How to Prove Hume’s Law

This paper proves a precisification of Hume’s Law—the thesis that one cannot get an ought from an is—as an instance of a more general theorem which establishes several other philosophically interesting, though less controversial, barriers to logical consequence.

Hume's Law is controversial, both in logic and in metaethics, 1 but it is just one example of the more general phenomenon of barriers to entailment-theses according to which premises of one kind never entail conclusions of another. Four others of interest to philosophers are: that one cannot deduce universal conclusions from particular premises (see e.g. [40], p.100), that one cannot deduce conclusions about the future from premises about the present or the past [13, 4.21/37], that one cannot deduce conclusions about how the world must be from premises which merely say how it is [11,39], and finally that one cannot deduce indexical claims from premises which are not themselves indexical [4,21,42]. These other barrier theses are much less controversial and often function as philosophical platitudes.
The present paper proves a Limited General Barrier Theorem from which a precisification of each of the barriers follows. The goal is to provide a unified, logical account of these barriers, permitting the platitudinous status of the less controversial ones to support Hume's Law. The theorem is "limited" in that it says that the barriers hold unless a certain condition is met.
The paper has five main parts. Section 2 uses a counterexample to Hume's law proposed by Mavrodes [26] to motivate and formulate the barrier's limit. Section 3 proves the limited indexical barrier, first introducing an indexical logic to permit this to be done precisely. This is then generalised to the General Limited Barrier in Section 4, and it is shown how to derive the other four barriers from the general one, employing a suitable logic in each case. Section 5 looks at the consequences for some formal counterexamples to Hume's Law found in the literature, including those of [36] and [26], and finally in Section 6 the approach presented here is compared to three extant proofs of Hume's Law, those of Pigden, Schurz, and my own earlier work with Restall [33,38,44,45].

Ought implies Can
We motivate the formulation of our barrier theorem via a proposed counterexample to Hume's Law. Mavrodes presented the issue succinctly in Analysis: Many ethical philosophers appear to accept the view that 'ought' implies 'can'. This view, which seems quite plausible, can perhaps be formulated more precisely as (1) Statements of the form 'N ought to do X' entail the corresponding statements of the form 'N can (is able to) do X.' But (1) is equivalent to (2) Statements of the form 'N cannot (is unable to) do X' entail the corresponding statements of the form 'It is not the case that N ought to do X'. And (2) appears to say that there is a non-normative statement which entails a normative one. [26] We can present the issue more succinctly still. It is widely held that the following is correct: Oφ ♦φ (DM1) and that contraposing preserves validity, so that this is correct too: (DM2) appears to have non-normative premises but a normative conclusion; it thus threatens to be a counterexample to Hume's Law. A defender of the barrier has four possible responses. Option A is to say that the argument is not really valid. This approach is taken by Pigden [33], where it is argued that only first-order validity is validity proper. We will have more to say about the advantages of our approach over Pigden's in Section 6, but for now we note that it seems unlikely that the sense of entailment employed in the highly intuitive barrier theses is so restrictive that say, Oφ P φ and p ♦p cannot count as valid. Option B is to hold that that the conclusion of (DM2) is not really normative. We can generate some plausibility for this option by looking at two of the other barriers to entailment-it's quite plausible that the negation of a universal statement, e.g. ¬∀xF x, which is equivalent to ∃x¬F x, is not universal and that ¬ p, which is equivalent to ♦¬p is not a must-type (or modally universal) claim. But the attractiveness of option B evaporates once we recognise that ought implies can and its contrapositive are just two of a larger number of interrelated deontic modal principles that seem likely to stand or fall together. Substituting ¬φ for φ in (DM2) and taking the deontic and modal operators to be interdefined in the standard ways, gives us: Contraposing gives: Moreover the same kind of reasoning that gives us Ought implies Can suggests And similar moves give: Of these eight DM principles, four (DM 2, 3, 6 and 7) have apparently nonnormative premises and normative conclusions, and two of those four (3 and 7) do not contain negation. Thus, even if correct, the suggestion that the class of normative sentences is not closed under negation would not solve the problem in full generality; we would still need to contend with counterexamples like p Pp.
There are two options remaining. Option C is to hold that the premises of (DM2) are not really non-normative. This would require some explanation to avoid ad hocery. Finally Option D is to back off the barrier in its full strength and instead adopt a limited version, according to which non-normative premises never entail normative conclusions unless some further condition is met. This would require the formula-tion and justification of the further condition. One approach of this kind is that taken by Schurz [44,45,47]. We will compare the present approach with Schurz' in more detail in Section 6. Over the remainder of Section 2 we argue that in choosing to limit the barrier in response to the argument from Ought Implies Can Schurz was entirely correct: (DM2) represents a special case in which the normal reason to think that descriptive premises never entail normative conclusions fails.

Will implies Can
Given that the goal is a unified account of the barriers, we can ask whether similar problems arise for the other barriers, and what it would be sensible to say about those. With the past/future barrier we might consider Will implies Can: that something will be the case entails that it is possible. 2 In the language of tense-modal logic: 3 (TM2)'s premise is not about the future, while the conclusion is, giving us a putative counterexample. As with the (DM) principles from the previous section, these two belong to a larger group: TM 2, 3, 6 and 7 have future claims on the right but not on the left. Again, there are four possible responses: A: deny the entailment, but this is hard to justify, given the intuitive sense of consequence in play in barriers to entailment. B: deny that the conclusions are really Future, but this is implausible for Fp and Gp especially. C: hold that modal claims like p and ♦p are somehow really Future after all, or D: restrict the barrier so that it does not forbid such arguments.

