PreprintPDF Available

Computer Science and Metaphysics: A Cross-Fertilization

March 2019

DOI:10.13140/RG.2.2.25229.18403

Authors:

Daniel Kirchner

University of Bamberg

Christoph Benzmüller

University of Bamberg

Computational philosophy is the use of mechanized computational techniques to unearth philosophical insights that are either difficult or impossible to find using traditional philosophical methods. Computational metaphysics is computational philosophy with a focus on metaphysics. In this paper, we (a) develop results in modal metaphysics whose discovery was computer assisted, and (b) conclude that these results work not only to the obvious benefit of philosophy but also, less obviously, to the benefit of computer science, since the new computational techniques that led to these results may be more broadly applicable within computer science. The paper includes a description of our background methodology and how it evolved, and a discussion of our new results.

Our general methodology supports the reuse of state of the art theorem proving technology

…

Page 1 of Gödel's Manuscript. The axioms causing the inconsistency in Gödel's modal logic variant of the ontological argument for the existence of God are highlighted (by us) in blue. (Unpublished works of Kurt Gödel are Copyright Institute for Advanced Study and are used with permission. All rights reserved by Institute for Advanced Study.)

…

Page 2 of Gödel's Manuscript. The axioms causing the inconsistency in Gödel's modal logic variant of the ontological argument for the existence of God are highlighted (by us) in blue. (Unpublished works of Kurt Gödel are Copyright Institute for Advanced Study and are used with permission. All rights reserved by Institute for Advanced Study.)

…

Figures - uploaded by Christoph Benzmüller

Content may be subject to copyright.

Content uploaded by Christoph Benzmüller

Content may be subject to copyright.

Content uploaded by Christoph Benzmüller

Content may be subject to copyright.

Content uploaded by Christoph Benzmüller

Content may be subject to copyright.

Computer Science and Metaphysics:

A Cross-Fertilization

Daniel Kirchner

Fachbereich Mathematik und Informatik

Freie Universit¨at Berlin

daniel@ekpyron.org

Christoph Benzm¨uller

Fachbereich Mathematik und Informatik

Freie Universit¨at Berlin

c.benzmueller@fu-berlin.de

& Faculty of Science, Technology and Communication

University of Luxembourg

Edward N. Zalta

Center for the Study of Language and Information

Stanford University

zalta@stanford.edu

Abstract

Computational philosophy is the use of mechanized computa-

tional techniques to unearth philosophical insights that are either

diﬃcult or impossible to ﬁnd using traditional philosophical meth-

ods. Computational metaphysics is computational philosophy with

a focus on metaphysics. In this paper, we (a) develop results in

modal metaphysics whose discovery was computer assisted, and

(b) conclude that these results work not only to the obvious bene-

ﬁt of philosophy but also, less obviously, to the beneﬁt of computer

science, since the new computational techniques that led to these

results may be more broadly applicable within computer science.

The paper includes a description of our background methodology

and how it evolved, and a discussion of our new results.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 2

1 The Basic Computational Approach to

Higher-Order Modal Logic

The application of computational methods to philosophical problems was

initially limited to ﬁrst-order theorem provers. These are easy to use and

have the virtue that they can do proof discovery. In particular, Fitelson

and Zalta1both (a) used Prover9 to ﬁnd a proof of the theorems about

situation and world theory2and (b) found an error in a theorem about

Plato’s Forms that was left as an exercise in a paper by Pelletier & Zalta.3

And, Oppenheimer and Zalta discovered,4using Prover9, that 1 of the 3

premises used in their reconstruction of Anselm’s ontological argument5

was suﬃcient to derive the conclusion. Despite these successes, it be-

came apparent that working within a ﬁrst-order theorem-proving system

involved a number of technical compromises that could be solved by using

a higher-order system. For example, in order to represent modal claims,

second-order quantiﬁcation, and schemata, etc., in Prover9, special tech-

niques must be adopted that force formulas which are naturally expressed

in higher-order systems into the less-expressive language of multi-sorted

ﬁrst-order logic. These techniques were discussed in the papers just men-

tioned and outlined in some detail in a paper by Alama, Oppenheimer,

and Zalta.6The representations of expressive, higher-order philosophical

claims in ﬁrst-order logic is therefore not the most natural; indeed, the

complexity of the ﬁrst-order representations grows as one considers philo-

sophical claims that require greater expressivity. And this makes it more

diﬃcult to understand the proofs found by the ﬁrst-order provers.

1Fitelson & Zalta, “Steps toward a computational metaphysics”.

2Zalta, “Twenty-Five Basic Theorems”.

3Pelletier & Zalta, “How to Say Goodbye to the Third Man”.

4Oppenheimer & Zalta, “Simpliﬁcation of the ontological argument”.

5Oppenheimer & Zalta, “On the logic of the ontological argument”.

6Alama, Oppenheimer & Zalta, “Automating Leibniz’s theory of concepts”. For

example, to represent the T schema φ→φ, one begins with the intermediate repre-

sentation ∀p(p→p). Then one introduces two sortal predicates Proposition(x) and

Point(x), where the latter represent the possible worlds. In addition, a distinguished

point Wmust be introduced, as well as a truth predicate True(x,y). Then one can rep-

resent ∀p(p→p) as: all x (Proposition(x) -> (all y (Point(y) -> True(x,y))

-> True(x,W))).

arXiv:submit/2731814 [cs.LO] 15 Jun 2019

3Computer Science and Metaphysics: Cross-Fertilization

1.1 The Move to Higher-Order Systems

Ways of addressing such problems were developed in a series of papers

by Benzm¨uller and colleagues. Using higher-order theorem provers, they

brought computational techniques to the study of philosophical problems

and, in the process, they (along with others) developed two methodologies:

•Using the syntactic capabilities of a higher-order theorem prover

such as Isabelle/HOL (a) to represent the semantics of a target

logic and (b) to deﬁne the original syntax of the target theory within

the prover. We call this technique Shallow Semantic Embeddings

(SSEs).7These SSEs suﬃce for the implementation of interesting

modal, higher-order, and non-classical logics and for the investiga-

tion of the validity of philosophical arguments. By proving that the

axioms or premises of the target system are true in the SSE, one

immediately has a proof of soundness of the target system.

•Developing additional abstraction layers to represent the deductive

system of philosophical theories with a reasoning system that goes

beyond the deductive systems of classical modal logics.

Early papers focused on the development of SSEs. These papers show

that the standard translation from propositional modal logic to ﬁrst-order

logic can be concisely modelled (i.e., embedded) within higher-order the-

orem provers, so that the modal operator , for example, can be explic-

itly deﬁned by the λ-term λϕ.λw.∀v.(Rwv →ϕv), where Rdenotes the

accessibility relation associated with . Then one can construct ﬁrst-

order formulas involving ϕand use them to represent and proof theo-

rems. Thus, in an SSE, the target logic is internally represented using

higher-order constructs in an automated reasoning environment such as

Isabelle/HOL. Benzm¨uller and Paulson8developed an SSE that captures

quantiﬁed extensions of modal logic (and other non-classical logics). For

example, if ∀x.φx is shorthand in functional type theory for Π(λx.φx),

then ∀xP x would be represented as Π0(λx.λw.P xw), where Π0stands

7This is to be contrasted with a deep semantic embedding, in which the syntax of

the target language is represented using an inductive data structure (e.g., following

the BNF of the language) and the semantics of a formula is evaluated by recursively

traversing the data structure. Shallow semantic embeddings, by contrast, deﬁne the

syntactic elements of the target logic while reusing as much of the infrastructure of the

meta-logic as possible.

8Benzm¨uller & Paulson, “Quantiﬁed multimodal logics”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 4

for the λ-term λΦ.λw.Π(λx.Φxw), and the gets resolved as described

above.9

The SSE technique was also the starting point for a natural encoding

of G¨odel’s modern variant of the ontological argument in second-order

S5 modal logic. Various computer formalizations and assessments of re-

cent variants of the ontological argument in higher-order theorem provers

emerged in work by Benzm¨uller and colleagues. Initial studies10 investi-

gated G¨odel’s and Scott’s variants of the argument within the higher-order

automated theorem prover (henceforth ATP) LEO-II.11 Subsequent work

deepened these assessment studies.12 Instead of using LEO-II, these stud-

ies utilized the higher-order proof assistant Isabelle/HOL,13 a system that

is interactive and supports strong proof automation. Some of these exper-

iments were reconstructed in the proof assistant Coq.14 Additional follow-

up work contributed similar studies15 and includes a range of variants of

the ontological argument proposed by other authors, such as Anderson,

9To see how these expressions can be resolved to produce the right representation,

consider the following series of reductions:

∀xP x ≡Π0(λx.λw.P xw)

≡((λΦ.λw.Π(λx.Φxw))(λx.λw.P xw ))

≡(λw.Π(λx.(λx.λw.P xw)xw))

≡(λw.Π(λx.P xw))

≡(λϕ.λw.∀v.(Rwv →ϕv))(λw.Π(λx.P xw))

≡(λϕ.λw.Π(λv.Rwv →ϕv))(λw.Π(λx.P xw))

≡(λw.Π(λv.Rwv →(λw.Π(λx.P xw))v))

≡(λw.Π(λv.Rwv →Π(λx.P xv)))

≡(λw.∀v.Rwv → ∀x.P xv)

≡(λw.∀vx.Rwv →P xv)

Thus, we end up with a representation of ∀xPx in functional type theory.

10Benzm¨uller & Paleo, “Automating G¨odel’s ontological proof”.

11Benzm¨uller, Sultana, Paulson & Theiß, “The higher-order prover LEO-II”.

12Benzm¨uller & Paleo, “The inconsistency in G¨odel’s ontological argument”.

Benzm¨uller & Paleo, “Object-logic explanation for the inconsistency in G¨odel’s on-

tological theory”.

13Nipkow, Paulson & Wenzel, “Isabelle/HOL“.

14Bertot & Casteran, “Interactive Theorem Proving and Program Development“.

Benzm¨uller & Paleo, “Interacting with modal logics in the Coq proof assistant”.

15Benzm¨uller, Weber & Paleo, “Analysis of the Anderson-H´ajek controversy”. Fuen-

mayor & Benzm¨uller, “Automating emendations of the ontological argument”. Fuen-

mayor & Benzm¨uller, “A case study on computational hermeneutics”. Bentert,

Benzm¨uller, Streit & Paleo, “Analysis of an ontological proof proposed by Leibniz”.

5Computer Science and Metaphysics: Cross-Fertilization

Hajek, Fitting, and Lowe.16 Moreover ultraﬁlters have been used17 to

study the distinction between extensional and intensional positive prop-

erties in the variants of Scott, Anderson and Fitting. This ongoing work

will be sketched in Section 2.

The other main technique (i.e., the one in the second bullet point

above), was developed by Kirchner and Benzm¨uller to re-implement, in

a higher-order system, the work by Fitelson and Zalta.18 In order to de-

velop a more general implementation of Abstract Object Theory (hence-

forth AOT or ‘object theory’), it doesn’t suﬃce to just develop an SSE

for AOT. The SSE of G¨odel’s ontological argument relies heavily on the

completeness of second-order modal logic with respect to Kripke models.

