Arrow update synthesis

University of Groningen

Arrow update synthesis

Ditmarsch ,van, Hans; Hoek, Wiebe van der; Kooi, Barteld; Kuijer, Bouke

Published in:

Information and Computation

DOI:

10.1016/j.ic.2020.104544

IMPORTANT NOTE: You are advised to consult the publisher's version (publisher's PDF) if you wish to cite from

it. Please check the document version below.

Document Version

Publisher's PDF, also known as Version of record

Publication date:

2020

Link to publication in University of Groningen/UMCG research database

Citation for published version (APA):

Ditmarsch ,van, H., Hoek, W. V. D., Kooi, B., & Kuijer, B. (2020). Arrow update synthesis. Information and

Computation, 275, [104544]. https://doi.org/10.1016/j.ic.2020.104544

Copyright

Other than for strictly personal use, it is not permitted to download or to forward/distribute the text or part of it without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license (like Creative Commons).

Take-down policy

If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.

Downloaded from the University of Groningen/UMCG research database (Pure): http://www.rug.nl/research/portal. For technical reasons the number of authors shown on this cover page is limited to 10 maximum.

Contents lists available atScienceDirect

Information

and

Computation

www.elsevier.com/locate/yinco

Arrow

update

synthesis

Hans van Ditmarsch

a

,∗

,

Wiebe van der Hoek

b

,

Barteld Kooi

c

,

Louwe

B. Kuijer

b

a_{UniversitédeLorraine,CNRS,LORIA,F-54000Nancy,France} b_{ComputerScience,UniversityofLiverpool,UnitedKingdom} c_{DepartmentofPhilosophy,UniversityofGroningen,theNetherlands}

a

r

t

i

c

l

e

i

n

f

o

a

b

s

t

r

a

c

t

Articlehistory:

Received3February2018

Receivedinrevisedform24October2019 Accepted28February2020

Availableonline13March2020 Keywords:

Modallogic Synthesis

Dynamicepistemiclogic Expressivity

In this contribution we present arbitrary arrow update model logic (AAUML). This is a dynamicepistemiclogic or updatelogic. In update logics, static/basic modalities are interpreted on a given relational model whereas dynamic/update modalities induce transformations (updates) of relational models. In AAUML the update modalities formalize the execution of arrowupdatemodels,

and there is also a modality for quantification over

arrow update models. Arrow update models are an alternative to the well-known action models. We provide an axiomatization of

AAUML. The axiomatization is a rewrite system

allowing to eliminate arrow update modalities from any given formula, while preserving truth. Thus, AAUML is decidable and equally expressive as the base multi-agent modal logic. Our main result is to establish arrowupdatesynthesis:

if there

is an arrow update

model after which

ϕ

, we can construct (synthesize)

that model from

ϕ

. We also point out some pregnant differences in updateexpressivity between

arrow update logics, action model

logics, and refinement modal logic.

©2020 Elsevier Inc. All rights reserved.

1. Introduction

Modallogic. Inmodallogicweformalizethatpropositionsmaynotbemerelytrueorfalse,butthattheyarenecessarilyor possiblytrueorfalse,orthattheymaybedesirable,orforbidden,ortruelater,ornever,orthattheyareknown.Acommon settingisforsuchmodalpropositionstobeinterpretedinrelationalmodels,alsoknownasKripkemodels.Theyconsistofa domainofabstractobjects,calledstatesorworlds;then,givenasetoflabels,oftenrepresentingagents,foreachsuchagent abinary relationbetweenthosestates; and,finally,avaluation ofatomicpropositionsonthedomain,typically seenasa unaryrelation,i.e.,apropertysatisfiedonasubsetofthedomain.Thetruthofamodalpropositionisrelativetoastatein therelationalmodel,calledtheactualstateorthepoint ofthemodel.Theunitofinterpretationisthusapointedmodel:a pairconsistingofarelationalmodelandanactualstate.

Ifapair

(

s

,

s

)

isintherelationfora thiscanmeanthat afterexecutingactiona instate s theresultingstateiss.But itcan alsomeanthat agenta considers state s desirableincasesheis instates. Theinterpretationthat wefocuson,is thatofinformation.Thatis,itisconsistentwitha’sinformationinstates thatthestatewouldbes.Instates itistruethat agenta knows

ϕ

(orbelieves

ϕ

,dependingonthepropertiesoftherelation),notation



a

ϕ

,iftheformula

ϕ

istrueinall

*

Correspondingauthor.

E-mailaddresses:hans.van-ditmarsch@loria.fr(H. van Ditmarsch),Wiebe.Van-Der-Hoek@liverpool.ac.uk(W. van der Hoek),b.p.kooi@rug.nl(B. Kooi), Louwe.Kuijer@liverpool.ac.uk(L.B. Kuijer).

https://doi.org/10.1016/j.ic.2020.104544

statess accessiblefroms,i.e.,forall swith

(

s

,

s

)

intherelationfora.Themodallogicsusingthatkindofinterpretation ofmodalitiesarecalledepistemiclogics[1,2].

Asan example,considertwoagentsa

,

b (commonlyknowntobe)uncertainaboutthetruthofapropositionalvariable p.Theuncertaintyofa andb canbepicturedasfollows.We‘name’thestateswiththevalueofthevariable p.Theactual state is framed. Pairsinthe accessibilityrelation arevisualized aslabelled arrows. Inthe actualstate: p istrue,agent a doesnotknowp becausesheconsidersastatepossiblewhereinp isfalse(formally

¬

ap),agenta alsodoesnotknow

¬

p

becausesheconsidersastatepossiblewhereinp istrue(formally

¬

a

¬

p,alsowrittenas

♦

ap),andsimilarlyforagentb.

Agenta alsoknowsthatsheisignorantaboutp,asthisistrueinbothstatesthatsheconsiderspossible.Theaccessibility relationsfora andb arebothequivalencerelations.Thisisalwaysthecaseifthemodalitiesrepresentknowledge.

¬

p ab p

ab

ab

p

Updatelogic. Inthisworkwefocuson modallogics thatare updatelogics.Apartfromthe modalitiesthatareinterpreted in a relational model, they have other modalities that are interpreted by transforming a relational model (and by then interpretingtheformulasboundbythatmodalityinthetransformedmodel).Ifthemodallogicisanepistemiclogic,update logicsarecalleddynamicepistemiclogics.Todistinguishthemwecalltheformerstatic andwecallthelatterdynamic.

The updates X that we consider can be defined as transformers of relational models. This transformation induces a binary update relationbetween pointedmodels. Toan update relation corresponds an updatemodality (often alsocalled update)that isinterpretedwiththisrelation,sowe canseethoseas

[

X

]

or



X



,where

[

X

]

ϕ

meansthat

ϕ

istrueinall pointedmodels transformedaccordingtothe X relation,and



X



ϕ

that thereisa pairofpointedmodels intherelation. Givenarelationalmodelwe canchangeits domainofstates,therelationsbetweenthestates,orthevaluationsofatomic propositions,ortwoormoreofthoseatthesametime.Therearethereforemanyoptionsforchange.Changethevaluation ofamodelisalsoknownasfactualchange [3,4].Updateinvolvingfactualchangeisaninterestingtopic,butitisoutsidethe scopeofthecurrentpaper.

