Paul Sabatier

Faustine Maffre

Professeur, UT3 Martin Cooper

Sylvie Doutre

Maître De

Le bonheur est dans l'ignorance : logiques épistémiques dynamiques basées sur l'observabilité et leurs applications

Il m'a été dit de ne pas trop attendre pour rédiger les remerciements. Ce type d'exercice n'étant pas mon domaine de prédilection, j'ai choisi de les limiter à un nombre restreint de personnes. Je suis cependant persuadée que l'aboutissement d'un projet tel qu'une thèse passe par un ensemble de rencontres et d'environnements propices, d'abord à son amorçage, puis à son développement. En tout cas, cela a été le cas pour moi : l'université Champollion d'Albi, l'IRIT et en particulier l'équipe LILaC dans laquelle j'ai travaillée, la communauté scientifique de mon domaine, mes parents et mes amis, sont tout autant à citer que les personnes qui vont suivre.

Je commence bien sûr par remercier mes encadrants : Andreas Herzig et Emiliano Lorini. Pendant toute la thèse et même avant, lors de mon stage de fin de master, ils ont su m'inspirer dans ma façon de faire de la recherche et je les considère comme les meilleurs exemples que j'ai pu suivre dans ce domaine. Ils ont su m'aiguiller tout en me laissant travailler de façon autonome, corriger mes erreurs et critiquer mon travail avec indulgence et bienveillance. J'ai beaucoup apprécié de travailler avec eux et j'ai énormément appris pendant ces trois ans.

Je remercie Jan van Eijck et Mark Ryan, pour avoir relu la thèse avec attention et y avoir apporté des retours pertinents. Je remercie aussi Martin Cooper, pour avoir diminué de façon significative la quantité de fautes de grammaire anglaise dans la thèse, ainsi que Frédéric Maris, pour avoir organisé les journées MAFTEC auxquelles j'ai eu le plaisir de participer et lors desquelles j'ai pu présenter mes travaux de thèse. De plus, j'ai été ravie de travailler avec Martin, Frédéric et Pierre Régnier sur les applications de notre logique à la planification et d'avoir pu tenter avec eux de réduire la frontière entre ces deux domaines. Merci aussi à Sylvie Doutre, Nicolas Troquard et Bruno Zanuttini d'avoir accepté de faire partie de mon jury de soutenance. À tout le jury, merci pour leurs questions et remarques pertinentes pendant la soutenance et pour l'ambiance d'échange qu'ils ont su créer lors de celle-ci. Quoiqu'un peu stressée au départ, j'ai trouvé ce moment et la v journée en général très agréable.

J'adresse des remerciements particuliers à Martin Strecker, pour m'avoir offert l'occasion de découvrir l'IRIT et la recherche avant même le début du master, et pour avoir suivi mes progrès depuis ce moment jusqu'à la fin de la thèse. Je remercie aussi Thierry Montaut, pour avoir été un si bon enseignant durant mes années de licence à Albi. J'espère avoir l'opportunité de retourner dans cette université, peut-être pour y enseigner quelques heures, dans laquelle je me suis tant plu pendant trois ans.

Enfin, je voudrais remercier Armelle Bonenfant, avec qui j'ai passé de très bons moments de travail, lors de l'organisation des projets de programmation, ou de détente, autour d'un chocolat ou d'un jeu de société.

Ignorance is bliss: observability-based dynamic epistemic logics and their applications Le bonheur est dans l'ignorance : logiques épistémiques dynamiques basées sur l'observabilité et leurs applications Faustine Maffre

Abstract

A recent trend in epistemic logic consists in studying construction of knowledge from the agents' observational abilities. It is based on the intuition that an agent's knowledge comes from three possible sources: her observations, communication with other agents, and inference. The approaches mainly focus on the first and suppose that the object of observations are propositional variables. This allows us to model knowledge in a more compact and intuitive way than with Hintikka's possible worlds semantics, where ignorance leads to an increase of the size of models.

The present thesis is part of that line of work. Its aim is to demonstrate that visibility-based epistemic logics provide a suitable tool for several important applications in the field of artificial intelligence. This requires to overcome some difficulties that seem to be inherent to the approach. At the heart of these problems are some counter-intuitive validities such as common knowledge of visibilities or the knowledge operator distributing over disjunctions. The first aim of the thesis is to solve these two issues and to illustrate logics of visibility with wellknown toy examples of epistemic logic as well as with more general applications such as epistemic planning and boolean games.

We first introduce a dynamic epistemic logic that is based on what an agent can observe, including joint observation and observation of what other agents observe. This generalizes current visibility-based epistemic logics by solving the first issue: visibilities are not common knowledge, allowing us to reason about higher-order knowledge and furthermore, higher-order ignorance. We show how epistemic operators can be interpreted in this framework and identify the conditions under which the principles of positive and negative introspection are valid. We include dynamic operators: facts of the world and their observability can both be modified by assignment programs. We also provide a sound and complete axiomatization and prove that the model checking problem is PSPACE-complete.

We illustrate our framework by the gossip problem. Given n agents each of which has a secret (a fact not known to anybody else), the goal of the classical version of the gossip problem is to achieve shared knowledge of all secrets in a minimal number of phone calls. We generalize that problem and focus on higher-order shared knowledge: how many calls does it take to obtain shared knowledge of order k? This requires not only the communication of secrets, but also the communication of knowledge about secrets. We give a protocol and prove that it is correct and optimal.

An important application of our work is multi-agent epistemic plani ning. Given the description of the individual actions, using our formal logic allows us to reduce the solvability of a planning task to a model checking problem. This proves its low complexity compared to standard approaches to epistemic planning. We present an encoding of planning problems expressed in our logic into the standard planning language PDDL. Feeding the resulting problem into a PDDL planner provides a provably correct plan for the original planning problem.

We then extend our logic with control and strategic operators and study epistemic boolean games in this extension. We provide an axiomatization of the logic and establish that the model checking problem is PSPACE-complete. We show how one can reason about equilibria in epistemic boolean games, generalizing current approaches while keeping the same complexity.

We finally extend the original framework by adding public announcements and more generally publicly executed programs. This solves the second issue of visibility-based epistemic logics: epistemic operators do not distribute over disjunction any more. With this framework, we are now able to model most of the classical epistemic problems, starting with the muddy children puzzle. We establish that the model checking problem is PSPACE-complete.

Keywords: dynamic epistemic logic, higher-order observation, gossip problem, epistemic planning, epistemic boolean games, public announcements ii

Résumé

Une tendance récente en logique épistémique consiste à étudier comment construire la connaissance à partir des capacités d'observation des agents. Cela est basé sur l'intuition que la connaissance d'un agent provient de trois sources possibles : ses observations, la communication avec d'autres agents, et l'inférence. Les approches se concentrent principalement sur les observations et supposent que l'objet de ces observations sont des variables propositionnelles. Cela permet de modéliser les connaissances d'une manière plus compacte et intuitive qu'avec la sémantique des mondes possibles d'Hintikka, où l'ignorance conduit à une augmentation de la taille des modèles.

Cette thèse suit cette ligne de travail. Son objectif est de démontrer que les logiques épistémiques basées sur la visibilité constituent un outil approprié pour plusieurs applications importantes dans le domaine de l'intelligence artificielle. Cela exige de surmonter certaines difficultés qui semblent être inhérentes à l'approche : ces logiques incluent des validités contre-intuitives telles que la connaissance commune des visibilités ou l'opérateur de connaissance distribuant sur la disjonction. Le but premier de la thèse est de résoudre ces deux problèmes et d'illustrer les logiques de visibilité obtenues sur des exemples bien connus de la logique épistémique ainsi que sur des applications plus générales comme la planification épistémique et les jeux booléens épistémiques.

Nous présentons d'abord une logique épistémique dynamique qui est basée sur ce qu'un agent peut observer, y compris l'observation jointe et l'observation de ce que les autres agents observent. Cela généralise les logiques basées sur la visibilité actuelles en résolvant le premier problème : les visibilités ne sont plus connaissance commune, ce qui permet de raisonner sur des connaissances d'ordre supérieur, mais surtout sur l'ignorance d'ordre supérieur. Nous montrons comment les opérateurs épistémiques peuvent être interprétés dans ce cadre et identifions les conditions sous lesquelles les principes d'introspection positive et négative sont valides. Nous incluons des opérateurs dynamiques : les valeurs de vérité des faits du monde et de la visibilité des agents sur ces faits peuvent être modifiées par des affectations. Nous fournissons également une axiomatisation adéquate et complète et prouvons que le problème de model checking est PSPACE-complet.

Nous illustrons notre logique par le problème du bavardage. Étant donnés n agents avec chacun un secret (un fait non connu par les autres), le but de la version classique du problème du bavardage est de parvenir à ce chaque agent connaisse tous les secrets en un nombre minimal d'appels téléphoniques. Nous généralisons ce problème et nous concentrons sur le partage des connaissances d'ordre supérieur : combien d'appels iii sont nécessaires pour obtenir la connaissance partagée d'ordre k ? Cela nécessite non seulement la communication des secrets, mais aussi la communication de la connaissance à propos de secrets. Nous exposons un protocole et prouvons qu'il est correct et optimal.

Une application importante est la planification épistémique multiagents. Compte tenu de la description des actions individuelles, utiliser notre logique formelle nous permet de réduire la solvabilité d'une tâche de planification à un problème de model checking. Cela prouve sa faible complexité par rapport aux approches standards. Nous présentons un encodage des problèmes de planification exprimés dans notre logique vers PDDL, le langage classique de planification. Donner le problème résultant à un planificateur PDDL fournit un plan qui résout le problème de planification original.

Nous étendons ensuite notre logique en ajoutant le contrôle des variables et des opérateurs stratégiques et étudions les jeux booléens épistémiques dans cette extension. Nous fournissons une axiomatisation de la logique et établissons que le problème de model checking est PS-PACE-complet. Nous montrons comment il est possible de raisonner sur les équilibres dans les jeux booléens épistémiques, généralisant les approches actuelles tout en gardant la même complexité.

Finalement, nous étendons la logique originale en ajoutant des annonces publiques et plus généralement des programmes exécutés publiquement. Cela résout le second problème des logiques épistémiques basées sur la visibilité : les opérateurs épistémiques ne distribuent plus sur la disjonction. Grâce à cette nouvelle logique, nous sommes capables de modéliser la plupart des problèmes épistémiques classiques, notamment le problème des enfants sales. Nous établissons que le problème model checking est PSPACE-complet.

Mots-clés : logique épistémique dynamique, observation d'ordre supérieur, problème du bavardage, planification épistémique, jeux booléens épistémiques, annonces publiques

Introduction: state of the art

This chapter introduces several notions on which we will rely in the thesis, then gives the general outline. It also implicitly presents notation that will be adopted in the following.

Throughout the whole thesis we assume Prop = {p, q, . . .} is a countable non-empty set of propositional variables and Agt = {1, . . . , n} is a finite non-empty set of agents.

Le sujet principal de la thèse concerne les logiques épistémiques basées sur la visibilité, c'est-à-dire les logiques dans lesquelles la connaissance d'un agent est construite à partir de ce qu'elle voit. La première section est consacrée aux logiques existantes de ce type.

La deuxième section concerne les logiques dynamiques, et plus principalement la logique DL-PA [START_REF] Herzig | A dynamic logic of normative systems[END_REF][START_REF] Balbiani | Dynamic logic of propositional assignments: a well-behaved variant of PDL[END_REF], dans laquelle les programmes atomiques sont des affectations de variables à vrai ou faux. Les logiques présentées dans la thèse incluront toutes des programmes de ce type, qui nous permettront de modifier de façon simple les connaissances des agents.

La troisième section donne quelques logiques incluant une notion de contrôle : si un agent contrôle une variable, elle peut changer sa valeur de vérité. Des logiques comme CL-PC [van der [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF] utilisent ce contrôle pour exprimer les capacités stratégiques des agents, un peu de la même façon que la visibilité par rapport à la connaissance. Nous allons voir dans la thèse qu'intégrer le contrôle à notre logique permet de raisonner sur les jeux booléens, dans lesquels les agents peuvent modifier les variables sous leur contrôle pour atteindre leur but, et même sur les jeux booléens épistémiques, dans lesquels ces buts peuvent concerner la connaissance.

La quatrième section donne des informations sur la planification ainsi que sur la planification épistémique, où les actions et les buts peuvent concerner les connaissances des agents. Souvent, la planification épistémique est basée sur DEL [START_REF] Bolander | Epistemic planning for single and multi-agent systems[END_REF][START_REF] Löwe | DEL planning and some tractable cases[END_REF], qui offre un cadre très expressif, mais très rapidement indécidable. D'autres méthodes plus modestes ont été développées pour palier à ce problème. Dans ce même but, nous proposons dans la thèse d'appliquer notre formalisme à la planification épistémique.

Enfin, la dernière section explicite le but de la thèse et son organisation, ainsi que les contributions produites durant la thèse mais non détaillées dans celle-ci.

Epistemic logics and visibility

In his seminal book [START_REF] Hintikka | Knowledge and Belief: An Introduction to the Logic of the Two Notions[END_REF], Jaakko Hintikka proposed to give truth conditions to epistemic operators in terms of possible worlds: agent i knows that ϕ if, from the perspective of the actual world, this statement is true in all worlds that are possible, or indistinguishable, for i. Such epistemic logics resort to Kripke's possible worlds semantics and were popularized in computer science in the 90's by [START_REF] Fagin | Reasoning about Knowledge[END_REF], who were also the first to advocate the use of S5 as the logic of knowledge (while Hintikka had settled for S4).

While these semantics are natural for modalities such as temporal or dynamic operators, there is a bigger gap between knowledge and possible worlds models. The problem is that the number of possible worlds entertained by an agent is inversely proportional to her knowledge. Possible worlds are therefore not very plausible candidates for cognitive models. Furthermore, when one tries to model things such as distributed systems, such models are typically way too big to be stored and analysed on a computer. Possible worlds models as they stand are therefore not a good basis for system verification. This lead theoretical computer scientists to investigate other, more compact ways to represent knowledge, with the aim of making things more feasible.

A first attempt based on interpreted systems can be found in [START_REF] Lomuscio | Model checking knowledge, strategies, and games in multi-agent systems[END_REF]], using the model checker MOCHA. In interpreted systems, agents are associated with private local states, which, put together, make up the global state. Their idea is to construct knowledge from these local states: i cannot distinguish two global states if her local states in these global states are equal.

Taking this work as an inspiration, several authors [START_REF] Van Der Hoek | Knowledge and control[END_REF][START_REF] Van Der Hoek | A logic of revelation and concealment[END_REF] investigated how epistemic logic could be grounded on the notion of visibility (or observability) of propositional variables. The basic idea is that the sentence "agent i knows that the atomic fact p is true" can be reduced to:

• p is true and

• agent i observes the truth value of p. Similarly, "agent i knows that p is false" can be reduced to:

• p is false and

• agent i observes the truth value of p. It is therefore supposed that every agent has a set of propositional variables that she can observe, in the sense that she knows their truth values. The other way round, any combination of truth values of the non-observable variables is possible for the agent. Such observability information allows us to reconstruct Hintikka's semantics: two worlds are indistinguishable for agent i if and only if every variable observed by i has the same value in both worlds. The motivation of van der Hoek et al. was not only to decrease the complexity of the model checking problem, but also to conceptually study and axiomatize these logics of visibility.

A logic of visibility: ECL-PC

As in standard epistemic logic, the language of logics of visibility extends the language of propositional logic with the unary epistemic operator K i .

In this section, we present observability-based epistemic logics as done in [START_REF] Van Der Hoek | Knowledge and control[END_REF]. In this paper, van der Hoek et al. introduce the logic ECL-PC (Epistemic Coalition Logic of Propositional Control), which extends the logic of control and strategy CL-PC [van der [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF] (Coalition Logic of Propositional Control) with epistemic operators.

We focus here on the epistemic part: we will come back to the strategic operator 3 i in Section 1.3. On the other hand, we include the operator of common knowledge CK (that is not studied in [START_REF] Van Der Hoek | Knowledge and control[END_REF]) in the standard sense: CK ϕ reads "it is common knowledge among all the agents that ϕ is true" (that is, "everybody knows ϕ is true and everybody knows that everybody knows that ϕ is true, and so on ad infinitum"). We propose an axiomatization of the epistemic fragment of ECL-PC extended by common knowledge.

In ECL-PC, each agent is associated to a (fixed) set of propositional variables, which are the variables she sees. We choose to encode visibilities not in the model, but by atomic propositions of the form S i p, as we will reuse them in the rest of the thesis. The atomic formula S i p reads "agent i sees the value of the propositional variable p." We call these, along with propositional variables, atomic formulas, or, for short, atoms. Formulas are interpreted over a valuation, which is a set of atoms, and a visibility model, which contains every possible valuation (every combination of atoms). To comply with ECL-PC semantics, we constrain the indistinguishability relation so that visibilities stay the same in every related valuation. (It is a hypothesis that we will relax in the following chapters.)

Language of ECL-PC

From the set of propositional variables Prop we define the set of atoms by ATM = Prop ∪ {S i p : i ∈ Agt, p ∈ Prop}. We denote atoms by α, α , β, β , etc.

Then the language we study is defined by the following grammar:

ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | CK ϕ
where α ranges over ATM and i over Agt. The formula K i ϕ reads "i knows that ϕ on the basis of what she observes" and CK ϕ reads "all agents commonly know that ϕ on the basis of what they observe." We define the operator of shared knowledge EK J , for J ⊆ Agt a non-empty set of agents, by

EK J ϕ = i∈J K i ϕ.
The formula EK J ϕ reads "every agent in J knows that ϕ."

Semantics of ECL-PC

In order to prepare the ground for the following chapters, we give the semantics of ECL-PC in a form that slightly differs from the original presentation, while being equivalent.

A valuation V ∈ 2 ATM is a subset of the set of atoms ATM : the atoms that are currently true. For an atom α, we write V (α) = V (α) if and only if α has the same value in V and in V , i.e., either α ∈ V and α ∈ V , or α / ∈ V and α / ∈ V . The (unique) visibility model M vis = 2 ATM contains every possible valuation.

As said above, the indistinguishability relations of M vis are constructed from visibility information. We denote by V ∼ i V the fact that valuation V is indistinguishable from valuation V for i. Formally:

V ∼ i V iff S i p ∈ V implies V (p) = V (p), and
for every j ∈ Agt, V (S j p) = V (S j p).

The first part is the formal counterpart of the intuition behind visibility: two valuations V and V are related for i if every atom α that i sees at V has the same value in V and V . The second part ensures that visibilities of all agents on every propositional variable are identical in all related valuations; remember that this is a hypothesis of ECL-PC. We will see how this implies complete information about visibility.

As the reader may observe, each relation ∼ i is reflexive, transitive and euclidean, and is therefore an equivalence relation. So each ∼ i divides the visibility model M vis into equivalence classes of valuations in which visibilities remain constant.

From this relation, we define the relation for common knowledge, noted ∼ Agt , as:

∼ Agt = i∈Agt ∼ i *
where, for a relation R, R * is the reflexive and transitive closure of R. This is the standard way [START_REF] Fagin | Reasoning about Knowledge[END_REF]: a statement ϕ must be true in any reachable world by any agent in any number of steps for it to be common knowledge.

Example 1.1. Suppose Prop = {p, q} and Agt = {1, 2}. Then ATM = {p, q, S 1 p, S 1 q, S 2 p, S 2 q} and thus the visibility model contains 2 6 = 64 valuations. Let us only consider the subset of this model where 1 only sees p and 2 only sees q. It is made up of the following four valuations: {S 1 p, S 2 q}, {S 1 p, S 2 q, p}, {S 1 p, S 2 q, q}, {S 1 p, S 2 q, p, q}.

These valuations are related such that 1 cannot distinguish valuations differing only in the value of q and 2 cannot distinguish valuations differing only in the value of p. This is illustrated in Figure 1.1. Example 1.2. Consider the same sets of propositional variables Prop and agents Agt as in Example 1.1. The subset where 1 sees p and q while 2 only sees q is depicted in Figure 1.2.

{S 1 p, S 2 q, p} o o 1 / / O O 2 1,2 {S 1 p, S 2 q, p, q} O O 2 1,2 {S 1 p, S 2 q} o o 1 / / 1,2 K K {S 1 p, S 2 q, q} 1,2 S S
{S 1 p, S 1 q, S 2 q, p} O O 2 1,2
{S 1 p, S 1 q, S 2 q, p, q}

O O 2 1,2
{S 1 p, S 1 q, S 2 q} 1,2 K K {S 1 p, S 1 q, S 2 q, q} Formulas are interpreted at a valuation of M vis . As the visibility model is unique we keep it implicit and only mention the current valuation V in the truth conditions. They are defined as follows:

V |= α iff α ∈ V V |= ¬ϕ iff not (V |= ϕ) V |= ϕ ∧ ϕ iff V |= ϕ and V |= ϕ V |= K i ϕ iff V |= ϕ for every V such that V ∼ i V V |= CK ϕ iff V |= ϕ for every V such that V ∼ Agt V
Therefore agent i knows that ϕ if ϕ holds in every valuation i considers possible, based on what i sees; and ϕ is common knowledge if it holds in any valuation accessible by a path over any indistinguishability relation.

When V |= ϕ we say that V is a model of ϕ. The set of models of ϕ is noted ϕ . A formula ϕ is satisfiable if it has a model, i.e., if ϕ = ∅; it is valid if ϕ is true in all models, i.e., if ϕ = 2 ATM .

Example 1.3. In Example 1.2, no valuation other than the current one is possible for agent 1; so she always knows the state of the valuation:

V |= (K 1 p ∨ K 1 ¬p) ∧ (K 1 q ∨ K 1 ¬q)
for every V of Figure 1.2. In contrast, agent 2 only knows the value of q, but knows that 1 knows the value of p:

V |= (¬K 2 p ∧ ¬K 2 ¬p) ∧ (K 2 q ∨ K 2 ¬q) ∧ K 2 (K 1 p ∨ K 1 ¬p)
for every V of Figure 1.2. Finally, we have {S 1 p, S 1 q, S 2 q, q} |= CK q.

The reader may observe that the interpretations of CK and EK Agt actually coincide. This does not only happen in this example, as we shall see in the next section.

Axiomatization of ECL-PC

Thanks to the visibility atoms we can axiomatize the epistemic fragment of ECL-PC by means of reduction axioms, in a way that is a bit simpler than that of [START_REF] Van Der Hoek | Knowledge and control[END_REF]. This also simplifies the completeness proof. Our axiomatization of ECL-PC without strategic operators is as follows:

• some axiomatization of S5 n C (epistemic logic S5 with n agents and with common knowledge), e.g. that of [START_REF] Fagin | Reasoning about Knowledge[END_REF];

• axioms reducing literal knowledge to visibility:

K i p ↔ p ∧ S i p (Red K,p ) K i ¬p ↔ ¬p ∧ S i p (Red K,¬p )
• positive and negative mutual introspection of visibility:

S i p → K j S i p (PI S ) ¬S i p → K j ¬S i p (NI S )
• distribution of knowledge over disjunction of literals:

K i α∈A + α ∨ α∈A - ¬α ↔ α∈A + K i α ∨ α∈A - K i ¬α (Red K,∨ )
where A + and A -are sets of atoms such that A + ∩ A -= ∅.

Observe that Axiom (Red K,∨ ) is not valid when the clause contains contradictory literals, i.e., when A + ∩ A -= ∅.

Proposition 1.1. Our axiomatization of ECL-PC without strategic operators is sound.

Proof. The axiomatization of S5 n C is sound because, as we will see in Section 1.1.2, the model of ECL-PC is a particular Kripke model. Therefore the axioms of S5 n C are valid and its inference rules preserve validity. • Axioms (Red K,p ), (Red K,¬p ) and (Red K,∨ ) will still be true in the logics of visibility that we will present in the next chapters; their proofs are similar to Proposition 2.10 on page 44.

• On the other hand, we will render invalid (PI S ) and (NI S ) in the following; we detail their proof here.

Consider an arbitrary valuation V ∈ 2 ATM . By the definition of ∼ j , we have V (S i p) = V (S i p) for every V such that V ∼ j V .

Suppose V |= S i p, then for every V such that V ∼ j V we have V |= S i p and therefore V |= K j S i p. Now suppose V |= S i p, then for every V such that V ∼ j V we have V |= S i p and therefore V |= K j ¬S i p.

Therefore all axioms are valid.

Proposition 1.2. The following formulas are theorems of ECL-PC.

• Reduction of visibility to knowing whether:

K i p ∨ K i ¬p ↔ S i p (1.1)
• Reduction of common knowledge to shared knowledge:

CK p ↔ EK Agt p (1.2) CK ¬p ↔ EK Agt ¬p (1.3)
• Common knowledge of visibility:

S i p → CK S i p (1.4) ¬S i p → CK ¬S i p (1.5)
• Distribution of common knowledge over disjunction of literals:

CK α∈A + α ∨ α∈A - ¬α ↔ α∈A + CK α ∨ α∈A - CK ¬α (1.6)
where A + and A -are sets of atoms such that A + ∩ A -= ∅.

Proof. We derive formulas from axioms.

• (1.1). It follows from the reduction axioms (Red K,p ) and (Red K,¬p ) that

K i p ∨ K i ¬p is equivalent to (p ∧ S i p) ∨ (¬p ∧ S i p).
The latter is equivalent to S i p by propositional logic.

• (1.2). The left-to-right sense is a theorem of S5 n C . For the rightto-left sense, we have EK Agt p → K j p by propositional reasoning. Moreover, we have EK Agt p → K j i∈Agt S i p by (Red K,p ) and (PI S ). Thus

EK Agt p → K j p ∧ i∈Agt S i p which by (Red K,p ) is nothing but EK Agt p → K j EK Agt p,
CK (EK Agt p → EK Agt EK Agt p) → (EK Agt p → CK p),
whence the result. The proof for (1.3) is similar.

• (1.4). From the positive introspection axiom (PI S ) it follows that S i p → EK Agt S i p, from which we obtain CK (S i p → EK Agt S i p) by necessitation. The induction axiom for common knowledge then tells us that

CK (S i p → EK Agt S i p) → (S i p → CK S i p),
hence the result. The proof for (1.5) is similar.

• (1.6). The right-to-left direction is a theorem of S5 n C . For the leftto-right direction we only state the proof for m = 2 and propositional variables; the generalisation is straightforward. Using axioms (1.2) and (Red K,p ) and the definition of EK Agt , it suffices to prove that

CK (p ∨ q) → (p ∧ S i p ∧ S j p) ∨ (q ∧ S i q ∧ S j q).
We distribute ∧ over ∨ in the right side and prove that CK (p ∨ q) implies each of the nine disjuncts.

1. CK (p ∨ q) → (p ∨ q). This is a theorem of S5 n C . 2. CK (p ∨ q) → (p ∨ S i q). First, CK (p ∨ q) implies K i (p ∨ q) in S5 n C . Second, K i (p ∨ q) implies K i p ∨ K i q by (Red K,∨ ). Third, K i p ∨ K i q implies p ∨ S i q by (Red K,p ). 3. CK (p ∨ q) → (p ∨ S j q).
The proof is similar to case (2). 4. CK (p ∨ q) → (S i p ∨ q). The proof is similar to case (2).

CK

(p ∨ q) → (S i p ∨ S i q). First, CK (p ∨ q) implies K i (p ∨ q) in S5 n C . Second, K i (p ∨ q) implies K i p ∨ K i q by (Red K,∨ ). Third, K i p ∨ K i q implies S i p ∨ S i q by (Red K,p ). 6. CK (p ∨ q) → (S i p ∨ S j q). First, CK (p ∨ q) implies K i K j (p ∨ q) in S5 n C .
Second, the latter is equivalent to K i (K j p ∨ K j q) by (Red K,∨ ). Third, K i (K j p∨K j q) implies K i (p∨S j q) by the truth axiom of S5 n C . Fourth, the latter is equivalent to K i p ∨ K i S j q by (Red K,∨ ). Finally, the latter implies S i p ∨ S j q by (Red K,p ) and the truth axiom of S5 n C . 7. CK (p ∨ q) → (S j p ∨ q). Similar to (2). 8. CK (p ∨ q) → (S j p ∨ S i q). Similar to (6). 9. CK (p ∨ q) → (S j p ∨ S j q). Similar to (5).

Putting together these cases we obtain the result. Therefore all the formulas are valid.

Proposition 1.3. Our axiomatization of ECL-PC without strategic operators is complete.

Proof. Completeness follows from the fact that our axiomatics allows us to derive a complete set of reduction axioms for the epistemic operator K i and CK . We start by showing that these operators can be eliminated when they face a boolean formula.

• When K i faces a literal then it can be eliminated: first, when that literal is a propositional literal (a variable or a negation thereof) then the reduction axioms (Red K,p ) and (Red K,¬p ) apply; second, when the literal is a visibility atom then we have K j S i p ↔ S i p by the axiom of positive introspection (PI S ) and the truth axiom of S5 n C ; third, when the literal is the negation of a visibility atom then we have K j ¬S i p ↔ ¬S i p by the axiom of negative introspection (NI S ) and the truth axiom of S5 n C .

• When CK faces a literal then it can be eliminated in a way similar to the above: we apply equivalences (1.2) and (1.3) of Proposition 1.2 for variables, and we apply implications (1.4) and (1.5) and the truth axiom of S5 n C for visibility atoms.

• When K i faces a clause then it can be replaced by if the clause is tautological (by standard principles of normal modal logics); otherwise it can be distributed by the implication (Red K,∨ ) and its converse (which is a principle of S5 n C ).

• When CK faces a clause then it can be replaced by if the clause is tautological (by standard principles of normal modal logics); otherwise it can be distributed by the equivalence (1.6) of Proposition 1.2.

• When K i or CK face a conjunction or a double negation then they can be simplified by standard principles of normal modal logics.

Now that we can eliminate epistemic operators facing boolean formulas, we can start by innermost such operators and-applying the rule of replacement of equivalents of S5 n C -eliminate all epistemic operators. The result is a boolean combination of atoms. Such a formula is satisfiable in ECL-PC if and only if it is satisfiable in propositional logic.

Complexity of model checking of ECL-PC

The model checking of ECL-PC is defined as:

• Input: a couple V, ϕ where ϕ is a ECL-PC formula and V is finite a valuation;

• Output: yes if V |= ϕ, no otherwise.

Its complexity was proven to be PSPACE-complete [START_REF] Van Der Hoek | Knowledge and control[END_REF].

Relation with Kripke models

We have seen that logics of visibility-based knowledge still rely on possible worlds and indistinguishability relations that are constructed from what agents can see. In this section, we examine the link between visibility-based models and standard Kripke models in more detail. The language of standard epistemic logic (with common knowledge) is the language of ECL-PC but without visibility atoms. It can therefore be defined by the following grammar:

ϕ ::= p | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | CK ϕ
where p ranges over Prop and i over Agt.

In the semantics, a Kripke model for epistemic logic is usually defined as a tuple M = W, ∼ 1 , . . . , ∼ n , v , where W is a set of worlds, ∼ 1 , . . . , ∼ n are equivalence relations, one per agent, and v : Prop → 2 W is a valuation function mapping every propositional variable to a set of worlds where it is true. With M = W, ∼ 1 , . . . , ∼ n , v a Kripke model and w ∈ W a world:

M, w |= p iff w ∈ v(p) M, w |= ¬ϕ iff not (M, w |= ϕ) M, w |= ϕ ∧ ϕ iff M, w |= ϕ and M, w |= ϕ M, w |= K i ϕ iff M, w |= ϕ for every w such that w ∼ i w M, w |= CK ϕ iff M, w |= ϕ for every w such that w ∼ Agt w
where ∼ Agt = i∈Agt ∼ i * as in ECL-PC. Again, we write w(p) = w (p) if and only if p has the same value in w and in w .

From visibilities to Kripke models

In logics of visibility, every subset of the set of propositional variables is a possible world. This means that a visibility model is always made up of 2 |ATM | worlds (with |ATM | the cardinality of ATM ).

Formally, given a valuation V 0 ∈ 2 ATM , we are going to build a pointed Kripke model (M V 0 , w V 0 ) that is bisimilar to (M vis , V 0 ) w.r.t. the standard language of epistemic logic of the beginning of this section. We define M V 0 = W, ∼ 1 , . . . , ∼ n , v as follows:

W = 2 Prop ∼ i = {(
(M V 0 , w V 0 ) are bisimilar w.r.t. Prop. Proof. Consider the relation Z ⊆ 2 ATM × W such that Z = {(V, w) : for every p ∈ Prop, V (p) = w(p) and for every p ∈ Prop, i ∈ Agt, V (S i p) = V 0 (S i p)}.
We check the three conditions for Z to be a bisimulation.

1. Atomicity. (V, w) ∈ Z implies V (p) = w(p) holds for all p ∈ Prop by definition of Z.

2. Forth. Suppose (V, w) ∈ Z and V ∼ i V and let w = V ∩ Prop.

Then:

• We have (V , w ) ∈ Z because, first, V (p) = w (p)
for all p by definition of w ; and second, because for all p and j: V (S j p) = V (S j p) by definition of ∼ i and V (S j p) = V 0 (S j p) because (V, w) ∈ Z.

• We have w ∼ i w because we have: first,

S i p ∈ V implies V (p) = V (p) by definition of ∼ i ; second, as (V, w) ∈ Z, we have V (S i p) = V 0 (S i p), so S i p ∈ V 0 implies V (p) = V (p); third, again as (V, w) ∈ Z we have V (p) = w(p), so S i p ∈ V 0 implies w(p) = V (p). Hence S i p ∈ V 0 implies w(p) = w (p) by definition of w . 3. Back. Suppose (V, w) ∈ Z and w ∼ i w . Let V = w ∪ (V 0 \ Prop).
The proof that "V ∼ i V and (V , w ) ∈ Z" follows the same steps as the proof of the "forth" condition, in reverse order.

Moreover, we have (V 0 , w V 0 ) ∈ Z. Therefore (M vis , V 0 ) and (M V 0 , w V 0 ) are bisimilar w.r.t. the standard language of epistemic logic.

The pointed Kripke model and the valuation being bisimilar, they satisfy the same formulas: we have

V 0 |= ϕ if and only if M V 0 , w V 0 |= ϕ.
{p} o o 1 / / O O 2 1,2 {p, q} O O 2 1,2 ∅ o o 1 / / 1,2 L L {q} 1,2 S S Figure 1.3: Kripke model M V 0 for V 0 = {p, S 1 p, S 2 q}.

From Kripke models to visibilities

We have seen that every visibility model can be transformed into a to Kripke model. The other way round, it is in general not possible to transform a Kripke model to a visibility model. There are two reasons for that.

1. First, visibilities stay the same across the indistinguishability relations. This implies that who sees what is common knowledge:

S i p → CK S i p ¬S i p → CK ¬S i p
which, along with validity (1.1) of Proposition 1.2, gives:

(K i p ∨ K i ¬p) → CK (K i p ∨ K i ¬p) (¬K i p ∧ ¬K i ¬p) → CK (¬K i p ∧ ¬K i ¬p)
We have also seen there that this leads to the validity of CK p ↔ EK Agt p, which is invalid in standard epistemic logic. This is annoying because theory of mind is "flattened": it becomes impossible to reason about higher-order knowledge. This is however fundamental in the gossip problem (generalized to higherorder knowledge) or in any other reasoning task requiring theory of mind.

2. Second, as we have seen in the previous section, a visibility model always contains 2 |ATM | worlds: every possible subset of ATM is contemplated. This implies the distribution of knowledge over disjunction of literals:

K i α∈A + α ∨ α∈A - ¬α ↔ α∈A + K i α ∨ α∈A - K i ¬α when A + ∩ A -= ∅.
This problem is inherent to the notion of visibility: if an agent knows that p or q is true by looking at them, she immediately knows which one is true.

This forbids to model things such as the muddy children puzzle, where each child knows that at least one of the children is muddy without knowing which.

In this thesis, we will propose solutions to these two issues.

Other observation-based logics

Besides ECL-PC, other logics of visibility were also studied in recent years.

The Logic of Revelation and Concealment LRC [van der Hoek et al., 2012] allows us to express, as programs, that a variable is revealed to an agent or concealed from her, modifying the visibilities. However, like in 1.2. Dynamic logics among all agents. In the following, we will see how to include dynamic modalities that will change visibilities of agents.

In Flatland Logic [Balbiani et al., 2013a], visibility is grounded on geometry in order to give semantics to epistemic operators: an agent can (or cannot) observe the positions of other agents and can reason about what they observe. Visibility can be higher-order and is also fully determined by geometric constraints such as the position of agents and their angle of view. A notable difference with other visibility-based epistemic logics is that agents see other agents instead of propositional variables. A successor of Flatland Logic is Big Brother Logic [START_REF] Gasquet | Big brother logic: logical modeling and reasoning about agents equipped with surveillance cameras in the plane[END_REF] where agents have a fixed position and angle of view, but can rotate freely. We will see how to fully relax these types of constraints.

Dynamic logics

Inspired from [START_REF] Engeler | Algorithmic properties of structures[END_REF][START_REF] Hoare | An axiomatic basis for computer programming[END_REF][START_REF] Yanov | On equivalence of operator schemes[END_REF], Algorithmic Logic AL [START_REF] Salwicki | Formalized algorithmic languages[END_REF], and then Dynamic Logic DL [START_REF] Pratt | Semantical considerations on Floyd-Hoare logic[END_REF] were designed as "logics of programs": to each computer program is associated a modality expressing the fact that when the program terminates, the system is in a state satisfying a statement. Propositional Dynamic Logic PDL [START_REF] Fischer | Propositional dynamic logic of regular programs[END_REF] is the propositional variant of DL.

In dynamic logics, complex programs are built from abstract atomic programs by sequential composition, non-deterministic composition, iteration and test. Other operators can be considered, like converse or intersection, and iteration is sometimes dropped in so-called "star-free" fragments. Formulas are interpreted over labelled transition systems, where each transition between states is labelled with the name of an atomic program and indicates a possible execution of this atomic program.

Logic of propositional assignments

A recent contribution, Dynamic Logic of Propositional Assignments DL-PA [START_REF] Herzig | A dynamic logic of normative systems[END_REF][START_REF] Balbiani | Dynamic logic of propositional assignments: a well-behaved variant of PDL[END_REF], instantiates PDL atomic programs: they are now assignments of propositional variables to true or to false. We recall the syntax and semantics of this logic as we heavily rely on it in the following.

Language of DL-PA

The language of formulas and programs of DL-PA is defined by the following grammar:

π ::= +p | -p | (π; π) | (π π) | π * | ϕ? ϕ ::= p | ¬ϕ | (ϕ ∧ ϕ) | [π]ϕ
where p ranges over Prop.

The formula [π]ϕ reads "after every execution of π, ϕ is true" as in standard dynamic logics. As for programs, assignments +p and -p make p true or false; π; π is sequential composition: it executes π followed by π ; π π is non-deterministic choice: it executes either π or π , choosing non-deterministically; π * is unbounded iteration: it executes π a finite, but non-deterministically determined number of times; ϕ? is test: it checks if ϕ is currently true and continue if this is the case, or fails and ends the execution otherwise.

Semantics of DL-PA

Formulas are interpreted on valuations V ∈ 2 ATM , like the ones we have seen in ECL-PC in Section 1.1.1. Again, the whole model is unique and we keep it implicit in the truth conditions. They are as follows:

V |= p iff p ∈ V V |= ¬ϕ iff not (V |= ϕ) V |= ϕ ∧ ϕ iff V |= ϕ and V |= ϕ V |= [π]ϕ iff V |= ϕ for every V such that V R π V
where R π is a binary relation on valuations defined by:

V R +p V iff V = V ∪ {p} V R -p V iff V = V \ {p} V R π;π V iff V (R π • R π )V V R π π V iff V (R π ∪ R π )V V R π * V iff V ( k∈N 0 (R π ) k )V V R ϕ? V iff V = V and V |= ϕ
The semantics are standard except that atomic programs, being concrete, have always the same effect of updating the current valuation by adding or removing a given variable.

Control, strategies and boolean games

Complexity of model checking of DL-PA

The model checking of DL-PA is defined as:

• Input: a couple V, ϕ where ϕ is a DL-PA formula and V is a finite valuation;

• Output: yes if V |= ϕ, no otherwise.

Its complexity was proven to be PSPACE-complete [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF].

On the relation with visibility logics

As we have glimpsed, observation-based logics are often related with dynamics, like LRC [van der [START_REF] Van Der Hoek | A logic of revelation and concealment[END_REF], where programs modify visibilities, and hence agents' knowledge.

