Modal Knowledge and Game Semirings
Bernhard Moller¨
Institut f¨urInformatik, Universit¨atAugsburg, Germany Email: [email protected]
The aim of algebraic logic is to compact series of small steps of general logical inference into larger (in)equational steps. Algebraic structures that have proved very useful in this context are modal semirings and modal Kleene algebras. We show that they can also model knowledge and belief logics as well as games without additional effort; many of the standard logical properties are theorems rather than axioms in this setting. As examples of the first area we treat the classical puzzles of the Wise Men and the Muddy Children. Moreover, we show possibilities for handling knowledge update and revision algebraically. For the area of games, we generalise the well-known connection between game logic and dynamic logic to the setting of modal semirings and link it to predicate transformer semantics, in particular to demonic refinement algebra. We think that our study provides evidence that modal semirings are able to handle a wide variety of (multi-)modal logics in a uniform algebraic fashion.
Keywords: algebraic logic; modal logic; epistemic logic; game algebra; semantics; semiring
1. INTRODUCTION modal operators can be used to give algebraic semantics of PDL, LTL and CTL; as shown in [8], the subclass of left Boolean quantales can even handle full CTL∗ and The aim of algebraic logic is to compact series the propositional µ-calculus. Many further applications of small steps of general logical inference into larger have been developed. (in)equational steps. Moreover, it attempts to replace In the present paper we show that modal semirings tedious model-theoretic argumentation, in particular, can also model knowledge and belief logics (e.g. [9]) as elementwise argumentation, by more abstract and well as games (e.g. [10]) without additional effort; many compact reasoning. of the standard logical properties there are theorems During the recent years it has turned out that rather than axioms in this setting. As examples of the variants of semirings (e.g. [2]) are very useful algebraic first area we treat the classical puzzles of the Wise structures for this. They may be seen as abstract Men and the Muddy Children and show possibilities for representations of (state) transition systems and handling knowledge update and revision algebraically. axiomatise the fundamental operations of choice and The algebraic treatment offers a more concise way sequential composition in such systems. Semirings of reasoning than classical natural deduction proofs. with an idempotent choice operator have a natural Moreover, since the algebraic treatment is completely approximation order that corresponds to implication first-order, it offers the possibility of using off-the (or inclusion); hence implicational inference can be shelf fully automatic theorem provers without a need replaced by inequational reasoning. Adding finite and for specially tailoring them towards modal/epistemic infinite iteration leads to Kleene algebras [3] and omega logic. For the area of games, we generalise the well- algebras [4]. known connection between game logic and dynamic An essential extension of these basic structures is logic to the setting of modal semirings and link it provided by modal semirings, as studied extensively to predicate transformer semantics, in particular to in [5, 6]. They are based on the concept of tests [7] demonic refinement algebra [11]. that algebraically represent state predicates. Modal semirings add diamond and box operators and are The character of this paper is that of a feasibility more general than Kripke structures: the access between study, not that of a re-development of existing possible worlds can be described not only by relations, particular modal logics in a new setting. Nevertheless, a but, e.g., by sets of computation paths or even by surprising result seems to be that the relatively simple computation trees. Kleene and omega algebras with axiomatisation of modal semirings and modal Kleene algebras achieves many of the standard properties of This paper is a significantly extended and revised version of [1]. such logics in an easy and uniform way.
The Computer Journal, Vol. ??, No. ??, ???? Our framework is intended for defining the semantics asks the middle one who denies, too. Finally he says to of new, special-purpose modal logics as they arise, e.g., the front one: “If you are really wise, you should now with multi-agent systems. Using it will provide the know the colour of your hat.” advantage that many standard modal properties such To treat the puzzle in epistemic logic, one uses as axioms M and K as well as certain induction rules formulae Kjϕ (man j knows ϕ, individual knowledge), hold automatically and do not need to be reproved or Eϕ (everyone knows ϕ) or Cϕ (everyone knows ϕ and added as axioms separately for each new logic. everyone knows that everyone knows ϕ and everyone The paper is organised as follows. Part I deals with knows that everyone knows that everyone knows ϕ and an algebraisation of knowledge/belief logics. These are . . . , i.e., ϕ is common knowledge). briefly recapitulated in Section 2 and illustrated with Let the men be numbered in the order of questioning, a variant of the Wise Men Puzzle. Section 3 defines i.e., from back to front, and let ri mean that i’s hat is several variants of modal (left) semirings and Kleene red. Then the following assumptions are usually made: algebras and lists the most essential properties of the the configuration of the chairs and the visibility are box and diamond operators. They are applied in Section common knowledge, as is everything that is being said. 4 to represent the usual knowledge/belief operators None of that can be withdrawn or invalidated. This is for multiagent systems algebraically. The laws these formalised in epistemic logic as follows. inherit from the general algebraic framework are used in Section 5 for a concise solution of the Wise Men – Every man sees exactly the hats before him, i.e., Puzzle. Section 6 reuses parts of the solution to treat for j < i, C(r → K r ) and C(¬r → K ¬r ). the Muddy Children Puzzle. In Section 7 we show i j i i j i – At least one hat is red, i.e., C(r1 ∨ r2 ∨ r3). further use of the algebra in modelling certain aspects – After the king’s questions, for i = 1, 2 we have like knowledge/belief revision (e.g. [12]) and preference C(¬K r ) and C(¬K ¬r ). relations between possible worlds and their upgrade i i i i (e.g. [13]). Part II treats games and predicate transformers. Now the question is whether we can infer anything Section 8 gives a brief recapitulation of games and about K3r3 from that. their algebra, in particular, of their representation One aim of Part I is to give an algebraic semantics by predicate transformers. These are analysed in a for the knowledge operators and to solve the puzzle by general fashion in Section 9, and a connection to (in)equational reasoning. Parikh’s iteration operators for games is set up. Section To prepare the algebraisation we recall the main 10 considers predicate transformers as elements of a elements of Kripke semantics for modal logic (e.g. [16]). left i-semiring which is extended to a modal one. We will use a multiagent setting (each wise man is It relates the box and diamond operators there to an agent) in which each agent has his own box and the enabledness and termination operators of demonic diamond operators. refinement algebra [14]. Section 11 provides a brief A (multimodal) Kripke frame is a pair K = (W, R), conclusion and outlook. where W is a set of possible worlds and R = (Ri)i∈I , for some index set I, is a family of binary access relations Ri ⊆ W ×W between worlds. Relation Ri expresses the PART I: KNOWLEDGE uncertainty of agent i about the current state of affairs: if he actually is in a world w then he considers all worlds We first model epistemic logic in modal semirings. As v with w Ri v, called the epistemic Ri-neighbours of w, our running example we use a particular version of the as possible and has insufficient information to discern Wise Men Puzzle [15]. Although, of course, epistemic which of the worlds is the “real” one. The epistemic logic was not invented for the solution of such puzzles, neighbours of w may or may not include w itself. they provide a nice illstration of the basic concepts of Note that, following the literature on modal logic, we the logic. view the “inputs” to a relation on the left, its “outputs” on the right. 2. THE WISE MEN PUZZLE AND EPIS- The knowledge/belief of agent i in a world w consists TEMIC MODAL LOGIC of the formulae that are true in all epistemic Ri- neighbours of w. Knowledge and belief variants of the A king wants to test the wisdom of his three wise men. logic are distinguished by special assumptions about the They have to sit on three chairs behind each other, all relations Ri. facing the same direction. The king puts a hat on each The semantics of modal formulae is modelled by the head, either red or black, in such a way that no one can satisfaction relation K, w |= ϕ which tells whether a see his own hat or the hats behind him, only the hats of formula ϕ holds in world w in frame K. Equivalently, a the men before him. Then the king announces that at formula ϕ characterises the subset [[ϕ]] =df {w | K, w |= least one hat is red. He asks the wise man in the back if ϕ} of possible worlds in which it holds. he knows his hat colour, but that one denies. Then he The semantics of the modal operators hRii and [Ri]
2 are given by also can, without effort, be re-used to model essential aspects of knowledge and game logics and perform w ∈ [[hRiiϕ]] ⇔df ∃ v : Ri(w, v) ∧ v ∈ [[ϕ]] , corresponding algebraic proofs about them. To make w ∈ [[[Ri]ϕ]] ⇔df ∀ v : Ri(w, v) ⇒ v ∈ [[ϕ]] . the paper largely self-contained, we repeat the essential definitions (e.g. [2]). They are De Morgan duals: Definition 3.1. [[[Ri]ϕ]] = [[¬hRii¬ϕ]] . 1. A left idempotent semiring, briefly a left i-semiring, By these definitions [Ri] coincides with the know- is a structure (S, +, 0, ·, 1) satisfying the following ledge/belief operator Ki, whereas hRii coincides with axioms. the possibility operator Pi. Usually, special axioms for the knowledge operators – The reduct (S, +, 0) is a commutative and are required: idempotent monoid. This induces the natural order a ≤ b ⇔df a + b = b. Kiϕ → ϕ if i knows ϕ then ϕ is indeed true – The reduct (S, ·, 1) is a monoid. (truth, Axiom T) – Composition · is distributive and strict in its Kiϕ → KiKiϕ if i knows ϕ, he knows that left argument, i.e., (a + b) · c = a · c + b · c and (positive introspection PI) 0 · a = 0. ¬Kiϕ → Ki¬Kiϕ analogous (negative introspec- – Composition is ≤-isotone or, equivalently, tion NI) superdistributive in its right argument, i.e., a · b + a · c ≥ a · (b + c). If Ki is intended to model belief rather than true knowledge, only the introspection axioms are used. We 2. A weak i-semiring is a left i-semiring in which will see in the solution of the puzzle which of these are composition is also distributive in its right argu- actually needed. ment, i.e., a · (b + c) = a · b + a · c.
