1 =y1 ∧ . . . ∧ xn−1 =yn−1 ⊃ xn=z ∧ z=yn ⊃ A ⊃ [y1, . . . , yn/x1, . . . , xn]A. (4)

So by (Sub∗),

`L x1 =y1 ∧ . . . ∧ xn−1 =yn−1 ⊃ xn=xn ∧ xn=yn ⊃ A ⊃ [y1, . . . , yn/x1, . . . , xn]A. (5)

Since `L xn=yn ⊃ xn=xn (by either (=R) or (Neg) and (∀=R)), it follows that

`L x1 =y1 ∧ . . . ∧ xn=yn ⊃ A ⊃ [y1, . . . , yn/x1, . . . , xn]A. (6)

Lemma 4.15 (Cross-substitution)For any L-formula A and variables x, y,

(CS) `L x=y ⊃ 2A ⊃ 2(y=z ⊃ [z/x]A), provided z is not free in A.

More generally, for any variables x1, . . . , xn, y1, . . . , yn such that the x1, . . . , xn arepairwise distinct,

(CSn) `L x1 = y1 ∧ . . . ∧ xn = yn ⊃ 2A ⊃ 2(y1 = z1 ∧ . . . ∧ yn = zn ⊃[z1, . . . , zn/x1, . . . , xn]A), provided none of z1, . . . , zn is free in A.

Proof For (CS), assume z is not free in A. Then

1. `L x=z ⊃ A ⊃ [z/x]A. (LL∗)2. `L A ⊃ (x=z ⊃ [z/x]A). (1)3. `L 2A ⊃ 2(x=z ⊃ [z/x]A). (2, (Nec), (K))4. `L x=y ⊃ 2(x=z ⊃ [z/x]A) ⊃ 2(y=z ⊃ [z/x]A). (LL∗)5. `L x=y ⊃ 2A ⊃ 2(y=z ⊃ [z/x]A). (3, 4)

Step 4 is justified by the fact that x is not free in [z/x]A and so x and y are modally separatedin x=z ⊃ [z/x]A.

The proof for (CSn) is analogous. Assume none of z1, . . . , zn is free in A. Then

1. `L x1 =z1 ∧ . . . ∧ xn=zn ⊃ A ⊃ [z1, . . . , zn/x1, . . . , xn]A. (LL∗n)2. `L A ⊃ (x1 =z1 ∧ . . . ∧ xn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A). (1)3. `L 2A ⊃ 2(x1 =z1 ∧ . . . ∧ xn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A). (2, (Nec), (K))4. `L x1 =y1 ∧ . . . ∧ xn=yn ⊃

2(x1 =z1 ∧ . . . ∧ xn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A) ⊃2(y1 =z1 ∧ . . . ∧ yn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A). (LL∗n)

5. `L x1 =y1 ∧ . . . ∧ xn=yn ⊃ 2A ⊃2(x1 =z1 ∧ . . . ∧ xn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A). (3, 4)

Step 4 is justified by the fact that none of x1, . . . , xn is free in [z1, . . . , zn/x1, . . . , xn]A,and each yi is modally free for xi in [y1, . . . , yi−1/x1, . . . , xi−1]2(x1 = z1 ∧ . . . ∧ xn = zn ⊃[z1, . . . , zn/x1, . . . , xn]A), i.e. in 2(y1 = z1 ∧ . . . ∧ yi−1 = zi−1 ∧ xi = zi ∧ . . . ∧ xn = zn ⊃[z1, . . . , zn/x1, . . . , xn]A), because xi and yi are modally separated in y1 = z1 ∧ . . . ∧ yi−1 =zi−1 ∧ xi=zi ∧ . . . ∧ xn=zn ⊃ [z1, . . . , zn/x1, . . . , xn]A.

Lemma 4.16 (Substitution-free Universal Instantiation)For any L-formula A and variables x, y,

(FUI∗∗) `L ∀xA ⊃ (Ey ⊃ ∃x(x=y ∧A)).

Proof Let z be a variable not in Var(A), x, y.

1. `L z=y ⊃ Ey ⊃ Ez (LL∗)2. `L ∀xA ⊃ Ez ⊃ [z/x]A ((FUI∗), z < Var(A))3. `L ∀xA ∧ Ey ⊃ z=y ⊃ [z/x]A (1, 2)4. `L ∀x(x=z ⊃ ¬A) ⊃ Ez ⊃ (z=z ⊃ [z/x]¬A) ((FUI∗), z < Var(A))5. `L Ez ⊃ z=z ((=R), or (∀=R), (FUI∗))6. `L ∀x(x=z ⊃ ¬A) ⊃ Ez ⊃ [z/x]¬A (4, 5)7. `L Ez ⊃ [z/x]A ⊃ ∃x(x=z ∧A) (6)8. `L ∀xA ∧ Ey ⊃ z=y ⊃ ∃x(x=z ∧A) (1, 3, 7)9. `L z=y ⊃ ∃x(x=z ∧A) ⊃ ∃x(x=y ∧A) ((LL∗), z < Var(A))

10. `L ∀xA ∧ Ey ⊃ z=y ⊃ ∃x(x=y ∧A) (8, 9)11. `L ∀z(∀xA ∧ Ey) ⊃ ∀z(z=y ⊃ ∃x(x=y ∧A)) (10, (UG), (UD))12. `L ∀xA ∧ Ey ⊃ ∀z(z=y ⊃ ∃x(x=y ∧A)) (11, (VQ))13. `L ∀z(z=y ⊃ ∃x(x=y ∧A)) ⊃ y=y ⊃ ∃x(x=y ∧A) ((FUI∗), z < Var(A))14. `L Ey ⊃ y=y ((=R), or (∀=R), (FUI∗))15. `L ∀z(z=y ⊃ ∃x(x=y ∧A)) ⊃ Ey ⊃ ∃x(x=y ∧A) (13, 14)16. `L ∀xA ⊃ Ey ⊃ ∃x(x=y ∧A) (12, 15)

(FUI∗) can also be derived from (FUI∗∗), so we could just as well have used (FUI∗∗)as basic axiom instead of (FUI∗).

5 Logics with explicit substitution

Let’s move on to languages with substitution. We first have to lay down some axiomsgoverning the substitution operator. An obvious suggestion would be the lambda-

conversion principle〈y : x〉A↔ [y/x]A,

which would allow us to move back and forth between e.g. 〈y : x〉Fx and Fy. But we’veseen in lemma 3.9 that if things can have multiple counterparts, then these transitions aresound only under certain conditions: the move from 〈y : x〉A to [y/x]A requires that y ismodally free for x in A, the other direction requires that y and x are modally separatedin A. So we have the following somewhat more complex principles:

(SC1) 〈y : x〉A↔ [y/x]A, provided y and x are modally separated in A.

(SC2) 〈y : x〉A ⊃ [y/x]A, provided y is modally free for x in A.

But now we need further principles telling us how 〈y : x〉 behaves when y is notmodally free for x. For example, 〈y : x〉¬A should always entail ¬〈y : x〉A, even if y isnot modally free for x in A. More generally, the substitution operator commutes withevery non-modal operator as long as there is no clash of bound variables:

(S¬) 〈y : x〉¬A↔ ¬〈y : x〉A,

(S⊃) 〈y : x〉(A ⊃ B)↔ (〈y : x〉A ⊃ 〈y : x〉B),

(S∀) 〈y : x〉∀zA↔ ∀z〈y : x〉A, provided z < {x, y},

(SS1) 〈y : x〉〈y2 : z 〉A↔ 〈y2 : z 〉〈y : x〉A, provided z < {x, y} and y2 , x.

Substitution does not commute with the box. Roughly speaking, this is because〈y : x〉2A(x, y) says that at all accessible worlds, all counterparts x′ and y′ of y areA(x′, y′), while 2〈y : x〉A(x, y) says that at all accessible worlds, every counterpartx′ = y′ of y is such that A(x′, y′). In the first case, x′ and y′ may be different counterpartsof y, while in the second case, they must be the same. Thus 〈y : x〉2A entails 2〈y : x〉A,but the other direction holds only if either y does not have multiple counterparts ataccessible worlds (relative to the same counterpart relation), or at most one of x and yoccurs freely in A (including the special case where x and y are the same variable).

(S2) 〈y : x〉2A ⊃ 2〈y : x〉A,

(S3) 〈y : x〉3A ⊃ 3〈y : x〉A, provided at most one of x, y is free in A.

These principles largely make (SC1) and (SC2) redundant. We only need to addthe special case for substituting free variables in atomic formulas and in substitutionoperators, as well as a principle for vacuous substitutions:

(SAt) 〈y : x〉Px1 . . . xn ↔ P [y/x]x1 . . . [y/x]xn.

(SS2) 〈y : x〉〈x : z 〉A↔ 〈y : z 〉〈y : x〉A.

(VS) A↔ 〈y : x〉A, provided x is not free in A.

Lemma 5.1 (Soundness of the substitution axioms)If Ls is a language of quantified modal logic with substitution, then every Ls-instance of (S¬), (S⊃), (S∀), (SS1), (S2), (S3), (SAt), (SS2), and (VS) is valid inevery (positive or negative) counterpart model.

Proof

1. (S¬). w, V 〈y : x〉¬A iff w, V [y/x] ¬A by definition 3.2, iff w, V [y/x] 6 A bydefinition 2.7, iff w, V 6 〈y : x〉A by definition 3.2, iff w, V ¬〈y : x〉A by definition2.7.

2. (S⊃). w, V 〈y : x〉(A ⊃ B) iff w, V [y/x] A ⊃ B by definition 3.2, iff w, V [y/x] 6 A

or w, V [y/x] B by definition 2.7, iff w, V 6 〈y : x〉A or w, V 〈y : x〉B by definition3.2, iff w, V 〈y : x〉A ⊃ 〈y : x〉B by definition 2.7.

3. (S∀). Assume z < {x, y}. Then the existential z-variants V ′ of V [y/x] on w coincideat w with the functions (V ∗)[y/x] where V ∗ is an existential z-variant V ∗ of V on w.And so w, V 〈y : x〉∀zA iff w, V [y/x] ∀zA by definition 3.2, iff w, V ′ A for allexistential z-variants V ′ of V [y/x] on w by definition 2.7, iff w, (V ∗)[y/x] A for allexistential z-variants V ∗ of V on w, iff w, V ∗ 〈y : x〉A for all existential z-variantsV ∗ of V on w by definition 3.2, iff w, V ∀z〈y : x〉A by definition 2.7.

4. (SS1). Assume z < {x, y} and y2 , x. Then the function [y/x] · [y2/z] is identical to thefunction [y2/z] · [y/x]. So w, V 〈y : x〉〈y2 : z 〉A iff w, V [y/x]·[y2/z] A by definition3.2, iff w, V [y2/z]·[y/x] A, iff w, V 〈y2 : z 〉〈y : x〉A by definition 3.2.

5. (S2). Assume w, V 6 2〈y : x〉A. By definitions 2.7 and 3.2, this means thatw′, V ′[y/x] 6 A for some w′, V ′ such that wRw′ and Vw.V ′w′ , i.e. there is a C ∈ Kw,w′ forwhich V ′w′ assigns to every variable z a C-counterpart of its value under Vw (or nothingif there is none). Then for all z, V ′[y/x]

w′ (z) is a C-counterpart of V [y/x]w (z) (or undefined

if there is none), since V ′[y/x]w′ (x) = V ′w′(y) is a C-counterpart of Vw(y) = V

[y/x]w (x) (or

undefined if there is none). So V [y/x]w . V

′[y/x]w′ . And so w′, V ∗ 6 A for some w′, V ∗ such

that wRw′ and V [y/x]w . V ∗w′ . So w, V 〈y : x〉2A by definitions 2.7 and 3.2.

6. (S3). Assume w, V 〈y : x〉3A and at most one of x, y is free in A. By definitions2.7 and 3.2, w′, V ∗ A for some w′, V ∗ such that wRw′ and V [y/x]

w . V ∗w′ , i.e. there is aC ∈ Kw,w′ for which V ∗w′ assigns to every variable z a C-counterpart of its value underVw (or nothing if there is none). We have to show that there is a w′-image V ′ of V atw such that w, V ′[y/x] A, since then w, V 3〈y : x〉A.If x is the same variable as y, then V ∗w′(x) = V ∗w′(y) is a C-counterpart at w′ ofV

[y/x]w (x) = V

[y/x]w (y) = Vw(x) = Vw(y) at w (or undefined if there is none), so we can

choose V ∗ itself as V ′. We then have w, V ′[y/x] A because V ′[y/x] = V ′.Else if x is not free in A, let V ′ be some x-variant of V ∗ at w′ such that V ∗w′(x) is someC-counterpart at w′ of Vw(x) at w (or undefined if there is none). Since V ∗w′(y) is a

C-counterpart at w′ of V [y/x]w (y) = Vw(y) at w (or undefined if there is none), V ′ is a

w′-image of V at w. Moreover, V ′[y/x] and V ∗ agree at w′ about all variables otherthan x; so by the coincidence lemma 2.9, w′, V ′[y/x] A.Else if y is not free in A, let V ′ be like V ∗ except that V ′w′(y) = V ∗w′(x) and V ′w′(x)is some C-counterpart at w′ of Vw(x) at w (or undefined if there is none). SinceV ′w′(y) = V ∗w′(x) is a C-counterpart at w′ of V [y/x]

w (x) = Vw(y) at w (or undefinedif there is none), V ′ is a w′-image of V at w. Moreover, V ′[y/x] and V ∗ agree at w′about all variables other than y; in particular, V ′[y/x]

w′ (x) = V ′w′(y) = V ∗w′(x). So by thecoincidence lemma 2.9, w′, V ′[y/x] A.

7. (SAt). w, V 〈y : x〉Px1 . . . xn iff w, V [y/x] Px1 . . . xn by definition 3.2, iff w, V [y/x]Px1 . . . xn by lemma 3.9.

8. (SS2). w, V 〈y : x〉〈x : z 〉A iff w, V [y/x]·[x/z] A by definition 3.2, iff w, V [y/z]·[y/x] A because [y/x] · [x/z] = [y/z] · [y/x], iff w, V 〈y : z 〉〈y : x〉A by definition 3.2.

9. (VS). By definition 3.2, w, V 〈y : x〉A iff w, V [y/x] A. If x is not free in A, thenV [y/x] agrees with V at w about all free variables in A. So by the coincidence lemma2.9, w, V [y/x] A iff w, V A. So then w, V 〈y : x〉A iff w, V A.

Definition 5.2 (Positive logics with substitution)Given a language Ls with substitution, a positive (quantified modal) logic withsubstitution in Ls is a set of formulas L ⊆ Ls that contains all Ls-instances of thesubstitution axioms (S¬), (S⊃), (S∀), (SS1), (S2), (S3), (SAt), (SS2), (VS), aswell as (Taut), (UD), (VQ), (∀Ex), (=R), (K),

(FUIs) ∀xA ⊃ (Ey ⊃ 〈y : x〉A),

(LLs) x=y ⊃ (A ⊃ 〈y : x〉A),

and that is closed under (MP), (UG), (Nec) and

(Subs) if `L A, then `L 〈y : x〉A.

Let the smallest such logic be called Ps.

Definition 5.3 (Negative logics with substitution)Given a language Ls with substitution, a negative (quantified modal) logic withsubstitution in Ls is a set L ⊆ Ls that contains all Ls-instances of the substitutionaxioms (S¬), (S⊃), (S∀), (SS1), (S2), (S3), (SAt), (SS2), (VS), as well as (Taut),(UD), (VQ), (Neg), (NA), (∀=R), (K), (FUIs), (LLs), and that is closed under(MP), (UG), (Nec) and (Subs). Let the smallest such logic be called Ns.

Theorem 5.4 (Soundness of Ps)Every member of Ps is valid in every positive counterpart model.

Proof We have to show that all Ps axioms are valid in every model, and that validity isclosed under (MP), (UG), (Nec) and (Subs). For (Taut), (UD), (VQ), (∀Ex), (=R), (K),(MP), (UG), (Nec), see the proof of theorem 4.3. For the substitution axioms, see lemma 5.1.The remaining cases are (FUIs), (LLs), and (Subs).

1. (FUIs). Assume w, V ∀xA and w, V Ey in some model. By definition 2.7, thelatter means that Vw(y) ∈ Dw, and the former means that w, V ′ A for all existentialx-variants V ′ of V on w. So in particular, w, V ′ A, where V ′ is the x-variant of V onw with Vw(x) = Vw(y). So w, V 〈y : x〉A by definition 3.2.

2. (LLs). Assume w, V x = y and w, V A. By definitions 2.7 and 2.3, thenVw(x) = Vw(y). So w, V 〈y : x〉A by definition 3.2.

3. (Subs). Assume w, V 6 〈y : x〉A in some model M = 〈S , V 〉. By definition 3.2, thenw, V ′ 6 A, where V ′ is the x-variant of V on w with V ′(x) = V (y). So A is invalid inthe model 〈S , V ′ 〉. Hence if A is valid in all positive models, then so is 〈y : x〉A.

Theorem 5.5 (Soundness of Ns)Every member of Ns is valid in every negative counterpart model.

Proof All the cases needed here are covered in the proofs of theorem 4.6 and 5.4.

To derive some further properties of these systems, let L range over languages ofquantified modal logic with substitution, and L over positive or negative logics in L .Closure under propositional consequence and the validity of (∀Ex) and (∀=R) are

proved just as for substitution-free logics (see lemmas 4.7 and 4.8). So we move onimmediately to more interesting properties.

Lemma 5.6 (Substitution expansion)If A is an L-formula and x, y, z L-variables, then

(SE1) `L A↔ 〈x : x〉A;

(SE2) `L 〈y : x〉A↔ 〈y : z 〉〈z : x〉A, provided z is not free in A.

