Modal Deduction in Second-OrderLogic and Set TheoryJohan van Benthem+, Giovanna D'Agostino#,Angelo Montanari#+, Alberto Policriti#+ ILLC, Universiteit van AmsterdamPlantage Muidergracht, 24, 1018 TV Amsterdam, The Netherlandsfax: +31 20 5255101, e-mail: fjohan j angelog@fwi:uva:nl# Dipartimento di Matematica e Informatica, Universit�a di UdineVia Zanon, 6 - 33100 Udine, Italyfax: +39 432 510755, e-mail: fdagostin j montana j policritg@dimi:uniud:it �AbstractWe investigate modal deduction through translation into standard logic and set theory. Derivabilityin the minimal modal logic is captured precisely by translation into a weak, computationally attractiveset theory . This approach is shown equivalent to working with standard �rst-order translations ofmodal formulas in a theory of general frames. Next, deduction in a more powerful second-order logic ofgeneral frames is shown equivalent with set-theoretic derivability in an `admissible variant' of . Ourmethods are mainly model-theoretic and set-theoretic, and they admit extension to richer languages thanthat of basic modal logic.1 IntroductionWe are interested in analyzing general deduction for modal formulae [4]. The standard systems used for thispurpose are the so-called \minimal modal logic" K or, if one wants to work over general frames (as we do),the system Ks obtained from K adding a substitution rule. We do not consider special purpose calculi forstronger modal logics over Ks, such as S4 or S5, although we expect that our results and method can bespecialized to frame classes obeying their additional speci�c constraints. Such logics are treated as particularsets of assumptions in our general deduction mechanisms.Our aim is to analyze general modal deduction via translations into standard logics. What already existsfor this purpose in the logical tradition are \standard translations" into �rst-order and monadic second-orderlogic (for their extensive theory, cf. [4]). In recent years, the computer-science community has also becomeinterested in this approach, (see, for example, [14]), with results that are mainly restricted to cases wherespeci�c modal logics have \nice" translations (�rst-order, or well-behaved second-order). A new theme inthe latter approach has been variations in translation formats, e.g., special operator-based `path languages'have been used to pro�t optimally from resolution methods [12, 13].�This work has been supported by funds MURST 40% and 60%. The third author was supported by a grant from the ItalianConsiglio Nazionale delle Ricerche (CNR). 1

This paper takes its point of departure in [8], where a general set-theoretic translation, whose main ideais to treat the universal modality as a Power-set operator, was proposed for modal logic. The engine drivingsoundness and completeness of this translation was a weak set theory , having pleasant computationalproperties [7]. The method was shown adequate only for frame complete modal logics, using an argumentheavily relying on non-well-founded set theory [1].Against this background, the present paper makes the following new contributions. Standard modaldeduction via the standard translation is supported by a simple two-sorted �rst-order theory � of generalframes. Comparing � with , we establish an e�ective equivalence between the latter and a suitable extensionof �, that we call �+. Such an extension is obtained adding to � an axiom re ecting the \uniformity" of ourset-theoretic approach which uses just 2 for both set-membership and the accessibility relation. We thenprove that �+ is non-conservative over �. On the ground of the equivalence between and �+, this allows usto conclude that the translation method given in [8] is not adequate for logics which are not frame complete.By varying our translation, however, we manage to obtain a full equivalence between general modal deductionin Ks and -deduction. This is the desired general result, which is based on standard set-theoretic methods(including a suitable adaptation of Fraenkel-Mostowski permutations of the universe [10]).Next, we turn to extensions on a broader perspective. One can consider various principled strengtheningsof minimal modal deduction; from a second-order point of view, a good candidate is L2 [3]. L2 is based on asecond-order language containing, besides equality and a binary constant R, unary predicate variables. Thelogic is provided with a suitable form of substitution that allows to replace universal quanti�ed second-ordervariables with �rst-order formulae in the language of R and equality. L2 turns out to be rather expressive;in particular, it allows one to derive the �rst-order correspondents of Sahlqvist formulae. We show how tomatch L2-derivability of modal formulae with derivability in a suitably modi�ed version c of , which adds(some of) the well-known operations of admissible set theory.In conclusion we brie y consider what happens when we vary the source language for these translationsand deductive engines, from the basic modal language to stronger (temporal or �rst-order) formalisms.The paper is organized as follows. Section 2 contains basic results about the standard translation methodand the set-theoretic one. Section 3 compares the two methods providing the basic equivalence result. InSection 4 the full equivalence between general modal deduction in Ks and is proved. In Section 5 suchan equivalence is generalized to the case of L2. Finally, Section 6 presents some variations of the proposedframework suitable to deal with languages other than the basic modal one.2 Translation methods for modal logicLet us brie y recall some notation and basic results about modal logic (see [4]) for details). Propositionalmodal formulae are constructed using propositional letters P1; P2; : : :, boolean operators _;: and the 2operator. The minimal modal logic Ks consists of a set of propositional axioms complete for classicallogic, the modal axiom 2(P ! Q) ! (2(P ) ! 2(Q)), and the rules of substitution, modus ponens andnecessitation (infer 2(�) from �). Deducibility of from � in Ks is de�ned as usual and denoted by � `Ks .A frame is a pair F = (W;R), where W is a set (of worlds) and R is a binary relation on W (theaccessibility relation). A valuation j= in the frame (W;R) is a subset of W �fP1; : : :g. For all w 2W , w j= �is de�ned by induction on the structural complexity of the modal formula �, as usual. A formula � is validin a frame (W;R) if and only if, for all w 2 W and for all valuation j=, w j= � holds. A formula is aframe logical consequence of a formula � (� j=f ) if and only if, for all frames F , if � is valid in F , then is valid in F . A formula � is said to be complete if and only if, for all , � `Ks , � j=f . Examples ofincomplete formulae can be found in the literature (see for example [4]).A semantic characterization of Ks is obtained via general frames. A general frame is a pair (F;W),where F is a frame and W is a set of subsets of W , which is closed under the boolean operations of union,2

complementation w.r.t. W , and 2(X) = fw 2W : 8v (wRv ! v 2 X)g. Validity in general frames is de�nedas for frames except for the fact that we only consider valuations taking values on W . Logical consequencein general frames (� j=gf ) is de�ned accordingly. For all modal formulae �; we have� `Ks , � j=gf :2.1 The standard translation methodThe standard translation of modal formulae into L2-formulae is the following [4, 5]:� ST (Pi) = Pi(x);� ST (� _ ) = ST (�) _ ST (�);� ST (:�) = :ST (�);� ST (2�) = 8y (xRy ! ST (�)(yjx)),where yjx denotes uniform substitution of the variable x with the variable y.The closed standard translation ST (�) of a formula � is de�ned as the L2-sentence 8P1 : : :8Pn8xST (�),and it is is easy to see that � j=f if and only if ST (�) j= ST ( );where the j= on the right-hand side denotes second-order consequence.In [3], axiomatic theories for deduction in the L2-language are introduced. In particular, a system of weaksecond-order logic is de�ned by means of a suitable form of substitution. Let an L0-formula be an L2-formulawith a free variable x but without occurrences of second-order quanti�ers. Denote by �( jP) the L2-formulaobtained from the L2-formula � by replacing subformulas of the form P(u) by an L0-formula (ujx) (modulosome technicalities about free variables [3]). L0-substitution is expressed by the axiom8P�! �( jP ):Weak second-order logic contains a set of axioms complete for �rst-order predicate logic, plus L0-substitution.It is possible to obtain a semantic counterpart of deducibility in weak second-order logic by meansof closure under L0-de�nitions in general frames. A general frames (F;W) is closed under L0-de�nitionsif, for all L0-formula with free world-variables x; x1; : : : ; xn, free set-variables X1; : : : ; Xm, and for allw;w1; : : : ; wn 2 W , A1; : : : ; Am 2 W , the set fw 2 W : F j= (w;w1; : : : ; wn; A1; : : : ; Am)g belongs to W . Itfollows that � `L2 � if and only if, for all general frames (F;W) closed under L0-de�nitions, if (F;W) j= �[f ],then (F;W) j= �[f ] (where f is an assignment of worlds in W to individual variables and set of worlds inW to unary predicate variables). Weak second-order logic is a nonconservative extension of Ks, namely,� `Ks ) ST (�) `L2 ST ( ), but there exist � and such that ST (�) `L2 ST ( ) but � 6`Ks [3].2.2 The set-theoretic translation methodThe basic idea behind the set-theoretic translation is to represent any Kripke frame as a set, with theaccessibility relation modeled using the membership relation 2. The theory in which the translation iscarried out is a very weak1 �nitely (�rst-order) axiomatizable set theory called [7, 8]. The axioms, in thelanguage with relational symbols 2 and �; and functional symbols [; n; and Pow; are the following:x 2 y [ z $ x 2 y _ x 2 z;1Compare this theory with more classical �nite axiomatizations of set theory, such as NBG [11].3

x 2 y n z $ x 2 y ^ x 62 z;x � y $ 8z(z 2 x! z 2 y);x 2 Pow(y)$ x � y.Notice that neither the extensionality axiom nor the axiom of foundation are in .Given a modal formula �(P1; :::; Pn), we de�ne its translation as the set-theoretic term ��(x; x1; :::; xn),with variables x; x1; :::; xn, built using [; n, and Pow. Intuitively the term ��(x; x1; :::; xn) represents the setof those worlds (in the frame x) in which the formula � holds. The inductive de�nition of ��(x; x1; :::; xn) isthe following:� P �i = xi;� (� _ )� = �� [ �;� (:�)� = x n ��;� ( �)� = Pow(��).For all modal formulae �; , the following results showing the adequacy of the translation hold:completeness:� `Ks ) ` 8x(Trans(x)^8x1 : : : xn(x � ��(x; x1; : : : ; xn))! 8x1 : : : xn(x � �(x; x1; : : : ; xn)));soundness: ` 8x(Trans(x) ^ 8x1 : : : xn(x � ��(x; x1; : : : ; xn))! 8x1 : : : xn(x � �(x; x1; :::xn))) ) � j=f ;where Trans(x) stands for 8y (y 2 x! y � x).It is worth noting that, for frame-complete theories, the above translation captures exactly the notion ofKs-derivability.3 A comparison of the two methodsIn this section, we compare the two translation methods. To this end, consider a two-sorted �rst-orderlanguage, with worlds (denoted by small letters) and sets (denoted by capital letters), with binary predicatesR (on worlds) and 2 (between worlds and sets), as well as operations �;[ and 2 on the set sort. Thislanguage is adequate for the description of the general frame semantics. The minimal logic describing it isobtained by considering the following theory �:- First-Order Principles for both sorts;- 8w(w 2 �P$ :w 2 P);- 8w(w 2 P [ Q$ w 2 P _ w 2 Q);- 8w(w 2 2P$ 8v(wRv ! v 2 P))- 8P8Q(8w(w 2 P$ w 2 Q)! P = Q) (extensionality).4