'Everyone' includes me
We also get similar issues for the indexical barrier, according to which sentences which contain indexicals are not entailed by non-indexical sentences. Consider the interaction between quantifiers like ∀ and ∃, and the first-person pronoun ı. ı refers to whoever the agent of the context of utterance is, and since this must be an element of the domain of the model, whenever I am R is true, something is R is true as well, making the entailment from I am R to Something is R true. In the formal language of LD- [17]'s Logic of Demonstratives-this would be: Contraposing gives ¬∃xRx ¬Rı (IL2) Substituting ¬R for R in (IL2), and treating the quantifiers as interdefined in the usual way gives us: And contraposing once again: ¬Rı ¬∀xRx (IL4) IL 2 and 3 have indexicals in the conclusion, but not the premises, making them putative counterexamples. We have the usual four options, but here, I think, it is much clearer what the right one is. Option A: say that the arguments are not really valid; this is even more implausible here than in the previous cases. Option B: say that Rı is not really indexical, but it is surely indexical if any sentence is. Option C: say that ∀xRx is really indexical. But though quantifiers can be context-sensitive-quantifying over different subsets of the domain relative to different contexts of utterance-the quantifiers in the formal language of (LD) are not. In this case Option D, limiting the articulation of the barrier so that it is no longer in conflict with such cases, is the only sensible option. But how do we do that?

Formulating the Limit
It can help to consider why anyone expects there to be an indexical barrier in the first place. The existence of a barrier is suggested by work in the philosophy of language by Castañeda, Perry, and Lewis. 5 Lewis asks us to imagine there are two gods, one who lives on the tallest mountain and one who lives on the coldest. One is angry and hurls thunderbolts on the people below, the other generous and showers mana. Each is omniscient in a distinctive way: they know which non-indexical sentences are true. 6 For example, they each know the truth-value of The generous god lives on the tallest mountain, there are two gods, and one god throws thunderbolts. The question is: can either deduce the truth-values of any indexical sentences?
Lewis' remarks suggest not. 7 Moreover, there are general theoretical reasons to think this, namely: the truth-values of indexical sentences vary with who the god is (and more generally with the context); I am the angry god is true for one god, false for the other. The coldest mountain is here is false in one god's context but true in the other's. If either indexical sentence followed from the non-indexical premises available to both gods, it would be a logical consequence of true premises, and so true itself-no matter what the context was. So neither can be entailed by the premises.
The forgoing suggests a non-syntactic way of defining indexical sentences (something that will be important for formulating the barrier) and an argument for the barrier's existence. First, call a sentence indexical if we can change its truth-value by changing the context of utterance. When we look at the model theory for a logic like LD-in which a context is a quadruple of agent, place, time and world, a, p, t, w , relative to which sentences get truth-values-this will give us a partition of the set of sentences. We could then argue that indexical sentences never follow from non-indexical premises by noting that if such non-indexical premises are true in a model, changing the context can falsify an indexical conclusion without falsifying the premises, which generates a counterexample.
That's the reason to think the barrier will exist. But now consider (IL3): ∀xRx F ı, which constitutes a problem for the very reasoning just sketched. Suppose the gods know that the non-indexical sentence All gods live on mountains is true. Then each can deduce If I am a god, I live on a mountain. This is a counterexample to the barrier, and a case in which the reasoning of the previous paragraph fails. For suppose the premises are such that, in order for them to be true in a model, that model must be such that every available context is one in which the conclusion is true. Then even though the conclusion is sensitive to context in general, when we look only at models which make the premises true, only contexts which make the indexical sentence true remain available.
Fortunately, this problem suggests a way to formulate the limit: φ unless every context-shift of every model of is a model of φ. Now it is time to make these ideas more precise. 6 The world indexical is more commonly applied to subsentential expressions like I, here, tomorrow etc, which are indexical just in case their propositional content varies with context. But given that that the propositional content of a sentence (a proposition) is composed of the contents of the expressions of which it is composed, sentences containing indexicals will themselves have contents which vary with context (they express different propositions in different contexts.) In virtue of this we can refer to sentences as indexical as well. 7 This is complicated by the fact that his set up of the case is slightly different from mine. But on page 521 he writes: "[n]either one knows whether he lives on the tallest mountain or on the coldest mountain, nor whether he throws manna or thunderbolts." (bold added.)

The Limited Indexical Barrier
For thinking carefully about entailment relations on languages which contain indexicals, we turn to the model theory for indexical logics. 8

Indexical Logic
The logic below, IL (for indexical logic), is a simplified version of [17]'s logic, LD.

The Language
Our language has two sorts of term, i-terms (intended to denote elements from the domain of individuals) and p-terms (for elements from a second domain, the domain of places.) i-terms are divided into i-constants (a, b, c etc.), i-variables (x, y, z, etc.) and a logical i-term: ı (for the first person pronoun, I) and p-terms are similarly divided: p, p 0 , p 1 . . . etc. are p-constants, v, v 0 , v 1 . . . etc. are p-variables, and h (for the indexical here) is a logical p-term.
The arity of predicates is given by a pair, m, n , with m the number of i-terms and n the number of p-terms needed to form an atomic wff. We have non-logical predicate-letters Q m,n , R m,n , S m,n etc., 9 and two logical identity predicates, = 2,0 and = 0,2 (the former a relation between each individual and itself, the later a relation between each place and itself). We also inherit from LD the special predicate Loc 1,1 (for is located at.) Logical constants are the usual truth-functors ¬, ∧, ∨, →, and ↔, first-order quantifiers ∀, and ∃, (which may bind either i or p-variables), modal operators , and ♦, tense operators F , G, P , H , (as explained in note 3) and the context-sensitive unary sentence-operators, A, and N (for actually and now.)

