A one-pass tree-shaped tableau for defeasible LT L 1

10 Defeasible Linear Temporal Logic is a defeasible temporal formalism for representing and verifying 11 exception-tolerant systems. It is based on Linear Temporal Logic (LTL) and builds on the preferential 12 approach of Kraus et al. for non-monotonic reasoning, which allows us to formalize and reason with 13 exceptions. In this paper, we tackle the satisfiability checking problem for defeasible LTL. One of the 14 methods for satisfiability checking in LTL is the one-pass tree shaped analytic tableau proposed by 15 Reynolds. We adapt his tableau to defeasible LTL by integrating the preferential semantics to the 16 method. The novelty of this work is in showing how the preferential semantics works in a tableau 17 method for defeasible linear temporal logic. We introduce a sound and complete tableau method for 18 a fragment that can serve as the basis for further exploring tableau methods for this logic. 19


Introduction
Linear temporal logic (LT L) was introduced by Pnueli [13] as a formal tool for reasoning about programs execution.Many properties that an execution should have can be expressed elegantly using this formalism.The logic LT L is used for systems verification [16].With advances in technologies, systems became more and more complex, displaying new features and behaviours.One of these behaviours is tolerating exceptions.In more general terms, if an error occurs, within an execution of a program, at certain points of time where it is tolerated, the program can still function properly.
Let us say, for the sake of argument, that there is an execution of a program in which a parameter cannot have a certain value.We notice that, at some given points of time, the execution produces the invalid value in the aforementioned parameter.Nevertheless, we do not mind that the program produces the error at these time points deemed to be harmless.
The crucial point is that this behaviour is not present in other, more important, points of time.We want to be sure that the execution still continues and the program functions properly even in the presence of such benign time points.
We want a formalism for verifying properties of executions that can, on one hand, be strictly required at some points of time, and on the other hand, be missing in other points of time.That is why we introduced an extended formalism of LT L, called defeasible linear temporal logic (LT L˜) [6].It uses the preferential approach of Kraus et al. to non-monotonic reasoning [11] (a.k.a. the KLM approach).The defeasible aspect of LT L44

23:2
adds a new dimension to the verification of a program's execution.We can order time points from the important ones, which we call normal, to the lesser and lesser ones.Normality in LT L indicates the importance of a time point within an execution compared to others.
We also introduced defeasible versions of the modalities always and eventually.With these defeasible modalities, we can express properties similar to their classical counterparts, targeting the most normal time points within the execution.
The main goal of this paper is to establish a satisfiability checking method for our logic, in particular, for a fragment thereof.In the case of LT L, many tableau methods were proposed in the literature.There are two types of tableau methods: multi-pass and one-pass tableaux.
Multi-pass tableau methods [22,12,10] go through an initial phase of building a tree-shaped structure by putting the sentence in the root node and expanding the tableau via a systematic application of a set of rules.The second phase is a culling phase, which uses an auxiliary structure built from the tableau, and checks for the satisfiability of the input sentence in this structure.Whereas in one-pass tableau methods [17,14], the construction and the verification are done simultaneously.Reynolds' tableau for LT L [15,14] is a tree-shaped one-pass tableau where each branch is independent from the others.Moreover, each successful branch by itself is a representation of an interpretation that satisfies the sentence.
As for the KLM approach, tableau methods were developed for the preferential approach of Kraus et al. logic [11] and formalisms extending the preferential approach [9,4,5].In the case of preferential modal logic, Britz and Varzinczak [4] proposed a tree-shaped tableau that builds the ordering relation on worlds at the same time as the tableau is expanded.The tableau method in this paper is based on both the one-pass tableau of Reynolds [14] and the tableau for preferential modal logic by Britz and Varzinczak [4].The novelty of this paper is in showing how preferential semantics works in a tableau for a fragment of LT L˜.
The plan of this paper goes the following way: We talk briefly about LT L and LT L˜in Section 2. We then describe a tableau method for a fragment of LT L˜in Section 3. We show soundness, and completeness of our method in Section 4. Section 5 concludes the paper.