3. ALGEBRAIC SEMANTICS: MODAL 3. A weak i-semiring with right-strictness, i.e., a · 0 = SEMIRINGS 0, is called an i-semiring.
We will now present our algebraic formalisation of the In most applications these operators are interpreted knowledge operators. as follows: + ↔ choice, 3.1. Semirings · ↔ sequential composition, There are already various algebraisations of modal 0 ↔ empty choice, operators, e.g., Boolean algebras with operators [17] 1 ↔ null action, and propositional dynamic logic PDL [18]. Moreover, ≤ ↔ increase in information or in choices. a concrete algebraic treatment of Kripke frames can be given using relation algebra; the knowledge require- The axioms entail that 0 is the least element and a + b ments above correspond to the following relational ones: is the least upper bound or join of a and b. A prominent i-semiring is provided by the set of all Kiϕ → ϕ I ⊆ Ri (reflexive) binary relations over a set, with + and · interpreted as Kiϕ → KiKiϕ Ri ; Ri ⊆ Ri (transitive) union and relational composition. ¬Kiϕ → Ki¬Kiϕ Ri˘; Ri ⊆ Ri (euclidean) A left i-semiring structure is also at the core of process algebra frameworks (e.g. [19]); for further discussion of Here, I is the identity relation, ; is relational com- the connection see [20]. position and ˘ is relational converse. Modal semirings and Kleene algebras, as studied 3.2. Tests and Validity extensively in [5, 6], provide a very effective combination of PDL and algebraic operations on the access elements. While general i-semiring elements can be thought of as Additionally, they abstract from the special case sets of transitions or transition paths between states, of access relations and allow more general access we now describe how to model state predicates or, elements to connect states, such as sets of computation isomorphically, sets of states algebraically. paths. The subclass of omega algebras [4] allows the Let us illustrate this in the i-semiring of binary incorporation of infinite iteration. A further subclass, relations over a set Q of elements (say, states). The the Boolean quantales, admit µ-calculus-like recursive subsets P ⊆ Q are in one-to-one correspondence with ∗ definitions and can even realise full CTL , as shown subsets of the identity relation of the form IP =df in [8]. {(x, x) | x ∈ P }. Therefore these IP can represent the P s One main aim of the present paper is to show as relations and hence model predicates characterising that this well established structure of modal semirings them. In PDL, the role of tests is played by statements
3 of the form ϕ? that test whether ϕ holds in the current In a left test semiring S we will freely use the standard state. Boolean operations on tests, like implication p → q =df The algebraic counterpart to this idea dates back at ¬p + q and relative complement p − q =df p · ¬q, with least to [21]; terminologically we follow [7]. their usual laws, notably the Galois connection Definition 3.2. A test of a left i-semiring S is a p · q ≤ r ⇔ p ≤ q → r , (shunting) subidentity, i.e., an element p with p ≤ 1, that has a complement ¬p relative to 1, i.e., p · ¬p = 0 = ¬p · p which has contraposition as a special case. We assume and p + ¬p = 1. The set of all tests of S is denoted by that · binds tighter than → . test(S). In logic, a predicate is called valid if it holds for all states, which means that it coincides with the predicate As described above, in the relation i-semiring the TRUE, represented by the largest test 1. Therefore, we tests are the subsets of the identity relation. can define validity algebraically as follows. We will consistently write a, b, c . . . for arbitrary i- semiring elements and p, q, r, . . . for tests. This way, Definition 3.4. A test p is valid, in symbols |= p, tests may look like propositional variables, but they are if 1 ≤ p (or, equivalently, p = 1). not: as described above they abstract predicates with By shunting, free variables and stand for the sets of states that fulfil the predicates. |= q → r ⇔ q ≤ r . It is not hard to show that Definition 3.2 entails uniqueness of the complement ¬p of a test p. Note that Moreover, ¬ is required only for tests, not for general elements, |= p ∧ p ≤ q ⇒ |= q . (1) which allows a much wider class of models. In fact, the negation operator on tests is a derived concept: in any 3.3. Modal Operators: Box and Diamond given i-semiring the set of tests is precisely the set of subidentities for which ¬ exists. This set may be very We now axiomatise forward box operators; a backward small, but it always contains at least 0 and 1. version could be axiomatised symmetrically, but will not be needed in the present paper. The box operators Definition 3.3. A left test semiring is a left i- we define are not (yet) epistemic operators. They are semiring S in which all tests commute under · , i.e., completely independent of any particular interpretation p · q = q · p for all p, q ∈ test(S). This is equivalent to what the elements a of the underlying i-semiring may stipulating the distributivity law p · (q + r) = p · q + p · r mean. Most generally, one may think of such an a as for all p, q, r ∈ test(S). being some kind of transition system, for instance a Hence every weak i-semiring is a left test semiring. Kripke structure. Then the box operator [a] describes The above notion of tests deviates slightly from the connection between states via a: given a set of that in [7]: it does not allow an arbitrary Boolean (post-)states, represented by a test q, the result of algebra of subidentities as test(S) but only the [a]q (operator [a] applied to q) is a test representing maximal complemented one. The reason is that the all (pre-)states for which all a-successors lie in q. axiomatisation of the modal box operator to be This coincides with the classical semantics of [a] in presented below forces this maximality anyway (see [6]). multimodal logics (see e.g. [16]), which admit several Further ways of axiomatising tests and the associated transition elements a. In monomodal logics, such as modal operators will be discussed in the following linear temporal logic, there is only one transition section. element which can therefore be omitted, leading to the Straightforward calculations show that in a left test familiar 2 notation. semiring S the set test(S) is closed under + and · and The general concept of box covers many familiar forms a Boolean algebra with + as join, · as greatest notions, for instance, the weakest liberal precondition lower bound or meet and 0 and 1 as its least and greatest and Hoare triples in program correctness. To explain elements. this, assume that test q represents all states that When tests are viewed as predicates over a set Q of satisfy a certain postcondition ϕ, and let a be the states, the semiring operators play the following roles: transition relation of a program. Then the test [a]q represents all states for which all a-successors satisfy the postcondition ϕ. Hence [a] corresponds to the weakest 0/1 ↔ FALSE (empty set)/TRUE (full set Q), precondition under which a guarantees postcondition +/· ↔ disjunction (union)/conjunction (inter- ϕ, i.e. to the weakest liberal precondition wlp(a, q) [22]. section), Therefore, algebraically one can consider a Hoare triple ≤ ↔ implication (subsethood), {p} a {q} as standing for “p implies [a]q”, in semiring p · a/a · p ↔ input/output restriction of a by p, notation, p ≤ [a]q. p · a · q ↔ the part of a that takes p-elements to When the states are viewed as possible worlds and a q-elements. (∗) represents the access relation of a Kripke structure, [a]