Models
An IL-model is an 6-tuple, W, T , D, P , C, I in which: 1. W is a non-empty set of points (worlds) 2. T is the set of integers (times) 3. D is a non-empty set (domain of individuals) 4. P is a non-empty set (domain of places) 5. C is a quadruple, (the model's context) a, p, n, @ 8 The treatment of indexical logic here is rather brief. Additional motivation and background can be found in [17] and [41]. 9 We avoid using P , H, F , and G as predicate-letters since these will be our tense operators. In the interests of readability, we drop the superscript giving the predicate's arity where this is obvious. where: (a) a ∈ D (the agent of the context) (b) p ∈ P (the place of the context) (c) n ∈ T (the time of the context, now) (d) @ ∈ W (the world of the context, the actual world) 6. I is a function from expressions, to an appropriate value for that expression as follows: (a) If t is a non-logical i-constant, then I (t) ∈ D (b) If t is a non-logical p-constant, then I (t) ∈ P (c) If is an m, n -place non-logical predicate, then I ( ) is a function such that for each t ∈ T and w ∈ W , I (t, w) ⊆ (D m × P n ) (i.e. a function from time-world pairs to an sequence consisting of an m-tuple of individuals from D followed by an n-tuple of places from P -the predicate's intension.) 7. (a, p) ∈ I Loc (n, @)

Truth and Denotation
Variable assignments need to accommodate both i-variables and p-variables. Let f i be a function from each of the i-variables to a value in D, and f p a function from each of the p-variables to a value in P . Then f i ∪ f p is variable assignment. We write [α] Mgtw for the denotation of the term α in the model M, on the assignment g, at the time t in the world w.
We write V M g (φ, t, w) for the truth-value of the wff φ at a time t and world w, in the model M on the variable assignment g.
1. If i 1 , . . . , i m are i-terms, p 1 , . . . , p n p-terms, and an m, n -place nonlogical predicate, then The truth-conditions for the truth-functors are as you might expect, e.g.: Quantifiers range over the sets D or P in the model, depending on whether they bind i or p variables, e.g.: 5. Tense operators have the expected clauses, e.g.: V M g (F φ, t, w) = 1 iff there is u ∈ T , t < u and V M g (φ, u, w) = 1 6. To avoid unneeded complexity, modal operators are unrestricted by an accessibility relation, e.g.: Finally, we have clauses for the context-sensitive operators. Each makes reference to a member of the model's context (n and @ respectively.)

Truth and Consequence
Truth at a time in a world in a model: Truth in a model: We write V M (φ) = 1 for this and abbreviate V M (φ) = 1 for all φ ∈ to V M ( ) = 1.

Context-shifts and Taxonomy
Now that we have our indexical logic, the next step is to define a relation of contextshifting ( ) on the IL-models. We will say that one model is a context shift of another if they are alike except perhaps for the a (agent) or p (place) elements in the context C. More formally: We use in our definition of indexical sentences.
Definition (Indexical Sentence) A sentence φ is indexical iff there are models, M, N, such that M satisfies φ, N M, and N does not satisfy φ. 10 We will also call such sentences context-shift breakable.

Theorem 1 (Limited Indexical Barrier) If is a non-indexical set of sentences and φ is indexical, then
Proof Suppose the barrier's unless-clause is not met, i.e. that some model M of is such that there is a model N, M N and φ is false in N. Since M satisfies and M N, the new model N satisfies ( is non-indexical and so not breakable by context-switches.) Thus N is a counterexample and φ.
Remark Indexical sentences include: We will see later that the status of the disjunctions and conditionals above is especially salient given the counterexamples that have been proposed against Hume's Law. Some formulations classify disjunctions of descriptive sentences with normative sentences as neither normative nor descriptive, and state only that normative sentences don't follow from descriptive premises-thus saying nothing about such disjunctions. Schurz [45,[11][12] and Vranas [54] have stressed the importance of classifying these mixed disjunctions and conditionals as normative, and for now we note only that identifying indexicality with -breakability allows us to do the analogous thing in the case of the indexical barrier.
No logical truths are indexical. They are not -breakable because there is no model which makes them false. This means that the famous sentence NLoc(ı, h) (informally: I am here now) which is a logical truth in Kaplan's and our systems, counts as non-indexical.
Similarly, no unsatisfiable sentence is indexical, because there is no model which makes it true. For example, Rı ∧ ¬Rı is non-indexical. From the above it is clear that merely containing an indexical expression is not sufficient for indexicality in the sense in use in the barrier. Rather, the property we are interested in is a model theoretic one: having a truth value that is vulnerable to certain kinds of change in the model. 11

Remark ∀xRx
Rı meets the barrier's unless clause, so that (IL3) is not a counterexample.
∀xRx is non-indexical; changing a and p in C will not change the fact that I (R, n, @) = D and so will not change the universal sentence from true to false. Rı is indexical; changing a in C can change the truth-value of Rı in models where I (R, n, @) = D. Moreover (IL3) is valid in IL. But any model of ∀xRx is one where I (R, n, @) = D, and no context-shift of such a model is one in which F ı is false.
Next we want to generalise our insights from the indexical case to the other barriers. 11 More surprisingly, some simple sentences containing N and A-like NRa and ARa-are not indexical in the sense defined, since context-shifting changes only a and p-not n and @. This is intentional, but the reasons for it are a bit complicated. First, note that if we were to count sentences like AF a and NF a as indexical, they would present straightforward counterexamples to the claim that one cannot get indexical sentences from non, since F a AF a and F a NF a. That is because there is a critical difference between a and p on the one hand, and n and @ on the other: n and @ are not only part of the context of use for the sentence, but also part of the circumstance of evaluation for the proposition expressed by the sentence. The time and world parameters play a double role, first to determine which proposition the sentence expresses, and second to determine whether or not that proposition is true. That matters because context-shifts are supposed to be mere context-shifts, which keep everything else the same. If we allowed n and @ to shift as well, that would automatically shift the n and @ with respect to which the proposition is evaluated, in addition to shifting the context, with the consequence that sentences which always express the same contingent (or temporally contingent) proposition-like Ra-would all be counted as indexical. Admittedly, some authors do allow the expression indexical to be used that broadly sometimes (e.g., Lewis [22,[24][25][26][27][28][29][30][31][32][33][34][35] "Contingency is a kind of indexicality") but I don't think that broad conception is the one employed in the intuitive version of the indexical barrier; the two gods are allowed to know the truth-values of contingent and temporary premises and they can infer Aφ and Nφ for any φ they know to be true. A final remark on generalising this to non-Kaplanian conceptions of propositions: if we had a different conception of proposition, perhaps one on which the truth-value varied only with the world parameter, or even one on which it varied with world, time and place, this would affect which aspects of the context could be changed with context: the underlying idea is that you can shift all aspects of the context of use that are not also featured in the circumstances of evaluation. See [41,[155][156][157] for more on this topic.