Preliminaries
Linear Temporal Logic [1] is a modal logic in which modalities are considered to be temporal operators that describe events happening in different time points over a linearly ordered timeline.Let P be a finite set of propositional atoms.The set of operators in LT L can be split into two parts: the set of Boolean connectives (¬, ∧, ∨), and that of temporal operators (□, ♢, ⃝), where □ reads as always, ♢ as eventually, and ⃝ as next.Let p ∈ P, sentences in LT L are built up according to the following grammar: Standard abbreviations are included in LT L, such as: There are other temporal operators such as U (until operator) and R (release operator) in LT L, but we chose to omit them in this paper.
The temporal semantics structure is a chronological linear succession of time points.
We use the set of natural numbers in order to label each of these time points i.e., (N, <).
Hence, a temporal interpretation associates each time point t with a truth assignment of all propositional atoms.A temporal interpretation is defined as follows: ▶ Definition 1 (Temporal interpretation).A temporal interpretation I is a mapping function corresponding to the set of propositions that are true in t. (Propositions not belonging to V (t) are assumed to be false at the given time point.)

23:3
The truth value of a sentence in an interpretation I at a time point t ∈ N, denoted by I, t |= α, is recursively defined as follows: In previous work [6], we introduced a new formalism called preferential linear temporal logic.The motivation is to provide a formalism for the specification and verification of systems where exceptions can be tolerated.
Let p ∈ P, sentences of the logic LT L˜are built up according to the following grammar: The intuition behind the new temporal operators is the following: □ ∼ reads as nonmonotonic always and ♢ ∼ reads as non-monotonic eventually.The set of all well-formed LT L˜sentences is denoted by L˜.It is worth to mention that any well-formed sentence α in LT L is a sentence of L˜.
A sentence such as □ ∼α reads as: in all normal future time points, α is true.A sentence of the form ♢ ∼α reads as: in some normal future time point, α is true.We can even express properties using a mix of classical and non-monotonic operators.A sentence □♢ ∼α reads as: always, there is a normal future time point where α is true.
The preferential component of the interpretation of our language is directly inspired by the preferential semantics proposed by Shoham [19] and used in the KLM approach [11].
▶ Definition 3 (Well-founded set).Let ⋎ be a strict partial order on a set N. We say N is well-founded w.r.t.
In what follows, given a relation ⋎ and a time point t ∈ N, the set of preferred time points ▶ Definition 4 (Preferential temporal interpretation).An LT L ˜interpretation on a set of propositional atoms P, also called preferential temporal interpretation on P, is a pair

A one-pass tableau for LT L
In this paper, we address the computational task of satisfiability checking in LT L˜.That is, given a sentence α in LT L˜, decide whether or not there is an interpretation I that satisfies the sentence α.As mentioned in the Introduction, we propose a one-pass tree-shaped tableau for a fragment of LT L˜based on Reynolds' tableau [15] and inspired by the semantic rules for defeasible modalities in modal logic proposed by Britz and Varzinczak [4].This fragment, denoted by L 1 , serves as a starting point for showing how the ordering ⋎ is built for preferential interpretations in LT L˜.

The fragment L 1
The fragment L 1 considers that sentences are in NNF (negation is only allowed on the level of atomic propositions).On the other hand, the non-monotonic operator □ ∼ is omitted from L 1 .Furthermore, only Boolean sentences are permitted within the scope of □ sentences.
In what follows, we define formally well formed sentences of L 1 .In order to do that, we introduce first the set of Boolean sentences L bool .Let p ∈ P, sentences α bool ∈ L bool are defined recursively as such: Next, let α bool ∈ L bool , sentences in L 1 are recursively defined as such: Sentences of the form ♢α are called eventualities, because its truth depends on α being true in the future.Similarly, sentences of the form ♢ ∼α are called non-monotonic eventualities.
Their truth depends not only on α being true in some future, but it depends also on this future being preferred to the other future time points.Sentences of the form ⃝♢α are called ⃝-eventuality.