Since models both set membership and the accessibility relation in terms of 2-relationship, let �+ bethe theory obtained by adding to � the axiom- 8w9P8v (v 2 P$ wRv)that links R and 2.In the following, we will show that the standard translation method w.r.t. �+ and the set-theoretic onew.r.t. are equivalent. More precisely, we will prove that, for all modal formulae �; ,�+ ` ST (�)! ST ( )if and only if ` 8x (Trans(x) ^ 8y (x � ��(x; y))! 8y(x � �(x; y))):We �rst prove that derivability in �+ implies derivability in . Given an -model based on a set U anda transitive set x in that model, we show how to construct a model for �+.DEFINITION 3.1 Let (U;2U ; : : :) be a model for , and let x be a transitive element of U . The corre-sponding model of �+ is a a general frame (W;R;W) such that:� the world sort W is given by all elements (w.r.t. the model U) of x ;� the set sort W is given by equivalence classes in U with respect to the equivalence relation of \havingthe same elements of the world sort"2. More precisely, we state that [y] = [z] if and only if, w 2U y ,w 2U z, for every w 2U x. An element of the set sort is an equivalence class [y], for y 2 U ;� the operations over W are de�ned as follows: [y][ [z] = [y[U z], �[y] = [xnU y], and 2[y] = [PowU (y)].� for worlds y; z we de�ne yRz i� z 2U y, while if y is a world and [z] is a set, we de�ne y 2 [z] i�y 2U z.It is easy to show that the resulting model veri�es all principles of �+.THEOREM 3.2 For each pair of formulae �; ,�+ ` ST (�)! ST ( )) ` 8x (Trans(x) ^ 8y (x � ��(x; y))! 8y(x � �(x; y))):Proof. First of all, we prove that, for any modal formula �(P1; ::; Pn), each y 2 x, and y1; :::; yn 2 U ,y 2 ��(x; y1; :::; yn) holds in the -model i� ST (�)(y; [y1]; :::; [yn]) holds in the two-sorted one:The proof is by induction on the structure of �.� if � = Pi, then U j= y 2 ��(x; yi) i� U j= y 2 yi i� y 2 [yi] holds in the two-sorted model i�ST (�)(y; [yi]) holds;� if � = : , then U j= y 2 ��(x; y1; :::; yn) i� U j= y 2 x n �(x; y1; :::; yn) i� U j= y 2 x ^ y 62 �(x; y1; :::; yn) i� ST ( )(y; [y1]; :::; [yn]) does not hold in the two-sorted model i� ST (�)(y; [y1]; :::; [yn])holds;� the case of [ is left to the reader;2We cannot restrict ourselves to x, because x may be not closed under the set operations. For instance, the transitive setf;; f;gg is not closed under the Pow operation. 5

� if � = 2 then U j= y 2 ��(x; y1; :::; yn) i� U j= y 2 Pow( �(x; y1; :::; yn)) i� U j= 8w (w 2y ! w 2 �(x; y1; :::; yn)) i� 8w (yRw ! ST ( )(w; [y1]; :::; [yn])) holds in the two-sorted model i�ST (�)(y; [y1]; :::; [yn]) holds.This implies that, for any modal formula �(P1; :::; Pn),U j= 8y1:::8yn (x � ��(x; y1; :::; yn)) i� ST (�) holds in the two-sorted model.If x is transitive and U j= 8y (x � ��(x; y)), then, from what preceeds, it follows that ST (�) holds in thetwo-sorted model. Thus, by hypothesis, we obtain ST ( ) and again U j= 8y(x � �(x; y)). aLet us prove that derivability in implies derivability in �+. Let (W;R;W) be a general frame satisfying�+. This means that W includes all subsets of W de�ned by the additional axiom characterizing �+, plusthe subsets that can be obtained from them by union, (relative) complementation, and the 2 operation.Moreover, without loss of generality, we suppose that the elements of W are sets of the same rank �. An-model can be obtained from (W;R;W) in the following way:DEFINITION 3.3 The -model (U;2U ; : : :) generated by (W;R;W) is de�ned as follows.Let U0 = W;...Un = Pow(Un�1) [ Un�1;and let U = S!n=0 Un.De�ne a function F : U ! U as:F (x) = 8<: fv 2W : xRvg if x 2Wx nW if x 62W ^ x \W 62 Wx if x 62W ^ x \W 2 Wwhere fv 2 W : xRvg 2 W for any x 2W .A structure for the language f2g is obtained by taking U as domain, and de�ningx 2U y if and only x 2 F (y):The de�nition of 2U is very similar to that of the so-called Fraenkel-Mostowski's permutation of theuniverse [10].The following properties are easily veri�ed:� if y 2 W , then x 2U y i� yRx;� if y 2 W , then x 2U y i� x 2 y.LEMMA 3.4 The interpretation (U;2U ; : : :) generated by a general frame (W;R;W) satisfying �+ is an-model.6

Proof. To show that (U;2U ) is a model of , it is enough to prove that(U;2U ) j= 8x8y9z8u (u 2 z $ u 2 x _ u 2 y);(U;2U ) j= 8x8y9z8u (u 2 z $ u 2 x ^ u 62 y);(U;2U ) j= 8x9z8y (y 2 z $ 8s (s 2 y ! s 2 x)):Notice that the range of F is the set fy 2 U nW : y \W 2 Wg:For any x; y 2 U , the set F (x) [ F (y) is in the range of F . Indeed (F (x) [ F (y)) \W = (F (x) \W ) [(F (y) \W ), and both (F (x) \W ) and (F (y) \W ) belong to W , which is closed under union. Therefore,take a z such that F (z) = F (x) [ F (y), and observe thatt 2U z $ t 2 F (z)$ t 2 F (x) _ t 2 F (y)$ t 2U x _ t 2U y:Similarly, we show that the set F (x) n F (y) is in the range of F . In fact, (F (x) n F (y)) \W = (F (x) \W ) n (F (y)\W ), and both (F (x) \W ) and (F (y)\W ) belong to W , which is closed under di�erence. Anyz such that F (z) = F (x) n F (y) will verify the axiom for n.Consider now the set fy 2 U : F (y) � F (x)g. This set is in the range of F because(fy 2 U : F (y) � F (x)g) \W = fy 2 W : F (y) � F (x)g =fy 2W : 8z(yRz ! z 2 F (x))g = 2(F (x) \W ):Since F (x) \ W is in W and W is closed under 2, the set 2(F (x) \ W ) is in W . Any z such thatF (z) = fy 2 U : F (y) � F (x)g will verify the axiom for 2, becauseF (y) � F (x), 8s(s 2U y ! s 2U x):aTHEOREM 3.5 For each pair of formulae �; , ` 8x (Trans(x) ^ 8y (x � ��(x; y))! 8y(x � �(x; y)))) �+ ` ST (�) ! ST ( ):Proof. For any modal formula �(P1; :::; Pn), we prove that, for each y 2 W and y1; :::; yn in U ,y 2 ��(W; y1; ::; yn) holds in (U;2U ) i� ST (�)(y; F (y1) \W; ::; F (yn) \W ) holds in (W;R;W)(recall that F (yi) \W 2 W).The proof is by induction on the structure of �:� if � = Pi, then y 2 ��(W; yi) in the model (U;2U ) i� y 2U yi i� y 2 F (yi) i� y 2 F (yi) \ W i�ST (�)(y; F (yi) \W );� if � = : , then y 2 ��(W; y1; ::; yn) i� y 2 W n �(W; y1; ::; yn) i� y 2 W ^ y 62 �(W; y1; ::; yn) i�not ST ( )(y; F (y1) \W; ::; F (yn) \W ) i� �ST ( )(y; F (y1) \W; ::; F (yn) \W ) i� ST (�)(y; F (y1) \W; ::; F (yn) \W );� the case of [ is left to the reader; 7

� if � = 2 , then y 2 ��(W; y1; ::; yn) in (U;2U ) i� y 2 Pow( �(W; y1; ::; yn)) in (U;2U ) i� 8v(v 2 y !v 2 �(W; y1; ::; yn)) in (U;2U ) i� for all v 2 W , if yRv then v 2 �(W; y1; ::; yn)) in (U;2U ) i� for allv 2W , if yRv then ST ( )(v; F (y1) \W; ::; F (yn) \W ) i� ST (�)(y; F (y1) \W; ::; F (yn) \W ).This implies that, for any modal formula �(P1; :::; Pn),8y1:::8yn (W � ��(W; y1; :::; yn)) holds in the -modelif and only ifST (�) holds in the original one.Let us prove that W is transitive, that is,8x(x 2 W ! 8y(y 2 x! y 2 W )):From x 2 W (in the -model), it follows that x is an element of the world sort (in the model of �+), andfrom y 2 x (in the -model), it follows that xRy in the model of �+; therefore, y 2W (in the -model).Thus, if ST (�) holds (in the original model), then 8y (W � ��(W; y)) holds (in the -model) and W istransitive. By hypothesis, we obtain 8y(W � �(W; y)) and then ST ( ). aIt is worth noting that it is possible to remove the extensionality axiom from �+ without a�ecting thevalidity of the established result. To this end, it su�ces to slightly modify De�nition (3.1).4 Capturing derivability in KsIn Section 3, we have proved that and �+ are equiparable, provided that the translation for is the onede�ned in Section 2.2. If �+ was conservative over �, then would exactly correspond to Ks. It is indeedeasy to see that: � ` ST (�)! ST ( ), � j=gf ;and then � `Ks , � ` ST (�)! ST ( ):In Section 4.1, we will show that �+ is a nonconservative extension of �. This gives rise to a natural question:can we change the translation to make and � equiparable? In such a case, we would be able to capturederivability in Ks not only for complete formulae, as in [8], but in general. The answer is positive. Thegeneralization of the proposed set-theoretic translation method to any (possibly incomplete) modal formulais given in Section 4.2.4.1 Is �+ conservative over �?PROPOSITION 4.1 The theory �+ = � + 8x9P8y (y 2 P $ xRy) is non-conservative (w.r.t. modalformulae) over �.Proof. The proof is a variant of the proof given in [3], where it is proved that the theory �s equal to � plusthe axiom 8x9P8y (y 2 P$ x = y) is nonconservative over �. The modal incomplete logic and the formulashowing its incompleteness are indeed the same as in [3].We prove that, if = 2 � > ! 2(2(2P ! P )! P ) and � = 2 � > ! 2 ?, then� 6` ST ( )! ST (�) (or, equivalently, 6j=gf �);8

but �+ ` ST ( )! ST (�):The proof that 6j=g � is given in [3]. Let us prove now that �+ ` ST ( ) ! ST (�). The proof ismodel-theoretic: we suppose that a general frame (W;R;W) satisfying �+ is given in which � is not valid,and then prove that such a general frame invalidates too.If � is not valid, then there exists a world x in the general frame such that 2�> is true at x and 9y xRy.There are two possible cases:� all y such that xRy are re exive;� there exists y such that xRy and y is not re exive.Let us consider the �rst case. We know that there exists X = fy : xRyg, together with its relativecomplement �X . Let us take a valuation j= such that fw 2 W : w j= :P )g = X . Consider a world y suchthat xRy. For all z such that yRz, either z 2 �X , or xRz and z is re exive; in both cases z j= 2P ! P .Thus, y j= 2(2P ! P ), but y 6j= P .Consider now the second case. Let j= be such that fw 2 W : w j= Pg = fz : yRzg. Since y is notre exive, again y 6j= P ; moreover, for all z such that yRz, z j= P , and then y j= 2(2P ! P ).In both cases, there exists at least one y such that xRy and y 6j= 2(2P ! P )! P . Thus,x 6j= 2 � T ! 2(2(2P ! P )! P ):aWe can actually prove something stronger, namely, that �+ plus ST ( ) is complete with respect to theclass of frames for .PROPOSITION 4.2 For any formula �, j=f � implies �+ ` ST ( )! ST (�)Proof. Consider the formula � of Proposition (4.1). We already proved that�+ ` ST ( )! ST (�);and it is straightforward to show that � j=f . Therefore, in order to prove that j=f � implies �+ `ST ( ) ! ST (�), it su�ces to show that � ` ST (�) ! ST (�). Since �+ is an extension of �, the thesisindeed follows from �+ ` ST ( )! ST (�).Let (W;R;W) be a general frame satisfying �. Since � does not involve any propositional variable, theunderline frame (W;R) validates � too. Hence, it validates and, from j=f �, it follows that it validates�. This implies that the general frame (W;R;W) validates � too. a4.2 A modi�ed translation for KsIn this section, we show how to change the translation to capture derivability in Ks. Let Trans(x) be theformula 8y (y 2 x! y � x), and de�ne Cl(y; x) as the conjunction of the following formulas:� 8z (z 2 y ! Pow(z) \ x 2 y);� 8z (z 2 y ! x n z 2 y); 9

