Philippe Besnard

Sébastien Konieczny

Philippe Balbiani

Thomas Caridroit

Frank Dignum

Hans Van Ditmarsch

Andreas Herzig

Jean-Marie Lagniez

Sébastien Magnier

Pierre Marquis

Valentin Montmirail

Daniel Le Berre

Emiliano Lorini

Lambèr Royakkers

Nicolas Troquard

existed. Special thanks to Lorena Beghetto

Marli De Lima

Antonio De Lima

Chapter 1 Introduction

As the reader may have already guessed, this work is all about modal logics for actions, knowledge and belief, but also some additional concepts, such as responsibility and ability. Indeed, this is the kind of research I decided to do since my Ph.D., more than a decade ago. This topic is part of a broader subarea of artificial intelligence called knowledge representation and reasoning. The study described here intersects some subareas of philosophy and also multi-agent systems, game theory and computational complexity.

This work synthesises research results obtained after my Ph.D., from 2008 onward. Starting on Chapter 4, the structure of the document is organised in order to reflect some of the main topics I worked on during this period. I chose the subjects that are more representative of my work.

But, before that, Chapter 2 presents, as its title suggests, some formal preliminaries. The idea is to establish the mathematical notation that will be used in the entire document, as well as to recall basic definitions, theorems and facts that will be referred to in the subsequent chapters. This exposition is divided into two parts. Section 2.1 presents classical propositional logic (hereafter CPL), its syntax, semantics, axiom systems and reasoning methods. Section 2.2 contains a very brief introduction to belief revision theory. The AGM postulates and a couple of fundamental theorems are presented in order to pave the way for Chapter 6, that will refer to that material. After that, Chapter 3 presents modal logics. We will see modal logic syntax, semantics, axiom systems, expressiveness, reasoning methods and also some applications.

Chapter 4 presents a formalism aiming at modeling responsibility in multi-agents environments. I started working on this subject during my two years post-doc at the Eindhoven University of Technology, in The Netherlands. There, I wrote some papers on logic and responsibility with Lambèr Royakkers from Eindhoven and Frank Dignum from the Utrecht University. The most recent work I published on that topic was done some years latter, after I moved to France.

The formalism is called coalition epistemic dynamic logic (CEDL). It is a modal

Chapter 1. Introduction logic that contains epistemic and dynamic operators. Other operators are defined as abbreviations, such as obligations, ability and knowing ability. For instance, an agent has the ability to achieve ϕ if there is an action that the agent can execute and its execution leads to ϕ. But, knowing ability means that the agent, in addition, knows what action it is. A sound and complete axiom system is also provided. On the conceptual side, CEDL has been designed to reason about responsibility, which is a concept defined in terms of causality, knowledge and obligation. We will see formal definitions of different kinds of individual and collective responsibility and, consequently, some logical relations between these different concepts.

Chapter 5 presents a formalism aiming at modeling agents abilities and knowledge trough time. That work was carried out at the Lens Computer Science Research Laboratory (abbreviated CRIL), in France. I joined the CRIL mid 2009 to occupy a position of Lecturer (maître de conférences). The position was offered along with a very interesting five years CNRS Chair (chaire CNRS).

The logic we see in Chapter 5 is called alternating-time temporal dynamic epistemic logic (ATDEL). ATDEL also has dynamic and knowledge operators and, in addition, temporal operators. The dynamic operators of ATDEL are designed in "dynamic epistemic logic style". Here, we only define public actions, such as public announcements and also factual change actions that are perceived by all agents in the environment. In that respect, ATDEL is less expressive than the former CEDL. However, ATDEL semantics permits much shorter system specifications. In addition, apart from a sound and complete axiom system, algorithms for model checking and satisfiability checking in an interesting fragment of the logic are proposed. We will also see a comparison of the expressiveness of ATDEL with several different logics from the literature.

Chapter 6 presents some research on multi-agent belief change. This work has been carried out in collaboration with CRIL colleagues Thomas Caridroit, Sébastien Konieczny and Pierre Marquis. Thomas was my first Ph.D. student. I co-supervised him together with Sébastien and Pierre from 2013 until 2016. Working with Thomas, Sébastien and Pierre on this subject, which has a substantial intersection with, but is slightly different from, what I have been done before, was rewarding. It also permitted the opening of new perspectives for my research.

CEDL and ATDEL were designed with knowledge operators. One may think that these logics could work well with belief, and the change would just be a small technical trick. But this is not the case. I can tell, I tried it. When belief operators naively replace knowledge in the formalisms mentioned above, the resultant logic just does not work as it should.

When an agent faces a new piece of information that contradicts previous beliefs, a revision must be done. This can be a quite complicated process. "Correct" ways of revising beliefs have been proposed in the field of belief revision theory. Chapter 6 presents an adaptation of these techniques to multi-agents scenarios. AGM belief expansion and revision postulates are generalised to such scenarios and concrete operators for multi-agent expansion and revision are proposed.

Chapter 7 presents some research on automated reasoning for modal logics. This time, the study was performed in collaboration with my CRIL colleagues Jean-Marie Lagniez, Daniel Le Berre and Valentin Montmirail. Valentin was my second Ph.D. student. I co-supervised him with Jean-Marie and Daniel. Once again, the experience was rewarding, and even more perspectives have been opened. I consider this topic particularly important for my personal objectives. The possibility to develop practical applications from what was, up to some years ago, exclusively theoretical research seems promising.

On that chapter, we will see methods for satisfiability checking in modal logics K and KT5 (also known as S5). The method for KT5 amounts to an efficient translation from that logic to classical propositional logic that is handed over to a performant SAT solver. Practical experiments show that this technique outperformed all alternative methods. The reasoning method for modal logic K also uses a translation to CPL. But, since the translated formula can be exponentially larger than the original one, a more clever algorithm was designed in order to work with "parts" of that translation.

Finally, Chapter 8 concludes the thesis. It discusses some results and points out new possible directions of research.

This document does not contain all the research I have being doing since 2008. For instance, still in Eindhoven, I published a couple of papers on acceptance logic and intentions and plan dynamics with Andreas Herzig and Emiliano Lorini both from Toulouse. After moving to France, some new papers on dynamic epistemic logics, co-authored with Philippe Balbiani, Hans van Ditmarsch and Andreas Herzig have been published as well. There is also a fine paper on dialogical logic written with Sébastien Magnier, at the time, a Ph.D. student supervised by Shahid Rahman from Lille. Appendix A contains a list of all my publications on the period.

The great majority of proofs of theorems and alike are omitted from the this text. Only some "easy" proofs and sketches are present, and only when they help understanding the results. This decision was motivated by the fact that long or difficult proofs may disrupt the reading process, take away the focus or, worse, annoy the reader. In each case, the reader will be pointed to the articles where these proofs can be found.

Chapter 2

Formal Preliminaries

Classical Propositional Logic

In the very beginning of his class notes, [START_REF] Fitting | Notes on Classical Propositional Logic[END_REF] says that: "Classical propositional logic is the simplest and most nicely behaved of any logic (whatever that means)." Since I do not know what that means, I prefer to motivate the study of classical propositional logic (CPL) (also called sentential logic, statement logic, propositional calculus, etc.) by the fact that it is one of the most fundamental logical formalisms we have. It is included in modal logics and thus also in first-order logic and higher-order logic.

CPL studies propositions, which are sentences to which one can assign truth values, i.e., they can be true or false. For example, the following two sentences are propositions: John teaches at the university (2.1) John is an academic. (2.2) In addition to propositions, CPL also has connectives, such as → (material implication) and ∧ (conjunction), that can be used to form new propositions. For instance, the sentence: (2.3) If John teaches at the university then John is an academic.

is also a proposition. This proposition is true if and only if, if (2.1) is true then (2.2) is also true. If we are able to show that both (2.1) and (2.3) are true, CPL permits us to conclude that (2.2) is true as well.

On the next subsections, we see the syntax and semantics of CPL, which permit us to construct propositions and to give them meaning. After that, we see different proof methods for CPL, which is what permits us to study the relationships among propositions and to draw conclusions from them.

Syntax

The symbols used in the language of CPL are constants, propositional variables (also called propositional letters) and connectives. We assume the constant ⊥ and a nonempty countable (possibly infinite) set of propositional variables P. Elements of P are noted p 0 , p 1 , p 2 , etc.. The primitive connectives used here are →, ∧ and ∨. The first one is called 'material implication ' (or 'if-then', if you prefer), the other two are called, respectively, 'conjunction' and 'disjunction'. Some other (non-primitive) connectives are also used. They are defined as abbreviations. Formally, we have the following. Definition 2.1 (CPL Formula). Let P be a non-empty countable (possibly infinite) set of propositional variables. The language of classical propositional logic, also called the set of classical propositional logic formulas, is noted L CPL and is defined by the following grammar in Bakus-Nahur form:

ϕ ::= ⊥ | p | (ϕ → ϕ) | (ϕ ∧ ϕ) | (ϕ ∨ ϕ)
where p is any element of P.

Throughout this document, we also use the constant and connectives ¬ and ↔. They are defined as abbreviations, namely:

def = ¬⊥, ¬ϕ def = (ϕ → ⊥) and (ϕ ↔ ψ) def = ((ϕ → ψ) ∧ (ϕ → ψ)).
We sometimes omit outer parentheses when convenient.

A formula of the form (ϕ → ψ) is read 'if ϕ then ψ' (or, 'ϕ implies ψ'), a formula of the form (ϕ ∧ ψ) is read 'ϕ and ψ' and a formula of the form (ϕ ∨ ψ) is read 'ϕ or ψ'.

The idea is to identify atomic propositions with propositional variables. As we have done in the example, we can identify (2.1) above with variable p 0 and (2.2) with p 1 . Then, proposition (2.3) is written in CPL as p 0 → p 1 .

Semantics

The meaning of CPL formulas is given by the semantics of the logic, which uses Boolean valuations.

Definition 2.2 (Boolean Valuation).

A Boolean valuation is a function V : P → {0, 1}, which assigns a truth value to each propositional variable in P.

The truth values 0 and 1 mean, respectively, 'false' and 'true'. Let p ∈ P, V (p) = 0 means that the proposition represented by p is false, and it is true when V (p) = 1. The valuation function can be used to give the truth values to all formulas in L CPL . There are several different ways to do that. Here, we find it more convenient to use a satisfaction relation.

Definition 2.3 (Satisfaction Relation). The satisfaction relation

between Boolean valuations and formulas in L CPL is recursively defined as follows:

V ⊥ V p iff V (p) = 1 V (ϕ → ψ) iff if V ϕ then V ψ V ϕ ∧ ψ iff V ϕ and V ψ V ϕ ∨ ψ iff V ϕ or V ψ
Example 2.1. Let the formula p 0 → p 1 be given, and let V be a Boolean valuation where V (p 0 ) = 1 and V (p 1 ) = 0. We have:

V p 0 → ¬p 1 iff if V p 0 then V p 1 iff if V (p 0 ) = 1 then V (p 1 ) = 1
Thus, the formula p 0 → p 1 is true under this Boolean valuation.

When V ϕ, we say that the Boolean valuation V satisfies the formula ϕ. Boolean valuations are also called CPL models. When a model satisfies a formula ϕ, it is also called a model of ϕ. This leads to the next definition. Definition 2.4 (Satisfiability, Validity). A CPL formula ϕ is satisfiable if and only if there is a Boolean valuation V that satisfies ϕ. A CPL formula ϕ is valid if and only if all Boolean valuations V satisfy ϕ.

We use ϕ to denote that ϕ is valid.

A valid CPL formula is also called a tautology. This notion can be generalised, as follows.

Definition 2.5 (Semantic Consequence). Let Γ be a set of CPL formulas. A CPL formula ϕ is a semantic consequence of Γ if and only if every Boolean valuation that satisfies every member of Γ also satisfies ϕ.

We use Γ ϕ to denote that ϕ is a semantic consequence of Γ.

Note that, if a formula ¬ϕ is not valid, then there is a valuation V such that V ¬ϕ. This means that V ϕ. Therefore, ϕ is satisfiable if and only if ¬ϕ. Also note that ϕ if and only if ∅ ϕ.

For instance, the formula p 0 → p 1 in Example 2.1 is satisfiable, but not valid. To see it, assume another Boolean valuation V where V (p 0 ) = 1 and V (p 1 ) = 0. The reader may verify that V p 0 → p 1 . As an example of valid formula, one can verify that p 0 → p 0 is satisfied by all Boolean valuations.

Semantic consequence also permits us to define equivalence and equisatisfiability between formulas. Definition 2.6 (Equivalence). Two CPL formulas ϕ and ψ are equivalent, noted ϕ ≡ ψ, if and only if, ϕ ψ and ψ ϕ. Definition 2.7 (Equisatisfiability). Two CPL formulas ϕ and ψ are equisatisfiable, noted ϕ sat ≡ ψ, if and only if there is a function f between Boolean valuations such that, for all V we have:

V ϕ iff f (V ) ψ Corollary 2.1. ϕ ≡ ψ implies ϕ sat ≡ ψ.
It is easy to see that the converse of Corollary 2.1 is not true. For example, p 0 sat ≡ p 1 , whereas p 0 ≡ p 1 . Equivalence means that the very same models that satisfy one formula also satisfy the other, whereas equisatisfiability means that, whenever we can find a model for one formula, we can also find a model for the other one.

An Axiom System for CPL

In this thesis, we are often interested in deciding whether a formula is valid in a logic. Depending on the logic, there may be several automatic methods to perform this task. One of the most traditional is the one known as Hilbert-style system. Most of the time, this method is not very efficient, but it is relevant for this work, specially on chapters 4, 5 and 6. Therefore, we give it some attention here. Efficient methods for deciding whether CPL formulas are valid are discussed on Section 2.1.4. Efficient methods for deciding validity of modal logic formulas are proposed on Chapter 7.

Hilbert-style systems are also called axiom systems. Such a system consists of a set of axiom schemas A and a set of inference rules R. An axiom schema is a "schematic" formula, in the sense that it stipulates that any formula of a certain format is an axiom. For example, assume that the formula below is an axiom schema:

ϕ → (ψ → ϕ)
We have that p 0 → (p 1 → p 0 ) is an axiom, as well as ¬p 0 → ((p 1 → p 0 ) → ¬p 0 ). The former is so by setting ϕ = p 0 and ψ = p 1 , whereas for the latter, we set ϕ = ¬p 0 and ψ = p 1 → p 0 . The axioms used in a derivation (see Definition 2.8) are also called instances of the axiom schema considered.

Inference rules have two components: a set of formulas that triggers the rule and a set of formulas that are produced by the rule, and these sets of formulas are also schemas. For example, assume the inference rule below:

From ϕ and ϕ → ψ infer ψ

We have that, if the formulas p 0 and p 0 → p 1 are already present in a derivation, then we can add the formula p 1 to the derivation.

A formula is considered valid in the given axiom system if one can find a proof for it using the axioms and inference rules available. So first, let us make precise what proof means.

Definition 2.8 (Derivation, Proof). Let an axiom system be formed by a set of axiom schemas A and a set of inference rules R. Let H be a (possibly infinite) set of formulas, called hypotheses. A derivation from H is a finite sequence of formulas ϕ 1 , . . . , ϕ n such that each formula in the sequence is either:

• a member of H,

• an axiom from A, or

• obtained by the application of an inference rule from R to formulas that appear previously in the sequence.

The last formula of the sequence, ϕ n , is the derived formula.

If the set H is empty, the derivation is called proof, and the last formula in the sequence is the formula that has been proved.

We use H ϕ to denote that ϕ is derived from H and we simply use ϕ to denote that ϕ is derived from ∅.

Example 2.2. Let us see how a derivation looks like. Recall that the formula p 0 → p 0 is valid. Below, we see how it can be proved in the axiom system of Table 2.1.

p 0 → ((p 1 → p 0 ) → p 0 )
instance of (→ 1) 1.

(p 0 → ((p 1 → p 0 ) → p 0 )) → ((p 0 → (p 1 → p 0 )) → (p 0 → p 0 )) instance of (→ 2) 2. (p 0 → (p 1 → p 0 )) → (p 0 → p 0 )
from 1 and 2 with (RMP) 3.

p 0 → (p 1 → p 0 )
instance of (→ 1) 4. p 0 → p 0 from 3 and 4 with (RMP) 5.

Line 1 is an instance of axiom schema (→ 1), where ϕ = p 0 and ψ = p 1 → p 0 . Line 2 is an instance of axiom schema (→ 2), where, ϕ = p 0 and ψ = p 1 → p 0 and χ = p 0 . Line 3 is obtained from the application of inference rule (RMP) to lines 1 and 2. Line 4 is another instance of axiom schema (→ 1), where ϕ = p 0 and ψ = p 1 . Finally, line 5 is obtained from lines 3 and 4 by the application of inference rule (RMP).

Derivations are also fundamental to understand the concept of deductive closure, which is important, for instance, in belief revision theory, that we study in Chapter 6. Definition 2.9 (Deductive Closure). Let Γ be a set of formulas. The deductive closure of Γ is the set Cn(Γ) = {ϕ | Γ ϕ}, i.e., the set of all formulas that can be derived when taking all formulas in Γ as hypotheses. Some interesting properties follow immediately from the definitions above. First, it is easy to see that, whenever a formula can be derived from a set Γ, it can also be derived from a set Γ , where Γ ⊆ Γ . We thus have the following property. For the next property, assume an infinite set Γ such that Γ ϕ. Since derivations must be finite, it follows that there is only a finite set of formulas from Γ that are used on the proof of ϕ.

Lemma 2.3 (Compactness

). If Γ ϕ then there is a finite set Γ ⊆ Γ such that Γ ϕ. ϕ → (ψ → ϕ) (implication 1) (→ 1) (ϕ → (ψ → χ)) → ((ϕ → ψ) → (ϕ → χ)) (implication 2) (→ 2) ⊥ → ϕ (falsehood) (⊥) (ϕ ∧ ψ) → ϕ (conjunction 1) (∧1) (ϕ ∧ ψ) → ψ (conjunction 2) (∧2) ϕ → (ψ → (ϕ ∧ ψ)) (conjunction 3) (∧3) ϕ → (ϕ ∨ ψ) (disjunction 1) (∨1) ψ → (ϕ ∨ ψ) (disjunction 2) (∨2) (ϕ → ⊥) → ((ψ → ⊥) → ((ϕ ∨ ψ) → ⊥)) (disjunction 3) (∨3) ((ϕ → ⊥) → ⊥) → ϕ (double negation) (¬¬)
From ϕ and ϕ → ψ infer ψ (modus ponens) (RMP)

Table 2.1 -Axiom system of classical propositional logic

The completeness proofs in this section, as well as in Section 3 and chapters 4 and 5 use the concepts of consistent and maximal consistent sets. We therefore pay some attention to it here. Definition 2.10 (Consistency). A set of formulas Γ is inconsistent if and only if Γ ⊥, and it is consistent if and only if it is not inconsistent, i.e., Γ ⊥. Definition 2.11 (Maximal Consistent Set). A set of formulas Γ is maximal consistent if and only if (1) it is consistent and (2) if Γ ⊆ Γ then Γ = Γ . Now, assume that a maximal consistent set Γ such that Γ ϕ. It is interesting to see that ϕ must be in Γ. For, if ϕ ∈ Γ were the case, then, because Γ is maximal consistent, we would have that Γ ∪ {ϕ} ⊥. But, since Γ ϕ, it is not difficult to see that one can produce a finite proof for ⊥ using the elements of Γ. However, the latter contradicts the fact that Γ is consistent. Therefore, we have the following property.

Lemma 2.4. Let Γ be a maximal consistent set. If Γ ϕ then ϕ ∈ Γ. Now, the proof of the famous theorem below uses lemmas 2.2 and 2.3 above, but we spare the reader from the details. Theorem 2.5 (Lindenbaum's Theorem). Let Γ be any consistent set. We have that Γ ⊆ Γ * , for some maximal consistent set Γ * .

It can be shown that the axiom system in Table 2.1 is sound and complete for CPL.

Theorem 2.6 (Soundness and Completeness). Let the axiom system on Table 2.1 be given. We have that ϕ if and only if ϕ. Soundness, i.e., the implication from the left to the right, is very simple. In fact, it is enough to show that every principle in Table 2.1 is valid. For the axioms, it amounts to show that they are all tautologies. For the inference rule (RMP), it amounts to show that, whenever ϕ and ϕ → ψ are tautologies, so is ψ. As the reader may easily verify, this is indeed the case. All this means that every formula in a proof is valid. Therefore, every proved formula is valid.

Proof of completeness, i.e., the implication from the right to the left, is much more involving. First, we show the folowing theorem.

Theorem 2.7 (Deduction Theorem). Let Γ ⊆ L CPL and ϕ, ψ ∈ L CPL . If Γ ∪ {ϕ} ψ then Γ ϕ → ψ. (In particular, if ϕ ψ then ϕ → ψ.)

Second, we show the following lemma.

Lemma 2.8. Γ is a maximal consistent set of formulas if and only if, for all ϕ ∈ L CPL , we have:

1. ϕ ∈ Γ iff (ϕ → ⊥) ∈ Γ. 2. (ϕ → ψ) ∈ Γ iff, if ϕ ∈ Γ then ψ ∈ Γ. 3. (ϕ ∧ ψ) ∈ Γ iff ϕ ∈ Γ and ψ ∈ Γ. 4. (ϕ ∨ ψ) ∈ Γ iff ϕ ∈ Γ or ψ ∈ Γ.
The proof of Lemma 2.8 uses Lemma 2.4 and theorems 2.5 and 2.7. As for an easy example, Axioms (∧1) and (∧2) guarantee that if ϕ ∧ ψ ∈ Γ, we have both ϕ ∈ Γ and ψ ∈ Γ.

After all that, we can finally show completeness by showing the countrapositive of the claim, i.e., if a formula ϕ does not have a proof then it is not valid. In fact, it is possible to prove an even stronger result, called strong completeness, which means the following.

Theorem 2.9. ϕ ψ if and only if ϕ ψ.

We finish this section with two remarks. First, as a side effect of the deduction theorem above, we have the following property.

Corollary 2.10. ϕ ≡ ψ if and only if ϕ ↔ ψ.

Second, the choice of primitive connectives made here is guided by the technique used to prove completeness of the axiom system. In any case, whenever the set of primitive connectives is adequate, i.e., it permits to define all truth-functional operations, a sound and complete axiom system can be found.

For example, we could have chose to define CPL with negation (¬) and material implication (→) as primitive connectives and use abbreviations for ⊥, , ∧, ∨ and ↔. In this case, it is shown in, e.g., [START_REF] Mendelson | An Introduction to Mathematical Logic[END_REF] that, the axiom system formed by (→ 1), (→ 2), (RMP) and the axiom schema:

(¬ϕ → ¬ψ) → ((¬ϕ → ψ) → ϕ) (negation) (¬2)
is sound and complete for CPL. We choose the technique above, which uses maximal consistent sets and the Lindenbaum's Theorem, because this is the technique commonly used to show completeness of axiom systems in modal logics. We will therefore build axiom systems for modal logics from that.

Deductive closures and maximal consistent sets are also usefull in some other contexts. For example, knowledge bases inconsistency mesures [START_REF] Bona | Towards a Unified Framework for Syntactic Inconsistency Measures[END_REF][START_REF] Hunter | On the measure of conflicts: Shapley Inconsistency Values[END_REF][START_REF] Mu | A general framework for measuring inconsistency through minimal inconsistent sets[END_REF] are havily based on this notion.

Automated Reasoning in CPL

Let a formula ϕ ∈ L CPL be given, the problem of deciding whether ϕ is satisfiable in a logic is called satisfiability checking problem. In the case of CPL, [START_REF] Cook | The complexity of theorem-proving procedures[END_REF] proved that any recognition problem that can be solved in polynomial time by a nondeterministic Turing machine can be reduced to the CPL satisfiability checking problem. In other words, CPL satisfiability checking is a NP-Hard problem. Since there are several algorithms that decide satisfiability of CPL formulas in polynomial time in a non-deterministic Turing machine, we have that CPL satisfiability checking problem is in NP. Altogether, this means that CPL satisfiability checking is a NP-Complete problem.

Note that, an algorithm deciding satisfiability of CPL formulas can easily be turned into an algorithm deciding validity of CPL formulas and vice-versa. Indeed, because ϕ is satisfiable if and only if ¬ϕ is not valid, we immediately have that CPL validity checking is a co-NP-complete problem.

As said before, axiom systems are not efficient automatic methods for reasoning in CPL. This is why, in this subsection, we show two methods for CPL satisfiability checking that are more efficient in practice. The tableau method and the CDCL algorithm.

The Tableau Method

One of the simplest algorithms deciding satisfiability (thus, also validity) of CPL formulas is the tableau method. (For a thorough exposition of the subject the reader may consult (D'Agostino et al. 1999).) The idea of this algorithm is to decompose the formula given as input in sub-formulas until it reaches its atoms (constants or variables) and then build-up a Boolean valuation for them.

But, before presenting the method, we need to deal with a tiny language problem. In fact, it turns out that it is easier to design a tableau method for CPL when negation (¬), conjunction (∧) and disjunction (∨) are taken as the primitive connectives of the language, and the other ones are defined as abbreviations. Note that this can be done without affecting the expressiveness of the logic. In the following, we assume that L CPL is defined in this way.

The tableau method explores the sub-formulas of the formula ϕ that is given it as input. So, before presenting the method, we need to make precise what sub-formula means.

Definition 2.12 (Set of Sub-Formulas). Let ϕ ∈ L CPL , sub(ϕ) denotes the set of subformulas of ϕ, which is defined recursively, as follows:

sub(⊥) = {⊥} sub(p) = {p} sub(¬ϕ) = {¬ϕ} ∪ sub(ϕ) sub(ϕ • ψ) = {ϕ • ψ} ∪ sub(ϕ) ∪ sub(ψ)
where

• ∈ {→, ∧, ∨}
It is important for the complexity proof of the method to see that the number of elements of the set sub(ϕ) is proportional to the length of the formula ϕ. The latter is defined as follows.

Definition 2.13 (Length). The length of a formula ϕ ∈ L CPL is the natural number len(ϕ) defined recursively, as follows:

len(⊥) = 1 len(p) = 1 len(¬ϕ) = 1 + len(ϕ) len(ϕ • ψ) = 1 + len(ϕ) + len(ψ)
where

• ∈ {→, ∧, ∨}
It is easy to see that the number of elements of sub(ϕ) equals len(ϕ).

We can finally present the definition of a tableau for a CPL formula.

Definition 2.14 (Tableau). Let ϕ be a CPL formula. A tableau for ϕ is a non-empty set T ⊆ sub(ϕ) such that ϕ ∈ T and T satisfies the following conditions:

1. ⊥ ∈ T .

ϕ ∈ T if and only if

¬ϕ ∈ T . 3. if ¬¬ψ ∈ T then ψ ∈ T . 4. if ψ 1 ∧ ψ 2 ∈ T then ψ 1 ∈ T and ψ 2 ∈ T . 5. if ψ 1 ∨ ψ 2 ∈ T then ψ 1 ∈ T or ψ 2 ∈ T . Lemma 2.11. Let ϕ ∈ L CPL .
There is a tableau for ϕ if and only if ϕ is satisfiable.

To prove the implication from the right to the left of Lemma 2.11, we assume a satisfiable formula ϕ and show that there is an algorithm (Algorithm 2.1) that constructs a tableau T for it. To prove the implication from the left to the right, we assume a tableau T for ϕ. From T , we construct a Boolean valuation and, using an induction on the structure of ϕ, we conclude that this Boolean valuation satisfies ϕ.

The procedure described in Algorithm 2.1 tries to construct a tableau for the input formula ϕ. It starts with the singleton T = {ϕ} and decomposes ϕ by adding its subformulas to T , aiming at satisfying all conditions in Definition 2.14. For example, if (ψ 1 ∧ ψ 2 ) ∈ T , then it adds both ψ 1 and ψ 2 to T . (The implemented procedure also removes (ψ 1 ∧ ψ 2 ) from T to avoid performing this step again.) When the procedure input: The set T = {ϕ} output: true if ϕ is satisfiable, false otherwise

1 function tableau(T ) 2 if ⊥ ∈ T or {ψ, ¬ψ} ⊆ T then 3 return false 4 if ¬¬ψ ∈ T then 5 return tableau(T \ {¬¬ψ} ∪ {ψ}) 6 if (ψ 1 ∧ ψ 2 ) ∈ T then 7 return tableau(T \ {ψ 1 ∧ ψ 2 } ∪ {ψ 1 , ψ 2 }) 8 if (ψ 1 ∨ ψ 2 ) ∈ T then 9 return tableau(T \ {ψ 1 ∨ ψ 2 } ∪ {ψ 1 }) or tableau(T \ {ψ 1 ∨ ψ 2 } ∪ {ψ 2 })
10 return true Algorithm 2.1: Tableau method for classical propositional logic faces a choice, it branches. For example, if (ψ 1 ∨ ψ 2 ) ∈ T , then it creates two different tableaux T and T . It adds all elements of T plus ψ 1 to the first tableau T , and adds all elements of T plus ψ 2 to the second tableau T . (Again, it removes (ψ 1 ∨ ψ 2 ) from T to avoid repeating this step.) Eventually, the procedure reaches a state where either it violates one of the conditions in Definition 2.14, or the input formula ϕ has been completely decomposed. In the first case, it returns false, meaning that no Boolean valuation satisfying the formulas in the corresponding tableau T can be found. In the second case, it returns true, meaning that a Boolean valuation satisfying all formulas in T is possible.

For the branches where the procedure returns true, one can construct a Boolean valuation that satisfies ϕ, as follows. For all variables p that occur in ϕ, V (p) = 1 if p is in the branch, otherwise V (p) = 0. By using Lemma 2.11, one can show that such a valuation satisfies the input formula ϕ.

An example of the execution of Algorithm 2.1 is depicted in Figure 2.1. The recursive calls of function tableau() form the tree displayed in the figure. In the root of the tree, the tableau T only contains the input formula. In its child, it contains both conjuncts. In the subsequent step, the procedure creates two tableaux T and T , each one containing one of the disjuncts of the formula ¬p 0 ∨ p 1 . Tableau T contains two contradictory formulas, this is why this branch is stopped and closed, meaning that this branch can be discarded. The branch with tableau T also stops, but it does not contain contradictions. Therefore, one can create a Boolean valuation V that satisfies the input formula ϕ, as described before. Since both p 0 and p 1 are in T , we have V (p 0 ) = 1 and V (p 1 ) = 1.

Termination of the procedure is guaranteed by the finiteness of sub(ϕ). It is also not hard to show that the depth of the tree is bound by the size of sub(ϕ). Altogether, this means that we can show that the maximal number of steps executed by the procedure is bounded by a polynomial function on len(ϕ), when executed in a non-deterministic Turing machine. Therefore, the tableau method is optimal, with respect to complexity

T = {p 0 ∧ (¬p 0 ∨ p 1 )} T = {p 0 , (¬p 0 ∨ p 1 }) T = {p 0 , ¬p 0 } (closed) T = {p 0 , p 1 } Figure 2.1 -Execution of the tableau method for p 0 ∧ (¬p 0 ∨ p 1 )
class of the problem.

The CDCL Algorithm

The tableau method presented on the previous section is optimal, but it is not the most performant method. The most efficient software deciding satisfiability of CPL formulas available today are based on an algorithm called conflict driven clause learning (CDCL) [START_REF] Bayardo | Using CSP look-back techniques to solve real world SAT instances[END_REF]Marques-Silva andSakallah 1996, 1999). This algorithm uses several different techniques to speed up the process of finding a model for a formula. It is an evolution of the DPLL algorithm [START_REF] Davis | A Machine Program for Theorem Proving[END_REF][START_REF] Davis | A Computing Procedure for Quantification Theory[END_REF], where the main differences from the latter are (1) its conflict analysis, which prevents the algorithm from taking a decision that has shown to be a bad one on previous iterations; and [START_REF] Goldblatt | [END_REF] its capacity to perform non-chronological backtracks.

CDCL takes as input CPL formulas in a special format called conjunctive normal form. Thus, we need to define it first. Definition 2.15 (Literals, Clauses, Negation and Conjunctive Normal Forms). A literal is a propositional variable or a negation of a propositional variable.

A clause is a disjunction of literals.

A CPL formula ϕ is in negation normal form (NNF) if and only if the negations in ϕ appear only immediately in front of propositional variables.

A CPL formula is in conjunctive normal form (CNF) if and only if it is a conjunction of clauses.

Any formula ϕ ∈ L CPL can be translated into an equivalent formula in CNF. For example, the following formulas are not in CNF:

¬(p 0 ∧ p 1 ) ¬(p 0 ∨ p 1 ) ¬¬p 0 ¬(p 0 ∧ (¬p 1 ∨ p 2 ))
whereas the following ones are their equivalent in CNF:

¬p 0 ∨ ¬p 1 ¬p 0 ∧ ¬p 1 p 0 (¬p 0 ∨ p 1 ) ∧ (¬p 0 ∨ ¬p 2 )
Any formula ϕ ∈ L CPL can be translated into an equivalent formula in NNF in linear time and space [START_REF] Baaz | Normal Form Transformations[END_REF]. However, in general, the translation of a CPL formula into an equivalent one in CNF generates an exponentially larger formula. However, if we allow the introduction of new propositional variables, it is possible to generate an equisatisfiable formula in CNF such that its length is bound by a polynomial function on the length of the original formula. Moreover, the algorithm producing such formula runs in polynomial time [START_REF] Tseitin | On the Complexity of Derivation in Propositional Calculus[END_REF]. Therefore, it is safe to assume an algorithm that take formulas in CNF as input.

CDCL uses unit propagation. This is a technique that simplifies CNF formulas by using the following two properties of CPL.

Theorem 2.12 (Resolution [START_REF] Robinson | A Machine-Oriented Logic Based on the Resolution Principle[END_REF]

). Let ϕ, ψ, χ ∈ L CPL . We have {(ϕ ∨ ψ), (¬ϕ ∨ χ)} (ψ ∨ χ) Theorem 2.13. Let ϕ, ψ ∈ L CPL . {ϕ, (ϕ ∨ ψ)} ϕ.
Theorem 2.12 means that, if (ψ ∨ χ) is not satisfiable then (ϕ ∨ ψ) ∧ (¬ϕ ∨ χ) is also not satisfiable. Therefore, in order to decide satisfiability for the latter, it is enough to decide satisfiability for the former. Note that it is better to use the former formula, because it is smaller. Theorem 2.13 is analogous.

When the input formula ϕ has a unit clause (i.e., a clause with only one literal) this means that this literal must be assigned to true in the Boolean valuation that satisfies the entire formula. In other words, if the literal is a variable p then V (p) must be 1, and if the literal is a negation of a variable p then V (p) must be 0. Therefore, there is no decision to be taken with respect to this literal. Once this is done, we can propagate this information across the formula, hence the unit propagation.

Example 2.3. To see unit propagation in practice, consider the following CPL formula in CNF:

(p 0 ∨ p 1 ) ∧ (¬p 0 ∨ p 2 ) ∧ (¬p 2 ∨ p 3 ) ∧ p 0
We will propagate the unit clause p 0 . We have:

(p 0 ∨ p 1 ) ∧ (¬p 0 ∨ p 2 ) ∧ (¬p 2 ∨ p 3 ) ∧ p 0 1. (¬p 0 ∨ p 2 ) ∧ (¬p 2 ∨ p 3 ) ∧ p 0 2. p 2 ∧ (¬p 2 ∨ p 3 ) ∧ p 0 3.
Line 2 is obtained from Line 1 by removing the first conjunct (Theorem 2.13). Line 3 is obtained from Line 2 by removing the first conjunct again (Theorem 2.12). Note that we now have a new unit clause p 2 , which can be propagated. Thus, unit propagation continues. We have:

p 2 ∧ p 3 ∧ p 0 4.
which is obtained from Line 3 by removing the second conjunct (Theorem 2.12). Now, all clauses are unit, but there is no non-unit clauses to propagate. Unit propagation stops. Note that it is much easer to find a model for the formula on Line 4, than for the one on Line 1.

The second important technique used by CDCL is the conflict analysis. Once unit propagation stops, if there are still non-unit clauses, it is time to take decisions, i.e., we must arbitrarily assign a truth value to some variable and then check whether the Boolean valuation we are building still satisfies all the clauses. Sometimes, we take a decision and we find out that the Boolean valuation does not satisfy some clause. This is called conflict. Once a conflict is detected, CDCL does two things. First, it adds a new clause to the formula, which will prevent this conflict from happen again, this is called clause learning. Second, it tries to find the decision that most likely lead to the conflict and restart from there, i.e., it backtracks. The explanation of clause learning and backtrack techniques is involving. We do not explain them in detail here. For a through exposition, the reader can consult [START_REF] Marques-Silva | Conflict-Driven Clause Learning SAT Solvers[END_REF]). In the sequel we only explain roughly how clause learning works.

During its execution, CDCL builds a graph that contains the decisions taken and their consequences. When a conflict is detected, one can build, from this graph, a clause that contains information to prevent the same chain of decisions to be taken again. For example, consider the formula:

(¬p 4 ∨ ¬p 5 ) ∧ (p 21 ∨ ¬p 4 ∨ ¬p 6 ) ∧ (p 5 ∨ p 6 )
There are no unit clauses to propagate. So, CDCL must take some decisions. Suppose it makes the assignments V (p 21 ) = 0 and V (p 4 ) = 1. Once it is done, the formula can be simplified. We now have:

¬p 5 ∧ ¬p 6 ∧ (p 5 ∨ p 6 )
We now can apply unit propagation to ¬p 5 . We have:

p 6 ∧ ¬p 6
which is a conflict. This means that the same decisions should not be taken again. In this example, CDCL will learn the clause p 21 ∨ ¬p 4 , which is somewhat the contrary of what we have done in the beginning. This is added to the input formula and the algorithm backtracks. A different decision will be taken and maybe this time a model will be found.