Tableau method for L 1
A tableau for α ∈ L 1 is a tree of nodes.Each node has a positive integer n as a label.It has also two sets of sentences: one we denote as Γ and the other as une (which stands for unfulfilled non-monotonic eventualities, a notion to be detailed below).The set Γ is a subset of L 1 which contains the sentences in the node.The set une is a set of pairs (n k , ♢ ∼α k ), where n k is a label and ♢ ∼α k is a non-monotonic eventuality.
▶ Definition 5 (Labelled node).A labelled node is a triple of the form n : (Γ, une) where It is worth to mention that different nodes can have the same label.Intuitively, the nodes labelled by a same integer n represent the set of sentences that are satisfied at the time point associated with n.Hence, these nodes correspond with a given temporal state.
A branch B is a sequence of nodes, we introduce also a strict partial ordering relation x m comes after x n in the sequence, then x m is a successor of x n , and x n is a predecessor of x m .We denote it by x n ≤ x m .Moreover, if x m is not the same labelled node as x n , we say that x m is a proper successor of x n (same goes for a proper predecessor).We denote it by The last node of a branch is called a leaf node.When a leaf node is ticked with ✓, we say that the branch is a successful branch.On the other hand, when a leaf node is crossed with ✗, we say that the branch is a failed branch.
A tree is a set of branches where k ≥ 0. A tableau T for α is the limit of a sequence of trees ⟨T 0 , T 1 , T 2 , . . .⟩ where the initial tree is T 0 := {(⟨0 : (α, ∅)⟩, ∅, ∅)} and every T i+1 is obtained from T i by applying a rule on one of its branches.
We say that a tableau T for α is saturated if no more rules can be applied after a tree T .
We have two types of rules, static and dynamic rules.We introduce static rules first.Let T be a tree, and let B be a branch of T that has a leaf n : (Γ, une).We say that a static rule (ρ) is applicable at the leaf n : (Γ, une) if a sentence in Γ or a pair in une instantiates the pattern ρ.A static rule is a rule of the form: In a tree T i , after applying the static rule (ρ), we obtain the tree T i+1 by repla- In what follows, we show the rules for Boolean and the operators (□, ♢).We also show two stopping conditions, namely, Empty and Contradiction.We chose to omit ⋎ B and min B to lighten these rules.The crucial detail to remember is that they do not change after applying the rules below, i.e., ⋎ Bi = ⋎ B and min Bi = min B for all resulting branches.The symbol ∪ is the union of two sets.The symbol ⊎ represents the union between disjoint sets.
Before introducing the rule for the non-monotonic operator ♢ ∼, we discuss firsthand the notion of fulfillment for classical and non-monotonic eventualities.Following Reynolds' tableau, let an eventuality ♢α be in a node with a label n.If the sentence α appears in a C V I T 2 0 1 6