� 8z8u (z 2 y ^ u 2 y ! z [ u 2 y).We also modify the translation of the : (2�)� = Pow(��) \ x:We prove that, for all modal formulae �; , the following holds:� `Ks if and only if ` 8x8y (Trans(x) ^ Cl(y; x) ^ 8z 2 y (x � ��(x; z))! 8z 2 y (x � �(x; z)));where if �(P1; : : : Pn) is a modal formula, 8z 2 y (x � ��(x; z)) stands for 8z1 : : :8zn (z1 2 y ^ : : : ^ zn 2y ! x � ��(x; z1; : : : ; zn)).The proof of completeness is similar to the proof of completeness for frame-complete logics given in [8].THEOREM 4.3 (Completeness of the translation method) For each pair of formulae �; ,� `Ks ) ` 8x8y (Trans(x) ^ Cl(y; x) ^ 8z 2 y (x � ��(x; z))! 8z 2 y (x � �(x; z))):Proof. The proof is by induction on the derivation � `Ks . We skip the veri�cation of closure under modusponens, tautologies, necessitation rule, and Ks-axiom. We only prove the case of closure under substitutionrule.Let (P1; :::; Pn) such that ` 8x8y (Trans(x) ^ Cl(y; x) ^ 8z 2 y (x � ��(x; z))! 8z 2 y (x � �(x; z))):and let �1(P1; ::; Pm); :::; �n(P1; ::; Pm) be modal formulae. We want to prove that ` 8x8y (Trans(x) ^ Cl(y; x) ^ 8z 2 y (x � ��(x; z))! 8z 2 y (x � (�1; : : : ; �n)�(x; z))):This is easily shown because:(i) For any modal formula �(P1; :::; Pm) it holds that ` Cl(y; x)! 8x1; :::;8xm (x1 2 y ^ ::: ^ xm 2 y ! ��(x1; :::; xm) 2 y);(ii) (�1; :::; �n)� is the same (syntactically) as �(��1 jx1; :::; ��n jxn) (both are easily proved by induction).By simultaneous substitution, it holds that ` 8x1; :::;8xn (x1 2 y ^ ::: ^ xn 2 y ! x � �(x; x1; ::; xn))!8x1; :::;8xm (��1 2 y ^ ::: ^ ��n 2 y ! x � �(x; ��1 ; ::; ��n));By applying (i) to terms ��1 ; ::; ��n , it follows that ` Cl(y; x) ^ 8x1; :::;8xn (x1 2 y ^ ::: ^ xn 2 y ! x � �(x; x1; :::xn))!8x1; :::;8xm (x1 2 y ^ ::: ^ xm 2 y ! x � �(x; ��1 ; ::; ��n));and from (ii) the desired result follows. a 10

Let us prove now the soundness of the translation method. First of all, we show how an model canbe obtained from (W;R;W). Without loss of generality, we suppose that the elements of W are sets of thesame rank �.DEFINITION 4.4 The -model (U;2U ; : : :) generated by (W;R;W) is de�ned as follows.Let U0 = W;...Un = Pow(Un�1) [ Un�1;and let U = S!n=0 Un.De�ne a function F : U ! U asF (x) = � fv 2W : xRvg if x 2Wx otherwiseA structure for the language f2g is obtained by taking U as domain, and de�ningx 2U y if and only x 2 F (y):First notice that, if y 2 W , then we have:x 2U y i� x 2W ^ yRx:Moreover, it is immediate to see that the range of F is the set U nW . This set is closed under union anddi�erence, and F is the identity on U nW . Therefore, we can de�nex [U y = F (x) [ F (y) x nU y = F (x) n F (y)and the axioms for [ and n will be satis�ed. Finally, the set fy 2 U : F (y) � F (x)g is in U nW too, and wecan safely de�ne PowU (x) = fy 2 U : F (y) � F (x)g:THEOREM 4.5 (Soundness of the translation method) For each pair of formulae �; , ` 8x8y (Trans(x) ^ Cl(y; x) ^ 8z 2 y (x � ��(x; z))! 8z 2 y (x � �(x; z)))) � `Ks Proof. We prove that � `Ks by showing that, for any general frame (W;R;W), if � is valid in (W;R;W),then is valid too.As before, (U;2U ) j= Trans(W ). Moreover, it is straightforward to show that Closure(W ;W ) holdsin (U;2U ): closure under union and complementation w.r.t. W follows from the corresponding closureproperties of W , while, for all x 2 W ,PowU (x) \W = fy 2 W : F (y) � F (x)g = fy 2W : fv 2 W : yRvg � xg = 2(x) 2 W :It is now easy to show that, for all y1; :::; yn in W and for any modal formula �(P1; : : : ; Pn),W � ��(W; y1; :::; yn)) holds in (U;2U ; : : :)if and only if(W;R) j= �(P1; ::; Pn); where fw 2W : w j= Pig = yi; for all i = 1; :::; n:By using this correspondence, one easily shows that, if � is valid in (W;R;W), then is valid too. a11

5 On the strengthening of KsIn this section we consider a �nite set of operations and a translation suitable to capture L2-derivability in aset-theoretic context. We will work with a set theory whose axioms are closely related to the so-called G�odeloperations for de�ning the constructible universe. Among all possible approaches, we choose (essentially) theone proposed by Barwise in [2]. We introduce some natural functions de�ning suitable cartesian products(�;�=;�2) and their projections (Dom;Rng), plus some operations allowing us to manipulate argumentpositions in ordered sequences (C1; C2). As far as the translation is concerned, we will need a slight modi�-cation of the previously introduced ones in order to properly distribute the closure requirements providingthe set-theoretic counterpart of L0-de�nability (see Theorem (5.4) below).Let us consider the theory c de�ned as follows. The language of c has =;2, and � as predicate symbols,fg,Dom, and Rng as unary functional symbols, and [; n;�;�2;�=; C1, and C2 as binary functional symbols.The axioms for c are the identity axioms and the axioms, already in , describing �;[; and n in terms of2, plus the axioms de�ning �;�2;�=; Dom;Rng; C1, and C2. There are two main di�erences between ourset operators and more classical ones for the constructible universe. First, we use the binary union insteadof the unary union. Moreover, even though there is no axiom de�ning the singleton operator (see the listof axioms below), a unary functional symbol fg, behaving as the usual singleton operator on part of thedomain, is in the language of c.Besides the axioms for equality, the axioms for c are the following:t 2 x [ y $ t 2 x _ t 2 y;t 2 x n y $ t 2 x ^ t 62 y;x � y $ 8t (t 2 x! t 2 y);t 2 x� y $ 9a 2 x9b 2 y (t = ha; bi ^ Pair(a; b));t 2 x�2 y $ 9a 2 x9b 2 y (t = ha; bi ^ Pair(a; b) ^ a 2 b);t 2 x�= y $ 9a 2 x9b 2 y (t = ha; bi ^ Pair(a; b) ^ a = b));t 2 Dom(x)$ 9s (ht; si 2 x ^ Pair(t; s));t 2 Rng(x)$ 9s (hs; ti 2 x ^ Pair(s; t));t 2 C1(x; y)$ 9a9b9c (ha; bi 2 x ^ Pair(a; b) ^ c 2 y ^ Pair(b; c) ^ t = ha; hb; cii ^ Pair(a; hb; ci));t 2 C2(x; y)$ 9a9b9c (ha; ci 2 x ^ Pair(a; c) ^ b 2 y ^ Pair(b; c) ^ t = ha; hb; cii ^ Pair(a; hb; ci)).The meaning of Pair(x; y) is that the elements x; y can be used to build an ordered pair in the Kuratowski'sstyle. More formally,� hx; yi = ffxgg [ ffxg [ fygg, and� Pair(x; y) = Sing(x) ^ Sing(y) ^ Sing(fxg) ^ Sing(fxg [ fyg),where Sing(x) is a shorthand for 8t (t 2 fxg $ t = x).If Pair(a; b) holds, then ha; bi behaves as the usual encoding of ordered pairs. In particular, notice thatPair(a; b) ^ Pair(c; d)) (ha; bi = hc; di $ a = c ^ b = d).Let us now de�ne a translation of modal formulae into c-terms that captures derivability in L2 (inSection 6, we will show how this result can be generalized to the full L2-language). We will prove thatL2 ` ST (�)! ST ( )if and only ifc ` 8x(Cl(x) ^ 8z (x � ��(x; z))! 8z (x � �(x; z)));12