Given these completeness results, the computational analysis at the SSE

level accurately reﬂects what follows from the premises of the argument.

Since such completeness results aren’t available for AOT with respect to

its Aczel models, some other way of investigating the proof system com-

putationally is needed. To address this, Kirchner extended the SSE by

introducing the new concept of abstraction layers.19 By introducing an

additional proof system (as a higher abstraction layer, on top of the se-

mantic embedding) that involves just the axioms of the target logic, one

can do automated reasoning in the target logic without generating arti-

factual theorems (i.e., theorems of the model that aren’t theorems of the

target logic), and without requiring the embedding to be complete or even

provably complete. So the additional abstraction layer makes interactive

and automated reasoning in Isabelle/HOL possible in a way that is inde-

pendent of the model structure used for the semantic embedding itself.

Whereas the SSE serves as a sound basis for implementing the abstract

reasoning layer, the embedding with abstraction layers provides the in-

frastructure for a deeper analysis of the semantic properties of the target

logic, such as completeness. We’ll expand upon this theme on several

occasions below.

16Anderson, “Some emendations of G¨odel’s ontological proof”. Anderson & Get-

tings, “G¨odel’s ontological proof revisited”. H´ajek, “Magari and others on G¨odel’s

ontological proof”. H´ajek, “Der Mathematiker und die Frage der Existenz Gottes”.

H´ajek, “A new small emendation of G¨odel’s ontological proof”. Fitting, “Types,

Tableaus, and G¨odel’s God”. Lowe, “A modal version of the ontological argument”.

17Benzm¨uller & Fuenmayor, “Can computers help to sharpen our understanding of

ontological arguments?”.

18Fitelson & Zalta, “Steps toward a computational metaphysics”.

19Kirchner, “Representation and Partial Automation of the PLM in Isabelle/HOL”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 6

Kirchner reconstructs not only AOT’s fundamental theorems about

possible worlds, but arrives at meta-theorems about the correspondence

between AOT’s syntactic possible worlds and the semantic possible worlds

used in its models.20 In particular, Kirchner shows, using the embedding

of AOT in Isabelle/HOL, that for each syntactic possible world wof AOT,

there exists a semantic possible world win the embedding, such that all

and only propositions derivably true in w(using AOT’s deﬁnition of truth

in possible worlds) are true in w, and vice-versa. The shallow semantic

embedding with abstraction layers made it possible to reason both within

the target logic itself (i.e., in the higher-level abstract reasoning layer)

and about the target logic (i.e., using the outer logic of HOL as metalogic

and the embedding as a deﬁnition of the semantics of the target logic).

To illustrate, as simply as possible, some of the technical details in-

volved in the two basic techniques described above, we now turn to the

development of an SSE for propositional modal logic, and show how an

abstraction layer can be added on top of that.

1.2 Propositional S5 with Abstraction Layers.

Our computational method can be illustrated with the simple example of

a shallow semantic embedding of a propositional S5 logic with abstraction

layers. In order to map modal logic to non-modal higher-order logic we

use Kripke semantics. To that end we introduce a (non-empty) domain i

for possible worlds in terms of a type declaration. In Isabelle/HOL:

typedecl i

Then we deﬁne a type for propositions, which are represented by func-

tions mapping possible worlds to booleans. The right-hand side of the

following in Isabelle/HOL represents the complete set of all (UNIV ) func-

tions from type ito type bool. This set is used to deﬁne a new abstract

type o, whose objects are represented by elements of this set.21

typedef o= "UNIV::(i⇒bool) set" ..

20Kirchner, “Representation and Partial Automation of the PLM in Isabelle/HOL”.

21To introduce a new type the representation set has to be non-empty. The fact that

it is non-empty here can be trivially proven, which is indicated by the two dots at the

end of the line.

7Computer Science and Metaphysics: Cross-Fertilization

Given these deﬁnitions we then lift the already deﬁned connectives of

our meta-logic HOL to the newly introduced type oof propositions in the

target logic:

lift deﬁnition S5 not :: "o⇒o" ("¬" [54] 70)

is "λp. λw. ¬(p w)" .

lift deﬁnition S5 impl :: "o⇒o⇒o" ( inﬁxl "→" 51)

is "λp. λq. λw. (p w)−→ (q w)" .

The ﬁrst deﬁnes the new operator S5 not (with the convenient syntax

of a bold negation ¬) on the abstract type ousing the given λ-function

on the representation type (functions from possible worlds to booleans).

In λp. λw. ¬(p w), the λ-bound pis a function from possible worlds to

booleans (type i⇒bool ) and wis a possible world. The λ-term maps p

and wto the negation of: wapplied to p. So it deﬁnes a function of

type (i⇒bool)⇒i⇒bool, which is exactly the representation type of the

desired signature o⇒o. The implication connective S5 impl with syntax

→is deﬁned in a similar manner.

Using the same mechanism the unique operators of modal logic can

be deﬁned in accordance with their Kripke semantics:

lift deﬁnition S5 box :: "o⇒o" ("



" [62] 63)

is "λp. λw. ∀v. p v" .

lift deﬁnition S5 dia :: "o⇒o" ("♦

♦

♦" [62] 63)

is "λp. λw. ∃v. p v" .

To formulate statements about our newly deﬁned target logic, we still

have to deﬁne what it means for a formula of the target logic to be valid.

There are two options for deﬁning validity, i.e., either as truth relative

to a designated actual world or as truth in all possible worlds. Thus, to

deﬁne validity, we ﬁrst need a deﬁnition of truth relative to a possible

world:

lift deﬁnition S5 true in world :: "i⇒o⇒bool" ("[ |=]")

is "λp. λw. p w" .

It turns out that this is suﬃcient for reasoning about validity; so we

don’t need to choose between the following two alternative deﬁnitions22

of global validity:

22It has been argued that the second option is more philosophically correct, see

Zalta, “Logical and analytic truths that are not necessary”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 8

lift deﬁnition S5 valid nec :: "o⇒bool" ("[ ]")

is "λp. ∀w. p w" .

consts w0:: i

lift deﬁnition S5 valid act :: "o⇒bool" ("A[ ]")

is "λp. p w0" .

What we have so far is a shallow semantical embedding of an S5 modal

logic, implemented using an abstract type in Isabelle/HOL.23 We can al-

ready formulate and prove statements in our target logic at this stage by

initiating what Isabelle/HOL calls a transfer of a given statement to its

counterpart with respect to the representation types, in accordance with

the lifting deﬁnitions.24 So to prove the K♦-lemma, we simply give the

following command:

lemma "[w|=



(p→q)→(♦

♦

♦p→♦

♦

♦q)]"

apply transfer by auto

The proof of this lemma uses the transfer method and is shown to

be valid in the semantics, so the proof doesn’t reveal which particular

axioms, or axiom system, of S5 are needed to derive it in the traditional

sense. In the case of propositional S5 modal logic this doesn’t constitute

a problem, since it is known that it is complete with respect to Kripke

semantics. So everything that is derivable from the semantics will also

be derivable from the standard axioms of S5. However, for more complex

target systems like AOT, this is not the case a priori.

We could, at this point, show how the additional abstraction layers

needed for the proof theory of AOT can be developed, but that would

introduce complexity that isn’t really needed for this discussion. So, in-

stead, we shall illustrate how an abstraction layer can be added to the

above SSE for propositional modal logic. For the remainder of this sec-

tion, then, we proceed as if the completeness results for Kripke semantics

aren’t known. For the analysis of the proof theory of propositional S5

logic, the ﬁrst step is to simultaneously show that the system of proposi-

tional S5 logic is sound with respect to our semantics and construct the

23For the shallow semantical embedding alone we could have skipped the intro-

duction of a new abstract type o, but instead used the representation type i⇒bool

directly in the deﬁnitions; however, using the abstract type makes it easier to introduce

the abstraction layer in the following paragraphs.

24Huﬀman & Kuncar, “Lifting and transfer”.

9Computer Science and Metaphysics: Cross-Fertilization

basis of our abstraction layer by deriving the standard S5 axioms from

the semantics:

lemma ax K: "[w|=



(p→q)→(



p→



q)]"

apply transfer by auto

lemma ax T: "[w|=



p→p]"

apply transfer by auto

lemma ax 5: "[w|=♦

♦

♦p→



♦

♦

♦p]"

apply transfer by auto

Furthermore we need axioms for the classical negation and implication

operators, e.g.,

lemma ax pl 1: "[w|=p→(q→p)]"

apply transfer by auto

and so on for the other axioms of propositional logic.

Next we need to derive the two inference rules, i.e., modus ponens and

necessitation.

lemma mp: assumes "[w|=p]" and "[w|=p→q]"

shows "[w|=q]"

using assms apply transfer by auto

lemma necessitation: assumes "∀v. [v|=p]"

shows "[w|=



p]"

using assms apply transfer by auto

Unfortunately, in our implementation we are lacking structural induc-

tion, i.e., induction on the complexity of a formula. For that reason, we

also have to derive meta-rules for our target system from the semantics,

e.g.,

lemma deduction: assumes "[w|=p]=⇒[w|=q]"

shows "[w|=p→q]"

using assms apply transfer by auto

Together, the axioms, the inference rules and our meta-rules now con-

stitute the abstraction layer in our embedding. Subsequent reasoning can

D. Kirchner, C. Benzm¨

uller, and E. Zalta 10

be restricted so that it doesn’t use the semantic properties of the embed-

ding (i.e., so that it won’t transfer abstract types to representation types

or unfold the semantic deﬁnitions). In this way, proofs can be constructed

that only rely on the axioms and rules themselves.

Given a sane choice of inference rules and meta-rules, every theorem

derived in this manner is guaranteed to be derivable from the axiom sys-

tem. While simple propositional S5 modal logic is known to be complete

with respect to its semantic representation, one can still construct ab-

straction layers to reproduce and analyze the deductive reasoning system

of a particular formalization of S5. The abstraction layer can help a user

in interactive reasoning, since it enables the same mode of reasoning as

the target system with identical rules. More generally, whenever the focus

of an investigation is derivability rather than semantic truth,25 introduc-

ing abstraction layers is either necessary (if there are no completeness

results) or at least helpful (even if there are completeness results), since

they alleviate the need for a translation process from semantic facts to

actual derivations.

A reasonable analysis of AOT is not possible without abstraction lay-

ers. For one, AOT is more expressive than propositional modal logic and

uses foundations that are fundamentally diﬀerent from HOL.26 Therefore

a representation of the semantics and a model structure of AOT in HOL

is more complex and it becomes more diﬃcult to reason about AOT solely

by unfolding semantic deﬁnitions. Furthermore, there are as yet no results

about the completeness of the canonical Aczel models of AOT, so there is

no guarantee that theorems valid in the semantic embedding are in fact

derivable using the axioms and derivation system of AOT itself. Lastly,

although the original motivation for constructing an SSE of AOT was

mainly to investigate the feasibility of a translation between functional

and relational type theory and to gain insights about possible models of

the theory, it turned out that an SSE with abstraction layers can be used

as a means to analyze the eﬀects of variations in the axiomatization of

AOT itself. This led to an evolution of AOT, parts of which are described

in Section 3.

25This is generally the case when investigating an entire logical theory, rather than

a logical argument that might not even specify a ﬁxed axiom system against which it

is formulated.