Publicannouncementlogic. Thebasicupdateforstatesisthemodelrestriction,andthebasicupdateoperationinterpreted as amodel restrictionis a publicannouncement.The logic withepistemic modalitiesandpublic announcements ispublic announcementlogic (PAL)[5,6].Apublicannouncementof

ϕ

restrictsthedomaintoallstateswheretheannouncedformula

ϕ

istrue, thereby decreasing the uncertainty of the agents.As a result of the domain restriction,the relations and the valuation areadjusted intheobviousway.Acondition forthe transformationisthattheactual stateisinthe restriction. Thismeansthattheannouncementformulaistruewhenannounced.

Asanexample,afterthepublicannouncementofp,botha andb knowthat p:

¬

p ab p

ab

ab

⇒

p

ab

Arrowupdatelogic. Thebasicupdateforrelationsistherelationalrestriction,i.e.,arestrictionofthearrows:apairinthe relation is calledan ‘arrow’. Thisleaves all states intact, although some may have become unreachable. In arrowupdate logic (AUL), proposed in[7] wespecifywhicharrowswe wishto preserve,bywayofspecifying whatformulasshouldbe satisfiedatthesource (state)ofthearrowandthetarget (state)ofthearrow.Thisdetermines themodeltransformation. Suchaspecificationiscalledanarrowupdate.ThelogicAULcontainsmodalitiesforarrowupdates.

Given initial uncertainty about p with both agents, a typical arrow update is the action wherein Anne(a) opensan envelope containing the truth about p while Bill (b) observes Anne reading the contents of the letter. We preserve all arrows satisfyingoneofp

→

ap

,

¬

p

→

a

¬

p,and



→

b



.Therefore,onlytwoarrowsdisappear,

¬

p

→

ap and p

→

a

¬

p.

¬

p ab p ab ab

⇒

¬

p b p ab ab

Theboundarybetweenstateeliminationandarroweliminationissubtle.Ifp is true,thefollowingarrowupdatewith



→

ap

,



→

bp isthesameupdateasapublicannouncementofp.Thisisbecausethereisnoarrowfromthe p stateto

the

¬

p stateaftertheupdate.Therefore,ifp istrue,the

¬

p statedoesnotmatter.Inanotherformalismthisarrowupdate isknownasthearroweliminationsemanticsofpublicannouncement[8,9].

¬

p ab p

ab

ab

⇒

¬

p b p

ab

Generalizations. InPALandAULthecomplexity(thenumberofstates)oftherelationalmodelcannotincrease.By general-izingthemechanismunderlyingstateeliminationandarroweliminationwecanachievethat,andthusexpressmoremodel transformations.Thisincreasestheirupdateexpressivity.Fromtheperspective ofinformationchange,thisaddsuncertainty aboutwhatishappening.Weobtainactionmodels [6] asageneralizationofpublicannouncements,andarrowupdatemodels [10] asageneralizationofarrowupdates.

Actionmodellogic. Actionmodellogic (AML)was proposed by Baltag, Moss and Soleckiin [6]. An actionmodel is like a relationalmodelbuttheelementsofthedomainarecalledactions insteadofstates,andinsteadofavaluationaprecondition isassignedtoeach domainelement.The transformedrelationalmodelisthen themodalproductoftherelationalmodel andtheactionmodel,restrictedto(state,action)pairswheretheactioncanbeexecutedinthatstate.WerefertoSection6 foraformalintroduction.

An example is the action as above wherein Anne reads the contents of a letter containing p or

¬

p, but now with theincreasing uncertaintythat BillisuncertainwhetherAnnehasreadthe letter(andthatthey are bothawareofthese circumstances).Theactionmodelisnotdepicted(detailsareinSection 6).Themodeltransformationisasfollows.Inthe resultingframedstate,a knowsthatp,butb considersitpossiblethata isuncertainaboutp,i.e.,



ap

∧ ♦

b

¬(

ap

∨ 

a

¬

p

)

.

Inthefigureweassumetransitivityoftherelationforb.

¬

p

¬

p ab p ab ab

⇒

¬

p p

¬

p p ab b b _b ab ab ab ab

Similar logics (or semantics) foraction composition are found in[11,12,4,13,14]. Action modellogic is often referred to as(the) dynamic epistemic logic. As said, we use thelatter more generally,namely to denoteany update logic withan epistemicinterpretation.

Arrowupdatemodellogic. Generalizedarrowupdatelogic [10] isa(indeed)generalization ofarrowupdate logicwherethe dynamic modalities for information change formalize execution of (pointed) arrowupdatemodels, structures akin to the actionmodels of actionmodellogic.Inthiscontribution,insteadofgeneralizedarrowupdatelogic wecallit arrowupdate modellogic (AUML). The arrowupdatesof[7] correspondto singletonarrowupdate models. Thenext Section 2formally introduces them.Theabove isalsoan exampleofarrowupdate modelexecution—Section 6explainshow togetaction modelsfromarrowupdatemodelsandviceversa,andtowhatextenttheydefinethesameupdate.

Quantificationoverinformationchange. Another extension of update logics is with quantification over updates. Arbitrary publicannouncementlogic (APAL) addsquantification over public announcements to PAL [15]. Arbitraryarrowupdatelogic (AAUL)[16] extendsarrow update logic withquantifiers over informationchange induced by arrowupdates: it contains dynamicmodalitiesformalizingthatthereisanarrowupdateafterwhich

ϕ

.Arbitrary actionmodellogic (AAML)byHales[17] add quantifiersover actionmodelsto AML.Inarbitraryarrowupdatemodellogic (AAUML),the topicofthispaper,we add quantifiersoverarrowupdatemodelstothelogicallanguage.ItislikeHales’arbitraryactionmodellogic.Refinementmodal logic (RML)[18] hasamodalityrepresentingquantificationoverupdates,butdoesnothave(deterministic/concrete)update modalitiesintheobjectlanguage toquantifyover.We showthat theAAMLandAAUMLquantifierbehavemuch (butnot quite)liketherefinementquantifierinRML.Section7isdevotedtoit.

Fig.1givesanoverviewofthedifferentlogicsdiscussedinthepaper,intheirrelationtoAAUML.Thefourlogicsinthe left squareare basedonstatemanipulation,the fourlogics intherightsquareare basedonarrowmanipulation.Entirely ontheleftwefindthebasemodallogicMLandthelogicRML,thatisalsoarrowmanipulating.

ML RML PAL APAL AML AAML AUL AAUL AUML AAUML

Fig. 1. An overviewofupdatelogicsdiscussedinthe paper.Horizontalarrows informallyrepresentmorecomplex updates.Verticalarrowsinformally representquantificationover updates.Thearrowscanbeinterpretedassyntacticextensions(modulothenamesofquantifiers)orassemanticgeneralizations. Assumetransitiveclosure.

All these logics are equally expressive as ML and are decidable, which can be shown by truth-preserving rewriting procedures to eliminate updates (for AAUML this isone of the resultsof the paper), except for APALand AAUL, which are moreexpressiveandundecidable[15,19,16,20].However,thelogics greatlydifferinupdateexpressivity,asthetypical examplesabovealreadydemonstrated.SeealsoSections5–7.Finally,itshouldbementionedthatallthelogicsareinvariant underbisimulation.Thisisbecausetheparametersofthemodeltransformingdynamicmodalitiesandquantifiersare(model restrictionsinducedby)formulas.

