Chapter 7

Logic of behavior: Sheaves,

toposes, and internal languages

In this chapter, we will study the notion of behavior and interaction by defining a
category BT whose objects we call behavior types. Doing so will refine exactly what
we mean by behavior, as well as how different types of behavior relate. However, our
formulation will do much more: it will give us a formal language and logic in which
to prove properties of behaviors in systems.

7.1 Motivation: a logic for composing machines

Imagine you are trying to design a system of interacting components. You wouldn’t
be doing this if you didn’t have a goal in mind: you want the system to do something,
to behave in a certain way (even gods know what they think is “good” for the system
they design.)
Luckily, in the given case the possible behavior of any system in any environment
is determined by the possible behaviors of each of its components, together with the
precise way in which they interact.1 In this chapter, we will discuss a logic wherein
one can describe general types of behavior that occur over time, and prove properties
of a larger-scale system from the properties and interaction patterns of its components.

7.1.1 Systems and components

For example, suppose we want an autonomous vehicle to maintain a distance of at
least s ≥ safe from another object. To do so, several components must interact: a
1 The well-known concept of emergence is not about possibilities, it is about prediction. Predicting
the behavior of a system given predictions of its components is notoriously hard. The behavior of a
double pendulum is chaotic—meaning extremely sensitive to initial conditions—whereas those of the
two component pendulums are not. However, the set of possibilities for the double pendulum are
completely understood: it is the set of possible angular positions and velocities of both arms. When we
speak of a machine’s properties in this chapter, we always mean the guarantees on its behaviors, not the
probabilities involved.

1
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
2 LANGUAGES
sensor that approximates the real distance by an internal variable s 0, say s 0 ≈ s, a
controller that uses s 0 to decide what action a to take, and a motor that moves the
vehicle with an acceleration based on a. This in turn affects the real distance s, so
there is a feedback loop.
Consider the following model diagram:

sensor controller a motor s

s0

In the diagram shown, the distance s is exposed by the exterior interface. This just
means we imagine s as being a variable that other components of a larger system
may want to interact with. We could have exposed no variables (making it a closed
system) or we could have exposed a and/or s 0.
In order for the system to ensure s ≥ safe, we need each of the components to
ensure a property of its own. But what are these components, “sensor, controller,
motor”, and what do they do?
One way to think about any of the components is to open it up and see how it is put
together; with a detailed study we may be able to say what it will do. For example,
just as s was exposed in the diagram above, one could imagine opening up the sensor
component and seeing an interaction between subcomponents

sensor
radar
s processor s0

sonar

This ability to zoom in and see a single unit as being composed of others is important
for design. But at the end of the day, you eventually need to stop diving down and
simply use the properties of the components in front of you to prove properties of
the composed system. Your job is to design the system at a given level, taking the
component properties of lower-level systems as given.
We will think of each component in terms of the relationship it maintains (through
time) between the ports on its interface. We will make this more precise soon, but
examples should help. The sensor maintains a relationship between s and s 0, e.g. that
they differ by no more than 5cm. The controller maintains a relationship between s 0
and the action signal a, e.g. that if at any time s < safe, then within one second it will
emit the signal a  go. The motor maintains a relationship between a and s, e.g. that
a dictates the second derivative of s by the formula

(a  go ⇒ sÜ > 1) ∧ (a  stop ⇒ sÜ  0). (7.1)

7.1. MOTIVATION: A LOGIC FOR COMPOSING MACHINES 3

The above formula, and the rest, need to have unambiguous interpretations in a
formal logical language, in which we can use standard proof techniques to combine
properties of subsystems into properties of the whole. This is our objective in the
present chapter.

7.1.2 A language for behavioral properties

We have said how component systems, wired together in some arrangement, create
larger-scale systems. We have also said that, given the wiring arrangement, the behav-
ioral properties of the component system behaviors dictate the behavioral properties
of the whole. But what exactly are behavioral properties?
In this chapter, we want to give a formal language and semantics for a very general
notion of behavior. Mathematics is itself gives a formal language; the usual style of
mathematical modeling is to use any piece of this vast language at any time and for
any reason. One uses “human understanding” to ensure that the different linguistic
pieces are fitting together in an appropriate way when different systems are combined.
Where the present work differs is that we want to find a domain-specific language
for modeling behavior, any sort of behavior, and nothing but behavior. Unlike in the
wide world of math, we want a setting where the only things that can be discussed
are behaviors.
For this, we will construct what is called a topos, which is a special kind of category.
Our topos, let’s call it BT, will have behavior types as its objects. An amazing fact
about toposes is that they come with an internal language that looks very much like the
usual formal language of mathematics itself. Thus one can define groups, topological
spaces, etc. in any topos. But in BT, groups will be group-like behavior types, e.g.
where the group changes through time; topological spaces will be topological space-
like behavior types, e.g. where the space changes through time. Rather than living
in the world of sets—where elements are constant through time—we will live in the
world of behavior types, which can change through time.
The topos BT not only has an internal language, but it has a mathematical semantics
using the notion of sheaves. A sheaf is a certain sort of functor. Every property we
prove about behavior types will have meaning in this category of sheaves.
When discussing systems and components above in Section 7.1.1, we mentioned
behavior types; these will be the objects in the topos BT. Every wire in the picture
below will stand for a behavior type, and every box will stand for a behavior contract,
relating the wires it touches.

sensor controller a motor s

s0

For example
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
4 LANGUAGES
• There is a behavior type for distances s between our vehicle and the other object;
perhaps its behaviors are real-valued continuous functions of time.
• There is a behavior type for action-signals a emanating from the controller;
perhaps its behaviors are piecewise-constant functions of time taking values in
a finite set such as {go, stop}.
• The controller itself is a behavior contract on pair (s 0 , a), while the motor is a
behavior contract on a pair (a, s) e.g. the one shown in Eq. (7.1).

7.2 Introduction to toposes, sheaves, and their logic

In this section, we introduce toposes and sheaves. We give a brief history and some
first definitions in Section 7.2.1. Then we discuss topological spaces and sheaves on
them in Section 7.2.2. This leads into the definition and basic properties of toposes,
which we discuss in Section 7.2.3. In particular, we explain how toposes are related to
logic in Section 7.2.4 and quickly discuss type theories and semantics in Section 7.2.5.
We will not discuss a specific topos of behavior types until Section 7.3.

7.2.1 Toposes
A topos is defined to be a category of sheaves.2 So for any space (X, Op), the category
Shv(X, Op) defined in Definition 7.10 is a topos. Also, for any database schema—i.e.
finitely presented category—C, the category C-Inst of database instances on C is a
topos. Toposes encompass both of these sources of examples, and much more.
The point is, a topos is a category E that happens to be the category of sheaves
on something. There are several things that make toposes really nice; one is that
every topos has much of the same structural properties that the category Set has. For
example, here are some structures and properties enjoyed by every topos E:
1. E has all limits,
2. E has all colimits,
3. E is cartesian closed,
4. E has epi-mono factorizations,
true
5. E has a subobject classifier 1 −−−→ Ω
We need to explain a few of these.

