Professeur Ridoux Olivier

Murano Aniello

Schnoebelen Philippe

Ceux De

Elisa Engel

Laura Gwezheneg

Enora Casey

Yann, Simon Jean-Joseph Bastien

Antoine Gurvan

Gaetan

« Complexité théorique du raisonnement en logique épistémique dynamique et étude d'une approche symbolique »

que j'entreprends. J'ai énormément de chance d'avoir une famille comme vous ! Je remercie également mes amis, en particulier ceux de Tours,

I would also like to thank the jury who participated in my PhD defense. Many thanks to Catalin Dima and Aniello Murano for reviewing my manuscript, your comments were truly insightful. I thank too the other members of the jury: Thomas Bolander, Olivier Ridoux, Philippe Schnoebelen and Hans van Ditmarsch for accepting the examination of my defense and for all your great comments during the defense. I also am honored to have the MAFTEC workshop co-organized with my PhD defense, and I thank a lot Frédéric Maris and François Schwarzentruber for the organization. I am also truly grateful to have had the opportunity to spend three months in Barcelona in the team of artificial intelligence lead by Anders Johnson. My main contact, Hector Geffner, is a warmful and nice person, who welcomed me with open arms, and gave me the opportunity to learn more about planning techniques. I also thank the other members of the research team in Barcelona. In particular I thank Filippos Kominis for all our interesting discussions about epistemic planning, and Guillem Frances for your help using your classical planner.

Je remercie tous les chercheurs et personnels de l'IRISA/INRIA que j'ai cotoyés pendant ces années, en particulier notre ancienne assistante Tifenn Donguy et notre nouvelle assistante Fanny Banor pour leur disponibilité et leur sympathie, les autres membres de [START_REF] Kordy | Foundations of Attack-Defense Trees[END_REF], où l'attaquant veut accéder par exemple à une ressource cachée, et doit infiltrer le bâtiment sans être repéré. Dans ce cas, il s'agit du point du vue opposé à la sécurité réseau, puisque c'est l'attaquant qui veut que le propriétaire ait le moins d'information possible sur ses agissements.

• Dans les jeux de société, comme les jeux de carte, la bataille navale, Cluedo, etc., les agents sont les joueurs. Par exemple dans les jeux de carte classiques, la main d'un joueur est la seule information qu'il possède au début de la partie. Au fur et à mesure que le jeu progresse, les agents acquièrent de la connaissance supplémentaire de part les actions et déclarations des autres joueurs. Il existe une panoplie de jeux de société qui sont pertinents car ils couvrent le champ des interactions possibles entre les joueurs. Par exemple Hanabi 1 est un jeu où la connaissance mutuelle entre les agents est centrale, car un joueur ne voit que les mains des autres joueurs, et les joueurs doivent collaborer pour gagner ensemble un maximum de points. Tragedy Looper 2 met également en jeu une notion de collaboration, mais les joueurs doivent ici collaborer contre un joueur isolé, appelé le mastermind. En effet, dans ce jeu, les joueurs ont une vue incomplète du scénario, et doivent s'assurer que le mastermind, qui lui a une vision complète du scénario, ne déclenche pas une condition de défaite. Ils peuvent jouer le scénario plusieurs fois (par une mécanique de voyage dans le temps dans le jeu) afin de gagner de plus en plus de connaissance sur le contenu du scénario. Le mastermind lui doit s'assurer que les joueurs déclenchent toujours une condition de défaite et obtiennent le moins de connaissance possible. Enfin, beaucoup de jeux existent autour de la communication, comme le jeu Loups-Garous de Thiercelieux 3 , où les joueurs ont tous un rôle caché, soit loup-garou soit villageois.

Les villageois doivent démasquer les loups-garous pendant les phases de jour et les loups-garous doivent manger les villageois pendant les phases de nuit. Dans ce jeu, la connaissance est obtenue par les interactions entre les joueurs mais également par les rôles d'information, comme la voyante qui peut regarder le rôle d'un joueur chaque nuit.

• Dans les jeux vidéos, les agents sont les joueurs et les personnages non-jouables (PNJ). Les PNJs ont une connaissance et une capacité de raisonnement limitées, mais il est pertinent de considérer les jeux vidéos comme des systèmes multi-agents lorsque les PNJs interagissent avec le joueur. Par exemple, dans les jeux de rôle massivement multi-joueur en ligne, les boss ont un mécanisme de menace qui leur permet de toujours attaquer le joueur qui représente la plus grande menace à leurs yeux. Il existe également des mécaniques plus sophistiquées, comme le boss notoire Dark Link tiré du jeu "The Legend of Zelda: Ocarina of Time" 4 . Sa vie se cale sur celle du joueur et il a une intelligence artificielle qui s'adapte à la façon d'attaquer du joueur. Par exemple si le joueur ne donne que des coups d'épée basiques, Dark Link va principalement bloquer les attaques.

Dans tous ces exemples, la notion de connaissance est centrale, en particulier la connaissance d'ordre supérieur, c'est à dire la connaissance que les agents ont à propos de la connaissance des autres agents. En effet, la connaissance d'ordre supérieur représente la façon que les agents ont de raisonner sur les autres agents. C'est donc une notion cruciale dans beaucoup des exemples cités au dessus, comme en sécurité où chaque agent doit raisonner sur la connaissance de l'autre agent, ou dans les jeux de carte pour concevoir des stratégies pertinentes. De plus, la dynamique est également importante, puisque les agents communiquent et agissent sur le système. Quelques exemples d'actions dynamiques seraient l'envoi d'un message, l'ouverture d'une porte, le déplacement d'un objet, le jeu d'une carte, le lancer d'un sort dans un jeu vidéo, etc. C'est pourquoi nous voulons exprimer les actions des agents dans les systèmes multi-agents.

Tout au long du document, nous nous focalisons sur la vérification de propriétés mettant en jeu de la connaissance dans les systèmes multi-agents. Puisque nous avons besoin d'exprimer la connaissance et des actions dynamiques, nous choisissons d'utiliser la logique épistémique dynamique qui exprime les deux. Nous étudions le problème de vérification de modèles, mais également le problème d'existence d'un modèle, appelé problème de satisfiabilité. Nous étudions également leurs variantes symboliques. Nous allons aussi plus loin en considérant des variantes stratégiques de la logique épistémique dynamique, comme la planification épistémique ou les actions arbitraires.

Notions introduites dans le document

Logique épistémique Dans le document, nous mettons en avant l'utilisation de la logique pour exprimer des propriétés dans les systèmes multi-agents. En effet, la logique 4. Édité par Nintendo.

donne un langage de spécification, et est utile pour définir des procédures de vérification, puisque sa définition claire permet d'écrire naturellement ces procédures.

Nous considérons la logique épistémique introduite par Hintikka [START_REF] Hintikka | Knowledge and belief. An introduction to the logic of the two notions[END_REF]. Elle étend la logique propositionnelle avec des opérateurs de connaissance, comme K a pour "L'agent a sait que". Toutes les valeurs considérées sont booléennes, ce qui veut dire que les deux seules valeurs possibles sont vrai ( ) ou faux (⊥). Nous pouvons ainsi exprimer toute variable avec une valeur sur un domaine fini, comme les entiers bornés par exemple en utilisant plusieurs variables booléennes. En revanche, nous ne pouvons pas exprimer les valeurs dans des domaines infinis, comme les rationnels ou les réels.

L'opérateur K a est appelé une modalité. En effet, la logique épistémique est un type spécial de logique modale (cf par exemple [START_REF] Blackburn | Handbook of modal logic[END_REF] pour plus d'information sur la logique modale) où les seules modalités sont K a . La différence principale entre la logique propositionnelle et la logique modale réside dans l'interprétation des formules. Alors que les formules propositionnelles sont évaluées sur les interprétations des variables (appelées valuations), les formules modales sont évaluées sur ce que l'on appelle des modèles de Kripke.

Ces modèles peuvent être vus comme des graphes où chaque noeud (appelé monde) possède une valuation et représente une configuration possible, par exemple le contenu des mains des joueurs. Les arcs représentent quels mondes les agents imaginent comme possibles, de telle manière que K a est interprété comme " pour tous les mondes imaginés comme possibles par l'agent a, . . . ". Les systèmes multi-agents sont alors représentés par des modèles de Kripke et les propriétés sont des formules de la logique épistémique.

Pour plus d'information à propos de la logique épistémique, le lecteur peut se référer aux livres [START_REF] Fagin | Reasoning about Knowledge[END_REF][START_REF] Meyer | Epistemic logic for AI and computer science[END_REF] qui décrivent des travaux classiques sur la logique épistémique, ou à l'article [vV02]. Plus récemment, le livre [START_REF] Ditmarsch | Handbook of epistemic logic[END_REF] couvre également la logique épistémique et plusieurs de ses extensions.

Néanmoins la logique épistémique a plusieurs limitations. En effet, les agents sont supposés rationnels et ont une connaissance parfaite du modèle de Kripke. Plusieurs extensions de la logique épistémique existent pour résoudre ces problèmes. Par exemple l'article [START_REF] Fagin | Belief, Awareness, and Limited Reasoning[END_REF] introduit une extension de la logique épistémique où les agents peuvent être ignorants de l'existence de propositions atomiques, et ont des capacités de raisonnements limitées, ce qui signifie qu'ils ne peuvent pas déduire toutes les implications logiques. De plus, la logique épistémique ne se focalise par sur pourquoi les agents savent une propriété. La logique de justification [START_REF] Artëmov | Justification Logic[END_REF] définit un mécanisme de justification de la connaissance des agents. Pour citer un article plus récent, l'article [START_REF] Seligman | Call Me by Your Name: Epistemic Logic with Assignments and Non-rigid Names[END_REF] propose une logique où les noms des agents ne sont pas connaissance commune, faisant ainsi une distinction entre "savoir que l'agent a a commis un crime sans connaître son nom" et "savoir qu'un agent nommé a a commis un crime sans savoir qui c'est." Dans le document, nous ne considérons pas ces extensions pour garder une logique simple et considérons la définition usuelle de la logique épistémique.

Connaissance commune La connaissance commune a d'abord été définie formellement dans [START_REF] Robert J Aumann | Agreeing to disagree[END_REF]. On dit qu'une formule est connaissance commune si elle est vraie dans chaque monde possible. On peut également définir la connaissance commune par une conjonction de formules de la forme "tout le monde sait que tout le monde sait que . . . ". La notion de connaissance commune en logique épistémique est très proche de l'opérateur AG de CTL (cf [START_REF] Baier | Principles of model checking[END_REF] pour plus d'information sur les logiques temporelles). Les deux opérateurs peuvent être vus comme des opérateurs de point fixe comme ceux du µ-calcul [START_REF] Vaughan | A Decidable mu-Calculus: Preliminary Report[END_REF].

Dans le document, tous les chapitres excepté le Chapitre 4 autorisent l'opérateur de connaissance commune dans la logique.

Vérification de modèles et satisfiabilité

Quand on définit une logique, il est classique d'étudier ses propriétées computationnelles. Ici, nous considérons une approche similaire à [START_REF] Halpern | Model Checking vs. Theorem Proving: A Manifesto[END_REF] en définissant le problème de vérification de modèles. Ce problème prend en entrée un modèle et uen formule et vérifie si la formule est vraie dans ce modèle. Nous prouvons d'ailleurs en Annexe C que le problème est dans P pour la logique épistémique, avec une preuve très similaire à celle pour CTL. Pour un rappel sur la complexité computationnelle, le lecteur peut se référer à l'Annexe A.

Un autre problème classique est de vérifer la satisfiabilité d'une formule, c'est à dire trouver un modèle de Kripke satisfaisant la formule. En réalité, le problème de satisfiabilité est dual au problème de preuve de théorème, puisqu'une formule ϕ est valide si et seulement si ¬ϕ n'est pas satisfiable. Pour la logique épistémique, le problème de satisfiabilité est Pspace-complet sans connaissance commune, avec au moins deux agents et pour des modèles S5 5 [START_REF] Halpern | A Guide to Completeness and Complexity for Modal Logics of Knowledge and Belief[END_REF].

Il est également classique de définir l'axiomatisation de la logique. Il s'agit d'un ensemble d'axiomes et de règles qui illustrent la construction de formules prouvables (cf 5. c'est à dire des modèles de Kripke avec des arcs qui forment une relation d'équivalence. [START_REF] Fagin | Reasoning about Knowledge[END_REF] pour la logique épistémique). Nous établissons généralement si cette axiomatisation est correcte (chaque formule prouvable est valide) et complète (chaque formule valide est prouvable). Lorsqu'une axiomatisation correcte et complète est proposée, il est parfois possible de définir alors un algorithme de preuve de théorème qui vérifie la validité de formules en utilisant l'axiomatisation. La différence principale avec la vérification de modèles est que l'on prouve alors la validité de la formule en entrée au lieu de sa satisfaction dans un modèle donné. Si nous voulons alors utiliser la preuve de théorème pour vérifier une formule ϕ dans un modèle, nous devons caractériser le modèle par une formule ϕ M et prouver la validité de ϕ M → ϕ. La preuve de théorème étant duale à la satisfiabilité, la vérification de modèles est en général un problème plus simple. C'est pourquoi nous n'utilisons pas la preuve de théorème ici, car ce serait un problème trop difficile pour l'utilisation que l'on compte en faire.

Modèles symboliques Lorsque l'on souhaite utiliser la vérification de modèles et la satisfiabilité en pratique, nous nous heurtons généralement à l'explosion combinatoire des modèles de Kripke. Par exemple dans les jeux de carte, quand il y a k joueurs et n cartes, le nombre de propositions atomiques est généralement k × n. Si l'on considère un jeu de tarot classique avec 5 joueurs, le nombre de mondes possibles serait alors environ 6 × 10 48 , ce qui est du même ordre de grandeur que le nombre d'atomes sur Terre. Il paraît donc déraisonnable de manipuler les modèles explicitement.

Pour cette raison, nous proposons une représentation symbolique des modèles de Kripke, ce qui évite de les définir à la main. De telles représentations existent déjà pour d'autres formalismes, comme les circuits booléens pour les chemins Hamiltoniens dans les graphes [START_REF] Papadimitriou | Computational complexity[END_REF]. Généralement, une représentation symbolique définit un modèle par des formules booléennes au lieu de définir le modèle de façon explicite. Par exemple l'article [START_REF] Burch | Symbolic Model Checking: 10ˆ20 States and Beyond[END_REF] donne une représentation symbolique des modèles pour les logiques temporelles. Il est alors possible d'utiliser des structures de données appelées des diagrammes de décision binaires ordonnés et réduits [START_REF] Drechsler | Binary Decision Diagrams -Theory and Implementation[END_REF] (ROBDDs), afin d'implémenter les représentations symboliques.

Cela peut paraître surprenant de considérer des procédures de vérification avec des modèles symboliques en entrée, car cela peut paraître très similaire à la méthode de preuve de théorème mentionnée précédemment. La différence principale est que la description des modèles (donnée par des ROBDDs par exemple) n'est pas écrite dans le même langage que la formule (par exemple en logique épistémique), cela aurait donc peu de sens d'essayer de prouver ϕ M → ϕ avec ϕ M la représentation symbolique du modèle de Kripke M.

Pour la logique épistémique, plusieurs approches symboliques existent déjà, qui sont décrites plus en détail dans le Chapitre 3. La première approche définie associe les mondes à des valuations et les agents observent un ensemble de propositions atomiques [START_REF] Wiebe Van Der Hoek | Knowledge and control[END_REF][START_REF] Wiebe Van Der Hoek | A logic of revelation and concealment[END_REF][START_REF] Ågotnes | Boolean Games with Epistemic Goals[END_REF]. Dans ce cas, un modèle de Kripke est seulement défini par l'ensemble des mondes et les propositions que chaque agent observe, les relations épistémiques étant alors inférées des ensembles d'observation. En outre, l'article [START_REF] Gasquet | Big Brother Logic: visual-epistemic reasoning in stationary multi-agent systems[END_REF] étend cette idée en considérant des agents dans un espace de dimension 2 qui peuvent seulement voir un cône devant eux. Enfin, l'article [START_REF] Herzig | A Poor Man's Epistemic Logic Based on Propositional Assignment and Higher-Order Observation[END_REF] considère une représentation des relations épistémiques avec des variables de la forme S a p pour "l'agent a perçoit la valeur de p" qui peuvent être d'ordre supérieur comme S a S b p pour "l'agent a perçoit la valeur de S b p".

Ici, nous utilisons une approche symbolique qui utilise les programmes de la logique dynamique avec des affectations propositionnelles (DL-PA [START_REF] Balbiani | Dynamic Logic of Propositional Assignments: A Well-Behaved Variant of PDL[END_REF]), qui sont des programmes particuliers de la logique dynamique propositionnelle (PDL [START_REF] Michael | Propositional Dynamic Logic of Regular Programs[END_REF]) où les programmes atomiques sont des affectations propositionnelles. Même si ce ne sont pas directement des formules booléennes, ces programmes peuvent être traduits en formules booléennes classiques afin d'utiliser des techniques ROBDDs 6 . Cette approche a les avantages habituels des modèles symboliques : ils peuvent exprimer n'importe quel modèle, ils sont succincts, et ils permettent une représentation simple des exemples habituels de la logique épitémique.

Dynamique dans la logique épistémique Comme souligné dans le paragraphe sur la logique épistémique, on ne peut pas y exprimer la dynamique dans les modèles. Nous considérons ici la logique épistémique dynamique. C'est un terme parapluie pour toutes les extensions de la logique épistémique avec des opérateurs dynamiques. Les extensions de la logique épistémique avec de la dynamique sont fortement inspirées de la logique dynamique comme définie dans [START_REF] Michael | Propositional Dynamic Logic of Regular Programs[END_REF].

Initialement, la première occurrence d'opérateurs dynamiques dans la logique épistémique reposait sur les annonces publiques (la logique associée est nommée PAL) [START_REF] Plaza | Logics of public communications[END_REF] 7 . Cela correspond à des diffusions de propriétés vraies à tous les agents. Par exemple dans un jeu vidéo, si un joueur dit "le boss est au milieu attention !", tous les joueurs sauront maintenant que le boss est au milieu. Dans ce cas, si le boss est également considéré comme un agent, nous pouvons considérer que le boss sait maintenant que les joueurs savent sa position, donc il peut agir en conséquence en se cachant par exemple.

La logique épistémique dynamique comme référéee dans le reste du document (appelée DEL) étend PAL en considérant des événements plus riches (annonces privées par exemple), l'article fondateur étant [START_REF] Baltag | The Logic of Public Announcements and Common Knowledge and Private Suspicions[END_REF]. Un événement est maintenant représenté par un graphe, similairement aux modèles de Kripke, et est appelé un modèle d'événement. Dans ce modèle, chaque noeud est un événement possible et les arcs, étiquetés par des agents, représentent les événements que les agents imaginent comme possible. Par exemple, dans l'exemple du boss, le modèle d'événement pour "il y a une annonce que le boss n'entend pas" contiendrait deux événements : l'événement "annoncer que le boss est au milieu" et l'événement "rien n'est dit", et le boss penserait que le deuxième événement est celui exécuté. De plus, les événements peuvent modifier le monde (on dit alors qu'ils sont ontiques). Par exemple, jouer une carte est un événement ontique, car la carte n'est plus dans la main du joueur qui l'a jouée. La logique DEL étend alors la logique épistémique avec l'opérateur "après l'exécution du modèle d'événement E . . . ".

Comme pour la logique épistémique, on peut définir les problèmes de vérification de modèles et de satisfiabilité pour DEL. Il est déjà prouvé que sans connaissance commune, le problème de vérification de modèles est Pspace-complet et le problème de satisfiabilité est NExptime-complet [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF]. Toutefois, ce résultat n'est pas pour DEL en soi mais pour une variante légèrement plus riche où les modèles d'événement sont multi-pointés. Cela signifie que lorsque l'on applique un modèle d'événement, le choix de l'événement appliqué dans le monde courant est non déterministe. Par exemple le modèle d'événement "lancer un dé" aurait six événements pointés, un pour chaque valeur possible. En réalité, l'article [START_REF] De | On the Computational Complexity of Model Checking for Dynamic Epistemic Logic with S5 Models[END_REF] prouve que le problème de vérification de modèles est Pspace-dur pour des modèles d'événement multi-pointés, S5, non-ontiques, et avec deux agents.

Pour plus d'information sur la logique épistémique dynamique, le lecteur peut se référer à [START_REF] Baltag | The Logic of Public Announcements and Common Knowledge and Private Suspicions[END_REF], qui est le livre de référence sur DEL. Comme cité aupravant, le livre [START_REF] Ditmarsch | Handbook of epistemic logic[END_REF] traite également de DEL.

Pour citer des variantes de DEL, il existe la variante probabiliste de PAL [START_REF] Barteld | Probabilistic Dynamic Epistemic Logic[END_REF], ainsi que la logique épistémique dynamique temporelle [START_REF] Renne | Dynamic Epistemic Temporal Logic[END_REF] qui étend DEL avec des opérateurs temporels. De plus, il a été prouvé récemment que la logique de description de jeux III (GDL-III [START_REF] Thielscher | GDL-III: A Proposal to Extend the Game Description Language to General Epistemic Games[END_REF]), une logique pour exprimer des jeux avec des aspects épistémiques, est aussi expressive que DEL [START_REF] Engesser | Game Description Language and Dynamic Epistemic Logic Compared[END_REF].

Planification épistémique La planification est un domaine en intelligence artificielle où le problème de décision habituel est, donnés une situation initiale, des actions et un but, de déterminer si l'on peut trouver une séquence de ces actions pour atteindre le but.

La forme la plus connue de la planification est appelée la planification classique, en particulier le langage de résolution de problème de Stanford Research Institute (STRIPS [START_REF] Fikes | STRIPS: A New Approach to the Application of Theorem Proving to Problem Solving[END_REF]). Dans STRIPS, la situation initiale est représentée par une valuation, les actions ont seulement des préconditions/effets propositionnels et le but est une formule propositionnelle. Une vaste littérature existe à ce sujet, et un langage de spécification commun a été défini pour les planificateurs, appelé langage de description de domaine de planification (PDDL [START_REF] Mcdermott | PDDL-the planning domain definition language[END_REF]). Ici, on s'intéresse à la planification épistémique. Cela signifie que les problèmes de planification doivent prendre en compte des aspects épistémiques. La planification épistémique est une notion vaste, et a une communauté active. Nous résumons ici le groupe de discussion du séminaire Dagstuhl sur les méthodes pour la planification épistémique ([Bar+17] Section 4.4) que j'ai coordonné. Nous laissons de côté les aspects mono-agents.

La planification épistémique considérée dans le document est celle basée sur DEL. Cela signifie que nous considérons en entrée un modèle de Kripke, des modèles d'événements pour les actions, et une formule épistémique pour le but. Malheureusement, la planification épistémique basée sur DEL est indécidable dans le cas général [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF], y compris lorsqu'il n'y a pas de connaissance d'ordre supérieur dans les formules des modèles d'événement. [START_REF] Bolander | Epistemic planning for single and multi-agent systems[END_REF]. Néanmoins, quand les modèles d'événement ont seulement des formules propositionnelles, la planification épistémique devient décidable [START_REF] Yu | Multi-Agent Epistemic Explanatory Diagnosis via Reasoning about Actions[END_REF] (plus précisément non-élémentaire [START_REF] Douéneau-Tabot | Chain-Monadic Second Order Logic over Regular Automatic Trees and Epistemic Planningn Synthesis[END_REF]). En outre, lorsque les modèles d'événements sont propositionnels et non-ontiques, il a été prouvé que la planification épistémique est dans Expspace [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF]. Nous prouvons en réalité dans [START_REF] Charrier | On the Impact of Modal Depth in Epistemic Planning[END_REF] que la planification épistémique est Pspace-complète dans ce cas, et expliquerons ce résultat en détail dans le Chapitre 4.

Pour contourner le problème de complexité, d'autres approches ont été considérées pour la planification épistémique basée sur DEL. Elles utilisent principalement des compilations syntaxiques vers la planification classique, utilisant en général PDDL. Le point commun de ces approches est que l'expressivité est restreinte afin d'être applicable. Le travail de [START_REF] Muise | Planning Over Multi-Agent Epistemic States: A Classical Planning Approach[END_REF] considère par exemple des modèles d'événement avec un seul événement et des effets conditionnels, ce qui produit une traduction exponentielle vers la planification classique. Dans [START_REF] Kominis | Beliefs In Multiagent Planning: From One Agent to Many[END_REF], les auteurs considèrent des annonces publiques, des affectations publiques et des annonces semi-privées 8 , et ont une réduction polynomiale à la planification classique 9 . Dans [START_REF] Cooper | A Simple Account of Multi-Agent Epistemic Planning[END_REF], les auteurs considèrent les variables S i p pour décrire les modèles. D'autres approches existent pour résoudre la planification épistémique qui ne se basent pas sur DEL. Par exemple, il est possible de faire de la planification épistémique en étendant la logique temporelle alternante (ATL [START_REF] Alur | Alternatingtime temporal logic[END_REF]) avec des opérateurs épistémiques (AETL). ATL est elle même une extension de CTL [START_REF] Baier | Principles of model checking[END_REF] avec des modalités dynamiques pour exprimer l'existence de stratégies dans les jeux. Avec cette modélisation, on peut exprimer qu'un groupe d'agents a une stratégie pour atteindre une formule ϕ, ce qui correspond bien à la planification quand il n'y a pas d'adversaire. Cela permet d'exprimer également des propriétés plus fortes que juste la planification, comme l'existence de stratégies gagnantes par exemple. Le vérificateur MCMAS [START_REF] Lomuscio | MCMAS: an opensource model checker for the verification of multi-agent systems[END_REF] permet de résoudre AETL, mais a de fortes limitations : les modèles sont nécessairement S5, et la connaissance n'a pas de rappel parfait (puisque sinon cela devient indécidable [START_REF] Dima | Model-checking ATL under Imperfect Information and Perfect Recall Semantics is Undecidable[END_REF]), ce qui signifie que les agents oublient une partie de l'historique des actions. En particulier, on ne peut pas exprimer la planification épistémique basée sur DEL ainsi, puisqu'elle a intrinsèquement un rappel parfait. De plus, le modèle doit être régulier (décrit par un automate à états finis), ce qui n'est pas toujours le cas pour DEL.

Il est également possible d'exprimer la planification épistémique en utilisant des techniques par automate pour utiliser la vérification de modèles de CTL * K n [START_REF] Bozzelli | Uniform strategies, rational relations and jumping automata[END_REF]. Cela est possible par exemple lorsque les modèles sont propositionnels [START_REF] Aucher | Automata Techniques for Epistemic Protocol Synthesis[END_REF][START_REF] Douéneau-Tabot | Chain-Monadic Second Order Logic over Regular Automatic Trees and Epistemic Planningn Synthesis[END_REF]. Malheureusement, cette approche ne va pas plus loin. D'autres techniques existent mais sont trop éloignées par rapport à la planification épistémique considérée dans ce document. Le lecteur peut se référer à [START_REF] Baral | Epistemic Planning (Dagstuhl Seminar 17231)[END_REF] pour plus d'information, puisque cet article sonde les techniques existantes pour la planification épistémique.

Annonces publiques arbitraires A cause de l'indécidabilité de la planification épistémique, nous étudions une classe plus restreinte de modèles d'événements. Des extensions de PAL existent pour exprimer l'existence d'une annonce publique. La logique correspondante est APAL [START_REF] Balbiani | Knowable' as 'known after an announcement[END_REF], l'extension de PAL avec l'opérateur d'existence d'annonce (appelé an-8. Annonce à un groupe d'agents d'une formule ϕ, les autres agents sachant que ϕ ou ¬ϕ a été annoncée sans savoir la valeur. 9. Ce qui n'est pas surprenant, dans le Chapitre 4 nous prouvons que leur article s'exprime en planification épistémique avec des événements séparables. nonce arbitraire). Une autre variante a été considérée : la logique d'annonce de groupe [Ågo+10] (GAL), où l'on ne quantifie pas sur toutes les annonces possibles mais seulement sur celles qui peuvent être faites par un certain groupe d'agents.

Malheureusement, les problèmes de satisfiabilité pour APAL et GAL sont indécidables [START_REF] French | Undecidability for arbitrary public announcement logic[END_REF][START_REF] Ågotnes | Group announcement logic[END_REF]. Ce n'est pas un problème si l'on veut voir APAL comme une autre façon de faire de la planification épistémique, comme le modèle de Kripke est donné en entrée.

Toutefois, APAL et GAL sont loin de la planification épistémique basée sur DEL, comme ils permettent seulement d'exprimer des annonces publiques, et ne permettent pas d'exprimer l'existence d'une séquence d'annonces.

Contribution

Dans ce document, nous étudions les problèmes de décision pour la logique épistémique dynamique mentionnés précédemment : la vérification de modèles et la satisfiabilité. Nous étudions également le problème de planification épistémique basé sur la logique épistémique dynamique, et des extensions de la logique épistémique avec quantification sur les annonces publiques. Enfin, nous définissons une représentation symbolique des modèles de Kripke et des modèles d'événements, et étudions son impact sur l'expressivité et sur la complexité algorithmique. Tout au long du document, nous donnons des exemples de jeux et de puzzles car ils sont intuitifs et mettent en jeu les problèmes que nous souhaitons discuter, comme par exemple l'interaction entre les agents. Nous décrivons maintenant la contribution de la thèse et le contenu de chaque chapitre de la partie en anglais.

Introduction Context

The concept of multi-agent system is commonly accepted as a representation of many examples of real-life systems where autonomous entities, the agents, act according to their knowledge of the actual world in order to achieve individual or collective goals.

Let us consider examples of multi-agent systems.

• In multi-robot systems, the agents are robots that gather knowledge from the environment they perceive with their sensors and from the information obtained via communication channels [START_REF] Lemaignan | Human-Robot Interaction: Tackling the AI Challenges[END_REF]. They also need to take into account other agents, in particular human agents, to fulfill their objectives. For instance, Lemaignan et al. [START_REF] Lemaignan | ORO, a knowledge management platform for cognitive architectures in robotics[END_REF] give an example of knowledge management in multi-robot systems to take into account interactions with a human agent. Their system contains a notion of knowledge base the robot has about the environment. The field of distributed intelligence is dedicated precisely to this matter, having direct applications in multi-robot systems [START_REF] Parker | Distributed intelligence: Overview of the field and its application in multi-robot systems[END_REF].

• In board games, like card games, Battleship, Clue, etc., the agents are the players. For instance in classical card games, the hand of a player is the only information he perceives at first. When the game goes on, the agents also acquire additional knowledge by other players' statements and actions. There exists a variety of board games that are relevant because they cover the spectrum of possible interactions between players. For instance in Hanabi10 , there is a heavy focus on mutual knowledge between agents, because a player only sees the hands of the other players, and the players must collaborate to collectively earn a maximum of points. Tragedy Looper11 also features a notion of collaboration, but the players act together against an isolated player, the mastermind. Indeed, in this game, the players have an incomplete view about the scenario, and have to ensure that they do not let the mastermind trigger a defeat condition. They can play the scenario several times (in the game by a time travel mechanic) and collaborate to gain knowledge about the content of the scenario. The mastermind, on the other side, must ensure that the players always trigger a defeat condition and gain as little knowledge as possible. Finally, a lot of communication games exist, like the werewolf game, where all players have a hidden role and can be either a werewolf or a villager. The villagers must find the werewolves during the day phase and the werewolves must eat the villagers during the night phase. In this game, the knowledge is obtained by interactions between players but also by information roles, like the fortune teller who can see a role each turn.

• In video games, the agents are the players and the non-playable characters (NPC). The NPCs may have limited knowledge and capacities of reasoning, but it is relevant to consider the game as a multi-agent system when the NPCs interact with the players. For instance, in many massively multi-player online role-playing games (MMORPGs), the bosses have a threat mechanism that allows them to attack the player that represents the biggest threat. Also, there exist more sophisticated behaviors for NPCs, as the notorious boss Dark Link from the game "The Legend of Zelda: Ocarina of Time"12 . His health scales to the player's and he has a AI that adapts to the way the player is attacking. For instance, if the player only does basic sword attacks, Dark Link will mainly block attacks.

