On the Complexity of Dynamic Epistemic Logic ∗

Guillaume Aucher François Schwarzentruber University of Rennes 1 - INRIA ENS Cachan - Brittany extension [email protected] [email protected] cachan.fr

ABSTRACT knowledge change of multiple agents, and more generally Although Dynamic Epistemic Logic (DEL) is an influential about information change. logical framework for representing and reasoning about in- The theoretical work of the above mentioned research formation change, little is known about the computational fields has already been applied to various practical problems complexity of its associated decision problems. In fact, we stemming from telecommunication networks, World Wide only know that for public announcement logic, a fragment Web, peer to peer networks, aircraft control systems, and so of DEL, the satisfiability problem and the model-checking on. . . In general, in all applied contexts, the investigation of problem are respectively PSPACE-complete and in P. We the algorithmic aspects of the formalisms employed plays an contribute to fill this gap by proving that for the DEL lan- important role in determining whether and to what extent guage with event models, the model-checking problem is, they can be applied. For this reason, the algorithmic aspects surprisingly, PSPACE-complete. Also, we prove that the of DEL need to be studied. satisfiability problem is NEXPTIME-complete. In doing so, To this aim, a preliminary step consists in studying the we provide a sound and complete tableau method deciding computational properties of its main associated decision prob- the satisfiability problem. lems, namely the model checking problem and the satisfiability problem. Indeed, it will indirectly provide algorithmic methods to solve these decision problems and give us a hint Categories and Subject Descriptors of whether and to what extent our methods can be applied. I.2.4 [Knowledge representation formalisms and meth- However, surprisingly little is known about the computa- ods]: Modal logic; F.1.3 [Complexity measure and classes]: tional complexity of these problems. We only know that Reducibility and completeness for public announcement logic, a fragment of DEL [Plaza, 1989], the model checking problem is in P and the satisfi- General Terms ability problem is PSPACE-complete. Here, we aim to fill this gap for the full language of DEL with event models. Theory DEL is built on top of epistemic logic. An epistemic model represents how a given set of agents perceive the actual world Keywords in terms of beliefs and knowledge about this world and about Dynamic epistemic logic, computational complexity, model the other agents’ beliefs. The insight of the DEL approach checking, satisfiability is that one can describe how an event is perceived by agents in a very similar way: an agent’s perception of an event can also be described in terms of beliefs and knowledge. For 1. INTRODUCTION example, at the battle of Waterloo, when marshal Blucher¨ Research fields like distributed artificial intelligence, dis- received the message of the duke of Wellington inviting him tributed computing and game theory all deal with groups of to join the attack at dawn against Napoleon, Wellington did human or non-human agents which interact, exchange and not know at that very moment that Blucher¨ was receiving receive information. The problems they address range from his message, and Blucher¨ knew it. This is a typical example multi-agent planning and design of distributed protocols to of announcement which is not public. This led Baltag, Moss strategic decision making in groups. In order to address ap- and Solecki to introduce the notion of event model [Baltag propriately and rigorously these problems, it is necessary to et al., 1998]. The definition of an event model, denoted be able to provide formal means for representing and reason- (M,w), is very similar to the definition of an epistemic ing about such interactions and flows of information. The model. They also introduced a product update, which defines framework of Dynamic Epistemic Logic (DEL for short) is a new epistemic model representing the situation after the very well suited to this aim. Indeed, it is a logical frame- event. Then, they extended the epistemic language with work where one can represent and reason about beliefs and dynamic operators [M,w]ϕ standing for ‘ϕ holds after the M ∗An extended version of this article with full proofs can be occurrence of the event represented by ( ,w )’. found at the following url: http://hal.inria.fr/docs/00/ Using the so-called reduction axioms, it turns out that 75/95/44/PDF/RR-8164.pdf any formula with dynamic operator(s) can be translated to an equivalent epistemic formula without dynamic oper- TARK 2013, Chennai, India. ator. As a first approximation, we could be tempted to Copyright 2013 by the authors.

