1 Introduction
Church’s uniform substitution is a classical proof rule for firstorder logic [2, §35/40]. Uniform substitutions uniformly instantiate function and predicate symbols with terms and formulas, respectively, as functions of their arguments. If is valid, then so is any admissible instance for any uniform substitution :
Uniform substitution , e.g. turns into . The introduction of is sound, but introducing variable via would not be. The occurrence of the variable of the argument that was already present previously, however, can correctly continue to be used in the instantiation.
Differential game logic (), which is the specification and verification logic for hybrid games [5], originally adopted uniform substitution for predicates, because they streamline and simplify completeness proofs. A subsequent investigation of uniform substitutions for differential dynamic logic () for hybrid systems [6] confirmed how impressively Church’s original motivation for uniform substitutions manifests in significantly simplifying prover implementations.
Church developed uniform substitutions to relate the study of (objectlevel) axioms to that of (metalevel) axiom schemata (which stand for an infinite family of axioms). Beyond their philosophical considerations, uniform substitutions significantly impact prover designs by eliminating the usual gap between a logic and its prover. After implementing the recursive application of uniform substitutions, the soundnesscritical part of a theorem prover reduces to providing a copy of each concrete logical formula that the logic adopts as axioms. Uniform substitutions provide a modular interface to the static semantics of the logic, because they are the only soundnesscritical part of the prover that needs to know free or bound variables of an expression. This simplicity is to be contrasted with the subtle soundnesscritical side conditions that usually infest axiom schema and proof rule schema implementations, especially for the more involved binding structures of program logics. The beneficial impact of uniform substitutions on provers made it possible to reduce the size of the soundnesscritical core of the differential dynamic logic prover [3] down to 2% compared to the previous prover [8] and formally verify in Isabelle and Coq [1].
This paper generalizes uniform substitution to the significantly more expressive differential game logic for hybrid games [5]. The modular structure of the soundness argument for is sufficiently robust to work for : i) prove correctness of the static semantics, ii) relate syntactic effect of uniform substitution to semantic effect of its adjoint interpretation, iii) conclude soundness of rule US, and iv) separately establish soundness of each axiom. The biggest challenge is that hybrid game semantics cannot use state reachability, so correctness notions and their uses for the static semantics need to be phrased as functions of winning condition projections. The interaction of game operators with repetitions causes transfinite fixpoints instead of the arbitrary finite iterations in hybrid systems. Relative completeness follows from previous results, but exploits the new game symbols to simplify the proof. After new soundness justifications, the resulting uniform substitution mechanism and axioms for end up close to those for hybrid systems [6] (apart from the ones that are unsound for hybrid games [5]). The modularity caused by uniform substitutions explains why it was possible to generalize the prover kernel from hybrid systems to hybrid games with about 10 lines of code.^{1}^{1}1The addition of games to the previous prover was more complex [9], with an implementation effort measured in months not minutes. Unfortunately, this is not quite comparable, because both provers implement markedly different flavors of games for hybrid systems. The game logic for [9] was specifically tuned as an exterior extension to be more easily implementable than in . All proofs are inline.
2 Preliminaries: Differential Game Logic
This section reviews differential game logic (), a specification and verification logic for hybrid games [5, 7]. Hybrid games support the discrete, continuous, and adversarial dynamics of twoplayer games in hybrid systems between players Angel and Demon. Compared to previous work [5], the logic is augmented to form (differentialform) differential game logic with differentials and function symbols [6] and with game symbols that can be substituted with hybrid games.
2.1 Syntax
Differential game logic has three syntactic categories. Its terms are polynomial terms, function symbols interpreted over , and differential terms . Its hybrid games describe the permitted player actions during the game in program notation. Its formulas include firstorder logic of real arithmetic and, for each hybrid game , a modal formula , which expresses that player Angel has a winning strategy in the hybrid game to reach the region satisfying formula . In the formula , the formula describes Angel’s objective while the hybrid game describes the moves permitted for the two players, respectively.