In all these examples, the notion of knowledge is central, in particular nested knowledge i.e. knowledge agents have about the knowledge of other agents. Indeed, nested knowledge represents the way agents reason about the reasoning of other agents. It is central in many examples cited above, as in security where each agent needs to reason about the other agent's knowledge, or card games in order to design meaningful strategies. Furthermore, dynamics is also important, since agents communicate and act on a system. Some examples of dynamic actions are sending a message, opening a door, moving an object, playing a card, casting a spell in a video game, etc. Therefore, we aim at expressing the actions of agents in a multi-agent system.

Through the manuscript, we focus on the verification of properties involving knowledge in multi-agent systems. We need to express knowledge and dynamic actions, therefore we choose to use dynamic epistemic logic featuring both. It is an extension of epistemic logic with dynamic operators. We study the verification problem, called model checking and also the existence of a model, called the satisfiability problem, and their symbolic counterparts. We also go further by studying strategic variants of dynamic epistemic logic, like epistemic planning or arbitrary actions.

Notions introduced in the manuscript

Epistemic logic In this manuscript, we advocate for the use of logic to express properties in multi-agent systems. Indeed, logic provides a clear specification language, and is handy to define verification procedures, since its clear definition allows to write verification algorithms.

We consider epistemic logic as introduced by Hintikka [START_REF] Hintikka | Knowledge and belief. An introduction to the logic of the two notions[END_REF]. It extends propositional logic with knowledge operators, such as K a for "Agent a knows that". All considered variables will be boolean, meaning that the only two values are true ( ) or false (⊥). We can express every variable on a finite domain, as bounded integers, by using several variables. We cannot express infinite domains though, as rational or real numbers.

The operator K a is called a modality. Indeed, epistemic logic is a special type of modal logic (read for instance [START_REF] Blackburn | Handbook of modal logic[END_REF] for more information about modal logic) where the only modalities are K a . The main difference between propositional logic and modal logic is the interpretation of formulas. As a propositional formula (also called boolean formula) is evaluated over interpretations for variables (called valuations), modal formulas are evaluated over so-called Kripke models. Such models can be seen as graphs where each node (called a world) has a valuation and represent a possible setting, for instance which cards players own in a card game. The edges represent which worlds agents imagine as possible, so that K a is interpreted as "for all worlds imagined as possible by Agent a, . . . ". Multi-agent systems are then represented by Kripke models and the properties are formulas in epistemic logic.

For more information about epistemic logic, the reader may refer to any the books [Fag+95; MV04] that browse classical works about epistemic logic, or the survey [vV02]. More recently, the book [Dit+15] also covers epistemic logic and many of its extensions.

However epistemic logic has some limitations. Indeed, agents are supposed to be rational and to have a perfect knowledge of the Kripke model. Some extensions of epistemic logic exist to solve these issues. For instance, the paper [START_REF] Fagin | Belief, Awareness, and Limited Reasoning[END_REF] introduces an extension of epistemic logic where agents may be unaware of the existence of atomic propositions, and have limited capacities of reasoning, meaning that they cannot deduce all logical validities. Also, epistemic logic does not focus on why the agents know a fact. Justification logic [START_REF] Artëmov | Justification Logic[END_REF] is a way of defining a justification of their knowledge when agents know a fact. To cite a more recent work, the paper [START_REF] Seligman | Call Me by Your Name: Epistemic Logic with Assignments and Non-rigid Names[END_REF] proposes a logic where agents' names are not known by all agents, making a distinction between "knowing that a committed a crime and not knowing his name" and "knowing that an agent named a committed a crime without knowing who he is".

In the manuscript, we do not consider all these extensions to keep a simple logic and stick to the usual definition of epistemic logic.

Common knowledge

Common knowledge has been first defined formally in [START_REF] Robert J Aumann | Agreeing to disagree[END_REF]. A formula is common knowledge if it is true in every possible world. It can be defined as an infinite conjunction of formulas of the form "everyone knows that everyone knows that . . . " which is an equivalent definition.

verification problem called the model checking problem. It takes as input a Kripke model and a formula and verifies whether the formula is true in the current model. We prove in Appendix C that the model checking problem for epistemic logic with common knowledge is in P, which is very similar to the proof for the model checking of CTL. For a reminder on computational complexity, the reader may refer to Appendix A.

Another classical problem is to check the satisfiability of a formula, meaning finding a Kripke model satisfying a formula. In fact, the satisfiability problem is dual to the theorem proving problem, since a formula ϕ is valid if and only if ¬ϕ is not satisfiable. For epistemic logic, the satisfiability without common knowledge is known to be Pspace-complete, for at least two agents and for S5 models 13 [START_REF] Halpern | A Guide to Completeness and Complexity for Modal Logics of Knowledge and Belief[END_REF].

It is also common to define the axiomatization of the logic. It consists in a set of axioms and rules that illustrate how to construct provable formulas (see [START_REF] Fagin | Reasoning about Knowledge[END_REF] for epistemic logic). We establish whether it is sound (any provable formula is valid) and complete (any valid formula is provable). When a sound and complete axiomatization is provided, it may lead to a theorem proving algorithm, that checks the validity of the formula using the axiomatization. The main difference with model checking is that we prove the validity of a formula instead of verifying it in a given model. Therefore, if we would like to use theorem proving to verify a formula ϕ in a model, we would need to characterize the model by a formula ϕ M and prove the validity of ϕ M → ϕ. Theorem proving is dual to satisfiability, so in fact model checking is a simpler problem. That is why we do not use theorem proving instead of model checking because it would be a sledgehammer.

Symbolic models

When we want to use model checking and satisfiability approaches in practice, we have to deal with combinatorial explosion in the size of Kripke models. For instance in card games, when there is k players and n cards, the number of atomic propositions is usually k × n. If we consider a classical tarot card game with 5 players, the number of possible worlds would be approximately 6 × 10 48 , which is the same order of magnitude than the number of atoms in Earth. It thus seems rather unrealistic to define the input Kripke models explicitly.

For this reason, we propose to use a symbolic representation of the Kripke models, that avoids defining models completely by hand. Such representations already exist for other formalisms, such as boolean circuits for searching for Hamiltonian paths in graphs [START_REF] Papadimitriou | Computational complexity[END_REF]. Usually, a symbolic representation of models consists in describing the input model with boolean formulas instead of describing it explicitly. For example, the paper [START_REF] Burch | Symbolic Model Checking: 10ˆ20 States and Beyond[END_REF] gives a symbolic representation of models for temporal logics. For symbolic representations, it is possible to use data structures known as reduced and ordered binary decision diagrams [START_REF] Drechsler | Binary Decision Diagrams -Theory and Implementation[END_REF] (ROBDDs) to implement symbolic representations.

It may seem surprising to consider model checking procedures with symbolic inputs, as it looks very similar to theorem proving as mentioned before. Yet, the difference is that the description of the model (given with ROBDDs, etc.) is not written in the same language as the formula (e.g. in epistemic logic), so it would not make sense to try to prove ϕ M → ϕ with ϕ M the symbolic representation of the Kripke model M.

For epistemic logic, many symbolic approaches already exist, described in more depth in Chapter 3. The first approach defines worlds as valuations and agents observe a set of atomic propositions [START_REF] Wiebe Van Der Hoek | Knowledge and control[END_REF][START_REF] Wiebe Van Der Hoek | A logic of revelation and concealment[END_REF][START_REF] Ågotnes | Boolean Games with Epistemic Goals[END_REF]. In this case, only the set of worlds is needed, so a Kripke model is only the data of the set of worlds, and for each agent the set of propositions he observes, the edges being inferred from the observation set. Also the paper [START_REF] Gasquet | Big Brother Logic: visual-epistemic reasoning in stationary multi-agent systems[END_REF] extends this idea sightly by considering agents in a two-dimensional space that can only see inside a cone in front of them. Finally, [START_REF] Herzig | A Poor Man's Epistemic Logic Based on Propositional Assignment and Higher-Order Observation[END_REF] considers a representation of the epistemic relations with "seeing"-variables of the form S a p for "Agent a perceives the value of p" that may be of higher-order like S a S b p for "Agent a perceives the value of S b p".

Here, we use a symbolic approach using programs of Dynamic Logic with Propositional Assignments (DL-PA [START_REF] Balbiani | Dynamic Logic of Propositional Assignments: A Well-Behaved Variant of PDL[END_REF]), that are particular programs of Propositional Dynamic Logic (PDL [START_REF] Michael | Propositional Dynamic Logic of Regular Programs[END_REF]) where atomic programs are propositional assignments. While not directly boolean formulas, they can be translated into classical boolean formulas so that BDD techniques may be used14 . The advantage of this approach is that it has the usual properties of symbolic models: they can express any model, they are succinct, and they allow for a simple representation of usual examples of epistemic logic.

Dynamics in epistemic logic

As highlighted in the epistemic logic paragraph, epistemic logic is not sufficient to express the dynamics in models. We consider here the so-called dynamic epistemic logic. It is an umbrella term for all extensions of epistemic logic with dynamic operators. The extensions of epistemic logic with dynamics are strongly inspired from dynamic logic [START_REF] Michael | Propositional Dynamic Logic of Regular Programs[END_REF].

Originally, the first occurrence of dynamic operators for epistemic logic relied on public announcements (the logic is called PAL for Public Announcement Logic) [START_REF] Plaza | Logics of public communications[END_REF] 15 . It corresponds to broadcasting true properties to all agents. For instance, in a video game, if a player says "the boss is in the middle watch out!", all players will now know that the boss is in the center. In that case, if the boss is also considered as an agent, we would consider that the boss also knows that players know his position, so he may act accordingly by hiding for instance.

The dynamic epistemic logic as referred in the rest of the manuscript (called DEL) extends PAL by considering richer types of events (private announcements, etc.), the paper [START_REF] Baltag | The Logic of Public Announcements and Common Knowledge and Private Suspicions[END_REF] being the milestone. An event is now represented as a graph, alike Kripke models, and is called event model. In this model, each node is a possible event and the edges, labeled by agents, represent events agents imagine as possible. For instance, in the broadcast example, the event model for "There is an announcement not heard by the boss" would contain two events: the event "Announcing that the boss is in the middle" and the event "Nothing is said", and the boss would think that the second event is the actual one happening. Furthermore, events may modify the world, and usually are called ontic events when they do. For instance, playing a card modifies the world, because the card is no longer in the player's hand. The logic DEL thus extends epistemic logic with the operator "after applying the event model E...".

As for epistemic logic, we can define the model checking and satisfiability problems for DEL (so without common knowledge). It has been proven that without common knowledge the model checking problem is Pspace-complete and the satisfiability problem is NExptime-complete [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF]. Notice that the result in [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF] does not hold for dynamic epistemic logic per se, but for a slightly richer version where event models are multipointed. It simply means that when applying an event model, the choice of the actual event occurring is non-deterministic. For instance, the event model for "role a dice" would have 6 events, one for each value, and all would be pointed. Actually, in [START_REF] De | On the Computational Complexity of Model Checking for Dynamic Epistemic Logic with S5 Models[END_REF], it is proven that the model checking problem is Pspace-hard for non-ontic, multi-pointed S5 event models with only one agent, or non-ontic, single-pointed S5 event models with two agents. with probabilities and dynamic epistemic temporal logic [START_REF] Renne | Dynamic Epistemic Temporal Logic[END_REF] that extends DEL with temporal operators. Also, it has been proven recently that Game Description Logic III (GDL-III [START_REF] Thielscher | GDL-III: A Proposal to Extend the Game Description Language to General Epistemic Games[END_REF]), a logic for expressing games with epistemic aspects, is as expressive as DEL [START_REF] Engesser | Game Description Language and Dynamic Epistemic Logic Compared[END_REF].

Epistemic planning

Planning is a field in Artificial Intelligence where the usual decision problem is, given an initial situation and actions, find a sequence of actions to reach the goal.

The well known form of planning is called classical planning, in particular the language of the Stanford Research Institute problem solver (STRIPS [START_REF] Fikes | STRIPS: A New Approach to the Application of Theorem Proving to Problem Solving[END_REF]), where the initial situation is represented with a valuation, the actions only feature propositional preconditions/effects and the goal is also propositional. A vast literature exists on the subject, leading to a specification language called Planning Domain Description Language (PDDL [START_REF] Mcdermott | PDDL-the planning domain definition language[END_REF]), that aims at defining a common language for designers and users of planners.

Here, we are interested in epistemic planning. It means that the planning problems must consider epistemic aspects. Epistemic planning is a broad notion, and has an active community. We summarize here the group discussion at Dagstuhl about methods for epistemic planning ([Bar+17] Section 4.4) that I coordinated. We leave apart the singleagent approaches.

The way of doing epistemic planning we consider in the manuscript is epistemic planning based on DEL. It means that we consider as input a Kripke model, event models for actions, and an epistemic formula as a goal. Unfortunately, epistemic planning based on DEL is undecidable [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF], even when there is no nested knowledge in event models' formulas [START_REF] Bolander | Epistemic planning for single and multi-agent systems[END_REF]. Yet, when event models only feature propositional formulas, the epistemic planning problem is decidable [START_REF] Yu | Multi-Agent Epistemic Explanatory Diagnosis via Reasoning about Actions[END_REF], more precisely non-elementary [START_REF] Douéneau-Tabot | Chain-Monadic Second Order Logic over Regular Automatic Trees and Epistemic Planningn Synthesis[END_REF]. Furthermore, when all event models feature non-ontic and propositional events, the epistemic planning problem has been proven to be in Expspace [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF]. Actually, we prove in [START_REF] Charrier | On the Impact of Modal Depth in Epistemic Planning[END_REF] that it is Pspace-complete. We will explain this result in detail in Chapter 4.

To circumvent the complexity problem, some other approaches have been considered to do epistemic planning based on DEL. They mainly revolve around syntactic compilation to classical planning, usually using PDDL. The common point between the approaches is the restricted expressivity to be applicable with classical planners. The work of [START_REF] Muise | Planning Over Multi-Agent Epistemic States: A Classical Planning Approach[END_REF] considers event models with one event with additional conditional effects, that leads to an exponential reduction to classical planning. In [START_REF] Kominis | Beliefs In Multiagent Planning: From One Agent to Many[END_REF], they consider public announcements, public assignments and semi-private announcements16 , and have a polynomial reduction to classical planning17 . In [START_REF] Cooper | A Simple Account of Multi-Agent Epistemic Planning[END_REF], the authors consider the "seeing"-variables to describe the models.

Other approaches exist to solve epistemic planning that do not rely on DEL. For instance, it is possible to do epistemic planning by extending Alternating Temporal Logic (ATL) [START_REF] Alur | Alternatingtime temporal logic[END_REF] with knowledge (AETL). ATL is itself an extension of computation-tree logic [START_REF] Baier | Principles of model checking[END_REF] with dynamic modalities to express the existence of strategies. With this model, we can express that a group of agents have a strategy to reach a formula ϕ, which corresponds to planning. This allows to express stronger properties than just planning, such as winning strategies for instance. The model checker MCMAS [START_REF] Lomuscio | MCMAS: an opensource model checker for the verification of multi-agent systems[END_REF] can solve AETL, but has strong limitations: only S5 models are allowed and the knowledge has no perfect recall (it is undecidable with perfect recall [START_REF] Dima | Model-checking ATL under Imperfect Information and Perfect Recall Semantics is Undecidable[END_REF]), meaning that each agent forgets a part of the actions history. In particular, this setting does not express epistemic planning based on DEL since it is intrinsically perfect recall. Furthermore, the model must be regular (described by a finite-state automaton), which is not the case for DEL because the epistemic planning problem would be decidable otherwise.

It is also possible to express epistemic planning using automata techniques to solve the model checking of CTL * K n [START_REF] Bozzelli | Uniform strategies, rational relations and jumping automata[END_REF], when it is possible to describe with automata the infinite structure generated by the event models. It is possible, for instance, when event models are propositional [START_REF] Aucher | Automata Techniques for Epistemic Protocol Synthesis[END_REF][START_REF] Douéneau-Tabot | Chain-Monadic Second Order Logic over Regular Automatic Trees and Epistemic Planningn Synthesis[END_REF]. Unfortunately, this approach does not work further.

Other techniques exist but are further from epistemic planning as considered in the manuscript. The reader can refer to [START_REF] Baral | Epistemic Planning (Dagstuhl Seminar 17231)[END_REF] for more information, since it surveys currently existing techniques for epistemic planning.

Arbitrary public announcements

Because epistemic planning is undecidable, we study a more restrictive class of event models. Some extensions of PAL already exist to express the existence of an announcement. The corresponding logic is called APAL [START_REF] Balbiani | Knowable' as 'known after an announcement[END_REF], the extension of PAL with the existential operator (called arbitrary announce-ment). Another variant was considered: Group Announcement Logic [Ågo+10] (GAL), where we do not quantify on all announcements but only on announcements doable by a certain group of agents.

Unfortunately, the satisfiability problems of both APAL and GAL are undecidable [START_REF] French | Undecidability for arbitrary public announcement logic[END_REF][START_REF] Ågotnes | Group announcement logic[END_REF]. It is not a problem if we want to see APAL as a different way of studying epistemic planning, since the Kripke model is given in input.

Yet, by themselves, APAL and GAL are pretty far from epistemic planning. They just express the existence of public announcements once, and do not consider a sequence of announcements.

Contribution

In this document, we study the mentioned decision problems for dynamic epistemic logic, namely model checking and satisfiability. We also study the epistemic planning problem based on dynamic epistemic logic, and extensions of epistemic logic that quantify over public announcements. Finally, we define a symbolic representation of Kripke models and event models and study its impact on expressivity and algorithmic complexity. Through the manuscript, we give games and puzzles as examples since they are intuitive and feature the matters we wish to discuss, as interaction of knowledge between agents. We now detail the content of each chapter.

• Chapter 1 defines the syntax and the semantics of Dynamic Epistemic Logic (DEL). We first define epistemic logic, with the notion of common knowledge, and then introduce dynamic operators, defined with event models. We also recall some axioms leading to classical classes of models. In particular, we define S5 models to talk about knowledge and KD45 to talk about beliefs. We then prove expressivity results for DEL, namely that for any formula of DEL where event models do not contain common knowledge, we can define an equivalent formula of DEL where event model contain no nested knowledge.

• Chapter 2 defines the model checking and satisfiability problems for DEL with common knowledge (DELCK). We extend the results of [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF] for DEL by proving that the model checking problem against DELCK is Pspace-complete (as DEL) and the satisfiability problem is 2-Exptime-complete (compared to NExptimecomplete for DEL). All proofs strongly rely on alternating complexity classes, de-fined by algorithms/Turing machines enriched by existential and universal choices. Indeed, as explained in Appendix A, such classes are directly correlated with standard complexity classes and they provide a very intuitive way of establishing complexities of decision problems. We apply our result on the model checking to express the existence of a uniform strategy in the game blind tic tac toe, which is tic tac toe where players do not see the moves of their opponents.

• Chapter 3 introduces the symbolic representation of Kripke and event models using DL-PA-relations. We show that we do not lose any expressivity by introducing the symbolic models and that the representation is exponentially more succinct. Then, we show that the model checking and satisfiability problems for DELCK with symbolic models have the same complexities than the non-symbolic case, Pspacecomplete and 2-Exptime-complete respectively. We apply the result for symbolic model checking to express the existence of a uniform strategy in the bridge card game, which shows that with symbolic inputs, expressing the existence of winning uniform strategies in classical card games is in Pspace.

• Chapter 4 is dedicated to epistemic planning. We first prove decidability results when event models are separable, i.e. events have disjoint conditions. In that case, the epistemic planning is NP-complete when all events are non-ontic, and Pspacecomplete when events are ontic. We next prove that epistemic planning is also Pspace-complete when event models are propositional but not necessarily separable and all events are non-ontic. Finally, we show that undecidability holds when event models with modal depth 2 are allowed and non-ontic events. the formulas considered are monadic, as opposed to MSO where only the predicates under quantification must be monadic. We exhibit the existential fragment of PAPL and show how to implement its symbolic model checking with the satisfiability of Monadic First-Order Logic (MFO). We then give some experimental results using the first-order solver Iprover [START_REF] Korovin | iProver -An Instantiation-Based Theorem Prover for First-Order Logic (System Description)[END_REF].

Table 2 summarizes the publications during my PhD and the concerned parts in the manuscript.

Chapter 1

Dynamic Epistemic Logic

In this chapter, we describe dynamic epistemic logic (DEL in short). The chapter is constructed as follows.

• First, we give the definition of DEL to model interactions of knowledge between agents in a multi-agent system and complex dynamic actions.

• Second, we show that in actions, it is always possible to gather the knowledge complexity either in the conditions or in the effects. We go even further by showing also that actions with no nesting of knowledge are sufficient to capture the whole expressive power of DEL.

• Finally we conclude.

The expressivity results are the contribution of this chapter, and have not been published yet.

Background on DEL

We define epistemic logic (without dynamic actions) and then introduce dynamic epistemic logic.

Epistemic logic

Syntax

We consider a countable set of atomic propositions AP and a finite set of agents Ag. The syntax of the language of epistemic logic (ELCK), denoted by L ELCK , is defined as follows.

Definition 1 (Syntax of epistemic logic). L ELCK is defined by the following grammar.

Operator Intuitive meaning

True. p Atomic proposition p is true. ¬ϕ Formula ϕ is false. ϕ ∨ ψ Formula ϕ or formula ψ is true.

K a ϕ
Agent a knows that ϕ is true. C G ϕ ϕ is common knowledge among the agents of G.

Table 1.1: Intuitive meaning of the operators of L ELCK .

Abbreviation Meaning

⊥ ¬ (ϕ 1 ∧ ϕ 2 ) ¬(¬ϕ 1 ∨ ¬ϕ 2 ) ϕ 1 → ϕ 2 ¬ϕ 1 ∨ ϕ 2 ϕ 1 ↔ ϕ 2 (ϕ 1 → ϕ 2 ) ∧ (ϕ 2 → ϕ 1 ) Ka ϕ ¬K a ¬ϕ ĈG ϕ ¬C G ¬ϕ
Table 1.2: Abbreviations for ELCK.

ϕ ::= | p | ¬ϕ | (ϕ ∨ ϕ) | K a ϕ | C G ϕ with p ∈ AP, a ∈ Ag, G ⊆ Ag.
Intuitive meaning of the operators of L ELCK are given in Table 1.1. Other operators appearing afterwards are defined in Table 1.2, either with the De Morgan's law or by duality.

Epistemic logic without the common knowledge operator (C G ) is noted EL and its language L EL .

Example 1. Formula "K a (K b p ∨ K c p)" reads "Agent a knows that either Agent b knows p or Agent c knows p".

Semantics

We know define the semantics of ELCK. A multi-agent system is formalized by a Kripke model, defined as follows. We write R M a for the epistemic relation for agent a in model M. We may also write

w a - → M u for (w, u) ∈ R M a or w a - → u when M is clear.
Later on, if we need to define a Kripke model but do not need to use W , R a or V outside of the definition, we may write the tuple (W, (R a ) a∈Ag , V ) even if the names are already used.

A pair (M, w) is called a pointed Kripke model, where w denotes the real world, the other worlds being only imagined as possible by the agents.

Intuitively, a world represents a possible configuration, and the Kripke model represents all possible configurations agents imagine as possible. The epistemic relations R a represent the agents' capacities of reasoning. We have w a -→ u if Agent a thinks that u may be the real world when the real world is actually w.

Example 2. Figure 1.1 shows a simple Kripke model M = (W, R a , R b , V ) with AP = {p}, Ag = {a, b} and:

• W = {w, u}; • R a = R b = W × W ; • V (w) = {p}; V (u) = ∅.
Worlds in Kripke models are drawn with ellipses. Inside each ellipse, the label corresponds to the name of the world followed by a colon and its valuation. The edges represent the relations R a and R b : there is an a-edge from w to u if and only if (w, u) ∈ R a . If an edge goes both ways, we do not draw the arrow but just a line instead (as between w and u in Figure 1.1). The pointed world is represented by an incoming edge coming from no world. For instance Example 1.1 represents the pointed Kripke model (M, w).

When each valuation is unique in the Kripke model, we may name a world by its valuation. For instance in the previous example, world w would be world {p} and world u would be world ∅. In this case, we do not include the name of the world in the ellipse as in Figure 1.2. Example 3 (Muddy children [START_REF] Mccarthy | Formalization of two puzzles involving knowledge[END_REF][START_REF] Hans Van Ditmarsch | One Hundred Prisoners and a Light Bulb[END_REF]). We now model the famous muddy children puzzle. In this puzzle, n children are playing in a garden, and some of them become muddy. They are supposed clever and honest. Their father comes and say "At least one of you is muddy". They do not see whether they are muddy or not, but see the other children muddiness. The father then asks several times "Does any one of you know whether he is muddy?". The puzzle consists in determining how many times the father needs to ask the question before any of the children answers "I know that I am muddy" or "I know that I am not muddy". We leave aside the answer for now and only model the initial situation. The initial situation is modeled by the Kripke model of Figure 1.2 in the case of 2 agents, and is modeled in general by the Kripke model M = (W, {R a } a∈Ag , V ) with Ag the set of children, AP = {m a , a ∈ Ag} and:

• W = 2 AP • R a = {(w, u) | w \ {m a } = u \ {m a }}; • V (w) = w.
We now give the semantics of ELCK on Kripke models. Definition 3 (Semantics of ELCK). The semantics of ELCK is defined on a pointed Kripke model. We note M, w |= ϕ for "Formula ϕ is true in the pointed Kripke model (M, w)". It is defined by induction on ϕ as follows.

• M, w |= ;

• M, w |= p if p ∈ V (w); • M, w |= ¬ϕ if M, w |= ϕ; • M, w |= (ϕ ∨ ψ) if M, w |= ϕ or M, w |= ψ; • M, w |= K a ϕ if for all u ∈ W, (w, u) ∈ R a implies M, u |= ϕ; • M, w |= C G ϕ if for all u ∈ W, (w, u) ∈ R G implies M, u |= ϕ where R G is the transitive closure of a∈G R a .
Example 4. We consider again the Kripke model of Figure 1

Axioms and Types of Kripke models

In the rest of the manuscript, we will refer to types of Kripke models, as S5, KD45, K. They correspond to Kripke models where a certain set of axioms is true. Such axioms are summarized in Table 1.3. The models we are going to work on are described in the following definition.

Definition 4 (K, KD45 and S5). The classes of models K, KD45 and S5 are defined in the following way.

• K is the set of Kripke models satisfying the axiom K. It corresponds to all Kripke models.

• KD45 is the set of Kripke models satisfying the axioms K, D, 4 and 5.

• S5 is the set of Kripke models satisfying the axioms K, T, 4 and 5.

Other axioms and types of Kripke models exist, but we omit them here since they are not used later.

The usual class of Kripke models considered in the literature are S5 models. They correspond to models where the epistemic relations are equivalence relations and thus represent knowledge. On the contrary, KD45 models usually represent belief, because in particular the current world is not always considered as possible by the agents.

Axiom

Condition on Kripke models Drawing of the condition For more information about axioms and epistemic logic, the reader may refer for instance to [START_REF] Meyer | Epistemic logic for AI and computer science[END_REF].

K K a (ϕ 1 → ϕ 2 ) → (K a ϕ 1 → K a ϕ 2 ) None T K a ϕ → ϕ Reflexivity: for all w, (w, w) ∈ R a w a D K a ϕ → Ka ϕ Serial: for all w, there exists u such that (w, u) ∈ R a w ⇒ w u a 4 K a ϕ → K a K a ϕ Transitivity: for all w, u, v, (w, u) ∈ R a and (u, v) ∈ R a implies (w, v) ∈ R a w u v a a ⇒ w u v a a a 5 Ka ϕ → K a Ka ϕ Euclidean: for all w, u, v, (w, u) ∈ R a and (w, v) ∈ R a implies (u, v) ∈ R a w u v a a ⇒ w u v a a a

Dynamic Epistemic Logic

Dynamic Epistemic Logic (DELCK), initially proposed in [START_REF] Baltag | The Logic of Public Announcements and Common Knowledge and Private Suspicions[END_REF], extends epistemic logic by adding a new operator. The book [START_REF] Hans Van Ditmarsch | Dynamic epistemic logic[END_REF] published later on is an extensive reference on DELCK, so the reader may feel free to browse this book for more information about DELCK. For a more recent reference with additional extensions of epistemic logic, the reader may refer to [START_REF] Ditmarsch | Handbook of epistemic logic[END_REF].

Its language L DELCK is defined in the following way.

Definition 5 (Syntax of DEL). L DELCK is defined by the following grammar.

ϕ ::= | p | ¬ϕ | (ϕ ∨ ϕ) | K a ϕ | C G ϕ | E, E 0 ϕ with p ∈ AP, a ∈ Ag, G ⊆ Ag.
The language without the C G operator is written L DEL and the logic DEL. The operator E, E 0 ϕ is read "After the execution of the multi-pointed event model (E, E 0 ), ϕ is true". We define its dual [E, E 0 ]ϕ = ¬ E, E 0 ¬ϕ. Event models are a semantic object that appear in the syntax of DELCK. The main reason is that DELCK aims at reasoning about knowledge when the actions are fixed. Therefore, we need the event models to be fixed in the formula. It is possible to only consider the E, E 0 operator as a symbol that is interpreted in the semantics, but it is not done this way in the literature, and changes decision problems later on, in particular the satisfiability problem where the event models are fixed in the input. Event models are defined as follows.

Definition 6 (Event model). An event model E = (E, (R E a ) a∈Ag , pre, post) is defined by a non-empty set of events E, epistemic relations (R E a ) a∈Ag ⊆ E × E, a precondition function pre : E → L ELCK and a postcondition function post : E × AP → L ELCK .

An event model is similar to a Kripke model but epistemic worlds are now replaced by events labeled by a precondition and a postcondition. The precondition pre(e) of an event e is the necessary condition to execute the event. An event e is said executable in a world w if and only if its precondition pre(e) holds in w. The postcondition post(e, p) represents the effect the event has on atomic proposition p, meaning whether p is now or ⊥. Events can be seen as PDDL [START_REF] Mcdermott | PDDL-the planning domain definition language[END_REF] actions where formulas in preconditions and postconditions/effects can be any formula of ELCK instead of propositional. As for Kripke models, if outside definitions we do not use the content of the tuple, we may write event models with the tuple (E, (R E a ) a∈Ag , pre, post) even if the names are already used. We may write e ∈ E for e ∈ E.

A pair (E, e) with e ∈ E is called a pointed event model, where e represents the actual event. A pair (E, E 0 ) with E 0 ⊆ E is called a multi-pointed event model, where E 0 represents the set of possible actual events. Pointed event models correspond to deterministic actions and multi-pointed event models correspond to non-deterministic actions. We may confuse (E, e) and (E, {e}) as they are equivalent.

• E = {e, f }; • R a = {(e, e), (f, f )}; R b = {(e, f ), (f, f )}; • pre(e) = p; pre(f ) = ; • post(e, p) = ⊥; post(f, p) = p
It has two events e and f . Event e is executable only when p is true and assigns p to false. Event f is always executable and does not perform any assignment. Agent a has exact knowledge of the event and agent b always thinks that the actual event is f . By convention, we draw the events of event models with rectangles (whereas worlds in Kripke models are ellipses). In each rectangle, the name of the event is written followed by the precondition and the postcondition. For the postconditions, all atomic propositions not mentioned in the figure are assigned to their previous value. For instance, post(f, p) = p. In this case, we say that the postcondition of f is trivial for p. If the postcondition of an event f is trivial for all atoms of AP, we simply say that the postcondition of f is trivial and represent the postcondition with a bar ( / ) in the figures.

Example 7. In the muddy children example, two types of event models are relevant.

• The announcement by the father, represented in Figure 1.4.a, is an event model with one event whose precondition is true if and only if at least one of the children is muddy and whose postcondition is trivial. • The fact that children do not speak after the question of the father is also modeled by an announcement, represented in Figure 1.4.b. The event model also has only one event with a trivial postcondition and the precondition is no child knows whether he is muddy.

Both event models are public announcements, that will be central in Chapters 5 and 6. They are event models with only one event with a trivial postcondition. If the postcondition is not trivial, we usually called such an event model a public action.