We can now present the outline of CDCL in Algorithm 2.2. It starts by performing unit propagation. After that, CDCL chooses a variable, assigns a truth value to it and performs unit propagation again. If a conflict is detected, it is analysed, then clauses are learned, and then CDCL decides to which level it will perform the backtrack. The process repeats until a Boolean valuation satisfying the formula is found, in which case it returns 'true'. Otherwise, it returns 'false'.

We note that current implementations of CDCL bring together a number of additional improvements. Among them, we can mention:

• use of lazy data structures for the representation of formulas;

• periodically restarting backtrack search;

• deletion policies for learnt clauses (to avoid overflow the memory);

• etc. input: A CPL formula ϕ in CNNF and a Boolean valuation V output: true if ϕ is satisfiable, false otherwise

1 function cdcl(ϕ, V ) 2 if unit_propagation(ϕ, V ) = conflict then 3 return false 4 dl := 0 5 while not all_vars_assigned(ϕ, V ) do 6 (p, v) := pick_branching_variable(ϕ, V ) 7 dl := dl + 1 8 V := V ∪ {(p, v)} 9 if unit_propagation(ϕ, V ) = conflict then 10 β := conflict_analysis(ϕ, V ) 11 if β < 0 then

Belief Revision Theory

In Chapter 6, we propose a framework for modeling belief change in multi-agent scenarios. Therefore, we make a very brief introduction to belief revision here. For more information, the reader my consult, e.g., [START_REF] Gärdenfors | Knowledge in Flux: Modeling the Dynamics of Epistemic States[END_REF].

A simple way to represent agents beliefs is to use a set containing the sentences believed by the agent. This set is commonly called a belief set. The sentences in the belief set must be written in some language. We normally chose a formal language, because the meanings of such sentences as well as the relations among them can be defined more precisely. If we chose L CPL , a belief set is defined as follows.

Definition 2.16 (Belief Set). A belief set is a deductively closed set of formulas in CPL.

Let K be a consistent belief set. For any sentence ϕ ∈ L CPL , three different epistemic attitudes concerning ϕ can be expressed:

Accepted: ϕ ∈ K. Rejected: ¬ϕ ∈ K. Indetermined: ϕ ∈ K and ¬ϕ ∈ K.
When an agent changes her epistemic attitude concerning ϕ, this means that the agent goes from one of these attitudes to another. Therefore, there are in total six

Accepted

Indetermined Rejected Revision: ϕ goes either from accepted to rejected or it goes from rejected to accepted.

Expansion

The first type of attitude change is expansion. This can be seen as the event of the agent "learning" a new information that she was not aware of. For instance, suppose that ϕ is indetermined for the agent. An expansion by ϕ makes the agent accept that ϕ (and thus reject ¬ϕ). An expansion by ¬ϕ makes the agent reject ϕ (and thus accept ¬ϕ).

Note that the expansion of K by ϕ is not as simple as K ∪ {ϕ}. This is because the latter must also be a belief set, which means that it must be deductively closed. In other words, once ϕ is added to the belief set, all formulas that can be derived with this new addition must also be added to the resulting belief set. In the particular case where ϕ contradicts some formula already present in K, the contradiction ⊥ is added to the resulting belief set. In this case, the resulting belief set should be trivial, i.e., (K + ϕ) = L CPL .

For example, suppose that (p 0 → p 1 ) ∈ K. If we expand K by p 0 , then p 0 is added to K as well as p 1 . If it were the case that ¬p 1 ∈ K, then we have, as a result, K = L CPL .

Alchourrón, Gärdenfors and Makinson [START_REF] Alchourrón | On the logic of theory change: Partial meet contraction and revision functions[END_REF][START_REF] Gärdenfors | Knowledge in Flux: Modeling the Dynamics of Epistemic States[END_REF]) proposed postulates for the expansion, contraction and revision of belief sets. These postulates logically encode the constraints expected on the behaviour of such operators.

The postulates for expansion are the following. Let K be a belief set and ϕ ∈ L CPL .

K + ϕ is a belief set (closure) (K + 1) ϕ ∈ K + ϕ (success) (K + 2) K ⊆ K + ϕ (inclusion) (K + 3) If ϕ ∈ K then K + ϕ = K (vacuity) (K + 4) If K ⊆ K then K + ϕ ⊆ K + ϕ (monotony) (K + 5) K + ϕ is the smallest belief set satisfying (K + 1)-(K + 5) (minimality) (K + 6)
Postulate (K + 1) stipulates that the resulting of expanding a belief set is also a belief set. Postulate (K + 2) stipulates that ϕ will be accepted after expanding the belief set by ϕ. Postulate (K + 3) stipulates that nothing is lost with the addition of ϕ to the belief set. Postulate (K + 4) stipulates that K does not change if ϕ is already in K. For postulate (K + 5), assume that K contains more beliefs than K. In this case, there is no reason for the expansion of K by ϕ to contain more beliefs than the expansion of K by the same formula ϕ. Postulate (K + 6) stipulates that, as its name suggests, the change caused in K by the expansion of ϕ is minimal.

It turns out that there is only one expansion operator + satisfying these postulates. As stated by the result below.

Theorem 2.14 (Representation Theorem). The expansion function

+ satisfies (K + 1)- (K + 6) if and only if K + ϕ = Cn(K ∪ {ϕ}).
Theorem 2.14 is an important result. Not only the expansion operator + exists, but it is unique. In addition, it seems to be a very intuitive operation of simply adding a new formula to the belief set and then close it deductively.

Contraction

The second type of change is contraction. This can be seen as the event of the agent "forgetting" a piece of information. For example, suppose that the agent accepts ϕ (and thus rejects ¬ϕ). A contraction by ϕ makes both ϕ and ¬ϕ become for the agent indetermined, i.e., the agent is not sure of the truth value of ϕ anymore. Now, suppose the opposite, that the agent rejects ϕ (and thus she accepts ¬ϕ). In this case, a contraction by ¬ϕ makes ¬ϕ become indetermined for the agent.

Analogously as to expansion, the contraction of K by ϕ is not as simple as K \ {ϕ}. All formulas that "need" ϕ to be derived must also be removed from the resulting belief set. In addition, all formulas from which one can derive ϕ must also be removed. In the particular case where ϕ, its subtraction subtracts all formulas from the resulting belief set. In this case, the resulting belief set is (K -ϕ) = ∅.

For example, suppose that {p 0 , p 1 , (p 0 → p 1 )} ⊆ K. If we contract K by p 1 , then p 1 is removed from K which means that either p 0 or p 0 → p 1 must also be removed. Note that, as usual in contraction, in this case we have a choice.

The postulates for contraction are the following.

K -ϕ is a belief set (closure) (K -1) K -ϕ ⊆ K (inclusion) (K -2) If ϕ ∈ K then K -ϕ = K (vacuity) (K -3) If ϕ then ϕ ∈ K -ϕ (success) (K -4) If ϕ ∈ K then K ⊆ (K -ϕ) + ϕ (recovery) (K -5) If ϕ ↔ ψ then K -ϕ = K -ψ (extensionality) (K -6) K -ϕ ∩ K -ψ ⊆ K -(ϕ ∧ ψ) (intersection) (K -7) If ϕ ∈ K -(ϕ ∧ ψ) then K -(ϕ ∧ ψ) ⊆ K -ϕ (conjunction) (K -8)
As for expansion, the first postulate stipulates that the result of a contraction is a belief set. Postulate (K -2) stipulates that no new information should be added to K by a contraction. Postulate (K -3) stipulates that K should not be changed if ϕ does not belong to it. Postulate (K -4) stipulates that ϕ does not belong to the contraction by ϕ, unless it is valid. Postulate (K -5) stipulates that all beliefs in K are recovered if first contracting and then expanding again by the same formula. Postulate (K -6) stipulates that a contraction by an equivalent formula should give the same result. Postulates (K -7) and (K -8) deal with the contraction by a conjunction ϕ ∧ ψ. Without entering in too much detail, they stipulate that a choice between ϕ and ψ must be made, and what must be taken into account when making this choice.

Revision

The third type of change is revision. This can be seen as the event of the agent "changing her mind" about a piece of information. Suppose that the agent accepts ϕ and rejects ¬ϕ. A revision by ¬ϕ makes the agent accept ¬ϕ and reject ϕ. Analogously, if the agent accepts ¬ϕ and rejects ϕ, a revision by ϕ makes the agent accept ϕ and reject ¬ϕ.

Again, if we revise a belief set K by ϕ, it is not as simple as just add ϕ to the belief set. All formulas that are implied by ϕ must be added and also, all formulas that are implied by ¬ϕ must be removed.

The postulates for revision are the following.

K * ϕ is a belief set (closure) (K * 1) ϕ ∈ K * ϕ (success) (K * 2) K * ϕ ⊆ K + ϕ (inclusion) (K * 3) If ϕ ∈ K then K + ϕ ⊆ K * ϕ (vacuity) (K * 4) ⊥ ∈ K * ϕ if and only if ¬ϕ (coherence) (K * 5) If ϕ ↔ ψ then K * ϕ = K * ψ (extensionality) (K * 6) K * (ϕ ∧ ψ) ⊆ (K * ϕ) + ψ (conjunctive inclusion) (K * 7) If ¬ψ ∈ K * ϕ then (K * ϕ) + ψ ⊆ K * (ϕ ∧ ψ) (conjunctive vacuity) (K * 8)
Postulates (K * 1) and (K * 2) play the same role as for expansion and contraction. Postualtes (K * 3) and (K * 4) together stipulate that, when ¬ϕ ∈ K, the revision by ϕ is just an expansion. Postualte (K * 5) stipulates that a revision by ϕ trivialises only when ϕ is an inconsistent formula. Postulate (K * 6) stipulates that the revision operator should perform the same operation for equivalent formulas. Postulates (K * 7) and (K * 8) stipulate the behaviour of the revision operator with conjunctions.

The following definition and theorem confirm the intuition behind revision mentioned before and depicted in Figure 2.2, namely, that revision is a contraction followed by an expansion.

Definition 2.17 (Levi Identity (Levi 1977)). K * ϕ = (K -¬ϕ) + ϕ Theorem 2.15. If the contraction functionsatisfies (K -1)-(K -4) and (K -6) and the expansion + satisfy (K + 1)-(K + 6), then the revision function * obtained from Definition 2.17 satisfy (K * 1)-(K * 6).

Theorem 2.16. Suppose that the assumptions of Theorem 2.15 are fulfilled. Then we have:

1. If (K -7) is satisfied then the revision function * satisfies (K * 7). 2. If (K -8) is satisfied then the revision function * satisfies (K * 8).
Another important important result is given in the sequel. Definition 2.18 (Harper Identity (Harper 1976)). K -ϕ = K ∩ K * ¬ϕ Theorem 2.17. If the revision function * satisfies (K * 1)-(K * 6) then the contraction function obtained from Definition 2.18 satisfies (K -1)-(K -6).

Theorem 2.18. Suppose that the revision function satisfies (K * 1)-(K * 6), then:

1. If (K * 7) is satisfied then the revision function * satisfies (K -7).

2. If (K * 8) is satisfied then the revision function * satisfies (K -8).

Levi identy above shows that belief revision can be defined using contraction and expansion. This means that, when faced with a piece of information ϕ that contradicts her beliefs, the agent can contract by ¬ϕ and then expand by ϕ to integrate it.

Harper identity above shows us that a contraction by ϕ is an intersection with the revision by ¬ϕ.

Conclusion

In the first part of this chapter we saw a brief introduction to classical propositional logic. We saw its syntax and semantics, but also some basic definitions such as derivations, deductive closure, maximal consistent sets and an axiom system. In the second part, we saw the very basics of belief revision theory, the classical AGM postulates, Levi and Harper identities. This material will be useful on Chapter 6, when expansion and revision are be extended to multi-agent settings.

In the next chapter, we will see a brief introduction to modal logic, which will in turn be referred to in all subsequent chapters.

Chapter 3

Modal Logic

The logics used in this thesis are all modal logics. This is a family of logics that use modal operators to express a variety of notions, such as knowledge, belief, preference, obligation, action and time. In this work, we see several modal logics, such as epistemic logics, deontic logic, propositional dynamic logic, alternating-time temporal logic as well as some new ones. All of them follow the same principle: they extend classical propositional logic by some modal operators, which are used to express those different notions.

Because of this extensive use of modal logics, this chapter is dedicated to an introduction to modal logic. This introduction is, of course, not meant to be complete. The interested reader may find more on theses subjects by consulting very good textbooks, such as (Blackburn et al. 2007[START_REF] Blackburn | Modal Logic[END_REF][START_REF] Chellas | Modal Logic: an introduction[END_REF][START_REF] Hugues | A New Introduction to Modal Logic[END_REF]

introduction

Modal logic (ML) extends classical propositional logic, in the sense that it is used to represent and reason about modal propositions. For example, the sentence below is a modal proposition: it is possible that John teaches at the university.

In modal logic notation, this is represented by ♦p 0 . As before, p 0 represents the proposition 'John teaches at the university', but here, in addition, we have ♦ representing 'it is possible'. The symbol ♦ is used to qualify the truth value of the sentence. This is why it is called a modality, or a modal operator. The above modal proposition is true if and only if there is a situation (or, it is possible to imagine a situation) where p 0 is true. Note that its truth value does not depend on the actual truth value of the proposition p 0 . This is why modal logic is considered to be more expressive than classical propositional logic. Indeed, the meaning of operator ♦ cannot be expressed by any composition of CPL connectives. 1CPL operators are also allowed in modal logic. For example, the formula:

♦p 0 ∧ ♦¬p 1
is a well formed modal proposition meaning 'it is possible that John works at the university and it possible that John is an academic'. Another interesting example is the well formed modal proposition:

(3.1) ¬♦¬p 0 which means 'it is not possible that John does not teach at the university'. Following the intuitive meaning given before, this modal proposition is true if and only if there is no situation where p 0 is false. In other words, it is true if and only if p 0 is true in all (conceivable) situations. Hence, we conclude that it is equivalent to the sentence:

it is necessary that John teaches at the university.

The modality 'it is necessary' is also present in modal logic. It is expressed by the symbol . Indeed, in modal logic, the modal proposition:

(3.2) p 0 is equivalent to (3.1).

In the sequel, we present the formal definition of modal logic. We present only the group of modal logics called normal modal logics. These are modal logics based on the axiom system K (which is explained latter on this chapter). The other, non-normal, modal logics are also interesting, but we do not need to study them to understand the work presented in this thesis.

In order to be general, we present the definition of multi-modal logic. This is modal logic with several different modal operators. Each modal operator represents a different modality.

Maybe, the simplest way to understand this is to consider different agents (persons, robots, computers, etc.) having different "points of view". For example, for the first agent, which we call m 0 , John teaches at the univerisity, whereas for the second agent, which we call m 1 , John may not teach at the university. We have:

[m 0 ]p 0 ∧ m 1 ¬p 0
Here, [m 0 ] is a modal operator representing 'it is necessity for m 0 ', and m 1 is a modal operator representing 'it is possible for m 1 '. Then, this modal proposition means 'it is necessary for m 0 (the first agent) that John teaches at the university and it is possible for m 1 (the second agent) that John teaches at the university'.

Syntax

Syntax

Definition 3.1 (Vocabulary). A vocabulary is a pair P, M , where P is a countable (possibly infinite) set of propositional variables, and M is a finite set of modal contexts. Definition 3.2 (Formula). Let a vocabulary P, M be given. The language of modal logic, also called the set of modal logic formulas is noted L ML and is defined by the following grammar in Bakus-Nahur form:

ϕ ::= ⊥ | p | (ϕ → ϕ) | (ϕ ∧ ϕ) | (ϕ ∨ ϕ) | ([m]ϕ) | ( m ϕ)
where p is any variable from P, and m is any modal context from M.

We define the same abbreviations as for L CPL (Definition 2.1). In addition, we

sometimes use [m] n to abbreviate a sequence of n operators [m] (i.e., [m] 0 ϕ def = ϕ and [m] n+1 ϕ def = [m][m] n ϕ,
where n ≥ 0), and analogously for m . As for CPL, we sometimes omit outer parentheses for convenience.

When we use a language that has only one modal operator, we sometimes prefer to write modal formulas using and ♦, because they are more readable than their multimodal counterparts [m] and m . Thus, whenever formulas of the form ϕ and ♦ϕ are used, they mean, respectively, [m 0 ]ϕ and m 0 ϕ, and the set of modal contexts of the corresponding language is M = {m 0 }.

The formula [m]ϕ is read 'box m ϕ', and the formula m ϕ is read 'diamond m ϕ'. Their interpretations vary according to the application. One of the most classical applications of modal logic is the one seen in the beginning of this chapter. It is used to model sentences of the form 'it is necessary that ϕ' and 'it is possible that ϕ'. The operator [m] is then called the necessity operator and m is called the possibility operator.

We use the same definitions of literals, clauses and CNF for modal logic formulas (Definition 2.15). But note that, in general, formulas in L ML containing modal operators cannot be efficiently translated to formulas in CNF. 2The length of modal formulas is defined in the same way as for CPL formulas (Definition 2.13) plus:

3 len([m]ϕ) = len( m ϕ) = 1 + len(m) + len(ϕ)
The set of sub-formulas and negations of sub-formulas in ML is defined in the same way as for CPL (Definition 2.12) plus:

sub(•ϕ) = {•ϕ} ∪ sub(ϕ) where • ∈ {[m], m } Definition 3.3 (Modal Degree).
Let ϕ ∈ L ML , md(ϕ) denotes the modal degree of ϕ, which is defined recursively, as follows:

md( ) = md(p) = 0 md(¬ϕ) = md(ϕ) md(ϕ ∧ ψ) = md(ϕ ∨ ψ) = max(md(ϕ), md(ψ)) md([m]ϕ) = md( m ϕ) = 1 + md(ϕ)

Semantics

The semantics of normal modal logics is often defined using Kripke models (named after [START_REF] Kripke | A Completeness Theorem in Modal Logic[END_REF], who originally proposed it). They are formally defined as follows.

Definition 3.4 (Kripke model). Let a vocabulary P, M be given. A Kripke model is a triplet W, R, I , where:

• W is a non-empty set of possible worlds (sometimes called states, or situations);

• R : M → ℘(W × W ) associates an accessibility relation R(m) to each m ∈ M;

• I : P → ℘(W ) associates an interpretation I(p) to each p ∈ P.

The set of all Kripke models is noted K.

The size of a Kripke model M = W, R, I , which is the number of possible worlds in W , is noted |M |.

For some applications, it is more convenient to define valuations instead of interpretations. Kripke models defined in such way are triplets of the form W, R, V , where W and R are as in Definition 3.4 and we have:

• V : W → (P → {0, 1}
) associates a Boolean valuation to each w ∈ W .

Note that both definitions are equivalent. One can go from one to the other by letting:

V (w)(p) = 1, if w ∈ I(p) 0, otherwise
To simplify notation, we sometimes use R m instead of R(m) and, analogously, I p instead of I(p) and V w instead of V (w). We also sometimes use R m (w) to denote the set {w | (w, w ) ∈ R(m)}. Definition 3.5 (Pointed Kripke Model). A pointed Kripke model is a pair W, R, I , w , where W, R, I is a Kripke model and w is a distinguished possible world from W called actual world or root of the model.

P = {p 0 , p 1 } M = {m 0 } W = {w 0 , w 1 , w 2 } R m0 = {(w 0 , w 1 ), (w 0 , w 2 ), (w 1 , w 1 )} V w0 = ∅ V w1 = {p 0 } V w2 = {p 1 } p 0 p 1 w 0 p 0 p 1 w 1 p 0 p 1 w 2 Figure 3.1 -A Kripke model M, w 0
For convenience, sometimes we just drop one ' ', and use W, R, V, w to denote a pointed Kripke model. Also for convenience, we often use M, w , where M = W, R, I , to denote a pointed Kripke model.

Pointed Kripke models can be seen as a particular kind of graph. An example of a pointed Kripke model is given in Figure 3.1. We often use such pictures to show Kripke models in this thesis. For example, let M be the Kripke model in Figure 3.1, we have:

M, w p 0 M, w ¬p 1 M, w m 0 p 0 M, w [m 0 ]p 0 M, w m 0 (p 0 ∧ p 1 ) M, w [m 0 ](p 0 ∨ p 1 ) M, w m 0 [m 0 ]p 0 M, w [m 0 ] m 0 p 0 Let ϕ ∈ L ML .
♦ϕ ↔ ¬ ¬ϕ (definition of ♦) (Df♦) (ϕ → ψ) → ( ϕ → ψ) (distributivity) (K)
From ϕ and ϕ → ψ infer ψ (modus ponens) (RMP)

From ψ infer ψ (necessitation) (RN) When a pointed model M, w satisfies a formula ϕ ∈ L ML , we sometimes say that the pointed model is a model of ϕ. Definition 3.9 (Semantic Consequence). Let two formulas ϕ, ψ ∈ L ML be given. We say that ψ is a consequence of ϕ, noted ϕ ψ, if and only if, for all M, w such that M, w ϕ we have M, w ψ.

Axiom Systems of Modal Logic

There are several different modal logics. The simplest and one of the most common modal logic in the literature is called K. Its language is L ML , where the vocabulary contains only one modal context. Its axiom system is the one in Table 3.1.

The presence of principles (CPL) and (RMP) in the axiom system of K means that it is a conservative extension of CPL. In other words, the axiom system of K proves all CPL tautologies, including the additional tautologies that can be written using the operators and ♦. For example, p ∨ ¬ p is valid in K as well as p ∨ ¬p in CPL. The principle (Df♦) stipulates the duality between operators and ♦. It defines operator ♦ in terms of operator . This is the formal counterpart of the equivalence between formulas (3.1) and (3.2) seen before. This is also why, sometimes, the operator ♦ is defined as an abbreviation in modal logic (similarly to what we could have done with the connective ∨). Principle (K) is a kind of deductive closure for . It stipulates that, if ϕ necessarily implies ψ, then necessarily ϕ implies necessarily ψ. Principle (RN) stipulates that all valid formulas is necessarily true. This is intuitive, since necessarily true means true in all possible worlds.

As an example, let us see a derivation in the axiom system of K.

(ϕ 1 ∧ • • • ∧ ϕ n ) → ψ (hypothesis) 1. ϕ 1 → (• • • → (ϕ n → ψ)) (from 1 with CPL, RMP) 2. (ϕ 1 → (• • • → (ϕ n → ψ)))
(from 2 with RN) 3.

ϕ 1 → (• • • → (ϕ n → ψ))
(from 3 with K, CPL and RMP) 4.

. . .

ϕ 1 → (• • • → ( ϕ n → ψ)) (from n + 3 with K, CPL and RMP) n + 4. ( ϕ 1 ∧ • • • ∧ ϕ n ) → ψ (from n + 4 with K, CPL and RMP) n + 5.
The latter derivation shows that the rule (RK) below is is a valid infernece rule in K.

From (ϕ 1 ∧ • • • ∧ ϕ n ) → ψ infer ( ϕ 1 ∧ • • • ∧ ϕ n ) → ψ (general modal consequence) (RK)
Indeed, there is an alternative axiom system for K consisting of axioms (CPL), (Df♦), and the inference rules (RMP) (RK).

The reader may verify that (CPL) and axiom schemas (Df♦) and (K) are valid in logic K. In fact, Kripke models satisfy precisely the valid formulas in K or, in other words, the set of validities is determined by the class of models K, as shown below.

Theorem 3.2 (Soundness and Completeness of K). ϕ if and only if ϕ.

The implication from the left to the right is rather easy. It is proved by showing that all models in K satisfy all principles of K. In other words, we show that each axiom is valid in K and, for each inference rule, if its antecedent is valid in K so is its consequent.

The other direction is proved in four steps:

1. We define the canonical model M c = W c , R c , I c such that:

• W c is the set of all maximally consistent sets in K;

• For all w, w ∈ W, (w, w ) ∈ R c m if and only if {ϕ | [m]ϕ ∈ w} ⊆ w ; and

• I c p = {w | p ∈ w} 2.
We prove Lemma 1: The canonical model M c is a Kripke model.

3. We prove the Truth Lemma: M c ϕ if and only if ϕ ∈ K.

4. We have: if ϕ then M c ϕ, by Lemma 1. Then ϕ ∈ K, by the Truth Lemma.

We also note that modal logic K is strongly complete. This means the following.

Theorem 3.3. ϕ ψ if and only if ϕ ψ.

Other Modal Logics

Different modal logics can be defined using the axiom system of K plus one or more axiom schemas. The most common axiom schemas found in literature are the following:

ϕ → ♦ϕ (D) ϕ → ϕ (T) ϕ → ♦ϕ (B) ϕ → ϕ (4) ♦ϕ → ♦ϕ (5)
For example, the modal logic KT is the modal logic containing all principles of K plus the axiom schema T; the modal logic KD5 is K plus axiom schemas D and 5; the modal logic KD45 is K plus axiom schemas D, 4 and 5; etc.. More formally, we have the following. Definition 3.10 (Axiom System of Logic KX). Let X ⊆ {D, T, B, 4, 5}. The axiom system of modal logic KX consists of axiom schemas (CPL), (Df♦), (K) plus the ones in X, and the inference rules (RMP) and (RN).

It is interesting to note that, for instance, the set of validities of KT contains the validities of K. This is so because all formulas that can be derived using the axiom system of K can also be derived using the axiom system of KT. The same holds for all modal logics KX. It is even more interesting to note that some axiom schemas imply others. For example, axiom schema T implies axiom schema D. This means that KT contains KD. As another example, we have that axiom schemas K T and 5 together imply all the other ones, namely, B, D and 4. In fact, all combinations of these schemas give rise to 15 different axiom systems. Figure 3.2 presents the inclusions between them. Proofs for all these results can be found, for instance, in [START_REF] Chellas | Modal Logic: an introduction[END_REF].

Soundness and completeness for these logics are proved as for Theorem 3.2, but the set of Kripke models is different for each one of them. We delay this until Section 3.5, when we see the list of properties that correspond to the axiom schemas considered here.

Expressiveness

It turns out that modal logic is a fragment of first-order logic (FOL). Below, we see how to compute an equisatisfiable FOL formula from a ML formula. Definition 3.11 (Standard Translation). Assume:

• a denumerable set of variables {x, y, . . .},

• an unary predicate p for each propositional variable p ∈ P, and

• a binary predicate R m for each modality in M. Example 3.1. Just to be sure that we understood the principle, let us see a small example of translation:

str(ϕ → ψ, x) = str(ϕ, x) → str(ψ, x) str(ϕ ∧ ψ, x) = str(ϕ, x) ∧ str(ψ, x) str(ϕ ∨ ψ, x) = str(ϕ, x) ∧ str(ψ, x) str([m]ϕ, x) = ∀y(R m (x, y) → str(ϕ, y)) str( m ϕ, x) = ∃y(R m (x,
str(p 0 ∧ [m 0 ]p 0 ) = str(p 0 ∧ [m 0 ]p 0 , x) = str(p 0 , x) ∧ str([m 0 ]p 0 , x) = p 0 (x) ∧ ∀y(R m0 (x, y) → str(p 0 , y)) = p 0 (x) ∧ ∀y(R m0 (x, y) → p 0 (y))
This result is important for us. We will see, on Chapter 7, that we can speed up reasoning on modal logic by adapting this translation to a translation to CPL, and then giving the resulting formula to a SAT solver.

This result is also very important for the field of modal logics itself. This is how modal logics have "inherited for free" various properties of FOL, such as compactness and semi-decidability. But some FOL properties are not the same in ML. One of the most important is called invariance. Theorem 3.5. If f is an isomorphism between first-order logic models M and M then for each first-order formula ϕ(x 1 , . . . , x k ), and each matching tuple of objects o 1 , . . . , o k in M we have that:

M ϕ[o 1 , . . . o k ] if and only if M ϕ[f (o 1 ), . . . f (o k )]
The converse is also true for finite models.

In other words, two FOL models satisfy the same set of formulas if and only if they are isomorphic. It is a curious fact that this does not transfer to modal logic. To see it, first consider the definition of isomorphic Kripke models. Definition 3.12 (Isomorphism). Let M = W, R, V and M = W , R , V be two Kripke models. An isomorphism between M and M is a bijection f : W → W such that:

M : w 0 p 0 M : w 0 p 0 w 1 p 0 Figure 3.3 -Equivalent, but not isomorphic, Kripke models • (w, v) ∈ R iff (f (w), f (v)) ∈ R; • w ∈ V (p) iff f (w) ∈ V (p).
Theorem 3.6. Let f be an isomorphism between two Kripke models M and M . For all formulas ϕ ∈ L ML and all worlds w ∈ W , we have that M, w ϕ if and only if M , f (w) ϕ.

However, the converse of Theorem 3.6 is not true. We can see that by analysing the two models in Figure 3.3. It is not possible to find a modal logic formula that is true in one of them and false in the other one. Nonetheless, they are clearly not isomorphic.

Therefore, modal logics do not distinguish all non-isomorphic models. This means that they are strictly less expressive than FOL. In fact, modal logic invariance comes in a different flavor than in FOL. Actually, ML cannot distinguish bisimilar models. Let us see the formal definition. Definition 3.13 (Bisimulation). Let M = W, R, V and M = W , R , V be two Kripke models. A bisimulation between M and M is a binary relation B ⊆ W × W such that for all (w 0 , w 0 ) ∈ B we have:

Atomic harmony: M, w 0 p if and only if M , w 0 p;

Zig: if (w 0 , w 1 ) ∈ R m then there exists w 1 ∈ W such that (w 1 , w 1 ) ∈ B and (w 0 , w 1 ) ∈ R m ;

Zag: if (w 0 , w 1 ) ∈ R m then there exists w 1 ∈ W such that (w 1 , w 1 ) ∈ B and (w 0 , w 1 ) ∈ R m .

Definition 3.14 (Bisimilarity). Two pointed Kripke models are bisimilar, which is noted M, w M , w , if and only if there is a bisimulation B between M and M such that (w, w ) ∈ B.

The two Kripke models in Figure 3.3 are examples of bisimilar Kripke models that are not isomorphic. The reader may verify that the relation B = {(w 0 , w 0 ), (w 0 , w 1 )} is a bisimulation between M and M . Bisimulation is therefore a key concept in modal logics. We use it a couple of times in this thesis, whenever we need to show that two Kripke models are equivalent. This happens, for instance, in Chapter 6 where we need to show that two different ways of revising an epistemic model result in the same (up to bisimulation) model.

Bisimulation also plays an important role on the comprehension of another key concept in modal logics called correspondence theory [START_REF] Van Benthem | Correspondence Theory[END_REF]. Recall that we saw the definition of several different logics in Section 3.4.1. Each one of those logics "corresponds" to a particular class of Kripke models. This result is captured by the next theorem.

Theorem 3.9 (First-order Definability [START_REF] Lemmon | The Lemmon Notes: An Introduction to Modal Logic[END_REF]). Let the logic L be defined by (CPL), (Df♦), (K), (RMP), (RN) and a set A of axiom schemas of the form:

(G i,j,k, ) m i [m] j ϕ → [m] k m ϕ (i, j, k, ≥ 0)
L is determined by the class of Kripke models satisfying a condition:

(C i,j,k, ) ∀x∀y∀z((R i m (x, y) ∧ R k m (x, z)) → ∃v(R j m (y, v) ∧ R m (z, v)))
for each axiom schema in A.

Corollary 3.10.

1. Axiom schema (D) = G 0,1,0,1 = [m]ϕ → m ϕ corresponds to seriality, i.e.: 5 ∀x∀y∀z((R 0 m (x, y) ∧ R 0 m (x, z)) → ∃v(R 1 m (y, v) ∧ R 1 m (z, v))) ≡ ∀y∃v(R m (y, v))
2. Axiom schema (T) = G 0,1,0,0 = [m]ϕ → ϕ corresponds to reflexivity, i.e.:

∀x∀y∀z((R 0 m (x, y) ∧ R 0 m (x, z)) → ∃v(R 1 m (y, v) ∧ R 0 m (z, v))) ≡ ∀x(R m (x, x)) 3. Axiom schema (B) = G 0,0,1,1 = ϕ → [m] m ϕ corresponds to symmetry, i.e.: ∀x∀y∀z((R 0 m (x, y) ∧ R 1 m (x, z)) → ∃v(R 0 m (y, v) ∧ R 1 m (z, v))) ≡ ∀x∀z(R m (x, z) → (R m (z, x))) 4. Axiom schema (4) = G 0,1,2,0 = [m]ϕ → [m][m]ϕ corresponds to transitivity, i.e.: ∀x∀y∀z((R 0 m (x, y) ∧ R 2 m (x, z)) → ∃v(R 1 m (y, v) ∧ R 0 m (z, v))) ≡ ∀x∀z(R 2 m (x, z) → R m (x, z)) 5. Axiom schema (5) = G 1,0,1,1 = m ϕ → [m] m ϕ corresponds to Euclideanity: ∀x∀y∀z((R 1 m (x, y) ∧ R 1 m (x, z)) → ∃v(R 0 m (y, v) ∧ R 1 m (z, v))) ≡ ∀x∀y∀z((R m (x, y) ∧ R m (x, z)) → R m (z, y))

Schema

First-Order Property

(K) [m](ϕ → ψ) → ([m]ϕ → [m]ψ) None (T) [m]ϕ → ϕ Reflexivity (B) ϕ → [m] m ϕ Symmetry (D) [m]ϕ → m ϕ Seriality (4) [m]ϕ → [m][m]ϕ Transitivity (5) m ϕ → [m] m ϕ Euclideanity Table 3.

-Axiom schemas and their corresponding structural properties

We summarise all results from Corollary 3.10 in Table 3.2.

Lemmon and Scott's result has been generalised further by [START_REF] Sahlqvist | Completeness and Correspondence in the First and Second Order Semantics for Modal Logic[END_REF].

Definition 3.15 (Salhqvist Formula). A Sahlqvist formula is a formula of the form

m n (ϕ → ψ)
where n ≥ 0 and ϕ and ψ satisfy the following conditions:

1. no operators occur in ϕ except m , [m], ∨, ∧ and ¬;

2. operator ¬ occurs only immediately before a variable in ϕ;

3. no occurrence of [m], ∨ or ∧ lies within the scope of any m in ϕ;

4. no operators occur in ϕ except m , [m], ∨ and ∧ (¬ is not permitted).

Theorem 3.11 (Sahlqvist Theorem (Sahlqvist 1975)). There is an effective method for computing first-order equivalents for Sahlqvist formulas.

Computational Complexity

It is a known fact that model checking in normal modal logics can be computed in O(n), where n is the length of the formula given as input. The algorithm performing such a task (Algorithm 3.1) is the most obvious implementation of Definition 3.6. Note, however, that this assumes an explicit representation of the Kripke model given as input.

If a more clever representation of the Kripke model is used, the complexity of model checking may be higher. But this task is never more complex than satisfiability checking, which has been proved to be PSACE-Complete for most modal logics and NP-Complete in the case of KT5. PSPACE-Hardness for satisfiability checking in K, KT and KT4, as well as NP-Completeness for KT5 has been proved in a famous paper by [START_REF] Ladner | The Computational Complexity of Provability in Systems of Modal Propositional Logic[END_REF]. In another [START_REF] Halpern | A guide to completeness and complexity for modal logics of knowledge and belief[END_REF] extended those results for the multi-modal versions of those logics plus KD45 and also studied the addition of distributed and common knowledge operators. NP-Completeness of satisfiability checking has been proved for all mono-modal logics with axiom (5) by Halpern and Rêgo (2007a,b). Here, we see a brief summary of the results that are interesting for us in this thesis.

The proof sketch of the next theorem gives us a fairly easy way to show that all modal logics we have seen in this chapter are decidable. The technique used is called filtration. It mainly shows that there is a finite model for every satisfiable formula, and also presents the maximum size of such a model. We also use this technique to prove decidability of the logics presented in chapters 4 and 5.

Theorem 3.12. If ϕ is satisfiable, then there is a Kripke model containing at most 2 | sub(ϕ)| possible worlds satisfying it, where sub(ϕ) is the set of sub-formulas of ϕ.

Proof Sketch. Let M = W, R, I be a Kripke model satisfying ϕ. First, we build equivalence classes of possible worlds. Two possible worlds w and w are in the same class (noted w ≡ w ) if and only if:

for all ψ ∈ sub(ϕ) we have that M, w ψ iff M, w ψ Now, let the equivalence class of a possible world w be [w] = {w | w ≡ w }. The filtration of M by the formula ϕ is a Kripke model M f = W f , R f , I f
, where:

• W f = {[w] | w ∈ W } • R f ([w 0 ], [w 1 ]) iff there exists w 0 ∈ [w],
and

w 1 ∈ [w 1 ] such that R(w 0 , w 1 ) • I f (p) = {[w] | M,

w p}

Note that there cannot be more than 2 | sub(ϕ)| worlds in M f , because this is the number of ways possible worlds can disagree, with respect to ϕ.

The next thing we must do is to show that, for all ψ ∈ sub(ϕ), M, w

ψ iff M f , [w]
ψ. This is be done by an easy induction on the structure of ψ. In the induction base, we have ψ = p for some p

∈ P. M, w p iff [w] ∈ I f (p) (by the definition of I f ) iff M f , [w]
p. There are five cases on the induction step, one for each Boolean connective and modal operator in the language. The cases for the Boolean connectives are straightforward. For the modal operator , let ψ = χ. M, w χ iff, for all w ∈ R(w), we have M, w χ. The latter is true iff, for all w ∈ [w ], we have M, w χ (by the definition of [w ]). We also have that (

[w], [w ]) ∈ R f (by the definition of R f ). Therefore, we have that the former is true iff, for all [w ] ∈ R([w]) we have M f , [w ] χ, iff M f , [w]
χ. The induction step for the modal operator ♦ is analogous.