Note that the new semantics that we presented for ECL-PC in Section 1.1.1 fit well with the ones of DL-PA. While relaxing the constraint on visibilities of ECL-PC (which stay constant across indistinguishability relations), one of the main contributions of this thesis will be to study a dynamic epistemic logic based on observation, where the truth values of visibilities, but also facts of the world, can evolve using assignments. We will also show that the complexity of the model checking in this new setting does not increase compared to ECL-PC and DL-PA.

Control, strategies and boolean games

Logics of control, such as Coalition Logic of Propositional Control CL-PC [van der [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF], have been proposed in recent years to model capabilities of agents in a rather simple and elegant way. They allow us to reason about the strategic abilities of agents, i.e., the states an agent is able to reach by modifying the variables she controls. This can be extended to coalitions (sets of agents) by considering variables at least one of them controls.

Control

In CL-PC [van der [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF], each agent controls a set of variables, much like visibilities of ECL-PC (which is an extension of CL-PC as we have mentioned). Control is assumed to be exclusive and exhaustive: a variable is controlled by exactly one agent. With control, it is possible to define the ceteris paribus operator 3 J , with J a coalition, such that 3 J ϕ reads "agents in J can change values of variables they control while the other agents do not act so that ϕ is true." It is true at V if and only if there exists a valuation V that satisfies ϕ, such that only variables controlled by at least one agent in J are modified between V and V .

The ceteris paribus operator 3 J allows us to reconstruct the "coalition logic-like" strategic operator J [START_REF] Pauly | Logic for Social Software[END_REF][START_REF] Pauly | A modal logic for coalitional power in games[END_REF][START_REF] Alur | Alternating-time temporal logic[END_REF], such that J ϕ reads "agents in J are able to achieve ϕ by modifying variables they control, whatever the other agents do": J ϕ = 3 J 2 Agt\J ϕ, with 2 J the dual operator of 3 J reading that "agents in J cannot avoid ϕ by changing values of variables they control."

The connection between CL-PC and DL-PA was studied in [START_REF] Herzig | A dynamic logic of normative systems[END_REF], where it was shown that the former can be polynomially embedded in the star-free fragment of the latter.

Another work on control is [START_REF] Grossi | The ceteris paribus structure of logics of game forms[END_REF] in which the authors present a ceteris paribus logic, called CP, whose formulas are interpreted on the equivalence classes induced by finite sets of propositional atoms. This logic has modal operators of the form [X] where X is a finite set of propositional variables. The formula [X]ϕ is read "ϕ is the case in all states which are X-equivalent to the current state," where two states are X-equivalent if they assign the same truth values to the variables in X. The authors show that CL-PC as well as the star-free fragment of DL-PA can be embedded in CP.

Boolean games and epistemic boolean games

Boolean games [START_REF] Harrenstein | Boolean games[END_REF][START_REF] Bonzon | Boolean games revisited[END_REF][START_REF] Dunne | Cooperative boolean games[END_REF] are games in which each player wants to achieve a certain goal that is represented by a propositional formula. They correspond to the specific subclass of normal-form games in which agents have binary preferences (i.e., payoffs are either 0 or 1) and are widely accepted as a useful and natural abstraction for reasoning about social interaction in multi-agent systems.

Boolean games

A boolean game is a tuple (Agt, Prop f , (Ψ i ) i∈Agt , (γ i ) i∈Agt ) where Prop f is a finite subset of Prop, each Ψ i ⊆ Prop f
is the set of variables agent i controls, and γ i is a boolean formula such that ATM (γ i ) ⊆ Prop f . The latter expresses i's personal goal, i.e., the state of affairs i wants to achieve. Exclusive and exhaustive control is assumed: the sets Ψ i partition the set of variables Prop f . A strategy for an agent i, noted s i , is an interpretation of variables controlled by i, that is to say, s i ⊆ Ψ i . Therefore the set of all possible strategies of agent i is 2 Ψ i . Given a strategy s i for each member of a coalition J, the induced strategy for J is s J = i∈J s i . A strategy s Agt for Agt is called a strategy profile. It can be seen as an interpretation of 1.4. Automated planning the set of variables Prop f . Agent i's utility function maps every strategy profile to i's reward; this reward depends only on the truth value of i's goal in s Agt :

U i (s Agt ) = 1 if s Agt |= γ i 0 otherwise.
Let s i , s Agt\{i} be the strategy profile composed of the strategy s i of i and of the strategy s Agt\{i} of i's opponents. We say that s i is a best response to s Agt\{i} if and only if, for every strategy

s i ∈ 2 Ψ i , U i ( s i , s Agt\{i} ) ≤ U i ( s i , s Agt\{i} )
holds, i.e., every other strategy of i against the same strategy of opponents would not increase i's reward.

A strategy profile s Agt is a Nash equilibrium if and only if s i is a best response to s Agt\{i} for every i ∈ Agt. This means that every agent cannot get a bigger reward by choosing another strategy if the others do not change theirs.

Epistemic boolean games

In [Ågotnes et al., 2013], epistemic boolean games are studied. In these games, agents' goals are no longer restricted to boolean formulas, but may contain epistemic operators. Semantics, like in ECL-PC, are based on valuations and visibility sets of variables associated to agents, with the drawbacks that we saw in Section 1.1. In particular, agents can affect the truth value of propositional variables and, indirectly, the knowledge of those agents' who can see these variables; but agents cannot modify the visibility conditions of propositional variables.

It is shown in [Ågotnes et al., 2013] that for their class of epistemic boolean games, membership and existence of Nash equilibria (i.e., deciding if the current strategy is a Nash equilibrium and deciding if there exists one) are PSPACE-complete. Using atoms of control in addition to atoms of visibility, we will show in Chapter 5 how to encode a more general class of epistemic boolean games, where agents can affect the truth value of propositional variables but also the visibilities of conditions of propositional variables, including higher-order visibility. We will also show that the complexity of deciding membership and existence of Nash equilibria is not affected by this generalisation.

Automated planning

Automated planning [START_REF] Ghallab | Automated Planning: Theory and Practice[END_REF] is a field of artificial intelligence that aims to, given some actions, generate a plan that can be executed by an agent and that leads her to her goal.

Classical planning

In its simplest form, a planning task is composed of the initial state, a set of actions, and the goal; a plan is a sequence of actions. It is assumed that the initial state is unique and known, that actions are instantaneous, deterministic and fully observable.

The three components can be described with the help of propositional logic: the initial state being a set of propositional variables, actions adding or removing these variables, possibly with preconditions to be executed, and the goal being a boolean formula. The planning task is solvable if there exists a sequence of actions which, executed from the initial state, leads to a state where the goal is satisfied.

Planning is furthermore interested in the design of algorithms that solve planning tasks, i.e., that find a solution plan. Several languages for representing such tasks were developed; the most commonly known are STRIPS [START_REF] Fikes | STRIPS: A new approach to the application of theorem proving to problem solving[END_REF] (Stanford Research Institute Problem Solver) and PDDL [START_REF] Mcdermott | PDDL -The Planning Domain Definition Language[END_REF]] (Planning Domain Definition Language), the latter including the former. New planners are regularly proposed and evaluated at competitions such as the International Planning Competition.1

Epistemic planning

Epistemic planning focuses on planning under uncertainty: agents may be uncertain about the state of the world, about the actions performed by other agents or about the effects of actions. Goals may also concern the knowledge of agents in addition to facts of the world.

Dynamic Epistemic Logic DEL [START_REF] Van Ditmarsch | Dynamic Epistemic Logic[END_REF] provides a formal framework for the representation of knowledge and update of knowledge. Its dynamics rely on event models which modify Kripke models with an operation called product update. These models allow us to represent actions together with the agents' perception of their occurrence.

Several recent approaches to multi-agent epistemic planning are based on DEL, starting with [START_REF] Bolander | Epistemic planning for single and multi-agent systems[END_REF][START_REF] Löwe | DEL planning and some tractable cases[END_REF]. While DEL provides a very expressive framework, it was unfortunately proven to be undecidable even for rather simple fragments of the language. For example, if actions make factual changes to the world, then the problem is undecidable whenever epistemic operators are allowed in preconditions of actions; if actions are purely epistemic, then it is undecidable whenever two agents are involved or the epistemic depth exceeds 2 [START_REF] Aucher | Undecidability in epistemic planning[END_REF]Charrier et al., 2016a]. Some decidable fragments were studied, most of which focused on public events [START_REF] Löwe | DEL planning and some tractable cases[END_REF][START_REF] Yu | A dynamic epistemic framework for conformant planning[END_REF]. However, we will see that some tasks such as the gossip problem requires private communication.

There exist other approaches on planning with uncertainty that do not use DEL. The framework presented in [START_REF] Kominis | Beliefs in multiagent planning: from one agent to many[END_REF] allows us to reason about knowledge on literals in a multi-agent setting. A similar approach with beliefs can be found in [START_REF] Muise | Planning over multi-agent epistemic states: A classical planning approach[END_REF]. While restricted to a single agent, the framework of [START_REF] Petrick | Extending the Knowledge-Based Approach to Planning with Incomplete Information and Sensing[END_REF]] deals with "knowing that" but also "knowing whether" formulas (i.e., knowing p or knowing ¬p).

We will show in Chapter 4 how to encode more general multi-agent epistemic planning problems within the framework of our logic of visibility, keeping the complexity low in comparison with DEL-based approaches.

Aim and contributions of the thesis 1.5.1 Aim of the thesis

The aim of the present thesis is to demonstrate that visibility-based epistemic logics provide a suitable tool for important applications in the field of artificial intelligence. This requires to solve the two issues we identified in Section 1.1.2: common knowledge of visibilities and the epistemic operator distributing over disjunctions. We illustrate the result with well-known toy examples of epistemic logic as well as with more general applications such as epistemic planning and boolean games.

A higher-level motivation behind logics of visibility and the generalisations we propose is also notable: we consider that, given a particular problem, the design and use of an epistemic model is easier with them. As an example, designing the Kripke model which describes the initial situation the muddy children problem may be a difficult task, especially for someone not fully familiar with modal logic. As we will see in Chapter 6, writing down the same situation in terms of visibility is obvious. One could argue hat models do not have to be constructed from scratch: there exist techniques to infer a model from a formula, such as the tableaux method [START_REF] Fitting | Proof methods for modal and intuitionistic logics[END_REF]. The resulting models may still be complex to handle and to work with for non-logicians. Moreover, adding actions to standard epistemic logic leads to DEL. While being highly expressive, the design of a DEL event model (representing an action) is even more complex than of an epistemic Kripke model. This hardness has led to the research of fragments such as Public Announcement Logic PAL. We have also seen that in the field of epistemic planning, where the standard approach relies on DEL, alternative methods are proposed to avoid its arduousness. We will see that the inclusion of actions in our logics of visibility is straightforward and that they are easy to handle. We hope that this encourage the use of formal methods for concrete applications involving reasoning about knowledge such as in cyber security, autonomous vehicles or video games.

Outline of the thesis

In Chapter 2, we add higher-order knowledge to observability-based logics and allow for situations where, e.g., agent i sees variable p but agent j does not see whether i sees p. This logic, which we call DEL-PAO, solves the first issue: observations are not common knowledge any more. This chapter is based on [START_REF] Herzig | A poor man's epistemic logic based on propositional assignment and higher-order observation[END_REF].

DEL-PAO allows us to model in a natural way scenarios such as a generalisation of the gossip problem. In the original gossip problem, friends exchange secrets via telephone calls until everyone knows all secrets. In the novel generalisation studied in Chapter 3, we want that everyone knows all secrets, but also that everyone knows this, and so on until a fixed depth. This chapter is based mostly on [Herzig and Maffre, 2016], with the exception of the proof of optimality that can be found in [START_REF] Cooper | Simple epistemic planning: generalised gossiping[END_REF].

In Chapter 4, we apply DEL-PAO to epistemic planning. We show how our framework allows us to express many problems of epistemic planning (such as the gossip problem) while avoiding the undecidability of current methods based on DEL. This chapter is based on [Cooper et al., 2016a].

The framework of DEL-PAO can also be easily extended with atoms of control, modelling strategic abilities and epistemic boolean games as introduced in Section 1.3. This extension is presented in Chapter 5. This chapter is based on [Herzig et al., 2016].

We show in Chapter 6 how to take into account public announcements, as popularized in dynamic epistemic logics and more generally publicly executed programs. Knowledge may now originate from two sources: observations and communication. This solves the second issue: knowledge operators do not distribute over disjunctions any more. This chapter is based on [Charrier et al., 2016a].

Finally, Chapter 7 settles the complexity of the model checking problem of all presented logics. It introduces a framework into which every given logic can be translated and presents an algorithm solving the model checking problem for this framework that runs in PSPACE. This chapter is based on a section of [Charrier et al., 2016a].

Every paper this thesis is based on is, for most parts, the result of collaborative work between all its authors. Notable parts in which the author of the thesis has less participated in are: the optimality proof of Chapter 3; the translation into PDDL of Chapter 4; the application to epistemic boolean games of Chapter 5; the model checking algorithms of Chapter 7.

Moreover, several changes have been made by the author of the thesis to some parts of the papers, including corrections of errors and new results, the most important being the inclusion of the Kleene star into the language of programs. They are signalled by footnotes indicating what was altered. Explanations and proofs have also been globally expanded. Finally, drawings have been added, with the sole aim to decorate examples given throughout the thesis. These illustrations were made by the author and are free to use.

Contributions not detailed in this thesis

Formal properties of the generalized gossip problem

Other interesting properties of the generalized gossip problem, introduced in Chapter 3, and not included in this thesis can be found in [START_REF] Cooper | Simple epistemic planning: generalised gossiping[END_REF] (with a long version in [START_REF] Cooper | Simple epistemic planning: generalised gossiping[END_REF]). In this paper, we more generally consider the case where graphs are not complete, i.e., where some agents cannot call each other. We study the necessary number of calls and the complexity of the generalised gossip problem and its variant with ignorance goals, as well as:

• the one-way gossip, where calls are replaced by e-mails;

• the parallel gossip, where we are interested in the number of steps required rather than in the number of calls;

• the gossip with variable secrets, where agents can switch the value of their secrets.

An important result of this paper, namely, the proof of optimality of the algorithm for the standard generalized gossip problem, is nevertheless included in Chapter 3.

Alternating-time temporal logic with commitments

In [START_REF] Herzig | Reasoning about actions meets strategic logics[END_REF], the authors introduce Alternating-time Temporal Logic with Explicit Actions ATLEA, which extends the language of Alternating-time Temporal Logic ATL with commitments on actions. These commitments specify the next action the agent will perform. This is a first step towards a full specification of strategies that is not included in ATL: operators J only indicates whether the coalition of agents J has a strategy to ensure some state or not, without giving any hint on the actions composing this strategy.

In [START_REF] Herzig | Alternatingtime Temporal Logic with Explicit Programs[END_REF], we followed this line of work and introduced Alternating-time Temporal Logic with Explicit Programs ATLEP. In ATLEP, atomic commitments are ATLEA commitments, and complex commitments are constructed using dynamic logic operators. Agents may not only commit to the next action, but also on the ones following the next action. They can also commit on different actions depending on the current state, by using tests, and even commit infinitely thanks to a special operator of infinite iteration.

This work was set aside because we were only able to specify the semantics of ATLEP in a very complicated way, making the study of properties such as axiomatization or complexity difficult, and decreasing the chances of building interesting work over it. One lead might be to not consider PDL but instead the less complex language of DL-PA for actions, but this was not investigated. We do not include this work in this thesis because of its lack of connection with the more recent contributions on logics of visibility.

A simple dynamic epistemic logic based on observation

A drawback of current logics of visibility is that what each agent can see is common knowledge to all agents. This is a strong hypothesis that we are going to relax in the present chapter.

In existing frameworks, visibility information is in terms of propositional variables associated to agents. We here consider propositional variables associated to sequences of agents, giving the central logic of this thesis: DEL-PAO.

Syntactically, we represent visibility information by means of atomic formulas that we call visibility atoms. They take the form S i 1 S i 2 . . . S in p, where p is a propositional variable and i 1 , i 2 , . . . , i n are agents. When n=0 then we have nothing but a propositional variable. For n=1, the atom S i 1 p reads "agent i 1 sees the value of the variable p," and for n=2, the second-order observation S i 1 S i 2 p reads "agent i 1 sees whether i 2 sees the value of p," and so on.

Our models are valuations as presented in the introduction, i.e., sets of atoms. In order to guarantee positive and negative introspection we have to ensure that agents are always aware of what they see: for every agent i and propositional variable p, we require S i S i p to be in every valuation. We say that a valuation V is introspective when it contains every visibility atom having two consecutive S i , such as S j S i S i S k p.

Visibility information allows us to interpret epistemic operators as in other visibility-based logics; the truth condition for K i ϕ is based on a relation between valuations that can be defined from our visibility atoms: V ∼ i V if every atom that i sees in V has the same truth value in V and in V . While the relations ∼ i are reflexive on the set of all valuations, they are symmetric and transitive-and therefore equivalence relations-on the set of introspective valuations only. The positive and negative introspection axioms K i ϕ → K i K i ϕ and ¬K i ϕ → K i ¬K i ϕ are valid in the set of introspective valuations.

A further novelty of our approach as compared to existing visibilitybased epistemic logics is that we also account for common knowledge: our language includes a special atomic formula for joint attention of the form JS p that reads "all agents jointly see the value of p." Metaphorically, joint attention about a propositional variable p can be understood as eye contact between the agents when observing p. Just as individual visibility, we generalize our account to higher-order joint visibility, adding a constraint on valuations that guarantees introspection of common knowledge. We moreover require that joint visibility implies individual visibility by imposing that S i p ∈ V whenever JS p ∈ V . We can then interpret a modal operator of common knowledge CK in the same way as the modal operator of individual knowledge.

Just as several existing proposals, we take inspiration from dynamic epistemic logics DEL [START_REF] Van Ditmarsch | Dynamic Epistemic Logic[END_REF] and add dynamics to our observation-based epistemic logic. This will allow us to model systems where knowledge, but also facts of the world, change over time. Specifically, we adapt van der Hoek et al.'s logic LRC which has two update operations modifying visibility: reveal and conceal the value of a variable to some agent. These two primitives can however not be taken over as they stand because the naive update of a valuation may no longer be introspective. We exclude this by an appropriate definition of update. We relate our assignment programs to DL-PA [START_REF] Herzig | A dynamic logic of normative systems[END_REF][START_REF] Balbiani | Dynamic logic of propositional assignments: a well-behaved variant of PDL[END_REF]. We show how visibility updates can capture private announcements of literals, conjunctions and knowledge of literals.

We call our logic DEL-PAO: Dynamic Epistemic Logic of Propositional Assignment and Observation.

Contents

Résumé du chapitre

Un inconvénient des logiques actuelles de visibilité est que ce que chaque agent voit est connaissance commune pour tous les agents. Ceci est une hypothèse forte que nous allons relâcher dans ce chapitre. Dans les logiques existantes, les informations de visibilité sont sous forme d'ensembles de variables propositionnelles associés aux agents. Nous considérons ici des variables propositionnelles associées à des séquences d'agents, ce qui donne la logique centrale de la thèse : DEL-PAO.

Syntaxiquement, nous représentons les informations de visibilité au moyen de formules atomiques que nous appelons atomes de visibilité. Ils sont de la forme S i 1 S i 2 . . . S in p, où p est une variable propositionnelle et i 1 , i 2 , . . . , i n sont des agents. Pour n=0 nous obtenons simplement variable propositionnelle. Pour n=1, l'atome S i 1 p se lit "l'agent i 1 voit la valeur de la variable p", et pour n=2, l'observation du second ordre S i 1 S i 2 p se lit "l'agent i 1 voit si i 2 voit la valeur de p", etc.

Nos modèles sont les valuations comme celles présentées dans l'introduction, c'est-à-dire, des ensembles d'atomes. Afin de garantir l'introspection positive et négative, nous devons nous assurer que les agents sont toujours conscients de ce qu'ils voient : pour chaque agent i et variable propositionnelle p, chaque valuation doit contenir S i S i p. Une valuation V est dite introspective si elle contient tout atome de visibilité ayant deux S i consécutifs, comme par exemple S j S i S i S k p.

Ces informations de visibilité nous permettent d'interpréter les opérateurs épistémiques de la même façon que dans les autres logiques basées sur la visibilité ; la condition de vérité pour K i ϕ est basée sur une relation entre les valuations qui peut être définie à partir de nos atomes de visibilité : V ∼ i V si chaque atome que i voit dans V a la même valeur de vérité dans V et dans V . Alors que les relations ∼ i sont réflexives sur l'ensemble des valuations, elles sont symétriques et transitives, et donc des relations d'équivalence, sur l'ensemble des valuations introspectives seulement. Les axiomes d'introspection positive et négative K i ϕ → K i K i ϕ et ¬K i ϕ → K i ¬K i ϕ sont valables dans l'ensemble des évaluations introspectives.

Une autre nouveauté de notre approche par rapport aux logiques épistémiques basées sur la visibilité existantes est que nous considérons la connaissance commune : notre langage inclut une formule atomique spéciale pour l'attention jointe, de la forme JS p, lue "tous les agents voient conjointement la valeur de p". Métaphoriquement, l'attention jointe sur une variable propositionnelle p peut être comprise comme un contact visuel entre les agents lors de l'observation p. Tout comme la visibilité individuelle, nous prenons en compte l'ordre supérieur en ajoutant une contrainte sur les valuations qui garantit l'introspection de la connaissance commune. De plus, nous exigeons que la visibilité commune implique la visibilité individuelle en imposant que S i p ∈ V lorsque JS p ∈ V . On peut alors interpréter un opérateur modal CK de connaissance commune de la même manière que l'opérateur modal de connaissance individuelle.

Tout comme plusieurs propositions existantes, nous nous inspirons des logiques épistémiques dynamiques DEL [START_REF] Van Ditmarsch | Dynamic Epistemic Logic[END_REF] et ajoutons des opérateurs dynamiques à notre logique épistémique basée sur l'observation. Cela nous permettra de modéliser des systèmes où la connaissance, mais aussi les propositions, evoluent au fil du temps. Plus précisément, nous adaptons la logique LRC de van der Hoek et al., qui propose deux opérations de mise à jour modifiant la visibilité : révéler et cacher la valeur d'une variable à un agent. Ces deux primitives ne peuvent toutefois pas être utilisées en l'état, car la mise à jour naïve d'une valuation peut ne plus être introspective. Nous excluons ce cas par une définition appropriée de l'opération de mise à jour. Nos programmes d'affectation sont similaires à ceux de DL-PA [START_REF] Herzig | A dynamic logic of normative systems[END_REF][START_REF] Balbiani | Dynamic logic of propositional assignments: a well-behaved variant of PDL[END_REF]. Nous montrons comment les mises à jour de visibilité peuvent capturer des annonces privées de littéraux, de conjonctions et de connaissance de littéraux.

Nous appelons notre logique DEL-PAO : une logique épistémique dynamique des affectations propositionnelles et de l'observation.

Language of DEL-PAO

Remember that Prop is a countable non-empty set of propositional variables and Agt is a finite non-empty set of agents.

In our language, an atomic formula is a sequence of visibility operators, possibly empty, followed by a propositional variable. The formal definition is as follows.

The set of observability operators is OBS = {S i : i ∈ Agt} ∪ {JS }, where S i stands for individual visibility of agent i and JS stands for joint visibility of all agents. The set of all sequences of visibility operators is 2.1. Language of DEL-PAO noted OBS * and the set of all non-empty sequences is noted OBS + . We use σ, σ , etc. for elements of OBS * . The depth of a sequence of operators σ, noted depth(σ), is the number of operators composing it. Moreover, we note σ[k:], for 0 ≤ k ≤ depth(σ), the sub-sequence starting at the kth element of σ, such that the first element's index is 0. For example, JS S 1 S 2 [1:] = S 1 S 2 and JS S 1 S 2 [2:] = S 2 . Therefore σ[0:] = σ and we suppose σ[depth(σ):] is the empty sequence.

The set of atomic formulas is

ATM = {σ p : σ ∈ OBS * , p ∈ Prop}.
Elements of that set are called visibility atoms, or atoms for short. Here are some examples:

• S 1 p reads "1 sees the value of p." It means that 1 knows whether p is true or false.

• JS S 2 q reads "all agents jointly see whether agent 2 sees the value of q." In other words, there is joint attention in the group of all agents concerning 2's observation of q. This does not imply that 2 sees the value of q.

• S 1 S 2 S 3 p reads "1 sees whether 2 sees whether 3 sees p."

• ... and so on.

We use α, α , β, β , etc. for elements of ATM . The language of DEL-PAO is then defined by the following grammar:

π ::= +α | -α | (π; π) | (π π) | π * | ϕ? ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | CK ϕ | [π]ϕ
where α ranges over ATM and i over Agt.2 Programs have the same meaning as in DL-PA: +α makes α true and -α makes α false, π; π is sequential composition, π π is nondeterministic choice, π * is unbounded iteration, and ϕ? is test. Just as in dynamic logic, the formula [π]ϕ reads "after every execution of π, ϕ is true."

As in other visibility logics, the formula K i ϕ reads "i knows that ϕ on the basis of what she observes." Moreover, CK ϕ reads "all agents commonly know that ϕ on the basis of what they jointly observe." Our epistemic operators account for forms of individual and common knowledge that are respectively obtained via individual observation and joint observation of facts. As we have seen, this differs therefore conceptually from the classical operators of individual and common knowledge as studied in the area of epistemic logic [START_REF] Fagin | Reasoning about Knowledge[END_REF]. We will come back to this in Section 2.2.6.

The other boolean operators , ⊥, ∨, → and ↔ are defined in the standard way. Dual operators K i ϕ ("ϕ is compatible with i's knowledge") abbreviates ¬K i ¬ϕ and π ϕ ("there exists an execution of π after which ϕ is true") abbreviates ¬[π]¬ϕ. The program skip abbreviates ? and fail abbreviates ⊥?.

We also use π m ("π is repeated m times"), with m ≥ 0, inductively defined by π 0 = skip and π m+1 = π; π m , and π ≤m ("π is repeated m at most times") for 0≤k≤m π k . Finally, if ϕ then π abbreviates (ϕ?; π) ¬ϕ? and if ϕ then π else π abbreviates (ϕ?; π) (¬ϕ?; π ).

The set of atomic formulas from ATM occurring in the formula ϕ is noted ATM (ϕ). It is inductively defined as:

ATM (α) = α ATM (¬ϕ) = ATM (ϕ) ATM (ϕ ∧ ϕ ) = ATM (ϕ) ∪ ATM (ϕ ) ATM (K i ϕ) = ATM (ϕ) ATM (CK ϕ) = ATM (ϕ) ATM ([π]ϕ) = ATM (π) ∪ ATM (ϕ)
with ATM (π) the set of atoms occurring is the program π, defined as:

ATM (+α) = α ATM (-α) = α ATM (π; π ) = ATM (π) ∪ ATM (π ) ATM (π π ) = ATM (π) ∪ ATM (π ) ATM (π * ) = ATM (π) ATM (ϕ?) = ATM (ϕ)
For example, let π = q?; +S 2 p and ϕ = [π]S 1 JS p. Then ATM (π) = {q, S 2 p} and ATM (ϕ) = {q, S 2 p, S 1 JS p}. Note that JS p is not an atom of ϕ.

Semantics of DEL-PAO

We denote valuations by V , V , etc. Remember that a valuation is simply a subset of the set of atoms ATM . The set of all valuations is again 2 ATM .

In this section, we stipulate constraints that are motivated by the requirement that visibility information should be introspective and that joint visibility should imply individual visibility. We then define indistinguishability relations between valuations and show how to interpret formulas and programs.

Introspective valuations

A valuation V ∈ 2 ATM is introspective if and only if the five following constraints hold, for every α ∈ ATM and i ∈ Agt:

S i S i α ∈ V (C1) JS JS α ∈ V (C2) JS S i S i α ∈ V (C3) if JS α ∈ V , then S i α ∈ V (C4) if JS α ∈ V , then JS S i α ∈ V (C5)
The set of all introspective valuations is noted INTR.

In words, (C1) impose introspection of individual sight: an agent always sees whether she sees the value of an atom. (C2) requires the same for joint sight; indeed, if JS α is true then JS JS α should be true by introspection, and if JS α is false then all agents jointly see that at least one of them has broken eye contact. (C3) forces the first to be common knowledge. (C4) guarantees that joint visibility implies individual visibility. The constraints (C4) and (C5) ensure that JS α ∈ V implies σ α ∈ V for σ ∈ OBS + .

This motivates the following relation of introspective consequence between atoms:

α ⇒ I β iff either α = β, or α = JS α and β = σ α for some σ ∈ OBS + .
When α ⇒ I β, we say that α is an introspective cause of β and that β is an introspective consequence of α. For a given α, we note α ⇐ the set of introspective causes of α, and α ⇒ the set of its introspective consequences.

Proposition 2.1. A valuation V ⊆ ATM is introspective if and only if, for every α, β ∈ ATM and i ∈ Agt:

σ S i S i α ∈ V for every σ ∈ OBS * (P1) σ JS α ∈ V for every σ ∈ OBS + (P2) if α ∈ V and α ⇒ I β then β ∈ V (P3)
Proof. We prove that, for a valuation V , the constraints (C1)-(C5) are satisfied if and only if (P1), (P2) and (P3) hold.

For the left-to-right direction, we begin with (P3). The interesting case is when α = JS α (otherwise the only introspective consequence of α is itself). Suppose JS α ∈ V . By constraint (C5), we know that JS S i 1 α ∈ V , and also that JS S i 2 S i 1 α ∈ V for any i 1 and i 2 , and so on. By repeating the application of (C5), we can generate any JS S im . . . S i 1 α and then, by (C4), we can obtain S i S im . . . S i 1 α for any agents i 1 , . . . i m and i. Moreover, we have JS JS α ∈ V by (C2), and in the same way, we can generate S i S im . . . S i 1 JS α for any agents i 1 , . . . i m and i. By choosing α appropriately, we can therefore obtain any sequence containing any S i and JS , that is, all σ α for any σ ∈ OBS + .

Using the same technique, we obtain σ S i S i α and σ JS α, the first with (C1) (for σ empty) and (C3) (for σ non-empty), and the second with (C2).

The other way round, constraints (C1), ( C2) and (C3) are respectively instances of (P1), ( P2) and (P1); and constraints (C4) and (C5) are both guaranteed by (P3).

An atom α ∈ ATM is called valid in INTR, or introspectively valid, if and only if α belongs to every valuation in INTR.

Proposition 2.2. The atom α is valid in INTR if and only if α is:

• either of the form σ S i S i α with σ ∈ OBS * ; • or of the form σ JS α with σ ∈ OBS + .
Proof. The right-to-left direction is obvious by Proposition 2.1.

For the left-to-right direction, we prove that every atom in INTR, i.e., every atom specified in Proposition 2.1, is of one of the given forms.

The first two items of Proposition 2.1 are already in the right form; we only need to prove that for every β such that either σ S i S i α ⇒ I β or σ JS α ⇒ I β, β is of the form σ S i S i α or σ JS α .

• Take α = σ S i S i α with σ ∈ OBS * . Suppose that σ contains at least one observability operator and starts with a JS (otherwise, the only consequence of α is itself). Thus α = JS σ S i S i α with σ ∈ OBS * . Then by the definition of introspective consequence, α ⇒ I β if and only if β = σ σ S i S i α with σ ∈ OBS * and σ ∈ OBS + , that is, β is captured by the form (P1) of Proposition 2.1.

• Now take α = σ JS α with σ ∈ OBS + , and suppose that σ starts with a JS : α = JS σ JS α with σ ∈ OBS * . Thus α ⇒ I β if and only if β = σ σ JS α with σ ∈ OBS * and σ ∈ OBS + , that is, β is captured by the form (P2) of Proposition 2.1.

Hence closure under introspective consequence characterizes introspective valuations. Therefore valid atoms are exactly of the two given forms.

In words, any atom containing a sequence S i S i or containing (but not starting with) a JS is introspectively valid.

Observe that we do not impose the constraint "if σ α ∈ V for every σ ∈ OBS * then JS α ∈ V ," which corresponds to the greatest fixed point definition of the operator of common knowledge from shared knowledge. We will comment on this in Section 2.2.6.

Introspective causes and consequences

In this section, we study in more detail the relation of dependence between atoms that we defined in the previous section:

α ⇒ I β iff either α = β, or α = JS α and β = σ α for some σ ∈ OBS + .
As we will see, this relation is omnipresent in DEL-PAO, especially when dealing with assignments. Remember that we note α ⇐ the causes of α and α ⇒ its consequences. We characterize them depending on the form of α:

• α = p with p ∈ Prop: -α ⇐ = {p}; -α ⇒ = {p}.
• α = S i σ p with σ ∈ OBS * and p ∈ Prop:

-α ⇐ = {JS σ[k:] p : 0 ≤ k ≤ depth(σ)} ∪ {S i σ p}; -α ⇒ = {S i σ p}.
• α = JS σ p with σ ∈ OBS * and p ∈ Prop:

-α ⇐ = {JS σ[k:] p : 0 ≤ k ≤ depth(σ)}; -α ⇒ = {σ σ p : σ ∈ OBS + }.
Consequences are obvious from the definition of ⇒ I : only atoms starting with a JS may have consequences different from themselves; they are all atoms obtained by replacing the JS operator by any sequence of visibility operators.

Causes are less straightforward. The first case is easy: p has no cause but itself. For the other cases, we actually are in two similar situations: the only difference is that when α starts with a JS , then it is itself contained in the set {JS σ

[k:] p : 0 ≤ k ≤ depth(σ)} (case k = 0).
This latter set may seem complicated so let us illustrate it with an example. Suppose we want the causes of JS S 1 S 2 p. We are looking for every atom starting with a JS operator such that we can replace the JS by any sequence of depth at least 1 to obtain JS S 1 S 2 p. There are three of them:

1. JS S 1 S 2 p itself (replace JS by JS ); 2. JS S 2 p (replace JS by JS S 1 ); 3. JS p (replace JS by JS S 1 S 2 ).

JS JS S 1 S 2 p, for example, would not be eligible because the first JS cannot be replaced by a sequence of depth at least 1. (This implies that the depths of causes of α are always smaller or equal to the depth of α.) Therefore the causes of S i σ p or JS σ p are every atom starting with a JS operator and followed by any postfix of σ (including the empty sequence), hence the result. Note the special case of JS p: its only cause is itself.

We will use these definitions and the following properties to demonstrate equivalences between sequences of assignments in Section 2.3. Proposition 2.3. Let α be an atom. Then α ⇐ ∩ α ⇒ = {α}.

Proof. With the above definitions, the cases where α = p and α = S i σ p are obvious. The last case, where α = JS σ p, derives from the fact that all other causes of α have a depth strictly lower than α and all other consequences of α starting with a JS have depth strictly higher than α. Proof. Suppose γ = α and γ = β, otherwise the result is obvious. Since α ⇒ I γ, we have α = JS α and γ = σ 1 α with σ 1 ∈ OBS + . Moreover, because γ ⇒ I β, we have γ = JS γ and β = σ 2 γ with σ 2 ∈ OBS + .

Thus γ = σ 3 α with σ 3 ∈ OBS * and hence β = σ 2 σ 3 α (where σ 2 ∈ OBS + ) which is of the form σ 1 α , with σ 1 ∈ OBS + , and therefore a consequence of α. Therefore α ⇒ I β.

Proposition 2.4 implies that if α ⇒ I β, then α ⇐ ⊆ β ⇐ and β ⇒ ⊆ α ⇒ .
Proposition 2.5. Let α and β be two atoms.

If α ⇒ I β and β ⇒ I α, then α ⇐ ∩ β ⇒ = ∅ and α ⇒ ∩ β ⇐ = ∅.
Proof. To prove that α ⇐ ∩ β ⇒ = ∅, suppose there exists an atom γ such that γ ∈ α ⇐ and γ ∈ β ⇒ . This implies that γ ⇒ I α and that β ⇒ I γ.

Hence by Proposition 2.4, β ⇒ I α, which contradicts our hypothesis.

The reasoning for α ⇒ ∩ β ⇐ = ∅ is similar.

Indistinguishability relations

As usual in visibility logics, two valuations are related by the indistinguishability relation for agent i, noted ∼ i , if every α that i sees has the same value. The relation ∼ Agt acts similarly for joint indistinguishability. They are defined as follows:

V ∼ i V iff S i α ∈ V implies V (α) = V (α) V ∼ Agt V iff JS α ∈ V implies V (α) = V (α)
with, as in the introduction,

V (α) = V (α) when either α ∈ V and α ∈ V , or α / ∈ V and α / ∈ V . In the following, let us write V = A V , with A ⊆ ATM , in place of "V (α) = V (α) for every α ∈ A." Thus V ∼ i V if and only if V = {α:S i α∈V } V and V ∼ Agt V if and only if V = {α:JS α∈V } V .
Now that we account for higher-order knowledge and that visibilities are not constant across ∼ i and ∼ Agt , the two binary relations are not equivalence relations. Indeed, while being reflexive, they are neither symmetric nor transitive in the general case. For example, ∅ ∼ i {p, S i p} while {p, S i p} ∼ i ∅ since p / ∈ ∅. However, both properties hold on valuations satisfying the introspection constraints (C1) and (C2).

Proposition 2.6. The relation ∼ Agt and every ∼ i are equivalence relations on INTR.

Proof. Reflexivity is obvious from the definition of relations. We prove symmetry and transitivity of ∼ i for an arbitrary agent i. The proof for ∼ Agt is analogous, but with (C2) instead of (C1).

• Symmetry. Take two valuations V, V ∈ INTR. Suppose V ∼ i V and V ∼ i V . By the former, for every α, if S i α ∈ V then V (α) = V (α)
. By the latter, there exists a β such that

S i β ∈ V and V (β) = V (β). Thus this β is such that S i β / ∈ V . Therefore there exists a β such that S i β ∈ V but S i β / ∈ V , that is, V (S i β) = V (S i β). Since V ∈ INTR, we have S i S i α ∈ V for every α by constraint (C1). This means that for every α, V (S i α) = V (S i α). We obtain a contradiction, thus V ∼ i V . • Transitivity. Take three valuations V, V , V ∈ INTR. Suppose V ∼ i V , V ∼ i V and V ∼ i V . By the first two hypotheses, for every α, if S i α ∈ V then V (α) = V (α) and if S i α ∈ V then V (α) = V (α). As observed above, since V ∈ INTR, V (S i α) = V (S i α) for every α. Therefore if S i α ∈ V , then S i α ∈ V , that is, if S i α ∈ V , V (α) = V (α) and V (α) = V (α), thus V (α) = V (α), for every α.
This contradicts the third hypothesis since the latter implies that there exists a β such that

S i β ∈ V and V (β) = V (β). Therefore V ∼ i V .
Therefore ∼ Agt and ∼ i are equivalence relations on INTR.

Lemma 2.1. Let V ∈ INTR and V ∈ 2 ATM . If V ∼ i V or V ∼ Agt V then V ∈ INTR.
Proof. Suppose that V ∼ i V for an arbitrary agent i and that V ∈ INTR.

We prove that V satisfies constraints (C1)-(C5). Recall that the five constraints are equivalent to the three properties (P1)-(P3) of Proposition 2.1. The proof for ∼ Agt is analogous. Take an arbitrary agent j.

• (C1). By (P1), S i S j S j α ∈ V and S j S j α ∈ V . Thus S j S j α ∈ V .

• (C2). By (P2), S i JS JS α ∈ V and JS JS α ∈ V . Thus JS JS α ∈ V . • (C3). By (P1), S i JS S j S j α ∈ V and JS S j S j α ∈ V . Thus JS S j S j α ∈ V . • (C4). Suppose JS α ∈ V . By (P2), S i JS α ∈ V , thus V (JS α) = V (JS α) and thus JS α ∈ V . By (P3), this implies that both S i S j α ∈ V and S j α ∈ V . Thus S j α ∈ V .
• (C5). Suppose JS α ∈ V . As observed with the previous item, this implies that JS α ∈ V . Thus by (P3), both S i JS S j α ∈ V and

JS S j α ∈ V . Thus JS S j α ∈ V . Therefore V ∈ INTR.
Together, Proposition 2.6 and Lemma 2.1 ensure that ∼ i and ∼ Agt have a "proper behaviour" on introspective valuations and that they cannot exit them. While only (C1) and (C2) are necessary to ensure the former, for the latter all constraints are required.

Valuation updates

Given an introspective valuation V , our update operations add or remove atoms from V . This requires some care: we want the resulting valuation to be introspective. For example, removing S i S i p should be impossible. Another example is when V does not contain S i p: then V ∪ {JS p} would violate (C4).