26AOT is formulated in relational type theory, whereas HOL is based on functional

type theory. A translation between the two is known to be challenging, e.g. see

Oppenheimer & Zalta, “Relations Versus Functions”.

11 Computer Science and Metaphysics: Cross-Fertilization

The remainder of the paper is structured as follows. In Section 2, we

explain how the SSE technique led to insights about G¨odel’s ontological

argument. In Section 3, we discuss the various insights into AOT that

emerged as a result of the addition of the abstraction layer to the SSE for

AOT. Finally, in Section 4, we discuss how our techniques may be general-

ized, and how cross-pollination between computer science and philosophy

works to the beneﬁt of both disciplines.

2 Implementation of G¨odel’s Ontological

Argument

This section outlines the results of a series of experiments in which the

SSE approach was successfully utilized for the computer-supported as-

sessment of modern variants of the ontological argument for the exis-

tence of God. The ﬁrst series of experiments, conducted by Benzm¨uller

and Woltzenlogel-Paleo, focused on G¨odel’s higher-order modal logic vari-

ant,27 as emended by Dana Scott28 and others; the detailed results were

presented in the literature.29 This work had a strong inﬂuence on the

research mentioned above, since its success motivated the question of

whether the SSE approach would eventually scale for more ambitious and

larger projects in computational metaphysics. The computer-supported

assessments of G¨odel’s version of the ontological argument and its variants

revealed several novel ﬁndings some of which will be outlined below.

2.1 Inconsistency and Other Results about G¨odel’s

Argument

In the course of experiments,30 the theorem prover Leo-II detected that

the unedited version of G¨odel’s formulation of the argument31 was incon-

sistent, and that the emendation introduced by Scott32 while transcribing

27G¨odel, “Appendix A. Notes in Kurt G¨odel’s Hand”.

28Scott, “Appendix B: Notes in Dana Scott’s Hand”.

29Benzm¨uller & Paleo, “The inconsistency in G¨odel’s ontological argument”.

Benzm¨uller & Paleo, “Automating G¨odel’s ontological proof”. Benzm¨uller, Weber

& Paleo, “Analysis of the Anderson-H´ajek controversy”. Fuenmayor & Benzm¨uller,

“Types, Tableaus and G¨odel’s God”.

30Benzm¨uller & Paleo, “Automating G¨odel’s ontological proof”.

31G¨odel, “Appendix A. Notes in Kurt G¨odel’s Hand”.

32Scott, “Appendix B: Notes in Dana Scott’s Hand”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 12

the original notes was essential to preserving consistency. The Scott ver-

sion was veriﬁed for logical soundness in the interactive proof assistants

Isabelle/HOL33 and Coq.34 In Figures 2 and 3, the axioms causing the

inconsistency in G¨odel’s manuscript are highlighted. The inconsistency,

which was missed by philosophers, is explained in detail in related publi-

cations.35

The problem G¨odel introduced in his scriptum36 is that essence is

deﬁned as:

P2 A property Yis the essence of an individual xiﬀ all of x’s properties

are entailed by Y, i.e., iﬀ ∀Z(Zx →Y⇒Z),

where Y⇒Zmeans that ∀x(Y x →Z x). We’ll see below that this deﬁni-

tion doesn’t require that an individual xexemplify its essence, something

we would intuitively expect of the notion of an essence. Scott, in contrast,

added a conjunct to the deﬁnition of essence:

P20A property Yis the essence of an individual xiﬀ xhas property Y

and all of x’s properties are entailed by Y.

This simple emendation by Scott preserved consistency of the axioms

G¨odel introduced as premises of the argument.

The inconsistency in G¨odel’s original version already appears when the

argument is formulated in the quantiﬁed modal logic K (with and without

the Barcan formulas), and thus also appears in the stronger logics KB and

S5, which are both extensions of K.37 By proving a simple lemma, one

can demonstrate how the inconsistency arises. The simple lemma is:

EmptyEssenceLemma An empty property (e.g., being non-self-

identical) is an essence of any individual x.

This lemma, in combination with the other highlighted axioms and def-

initions in Figures 2 and 3, implies a contradiction.38 The inconsistency

33Nipkow, Paulson & Wenzel, “Isabelle/HOL“.

34Bertot & Casteran, “Interactive Theorem Proving”.

35Benzm¨uller & Paleo, “Object-logic explanation for the inconsistency in G¨odel’s

ontological theory”. Benzm¨uller & Paleo, “The inconsistency in G¨odel’s ontological

argument”.

36G¨odel, “Appendix A. Notes in Kurt G¨odel’s Hand”.

37Though in S5, the Barcan formulas are derivable.

38Benzm¨uller & Paleo, “Object-logic explanation for the inconsistency in G¨odel’s

ontological theory”.

13 Computer Science and Metaphysics: Cross-Fertilization

was detected automatically by the ATP Leo-II,39 and in the course of the

proof, it used the fact that an empty property obeys the above lemma to

derive the contradiction.40

The investigation using ATPs also yielded other noteworthy results:

•it determined which axioms were otiose,

•it determined which properties of the modal operator were required

for the argument, and

•it determined that the argument, even as emended by Scott, implies

modal collapse, i.e., that φ≡φ, so that there can only be models of

the premises to the argument in which there is exactly one possible

world.

The modal collapse was already noted by Sobel41 but quickly conﬁrmed

by the ATP. One might conclude, therefore that the premises of G¨odel’s

argument imply that everything is determined (we may even say: that

there is no free will).

Further variants of G¨odel’s argument, in which his premises were weak-

ened to address the above issues, were proposed by Anderson, H´ajek, Fit-

ting, and Bjørdal.42 The modal collapse problem was the key motivation

for the contributions of Anderson, H´ajek, and Bjørdal (and many others),

and these have also been investigated computationally.43 Moreover, ATPs

have even contributed44 to the clariﬁcation of an unsettled philosophical

dispute between Anderson and H´ajek. In the course of this work, diﬀerent

notions of quantiﬁcation (actualist and possibilist) have been utilized and

combined within the SSE approach.45

39Benzm¨uller, Sultana, Paulson & Theiß, “The higher-order prover LEO-II”.

40It is interesting to note here that during the course of its discovery of the inconsis-

tency, Leo-II engaged in blind-guessing. That is, it used a primitive substitution rule

to instantiate a predicate quantiﬁer ∀Ywith the λ-expression [λx x 6=x]. This is a

method that is not uniﬁcation-based. See Andrews, “On connections and higher-order

logic”.

41Sobel, “G¨odel’s ontological proof”. Sobel, “Logic and Theism”.

42Anderson, “Some emendations of G¨odel’s ontological proof”. Anderson & Get-

tings, “G¨odel’s ontological proof revisited”. H´ajek, “Magari and others on G¨odel’s

ontological proof”. H´ajek, “Der Mathematiker und die Frage der Existenz Gottes”.

H´ajek, “A new small emendation of G¨odel’s ontological proof”. Fitting, “Types,

Tableaus, and G¨odel’s God”. Bjørdal, “Understanding G¨odel’s ontological argument”.

43Benzm¨uller & Paleo, “The modal collapse”.

44Benzm¨uller, Weber & Paleo, “Analysis of the Anderson-H´ajek controversy”.

45Benzm¨uller & Paleo, “Higher-order modal logics”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 14

2.2 Emendations by Anderson and Fitting

The emendations proposed by C. Anthony Anderson46 and Melvin Fit-

ting47 to avoid the modal collapse are rather distinctive and merit special

consideration. In order to rationally reconstruct Fitting’s argument, an

SSE of the richer logic underlying his argument was constructed. This

same SSE was used to reconstruct Anderson’s argument. By introducing

the mathematical notion of an ultraﬁlter, the two versions of the argu-

ment can be compared. This enhanced SSE technique shows that their

variations of the argument are closely related.

2.2.1 Anderson’s Variant.

Anderson’s central change was to modify a premise that governs the prim-

itive notion of a positive property, which was originally governed by the

axiom: Yis positive if and only if the negation of Yis non-positive (cf. ax-

iom A2 in Figure 2 where an exclusive or is utilized). Anderson suggests

that one direction of the biconditional should be preserved, namely, that:

A20If a property is positive, then its negation is not positive.

As expected, this has an eﬀect on the argument’s validity, and in order

to render the argument logically valid again, Anderson proposes modiﬁ-

cations to premises governing other notions of the argument — in partic-

ular, to those governing the deﬁnition of essence (which Anderson revises

to essence∗) and a modiﬁed notion of Godlikeness (Godlike∗):

essence∗A property Eis an essence∗of an individual xif and only if

all of x’s necessary/essential properties are entailed by Eand (con-

versely) all properties entailed by Eare necessary/essential proper-

ties of x.

Godlike∗An individual xis Godlike∗if and only if all and only the nec-

essary/essential properties of xare positive, i.e., G∗x≡ ∀Y(Y x ≡

P(Y)).

These two amended deﬁnitions render the argument logically valid again.

This was veriﬁed computationally.48 However, the validity comes at the

46Anderson, “Some emendations of G¨odel’s ontological proof”. Anderson & Get-

tings, “G¨odel’s ontological proof revisited”.

47Fitting, “Types, Tableaus, and G¨odel’s God”.

48Fuenmayor & Benzm¨uller, “Alan Gewirth’s Proof”.

15 Computer Science and Metaphysics: Cross-Fertilization

cost of introducing some vagueness in the conception of Godlikeness, since

the new deﬁnition allows for there being distinct Godlike entities, which

diﬀer only by properties that are neither positive nor non-positive.

2.2.2 Fitting’s Variant.

Fitting suggests that there is a subtle ambiguity in G¨odel’s argument,

namely, whether the notion of a positive property applies to extensions

or intensions of properties. In order to study the diﬀerence, Fitting for-

malizes Scott’s emendation in an intensional type theory that makes it

possible for him to encode and compare both alternatives. On Fitting’s

interpretation, the property of being Godlike would be represented by the

λ-expression [λx ∀Y(PY→Y x)], where Pis the second-order property

of being a positive property. On Fitting’s understanding, the variable

Yin the λ-expression ranges over properties whose extensions are ﬁxed

from world to world,49 while Pis a second-order property whose exten-

sion among the ﬁrst-order properties can vary from world to world. Thus,

the λ-expression that deﬁnes the being Godlike is a ﬁrst-order property

whose extension varies from world to world.

In G¨odel’s original version of the argument, positiveness and essence

are second-order properties, but Fitting suggests that the expressions de-

noting the ﬁrst-order properties to which positiveness and essence apply

are not rigid designators; such expressions might have diﬀerent extensions

at diﬀerent worlds. So in Fitting’s variant, positiveness and essence ap-

ply only to the extensions of ﬁrst-order properties, where the expressions

denoting these extensions are rigid designators. If a property is positive

at a world w, its extension at every world is the same as its extension at

w. If we utilize the notion of a rigid property, that is, a property that is

exempliﬁed by exactly the same individuals in all possible circumstances,

then we can say that, on Fitting’s understanding, only rigid properties

can be positive.