The Limited General Barrier
In this section we generalise the Limited Indexical Barrier to a statement from which each of the five barriers follows. Suppose we have a logic, L, where this is to say that we have i) a formal language, ii) a set of models, U , with respect to which sentences in the formal language are true or false, and iii) a definition of consequence, i.e. L φ just in case all models of are models of φ.
And suppose R is a binary relation on U . (In the indexical case, the logic was IL and R was context-shifting.) Where a sentence is not R-breakable, we call it R-preserved.
φ, unless all models of are such that all R-related models N are models of φ.
Proof The proof mirrors that of the Limited Indexical Barrier. Suppose the unlesscondition is not met. Then there is some model of , M, and a model N where MRN and N is not a model of φ. Then N is also a model of because MRN and is R-preserved. But φ is false in N, making N a counterexample, so φ as required.

Four More Barriers
For each remaining barrier we require a logic and a suitable R-relation. The next four subsections identify these for the other four barriers, culminating in Hume's Law.

Universal Sentences and Domain Extension
Universal sentences are vulnerable to expansions of the domain of the model: whenever ∀xF x is true in a model, for example, it can be made false by expanding the domain to include a new element which is "¬F ." So let U be the set of first-order models (pairs D, I , where D is a non-empty set and I an interpretation function.) R will be the relation of Domain Extension on that set of models. Remark (This model-theoretic conception of a universal sentence is distinct from the syntactic conception of a sentence that contains a ∀) ¬∃x¬Rx is universal though it does not contain a universal quantifier, and the logical truth ∀x(Rx → Rx) is not universal even though it does, since-being true in all models-it is not D-extension breakable.
Remark (The set of universal sentences is not closed under negation. (Nor is the set of non-universal sentences)) ∀xRx is universal but ¬∀xRx is not. p∨∀xRx is universal but ¬(p ∨ ∀xRx) is not. (Similarly, ∃xRx is non-universal but ¬∃xRx is universal.) The contrast between the universal and indexical barriers when it comes to closure under negation is explained by the properties of the R-relation used in their definitions: context-shifting is symmetric whereas domain-extension is not.

Proposition 1 If R is symmetric, then the set of R-breakable sentences is closed under negation.
Proof Suppose R is symmetric and let φ be an R-breakable sentence. Then there are models M, N, such that MRN, V M (φ) = 1 and V N (φ) = 0. But then V N (¬φ) = 1 and since R is symmetric, NRM. And since V M (¬φ) = 0, ¬φ is R-breakable too.

Corollary (Limited Universal Barrier) If is non-universal and φ is universal, then
φ unless all D-extensions of all models of are also models of φ.
Proof This follows from the Limited General Barrier.

Modally Universal Sentences and W -extension
An informal way to gloss the modal barrier is as saying that you can't get sentences which say how things must be from premises which merely tell you how things are. Intuitively that is because sentences which say how things must be place global requirements on the set of possibilities, whereas sentences which tell us how things are are only concerned with what is happening locally-in the actual world. Adding new possibilities can "break" sentences of the former kind, but not sentences of the later. This section precisifies this informal conception of the barrier. We will look at 3 different modal logics: S4, B, and S5, as the variation illustrates the robustness of the Limited General Barrier: changing the logic sometimes changes the taxonomy, but the barrier continues to hold. B is especially important in the context of the modal barrier because the entailment version of the B-axiom might be thought to be a counterexample [11,39]:

The Logics
In this case our language consists of sentence letters and truth-functors, supplemented with and ♦. Models are 4-tuples W, S, @, I with @ ∈ W and S a reflexive accessibility relation on W . For S4, B and S5 we restrict attention to models in which S is transitive, symmetric, or both transitive and symmetric, respectively. That is, the set U of models in the definition, below, of W -extension, pertinent to one of these logics should be taken to comprise all models whose accessibility relations have the properties just spelled out for the logic in question. A sentence of the formal language is true in a model if it is true at the model's actual world, and φ just in case all models of are models of φ.

The Taxonomy
Our R-relation is that of W -extension: Definition (W -Extension) For all models M, N ∈ U , N is a W -extension of M just in case: Proof This follows from the Limited General Barrier.
Now we can ask about p ♦p, which is valid in B and S5: if p is true at the actual world of an arbitrary B or S5 model, then, thanks to symmetry, ♦p is true at all accessible worlds and ♦p is true at the actual world, and so in the model.
Moreover the premise p is not modally universal; if V M (p, @) = 1, adding worlds to W will not change that. The conclusion ♦p is modally universal on the B-models. Suppose we have a model in which W = {@, w}, the two worlds are accessible from each other, and p is false at @, but true at w. Then ♦p is true at @, since w is accessible from @, and true at w because of reflexivity. So ♦p is true at @ and true in the model. But if we added a third world v, accessible from @ but not from w, and made p false at v, then there are no worlds accessible from v where p holds, and so ♦p is false there, and so now ♦p is false at @ and in the model (see Fig. 1.) So in B, ♦p is modally universal.
However, in this case p ♦p meets the barrier's unless-clause: no B-model of p (recall that a sentence is true in the model if it is true in the model's actual world) has a W -extension in which ♦p fails to be true at the actual world: thanks to symmetry, the truth of p at the actual world makes ♦p true at all worlds accessible from it.
Things are different with S5, because there ♦p is not W -extension breakable. (The model on the right in Fig. 1 is not an S5-model.) We could add a new world, accessible from the actual world, but if ♦p was true before, it was because every world accessible from @ could access a world where p is true. Thanks to the reflexivity, symmetry and transitivity of the accessibility relation, the worlds accessible from @ form an equivalence class. Either the new world is inaccessible from any world in that class-in which case it will not affect the truth-value of any sentence in the model-or it is, in which case it can access at least one world where p is true, and so ♦p is true at the new world, so that the truth of ♦p in the model is unaffected. So in S5 the B-argument is not a counterexample because the conclusion is not modally universal; its truth can be secured by the existence of a single world.
And of course in S4, the B-argument fails as a counterexample because it is not valid.