where Cl(x) stands for 9y(y 2 x) (x is not empty), and8y8z (y 2 x ^ z 2 x! Pair(y; z)) ^ 8y8u8v (Pair(u; v) ^ y 2 x! Pair(y; hu; vi) ^ Pair(hu; vi; y)):The translation function (�)� is the same as before except for the operator, and this is obviously thecase, since we do not have Pow among the symbols in the language of c. Moreover, notice that Trans(x)disappeared from the antecedent of the translated sentence. It can be easily checked that, in the case of, it would have made no di�erence to work with ( �)� de�ned either as Pow(��) or as Pow(��) \ x.Actually, we chose the �rst alternative only to maintain the translated terms simpler. It is also easy to seethat Pow(��) \ x = fy 2 x : y \ x � ��g, whenever x is transitive. As a matter of fact, we will see that theset fy 2 x : y \ x � ��g can always be used to translate 2� (even in the case in which x is not transitive).Moreover, the reader can easily check thatfy 2 x : y \ x � ��g = x nRng((x n ��)�2 x);and hence we put: ( �)� = x nRng((x n ��)�2 x):It is worth noting that the introduction of an axiom for the singleton in the theory and the additionof Cl(x) as a new conjunct in the antecedent of the translation (as we did) are not equivalent. In the �rstcase, there is the singleton of any set (in any model of the theory); in the second case, the existence of thesingletons is only guaranteed for the elements of any set x for which Cl(x) holds. As a consequence, wecannot exclude that the set of subsets of a given x (such that Cl(x) holds) in a model of c could be (strictly)smaller than the set of subsets of the corresponding x in a model of c plus the singleton axiom. Assumingthe singleton axiom makes indeed models richer, and this may turn out to force the presence of subsets ofW which are not L0-de�nable. In Lemma (5.13) we prove that the subsets of a suitable x (such that Cl(x)holds) in a suitable model of c are exactly the L0-de�nable sets.We start proving the completeness of the translation. First of all, we construct a general frame corre-sponding to a suitable element of a model of c.DEFINITION 5.1 Let (U;2U ; : : :) be a model for c, and let x0 be an element of U such that U j= Cl(x0).The general frame generated by x0 in U is the triplet (W;R;W) where:� W = fw 2 U : w 2U x0g,� for all w;w0 2W , wRw0 , w0 2U w,� W = ffw 2 U : w 2U yg : y 2 U ^ y �U x0g.In order to show that a generated general frame is a general frame closed under L0-de�nitions, we prove thatthe set of all n-tuples of worlds, de�ned by a �rst-order formula in (W;R;W), can be obtained by means ofthe set-theoretic operations of c.In the following, given y 2 U such that y �U x0, we will identify it with the element fw 2 U : w 2U ygof W in the generated general frame; in particular, we will identify x0 with W .LEMMA 5.2 For every L0-formula �(x1; : : : ; xn; Y1; : : : ; Yk), whose free variables are among x1; : : : ; xn(world variables) and Y1; : : : ; Yk (set variables), there exists a term F�(X1; : : : ; Xn; Y1; : : : ; Yk) in the languageof c such that, for all V1; : : : ; Vn;W1; : : : ;Wk in W, and u 2 U ,U j= u 2 F�(V1; : : : ; Vn;W1; : : : ;Wk)if and only ifthere exist w1 2 V1; : : : ; wn 2 Vn such that13

a) U j= u = hwn; wn�1 : : : ; w1i,b) (W;R) j= �(w1; : : : ; wn;W1; : : : ;Wk):The proof of Lemma (5.2) (as well as all the missing proofs of the following lemmas) is given in the Appendix.The next lemma shows that any generated general frame is actually a general frame closed under L0-de�nitions.LEMMA 5.3 Let (U;2U ; : : :) be a model for c, and let x0 be an element of U such that U j= Cl(x0). Thegeneral frame (W;R;W) generated by x0 in U is a general frame closed under L0-de�nitions.Proof. Let �(x1; : : : ; xn; Y1; : : : ; Yk) be an L0-formula, a2; : : : ; an 2 W , and W1; : : : ;Wk 2 W . We need toshow that the set fa1 2 W : (W;R) j= �(a1; a2 : : : ; an;W1; : : : ;Wk)g belongs to W . Since Cl(x0) holds in U ,the sets fa2g; : : : ; fang belong to W and, applying Lemma (5.2) with V1 =W;V2 = fa2g; : : : ; Vn = fang, wehave that, for every u 2 U , U j= u 2 F�(W; fa2g; : : : ; fang;W1; : : : ;Wk)if and only ifthere exists a1 2 W such thata) U j= u = han; an�1 : : : ; a1i,b) (W;R) j= �(a1; : : : ; an;W1; : : : ;Wk):It follows that, for every a1 2 U ,U j= a1 2 Rngn�1(F�(W; fa2g; : : : ; fang;W1; : : : ;Wk)if and only ifa1 2 W and (W;R) j= �(a1; a2 : : : ; an;W1; : : : ;Wk):Since Rngn�1(F�(W; fa2g; : : : ; fang;W1; : : : ;Wk)) �U W , the setfa1 2W : (W;R) j= �(a1; a2 : : : ; an;W1; : : : ;Wk)gis equal to the set fa1 2 U : a1 2U Rngn�1(F�(W; fa2g; : : : ; fang;W1; : : : ;Wk)g, and thus it belongs to W .Hence (W;R;W) is closed under L0-de�nability. In particular, notice that the closure under union, relativecomplementation, and 2 follows, since, if W1;W2 2 W , then W1 [W2, W nW1, and 2(W1) are characterizedby L0-de�nitions from parameters in fW1;W2g. aOn the basis of the previous results, we can now prove the completeness of the translation.THEOREM 5.4 (Completeness of the translation method) For any pair of formulae �; ,L2 ` ST (�)! ST ( )) c ` 8x(Cl(x) ^ 8z (x � ��(x; z))! 8z (x � �(x; z))):Proof. Let (U;2U ; : : :) be a model for c, and let x0 be an element of U such that U j= Cl(x0). We alreadyproved that the general frame (W;R;W), generated by x0, is closed under L0-de�nitions. To prove the thesis,it su�ces to show that a modal formula � is valid in (W;R;W) (equivalently (W;R;W) j= ST (�)) if andonly if U j= 8z (x0 � ��(x0; z)).We can proceed, basically, as in Section 3. It is not di�cult to prove, indeed, that, for all w 2 W andy1; : : : ; yn 2 U , U j= w 2 ��(W; y1; : : : ; yn), (W;R;W) j= ST (�)(w; y1 \W; : : : ; yn \W );14

from which the thesis easily follows.We just check the property for the operator, leaving the remaining cases to the reader:U j= w 2 ( �)�(W; y1; : : : ; yn), U j= w 2W nRng((W n ��)�2W ),U j= w 62 Rng((W n ��)�2W ) (since U j= w 2W ) , U j= 8s (Pair(s; w) ! hs; wi 62 (W n ��)�2W ),U j= 8s (Pair(s; w) ^ s 2 W ^ s 2 w ! s 2 ��), U j= 8s (s 2W ^ s 2 w ! s 2 ��)(because U j= Cl(W ) and, if s; w 2W then U j= Pair(s; w)) ,8s 2 W (wRs! (W;R;W) j= ST (�)(s; y1\W; : : : ; yn\W )), (W;R;W) j= ST ( �)(w; y1\W; : : : ; yn\W ):aLet us prove now the correctness of the translation (Theorem (5.14) below). The structure of the proof issimilar to the one of Theorem (5.4): we will �rst de�ne a suitable notion of c-model generated by a generalframe (W;R;W) closed under L0-de�nability; then, we will prove the following two claims:� the generated c-model is actually a model of c;� a modal formula � is valid in the general frame (W;R;W) if and only if 8z(W � ��(W; z)) holds in thegenerated c-model.In the following, 2;�; fg; Dom;Rng;[; n;�;�=; C1; C2 denote standard (meta-theoretic) relations andoperations. For example, C1(x; y) is the set having as elements all sets t such that t = ha; hb; cii with ha; bi 2 xand c 2 y, where h�;�i denotes the standard pair. Moreover, if R is a binary relation, then x�2;R y denotesthe set fha; bi : a 2 x ^ b 2 y ^ a 2 bg [ fha; bi : a 2 x ^ b 2 y ^ bRag.From now on we will denote by (W;R;W) a general frame closed under L0-de�nitions. Without loss ofgenerality, we can assume that the elements of W are sets having the same rank, and no element of W is apair or a singleton. From such a general frame, we obtain an interpretation (Uc;2Uc ; : : :) of c as follows.The domain of the interpretation is built starting from all ordered sequences of W , adding the distinguishedsubsets of W , and closing under the c set operations. The membership relation and the interpretation ofthe function symbols are de�ned in the same way as in De�nition (4.4).DEFINITION 5.5 The c-model (Uc;2Uc ; : : :) generated by (W;R;W) is de�ned as follows.Domain of interpretation Uc:W s =W s0 = ffwg : w 2 Wg;W s(n+1) = fft1g; t1 [ t2 : t1; t2 2 Sni=0W si g;W s = S!i=0W si ;Wc =Wc0 =W [W s;Wc(n+1) = fDom(t1); Rng(t1); t1 � t2 : � 2 f[; n;�;�2;R;�=; C1; C2g; t1; t2 2 Sni=0Wci g;Wc = S!i=0Wci ;Uc =W [Wc. 15

Membership relation 2Uc : x 2Uc y i� x 2 F (y) for x; y 2 Uc;where F (y) = � fw 2W : yRwg = R(y) if y 2 W;y otherwise.Interpretation of function symbols:� fzgUc = � fzg if z 2 W [W s;; otherwise ;� z �Uc r = F (z) � F (r), for � in f[; n;�;�=; C1; C2g;� z �Uc2 r = F (z)�2;R F (r);� DomUc(z) = Dom(F (z)), and RngUc(z) = Rng(F (z)).where the operations on the right-hand side of the equalities are the standard ones.Notice that we used standard operations to build the domain of Uc, but the interpreted functions of themodel are non-standard. Moreover, since W 2 W , we have that W is an element of the generated model Uc.OBSERVATION 5.6 If a; b 2W [W s, then we have Uc j= Pair(a; b) and ha; bi = ha; biUc . If a 2W [W s(resp. b 2 W[W s), but b 62W[W s (resp. a 62 W[W s), then Uc 6j= Pair(a; b) and ha; biUc = ha; aiUc = ha; ai(resp. ha; biUc = hb; biUc = hb; bi). If a; b 62W [W s, then Uc 6j= Pair(a; b) and ha; biUc = ;.In order to show that the c-model generated by (W;R;W) is indeed an c-model, we �rst need to provethe following Lemma.LEMMA 5.7 The following properties hold:a) t 2 Wc ) t �W [W s;b) t 2 Uc ) t �Uc W [W s.Proof. a) The proof is by induction on the structure of t. If t 2 Wc, then either t 2 W or t 2W s. If t 2 W ,then t �W (by de�nition of W). If t 2 W s, then it is easy to prove that t �W [W s (by induction).Consider now the inductive step. The cases of t = t1 [ t2 and t = t1 n t2 are straightforward, and thusomitted.If t = t1 � t2 and u 2 t, then there exist a 2 t1 and b 2 t2 such that u = ha; bi. By induction, we havea; b 2 W [W s and thus u = ha; bi 2 W [W s, because this set is closed for ordered pairs. The case oft1 �2;R t2; t1 �= t2 are immediately solved by noticing that both are subsets of t1 � t2.If t = Dom(t1) and u 2 t, then there exists s such that hu; si 2 t1 and thus hu; si 2W [W s. Since noelement of W is a pair, hu; si 2 W s, and thus hu; si �W [W s. Moreover, since fug 2 hu; si, we havefug 2 W [W s. Finally, since fug 62 W , we have fug 2W s, and therefore fug �W [W s. This allowsus to conclude that u 2 W [W s. The case of t = Rng(t1) is similar, and thus omitted.If t = C1(t1; t2) and u 2 t then there are a; b; c such that ha; bi 2 t1, c 2 t2 and u = ha; hb; cii. Asbefore, it follows a; b; c 2 W [W s, and therefore u = ha; hb; cii 2 W s. The case of t = C2(t1; t2) issimilar. 16