The effect an event model has on a Kripke model is characterized by the synchronous product operation, also called product update. In fact, it can be proven that when k children are muddy, the father needs to ask the question k -1 times, and all the muddy children then answer that they know they are muddy.

We now define the semantics of the operator E, E 0 . Definition 8 (Semantics of DELCK). We extend the definition M, w |= ϕ to L DELCK with the following clause:

• M, w |= E, E 0 ϕ if there exists e ∈ E 0 s.t. M, w |= pre(e) and M ⊗ E, (w, e) |= ϕ.

In the sequel, we take the abbreviation (w, e 1 , . . . , e n ) for (((w, e 1 ), . . . ), e n ) and further abbreviate it by w -→ e . We also write M

- → E for M, E 1 , . . . , E n . We write M - → E , w - → e |= ϕ instead of M ⊗ E 1 ⊗ • • • ⊗ E n , (((w, e 1 ), . . . ), e n ) |= ϕ. A sequence of events - → e is executable in w if w - → e is in M - → E .
The empty sequence of events is denoted by (so w = w). The empty sequence is of course executable in all worlds.

We will also need a notion of size of formulas and models, noted |ϕ|, |M|, |E|.

Definition 9 (Size of formulas and models). The size of formulas ϕ and models M, E are mutually defined by induction:

• | | = |p| = 1; • |¬ϕ| = 1 + |ϕ|; • |ϕ 1 ∨ ϕ 2 | = 1 + |ϕ 1 | + |ϕ 2 |; • |K a ϕ| = 1 + |ϕ|; • |C G ϕ| = 1 + |ϕ|; • | E, E 0 ϕ| = 1 + |E| + |E 0 | + |ϕ|; • |M| = |AP| × |W |; • |E| = |E|+ e∈E | pre(e)| + p∈AP | post(e, p)| .
The notion of size may change in the analysis later on, the differences will be explicitly given if it is the case.

Expressivity of event models in DEL

We now show expressivity results for DEL. Indeed, the whole class of event models is not needed to capture the whole expressivity of DEL. In fact, it is already proven that DEL has the same expressivity than EL [START_REF] Hans Van Ditmarsch | Dynamic epistemic logic[END_REF], but it is not the case with DELCK and ELCK. Yet, the translation from a formula of DEL to a formula of EL is exponential.

Here we exhibit a sublanguage of DEL that captures the whole expressivity of DEL with a polynomial translation.

Before announcing the outline of the subsections, let us define two notions: modal depth of an epistemic formula without common knowledge and classes of event models.

Definition 10 (Modal depth). The modal depth of a formula ϕ ∈ L EL , noted d(ϕ) is defined by induction on ϕ:

• d(p) = d( ) = 0; • d(¬ϕ) = d(ϕ); • d(ϕ 1 ∨ ϕ 2 ) = max(d(ϕ 1 ), d(ϕ 2 )); • d(K a ϕ) = 1 + d(ϕ).
Intuitively, the modal depth corresponds to the maximal nesting of knowledge operators. Common knowledge is not included in the definition of modal depth because it intrinsically introduces an unbounded nesting of knowledge operators.

We now define the classes of event models for the section.

Definition 11. The class of event models C j i with i ≥ 0 or i = ∞, and j ≥ -1 or j = ∞, is the set of event models where the events have preconditions of modal depth at most i and postconditions of modal depth at most j. If i or j is ∞ the modal depth is not constrained, and if j = -1, the event models must have trivial postconditions.

Example 10. The event model from Figure 1.3 page 41 is in C 0 0 because all formulas are propositional, but it is not in C -1 0 because the postcondition of e is not trivial. Notice that it is also in C j i for any i, j ≥ 0 and i, j = ∞.

We trivially have that C j i ⊆ C j i whenever i ≥ i and j ≥ j . Let us now define the notion of equivalence of formulas.

Definition 12 (Equivalent formulas). Let ϕ 1 and ϕ 2 be two formulas. We say that they are equivalent if M, w |= ϕ 1 if and only if M, w |= ϕ 2 for all pointed Kripke models (M, w).

We prove here that for any formula ϕ ∈ L DEL on AP (supposed finite) whose event models are all in a certain C j i , it is possible to polynomially construct an equivalent formula tr(ϕ) on a certain AP ⊇ AP where the event models are in C, where C can be any of the following: C max(i,j) 0 , C 0 max(i,j) , C 1 0 . It will also prove directly that the result holds for C 0 1 . The C max(i,j) 0 case is not directly needed, but we present the construction because it is fairly easy and allows us to introduce some notions needed for the next two.

The formulas ϕ and tr(ϕ) do not contain the same set of atomic propositions, but if we evaluate them on Kripke models on AP , we will indeed have M, w |= ϕ if and only if M, w |= tr(ϕ). If we want to be rigorous on the notion of equivalence, they would need to be defined in the same set of atomic propositions. We decide to distinguish AP and AP to avoid defining both formulas with atomic propositions of the infinite set AP, with tr(ϕ) containing fresh atomic propositions of AP not appearing in ϕ. Indeed, such a definition would make the proofs more difficult to read.

We dedicate one subsection per class and then discuss the case of common knowledge briefly.

Removing the knowledge operators from the preconditions

This section is dedicated to the C max(i,j) 0 case.

General idea

In a formula ϕ, we replace the modality E, E 0 by two nested modalities E , E 0 E p , E 0p . The pointed event model (E , E 0 ) is (E, E 0 ) where the preconditions are pushed in postconditions by assigning the value of a fresh atomic proposition, p prune , to whenever the precondition is true. The event model (E p , E 0p ) removes any world where p prune is false and resets the value of p prune .

Formal definition

Let AP = AP∪{p prune } and (E, E 0 ) an event model on AP with E = (E, (R E a ) a∈Ag , pre, post). We define the event models (E , E 0 ) and (E p , E 0p ).

Definition 13 (Event model (E , E 0 )). The event model E = (E , (R E a ) a∈Ag , pre , post ) and set E 0 are defined as follows:

• E = {e , e ∈ E}; • R E a = {(e , f ), (e, f ) ∈ R E a } for all a ∈ Ag;
• pre (e ) = for all e ∈ E ;

• post (e , p) = post(e, p) for all e ∈ E and p ∈ AP;

• post (e , p prune ) = pre(e) for all e ∈ E ;

• E 0 = {e , e ∈ E 0 }. If E ∈ C j i then E ∈ C max(i,j) 0
because the preconditions in E are now propositional and the postconditions contain formulas both from the preconditions and the postconditions of E, thus are of modal depth at most max(i, j).

Definition 14 (Event model (E p , E 0p )). The event model E p = (E p , (R Ep a ) a∈Ag , pre p , post p ) and set E 0p are defined as follows:

• E p = {e p }; • R Ep a = {(e p , e p )};
• pre p (e p ) = p prune ;

• post p (e p , p prune ) = ⊥; post p is trivial for other atomic propositions;

• E 0p = {e p }.
The event model E p is in C 0 0 because both the precondition and the postcondition of e p are propositional.

We now prove that executing (E , E 0 ) then (E p , E 0p ) has the same effect than executing (E, E 0 ) for any pointed Kripke model (M, w). Before stating the theorem, we need to define a notion of equivalence between Kripke models , generally called AP-bisimulation.

Definition 15 (AP-bisimulation). Let M = (W, (R a ) a∈Ag , V ) and M = (W , (R a ) a∈Ag , V ) two Kripke models on AP 1 ⊇ AP and AP 2 ⊇ AP. An AP-bisimulation is a relation

B ⊆ W × W such that: • AP-conservation: For all (w, w ) ∈ B, for all p ∈ AP, p ∈ V (w) if and only if p ∈ V (w ); • Zig: For all (w, w ) ∈ B, for all a ∈ Ag and u ∈ W , if (w, u) ∈ R a then there exists u ∈ W such that (w , u ) ∈ R a and (u, u ) ∈ B. • Zag: For all (w, w ) ∈ B, for all a ∈ Ag and u ∈ W , if (w , u ) ∈ R a then there exists u ∈ W such that (w, u) ∈ R a and (u, u ) ∈ B.
If there exists an AP-bisimulation between M and M then we say that both Kripke model are AP-bisimilar. Bisimulation is also defined on pointed Kripke models (M, w) and (M, w ) by adding the constraint (w, w ) ∈ B. Interestingly, if two pointed Kripke models (M, w) and (M , w ) are AP-bisimilar then M, w |= ϕ if and only if M , w |= ϕ for any formula ϕ ∈ L DELCK on AP.

Theorem 1. Let (E, E 0 ) be an event model on AP and (E , E 0 ), (E p , E 0p ) be the two event models defined respectively in Definitions 13 and 14. Then for any pointed Kripke model (M, w) on AP, e ∈ E 0 , (M ⊗ E, w) and (M ⊗ E ⊗ E p , (w, e , e p )) are AP -bisimilar.

Proof. We define the relation B = {((w, e), (w, e , e p )), (w, e) ∈ M ⊗ E}. Before proving that B is a AP -bisimulation, we first need to prove that it is well defined, meaning that (w, e) exists if and only if the world (w, e , e p ) exists.

The For p prune , we necessarily have p prune ∈ V (w, e) and p prune ∈ V (w, e , e p ).

• Zig and Zag: we have ((w, e), (u, f

)) ∈ R M⊗(E,E 0 ) a if and only if ((w, e , e p ), (u, f , e p )) ∈ R M⊗(E ,E 0 )⊗(Ep,E 0p ) a
by definition of E and E p so the Zig and Zag properties are direct.

Therefore, we have M, w |= E, E 0 ϕ if and only if M, w |= E , E 0 E p , E 0p ϕ for any formula ϕ on AP. Also, we have also proven that p prune is false everywhere after having applied E and E p , thus we can reuse p prune . In particular, we have proven that the following translation is correct.

Definition 16. Let ϕ be a formula on AP with event models all in C j i . We construct an AP-equivalent formula tr(ϕ) on AP ∪ {p prune }, with events models all in C max(i,j) 0 by induction on ϕ:

• tr( ) = ; • tr(p) = p; • tr(¬ϕ) = ¬tr(ϕ); • tr(ϕ 1 ∨ ϕ 2 ) = tr(ϕ 1 ) ∨ tr(ϕ 2 ); • tr(K a ϕ) = K a tr(ϕ) • tr(C G ϕ) = C G tr(ϕ); • tr( E, E 0 ϕ) = E , E 0 E p , E 0p tr(ϕ).

Removing the knowledge from the postconditions.

This section is dedicated to the C 0 max(i,j) case.

General idea

Let (E, E 0 ) be an event model in C j i . To simulate the execution of this event model, we introduce one atomic proposition p e for each atomic proposition p ∈ AP and event e ∈ E, and create one event model (E e,p , E e,p 0 ) per p and e that will assign the value of post(e, p) to p e . We furthermore introduce an event model (E , E 0 ) that is (E, E 0 ) where postcondition of event e become p ← p e for every p ∈ AP.

Formal definition

Let (E, E 0 ) be an event model with E = (E, (R E a ) a∈Ag , pre, post). We define the setAP = AP ∪ {p e , p ∈ AP, e ∈ E}.

p ← p e q ← q e p e ← ⊥ q e ← ⊥ p f ← ⊥ q f ← ⊥ f : pre : post : p ← p f q ← q f p e ← ⊥ q e ← ⊥ p f ← ⊥ q f ← ⊥ b a a, b (E, E 0 ) (E e,p , E e,p 0 ) (E , E 0 )
Figure 1.9: Example of an event model (E e,p , E e,p 0 ) and (E , E 0 ) for the C 0 max(i,j) construction.

Definition 17 (Event model (E e,p , E e,p 0 )). The event model E e,p = (E e,p , (R e,p a ) p∈AP , pre e,p , post e,p ) is defined as follows:

• E e,p = {c e,p , c e,p ⊥ };

• R e,p a = E e,p × E e,p for all a ∈ Ag;

• pre e,p (c e,p ) = post(e, p); pre e,p (c e,p ⊥ ) = ¬ post(e, p);

• post e,p (c e,p , p e ) = ; post e,p (c e,p ⊥ , p e ) = ⊥; post e,p is trivial for all other atomic propositions of AP ;

• E e,p 0 = E e,p .

Notice that the following proposition holds.

Proposition 1. For any Kripke model M on AP , M ⊗ E e,p is isomorphic to M with the only difference that p e is in the new valuation of w if and only if M, w |= post(e, p).

Proof sketch Each world of M matches exactly to one event of E e,p = {c e,p , c e,p ⊥ }, so M ⊗ E e,p has the same number of worlds. Furthermore, the epistemic relation form a complete graph in (E e,p , E e,p 0 ), so all pre-existing edges in M remain. Therefore, M and M ⊗ E e,p are isomorphic.

For the second point, it is direct by definition of M ⊗ E e,p .

Definition 18

(Event model (E , E 0 )). The event model E = (E , (R E a ) a∈Ag , pre , post ) is defined as follows: • E = {e , e ∈ E}; • R E a = {(e , f ), (e, f ) ∈ R E a } for all a ∈ Ag;
• pre (e ) = pre(e) for all e ∈ E ;

• post (e , p) = p e for all e ∈ E and p ∈ AP; post (e , q) = ⊥ for all e ∈ E and q ∈ AP \ AP;

• E 0 = {e , e ∈ E 0 }.
Theorem 2. For any pointed Kripke model (M, w) on AP, for every e ∈ E 0 , (M ⊗ E, (w, e)) and (M⊗ e∈E p∈AP E e,p ⊗E , (w, . . . , e )) are AP-bisimilar where (w, . . . , e ) is the only possible world corresponding to (w, e).

Proof. The proof is similar to the one of Theorem 1. Here B associates (w, e) to the only (w, . . . , e ) that exists, with . . . the c f,q ⊥ /c f,q that are the only events that can be inserted in the tuple.

• AP-conservation: for any p ∈ AP, p is in the valuation of (w, . . . , e ) if p e was true, meaning that post(e , p) was true in a certain (M , w) isomorphic to (M, w). Therefore, p has the same value in (w, e) and (w, . . . , e ).

• Zig and Zag: as remarked before, M ⊗ e∈E p∈AP E e,p is isomorphic to M, and E is constructed similarly to E, therefore the Zig and Zag properties are direct.

As before, we can then define a translation from a formula with event models in C j i to a formula with event models in C 0 max(i,j) . Here the new formula will have E∈ϕ |AP|×|E| new atomic propositions and its size will be in O(|ϕ| × E∈ϕ |AP| × |E|) which is polynomial in |ϕ|.

Removing the knowledge nesting from preconditions and the knowledge operators from postconditions.

This subsection is dedicated to the C 1 0 case.

General idea

To simulate the effect of an event model (E, E 0 ) in C j i with event models with no nesting of knowledge operators, we compute with event models

(E 1 , E 1 0 ), . . . , (E max(i,j)-1 , E max(i,j)-1 0
) the values of subformulas of formulas in E that are of modal depth 1, . . . , max(i, j) -1. For each formula ϕ in E, we introduce one new atomic proposition p ψ for each subformula ψ of ϕ. Then at the end we execute an event model (E , E 0 ) which is (E, E 0 ) where each formula ϕ is now replaced by p ϕ .

Formal definition

We first need to define the set of subformulas of ϕ.

Definition 19 (Set of subformulas). Let ϕ ∈ L EL be a formula. We define the set of subformulas of ϕ, noted SF (ϕ) in the following way.

• SF (p) = {p};

• SF ( ) = { } • SF (¬ϕ) = {¬ϕ} ∪ SF (ϕ); • SF (ϕ 1 ∨ ϕ 2 ) = {ϕ 1 ∨ ϕ 2 } ∪ SF (ϕ 1 ) ∪ SF (ϕ 2 ); • SF (K a ϕ) = {K a ϕ} ∪ SF (ϕ) e : pre : K a K b p post : p ← K a p f : pre : q post : q ← ¬K b q b a a, b (E, E 0 ) e 1 : pre : post : p Kap ← K a p p K b p ← K b p p K b q ← K b q a, b (E 1 , E 1 0 ) e : pre : p KaK b p post : p ← p Kap p Kap ← K a ⊥ p K b p ← K b ⊥ p K b q ← K b ⊥ p KaK b p ← ⊥ f : pre : q post : q ← ¬p K b q p Kap ← K a ⊥ p K b p ← K b ⊥ p K b q ← K b ⊥ p KaK b p ← ⊥ b a a, b (E , E 0 ) Figure 1.10: Example of an event model (E 1 , E 1 0 ) and (E , E 0 ) for the C 1 0 construction.
Notice that SF (ϕ) has polynomial size compared to |ϕ|.

We now define AP

= AP ∪ {p ψ , ψ ∈ SF (ϕ), ϕ ∈ E, d(ψ) ≥ 1}
where ϕ ∈ E means that ϕ appears in a precondition or a postcondition in E. For any formula ϕ, we define a new formula tr(ϕ) of modal depth one where subformulas ψ have been replaced by p ψ . Definition 20. Let ϕ be a formula of modal depth at least 2. Then we define ϕ = tr(ϕ) in the following way.

• tr(p) = p;

• tr( ) = ; • tr(¬ϕ) = ¬tr(ϕ); • tr(ϕ 1 ∨ ϕ 2 ) = tr(ϕ 1 ) ∨ tr(ϕ 2 ); • tr(K a ψ) = K a p ψ .
Indeed, tr(ϕ) is a now a formula of modal depth at most 1, and any p ψ appearing in

tr(ϕ) is such that d(ψ) = d(ϕ) -1.
The definition is for any formula ϕ of modal depth at least 2 because we need to be sure that p ψ exists. For any formula of modal depth at most 1, it is not needed to transform it to a formula of modal depth at most 1 because it already is. In that case we define tr(ϕ) = ϕ.

Definition 21 (Event model (E k , E k 0 )). The event model E k = (E k , (R k a ) a∈Ag , pre k , post k ) is defined in the following way. • E k = {e k }; • R k a = {(e k , e k )} for all agents a ∈ Ag; • pre k (e k ) = ;
• post k (e, p ϕ ) = tr(ϕ) for any formula ϕ of modal depth k such that p ϕ ∈ AP ;

• post k is trivial for all other atomic propositions;

• E k 0 = {e k }.
Definition 22 (Event model (E , E 0 )). The event model E = (E , (R a ) a∈Ag , pre , post ) is defined in the following way.

• E = {e , e ∈ E}; • R E a = {(e , f ), (e, f ) ∈ R E a } for all a ∈ Ag; • pre (e ) =    p pre(e) if d(pre(e)) ≥ 1 pre(e) otherwise.
for all e ∈ E ;

• post (e , p) =    p post(e,p) if d(post(e, p)) ≥ 1 post(e, p) otherwise.
for all e ∈ E and p ∈ AP;

• post (e , p ψ ) = ⊥ for all e ∈ E and q ψ ∈ AP \ AP;

• E 0 = {e , e ∈ E 0 }.
Theorem 3. For any pointed Kripke model (M, w) and e ∈ E 0 , the Kripke models (M ⊗ E, (w, e)) and (M ⊗ max(i,j) k=1

E k ⊗ E , (w, e 1 , . . . , e max(i,j) , e )) are AP-bisimilar.

Proof. The bisimulation is B = {((w, e), (w, e 1 , . . . , e max(i,j) , e ), w ∈ W, e ∈ E}. As before, the Zig and Zag properties are easy to prove, the difficult part of the proof is to prove that M, w |= ϕ if and only if M ⊗ max(i,j) k=1

, (w, e 1 , . . . , e max(i,j) ) |= p ϕ with ϕ any formula appearing in a precondition or a postcondition in E. Indeed, if such a property is proven, then:

• B is well defined because (w, e 1 , . . . , e max(i,j) , e ) passed all the preconditions if and only if w passed the precondition of e (because the only precondition which is not is pre (e ) = p pre(e) ).

• The AP-conservation is direct because: , (w, e 1 , . . . , e max(i,j) ) |= tr(post(e, p)) if and only M ⊗ max(i,j) k=1 , (w, e 1 , . . . , e max(i,j) ) |= post (e , p) if and only if p ∈ V (w, e 1 , . . . , e max(i,j) , e ).

p ∈ V (w, e) if
The above property is a consequence of the following lemma. Lemma 1. For any i ∈ {0, . . . , max(i, j) -1}, for any formula ϕ of modal depth at most

i + 1, M, w |= ϕ if and only if M ⊗ i k=1 E k , (w, e 1 , . . . , e i ) |= tr(ϕ)
It is proven by recurrence on i:

• i = 0: for this case, tr(ϕ) = ϕ and M ⊗ i k=1 E k , (w, e 1 , . . . , e i ) = M so the case is direct.

• i > 0: if the property is true for k -1 then for i, in M ⊗ i k=1 E k , (w, e 1 , . . . , e i ), any atomic proposition p ψ with ψ of modal depth i has now the correct value of ψ in each world w. Therefore for any formula ϕ of modal depth i + 1, we indeed have

M, w |= ϕ if and only if M ⊗ i k=1 E k , (w, e 1 , . . . , e i ) |= tr(ϕ). Replacing (E, E 0 ) by (E 1 , E 1 0 ) . . . (E max(i,j)-1 , E max(i,j)-1 0
)(E , E 0 ) introduces ϕ∈E |SF (ϕ)| new atomic propositions, and there are (max(i, j) + 1) times event models compared to before. Therefore, translating a formula from C j i to C 1 0 is polynomial. Notice that we have also proven that it is polynomial to go from C j i to C 0 1 by combining the C 0 max(i,j) result with the C 1 0 result.

Theorem 4. For any formula ϕ containing event models without common knowledge, it is possible to polynomially construct a formula ϕ with events models either all in C 1 0 or either all in C 0 1 .

Adding common knowledge

Unfortunately, such results do not hold when formulas in event models contain common knowledge operators. The reason is that common knowledge introduces an unbounded modal depth, so it is in no C j i with i, j ∈ N. Nevertheless, when the Kripke model M is fixed from the start and is finite, it is possible to transform the C G ϕ modality into

|W | k=0 a 1 ,...,a k ∈Ag K a 1 . . . K a k ϕ, which has ex- ponential size compared to |C G ϕ|.
But this formula depends on the initial Kripke model, so the expressivity results do not hold anymore.

Conclusion

In this chapter, we have first defined epistemic logic, seen here as a specification language for multi-agent systems. Its semantics uses Kripke models, that express multi-agent systems by a graph of possible configurations, called worlds. We considered classical axioms for epistemic logic to restrict the Kripke models considered, as S5, for models about knowledge, and KD45, for models about beliefs. Then, we have defined dynamic epistemic logic (DEL) and its extension with common knowledge (DELCK), that extends epistemic logic with dynamic operators featuring event models. Such models give a precise way of defining events and the perception agents have about the events.

We have shown that in fact, a relevant fragment of DELCK is sufficient to express every formula of DELCK where event models do not feature common knowledge. We defined the class C j i for events models with preconditions of modal depth at most i and postconditions of modal depth at most j. We have shown that for any formula where its event models are in C j i , we could find an equivalent formula where its event models fall into one of the following classes: C max(i,j) 0 , C 0 max(i,j) , C 1 0 , and deduced that C 0 1 is also suitable. The proof techniques involves dividing a dynamic modality E, E 0 into a sequence of modalities

E i , E i
0 where each event model E i is in the relevant class considered. The main limitation of the expressivity results is common knowledge in event models. Indeed, common knowledge introduces an unbounded number of modal depth, so an Chapter 2

Model Checking and Satisfiability of Dynamic Epistemic Logic

In this chapter, we study decision problems of DELCK. The chapter is constructed as follows.

• First, we show that the model checking problem against DELCK is Pspacecomplete (same result than DEL).

• Second, we recall that the satisfiability problem of DEL is NExptime-complete, and show that it is 2-Exptime-complete for DELCK.

• Third, we model a game with incomplete information, blind tic tac toe, to illustrate the notions presented in the chapter. We show in particular that finding a uniform strategy in blind tic tac toe can be reduced to the model checking problem against DELCK, meaning that finding a uniform strategy in such games is not harder than Pspace.

• Finally, we conclude.

Everything in this chapter is a contribution. The model checking and the satisfiability section have been published in [START_REF] Charrier | Complexity of Dynamic Epistemic Logic with Common Knowledge[END_REF].

Complexity of model checking against DELCK

In this section, we explain the model checking problem against DELCK, recall that it was already known against DEL to be PSPACE-complete, and detail the contribution: the model checking against DELCK remains PSPACE-complete even when common knowledge is added (the PSPACE-hardness being easy, we only prove here the PSPACEmembership).

Duality of algorithms.

In the sequel, alternating algorithms are paired: a yes-algorithm algo yes and a no-algorithm algo no .

• Algorithm algo no rejects exactly when Algorithm algo yes does not reject, and vice versa;

• Existential choices and universal choices are permuted in the two algorithms.

In the sequel, we will write and explain yes algorithms, and write the no algorithms in Appendix D.

The model checking for DELCK is defined as follows.

Definition 23 (Model checking problem).

• Input: a pointed Kripke model M, w, a formula ϕ of L DELCK ;

• Output: yes if M, w |= ϕ, no otherwise.

In this section, we prove the following theorem.

Theorem 5. The model checking problem for DELCK is Pspace-complete.

Hardness comes directly from the Pspace-hardness of the model checking of DEL without common knowledge [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF] (actually, it is already Pspace-hard for single-pointed event models [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF], but actually even when the Kripke model is S5 and event models are S5 and single-pointed [START_REF] Van De Pol | Parameterized Complexity Results for a Model of Theory of Mind Based on Dynamic Epistemic Logic[END_REF]).

For the Pspace-membership, Figures 2.1 and 2.2 provides the pseudo-code of an alternating Turing machine that decides the model checking problem for DELCK in polynomial time. The upper bound is proven since Pspace = Aptime. The machine starts by calling mc yes (M, w, ϕ). The specifications of the procedures mc yes , inval yes , in yes , access yes and access * yes (see Figures 2.1 and 2.2) are given in the following proposition:

Proposition 2. For all formulas ϕ, for all Kripke models M, for all sequences of event models -→ E , for all worlds w -→ e , u -→ f of M -→ E , for all agents a, for all groups of agents G, for integers i that are powers of two,

proc mc yes (M - → E , w - → e , ϕ) |M - → E | + |ϕ| accepts whenever M - → E , w - → e |= ϕ case ϕ = p: inval yes (p, M - → E , w - → e ) case ϕ = (ϕ 1 ∨ ϕ 2 ): (∃) (∃) (∃) choose i ∈ {1, 2}; mc yes (M - → E , w - → e , ϕ i ) case ϕ = ¬ψ: mc no (M - → E , w - → e , ψ). case ϕ = K a ψ: (∀) (∀) (∀) choose u - → f ∈ M - → E (∃) (∃) (∃) access no (w - → e , u - → f , a, M - → E ) or in no (u - → f , M - → E ) or mc yes (M - → E , u - → f , ψ) case ϕ = E, E 0 ψ: (∃) (∃) (∃) choose e ∈ E 0 ; (∀) (∀) (∀) mc yes (M - → E , w - → e , pre(e)) and mc yes (M - → E :: E, w - → e :: e, ψ). case ϕ = C G ψ: (∀) (∀) (∀) choose u - → f ∈ M - → E (∃) (∃) (∃) access * no (w - → e , u - → f , G, B M,ϕ , M - → E ) or in no (u - → f , M - → E ) or mc yes (M - → E , u - → f , ψ) proc inval yes (p, w - → e , M - → E ) |M - → E | accepts whenever p ∈ V (w - → e ) case - → E = : if p ∈ V (w)
proc in yes (w - → e , M - → E ) |M - → E | accepts whenever w - → e ∈ M - → E case - → E = : accept case - → E = - → E ::E, w - → e = w - → e ::e: (∀) (∀) (∀) mc yes (M - → E , w - → e , pre(e)) and in yes (w - → e , M - → E ) proc access yes (w - → e , u - → f , a, M - → E ) |M - → E | accepts whenever (w - → e , u - → f ) ∈ R a case - → E = : if (w, u) ∈ R M a then accept else reject case - → E = - → E :: E, - → e = - → e :: e, - → f = - → f :: f : (∀) (∀) (∀) access yes (w - → e , u - → f , a, M - → E ) and if (e, f ) ∈ R E a then accept else reject
proc access * yes (w - → e , u - → f , G, i, M - → E ) |M - → E | + log i accepts whenever (w - → e , u - → f ) ∈ ( a∈G R a ) j for some j ≤ i case i = 1: if u - → f = w - → e then accept else (∃) (∃) (∃) choose a ∈ G; access yes (w - → e , u - → f , a, M - → E ) case i ≥ 2: (∃) (∃) (∃) choose v - → g ∈ M - → E (∀) (∀) (∀) in yes (v - → g , M - → E ) and access * yes (w - → e , v - → g , G, i/2, M - → E ) and access * yes (v - → g , u - → f , G, i/2, M - → E )
Figure 2.2: Sub-procedures for DELCK (in gray: quantities associated to each procedure call).

mc yes (M - → E , w - → e , ϕ) is accepting iff M - → E , w - → e |= ϕ, mc no (M - → E , w - → e , ϕ) is accepting iff M - → E , w - → e |= ϕ, inval yes (p, w - → e , M - → E ) is accepting iff p ∈ V (w - → e ), inval no (p, w - → e , M - → E ) is accepting iff p ∈ V (w - → e ), in yes (w - → e , M - → E ) is accepting iff w - → e ∈ M - → E , in no (w - → e , M - → E ) is accepting iff w - → e ∈ M - → E , access yes (w - → e , u - → f , a, M - → E ) is accepting iff (w - → e , u - → f ) ∈ R a , access no (w - → e , u - → f , a, M - → E ) is accepting iff (w - → e , u - → f ) ∈ R a , access * yes (w - → e , u - → f , G, i, M - → E ) is accepting iff (w - → e , u - → f ) ∈ j≤i ( a∈G R a ) j and access * no (w - → e , u - → f , G, i, M - → E ) is accepting iff (w - → e , u - → f ) ∈ j≤i ( a∈G R a ) j .
We do not prove the proposition here, since it mimics the semantics of DELCK. Instead, we first detail the meaning of the procedures, then give an example, and finally prove that the quantities given in each procedure in grey are strictly decreasing:

Propositional constructions in mc yes . For ϕ = p, the procedure calls inval yes (p, M - → E , w - → e )
that checks whether the valuation of w -→ e contains p. This procedure has two cases: if

- → E = , meaning that there is no event model, we just check that p ∈ V (w). Else, if - → E = - → E :: E, we call mc yes (M - → E , w - → e , post(e, p)) to check whether p is in the valuation of w - → e .
As expected, for ϕ = ¬ψ, the call switches from mc yes to mc no .

For

ϕ = ϕ 1 ∨ ϕ 2 , mc yes (M - → E , w - → e , ϕ) consists in existentially choosing i ∈ {1, 2} and then in calling mc yes (M - → E , w - → e , ϕ i ).

Knowledge operators in mc

yes . The call mc yes (M - → E , w - → e , K a ψ) consists in universally choosing a valuation u - → f ∈ M - → E , then checking two conditions such that mc yes (M - → E , u - → f , ψ) must be true if they are verified. The first test is (w - → e , u - → f ) ∈ R M -→ E a
, thus calling

access yes (w - → e , u - → f , a, M - → E ). This procedure just checks that (w, u) ∈ R a and (e i , f i ) ∈ R E i a for each E i ∈ - → E . The second test is u - → f ∈ M - → E , by calling Algorithm in yes (u - → f , M - → E ).
This procedure checks all preconditions.

Both tests are negated in the code of mc yes because the condition is an implication.

Event model operators in mc yes

The call mc yes (M -→ E , w -→ e , E, E 0 ψ) just chooses an event e ∈ E 0 , checks that its precondition is true with the call mc yes (M -→ E , w -→ e , pre(e))

and goes on with the model checking by calling mc yes (M -→ E :: E, w -→ e :: e, ψ).