Fig. 1 ♦p is W -extension breakable on B-models
One lesson from the above is that the Limited Barrier has a certain robustness; it is not limited to the particular logics that we use to illustrate it. We might reject one logic, and adopt another, by changing the set of models which we quantify over in our definition of logical consequence. But this change also changes the taxonomy of sentences: what counts as being e.g. modally universal or indexical, in a way that preserves the barrier. The main danger in changing our logics is not so much that the barrier will be false of the new logic, but rather that the taxonomy might be implausible or futile in some way.
Before moving on we note that there is a different putative counterexample to the modal barrier that would require a first-order modal logic for rigorous treatment, namely: 12 a = b (a = b). However we can see the important part of how the Barrier will treat the argument very easily: since modally universal claims are those which are W -extension breakable, the conclusion (a = b) is not modally universal: if it is true in a model it will be true in all extensions of that model.

Future-sentences and Future-switching
Future sentences are, roughly, sentences whose truth-values can change if the future changes. We will use a tense logic to make that idea more precise, and because we are especially keen to resolve questions about p Fp-given its parallels with Mavrodes' counterexample to Hume's Law-it will be a tense-modal logic (TML for short).
The primitive expressions of our language are sentence letters, truth-functors, and ♦, and four unary tense logical operators: F , G, P , and H , meaning at some time in the future, at all times in the future, at some time in the past, and at all times in the future, respectively.
Models are 5-tuples W, T , @, n, I With 1. W a non-empty set (worlds) 2. T the set of integers (times) 3. @ ∈ W (the actual world) 4. n ∈ T (the now) 5. I assigns each sentence letter an intension: a function from T × W into {1, 0}.
In the interests of simplicity-to allow us to demonstrate the main points without additional distraction-we forgo a modal accessibility relation (the operators will be unrestricted)-and make use of the standard ordering on the integers as our tenselogical "<" relation. In simple cases we can represent a model with a table:

Fig. 2 A table representing a TML model
The table in Fig. 2 displays the different worlds in W along the top, and the times in T down the left-hand side. In each cell, t, w we write the sentence letters which receive the value 1 from the I function relative to that time-world pair. We adopt the convention of having time proceed from the bottom of the table to the top, so that the past is at the bottom and the future at the top. The sentence letters in the n, @ cell are the sentences which are true now in the actual world of the model.
Truth-functors receive their standard interpretations, and the clauses for the tenselogical operators are as one might expect: V M (F φ, t, w) = 1 iff there is u ∈ T such that t < u and V M (φ, u, w) = 1 V M (Gφ, t, w) = 1 iff for all u ∈ T such that t < u, V M (φ, u, w) = 1 V M (P φ, t, w) = 1 iff there is u ∈ T such that u < t and V M (φ, u, w) = 1 V M (H φ, t, w) = 1 iff for all u ∈ T such that u < t, V M (φ, u, w) = 1 When it comes to the clauses for and ♦ there is a choice. 13 We could say that p is true at a time and world just in case p is true at that time in all worlds. Or we could say that p is true at a time and a world just in case p is true at all times in all worlds. The former allows a time-relative sense of possibility and necessity; p could be true at t, w but not true at t 1 , w. The latter is what we need here, in order to get a tense-modal logic that validates our TML principles. p Fp makes sense only on the assumption that the tells about future times as well as the present one. The clauses for our modal operators will thus be: Then V M ( φ, n, @) = 1 which requires that for all w ∈ W and t ∈ T , V M (φ, t, w) = 1. In particular, for all t * ∈ T such that n < t * , Next we need an R relation on the models, to be used in defining Future sentences. Above we suggested that this would be a precisification of 'changing the future' i.e., a model would stand in the appropriate relation to another if you could get it from the first by changing (only) the future. There are two natural precisifications of this idea, which we'll call unrestricted and restricted future-switching.

Unrestricted Future-switching
Call one model an unrestricted future-switch of another if you can get it from the first by changing the values of the I -function for pairs t, @ where n < t. That is: changing which sentences letters appear in the "actual future"-cells shaded grey in the tables in Fig. 3.
In Fig. 3, the model on the right is an unrestricted future-switch of the model on the left; it is just like the one on the left except for the sentence letters in the grey box. Since future-switching is symmetric, the model on the left is also an unrestricted future-switch of the model on the right.
Future sentences are sentences which are future-switch breakable. If futureswitching is unrestricted like this, we get a somewhat uncomfortable result: p will count as Future, since it is true on the left but false on the right. An alternative is to use restricted future-switching.

Restricted Future-switching
Restricted future-switching involves swapping out the actual future for one whichaccording to the model-is merely possible. In the illustration in Fig. 4, the model on the right is obtained from the one on the left by "swapping" the future of world u for that of @. (And vice versa-restricted future-switching is symmetric too.) If we use this relation to define the Future sentences, then Fp and Gp come out Future, as expected (if Fp is true in a model where there are possible worlds where p is false in the future, we can future-switch to make it false) but p and ♦p do not: if p or ♦p is true in a model, restricted future-switching cannot break them. This is both a more intuitive taxonomy for modal claims, and in line with our aim of treating (IL3) and (TM3) in analogous ways. (Recall that we defined indexical sentences so that ∀xF x did not count as indexical.) We will thus proceed with restricted Since the u mentioned in clause 5 could be @ itself, future-switching is reflexive as well as symmetric.