From Theorem 3.12, we obtain the so-called finite model property for the modal logics we have seen here. This, together with some properties of their axiom system, gives us decidability of satisfiability checking. Theorem 3.13. Satisfibility checking in all modal logics of Figure 3.2 are decidable. The procedure described in the proof sketch of Theorem 3.13 is far from optimal. Optmial procedures for deciding satisfiability of modal formulas can be found, for instance, in [START_REF] Goré | Tableau Methods for Modal and Temporal Logics[END_REF]. The methods proposed therein are tableau methods. Their optimality rely in the following results.

n = 1 n > 1 K n KT n KT4 n PSPACE-Complete PSPACE-Complete K * 5 n NP-Complete PSPACE-Complete
• W | w,n = {w} ∪ {w | R ≤n (w, w )} • R| w,n = R ∩ W | w,n • I| w,n = I ∩ W | w,n Then, for all ϕ ∈ L ML , if md(ϕ) ≤ n then, M, w ϕ if and only if M | w,n , w ϕ.
The tableau methods for modal logics expoits Lemma 3.14 and also the fact that | sub(ϕ)| ≤ len(ϕ). They explore the Kripke model for ϕ branch by branch, without having to put it entirely on the memory. The result is a method that is exponential in time but polynomial is space.

Theorem 3.15. Every formula ϕ in L is satisfiable in a model based on a finite tree of depth at most md(ϕ).

Corollary 3.16. Satisfiability checking in K is in PSPACE.

The result above, with some clever adjustments, can be extended to all modal logics we have seen. We summarize computational complexity in Table 3.3.

In Section 7.2, we use a tableau to show the adequacy of a new method for satisfiability checking in KT5. We therefore take a look on tableau methods for modal logic here. First, we need to define a tableau for a modal logic formula. The definition below defines tableau for the modal logic K. It is an extension of the tableau for a CPL formula that we saw in Definition 2.14. Definition 3.16 (ML Tableau). Let ϕ ∈ L ML . A tableau for ϕ is a set T of pairs of the form (σ, ϕ). The first element of the pair is called label. It is a (possibly empty) sequence of natural numbers and modalities from M. The second element of the pair is a formula ψ ∈ sub(ϕ). In addition, we have that (0, ϕ) ∈ T and, for all sequences σ, T satisfies the following conditions:

1. (σ, ¬ ) ∈ T . 2. (σ, ψ) ∈ T if and only if (σ¬ψ) ∈ T . 3. if (σ, ¬¬ψ) ∈ T then (σ, ψ) ∈ T . 4. if (σ, ψ 1 ∧ ψ 2 ) ∈ T then (σ, ψ 1 ) ∈ T and (σ, ψ 2 ) ∈ T . 5. if (σ, ψ 1 ∨ ψ 2 ) ∈ T then (σ, ψ 1 ) ∈ T or (σ, ψ 2 ) ∈ T . 6. if (σ, [m]ψ) ∈ T then, for all (σmi, χ) ∈ T , we have (σmi, ψ) ∈ T . 7. if (σ, m ψ) ∈ T then (σmi, ψ) ∈ T , for some i ∈ N.
The tableau method is presented in Algorithm 3.2. As for CPL, it starts with the singleton T = {(0, ϕ)} and decomposes ϕ by adding its sub-formulas to T , aiming at satisfying all conditions in Definition 3.16. Here though, it also handles a set of labels σ, which represent the possible worlds in the model being constructed for ϕ. For example, if the pair (σ, m ϕ) is in T , then the method choses a fresh (not yet present in T ) natural number i and adds (σmi, ϕ) to T . This means that, whenever m ϕ is true in the possible world σ then there exists a possible world σmi where ψ is true. A dual condition handles the operator [m]. The initial sequence 0 represents the actual world in the model.

As for the CPL tableau method, for the branches where Algorithm 3.2 returns true, one can construt a Kripke model M , where:

• W = {i | (σi, χ) ∈ T }, for some χ. • R m = {(i, j) | (σimj, χ) ∈ T }, for some χ. • V (p) = {i | (σi, p) ∈ T }
An easy induction on the structure of ϕ shows that M, 0

ϕ. An exemple of the execution of Algorthm 3.2 in a modal logic K with only one modality is shown in Figure 3.4. The closed left branch is discarded, but a model M, 0 satisfaying ϕ can be build from the right branch of the tree. We have M = W, R, V , where:

W = {0, 1}, R m0 = {(0, 1)}, V p = {1} and V q = {1}.
Additional conditions must be added to Definition 3.16 for the other modal logics in Figure 3.2. For instance, modal logic KT4 has the following conditions added:

input: The set T = {ϕ} output: true if ϕ is satisfiable, false otherwise function mltableau(T ) if (σ, ⊥) ∈ T or {(σ, ϕ), (σ, ¬ϕ)} ⊆ T then return false if (σ, ¬¬ψ) ∈ T then return mltableau(T \ {(σ, ¬¬ψ)} ∪ {(σ, ψ)}) if (σ, ψ 1 ∧ ψ 2 ) ∈ T then return mltableau(T \ {(σ, ψ 1 ∧ ψ 2 )} ∪ {(σ, ψ 1 ), (σ, ψ 2 )}) if (σ, ψ 1 ∨ ψ 2 ) ∈ T then return mltableau(T \ {(σ, ψ 1 ∨ ψ 2 )} ∪ {(σ, ψ 1 )}) or mltableau(T \ {(σ, ψ 1 ∨ ψ 2 )} ∪ {(σ, ψ 2 )}) if {(σ, [m]ψ), (σmi, χ)} ∈ T and (σmi, ψ) ∈ T then return mltableau(T ∪ {(σmi, ψ)}) if (σ, m ψ) ∈ T then return mltableau(T \ {(σ, m ψ)} ∪ {(σmi, ψ)}) Algorithm 3.2: Tableau Method for Modal Logic T = {(0, p ∧ (¬ p ∨ ♦q))} T = {(0, p), (0, ¬ p ∨ ♦q)} T = {(0, p), (0, ¬ p)} (closed) T = {(0, p), (0, ♦q)} T = {(0, p), (0, ♦q), (0m1, q)} T = {(0, p), (0m1, q), (0m1, p)} Figure 3.4 -Execution of the tableau method for p ∧ (¬ p ∨ ♦q) • If (σ, [m]ϕ) ∈ T then (σ, ϕ) ∈ T • If (σ, [m]ϕ) ∈ T then (σ, [m][m]ϕ) ∈ T
The first condition corresponds to the addition of axiom schema (T) to the logic, whereas the second condition corresponds to axiom schema (4). The corresponding tableau method must also handle these two additional conditions. 6 The reader can consult [START_REF] Goré | Tableau Methods for Modal and Temporal Logics[END_REF]) for more details. For the logic KT5, the method can actually be simplified.

We will see that latter, on Section 7.2.

Some Applications of Modal Logic

Epistemic Logic

In the next three chapters of this thesis, we will build formalisms to model, among other things, agents knowledge and beliefs. This will be done using ideas from epistemic logics. Therefore, it seems sensible to see a small introduction of these modal logics here. This introduction is very brief. The interested reader may consult, e.g., (van Ditmarsch et al. 2015;[START_REF] Fagin | Reasoning about Knowledge[END_REF][START_REF] Meyer | Epistemic Logic for AI and Computer Science[END_REF] for more details.

The birth of epistemic logics (EL) is usually attributed to [START_REF] Hintikka | Knowledge and Belief: An Introduction to the Logic of the Two Notions[END_REF]. These formalisms use possible worlds semantics to model knowledge and belief. Using the very same words of [START_REF] Halpern | A guide to completeness and complexity for modal logics of knowledge and belief[END_REF]: "the essential idea behind possible worlds semantics is that an agent's state of knowledge [or belief] corresponds to the extent to which he can determine what world he is in". Let a possible world be given, we associate, to each agent, a set of possible worlds that the gent considers it possible that she is in.

As we can see, this idea can be easily captured in modal logic, as follows. Let the vocabulary of epistemic logic be P, A , where:

• P = {p 0 , p 1 , . . .} is a non-empty set of propositional variables; and

• A = {1, 2, . . . , |A|} is a finite set of modalities representing the agents in the environment.

The environment itself is represented by an epistemic model of knowledge, which is a Kripke model M = W, R, I , where W and I are as in Definition 3.4 and:

• R : A → (W × W ) is a function that associates a reflexive and Euclidean indistinguishability relation to each agent i ∈ A;

We have that, if the agent i is in the possible world w, all elements in R i (w) are indistinguishable from w for i.

The language of the epistemic logic of knowledge is L ML , where the modal box operators are noted K i , instead of [m], just to recall that they mean knowledge. 7 Formulas of the form K i ϕ are read 'agent i knows that ϕ'. We sometimes use L EL to refer to the language of epistemic logic.

The constraints imposed on each R i imply that the axiom system of epistemic logic of knowledge is the one in Table 3.1 plus the following two (recall Table 3.2):

K i ϕ → ϕ (knowledge) (T) ¬K i ϕ → K i ¬K i ϕ (negative introspection) (5)
In other words, epistemic logic of knowledge is KT5 n (which is also commonly known as S5 n ).

The semantics above is explicitly chosen to validate these axiom schemas. Axiom schema (T) stipulates that, if an agent knows that ϕ, then ϕ is true. This means that one cannot know something that is false, which is commonly considered to be the difference between knowledge and belief. Axiom schema (5) stipulates that, if an agent does not know that ϕ, then the agent knows that she does not know that ϕ.

It is also interesting to recall that the axiom system above validates the following (see Figure 3.2):

¬K i ⊥ (consistency) (D) K i ϕ → K i K i ϕ (positive introspection) (4)
Axiom schema (D) stipulates that an agent does not know inconsistent facts. Axiom schema (4) stipulates that, if an agent knows that ϕ, then the agent knows that she knows that ϕ.

Example 3.2 (The Light Bulb). As an example, let us imagine a closed room with a light bulb that is on. The state of the light is represented by the propositional variable light, which is true if and only if the light is on. Alice (agent 1) is inside the room and thus can see that the light is on. Betty (agent 2) is outside the room and thus cannot see the state of the light. Both agents know the location of each other. This environment can be represented by the epistemic model in Figure 3.5.

Alice can see the state of the light, which means that she can distinguish between w 0 and w 1 . This is why worlds w 0 and w 1 are separated in the indistinguishability relation of Alice R 1 . Betty, on the other hand, does not see the light bulb. This is why both worlds w 0 and w 1 are related in her indistinguishability relation R 2 . Also note that it is indeed an epistemic model of knowledge, since both relations in R are equivalence relations.

In the actual world, the light is on. We have that M, w 0 light. In addition, Alice knows that the light is on. We have that M, w 0 K 1 light. Betty, does not know it, i.e., M, w 0 ¬K 2 light. In fact, Betty does not know the state of the light. She does not know whether it is on or off, i.e., M, w 0 ¬K 2 light ∧ ¬K 2 ¬light. Both agents know the location of each other. Therefore, Alice must know that Betty does not know the state of the light. Indeed, we have M, w 0 K 1 (¬K 2 light ∧ ¬K 2 ¬light). We also have that Betty knows the location of Alice and thus knows that Alice knows the state of the light. Indeed, we also have M, w 0 K 2 (K 1 light∨K 1 ¬light). Finally, note that Betty does not know that Alice knows that the light is on, i.e., M, w 0 ¬K 2 K 1 light, nor that the light is off, i.e., M, w 0 ¬K 2 K 1 ¬light. As before, we have that, if the agent i is in the possible world w, then all elements in R i (w) are indistinguishable from w for i.

The language of the epistemic logic of belief is L ML , where the modal box operators are noted B i , instead of [m], just to recall that they mean belief. Formulas of the form B i ϕ are read 'agent i believes that ϕ'.

The constraints imposed on each R i imply that axiom system of epistemic logic of belief is the one in Table 3.1 plus the following (again, recall Table 3.2):

¬B i ⊥ (consistency) (D) B i ϕ → B i B i ϕ (positive introspection) (4) ¬B i ϕ → B i ¬B i ϕ (negative introspection) (5)
In other words, the epistemic logic of belief is KD45 n .

As for knowledge, the semantics of belief is chosen to validate these axiom schemas. Axiom schema (D) stipulates that an agent does not belief in inconsistent facts. Axiom schema (4) stipulates that, if an agent believes ϕ, then she believes that she believes ϕ. And finally, axiom schema (5) stipulates that, if an agent does not believe ϕ, then she believes that she does not believe ϕ.

Example 3.3 (The Light Bulb Revisited). Let us imagine again the environment of Example 3.2. But, now Alice leaves the room without telling Betty. The state of the light inside the room may have changed, so Alice does not know if it is on or off anymore. Betty still thinks that Alice is inside the room. This can be modeled with the epistemic model in Figure 3.6.

Alice does not know the state of the light. This is why she cannot distinguish between w 0 and w 1 . The situation for Betty is different. In the actual world w 0 , she thinks that Alice is in the room. Therefore, in w 0 Betty thinks that she is either in w 2 or in w 3 , where Alice can distinguish between the states where the light is on and off. Note that the model satisfies all the required constraints for each indistinguishability relation R i .

light w 0 light w 1 light w 2 light w 3 1 1 1 2 2 2 2 2 1, 2 1, 2 Figure 3.6 -An epistemic model of belief
In the actual world the light is still on, thus we have that M, w 0 light. Alice cannot be sure of the state of the light anymore. Thus Alice does not believe it, i.e., M, w 0 ¬B 1 light. In fact, Alice now has two possibilities, either the light is on or off, i.e., M, w 0 B 1 (light ∨ ¬light). Betty still believes that Alice is sure about the state of the light. That is, M, w 0 B 2 (B 1 light ∨ B 1 ¬light). Alice did not tell Betty that she left the room. Thus Alice believes that Betty still believes that she is sure of the state of the light, i.e., M, w 0

B 1 B 2 (B 1 light ∨ B 1 ¬light).
A complete exposition of epistemic knowledge usually also presents operators modeling group knowledge, distributed knowledge and common knowledge. To keep this introduction brief, we do not present them here (but we do introduce a group knowledge operator in Chapter 4). Many extensions of epistemic logic exist. Operators modelling agents abilities, actions and time are among them. For a survey of such extensions, the reader may consult (van Ditmarsch et al. 2015).

Dynamic Epistemic Logic

One of the extensions of epistemic logic is dynamic epistemic logic (DEL), originally proposed by [START_REF] Baltag | Logics for Epistemic Programs[END_REF] and [START_REF] Baltag | The logic of common knowledge, public announcements and private suspicions[END_REF]. We will meet this logic on chapters 5 and 6. This is why we make a very brief introduction here. For more information, please consult (van Ditmarsch, van der Hoek, et al. 2007).

Dynamic epistemic logic extends EL with operators aiming at modelling the dynamics of knowledge. It adds to EL operators of the form [e]ϕ, where e is a possible event. A formula of the form [e]ϕ is read 'after every possible occurrence of e it is the case that ϕ'.

DEL defines a structure called event model containing all possible events which may modify the knowledge of the agents. 8 Definition 3.17 (Event Model). Let a vocabulary P, A be given. An event model is a structure N = E, P, pre, post , where:

• E is a set of possible events;

• P : A → (E × E) is a function that associates an indistinguishability relation to each agent i ∈ A.
• pre : E → L EL is a function that associates a pre-condition ϕ ∈ L EL to each event e ∈ E.

• post : E → (P → L EL ) is a function that associates a partial post-condition function post(e) to each event e ∈ E.

Therefore, an event model is a special kind of epistemic model. it has possible events instead of possible worlds, indistinguishability relations between events, instead of between worlds and it has pre-and post-conditions for events instead of interpretations.

An example of event model is depicted in Figure 3.7a. In that picture, agent 1 can distinguish between e 0 and e 1 , while agent 2 cannot. This means that, if e 0 is the actual event occurring, then agent 1 is able to know that it is occurring, whereas agent 2 cannot make that distinction. Each event in the picture contains a pair (pre, post) representing its pre-and post-condition, respectively. For instance, the pre-condition of e 0 is light while its post-condition is ∅, meaning that this event occurs only if light is true and that it does produce any factual change.

The occurrence of an event e in a pointed epistemic model M, w , changes the pointed epistemic model. The result is a new pointed epistemic model, which is obtained from the product between the epistemic model and the event model, defined as follows.

Definition 3.18 (Model Product). The product between an epistemic model M = W, R, I and an event model N = E, P, pre, post is a new epistemic model M.N = W N , R N , I N , where:

• W N = {w.e | M, w pre(e)} • R N i = {(w.e, w .e ) | (w, w ) ∈ R i and (e, e ) ∈ P i } • I N p = {w.e | M, w post(e)(p)}, if post(e)(p) is defined I p , otherwise
Intuitively, the product between M and N is a Kripke model M.N where each of its possible worlds w.e is a combination of a possible world w of M and a possible event e of N , provided that the pre-condition of e is true at w. The indistinguishability relation of the resulting model is calculated using the relations in M and N . The interpretations in the resulting model are calculated using the post-conditions post in N . Now, suppose that Alice enters the room. Alice observes the state of the light, Betty knows that Alice observes the state of the light, but she does not know if Alice observes that the light is on or off. This is modeled by the event model in Figure 3.7a.

It is important to grasp the idea that the pre-condition of an event can also be seen as the observation made by the agents when this is the actual event occurring. Indeed, agents cannot observe that ϕ is true, if ϕ is actually false. This is why it is a pre-condition.

In the model in Figure 3.7a, we have that the pre-condition of e 0 is light, meaning that, when this event occurs, the agents observe that the light is on on the room. The pre-condition of e 1 is ¬light, meaning that, when this event occurs, the agents observe that the light is off in the room. Therefore, we have that Betty does not observe the state of the light, but she does observe that Alice observes it.

The resulting model is depicted in Figure 3.7c. Note that it is bisimilar to the model in Figure 3.5.

Event models and updates are a powerful tool. The number of different events that can be modeled is huge (it is infinite, actually). For instance, we will see in Chapter 6 that we use this to model belief expansion and belief revision.

There are some limitations nonetheless. Note that the indistinguishability relations P i in the event model of Example 3.4 are all equivalence relations. This is necessary. If relations P i are not equivalence relations, the result of the product may not be a KT5 n model. There are similar restrictions must be made when working with KD45 n models.

w 0 p 0 p 0 , p 1 . . . m 0 m 0 m 0 m 0 Figure 3.8 -A temporal model

More applications

In fact, modal logics have a huge number of applications. We could keep listing them for a long time. In this section, we just briefly mention two more. The model in Figure 3.8 represents a temporal model, as in the modal logic called linear temporal logic (LTL). In this logic, possible worlds are seen as instants in time. Assume that we define R(t) as the transitive closure of R(m 0 ). We have that the modal operator t means 'eventually' and the operator [t] means 'always'. For example, M, w 0 t (p 0 ∧ p 1 ), meaning that (p 0 ∧ p 1 ) is 'eventually' true in the future, and M, w 0

[t]p 0 means that p 0 is not 'always' true in the future.

w 0 p 0 p 1 a a b b Figure 3.9 -A dynamic model
Another application that interests us in this thesis is the one exemplified in Figure 3.9. This is a model of propositional dynamic logic (PDL). In this formalism, possible worlds are states and the relations are state transitions. For example, M, w 0 p 0 ∧ [a][b]p 1 means that, the initial state w 0 satisfies p 0 and the execution of the sequence of actions a; b invariably leads to a state satisfying p 1 .

Conclusion

In this chapter, we saw a brief introduction to modal logic. We saw the basics, its syntax, semantics, axiom systems and a tableau method. Some applications have also been presented.

From the next chapter on, we will put all the introductory material seen up till now at work. The next two chapters present modal logics of action and knowledge. Then, we will see modal logics for belief and belief revision. After that, we will see new methods for modal logic satisfiability checking.

Chapter 4 A Modal Logic of Responsibility

This chapter presents a formalism aiming at modeling individual and collective responsibility, and also the problem of many hands. This is a problem that arises whenever an organisation is responsible for some undesirable outcome, but none of its members can be held responsible for that outcome. The formalism proposed here is a logic that brings together notions of enacted actions, agents abilities, group knowledge and organisational structures. A sound and complete axiom system for the formalism is provided, as well as formal definitions for individual and collective responsibility, and for the problem of the many hands. This is a synthesis of a series of publications on the subject (de Lima et al. 2010a; de Lima and Royakkers 2015; de Lima et al. 2010b). The first section below presents and discusses the problem of many hands, which is the motivation of the work. The formal logic, its syntax, semantics and axiom system are presented on Section 4.2. After that, Section 4.3 uses that formalism to present formal definitions for individual and collective responsibility. These definitions are in turn used to formalise the problem of many hands in Section 4.4. Section 4.5 discusses related work and Section 4.6 concludes the chapter.

Motivation

The term problem of many hands (hereafter PMH) has been coined by [START_REF] Thompson | Moral responsibility and public officials: The problem of many hands[END_REF] and is meant to designate a situation where: "a group of individuals can reasonably be held responsible for an undesirable outcome, while no member of the group can reasonably be held responsible for the outcome."

It is not evident whether such a situation may actually occur. Indeed, one may tend to ascribe responsibility to a group only if at least some member of the group is #votes a 1 a 2 a 3 3 no yes yes 3 yes no yes 3 yes yes no Decision: yes yes yes Example 4.1. The first example is inspired by the doctrinal paradox [START_REF] Kornhauser | Unpacking the Court[END_REF][START_REF] Petit | Deliberative Democracy, the Discursive Dilemma[END_REF]. We suppose that a group of 9 agents have to decide whether the actions a 1 , a 2 and a 3 will be performed. They decide it using a simple majority election for each of the actions. Every agent knows that an undesirable outcome ϕ is brought about if all the three actions are performed. The way the agents vote on this issue is depicted on Table 4.1. Note that no agent agrees that all the three actions should be performed. We therefore assume that no agent intends to obtain ϕ. However, the final result is such that all the three actions are performed which means that the undesirable outcome ϕ is obtained. Also note that, for each agent taken individually, if this agent changes its vote, it does not change the final result.

We conclude that, when assuming that the vote is secret and that there is no previous arrangement between the agents, no agent is, individually, responsible for ϕ, whereas the group is responsible for that. Hence, a PMH.

Example 4.2. In the second example, we assume an environment with 4 agents where each one has the ability to execute a different action: agent 1 is the only one that can execute action a 1 ; agent 2 is the only one that can execute action a 2 ; and so on. The execution of action a i by agent i brings a desirable outcome for this agent. But every agent knows that the execution of three different actions a i brings about an undesirable outcome ϕ.

Here, the agents do not vote on the actions, they simply decide, individually, whether to perform the action or not. If we assume that the agents are rational, the decision taken by each of them depends on the reward of the outcomes involved. For each agent, if the reward of the outcome of its own action outweighs the utility of ϕ, then the agent decides to perform its own action. If so is the case for all agents, we have that the undesirable outcome ϕ is brought about. Table 4.2 depicts agents decisions in this latter case. Again, note that if one agent, taken individually, changes its decision, it is not enough to change the result.

Since no agent, individually, bought about ϕ, we cannot ascribe to one agent the responsibility for ϕ. However, the group acted in a way that brought about ϕ. Hence, again, a PMH.

Example 4.3. The third example is inspired by the prisoners dilemma [START_REF] Kuhn | Prisoner's Dilemma[END_REF]. In this version, we assume an environment with two agents. Each one has the ability to execute the two actions a 1 and a 2 . Both agents know that if they do not execute the In these three examples, one may argue that each agent shares the responsibility for ϕ. This would mean that the agents are not completely responsible for the undesirable outcome, but they are responsible for it to some degree. For instance, in the first example, the agent not willing to share responsibility for ϕ should simply vote 'no' in all columns.

agent a 1 a 2 a 3 a 4 1 yes - - - 2 - yes - - 3 - - yes - 4 - - - yes
The way we see things, there is a problem with this argument. A rational agent has no reason to think that the other agents would vote in a different way. Remember that the assumption made here is that the agents cannot talk to each other. The agent cannot foresee that the other agents will vote differently and thus cannot foresee that the undesirable outcome will be brought about. We believe that an agent cannot be held responsible for what cannot be foreseen. In the second and third examples, something similar happens. Each agent does not know the reward of the actions for the other agents. So, again, the agent cannot foresee the outcome and cannot be held responsible.

According to [START_REF] Bovens | The quest for responsibility. Accountability and citizenship in complex organisations[END_REF], the PMH can happen and when it does, it raises a problem when people are harmed, because: it "frustrates the need for compensation and retribution on the part of the victims", and also: "the fact that no one can be meaningfully called to account after the event also means. . . that no one need feel responsible beforehand".

But we overlooked an important thing in the above discussion. We did not precise what we mean by the term 'responsibility'. For example, when we say that someone is responsible for an outcome ϕ, it may mean that one is 'accountable' for ϕ or that one is 'blamed' for ϕ, or even, that one has the 'obligation to see to it that' ϕ. van de Poel et al. (2015) define several different meanings for the term 'responsibility' using other, more basic, concepts, such as moral agency, causality, wrong-doing, freedom and knowledge:

• Descriptive meanings:

-Responsibility-as-cause:

"The earth quake is responsible for the death of 100 people." -Responsibility-as-task:

"The train driver is responsible for driving the train." -Responsibility-as-authority:

"The project manager is responsible for the project." -Responsibility-as-capacity:

(The ability to act in a responsible way.)

• Normative forward-looking meanings:

-Responsibility-as-virtue: "She is a responsible person." -Responsibility-as-obligation:

"The bus driver is responsible for the safety of the passengers."

• Normative backward-looking meanings:

-Responsibility-as-accountability:

(The obligation to account for one's actions and theirs outcomes.) -Responsibility-as-blameworthiness:

"The driver is responsible for the car accident." -Responsibility-as-liability:

"He is liable to pay damages."

In this work, we are interested on some normative meanings of responsibility, namelly, obligation, accountability and blameworthiness. For instance, an individual i is accountable for ϕ if i is capable of acting as a moral agent, behaves in a way that is not morally acceptable (i.e., does something wrong) and this behavior causes ϕ. In addition, i is blamed for ϕ if i is accountable for ϕ, knows (or could know) that ϕ would be the case, and acts freely, i.e., i can chose to behave differently, and this different behavior avoids ϕ. Finally, i has the obligation to see to it that ϕ if i has the obligation that ϕ and i must in fact make ϕ occur, i.e., i has the obligation to cause ϕ.

These different meanings of responsibility are also classified in two categories. Accountability and blameworthiness are 'backward-looking responsibilities', i.e., responsibilities regarding the past, while 'obligation to see to it that' is a 'forward-looking responsibility', i.e., a responsibility regarding the future. Van de Poel et al. also argues that these three notions are related. Roughly, if an individual i has the obligation to see to it that ϕ but does not obtain ϕ, then i is accountable for ¬ϕ and, if i does not provide a satisfactory account for ¬ϕ, then i is blamed.

The Formal Framework

In this section we present a logic that will be the basis of our formalization of individual and collective responsibility. This logic is a variation of the coalition epistemic dynamic logic (CEDL) presented in (de Lima et al. 2010b), which, by its turn, is an extension of the well-known propositional dynamic logic (PDL) [START_REF] Harel | Dynamic Logic[END_REF][START_REF] Harel | Dynamic Logic[END_REF]. PDL is a classical propositional logic augmented with modal operators '[a]'. A formula of the form [a]ϕ means 'after every possible occurrence of event a, the consequence ϕ is true'. Thus, it permits expression of what consequences are caused by the occurrence of some given event a, where such events can be actions executed by one agent, actions executed by several agents, exogenous events or even programs. But since PDL does not have agents in its language, it does not enable expression of what consequences are caused by which agents of the scenario. To be able to express agent causality, CEDL extends it by actions that are 'enacted' by agents, in a similar way as done, e.g., by [START_REF] Royakkers | Extending Deontic Logics for the Formalisation of Legal Rules[END_REF] and [START_REF] Wieringa | Actors, actions, and initiative in normative system specification[END_REF] and also more recently by Herzig and Lorini (2010a,b). In CEDL, one can write formulas of the form [(i, a)]ϕ, meaning 'after every possible occurrence of event (i, a), the consequence ϕ is true', where the event (i, a) is the action a executed by agent i. Moreover, to be able to express agent knowledge, CEDL has modal operators K i , in a similar way as done, e.g., by [START_REF] Grossi | Organizational structure and responsibility: An analysis in a dynamic logic of organized collective agency[END_REF] and [START_REF] Herzig | A logic for planning under partial observability[END_REF]. In CEDL, one can also write formulas of the form K i ϕ, meaning 'agent i knows that ϕ'.

The resultant formalism is a logic presenting some of the properties of PDL and epistemic logic [START_REF] Fagin | Reasoning about Knowledge[END_REF]. In addition, because the actions of CEDL are enacted by agents, it is possible to define operators expressing agent abilities and agent obligations. It turns out that these operators are similar to the ones in coalition logic [START_REF] Pauly | Logic for Social Software[END_REF](Pauly , 2002)), alternating-time temporal logic [START_REF] Alur | Alternating-time temporal logic[END_REF]) and alternating-time temporal epistemic logic (van der Hoek and Wooldridge 2003). The obligation operators are similar to the ones in dynamic deontic logic (d'Altan et al. 1996;[START_REF] Meyer | A Different Approach to Deontic Logic: Deontic Logic Viewed as a Variant of Dynamic Logic[END_REF][START_REF] Wieringa | Actors, actions, and initiative in normative system specification[END_REF]. Therefore, CEDL constitutes a vary expressive framework where one can express actions, knowledge, abilities and obligations, all at once.

Models

A model is defined for a given vocabulary, which, in this case, consists of a triple of disjoint sets P, A, T , where:

• P is a countable (possibly infinite) set of propositional variables denoting propositional facts;

• A is a finite set of labels denoting agents; and

• T is a finite set of labels denoting the actions available for the agents.

We use ∆ to denote the set of all joint actions available for the agents in A, which is defined as the set of all total functions δ with signature A → T. In other words, ∆ = {δ 1 , δ 2 , . . .}, where each δ n is a set of pairs of the form {(i 1 , a 1 ), (i 2 , a 2 ), . . . , (i |A| , a |A| )} (one pair for each agent in A) and where i m ∈ A and a m ∈ T. CEDL models are a specific kind of Kripke models, where nodes represent possible worlds and relations between worlds represent either accessibility relations or transitions. A graphical representation of such models is displayed in Figure 4.1.

The formal definition is as follows. Let the vocabulary P, A, T be given, a CEDL model is a quadruple W, R, T, I , where:

• W is a non-empty set of possible worlds;

• R is a function with signature A → (W × W ), defining, for each agent i ∈ A, an equivalence relation between possible worlds, which represents the knowledge of agent i;

• T is a function with signature ∆ → (W ×W ), defining, for each joint action δ ∈ ∆, a relation between possible worlds, which represents the transition associated to the joint action δ; and

• I is a function with signature P → 2 W , defining, for each p ∈ P, the interpretation of the propositional variable p in the model.

To simplify notation, we sometimes write R i instead of R(i), and also use R i (w) to denote the set of worlds that i considers possible at w. Analogously, we sometimes write T δ instead of T (δ), and also use T δ (w) to denote the set of possible outcomes of the occurrence of δ at w. Some assumptions are implicit in the definition of CEDL models. For instance, every relation R i is an equivalence relation, i.e., they are all reflexive, transitive and euclidean. These are standard assumptions when modeling the knowledge of agents. As we have seen in Chapter 2, these assumptions correspond to axioms T, 4 and 5. Therefore, we have the following properties in CEDL:

• Truth: if agent i knows that ϕ is true, then ϕ is true;

• Positive introspection: if agent i knows that ϕ is true, then i knows that i knows that ϕ is true; and

• Negative introspection: if agent i does not know that ϕ is true, then i knows that i does not know that ϕ is true.

Even with a small vocabulary, structures respecting the definition above can model many different scenarios. Some of them are interesting, but some may be considered strange, if not useless. For instance, the definition above does not forbid structures where, for some possible world w ∈ W and for all δ ∈ ∆, we have T δ (w) = ∅. This is considered a strange structure because we cannot conceive a scenario that could be modeled in such a way. We consider here that an action is every behavior that takes time. This means that even "doing nothing" is an action. In fact, this is a special kind of action that does not change the state of affairs, but that has an outcome and therefore has a non-empty transition leading to a possible world: one which satisfies the same propositional variables as before the execution of the action. We then conclude that there is always some action available for the agents in every possible world. Therefore, we impose it to CEDL models. This is done by imposing the following constraint:

for all w ∈ W there is δ ∈ ∆ such that T δ (w) = ∅ (C1)
Constraint C1 is called 'activity'. It stipulates that, at all possible worlds of the model, there is at least one non-empty transition which is labeled by some joint action in ∆. In other words, at any moment, there is at least one executable action for each agent, which prevents those strange structures mentioned earlier from being CEDL models.

There is yet another constraint imposed to CEDL models:

for all w ∈ W, all i ∈ A and all δ ∈ ∆, we have (T δ • R i )(w) ⊆ (R i • T δ )(w) (C2)
This constraint corresponds to 'no-forgetting' in [START_REF] Herzig | A logic for planning under partial observability[END_REF] and 'perfect recall' in [START_REF] Fagin | Reasoning about Knowledge[END_REF]. It defines an interaction between accessibility relations and transitions. With this constraint, the knowledge of an agent either increases or stays the same, after the execution of any action. This means that agents never loose information, i.e., once an agent knows something, this agent will never forget it. This is obviously very restrictive but, at the same time, useful. For instance, it avoids to consider models where agents may keep losing information for whatever reason. Such possibility would make much more difficult (if not impossible) to derive some interesting properties of our formalism. We also note that, because each R(i) is an equivalence relation, Constraint C2 implies that action occurrences are perceived by all agents. The latter implies that the agents perceive the passage of time.

For example, the structure in Figure 4.1 respects both C1 and C2. The first is respected because, for all possible worlds w, there is at least one transition from w to some possible world. The second is respected because the equivalence classes of the accessibility relation R i do not increase their size when we follow a transition from one possible world to another.

Syntax and Semantics of CEDL

Let the vocabulary P, A, T be given, the language of CEDL, L CEDL , is defined by the BNF:

ϕ ::= | p | ¬ϕ | ϕ ∧ ϕ | K i ϕ | [δ| G ]ϕ where p ∈ P, i ∈ A, G ⊆ A and δ ∈ ∆.
The construction δ| G is δ, but with its domain restricted to G, i.e., let δ be the joint action {(i 1 , a 1 ), . . . , (i |A| , a |A| )}, then δ| G is the partial joint action formed by the set of pairs

{(i n , a n ) | (i n , a n ) ∈ δ and i n ∈ G}.
In what follows, the common abbreviations for the operators ∧, → and ↔ are also used, the symbol ⊥ (contradiction) abbreviates ¬ , and, to simplify notation, we sometimes write

[i 1 :a 1 , . . . , i n :a n ]ϕ instead of [{(i 1 , a 1 ), . . . , (i n , a n )}]ϕ.
The fragment without operator [ ] is, in fact, multi-modal KT5, where each modality m ∈ M is identified with an agent i ∈ A. The modal operator K i is used instead of [m] to stress its "knowledge" meaning.

The intended meaning of formulas of the form K i ϕ is, as usual: 'agent i knows that ϕ'. The intended meaning of a partial joint action of the form {(i 1 , a 1 ), . . . , (i n , a n )} is: 'the agents in {i 1 , . . . , i n } execute their corresponding actions in {a 1 , . . . , a n } simultaneously (and we do not consider what the other agents do at the same time)'. And the intended meaning of formulas of the form [δ| G ]ϕ is: 'after every possible occurrence of δ G , ϕ is true'.

To match their intended meanings, formulas from language L CEDL are interpreted using 'pointed CEDL models'. The latter are pairs of the form (M, w), where M = W, R, T, I is a CEDL model and w ∈ W . Then, the semantic interpretation of Boolean operators is the usual one. For formulas of the form K i ϕ we use the accessibility relation labeled with i: K i ϕ is true at the world w if and only if ϕ is true at all possible worlds w accessible from w via the accessibility relation labeled with i, i.e., it is true if and only if ϕ is true at all worlds that the agent i considers possible at w. The interpretation of operators [δ| G ] is more complex. A formula of the form [δ| G ]ϕ is true at the world w if and only if ϕ is true at all possible worlds w that are attained from w via some transition in T which is labeled with δ| G ∪ δ | A\G . In other words, to verify whether [δ| G ]ϕ is true at some possible world w, we must verify whether ϕ is true at all worlds w belonging to T δ (w) for all δ ∈ ∆, provided that the restriction of δ to G is equal to the restriction of δ to G, i.e., provided that δ | G = δ| G . That is, we must verify whether is true at all transitions from no matter what the agents outside the group do.

Formally, the satisfaction relation , between pointed CEDL models and formulas from L CEDL , is recursively defined as follows:

M, w M, w p iff w ∈ I(p) M, w ¬ϕ iff M, w ϕ M, w ϕ ∧ ψ iff M, w ϕ and M, w ψ M, w K i ϕ iff for all w ∈ R i (w) we have M, w ϕ M, w [δ| G ]ϕ iff for all δ ∈ ∆ and all w ∈ T δ| G ∪δ | A\G (w) we have M, w ϕ We note that δ| G ∪ δ | A\G is a set of pairs belonging to ∆. Thus, T δ| G ∪δ | A\G is defined for all w ∈ W .
As usual, a formula ϕ is valid (notation: ϕ) if and only if every pointed CEDL model M, w satisfies ϕ. Example 4.4 (Light Bulb and Light Switch). To better explain the definitions given so far, we now use a scenario that we call 'light bulb and light switch'. This scenario is inhabited by two agents: Alice (agent alice) and Betty (agent betty). They live in a strange house: its interior is illuminated by a light bulb, but the corresponding switch is located outside the house. In this scenario, Alice is inside the house and Betty is outside it, close to the switch. Thus, Alice can see whether the light bulb is on (noted light) or off (noted ¬light) and tell (or rater shout) it to Betty (action tell), but she cannot toggle the switch. Betty, on the other hand, can toggle the switch (action tog) but she cannot see whether the light is on or off. If she toggles the switch with the light on, it will turn off, and if she toggles it with the light off, it will turn on. Let the vocabulary be P, A, T , where P = {light}, A = {alice, betty} and T = {none, tell, tog}. A CEDL model for this scenario can be given by the structure in Figure 4.2.

w 0 w 1 w 2 w 3 betty δ 0 δ 1 δ 2 δ 3 δ 0 δ 3 δ 2 δ 0 , δ 2 δ 1 , δ 3 δ 0 , δ 2 I(light) = {w 1 , w 3 } δ 0 =
We assume that the light bulb is off, i.e., the actual world is w 0 . We then use the definition of to verify truth of some formulas in the pointed CEDL model M, w 0 :

• M, w 0 ¬light. In words, the light is off. This is true because w 0 ∈ I(light), i.e., light is not in the label of w 0 .