Proof (SE1) is proved by induction on A.

1. A is atomic. Then `L 〈x : x〉A↔ [x/x]A by (SAt), and so `L 〈x : x〉A↔ A because[x/x]A = A.

2. A is ¬B. By induction hypothesis, `L B ↔ 〈x : x〉B. So by (PC), `L ¬B ↔ ¬〈x : x〉B.And by 〈S¬〉, `L 〈x : x〉¬B ↔ ¬〈x : x〉B.

3. A is B ⊃ C. By induction hypothesis, `L B ↔ 〈x : x〉B and `L C ↔ 〈x : x〉C. So`L (B ⊃ C) ↔ (〈x : x〉B ⊃ 〈x : x〉C). And by 〈S ⊃ 〉, `L 〈x : x〉(B ⊃ C) ↔ (〈x :x〉B ⊃ 〈x : x〉C).

4. A is ∀zB. If z = x, then `L ∀xB ↔ 〈x : x〉∀xB by (VS). If z , x, then by inductionhypothesis, `L B ↔ 〈x : x〉B; by (UG) and (UD), `L ∀zB ↔ ∀z〈x : x〉B; and`L 〈x : x〉∀zB ↔ ∀z〈x : x〉B by (S∀).

5. A is 〈y : z 〉B. If z = x, then `L 〈y : x〉B ↔ 〈x : x〉〈y : x〉B by (VS). If z , x, then byinduction hypothesis, `L B ↔ 〈x : x〉B; by (Subs) and (S⊃), `L 〈y : z 〉B ↔ 〈y : z 〉〈x :x〉B; and `L 〈x : x〉〈y : z 〉B ↔ 〈y : z 〉〈x : x〉B by (SS1) (if y , x) or (SS2) (if y = x).

6. A is 2B. By (S2), `L 〈x : x〉2B ⊃ 2〈x : x〉B. Conversely, since at most one of x, xis free in ¬B, by (S3), `L 〈x : x〉3¬B ⊃ 3〈x : x〉¬B. Contraposing and unravelingthe definition of the diamond, we have `L 2¬〈x : x〉¬B ⊃ ¬〈x : x〉¬2¬¬B. Since`L 2¬〈x : x〉¬B ↔ 2〈x : x〉B and `L ¬〈x : x〉¬2¬¬B ↔ 〈x : x〉B (by (S¬), (Subs),(S⊃), (Nec) and (K)), this means that `L 2〈x : x〉B ⊃ 〈x : x〉2B.

As for (SE2): by (VQ), `L 〈y : x〉A↔ 〈y : z 〉〈y : x〉A. And `L 〈y : x〉〈y : z 〉A↔ 〈y : z 〉〈y :x〉A by (SS1) (if y , x) or (SS2) (if y = x). Moreover, by (SS2), `L 〈y : z 〉〈z : x〉A ↔ 〈y :x〉〈y : z 〉A. So by (PC), `L 〈y : x〉A↔ 〈y : z 〉〈z : x〉A.

Lemma 5.7 (Substituting bound variables)For any L-sentence A and variables x, y,

(SBV) `L ∀xA↔ ∀y〈y : x〉A, provided y is not free in A.

Proof

1. `L ∀y〈y : x〉A ⊃ Ex ⊃ 〈x : y 〉〈y : x〉A. (FUIs)2. `L 〈x : y 〉〈y : x〉A↔ A. ((SE1), (SE2))3. `L ∀x∀y〈y : x〉A ⊃ ∀xEx ⊃ ∀xA. (1, 2, (UG), (UD))4. `L ∀x∀y〈y : x〉A ⊃ ∀xA. (3, (∀Ex))5. `L ∀y〈y : x〉A ⊃ ∀x∀y〈y : x〉A. (VQ)6. `L ∀y〈y : x〉A ⊃ ∀xA. (4, 5)7. `L ∀xA ⊃ Ey ⊃ 〈y : x〉A. (FUIs)8. `L ∀y∀xA ⊃ ∀y〈y : x〉A. (7, (UG), (UD), (∀Ex))9. `L ∀xA ⊃ ∀y∀xA. ((VQ), y not free in A)

10. `L ∀xA ⊃ ∀y〈y : x〉A. (8, 9)11. `L ∀xA↔ ∀y〈y : x〉A. (6, 10)

Lemma 5.8 (Substituting empty variables)For any L-sentence A and variables x, y,

(SEV) `L x,x ∧ y,y ⊃ (A↔ 〈y : x〉A).

Proof (SEV) is trivial if L is positive, in which case `L x=x. For negative L, it is provedby induction on A.

1. A is atomic. If x < Var(A), then `L A↔ 〈y : x〉A by (VS), and so `L x,x ∧ y,y ⊃(A↔ 〈y : x〉A) by (PC). If x ∈ Var(A), then by (Neg)

`L x, x ∧ y,y ⊃ ¬A. (1)

Also by (Neg), `L x,x ∧ y , y ⊃ ¬[y/x]A. By (SAt), `L [y/x]A ↔ 〈y : x〉A, and so`L ¬[y/x]A↔ ¬〈y : x〉A. So

`L x,x ∧ y,y ⊃ ¬〈y : x〉A. (2)

Combining (1) and (2) yields `L x,x ∧ y,y ⊃ (A↔ 〈y : x〉A).

2. A is ¬B. By induction hypothesis, `L x,x ∧ y , y ⊃ (B ↔ 〈y : x〉B). So by (PC),`L x,x∧y,y ⊃ (¬B ↔ ¬〈y : x〉B), and by (S¬), `L x,x∧y,y ⊃ (¬B ↔ 〈y : x〉¬B).

3. A is B ⊃ C. By induction hypothesis, `L x , x ∧ y , y ⊃ (B ↔ 〈y : x〉B) and`L x,x ∧ y , y ⊃ (C ↔ 〈y : x〉C). So by (PC), `L x,x ∧ y , y ⊃ ((B ⊃ C) ↔ (〈y :x〉B ⊃ 〈y : x〉C)), and by (S⊃), `L x,x ∧ y,y ⊃ ((B ⊃ C)↔ 〈y : x〉(B ⊃ C)).

4. A is ∀zB. We distinguish three cases.

a) z < {x, y}. Then

1. `L x,x ∧ y,y ⊃ (B ↔ 〈y : x〉B) (ind. hyp.)2. `L ∀z x,x ∧ ∀z y,y ⊃ (∀zB ↔ ∀z〈y : x〉B) (1, UG, UD)3. `L x,x ∧ y,y ⊃ (∀zB ↔ ∀z〈y : x〉B) (2, VQ)4. `L x,x ∧ y,y ⊃ (∀zB ↔ 〈y : x〉∀zB). (3, (S∀))

b) z = x. Then A is ∀xB, and `L ∀xB ↔ 〈y : x〉∀xB by (VS). So `L x,x ∧ y ,y ⊃ (∀xB ↔ 〈y : x〉∀xB) by (PC).

c) z = y , x. Then A is ∀yB. Let v be a variable not in Var(A), x, y.

1. `L x,x ∧ v,v ⊃ (B ↔ 〈v : x〉B). (ind. hyp.)2. `L ∀yx,x ∧ ∀yv,v ⊃ (∀yB ↔ ∀y〈v : x〉B). (1, UG, UD)3. `L x,x ∧ v,v ⊃ (∀yB ↔ ∀y〈v : x〉B). (2, VQ)4. `L x,x ∧ v,v ⊃ (∀yB ↔ 〈v : x〉∀yB). (3, (S∀))5. `L 〈y : v 〉x,x ∧ 〈y : v 〉v,v ⊃ (〈y : v 〉∀yB ↔ 〈y : v 〉〈v : x〉∀yB). (4, (Subs), (S⊃))6. `L x,x ∧ y,y ⊃ (〈y : v 〉∀yB ↔ 〈y : v 〉〈v : x〉∀yB). (5, (VS), (SAt))7. `L x,x ∧ y,y ⊃ (∀yB ↔ 〈y : v 〉〈v : x〉∀yB). (6, (VS))8. `L x,x ∧ y,y ⊃ (∀yB ↔ 〈y : x〉∀yB). (7, (SE2))

5. A is 〈y2 : z 〉B. We have four cases.a) z < {x, y} and y2 , x. Then

1. `L x,x ∧ y,y ⊃ (B ↔ 〈y : x〉B) (ind. hyp.)2. `L 〈y2 : z 〉x,x ∧ 〈y2 : z 〉y,y ⊃ (〈y2 : z 〉B ↔ 〈y2 : z 〉〈y : x〉B) (1, (Subs), (S⊃))3. `L x,x ∧ y,y ⊃ (〈y2 : z 〉B ↔ 〈y2 : z 〉〈y : x〉B) (2, (VS))4. `L x,x ∧ y,y ⊃ (〈y2 : z 〉B ↔ 〈y : x〉〈y2 : z 〉B). (3, (SS1))

b) z , x and y2 = x. Then A is 〈x : z 〉B.

1. `L x,x ∧ z,z ⊃ (B ↔ 〈x : z 〉B) (ind. hyp.)2. `L 〈y : z 〉x,x ∧ 〈y : z 〉z,z ⊃ (〈y : z 〉B ↔ 〈y : z 〉〈x : z 〉B) (1, (Subs), (S⊃))3. `L x,x ∧ y,y ⊃ (〈y : z 〉B ↔ 〈y : z 〉〈x : z 〉B) (2, (SAt), z , x)4. `L x,x ∧ y,y ⊃ (〈y : z 〉B ↔ 〈x : z 〉B) (3, (VS), z , x)5. `L x,x ∧ y,y ⊃ (B ↔ 〈y : x〉B) (ind. hyp.)6. `L 〈y : z 〉x,x ∧ 〈y : z 〉y,y ⊃ (〈y : z 〉B ↔ 〈y : z 〉〈y : x〉B) (5, (Subs),(S⊃))7. `L x,x ∧ y,y ⊃ (〈y : z 〉B ↔ 〈y : z 〉〈y : x〉B) (6, (SAt), z , x)8. `L x,x ∧ y,y ⊃ (〈x : z 〉B ↔ 〈y : z 〉〈y : x〉B) (4, 7)9. `L x,x ∧ y,y ⊃ (〈x : z 〉B ↔ 〈y : x〉〈x : z 〉B). (8, (SS2))

c) z = x. Then A is 〈y2 : x〉B, and `L 〈y2 : x〉B ↔ 〈y : x〉〈y2 : x〉B by (VS). So`L x,x ∧ y,y ⊃ (〈y2 : x〉B ↔ 〈y : x〉〈y2 : x〉B) by (PC).

d) z = y , x and y2 , x. Then A is 〈y2 : y 〉B. Let v be a variable not inVar(A), x, y, y2.

1. `L x,x ∧ v,v ⊃ (B ↔ 〈v : x〉B). (ind. hyp.)2. `L 〈y2 : y 〉x,x ∧ 〈y2 : y 〉v,v ⊃ (〈y2 : y 〉B ↔ 〈y2 : y 〉〈v : x〉B). (1, (Subs), (S⊃))3. `L x,x ∧ v,v ⊃ (〈y2 : y 〉B ↔ 〈y2 : y 〉〈v : x〉B). (2, (VS))4. `L x,x ∧ v,v ⊃ (〈y2 : y 〉B ↔ 〈v : x〉〈y2 : y 〉B). (3, (SS1), y2 , x)5. `L 〈y : v 〉x,x ∧ 〈y : v 〉v,v ⊃ (〈y : v 〉〈y2 : y 〉B ↔ 〈y : v 〉〈v : x〉〈y2 : y 〉B). (4, (Subs), (S⊃))6. `L x,x ∧ y,y ⊃ (〈y : v 〉〈y2 : y 〉B ↔ 〈y : v 〉〈v : x〉〈y2 : y 〉B). (5, (VS), (SAt))7. `L x,x ∧ y,y ⊃ (〈y2 : y 〉B ↔ 〈y : v 〉〈v : x〉〈y2 : y 〉B). (6, (VS))8. `L x,x ∧ y,y ⊃ (〈y2 : y 〉B ↔ 〈y : x〉〈y2 : y 〉B). (7, (SE2))

6. A is 2B. Let v be a variable not in Var(B).

1. `L x,x ∧ v,v ⊃ (B ↔ 〈v : x〉B). (ind. hyp.)2. `L 2(x,x ∧ v,v) ⊃ (2B ↔ 2〈v : x〉B). (1, (Nec), (K))3. `L x,x ∧ v,v ⊃ 2(x,x ∧ v,v) ((NA), (EI), (Nec), (K))4. `L x,x ∧ v,v ⊃ (2B ↔ 2〈v : x〉B). (2, 3)5. `L x,x ∧ v,v ⊃ (2B ↔ 〈v : x〉2B). (4, (S2), (S3), v < Var(B))6. `L 〈y : v 〉x,x ∧ 〈y : v 〉v,v ⊃ (〈y : v 〉2B ↔ 〈y : v 〉〈v : x〉2B). (5, (Subs), (S⊃))7. `L x,x ∧ y,y ⊃ (〈y : v 〉2B ↔ 〈y : v 〉〈v : x〉2B). (6, (SAt))8. `L x,x ∧ y,y ⊃ (2B ↔ 〈y : v 〉〈v : x〉2B). (7, (VS))9. `L x,x ∧ y,y ⊃ (2B ↔ 〈y : x〉2B). (8, (SE2))

Now we can prove (SC1) and (SC2). I will also prove that 〈y : x〉A and [y/x]A areprovably equivalent conditional on y,y. Compare lemma 3.9 for a (slightly stronger)semantic version of this lemma.

Lemma 5.9 (Substitution conversion)For any L-formula A and variables x, y,

(SC1) `L 〈y : x〉A↔ [y/x]A, provided y and x are modally separated in A.

(SC2) `L 〈y : x〉A ⊃ [y/x]A, provided y is modally free for x in A.

(SCN) `L y,y ⊃ (〈y : x〉A↔ [y/x]A).

Proof If x and y are the same variable, then by (SE1), `L 〈x : x〉A ↔ [x/x]A. Assumethen that x and y are different variables. We first prove (SC1) and (SC2), by induction on A.Observe that if A is not a box formula 2B, then by definition 3.4, y is modally free for x in Aiff y and x are modally separated in A, in which case y and x are also modally separated inany subformula of A.

1. A is atomic. By (SAt), `L 〈y : x〉A↔ [y/x]A holds without any restrictions.

2. A is ¬B. If y and x are modally separated in A, then by induction hypothesis,`L 〈y : x〉B ↔ [y/x]B. So by (PC), `L ¬〈y : x〉B ↔ ¬[y/x]B. By (S¬) and definition3.3, it follows that `L 〈y : x〉¬B ↔ [y/x]¬B.

3. A is B ⊃ C. If y and x are modally separated in A, then by induction hypothesis,`L 〈y : x〉B ↔ [y/x]B and `L 〈y : x〉C ↔ [y/x]C. By (S⊃), `L 〈y : x〉(B ⊃C) ↔ (〈y : x〉B ⊃ 〈y : x〉C). So `L 〈y : x〉(B ⊃ C) ↔ ([y/x]B ⊃ [y/x]C), and so`L 〈y : x〉(B ⊃ C)↔ [y/x](B ⊃ C) by definition 3.3.

4. A is ∀zB. We have to distinguish four cases, assuming each time that y and x aremodally separated in A.a) z < {x, y}. By induction hypothesis, `L 〈y : x〉B ↔ [y/x]B. So by (UG) and

(UD), `L ∀z〈y : x〉B ↔ ∀z[y/x]B. Since z < {x, y}, `L 〈y : x〉∀zB ↔ ∀z〈y : x〉Bby (S∀), and ∀z[y/x]B is [y/x]∀zB by definition 3.3; so `L 〈y : x〉∀zB ↔ [y/x]∀zB.

b) z = y and x < Varf(B). By definition 3.3, then [y/x]∀zB is ∀y[y/x]B.

1. `L 〈y : x〉B ↔ [y/x]B. (induction hypothesis)2. `L ∀y〈y : x〉B ↔ ∀y[y/x]B. (1, (UG), (UD))3. `L B ↔ 〈y : x〉B. ((VS), x < Varf(B))4. `L ∀yB ↔ ∀y〈y : x〉B. (3, (UG), (UD))5. `L ∀yB ↔ 〈y : x〉∀yB. ((VS), x < Varf(B))6. `L 〈y : x〉∀yB ↔ ∀y[y/x]B. (2, 4, 5)

c) z = x and y < Varf(B). By definition 3.3, then [y/x]∀zB is ∀y[y/x]B.

1. `L 〈y : x〉B ↔ [y/x]B. (induction hypothesis)2. `L ∀y〈y : x〉B ↔ ∀y[y/x]B. (1, (UG), (UD))3. `L ∀xB ↔ ∀y〈y : x〉B. ((SBV), y < Varf(B))4. `L ∀xB ↔ 〈y : x〉∀xB. (VS)5. `L 〈y : x〉∀xB ↔ ∀y[y/x]B. (2, 3, 4)

d) z = x and y ∈ Varf(B), or z = y and x ∈ Varf(B). By definition 3.3, then[y/x]∀zB is ∀v[y/x][v/z]B for some variable v < Var(B) ∪ {x, y}. Since v and zare modally separated in B, by induction hypothesis `L 〈v : z 〉B ↔ [v/z]B. So by(UG) and (UD), `L ∀v〈v : z 〉B ↔ ∀v[v/z]B. By (SBV), `L ∀zB ↔ ∀v〈v : z 〉B.So `L ∀zB ↔ ∀v[v/z]B. Moreover, as z ∈ {x, y}, y and x are modally separated

in [v/z]B. So by induction hypothesis, `L 〈y : x〉[v/z]B ↔ [y/x][v/z]B. Then

1. `L ∀zB ↔ ∀v[v/z]B (as just shown)2. `L 〈y : x〉∀zB ↔ 〈y : x〉∀v[v/z]B (1, (Subs), (S¬), (S⊃))3. `L 〈y : x〉∀v[v/z]B ↔ ∀v〈y : x〉[v/z]B. (S∀)4. `L 〈y : x〉∀zB ↔ ∀v〈y : x〉[v/z]B. (2, 3)5. `L 〈y : x〉[v/z]B ↔ [y/x][v/z]B. (induction hypothesis)6. `L ∀v〈y : x〉[v/z]B ↔ ∀v[y/x][v/z]B. (5, (UG), (UD))7. `L 〈y : x〉∀zB ↔ ∀v[y/x][v/z]B. (4, 6)

5. A is 〈y2 : z 〉B. Again we have four cases, assuming x and y are modally separated inA.a) z < {x, y}. By definition 3.3, then [y/x]〈y2 : z 〉B is 〈[y/x]y2 : z 〉[y/x]B.