Therearemanyotherupdatesandupdatelogicsthatwedonotconsiderinthispaper.Inparticularwedonotconsider updates X thatcan onlybe definedaspointed modeltransformers(that is,theycannot be globally defined ontheentire model; they are definedlocally: howthey transformthe modeldependson theactual state).If suchwere the definition ofan update,eventheinterpretation ofa staticmodality canbe seenasanupdate,namelytransformingthemodelwith point s intothemodelwithpoints,wherethepointhasshiftedgivenapair

(

s

,

s

)

intherelationforanagent.Suchlocal updatelogicsareoftenmoreexpressivethanmodallogic,areoftenundecidable,aretypicallynotinvariantunder(standard) bisimulation, andmaylackaxiomatizations.Examplesare[21–23].In[23] notonly relationalrestriction is consideredbut also relationalexpansion (‘bridge’) andrelational change that is neither restriction nor expansion, such as reversing the directionofarrows(‘swap’).Itshouldfinallybenotedthatthedistinctionbetweenstaticmodalities,interpretedinamodel, anddynamicmodalities,interpretedasupdates,isnotrigid:unifyingperspectivesinclude[4].

Synthesis. For these update logics we can ask whether there is an update that achieves a certain goal. For the logics without quantification thisquestion cannot be askedin the objectlanguage but onlymeta-logically. Thatis,we can ask whetherthereisanupdate X suchthat



X



ϕ

istrue.Fortheupdate logicswithquantificationthisquestioncanbeasked intheobjectlanguage.Let



?



be(theexistentialversionof)that quantifier.Then



?



ϕ

askswhetherthereisanupdate X thatmakes

ϕ

true.

Onlyknowingwhether thereisanupdatethat achievesagoalisnotverysatisfying;we wouldalsoliketoknowwhich update,ifany,achievesthegoal.Sowewouldliketoknownotonlywhetherthegoalisachievablebutalsohowitcanbe achieved.Theprocessofconstructingthisupdatethatachievesthegoalisknownassynthesis.

Formally,thesynthesisproblemforagiventypeofupdatetakesasinputaformula

ϕ

,andgivesasoutputanupdate X ofthattypesuchthat,whenever

ϕ

canbeachieved,then X achieves

ϕ

.Insymbols,thisisthevalidityof



?



ϕ

→ 

X



ϕ

.

This isaratherstronggoal.We donot consideritsufficient tofind,foreverypointedmodel

(

M

,

s

)

,an update X(M,s)

such that

(

M

,

s

)

satisfies



?



ϕ

→ 

X(M,s)



ϕ

.We want one single update Xϕ thatachieves

ϕ

inevery modelwhere

ϕ

is

achievable.Becausethisgoalissostrong,thereis,ingeneral,noguaranteethatsynthesisispossible.

ForPALthisstrongkindofsynthesisisimpossible. If

(

M1

,

s1

)

satisfies

ψ

1



ϕ

and

(

M2

,

s2

)

satisfies

ψ

2



ϕ

,so if

ϕ

can beachievedintwodifferentsituationsusingtwodifferentpublicannouncements,thenthereistypicallynounifyingpublic announcement

ψ

suchthat

(

M1

,

s2

)

satisfies

ψ

ϕ

and

(

M2

,

s2

)

satisfies

ψ

ϕ

.1

For AULthisstrongkindof synthesisis alsonot possible.But,somewhat surprisingly,in [17], Halesshowedthat this synthesis ispossibleforAML.Thisresultwassurprisingforthefollowingreason. Halesobtainedhissynthesisresultwith

1 _{Forexample,considerthefour-statemodelbelow;p meansthatp isfalseinthatstate,etc.Bothstateswherep,q,r arealltruesatisfythat}

_

_?(

ap∧ ¬bp).Inthetop-leftpqr-statethisistruebecause



q(ap∧ ¬bp)istrue,whereasinthebottom-rightpqr-statethisistruebecause



r(ap∧ ¬bp) istrue.However,thereisnoannouncementϕsuchthat



ϕ(ap∧ ¬bp)istruthinbothpqr-states.Assumingthatthereweresuchanannouncement easilyleadstoacontradiction.

pqr pqr pqr pqr a a b b ab ab ab ab

refinementmodalitiesasquantifiers.Itwasalreadyknownthatfiniteactionmodelexecutionresultsinarefinementofthe currentrelationalmodel,butalsothattheotherdirectiondoesnothold:therearerefinements(i.e.,updates)thatcanonly beachievedbyexecutinganinfiniteactionmodel[24].However,asthesynthesisiswithrespecttomakingagivenformula

ϕ

true,afinitesyntacticobject,synthesisforAMLwasafterallpossible.

In this contribution we show that synthesis is also possible forAUML. That is, for a given goal formula

ϕ

, we can constructanarrowupdatemodel X suchthat

Forall

(

M

,

s

)

:thereisanarrowupdatemodelY suchthat

(

M

,

s

)

satisfies



Y



ϕ

,ifandonlyif

(

M

,

s

)

satisfies



X



ϕ

. In AAUML we also have a quantifier over arrow update models. Therefore, in that logic the synthesis translates to the above-mentionedvalidity



?



ϕ

→ 

X



ϕ

.InAUML/AAUMLwesynthesize a(single-)pointedarrowupdatemodel,whereas forAAUMLHalessynthesizesamulti-pointedactionmodel,anditcanbeeasilyshownthatthiscannotbesingle-pointed. Resultsinthepaper. Inthiscontributionwepresentarbitraryarrowupdatemodellogic (AAUML),thatfurtherextendsarrow updatemodellogicAUML,namelywithdynamicmodalitiesformalizingthatthereisanarrowupdate model afterwhich

ϕ

.For thislogicAAUMLweobtainvariousresults.Weprovideanaxiomatization ofAAUML.Theaxiomatizationisarewritesystem allowing to eliminate dynamic modalities fromanygiven formula, while preservingtruth. Thus, unlike AAUL,AAUML is decidable,andequallyexpressiveasmulti-agentmodallogic.Weestablisharrowupdatemodelsynthesis:ifthereisanarrow updatemodelafterwhich

ϕ

,wecanconstruct (synthesize)thatmodelfrom

ϕ

.Wedefineanotionofupdateexpressivity and wedeterminetherelativeupdateexpressivityofAAUMLandotherarrowupdatelogicsandactionmodellogics,andRML. Overviewofcontent. Section2presentsthesyntaxandsemanticsofarbitraryarrowupdatemodellogic,AAUML,and ele-mentarystructuralnotions.InSection 3wedescribe theprocedureforsynthesizing arrowupdatemodels.Inthat section wealsointroduceanumberofvaliditiesthatareusefulwhenintroducinganaxiomatizationforAAUML,whichwedointhe subsequentSection4.Section5introducesthenotionofupdateexpressivity.Section 6comparesAAUMLandAAML,andin particulartheirupdateexpressivity.Thiscomparisonalsoincludesexamplesofarrowupdatemodelsthathaveexponentially largercorrespondingactionmodels.Section7comparesAAUMLtoRML.