It should be noted that this technical notion of a positive property de-

parts from the ordinary notion; for example, a property like being honest

is something a person could have in one world but lack in another, and

in those worlds where he or she has that property, it would be considered

49Thus, the variable Yranges over properties such that ∀x(Y x ≡Y x). For example

one group of such properties can be deﬁned in terms of an actuality operator: properties

of the form [λx Aφ], i.e., being an x that is actually such that φ, satisfy the condition

just stated.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 16

‘positive’ in so far as it is contributory to a good moral character. But,

on the above conception, when a property like being honest is designated

a positive property, then for any actually honest individual x, an alter-

native world in which xis not honest would be inconceivable (i.e., we

take honesty to be an indispensable, identity-constitutive character trait

of x). In this sense, being self-identical is a prototypical positive property.

By restricting the notions in G¨odel’s argument in this way, Fitting thus

leaves Scott’s variant of G¨odel’s argument largely unchanged but is able

to prevent the modal collapse. This was conﬁrmed computationally.50

2.3 Assessment and Comparison using Ultraﬁlters

These emendations proposed by Anderson and Fitting were further inves-

tigated and assessed computationally51 by extending the SSE approach in

the spirit of Fitting’s book. Experiments using Isabelle/HOL that inter-

actively call the model ﬁnder Nitpick conﬁrm that the formula expressing

modal collapse is not valid. The ATPs were still able to ﬁnd proofs for

the main theorem not only in S5 modal logic but even in the weaker and

less controversial logic KB.

In order to compare all the variant arguments by Scott, Anderson,

and Fitting, the notion of an ultraﬁlter was formalised in Isabelle/HOL.

On the technical level, two closely related deﬁnitions of ultraﬁlters were

provided: one (A) is deﬁned on the powerset of individuals, i.e., on the

set of rigid properties, and the other one (A0) is deﬁned on the power-

set of concepts, i.e., on the set of non-rigid, world-dependent properties.

Moreover, in these formalizations of the variants, a careful distinction was

made between the original notion of a positive property (P) that applies

to (intensional) properties and a restricted notion of a positive property

(P0) that applies to the rigidiﬁed extensions of properties that would oth-

erwise count as positive. Using these deﬁnitions the following results were

proved computationally:

•In Scott’s variant both Pand P0coincide, and both have the ultra-

ﬁlter properties Aand A0.

•In Anderson’s variant Pand P0do not coincide, and only P0con-

stitutes an A0ultraﬁlter.

50Fuenmayor & Benzm¨uller, “Alan Gewirth’s Proof”.

51Benzm¨uller & Fuenmayor, “Can computers help to sharpen our understanding of

ontological arguments?”.

17 Computer Science and Metaphysics: Cross-Fertilization

•In Fitting’s variant, Pis not considered an appropriate notion and

so not deﬁned. However, P0is a A0ultraﬁlter.

Our computational experiments thus reveal an intriguing correspondence

between the variants of the ontological argument by Anderson and Fit-

ting, which otherwise seem quite diﬀerent. The variants of Anderson and

Fitting require that only the restricted notion of a positive property is an

ultraﬁlter.

2.4 Future Research

The above insights suggest an alternative approach to the argument,

namely, one that starts out with semantically introducing Por P0as

ultraﬁlters and then reconstructs variants of the formal argument on the

basis of this semantics. This could lead to an alternative reconstruction

in which some of the axioms of the variants described above could be

derived as theorems.

The experimental setup described above also provides a basis for in-

teresting research about how to prove that there is a unique object that

exempliﬁes the property being God. G¨odel’s original premise set guar-

antees that there is a unique such object, but at the pain of modal col-

lapse. The emendations prevent the modal collapse but at the loss of a

unique object that exempliﬁes being God. So it is important to study how

various notions of equality in the context of the various logical settings

described above might help one to restore uniqueness. One particular

motivation is to assess whether diﬀerent notions of equality do or don’t

yield monotheism. Formal results about this issue would be of additional

interest theologically.

3 Implementation of Object Theory

Whereas the last section described the analysis of philosophical arguments

using plain SSEs without abstraction layers, the focus of this section is

the analysis of full philosophical theories by using SSEs with abstraction

layers. Section 1.2 already illustrated a simple example of this. We now

examine a more complicated case, namely, the analysis of AOT.

Though AOT has been developing and evolving since its ﬁrst publica-

D. Kirchner, C. Benzm¨

uller, and E. Zalta 18

tion,52 the basic idea, namely, of distinguishing a new mode of predication

and postulating a plenitude of abstract objects using the new mode of

predication, has remained constant. In all the publications on object the-

ory, we ﬁnd a language containing the new mode of predication ‘xencodes

F’ (‘xF ’), in which Fis a 1-place predicate. This new mode extends the

traditional second-order modal predicate calculus, which is based on a sin-

gle mode of predication, namely, x1, . . . , xnexemplify Fn(‘Fnx1. . . xn’).

The resulting language allows complex formulas built up from the two

modes of predication and the system allows the two modes to be com-

pletely independent of one another (neither xF →F x nor F x →xF is a

theorem).

Using such a language (extended to include deﬁnite descriptions and

λ-expressions), the basic deﬁnitions and axioms of AOT have also re-

mained constant. If we start with a distinguished predicate E! to assert

concreteness, then the basic deﬁnitions and axioms of AOT are:

Deﬁnition: Being ordinary is (deﬁned as) being possibly concrete:

O!=[λx ♦E!x]

Axiom: Ordinary objects necessarily fail to encode properties.

O!x→¬∃F(xF )

Deﬁnition: Being abstract is (deﬁned as) not possibly being con-

crete.

A!=[λx ¬♦E!x]

Axiom: If an object possibly encodes a property it necessarily does.

♦xF →xF

Comprehension Schema for Abstract Objects: Where ϕis any con-

dition on properties, there is an abstract object that encodes exactly

the properties such that ϕ, i.e., ∃x(A!x&∀F(xF ≡ϕ)), where ϕ

has no free occurrences of x.

In AOT, identity is not a primitive notion, and so the above deﬁnitions

and axioms are supplemented by a deﬁnition of identity for objects and a

deﬁnition of identity for properties, relations and propositions. The three

most important deﬁnitions are:

52Zalta, “Abstract Objects”.

19 Computer Science and Metaphysics: Cross-Fertilization

Objects xand yare identical if and only if either xand yare both

ordinary objects that necessarily exemplify the same properties or

xand yare both abstract objects that necessarily encode the same

properties.

Properties Fand Gare identical if and only if they are necessarily en-

coded by the same objects.

Propositions pand qare identical just in case the properties [λx p] and

[λx q] are identical.

While this basis has remained stable, other parts of the theory have been

developed and improved over the years. The most recent round of im-

provements, however, has been prompted by computational studies. Some

of these improvements have not yet been published. Nevertheless, we’ll

describe them here.

For example, in earlier versions of object theory, λ-expressions of the

form [λx1. . . xnϕ] in which ϕcontained encoding subformulas were sim-

ply not well-formed. That’s because certain well-known paradoxes of

encoding could arise for λ-expressions like [λx ∃F(xF &¬F x)].53 But

Kirchner’s computational studies54 showed that unless one is extremely

careful about the formation rules, such paradoxes could arise again by

constructing λ-expressions in which the matrix ϕincluded descriptions

with embedded encoding formulas (encoding formulas embedded in de-

scriptions don’t count as subformulas, and thus were allowed). A natural

solution to avoid the re-emergence of paradox is to no longer assume that

all λ-expressions have a denotation. Given that AOT already included a

free logic to handle non-denoting descriptions, its free logic was extended

to cover λ-expressions. This allowed us to suppose that λ-expressions are

well-formed even if they include encoding subformulas; the paradoxical

ones simply don’t denote.

Other changes to object theory that have come about as a result of

computational studies include:

•the notion of encoding was extended to n-ary encoding formulas

and these allow one to deﬁne the logical notion of term existence

53An instance of Comprehension for Abstract Objects that asserted the existence of

an object that encodes just such a property would provably exemplify that property if

and only if it did not.

54Kirchner, “Representation and Partial Automation of the PLM in Isabelle/HOL”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 20

directly by way of predication instead of by way of the notion of

identity,

•the comprehension principle for propositions has been extended to

cover all formulas of the language, so that even encoding formulas

denote propositions, and

•the application of AOT to the theory of possible worlds, in which the

latter are deﬁned as abstract objects of a certain sort, was enhanced:

the fundamental theorem for possible worlds, which asserts that a

proposition is necessarily true if and only if it is true at all possible

worlds, was extended to cover the new encoding propositions.

These will be explained further below, as we show how AOT was ﬁrst

implemented computationally and how this led to reﬁnements both of the

theory and its implementation.

3.1 Construction of an SSE of AOT in Isabelle/HOL

The ﬁrst SSE of AOT that introduced abstraction layers can be found in

Kirchner’s work.55 A detailed description of the structure of this SSE is

beyond the scope of this paper, however, we can nevertheless illustrate

some of its features and the challenges it had to overcome.

In order to construct an SSE, one has to represent the general model

structure of AOT in Isabelle/HOL. The most general models of AOT

are Aczel models,56 an enhanced version of which we now describe. Aczel

models consist of a domain of Urelements that is partitioned into ordinary

Urelements and special Urelements. The ordinary Urelements represent

AOT’s ordinary objects, whereas the special Urelements will act as prox-

ies for AOT’s abstract objects and determine which properties abstract

objects exemplify. In addition, a domain of semantic possible worlds (and

intensional states) is assumed, and propositions are represented either as

intensions (i.e., functions from possible worlds to Booleans) or more gen-

erally as hyperintensions (i.e., functions from intensional states to inten-

sions). This way the relations of AOT can be introduced before specifying

the full domain of AOT’s individuals: AOT’s relations can be modeled as

functions from Urelements to propositions (as the latter were just repre-

sented). Since this already ﬁxes the domain of properties, a natural way

55Kirchner, “Representation and Partial Automation of the PLM in Isabelle/HOL”.

56Zalta, “Natural Numbers and Natural Cardinals as Abstract Objects”.

21 Computer Science and Metaphysics: Cross-Fertilization

to represent AOT’s abstract objects that validates their comprehension

principle is to model them as sets of properties (i.e., as sets of functions

from Urelements to propositions). The domain of AOT’s individuals can

now be represented by the union of the set of ordinary Urelements and

the set of sets of properties. In order to deﬁne truth conditions for ex-

empliﬁcation formulas involving abstract objects, a mapping σthat takes

abstract objects to special Urelements is required.57 With the help of this

proxy function σ, the truth conditions of AOT’s atomic formulas can be

deﬁned as follows:

•The truth conditions of an exempliﬁcation formula Fnx1. . . xnare

determined by the proposition obtained by applying the function

used to represent Fnto the Urelements corresponding to x1, . . . , xn

(in such a way that when xiis an abstract object, then its Urelement

is the proxy σ(xi)). This yields a proposition, which can then be

evaluated at a speciﬁc possible world (and in the hyperintensional

case, at the designated ‘actual’ intensional state).