1. ` 〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 : z 〉〈y : x〉B ((SS1) or (SS2))2. ` 〈y : x〉B ↔ [y/x]B (induction hypothesis)3. ` 〈[y/x]y2 : z 〉(〈y : x〉B ↔ [y/x]B) (2, (Subs))4. ` 〈[y/x]y2 : z 〉〈y : x〉B ↔ 〈[y/x]y2 : z 〉[y/x]B (3, (S⊃), (S¬))5. ` 〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 : z 〉[y/x]B. (1, 4)

b) z = y and x < Varf(B). By definition 3.3, then [y/x]〈y2 : z 〉B is 〈[y/x]y2 :y 〉[y/x]B. By induction hypothesis, `L 〈y : x〉B ↔ [y/x]B. So by (Subs)and (S⊃), `L 〈[y/x]y2 : y 〉〈y : x〉B ↔ 〈[y/x]y2 : y 〉[y/x]B. If y2 = x, then`L 〈y : x〉〈y2 : y 〉B ↔ 〈[y/x]y2 : y 〉〈y : x〉B by (SS2). If y2 , x, then

1. `L 〈y2 : y 〉B ↔ 〈y : x〉〈y2 : y 〉B ((VS), x < Varf(〈y2 : y 〉B))2. `L B ↔ 〈y : x〉B ((VS), x < Varf(B))3. `L 〈y2 : y 〉B ↔ 〈y2 : y 〉〈y : x〉B (1, (Subs), (S⊃))4. `L 〈y : x〉〈y2 : y 〉B ↔ 〈[y/x]y2 : y 〉〈y : x〉B (1, 3)

So either way `L 〈y : x〉〈y2 : y 〉B ↔ 〈[y/x]y2 : y 〉〈y : x〉B. So `L 〈y : x〉〈y2 :y 〉B ↔ 〈[y/x]y2 : y 〉[y/x]B.

c) z = x and y < Varf(B). By definition 3.3, then [y/x]〈y2 : z 〉B is ([y/x]y2 : y)[y/x]B.By induction hypothesis, `L 〈y : x〉B ↔ [y/x]B. So by (Subs) and (S⊃),`L 〈[y/x]y2 : y 〉〈y : x〉B ↔ 〈[y/x]y2 : y 〉[y/x]B. Since y < Varf(B), by (SE2),`L 〈[y/x]y2 : y 〉〈y : x〉B ↔ 〈[y/x]y2 : x〉B. Moreover, `L 〈[y/x]y2 : x〉B ↔ 〈y :x〉〈y2 : x〉B by either (VS) (if x , y2) or by (SE1), (Subs) and (S⊃) (if x = y2).So `L 〈y : x〉〈y2 : x〉B ↔ 〈[y/x]y2 : y 〉〈y : x〉B.

d) z = x and y ∈ Varf(B), or z = y and x ∈ Varf(B). By definition 3.3, then

[y/x]〈y2 : z 〉B is 〈[y/x]y2 : v 〉[y/x][v/z]B, where v < Var(B) ∪ {x, y, y2}.

1. ` 〈v : z 〉B ↔ [v/z]B (induction hypothesis)2. ` 〈y2 : v 〉〈v : z 〉B ↔ 〈y2 : v 〉[v/z]B (1, (Subs), (S⊃), (S¬))3. ` 〈y2 : z 〉B ↔ 〈y2 : v 〉〈v : z 〉B (SE2)4. ` 〈y2 : z 〉B ↔ 〈y2 : v 〉[v/z]B (2, 3)

Since z ∈ {x, y}, x and y are modally separated in [v/z]B. So:

5. ` 〈y : x〉[v/z]B ↔ [y/x][v/z]B (ind. hyp.)6. ` 〈[y/x]y2 : v 〉〈y : x〉[v/z]B ↔ 〈[y/x]y2 : v 〉[y/x][v/z]B (5, (Subs), (S⊃))7. ` 〈y : x〉〈y2 : z 〉B ↔ 〈y : x〉〈y2 : v 〉[v/z]B (4, (Subs), (S⊃))8. ` 〈y : x〉〈y2 : v 〉[v/z]B ↔ 〈[y/x]y2 : v 〉〈y : x〉[v/z]B ((SS1) or (SS2))9. ` 〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 : v 〉〈y : x〉[v/z]B (7, 8)

10. ` 〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 : v 〉[y/x][v/z]B (6, 9)

6. A is 2B. For (SC1), assume x and y are modally separated in A. Then they are alsomodally separated in B, so by induction hypothesis, `L 〈y : x〉B ↔ [y/x]B. By (Nec)and (K), then `L 2〈y : x〉B ↔ 2[y/x]B. By (S2), `L 〈y : x〉2B ⊃ 2〈y : x〉B. Sinceat most one of x, y is free in B, by (S3), `L 〈y : x〉3¬B ⊃ 3〈y : x〉¬B; so `L 2〈y :x〉B ⊃ 〈y : x〉2B (by (S¬), (Subs), (S⊃), (Nec), (K)). So `L 〈y : x〉2B ↔ 2[y/x]B.Since 2[y/x]B is [y/x]2B by definition 3.3, this means that `L 〈y : x〉2B ↔ [y/x]2B.For (SC2), assume y is modally free for x in 2B. Then y is modally free for x in B, soby induction hypothesis, ` 〈y : x〉B ⊃ [y/x]B. By (Nec) and (K), then ` 2〈y : x〉B ⊃2[y/x]B. By (S2), ` 〈y : x〉2B ⊃ 2〈y : x〉B. So ` 〈y : x〉2B ⊃ 2[y/x]B.

Here is the proof for (SCN). The first three clauses are very similar.

1. A is atomic. Then `L 〈y : x〉A↔ [y/x]A as we’ve seen above, and so `L y,y ⊃ (〈y :x〉A↔ [y/x]A) by (PC).

2. A is ¬B. By induction hypothesis, `L y , y ⊃ (〈y : x〉B ↔ [y/x]B). So by (PC),`L y , y ⊃ (¬〈y : x〉B ↔ ¬[y/x]B). By (S¬) and definition 3.3, it follows that`L y,y ⊃ (〈y : x〉¬B ↔ [y/x]¬B).

3. A is B ⊃ C. By induction hypothesis, `L y , y ⊃ (〈y : x〉B ↔ [y/x]B) and`L y , y ⊃ (〈y : x〉C ↔ [y/x]C). By (S⊃), `L y , y ⊃ (〈y : x〉(B ⊃ C) ↔ (〈y :x〉B ⊃ 〈y : x〉C)). So `L y , y ⊃ (〈y : x〉(B ⊃ C) ↔ ([y/x]B ⊃ [y/x]C)), and so`L y,y ⊃ (〈y : x〉(B ⊃ C)↔ [y/x](B ⊃ C)) by definition 3.3.

4. A is ∀zB. If z < {x, y}, then by induction hypothesis, `L y,y ⊃ (〈y : x〉B ↔ [y/x]B).So by (UG) and (UD), `L ∀z y , y ⊃ (∀z〈y : x〉B ↔ ∀z[y/x]B). Since z < {x, y},`L 〈y : x〉∀zB ↔ ∀z〈y : x〉B by (S∀), and `L y,y ⊃ ∀z y,y by (VQ), and ∀z[y/x]B is[y/x]∀zB by definition 3.3; so `L y,y ⊃ (〈y : x〉∀zB ↔ [y/x]∀zB).Alternatively, if z ∈ {x, y}, then either x or y is not free in A, and thus x and y aremodally separated in A. By (SC2), then `L 〈y : x〉∀zB ↔ [y/x]∀zB, and so by (PC),`L y,y ⊃ (〈y : x〉∀zB ↔ [y/x]∀zB).

5. A is 〈y2 : z 〉B. If z < {x, y}, then by induction hypothesis, `L y , y ⊃ (〈y : x〉B ↔[y/x]B). So by (Subs) and (S⊃), `L 〈[y/x]y2 : z 〉y , y ⊃ (〈[y/x]y2 : z 〉〈y : x〉B ↔〈[y/x]y2 : z 〉[y/x]B). By (VS), 〈[y/x]y2 : z 〉y , y ↔ y , y. And by (SS1) or (SS2),〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 : z 〉〈y : x〉B. So `L y, y ⊃ (〈y : x〉〈y2 : z 〉B ↔ 〈[y/x]y2 :z 〉[y/x]B). But by definition 3.3, [y/x]〈y2 : z 〉B is 〈[y/x]y2 : y 〉[y/x]B.Alternatively, if z ∈ {x, y}, then either x or y is not free in A, and thus x and y aremodally separated in A. By (SC2), then `L 〈y : x〉〈y2 : z 〉B ↔ [y/x]〈y2 : z 〉B, and soby (PC), `L y,y ⊃ (〈y : x〉〈y2 : z 〉B ↔ [y/x]〈y2 : z 〉B).

6. A is 2B. Then

1. `L y,y ⊃ (〈y : x〉B ↔ [y/x]B). (ind. hyp.)2. `L 2y,y ⊃ (2〈y : x〉B ↔ 2[y/x]B). (1, (Nec), (K))3. `L y,y ⊃ 2y,y. ((=R) or (NA), (EI) and (Nec))4. `L y,y ⊃ (2〈y : x〉B ↔ 2[y/x]B). (2, 3)5. `L y,y ⊃ 〈y : x〉(x,x ∧ y,y) ((SAt), (S⊃), (S¬))6. `L (x,x ∧ y,y) ⊃ 2(x,x ∧ y,y). ((=R) or (NA), (EI), (Nec) and (K))7. `L 2(x,x ∧ y,y) ⊃ (2B ↔ 2〈y : x〉B). ((SEV), (Nec), (K))8. `L (x,x ∧ y,y) ⊃ (2B ↔ 2〈y : x〉B). (6, 7)9. `L 〈y : x〉(x,x ∧ y,y) ⊃ (〈y : x〉2B ↔ 〈y : x〉2〈y : x〉B). (8, (Subs), (S⊃))

10. `L 〈y : x〉(x,x ∧ y,y) ⊃ (〈y : x〉2B ↔ 2〈y : x〉B). (9, (VS))11. `L y,y ⊃ (〈y : x〉2B ↔ 2〈y : x〉B). (7, 10)12. `L y,y ⊃ (〈y : x〉2B ↔ [y/x]2B). (4, 13, def. 3.3)

Lemma 5.10 (Syntactic alpha-conversion)If A,A′ are L-formulas, and A′ is an alphabetic variant of A, then

(AC) `L A↔ A′.

Proof by induction on A.

1. A is atomic. Then A = A′ and `L A↔ A′ by (Taut).

2. A is ¬B. Then A′ is ¬B′ with B′ an alphabetic variant of B. By induction hypothesis,`L B ↔ B′. By (PC), `L ¬B ↔ ¬B′.

3. A is B ⊃ C. Then A′ is B′ ⊃ C ′ with B′, C ′ alphabetic variants of B,C, respectively.By induction hypothesis, `L B ↔ B′ and `sC C ↔ C ′. By (PC), then `L (B ⊃ C)↔(B′ ⊃ C ′).

4. A is ∀xB. Then A′ is either ∀xB′ or ∀z[z/x]B′, where B′ is an alphabetic variant of Band z < Var(B′). Assume first that A′ is ∀xB′. By induction hypothesis, `L B ↔ B′.So by (UG) and (UD), `L ∀xB ↔ ∀xB′.Alternatively, assume A′ is ∀z[z/x]B′ and z < Var(B′). Since B′ differs from B at mostin renaming bound variables, if z were free in B, then z ∈ Var(B′). So z is not free inB. Then

1. `L B ↔ B′. induction hypothesis2. `L 〈z : x〉B ↔ 〈z : x〉B′. (1, (Subs), (S¬))3. `L 〈z : x〉B′ ↔ [z/x]B′. ((SC1), z < Var(B′))4. `L 〈z : x〉B ↔ [z/x]B′. (2, 3)5. `L ∀z〈z : x〉B ↔ ∀z[z/x]B′. (4, (UG), (UD))6. `L ∀xB ↔ ∀z〈z : x〉B. ((SBV), z not free in B)7. `L ∀xB ↔ ∀z[z/x]B′. (5, 6)

5. A is 〈y : x〉B. Then A′ is either 〈y : x〉B′ or 〈y : z 〉[z/x]B′, where B′ is an alphabeticvariant of B and z < Var(B). Assume first that A′ is 〈y : x〉B′. By induction hypothesis,`L B ↔ B′. So by (Subs) and (S⊃), `L 〈y : x〉B ↔ 〈y : x〉B′.Alternatively, assume A′ is 〈y : z 〉[z/x]B′ and z < Var(B′). Again, it follows that z isnot free in B. So

1. `L B ↔ B′. induction hypothesis2. `L 〈z : x〉B ↔ 〈z : x〉B′. (1, (Subs), (S⊃))3. `L 〈z : x〉B′ ↔ [z/x]B′. ((SC1), z < Var(B′))4. `L 〈z : x〉B ↔ [z/x]B′. (2, 3)5. `L 〈y : z 〉〈z : x〉B ↔ 〈y : z 〉[z/x]B′. (4, (Subs), (S⊃))6. `L 〈y : z 〉〈z : x〉B ↔ 〈y : x〉B. ((SE2), z not free in B)7. `L 〈y : x〉B ↔ 〈y : z 〉[z/x]B′. (5, 6)

6. A is 2A′. Then B is 2B′ with B′ an alphabetic variant of A′. By induction hypothesis,`L A′ ↔ B′. Then by (Nec), `L 2(A′ ↔ B′), and by (K), `L 2A′ ↔ 2B′.

Theorem 5.11 (Substitution and non-substitution logics)For any L-formula A and variables x, y,

(FUI∗) `L ∀xA ⊃ (Ey ⊃ [y/x]A), provided y is modally free for x in A,

(LL∗) `L x=y ⊃ A ⊃ [y/x]A, provided y is modally free for x in A,

(Sub∗) if `L A, then `L [y/x]A, provided y is modally free for x in A.

It follows that P ⊆ Ps and N ⊆ Ns.

Proof Assume y is modally free for x in A. Then by (SC2), `L 〈y : x〉A ⊃ [y/x]A. By(FUIs), `L ∀xA ⊃ (Ey ⊃ 〈y : x〉A), so by (PC), `L ∀xA ⊃ (Ey ⊃ [y/x]A). Similarly, by(LLs), `L x= y ⊃ A ⊃ 〈y : x〉A, so by (PC), `L x= y ⊃ A ⊃ [y/x]A. Finally, by (Subs), if`L A, then `L 〈y : x〉A, so then `L [y/x]A by (PC).

Lemma 5.12 (Symmetry and transitivity of identity)For any L-variables x, y, z,

(=S) `L x=y ⊃ y=x;

(=T) `L x=y ⊃ y=z ⊃ x=z.

Proof Immediate from lemma 5.11 and lemma 4.10.

Lemma 5.13 (Variations on Leibniz’ Law)If A is an L-formula and x, y, y′ are L-variables, then

(LV1) `L x=y ⊃ 〈y : x〉A ⊃ A.

(LV2) `L y=y′ ⊃ 〈y : x〉A ⊃ [y′/x]A, provided y′ is modally free for x in A.

Proof (LV1). Let z be an L-variable not in Var(A). Then

1. `L x=z ⊃ 〈z : x〉A ⊃ 〈x : z 〉〈z : x〉A. (LLs)2. `L x=z ⊃ 〈z : x〉A ⊃ 〈x : x〉A. (1, (SE2), z < Var(A))3. `L x=z ⊃ 〈z : x〉A ⊃ A. (2, (SE1))4. `L 〈y : z 〉x=z ⊃ 〈y : z 〉〈z : x〉A ⊃ 〈y : z 〉A. (3, (VS), (S⊃))5. `L x=z ⊃ 〈y : z 〉〈z : x〉A ⊃ 〈y : z 〉A. (4, (SAt))6. `L x=z ⊃ 〈y : x〉A ⊃ 〈y : z 〉A. (5, (SE2), z < Var(A))7. `L x=z ⊃ 〈y : x〉A ⊃ A. (6, (VS), z < Var(A)).

(LV2).

1. `L x=y ∧ y=y′ ⊃ x=y′. (=T)2. `L A ∧ x=y′ ⊃ [y′/x]A. ((LL∗), y′ m.f. in A)3. `L A ∧ x=y ∧ y=y′ ⊃ [y′/x]A. (1, 2)4. `L 〈y : x〉A ∧ 〈y : x〉x=y ∧ 〈y : x〉y=y′ ⊃ 〈y : x〉[y′/x]A. (3, (Subs), (S¬), (S⊃))5. `L y=y ⊃ 〈y : x〉x=y. (SAt)6. `L y=y′ ⊃ y=y. ((LL∗), (=S))7. `L y=y′ ⊃ 〈y : x〉y=y′. (VS)8. `L 〈y : x〉A ∧ y=y′ ⊃ 〈y : x〉[y′/x]A. (4, 5, 6, 7)9. `L 〈y : x〉[y′/x]A ⊃ [y′/x]A. (VS)

10. `L 〈y : x〉A ∧ y=y′ ⊃ [y′/x]A. (8, 9)

Lemma 5.14 (Leibniz’ Law with sequences)For any L-formula A and variables x1, . . . , xn, y1, . . . , yn such that the x1, . . . , xnare pairwise distinct,

(LLn) `L x1 =y1 ∧ . . . ∧ xn=yn ⊃ A ⊃ 〈y1, . . . , yn : x1, . . . , xn 〉A.