2. Arbitraryarrowupdatemodellogic

Throughoutthiscontribution,let A beafinitesetofagents andlet P beadisjointcountablyinfinitesetofpropositional variables (oratoms).

2.1. Structures

Arelationalmodel isatripleM

= (

S

,

R

,

V

)

withS anon-emptydomain (set)ofstates (alsodenoted

D(

M

)

), R afunction assigning to each agent a

∈

A an accessibilityrelation Ra

⊆

S

×

S, and V

:

P

→

S a valuationfunction assigning to each

propositional variable p

∈

P thesubset V

(

p

)

⊆

S where thevariableistrue. Fors

∈

S,thepair

(

M

,

s

)

iscalledapointed relationalmodel,andforT

⊆

S,thepair

(

M

,

T

)

iscalledamulti-pointedrelationalmodel.

Foranyrelation R onadomain X ,insteadof

(

x

,

y

)

∈

R (wherex

,

y

∈

X )wemaywrite R

(

x

,

y

)

orxR y,andR

(

x

)

orRx fortheset

{

y

∈

X

|

R

(

x

,

y

)

}

.IfR

(

x

,

y

)

wealsosaythat R links x to y,orthat thereisanarrow fromx to y.Relation R is: reflexive iffforall x

∈

X , R

(

x

,

x

)

;serial iffforall x

∈

X thereis y

∈

X suchthat R

(

x

,

y

)

; transitive iffforall x

,

y

,

z

∈

X , if R

(

x

,

y

)

and R

(

y

,

z

)

then R

(

x

,

z

)

; Euclidean iffforall x

,

y

,

z

∈

X , if R

(

x

,

y

)

and R

(

x

,

z

)

then R

(

y

,

z

)

;an equivalencerelation iffitisreflexive,transitive,andEuclidean.Finally,foranyY

,

Z

⊆

X welet R

(

Y

,

Z

)

meanthatforall y

∈

Y thereisa z

∈

Z suchthat R

(

y

,

z

)

andforallz

∈

Z thereisa y

∈

Y suchthat R

(

y

,

z

)

;thisisknownasrelationallifting.

Theclassofrelationalmodelsisknownas

K

.Theclassofrelationalmodelswhereallaccessibilityrelationsare equiva-lencerelationsisknownas

S

5,andtheclassofrelationalmodelswhereallaccessibilityrelationsareserial,transitive,and Euclideanisknownas

KD

45.

LettworelationalmodelsM

= (

S

,

R

,

V

)

andM

= (

S

,

R

,

V

)

begiven.Anon-emptyrelation

R

⊆

S

×

Sisabisimulation ifforall

(

s

,

s

)

∈ R

anda

∈

A:

atoms s

∈

V

(

p

)

iffs

∈

V

(

p

)

forall p

∈

P ;

forth forallt

∈

S,ifRa

(

s

,

t

)

,thenthereisat

∈

SsuchthatRa

(

s

,

t

)

and

(

t

,

t

)

∈ R

;

back forallt

∈

S,ifR_a

(

s

,

t

)

,thenthereisat

∈

S suchthat Ra

(

s

,

t

)

and

(

t

,

t

)

∈ R

.

We write M

↔

M (M andMarebisimilar) iffthere isa bisimulation betweenM and M, andwe write

(

M

,

s

) ↔ (

M

,

s

)

(

(

M

,

s

)

and

(

M

,

s

)

are bisimilar) iff there is a bisimulation between M and M linking s and s. Similarly, we write

(

M

,

T

) ↔ (

M

,

T

)

iffthereisabisimulationbetweenM and Mlinking everystatein T toastatein Tandlinkingevery stateinTtoastateinT .

Usingtheabove-definednotionofrelationallifting,if

M

1and

M

2aresetsofpointedmodelswesaythat

M

1and

M

2 are bisimilar,denoted

M

1

↔ M

2,ifforevery

(

M1

,

s1

)

∈

M

1 thereisan

(

M2

,

s2

)

∈

M

2 suchthat

(

M1

,

s1

) ↔ (

M2

,

s2

)

and forevery

(

M2

,

s2

)

∈

M

2 thereisan

(

M1

,

s1

)

∈

M

1suchthat

(

M1

,

s2

) ↔ (

M2

,

s2

)

.2

Wewillnowdefinearrowupdatemodels.Wecanthinkofthemasfollows.Ifyouremovethevaluationfromarelational model you get a relationalframe. We nowdecorate each arrow(pair in the accessibilityrelation foran agent) withtwo formulasinsomelogicallanguage

L

:oneforaconditionthatshouldholdinthesource(state)ofthearrowandtheother thatshouldholdinthetarget(state)ofthearrow.Theresultiscalledanarrowupdatemodel.

Definition1(Arrowupdatemodel).Givenalogicallanguage

L

,anarrowupdatemodel U isapair

(

O

,

RR

)

whereO isa non-emptydomain(set)ofoutcomes (alsodenoted

D(

U

)

)andwhere RR isanarrowrelation RR

:

A

→

P((

O

×

L)

× (

O

×

L))

.

Foreachagenta,thearrowrelationlinks(outcome,formula)pairstoeachother.Wewrite RRaforRR

(

a

)

,andwewrite

(

o

,

ϕ

)

→

a

(

o

,

ϕ



)

for

((

o

,

ϕ

),

(

o

,

ϕ



))

∈

RRa,oreven, ifthe outcomesareunambiguous,

ϕ

→

a

ϕ

.Formula

ϕ

is thesource

condition and formula

ϕ

isthetargetcondition of thea-labelledarrow fromsource o totarget o.Apointedarrowupdate model,orarrowupdate,isapair

(

U

,

o

)

whereo

∈

O .Similarly,wedefinethemulti-pointedarrowupdatemodel

(

U

,

Q

)

,where Q

⊆

O ,knownaswell asarrowupdate.ThereisnoconfusionwiththearrowupdatesofAUL[7],asthosecorrespondto singletonpointedarrowupdatemodels.

Arrowupdatemodelsarerathersimilartotheactionmodels byBaltagetal. [6].TheyarecomparedinSection6. 2.2. Syntax

Weproceedwiththelanguageandsemanticsofarbitraryarrowupdatemodellogic (AAUML).

Definition2(Syntax).Thelanguage

L

ofAAUMLconsistingofformulas

ϕ

isinductivelydefinedas

L



ϕ

::=

p

| ¬

ϕ

| (

ϕ

∧

ϕ

)

| 

a

ϕ

| [

U

,

o

]

ϕ

| [↑]

ϕ

where p

∈

P ,a

∈

A,andwhereU

= (

O

,

RR

)

witho

∈

O isanarrowupdatemodelwithO finiteandwith RRa finiteforall

a

∈

A,andwithsourceandtargetconditionsthatareformulas

ϕ

.