•An encoding formula xF is true if and only if xis an abstract

object and the function representing Fis contained in the set of

functions representing x. An ordinary ob ject xdoes not encode

any properties, so all formulas of the form xF are false when xis

ordinary.58

In earlier formulations, AOT relied heavily on the notion of a propo-

sitional formula, namely, a formula free of encoding subformulas. This

notion played a role in relation comprehension: only propositional for-

mulas could be used to deﬁne new relations. However, we realized that

in the modal version of AOT, encoding formulas are either necessarily

true if true or necessarily false if false. This led to the realization that in

the models we had constructed, all formulas could be assigned a proposi-

tion as denotation; encoding formulas could denote propositions that are

necessarily equivalent to necessary truths or necessary falsehoods. As a

result, the latest (unpublished) versions of AOT have been reformulated

57Note that for the model to be well-founded, the function σcannot be injective,

i.e., σmust map some distinct abstract objects to the same special Urelement.

58The truth conditions for n-ary encoding formulas x1...xnFncan be deﬁned on

the basis of monadic encoding formulas, but this requires an appeal to the semantics of

complex λ-expressions, discussed below. Hence we omit the discussion of this further

development here.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 22

without the notion of a propositional formula and one of the consequences

of this move is that comprehension for propositions can be extended to

all formulas (this will be discussed further in Section 3.3).

What remains to be deﬁned are the denotations for AOT’s complex

terms, namely, deﬁnite descriptions and λ-predicates. Descriptions may

fail to denote and, since AOT follows Russell’s analysis of deﬁnite descrip-

tions, atomic formulas containing a non-denoting description are treated

as false. Therefore, the embedding has to distinguish between the domain

of individuals and the domain of individual terms. The latter domain con-

sists of the domain of individuals plus an additional designated element

that represents non-denoting terms. If there exists a unique assignment

to xfor which it holds that ϕ, the deﬁnite description ıxϕ denotes this

unique object. If there is no unique such object, ıxϕ denotes the des-

ignated element in the domain of individual terms that represents non-

denoting terms. The truth conditions of atomic formulas can now just be

lifted to the new domain of terms, with the result that an atomic formula

involving the designated element for non-denoting terms becomes false.

In published versions of AOT, every well-formed λ-expression was as-

serted to have a denotation. However, AOT now allows λ-expressions

with encoding subformulas and requires that some of these (in particular,

the paradoxical ones) don’t denote. Only the λ-expressions that denote

are governed by β-Conversion. Nevertheless, every λ-expression has to be

interpreted in the model, and the mechanism for doing this is as follows,

where we simplify by discussing only the 1-place case and where we sup-

pose that an ordinary object serves as its own proxy. When the matrix ϕ

of the λ-expression [λxϕ] has the same truth conditions for all objects that

have the same proxy, one can ﬁnd a function from Urelements to propo-

sitions that, when used to represent [λx ϕ], preserves β-Conversion.59

There is no such function when the matrix has diﬀerent truth conditions

for objects with the same proxy, but these are precisely the matrices

for which the λ-expressions provably fail to denote. We interpret these

λ-expressions in a manner similar to the interpretation of non-denoting

descriptions, namely, by introducing an additional domain for relation

59For example, if we make use of the λ-expressions of HOL’s functional type theory,

then we could point to (λu.∃x. u =|x| ∧ ϕ0x) as such a function, where (a) ϕ0is a

function that represents the matrix ϕof the AOT λ-expression [λx ϕ] and maps the

bound variable xto a proposition, (b) the type of the bound variable uis the type of

Urelements, and (c) |x|is the Urelement corresponding to x.

23 Computer Science and Metaphysics: Cross-Fertilization

terms that extends the domain of relations with a designated element for

non-denoting terms. Since the condition under which [λx ϕ] cannot de-

note is easy to formulate, namely as ∃x∃y(∀F(F x ≡F y)) ∧ ¬(ϕ≡ϕy

x),

such expressions can be mapped to this designated element.

Given the presence of non-denoting descriptions and λ-expressions,

AOT extended its free logic for descriptions to cover all complex terms.

Note that the axioms of free logic are usually stated in terms of a primitive

notion of identity or a primitive notion of existence (↓) for terms, so that,

for example, the axiom for instantiating terms into universal claims can

be stated as one of the following:

∀αϕ →(∃β(β=τ)→ϕτ

α)

∀αϕ →(τ↓ → ϕτ

α)

Normally, these are equivalent formulations, since one usually deﬁnes τ↓

≡ ∃β(β=τ).

However, object theory now proves this standard deﬁnition as a theo-

rem! As we saw above, it doesn’t take identity as a primitive, but rather

deﬁnes it. Moreover, AOT does not take term existence as primitive ei-

ther, but deﬁnes it as well by cases: (a) an individual term κexists (‘κ↓’)

just in case ∃F F κ, provided Fisn’t free in κ, and (b) an n-place property

term Π exists (‘Π↓’) just in case ∃x1. . . ∃xnx1. . . xnΠ, provided no xiis

free in Π, and (c) a 0-place proposition term Π exists (‘Π↓’) just in case

[λx Π]↓, provided xisn’t free in Π. Thus, object theory reduces existence

to predication, and indeed, given its deﬁnitions of identity, reduces iden-

tity to predication and existence.60 Given the foregoing deﬁnitions, the

claim τ↓ ≡ ∃β(β=τ) becomes a theorem.

60To see how the latter comes about (i.e., the reduction of identity to predication and

existence), note that in a system like AOT, the deﬁnition of property identity stated

in the opening paragraphs of Section 3, have to be formalized using metavariables and

existence clauses in the deﬁniens, so that we have:

Π=Π0=df Π↓& Π0↓&∀x(xΠ≡xΠ0)

The metavariables ensure that the deﬁniendum Π = Π0will be provably false when

either Π or Π0is non-denoting. Otherwise one could argue, for non-denoting Π and

Π0, that both xΠ and xΠ0are equivalent (since both are false, given that atomic

formulas with non-denoting terms are false), and since this holds for arbitrary xand

can be proved without an appeal to contingencies, it follows that ∀x(xΠ≡xΠ0). So

without the existence clauses, we could prove that Π = Π0for any non-denoting terms

Π and Π0.

So whereas identity claims in AOT require the existence of the terms ﬂanking the

identity sign, this is not required in computational implementations of other interest-

D. Kirchner, C. Benzm¨

uller, and E. Zalta 24

3.2 Minimal models of second-order modal AOT

Normally, the minimal model for ﬁrst-order quantiﬁed modal logic (QML)

contains one possible world and one individual, and in second-order QML,

there have to be at least two properties (one true of everything and one

false of everything). So, a natural question arises: what is the most nat-

ural axiom that forces the domain of possible worlds to have at least

two members (so as to exclude modal collapse), and what eﬀect does

that have on the domain of properties? We’ve discovered that the ax-

iom Zalta has proposed for this job in AOT, namely, the assertion that

♦∃x(E!x&¬AE!x), not only forces the models to have at least 2 possible

worlds, but also a minimum of 4 propositions and (in combination with

the comprehension principle for abstract objects) a minimum of 16 prop-

erties. Proofs of these facts are available within the system. The latter

fact improved upon the original discussion in PLM, which had asserted

only that there are at least 6 diﬀerent properties.61 But once properties

in AOT were modeled in Isabelle/HOL as functions from Urelements and

possible worlds to Booleans, it was recognized that there had to be at

least 16 of those functions.

The two core axioms that need to be considered for minimal models

of AOT are the modal axiom that requires the existence of a contingently

nonconcrete object already mentioned above and the comprehension ax-

iom of abstract objects:

♦∃x(E!x&¬AE!x)

∃x(A!x&∀F(xF ≡ϕ))

where being abstract (A!) in the second axiom is deﬁned as not possibly

being concrete, i.e., where A!=[λx ¬♦E!x]. In particular, the ﬁrst of

these axioms implies:

∃x(♦E!x&¬AE!x)

while the second implies:

∃x(¬♦E!x)

ing logics. For example, Scott introduces both a notion of “identity” and “existing

identity”, where the latter corresponds to AOT’s notion of identity. See Benzm¨uller &

Scott, “Automating free logic in HOL”.

61Originally, Zalta had proved that E! and its negation, O!, A!, [λx E!x→E!x] and

the latter’s negation, all of which exist by comprehension, were distinct properties.

25 Computer Science and Metaphysics: Cross-Fertilization

From these consequences it follows that there are at least two distinct

individuals; let’s call them x1and x2.62 The proof makes it clear that x1

is ordinary (i.e., O!x1= [λz ♦E!z]x1) and x2is abstract. But by the con-

struction of Aczel models, the proxy Urelement of the abstract individual

can’t be the ordinary individual. Urelements in Aczel models determine

the exempliﬁcation behaviour of individuals. So since x1exempliﬁes be-

ing ordinary while x2does not, x1and x2have to be mapped to distinct

Urelements. Furthermore, the ﬁrst statement ∃x(♦E!x&¬AE!x), im-

plies that there are at least two possible worlds in the Kripke semantics,

namely, a non-actual world, in which E!x1holds, and the actual world,

in which E!x1does not hold.

Recall that in our models, relations are represented as functions from

Urelements and possible worlds to Booleans.63 So, by a combinatorial

argument from the existence of two possible worlds and two Urelements,

we may derive the existence of at least (22)2= 16 relations in the model;

each relation has a well-deﬁned and distinct exempliﬁcation extension.

However, this doesn’t yet show, within the system, that there are at

least 16 distinct relations, but only that there are at least 16 distinct

relations in our models (we don’t assume a priori that our models are

complete). However, we found a proof of the existence of at least 16

relations in AOT and this is now part of PLM.64

62To see this, instantiate these two existential claims using two individual variables

x1and x2, such that:

♦E!x1&¬AE!x1

¬♦E!x2

To show that x16=x2, we need the principle of the substitution of identicals, which is

asserted by the following axiom:

α=β→(ϕ→ϕ0), whenever βis substitutable for αin ϕ, and ϕ0is the result

of replacing zero or more free occurrences of αin ϕwith occurrences of β.

Now if, for reductio, x1=x2, then ♦E!x1→♦E!x2, but since ¬♦E!x2, this cannot be

true, hence x16=x2. This already shows that there are at least two individuals AOT.

63In hyperintensional models, they additionally depend on an intensional state, but

since there is only one intensional state in a minimal model, this dependency can be

ignored; it doesn’t aﬀect the size of the model.

64The modal axiom ∃x(♦E!x&¬AE!x) of AOT requires the existence of a contin-

gently false proposition, namely ∃x(E!x&¬AE!x). Call the false proposition q0and

its negation q0. These propositions (in the form of propositional properties [λx q0] and

[λx q0]) were not considered when it was thought there were at least 6 properties. It

turns out that they are provably distinct from the six other properties mentioned above

and that combinations (e.g., conjunctions) of these propositional properties and the

D. Kirchner, C. Benzm¨

uller, and E. Zalta 26

The foregoing discussion illustrates our research methodology: (1) we

constructed a model for the theory and conjectured that it was com-

plete; (2) we then analyzed the features of the model and arrived at

statements formulable within the systems AOT and its representation in

Isabelle/HOL that should be true given the model; (3) we investigated

whether these statements are indeed derivable in AOT (or alternatively,

derivable in the abstraction layer of the embedding); and (4) we then con-

cluded either that we had derived a new theorem within these systems or

that the model needed to be further reﬁned.