23:6
proper successor node x with the label m ≥ n, we say that ♢β at the position n is fulfilled in m.In a similar fashion, we define the fulfillment for non-monotonic eventualities as follows: ▶ Definition 7 (Fulfillment of non-monotonic eventualities).Let a non-monotonic eventuality For the rule (♢ ∼), we explore two outcomes.The first outcome is when the non-monotonic eventuality ♢ ∼α 1 at n is fulfilled in n.We then add α 1 to the set of sentences Γ of the leaf node and add (n, n) ∈ min of the branch.The second outcome is when ♢ ∼α 1 is not fulfilled in n, then we add the pair to (n, ♢ ∼α 1 ) to une of the leaf node as a non-monotonic eventuality that needs to be fulfilled.Example 8 shows the application of [♢ ∼] rule.
After applying (♢ ∼) rule on ♢ ∼r, we have two new branches B 1 and B 2 .The branch B 1 has a leaf node where the sentence r is in Γ of the leaf node and (5, 5) ∈ min B1 .The branch B 2 has (5, ♢ ∼r) in une of the leaf node.
5 : ({p, q, □(p ∧ q), ♢ ∼r}, ∅), The next static rule we discuss is the rule (une).Let n, n ′ be two labels such that n ′ < n, for each label n and a pair (n ′ , ♢ ∼α 1 ), the rule (une) is applied one and only one time.The rule goes as follows: For the rule (une), we explore three outcomes.The first outcome is when ♢ ∼α 1 at the position n ′ is fulfilled at n.We remove (n ′ , ♢ ∼α 1 ) from une, then we add α in Γ of the leaf node and (n ′ , n) in min of the branch.In the second and third branches, we explore the outcome of ♢ After the application of une on (2, ♢ ∼s), we have three branches B 1 , B 2 and B 3 .B 1 has the sentence s in Γ of its leaf node, it has also (2,5) in min B1 .B 2 keeps (2, ♢ ∼s) in the une of its leaf node, with (2, 5) ∈ min B2 .B 3 keeps also (2, ♢ ∼s) in une of its leaf node, with (2, 5) ∈ ⋎ B3 .
5 :  In a branch B of a tree T with a leaf node x i , after applying every static rule aforementioned (the order of application these rules is non-deterministic) that can be applied, all leaf nodes of the generated branches contain only sentences of the form p, ¬p or ⃝α in their Γ.
When no more static rules can be applied in a node, this node is called a state-labelled node.
State-labelled nodes mark the full expansion of all sentences that hold in a state n.
Once we are in a state-labelled node, in order to go from a temporal state to the next, we need a transition rule (a rule to go from a temporal state n to the next n + 1).In a branch B with a leaf state-labelled node, the rule transition goes the following way: (Transition) n : ({⃝α1, ⃝α Notice that once an eventuality is fulfilled, it does not appear any longer in the successors of the node.In this case, we say that the sentence is consumed.On the other hand, sentences of the form □α bool never get consumed and get replicated indefinitely.Once a branch has no eventuality left, □α bool sentences give rise to an infinite tableau with repetitive nodes. Nevertheless, we can represent this by looping nodes of the last temporal state.We can, in this case, stop the branch from ever going infinite.The loop rule states that when the leaf state node v has no eventualities (classical or non-monotonic), has only ⃝□α bool as sentences with the pattern ⃝, and each ⃝□α bool is a result from applying the □ rule to a node in B with label n, the branch is ticked and marked as a successful branch.
[Prune] Let u < v be two consecutive state-labelled nodes s.t.Γ v = Γ u and une v = une u and that there is at least one eventuality in x u (either ⃝♢β ∈ Γ u or (n ′ , ♢ ∼β) ∈ une u ), then the branch is crossed (✗).
The prune rule states that when the last two state nodes u and v have the same set of classical and non-monotonic eventualities that need to be fulfilled, and there is at least one eventuality in u, the branch is then crossed and marked as an unsuccessful branch.Any branch that does not fulfill at least one eventuality between the current and the last temporal state is closed, to prioritize the exploration of branches that fulfill one or more eventuality of the last temporal state.If neither prune or loop apply on v, we apply the transition rule on the node v.Note that the loop and prune rules are fundamentally different from the ones proposed in Reynolds' tableau [14].These rules are tailored to the restrictions of the fragment L 1 , in particular, the restriction of not allowing temporal sentences inside the □ operator.We argue in this paper that when eventualities (either classical or non-monotonic) are not infinitely replicated inside globally operators, we only need to check the current state node with the last one that comes beforehand.It is the reason why we also omit also the operator U, since the right part of a U-sentence can also replicate eventualities.
Once we are in a state-labelled node, we check for the loop and prune within the branch before applying the transition rule.If the transition rule is applied on a state node with a label n, we obtain a new node with the label n + 1.We can then expand the tree from this node by applying static rules until we find ticked branches (thanks to the empty rule), closed branches (thanks to the contradiction or ⋎ -inconsistency rules), or branches with a state node that has the label n + 1.We then repeat the cycle between static and dynamic rules.
We can see that the tableau method does not go indefinitely.Thanks to prune rule, we close any branch (✗) that does not fulfill any eventuality in the current temporal state.Anytime we apply a transition rule (from n to n + 1), we need to fulfill at least one eventuality in n.
Therefore, as long as a branch is not closed with prune rule, eventuality sentences (either classical or non-monotonic) get consumed one by one over the execution of the method.Thus any branch that is not closed with prune has no eventualities left to fulfill.Note that if a branch contains at least one sentence of the form □α bool , it is then ticked thanks to the loop rule (□α bool sentences do not get consumed).Otherwise, it is ticked thanks to the empty rule.Therefore any tableau T for a sentence in L 1 is a saturated tableau.

Soundness
Here we prove that the tableau method is sound, that is, when a tableau T of a sentence α ∈ L 1 has a successful branch, then α is satisfiable.As a first step, we show that we can extract an interpretation I ∈ I from the successful branch.Let B := (⟨x 0 , x 1 , x 2 , . . ., x n , (✓)⟩, ⋎ B , min B ) be a successful branch of a tableau T for α, the sequence of nodes contains normal and state-labelled nodes.Each state-labelled node, denoted by x ji , within this sequence has a distinct label i. Figure 1 shows an example of the branch B.
From the aforementioned branch B, we can build an interpretation I B = (V, ⋎ ).In this section, k denotes the label of the last state node.The function V is defined as follows: The ordering relation ⋎ is defined as follows With the model construction introduced, we can move on to the second part of the proof of soundness.We need to show that the model I satisfies the sentence α.In order to do so, we introduce a mapping function, denoted by ∆ B , that links each time point i ∈ N to a set of sentences that are true in said i.These sentences come from the branch B. Depending on how the branch is ticked, the function ∆ B is defined in the following way.
If the branch was ticked with the empty rule: {}, otherwise.
C V I T 2 0 1 6