Thus, when adding an atom to V , we also have to add all its introspective consequences; symmetrically, when removing an atom we also have to remove its introspective causes. To that end, let us define the following update operations on valuations:

V +α = V ∪ α ⇒ V -α = V \ α ⇐ Proposition 2.7. Let V ∈ INTR and α ∈ ATM . Then V +α ∈ INTR. Moreover, if α is not valid in INTR, then V -α ∈ INTR.
Proof. Doing either V +α, or V -α such that α is not valid in INTR, implies that we are not deleting any valid atom in the process. Therefore we only have to take care that property (P3) of Proposition 2.1 (introspective consequence) is preserved:

• when adding α, adding every β such that α ⇒ I β ensures that it is;

• when removing α, removing every β such that β ⇒ I α ensures that no atom can still introspectively imply α, thus preserving introspective consequence.

Therefore V +α and V -α are introspective.

V +α and V -α will be the updated worlds resulting from adding α to V or removing α (if not valid) from V . Proposition 2.7 ensures that corresponding atomic programs +α and -α will preserve introspection.

Truth conditions and validity

Truth conditions are as follows:

V |= α iff α ∈ V V |= ¬ϕ iff not (V |= ϕ) V |= ϕ ∧ ϕ iff V |= ϕ and V |= ϕ V |= K i ϕ iff V |= ϕ for every V such that V ∼ i V V |= CK ϕ iff V |= ϕ for every V such that V ∼ Agt V V |= [π]ϕ iff V |= ϕ for every V such that V R π V
where R π is a binary relation on valuations defined by:

V R +α V iff V = V +α V R -α V iff V = V -α and α is not valid in INTR V R π;π V iff V (R π • R π )V V R π π V iff V (R π ∪ R π )V V R π * V iff V ( k∈N 0 (R π ) k )V V R ϕ? V iff V = V and V |= ϕ
Truth conditions are defined on any valuation V ∈ 2 ATM . However, we have seen that indistinguishability relations ∼ i and ∼ Agt will not be equivalence relations outside of introspective valuations. Therefore knowledge operators may have unexpected behaviour in that case.

The relation R π is defined like in dynamic logic for the program operators ;, , * and ?. As noted in the previous section, the interpretation of assignments is designed in a way such that we stay in INTR: the program +α adds all the consequences of α; the program -α fails if α is valid in INTR and otherwise removes all the causes of α. For example, we never have V R -S 1 S 1 p V , i.e., the program -S 1 S 1 p always fails (thus the formula [-S 1 S 1 p]ϕ is always true, whatever ϕ). In contrast, the program -S 1 S 2 p always succeeds, and we have V R -S 1 S 2 p (V \ {S 1 S 2 p, JS S 2 p, JS p}) because as we have seen in Section 2.2.2, the only atoms-beyond S 1 S 2 p itself-whose consequence is S 1 S 2 p are JS S 2 p and JS p. Therefore V |= [-S 1 S 2 p]¬JS p for every V .

We say that two programs π 1 and π 2 are equivalent, noted

π 1 ≡ π 2 , if and only if R π 1 equals R π 2 , i.e., for every V, V ∈ 2 ATM we have V R π 1 V if and only if V R π 2 V . Lemma 2.2. Let V ∈ INTR and V R π V . Then V ∈ INTR.
Proof. By Proposition 2.7, we know that R +α and R -α preserve introspection. R π;π , R π π and R π * make unions and compositions and thus preserve introspection, assuming R π and R π do. Finally, R ϕ? relates the current valuation to itself and thus trivially stays in INTR.

Proposition 2.8. For every V ∈ INTR, i ∈ Agt and program π, V is related by ∼ i , ∼ Agt and R π only to valuations in INTR.

Proof. This is a direct consequence of lemmas 2.1 and 2.2.

When V |= ϕ we say that V is a model of ϕ. The set of (not necessarily introspective) models of ϕ is noted ϕ .

A formula ϕ is satisfiable in

INTR if ϕ has an introspective model, i.e., if ϕ ∩ INTR = ∅; it is valid in INTR if INTR ⊆ ϕ . A formula ϕ is plainly satisfiable if it has a model, i.e., if ϕ = ∅; it is plainly valid if ϕ is true in all models, i.e., if ϕ = 2 ATM .
For example, JS p ∧ ¬S i p is plainly satisfiable but not satisfiable in INTR. On the other hand, [-S 1 S 2 p]¬JS p is valid in INTR (and even plainly valid).

Proposition 2.9. Let ϕ be a formula without epistemic operators. Let

V, V ∈ 2 ATM be such that V = ATM (ϕ) V . Then V |= ϕ if and only if V |= ϕ. Remember that V = A V means that V (α) = V (α) for every α ∈ A.
Proof. We prove by mutual recursion on formulas and programs the two following hypotheses:

• H f (ϕ): if V = ATM (ϕ) V , then V |= ϕ if and only if V |= ϕ; • H p (π): for every A ⊆ ATM : if V = ATM (π)∪A V , then for every U ∈ 2 ATM such that V R π U , there exists U ∈ 2 ATM such that V R π U and U = A U .
Take two arbitrary valuations V, V ∈ 2 ATM . We begin with H f (ϕ). Using the definition of ATM (ϕ), the proof is straightforward for atoms and boolean operators. We only examine the case where ϕ = [π]ϕ .

By definition of ATM (ϕ), we have

ATM (ϕ) = ATM (π) ∪ ATM (ϕ ), hence suppose V = ATM (π)∪ATM (ϕ ) V . We prove that for every U such that V R π U , U |= ϕ if and only if for every U such that V R π U , U |= ϕ .
By H p (π), we have:

for every U such that V R π U, there exists U such that V R π U and U = ATM (ϕ ) U .
We also have:

for every U such that V R π U , there exists U such that V R π U and U = ATM (ϕ ) U .
By H f (ϕ ), they become:

for every U such that V R π U,

there exists U such that V R π U and U |= ϕ if and only if U |= ϕ (2.1)
and for every U such that V R π U ,

there exists U such that V R π U and U |= ϕ if and only if U |= ϕ . (2.2)
For the left-to-right direction, suppose that U |= ϕ for every U such that V R π U , but that there exists U such that V R π U and U |= ϕ . By (2.2), the latter implies that there exists U such that V R π U and U |= ϕ , which contradicts the former. The right-to-left direction is analogous but using (2.1). Therefore for every

U such that V R π U , U |= ϕ if and only if for every U such that V R π U , U |= ϕ .
We now move to H p (π). We suppose that in all cases, π does not fail; otherwise, H p (π) is trivially true since there is no U such that V R π U . Moreover, as we will see in the axiomatization (Section 2.3), π * can be reduced to π ≤2 2|ATM (π)| , which is a non-deterministic composition of sequences of π. Therefore we skip this case.

Take an arbitrary set of atoms A ⊆ ATM .

• π = +α. We have ATM (π) = {α}, thus suppose V = {α}∪A V . The program is deterministic: U = V +α and U = V +α. Take an arbitrary atom β ∈ A.

-Suppose α ⇒ I β: then β was added by +α and thus β ∈ U and β ∈ U .

-Now suppose α ⇒ I β: then β was not modified by +α. Thus

U (β) = V (β) and U (β) = V (β). Since V (β) = V (β) (because β ∈ A), then U (β) = U (β).
In both cases, β has the same value in U and in U : U = A U .

• π = -α. The proof is analogous to the case π = +α.

• π = π 1 ; π 2 . We have ATM (π) = ATM (π 1 ) ∪ ATM (π 2 ), thus sup- pose V = ATM (π 1 )∪ATM (π 2 )∪A V . By H p (π 1 ), this implies that: for every U 1 such that V R π 1 U 1 , there exists U 1 such that V R π 1 U 1 and U 1 = ATM (π 2 )∪A U 1 .
This time by H p (π 2 ), this gives:

for every U 1 such that V R π 1 U 1 , there exists U 1 such that V R π 1 U 1 and for every U such that U 1 R π 2 U, there exists U such that U 1 R π 2 U and U = A U .
Since π does not fail:

for every U such that there exists

U 1 such that V R π 1 U 1 and U 1 R π 2 U, there exists U and U 1 such that V R π 1 U 1 and U 1 R π 2 U and U = A U .
This is equivalent to:

for every U such that V R π 1 ;π 2 U, there exists U such that V R π 1 ;π 2 U and U = A U ,
which is our result.

• π = π 1 π 2 . We have ATM (π) = ATM (π 1 ) ∪ ATM (π 2 ), thus sup- pose V = ATM (π 1 )∪ATM (π 2 )∪A V .
By applying H p (π 1 ) and H p (π 2 ), we obtain:

for every U 1 such that V R π 1 U 1 , there exists U 1 such that V R π 1 U 1 and U 1 = ATM (π 2 )∪A U 1 and for every U 2 such that V R π 2 U 2 , there exists U 2 such that V R π 2 U 2 and U 2 = ATM (π 1 )∪A U 2 . Note that if V = B∪A V , then V = A V , thus: for every U 1 such that V R π 1 U 1 , there exists U 1 such that V R π 1 U 1 and U 1 = A U 1 and for every U 2 such that V R π 2 U 2 , there exists U 2 such that V R π 2 U 2 and U 2 = A U 2 .
This implies, by addition:

for every U 1 such that V R π 1 U 1 , there exists U 1 such that V R π 1 U 1 and U 1 = A U 1 or there exists U 2 such that V R π 2 U 2 and U 1 = A U 2 and for every U 2 such that V R π 2 U 2 , there exists U 2 such that V R π 2 U 2 and U 2 = A U 2 or there exists U 1 such that V R π 1 U 1 and U 2 = A U 1 .
Thus:

for every U 1 such that V R π 1 U 1 , there exists U such that V R π 1 U or V R π 2 U and U 1 = A U and for every U 2 such that V R π 2 U 2 , there exists U such that V R π 2 U or V R π 1 U and U 2 = A U ,
that is:

for every U such that V R π 1 U or V R π 2 U, there exists U such that V R π 1 U or V R π 2 U and U = A U .
This is equivalent to:

for every U such that V R π 1 π 2 U, there exists U such that V R π 1 π 2 U and U = A U ,
which is our result.

• π = χ?. We have ATM (π) = ATM (χ), hence suppose V = ATM (χ)∪A V . As we have seen, this implies V = ATM (χ) V , and by H f (χ), we thus have V |= χ if and only if V |= χ. We have assumed that π does not fail; this implies that V |= χ and thus that V |= χ, hence

U = V and U = V . Thus U = ATM (χ)∪A U and therefore U = A U . Therefore if V = ATM (ϕ) V , V |= ϕ if and only if V |= ϕ.
This proposition will be instrumental in many places across the thesis. Observe that it does not hold when ϕ contains epistemic operators. For example, the truth value of K i p depends on that of S i p, which however does not occur in ATM (K i p). We will see in Section 2.4 how to account for these operators.

Discussion

Both the operators of individual knowledge and the operator of common knowledge of DEL-PAO satisfy all the principles of the standard epistemic logic S5.

We have seen in the introduction that there are also some further validities. For example the distribution of knowledge over disjunction of literals is still valid in DEL-PAO:

K i (p ∨ q) → (K i p ∨ K i q),
cf. the axiom (Red K,∨ ) below. This is a strong principle: to give an example, if one knows that the butler or the gardener was the murderer then one knows which of them it was. We will see how to relax it in Chapter 6.

Our common knowledge operator obeys the fixed point axiom:

CK p → p ∧ i∈Agt K i CK p .
This is ensured by constraints (C2) and (C4) that make the formula i∈Agt S i JS p valid in INTR. Our notion of common knowledge is however weaker than standard common knowledge because the induction axiom

ϕ ∧ CK ϕ → i∈Agt K i ϕ → CK ϕ is invalid in INTR.
To see this, take as an example Agt = {1, 2} and Prop = p. Take the valuation V = {p} ∪ {σ p : σ ∈ OBS + \ {JS }}, i.e., everybody sees p and everybody knows that, but there is no joint visibility of p. This valuation is introspective since every introspectively valid atom belongs to V and JS p, which is absent from V , has no introspective causes but itself. Then

p ∧ CK p → (K 1 p ∧ K 2 p) → CK p
is not true at V . Indeed, given an arbitrary V ∈ 2 ATM , we have:

V |= CK p → (K 1 p ∧ K 2 p) ⇔ V |= CK ¬p ∨ (K 1 p ∧ K 2 p) ⇔ V |= CK ¬p ∨ (S 1 p ∧ S 2 p) ⇔ V |= CK ¬p ∨ (CK S 1 p ∧ CK S 2 p) ⇔ V |= CK ¬p ∨ (JS S 1 p ∧ S 1 p ∧ JS S 2 p ∧ S 2 p)
by the axioms of Proposition 2.10. While V |= CK ¬p, the atoms JS S 1 p, S 1 p, JS S 2 p and S 2 p belong to V . Therefore V |= p ∧ CK p → (K 1 p ∧ K 2 p) . On the other hand, V |= CK p since this is equivalent to JS p ∧ p, and the former is false in V . Therefore the induction axiom is invalid in

INTR.

Observe that defining the indistinguishability relation for common knowledge ∼ Agt as ( i∈Agt ∼ i ) * instead of relying on the JS operator would make the induction axiom valid. Beyond the technical reason for that choice (the corresponding constraint is infinite and thus cannot be axiomatized by formula built from visibility atoms) we follow [START_REF] Lorini | Direct and indirect common belief[END_REF][START_REF] Herzig | Logics of knowledge and action: critical analysis and challenges[END_REF] and assume that such a principle is too strong for a logic of common knowledge.

Axiomatization

Our axiomatization relies on reduction axioms. With them, we are able to reduce any DEL-PAO formula to a propositional formula.

Reduction axioms for epistemic operators

Proposition 2.10. The following formulas are plainly valid, where α is an atom and A + and A -are sets of atoms:

K i α ↔ S i α ∧ α (Red K,α ) CK α ↔ JS α ∧ α (Red CK ,α ) K i ¬α ↔ S i α ∧ ¬α (Red K,¬α ) CK ¬α ↔ JS α ∧ ¬α (Red CK ,¬α ) K i (ϕ ∧ ϕ ) ↔ K i ϕ ∧ K i ϕ (Red K,∧ ) CK (ϕ ∧ ϕ ) ↔ CK ϕ ∧ CK ϕ (Red CK ,∧ ) K i α∈A + α ∨ α∈A - ¬α ↔    α∈A + K i α ∨ α∈A - K i ¬α if A + ∩A -= ∅ otherwise (Red K,∨ ) CK α∈A + α ∨ α∈A - ¬α ↔    α∈A + CK α ∨ α∈A - CK ¬α if A + ∩A -= ∅ otherwise (Red CK ,∨ )
Proof. For each validity, consider an arbitrary valuation V ∈ 2 ATM . Some proofs are skipped due to their similarity with those of standard epistemic logic [START_REF] Fagin | Reasoning about Knowledge[END_REF].

• (Red K,α ). From left to right, suppose V |= α ∧ S i α. If V |= α then V |= K i α because ∼ i is reflexive. If V |= S i α then by definition of ∼ i there exists V such that V ∼ i V and α ∈ V , thus V |= K i α. From right to left, suppose V |= S i α and V |= α. Then by definition of ∼ i , every valuation V such that V ∼ i V contains α, thus V |= K i α.
• Proofs for (Red CK ,α ), (Red K,¬α ) and (Red CK ,¬α ) are analogous to the proof for (Red K,α ).

• Proofs for (Red K,∧ ) and (Red CK ,∧ ) are standard.

• (Red K,∨ ). The case where A + ∩ A -= ∅ is obvious: K i faces a tautological disjunction and the formula is therefore equivalent to .

For the other case, the proof for the right-to-left direction is standard; here we examine only the left-to-right direction. As we shall see, this unusual validity is due to the fact that any subset of ATM is an eligible world. We give a proof by contraposition. Suppose:

V |= α∈A + K i ¬α ∧ α∈A - K i α , (2.3)
we prove:

V |= K i α∈A + ¬α ∧ α∈A - α ,
i.e., there exists a valuation related to V by ∼ i where every atom from A + is false and every atom from A -is true. 3 Let us define the four following sets of atoms:

A + S = {α : α ∈ A + and S i α ∈ V } A + S = {α : α ∈ A + and S i α / ∈ V } A - S = {α : α ∈ A -and S i α ∈ V } A - S = {α : α ∈ A -and S i α / ∈ V }
(Note that the sets are mutually disjoint because A + and A -are.)

We can reformulate (2.3) by splitting each conjunction into two parts:

V |= α∈A + S K i ¬α ∧ α∈A + S K i ¬α ∧ α∈A - S K i α ∧ α∈A - S K i α . (2.4)
Let us first look at atoms that are seen by i. Take an atom α ∈ A + S . By (2.4), we have V |= K i ¬α, and by the definition of A + S , we have V |= S i α. Note that K i ¬α ∧ S i α ↔ K i ¬α is plainly valid (by (Red K,α ) and (Red K,¬α )). This implies that every α ∈ A + S is false in V and in every related valuation. Analogously, every α ∈ A - S is true in V and in every related valuation. Atoms from A + S and A - S , on the other hand, are not seen by i and thus can have any value in the current and in related valuations.

Take V = (V \ A + S ) ∪ A - S . No atom α that i sees in V varies in V :
if α is outside of A + and A -then, seen or not, it is not modified between V and V ;

-if α is either in A + or A -, S i α ∈ V implies that α / ∈ A + S and α / ∈ A - S .
Hence α is not modified either between V and V .

Therefore V ∼ i V . Now let us examine the truth values of our atoms in V . If α ∈ A + S , then we have seen that α is false in every valuation related to V . Moreover, if α ∈ A + S , then by construction of V , α is false in V . Thus every atom from A + is false in V . Similarly, we can prove that every atom from A -is true in V . Since V ∼ i V , we have:

V |= K i α∈A + ¬α ∧ α∈A - α .
• The proof for (Red CK ,∨ ), is analogous to the proof for (Red K,∨ ).

Therefore the given formulas are plainly valid.

Distribution of knowledge over disjunction (Red K,∨ ) entails that, for example,

K i (p ∨ q) → K i p ∨ K i q
is valid. However, the following formula is invalid:

K i (K j p ∨ K j ¬p) → K i K j p ∨ K i K j ¬p,
as it would mean that if i knows that j knows the value of p (i.e., that j sees p), then she knows that j knows p or she knows that j does not know p, and therefore that she knows the value of p herself. This implies that DEL-PAO is not closed under propositional substitution: we cannot replace p by K j p and q by K j ¬p in the first (valid) formula and obtain a new validity. While this is a property of standard epistemic logic, dynamic epistemic logics are not closed under propositional substitution either [START_REF] Van Ditmarsch | Dynamic Epistemic Logic[END_REF].

Reduction axioms for dynamic operators

The three lemmas give equivalences for sequence of affectations, that will be useful in the proof of the proposition.

Lemma 2.3. We have the following program equivalences, where α is an atom and p is a propositional variable:

+α; +α ≡ +α (+=+) -α; -α ≡ -α (-=-) -α; +α ≡      +α if α = p or α = JS p +α; -JS σ p if α = S i σ p with σ ∈ OBS * +α; -JS σ[1:] p if α = JS σ p with σ ∈ OBS + (-=+)
Proof. For every equivalence, take a valuation V ∈ 2 ATM and suppose we execute the sequence of assignments from V . We assume that α is not introspectively valid (otherwise -α fails and the equivalences are trivially valid). Remember that by the truth conditions, executing +α from V leads to the valuation V ∪ α ⇒ and executing -α from V leads to V \ α ⇐ . We use definitions of Section 2.2.2.

• (+=+). Obvious:

(V ∪ α ⇒ ) ∪ α ⇒ = V ∪ α ⇒ .
• (-=-). Obvious again:

(V \ α ⇐ ) \ α ⇐ = V \ α ⇐ .
• (-=+). We examine each three cases:

-Suppose α = p or α = JS p. In the first case,

α ⇐ = α ⇒ = {p}; in the second case, α ⇐ = {JS p} and α ⇒ = {σ p : σ ∈ OBS + }. In both cases, α ⇐ ⊆ α ⇒ ; hence (V \ α ⇐ ) ∪ α ⇒ = V ∪ α ⇒ . -Now suppose α = S i σ p with σ ∈ OBS * . Then we have α ⇐ = {JS σ[k:] p : 0 ≤ k ≤ depth(σ)} ∪ {S i σ p} and α ⇒ = {S i σ p}. Thus (V \ α ⇐ ) ∪ α ⇒ = (V \ ({JS σ[k:] p : 0 ≤ k ≤ depth(σ)} ∪ {S i σ p})) ∪ {S i σ p} = (V ∪ {S i σ p}) \ {JS σ[k:] p : 0 ≤ k ≤ depth(σ)} = (V ∪ α ⇒ ) \ JS σ p ⇐ ,
hence the result.

-Finally, suppose α = JS σ p with σ ∈ OBS + . Then

α ⇐ = {JS σ[k:] p : 0 ≤ k ≤ depth(σ)} and α ⇒ = {σ σ p : σ ∈ OBS + }.
We have seen with Proposition 2.3 that α ⇐ ∩α ⇒ = {α}. Therefore, intuitively, removing causes then adding consequences of α is like adding consequences, then removing all causes of α except α itself. We have {JS σ

[k:] p : 0 ≤ k ≤ depth(σ)} \ {JS σ p} = {JS σ[k:] p : 1 ≤ k ≤ depth(σ)}, thus (V \ α ⇐ ) ∪ α ⇒ = (V \ {JS σ[k:] p : 0 ≤ k ≤ depth(σ)}) ∪ {σ σ p : σ ∈ OBS + } = (V ∪ {σ σ p : σ ∈ OBS + }) \ {JS σ[k:] p : 1 ≤ k ≤ depth(σ)} = (V ∪ α ⇒ ) \ JS σ[1:] p ⇐ , hence the result.
Therefore all equivalences are valid.

Lemma 2.4. Suppose α and β are atoms such that α ⇒ I β and α = β: then α = JS σ p with p a propositional variable. Then we have the following program equivalences:

+α; +β ≡ +β; +α ≡ +α (+⇒+) -α; -β ≡ -β; -α ≡ -β (-⇒-) -α; +β ≡ +β; -α (-⇒+) -β; +α ≡ +α if α = JS p +α; -JS σ[1:] p otherwise (-⇐+)
Proof. For every equivalence, take a valuation V ∈ 2 ATM and suppose we execute the sequence of assignments from V . We assume that α is not introspectively valid (otherwise -α fails and the equivalences are trivially valid). Like for the previous proof, we use definitions of Section 2.2.2.

• (+⇒+). Since α ⇒ I β, by Proposition 2.4, we have

β ⇒ ⊆ α ⇒ . Hence (V ∪ α ⇒ ) ∪ β ⇒ = (V ∪ β ⇒ ) ∪ α ⇒ = V ∪ α ⇒ . • (-⇒-). Since α ⇒ I β, by Proposition 2.4, we have α ⇐ ⊆ β ⇐ . Hence (V \ α ⇐ ) \ β ⇐ = (V \ β ⇐ ) \ α ⇐ = V \ β ⇐ . • (-⇒+). To prove that (V \ α ⇐ ) ∪ β ⇒ = (V ∪ β ⇒ ) \ α ⇐ , we prove that, when α ⇒ I β while α = β, α ⇐ ∩ β ⇒ = ∅.
Suppose there exists an atom γ such that γ ∈ α ⇐ and γ ∈ β ⇒ , i.e., γ ⇒ I α and β ⇒ I γ.

Since α ⇒ I β and by Proposition 2.4, the former implies that γ ⇒ I β.

With the latter and by Proposition 2.3, it implies that γ = β.

On the other hand, again since α ⇒ I β and by Proposition 2.4, the latter implies α ⇒ I γ. With the latter and by Proposition 2.3, it implies that α = γ.

Hence both hypothesis together imply that α = β, which contradicts our hypothesis. Therefore

α ⇐ ∩ β ⇒ = ∅ and (V \ α ⇐ ) ∪ β ⇒ = (V ∪ β ⇒ ) \ α ⇐ .
• (-⇐+). We examine both cases:

-Suppose α = JS p. Then α ⇒ = {σ p : σ ∈ OBS + }, i.e., any sequence of visibility operators of depth at least 1, followed by p. Since α ⇒ I β, β is of the form σ p with σ ∈ OBS + , that is, either of the form S i σ p or of the form JS σ p with σ ∈ OBS * . In both cases, each cause of β is a consequence of α:

β ⇐ ⊆ α ⇒ . Hence (V \ β ⇐ ) ∪ α ⇒ = V ∪ α ⇒ .
-Now suppose α = JS σ p with σ ∈ OBS + . Then α ⇒ = {σ σ p : σ ∈ OBS + }. As a consequence of α, β is either of the form S i σ σ p or JS σ σ p with σ ∈ OBS * . In the first case,

β ⇐ = {JS σ [k:] σ p : 0 ≤ k ≤ depth(σ )} ∪ {JS σ[k:] p : 0 ≤ k ≤ depth(σ)} ∪ {S i σ σ p}.
The first and last parts are included in α ⇒ ; the second part only intersects with α ⇒ for k = 0.

In the second case,

β ⇐ = {JS σ [k:] σ p : 0 ≤ k ≤ depth(σ )} ∪ {JS σ[k:] p : 0 ≤ k ≤ depth(σ)}.
Almost like in the previous case, the first part is included in α ⇒ ; the second part only intersects with α ⇒ for k = 0.

Intuitively, removing causes of β then adding consequences of α is like adding consequences of α then removing all causes of β but the ones included in α ⇒ :

(V \ β ⇐ ) ∪ α ⇒ = (V ∪ {σ σ p : σ ∈ OBS + }) \ {JS σ[k:] p : 1 ≤ k ≤ depth(σ)} = (V ∪ α ⇒ ) \ JS σ[1:] p ⇐ , hence the result.
Therefore all equivalences are valid.

Lemma 2.5. We have the following program equivalences, where α and β are atoms such that α ⇒ I β and β ⇒ I α:

+α; +β ≡ +β; +α (+ ⇒+) -α; -β ≡ -β; -α (-⇒-) -α; +β ≡ +β; -α (-⇒+)
Proof. For every equivalence, take a valuation V ∈ 2 ATM and suppose we execute the sequence of assignments from V . We assume that α is not introspectively valid (otherwise -α fails and the equivalences are trivially valid).

• (+ ⇒+). Obvious:

(V ∪ α ⇒ ) ∪ β ⇒ = (V ∪ β ⇒ ) ∪ α ⇒ whatever α ⇒ and β ⇒ . • (-⇒-). Obvious again: (V \ α ⇐ ) \ β ⇐ = (V \ β ⇐ ) \ α ⇐ whatever α ⇐ and β ⇐ .
• (-⇒+). Since α ⇒ I β and β ⇒ I α, we know by Proposition 2.5 that

α ⇐ ∩ β ⇒ = ∅. Therefore (V \ α ⇐ ) ∪ β ⇒ = (V ∪ β ⇒ ) \ α ⇐ .
Proposition 2.11. The following formulas are plainly valid, where α and β are atoms:

[+α]β ↔ if α ⇒ I β β otherwise (Red +α ) [-α]β ↔      if α is valid in INTR ⊥ if α is not valid in INTR and β ⇒ I α β otherwise (Red -α ) [+α]¬ϕ ↔ ¬[+α]ϕ (Red +α,¬ ) [-α]¬ϕ ↔ if α is valid in INTR ¬[-α]ϕ otherwise (Red -α,¬ ) [+α](ϕ ∧ ϕ ) ↔ [+α]ϕ ∧ [+α]ϕ (Red +α,∧ ) [-α](ϕ ∧ ϕ ) ↔ [-α]ϕ ∧ [-α]ϕ (Red -α,∧ ) [π; π ]ϕ ↔ [π][π ]ϕ (Red ; ) [π π ]ϕ ↔ [π]ϕ ∧ [π ]ϕ (Red ) [π * ]ϕ ↔ [π ≤2 2|ATM (π)| ]ϕ (Red * ) [ϕ?]ϕ ↔ ϕ → ϕ (Red ? )
Proof. For each validity, consider an arbitrary valuation V ∈ 2 ATM . Some proofs are skipped due to their similarity with those of PDL [START_REF] Fischer | Propositional dynamic logic of regular programs[END_REF] or DL-PA [START_REF] Balbiani | Dynamic logic of propositional assignments: a well-behaved variant of PDL[END_REF].

• (Red +α ). This is an extension of the corresponding validity of DL-PA for propositional variables:

[+p]q ↔ if p = q q otherwise to our atoms. When α is put to true, all of its introspective consequences also are, hence the condition α ⇒ I β replacing p = q.

• (Red -α ). This is again an extension of a DL-PA validity:

[-p]q ↔ ⊥ if p = q q otherwise
to atoms. Here we need to deal again with introspective consequences, hence β ⇒ I α instead of p = q, and also with introspectively valid atoms: trying to remove an atom valid in INTR will lead to a failure of the program (and thus to the formula being true).

• (Red +α,¬ ). Already true in DL-PA, this is due to the program +α always succeeding and being deterministic.

• (Red -α,¬ ). Provided that α is not valid in INTR, the program -α always succeeds and is deterministic. If α is valid in INTR, trying to remove it will lead to a failure of the program (no related valuations).

• Proofs for (Red +α,∧ ), (Red -α,∧ ), (Red ; ), (Red ) and (Red ? ) are standard.

• (Red * ). We establish that the program π * actually leads to at most 2 2|ATM (π)| different valuations, and that it implies that it is sufficient to repeat π * at most 2 2|ATM (π)| times.

Like in DL-PA, each execution of a DEL-PAO program π * consists in a sequence of assignments τ such that

ATM (τ ) ⊆ ATM (π * ) = ATM (π).
Let us take such a sequence τ . Using axioms (-=+), (-⇒+), (-⇐+) and (-⇒+) of lemmas 2.3, 2.4 and 2.5, we can transform τ into a sequence τ of the form +α 1 ; . . . ; +α p ; -β 1 ; . . . ; -β q . These exchanges may create new atoms when applying (-=+) or (-⇐+); let us write them α R for a given atom α. Formally:

α R = JS σ p if α = S i σ p with σ ∈ OBS * JS σ[1:] p if α = JS σ p with σ ∈ OBS + .
Note that α R ⇒ I α.

Then we can transform τ into another sequence τ of the form +α 1 ; . . . ; +α p ; -β 1 ; . . . ; -β q , where the ordering of positive assignments as well as the ordering of negative assignments does not matter and where p , q ≤ |ATM (π)|, using axioms (+=+), (-=-), (+⇒+), (-⇒-), (+ ⇒+) and (-⇒-) of lemmas 2.3, 2.4 and 2.5. These transformations only decrease the number of atoms, removing causes or consequences, but do not add new atoms. Since α R ⇒ I α, at most one of them will appear positively and at most one of them will appear negatively in the final transformation, hence the result p , q ≤ |ATM (π)|.

This means that for any sequence of assignments of atoms from a set ATM (π), there exists an equivalent sequence of assignments composed of at most |ATM (π)| positive assignments, then at most |ATM (π)| negative assignments, in which the ordering does not matter. There exist at most 2 |ATM (π)| such sequences of positive assignments, and at most 2 |ATM (π)| such sequences of negative assignments, hence at most

2 |ATM (π)| × 2 |ATM (π)| = 2 2|ATM (π)| differ-
ent, in the sense that they are not equivalent, sequences of assignments of atoms from ATM (π). This implies that the program π * can lead to at most 2 2|ATM (π)| different valuations.

Now to prove π * ≡ π ≤2 2|ATM (π)| , if suffices to prove that there is a k ≤ 2 2|ATM (π)| such that π ≤k+1 ≡ π ≤k . We proceed by contradiction. Suppose there is no k ≤ 2 2|ATM (π)| such that π ≤k+1 ≡ π ≤k . So there is a valuation V and a chain of strict inclusions

R π ≤0 (V ) ⊂ R π ≤1 (V ) ⊂ . . . ⊂ R π ≤2 2|ATM (π)| +1 (V )
where

R π (V ) = {V : V R π V }. In other words, there is a sequence of valuations V 1 , . . ., V 2 2|ATM (π)| +1 such that V k / ∈ R π ≤k-1 (V ) and V k ∈ R π ≤k (V ) for every k ≤ 2 2|ATM (π)| + 1. Observe that these valu- ations are pairwise different (if k = then V k = V
) and that all of them are contained in R π * (V ). However, we have seen there can be at most 2 2|ATM (π)| such valuations, so we end up in a contradiction.

Therefore there is a k ≤ 2 2|ATM (π)| such that π ≤k+1 ≡ π ≤k . If follows that π * ≡ π ≤k and thus that π * ≡ π ≤2 2|ATM (π)| (by the definition of π ≤k ).

Therefore the given formulas are plainly valid.

Soundness and completeness

The above equivalences can be applied anywhere in a formula because the inference rule of replacement of equivalents preserves validity. Proposition 2.12. Let ϕ be obtained from ϕ by replacing some occurrence of ψ in ϕ by ψ . If ψ ↔ ψ is plainly valid then ϕ ↔ ϕ is plainly valid.

Proof. This is due to the fact that the following rules of inference for K i , CK and [π]:

ϕ ↔ ϕ K i ϕ ↔ K i ϕ ϕ ↔ ϕ CK ϕ ↔ CK ϕ ϕ ↔ ϕ [π]ϕ ↔ [π]ϕ
all preserve plain validity.

Theorem 2.1. For every DEL-PAO formula ϕ there exists a formula without modal operators ϕ such that ϕ ↔ ϕ is plainly valid.

Proof. We provide a procedure to remove modal operators.

Procedure 2.1. While there is a modal operator in ϕ:

1. if there is a sub-formula K i ϕ such that ϕ does not contain modal operators, put ϕ in conjunctive normal form and eliminate K i by applying equivalences (Red K,∧ ), (Red K,∨ ), (Red K,α ) and (Red So by iterating elimination of innermost modal operators we obtain a formula without modal operators. These transformations are possible thanks to the rule of replacement of equivalents that preserves plain validity.

Proposition 2.13. The following formulas are valid in INTR, where i is an agent and α is an atom:

S i S i α (Vis C1 ) JS JS α (Vis C2 ) JS S i S i α (Vis C3 ) JS α → S i α (Vis C4 ) JS α → JS S i α (Vis C5 )
Proof. These formulas are the syntactical counterparts of the five constraints (C1)-(C5) of introspective valuations.

Let us call T vis the collection of the above formulas, i.e.: For the right-to-left direction, if ϕ is derivable from T vis in CPL then ϕ is DEL-PAO-provable is obviously true because the axiomatics of DEL-PAO contains the elements of T vis as schemas.

T vis = {S i S i α : i ∈ Agt, α ∈ ATM } ∪ {JS JS α : α ∈ ATM } ∪ {JS S i S i α : i ∈ Agt, α ∈ ATM } ∪ {JS α → S i α : i ∈ Agt, α ∈ ATM } ∪ {JS α → JS S i α : i ∈ Agt, α ∈ ATM }.
The axiomatization of DEL-PAO is given by:

• the axioms of CPL (Classical Propositional Logic);

• the reduction axioms for epistemic operators given in Proposition 2.10;

• the reduction axioms for dynamic operators given in Proposition 2.11;

• the introspection axioms given in Proposition 2.13;

• the rule of Modus Ponens and the rules of inference for K i , CK, and [π]:

ϕ ↔ ϕ K i ϕ ↔ K i ϕ ϕ ↔ ϕ CK ϕ ↔ CK ϕ ϕ ↔ ϕ [π]ϕ ↔ [π]ϕ
Theorem 2.2. The axiomatization of DEL-PAO is sound and complete w.r.t. the set of introspective valuations.

Proof. Let ϕ be a DEL-PAO formula. Let ϕ be its reduction to a boolean formula.

To prove soundness, suppose ϕ is a theorem of DEL-PAO. By Theorem 2.1, ϕ is a theorem of DEL-PAO, too. By Proposition 2.15 we have

INTR.

The completeness proof follows the lines of the soundness proof in reverse order, resorting to completeness of classical logic instead of soundness.

Complexity of model checking

Given an introspective valuation V and a formula ϕ, we are interested in deciding whether V |= ϕ. An issue here is that introspective valuations are always infinite. We show that a finite number of atoms are actually necessary to interpret a formula ϕ, even when it contains epistemic operators. These operators can be reduced to programs if enough atoms are involved in the valuation.4

From infinite to finite models

The valuations that we are interested in DEL-PAO, i.e., the introspective valuations, are always infinite. However, the model checking problem must be defined on finite models. To this end, we define a notion of "introspective enough" valuations.

A valuation V is introspective w.r.t. a set of atoms A if for every atom α ∈ A:

1. if α is valid in INTR then α ∈ V ; 2. if there exists β ∈ V such that β ⇒ I α then α ∈ V ; 3. if there exists β / ∈ V such that α ⇒ I β then α / ∈ V .
Observe that if A is finite, given an introspective valuation V , it is always possible to find a finite valuation which is introspective w.r.t. A, the simplest one being V ∩ A. Indeed, since V is introspective:

1. every introspectively valid atom belongs to V , thus every introspectively valid atom from A belongs to V ∩ A;

2. for every β ∈ V , every introspective consequence of β is in V , thus every introspective consequence of

β from A is in V ∩ A; 3. for every β / ∈ V , no introspective cause of β is in V , thus no intro- spective cause of β is in V ∩ A. Obviously, if V is introspective w.r.t. A, then it is introspective w.r.t. B if B ⊆ A. A "fully" introspective valuation V ∈ INTR is introspective w.r.t.
ATM ; therefore it is also introspective w.r.t. any subset of atoms.

Simulating epistemic operators with programs

Let us define the following programs:

varyIfNotSeen(i, α) = if ¬S i α then (+α -α) varyIfNotSeen(Agt, α) = if ¬JS α then (+α -α)
As their names suggest, varyIfNotSeen(i, α) checks whether i sees α, and non-deterministically varies the truth value of α otherwise; varyIfNotSeen(Agt, α) behaves similarly for joint visibility. We extend them to a set of atoms A = {α 1 , . . . , α m }:

varyIfNotSeen(i, A) = varyIfNotSeen(i, α 1 ); . . . ; varyIfNotSeen(i, α m ) varyIfNotSeen(Agt, A) = varyIfNotSeen(Agt, α 1 ); . . . ; varyIfNotSeen(Agt, α m )
where we suppose that both programs are skip if A is empty.

We do not impose any ordering on sub-programs; however, one could argue that such ordering is important. For example, suppose we execute varyIfNotSeen(i, JS p); varyIfNotSeen(i, p). The first program, if ¬S i JS p then (+JS p -JS p), might put JS p to true, thus making S i p true (by introspective consequence) in the process. This may change the execution of the second program, if ¬S i p then (+p -p), if S i p was previously false. However, note that S i JS p is introspectively valid: on introspective valuations, varyIfNotSeen(i, JS p) will actually never change the value of JS p. This can be generalized.

Lemma 2.6. Let V be a valuation, i an agent and α and β two different atoms. Then:

1. if V is introspective w.r.t. {S i β}, then for every valuation V 1 such that V R varyIfNotSeen(i,β) V 1 , we have V |= S i α if and only if V 1 |= S i α; 2. if V is introspective w.r.t. {JS α, JS β}, then for every valuation V 2 such that V R varyIfNotSeen(Agt,β) V 2 , we have V |= JS α if and only if V 2 |= JS α.
Proof. We detail both items, since the proof for joint visibility is slightly different from the one for individual visibility here. Remember that by applying the programs +α and -α to V we respectively obtain V +α and V -α.

1. Recall that varyIfNotSeen(i, β) = if ¬S i β then (+β -β). We distinguish two cases.

• Suppose S i β ∈ V . Then the program is equivalent to skip and thus V = V 1 , making the result obvious.

• Now suppose S i β / ∈ V . Then varyIfNotSeen(i, β) is equivalent to +β -β and thus V 1 = V +β or V 1 = V -β.
Note that β cannot be valid in INTR, otherwise S i β would also be valid in INTR and belong to V since V is introspective w.r.t. S i β. Thus -β cannot fail and V -β exists. We have to prove that V |= S i α if and only if V +β |= S i α and V |= S i α if and only if V -β |= S i α. We again split into two cases.