19 use these reduction axioms to reduce both the model check- 1,2 2 ing problem and the satisfiability problem of DEL to the Õ ×Ö × ÕÔ ×Ö ÕÔ model checking problem and the satisfiability problem of w : p ÐÑ(w, w1):pÒÓ ÐÑ(w, w1,w2):pÒÓ epistemic logic, because optimal algorithmic methods already exist for these related problems. However, the re- 2 1 2 duction algorithm induced by the reduction axioms is expo- z z ¬ nential in the size of the input formula. Therefore, for the u : Yp p 1,2 p 2 satisfiability problem, we only obtain an algorithm which is 2 1 in EXPSPACE (because the satisfiability problem of epis- 1 z temic logic is PSPACE-complete), and for the model check- ¬pY p 1,2 ing problem, we only obtain an algorithm which is in EX- PTIME (because the model checking problem of epistemic 2 1 logic is in P). These algorithms are not optimal because, as ¬p we shall see, there exists an algorithm solving the satisfiabil- Y ity problem which is in NEXPTIME⊆ EXPSPACE and also an algorithm solving the model checking problem which is in 1 PSPACE⊆ EXPTIME. Our algorithm for solving the satis- M fiability problem is based on a sound and complete tableau Figure 1: Pointed epistemic models ( ,w) (left), M⊗M M⊗M ⊗ method which does not resort to the reduction axioms. (( 1), (w, w1)) (center)and( 1 M The paper is organized as follows. In Section 2, we re- 2, (w, w1,w2)) (right) call the core of the DEL framework and the different vari- ants of languages with event models which have been introduced in the literature. In Section 3, we prove that is an abbreviation for p ∧¬p,and is an abbreviation for the model checking problem of DEL is PSPACE-complete, ¬⊥. The formula Ba ϕ is an abbreviation of ¬Ba¬ϕ.The and in Section 4 we prove that the satisfiability problem size of a formula ϕ ∈LEL is defined by induction as follows: is NEXPTIME-complete. In Section 5, we discuss related |p| =1;|¬ϕ| =1+|ϕ|; |ϕ∧ψ| =1+|ϕ|+|ψ|; |Baϕ| =1+|ϕ|. works and whether our results still hold when we extend the expressiveness of the language with common belief and ‘star’ Intuitively, the formula Baϕ reads as ‘agent a believes that iteration operators. We conclude in Section 6. ϕ holds in the current situation’. Definition 3 (Truth conditions). 2. DYNAMIC EPISTEMIC LOGIC Given an epistemic model M =(W, R, V )andaformula Following the methodology of DEL, we split the exposi- ϕ ∈LEL, we define inductively the satisfaction relation |=⊆ tion of the DEL logical framework into three subsections. In W ×LEL as follows: for all w ∈ W , Section 2.1, we recall the syntax and semantics of the epis- M,w |= p iff w ∈ V (p) temic language. In Section 2.2, we define event models, and M,w |= ϕ ∧ ψ iff M,w |= ϕ and M,w |= ψ in Section 2.3, we define the product update. In Section 2.4, M,w |= ¬ϕ iff not M,w |= ϕ we recall the different languages that have been introduced M,w |= Baϕ iff for all v ∈ Ra(w), we have M,v |= ϕ in the DEL literature and we introduce our language LDEL. We write M|= ϕ when for all w ∈M, it holds that M,w |= 2.1 Epistemic language ϕ. Also, we write |= ϕ, and we say that ϕ is valid,whenfor In the rest of the paper, ATM is a countable set of atomic all epistemic model M,itholdsthatM|= ϕ. Dually, we propositions and AGT is a finite set of agents. say that ϕ is satisfiable when ¬ϕ is not valid. M A (pointed) epistemic model ( ,w) represents how the Example 1. Our running example is inspired by the co- actual world represented by w is perceived by the agents. ordinated attack problem from the distributed systems folk- Intuitively, in this definition, vRau means that in world v lore [Fagin et al., 1995]. Our set of atomic propositions is agent a considers that world u might be the actual world. ATM = {p} andoursetofagentsisAGT= {1, 2}. Agent Definition 1 (Epistemic model). 1 is the duke of Wellington and agent 2 is marshal Blucher;¨ An epistemic model is a tuple M =(W, R, V ) where W p stands for ‘Wellington wants to attack at dawn’. The ini- is a non-empty set of possible worlds, R maps each agent tial situation is represented in Figure 1 by the pointed epis- W temic model (M,w)=({w, u},R1 = {(w, w), (u, u)},R2 = a ∈ AGT to a relation Ra ⊆ W × W and V : ATM → 2 { } { } is a function called a valuation. We abusively write w ∈M (w, w), (w, u) ,V(p)= w ).Inthispointedepistemic M | ∧ for w ∈ W and we say that (M,w)isapointed epistemic model, it holds that ,w = p B1p: Wellington ‘knows’ that he wants to attack at dawn. It also holds that M,w |= ¬B2p: model.Wealsowritev ∈ Ra(w)forwRav. Blucher¨ does not ‘know’ that Wellington wants to attack Then, we define the following epistemic language LEL.It at dawn; and M,w |= B1¬B2p: Wellington ‘knows’ that can be used to state properties of epistemic models: Blucher¨ does not ‘know’ that he wants to attack at dawn. Definition 2 (Epistemic language). 2.2 Event model The language LEL of epistemic logic is defined as follows: A (pointed) event model (M ,w ) represents how the actual event represented by w is perceived by the agents. In- LEL : ϕ ::= p |¬ϕ | (ϕ ∧ ϕ) | Baϕ tuitively, in this definition, u Rav means that while the pos- where p ranges over ATM and a ranges over AGT. A for- sible event represented by u is occurring, agent a considers mula of LEL is called an epistemic formula. The formula ⊥ possible that the event represented by v is in fact occurring.

20 2 1 Example 3. The pointed epistemic models ((M⊗M1), × ×Ö × ÕÔ (w, w1)) and (M⊗M1 ⊗M2, (w, w1,w2)) are represented in w1 : p ÐÑw2 : B2pÒÓ Figure 1. After Blucher¨ receives the message of Wellington, Blucher¨ ‘knows’ that Wellington wants to attack at dawn, 1 2 but Wellington does not ‘know’ that Blucher¨ ‘knows’ it: M⊗ M1, (w, w1) |= p∧B2p∧¬B1B2p. Likewise, after Wellington u1 : X u2 : X receives the message of Blucher¨ telling him that he ‘knows’ that he wants to attack at dawn (B2p), Wellington ‘knows’ 1,2 1,2 that Blucher¨ ‘knows’ that he wants to attack at dawn, but Blucher¨ does not ‘know’ that Wellington ‘knows’ it: M⊗ Figure 2: Pointed event models (M1,w1) (left)and M1 ⊗M2, (w, w1,w2) |= p ∧ B2p ∧ B1B2p ∧¬B2B1B2p. (M2,w2) (right) Hence, in particular, M,w |= ¬[M1,w1][M2,w2]B2B1B2p. 2.4 Languages of DEL Definition 4 (Event model). In [Baltag et al., 1998], the language is defined as follows: An event model is a tuple M =(W ,R ,Pre) where W is ϕ ::= p |¬ϕ | (ϕ ∧ ϕ) | Baϕ | [M ,w ]ϕ a non-empty and finite set of possible events, R maps each agent a ∈ AGT toarelationRa ⊆ W ×W and Pre : W → where p ranges over ATM , a over AGT and (M ,w )isany LEL is a function that maps each event to a precondition pointed and finite event model. The formula M ,w ϕ is expressed in the epistemic language. an abbreviation for ¬[M,w]¬ϕ. We abusively write w ∈M for w ∈ W and we say Intuitively, [M,w]ϕ readsas‘ϕ will hold after the occur- that (M ,w )isapointed event model.Thesize of an event rence of the event represented by (M,w)’ and M,w ϕ model M =(W ,R ,Pre)isnoted|M | andisdefinedas reads as ‘the event represented by (M,w) is executable in follows: card(W )+ a∈AGT card(Ra)+ w∈W |Pre(w )|. the current situation and ϕ will hold after its execution’. However, note that in this definition, preconditions of Example 2. In Figure 2 are represented two pointed event event models are necessarily epistemic formulas. In [Baltag models. The first, (M1,w1)=({w1,u1},R1 = {(w1,u1), and Moss, 2004], another language is introduced which can (u1,u1)},R2 = {(w1,w1), (u1,u1)},Pre,w1) where Pre(w1) deal with event models whose preconditions may involve for- = p and Pre(u1)=, represents the event whereby Blucher¨ mulas with event models. This language relies on the notion receives the message of Wellington that he wants to attack at of event signature and the epistemic language is extended dawn. When this happens, Wellington believes that nothing with a modality [Σ,ϕ1,...,ϕn]ϕ, where Σ is an event signa- happens and believes that this is even common knowledge. ture. The language of [Baltag and Moss, 2004] also includes The second, (M2,w2)=({w2,u2},R1 = {(w2,w2), (u2,u2)}, PDL-like program constructions such as sequential composi- R2 = {(w2,u2), (u2,u2)},Pre,w2),wherePre(w2)=B2p tion, union and ‘star’ operation of event models (see Section and Pre(u2)=, represents the event whereby Wellington 5 for a definition of these program constructions). receives the message of Blucher¨ telling him that he ‘knows’ In [van Ditmarsch et al., 2007], preconditions can also that Wellington wants to attack at dawn. be formulas involving event models, but only union of programs is allowed. It is therefore a fragment of the language 2.3 Product update of [Baltag and Moss, 2004] since it does not include sequen- The following product update yields a new pointed epis- tial composition nor the ‘star’ operation. This will be our temic model M⊗M, (w, w) representing how the new sit- language in this paper. uation which was previously represented by (M,w)isper- ceived by the agents after the occurrence of the event rep- Definition 6 ([van Ditmarsch et al., 2007]). stat resented by (M ,w ). The language LDEL is the union of the formulas ϕ ∈L⊗ dyn and the events (or epistemic events) π ∈L⊗ defined by Definition 5 (Product update). the following rule: Let M =(W, R, V ) be an epistemic model and let M = stat (W ,R ,Pre) be an event model. The product update of M L⊗ : ϕ ::= p |¬ϕ | (ϕ ∧ ϕ) | Baϕ | [π]ϕ by M is the epistemic model M⊗M =(W ,R ,V ) dyn L : π ::= M ,w | (π ∪ π) defined as follows (p and a range over ATM and AGT re- ⊗ spectively): where p ranges over ATM , a over AGT and (M,w)is ∈ W ={(w, w ) ∈ W × W |M,w |= Pre(u )} any pointed and finite event model such that for all w M Lstat , Pre(w ) is a formula of ⊗ that has already been Ra ={ (w, w ), (v, v ) ∈W × W | wRav and w Rav } constructed in a previous stage of the inductively defined V (p)={(w, w) ∈ W | w ∈ V (p)} hierarchy. The size of ϕ ∈LDEL is defined as for the epistemic lan- Given a pointed epistemic model (M,w), and a pointed guage together with the induction case |[π]ϕ| =1+|π| + |ϕ| event model (M,w), we say that (M,w)isexecutable in where |M ,w | = |M |,and|π ∪ γ| =1+|π| + |γ|. (M,w) when M,w |= Pre(w). If M is an epistemic model and M1,...,Mn are event models, we abusively write M⊗ Definition 7 (Truth conditions). M1 ⊗···⊗Mn for (...((M⊗M1) ⊗M2) ⊗ ...) ⊗Mn and Given an epistemic model M =(W, R, V )andaformula (w, w1,...,wn)for(...((w, w1),w2),...),wn). ϕ ∈LDEL, we define inductively the satisfaction relation