Common knowledge operators in mc

yes . The call mc yes (M - → E , w - → e , C G ψ) triggers mc yes (M - → E , w - → e , K a 1 ...K a i ψ) for all possible choices of a multiset {a 1 , . . . , a i } of G. The semantics of operator C G yields checking that mc yes (M - → E , u - → f , ψ) does not reject, for all u - → f ∈ M - → E reachable from w - → e by iterating a∈G R M -→ E a
. This is the purpose of Algorithm access * yes . Regarding the size of the multiset {a 1 , . . . , a i }, it is sufficient to consider at most B M,ϕ , that is the smallest power of 2 greater than all |M -→ E | that may appear during the evaluation of the formula: indeed, each iteration of a∈G R M -→ E a adds at least one world into the set of reachable worlds from w -→ e , so it will necessarily stabilize within at most B M,ϕ steps. Additionally, it is important to require that after each iteration, the obtained world is in M -→ E , ensured by the call in yes in access * yes . To remain in the class Aptime, Algorithm access * yes relies on a divide and conquer method, alike the one shown in [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF]; because in case i ≥ 2, only one of the three recursive calls is universally chosen, it ensures that in an execution branch, the number of recursive calls is logarithmic in

B M,ϕ . It computes a∈G R M -→ E a i for all i ≤ B M,ϕ and not just a∈G R M -→ E a B M,ϕ because in the case i = 1, we either compute a∈G R M -→ E a 0 or a∈G R M -→ E a 1 . Therefore, all i ≤ B M,ϕ can be computed.
Example 11. We take the example of mc yes (M, w, E, E 0 ¬C G p) depicted in Figure 2.3. The procedure starts by choosing e in E 0 . Then, we check that both pre(e) holds in w and that ¬C G p holds in we. Checking that ¬C G p holds in we leads to a negated configuration: we negate the fact that C G p holds in we. It is followed by a universal choice of uf ∈ ME. For each choice of uf ∈ ME, we progress in an existential configuration that checks that either uf is not a world of ME, either wf is not reachable from we by at most B M,ϕ

mc yes (M, w, E, E 0 ¬C G p) (∃) (∃) (∃) . . . . . . (∀) (∀) (∀) mc yes (M, w, pre(e)) mc yes (M, we, ¬C G p) mc yes (M, we, C G p) (∀) (∀) (∀) . . . . . . (∃) (∃) (∃) in no (uf, ME) . . . access * no (we, uf, G, B M,ϕ , ME) (∃) (∃) (∃) . . . . . . (∀) (∀) (∀) in no (vg,

Lemma 2. The quantities given in gray in Figures 2.1 and 2.2 are strictly decreasing along a branch of the computation tree (i.e. when a recursive call is made, the quantity associated is strictly lower).

Proof. Let us discuss the following cases (the other ones are straightforward):

• The quantity for mc yes (M - → E , w - → e , C G ϕ) is |M - → E |+|C G ϕ|+1 = |M - → E |+log 2 B M,
(w - → e , u - → f , G, B M,ϕ , M - → E ), which is |M - → E | + log 2 B M,ϕ .
• The quantity for mc yes (M Proof. The time is bounded the height of the computation tree rooted in mc yes (M, w, Φ).

- → E , w - → e , E, E 0 ϕ) is |M - → E | + |E| + |ϕ| +
Thanks to Lemma 2, the height of the computation tree is bounded by the quantity associated to

mc yes (M - → E , w - → e , ϕ), that is |M| + |ϕ|.
Recall that this quantity is not the size of the input (M, w, ϕ): for instance the weight of C G -modalities is log 2 B M,ϕ . However this quantity is polynomial in the the size of the input (M, w, ϕ).

At each node of the computation tree, the computation performed in a single node is polynomial. For instance, the instruction "(∀

) (∀) (∀) choose u - → f ∈ M - → E " consists in choosing each bit of u - →
f , thus is polynomial in the size of the input.

To conclude, the execution time on each branch in the computation tree is polynomial.

Complexity of the satisfiability problem of DELCK

The satisfiability problem for DELCK is defined as follows.

Definition 24 (Satisfiability problem).

• Input: a DELCK-formula ϕ.

• Output: yes if there exists a Kripke model M and a world w ∈ M such that M, w |= ϕ, no otherwise.

In this section, we prove the following upper bound result: Theorem 6. The satisfiability problem of DELCK is in 2-Exptime.

We first prove the upper bound result (the membership) and then the lower bound result (the hardness).

Upper Bound of Satisfiability

In order to prove Theorem 6, we will proceed as for proving that Propositional Dynamic Logic is in Exptime and use the method of Pratt [START_REF] Pratt | A Near-Optimal Method for Reasoning about Action[END_REF], but we will simulate tableau method rules of the same kind that in [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF]. Intuitively, we define a canonical Kripke model, where the worlds are called Hintikka sets and the model itself is called the Hintikka structure. The algorithm will then construct the Hintikka structure and remove any inconsistent world, and the resulting model will be a model of the input formula if a world satisfying this formula exists.

To ease the reading, we will w.l.o.g consider that formulas are in negative normal form, defined as follows.

Definition 25 (Negative normal form of DELCK). The syntax of negative normal form of DELCK is defined as follows.

ϕ ::= | ⊥ | p | ¬p | (ϕ ∨ ϕ) | (ϕ ∧ ϕ) | K a ϕ | Ka ϕ | C G ϕ | ĈG ϕ | E, E 0 ϕ | [E, E 0 ]ϕ
Intuitively, it means that negations are pushed in front of atomic propositions, and we will use all connectives ∨, ∧, K a , Ka , C a , Ĉa , E, E 0 , [E, E 0 ]. The following definition gives an inductive function nnf that transforms a formula ϕ into an equivalent formula nnf (ϕ) in negative normal form.

Definition 26 (Function nnf ). The function nnf is defined as follows:

• nnf ( ) = nnf (¬⊥) = ; • nnf (⊥) = nnf (¬ ) = ⊥; • nnf (p) = p; • nnf (¬p) = ¬p; • nnf (ϕ 1 ∨ ϕ 2 ) = nnf (ϕ 1 ) ∨ nnf (ϕ 2 ); • nnf (¬(ϕ 1 ∨ ϕ 2 )) = nnf (¬ϕ 1 ) ∧ nnf (¬ϕ 2 ); • nnf (ϕ 1 ∧ ϕ 2 ) = nnf (ϕ 1 ) ∧ nnf (ϕ 2 ); • nnf (¬(ϕ 1 ∧ ϕ 2 )) = nnf (¬ϕ 1 ) ∨ nnf (¬ϕ 2 ); • nnf (K a ϕ) = K a nnf (ϕ); • nnf (¬K a ϕ) = Ka nnf (¬ϕ); • nnf ( Ka ϕ) = Ka nnf (ϕ); • nnf (¬ Ka ϕ) = K a nnf (¬ϕ); • nnf (C G ϕ) = C G nnf (ϕ); • nnf (¬C G ϕ) = ĈG nnf (¬ϕ); • nnf ( ĈG ϕ) = ĈG nnf (ϕ); • nnf (¬ ĈG ϕ) = C G nnf (¬ϕ); • nnf ( E, E 0 ϕ) = E, E 0 nnf (ϕ); • nnf (¬ E, E 0 ϕ) = [E, E 0 ]nnf (¬ϕ); • nnf ([E, E 0 ]ϕ) = [E, E 0 ]nnf (ϕ); • nnf (¬[E, E 0 ]ϕ) = E, E 0 nnf (¬ϕ);
The negation of a formula ϕ in negative normal form corresponds to nnf (¬ϕ), the formula in negative normal form obtained by negating all connectives. The dynamic modal depth of a formula ϕ, noted dmd(ϕ), is the modal depth by only counting the dynamic operators. E.g. the dynamic modal depth of

K a [E, E 0 ][E , E 0 ]p ∧ [E , E 0 ]C G q is 2.
From now on, in this section, we also suppose that there is a unique event model E, that is the union of all event model appearing in ϕ. The set E 0 will then give the relevant part of the event model E we consider, and so the modality E, E 0 becomes E 0 . We now define the notion of closure of a formula. Definition 27. The closure1 of formula ϕ is the set Cl(ϕ) that contains elements in -→ e and ( -→ e , ψ) where -→ e is a sequence of events in E of length at most dmd(ϕ), and ψ is a subformula (or negation) of ϕ or a subformula (or negation) of a precondition or postcondition in E, under the condition that dmd(ϕ)

+ | - → e | ≤ dmd(ϕ).
The intended meaning of in -→ e is that the current world is compatible with the sequence of events -→ e . The intended meaning of ( -→ e , ϕ) is that formula ϕ is true in the current world after having executed the sequence of events -→ e .

Example 12. Let us take the event model E of Figure 1.5 page 43 and formula ϕ :=

[e]K a [f ]q. The closure Cl(Φ) is the set {in , in e , in ef , in f , in f e , ( , ϕ), ( , K a [f ]q), (e, K a [f ]q), . . . }.

Proposition 4. The size of the closure of ϕ is exponential in |ϕ|.

Proof. There is a direct correspondence between a subformula of ϕ and a node in the syntactic tree of ϕ. Therefore, the number of subformulas of ϕ is in O(|ϕ|). The number of possible ψ is then bounded by O(|ϕ|) (the size of ϕ is the number of memory cells needed to write down ϕ, all the information of the event model E included). The number of possible sequences -→ e is |E| dmd(ϕ) , thus exponential in |ϕ|.

A Hintikka set (see Definition 28) is a maximal subset of Cl(Φ) that is consistent with respect to propositional logic (points 2-4), common knowledge reflexivity (point 5), dynamic operators (point 6-7), executability of events (point 8-9) and postconditions (point 10). Definition 28. A Hintikka set h over Cl(Φ) is a subset of Cl(Φ) that satisfies:

( • H is the set of all possible Hintikka sets over Cl(Φ);

1) If ( - → e , ϕ) ∈ h then in -→ e ∈ h; (2) ( - → e , ϕ ∧ ψ) ∈ h iff ( - → e , ϕ) ∈ h and ( - → e , ψ) ∈ h; (3) ( - → e , ϕ ∨ ψ) ∈ h iff ( - → e , ϕ) ∈ h or ( - → e , ψ) ∈ h; (4) If in -→ e ∈ h then ( - → e , ϕ) ∈ h xor ( - → e , nnf (¬ϕ)) ∈ h; (5) If ( - → e , C G ϕ) ∈ h then ( - → e , ϕ) ∈ h; (6) ( - → e , E 0 ϕ) ∈ h iff
- → e , ĈG ψ) ∈ h but no path h = h 0 → a 1 h 1 . . . h k and no path - → e = - → e (0) → a 1 - → e (1) • • • → a k - → e (k) such that ( - → e (k) , ψ) ∈ h k and
• hR a h if the two following conditions holds:

(K a ) for all ( - → e , K a ϕ) ∈ h we have ( - → e , ϕ) ∈ h for all - → e such that - → e → a - → e and in-→ e ∈ h , (C G ) for all ( - → e , C G ϕ) ∈ h we have ( - → e , C G ϕ) ∈ h for all - → e such that - → e → a - → e
with a ∈ G and in-→ e ∈ h .

The size of the Hintikka structure is double-exponential in |ϕ|, since there are a double-exponential number of different Hintikka sets. We finish by giving the algorithm isDELCK-sat?(see Figure 2.4) whose repeat...until loop takes care of the consistency of diamond modalities, Ka , Ĉa . The algorithm starts with the full Hintikka structure. Points ( Ka ), ( Ĉa ) remove worlds where Ka ψ and Ĉa ψ have no appropriate ψ-successor. We write

- → e → a - → e if for all ( - → e i , - → e i ) ∈ R E a .
Actually, the algorithm decides in double-exponential time whether a DELCK-formula is satisfiable (Propositions 5 and 6).

Proposition 5. Algorithm isDELCK-sat? of Figure 2.4 runs in double-exponential time in |ϕ|.

Proof. The computation of H can be performed by brute-force: enumerate all subsets of Cl(Φ) and discard those which do not satisfy all conditions (1)-( 10 (⇐) Suppose isDELCK-sat? accepts ϕ. We construct a model M = (W, (R a ) a∈Ag , V ) as follows:

• W is the set of Hintikka sets that remain in the structure at the end of the algorithm;

• R a is the relation for agent a at the end of the algorithm;

• V (h) = {p ∈ AP | ( , p) ∈ h}.
The proof finishes by proving the following lemma: Lemma 3. (truth lemma) The properties P(in -→ e ) and P(( -→ e , ϕ)) defined below hold:

• P(in -→ e ): for all h ∈ W , in -→ e ∈ h iff -→ e is executable in M, h;

• P(( - → e , ϕ)): for all h ∈ W , ( - → e , ϕ) ∈ h iff M ⊗ E | -→ e | , (h, - → e ) |= ϕ.
Proof. The proof is performed by induction. The quantity for in -→ e is n|E|. The quantity for ( -→ e , ϕ) is n|E| + |ϕ| where n is the length of -→ e .

We conclude by applying the truth lemma (Lemma 3 to the Hintikka set h that contains ( , ϕ)) and we obtain that M, h |= ϕ.

Remark 1. The 2EXPTIME upper bound also holds for the satisfiability problem of DELCK in S5 Kripke models. We proceed as in [START_REF] Halpern | A Guide to Completeness and Complexity for Modal Logics of Knowledge and Belief[END_REF] (p. 358). We add the following clauses to Definition 28:

(5') If ( - → e , K a ϕ) ∈ h then ( - → e , ϕ) ∈ h;
We add the following clause in the definition of R a in Definition 29:

for all - → e → a - → e , if in -→ e ∈ h and in-→ e ∈ h then ( - → e , K a ϕ) ∈ h iff ( - → e , K a ϕ) ∈ h .

Lower Bound of Satisfiability

The aim of this section is to prove the following theorem. Let us consider any 2-Exptime decision problem L. As Aexpspace = 2-Exptime [START_REF] Ashok | Alternation[END_REF], it is decided by an alternating Turing machine M that runs in exponential space. W.l.o.g we suppose that all executions halt3 and no state is a negated state. We will define a polynomial reduction tr from L to the satisfiability problem of DELCK, that is tr will be computable in polynomial time, and ω is a positive instance of L if and only if tr(ω) is a satisfiable DELCK-formula.

p ω1 x = 1 . . . p ␣ x = N p a x = 0 p ω1 , p q1 x = 1 p ␣ x = N . . . p a1 x = 0 p b , p qacc x = 1 p ␣ x = N . . . p a3 , p qrej x = 0 p ω1 x = 1 p ␣ x = N . . . p a2 , p q2 x = 0 p ω1 x = 1 p ␣ x = N . . . p a4 x = 0 p ω1 , p qacc x = 1 p ␣ x = N . . . Agent t Agent ex
The idea of tr(ω) is to enforce an expected form of a Kripke model as shown in Figure 2.5 that represents the computation tree of M starting with ω on the tape. The cursor of the machine remains in the N -first cell portion of the tape, where N is exponential in |ω|. We define N 0 = log 2 (N ) for the rest of the section. N 0 is polynomial in |ω|.

We introduce two agents: agent ex for the transitions in the computation tree and agent t for the linear structure of tapes. A configuration of the Turing machine is represented by a sequence of worlds linked by agent t: one so-called control world followed by cell worlds.

• The control world contains the type of the configuration: existential (resp. universal) if p ∃ (resp. p ∀ ) is true. A special atomic proposition p win tags control worlds that correspond to winning configurations for player ∃.

• Cell worlds represent the cells of the tape and form a linear structure. They are indexed by x from x = 0 (left-most cell) to x = N (right-most cell). In each cell world, p a is true means that the corresponding cell contains letter a ∈ Γ. A proposition of the form p q being true means that the cursor is at that cell and the current state is

q ∈ Q.
Besides atomic propositions p ∃ , p ∀ , p a , a ∈ Γ and p q , q ∈ Q, we also consider the list of atomic propositions for the bits of the cell index x: x 1 , . . . , x N 0 . We also consider another such list for another cell index v: v 1 , . . . , v N 0 . The index v will be used to compare cell worlds of tapes of a configuration and a successor configuration different tapes during transitions.

e i pre : post : v i ← t, ex f i pre : post : v i ← ⊥ t, ex Figure 2.6: Multi-pointed event models (E i , E i 0 ).
The definition of tr(ω) needs multi-pointed event models (E i , E i 0 ) given in Figure 2.6 non-deterministically and publicly choose the i th bit of value v. We also consider Boolean formulas

x ≤ v, x = v, x = v -1 and finally K t x = x + 1 (the value of K t x 0 . . . K t x N 0 is equal to x + 1). We define the abbreviation [choosev] = [E 0 , E 0 0 ] . . . [E N 0 , E N 0 0 ].
Technically, it corresponds to non-deterministically choosing and publicly announcing a value for v.

Definition 30. Formula tr(ω) is the conjunction of the formulas shown in Table 2.1.

In formulas of Table 2.1, common knowledge operators C ex and Ĉex are used to talk about any control world, while C t and Ĉt talk about any cell world.

Importantly, notice that with DELCK, it is impossible to force the each world to have exactly one successor. Thus in general, the expected Kripke model is not as depicted in Figure 2.5. Instead, we ensure that cell worlds of depth k have the value x = k. We use

Valuations for control worlds

1. C ex (x = 0) x = 0 holds in all control worlds.

2.

C ex (p ∃ ↔ q|g(q)=∃ Ĉt p q ) ∧ (p ∀ ↔ q|g(q)=∀ Ĉt p q ) p ∀ and p ∃ match the type of the state on the tape.

C ex a∈Γ ¬p a ∧ q∈Q ¬p q

Every pa or pq is false.

Winning condition

4. C ex (( Ĉt p qacc ) → p win ) ∧ ( Ĉt p q rej ) → ¬p win ))
If the current state is qacc the world is marked as winning, if the current state is q rej it is marked as losing.

5

.

C ex ( (p ∀ ∧ (C t (¬p qacc ∧ ¬p q rej ))) → (p win ↔ K ex p win ))
If the current state is not qacc nor q rej and is universal, the world is marked as winning if all successor worlds are marked as winning.

6.

C ex ( (p ∃ ∧ (C t ¬p qacc ∧ ¬p q rej ))) → (p win ↔ Kex p win ))
If the current state is not qacc nor q rej and is existential, the world is marked as winning if one successor world is marked as winning.

Tape

7. C ex K t (x = 0)
The cell index of the left-most cell is 0.

8. C ex K t C t N 0 i=0 (K t x i ∨ K t ¬x i )
On any tape world, the value of x is the same in all successors

9. C ex K t C t (K t x = x + 1)
On any tape world, the value of x is incremented by 1 on all successors.

10.

C ex K t C t (⊕ a∈Γ p a )
On any tape world, only one pa is true and represent the current letter on the cell.

C ex Ĉt (⊕ q∈Q p q )

On any tape, somewhere only one pq is true 12. C ex C t q∈Q p q → C t q ∈Q ¬p q Anywhere, if pq is true then no p q is true anywhere on the rest of the tape.

Transitions

We define here ϕ (q,a,q ,b,d

) = C t ((x = v → p b ∧ ¬p q ) ∧ (x = v + d → p q )) 13. [choosev]C ex a∈Γ Ĉt (p a ∧ q∈Q ¬p q ∧ x = v) → K ex C t (x = v → p a )
On the tape, if no pq is true and pa is true, then at the same position on the successors' tapes, pa is true.

14.

(q,a,q ,b,d)∈δ

[choosev] C ex ( Ĉt (p q ∧ p a ∧ x = v) → Kex ϕ (q,a,q ,b,d) )
If there is a transition it must be present on the model.

15.

[choosev] a∈Γ q∈Q

C ex Ĉt (p q ∧ p a ∧x = v) → K ex (q,a,q ,b,d)∈δ ϕ (q,a,q ,b,d)
In every world, any ex-successor must correspond to a transition.

Initial configuration

16.

|ω|-1

i=0 C t ((x = i) → p ω(i) )
The letters of the initial word are on the initial tape.

C t ((x ≥ |ω|) → p ␣ )

Cells of index |ω| are blank.

K t p q 0

Head in the left-most cell. Initially in the initial state.

p win

The initial control world is winning. formula (8) that imposes the value of x to be the same in all successor cell worlds, and formula (9) saying that everywhere, K t x = x + 1. Formula (10) states that only one p a is true in each cell world, formula (11) states that only one p q is true in some cell world, and formula (12) states that if p q is true in a cell world, then no p q is true in all the t-successors. Formulas ( 16), ( 17) and (18) define the initial tape. Transitions are ensured by formulas (13) to (15). These formulas automatically ensure that several cell worlds with the same index x have the same valuation over x, p a , a ∈ Γ, p q , q ∈ Q.

Formulas that handle transitions use integer v to pinpoint a cell index in the tape. It is used in formula (13) to tell that when the cursor is not in a cell world, then the letter remains the same during any transition. It is also used in formula (14) to check the existence of all compatible transitions and in formula (15) to check that all successor control worlds and their tapes correspond to a transition.

Proposition 7. tr(ω) is satisfiable if and only if ω is a positive instance of L.

The lower bound given in Theorem 7 still holds for the variant of the satisfiability problem where we require the model to be S5, that is, epistemic relations, to be equivalence relations.

Example: blind tic tac toe

In this section, we express in DEL the existence of a uniform winning strategy in the blind tic tac toe game. We begin by giving the rules of the game, then define some useful macros for defining the event models, give the models and finally the formula.

For a recall on uniform winning strategies, the reader may refer to Appendix B. We do not model the game here, just explain the rules.

Rules of the game

Blind tic tac toe is a two player game where the goal is to fill a row, a column or a diagonal with only • (for Player •) or only × (for player ×). The difference with basic tic tac toe is that players do not see the actions of the other Player.

The game begins with Player •. At each turn, the current player attempts to play his token on a position in the grid where he did not put a token before. Then one of the two following cases occur.

• If there is nothing on the cell the token is now played on the cell.

• Otherwise, an external referee informs the player that the move is invalid. The player can then attempt to play somewhere else.

The adversary does not see where the token is played, but hears the referee. Therefore he knows whether the Player played a token or was given an information.

The game stops when a row, a column or a diagonal is filled by tokens of the same player.

Figure 2.7 gives an example of play. Each player maintains his grid according to his previous moves and the information he gained. Notice that until turn 5, each move is played on an empty cell, therefore the players do not gain information on their opponent's previous moves. At turn 5, Player • attempts a move that is invalid, he thus gains a information that a × is present in the cell. Therefore, he has the right to play another move. The game stops at turn 6 because Player × completes a diagonal, and is thus the winner. Valid move We now define the problem we want to tackle.

Grid

• ו × • Turn 5 Invalid move • •×• × Turn 5 Valid move ו •×• × Turn 6 Valid move ו •×• × End Player × wins
Definition 31 (Blind tic tac toe problem). It is defined as follows.

• Input: an integer n (the size of the grid);

• Output: does there exist a uniform winning strategy for player • in blind tic tac toe in a n × n grid.

We now describe the reduction of the tic tac toe problem to the model checking problem of DEL.

Atomic propositions and macros

In this subsection, we consider a fixed integer n. The agents are Ag = {•, ×}. We assign coordinates to each cell. For instance in Figure 2.8, the • token is in cell (1,2) and the × token in cell (3,1).

• ×

x y 1 2 3 1 2 3 We begin by defining the set of atomic propositions AP needed for defining the problem:

Definition 32 (Atomic propositions for blind tic tac toe). We define

AP = {p z • , z ∈ {1, . . . , n} 2 } ∪ {p z × , z ∈ {1, . . . , n} 2 } ∪ {c z • , z ∈ {1, . . . , n} 2 } ∪ {c z × , z ∈ {1, . . . , n} 2 } ∪ {t • , t × , p end }.
The meaning of the atomic proposition is the following.

• z is a pair (x, y) of integers in {1, . . . , n} (position in the grid);

• p z • (resp. p z × ) is true iff there is a • token (resp. a × token) in z; • c z • (resp. c z × ) is true iff Player • (resp.
Player ×) has chosen to do a move in position z (such atomic propositions will be used later in event models);

• t • (resp. t × )
• •×• ×
It is represented by the world with valuation {p (1,2)

• , p (2,3) • , p (3,2) • , p (2,2) × , p (3,1) × , t × }.
We now define a formula ϕ win • (resp. ϕ win × ) to express that • (resp. × )wins the game.

Definition 33 (Winning condition for blind tic tac toe). The formula ϕ win

• is defined as follows.

ϕ win • =   n x=1 n y=1 p (x,y) •   column ∨   n y=1 n x=1 p (x,y) •   row ∨ n x=1 p (x,x) • ∨ n x=1 p (x,n+1-x) • diagonal Formula ϕ win

Reduction into DEL

We now describe the initial Kripke model, the event models and the formula characterizing the existence of a uniform winning strategy in blind tic tac toe.

Initial Kripke model

The initial Kripke model consists in a unique world, the empty grid (Figure 2.9).

Definition 34 (Initial Kripke model for blind Tic Tac Toe). Let M 0 = (W, (R a ) a∈Ag , V ) with:

• W = {w 0 }; • R • = R × = {(w 0 , w 0 )}; • V (w 0 ) = {t • }. w 0 : {t • } •, ×

Event models for choosing a position

A Player's turn is divided in two event models: one choosing a position to play a token on and one for the effect of the move. Figure 2.10 shows an example of the event model (E (1,1)

• , E (1,1) • ) for Player • to choose the cell (1, 1) on a 2 × 2 grid.
In (E z

• , E z • ), there is one event e z •,choose for each possible position z , for "Player • chooses to play in position z ". Player × does not know the position, so he imagines as possible any event e z •,choose .

Definition 35

(Event model (E z • , E z • )). The event model E z • = (E, (R E a ) a∈Ag , pre, post
) is defined as follows:

• E = {e z •,choose , z ∈ {1, . . . , n} 2 }; e (1,1)
•,choose :

pre : post : c (1,1)

• ← e

(1,2)

•,choose :

pre : post : c (1,2)
• ← e

(2,1)

•,choose :

pre : post : c (2,1) • ← e (2,2)
•,choose :

pre : post : c (2,2) • ← •, × •, × •, × •, × × × × × × × Figure 2
.10: Event model (E (1,1)

• , E (1,1)

•

) for a 2 × 2 grid. .

• R E • = {(e z •,choose , e z •,choose ), z ∈ {1, . . . , n} 2 }; • R E × = E × E ; • pre(e z •,choose ) = ; • post(e z •,choose , c z • ) = • post is trivial otherwise. Additionally, E z • = {e z •,choose }.
The event model for × is defined similarly by switching • and ×'s roles.

Event model for playing a token

We now describe the event model of playing a token in the position chosen by •. It is composed of two types of events: e z •,play and e z •,inf o that model the fact that the move resulted in a token played at position z (for event e z •,play ) or in an information for Player • (for event e z

•,inf o ). Such events are drawn in Figures 2.11 and 2.12. Notice first that both events are executable only if there is no

•-token in z (¬p z • ), Player • does not know that there is a × token in z (¬K • p z × ), it is Player •'s turn to play (t • ), Player • has chosen to play in z (c z • )
and the game has not ended yet p end . If such conditions are not fulfilled, the previous choice of a position was invalid, thus removing any invalid move from possible strategies. Furthermore:

• Event e z

•,play is executable in the case where there is no ×-token in z (¬p z × ). The effect is that there is now a •-token in z (p z

• ← ), and it is now the other Player's turn (t • ← ⊥; t × ← ).

• Event e z

•,inf o is executable in the case where there is a ×-token in z (¬p z × ). In this case, there is no effect (trivial postcondition).

e z

•,play :

pre : ¬p z • ∧ ¬K • p z × ∧ c z • ∧ ¬p z × ∧ t • ∧ ¬p end post : p z • ← ; t • ← ⊥; t × ← ; c z • ← ⊥ Figure 2.11: Event e z •,play . e z •,inf o : pre : ¬p z • ∧ ¬K • p z × ∧ c z • ∧ p z × ∧ t • ∧ ¬p end post : c z • ← ⊥ Figure 2.12: Event e z •,inf o .
The pointed event model (E

e (1,1) •,inf o e (1,2) •,inf o e (2,1) •,inf o e (2,2) •,inf o •, × •, × •, × •, × •, × •, × •, × •, × × × × × × × × × × × × × Figure 2.13: Event model (E pl • , E pl • ) for a 2 × 2 grid. . • E = {e z •,play , z ∈ {1, . . . , n} 2 } ∪ {e z •,inf o , z ∈ {1, . . . , n} 2 }; • R E • = {(e z •,play , e z •,play ), z ∈ {1, . . . , n} 2 } ∪ {(e z •,inf o , e z •,inf o )z ∈ {1, . . . , n} 2 }; • R E × = {(e z •,play , e z •,play ), z , z ∈ {1, . . . , n} 2 } ∪ {(e z •,inf o , e z •,inf o )z , z ∈ {1, . . . , n} 2 }; • pre(e z •,play ) = (¬p z • ∧ ¬K • p z × ∧ c z • ∧ ¬p z × ∧ t • ∧ ¬p end ) for all z ; • pre(e z •,inf o ) = (¬p z • ∧ ¬K • p z × ∧ c z • ∧ p z × ∧ t • ∧ ¬p end ) for all z ; • post(e z •,play , p z • ) = post(e z •,play , t × ) = for all z ; • post(e z •,play , t • ) = post(e z •,play , c z • ) = post(e z •,inf o , c z • ) = ⊥ for all z ;
• post is trivial otherwise.

Additionally,

E z • = {e z •,play , e z •,inf o }.

Dummy event model to fill the turns

We do not know in advance the length of a turn, it may need several applications of event models (E pl • , E pl • ). That is why in the formula will we say that event models (E pl • , E pl • ) are played n 2 times, and introduce a dummy event model (E du

• , E du • ) that is executable iff the turn has ended (Figure 2.14).

e pass :

pre

: ¬t • ∨ p end post : c z • ← ⊥ for all z •, × Figure 2.14: Event model (E du • , E du • ) Definition 37 (Event model (E du • , E du • )). The event model (E du • , E du • ) = (E, (R E a ) a∈Ag , pre, post) is defined as follows: • E = {e pass }; • R E • = R E × =
{(e pass , e pass )};

• pre(e pass ) = ¬t • ∨ p end ;

• post(e pass , c z • ) = ⊥ for all z ;

• post is trivial for other propositions.

Additionally E pass = {e pass }.

Event model to declare the end of the game

At the end of each turn, the event model (E end , E end ) (Figure 2.15) will be executed to declare the end of the game (i.e. assign p end to ). It is executable if any of the players wins, meaning that ϕ win

• ∨ ϕ win × is true.
Definition 38 (Event model (E end , E end )). The event model (E end , E end ) = (E, (R E a ) a∈Ag , pre, post) is defined as follows:

• E = {e end }; e end : pre : ϕ win • ∨ ϕ win × post : p end ← •, × Figure 2.15: Event model (E end , E end ) • R E • = R E × = {(e end , e end )}; • pre(e end ) = ϕ win • ∨ ϕ win × ;
• post(e end , p end ) = ;

• post is trivial for other propositions.

Additionally E end = {e end }.

Formula

Let (E ch

• , E ch • ) = z ∈{1,...,n} 2 (E z • , E z • )
. Now the formula fragment describing a turn for agent • is the following:

t • = ( (E ch • , E ch • ) K • (E pl • , E pl • ) ∪ (E du • , E du • ) ) n 2 (E end , E end )
The turn is divided in two steps: first the choice of a position ((E ch

• , E ch • )) and then the move, with a possibility of a dummy event if the turn was already ended ((E pl

• ,

E pl • ) ∪ (E du • , E du • )
). The modality K • in the formula t • ensures the uniformity of the position choice: it must be winning in any possible world for Player •. Then, after n 2 moves (which is an obvious and improvable upper bound of the length of the turn), we verify whether the game has ended with (E end , E end ).

For Player × the formula fragment is similar except that it does not contain any K × operator (since the winning strategy must work against any action of Player ×):

t × = ([(E ch × , E ch × )][(E pl × , E pl × ) ∪ (E du × , E du × )]) n 2 [(E end , E end )] Finally the whole formula is: ϕ = (t • t × ) n 2 /2 ϕ win • Each event model is at most of size O(n 2
). Overall, it means that ϕ is of size O(n 6 ), which is polynomial in n. Therefore, the reduction is polynomial, leading to the following theorem.