4 turns into the epistemic knowledge or belief operator: if on the i-semiring under consideration. One important, q represents all worlds that satisfy a certain formula ϕ relationally based, approach in this vein is that then [a]q represents all worlds for which all a-neighbours of dynamic negation [24], another the antidomain satisfy ϕ. approach of [25] in general i-semirings. We forego details of these approaches, since the present paper Definition 3.5. A (left/weak) modal semiring is is not about axiomatisation, but about application of a structure (S, +, 0, ·, 1, [ ]) such that the reduct algebraic structures. A recent survey is given in [26]. (S, +, 0, ·, 1) is a (left/weak) i-semiring and the box We list some useful properties of the above box operator [ ]: S → (test(S) → test(S)) satisfies the axioms. De Morgan duality gives the swapping rule axioms [23] hai[b]p ≤ [c]p ⇔ hci¬p ≤ [a]hbi¬p . (3) p ≤ [a]q ⇔ p · a · ¬q = 0 , (box1) [a · b]p = [a][b]p . (box2) Box is anti-disjunctive and diamond is disjunctive in the first argument: The associated diamond operator h i : S → (test(S) → test(S)) is defined as the de Morgan dual of box, viz. [a+b]p = [a]p·[b]p , ha+bip = haip+hbip . (4)
haip =df ¬[a]¬p . Hence box is antitone and diamond is isotone in the first argument: We are well aware that there are different ways of axiomatising tests and box; however, the treatment we a ≤ b ⇒ [a]p ≥ [b]p ∧ haip ≤ hbip . (5) are choosing is the most adequate one for our purposes. We will discuss some of the alternatives below. To understand the antitony, recall that the implication According to (∗) above, Axiom (box1) means that order a ≤ b expresses that b offers at least as many all p-worlds satisfy [a]q iff there is no a-connection transition possibilities as a. Now, if more choices are from p-worlds to ¬q-worlds. This specifies [a]q as the offered, one can guarantee less, which is expressed by weakest of all such predicates, which justifies the above [b]p ≤ [a]p. discussion of the weakest liberal precondition predicate Moreover, both box and diamond are isotone in their transformer wlp. second arguments: Axiom (box2) makes box well-behaved w.r.t. compo- sition. An easy calculation shows that also diamond is p ≤ q ⇒ [a]p ≤ [a]q ∧ haip ≤ haiq . (6) well-behaved w.r.t. composition: This entails ha · bip = haihbip . (2) |= [a]p ∧ p ≤ q ⇒ |= [a]q . (7) Both operators are unique if they exist. They coincide with the corresponding ones in PDL (e.g. [18]); the Finally, for tests box and diamond can be given difference is that in PDL the first argument a of the explicitly: box is of a purely syntactic nature without any algebraic laws. [p]q = p → q , hpiq = p · q . (8) An equivalent purely equational axiomatisation via a domain operator has been presented in [6] for the case of This agrees with the behaviour of the test operation p? an i-semiring. In [20] it has been shown that it carries in PDL. Moreover, we have over to left i-semirings. It works as follows. Given a [1]q = q = h1iq . domain operator p: S → test(S) such that pa is the test characterising the starting states of transition element a, diamond and box can be defined as 3.4. Modal operators in Weak Semirings In a weak i-semiring S we have the following additional haip = p(a · p) , [a]p = ¬ p(a · ¬p) . properties:
Conversely, domain can be defined by – Box is conjunctive and diamond is disjunctive:
pa = hai1 = ¬[a]0 . [a](p · q) = [a]p · [a]q , hai(p + q) = haip + haiq . Both from a mathematical and an automated theorem proving point of view, the two-sortedness of the – Moreover, Box satisfies Axiom K (modal modus box/diamond and the domain views is unsatisfactory. ponens) and diamond its dual: A number of authors have come up with one- sorted approaches where the sort of tests is implicitly [a](p → q) ≤ [a]p → [a]q , (9) defined as the image set of a certain endofunction haip − haiq ≤ hai(p − q) .
5 By contraposition and shunting, this is equivalent The first of these reads in terms of Hoare triples to the following forms (modal modus tollens, given {q} a {q} ⇒ {q} a+ {q}, i.e., an invariant of a is also only for box): one of a+. Finally, we have the PDL induction rules (see [23]) [a](p → q) · ¬[a]q ≤ ¬[a]p , (10) [a](p + q) · ¬[a]p ≤ ¬[a]¬q . [a∗](p → [a]p) ≤ p → [a∗]p , (18) ha∗ip − p ≤ ha∗i(haip − p) . – Box satisfies the following propagation law: 3.6. Reflexivity, Transitivity, Symmetry and ([a]q) · a = ([a]q) · a · q , (11) Introspection which means that starting in a world for which all We now want to give general algebraic variants of the a-successors guarantee q allows indeed asserting q relational characterisations of reflexivity, transitivity, as a postcondition. This law entails symmetry and introspection. The fundamental tool for this is the Geach formula (e.g. [16]) from standard |= [a]q ⇒ a = a · q . (12) modal correspondence theory: for relations R, S, T, U In an i-semiring also the reverse implication holds one has which further entails |= [a·q]q, since a·q = a·q ·q. R˘; S ⊆ T ; U˘ ⇔ ∀ P : hSi[U]P ⊆ [R]hT iP, Finally we note that a weak i-semiring S is an i- where is the relational converse operator and P ranges semiring iff box satisfies Axiom M of modal logic and ˘ over the relational tests, i.e., the subidentity relations. diamond its dual; algebraically they read If in addition to the forward modal operators [ ] and - - [a]1 = 1 , hai0 = 0 . (13) h i also the backward ones [ ] and h i are present, the relational form can be mimicked more directly by Hence, if (13) holds then |= p ⇒ |= [a]p. A conse- - - quence of (13) and (9) is R˘; S ⊆ T ; U˘ ⇔ ∀ P : hRi hSiP ⊆ hUihT i P. To obtain more compact formulas we lift the inclusion |= p → q ⇒ |= [a]p → [a]q . (14) order between test relations pointwise to the box and diamond operators and denote composition of such 3.5. Modal Kleene Algebras operators by juxtaposition. With this convention and Next, we describe finite iteration. A (left/weak) Kleene by shunting, the Geach equivalence simply becomes algebra [3] is a structure (S, +, 0, ·, 1, ∗) such that the reduct (S, +, 0, ·, 1) is a (left/weak) i-semiring and the R˘;S ⊆ T ;U˘ ⇔ hSi[U] ⊆ [R]hT i ⇔ hRi[T ] ⊆ [S]hUi . ∗ finite iteration operator satisfies the left unfold and The following properties of relations and their Geach induction axioms equivalents are particularly useful here: A relation R is 1 + a · a∗ ≤ a∗ , b + a · c ≤ c ⇒ a∗ · b ≤ c . – reflexive ⇔df I ⊆ R ⇔ hIi ⊆ hRi ⇔ [R] ⊆ [I], – euclidean ⇔df R˘; R ⊆ R ⇔ hRi[R] ⊆ [R] ⇔ ∗ + ∗ In the relation i-semiring, a and a =df a · a are the hRi ⊆ [R]hRi , reflexive-transitive and transitive closure of a, respec- – symmetric ⇔df R˘⊆ R ⇔ [I] ⊆ [R]hRi, tively. – serial or total ⇔df I ⊆ R ; R˘ ⇔ [R] ⊆ hRi, A (left/weak) Kleene algebra is modal when the – deterministic ⇔df R˘; R ⊆ I ⇔ hRi ⊆ [R], underlying left/weak i-semiring is. As shown in [6], in – transitive ⇔df R ; R ⊆ R ⇔ hRihRi ⊆ hRi ⇔ this case the axioms entail the laws of box and diamond [R] ⊆ [R][R] . star and plus induction (note that they need not be Since general semirings do not furnish a converse added as separate axioms): operation, we use the modal Geach equivalents to transfer these notions to the abstract setting. Again we q ≤ p · [a]q ⇒ q ≤ [a∗]p , (15) use the pointwise lifting of the order ≤ on tests to test p + haiq ≤ q ⇒ ha∗ip ≤ q transformers and denote test transformer composition q ≤ [a]p · [a]q ⇒ q ≤ [a+]p , by juxtaposition. + (16) haip + haiq ≤ q ⇒ ha ip ≤ q . Definition 3.6. An element a of a left modal semi- ring is Using Hoare triples, the box part of (15) reads (q ≤ p ∧ {q} a {q}) ⇒ {q} a∗ {p}, which is related to the – m-reflexive ⇔df h1i ≤ hai ⇔ [a] ≤ [1], familiar Hoare rule for the while loop. For the case p = q – m-euclidean ⇔df hai[a] ≤ [a] ⇔ hai ≤ [a]hai, (16) yields the laws – m-symmetric ⇔df [1] ≤ [a]hai ⇔ hai[a] ≤ h1i, – m-serial or m-total ⇔df [a] ≤ hai, + q ≤ [a]q ⇒ q ≤ [a ]q , – m-deterministic ⇔df hai ≤ [a], + (17) haiq ≤ q ⇒ ha iq ≤ q . – m-transitive ⇔df haihai ≤ hai ⇔ [a] ≤ [a][a].