Theinductivenatureofthedefinitionmaybeunclearfromtheconstruct

[

U

,

o

]

ϕ

.Weshouldthinkof

[

U

,

o

]

ϕ

asann-ary operatorwherenotonlytheformulaboundby

[

U

,

o

]

isaformulabutalsoall thesourceandtargetconditionsinU .3 We read

[

U

,

o

]

ϕ

as‘afterexecuting arrow update

(

U

,

o

)

,

ϕ

(holds),and

[↑]

ϕ

as‘afteran arbitrary arrowupdate,

ϕ

(holds)’. Other propositionalconnectivesanddualdiamondversionsofmodalitiescanbedefinedasusualby abbreviation:

♦

a

ϕ

:=

¬

a

¬

ϕ

,



U

,

o



ϕ

:= ¬[

U

,

o

]¬

ϕ

,and

↑

ϕ

:= ¬[↑]¬

ϕ

.Expression

ϕ

[ψ/

p

]

stands foruniformsubstitutionofall occurrences

of p in

ϕ

for

ψ

.

A formulaisa modalformula if ithasshape



a

ϕ

,

♦

a

ϕ

,

[↑]

ϕ

,

↑

ϕ

,

[

U

,

o

]

ϕ

,or



U

,

o



ϕ

. Themodaldepth of aformula

ϕ

∈

L

isdefinedas:d

(

p

)

=

0,d

(

¬

ϕ

)

=

d

(

ϕ

)

,d

(

ϕ

∧ ψ)

=

max

(

d

(

ϕ

),

d

(ψ))

,d

(



a

ϕ

)

=

d

(

↑

ϕ

)

=

d

(

ϕ

)

+

1,andd

(

[

U

,

o

]

ϕ

=

d

(

U

)

+

d

(

ϕ

)

+

1,whered

(

U

)

isthemaximummodaldepthofthesourceandtargetconditionsoccurringinU .

The propositional sublanguage iscalled

L

pl (the propositionalformulas). Adding the basicmodal construct



a

ϕ

to

L

pl

yields

L

ml (the language of basicmodal logic,the basicmodalformulas). Additionallyadding theconstruct

[

U

,

o

]

ϕ

yields

L

auml(thelanguageofarrowupdatemodellogic).Inthelanguage

L

ofAAUML,(modalitiesfor)multi-pointedarrowupdate

models aredefinedby abbreviationas

[

U

,

Q

]

ϕ

:=



o∈Q

[

U

,

o

]

ϕ

.Fromhereonwealsoconsidersuchmodalitiesaslogical

connectives,suchthat

[

U

,

Q

]

ϕ

isaformulainthelogicallanguage.

Whendoingsynthesis,wewillputformulasindisjunctivenegationnormalform.ThisfragmentDNNFof

L

,thatisinspired bythedisjunctivenormalformofpropositionallogicandthenegationnormalformofmodallogic,isdefinedas

DNNF



χ

::= ψ | (

χ

∨

χ

)

ψ

::=

ϕ

| (ψ ∧ ψ)

ϕ

::=

p

| ¬

p

| 

a

χ

| ♦

a

χ

| [

U

,

o

]

χ

| 

U

,

o



χ

| [↑]

χ

| ↑

χ

wherethesourceandtargetconditionsin

(

U

,

o

)

arealsoformulas

χ

.

Thismeansthata

ϕ

∈

L

isindisjunctivenegationnormalformifeverysubformula of

ϕ

isadisjunctionofconjunctions of formulas that are an atom, or the negation ofan atom, or that have one of



a

,

♦

a

,

[

U

,

o

],



U

,

o

,

[↑]

or

↑

as main

2 _{For the purpose of bisimilarity, we could have treated a multi-pointed model (M,T) as a set of pointed models {(M,t)}

_|

_{t∈T}, so that}

(M1,T1) ↔ (M2,T2)ifandonlyifforeveryt1∈T1thereisat2∈T2suchthat(M1,t1) ↔ (M2,t2),andviceversa.Asaunionofbisimulationsisagaina

bisimulation,thatwouldhavedefinedthesamenotionasabove.

3 _{TheBNFinformatics-stylepresentationobscurestheinductivenatureofthelanguagedefinition,becausethesourceandtargetconditionsof}

(U,o)are implicit.Themathematics-stylepresentationofthatclausemaybeclearer:

Letϕ∈ L,letU= (O,RR)beanarrowupdatewithsourceandtargetconditionsϕ1,. . . ,ϕn∈ LandsuchthatO andRRaforalla∈A arefinite,and leto∈O .Then

[

U,o]ϕ∈ L.

connective.In particular,thismeansthat formulashavetobe inDNNFatevery modaldepth.So,forexample, p

∨ (

q

∨

(

♦

p

∧ ¬

q

))

isinDNNF,while p

∨ (

q

∨ ¬(¬♦

p

∨

q

))

isnot.

2.3. Semantics

Wecontinuewiththesemantics.Thesemanticsaredefinedbyinductionon

ϕ

∈

L

,andsimultaneouslywiththe execu-tionofarrowupdatemodels.

Definition3(Semantics).Leta relational model M

= (

S

,

R

,

V

)

, a state s

∈

S, an arrowupdate model U

= (

O

,

RR

)

, anda formula

ϕ

∈

L

begiven.Thetruth(orsatisfaction)of

ϕ

in

(

M

,

s

)

isdefinedbyinductionon

ϕ

.

M

,

s

|=

p iff s

∈

V

(

p

)

M

,

s

|= ¬

ϕ

iff M

,

s

|=

ϕ

M

,

s

|=

ϕ

∧ ψ

iff M

,

s

|=

ϕ

and M

,

s

|= ψ

M

,

s

|= 

a

ϕ

iff M

,

t

|=

ϕ

for all

(

s

,

t

)

∈

Ra

M

,

s

|= [

U

,

o

]

ϕ

iff M

∗

U

, (

s

,

o

)

|=

ϕ

where M

∗

U is defined in

()

M

,

s

|= [↑]

ϕ

iff M

,

s

|= [

U

,

o

]

ϕ

for all

(

U

,

o

)

satisfying

()

()

: M

∗

U

= (

S

,

R

,

V

)

isdefinedas S

=

S

×

O For all a

∈

A

,

ϕ

,

ϕ



∈

L

,

s

,

s

∈

S

,

o

,

o

∈

O

:

((

s

,

o

), (

s

,

o

))

∈

R_a iff

(

s

,

s

)

∈

Ra

, (

o

,

ϕ

)

→

a

(

o

,

ϕ



),

M

,

s

|=

ϕ

,

and M

,

s

|=

ϕ

 For all p

∈

P

:

V

(

p

)

=

V

(

p

)

×

O

()

:

(

U

,

o

)

isanarrowupdatewithallsourceandtargetconditionsin

L

ml.

Formula

ϕ

isvalidinM,notationM

|=

ϕ

,iffM

,

s

|=

ϕ

foralls

∈

S;and

ϕ

isvalid iffforallrelationalmodels M wehave that M

|=

ϕ

.Formulas

ϕ

,

ψ

∈

L

are equivalent iffforall M

= (

S

,

R

,

V

)

andforall s

∈

S,M

,

s

|=

ϕ

iffM

,

s

|= ψ

.The setof validities,alsomoreproperlyknownasthelogic,iscalledAAUML.