• M, w 0 K alice ¬light. In words, Alice knows that the light is off. This is true because M, w ¬light for all w ∈ R alice (w 0 ). (Recall that R alice (w 0 ) = {w 0 }.)

• M, w 0 ¬K betty light ∧ ¬K betty ¬light. In words, Betty does not know that the light is on and she also does not know that the light is off. This is true because, first, there is a possible world that Betty considers possible (namely w 0 ) where the light is off and there is a possible world that Betty considers possible (namely w 1 ) where the light is on.

• M, w 0

[alice:none, betty:tog]light. In words, after the parallel execution of Alice doing noting and Betty toggling the switch, the light is on. This is true because, first, δ 1 = alice:none, betty:tog. Second, A = {alice, betty}, thus, for all δ ∈ ∆, we have δ

| A\{alice,betty} = δ | ∅ = ∅; Then, δ 1 | {alice,betty} ∪ δ = δ 1 , which means that T δ1| {alice,betty} ∪δ | A\{alice,betty} (w 0 ) = T δ1 (w 0 ) = {w 1 },
for all δ ∈ ∆, and finally, M, w 1 light.

• M, w 0

[alice:tell, betty:tog]light. In words, after the parallel execution of Alice telling whether the light is on or off and Betty toggling the switch, the light is on. Similarly as before, we have that δ 3 = alice:tell, betty:tog and T δ3| {alice,betty} ∪δ | A\{alice,betty} (w 0 ) = T δ3 (w 0 ) = {w 3 }, for all δ ∈ ∆, and also M, w 3 light.

• M, w 0

[betty:tog]light. In words, after Betty toggling the switch, the light is on. (Note that here we consider only the action executed by Betty.) This is true if and only if, for every action that Alice can execute at the same time as Betty, after its parallel execution with Betty's action tog, the light is on. We have just verified, in the two preceding items, that if Alice does nothing this is indeed the case, as well as if Alice tells Betty whether the light bulb is on or off. But these are the only two options Alice has. Therefore, the sentence 'after Betty toggling the switch, the light is on' is true. More formally, note that δ 1 | {betty} = betty:tog and also δ 3 | {betty} = betty:tog. Then, we just have to verify that M, w 0

[δ 1 ]light and also M, w 0 [δ 3 ]light. But, this is what has been done in the two preceding items.

• M, w 0 ¬[betty:tog]⊥. In words, it is not the case that, after Betty toggling the switch, we have a contradiction. Since the formula ⊥ is false in any possible world (by definition), then the latter sentence is equivalent to: 'it is not the case that the execution of Betty toggling the switch is not possible'. To show that it is true, we have to verify that M, w 0 ¬[δ 1 ]⊥ or M, w 0 ¬[δ 3 ]⊥. Both are the case, because M, w ¬⊥ for all w ∈ W (by definition).

• M, w 0 ¬[alice:tell]K betty ¬light. In words, it is not the case that after Alice telling whether the light bulb is on or off to Betty, she knows that the light is off. This is the case because, if Betty toggles the switch at the same time, the light will be on. If it is on, then it is not possible for Betty to know that this is off. (Note that it uses the assumption that agents cannot know false statements.) Indeed, we have that M, w 0

[alice:tell, betty:tog]K betty ¬light. To show it, we first note that δ 3 = alice:tell, betty:tog. Moreover, T δ3 (w 0 ) = {w 3 }. And also, M, w 3 ¬K betty ¬light. The latter is the case because R betty (w 3 ) = {w 3 } and w 3 ∈ I(light).

Many other interesting (and more complex) formulas can be verified in this model. For instance, we leave it to the reader to verify that the following is true: M, w 0 [alice:tell, betty:none]K betty [betty:tog](K alice light ∧ K betty light). In words, it means that after the parallel execution of Alice telling whether the light bulb is on or off to Betty All instances of CPL tautologies (TAU)

(K i ϕ ∧ K i (ϕ → ψ)) → K i ψ (deductive closure for knowledge) (K) K i ϕ → ϕ (truth) (T) K i ϕ → K i K i ϕ (positive introspection) (4) ¬K i ϕ → K i ¬K i ϕ (negative introspection) (5) ([δ| G ]ϕ ∧ [δ| G ](ϕ → ψ)) → [δ| G ]ψ (deductive closure for action) (KA) δ∈∆ ¬[δ| G ]⊥ (activity) (A) δ ∈∆ [δ| G ∪ δ | A\G ]ϕ) → [δ| G ]ϕ (deriving action) (DA) ([δ| G ]ϕ ∧ [δ | H ]ψ) → [δ| G ∪ δ | H ](ϕ ∧ ψ) (if G ∩ H = ∅) (superadditivity) (S) K i [δ| G ]ϕ → [δ| G ]K i ϕ (perfect recall) (PR) From ϕ and ϕ → ψ infer ψ (modus ponens) (RMP) From ϕ infer K i ϕ (knowledge necessitation) (RNK) From ϕ infer [δ| G ]ϕ (action necessitation) (RNA) Table 4.4 -Axiom system of CEDL
and Betty doing nothing, Betty knows that after Betty toggling the switch, the two agents know that the light is on. In other words, it means that if Betty waits for the announcement of Alice, then she knows how to reach the state where the two agents know that the light is on.

We now turn our attention to some important CEDL validities, displayed in Table 4.4.

Theorem 4.1. The principles in Table 4.4 are sound and complete with respect to the class of CEDL models.

The proof of Theorem 4.4 is done by providing an equivalent alternative semantics for CEDL and then using correspondence theory [START_REF] Blackburn | Modal Logic[END_REF][START_REF] Sahlqvist | Completeness and Correspondence in the First and Second Order Semantics for Modal Logic[END_REF] with this alternative semantics.

First, for every CEDL model M = W, R, T, I we build an alternative model M * = W, R, T * , I . That is, M * is the same structure as M , but with a different transition function T * , which is defined as follows:

• T * is a function from the set of all partial joint actions to W × W , where w, w ∈ T * (δ| G ) if and only if there is δ ∈ ∆ such that w, w ∈ T (δ| G ∪ δ | A\G ).

Alternative pointed models are tuples of the form M * , w , where M * is as defined above and w ∈ W . The alternative satisfaction relation, * , is the same as for Boolean operators and for operators K i plus:

M * , w * [δ| G ] iff for all w ∈ T * δ| G (w) we have M * , w * ϕ Validity is defined as usual.
Second, let ϕ ∈ L CEDL , we show by an induction on the structure of ϕ that M, w ϕ if and only if M * , w * ϕ.

Third, we show that alternative models satisfy the following constraints:

δ∈∆ T * δ| G (w) = ∅ (C1') (T * δ| G • R i )(w) ⊆ (R i • T * δ| G )(w) (C2') T * δ| G (w) ⊆ δ ∈∆ T * δ| G ∪δ | A\G (w) (C3) T * δ| G∪H ⊆ T * δ| G (w) ∩ T * δ| H (w) (C4)
The first two are enforced by constraints (C1) and (C2) on CEDL models, respectively. The other two are enforced by the construction of T * .

Fourth, it is easy to see that all axioms in Table 4.4 are Sahlqvist's formulas [START_REF] Blackburn | Modal Logic[END_REF][START_REF] Sahlqvist | Completeness and Correspondence in the First and Second Order Semantics for Modal Logic[END_REF]. Then, by using the substitution algorithm, we obtain that Axioms (T), ( 4) and ( 5) correspond to reflexivity, transitivity and euclidicity of relations R i , respectively, and Axioms (A), (DA), (S) and (PR) correspond to Constraints C1', C3, C4 and C2', respectively. Therefore, it follows from the Correspondence Theorem [START_REF] Blackburn | Modal Logic[END_REF][START_REF] Sahlqvist | Completeness and Correspondence in the First and Second Order Semantics for Modal Logic[END_REF]) that the principles in Table 4.4 are sound and complete with respect to the class of alternative models. Since this semantics is equivalent to the semantics given earlier, then it is also sound and complete with respect to the class of CEDL models.

The axiom system in Table 4.4 reveals one additional assumption that is implicit in CEDL models. This assumption corresponds to Axiom (S), which is called 'superadditivity'. It stipulates that if group G obtains outcome ϕ by acting as determined by the partial joint action δ and H obtains outcome ψ by acting as determined by the partial joint action δ , then the group of agents G ∪ H obtains outcome ϕ ∧ ψ by acting as determined by the union of their partial joint actions. In particular, this implies that the bigger the group, the more it can achieve. This seems to be an intuitive property.

Group Knowledge

Because we aim at formalising collective responsibility, we have to provide a formalisation of 'group knowledge'. Unfortunately, there is no consensus in the literature of what group knowledge means (see, e.g., the discussion in [START_REF] Goldman | Social Epistemology[END_REF]). Here, we choose to use the notion of 'distributed knowledge', found, e.g., in [START_REF] Fagin | Reasoning about Knowledge[END_REF]). In the language, we replace operators K i by the more general K G , which semantics is formally defined as follows. Let G = ∅:

M, w K G ϕ iff M, w ϕ for all w ∈ i∈G R(i)(w)
Distributed knowledge approximately describes the knowledge of someone who has complete knowledge of what each member of the community knows.

Proposition 4.2. The following schemata are valid in CEDL with distributed knowledge:

(K G ϕ ∧ K G (ϕ → ψ)) → K G ψ (deductive closure for knowledge) (K ) K G ϕ → ϕ (truth) (T ) K G ϕ → K G K G ϕ (positive introspection) (4 ) ¬K G ϕ → K G ¬K G ϕ (negative introspection) (5 ) (K G1 ϕ 1 ∧ K G2 ϕ 2 ) → K G1∪G2 (ϕ 1 ∧ ϕ 2 ) (if G ∩ H = ∅) (knowledge superadditivity) (KS) K G [δ| A ]ϕ → [δ| A ]K G ϕ (perfect recall) (PR )
Axioms (K ) to (5 ) are, again, shown using correspondence theory. Axiom (PR ) is valid because (C2) is preserved for groups G, by the definition of K G . And (KS) is valid because i∈G1∪G2 R(i) ⊆ i∈G1 R(i).

Note that using axioms (KS) and (K ), one can derive both:

K G1 ϕ → K G1∪G2 ϕ and (K G1 ϕ 1 ∧ K G2 (ϕ 1 → ϕ 2 )) → K G1∪G2 ϕ 2 .
However, whether these principles constitute a complete axiom system for CEDL with distributed knowledge, is left as an open question.

Ability and Knowing How Ability

Our aim in this section is to define operators to express agent ability. The first operator we define here expresses that 'by executing δ| G , the group of agents G ensures an outcome satisfying ϕ in the next step'. That is, formulas of the form E δ| G ϕ should mean that G can execute δ| G (or, simply, δ| G is executable) and that it necessarily leads to an outcome satisfying ϕ. It therefore amounts to the following abbreviation:

E δ| G ϕ def = ¬[δ| G ]⊥ ∧ [δ| G ]ϕ
Sometimes, we will need to express that some group of agents ensure an outcome ϕ by executing a sequence of actions δ 1 | G ; . . . ; δ 2 | G . This amounts to a similar abbreviation, which generalizes the previous one:

E δ1| G ;...;δn| G ϕ def = ¬[δ 1 | G ] . . . [δ n | G ]⊥ ∧ [δ 1 | G ] . . . [δ n | G ]ϕ
The second operator defined here expresses that 'the group of agents G is able to ensure that ϕ is true in the next step'. That is, formulas of the form G ϕ should mean that G has an available action such that G can execute and which ensures an outcome satisfying ϕ. Thus, the latter is given by:

G ϕ def = δ∈∆ E δ| G ϕ
We note that this is a well-formed formula, because ∆ is finite, since T is finite. • M, w 0 {betty} light. In words, Betty is able to ensure that the light is on in the next step. This is true because there is an action available for Betty such that she can execute and which ensures an outcome satisfying ϕ. • M, w 0 ¬ {alice} K betty ¬light. In words, it is not the case that Alice is able to ensure that Betty knows that the light is off in one step. This is the case because there is no action available for Alice that ensures that Betty knows that the light is on on the next step. For instance, Betty can always toggle the switch, which leads to the situation where the light is off. Formally, the two options available for Alice do not lead, necessary, to a situation where the light is off. That is, we have that M, w 0 ¬[alice:tell]K betty ¬light, as seen before, and also M, w 0 ¬[alice:none]K betty ¬light.

• M, w 0 {alice} {betty} K betty light. In words, Alice is able to ensure that after one step Betty is able to ensure after one more more step that she knows that the light is on. In the first step, the action available for Alice that leads to that result is tell. The reader can verify that, if Alice executes tell an Betty does noting, then after that she knows that the light is off, and then she only has to toggle the switch to ensure that the light is on after one more step. On the other hand, if Alice executes tell and Betty toggles the switch, then after that she knows that the light is on, and then she only has to do nothing to ensure that the light is on after one more step. So, in any case, Betty will have an action that leads to a state where she knows that the light is on.

• M, w 0 {alice, betty} light ∧ {alice, betty} ¬light. In words, the two agents together are able to ensure that the light is on and they are able to ensure that the light is off. This is true because the agents may chose to execute, e.g., alice:none, betty:tog to ensure that the light is on after one step And also, they can chose to execute, e.g., alice:none, betty:none to ensure that the light is off after one step. This shows that in this scenario, the agents are able to control the state of propositional variable light.

• M, w 0 ¬ ∅ light ∧ ¬ ∅ ¬light. We note that this is a well-formed formula, because ∅ ⊆ A. Thus, we can follow the definition of ∅ , to verify that, for instance, the first conjunct ¬ ∅ light is true at w 0 . To do so, it is enough to verify that for all δ ∈ ∆, the formula [δ| ∅ ]light is false at w 0 . The latter is the case if and only if for all δ ∈ ∆ there is δ ∈ ∆ such that the formula [δ| ∅ ∪ δ {alice,betty} ]light is false at w 0 . And the latter is indeed the case for, e.g., δ = alice:none, betty:none. To verify that the second conjunct is also true at w 0 , we do the same reasoning but using δ = alice:none, betty:tog.

At this point, the reader may be wondering what interpretation should be given to ∅ . Formulas of the form ∅ ϕ mean 'after the execution of any joint action, ϕ is true', which is equivalent to 'ϕ is true in the next step, in spite of what the agents do' or even, 'it is necessary the case that ϕ true in the next step'. This interpretation of ∅ is similar as given to its homonym in Coalition Logic (CL) and Alternating-time Temporal Logic (ATL) [START_REF] Alur | Alternating-time temporal logic[END_REF]. In fact, for all G ⊆ A, the interpretation given to G is similar to that in CL and ATL, but with some technical differences. Our G is the fusion of ATL operators G and X (where the latter means "next"). That is, our formulas of the form G ϕ correspond to ATL formulas of the form G Xϕ. It turns out that our operator G validates some of the axioms and inference rule of ATL operators G X (as found, e.g., in [START_REF] Goranko | Complete axiomatization and decidability of Alternating-time temporal logic[END_REF]).

Proposition 4.3. The following schemas and rule of inference are valid in CEDL:

1. ¬ G ⊥ 2. G 3. ( G ϕ ∧ H ψ) → G ∪ H (ϕ ∧ ψ) (if G ∩ H = ∅) 4. From ϕ → ψ infer G ϕ → G ψ
It is easy to see why Proposition 4.3 holds:

1. Suppose that M, w G ⊥, for some arbitrary pointed model M, w . Then, there is a δ such that M, w

¬[δ| G ]⊥ ∧ [δ| G ]⊥, which is a contradiction. 2. From Axiom (A), ∃ δ∈∆ ¬[δ| G ]⊥ for all G ⊆ A. Since also [δ| G ] for all δ ∈ ∆ and all G ⊆ A, we have ∃ δ∈∆ (¬[δ| G ]⊥ ∧ [δ| G ] ).
3. First, note that G ϕ∧ H ψ is equivalent to the formula: We remark that the formula A ϕ → ¬ ∅ ¬ϕ is valid. Indeed, we can derive it quite easily using Axioms (S) and (A). This formula means that if the whole set of agents is able to ensure that ϕ is true after one step, then it is not the case that ϕ is necessarily false after one step. However, the converse is not the case. That is, ¬ ∅ ¬ϕ → A ϕ is not valid in CEDL. In words, just because ϕ is not necessarily false after one step, it does not mean that the whole set of agents are able to ensure it. It happens because we do not assume 'joint determinism' in CEDL, i.e., a joint action may have more than one possible outcome. It contrasts with ATL, where the formula ¬ ∅ X¬ϕ → A Xϕ is valid. This is not the case here though. 1Theorem 4.3 shows that operators G are similar to their CL and ATL homonyms. This means that these operator presents well-known, and desired, properties of an operator supposed to model ability of agents. It is very important for our framework, since we will base our subsequent definitions in the intuition behind the concept of ability.

∃ δ∈∆ (¬[δ| G ]⊥∧[δ| G ]ϕ)∧ ∃ δ ∈∆ (¬[δ | H ]⊥ ∧ [δ | H ]ψ). Also note that (a) ¬[δ| G ∪ δ | H ]⊥ (by Axiom (A)), and also (b) ([δ| G ]ϕ ∧ [δ | H ]ψ) → [δ| G ∪ δ | H ](ϕ ∧ ψ) (by Axiom (S)). Putting (a) and (b) together we have G ϕ ∧ H ϕ → G ∪ H (ϕ ∧ ψ).
Nonetheless, this operator has a "problem". It has been argued several times [START_REF] Ågotnes | Coalitions and Announcements[END_REF][START_REF] Broersen | A Normal Simulation of Coalition Logic and an Epistemic Extension[END_REF][START_REF] Jamroga | Constructive knowledge: What agents can achieve under incomplete information[END_REF]; Jamroga and van der Hoek 2004) that, when a logic of this kind is also able to express that agents' knowledge is incomplete, the operator just defined is not completely adequate. The same issue rises in our logic, and can be explained using the Light Bulb and Light Switch scenario again (Examples 4.4 and 4.5): let us recall that Betty is able to ensure that the light is on after one step. That is, {betty} light is true at w 0 . In fact, this formula is true at w 1 too. The latter means that she knows it, i.e., M, w 0 K betty {betty} light. Then, it may seem counterintuitive that Betty does not know that the action tog ensures light in w 0 , i.e., M, w 0

¬K betty E betty:tog light. However, the reader may verify that it is indeed the case. This means that although Betty knows that she is able to ensure that the light is on after one step, she does not know what she must do to ensure it! In game theory [START_REF] Osborne | A Course in Game Theory[END_REF] we say that an agent has a 'non-uniform strategy' for a given goal whenever:

for every state that the agent cannot distinguish from the current state, there is a strategy whose execution leads to the goal; and we say that an agent has a 'uniform strategy' for a given goal whenever: there is a strategy such that for every state that the agent cannot distinguish from the current one, its execution leads to the goal.

In our example above, Betty has a 'non-uniform strategy' for the outcome where the light is on. The formula K betty betty light expresses it. However, sometimes we would like to write a formula expressing that an agent has (or does not have) a uniform strategy for a given goal. In the language of coalition logic and ATL, the latter is not possible. But this is possible in CEDL. The formula δ∈∆ K i E δ|i light (which is false at w 0 ) expresses that Betty has a uniform strategy to obtain the goal light. In other words, it expresses that Betty knows how to ensure that the light is on after one step. Here, we call this a 'knowing how ability'. To be able to express it more succinctly, we define operators H G , as follows:

H G ϕ def = δ∈∆ K G E δ| G ϕ
The knowing how operator has some of the properties of the ability operator. For instance, we have the following.

Proposition 4.4. The following scheme and rule of inference are valid in CEDL:

1. ¬H G ⊥ 2. (H G1 ϕ 1 ∧ H G2 ϕ 2 ) → H G1∪G2 (ϕ 1 ∧ ϕ 2 ) (if G ∩ H = ∅) 3. From ϕ → ψ infer H G ϕ → H G ψ
But not all properties are the same. For instance, G is valid, while H G is not. Validity of the former means that there is always some action available for G that is executable, because of Axiom A. The latter is not valid because agent G does not always know which action it is.

Obligations

In this section, we define an operator expressing agents obligations, as in deontic logic [START_REF] Wieringa | Actors, actions, and initiative in normative system specification[END_REF]. We do so by adapting the simple, yet effective, idea of d [START_REF] Altan | An Integrated Framework for Ought-to-Be and Ought-to-Do Constraints[END_REF] to our framework. The latter developed further the ideas of [START_REF] Meyer | A Different Approach to Deontic Logic: Deontic Logic Viewed as a Variant of Dynamic Logic[END_REF], introducing both static and dynamic obligations in PDL.

From now on, we assume that the set of propositional variables of our language is P ∪ Vio, where Vio = {vio G | G ∈ 2 A \ ∅}. That is, for each agent, we introduce a new atomic formula vio G , that has the special meaning: 'the group of agents G is in violation'. In addition, we require that our models now be quadruples of the form W, R, T, I , where W , R and T are defined as before but the domain of I is extended to the new set of propositional variables, i.e., I :

(P ∪ Vio) → 2 W .
In (d'Altan et al. 1996), formulas of the form O G ϕ mean 'it is obligatory for G that ϕ is true'. The idea is that vio G flags the states of the model that consists of a violation state for G. In other words, vio G simply means 'G is in violation'. Thus, we define one obligation operator for each group of agents G ∈ 2 A \ ∅ with the following abbreviation:

O G ϕ def = ¬ϕ → vio G
Obligations satisfy some interesting properties. Proposition 4.5.

1. O G 2. O G (ϕ ∧ ψ) ↔ (O G ϕ ∧ O G ψ) 3. If ϕ then O G ϕ
We note that agents do not necessarily know their obligations, i.e., O G ϕ does not imply K G O G ϕ. Also, our approach permits models where violations are unavoidable. For instance, we have that vio G → O G ⊥ is valid, which also means that we do not impose Axiom D (i.e., ¬O G ⊥), which is present in some deontic systems. In our view it just means that dilemmas are possible (cf. van Fraassen (1973)). As in the classical Sartre's example, one can have the obligation to stay at home to look after an elderly mother and, at the same time, to have obligation to join the resistance movement to fight the Nazis. Now, still following d [START_REF] Altan | An Integrated Framework for Ought-to-Be and Ought-to-Do Constraints[END_REF] and [START_REF] Meyer | A Different Approach to Deontic Logic: Deontic Logic Viewed as a Variant of Dynamic Logic[END_REF], we can also define dynamic obligations in our framework, by using the dynamic operator available in our language, i.e., the operator [ ]. We therefore define:

F G (δ| G ) def = [δ| G ]vio G F G (δ 1 | G ; . . . ; δ n | G ) def = F G (δ| G ) ∨ [δ 1 | G ]F G (δ 2 | G ; . . . ; δ n | G )
A formula of the form F G (δ| G ) literally means that, 'G will necessarily be in a violation state after every possible occurrence of δ| G .' It should be read as 'action δ| G is forbidden for G'. Permitted actions are also defined by an abbreviation:

P G (δ 1 | G ; . . . ; δ n | G ) def = ¬F G (δ 1 | G ; . . . ; δ n | G )
That is, action δ| G is permitted for G if and only if δ| G is not forbidden for G.

Our operator O has an important difference compared to the one defined by Meyer (1988). Meyer's obligation is abbreviated by a master modality ,2 while ours is not. Therefore, our obligations are "immediate" ones, instead of Meyer's "global" ones. That is, O G ϕ means that ϕ is obligatory only now. We think that this kind of obligation makes sense, too. It may even make more sense than Meyer's obligations, since in real life, some rules and norms may expire, or even be subject of change.

Responsibility

With all the necessary ingredients in hands, we are now able to develop our formal theory of responsibility. We start with forward-looking responsibility, in Subsection 4.3.1, and then we deal with the two different kinds of backward-looking responsibilities, in Subsection 4.3.2. Subsection 4.3.3 establishes the relation between these two kinds of responsibility.

Forward-looking Responsibility

In this section, we formalize one kind of forward-looking responsibility, namely, the 'obligation to see to it that'. The aim here is to augment our logic with operators R, where formulas of the form R n G ϕ are to be read as 'it is obligatory for G that G sees to it that ϕ is true after n steps'. But, before showing its definition, let us recall part of the informal discussion drawn in van de Poel et al. 2015, Chapter 1, where Goodin's ideas are used to define this meaning of responsibility. The argument advanced is the following quote from Goodin 1995, p. 83:

The standard form of responsibility is that A see to it that X. It is not enough that X occurs. A must have "seen to it" that X occurs. "Seeing to it that X" requires, minimally: that A satisfy himself that there is some process (mechanism or activity) at work whereby X will brought about; that A check from time to time to make sure that process is still at work, and is performing as expected; and that A take steps as necessary to alter or replace process that no longer seem likely to bring about X. This is a complex definition. It is unlikely that we would be able to capture all its details in our framework. Nonetheless, we approximate it by the following inductive definition:

w 0 w 1 w 2 w 3 betty δ 0 δ 1 δ 2 δ 3 δ 0 δ 3 δ 2 δ 0 , δ 2 δ 1 , δ 3 δ 0 , δ 2 I(light) = {w 1 , w 3 } I(vio alice ) = {w 0 , w 1 , w 2 } I(vio betty ) = {w 0 ,
R 0 G ϕ def = O G ϕ (4.1) R n+1 G ϕ def = O G H n+1 G ϕ ∧ ∅ R n G ϕ (for n > 0) (4.2)
where H n G stands for a sequence of n operators H G , i.e., H 0

G ϕ def = ϕ and H n G ϕ def = H G H n-1 G ϕ. The formula R 0 G ϕ is equivalent to O G ϕ. That is, R 0 G
ϕ is true at some world w if and only if, it is necessary the case that, ¬ϕ implies a violation for G. But formulas R n G ϕ, for n > 1, are more than mere obligations that ϕ. They also capture the "supervisory nature" of this kind of responsibility. For it is also necessary the case that, after n -1 steps, ¬H G ϕ implies a violation for G. This means that, to avoid a violation, group G must find a way to be in the position to know how to ensure ϕ after one step. And analogously for n -2, and so on until n = 1.

Example 4.6 (Light Bulb and Light Switch with Violations). Let us now see our operator R in action using a variation of Example 4.4. The only difference in this variation is that worlds w 0 , w 1 and w 2 are violation states for Alice and also for Betty. Such scenario is depicted in Figure 4.3.

• M, w 0 R 1 alice light and also M, w 0 R 1 betty light In words, it is obligatory for Alice to see to it that the light is on after one step, and the same for Betty. We verify only Alice's case, since Betty's one is analogous. It is the case if and only if (1) M, w 0

O alice H alice light and ( 2) M, w 0 ∅ R 0 alice light. We have (1) because M, w 0 vio alice . And we have (2) because, for every w in the model, we have M, w ¬light → vio alice .

• M, w 0 R 2 alice light In words, it is obligatory for Alice to see to it that the light is on after two steps. To show it, we have to show that (1) M, w 0

O alice H alice H alice light and (2) M, w 0 ∅ R 1 alice light. To show (1) we have to show that ¬H alice H alice light → vio alice is true at w 0 . The reader can verify that this is indeed the case. To show [START_REF] Goldblatt | [END_REF] we have to show that for all w ∈ W we have M, w R 1 alice light. It can be done in the same way as for w 0 , which is done in the previous item.

We also note that that M, w 0 R 2 betty light, and invite the reader to do the exercise of showing it.

It may worth to explain why we do not use the classical notion of 'seeing to it that' (henceforth stit) proposed in [START_REF] Belnap | Facing the Future: Agents and Choices in Our Indeterminist World[END_REF]). Belnap et al.'s stit can be defined in our framework as follows. The sentence 'by executing δ| {i} , i sees to it that ϕ after one step' is expressed by the formula ¬[δ| {i} ]⊥ ∧ [δ| {i} ]ϕ ∧ ¬ ∅ ϕ. Note that it amounts to ours E δ| {i} ϕ plus the conjunct ¬ ∅ ϕ. This conjunct is there because, for Belnap et al., it is not enough that ϕ is true after one step. It must be the agent i that influences the course of things to ensure that ϕ is true after one step. It can be argued that our operator E does not capture this latter meaning. For example, the formula E δ| G is valid in CEDL, i.e., it is true at every world of every model. However, Belnap et al.'s stit is incompatible with the meaning of responsibility we are trying to formalize here. We show it using an informal example. Suppose that a teacher has the obligation to see to it that, after his class, the door of the classroom will be closed. Also suppose that the door of the classroom is connected to an automatic system that closes it exactly after his class finishes. Some minutes before finishing his class, the teacher has some options: (a) finish the class on time and then let the door be closed automatically by the system; (b) finish the class a bit earlier and then close the door himself; and (c) disable the automatic system an then close the door himself. It seems to us that in Belnap et al.'s terms, only (b) and (c) fulfill the teacher's obligation, while we think that all the three options fulfill the teacher's obligation. On the other hand, recall that, as explained earlier, the obligation to see to it that ϕ does not require that ϕ is achieved by an action of the teacher. But it requires some supervision. Therefore, in our example, the obligation to see to it that the door will be closed implies that the agent supervises the process by himself. That is, if the teacher chooses (a), then the teacher must be sure that the system is working properly or at least verify if the system closed the door after the class.

Backward-looking Responsibility

In this section, we formalize two kinds of individual backward-looking responsibility, 'accountability' and 'blameworthiness'. The aim here is to augment the logic with two operators, A and B. Formulas of the form A δ|i ϕ is to be read as 'after executing δ, agent i is accountable for ϕ' and formulas of the form B δ|i ϕ is to be read as 'after executing δ, agent i is blamed for ϕ'.

Accountability

Let us start by recalling the definition of 'accountability' given in van de Poel et al. 2015, Chapter 1: . . . an agent A is accountable for X if A has the capacity to act responsibly (has moral agency), is somehow causally connected to the outcome X (by an action or omission) and there is a reasonable suspicion that agent A did somehow something wrong.

The first condition for holding an agent accountable, 'moral agency', is a tacit assumption in our framework. In fact, our logical framework also assumes that all agents are rational and that they are perfect reasoners. This, for instance, means that agents can foresee all the logical consequences of the facts they know. Again, these assumptions may be seen as very restrictive ones, but, in a logical framework like ours, the relaxation of such assumptions would make it much more difficult (if not impossible) to derive some interesting properties.

The other two conditions for holding an agent accountable are causality and wrongdoing. We just make it precise that these two conditions must be related to each other, in the sense that the "something wrong" did by the agent must be what is "somehow causally connected to the outcome" for which the agent is accountable. So, first, we consider that agent i is causally connected to a given consequence ϕ whenever i ensures that ϕ is true and the action that ensures ϕ is wrong. And we consider that an action is wrong whenever it does not ensure a non-violation state. For the latter, it either means that a violation state is achieved by the execution of the action or, if the violation state is not achieved, it means that the agent did not take enough care in order to avoid it, what we also consider as a "wrong-doing". Putting everything together we have the following definition for accountability (which is already generalised to groups of agents):

A δ1| G ;...;δn| G ϕ def = E δ1| G ;...;δn| G ϕ ∧ ¬E δ1| G ;...;δn| G ¬vio G
The latter definition stipulates that, after executing the sequence of actions δ 1 ; . . . ; δ 2 , group G is accountable for ϕ if and only if, by executing this sequence, G ensures that ϕ is true and also, by executing this sequence, G does not ensure a non-violation state. • M, w 0 ¬A δ0| alice ¬light. In words, it is not the case that, after executing action none, Alice is accountable for the fact that the light is off. It is true if and only if ¬E δ0| alice ¬light ∨ E δ0| alice ¬vio alice . And it is true because the first disjunct is true. To see it, note that M, w 0 ¬[δ 0 | alice ]¬light.

• M, w 0 A δ0| betty ¬light. In words, Betty is accountable for the fact that, after executing action none, the light is off. It is true if and only if E δ0| betty ¬light ∧ ¬E δ0| betty ¬vio betty . Note that both conjuncts are true in the model of Figure 4.3.

• M, w 0 ¬A δ0| alice ;δ0| alice ¬light. In words, it is not the case that, after executing action none twice, Alice is accountable for the fact that the light is off. To show it, we use the same reasoning as for the first item again, but now twice.

We may say that, in this example, operator A works as expected. Note that Alice, who does not control the light switch cannot be held accountable for the fact that the light is off. On the other hand, Betty, who does control the light switch, can be held accountable for the fact that the light is off. But, we will see in the next section that she cannot always be blamed for that, because she does not know the state of the light in the beginning.

Blameworthiness

The definition given in van de Poel et al. 2015, Chapter 1 for this meaning of responsibility is the following: agent i is blamed for consequence ϕ whenever i is accountable for ϕ and is not capable to give an account for it. Two accounts (excuses) are considered acceptable. The first one is ignorance: the agent i is excused (and thus is not blamed) for ϕ if i can show that it does not know that its behavior causes ϕ, or it does not know that its behavior is wrong. The second is compulsion: the agent i is excused for ϕ if i can show that no behavior that does not cause ϕ or that is not wrong is possible. For simplicity, we give the definition of blame in two steps (note the generalisation to groups of agents):

C δ| G ϕ def = K G E δ| G ϕ ∧ ¬ ∅ ϕ C δ1| G ;...;δn| G ϕ def = K G E δ1| G C δ2| G ;...δn| G ϕ ∧ ¬ ∅ C δ2| G ;...;δn| G ϕ (for n > 1) B δ1| G ;...;δn| G ϕ def = C δ1| G ;...;δn| G ϕ ∧ ¬C δ1| G ;...;δn| G ¬vio G
The definition of operator B is similar to that of A, but with operator C in the place of ensure. The latter operator means more than just ensure. It could be seen as 'knowing causality'. That is, formula of the form C δ| G ϕ mean 'by executing δ, group G knowingly causes ϕ'. The difference with ensuring ϕ is that the latter formula also means that the agent knows that the action ensures ϕ and, in addition, the conjunct ¬ ∅ ϕ means that an option not necessarily leading to ϕ was possible. Therefore, the definition of formula B δ| G ϕ stipulates that, not only the group is accountable for ϕ, but the group cannot provide acceptable excuses for it, which, by the defition given initially, means that the group is blamed for ϕ. • M, w 0 ¬B δ0| alice ¬light. In words, it is not the case that, after executing action none, Alice is blamed for the fact that the light is off. It is true if and only if M, w 0 ¬C δ0| alice ¬light ∨ C δ0| alice ¬vio alice . And it is true because the first disjunct is true. To see it, note that M, w 0

¬K alice E δ0| alice ¬light, because M, w 0 ¬K alice [δ 0 | alice ]¬light.

• M, w 0 ¬B δ0| betty ¬light. In words, it is not the case that, after executing the action none, Betty is blamed for the fact that the light is off. It is true if and only if M, w 0 ¬C δ0| betty ¬light ∨ C δ0| betty vio betty . And it is true because the first disjunct is true. The reasoning is the same as for the item above. Note that M, w 0

¬K betty E δ0| betty ¬light, because M, w 0 ¬K betty [δ 0 | betty ]¬light.

Recall from Example 4.7 that M, w 0 A δ0| betty ¬light, i.e., after executing action none, Betty is accountable for the fact that the light is off. But, we now saw that, since she did not know the state of the light, she cannot be blamed for it.

• M, w 0 ¬B δ0| alice ;δ0| alice ¬light. In words, it is not the case that, after executing action none twice, Alice is blamed for the fact that the light is off. To show it, we use the same reasoning as for the first item again, but now twice.

• M, w 0 [δ 2 | alice ]B δ0| betty ¬light. In words, after the execution of action tell by Alice and then the execution of action none, Betty is blamed for the fact that the light is off. It is true if and only if M, w 2 B δ0| betty ¬light. And it is true if and only if M, w 2 C δ0| betty ¬light ∧ ¬C δ0| betty ¬vio betty . Note that the latter is true, because, in w 2 Betty knows the status of the light switch, which means that she knows that executing none will lead to a violation. In addition, in w 2 Betty also knows that there is another option that avoids the violation, namely, the execution of tog.

In other words, once Alice tells Betty the status of the light, Betty has all she needs to avoid the violation. If she decides to execute none she is not only accountable for the fact that the light is off, but she knew that it would happen and she also knew how to avoid it. Therefore, she is blamed for it.

The Relation Between Forward-Looking and Backward-Looking Responsibilities

Given the definitions for operators R, A and B of the latter subsections, the relation between the two kinds of responsibility now seems almost evident. Indeed, it is easy to check that the following proposition is true.

Proposition 4.6. The following axiom schemata are valid in CEDL:

1. (R n G ϕ ∧ E δ1| G ;...;δn| G ¬ϕ) → A δ1| G ;...;δn| G ¬ϕ 2. (R n G ϕ ∧ C δ1| G ;...;δn| G ¬ϕ) → B δ1| G ;...;δn| G ¬ϕ
Proposition 4.6.1 says that: if it is obligatory for G to see to it that ϕ, and the sequence of actions δ 1 ; . . . ; δ n ensures ¬ϕ, then G is accountable for ¬ϕ; and Proposition 4.6.2 says that: if it is obligatory for G to see to it that ϕ, and the sequence of actions δ 1 ; . . . ; δ n knowingly causes ¬ϕ, then G is blamed for ¬ϕ.