6 Finally, a is called an m-equivalence if a is m-reflexive, ≥ {[ Boolean algebra ]} m-transitive and m-symmetric. q . One may wonder about the qualifier “m-” (for “modally”) in the above notions. The reason is that 2. We have, by isotony (6) and m-symmetry, reflexivity and transitivity are usually defined as 1 ≤ a and a · a ≤ a, resp. These notions are much stronger hai1 ≤ p ⇒ [a]hai1 ≤ [a]p ⇒ and coincide with the above ones only if the underlying 1 ≤ [a]p ⇒ hai1 ≤ hai[a]p ⇒ hai1 ≤ p . modal semiring is extensional, i.e., satisfies hai ≤ hbi ⇒ a ≤ b for all a, b. An example of an extensional modal semiring is the relational one, whereas i-semirings of trace sets (see e.g. [8]) are not. 3. We calculate The m-euclidean elements correspond to knowledge operators that satisfy negative introspection. The fol- a = a · p lowing facts are well known (and can straightforwardly ⇔ {[ by (12) and S being an i-semiring ]} be shown from the above definitions): |= [a]p – An m-reflexive and m-euclidean element is also m- ⇔ {[ Part (2) ]} symmetric and m-transitive. hai1 ≤ p – An m-symmetric and m-transitive element is also m- ⇔ {[ shunting ]} euclidean. The case of m-symmetric elements is particularly ¬p ≤ [a]0 important, since often one uses m-equivalences as access ⇔ {[ by Axiom (box1) ]} elements. We have the following useful properties. ¬p · a ≤ 0 ⇔ {[ splitting a = p · a + ¬p · a ]} Lemma 3.7. Let S be a left test semiring, a ∈ S be m-symmetric and p ∈ test(S). a = p · a .
1. p · a · p is again m-symmetric. 4. Immediate from Part (3) and multiplicative idempotence of tests. 2. hai1 ≤ p ⇔ |= [a]p.
Let now S be an i-semiring. As another application of the algebra we show that, 3. a = a · p ⇔ a = p · a. without any other assumption, negative introspection is 4. a = a · p ⇔ a = p · a · p ⇔ a = p · a. preserved by transitive closure (for positive introspec- tion this is trivial, since that property is equivalent to Proof. transitivity, so that transitive closure does not add any- thing). 1. We calculate Lemma 3.8. If a is m-euclidean then so is a+. [p · a · p]hp · a · piq Proof. We calculate = {[ by Axiom (box2) and modal operators of tests (8) ]} ha+i[a+]p ≤ [a+]p [p · a](p → (p · ha · piq)) ⇐ {[ plus induction (17) ]} = {[ Boolean algebra ]} hai[a+]p ≤ [a+]p [p · a](p → ha · piq) ⇔ {[ shunting ]} = {[ by Axiom (box2) and modal ha+i¬p ≤ [a]ha+i¬p operators of tests (8) ]} ⇐ {[ plus induction (16) ]} [p · a · p]ha · piq) hai¬p + hai[a]ha+i¬p ≤ [a]ha+i¬p ≥ {[ antitony of box ]} ⇐ {[ supremum ]} [p · a]ha · piq hai¬p ≤ [a]ha+i¬p ∧ = {[ by Axiom (box2) and modal hai[a]ha+i¬p ≤ [a]ha+i¬p . operators of tests (8) ]} The first of these conjuncts follows from the second form p → [a]hai(p · q) of the m-euclidean property of a and a ≤ a+, together ≥ {[ a m-symmetric and isotony ]} with isotony of diamond in its first argument (5) and of p → (p · q) box in its second argument (6). The second conjunct = {[ Boolean algebra ]} is immediate from the first form of the m-euclidean p → q property.
7 4. KNOWLEDGE ALGEBRA i.e., C is transitive in the sense of knowledge operators:
4.1. Common Knowledge Cp ≤ CCp . (20) Using our modal operators we can now model common knowledge over a modal weak semiring S as follows. From this we obtain two further properties that will be Assume a finite set of agents, represented by an index useful in the solution of the wise men puzzle: set I = {1, . . . , n}, each with an access element ai ∈ S. As detailed in Section 2, for the case of Kripke Cp · Cq ≤ C(Cp · Cq) , Cp · Cq ≤ C(Cp · q) (21) structures with access relations R , the knowledge i They are shown, using conjunctivity, transitivity and operators for the agents would be [R ]. Therefore, in i conjunctivity of C again, by the abstract algebraic setting we define, analogously, Ki =df [ai]. Cp · Cq = C(p · q) ≤ CC(p · q) = C(Cp · Cq) An agent group is a subset G ⊆ I. We introduce two operators for expressing common knowledge: and, using transitivity and conjunctivity of C, by – EGp : everyone in group G knows p; – CGp : everyone in G knows that everyone in G Cp · Cq ≤ CCp · Cq = C(Cp · q) . knows that . . . everyone in G knows p. Using antidisjunctivity (4) of box we calculate, for All our properties up to here hold irrespective of the G = {k , . . . , k }, knowledge axioms. Let us see what can be derived when 1 m some of these axioms are assumed.
EGp = Kk1 p ····· Kkm p = [ak1 ]p ····· [akm ]p If all Ki are reflexive (i.e., satisfy Axiom (T)) then + ∗ = [ak1 +···+akm ]p = [aG]p , so is E and hence C = [a ] = [a ]. Therefore the general induction rule (18) specialises to the knowledge where aG =df ak1 + ··· + akm . induction rule Likewise, using the composition axiom (box2) and again antidisjunctivity (4) of box, we obtain, semi- C(p → Ep) ≤ p → Cp . formally,1 It means that if all agents in G know that p is invariant CGp = EGp · EGEGp · EGEGEGp ···· under EG and p is true then all agents know they all = [aG]p · [aG][aG]p · [aG][aG][aG]p ···· know p. Moreover, (box2) and a star property yield = [aG]p · [aG · aG]p · [aG · aG · aG]p ···· 2 3 ∗ ∗ ∗ ∗ ∗ = [aG + aG + aG ··· ]p . CCp = [a ][a ]p = [a · a ]p = [a ]p = Cp + Therefore we define CGp =df [aG]p if the underlying and hence, by conjunctivity of C, i-semiring is a Kleene algebra. In this way we have obtained an algebraic counterpart Cp · Cq = CCp · CCq = C(Cp · Cq) . (22) of the multiagent logic KT45n (e.g. [9]) and a fragment of Public Announcement Logic [27, 28]. 5. SOLVING THE WISE MEN PUZZLE
4.2. Knowledge Laws Let us now solve the Wise Men Puzzle using our encoding in the terminology of modal weak semirings. We shall now derive a number of laws for our knowledge With our algebraic definitions we can rephrase the operators that will come in handy in solving the Wise assumptions from Section 2 in abstract algebraic form Men Puzzle and, later on, also the Muddy Children (the indices of C and E are suppressed, since always the Puzzle. full group of all three agents is referred to): First, from antitony of box in its first argument we + (a) |= C(ri → Kjri)(j < i), get, since akj ≤ aG ≤ aG, (b) |= C(¬ri → Kj¬ri)(j < i),
CGp ≤ EGp ≤ Kkj p CGp ≤ CGKkj p . (19) (c) |= C(r1 + r2 + r3), (d) |= C(¬Kiri)(i = 1, 2), For the remaining laws of this section we shall (e) |= C(¬Ki¬ri)(i = 1, 2). consider the agent group G and its access element fixed Now, first the formulas (c) and (d) invite an application and just write a, E, C instead of aG, EG, CG. By a+ · a+ ≤ a+, again antitony of box in its first of modal modus tollens (10) from Section 3.4; argument and Axiom (box2) we have afterwards the contrapositive ¬Kj¬ri → ri of the formula within (b) can be used. We just have to wrap Cp = [a+]p ≤ [a+ · a+]p = [a+][a+]p = CCp , the corresponding inferences into applications of the common knowledge operator C. More precisely, for 1This notation is semi-formal, since general infinite products and sums need not exist in every left i-semiring; even if this arbitrary agent number i and arbitrary tests p and q + particular one exists, it need not coincide with aG. we can reason as follows:
