1 Introduction
Program verification within modal logic, as showcased by dynamic logic [14], is following the mainstream axiomatic approach proposed by Hoare/Floyd [10, 16]. In this paper, we continue our work from [17] in exploring the amenability of dynamic logic in particular, and of modal logic in general, to express operational semantics of languages (as axioms), and to make use of such semantics in program verification. Consequently, we consider the SMC Machine described by Plotkin [19], we derive a dynamic logic set of axioms from its proposed transition semantics, and we argue that this set of axioms can be used to derive Hoarelike assertions regarding functional correctness of programs written in the SMC language.
The main idea is to define a general logical system that is powerful enough to represent both the programs and their semantics in a uniform way. With respect to this, we follow the line of [13] and the recent work from [20].
The logical system that we developed as support for our approach is a manysorted hybrid polyadic modal logic, built upon our general manysorted polyadic modal logic defined in [17]. We chose a modal setting since, as argued above, through dynamic logic and Hoare logic, modal logic has a longstanding tradition in program verification (see also [8] for a modal logic approach to separation logic [21]) and it is successfully used in specifying and verifying hybrid systems [18].
In [17] we defined a general manysorted modal logic, generalizing some of the already existing approaches, e.g. [22, 23] (see [17] for more references on manysorted modal logic). This system allows us to specify a language and its operational semantics and one can use it to certify executions as well. However, both its expressivity and its capability are limited: we were not able to perform symbolic execution and, in particular, we were not able to prove Hoarestyle invariant properties for loops. In Remark 2.4, we point out some theoretical aspects related to these issues.
In the present paper we employ the procedure of hybridization on top of our manysorted modal logic previously defined. We drew our inspiration from [7, 20] for practical aspects, and from the extensive research on hybrid modal logic [1, 6] on the theoretical side.
Our aim was to develop a system that is strong enough to perform all the addressed issues (specification, semantics, verification), but also to keep it as simple as possible from a theoretical point of view. To conclude: in our setting we are able to associate a sound and complete manysorted hybrid modal logic to a given language such that both operational semantics and program verification can be performed through logical inference.
We have to make a methodological comment: sometimes nominals are presented as another sort of atoms (see, e.g.[6]). Our sorts come from a manysorted signature , as in [13], so all the formulas (in particular the propositional variables, the state variables, the nominals) are sorted sets. When we say that the hybrid logic is monosorted we use sorted according to our context, i.e. the sets of propositional variables, nominals and state variables are regular sets and not sets.
2 Preliminaries: a manysorted modal logic
Our language is determined by a fixed, but arbitrary, manysorted signature and an sorted set of propositional variables such that for any and for any in . For any and we denote .
The set of formulas of is an indexed family inductively defined by:
where , and .
We use the classical definitions of the derived logical connectors: for any the dual operation is
In the sequel, by we mean that is a formula of sort . Similarly, means that is a set of formulas of sort . When the context uniquely determines the sort of a state symbol, we shall omit the subscript.
In order to define the semantics we introduce the frames and the models. An frame is a tuple such that:

is an sorted set of worlds and for any ,

for any .
An model based on is a pair where such that for any . The model will be simply denoted as .
In the sequel we introduce a manysorted satisfaction relation. If is an model, , and is a formula of sort , then the manysorted satisfaction relation is inductively defined:

iff

iff

iff or

if , then iff there exists such that and for any .
Definition 2.1 (Validity and satisfiability).
Let and assume is a formula of sort . Then is satisfiable if for some model and some . The formula is valid in a model if for any ; in this case we write . The formula is valid in a frame if is valid in all the models based on ; in this case we write . Finally, the formula is valid if is valid in all frames; in this case we write .
The system

For any , if is a formula of sort which is a theorem in propositional logic, then is an axiom.

Axiom schemes: for any and for any formulas of appropriate sorts, the following formulas are axioms:

Deduction rules: Modus Ponens and Universal Generalization
if and then if then
The set of theorems of is the least set of formulas that contains all the axioms and it is closed under deduction rules. Note that the set of theorems is obviously closed under sorted uniform substitution (i.e. propositional variables of sort are uniformly replaced by formulas of the same sort). If is a theorem of sort write . Obviously, is a generalization of the modal system (see [6] for the monosorted version).
The distinction between local and global deduction from the monosorted setting (see [6]) is deepened in our version: locally, the conclusion and the hypotheses have the same sort, while globally, the set of hypotheses is a manysorted set. In the sequel we only consider the local setting.
Definition 2.2 (Local deduction).
[17] If and is a set of formulas of sort , then we say that is (locally) provable from if there are such that . In this case we write .
The construction of the canonical model is a straightforward generalization of the monosorted setting. For more details, we refer to [17]. The last result we recall is the (strong) completeness theorem with respect to the class of all frames.
Theorem 2.3.
[17] Let be a set of formulas of set . If is a consistent set in then has a model. Moreover, if is a formula of sort , then iff , where denotes the fact that any model of is also a model of .
Remark 2.4 (Problems).
The manysorted modal logic allows us to define both the syntax and the semantics of a programming language (see [17] for a complex example). However, there are few issues, both theoretical and operational, that we could not overcome:

the logic can be used to certify executions, but not to perform symbolic verification; in particular, in order to prove the invariant properties for loops, the existential binder is required;

the sorts are completely isolated formally, but in our example elements of different sorts have a rich interaction.
These issues will be adressed in the following sections.
3 Manysorted hybrid modal logic
The hybridization of our manysorted modal logic is developed using a combination of ideas and techniques from [1, 3, 4, 6, 11, 12]. Hybrid logic is defined on top of modal logic by adding nominals, states variables and specific operators and binders.
Nominals allow us to directly refer the worlds (states) of a model, since they are evaluated in singletons in any model. However, a nominal may refer different worlds in different models. In the sequel we introduce the constant nominals, which are evaluated to singletons, but they refer to the same world (state) in all models. Our example for constant nominals are true and false from Section 4.
Definition 3.1 (Signature with constant nominals).
A signature with constant nominals is a triple where is a manysorted signature and is an sorted set of constant nominal symbols. In the sequel, we denote .
As before, the sorts will be denoted by , , and by , and we will denote some countable sorted sets. The elements of are ordinary propositional variables and they will be denoted , ,; the elements of are called nominals and they will be denoted by , , ; the elements of are called state variables and they are denoted , , . We shall assume that for any distinct sorts , the corresponding sets of propositional variables, nominals and state variables are distinct. A state symbol is a nominal, a constant nominal or a state variable..
As in the monosorted case, nominals and state variables will be semantically constrained: they are evaluated in singleton, which means they will always refer to a unique world of our model. In addition, the constant nominals will refer to the same world(state) in any evaluation, so they will be defined at the frames’ level.
In the monosorted setting, starting with a modal logic, the simplest hybrid system is obtained by adding nominals alone. However, the basic hybrid system is obtained by adding the satisfaction modality (which states that is true at the world denoted by the nominal ). The most powerful hybrid systems are obtained by further adding the binders and that bind state variables to worlds, with the expected semantics [1, 2, 4]. The subsequently defined systems and develop the hybrid modal logic in our manysorted setting.
Note that, whenever the context is clear, we’ll simply write instead of or , and instead of or . We will further assume that the sort of a formula (set of formulas) is implied by a concrete context but, whenever necessary, we will use subscripts to fix the sort of a symbol: means that is a state variable of sort , means that is a set of formulas of sort , etc.
Definition 3.2 (Formulas).
For any we define the formulas of sort :
 for :
 for :
Here, , , , ,, and . For any , the dual formula is defined as in Section 2. We also define the dual binder : for any , if is a formula of sort and is a state variable of sort , then is a formula of sort . The notions of free state variables and bound state variables are defined as usual.
Remark 3.3 (Expressivity).
As a departure from our sources of inspiration, we only defined the satisfaction operators for nominals, and not for state variables. Hence, is not a valid formula in our logic. Our reason was to keep the system as ”simple” as possible, but strong enough to overcome the problems encountered in the nonhybrid setting (see Remarks 2.4). More issues concerning expressivity are analyzed in Section 5.
One important remark is the definition of the satisfaction modalities: if and are a nominal and respectively, a formula of the sort , then we define a family of satisfaction operators such that is a formula of sort for any . This means that is true at the world denoted by on the sort and is acknowledged on any sort . So, our sorted worlds are not isolated anymore, both from a syntactic and a semantic point of view.
Definition 3.4.
If then a frame is where is an frame and and for any . We will further assume that distinct constant nominals have distinct sorts, so we shall simply write .
Definition 3.5 (The satisfaction relation in ).
A (hybrid) model in is a triple
where is an sorted valuation such that is a singleton for any and . If is an sorted evaluation, we define by for any and otherwise.
The satisfaction relation for nominals, constant nominals and satisfaction operators is defined as follows:

if and only if ,

if and only if where .
Here , , , and is a formula of sort .
Satisfiability and validity in are defined as in Section 2.
In order to define the semantics for more is needed. Given a model , an assignment is an sorted map . If and are assignment functions and then we say that is an variant of (and we write ) if for and for any , .
Definition 3.6 (The satisfaction relation in ).
In the sequel
is a model and an sorted assignment. The satisfaction relation is defined as follows:

, if and only if , where ,

, if and only if , where ,

, if and only if

, if and only if or

if then , if and only if there is
such that and for any , 
if and only if where , has the sort and ,