Formulas

ϕ

and

ψ

fromdifferentlanguageswillalsobe calledequivalent ifthey satisfytheabovecondition.The term AAUMLwillalsocontinuetobeinformallyusedforarbitraryarrowupdatelogic.Therestrictionofarrowformulasto

L

ml in

thesemanticsof

[↑]

ϕ

istoavoidcircularityofthesemantics,as

[↑]

ϕ

couldotherwiseitselfbeoneofthosearrowformulas. However,becausewewillprovethatAAUMLisasexpressiveasbasicmodallogic,wealsohave

M

,

s

|= [↑]

ϕ

iff M

,

s

|= [

U

,

o

]

ϕ

for all

(

U

,

o

)

withoutanyrestrictiononthesourceandtargetconditionsofU .WewillprovethispropertyinProposition16,later. Weconcludethissubsectionbynotingtwo relativelysimplepropertiesofAAUMLthat willbeusefulinlatersections. Firstly,AAUMLisinvariantunderbisimulation,i.e.,if

(

M

,

s

) ↔ (

M

,

s

)

thenforall

ϕ

∈

L

wehaveM

,

s

|=

ϕ

iffM

,

s

|=

ϕ

.In [16,Lemma 3] itwasshownthatAUMLisinvariantunderbisimulation.Theproofgivenin[16] caneasilybeextendedtoa proofthatAAUMLisalsoinvariantunderbisimulation.

Secondly,everyformula

ϕ

∈

L

isequivalenttoaformula

ϕ

thatisinDNNF.Provingtheexistenceofsuch

ϕ

is concep-tuallysimplebutrathernotationallycomplex.Wethereforeprovideonlyanexample,andtrustthatthereadercanseethat thedemonstratedprocesscanbegeneralizedtoany

ϕ

∈

L

.Supposethat

ϕ

=

p

∧ ¬(

a

ψ

1

∧ ¬[

U

,

o

]ψ

2

)

.Ourfirststepisto treatthenon-propositionalsubformulasof

ϕ

asatoms,i.e., wetreattheformulaas p

∧ ¬(

q1

∧ ¬

q2

)

.Thisis aformulaof propositionallogic,soitisequivalenttoaformulaindisjunctivenormalform:

(

p

∧ ¬

q1

)

∨ (

p

∧

q2

)

.Thenwerecallwhatq1 andq2represent,andobtain

(

p

∧ ¬

a

ψ

1

)

∨ (

p

∧ [

U

,

o

]ψ

2

)

.Usingthefactthat

¬

a

ψ

1isequivalentto

♦

a

¬ψ

1,wefindthat

ϕ

isequivalentto

(

p

∧ ♦

a

¬ψ

1

)

∨ (

p

∧ [

U

,

o

]ψ

2

)

.Wethenrepeatthisprocessfor

¬ψ

1,

ψ

2 andeveryformula

χ

thatoccurs asasourceortargetconditioninU .Thedepthof

¬ψ

1

,

ψ

2 andeverysuch

χ

isstrictlylowerthanthatof

ϕ

,sothisprocess eventuallyterminates,resultinginformulas

ψ

₁

,

ψ

₂ and

χ

thatareinDNNFandequivalentto

¬ψ

1

,

ψ

2 and

χ

,respectively. LetU be theresultofreplacingevery

χ

in U bytheequivalent

χ

.Then theformula

(

p

∧ ♦

a

ψ

1

)

∨ (

p

∧ [

U

,

o

]ψ

2

)

is in DNNFandequivalentto

ϕ

.

2.4. Example

First consider theaction of the introductory section of Annereadinga letter containing the truth about p whileBill remainsuncertainwhethersheperformsthataction.Thearrowupdatemodelproducingtheresultinginformationstateis depictedintheupperpartofFig.2.Inthefigure,anarrow

→

labelledwith

ϕ

i

ϕ

andlinkingoutcomeso

,

o stands for

IntheresultingmodelBillconsidersit possiblethatAnneknows p,thatsheknows

¬

p, andthat shestill isuncertain about p:

♦

b



ap

∧ ♦

b



a

¬

p

∧ ♦

b

¬(

ap

∨ 

a

¬

p

)

.

Next,considertheactionofAnneprivatelylearningthat p whileBillremainsunawareofherdoingso.Thearrowupdate modelachievingthatandtheresultingrelationalmodelaredepictedinthelowerpartofFig.2.Intheresultingmodelit is truethat,forexample,Annebelieves p butBillincorrectly believesthat Anneisuncertainaboutp:



ap

∧ 

b

¬(

ap

∨



a

¬

p

)

. ¬p ab p ab ab

∗

• ◦ b ab pap ¬pa¬p b

=

(¬p,•) (p,•) (¬p,◦) (p,◦) ab b b b ab ab ab ab ¬p ab p ab ab

∗

• ◦ b ab ap

=

(¬p,•) (p,•) (¬p,◦) (p,◦) ab a b b ab ab a

Fig. 2. Different ways of Anne learning that p.

Therelation RRa allowsformultiplepairsbetweenthesameoutcomes.Thisisnecessary.Foranexample,thesingleton

arrowupdate withtwo reflexivearrows p

→

aq

,

r

→

as (i.e.,

(

o

,

p

)

RRa

(

o

,

q

)

and

(

o

,

r

)

RRa

(

o

,

s

)

)doesnotcorrespondtoan

arrowupdatewhereforanygivenagenta atmostasinglearrowlinksanytwooutcomes,see[7,10,16].

Arrowupdatesapplytoanykindofrelationalmodel,andalsoinparticulartorelationalmodelswhereinallaccessibility relationsareequivalencerelations,theclass

S

5.Theserelationsmodelknowledge ofanagent.Relationalmodelswhereinall accessibilityrelationsare serial,transitive,andEuclidean,areoftheclass

KD

45.Theserelationsmodelconsistentbelief of an agent.Asdynamicepistemiclogicstypicallyformalizechangeofknowledgeorchangeofbelief,i.e.,epistemicchange,of particularinterestarethereforearrowupdatesthat are

S

5-preservingor

KD

45-preserving,bywhichwemeanthat,given arelationalmodelinclass

S

5,theupdatewillproducearelationalmodelinclass

S

5,andsimilarlyfor

KD

45.

The examples in this section are indeed typical inthat sense. The first exampleis an

S

5-preserving update and the secondexampleisa

KD

45-preservingupdate.

There is more to be learnt from these examples: the first arrow update ‘seems

S

5’ and the second update ‘seems

KD

45’. It iseasy to make ‘seem’ precise: considerthe following accessibility relationbetween outcomesinduced by an arrowrelation:

o

→

_ao iff

(

o

,

ϕ

)

→

a

(

o

,

ϕ



)

for some

ϕ

,

ϕ



.

Letanarrowupdatebeinclass

S

5 ifforallagentsa,theseinduced

→

aareequivalencerelations;andsimilarlyfor

KD

45.

The first arrow update istherefore

S

5 and thesecond arrowupdate is

KD

45.However, an

S

5 arrow update ofan

S

5 relationalmodelmaynotresultinan

S

5 relationalmodel(whereasan

S

5 actionmodelexecutedinan

S

5 relationalmodel will always resultin an

S

5 relational model). This is obvious,as the presence of arrowsin the resulting model is also determinedbysourceandtargetconditions.Forexample,ifinthearrowupdateofthefirstexamplewechangethearrow



→

b



linking

◦

to

•

into

⊥

→

b



,thentheresultingmodelwillnolongerbereflexive.Itisnolonger

S

5.Itisnotknown

howtoaddresssuchissuessystematically(seeSection8).