8 C(p + q) · C(¬Kip) · C(¬Ki¬q → q) form of the generalised argument. Assume an agent ≤ {[ by (21) twice ]} group G and a subgroup H ⊆ G of agents who have already been interrogated and have denied knowledge C(C(p + q) · ¬Kip · (¬Ki¬q → q)) ≤ {[ common knowledge (19) and of their hat colour. Then isotony of C ]} C( Σ rj) · C( Π ¬Kiri) · C( Π Π rj → Kirj) ≤ j∈G i∈H i∈H j∈G−H C(Ki(p + q) · ¬Kip · (¬Ki¬q → q)) 0 C( Σ rj) . ≤ {[ by (K ) and isotony of C ]} j∈G−H C(¬K ¬q · (¬K ¬q → q)) i i Note that we have assumed neither reflexivity ≤ {[ Boolean algebra (modus ponens) ]} nor positive/negative introspection for the knowledge C(q) . modalities; only transitivity of C and axiom K were In sum, we have shown the following lemma: used. Moreover, axiom M was not used either, which is why the assumption of a modal weak semiring was Lemma 5.1 (Knowledge Strengthening). Assume a sufficient. group of agents indexed by some family I and consider One may well argue that all this could have been done an i ∈ I and arbitrary tests p, q. Then in conventional modal logic. This is true; however, our derivations work not only in relational Kripke models CI (p + q) · CI (¬Kip) · CI (¬q → Ki¬q) ≤ CI (q) . but just the same in many other models of modal To make progress in the puzzle, we want to apply this semirings, such as algebras of traces and trajectories, to lemma first for p = r1 and q = r2 + r3 and assumption name just the most important ones. This will be fruitful, (d) with i = 1. Therefore we have to obtain information e.g., for combinations of temporal and epistemic logic, about CI (¬q → K1¬q). We calculate such as [30, 31]. However, the details will be the subject of further research. C(¬(r2 + r3) → K1¬(r2 + r3)) = {[ de Morgan ]} 6. THE MUDDY CHILDREN C((¬r2 · ¬r3) → K1(¬r2 · ¬r3)) = {[ conjunctivity of Kj ]} The arguments of the previous section can be reused for puzzles with a similar structure, like the C((¬r2 · ¬r3) → (K1¬r2 · K1¬r3)) ≥ {[ Boolean algebra and isotony of C ]} Surprise Examination Paradox [28] or the Muddy Children Puzzle (e.g. [9]), which add several rounds of C((¬r → K ¬r ) · (¬r → K ¬r )) 2 1 2 3 1 3 interrogation of the above shape. Let us treat the latter = {[ conjunctivity of C ]} as a somewhat more complicated example. C(¬r2 → K1¬r2) · C(¬r3 → K1¬r3) . There are n children together in a playground. They Hence our assumptions and property (7) indeed entail have been told that they must not get dirty. However, during their play k of them get mud on their foreheads. CI (¬q → K1¬q) and hence, by Lemma 5.1 also Each can see the mud on the foreheads of others but C(r1 + r2 + r3) ≤ C(r2 + r3) ∧ C(r2 + r3) ≤ C(r3) . not on her own. After a while a passer-by says to them “At least one of you has mud on her forehead”. Finally, by the common knowledge law (19) we infer He then repeatedly asks “Does any one of you know C(r ) ≤ K (r ). Since |= C(r + r + r ) by Formula 3 3 3 1 2 3 whether you are muddy?” What will eventually happen (1), we also have, using assumption (b), that |= K (r ), 3 3 if it is assumed that all the children are perceptive, which means that the third wise man knows his hat intelligent, truthful and answer simultaneously after is red. Hence the puzzle is solved, because the King’s each repetition of the question? question can now be answered in the affirmative. Note For the case of n children we use the index set that assumption (a) was not used in this derivation. I = {1, . . . , n}. Then we see immediately that we have We think that this algebraic solution is much more a quite similar set of initial assumptions as for the Wise concise than standard treatments in multimodal logic Men, where m now means that child i is muddy: with a natural deduction system (e.g. [29]). Moreover, i the algebraic axiomatisation is completely first-order. (a) |= C(mi → Kjmi)(j 6= i), Hence it can be treated by off-the-shelf fully automatic provers without specialising them in any way for the (b) |= C(¬mi → Kj¬mi)(j 6= i), modal case. (c) |= C(Σ mi). The above derivation can be generalised to a group i∈I G ⊆ I of agents and an index j ∈ I, which yields Contrary to the Wise Men, the situation here is fully Π C(¬ri → Kj¬ri) ≤ C(¬( Σ ri) → Kj¬( Σ ri)) . symmetric. i∈G i∈G i∈G Assume now that after the first question all Similarly, the whole solution easily generalises to n children simultaneously answer “no”. Then we have the instead of three wise men. In fact, one can give a closed additional information
9 (d) |= C(¬Kimi)(i ∈ I). conclude that she herself is muddy, too. This conclusion is expressed by the following formula for i ∈ I and This is again similar to the Wise Men case. l ∈ [2, n]: Set now, for l ∈ [1, n],
concli,l =df atleastl · seesmuddyi,l−1 → mi , dontknowl =df Π Π ¬Kimi , G⊆I ∧ |G|=l i∈G where seecleans =df Π (¬mj → Ki¬mj) . i6=j seesmuddyi,l =df Hence dontknowl expresses that in every group of l Σ muddyG · cleanI−(G∪{i}) children none of them knows whether she is muddy, G⊆I ∧ |G|=l ∧ i6∈G while seecleans means that each child knows whether expresses that child i sees at least one group of l the others are clean. Assumptions (a) and (b) together muddy children other than herself. Validity of concli,j with conjunctivity of C imply |= C(seecleans). With this is immediate from the definitions by Boolean algebra, we can calculate as follows: so that by property (7) of C we may infer
C(Σ mi) · C(dontknow1) · C(seecleans) i∈I |= C(concli,j) . (23) = {[ definition of dontknow1, index chasing ]} Now we reason as follows, assuming that G ⊆ I is C(Σ mi) · C(Π ¬Kimi) · C(seecleans) i∈I i∈I the group of muddy children, uniquely characterised by ≤ {[ using conjunctivity of C and Lemma 5.1 msetG, and k = |G|. Then we have, for every i ∈ G, for every i ∈ I ]} that |= seesmuddyi,k−1 and hence, again by (7), |= Π C(Σ mj) C(seesmuddy ). According to the above induction we i∈I j6=i i,k−1 infer |= C(atleast ). Now modal modus ponens (9) using = {[ by conjunctivity of C ]} k (23) and knowledge algebra yield the implications C(Π Σ mj) i∈I j6=i = {[ Boolean algebra ]} C(atleastk) · C(seesmuddyi,k−1) ≤ C(mi) ≤ Kimi ,
C(Σ mi · mj) j6=i so that indeed after k − 1 rounds of questioning all muddy children know that they are muddy. In fact, this The test Σ mi · mj is valid iff at least 2 of the mi is even common knowledge. j6=i are valid. This means that after the first round of Note that the knowledge axioms of reflexivity and questioning with uniformly negative answers all children introspection as well as axiom M again have not been know that at least two of them are muddy. used, so that the whole solution goes through assuming Define now, for G ⊆ I, only transitivity of C and Property (9); these properties come for free from the algebraic definition of C. The approach works, because this type of puzzle has muddyG =df Π mi , cleanG =df Π ¬mi i∈G i∈G a “purely logical” structure. Contrarily, any analytical Then the group of muddy children is uniquely solution of the puzzle about Mr. S and Mr. P [15, 27, 32] characterised by (i.e., any solution by logical deduction and not by exhaustive checking of all pairs of numbers within the
msetG =df muddyG · cleanI−G . given range) will involve a lot of domain logic about arithmetic in addition to the logic of mutual knowledge The fact that at least n children are muddy is of the agents about each other; therefore the abstract formalised, for l ∈ [1, n], by algebraic reasoning will cover only the overall structure of the solution, whereas the arithmetic details will take atleastl =df Σ muddyG = Σ muddyG . G⊆I ∧ |G|=l G⊆I ∧ |G|≥l place within the test set of a particular semiring.