The Problem of Many Hands

How to avoid the PMH

As said before, the problem of many hands arises in an organisation when the organisation is backward-looking responsible for some undesirable outcome but no organisation member can be held backward-looking responsible for this outcome. Let G be the set of members of a given organisation, it is formally given by:

PMH δ G ϕ def = B δ G (ϕ) ∧ i∈A ¬B δi (ϕ)
A formula of the form PMH δ G ϕ means that 'by performing δ G , the problem of many hands arises in group G with respect to the outcome ϕ'. If we follow the definitions of operator B, we find out that we can paraphrase it as 'by performing δ G , group G is backward-looking responsible for ϕ, but no agent i in G is backward-looking responsible for ϕ by performing δ i '. Analysing the definitions of operator B a bit further we realise that the PMH may arise from three different sources: either (1) no forward-looking responsibility is ascribed to the individuals, or (2) the individuals that are forwardlooking responsible for ϕ do not have the ability to bring it about (without the other individuals of the group), or (3) the individuals that are forward-looking responsible for ϕ do not have the necessary knowledge to bring about ϕ (without considering the knowledge of the other individuals of the group).

To address source 1, once a group is forward-looking responsible for outcome ϕ, we need to ascribe responsibility to at least one individual in that group. We call this individual the leader of the group. Formally we have:

R n G ϕ → R n i ϕ (if i is the leader of G) (A10)
and where the leader i is a distinguished agent in the model (this is defined formally in the next section). Now, to address source 2, we have to be sure that the forward-looking responsibility can be "delegated" (directly or indirectly) to the individuals that have the ability to fulfill it. This will mean that the leader should have the power to ascribe forwardlooking responsibilities to other individuals of the group.

Similarly, to address source 3, we have to be sure that individuals can share information. In other words, that knowledge can be transmitted among individuals of the group.

Therefore, a group that wants to avoid the PMH should organise itself in such a way that delegation actions and information actions are possible. In management theory, some ideas of how organisations can be built are given. Here, we use the ideas of [START_REF] Grossi | Organizational structure and responsibility: An analysis in a dynamic logic of organized collective agency[END_REF], and define organisations as a kind of structure.

Organisational structures

An organisational structure is a quadruple G, P, IR, i where:

• G is a group of agents in A, representing the members of the organisation;

• P is a subset of G 2 , representing a power relation among the members of the organisation;

• IR is a subset of G 2 , representing an information flux relation among the members of the organisation;

• i is an agent in G, representing the leader of the group, and that satisfies the following semantic constraints:

j ∈ P + (i) (for all j ∈ G) (SC6) P ⊆ IR (SC7)
where P + is the transitive closure of P .

SC6 implies that every individual in the organisation can eventually be ascribed forward-looking responsibility for some outcome. SC7 guarantees that if an individual may be ascribed forward-looking responsibility for some outcome, this individual can also be informed about it.

Let O be an organisational structure, the models of our logic are now tuples of the form O, W, R, T, I . And its language is extended by the set of atomic formulas {Power(i, j) | i, j ∈ G} ∪ {Coord(i, j) | i, j ∈ G}. The satisfaction relation is the same as before plus:

M, w Power(i, j) iff (i, j) ∈ P M, w Coord(i, j) iff (i, j) ∈ I
Note that from SC7 we immediately obtain:

(A11) Power(i, j) → Coord(i, j)

Organisational actions

Once organisational structures are in place, we can define the organisational actions mentioned above. The first kind of such actions consists of information actions. That is, we add the set of actions {info(G, ϕ) : G ⊆ A and ϕ ∈ L} to the set T of atomic actions of the language. For example, action {(i, info(G, ϕ))} means 'agent i informs all members of G that ϕ'. We require that such actions satisfy the following two properties:

¬[(i, info(G, ϕ))]¬ → K i ϕ (A12) Coord(i, j) → [(i, info(G, ϕ))]K j ϕ (for each j ∈ G) (A13)
A12 restricts the circumstances in which action info(G, ϕ) is executable. We impose that agents can inform only what they know will be true after the communication act. It follows that agents cannot lie. A13 stipulates that informing actions are successful communication actions when the agents involved are appropriately related by a coordination link. This also means that the agents trust information that comes through the coordination link.

The second kind of organisational action consists of delegation actions That is, we add the set of actions:

{deleg((G 1 , n 1 , ϕ 1 ), . . . , (G m , n m , ϕ m )) | G 1 , . . . , G m ⊆ A, n 1 , . . . , n m ∈ N and ϕ 1 , . . . , ϕ m ∈ L}
to the set T of atomic actions of the language. In fact, this is a multiple-delegation action. The action {(i, deleg((G 1 , n 1 , ϕ 1 ), . . . , (G m , n m , ϕ m )))} means 'agent i ascribes forward-looking responsibility that ϕ k after n k steps to G k , for each 1 < k < m'. We require that such actions satisfy:

Power(i, j) → [(i, deleg((G 1 , n 1 , ϕ 1 ), . . . , (G m , n m , ϕ m )))]K j R n k ϕ k (A14)
(for each j ∈ G and each 1 < k < m) A14 stipulates that, when agent i delegates ϕ to G, it creates a forward-looking responsibility that ϕ for every agent in G, but only if agent i has the power to do so. Note that, in this definition of delegation, the actor of the delegation action keeps the responsibility. In addition, the agents in G also know their new responsibility. This is why power links must also be coordination links. (Recall SC7.)

Indirect responsibility

Note that the definition of forward-looking responsibility does not take indirect agency into account. It defines forward-looking responsibility as the case where the group must guarantee the outcome by itself. This is not well adapted for an organisation setting, where delegation actions and information actions are available. Therefore, here we redefine forward-looking responsibility below. For the sake of readability it is given in two parts. In the first part we can see that the only difference from the definition of forward-looking resposibility is the presence of operator IR. The latter operator means 'indirect responsibility'. Definition 4.1. (Again, we show only the first three, the others are analogous.)

R 0 G (ϕ) def = O G (ϕ ∨ IR 0 G (ϕ)) R 1 G (ϕ) def = O G (H G ϕ ∨ IR 1 G (ϕ)) ∧ ∅ R 0 G (ϕ) R 2 G (ϕ) def = O G (H G (H G ϕ ∨ IR 1 G (ϕ)) ∨ IR 2 G (ϕ)) ∧ ∅ R 1 G (ϕ)
where IR n G is defined as:

IR 0 G (ϕ) def = ∃ G 1 K G (Power(G, G 1 ) ∧ R 0 G 1 ϕ 1 ) ∧ • • • ∧ ∃ G m K G (Power(G, G m ) ∧ R 0 G m ϕ m ) ∧ K G ((ϕ 1 ∧ • • • ∧ ϕ m ) → ϕ) IR 1 G (ϕ) def = ∃ G 1 K G (Power(G, G 1 ) ∧ H G 1 ϕ ∧ R 1 G 1 ϕ 1 ) ∧ • • • ∧ ∃ G m K G (Power(G, G m ) ∧ H G m ϕ ∧ R 1 G m ϕ m ) ∧ K G ((ϕ 1 ∧ • • • ∧ ϕ m ) → ϕ) IR 2 G (ϕ) def = ∃ G 1 K G (Power(G, G 1 ) ∧ H G 1 (H G 1 ϕ 1 ∨ IR 1 G 1 (ϕ m )) ∧ R 2 G 1 (ϕ 1 )) ∧ • • • ∧ ∃ G m K G (Power(G, G m ) ∧ H G m (H G m ϕ m ∨ IR 1 G m (ϕ m )) ∧ R 2 G m (ϕ m )) ∧ K G ((ϕ 1 ∧ • • • ∧ ϕ m ) → ϕ) where Power(G, G ) def = ∃ i∈G ∀ j∈G Power(i, j).
Informally, group G is forward-looking responsible for ϕ after n steps if and only if it is obligatory for G that it is able to bring about ϕ after n steps or that it is indirect forward-looking responsible for ϕ after n steps. The definition of indirect responsibility is the most complex part. Yet, it is intuitive. We consider that a group G is indirect responsible for ϕ if and only if there are groups G 1 , . . . , G m under G's power that are able to bring about ϕ 1 , . . . , ϕ m , or they are indirect responsible for ϕ 1 , . . . , ϕ m , and such that ϕ 1 , . . . , ϕ m → ϕ.

Example

Consider an organisation with two bank accounts, 1 and 2. Alice (agent alice) is the member of the organisation who manages the accounts. Betty (agent betty) is the member who normally pays the bills for the organisation. And Carol (agent c) is the director of their department, but she has no access to the accounts.

Let M, w 0 be a pointed CEDL model, where M is depicted in Figure 4.4. It describes a situation where Betty will pay a bill after three steps using account 1. Alice knows that, but she does not know which account Betty will use. Alice also knows that none of the accounts has enough money to pay the bill, but she does know that both accounts together do. Group G = {alice, betty, c} is ascribed the responsibility to have the bill paid and the balances non-negative after three steps, i.e., M,

w 0 w 1 . . . δ 7 δ 6 w 2 w 3 w 4 δ 5 δ 6 w 5 w 6 w 7 w 8 w 9 w 10 δ 1 δ 2 δ 1 δ 2 δ 3 δ 4
w 0 R 3 G (bal(n) ≥ 0). Note that M, w 2 C δ 2 | G ¬(bal(n) ≥ 0).
That is, at w 2 , if Alice places the money on account 2, Betty pays the bill from account 1 and Carol just waits, the group G knowingly causes a negative balance. This is true because M, w 2

¬K G E δ 2 | G ¬(bal(n) ≥ 0), and also M, w 2 ¬C δ 2 | G ¬vio G i.e., it is not the case that G knows that δ 2 avoids a violation state. Therefore, M, w 2 B δ 2 | G ¬(bal(n) ≥ 0). A similar reasoning will show that M, w 0 B δ 7 | G ;δ 5 | G ;δ 2 | G ¬(bal(n) ≥ 0). Now, suppose for a moment that P = ∅, so that action deleg does not produce its normal effect of ascribing forward-looking responsibilities to Alice and Betty. That is, under this assumption I(vio alice ) = I(vio betty ) = ∅. Then, we have M, w 2 ¬B δ 2 | alice (bal(n) ≥ 0), because there is no violation for Alice in the model. Therefore, M, w 0 ¬B δ 7 | alice;δ 5 | alice ;δ 2 | alice (bal(n) ≥ 0). Similarly, there is no violation for Betty either, so M, w 0 ¬B δ 7 | betty ;δ 5 | betty ;δ 2 | betty (bal(n) ≥ 0). Because of Axiom A10, the violations for Carol are present in the model. However, we have M, w 2 ¬B δ 2 |c (bal(n) ≥ 0). The reason for this is that at w 2 Carol cannot ensure a non-violation state no matter which action she decides to execute. Therefore, M, w 0 ¬B δ 7 |c;δ 5 |c;δ 2 |c (bal(n) ≥ 0). This means that neither Alice, Betty or Carol can be held backward-looking responsible for a violation state. Thus M, w 0

PMH δ 7 | G ;δ 5 | G ;δ 2 | G (¬bal(n) ≥ 0), i.e.
, by performing such actions, the PMH arises in group G with respect to outcome ¬bal(n) ≥ 0. Now, let us come back to the original configuration of P . In this case, after the execution of δ 7 , Alice is forward-looking responsible for bal(n) ≥ 0. Then, if δ 2 is executed at w 2 , Alice is held backward-looking responsible, i.e., M, w 2 B δ 2 alice (¬bal(n) ≥ 0). That is, the PMH does not arise in the presence of the organisational structure proposed and the organisational actions info and deleg. Now, let us see the importance of using the new Definition 4.1 (instead of the definition in page 67) in the formalisation of this example. If we were using the old definition, alice betty c δ 1 tr(2, 1) pay(1) wait δ 2 tr(1, 2) pay(1) wait δ3 tr(2, 1) pay( 2) wait δ 4 tr(1, 2) pay( 2) wait δ 5 wait info wait δ 6 wait wait wait δ 7 wait wait deleg The bullets show where the atoms are true.)

vio G vio alice vio betty vio c bal(n) ≥ 0 w 0 • w 1 • w 2 • w 3 • • w 4 • w 5 • w 6 • • • • w 7 • w 8 • • • • w 9 • • • • w 10 • Table 4.5 -
the PMH could not be avoided, because it does not take delegation and indirect agency into account. The leader of the group, Carol, has no action in her repertoire to ensure a non-violation state herself. It does not matter what she does, she will never be held backward-looking responsible. But with the new definition she can be held responsible, because δ 6 does not ensure a non-violation state for Carol, while there is an action that does, namely, δ 7 , because M, w 0 K c E δ 7 c (IR 2 {alice,betty} (bal(n) ≥ 0). Finally, it is also interesting to notice that the information action executed by Betty on w 1 is important to make Alice aware of which account she will use to pay the bill. We invite the reader to do the exercise of considering I = ∅. In this case, action info will not produce its effect and therefore, the PMH arises. 3

Related Work

Our formalization of forward-looking and backward-looking responsibility is based on other, more basic, "ingredients". Here, we use agents' actions, abilities, obligations and knowledge. Earlier works on the formalization of responsibility often do not deal with all of these ingredients. For instance, [START_REF] Santos | Indirect Action, Influence and Responsibility[END_REF] deal only with obligations and agents abilities. As we do here, they propose that responsibility should be paraphrased by 'obligation to ensure'. Their formalization is done by using a logic wherein one can write formulas of the form OE i ϕ, which stand for 'it is obligatory that i ensures ϕ'. The most interesting feature of this approach is the validity of the scheme E i E j ϕ → E i ϕ. It expresses that 'if agent i ensures that agent j ensures ϕ then i ensures ϕ'. This is a useful feature for modelling indirect agency that is not present in our framework. However, Santos and Carmo's logic is not appropriate to address our problem for two reasons: it does not permit to express agents' incomplete knowledge about the situation and also does not have actions in its object language. The fact that Alice has incomplete knowledge is crucial in the example presented in Section 4.1, as well as the actions, since the problem is precisely that she needs to decide which action to execute.

With the logic for agent organisation (LAO) [START_REF] Dignum | A Logic for Agent Organizations[END_REF] Dignum and Dignum propose to formalise responsibility in terms of agents abilities. It seems to be a better alternative than Santos and Carmo's approach, because the former avoids considering that the agent is backward-looking responsible for a failure in the case the agent is not able to avoid this failure. However, as in Santos and Carmo's approach, LAO does not have actions in its object language, which means that, again, we cannot address our example using this logic either.

The formalism proposed by [START_REF] Grossi | Organizational structure and responsibility: An analysis in a dynamic logic of organized collective agency[END_REF] is based on a combination of dynamic and epistemic logics. Therefore, it has actions in the object language and also permits to express incomplete knowledge scenarios. However, this logic does not permit to express agents' abilities. As mentioned above, abilities are important in the definition of responsibility, and it is also important in the definition of obligations. We are not aware of other attempts to formalise the PMH in organisations.

A formalism that seems very close to CEDL is dynamic logic of agency (DLA) of Herzig and Lorini (2010a,b). CEDL and DLA appeared almost at the same time. However, their semantics, as well as their axiom systems are different. Moreover, formulas in DLA do not have the same meaning as in CEDL. For instance, a DLA formula of the form i : a ϕ means that 'agent i performs action a and ϕ is true afterwards'. This is why DLA has, for instance, axiom schema (Single): a : a → [i : b]⊥, meaning that an agent can execute only one action at a time. In fact, we have in DLA that the future is already determined: there is an actual history. This makes CEDL and DLA quite different formalisms. DLA is designed to reason about a system whose execution has already been determined, whereas CEDL is designed to reason about a system where agents are still to decide which possible execution will be undertaken.

Other approaches to responsibility, that are not based on logic, also exist. For instance, the casual models approach [START_REF] Alechina | Causality, responsibility and blame in team plans[END_REF][START_REF] Chockler | Responsibility and Blame: A Structural-Model Approach[END_REF][START_REF] Halpern | A modification of the Halpern-Pearl definition of causality[END_REF], describes the world in terms of variables and their values. Some variables may have a causal influence on others. This influence is modelled by a set of modifiable structural equations. Two different notions are defined: the degree of responsibility, which is a number in the interval [0, 1] that essentially measures the minimal number of variables and changes that participate on the cause of some event; and the degree of blame, which is also a number in the interval [0, 1] that, roughly speaking, measures the probability that those changes happen. Though it is very technical, the approach is flexible and able to model examples such as the ones we saw in this chapter. The responses to questions such as 'is the agent responsible for the outcome?' or 'is the agent blamed for the outcome?' are simply numbers on the given interval. The interpretation of those numbers are left to the user.

Conclusion

In this chapter, we saw a logic that extends PDL by epistemic formulas of the form K i ϕ, expressing that agent i knows that ϕ (similar to [START_REF] Grossi | Organizational structure and responsibility: An analysis in a dynamic logic of organized collective agency[END_REF] and [START_REF] Herzig | A logic for planning under partial observability[END_REF]), and also by enacted actions, i.e., formulas of the form [δ| G ]ϕ, expressing that ϕ holds after the execution of δ by group G (similar to Herzig and Lorini (2010a,b), [START_REF] Royakkers | Extending Deontic Logics for the Formalisation of Legal Rules[END_REF], and [START_REF] Wieringa | Actors, actions, and initiative in normative system specification[END_REF]). It turns out that, in CEDL, formulas of the form G ϕ, expressing that G has the ability to ensure ϕ, can be defined as simple abbreviations. Therefore, it is possible to express operators with the same properties as the ones found in other logics of agency, such as coalition logic [START_REF] Pauly | Logic for Social Software[END_REF]Pauly ( , 2002) ) and ATL Alur et al. (2002), but using a simpler semantics. In addition, CEDL also enables us to give a solution to the problem of uniform strategies.

With this tool in hands, we propose a formalization of one notion of forward-looking responsibility, two notions of backward-looking responsibility, and also the relation between them. All together enables us to model the problem of many hands in organisations, and to show how organised groups of agents are more likely to avoid such problem.

We did not address decidability, complexity and expressiveness of CEDL. In particular, a deep comparison analysis between this logic and other logics of agency, such as coalition logic, ATEL, STIT Belnap et al. (2001), etc., has not been addressed here. Moreover, there is a possible extension of this logic that may be promising. The first one is the addition of temporal operators. When reasoning about responsibilities, one may want to express statements such as 'Betty must turn on the light before 7 p.m.'. This statement means that Betty may fulfill her task by turning on the light before the specified deadline. Such statement cannot be expressed in our language.

In the next chapter, we design a new logic that, as well as CEDL, can express enacted actions, agents abilities and knowledge. That new logic is different from CEDL but, on that framework, we will be able to address all the questions on the last paragraph, as well as one additional problem of CEDL. This additional problem has to do with the formalization of scenarios, such as the example on Section 4.4.5. There, we took a model that corresponds to the description of the problem and check that some formulas have their intuitive meanings. But, in reality, this kind of problem should be modeled using a set of formulas describing the initial situation and the behaviour of each action of the scenario. This kind of formalisation can be very long and error prone in CEDL. The reader is invited to check (de Lima et al. 2010b, Section 4), where the complete description of an example similar to the one on Section 4.4.5 is given. This problem has to do with the so-called frame axioms [START_REF] Reiter | The frame problem in the situation calculus: a simple solution (sometimes) and a completeness result for goal regression[END_REF]). We will see on the next chapter, that an elegant solution can be provided when the semantics of the logic is designed using the ideas of dynamic epistemic logic (van Ditmarsch, van der Hoek, et al. 2007).

Chapter 5 A Logic of Agent Abilities and Knowledge

As exposed on Section 4.6, several open questions remain for CEDL. In addition, there are a couple of ways in which CEDL could be improved. Because the aim of that logic includes reasoning about actions and knowledge, it seems possible to approach those matters from a dynamic epistemic logic perspective. The main advantage of this perspective is that, as shown in (van Ditmarsch, Herzig, et al. 2007), we do not need to bother with the frame problem. This permits relatively shorter scenario descriptions, thus solving one of the main issues of CEDL.

In this chapter, we design a new logic that improves CEDL. We call this new formalism alternating-time temporal dynamic epistemic logic (ATDEL). It is indeed a long name for a logic. This is motivated by the fact that ATDEL incorporates features from alternating-time temporal logic (ATL) [START_REF] Alur | Alternating-time temporal logic[END_REF] and dynamic epistemic logic (DEL) (van Ditmarsch, van der Hoek, et al. 2007). It then allows for reasoning about agents abilities and time, and also actions and knowledge, something that is not possible in CEDL and is not very common in other formalisms.

This exposition is based on the results published in (de Lima 2011, 2014). In the next section, we present some additional motivation for the design of a logic such as ATDEL. Section 5.2 presents the syntax and semantics of this new formalism. After that, Section 5.3 presents examples showing how our logic can be used to model multiagent systems. In Section 5.4, the expressive power of ATDEL is compared to that of several other logics in the literature. In particular, it is shown that ATDEL subsumes group announcement logic [START_REF] Ågotnes | Group announcement logic[END_REF][START_REF] Ågotnes | Coalitions and Announcements[END_REF], arbitrary announcement logic (Balbiani et al. 2008) and coalition announcement logic [START_REF] Ågotnes | Group announcement logic[END_REF][START_REF] Ågotnes | Coalitions and Announcements[END_REF]. The subsequent two sections present axiom systems and decision procedures for automated reasoning in ATDEL. We discuss computational complexity of model checking and decidability issues for the satisfiability checking problem. Section 5.7 discuss some related work and Section 5.8 concludes the chapter.

Motivation

Several formalisms aiming at modeling multi-agent systems have been proposed. The most known examples are perhaps sees-to-it-that logic (STIT) [START_REF] Belnap | Facing the Future: Agents and Choices in Our Indeterminist World[END_REF][START_REF] Broersen | Deontic epistemic stit logic distinguishing modes of mens rea[END_REF], coalition logic (CL) (Pauly 2002) and alternating-time temporal logic (ATL) [START_REF] Alur | Alternating-time temporal logic[END_REF][START_REF] Van Der Hoek | Cooperation, Knowledge, and Time: Alternating-Time Temporal Epistemic Logic and its Applications[END_REF]. These formalisms allow reasoning about the abilities of the agents, i.e., about what states the agents are able to achieve. In ATL, for example, one can write the formula G ϕ, which means 'the group of agents G is able to enforce an outcome satisfying ϕ'. However, these logics do not enable reasoning about how the group G is able to enforce such outcomes. In other words, these logics do not enable reasoning about the actions the agents actually perform in order to enforce the outcome satisfying ϕ.

In the literature, we can find formalisms allowing reasoning about what outcomes agents are able to achieve and about how the agents achieve such outcomes. But frequently, they do not allow reasoning about individual actions of the agents. In other words, the actions are either exogenous or always executed jointly by all the agents of the scenario. For example, in public announcement logic (PAL) [START_REF] Plaza | Logics of public communications[END_REF], one can write the formula ψ K i ϕ, which means 'agent i knows that ϕ after the announcement of ψ'. But the announcement of ϕ is not "enacted" by any agent of the scenario. It is either interpreted as executed by all the agents together, or as an exogenous event. To this category, also belongs logic ES [START_REF] Lakemeyer | Semantics for a useful fragment of the situation calculus[END_REF] as well as some logics of the DEL family (i.e., the dynamic epistemic logic family), such as the BMS framework [START_REF] Baltag | Logics for Epistemic Programs[END_REF], the already mentioned public announcement logic (PAL) [START_REF] Plaza | Logics of public communications[END_REF], and public announcement logic with assignment (PALA) (van Ditmarsch et al. 2005).

Formalisms allowing reasoning about agents abilities and individual actions also exist. But their focus is on actions with epistemic effects only. To this category, belong group announcement logic (GAL) and coalition announcement logic (CAL) [START_REF] Ågotnes | Group announcement logic[END_REF][START_REF] Ågotnes | Coalitions and Announcements[END_REF]. Both are extensions of multi-agent epistemic logic (EL) with "enacted" public announcement operators and with group announcement operators. In GAL, one can write, e.g., the formula K i ψ K j ϕ, which means 'agent j knows that ϕ after the announcement of ψ by agent i'. In addition, the formula G ϕ means 'there is an announcement by group G after which ϕ, where the other agents remain silent'. The group announcement operator in CAL is different. There, the formula G ϕ means 'there is an announcement by group G after which ϕ is true, in spite of what the other agents announce'. In both formalisms though, the only kind of action present is public announcement. Such actions are a specific kind of communication actions capable of modifying the epistemic state of the agents.

Here, a new formalism called alternating-time temporal dynamic epistemic logic (AT-DEL) is proposed. This logic is somewhat similar to CAL. As well as in CAL, in ATDEL, formula G Xϕ is true if and only if there is an action by group G after which ϕ is true, in spite of what the other agents do, which can also be read as 'the group G is able to enforce that ϕ is true in the next step'. Note that all actions in CAL are public. This remains so in ATDEL. But the latter brings some improvements. First, ATDEL permits parallel actions by the same agent, i.e., in this logic, agents can also execute more than one action at the same time. Second, it contains actions with factual effects. These are actions that change the actual state of the world (and not only the epistemic state of the agents). Third, it contains temporal operators. In ATDEL, the formula G Aϕ means 'the group G is able to enforce that ϕ will always be true' and formula G (ψUϕ) means 'the group G is able to enforce that ψ is true until ϕ becomes true'. Fourth, the description of actions in ATDEL is concise. We argue that this permits reasonable sized multi-agent systems specifications. Fifth, a complete axiom system and decidability results for model checking and satisfiability checking are provided (those were missing for CAL). For instance, satisfiability checking is shown to be decidable when the set of available actions is finite.

The Logic

In this section, alternating-time temporal dynamic epistemic logic (ATDEL) is defined. It extends multi-agent epistemic logic (EL) with dynamic, coalition and temporal operators. In the preliminary part, EL and also the actions of ATDEL are presented. Its syntax and semantics are presented in the sequel.

Conflicting Actions

ATDEL extends EL, among other things, with dynamic operators taking actions as arguments. Inspired by other work on reasoning about actions [START_REF] Demolombe | Regression in Modal Logic[END_REF]van Ditmarsch, Herzig, et al. 2007), it is assumed that every action consists of the pair formed by its executability pre-condition and the set of its post-conditions. Such way of defining actions is an alternative way to implement the successor state axioms (which are proposed, e.g., in [START_REF] Lakemeyer | Semantics for a useful fragment of the situation calculus[END_REF][START_REF] Reiter | The frame problem in the situation calculus: a simple solution (sometimes) and a completeness result for goal regression[END_REF]. It enables us to represent the actions in a simple way, which then permits system specifications with reasonable size.

An action is a pair a = ϕ, σ , where ϕ ∈ L EL is a formula describing its executability pre-condition. This formula is sometimes also noted pre(a); and σ is a partial function with finite domain from P to L EL . Each formula σ(p), sometimes also noted post(a)(p), is the truth value that p will assume after the execution of a.

Example 5.1 (Two Buttons). Consider a scenario with a light bulb that can be turned on and off using two different buttons. If button a is pressed, the light will turn on; and if button b is pressed, the light will turn off. Now, let the proposition light represent the state of the light bulb: it is true if and only if the light bulb is on. The definition of actions a and b are:

a = (ϕ, {(light → )}) b = (ψ, {(light → ⊥)})
That is, pre(a) = ϕ means that the action of pressing button a is executable if and only if ϕ is true, whereas post(a)(p) = means that the light should turn on if the action is executed. And analogously for b. We do not bother with the contents of ϕ and ψ. They could, for instance, describe the state where the mechanism linking the corresponding button to the light bulb is working properly.

The formalism is constructed in such a way that, if action a is executed, the truth value of p is set to true if post(a)(p) is true, and it is set to false if it is false. However, because we intend to use such definitions in multi-agent scenarios, we may now wonder: what should be the truth value of p if, in Example 5.1, one agent presses button a and another agent presses the button b, both at the same time? Note that the two mechanisms may very well be working properly, i.e., ϕ and ψ may be true at the same time.

Therefore, we must decide how to aggregate the results of several actions performed in parallel. We may take the following option. Let a 1 , . . . , a n denote the execution of a 1 to a n in parallel, we may define:

(5.1) post(a 1 , . . . , a n )(p) def = n i=1 post(a i )(p) ∨ (p ∧ n i=1 post(a i )(p))
With this definition, the truth value of p after the execution of a 1 , . . . , a n is:

• true if every post(a i )(p) is true,
• false if every post(a i )(p) is false, and

• maintained if some post(a i )(p) are true and some post(a j )(p) are false.

Indeed, returning to our example of the light bulb, we have that, in the situation where both buttons are pressed at the same time, the light bulb will not change its state, because post(a, b)(p) is equivalent to p.

The solution taken above implements what is called 'shared control' in [START_REF] Gerbrandy | Logics of propositional control[END_REF]. That is, the truth value of p is calculated taken all agents' actions into account. But, other solutions are equally possible. For instance, one could implement what Gerbrandy calls 'positive control'. That is, the truth value of p is set to true if at least one agent decides to do so. Or even 'negative control', i.e., p is set to false if at least one agent decides to do so. Now, we may ask a similar question about the executability pre-condition of actions taken in parallel. But this matter seems much less controversial. We thus take the following standard approach:

(5.2) pre(a 1 , . . . , a n ) = n i=1 pre(a i )
This means that the execution of a 1 to a n in parallel is possible if and only if all individual actions are executable.

In what follows, we assume that these approaches for post and pre are taken. However, most of the results of this article also hold for other approaches, in particular, the already mentioned positive and negative control. In the case of post-conditions post, the most important feature that any alternative solution should present to benefit from the results in this article is that they can be written as a formula in L EL .

Syntax of ATDEL

The vocabulary of ATDEL contains the vocabulary of EL (i.e., a countable set P of propositional variables and a finite set A of labels denoting agents) and also a countable set E of events, which is the set of all possible combinations of executions of actions available for the agents in A. Thus, to be able to define E, we first define what are the actions available for the agents.

Definition 5.1 (ATDEL Actions

). An action is a pair a = (ϕ, σ) where ϕ ∈ L EL and σ is a function from a finite subset of P to L EL . We assume, for each i ∈ A, a countable set T i of such actions, which is the set of actions available for agent i. It is also assumed that every set T i contains the action skip = ( , ∅), which represents the 'no-operation' action, i.e., an action that is always executable and with no post-condition.

As said before, the first element of the pair a = (ϕ, σ) is the executability precondition of a, which is also noted pre(a). The second element of the pair is the set of post-conditions of a, which is also noted post(a). Definition 5.2 (ATDEL Events). For each i ∈ A and each a ∈ T i , the pair (i, a), denotes the event of agent i executing action a. The set E of all possible events is the set of all subsets of the set {(i, a) : i ∈ A and a ∈ T i }.

Note that this definition allows events where the same agent executes more than one action at the same time. Also note that e A = e and e ∅ = ∅ are also valid events of E. Moreover, let G ⊆ A be a group of agents, and let e ∈ E be a possible event, we use e G to denote the G's part of e, i.e., e G = {(i, a) : (i, a) ∈ e and i ∈ G}. And finally, we sometimes use skip G to denote the event {(i, skip) : i ∈ G} ∈ E. Definition 5.3 (ATDEL Language). The language L ATDEL of ATDEL is the set of formulas ϕ defined by the following BNF:

ϕ ::= | p | ¬ϕ | ϕ ∧ ϕ | K i ϕ | [e G ]ϕ | G Xϕ | G Aϕ | G (ϕUϕ)
where p ranges over P, i ranges over A, G ranges over 2 A , and e ranges over E.

The fragment of L without operators U and

A is called the 'next-fragment of ATDEL and is noted L X .
In what follows, the common abbreviations for ∨, →, ↔ and ⊥ are used. We also use the abbreviations for the duals of [ ] and

G X n+1 ϕ def = G X G X n ϕ.
The intended meaning of e G = {(i 1 , a 1 ), . . . , (i n , a n )} is 'all the agents in {i 1 , . . . , i n } execute their corresponding actions in {a 1 , . . . , a n } simultaneously'. As well as in other strategic logics, it is assumed that actions are executed synchronously and that the occurrence of each event e A corresponds to a "time step". But also note that the same agent may appear more than once in {i 1 , . . . , i n }. This means that each agent may execute more than one action at the same time. For example, it enables modeling scenarios where the same agent can press two different buttons, send two different messages, etc., simultaneously.

The intended meaning of formula [e G ]ϕ is 'after every possible occurrence of e G , ϕ is true'. The intended meaning of formula G Xϕ is 'group G is able to enforce that ϕ is true in the next step'. Thus, the intended meaning of its dual [ [G] ]Xϕ is 'it is not the case that group G is able to enforce that ¬ϕ is true in the next step', or, equivalently, 'group G is not able to avoid that ϕ is true in the next step'. Moreover, the intended meaning of formulas of the form G Aϕ is 'group G is able to enforce that ϕ will always be true', while formulas of the form G (ψUϕ) is intended to mean 'group G is able to enforce that ψ is true until ϕ becomes true'.

We present some admissible inference rules for ATDEL in Section 5.5.1. Some of these rules are formulated using 'necessity forms'. These are defined as the set of forms η defined by the following BNF:

η ::= | ϕ → η | K i η | [e G ]η
where is a special symbol (that appears only once in a necessity form), ϕ ranges over L ATDEL , i ranges over A, G ranges over 2 A and e ranges over E.

If η is a necessity form, then η(ϕ) is obtained from η by substituting ϕ for in η. For example, is a necessity form (the most basic one). Thus, so is K i and also p → K i , as well as [e A ](p

→ K i ). Therefore [e A ](p → K i )(p ∧ q) amounts to [e A ](p → K i (p ∧ q)).
The role of such forms in the axiom system of ATDEL is explained in Section 5.5.1.

Semantics of ATDEL

Formulas in L ATDEL are interpreted using epistemic models (i.e., Kripke models respecting axioms (T) and ( 5)). The dynamic operators of ATDEL are interpreted using 'model updates'. The update of M by event e modifies M in two ways: the possible worlds not satisfying its occurrence pre-condition are removed and the truth value of propositional variables are changed according to its post-conditions. Formally, it is defined as follows.

W |e = {w | M, w pre(e)} R|e(i) = R(i) ∩ (W |e × W |e) V |e(p) = {w | M, w post(e)(p)} ∩ W |e
and where pre(e) aggregates the pre-conditions of all actions in e, as defined Section 5.2.1, and post(e)(p) aggregates the post-conditions of the individual actions in e, also as defined in Section 5.2.1.

In the sequel, the satisfaction relation of ATDEL is defined.

Definition 5.5 (ATDEL Satisfaction Relation). The satisfaction relation between pointed epistemic models M, w and formulas in L ATDEL is defined as usual for formulas in L EL plus:

M, w [e G ]ϕ iff for all e ∈ E, if M, w pre(e G ∪ e G ) then M |(e G ∪ e G ), w ϕ M, w G Xϕ iff there is e ∈ E such that M, w ¬[e G ]⊥ and M, w [e G ]ϕ M, w G Aϕ iff for all n ∈ N, if n ≥ 0 then M, w G X n ϕ M, w G (ψUϕ) iff there is n ∈ N s.t. n ≥ 0 and M, w G X n ϕ and for all m ∈ N, if 0 ≤ m < n then M, w G X m (¬ϕ ∧ ψ)
Sometimes, to avoid confusion, we also note this satisfaction relation ATDEL .

The interpretation of the operator [ ] embeds a quantification over events. A formula of the form [e G ]ϕ is true if and only if the occurrence of G's part of e leads, necessarily, to an outcome satisfying ϕ. In other words, it is true if and only if the occurrence of e G with any possible "completion" of it e G leads to an outcome satisfying ϕ. Remark 5.1. Thus, following the definition given above, we have: Assume an event e = {(i 1 , a 1 ), . . . , (i n , a n )}, where M, w pre(a k ), for some a k , 1 ≤ k ≤ n. Using (5.2), we have M, w pre(e). Using the definitions just given, we have: M, w

M, w [e A ]ϕ iff for all e ∈ E, if M, w pre(e A ∪ e ∅ ) then M |(e A ∪ e ∅ ), w ϕ iff if M, w pre(e A ) then M |e A ,
[e]⊥. The latter formula reads 'after every possible execution of e, ⊥ is true'. This is as it is supposed to be, since we have just assumed that there is no possible execution of e.

The interpretation of the operator X is based on the interpretation of [ ]. It stipulates that the formula G Xϕ is true if and only if there is an event e ∈ E such that G's part of e can occur and such that its occurrence, necessarily, leads to an outcome satisfying ϕ. 1As usual, a formula ϕ ∈ L ATDEL is valid in ATDEL, noted ϕ, if and only if every pointed epistemic model M, w satisfies ϕ. A formula ϕ ∈ L ATDEL is satisfiable in ATDEL, if and only if there is a pointed epistemic model M, w that satisfies ϕ, i.e., ¬ϕ.

Examples

We show in this section two examples of scenarios which can be modeled using ATDEL.

Example 5.2 (Light bulb and light switch). ATDEL can be used to reason about collaborative agency. To see it, we consider again the scenario of Example 4.4. To formalize this in ATDEL, let the set of agents be A = {alice, betty} and the actions available for them be:

T alice = {skip, tellon, telloff }
T betty = {skip, tog} where:

tog = ( , {(light → ¬light)}) tellon = (K alice light, ∅) telloff = (K betty ¬light, ∅)
Action tog is available only for Betty while actions tellon and telloff are available only for Alice. Note that the latter two actions work as the public announcements that the light bulb is on and off, respectively. We do not have, as in Chapter 4, the action tell here. This is so because this logic does not contain non-deterministic actions. Note that tell can be seen as the non-deterministic choice between tellon and telloff .

The set of possible events E is formed by all combinations of these actions. For the considerations below, we will use only the following ones: e = {(alice, tellon), (betty, skip)} e = {(alice, telloff ), (betty, skip)} f = {(alice, skip), (betty, tog)} f = {(alice, skip), (betty, skip)} A model for this example is depicted in Figure 5.1. In the actual world w 0 , the light is off (¬light), Alice knows it, but Betty does not. After the occurrence of e , the model is updated: the world where pre(e ) is false is removed. In the resulting model, both Alice and Betty know that the light is off. Then, after the occurrence of f , the truth value of light is changed. In the resulting model, both Alice and Betty know that the light is now on.