b) Since all elements of W have the same rank, a) implies that W \Wc = ;. If t 2 Wc, then F (t) = t andthe thesis follows from a). Otherwise, t 2W and t �Uc W .aThe important feature of Uc expressed by b) in Lemma (5.7) is the fact that the extension of any z 2 Uc(w.r.t. Uc) is contained in W [W s.LEMMA 5.8 The interpretation (Uc;2Uc ; : : :) generated by a general frame closed under L0-de�nitions isan c-model.Proof. It is easy to see that (Uc;2Uc ; : : :) satis�es the axioms for union and di�erence.Consider the case of �:x 2Uc y �Uc z , x 2 F (y �Uc z), x 2 F (F (y)� F (z)),x 2 F (y)� F (z)(since F (y)� F (z) is never in W ),9a9b(a 2 F (y) ^ b 2 F (z) ^ x = ha; bi), 9a9b(a 2Uc y ^ b 2Uc z ^ x = ha; biUc ^ PairUc(a; b)):All equivalences are rather straightforward except for (the right direction of) the last one. First, since y 2 Uc,then F (y) 2 Wc. From Lemma (5.7 a)) and the de�nition of 2Uc , it follows that a 2 F (y)! a 2 Uc^a 2Uc y- the same for b; z. Moreover, if a 2Uc y, b 2Uc z, then Lemma (5.7) implies that a; b 2 W [W s, and, byObservation (5.6), we can conclude that Uc j= Pair(a; b), and the standard pair ha; bi coincide with ha; biUc .The proof for the other axioms is given in the Appendix. aIn order to prove the second Claim we show in Lemma (5.13) that every set in Uc, constructed by meansof the c-operations, has its members de�ned by an L0-formula involving parameters from W and sets fromW .We �rst need a number of auxiliary de�nitions and results.DEFINITION 5.9 A c-term t(x1; ::; xn) is either a variable xi or a term t0(fx1g; : : : ; fxng), where theterm t0(y1; : : : ; yn) is a term in fg and [.Notice that u 2W s if and only if there exists a c-term t(x1; : : : xn) which is not a variable and w1; : : : wn 2Wsuch that Uc j= u = t(w1; : : : wn).LEMMA 5.10 Let t(x1; ::; xn) be a c-term. If it is not a variable, then there exist k c-terms t1(x1; ::; xn); : : : ;tk(x1; : : : ; xn) such that, for all w1; : : : ; wn in W ,Uc j= t(w1; : : : ; wn) = ft1(w1; : : : ; wn)g [ : : : [ ftk(w1; : : : ; wn)g:Notice that if ti is a c-term, then fti(w1; : : : ; wn)gUc = fti(w1; : : : ; wn)g.LEMMA 5.11 If t(x1; ::; xn) and s(y1; ::; yl) are c-terms, then there are two L0-formulae (x1; ::; xn; y1; ::; yl)and �(x1; ::; xn; y1; ::; yl), which are boolean combinations of atomic formulae of the forms zi = zj and ziRzj,such that, for all w1; : : : ; wn; v1; : : : ; vl in W ,a) Uc j= t(w1; ::; wn) = s(v1; ::; vl) if and only if (W;R) j= (w1; ::; wn; v1; ::; vl),b) Uc j= t(w1; ::; wn) 2 s(v1; ::; vl) if and only if (W;R) j= �(w1; ::; wn; v1; ::; vl).17

LEMMA 5.12 For each c-term t(x1; : : : ; xm), there exist d c-terms t1(x1; : : : ; xm); : : : ; td(x1; : : : ; xm), andd2 L0-formulae �te;f (x1; :::; xm), with e; f 2 f1; : : : dg, such that, for all w1; : : : ; wm 2W and a; b 2 W [W s,Uc j= t(w1; : : : ; wm) = ha; biif and only ifthere exist e; f 2 f1; : : : dg such thata) Uc j= a = te(w1; : : : ; wm) ^ b = tf (w1; : : : ; wm);b) (W;R) j= �te;f (w1; : : : ; wm).We are now ready to prove the main lemma.LEMMA 5.13 For any term �(X1; : : : ; Xn) built using the functions [; n;�;�2;�=; Dom;Rng; C1; C2,whose free variables are among X1; : : : ; Xn, and for any A1; : : : ; An in Wc, there are:� k c-terms t1(x1; : : : ; xm); : : : ; tk(x1; : : : ; xm),� k L0-formulae ��1(x1; : : : ; xm; Y1; : : : ; Yr); : : : ; ��k(x1; : : : ; xm; Y1; : : : ; Yr),� r sets W1; : : : ;Wr in W,such that, for all u 2 Uc, Uc j= u 2 �(A1; : : : ; An)if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thata) Uc j= u = ti(w1; : : : ; wm),b) (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr).Proof. By induction on the structural complexity of the term �(X1; : : : ; Xn).Base case. �(X1; : : : ; Xn) = X1 and A1 2 Wc =W [W s.If A1 2 W , then t1(x1) = x1; ��1(x1; Y1) = x1 2 Y1 and W1 = A1 satisfy the required properties.If A1 2W s, we proceed by induction on the structure of the c-term de�ning A1. If A1 = fvg with v 2W ,then the c-term, the L0-formula, and the set W1 2 W can be de�ned as in the preceding case (fvg 2 W). IfA1 = s1(v1; : : : ; vp) [ s2(v1; : : : ; vq), it is su�cient to take as sets of c-terms, L0-formulae, and elements inW the unions of the corresponding sets for s1(v1; : : : ; vp) and s2(v01; : : : ; v0q). If A1 = fs(v1; : : : ; vp)g, we taket1(x1; : : : ; xp) = s(x1; : : : ; xp), ��1(x1; : : : ; xp; Y1; : : : ; Yp) = x1 2 Y1 ^ : : :^xp 2 Yp, and W1 = fv1g; : : : ;Wp =fvpg.Inductive step. The proof for [ is straightforward, and thus omitted. Let us consider the case of�(X1; : : : ; Xn) = �(X1; : : : ; Xn) n �(X1; : : : ; Xn).Fix A1; : : : ; An 2 Wc.Consider the term �. By induction, there are� k c-terms m1(x1; : : : ; xm); : : : ;mk(x1; : : : ; xm),� k L0-formulae ��1 (x1; : : : ; xm; Y1; : : : ; Yr); : : : ; ��k(x1; : : : ; xm; Y1; : : : ; Yr),� r sets W1; : : : ;Wr in W , 18

such that, for all u 2 Uc, Uc j= u 2 �(A1; : : : ; An)if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thata) Uc j= u = mi(w1; : : : ; wm),b) (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr).Consider the term �. By induction there are� h c-terms n1(x1; : : : ; xl); : : : ; nh(x1; : : : ; xl),� h L0-formulae ��1(x1; : : : ; xl; Y1; : : : ; Ys); : : : ; ��h(x1; : : : ; xl; Y1; : : : ; Ys),� s sets V1; : : : ; Vs in W ,such that, for all u 2 Uc, Uc j= u 62 �(A1; : : : ; An)if and only iffor all j 2 f1; : : : ; hg and for all v1; : : : ; vl 2Wa) Uc j= u 6= ni(v1; : : : ; vl), orb) (W;R) j= :��i (v1; : : : ; vl; V1; : : : ; Vs).It follows that Uc j= u 2 �(A1; : : : ; An)if and only ifUc j= u 2 �(A1; : : : ; An) and Uc j= u 62 �(A1; : : : ; An)if and only if(there exist i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thatUc j= u = mi(w1; : : : ; wm) and (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr))and(for all j 2 f1; : : : ; hg and v1; : : : ; vl 2W;Uc j= u 6= nj(v1; : : : ; vl) or (W;R) j= :��j (v1; : : : ; vl; V1; : : : ; Vs))if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2W such that(Uc j= u = mi(w1; : : : ; wm) and (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr) andhj=1 8v1; : : : ; vl 2W (Uc j= mi(w1; : : : ; wm) 6= nj(v1; : : : ; vl); or (W;R) j= :��j (v1; : : : ; vl; V1; : : : ; Vs)));where the scope of the existential quanti�er on i (originally limited to the �rst conjunct) has become thewhole formula, and the u appearing in the second conjunct has been substituted by mi,if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2W such that19

a) Uc j= u = mi(w1; : : : ; wm), andb) (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr)^Vhj=1 8v1; : : : ; vl(: i;j(w1; : : : ; wm; v1; : : : ; vl) _ :��j (v1; : : : ; vl; V1; : : : ; Vl)),where i;j is obtained from mi and nj as in Lemma (5.12).The proof for the other cases is given in the Appendix. aOn the basis of the previous results, we can now prove the correctness of the translation.THEOREM 5.14 (Soundness of the translation method) For each pair of formulae �; ,c ` 8x(Cl(x) ^ z (x � ��(x; z))! z (x � �(x; z)))) L2 ` ST (�)! ST ( ):Proof. Consider a general frame (W;R;W) closed under L0-de�nitions. The proof is accomplished in twosteps:Step 1: we show that the generated c-model (Uc;2Uc ; : : :) satis�es Uc j= Cl(W );Step 2: we prove that a modal formula � is valid in (W;R;W) if and only if Uc j= 8z (W � ��(W; z)).First of all, if Uc j= Pair(a; b), then a 2 fagUc ; b 2 fbgUc and, from Lemma (5.7), it follows thata; b 2 W s [W ; thus, for all w 2W , Uc j= Pair(w; ha; bi) and Uc j= Pair(ha; bi; w). From this, it follows thatUc j= Cl(W ).For step 2, it is enough to show that, for all u 2 Uc, F (u) \W 2 W . Indeed, if such a condition holds,then for all u1; : : : ; un 2 Uc,Uc j= w 2 ��(W;u1; : : : ; un), (W;R;W) j= ST (�)(w;F (u1) \W; : : : ; F (un) \W );(the only nontrivial case is � = 2 ; its proof is similar to the last part of the proof of Theorem (5.4)).From this, it easily follows thatUc j= 8z (W � ��(W; z)), (W;R;W) j= ST (�), the formula � is valid in (W;R;W):Hence, let us prove that, for all u 2 Uc, F (u) \W 2 W . Consider �rst the case in which y 2 W ; in thiscase F (y) \W = R(y) 2 W , because W is closed under L0-de�nitions. If y 2 Wc, then F (y) = y and it iseasy to show by induction on the structure of the elements of Wc that there exist A1; : : : ; An in W c suchthat Uc j= y = �(A1; : : : ; An), where � is a term as in Lemma (5.13). By such a lemma, it follows that thereexist� c-terms t1(x1; : : : ; xm); : : : ; tk(x1; : : : ; xm),� L0-formulae ��1(x1; : : : ; xm; Y1; : : : ; Yr); : : : ; ��k(x1; : : : ; xm; Y1; : : : ; Yr),� W1; : : : ;Wr in W ,such that for all u 2 Uc, Uc j= u 2 �(A1; : : : ; An)if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thata) Uc j= u = ti(w1; : : : ; wm),b) (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr).20