In sum, the above derivation shows 7. KNOWLEDGE PROPAGATION AND KNOWLEDGE UPDATE C(atleast1) · C(dontknow1) · C(seecleans) ≤ C(atleast2) . 7.1. Knowledge Propagation An easy induction using again Lemma 5.1 shows, for We will now turn to another view of puzzles of 1 ≤ j < n, that the above type. Rather than accumulating knowledge
C(atleastj) · C(dontknowl) · C(seecleans) ≤ C(atleastl+1) . about one and the same fixed Kripke structure we will increase knowledge by shrinking the initial Kripke The remaining part of the solution uses the following structure until only worlds remain that are in some observation: if a child mi knows that there are at sense “interesting” for the solution. We will see that the least l muddy children but sees only l − 1 she must modal semiring setting immediately allows knowledge
10 update operators as in e.g. [33] without adding any = {[ complements ]} further axioms. [a · (p + ¬p)]q To illustrate this we sketch a particular Kripke = {[ distributivity ]} structure for the Muddy Children Puzzle. As worlds [a · p + a · ¬p]q in this structure we use minterms as known from the = {[ antidisjunctivity ]} Boolean normal form of logical assertions. Again, let I = {1, . . . , n} be the index set for the case of n children. [a · p]q · [a · ¬p]q For G ⊆ I the minterm = {[ by (24) ]} [a · p]q · [a](¬p → q) . mG =df ( Π mi) · ( Π ¬mi) i∈G i∈I−G If we now can show that [a](¬p → q) = 1 then [a]q = [a · p]q. expresses that exactly the children in group G are This is summarised by muddy. Moreover, we say that world w satisfies a test q of the form mi or ¬mi, in symbols w |= q, iff |= w → q. Lemma 7.1 (Knowledge Propagation). Since no child i can see herself, she cannot distinguish between worlds that are identical except for the value |= [a](¬p → q) ⇒ [a]q = [a · p]q . of m . This induces as access relation the equivalence i As an example, for three Muddy Children we have 0 0 0 for all i ∈ {1, 2, 3}, by Boolean algebra, w∼iw ⇔df w = w ∨ w = flipi(w) ,
C(m1 + m2 + m3) = C(¬(¬m1 · ¬m2) → m3) ≤ where flipi(mG) =df mG∆{i} and the operator ∆ forms the symmetric difference of sets, i.e., F ∆G = (F − G) ∪ Ki(¬(¬m1 · ¬m2) → m3) . (G − F ). As an equivalence, ∼ is reflexive and satisfies Hence [a ]m = [a · ¬m · ¬m ]m . positive and negative introspection. i 3 i 1 2 3 To solve the puzzle in a different way, we want to end up with a reduced Kripke structure in which for the 7.2. Public Announcement actually muddy children only a single accessible world In the public announcement (e.g. [27, 12, 34]) of a remains so that for them knowledge is complete. property p one makes sure that all agents henceforth Since we now have to work with knowledge in know p. This can be realised in various ways. different structures, we have to give up the convenient For instance, the semantics of Pub p in [12] corre- operators K, E, C and to revert to the general box sponds to changing an access element a to a · p. notation. Therefore the knowledge propagation rule (24) applies; Shrinking a Kripke structure can be expressed it is called “atomic permanence” in [12]. In fact, the through restricting access elements by tests. If the operator [Pub p] there largely behaves like [p]. With this, original access element was a we would now, e.g. like to the Action-Knowledge and Partial Functionality axioms consider only a · p where p is a test. This preserves only of [12] translate into2 those transitions in a that lead into worlds satisfying p. By antitony of box in its first argument (5), restrict- [p][a]q = p → [a][p]q , ing an access element implies knowledge preservation: [p]¬q = p → ¬[p]q . Since p ≤ 1 implies a · p ≤ a, we have Using (8) and (box2), the first of these compacts into ∀ q :[a]q ⇒ [a · p]q , [p · a]q = [p · a · p]q . i.e., in a restricted structure the knowledge of the original structure is preserved and possibly extended. For the second one we calculate, using again (8), the Moreover, by Axiom (box2) and the explicit form definition of → and Boolean algebra, of the box of a test (8) there is an interplay between p → ¬[p]q = p → ¬(p → q) = p → ¬q = [p]¬q , restriction and implication so that in the modal semiring setting this is a theorem [a](p → q) = [a · p]q . (24) rather than an axiom. A more detailed analysis is beyond the scope of this paper. Let us now, conversely, see how knowledge about a Another possibility would be to use the smaller certain property q can be preserved when the relevant restriction p · a · p as the definition of the public accessible worlds are restricted by a test p. Assume the announcement of p in access element a; this would underlying modal semiring to be weak. Then eliminate the need for the Action-Knowledge axiom. [a]q Restriction is particularly well-behaved if the access = {[ neutrality ]} element a under consideration is m-symmetric, since we [a · 1]q 2I am grateful to one of the referees for pointing that out.
11 know from Lemma 3.7(1) that then p · a · p is symmetric – Satisfaction of [!p]q in a frame is defined as again. Moreover, axiom (box2) and the explicit form (8) satisfaction of q in a modified frame. of box for tests imply – The semantics is again given in a PDL-like fashion, making the new access relation explicit in the first [p · a · p]q = p → [a](p → q) . argument of box.
Hence, in a modal semiring we have We can represent the latter approach directly in our setting by defining the modification of access element |= p → q ⇒ |= [p · a · p]q ai as ai!p =df p · ai · p + ¬p · ai · ¬p. The advantage of our approach is that in both cases which implies we can just use the same algebraic laws as before and |= [p · a · p]p . (25) do not need to invent special inference rules for the announcement operators. Note that p here is a semantic value and not a In the literature there are many more logics dealing formula; otherwise this law would not be valid, as the with knowledge or belief revision. We are convinced that discussion on (un)successful updates in [27, 34] shows. a large portion of these can be treated uniformly in In fact, so far we have refrained from giving a syntax. the setting of modal semirings. For a related approach One can do this using a set Π of propositional atoms see [36], where belief update is modelled using semiring and again a finite index set I = {1, . . . , n}. Then the concepts. That paper enriches test semirings with a set Φ of propositions is defined by the grammar special operator for belief revision (where beliefs are Φ ::= Π | ¬Φ | Φ ∧ Φ | K Φ | EΦ | CΦ | Φ!Φ , represented as tests). It presents an axiomatisation i of that operator which entails the standard AGM where i ranges over I. (We use the notation ϕ!ψ rather axioms [37]. Contrarily, our aim was to show that than ϕ+ψ of [27] or [ϕ]ψ of [34] to avoid confusion with already the general concept of modal semirings is the + and box of modal semirings.) adequate. To define a semantics for these formulas over a modal 7.3. Preferences and Their Upgrade semiring S we choose an access element ai ∈ S for every i ∈ I and a testπ ˆ ∈ test(S) for every π ∈ Π. Moreover, We now return to our general setting of modal we again set aI =df a1 +···+an. The semantics [[ϕ]]q ∈ semirings; in particular we assume neither of the axioms test(S) is parameterised by a test q that determines the (T), (PI) or (NI). Let us briefly show how one can subset of possible worlds w.r.t. which ϕ is evaluated. reason about other aspects of knowledge and belief. The semantic clauses corresponding to the approach Some agent logics allow expressing preferences between of [34] read as follows. possible worlds (e.g. [13]). Since we are completely free in choosing our access [[π]] = πˆ · q , q df elements, we can also include these. To this end we equip [[¬ϕ]]q =df q − [[ϕ]]q , each agent i with her own preference relation i. The [[ϕ ∧ ψ]]q =df [[ϕ]]q · [[ψ]]q , intention is that [i]p holds in a world w iff p holds in [[Kiϕ]]q =df [q · ai · q][[ϕ]]q , 0 all worlds w that agent i prefers over w under i, i.e., [[Eϕ]]q =df [q · aI · q][[ϕ]]q , 0 + for which w i w . [[Cϕ]]q =df [(q · aI · q) ][[ϕ]]q , Usually one requires that i be a preorder, modally, [[ϕ!ψ]]q =df u → [[ψ]]q·u where u =df [[ϕ]]q . [i]p ≤ p , [i]p ≤ [i][i]p . Based on this relative semantics we can define the Antisymmetry is not required: if w w ∧ w w absolute semantics [[ϕ]] as 1 i 2 2 i 1 then agent i is indifferent about w1 and w2 . Using the preference concept, one can, e.g., model [[ϕ]] =df [[ϕ]]1 . regret [13]: the formula Ki¬p ∧ hiip expresses that From this definition it is clear that in a formula although agent i knows that p is not true, she would (Kϕ)!(Kϕ) the two occurrences of Kϕ may be evaluated still prefer a world where it would be. in different substructures and hence yield different tests, A preference agent system can be updated in various in which case Law (25) does not apply. This is what is ways. In belief revision agents may discard or add referred to as unsuccessful update in [27, 34]: a formula links to epistemic neighbour worlds. We model the two may become false after publicly announcing it. The possibilities presented in [13] in our agent algebra. classical example for this is the Moore sentence “π is Another change operation is preference upgrade true and you don’t know this” [35]. by suggesting that p be observed. This affects the A different approach to modelling public announce- preference relations, not the accessibilities: ment of a test p is to remove all links between p-worlds p#i =df p ·i ·p + ¬p ·i . and ¬p-worlds. In [13] the corresponding operator !p is explained in two ways: Now agent i no longer prefers ¬p worlds over p ones.