Proof For n = 1, (LLn) is (LLs). Assume then that n > 1. To keep formulas in the followingproof at a managable length, let φ(i) abbreviate the sequence φ(1), . . . , φ(n− 1). For example,〈yi : xi 〉 is 〈y1, . . . , yn−1 : x1, . . . , xn−1 〉. Let z be the alphabetically first variable not in A or

x1, . . . , xn. Now

1. `L xn=yn ⊃ 〈yi : xi 〉A ⊃ 〈yn : xn 〉〈yi : xi 〉A. (LLs)2. `L 〈yn : xn 〉〈yi : xi 〉A ⊃ 〈yn : z 〉〈z : xn 〉〈yi : xi 〉A. (SE1)3. `L 〈z : xn 〉〈yi : xi 〉A ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉A. ((SS1) or (SS2))

4. `L 〈yn : z 〉〈z : xn 〉〈yi : xi 〉A⊃ 〈yn : z 〉〈[z/xn]yi : xi 〉〈z : xn 〉A. (3, (Subs), (S⊃))

5. `L xn=yn ⊃ 〈yi : xi 〉A ⊃ 〈yn : z 〉〈[z/xn]yi : xi 〉〈z : xn 〉A. (1, 2, 4)

6. `L xn=z ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉A⊃ 〈z : xn 〉〈[z/xn]yi : xi 〉〈z : xn 〉A. (LLs)

7. `L xn=z ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉A⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉〈z : xn 〉A. (6, (SS1))

8. `L z=xn ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉〈z : xn 〉A⊃ 〈xn : z 〉〈[z/xn]yi : xi 〉〈z : xn 〉〈z : xn 〉A. (LLs)

9. `L z=xn ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉〈z : xn 〉A⊃ 〈yi : xi 〉〈xn : z 〉〈z : xn 〉〈z : xn 〉A. (8, (SS1), (SS2))

10. `L 〈xn : z 〉〈z : xn 〉〈z : xn 〉A↔ 〈z : xn 〉A ((SE1), (SE2))11. `L 〈yi : xi 〉〈xn : z 〉〈z : xn 〉〈z : xn 〉A ⊃ 〈yi : xi 〉〈z : xn 〉A (10, (Subs), (S⊃))12. `L z=xn ⊃ xn=z (=S)13. `L z=xn ⊃ 〈[z/xn]yi : xi 〉〈z : xn 〉A ⊃ 〈yi : xi 〉〈z : xn 〉A. (7, 9, 11, 12)

14. `L xn=yn ⊃ 〈yn : z 〉z=xn ((=S), (SAt))15. `L xn=yn ⊃ 〈yn : z 〉〈[z/xn]yi : xi 〉〈z : xn 〉A

⊃ 〈yn : z 〉〈yi : xi 〉〈z : xn 〉A. 13, 14, (Subs), (S⊃)16. `L xn=yn ⊃ 〈yi : xi 〉A ⊃ 〈yn : z 〉〈yi : xi 〉〈z : xn 〉A. 5, 1517. `L x1 =y1 ∧ . . . ∧ xn−1 =yn−1 ⊃ A ⊃ 〈yi : xi 〉A. (induction hypothesis)18. `L x1 =y1 ∧ . . . ∧ xn=yn ⊃ A ⊃ 〈yn : z 〉〈yi : xi 〉〈z : xn 〉A. (16, 17)19. `L x1 =y1 ∧ . . . ∧ xn=yn ⊃ A ⊃ 〈y1, . . . , yn : x1, . . . , xn 〉A. (18, def. 3.14)

Lemma 5.15 (Closure under transformations)For any L-formula A and transformation τ on L ,

(Subτ ) `L A iff `L Aτ .

Proof The proof is exactly as in lemma 4.12.

6 Correspondence

A well-known feature of Kripke semantics for propositional modal logic is that variousmodal principles correspond to conditions on the accessibility relation, in the sense thatthe principle is valid in all and only those Kripke frames whose accessibility relationsatisfies the condition: 2p ⊃ p corresponds to (or defines) the class of reflexive frames,p ⊃ 23p the class of symmetrical frames, and so on.

In our counterpart semantics, all these facts are preserved if we translate the sentenceletters of propositional modal logic into null-ary predicates (or other sentences withoutfree variables). Things are slightly more complex if we replace the sentence letters byformulas with free variables. For example, the general schema 2A ⊃ A, where A maycontain arbitrarily many free variables, is valid in a counterpart structure iff (i) everyworld can see itself, and (ii) every individual (and every sequence of individuals) at everyworld is a counterpart of itself (relative to some counterpart relation). To see why (i) isnot enough, consider what is required for the validity of 2Fx ⊃ Fx. Loosely speaking,the antecedent 2Fx is true at w iff all counterparts of x are F at all accessible worlds.This does not entail that x is F at w unless (i) w can see itself and (ii) x is its owncounterpart at w.

In a sense, formulas containing free variables don’t just express properties of worlds, butrelations between a world and a (finite) sequence of individuals. In any given counterpartmodel, the truth-value of Fx is fixed by choosing a world. In this sense, the formulaexpresses just a property of worlds. On the other hand, the truth-value of ∀xFx (or2Fx) at a world is not simply a function of the truth-value of Fx at that world or otherworlds. Whether ∀xFx is true at w depends on whether Fx is true at w relative toevery choice of an individual d ∈ Dw as value of x. (Similarly, whether 2Fx is trueat w depends on whether Fx is true at all accessible worlds w′ relative to every choiceof an x-counterpart as value of x.) In a Tarski-style semantics this is rendered explicitby the fact that formulas with free variables are evaluated not only relative to a world,but relative to a world w and an infinite sequence of individuals from w, representingdifferent assignments of values to the variables. (Our Mates-style semantics incorporatesthe assignment function in the interpretation function V ; hence our rules for quantifiersquantify over alternative interpretations rather than alternative assignments.) That’sthe sense in which formulas express properties of sequences. Tarski’s semantics mightmight suggest that the relevant sequences are infinite, but actual formulas of standardfirst-order logic only contain a finite number of variables and so only ever constrain afinite initial segment of a Tarskian sequence.First a brief review of some definitions from propositional modal logic.

Definition 6.1 (Languages of propositional modal logic)A set of formulas L0 is a (unimodal) propositional language if there is a denumerableset of symbols Prop (the sentence letters of L0) distinct from {¬,⊃,2} such thatL0 is generated by the rule

P | ¬A | (A ⊃ B) | 2A,

where P ∈ Prop.

Note that any language L of quantified modal logic is also a unimodal propositionallanguage, with sentence letters defined as all L-formulas not of the form ¬A,A ⊃ B or2A. (So ∀x2(Fx ⊃ Gx), for example, is a sentence letter.) For future reference, let’scall such formulas quasi-atomic.

Definition 6.2 (Quasi-atomic formulas)A formula A of quantified modal logic is quasi-atomic if it is not of the form¬B,B ⊃ C or 2B.

Definition 6.3 (Frames and valuations)A frame is a pair consisting of a non-empty set W and a relation R ⊆W 2.

A valuation of a unimodal propositional language L0 on a frame F = 〈W,R〉 is afunction V that maps every sentence letter of L0 to a subset of W .

Definition 6.4 (Propositional truth)For any frame F = 〈W,R〉, point w ∈W , and valuation V on F ,

F , V, w K P for P ∈ Prop iff w ∈ V (P ),

F , V, w K ¬B iff F , V, w 6 K B,

F , V, w K B ⊃ C iff F , V, w 6 K B or F , V, w K C,

F , V, w K 2B iff F , V, w′ K B for all w′ with wRw′.

Definition 6.5 (Frame validity)A formula A of a unimodal propositional language is valid in a frame F = 〈W,R〉if F , V, w K A for all w ∈W and valuation functions V of the language on F . Aset of formulas A is valid in a frame F if all members of A are valid in F .

To keep things simple, I will focus on positive models for a moment.

Definition 6.6 (n-sequential accessibility relations)Given a total counterpart structure S = 〈W,R,U,D,K 〉 and number n ∈N, the n-sequential accessibility relation RnS of S is the binary relation suchthat 〈w, d1, . . . , dn 〉RnS 〈w′, d′1, . . . , d′n 〉 iff wRw′ and for some C ∈ Kw,w′ ,d1Cd

′1, . . . , dnCd

′n.

(Note that R0S = R.) We can reformulate the semantics of section 2 in terms of RnS .

Lemma 6.7 (Sequential semantics)Let A(x1, . . . , xn) be a formula with free variables x1, . . . , xn. Restricted to totalstructures S and interpretations V , the clause for the box in definition 2.7, viz.

w, V S 2A(x1, . . . , xn) iff w′, V ′ S A for all w′, V ′ such that wRw′ and Vw .V ′w′ .

is equivalent to

w, V S 2A(x1, . . . , xn) iff w′, V ′ S A(x1, . . . , xn) for all w′, V ′ such that〈w, Vw(x1), . . . , Vw(xn)〉RnS 〈w′, V ′w′(x1, ) . . . , V ′w′(xn)〉.

Proof By definitions 2.7 and 2.6, w, V S 2A(x1, . . . , xn) iff

(1) w′, V ′ S A(x1, . . . , xn) for all w′, V ′ such that wRw′ and for some C ∈ Kw,w′ and allvariables x, Vw(x) is C-related to V ′w′(x).

By lemma 2.10, it doesn’t matter what V ′ assigns to variables not in A(x1, . . . , xn). So (1) isequivalent to

(2) w′, V ′ S A(x1, . . . , xn) for all w′, V ′ such that wRw′ and for some C ∈ Kw,w′ and allvariables xi ∈ x1, . . . , xn, Vw(xi) is C-related to V ′w′(xi).

By definition 6.6, 〈w, Vw(x1), . . . , Vw(xn)〉RnS 〈w′, V ′w′(x1), . . . , Vw(xn)〉 iff wRw′ and for someC ∈ Kw,w′ and all variables xi ∈ x1, . . . , xn, Vw(xi) is C-related to V ′w′(xi). So (2) is equivalentto

(3) w′, V ′ S A(x1, . . . , xn) for all w′, V ′ such that 〈w, Vw(x1), . . . , Vw(xn)〉RnS 〈w′, V ′w′(x1), . . . , V ′w′(xn)〉.

By lemma 2.9, the truth-value of A(x1, . . . , xn) at a world w in a model S , V neverdepends on the values V assigns to variables other than x1, . . . , xn, nor on the valuesV assigns to x1, . . . , xn relative to worlds other than w. Thus we can factor V into apredicate interpretation I and the sequence Vw(x1), . . . , Vw(xn) specifying the valuesassigned to x1, . . . , xn at w, and once again reformulate our semantics.

Definition 6.8 (Rank)Let ρ be some fixed “alphabetical” order on the variables of L , i.e. a bijectionVar→ N+. I will use v to denote the inverse of ρ, so that v1 is the alphabeticallyfirst variable, v2 the second, and so on. The rank of an L-formula A is the smallestnumber r ∈ N such that all members of V ar(A) have a ρ-value less than r.

Definition 6.9 (Finitary satisfaction)Let A be an L-formula and r a number greater or equal to A’s rank. Let S =〈W,R,U,D,K 〉 be a total counterpart structure, I a predicate interpretation on S ,w a member of W , and d1, . . . , dr (not necessarily distinct) elements of Uw. Then

w, d1, . . . , dr �S ,I Px1 . . . xn iff 〈dρ(x1), . . . , dρ(xn) 〉 ∈ Iw(P ).

w, d1, . . . , dr �S ,I ¬A iff w, d1, . . . , dr 6�S ,I A.

w, d1, . . . , dr �S ,I A ⊃ B iff w, d1, . . . , dr 6�S ,I A or w, d1, . . . , dr �S ,I B.

w, d1, . . . , dr �S ,I ∀xA iff w, d′1, . . . , d′r �S ,I A for all d′1, . . . , d′r such that

d′ρ(x) ∈ Dw and d′i = di for all i , ρ(x).

w, d1, . . . , dr �S ,I 〈y : x〉A iff w, d′1, . . . , d′r �S ,I A for all d′1, . . . , d′r such that

d′ρ(x) = dρ(y) and d′i = di for all i , ρ(x).

w, d1, . . . , dr �S ,I 2A iff w′, d′1, . . . , d′r �S ,I A for all w, d′1, . . . , d′r such that〈w, d1, . . . , dr 〉RnS 〈w′, d′1, . . . , d′n 〉,

where RnS is the n-sequential counterpart relation of S .

Notice that this looks just like standard Kripke semantics for a propositional modallanguage with multiple box operators 2, ∀v1, . . . ,∀vr, 〈v1 : v1 〉, 〈v1 : v2 〉, . . . , 〈vr : vr 〉, allgoverned by their own accessibility relation between points of the form w, d1, . . . , dr. (As

mentioned on p. 15, there is a bit of redundancy here: if we have substitution operators,a single box operator ∀v1 would be enough.)

Lemma 6.10 (Truth and satisfaction)For any total counterpart structure S = 〈W,R,U,D,K 〉, total interpretation V onS , world w ∈W , and formula A,

w, V S A iff w, d1, . . . , dr �S ,I A,

where I is V restricted to predicates, r is a number greater than or equal to A’srank and d1 = Vw(v1), . . . , dr = Vw(vr).

Proof by induction on A.

(i) A is Px1 . . . xn. w, V S Px1 . . . xn iff 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ) by definition 2.7,iff 〈dρ(x1), . . . , dρ(xn) 〉 ∈ Iw(P ), iff x, d1, . . . , dr �S ,I Px1 . . . xn by definition 6.9.

(ii) A is ¬B. w, V S ¬B iff w, V 6 S B by definition 2.7, iff w, d1, . . . , dr 6�S ,I B byinduction hypothesis (since B has rank ≤ r), iff w, d1, . . . , dr �S ,I ¬B by definition 6.9.

(iii) A is B ⊃ C. w, V S B ⊃ C iff w, V 6 S B or w, V S C by definition 2.7, iffw, d1, . . . , dr 6�S ,I B or w, d1, . . . , dr �S ,I C by induction hypothesis (since B and Chave rank ≤ r), iff w, d1, . . . , dr �S ,I B ⊃ C by definition 6.9.

(iv) A is ∀xB. By definition 2.7, w, V S ∀xB iff w, V ′ S B for all existential x-variants V ′of V on w. By definition 2.5, V ′ is an existential x-variant of V on w iff V and V ′ agreeon all predicates, V ′w(x) ∈ Dw and V ′w(y) = Vw(y) for all y , x. Take any such V ′. Byinduction hypothesis (sinceB has rank≤ r), w, V ′ S B iff w, V ′w(v1), . . . , V ′w(vr) S ,I B.So w, V S ∀xB iff w, V ′w(v1), . . . , V ′w(vr) S ,I B for all V ′ such that V ′w(x) ∈ Dw andV ′w(y) = Vw(y) for all y , x. In other words, w, V S ∀xB iff w, d′1, . . . , d′r S ,I B for alld′1, . . . , d

′r such that d′ρ(x) ∈ Dw and d′i = di for all i , ρ(x), iff w, d1, . . . , dr �S ,I ∀xB

by definition 6.9.

(v) A is 〈y : x〉B. By definition 2.7, w, V S 〈y : x〉B iff w, V ′ S B where V ′ is thex-variant of V on w with V ′w(x) = Vw(y). By induction hypothesis (since B hasrank ≤ r), w, V ′ S B iff w, V ′w(v1), . . . , V ′w(vr) �S ,I B. So w, V S 〈y : x〉B iffw, d′1, . . . , d

′r �S ,I B for all d′1, . . . , d′r such that d′ρ(x) = dρ(y) and d′i = di for all i , ρ(x),

iff w, d1, . . . , dr �S ,I 〈y : x〉B by definition 6.9.

(vi) A is 2B. By definition 2.7, w, V S 2B iff w′, V ′ S B for all w′, V ′ with wRw′ andVw . V

′w′ . By definition 2.6 and totality of S and V , the latter holds iff V ′ and V

agree on all predicates and for some C ∈ Kw,w′ and all variables x, Vw(x)CV ′w′(x).Take any such w′, V ′. By induction hypothesis (since B has rank ≤ r), w′, V ′ S B

iff w′, V ′w(v1), . . . , V ′w(vr) �S ,I B. So w, V S 2B iff w′, V ′w(v1), . . . , V ′w(vr) S ,I B forall w′, V ′ with wRw′ and Vw . V ′w′ , iff w′, d′1, . . . , d

′r S ,I B for all w′, d′1, . . . , d′r such

that 〈w, d1, . . . , dr 〉RnS 〈w′, d′1, . . . , d′n 〉 by definition 6.6, iff w, d1, . . . , dr �S ,I 2B bydefinition 6.9.

Clearly the evaluation of a formula whose only box operator is 2 does not depend onthe accessibility relations associated with the quantificational box operators (∀x, 〈y : x〉).As we will see, the same is true if we consider the evaluation of modal schemas like2A ⊃ A, i.e. the set of formulas that result from 2p ⊃ p by uniformly substitutingarbitrary L-formulas for p. In this way, every purely modal schema corresponds to aconstraint on sequential accessibility relations in counterpart structures.To make this connection between counterpart models and (unimodal) Kripke models

even more explicit, we use the following terminology.