The set of all variables is . Variables of the form for a variable are called differential variables, which are just independent variables associated to variable . For any subset is the set of differential variables for the variables in . The set of all variables is assumed to contain all its differential variables (although are not usually used).
Definition 1 (Terms).
Terms are defined by this grammar (with as terms, as variable, and as function symbol of arity ):
As in [6], differentials of terms are exploited for the purpose of axiomatically internalizing reasoning about differential equations. The differential describes how the value of changes locally depending on how the values of its variables change, i.e., as a function of the values of the corresponding differential variables . Differentials reduce reasoning about differential equations to reasoning about equations of differentials [6] with their singlestate semantics.
Definition 2 (Hybrid games).
The hybrid games of differential game logic are defined by the following grammar (with as hybrid games, as game symbol, as variable, as term, and as formula):
Atomic games are the following. Game symbols are uninterpreted. The discrete assignment game evaluates term and assigns it to variable . The continuous evolution game allows Angel to follow differential equation x=θ for any real duration during which the evolution domain constraint is true ( stands for ). If is not true in the current state, then no solution exists and Angel loses the game. Test game has no effect except that Angel loses the game prematurely unless is true in the current state.
Compound games are the following. The game of choice allows Angel to choose whether she wants to play game or, instead, play game . The sequential game first plays and then plays (unless a player lost prematurely during ). The repeated game allows Angel to decide how often to repeat game by inspecting the state reached after the respective game to decide whether she wants to play another round. The dual game makes the players switch sides: all of Angel’s decisions are now Demon’s and all of Demon’s decisions are now Angel’s. Where Angel would have lost prematurely in (for failing a test or evolution domain) now Demon does in , and vice versa. This makes game play interactive but semantically quite rich [5]. All other operations are definable, e.g., the game where Demon chooses between and as .
Definition 3 (formulas).
The formulas of differential game logic are defined by the following grammar (with as formulas, as predicate symbol of arity , as terms, as variable, and as hybrid game):
The box modality in formula describes that the player Demon has a winning strategy to achieve in hybrid game . But satisfies the determinacy duality [5, Theorem 3.1], which we now take as its definition to simplify matters. Other operators are definable as usual, e.g., as . The following formula, for example, expresses that Angel has a winning strategy to follow the differential equation to a state where even after Demon chooses or first: .
2.2 Semantics
While the syntax of is close to that of (with the only change being the addition of the duality operator ), its semantics is significantly more involved, because it needs to recursively support interactive game play, instead of mere reachability. Variables may have different values in different states of the game. A state is a mapping from the set of all variables to the reals . Also, is the state that agrees with state except for variable whose value is . The set of all states is denoted . The set of all subsets of is denoted .
The semantics of function, predicate, and game symbols is independent from the state.
They are interpreted by an interpretation that maps
each arity function symbol to a ary smooth function ,
and each arity predicate symbol to a ary relation .
The semantics of differential game logic in interpretation defines, for each formula , the set of all states , in which is true.
Since hybrid games appear in formulas and vice versa, the semantics of hybrid game in interpretation is defined by simultaneous induction (def:HGsemantics) as the set of all states from which Angel has a winning strategy in hybrid game to achieve .
The real value of term in state for interpretation is denoted and defined as usual.^{2}^{2}2Even if not critical here, differentials have a differentialform semantics [6] as the sum of all partial derivatives by multiplied by the corresponding values of :
An interpretation maps each game symbol to a function , where are the states from which Angel has a winning strategy to achieve .
Definition 4 (semantics).
The semantics of a formula for each interpretation with a corresponding set of states is the subset [const=I,state=ω]ϕ⊆Σ of states in which is true. It is defined inductively as follows