Corollary (Limited Past/Future Barrier) If is non-Future and φ is Future, then
φ unless all future-switches of all models of are models of φ.
Proof This follows from the Limited General Barrier.
We can now see what the consequences of the barrier are for the instance of (TM3): p Fp. 14 p is, as we wanted, non-Future, and Fp is, as we also wanted, Future, and the argument is TML-valid. However it meets the barrier's unless clause: whenever p is true in a model, p will be true throughout the cells of the table, (at all pairs t, w ), so that no future-switching will result in a model which makes Fp false. Given this, the argument is not a counterexample to the Limited formulation of this barrier.
There's another interesting proposed counterexample to the past/future barrier due to A.N. Prior. In the section headed "Correction of Hume on past and future" in chapter 3 of [37], we read: J.F. Bennett recently described Leibniz as having discovered, and Hume as having re-discovered, the principle that 'if Q is an immediate consequence of P 14 A small issue with potential to confuse: the (DM) and (TM) principles are stated in a very general way using φ and we get instances of them by replacing φ uniformly with a sentence of the language. The status of the resulting sentences as -breakable or not can depend on what we replace φ with. For example, using (TM3), p Fp has a Future conclusion, but (p ∨ ¬p) F (p ∨ ¬p) does not. Strictly then, it is not the general principles themselves that threaten to be counterexamples, but their instances. then there cannot be a time-reference in Q later than the latest time-reference in P '. One thing that the development of tense-logic makes quite clear-if it was not clear before-is that this alleged 'discovery' is in fact a falsehood. [37,57]) A slight variant on Prior's counterexample will play the same role for us here:

p F Pp
Here F Pp is indeed a Future sentence on our taxonomy. For suppose it is true in a model where p is false now and at all past times in the actual world, e.g. the model on the left in (Fig. 5).
F Pp is true in the model on the left because there is a time later than n (namely t 5 ) in the actual world when Pp is true. But the model on the right is a future-switch of the model on the left and F Pp is false there, hence the sentence is -breakable. Moreover, the premise p in the argument is non-Future, since changing what happens at future-times does not change which atomic sentences are true at n, @ . But the argument meets the barrier's unless clause: for suppose p is true at n, @ in a model. No future-switch of that model makes the sentence F Pp false, again because futureswitching does not change the value of atomic sentences at n, @ .

Normative sentences and Norm-shifting
We come at last to the most controversial of our five barriers: Hume's Law. What is it for a sentence to be normative? One idea-present in [12]'s survey of logical work on Hume's Law and attributed there to [18]-is that sentences are normative if Fig. 5 A future-switch that breaks F Pp their truth-value is somehow dependent upon, and hence sensitive to, the normative standards. If so we might expect normative sentences to be the ones that are breakable with changes in the normative standards. But what does that mean? To refine the idea, we introduce a simple deontic logic, though since it will be important to diagnose the counterexample based on ought implies can from Section 2.1, it will be a Deontic Modal Logic (so not simple in one respect) which we will call DML.
The primitive expressions of DML are sentence letters, the deontic operators O and P , and the modal operators and ♦. A DML model is an ordered quadruple W, S, @, I where: 1. W is a non-empty set of points (worlds), 2. S is a non-empty subset of W (the superb worlds) 15 3. @ is an element of W (the model's 'actual world') 4. I is an interpretation function mapping pairs of sentence letters and members of W into the set of values {1, 0}.
The modal operators range over all of W , and the deontic operators O and P are interpreted as quantifying over the set of superb worlds: Our R-relation will be S-shifting, where one DML-model is an S-shift of another iff it is the same except (possibly) for the identity of the set of superb worlds, S, which may be a different (non-empty) subset of W (see Fig. 6). More formally: Remark Normative sentences include: Pp, Op, P ¬p, O¬p, as well as the result of putting any logically synthetic sentence composed of sentence letters and truthfunctors within the scope of an O or P .
A model with some p-worlds (worlds where p is true) and some non-p-worlds, where O¬p is true, can be S-shifted to a model where O¬p is false by letting S be the set of p-worlds. Similarly, if P ¬p is true in a model with some p-worlds, it can be made false by changing S to be the model's set of p-worlds.
A logically synthetic sentence is one that is neither logically true nor unsatisfiable. If a truth-functional matrix is synthetic, it can be true at some worlds and false at others. In models where S is the set of worlds where it is true, placing the truthfunctional matrix within the scope of a P or O results in a sentence which is true in the model. Switching S to be the set of worlds where the matrix is false then results in a model where the O and P sentences are false. Hence such sentences are S-shift breakable.
Remark ¬Op and ¬Pp are normative. More generally, the class of normative sentences is closed under negation. This follows from Proposition 1 and the fact that S-shifting is symmetric.

Corollary (Limited Normative Barrier) If is non-normative and φ is normative, then
φ, unless all S-shifts of all models of are also models of φ.
Proof This follows from the Limited General Barrier.