Limits and colimits We discussed limits and colimits briefly in ??, but the basic idea
is that one can make new objects from old by taking Cartesian products of objects,
using equations to define subobjects, forming unions, and taking quotients. There is
also a terminal object 1 and an initial object 0.

2 This is sometimes called a sheaf topos or a Grothendieck topos. There is a more general sort of topos
called an elementary topos due to Lawvere.
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 5

Epi-mono factorizations Having epi-mono factorizations means that every mor-

phism f : c → d in E has a unique “image”; that is, there is an object im( f ), an
epimorphism c  im( f ) and a monomorphism im( f )  d, whose composite is f .

Cartesian closed Being cartesian closed means that for any two objects c, d ∈ E, one
has a “hom-object” d c ∈ E and a natural isomorphism E(a × c, d)  E(a, d c ) for every
a ∈ E. See ??.

Subobject classifier The subobject classifier is more subtle but gives rise to a rich
logical system. We give the definition here and then discuss the corresponding logic
for a simple example in Section 7.2.3.1.

Definition 7.1. Let E be a category with finite limits. A subobject classifier in E is an

object Ω ∈ E and a monomorphism true : 1 → Ω satisfying the following property:
for any monomorphism m : X  Y in E, there is a unique morphism p m q : Y → Ω
such that the diagram on the left of Eq. (7.3) is a pullback in E:

!
X 1 {Y | p} 1
y y
m true true (7.2)

Y Ω Y Ω
pm q p

We refer to p m q as the characteristic map of m, or we say that p m q classifies m. Con-

versely, given any map p : Y → Ω, we denote the pullback of true as on the right of
Eq. (7.3).

A subobject classifier is a very rich mathematical notion. It’s like a technological

gadget that opens up a whole new world of possibilities. Most categories do not
have a subobject classifier, but toposes do. To begin to make sense of Definition 7.17,
we will now explain how to think about subobject classifiers in a simple case: the
category of sets.

7.2.1.1 Doing logic in the topos Set

We saw in Example 7.15 that the category Set is a topos. The object Ω is played by the
set of booleans,
ΩSet B B  {true, false}. (7.3)

By definition (Def. 7.17), the subobject classifier comes with a morphism, generically
called true : 1 → Ω; in the case of Set it is played by the function 1 → {true, false}
that sends 1 to true. In other words, it is aptly named.
For sets, monomorphism just means injection. So Definition 7.17 says that for
any injective function m : X → Y between sets, we are supposed to be able to find a
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
6 LANGUAGES
characteristic function p m q : Y → {true, false} with some sort of pullback property.
We propose the following:
(
true if ∃(x ∈ X). m(x)  y
p m q (y) B
false otherwise

for any y ∈ Y. The pullback property says that { y | p y q  true} is isomorphic to X,

which one can check by looking at the above definition of p m q .
Exercise 7.2. Let’s continue to work in the topos Set. Let X  N  {0, 1, 2, . . .}
and Y  Z  {. . . , −1, 0, 1, . . .}; we have X ⊆ Y, so consider it as a monomorphism
m : X → Y. Since Set is a topos, there must be a characteristic function p m q : Y → B,
as in Definition 7.17. What is p m q (−5) ∈ B? ♦

Introduction to topos logic: obtaining the AND operation Consider the function
1 → B × B picking out the element (true, true). This is a monomorphism, so it
defines a characteristic function p (true, true) q : B × B → B. What function is it? By
Definition 7.17 the only element of B × B that can be sent to true is (true, true). Thus
p (true, true)q (P, Q) ∈ B must be given by the following truth table

P Q p (true, true)q (P, Q)

true true true
true false false
false true false
false false false

This is the truth table for the AND of P and Q, i.e. for P ∧ Q. In other words,
p (true, true)q  ∧.

Obtaining the OR operation Let’s go backwards this time. Starting from the truth
tables for the OR of P and Q, i.e. that of the function ∨ : B × B → B defining OR, is:

P Q P∨Q
true true true
true false true (7.4)
false true true
false false false

If we wanted to obtain this function as the characteristic function p m q of some subset

m : X ⊆ B × B, what subset would X be? As always, X should be the preimage of
true. It is the characteristic map for the three element subset

{(true, true), (true, false), (false, true)} ⊆ B × B.

To prepare for a more general setting soon, one can think of this three-element subset
as the union of {true} × B and B × {true}.
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 7

Exercise 7.3. Every boolean has a negation, ¬false  true and ¬true  ⊥. The
function ¬ : Bool → Bool is the characteristic function of something. What? ♦
Exercise 7.4. Consider the subsets E B {n ∈ N | n is even}, P B {n ∈ N | n is prime},
and T B {n ∈ N | n ≥ 10}.
1. What is p E q (17)?
2. What is p P q (17)?
3. What is p T q (17)?
4. Name the smallest three elements in the set classified by ( p T q ∧ p P q ) ∨ p E q .
♦

7.2.1.2 Generalizing logic to an arbitrary topos

Now that we understand how the logical operations AND and OR

Logical connectives In any topos, we have a map true : 1 → Ω, so we have

(true, true) : 1 → Ω × Ω. It is a monomorphism, so it defines a characteristic map
which we denote ∧ : Ω × Ω → Ω.
Consider the maps hid, truei : Ω × 1 → Ω × Ω and htrue, idi : 1 × Ω → Ω × Ω. This
defines a universal map from the coproduct [hid, truei, htrue, idi]Ω × 1 + 1 × Ω →
Ω×Ω, and taking its image we get a mono im([hid, truei, htrue, idi])  Ω×Ω whose
characteristic map we denote ∨.
Exercise 7.5.
1. In the topos Set, when Ω  B, what is the image of

[hid, truei, htrue, idi] : (Ω × 1) + (1 × Ω) → Ω × Ω?

2. Check: does it classify OR?

♦
Consider the diagonal map Ω → Ω × Ω; it is a monomorphism and we denote its
characteristic map ⇔.
Consider the two maps π1 , ∧ : Ω × Ω → Ω sending (P, Q) to P and to P ∧ Q
respectively. Pairing them up and composing with ⇔, we obtain ⇒, as shown:

Ω×Ω Ω×Ω ⇔ Ω
hπ1 ,∧i

In other words, p ⇒ q means p ⇔ (p ∧ q). From this one can prove the formulas

[p ∧ (p ⇒ q)]  [p ∧ q] and [(p ∧ q) ⇒ r]  [p ⇒ (q ⇒ r)] (7.5)

as translated into equalities between maps, Ω × Ω ⇒ Ω and Ω × Ω × Ω ⇒ Ω,

respectively.
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
8 LANGUAGES
Exercise 7.6. In Set, we have Ω  B.
1. Write down the truth table of ∧ : B × B → B.
2. Write down the truth table of π1 : B × B → B.
3. Write down the subset {(b1 , b2 ) ∈ B × B | (b1 ∧ b2 )  π1 (b1 , b2 )}.
4. Is your answer to c. the same as the set {(b 1 , b2 ) ∈ B × B | b1 ≤ b2 }?
♦
The inclusion 0 → 1 is a monomorphism; its characteristic map is denoted
false : 1 → Ω.
id ×false ⇒
Consider the composite Ω × 1 −−−−−−−→ Ω × Ω −→ Ω. We denote this map by ¬.