Theorem 8. The blind tic tac toe problem is in Pspace.

Conclusion

In this chapter, we have defined the model checking and satisfiability problems, and have proven that the complexity of the model checking problem is Pspace-complete for DELCK, meaning that adding common knowledge does not change the complexity of the model checking problem. However, for the satisfiability problem, we go from NExptime (for DEL) to 2-Exptime (for DELCK).

Finally, we have applied the model checking result to the blind tic tac toe game, thus proving that searching for the existence a uniform winning strategy in blind tic tac toe yields a Pspace problem.

Chapter 3

Symbolic Dynamic Epistemic Logic

In Chapter 1, we have introduced DELCK and shown in Chapter 2 that the complexity of the model checking problem is Pspace-complete. Yet, this complexity may seem a bit artificial, because the polynomial is defined with respect to the size of the input, namely |M| + |w| + |ϕ|. Take for instance the muddy children example defined in Example 3 page 37. The associated Kripke model drawn in Figure 1.2 page 38 has 2 n worlds in general where n is the number of children. Indeed, the Kripke model may have an exponential number of worlds when described explicitly. In practice, we may want to have an implicit representation of the model that is more succinct. This is what we propose in this chapter.

Usually, if the description language is (exponentially) more succinct, algorithmic problems become (exponentially) harder. For instance, deciding the existence of an Hamiltonian cycle is NP-complete but it becomes NExptime-complete [START_REF] Papadimitriou | Computational complexity[END_REF] when the input graph is described succinctly. A succinct representation of a graph with 2 b nodes is a Boolean circuit C such that there is an edge (i, j) ∈ 0, . . . , 2 b -1 2 iff C accepts the binary representations of the b-bit integers i, j as inputs.

In DELCK, the results are surprising. Here, we would expect that the succinct version of the model checking is Expspace-complete. Actually, we provide a framework where the representation of events such as attention-based announcements [START_REF] Bolander | Announcements to Attentive Agents[END_REF] is exponentially more succinct whereas the model checking remains in Pspace.

Here, we do not use Boolean circuits traditionally used for representing instances for succinct decision problems (see [START_REF] Papadimitriou | Computational complexity[END_REF], Chapter 20.1) but accessibility programs (also called mental programs in the literature) based on Dynamic Logic of Propositional Assignments (DL-PA) ([BHT13], [START_REF] Balbiani | DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE[END_REF]) as developed in [START_REF] Charrier | Arbitrary Public Announcement Logic with Mental Programs[END_REF]. The reason of that choice is that our model checking algorithm directly relies on DL-PA.

The chapter is divided as follows:

• First, we define the notion of symbolic Kripke models and symbolic event models, and prove that we do not lose in expressivity and that some usual Kripke/event models have an exponentially more succinct representation.

• Second, we comment on the complexity of model checking and satisfiability problems that remain the same for DELCK with or without symbolic models in input.

• Third, we model the bridge card game with succinct DELCK and establish that searching for a uniform winning strategy is a Pspace-problem even when the initial situation is described symbolically.

• Fourth, we discuss related work on symbolic models for epistemic logic.

• Finally, we conclude.

Our first definition of symbolic models and the expressivity/succinctness results have been published in [START_REF] Charrier | A Succinct Language for Dynamic Epistemic Logic[END_REF]. The current definition of symbolic models with the model checking/satisfiability results have been published in [START_REF] Charrier | Complexity of Dynamic Epistemic Logic with Common Knowledge[END_REF].

Programs and Symbolic Models

We describe a symbolic way of describing Kripke models: the set of worlds is the set of all valuations over the set AP of propositional variables and accessibility relations a -→ are given in a symbolic manner by means of programs, based on the programs of the Dynamic Logic of Propositional Assignments (DLPA) [START_REF] Balbiani | Dynamic Logic of Propositional Assignments: A Well-Behaved Variant of PDL[END_REF]. In the rest of the manuscript, we let U = 2 AP be the set of all valuations over AP. When we discuss succinct Kripke models, a typical world w is associated with its valuation on U and we may confuse the notion of world and valuation.

Programs for accessibility relations

We first introduce the syntax of programs.

Definition 39 (Syntax of programs). The syntax of programs π is defined as follows.

π ::= p←β | β? | π; π | π ∪ π where p ∈ AP, β is a propositional formula.
The intuitive meaning of programs is the following. The program p←β sets variable p to the truth value of β. β? tests whether β holds or not. The program π; π executes π then execute π . The program π ∪ π non-deterministically executes π or π .

Originally in DL-PA programs also feature the Kleene star π * for "execute π a nondeterministic finite number of times", yet here we choose to not include it in the syntax since it is not very relevant afterwards. Instead, iteration over programs will be featured with the common knowledge operator. Furthermore, initially the only allowed assignments in DL-PA are p ← ⊥ and p ← but here we choose to have a more convenient syntax. Our syntax is equivalent since p ← β is equivalent to (β?; p ← ) ∪ (¬β?; p ← ⊥).

The semantics of a program π is an accessibility relation over U , written π -→, and defined by induction over π as follows.

Definition 40 (Semantics of programs). The semantics of a program π is a subset of U 2 defined as follows.

•

w p←β --→ u if (u = w\{p} and w |= β) or (u = w ∪ {p} and w |= β); • w β? -→ u if w |= β and w = u; • w π 1 ;π 2 ---→ u if there exists v ∈ U such that w π 1 -→ v and v π 2 -→ u; • w π 1 ∪π 2 ---→ u if w π 1 -→ u or w π 2 -→ u.
We distinguish a particular program set(p 1 , ..., p n ) that allows to reach all worlds which may differ from the current one only on the valuation of propositions p 1 , ..., p n . This program non-deterministically assigns values to p 1 , ..., p n , namely:

set(p 1 , ..., p n ) = (p 1 ←⊥ ∪ p 1 ← ); . . . ; (p n ←⊥ ∪ p n ← )
We now give examples of programs. Example 15 (Program for an omniscient agent). The program ? represents an omniscient agent since the only reachable valuation with ? is the actual valuation, the only possible world is the current one. For instance in the muddy children, the program of the father is π f = ?.

Example 16 (Program for an agent believing p). Let AP = {p, q}. The program π = p← ; set(q) represents an Agent a that believes p but is uncertain of q.

The size of a program is defined as follows.

Definition 41 (Size of a program). It is noted |π| and is defined by induction:

• |p ← β| = 1 + |β|; • |β?| = 1 + |β|; • |π 1 ; π 2 | = 1 + |π 1 | + |π 2 |; • |π 1 ∪ π 2 | = 1 + |π 1 | + |π 2 |.
Now that programs are defined, we turn to symbolic (Kripke) models.

Symbolic Kripke models

Symbolic models are fully defined by means of the programs that denote accessibility relations between the set of valuations.

• W = {w ∈ U | w |= β M }; • a - →= {(w, u) | w πa -→ u}; • V (w) = w.
Notice that the translation from symbolic Kripke models to Kripke models can be also done conversely, meaning that we do not lose expressivity by considering symbolic Kripke models.

Definition 44. Let M = (W, (R a ) a∈Ag , V ) be a Kripke model. We define the succinct Kripke model M M = AP M , β M , (π a ) a∈Ag where:

• AP M = AP ∪ {p w | w ∈ W }; • β M = ∃!({p w | w ∈ W })∧ w∈W p w → desc(V (w))
• π a = wRau p w ?; set(AP M ); p u ?.

The intended meaning of the fresh atomic propositions p w is to designate the world w (as nominals in hybrid logic [START_REF] Blackburn | Representation, Reasoning, and Relational Structures: a Hybrid Logic Manifesto[END_REF]). Formula β M describes the set W and the valuation V . Program π a performs a non-deterministic choice over edges wR a u and then simulate the transition wR a u. The following proposition states that M M indeed represents M. Proposition 8. ( M(M M ), {p w } ∪ V (w)) and (M, w) are AP-bisimilar.

Proof. We note M = (W, (R a ) a∈Ag , V ) and M(M M ) = (W , (R a ) a∈Ag , V ). We define

B := {(u, p u ∪ V (u)) | u ∈ W }. Let us prove that B is a AP-bisimulation.
• AP-conservation: for all w ∈ W , the valuation of w on AP is V (w) by definition.

The valuation of {p w } ∪ V (w) is also V (w) since p w ∈ AP. The AP-conservation is thus proven.

• Zig: consider w ∈ W . Then we have p w ∪ V (w) |= β M by Definition 44, therefore

{p w } ∪ V (w) ∈ M(M M )
. For all u ∈ W , we then also have

{p u } ∪ V (u) ∈ M(M M )
and if wR a u then we have p w ∪ V (w) πa -→ p u ∪ V (u) so we have wR M(M M ) a u.

• Zig: the reasoning is symmetrical, since w and p w ∪ V (w) have a one on one correspondence.

Therefore, with the potential cost of more atomic propositions, it is always possible to go from Kripke model to symbolic Kripke models and vice versa.

{p bel } ∅ {p, p bel } {p} π a π b π b π a , π b π a , π b π a , π b π a , π b a. b.
Figure 3.2: Kripke model with multi-valuations and its symbolic representation.

symbolic Kripke model is quadratic in the number of children, whereas the Kripke model has exponential size. Notice that we cannot find another Kripke model exponentially smaller AP-bisimilar since each valuation must be present in an explicit Kripke model representing the muddy children. Therefore, the example of muddy children shows that there exist Kripke models such that there exist a symbolic counterpart exponentially smaller, and that this exponential is significant because the Kripke model could not be reduced written explicitly. Therefore, the following theorem is true.

Theorem 9. There exists a family of Kripke model (M n ) n∈N of exponential size in n such that there exists a family of equivalent succinct Kripke models (M n ) n∈N which are of polynomial size in n.

Proof. Take n as the number of children in the muddy children puzzle.

Symbolic Event Models

We adopt a similar method for symbolic event models.

Definition 45. A symbolic event model is a tuple E = AP E , χ E , (π a,E ) a∈Ag , pre, post where:

• AP E is a set of atomic propositions disjoint from AP;

• χ E is a propositional formula over AP E characterizing the set of events;

• π a,E is a program over AP E for all a ∈ Ag;

• pre is a propositional formula over AP E ∪ L EL (AP) (meaning that any atom from AP E cannot be under the scope of a K or a C operator);

• for all p ∈ AP, post(p) is a propositional formula over AP E ∪ L EL (AP).

As for symbolic Kripke models, the set of events in symbolic events models is described by a set of valuations. Here, we choose to distinguish the atomic propositions that describe the set of possible events (AP E ) from the atomic propositions that describe the preconditions and the postconditions (AP).

Similarly to symbolic Kripke models, it is possible to express any event model as a symbolic event model and vice versa.

Definition 46. Given a symbolic event model E = AP E , χ E , (π a,E ) a∈Ag , pre, post , the event model represented by E, noted Ê(E) is the model (E, (R E a ) a∈Ag , pre, post) on AP where:

• E = {v e ∈ V(AP E ) | v e |= χ E }; • R E a = {(v e , v e ) | v e π a,E --→ v e };
• pre(v e ) = pre| ve which is pre where every atomic proposition of AP E is replaced by its value in v e ;

• post(v e , p) = post(p)| ve .

The definition is quite straightforward. The set of events is the set of valuations satisfying χ E We define a symbolic event model E E representing the event model E.

Definition 47. Let E = (E, (R E a ) a∈Ag , pre, post) be an event model on AP. We define the symbolic event model E E = AP E , χ E , (π a,E ) a∈Ag , pre, post where:

• AP E = {p e | e ∈ E}; • χ E = ∃!(AP E ); • π a,E = eR E a f p e ?
; p e ← ⊥; p f ← ;

• pre = e∈E (p e → pre(e));

• post(p) = e∈E (p e → post(e, p)).

Fresh atomic proposition p e is used to designate the event e. Formula χ E describes the set E. Program π a,E performs a non-deterministic choice in the same spirit than π a in Definition 44. The formulas pre and post(p) mimic the formulas pre and post(p).

It is possible to define symbolic multi-pointed event models (E, β 0 ): β 0 is just a boolean formula on AP E defining the set of pointed events.

Example 20. The event model E of Figure 1.3 page 41 is modeled by the symbolic event model E E = AP M , AP E , χ E , (π a,E ) a∈Ag , post with:

• AP E = {p e , p f };

• χ E = ∃!(AP E ); • π a,E = p e ? ∪ p f ? • π b,E = (p e ?; p e ← ⊥; p f ← ) ∪ (p f ?); • pre = (p e → p) ∧ (p f → ); • post(p) = (p e → ⊥) ∧ (p f ← p).

Succinctness of symbolic event models

As for succinct Kripke models, we provide a family of event models having exponentially more compact representations with symbolic event models. First let us define this family of event models. Example 21. We focus on the notion of attention-based announcement of p as shown in [START_REF] Bolander | Announcements to Attentive Agents[END_REF]. In addition of classic atomic propositions, we add propositions h a for "agent a is listening to the announcement". The attention-based announcement of p can be then represented by the event model E = (E, (R E a ) a∈Ag , pre) where:

pre : ¬p∧¬h a 1 ∧¬h a 2 post : / pre : ¬p∧¬h a 1 ∧h a 2 post : / pre : ¬p∧h a 1 ∧¬h a 2 post : / pre : ¬p∧h a 1 ∧h a 2 post : / pre : p∧¬h a 1 ∧¬h a 2 post : / pre : p∧¬h a 1 ∧h a 2 post : / pre : p∧h a 1 ∧¬h a 2 post : / pre : p∧h a 1 ∧h a 2 post : / idle : a 1 , a 2 a 1 a 1 , a 2 a 1 a 2 a 2 a 1 , a 2 a 1 a 2 a 1 , a 2 a 1 a 2 a 1 , a 2
• E = V({p} ∪ {h a | a ∈ Ag}) ∪ {e idle };
• for all a, (e, f ) ∈ R E a if e = e idle , f = e idle , e |= h a and f |= p;

• for all a, (e, e idle ) ∈ R E a if e = e idle and e |= h a ;

• for all a, (e idle , e idle ) ∈ R E a ;

• pre(e) =  



e if e = e idle otherwise. ;

• post is trivial.

Figure 3.3 shows the event model of the attention-based announcement of p for two agents a 1 and a 2 . Event e idle is the event where nothing happens. The relation R E a is defined as follows: if a is listening (e |= h a ) then a believes that p has been announced (f |= p). If a is not listening (e |= h a ) then a believes nothing happens. The precondition is defined to match the fact that attentive agents listen to the announcement of p (thus leading to events where p holds) and that others agents believe that nothing that happened (thus the precondition on e idle ). The announcement is purely epistemic so the postcondition function is trivial.

Let us consider the family of models (E n ) n∈N given in Example 21 for all number of agents n. The event model E is succinctly represented by the symbolic event model

E = AP M , AP E , χ E , (π a,E ) a∈Ag , post defined by • χ E = ;
• π a,E = (¬p idle ?; (h a ?; p← ; set({h b , b ∈ Ag}))∪ (¬h a ?; set(AP M ); p idle ← )) ∪(p idle ?; set(AP M ));

• post = ?.

Atomic proposition p idle intuitively means that the event e idle is occurring (at the bottom in Figure 3.3). Formula χ E = means that the set of possible events in unconstrained. Program π a,E works as follows: if p idle is false, if h a is true, assign to p and arbitrarily change h b for all b = a; if h a is false, change valuations of propositions in AP M and set p idle to true; otherwise if p idle is true, change all truth values of propositions in AP M . The number of worlds in

E is 2 n+1 + 1 while the size of E is O(n 2 ) (each program π a,E is of size O(n)).
Notice that this is not sufficient to say that we have found a family of event models whose symbolic representation is exponentially more succinct. Indeed, the event model itself could be too big, because the event model may be reducible, which was not the case in the muddy children Kripke model before. For instance take the event model with one event whose precondition is and with trivial postcondition, and take a second one with two events with preconditions p and ¬p and trivial postconditions, linked by all agents for epistemic relations. Then both event models are equivalent, although the preconditions in the second one are disjoint.

To show that the event model is not reducible, we need here a notion of equivalence between event model called action emulation.

Definition 48. Let E = (E, (→ E a ) a∈Ag , pre) and E = (E , (→ E a ) a∈Ag , pre ) be two event models without postconditions Let Σ be the set of preconditions appearing in E and E . Let Σ be the set of formulas containing Σ and closed under sub-formulas and negation (see [START_REF] Van Eijck | Action emulation[END_REF] for more details). Let CS( Σ) be the set of maximal consistent subsets of Σ. An

action emulation AE is a set of relations {AE Γ } Γ∈CS( Σ) ⊆ E × E such that whenever eAE Γ e :
• Invariance: pre(e) ∈ Γ and pre(e ) ∈ Γ;

• Zig: For all f ∈ E and Γ ∈ CS( Σ), if e → E a f , pre(f ) ∈ Γ and the formula ψ∈Γ ψ ∧ Ka ψ ∈Γ ψ is consistent then there exists f ∈ E such that e → E a f and f AE Γ f ; • Zag: symmetric of Zig for E .
Action emulation is similar to bisimulation in the sense that the types of rules are the same, except that instead of imposing equivalence for preconditions, we just ask here that they are in a same maximal consistent subset of Σ.

Action emulation characterizes equivalence for event models without postconditions:

E and E are equivalent if there is an action emulation AE between E and E such that for all e ∈ E and Γ ∈ CS( Σ) there exists e ∈ E such that eAE Γ e and vice versa. Now we prove that standard event models cannot represent E n as succinctly as symbolic event models.

Theorem 10. There is no propositional event model E n equivalent to E n with less that 2 n events.

Proof. We use the characterization of equivalent models with action emulations (Definition 48). We suppose that there is an action emulation AE between E n and E n . Let Σ be the set of preconditions of E n and E n . Note that Σ (defined as in Definition 48) is a set of propositional formulas. Let e 1 and e 2 be events of E such that pre(e 1 ) |= p and pre(e 2 ) |= p and e 1 = e 2 . Suppose that there is e of E n , Γ 1 , Γ 2 such that e 1 AE Γ 1 e and e 2 AE Γ 2 e . As e 1 = e 2 , there is an agent a such that pre(e 1 ) |= ¬h a and pre(e 2 ) |= h a (we swap e 1 and e 2 if pre(e 1 ) |= h a and pre(e 2 ) |= ¬h a ).

Then e 1 R En a e idle . We consider the maximal consistent subset Γ = {ϕ ∈ Σ|{h a , a ∈ Ag} |= ϕ} . We have pre(e idle ) ∈ Γ and the formula ψ∈Γ 1 ψ ∧ Ka ψ ∈Γ ψ is consistent (because Γ 1 and Γ are propositional). By Zig, there exists f ∈ E such that e R E n a f with e idle AE Γ f . By Zag, as e 2 AE Γ 2 e and the formula ψ∈Γ 2 ψ ∧ Ka ψ ∈Γ ψ is consistent, there exists f ∈ E such that eR En a f and f AE Γ e . By invariance we obtain pre(f ) ∈ Γ . However we necessarily have here pre(f ) |= p so {h a , a ∈ Ag} |= pre(f ). Therefore we derive a contradiction.

This proves that there at least 2 n events.

Model checking and satisfiability

Model checking

Let M be a symbolic Kripke model and ϕ ∈ L DELCK a formula containing only symbolic event models. We define the notation M, w |= ϕ for M(M), w |= ϕ where w is the counterpart of w in the Kripke model M(M) and ϕ is ϕ where each event model (E, β 0 ) is replaced by ( Ê(E), E 0 ) with E 0 = {e | e |= β 0 }. The symbolic model checking problem is now defined as follows.

Definition 49 (Model checking problem). The succinct model checking problem of DELCK is defined as follows:

• Input: a symbolic Kripke model M, a world w of M, a formula ϕ of DELCK whose event models are symbolic.

• Output: yes if M, w |= ϕ, no otherwise.

Here we prove that the symbolic model checking problem against DELCK is also Pspace-complete. In fact, we do not go into much detail, because the proof is almost identical to the Pspace-completeness of the model checking problem against DELCK.

The algorithms for the symbolic checking are given in Figures 3.4, 3.5 and 3.6. The main differences are the following. • Instead of checking whether (w, u) ∈ R a we have w πa -→ u, checked by the procedure relation yes (w, u, π a ). This procedure takes |π a | in time so it does not change the overall complexity.

proc mc yes (M - → E , w - → e , ϕ) |M -→ E | + |ϕ| accepts whenever M - → E , w - → e |= ϕ case ϕ = p: inval yes (p, M - → E , w - → e ) case ϕ = (ϕ 1 ∨ ϕ 2 ): (∃) (∃) (∃) choose i ∈ {1, 2}; mc yes (M - → E , w - → e , ϕ i ) case ϕ = ¬ψ: mc no (M - → E , w - → e , ψ). case ϕ = K a ψ: (∀) (∀) (∀) choose u - → f ∈ M - → E (∃) (∃) (∃) access no (w - → e , u - → f , a, M - → E ) or in no (u - → f , M - → E ) or mc yes (M - → E , u - → f , ψ) case ϕ = E, β 0 ψ: (∃) (∃) (∃) choose e such that e |= β 0 ; (∀) (∀) (∀) mc yes (M - → E , w - → e , pre| ve ) and mc yes (M - → E :: E, w - → e :: e, ψ). case ϕ = C G ψ: (∀) (∀) (∀) choose u - → f ∈ M - → E (∃) (∃) (∃) access * no (w - → e , u - → f , G, B M,ϕ , M - → E ) or in no (u - → f , M - → E ) or mc yes (M - → E , u - → f , ψ)
• Instead of pre and post we now have pre and post, their symbolic counterparts.

Therefore, instead of pre(e), we now have pre| ve . Constructing pre| ve takes linear time in the size of pre. Here we can consider it to simplify that it is constant since the a computation branch is linear in respect of the size, so the constructions of formulas pre| ve and post(p)| ve will add a quadratic factor to the time taken in the worst case.

proc inval yes (p, w - → e , M - → E ) |M - → E | accepts whenever p ∈ V (w - → e ) case - → E = : if p ∈ w then accept else reject case - → E = - → E ::E, w - → e = w - → e ::e: mc yes (M - → E , w - → e , post(p)| ve ) proc in yes (w - → e , M - → E ) |M - → E | accepts whenever w - → e ∈ M - → E case - → E = : accept case - → E = - → E ::E, w - → e = w - → e ::e: (∀) (∀) (∀) mc yes (M - → E , w - → e , pre| ve ) and in yes (w - → e , M - → E ) proc access yes (w - → e , u - → f , a, M - → E ) |M - → E | accepts whenever (w - → e , u - → f ) ∈ R M -→ E a case - → E = : relation yes (w, u, π a ) case - → E = - → E :: E, - → e = - → e :: e, - → f = - → f :: f : (∀) (∀) (∀) access yes (w - → e , u - → f , a, M - → E ) and relation yes (e, f, π E a ) proc access * yes (w - → e , u - → f , G, i, M - → E ) |M -→ E | + log i accepts whenever (w - → e , u - → f ) ∈ ( a∈G R a ) j with j ≤ i case i = 1: if u -→ f = w - → e then accept else (∃) (∃) (∃) choose a ∈ G; access yes (w - → e , u - → f , a, M - → E ) case i ≥ 2: (∃) (∃) (∃) choose v - → g ∈ M - → E (∀) (∀) (∀) in yes (v - → g , M - → E ) and access * yes (w - → e , v - → g , G, i/2, M - → E ) and access * yes (v - → g , u - → f , G, i/2, M - → E )
Figure 3.6: Sub-procedures for DELCK (in gray: quantities associated to each procedure call).

Therefore, the complexity remains unchanged, the symbolic model checking problem is in Pspace. The Pspace-hardness comes from the hardness of non-symbolic model checking. The specification of the procedures are as follows.

Proposition 10. For all formulas ϕ with symbolic event models, for all symbolic Kripke models M, for all sequences of event models -→ E , for all worlds w -→ e , u -→ f of M -→ E , for all agents a, for all groups of agents G, for all programs π, for integers i that are powers of two,

mc yes (M - → E , w - → e , ϕ) is accepting iff M - → E , w - → e |= ϕ, mc no (M - → E , w - → e , ϕ) is accepting iff M - → E , w - → e |= ϕ, inval yes (p, w - → e , M - → E ) is accepting iff p ∈ V (w - → e ), inval no (p, w - → e , M - → E ) is accepting iff p ∈ V (w - → e ), in yes (w - → e , M - → E ) is accepting iff w - → e ∈ M - → E , in no (w - → e , M - → E ) is accepting iff w - → e ∈ M - → E , access yes (w - → e , u - → f , a, M - → E ) is accepting iff (w - → e , u - → f ) ∈ R a , access no (w - → e , u - → f , a, M - → E ) is accepting iff (w - → e , u - → f ) ∈ R a , access * yes (w - → e , u - → f , G, i, M - → E ) is accepting iff (w - → e , u - → f ) ∈ j≤i ( a∈G R a ) j , access * no (w - → e , u - → f , G, i, M - → E ) is accepting iff (w - → e , u - → f ) ∈ j≤i ( a∈G R a ) j , relation yes (w, u, π) is accepting iff w π - → u, and relation no (w, u, π) is accepting iff w π - → u.
The result on the complexity may seem surprising, since usually considering symbolic models increases the complexity. Here, we advocate that the non-symbolic model checking already has some kind of symbolic representation, since the model M ⊗ -→ E is not represented explicitly in the input. We add another layer of symbolic here, and fortunately having both symbolic aspects at the same time does not cause any issue here.

Satisfiability

Succinct satisfiability problem

The symbolic satisfiability problem for DELCK is defined as follows:

Definition 50 (Symbolic satisfiability problem).

• Input: ϕ ∈ L suc DELCK ;

• Output: yes if ϕ is satisfiable (that is, there exists a pointed epistemic model1 M, w such that M, w |= ϕ); no otherwise.

Theorem 11. The symbolic satisfiability problem of DELCK is in 2EXPTIME.

Proof. We adapt the algorithm of Figure 2.4 for the non-succinct satisfiability problem.

First, we translate in exponential time our formula ϕ ∈ L suc DELCK into an exponential size formula τ (ϕ) ∈ L DELCK . Then we call isDELCK-sat?(τ (ϕ)). As the skeleton of formula ϕ and τ (ϕ) are the same (only dynamic modalities have been replaced), the cardinality of each Hintikka set h is still exponential in the size of ϕ. Therefore, the new algorithm for symbolic satisfiability problem is still double-exponential in the size of ϕ.

Example: bridge card game

In this section, we show how to use symbolic model checking of DELCK to polynomially express the existence of a uniform winning strategy in the bridge card game [START_REF] Francis | The Official Encyclopedia of Bridge[END_REF].

Here, we occult completely the bidding aspect of the bridge, we just want to know if it is possible to win at least k deals once the bidding is done. Notice that even though there are more than two players, we consider the bridge as a two player game, where the adversaries are considered as a coalition.

After recalling the rules of the game, we define a symbolic Kripke model and symbolic event models to express the game, and finally write a formula to express the existence of a winning strategy. With the model checking result for symbolic DELCK, we will thus prove that checking for the existence of a winning strategy in bridge is in Pspace. We discuss briefly how to use this result in the bidding phase afterwards.

Rules

In bridge, we have the data of a set of card values V = {v 1 , . . . , v n }. In a classical card game, we would have V = {1, . . . , 13} with Jack the card 11, Queen the card 12 and King the card 13. We say that card i is stronger than card j if and only if i > j. We also have a set of card colors C = {c 1 , . . . , c m }. A card is then a couple (v, c) with v ∈ V the value of the card and c ∈ C its color. Figure 3.7 shows a example of card set corresponding to a classical 52 cards deck.

♦ 1 ♥ 1 ♠ 1 ♣ 1 ♦ 2 ♥ 2 ♠ 2 ♣ 2 ♦ 3 ♥ 3 ♠ 3 ♣ 3 ♦ 4 ♥ 4 ♠

Goal of the game

As said before, we completely omit the bidding part. Each player initially has the same number of cards and all the cards are given to the players (therefore the number of players n must divide |V | × |C|). The player we want to check the winning strategy for is called the leader. His aim is to win at least k deals where k corresponds to his bidding (in the classical bridge it is 6 + the bidding but it is equivalent).

Dummy players Some players do not play the game. They are called dummy players. The dummy players reveal their hands, and the leader is now in control of its own hand and the hands of the dummy players. In classical bridge with 4 players, there is only one dummy player, so the leader controls 2 hands and 2 other players control their own hand.

Execution of a deal

In a deal, the first player plays a card. The color of the card is the color players must play during the deal. Each player then plays a card of the same color, and the player with the highest card wins the deal. He becomes the first player for the next deal.

Notable exceptions Initially, there may be a special color called the trump color determined by the bidding. If a player cannot play the color of the deal, then he can play a card of the trump color instead. When played, trump colors are stronger than the color of the deal. If the player cannot play the color of the deal nor a trump card, he plays another card but he will necessarily lose the deal.

The problem we address is then the following:

• • Output: yes if Player 1 has a uniform winning strategy to win at least k deals in the game where he controls his hand and the hands of players in D.

Atomic propositions and useful formulas

Compared to blind tic tac toe (see Section 2.3), the difficulty of the modeling is not in the events since all events are combinations of public announcements. Instead, the heart of matter lies in the atomic propositions and the Kripke model. In Table 3.1 we define the set of atomic proposition AP needed. Notice that there is a polynomial number of atomic propositions in the input size. We also define the following macros:

winsdeal(i) = n i=1 (p i,v,c ∧ ((de c ∧ ¬tr c ∧ 1≤j≤n,j =i c 2 ∈C,v 2 ∈V p j,v 2 ,c 2 → (¬tr c 2 ∧ (de c 2 → (v 2 < v))) ) ∨(tr c ∧ 1≤j≤n,j =i c 2 ∈C,v 2 ∈V p j,v 2 ,c 2 ∧ tr c 2 → (v 2 < v) ))
The formula winsdeal(i) states that Player i wins the current deal. Indeed:

• The first line states that there is a c ∈ C and v ∈ V such that Player i has played card (v, c).

• The second line states that if c is the color of the deal then for every Player, the card he played has not the trump color and if it has the color of the deal, its value is lower than v.

• The third line states that if c is the trump color, then for every Player, if he played a card with the trump color then its value is lower than v.

The case where Player i has played a card which has not the color of the deal nor the trump color is not considered because this card would not make Player i win the deal.

canplay(i, (v, c)) = h i,v,c ∧ (de c ∨(tr c ∧ c ∈C (de c → v ∈V ¬h i,v ,c )) ∨ ( c ∈C (de c ∨ tr c → v ∈V ¬h i,v ,c ))) ∨ c ∈C ¬de c
) Formula canplay(i, (v, c)) states that Player i can play card (v, c). The formula is the conjunction of Player i has card (v, c) in hand (h i,v,c ) and of a disjunction of four cases:

• Color c is the color of the deal (de c ).

• Color c is the trump color and Player i does not have any card of the color of the deal.

• Color c is nor the color of the deal or the trump color but Player i does not have any of the two colors in hand.

• No color is currently the color of the deal (then Player i can play any card).

Initial Kripke model

Compared to blind tic tac toe, the Kripke model initially has a exponential number of words. Thus, for practical reasons, we consider a symbolic Kripke model instead. It is

M = AP M , β M , (π a ) a∈Ag .
Here AP M = AP. The formula β M is the conjunction of formulas given in Table 3.2.

Remark 2. Although Formula 1 is not boolean, it is possible to express the equality with a boolean formula in the following way. Let S be a list of atomic propositions. We introduce the atomic proposition eq k (S ) for any k ≤ |V |×|C| n and S sublist of S. It is defined as the following conjunction of formulas:

• eq k ([]) ↔    if k = 0 ⊥ otherwise • eq k (S :: p) ↔    (p ∧ eq k-1 (S )) ∨ (¬p ∧ eq k (S )) if k > 0 (¬p ∧ eq k (S )) otherwise Then the formula n i=1 |{h i,v,c = , v ∈ V, c ∈ C}| = |V |×|C| n is

replaced by the following formula:

Content of the hands for players

1. n i=1 |{h i,v,c = , v ∈ V, c ∈ C}| = |V |×|C| n Each player has exactly |V |×|C| n cards in hand 2. v∈V,c∈C n i=1 h i,v,c
Each card is exactly in one player's hand.

v∈V,c∈C

n i=1 ¬p i,v,c
No card is currently played.