21 |=⊆ W ×LDEL as follows: function M-Check(w M1,w1; ...; Mi,wi ϕ) match (ϕ) M,w |=[M ,w ]ϕ iff M,w |= Pre(w )implies case p: M⊗M, (w, w) |= ϕ return w ∈ V (p); M | ∪ M | M | case ¬ψ: ,w =[π γ]ϕ iff ,w =[π]ϕ and ,w =[γ]ϕ. return not M-Check(w M1,w1; ...; Mi,wi ψ); The other induction steps are identical to the induction steps case ψ1 ∧ ψ2: of Definition 3. return (M-Check(w M1,w1; ...; Mi,wi ψ1) and M-Check(w M1,w1; ...; Mi,wi ψ2)); The results in this paper are the same whether or not the case Baψ: formulas of the preconditions involve event models. How- for u ∈ Ra(w) ever, the result of NEXPTIME-completeness of the satisfi- for u1 ∈ Ra(w1) ability problem of Section 4 holds only if we consider union if M-Check(u, P re(u1)) of event models as a program construction in the language. . . for ui ∈ Ra(wi) 3. MODEL CHECKING PROBLEM if M-Check(u M1,u1; ...; Mi−1,ui−1 Pre(ui)) The model checking problem of LDEL is defined as follows: if not M-Check(u M1,u1; ...; Mi,ui ψ); return false ; Input: a pointed epistemic model (M,w) and a for- endIf endIf endFor ...endIf endFor endFor mula ϕ ∈LDEL; return true ; M | case [M ,w ]ψ: Output:yesiff ,w = ϕ. if M-Check(w M1,w1; ...; Mi,wi Pre(w )) Whereas the model checking problem with an epistemic return M-Check(w M1,w1; ...; Mi,wi; M ,w ψ); formula of LEL is in P, model checking with a formula of endIf true LDEL is surprisingly PSPACE-complete. This shows that return ; case [π ∪ γ]ψ: the addition of dynamic modalities with event models to return (M-Check(w M1,w1; ...; M ,w [π]ψ) and LEL increases tremendously the computational complexity i i M-Check M M of the model checking problem. (w 1,w1; ...; i,wi [γ]ψ)); endMatch 3.1 Upper bound endFunction In Figure 3 is defined a deterministic algorithm M-Check( Figure 3: PSPACE algorithm for model checking w M1,w1; ...; Mi,wi ,ϕ) that checks whether we have M⊗M1 ⊗ ...Mi, (w, w1,...,wi) |= ϕ, where (M,w)isa ∈{ } M pointed epistemic model and for all j 1,...,i ,( j ,wj ) Theorem 2. The model checking problem of LDEL is is a pointed event model. The precondition of a call to PSPACE-hard. the function M-Check(w M1,w1; ...; Mi,wi ,ϕ) is that Proof. Without loss of generality, we only consider in (w, w1,...,wi) ∈M⊗M1 ⊗ ...Mi, that is, the sequence this proof quantified Boolean formulas of the form ∀p1∃p2∀p3 (M1,w1) ...,(M ,w )isexecutablein(M,w). In order to i i ∀ ∃ check whether M,w |= ϕ, we just call M-Check(w, ϕ). ... p2k−1 p2kψ(p1,...p2k), where ψ(p1,...,p2k) is a Boolean formula over the atomic propositions p1,...,p2k. The for- ∀ ∃ ∀ ∀ ∃ Theorem 1. The model checking problem of LDEL is in mula p1 p2 p3 ... p2k−1 p2kψ(p1,...p2k)issatisfiable iff PSPACE. for both truth values of the atomic proposition p1 there is a truth value for the atomic proposition p2 such that for both Proof sketch. Termination and correction of the algo- truth values of the atomic proposition p3, and so on up to M-Check rithm are easily proved over the size of the input p2k, the formula ψ(p1,...p2k) is true in the overall truth i assignment. defined by |M| + |Mk| + |ϕ|. As for complexity, the al- We can restrict ourselves to LDEL where there is only k=1 gorithm requires a polynomial amount of space in the size one agent a.Thequantified Boolean formula satisfiability of the input. Indeed, as the size of the input is strictly de- problem is defined as follows: creasing at each recursive call, the number of recursive calls Input: a natural number k and a quantified Boolean in the call stack is linear in the size of the input. Then, each formula ϕ ∀p1∃p2∀p3 ...∀p2k−1∃p2kψ(p1,...,p2k); of the current call requires a polynomial amount of space in the size of the input for storing the value of local variables: Output:yesiffϕ is satisfiable. the most consuming case is Baψ wherewehavetosaveall Let ϕ = ∀p1∃p2∀p3 ...∀p2k−1∃p2kψ(p1,...p2k)beaquanti- the current values of u, u1,...,ui in the loop for. fied Boolean formula. We define a pointed epistemic model 0 0 0 (M,w ), 2k pointed event models (M1,w1 ),...,(M2k,w2k), 0 a pointed event model M,w and an epistemic formula ψ 3.2 Lower bound that are computable in polynomial time in the size of ϕ such that: We prove that the algorithm of the previous section is optimal. To do so, we provide a polynomial reduction of the ϕ is satisfiable in quantified Boolean logic quantified Boolean formula satisfiability problem,knownto iff 0 0 0 0 0 be PSPACE-complete [Papadimitriou, 1995, p. 455] to the M,w |=[M1,w1 ∪M,w ] M2,w2 ∪M,w ... 0 0 0 0 model-checking problem of LDEL. [M2k−1,w2k−1 ∪M,w ] M2k,w2k ∪M,w ψ .