Definition 6.11 (Opaque Propositional Guise)The n-ary opaque propositional guise of a total counterpart structure S =〈W,R,U,D,K 〉 is the Kripke frame 〈Wn

S , RnS 〉 where Wn

S is the set of points〈w, d1, . . . , dn 〉 such that w ∈W,d1 ∈ Uw, . . . , dn ∈ Uw, and RnS is the n-accessibilityrelation for S . The n-ary opaque propositional guise of a predicate interpretation Ifor a language L on S is the valuation function V n on 〈Wn

S , RnS 〉 such that for every

quasi-atomic formula A ∈ L , V n(A) = {〈w, d1, . . . , dn 〉 : w, d1, . . . , dn �S ,I A}.

Lemma 6.12 (Truth-preservation under opaque guises)For any total counterpart structure S = 〈W,R,U,D,K 〉, predicate interpretation Ion S , world w ∈W , individuals d1, . . . , dn ∈ Uw, and L-formula A with rank ≤ n,

w, d1, . . . , dn �S ,I A iff Sn, V n, 〈w, d1, . . . , dn 〉 K A,

where Sn and V n are the n-ary opaque propositional guises of S and I respectively.

Proof by induction on A, where quasi-atomic formulas all have complexity zero.

(i) A is quasi-atomic. By definition 6.17, V n(A) = {〈w, d1, . . . , dn 〉 : w, d1, . . . , dn �S ,I A}.So w, d1, . . . , dn �S ,I A iff 〈w, d1, . . . , dn 〉 ∈ V n(A), iff Sn, V n, 〈w, d1, . . . , dn 〉 K A bydefinition 6.4.

(ii) A is ¬B. w, d1, . . . , dn S ,I ¬B iff w, d1, . . . , dn 6 S ,I B by definition 6.9, iff Sn, V n, 〈w, d1, . . . , dn 〉 6 KB by induction hypothesis, iff Sn, V n, 〈w, d1, . . . , dn 〉 K ¬B by definition 6.4.

(iii) A is B ⊃ C. w, d1, . . . , dn S ,I B ⊃ C iff w, d1, . . . , dn 6 S ,I B or w, d1, . . . , dn S ,I C

by definition 6.9, iff Sn, V n, 〈w, d1, . . . , dn 〉 6 K B or Sn, V n, 〈w, d1, . . . , dn 〉 K C byinduction hypothesis, iff Sn, V n, 〈w, d1, . . . , dn 〉 K B ⊃ C by definition 6.4.

(iv) A is 2B. w, d1, . . . , dn S ,I 2B iff w′, d′1, . . . , d′n �S ,I B for all w, d′1, . . . , d′r such that〈w, d1, . . . , dr 〉RnS 〈w′, d′1, . . . , d′n 〉 by definition 6.9, iff S∗, V ∗, 〈w′, d′1, . . . , d′n 〉 K B forall such w, d′1, . . . , d

′r by induction hypothesis, iff S∗, V ∗, 〈w, d1, . . . , dn 〉 K 2B by

definition 6.4.

Lemma 6.13 (Finite correspondence transfer)If A is a formula of (unimodal) propositional modal logic that is valid in all and onlythe Kripke frames in some class F , and n ∈ N, then the set of L-formulas that resultfrom A by uniformly substituting sentence letters by L-formulas of rank ≤ n ispositively valid in all and only the total counterpart structures S = 〈W,R,U,D,K 〉whose n-ary opaque propositional guise is in F .

Proof Assume A is valid in all and only the Kripke frames in F , and let p1, . . . , pk be thesentence letters in A. Let S = 〈W,R,U,D,K 〉 be a total counterpart structure whose n-aryopaque propositional guise 〈Wn

S , RnS 〉 is in F . Suppose for reductio that some formula A′ is

not (positively) valid in S that results from A by uniformly substituting the sentence letterspi in A by L-formulas pL

i of rank ≤ n. Then there is an interpretation V on S and a worldw ∈W such that w, V 6 S A

′. By lemma 6.10, this means that w, d1, . . . , dr 6 S ,I A′, where I

is V restricted to predicates and d1 = Vw(v1), . . . , dr = Vw(vr). By lemma 6.12, it follows thatSn, V n, 〈w, d1, . . . , dn 〉 6 K A′. But then Sn, V n′, 〈w, d1, . . . , dn 〉 6 K A, where V n′ is suchthat for all sentence letters pi in A, V n′(pi) = V n(pL

i ). This contradicts the assumption thatA is valid in 〈Wn

S , RnS 〉.

We also have to show that the relevant L-formulas are valid only in structures S whosen-ary opaque propositional guise is in F . So let S be a structure whose guise 〈Wn

S , RnS 〉 is

not in F . Since A is valid only in frames in F , we know that there is some valuation V on〈Wn

S , RnS 〉 and some 〈w, d1, . . . , dn 〉 ∈ Wn

S such that 〈WnS , R

nS 〉, V, 〈w, d1, . . . , dn 〉 6 K A. Let

A′ result from A by uniformly substituting each sentence letter pi in A by an n-ary predicatePi followed by the variables v1 . . . vn, with distinct predicates for distinct sentence letters. LetI be a predicate interpretation such that for all Pi and w′ ∈ W , Iw′(Pi) = {〈d′1, . . . , d′n 〉 :〈w′, d′1, . . . , d′n 〉 ∈ V (pi)}. A simple induction on subformulas B of A shows that for all〈w′, d′1, . . . , d′n 〉 ∈Wn

S , 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 K B iff w′, d′1, . . . , d′n � B′, where B′ is

B with all pi replaced by Piv1 . . . vn. Given that 〈WnS , R

nS 〉, V, 〈w, d1, . . . , dn 〉 6 K A it follows

that w, d1, . . . , dn 6�S ,I A′.

(i) B is a sentence letter pi. Then B′ is Piv1 . . . vn. 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 K pi iff

〈w′, d′1, . . . , d′n 〉 ∈ V (pi) by definition 6.4, iff 〈d′1, . . . , d′n 〉 ∈ Iw(Pi) by construction of I,iff w′, d′1, . . . , d′n �S ,I Piv1 . . . vn by definition 6.9.

(ii) B is ¬C. ThenB′ is ¬C ′, where C ′ is C with all pi replaced by Piv1 . . . vn. 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 K

¬C iff 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 6 K C by definition 6.4, iff w′, d′1, . . . , d

′n 6�S ,I C

′

by induction hypothesis, iff w′, d′1, . . . , d′n �S ,I ¬C ′ by definition 6.9.

(iii) B is C ⊃ D. Then B′ is C ′ ⊃ D′, where C ′ andD′ are C andD respectively with all pi re-placed by Piv1 . . . vn. 〈Wn

S , RnS 〉, V, 〈w′, d′1, . . . , d′n 〉 K C ⊃ D iff 〈Wn

S , RnS 〉, V, 〈w′, d′1, . . . , d′n 〉 6 K

C or 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 K D by definition 6.4, iff w′, d′1, . . . , d′n 6�S ,I C

′ orw′, d′1, . . . , d

′n �S ,I D′ by induction hypothesis, iff w′, d′1, . . . , d

′n �S ,I C ′ ⊃ D′ by

definition 6.9.

(iv) B is2C. ThenB′ is2C ′, where C ′ is C with all pi replaced by Piv1 . . . vn. 〈WnS , R

nS 〉, V, 〈w′, d′1, . . . , d′n 〉 K

2C iff 〈WnS , R

nS 〉, V, 〈w′′, d′′1 , . . . , d′′n 〉 K C for all 〈w′′, d′′1 , . . . , d′′n 〉 with 〈w′, d′1, . . . , d′n 〉RnS 〈w′′, d′′1 , . . . , d′′n 〉

by definition 6.4, iff w′′, d′′1 , . . . , d′′n 6�S ,I C

′ for all such 〈w′′, d′′1 , . . . , d′′n 〉 by inductionhypothesis, iff w′, d′1, . . . , d′n �S ,I 2C

′ by definition 6.9.

Given that a modal schema restricted to the variables v1, . . . , vn defines a constrainton the n-sequential accessibility relation of a counterpart structure S , the unrestrictedschema defines a constraint on all sequential accessibility relations. Let’s fold these intoa single entity.

Definition 6.14 (Sequential accessibility relation)The sequential accessibility relation R∗S of a total counterpart structure S is theunion of the n-sequential accessibility relations RnS of S , i.e. R∗S =

⋃n∈NR

nS .

Definition 6.15 (Opaque Propositional Guise (part 1))The opaque propositional guise of a total counterpart structure S = 〈W,R,U,D,K 〉is the disjoint union of the n-ary opaque propositional guises of S , i.e. the Kripkeframe 〈W ∗S , R∗S 〉 such that R∗S is the sequential accessibility relation of S and W ∗Sis the set of points w∗ such that for some n ∈ N, world w ∈ W and individualsd1, . . . , dn ∈ Uw, w∗ = 〈w, d1, . . . , dn 〉.

Theorem 6.16 ((Positive) correspondence transfer)If A is a formula of (unimodal) propositional modal logic that is valid in all andonly the Kripke frames in some class F , then the set of L-formulas that result fromA by uniformly substituting sentence letters by L-formulas is positively valid in alland only the total counterpart structures S whose opaque propositional guise is inF .

Proof Since validity in propositional modal logic is preserved under disjoint unions, A isvalid in the opaque propositional guise of a structure S iff A is valid in each n-ary opaquepropositional guise of S , with n ∈ N. (See e.g. [Blackburn et al. 2001], p.140, Theorem 3.14.(i).)Thus the opaque propositional guise of S is in F iff all n-ary opaque propositional guises of Sare in F .

Assume A is valid in all and only the Kripke frames in F . Let A′ be an L-formula thatresults from A by uniformly substituting sentence letters by L-formulas. By lemma 6.13, A′ is(positively) valid in all total counterpart structures S whose n-ary propositional guise is in F ,where n is the rank of A′. Any total structure whose propositional guise is in F satisfies thiscondition.

To show that the A schema is valid only in structures S whose guise is in F , let S be astructure whose guise is not in F . Then there is some n such that the n-ary guise of S is notin F . By lemma 6.13, there is an L-substitution instance A′ of A with rank n that is not validin S .

As a union of relations of different arity, R∗ is a somewhat gerrymandered entity. Itmay help to understand statements about R∗ as universal statements about its membersRn. For example, the schema 2A ⊃ A is valid iff (0) every world can see itself and(1) every individual at every world is its own counterpart (relative to some counterpartrelation), (2) every pair of individuals at every world is its own counterpart, and so on.Each clause (i) covers instances of the schema with i free variables.In Tarski’s semantics for first-order logic, every formula is evaluated relative to an

infinite sequence of individuals. Accordingly, the points of evaluation in a Tarski-stylefirst-order modal logic would consist of a world together with an infinite sequence ofindividuals. Quantifiers and modal operators shift these points of evaluation. Thus onemight expect that modal schemas constrain the infinitary accessibility relation R∞ thatholds between a pair 〈w, s〉 of a world w and an infinite sequence s on Uw and anothersuch pair 〈w′, s′ 〉 iff for some C ∈ Kw,w′ , each element si of s has the correspondingelement s′i of s′ as C-counterpart. But this is false. For example, 2⊥ is valid in a Kripkeframe iff no point can see itself. Suppose in some structure S , no point 〈w, s〉 standsin R∞ to any point 〈w′, s′ 〉, although for some w,w′, wRw′. Since ¬〈w, s〉R∞〈w′, s′ 〉,we know that there is no C ∈ Kw,w′ such that s1Cs

′1, s2Cs

′2, . . .. In other words, for all

C ∈ Kw,w′ there is some i such that ¬siCs′i. But (as long as Kw,w′ is infinite) this iscompatible with the fact that for all i there is a C ∈ Kw,w′ such that s1Cs

′1, . . . , siCs

′i.7

The general point is that in a Kripke model with points of the form 〈w, s〉, formulas canexpress arbitrary properties of world and infinite sequences of individuals; by contrast,formulas of L can only talk about a finite initial segment of a sequences.Thus far, I have set aside negative counterpart models. In negative models, variables

can be undefined, so sequential accessibility relations must be redefined to hold betweenpairs of a world w and a possibly gappy sequence of individuals from Dw, i.e. a partialfunction from numbers to members of Dw. Now we could re-run the above arguments,but we can also cut all this short by using lemma 2.12.

7 Thanks here to Joel David Hamkins and Sam Roberts.

Definition 6.17 (Opaque Propositional Guise (part 2))The opaque propositional guise of a partial counterpart structure S is the opaquepropositional guise of its positive transpose S+. Accordingly, the sequential acces-sibility relation R∗S of S is the sequential accessibility relation of S+.

Corollary 6.18 (Negative correspondence transfer)If A is a formula of (unimodal) propositional modal logic that is valid in all andonly the Kripke frames in some class F , then the set of L-formulas that result fromA by uniformly substituting sentence letters by L-formulas is negatively valid in alland only the single-domain counterpart structures S whose opaque propositionalguise is in F .

Proof Assume A is valid in all and only the Kripke frames in F . Let A′ be an L-formulathat results from A by uniformly substituting sentence letters by L-formulas. Let S be asingle-domain counterpart structure whose guise is in F , and let w, V be a world from S anda partial interpretation on S . By lemma 2.12, w, V S A

′ iff w, V + S+ A′. By theorem 6.16,w, V + S + A′. So A′ is negatively valid in S .

Now let S be a structure whose guise is not in F . By theorem 6.16, there is a substitutioninstance A′ of A, a world w and a total interpretation V ′ on S + such that w, V ′ 6 S + A′.Define V so that V and V ′ agree on all predicates and for all worlds w′ and variables x, Vw′(x)is V ′w′(x) if V ′w′(x) ∈ Dw, otherwise Vw′(x) is undefined. Then V ′ is the positive transpose ofV . By lemma 2.12, w, V S A

′ iff w, V ′ S+ A′. So w, V 6 S A′. So A′ is not negatively valid

in S .

Here are some applications of theorems 6.16 and 6.18.

Corollary 6.19 (Correspondence facts)1. The schema 2A ⊃ A is valid in a counterpart structure S iff R∗S is reflexive.

2. The schema A ⊃ 23A is valid in a counterpart structure S iff R∗S is symmet-rical.

3. The schema 2A ⊃ 22A is valid in a counterpart structure S iff R∗S istransitive.

4. The schema 3A ⊃ 23A is valid in a counterpart structure S iff R∗S iseuclidean.

There are of course further aspects of structures that can only be captured in quantifiedmodal logic.

Definition 6.20 (Types of structures)A structure S = 〈W,R,U,D,K 〉 is

total if every individual at every world has at least one counterpart at everyaccessible world: whenever wRw′ and d ∈ Uw then there is a d′ ∈ Uw′ with〈d,w〉C〈d′, w′ 〉;

functional if every individual at every world has at most one counterpart at everyaccessible world;

inversely functional if no two individuals at any world have a common counterpartat some accessible world;

injective if it is both functional and inversely functional.

[To be continued. . . ]

7 Canonical models

We can use the canonical model technique to prove (strong) completeness. Let me beginwith an informal exposition of the key ideas.

Let’s hold fixed a particular language L , with or without substitution. A formula A ofL is a syntactic consequence in a logic L of a set Γ of L-formulas L, for short: Γ `L A,iff there are 0 or more sentences B1, . . . , Bn ∈ Γ such that `L B1 ∧ . . . ∧ Bn ⊃ A. (Forn = 0, B1 ∧ . . . ∧Bn ⊃ A is A.) Γ is L-consistent iff there are no members A1, . . . , An ofΓ such that `L ¬(A1 ∧ . . . ∧An).A logic L is weakly complete with respect to a class of models M iff L contains every

formula valid in M: whenever A is valid in M, then `L A. Equivalently, every formulaA < L is false at some world in some model in M. L is strongly complete with respect toM iff whenever A is a semantic consequence of a set of formulas Γ in M, then Γ `L A.Since Γ 0L A iff Γ ∪ {¬A} is L-consistent, and A is a semantic consequence of Γ in Miff no world in any model in M verifies all members of Γ ∪ {¬A}, this means that L isstrongly complete with respect to M iff for every L-consistent set of formulas Γ there is aworld in some model in M at which all members of Γ are true.

To prove strong completeness, we associate with each logic L a canonical model ML.The worlds of ML are construed as maximal L-consistent sets of formulas, and it is shownthat a formula A is true at a world in ML iff A is a member of that world. Since every

L-consistent set of formulas can be extended to a maximal L-consistent set, it followsthat every L-consistent set of formulas is verified at some world in ML, and thereforethat L is strongly complete with respect to every model class that contains ML.To ensure that a formula is true at a world iff it is a member of the world, the

interpretation V in a canonical model assigns to each variable x at each world w someindividual [x]w and to each predicate P at w the set of n-tuples 〈[x1]w, . . . , [xn]〉 suchthat Px1 . . . xn ∈ w. The customary way to make this work is to identify [x]w with theclass of variables z such that x= z ∈ w. The domains therefore consist of equivalenceclasses of variables.