Initial situation in the game

tu 1 ∧ n i=2 ¬tu i

It is Player's 1 turn to play.

w 0 ∧

|V |×|C| n l=1 ¬w l Player 1 has not won any deal yet.

tr ct ∧ c∈C\{ct} ¬tr c

Color ct is the only trump color (replace by c∈C ¬trc if there is no trump color).

7. du 1 ∧ i∈D du i ∧ j∈C\(D∪{1}) ¬du j

The dummy players' hands are controlled by Player 1.

c∈C ¬de c

No color is the color of the deal.

({h i,v,c , v ∈ V, c ∈ C}) where {h i,v,c , v ∈ V, c ∈ C} is viewed as a list.

The number of new atomic propositions introduced is |V | × |C| × |V |×|C|

n + 1 for each Player i, so |V | × |C| × (|V | × |C| + n) in total, so we remain polynomial. In the rest of the construction we omit the values of eq k (S ) because they are irrelevant in event models, they are only useful to define the initial Kripke model.

The players only have uncertainty about the hands of other non dummy players so π a is defined as follows.

π a = set({h i,v,c , v ∈ V, c ∈ C, i ∈ D, i = a})
The initial symbolic Kripke model M is then indeed of polynomial size in the size of the input.

Event models

To be consistent with the definition of symbolic model checking, we should define event models symbolically. Yet, they are of linear size when described explicitly, we use Definition 47 page 92 to obtain symbolic event models and describe them explicitly instead.

Event model of playing a card for Player i E v,c i

The event model is drawn in Figure 3.8 for V = {1} and C = {♠, ♣}. e 1,♠ : pre :

tu i ∧ canplay(i, (1, ♠))
post :

h i,1,♠ ← ⊥ p i,1,♠ ← tu i ← ⊥ tu (i+1%n) ← v∈V,c∈C ¬p (i+1%n),v,c de ♠ ← c ∈C ¬de c Ag e 1,♣ : pre : tu i ∧ canplay(i, (1, ♣))
post :

h i,1,♣ ← ⊥ p i,1,♣ ← tu i ← ⊥ tu (i+1%n) ← v∈V,c∈C ¬p (i+1%n),v,c de ♣ ← c ∈C ¬de c Ag e pass : pre : ¬tu i post : / Ag Figure 3.8: Example of event model (E i , E i 0 ) for V = {1} and C = {♠, ♣}.
It contains one event e v,c per card (v, c) which is executable when it is the turn of Player i (tu i ) and that he is allowed to play this card (canplay(i, (v, c))). The postcondition is that Player i does not have the card in hand anymore (h i,v,c ← ⊥), the card is played (p i,v,c ← ), it is not Player i's turn anymore (tu i ← ⊥), it is the turn of the next player if he has not played yet in the deal (tu (i+1%n) ← v∈V,c∈C ¬p (i+1%n),v,c ), and the color the deal becomes c if it was not assigned beforehand in the deal (de c ← c∈C ¬de c ). We add one event e pass because afterwards this event model may be used in a case where Player i was not allowed to play, it is a trivial event whose precondition is ¬tu i .

The formal definition in the general case is the following.

Definition 51 (Event model (E i , E i 0 )). The event model E i = (E i , (R i a , pre i , post i )) is defined as follows:

• E i = {e v,c , v ∈ V, c ∈ C} ∪ {e pass };
• R a = {(e, e), e ∈ E i } for all agents a ∈ Ag;

• pre i (e v,c ) = tu i ∧ canplay(i, (v, c)); • pre i (e pass ) = ¬tu i ; • post i (e v,c , h i,v,c ) = ⊥; • post i (e v,c , p i,v,c ) = ; • post i (e v,c , tu i ) = ⊥; • post i (e v,c , tu (i+1%n) ) = v ∈V,c ∈C ¬p (i+1%n),v ,c ; • post i (e v,c , de c ) = c ∈C ¬de c ;
• post i is trivial for all other cases;

• E i 0 = E i .

Event model to end the deal E end

The event model contains one event e i per Player, where an example is drawn in Figure 3.9.

Intuitively, e i is fired if Player i has won the deal. The precondition is thus winsdeal(i). The postcondition is do not change the score of Player 1 is Player i is not a dummy player (w l ← w l ∧ ¬du i ), increase the score of Player 1 is Player i is a dummy player (w l+1 ← w l ∧ du i ), for the next deal Player i begins (tu i ← ), all other players do not begin (tu j ← ⊥), all cards played are now considered not played (p j,v,c ← ⊥), and no color is the color of the deal (de c ← ⊥).

The formal definition of E end is the following:

Definition 52 (Event model (E end , E end 0 )
). The event model E end = (E end , R end a , pre end , post end ) is defined as follows:

e i : pre : winsdeal(i) post : w l ← w l ∧ ¬du i for all l w l+1 ← w l ∧ du i for all l tu i ← tu j ← ⊥ for j = i p j,v,c ← ⊥ for all j ∈ {1, . . . , n}, v ∈ V, c ∈ C de c ← ⊥ for all c ∈ C Ag Figure 3
.9: Example of event e i for Player i in the event model (E end , E end 0 ).

• E end = {e i , i ∈ {1, . .

. , n}};

• R a = {(e, e), e ∈ E end } for all agents a ∈ Ag;

• pre end (e i ) = winsdeal(i) for all events e i ;

• post end (e i , w l ) = w l ∧ ¬du i for all events e i and l;

• post end (e i , w l+1 ) = w l ∧ du i for all events e i and l;

• post end (e i , tu i ) = for all events e i • post end (e i , tu j ) = ⊥ for all events e i and j = i;

• post end (e i , p j,v,c ) = ⊥ for all events e i , j ∈ {1, . . . , n}, v ∈ V, c ∈ C;

• post end (e i , de c ) = ⊥ for all events e i and c ∈ C;

• post end is trivial for all other cases;

• E end 0 = E end .

Formula

We consider the succinct versions of E i and E end , namely E i and E end . We define

{E i , E i 0 } as E i , E i 0 K 1 when i is a dummy player, [E i , E i 0 ] otherwise. Then: ϕ g = (({E 1 , E 1 0 } . . . {E n , E n 0 }) 2 [Eend]) |V |×|C| n l≥k w l
In each deal, each player plays 2 times in the formula because we do not know in advance which player begins the deal, so we apply the event model 2 times to be sure each player plays once (if we execute E i in a case where Player i has already played then necessarily tu i will be false). We translate the bridge problem into the symbolic model checking instance M, w |= ϕ g where w is the world corresponding to the initial situation. Therefore the following Theorem is true.

Theorem 12. The bridge problem is in Pspace.

Concluding remarks

In the above modeling, we have supposed that the hand of the dummy players were already known in advance. If we want to apply such techniques in the bidding phase, it is possible to change the model such that players do not know the hand of dummy players. It only amounts to change the programs π a .

The new model can then be used in the bidding phase. If a player announces for instance "I can do 6 deals with ♠ as the trump color", then if all agents only do safe biddings, the agents can deduce that this player has a winning strategy for 6 deals with ♠ as the trump color. It then becomes common knowledge between agents and they can update the Kripke model accordingly. Therefore, it is possible to apply the technique above to make agents that can reason about the biddings.

Related work

We now briefly survey other works in the literature that display important features of our contribution.

Dynamic Logic of Propositional Assignments.

Dynamic Logic of Propositional Assignments [START_REF] Balbiani | Dynamic Logic of Propositional Assignments: A Well-Behaved Variant of PDL[END_REF] is a instantiated version of Propositional Dynamic Logic (PDL) [START_REF] Michael | Propositional Dynamic Logic of Regular Programs[END_REF] where atomic programs are propositional assignments. The authors of DL-PA have shown that DL-PA behaves better than PDL in many respects, having e.g. compactness and eliminability of the iteration construct in programs. However, the model checking problem against DL-PA is Pspace-complete, as opposed to the model checking problem against PDL which is P-complete [START_REF] Lange | Model checking propositional dynamic logic with all extras[END_REF].

The iteration-free fragment of DL-PA has been extended with epistemic operators in [START_REF] Hans | Public announcements, public assignments and the complexity of their logic[END_REF] where the programs are viewed as ontic actions, rather than accessibility relations as done in our contribution. In their setting, the authors showed that the validity problem of the iteration-free fragment of DL-PA is coNP-complete in the single-agent case and PSPACE-complete in the multi-agent case.

Ad-hoc accessibility relations

We highlight frameworks in which Kripke models have ad-hoc accessibility relations, and demonstrate that they can be captured by DL-PA programs. Consequently, all these frameworks may take advantage of the ability to use the full expressive power the full PAPL language.

Geometrical models. Gasquet et al. [START_REF] Gasquet | Big Brother Logic: visual-epistemic reasoning in stationary multi-agent systems[END_REF] defined a family of Kripke models for reasoning about the knowledge of agents that are video cameras located in the 2-dimensional space (a position and a direction), according to elementary facts of the kind "Agent a sees b". They also designed a suitable language whose atomic propositions are the form a b, so as to mean "Agent a sees Agent b". In this setting, the worlds of the Kripke models denote configurations of agents (i.e. video cameras); each agent has a fixed position and its fixed range is some cone. It is assumed that the agents' position, as opposed to their direction, is a common knowledge to all agents. An agent cannot distinguish two worlds characterized by different dispositions of agents out of its reach. For instance, in Figure 3.10, the two depicted worlds are indistinguishable for Agent a, since they only differ on the directions of Agents b, d and e that are out of its range. Such Kripke models can be embedded in our framework. First of all, notice that not all valuations of atomic propositions are meaningful: for instance, the positions of agents in (any world of) Figure 3.10, prevents Agent a from seeing both Agent c and Agent b at the same time, whichever its direction might be. As a consequence, it is common knowledge that Agent a does not see both Agent b and Agent c simultaneously. This can be captured in our setting by prefixing any property of interest by an announcement modality with an appropriate (Boolean) formula that restricts the set of valuations to meaningful ones. Now, the accessibility relation for Agent a can be described the program that non-deterministically chooses a direction of all agents that are not seen by Agent a, which can formally be written as

; b∈Ag,b =a (a b?) ∪ ¬(a b)?; ; c∈Ag,c =b set(b c)
It is important to observe that our representation of the video camera Kripke models relies on a subtle argument, noticed [START_REF] Gasquet | Big Brother Logic: visual-epistemic reasoning in stationary multi-agent systems[END_REF]: any quantitative model (that is where worlds are defined by the real coordinates of video camera's position/direction in the plane) is bisimilar to a Kripke model where the only information about worlds is the truth values of all atomic propositions a b. Incidentally, it is an open question whether this property still holds, when the assumption that the fixed video cameras' position is common knowledge is relaxed, as done in [START_REF] Balbiani | Agents that look at one another[END_REF].

Observation/Visibility There is a long tradition in inferring epistemic aspects from the ability of agents to observe the value of atomic propositions, e.g Epistemic Coalition Logic of Propositional Control with Partial Observability [START_REF] Wiebe Van Der Hoek | Knowledge and control[END_REF], Logic of Revelation and Concealment [START_REF] Wiebe Van Der Hoek | A logic of revelation and concealment[END_REF], Boolean games with epistemic goals [Ågo+13], Alternatingtime Temporal Logic under imperfect information [START_REF] Alur | Alternatingtime temporal logic[END_REF]. In these approaches, each agent a observe a subset of propositions Obs a , entailing a natural accessibility relation: two worlds are indistinguishable to Agent a if they agree on Obs a . Therefore, the program for Agent a is π a = set(AP \ Obs(a)) and consists in reassigning values to unobservable propositions.

Differently, and somehow connected to a geometrical setting, the more recent work of [START_REF] Herzig | A Poor Man's Epistemic Logic Based on Propositional Assignment and Higher-Order Observation[END_REF] describes a multi-agent epistemic logic that relies on visibility atomic propositions of the form, e.g. S a S b p to mean that 'Agent a sees that Agent b sees that p holds'. Such visibility atomic propositions (v-a-p) may contain an arbitrary finite (possibly zero) number of nested observability abilities S a . Worlds of the Kripke models are valuations over the set of v-a-p's, and the accessibility relations are given by: Agent a cannot distinguish between valuations w and u whenever every v-a-p that a sees in w has the same truth value in u. Such ad-hoc accessibility relations can easily be described by DL-PA-programs, but in a way that depends on the formula to be evaluated (actually, it would only depend on the knowledge modal depth of the formula) -indeed, it is necessary to select a finite set of v-a-p's the program will act on, as there are infinitely many. To do so, let us first define the program π a,p = (S a p?) ∪ (¬(S a p)?; set(p)), where a is an agent and p is a v-a-p. Intuitively, program π a,p non-deterministically reassigns the value of v-a-p p if not seen by Agent a. Now consider the formula K a K b β where β is a Boolean formula of v-a-p's. For the sake of simplicity, assume additionally that the only v-a-p's occurring in β are p and q. It can be established that the relevant v-a-p's in K a K b β are p, q, S b p, and S b q for Agent a, and p and q for Agent b -we do not justify this claim as it is out of the scope of the paper. We would consequently define programs π a = (π a,p ; π a,S b p ; π a,q ; π a,S b q ) and π b = (π b,p ; π b,q ) for the accessibility relations of Agent a and b, respectively. This framework has subsequently been enlarged to encompass public announcements, yielding Dynamic Epistemic Logic of Propositional Assignment and Observation (DEL-PAO) [START_REF] Charrier | Building Epistemic Logic from Observations and Public Announcements[END_REF].

Conclusion

In this chapter, we have defined the notion of symbolic Kripke and event models. We have shown that for a family of Kripke/event models, their symbolic counterparts become exponentially smaller. In fact, this result is true in most applications. In fact, all the related work shown before have symbolic representations which are exponentially smaller than their explicit representation.

We have shown that the complexity results for model checking and satisfiability do not change, namely model checking remains Pspace-complete and satisfiability 2-Exptimecomplete. As we highlighted before, this result may seem surprising. In our opinion, the reason this symbolic representation does not make the complexity grow up is because DELCK initially has a king of symbolic representation, because the model M -→ E is not represented explicitly in the input. Therefore, adding a symbolic representation for the input models does not impact the complexity. is a strong result, since it proves that introducing imperfect information in a lot of games does not increase their complexity. It refines in particular the result of [START_REF] Demaine | Constraint Logic: A Uniform Framework for Modeling Computation as Games[END_REF] stating that bounded games with imperfect information are NExptime-complete for players in teams. Indeed, we can show that bounded two-player games with imperfection information yield Pspace problems when the bound is given in unary in input. With this result, we can show for instance that Othello which is Pspace-complete [START_REF] Iwata | The Othello game on an n*n board is PSPACE-complete[END_REF] remains Pspacecomplete with imperfect information.

We consider implementing our approach to effectively find these winning strategies. A symbolic model checker of DEL already exists: SMCDEL [START_REF] Van Benthem | Symbolic Model Checking for Dynamic Epistemic Logic[END_REF]. Their symbolic representation relies on observation sets, and so they can be expressed easily with DL-PA. We envision introducing DL-PA-programs into their model checker, which may allow simpler and more efficient representations for problems. With this model checker, we then wish to implement the existence of uniform strategies in games to see experimental results on the matter.

Chapter 4

Epistemic Planning

In this chapter, we extend on DELCK by considering the so-called epistemic planning problem. It is defined as follows:

Definition 53 (Epistemic planning problem).

• Input: a pointed epistemic model (M, w), a finite set of pointed event models E, and a goal formula ϕ G ∈ ELCK;

• Output: yes if there exists a sequence of pointed event models

(E 1 , E 1 0 ), . . . , (E p , E p 0 ) ∈ E (a plan) such that M, w |= E 1 , E 1 0 . . . E p , E p 0 ϕ G ; no otherwise.
Epistemic planning can be seen as an extension of classical planning [START_REF] Fikes | STRIPS: A New Approach to the Application of Theorem Proving to Problem Solving[END_REF] where the models are the ones considered in DELCK, namely Kripke and event models. In classical planning, the model is a valuation and the actions are propositional, which correspond to propositional public actions in DELCK.

Here, we study the impact on complexity when all input event models are in C j i , the class of event models where preconditions are of modal depth at most i and postconditions are of modal depth at most j.

On the one hand, when only propositional preconditions are used it is known that the problem is decidable if postconditions are also propositional [START_REF] Yu | Multi-Agent Epistemic Explanatory Diagnosis via Reasoning about Actions[END_REF]. In this case it is in k-Exptime, where k is the modal depth of goal formulas [START_REF] Aucher | Automata Techniques for Epistemic Protocol Synthesis[END_REF]; if there are no postconditions, the problem is in Expspace [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF]. On the other hand, epistemic preconditions yield undecidability: if propositional postconditions are allowed, then the problem is already undecidable with preconditions of modal depth one [START_REF] Bolander | Epistemic planning for single and multi-agent systems[END_REF]. It is also known to be undecidable without postconditions, if we allow for preconditions of unbounded modal depth [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF]. Table 4.1 summarizes the results about epistemic planning.

Here, we refine this table to the one of Figure 4.2 where new results are highlighted in red. trivial postconditions (j = -1) with postconditions (j = ∞) i = 0

In Expspace

[BJS15] Decidable [YWL13] i = 1 ? Undecidable [BA11] i = ∞ Undecidable [AB13] Undecidable Table 4
.1: Overview of the complexity of epistemic planning where event models are all in C j i .

trivial postconditions (j = -1) with postconditions (j = ∞)

i = 0 Pspace-complete Decidable [YWL13] i = 1 ? Undecidable [BA11] i = 2 Undecidable Undecidable i = ∞ Undecidable [AB13] Undecidable Table 4
.2: Overview of the new complexity results of epistemic planning where event models are all in C j i .

The chapter is divided as follows:

• First, we prove an easy result on epistemic planning with only "separable" event models.

• Second, we prove that with propositional preconditions and trivial postconditions, epistemic planning is Pspace-complete (Theorem 15). The key point is that in this case events commute [START_REF] Löwe | DEL Planning and Some Tractable Cases[END_REF]. This allows for a succinct representation of tuples of events, and we build upon a model checking procedure from [START_REF] Aucher | On the Complexity of Dynamic Epistemic Logic[END_REF] to devise a polynomial space decision procedure.

• Third, we prove that epistemic planning is already undecidable for the subproblem with only event models in C -1 2 , that is with preconditions of modal depth at most two and trivial postconditions (Theorem 16). The proof, by reduction from the halting problem for two counter machines, refines the one given in [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF], which requires preconditions with unbounded modal depth. By designing more involved gadgets to code the configurations and instructions of the machines, we manage to bound the modal depth of preconditions.

• Finally, we conclude.

The chapter, except the separable events section, corresponds to the published paper [START_REF] Charrier | On the Impact of Modal Depth in Epistemic Planning[END_REF].

Separable event models

We prove that when event models are separable (all events have disjoint preconditions) then the following two cases are true.

• If all events also have trivial postconditions, then the epistemic planning problem is NP-complete.

• Else, the epistemic planning is Pspace-complete.

To our knowledge, these results were never published. Yet, they are interested since they legitimate for instance the approach of [START_REF] Kominis | Beliefs In Multiagent Planning: From One Agent to Many[END_REF], that considered public actions and semi-private announcements, which fall into the separable events setting. The hardness results for both cases are direct because they extend [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF] where it is proven that for public announcements, the epistemic planning is NP-complete and with public actions, the epistemic planning problem is Pspace-complete.

The intuition between separable event models is simple: preconditions must be disjoint. For instance, the event model from Figure 1.3 page 41 is not separable since the precondition of event f is compatible with the precondition of event e (p). We now define formally separable event models.

Definition 54 (Separable event models

). An event model E = (E, (R E a ) a∈Ag , pre, post) is separable if and only if for all events e, f ∈ E such that e = f , the formula pre(e) ∧ pre(f ) is unsatisfiable.

Example 22. Here are some examples of separable event models:

• Public announcements and public actions are separable events models (i.e. event models with only one event).

• Semi-private announcements to a group G ⊆ Ag are separable, since they are of the following form:

Ag Ag

We now establish a similar theorem for all separable event models.

Theorem 14. We consider the epistemic planning problem with the additional restriction that E only contains separable event models. Then this new epistemic planning problem is Pspace-complete.

Proof. Hardness: direct from [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF].

Membership: we write a trivial algorithm searching for a plan:

proc existplan(M, w, E, ϕ G ) if M, w |= ϕ G : accept else : (∃) (∃) (∃) choose (E, E 0 ) ∈ E (∃) (∃) (∃) choose e ∈ E 0 if M, w |= pre(e): reject else existplan(M ⊗ E, (w, e), E, ϕ G )
It chooses an event model and calls back to itself with the product update in input. It stops whenever the goal has been reached. Since the event models are separable, then |M⊗ E| ≤ |M|, so the space needed is polynomial, which proves the Pspace-membership.

Remark 3. In practice, if we want to apply Theorems 13 and 14, we need an algorithm to check that an event model is separable. If the event model has a single event, it is trivially separable. Otherwise, checking that pre(e)∧pre(e ) is unsatisfiable calls a Pspace procedure since the satisfiability problem for epistemic logic is Pspace-complete. Therefore for the trivial postcondition Theorem 13 is unusable for any event model if we do not know it is separable beforehand. However, for the Pspace variant, having a Pspace procedure beforehand is not a problem. Notice that the same problem arises even if all preconditions are propositional.

However, for most cases in practice, for most event models we construct, we know beforehand if they are separable or not, so calling a Pspace procedure to verify separability is a sledgehammer. Remark 4. In theory, the separability constraint is too strong. It is sufficient to say that for the input Kripke models (M, w), for any event models E 1 , . . . , E n ∈ E and event model

E ∈ E, in each world of M ⊗ E 1 ⊗ • • • ⊗ E n ,

at most one of the events of E is applicable.

Indeed if this constraint is true, then the Kripke model will never increase in size, and so the algorithms presented before still work. Yet, this constraint seems very hard to check. That is why separability is an easier criteria.

Similarly, if |M ⊗ E 1 ⊗ . . . E n | is never bigger than P (|M|) for a fixed polynomial P then the Theorems 13 and 14 would still work (just replace i ≤ |M| by i ≤ P (|M|)).

Propositional preconditions

It is already known that the epistemic planning problem restricted to C -1 0 is Pspace-hard [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF]. We establish that it is actually Pspace-complete.

From now on, we suppose that the event models are single-pointed in the input of the epistemic planning problem. If not, we just need to transform an event model (E, E 0 ) into a set of event models (E, e) for each e ∈ E 0 .

As pointed out in [START_REF] Löwe | DEL Planning and Some Tractable Cases[END_REF], epistemic event models with propositional preconditions commute. Formally: Lemma 4. For all pointed epistemic models (M, w), for all pointed event models (E 1 , e 1 ) and

(E 2 , e 2 ) in C -1 0 , M ⊗ E 1 ⊗ E 2 , (w, e 1 , e 2 ) exists iff M ⊗ E 2 ⊗ E 1 , (w, e 2 , e 1
) exists, and in that case they are bisimilar.

As a consequence, in the rest of the section, the order in which events are applied in an initial world is indifferent. Only the number of times each event occurs is relevant, and the proof of our result heavily relies on this property.

We first establish a preliminary result on the model checking problem for a dedicated language: we extend the dynamic epistemic language with iterations of event models in C -1 0 , that is, constructions of the form (E, e) ψ where (E, e) is a pointed event model in C -1 0 and is a positive integer. We suppose here that is written in binary so that this language, called L it C -1 0 , is exponentially more succinct than DEL. The size |ϕ| of a formula ϕ is defined as usual, with the following additional inductive case: | (E, e) ψ| = 1+|E|+ log 2 +|ψ| (by convention log 2 0 = 0). Classically, the model checking problem for L it

C -1 0 is, given a pointed epistemic model (M, w) and a formula ϕ ∈ L it C -1 0 , to decide whether M, w |= ϕ. Proposition 11. Model checking L it C -1 0 is in Pspace.
Proof. We design a deterministic algorithm that takes as an input a pointed epistemic model (M, w 0 ) and a formula ϕ ∈ L it C -1 0 , and decides whether M, w 0 |= ϕ. Without loss of generality, we suppose that all event models appearing in the formula are the same, noted E = (E, →, pre) (if not, we replace each one by their disjoint union ).

Let mc be the algorithm given in Figure 4.1, and let 0 |E| denote the null |E|-vector. We claim that mc(M, w 0 , E, 0 |E| , ϕ) returns true iff M, w 0 |= ϕ. To prove this claim we establish that for all w ∈ M, all integers n 1 , . . . , n |E| and all subformula ψ of ϕ, the following property P holds:

If M ⊗ E |E| i=1 n i , w• n exists then mc(M, w, E, (n 1 , . . . , n |E| ), ψ) returns true iff M ⊗ E |E| i=1 n i , w• n |= ψ.
Property P is proven by induction on ϕ. We omit the boolean cases and case (E, e i ) ψ which are trivial.

Case K a ψ: the algorithm has to check that ψ holds in all a-successors of w• n in M ⊗ E |E| i=1 n i . Every a-successor of w• n is a permutation of some u• and is bisimilar to it. We thus need to enumerate all worlds u and vectors that represent some a-successor, and verify that ψ holds in u• . Given a tuple u• , to check whether it is a permutation of some a-successor of w• n, we first check that it is an existing world in M ⊗ E |E| i=1 n i . Since events are purely epistemic and propositional, preconditions of successive events can all be checked in the initial world u. This is done by calling function preok(M, u, E, ), which checks that for all i ∈ {1, . . . , |E|}, if i > 0 then pre(e i ) is true in u. Next, we check that some permutation of u• is indeed a-related to w• n: we should first have u ∈ R a (w); then, it should be possible to map each occurrence of an event e i in w• n to some occurrence of some a-related event e j in u• so as to form a bijection. Deciding whether such a bijection exists amounts to solving the following integer linear program: checking whether there exist positive integers (x i,j ) (i,j)∈{1,...,|E|} 2 |e j ∈Ra(e i ) , where x i,j is the number of times e j is chosen as a-successor for e i , such that:

(S)    n i = j|e j ∈R E
a (e i ) x i,j for all i ∈ {1, . . . , |E|}, and j = i|e i ∈R E a (e j ) x i,j for all j ∈ {1, . . . , |E|}.

This is done by calling succ(E, a, n, ).

Spatial complexity.

We justify that mc can be implemented in polynomial space in the size of the input (which is |M| + |ϕ|). The maximal number of nested calls is bounded by |ϕ|, so that the number of local variables to be stored is polynomial in |ϕ|. We now bound the space needed to store vector n in each call, which is in O( |E| i=1 log 2 n i ). Letting 1 , . . . , m be an enumeration of the numbers appearing in ϕ, it is clear that k i=1 n i ≤ m i=1 i , and thus for all i ∈ {1, . . . , |E|}, n i ≤ m j=1 j . We obtain

|E| i=1 log 2 n i ≤ |E| log 2 ( m i=1 i ) .
Now, it can be proven by studying the variation of function f

: (x 1 , . . . , x m ) → log 2 ( m i=1 x i )- m i=1 log 2 x i -log 2 m, that since i ≥ 1 for all i ∈ {1, . . . , m}, we have log 2 ( m i=1 i ) ≤ m i=1 log 2 i + log 2 m,
and because the ceiling of a sum is less than the sum of the ceilings, we get

k log 2 ( m i=1 i ) ≤ |E|( m i=1 log 2 i + log 2 m ).
By definition of the size of L it

C -1 0 formulas, k = |E| ≤ |ϕ|, m i=1 log 2 i ≤ |ϕ| and log 2 m ≤ m ≤ |ϕ|, so that the space used to store n is in O(|ϕ| 2 ).
It only remains to note that checking consistency of a system (S) can be done in nondeterministic time polynomial in the number of bits needed to encode n and [START_REF] Papadimitriou | On the complexity of integer programming[END_REF], and therefore succ is in deterministic space polynomial in |ϕ|.

We now describe a (non-deterministic) algorithm for the epistemic planning problem, which consists in guessing a plan and then model-check an L it C -1 0 -formula to check that this plan realizes the goal. The crucial points here are, first, that we can restrict to plans of exponential length, second, that thanks to commutation of events they can be represented in polynomial space, and third, that verifying whether a plan works can be done in polynomial space (Proposition 11).

Theorem 15. The epistemic planning problem restricted to C -1 0 is in Pspace.

Proof. We adapt the algorithm given in [BJS15, Theorem 5.8]. First it is proved in [START_REF] Sadzik | Exploring the Iterated Update Universe[END_REF] that, noting d the d-bisimulation 1 for event models (see [BJS15; Sad06; DHK07]), for every d ≥ 0, every pointed event model (E, e) is d -stabilizing at iteration |E| d ; formally, (E, e i ) k d (E, e i ) k+1 for all k ≥ |E| d .2 Secondly, by Lemma 4, event models with propositional preconditions commute. Therefore, the following algorithm correctly solves the epistemic planning problem for event models with propositional preconditions:

Given input (M, w), {(E 1 , e 1 ), . . . ,(E m ,e m )},ϕ G : 1. Compute d, the modal depth of the goal formula ϕ G ; 2. For each i ∈ {1, . . . , m}, non-deterministically guess

n i ∈ 0, . . . , |E i | d ; 3. Accept if M, w |= (E 1 , e 1 ) n 1 . . . (E m , e m ) nm ϕ G .
This algorithm is non-deterministic. The first step is clearly performed in space polynomial in the size of the input. Concerning the second point, each n i can be exponential in d and thus in |ϕ G |, but its binary representation uses polynomial space. Since (E 1 , e 1 ) n 1 . . . (E m , e m ) nm ϕ G is an L it C -1 0 formula, it follows from Proposition 11 that the last step can also be performed in polynomial space. The epistemic planning problem restricted to C -1 0 is therefore in NPspace and thus in Pspace by Savitch's theorem [START_REF] Walter | Relationships Between Nondeterministic and Deterministic Tape Complexities[END_REF].

Preconditions of modal depth 2

We now prove the following theorem by refining the reduction given in [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF].

Theorem 16. The epistemic planning problem restricted to C -1 2 is undecidable.

We first recall the halting problem for two-counter machines, known to be undecidable [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF], and then we reduce it to the epistemic planning problem restricted to C -1 2 .

Two-counter machines

We present two-counter machines as introduced in The transition function → M on C M is defined as follows. For all ( , c 1 , c 2 ) ∈ C M :

• If I = inc(1), ( , c 1 , c 2 ) → M ( + 1, c 1 + 1, c 2 ); • If I = inc(2), ( , c 1 , c 2 ) → M ( + 1, c 1 , c 2 + 1); • If I = goto( ), ( , c 1 , c 2 ) → M ( , c 1 , c 2 ) ; • If I = gotocond(1, ), ( , c 1 , c 2 ) → M      ( , 0, c 2 ) if c 1 = 0; ( + 1, c 1 -1, c 2 ) otherwise; • If I = gotocond(2, ), ( , c 1 , c 2 ) → M      ( , c 1 , 0) if c 2 = 0; ( + 1, c 1 , c 2 -1) otherwise.
A two-counter machine M halts if there exist c 1 , c 2 such that (0, 0, 0) → * M (N, c 1 , c 2 ), where → * M denotes the reflexive transitive closure of → M . For instance, the machine M ex given in Example 23 above does not halt. The halting problem for two-counter machines consists in deciding, given a two-counter machine, whether it halts or not. This problem is well known to be undecidable [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF].

The reduction

From now on in the figures, since there are a lot of worlds/events, we keep the notation circles for worlds and squares for events, but write the valuation/precondition beside the world/event.