7.2.2 Presheaves
Sheaf theory began before category theory, e.g. in the form of local coefficient systems
for homology groups. However its modern formulation in terms of functors and sites
is due to Grothendieck, who also invented toposes.
The basic idea is that rather than study spaces, we should study what happens on
spaces. A space is merely the “site” at which things happen. For example, if we think
of the plane R2 as a space, we examine only points and regions. But if we think of
R2 as a site where things happen, then we might think of things like weather systems
throughout the plane, or sand dunes, or trajectories and flows. There are many sorts
of things that can happen on a space; each sort should correspond to a sheaf on that
space. Points, or certain regions, are then regarded in terms of how we can restrict
our attention to what is happening there. Still, it’s all about what’s happening.
This is reminiscent of databases. The schema of a database is not the interesting
part; the data is what’s interesting. Indeed, the schema of a database is a site and the
category of all instances on it is a topos. In general, we can think of any small category
C as a site; the corresponding topos is the category of functors C op → Set.3

Definition 7.7. Let C be a small category. A presheaf P on C is a functor P : C op → Set.

To each object c ∈ C, we refer to the set P(c) as the set of sections of P at c. To each
morphism f : c 0 → c, we refer to the function P( f ) : P(c) → P(c 0) as the restriction map

along f . For any section s ∈ P(c), we may denote P( f )(s) ∈ P(c 0) by s c0 if f is clear
from context.
If P and Q are presheaves, a morphism f : P → Q between them is a natural
transformation of functors C op → Set.

Example 7.8. Let ArShp be the category shown below:

Vertex src Pure Arrow

ArShp B • •
tgt

3 The category of functors C → Set is also a topos: use C op as the defining site.
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 9

A presheaf on ArShp is a functor I : ArShpop → Set, which is a database instance

on ArShpop . Note that ArShpop is what we called Gr in ??; there we showed that
database instances on this category—i.e. presheaves on ArShp— are just directed
graphs.
The reason we called our category ArShp above is that we can imagine of it as an
“arrow shape”.
Vertex B

src tgt

Pure Arrow B

Presheaves are functors from opposite categories, basically because they were fash-
ioned off of topological spaces. Information on bigger spaces restricts to information
on smaller spaces, and this is opposite to the inclusion of smaller into bigger. 
The point is that presheaves are relatively easy: they’re basically database in-
stances; see ??. The difference between presheaves and sheaves is that sheaves take
into account some sort of “covering information”. The trivial notion of covering is to
say that every object covers itself and nothing more; if one uses this trivial covering,
presheaves and sheaves are the same thing. In our context we will need a non-trivial
notion of covering, so sheaves and presheaves will be slightly different. Our next goal
is to understand sheaves on a topological space.

7.2.3 Sheaves on topological spaces

We continue our march toward precision. While sites are very general objects, one
of the easiest sorts of sites to think about are those coming from topological spaces.
Every topological space naturally has the structure of a site. So let’s begin by recalling
the definition of topological space.

7.2.3.1 Review of topological spaces

Definition 7.9. Let X be a set, and let P(X)  {U ⊆ X} denote its set of subsets. A
topology on X is a subset Op ⊆ P(X). Given a subset U ⊆ X, we will say it is open if
U ∈ Op. In order to be a topology, Op needs to satisfy the following conditions:
a. Whole set: the subset X ⊆ X is open, i.e. X ∈ Op.
b. Binary intersections: if U, V ∈ Op then (U ∩ V) ∈ Op.
c. Arbitrary unions: if I is a set and if we are given an open set U i ∈ Op for each i,
Ð

then their union is also open, i∈I U i ∈ Op. We interpret the particular case
where I  ∅ to mean that the empty set is open: ∅ ∈ Op.
If U  i∈I U i , we say that (U i )i∈I covers U.
Ð

A pair (X, Op), where X is a set and Op is a topology on X, is called a topological

space.
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
10 LANGUAGES
A continuous function between topological spaces (X, OpX ) and (Y, OpY ) is a func-
tion f : X → Y such that for every U ∈ OpY , the preimage f −1 (U) is in Op(X).

It will be the last item in the above list—arbitrary unions—that gives rise to the
notion of covering we use to define sheaves. That is, we will see in Definition 7.10
how coverings U  i∈I U i come into play.
Ð

Example 7.10. The usual topology Op on R2 is based on “-balls”. For any  ∈ R with
 > 0, and any point (x, y) ∈ R2 , let B(x, y; )  {(x 0 , y 0) ∈ R2 | (x−x 0)2 +(y− y 0)2 < 2 }:
it is the set of all points within  of (x, y), and we call it the -ball centered at (x, y).

(x, y)

U 

an  -ball centered at (x, y)

an open set U ⊆ R2 , a point (x, y) ∈ U , and an

-ball B(x, y; ) ⊆ U .

For any subset U ⊆ R2 , we call it open and put it in Op if, for every (x, y) ∈ U there
exists an  > 0 such that B(x, y; ) ⊆ U.
The same idea works for any Lawvere metric space X (??): it can be considered as
a topological space where the open sets are subsets U such that for any p ∈ U there is
an -ball centered at p and contained in U. 
Exercise 7.11.
1. Define the usual topology on R.
2. Find three open sets U1 , U2 , U, such that (U i )i∈{1,2} covers U.
3. Find an open set U and a collection (U i )i∈I of opens sets where I is infinite, such
that (U i )i∈I covers U.
♦
Example 7.12. For any set X, there is “coarsest” topology, having as few open sets as
possible: Opcrse  (∅, X). There is also a “finest” topology, having as many open sets
as possible: Opfine  P(X). The latter, (X, P(X)) is called the discrete space on the set X.

Exercise 7.13.
1. Verify that for any set X, what we called Opcrse in Example 7.6 really is a
topology, i.e. satisfies the conditions of Definition 7.3.
2. Verify also that Opfine really is a topology.
3. Show that if (X, P(X)) is discrete and (Y, OpY ) is any topological space, then
every function X → Y is continuous.
♦
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 11

Example 7.14. There are four topologies possible on X  {1, 2}. Two are Opcrse and
Opfine from Example 7.6. The other two are:

Op1 B {∅, {1}, X} and Op2 B {∅, {2}, X}

The two topological spaces ({1, 2}, Op1 ) and ({1, 2}, Op2 ) are isomorphic; either one
can be called the Sierpinski space. 
Given a topological space (X, Op), the set Op has the structure of a poset using
the subset relation. It is reflexive because U ⊆ U for any U ∈ Op, and it is transitive
because if U ⊆ V and V ⊆ W then U ⊆ W. Thus we can regard Op as a category in
the usual way: every poset is a kind of category.
Exercise 7.15. Recall the Sierpinski space, say (X, Op1 ) from Example 7.8.
1. Write down the Hasse diagram for its poset of opens.
2. Write down all the coverings.
♦
Exercise 7.16. Given any topological space X, any subset Y ⊆ X can be given the
subspace topology. This topology defines any A ⊆ Y to be open if there is an open set
B ⊆ X such that A  B ∩ Y.
1. Find an open set B ⊆ X that shows that the whole set Y is open.
2. Show that the inclusion function Y ,→ X is a continuous function.
♦
Remark 7.17. Suppose (X, Op) is a topological space, and consider the poset (Op, ⊆)
of open sets. It turns out that (Op, ⊆, X, ∩) is always a navigator in the sense of ??,
though we will not need that fact.