-V +β |= S i α if and only if S i α ∈ V +β, i.e., S i α ∈ V or β ⇒ I S i α. Recall that S i β must not be valid in INTR. Suppose β ⇒ I S i α. Thus either β = S i α and S i β = S i S i α which is valid in INTR, or β is of the form JS β and S i β = S i JS β which is also valid in INTR. This implies that β ⇒ I S i α. Therefore V +β |= S i α is equivalent to S i α ∈ V . -V -β |= S i α if and only if S i α ∈ V -β, i.e., S i α ∈ V and S i α ⇒ I β. This time suppose S i α ⇒ I β. Then since the only introspective consequence of S i α is itself, S i β = S i S i α, which is introspectively valid. This is impossible since S i β / ∈ V . This implies that S i α ⇒ I β. Therefore V -β |= S i α is equivalent to S i α ∈ V . In all cases, V |= S i α if and only if V 1 |= S i α for every V 1 such that V R varyIfNotSeen(i,β) V 1 .
2. For the second case, remember that varyIfNotSeen(Agt, β) = if ¬JS β then (+β -β).

• Suppose JS β ∈ V , then again the result is obvious.

• Now suppose JS β / ∈ V . This time we prove V |= JS α if and only if V +β |= JS α and V |= JS α if and only if V -β |= JS α. The latter exists because β is not valid in INTR (otherwise JS β would belong to V since V is introspective w.r.t. JS β).
-The first case is analogous to the one for individual visibility: β ⇒ I JS α implies that either β = JS α or β is of the form JS β . In both cases, JS β is introspectively valid, which leads to a contradiction. Therefore V +β |= JS α if and only if V |= JS α.

-The second case is trickier. We have

V -β |= JS α if and only if JS α ∈ V -β, i.e., JS α ∈ V and JS α ⇒ I β. Suppose V -β |= JS α. Then obviously JS α ∈ V . Now suppose V -β |= ¬JS α. Then JS α / ∈ V or JS α ⇒ I β. The latter implies that β is of the form σ α, with σ ∈ OBS + . Hence JS α ⇒ I JS β. Since we assumed that JS β / ∈ V and because V is introspective w.r.t. JS α, we get JS α / ∈ V . Thus JS α ⇒ I β implies that JS α / ∈ V , that is, V -β |= ¬JS α implies that JS α / ∈ V . Therefore V -β |= JS α if and only if V |= JS α. In all cases, V |= JS α if and only if V 2 |= JS α for every V 2 such that V R varyIfNotSeen(i,β) V 2 .
Therefore both items are true.

Proposition 2.16. Let V be a valuation, i an agent and α and β two different atoms. Then:

1. if V is introspective w.r.t. {S i α, S i β}, then for every val- uation V 1 , V R varyIfNotSeen(i,α);varyIfNotSeen(i,β) V 1 if and only if V R varyIfNotSeen(i,β);varyIfNotSeen(i,α) V 1 ; 2. if V is introspective w.r.t. {JS α, JS β}, then for every val- uation V 2 , V R varyIfNotSeen(Agt,α);varyIfNotSeen(Agt,β) V 2 if and only if V R varyIfNotSeen(Agt,β);varyIfNotSeen(Agt,α) V 2 .
Proof. We only detail the proof of the first item since the proof for the second is analogous.

Recall that varyIfNotSeen(i, α) = if ¬S i α then (+α -α). We distinguish three cases.

• Suppose S i α ∈ V . Then varyIfNotSeen(i, α) is reduced to skip and V R varyIfNotSeen(i,α);varyIfNotSeen(i,β) V 1 if and only if V R varyIfNotSeen(i,β) V 1 .
Moreover, by Lemma 2.6, since V is introspective w.r.t. S i β, the value of S i α is not modified by the execution of varyIfNotSeen(i, β).

Therefore we also have V R varyIfNotSeen(i,β);varyIfNotSeen(i,α) V 1 if and only if V R varyIfNotSeen(i,β) V 1 , hence the result.

• Now suppose S i β ∈ V . The reasoning is similar and both sides are reduced to varyIfNotSeen(i, α) due to V being introspective w.r.t. S i α.

• Finally, suppose S i α / ∈ V and S i β / ∈ V . Again by Lemma 2.6, since V is introspective w.r.t. S i α and S i β, the values of S i α and S i β are not modified by varyIfNotSeen(i, β) and varyIfNotSeen(i, α).

This implies that V R varyIfNotSeen(i,α);varyIfNotSeen(i,β) V 1 if and only if V R (+α -α);(+β -β) V 1 , and V R varyIfNotSeen(i,β);varyIfNotSeen(i,α) V 1 if and only if V R (+β -β);(+α -α) V 1 .
Using distributivity properties, the first program becomes (+α; +β) (+α; -β) (-α; +β) (-α; -β) and the second (+β; +α) (+β; -α) (-β; +α) (-β; -α). We prove that these two are equivalent by examining equivalences between sub-programs. Observe that since S i α / ∈ V and S i β / ∈ V , and again because V is introspective w.r.t. S i α and S i β, α and β are not introspectively valid, thus -α and -β cannot fail.

1. We have seen with lemmas 2.4 and 2.5 that +α; +β ≡ +β; +α.

2. If α ⇒ I β, and since α and β are different, then α is of the form JS α . Thus S i α = S i JS α , which is introspectively valid. This leads to a contradiction with our hypothesis that S i α / ∈ V since V is introspective w.r.t. S i α. Therefore α ⇒ I β. Similarly, we have β ⇒ I α. By Lemma 2.5, we know that in this case, +α; -β ≡ -β; +α.

3. Similarly, -α; +β ≡ +β; -α by Lemma 2.5.

4. We have seen with lemmas 2.4 and 2.5 that -α; -β ≡ -β; -α.

Therefore (+α; +β) (+α; -β) (-α; +β) (-α; -β) is equivalent to (+β; +α) (+β; -α) (-β; +α) (-β; -α).
In all cases, we have that V R varyIfNotSeen(i,α);varyIfNotSeen(i,β) V 1 if and only if V R varyIfNotSeen(i,β);varyIfNotSeen(i,α) V 1 . In the general case, the ordering of sub-programs in varyIfNotSeen(i, A) is irrelevant whenever V is introspective w.r.t. {S i α : α ∈ A}.

The programs varyIfNotSeen(i, A) and varyIfNotSeen(Agt, A) will simulate the behaviour of K i and CK .

Proposition 2.17. Let V be a valuation, i an agent and ϕ a formula without epistemic operators. Then

1. if V is introspective w.r.t. {S i α : α ∈ ATM (ϕ)} ∪ ATM (ϕ), then V |= K i ϕ ↔ [varyIfNotSeen(i, ATM (ϕ))]ϕ; 2. if V is introspective w.r.t. {JS α : α ∈ ATM (ϕ)} ∪ ATM (ϕ), then V |= CK ϕ ↔ [varyIfNotSeen(Agt, ATM (ϕ))]ϕ.
Proof. Again we only describe the case of individual knowledge; the proof for common knowledge is analogous.

We are going to compare relations associated to the modalities K i and [varyIfNotSeen(i, ATM (ϕ))], i.e., the valuations related with V by ∼ i and by R varyIfNotSeen(i,ATM (ϕ)) .

First of all, since ϕ does not contain epistemic operators, remember that by Proposition 2.9, only atoms from ATM (ϕ) are important when evaluating ϕ; the other atoms may vary without influencing its truth value. Therefore we will only take into account these atoms when describing relations.

The definition of ∼ i , restricted to atoms from ϕ, goes as follows:

for every α ∈ ATM (ϕ), if S i α ∈ V, then for every V 1 such that V ∼ i V 1 , V (α) = V 1 (α) and
(2.5)

if S i α / ∈ V, then there is V 1 such that V ∼ i V 1 and α ∈ V 1 and
(2.6)

there is V 1 such that V ∼ i V 1 and α / ∈ V 1 . (2.7)
On the other hand, the relation R varyIfNotSeen(i,ATM (ϕ)) is slightly more complicated. Remember that by Proposition 2.16, the ordering of subprograms in varyIfNotSeen(i, ATM (ϕ)) does not matter since V is introspective w.r.t. {S i α : α ∈ ATM (ϕ)}. In other words, each sub-program varyIfNotSeen(i, α) will have the same behaviour whenever it is executed.

In particular, we have seen that truth values of conditions stay the same, and therefore are identical to the ones of the initial state.

Remember that varyIfNotSeen(i, α) = if ¬S i α then (+α -α). The program +α adds α and all its introspective consequences to the current valuation, while -α removes α and all its introspective causes. In other words, each α ∈ ATM (ϕ), if not seen, may vary, but its causes or consequences may also vary. Let us abbreviate varyIfNotSeen(i, ATM (ϕ)) by vins. We can describe the behaviour of the program as follows:

for every α ∈ ATM (ϕ), if S i α ∈ V, then if there exists β ∈ ATM (ϕ) such that S i β / ∈ V and β ⇒ I α, then there is V 2 such that V R vins V 2 and α ∈ V 2 and (2.8) if there exists β ∈ ATM (ϕ) such that S i β / ∈ V and α ⇒ I β, then there is V 2 such that V R vins V 2 and α / ∈ V 2 and (2.9) there is V 2 such that V R vins V 2 and V (α) = V 2 (α) and

(2.10)

if S i α / ∈ V, then there is V 2 such that V R vins V 2 and α ∈ V 2 and
(2.11)

there is V 2 such that V R vins V 2 and α / ∈ V 2 .
(2.12)

In words, if α is seen by agent i, it will not be modified "directly" by the program. Indeed, if S i α is true the sub-program varyIfNotSeen(i, α) will be equivalent to skip. However, another atom β appearing in ϕ and not seen by i might vary α, making it true with +β if α is a consequence of β (case (2.8)) or false with -β if β is a consequence of α (case (2.9)).

Finally, there always exists a state where α was not modified, either because there is no β or because it was put to its initial value (case (2.10)). Otherwise, when α is not seen by i, it is directly modified by the program (cases (2.11) and (2.12)). Observe that since V is introspective w.r.t. {S i α : α ∈ ATM (ϕ)}, α is not valid in INTR, otherwise S i α would belong to V . Hence it can be removed safely. So it seems that atoms not seen or not in ϕ may vary while they should not. However, we are going to see that this does not happen. Take an arbitrary atom α such that α ∈ ATM (ϕ) and S i α ∈ V , and an arbitrary β such that β ∈ ATM (ϕ) and S i β / ∈ V . By definition, β is different from α.

• First, we consider case (2.8): suppose β ⇒ I α. Since they are different, β must be of the form JS β . Thus S i β = S i JS β , which is introspectively valid. Therefore S i β belongs to V because V is introspective w.r.t. {S i α : α ∈ ATM (ϕ)}: we get a contradiction.

• Now for case (2.9): suppose α ⇒ I β. This time, α is of the form JS α , and β = σ α , with σ ∈ OBS + . Thus S i β is also an introspective consequence of α.

Since S i β / ∈ V , then α / ∈ V , otherwise V would not be introspective w.r.t. ATM (ϕ). Thus α / ∈ V 2 is the same as V (α) = V 2 (α).
In the end, case (2.8) cannot happen and case (2.9) reduces to case (2.10). We obtain:

for every α ∈ ATM (ϕ), if S i α ∈ V, then for every V 2 such that V R vins V 2 , V (α) = V 2 (α) and
(2.10')

if S i α / ∈ V, then there is V 2 such that V R vins V 2 and α ∈ V 2 and
(2.11)

there is V 2 such that V R vins V 2 and α / ∈ V 2 .
(2.12)

Hence ∼ i = R varyIfNotSeen(i,ATM (ϕ)) on valuations introspective w.r.t. {S i α : α ∈ ATM (ϕ)}∪ATM (ϕ) for atoms that are relevant to the truth value of ϕ.

Therefore V |= K i ϕ ↔ [varyIfNotSeen(i, ATM (ϕ))]ϕ if V is introspec- tive w.r.t. {S i α : α ∈ ATM (ϕ)} ∪ ATM (ϕ).
Proposition 2.17 can be turned into a procedure eliminating epistemic operators: it suffices to iterate the application of the equivalences, starting with the innermost operators. These transformations are possible thanks to the rule of replacement of equivalents that preserves plain validity (see Proposition 2.12). Procedure 2.2. While there is an epistemic operator in ϕ:

1. if there is a sub-formula K i ϕ such that ϕ does not contain epistemic operators, replace K i ϕ by [varyIfNotSeen(i, ATM (ϕ))]ϕ ;

2. if there is a sub-formula CK ϕ such that ϕ does not contain epistemic operators, replace CK ϕ by [varyIfNotSeen(Agt, ATM (ϕ))]ϕ.

Relevant atoms

We have seen in Proposition 2.17 that to reduce epistemic operators to programs, we needed some specific atoms to be true or false in the current world. In this section, we extend the definition of ATM (ϕ) to include such atoms. We note this new set of atoms RATM (ϕ), the "relevant atoms" of ϕ. Formally:

RATM (K i ϕ) = RATM (ϕ) ∪ {S i α : α ∈ RATM (ϕ)} RATM (CK ϕ) = RATM (ϕ) ∪ {JS α : α ∈ RATM (ϕ)}
and equal to ATM (ϕ) otherwise. So RATM (ϕ) includes ATM (ϕ). For instance:

ATM (q ∧ CK K i p) = {q, p} RATM (q ∧ CK K i p) = {q, p, JS p, S i p, JS S i p}
Moreover, for a formula ϕ without epistemic operators, RATM (ϕ) = ATM (ϕ). Note that while RATM (ϕ) is finite, its cardinality can be exponential in the length (the number of symbols) of ϕ: for example, the cardinality of

RATM (K i 1 . . . K im p) is in 2 m .
These relevant atoms of a formula ϕ are exactly the atoms appearing in the reduction of ϕ given by Procedure 2.2: starting with the innermost, each replacement of K i or CK by [varyIfNotSeen(i, ATM (ϕ))] or [varyIfNotSeen(Agt, ATM (ϕ))] makes S i α or JS α appear, for every α in the formula following the operator. Moreover, by Proposition 2.17, this reduction is equivalent to the original formula ϕ on any valuation introspective w.r.t. RATM (ϕ).

Proposition 2.18. Let ϕ be a formula. Let V , V ∈ 2 ATM such that V and V are introspective w.r.t. RATM (ϕ) and V = RATM (ϕ) V . Then V |= ϕ if and only if V |= ϕ.

Proof. Let (ϕ) R be the formula obtained by applying Procedure 2.2 to ϕ. We know that ϕ is equivalent to (ϕ) R on valuations introspective w.r.t. RATM (ϕ) and that RATM (ϕ) = ATM ((ϕ) R ).

We have:

V |= ϕ ⇔ V |= (ϕ) R since V is introspective w.r.t. RATM (ϕ), ⇔ V |= (ϕ) R by Proposition 2.9, since V = ATM ((ϕ) R ) V , ⇔ V |= ϕ since V is introspective w.r.t. RATM (ϕ). Therefore V |= ϕ if and only if V |= ϕ. Proposition 2.18 implies that if V ∈ INTR, then V |= ϕ if and only if V ∩ RATM (ϕ) |= ϕ for any ϕ, since we have seen that V ∩ RATM (ϕ) is introspective w.r.t. RATM (ϕ) if V is introspective.
Before finally defining the model checking problem, we give some properties of relevant atoms that will be useful in the next chapter.

Proposition 2.19. The equivalence

K i 1 . . . K im α ↔ β∈RATM (K i 1 ...K im α) β is plainly valid, for m ≥ 0.
Proof. We prove it by induction on m.

If m = 0, then RATM (α) = α and the equivalence is obvious.

For general m, suppose

K i 1 . . . K im α ↔ β∈RATM (K i 1 ...K im α)
β is plainly valid. Take a valuation V ∈ 2 ATM and an agent . Then:

V |= K K i 1 . . . K im α ⇔ V |= K β∈RATM (K i 1 ...K im α) β ⇔ V |= β∈RATM (K i 1 ...K im α) K β ⇔ V |= β∈RATM (K i 1 ...K im α) (β ∧ S β) ⇔ V |= β∈RATM (K i 1 ...K im α) β ∧ β∈RATM (K i 1 ...K im α) S β ⇔ V |= β∈RATM (K i 1 ...K im α) β ∧ β∈{S γ:γ∈RATM (K i 1 ...K im α)} β ⇔ V |= β∈RATM (K i 1 ...K im α) ∪ {S γ:γ∈RATM (K i 1 ...K im α)} β ⇔ V |= β∈RATM (K K i 1 ...K im α) β ,
hence the result.

We note r 1 , . . . , r p 1, . . . , m for r 1 , . . . , r p a subset of {1, . . . , m} in the same order. For example, we have 1, 3, 4 1, 2, 3, 4, 5 or 1, 2, 3, 4, 5 but not 1, 4, 3 1, 2, 3, 4, 5 . The next proposition characterizes the set of relevant atoms of a formula of the type K i 1 . . . K im α.

Proposition 2.20. We have, for m ≥ 0:

RATM (K i 1 . . . K im α) = {S ir 1 . . . S ir p α : r 1 , . . . , r p 1, . . . , m }
Proof. We prove it by induction on m.

The case where m = 0 is obvious since RATM (α) = {α} and the only subset of is .

For general m, suppose

RATM (K i 1 . . . K im α) = {S ir 1 . . . S ir p α : r 1 , . . . , r p 1, . . . , m }. Then RATM (K K i 1 . . . K im α) = RATM (K i 1 . . . K im α) ∪ {S α : α ∈ RATM (K i 1 . . . K im α)} = {S ir 1 . . . S ir p α : r 1 , . . . ,

The model checking problem

The model checking problem for DEL-PAO is defined as follows:

• Input: a couple V ∩ RATM (ϕ), ϕ where ϕ is a DEL-PAO formula and V is an introspective valuation;

• Output: yes if V |= ϕ, no otherwise.

As seen with Proposition 2.18, if V is introspective, an eligible valuation to perform model checking on is V ∩ RATM (ϕ). While RATM (ϕ) may be exponential in the size of ϕ, we will see in Chapter 7 that this does not impact the complexity result.

Theorem 2.3. The DEL-PAO model checking problem is PSPACEcomplete.

Proof. The model checking of DL-PA, which is a fragment of DEL-PAO without visibility operators S i and JS was proven to be PSPACE-hard [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF]. This establishes the lower bound.

We will show in Chapter 7 that the problem is in PSPACE.

Applications

In this section we propose the Byzantine Two Generals' problem as a application, and a discussion on private announcements.

Two Generals' problem

The Byzantine Two Generals' problem [START_REF] Akkoyunlu | Some constraints and tradeoffs in the design of network communications[END_REF][START_REF] Gray | Notes on data base operating systems[END_REF]. is an experiment illustrating the problem of coordination by communicating over an unreliable link, highlighting the importance of common knowledge. It goes as follows.

Two generals, leading two armies, need to coordinate an attack on a fortified city; they can succeed only if they attack at the same time. The armies are located on each side of the city and they can only communicate by sending messengers that can be captured. The two generals have agreed that they will attack; however, they did not agree upon a time for the attack. This is required; but more importantly, it is required that each general knows that the other has agreed, and knows that the other knows he has agreed, and so on: common knowledge of the moment of the attack is expected.

Messengers carrying acknowledgements of receipt can also be captured: an infinite number of messages is required to reach common knowledge. Formally, let Agt = {1, 2} be the set of agents and Prop = {ta} be the set of variables, with ta representing the time of the attack. We define the atom S m 1,2 ta as:

S m 1,2 ta =          S 1 S 2 S 1 . . .S 2 m alternations ta if m is even S 2 S 1 S 2 . . .S 2 m alternations ta if m is odd
Then we define the program

sndMsg m = +S 1 ta; +S 2 ta; +S 2 1,2 ta; . . . ; +S m 1,2 ta,
which formalizes the first general learning the time of the attack, then the second general learning it, then the first learning that the second know it, and so on until m.

Proposition 2.21. Let V 0 = {α : α is valid in INTR} ∪ {ta}. We have, for every m > 0:

V 0 |= [sndMsg m ]¬CK ta.
Proof. V 0 is introspective: it contains all introspectively valid atoms and ta. We are not interested in the truth value of the latter; making it initially true allows us to more succinctly write CK ta instead of CK ta ∨ CK ¬ta.

To have V |= CK ta, and since ta is true, we only need JS ta. Because JS ta is not valid in INTR, it must be added by the program sndMsg m . Moreover, JS ta has no other introspective causes than itself, thus it should be added explicitly by sndMsg m . However, JS ta is not present in sndMsg m , whatever the value of m. Therefore CK ta will never be satisfied whatever m > 0.

DEL-PAO allows us to simply model this kind of problem where we perform private announcements of variables and visibility of variables. We generalize this in the next section.

Private announcements

Public Announcement Logic PAL [START_REF] Plaza | Logics of public communications[END_REF] is a logic of the DEL family, extending standard epistemic logic with an operator [ψ!], such that [ψ!]ϕ reads "after ψ is publicly and truthfully announced, ϕ is true." We show in Chapter 6 how to extend DEL-PAO with public announcements, and more generally, publicly executed programs. In this section we show how to express private announcements [START_REF] Baltag | The logic of public announcements, common knowledge, and private suspicions[END_REF]] of certain kinds of formulas within the language of DEL-PAO.

We write i : ϕ for "ϕ is privately announced to i." We model purely private announcements here, i.e., no agent observes that ϕ was announced to i. Suppose we want to announce to agent i that p is true. Then we can use the following program: i : p! = p?; +S i p Indeed, [i : p!]K i p is plainly valid because after the execution of p?; +S i p, both p and S i p are true. This also works for the announcement of ¬p: i : ¬p! = ¬p?; +S i p and more generally for the announcement of a visibility atom or the negation of a visibility atom, i.e., for literals:

i : α! = α?; +S i α i : ¬α! = ¬α?; +S i α
Similarly, we can safely announce a conjunction of literals:

i : (α 1 ∧ . . . ∧ α m )! = (α 1 ∧ . . . ∧ α m )?; +S i α 1 ; . . . ; +S i α m
Observe that the ordering of the α j is not important since we only add atoms. This implies that we can also privately announce knowledge of literals, since they can be reduced to a conjunction of atoms. Here are some examples: i : K j p! = K j p?; +S i S j p; +S i p i : K j K ¬q! = K j K ¬q?; +S i S j S q; +S i S q; +S i S j q; +S i q i : CK S j α! = CK S j α?; +S i JS S j α; +S i S j α

In the general case, if ϕ is a sequence of epistemic operators (K i or CK ) followed by a literal, any S i α with α ∈ RATM (ϕ) must be set to true in order to announce ϕ to i.

Because we only modify visibilities of atoms, we cannot properly announce disjunctions in the general case. However, we can announce a special case of disjunction: the fact of knowing whether a literal. For example:

i : (K j p ∨ K j ¬p)! = (K j p ∨ K j ¬p)?; +S i S j p
Observe that we add less information here than when we were announcing K j p: we do not include the visibility of i on p.

We will extensively use these kinds of announcements when modelling the gossip problem in Chapter 3.

Conclusion

Using visibility atoms instead of visibility sets of propositional variables, DEL-PAO avoids the strong hypothesis of common knowledge of visibilities that other observation-based epistemic logics make. It also includes joint visibility atoms, that allows us to express common knowledge. These atoms can be modified by assignments programs, modifying facts of the world and of knowledge of agents in a simple way. The model checking requires reducing the infinite models to finite models containing only the relevant atoms. However, the merge of knowledge and programs comes without increasing the complexity: the model checking problem is PSPACE-complete like in ECL-PC and DL-PA.

The logic DEL-PAO is the central contribution of this thesis and the base of all other logics that will be presented. We have seen that it solves the first problem of visibility-based logics that we have identified in the introduction; we are now able to reason about higher-order knowledge. This will be necessary in order to study the generalized gossip problem in Chapter 3 and other epistemic planning problems in Chapter 4. As for the second problem (distribution of knowledge operators over disjunctions), we will propose a solution to it in Chapter 6. Moreover, in Chapter 5 we will see an extension of DEL-PAO with control atoms and its application to epistemic boolean games.

How to share higher-order knowledge by gossiping

There are contexts where agents have to achieve higher-order knowledge, typically in order to coordinate some joint action.

In the original gossip problem, all secrets are shared knowledge after 2(n-2) calls, but they fail to be common knowledge.

Unless everybody knows the protocol and there is a global clock, such common knowledge cannot be attained. More modestly, the agents may want to achieve second-order shared knowledge: they may have the goal that everybody knows that everybody knows all secrets. This chapter investigates how such higher-order knowledge can be achieved.

The original version of the gossip problem [START_REF] Akkoyunlu | Some constraints and tradeoffs in the design of network communications[END_REF][START_REF] Hurkens | Spreading gossip efficiently[END_REF]] goes as follows.

There are six agents each of which knows some secret not known to anybody else. Two agents can make a telephone call and exchange all secrets they know. How many calls does it take to share all secrets, i.e., how many calls have to take place until everybody knows all secrets?

The problem can be generalized from six to arbitrary numbers of agents n. In the literature one can find various protocols achieving the goal in 2(n-2) calls. It has been proved that they are optimal: no protocol exists achieving the goal with less calls [START_REF] Baker | Gossips and telephones[END_REF][START_REF] Tijdeman | On a telephone problem[END_REF][START_REF] Hajnal | A cure for the telephone disease[END_REF].

In this chapter, we are interested in a novel generalisation of the gossip problem including higher-order knowledge: the goal is not only that every agent knows every secret, but also that every agent knows this, and that every agent knows this... and so on until a given depth k. We are going to express this generalisation within the framework of DEL-PAO. Thanks to this formalisation, we are able to formally study the problem, giving a protocol that achieves the goal and proving that it is optimal for any depth of knowledge k.

Résumé du chapitre

La version originale du problème du bavardage [START_REF] Akkoyunlu | Some constraints and tradeoffs in the design of network communications[END_REF][START_REF] Hurkens | Spreading gossip efficiently[END_REF] est la suivante.

Il y a six agents, chacun connaissant un secret inconnu de tous les autres. Deux agents peuvent s'appeler au téléphone et d'échanger tous les secrets qu'ils connaissent. Combien d'appels sont nécessaires pour partager tous les secrets, c'està-dire, combien d'appels doivent avoir lieu pour que tout le monde connaisse tous les secrets ? Le problème peut être généralisé de six à un nombre arbitraire d'agents n. Dans la littérature, il est possible de trouver différents protocoles qui atteignent l'objectif en 2(n-2) appels. Il a été prouvé qu'ils sont optimaux : il n'existe aucun protocole qui atteint l'objectif en moins d'appels [START_REF] Baker | Gossips and telephones[END_REF][START_REF] Tijdeman | On a telephone problem[END_REF][START_REF] Hajnal | A cure for the telephone disease[END_REF].

Il existe des contextes où les agents ont besoin d'acquérir des connaissances d'ordre supérieur, généralement afin de coordonner une action conjointe. Dans le problème du bavardage original, tous les secrets sont connaissance partagée après 2(n-2) appels, mais à moins que tout le monde connaisse le protocole et qu'il y ait une horloge globale, une telle connaissance commune ne peut pas être atteinte. Plus modestement, nous nous intéressons à une généralisation du problème du bavardage qui inclue les connaissances d'ordre supérieur : le but est non seulement que chaque agent connaisse tous les secrets, mais aussi que chaque agent sache cela, et que chaque agent sache cela... et ainsi de suite jusqu'à une profondeur donnée k. Nous allons exprimer cette généralisation dans le cadre de DEL-PAO. Grâce à cette formalisation, nous 3.1. The generalised problem sommes en mesure d'étudier formellement le problème, en donnant protocole qui permet d'atteindre l'objectif, et en prouvant qu'il est optimal pour toute profondeur de connaissance k.

The generalised problem

Let Agt = {1, . . . , n} be the set of all agents. Let us denote the secret of agent i by s i : Prop = {s i : i ∈ Agt}. To simplify things we suppose that s i is true.

The initial situation before the agents start gossiping is expressed by

i∈Agt s i ∧ K i s i ∧ j∈Agt,j =i ¬K j s i ∧ ¬K j ¬s i and the formula i∈Agt K i j∈Agt s j
expresses the goal that every agent knows every secret. Let us abbreviate the conjunction i∈J s i of secrets of agents in J by s J ; remember that EK J ϕ abbreviates the conjunction i∈J K i ϕ. We usually drop set parentheses and write write EK i 1 ,...,im and s i 1 ,...,im instead of EK {i 1 ,...,im} and s {i 1 ,...,im} . Then:

• EK Agt s Agt expresses that all secrets are shared knowledge: every agent knows every secret;

• EK Agt EK Agt s Agt expresses the goal that every agent knows that all secrets are shared knowledge;

• EK Agt . . . EK Agt k times
s Agt expresses that all secrets are shared knowledge up to depth k ≥ 1.

We define the iteration of EK J inductively, for m ≥ 0, by EK 0 J ϕ = ϕ and EK m+1 J ϕ = EK J EK m J ϕ. Thus our goal is:

EK k Agt s Agt
The result of a phone call between two agents is that their knowledge increases. We model a call between two agents i and j by a DEL-PAO action noted Call i j . Then

[Call i j ]EK i,j (s i ∧ s j ),
also noted

[Call i j ]EK i,j s i,j ,
expresses that the result of Call i j is that i and j know their secrets. When we say that during a call the agents communicate all they know then this not only concerns secrets, but also knowledge about secrets and more generally higher-order knowledge. Therefore calls achieve common knowledge between the calling agents:

[Call i j ]EK m i,j s i,j
is the case for arbitrary nesting m of EK i,j . Furthermore, the formula

[Call i 1 j 1 ] . . . [Call i 2(n-2) j 2(n-2) ] 2(n-2) times
EK Agt s Agt expresses that the protocol where i 1 calls j 1 first, then i 2 calls j 2 , . . . , and finally i 2(n-2) calls j 2(n-2) achieves shared knowledge. We note Gossip(k, n) the instance of the generalized gossip problem with n ≥ 2 agents and the goal to achieve depth k ≥ 1 of shared knowledge. So the original problem corresponds to the instance Gossip(1, 6). We are going to introduce a protocol achieving shared knowledge of depth k in (k+1)(n-2) calls, for n ≥ 4. We moreover prove that our protocol is optimal: at least (k+1)(n-2) calls are necessary to achieve the goal of Gossip(k, n).

An algorithm achieving shared knowledge

The following algorithm generates a sequence of calls for a given instance Gossip(k, n) of the generalized gossip problem, for k ≥ 1 and n ≥ 4. Throughout the algorithm two of the agents, which we call left and right, will have a central, fixed role: each of the other agents only communicates with either left or right. The n-2 remaining agents will be numbered 0, 1, . . ., n-3.

The algorithm is made up of turns. During each turn, left and right collect the secrets of other agents. Together with the last agent they talked to in that turn, they thereby become what we call "semi-experts." A further call between complementary semi-experts turns them into full experts. The last agents talked to, left and right, play a crucial role. These two further semi-experts are permuted at each turn in a way that will guarantee that the goal is reached. for t = 0..k: agent left calls agent 0-t mod n-2; agent left calls agent 1-t mod n-2;

. . . agent left calls agent n-4-t mod n-2; agent right calls agent n-3-t mod n-2.

In words:

• at the first turn (turn 0), agent left calls agent 0, then 1, . . . , then n-4, and finally agent right calls agent n-3;

• at the second turn (turn 1), agent left calls agent n-3, then 0, then 4, . . . , then n-5; and finally agent right calls agent n-4;

• ... and so on.

So each turn involves n-2 calls, and overall the algorithm produces a sequence of (k+1)(n-2) calls. In the rest of the chapter, we assume that every index of agent is taken modulo n-2 and we omit "mod n-2." Figure 3.1 gives a visual representation of Algorithm 3.1: agents 0, 1, . . ., n-3 are put on a wheel which, between each turn, rotates clockwise. Agent left calls everyone in ascending order, except the agent at the rightmost position of the wheel, then right calls this agent.

Theorem 3.1. The minimal number of calls needed to solve the instance Gossip(k, n) of the generalized gossip problem, for k ≥ 1 and n ≥ 4, is (k+1)(n-2).

The main part of the chapter is devoted to the proof of the above theorem: we prove that the sequence of calls produced by the algorithm is indeed a solution in Section 3.4 and that it is optimal in Section 3.5. Our proofs will be done in the formal language of DEL-PAO.

Calls in the language of DEL-PAO

DEL-PAO provides a suitable framework to model calls between agents and to reason about the evolution of their knowledge. Before the proof of correctness of our algorithm, we show how to express calls and we give some of their properties.

In the standard version of the gossip problem, agents only communicate their factual knowledge during a call. In order to achieve higherorder knowledge they also have to tell what they know about others: for shared knowledge of level k they have to exchange all their knowledge up to depth k-1.

More formally, let the level k of intended shared knowledge be given. Let i and j be two agents. For a given integer m, we note {S i , S j } ≤m the set all non-empty sequences of visibility operators S i and S j of length at most m. For example:

{S i , S j } ≤2 = {S i , S j , S i S i , S i S j , S j S i , S j S j }.
Then Call i j is the sequential composition of programs of the form

if K i K i 1 • • •K im s ∨ K j K i 1 • • •K im s then +σ 1 S i 1 • • • S im s; . . . ; +σ S i 1 • • • S im s
for secret s in Prop, integer m ≤ k-1, agents i 1 , . . . , i m ∈ Agt and sequences {S i , S j } ≤k-m = {σ 1 , . . . , σ }. (Remember that if ϕ then π abbreviates (ϕ?; π) ¬ϕ?.) For example, for k = 3 the following is an element of the sequence:

if K i K s ∨ K j K s
then +S i S s; +S j S s; +S i S i S s; +S i S j S s; +S j S i S s; +S j S j S s That piece of program tests whether K s is known by i or j and if so, makes S s visible for both i and j and i's observation of S s visible for j, and vice versa. Remember that this is procedure we used in Section 2.5.2 to model private announcements. We observe that the additions +S i S i S s and +S j S j S s are trivial because they are introspectively valid.

The following properties of the program Call i j and of its interaction with the shared knowledge operator will be useful in our proofs.

First of all, the dynamic operators [Call i j ] and the shared knowledge operators EK J are normal modal operators. So in particular

[Call i j ]ϕ ∧ [Call i j ]ψ ↔ [Call i j ](ϕ ∧ ψ) and (EK J ϕ ∧ EK J ψ) ↔ EK J (ϕ ∧ ψ)
are plainly valid. Moreover, we can put coalitions together: the schema

(EK J 1 ϕ ∧ EK J 2 ϕ) ↔ EK J 1 ∪J 2 ϕ
is plainly valid for every J 1 , J 2 ⊆ Agt. (To see this reduce EK according to its definition.) Finally, calls preserve positive knowledge and produce shared knowledge, which is a property that we state formally. Proposition 3.1. Let s ∈ Prop and m ≥ 0. Let ϕ be of the form either K i 1 . . . K im s or EK J 1 . . . EK Jm s. Then the formulas:

ϕ → [Call i j ]ϕ (Prsv ) K i ϕ → [Call i j ]EK k-m i,j ϕ (Incr )
are plainly valid.

Proof. We prove each implication thanks to properties of DEL-PAO.

• (Prsv ). This is due to ϕ not containing negations and calls only making atoms true.

• (Incr ). Suppose ϕ = K i 1 . . . K im s. The proof for ϕ = EK J 1 . . . EK Jm s is similar since EK J is a conjunction of K i .

We have seen in DEL-PAO (see Proposition 2.19 on page 63) that

ϕ ↔ β∈RATM (ϕ) β is plainly valid. Moreover, RATM (EK m i,j ϕ) = {σ α : α ∈ RATM (ϕ), σ ∈ {S i , S j } ≤m }
by the definition of the relevant atoms. Therefore we want to prove that

K i ϕ → [Call i j ]
β∈{σ α:α∈RATM (ϕ),σ∈{S i ,S j } ≤k-m } β .

We have:

K i K i 1 . . . K im s → K i K ir 1 . . . K ir p s,
for every r 1 , . . . , r p 1, . . . , m , by axiom T of standard epistemic logic. Remember that r 1 , . . . , r p 1, . . . , m means that r 1 , . . . , r p is a subset of 1, . . . , m , in the same order. Since K i K ir 1 . . . K ir p s obviously implies K i K ir 1 . . . K ir p s ∨ K j K ir 1 . . . K ir p s, for every subset r 1 , . . . , r p 1, . . . , m , we have:

K i K i 1 . . . K im s → [Call i j ] β∈{σ S ir 1 ...S ir p s:σ∈{S i ,S j } ≤k-p } β ,
by the definition of programs composing Call i j . This means that

K i K i 1 . . . K im s → [Call i j ] β∈{σ S ir 1 ...S ir p s:σ∈{S i ,S j } ≤k-m } β , because p ≤ m.
Since this is true for any r 1 , . . . , r p 1, . . . , m , we can apply Proposition 2.20 on page 64 and we obtain

K i K i 1 . . . K im s → [Call i j ] β∈{σ α:α∈RATM (K i 1 ...K im s),σ∈{S i ,S j } ≤k-m } β ,
which is our result.

Therefore both implications are plainly valid.

With the help of the call actions, we can define the turn t of Algorithm 3.1 as:

turn t =

Correctness

We now prove that the algorithm returns a solution.

Let us rename the agents: Agt = {left, right, 0, . . . , n-3}. The initial state is modelled by the valuation

V 0 = {s i : i ∈ Agt} ∪ {S i s i : i ∈ Agt} ∪ {α : α is valid in INTR}.
So all secrets are true, each agent knows her own secret, and moreover the introspectively valid atoms are true (so that V 0 ∈ INTR). We have:

V 0 |= i∈Agt K i s i ∧ j∈Agt,j =i ¬K j s i .
An agent is an expert for depth t if her personal goal for depth t is reached. Precisely, agent i is an expert for depth t ≥ 1 if and only if we have:

K i EK t-1
Agt s Agt . The dynamic modalities of DEL-PAO nicely allow us to express that a further call would turn an agent i into an expert, i.e., that i is a semiexpert. Indeed, two agents i and j are complementary for depth t ("semiexperts"), noted compl t (i, j), if a call between i and j would make them both experts for depth t. More formally:

compl t (i, j) = [Call i j ]EK i,j EK t-1
Agt s Agt . Furthermore, two pairs of agents (i 1 , i 2 ) and (j 1 , j 2 ) are complementary for depth t if and only if we have:

compl t (i 1 , j 1 ) ∧ compl t (i 1 , j 2 ) ∧ compl t (i 2 , j 1 ) ∧ compl t (i 2 , j 2 ).
In this section, we prove that the sequence of calls returned by our algorithm has an optimal length. 5We first show a property of the gossip problem that may seem obvious but that we prefer to clarify. Lemma 3.5. Suppose m agents know a fact ϕ not known to the remaining agents.

Then it takes at least n-m calls for the remaining agents to know ϕ.

Proof. It suffices to prove that a call Call i j increases the knowledge on a fact ϕ of at most one agent. We distinguish four cases depending on the knowledge of i and j on ϕ.

• Neither i nor j know ϕ.

Then K i ϕ ∨ K j ϕ is false and no agent knows ϕ after Call i j .

• i knows ϕ but j does not know ϕ.

Then K i ϕ ∨ K j ϕ is true and both agents know ϕ after Call i j but only j learned it.

• i does not know ϕ but j knows ϕ.

Then K i ϕ ∨ K j ϕ is true and both agents know ϕ after Call i j but only i learned it.

• i and j know ϕ. Then K i ϕ ∨ K j ϕ is true but both agents know ϕ after Call i j but no one learned it.

Therefore n-m calls are necessary to spread a piece of gossip to n-m agents.

Proposition 3.3. The minimal number of calls needed to solve the instance Gossip(k, n) of the generalized gossip problem, for k ≥ 1 and n ≥ 4, is at least (k+1)(n-2).

Proof. We prove it by induction on k.

Base case: k = 1. As we have seen, protocols achieving the goal in 2(n-2) calls have been proved to be optimal [START_REF] Baker | Gossips and telephones[END_REF][START_REF] Tijdeman | On a telephone problem[END_REF][START_REF] Hajnal | A cure for the telephone disease[END_REF] for k = 1.

Inductive case. Suppose that we need at least (k+1)(n-2) calls to achieve the goal for depth k. This implies that after (k+1)(n-2) -1 calls, at least one agent, let us call her i, does not know a piece of information of depth k -1:

V 0 |= [Call i 1 j 1 ; . . . ; Call i (k+1)(n-2)-1 j (k+1)(n-2)-1 ]¬K i K 1 • • • K k-1 s.
Observe that i could also not know facts of a lower depth; in this case she would also not know facts of depth k -1 by the truth axiom T. For example, suppose that i does not know the secret of 1; then she cannot know that 2 knows the secret of 1, and that 1 knows that 2 knows the secret of 1, and so on.

