Note that the proofs of Lemma 6.2.2 and Lemma 6.2.4 follow the inductive argument from the proof of Theorem 6.1.3. For a proof at the level of Hilbert derivations, it is essential that the proof does not mention paths.
Also note that neither the proof of Lemma 6.2.2 nor the proof of Lemma 6.2.4 makes essential use of the fact thatH is the associated formula of a history or thatC is the associated formula of a clause. That is, if one replaces s UHt with (s ∧H) U(t ∧H) and s UH,Ct with (s ∧H ∧¬C) U(t ∧H ∧¬C) one can treat H and C as formulas. The resulting lemmas correspond, up to propositional reasoning, to the rules ERel and ARel of the Hilbert system LS (cf. Figure 5.8). Hence, we obtain:
Theorem 6.2.7 LS `s iff IC ` s.
Proof The direction from right to left was established as Theorem 5.8.3. The direction from left to right follows with the argument above.
6.3 Completeness of Gentzen System for CTL
We now show that the system GCT is complete for history-free clauses. The proof works by showing the rules of the refutation calculus from Figure 5.6 admissible for the Gentzen system. This is the place where we profit from the model construction for relaxed demos (Sections 5.3 and 5.4).
We fix some subformula universeU. We call a clause C Gentzen refutableif ðC|ε. Further, we call a set of clauses SGentzen corefutableif every clause in U \ S is Gentzen refutable.
Lemma 6.3.1 (Admissibility of Support Rule) LetC ⊆ U.
1. ðC|a whenever ð D|a for all D ∈ BUC.
2. ðC|ε whenever S is Gentzen corefutable and S 6. C.
Proof Claim (1) follows by induction on the total size of the non-literal formulas inC using the rules in the first three rows of Figure 6.3. Claim (2) is an immediate
consequence of Claim (1).
Lemma 6.3.2 (Admissibility of Jump Rule) Let D ∈ Dem C. Then ð C|a when-ever ðD|r a.
Proof Follows immediately with the rules X and Xs. Note that showing admissibility of the jump rule only requires the case wherea (and hence r a) is ε. The added generality is required to prove admissibility of the loop rules.
Lemma 6.3.3 (Admissibility of loop+) Let S ⊆U be Gentzen corefutable and let
A(s U t)+∈C ∈ S. Then ð C|ε whenever (S, U ), C 63 A(s U t)+.
Proof We defineI := { D ∈ U | (S, U), D 63 A(s U t)+}. It suffices to show ðC|ε forC ∈ I. Since C ∈ I, there exists some clause D ∈ Dem C such that S 6. D, t+ and BU(D, s+) ⊆ I. By Lemma 6.3.2, it suffices to show D|ε. Since A(s U t)+∈D we can apply the rule U. It then remains to prove ðD| A(s Ut)+. We prove the following generalization
∀H D. H ⊆ 2U ∧D ⊆ U ∧ S 6. D, t+∧ BU(D, s+) ⊆ I → ð D| A(s UHt)+ by induction on the size of 2U\H. Let D and H as in the statement above. We can assumeD ∉ H since otherwise the claim follows with the rule U. After applying the rule UH, there are two cases:
ðD, t+|ε. Follows with Lemma 6.3.1(2)
ðD, s+| A(s UH,Dt)+. By Lemma 6.3.1(1) it suffices to show ðE| A(s UH,Dt)+ forE ∈ BU(D, s+). By assumption we have E ∈ I. Hence, there exists some clause F ∈ Dem E such that S 6. F , t+ and BU(F , s+) ⊆ I. The claim then follows with Lemma 6.3.2 and the induction hypothesis.
The admissibility proof of the rule loop−follows a similar pattern.
Lemma 6.3.4 (Admissibility of loop−) Let S ⊆U be Gentzen corefutable and let
A(s R t)−∈C ∈ S. Then ð C|ε whenever (S, U ), C 63 A(s R t)−.
Proof We defineI := { D ∈ U | (S, U ), D 63 A(s R t)−}. It suffices to show ðC|ε forC ∈ I. We can assume that there is no clause D ∈ Dem C such that S 6. D since otherwise we have ðC|ε by Lemma 6.3.2. Hence, S 6. R C, t−and BU(R C, s−) ⊆ I.
After applying the rules X and R, we need to show ð RC| A(s Rt)−. Similar to above, we prove the generalization
∀H D. H ⊆ 2U∧D ⊆ U ∧ S 6. (D, t−) ∧ BU(D, s−) ⊆ I → ð D| A(s RHt)− by induction on the size of 2U\H. Let H and D as in the statement above. As above, we can assumeD ∉ H. After applying the rule RH, there are two cases:
ðD, t−|ε. Follows with Lemma 6.3.1(2).
ðD, s−| A(s RH,Dt)−. LetE ∈ BU(D, s−). It suffices to show ð E| A(s RH,Dt)− (Lemma 6.3.1(1)). Since E ∈ I, we can reason as for C above and obtain S 6. R E, t−and BU(R E, s−) ⊆ I. The claim then follows with the rule XHand
the induction hypothesis.
Putting everything together, we obtain (ref refers to the rules in Figure 5.6):
Lemma 6.3.5 ðC|ε whenever refUC.
6.3 Completeness of Gentzen System for CTL
The admissibility proofs for the loop rules start by setting a focus on the eventual-ity under consideration and then proceed by induction on the number of clauses that can still be added to the history. In both cases, the induction establishes that all clauses fromU where the eventuality under consideration is not inductively fulfilled are refutable. This is slightly more general than needed since we only need to refute clauses from the corefutable set S. The generalization toU has the effect that we do not have to rely on the existing refutations for clauses in U \ S. Instead we can continue to build up the history for the eventuality currently in focus. This is important since in the presence of a focused eventuality the refutations for clauses inU \ S would be of little use. The reason for this is that a refutation ofC|ε does not necessarily provide a refutation of C|a when a is an annotated eventuality (consider the case where the derivation ofC|ε ends with one of the focusing rules). The refutation calculus arising with relaxed demos provides exactly the right invariants for the inductive proofs to go through. Hence, the notion of relaxed fulfillment allows us to handle the fact that the Gentzen system does not allow re-focusing, i.e., dropping an annotated eventuality and focusing on another eventuality.
Theorem 6.3.6 (Informative Completeness) LetC be clause. Then either ð C|ε orC is satisfied by a finite model.
Proof IfC is empty, it is satisfied by any nonempty model. If C is nonempty, so is sfcC. With Theorem 5.5.4, we either obtain refsfcCC or a finite model satisfying C.
The claim then follows with Lemma 6.3.5.
Together with soundness, we obtain that GCT derives exactly the unsatisfiable history-free clauses.
Corollary 6.3.7 ðC|ε iff C is unsatisfiable.
Since the Gentzen system is only complete for history-free clauses, soundness and completeness only establish decidability of derivability for history-free clauses.
The decidability result for arbitrary annotated clauses can be established using fixpoint iteration. For this one shows that every annotated clause is contained in a finite universe of annotated clauses that is closed under backward application of the rules. Decidability then follows by expressing one-step derivability as a mono-tone function bounded by the clause universe (cf. Remark 3.6.7). The construction is fairly technical and the details are spelled out in the formalization [ACF].
Theorem 6.3.8 Derivability of annotated clauses is decidable.
We remark that while the completeness proof given here does not depend on decidability of derivability, it does rely on the fact that the calculus is analytic.
Analyticity ensures that histories cannot grow indefinitely and provides for the inductions in the admissibility proofs for the loop rules.