3.3 An Extended Theory of Propositions and Worlds

One of the key challenges in constructing the ﬁrst SSE of AOT was the

fact that its syntax relied heavily on the use of the notion of a proposi-

tional formula (i.e., formulas with no encoding subformulas). Only propo-

sitional formulas were allowed in the construction of n-place complex re-

lation terms for n≥0. ϕand [λ ϕ] were designated as 0-place relation

terms only if ϕwas a propositional formula. But capturing the notion of

a propositional formula in the SSE would have increased its complexity

signiﬁcantly. For example, it would have been necessary to deﬁne two

versions of every connective and quantiﬁer, one for non-propositional for-

mulas and one for propositional formulas. Instead, the SSE used one type

for both kinds of formulas, and thus one kind of connective and quantiﬁer

suﬃces.

However, from this it became apparent that the models used for the

SSE assigned every formula a proposition, including those formulas that

contained encoding subformulas. This suggested that AOT could be ex-

panded similarly. Consequently, the comprehension principles for propo-

sitions in AOT were revised and expanded in such a way that it has

become a theorem that every formula denotes a proposition. And once

every formula denotes a proposition, the fundamental theorem of possi-

ble worlds becomes naturally extended to cover all formulas and not just

propositional ones. The fundamental theorem of possible world theory

asserts that for every proposition pand every world w,p≡w|=p,

where w|=passerts that pis true in w(where this, in turn, is cashed out

as: wencodes the propositional property [λx p]). In previous versions of

six properties mentioned above in fact yield 16 properties that are provably distinct in

the system and correspond to the 16 properties in the models.

27 Computer Science and Metaphysics: Cross-Fertilization

AOT, only propositional formulas could be substituted for p, since only

propositional formulas denoted propositions. But once AOT was extended

(as a result of our computational investigations), every formula becomes

substitutable for p, including those with encoding subformulas.

4 Generalizing the Cross-Fertilization

As we see it, computer science and related disciplines like philosophy

that rely heavily on reasoning and argumentation, beneﬁt from interdis-

ciplinary studies in which computational techniques are applied. Histor-

ically, the realization that ﬁrst-order theorem provers don’t capture the

higher-order logic of many applied systems created the impetus for the de-

velopment of systems like Isabelle/HOL. In this paper, we’ve seen that the

requirements for implementing logics and metaphysical theories has led to

the development of new methodologies for creating automated reasoning

environments for complex systems (e.g., those that are essentially higher-

order, non-classical, or have complex terms). This is especially clear in

the development of additional abstraction layers in which deductive sys-

tems are recaptured so that only the theorems of the target system, and

no artifactual theorems, can be discovered computationally. Abstraction

layers in turn can be used as a technical tool to analyze properties of

the implementation, and in the case of AOT, the completeness of its em-

bedding. In our particular work, not only did the interdisciplinary eﬀort

lead to improvements in the computational methodologies used for mod-

eling, but those same methodologies led to improvements in the target

metaphysical theory being implemented.

This cross-fertilization methodology can be depicted more generally

in Figure 1. In this diagram, the cross-fertilization occurs primarily be-

tween the various interactions that the user can have with the front-end

systems and applications. Note that Isabelle/HOL integrates state-of-the

art automated reasoning technology and beneﬁts from the constant im-

provements in all the systems that it integrates. In the lower left corner

of Figure 1, the user is conducting/orchestrating experiments; in this par-

ticular case, the application in the lowest blue box is (the metaphysics of)

AOT. Since AOT is based on a higher-order modal logic, the computa-

tional mechanization of this “target logic” (in the middle blue box) has

served as a signiﬁcant goal. However, at the start of the project, AOT’s

proof theory wasn’t computationally implemented generally. Therefore

D. Kirchner, C. Benzm¨

uller, and E. Zalta 28

(Counter-)Model

Nitpick

Proof Automation

Sledgehammer

HOL-ATP

Leo-II/III, Satallax

FOL-ATP

E, Spass, Vampire

SMT-Solver

CVC4, Z3

SAT-Solver

(Counter-)Model

Nunchaku

(Isabelle/HOL)

HOL!

—meta logic—!

HO Modal Logic(s)!

—target logic—!

Metaphysics!

—application—!

models

embeds

unfolds

into

unfolds

into

Paradox

Kodkod

smbc

may-call-as-subsystem

interacts-with (thickness indicates intensity)

cross-fertilizes

Figure 1: Our general methodology supports the reuse of state of the art

theorem proving technology

the task was to semantically embed the language and theory in HOL

(the top blue box), which turned out to be suﬃciently expressive as a

meta-logic for second-order AOT. A core advantage of this meta-logical

approach is that existing reasoning tools for HOL can readily be reused

for interactive and automated reasoning in the embedded target logic (the

black arrows). This is particularly helpful when the details of a desired

language and theory in a given context are not fully determined yet; the

methodology enables rapid prototyping of the diﬀerent ways of formulat-

ing the language and axioms of the theory.

Our preferred proof assistant for HOL has been Isabelle/HOL. This

system comes with strong user-interaction support, including a conﬁg-

urable user-interface, which, in our context, enables readable surface pre-

sentations of the embedded target logic. Equally important is the au-

tomation provided by the proof assistants, which include both external

29 Computer Science and Metaphysics: Cross-Fertilization

ATPs orchestrated by the Sledgehammer tool65 and automated (counter-

)model ﬁnding tools like Nitpick66 and Nunchaku.67 These systems, in

turn, make calls to specialist tools such as Kodkod, Paradox, smbc, and

the SMT solvers CVC468 and Z3.69 Other systems integrated with Sledge-

hammer include the ﬁrst-order ATPs E,70 Spass,71 Vampire,72 and the

higher-order ATPs Leo-II,73 Leo-III,74 and Satallax.75 If one downloads

Isabelle/HOL, all of these systems are bundled with it, except for the

higher order provers like Leo-II, Leo-III and Satallax, which can be ac-

cessed via the TPTP infrastructure using remote calls. These higher-

order ATPs internally collaborate in turn with ﬁrst-order ATPs and SMT

solvers. And all these ATPs and SMT solvers internally rely on or inte-

grate state-of-the art SAT technology. Thus, whenever one of the sub-

systems improves, the enhancements ﬁlter up to the Isabelle/HOL envi-

ronment. In other words, a proof conjecture in some theory that is not

automatically solvable at the present time may well become solvable as

improvements to this framework accumulate.

When moving to other application domains (e.g., machine ethics),

deontic logics become relevant as target logics. The overall pictures stays

the same. Only the two lower blue boxes on the left of the Figure change.

Note that the combinations of diﬀerent non-classical logics, e.g., those

required for the encoding of the Gewirth principle of generic consistency,76

can be realized and assessed as targets in this framework.

What has been described above is a generic approach to universal log-

ical and metalogical reasoning77 based on shallow semantic embeddings

in HOL. In addition, the approach also supports the direct encoding of

a target logic’s proof theory of choice. The shallow semantic embedding

technique and associated reasoning framework described in the previous

sections scale to applications in many other areas, including, for example,

65Blanchette, B¨ohme & Paulson “Extending Sledgehammer with SMT solvers”.

66Blanchette & Nipkow, “Nitpick”.

67Cruanes & Blanchette, “Extending nunchaku to dependent type theory”.

68Deters, Reynolds, King, Barrett & Tinelli, “A tour of CVC4”.

69Moura & Bjørner, “Z3: An eﬃcient smt solver”.

70Schulz, “System description: E”.

71Blanchette, Popescu, Wand & Weidenbach, “More SPASS with Isabelle”.

72Kov´acs & Voronkov, “First-Order Theorem Proving and Vampire”.

73Benzm¨uller, Sultana, Paulson & Theiß, “The higher-order prover LEO-II”.

74Steen & Benzm¨uller, “The higher-order prover Leo-III”.

75Brown, “Satallax”.

76Fuenmayor & Benzm¨uller, “Alan Gewirth’s Proof”.

77Benzm¨uller, “Universal (meta-)logical reasoning”.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 30

mathematical foundations, artiﬁcial intelligence and machine ethics. In

particular, metalogical investigations are feasible beyond what was con-

sidered possible before. In a case study in mathematics, for example,

Benzm¨uller and Scott78 compared diﬀerent axiom systems for category

theory proposed by MacLane,79 Scott,80 and Freyd & Scedrov.81 This

work started with an embedding of free logic in HOL, which was then

utilized to encode and assess the diﬀerent axiom systems. As a side result

of the studies, a minor ﬂaw in the work of Freyd and Scedrov was revealed

and corrected. Applications in artiﬁcial intelligence include the veriﬁca-

tion of the dependency diagrams of systems in modal logic82 and an ele-

gant, higher-order encoding of common knowledge (of a group of agents)

as part of a solution for the wise men puzzle, a famous riddle in artiﬁcial

intelligence.83 A normative-reasoning workbench supporting empirical

studies with alternative deontic logics that are resistant to contrary-to-

duty paradoxes is currently being developed,84 and various embeddings of

other logics in this area can be found elsewhere.85 A recent extension and

application of this framework86 demonstrates that even ambitious ethical

theories such as Alan Gewirth’s principle of generic consistency can be

formally encoded and assessed on the computer.

References

J. Alama, P. E. Oppenheimer, and E. N. Zalta. Automating leibniz’s

theory of concepts. In A. P. Felty and A. Middeldorp, editors, Au-

tomated Deduction - CADE-25 - 25th International Conference on

Automated Deduction, Berlin, Germany, August 1-7, 2015, Proceed-

ings, volume 9195 of Lecture Notes in Computer Science, pp. 73–97.

Springer, 2015.

78Benzm¨uller & Scott, “Automating free logic in HOL”. Benzm¨uller & Scott, “Axiom

systems for category theory in free logic”.

79MacLane, “Groups, categories and duality”.

80Scott, “Identity and existence in intuitionistic logic”.

81Freyd & Scedrov, “Categories, Allegories”.

82Benzm¨uller, Claus & Sultana, “Systematic veriﬁcation of the modal logic cube”.

83Benzm¨uller, “Universal (meta-)logical reasoning”.

84Benzm¨uller, Parent & Torre, “A deontic logic reasoning infrastructure”.

85Benzm¨uller, Farjami & Parent, “A dyadic deontic logic in HOL”. Benzm¨uller,

Farjami & Parent, “Aqvist’s dyadic deontic logic E in HOL”. Farjami, Meder, Parent

& Benzm¨uller, “I/O logic in HOL”.

86Fuenmayor & Benzm¨uller, “Alan Gewirth’s Proof”.

31 Computer Science and Metaphysics: Cross-Fertilization

C. A. Anderson. Some emendations of G¨odel’s ontological proof. Faith

and Philosophy, 7(3):291–303, 1990.

C. A. Anderson and M. Gettings. G¨odel’s ontological proof revisited. In

G¨odel’96: Logical Foundations of Mathematics, Computer Science,

and Physics: Lecture Notes in Logic 6, pp. 167–172. Springer, 1996.

P. B. Andrews. On connections and higher-order logic. Journal of

Automated Reasoning, 5(3):257–291, 1989.

M. Bentert, C. Benzm¨uller, D. Streit, and B. Woltzenlogel Paleo. Anal-

ysis of an ontological proof proposed by Leibniz. In C. Tandy, edi-

tor, Death and Anti-Death, Volume 14: Four Decades after Michael

Polanyi, Three Centuries after G.W. Leibniz. Ria University Press,

2016. Preprint URL:

http://christoph-benzmueller.de/papers/B16.pdf.