A well-known problem now arises from the fact that first-order logic does not requireevery individual to have a name. This means that there are consistent sets Γ that contain∃xFx as well as ¬Fxi for every variable xi. If we extend Γ to a maximal consistent setw and apply the construction just outlined, then Vw(F ) would be the empty set. So wewould have w, V ¬∃xFx, although ∃xFx ∈ w. To avoid this, one requires that theworlds in a canonical model are all witnessed so that whenever an existential formula∃xFx is in w, then some witnessing instance Fy is in w as well. But we still want theset Γ to be verified at some world. So the worlds are construed in a larger language L∗

that adds infinitely many new variables to the original language L . The new variablesmay then serve as witnesses. (In the new language, there are again consistent sets ofsentences that are not included in any world, but not so in the old language.)In modal logic, this problem reappears in another form. Assume Γ contains 3∃xFx

but also 2¬Fxi for every L∗-variable xi. Using Kripke semantic, we then need a worldw′ accessible from the Γ-world that verifies all instances of ¬Fxi, as well as ∃xFx. Butthen w′ isn’t witnessed!One way out is to stipulate that worlds in ML must be modally witnessed in the

sense that whenever 3∃xA ∈ w, then 3[y/x]A ∈ w for some (possibly new) variabley. Metaphysically speaking, this means that whenever it is possible that somethingis so-and-so, then we can point at some object at the actual world which is possiblyso-and-so. In single-domain models, this has the unfortunate consequence of renderingthe Barcan Formula valid. In dual-domain semantics, the “modal witness” can comefrom the outer domain, so that ∀x2Fx does not entail 2∀xFx. However, if the relevantlogic is classical rather than free, the Barcan Formula still comes out valid, despite thefact that it is not entailed by the principles of classical first-order logic and K.

Counterpart semantics provides a less drastic response that does not introduce undesiredvalidities and thereby reduce the applicability of the canonical model technique. Incounterpart semantics, the truth of 2¬Fxi at some world w only requires that ¬Fxi istrue at w′ under all w′-images V ′ of V at w – i.e. under interpretations V ′ such thatV ′w′(xi) is some counterpart of Vw(xi) = [x1]w. Suppose, for example, that [x1]w = {x1}and each individual [xi]w at w has [xi+1]w′ as unique counterpart at w′. Then the truth

of 2¬Fx1,2¬Fx2, etc. at w only requires that ¬Fx1,¬Fx2, etc. are true at w′ underan assignment of [x2]w′ to x1, [x3]w′ to x2, etc. So Fx2, Fx3, . . . ∈ w′, but the variablex1 becomes available to serve as a witness for 3∃xFx.Here we exploit the fact that in counterpart semantics, truth at a world “considered

as actual” can come apart from truth at a world “considered as counterfactual”. Inthe canonical model, membership in a world only coincides with truth at the world “asactual”: A ∈ w iff w, V A. If w′ contains Fx1, it follows that w′, V Fx1. On theother hand, when we look at w′ (“as counterfactual”) from the perspective of w, weevaluate formulas not by the original interpretation function V , but by an image V ′ of V .Given that V ′w′(x1) = [x2]w′ and Fx2 < w

′, w′, V ′ 6 Fx1.Unfortunately, this creates a complication. Suppose we want to show that for every

formula A and world w in ML,

2A ∈ w iff w, V 2A, (8)

where V is the interpretation function of ML. Proceeding by induction on complexity ofA, we can assume that for all w,

A ∈ w iff w, V A. (9)

In standard Kripke semantics, we now only need to stipulate that w′ is accessible from w

iff w′ contains all A for which w contains 2A. This means that 2A ∈ w iff A ∈ w′ for allw-accessible w′; by (9), the latter holds iff w′, V A for all such w′, i.e. iff w, V 2A bythe semantics of the box. In counterpart semantics, this line of thought no longer goesthrough, since w, V 2A only means that A is true at all accessible worlds w′ consideredas counterfactual: w′, V ′ A. By contrast, (9) only considers worlds as actual; it doesnot tell us that A ∈ w iff w, V ′ A.Take a concrete example. Suppose w and w′ look as follows.

w : {x,y,2x,y,2Fx,2Fy, . . .}w′ : {¬Fx, Fu, Fv, u,y, . . .}

We can tell that [x]w′ does not qualify as counterpart of [x]w, since it doesn’t satisfy the“modal profile” that w attributes to [x]w: w contains 2Fx, so all counterparts of [x]wshould satisfy F . Both [u]w′ and [v]w′ meet this condition. So we might say that both ofthem are counterparts of [x]w. But then they should also be counterparts of [y]w, andwe get a violation of the “joint modal profile” expressed by 2x,y, which requires thatno counterpart of [x]w is identical to any counterpart of [y]w. Structurally, this is the“problem of internal relations” noted in [Hazen 1979]. In response, we assume that therecan be multiple counterpart relations linking the individuals at w to those at w′. Onerelation links [x]w with [u]w′ and [y]w with [v]w, another [x]w with [v]w′ and [y]w with

[u]w′ . So [x]w does have both [u]w′ and [v]w′ as counterpart, but the pair 〈[x]w, [y]w 〉 hasonly two rather than four counterparts.

It proves convenient to impose a further restriction on canonical counterpart relations:every counterpart relation C in a canonical model corresponds to a transformation τso that [x]w at w has [xτ ]w′ at w′ as counterpart (unless [xτ ]w′ is empty – see below).This means that if an individual [x]w at w has two counterparts at w′ under the samecounterpart relation, then there must be at least two variables x, y in [x]w, so that [xτ ]w′and [yτ ]w′ can serve as the two counterparts.

So here is how we might construct the accessibility and counterpart relations. Let’s saythat w′ is accessibility from w via a transformation τ , for short: w τ−→ w′, iff w′ containsAτ whenever w contains 2A. Define wRw′ to be true iff w

τ−→ w′ for some τ , and letC be a counterpart relation between w and w′ iff C = {〈[x]w, [y]w′ 〉 : xτ = y} for somew

τ−→ w′.If w τ−→ w′, then [x]w has [xτ ]w′ as counterpart. Since [xτ ]w′ = Vw′(xτ ) and Vw′(xτ ) =

V τw′(x), V τ is a w′-image of V at w. If V τ were the only w′-image of V at w, it would be

easy to prove that 2A ∈ w iff w, V 2A. Assume 2A ∈ w. Then Aτ ∈ w′ wheneverw

τ−→ w′. The induction hypothesis (9) tells us that Aτ ∈ w′ iff w′, V Aτ . By thetransformation lemma (lemma 3.13), w′, V τ A iff w′, V Aτ : A is true at w′ ascounterfactual iff Aτ is true at w′ as actual. So 2A ∈ w iff for all accessible w′, thereis a transformation τ such that w′, V τ A. If V τ is the only w′-image of Vw at w′, itfollows that 2A ∈ w iff w, V 2A.The remaining problem is that V τ may not be the only w′-image of V at w – and

not only because there can be several τ with w τ−→ w′. For example, assume w containsx=y but not 2x=y. Then there is some world w′ and transformation τ such that w′

contains xτ ,yτ . That is, the individual [x]w = [y]w = {x, y, . . .} at w has two τ -inducedcounterparts at w′, [xτ ]w′ and [yτ ]w′ , which V τ assigns (at w′) to x and y, respectively.But then there will also be another w′-image of V at w which assigns, for example, [yτ ]w′to both x and y.Here is a case where this leads to trouble. Assume we are working with a positive

logic without explicit substitution. Again let w contain x= y but not 2x= y, so thatfor some w τ−→ w′, w′ contains xτ ,yτ . Assume further that w contains 23x,y. So w′

contains 3xτ ,yτ . To verify 23x,y at w, we need to ensure that w′, V ′ 3x,y forall w′-images V ′ of V at w, not just for V τ . Consider the image V ′ that assigns [yτ ]w′to both x and y. To ensure that w′, V ′ 3x , y, there must be some w′ σ−→ w′′ andV ′w′ . V

′′w′′ with w′′, V ′′ x, y. V ′w′ . V ′′w′′ means that there is a σ such that w′ σ−→ w′′

and V ′w′(x)CσV ′′w′′(x) for all x, where Cσ is the counterpart relation induced by σ. Inother words, we need a transformation σ, world w′′ and interpretation V ′′ such thatw′′, V ′′ x,y, where w′ σ−→ w′′ and V ′′ is such that for all x there is a z ∈ V ′w′(x) withzσ ∈ V ′′w′′(x). Since V ′w′(x) = V ′w′(y) = [yτ ]w′ , this means that [yτ ]w′ must have two

counterparts at some w′′ relative to the same transformation σ. But so far, we have noguarantee that this is the case. There has to be a variable z other than yτ such thatw′ contains z=yτ as well as 3z,yτ . The latter ensures that zσ , (yτ )σ ∈ w′′ for somew

σ−→ w′′; [zσ]w′′ and [(yτ )σ]w′′ are then both counterparts at w′′ of [yτ ]w′ . Hence wecomplicate the definition of w τ−→ w′. We stipulate that if w′ does not contain z=yτ and3z,yτ for some suitable z, then w′ is not τ -accessible from w. In general, if w contains2A as well as x= y, and x is free in A, then for w′ to be accessible from w via τ , werequire that it must contain not only Aτ , but also z=yτ and [z/xτ ]Aτ , for some z notfree in Aτ .

This requirement might be easier to understand if we consider the same situation in alanguage with substitution. Here 23x,y and x=y entail 2〈y : x〉3x,y (by (LLs) and(S2)). By the original, simple definition of w τ−→ w′, each world w′ accessible from w via τmust contain 〈yτ : xτ 〉3xτ ,yτ . This formula says that [yτ ]w′ has multiple counterpartsat some accessible world w′′. Before we worry about images other than V τ , we ought tomake sure that 〈yτ : xτ 〉3xτ ,yτ is true at w′ under V τ . This requires that there is avariable z other than yτ such that w′ contains z=yτ and 3z,yτ . In effect, z is a kindof witness for the substitution formula 〈yτ : xτ 〉3xτ ,yτ . Just as an existential formula∃xA must be witnessed by an instance [z/x]A, a substitution formula 〈y : x〉A must bewitnessed by [z/x]A together with z= y. Loosely speaking, 〈y : x〉A(x) says that y isidentical to some x such that A(x). In a canonical model, we want a concrete witness z sothat y is identical to z and A(z). y itself may not serve that purpose, because 〈y : x〉A(x)does not guarantee A(y).

This requirement of substitutional witnessing entails that if w contains 2A, then anyτ -accessible w′ contains not only Aτ , but also z=yτ and [z/xτ ]Aτ (for some suitable z).So we don’t need to complicate the accessibility relation. In our example, since w′ containsAτ whenever w contains 2A, w′ contains 〈yτ : xτ 〉3xτ ,yτ , which settles that [yτ ]w′ hastwo counterparts at some accessible world. Without substitution, 〈yτ : xτ 〉3xτ ,yτ isinexpressible (see lemma 3.10). So we have to limit the accessible worlds by requiringmembership of the relevant witnessing formulas in addition to Aτ .On to the details. Let L be some language with or without substitution and L a

positive or strongly negative quantified modal logic in L . Define the extended languageL∗ by adding infinitely many new variables Var+ to L .

Definition 7.1 (Henkin set)A Henkin set for L is a set H of L∗-formulas that is

1. L-consistent: there are no A1, . . . , An ∈ H with `L(L∗) ¬(A1 ∧ . . . ∧An),

2. maximal: for every L∗-formula A, H contains either A or ¬A,

3. witnessed: whenever H contains an existential formula ∃xA, then there is avariable y < Var(A) such that H contains [y/x]A as well as Ey, and

4. substitutionally witnessed: whenever H contains a substitution formula 〈y :x〉A as well as y=y, then there is a variable z < Var(〈y : x〉A) such that Hcontains y=z.

I write HL for the class of Henkin sets for L in L∗.

If L is without substitution, the fourth clause is trivial.Above I said that witnessing a substitution formula 〈y : x〉A requires y=z as well as

[z/x]A, but in fact y=z is enough, since [z/x]A follows from 〈y : x〉A and y=z by (LV2)(lemma 5.13). I have also added the condition that H contains y=y. In negative logics,a Henkin set may contain y, y as well as 〈y : x〉A; adding y= z would render the setinconsistent.The requirement of substitutional witnessing generalises to substitution sequences:

if H contains a substitution formula 〈y1, . . . , yn : x1, . . . , xn 〉A as well as yi = yi forall yi in y1, . . . , yn, then there are (distinct) new variables z1, . . . , zn such that H con-tains y1 = z1, . . . , yn = zn as well as [z1, . . . , zn/x1, . . . , xn]A. This is easily proved byinduction on n. Suppose H contains 〈y1, . . . , yn : x1, . . . , xn 〉A. By definition 3.14,this is 〈yn : v 〉〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈v : xn 〉A, where v is new. Witnessingrequires yn = zn ∈ H and (hence) [zn/v]〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈v : xn 〉A =〈y1, . . . , yn−1 : x1, . . . , xn−1 〉〈zn : xn 〉A ∈ H for some new zn. By induction hypoth-esis, the latter means that there are (distinct) z1, . . . , zn−1 < Var(〈zn : xn 〉A) such thatH contains y1 = z1, . . . , yn−1 = zn−1 as well as [z1, . . . , zn−1/x1, . . . , xn−1]〈zn : xn 〉A.Since all the xi and zi are pairwise distinct, [z1, . . . , zn−1/x1, . . . , xn−1]〈zn : xn 〉A is 〈zn :xn 〉[z1, . . . , zn−1/x1, . . . , xn−1]A. By (SC1), it follows that [zn/xn][z1, . . . , zn−1/x1, . . . , xn−1]A =[z1, . . . , zn/x1, . . . , xn]A ∈ H.

Definition 7.2 (Variable classes)For any Henkin set H, define ∼H to be the binary relation on the variables of L∗

such that x ∼H y iff x=y ∈ H. For any variable x, let [x]H be {y : x ∼H y}.

Lemma 7.3 (∼-Lemma)∼H is transitive and symmetrical.

Proof Immediate from lemmas 4.10 and 5.12.

Definition 7.4 (Accessibility via transformations)Let w,w′ be Henkin sets and τ a transformation.If L is with substitution, then w′ is accessible from w via τ , for short: w τ−→ w′,

iff for every L-formula A, if 2A ∈ w, then Aτ ∈ w′.If L is without substitution, then w τ−→ w′ iff for every L-formula A and variables

x1 . . . xn, y1, . . . , yn (n ≥ 0) such that the x1 . . . xn are pairwise distinct membersof Varf(A), if x1 = y1 ∧ . . . ∧ xn = yn ∧ 2A ∈ w and yτ1 = yτ1 ∧ . . . ∧ yτn = yτn ∈ w′,then there are variables z1 . . . zn < Var(Aτ ) such that z1 = yτ1 ∧ . . . ∧ zn = yτn ∧[z1 . . . zn/x

τ1 . . . x

τn]Aτ ∈ w′.

This generalises the witnessing requirements on accessible world as explained aboveto multiple variables and negative logics. (In this case, the generalised version for nvariable pairs is not entailed by the requirement for a single pair, unlike in the case ofsubstitutional witnessing.) Note that the x1, . . . , xn need not be all the free variablesin A. Also recall from p.6 that a conjunction of zero sentences is the tautology >; sofor n = 0, the accessibility requirement says that if > ∧ 2A ∈ w and > ∈ w′, then> ∧Aτ ∈ w′ – equivalently: if 2A ∈ w, then Aτ ∈ w′.

Definition 7.5 (Canonical model)The canonical model 〈W,R,U,D,K, V 〉 for L is defined as follows.

1. The worlds W are the Henkin sets HL.

2. For each w ∈ W , the outer domain Uw comprises the non-empty sets [x]w,where x is a L∗-variable.

3. For each w ∈ W , the inner domain Dw comprises the sets [x]w for whichEx ∈ w.

4. The accessibility relation R holds between world w and world w′ iff there issome transformation τ such that w τ−→ w′.

5. C is a counterpart relation ∈ Kw,w′ iff there is a transformation τ such that(i) w τ−→ w′ and (ii) for all d ∈ Uw, d′ ∈ Uw′ , dCd′ iff there is an x ∈ d suchthat xτ ∈ d′.

6. The interpretation V is such that for all L∗-variables x, Vw(x) is either [x]wor undefined if [x]w = ∅, and for all non-logical predicates P , Vw(P ) ={〈[x1]w, . . . , [xn]w 〉 : Px1 . . . xn ∈ w}.

Clause 6 takes into account the fact that in negative logics, ¬Ex entails x , y forevery variable y. So if ¬Ex ∈ w, then [x]w is the empty set. However, we don’t want tosay that empty terms denote the empty set (so that ∅ ∈ Dw, and x=x would have tobe true). Instead, the canonical interpretation assigns to each variable x at w the set[x]w, unless that set is empty, in which case Vw(x) remains undefined. Similarly, clause 5ensures that [x]w at w has [xτ ]w′ as counterpart at w′ only if [xτ ]w′ , ∅.

The term ‘{〈[x1]w, . . . , [xn]w 〉 : Px1 . . . xn ∈ w}’ in clause 4 is meant to denote the setof n-tuples 〈d1, . . . , dn 〉 for which there are variables x1, . . . , xn such that d1 = [x1]w and. . . and dn = [xn]w and Px1 . . . xn ∈ w. These di are guaranteed to be non-empty becausexi =xi ∈ w whenever Px1 . . . xn ∈ w: if L is positive, then `L zi = zi by (=R); if L isnegative, then `L Pz1 . . . zn ⊃ Ezi by (Neg) and hence `L Pz1 . . . zn ⊃ zi=zi by (∀=R)and (FUI∗).

Lemma 7.6 (Charge of canonical models)If L is positive, then the canonical model for L is positive. If L is strongly negative,then the canonical model for L is negative.

Proof If L is positive, then for all L∗-variables x, every Henkin set for L contains x=x (by(=R)). So Vw(x) = [x]w is never empty. Nor is [xτ ]w′ , for any world w′ with w τ−→ w′. Soeverything at any world has a counterpart at every accessible world under every counterpartrelation. So the canonical model for a positive logic is positive.

If L is strongly negative, then every Henkin set for L contains x= x ⊃ Ex, for all L∗-variables x (by (Neg)). So Vw(x) = [x]w , ∅ iff Ex ∈ w, which means that Dw = Uw for allworlds w in the model. So the canonical model for a strongly negative logic is negative.