Then the (k+1)(n-2)-th call involves i (otherwise her knowledge does not evolve) and another agent, say j. This call establishes not only

K i K 1 • • • K k-1
s and thus the goal for depth k:

V 0 |= Call i 1 j 1 ; . . . ; Call i (k+1)(n-2)-1 j (k+1)(n-2)-1 Call i j EK k Agt s
Agt , but also the fact that i and j both know this:

V 0 |= Call i 1 j 1 ; . . . ; Call i (k+1)(n-2)-1 j (k+1)(n-2)-1 Call i j EK i,j EK k
Agt s Agt , while no other agent does:

V 0 |= [Call i 1 j 1 ; . . . ; Call i (k+1)(n-2)-1 j (k+1)(n-2)-1 ][Call i j ] ∈Agt\{i,j} ¬K EK k Agt s Agt .
To establish the goal for depth k + 1, EK Agt EK k Agt s Agt , it is necessary to distribute EK k Agt s Agt from i and j to all other agents. By Lemma 3.5, we know that this takes at least n-2 calls. Therefore, we need (k+1)(n-2)+ n -2 = (k+2)(n-2) calls to achieve the goal for depth k + 1.

Propositions 3.2 and 3.3 together ensure Theorem 3.1, i.e., that the minimal number of calls needed to solve the instance (k, n) of the generalized gossip problem, for k ≥ 1 and n ≥ 4, is exactly (k+1)(n-2).

Two and three agents

Our algorithm works when four or more agents are involved; it trivially does not for two and three agents. 6that is,

V 0 |= [turn 0 ; turn 1 ; . . . ; turn k+2 ][turn k+3 ]EK k+1
Agt s Agt , which is our goal for depth k + 1.

Proposition 3.5. The minimal number of calls needed to solve the instance Gossip(k, 3) of the generalized gossip problem, for k ≥ 1, is at least k+2.

Proof. This proof is similar to the proof of optimality for n ≥ 4 (see Proposition 3.3).

Base case: k = 1. It was proven-and it is easy to check-that 3 calls are necessary, in the original problem, when three agents are involved [START_REF] Baker | Gossips and telephones[END_REF][START_REF] Tijdeman | On a telephone problem[END_REF][START_REF] Hajnal | A cure for the telephone disease[END_REF].

Inductive case. Suppose that at least k+2 calls are necessary to achieve the goal for depth k. Then after k+1 calls, at least one agent i does not know a piece of information of depth k -1. The k+2-th call, between i and j, makes i know this piece of information, and i and j be aware of this. At least one call is necessary to inform the third agent that the goal for depth k was reached, establishing the goal for depth k + 1 in k+3 calls.

Gossiping with ignorance goals

In the gossip problem, we aim for full knowledge of every agent on secrets. We could also consider scenarios where we want that some agents do not learn some secrets. Assuming agents cannot omit to tell secrets they know (say, for example, because they do not know the goal), the ordering of calls might be influenced by these "ignorance goals." This section discusses some aspects of this variant which, to the best of our knowledge, was not investigated before. Unlike the version with full knowledge goal though, we do not provide a result on the number of calls or a generic algorithm, but rather protocols in specific cases and general remarks. 7Let us start with the original gossip problem, i.e., with k = 1. Suppose we do not want agent 1 to know the secret of 2, and full knowledge otherwise. Our goal is

EK Agt\{1} s Agt ∧ K 1 s Agt\{2} ∧ ¬K 1 s 2 .
While this is obviously unsolvable for 2 agents, for at least 3 agents, a protocol would be for 1 to call every other agent but 2 before they have 3.7. Gossiping with ignorance goals called 2. Then 2 and the remaining agents could solve the problem not involving 1. Slightly more generally, if 1 must not know the secret of 2, . . ., m, she must call m+1, . . ., n before they call any of 2, . . ., m, then 2, . . ., m, m+1, . . ., n can freely acquire full knowledge.

It gets quickly more complicated, even for k = 1, when several agents should be ignorant. For example, suppose n = 4 and 1 should not know the secret of 3, while 2 should not know the secret of 4. Then 1 should call 2 first, before she calls 4 and before 2 calls 3. Then 1 can call 4, 2 can call 3 and 3 can call 4. Now suppose that 1 should not know the secret of 3, while 3 should not know the secret of 1. Then no sequence of calls lead to a solution, since every agent that 1 calls cannot be called by 3 and conversely. Now we skip to higher-order order goals. Take k = 2 and suppose we want 1 not to know whether 2 knows the secret of 3 (but we do want 1 and 2 to know the secret of 3):

EK Agt\{1} EK Agt s Agt ∧ (K 1 EK Agt\{2} s Agt ∧ K 1 K 2 s Agt\{3} ) ∧ ¬K 1 K 2 s 3 .
Then the following protocol gives a solution:

1. 2 calls every agent but 3; 2. all agents but 2 call themselves until full knowledge of depth 2 is acquired;

3. 2 calls every agent but 1.

After the second step, every agent i different from 2 has almost reached her goal, except that she does not know whether 2 knows the secret of 3 (because it is not the case yet). At the third step, 2 calls everyone but 1, to learn the secret of 3, acquire the required depth of knowledge and inform every other agent.

Observe that if we increase the depth k, the goal that only 1 does not to know whether 2 knows the secret of 3 becomes unsolvable. By the truth axiom T of epistemic logic, we have, for example:

K 1 K 4 K 2 s 3 → K 1 K 2 s 3 ,
and hence the latter cannot be false without the former being false. Therefore for k > 2, the correct specification will be that every goal of the form

K 1 K i 1 . . . K im K 2 K j 1 . . . K jp s 3 is false, for m+p+2 ≤ k.

Conclusion

We have provided a logical analysis of the gossip problem, focusing on how higher-order shared knowledge can be obtained. DEL-PAO integration of knowledge modalities and dynamic modalities provides a handy language in order to reason about concepts such as an agent being a semi-expert, which is pivotal in our algorithm. With DEL-PAO, we were able to prove both the correctness and optimality of our algorithm, generalizing the results from [START_REF] Baker | Gossips and telephones[END_REF][START_REF] Tijdeman | On a telephone problem[END_REF][START_REF] Hajnal | A cure for the telephone disease[END_REF] on the necessary number of calls.

The gossip problem recently attracted quite some attention in the dynamic epistemic logic community [Attamah et al., 2014a,b;[START_REF] Van Ditmarsch | Dynamic gossip[END_REF]. We believe that our generalization as well as these variations provide interesting, canonical multi-agent problems in the field of epistemic logic and automated planning, that can be compared to the blocksworld in classical planning. First steps towards the latter, as well as an encoding of the generalized gossip problem with and without ignorance goals, are reported in Chapter 4.

A simple account of multi-agent epistemic planning

The generalized gossip problem can be viewed as perhaps the simplest multi-agent planning problem: it is only the agents' knowledge that evolves, while the facts of the world remain unchanged.

In this chapter, we apply DEL-PAO to epistemic planning, as it allows us to model actions and epistemic planning tasks such as the gossip problem.

While DEL-PAO visibility atoms and epistemic formulas allow us to model epistemic planning problems and to reduce conditions and goals to boolean formulas, we are able to formalize the existence of a plan with its dynamic operators, giving the complexity result. We also study an encoding of actions into PDDL, the standard Planning Domain Definition Language [START_REF] Mcdermott | PDDL -The Planning Domain Definition Language[END_REF]]. This allows us to find a plan efficiently with a PDDL planner, which we do with the generalized gossip problem and with the "exam problem" where truth values of facts can also evolve.

Résumé

Le problème du bavardage généralisé peut être considéré comme le problème de planification multi-agent le plus simple : seuls les connaissances des agents évoluent, alors que l'état du monde reste inchangé. Dans ce chapitre, nous appliquons DEL-PAO à la planification épistémique : elle nous permet de modéliser des actions et des tâches de planification épistémiques comme le problème du bavardage.

Alors que les atomes de visibilité et les formules épistémiques de DEL-PAO nous permettent de modéliser des problèmes de planification épistémique et de réduire les conditions et les buts à des formules booléennes, nous sommes en mesure de formaliser l'existence d'un plan avec ses opérateurs dynamiques, donnant le résultat de complexité. Nous décrivons également un encodage des actions en PDDL [START_REF] Mcdermott | PDDL -The Planning Domain Definition Language[END_REF]]. Cela nous permet de trouver un plan efficace à l'aide un planificateur PDDL, ce que nous faisons avec le problème du bavardage généralisé et avec le "problème de l'examen" où les valeurs de vérité des propositions peuvent aussi évoluer.

DEL-PAO S : DEL-PAO without joint visibility

In this chapter, we consider the fragment of DEL-PAO without the JS operator, and thus without common knowledge. This avoids dealing with introspective consequences; we will come back to this in Section 4.4.4.

We call this logic DEL-PAO S .

Language of DEL-PAO S

Recall that Prop is a countable non-empty set of propositional variables and Agt is a finite non-empty set of agents. The set of visibility operators is now:

OBS S = {S i : i ∈ Agt}.
Like in DEL-PAO, the set of all sequences of visibility operators is noted OBS S * . The set of atomic formulas becomes:

ATM = {σp : σ ∈ OBS S * , p ∈ Prop}
The language of programs and formulas of DEL-PAO S is defined by the following grammar:

π ::= +α | -α | (π; π) | (π π) | π * | ϕ? ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | [π]ϕ
where α ranges over ATM and i over Agt.

Programs and all operators are to be read like in DEL-PAO (see Section 2.1). The other boolean operators and dual modal operators abbreviate like in DEL-PAO (i.e., in the standard way). The set of atoms appearing in the formula ϕ and in the program π, noted ATM (ϕ) and ATM (π), are also defined like in DEL-PAO. Hence the only difference is that JS operators and the common knowledge modal operator CK are not included. We note Fml bool the set of boolean formulas, i.e., formulas that do not contain K i or [π].

Semantics of DEL-PAO S

In this chapter, we denote valuations by s or t instead of V , as automated planning usually deals with "states" instead of worlds or valuations.

Since we do not include joint visibility operators, a state s ∈ 2 ATM is introspective if and only if it contains every atom of the form σ S i S i α with σ ∈ OBS S * . Therefore an atom is valid in INTR if and only if it is of the form σ S i S i α with σ ∈ OBS S * . Accessibility relations for K i are defined exactly like in DEL-PAO:

s ∼ i s iff S i α ∈ s implies s(α) = s (α)
where s(α) = s (α) when either α ∈ s and α ∈ s , or α / ∈ s and α / ∈ s . We verify that the introspective properties of DEL-PAO still hold. Proof. Suppose that s ∼ i s for an arbitrary agent i and that s ∈ INTR.

Take an arbitrary atom α of the form σ S j S j α with σ ∈ OBS * . Since s ∈ INTR, α belongs to s, and moreover S i α also belongs to s. Thus α belongs to s for every s ∼ i s . Therefore s ∈ INTR.

For the dynamic part, we do not have to deal with introspective consequences as we do not include the JS operator. Valuations updates become simpler than in DEL-PAO:

s+α = s ∪ {α} s-α = s \ {α}
Obviously, if s is introspective, the only way to lead to a non-introspective valuation is to remove an introspectively valid atom. Therefore when s is introspective then both s+α and s-α are as well, unless α is valid in

INTR.

Truth conditions are as follows:

s |= α iff α ∈ s s |= ¬ϕ iff not (s |= ϕ) s |= ϕ ∧ ϕ iff s |= ϕ and s |= ϕ s |= K i ϕ iff s |= ϕ for every s such that s ∼ i s s |= [π]ϕ iff s |= ϕ for every s such that sR π s
where R π is a binary relation on valuations defined by:

sR +α s iff s = s+α sR -α s iff s = s-α and α not valid in INTR sR π 1 ;π 2 s iff s(R π • R π )s sR π 1 π 2 s iff s(R π ∪ R π )s sR π * s iff s( k∈N 0 (R π ) k )s sR ϕ? s iff s = s and s |= ϕ
Truth conditions are identical to DEL-PAO (see Section 2.2.5) for epistemic operators; for dynamic operators, as we have mentioned, the relation for assignments is simplified.

Epistemic planning with conditional effects

In this section, we formally define actions and planning tasks within our framework. We assume that we perform planning tasks in fully observable, deterministic domains.

Actions with conditional effects

An conditional action is a pair a = pre(a), eff (a) where:

• pre(a) ∈ Fml bool is a boolean formula: the precondition of a;

• eff (a) ⊆ Fml bool × 2 ATM × 2 ATM is a set of triples ce of the form cnd (ce), ceff + (ce), ceff -(ce) ,
the conditional effects of a, where cnd (ce) is a boolean formula (the condition) and ceff + (ce) and ceff -(ce) are sets of atoms (added and deleted atoms respectively).

We impose that there is no conflicting effects: for every ce 1 , ce 2 ∈ eff (a) with cnd (ce 1 ) and cnd (ce

2 ) consistent, ceff + (ce 1 ) ∩ ceff -(ce 2 ) = ∅.
We extend the set of atoms to an action a as expected:

ATM (a) = ATM (pre(a)) ∪ ce∈eff (a) ATM (cnd (ce)) ∪ ceff + (ce) ∪ ceff -(ce)
For example, consider the conditional action toggle p of flipping the truth value of the propositional variable p. It is described as toggle p = pre(toggle p ), eff (toggle p ) with:

pre(toggle p ) = eff (toggle p ) = { p, ∅, {p} , ¬p, {p}, ∅ }
The conditions p and ¬p are inconsistent, thus not leading to conflict.

Example 4.1. Suppose we want to model the original gossip problem, i.e., the gossip problem presented in Chapter 3 with a depth k = 1. Let Agt = {1, . . . , n} and Prop = {s i : i ∈ Agt}. As in Chapter 3, each propositional variable s i represents the secret of agent i. (We suppose each s i is true.)

During the action Call i j , we have seen that agents i and j tell each other every secret they know among all n secrets. We have Call i j = pre(Call i j ), eff (Call i j ) with pre(Call i j ) = and:

eff (Call i j ) = { S i s 1 ∨ S j s 1 , {S i s 1 , S j s 1 }, ∅ , . . . , S i s n ∨ S j s n , {S i s n , S j s n }, ∅ }.
Unlike the specification of Chapter 3, here formulas must not contain epistemic operators. Since secrets will be initially true and actions do not make them false, the condition K i s ∨K j s is equivalent to S i s ∨S j s , hence the current specification.

There is no possible conflict since Call i j has no negative effects. A conditional action a determines a relation between states that is a partial function: sR a s iff s |= pre(a), and for every ce ∈ eff (a) such that

(ceff + (ce) ∪ ceff -(ce)) ∩ {α : α is valid in INTR} = ∅,
s |= cnd (ce), and

s = s \ ce∈eff (a) and s|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s|=cnd(ce) ceff + (ce).
In words, an action adds and removes atoms as expected if its precondition is satisfied and none of its conditional effects involving an introspective atom can be triggered. We will see why this constraint on introspective atoms is required in Section 4.3.

Simple epistemic planning tasks

We say that a state s is reachable from a state s 0 via a set of conditional actions Act if there exists a sequence of actions a 1 , . . . , a m ∈ Act and a sequence of states t 0 , . . . , t m ∈ 2 ATM with m ≥ 0 such that s 0 = t 0 , s = t m and t k-1 R a k t k for every k such that 1 ≤ k ≤ m.

A simple epistemic planning task is a triple P = Act, s 0 , Goal where Act is a finite set of actions, s 0 ∈ 2 ATM is a finite state (the initial state) and Goal ∈ Fml bool is a boolean formula. It is solvable if at least one state s such that s |= Goal is reachable from s 0 via Act; otherwise it is unsolvable.

We define the set of atoms of a planning task P = Act, s 0 , Goal as expected:

ATM (P) = a∈Act ATM (a) ∪ s 0 ∪ ATM (Goal )
Example 4.2. The planning task corresponding to the original gossip problem is

G 1 = Act G 1 , s G 1 0 , Goal G 1 with: • Act G 1 = {Call i j : i, j ∈ Agt and i = j}; • s G 1 0 = {S i s i : i ∈ Agt} ∪ {s i : i ∈ Agt}; • Goal G 1 = i,j∈Agt S i s j ,
as specified in Chapter 3 (such that, like conditions in Example 4.1, the goal formula must not contain epistemic operators).

Normal forms

The depth of atoms being unbounded, introspective states are infinite since they contain every atom of the form σ S i S i α with σ ∈ OBS S * . However, we want to deal with finite states, especially when encoding our problem into PDDL (see Section 4.5). We thereby impose that planning tasks are in normal form: they must not include an introspectively valid atom. In this form, we show that they are solvable starting from an introspective, but infinite initial state if and only if they are from the same state without atoms valid in INTR.

Boolean formulas

We say that a boolean formula ϕ is in normal form if and only if for every α ∈ ATM (ϕ), α is not valid in INTR.

Given a boolean formula ϕ, the following procedure produces a formula in normal form.

Procedure 4.1. For every α ∈ ATM (ϕ) such that α is valid in INTR, replace every occurrence of α in ϕ by .

We note the resulting formula NF (ϕ). Proof. Since ϕ is in normal form, any α which is valid in INTR does not belong to ATM (ϕ). Hence since ϕ is boolean, by Proposition 2.9 on page 38, only atoms from ATM (ϕ) influence the truth value of ϕ, and thus, no introspectively valid α do. In other words, s\{α} |= ϕ if and only if s∪{α} |= ϕ.

Actions

We say that the action a is in normal form if and only if:

• the formulas pre(a) and cnd (ce) for every ce ∈ eff (a) are in normal form;

• for every ce ∈ eff (a), if α ∈ ceff + (ce) ∪ ceff -(ce) then α is not intro- spectively valid.
Given an action a, the following procedure produces an action in normal form. We note the resulting action NF (a). We split the set of conditional effects of a into two parts depending on whether they contain an introspectively valid atom or not:

CE INTR = {ce ∈ eff (a) : (ceff + (ce) ∪ ceff -(ce)) ∩ {α : α is valid in INTR} = ∅} CE INTR = {ce ∈ eff (a) : (ceff + (ce) ∪ ceff -(ce)) ∩ {α : α is valid in INTR} = ∅}
Therefore we can characterise NF (a), returned by Procedure 4.2, by:

• pre(NF (a)) = NF (pre(a) ∧ ce∈CE INTR ¬cnd (ce)); • eff (NF (a)) = { NF (cnd (ce)), ceff + (ce), ceff -(ce) : ce ∈ CE INTR }.
Intuitively, every conditional effect from CE INTR may modify an introspective atom, and thus is removed from the set of effects, while the negation of its condition is added to pre(a). Moreover, every formula is put to normal form. We know that: To prove that sR a t and sR NF (a) t are equivalent, we are going to prove that (4.1) together with (4.2) are equivalent to (4.4) and that (4.2) together with (4.3) are equivalent to (4.5).

sR a t iff
• (4.1) and (4.2) together are equivalent to:

s |= pre(a) ∧ ce∈CE INTR ¬cnd (ce),
which, by Proposition 4.3, is equivalent to:

s |= NF (pre(a) ∧ ce∈CE INTR ¬cnd (ce))
since s in introspective. We examine each part that differs between the two definitions. Therefore s\{α} R a t\{α} is equivalent to s∪{α} R a t∪{α}.

Planning tasks

The planning task P = Act, s 0 , Goal is in normal form if and only if:

• every action a ∈ Act is in normal form;

• the formula Goal is in normal form. Propositions 4.4 and 4.6 imply that P = Act, s 0 , Goal is solvable if and only if P = Act, s 0 , Goal with s 0 = s 0 \ {α : α is valid in INTR} is solvable.

Observe that Example 4.2 is trivially in normal form since no higherorder knowledge is involved. We will however need to be careful when specifying the generalized gossip problem (see Section 4.6.2).

One could wonder why we did not apply the technique we used in DEL-PAO for defining the model checking problem, that consists in restricting the valuation to (relevant) atoms appearing in the actions and in the goal. This would indeed be an alternative. However, the transformation of epistemic formulas into boolean formulas is required for encoding the planning task into PDDL; we believe that this method is more intuitive and less technical than the one we previously used.

Complexity results

Consider the planning task P = Act, s 0 , Goal . In this section, we show how actions from Act can be encoded into DEL-PAO S programs. Then we prove that the solvability of P is in PSPACE by showing that it can be polynomially reduced to a DEL-PAO S model checking problem.

Storing variables

The conditional effects of the actions that we have defined in Section 4.2 are produced in parallel. We have to simulate this in DEL-PAO S by sequential composition. We therefore have to take care that the truth value of no condition is modified by an effect. To achieve this, we store the values of our conditions before executing the action, and evaluate such values. This problem does not arise in PDDL where all conditions are checked before any effects are produced.

We use new atomic variables noted c, called storage variables, which we suppose do not appear in the planning task under concern. Then the program storing the value of a formula is defined as: Proof. Take an arbitrary valuation s ∈ 2 ATM . Using axioms from Proposition 2.11 on page 50 that are plainly valid, we have:

str(ϕ, c) = if ϕ then +c else -c.
s |= [str(ϕ, c)]c ⇔ s |= [if ϕ then +c else -c]c ⇔ s |= [(ϕ?; +c) (¬ϕ?; -c)]c ⇔ s |= [ϕ?; +c]c ∧ [¬ϕ?; -c]c ⇔ s |= (ϕ → [+c]c) ∧ (¬ϕ → [-c]c) ⇔ s |= (ϕ → ) ∧ (¬ϕ → ⊥) (since c is not valid in INTR) ⇔ s |= ϕ ∧ ϕ ⇔ s |= ϕ,
hence the result.

After the execution of our program, we want all storage variables to be put to false so that we do not have to worry about them later. The program resetting the value of a given set of storage variables is simply defined as rst({c 1 , . . . , c m }) = -c 1 ; . . . ; -c m .

Encoding of actions

Intuitively, an action is a DEL-PAO S program, only executed if the precondition is fulfilled, applying each conditional effect whose condition is satisfied. For example, the action toggle p (flipping the value of the variable p) corresponds to the program:

str(p, c 1 ); str(¬p, c 2 ); if c 1 then -p; if c 2 then +p.
This highlights the importance of storing values of conditions: the program if p then -p; if ¬p then +p would actually always make p true.

We first show how to perform one conditional effect ce whose condition's value was stored in c: Proposition 4.7. For every s, t ∈ 2 ATM such that s does not contain any storage variable, and every action a in normal form: s R a t if and only if s R exeAct(a) t.

Proof. By the definition of R exeAct(a) , we have: s R exeAct(a) t iff there exist s 1 , s 2 , s 3 ∈ 2 ATM such that sR pre(a)? s 1 , and s 1 R str(cnd(ce 1 ),c 1 );...;str(cnd(cem),cm) s 2 , and s 2 R exeCE(ce 1 ,c 1 );...;exeCE(cem,cm) s 3 , and

s 3 R rst({c 1 ,...,cm}) t, that is:
s R exeAct(a) t iff there exist s 2 , s 3 ∈ 2 ATM such that s |= pre(a), and sR str(cnd(ce 1 ),c 1 );...;str(cnd(cem),cm) s 2 , and s 2 R exeCE(ce 1 ,c 1 );...;exeCE(cem,cm) s 3 , and

s 3 R rst({c 1 ,...,cm}) t.
Observe that:

• First, the storage variable c i does not appear in the boolean formula cnd (ce j ).

Since str(cnd (ce i ), c i ) only modifies c i , it does not change the truth value of cnd (ce j ), for any j.

Therefore between s and s 2 , during the execution of str(cnd (ce 1 ), c 1 ); . . . ; str(cnd (ce m ), c m ), every cnd (ce j ) keeps the same value, i.e., the value it had in s.

• Second, the storage variable c i does not appear in effects ceff + (ce j ) and ceff -(ce j ). Hence exeCE(ce j , c j ) does not modify c i , for any j. Therefore between s 2 and s 3 , during the execution of exeCE(ce 1 , c 1 ); . . . ; exeCE(ce m , c m ), every c i keeps the same value, i.e., the value it had in s 2 . By Lemma 4.1, we know that the value of c i in s 2 is the value of the corresponding condition cnd (ce i ) before the execution of str(cnd (ce i ), c i ), i.e., in s (since we have seen that the execution of str(cnd (ce j ), c j ) does not change the truth value of cnd (ce i )).

• Third, the program rst({c 1 , . . . , c m }) makes every storage variable c i false.

With this in mind, and in order to simplify the writing, let us define: Note that in this case, pre(Call i j )? can clearly be dropped.

C |= = {c i : ce i ∈ eff (a) and s |= cnd (ce i )} C |= = {c i : ce i ∈ eff (a) and s |= cnd (ce i )} C = {c i : ce i ∈ eff (a)} CEFF -= ce∈eff (

Solvability of a planning task

Now that we have defined the encoding of actions, we can capture the solvability of a planning task in DEL-PAO S .

Proposition 4.8. A planning task Act, s 0 , Goal in normal form such that ATM ( Act, s 0 , Goal ) does not contain any storage variable is solvable if and only if

s 0 |= a∈Act exeAct(a) * Goal .
Proof. By the truth conditions, we have: For the equivalence between R exeAct(a) and R a to be valid, every t k-1 must not contain any storage variable. This is the case because:

s 0 |= a∈Act exeAct (
1. First, we assumed that s 0 does not contain any storage variable;

2. Second, assuming that t k-1 does not contain any storage variable, ending exeAct(a) with rst({c 1 , . . . , c m }) ensures that all used storage variables are set to false, or in other words, that t k does not contain any storage variable.

Therefore: It may seem that we assume many hypothesis on planning tasks, such as boolean formulas and actions in normal form. (This allows a straightforward translation into PDDL.) However, the previous procedures and propositions show how to transform a general planning task into a "well-behaved" one.

s 0 |= a∈Act exeAct (
Suppose you have a finite set Act of pairs a of the form pre(a), eff (a) , where pre(a) is a formula (that may contain epistemic operators), and eff (a) is a set of tuples cnd (ce), ceff + (ce), ceff -(ce) , where cnd (ce) is a formula (that may contain epistemic operators) and ceff + (ce) and ceff -(ce) are set of atoms such that for every ce 1 , ce 2 ∈ eff (a), we have ceff + (ce 1 ) ∩ ceff -(ce 2 ) = ∅. We cannot call them "actions" yet since the formulas appearing in these structures are not necessarily boolean formulas. Suppose you also have an initial state s 0 ∈ INTR, i.e., infinite, and a goal formula Goal that may also contain epistemic operators. Then:

1. Using Procedure 2.1 on page 52 of DEL-PAO, that is based on equivalences of Proposition 2.10 on page 44 which are still plainly valid, and on the rule of replacement of equivalents that still preserves plain validity, remove epistemic operators from Goal , pre(a) for every a ∈ Act, and cnd (ce) for every ce ∈ eff (a). After this step, all formulas are boolean formulas.

2. Following procedures 4.1 and 4.2, put Goal and every action a ∈ Act in normal form. By propositions 4.3 and 4.5, we know that the resulting formulas and actions are equivalent on introspective states.

3. Remove every atom α valid in INTR from s 0 . By propositions 4.4 and 4.6, we know that formulas and actions in normal form behave in the same way in the original and new s 0 .

4. Remove every atom α not appearing in the planning task from s 0 , i.e., replace s 0 by

s 0 ∩ a∈Act ATM (a) ∪ ATM (Goal ) .
Since there is no epistemic operator, by Proposition 2.9 on page 38, we know that formulas and actions will behave in the same way in the original and new s 0 .

In the end, Act is a set of actions in normal form, s 0 is finite and and

Goal is in normal form. Therefore we can apply Proposition 4.8 to solve the planning task Act, s 0 , Goal .

Theorem 4.1. Deciding the solvability of a planning task with DEL-PAO S is PSPACE-complete.

Proof. For the lower bound, we know that deciding this problem is already PSPACE-hard in classical planning [START_REF] Bylander | The computational complexity of propositional STRIPS planning[END_REF].

For the upper bound, we reduced the problem to a problem of model checking of DEL-PAO S by Proposition 4.8. We will see in Chapter 7 that DEL-PAO S can be translated into DL-PA-PMP whose model checking is in PSPACE.

This establishes that deciding the solvability of a planning task in

DEL-PAO S is in PSPACE.
This result compares favourably to DEL-based epistemic planning, which is undecidable even for simple fragments [START_REF] Aucher | Undecidability in epistemic planning[END_REF]Charrier et al., 2016a]. The difference is due to the simplicity of our underlying epistemic logic as well as to the limited expressivity of our actions: we can basically model private announcements, while DEL has more general event models.

Planning actions and joint visibility

We did not include the operator of joint visibility to our language. The reason behind this choice should appear more clearly now that we have given our encoding into DEL-PAO. 8In planning, when conditional effects are permitted, every effect of an action is assumed to be executed in parallel. This is not possible with our DEL-PAO programs: we must execute them in sequence. This leads to the specific measures we have taken: we have to include and deal with storage variables to ensure that the execution is running correctly. However, once this is taken into account, the execution of effects are not a problem any more: assignment programs can be performed in any order-we arbitrary chose to execute all positive effects, then all negative ones. Now suppose JS operators are included; this also brings about introspective causes and consequences. We have seen in DEL-PAO (see Lemma 2.4 on page 47) that the ordering in sequences of assignments becomes important. For example, +JS p; -JS S i p is neither equivalent to -JS S i p; +JS p, nor to +JS p, nor to -JS S i p. Therefore even if effects are non-conflicting, arbitrarily choosing an ordering is not an option. An alternative would be to generate all possible orderings (we will see how to do this in Chapter 5 with the star) then to quantify over them with our dynamic modalities [π] and π . In this case, actions become nondeterministic. This deflects from our main objective to design a simple approach to epistemic planning.

It is interesting to mention that we have investigated ways to include the parallel operator " " to DEL-PAO, without success. One of the 4.5. Encoding into PDDL reasons corresponds to the problem given above: deciding what should be the outcome of +JS p -JS S i p is not trivial (especially without nondeterminism).

Encoding into PDDL

In this section we present a method for encoding planning problems defined in DEL-PAO S into PDDL. As already observed, in PDDL we do not need to store conditions as we were obliged to do in DEL-PAO S . Consider a planning task Act, s 0 , Goal . We show how to encode boolean formulas and actions in PDDL.

Translation of formulas

Some PDDL requirement flags should be set depending on the form of conditions cnd (ce) of conditional effects ce of actions and of the formula Goal :

• the default flag :strips for conjunctions;

• the flag :negative-preconditions for negations;

• the flag :disjunctive-preconditions for negations of conjunctions, and disjunctions, if used to simplify writing.

Given a boolean formula ϕ ∈ Fml bool , we define a recursive function tr PDDL (ϕ) which returns the encoding of ϕ into PDDL:

tr PDDL (S i 1 . . . S im p) = (p) if m = 0 (S-m i1 ... im p) otherwise tr PDDL (¬ϕ) = (not tr PDDL (ϕ)) tr PDDL (ϕ 1 ∧ ϕ 2 ) = (and tr PDDL (ϕ 1 ) tr PDDL (ϕ 2 ))
with p ∈ Prop, m ≥ 0, and i 1 , . . . , i m ∈ Agt.

In words, a visibility atom α = S i 1 . . . S im p is encoded by a special fluent with m+1 parameters. If m = 0, then the propositional variable p is encoded as a fluent without parameters. We note tr PDDL (α) the translation of an atom α in the general case (p or S i 1 . . . S im p). Other boolean operators are encoded as expected.

The initial state s 0 is trivially encoded as a set of fluents thanks to tr PDDL (α). The formula Goal and the preconditions of every action can be encoded using tr PDDL (ϕ) since they are all boolean formulas.

Encoding of actions

As we consider actions with conditional effects, the requirement flag :conditional-effects must be set.

Consider an action a. For every ce ∈ eff (a) with ceff + (ce) = {α 1 , . . . , α m } and ceff -(ce) = {β 1 , . . . , β }, we add the conditional effect:

(when tr PDDL (cnd (ce))

(and tr PDDL (α 1 ) . . . tr PDDL (α m )

(not tr PDDL (β 1 )) . . . (not tr PDDL (β ))))
Note that, again, the ordering is not important.

Example 4.4 (Example 4.1, ctd.). The action Call 1 2 is coded in PDDL as follows:

(:action call-1-2 :effect (and (when (or (S-1 1 s1) (S-1 2 s1)) (and (S-1 1 s1) (S-1 2 s1))) ... (when (or (S-1 1 sn) (S-1 2 sn))

(and (S-1 1 sn) (S-1 2 sn))))) This is the direct encoding of a call into PDDL. Observe that we could generalize it to any i and j by: (:action call :parameters (?i ?j) :effect (and (forall (?s) (and (when (or (S-1 ?i ?s) (S-1 ?j ?s)) (and (S-1 ?i ?s) (S-1 ?j ?s)))))))

Almost all planners from last International Planning Competition (IPC 2014)9 handle conditional effects and negative preconditions, and most of them handle disjunctive preconditions. For experiments, we used the planner FDSS-2014 [START_REF] Röger | Fast downward stone soup 2014[END_REF]] that satisfied all these properties.

Applications

In this section, we first study the "exam problem" (a simple illustrative example concerning privacy of information), then the generalized gossip problem.10

The exam problem

Suppose we have two agents: a teacher and a student. The teacher has prepared the exam and keeps it in her office; the goal of the student is to know the exam topic, but without the teacher seeing her doing this.

To achieve this goal, the student must enter the teacher's office, read the exam while the teacher is not inside, and exit the office.

Let us write the corresponding planning task Exam =

Act Exam , s Exam 0 , Goal Exam . Let Agt = {t, s} and Prop = {exam, open, in t , in s }.
Agent t is the teacher and agent s is the student. The variable exam represents the topic of the exam. Like secrets in the gossip problem, its value is not relevant and we only reason about the knowledge of it (we will assume it is true). The variable open reads "the teacher's office is open," and in i , for i an agent, "agent i is in the teacher's office." Initially, we assume the office is empty and the door is closed:

s Exam 0 = {exam}.
As we said, the goal for the student is to know the exam topic without being caught by the teacher. The goal is S s exam ∧ ¬K t S s exam ∧ ¬in s . In terms of visibility atoms, this gives:

Goal Exam = S s exam ∧ ¬S t S s exam ∧ ¬in s .
We study two variants of this problem with different actions.

Vigilant teacher

In this first version, we suppose the teacher always closes her office door when leaving. The set of actions is Act Exam = {openAndGoIn t , goOutAndClose t , goIn s , goOut s , readExam s }, where

openAndGoIn t = ¬in t , { , {open, in t , S t S s exam}, ∅ } goOutAndClose t = in t ∧ ¬S s exam, , ∅, {S t S s exam, in t , open} } goIn s = open ∧ ¬in s , { , {in s }, ∅ } goOut s = open ∧ in s , { , ∅, {in s } } readExam s = in s , { , {S s exam}, ∅ }
Action openAndGoIn t makes the teacher open and enter the room, and thus watch the exam. Action goOutAndClose t makes her leave and close the room; she cannot watch the exam anymore. We add the precondition ¬S s exam to ensure that the teacher cannot leave if she has witnessed the student see the exam, so that she cannot forget this fact. 11 For the student, goIn s and goOut s makes her enter and leave the office, with the precondition that it is open; readExam s makes her read the exam topic, acquiring the knowledge on its value.

In this case, no plan reaching the goal exist. Indeed, the student can only enter the room if the door is open, which can only happen when the teacher is inside the room. Therefore the student cannot read the exam's topic without the teacher knowing it: we have S s exam → K t S s exam. This was confirmed by experiments: FDSS-2014 cannot find a plan.

Inattentive teacher

Now we assume that the teacher can leave the room without closing the door. This is done by dividing actions openAndGoIn t and goOutAndClose t each in two parts:

• we replace openAndGoIn t by: 11 It is interesting to note that this occurs because knowledge only comes from observation. It constitutes one of the limits of the approach: not seeing any more means forgetting. If we want the teacher to exit the room to perform another action only if she has seen the student read the exam (for example, inform one of her colleagues), we need to use auxiliary variables representing the fact that she knows that the student has cheated (while not currently seeing it).

open t = ¬open, { , {open}, ∅ } goIn t = open ∧ ¬in t , { , {in t , S t S s exam}, ∅ } ,
• we replace goOutAndClose t by:

goOut t = open ∧ in t ∧ ¬S s exam, { , ∅, {S t S s exam, in t } } close t = open, { , ∅, {open} } .

Thus the set of actions becomes

Act Exam = {open t , close t , goIn t , goOut t , goIn s , goOut s , readExam s }.

In this setting, the problem becomes solvable: for example, the plan open t ; goIn t ; goIn s ; goOut t ; readExam s ; goOut s is a solution plan. More mundanely, FDSS-2014 finds the shortest plan: open t ; goIn s ; readExam s ; goOut s . Note that in these two examples, we are more interested in the existence of a plan than in the plan itself: the first variant is safe for the teacher, while the second is not.

The generalized gossip problem

We formalize the problem exactly like in Chapter 3. Let Agt = {1, . . . , n} and Prop = {s i : i ∈ Agt}. Let us write the planning task for the generalized gossip problem of depth k

G k = Act G k , s G k 0 , Goal G k . Our goal is ϕ G k = EK k Agt s Agt .
Remember that s Agt abbreviates i∈Agt s i , that EK Agt ϕ abbreviates i∈Agt K i ϕ and that EK k Agt is the iteration of EK Agt , k times. As a boolean formula, this becomes:

Goal G k = α∈RATM -(ϕ G k ) α,
where

RATM -(ϕ) = RATM (ϕ) \ {α : α is valid in INTR}.
The set RATM -(ϕ) contains the relevant atoms of ϕ as defined in DEL-PAO (see Section 2.4.3), without all introspectively valid atoms, as we require the goal to be in normal form.

The initial state and the set of actions are still the same:

s G k 0 = {S i s i : i ∈ Agt} ∪ {s i : i ∈ Agt} Act G k = {Call i j : i, j ∈ Agt, i = j},
where pre(Call i j ) = and every conditional effect ce ∈ eff (Call i j ) is of the form:

cnd (ce) = α∈RATM -(K i K i 1 ...K im s ) α ∨ α∈RATM -(K j K i 1 ...K im s ) α ceff + (ce) = {σ S i 1 . . . S im s : σ ∈ {S i , S j } ≤k-m } ceff -(ce) = ∅
for every 0 ≤ m < k and i 1 , . . . , i m , ∈ Agt such that for every 1 ≤ p < m, i p = i p+1 , and i = i 1 and j = i 1 . The description of effects ensures that there is not valid atom modified, so that Call i j is in normal form. Remember that {S i , S j } ≤k-m denotes the set all non-empty sequences of visibility operators S i and S j of length at most km.

It is also possible to easily model the gossip with ignorance goals as introduced in Section 3.7. Given a set of atoms A such that A ∩ {α : α is valid in INTR} = ∅, let us write the planning task for the generalized gossip problem of depth k with the atoms of A as the only negative goals

G-neg k,A = Act G-neg k,A , s G-neg k,A 0 , Goal G-neg k,A .
The initial state and the actions remains the same:

s G-neg k,A 0 = {S i s i : i ∈ Agt} ∪ {s i : i ∈ Agt} Act G-neg k,A = {Call i j : i, j ∈ Agt, i = j}, but the goal changes: Goal G-neg k,A = α∈RATM -(ϕ G k )\A α ∧ α∈A ¬α .
Here are some examples:

• G-neg 1,{S 1 s 2 } corresponds to the case where we want everyone to know all secrets, except 1 that should not know the secret of 2;

• G-neg 1,{S 1 s 3 ,S 2 s 4 } , to the case where only 1 does not know the secret of 3 and 2, the secret of 4;

• G-neg 2,{S 1 S 2 s 3 } , to the case of epistemic depth 2 where only 1 does not know whether 2 knows the secret of 3, while 1 and 2 know the secret of 3; G-neg 3,{S 1 S 2 s 3 } the same goal but of depth 3.

(We had discussed these instances in Section 3.7.)

The resources available at http://www.irit.fr/%7EAndreas.Herzig/ P/Ecai16.html include an open-source PDDL generator that was developed in Python (the direct link is https://github.com/FaustineMaffre/ GossipProblem-PDDL-generator). It allows us to create the domain and problem files for the generalized gossip problem and its variant with ignorance goals. In its basic settings, the program needs the depth k and the number of agents n. It is also possible to specify sets of negatives goals, either directly by giving the index of agents (such as {S 1 s 3 , S 2 s 4 }), or with constraints (such as {S i s j : i = j and j < 3} if we want every agent not to know secrets of all agents except 1 and 2). Feeding the resulting files to a PDDL planner returns a sequence of calls which is a solution to the corresponding gossip problem. As examples, here are the shortest plans that were produced by FDSS-2014 for the examples above, with 4 agents:

• G-neg 1,{S 1 s 2 } : Call 1 3 ; Call 1 4 ; Call 2 4 ; Call 3 4 ; • G-neg 1,{S 1 s 3 ,S 2 s 4 } : Call 1 2 ; Call 1 4 ; Call 2 3 ; Call 3 4 ; • G-neg 2,{S 1 S 2 s 3 } : Call 1 2 ; Call 2 4 ; Call 3 4 ; Call 1 3 ; Call 2 3 ;
Call 2 4 and no solution for G-neg 3,{S 1 S 2 s 3 } .