C. Benzm¨uller. Universal (meta-)logical reasoning: Recent successes.

Science of Computer Programming, 172:48–62, March 2019. doi:

https://doi.org/10.1016/j.scico.2018.10.008.

C. Benzm¨uller, M. Claus, and N. Sultana. Systematic veriﬁcation of the

modal logic cube in Isabelle/HOL. In C. Kaliszyk and A. Paskevich,

editors, PxTP 2015, volume 186, pp. 27–41, Berlin, Germany, 2015.

EPTCS.

C. Benzm¨uller, A. Farjami, and X. Parent. Aqvist’s dyadic deontic logic

E in HOL, 2018. MIREL 2018 workshop on MIning and REasoning

with Legal texts; available online at

http://orbilu.uni.lu/handle/10993/37014.

C. Benzm¨uller, A. Farjami, and X. Parent. A dyadic deontic logic

in HOL. In J. Broersen, C. Condoravdi, S. Nair, and G. Pigozzi,

editors, Deontic Logic and Normative Systems — 14th International

Conference, DEON 2018, Utrecht, The Netherlands, 3-6 July, 2018,

pp. 33–50. College Publications, 2018. (John-Jules Meyer Best

Paper Award).

C. Benzm¨uller and D. Fuenmayor. Can computers help to sharpen

our understanding of ontological arguments? In S. Gosh, R. Up-

palari, K. V. Rao, V. Agarwal, and S. Sharma, editors, Mathemat-

D. Kirchner, C. Benzm¨

uller, and E. Zalta 32

ics and Reality, Proceedings of the 11th All India Students’ Con-

ference on Science & Spiritual Quest (AISSQ), 6-7 October, 2018,

IIT Bhubaneswar, Bhubaneswar, India, pp. 195–226. The Bhak-

tivedanta Institute, Kolkata, 2018.

C. Benzm¨uller, X. Parent, and L. van der Torre. A deontic logic rea-

soning infrastructure. In F. Manea, R. G. Miller, and D. Nowotka,

editors, 14th Conference on Computability in Europe, CiE 2018,

Kiel, Germany, July 30-August, 2018, Proceedings, volume 10936

of Lecture Notes in Computer Science, pp. 60–69. Springer, 2018.

C. Benzm¨uller and L. Paulson. Quantiﬁed multimodal logics in simple

type theory. Logica Universalis, 7(1):7–20, 2013.

C. Benzm¨uller and D. S. Scott. Axiom systems for category theory in

free logic. Archive of Formal Proofs, May 2018. URL =

http://isa-afp.org/entries/AxiomaticCategoryTheory.html

C. Benzm¨uller and D. S. Scott. Automating free logic in HOL, with an

experimental application in category theory. Journal of Automated

Reasoning, 2019. doi:

http://dx.doi.org/10.1007/s10817-018-09507-7.

C. Benzm¨uller, N. Sultana, L. C. Paulson, and F. Theiß. The higher-

order prover LEO-II. Journal of Automated Reasoning, 55(4):389–

404, 2015.

C. Benzm¨uller, L. Weber, and B. Woltzenlogel Paleo. Computer-assisted

analysis of the Anderson-H´ajek controversy. Logica Universalis,

11(1):139–151, 2017.

C. Benzm¨uller and B. Woltzenlogel Paleo. Automating G¨odel’s ontolog-

ical proof of God’s existence with higher-order automated theorem

provers. In T. Schaub, G. Friedrich, and B. O’Sullivan, editors,

ECAI 2014, volume 263 of Frontiers in Artiﬁcial Intelligence and

Applications, pp. 93–98. IOS Press, 2014.

C. Benzm¨uller and B. Woltzenlogel Paleo. Higher-order modal logics:

Automation and applications. In A. Paschke and W. Faber, editors,

Reasoning Web 2015, Lecture Notes in Computer Science: 9203,

pp. 32–74, Berlin, Germany, 2015. Springer.

33 Computer Science and Metaphysics: Cross-Fertilization

C. Benzm¨uller and B. Woltzenlogel Paleo. Interacting with modal log-

ics in the Coq proof assistant. In L. D. Beklemishev and D. V.

Musatov, editors, Computer Science — Theory and Applications —

10th International Computer Science Symposium in Russia, CSR

2015, Listvyanka, Russia, July 13-17, 2015, Proceedings, volume

9139 of Lecture Notes in Computer Science, pp. 398–411. Springer,

2015.

C. Benzm¨uller and B. Woltzenlogel Paleo. An object-logic explanation

for the inconsistency in G¨odel’s ontological theory (extended ab-

stract, sister conferences). In M. Helmert and F. Wotawa, editors,

KI 2016: Advances in Artiﬁcial Intelligence, Proceedings, Lecture

Notes in Computer Science, pp. 244–250, Berlin, Germany, 2016.

Springer.

C. Benzm¨uller and B. Woltzenlogel Paleo. The inconsistency in G¨odel’s

ontological argument: A success story for AI in metaphysics. In

S. Kambhampati, editor, IJCAI 2016, volume 1-3, pp. 936–942.

AAAI Press, 2016.

C. Benzm¨uller and B. Woltzenlogel Paleo. The modal collapse as a

collapse of the modal square of opposition. In J.-Y. B´eziau and

G. Basti, editors, The Square of Opposition: A Cornerstone of

Thought (Collection of papers related to the World Congress on the

Square of Opposition IV, Vatican, 2014), Studies in Universal Logic,

pp. 307–313. Springer International Publishing Switzerland, 2016.

http://www.springer.com/us/book/9783319450612.

Y. Bertot and P. Casteran. Interactive Theorem Proving and Program

Development – Coq’Art: The Calculus of Inductive Constructions.

Texts in Theoretical Computer Science. Springer, 2004.

F. Bjørdal. Understanding G¨odel’s ontological argument. In T. Childers,

editor, The Logica Yearbook 1998, pp. 214–217. Filosoﬁa, 1999.

J. C. Blanchette, S. B¨ohme, and L. C. Paulson. Extending Sledgeham-

mer with SMT solvers. Journal of Automated Reasoning, 51(1):109–

128, 2013.

J. C. Blanchette and T. Nipkow. Nitpick: A counterexample gener-

ator for higher-order logic based on a relational model ﬁnder. In

D. Kirchner, C. Benzm¨

uller, and E. Zalta 34

M. Kaufmann and L. C. Paulson, editors, Interactive Theorem Prov-

ing, First International Conference, ITP 2010, Edinburgh, UK, July

11-14, 2010. Proceedings, volume 6172 of Lecture Notes in Com-

puter Science, pp. 131–146. Springer, 2010.

J. C. Blanchette, A. Popescu, D. Wand, and C. Weidenbach. More

SPASS with Isabelle – Superposition with Hard Sorts and Con-

ﬁgurable Simpliﬁcation. In L. Beringer and A. P. Felty, editors,

Interactive Theorem Proving — Third International Conference,

ITP F2012, Princeton, NJ, USA, August 13-15, 2012. Proceedings,

volume 7406 of Lecture Notes in Computer Science, pp. 345–360.

Springer, 2012.

C. E. Brown. Satallax: An automatic higher-order prover. In B. Gram-

lich, D. Miller, and U. Sattler, editors, Automated Reasoning —

6th International Joint Conference, IJCAR 2012, Manchester, UK,

June 26-29, 2012. Proceedings, volume 7364 of Lecture Notes in

Computer Science, pp. 111–117. Springer, 2012.

S. Cruanes and J. C. Blanchette. Extending nunchaku to dependent type

theory. In Proceedings First International Workshop on Hammers

for Type Theories, HaTT@IJCAR 2016, Coimbra, Portugal, July 1,

2016., volume 210 of EPTCS, pp. 3–12, 2016.

L. de Moura and N. Bjørner. Z3: An eﬃcient smt solver. In C. R.

Ramakrishnan and J. Rehof, editors, Tools and Algorithms for the

Construction and Analysis of Systems, pp. 337–340, Berlin, Heidel-

berg, 2008. Springer Berlin Heidelberg.

M. Deters, A. Reynolds, T. King, C. W. Barrett, and C. Tinelli. A tour

of CVC4: How it works, and how to use it. In K. Claessen and

V. Kuncak, editors, Formal Methods in Computer-Aided Design,

FMCAD 2014, Lausanne, Switzerland, October 21-24, 2014, page 7.

IEEE, 2014.

A. Farjami, P. Meder, X. Parent, and C. Benzm¨uller. I/O logic in HOL,

2018. MIREL 2018 workshop on MIning and REasoning with Legal

texts; available online, URL =

http://orbilu.uni.lu/handle/10993/37013.

B. Fitelson and E. N. Zalta. Steps toward a computational metaphysics.

Journal Philosophical Logic, 36(2):227–247, 2007.

35 Computer Science and Metaphysics: Cross-Fertilization

M. Fitting. Types, Tableaus, and G¨odel’s God. Kluwer, 2002.

P. Freyd and A. Scedrov. Categories, Allegories. North Holland, 1990.

D. Fuenmayor and C. Benzm¨uller. Automating emendations of the

ontological argument in intensional higher-order modal logic. In

KI 2017: Advances in Artiﬁcial Intelligence 40th Annual German

Conference on AI, Dortmund, Germany, September 25-29, 2017,

Proceedings, volume 10505 of LNAI, pp. 114–127. Springer, 2017.

D. Fuenmayor and C. Benzm¨uller. Types, Tableaus and G¨odel’s God

in Isabelle/HOL. Archive of Formal Proofs, 2017, https://www.

isa-afp.org/entries/Types_Tableaus_and_Goedels_God.html.

D. Fuenmayor and C. Benzm¨uller. A case study on computational

hermeneutics: E. J. Lowe’s modal ontological argument. Journal of

Applied Logic - IfCoLoG Journal of Logics and their Applications

(special issue on Formal Approaches to the Ontological Argument),

5(7):1567–1603, 2018.

D. Fuenmayor and C. Benzm¨uller. Formalisation and Evaluation of

Alan Gewirth’s Proof for the Principle of Generic Consistency in

Isabelle/HOL. Archive of Formal Proofs, Oct. 2018. http://

isa-afp.org/entries/GewirthPGCProof.html, Formal proof de-

velopment.

K. G¨odel. Appendix A. Notes in Kurt G¨odel’s Hand. In J. Sobel,

editor, Logic and Theism: Arguments for and Against Beliefs in

God, pp. 144–145. Cambridge University Press, 1970.

P. H´ajek. Magari and others on G¨odel’s ontological proof. In A. Ursini

and P. Agliano, editors, Logic and algebra, page 125–135. Dekker,

New York etc., 1996.

P. H´ajek. Der Mathematiker und die Frage der Existenz Gottes. In

B. Buldt et al., editor, Kurt G¨odel. Wahrheit und Beweisbarkeit,

pp. 325–336. ¨obv & hpt Verlagsgesellschaft mbH, Wien, 2001. ISBN

3-209-03835-X.