is the complement of



A formula is valid in , written [const][const=I,state=ω]⊧ϕ, iff it is true in all states, i.e., [const=I,state=ω]ϕ=Σ. Formula is valid, written ϕ, iff [const][const=I,state=ω]⊧ϕ for all interpretations .
Definition 5 (Semantics of hybrid games).
The semantics of a hybrid game for each interpretation is a function [α][const=I,state=ω](⋅) that, for each set of Angel’s winning states X⊆Σ, gives the winning region, i.e., the set of states [α][const=I,state=ω](X) ⊆Σ from which Angel has a winning strategy to achieve in (whatever strategy Demon chooses). It is defined inductively as follows



on and for some function [flow][const=I,flow=φ]:[0,r]→Σ of some duration satisfying [const=I,flow=φ]x=θ∧ψ
where [const=I,flow=φ]x=θ∧ψ iff and on for all and exists and equals for all if r¿0. 




The semantics is the set of all states from which there is a solution of the differential equation of some duration that reaches a state in without ever leaving the set of all states where evolution domain constraint is true. The initial value of in state is ignored for that solution. It is crucial that gives a least fixpoint semantics to repetition [5].
Lemma 1 (Monotonicity [5, Lem. 2.7]).
The semantics is monotone, i.e., [α][const=I,state=ω](X)⊆[α][const=I,state=ω](Y) for all .
3 Static Semantics
The central bridge between a logic and its uniform substitutions is the definition of its static semantics via its free and bound variables. The static semantics captures static variable relationships that are more tractable than the full nuances of the dynamic semantics. It will be used in crucial ways to ensure that no variable is introduced free into a context within which it is bound during the uniform substitution application. It is imperative for the soundness of uniform substitution that the static semantics be sound, so expressions only depend on their free variables and only their bound variables change during hybrid games.
The most tricky part for the soundness justification for is that the semantics of hybrid games is not a reachability relation, such that the usual semantic characterizations of free and bound variables from programs do not work for hybrid games. Hybrid games have a more involved winning region semantics.
The first step is to define upward projections that increase the winning region from the variables to all states that are “on like ”, i.e., similar on to states in (and arbitrary on complement ). The downward projection shrinks the winning region and selects the values of state on variables to keep just those states of that agree with on .
Definition 6.
The set extends to the states that agree on with some state in (written ). The set selects state on in .
Remark 1.
It is easy to check these properties of up and down projections:

Composition:

Antimonotone: for all

(unless ) and , where is the set of all variables

Composition:

Antimonotone: for all

and . Thus, for any iff .

are all states in that agree on with a state in , which, in turn, are all states that agree on with a state in . That is, are all states that agree on with some state that agrees on with a state in , which is the set of states that agree on with a state in .

implies for some . By case:restrictcompose, by def:projections.

First note for all . If , then , because equality on imposes no conditions on the state . , because agreement on all variables implies .

are all states that agree on with and are in the set . That is, are all states in that agree on and on with , which is the set .

implies for some . By case:selectcompose, by def:projections.

since agreement on imposes no conditions on . Furthermore, since agreement on all variables imposes the condition , which is in iff .
Projections make it possible to define (semantic!) free and bound variables of hybrid games by expressing suitable variable dependence and ignorance. Variable is free iff two states that only differ in the value of have different membership in the winning region for hybrid game for some winning region that is insensitive to the value of . Variable is bound iff it is in the winning region for hybrid game for some winning condition but not for the winning condition that limits the new value of to stay at its initial value .
Definition 7 (Static semantics).
The static semantics defines the free variables, which are all variables that the value of an expression depends on, as well as bound variables, , which can change their value during game , as:
The signature, i.e., set of function, predicate, and game symbols in is denoted ; accordingly for term and for hybrid game .
The static semantics from def:staticsemantics satisfies the coincidence property (the value of an expression only depends on the values of its free variables) and bound effect property (a hybrid game only changes the values of its bound variables).
Lemma 2 (Coincidence for terms).
is the smallest set with the coincidence property for : If on and on then [const=I,state=ω]θ=[const=J,state=~ω]θ.
By [6, Lem. 10], as semantics and free variables of terms are as in .
Lemma 3 (Coincidence for formulas).
is the smallest set with the coincidence property for : If on and on , then [const=I,state=ω]ϕ iff [const=J,state=~ω]ϕ.
The semantics of formulas and their semantic free variables is analogous to , so [6, Lem. 11] transfers, because its proof is by induction on the set of free variables independently of the particular syntactic structure of the formula and, thus, the proof is not affected by the modified meaning of modalities.
From which states a hybrid game can be won only depends on , the winning region, and the values of its free variables, as is only sensitive to .
Lemma 4 (Coincidence for games).
The set is the smallest set with the coincidence property for : If on