22 The corresponding instance of the model checking problem The behavior of ∃pi in quantified Boolean logic consists in of LDEL is computable in polynomial time in the size of ϕ. an existential choice of a truth value for pi. It is translated 0 0 0 Now, let us describe M,w0, the event models M1,w1 ,..., bytheupdateoperator Mi,wi ∪M,w whose semantics 0 0 M2k,w2k, the event model M,w and ψ . is to choose existentially theupdateoftheepistemicmodel 0 by Mi,wi , that will give a new updated epistemic model •M=(W, R, V ) is defined by: 0 with a chain of length i, that is pi is true, or by M,w , – W = {w0,w1,...,w2k+1}; that will let the new updated epistemic model without a j j+1 chainoflengthi, that is pi is false. – Ra = {(w ,w | j ∈{0,...,2k}}; Remark – and V (p)=∅ for all p ∈ ATM 1. Note that the reduction used to prove that the model checking problem of LDEL is PSPACE-hard uses only • For all i ∈{1,...,2k}, Mi =(Wi ,Ri,Prei) is defined the precondition . by: 0 1 i 4. SATISFIABILITY PROBLEM – Wi = {wi ,wi ,...,wi ,wi } LDEL j j+1 0 The satisfiability problem of is defined as follows: – Ria = {(wi ,wi ) | j ∈{0,...,i− 1}}∪{(wi ,wi ), ∈LDEL (wi ,wi )} Input: a formula ϕ ; – and Prei(u )= for all u ∈ Wi Output: yes iff there exists a pointed epistemic model 0 (M,w) such that M,w |= ϕ. •M,w =(W,R,Pre) is defined by:

0 The satisfiability problem is known to be decidable. Indeed, – W = {w } the standard reduction axioms of DEL [Baltag and Moss, 0 0 L →L – Ra = {(w ,w )} 2004, p. 214] induce a translation tr : DEL EL such 0 that ϕ ∈LDEL is satisfiable iff tr(ϕ) ∈LEL is satisfiable. – Pre(w )= Since the size of tr(ϕ)isatmostexponentialinthesize 2k • ψ = ψ(p1 ← Ba Ba⊥,...,p2k ← ( Ba ) Ba⊥), of ϕ [Lutz, 2006] and the satisfiability problem of LEL is that is, ψ is the formula ψ where all pi occurrences PSPACE-complete, the satisfiability problem of LDEL is in i 1 are substituted by ( Ba ) Ba⊥. EXPSPACE. This upper bound is nevertheless not optimal: we are going to prove in this section that the satisfiability The semantics is simulated in the following way. The problem of LDEL is NEXPTIME-complete. proposition pi is interpreted as the presence of a chain of length exactly i from the root of a given epistemic model. 4.1 Upper bound That is why in ψ , the proposition pi is substituted by In this subsection we present a tableau method that does i ( Ba ) Ba⊥, which is true in the root of the final epistemic not rely on reduction axioms and we prove that it provides a model iff there exists a chain of length i in that model. NEXPTIME procedure deciding the satisfiability problem. Note that updating an epistemic model where there is a 0 chainoflength2k +1byMi,wi where i ∈{1,...,2k}: 4.1.1 Tableau method Let Lab be a countable set of labels designed to represent • preserves the presence or absence of any chain of length M worlds of the epistemic model ( ,w). Our tableau method j = i; in particular, it always preserves the presence of manipulates terms that we call tableau terms and they are the chain of length 2k +1; of the following kind:

• adds a chain of length i, that is pi becomes true; • (σ M1,w1; ...; Mi,wi ϕ) where σ ∈ Lab is a node (that represents a world in the initial model) and for Note also that updating an epistemic model where there 0 all j ∈{1,...,i}, Mj ,wj is an event model. This term is a chain of length 2k+1 by M,w preserves the presence means that ϕ is true in the world denoted by σ after or absence of any chain. So, it will keep pi false if it was the execution of the sequence M1,w1,...,Mi,wi and already false and it will keep any pi true if it was already 0 that the sequence is executable in the world denoted true. In other words, the M,w is a neutral element for the product update. by σ; The crucial invariant property (Inv) of an epistemic model • (σ M1,w1; ...; Mi,wi ) means that the sequence is the existence of a chain of length 2k + 1 in any update of M M 0 0 0 1,w1,..., i,wi is executable in the world denoted M,w by any sequence of M,w and Mi,wi . by σ; The behavior of ∀pi in quantiﬁed Boolean logic consists in • (σ M1,w1; ...; Mi,wi ⊗) means that the sequence a universal choice of a truth value for pi. It is translated by M1,w1,...,Mi,wi is not executable in the world de- 0 0 theupdateoperator[Mi,wi ∪M,w ] whose semantics is noted by σ; to choose universally the update of the epistemic model by 0 • (σRaσ1) means that the world denoted by σ is linked Mi,wi , that will give a new updated epistemic model with 0 by Ra to the world denoted by σ1; a chain of length i, that is pi is true, or by M,w that will let the new updated epistemic model without a chain of •⊥denotes an inconsistency. length i, that is pi is false. A tableau rule is represented by a numerator N above a 1 i The formula ( Ba ) ϕ is an abbreviation of Ba ... Ba ϕ. D D line and a ﬁnite list of denominators 1,..., k below this itimes line, separated by vertical bars:

23 ¬ M (σ Σ [ ,w ]ϕ) ¬ M (σ Σ ϕ ∧ ψ) ( [ ,w ]) ∧ (σ Σ ¬¬ϕ) (σ Σ ; M ,w ) ( ) ¬¬ (σ Σ ϕ) ( ) (σ Σ ; M ,w ¬ϕ) (σ Σ ϕ) (σ Σ ψ) M (σ Σ [ ,w ]ϕ) ([M ,w ]) (σ Σ ¬(ϕ ∧ ψ)) (σ Σ p)(σ Σ ¬p) M ⊗ M (¬∧) (⊥) (σ Σ ; ,w ) (σ Σ ; ,w ) (σ Σ ¬ϕ) | (σ Σ ¬ψ) ⊥ (σ Σ ; M,w ϕ)

(σ Σ ; M,w ) (σ Σ ; M,w ⊗) (σ Σ p) (σ Σ ¬p) ⊗ ← ← ( ) ( ) ( p) ( ¬p) (σ Σ Pre(w )) (σ Σ ) (σp) (σ¬p) (σ Σ ⊗) (σ Σ ) (σ Σ ¬Pre(w ))

(σ M1,w1; ...; Mi,wi Baϕ) (σRa σ1)(Ba) (σ Σ ⊗)(σ Σ ) (σ⊗) (clash,⊗) (⊗) ⊥ ⊥ (σ1 M1,u1; ...; Mi,ui ) (σ1 M1,u1; ...; Mi,ui ⊗) (σ1 M1,u1; ...; Mi,ui ϕ)

(σ M1,w1; ...; Mi,wi ¬Baϕ) (σ Σ [π ∪ γ]ϕ) (σ Σ ¬[π ∪ γ]ϕ) ¬ a ∪ ¬ ∪ ( B ) ([π γ]) ( [π γ]) (σRa σnew) (σ Σ [π]ϕ) (σ Σ ¬[π]ϕ) | (σnew M1,u1; ...; Mi,ui ) (σ Σ [γ]ϕ) (σ Σ ¬[γ]ϕ) (σnew M1,u1; ...; Mi,ui ¬ϕ)

Figure 4: Tableau rules

N Similarly, the rule for (¬Ba) is applied by choosing non- D1 | ... |Dk deterministically for all j ∈{1,...i} some uj such that w Rau and creating a new fresh label σnew. The rules (), The numerator and the denominators are finite sets of j j (⊗), (clash,⊗) and (⊗) handle the preconditions. The last tableau terms. two rules ([π ∪ γ]) and (¬[π ∪ γ]) handle the union operator. A tableau tree is a finite tree with a set of tableau terms N at each node. A rule with numerator and denominator Theorem 3 (Soundness and Completeness). Let ϕ D is applicable to a node carrying a set Γ if Γ contains an ∈LDEL. It holds that ϕ iff |= ϕ. instance of N but not the instance of its denominator D.If no rule is applicable, Γ is said to be saturated. We call a node Example 4. We prove with our tableau method that the σ an end node if the set of formulas Γ it carries is saturated, formula ϕ = ¬[M1,w1][M2,w2]B2B1B2p from Example 3 or if ⊥∈Γ. The tableau tree is extended as follows: is satisfiable, where M1,w1 and M2,w2 are defined in Ex- 1. Choose a leaf node n carrying Γ where n is not an end ample2.InFigure5,anopenbranchofthetableautree node, and choose a rule ρ applicable to n. for ϕ is represented. The set Σ22 is saturated: no more tableau rule is applicable. From this branch, we may extract 2. (a) If ρ has only one denominator, add the appropri- a pointed epistemic model (M,σ0) such that M,σ0 |= ϕ. ate instantiation to Γ. (b) If ρ has multiple denominators, choose one of them 4.1.2 NEXPTIME-membership and add to Γ the appropriate instantiation of this denominator. Theorem 4. The satisfiability problem of LDEL is in NEX- PTIME. A branch in a tableau tree is a path from the root to Proof sketch. Termination of our tableau method is an end node. A branch is closed if its end node contains ⊥, otherwise it is open. A tableau tree is closed if all its proved by defining the size of a term (σ Σ ϕ)by1+ branches are closed, otherwise it is open.The tableau tree (|M| +1)+|ϕ|. The depth of the tableau tree for a formula ϕ ∈LDEL is the tableau tree obtained from (M,w)∈Σ the root {(σ0 ϕ)} when all leafs are end nodes. We write is linear in the size of the input formula, but the number ϕ when the tableau for ¬ϕ is closed. of tableau terms at a node σ may be exponential, because The tableau rules of our tableau method are represented of rule (¬Ba). As a consequence, the tableau tree has at in Figure 4. In these rules, Σ is a list of pointed event mod- most an exponential number of nodes and constructing non- els M1,w1,...,Mi,wi and is the empty list. The tableau deterministically such a tree can been done in an exponential method contains the classical Boolean rules (∧), (¬¬), (¬∧). amount of time. So, the procedure is in NEXPTIME. The rules (←p) and (←¬p) handle atomic propositions. The rule (⊥) makes the current execution fail. The rule for (Ba) is applied for all j ∈{1,...i} and all uj such that wj Rauj . 4.2 Lower bound

24 ⏐ 0 { 0 } ⏐ Σ := ⏐(σ ϕ) () ⏐ (¬[M,w]) (σ3 M1,u1 ) Σ18 := Σ17 ∪ (σ0 M1,w1 ) (σ3 M1,u1; M2,u2 ¬(p ∧¬p)) Σ1 := Σ0 ∪ ⏐ (σ0 M1,w1¬[M2,w2]B2B1B2p) ⏐ ⏐ ⏐ ()

() ∪ ¬ ∧¬ Σ19 := Σ18 ⏐(σ3 (p p) Σ2 := Σ1 ∪ (σ0 ), (σ0 p) ⏐ ⏐ ⏐ (¬∧,¬¬) (¬[M,w]) Σ20 := Σ19 ∪ (σ3 ¬p) ⏐ (σ0 M1,w1; M2,w2 ) ⏐ Σ3 := Σ2 ∪ (¬∧,¬¬) (σ0 M1,w1; M2,w2 ¬B2B1B2p) ⏐ ⏐ ∪ M M ¬ Σ21 := Σ20 (σ3 ⏐ 1,u1; 2,u2 p) () ⏐