Lemma 7.7 (Extensibility Lemma)If Γ is an L-consistent set of L∗-sentences in which infinitely many L∗-variables donot occur, then there is a Henkin set H ∈ HL such that Γ ⊆ H.

Proof Let S1, S2, . . . be an enumeration of all L∗-sentences, and z1, z2, . . . an enumerationof the unused L∗-variables in such a way that zi < Var(S1 ∧ . . . ∧ Si). Let Γ0 = Γ, and defineΓn for n ≥ 1 as follows.

(i) If Γn−1 ∪ {Sn} is not L-consistent, then Γn = Γn−1;

(ii) else if Sn is an existential formula ∃xA, then Γn = Γn−1 ∪ {∃xA, [zn/x]A,Ezn};

(iii) else if Sn is a substitution formula 〈y : x〉A, then Γn = Γn−1∪{〈y : x〉A, y=y ⊃ y=zn};

(iv) else Γn = Γn−1 ∪ {Sn}.

Define w as the union of all Γn. We show that w is a Henkin set for L.

1. w is L-consistent. This is shown by proving that Γ0 is L-consistent and that wheneverΓn−1 is L-consistent, then so is Γn. It follows that no finite subset of w is L-inconsistent,and hence that w itself is L-consistent. The base step, that Γ0 is L-consistent is given byassumption. Now assume (for n > 0) that Γn−1 is L-consistent. Then Γn is constructedby applying one of (i)–(iv).

a) If case (i) in the construction applies, then Γn = Γn−1, and so Γn is also L-consistent.

b) Assume case (ii) in the construction applies, and suppose that Γn = Γn−1 ∪{∃xA, [zn/x]A,Ez} is L-inconsistent. Then there is a finite subset {C1, . . . , Cm} ⊆Γn−1 such that

1. `L ¬(C1 ∧ . . . ∧ Cm ∧ ∃xA ∧ [zn/x]A ∧ Ezn).

Let C abbreviate C1 ∧ . . . ∧ Cm. Then

2. `L C ∧ ∃xA ⊃ (Ezn ⊃ ¬[zn/x]A) (1)3. `L ∀zn(C ∧ ∃xA) ⊃ ∀znEzn ⊃ ∀zn¬[zn/x]A (2, (UG), (UD))4. `L C ∧ ∃xA ⊃ ∀zn(C ∧ ∃xA) ((VQ), zn not in Γn−1)5. `L C ∧ ∃xA ⊃ ∀znEzn ⊃ ∀zn¬[zn/x]A. (3, 4)6. `L C ∧ ∃xA ⊃ ∀zn¬[zn/x]A. (5, (∀Ex))7. `L ∀zn¬[zn/x]A↔ ∀x¬A ((AC), zn < Var(A))8. `L C ∧ ∃xA ⊃ ¬∃xA. (6, 7)

So {C1, . . . Cm,∃xA} is not L-consistent, contradicting the assumption that clause(ii) applies.

c) Assume case (iii) in the construction applies (hence L is with substitution), andsuppose that Γn = Γn−1 ∪ {〈y : x〉A, y=y ⊃ y=zn} is L-inconsistent. Then thereis a finite subset {C1, . . . , Cm} ⊆ Γn−1 such that

1. `L ¬(C ∧ 〈y : x〉A ∧ (y=y ⊃ y,z)).

(As before, C is C1 ∧ . . . ∧ Cm.) But then

2. `L C ∧ 〈y : x〉A ⊃ y=y ∧ y,zn (1)3. `L 〈y : zn 〉(C ∧ 〈y : x〉A ⊃ y=y ∧ y,zn) (2, (Subs))4. `L 〈y : zn 〉(C ∧ 〈y : x〉A) ⊃ 〈y : zn 〉y=y ∧ 〈y : zn 〉y,zn (3, (S⊃), (S¬))5. `L C ∧ 〈y : x〉A ⊃ 〈y : zn 〉(C ∧ 〈y : x〉A) ((VS), zn not in Γn−1, Sn)6. `L C ∧ 〈y : x〉A ⊃ 〈y : zn 〉y=y ∧ 〈y : zn 〉y,zn (4, 5)7. `L 〈y : zn 〉y,zn ↔ y,y (SAt)8. `L 〈y : zn 〉y=y ↔ y=y (SAt)9. `L C ∧ 〈y : x〉A ⊃ (y=y ∧ y,y). (6, 7, 8)

So {C1, . . . , Cm, 〈y : x〉A} is L-inconsistent, contradicting the assumption thatclause (iii) applies.

d) Assume case (iv) in the construction applies. Then Γn = Γn−1 ∪ {Sn} is L-consistent, since otherwise (i) would have applied.

2. w is maximal. Assume some formula Sn is not in w. Then case (i) applied to Sn, soΓn−1 ∪ {Sn} is not L-consistent. So there are C1, . . . , Cm ∈ Γn−1 such that `L C1 ∧. . . Cm ⊃ ¬Sn. Similarly, if Sk = ¬Sn is not in w, then there are D1, . . . , Dl ∈ Γk−1 suchthat `L D1∧. . . Dl ⊃ ¬Sk. By (PC), it follows that there are C1, . . . , Cm, D1, . . . Dl ∈ wsuch that

`L C1 ∧ . . . ∧ Cm ∧D1 ∧ . . . ∧Dl ⊃ (¬Sn ∧ ¬¬Sn).

But then w is inconsistent, contradicting what was just shown under 1.

3. w is witnessed. This is guaranteed by clause (ii) of the construction and the fact thatthe zn < Var(Sn).

4. w is substitutionally witnessed. This is guaranteed by clause (iii) and the fact that thezn < Var(Sn).

Lemma 7.8 (Existence Lemma)If w is a world in the canonical model for L, A a formula with 3A ∈ w, and τ anytransformation whose range excludes infinitely many variables of L , then there is aworld w′ in the model such that w τ−→ w′ and Aτ ∈ w′.

Proof I first prove the lemma for logics L with substitution. Let Γ = {Aτ} ∪ {Bτ : 2B ∈w}. Suppose Γ is not L-consistent. Then there are Bτ1 , . . . , Bτn with 2Bi ∈ w such that`L Bτ1 ∧ . . . ∧ Bτn ⊃ ¬Aτ . By definition 3.3, this means that `L (B1 ∧ . . . Bn ⊃ ¬A)τ , andso `L B1 ∧ . . . ∧ Bn ⊃ ¬A by (Subτ ). By (Nec) and (K), `L 2B1 ∧ . . . ∧ 2Bn ⊃ 2¬A. Butthen w contains both 3A and ¬3A, which is impossible because w is L-consistent. So Γ isL-consistent.

Since the range of τ excludes infinitely many variables, by the extensibility lemma, Γ ⊆ Hfor some Henkin set H. Moreover, w τ−→ w′ because Bτ ∈ H whenever for 2B ∈ w.

Now for logics without substitution.Let S1, S2 . . . enumerate all sentences in w of the form

x1 =y1 ∧ . . . ∧ xn=yn ∧2B,

where x1, . . . , xn are zero or more distinct variables free in B. Let U be the “unused” L-variables that are not in the range of τ . Let Z be an infinite subset of U such that Z\U isalso infinite. For each Si = (x1 =y1 ∧ . . .∧ xn=yn ∧2B), let ZSi be a set of distinct variablesz1, . . . , zn ∈ Z such that ZSi ∩

⋃j<i ZSj = ∅ (i.e. none of the zi has been used for any earlier

Sj). Abbreviate

Bi =df [z1, . . . , zn/xτ1 , . . . , x

τn]Bτ ;

Xi =df x1 =y1 ∧ . . . ∧ xn=yn;Yi =df yτ1 =yτ1 ∧ . . . ∧ yτn=yτn;Zi =df yτ1 =z1 ∧ . . . ∧ yτn=zn.

(For n = 0, Xi, Yi and Zi are the tautology >, and Bi is Bτ .)Let Γ− = {(Yi ⊃ Zi ∧Bi) : Si ∈ S1, S2, . . .}, and let Γ = Γ− ∪ {Aτ}.Suppose for reductio that Γ is inconsistent. Then there are sentences (Y1 ⊃ Z1 ∧

B1), . . . , (Ym ⊃ Zm ∧Bm) ∈ Γ− such that

`L ¬(Aτ ∧ (Y1 ⊃ Z1 ∧B1) ∧ . . . ∧ (Ym ⊃ Zm ∧Bm)). (1)

By (Nec),`L 2¬(Aτ ∧ (Y1 ⊃ Z1 ∧B1) ∧ . . . ∧ (Ym ⊃ Zm ∧Bm)). (2)

Any member (Yi ⊃ Zi ∧Bi) of Γ− has the form

yτ1 =yτ1 ∧ . . . ∧ yτn=yτn ⊃ yτ1 =z1 ∧ . . . ∧ yτn=zn ∧ [z1, . . . , zn/xτ1 , . . . , x

τn]Bτ .

By (CSn),

`L xτ1 =yτ1 ∧ . . . ∧ xτn=yτn ∧2Bτ ⊃2(yτ1 =z1 ∧ . . . ∧ yτn=zn ⊃ [z1, . . . , zn/x

τ1 , . . . , x

τn]Bτ ). (3)

Now w contains x1 =y1 ∧ . . . ∧ xn=yn ∧ 2B. So wτ contains xτ1 =yτ1 ∧ . . . ∧ xτn=yτn ∧ 2Bτ ,which is the antecedent of (3). The consequent of (3) is 2(Zi ⊃ Bi). Thus

wτ `L 2(Z1 ⊃ B1) ∧ . . . ∧2(Zm ⊃ Bm). (4)

Let ∆ = wτ ∪ {3(Aτ ∧ (Y1 ⊃ Z1) ∧ . . . ∧ (Ym ⊃ Zm))}. So

∆ `L 2(Z1 ⊃ B1) ∧ . . . ∧2(Zm ⊃ Bm); (5)∆ `L 3(Aτ ∧ (Y1 ⊃ Z1) ∧ . . . ∧ (Ym ⊃ Zm)). (6)

By (K) and (Nec), (5) and (6) yield

∆ `L 3(Aτ ∧ (Y1 ⊃ Z1 ∧B1) ∧ . . . ∧ (Ym ⊃ Zm ∧Bm)). (7)

By (2), it follows that ∆ is inconsistent. This means that

wτ `L ¬3(Aτ ∧ (Y1 ⊃ Z1) ∧ . . . ∧ (Ym ⊃ Zm)). (8)

Now consider Z1 = (yτ1 =z1 ∧ . . . ∧ yτn=zn). By (LL∗n) (or repeated application of (LL∗)),

`L yτ1 =z1 ∧ . . . ∧ yτn=zn ⊃ 2¬(Aτ ∧ (yτ1 =yτ1 ∧ . . . ∧ yτn=yτn ⊃ yτ1 =z1 ∧ . . . ∧ yτn=zn))⊃ 2¬(Aτ ∧ (yτ1 =yτ1 ∧ . . . ∧ yτn=yτn ⊃ yτ1 =yτ1 ∧ . . . ∧ yτn=yτn)), (9)

because the zi are not free in Aτ . In other words (and dropping the tautologous conjunct atthe end),

`L Z1 ⊃ 2¬(Aτ ∧ (Y1 ⊃ Z1)) ⊃ 2¬Aτ . (10)

By the same reasoning,

`L Z1 ∧ . . . ∧ Zm ⊃ 2¬(Aτ ∧ (Y1 ⊃ Z1) ∧ . . . ∧ (Ym ⊃ Zm)) ⊃ 2¬Aτ . (11)

By (PC), (Nec) and (K), this means

`L Z1 ∧ . . . ∧ Zm ⊃ 3Aτ ⊃ 3(Aτ ∧ (Y1 ⊃ Z1) ∧ . . . ∧ (Ym ⊃ Zm)). (12)

Since wτ `L 3Aτ , (8) and (12) together entail

wτ `L ¬(Z1 ∧ . . . ∧ Zm). (13)

So there are C1, . . . , Ck ∈ w such that

`L Cτ1 ∧ . . . ∧ Cτk ⊃ ¬(Z1 ∧ . . . ∧ Zm). (14)

Each Zi has the form yτ1 = z1 ∧ . . . ∧ yτn = zn. All the zi are pairwise distinct, and none ofthem occur in Cτ1 ∧ . . .∧Cτk (because the zi are not in the range of τ) nor in any other Zi. By(Sub∗), we can therefore replace each zi in (14) by the corresponding yτi , turning Zi into Yi:

`L Cτ1 ∧ . . . ∧ Cτk ⊃ ¬(Y1 ∧ . . . ∧ Ym). (15)

For any Yi = (yτ1 =yτ1 ∧ . . . ∧ yτn=yτn), Xi is a sentence of the form x1 =y1 ∧ . . . ∧ xn=yn. SoXτi is xτ1 =yτ1 ∧ . . . ∧ xτn=yτn, and `L Xτ

i ⊃ Yi by either (=R) or (Neg) and (∀=R). So (15)entails

`L Cτ1 ∧ . . . ∧ Cτk ⊃ ¬(Xτ1 ∧ . . . ∧Xτ

m). (16)

Thus by (Subτ ),`L C1 ∧ . . . ∧ Ck ⊃ ¬(X1 ∧ . . . ∧Xm). (17)

Since {C1, . . . , Ck, X1, . . . , Xm} ⊆ w, it follows that w is inconsistent. Which it isn’t. Thiscompletes the reductio.

So Γ is consistent. Since the infinitely many variables in U\Z do not occur in Γ, lemma7.7 guarantees that Γ ⊆ w′ for some world w′ in the canonical model for L. And of course,Γ was constructed so that w′ satisfies the condition in definition 7.4 for w τ−→ w′. Thisrequires that for every formula B and variables x1 . . . xn, y1, . . . , yn such that the x1 . . . xnare zero or more pairwise distinct members of Varf(B), if x1 =y1 ∧ . . . ∧ xn=yn ∧ 2B ∈ wand yτ1 = yτ1 ∧ . . . ∧ yτn = yτn ∈ w′, then there are variables z1 . . . zn < Var(Bτ ) such thatz1 = yτ1 ∧ . . . ∧ zn = yτn ∧ [z1 . . . zn/x

τ1 . . . x

τn]Bτ ∈ w′. By construction of Γ, whenever

x1 =y1∧ . . .∧xn=yn∧2B ∈ w, then there are suitable z1, . . . , zn such that yτ1 =yτ1 ∧ . . .∧yτn=yτn ⊃ yτ1 =z1 ∧ . . .∧ yτn=zn ∧ [z1, . . . , zn/x

τ1 , . . . , x

τn]Bτ ∈ w′. So if yτ1 =yτ1 ∧ . . .∧ yτn=yτn ∈ w′,

then yτ1 =z1 ∧ . . . ∧ yτn=zn ∧ [z1, . . . , zn/xτ1 , . . . , x

τn]Bτ ∈ w′.

Lemma 7.9 (Truth Lemma)For any sentence A and world w in the canonical model ML = 〈W,R,U,D,K, V 〉for L,

w, V A iff A ∈ w.

Proof by induction on A.

1. A is Px1 . . . xn. w, V Px1 . . . xn iff 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ) by definition 2.7.By construction of Vw (definition 7.5), Vw(xi) is [xi]w or undefined if [xi]w = ∅, andVw(P ) = {〈[z1]w, . . . , [zn]w 〉 : Pz1 . . . zn ∈ w}. (For non-logical P , this is directly givenby definition 7.5; for the identity predicate, Vw(=) is {〈d, d〉 : d ∈ Uw} by definition2.7, which equals {〈[z]w, [z]w 〉 : z=z ∈ w} = {〈[z1]w, [z2]w 〉 : z1 =z2 ∈ w} because themembers of Uw are precisely the non-empty sets [z]w.)Now if 〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ), then 〈[x1]w, . . . , [xn]w 〉 ∈ {〈[z1]w, . . . , [zn]w 〉 :Pz1 . . . zn ∈ w}, where all the [xi]w are non-empty (for Vw(xi) is defined). This meansthat there are variables z1, . . . , zn such that {x1 =z1, . . . , xn=zn, P z1 . . . zn} ⊆ w. ThenPx1 . . . xn ∈ w by (LL∗).In the other direction, if Px1 . . . xn ∈ w, then xi = xi ∈ w for all xi in x1 . . . xn(see p. 77). Hence 〈[x1]w, . . . , [xn]w 〉 ∈ {〈[z1]w, . . . , [zn]w 〉 : Pz1 . . . zn ∈ w}, i.e.〈Vw(x1), . . . , Vw(xn)〉 ∈ Vw(P ).

2. A is ¬B. w, V ¬B iff w, V 6 B by definition 2.7, iff B < w by induction hypothesis,iff ¬B ∈ w by maximality of w.

3. A is B ⊃ C. w, V B ⊃ C iff w, V 6 B or w, V C by definition 2.7, iff B < w orC ∈ w by induction hypothesis, iff B ⊃ C ∈ w by maximality and consistency of w andthe fact that `L ¬B ⊃ (B ⊃ C) and `L C ⊃ (B ⊃ C).