We define an effective reduction tr that, given a two-counter machine M , computes an instance tr(M ) of the epistemic planning problem restricted to C -1 2 . We fix M and the rest of the section is devoted to defining tr(M ) = (M 0 , w 0 ); E; ϕ G and justifying its correctness (Proposition 12). As in [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF], we only use one agent a ( stands for K a and ♦ stands for Ka ), configurations of M are represented by pointed epistemic models, and the initial pointed epistemic model represents the initial configuration (0, 0, 0). Each program line :I is represented by one or two pointed event model(s), such that a plan corresponds to a sequence of program lines. The goal formula expresses that the final pointed epistemic model represents a halting configuration. PC = 1

c 1 = 3 c 2 = 2 a 0 a 1 a N a 1 . . . a 2 p 1 q 1 p 1 p 1 p 1 p 2 q 2 p 2 p 2 Figure 4.2: Pointed epistemic model (M, w) (1,3,2) . PC = 0 c 1 = 0 c 2 = 0 a 0 a 1 a N a 0 . . . p 1 q 1 p 2 q 2

Pointed epistemic models

Let ( , c 1 , c 2 ) be a configuration of M . We describe the model (M ( ,c 1 ,c 2 ) , w ( ,c 1 ,c 2 ) ) (shortened as (M, w) ( ,c 1 ,c 2 ) ) that represents ( , c 1 , c 2 ). For instance, Figure 4.2 shows (M, w) (1,3,2) . It is a tree-like structure rooted at w ( ,c 1 ,c 2 ) . In each world except the root, there is exactly one true atomic proposition, and we call p-world any world where p holds. The root w ( ,c 1 ,c 2 ) verifies no atomic proposition, and it has three groups of children, one for each counter:

Program counter. For each program line : I , w ( ,c 1 ,c 2 ) has one reflexive child labeled by proposition a . The a -child of w ( ,c 1 ,c 2 ) has a child also labeled by a , without any outgoing edge: we say that there is an a -strip. Intuitively, the a -strip represents the fact that I is the next instruction to be executed.

Data counter c i . For each i ∈ {1, 2}, w ( ,c 1 ,c 2 ) has a reflexive p i -child that has an irreflexive q i -child, and is followed by a chain of irreflexive p i -worlds of length c i .

Intuitively, the number of irreflexive p i -children represents the value of c i .

We define the first component of tr(M ): (M 0 , w 0 ) := (M, w) (0,0,0) as depicted in . . .

a 2 p 1 q 1 p 1 p 1 p 1 p 2 q 2 p 2 p 2 a 0 a 1 a N a 1 . . . p 2 q 2 p 2 p 2 p 2 (a) (b)

Pointed event models

For each program line :I of M where I is of the form goto( ) or inc(i), we define a pointed event model (E :I , e :I ) (shortened as (E, e) :I ) that mimics the semantics of :I (Figures 4.6 and 4.8). For each program line :gotocond(i, ) of M , we define two pointed event models (E, e) :gotocond(i, ) and (E >0 , e >0 ) :gotocond(i, ) , respectively for the case c i = 0 and c i > 0 (Figure 4.9). These pointed event models form the second component of tr(M ):

E := {(E, e) :I | < N } ∪ {(E >0 , e >0 ) :I | < N and I = gotocond(i, )}.
In the model (M, w) ( ,c 1 ,c 2 ) where < N , the only pointed event model of E that should be applied is the one representing the behavior of program line :I in configuration ( , c 1 , c 2 ). This event model is defined as follows:

E( , c 1 , c 2 ) :=          (E >0 , e >0 ) :I if I = gotocond(i, )
and c i > 0, (E, e) :I otherwise.

The product with any other event model from E results in a model that is not valid according to the following definition: Definition 56. A pointed epistemic model (M, w) is valid if w has an a -child for each ∈ {0, . . . , N } and a p i -child for each i ∈ {1, 2}.

Example 24. The model shown in Figure 4.2, corresponding to (M, w) (1,3,2) , is valid. Notice that by definition, every configuration model is valid.

The two models shown in Figure 4.4 are not valid. Indeed:

• In the model shown in Figure 4.4(a), the root does not have a a 1 -child.

• In the model shown in Figure 4.4(b), the root does not have a p 1 -child.

Further down, we will define event models of E such that:

Lemma 5. For every configuration ( , c 1 , c 2 ), it holds that

1. (M, w) ( ,c 1 ,c 2 ) ⊗ E( , c 1 , c 2 ) is isomorphic 3 to (M, w) ( ,c 1 ,c 2 ) , where ( , c 1 , c 2 ) → M ( , c 1 , c 2 ).
2. The product of (M, w) ( ,c 1 ,c 2 ) with any other event model from E is defined but not valid.

For any non-empty sequence of event models

(E 1 , . . . , E n , E n+1 ) in E, if the model (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n is not valid, then (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n ⊗ E n+1 is also not valid.
We now describe the event models in E and at the same time we prove Lemma 5. Each of these models has three groups (from left to right on Figures 4.6, 4.8, 4.9), that update respectively the program counter group, the data counter c 1 group and the data counter c 2 group of configuration models.

Event model for

: goto( ). The pointed event model (E, e) :goto( ) , that mimics the effect of :goto( ), is depicted in Figure 4.6. Portion repl( , ) concerns the program counter group and is described in Figure 4.5. The two other groups leave the data counter groups c 1 and c 2 unchanged.

• The product (M, w) ( ,c 1 ,c 2 ) ⊗ (E, e) :goto( ) is isomorphic to (M, w) ( ,c 1 ,c 2 ) : indeed, portion repl( , ) removes the a -strip and adds an a -strip in the program counter group (recall that = ).

• The product (M, w) ( ,c 1 ,c 2 ) ⊗(E, e) :goto( ) with = is not valid. Indeed, as (M, w) ( ,c 1 ,c 2 ) does not have an a -strip in its program counter group, its a -world violates precondition a ∧ ♦ ⊥ in portion repl( , ). As a consequence, (M, w) ( ,c 1 ,c 2 ) ⊗ (E, e) :goto( ) has no a -child at its root and is thus not valid. repl( , ) Event model for : inc(i). Figure 4.8 shows (E, e) :inc(1) that mimics the effect of : inc(1) (for inc(2), the construction is symmetric). Portion repl( , + 1) is meant to increment the program counter. Portion lengthen(1) (described in Figure 4.7) is meant to increment the data counter c 1 . The intermediate event of precondition p 1 ∧ ♦q 1 duplicates once the p 1 -child of the root: it adds one p 1 -world at the start of the p 1 -chain. The last group leaves data counter c 2 unchanged.

p 1 q 1 p 2 q 2
• The product (M, w) ( ,c 1 ,c 2 ) ⊗ (E, e) :inc(1) is isomorphic to (M, w) ( +1,c 1 +1,c 2 ) .

• For the same reason as for (E, e) :goto( ) , the product (M, w) ( ,c 1 ,c 2 ) ⊗ (E, e) :inc(1) with = is not valid.

Event models for

: gotocond(i, ). Figure 4.9 describes models (E, e) :gotocond(1, ) and (E >0 , e >0 ) :gotocond(1, ) . They mimic the effect of : gotocond(1, ) in case c 1 = 0 and case c 1 > 0, respectively (for : gotocond(2, ), constructions are symmetric).

p i ∧ ♦q i q i p i ∧ ♦q i p i ∧ ¬♦q i p i ∧ ♦q i ∧ ♦(p i ∧ ¬q i ) q i p i ∧ ¬♦q i ∧ ♦

repl( , )

¬♦(p 1 ∧¬♦q 1 ) q 1 p 2 q 2 repl( , + 1)

shorten(1) p 2 q 2 (E, e) :gotocond(1, ) (E >0 , e >0 ) :gotocond(1, )
Figure 4.9: Event models for :gotocond(1, ).

• (M, w) ( ,0,c 2 ) ⊗(E, e) :gotocond(1, ) is isomorphic to (M, w) ( ,0,c 2 ) : indeed, the precondition ¬♦(p 1 ∧ ¬♦q 1 ) checks that the p 1 -chain in the data counter c 1 group is of length 0.

Here it is the case, so that the data counter group c 1 remains unchanged. However, when c 1 > 0, the p 1 -child of the root of (M, w) ( ,c 1 ,c 2 ) violates this precondition. It is thus removed, so that the product (M, w) ( ,c 1 ,c 2 ) ⊗ (E, e) :gotocond(1, ) is not valid.

• (M, w) ( ,c 1 ,c 2 ) ⊗ (E >0 , e >0 ) :gotocond(1, ) with c 1 > 0 is isomorphic to (M, w) ( +1,c 1 -1,c 2 ) .
Indeed, portion shorten(1) (Figure 4.7) is meant to decrement data counter c 1 by one: precondition p 1 ∧¬♦q 1 ∧♦ checks that we are in the p 1 -chain (p 1 ), but not at the start (¬♦q 1 ) nor the end (♦ ) of the chain. The last world of the p 1 -chain is thus removed when c 1 > 0. When c 1 = 0, precondition ♦(p i ∧ ¬q i ) is violated by the p 1 -child of the root of (M, w) ( ,0,c 2 ) : indeed, this precondition checks that the length of the p 1 -chain is at least 1. The product (M, w) ( ,0,c 2 ) ⊗ (E >0 , e >0 ) :gotocond(1, ) is thus not valid.

• For = , (M, w) ( ,c 1 ,c 2 ) ⊗(E, e) :gotocond(1, ) and (M, w) ( ,c 1 ,c 2 ) ⊗(E >0 , e >0 ) :gotocond(1, ) are not valid.

We now prove point 3 of Lemma 5:

We first prove the following assertion A n for all n ≥ 1: for all ( , c 1 , c 2 ), for all

E 1 ⊗• • •⊗ E n , if (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n is not valid then there exists p ∈ {a 0 , . . . , a N , p 1 , p 2 } such that there is no p-world in (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n . It is proven by recurrence on n ≥ 1. • A 1 : if (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 is not valid, then:
-Either E 1 contains a repl( , ) part such that = , then there is no a -world in (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 , so we take p = a ; -Or I = gotocond(i, ) (with i ∈ {1, 2}) and E 1 is (E, e) :gotocond(i, ) with c i > 0. In this case, there is no p i -world in (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 , so we take p = p i .

-Or I = gotocond(i, ) (with i ∈ {1, 2}) and E 1 is (E >0 , e >0 ) :gotocond(i, ) with c i = 0. In this case, there is no p i -world in (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 , so we take p = p i .

In other cases, (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 is valid by point 1 of Lemma 5.

• A n ⇒ A n+1 : We suppose A n holds for a given n ≥ 1. For any

E n+1 ∈ E, if (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n+1 is not valid then: -Either (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n
is valid and by points 1 and 2 of Lemma 5, it is isomorphic to some (M, w) ( ,c 1 ,c 2 ) . We apply A 1 to conclude.

-

Either (M, w) ( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n is
not valid, so by A n there exists p such that there is no p-world. Because there is no postcondition, there is no p-world in (M, w)

( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n+1 either.
To conclude, we have proven that if (M, w)

( ,c 1 ,c 2 ) ⊗ E 1 ⊗ • • • ⊗ E n is not valid, by A n
there is p ∈ {a 0 , . . . , a N , p 1 , p 2 } that is false in every world. Therefore, for any E n+1 , there is no p-world in (M, w)

( ,c 1 ,c 2 ) ⊗E 1 ⊗• • •⊗E n+1 , so (M, w) ( ,c 1 ,c 2 ) ⊗E 1 ⊗• • •⊗E n+1
is not valid either. This concludes the proof of point 3 of Lemma 5.

Goal formula

The goal formula ϕ G in tr(M ) is ϕ valid ∧ ϕ halt , where:

• ϕ valid := N =0 ♦a ∧ ♦p 1 ∧ ♦p 2 , and • ϕ halt := ♦(a N ∧ ♦ ⊥).
Intuitively, formula ϕ valid forces the final pointed epistemic model of a plan to be valid (and therefore, by Point 3 of Lemma 5, all intermediate pointed epistemic models of the plan also are valid). Formula ϕ halt enforces the final pointed epistemic model to represent a halting configuration (N, * , * ).

Proposition 12. M halts iff there is a plan for tr(M ).

Proof. ⇒ If M halts, let ( t , c t 1 , c t 2 ) t=0,.
..,T be the sequence of configurations of the halting execution. We build a plan for tr(M ) by taking the sequence of pointed event models (E( t , c t 1 , c t 2 )) t=0,...,T -1 . One can prove by recurrence, using point 1 of Lemma 5, that each intermediate product (M, w) (0,0,0) ⊗ E(0, 0, 0)

⊗ . . . ⊗ E( t , c t 1 , c t 2 ) is isomorphic to (M, w) ( t ,c t 1 ,c t 2 ) . The final product is thus isomorphic to (M, w) (N,c 1 ,c 2 ) for some c 1 , c 2 , so that (M, w) (N,c 1 ,c 2 ) |= ϕ halt . In addition, (M, w) (N,c 1 ,c 2 ) is valid, so that (M, w) (N,c 1 ,c 2 ) |= ϕ valid .
⇐ Suppose that there is a plan (E t , e t ) t=0,...,T -1 for tr(M ). As the final product satisfies ϕ valid , it is valid. Using point 3 of Lemma 5 we can prove by backward recurrence that all intermediate products are valid. By forward recurrence, using points 1 and 2 of Lemma 5, we can prove that each intermediate model is isomorphic to a model of the form (M, w) ( ,c 1 ,c 2 ) , and that the event model applied to it in the plan is E( , c 1 , c 2 ). We extract a sequence of configurations ( , c 1 , c 2 ) t=0,...,T that starts with (0, 0, 0) and that, by point 1 of Lemma 5, follows the transition function of M . As the final product satisfies ϕ halt , it is isomorphic to (M, w) (N,c 1 ,c 2 ) for some c 1 , c 2 , so that the final configuration is (N, c 1 , c 2 ). Therefore, M halts.

Comparison

In [START_REF] Aucher | Undecidability in Epistemic Planning[END_REF] the program counter as well as the data counters are represented with chains of worlds, and incrementation, decrementation and replacement of a value by another one are implemented on such chains. While the first two operations can be performed with preconditions of modal depth two, repl( , ) requires unbounded nesting in general to be implemented on chains. We observed that unlike data counters, the program counter is bounded so that we can avoid chains for its representation, and provide an alternative gadget for repl( , ) that only uses preconditions of modal depth two.

Conclusion

In this chapter, we have introduced the epistemic planning problem, which takes in input a Kripke model, event models and a goal formula, and searches for a sequence of event models to apply to reach the goal formulas.

We proved that when event models are separable, meaning that any pair of events in an event models have disjoint preconditions, the epistemic planning problem is NP-complete when all events are non-ontic, and Pspace-complete otherwise. We also proved that in the general case, when all event models are in C -1 0 , the epistemic planning problem is Pspace-complete. Finally, we showed that if the epistemic planning problem is restricted to the C -1 2 , it is already undecidable. This negative result shows that it is impossible to deal with epistemic planning in all its generality, but there is still hope in practice. Indeed, for separable events, epistemic planning has the same complexity than classical planning, so maybe for non separable event model with insightful constraints, we might find other decidable fragments of epistemic planning. For instance, semi-private assignments, i.e. assign a variable to a value but some agents are oblivious about the value, may be a non separable event model such that the epistemic planning problem is still decidable. It corresponds to playing cards secretly in card games for instance. We wish to continue studying epistemic planning in this respect.

Chapter 5

Symbolic Epistemic Logic with Arbitrary Announcements

Introduction

In this chapter, we do not consider the full expressivity of DELCK, but instead focus on a special type of event models: public announcements, that is event models with only one event with a trivial postcondition. The family of announcement logics has been the subject of much work as they open the way to formal reasoning in many practical applications. We here mention a few, at the intuitive level only. For example, such logics enable one to reason about human/robot interaction via a public channel of communication: message exchanges between robots can modeled by public announcements when there is common knowledge of the reliability of the network and when it is assumed that messages are received instantaneously [START_REF] Lemaignan | Human-Robot Interaction: Tackling the AI Challenges[END_REF]. Announcement logics, as well as dynamic epistemic logic, are also relevant in games [START_REF] Löwe | Logic and the simulation of interaction and reasoning: Introductory remarks[END_REF]: in the Battleships game, players publicly announce that there is a ship in a given cell. In card games, players often publicly show some cards to other players or announce something. Some issues in security may also be approached with announcement logics: for example, one may wish to verify that no announcement leads the system to a critical/bad state, say, where Intruder knows some secret [START_REF] Chareton | Strategic Knowledge of the Past in Quantum Cryptography[END_REF]. Finally, gossip-based algorithms in distributed systems, where agents privately share their secrets in order to achieve shared knowledge of all secrets, may be analyzed with announcement logics [HM15; Dit+16; Dit+17].

Since epistemic planning is undecidable in general but NP-complete when restricted to announcements [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF] 1 , studying in depth the the announcement operator is reasonable.

Here, we go further by synthesizing an announcement from scratch. Several logics were created to express the existence of an announcement, as arbitrary public announcement logic (APAL) [START_REF] Balbiani | What can we achieve by arbitrary announcements?: A dynamic take on Fitch's knowability[END_REF] or group announcement logic (GAL) [Ågo+10].

In this chapter, we study the symbolic model checking against the Public Announcement Protocol Logic (PAPL), that embeds both APAL and GAL, where symbolic models are defined as in Chapter 3. The content of this chapter extends a previous paper [START_REF] Charrier | Arbitrary Public Announcement Logic with Mental Programs[END_REF] that only focused on symbolic model checking of APAL. The content of the chapter is the following.

No arbitrary announcements Arbitrary/group announcements star-free protocols PSPACE-complete A pol Exptime-complete protocols with stars A pol Exptime-complete A pol Exptime-complete Table 5.1: Symbolic model checking of PAPL

• First, we define the logic PAPL as an extension of epistemic logic with announcement protocols.

• Second, we prove that even if a formula contains arbitrary announcements, it is sufficient to consider the set of atomic propositions in this formula in symbolic models to capture the whole expressivity.

• Third, we design algorithms that establish upper bound complexities.

• Fourth, we establish tight lower bounds.

• Fifth, we discuss the non-symbolic case.

• Finally, we conclude.

See Table 5.1 for a summary of the results. The chapter was initially published in [START_REF] Charrier | Arbitrary Public Announcement Logic with Mental Programs[END_REF] but only for APAL and GAL. The extensions presented in this chapter are submitted and accepted to the Journal of Logic in Computation.

Public announcement protocol logic

We define a unifying logic, called P AP L (Public Announcement Protocol Logic), that extends Public Announcement Logic (PAL) [START_REF] Plaza | Logics of public communications[END_REF], Arbitrary Public Announcement Logic (APAL) [START_REF] Balbiani | What can we achieve by arbitrary announcements?: A dynamic take on Fitch's knowability[END_REF] and Group Arbitrary Public Announcement Logic (GAL) [Ågo+10]. It also contains constructions to express announcement protocols in the dynamic logic style.

Syntax of the full language P AP L

The formulas of P AP L, that may rely on announcement protocols, obey to the following syntax.

Definition 57 (Syntax of P AP L).

(Formulas) ϕ ::= p | (ϕ ∧ ϕ) | ¬ϕ | K a ϕ | C G ϕ | γ ϕ (Announcement protocols) γ ::= ϕ! | •! | •! G | ϕ? | (γ; γ) | (γ ∪ γ) | γ *
where p ∈ AP is a proposition, a ∈ Ag is an agent, and G ⊆ Ag is a group of agents.

The intuitive meanings of the modal construction γ ϕ is "there is a successful execution of the protocol γ after which ϕ holds".

Protocols can be understood as knowledge-based programs [START_REF] Fagin | Knowledge-Based Programs[END_REF], except that we do not impose tests ϕ? to be formulas of the form K a ψ, as protocols could be executed by the environment. Their intuitive behavior is given by th following table.

ϕ!

announce the true formula ϕ; fail if ϕ is false

•! announce an arbitrary true formula

•! G announce an arbitrary true formula of the form a∈G K a ψ a ϕ? succeed if ϕ is true, fail otherwise γ 1 ; γ 2 sequentially execute γ 1 then γ 2 γ 1 ∪ γ 2 non-deterministically choose between γ 1 and γ 2 γ * execute protocol γ a finite number of times (possibly 0 times)2

Noticeable syntactic fragments of P AP L can be exhibited. Arbitrary public announcement logic (APAL) is the fragment where only operator K a , ψ and •! are permitted. Group announcement logic (GAL) is the fragment where only K a , ψ and •! G can be used.

We now give examples of P AP L-formulas.

Example 25 (Muddy children with two children). Formula •! (¬K a p a ∧¬K b p b )! C {a,b} p a states that "there exists an arbitrary public announcement such that after having announced it, the announcement that Agent a does not know that he is muddy and Agent b does not know he is muddy makes it common knowledge that Agent a is muddy". It is true for instance in the case with two children where p a = p b = by instantiating the arbitrary announcement by the announcement of p a ∨ p b .

Example 26 (Muddy children in the general case). The announcement protocol

γ =   a∈Ag p a !   ;   a∈Ag ¬K a p a !   *
consists in first announcing that one of the children is muddy, and second, non-deterministically announcing a finite number of times that no child knows that he is muddy. Formula γ a∈Ag K a p a is true in any situation where at least one child is muddy.

Example 27 (Protocol of a dialogue). Consider four agents a, b, c, d that discuss together. The "dialogue" protocol where a speaks first and leading to the situation where c does not know p, followed by a sentence expressed by b and leading to the situation where d does not know p is modeled by the following announcement protocol.

•! a ; ¬K c p?; •! b ; ¬K d p?
In the following, a formula ϕ or a protocol γ is arbitrary-free if it does not contain any occurrence of operators •! or •! G . Typically the protocol of Example 26 is arbitraryfree, but the protocol of Example 27 is not. Similarly, a protocol is star-free if it does not contain any occurrence of operators * . Thus the protocol of Example 25 is not starfree but the protocol of Example 26 is. Arbitrary-free and star-free protocols are noted τ instead of γ.

Remark 5. We can express epistemic planning with announcements by a PAPL formulas. Let {a 1 , . . . , a n } be a series of announcements that can public or arbitrary. Then the epistemic planning problem with this set announcements as the set of possible actions is expressed by the PAPL-formula (a 1 ∪ • • • ∪ a n ) * ϕ G where ϕ G is the goal formula. In this setting, the action •! is interpreted as "find a formula to announce" and •! G is interpreted as "find any formula announced by group G".

Well-founded order over protocols and formulas

We can equip the set P AP L with well-founded orders over protocols and formulas, that will be useful in subsequent proofs. We first define the order ≺ γ over protocols (Definition 58) and then define the order ≺ over formulas (Definition 59).

Definition 58 (Well-founded order over protocols). We let ≺ γ be the least relation on protocols that contains the standard "subprotocols"-based ordering and that satisfies:

• ϕ! ≺ γ •! for any arbitrary-free formula ϕ;

• ϕ! ≺ γ •! G for any arbitrary-free formula ϕ and any set G;

• γ i ≺ γ γ * for any protocol γ and any i ∈ N; Proposition 13. ≺ γ is well-founded.

Proof. For any protocol γ we define q(γ)

= (•! G (γ), •!(γ), * (γ), symb(γ)) ∈ N 4 with •! G (γ) the number of •! G operators in γ, •!(γ) the number of •! operators in γ, * (γ)
the number of Kleene stars in γ and symb(γ) the total number of symbols in γ. We define Q γ = {q(γ)} ⊆ N 4 equipped with the lexicographical order < lex on N 4 . We obtain directly that γ ≺ γ γ implies q(γ) < lex q(γ ), which shows that ≺ γ is well-founded.

We now define the well-founded operator over formulas.

Definition 59 (Well-founded order over formulas). We let ≺⊆ P AP L × P AP L be the least relation that contains the standard "subformula"-based ordering and that satisfies:

• γ ϕ ≺ γ ϕ for any formula ϕ and any protocols γ and γ such that γ ≺ γ γ ;

• K a 1 ...K an ϕ ≺ C G ϕ for any set G, any sequence a 1 , . . . , a n of agents in G and any formula ϕ.

We prove the following.

Proposition 14. ≺ is well-founded.

Proof. Similarly to Proposition 13, we define q(ϕ)

= (•! G (ϕ), •!(ϕ), * (ϕ), C G (ϕ), symb(ϕ)) with •! G (ϕ) being the number of •! G operators in ϕ, •!(ϕ)
being the number of •! operators in ϕ etc. We conclude with the same argument.

In the rest of the chapter, the notion of induction for protocols and formulas is relative respectively to ≺ γ and ≺.

Semantics

The semantics of P AP L-formulas is defined as follows.

Definition 60 (Semantics of PAPL). Let M = (W, { a -→} a∈Ag , V ), w ∈ W and ϕ a formula. We extend the definition of M, w |= ϕ given in Definition 3 page 38 for ELCK with the following inductive case.

• M, w |= γ ϕ if there exists M , w such that (M, w) γ (M , w) and M , w |= ϕ.

We define γ a binary relation between pointed models by induction over protocols γ.

• (M, w) ϕ! (M {u∈W |M,u|=ϕ} , w) whenever M, w |= ϕ;

• (M, w) •! (M , w) whenever (M, w) ϕ! (M , w) for some arbitrary-free formula ϕ;

• (M, w) •! G (M , w) whenever (M, w)
a∈G Kaψa! (M , w) for some arbitrary-free formulas (ψ a ) a∈G ;

• (M, w) ϕ? (M, w) whenever M, w |= ϕ;

• (γ∪γ ) is γ ∪ γ ; γ;γ is the composition γ • γ ; and γ * is the reflexive transitive closure of γ .

Relevant atomic propositions in symbolic Kripke models

Symbolic Kripke models

We consider a similar definition to Definition 42 page 88. The main difference here is that the symbolic Kripke model is only described by the programs, the set of worlds being U by default. If we want to begin with a set W of worlds instead of U , it is always possible to express W with a formula ϕ W and replace for any formula ϕ the model checking of ϕ by the model checking of ϕ W ! ϕ.

Definition 61 (Symbolic Kripke models). A symbolic (Kripke) model is a collection M = (π a ) a∈Ag of programs over the set AP of propositional variables.

Before proving the main theorem of this section, let us detail an example to highlight why arbitrary announcements and symbolic models are relevant together.

Example 28 (Russian cards, ([Dit03; DK15])). We consider a card game where the cards range from 1 to 7, with three players/agents Agent a, Agent b and Agent c, respectively, each of them having in hand 3 cards, 3 cards and 1 card. Such a typical situation is depicted in Figure 5.1. We address the question of whether Agents a and b can or cannot publicly announce a course of truthful facts so that they end-up commonly knowing each player's hand, while Agent c not being able to learn any card from Agent a's or Agent b's hands from any of these announcements.

From [START_REF] Hans | The Russian Cards Problem[END_REF], we know that in any possible initial situation, Agents a and b can indeed share full information of their hand by performing each a single public announcement. For example, from the situation of Figure 5.1, agents can do the following. Notice first that a cannot announce the hand, because c would then get a forbidden information. However a may announce a set of possible hands so that Agent b can infer Agent a's hand but Agent c cannot. Let Agent a announce the sentence "My hand is either 134, 126, 367, 465 or 275". Whichever hand Agent b and Agent c have, Agent b will always be able to deduce Agents a's hand while Agent c will never find out any card of Agent a. After Agent a's announcement, Agent b actually knows all hands of the players and achieves the goal by announcing Agent c's hand so that Agent a knows all hands.

We formalize the Russian cards puzzle with a symbolic Kripke model and state a formula expressing that both agents a and b commonly know the card configurations while Agent c does not know any others' card.

To do so, we first let proposition p i,a denote the fact "Agent a has card i", where i ∈ {1, . . . , 7} ranges over the set of cards, and we let AP σ be the set of propositions p i,a , p i,b , p i,c , where i ∈ {1, . . . , 7}.

Legal hands. Let S 7 be the set of all permutations of (1, 2, 3, 4, 5, 6, 7) whose typical element is σ = (σ(1), ..., σ( 7)). The valuations that correspond to legal hands are the models of the formula ϕ h defined by

ϕ h = σ∈S 7 ϕ σ
where ϕ σ describes the hands given by the permutation σ = (σ(1), ..., σ(7)) ∈ S 7 . Namely,

ϕ σ = p σ(1),a ∧ p σ(2),a ∧ p σ(3),a ∧ p σ(4),b ∧ p σ(5),b ∧ p σ(6),b ∧ p σ(7),c ∧ p∈APσ\{p σ(1),a ,...,p σ(7),c} ¬p.
The public announcement ϕ h ! restricts the set of valuations to those denoting legal hands.

Symbolic Kripke model. The programs for the three players are the following.

π a = set(p 1,b , ..., p 7,b , p 1,c , ..., p 7,c ) π b = set(p 1,a , ..., p 7,a , p 1,c , ..., p 7,c ) π c = set(p 1,a , ..., p 7,a , p 1,b , ..., p 7,b )
Each program expresses that its agent considers possible all worlds obtained by changing other players' cards, and in a legal manner since formula ϕ h has previously been announced.

Formula. We express formula ϕ stating that both agents a and b commonly know the card configurations while Agent c does not know any others' card.

ϕ = σ∈S 7 (C {a,b} ϕ σ ) ∧ p∈{p 1,a ,...,p 7,a ,p 1,b ,...,p 7,b} ¬(K c p ∨ K c ¬p) We can show that for all w ∈ U , U , w |= ϕ h ! •! a ϕ but for all w ∈ U , U , w |= [ϕ h !] •! a •! b ϕ.
Notation 1. In the rest of the chapter, we suppose that the symbolic Kripke model M is clear from the context. Thus, for every set of valuations U ⊆ U , for every valuation u ∈ U , we simply write (U, u) instead of (M U M , u).

Relevant set of propositions

We establish non-surprising but important results regarding the relevant set of propositions that should be considered in a symbolic model. Given a symbolic model M and a formula ϕ ∈ P AP L, the set of atomic propositions that appear in both is sufficient to evaluate the truth value of ϕ. In particular, it is not necessary to consider arbitrary announcements that involve formulas referring to propositions not occurring in any of the program π among M and in ϕ. This property (stated in Proposition 15) plays an important role in the design of our algorithms in Section 5.4. Before we prove this property, we need to introduce notations and to define the notion of relevant propositions.

In the rest of this proof, given a program π, two sets of valuations W, U ⊆ U , and a valuation w ∈ W ∩ U , we consider the two following sets.

• ∼ pre π,W (U ) = w ∈ W | ∀v ∈ W, w π - → v implies v ∈ U is the set of worlds whose all π-successors are in U ; • post π,W (U ) = v ∈ W | ∃w ∈ U, w π - → v
is the set of worlds that are π-successors of worlds in U .

We now define relevant propositions.

Definition 62. Given a symbolic model M, we define the set of relevant propositions AP(ϕ) in a formula ϕ, AP(γ) in a protocol γ, and AP(π) in a program π as follows, in a crossed-inductive manner.

• For formulas:

-AP( ) = ∅; AP(p) = {p}; -AP(¬ϕ) = AP(ϕ); -AP(ϕ 1 ∨ ϕ 2 ) = AP(ϕ 1 ) ∪ AP(ϕ 2 ); -AP(K a ϕ) = AP(π a ) ∪ AP(ϕ); -AP(C G ϕ) = AP(ϕ) ∪ a∈G AP(π a ); -AP( γ ϕ) = AP(γ) ∪ AP(ϕ);
• For programs:

-AP(p ← ⊥) = AP(p ← ) = {p}; -AP(β?) = AP(β); -AP(π 1 ; π 2 ) = AP(π 1 ∪ π 2 ) = AP(π 1 ) ∪ AP(π 2 );
• For protocols:

-AP(ϕ!) = AP(ϕ);

-AP(•!) = ∅; -AP(•! G ) = a∈G AP(π a ); -AP(ϕ?) = AP(ϕ); -AP(γ 1 ; γ 2 ) = AP(γ 1 ∪ γ 2 ) = AP(γ 1 ) ∪ AP(γ 2 ); -AP(γ * ) = AP(γ);
Example 29. If π a = set(q, r), then AP(K a p) = {p, q, r}.

Given a symbolic model M, sole the set AP(ϕ) is relevant to evaluate a formula ϕ, as stated by the following proposition. Proof. In Appendix E.1.