P. H´ajek. A new small emendation of G¨odel’s ontological proof. Studia

Logica, 71(2):149–164, 2002.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 36

B. Huﬀman and O. Kuncar. Lifting and transfer: A modular design

for quotients in Isabelle/HOL. In G. Gonthier and M. Norrish,

editors, Certiﬁed Programs and Proofs — Third International Con-

ference, CPP 2013, Melbourne, VIC, Australia, December 11-13,

2013, Proceedings, volume 8307 of Lecture Notes in Computer Sci-

ence, pp. 131–146. Springer, 2013.

D. Kirchner. Representation and Partial Automation of the Principia

Logico-Metaphysica in Isabelle/HOL. Archive of Formal Proofs,

Sept. 2017. http://isa-afp.org/entries/PLM.html.

L. Kov´acs and A. Voronkov. First-Order Theorem Proving and Vampire.

In N. Sharygina and H. Veith, editors, Computer Aided Veriﬁcation

– 25th International Conference, CAV 2013, Saint Petersburg, Rus-

sia, July 13-19, 2013. Proceedings, volume 8044 of Lecture Notes in

Computer Science, pp. 1–35. Springer, 2013.

E. J. Lowe. A modal version of the ontological argument. In J. P. More-

land, K. A. Sweis, and C. V. Meister, editors, Debating Christian

Theism, chapter 4, pp. 61–71. Oxford University Press, 2013.

S. MacLane. Groups, categories and duality. Proceedings of the National

Academy of Sciences, 34(6):263–267, 1948.

T. Nipkow, L. C. Paulson, and M. Wenzel. Isabelle/HOL — A Proof

Assistant for Higher-Order Logic, volume 2283 of LNCS. Springer,

2002.

P. E. Oppenheimer and E. N. Zalta. On the logic of the ontological

argument. Philosophical Perspectives, 5:509–529, 1991.

P. Oppenheimer and E. Zalta. A computationally-discovered simpliﬁca-

tion of the ontological argument. Australasian Journal of Philoso-

phy, 89(2):333–349, 2011.

P. E. Oppenheimer and E. N. Zalta. Relations Versus Functions at the

Foundations of Logic: Type-Theoretic Considerations. Journal of

Logic and Computation, 21(2):351–374, 2011.

F. J. Pelletier and E. Zalta. How to Say Goodbye to the Third Man.

Noˆus, 34(2):165–202, 2000.

37 Computer Science and Metaphysics: Cross-Fertilization

S. Schulz. System description: E 1.8. In K. L. McMillan, A. Middeldorp,

and A. Voronkov, editors, Logic for Programming, Artiﬁcial Intel-

ligence, and Reasoning – 19th International Conference, LPAR-19,

Stellenbosch, South Africa, December 14-19, 2013. Proceedings,

volume 8312 of Lecture Notes in Computer Science, pp. 735–743.

Springer, 2013.

D. S. Scott. Appendix B: Notes in Dana Scott’s Hand. In J. Sobel,

editor, Logic and Theism: Arguments for and Against Beliefs in

God, pp. 145–146. Cambridge U. Press, 1972.

D. S. Scott. Identity and existence in intuitionistic logic. In M. Fourman,

C. Mulvey, and D. Scott, editors, Applications of Sheaves: Proceed-

ings of the Research Symposium on Applications of Sheaf Theory to

Logic, Algebra, and Analysis, Durham, July 9–21, 1977, volume 752

of Lecture Notes in Mathematics, pp. 660–696. Springer, 1979.

J. Sobel. G¨odel’s ontological proof. In J. J. Tomson, editor, On Being

and Saying. Essays for Richard Cartwright, pp. 241–261. MIT

Press, 1987.

J. Sobel. Logic and Theism: Arguments for and Against Beliefs in God.

Cambridge University Press, 2004.

A. Steen and C. Benzm¨uller. The higher-order prover Leo-III. In

D. Galmiche, S. Schulz, and R. Sebastiani, editors, Automated Rea-

soning. IJCAR 2018, volume 10900 of Lecture Notes in Computer

Science, pp. 108–116. Springer, Cham, 2018.

E. Zalta. Abstract Objects: An Introduction to Axiomatic Metaphysics.

D. Reidel, 1983.

E. Zalta. Logical and analytic truths that are not necessary. The

Journal of Philosophy, 85(2):57–74, 1988.

E. Zalta. Twenty-Five Basic Theorems in Situation and World Theory.

Journal of Philosophical Logic, 22(4):385–428, 1993.

E. Zalta. Natural Numbers and Natural Cardinals as Abstract Objects:

A Partial Reconstruction of Frege’s Grundgesetze in Object Theory.

Journal of Philosophical Logic, 28(6):619–660, 1999.

D. Kirchner, C. Benzm¨

uller, and E. Zalta 38

Appendix: G¨odel’s Manuscript

Figure 2: Page 1 of G¨odel’s Manuscript. The axioms causing the incon-

sistency in G¨odel’s modal logic variant of the ontological argument for the

existence of God are highlighted (by us) in blue. (Unpublished works of

Kurt G¨odel are Copyright Institute for Advanced Study and are used with

39 Computer Science and Metaphysics: Cross-Fertilization

Figure 3: Page 2 of G¨odel’s Manuscript. The axioms causing the incon-

sistency in G¨odel’s modal logic variant of the ontological argument for the

existence of God are highlighted (by us) in blue. (Unpublished works of

Kurt G¨odel are Copyright Institute for Advanced Study and are used with

Designing Normative Theories for Ethical and Legal Reasoning: LogiKEy Framework, Methodology, and Tool Support

Preprint

Full-text available

May 2020

A framework and methodology---termed LogiKEy---for the design and engineering of ethical reasoners, normative theories and deontic logics is presented. The overall motivation is the development of suitable means for the control and governance of intelligent autonomous systems. LogiKEy's unifying formal framework is based on semantical embeddings of deontic logics, logic combinations and ethico-legal domain theories in expressive classic higher-order logic. This meta-logical approach enables the provision of powerful tool support in LogiKEy with small effort: off-the-shelf theorem provers and model finders for higher-order logic are assisting the LogiKEy designer of ethical intelligent agents to flexibly experiment with underlying logics and their combinations, with ethico-legal domain theories, and with concrete examples---all at the same time. Continuous improvements of these off-the-shelf provers, without further ado, leverage the reasoning performance in LogiKEy. Case studies, in which the LogiKEy framework and methodology has been applied and tested, give early evidence that HOL's undecidability often does not hinder efficient experimentation.

Designing Normative Theories of Ethical Reasoning: Formal Framework, Methodology, and Tool Support

Preprint

Full-text available

Mar 2019

Extensional Higher-Order Paramodulation in Leo-III *

Preprint

Jul 2019

A Case Study on Computational Hermeneutics: E. J. Lowe’s Modal Ontological Argument

Article

Full-text available

Oct 2018
J Appl Logic

Computers may help us to better understand (not just verify) arguments. In this article we defend this claim by showcasing the application of a new, computer-assisted interpretive method to an exemplary natural-language argument with strong ties to metaphysics and religion: E. J. Lowe’s modern variant of St. Anselm’s ontological argument for the existence of God. Our new method, which we call computational hermeneutics, has been particularly conceived for use in interactive-automated proof assistants. It aims at shedding light on the meanings of words and sentences by framing their inferential role in a given argument. By employing automated theorem reasoning technology within interactive proof assistants, we are able to drastically reduce (by several orders of magnitude) the time needed to test the logical validity of an argument’s formalization. As a result, a new approach to logical analysis, inspired by Donald Davidson’s account of radical interpretation, has been enabled. In computational hermeneutics, the utilization of automated reasoning tools effectively boosts our capacity to expose the assumptions we indirectly commit ourselves to every time we engage in rational argumentation and it fosters the explicitation and revision of our concepts and commitments.

Automating Free Logic in HOL, with an Experimental Application in Category Theory

Article

Full-text available

Jan 2020
J AUTOM REASONING

A shallow semantical embedding of free logic in classical higher-order logic is presented, which enables the off-the-shelf application of higher-order interactive and automated theorem provers for the formalisation and verification of free logic theories. Subsequently, this approach is applied to a selected domain of mathematics: starting from a generalization of the standard axioms for a monoid we present a stepwise development of various, mutually equivalent foundational axiom systems for category theory. As a side-effect of this work some (minor) issues in a prominent category theory textbook have been revealed. The purpose of this article is not to claim any novel results in category theory, but to demonstrate an elegant way to “implement” and utilize interactive and automated reasoning in free logic, and to present illustrative experiments.

Universal (Meta-)Logical Reasoning: The Wise Men Puzzle

Data

Full-text available

Nov 2018

Christoph Benzmüller

The authors universal (meta-)logical reasoning approach is demonstrated and discussed with a challenge puzzle in epistemic reasoning: the wise men puzzle. The presented solution puts a particular emphasis on the adequate modeling of common knowledge. (For further explanations see the related article at http://dx.doi.org/10.1016/j.scico.2018.10.008)

A Dyadic Deontic Logic in HOL

Conference Paper

Full-text available

Jul 2018

A shallow semantical embedding of a dyadic deontic logic by Carmo and Jones in classical higher-order logic is presented. This embedding is proven sound and complete, that is, faithful. The work presented here provides the theoretical foundation for the implementation and automation of dyadic deontic logic within o-the-shelf higher-order theorem provers and proof assistants.

Universal (Meta-)Logical Reasoning: Recent Successes

Article

Full-text available

Mar 2019
SCI COMPUT PROGRAM

Christoph Benzmüller

Classical higher-order logic, when utilized as a meta-logic in which various other (classical and non-classical) logics can be shallowly embedded, is suitable as a foundation for the development of a universal logical reasoning engine. Such an engine may be employed, as already envisioned by Leibniz, to support the rigorous formalisation and deep logical analysis of rational arguments on the computer. A respective universal logical reasoning framework is described in this article and a range of successful first applications in philosophy, artificial intelligence and mathematics are surveyed.

Universal (Meta-)Logical Reasoning: Recent Successes

Preprint

Full-text available

Oct 2018

Christoph Benzmüller

A Deontic Logic Reasoning Infrastructure

Chapter

Full-text available

Jul 2018
Lect Notes Comput Sci

A flexible infrastructure for the automation of deontic and normative reasoning is presented. Our motivation is the development, study and provision of legal and moral reasoning competencies in future intelligent machines. Since there is no consensus on the “best” deontic logic formalisms and since the answer may be application specific, a flexible infrastructure is proposed in which candidate logic formalisms can be varied, assessed and compared in experimental ethics application studies. Our work thus links the historically rich research areas of classical higher-order logic, deontic logics, normative reasoning and formal ethics.

The Higher-Order Prover Leo-III

Article

Full-text available

Feb 2018

The automated theorem prover Leo-III for classical higher-order logic with Henkin semantics and choice is presented. Leo-III is based on extensional higher-order paramodulation and accepts every common TPTP dialect (FOF, TFF, THF), including their recent extensions to rank-1 polymorphism (TF1, TH1). In addition, the prover natively supports almost every normal higher-order modal logic. Leo-III cooperates with first-order reasoning tools using translations to (polymorphic) many-sorted first-order logic and produces verifiable proof certificates. The prover is evaluated on heterogeneous benchmark sets.

A new modal version of the ontological argument

Chapter