23:10
If the branch was ticked with the loop rule: For a time point 0 Proof.Let B be a ticked branch of the tableau, k be the label of the last state node and i ∈ N. We discuss two possibilities: When the branch B is ticked with empty rule, whenever ♢ ∼α 1 ∈ ∆ B (i), then we have and (i, d) ∈ min B .Since the branch is closed thanks to the empty rule, it means that When the branch B is ticked with loop rule, the proof is analogous to the case of the empty rule (notice that we also have (i, ♢ ∼α 1 ) ̸ ∈ une xj k ).
Proof.We prove this lemma using structural induction on the size of the sentence α.Let B be a successful branch for a tableau T , and By construction of the model I B , we have p ∈ V (i).Therefore, Since B is a ticked branch, then it was not closed with the contradiction rule, therefore we have p ̸ ∈ V (i).Therefore, we have , by induction hypothesis on α 1 , we have I B , i |= α 1 .Therefore, we have Thanks to Lemma 11, we have α 1 ∈ ∆ B (i + 1).By induction hypothesis on α 1 , we have By induction hypothesis on α 1 , we have I B , f |= α 1 for all f ≥ i.Therefore, we have By induction hypothesis on α 1 , we have Depending on where i is, we have two cases: since the branch is ticked with loop rule, we know that (i, ♢ ∼α 1 ) ̸ ∈ une xj k .Therefore , and there is no

Completeness
We conclude this paper by proving the completeness of the tableau method for sentences in L 1 i.e., if a sentence α is satisfiable, then any tableau for α has a successful branch, no matter the order of applying the rules.We use a model I for α to find a ticked node.
▶ Theorem 17.Let α ∈ L 1 be a satisfiable sentence of LT L ˜. Then any tableau for α has a successful branch.
The idea behind this proof is to have an intermediate sequence s that serves as a link between an interpretation I that satisfies the sentence α and a tableau T for α.The sequence s is a tuple s := (⟨x 0 , x We link each node of the sequence x i to a time point J(x i ) of the interpretation I and a labelled node f (x i ) of the tableau T .Depending on I, we can build the sequence s using the tableau, we then show the sequence s ends up with a tick (✓).We make sure that for each node x i with the index time point J(x i ) of the sequence, we have the following invariant: For each α ∈ Γ xi , we have I, J(x i ) |= α; For each (J 1 , ♢ ∼α 1 ) ∈ une xi , there exists J 2 ≥ J(x i ) where J 2 ∈ min ⋎ (J 1 ) and I, J 2 |= α 1 ; For each (J 1 , J 2 ) ∈ min s , we have J 2 ∈ min ⋎ (J 1 ); For each (J 1 , J 2 ) ∈ ⋎ s , there exists We start by putting the root node 0 : ({α}, ∅) with the index time point J(x 0 ) := 0 at the start of the sequence.For the first node x 0 with the index time point 0 (since there is no rule applied before the root node, the sets min s and ⋎ s are empty at the start), we have I, 0 |= α.
Therefore the invariant Inv(x 0 , 0) holds.Suppose that the invariant holds up to x i , and a rule was applied to x i , we then add a new node x i+1 to the sequence depending on which outcome of the rule represents the interpretation I.We then move to the outcome node in the tableau, and see which rule is applied to it, and so on and so forth.Each time we add a new node x i+1 to the sequence s, we need to make sure that the invariant Inv(x i+1 , J(x i+1 )) holds.In general, the sequence will head from the parent node to a child node but it might occasionally jump backwards (only in the case of the parent being a prune node, more on that later).It is worth to point out that since we might be jumping back and forth between nodes of T , each time we are add a new node x i+1 to the sequence s, we are going to rename labels within the sets une x , ⋎ B and min B by their respective indexed time points J.The function f links each node x i of the sequence s to a labelled node f (x i ) of the tableau T .
It is worth to mention that, since we are only renaming labels of other sets, then we have In Appendix B, we discuss the case of each rule that is applied to x i .