Analysis of Counterexamples
In this section we look at what to say-in the light of the barriers above-in response to formal counterexamples proposed to Hume's Law.

q Op ∨ ¬Op; q Op → Pp; q Pp ∨ P ¬p
Arguments with logical truths on the right are valid, even if they have a descriptive sentence on the left. Where the logical truth contains an O or a P , the conclusion might seem normative, and the argument a counterexample to Hume's Law. However, on our taxonomy normativity is not a matter of containing an O or a P , but of having a truth-value that is vulnerable to changes in the norms: being S-shift breakable. No logical truth is S-shift breakable, since it is true in all models. So the sentences on the right are not normative, and the arguments are not counterexamples.

p, ¬p Oq
Arguments with unsatisfiable premises are valid, even if they have normative conclusions. Unsatisfiable premises are also trivially descriptive on our definition: they are not S-shift breakable because they have no models at all.
However, arguments with unsatisfiable premises also meet the unless-condition trivially: any model of the premises is such that all its S-shifts are models of the conclusion. So they are not counterexamples.

p p ∨ Oq
This is a formalisation of the first part of [36]'s famous argument against Hume's Law. It has a descriptive premise and the conclusion is normative on our taxonomy: p ∨ Oq is true in a model where p is false and Oq true, but false in an S-shift of that model that makes Oq false. Hence it is S-shift breakable.
However, the argument meets the barrier's unless clause: any model of the premise p has no S-shift that makes p false and so no S-shifts that make p ∨ Oq false. So this is not a counterexample. The argument with the equivalent conditional, p ¬p → Oq, receives a similar analysis.

p ∨ Oq, ¬p Oq
This is a formalisation of the second part of Prior's argument. It is valid and the conclusion is normative. But the premise set is normative too. Suppose p ∨ Oq and ¬p are both true in a model where ¬q is also true. Then p is false at @, and Oq is true at @. So q is true at all w ∈ S. But now shift S to include the actual world, where q is false. Oq is not true in this S-shift of the original model, and p is still not true, so p ∨ Oq is false and the premise set is no longer satisfied. Hence it is normative, and the argument is not a counterexample.

¬♦p ¬Op
Finally we come to (DM2), the formal version of Mavrodes' counterexample. First, ¬♦p is non-normative; S-shifting does not change the modal accessibility of any worlds (or which worlds exist), and so if ¬♦p is true in a model it is true in all S-shifts of it. So it is not S-shift-breakable. Moreover, the argument is valid in DML-we designed the logic so that it would be so that we could face this kind of counterexample-and the conclusion is normative; Op is normative and the set of normative sentences is closed under negation on our definition, because S-shifting is a symmetric relation.
However, as might be expected after looking at our analysis of (IL3) and (TM3) in the cases of the other barriers, the argument meets the unless-clause: all DMLmodels of ¬♦p are such that W contains no p worlds. That means that no amount of S-shifting can result in a model where S contains a p-world, and so as model that makes ¬Op false. So the argument is not a counterexample.