Assaid,arrowupdatesareanalternativemodellingmechanismtothebetterknownactionmodels.InSection6,andin particularSubsection6.5,wecomparethetwomechanismsinmoredetail,wewillgiveactionmodelsthatdefinethesame updateasthearrowupdatesinthissection,andwewillalsopresenttypicalapplicationsonwhichtheyperformdifferently.

3. Arrowupdatesynthesis

ThegoalofsynthesisforAUMListofind,givenagoalformula

ϕ

,anarrowupdate(i.e.,apointedarrowupdatemodel)

(

U

,

o

)

thatmakes

ϕ

true.Thereareatleastthreewaysinwhichwecouldinterpretthisgoal,however.

Definition4(Synthesis).

•

Thelocalsynthesisproblem takesasinputapointedmodel

(

M

,

s

)

andagoalformula

ϕ

.Theoutputisan arrowupdate

(

U

,

o

)

suchthat M

,

s

|= 

U

,

o



ϕ

,or“NO”ifnosucharrowupdateexists.

•

Thevalidsynthesisproblem takesasinputagoalformula

ϕ

.Theoutputisanarrowupdate

(

U

,

o

)

suchthat

|= 

U

,

o



ϕ

, or“NO”ifnosucharrowupdateexists.

•

Theglobalsynthesisproblem takesasinputagoalformula

ϕ

.Theoutputisanarrowupdate

(

U

,

o

)

suchthatforevery pointedmodel

(

M

,

s

)

,ifthereissome

(

U

,

o

)

suchthatM

,

s

|= 

U

,

o



ϕ

,then M

,

s

|= 

U

,

o



ϕ

.

Werecallfromtheintroductionthatwetakethethirdapproach:whenwe saysynthesiswemeanglobalsynthesis.An alternative,equivalentcharacterizationoftheglobalsynthesisproblemisthat,forgiven

ϕ

,wewanttofind

(

U

,

o

)

suchthat, forall

(

M

,

s

)

,M

,

s

|= ↑

ϕ

↔ 

U

,

o



ϕ

(seeProposition16).

Notethatfortheglobalsynthesisproblem,unlikethelocalsynthesisproblemandthevalidsynthesisproblem,wedonot allow“NO”asanoutput.Asaresult,itisnotobviousthatglobalsynthesisforAUMLispossibleatall.Wealsorecallfrom theintroductionthatsynthesisisimpossibleforPALandforAUL,butpossibleforAML[17].Wenowshow thatsynthesis forAUMLisindeedalsopossible.Becauseourversionofsynthesisisglobal,itcannotdependonanyspecificmodel.Soour synthesisprocessispurelysyntactic.

Inour synthesis,we makeuseofso-calledreductionaxioms. Thesereduction axiomsarea setofvaliditiesthat, when takentogether,showthatAAUMLhasthesameexpressivepowerasmodallogic.

3.1. Reductionaxiomsforarrowupdatemodels

Westartbyconsideringthereductionaxiomsforthe

[

U

,

o

]

operator.

Lemma5([10]).Let

(

U

,

o

)

beanarrowupdate,p

∈

P ,a

∈

A and

ϕ

,

ψ

∈

L

.Thenthefollowingvaliditieshold.

|= [

U

,

o

]

p

↔

p

|= [

U

,

o

]¬

ϕ

↔ ¬[

U

,

o

]

ϕ

|= [

U

,

o

](

ϕ

∧ ψ) ↔ ([

U

,

o

]

ϕ

∧ [

U

,

o

]ψ)

|= [

U

,

o

]

a

ϕ

↔



(o,ψ )→a(o,ψ)

(ψ

→ 

a

(ψ



→ [

U

,

o

]

ϕ

))

Proof. Thefirstthreevaliditiesfollowimmediatelyfromthesemantics of

[

U

,

o

]

.Thefourthvalidityalsofollowsfromthe semantics,inthefollowingway.

M

,

w

|= [

U

,

o

]

a

ϕ

iff M

∗

U

, (

w

,

o

)

|= 

a

ϕ

iff for all

(

w

,

o

)

such that

(

w

,

o

)

Ra

(

w

,

o

)

:

M

∗

U

, (

w

,

o

)

|=

ϕ

iff for all

(

o

, ψ



)

and wsuch that

(

o

, ψ )

→

a

(

o

, ψ



)

and w Raw

:

if M

,

w

|= ψ

and M

,

w

|= ψ

then M

∗

U

, (

w

,

o

)

|=

ϕ

iff for all

(

o

, ψ



)

such that

(

o

, ψ )

→

a

(

o

, ψ



)

:

if M

,

w

|= ψ

then M

,

w

|= 

a

(ψ



→ [

U

,

o

]

ϕ

)

iff M

,

w

|=



_{(o,ψ )→}

a(o,ψ)

(ψ

→ 

a

(ψ



_{→ [}

_U

_,

_o

_]

_ϕ

₎₎

_

Note that, in particular,

|= [

U

,

o

]¬

ϕ

↔ ¬[

U

,

o

]

ϕ

implies that

[

U

,

o

]

is self-dual: we have

|= [

U

,

o

]

ϕ

↔ 

U

,

o



ϕ

. This, of course, doesnot extend to thearbitrary arrowupdate operator: there are

ϕ

forwhich

|= [↑]

ϕ

↔ ↑

ϕ

,for example,

|= [↑]

ap

↔ ↑

ap.

Theabove lemmashowsthat

[

U

,

o

]

commuteswith

¬

,distributesover

∧

and, inasomewhat complicatedway, com-muteswith



a.Asdiscussedin[10],thissufficestoshowthat

[

U

,

o

]

canbeeliminatedfromtherestrictionofthelanguage

L

to

L

auml.

Corollary6.Forevery

ϕ

∈

L

aumlthereisaformula

ϕ



∈

L

mlsuchthat

|=

ϕ

↔

ϕ

.

3.2. Reductionaxiomsforthearrowupdatemodelquantifier

We can alsowrite similar reduction axiomsfor

[↑]

. Inpractice, however,it turnsout tobe slightly moreconvenient towrite themforthedualoperator

↑

.Notethatinthe lemmasinthissubsectionwerestrict ourselvesto thelanguage

L

auml,assomeofthoselemmasusethat

↑

quantifiesoverarrowupdateswithsourceandtarget conditionsin

L

ml,and

becausewe can meetthisconstraintby applying Corollary6. Later,inTheorem 15inthe next subsection,we willshow thatthisrestrictionisunnecessary,andthatthelemmasapplyto

L

aswell.

Lemma7.Forevery

ϕ

∈

L

aumlandeverya

∈

A,wehave

|= ↑♦

a

ϕ

↔ ♦

a

↑

ϕ

Proof. Let

(

M

,

w

)

be any pointed model, and suppose that M

,

w

|= ↑♦

a

ϕ

. Then there is some

(

U

,

o

)

such that M

∗

U

,

(

w

,

o

)

|= ♦

a

ϕ

.So

(

w

,

o

)

hasana-successor

(

w

,

o

)

suchthatM

∗

U

,

(

w

,

o

)

|=

ϕ

.