It is easy to check that every pointed model M, w satisfies: which means that 'if the light is off, then both agents will know that the light will be on after Alice telling that it is off and Betty toggling the switch'. Therefore, we have that every pointed model also satisfies:

¬light → {alice, betty} X {alice, betty} X(K alice light ∧ K betty light)
which means that 'if the light is off, then after two steps Alice and Betty are able to enforce an outcome where both of them know that the light is on'. Analogously, it is easy to check that every pointed model also satisfies:

light → [e {alice,betty} ][f {alice,betty} ](K alice light ∧ K betty light)
which implies that we also have:

light → {alice, betty} X {alice, betty} X(K alice light ∧ K betty light)
All together, this implies that every pointed model satisfies:

{alice, betty} X {alice, betty} X(K alice light ∧ K betty light)

And finally, it implies that every pointed model satisfies {alice, betty} ( U(K alice light ∧ K betty light))

which in words means that whatever the initial situation is, Alice and Betty are able to enforce that, eventually, both know that the light is on.

It is perhaps worthwhile to stress that the descriptions in terms of functions pre and post above are all that is needed to formalize the actions of this scenario. This is one of the advantages of using such functions to describe actions. In other formalisms, a relatively large number of formulas would be needed to achieve the same. This is, for instance, the case for the formalism presented on Chapter 4. Also note that, if one wants to add more actions to the scenario, including actions with different epistemic effects or even actions that change the truth value of other additional propositional variables, the description of tellon, telloff and tog do not need to be changed.

Example 5.3 (Tic-tac-toe). To illustrate that ATDEL can also be used to model competitive agency, such as in game-like scenarios, we consider a formalization of the game tic-tac-toe. We use capital letters to name each cell in the board from the left to the right and from the top to the bottom (i.e., A names the leftmost top cell, B names the middle top cell, . . . , and I names the rightmost bottom cell). Then, we assume some propositional variables describing the situation of the game, e.g., p CA means 'there is a cross in cell A', and two propositional variables expressing which player has the right to play: q C means 'it is Cross' turn to play' and q O means 'it is Nought's turn to play'. Finally, we assume some actions describing the possible plays, e.g., a OB means 'plays a nought in cell B'. These actions can be defined as follows. For all x ∈ {C, O} and y ∈ {A, . . . , I}:

pre(a xy ) = q x ∧ ¬p Cy ∧ ¬p Oy post(a xy ) = {(p xy → ), (q x → ), (q x → ⊥)}
where x means 'the opposite player', i.e., C = O and O = C. For instance, it follows from these definitions that player x can play x in cell y if and only if it is x's turn and there is no cross nor nought in the cell y. The actions a Cy are only available for player C, while actions a Oy are only available for player O. Finally, let some possible events be:

e {C,O} = {(C, a CI ), (O, skip)} e {C,O} = {(C, a CD ), (O, skip)} f {C,O} = {(C, skip), (O, a OI )}
Now, let us suppose an already started match which looks like the following picture, where it is Cross' turn to play:

X O X O O
Assume a pointed model M, w satisfying this situation, i.e., assume:

M, w q C ∧ p CA ∧ ¬p CB ∧ ¬p CC ∧ ¬p CD ∧ p CE ∧ ¬p CF ∧ ¬p CG ∧ ¬p CH ∧ ¬p CI ∧ ¬p OA ∧ ¬p OB ∧ p OC ∧ ¬p OD ∧ ¬p OE ∧ p OF ∧ p OG ∧ ¬p OH ∧ ¬p OI
It is easy to check that M, w also satisfies [e {C} ]p CI , which means that p XI becomes true after such action and, therefore, player C wins. Note that such formula implies {C} Xp CI , which means that player C can win in one step. But we also have that this model satisfies [e {C} ][f {O} ]p OI , which means that after some other play by player C, player O can win. Note that this implies C X O Xp OI , which means that X can put O in a position where O can win the game.

Note that formulas of the form [ ψ]ϕ are permitted in APAL. In the sequel, however, we do not deal with such formulas. That is, we consider a fragment of L APAL where public announcements are formulas in L EL . In other words, let P be a countable set of propositional variables and let A be a finite set of labels denoting agents, the language L APALR considered here is the set of formulas ϕ defined by the following BNF:

ϕ ::= p | ¬ϕ | ϕ ∧ ϕ | K i ϕ | [ψ]ϕ | ϕ ψ ::= p | ¬ψ | ψ ∧ ψ | K i ψ
where p ranges over P and i ranges over A.

We call the corresponding logic APALR. This is not an uninteresting fragment. Note that formulas of the form [ψ]ϕ, where ψ itself contains public announcements, can be reduced to equivalent formulas in L EL (cf. [START_REF] Kooi | Expressivity and completeness for public update logics via reduction axioms[END_REF]). In addition, the semantic interpretation of formulas of the form ψ uses a quantification over L EL in order to avoid a circular definition (cf. (Balbiani et al. 2008)). Therefore, even though formulas of the form [ ψ]ϕ are allowed in the full language of APAL, the public announcement in it (i.e., formula ψ) does not count as a possible announcement for the interpretation of ϕ. Here, we avoid to deal with such announcements just because the action preconditions and post-conditions in ATEL are restricted to formulas in L EL . We leave as an open question weather such announcements can be expressed in ATDEL. Now, let us compare the expressiveness of APALR to that of ATDEL 1 , which is the version of ATDEL that respects the following condition.

(i) For all i ∈ A, T i = {(ϕ, ∅) | ϕ ∈ L EL }.
The key idea is to make ATDEL 1 respect two restrictions of APALR, namely, (1) public announcements are the only kind of action allowed (which is already the case in APAL) and ( 2) only formulas in L EL can be announced.

The translation mltr from L APALR to the language of ATDEL 1 is defined as follows:

mltr(ϕ) def = ϕ (if ϕ ∈ L EL ) mltr([ϕ 1 ]ϕ 2 ) def = [{(i, (ϕ 1 , ∅))} ∪ skip A ] mltr(ϕ 2 ) mltr( ϕ) def = [∅] mltr(ϕ)
where the agent i in the second clause is arbitrarily chosen among A.

The intuition behind the second clause is that public announcements ϕ 1 are translated to actions (ϕ 1 , ∅), enacted by one of the agents, while all the other agents remain silent.

We obtain the following expressiveness result.2

Proposition 5.5. APALR ≤ ATDEL 1 .

ATDEL vs. GAL

The language L GAL of GAL contains L EL plus formulas of the form [ψ]ϕ, which are both read and interpreted as in APAL; and also formulas of the form G ϕ, which are read 'there is an announcement by group G after which ϕ, where the other agents remain silent'. The satisfaction relation GAL is the usual one plus:

M, w GAL G ϕ iff there exists a set {ψ i | i ∈ G} ⊆ L EL s.t. M, w GAL i∈G K i ψ and M | i∈G K i ψ i , w GAL ϕ
where M |ψ is defined as in APAL.

Note that formulas of the form [ G ψ]ϕ are permitted in GAL. For analogous reasons to the ones in Section 5.4.2, we consider a fragment of L GAL where public announcements are formulas in L EL . In other words, let P be a countable set of propositional variables and let A be a finite set of labels denoting agents, the language L GALR considered here is the set of formulas ϕ defined by the following BNF:

ϕ ::= p | ¬ϕ | ϕ ∧ ϕ | K i ϕ | [ψ]ϕ | G ϕ ψ ::= p | ¬ψ | ψ ∧ ψ | K i ψ
where p ranges over P, i ranges over A and G ranges over 2 A .

We call the corresponding logic GALR. Let us compare its expressiveness to that of ATDEL 2 , which is the version of ATDEL with the finite set A ∪ {s} of labels denoting agents and which respects following condition.

(i) The set of available actions for s is T s = {(ϕ, ∅) | ϕ ∈ L EL } and, for each agent i ∈ A, the set of available actions for i is

T i = {(K i ϕ, ∅) | K i ϕ ∈ L EL }.
The key idea is to have a 'special agent' s that is the only one acting whenever a public announcement is made. In addition, the condition above also makes ATDEL 2 respect three restrictions of GALR (which are already the case in GAL), namely, (1) public announcements are the only kind of action allowed, (2) each agent in A can only announce what is known and (3) only formulas in L EL can be announced by the agents in A.

The translation function mltr from L GALR to the language of ATDEL 2 is defined as follows.

mltr(ϕ) def = ϕ (if ϕ ∈ L EL ) mltr([ϕ 1 ]ϕ 2 ) def = [{(s, (mltr(ϕ 1 ), ∅))} ∪ skip A ] mltr(ϕ 2 ) mltr( G ϕ) def = skip G∪{s} mltr(ϕ)
The intuition behind the second clause is that public announcements ϕ 1 are translated to actions (ϕ 1 , ∅) enacted by the agent s, while all the other agents remain silent. We must have a special agent s here because the agents in A are not allowed to announce what they do not know. To be able to express, for instance, the formula [p]ϕ in ATDEL 2 , we need to add an agent capable to announce p, which is not necessarily known.

We obtain the following result.

Proposition 5.6. GALR ≤ ATDEL 2 .

ATDEL vs. CAL

The language L CAL of CAL contains L EL plus formulas of the form [ψ]ϕ, which are both read and interpreted as in APAL; and also formulas of the form G ϕ, which read 'there is an announcement by group G after which ϕ, in spite of what the other agents announce'. Its interpretation is given by:

M, w CAL G ϕ iff for every i ∈ G there exists ψ i ∈ L EL s.t. for every ψ j ∈ L EL for each j ∈ G, M, w CAL i∈G K i ψ i ∧ [ k∈A K k ψ k ]ϕ
Again, note that formulas of the form [ G ψ]ϕ are permitted in CAL. For analogous reasons to the ones in Section 5.4.2, we consider a fragment of L CAL where public announcements are conjunctions of formulas in L EL which are known by some agent. In other words, let P be a countable set of propositional variables and let A be a finite set of labels denoting agents, the language L CALR considered here is the set of formulas ϕ defined by the following BNF:

ϕ ::= p | ¬ϕ | ϕ ∧ ϕ | K i ϕ | [ψ]ϕ | G ϕ ψ ::= K i χ | ψ ∧ ψ χ ::= p | ¬ψ | ψ ∧ ψ | K i ψ
where p ranges over P, i ranges over A and G ranges over 2 A .

We call the corresponding logic CALR. Let us compare its expressiveness to that of ATDEL 3 , which is the version of ATDEL that respects the following condition.

(iii) for each agent i ∈ A, the set of available actions for i is

T i = {(K i ϕ, ∅) | K i ϕ ∈ L EL }.
The key idea is to make ATDEL 3 respect three restrictions of CALR (which are already the case in CAL), namely, (1) public announcements are the only kind of action allowed, (2) each agent in A can only announce what is known and (3) only formulas in L EL can be announced by the agents in A.

The translation function mltr from L CALR to the language of ATDEL 2 is defined as follows:

mltr(ϕ) def = ϕ (if ϕ ∈ L EL ) mltr([ϕ 1 ]ϕ 2 ) def = [mltr (ϕ 1 ) ∪ skip A ]ϕ 2 mltr( G ϕ) def = G X mltr(ϕ) PAL PALA EL CL ATL APALR GALR CALR ATDEL 1 ATDEL 2 ATDEL 3 Figure 5.2 -Expressiveness relations
where mltr is defined by:

mltr (K i χ) def = {(i, (χ, ∅))} mltr (ψ 1 ∧ ψ 2 ) def = mltr (ψ 1 ) ∪ mltr (ψ 2 )
The intuition behind the second clause of mltr is that public announcements ϕ 1 , which are always of the form

k≤n K i k ψ k , are translated to k≤n {(i k , (ψ k , ∅))}.
We obtain the following result.

Proposition 5.7. CALR ≤ ATDEL 3 .

Summary

The diagram in Figure 5.2 summarizes currently known expressiveness relations between some logics: a double arrow from logic L 1 to logic L 2 represents L 1 ≤ L 2 , a single arrow represents L 1 ≤ L 2 but not L 1 = L 2 , dashed arrows represent previously established results and black arrows represent new results. Some transitive and reflexive arrows are omitted.

The Next-fragment of ATDEL

The next-fragment of ATDEL has some interesting properties which are worth to be examined separately. We do so in this section.

Axiom System

Table 5.1 displays the axiom system of the next-fragment of ATDEL. Principles (CPL), (KT5 n ), (RMP) and (RNK) are the standard ones for epistemic logic. Principles (AA), (AN), (AC), (AK) and (RNA) are similar to the reduction axioms and rule of inference of public announcement logic (van Ditmarsch, van der Hoek, et al. 2007;[START_REF] Plaza | Logics of public communications[END_REF]) and public announcement logic with assignment (van Ditmarsch et al. 2005). These principles follow directly from the semantics of ATDEL. Principle (AD) captures the very natural intuition that, if ϕ → ψ is true after every possible occurrence of e A then, if ϕ is true after e A then so is ψ. Principle (AS) is sometimes called 'superadditivity'. It captures the intuition that, if a group G enforces ϕ by executing the actions in e, and group H enforces ψ by executing the actions in f , then, by working together, the two groups enforce outcomes satisfying both ϕ and ψ.

Principle (RDA) captures the intuition that, if a group G enforces ϕ by executing the actions in e, in spite of what other agents do, in particular, in spite of what H does, then G enforces ϕ by executing the actions in e. The principles (AG) and (RDG) capture the intuition that, if group G enforces ϕ by executing action e, then G is able to enforce ϕ. Principles (RDA) and (RDG) use necessity forms. They have been inspired by rule R ω ( ) of APAL (cf. (Balbiani et al. 2008)). We need such rules to "encode" the quantification over actions embedded in the semantics the operator [ ]. These inference rules work (so to say) as the counter-positives of Proposition 5.9.3 (which is shown using (AS) on page 98) and Axiom (AG), respectively. Also note that, unlike other logics in the DEL family, this axiom system does not permit a reduction to EL. Such reduction cannot be achieved, because ATDEL is at least as expressive as APALR (cf. Proposition 5.5), which has been shown to be strictly more expressive than EL in (Balbiani et al. 2008).

Theorem 5.8 (Soundness). All principles in Table 5.1 are valid in ATDEL.

As usual, a formula ϕ ∈ L ATDEL is a theorem of ATDEL, noted ϕ, if and only if ϕ is an instantiation of some axiom from the axiom system of ATDEL, or it is generated by the application of some inference rule from the axiom system of ATDEL to theorems of ATDEL.

In the sequel, some interesting properties of ATDEL are derived. Some of them are used to prove completeness of the axiom system. Moreover, this exercise helps to illustrate how to correctly use the non-standard inference rules (RDA) and (RDG). Proposition 5.9.

1. if ϕ ↔ ψ then K i ϕ ↔ K i ψ (substitution of proved equivalences under K i ) 2. If ϕ then [e G ]ϕ (necessitation for [e G ]) 3. [e G ]ϕ → [e G ∪ f H ]ϕ (if G ∩ H = ∅) (outcome monotonicity) 4. [e G ](ϕ ∧ ψ) ↔ ([e G ]ϕ ∧ [e G ]ψ) (action and conjunction for [e G ]) 5. K i [e G ]ϕ → [e G ]K i ϕ (perfect recall) 6. [e G ](ϕ → ψ) → ([e G ]ϕ → [e G ]ψ) (action distribution for [e G ]) 7. If ϕ → ψ then [e G ]ϕ → [e G ]ψ (monotonicity of [e G ]) 8. If ϕ ↔ ψ then [e G ]ϕ ↔ [e G ]ψ (substitution of proved equivalences under [e G ])
Proof. We derive each property using the axiom system of ATDEL. Here we show only some of them.

2. 1. ϕ (hypothesis) 2. for all f ∈ E, [e G ∪ f G ]ϕ (from 1 with (RNA)) 3. [e G ]ϕ
(from 2 with (RDA), because is a necessity form)

3. Assume G ∩ H = ∅. 1. [f H ] (from Prop. 5.9.2) 2. ([e G ]ϕ ∧ [f H ] ) → [e G ∪ f H ](ϕ ∧ ) (AS) 3. [e G ]ϕ → [e G ∪ f H ]ϕ
(from 1 and 2)

4. First, we derive the implication from the right to the left:

1. for all f ∈ E, ([e G ]ϕ ∧ [e G ]ψ) → ([e G ∪ f G ]ϕ ∧ [e G ∪ f G ]ψ) (from Prop. 5.9.3) 2. for all f ∈ E, ([e G ]ϕ ∧ [e G ]ψ) → [e G ∪ f G ](ϕ ∧ ψ) (from 1 and (AC)) 3. ([e G ]ϕ ∧ [e G ]ψ) → [e G ](ϕ ∧ ψ) (from 2 with (RDA), because ([e G ]ϕ ∧ [e G ]ψ) → is a necessity form)
Now, we derive the implication from the left to the right:

1. for all f ∈ E, [e G ](ϕ ∧ ψ) → [e G ∪ f G ](ϕ ∧ ψ) (Prop. 5.9.3) 2. for all f ∈ E, [e G ∪ f G ](ϕ ∧ ψ) → ([e G ∪ f G ]ϕ ∧ [e G ∪ f G ]ψ) (from (AC)) 3. for all f ∈ E, [e G ∪ f G ](ϕ ∧ ψ) → [e G ∪ f G ]ϕ (from 2) 4. for all f ∈ E, [e G ](ϕ ∧ ψ) → [e G ∪ f G ]ϕ (from 1 and 3) 5. [e G ](ϕ ∧ ψ) → [e G ]ϕ (from 4 with (RDA), because [e G ](ϕ ∧ ψ) → is a necessity form) Analogously, we obtain [e G ](ϕ ∧ ψ) → [e G ]ψ.
From this and 5, we obtain:

[e G ](ϕ ∧ ψ) → ([e G ]ϕ ∧ [e G ]ψ).
Propositions 5.9.2 and 5.9.6 together show that operators [e G ] are normal modal operators. Proposition 5.9.5 corresponds to what is called 'perfect recall' in [START_REF] Fagin | Reasoning about Knowledge[END_REF]. It is shown using superadditivity (AS), necessitation for knowledge (RNK), Axiom (K) for knowledge and Axiom knowledge and actions (AK). It captures the intuition that the knowledge of the agents either increases or remains the same after the occurrence of an event. This means that agents never loose information, i.e., once an agent knows something, this agent will never forget it. Together with the fact that each R(i) is an equivalence relation, Proposition 5.9.5 implies that action occurrences are perceived by all agents, which implies that the agents also perceive the passage of time.

Proposition 5.10.

1.

G X (group activity)

2. ¬ G X⊥ (group non-blocking) 3. ¬ ∅ X¬ϕ → A Xϕ (joint determinism) 4. ( G Xϕ ∧ H Xψ) → G ∪ H X(ϕ ∧ ψ) (if G ∩ H = ∅) (group superadditivity) 5. If ϕ → ψ then G Xϕ → G Xψ (monotonicity of G X) 6. If ϕ ↔ ψ then G Xϕ ↔ G Xψ (substitution of proved equivalences under G X)
Propositions 5.10.1-5 are the principles satisfied by operators G of coalition logic (CL).

The next theorem states completeness of the axiom system in Table 5.1.

Theorem 5.11 (Completeness). Every valid formula ϕ ∈ L X is a theorem in ATDEL.

Decision Procedures

Algorithm 5.1 decides model checking for the next-fragment of all versions of ATDEL in which the sets of actions T i are finite. Note that the set T = {T i | i ∈ A} is given as an argument. The idea is simple: if ϕ ∈ L EL it calls an existing model checker for EL (Algorithm 3.1); otherwise, it it simply tries all possible events in E. We have the following result.

input:

A finite set T of actions, an epistemic model M, w and a formula ϕ ∈ L X . output: true if M, w ϕ, false otherwise Theorem 5.12. Model checking in the next-fragment of ATDEL with finite sets of actions is in PSPACE. Ågotnes et al. (2010) proved that model checking in both GAL and APAL is in PSPACE. These can be seen as two versions of ATDEL with infinite sets T i (cf., Section 5.4). Their algorithm is similar to Algorithm 5.1, but instead of choosing events in the set E, it computes definable restrictions of model M via bisimulation contractions. All these restrictions correspond to valid public announcements in the languages of APAL and GAL. However, it is not clear if all versions of ATDEL with infinite sets of actions could use the same algorithm. The difficulty is to provide a non-resource consuming method to verify whether some given definable restriction of M would, indeed, be a valid event from E.

1 function nfmc( T, M, w , ϕ) 2 if ϕ ∈ L EL then return mlmc( M, w , ϕ) 3 else if ϕ = [e G ]ψ then 4 forall f G ∈ E do 5 M := M |(e G ∪ f G ) 6 if not nfmc( T,
Satisfiability checking in the next-fragment of ATDEL is not decidable in general. It follows immediately from the non-decidability of satisfiability checking in APAL [START_REF] French | Undecidability for arbitrary public announcement logic[END_REF], which can easily be transferred to APALR, and because there is a version of the next-fragment of ATDEL that is at least as expressive as APALR (cf. Proposition 5.5).

However, when the sets of available actions are finite, so is the set E of possible events. In this case, one can define an algorithm that decides satisfiability. Such algorithm depends on Principle substitution of proved equivalences (RSE), which soundness is proved below.

Lemma 5.13. The following principle is sound in the next fragment of ATDEL:

(RSE) If ϕ ↔ ψ then χ ↔ χ[ϕ/ψ]
(substitution of proved equivalences)

Theorem 5.14. Satisfiability checking in the next-fragment of ATDEL with finite sets of actions is decidable.

When the sets of actions available for the agents in A is finite, the infinitary rules (RDA) and (RDG) can be replaced by the following two axioms:

f ∈E [e G ∪ f G ]ϕ → [e G ]ϕ (RA ) e∈E ([e G ]⊥ ∨ e G ϕ) → [ [G] ]Xϕ (RG )
Axiom (RA ) and Proposition 5.9.3 together imply the following reduction axiom:

[e G ]ϕ ↔ f ∈E [e G ∪ f G ]ϕ
This means that successive applications of this equivalence and RSE (Lemma 5.13) replace operators [e G ] for operators [e A ], i.e., formulas containing actions executed by a group G can be replaced by formulas containing actions executed by the entire set of agents A. Then, using Axioms (AA), (AN), (AC) and (AK), operators [e A ] can be eliminated. The result is a (huge) formula in L EL .

Similarly, axioms (RG ) and (AG) together imply the following reduction axiom:

G Xϕ ↔ e∈E ( e G ∧ [e G ]ϕ)
This means that operators X can be eliminated from formulas by successive applications of this equivalence and (RSE). Since, in this case, operators [ ] can also be eliminated, the next-fragment of ATDEL with a finite set of actions is reducible to epistemic logic. This, all together, implies that the next-fragment of ATDEL with a finite set of actions is reducible to epistemic logic. Since satisfiability checking in EL is decidable, so is satisfiability checking in this fragment.

Full ATDEL

All principles in Table 5.1 (of Page 96) Note that the algorithm induced by Theorem 5.14 is probably non-optimal. Let ϕ be given, one can imagine a tableaux-like method that explores the canonical epistemic model filtrated by ϕ branch by branch. Since the size of each branch is a polynomial function on the length of ϕ, this may lead to an algorithm that is less resource consuming. We leave such kind of improvement to future work though.

G Aϕ → (ϕ ∧ G X G Aϕ) (fixed-point for always) (FPA) G (ψUϕ) ↔ (ϕ ∨ (ψ ∧ G X G (ψUϕ))) (fixed-point for until) (FPU) From χ → (ϕ ∧ G Xχ) infer χ → G Aϕ (induction for always) (RIA) From (ϕ ∨ (ψ ∧ G Xχ)) → χ infer G (ψUϕ) → χ (induction for until) (RIU)

Full ATDEL

Axiom System

Table 5.2 displays the axiom system of full ATDEL. The principles therein are standard for logics containing operators always and until. For instance, they are analogous to the principles present in the axiom system of ATL, given, e.g., in [START_REF] Goranko | Complete axiomatization and decidability of Alternating-time temporal logic[END_REF]. They are proved to be sound in Theorem 5.15 below. Theorem 5.15 (Soundness). All principles in Table 5.2 are valid in ATDEL.

However, to prove completeness, we need to add the assumption that all sets T i are finite! This is so because the technique used (similar to the one used in [START_REF] Halpern | A guide to completeness and complexity for modal logics of knowledge and belief[END_REF] for the common knowledge operator) requires a finite canonical model. The complete axiom system for ATDEL with infinite sets T i is left as an open question.

Theorem 5.16 (Completeness). Every formula ϕ ∈ L ATDEL which is valid in ATDEL with finite sets of actions is a theorem of ATDEL.

Decision Procedures

Algorithm 5.2 decides model checking in full ATDEL in which the sets of actions available for the agents in A are finite. We have the following result.

Theorem 5.17. Model checking in full ATDEL is in EXPSPACE.

We leave as future work the lower bound of model checking in full ATDEL with finite sets of actions.

Satisfiability checking in full ATDEL with finite sets of actions is decidable. This can be shown as follows. The proof is based on the fact that the filtrated canonical model for ATDEL is constructed using a finite set of formulas sub(ϕ) (also see Section 3.6). This enables us to show the following theorem.

Theorem 5.19 (Decidability of ATDEl). Satisfiability checking in ATDEL with a finite number of actions is decidable.

Related Work and Discussion

Apart from the formalisms mentioned in Section 5.4, there are some other containing actions by groups and group modalities in their languages that are worth to be mentioned here. They are the coalition action logic [START_REF] Borgo | Coalitions in Action Logic[END_REF], the alternating-time temporal logic with explicit strategies [START_REF] Walther | Alternating-time Temporal Logic with Explicit Strategies[END_REF], the dynamic logic of agency (DDL) (Herzig and Lorini 2010a) and the logic CEDL, presented on Chapter 4 The first two differ from ATDEL in several aspects. The most important of them is perhaps the fact that they do not model the knowledge of the agents and, thus, also do not have epistemic actions. The third and fourth ones model the knowledge of agents and their languages look very similar to that of ATDEL. But, their semantics is completely defined in terms of Kripke structures, instead of model updates. This difference is reflected on their axiom system. Both, DDL and CEDL do not validate reduction axioms as ATDEL does (i.e., Axioms (AA), (AN), (AC) and (AK)). One can argue that those formalisms are able to model "more actions", instead of only public announcements and actions with factual effects. This is indeed a limitation of ATDEL. But the two kinds of actions ATDEL is able to model are already very expressive. The examples on Section 5.3 give a strong support for this argument. Second, as mentioned before, because of its action descriptions, the specifications of scenarios in ATDEL are generally more succinct than in DDL and CEDL. This is the case because one must deal with the so-called frame axioms in DDL and CEDL.

Conclusion

In this chapter, we saw the alternating-time temporal dynamic epistemic logic, wherein one may write formulas of the form G Xϕ, which mean 'there is an action by group G after which ϕ is true, in spite of what the other agents do' (as well as always and until versions of it). Differently from the previously existent coalition announcement logic, ATDEL also contains actions with factual effects, temporal operators, and is equipped with a sound and complete axiom system.

We saw that ATDEL subsumes several logics of the dynamic epistemic logics family. It is also shown to be useful in modeling multi-agent systems through examples of collaborative and competitive scenarios. Moreover, compared to other multi-agent logics, such as ATL and STIT, it adds the possibility to model agents' knowledge and it has concise descriptions of actions, Thus, permitting reasonable sized multi-agent systems specifications.

In the next chapter, we will leave knowledge and actions behind and discuss agents belief and belief change instead. Belief change is more complicated than knowledge change because, apart from learning, agents may also have to revise their beliefs. This is subject of a whole different area, called belief revision theory. expected properties. But, in the case of KD45 n models, this task is more complicated than in the standard AGM framework, because, in a multi-agent context, a new piece of evidence can take different forms. For instance, it can be observed, transmitted, or available to every agent or only to some of them.

Here, we consider private and group change, i.e., one or more agents receive some new piece of information, and then we look at defining the new KD45 n model that represents the new epistemic situation. We consider only objective pieces of information, i.e., information about the environment (world). The problem of considering change by subjective information, i.e., information about the beliefs of other agents, is more difficult and is left for future work. We study both expansion and revision. For each case, we provide a translation of AGM postulates for the multi-agent setting, and some specific operators.

The remainder of the chapter synthesises the results published in (Caridroit et al. 2015a,b), with some small additions, and is organised as follows. After some considerations about multi-agent belief sets, we study private expansion. In Section 6.2, we translate the AGM postulates for this kind of scenario and then propose a particular expansion operator that satisfies these postulates. In Section 6.3, we translate the AGM postulates for private revision, and then propose a family of revision operators. We discuss some related work in Section 6.4 and then conclude the chapter in Section 6.5.

Multi-agent Belief Sets

We are interested here in a framework with several agents, each of them having her own beliefs about the state of the world and about the beliefs of other agents. Therefore, we take the epistemic logic commonly used for modelling agents beliefs in multi-agent systems, i.e., KD45 n (see Section 3.7.1). Here, a pointed KD45 n model represents a set of |A| belief sets, one for each i ∈ A. Formally, we have the following. Definition 6.1 (Multi-agent Belief Set). Let a pointed KD45 n Kripke model be given.

The belief set of agent

i ∈ A is the set K M,w i = {ϕ | M, w B i ϕ}.
In other words, the belief set of an agent is the set of formulas that the agent believes in the given model. Note that K M,w i is a deductively closed set. We also define the objective belief set of agent i, (i.e., what i believes about the state of the world). This is the set O M,w i = K M,w i ∩ L CPL . Note that objective belief sets are deductively closed subsets of L CPL . Therefore, we have that objective belief sets are AGM belief sets.

In the following, we make the assumption that the new information is a consistent formula. Making a change by an inconsistent formula is allowed by AGM postulates, but it is not of much interest in practical applications. Furthermore, recall from Section 3.4.1 that axiom (D) forbids inconsistent beliefs.

V (w ) = V (w) (no factual change) (E + a 0) If M, w B a ¬ϕ then M, w + a ϕ ∈ KD45 n (closure) (E + a 1) M, w + a ϕ B a ϕ (success) (E + a 2) M, w B i ψ iff M, w + a ϕ B i ψ, for i = a (privacy) (E + a 3) If M, w B a ¬ϕ then M, w B n a B i ψ iff M, w + a ϕ B n a B i ψ for a = i and n ≥ 1 (believed privacy) (E + a 4) If M, w B a ψ then M, w + a ϕ B a ψ (inclusion) (E + a 5) If M, w B a ϕ then ( M, w + a ϕ) M, w (vacuity) (E + a 6) If M 1 , w 1 B a ψ implies M 2 , w 2 B a ψ then M 1 , w 1 + a ϕ B i χ implies M 2 , w 2 + a ϕ B i χ (monotonicity) (E + a 7) For all M , w , if M , w satisfies (E + a 1)-(E + a 7) then M, w + a ϕ B a ψ implies M , w B a ψ (minimality) (E + a 8)

Private Expansion

Private Expansion Postulates

In this section, we focus on private expansion, i.e., only one agent increases her beliefs. Beliefs of other agents, as well as the higher order beliefs, remain unchanged. Hereafter, we note a the agent that performs the belief change.

The result of the private expansion of a pointed Kripke model M, w by ϕ ∈ L CPL for agent a is a new pointed Kripke model M, w + a ϕ. The AGM postulates for expansion can be rewritten for KD45 n models, as depicted in Table 6.1.

Postulate (E + a 0) stipulates that the actual world does not change. As usual in belief revision, the state of the world does not change1 , only the agents beliefs are allowed to change. Postulate (E + a 1) stipulates that, if the new information does not contradict agent a beliefs, then the resulting model remains a KD45 n model after the private expansion. Indeed, when the expansion is done by a formula that contradicts agent a beliefs, the result infringes axiom (D) for agent a. This means that the postulates in Table 6.1 are a conservative extension of the usual AGM expansion ones.

A Private Expansion Operator

Now, we give a constructive definition of the private expansion operator characterized in the previous section.

Hereafter, we use v x w to denote a copy of the possible world w, but having the Boolean valuation x. Definition 6.2 (Expansion of M, w 0 by ϕ for agent a.). Let M, w 0 = W, R, V, w 0 be a KD45 n pointed model, and ϕ be a consistent objective formula (i.e., ϕ ∈ L CPL and ¬ϕ). The private expansion of M, w 0 by ϕ for agent a is M, w 0 + a ϕ = W , R , V , w 0 , such that: On the middle, the sets X and W q (Definition 6.2). The model on the bottom corresponds to the expansion by q for agent 1, i.e., M, w 0 + 1 q.

• W = {w 0 } ∪ W ∪ W ϕ , where -W ϕ = w∈Ra(w0) W ϕ w -W ϕ w = x∈X {v x w } -X = {V (w) | w ∈ R a (w 0 ) ∩ ϕ M } • R a = R a ∪ R ϕ a ∪ R 0 a , where -R ϕ a = {(w ϕ 1 , w ϕ 2 ) | w ϕ 1 , w ϕ 2 ∈ W ϕ } -R 0 a = {(w 0 , w ϕ ) | w ϕ ∈ W ϕ } • R i = R i ∪ R - → ϕ i ∪ R 0 i , for i = a, where -R - → ϕ i = {(v x w , w ) | i(w, w ) ∈ R i and v x w ∈ W ϕ }, for i = a M, w 0 pq w 0 pq w 1 1 1,2 1,2 X = {pq} w 1 = v pq w0 et w 2 = v pq w1 W q = {w 1 , w 2 } M ,
( , ∅) For example, the event model that corresponds to the private expansion for q by 1 in Example 6.1 is depicted in Figure 6.2. The reader may verify that the update of the pointed Kripke model M, w 0 in Figure 6.1 by event e 0 in Figure 6.2 is bisimilar to the pointed Kripke model M , w 0 in Figure 6.1.

A General Expansion Operator

An interesting question is whether the private expansion operator can be generalised to groups of agents. To answer this question, we first need to make more precise what we mean by generalisation. Assume that a group of agents G ⊆ A receives a new piece of information ϕ, there are several possibilities: Multiple Expansion: Each agent of the group makes a private expansion by ϕ. As a result, ϕ is believed by each agent in the group, but higher order believes do not change.

Common Expansion: All agents in the group make a public expansion by ϕ. As a result, ϕ is commonly believed among the agents in the group, but beliefs about the agents outside the group do not change.

Mixed Expansion: A mix of both kinds of expansions above.

It turns out that all three kinds of expansion are possible. Multiple expansion is simple. It amounts to make one private expansion for each member of group G. Common The only difference between the event model for private expansion we saw before and the event model in Definition 6.3 above is the replacement of a for G. Figure 6.3 schematically illustrates this operator. When e 0 occurs, the agents performing the expansion believe that event e ϕ is occurring, while the other agents believe that event e is occurring. In both events e 0 and e nothing changes. In e ϕ , only the beliefs of agents in G changes. Moreover, the higher beliefs of agents in G do not change, because they all believe that the agents not in G believe that e is occurring.

Note that formula ϕ in Definition 6.3 can be a subjective formula. In fact, the common expansion operator defined above is a completely general expansion operator.

We have the following result.

Proposition 6.5. Let M, w 0 , ϕ and G be as in Definition 6.3. For each a ∈ G, we have O

M,w0 + G ϕ a = O
M,w0 +aϕ a . Proposition 6.5 above means that operator + G is an AGM expansion for each agent a ∈ G. In particular, it means that postulates (E + a 0)-(E + a 8) are satisfied for each a ∈ G and i ∈ G. In fact, the common expansion operator should satisfy a stronger versions of the postulates in Table 6.1. The third possibility of expansion amounts to a sequence of expansions. One private expansion for each agent that expands privately and one common expansion for each group that expands commonly.

V (w ) = V (w) (no factual change) (R a 0) M, w a ϕ ∈ KD45 n (closure) (R a 1) M, w a ϕ B a ϕ (success) (R a 2) M, w B i ψ iff M, w a ϕ B i ψ, for i = a (privacy) (R a 3) M, w B k a B i ψ iff M, w a ϕ B k a B i ψ for i = a and k ≥ 1 (believed privacy) (R a 4) If M, w a ϕ B i ψ then M, w + a ϕ B i ψ (inclusion) (R a 5) If M, w B a ¬ϕ then M, w + a ϕ M, w a ϕ (vacuity) (R a 6) If M 1 , w 1 M 2 , w 2 and ϕ ↔ ψ then M 1 , w 1 a ϕ M 2 , w 2 a ψ (extensionality) (R a 7) If M, w a (ϕ ∧ ψ) B i χ then ( M, w a ϕ) + a ψ B i χ (iterated inclusion) (R a 8) If M, w a ϕ B a ¬ψ then ( M, w a ϕ) + a ψ B i χ implies M, w a (ϕ ∧ ψ) B i χ (iterated vacuity) (R a 9)

Private Revision

Private Revision Postulates

Private revision behaves as expansion when there is no inconsistency between the agents beliefs and the new piece of evidence, but, unlike expansion, do not trivialize when this is not the case.

We denote the result of the private revision of the model M, w by a consistent CPL formula ϕ for agent a by the model M, w a ϕ = M , w = W , R , V , w . The AGM postulates for revision can be rewritten as in Table 6.2.

As for expansion, (R a 0) stipulates that there is no change on the actual world. (R a 1) stipulates that the model obtained after a revision is a KD45 n model. It also guarantees that K M,w a a is a belief set. (R a 2) stipulates that ϕ is believed by a after the revision. Thus, we have that ϕ ∈ K M,w a . (R a 3) stipulates that the beliefs of all agents except a do not change. (R a 4) stipulates that the beliefs of the agent a about other agents do not change. (R a 5) and (R a 6) stipulate that, when the new piece of evidence is consistent with the beliefs of the agent, revision is just expansion. (R a 7) is an irrelevance of syntax postulate, stipulating that, if two formulas are logically equivalent, then they lead to the same revision results. (R a 8) and (R a 9) stipulate when the revision by a conjunction can be obtained by a revision followed by an expansion.

The revision operators we define are a conservative extension of usual AGM belief revision operators.