∪ M M (→¬p) Σ4 := Σ3 (σ0 1,w⏐1 ), (σ0 1,w1 B2p) ⏐ Σ22 := Σ21 ∪ (σ3 ¬p) (¬B ) ⎧ a ⎫ ⎨ (σ0 R2 σ1) ⎬ Figure 5: An open branch of the tableau for ϕ Σ5 := Σ4 ∪ (σ1 M1,w1; M2,u2 ) ⎩ ⎭ (σ1 M1,w1; M2,u2 ¬B1B2p) ⏐ ⏐ We prove that the algorithm based on our tableau method (Ba) of the previous section is optimal in terms of computational ∪ M M complexity. To do so, we prove that the satisﬁability prob- Σ6 := Σ5 (σ1 1,w⏐ 1 ), (σ1 1,w1 p) ⏐ lem of LDEL is NEXPTIME-hard by reducing a NEXPTIME- () complete tiling problem to it [Boas, 1997]. ∪ M M ¬ ∧¬ Let C be a countable and inﬁnite set of colors. A tile Σ7 := Σ6 (σ1 1,w1 ⏐ ), (σ1 1,w1 (p p)) ⏐ type t is a 4-tuple of colors, denoted t =(left(t),right(t), (¬∧,¬¬) up(t), down(t)) ∈ C4. We consider the following tiling prob-

∪ M lem: Σ8 := Σ7 ⏐(σ1 1,w1 p) ⏐ Input: a ﬁnite set T of tile types, t0 ∈ T and a natural (→p) number k written in its binary form. Σ9 := Σ8 ∪ (σ1 p) ⏐ 2 ⏐ Output: yes iﬀ there exists a function τ from {0,...k} (¬B ) ⎧ a ⎫ to T satisfying the following constraints: ⎨ (σ1 R1 σ2) ⎬ τ(0, 0) = t0;(1) Σ10 := Σ9 ∪ (σ2 M1,u1; M2,u2 ) ⎩ ⎭ (σ2 M1,u1; M2,u2 ¬B2p) ⏐ for all x ∈{0,...,k} and y ∈{0,...,k− 1}: ⏐ () up(τ(x, y)) = down(τ(x, y + 1)); (2) ∪ M M ¬ ∧¬ Σ11 := Σ10 (σ2 1,u1⏐ ), (σ2 1,u1 (p p)) ⏐ for all x ∈{0,...,k− 1} and y ∈{0,...,k}: (¬∧,¬¬) right(τ(x, y)) = left(τ(x +1,y)). (3) ∪ M Σ12 := Σ11 ⏐(σ2 1,u1 p) ⏐ In other words, the problem is to decide whether we can (→p) tile a (k +1)× (k + 1) grid with the tile types of T , t0 being 13 12 ∪ 2 placed onto (0, 0). Σ := Σ ⏐ (σ p) ⏐

() Theorem 5. The satisﬁability problem of LDEL is NEX-

∪ PTIME -hard. Σ14 := Σ13 (⏐σ2 ), (σ2 ) ⏐ Proof. (¬∧,¬¬) Without loss of generality, we assume that k = 2n. Let us consider an instance of the NEXPTIME-hard ∪ Σ15 := Σ14 ⏐ (σ2 p) tiling problem described above. Our goal is to provide a ⏐ polynomial translation from this instance to an instance of (¬Ba) ⎧ ⎫ the satisﬁability problem of LDEL. ⎨ (σ2 R2 σ3) ⎬ Theideaistoembedtwo identical k × k-tilings into a Σ16 := Σ15 ∪ (σ3 M1,u1; M2,u2 ) single tree. Each leaf of the tree represents both a position ⎩ ⎭ (σ3 M1,u1; M2,u2 ¬p) (x1,y1) in the ﬁrst tiling and a position (x2,y2) in the second ⏐ ⏐ tiling. We need to encode two identical tilings because, in (→¬p) order to check constraints 2 and 3, we will need to refer to Σ17 := Σ16 ∪ (σ3 ¬p) thetilelocatedtotherightortotheleftofagivenposition in a tiling, and also to refer to the tile located above or below

25 it. This is hardly possible if we encode a single tiling at the The tile types of the first tiling are represented by atomic leafsofatree,becausewewouldneedto‘backtrack’inthe propositions 1t and the tile types of the second tiling are tree to access these other positions. represented by atomic propositions 2t , where t and t range We start by showing how to encode two identical tilings over T . They hold at a leaf of the tree whose coordinates at the leafs of a tree. Then we will show how to express the correspond to (x1,y1) and (x2,y2) when the tile type of the three constraints 1, 2 and 3 in the definition of a tiling. first tiling at coordinate (x1,y1)ist and the tile type of the second tiling at coordinate (x2,y2)ist . 1. The coordinates (x1,y1) and (x2,y2) of the two tilings Formulas 9 and 10 below encode the fact that, at each leaf are represented by the valuations of atomic propositions of the tree, there is exactly one tile type for the first tiling and p0,...,p4n−1. More precisely, the set X1 = {p0,...,pn−1} exactly one tile type for the second tiling. Formula 11 below contains the atomic propositions encoding the binary rep- encodes the fact that when these two pairs of coordinates resentation of the integer x1, Y1 = {pn,...,p2n−1} con- coincide, that is when x1 = x2 and y1 = y2, then the tile tains the atomic propositions encoding the binary repre- type of the first tiling and the tile type of the second tiling sentationoftheintegery1, X2 = {p2n,...,p3n−1} contains are identical. the atomic propositions encoding the binary representation { } 4n of the integer x2,andY2 = p3n,...,p4n−1 contains the Ba 1t ∧ 2t (9) atomic propositions encoding the binary representation of t∈T t∈T the integer y2. For instance, for n = 4, the coordinates 4n Ba (1t →¬1t ) ∧ (2t →¬2t ) | t, t ∈ T,t = t (10) (x1,y1)=(4, 3) and (x2,y2)=(11, 2) are represented at a leaf of the tree by the following valuation. We recall that in 4n binary notation, 4 is represented by 100, 3 is represented by Ba (x1 = x2) ∧ (y1 = y2) → (1t ↔ 2t) (11) 11, 12 is represented by 1100 and 2 is represented by 10. t∈T ¬ ¬ ¬ ¬ ¬ However, it may be the case that in the tree, two differ- p0,p1,p2, p3 p4, p5,p6,p7 ent leafs with the same valuation have different tile types. 4 3 Therefore, we also have to constrain the tree so that the leafs ¬ ¬ ¬ ¬ ¬ p8,p9, p10, p11 p12, p13,p14, p15 denoting the same position in the first tiling (resp. second 12 2 tiling) contain the same tile type for the first tiling (resp. second tiling). This is expressed by the following two for- We then encode the existence of all valuations over X1 ∪ mulas: Y1 ∪ X2 ∪ Y2 with the following formula: M ∪M M ∪M 4n l [ p0 ¬p0 ] ...[ p2n−1 ¬p2n−1 ] Ba 1t (12) Ba Ba pl ∧ Ba ¬pl∧ t∈T l<4n M ∪M M ∪M 4n [ p2n ¬p2n ] ...[ p4n−1 ¬p4n−1 ] Ba 2t (13) ((pi → Bapi) ∧ (¬pi → Ba¬pi)) . (4) t∈T i