7.2.3.2 Definition of sheaf on a topological space

Definition 7.18. Let (X, Op) be a topological space, and let P : Opop → Set be a
presheaf on Op.
Let (U i )i∈I be a collection of open sets U i ∈ Op covering U  i∈I U i . A matching
Ð

family (s i )i∈I of P-sections over (U i )i∈I consists of a section s i ∈ P(U i ) for each i such
that for every i, j ∈ I we have
 
s i U ∩U  s j U ∩U .
i j i j

Given a matching family (s i )i∈I for the cover U  i∈I U i , we say that s ∈ P(U) is
Ð

the gluing, or glued section, of the matching family if s U  s i holds for all i ∈ I.
i
If there exists a unique gluing s ∈ P(U) for every matching family (s i )i∈I , we say
that P satisfies the sheaf condition for the cover U  i∈I U i .
Ð

If P satisfies the sheaf condition for every cover, we say that P is a sheaf.
Thus a sheaf is just a presheaf satisfying the sheaf condition. If P and Q are sheaves,
then a morphism f : P → Q is just a morphism—that is, a natural transformation—of
their underlying presheaves. We denote by Shv(X, Op) the category of sheaves on X.
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
12 LANGUAGES
In particular, if I  ∅, so U  ∅, then the empty tuple () is a matching family of
P-sections, and it is the only one. Thus every s ∈ P(∅) is a gluing for the unique
matching family.

Example 7.19. Consider the function f : X → Y shown below, where each element of X
is mapped to the element of Y immediately below it. For example, f (a 1 )  f (a 2 )  a,
f (b 1 )  b, and so on.

b3
•
a2 b2 e2
XB • • •
a1 b1 c1 e1
• • • •

a b c d e
YB • • • • •

Let’s consider X and Y as discrete spaces, so f is continuous (see Exercise 7.7). For
any subset U ⊆ Y, one can consider the set Sec f (U) of functions 1 : U → X such that
f ◦ 1(x)  x for all x ∈ U; let’s call this set Sec f (U). Let’s say U  {a, b}. How many
such 1 are there?

Let’s clip the picture and look only at the relevant part:

11 12 13 14 15 16
• • • • • •
• • • • • • • • • • • •
• • • • • • • • • • • •

• • • • • • • • • • • •

(7.6)
So Sec f (U) B {1 : U → X | f ◦1(x)  x for all x ∈ U} is the set of sections {11 , . . . , 16 },
as in “cross-sections”, shown above.

The restriction maps are easy: if V ⊆ U, say V  {a}, then given a section 1 as
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 13

above, we get a section over V by “restricting” our attention to what 1 does on a.

     
11 V  12 V  13 V 14 V  15 V  16 V
• •
• •

• •

Now we have explained the presheaf, though we will give you a chance to work
it out a bit more in Exercise 7.13. To understand the sheaf condition, consider the
set U1  {a, b} and U2  {b, e}. These cover the set U  {a, b, e}. A matching
family for this cover is a section 1 of U1 and a section of U2 that agree on the overlap,
U1 ∩ U2  {b}. So consider 1 ∈ Sec f (U1 ) and h ∈ Sec f (U2 ) shown below.

1 h
b3 b3
• •
a2 b2 b2 e2
• • • •
a1 b1 b1 e1
• • • •

a b b e
• • • •

Since sections 1 and h agree on the overlap—they both send b to b2 —the two sections
can be glued to form a single section over U  {a, b, e}:

glued section
b3
•
a2 b2 e2
• • •
a1 b1 e1
• • •

a b e
• • •


Exercise 7.20. Refer to Example 7.12.
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
14 LANGUAGES
1. Let U  {a, b, c}. Draw all the sections over it, i.e. all elements of Sec f (U), as
we did in Eq. (7.2).
2. Let U  {a, b, c, d}. Again draw all the sections, Sec f (U).
3. Let U  {a, b, d, e}. How many sections (elements of Sec f (U)) are there?
♦
?? generalizes to any continuous function between topological spaces.
Example 7.21. Let f : (Y, OpY ) → (X, OpX ) be a continuous function. Consider the
op
functor Sec f : OpX → Set given by

Sec f (U) B {1 : U → Y | 1 is continuous and 1. f  ι U },

where ι : U → X is the inclusion of U into X. The morphisms of OpX are inclusions


V ⊆ U; given 1 : U → Y and V ⊆ U, there is a well-known notion of restriction 1 V
of 1 to V. One could define it as the composite V ⊆ U → Y. This usual terminology

of restriction, as well as the notation 1 V , is exactly what we used in Definition 7.10,
and this was not a coincidence. On morphisms, we define the functor Sec f to be
restriction in this usual sense.
Is Sec f a sheaf? Let (U i )i∈I be a collection of open sets, let U  i∈I U i be the
Ð

union, and let (1i )i∈I be a matching family of Sec f -sections over it. We need to check

that there is a unique section 1 ∈ Sec f (U) such that 1 U  1i .
i
The easy case is when I  ∅ and hence U  ∅. We’re supposed to show that
Sec f (∅) has one element. Indeed, there is exactly one continuous map 1 : ∅ → Y, and
1. f ! : ∅ → X.
In the general case, suppose we have a function 1i : U i → Y for all i. To say
 
they match means that 1i U ∩U  1 j U ∩U for every i, j ∈ I. But then at every point
i j i j
x ∈ U all of the 1i ’s defined on x agree about where in Y the point x should be sent:
1i (x)  1 j (x) for all i, j. Thus we define a function 1 : U → Y on x by choosing any i
where x ∈ U i and letting 1(x) B 1i (x). Indeed, this is the only possibility that could

possibly satisfy the sheaf condition 1 U  1i , from Definition 7.10.
i
To see that it works, it remains to check the continuity condition and the 1. f  ι
condition. These are straightforward. 
Example 7.22. A nice example of a sheaf on a space M is that of vector fields on M. If
you calculate the wind velocity at every point on earth, you will have what’s called
a vector field on Earth. If you know the wind velocity at every point in Afghanistan
and I know the wind velocity at every point in Pakistan, and our calculations agree
around the border, then we can glue our information together to get the wind velocity
over the region including both countries. All possible wind velocity fields over all
possible open sets of earth’s surface together form the sheaf.
A manifold M—you can just imagine the sphere above—has something called a
tangent bundle. It is a space TM whose points are pairs (m, v), where m ∈ M is a
point in the manifold and v is a tangent vector there. We are taught in linear algebra
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 15