, if and only if for all .
Consequently,

, if and only if .
Following the monosorted setting, satisfiability in is defined as follows: a formula of sort is satisfiable if for some model , some assignment and some . Consequently, the formula is valid in a model if for any assignment and any . One can speak about validity in a frame as in Section 2.
In the presence of nominals, we can speak about named models and pure formulas, as in [6][Section 7.3].
Definition 3.7 (Named models and pure formulas).
A formula is pure if it does not contain propositional variables. A pure instance of a formula is obtained by is obtained by uniformly substituting nominals for nominals of the same sort. A model is named if for any sort and world there exists such that .
As in the monosorted case, pure formulas and named models are important since they give rise to strong completeness results with respect to the class of frames they define.
Proposition 3.8 (Pure formulas in ).
Let be a named model, the corresponding frame and a pure formula of sort . Then if and only if for any that is a pure instance of .
Proof.
Let be a pure formula of sort and suppose . Then there exist a valuation and some state in the model such that .
On each sort we will notate all the nominals occurring in . But because we are working in a named model, labels every state of any sort in with a nominal of the same sort. Hence, on each sort there exist nominals such that , ,. Therefore, if and is obtained by substituting on each sort each nominal with the corresponding one , then .
But is a pure formula, and by substituting the nominals contained in the formula with other nominals of the same sort, the new instance it is also a pure formulas like . Therefore, by hypothesis, we have for any . But also , hence , and we have a contradiction. ∎
Can we prove a similar result for the system ? We give a positive answer to this question, inspired by the discussion on existential saturation rules from [3][Lemma 1]. In order to do this, we define the pure formulas and we characterize frame satisfiability for such formulas. As consequence, Propositions 3.8 and 3.11 will lead to completeness results with respect to frame validity.
Definition 3.9.
In , we say that a formula is pure if it is pure or it has the form , where contains no propositional variables and the only state symbols from are in .
Proposition 3.10 (Pure formulas in ).
Let be a named model where , the corresponding frame and a pure formula of sort . Then if and only if .
Proposition 3.11 (Pure formulas in ).
Let be a named model where , the corresponding frame and a pure formula of sort . Then if and only if .
Proof.
Suppose where do not occur in . Hence, for any and any of sort , where do not occur in . So, for any assignment exists an assignment such that . Let and for any . Because we work with named model, there exist nominals and such that and for any . Therefore, we get for any exist such that . But now we have a pure formula and the assignment function will not affect the satisfiability of the formula. Therefore, for any exist such that . Therefore, for any assignment and any of sort we have that for any there exist such that . We use the contrapositive of axiom to get that and by Lemma 3.14 we get that for any assignment and any of sort we have that if and only if ∎
We are ready now to define the deductive systems of our logics. The deductive systems for and are presented in Figure 2.
The system

The axioms and the deduction rules of

Axiom schemes: any formula of the following form is an axiom, where are sorts, , are formulas (when necessary, their sort is marked as a subscript), are nominals or constant nominals, and , are state variables:

Deduction rules:
if then if then , where and have the same sort if then , where does not occur in if then where is distinct from that does not occur in or if then where and for some . Here, and are nominals or constant nominals having the appropriate sort.
The system

The axioms and the deduction rules of

Axiom schemes:

Deduction rules: , , , ,
In the sequel, our main focus is on the more expressive system . The properties and the proofs for follow easily from their equivalent in the richer setting.
Theorems and (local) deduction from hypothesis are defined as in Section 2. In order to further develop our framework, we need to analyze the uniform substitutions. Apart for being sorted, in the hybrid setting, more restrictions are required: state variables are uniformly replaced by state symbols that are substitutable for them (as in the monosorted setting [4]). Nominals and constant nominals are always substitutable for state variables of the same sort. If and are state variables of the sort , then we define:

if , then is substitutable for in ,

is substitutable for in iff is substitutable for in ,

is substitutable for in iff is substitutable for in and ,

is substitutable for in iff is substitutable for in for all ,

is substitutable for in iff is substitutable for in ,

is substitutable for in iff does not occur free in , or and is substitutable for in .
In the sequel, we will say that a substitution is legal if it perform only allowed replacements. If is a formula and is a state variable we denote by the formula obtained by substituting for all free occurrences of in ( must be a nominal, a constant nominal or a state variable substitutable for ).
Lemma 3.12 (Agreement Lemma).
Let be a standard model. For all standard assignments and , all states in and all formulas of sort , if and agree on all state variables occurring freely in , then:
Proof.
We suppose that and agree on all state variables occurring freely in on each sort. We prove this lemma by induction on the complexity of :

iff we have iff .

iff we have , but , therefore .

iff . But, if and agree on all state variables occurring freely in , then same for . Therefore, from the induction hypothesis, iff . Then