A Family Of Private Revision Operators

Let us now define a family of private revision operators. These operators are defined similarly to the expansion operator of the previous section, but in the cases when the new piece of evidence is inconsistent with the current beliefs of the agent they use a classical AGM belief revision operator * in order to compute the new beliefs of the agent. Definition 6.4 (Revision of M, w 0 by ϕ for agent a). Let M, w 0 = W, R, V, w 0 be a KD45 n model, let ϕ be a consistent CPL formula (i.e., ϕ ∈ L CPL and ¬ϕ), and let * be an AGM revision operator. We define the private revision of M, w 0 by ϕ for agent a (with revision operator * ) as M, w 0 * a ϕ = W , R , V , w 0 , such that:

• if R a (w 0 ) ∩ ϕ M = ∅ -then X = {V (w) | w ∈ R a (w 0 ) ∩ ϕ M } -else X = {x | x ⊆ P and x O M,w0 a * ϕ} • W = W ∪ W ϕ ∪ {w 0 }, where: -W ϕ = w∈Ra(w0) W ϕ w -W ϕ w = x∈X {v x w } • R a = R a ∪ R ϕ a ∪ R 0 a , where: -R ϕ a = {(w ϕ 1 , w ϕ 2 ) | w ϕ 1 , w ϕ 2 ∈ W ϕ } -R 0 a = {(w 0 , w ϕ ) | w ϕ ∈ W ϕ } • R i = R i ∪ R - → ϕ i ∪ R 0 i for i = a, where: -R - → ϕ i = {(v e w , w ) | (w, w ) ∈ R i , v e w ∈ W ϕ }, for i = a -R 0 i = {(w 0 , w) | (w 0 , w) ∈ R i }, for i = a • V (w) = V (w), for w ∈ W • V (v x w ) = x, for v x w ∈ W ϕ • V (w 0 ) = V (w 0 )
The construction of the revised model is similar to the construction of the expanded model discussed earlier. Only the new set of worlds W ϕ is different: if the new information ϕ is considered possible by agent i, she performs an expansion, otherwise, each of the worlds of the new set W ϕ has as valuation a (propositional) model of the new information ϕ.

The next result shows that these operators exhibit good logical properties.

Proposition 6.8. The operators * i satisfy (R a 0)-(R a 9). Example 6.2. We consider the model M, w 0 in Figure 6.4, where agent 1 believes ¬p∧ ¬q and believes that agent 2 believes p ∧ q. Agent 2 believes p ∧ q and believes that agent 1 believes p ↔ q. After the revision by p ∧ q, agent 1 believes p ∧ q, whereas the beliefs of agent 2 remain unchanged. The obtained model M , w 0 is also depicted in Figure 6.4. In this example, agent 1 uses Dalal's AGM revision operator * D [START_REF] Katsuno | Propositional knowledge base revision and minimal change[END_REF]. We can observed that the revised model obtained using Definition 6.4 may not be minimal, in the sense that there may exist a smaller bisimilar model. Nevertheless, a minimal model can be obtained via bisimulation contraction. Here, this leads to the model M , w 0 , depicted in the same figure.

Similarly to expansion, we can also define a model update that performs the revision. The event model in Definition 6.5 is similar to the one for expansion. The difference is that the possible event e ϕ is replaced for a clique of possible events e x w . When e 0 occurs, agent a believes that one of the events e x w is occurring. As a result of the update, each possible world w ∈ R a (w 0 ) will be replaced by a set of possible worlds w.e x w , where x ∈ X, with a new valuation that satisfies ϕ in the resulting model. For example, the event model that corresponds to the revision in Example 6.2 is the following:

N 1 = E, P, pre, post E = {e 0 , e , e pq
w1 , e pq w2 } P 1 = {(e 0 , e pq w1 ), (e 0 , e pq w2 ), (e pq w1 , e pq w1 ), (e pq w1 , e pq w2 ), (e pq w2 , e pq w2 ), (e , e )} P 2 = {(e 0 , e ), (e , e ), (e pq w1 , e )(e pq w2 , e )} pre(e 0 ) = ¬p ∧ q pre(e pq w1 ) = p ∧ q pre(e pq w2 ) = p ∧ q pre(e ) = post(e pq w1 ) = {(p, ), (q, )} post(e pq w2 ) = {(p, ), (q, )}

The reader may verify that the product between the pointed Kripke model M, w 0 in Figure 6.4 and the model above is bisimilar to the pointed Kripke model M , w 0 in Figure 6.4. As for expansion, multiple revision can be achieved with a sequence of private revisions, one for each agent. Common and subjective revision, however, are trickier. Note that the set W ϕ in Definition 6.4 is defined using the set R a (w 0 ) and an AGM revision of the objective believe set O M,w0 a . When trying to generalise revision for multiple agents, we then have two problems. The AGM revision operator is only defined for one agent, and it is only defined for objective formulas.

We can think of a way of circumventing this problem. We could replace those sets for their "natural" multi-agent versions, i.e., R G (w 0 ) = a∈G R a (w 0 ) and and

O M,w0 G = a∈G O M,w0 a
. However, it is not completely clear what properties (postulates) a revision operator defined in this way would satisfy. Therefore, this is left as an open question.

Related Work

There are other studies on the connections between dynamic epistemic logics and belief change theory, e.g., by Baltag andSmets (2006), van Benthem (2007), [START_REF] Board | Dynamic interactive epistemology[END_REF]van Ditmarsch (2005). These studies investigate how to encode belief change operators within epistemic models with accessibility relations representing plausibility levels, similar to Grove's systems of spheres [START_REF] Grove | Two Modellings of Theory Change[END_REF]). These plausibility levels guide the revision process. Contrastingly, we study here how to perform belief revision (and expansion) on a KD45 n model, representing the beliefs of a group of agents.

In the same vein, [START_REF] Tallon | Communication among Agents: A Way to Revise Beliefs in KD45 Kripke Structures[END_REF] study what they call revision of KD45 n models due to communication between agents: some agents (publicly) announce (part of) their beliefs. Their model is closer to expansion than to true revision, and concerns only subjective beliefs. [START_REF] Herzig | Action progression and revision in multiagent belief structures[END_REF] study action progression in multi-agent belief structures. Their work is mainly about the effects of actions using update, but they also briefly mention the problem of revision by objective formulas. Their construction is related to the one we point out, but they do not study the properties of the operators they considered.

Finally, the closest work is the study of private expansion and revision made by [START_REF] Aucher | Perspectives on belief and change[END_REF]Aucher ( , 2010)). The difference is that Aucher considers an internal model of the problem, i.e., a model of the situation viewed from each agent, so he does not use a KD45 n model for modeling the system, but one internal model by agent. He uses a notion of multi-agent possible worlds in order to compute the result of the revision, so the result of the revision is a set of such multi-agent worlds, whereas in this work we work with KD45 n models, and we obtain a unique KD45 n model as result of a revision.

It is easy to find a translation between internal models and KD45 n models, so one can look at the technical details between the expansion and revision operators we present in this work and the one proposed (on internal models) in [START_REF] Aucher | Perspectives on belief and change[END_REF](Aucher , 2010)). Concerning expansion, it turns out that the two operations are equivalent (that is not surprising since we proved that there is only one rational expansion operator). First, note that it is possible to obtain an internal model I M for agent a ∈ A from any KD45 n model M, w . Indeed, it suffices to consider the set formed of models M k , w k generated from each w k such that w k ∈ R a (w 0 ). Similarly, it is possible to obtain an internal event model I N +a for agent a ∈ A from the pointed event model N +a , e 0 . Now, it is easy to see that the internal model for a obtained from the product of M, w 0 by N +a , e 0 is the same as the product of I M by I N +a . Concerning revision, the situation is different. Aucher allows revision by subjective formulas and compute distances between the corresponding (epistemic) models. We are interested here only by revision with objective formulas. In this particular case Aucher's revision does not allow the agent concerned by the private revision to choose among the models of the objective formulas, the ones that are the most plausible, this is problematic since this is the basic aim of belief revision. We can do that thanks to the underlying AGM revision operators in the definition of the private revision operator. So our private revision result implies (usually strictly) the result given by Aucher's revision.

Conclusion

This chapter investigates the problem of belief change in a multi-agent context. More precisely, it studies private expansion and revision of KD45 n models by objective formulas. We saw a set of postulates for expansion and for revision which are close to the classical AGM ones for the single agent case. We also saw definitions of specific expansion and revision operators that satisfy the desired properties.

All results showed in this chapter would most probably hold for K45 n models as well. The advantage of using such models is that the absence of axiom (D) permits situations where agents have trivial belief sets, i.e., K M,w i = L ML (and thus O M,w i = L CPL ). Consequently, the assumption that formula ϕ is consistent can be dropped for both expansion and revision operators. Similarly, the condition ' M, w B i ¬ϕ' can be dropped for postulates (E + a 1), (E + a 4). This slightly modified framework is therefore even better as a generalisation of AGM belief change to multi-agent settings.

The problem of revising by subjective formulas is not addressed in this work. As mentioned before, this is more complicated and richer than we studied here due to the minimality of change requirement. A different approach would be to investigate metrics that can be used to define minimal change for revision. In another piece of work not described here (Caridroit et al. 2016), we define and study a number of distances between Kripke models. There, we show how these distances can be used to compute, given an initial model and a formula ϕ, the "most similar" Kripke model satisfying ϕ.

Complexity issues of belief change operators in multi-agents settings have not been addressed either. As seen in Section 3.6, KD45 n satisfiability checking is PSPACEcomplete. Thus, we have reasons to thrust that belief change in this setting is "more difficult" than in CPL. If that is the case, one way of maybe circumventing this problem is to use fragments of the language. Such kind of approach have been studied, for instance, by [START_REF] Creignou | Belief Contraction Within Fragments of Propositional Logic[END_REF][START_REF] Creignou | Belief revision within fragments of propositional logic[END_REF] and [START_REF] Delgrande | Revising Horn Theories[END_REF]. Moreover, note that description logics are close related to modal logics, which means that they could also be candidates for settings with better complexities. Approaches for belief change in description logics have been studied, e.g., by [START_REF] Benferhat | Assertionalbased Prioritized Removed Sets Revision of DL-LiteR Knowledge Bases[END_REF]Benferhat et al. ( , 2017)).

Some straightforward generalisations to group expansion have been considered in this chapter. Remark, however, that multi-agent belief revision permits even more possibilities than those listed in Section 6.2.3. Recall that the private revision operators are defined using AGM revision operators * . This means that, in a group revision, each agent could choose a different revision operator. If that were the case, the question now would be: what about the interactions between the agents? I mean, should an agent i assume that another agent j uses the same revision operator as herself? If not, what operator i should chose for j? And, what i thinks that j would chose for i?

It seems that we could model this by adding to the framework yet another epistemic model, where possible worlds would be "possible revision operators", and that new, very general, multi-agent belief revision operators could be defined using this model. However, the way this could be translated into concrete revision operators is left as an open question.

Chapter 7

Methods for Automated Reasoning in Modal Logic

In this chapter, we will study methods for satisfiability checking in some modal logics. This topic is rather different from the ones studied before in this thesis. Nonetheless, I consider this a very important topic for my personal research. The reason is that all the theoretical investigation we saw up till now in this thesis aims at providing formalisms for reasoning. Reasoning about actions, abilities, knowledge, beliefs, responsibility, time, and all this in multi-agent systems. But the idea is not just reason about toy examples and small problems, and certainly not with just pen and paper. The ultimate goal of this research is to provide tools to reason about real life problems, and to do so automatically, with a computer. My intention is to convince people that such a goal is attainable. Therefore, I consider it part of my job to produce some piece of software that performs, at least, some of those reasoning tasks. The contents of this chapter is just the beginning of that endeavour.

This chapter brings together results published with several colleges in a couple of papers, namely, (Caridroit et al. 2017) and [START_REF] Lagniez | A Recursive Shortcut for CEGAR: Application To The Modal Logic K Satisfiability Problem[END_REF]. The introduction below motivates the choice of studying logics KT5 and K, and the choice of studying satisfiability checking for these formalisms. Section 7.2 shows the method for satisfiability checking formulas in KT5. It presents the technique used and some experiments showing that such a technique performs well among all other alternatives. Section 7.3 shows a different method of reasoning, this time for satisfiability checking formulas in K. As before, it presents the techniques used and some experiments. Finally, Section 7.4 concludes the chapter.

Introduction

In the formalisms we saw, the reasoning tasks we want to perform are usually among the following ones: Consequence checking. For example, assume that, given some conditions described as a set of formulas Γ, we want to know whether agent i would believe that ϕ under assumptions Γ. In KD45 n , it amounts to decide whether, for all pointed Kripke models M, w satisfying Γ, it is the case that ϕ ∈ K M,w i . This is the same as to decide whether Γ B i ϕ in KD45 n . Validity checking. For example, assume that we want to know whether the group of agents G can achieve a state of affairs where ϕ is true, no matter what is the current situation. In ATDEL, it amounts to decide whether G ϕ.

Satisfiability checking.

For example, assume that we want to know whether there is a situation where the group G would be responsible for the outcome ϕ, if they execute joint action δ. In CEDL, it amounts to decide whether there is a model that satisfies R δ| G ϕ.

Model checking.

For example, assume that we want to know whether the agent i believes that ϕ is true in a given situation. In KD45 n , it amounts to decide whether ϕ ∈ K M,w i , which amounts to decide whether M, w B i ϕ.

As saw before (Section 3.6), model checking in modal logics is "easy", in the sense that its computational complexity is polynomial. Consequence, validity and satisfiability checking, though, are another story. First, note that these three tasks are strongly related (see Section 2.1.2). A formula is valid if and only if there is no model for its negation. Therefore, whenever one designs a complete algorithm for satisfiability checking, the same algorithm can be used for validity checking. In the case of consequence, for strongly complete logics, such as KD45 n , Γ ϕ is equivalent to ψ∈Γ ψ → ϕ. Therefore, a satisfiability checking algorithm can also be adapted for consequence checking. However, [START_REF] Ladner | The Computational Complexity of Provability in Systems of Modal Propositional Logic[END_REF] showed that the satisfiability problem for several modal logics including K, KT and KT4 are PSPACE-Hard, while it is NP-Complete for single-agent KT5 (see also (Halpern and Rêgo 2007a,b) for more details).

Since recently, SAT solvers (computer programs that solve the satisfiability problem for CPL) have been used as quite efficient NP-oracles for some problems whose complexity is beyond NP [START_REF] Brummayer | Effective Bit-Width and Under-Approximation[END_REF]. By the way, SAT solvers have already been used in the context of modal logics (see for example [START_REF] Sebastiani | SAT Techniques for Modal and Description Logics[END_REF] for a comprehensive overview of the subject). For instance, *SAT (Giunchiglia and Tacchella 2000b;[START_REF] Giunchiglia | SAT-Based Decision Procedures for Classical Modal Logics[END_REF]) uses a SAT solver to decide satisfiability in 8 different modal logics, including K. A translation of modal logic K to CPL has been proposed in KM2SAT [START_REF] Sebastiani | Automated Reasoning in Modal and Description Logics via SAT Encoding: the Case Study of K(m)/ALC-Satisfiability[END_REF]. More recently, the solver InKreSAT [START_REF] Kaminski | InKreSAT: Modal Reasoning via Incremental Reduction to SAT[END_REF]) uses an innovative system, where the SAT solver drives the development of a tableau method.

Curiously, however, none of the methods aforementioned are applicable to modal logic KT5, the easiest one! Single-agent KT5 is considered an "easy" modal logic, because it is the only one in NP. This means that there is a polynomial algorithm that can translate KT5 to CPL. Therefore, the first thing we do here is exactly that: translate KT5 formulas to CPL and launch a SAT solver. However, we find out that this is less easy than announced.

The second thing we do in this chapter is to attack a more difficult satisfiability checking problem, the one in modal logic K. As for KT5, it is possible to translate K formulas into CPL formulas. But the translated formula can be exponentially larger than the original one. We then find out that the idea of just translating and sending to a SAT solver does not give satisfactory results. The solution described in this chapter is an improvement of the CEGAR (Counter-Example-Guided Abstraction Refinement) approach by [START_REF] Clarke | Counterexample-guided abstraction refinement for symbolic model checking[END_REF], that has been used in several different problems beyond NP.

The KT5-SAT problem

Because KT5-SAT, the problem of deciding satisfiability of formulas in KT5, is in NP, we know that there is a polynomial translation from KT5 formulas to CPL formulas. Therefore KT5-SAT is, in principle, "easy": just translate it to CPL and launch the best SAT solver available. However, before our paper (Caridroit et al. 2017), such method has never been tried! We actually did not know if this was better than to use a different method, such as a traditional tableau method for instance. This is so because the translation from KT5 to CPL is not direct. In fact, the translated formula must contain new propositional variables and the CPL formula outputted by the translation is larger than the original formula. Added to the fact that the translation itself might take some time to be performed, this could result in an less efficient method than the traditional tableau methods.

In this section, we try the method of translating KT5 formulas to CPL and launch a SAT solver. But, just to be sure that we are going to win, we propose here a "clever" translation. This translation introduces fewer fresh variables than the standard (naive) translation. We then provide experimental evidence that the proposed approach outperforms the state-of-the-art approaches on the benchmarks considered.

From KT5-SAT to SAT

It has been shown that, if a formula ϕ with n modal connectives is satisfiable in KT5, then there is KT5-model of ϕ with at most n + 1 possible worlds. As a consequence, we know that there exists an algorithm running in polynomial time able to transform the KT5-SAT problem into the SAT problem.

We transform KT5-SAT into SAT with a translation function trkt5. It takes a modal logic formula ϕ in NNF (Definition 2.15) and a natural number n as input, and produces a formula in L CPL . This translation is inspired by the standard translation from modal logic to first-order logic (Definition 3.11). Note that the accessibility relation does not need to be represented for a KT5-model, because it is an equivalence relation. Definition 7.1 (Translation from KT5 to CPL). Let ϕ ∈ L ML be in NNF:

trkt5(ϕ, n) = trkt5(ϕ, 1, n) trkt5(p, i, n) = p i trkt5(¬p, i, n) = ¬p i trkt5(ϕ 1 ∧ • • • ∧ ϕ k , i, n) = trkt5(ϕ, i, n) ∧ • • • ∧ trkt5(ϕ k , i, n) trkt5(ϕ 1 ∨ • • • ∨ ϕ k , i, n) = trkt5(ϕ, i, n) ∨ • • • ∨ trkt5(ϕ k , i, n) trkt5( ϕ, i, n) = n j=1 trkt5(ϕ, j, n) trkt5(♦ϕ, i, n) = n j=1 trkt5(ϕ, j, n)
To compute the translation of ϕ, it must be in NNF. As mentioned in Section 2.1.4, this operation can be performed in both polynomial time and space. Therefore, without loss of generality, we assume in the remainder of this chapter that the modal logic formulas considered are in NNF.

The translation trkt5 adds fresh propositional variables p i to the formula. Variable p i denotes the truth value of p in the possible world w i . If n is big enough, trkt5(ϕ, n) is equisatisfiable to ϕ. This is the case when n = nm(ϕ) + 1, where nm(ϕ) is the number of modal operators in ϕ.

Proposition 7.1. ϕ ∈ L ML is satisfiable in KT5 if and only if trkt5(ϕ, nm(ϕ) + 1) is satisfiable in CPL.

The proof of Theorem 7.1 is done in the same way as the standard translation to FOL plus Lemma 6.1 in [START_REF] Ladner | The Computational Complexity of Provability in Systems of Modal Propositional Logic[END_REF]).1 Also note that the accessibility relation R in KT5 is an equivalence relation. Therefore, it does not need to be represented.

For example, Figure 7.1 shows trkt5(♦(p ∧ q), 2). Note that the result of the translation is not in CNF. Thus, classical translation into CNF (such as in [START_REF] Tseitin | On the Complexity of Derivation in Propositional Calculus[END_REF]) is needed to use a SAT solver. As for NNF, the translation to CNF can also be performed in polynomial time and space.

A New Upper-Bound for the Translation

The length of trkt5(ϕ) depends on the number of modalities in ϕ, which we note nm(ϕ). In practice, this produces unreasonably large formulas. This is why we first tried to find out whether it is possible to decrease the value of n in trkt5. We found a smaller value for it that depends on the diamond degree of a formula. Definition 7.2 (Diamond Degree). The diamond degree of a modal logic formula ϕ in

♦ ∧ p q (a) ♦(p ∧ q) ∨ ∧ p 1 ∧ q 1 q 2 ∧ p 2 ∧ q 1 q 2 (b) trkt5(♦(p ∧ (q))
Figure 7.1 -Translation from KT5 to CPL NNF, noted dd(ϕ), is defined recursively, as follows:

dd( ) = dd(¬ ) = dd(p) = dd(¬p) = 0 dd(ϕ ∧ ψ) = dd(ϕ) + dd(ψ) dd(ϕ ∨ ψ) = max(dd(ϕ), dd(ψ)) dd( ϕ) = dd(ϕ) dd(♦ϕ) = 1 + dd(ϕ)
Informally, the diamond degree is an upper bound of the number of diamonds to be taken into account to satisfy the formula.

To show that the diamond degree is a valid value for n, we use a tableau method. Therefore, we need some additional definitions. The tableau defined below is similar to the one in Definition 3.16. The differences are due to the fact that KT5 is simpler than K and, therefore, the tableau can be simplified. Definition 7.3 (Tableau). Let ϕ be a KT5 formula in NNF. A tableau for ϕ is a set of pairs of the form (σ, ψ), where σ is a (possibly empty) sequence of natural numbers and ψ ∈ sub(ϕ). In addition, we have that (0, ϕ) ∈ T and, for all sequences σ, T satisfies the following conditions:

1. (σ, ¬ ) ∈ T . 2. (σ, p) ∈ T if and only if (σ, ¬p) ∈ T . 3. if (σ, ψ 1 ∧ ψ 2 ) ∈ T then (σ, ψ 1 ) ∈ T and (σ, ψ 2 ) ∈ T . 4. if (σ, ψ 1 ∨ ψ 2 ) ∈ T then (σ, ψ 1 ∈ T ) or (σ, ψ 2 ) ∈ T . 5. if (σ, ψ 1 ) ∈ T then ∀(σi, χ) ∈ T we have (σ, ψ 1 ) ∈ T . 6. if (σ, ♦ψ 1 ) ∈ T then (σi, ψ 1 ) ∈ T , for some i ∈ N.
Lemma 7.2. Let ϕ be a KT5 formula in NNF. There is a tableau for ϕ if and only if ϕ is satisfiable.

Let T be a tableau for ϕ. The number of different sequences σ in T depends on the number of times the condition involving operator ♦ is triggered. It is possible to show, by induction on the structure of ϕ, that this number is bounded by dd(ϕ).

Lemma 7.3. Let ϕ be a KT5 formula in NNF. The number of different sequences σ in the tableau for ϕ is bounded by dd(ϕ).

Each σi in the tableau T corresponds to a w i ∈ W in the KT5-model, |T | ≤ dd(ϕ) means that the number of possible worlds in the model is bounded by dd(ϕ).

Theorem 7.4. If ϕ ∈ L ML is satisfiable, then trkt5(ϕ, dd(ϕ)) is satisfiable.

Structural Caching

Caching is a classical way to avoid redundant work. For instance, the modal logic solver *SAT performs caching using a "bit matrix" (Giunchiglia and Tacchella 2000a). Efficient implementations of BDD packages (such as [START_REF] Bryant | Graph-Based Algorithms for Boolean Function Manipulation[END_REF])) also rely on caching to build an explicit graph. These two examples require additional time and space to store and search among already performed work.

The technique we use here is a "simple but efficient" trade-off. It does not memorize the work already done. Thus, it may not cache all possible formulas, but it does not have any additional cost.

As an example, let the formula ϕ = ♦(p ∧ ♦q) be given. Both translation techniques are depicted in Figure 7.2. The formula in Figure 7.2b contains two copies of (q 1 ∨ q 2 ). This happens because the translation of the first diamond creates two sub-formulas p 1 ∧ ♦q and p 2 ∧ ♦q, where each ♦q needs to be translated. Because we are in KT5 (where all possible worlds are connected to each other in the model), both translations of ♦q are equivalent. This means that we can reuse the same sub-formula. Therefore, instead of using a tree, we can use a directed acyclic graph (DAG), which also allows us to translate the CPL formula into CNF more efficiently. Lemma 7.5. trkt5(•ϕ, i, n) = trkt5(•ϕ, j, n) ∀i, j and • ∈ { , ♦} Proof. There are two possible cases:

1. If (• = ) then, trkt5( ϕ, i, n) = n k=1 trkt5(ϕ, k, n) = trkt5( ϕ, j, n) 2. If (• = ♦) then trkt5(♦ϕ, i, n) = n k=1 trkt5(ϕ, k, n) = trkt5(♦ϕ, j, n) Therefore, we have trkt5(•ϕ, i, n) = trkt5(•ϕ, j, n).
Informally, Lemma 7.5 implies that no matter how deep in the tree the sub-formula •ϕ is, its translation is always the same. Therefore, we can translate the deepest subformula first and then backtrack. For example, in Figure 7.2(b), the same sub-formula appears twice, which means that we can use only one of its occurrences, such as in Figure 7.2(c). We denote this modified translation function trkt5 + . Structural caching is thus performed on the fly when translating the modal logic formula into propositional logic, before translating the formula in CNF. practice) that the translated formula may not fit into the computer memory. When that happens, it is just not possible to find a model for the formula.

♦ ∧ p ♦ q (a) ϕ = ♦(p ∧ ♦q) ∨ ∧ p 1 ∨ q 1 q 2 ∧ p 2 ∨ q 1 q 2 (b) trkt5(ϕ, dd(ϕ)) ∨ ∧ p 1 ∨ q 1 q 2 ∧ ∨ q 1 q 2 p 2 (c) trkt5 + (ϕ, dd(ϕ))
To make things even more difficult, the diamond degree cannot be used in modal logic K. The example below shows us why.

Example 7.1. Let the formula ϕ be:

(p 1 ∧ p 2 ∧ p 3 )∧ (♦(p 1 ∧ p 2 ∧ ¬p 3 ∧ (p 1 ∧ ¬p 2 ∧ p 3 )))∧ (♦(p 1 ∧ ¬p 2 ∧ ¬p 3 ∧ (¬p 1 ∧ ¬p 2 ∧ p 3 )))∧ ( ♦p 3 )
Its diamond degree is dd(ϕ) = 3. This formula is satisfied, e.g., by the model below.

p 1 , p 2 , p 3 p 1 , p 2 , ¬p 3 p 1 , ¬p 2 , ¬p 3 p 1 , ¬p 2 , p 3 ¬p 1 , ¬p 2 , p 3
However, the reader may verify that it is not possible to find a model satisfying ϕ with less than 5 possible worlds.

To handle the K-SAT problem, we use here an improvement of the CEGAR approach [START_REF] Clarke | Counterexample-guided abstraction refinement for symbolic model checking[END_REF], whose the original idea is as follows. Imagine a very large CPL formula in CNF. Instead of giving it directly to the SAT solver, we give only part of it, and then ask for a model. If the SAT solver answers UNSAT, then the entire formula is UNSAT. Our program can just return UNSAT and we are done (this is the UNSAT shortcut). On the other hand, if the SAT solver gives us a model, then it is easy (can be done in linear time) to verify if that model is a model for the entire formula. If we are lucky, it is so. In this case, the program can just return that model and we are done. If we are not so lucky (i.e., the SAT solver find a model that does not satisfy the entire formula) then we go for another run: we add some constraints to prevent the sat solver from finding the same model again and give it a bigger part of the original formula, hoping to be luckier this time (this is the refinement step). In the worst case, either the program runs out of memory (in which case the program returns UNKNOWN), or we end up giving the entire original formula to the SAT solver (in which case it will decide its satisfiability anyway).

This framework has been applied in various areas: Satisfiability Modulo Theory [START_REF] Brummayer | Effective Bit-Width and Under-Approximation[END_REF], Planning [START_REF] Seipp | Counterexample-Guided Cartesian Abstraction Refinement[END_REF] and, more recently, QBF [START_REF] Janota | Solving QBF with counterexample guided refinement[END_REF]. Several previous SAT-based approaches have already been proposed in the field of modal logic [START_REF] Sebastiani | Automated Reasoning in Modal and Description Logics via SAT Encoding: the Case Study of K(m)/ALC-Satisfiability[END_REF]. One could argue that *SAT [START_REF] Giunchiglia | SAT-Based Decision Procedures for Classical Modal Logics[END_REF]) is already a CEGAR approach for the modal logic K.

In this chapter, we present an extension of CEGAR which includes a recursive step to introduce a new shortcut in the original procedure. We call this extension Recursive Explore and Check Abstraction Refinement (RECAR). The idea of mixing SAT and UNSAT shortcuts in a CEGAR procedure is not new: it has been already used for SMT [START_REF] Brummayer | Effective Bit-Width and Under-Approximation[END_REF] and for bug detection [START_REF] Wang | Induction in CEGAR for Detecting Counterexamples[END_REF]. The novelty here is that we use an abstraction of the original problem in the loop, made possible by a recursive call to the main procedure.

The RECAR procedure is generic, i.e., it is not bound to a specific domain. We present the conditions required on the abstractions used, and the correctness of the approach. We instantiate the framework for the satisfiability of modal logic K, by providing abstraction functions for this problem and experimental results of the approach against state-of-the-art solvers.

CEGAR Preliminaries

Counter-Example-Guided Abstraction Refinement (CEGAR) is an incremental way to decide the satisfiability of formulas in CPL. It has been originally designed for model checking (Clarke et al. 2003), i.e., to answer questions such as 'does Γ ψ?' or, equivalently, "is Γ ∧ ¬ψ unsatisfiable?", where Γ describes a system and ψ a property. In such highly structured problems, it is often the case that only a small part of the formula is needed to answer the question. The idea behind CEGAR is to replace ϕ = Γ ∧ ¬ψ by an approximation ϕ , where ϕ is easier to solve in practice than ϕ. There are two kinds of approximations:

• an over-approximation of ϕ is a formula φ such that φ ϕ holds, i.e., φ has at most as many models as ϕ;

• an under-approximation of ϕ is a formula φ such that ϕ φ holds, i.e., φ has at least as many models as ϕ.

Usually, ϕ is in CNF. Then, a classical way to under-approximate ϕ is to remove some clauses from it. In other words, φ is a subset of the clauses in ϕ. A model of φ also may by chance satisfy ϕ. Moreover, if φ is found to be unsatisfiable, then so is ϕ. This double possibility to conclude earlier makes under-approximation based CEGAR very popular. A classical way to over-approximate is to bound the generation of the formula ϕ to a given number n smaller than the one needed to reach equisatisfiability to the original problem (as in bounded model checking [START_REF] Clarke | Counterexample-guided abstraction refinement for symbolic model checking[END_REF] or planning [START_REF] Seipp | Counterexample-Guided Cartesian Abstraction Refinement[END_REF]). In this case, a model of φ can be extended to a model of ϕ, but the unsatisfiability of ϕ means that n has to be incremented and the process repeated. An example of a CEGAR algorithm using over-approximations is given on Algorithm 7.1. It receives a formula ϕ as input and computes an over-approximation ψ. Then it uses a oracle (usually a SAT solver) to check whether ψ is satisfiable. If so, it returns SAT. Otherwise, ψ is refined (i.e., it gets closer to ϕ) until it is satisfiable, or until the refined over-approximation is detected to be equisatisfiable to ϕ. Function eqsat(ϕ, ψ) denotes an incomplete but efficient equisatisfiability test, which returns true if it is able to detect that ϕ sat ≡ ψ and false otherwise. Recent SAT solvers are able to check satisfiability under assumptions [START_REF] Eén | An Extensible SAT-solver[END_REF]. This means that, assuming a given set of literals are satisfied, provide, in case of unsatisfiability, a "reason", in terms of those literals, for the unsatisfiability of a formula. Formally, we have the following. Let ϕ be in CNF and A be a consistent set of literals from ϕ. Let ϕ be satisfiable and (ϕ ∧ a∈A a) be unsatisfiable. L ⊆ A is an unsatisfiable core of ϕ if and only if (ϕ ∧ l∈L l) is unsatisfiable.

Therefore, a SAT solver for ϕ, given A, can be seen as a procedure providing a pair (d, r) with d ∈ {SAT, UNSAT} and r is a model of ϕ if d = SAT or an unsatisfiable core of ϕ if d = UNSAT. Modern SAT-based procedures are able to take r into account in both cases. Unsatisfiable cores have been used, for instance, in a CEGAR approach for deciding satisfiability of formulas in the propositional fragment of first-order logic [START_REF] Khasidashvili | EPR-based k-induction with Counterexample Guided Abstraction Refinement[END_REF].

Recursive Explore and Check Abstraction Refinement

A classic CEGAR approach with over-approximation and a SAT shortcut performs well when the input is satisfiable. But, generally, it does not perform well when the input is unsatisfiable. The reason is that it may have to keep refining until it reaches equisatisfiability with the original problem. One way to address this issue is to mix SAT and UNSAT shortcuts, as in [START_REF] Brummayer | Effective Bit-Width and Under-Approximation[END_REF] and [START_REF] Wang | Induction in CEGAR for Detecting Counterexamples[END_REF]. In these approaches, the methods alternate between over and under approximations.

Recursive Explore and Check Abstraction Refinement (RECAR), depicted in Algorithm 7.2, interleaves both kinds of approximations. Each abstraction is performed with the information retrieved from solving the previous one. The UNSAT shortcut is implemented using a recursive call to the main procedure when a strict under-approximation φ can be built. It is function 'rc()' that verifies if the under-approximation is strict.

One should also note that the proposed approach permits abstractions on two different levels: one is used to simplify the problem at the domain level (recursive call), while the other one is used to approximate the problem at the oracle (function 'check()') level.

In order to be able to apply RECAR, the under-and over-approximations must satisfy some properties. In the following, we use 1 and 2 to denote two possibly different consequence relations (two different logics). Let under(ϕ) = φ. We also use refine n () and under n () to indicate n successive applications of functions refine() and under(), respectively. Theorem 7.7 (Completeness). If recar(ϕ) returns UNSAT then ϕ is unsatisfiable.

The intuition behind the proof of Theorem 7.8 below is that the function performs a finite number of recursive calls (by Assumption 5). Moreover, each of these calls has a finite number of refinements before terminating (by Assumption 3).

Theorem 7.8 (Termination). RECAR terminates for any input ϕ.

An Implementation of RECAR for Modal Logic

In order to be able to apply RECAR to modal logic K, we need to find over-and under-approximations respecting all five RECAR assumptions. First, we show the overapproximation used in our solution.

Over-approximation

The over-approximation function used in our K-SAT solver uses a translation from ML to CPL that is similar to the one in Definition 7.1. As already discussed, in the general case, this translation outputs a formula that is exponentially larger than the original one. The idea though, is to avoid using the translation naively. But first, let us see its definition. We assume a formula ϕ in NNF. (¬r a i,j ∨ mltr(ϕ, j, n))

Let ϕ be the input formula. As before, we have that, if mltr(ϕ, nm(ϕ)) is satisfiable in CPL then ϕ is satisfiable in K. However, mltr(ϕ, nm(ϕ)) can be very large. We therefore start with mltr(ϕ, n), for some small number n. If we find a model for this formula, then ϕ has a model, we can stop and return SAT. If we do not find a model, we increment n and start again. Formally, we have. Definition 7.6 (Over-approximation). Let ϕ ∈ L ML . The over-approximation of ϕ, denoted φ, is the formula mltr(ϕ, 1). Definition 7.7 (Over-approximation Refinement). Let 1 ≤ n ≤ nm(ϕ) + 1. The refinement of mltr(ϕ, n), noted refine(mltr(ϕ, n)) is the formula mltr(ϕ, n + 1). Theorem 7.9. If mltr(ϕ, n) is satisfiable then mltr(ϕ, n + 1) is satisfiable, for all 1 < n ≤ nm(ϕ) + 1.

Proof Sketch. The idea is that if ϕ is satisfied by a model M with n worlds, then we can find a model M with n + 1 worlds satisfying ϕ. The additional world is just not accessible from the ones already in M . Theorem 7.9 above means that RECAR Assumption 2 is satisfied by this overapproximation. Assumption 3 is also satisfied, because mltr(ϕ, n) sat ≡ mltr(ϕ, n + 1), for n > nm(ϕ). This allows us to use this over-approximation and refinement in the RECAR approach.

Under-approximation

To understand the intuition behind the under-approximation we use in our solver, let us see an example. Let ϕ = (♦p ∧ ¬p ∧ χ) for some χ ∈ L, where nm(χ) is huge. This is clearly unsatisfiable because (♦p ∧ ¬p) is unsatisfiable. One can see that right away without even knowing what χ looks like. However, a CEGAR approach using the over-approximation and refinement defined earlier will take a long time before finally conclude it. The reason is that each refinement mltr(ϕ, n+1) of the original formula will be shown unsatisfiable and it will not stop until the huge number nm(ϕ) + 1 is reached.

We found a way to avoid these pathological cases, as follows. Let us take that formula ϕ again. First, we add to each conjunct in ϕ a fresh variable s i (a selector) that will be assumed to be true by the SAT solver, as done in Figure 7.3. Then, we make the first over-approximation mltr(ϕ, 1) and give it to a modern SAT solver. The solver will return UNSAT with an unsatisfiable core. From this core, we extract a set of selectors core. Let us assume, in our example, that core = {s 1 , s 2 }. This means that the formula φ = (♦p ∧ ¬p), which is the one labelled by the selectors, is enough to prove the unsatisfiability of ϕ with only 1 possible world. Proving the unsatisfiability of φ will imply that ϕ is unsatisfiable. Note that, in this specific case, nm( φ) is much smaller than nm(ϕ). Thus, if we launch a SAT solver on mltr( φ, 1) will succeed right a way, while it may have failed for the entire formula ϕ. Formally, we have the following. The intuition of the proof is that each selector s i enables an operand in a conjunction of the formula. Each time function under() is called with a non-empty core, operands not enabled with a selector from the core will be removed from the formula.

Theorem 7.10 shows that function under() satisfies RECAR Assumption 4. To see that it also satisfies Assumption 5, note that the length of under n+1 (ϕ, core) is smaller or equal to that of under n (ϕ, core ) (even though the sets core and core usually differ).