26 4n Ba (x1 = x2 +1)∧ (y1 = y2) (16) 5.1.2 DEL-sequents DEL-sequents [Aucher, 2011] are triples of the form ϕ, ϕ |= ϕ where ϕ, ϕ ∈LEL and ϕ is a formula of a language for → 1t → 2t | t ∈ T,left(t )=right(t) event models. A DEL-sequent ϕ, ϕ |= ϕ holds when for all t∈T pointed epistemic model (M,w) such that M,w |= ϕ,for As we said at the beginning of the proof, these two con- all pointed event model (M,w) such that M,w |= ϕ,if straints motivate the need to encode two tilings: for a given (M,w)isexecutablein(M,w), then M⊗M, (w, w) |= position in a tiling, we need to refer to the tile located to the ϕ. The problem of determining whether a DEL-sequent right or to the left of it, and to refer to the tile located above holds is NEXPTIME-complete and there exists a tableau or below it. This would not be possible with our epistemic method for it. DEL-sequents have been generalized to se- language if the tiling was encoded by a single tree. 1 quences of the form ϕ0,ϕ1,ϕ1,...,ϕn,ϕn i ψ and ϕ0,ϕ1,ϕ1, One can then check that there exists a tiling for the in- 2 ...,ϕn,ϕn ψ . The corresponding satisfiability problem stance of the tiling problem iff the formula ϕ, which is the i is also NEXPTIME-complete [Aucher et al., 2012]. conjunction of fomulas 4, 9, 10, 11, 12, 13, 14, 15, and 16 is satisfiable in LDEL. 5.1.3 The sequence and ‘star’ iteration operators The sequence and ‘star’ iteration operators are construc- 3. Finally, we show that the reduction is polynomial in tions enabling to build complex programs as in Propositional the size of the instance of the tiling problem. The formula of Dynamic Logic (PDL [Harel et al., 2000]). The truth condi- Equation 4 is of size O(n2). The formulas of Equations 12, tions are defined as follows: 13 are of size O(n2 +|T |×n). The other formulas are clearly of size polynomial in the size of the input, so the result M,w |=[π; γ]ϕ iff M,w |=[π][γ]ϕ ∗ follows. Importantly, note that if we decided to rewrite the M,w |=[π ]ϕ iff there is a finite sequence π; ...; π formulas 12 and 13 without using the union operator ∪, then such that M,w |=[π; ...; π]ϕ the corresponding formula would be exponential in the size We do not know about the computational complexity of of the input. So, the use of the union operator is really the model-checking problem when the operator [π∗]ϕ is added crucial in order to have a polynomial reduction from the to the language. In fact, we do not even know whether it is tiling problem to our satisfiability problem. decidable. The computational complexity of the satisfiability problem remains the same when the sequential compo- 5. RELATED WORK sition operator is added. However, adding a ‘star’ operator makes the satisfiability problem undecidable. This result is 5.1 Theory not really surprising, it is a direct corollary of the result of There exists a terminating tableau method solving the [Miller and Moss, 2005] stating that Public Announcement satisfiability problem of LDEL [Hansen, 2010]. This method Logic with the ‘star’ operator is already undecidable. writes subformulas by applying the reduction axioms [Baltag and Moss, 2004, p. 214]. It is therefore mainly a variant of 5.1.4 The common belief operator the tableau method of classical multi-modal logic Kn.Even We may extend the language with the common belief op- if we know that tr blows up exponentially the size of the erator CGϕ, where G ⊆ AGT. The truth conditions are input formula, the computational complexity of this tableau defined as follows: method is not studied. In this section, we review the existing + results about computational complexity of DEL. M,w |= CGϕ iff for all v ∈ Ra (w), M,v |= ϕ a∈G 5.1.1 Public Announcement Logic (PAL) Intuitively, CGϕ is an abbreviation of an infinite conjunc- 1 2 3 Public Announcement Logic (PAL) [Plaza, 1989] is an ex- tion [Fagin et al., 1995]: CGϕ = EGϕ ∧ EGϕ ∧ EGϕ ∧ ..., k 1 tension of epistemic logic with a dynamic operator [ψ!]ϕ where EGϕ is defined inductively as follows: EGϕ = Baϕ whose truth conditions are defined as follows: a∈G k+1 1 k and EG ϕ = EGEGϕ. M,w |=[ψ!]ϕ iff M,w |= ψ implies Mψ,w |= ϕ We do not know about the computational complexity of where Mψ is the restriction of M to the worlds which sat- the satisfiability problem when the common belief operator isfy ψ. PAL is a fragment of DEL: the language of PAL is is added to the language LDEL. However, we know that LDEL restricted to event models consisting of a single pos- it is decidable and that the language with common belief sible event with reflexive arrows for all agents. There is a operator is more expressive than the epistemic language LEL gap between PAL and DEL in terms of computational com- with common belief [Baltag et al., 1998, Baltag et al., 1999]. plexity, both for the model checking problem and the satisfiability problem. Indeed, the model checking of PAL is in 5.2 Implementation P (also with common belief) [van Benthem and Kooi, 2004] There exist two implementations of our decision problems: and the satisfiability problem for PAL is PSPACE-complete 1. The model-checker DEMO [van Eijck, 2007], standing [Lutz, 2006]. Despite the fact that there exist reduction for Dynamic Epistemic MOdeling tool, can evaluate formu- axioms for PAL, it is difficult to implement a direct trans- las of LDEL in epistemic models, display graphically epis- lation using reduction axioms. In fact, there are properties temic models, event models and updates of epistemic models that can be expressed exponentially more succinctly in PAL by event models, translate formulas of LDEL to formulas of than in epistemic logic [French et al., 2011]. Note that there PDL. DEMO is written in Haskel and has been applied in exist PSPACE tableau methods for solving the satisfiability [van Ditmarsch et al., 2005] and [van Ditmarsch et al., 2006]. problem in PAL [de Boer, 2007, Balbiani et al., 2010]. Also, it has been used to investigate the pros and cons of