Conclusion

In this chapter, we have made a first step towards a realistic and provably-correct method for multi-agent epistemic planning. Our use of a logic of action and knowledge together with an state of the art automatic planner (which is assumed to be correct in the case of classical planning with conditional effects) provides a method for producing plans which are guaranteed to be correct.

Our approach contrasts with the undecidability of DEL-based epistemic planning which occurs even for simple fragments [START_REF] Aucher | Undecidability in epistemic planning[END_REF]Charrier et al., 2016a]. Of course, the low complexity of DEL-PAO S compared to DEL comes at the price of expressivity. We have seen that our epistemic logic DEL-PAO S has more validities than standard epistemic logic. We have also seen in the exam problem that considering knowledge instead of belief is a restriction leading to counter-intuitive design of actions (the teacher must not exit the room if she has seen the student see the exam). While relaxing knowledge in DEL is simple, this is not easy in DEL-PAO. However, our framework at least allows us to update knowledge along with facts of the world and to specify epistemic preconditions of any form. Since any epistemic formula can be reduced to a boolean formula, the translation to PDDL is immediate.

Résumé du chapitre

Dans ce chapitre, nous étendons DEL-PAO en y ajoutant de nouveaux atomes spéciaux : des atomes des contrôle. Cela nous permet d'interpréter, en plus des opérateurs épistémiques, l'opérateur de capacité stratégique ceteris paribus et de capturer les jeux booléens épistémiques.

L'atome de contrôle C i p se lit "l'agent i contrôle la valeur de p" ; C i C j p se lit "i contrôle si l'agent j contrôle p" ; etc. Nous permettons l'imbrication avec la visibilité : C i S j p est lu "i contrôle la visibilité de j sur la valeur de vérité de p" ; S i C j p est lu "i voit si j contrôle p" ; etc. Nous sommes alors en mesure d'interpréter l'opérateur stratégique 3 J , qui signifie intuitivement que les agents de l'ensemble J peuvent rendre une propriété vraie en modifiant les variables qu'elles contrôlent, en supposant que les autres agents n'agissent pas [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF][START_REF] Herzig | Logics of knowledge and action: critical analysis and challenges[END_REF]. Avec l'aide de cet opérateur, nous montrons comment capturer les jeux booléens épistémiques et comment raisonner sur les équilibres de tels jeux.

Nous appelons cette nouvelle logique DEL-PAOC : une logique épistémique dynamique des affectations propositionnelles, de l'observation et du contrôle.

Language of DEL-PAOC

Remember that Prop is a countable non-empty set of propositional variables and Agt is a finite non-empty set of agents.

Like in Chapter 4, in this chapter we consider the fragment of DEL-PAO without JS operators and thus without common knowledge. As we will discuss in Section 5.6, including the joint visibility operator implies dealing with introspective consequences and leads to problems with exclusive control. The set of visibility operators is

OBS S = {S i : i ∈ Agt}.
The set of control operators is

CTRL = {C i : i ∈ Agt},
where C i stands for control of agent i. The set of all sequences of visibility and control operators is noted (OBS S ∪ CTRL) * and the set of all non-empty sequences is noted (OBS S ∪ CTRL) + . As in DEL-PAO, we use σ, σ , . . . for elements of (OBS S ∪ CTRL) * .

Language of DEL-PAOC

Atomic formulas are now sequences of visibility, but also control operators followed by propositional variables:

ATM = {σ p : σ ∈ (OBS S ∪ CTRL) * , p ∈ Prop}.
Therefore our new atoms include C i operators. Here are some examples:

• C 1 p reads "1 controls the value of p." This means that 1 has the ability to change the truth value of the variable p.

• C 1 C 2 p reads "1 controls whether 2 controls the value of p."

• S 1 C 2 q reads "1 sees whether 2 controls the value of q." Recall that this does not imply that 2 controls the value of q.

• C 1 S 2 p reads "1 controls whether 2 sees the value of p."

• ... and so on.

The language of DEL-PAOC is then defined by the following grammar:

π ::= +α | -α | (π; π) | (π π) | π * | ϕ? ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | [π]ϕ | 3 J ϕ
where α ranges over ATM , i over Agt and J over 2 Agt .

Programs and all operators except 3 J should be read like in DEL-PAO (see Section 2.1). 3 J ϕ is a strategic operator that reads "agents in J can achieve ϕ by modifying variables they control if other agents do not act." This refers to the ceteris paribus strategic ability in the sense of [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF][START_REF] Herzig | Logics of knowledge and action: critical analysis and challenges[END_REF].

The other boolean operators and dual modal operators abbreviate like in DEL-PAO (i.e., in the standard way). Moreover, 2 J ϕ ("agents in J cannot avoid ϕ by changing values of variables they control while other agents do not act") abbreviates ¬3 J ¬ϕ.

The set of atoms appearing in the formula ϕ and in the program π, noted ATM (ϕ) and ATM (π), are also defined like in DEL-PAO, with the addition of:

ATM (3 J ϕ) = ATM (ϕ).
Following [van der Hoek and Wooldridge, 2005], we can express the "coalition logic-like" strategic formula J ϕ that reads "agents in J are able to achieve ϕ by modifying variables they control, whatever the other agents do" from 3 J by

J ϕ = 3 J 2 Agt\J ϕ, along with its dual [[J]]ϕ = ¬ J ¬ϕ.

Semantics of DEL-PAOC

Like in Chapter 4, a valuation V ∈ 2 ATM is introspective if and only if it contains every atom of the form σ S i S i α with σ ∈ OBS S * , and not (OBS S ∪ CTRL) * , and α ∈ {σ p : σ ∈ (OBS S ∪ CTRL) * , p ∈ Prop}. This means that, for example, C j S i S i p is not valid in INTR (but S i S i C j p is).

Accessibility relations for K i are defined exactly like in DEL-PAO (see Section 2.2.3):

V ∼ i V iff S i α ∈ V implies V (α) = V (α)
where, again, V (α) = V (α) when either α ∈ V and α ∈ V , or α / ∈ V and α / ∈ V . As we have seen in Chapter 4, the properties of DEL-PAO still hold: all ∼ i are equivalence relations on

INTR and if V ∈ INTR, if V ∼ i V then V ∈ INTR.
For the dynamic part, we again do not have to deal with introspective consequences as we do not include the JS operator. Like in Chapter 4, valuations updates are simpler than in DEL-PAO:

V +α = V ∪ {α} V -α = V \ {α}
With our new set of atoms, we have seen that when V is introspective then both V +α and V -α are so, unless α is valid in INTR.

Truth conditions are as follows:

V |= α iff α ∈ V V |= ¬ϕ iff not (V |= ϕ) V |= ϕ ∧ ϕ iff V |= ϕ and V |= ϕ V |= K i ϕ iff V |= ϕ for every V such that V ∼ i V V |= [π]ϕ iff V |= ϕ for every V such that V R π V V |= 3 J ϕ iff there exist α 1 , . . . , α m ∈ ATM with m ≥ 0 such that for every 1 ≤ k ≤ m, there is i ∈ J such that C i α k ∈ V and V |= (+α 1 -α 1 ); . . . ; (+α m -α m ) ϕ
where R π is a binary relation on valuations defined by:

V R +α V iff V = V +α V R -α V iff V = V -α and α not valid in INTR V R π 1 ;π 2 V iff V (R π • R π )V V R π 1 π 2 V iff V (R π ∪ R π )V V R π * V iff V ( k∈N 0 (R π ) k )V V R ϕ? V iff V = V and V |= ϕ
Truth conditions are identical to DEL-PAO (see Section 2.2.5) for epistemic operators. For dynamic operators, the relation for assignments is simplified like in DEL-PAO S . The new operator 3 J is interpreted like in [START_REF] Herzig | A dynamic logic of normative systems[END_REF]: agents in J can make ϕ true while others do not act if there exists a sequence of assignments of variables they control that leads to a state where ϕ is satisfied. Remember that π ϕ reads "there exists an execution of π after which ϕ is true." 12 We suppose that the program becomes skip if m = 0, that is, agents in J can simply leave the world in its current state.

Introspective validity and plain validity are defined like in DEL-PAO (see Section 2.2.5).

Axiomatization

Our axiomatization will consist, like for DEL-PAO, in reduction axioms.

We axiomatize the richer language where the JS operator is included (along with common knowledge), since they are needed to characterize introspective valuations. In other words, we axiomatize the language of DEL-PAO with control atoms. In this language, valuation updates V +α and V -α are defined like in DEL-PAO (see Section 2.2.4). The semantics of the new operator 3 J is unchanged, but assignments may now concern atoms with JS operators.

Since their truth conditions were not modified, reduction axioms for knowledge operators (see Proposition 2.10 on page 44) and dynamic operators (see Proposition 2.11 on page 50) are still valid. We show how to reduce the strategic operator to a program.

Reduction of the strategic operator

In the vein of varyIfNotSeen(i, A) for epistemic operators defined in Section 2.4.2, we are going to define varyIfCtrl(J, A) which, as its name suggest, will vary the variables of A if the coalition J controls them.

Our truth condition for 3 J indicates that agents must control each variable initially, before the modification of any other variable. Since we can consider control over control of variables, this means that control may evolve and that we have to store its initial value, like we did for conditions of conditional effects in Chapter 4. We reuse the notion of storage variables, noted c, and the programs str(ϕ, c) = if ϕ then +c else -c, which stores the value of the formula ϕ into the storage variable c, and rst({c 1 , . . . , c m }) = -c 1 ; . . . ; -c m , which resets the value of a given set of storage variables.

Then, for a coalition of agents J and a set of atoms A = {α 1 , . . . , α m }, we define the program

varyIfCtrl(J, A) = str( i∈J C i α 1 , c 1 ); . . . ; str( i∈J C i α m , c m ); α k ∈A varyIf(c k , α k ) * ; rst(A),
where varyIf(c, α) = c?; (+α -α).

The programs first stores, for every variable α k in A, whether at least one agent in J controls α k . Then the program may vary each α k that was originally controlled, and this an undetermined number of times, generating all possible sequences of assignments of variables from A. We then reset the value of control variables so that, like in Chapter 4, they do not interfere with following executions. Proposition 5.1. Let V ∈ 2 ATM be a valuation that does not contain any storage variable, J a set of agents and ϕ a formula without modal operators. Then we have

V |= 3 J ϕ ↔ varyIfCtrl(J, ATM (ϕ)) ϕ.
Proof. We are going to compare the truth conditions associated to the modalities 3 J ϕ and varyIfNotSeen(i, ATM (ϕ)) ϕ. Take an arbitrary valuation V ∈ 2 ATM :

V |= 3 J ϕ iff there exist α 1 , . . . , α m ∈ ATM such that for every 1 ≤ k ≤ m, there exists i ∈ J such that C i α k ∈ V, and

V |= (+α 1 -α 1 ); . . . ; (+α m -α m ) ϕ,
that is:

V |= 3 J ϕ iff there exist α 1 , . . . , α m ∈ ATM such that for every 1 ≤ k ≤ m, V |= i∈J C i α k , and
V |= (+α 1 -α 1 ); . . . ; (+α m -α m ) ϕ,
i.e.:

V |= 3 J ϕ iff there exist α 1 , . . . , α m ∈ ATM and U 0 , . . . , U m , V ∈ 2 ATM such that

V = U 0 , V = U m , and for every 1 ≤ k ≤ m, V |= i∈J C i α k and U k-1 R +α k -α k U k , and
V |= ϕ.
By Proposition 2.9 on page 38, we know that we can restrict atoms to the ones appearing in ϕ. Thus we have:

V |= 3 J ϕ iff there exist α 1 , . . . , α m ∈ ATM (ϕ) and U 0 , . . . , U m , V ∈ 2 ATM such that

V = U 0 , V = U m , and for every 1 ≤ k ≤ m, V |= i∈J C i α k and U k-1 R +α k -α k U k , and
V |= ϕ.
On the other hand:

V |= varyIfCtrl(J, ATM (ϕ)) ϕ iff there exist V 1 , V 2 , V ∈ 2 ATM such that V R str( i∈J C i α 1 ,c 1 );...;str( i∈J C i αm,cm) V 1 , and V 1 R α ∈ATM (ϕ) varyIf(c ,α ) * V 2 , and
V 2 R rst(ATM (ϕ)) V , and

V |= ϕ.
Similarly to the proof of Proposition 4.7 on page 99, we define

C |= = {c : α ∈ ATM (ϕ) and V |= i∈J C i α } C |= = {c : α ∈ ATM (ϕ) and V |= i∈J C i α } C = {c : α ∈ ATM (ϕ)} Obviously C |= ∪ C |= = C.
We obtain:

V |= varyIfCtrl(J, ATM (ϕ)) ϕ iff there exist V 1 , V 2 , V ∈ 2 ATM such that V 1 = (V \ C |= ) ∪ C |= , and V 1 R α ∈ATM (ϕ) varyIf(c ,α ) * V 2 , and V = V 2 \ C, and
V |= ϕ,
that is:

V |= varyIfCtrl(J, ATM (ϕ)) ϕ iff there exist V 1 , V 2 , V ∈ 2 ATM such that V 1 = (V \ C |= ) ∪ C |= , and there exist U 0 , . . . , U m ∈ 2 ATM such that V 1 = U 0 , V 2 = U m , and for every 1 ≤ k ≤ m, U k-1 R α ∈ATM (ϕ) varyIf(c ,α ) U k , and V = V 2 \ C, and V |= ϕ, i.e.: V |= varyIfCtrl(J, ATM (ϕ)) ϕ iff there exist V 1 , V 2 , V ∈ 2 ATM such that V 1 = (V \ C |= ) ∪ C |= ,
and there exist α 1 , . . . , α m ∈ ATM (ϕ) and U 0 , . . . , U m ∈ 2 ATM such that

V 1 = U 0 , V 2 = U m , and for every 1 ≤ k ≤ m, U k-1 R varyIf(c k ,α k ) U k , and
V = V 2 \ C, and
V |= ϕ.
which becomes, when decomposing varyIf(c k , α k ):

V |= varyIfCtrl(J, ATM (ϕ)) ϕ iff there exist V 1 , V 2 , V ∈ 2 ATM such that V 1 = (V \ C |= ) ∪ C |= ,
and there exist α 1 , . . . , α m ∈ ATM (ϕ) and U 0 , . . . , U m ∈ 2 ATM such that

V 1 = U 0 , V 2 = U m , and for every 1 ≤ k ≤ m, U k-1 |= c k and U k-1 R +α k -α k U k , and
V = V 2 \ C, and
V |= ϕ.
We are getting close to the truth condition of 3 J ϕ, with additional modifications of storage variables.

As we have seen in the proof of Proposition 4.7 on page 99, only storage variables are modified between V and V 1 , where each c k takes the value of i∈J C i α k . Afterwards, during the execution of varyIf(c , α ), the value of storage variables is not modified. Therefore saying

U k-1 |= c k is like V |= i∈J C i α k .
Finally, all storage variables, which by definition, do not appear in ϕ, are removed.

Therefore V |= 3 J ϕ ↔ varyIfCtrl(J, ATM (ϕ)) ϕ.

Soundness and completeness

The rule of replacement of equivalents still preserves plain validity.

Proposition 5.2. Let ϕ be obtained from ϕ by replacing some occurrence of ψ in ϕ by ψ . If ψ ↔ ψ is plainly valid then ϕ ↔ ϕ is plainly valid.

Proof. This is due to the fact that, along with the ones for K i and [π] (see Proposition 2.12 on page 52) the following rule of inference for 3 J :

ϕ ↔ ϕ 3 J ϕ ↔ 3 J ϕ
preserves plain validity.

Theorem 5.1. For every DEL-PAOC formula ϕ there exists a formula without modal operators ϕ such that ϕ ↔ ϕ is plainly valid.

Proof. We extend Procedure 2.1 on page 52 to strategic operators.

Procedure 5.1. While there is a modal operator in ϕ:

1. if there is a sub-formula K i ϕ or [π]ϕ such that ϕ does not contain modal operators, apply Procedure 2.1;

2. if there is a sub-formula 3 J ϕ such that ϕ does not contain modal operators, replace 3 J ϕ by varyIfCtrl(J, ATM (ϕ )) ϕ , according to Proposition 5.1.

So by iterating elimination of innermost modal operators we obtain a formula without modal operators. These transformations are possible thanks to the rule of replacement of equivalents that preserves plain validity.

The axiomatization of DEL-PAOC is given by:

• the axioms of DEL-PAO given in Section 2.3;

• the reduction axiom for strategic operators given in Proposition 5.1.

Epistemic boolean games

In this section, we show how to express that a given strategy is a Nash equilibrium and whether a Nash equilibrium exists in an epistemic boolean game within DEL-PAOC.

Epistemic boolean games in DEL-PAOC

We define ATM OBS S to be the subset of ATM which only visibility atoms:

ATM OBS S = {σ p : σ ∈ OBS S * , p ∈ Prop}.
Informally, ATM OBS S is exactly the set of atoms considered in Chapter 4, i.e., DEL-PAO atoms without joint visibility and without control.

An epistemic boolean game is a tuple

B = (Agt, ATM f OBS S , (Ψ i ) i∈Agt , (γ i ) i∈Agt ) where ATM f
OBS S is a finite subset of ATM OBS S , the sets (Ψ i ) i∈Agt (the sets of control) partition ATM f OBS S , and the formulas γ i (the goals) are such that RATM (γ i ) ⊆ ATM f OBS S . Remember that the relevant atoms of ϕ, introduced in Section 2.4.3 and noted RATM (ϕ), contains the atoms of ϕ plus visibility atoms related to epistemic operators appearing in ϕ (e.g., RATM (K i p) = {p, S i p}). This means that if γ j = K i p, then p but also S i p must belong to ATM f OBS S because both influence the truth value of γ j .

Strategies and introspection

Strategies of individuals and coalitions are defined like in the context of standard boolean games: s i ∈ 2 Ψ i and s J = i∈J s i . We however impose a constraint on strategy profiles s Agt : they must be introspective w.r.t.

ATM f

OBS S . We have seen in Section 2.4 that valuations introspective w.r.t. a specific set of atoms can be finite while being "introspective enough" for the model checking to work correctly. Without introspective consequences, the definition given in Section 2.4.1 reduces to: a valuation V is introspective w.r.t. to a set of atoms A if every introspectively valid atom from A belongs to V . Strategy profiles are sets of atoms and therefore are of the same nature as valuations. When requiring them to be introspective w.r.t. ATM f OBS S , we implicitly impose that every agent controlling an introspectively valid atom chooses to make it true; it appears like a reasonable condition.

Besides strategies, utilities over strategy profiles, best responses and Nash equilibria are defined exactly as in the context of standard boolean games (see Section 1.3.2). Remember that the utility of an agent is 1 if she reaches her goal, and 0 otherwise. not contain any control atom or strategic operator any more, hence by Proposition 2.9, this is equivalent to: for every α 1 , . . . , α m ∈ Ψ i , we have s Agt |= [(+α 1 -α 1 ); . . . ; (+α m -α m )]¬γ i , i.e., for every s Agt such that s Agt = ATM f OBS S \Ψ i s Agt , s Agt |= γ i .

In both cases, we have that s i is a best response to s Agt\{i} if and only if s Agt ∪ Ctrl |= 3 {i} γ i → γ i . The formula Nash generalizes this to the whole set of agents.

The following proposition provides a characterization in the logic DEL-PAOC of the existence of a Nash equilibrium in a certain epistemic boolean game.

, . . . , α k ∈ ATM f OBS S (with k ≤ m) such that Ctrl ∪ ATM f OBS S |INTR ∪ {α 1 , . . . , α k } |= Nash. ATM f
OBS S |INTR ∪ {α 1 , . . . , α k } can be viewed as a strategy for all agents which is, as required, introspective w.r.t. ATM f OBS S . In other words, there exists s Agt such that Ctrl ∪s Agt |= Nash, i.e., there exists a strategy s Agt such that s Agt is a Nash equilibrium by Proposition 5.4, that is, the game has at least one Nash equilibrium.

The preceding two propositions together with Theorem 5.3 about complexity of model checking for DEL-PAOC provide a complexity result both for the membership problem, described in Proposition 5.4, and for the existence problem, described in Proposition 5.5, of Nash equilibria in epistemic boolean games. Example 5.1. Suppose we have two agents 1 and 2 each of which knows a bit of information, respectively noted b 1 and b 2 , that the other agent does not know. Both 1 and 2 have the same goal: 1 wants 2 to know her secret only if 1 knows the secret of 2, and similarly for 2. Each agent can change her secret, and can either talk or keep quiet; in other words, each agent has control on her bit and on the other agent's visibility of her bit.

We define B b = (Agt, ATM f OBS S , (Ψ i ) i∈Agt , (γ i ) i∈Agt ) where:

• Agt = {1, 2};

• ATM f OBS S = {b 1 , b 2 , S 2 b 1 , S 1 b 2 }; • Ψ 1 = {b 1 , S 2 b 1 } and Ψ 2 = {b 2 , S 1 b 2 }; • γ 1 = γ 2 = (K 1 b 2 ∨ K 1 ¬b 2 ) ↔ (K 2 b 1 ∨ K 2 ¬b 1 ).
Two interesting Nash equilibria are the following. Either they both share their secrets: s Agt = {b 1 , b 2 , S 2 b 1 , S 1 b 2 }; or they both remain silent:

s Agt = {b 1 , b 2 }. Indeed, with Ctrl = {C 1 b 1 , C 2 b 2 , C 1 S 2 b 1 , C 2 S 1 b 2 }, we have: {b 1 , b 2 , S 2 b 1 , S 1 b 2 } ∪ Ctrl |= (3 {1} γ 1 → γ 1 ) ∧ (3 {2} γ 2 → γ 2 ) {b 1 , b 2 } ∪ Ctrl |= (3 {1} γ 1 → γ 1 ) ∧ (3 {2} γ 2 → γ 2 )
Intuitively, each agent can only modify the other agent's visibility of her secret; if only one of them changes her strategy then it will break the equivalence of the goal.

Observe that we omit other Nash equilibria such as {b 1 , S 2 b 1 , S 1 b 2 } or {b 2 }, where the values of b i is modified. It actually suffices that S 2 b 1 and S 1 b 2 are either both true or both false to obtain a Nash equilibrium.

Relationship between exclusive control and visibility

We have seen that we did not include the joint visibility operator JS in the language of DEL-PAOC. This would indeed lead to problems with exclusive control, that is required in boolean games, because of introspective causes and consequences. 13For example, suppose agent 1 controls JS p, and that agent 2 controls S i p. It seems that exclusive control is ensured; however if 1 makes JS p true, then an infinite number of other atoms, including S i p, will become true. Therefore the control on S i p is actually not exclusive. The other way round, if 2 makes S i p false, then JS p will also become false. It is interesting to note that 1 does not have a "full control" on S i p: she can only make it true. Similarly, 2 can only make JS p false.

A way to solve this issue would be to define constraints on atoms of control, like introspective constraints defined in Section 2.2.1:

S i S i α JS JS α JS S i S i α JS α → S i α JS α → JS S i α
New constraints would define a new set of introspective valuations INTR where, for example, no agent can control an introspectively valid atom such as σ S i S i α with σ ∈ OBS * or σ JS α with σ ∈ OBS + . This would require at least constraints of the form:

¬C j S i S i α ¬C j JS JS α ¬C j JS S i S i α
Yet these are not sufficient to ensure ¬C j σ S i S i α for every σ ∈ OBS * and ¬C j σ JS α for every σ ∈ OBS + . We also need to "generate" every sequence σ using the JS operator. However, the constraints:

¬C j JS α → ¬C j S i α ¬C j JS α → ¬C j JS S i α
echoing the last two introspective constraints, are intuitively too strong: an agent should be able to make individual visibility true without controlling joint attention.

As observed in the previous paragraph, we might consider a more subtle notion of control, with positive and negative control over variables: C + i α means that i can only make α true; C - i α means that i can only make α false. Then C i α is a shortcut for C + i α ∧ C - i α. Our constraints become:

¬C - j S i S i α ¬C - j JS JS α ¬C - j JS S i S i α ¬C - j JS α → ¬C - j S i α ¬C - j JS α → ¬C - j JS S i α or if we rewrite the last two: C - j S i α → C - j JS α C - j JS S i α → C - j JS α
This seems to be more intuitive: if one can make individual visibility false, then she can make joint visibility false. From this we can derive: if C - j α ∈ V and β ⇒ I α, then C - j β ∈ V, that is, if agent j negatively controls α, then she also negatively controls all its introspective causes. Then the constraints that come to mind for positive control are:

C + j JS α → C + j S i α C + j JS α → C + j JS S i α implying that: if C + j α ∈ V and α ⇒ I β, then C + j β ∈ V.
This set of constraints seems acceptable, however it remains to ensure that if V follows all of them, then every V such that V ∼ i V or V ∼ Agt V also follows them, which is not the case right now. Another work to be done is to tune the relation R π of programs so that it also does not exit the new set of introspective valuations. These were the hardest part when defining the introspective constraints in DEL-PAO; it is plausible that with an extended set of constraints, this task becomes much more challenging.

This might be rewarding however, as with such constraints we may also impose further relations between control and visibility, such as the requirement "control implies visibility":

C i α → S i α
or knowledge of control:

S i C i α.

Conclusion

We have studied an extension of DEL-PAO with control in which one can deduce strategic abilities of coalitions of agents. It accounts for concepts from boolean games such as the existence of a Nash equilibrium that can be extended to epistemic boolean games in a straightforward way.

As the model checking of the DEL-PAOC is PSPACE-complete, it follows that the membership problem and existence problem of a Nash equilibria in epistemic boolean games are both in PSPACE. Agents can now modify the visibility conditions of propositional variables, including higher-order visibility. In the previous work of Ågotnes et al., agents can only affect the truth value of propositional variables and, indirectly, the knowledge of those agents' who can see the truth value of these variables; but agents cannot modify the visibility conditions of propositional variables. In other words, visibility conditions remain static, whereas in our framework, they can change. It remains to establish the lower bound.

Adding public announcements and programs

Another main drawback of visibility-based epistemic logics, including DEL-PAO, is that the epistemic operators may distribute over disjunctions:

K i (p ∨ q) → (K i p ∨ K i q) is valid.
This is annoying because it does not allow us to model things such as the muddy children puzzle (where each child knows that one of the children is muddy without knowing which). In the present chapter, we propose a solution to this problem.

Following [START_REF] Castelfranchi | Guarantees for autonomy in cognitive agent architecture[END_REF][START_REF] Van Linder | Seeing is believing: and so are hearing and jumping[END_REF], we observe that an agent's knowledge may originate from three processes: observation, communication, and inference. We do not consider knowledge obtained via inference and assume that agents are omniscient. We therefore do not model formation of knowledge via (time-consuming) application of inference rules and leave it to future work to integrate existing logics of time-bounded reasoning [START_REF] Alechina | A complete and decidable logic for resource-bounded agents[END_REF][START_REF] Grant | A logic for characterizing multiple bounded agents[END_REF][START_REF] Balbiani | A logical theory of belief dynamics for resource-bounded agents[END_REF]. While current observability-based approaches only account for the former, we here take into account the most basic form of communication modifying the agents' knowledge: public announcements. We do so by adding a public information state to the model, which is a set of valuations, as proposed in [START_REF] Lomuscio | Knowledge in multiagent systems: initial configurations and broadcast[END_REF][START_REF] Su | Model checking temporal logics of knowledge via OBDDs[END_REF] and recently used in [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF][START_REF] Van Benthem | Symbolic model checking for Dynamic Epistemic Logic[END_REF]. Public announcements make the public information state shrink just as in public announcement logic. We can then model that although no p-worlds nor q-worlds are accessible for i because the information state contains no such world, there is an accessible p∧q-world. This may be due to the announcement of p ∧ q, or to the announcement (in some order) of p and of q, or to the announcement (in some order) of p and of p → q, etc.

In this chapter, we view DEL-PAO programs as being executed publicly, thereby updating the public information state. Public announcements become a particular case of such programs: they are publicly executed tests.

We call this logic DEL-PAO-PP: Dynamic Epistemic Logic of Propositional Assignment and Observation with Public Programs.

Résumé du chapitre

Un autre inconvénient majeur des logiques épistémiques basées sur la visibilité, y compris DEL-PAO, est que les opérateurs épistémiques peuvent distribuer sur les disjonctions : K i (p ∨ q) → (K i p ∨ K i q) est valide. Ceci est gênant, car cela nous empêche de modéliser les problèmes comme celui des enfants sales (où chaque enfant sait que l'un des enfants est boueux sans savoir qui). Dans ce chapitre, nous proposons une solution à ce problème.

En suivant [START_REF] Castelfranchi | Guarantees for autonomy in cognitive agent architecture[END_REF][START_REF] Van Linder | Seeing is believing: and so are hearing and jumping[END_REF], nous observons que la connaissance d'un agent peut provenir de trois processus : l'observation, la communication, et l'inférence. Nous ne considérons pas la connaissance obtenue par inférence et supposons que les agents sont omniscients. Alors que les approches actuelles basées sur l'observabilité ne prennent en compte que le premier processus, nous incluons ici la forme la plus basique de communication modifiant les connaissances des agents : les annonces publiques. Nous le faisons en ajoutant un état d'information au modèle, c'est-à-dire un ensemble de valuations, tel que proposé dans [START_REF] Lomuscio | Knowledge in multiagent systems: initial configurations and broadcast[END_REF][START_REF] Su | Model checking temporal logics of knowledge via OBDDs[END_REF] et récemment utilisé dans [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF][START_REF] Van Benthem | Symbolic model checking for Dynamic Epistemic Logic[END_REF]. Les annonces publiques font rétrécir l'état d'information, comme en logique des annonces publiques. Nous pouvons alors modéliser que même si aucun p-monde ni q-monde n'est accessible pour i car l'état d'information ne contient pas un tel monde, il existe un p∧q-monde accessible. Cela peut être dû à l'annonce de p ∧ q, ou bien à celle (dans un ordre quelconque) de p et de q, ou à celle (dans un ordre quelconque) de p et de p → q, etc.

Language of DEL-PAO-PP

Dans ce chapitre, nous considérons les programmes DEL-PAO comme étant exécutés publiquement, mettant ainsi à jour l'état d'information. Les annonces publiques deviennent un cas particulier de ces programmes : elles sont des tests exécutés publiquement.

Nous appelons cette nouvelle logique DEL-PAO-PP : une logique épistémique dynamique des affectations propositionnelles, de l'observation et du contrôle avec des programmes publics.

Language of DEL-PAO-PP

Remember that Prop is a countable non-empty set of propositional variables and and Agt is a finite non-empty set of agents. The set of observability operators OBS and atoms ATM is defined like in DEL-PAO:

OBS = {S i : i ∈ Agt} ∪ {JS } ATM = {σ p : σ ∈ OBS * , p ∈ Prop}
The language of programs and formulas of DEL-PAO-PP is defined by the following grammar:

π ::= +α | -α | (π; π) | (π π) | ϕ? ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | K i ϕ | CK ϕ | [π!]ϕ
where α ranges over ATM and i over Agt.

The language is therefore the one of DEL-PAO, except that programs are now executed publicly: we read [π!]ϕ as "ϕ will be true after the update of the current local and information states by π." As we shall see, the publicly performed test ϕ? behaves exactly as the public announcement of ϕ. Unlike in DEL-PAO, we do not include the Kleene star * to the language of (public) programs as it is not required in applications and complexity with it has to be decided. K i ϕ reads "ϕ is known by i" and CK ϕ reads "ϕ is common knowledge among all agents." Another difference with DEL-PAO in that, while S i still expresses sensor information, now K i expresses information coming from both sensors and communication.

The other boolean operators and dual epistemic operators abbreviate like in DEL-PAO (in the standard way). Moreover, π! ϕ ("there exists a public execution of π after which ϕ is true") abbreviates ¬[π!]¬ϕ. The set of atoms appearing in the formula ϕ and in the program π, noted ATM (ϕ) and ATM (π), are also defined like in DEL-PAO, with the addition of:

ATM ([π!]ϕ) = ATM (π) ∪ ATM (ϕ).
will be valid for n ≥ 2: each child is still ignorant about her muddiness after the announcement that one of them is muddy. Furthermore, the implications (Muddy ∧ Obs ∧ Ign) → i∈Agt m i ?! Ign?! k Ign will be valid for 0 ≤ k ≤ n-2 and n ≥ 2, where π! k is the iteration of π! , k times: the children keep on being ignorant about their state after n-2 rounds of the announcement of that ignorance.

It is important to note that, unlike in DEL-PAO, in DEL-PAO-PP the intended meaning of the formulas ¬K i m i ∧ ¬K i ¬m i and ¬S i m i is different: the former says that according to her information state, i is ignorant about m i , while the latter says that i does not observe m i . The status of the latter remains unchanged when the children gain new information via the public announcement of Ign. In contrast, the status of the former changes after n-1 announcements:

(Muddy ∧ Obs ∧ Ign) → i∈Agt m i ?! Ign?! n-1 i∈Agt K i m i and even (Muddy ∧ Obs ∧ Ign) → i∈Agt m i ?! Ign?! n-1 CK i∈Agt m i
will be valid: knowledge and even common knowledge of muddiness is achieved after n-1 rounds.

Semantics of DEL-PAO-PP

We interpret our formulas on pointed models. A pointed model is a couple U, w where:

• U ⊆ 2 ATM is the public information state, or simply information state. This set of worlds will evolve when programs are publicly executed. For example, the program ϕ? will make the public information state shrink so that only worlds satisfying ϕ are kept.

• w ∈ 2 ATM is a world, or valuation, or sometimes local state (in contrast to information state).

A valuation w of DEL-PAO-PP will behave like a valuation of DEL-PAO. In particular, we note INTR the set of worlds w where the five constraints (C1)-(C5) defined in Section 2.2.1 hold. We write them w to empathize that we do not necessarily consider all possible combinations of atoms from ATM any more, but only the ones from the public information state U . Our valuations hence become closer to standard Kripke "worlds." Accessibility relations for K i and CK are defined exactly like in DEL-PAO (see Section 2.2.3):

w ∼ i w iff S i α ∈ w implies w(α) = w (α) w ∼ Agt w iff JS α ∈ w implies w(α) = w (α)
where, again, with w(α) = w (α)

= {S 1 m 2 , S 2 m 1 } ∪ {α : α is valid in INTR} ∪ {σS i m j : σ ∈ OBS + , i, j ∈ {1, 2}}.
The last two lines ensure that w is introspective: the second adds all introspective validities and the third adds JS S i m j and all its introspective consequences. Then the four relevant introspective valuations are depicted in Figure 6.1, together with relations ∼ 1 and ∼ 2 . For the dynamic part, we reuse our notation for updates of valuations defined in Section 2.2.4:

w ∪ {m 1 } o o 2 / / O O 1 1,2 w ∪ {m 1 , m 2 } O O 1 1,2 w o o 2 / / 1,2 M M w ∪ {m 2 } 1,2 S S
w+α = w ∪ α ⇒ w-α = w \ α ⇐
where α ⇐ is the set of introspective causes of α and α ⇒ the set of its introspective consequences, defined like in DEL-PAO (see Section 2.2.1).

We extend it to a public information state U ⊆ 2 ATM :

U +α = {w+α : w ∈ U } U -α = {w-α : w ∈ U }
Again, Proposition 2.7 on page 37 ensures that when w is introspective then both w+α and w-α are so, too (unless α is valid in INTR). By definition, this is still obviously true for the information state: when U only contains introspective worlds then both U +α and U -α only contains introspective worlds, too (unless α is valid in INTR).

Truth conditions are as follows: For epistemic operators, truth conditions are similar to DEL-PAO's, but require the related world w to be in the public information state U . For the new dynamic operator, the relation P π includes the modification of the information state. This operator is therefore distinct from the dynamic operator [π] of DEL-PAO. Observe that tests make the information state shrink while assignments may shrink, but also transpose it.

U, w |= α iff α ∈ w U, w |= ¬ϕ iff not (U, w |= ϕ) U, w |= ϕ ∧ ϕ iff U, w |= ϕ and U, w |= ϕ U, w |= K i ϕ iff U, w |= ϕ for every w ∈ U such that w ∼ i w U, w |= CK ϕ iff U, w |= ϕ for every w ∈ U such that w ∼ Agt w U, w |= [π!]ϕ iff U ,

Example 6.3 (Two muddy children, continued). Remember that

Obs = (¬S 1 m 1 ∧ ¬S 2 m 2 ) ∧ (S 1 m 2 ∧ S 2 m 1 ) ∧ (JS S 1 m 1 ∧ JS S 1 m 2 ∧ JS S 2 m 1 ∧ JS S 2 m 2 ) and Ign = (¬K 1 m 1 ∧ ¬K 1 ¬m 1 ) ∧ (¬K 2 m 2 ∧ ¬K 2 ¬m 2 ). • π = χ?. If U, w |= χ,
S i α ∧ α → K i α S i α ∧ ¬α → K i ¬α
are still valid in the class of all pointed models (even non-epistemic ones). In contrast, the converse of the implication is now invalid. For example, imagine a public information state where p was publicly tested, i.e., publicly announced: U = {w ∈ 2 ATM : p ∈ w}. Then we have U, {p} |= K i p because in every world from the public information state, p is true, while U, {p} |= S i p since S i p is currently false.

Complexity of model checking

We define the relevant atoms of a DEL-PAO-PP formula ϕ like in DEL-PAO (see Section 2.4.3), as epistemic operators will reduce in the same way:

RATM (K i ϕ) = RATM (ϕ) ∪ {S i α : α ∈ RATM (ϕ)} RATM (CK ϕ) = RATM (ϕ) ∪ {JS α : α ∈ RATM (ϕ)}
and equal to ATM (ϕ) otherwise.

Then the model checking problem for DEL-PAO-PP is defined as follows:

• Input: a couple w ∩ RATM (ϕ), ϕ where ϕ is a DEL-PAO-PP formula and w is an introspective valuation;

• Output: yes if INTR, w |= ϕ, no otherwise.

Note that we do not consider the more general problem of checking a triple U, w, ϕ where U is a set of valuations. The reason is that the explicit representation of U may require exponential space in the size of w (that may be double-exponential in the length of ϕ). One might consider representing U by a boolean formula, as done in [START_REF] Lomuscio | Knowledge in multiagent systems: initial configurations and broadcast[END_REF][START_REF] Su | Model checking temporal logics of knowledge via OBDDs[END_REF][START_REF] Van Benthem | Symbolic model checking for Dynamic Epistemic Logic[END_REF]; however, one cannot represent the set of all introspective valuations INTR in that way.

Theorem 6.1. The DEL-PAO-PP model checking problem is PSPACEcomplete.

Proof. The model checking of DL-PA, which is a fragment of DEL-PAO-PP without visibility operators S i and JS and public information states was proven to be PSPACE-hard [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF]. This establishes the lower bound.

We will show in Chapter 7 that the problem is in PSPACE.

Properties of the public programs operator

In this section, we discuss a list of properties of the public programs operator [π!].

Expressing public announcement of formulas

Consider the operator [χ!] of public announcement of a formula χ as studied in dynamic epistemic logics [START_REF] Van Ditmarsch | Dynamic Epistemic Logic[END_REF]. In the present setting, its truth condition has to be formulated as follows:

U, w |= [χ!]ϕ iff U, w |= χ implies {u ∈ U : U, u |= χ}, w |= ϕ.
The set {u ∈ U : U, u |= χ} is called the relativisation of U to the extension of χ in U . Let us compare this to the public performance of tests: the relativisation of U to the extension of χ in U is nothing but the result of the public update of U by χ?. Indeed, U, w P χ? U , w is the case if and only if U, w |= χ and U is the restriction of U to the extension of χ in U . So [χ!]ϕ and [χ?!]ϕ have identical truth conditions.

Some reduction axioms

We could not find a complete axiomatization based on reduction axioms: as we have seen, the equivalences

K i α ↔ S i α ∧ α K i ¬α ↔ S i α ∧ ¬α
6.4. Properties of the public programs operator are not valid any more, preventing the reduction of the epistemic operators like in DEL-PAO. We will see in the next chapter that these operators can nevertheless be reduced to another kind of program that do not change the public information state when executed. However, these programs, while being useful for deciding the complexity, cannot be fully reduced and therefore are not sufficient to provide an axiomatization either. We discuss some valid and invalid equivalences.