MoSaiC is RECAR for K-SAT

Algorithm 7.3 shows the instantiation of RECAR to modal logic K satisfiability problem. It uses the over-and under-approximation defined in the previous sections.

This algorithm has been implemented by Valentin Montmirail in the solver MoSaiC. As before, MoSaiC uses the SAT solver Glucose [START_REF] Audemard | Improving Glucose for Incremental SAT Solving with Assumptions: Application to MUS Extraction[END_REF][START_REF] Eén | An Extensible SAT-solver[END_REF] to decide the satisfiability of each ψ. Some implementation details are not depicted in the algorithm. For instance, Glucose is not called on ψ but on an updated ψ with selectors on conjuncts under the assumption We can see on Figure 7.4 that MoSaiC with CEGAR is the worst solver whereas MoSaiC with RECAR outperforms all other solvers. Km2SAT has a specific technique to detect some unsatisfiable formulas without generating the CNF. This explains why it performs much better than the CEGAR approach. *SAT interleaves SAT reasoning and domain reasoning, and can be considered as an under-approximation CEGAR approach. It shows good results, despite being tied with the old SAT solver SATO. Spartacus is based on a tableau method, not on SAT. SAT based-techniques were not the best way to tackle such problems up to this work.

Conclusion

We saw in this chapter a reduction from KT5 to CPL that has been used to address the KT5-SAT problem using a SAT solver. This reduction uses a lower upper bound on the number of possible worlds of the model and also structural caching. We saw a comparison of this approach against solvers representing the state-of-the-art for KT5-SAT in a number benchmarks. The approach presented here outperforms those solvers.

Even if the benchmarks were not KT5 benchmarks, since they come from other modal logics, namely, K, KT and KT4, those results open interesting perspectives. For instance, satisfiability in KT5 entails satisfiability on less restrictive models, such as K, KT and KT4. Since S52SAT finds models in just a few seconds (2.06s median time), it could eventually be used as a preprocessing step for other modal logics.

The second part of this chapter presented the algorithm called recursive explore and check abstraction refinement (RECAR). We saw that, if the five RECAR conditions are fulfilled, the underlining algorithm is sound, complete and terminates. RECAR has been instantiated for the K-SAT problem in the solver MoSaiC, which has been compared to several other solvers on a number of benchmarks. It outperformed all those solvers on the benchmarks considered.

The natural continuation of this research is tackling the remaining modal logics in Figure 3.2. Actually, we have already started it. In a recent publication [START_REF] Lagniez | A Recursive Shortcut for CEGAR: Application To The Modal Logic K Satisfiability Problem[END_REF], we showed that, with some adaptations, MoSaiC can address all modal logics with axioms (T), (B), ( 4) and ( 5). The first experiments already show that MoSaiC is competitive on logics KT and KT4, but more improvements are on the way.

Chapter 8 Conclusion

This document describes part of the research I did in the past eleven years. Here, we saw that, in the first years, I worked on the formalisation of individual and collective responsibility in order to formalise the problem of many hands. To attain that objective, I designed coalition epistemic dynamic logic, a formalism capable of expressing agents actions, knowledge and, through abbreviations, also ability, knowing ability and obligation. The logic designed was apt to the task. Formalisations of different kinds of responsibility and also of the problem of many hands were proposed using this logic.

Towards the end of that first period, in part motivated by a number of questions left open for CEDL, I decided to design a similar, but more suitable formalism. The alternating-time dynamic epistemic logic has actions in "dynamic epistemic style", which permitted to address those open questions, as well as reasonable sized systems specifications.

Some years passed and the next natural step was enriching ATDEL. There were several possibilities. I decided that an interesting development would be the possibility of modeling environments where agents can have incorrect information, and where they are able to reconsider their knowledge base when they realise their mistakes. This lead me to the somewhat different area of belief revision theory. I then worked on that area with colleagues at the CRIL, aiming at finding generalisations of expansion and revision for multi-agents scenarios.

That topic is not yet closed. Some interesting possibilities for advancement of the work on belief revision are still possible. As it has been pointed out before, it comprises multi-agent revision by subjective formulas, and a very general kind of belief revision where different agents use different ways to revise their beliefs.

More recently, I decided to search for ways of putting in practice some of the theoretical investigations I did all these years. This lead me to the study of modal logic automated reasoning. Indeed, in the last part of this document, I described some research carried out with CRIL colleagues on that subject. Putting together our different expertises, the system built from that collaboration were able to outperform state-of-the-art techniques on modal logic automated reasoning.

This thesis obviously does not describe all the research work I did in the period. One interesting result not described here is (Herzig et al. 2009). On that paper, we investigate a logic called acceptance logic, which aims at modelling individual and collective acceptances. In that logic, formulas of the form A G:x ϕ read 'if the agents in the group G identify themselves with institution x then they together accept that ϕ'.

We extend that formalism by two dynamic modal operators. The first one models the event of agents learning some piece of information ψ in some context x. Technically, this is done using public announcements, i.e., public actions that make all agents in the environment commonly know that ψ is true. In the case here, ψ becomes commonly accepted in context x. The second operator models the event of agents shifting (changing) their acceptances in order to accept some piece of information ψ in context x.

We propose a sound and complete axiom system for this dynamic extension of acceptance logic. In addition, we show that this formalism can be used to model some interesting aspects of judgement aggregation. In particular, we apply it to the 'doctrinal paradox' [START_REF] Kornhauser | Unpacking the Court[END_REF][START_REF] Petit | Deliberative Democracy, the Discursive Dilemma[END_REF]. Because of a distinction between what agents accept in a context x and what agents believe, the doctrinal paradox does not necessarily lead to a contradiction, when formalised in that logic.

Another interesting result in the period is (Magnier and de Lima 2015). On that paper, we create a dialogical version of public announcement logic. In this version, the validity of a formula is defined via an argumentative game between two adversaries, the proponet and the opponent. The proponent starts a game by uttering a thesis (a formula) and then tries to defend it against the opponent. The opponent tries to refute the proponent's thesis. The moves in this game are either challenges on adversary's moves or defenses against adversary's challenges. The game is played with players acting alternatively. The game terminates when there are no more allowed moves. The proponent wins if there are no allowed moves for the opponent, and vice-versa.

We showed soundness and completeness of the game rules. The rules are made in such a way that simple adaptations can handle other systems, e.g., systems without the truth axiom, positive or negative introspection.

Future plans include the natural continuations aforementioned and a couple of new ideas.

For instance, I have started co-supervising a third Ph.D., now on the subject of intentions in epistemic games. The latter are games where players must have to take other players knowledge or beliefs into account to be able to play effectively. Common examples are Cluedo, Hanabi and most card games.

In this kind of game, some moves may reveal player's intentions. For example, in a collaborative game like Hanabi, a player may try to communicate with her partner by playing some specific card. In a competitive game, a player may try to make the opponent believe that she has some important card, in order to make the opponent take a "bad" decision.

The project has two phases. The first one is to propose a logical modelling of intentions in epistemic games. This can be done using the formalisms we saw here, i.e., logics of action, knowledge, belief, abilities, etc.. The second phase is to use this modelling to explain players decisions in the course of games.

Detection of players intentions is generally computationally expensive. The time allotted to each player is often too short to allow performing this task during the game. But it is possible to study games off-line in order to, e.g., identify bad moves or explain good ones. This second phase will use the results on modal logic automated reasoning.

Résumé

Ce travail présente quatre des mes résultats de recherche les plus importants obtenus après ma thèse de doctorat, c'est-à-dire, de 2008 à 2019. Après un bref état de l'art, un formalisme visant à modéliser la responsabilité dans des environnements multi-agents est mis en avant. Ce formalisme, appelé CEDL, est une logique modale qui contient des opérateurs épistémiques et dynamiques ainsi que d'autres opérateurs définis comme des abréviations, telles que l'obligation, la capacité des agents et la capacité de savoir des agents. Le deuxième résultat est une évolution de CEDL, appelée ATDEL. Cette logique vise à modéliser les capacités et les connaissances des agents dans un cadre temporel. Elle permet des spécifications des systèmes beaucoup plus courtes que celles de CEDL. De plus, outre une axiomatisation, des algorithmes de vérification de modèles et de vérification de la satisfiabilité de formules sont proposés. Le troisième résultat est une adaptation de la théorie de révision de croyances AGM à des scénarios multi-agents. Les postulats d'expansion et de révision AGM sont généralisés à de tels scénarios et des opérateurs concrets pour l'expansion et la révision des croyances multi-agents sont proposés. Le dernier résultat présenté porte sur le raisonnement automatique pour les logiques modales. Des méthodes de vérification de la satisfiabilité de formules dans les logiques modales K et KT5 sont proposés. Des expériences pratiques montrent que notre techniques surpasse toutes les méthodes alternatives.

Mots

Lemma 2 . 2 (

 22 Monotonicity). If Γ ϕ and Γ ⊆ Γ then Γ ϕ.

Figure 2 . 2 -

 22 Figure 2.2 -Types of belief change

Definition 3. 6 (

 6 Satisfaction Relation). The satisfaction relation between formulas in L ML and pointed Kripke models is recursively defined as follows: ϕ iff for all w ∈ R m (w) we have M, w ϕ M, w m ϕ iff there is w ∈ R m (w) such that M, w ϕ

Figure 3 . 2 -

 32 Figure 3.2 -Modal logic axiom systems inclusions. A path from L 1 to L 2 means that all validities in L 1 are also in L 2 .

Theorem 3. 7 .

 7 If two pointed Kripke models M, w and M , w are bisimlar then M, w and M , w satisfy the same formulas in L ML . Theorem 3.8. If M and M are finite Kripke models and M, w and M , w satisfy the same set of formulas then they are bisimilar.

  input: A pointed Kripke model M, w and a formula ϕ ∈ L ML output: true if M, w ϕ, false otherwise function mlmc( M, w , ϕ) ψ 0 ∧ ψ 1 then return mlmc( M, w , ψ 0 ) and mlmc( M, w , ψ 1 ) if ϕ = ψ 0 ∨ ψ 1 then return mlmc( M, w , ψ 0 ) or mlmc( M, w , ψ 1 ) if ϕ = [m]ψ then forall w ∈ R m0 (w) do 15 if not mlmc( M, w , ψ)

Lemma 3 .

 3 14. Let M = W, R, I be a Kripke model, where w ∈ W . Let n ∈ N and let M | w,n be the Kripke model W | w,n , R| w,n , I| w,n obtained from M such that:

Figure 3 . 5 -

 35 Figure 3.5 -An epistemic model of knowledge

Definition 3 .

 3 Figure 3.7 -Model product

Figure 4 . 1 -

 41 Figure 4.1 -Graphic representation of CEDL models: dots represent possible worlds, arrows represent transitions and rectangles represent accessibility relations equivalence classes. Possible worlds outside rectangles are alone in their class.

  Example 4.5 (Light Bulb and Light Switch (revisited)). To exemplify operators G , we reuse the scenario of Example 4.4 and the model in Figure 4.2.

4.

  From Axiom (A), (a) ∃ δ∈∆ ¬[δ| G ]⊥ for all G. And from ϕ → ψ we infer [δ| G ](ϕ → ψ) (by Rule (RNA)), and then (b) [δ| G ]ϕ → [δ| G ]ψ (by Axiom (KA) and Rule (RMP)). Then, (a) and (b) together imply G ϕ → G ψ.

  Figure 4.3 -A CEDL model for the Light Bulb and Light Switch scenario where w 0 and w 2 are violation states. (As before, the rectangles represent Betty's knowledge. To simplify the picture, Alice's knowledge is not represented. She has complete knowledge of the scenario, i.e., R alice (w) = {w} for all w ∈ W .)

Example 4. 7 (

 7 Light Bulb and Light Switch with Violations (revisited)). To exemplify operator A, we reuse the scenario of Example 4.6 and the model in Figure 4.3.

Example 4. 8 (

 8 Light Bulb and Light Switch with Violations (re-revisited)). To exemplify operator B, we reuse the scenario of Example 4.6 and the model in Figure 4.3.

Figure 4 . 4 -

 44 Figure 4.4 -The CEDL model M = O, W, R, T, I for the example in Section 4.4.5: the rectangle represents R(alice). The joint actions and the interpretation function I are detailed in Table 4.5. The organisation O = G, P, IR, c , where G = {alice, betty, c}, P = {(c, alice), (c, betty)}, and IR = P ∪ {(betty, alice)}.

  On the left, the joint actions for the model M in Figure 4.4. On the right, the interpretation function I for the model M in Figure 4.4. (Action info abbreviates info(alice, [betty : pay(2)]¬ ) and action deleg abbreviates deleg((alice, 2, bal(n) ≥ 0), (betty, 1, H alice bal(n) ≥ 0), (betty, 2, paid)).

X.

  They are defined by e G ϕ def = ¬[e G ]¬ϕ and [ [G] ]Xϕ def = ¬ G X¬ϕ, respectively. In addition, we sometimes use G X n , for n ≥ 0, wich stands for a sequence of n operators G X, i.e., G X 0 ϕ def = ϕ and

Definition 5. 4 (

 4 ATDEL Update). The update of the epistemic model M = W, R, V by the event e ∈ E is the new model M |e = W |e, R|e, V |e where:

  w ϕ because e ∅ = ∅ for all e ∈ E. Remark 5.2. And we also have: M, w [e ∅ ]ϕ iff for all e ∈ E, if M, w pre(e ∅ ∪ e A ) then M |(e ∅ ∪ e A ), w ϕ iff for all e ∈ E, if M, w pre(e A ) then M |e A , w ϕ again, because e ∅ = ∅ for all e ∈ E. Remark 5.3. Let us also explain what happens if the executability pre-condition of an action is false.

Figure 5 . 1 -

 51 Figure 5.1 -Example of model for the light bulb and light switch scenario

  choose e G ∈ E 10 return nfmc( T, M, w , e G ) and nfmc( T, M, w , [e G ]ψ) Algorithm 5.1: ATDEL Next-fragment Model Checking

2 :

 2 input: A fine set T of actions, an epistemic model M, w and a formula ϕ ∈ L ATDEL . output: true if M, w ϕ, false otherwise function atdelmc( T, M, w , ϕ) if ϕ ∈ L X then return nfmc( T, M, w , ϕ) else if ϕ = G Aψ then 4 return atdelmc( T, M, w , ψ) and fpamc( T, M, w , ψ, G, ∅)else if ϕ = G (ψ 1 Uψ 2 ) then return atdelmc( T, M, w , ψ 2 )or ( atdelmc( T, M, w , ψ 1 )and fpumc( T, M, w , ψ 1 , ψ 2 , G, ∅) ) function fpamc( T, M, w , ψ, G, S) if M ∈ S thenreturn true else non-deterministically choose e G ∈ E forall f G ∈ E do 14 M := M |(e G ∪ f G ) 15 if not ( atdelmc( T, M , w , ψ) 16 or not fpamc( T, M , w , ψ, G, S ∪ {M } )) fpumc(T, M, w , ψ 1 , ψ 2 , G, S) if M ∈ S then return true else non-deterministically choose e G ∈ E forall f G ∈ E do 24 M := M |(e G ∪ f G ) 25 if not atdelmc( T, M , w , ψ 2 ) and 26 not ( atdelmc( T, M , w , ψ 1 ) and 27 fpumc( T, M , w , ψ 1 , ψ 2 , G, S ∪ {M }) ATDEL Model checking Theorem 5.18 (Finite Model Theorem for ATDEL). Every satisfiable formula ϕ ∈ L ATDEL is satisfiable in a finite model.

Figure 6 . 1 -

 61 Figure 6.1 -Illustration of a private expansion. On the top, the initial model M, w 0 .On the middle, the sets X and W q (Definition 6.2). The model on the bottom corresponds to the expansion by q for agent 1, i.e., M, w 0 + 1 q.

Figure 6 . 2 -

 62 Figure 6.2 -Event model for the private expansion by q for 1

(Figure 6 . 3 -

 63 Figure 6.3 -Common expansion event model

Proposition 6. 7 .

 7 Let a be an revision operator satisfying postulates (R a 0)-(R a 9). The operator * defined as O M,w a * ϕ = O M,w a ϕ a is an AGM revision operator (i.e., it satisfies (K * 1)-(K * 8) in Section 2.2).

,

  Definition 6.5(Private Revision Event Model). Let M, w 0 be a KD45 n pointed Kripke model, let ϕ ∈ L CPL such that ¬ϕ and let * be an AGM revision operator. The revision of M, w 0 by ϕ for i is M, w 0 . N a , e 0 , where N a = E, P, pre, postE = {e 0 , e } ∪ {e x w | v x w ∈ W ϕ } P a = {(e 0 , e x w ) | v x w ∈ W ϕ } ∪ {(e x1 w1 , e x2 w2 ) | v x1 w1 , v x2 w2 ∈ W ϕ } ∪ {(e , e )} P i = {(e 0 , e ), (e , e )} ∪ {(e x w , e ) | v x w ∈ W ϕ }, for i = a pre(e 0 ) = pre(e if x p ⊥, if x pwhere W ϕ is as in Definition 6.4.

Figure 6

 6 Figure 6.4 -A private revision. On the top, the initial model M, w 0 . On the middle, the revised model M, w 0

Figure 7 . 2 -

 72 Figure 7.2 -Comparison between trkt5 and trkt5 +

  CEGAR with over-approximation Definition 7.4 (Unsatisfiable Core with Assumptions).

Definition 7. 5 (

 5 Translation from K to CPL). mltr(ϕ, n) = mltr(ϕ, 0, n) mltr(p, i, n) = p i mltr(¬p, i, n) = ¬p i mltr(ϕ ∧ ψ, i, n) = mltr(ϕ, i, n) ∧ mltr(ψ, i, n) mltr(ϕ ∨ ψ, i, n) = mltr(ϕ, i, n) ∨ mltr(ψ, i, n) mltr([m]ϕ, i, n) = n j=0 (¬r a i,j ∨ mltr(ϕ, j, n)) mltr( m ϕ, i, n) = n j=0

Figure 7 . 3 -

 73 Figure 7.3 -The formula ϕ = (♦p ∧ ¬p ∧ χ) with selectors

Figure 7 . 4 -

 74 Figure 7.4 -Runtime distribution on all the benchmarks

  -clés: intelligence artificielle • représentation de connaissance et raisonnement • systèmes multi-agents • logique modale • raisonnement sur les actions • raisonnement sur la connaissance et la croyance • responsabilité • capacité des agents • révision de croyances • raisonnement automatique • satisfiabilité

  We sometimes need to refer to the extension of ϕ in the Kripke model M = W, R, I . This is the set ϕ M = {w | M, w ϕ}.

	(CPL)	All axioms schemas in Table 2.1
	Definition 3.7 (Validity). A formula ϕ ∈ L ML is valid in a Kripke model M = W, R, I
	(noted M ϕ) if and only if, for all possible worlds w ∈ W , we have M, w	ϕ. A
	formula ϕ ∈ L ML is valid (noted ϕ) if and only if, for all Kripke models M ∈ K, we
	have M ϕ.

Table 3 .1 -Axiom system of modal logic K Definition 3.8 (

 3 Satisfiability). A formula ϕ ∈ L ML is satisfiable if and only if ¬ϕ.

	Corollary 3.1. A formula ϕ is satisfiable if and only if there is a Kripke model M ∈ K
	and a possible world w ∈ W such that M, w	ϕ.

Table 3 . 3 -

 33 Computational complexites of satisfiability checkingProof Sketch. By Definition 2.8 and Theorem 3.2, there is a finite derivation for each valid formula. Also, the set of axiom schemas and inference rules is finite. This means that the set of derivations is enumerable. Therefore, if ¬ϕ ∈ L ML is valid (i.e., if it is not satisfiable), one can find its derivation in such enumeration. On the other hand,

by Theorem 3.12, there is a finite model satisfying every satisfiable formula. Because the set of such models is also enumerable, if ϕ is satisfiable, one can find the model satisfying ϕ in such enumeration. Therefore, there is an algorithm that decides whether ϕ is satisfiable, which is as follows: It generates the next derivation and verify if it proves that ¬ϕ is valid. If so, it returns false. If not, it generates the next Kripke model and verify if it satisfies ϕ. If so, it return true. If not, it loops. Eventually, the algorithm stops either with a proof that ¬ϕ is valid or with a Kripke model for ϕ.

Table 4 . 1 -

 41 Agents votes on each action of Example 4.1 responsible. However, we argue that the PMH can occur in practice by giving here three examples.

Table 4 .

 4

	2 -Agents decisions on Example 4.2
		a 1	a 2
	a 1	OK	undesirable
	a 2 undesirable	OK

Table 4 . 3 -

 43 Possible outcomes on Example 4.3 same action, an undesirable outcome ϕ is brought about. This situation is depicted in Table 4.3. The agents cannot communicate. Each agent has no way to know what the other agent decides to do. Then, if the undesirable outcome is obtained, each agent, individually, cannot be hold responsible for it. But the group act in a way such that ϕ is obtained. Hence, yet again, a PMH.

  This action is tog. Let us see how it works formally. The claim is true if and only if M, w 0 δ∈∆ E δ| G light, which is true if M, w 0 E betty:tog light, The latter is true if and only if M, w 0 ¬[betty:tog]⊥ and M, w 0 [betty:tog]light. Both are indeed the case, as we have already seen in Example 4.4.

Table 5 . 2 -

 52 ATDEL Axiom System (for a finite sets of actions)

Table 6 .

 6 1 -AGM postulates for private expansion in KD45 n

  The model is therefore no longer in KD45 n . Therefore, this postulate guarantees that K + a ϕ is a belief set. Postulage (E + a 2) is the success postulate. It stipulates that, after the private expansion by ϕ, agent a believes that ϕ. It guarantees that ϕ ∈ K , for i = a. Postulate (E + a 4) stipulates that agent a beliefs about other agents beliefs do not change. Postulates (E + a 5) and (E + a 6) ensure that, if ϕ is already believed by agent a, then the private expansion does not change anything, so the resulting model is bisimilar to the initial one. These postulates guarantee, that ψ ∈ K + a ϕ. Postulate (E + a 7) is the translation of the monotonicity property. It stipulates that, if a model allows more inferences than another one, then the expansion of the first one allows more inferences than the expansion of the second one. Finally, postulate (E + a 8) is the minimality postulate. It stipulates that the result of the expansion of the model by ϕ is a minimal belief change.One can prove the following two propositions.

					M,w a	implies ψ ∈ K a M,w	M,w a + a ϕ and that ϕ ∈ K
	implies K	M,w a	M,w a = K
	Proposition 6.1. Let + a be an expansion operator satisfying postulates (E + a 0)-
	(E + a 8). The operator + defined by O a M,w	+ ϕ = O a M,w	+ a ϕ is an AGM expansion
	operator, i.e., it satisfies postulates (K + 1)-(K + 6) in Section 2.2.
	Proposition 6.2. There is a unique (up to model bisimilarity) private expansion oper-
	ator satisfying (E + a 0)-(E + a 8).
					M,w
					a
					M,w a	+ a ϕ. Postulate
	(E + a 3) stipulates that the beliefs of all other agents (different from a) do not change.
	This means that K i	M,w	+ a ϕ = K i	M,w

Table 6 . 2 -

 62 AGM postulates for private revision in KD45 n

	Conjecture 6.6. The common expansion operator in Definition 6.3 satisfy postulates
	(E + a 0)-(E + a 8), where the operators B a are replaced for common belief operators
	CB G .

In fact, we must be careful about what 'more expressive' really means. We will see in Chapter 7 that it is possible to translate formulas in ML into formulas in CPL. The translation requires the addition of new propositions in the formula. Moreover, the translated formula in CPL is, in general, exponentially larger than the original ML formula. In this case, this unavoidable "exponential blowing up" is another way to justify the claim that modal logic is "more expressive" than classical propositional logic.

In fact,[START_REF] Hugues | A New Introduction to Modal Logic[END_REF] define the modal conjunctive normal form (MCNF). However, this normal form is not a canonical form, in the sense that every formula can be translated to it, for all modal logics. Therefore, we do not use it here.

Note that len(m) may be greater than 1 when m is, as in Chapter 5, something more complex than a simple modal context.

Proofs or proof sketches of theorems 3.4, 3.5, 3.6, 3.7, 3.8 can be found in(Blackburn et al. 2007).

Note that R 0 m (x, y) means x = y.

In fact, in this specific case, an inclusion test must also be added to guarantee the termination of the method.

This is just a notational variation turns out to be useful when we start mixing different kinds of modal operators. For instance, in the next section, when we see a formula of the form [a]K i ϕ, we immediately know that the second modal operator is the one of epistemic logic of knowledge. The diamond operator is not used often in this logic but, when it is, usually it is noted K.

In fact, the original DEL uses a finite set of event models. But all the event models can be grouped together in a single event model, as we do here. Both definitions are equivalent. The addition of post-conditions is originally from(van Ditmarsch et al. 2005).

This constitutes a difference from the logic proposed in (de Lima et al.

2010b). There, joint determinism is taken as an assumption.

In the present context a master modality would be an operator satisfying: (i) ϕ → [δ| G ]ϕ, for all δ| G ; (ii) ϕ → ϕ; and (iii) ϕ → ϕ.

Note however, that under such assumption the model M must be changed. For instance, if action info does not produce any effect, worlds w 2 and w 3 should be bisimilar.

Note that this definition is slightly different from that of (de Lima

2011). The definition there stipulates that such formula is true if and only if there is an event e ∈ E such that G's part of e necessarily leads to an outcome satisfying ϕ, but its occurrence does not need to be possible. This leads to slightly different axioms for the operator X.

For readability, several proofs are omitted in this chapter. They can be found in (de Lima 2014).

When the state of the world evolves, one has to make an update(Herzig et al.

2005; Katsuno and Mendelzon 1991a).

(p ∧ q). On the bottom, the smaller model M , w 0 , which is bisimilar to the model on the middle.

The proofs of the results in this section can be found in(Caridroit et al.

2017).

Proofs can be fond in[START_REF] Lagniez | A Recursive Shortcut for CEGAR: Application To The Modal Logic K Satisfiability Problem[END_REF]).

Acknowledgements

Expressiveness

In this section, we compare the expressive power of ATDEL to that of several different members of the DEL family. This is done by presenting different versions of ATDEL that are at least as expressive as the various members of the DEL family. We consider five different logics in that family: public announcement logic (PAL), public announcement logic with assignment (PALA), group announcement logic (GAL), coalition announcement logic (CAL), and arbitrary announcement logic (APAL). First though, we need to define expressiveness, which is in turn defined in terms of model distinguishablility.

Definition 5.6 (Model Distinguishability). Logic L distinguishes two pointed epistemic models M, w and M , w , noted M, w ≡ L (M , w ), if and only if there is a formula ϕ in the language of L such that M, w L ϕ and M , w L ϕ.

Definition 5.7 (Expressiveness). Let L 1 and L 2 be two logics interpreted over the class of pointed epistemic models. Then, L 2 is at least as expressive as L 1 , noted L 1 ≤ L 2 , if and only if L 2 distinguishes at least the same models that L 1 distinguishes, i.e., L 1 ≤ L 2 , if and only if, for all pairs of pointed epistemic models M, w and M , w if M, w ≡ L1 M , w then M, w ≡ L2 M , w . We also use L 1 = L 2 to express that both L 1 ≤ L 2 and L 2 ≤ L 1 are true.

ATDEL vs. PAL and PALA

Clearly, ATDEL is at least as expressive as EL. Moreover, PALA is a conservative extension of PAL, thus, PAL ≤ PALA. In addition, it is a known fact that every formula in L PALA (thus also in PAL) has an equivalent formula in L EL (Kooi 2007, Theorem 15). Therefore, we immediately have the following result.

Proposition 5.4. PAL = PALA = EL ≤ ATDEL

ATDEL vs. APAL

The language L APAL of APAL contains L EL plus formulas of the form [ψ]ϕ, which are read 'after the public announcement of ψ, ϕ is true'; and also formulas of the form ϕ, which are read 'after every public announcement, ϕ is true'. Their interpretation is given by:

where M |ψ = W |ψ, R|ψ, V |ψ is the update of M by the public announcement of ψ, defined as follows.

(action and atoms) (AA)

(action and group) (AG)

From ϕ and ϕ → ψ infer ψ (modus ponens) (RMP)

Belief Change in Multi-agent Settings

In the last two chapters, we designed modal logics for reasoning about actions and knowledge in multi-agent environments. In order to do that, the formalisms incorporate some dynamic operators as well the standard epistemic logic of knowledge, i.e., KT5 n . Agents are able to execute various actions. In particular, they can communicate their knowledge. In ATDEL, the communication action available for the agents is the public announcement. This is an action that gives information to all agents in the environment. Just after a public announcement, the contents of the announcement is common knowledge among all agents. In some applications though, agents knowledge can be inaccurate. By communicating with others, agents may confirm the information they have, or realise that they should revise their knowledge base. For these applications, we have to incorporate an epistemic logic of belief, instead of knowledge. However, the replacement of KT5 n for the standard epistemic logic of belief, KD45 n , in ATDEL does not work. This is so because the axiom (AK) on Table 5.1 would not be valid. The explanation is somewhat technical and can be found in [START_REF] Balbiani | Some truths are best left unsaid[END_REF]. The solution we proposed on that work is only palliative: when an agent receives an information that contradicts her current beliefs, the agent just ignores it! Therefore, if we really want to be able to deal with scenarios where agents may have inaccurate information, we need to enter the realm of belief revision theory.

In this chapter, we make one step on that direction. We design operators that change the beliefs of the agents in KD45 n models.

Alchourrón, Gärdenfors and Makinson [START_REF] Alchourrón | On the logic of theory change: Partial meet contraction and revision functions[END_REF][START_REF] Gärdenfors | Knowledge in Flux: Modeling the Dynamics of Epistemic States[END_REF]) proposed postulates for the expansion, contraction and revision of belief sets. These postulates logically encode the constraints expected on the behaviour of such operators. Several representation theorems in terms of maximal consistent sets [START_REF] Alchourrón | On the logic of theory change: Partial meet contraction and revision functions[END_REF], plausibility relations on formulas [START_REF] Gärdenfors | Knowledge in Flux: Modeling the Dynamics of Epistemic States[END_REF], or plausibility relations on worlds exist [START_REF] Katsuno | Propositional knowledge base revision and minimal change[END_REF], allowing to define operators with these

When the agent a expands her beliefs, the model must change in order to represent these new beliefs, but other agents beliefs should remain unchanged. The new set of possible worlds W contains all possible worlds of the initial model plus a new real world w 0 and a set of worlds W ϕ representing the new beliefs of agent a. The set W ϕ contains a copy of each world in R a (w 0 ) which does not contradict ϕ.

The new accessibility relation R a contains the initial relation R a and the sets R ϕ a and R 0 a . The set R 0 a consists of pairs (w 0 , w ϕ ) where w ϕ ∈ W ϕ , thus modifying the beliefs of the agent performing the expansion. The set R ϕ a consists of pairs (w ϕ 1 , w ϕ 2 ) ∈ W ϕ . The worlds in W ϕ thus form a clique, because they are equally plausible for the agent performing the expansion.

Each accessibility relation R i , for i = a, contains the initial relation R i and the sets R 0 i and R -→ ϕ i . The set R 0 i consists of all pairs (w 0 , w) such that (w 0 , w) ∈ R i , thus preserving the beliefs of agents not performing expansion and higher order beliefs of all agents. The set R -→ ϕ i consists of pairs (v x w , w ), where v x w ∈ W ϕ such that (w, w ) ∈ R i , thus keeping higher-order beliefs of the agent performing the expansion.

We can now show that:

Proposition 6.3. The operator + satisfies (E + a 0)-(E + a 8).

As a direct consequence of Proposition 6.2, we know that this operator is the unique private expansion operator. Example 6.1. Consider the KD45 n model M, w 0 depicted in Figure 6.1. In this situation, agent 1 believes ¬p and she believes that agent 2 also believes ¬p. Agent 2 believes ¬p ∧ ¬q, and she believes that agent 1 believes ¬p. After the expansion by q, agent 1 believes ¬p∧q. The model M , w 0 obtained after the expansion is also depicted in Figure 6.1. The world having the valuation ¬p ∧ q has to be duplicated in order to keep the higher-order beliefs of agent 1. The beliefs of the agent 2 remain unchanged. In particular she still believes that agent 1 believes ¬p.

Let us now show that our approach to private expansion can be defined using a product by a specific kind of pointed event model. This result is quite similar to what is shown by Aucher (2012) for internal models. Indeed, the expansion of Definition 6.

Experiments

Several experiments were performed to evaluate the techniques aforementioned using the solver S52SAT, implemented by Valentin Montmirail. We will not see all the results here. The interested reader may find more information in (Caridroit et al. 2017) and in Montmirail's thesis [START_REF] Montmirail | Practical resolution of satisfiabilitytesting for modal logics[END_REF]). Table 7.1 summarises the results obtained in all benchmarks. The best result for each column is in bold face. At the time we published our results, LckS5TabProver, developed by [START_REF] Abate | Cut-free single-pass tableaux for the logic of common knowledge[END_REF] and SPASS, developed by [START_REF] Weidenbach | SPASS Version 3.5[END_REF], were the state-of-the art in S5-satisfiability checking. Here, we compare them with 4 different versions of S52SAT:

• S52SAT nm uses the number of modalities of the formula as the upper-bound for the translation;

• S52SAT nm+ does the same but also uses the caching technique;

• S52SAT dd uses the diamond degree as the upper bound;

• S52SAT dd+ uses the diamond degree and the caching.

In all versions, Glucose 4.0 [START_REF] Audemard | Predicting Learnt Clauses Quality in Modern SAT Solvers[END_REF] is used as the internal CPL SAT solver. The evaluations were performed using well known modal logic benchmarks: 3CNFK (Patel-Schneider and Sebastiani 2003), MQBFK [START_REF] Massacci | Design and Results of the Tableaux-99 Non-classical (Modal) Systems Comparison[END_REF], T ANCS 2000K (Massacci and Donini 2000) and LWB K, KT, S4 [START_REF] Balsiger | A Benchmark Method for the Propositional Modal Logics K, KT, S4[END_REF]. Note that they are designed for modal logics K, KT and S4. As a consequence, some of them are trivial in KT5. However, the results are still significant, since KT5 contains K, KT and KT4 (see Figure 3.2).

The K-SAT problem

To attack the K-SAT problem, we need more than just a clever translation. This is so because, no matter how clever it may be, the output of the translation can be exponentially larger than the original formula. This means (and sometimes is the case in 1 function recar(ϕ) 1. Function 'check()' is a sound and complete implementation of ' 1 ' which terminates.

2. If 1 ¬over(ϕ) then 1 ¬refine(over(ϕ)).

3. eqsat(refine n ( φ), ϕ) returns true, for some n ∈ N.

4. If 2 ¬ φ then 2 ¬ϕ.

5. rc(under n (ϕ),under n+1 (ϕ)) returns false, for some n ∈ N.

Note that, if φ is satisfiable, then ϕ is satisfiable, by assumptions 2 and 3. In the following, we show that, under these assumptions, RECAR is sound, complete and terminates.

Proposition 7.6 (Soundness). If recar(ϕ) returns SAT then ϕ is satisfiable.

Proof. Assume that recar(ϕ) returns SAT. This is the case only if check(ψ) returns SAT, on line 4 of Algorithm 7.2. Thus, we know that ψ is satisfiable (by Assumption 1). But ψ equals to over(ϕ) or equals to refine n (ϕ), for some n ∈ N. Then ϕ is satisfiable (by assumpumptions 2 and 3).

The intuition behind the proof of Theroem 7.7 2 below is that there are two ways to conclude that ϕ is unsatisfiable.

In the first case, φ is refined a finite number of times until it is detected equisatisfiable to ϕ, and check() returns UNSAT. Then ϕ is unsatisfiable. In the second case, one of the under-approximations is shown to be unsatisfiable, then ϕ is unsatisfiable, by Assumption 4).

Experiments

As before, only some results are shown here. The reader can find more information in [START_REF] Lagniez | A Recursive Shortcut for CEGAR: Application To The Modal Logic K Satisfiability Problem[END_REF] and in Montmirail's thesis [START_REF] Montmirail | Practical resolution of satisfiabilitytesting for modal logics[END_REF].

MoSaiC has been compared against the same solvers as in [START_REF] Nalon | K S P : A Resolution-Based Prover for Multimodal K[END_REF]), namely:

• K S P 0.1 [START_REF] Nalon | K S P : A Resolution-Based Prover for Multimodal K[END_REF]);

• BDDTab 1.0 [START_REF] Goré | Implementing Tableau Calculi Using BDDs: BDDTab System Description[END_REF]);

• FaCT++ 1.6.4 [START_REF] Tsarkov | FaCT++ Description Logic Reasoner: System Description[END_REF]);

• InKreSAT 1.0 (Kaminski and Tebbi 2013);

• *SAT 1.3 [START_REF] Giunchiglia | SAT-Based Decision Procedures for Classical Modal Logics[END_REF];

• Km2SAT 1.0 (Sebastiani and Vescovi 2009) combined with the same Glucose SAT solver we use in MoSaiC;

• Spartacus 1.0 [START_REF] Götzmann | Spartacus: A Tableau Prover for Hybrid Logic[END_REF]

Abstract

This work presents four of the most important research results obtained after my Ph.D., i.e., from 2008 until 2019. After a brief state of the art, a formalism aiming at modelling responsibility in multi-agent environments is put forward. This formalism, called CEDL, is a modal logic that contains epistemic and dynamic operators as well as some other operators defined as abbreviations, such as obligation, agents abilities and agents knowing how abilities. The second result is an evolution of CEDL, called ATDEL. This logic aims at modelling agents abilities and knowledge trough time. It permits system specifications that are much smaller than CEDL. In addition, apart from an axiomatisation, algorithms for model checking and satisfiability checking of formulas are also provided. The third result is an adaptation of AGM belief revision theory to multi-agent scenarios. Multi-agent versions of expansion and revision postulates are proposed. The last result presented in this work is about modal logic automated reasoning. Methods for satisfiability checking of formulas in K and KT5 are proposed. Practical experiments show that our technique outperforms alternative approaches.

Keywords