that vectors always start at the origin; that may be so, but there is a separate “origin”
for every point m ∈ M. Here’s a picture of one tangent plane on a sphere:

m ⊆ TM
v
MB

The tangent bundle M includes that whole tangent plane—including the three vectors
drawn on it—as well as the tangent plane at every other point on the sphere.
The tangent bundle TM comes with a continuous map π : TM → M back down
to M, sending (m, v) 7→ m. By Example 7.11, π defines a sheaf Secπ . It is called the
sheaf of vector fields on M. Given an open subset U ⊆ M, an element v ∈ Secπ (U) is
called a vector field over U because it continuously assigns a tangent vector v(u) to
each point u ∈ U.
One can prove that for every open set U, as long as U , M, there is a vector field
v ∈ Secπ (U) that is never 0: the wind could be blowing throughout U. However, if
you look at the whole M, there is guaranteed to be a point m ∈ M at which the wind
is not blowing at all. This difference between local sections (over arbitrary U ⊆ X)
and global sections (over X) is measured by cohomology, which we mentioned in ??.


Example 7.23. The one-point set X  {1} has a unique topology, Op  {∅, {1}}. Any
sheaf on (X, Op) is a functor P : Opop → Set. The only covering we have is that the
empty cover covers the empty set, so for P to be a sheaf, we must have P(∅)  {∗}: it
must be a one-element set. There is only one possible restriction map P(X) → P(∅)
because there is only one function from anything to {∗}. Thus the only data in P is
the set P(X) ∈ Set.
The upshot is that we can identify sheaves on {1} with sets, Shv({1})  Set. 

Exercise 7.24. Consider the Sierpinski space ({1, 2}, Op1 ) from Example 7.8.
1. What is the category Op for this space? (You may have already figured this out
in Exercise 7.9; if not, do so now.)
2. What is a presheaf on Op?
3. What is the sheaf condition for Op?
4. How do we identify a sheaf on Op with a set?
5. How do we identify a morphism of sheaves on Op with a function?
♦
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
16 LANGUAGES
7.2.4 Doing logic in the topos of sheaves on a space
We discussed sheaves on a topological space in Section 7.2.2. We now know that the
category of sheaves on a space (X, Op) forms a topos E  Shv(X, Op). In particular,
this means it satisfies the five properties on page 12, and using these properties, one
can do logic with semantics in the topos E. That is, the logical symbols are operations
that mean something about sheaves, e.g., relating vector fields, sections of maps, etc.
To understand this more deeply, we should say what the subobject classifier Ω
is. We did this for the topos Set, where Ω  B is the booleans. In the topos
E  Shv(X, Op), the subobject classifier Ω ∈ E would also have to be a sheaf. What
sheaf is it?

7.2.4.1 The subobject classifier Ω in a sheaf topos

Let’s go through the definition of sheaf (Definition 7.10) slowly. We’re supposed to
understand Ω as a presheaf, and then show that it satisfies the sheaf condition. A
presheaf is just a functor Ω : Opop → Set; it assigns a set Ω(U) to each open U ⊆ X
and comes with a restriction map Ω(U) → Ω(V) whenever V ⊆ U. So in our quest to
understand Ω, we have simplified the question: what presheaf is it?

Ω as a presheaf We will not prove it here, but the answer to our question is that Ω
is the presheaf that assigns to U ∈ Op the following set:

Ω(U) B {U 0 ∈ Op | U 0 ⊆ U}. (7.7)

It is the presheaf that assigns to each open U ∈ Op the set of open subsets of U. Given
V ⊆ U, the restriction function Ω(U) → Ω(V) sends U 0 to U 0 ∩ V. One can check that
this is functorial—see Exercise 7.23—but after doing so we will still need to see that it
satisfies the sheaf condition.

Exercise 7.25.
1. Show that the definition of Ω given above is functorial, i.e., that whenever
U ⊆ V ⊆ W, the restriction map Ω(W) → Ω(V) followed by the restriction map
Ω(V) → Ω(U) is the same as the restriction map Ω(W) → Ω(U).
2. Is that all that’s necessary to conclude that Ω is a presheaf?
♦

Ω as a sheaf To see that Ω satisfies the sheaf condition, suppose that we have a cover
U  i∈I U i , and suppose given an element Vi ∈ Ω(U i ), i.e. an open set Vi ⊆ U i , for
Ð

each i ∈ I. Suppose further that for all i, j ∈ I, it is the case that Vi ∩ U j  Vj ∩ U i ,

i.e. that the elements form a matching family in the sense of Definition 7.10. Define
Ð
V B i∈I Vi ; it is an open subset of U, so we can consider V as an element of Ω(U).
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 17

The following verifies that V is a gluing for the (Vi )i∈I :

! !
Ø Ø Ø Ø
V ∩ Uj  Vi ∩ U j  (Vi ∩ U j )  (Vj ∩ U i )  U i ∩ Vj  Vj
i∈I i∈I i∈I i∈I

In other words V ∩ U j  Vj for any j ∈ I.

Upshot: Truth values are open sets The point is that the truth values in the topos
of sheaves on a space (X, Op) are the open sets of that space. When someone says “is
property P true?”, the answer is not yes or no, but “it is true on the open subset U”.
If this U is everything, U  X, then P is really true; if U is nothing, U  ∅, then P is
really false. But in general, it’s just true some places and not others.
Example 7.26. If X  {1} is a one-point space, we already know three things:
1. that Shv(X)  Set by Example 7.15,
2. that the subobject classifier for Set is Ω  B  {true, false} by Eq. (7.4), and
3. Ω is the sheaf of open sets, by Eq. (7.7).
To justify 2 and 3, it suffices to recognize that X has exactly two open sets, namely {1}
and ∅, and these correspond to the truth values true and false respectively. 

7.2.4.2 Logic in a sheaf topos

Logical connectives Let’s consider the logical connectives, AND, OR, IMPLIES, and
NOT. Suppose we have an open set U ∈ Op. Given two open sets V1 , V2 , considered
as truth values V1 , V2 ∈ Ω(U), then their conjunction “U AND V” is their intersection,
and their disjunction “U OR V” is their union;

(U ∧ V) B U ∩ V and (U ∨ V) B U ∪ V.