12 PART II: GAMES AND Definition 9.1. Given an arbitrary Boolean algebra PREDICATE TRANSFORMERS B, a predicate transformer (over B) is a function f : B → B. By id we denote the identity transformer and In this part we return to the case of modal left ◦ denotes function composition. semirings. As in Section 3 we denote the meet, join and comple- mentation operators of B by · , + and ¬, the least and 8. GAMES AND THEIR ALGEBRA greatest elements by 0 and 1. This makes B a modal i-semiring with test(B) = B and hpiq = p · q by (8). The algebraic description of two-player games dates back at least to [38]; for a more recent survey see [10]. Definition 9.2. Consider a predicate transformer The idea is to use a predicate transformer semantics f : B → B over a Boolean algebra B. that is a variant of (a µ-calculus-like enrichment of) 1. If for all p, q ∈ B with p ≤ q we have f(p) ≤ f(q) PDL. then f is isotone. The starting point is, however, a slightly different relational model. It does not use relations of type 2. f is disjunctive if f(p + q) = f(p) + f(q) and P(W × W ), where the set of worlds W consists of the conjunctive if f(p · q) = f(p) · f(q). game positions and P is the power set operator, but 3. f is strict if f(0) = 0 and co-strict if f(1) = 1. rather of type P(W × P(W )). A pair (s, X) in relation R models that the player whose turn it is has a strategy Let PT(B), ISO(B), CON(B) and DIS(B) be the set to move from starting position s into a position in set of all, of isotone, of conjunctive and of disjunctive X. To make this well-defined, R has to be ⊆-isotone in predicate transformers over B. its second argument: It is well known that conjunctivity and disjunctivity imply isotony. Under the pointwise ordering f ≤ g ⇔ (s, X) ∈ R ∧ X ⊆ Y ⇒ (s, Y ) ∈ R. df ∀ p . f(p) ≤ g(p), PT forms a lattice where the join f + g and meet f u g of f and g are the pointwise liftings of This type of structure is similar to the so-called minimal + and ·, respectively: models used in the semantics of non-normal logics [39] and has been rediscovered under the name of “upclosed (f + g)(p) =df f(p) + g(p) , (f u g)(p) =df f(p) · g(p) . multirelations”. Now again, sets of worlds are identified with predicates over worlds. As pointed out in [38], such The least and greatest elements of PT(B) (and ISO(B) a relation R induces an isotone predicate transformer and DIS(B)) are the constant functions 0(p) =df 0 and >(p) = 1. Note that 0 and > both are left zeros w.r.t. ρ(R): P(W ) → P(W ) via ρ(R)(X) =df {s | (s, X) ∈ df R}. It is easy to check that the set of ⊆-isotone relations ◦. The substructure (ISO, +, 0, ◦, id) is a left i-semiring; is isomorphic to that of isotone predicate transformers the substructure (DIS(B), +, 0, ◦, id) is even a weak i- (the latter ordered by pointwise relational inclusion). semiring. Likewise, the structure (CON(B), u, >, ◦, id) The basic operations to build up more complex games is a weak i-semiring isomorphic to DIS(B), but with from atomic ones (such as single moves) are choice, the mirror ordering [14]. The isomorphism is provided d sequential composition, finite iteration and tests, which by the duality operator : PT(B) → PT(B), defined d are also basic operations found in left i-semirings; by f (p) =df ¬f(¬p). also the axioms (see [10]) are exactly those for left i- In the case where B = test(S) for some weak i- semirings. There are no constants 0 and 1; but they semiring S, the modal operator h i provides a weak i- could easily be added by the standard extension of semiring homomorphism from S into DIS(B). semigroups to monoids. The only operation particular If B is a complete Boolean algebra then PT(B) is a to game construction is dualisation in which the two complete lattice with ISO(B), DIS(B) and CON(B) as players exchange their roles. complete sublattices. Hence we can extend ISO(B) and Since games can be viewed as isotone predicate DIS(B) by a star operator via a least fixpoint definition: transformers, we study these from a bit more abstract ∗ f =df µ(λg . id + f ◦ g) , viewpoint in the next section. Based on that we will show that they form a modal left semiring with where µ is the least-fixpoint operator. It has been shown dualisation, i.e., an abstract algebraic model of games. in [20] that this satisfies the star laws. By passing to We will also show how to add finite iteration. the mirror ordering, one sees that also the subalgebra of conjunctive predicate transformers can be made into 9. PREDICATE TRANSFORMER SEMI- a left Kleene algebra; this is essentially the approach RINGS taken in [14] (except for infinite iteration). A useful consequence of the star induction rule is a For our purposes, all that matters about P(W ) is its corresponding one for the dual of a star, generalising structure as a Boolean algebra. Therefore we generalise (15): as follows. h ≤ g u f d ◦ h ⇒ h ≤ (f ∗)d ◦ g . (26)
13 Let us now connect this to game algebra. For a 10. MODAL SEMIRINGS OF PREDICATE predicate transformer g we find in [38] the following TRANSFORMERS AND DEMONIC RE- two definitions concerning iterations (we use boldface FINEMENT ALGEBRA stars and brackets here to distinguish Parikh’s notation Although we have now seen a somewhat more abstract from ours): predicate transformer model of game algebra, we will ?
14 Part (2) means that the tests in the i-semiring the latter provided S has a greatest element >. In an of isotone predicate transformers are precisely the operational view, both constructs check whether p holds diamonds of the elements of B (see Section 9). at the time of their execution. If so, they simply proceed Because of Part (1) and (8) we will, for convenience, (remember that 1 stands for the null action). If not, the denote mappings of the form λq . p · q by hpi also in assertion aborts while the assumption may do anything the general case of ISO(B). The proof also shows that (> means the set of all possible choices, so we have the ¬hpi = h¬pi. behaviour ex falso quodlibet). Now we are ready to enrich ISO(B) by box and Both expressions can be simplified. For assertions we diamond operators. To this end we work out what the obtain right hand side of axiom (box1) means there: assert p = p · 1 + ¬p · 0 = p + 0 = p . hpi ◦ f ◦ ¬hqi ≤ 0 ⇔ ∀ r : p · f(¬q · r) ≤ 0 ⇔ p · f(¬q · 1) ≤ 0 ⇔ p ≤ ¬f(¬q) ⇔ p ≤ f d(q); Hence the construct assert p could be omitted; we have introduced it just for symmetry. For assumptions we the second equivalence holds by isotony of f. So the get, since ¬p · 1 ≤ ¬p · >, only possible choice is d assume p = p · 1 + ¬p · > = p · 1 + ¬p · 1 + ¬p · > [f]hqi =df hf (q)i , hfihqi =df hf(q)i . = (p + ¬p) · 1 + ¬p · > = 1 + ¬p · > , Let us check that this satisfies axiom (box2) as well: which is the expression given above for assumptions. [f ◦ g]hqi = h(f ◦ g)d(q)i = d d d Let us now see which elements of a set ISO(B) of h(f (g (q))i = [f]hg (q)i = [f][g]hqi . isotone predicate transformers are assumptions in this Hence box and diamond are well defined in ISO(B). In sense: sum: (h¬pi ◦ > + id)(q) = h¬pi(>(q)) + q = Theorem 10.3. For a Boolean algebra B the set h¬pi1 + q = ¬p + q = [p]q . ISO(B) with the above operations forms a modal left Kleene algebra with dualisation. Written in point-free style, h¬pi ◦ > + id = [p]. So in ISO(B) the assumptions are the de Morgan duals of the This rounds off the picture in that now also the tests. test operations of game algebra and PDL have become For the dual of the domain operator we obtain first-class citizens in predicate transformer algebra. Moreover, we can enrich that algebra by a domain (pf)d = hf(1)id = [f(1)] = [f(¬0)] = [¬f d(0)] . (29) operator which will provide the announced connection with refinement algebra. This latter expression coincides with that for (f d) As mentioned in Section 3.3, in a modal left semiring in the mentioned concrete model of [14], so that by d d d d the domain operator [6] p : S → test(S) is given by (g ) = g we have the equation τf = ((f )) . Finally, pa =df hai1. This characterises the set of starting worlds it should be noted that the rightmost expression in of access element a. For ISO(B) this works out to (29) also corresponds to the guard ¬wp(a, false) of [43], pf = hf(1)i. This expression coincides with that for while that for τ coincides with the termination predicate the termination operator τf in the concrete model of wp(a, true) there. demonic refinement algebra (DRA) given at the end of [14]. That algebra is an axiomatic algebraic system 11. CONCLUSION AND OUTLOOK for dealing with predicate transformers under a demonic We have shown that modal i-semirings and Kleene view of non-determinacy. However, τf is not a test (or algebras form a comprehensive and flexible framework guard [42]), but an assumption (unfortunately called for handling various modal logics in a uniform algebraic “assertion” in [14]). These take the form ¬p · > + 1 fashion. We therefore think that the design of new where > is the greatest element (which always exists in modal systems geared toward special applications may DRA). benefit from using this algebraic approach. Besides τ (which is characterised by the domain An interesting approach, close in spirit, is [44], where axioms of [6]), DRA has an enabledness operator , modules over quantales are used to define an algebraic defined by dual axioms in terms of guards. semantics of modal operators. However, having separate Let us explain the relation between tests and assump- sorts for actions and (the equivalents of) tests makes tions. We first introduce a test-based conditional by that framework less flexible than ours, since those if p then a else b ⇔df p · a + ¬p · b . entities cannot be combined freely with the same operators. Moreover, the restriction to (full) quantales is Using it, assertions and assumptions can be defined as less general than what the i-semiring framework offers.