Notice that if the c-term ti is not a variable, then, for any w1; : : : ; wm in W , the element ti(w1; : : : ; wm)does not belong to W . Suppose w.l.o.g. that t1 = xl1 ; : : : ; ts = xls (l1; : : : ; ls � f1; : : :mg) are all the c-termsbetween t1; ::; tk which are variables. Then, F (y) \W is equal tofw 2W : (W;R) j= s_j=1 9w1 : : : :wm(w = wlj ^ ��j (w1; : : : ; wm;W1; : : : ;Wr))g:Since W is closed under L0-de�nitions, the latter set belongs to W . aAs we said in the introduction, a peculiar point of the technique employed in this section is the fact thatthe axiomatic requirements on the singleton operator are expressed locally on the set x by the formula Cl(x)in the antecedent of the translation. At this point a rather natural question follows: could we prove thecorrectness of the{more elegant{translation not involving Cl(x) with respect to c + fg (the extension ofc obtained adding an axiom for the singleton operator)? Even so, we believe that the present division ofset-theoretic labour between axioms and translation is a novel of interest by itself.6 Generalization to other languagesIn this section, we brie y consider the problem of applying (suitable variations of) the proposed translationmethod to other languages than the basic modal one, e.g. temporal, full monadic L2.6.1 Tense logicLet us consider �rst the case of minimal tense logic TL [6]. TL extends propositional logic with two one-placeoperators: F (future-tense) and P (past-tense). A sound and complete axiomatic system for TL consists ofthe usual axioms and rules of propositional logic plus the axioms:G(p! q)! (Gp! Gq) H(p! q)! (Hp! Hq)p! GPp p! HFpwhere G and H stand for :F: and :P:, respectively, and the rules of (temporal) necessitation:from � to infer G� and H�As shown in [16], it is possible to reduce frame validity in tense logic to that in modal logic. Even thoughsomewhat complicated, the composition of such a reduction and our translation method for modal logicwould allow us to encode minimal tense logic into as it stands.As an alternative, a speci�c translation method for TL can be devised that slightly extends , but keepsthe translation simpler. In view of the one-way character of 2, the main issue to consider is the treatment ofthe backward looking operator P. To this end, we extend the language of with a binary operator Pow�y(x),and add the following axiom (de�ning it) to :x 2 Pow�y(z) i� x 2 y ^ (x; y) � zwhere (x; y) � z is a shorthand for the formula 8t (x 2 t ^ t 2 y ! t 2 z). Let us call the resulting theoryTL. Notice that the additional axiom is only a particular instance of the comprehension schema.The translation of propositional letters and boolean connectives is the usual one. The translation of G isthe same as the translation of 2 in basic modal logic. The translation of H can be de�ned in terms of thePow�y(x) operator as follows: (H�)� = Pow�W (��):21

As an example, consider the translation of the formula Hpi, which is the term Pow�W (xi). By de�nition,x 2 Pow�W (xi) if and only if x 2 W ^ 8t(x 2 t ^ t 2 W ! t 2 xi), and this is the intendend meaning ofHpi when tRx corresponds to x 2 t.More generally, we have that w j= H�, 8t 2W (tRw ! t j= �)corresponds tow 2 Pow�W (��), w 2 W ^ (w;W ) � �� , w 2 W ^ 8t (w 2 t ^ t 2 W ! t 2 ��):It is worth noting that, unlike the case of the operator G, we do not need to require any \(inverse)transitivity" for the operator H , because if W � ��, then we always have W � Pow�W (��).PROPOSITION 6.1 For any TL-formula �(P1; : : : ; Pn), the following holds:`TL � , TL ` 8x(Trans(x)! 8x1 : : : xn(x � ��(x; x1; : : : ; xn))):As a further alternative, one can look for the proper subset of the operations introduced in section 5corresponding to the new operator Pow�y(x). This would allow us to single out the set theory for minimaltense logic somewhere between and c.More generally, we expect that a similar generalization of the proposed translation method could bedevised to obtain a set-theoretic characterization of other extensions of basic modal logic such as the Gabbay'sextension of K with the irre exivity rule [9] and the di�erence logic [15].6.2 Full monadic L2Let us consider now the case of the full monadic L2-language. The translation proposed in Section 5 encodedL2-derivability of formulae of the form ST (�) ! ST ( ) into derivability in c. It is not di�cult to see,however, that the proofs of Theorem (5.4) and Theorem (5.14) have a wider scope.Let �(x1; : : : ; xn; Y1; : : : ; Yk) be a generic L2-formula. Consider the translation � , introducing a new freevariable x, which is inductively de�ned as follows:� �(xiRxj) = xj 2 xi;� �(xi = xj) = xi = xj ;� �(xi 2 Yj) = xi 2 yj ;� �(� _ �) = �(�) _ �(�);� �(:�) = :�(�);� �(8xi�) = 8xi (xi 2 x! �(�));� �(8Yi�) = 8yi�(�).It is possible to prove the following proposition:PROPOSITION 6.2 For every pair of L2-sentences �; , the following holds:L2 ` �! , c ` 8x (cl(x) ^ �(�)(x) ! �( )(x)):22

The soundness and completeness of the translation can be proved as in Section 5. Consider, for example, thecase of completeness: given an c-model U and an element x0 of U satisfying cl(x0), we �rst build the generalframe of De�nition (5.1); then, we prove that, for each L2-formula �(x1; : : : ; xn; Y1; : : : ; Yk), w1; : : : ; wn 2W ,and y1; : : : yk 2 U ,U j= �(�)(W;w1 ; : : : ; wn; y1; : : : ; yk) i� (W;R;W) j= �(w1; : : : ; wn; y1 \W; : : : ; yk \W ):The same correspondence holds for the proof of soundness.Moreover, it is possible to show that � is a generalization of the translation given in Section 5: if is theformula ST (�), where �(P1; : : : ; Pn) is a modal formula, then it holds that: c ` 8x (cl(x) ! (�(�)(x) $8z (x � ��(x; z))).Conclusions and further directionsThe main purpose of this paper has been to build bridges between modal deduction and set-theoretic reason-ing. Let us collect some points concerning this enterprise already mentioned in our text. Our program maybe extended in several ways, by systematic variation in several `parameters' of this linkage. For instance,given a �xed translation, one can run through known modal logics extending the minimal one, and see whatset theories these involve - and the same may be done in the opposite direction. In the same spirit, one couldanalyse the set-theoretic strength of currently popular `additional modal rules of inference'. But also, onecan extend the language of the basic modal formalism, all the way up to the full classical logic of frames,as we have seen, obtaining richer reductions. Finally, there is also a constructive aspect. Our semanticalarguments can probably be reworked so as to yield e�ective purely combinatorial transformations betweenformal derivations in modal logic and our set theory. This will allow a more �nely structured comparison ofreasoning in both perspectives.References[1] P. Aczel, Non-well-founded sets, CSLI, Lecture Notes No. 14, 1988.[2] J. Barwise, Admissible sets and structure; Springer-Verlag. 1975.[3] J. van Benthem, Syntactic aspects of modal incompleteness theorems; Theoria, 45, 1979, pp. 67-81.[4] J. van Benthem, Modal Logic and Classical Logic; Bibliopolis, Napoli and Atlantic Heights (N.J.), 1985.[5] J. van Benthem and K. Doets, Higher-Order Logic, in Handbook of Philosophical Logic, Vol. I, D. Gabbayand F. Guenthner (eds.); D. Reidel Pub. Comp., Dordrecht-Holland, 1983, pp. 275-329.[6] J.P. Burgess, Basic Tense Logic, in Handbook of Philosophical Logic, Vol. II, D. Gabbay and F. Guenthner(eds.); D. Reidel Pub. Comp., Dordrecht-Holland, 1984, pp. 89-133.[7] G. D'Agostino, A. Montanari, and A. Policriti, Translating Modal Formulae as Set-Theoretic Terms;Research Report 10/94, Dipartimento di Matematica e Informatica, Universit�a di Udine, May 1994 (alsoin Logic Colloquium'94).[8] G. D'Agostino, A. Montanari, and A. Policriti, A set-theoretic translation method for polymodal logics;ILLC Prepublication Series, Mathematical Logic and Foundations, Amsterdam, October 1994 (a shortversion will appear in the Proc. of STACS '95). To appear in the Journal of Automated Reasoning.23

[9] D. M. Gabbay, An irre exivity lemma with applications to axiomatizations of conditions on tense frames,in Aspects of Philosophical Logic, U. M�onnich (ed.); D. Reidel Pub. Comp., Dordrecht-Holland, 1981,pp. 67{89.[10] J.L. Krivine, Introduction to axiomatic Set Theory; D. Reidel Pub. Comp., Dordrecht-Holland, 1971.[11] T. Jech, Set Theory; Pure and Applied Mathematics Series, Academic Press, 1978.[12] A. Nonnengart, First-order modal logic theorem proving and functional simulation; in Proc. of 13thInternational Joint Conference on Arti�cial Intelligence, IJCAI-93, Chambery, France, 1993, pp. 80-85.[13] H. J. Ohlbach, Semantic-Based Translation Methods for Modal Logics; Journal of Logic and Computa-tion, 1 (5), 1991.[14] H. J. Ohlbach, Translation Methods for Non-Classical Logics: An Overview; Bull. of the IGLP, 1 (1),1993, pp. 69-89.[15] M. de Rijke, The modal logic of inequality. Journal of Symbolic Logic, 57, 1992, pp. 566{584.[16] S.K. Thomason, Reduction of Tense Logic to Modal Logic II; Theoria, 41, 1975, pp.154{169.AppendixLEMMA 5.2 For every L0-formula �(x1; : : : ; xn; Y1; : : : ; Yk), whose free variables are among x1; : : : ; xn(world variables) and Y1; : : : ; Yk (set variables), there exists a term F�(X1; : : : ; Xn; Y1; : : : ; Yk) in the languageof c such that, for all V1; : : : ; Vn;W1; : : : ;Wk in W, and u 2 U ,U j= u 2 F�(V1; : : : ; Vn;W1; : : : ;Wk)if and only ifthere exist w1 2 V1; : : : ; wn 2 Vn such thata) U j= u = hwn; wn�1 : : : ; w1i,b) (W;R) j= �(w1; : : : ; wn;W1; : : : ;Wk):Proof. The proof is by induction on the structural complexity of �, and it is very similar to the proof ofLemma 6.1, pg. 64, in [2].By possibly renaming bounded variables we can assume that the formula � veri�es the following property:if 8xi or 9xi occurs in �, then i is the largest index among the indices of the free variables in the scope ofthe quanti�er.Notice that a formula with free variables among x1; : : : ; xi; Y1; : : : ; Yj can be considered either as a formula�(x1; : : : ; xi; Y1; : : : ; Yj) or as a formula �(x1; : : : ; xn; Y1; : : : ; Yk), for any n � i, k � j. Point 1 below showsthat we can consider every possible denotation for the same formula without loosing the property expressedin the Lemma.1) For any m; r; n; k, if �(x1; : : : ; xm; Y1; : : : ; Yr) = �(x1; : : : ; xn; Y1; : : : ; Yk) and the thesis is true for�(x1; : : : ; xn; Y1; : : : ; Yk), then it is true for �(x1; : : : ; xm; Y1; : : : ; Yr).The statement 1) follows from 1a),1b), and 1c) below.24