It’s easy to remember, because ∧ looks like ∩ and ∨ looks like ∪. The formula for
U ⇒ V is “the largest open set R such that R ∩ U ⊆ V, i.e.
Ø
(U ⇒ V) B R.
{R∈Op|R∩U⊆V }

In general, it is not easy to reduce this further, so implication is the hardest logical
connective to think about topologically.
Finally, the negation of U is given by ¬U  U ⇒ false, and this turns out to be
relatively simple. By the above formula, it is the union of all R such that R ∩ U  ∅,
i.e. the union of all open sets in the complement of U, which is the interior of the
complement.
Example 7.27. Consider the real line X  R as a topological space (see Exercise 7.5).
Let U, V ∈ Ω(X) be the open sets U  {x ∈ R | x < 3} and V  {x ∈ R | −4 < x < 4}.
Using interval notation, U  (−∞, 3) and V  (−4, 4). Then
• U ∧ V  (−4, 3).
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
18 LANGUAGES
• U ∨ V  (−∞, 4).
• ¬U  (3, ∞).
• ¬V  (−∞, −4) ∪ (4, ∞).
• (U ⇒ V)  (−4, ∞)
• (V ⇒ U)  U

Exercise 7.28. Consider the real line R as a topological space, and consider the open
subset U  R − {0}.
1. What open subset is ¬U?
2. What open subset is ¬¬U?
3. Is it true that U ⊆ ¬¬U?
4. Is it true that ¬¬U ⊆ U?
♦

Predicates In English, a predicate is the part of the sentence that comes after the
subject. For example “is even” or “likes the weather” are predicates. Not every subject
makes sense for a given predicate; e.g. “7 is even” makes sense, whereas “2.7 is even”
does not, and “2.7 likes the weather” does not. So predicates are associated to types:
the type of subject that makes sense.
When we apply a predicate to a subject of the appropriate type, the result has a
truth value: “7 is even” is either true or false. Perhaps “Bob likes the weather” is
true some days and false on others. In fact, this truth value might change by the year
(bad weather this year), by the season, by the hour, etc. In English, we expect truth
values to change over time, which is exactly the subject of this chapter. We’re working
toward a logic where truth values change over time.
In a topos E  Shv(X, Op), a predicate is a sheaf morphism p : S → Ω where S ∈ E
is a sheaf. By Definition 7.10 we get a function p(U) : S(U) → Ω(U) for any open set
U. That means that for any local section of S, the predicate p returns a truth value.
In the above example—which we will define more carefully in Section 7.3—if S is the
sheaf of people (people come and go over time), and Bob ∈ S(U) is a person existing
over a time U, and p is “likes the weather”, then p(Bob) ⊆ U is the subset of times
when Bob likes the weather. So the answer to “Bob likes the weather” is something
like “in summers yes, and also in April 2018 and May 2019 yes, but in all other times
no”.
Exercise 7.29. By Definition 7.17, any predicate p : S → Ω defines a subobject of S.
So a predicate like “likes the weather” on the sheaf S of people defines a subsheaf.
Describe its sections. ♦
For any topos E  Shv(X, Op) and object (sheaf) S ∈ E, the set of predicates
E(S, Ω) forms a poset, which we denote

(|ΩS |, ≤ S ) (7.8)
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 19

The elements of |ΩS | are the predicates on S; the order relation ≤ S is as follows. Given
two predicates p, q : S → Ω, we say that p ≤ S q if the first implies the second. More
precisely, for any U ∈ Op and section s ∈ S(U) we obtain two open subsets p(s) ⊆ U
and q(s) ⊆ U. We say that p ≤ S q if p(s) ⊆ q(s) for all U ∈ Op and s ∈ S(U). We often
drop the superscript from ≤ S and simply write ≤. In formal logic notation, one might
write p ≤ S q using the ` symbol, e.g. in one of the following ways:

s : S | p(s) ` q(s) or p(s) `s:S q(s).

In particular, if S  1 is the terminal object, we denote |ΩS | by |Ω|, and refer to

elements p ∈ |Ω| as propositions. They are just morphisms p : 1 → Ω.
All of the above logical symbols make sense in any such poset |ΩS |. Moreover,
the ∧ symbol is the meet and the ∨ symbol is the join. That is for any two predicates
p, q : S → Ω, we define (p ∧ q) : S → Ω by (p ∧ q)(s) B p(s) ∧ q(s), and similarly for
∨. One says that these operations are computed pointwise on S.
With all of the logical structure we’ve defined so far, the poset |ΩS | of predicates
on S forms what’s called a Heyting algebra. We will not define it here, but more
information can be found in Section 7.4. We now move on to quantification.

What is quantification? Quantification comes in two flavors: universal and exis-

tential, or “for all” and “there exists”. Each takes a predicate of n + 1 variables and
returns a predicate of n variables.
Example 7.30. Suppose we have two sheaves S, T ∈ Shv(X, Op) and a predicate p : S ×
T → Ω. Let’s say T represents what’s considered newsworthy and S is again the set
of people. So for a subset of time U, a section t ∈ T(U) means a piece of news that
lasts throughout the whole of U and a section s ∈ S(U) means a person that lasts
throughout the whole of U. Let’s imagine the predicate p as “s is worried about t”.
Then “for all t in T, s is worried about t” is a predicate on S, which we denote
∀(t : T). p. Applying this predicate to a person s returns the times when that person
is worried about everything in the news. Similarly, “there exists t in T such that s is
worried about t” is also a predicate on S, which we denote ∃(t : T). p(s, t). Note that
this predicate has a free variable s, so we can apply it to a person s. Doing so returns
the times when that person is worried about at least one thing in the news. 
Exercise 7.31. In the topos Set, where Ω  B, consider the predicate p : N × Z → B
given by
(
true if n ≤ |z|
p(n, z) 
false if n > |z|

1. What are all the n ∈ N for which the predicate ∀(z : Z). p(n, z) holds?
2. What are all the n ∈ N for which the predicate ∃(z : Z). p(n, z) holds?
3. What are all the z ∈ Z for which the predicate ∀(n : N). p(n, z) holds?
4. What are all the z ∈ Z for which the predicate ∃(n : N). p(n, z) holds?
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
20 LANGUAGES
♦
So given p, we have universally- and existentially-quantified predicates ∀(t :
T). p(s, t) and ∃(t : T). p(s, t) on S. What are they as sheaf morphisms S → Ω
or, equally good, as subsheaves of S?

Universal quantification Given a predicate p : S×T → Ω, the universally-quantified

predicate ∀(t : T). p(s, t) takes a section s ∈ S(U), for any open set U, and returns
a certain open set V ∈ Ω(U). Namely, it returns the largest open set V for which

p(s V , t)  V for all t ∈ T(V).

Exercise 7.32. Apply the above definition to the “person s is worried about news t”
example above.
1. What open set is ∀(t : T). p(s, t) for a person s?
2. Does it have the semantic meaning you’d expect?
♦
Exercise 7.33. Apply the above definition to the “person s is worried about news t”
example above. For a person s, does the open set ∀(t : T). p(s, t) have the desired
semantic meaning? ♦
Abstractly speaking, the universally-quantified predicate corresponds to the sub-
sheaf given by the following pullback:

∀t p 1
trueT

S ΩT
p0

where p 0 : S → ΩT is the transpose of S × T → Ω and trueT is the transpose of the

! true
composite 1 × T →
− 1 −−−→ Ω.

Existential quantification Given a predicate p : S × T → Ω, the existentially quanti-

fied predicate ∃(t : T). p(s, t) takes a section s ∈ S(U), for an open set U, and returns
a certain open set V ∈ Ω(U). To find it, consider all the open sets Vi for which there

exists some t i ∈ T(Vi ) satisfying p(s V , t i )  Vi ; then V B i Vi is their union. Note
Ð
i
that there may be no t ∈ T(V) such that p(s, t) holds! Thus the existential quantifier
is doing a lot of work “under the hood”, taking into account the idea of coverings.