Comparison with Extant Views
This section highlights some differences between the present paper's account and three other published proofs of Hume's Law, due to [33,38,44,45,47]. The sketch of each view here is of necessity brief, but each is published and the interested reader is referred to the books and papers cited here for further details.
Schurz proves his Generalised Hume Thesis (GH) about a broad class of deonticmodal-predicate logics. (GH) states that every deduction A, where the members of are purely descriptive and the conclusion A is either purely normative or mixed, is such that A is an O-irrelevant conclusion of . His result is, like ours, a limited one, and we might rephrase (GH): no purely normative or mixed conclusion can be deduced from a set of sentences that is purely descriptive unless that conclusion is an O-irrelevant conclusion of . Schurz' taxonomy is characterised syntactically: Purely descriptive sentences are those containing no occurrence of O. Purely normative ones are built up from elementary normative sentences with logical operators, and an elementary normative sentence is one of the form Oφ. Sentences which are neither purely normative nor purely descriptive-including disjunctions like p ∨ Oq-are mixed.
An advantage of the present model-theoretic approach over Schurz' syntactic approach to taxonomy is that we have no need to stipulate a list of normative subsentential expressions, such as O; for us normativity is read off the sentence's truth-conditions, rather than its syntax. Schurz is open about his approach's need to assume a list of normative expressions: "in our logical framework we must presuppose that under the primitive symbols we can separate those with normative (or valuative) meanings. E.g. 'it is necessary', 'it is desired', etc. have descriptive meaning, whereas 'it is obligated', 'it is a value' have ethical meaning. Without this separation we would not even be able to formulate the is-ought problem." [45,9] Moreover he is not alone in making this kind of assumption. 16 Yet the need for the assumption is unfortunate, since whether or not an expression counts as normative is often in dispute between defenders of Hume's Law and proposers of counterexamples. The present paper's model-theoretic approach allows us forgo it while retaining other virtues of Schurz' view: the application to complex logics, and well-motivated "limits" on the barriers.
The present view has one other advantage over the Schurz solution, and that is that the account of Hume's Law falls out of a unified account of the barriers: universal, future, indexical, modal and, of course, normative. This strength is shared with a different extant view, that of [38]. However the barrier proved here is different and an improvement on my earlier joint work in three respects.
One important difference is that here the conclusion classes are defined in terms of R-breakabillity. In [38] they were defined in terms of a stronger property: R-fragility, where a sentence φ is R-fragile just in case any model of φ has at least one Rrelated model which is not a model of φ. (This is stronger because a sentence might have some models which have R-related models which make it false (R-breakability) without it being the case that all its models have R-related models which make it false. (R-fragility).) p ∨ Oq and p → P q are examples of sentences that are S-shift breakable without being S-shift fragile.
The use of the stronger property permits Restall and Russell to prove an unlimited version of their barrier, to do so without assuming a list of normative expressions, and to provide a unified account of the barriers. 17 However, Vranas [54] and Schurz [46] were quick to point out the limitations of the Restall and Russell account. Vranas notes that it classifies p ∨ Oq as neither descriptive nor normative, and similarly for equivalent conditionals like ¬p → Oq. This means the barrier says nothing about whether such sentences follow from descriptive premises. But the intuitive, informal barrier we are attempting to capture does say something about them. Consider 16 See e.g. Prior and Jackson: "We follow Prior and adopt the common approach of defining ethical statements as those containing ethical terms; where ethical terms are defined by a technique of listing akin to that used in logic texts to specify the logical particles. That is, the ethical terms are terms like "good," "right," "ought," and so on." [15,[89][90] 17 Two points of detail: the section of [38] on Hume's Law failed to retain the desired unity, but I think it could be regained with some minor refinements. The paper also only dealt with 4 of the 5 barriers. The indexical barrier was taken up by [41], but that later paper's story is not quite in line with the treatment in [38], characterising indexicality as sensitivity to context-shift and using a syntactically specified limit clause. The use of the limit clause makes that 2011 paper in some ways a bridge between [38] and the present paper, but the syntactic limit clause is subject to the same criticisms as Schurz' syntactic taxonomy.
whether ¬p entails Oq. Of course not, one might think-we would have to add something normative to ¬p, to get something normative out. Something normative like: ¬p → Oq. So the intuitive story about Hume's law classifies ¬p → Oq and p ∨ Oq as normative. The [38] account doesn't do that, so it doesn't say enough to capture Hume's Law.
Schurz [46] highlighted a different problem for Restall and Russell. Some of the most interesting counterexamples to Hume's Law use both deontic and modal operators, including the one from [26] that we discussed in Section 2. Restall and Russell [38] proves its modal barrier for modal logics and its deontic barrier for deontic logics, but it does not prove anything about a deontic-modal logic strong enough to formulate the (DM) principles. It thus fails to say anything about those complex counterexamples, and-argues Schurz-cannot be extended to do so.
As we have already seen though, the present paper's account avoids both of those problems. By using breakability in place of fragility, p ∨ Oq and ¬p → Oq are properly classified as normative. And the 'limit' on the barrier allows it to say the right thing about complex principles, such as the (DM), (TM), and (IL) principles.
The third extant approach treats Hume's Law as an instance of a different general principle: the conservativeness of logic. [33] argues that not only do normative conclusions not follow from descriptive premises, but (roughly) one cannot get anything in a conclusion that was not already in the premises. He also endorses, for example, a hedgehog barrier: "conclusions concerning hedgehogs cannot be logically derived from hedgehog-free premises." [33,132] The account makes exceptions for logical expressions-of course one can derive ¬¬p from p-and for so-called vacuous appearances in the conclusion-one can derive D ∨ N from D, but since N could be replaced with other sentence letters without rendering the argument invalid, the occurrence of N is inessential to the argument's validity, and so is vacuous. Both Hume's Law and what we might call Pigden's Law (No hedgehogs in the conclusion unless hedgehogs in the premises!) are taken to be instances of the following: (CON) A predicate or propositional variable cannot occur non-vacuously in the conclusion of a valid inference unless it appears among the premises.
where a predicate or propositional variable occurs vacuously in the conclusion of an argument if can be replaced by any other expression of the same syntactic type without rendering the argument invalid [33,136]. Pigden's view has a virtue that Schurz' lacks: there is no need to agree a list of normative expressions before we begin. Since the conservativeness thesis applies as much to descriptive expressions like hedgehog as it does to normative ones like ought, the success of the project doesn't depend on us drawing the descriptive/normative line in any particular place.
However-as Pigden readily acknowledges-this raises a question: what about normative logical expressions, like the P and O of deontic logic? They give us arguments like p Pp and q Op → Pp. P is not vacuous on the right of the first argument (you couldn't replace it with an operator meaning it is forbidden that, or it is impossible that) and neither Op nor Pp is vacuous in the conclusion of the second.
Pidgen's answer is that there are no such logical expressions. Logic proper is limited to the logic of first-order quantifiers-classical or subclassical as that may be. This restrictiveness on its own might be enough to discourage many logicians, though the view has genuine and serious supporters in the Quinean tradition. But even if there is some pure and strict sense of logic that applies only to the first-order predicate calculus, logic in that restrictive sense hardly seems to be the one in play in debates over Hume's law. No-one would argue that you can't "get" ♦p from p in a similar way.
A final vice of the conservativeness approach is that it does not offer a unified account of the barriers; the particular/universal barrier is not an instance of the conservativeness of logic, unless perhaps we are prepared to reject the idea that ∀ is a logical expression.

Final Thoughts
Barriers like Hume's Law are intuitive and accessible enough that we might classify them as folk logic. Journalists, lawyers, and the protagonists of detective novels all attest that "you can't show that something doesn't exist" and people often find such claims plausible even before they embark on the formal study of logic.
We can think of scientific logic as having shown that some such claims are hyperbolic-an over-generalisation of a good insight. Sometimes we can show that something doesn't exist-using proof techniques like reductio, and reasoning about arbitrary objects. Even so, the insight that there is difficulty in proving negative existentials is basically correct, even if it tends to be a bit over-stated.
On the account given here, we can see, first, why the existence of the barriers is so intuitive. The truth-value of the conclusion-universal, future, modally universal, indexical, or normative-is vulnerable to changes that the truth-value of the premise set is not similarly vulnerable to: domain extension, changes in the future, additional possibilities, change in the context, or norm-shifting. This leaves us with the sense that the conclusion could fail without the premises failing.
So far, so good. But with more thought we see that there are special cases in which the truth of the premises is sufficient to cut down the range of those changese.g. which other futures are possible, what kinds of context are available, or what difference variation in norms could make-in such a way that the truth-value of the conclusion doesn't vary over the reduced range. In such cases the rough motivating argument for the barriers fails: you can get Rı from ∀xRx, Fp from p, and, yes ¬Op from ¬♦p, because e.g. if p is true, only futures which satisfy Fp are on the cards; the variation which would allow a counterexample has been excluded. Having recognised such exceptions, and the way the motivating argument for the barriers fails for them, we can incorporate them into the barriers via the unless clause. Since this meshes with the special cases where the intuitive motivations fail, the result is not ad hoc, but rather a natural and motivated limit on Hume's Law and its fellow barriers.
Declarations There is no funding information, conflict of interest or research involving human participants and/or animals to report for this paper.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.