1a) For any r � 1, if �(x1; : : : ; xn; Y1; : : : ; Yk) = �(x1; : : : ; xn; Y1; : : : ; Yr) and the thesis is true for theformula �(x1; : : : ; xn; Y1; : : : ; Yr), then it is true for �(x1; : : : ; xn; Y1; : : : ; Yk), withF�(X1; : : : ; Xn; Y1; : : : ; Yk) = F�(X1; : : : ; Xn; Y1; : : : ; Yr)(the veri�cation is left to the reader).1b) If �(x1; : : : ; xn; xn+1; Y1; : : : ; Yk) = �(x1; : : : ; xn; Y1; : : : ; Yk) and the thesis is true for the formula�(x1; : : : ; xn; Y1; : : : ; Yk), then it is true for �(x1; : : : ; xn; xn+1; Y1; : : : ; Yk), withF�(X1; : : : ; Xn+1; Y1; : : : ; Yk) = Xn+1 � F�(X1; : : : ; Xn; Y1; : : : ; Yk):Indeed, for all V1; : : : ; Vn+1;W1; : : : ;Wk in W , and u 2 U ,U j= u 2 F�(V1; : : : ; Vn+1;W1; : : : ;Wk)if and only ifU j= u 2 Vn+1 � F�(V1; : : : ; Vn;W1; : : : ;Wk)if and only ifU j= 9wn+19b (wn+1 2 Vn+1 ^ b 2 F�(V1; : : : ; Vn;W1; : : : ;Wk) ^ Pair(wn+1; b) ^ u = hwn+1; bi)if and only ifthere exist w1 2 V1; : : : ; wn+1 2 Vn+1 such thata) U j= u = hwn+1; wn; : : : ; w1i,b) (W;R) j= �(w1; : : : ; wn+1;W1; : : : ;Wk)(since, for all w1; : : : ; wn+1 2W , Pair(wn+1; hwn; wn�1; : : : ; w1i) holds in U).1c) If �(x1; : : : ; xn�1; Y1; : : : ; Yk) = �(x1; : : : ; xn; Y1; : : : ; Yk) and the thesis is true for the right-hand sideformula �(x1; : : : ; xn; Y1; : : : ; Yk), then it is true for �(x1; : : : ; xn�1; Y1; : : : ; Yk), withF�(X1; : : : ; Xn�1; Y1; : : : ; Yk) = Rng(F�(X1; : : : ;W; Y1; : : : ; Yk))(the proof is left to the reader, and relies on the fact that W is not empty).Two more preliminary steps are needed before starting the inductive proof. In each step we just determinethe term F� , leaving the veri�cation of the thesis to the reader. The notation �(: : : ; xijxj ; : : : ; : : :) is used todenote uniform substitution of xj with xi in the formula �.2) If �(x1; : : : ; xn+1; Y1; : : : ; Yk) = �(x1; : : : ; xn+1jxn; Y1; : : : ; Yk) and the thesis is true for �, then it is truefor �. If n = 1, it is enough to take F�(X1; X2; Y1; : : : ; Yk) = F�(X2; Y1; : : : ; Yk) � X1. If n > 1, letF�(X1; : : : ; Xn+1; Y1; : : : ; Yk) = C2(F�(X1; : : : ; Xn�1; Xn+1; Y1; : : : ; Yk); Xn).3) If �(x1; : : : ; xn; Y1; : : : ; Yk) = �(xn�1jx1; xnjx2; Y1; : : : ; Yk), with n � 2, and the thesis is true for �, thenit is true for �, with F�(X1; : : : ; Xn; Y1; : : : ; Yk) = C1(F�(Xn�1; Xn; Y1; : : : ; Yk); Xn�2 � � � � �X1):Let us prove now the thesis by induction on the structural complexity of �(x1; : : : ; xn; Y1; : : : ; Yk). Westart with atomic formulae. 25

4a) If �(x1; x2) is the formula x1 = x2, then let F� = X2 �= X1. If we need to consider x1 = x2 as aformula in the variables x1; : : : ; xn; Y1; : : : ; Yk, then the thesis follows from 1).4b) If �(x1; : : : ; xn; Y1; : : : ; Yk) is the formula xn�1 = xn, then the thesis follows from 4a) and 3).4c) If �(x1; : : : ; xn; Y1; : : : ; Yk) is the formula xm = xr, with m � r � n, there are two possibilities: ifm = r, then F� = Xn� (: : :�X1); if m < r, then the thesis follows from 4a) and 2) by induction on r.5a) If �(x1; x2) is the formula x1Rx2, then F� = X2 �2 X1. If we need to consider x1Rx2 as a formula inthe variables x1; : : : ; xn; Y1; : : : ; Yk, then the thesis follows from 1).5b) If �(x1; : : : ; xn; Y1; : : : ; Yk) is the formula xn�1Rxn, the thesis follows from 5a) and 3).5c) If �(x1; : : : ; xn; Y1; : : : ; Yk) is the formula xiRxj , consider the formulae 1(x1; : : : ; xn+2; Y1; : : : ; Yk) =xi = xn+1, 2(x1; : : : ; xn+2; Y1; : : : ; Yk) = xj = xn+2, and 3(x1; : : : ; xn+2; Y1; : : : ; Yk) = xn+1Rxn+2.From 4c) and 5b), it follows that the thesis is true for i, i = 1; 2; 3. Then, it is easy to ver-ify that the thesis is true for �, with F� equal to Rng(Rng(F 1(X1; : : : ; Xn; Xi; Xj ; Y1; : : : ; Yk) \F 2(X1; : : : ; Xn; Xi; Xj ; Y1; : : : ; Yk)\ F 3(X1; : : : ; Xn; Xi; Xj ; Y1; : : : ; Yk))):6) If �(x1; Y1) is the formula x1 2 Y1, then F�(X1; Y1) = Y1. It can be easily generalized to the case of�(x1; : : : ; xn; Y1; : : : ; Yk) = xi 2 Yj as in 5c).In the inductive step, the case of boolean combinations of formulae is dealt with [ and n (w.r.t. Xn� : : :�X1, where n is the number of world variables displayed in the formula), and left to the reader. Consider thecase in which �(x1; : : : ; xn; Y1; : : : ; Yk) = 9xn+1�(x1; : : : ; xn+1; Y1; : : : ; Yk). Let F�(X1; : : : ; Xn; Y1; : : : ; Yk) =Rng(F�(X1; : : : ; Xn;W; Y1; : : : ; Yk)). Then, for all V1; : : : ; Vn;W1; : : : ;Wk in W , and u 2 U ,U j= u 2 F�(V1; : : : ; Vn;W1; : : : ;Wk)if and only ifthere exist w1 2 V1; : : : ; wn 2 Vn; s 2 W such thata) U j= u = hwn; wn�1; : : : ; w1i,b) (W;R) j= �(w1; : : : ; wn; s;W1; : : : ;Wk):if and only ifthere exist w1 2 V1; : : : ; wn 2 Vn such thata) U j= u = hwn; wn�1; : : : ; w1i,b) (W;R) j= 9xn+1�(w1; : : : ; wn; xn+1;W1; : : : ;Wk):aLEMMA 5.8 The interpretation (Uc;2Uc ; : : :) generated by a general frame (W;R;W) closed under L0-de�nition is an c model.Proof. The veri�cation of the axioms regarding [ and n is left to the reader, while the case of � can be foundin the text. Consider now the case of �2:x 2Uc y �Uc2 z , x 2 F (y �Uc2 z), x 2 F (F (y)�2;R F (z)), x 2 F (y)�2;R F (z),9a9b(a 2 F (y) ^ b 2 F (z) ^ x = ha; bi ^ (a 2 b _ bRa)),9a9b(a 2Uc y ^ b 2Uc z ^ x = ha; biUc ^ PairUc(a; b) ^ a 2Uc b)26

(since, for all a; b 2 Uc, a 2Uc b$ (a 2 b _ bRa)). The case of �= is left to the reader.Consider the case of Dom:x 2Uc DomUc(y), x 2 F (DomUc(y)), x 2 F (Dom(F (y)), x 2 Dom(F (y)),9a(hx; ai 2 F (y)), 9a 2 Uc(hx; aiUc 2Uc y ^ PairUc(x; a)):All equivalences are rather straightforward, execpt for (the right direction of) the last equivalence. If hx; ai 2F (y), then a 2 Rg(F (y)) and Rg(F (y)) 2 Wc. Hence, from Lemma (5.7), it follows that a 2 W [ W s.Similarly, x 2 W [W s and, by Observation (5.6), Uc j= Pair(x; a), and the standard pair hx; ai coincideswith hx; aiUc .The cases of C1; C2 are left to the reader. aLEMMA 5.10 Let t(x1; ::; xn) be a c-term. If it is not a variable, then there exist k c-terms t1(x1; ::; xn); : : : ;tk(x1; : : : ; xn) such that, for all w1; : : : ; wn in W ,Uc j= t(w1; : : : ; wn) = ft1(w1; : : : ; wn)g [ : : : [ ftk(w1; : : : ; wn)g:Proof. If t(x1; ::; xn) is not a variable, then t(x1; ::; xn) = t0(fx1g; : : : ; fxng) (by de�nition of c-term). Theproof of the lemma is by induction on the structure of the term t0(y1; : : : yn).If t0 = yi, then t(xi) = fxig, and the result follows with t1(xi) = xi.If t0(y1; : : : yn) = t01(y1; : : : yn)[t02(y1; : : : yn), then the union of the two sets of terms obtained by inductionfor t1(x1; : : : ; xn) = t01(fx1g; : : : ; fxng) and t2(x1; : : : ; xn) = t02(fx1g; : : : ; fxng) can be taken as the set ofterms for t(x1; ::; xn).If t0(y1; : : : yn) = ft01(y1; : : : yn)g, then the result follows assuming t1(x1; ::; xn) = t01(fx1g; : : : ; fxng). aLEMMA 5.11 If t(x1; ::; xn) and s(y1; ::; yl) are c-terms, then there are two L0-formulae (x1; ::; xn; y1; ::; yl)and �(x1; ::; xn; y1; ::; yl), which are boolean combinations of atomic formulae of the forms zi = zj and ziRzj,such that, for all w1; : : : ; wn; v1; : : : ; vl in W ,a) Uc j= t(w1; ::; wn) = s(v1; ::; vl) if and only if (W;R) j= (w1; ::; wn; v1; ::; vl),b) Uc j= t(w1; ::; wn) 2 s(v1; ::; vl) if and only if (W;R) j= �(w1; ::; wn; v1; ::; vl).Proof. Consider �rst the case of =. The proof is by induction on the maximum of the heights of t and s.If both terms are variables, say t = x1 and s = y1, take (x1; y1) equal to x1 = y1.If one is a variable, but the other is not, then, for every w1; : : : ; wn; v1; : : : ; vl 2 W , it is impossible thatUc j= t(w1; ::; wn) = s(v1; ::; vl); thus, take (x1; y1; : : : ; yl) equal to x1 6= x1.If t and s are not variables, then Lemma (5.10) allows us to obtain k c-terms t1(x1; ::; xn); : : : ; tk(x1; : : : ; xn)and h c-terms s1(y1; ::; yl); : : : ; sh(y1; : : : ; yl) such that, for all w1; : : : ; wn; v1; : : : ; vl in W ,Uc j= t(w1; : : : ; wn) = ft1(w1; : : : ; wn)g [ : : : [ ftk(w1; : : : ; wn)g;and Uc j= s(v1; : : : ; vl) = fs1(v1; : : : ; vl)g [ : : : [ fsh(v1; : : : ; vl)g:Therefore, Uc j= t(w1; : : : ; wn) = s(v1; : : : ; vl)if and only ifUc j= ft1(w1; : : : ; wn)g [ : : : [ ftk(w1; : : : ; wn)g = fs1(v1; : : : ; vl)g [ : : : [ fsh(v1; : : : ; vl)g:27