Conclusion
We introduced the basis for a tableau method for LT L˜.We showed how preferential semantics work in a one-pass tree-shaped tableau.We also established semantic rules for the ♢ ∼ operator.We showed how to handle non-monotonic eventualities using une, ⋎ B and min B .
In the end, we proved that our method is sound and complete.The loop/prune checkers proposed in this paper are specific to L 1 , and work well under these restrictions.
With the foundation laid in this work, the next step is to establish semantic rules for the □ ∼ operator.The next fragment of LT L˜that we are investigating is the sub-language that allows only Boolean sentences within □ and □ ∼.We conjecture that the satisfiability of this fragment is decidable and has an upper bound model property similar to one that we published in [6].
Case 2: when J ′ > J(x i ), we have two possibilities: Case 2.1: If J(x i ) ∈ min ⋎ (J(x)), then we define the next node x i+1 with Γ xi+1 = Γ z , une xi+1 = une xi and add (J(x), J(x i )) to min s .We have (J(x), J(x i )) ∈ min s with [Transition]: Suppose that the transition rule is applied on the state node f (x i ).Let y be the child node of the node x i in the branch.We have Γ y = {α 1 | ⃝α 1 ∈ Γ f (xi) } and une y = une f (xi) .We define the next node x i+1 in s with Γ xi+1 = Γ y and une xi+1 = une xi .
Since we have Inv(x i , J(x i )), then for all Let J 1 be the time point corresponding to the node f (x 1 ) with the label n 1 , and let J 2 be the time point corresponding to the node f (x 2 ) with the label n 2 .It is worth to mention that J 1 ≤ J 2 ≤ J(x i ).Since x, x ′ are predecessors of x, we have Inv(x, J(x)), Inv(x ′ , J(x ′ )) and Inv(x i , J(x i )).Therefore, we the rules are applied on x and x ′ , we end up with (J 1 , J(x i )) ∈ min s and (J 2 , J(x i )) ∈ ⋎ s .Since (J 1 , J(x i )) ∈ min s , then we have ).On the other hand, since (J 2 , J(x i )) ∈ ⋎ s , then there exists J 3 ≥ J 2 s.t.(J 3 , J(x i )) ∈ ⋎ .Moreover, we have J 1 ≤ J 2 , this entails that there exists J 3 ≥ J 1 s.t.
(J 3 , J(x i )) ∈ ⋎ .This contradicts Definition 4 of minimality w.r.t. to the relation ⋎ .Therefore this cannot happen in a interpretation I ∈ I.
[Prune]: Let f (x i ) be a state node where the prune condition is met.There is a sequence within s that goes the following way, x h = u, x h+1 , x h+2 , . . ., v = x i .The node u or x h is C V I T 2 0 1 6

23:18
the state node that comes before x i and the node v is the current state node.Since v is a prune node, we have Γ v = Γ u and une u = une v .We can see that if we apply the transition rule to the node x i , we will have Γ xi+1 = Γ x h+1 and une xi+1 = une x h+1 .Therefore, we can proceed with the construction of s as if x i was linked to f (u) instead of f (v).Thanks to the transition, since we have Inv(x u , J(x u )), then we have Inv(x i+1 , J(x i ) + 1).
Each time we find a pair (u, v) in the sequence s, we call it a jump.These jumps may occur once or many times (and it may go infinite) in s.In a sequence s, if a pair (u, v) jumps repeatedly in succession, we call the pair a recurring jump.It is worth to point out that, each time we jump backwards because of a node closed with prune, we return to the state labelled node that comes before.In general, the sequence s explores one branch B of T , and it deviates sometime to a prune node and goes back to B. Furthermore, since no eventuality is fulfilled within a prune loop, eventualities and their fulfillment are in the same branch B.
What we showed so far is that for an interpretation I and its corresponding sequence s, we have Inv(x i , J(x i )) for each i ≥ 0. Going back to the start of the proof, we need to prove that the sequence finishes with a ticked node (such is the case when we end up in [loop] or [empty] node).We can see that if the sequence s is on a [prune] node, we jump back to the state node that comes before it.Theoretically, this jump can recur infinitely many times.
This means that sequence goes infinite on this case (and never find a ticked node).We need to prove that this case cannot happen in the sequence s of I. Suppose that is the case, that means the last jump (u k , v k ) in the sequence s is a recurring jump that goes infinitely many times.The jumps (u j , v j ) that come before may recur many times but not infinitely many times (otherwise, (u k , v k ) would not be the last jump).In the recurring jump (u k , v k ), no eventuality is fulfilled (whether it is classical or non-monotonic).This entails that when we are in a parent node u k < x l < v k that applies either [♢] or [une] rule, we move to the child node that delays the propagation of the eventuality (we are in Case 2 for both rules).
It is worth to point out that we have at least one eventuality in u k .Let us take ⃝♢α 1 ∈ Γ u k for example, since we have Inv(u k , J(u k )), that means that I, J(u k ) |= ⃝♢α 1 .Thus, we take the first time point J α1 > J(u k ) s.t.I, J α1 |= α 1 .We also have I, J α1 |= ♢α 1 .On the other hand, for all J(u k ) < J < J α1 , we have I, J |= ♢α 1 I, J |= ⃝♢α 1 .In other words, each time we encounter ♢α 1 ∈ Γ x l−1 within our jumps (keep in mind we have Inv(x l−1 , J)), we pick the node in Case 2 of the [♢] rule i.e., ⃝♢α 1 ∈ Γ x l .However, in the node indexed with J α1 , when we encounter ♢α 1 ∈ Γ x l ′ −1 (keep in mind we have Inv(x l ′ −1 , J α1 )), we pick the node in Case 1 of the [♢] rule i.e., α 1 ∈ Γ x ′ l .This raises a contradiction, because the node x l ′ is not present within the jump (u k , v k ).Thus breaking the infinite recurring jump (u k , v k ).
We proved that since I, 0 |= α, then the corresponding sequence s cannot finish on a contradiction, ⋎ -inconsistency or a prune jump.Therefore it must finish with a ticked node.