Exercise 7.34. Apply the above definition to the “person s is worried about news t”
example above.
1. What open set is ∃(t : T). p(s, t) for a person s?
2. Does it have the semantic meaning you’d expect?
♦
7.2. INTRODUCTION TO TOPOSES, SHEAVES, AND THEIR LOGIC 21

Abstractly speaking, the existentially-quantified predicate is given as follows. Start

with the subobject classified by p, namely {(s, t) ∈ S × T | p(s, t)} ⊆ S × T, compose
with the projection S × T → S as on the upper right; then take the epi-mono factor-
ization as on the lower left:

{S × T | p} S×T
π

∃t p S

Then the bottom map is the desired subsheaf.

7.2.4.3 Modalities

Back in ?? we discussed modal operators—also known as modalities—which we said

were closure operators on posets which arise in logic. The posets we were referring
to are the ones discussed in Eq. (7.8): for any object S ∈ E there is the poset (|ΩS |, ≤ S )
of predicates on S.

Definition 7.35. A modality in E is a sheaf morphism j : Ω → Ω satisfying three

properties:
1. idΩ ≤ j, where idΩ : Ω → Ω is the identity;
2. j. j ≤ j; and
3. the following diagram commutes:

∧
Ω×Ω Ω
j×j j

Ω×Ω j
Ω

Note that 1. and 2. together say that j is a closure operator in the sense of ??; they
together imply that j. j  j.

Proposition 7.36. Suppose that E is a topos, Ω is its subobject classifier, and j : Ω → Ω is a

modality on E. Then for any S ∈ E and predicates p, q ∈ |ΩS |, one has

p ∧ j(p ⇒ q) ≤ jq

Proof. By the universal property of meets in a poset, x ≤ x 0 and y ≤ y 0 imply

(x∧x 0) ≤ (y∧ y 0). By Definition 7.33 1., p ≤ jp, and by reflexivity j(p ⇒ q) ≤ j(p ⇒ q).
Thus, also using 3.,

(p ∧ j(p ⇒ q)) ≤ (jp ∧ j(p ⇒ q))  j(p ∧ (p ⇒ q))

By the adjunction Eq. (7.6) and the definition of meets, we have p ∧(p ⇒ q)  p ∧q ≤ q.
Thus applying j we have j(p ∧ (p ⇒ q)) ≤ j(q), and we are done. 
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
22 LANGUAGES
In ?? we informally said that for any proposition p, e.g. “Bob is in San Diego”,
there is a modal operator “assuming p, ...”. Now we are in a position to make that
formal.

Proposition 7.37. Let p ∈ |Ω| be a proposition.

1. the sheaf morphism Ω → Ω given by sending q to p ⇒ q is a modal operator.
2. the sheaf Ω → Ω given by sending q to p ∨ q is a modal operator.
3. the map Ω → Ω given by sending q to (p ⇒ q) ⇒ q is a modal operator.

We cannot prove Proposition 7.35 here, but we give references in Section 7.4.

7.2.5 Type theories and semantics

We have been talking about the logic of a topos in terms of open sets, but this is
actually a conflation of two ideas that are really better left un-conflated. The first
is logic, or formal language, and the second is semantics, or meaning. The formal
language looks like this:
∀(t : T). ∃(s : S). f (s)  t

and semantic statements are like “the sheaf morphism f : S → T is an epimorphism”.

In the former, all statements are formed according to strict rules and all proofs are
deductions that also follow strict rules. In the latter, statements are “statements
that are interpretable by a sufficiently-expert audience member”, and proofs are
“arguments that are convincing to a sufficiently expert audience member”. These
are rough statements, but it is hard to do better.
To provide semantics for a logical system means to provide a translation system for
converting all logical statements into mathematical ones interpretable by a sufficiently-
expert audience member. We say that semantics is sound if every formal proof is
converted into a convincing argument.
Every topos can be assigned a formal language, often called an internal language,
in which to carry out constructions and formal proofs. This language has a seman-
tics, where the logical statements are converted into mathematical statements about
sheaves (for any audience member who knows sufficiently much about sheaves. The
translation system goes under the name categorical semantics or Kripke-Joyal seman-
tics. We gave the basic ideas in Section 7.2.4; we give references to the literature in
Section 7.4.

7.3 A topos of behavior types

Now that we have discussed logic in a sheaf topos, we return to our motivating
example, a topos of behavior types. We begin by discussing the topological space on
which behavior types will be sheaves, a space called the interval domain.
7.3. A TOPOS OF BEHAVIOR TYPES 23

7.3.1 The interval domain

The interval domain IR is a specific topological space, that we will use to model
intervals of time. In other words, we will be interested in the category Shv(IR) of
sheaves on the interval domain.
To give a topological space, one must give a pair (X, Op), where X is a set and Op
is a topology on X; see Definition 7.3. The set for IR is that of compact intervals

IR  {[d, u] ⊆ R | d ≤ u}.

For a < b in R, let [a, b] denote the set {[d, u] ∈ IR | a < d ≤ u < b}. The topology


Op is determined by as follows. A subset U ⊆ IR is open if there exists a set I, a pair

(a i , b i ) ∈ R2 with a i ≤ b i for each i, such that
Ø
U [a i , b i ].4


i∈I


Thus for example, [0, 5] is an open set: it contains every [d, u] contained in the
open interval {x ∈ R | 0 < x < 5}. Similarly [4, 8] is an open set, but note that



[0, 5] ∪ [4, 8] , [0, 8]. Indeed, the interval [2, 6] is in the right-hand side but not
the left.
Let Op denote the open sets of IR and let BT  Shv(IR, Op) denote the topos of
sheaves on this space. We call it the topos of behavior types.
There is an important subspace of IR, namely the usual space of real numbers R.
We see it as a subspace via the isomorphism

R  {[d, u] ∈ IR | d  u}.

One can show that subset U ⊆ IR is open iff U ∩ R is open in the usual topology on
R; see Example 7.4.

7.3.2 Sheaves on IR
We cannot go into much depth here for reasons of space; we refer the interested
reader to Section 7.4. In this section we will briefly discuss the subobject classifier of
BT  Shv(IR , Op) and a few other sheaves.

What is a sheaf on IR? A sheaf S on the space (IR , Op) is a functor S : Opop →
Set: it assigns to each open set U a set S(U); how should we interpret this? An
element s ∈ S(U) is something that S says is an event—something that can happen
throughout—U. Given this event s together with an open subset of V ⊆ U, there is

an event s V that tells us what s is doing throughout V. If U  i∈I U i and (s i )i∈I is
Ð

a matching family of sections, then there is a unique gluing s ∈ S(U) that restricts to

each of them s U  s i ; see Definition 7.10.
i
4 In


other words the [a, b] form a basis for the topology.