4. A is 〈y : x〉B. Assume first that w, V y,y. So Vw(y) is undefined, and it is not thecase that Vw(y) has multiple counterparts at any world. And then w, V 〈y : x〉Biff w, V [y/x] B by definition 3.2, iff w, V [y/x]B by lemma 3.9, iff [y/x]B ∈ w byinduction hypothesis. Also by induction hypothesis, y,y ∈ w. By (SCN), `L y,y ⊃([y/x]B ↔ 〈y : x〉B). So [y/x]B ∈ w iff 〈y : x〉B ∈ w.Next, assume that w, V y=y; so by induction hypothesis y=y ∈ w. Assume furtherthat 〈y : x〉B < w. Then ¬〈y : x〉B ∈ w by maximality of w, and 〈y : x〉¬B ∈ w

by (S¬). Since w is substitutionally witnessed and y = y ∈ w, there is a variablez < Var(〈y : x〉¬B) such that y= z ∈ w and [z/x]¬B ∈ w. By induction hypothesis,w, V y = z. Moreover, by definition 3.3, ¬[z/x]B ∈ w, and so [z/x]B < w byconsistency of w. By induction hypothesis, w, V 6 [z/x]B. By definition 2.7, thenw, V ¬[z/x]B, i.e. w, V [z/x]¬B. Since z and x are modally separated in B, thenw, V [z/x] ¬B by lemma 3.9. But V [z/x] and V [y/x] agree on all variables at w, becausew, V y = z. So w, V [y/x] ¬B by the locality lemma 2.10. So w, V [y/x] 6 B bydefinition 2.7, and w, V 6 〈y : x〉B by definition 3.2.

In the other direction, assume 〈y : x〉B ∈ w. Since w is substitutionally witnessed andy=y ∈ w, there is a new variable z such that y=z ∈ w and [z/x]B ∈ w. By inductionhypothesis, w, V y=z and w, V [z/x]B. Since z and x are modally separated in B,w, V [z/x] B by lemma 3.9. As before V [z/x] and V [y/x] agree on all variables at w,because w, V y=z; so w, V [y/x] B by lemma 2.10 and w, V 〈y : x〉B by definition3.2.

5. A is ∀xB. We first show that for any variable x, w, V Ex iff Ex ∈ w: w, V Ex iffVw(x) ∈ Dw by definition 3.3, iff [x]w ∈ Dw by definition 7.5, iff Ex ∈ w by definition7.5.Now assume ∀xB ∈ w, and let y be any variable such that Ey ∈ w. As just shown,w, V Ey. By (FUI∗∗), ∃x(x = y ∧ B) ∈ w. By witnessing, there is a z < Var(B)such that z = y ∧ [z/x]B ∈ w, and thus z = y ∈ w and [z/x]B ∈ w. By inductionhypothesis, w, V z=y and w, V [z/x]B. By lemma 3.9, then w, V [z/x] B. Andsince Vw(z) = Vw(y), it follows by lemma 2.10 that w, V [y/x] B. So if ∀xB ∈ w,then w, V [y/x] B for all variables y with Ey ∈ w, i.e. with Vw(y) ∈ Dw. Since everymember [y]w of Dw is denoted by some variable y under Vw, this means that w, V ′ B

for all existential x-variants V ′ of V on w. So w, V ∀xB.Conversely, assume ∀xB < w. Then ∃x¬B ∈ w; so by witnessing, [y/x]¬B ∈ w for somey < Var(B) with Ey ∈ w. Then ¬[y/x]B ∈ w and so [y/x]B < w. As shown above,w, V Ey. Moreover, by induction hypothesis, w, V 6 [y/x]B. By lemma 3.9, thenw, V [y/x] 6 B. Let V ′ be the (existential) x-variant of V on w with V ′w(x) = V

[y/x]w (x).

By the locality lemma, w, V ′ 6 B. So w, V 6 ∀xB.

6. A is 2B. Assume w, V 2B. Then w′, V ′ B for all w′, V ′ with wRw′ and Vw . V ′w′ .We first show that if w τ−→ w′, then Vw . V

τw′ . By definitions 2.6 and 7.5, Vw . V τw′

means that there is a transformation σ such that w σ−→ w′ and for every variable y, ifthere is a z ∈ Vw(y) such that [zσ]w′ ∈ Uw′ (i.e., if Vw(y) has any σ-counterpart at w′),then there is a z ∈ Vw(y) with zσ ∈ V τw′(y) (i.e., then V τw′(y) is such a counterpart),otherwise V τw′(y) is undefined. The relevant transformation σ will be τ . So what we’llshow is this: for every variable y, if there is a z ∈ Vw(y) such that [zτ ]w′ ∈ Uw′ , thenthere is a z ∈ Vw(y) with zτ ∈ V τw′(y), otherwise V τw′(y) is undefined.Let y be any variable. Assume first that there is a z ∈ Vw(y) such that [zτ ]w′ ∈ Uw′ .Then z=y ∈ w and zτ =zτ ∈ w′. By either (Neg) and (EI) or (=R), `L z=y ⊃ y=y;so y = y ∈ w. Moreover, by either (TE), (EI), (Nec) and (K) or (=R) and (Nec),`L z = y ⊃ 2(z = z ⊃ y = y); so 2(z = z ⊃ y = y) ∈ w. By definition of w τ−→ w′,then zτ = zτ ⊃ yτ = yτ ∈ w′. So yτ = yτ ∈ w′. Hence y ∈ Vw(y) and yτ ∈ [yτ ]w′ =Vw′(yτ ) = V τw′(y). Alternatively, assume there is no z ∈ Vw(y) with zτ = zτ ∈ w′.Then either Vw(y) = ∅, in which case y , y ∈ w, and so 2(y , y) ∈ w by (NA), (EI),(Nec) and (K), and yτ , yτ ∈ w′ by definition of w τ−→ w′, or else Vw(y) , ∅, butzτ ,zτ ∈ w′ for all z ∈ Vw(y), in which case, too, yτ ,yτ ∈ w′ since y ∈ Vw(y). Eitherway, Vw′(yτ ) = V τw′(y) is undefined.We’ve shown that if w, V 2B, then for every w′ and τ with w

τ−→ w′, w′, V τ B.By the transformation lemma, then w′, V Bτ . By induction hypothesis, Bτ ∈ w′.Now suppose 2B < w. Then 3¬B ∈ w by maximality of w. By the existence lemma,

there is then a world w′ and transformation τ with wτ−→ w′ and ¬Bτ ∈ w′. (Any

transformation whose range excludes infinitely many variables will do.) But we’ve justseen that if w τ−→ w′, then Bτ ∈ w′. So if w, V 2B, then 2B ∈ w.For the other direction, assume w, V 6 2B. So w′, V ′ 6 B for some w′, V ′ withwRw′ and Vw . V ′w′ . As before, Vw . V ′w′ means that there is a transformation τ withw

τ−→ w′ such that for every variable x, either there is a y ∈ Vw(x) with yτ ∈ V ′w′(x),or there is no y ∈ Vw(x) with yτ = yτ ∈ w′, in which case V ′w′(x) is undefined. Letτ be any transformation with w

τ−→ w′, and let ∗ be a substitution that maps eachvariable x in B to some member y of Vw(x) with yτ ∈ V ′w′(x), or to itself if there isno such y. Thus if x ∈ Var(B) and V ′w′(x) is defined, then (∗x)τ ∈ V ′w′(x), and soV ′w′(x) = [(∗x)τ ]w′ = V τ ·∗w′ (x). Alternatively, if V ′w′(x) is undefined (so ∗x = x), thenV τ ·∗w′ (x) = V τw′(x) is also undefined. The reason is that otherwise V τw′(x) = [xτ ]w′ , ∅and xτ =xτ ∈ w′; by definition of accessibility, then 2x,x < w and hence x=x ∈ w, as`L x,x ⊃ 2x,x; so there is a y ∈ Vw(x), namely x, such that yτ =yτ ∈ w′, in whichcase V ′w′(x) cannot be undefined (by definition 2.6). So V ′ and V τ ·∗ agree at w′ on allvariables in B. By lemma 2.9, w′, V τ ·∗ 6 B.Now suppose for reductio that 2B ∈ w. Let x1, . . . , xn be the variables x in Var(B)with (∗x)τ ∈ V ′w′(x) (thus excluding empty variables as well as variables denot-ing individuals without τ -counterparts at w′). For each such xi, ∗xi ∈ Vw(xi),and so xi = ∗xi ∈ w. If L is with substitution, then by (LLn), 〈∗x1, . . . , ∗xn :x1, . . . , xn 〉2B ∈ w; so 2〈∗x1, . . . , ∗xn : x1, . . . , xn 〉B ∈ w by (S2). By definition ofw

τ−→ w′, then 〈(∗x1)τ , . . . , (∗xn)τ : xτ1 , . . . , xτn 〉Bτ ∈ w′. By substitutional witnessing,it follows that there are new variables z1, . . . , zn such that zi=(∗xi)τ ∈ w′ and (hence)[z1, . . . , zn/x

τ1 , . . . , x

τn]Bτ ∈ w′. If L is without substitution, this fact – that there are

new variables z1, . . . , zn such that zi=(∗xi)τ ∈ w′ and [z1, . . . , zn/xτ1 , . . . , x

τn]Bτ ∈ w′ –

is guaranteed directly by definition of w τ−→ w′ and the fact that 2B ∈ w.By induction hypothesis, w′, V zi = (∗xi)τ and w′, V [z1, . . . , zn/x

τ1 , . . . , x

τn]Bτ .

Since the zi are new, w′, V [z1,...,zn/xτ1 ,...,x

τn] Bτ by lemma 3.9. By the transformation

lemma 3.13, then w′, V [z1,...,zn/xτ1 ,...,x

τn]·τ B. However, for each xi, V

[z1,...,zn/xτ1 ,...,x

τn]·τ

w′ (xi) =V

[z1,...,zn/xτ1 ,...,x

τn]

w′ (xτi ) = Vw′(zi) = Vw′((∗xi)τ ) (because w′, V (∗xi)τ = zi) =V τw′(∗xi) = V

τ ·[∗x1,...,∗xn/x1,...,xn]w′ (xi) = V τ ·∗w′ (xi). Similarly, if x ∈ Var(B) is none of the

x1, . . . , xn, so (∗x)τ < V ′w′(x), then ∗x is x by definition of ∗, and so V [z1,...,zn/xτ1 ,...,x

τn]·τ

w′ (x) =V τw′(x) = V τw′(∗x) = V τ ·∗w′ (x). So V [z1,...,zn/x

τ1 ,...,x

τn]·τ and V τ ·∗w′ agree at w′ on all vari-

ables in B. By lemma 2.10, then w′, V τ ·∗ B – contradiction.

8 Completeness

Recall that a logic L in some language of quantified modal logic is (strongly) completewith respect to a class of models M if every L-consistent set of formulas Γ is verified atsome world in some model in M. L is characterised by M if L is sound and completewith respect to M.

The minimal positive and negative logics from sections 4 and 5 were designed to be

complete with respect to the class of all positive and negative models, respectively. Let’sconfirm that this is the case.

Theorem 8.1 (Completeness of P and Ps)The logics P and Ps are (strongly) complete with respect to the class of positivecounterpart models.

Proof Let L range over P and Ps. We have to show that whenever a set of L-formulas Γ isL-consistent, then there is some world in some positive counterpart model that verifies allmembers of Γ. By lemma 7.6, the canonical model ML = 〈SL, VL 〉 for L is a positive model.By the Extensibility Lemma, Γ ⊆ w for some world w in ML, since none of the infinitely manyvariables Var+ occur in Γ. By the truth lemma, then w, VL SL A for each A ∈ Γ.

Theorem 8.2 (Completeness of N and Ns)The logics N and Ns are (strongly) complete with respect to the class of negativecounterpart models.

Proof Let L range over N and Ns, and let Γ be an L-consistent set of L-formulas. By lemma7.6, the canonical model ML = 〈SL, VL 〉 for L is a negative model. By the ExtensibilityLemma, Γ ⊆ w for some world w in ML, since none of the infinitely many variables Var+

occur in Γ. By the truth lemma, then w, VL SL A for each A ∈ Γ.

Together with the soundness theorems 4.3, 4.6, 5.4 and 5.5, it follows that P and Psare characterized by the class of positive models, and N and Ns by the class of negativemodels.In footnote 3 (on page 4) I mentioned that the introduction of multiple counterpart

relations makes little difference to the base logic. Let’s call a counterpart structure inwhich any two worlds are linked by at most one counterpart relation unirelational. As itturns out, P and Ps are also characterized by the class of unirelational positive models,and N and Ns by the class of unirelational negative models. The easiest way to see this isperhaps to note that all the lemmas in the previous section still go through if we defineaccessibility and counterparthood in canonical models by a fixed transformation τ whoserange excludes infinitely many variables. The extensibility lemma 7.7 and existencelemma 7.8 are unaffected by this change; the only part that needs adjusting is the clausefor 2B in the proof of the truth lemma 7.9, but the adjustments are straightforward.

Every quantified modal logic is strongly complete with respect to every class of modelsthat contains its canonical model. However, on the traditional idea that logical truthsshould be true on any interpretation of the non-logical terms, an arguably more important

kind of completeness is completeness with respect to all models with a certain type ofstructure.

Strictly speaking, we have two such notions, one for positive and one for negativelogics.

Definition 8.3 (Positive completeness and characterisation)A logic L in some language of quantified modal logic is (strongly) positively completewith respect to a class of structures S if every L-consistent set of formulas Γ isverified at some world in some positive model 〈S , V 〉 with S ∈ S. L is positivelycharacterised by S if it is sound and positively complete with respect to S.

Now we might try to show, first, that if a PML is canonical, then so is its quantifiedcounterpart. Then we could try to show that the canonical model of the PML is in a classof frames F iff the opaque propositional guise of the canonical model of the quantifiedcounterpart is in F . Then we’d have completeness transfer for all canonical logics.

Theorem 8.4 ((Positive) completeness transfer)If L is a (unimodal) propositional modal logic that is complete with respect to theKripke frames in some class F , then the PL is positively complete with respect tothe total counterpart structures whose opaque propositional guise is in F .

[To be continued...]

References

J. L. Bell and M. Machover [1977]: A Course in Mathematical Logic. Noth-HollandPublishing Company

Patrick Blackburn, Maarten de Rijke and Yde Venema [2001]: Modal Logic. Cambridge:Cambridge University Press

Patrick Blackburn and Johan van Benthem [2007]: “Modal Logic: A Semantic Perspective”.In [Blackburn et al. 2007], 1–85

Patrick Blackburn, Johan van Benthem and Frank Wolter (Eds.) [2007]: Handbook ofModal Logic. Dordrecht: Elsevier

David Bostock [1997]: Intermediate Logic. Oxford: Clarendon Press

Torben Braüner and Silvio Ghilardi [2007]: “First-order Modal Logic”. In [Blackburnet al. 2007], 549–620

Giovanna Corsi [2002]: “Counterpart Semantics. A Foundational Study on QuantifiedModal Logics”. Manuscript

Melvin Fitting and Richard L. Mendelsohn [1998]: First-Order Modal Logic. Dordrecht:Kluwer

Dov Gabbay, Valentin Shehtman and Dmitrij Skvortsov [2009]: Quantification in Non-classical Logic, vol Vol. 1. Dordrecht: Elsevier

S. Ghilardi [1991]: “Incompleteness results in Kripke semantics”. Journal of SymbolicLogic, 56: 517–538

Silvio Ghilardi [2001]: “Substitution, quantifiers and identity in modal logic”. InE. Morscher and A. Hieke (Eds.) New essays in free logic, Dordrecht: Kluwer, 87–115

Silvio Ghilardi and Giancarlo Meloni [1988]: “Modal and tense predicate logic: Mod-els in presheaves and categorical conceptualization”. In Categorical algebra and itsapplications, 130–142

— [1991]: “Philosophical and mathematical investigations in first-order modal logic”.In Problemi fondazionali in teoria del significato. Atti del convegno di Pontignano,Firenze: Olsckhi, 77–107

Allen P. Hazen [1979]: “Counterpart-Theoretic Semantics for Modal Logic”. Journal ofPhilosophy, 76: 319–338

Markus Kracht and Oliver Kutz [2002]: “The semantics of modal predicate logic I.Counterpart frames”. In Frank Wolter, Heinrich Wansing, Maarten de Rijke andMichael Zakharayaschev (Eds.) Advances in Modal Logic, vol 3. World ScientificPublishing Company

— [2005]: “The semantics of modal predicate logic II. Modal individuals revisited”. InReinhard Kahle (Ed.) Intensionality, Los Angeles: A. K. Peters

— [2007]: “Logically possible worlds and counterpart semantics for modal logic”. In DaleJacquette (Ed.) Philosophy of Logic, Amsterdam: North Holland, 943–995

Steven T Kuhn [1980]: “Quantifiers as modal operators”. Studia Logica, 39(2-3): 145–158

Oliver Kutz [2000]: “Kripke-Typ-Semantiken für die modale Prädikatenlogik”. Diplomar-beit, Humboldt University Berlin

David Lewis [1968]: “Counterpart Theory and Quantified Modal Logic”. Journal ofPhilosophy, 65: 113–126

— [1983]: “Postscript to [Lewis 1968]”. In Philosophical Papers I, Oxford: OxfordUniversity Press, 39–46

— [1986]: On the Plurality of Worlds. Malden (Mass.): Blackwell

Gerhard Schurz [2011]: “Combinations and Completeness Transfer for Modal Quantifica-tional Logics”. Logic Journal of the IGPL, 19(4): 598–616

Wolfgang Schwarz [2012]: “How things are elsewhere: Adventures in counterpart se-mantics”. In G. Russell and G. Restall (Eds.) New Waves in Philosophical Logic,Basingstoke: Palgrave MacMillan, 8–29

Theodore Sider [2001]: Four-Dimensionalism. Oxford: Clarendon Press

D. P. Skvortsov and V. B. Shehtman [1993]: “Maximal Krike-Type Semantics for Modaland Superintuitionistic Predicate Logics”. Annals of Pure and Applied Logic, 63: 69–101

Robert Stalnaker and Richmond Thomason [1968]: “Abstraction in first-order modallogic”. Theoria, 34: 203–207

Lin Woollaston [1994]: “Counterpart Theory as a Semantics for Modal Logic”. Logiqueet Analyse, 147–148: 255–263