11 ◀▶ Theorem 16 .
Let B be a ticked branch from a saturated tableau, andI B = (V, ⋎) be the model built from the branch B. For all α ∈ L 1 , for all and therefore, I B , i |= ♢ ∼α 1 .0 ≤ i ≤ k.Thanks to Lemma 15, there exists d ≥ i s.t.α 1 ∈ ∆ B (d) and (i, d) ∈ min B .By induction hypothesis on α 1 , we have I B , d |= α 1 .Thanks to Proposition 14, there is no i ≤ f ≤ k where (f, d) ∈ ⋎ B and therefore there is no i ≤ f ≤ k where (f, d) ∈ ⋎ .Furthermore, by the construction of the model I B , there is no f ≥ k where (f, d) ∈ ⋎ .Therefore, we have d ∈ min ⋎ (i).Thus, we have I B , i |= ♢ ∼α 1 .◀ Let α ∈ L 1 , B be a ticked branch from a saturated tableau for α, I B = (V, ⋎ ) be a model built from B. Since we have α ∈ ∆ B (0), then we have I B , 0 |= α.

I T 2 0 1 6 23:4
We say α ∈ L ˜is satisfiable if there is a preferential temporal interpretation I and a time point t in N such that I, t |= α.We can show that α ∈ L ˜is satisfiable iff there is a preferential temporal interpretation I s.t.I, 0 |= α.
I, t |= □ ∼α if I, t ′ |= α for all t ′ ∈ min ⋎ (t); I, t |= ♢ ∼α if I, t ′ |= α for some t ′ ∈ min ⋎ (t).C V the labels of the nodes within the branch.The branch B has also a set of pairs of labels denoted by min B .The relation ⋎ B represents a preference relation on the temporal states of the branch B. On the other hand, the set min B represents some constraints that the final preference relation issued from B must satisfy.More precisely, each pair (n, n ′ ) in min B indicates that n ′ represents a preferred temporal state compared to all n ′′ ≥ n.
▶ Definition 6 (Branch).A branch is a tuple B def = (⟨x 0 , x 1 , x 2 , . . .⟩, ⋎ B , min B ) where the first element is a sequence of labelled nodes x i := n i : (Γ i , une i ), ⋎ B is a strict partial order ( ⋎ B ⊆ N×N) on labels within the branch, and min B is a set of pairs of labels (min B ⊆ N×N).
The truth value ♢ ∼α in a temporal state n depends on α being true on a future temporal state m and m being minimal to all temporal states that come after n w.r.t.⋎ B .We say m is minimal to n as shorter way to say that m is minimal to all temporal states that come after n.Unfulfilled non-monotonic eventualities in a node x with the label n are represented by the set une def = {(n 1 , ♢ ∼α 1 ), (n 2 , ♢ ∼α 2 ), . . .}, each pair (n k , ♢ ∼α k ) represents a non-monotonic eventuality ♢ ∼α k at a position n k that needs to be fulfilled.Therefore each node x has three components: n is a label indicating the temporal state, Γ is the set of sentences within the node and une is the set of non-monotonic eventualities at x that need to be fulfilled.With all of our notions introduced, here is the rule for the ♢ ∼ operator: ∼α be in a node with a label n in a branch B. If α appears in a proper successor node x with a label m ≥ n, and (n, m) ∈ min B , we say ♢ ∼α at the position n is fulfilled in m.
We then add (n ′ , n) to the min of the branch.In the third branch, we explore the outcome of n not being minimal to n ′ w.r.t.⋎ of the branch.It means that there exists a temporal state m ′ that come after n ′ where m ′ is preferred to n w.r.t. to ⋎ of the branch, we add the pair (n ′ , n) in ⋎ of the branch to represent this case.It is worth to mention that the rule (une) does not apply when the label of the node n is the same as (n, ♢ ∼α 1 ).The reason behind this is that we have already explored the case when the eventuality is fulfilled in n thanks to (♢ ∼) rule.Example 9 shows the application of (une) rule.
∼α 1 not being fulfilled yet in n, we keep the pair (n ′ , ♢ ∼α 1 ) on the leaves of two branches.The second branch explore the outcome of n being minimal to n ′ w.r.t. to ⋎ of the branch.▶ Example 9. Let a branch B have ⋎ B , min B and a leaf node 5 : ({□