The following equivalences reduce all programs to either atomic programs or public tests:

[π; π !]ϕ ↔ [π!][π !]ϕ [π π !]ϕ ↔ [π!]ϕ ∧ [π !]ϕ
The proofs given in Proposition 2.11 on page 50 still apply.

As to public tests, they can be reduced against boolean operators and the individual knowledge operator; the following equivalences are valid on introspective pointed models:

[χ?!]β ↔ ¬χ ∨ β [χ?!]¬ϕ ↔ ¬χ ∨ ¬[χ?!]ϕ [χ?!](ϕ ∧ ϕ ) ↔ [χ?!]ϕ ∧ [χ?!]ϕ [χ?!]K i ϕ ↔ ¬χ ∨ K i [χ?!]ϕ [χ?!]CK ϕ ↔ ¬χ ∨ CK [χ?!]ϕ
where β is an atom. Observe that these axioms are exactly the reduction axioms of public announcement logic PAL [START_REF] Wang | On axiomatizations of public announcement logic[END_REF]] plus an axiom for common knowledge that is due to the similarity between this operator and the individual knowledge operator. As we have seen, our public test has the same truth conditions as public announcements.

As to positive public assignments, they are deterministic and distribute over the boolean operators:

[+α!]β ↔ if α ⇒ I β β otherwise [+α!]¬ϕ ↔ ¬[+α!]ϕ [+α!](ϕ ∧ ϕ ) ↔ [+α!]ϕ ∧ [+α!]ϕ
are instances of the above PAL validity. Observe that Muddy ∧ Obs implies K 1 m 2 and K 2 m 1 while Ign implies ¬K 1 m 1 ∧ ¬K 1 ¬m 1 and ¬K 2 m 2 ∧ ¬K 2 ¬m 2 . Therefore:

(Muddy ∧ Obs ∧ Ign) → [m 1 ∨m 2 ?!]Ign.

Moreover:

Muddy → m 1 ∨m 2 ?! .

Putting the last two implications together we obtain:

(Muddy ∧ Obs ∧ Ign) → m 1 ∨m 2 ?! Ign.
Similarly, we can establish that

(Muddy ∧ Obs ∧ Ign) → m 1 ∨m 2 ?! Ign?! (K 1 m 1 ∧ K 2 m 2 )
is valid in introspective pointed models.

Conclusion

We have extended DEL-PAO in such a way that knowledge of agents is deduced from what they see and from what is publicly announced to them. We thereby solve the second issue of previous observability-based approaches: knowledge operators do not distribute over disjunction any more. This latter feature allows us to formalize the muddy children puzzle in a natural way.

Beyond public announcements, we can reason about publicly executed programs: public announcements are special cases of publicly executed tests. This allows us to formalize variants of the muddy children puzzle where the children e.g. clean their forehead [START_REF] Van Ditmarsch | Dynamic epistemic logic with assignment[END_REF]. The addition of public programs again comes without increasing the complexity as the model checking problem of DEL-PAO-PP is still PSPACE-complete. It however remains to find an axiomatization.

Complexity of model checking: upper bound

In this chapter, we prove that the model checking problem for all logics presented in this thesis-DEL-PAO in Chapter 2, DEL-PAO S in Chapter 4, DEL-PAOC in Chapter 5 and DEL-PAO-PP in Chapter 6-is in PSPACE. We do so by providing an algorithm for a language into which all formulas from every previous logic can be translated. This language includes publicly executed programs, used to encode DEL-PAO-PP programs, as well as "mental programs" that do not modify the public information state, allowing us to encode DEL-PAO programs.

To cover all languages, we provide semantics based on a public information state and a valuation (like in Chapter 6). However, public programs of DEL-PAO-PP modify the public information state and thus differ from programs presented in DEL-PAO, DEL-PAO S and DEL-PAOC. We have also seen in Chapter 2 and in Chapter 5 how to reduce epistemic and strategic operators to programs. Therefore it will be useful to include in our language both public programs and a new operator K π , where π will be a "mental program," i.e., will not modify the public information state. Such operators were introduced e.g. in [START_REF] Van Benthem | Logics of communication and change[END_REF][START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF][START_REF] Herzig | A poor man's epistemic logic based on propositional assignment and higher-order observation[END_REF]. Intuitively, [π!]ϕ is read "ϕ will be true after the public update of the current local and information states by π," while K π ϕ is read "ϕ will be true after the update of the current local state by π (keeping the current information state constant)." So at a given local state w and information state U , the public program operator [π!] updates both U and w; in contrast, the mental program operator K π keeps U constant and only updates w. The latter can be viewed as traversing the space of current epistemic possibilities.14

Résumé du chapitre

Dans ce chapitre, nous prouvons que le problème de vérification de modèle pour toutes les logiques présentées dans la thèse-DEL-PAO dans le chapitre 2, DEL-PAO S dans le chapitre 4, DEL-PAOC dans le chapitre 5 et DEL-PAO-PP dans le chapitre 6-est en PSPACE. Nous le faisons en fournissant un algorithme pour un langage dans lequel toutes les formules de toutes les précédentes logiques peuvent être traduites. Ce langage comprend des programmes exécutés publiquement, utilisés pour encoder les programmes de DEL-PAO-PP, ainsi que des "programmes mentaux" qui ne modifient pas l'état d'information, ce qui nous permet d'encoder des programmes de DEL-PAO.

Pour couvrir tous les langages, nous fournissons une sémantique s'appuyant sur un état d'information et une valuation (comme dans le chapitre 6). Toutefois, les programmes publics de DEL-PAO-PP modifient l'état d'information et diffèrent donc des programmes présentés dans DEL-PAO, DEL-PAO S et DEL-PAOC. Nous avons également vu dans le chapitre 2 et dans le chapitre 5 comment réduire les opérateurs épistémiques et stratégiques à ces programmes. Par conséquent, il sera utile d'inclure dans notre langage à la fois les programmes publics et un nouvel opérateur K π , où π sera un "programme mental", c'est-à-dire, qui ne modifiera pas l'état d'information. Ces opérateurs ont été introduits par in order to include properly all presented logics: the Kleene star has been added and translations from every language, along with proofs of correctness, have been added. The model checking algorithms remain unchanged (apart from the star that was included, following [START_REF] Charrier | Public announcements with mental programs: relevance and computational complexity[END_REF]).

exemple dans [START_REF] Van Benthem | Logics of communication and change[END_REF][START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF][START_REF] Herzig | A poor man's epistemic logic based on propositional assignment and higher-order observation[END_REF]. Intuitivement, [π!]ϕ est lu "ϕ sera vrai après la mise à jour des états local et d'information actuels par π", tandis que K π ϕ est lu "ϕ sera vrai après la mise à jour de l'état local actuel par π (en gardant l'état d'information courant constant)". Donc, étant donnés un état local w et un état d'information U , l'opérateur de programme public [π!] met à jour à la fois U et w, alors que l'opérateur de programme mental K π garde U constant et met seulement à jour w. Ce dernier peut être vu comme traversant l'espace des possibilités épistémiques actuelles.

Nous appelons cette logique DL-PA-PMP : une logique dynamique des affectations propositionnelles avec des programmes publics et mentaux.

DL-PA-PMP: DL-PA with public and mental programs

To show that the problem is in PSPACE, we adapt the alternating algorithm in [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF], originally designed for a variant of a dynamic logic with propositional assignments, public announcements and arbitrary public announcements. Here we consider another, novel variant without arbitrary public announcements but with public programs: DL-PA-PMP.

Language of DL-PA-PMP

Remember that Prop is a countable non-empty set of propositional variables and and Agt is a finite non-empty set of agents.

The set of visibility operators OBS is defined like in DEL-PAO:

OBS = {S i : i ∈ Agt} ∪ {JS }.
We also include the set of control operators CTRL from DEL-PAOC:

CTRL = {C i : i ∈ Agt},
so that atoms are about both visibility and control:

ATM = {σ p : σ ∈ (OBS ∪ CTRL) * , p ∈ Prop}.
Then the syntax of DL-PA-PMP is defined by the following grammar:

π p ::= α← | α←⊥ | (π p ; π p ) | (π p π p ) | ϕ? π m ::= α← | α←⊥ | (π m ; π m ) | (π m π m ) | π m * | ϕ? ϕ ::= α | ¬ϕ | (ϕ ∧ ϕ) | [π p !]ϕ | K πm ϕ
where α ranges over ATM . Unlike in previous logics, here assignments are noted α← and α←⊥ to highlight that they are different from our previous +α and -α. Indeed, even if we include joint visibility operators JS , we will see that their semantics do not take introspective consequences and introspectively valid atoms into account.

The other boolean operators abbreviate as usual, in the standard way. The set of atoms appearing in the formula ϕ and in the program π, noted ATM (ϕ) and ATM (π), are also defined like in DEL-PAO for boolean operators. Moreover:

ATM ([π p !]ϕ) = ATM (π p ) ∪ ATM (ϕ) ATM (K πm ϕ) = ATM (π m ) ∪ ATM (ϕ)
The language of DL-PA-PMP is slightly different from the one presented in [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF]; here, we:

• consider general programs [π p !]ϕ instead of only public announcements;

• drop arbitrary public announcements;

• include the Kleene star in mental programs.

This implies that the model checking procedure will have to consider general publicly executed programs and the Kleene star. The latter is however included in an extended version of [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF]] that can be found in [START_REF] Charrier | Public announcements with mental programs: relevance and computational complexity[END_REF].

Semantics of DL-PA-PMP

Formulas are interpreted on pointed models U, w (see Section 6.2): public programs will modify the public information state while mental programs will not. The latter will allow us to simulate DEL-PAO programs within the framework of DL-PA-PMP.

As we have mentioned, assignments do not take into account introspective consequences even with JS operators, so that a finite number of atoms is modified; it is the translation of other logics formulas into DL-PA-PMP that will deal with consequences. We define:

π;π U , w iff U, w (M π • M π ) U , w U, w M π π U , w iff U, w (M π ∪ M π ) U , w U, w M π * U , w iff U, w ( k∈N 0 (M π ) k ) U , w U, w M χ? U , w iff U = U, w = w and U, w |= χ
Observe that mental programs indeed do not change the public information state: when U, w M π U , w then U = U . However, the execution of mental programs may exit the information state. To see this, take as an example U = {w ∈ 2 ATM : p / ∈ w}, i.e., the set of valuations where p is false. M p← relates the pointed model U, ∅ to the model U, {p} , but {p} / ∈ U . As we will translate DEL-PAO-PP's epistemic operators, that depend on the information state, into mental programs, we impose that truth condition for K π requires w ∈ U : valuations outside the U will not be taken into account.

Note also that unlike in all other semantics presented in this thesis, introspectively valid atoms can be removed by the public or mental execution of α←⊥. Like introspective consequences, the translation into DL-PA-PMP will have to deal with them.

• ϕ is boolean. In this case, tr fml A (ϕ ) = ϕ . Then V |= DEL-PAO ϕ is equivalent to V ∩ A |= DEL-PAO ϕ by Proposition 2.9 on page 38, which is equivalent to U, V ∩ A |= DL-PA-PMP ϕ for any public information state U since the truth conditions for boolean formulas are identical in DEL-PAO and in DL-PA-PMP and only depend on the local state. In particular,

INTR| A , V ∩ A |= DL-PA-PMP ϕ . • ϕ = [+α]ψ. Then we have tr fml A (ϕ ) = K β 1 ← ;...;βm← tr fml A (ψ) with {β 1 , . . . , β m } = α ⇒ ∩ A. Hence: INTR| A , V ∩ A |= DL-PA-PMP K β 1 ← ;...;βm← tr fml A (ψ) ⇔ INTR| A , (V ∩ A) ∪ (α ⇒ ∩ A) |= DL-PA-PMP tr fml A (ψ) ⇔ INTR| A , (V ∪ α ⇒ ) ∩ A |= DL-PA-PMP tr fml A (ψ) ⇔ V ∪ α ⇒ |= DEL-PAO ψ (by induction hypothesis) ⇔ V |= DEL-PAO [+α]ψ. • ϕ = [-α]ψ.
The proof is obvious if α is introspectively valid (as it translates to fail ) and similar to the case ϕ = [+α]ψ otherwise.

Therefore the translation is correct.

This settles the case of DEL-PAO. The properties of other logics are slightly different due to their respective operators and semantics, but we will see that the method is the same.

From DEL-PAO S

Observe that DEL-PAO S is a fragment of DEL-PAOC: neither of them consider the operator of joint visibility JS or common knowledge, and their semantics are strictly identical for boolean, epistemic and dynamic operators; DEL-PAOC simply further includes the strategic operator 3 J . Therefore we do not detail any procedure for DEL-PAO S , as it is completely identical to the one for DEL-PAOC, without the reduction of strategic operators at the beginning.

From DEL-PAOC

Take a DEL-PAOC formula ϕ. We define the following procedure of translation of ϕ into DL-PA-PMP. Procedure 7.2.

1. eliminate all epistemic operators K i and strategic operators 3 J from ϕ using Procedure 5.1 on page 121; call the resulting formula ϕ ;

2. translate ϕ into the DL-PA-PMP formula tr fml (ϕ ) according to the following definition:

tr fml (α) = α tr fml (¬ϕ) = ¬tr fml (ϕ) tr fml (ϕ 1 ∧ ϕ 2 ) = tr fml (ϕ 1 ) ∧ tr fml (ϕ 2 ) tr fml ([π]ϕ) = K tr prg (π) tr fml (ϕ)
where tr prg (π) is defined as:

tr prg (+α) = α← tr prg (-α) = fail if α valid in INTR α←⊥ otherwise tr prg (π 1 ; π 2 ) = tr prg (π 1 ); tr prg (π 2 ) tr prg (π 1 π 2 ) = tr prg (π 1 ) tr prg (π 2 ) tr prg (π * ) = tr prg (π) *
tr prg (χ?) = tr fml (χ)?

Observe that we do not need to keep the set of atoms of ϕ in this case, as we do not have to deal with introspective causes and consequences in assignments. We note tr DEL-PAOC (ϕ) the formula obtained after applying Procedure 7.2 to ϕ. Proof. We prove it by induction on the form of π.

• π = +α. In this case, tr prg (π) = α← . Hence by the truth con-

ditions of DL-PA-PMP, w = (w ∩ A) ∪ {α} = (w ∪ {α}) ∩ A since α ∈ A (because ATM (π) ⊆ ATM ). Since w ∈ INTR, we have seen in DEL-PAOC that w ∪ {α} ∈ INTR, hence (w ∪ {α}) ∩ A ∈ INTR| A .
• π = -α. If α is valid in INTR, tr prg (-α) = fail and the property is trivially valid. Otherwise, the proof is similar to the case π = +α.

• The proofs for π = π 1 ; π 2 , π = π 1 π 2 and π = χ? are similar to their cases in the proof of Lemma 7.1 as their truth conditions are identical to DEL-PAO's.

In all cases we have w ∈ INTR| A .

This counterpart of Lemma 7.1 indicates that, again, the execution of mental programs cannot exit the public information state in models that interest us. Remember that relevant atoms of DEL-PAOC also include control atoms that are "hidden" in strategic operators.

Proof. The proof follows the lines of Proposition 7.2 from the previous section: we first remove epistemic and strategic operators from ϕ and obtain a formula ϕ , equivalent to ϕ by Proposition 5.1 on page 118 and such that RATM (ϕ) = ATM (ϕ ). Then we apply validities (Red ; ), (Red ), (Red * ) and (Red ? ) of Proposition 2.11 on page 50 to ϕ , getting ϕ , and equivalences of Proposition 7.3 to its translation tr fml (ϕ ), obtaining tr fml (ϕ ) like in the previous setting. We again need to prove that V |= DEL-PAOC ϕ if and only if INTR| A , V ∩ A |= DL-PA-PMP tr fml (ϕ ), with A = ATM (ϕ ). We again do it by induction on the form of ϕ .

• The case when ϕ is boolean is the same as for Proposition 7.2 (because the translation is still homomorphic).

• ϕ = [+α]ψ. This time we have tr fml (ϕ ) = K α← tr fml (ψ). Observe that α ∈ A. Hence: Observe that unlike in Procedure 7.1 for DEL-PAO and in Procedure 7.2 for DEL-PAOC, we use RATM (ϕ) instead of ATM (ϕ ) (with ϕ the formula resulting from eliminating epistemic operators from ϕ) as epistemic operators have not be eliminated yet. This is however equivalent, as we have seen that RATM (ϕ) = ATM (ϕ ) in previous cases. We simulate epistemic operators with our programs varyIfNotSeen(., .) on the relevant atoms of the nested formula as it may contain other epistemic operators; then we translate these programs so that assignments behave correctly. This translation is identical for public programs (and is the same as previous translations of DEL-PAO and DEL-PAOC programs). We do not include the star since it does not appear in varyIfNotSeen(i, A) and varyIfNotSeen(Agt, A). We note tr DEL-PAO-PP (ϕ) the formula obtained after applying Procedure 7.3 to ϕ.

We verify that epistemic operators are indeed equivalent to their mentally executed programs counterparts. Proof. We only examine the first case as the case of common knowledge is similar.

Observe that since ϕ is boolean, RATM (ϕ) = ATM (ϕ). We have seen in the proof of Proposition 2.17 on page 59 that varyIfNotSeen(i, ATM (ϕ)) correctly simulates the epistemic operator on valuations that are introspective enough (which is the case of w ∩ A since RATM (K i ϕ) ⊆ A). However, we are now also dealing with public information states.

According to the semantics of mental programs of DL-PA-PMP, we only take into account worlds related by M tr prg A (varyIfNotSeen(i,ATM (ϕ))) that are in the public information state U | A . This is important when simulating epistemic operators as their truth conditions in DEL-PAO-PP specify that we only keep worlds related by ∼ i that are in U (which is the main purpose of the public information state).

Take an atom α ∈ ATM (ϕ).

• If S i α ∈ w, then w(α) = u(α) for every u such that w ∼ i u, hence for every u ∈ U such that w ∼ i u. This moreover implies that S i α ∈ w ∩ A as α ∈ A (since RATM (K i ϕ) ⊆ A). As varyIfNotSeen(i, ATM (ϕ)) behaves like K i , we have that w(α) = u (α) for every u such that w ∩ AM tr prg A (varyIfNotSeen(i,ATM (ϕ))) u , and thus for every u ∈ U | A such that w∩AM tr prg A (varyIfNotSeen(i,ATM (ϕ))) u .

• Now suppose S i α / ∈ w. We distinguish three cases depending on the public information state.

-Suppose α is true in the information state, i.e., α ∈ v for every v ∈ U . Then of course, α ∈ u for every u ∈ U such that w ∼ i u.

Our hypothesis also implies that α ∈ v for every v ∈ U | A , as α ∈ A. Therefore α ∈ u for every u ∈ U | A such that w ∩ AM tr prg A (varyIfNotSeen(i,ATM (ϕ))) u . -Now suppose α / ∈ v for every v ∈ U . This case is similar to the previous one: this implies that α / ∈ v for every v ∈ U | A , and thus α is always false in all valuations related by ∼ i or by M tr prg A (varyIfNotSeen(i,ATM (ϕ))) . -Finally, suppose α ∈ v 1 for some v 1 ∈ U and α / ∈ v 2 for some v 2 ∈ U . This implies that α ∈ v 1 for some v 1 ∈ U | A and α / ∈ v 2 for some v 2 ∈ U | A . Since they behave in the same way, and because w and w∩A agree on atoms from A and thus on atoms from ATM (ϕ), we know that if w ∼ i v 1 for some v 1 ∈ U such that α ∈ v 1 , then w ∩ AM tr prg A (varyIfNotSeen(i,ATM (ϕ))) v 1 for some v 1 ∈ U | A such that α ∈ v 1 , and that if w ∼ i v 2 for some v 2 ∈ U such that α / ∈ v 2 , then w ∩ AM tr prg A (varyIfNotSeen(i,ATM (ϕ))) v 2 for some v 2 ∈ U | A such that α / ∈ v 2 ; and conversely.

In all cases, if one relation leads to a world within the public information state where α is true, then the other can lead to a world within the information state where α is true; if one relation leads to a world within the information state where α is false, then the other can lead to a world within the information state where α is false. Therefore K i ϕ and K tr prg A (varyIfNotSeen(i,ATM (ϕ))) ϕ are still equivalent on the given models.

Like in previous sections for mental programs, here we study the properties of public programs. Proposition 7.6. Let A ⊆ ATM be a set of atoms. Let U be a public information state such that U ⊆ INTR| A and w ∈ U a valuation. Then reduction of epistemic and strategic operators. However, the size of w ∩ ATM (ϕ ), ϕ is polynomial in the size of w ∩ RATM (ϕ), ϕ . Therefore we have a polynomial reduction from the model checking of our logics to the model checking of DL-PA-PMP. Algorithms 7.1,7.2,7.3 and 7.4 are adapted from [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF], and Algorithm 7.5 is from [START_REF] Charrier | Public announcements with mental programs: relevance and computational complexity[END_REF].

The set of valuations INTR| ATM (ϕ) is fixed in the beginning: we write it INTR 0 in the following procedures. Remember that INTR 0 is a finite set of finite valuations, as ATM (ϕ) is finite.

The procedures are alternating, meaning that existential and universal choices are performed. For instance, the instruction "(∀) (∀) (∀) choose w ∈ U " succeeds if every choice of w leads to the accepting state. We also quantify over choices of sub-procedures: for instance, "(∃) (∃) (∃) algo 1 or algo 2 " means that at least one of the calls algo 1 or algo 2 must succeed. More precisely, (∀) (∀) (∀)algo 1 and algo 2 is an abbreviation for:

(∀) (∀) (∀) choose i ∈ {1, 2} if i = 1:
algo 1 else: algo 2 and similarly for (∃) (∃) (∃)algo 1 or algo 2 . Observe that in each case, either algo 1 or algo 2 is executed, but not both.

• Algorithm 7.1 describes mc(w, ϕ), the main model checking procedure for DL-PA-PMP.

-Parameters: a finite valuation w and a DL-PA-PMP formula ϕ.

-Behaviour: calls the procedure mc yes with an empty list and accepts the input if mc yes does not reject it.

• Algorithm 7.2 describes mc yes (L, w, ϕ), the model checking subprocedure.

-Parameters: a list of announcements and assignments L, a finite valuation w and a DL-PA-PMP formula ϕ.

-Behaviour: verifies the formula ϕ depending on its form. The surviving set of valuations is represented by L, a list of announcements and assignments. (For this reason the set ) Making an assignment or a public test recursively calls mc yes with the new assignment or test (if it passes) appended to L. Then evaluating K πm ψ means finding a valuation w related to w by π m that is in the public information state, described by L, and where ψ is verified.

• Algorithm 7.3 describes survives yes (L, w), the procedure checking whether a valuation survives announcements and tests made.

-Parameters: a list of announcements and assignments L and a finite valuation w.

-Behaviour: checks whether w satisfies every public assignment and test made until now. The procedure unstacks the list L and verifies that tested formulas are satisfied and atoms assigned to true or false are indeed true or false. Whenever the list is not empty, the procedure calls itself with every valuation possible before the effect of the assignment or the test.

• Algorithm 7.4 describes ispath yes (L, w, w , π m ), the path searching procedure for mental programs.

-Parameters: a list of announcements and assignments L, two finite valuations w and w and a DL-PA-PMP mental program π m .

-Behaviour: checks whether there is a π m -path from w to w , depending on the form of π m . The list L is specifically required in the case of the test, where the procedure calls mc yes . When π m = π m * we have seen with Axiom (Red * ) of Proposition 2.11 on page 50 that it actually suffices to repeat the program at most 2 2|ATM (πm )| times.

• Algorithm 7.5 describes iter yes (L, w, w , π m , i), the program iterating procedure.

-Parameters: a list of announcements and assignments L, two finite valuations w and w , a DL-PA-PMP mental program π m and an integer i ≥ 0.

-Behaviour: checks whether w is reachable from w by repeating π m i times. If i is even, we recursively call iter yes , dividing i in two; if i is odd, we execute the program once to reduce to a case where i is even.

We implicitly define the dual of mc yes , called mc no , by replacing and by or , (∀) (∀) (∀) by (∃) (∃) (∃), mc yes by mc no , etc., in the pseudo-code of mc yes . While mc yes reads "reject if L, w does not satisfy ϕ," its dual mc no reads "reject

Conclusion and perspectives

This thesis follows recent works in epistemic logic which study how knowledge can be constructed using information on visibilities of agents over variables. Observability-based logics offer a nice alternative to standard semantics, but come with the two main drawbacks that we identified. We proposed solutions to both issues by encoding visibility information with special "visibility atoms" of unbounded depth instead of sets of propositional variables and by including communication in terms of publicly executed programs. We moreover introduced a "joint visibility" operator to build common knowledge and control atoms that allow us to discuss strategic abilities of agents.

It is notable that the addition of higher-order observability and of joint observability, and also of strategic operators and publicly executed programs, comes without supplementary cost for model checking, which stays PSPACE-complete. We have seen that its definition is however not direct as it requires to transform our infinite models into finite, but "introspective enough" ones. It remains to show the complexity of the satisfiability problem.

We have illustrated our framework with toy examples of epistemic logic, such as the muddy children problem, but also with more general applications. We believe that the generalisation of the gossip problem that we introduced may be the simplest and most tunable epistemic planning problem, much like the blocksworld problem in classical planning, and we have seen that our framework is well suited for such a task. In the long term, we aim to generalize our approach to temporal planning, where actions are durative and may overlap, to flexible planning, where actions may happen between intervals of time, and to contingent planning, with uncertainty on the initial state or on the effects of actions.

We close this thesis with a discussion on one central topic of it: knowledge and ignorance. The latter is an important part of the mo-tivation behind this work. As we have seen in the introduction, logics of visibility were first investigated because modelling ignorance with possible worlds semantics was counter-intuitive and led to models impractical for system verification. Moreover, our first goal when we designed DEL-PAO was to relax the assumption that visibilities are common knowledge, so that higher-order knowledge, but more importantly higher-order ignorance, becomes non-trivial.

How to ensure introspection of knowledge with our visibility atoms appeared clear: we simply imposed that an agent always sees whether she sees something. However, ensuring that introspection is preserved in all related worlds was not so straightforward and led to the definition of the five constraints (C1)-(C5). It is interesting to note that we have made several attempts at generalizing our framework to beliefs without success. A way we investigated was to replace the visibility operator S i by two operators O i and C i , respectively reading "i has an opinion on" and "i is correct on." However, we were not able to find counterparts of the five introspective constraints that ensure KD45 properties in the current and all related valuations. This is only important if we consider building an axiomatization; it remains an interesting line of work even only conceptually. Beliefs would provide a more general framework in which, with the help of our current dynamic operators, one could intuitively formalize a theory of mind.

Another interesting future work is to define the indistinguishability relation for common knowledge as usual as the reflexive and transitive closure of the union of individual indistinguishability relations. This would allow us to consider common knowledge for an arbitrary number of agents instead of only for the whole set of agents. This however should be done with care, as the axiomatization of the common knowledge operator would be different and as this might also influence the complexity result.

Finally, one may wonder whether, after including visibility and public announcements, there still exists a validity that is not a validity of standard epistemic logic. Here is one:

K 1 (p ∨ q) ∧ ¬K 1 p ∧ ¬K 1 q → K 1 K 2 (p ∨ q).
Intuitively: if I know that p∨q while not knowing that p and not knowing that q, then I must have learned it via a public announcement. Therefore I know that the others also know p ∨ q. A way to relax this validity is by integrating private announcements. We have shown that we can model at least some forms of private announcements thanks to our visibility atoms; it would be interesting to investigate to which extent one can capture action models of dynamic epistemic logics. One might then imagine to find combinations of gossip problems and muddy children puzzles...

Conclusion et perspectives

Cette thèse fait suite à des travaux récents dans la logique épistémique qui étudient comment la connaissance peut être construite en utilisant des informations sur les visibilités des agents sur les variables. Les logiques basées sur l'observabilité offrent une bonne alternative à la sémantique standard, mais sont accompagnées avec les deux principaux inconvénients que nous avons identifiés. Nous avons proposé des solutions aux deux problèmes en encodant les informations de visibilité avec des "atomes de visibilité" spéciaux de profondeur illimitée au lieu d'ensembles de variables propositionnelles et en incluant la communication sous forme de programmes exécutés publiquement. Nous avons en outre introduit un opérateur de "visibilité jointe" pour construire la connaissance commune et des atomes de contrôle qui nous permettent de considérer les capacités stratégiques des agents.

Il est à noter que l'ajout de l'observabilité d'ordre supérieur et de l'observabilité jointe, ainsi que des opérateurs stratégiques et des programmes exécutés publiquement, n'est pas accompagné d'un coût supplémentaire pour le model checking, qui reste PSPACE-complet. Nous avons vu que sa définition n'est toutefois pas directe car elle nécessite de transformer nos modèles infinis en modèles finis, mais "suffisamment introspectifs". Il reste à démontrer la complexité du problème de satisfiabilité.

Nous avons illustré notre logique sur des exemples classiques de la logique épistémique, tels que le problème des enfants sales, mais aussi sur des applications plus générales. Nous estimons que la généralisation du problème du bavardage que nous avons introduit est peut-être le problème de planification épistémique le plus simple et paramétrable, comme l'est le problème "blocksworld" en planification classique, et nous avons vu que notre logique est adaptée à ce type de tâche. À long terme, nous visons à généraliser notre approche à la planification temporelle, où les actions ont une durée et peuvent se chevaucher, à la planification flexible, où les actions peuvent se produire entre des intervalles de temps, et à la planification contingente, avec incertitude sur l'état initial ou sur les effets des actions.

Nous terminons cette thèse avec une discussion sur un sujet central de celle-ci : la connaissance et l'ignorance. Cette dernière est une partie importante de la motivation derrière ce travail. Comme nous l'avons vu dans l'introduction, les logiques de visibilité ont d'abord été étudiées car la modélisation de ignorance avec la sémantique des mondes possibles est contre-intuitive et conduit à la construction de modèles peu adaptés à la vérification de système. De plus, notre premier objectif lorsque nous avons conçu DEL-PAO était de relâcher le fait que les visibilités soient connaissance commune, de sorte que les connaissances d'ordre supérieur, ou plus important encore l'ignorance d'ordre supérieur, soient non triviales.

Comment assurer l'introspection des connaissances avec nos atomes de visibilité parut clair : nous avons simplement imposé qu'un agent voit toujours si elle voit quelque chose. Cependant, veiller à ce que cette propriété soit conservée dans tous les mondes liés n'a pas été aussi simple et a conduit à la définition des cinq contraintes (C1)-(C5). Il est intéressant de noter que nous avons fait plusieurs tentatives de généralisation de notre logique aux croyances sans succès. Une façon que nous avons étudiée était de remplacer l'opérateur de visibilité S i par deux opérateurs O i et C i , respectivement lus "i a une opinion sur" et "i est correcte sur". Cependant, nous n'avons pas réussi à trouver les homologues des cinq contraintes introspectives pour assurer les propriétés KD45 dans la valuation courante et dans toutes les valuations reliées. Ceci est seulement important si l'on considère la construction d'une axiomatique ; cela reste intéressant à étudier, même seulement sur le plan conceptuel. Les croyances fournirait un cadre plus général dans lequel, avec l'aide de nos opérateurs dynamiques actuels, il serait possible de formaliser intuitivement une théorie de l'esprit.

Un autre travail intéressant pour le futur est de définir la relation d'indistinguabilité pour la connaissance commune comme d'habitude, par la fermeture réflexive et transitive de l'union des relations indistinguabilité individuelles. Cela nous permettrait d'envisager la connaissance commune pour un nombre arbitraire d'agents au lieu de seulement pour l'ensemble des agents. Cela doit toutefois être examiné avec soin : l'axiomatique de l'opérateur de connaissance commune serait différente et cela pourrait également influer sur le résultat de complexité.

Enfin, on peut se demander si, après y inclus la visibilité et les annonces publiques, il existe encore des validités qui ne sont pas valides en logique épistémique standard. En voici une :

K 1 (p ∨ q) ∧ ¬K 1 p ∧ ¬K 1 q → K 1 K 2 (p ∨ q).
Intuitivement : si je sais que p ∨ q tout en ne sachant pas que p et en ne sachant pas que q, alors j'ai du l'apprendre par une annonce publique. Par conséquent, je sais que les autres savent aussi p ∨ q. Une façon de se relâcher cette validité est d'intégrer les annonces privées. Nous avons montré que nous pouvons modéliser au moins certaines formes d'annonces privées grâce à nos atomes de visibilité ; il serait intéressant d'étudier dans quelle mesure nous pouvons capturer des modèles d'action des logiques épistémiques dynamiques. On pourrait alors imaginer des combinaisons des problèmes du bavardage et des enfants sales... Dans les logiques épistémiques, la connaissance est généralement modélisée par un graphe de mondes possibles, qui correspondent aux alternatives à l'état actuel du monde. Ainsi, les arêtes entre les mondes représentent l'indistinguabilité. Connaître une proposition signifie que cette proposition est vraie dans toutes les alternatives possibles. Les informaticiens théoriques ont cependant remarqué que cela a conduit à plusieurs problèmes, à la fois intuitifs et techniques : plus un agent est ignorant, plus elle a d'alternatives à examiner ; les modèles peuvent alors devenir trop grands pour la vérification de système. Ils ont récemment étudié comment la connaissance pourrait être réduite à la notion de visibilité. Intuitivement, l'idée de base est que quand un agent voit quelque chose, alors elle sait sa valeur de vérité. A l'inverse, toute combinaison de valeurs de vérité des variables non observables est possible pour l'agent. Ces informations d'observabilité permettent de reconstituer la sémantique standard de la connaissance : deux mondes sont indistinguables pour un agent si et seulement si chaque variable observée par cet agent a la même valeur dans les deux mondes. Notre objectif est de démontrer que les logiques épistémiques fondées sur la visibilité constituent un outil approprié pour plusieurs applications importantes dans le domaine de l'intelligence artificielle.

Dans le cadre actuel de ces logiques de visibilité, chaque agent a un ensemble de variables propositionnelles qu'elle peut observer ; ces visibilités sont constantes à travers le modèle. Cela accompagne une hypothèse forte : les visibilités sont connues de tous, et sont même connaissance commune. De plus, la construction de la connaissance à partir de la visibilité entraîne des validités contre-intuitives, la plus importante étant que l'opérateur de la connaissance distribue sur les disjonctions de littéraux : si un agent sait que p ou q est vrai, alors elle sait que p est vrai ou que q est vrai, parce qu'elle peut les voir.

Dans cette thèse, nous proposons des solutions à ces deux problèmes et les illustrons sur diverses applications telles que la planification épistémique ou les jeux booléens épistémiques, et sur des exemples plus spécifiques tels que le problème des enfants sales ou le problème du bavardage. Nous étudions en outre des propriétés formelles des logiques que nous concevons, fournissant axiomatisations et résultats de complexité.

Figure 1

 1 Figure 1.1: Part of the visibility model where agent 1 only sees p and agent 2 only sees q.

Figure 1

 1 Figure 1.2: Part of the visibility model where agent 1 has full visibility but agent 2 only sees q.

  w, w ) : w, w ∈ W and for every p ∈ Prop, S i p ∈ V 0 implies w(p) = w (p)} v(p) = {w : w ∈ W and p ∈ w} and w V 0 = V 0 ∩ Prop. Therefore only a part of our unique visibility model M vis remains in the Kripke model: all those equivalence classes where the agents' knowledge complies with the visibility information contained in V 0 . Proposition 1.4. The visibility model (M vis , V 0 ) and the pointed Kripke model

Example 1. 4 .

 4 Consider Prop and Agt of examples 1.1 and 1.2. Consider the valuation V 0 = {p, S 1 p, S 2 q}. Then M V 0 = W, ∼ 1 , ∼ 2 , v with W = {∅, {p}, {q}, {p, q}}, where the indistinguishability relations are as depicted in Figure 1.3 and where w V 0 = {p}. Observe that this corresponds to the subset of Example 1.1.

  Proposition 2.3 implies that if α ⇒ I β and β ⇒ I α, then α = β. Proposition 2.4. Let α, β, γ be three atoms. If α ⇒ I γ and γ ⇒ I β, then α ⇒ I β.

T

  vis CPL ϕ . Then T vis |= CPL ϕ by soundness of classical propositional logic. Hence ϕ is valid in INTR by Proposition 2.14. Finally, ϕ is valid in INTR because all the equivalences used in Theorem 2.1 are valid in

  . . . . . . . . . . . . . . . . . . . . . . . . . 86

Figure 3

 3 Figure 3.1: Graphical representation of the first three turns of Algorithm 3.1.

  -PAO S : DEL-PAO without joint visibility . . . . . 88 4.1.1 Language of DEL-PAO S . . . .

Proposition 4. 1 .

 1 All relations ∼ i are equivalence relations on INTR. Proof. The proof of Proposition 2.6 on page 35 is still valid. Proposition 4.2. Let s ∈ INTR and s ∈ 2 ATM . If s ∼ i s then s ∈ INTR.

Proposition 4. 3 .

 3 Let ϕ be a boolean formula. Then ϕ ↔ NF (ϕ) is valid in INTR. Proof. Procedure 4.1 replaces every introspectively valid atom α by . For such α, α ↔ is valid in INTR. Therefore NF (ϕ) is equivalent to ϕ on introspective states because the rule of replacement of equivalents preserves plain validity. Proposition 4.4. For every state s ∈ 2 ATM , every boolean formula ϕ in normal form, and every α valid in INTR, we have s\{α} |= ϕ if and only if s∪{α} |= ϕ.

  every conditional effect ce ∈ eff (a) such that (ceff + (ce) ∪ ceff -(ce)) ∩ {α : α is valid in INTR} = ∅, replace the precondition pre(a) by pre(a) ∧ ¬cnd (ce) and remove ce from eff (a); 2. Put the resulting pre(a) and cnd (ce), for every ce ∈ eff (a), in normal form using Procedure 4.1.

  s |= pre(a), and (4.1) for every ce ∈ CE INTR , s |= cnd (ce), and (4.2) t = s \ ce∈eff (a) and s|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s|=cnd(ce) ceff + (ce). (4.3) On the other hand, the specification of sR NF (a) t is simpler because the problematic effects have been removed: sR NF (a) t iff s |= NF (pre(a) ∧ ce∈CE INTR ¬cnd (ce)), and (4.4) t = s \ ce∈CE INTR and s|=NF (cnd(ce)) ceff -(ce) ∪ ce∈CE INTR and s|=NF (cnd(ce))ceff + (ce). (4.5)

  s\{α} R a t\{α} iff s\{α} |= pre(a), and t\{α} = (s\{α}) \ ce∈eff (a) and s\{α}|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s\{α}|=cnd(ce) ceff + (ce) and: s∪{α} R a t∪{α} iff s∪{α} |= pre(a), and t∪{α} = (s∪{α}) \ ce∈eff (a) and s∪{α}|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s∪{α}|=cnd(ce) ceff + (ce).

•

  Since a is in normal form, pre(a) is in normal form. Hence by Proposition 4.4, s\{α} |= pre(a) is equivalent to s∪{α} |= pre(a) because α valid in INTR. • Since a is in normal form, cnd (ce), for every ce ∈ eff (a), is also in normal form. Therefore, again by Proposition 4.4, s\{α} |= cnd (ce) is equivalent to s∪{α} |= cnd (ce). • Finally, and again since a is in normal form, α does not belong to ceff + (ce) or ceff -(ce), for every ce ∈ eff (a). Thus t\{α} = (s\{α}) \ ce∈eff (a) and s\{α}|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s\{α}|=cnd(ce) ceff + (ce) if and only if t∪{α} = (s∪{α}) \ ce∈eff (a) and s∪{α}|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s∪{α}|=cnd(ce) ceff + (ce).

Lemma 4. 1 .