27 modeling some well-known problems of computer security [Fagin et al., 1995] Fagin, R., Halpern, J., Moses, Y., and within the DEL framework [van Eijck and Orzan, 2007]. Vardi, M. (1995). Reasoning about knowledge. MIT 2. The program Aximo [Richards and Sadrzadeh, 2009], Press. written in C++, implements an algorithm for proving prop- [Fitting, 1983] Fitting, M. (1983). Proof methods for modal erties of interactive multi-agent scenarios encoded in epis- and intuitionistic logics. D. Reidel, Dordrecht. temic systems. Epistemic systems provide an algebraic se- [French et al., 2011] French, T., van der Hoek, W., Iliev, mantics to DEL and were developed together with a sound P., and Kooi, B. P. (2011). Succinctness of epistemic and complete sequent calculus [Baltag et al., 2007]. languages. In Walsh, T., editor, IJCAI, pages 881–886. IJCAI/AAAI. 6. CONCLUDING REMARKS [Hansen, 2010] Hansen, J. (2010). Terminating tableaux for dynamic epistemic logics. Electronic Notes in Our work contributes to the proof theory and the study Theoretical Computer Science, 262:141–156. of the computational complexity of DEL, which has been rather neglected so far. Although our results show that [Harel et al., 2000] Harel, D., Kozen, D., and Tiuryn, J. our decision problems are not tractable, it turns out that (2000). Dynamic Logic. MIT Press. the DEMO implementation does not fare worse and often [Lutz, 2006] Lutz, C. (2006). Complexity and succinctness even better in terms of time of execution than other model- of public announcement logic. In Proceedings of AAMAS checkers modeling the same problems, without resorting to 2006, pages 137–143. ACM. the DEL methodology [van Ditmarsch et al., 2006]. [Miller and Moss, 2005] Miller, J. and Moss, L. (2005). We still need to investigate whether or not the computa- The undecidability of iterated modal relativization. tional complexity remains the same when we consider other Studia Logica, 79(3):373–407. epistemic logics as the basis of DEL, such as S5.Moreover, [Papadimitriou, 1995] Papadimitriou, C. H. (1995). our results rely on the fact that we use the union operator Computational complexity. Addison Wesley. in the language, an open problem is to obtain similar results [Plaza, 1989] Plaza, J. (1989). Logics of public without this operator. Finally, we plan to implement our communications. In Emrich, M. L., Pfeifer, M. Z., tableau method in LotrecScheme [Schwarzentruber, 2011]. Hadzikadic, M., and Ras, Z. W., editors, Proceedings of the 4th International Symposium on Methodologies for Acknowledgment. We thank the reviewers for their Intelligent Systems, pages 201–216. comments and Sophie Pinchinat for discussions. [Richards and Sadrzadeh, 2009] Richards, S. and Sadrzadeh, M. (2009). Aximo: Automated axiomatic 7. REFERENCES reasoning for information update. Electr. Notes Theor. Comput. Sci., 231:211–225. [Aucher, 2011] Aucher, G. (2011). DEL-sequents for [Schwarzentruber, 2011] Schwarzentruber, F. (2011). progression. Journal of Applied Non-Classical Logics, Lotrecscheme. Electr. Notes Theor. Comput. Sci., 21(3-4):289–321. 278:187–199. [Aucher et al., 2012] Aucher, G., Maubert, B., and [van Benthem and Kooi, 2004] van Benthem, J. and Kooi, Schwarzentruber, F. (2012). Generalized DEL-sequents. B. (2004). Reduction axioms for epistemic actions. In In del Cerro, L. F., Herzig, A., and Mengin, J., editors, Schmidt, R., Pratt-Hartmann, I., Reynolds, M., and JELIA, volume 7519 of Lecture Notes in Computer Wansing, H., editors, AiML-2004: Advances in Modal Science, pages 54–66. Springer. Logic, number UMCS-04-9-1 in Technical Report Series, [Balbiani et al., 2010] Balbiani, P., van Ditmarsch, H., pages 197–211, University of Manchester. Herzig, A., and de Lima, T. (2010). Tableaux for public [van Ditmarsch et al., 2007] van Ditmarsch, H., van der announcement logic. Journal of Logic and Computation, Hoek, W., and Kooi, B. (2007). Dynamic Epistemic 20(1):55–76. Logic, volume 337 of Synthese library. Springer. [Baltag et al., 2007] Baltag, A., Coecke, B., and [van Ditmarsch et al., 2005] van Ditmarsch, H. P., Ruan, Sadrzadeh, M. (2007). Epistemic actions as resources. J., and Verbrugge, L. C. (2005). Model checking sum Journal of Logic and Computation, 17(3):555–585. and product. In Zhang, S. and Jarvis, R., editors, [Baltag and Moss, 2004] Baltag, A. and Moss, L. (2004). Australian Conference on Artificial Intelligence, volume Logic for epistemic programs. Synthese, 139(2):165–224. 3809 of Lecture Notes in Computer Science,pages [Baltag et al., 1998] Baltag, A., Moss, L., and Solecki, S. 790–795. Springer. (1998). The logic of common knowledge, public [van Ditmarsch et al., 2006] van Ditmarsch, H. P., van der announcement, and private suspicions. In Gilboa, I., Hoek, W., van der Meyden, R., and Ruan, J. (2006). editor, Proceedings of TARK98, pages 43–56. Model checking russian cards. Electr. Notes Theor. [Baltag et al., 1999] Baltag, A., Moss, L., and Solecki, S. Comput. Sci., 149(2):105–123. (1999). The logic of public announcements, common [van Eijck, 2007] van Eijck, J. (2007). Demo — a demo of knowledge and private suspicions. Technical report, epistemic modelling. In van Benthem, J., Gabbay, D., Indiana University. and Löwe, B., editors, Interactive Logic — Proceedings [Boas, 1997] Boas, P. (1997). The convenience of tilings. In of the 7th Augustus de Morgan Workshop, Texts in Logic Complexity, Logic, and Recursion Theory,pages and Games 1, pages 305–363. 331–363. Marcel Dekker Inc. [van Eijck and Orzan, 2007] van Eijck, J. and Orzan, S. [de Boer, 2007] de Boer, M. (2007). KE tableaux for public (2007). Epistemic verification of anonymity. Electronic anouncement logic. In Proceedings of FAMAS 07, Notes in Theoretical Computer Science, 168(0):159 – 174. Durham UK.