0 1 6 23:8
After the transition rule is applied to a state-labelled node n : (Γ, une), we add a node with the label n + 1.It marks the start of a new temporal state n + 1.We carry over to n + 1 only sentences within the scope of ⃝α i sentences.The set une gets transferred as well to the next temporal state.Any pair (n ′ , ♢ ∼α 1 ) ∈ une remaining in the state node with the label n indicates that the rule (une) was applied on the temporal state n and the current branch explores an outcome where ♢ ∼α 1 is not yet fulfilled in n.Therefore, these non-monotonic eventualities need to be fulfilled in n ′′ ≥ n + 1.Before applying the transition rule, we need to add a set of checks to prevent branches from expanding indefinitely.These checks are called loop and prune rules.These rules, together with the transition rule, are called dynamic rules.Let B := (⟨x 0 , x 1 , x 2 , . ..,v⟩, ⋎ B , min B ) be a branch where v is a state-labelled node n : (Γ v , une v ).Let u be the last state-labelled node n − 1 : (Γ u , une u ) that comes before v in the branch B. Before applying the transition rule on v, we check for these rules: [Loop] Let v be a state-labelled node such that it has at least one sentence of the form ⃝□α bool in Γ v but has no ⃝α bool , ⃝♢β, ⃝♢ ∼β in Γ v and une v = ∅.If for all ⃝□α bool in Γ 2, ⃝α 3, ..., ⃝α k } ⊎ Σ, une), ⋎ B , minB n + 1 : ({α1, α2, α3, ..., α k }, une), ⋎ B , minBC V I T 2 v ,there exists u < s ≤ v such that □α bool ∈ Γ s , then the branch B is ticked (✓).
contains the set of all sentences in Γ of the node between the two consecutive state nodes x ji−1 and x ji , x ji−1 not included.If B is ticked thanks to the empty rule, then ∆ B (i) is empty for all i ≥ k.If B is ticked thanks to the loop rule, then ∆ B (i) has the same set of sentences as ∆ B (k) for all i ≥ k.We can shownext that if a sentence α 1 is in ∆ B (i), then I B , i |= α 1 .In what follows, let B be a successful branch of a tableau T , let k be the label of the last state node in B, and let I B , ∆ B be the interpretation and the mapping function of sentences extracted from B. Let B be a successful branch, and i ∈ N. If ⃝α 1 ∈ ∆ B (i), then α 1 ∈ ∆ B (i + 1).
∈ min B or we have (i, ♢ ∼α 1 ) ∈ une of the next node.If α 1 is in Γ of the next node, then the lemma holds.If (i, ♢ ∼α 1 ) ∈ une of the next node, then we find (i, ♢ ∼α 1 ) ∈ une xj i .Thanks to the transition rule, we have (i, ♢ ∼α 1 ) ∈ une xj i +1 .By applying the rule une on a node with the label i + 1,then we either have α 1 in Γ of the next node with (i, i + 1) ∈ min B or we have (i, ♢ ∼α 1 ) ∈ une (the two remaining branches) of the next node.In a similar way as in i, we can conclude that either α 1 ∈ ∆ B (i + 1) with (i, i + 1) ∈ min B (the lemma holds) or (i, ♢ ∼α 1 ) ∈ une xj i+1 .Without loss of generality, x be the node where we apply the rule (♢ ∼) on ♢ ∼α 1 , then we either have α 1 in Γ of the next node with (i, i)

2 0 1 6 23:12 the
interpretation.The set ⋎ s is not an ordering relation, it records instances of points of time not being minimal to other points of time w.r.t. the ordering relation ⋎ .Remember that each when we apply the une rule, we add a pair (n ′ , n) to ⋎ in order to symbolize the outcome of n not being minimal to n ′ .The set of min s records the instances of points of points of time being minimal to other points of time w.r.t. the ordering relation ⋎ .
1 , x 2 , . . .⟩, ⋎ s , min s ) where each x i is a pair (Γ, une), ⋎ s , min s are the set of constraints that the sequence s must follow in order to be coherent with ⋎ of C V I T ).The sets Γ xi+1 , une xi+1 and ⋎ s remain unchanged.Thus, the invariant Inv(x i+1 , J(x i )) holds.