 1 If c does not occur in ϕ, then the equivalence ϕ ↔ [str(ϕ, c)]c is plainly valid.

  exeCE(ce, c) = if c then +α 1 ; . . . ; +α m ; -β 1 ; . . . ; -β where ceff + (ce) = {α 1 , . . . , α m } and ceff -(ce) = {β 1 , . . . , β }. Note that the ordering of atoms is not important since ceff + (ce) ∩ ceff -(ce) = ∅. Then we can associate to action a the DEL-PAO S program exeAct(a): exeAct(a) = pre(a)?; str(cnd (ce 1 ), c 1 ); . . . ; str(cnd (ce m ), c m ); exeCE(ce 1 , c 1 ); . . . ; exeCE(ce m , c m ); rst({c 1 , . . . , c m }), with eff (a) = {ce 1 , . . . , ce m }.

  a) and s|=cnd(ce) ceff -(ce) CEFF + = ce∈eff (a) and s|=cnd(ce) ceff + (ce) Obviously C |= ∪ C |= = C and C |= and C |= are disjoint with CEFF -and CEFF + . We obtain: s R exeAct(a) t iff there exist s 2 , s 3 ∈ 2 ATM such that s |= pre(a), and s 2 = (s \ C |= ) ∪ C |= , and s 3 = (s 2 \ CEFF -) ∪ CEFF + , and t = s 3 \ C, i.e.: s R exeAct(a) t iff s |= pre(a), and t = ((((s \ C |= ) ∪ C |= ) \ CEFF -) ∪ CEFF + ) \ C. Since C |= and C |= are disjoint with CEFF -and CEFF + , we can reorder operations to obtain: s R exeAct(a) t iff s |= pre(a), and t = ((((s \ CEFF -) ∪ CEFF + ) \ C |= ) ∪ C |= ) \ C, which, since C |= ∪ C |= = C, gives: s R exeAct(a) t iff s |= pre(a) and t = (s \ CEFF -) ∪ CEFF + , or in other words: s R exeAct(a) t iff s |= pre(a) and t = s \ ce∈eff (a) and s|=cnd(ce) ceff -(ce) ∪ ce∈eff (a) and s|=cnd(ce) ceff + (ce).

5. 7

 7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 129

Theorem 5. 4 .

 4 The membership problem and the existence problem of Nash equilibria in epistemic boolean games are both in PSPACE.Proof. From propositions 5.4 and 5.5, both problems polynomially reduce to the DEL-PAOC model checking problem.The PSPACE-completeness remains an open problem. Let us illustrate epistemic boolean games with an example of a coordination game.

  public announcement of formulas . . 140 6.4.2 Some reduction axioms . . . . . . . . . . . . . . . 140 6.4.3 Replacement of equivalents . . . . . . . . . . . . 142 6.5 Muddy children, proved . . . . . . . . . . . . . . . . . 142 6.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 144

Figure 6 . 1 :

 61 Figure 6.1: Two muddy children.

  w |= ϕ for every U , w such that U, w P π U , w where P π is a binary relation on pointed models is defined by: U, w P +α U , w iff U = U +α and w = w+α U, w P -α U , w iff U = U -α and w = w-α and α is not valid in INTR U, w P π;π U , w iff U, w (P π • P π ) U , w U, w P π π U , w iff U, w (P π ∪ P π ) U , w U, w P χ? U , w iff U, w |= χ, w = w, and U = {u ∈ U : U, u |= χ} Note that we do not require w ∈ U .

  w+α = w ∪ {α} w-α = w \ {α} and U +α = {w+α : w ∈ U } U -α = {w-α : w ∈ U } Then the truth conditions of DL-PA-PMP are as follows:U, w |= α iff α ∈ w U, w |= ¬ϕ iff not (U, w |= ϕ) U, w |= ϕ ∧ ϕ iff U, w |= ϕ and U, w |= ϕ U, w |= [π!]ϕ iff U , w |= ϕ for every U , w such that U, w P π U , w U, w |= K π ϕ iff U, w |= ϕ for every w ∈ U such that U, w M π U, wwhere P π is the public relation on pointed models is defined by:U, w P α← U , w iff U = U +α and w = w+α U, w P α←⊥ U , w iff U = U -α and w = w-α U, w P π;π U , w iff U, w (P π • P π ) U , w U, w P π π U , w iff U, w (P π ∪ P π ) U , w U, w P χ? U , w iff U, w |= χ, w = w, and U = {u ∈ U : U, u |= χ} and M π is the mental relation on pointed models that is defined by: U, w M α← U , w iff U = U and w = w+α U, w M α←⊥ U , w iff U = U and w = w-α U, w M

Lemma 7 . 2 .

 72 Let π be a DEL-PAOC program and A ⊆ ATM a set of atoms such that ATM (π) ⊆ ATM . Let w be a DL-PA-PMP valuation such that w ∈ INTR. Then for every w such that INTR| A , w ∩ A M tr prg (π) INTR| A , w , we have w ∈ INTR| A .

Proposition 7 . 3 .

 73 Let A ⊆ ATM be a set of atoms and w ∈ INTR an introspective valuation. Then we have:INTR| A , w ∩ A |= DL-PA-PMP K tr prg (π 1 ;π 2 ) ϕ ↔ K tr prg (π 1 ) K tr prg (π 2 ) ϕ INTR| A , w ∩ A |= DL-PA-PMP K tr prg (π 1 π 2 ) ϕ ↔ K tr prg (π 1 ) ϕ ∧ K tr prg (π 2 ) ϕ INTR| A , w ∩ A |= DL-PA-PMP K tr prg (π * ) ϕ ↔ K tr prg (π 2 2|ATM (π)| ) ϕ INTR| A , w ∩ A |= DL-PA-PMP K tr prg (χ?) ϕ ↔ tr fml (χ) → ϕ Proof.The proof is similar to Proposition 7.1 for the translation of DEL-PAO programs. It likewise relies on Lemma 7.2. Proposition 7.4. Let V ∈ INTR be a valuation and ϕ a DEL-PAOC formula. Then we have: V |= DEL-PAOC ϕ if and only if INTR| RATM (ϕ) , V ∩ RATM (ϕ) |= DL-PA-PMP tr DEL-PAOC (ϕ)

  INTR| A , V ∩ A |= DL-PA-PMP K α← tr fml (ψ) ⇔ INTR| A , (V ∩ A) ∪ {α} |= DL-PA-PMP tr fml (ψ) ⇔ INTR| A , (V ∪ {α}) ∩ A |= DL-PA-PMP tr fml (ψ) ⇔ V ∪ {α} |= DEL-PAOC ψ (by induction hypothesis) ⇔ V |= DEL-PAOC [+α]ψ.

Proposition 7 . 5 .

 75 Let U be a public information state such that U ⊆ INTR, w ∈ U a valuation, i an agent and ϕ a formula without epistemic operators. Then:1. for every A ⊆ ATM such that RATM (K i ϕ) ⊆ A, U, w |= DEL-PAO-PP K i ϕ if and only if U | A , w ∩ A |= DL-PA-PMP K tr prg A (varyIfNotSeen(i,ATM (ϕ))) tr fml A (ϕ); 2. for every A ⊆ ATM such that RATM (CK ϕ) ⊆ A, U,w |= DEL-PAO-PP CK ϕ if and only if U | A , w ∩ A |= DL-PA-PMP K tr prg A (varyIfNotSeen(Agt,RATM (ϕ))) tr fml A (ϕ).

INTR 0

 0 is represented by the empty list [].

  for arbitrary j. It follows that EK Agt p → EK Agt EK Agt p. From the latter we obtain CK (EK Agt p → EK Agt EK Agt p) by necessitation. Now we are ready to apply the induction axiom for common knowledge, which tells us that

2.1 Language of DEL-PAO . . . . . . . . . . . . . . . . . . . 28 2.2 Semantics of DEL-PAO . . . . . . . . . . . . . . . . . . 30

	2.2.1 Introspective valuations . . . . . . . . . . . . . . 31
	2.2.2 Introspective causes and consequences . . . . . . 33
	2.2.3 Indistinguishability relations . . . . . . . . . . . 35
	2.2.4 Valuation updates . . . . . . . . . . . . . . . . . . 36
	2.2.5 Truth conditions and validity . . . . . . . . . . . 37
	2.2.6 Discussion . . . . . . . . . . . . . . . . . . . . . . 42
	2.3

Axiomatization . . . . . . . . . . . . . . . . . . . . . . 43

	2.3.1 Reduction axioms for epistemic operators . . . . 44
	2.3.2 Reduction axioms for dynamic operators . . . . . 46
	2.3.3 Soundness and completeness . . . . . . . . . . . 52
	2.4

Complexity of model checking . . . . . . . . . . . . 55

	2.4.2 Simulating epistemic operators with programs . 56
	2.4.3 Relevant atoms . . . . . . . . . . . . . . . . . . . 62
	2.4.4 The model checking problem . . . . . . . . . . . . 64
	2.5
	2.4.1 From infinite to finite models . . . . . . . . . . . 55

Applications . . . . . . . . . . . . . . . . . . . . . . . . 65

	2.5.1 Two Generals' problem . . . . . . . . . . . . . . . 65
	2.5.2 Private announcements . . . . . . . . . . . . . . 66
	2.6

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 67

  Proposition 2.14. For ϕ without modal operators, ϕ is valid in INTR if and only if T vis |= CPL ϕ, where |= CPL is logical consequence in classical propositional logic. Proof. The theory T vis describes the constraints defining the set of introspective valuations INTR. For the left-to-right direction, first, if ϕ is DEL-PAO-provable then ϕ is valid in INTR, since our axioms are sound and rules of inference preserve plain validity. Moreover, if ϕ is valid in INTR then ϕ is CPL-valid in the T vis models. This is trivial because the models are isomorphic. (It is actually an equivalence.) Then, if ϕ is CPL-valid in the T vis models then ϕ is derivable from T vis in CPL, by completeness of classical propositional logic. (It is again actually an equivalence.) Thus, if ϕ is DEL-PAO-provable then ϕ is derivable from T vis in CPL.

Proposition 2.15. For formulas ϕ without modal operators, DEL-PAO ϕ if and only if T vis CPL ϕ.

Proof.

  . . . . . . . . . . . 89 4.1.2 Semantics of DEL-PAO S . . . . . . . . . . . . . . . 89

	4.4.1 Storing variables . . . . . . . . . . . . . . . . . . 97
	4.4.2 Encoding of actions . . . . . . . . . . . . . . . . . 98
	4.4.3 Solvability of a planning task . . . . . . . . . . . 101
	4.4.4 Planning actions and joint visibility . . . . . . . 104
	4.5 Encoding into PDDL . . . . . . . . . . . . . . . . . . . 105
	4.5.1 Translation of formulas . . . . . . . . . . . . . . 105
	4.5.2 Encoding of actions . . . . . . . . . . . . . . . . . 106
	4.6 Applications . . . . . . . . . . . . . . . . . . . . . . . . 106
	4.6.1 The exam problem . . . . . . . . . . . . . . . . . 107
	4.6.
	4.2 Epistemic planning with conditional effects . . . 91
	4.2.1 Actions with conditional effects . . . . . . . . . . 91
	4.2.2 Simple epistemic planning tasks . . . . . . . . . 92
	4.3 Normal forms . . . . . . . . . . . . . . . . . . . . . . . 93
	4.3.1 Boolean formulas . . . . . . . . . . . . . . . . . . 93
	4.3.2 Actions . . . . . . . . . . . . . . . . . . . . . . . . 94
	4.3.3 Planning tasks . . . . . . . . . . . . . . . . . . . . 97

4.4 Complexity results . . . . . . . . . . . . . . . . . . . . 97 2 The generalized gossip problem . . . . . . . . . . 109 4.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 111

  Therefore sR a t if and only if sR NF (a) t. For every s, t ∈ 2 ATM , every action a in normal form, and every α valid in INTR, s\{α} R a t\{α} if and only if s∪{α} R a t∪{α}.Proof. Since a is in normal form, we have:

	Proposition 4.6.
	lent to:		4.3) is equiva-
	t = s \	ceff -(ce) ∪	ceff + (ce)
	ce∈CE INTR and s|=cnd(ce)	ce∈CE INTR and s|=cnd(ce)
	which is equivalent, by Proposition 4.3, to:
	t = s \	ceff -(ce) ∪	ceff + (ce)
	ce∈CE INTR and s|=NF (cnd(ce))	ce∈CE INTR and s|=NF (cnd(ce))
	since s in introspective.

• Since by (4.2), for every ce ∈ CE INTR , s |= cnd (ce), (

  Therefore s R exeAct(a) t if and only if s R a t.

	Example 4.3 (Example 4.1, ctd.). The action Call i j , for any i, j ∈ Agt, is associated to the program:
	exeAct(Call i j ) = ?;
	str(S

i s 1 ∨ S j s 1 , c 1 ); . . . ; str(S i s n ∨ S j s n , c n ); if c 1 then +S i s 1 ; +S j s 1 ; . . . ; if c n then +S i s n ; +S j s n ; rst({c 1 , . . . , c n })

  ATM with m ≥ 0 such that s 0 = t 0 , and for every 1 ≤ k ≤ m, t k-1 R a∈Act exeAct(a) t k , and t m |= Goal , that is, if we detail a∈Act exeAct(a): Goal iff there exist t 0 , . . . , t m ∈ 2 ATM with m ≥ 0 such that s 0 = t 0 , and for every 1 ≤ k ≤ m, there exists a ∈ Act such that t k-1 R exeAct(a) t k , and t m |= Goal .

	s 0 |= By Proposition 4.7, we thus have: a∈Act exeAct(a)
	s 0 |=	exeAct(a)
	a∈Act

a) * Goal iff there exist t 0 , . . . , t m ∈ 2 * * Goal iff there exist t 0 , . . . , t m ∈ 2 ATM with m ≥ 0 such that s 0 = t 0 , and for every 1 ≤ k ≤ m, there exists a ∈ Act such that t k-1 R a t k , and t m |= Goal .

  ATM such that t m is reachable from s 0 via Act, and

	that is:
	s 0 |=
	t m |= Goal ,
	i.e., s 0 |=	a∈Act exeAct(a)

a) * Goal iff there exist t 0 , . . . , t m ∈ 2 ATM and a 1 , . . . , a m ∈ Act with m ≥ 0 such that s 0 = t 0 , and for every

1 ≤ k ≤ m, t k-1 R a k t k ,

and t m |= Goal , a∈Act exeAct(a) * Goal iff there exists t m ∈ 2 * Goal if and only if Act, s 0 , Goal is solvable.

  Proposition 5.5. Let B = (Agt, ATM f OBS S , (Ψ i ) i∈Agt , (γ i ) i∈Agt ) be an epistemic boolean game. Then B has at least one Nash equilibrium if and only ifCtrl ∪ {α ∈ ATM f OBS S : α is valid in INTR} |= 3 Agt Nash. Proof. The set {α ∈ ATM f OBS S : α is valid in INTR} ensures that Ctrl ∪ {α ∈ ATM f OBS S : α is valid in INTR} is introspective w.r.t. ATM f OBS S . Let us write this set ATM f OBS S |INTR . We have: Ctrl ∪ ATM f OBS S |INTR |= 3 Agt Nash ifand only if there exists α 1 , . . . , α m ∈ ATM such that for every 1 ≤ k ≤ m, there exists i ∈ Agt such that C i α k ∈ Ctrl ∪ ATM f OBS S |INTR , and Ctrl ∪ ATM f OBS S |INTR |= (+α 1 -α 1 ); . . . ; (+α m -α m ) Nash. Since the sets (Ψ i ) i∈Agt partition ATM f OBS S , agents together control exactly the set ATM f OBS S and this is equivalent to: there exists α 1 , . . . , α m ∈ ATM f OBS S such that Ctrl ∪ ATM f OBS S |INTR |= (+α 1 -α 1 ); . . . ; (+α m -α m ) Nash. Therefore the program (+α 1 -α 1 ); . . . ; (+α m -α m ) will either add or remove atoms from ATM f OBS S . Observe that the only atoms from ATM f OBS Sthat are already in Ctrl ∪ ATM f OBS S |INTR are introspectively valid and therefore cannot be removed. Thus the program can only add new atoms among α 1 , . . . , α m (the others will stay false). Hence the previous statement is equivalent to: there exists α 1

  when either α ∈ w and α ∈ w , or α / ∈ w and α / ∈ w . The same properties hold: the relation ∼ Agt and every ∼ i are equivalence relations on INTR and if w ∈ INTR, if w ∼ i w or w ∼ Agt w then w ∈ INTR.

	Example 6.2 (Two muddy children). Consider the valuation
	w

  then there is no world related to U, w by P χ? . Otherwise, the resulting information state {u ∈ U : U, u |= χ} ⊆INTR since it is included in U ⊆ INTR. Moreover, w ∈ {u ∈ U : U, u |= χ} since U, w |= χ. Therefore {u ∈ U : U, u |= χ}, w is an introspective pointed model.It follows that every U , w such that U, w P π U , w is an introspective pointed model. Therefore, as it was the case for introspective valuations in DEL-PAO, we cannot "exit" the class of introspective pointed models when interpreting K i ϕ, CK ϕ or [π!]ϕ.It is important to observe that the schemas

http://www.icaps-conference.org/index.php/Main/Competitions

As mentioned in the introduction, the Kleene star * was not included in the original language of DEL-PAO[START_REF] Herzig | A poor man's epistemic logic based on propositional assignment and higher-order observation[END_REF].

Remember that Kiϕ reads "ϕ is compatible with i's knowledge."

This section was expanded compared to[START_REF] Herzig | A poor man's epistemic logic based on propositional assignment and higher-order observation[END_REF] with a more precise definition of the problem.

These results from[START_REF] Cooper | Simple epistemic planning: generalised gossiping[END_REF] were not included in[Herzig and Maffre, 2016].

The case of two and three agents was not discussed in[Herzig and Maffre, 2016].

This discussion, inspired from[Cooper et al., 2016a], was not included in[Herzig and Maffre, 2016].

This discussion was not present in[Cooper et al., 2016a].

http://helios.hud.ac.uk/scommv/IPC-14/planners.html

All resources and PDDL files we used for experiments are available at http://www. irit.fr/%7EAndreas.Herzig/P/Ecai16.html.

The semantics of 3J ϕ were modified between[Herzig et al., 2016] and here. In[Herzig et al., 2016], truth conditions were defined as: V |= 3J ϕ if and only if V |= ϕ for some V such that V RJ V , where V RJ V if only atoms controlled by at least one agent in J were modified between V and V . This led to technical issues with introspective valuations and axiomatization, such as the possibility to remove introspectively valid atoms. Some of these issues are discussed in Section 5.6.

This discussion was not included in[Herzig et al., 2016].

This chapter is inspired by a section of[Charrier et al., 2016a], but has been revised

Remerciements

We call this logic DL-PA-PMP: Dynamic Logic of Propositional Assignments with Public and Mental Programs.

We will prove that at each turn, two pairs of agents are complementary: the first pair is agent left along with the last agent she called at this turn, and the second is agent right along with the last (and only agent) she called at this turn.

The first turn is a special case where semi-experts of depth 1 are produced.

Lemma 3.1. We have:

EK left,n-4 s left,0,...,n-4 ∧ EK right,n-3 s right,n-3 .

Proof. Let us write ij for the call between i and j. The first turn (turn 0) of Algorithm 3.1 produces the following sequence of calls: left0, left1, . . . , left(n-4), right(n-3).

By (Incr ) of Proposition 3.1 we have V 0 |= [Call left 0 ]EK left,0 s left,0 and therefore V 0 |= [Call left 0 ]K left s left,0 . We do the same for the next call:

and so on until

]EK left,n-4 s left,0,1,...,n-4 .

In the same vein we also have We now characterize the turns after turn 0 .

Lemma 3.2. For t ≥ 1, we have:

V 0 |= [turn 0 ; . . . ; turn t ] EK left,n-4-t EK left,0-t,...,n-4-t EK t-1 Agt s Agt ∧ EK right,n-3-t EK right,n-3-t EK t-1 Agt s Agt .

Proof. We prove it by induction on t. Both cases resemble the proof of Lemma 3.1.

Base case: t = 1. The turn 1 of Algorithm 3.1 produces the following sequence:

left(n-3), left0, left1, . . . , left(n-5), right (n-4).

By Lemma 3.1 and (Incr ) of Proposition 3.1 we have

Then again by (Incr ),

K left EK left,n-3,0 s Agt , and for the next call Inductive case. The reasoning is similar, but generalized to turn t+1. Suppose the formula is true for turn t. The turn t + 1 is:

By our induction hypothesis and (Incr ) of Proposition 3.1 we have

Then by (Prsv ) of Proposition 3.1,

Agt s Agt , and so on until

Moreover, by (Incr ),

We end as usual with (Prsv ):

Agt s Agt , which is our result for t+1. Lemma 3.3. After turn t-1 of Algorithm 3.1, the pairs (left, n-3-t) and (right, 0-t) are complementary for depth t.

Proof. From Lemma 3.2 we can deduce

Applying (Incr ) of Proposition 3.1 we obtain

By the same reasoning for left and 0-t, right and n-3-t, and finally n-3-t and 0-t, we obtain that each of them are complementary, hence the result.

Lemma 3.4. The goal for depth t, EK t Agt s Agt , is reached after the turn t of Algorithm 3.1.

Proof. Turn t of Algorithm 3.1 is:

By Lemma 3.3, after turn t-1 and the first call left(0-t) of turn t, agents left and 0-t become experts for depth t. (Hence we have EK left,0-t EK t-1 Agt s Agt .) Then after the n-4 calls left(1-t), . . . , left(n-4-t) we get by (Incr ) of Proposition 3.1:

Agt s Agt , that is, 1-t, . . ., n-4-t are all experts for depth t. Finally, after the last call right(n-3-t), and also by Lemma 3.3, agents right and n-3-t become experts for depth t. (Thus EK right,n-3-t EK t-1 Agt s Agt .) Therefore after the n-2 calls of turn t we have EK Agt EK t-1 Agt s Agt , which is equivalent to EK t Agt s Agt .

Proposition 3.2. The sequence resulting from Algorithm 3.1 gives a solution to the generalized gossip problem for k ≥ 1 and n ≥ 4.

Proof. By Lemma 3.4, the goal for depth t is reached after turn t of Algorithm 3.1. Thus the goal for depth k is reached after turn k (k+1 turns), i.e., at the end of the algorithm.

Proposition 3.2 implies that at most (k+1)(n-2) calls are required to solve the instance Gossip(k, n) of the generalized gossip problem.

Optimality

Two and three agents

The former case is easy: only one call is necessary for two agents to reach knowledge on their secrets of level k, whatever k is. (This is ensured by (Incr ) of Proposition 3.1.) Obviously, less calls are not sufficient.

For three agents, we number them 0, 1 and 2 and we give an algorithm that takes k+2 turns of one call each.

Algorithm 3.2. procedure gossip(k, 3):

for t = 0..k+1: agent 0 calls agent (t mod 2) + 1.

Hence the algorithm produces sequences of the form Call 0 1 ; Call 0 2 ; Call 0 1 ; Call 0 2 ; . . ., k+2 times; each turn consists in one call:

, and so on. We prove that it is correct and optimal. Theorem 3.2. The minimal number of calls needed to solve the instance Gossip(k, 3) of the generalized gossip problem, for k ≥ 1, is k+2.

Proposition 3.4. The sequence resulting from Algorithm 3.2 gives a solution to the generalized gossip problem for k ≥ 1 and n = 3.

Proof. We prove it by induction on k.

Base case: k = 1. It is easy to check that the sequence Call 0 1 ; Call 0 2 ; Call 0 1 establishes the goal for depth 1.

Inductive case. Suppose k+2 turns of the algorithm achieve the goal for depth k: . Therefore, because 0, (k+2 mod 2) + 1 and k+3 mod 2) + 1 are all different, we obtain by (Prsv ) of Proposition 3.1:

Epistemic boolean games based on visibility and control

In this chapter, we extend DEL-PAO by adding further special atoms: control atoms. This allows us to interpret, in addition to epistemic operators, the operator of "ceteris paribus strategic ability" and to capture epistemic boolean games.

The atom of control C i p reads "agent i controls the value of p"; C i C j p reads "i controls whether agent j controls p"; etc. We allow nesting with visibility: C i S j p reads "i controls j's visibility of the truth value of p"; S i C j p reads "i sees whether j controls p"; and so on. We are now able to interpret the strategic operator 3 J , which intuitively means that agents in the set J can make a statement true by modifying variables they control, if the other agents do nothing [START_REF] Van Der Hoek | On the logic of cooperation and propositional control[END_REF][START_REF] Herzig | Logics of knowledge and action: critical analysis and challenges[END_REF]. With the help of this operator, we show how to capture epistemic boolean games and to reason about equilibria in such games.

We call this logic DEL-PAOC: Dynamic Epistemic Logic of Propositional Assignment, Observation and Control.

Theorem 5.2. The axiomatization of DEL-PAOC is sound and complete w.r.t. the set of introspective valuations.

Proof. The proof follows the lines of its counterpart for DEL-PAO (see Theorem 2.2 on page 54).

Complexity of model checking

For model checking, we will reduce the epistemic operator K i to the program varyIfNotSeen(i, A) as we did in DEL-PAO (see Section 2.4.2). We will do the same with the strategic operator 3 J , reducing it to the program varyIfCtrl(J, A) thanks to Proposition 5.1. Like in DEL-PAO, this transformation may add new atoms to the formula. In order to include these new atoms, we extend the definition of relevant atoms RATM (ϕ), defined in Section 2.4.3, to strategic operators as follows:

Observe that the relevant atoms of ϕ are exactly the atoms of its reduction obtained by Procedure 5.1, minus storage variables that do not influence the final value of ϕ.

We also extend Proposition 2.18 on page 62 to DEL-PAOC.

Proposition 5.3. Let ϕ be a formula. Let V , V ∈ 2 ATM such that V and V are introspective w.r.t. RATM (ϕ) and

Proof. The proof follows the line of Proposition 2.18. The new set of relevant atoms ensures that all atoms appearing in the reduction of ϕ (except storage variables) are equal in V and V (including atoms of control).

Then the model checking problem for DEL-PAOC is defined as follows:

• Input: a couple V ∩ RATM (ϕ), ϕ where ϕ is a DEL-PAOC formula and V is an introspective valuation;

Proof. The model checking of DL-PA, which is a fragment of DEL-PAOC without visibility operators S i and control operators C i was proven to be PSPACE-hard [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF]. This establishes the lower bound. We will show in Chapter 7 that the problem is in PSPACE.

Nash equilibrium

The Nash equilibria of a given epistemic boolean game can be characterised in the language of DEL-PAOC. Given the sets of control (Ψ i ) i∈Agt , we define Ctrl = {C i α : i ∈ Agt, α ∈ Ψ i } which describes the control abilities of agents in the boolean game in terms of atoms.

Proposition 5.4.

) be an epistemic boolean game and let

Then s Agt is a Nash equilibrium for B if and only if

The contraposition of the formula is easier to understand: ¬γ i → ¬3 {i} γ i intuitively reads "if i has not reached her goal, then she cannot reach it by modifying the variables under her control." In other words, her strategy is a best response to the strategies of the other agents. If this is the case for every agent, i.e., if i∈Agt (3 {i} γ i → γ i ) is true, then the current situation is a Nash equilibrium.

Proof. Take an arbitrary agent i. We prove that s i is a best response to s Agt\{i} (with s i , s Agt\{i} = s Agt ) if and only if s Agt ∪ Ctrl |= 3 {i} γ i → γ i . We distinguish two cases.

Since the control of i is defined by Ψ i , this is equivalent to: for every α 1 , . . . , α m ∈ Ψ i , we have s Agt ∪ Ctrl |= [(+α 1 -α 1 ); . . . ; (+α m -α m )]¬γ i . Our formula does Example 6.1 (Representing the muddy children puzzle). Let us illustrate by means of the muddy children puzzle [START_REF] Lehmann | Knowledge, common Knowledge and related puzzles (extended summary)[END_REF][START_REF] Fagin | Reasoning about Knowledge[END_REF] how knowledge can be represented in our language.

The version of this puzzle with two agents goes as follows. Two children come back from playing in the park. When their father sees them, he notices that they both have mud on their foreheads. He says, "at least one of you has mud on her forehead," and then asks, "Do you know if you have mud on your forehead?" The children simultaneously answer "No." Then the father repeats his question, "Do you know if you have mud on your forehead?" This time the two children simultaneously answer, "Yes, I have."

Let Agt = {1, . . . , n} be the set of children. Let Prop = {m 1 , . . . , m n } be the propositional variables, where m i expresses that child i is muddy.

Suppose all children are muddy. This fact is described by the conjunction:

Second, agents' observational capabilities are expressed by:

The first two conjuncts express that the agents see the states of other agents but not their own states. The last conjunct expresses that the agents jointly observe their observational capabilities. For instance, JS S i m i reads "all agents jointly see whether i sees m i ." Recall that it does not imply that i sees m i however. Third, the agents' (sensor and communicational) information in the initial situation is described by the formula:

So the muddy children puzzle where all children are muddy is fully described by the conjunction:

Let us now look at the consequences of this description in the semantics to be defined. First, the implication

Let U be the set of all valuations in Figure 6.1. We have:

The proof of last line will be detailed in Section 6.5.

Let C be a class of pointed models. A formula ϕ is satisfiable in C if and only if there is a U, w ∈ C such that U, w |= ϕ; it is valid in C if and only if ¬ϕ is unsatisfiable. For example, the equivalence [χ?!]⊥ ↔ ¬χ is valid in the class of all pointed models.

An introspective pointed model is a pointed model U, w such that:

For example, S i JS p is valid in the class of epistemic models. The following conditions guarantee that when we interpret a formula in an introspective pointed model we stay within the class of introspective pointed models.

Proposition 6.1. Let U, w be an introspective pointed model. Then the following hold:

1. If w ∼ i w and w ∈ U then U, w is an introspective pointed model.

2. If w ∼ Agt w and w ∈ U then U, w is an introspective pointed model.

3. If U, w P π U , w then U , w is an introspective pointed model.

Proof.

(1) and ( 2) are obvious since U does not change and we impose that w ∈ U .

The third item can be proven by induction on the form of π:

Moreover, by definition of U +α, w+α is obviously contained in U +α. Therefore U +α, w+α is an introspective pointed model.

• π = -α. If α is valid in INTR, then there is no world related to U, w by P -α . Otherwise, the proof follows the lines of the proof for π = +α.

• The proofs for π = π 1 ; π 2 and π = π 1 π 2 are straightforward.

Similarly, for negative public assignments we have

We have already proven them within the framework of DEL-PAO (see Proposition 2.11 on page 50).

Replacement of equivalents

The above equivalences can be applied anywhere in a formula because the inference rule of replacement of equivalents preserves validity.

Proposition 6.2. Let ϕ be obtained from ϕ by replacing some occurrence of χ in ϕ by χ . Let U be a set of valuations. If U, w |= χ ↔ χ for every w ∈ U then U, w |= ϕ ↔ ϕ for every w ∈ U .

Proof. This is due to the fact that, along with the ones for K i and CK (see Proposition 2.12 on page 52) the following rule of inference for [π!]:

Muddy children, proved

In this section we formally prove the statement we made in Example 6.3 about the muddy children puzzle for the case of two children. Remember that we have assumed that each child is muddy:

As usual, each child sees the other but cannot see herself:

and initially each child does not know whether she is muddy or not:

We use the following validity of PAL. Proposition 6.3. Let ϕ and ϕ be boolean formulas. Then

is valid in introspective pointed models.

Intuitively, the above proposition says that if agent i knows a fact ϕ but does not know the fact ϕ , then publicly announcing that ϕ or ϕ is true does not increase her knowledge about ϕ .

Proof. Suppose U, w |= K i ϕ. Then for every U , w such that U, w ∼ i U , w , U , w |= ϕ. Moreover, suppose U, w |= ¬K i ϕ ∧ ¬K i ¬ϕ . Then there exists a U 1 , w 1 such that U 1 , w 1 |= ϕ and there exists a U 2 , w 2 such that U 2 , w 2 |= ϕ . Now suppose we announce that ϕ ∨ ϕ . Every pointed model which was previously related to U, w by ∼ i will still be since ϕ, and hence ϕ∨ϕ , is true in all of them. Therefore there still exists a related pointed model where ϕ is true and a related pointed model where ϕ is false. Thus after the announcement of ϕ∨ϕ , we still have ¬K i ϕ ∧¬K i ¬ϕ .

The formulas

and

Translation into DL-PA-PMP

In this section, we show how to translate formulas of the previously presented logics into the language of DL-PA-PMP. We prove that the translation is correct on models we are interested in: the formula is satisfied in a given (introspective) model of its original framework if and only if it is satisfied in the corresponding (finite) model of DL-PA-PMP that we will use for model checking.

We define the restriction of a set of valuations to a set of atoms A as:

Note that U | A is a finite set of finite valuations whenever A is finite.

To avoid confusion, we indicate to which semantics we refer to by subscripting the satisfaction relation |= by the name of the logic. When we mention translation functions, we always refer to the ones defined at the beginning of the current subsection.

From DEL-PAO

Take a DEL-PAO formula ϕ. We define the following procedure of translation of ϕ into DL-PA-PMP. 1. eliminate all epistemic operators K i and CK from ϕ using Procedure 2.2 on page 61; call the resulting formula ϕ ;

2. translate ϕ into the DL-PA-PMP formula tr fml ATM (ϕ ) (ϕ ) according to the following definition:

Remember that α ⇐ and α ⇒ are the introspective causes and consequences of α. We note tr DEL-PAO (ϕ) the formula obtained after applying Procedure 7.1 to ϕ. • π = +α. In this case, we have tr prg

and the property is trivially valid. Otherwise, the proof is similar to the case π = +α.

• The proofs for π = π 1 ; π 2 and π = π 1 π 2 are straightforward since their translation is homomorphic and the associated relation

Proof. All these equivalences are plainly valid in DEL-PAO (see Proposition 2.11 on page 50) and most are equivalences of dynamic logics. They still apply in DL-PA-PMP on certain models because, first, the translation of these program operators is homomorphic, and second, because of Lemma 7.1 that ensures that on this kind of model, translations of programs for the set A do not exit the public information state. This is especially important for the sequence:

Proposition 7.2. Let V ∈ INTR be an introspective valuation and ϕ a DEL-PAO formula. Then we have:

Proof. We follow the translation procedure and use properties of DEL-PAO and DL-PA-PMP programs to prove the equivalence.

• First of all, remove epistemic operators from ϕ, and write the resulting formula ϕ ; by Proposition 2.17 on page 59, it is equivalent to ϕ since V is introspective. We have seen that RATM (ϕ) = ATM (ϕ ). Call this set A. Translate the resulting formula into DL-PA-PMP; we obtain tr fml A (ϕ ).

• In DEL-PAO, apply validities (Red ; ), (Red ), (Red * ) and (Red ? ) of Proposition 2.11 on page 50 to ϕ . We obtain a formula ϕ equivalent to ϕ and with the same atoms, but with only boolean operators and assignment programs.

In DL-PA-PMP, apply validities of Proposition 7.1 to tr fml A (ϕ ), without "breaking" sequences of assignments that originate from the same DEL-PAO assignment. (For example, suppose we translate [+JS p]S i p, we will obtain K JS p← ;S i p← S i p, with JS p← ; S i p← both originating from +JS p.) We obtain a new formula that is equivalent to tr fml A (ϕ ), and actually identical to the translation of ϕ (noted tr fml A (ϕ )) since, first, translations of program operators ;, , * and ? are homomorphic and second, because the equivalences that we apply are identical to the ones of Proposition 2.11.

Therefore we only need to prove that

We do it by induction on the form of ϕ (remember that it only contains boolean operators and assignments programs):

The proof is obvious if α is introspectively valid (as it translates to fail ) and similar to the case ϕ = [+α]ψ otherwise.

Therefore the translation is correct.

From DEL-PAO-PP

In DEL-PAO-PP, we consider public programs and epistemic operators. The formers will be translated homomorphically (except, as before, for assignments) to DL-PA-PMP public programs. We have already seen in DEL-PAO how to reduce epistemic operators to programs; we reuse these in DEL-PAO-PP. As epistemic operators do not modify the public information state and as we only keep indistinguishable worlds that are in this information state, we translate them to mentally executed programs, whose semantics fit perfectly. Take a DEL-PAO-PP formula ϕ. We define the following procedure of translation of ϕ into DL-PA-PMP.

Procedure 7.3.

1. translate ϕ into the DL-PA-PMP formula tr fml RATM (ϕ) (ϕ) according to the following definition:

where tr prg A (π) is defined as:

we have:

Proof. This is again due to translation being homomorphic for the given program operators, and because these equivalences are already valid in DEL-PAO-PP (see Section 6.4). The test is a special case that as we have seen, behaves like the public announcement of PAL. The last two equivalences are the counterparts of We prove the property by induction on the form of π.

• π = +α. Then tr prg A (π) = β 1 ← ; . . . ; β m ← with {β 1 , . . . , β m } = α ⇒ ∩ A. Hence since U, w P tr prg A (π) U , w , we have: for every u ∈ U , there is u ∈ U such that u = u ∪ (α ⇒ ∩ A), by the semantics of P tr prg A (π) . We have seen that this is equivalent to, for every u ∈ U , there is • The proofs for π = π 1 ; π 2 and π = π 1 π 2 are straightforward since their translation is homomorphic and the associated relation

is a composition or union of P tr prg A (π 1 ) and P tr prg A (π 2 ) .

• π = χ?. Like when assigning to false an introspectively valid atom, the proof is obvious if the program fails. Otherwise, we have seen that a public test can only shrink the public information state. Moreover w = w if and only if it satisfies χ, hence it is in the resulting state.

In all cases we have U ⊆ INTR| A and w ∈ U .

Lemma 7.3 implies that as we will start performing model checking in INTR| A , we will always stay in subset of this public information state, where all our properties apply.

Proof. We follow a procedure similar to the ones of propositions 7.2 and 7.4. First translate ϕ into DL-PA-PMP; we obtain tr fml A (ϕ). We have seen in Proposition 7.5 that epistemic operators are equivalent to their translation into mental programs on every public information state U ⊆ INTR| A , which are the only ones that are reachable by Lemma 7.3. Hence we focus on public programs.

We have shown with Proposition 7.6 that the properties for operators ;, and ? of DL-PA-PMP are identical to the ones of DEL-PAO-PP (see Section 6.4.2). Since their translation is homomorphic, we make the same reasoning than in previous sections: we remove them from ϕ, getting ϕ , and tr fml A (ϕ), getting tr fml A (ϕ ) and prove that the resulting formulas are equivalent:

for ϕ with boolean operators and public assignments and A = RATM (ϕ).

We do it by induction on the form of ϕ .

• The case when ϕ is boolean is the same as for Proposition 7.2 (because the translation is still homomorphic).

• ϕ = [+α!]ψ. Then we have tr fml

with {β 1 , . . . , β m } = α ⇒ ∩ A. Hence:

The proof is obvious if α is introspectively valid (as it translates to fail ) and similar to the case ϕ = [+α!]ψ otherwise.

Therefore the translation is correct.

The model checking problem

The model checking problem for DL-PA-PMP is defined as follows:

• Input: a couple w ∩ ATM (ϕ), ϕ where ϕ is a DL-PA-PMP formula and w is an introspective valuation;

• Output: yes if INTR, w |= ϕ, no otherwise.

Remember that DL-PA-PMP does not include epistemic or strategic operators; hence ATM (ϕ) = RATM (ϕ). The next section provides an algorithm that establishes the upper bound.

The PSPACE algorithm

In this section, we give the procedures performing the model checking algorithm on formulas of DL-PA-PMP. These formulas have been obtained from every language presented in the thesis by the translation presented in the previous section.

Let us define the size of a pair A, ϕ , with A ⊆ ATM a set of atoms and ϕ a formula, as the cardinality of A plus the length of ϕ (i.e., the number of symbols used to write it down). Note that the size of the translation ϕ of ϕ may be exponential in the size of ϕ because of the Proof. The critical case of procedure mc yes is when ϕ = K πm ψ. It was already proven that the procedure ispath yes without the case of the Kleene star * could be implemented by an alternating Turing machine in polynomial time [START_REF] Charrier | Arbitrary public announcement logic with mental programs[END_REF]. For the case of the star, remember that when running (∀) (∀) (∀)algo 1 and algo 2 or (∃) (∃) (∃)algo 1 or algo 2 , either algo 1 or algo 2 is executed, but not both. Hence in ispath yes , the procedure iter yes is called for only one value of i. For the same reason, the procedure survives yes runs in polynomial time.

The model checking of DL-PA-PMP is then in AP. Since AP = PSPACE [START_REF] Chandra | Alternation[END_REF], we have shown that our model checking is in PSPACE.

Conclusion

This technical chapter introduces an auxiliary logic into which every other logic presented in the thesis can be translated. We are not interested in concepts it may express or in a potential axiomatization (which might be difficult to find for the same reasons as for DEL-PAO-PP) but in the PSPACE complexity of its model checking as it proves the upper bound of the model checking problems of DEL-PAO, DEL-PAO S , DEL-PAOC and DEL-PAO-PP. We established this complexity by providing an alternating algorithm that runs in polynomial time.