For this kind of sets, extensionality holds in Uc. Thus, we may replace the above equality by a booleancombination of equalities between ti(w1; : : : ; wn) and sj(v1; : : : ; vl), with 1 � i � k and 1 � j � h; the thesisfollows from the inductive hypothesis.Consider now the case of 2.If both terms are variables, say t = x1 and s = y1, take �(x1; y1) equal to y1Rx1.If t is not a variable, but s (= y1) is a variable, then, for all w1; : : : ; wn; v1 2 W , it is impossible thatUc j= t(w1; ::; wn) 2 v1; thus, take �(x1; : : : ; xn; y1) equal to x1 6= x1.If s is not a variable, then, by Lemma (5.10), it follows that, for all w1; : : : ; wn; v1; : : : ; vl 2 W , Uc j=t(w1; : : : ; wn) 2 s(v1; : : : ; vl) if and only if Uc j= t(w1; : : : ; wn) 2 fs1(v1; : : : ; vl)g [ : : : [ fsh(v1; : : : ; vl)g ifand only if Uc j= t(w1; : : : ; wn) = s1(v1; : : : ; vl)_ : : :_ t(w1; : : : ; wn) = sh(v1; : : : ; vl). The thesis follows froma). aLEMMA 5.12 For each c-term t(x1; : : : ; xm), there exist d c-terms t1(x1; : : : ; xm); : : : ; td(x1; : : : ; xm), andd2 L0-formulae �te;f (x1; :::; xm), with e; f 2 f1; : : : dg, such that, for all w1; : : : ; wm 2W and a; b 2 W [W s,Uc j= t(w1; : : : ; wm) = ha; biif and only ifthere exist e; f 2 f1; : : : dg such thata) Uc j= a = te(w1; : : : ; wm) ^ b = tf (w1; : : : ; wm),b) (W;R) j= �te;f (w1; : : : ; wm).Proof. Consider the c-term t(x1; : : : ; xm). If t(x1; : : : ; xm) is a variable, say x1, then, for all w1 2 W ,t(w1)(= w1) is not an ordered pair in the model Uc (cfr. Observation (5.6)). Therefore, take d equal to 1,any c-term as t1, and w1 6= w1 as �te;f . The same argument works if t(x1; : : : ; xm) is not a variable, but oneof the c-term obtained by applying Lemma (5.10) to it is a variable.Otherwise, apply Lemma (5.10) twice. At the �rst step, we obtain t1(x1; : : : ; xm); : : : ; tk(x1; : : : ; xm) suchthat, for all w1; : : : wm 2 W ,Uc j= t(w1; : : : ; wm) = ft1(w1; : : : ; wm); : : : ; tk(w1; : : : ; wm)g;at the second step, for i = 1; : : : ; k, we determine ni terms ti;1(x1; : : : ; xm); : : : ; ti;ni(x1; : : : ; xm) such thatUc j= ti(w1; : : : ; wm) = fti;1(w1; : : : ; wm); : : : ; ti;ni(w1; : : : ; wm)g:By replacing each ti(w1; : : : ; wm) with the corresponding set of terms, we obtainUc j= t(w1; : : : ; wm) = fft1;1(w1; : : : ; wm); : : : ; t1;n1g(w1; : : : ; wm); : : : ;ftk;1(w1; : : : ; wm); : : : ; tk;nk (w1; : : : ; wm)gg:Let d = n1 + : : :+ nk and t1 = t1;1; : : : ; td = tk;nk . For all w1; : : : ; wm 2 W , the element t(w1; : : : ; wm) isa pair, with �rst component te = ti0;j0 and second component tf = ti1;j1 , if and only if in Uc it holds that( k_i=1 nij=1 ti;j = ti0;j0) ^ ( ki=1 nij=1(ti;j = ti0;j0 _ ti;j = ti1;j1)) ^ ( ki=1 ni_j=1 ti;j = ti0;j0);where the �rst conjunct says that there exists an i such that ti is the singleton fti0;j0g, the second conjunctsays that, for all i, ti is a subset of fti0;j0 ; ti1;j1g, and the third one says that, for all i, ti contains ti0;j0 . ByLemma (5.11), this expression corresponds to an L0-formula. a28

LEMMA 5.13 For any term �(X1; : : : ; Xn) built using the functions [; n;�;�2;�=; Dom;Rng; C1; C2;,whose free variables are among X1; : : : ; Xn, and for any A1; : : : ; An in Wc, there are:� k c-terms t1(x1; : : : ; xm); : : : ; tk(x1; : : : ; xm),� k L0-formulae ��1(x1; : : : ; xm; Y1; : : : ; Yr); : : : ; ��k(x1; : : : ; xm; Y1; : : : ; Yr),� r sets W1; : : : ;Wr in W,such that, for all u 2 Uc, Uc j= u 2 �(A1; : : : ; An)if and only ifthere exist i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thata) Uc j= u = ti(w1; : : : ; wm),b) (W;R) j= ��i (w1; : : : ; wm;W1; : : : ;Wr).Proof. The base case and the inductive step for [ and n have been already proved.To complete the proof, we must consider both terms of the form �(X1; : : : ; Xn) � �(X1; : : : ; Xn), with� 2 f�;�2;�=; C1; C2g, and terms of the forms Dom(�(X1; : : : ; Xn)) and Rng(�(X1; : : : ; Xn)).For i 2 f1; : : : ; kg (resp. j 2 f1; : : : ; hg), let mi(x1; : : : xm), ��i (x1; : : : xm; Y1; : : : ; Yr), and W1; : : : ;Wr,(resp. nj(y1; : : : ; yl), ��j (y1; : : : ; yl; Z1; : : : ; Zs), and V1; : : : Vs) be obtained by induction for �(A1; : : : ; An)(resp. �(A1; : : : ; An)).Consider the case of �: �(X1; : : : ; Xn) = �(X1; : : : ; Xn)� �(X1; : : : ; Xn).Uc j= u 2 �(A1; : : : ; An)if and only ifUc j= 9a9b (a 2 �(A1; : : : ; An) ^ b 2 �(A1; : : : ; An) ^ u = ha; bi ^ Pair(a; b))if and only ifthere exist i 2 f1; : : : ; kg; j 2 f1; : : : ; hg and w1; : : : ; wm; v1; : : : ; vl 2W such thata) Uc j= u = hmi(w1; : : : ; wm); nj(v1; : : : ; vl)ib) (W;R) j= ��i (w1; : : : wk;W1; : : : ;Wr) ^ ��j (v1; : : : ; vl; V1; : : : ; Vs))),(because, from mi(w1; : : : ; wm) 2Uc �(A1; : : : ; An) and nj(v1; : : : ; vl) 2Uc �(A1; : : : ; An), it follows thatUc j= Pair(mi(w1; : : : ; wm); nj(v1; : : : ; vl))).The cases �(X1; : : : ; Xn) = �(X1; : : : ; Xn) �2 �(X1; : : : ; Xn) and �(X1; : : : ; Xn) = �(X1; : : : ; Xn) �=�(X1; : : : ; Xn) are easily proved by using Lemma 5.11.Consider the case of Dom: �(X1; : : : ; Xn) = Dom(�(X1; : : : ; Xn)).For all i 2 f1; : : : ; kg, the application of Lemma (5.12) to the c-term mi (for �) allows us to �nd di c-termsm1i (x1; : : : ; xm); : : : ;mdii (x1; : : : ; xm) and d2i L0-formulae �miei;fi(x1; :::; xm), with ei; fi 2 f1; : : : dig, such that,for all u; b 2 W [W s, Uc j= mi(w1; : : : ; wm) = hu; biif and only ifthere exist ei; fi 2 f1; : : : diga) Uc j= u = meii (w1; : : : ; wm) ^ b = mfii (w1; : : : ; wm);a) (W;R) j= �miei;fi(w1; : : : ; wm).29

It follows that the c-terms, the L0-formulae, and the sets in W for �(A1; : : : ; An) can be chosen as follows:� the c-term are m11; : : : ;md11 ; : : : ;m1k; : : : ;mdkk ;� the L0-formula relative to the c-term meii is ��i ^Wdifi=1 �miei;fi(w1; : : : wm);� the sets in W are W1; : : :Wm (the same we took for �).Indeed, for all u 2 Uc, Uc j= u 2 Dom(�(A1; : : : ; An))if and only ifUc j= 9b(hu; bi 2 �(A1; : : : ; An) ^ Pair(u; b))if and only ifu 2W [W s and 9b 2W [W s such thatUc j= hu; bi 2 �(A1; : : : ; An)(since Uc j= Pair(u; b) if and only if u; b 2 W [W s)if and only ifu 2W [W s, and there exist b 2W [W s, i 2 f1; : : : ; kg and w1; : : : ; wm 2 W such thata) Uc j= hu; bi = mi(w1; : : : ; wm);b) (W;R) j= ��i (w1; : : : wm;W1; : : : ;Wr).if and only ifthere exist i 2 f1; : : : ; kg, ei; fi 2 f1; : : : ; dig and w1; : : : ; wm 2W such thata) Uc j= u = meii (w1; : : : ; wm);b) (W;R) j= ��i (w1; : : : wm;W1; : : : ;Wr) ^ �miei;fi(w1; : : : wm)if and only ifthere exist i 2 f1; : : : ; kg, ei 2 f1; : : : ; dig and w1; : : : ; wm 2 W such thata) Uc j= u = meii (w1; : : : ; wm);b) (W;R) j= ��i (w1; : : : wm;W1; : : : ;Wr) ^Wdifi=1 �miei;fi(w1; : : : wm).The case of Rng is similar, and therefore it is left to the reader.Consider now the case of C1: �(A1; : : : ; An) = C1(�(A1; : : : ; An); �(A1; : : : ; An)).For all u 2 Uc, we have Uc j= u 2 C1(�(A1; : : : ; An); �(A1; : : : ; An))if and only ifthere exist a; b; c in W [W s such thatUc j= u = ha; hb; cii ^ ha; bi 2 �(A1; : : : ; An) ^ c 2 �(A1; : : : ; An)(we can omit the conjuncts Pair(a; b); Pair(b; c); ::: for the same reason as in the case of Dom)if and only ifthere exist i 2 f1; : : : ; kg, ei; fi 2 f1; : : : ; dig, j 2 f1; : : : ; hg and w1; : : : ; wm; v1; : : : ; vl 2 W such thata)Uc j= u = hmeii (w1; : : : wm); hmfii (w1; : : : wm); nj(v1; : : : ; vl)iib) (W;R) j= ��i (w1; : : : wm;W1; : : : ;Wr) ^ ��j (v1; : : : ; vl; V1; : : : ; Vr) ^ �miei;fi(w1; : : : ; wm);(by applying Lemma (5.12) again to each c-term mi (for �))and the thesis easily follows.The case of C2 is similar, and therefore it is left to the reader. a30