 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
24 LANGUAGES
Since every open set in IR is the union of some basic open sets, U  i∈I [a i , b i ],
Ð



any sheaf S is determined by its values S( [a, b]) on these basic open sets. Since
[a, b]  >0 [a + , b − ], the set S [a, b] is also constrained to be “continuous” in a
 Ð


certain way: nothing can happen too suddenly in some sense.
Rather than get into the details, we describe a few sorts of sheaves that may be of
interest. First of all, for any set A there is a sheaf A ∈ Shv(IR) that assigns to each
open set U the set A(U) B A. This allows us to refer to integers, or real numbers, or
letters of an alphabet, as though they were behaviors. What sort of behavior is 7 ∈ N?
It is the sort of behavior that never changes: it’s always seven.
For any topological space (X, OpX ), there is a sheaf FX of local functions to X. That
is, for any open set U ∈ OpIR , we assign FX (U) B { f : U → X | f is continuous}.
There is often the—seemingly more useful—sheaf GX of local functions on the sub-
space R ⊆ IR.
Another source of examples is that of open hybrid dynamical systems. These are
machines whose behavior is a mixture of continuous movements—generally imagined
as physical movement as through a vector field—and discrete jumps. These jumps are
imagined as being caused by signals that spontaneously arrive. Over any interval of
time, a hybrid system has certain things that it can do and certain things that it cannot.
Although we will not make this precise here, there is a construction for converting
any hybrid system into a sheaf on IR; we refer the reader to Section 7.4.
We refer to sheaves on IR as behavior types because almost any sort of behavior one
can imagine is a behavior type. Of course, a complex behavior type—such as the way
someone acts when they are in love—would be extremely hard to write down. But
the idea is straightforward: for any interval of time, say a three-day interval (d, d + 3),
let L(d, d + 3) denote the set of all possible behaviors a person who is in love could
possibly do. It’s just a set: if persons A and B do exactly the same things except that
on the interval 1.77258–1.77259 (about a second) person A says “hi” and person B
says “hello there”, then consider these as different elements of the set L(d, d + 3), call
them a and b. However, they are very similar sections in the following precise sense:
 
if U ⊆ (d, d + 3) is any subinterval not containing (1.77258, 1.77259) then a U  b U .

Ehe subobject classifier as a sheaf on IR In any sheaf topos, the subobject classifier
Ω is itself a sheaf. It is responsible for the truth values in the topos: the full nu-
ance available for evaluating statements of fact. For sheaves on a topological space,
statements of fact are true in some places and not others.
BT is the topos of sheaves on the space (IR , Op), as defined in Section 7.3.1. As
always, the subobject classifier Ω assigns to any U ∈ Op the set of open subsets of
U, so these are the truth values. But what do they mean? The idea is that every
predicate, such as “Bob likes the weather” returns one of these open sets, responding
“...throughout these intervals of time”. Let’s explore this a bit more.
Suppose Bob likes the weather throughout the interval (0, 5) and throughout the
7.3. A TOPOS OF BEHAVIOR TYPES 25

interval (4, 8). We would probably conclude that Bob likes the weather throughout the
interval (0, 8). But what about the statement “there have been a pair of eyes watching
position p”. Then just because it’s true on (0, 5) and on (4, 8), does not imply that
it’s been true on (0, 8): there may have been a “change of shift” where one watcher
was relieved from their post by another watcher. As another example, consider the
statement “the stock market did not go down by more than 10 points”. This might be
true on (0, 5) and true on (4, 8) but not on (0, 8). In order to capture the semantics of
statements like these—statements that take time to evaluate—we must use IR rather
than R as a site.

7.3.3 Safety proofs in temporal logic

We now have at least a basic idea of what goes into a proof of safety, say for airplanes
in the national airspace system (NAS). Recall that the NAS consists of many different
systems interacting: interactions between airplanes, each of which is an interaction
between physics, humans, sensors, and actuators, each of which is an interaction
between still more basic parts. Each of the systems—at any level—is guaranteed to
satisfy some property. For example, perhaps we can assume that an airplane wing
is either out of gas, has a broken fuel line, or is following the orders of the pilot. Of
course, this is just a model, but all human reasoning is via models so this is the best
we can hope for.
Thus we assume that we have some basic systems which are guaranteed to have
certain behavior. If there is a rupture in the fuel line, the sensors will alert the pilot
within 10 seconds, etc. Each of the components interact with a number of different
variables: a pilot interacts with the radio, the positions of the dials, the position of
the thruster, and the visual data in front of her. The component—here the pilot—is
guaranteed to keep these variables in some relation: “if I see something, I will say
something” or “if the dials are in position bad_pos, I will engage the thruster within
1 second”. We call these guarantees behavior contracts.
All of the above can be captured in the topos BT of behavior types. The variables
are behavior types: the altimeter dial is a variable whose value θ ∈ S 1 is always a
point on the circle , and which changes continuously with respect to time. The
thruster is a variable whose value is in the range [0, 1], etc.
The relationships—behavior contracts—are given by predicates on variables. For
example, if the pilot will always engage the thruster within one second of the dials
being in position bad, this can be captured by a predicate p : dials × thrusters → Ω.
While we have not written out a formal language for p, one could imagine p as

∀(t : R). @t (dials  bad_pos) ⇒ [∃(r : R). (0 < r < 1) ∧ @t+r (thrusters  engaged).

Given an actual playing-out-of-events, the above predicate will hold on certain inter-
vals of time and not others. In other words, given a section of dials and thrusters
over some interval of time, the above predicate returns a section of Ω: the intervals
 CHAPTER 7. LOGIC OF BEHAVIOR: SHEAVES, TOPOSES, AND INTERNAL
26 LANGUAGES
on which the predicate holds. Hopefully the pilot upholds her behavior contract at
all times, in which case the statement will return the value true on that interval. But
if the pilot breaks her contract over certain intervals, then this fact is recorded in Ω.
The logic allows us to record such axioms and then reason from them: if the pilot
and the airplane, and at least one of the three radars upholds its contract then safe
separation will be maintained. We cannot give further details here, but these matters
have been worked out in detail in [TTT]; see Section 7.4.

7.4 Further reading

7.5. A 90-MINUTE PRESENTATION 27

7.5 A 90-minute presentation

I. Problem statement (5)

A. Behaviors and contracts

B. Cruise control

II. The topos Set

A. Basic structures in Set

1. Limits and colimits (2)
2. Epi–mono factorizations (3)
3. Cartesian closed (3)
4. Subobject classifier, characteristic maps and classifiers (5)
5. Discuss: exercise on subobject classifier (7)
B. Logic in Set
1. AND, OR, NOT (10)
2. Exercise (5)
3. Implication (5)

III. Sheaves on a topological space

A. Topological spaces and the poset of opens (5)

B. Presheaves and considering spaces as sites (5)
C. The sheaf condition (5)
D. Example of preimage sheaf on a discrete space (5)
E. Exercise/discussion (5)

IV. Topological sheaf toposes (10)

A. The subobject classifier is the upper set presheaf

B. Truth values are open sets
C. Example: logical connectives

V. Sheaves on the interval domain (10)

A. The interval domain

B. The idea of a safety proof in temporal logic

VI. Course recap, questions. (10)