This impliesthat M

,

w

|= 

U

,

o



ϕ

andtherefore M

,

w

|= ↑

ϕ

.Since w is an a-successor of w, we obtain M

,

w

|=

♦

a

↑

ϕ

.

Now,suppose that M

,

w

|= ♦

a

↑

ϕ

.Then thereisan a-successor wof w such that M

,

w

|= ↑

ϕ

.As witnessforthis

↑

statementtheremustbesomeU

,

osuchthat M

,

w

|= 

U

,

o



ϕ

.

Let

(

U

,

o

)

be thearrow update obtainedby adding one extraworld o to U,anda transition

(

o

,

)

→

a

(

o

,

)

. Note

that

(

M

∗

U

,

(

w

,

o

))

is bisimilarto

(

M

∗

U

,

(

w

,

o

))

, andtherefore M

∗

U

,

(

w

,

o

)

|=

ϕ

.Finally, note that

(

w

,

o

)

isan a-successorof

(

w

,

o

)

,sowehaveM

∗

U

,

(

w

,

o

)

|= ♦

a

ϕ

andthereforeM

,

w

|= ↑♦

a

ϕ

.



Notethattheproof isconstructive. Thatis,ifwefind

(

U

,

o

)

suchthat M

,

w

|= ♦

a



U

,

o



ϕ

thennotonlydoweknow

that M

,

w

|= ↑♦

a

ϕ

,wecanalsofindaspecific

(

U

,

o

)

suchthat M

,

w

|= 

U

,

o

♦

a

ϕ

.

Next,weconsideraslightlystrongerlemma.

Lemma8.Forevery

ϕ

1

,

· · · ,

ϕ

n

∈

L

aumlandeverya

∈

A wehave

|= ↑



1≤i≤n

♦

a

ϕ

i

↔



1≤i≤n

♦

a

↑

ϕ

i

Proof. Theleft-to-rightdirectionisobvious,soweshowonlytheright-to-leftdirection.SosupposethatM

,

w

|=



♦

a

↑

ϕ

i.

Then thereare a-successorsw1

,

· · · ,

wn of w and pointedarrowupdatemodels

(

U1

,

o1

),

· · · ,

(

Un

,

on

)

such that M

,

wi

|=



Ui

,

oi



ϕ

iforalli.

Now,let

(

U

,

o

)

bethearrowupdateobtainedbytakingthedisjointunionofallUiandaddingoneextraoutcomeo,and

addingarrows

(

o

,

)

→

a

(

oi

,

)

foreveryoi.

Forevery i,

(

M

∗

Ui

,

(

wi

,

oi

))

isbisimilarto

(

M

∗

U

,

(

wi

,

oi

))

,sowehave M

∗

U

,

(

wi

,

oi

)

|=

ϕ

i.Finally,

(

wi

,

oi

)

isan

a-successorof

(

w

,

o

)

foreveryi.Assuch,wehaveM

,

w

|= 

U

,

o





♦

a

ϕ

iandtherefore,asallthesourceandtargetconditions

ofU arein

L

ml,M

,

w

|= ↑



♦

a

ϕ

i.



Again,theproofisconstructive,sogiven

(

Ui

,

oi

)

forall i,wecanfindthemodel

(

U

,

o

)

.Notealsothatthe

ϕ

i neednot

beconsistentwitheachother.

Some reflection maybe inorder astowhy Lemma8holds. Supposethat M

,

w

|=



♦

a

↑

ϕ

i. So forevery i,there is

some worldwi thata considerspossibleaswellassomeeventUi andoutcomeoisuchthat,if

(

Ui

,

oi

)

weretohappenin

wi,then

ϕ

i wouldbecometrue.

Now let uslookatthe arrowupdate

(

U

,

o

)

that we constructed.Effectively, thisarrowupdate representsustellinga that“weareperformingoneoftheactionsUi

,

oi,butwearenottellingyouwhichone.”Now,foreveryi agenta considers

itpossiblethat wiistheactualworld,andthat

(

Ui

,

oi

)

istheeventthathappened.Assuch,afterweexecuteoureventwe

areinasituationwhereevery

ϕ

iisheldpossiblebya.

Sofar,wehaveonlyconsidereddiamonds.Now,letusaddaboxmodality.

Lemma9.Forevery

ϕ

1

,

· · · ,

ϕ

n

,

ψ

∈

L

aumlandeverya

∈

A,wehave

|= ↑(



1≤i≤n

♦

a

ϕ

i

∧ 

a

ψ )

↔



1≤i≤n

♦

a

↑(

ϕ

i

∧ ψ)

Proof. Theleft-to-rightdirectionisfairlyobvious.SupposethatM

,

w

|= ↑(



_1≤i≤n

♦

a

ϕ

i

∧

a

ψ)

.Thenthereisa

(

U

,

o

)

such

that M

,

w

|= 

U

,

o

(



_1≤i≤n

♦

a

ϕ

i

∧ 

a

ψ)

.Therefore, M

∗

U

,

(

w

,

o

)

|= 

a

ψ

andforeach 1

≤

i

≤

n, M

∗

U

,

(

w

,

o

)

|= ♦

a

ϕ

i.Let

(

wi

,

o

)

besuchthat

(

w

,

o

)

Ra

(

wi

,

o

)

andM

∗

U

,

(

wi

,

o

)

|=

ϕ

i.FromM

∗

U

,

(

w

,

o

)

|= 

a

ψ

and

(

w

,

o

)

Ra

(

wi

,

o

)

alsofollows

that M

∗

U

,

(

wi

,

o

)

|= ψ

.CombiningbothwehaveM

∗

U

,

(

wi

,

o

)

|=

ϕ

i

∧ ψ

.Therefore,M

,

wi

|= 

U

,

o

(

ϕ

i

∧ ψ)

,fromwhich

itfollowsthat M

,

wi

|= ↑(

ϕ

i

∧ ψ)

.From

(

w

,

o

)

Ra

(

wi

,

o

)

itfollowsby definitionthat w Rawi.From M

,

wi

|= ↑(

ϕ

i

∧ ψ)

andw RawiwegettherequiredM

,

w

|= ♦

a

↑(

ϕ

i

∧ ψ)

.Asi wasarbitrary,M

,

w

|=



1≤i≤n

♦

a

↑(

ϕ

i

∧ ψ)

.

Wenowshowtheright-to-leftdirection.SosupposethatM

,

w

|=



_1≤i≤n

♦

a

↑(

ϕ

i

∧ ψ)

.Thenforevery1

≤

i

≤

n,there

areana-successor wi ofw and

(

Ui

,

oi

)

suchthatM

,

wi

|= 

Ui

,

oi

(

ϕ

i

∧ ψ)

.

Let

(

U

,

o

)

be themodel obtainedby taking the disjointunion ofall Ui, andadding a single outcome o with arrows

(

o

,

)

→

a

(

oi

,



Ui

,

oi

ψ)

foreveryi.

Consider

(

M

∗

U

,

(

w

,

o

))

.By assumption, M

,

wi

|= 

Ui

,

oi

(

ϕ

i

∧ ψ)

,so M

,

wi

|= 

Ui

,

oi

ψ

. From that andthe fact that