assert p =df if p then 1 else 0 One topic we have omitted from the present paper assume p =df if p then 1 else > , is that of infinite iteration. This has been treated
15 in [20]. However, there is a restriction. Although, over [12] Baltag, A. and Moss, L. S. (2004) Logics for epistemic a complete Boolean algebra B, infinite iteration can be programs. Synthese, 139, 165–224. ω defined in ISO(B) as f =df νg . f ◦ g, this does not [13] van Benthem, J. and Liu, F. (2007) Dynamic logic of imply the usual omega coinduction law c ≤ a · c + b ⇒ preference upgrade. Journal of Applied Non-Classical c ≤ aω + a∗ · b [4]. It only does so in the set DIS(B) of Logics, 17, 157–182. disjunctive predicate transformers over B. However, as [14] Solin, K. and von Wright, J. (2006) Refinement algebra stated in [10], disjunctivity is not a natural requirement with operators for enabledness and termination. In Uustalu, T. (ed.), MPC, Lecture Notes in Computer for games. Future work will deal with a suitably revised Science, 4014, pp. 397–415. Springer. axiomatisation of infinite iteration of games. [15] McCarthy, J. (1990) Formalization of two puz- Further applications will concern the analysis of zles involving knowledge. Formalizing Common winning and losing positions (extending [45] and [5]). Sense - Papers by John McCarthy, pp. 158–166. Moreover, we will improve work on the automatic ver- Ablex Publishing Corporation. http://www-formal. ification of properties in knowledge and game semirings stanford.edu/jmc/puzzles/puzzles.html|. using, e.g., the tools Prover9 and Mace4 [46] along [16] Popkorn, S. (1994) First Steps in Modal Logic. the lines of [47]. While we have succeeded in an auto- Cambridge University Press. matic verification of the Wise Men Puzzle in a simplified [17] J´onsson,B. and Tarski, A. (1951) Boolean algebras version, full automation of the solution in the present with operators, part I. American Journal of paper still faces performance problems which we hope Mathematics, 73, 891–939. to overcome by a modified axiomatisation. [18] Harel, D., Kozen, D., and Tiuryn, J. (2000) Dynamic Logic Foundations of Computing. MIT Press. Acknowledgments I am grateful to E. Andr´efor [19] J.A. Bergstra, A. P., W. Fokkink (2001) Process algebra drawing my attention to the area of modal agent logics with recursive operations. In Bergstra, J., Ponse, A., and to J. Desharnais, B. Dill, R. Gl¨uck, P. H¨ofner, and Smolka, S. A. (eds.), Handbook of Process Algebra, H. Leiß, M.E. M¨uller,P. Roocks, K. Solin and the pp. 333–389. Elsevier. anonymous referees for many helpful comments and [20] M¨oller,B. (2007) Kleene getting lazy. Sci. Comput. Program., 65, 195–214. suggestions. [21] Manes, E. and Benson, D. (1985) The inverse semigroup of a sum-ordered semiring. Semigroup Forum, 31, 129– REFERENCES 152. [1] M¨oller, B. (2008) Knowledge and games in modal [22] Dijkstra, E. W. (1976) A Discipline of Programming. semirings. In Berghammer, R., M¨oller, B., and Prentice-Hall. Struth, G. (eds.), RelMiCS, Lecture Notes in Computer [23] M¨oller,B. and Struth, G. (2006) Algebras of modal Science, 4988, pp. 320–336. Springer. operators and partial correctness. Theor. Comput. Sci., [2] Hebisch, U. and Weinert, H. (1998) Semirings: 351, 221–239. Algebraic Theory and Applications in Computer [24] Hollenberg, M. (1997) An equational axiomatization of Science Series in Algebra. World Scientific. dynamic negation and relational composition. Journal [3] Kozen, D. (1994) A completeness theorem for Kleene of Logic, Language and Information, 6, 381–401. algebras and the algebra of regular events. Inf. [25] Desharnais, J. and Struth, G. (2008) Modal semirings Comput., 110, 366–390. revisited. In Audebaud, P. and Paulin-Mohring, C. [4] Cohen, E. (2000) Separation and reduction. In (eds.), MPC, Lecture Notes in Computer Science, 5133, Backhouse, R. C. and Oliveira, J. N. (eds.), MPC, pp. 360–387. Springer. Lecture Notes in Computer Science, 1837, pp. 45–59. [26] Hirsch, R. and Mikul´as, S. (2011) Axiomatizability Springer. of representable domain algebras. J. Log. Algebr. [5] Desharnais, J., M¨oller,B., and Struth, G. (2004) Modal Program., 80, 75–91. Kleene Algebra and Applications — A Survey —. [27] Plaza, J. (2007) Logics of public communications. JoRMiCS, 1, 93–131. Synthese, 158, 165–179. [6] Desharnais, J., M¨oller,B., and Struth, G. (2006) Kleene [28] Gerbrandy, J. (2007) The surprise examination in algebra with domain. ACM Trans. Comput. Log., 7, dynamic epistemic logic. Synthese, 155, 21–33. 798–833. [29] Huth, M. and Ryan, M. (2004) Logic in Computer [7] Kozen, D. (1997) Kleene algebra with tests. ACM Science: modelling and reasoning about systems (second Trans. Program. Lang. Syst., 19, 427–443. edition). Cambridge University Press. [8] M¨oller,B., H¨ofner,P., and Struth, G. (2006) Quantales [30] van der Hoek, W. and Wooldridge, M. (2003) and temporal logics. In Johnson, M. and Vene, V. Cooperation, knowledge, and time: Alternating-time (eds.), AMAST, Lecture Notes in Computer Science, temporal epistemic logic and its applications. Studia 4019, pp. 263–277. Springer. Logica, 75, 125–157. [9] Fagin, R., Moses, Y., Halpern, J., and Vardi, M. (2003) [31] Agotnes,˚ T. (2006) Action and knowledge in Reasoning About Knowledge. Mit Press. alternating-time temporal logic. Synthese, 149, [10] Pauly, M. and Parikh, R. (2003) Game logic - an 375–407. overview. Studia Logica, 75, 165–182. [32] van Ditmarsch, H. P., Ruan, J., and Verbrugge, R. [11] von Wright, J. (2004) Towards a refinement algebra. (2008) Sum and product in dynamic epistemic logic. Sci. Comput. Program., 51, 23–45. J. Log. Comput., 18, 563–588.
16 [33] Baltag, A., Moss, L. S., and Solecki, S. (1998) The logic of public announcements and common knowledge and private suspicions. In Gilboa, I. (ed.), Proc. TARK ’98 — 7th Conference on Theoretical Aspects of Rationality and Knowledge, pp. 43–56. Morgan Kaufmann. [34] van Ditmarsch, H. P. and Kooi, B. P. (2006) The secret of my success. Synthese, 151, 201–232. [35] Moore, G. (1942) A reply to my critics. In Schilpp, P. (ed.), The Philosophy of G.E. Moore, The Library of Living Philosophers, 4, pp. 535–677. Northwestern University, Evanston IL. [36] Solin, K. (2010) A sketch of a dynamic epistemic semiring. Inf. Comput., 208, 594–604. [37] Alchourr´on,C. E., G¨ardenfors,P., and Makinson, D. (1985) On the logic of theory change: Partial meet contraction and revision functions. J. Symb. Log., 50, 510–530. [38] Parikh, R. (1983) Propositional logics of programs: New directions. In Karpinski, M. (ed.), Proc. FCT 83 — Fundamentals of Computation Theory, Lecture Notes in Computer Science, 158, pp. 347–359. Springer. [39] Chellas, B. (1980) Modal Logic: An Introduction. Cambridge University Press. [40] Desharnais, J., M¨oller, B., and Struth, G. (2004) Termination in modal Kleene algebra. In L´evy, J.-J., Mayr, E. W., and Mitchell, J. C. (eds.), IFIP TCS, pp. 647–660. Kluwer. [41] Desharnais, J., M¨oller, B., and Struth, G. (2011) Algebraic notions of termination. Logical Methods in Computer Science, 7, 1–29. [42] Back, R. and Wright, J. (1998) Refinement Calculus: A Systematic Introduction Graduate Texts in Computer Science. Springer. [43] Nelson, G. (1989) A generalization of Dijkstra’s calculus. ACM Trans. Program. Lang. Syst., 11, 517– 561. [44] Baltag, A., Coecke, B., and Sadrzadeh, M. (2007) Epistemic actions as resources. J. Log. Comput., 17, 555–585. [45] Backhouse, R. C. and Michaelis, D. (2003) Fixed- point characterisation of winning strategies in impartial games. In Berghammer, R., M¨oller,B., and Struth, G. (eds.), RelMiCS, Lecture Notes in Computer Science, 3051, pp. 34–47. Springer. [46] McCune, W. (2005–2010) Prover9 and Mace4. http://www.cs.unm.edu/~mccune/prover9/. [47] H¨ofner,P. and Struth, G. (2007) Automated reasoning in Kleene algebra. In Pfenning, F. (ed.), CADE, Lecture Notes in Computer Science, 4603, pp. 279–294. Springer.
17