Thanks to Proposition 15, we can alternatively characterize the semantics of •! G ϕ by the existence of subsets of valuations U a instead of the existence of formulas ψ a as stated in Proposition 16. This characterization will be used for the design of algorithms in Section 5.4. We end this section by redefining the notion of size to take in account the symbolic model:

Definition 63 (Size of programs, formulas, protocols and symbolic Kripke models). Given a symbolic Kripke model M, the sizes of a program π, a formula ϕ and of a protocol γ, written |π|, |ϕ|, |γ| are mutually inductively defined as follows.

• Programs π

-|p ← β| = |β?| = 1 + |β|; -|π 1 ; π 2 | = |π 1 ∪ π 2 | = 1 + |π 1 | + |π 2 |.
• Formulas ϕ: -

-| | = |p| = 1 -|¬ψ| = 1 + |ψ| -|ψ 1 ∨ ψ 2 | = 1 + |ψ 1 | + |ψ 2 | -| Ka ϕ| = 1 + |π a | + |ϕ|
|C G ψ| = 1 + |AP| + a∈G |π a | + |ψ| -| γ ϕ| = 1 + |γ| + |ϕ| • Announcement protocols γ: -|ϕ!| = |ϕ?| = 1 + |ϕ|; -|•!| = 1 -|•! G | = 1 + a∈G |π a |; -|γ 1 ∪ γ 2 | = |γ 1 ; γ 2 | = 1 + |γ 1 | + |γ 2 |; -|γ * | = |AP| + |γ|.

Upper bounds

We design algorithms and establish upper bound complexity results. The alternating algorithm to decide whether w π -→ u, relation yes (w, u, π) is in Figure 5.2 and is the same than the one of Chapter 3. In Subsection 5.4.1, we present an alternating polynomial-time algorithm to model check against P AP L-formulas with star-free and alternation-free protocols only; since Aptime = Pspace [CS76], we obtain a Pspace upper bound (Theorem 17). In Subsection 5.4.2, we transform the previous algorithm into an A pol Exptime algorithm for model-checking against formulas that may contain protocols with stars and arbitrary announcement operators, yielding Theorem 18.

By Proposition 15, U , w |= ϕ is equivalent to U ϕ w , w ϕ |= ϕ so we abuse notations by taking U for U ϕ w , w for w ϕ for w and AP for AP(ϕ), thus considering only finite valuation sets.

Propositional constructions in mc yes (Figure 5.3). For ϕ = p, the call mc yes (L, w, ϕ) accepts if and only if p ∈ w. As expected, for ϕ = ¬ψ, the call switches from mc yes to mc no . For ϕ = ϕ 1 ∨ ϕ 2 , mc yes (L, w, ϕ) consists in existentially choosing i ∈ {1, 2} and then calling mc yes (L, w, ϕ i ). The semantics of operator C G yields checking that mc yes (L, u, ϕ) does not reject, for all u ∈ U reachable from w by iterating a∈G π a . This is the purpose of Algorithm access * yes (Figure 5.5). Regarding the size of the multiset {a 1 , . . . , a i }, it is sufficient to consider at most i = 2 #AP : indeed, each iteration of a∈G π a adds at least one valuation into the set of reachable valuations from w, so it will necessarily stabilize within at most 2 #AP steps, which is the size of U . Additionally, it is important to require that after each iteration, the obtained valuation is in W L , ensured by the call in yes in access * yes . To remain in the class Aptime, Algorithm access * yes relies on a divide and conquer method, similarly to access * yes in Chapters 2 and 3.

Knowledge operators in mc

Announcement protocol operators in mc yes (Figure 5.3). We separate the case of a formula of the form τ χ into four cases depending on the form of τ : namely, either ψ!, or ψ?, or τ 1 ∪ τ 2 , or τ 1 ; τ 2 . proc access * yes (L, w, u, π, i) When considering an announcement (some ψ!), it is necessary to check that this announcement is consistent with w (by calling mc yes (L, w, ψ)) and that χ holds after the announcement (by calling mc yes (L :: ψ, w, χ)). The case for ψ? is similar: it is needed to check ψ in w (by calling mc yes (L, w, ψ)), but in this case the list L needs not being changed (hence the call to mc yes (L, w, χ)). Regarding a non-deterministic choice τ 1 ∪ τ 2 , the algorithm existentially chooses which protocol to consider. Finally, for a sequence τ 1 ; τ 2 , the algorithm uses the fact that formula τ 1 ; τ 2 χ is equivalent to formula τ 1 τ 2 χ.

|L| + |AP| + log 2 (i) + |π| accepts whenever w = u or there exist v 1 , . . . , v k ∈ W L with k < i such that w π - → v 1 . . . π - → v i-1 π - → u (for i > 1) case i = 1: if u = w then access yes (w, u, π) else accept case i ≥ 2: (∃) (∃) (∃) v ∈ U (∀) (∀) (∀)
- → w 1 π - → . . . π - → w j-1 π - → u and j ≤ i; access * no (L, w, u, π, i) accepts iff for all w 1 , . . . , w j-1 ∈ W L such that j ≤ i, it is false that w π - → w 1 π - → . . . π - → w j-1 π - → u; in yes (L, w) accepts iff w ∈ W L ; in no (L, w) accepts iff w ∈ W L ; mainmc(w, ϕ) accepts iff U , w |= ϕ.
Proof. Let H(n) be the Proposition 17 but only for all L, w, ϕ, i such that |L| + |ϕ| ≤ n.

We prove H(n) by induction on n. The case access * yes is proven by another induction on i. Details are left to the reader.

Algorithm mainmc is achieved by an alternating Turing machine running in polynomial time. Indeed in the algorithms, the quantities in gray decrease strictly with the recursive calls, and are polynomial in the size of the input. Furthermore in each recursive call, only polynomial time instructions are performed. Since Pspace = Aptime, it concludes the proof of Theorem 17.

Model checking against P AP L-formulas

In this section, we prove the following theorem.

Theorem 18. The symbolic model checking problem against formulas (even with protocols with stars and arbitrary announcements) is in A pol Exptime.

In order to prove Theorem 18, we provide the following model checking algorithm mainmc that resorts on Algorithm mc yes subsequently defined (Figure 5.6). The algorithm mc yes , shown in Figure 5.6 is similar to the algorithm of Figure 5.3. However, instead of using the history of announcements L, we directly consider the context W L , thus written W in the algorithms. Namely, the call to mc yes (L, w, ϕ) in Figure 5.3 is now replaced by the call mc yes (W, w, ϕ), and similarly for all other auxiliary algorithms. Typically, for the case of a formula of the form K a ϕ, and in order to check that a given valuation u is in W , we replace the call in yes (L, u) (in Figure 5.3) by choosing directly u in W (in Figure 5.6).

We now detail each case of Algorithm mc yes of Figure 5.6.

Common knowledge. We tune the algorithms access * yes and access * no of Figure 5.5 into those in Figure 5.7.

Announcement protocols. We define algorithm exec yes (Figure 5.8) such that the call exec yes (W, w, W , γ) checks that (W, w) γ (W , w). For announcements ϕ!, we check that W is the restriction of W with respect to the announcement ϕ: namely every element u in W should satisfy ϕ (mc yes (W, u, ϕ)) and every element v outside W should not satisfy ϕ proc mc yes (W, w, ϕ) |AP| + |ϕ| accepts whenever W, w |= ϕ match ϕ with case ϕ = p: if p ∈ w then accept else reject case ϕ = ¬ψ: mc no (W, w, ψ) case ϕ = (ψ 1 ∨ ψ 2 ): (∃) (∃) (∃) mc yes (W, w, ψ 1 ) or mc yes (W, w, ψ 2 ) (mc no (W, v, ϕ)). For an arbitrary announcement •!, the call exec yes simply succeeds since

case ϕ = K a ψ: (∀) (∀) (∀) u ∈ W ; (∃) (∃) (∃) access no (w, u, π a ) or mc yes (W, u, ψ) case ϕ = C G ψ: (∀) (∀) (∀) u ∈ W (∃) (∃) (∃) access * no (W, w, u, a∈G π a , 2 #AP ) or mc yes (W, u, ψ) case ϕ = γ χ: (∃) (∃) (∃) W ⊆ W | w ∈ W (∀) (∀) (∀)
W ⊆ W is granted.
For group announcements •! G , we guess subsets (W a ) a∈G of W containing w. We then check whether there exist (ψ a ) a∈G such that for all a ∈ G, (W, w) Kaψa! (W a , w). According to Proposition 16, it amounts to checking that ∼ pre π,W (post π,W (W a )) = W a , as achieved by algorithm stable yes shown in Figure 5.10. The idea for checking that ∼ pre π,W (post π,W (W a )) = W a is that for all w ∈ W a , check that for all v ∈ W such that w πa -→ v (which is done by filtering the other ones by access no (w, v, π a )), all π a -predecessors of v are in W a . Therefore, the algorithm stable yes checks that ∼ pre π,W (post π,W (W a )) ⊆ W a3 . After having chosen the W a , the model-checking goes on with the new current set of valuations a∈G W a .

For γ * , we introduce the algorithm exec * yes (Figure 5.9), based on divide-and-conquer as access * yes .

proc stable yes (W, W , π)

|π| + 1 accepts whenever Proof. By induction on ϕ, i, γ.

∼ pre π,W (post π,W (W )) ⊆ W (∀) (∀) (∀) (w, v, u) ∈ W × W × W if u ∈ W then (∃) (∃) (∃)
The algorithm mainmc runs on exponential time and introduces a polynomial number of alternations. Indeed, the quantities in gray are polynomial and decrease strictly, and in each recursive call, there is a polynomial number of alternations and the call runs in exponential time.

Lower bounds

In this section, we establish tight lower bounds for the symbolic model checking problem. First, as DL-PA-model checking is Pspace-hard [START_REF] Herzig | A Dynamic Logic of Normative Systems[END_REF], we obtain that: Theorem 19. The symbolic model checking against formulas with arbitrary-free and starfree protocols is Pspace-hard.

To prove the other lower bound results of Table 5.1, we first prove in Subsection 5.5.1, as an intermediate step, the NExptime lower bound for the fragment ∃ 1 P AP L defined as the restriction to formulas of the form •! ϕ where ϕ does not contain any arbitrary public announcement and no protocols. Then we use this NExptime lower bound in Subsection 5.5.2 to show the A pol Exptime-hardness for the fragment of P AP L containing only formulas with star-free protocols, by taking alternations of ∃ 1 P AP Lformulas. The proofs described generalize Cook's theorem [START_REF] Cook | The Complexity of Theorem-Proving Procedures[END_REF]. Cook's theorem states that we can express the existence of a polynomially long accepting execution of a given non-deterministic Turing machine with a formula of propositional logic. Analogously, we will prove that:

• the existence of an exponentially long accepting execution of a given non-deterministic Turing machine can be stated by a formula of ∃ 1 P AP L.

• the existence of an exponentially long accepting execution of a given alternating Turing machine with a polynomial number of alternations can be stated by a with a formula of P AP L with star-free protocols.

In order to ease the notations, we confuse an agent and its program. We write K π instead of K a , where a is an agent whose program is π.

In the Subsection 5.5.3, we tackle the A pol Exptime-hardness for the case of protocols without arbitrary announcements.

NEXPTIME-hardness for ∃ 1 P AP L

The aim of this Subsection is to prove Theorem 20.

Theorem 20. The ∃ 1 P AP L-model checking problem is NExptime-hard.

Proof. Let L be a NExptime problem. We define a polynomial reduction tr from L to the ∃ 1 P AP L-model checking problem. Let M = (Q, Σ, Γ, δ, q 0 , q acc ) be an non-deterministic Turing machine running in exponential time that decides L. Q is a finite set of states, Σ is the finite input alphabet, Γ is the finite tape alphabet where the blank symbol ␣ is in Γ and Σ ⊆ Γ, δ ⊆ Q × Γ × Q × Γ × {-1, 0, 1}, q 0 is the start state and q acc is the accept state. We suppose here that all end-states that are not q acc are rejecting. Let P be (|ω|) . Note that the length of the non-empty part of the tape (that is the smallest portion of the tape such that there are only occurrences of the symbol ␣ on the left and on the right of that portion) is also bounded by 2 P (|ω|) at any step of the execution.

Let ω be an instance of L. We encode the existence of an accepting execution of M for ω (that is, which ends in the state q acc ) in an ∃ 1 P AP L-model checking instance tr(ω). Without loss of generality, we suppose that the machine M is built so that we loop on state q acc : formally (q acc , a, q acc , a, 0) ∈ δ for all a ∈ Γ.

The atomic propositions to represent an execution. An execution of M is represented by a tableau whose rows are the configurations of M , as depicted in Figure 5.11a. The integers x and t in 0, . . . , 2 P (|ω|) -1 respectively represent a cell index on the tape and the time index. We identify x and t with their binary representations respectively expressed by means of the atomic propositions x 1 , . . . , x n and t 1 , . . . , t n where n = P (|ω|). For instance, if n = 4, x 1 , ¬x 2 , x 3 , ¬x 4 represents x = 5.

We use the following atomic propositions to represent a given tape cell of index x at a given moment t:

• x = x 1 . . . x n : the position of the current tape cell;

• t = t 1 . . . t n : the moment we consider;

• cur: true if the cursor of the tape is in position x at time t, false otherwise;

• symbol a : true if the symbol a is stored at position x at time t, false otherwise;

• state q : at time t, M is in state q ∈ Q (q could be the initial state q 0 , the accepting state q acc or any other state of the finite state space of the Turing machine; notice that the truth values of propositions state q should be independent from x);

• tr q,a,q ,b,d : the transition starting from state q ∈ Q and going to state q ∈ Q, reading the symbol a ∈ Γ on the tape and writing b ∈ Γ, moving the cursor on direction d ∈ {-1, 0, +1} is executed at time t (note that the truth values of propositions tr q,a,q ,b,d should be independent from x).

The set of the atomic propositions we just described is noted AP .

Example 30. Let us suppose that n = 4. Valuation {x 1 , x 3 , t 2 , state q , symbol c , tr q ,b,q ,a,-1 } is about time 2 ( as ¬t 1 , t 2 , ¬t 3 , ¬t 4 represents 0 × 2 0 + 1 × 2 1 + 0 × 2 2 + 0 × 2 3 ) and the 5 th cell of the tape (as x 1 , ¬x 2 , x 3 , ¬x 4 represents 2 0 + 0 × 2 1 + 2 2 + 0 × 2 3 ):

• The cursor is not in the 5 th cell of the tape at time 2 (because cur is false);

• Letter c is written in the 5 th cell of the tape;

• The machine M is in state q at time 2;

• From time 2 to time 3, the machine M triggers the transition from state q to state q by reading b, writing a and moving the cursor left.

The existence of an accepting execution as an arbitrary public announcement.

Remark that there are non legal valuations in 2 AP , such as a valuation in which both symbol a and symbol b are true with a = b. The idea is to perform an arbitrary public announcement yielding to a set of legal valuations representing an accepting execution for ω of M . Each remaining valuation describes the content of one cell on the tape at a given moment along this execution. The rest of the proof consists in defining a formula of the form •! ϕ such that ϕ expresses that the set resulting from the announcement represents an accepting execution of M on ω.

Abbreviations. To ease the reading of the formula expressing the accepting execution, we introduce the following abbreviations:

• Exactly one proposition among {p 1 , . . . , p n } is true

∃!(p 1 , . . . , p n ) := i∈{1,...,n}   p i ∧ j =i ¬p j   ;
• x=y, x≥y, etc. are formulas over x 1 , . . . , x n and y 1 , . . . , y n whose intended meaning is that the values of propositions x 1 , . . . , x n and y 1 , . . . , y n are such that the number x (denoted by x 1 , . . . , x n ) is equal to y (denoted by y 1 , . . . , y n ), greater or equal than y, etc. We define these formulas by recurrence on the number of digits, with the empty word (0 digit):

-= is and x 1 . . . x n = y 1 . . . y n is (x n ↔ y n ) ∧ (x 1 . . . x n-1 = y 1 . . . y n-1 ) -≥ is and x 1 . . . x n ≥ y 1 . . . y n is (x n ∧ ¬y n ) ∨ ((y n → x n ) ∧ (x 1 . . . x n-1 ≥ y 1 . . . y n-1 ))
For instance the formula x=5 is equivalent to where p 1 . . . p n are fresh propositions;

x 1 ∧ ¬x 2 ∧ x 3 ∧ n k=4 ¬x k . Formula t=2 P (|ω|) -
• x←x-1, x←x+1 and t←t+1 are programs of polynomial size in |ω| that respectively decrement x, increment x and increment t. Notice that x←x+1 is not executable when x = 2 P (|ω|) -1 and that x←x-1 is not executable when x = 0. More precisely:

x←x+1 := n-1 k=0 (¬x k+1 ∧ k i=1 x i )?; x 1 ←⊥; . . . x k ←⊥; x k+1 ← x←x-1 := n-1 k=0 (x k+1 ∧ k i=1 ¬x i )?; x 1 ← ; . . . x k ← ; x k+1 ←⊥
Definition of the reduction. The instance tr(ω) is of the form (w,

•! K set(AP ) (ϕ exe ∧ ϕ init ∧ ϕ accept )).
• First, w is the valuation symbol ω 0 , cur, state q 0 . Valuation w represents the most-left tape cell in initial configuration of M (U , w |= (x = 0 ∧ t = 0)). 13. (q,a,q ,b,d)∈δ tr q,a,q ,b,d → state q

The triggered transition is compatible with the current state 14. (q,a,q ,b,d)∈δ tr q,a,q ,b,d ∧ cur → symbol a

The triggered transition is compatible with th read letter 15. (q,a,q ,b,d)∈δ tr q,a,q ,b,d ∧ cur → K t←t+1 symbol b

The triggered transition is compatible with the written letter 16. (q,a,q ,b,d)∈δ tr q,a,q ,b,d → K t←t+1 state q

The triggered transition is compatible with the next state

17.

(q,a,q ,b,+1)∈δ tr q,a,q ,b,d ∧ cur → K t←t+1;x←x+1 cur

Behavior of the cursor that moves to the right

18.

(q,a,q ,b,-1)∈δ tr q,a,q ,b,d ∧ cur → K t←t+1;x←x-1 cur

Behavior of the cursor that moves to the left 19. (q,a,q ,b,0)∈δ tr q,a,q ,b,d ∧ cur → K t←t+1 cur

Behavior of the cursor that stays in the same cell Table 5.2: Formulas that constraint the set of valuations to represent an execution

• Formula ϕ exe is the conjunction of the formulas in Table 5.2. Formula ϕ exe imposes the set of surviving valuations to represent an execution of M . For instance, formula 4 in Table 5.2 says that changing the current valuation via the program set(x, state, symbol, cur, tr) (that only time t is fixed) will not change the truth valuation of proposition state q .

• Formula ϕ init says that in that execution, the configuration at time t = 0 is the initial configuration on ω. Formally:

ϕ init := t=0 → state q 0 ∧ [(x=0 → (cur ∧ symbol ω 0 ))∧ |ω|-1 i=1 (x=i → (¬cur ∧ symbol ω i )) ∧ (x≥|ω| → (¬cur ∧ symbol ␣ ))],
where ␣ is the blank symbol.

• Formula ϕ accept says that the configuration at time t = 2 P (|ω|) -1 is an accepting configuration. Formally: ϕ accept := t=2 P (|ω|) -1 → state qacc .

By construction, tr(ω) is computable from ω in polynomial time in |ω| and tr(ω) is a positive instance of ∃ 1 P AP L-model checking problem if and only if ω is a positive instance of L.

A pol Exptime-hardness for P AP L with star-free protocols

The aim of this subsection is to prove Theorem 21 given below:

Theorem 21. The symbolic model checking of any formula is A pol Exptime-hard.

To prove the theorem, we use Theorem 20 as a basic step for the part of an execution where all states are of the same type (existential or universal). Now we will alternate the use of •! and [•!] operators to simulate alternations in executions of alternating Turing machines.

Proof. (of Theorem 21) Let L be a problem in A pol Exptime. We are going to define a polynomial reduction tr from L to our symbolic model checking problem. Let M = (Q, Σ, Γ, δ, q 0 , q acc , type) be an alternating Turing machine running in exponential time that decides L with a polynomial number of alternations, where Q, Σ, Γ, δ, q 0 , q acc are defined as in the proof of Proposition 20 and type : Q × {∃, ∀} says whether a given state is existential (∃) or universal (∀). Let A be a polynomial function such that for all inputs ω, the number of alternations of any execution starting from ω is bounded by A(|ω|). Without loss of generality, we suppose that the number of alternations is exactly A(|ω|) and that the initial state is existential. The execution is segmented into maximal parts in which each configuration is of the same type: in a given part, either all states are existential states or all are universal states. Let P be a polynomial function such that for all inputs ω, the length of any such part is bounded by 2 P (|ω|) .

Transformation of M so that all execution parts are of length 2 P (|ω|) . We transform the machine M so that we can suppose that the length of any part of an execution is exactly 2 P (|ω|) in the following way. For all transitions t from an existential state to a universal state, we add an intermediate existential state i t as pictured below:

∃ ∀ t =⇒ ∃ i t ∃ ∀
Let us explain the transformation formally. For all transitions δ = (q, a, q , b, d) ∈ δ, such that type(q) = ∃ and type(q ) = ∀, we add a new state i t in δ, we remove the transition t from δ, we add the transitions (q, a, i t , a, 0), (i t , a, q , b, d) to δ and also the transitions (i t , α, i t , α, 0) for all tape symbols α ∈ Γ.

We do the same transformation for transitions that go from a universal state to an existential state. Figure 5.11b shows the shape of an execution of M .

Abbreviations.

Now we use the notation of the proof of Proposition 20 but now numbers x and t ranges over 0, . . . , A(|ω|)×2 P (|ω|) so we take the number n of digits of the numbers x and t to be P (ω) + log 2 (A(ω)) + 1. Now we define formula ϕ ∃ exe which is similar to formula ϕ exe (see proof of theorem 20) except that we impose end states of transitions to be existential. We define formula ϕ ∀ exe which is similar to formula ϕ exe except that we impose end states of transitions to be universal.

We define the following abbreviations:

• We are in a k th part with k ≥ k: k×2 P (|ω|) ≤t • We are in a k th part with k ≤ k: t<(k+1)×2 P (|ω|) • Go to the k th part : U k := set(AP ); k×2 P (|ω|) ≤t ∧ t<(k+1)×2 P (|ω|) ?

• Go after the k th part : U after k := set(AP ); t>k×2 P (|ω|) ?

• We are at the end of the execution: t=A(|ω|)×2 P (|ω|) • All valuations concerning the k th part and beyond exist (i.e. the parts from the k th part are unfixed): Describing the accepting condition. Now we define a sequence of formulas (ψ k ) k∈{0,...,A(|ω|)} that describe the execution of the Turing machine M one part after another. Assuming the execution is already defined until the time 2k × 2 P (|ω|) , the formula ψ 2k chooses the next transitions to execute in the (2k) th part so that the last transition executed in the (2k) th part leads to a universal state. Moreover, it leaves all valuations in remaining parts unfixed so that formula ψ 2k+1 is carrying on the rest of the execution. Assuming the execution is already defined until the time (2k + 1) × 2 P (|ω|) , the formula ψ 2k+1 checks that all possible executions in the (2k + 1) th part are accepting. Assuming the execution is defined until the end, the last formula ψ A(|ω|) checks that the last state is q acc . Formally:

ϕ k unfixed := K U after k   Kx←x+1∪
• ψ A(|ω|) := K U A(|ω|) [(t = A(|ω|)×2 P (|ω|) ) → state qacc ]; • for all k such that 2k + 1 < A(|ω|), ψ 2k+1 := [•!] K U 2k+1 (ϕ ∀ exe ∧ ϕ ∀→∃ exe,2k+1 ) ∧ ϕ 2k+2 unfixed → ψ 2k+2 ); • for all k such that 0 ≤ 2k < A(|ω|), ψ 2k := •! K U 2k (ϕ ∃ exe ∧ ϕ ∃→∀ exe,2k ) ∧ ϕ 2k+1 unfixed ∧ ψ 2k+1 ;
For all k ∈ {0, . . . , A(|ω|)}, we define the following property P (k): For all W ⊆ U , such that W defines a unique configuration C at time t = k × 2 P (|ω|) and contains all valuations for t > k × 2 P (|ω|) , W, w |= ψ k if and only if C is an accepting configuration.

We can prove by induction on k that P (k) is true for all k ∈ {0, . . . , A(|ω|)}.

Definition of the reduction. The instance tr(ω) is of the form (w, ϕ) where:

• w is the valuation symbol ω 0 , cur, state q 0 ;

• ϕ = •! K set(AP ) ϕ init ∧ ϕ 0 unfixed ∧ ψ 0 .
Formula ϕ ensures that the initial configuration (t = 0) is fixed, leaves all valuations concerning t > 0 unfixed and ψ 0 checks whether the initial configuration is accepting. tr(ω) is computable from ω in polynomial time in |ω|. We have that ω is a positive instance of L if and only if the initial configuration for ω in M is accepting if and only if (w, ϕ) is a positive instance of the model checking problem.

A pol Exptime-hardness for P AP L with protocols without arbitrary announcements

In this section, we prove that:

Theorem 22. The symbolic model checking of formulas with protocols but without arbitrary announcements is A pol Exptime-hard.

Proof. We reduce the symbolic model checking of formulas with arbitrary announcements (and without protocols) to it. Suppose that the formula to check is over propositions AP = {p 1 , . . . , p n }. The idea is to simulate an arbitrary announcement •! by a protocol γ •! . The protocol consists in iterating over all valuations, and, each time, either we keep the current valuation or we remove it from the current context.

For representing the current valuation in the iteration, we introduce fresh propositions ι 1 , . . . , ι n for each occurrence of •! in ϕ. ι 1 , . . . , ι n represents an integer in {0, . . . , 2 n -1}. Thus the new set of atomic propositions is AP = AP ∪ {ι i } 1≤i≤n,•!∈ϕ . The idea in each protocol is to iterate ι 1 , . . . , ι n over integers from 2 n -1 down to 0. At the beginning, all valuations are in the model hence integer ι 1 . . . ι n = 1 . . . 1 = 2 n -1 is the current integer.

We introduce symbolic accessibility relation succ(ι) to link a valuation over ι, different from 2 n -1 to the next integer representing the next integer. Formally, we define succ(ι n . . . ι 1 ) (ι 1 is the least significant bit) by induction on n:

• succ(ι 1 ) = (¬ι 1 ?; ι 1 ← );

• succ(ι n . . . ι 1 ) = (¬ι 1 ?; ι 1 ← ) ∪ (ι 1 ?; ι 1 ←⊥; succ(ι n . . . ι 2 )); • tr(p) = Ka p

• tr(¬ϕ) = ¬tr(ϕ)

• tr(ϕ 1 ∧ ϕ 2 ) = tr(ϕ 1 ) ∧ tr(ϕ 2 ) • tr(∃pϕ) = ¬p! ∪ ! tr(ϕ) • tr(∀pϕ) = [¬p! ∪ !]tr(ϕ)
The input Kripke model M is represented in Figure 5.12. Intuitively, the formula tr(ϕ) prunes M with public announcements. Announcing ¬p! means that we assign p to ⊥ and announcing ! means we assign p to . In the resulting Kripke model, we evaluate β where p is replaced by Ka p. Indeed, p is assigned to is equivalent to p is present in the Kripke model after the announcement, thus p is assigned to if and only if Ka p is true in the Kripke model. It means that when we evaluate β, p is true if and only if in the model Ka p is true. To express the quantifier, we consider the modality for ∃ and [ ] for ∀, which effectively simulates the quantifier.

Definition 66 (Input model M). The Kripke model

M = (W, R a , V ) is defined as fol- lows. • W = {w ∅ } ∪ {w p , p ∈ AP} • R a = {(w ∅ , w), w ∈ W } • V (w ∅ ) = ∅; V (w p ) = {p}
We now formally define the reduction.

Definition 67 (Reduction). Let ϕ be a QBF formula. Then the input of the model checking procedure is (M, w ∅ ) for the pointed Kripke model and tr(ϕ) for the formula to model check.

proc exec yes (W, w, W , γ) proc exec * yes (W, w, W , γ, i)

|AP| + |γ| accepts whenever (W, w) γ (W , w) match γ with case γ = ϕ!: (∀) (∀) (∀) (u, v) ∈ W × (W \W ); (∀) (∀) (∀) mc yes (W, u, ϕ) and mc no (W, v, ϕ) case γ = •!: accept case γ = •! G : (∃) (∃) (∃) (W a ) a∈G | for all a ∈ G, W a ⊆W, w∈W a if a∈G W a = W then reject else (∀) (∀) (∀) a ∈ G; stable yes (W, W a , R a ) case γ = γ 1 ; γ 2 : (∃) (∃) (∃) W ⊆ W such that W ⊆ W (∀) (∀) (∀) exec yes (W, w, W , γ 1 ) and exec yes (W , w, W , γ 2 ) case γ = γ 1 ∪ γ 2 : (∃) (∃) (∃) k ∈ {1, 2}; exec yes (W, w, W , γ k ) case γ = ϕ?: (∀) (∀) (∀) if W = W then reject and mc yes (W, w, ϕ) case γ = γ * : (∃) (∃) (∃) i ∈ {0, ..., 2 log 2 (|W |)+1 }; exec * yes (W, w, W , γ , i)
|AP| + |γ| + log 2 (i) accepts whenever (W, w) γ i (W , w) case i = 0: if W = W then accept else exec yes (W, w, W , γ); case i ≥ 2: (∃) (∃) (∃) W s.th. W ⊆ W ⊆ W (∀) (∀) (∀)
pre R,W (post R,W (W )) ⊆ W (∀) (∀) (∀) (w, v, u) ∈ W × W × W if ((w, v) ∈ R and (u, v) ∈ R implies u ∈ W ) then accept else reject Figure 5.17: Algorithm that checks that ∼ pre π,W (post π,W (W )) ⊆ W .

Conclusion

In this chapter, we have introduced PAPL, a logic extending APAL and GAL. It contains an arbitrary announcement operator that checks for the existence of an announcement. The logic PAPL features announcement protocols, that combine public announcements and arbitrary announcements, and allow to express in particular epistemic planning in this setting. We have shown that the symbolic model checking against PAPL is A pol Exptimecomplete and that the non-symbolic model checking against PAPL is Pspace-complete. We thus observe a jump of complexity when considering symbolic models, which is a usual phenomenon.

disallow the use of non-unary predicates and of function symbols. We first define the syntax of these two logics. Definition 68. We suppose that we have first-order variables x, y, z and second-order variables X, Y, . . . The syntax of MMSO is defined as follows:

ϕ ::= X(x) | ϕ ∧ ϕ | ¬ϕ | ∀xϕ | ∀Xϕ
MFO is the fragment of MMSO where the operator ∀Xϕ is removed.

MMSO-formulas are thus monadic second-order formulas with first-order and secondorder variables but with no occurrence of non-unary predicates. The signature of MMSO mimics the set of atomic propositions AP: to each atomic proposition p ∈ AP, we introduce a corresponding unary predicate symbol P (.). We take the convention that atomic propositions are written in lowercase while the corresponding predicates are written in uppercase.

The semantics of MMSO is defined on models defined as follows. The semantics of MMSO is defined as follows.

Definition 70. Let M be a model with variable assignments. The semantics of MMSO is defined by induction on ϕ as follows. f is injective: if f (e) = f (e ), it means that for all P , e ∈ P M iff e ∈ P M . With M |= ϕ unique , we conclude that e = e .

• M |= X(x) iff M (x) ∈ M (X); • M |= ϕ 1 ∧ ϕ 2 iff M |= ϕ 1 and M |= ϕ 2 ; • M |= ¬ϕ iff M |= ϕ; • M |= ∀xϕ iff for all c ∈ D, M [x ← c] |= ϕ; -M AP |= ϕ
f is surjective: let w be an element of D. As D is non-empty, let e be in D . As M |= ϕ exists , we can, from e, guarantee the existence of an element e of D such that f (e ) = w.

From Theorem 24, we obtain the following.

Corollary 1. Let ϕ be an MMSO-formula. Then M AP |= ϕ if, and only if, T AP ∧ ϕ is MMSO-satisfiable.

From programs to FO-formulas

Definition 75. Let π be a program and x, y be two first-order variables. We define the first-order formula π(x, y) by induction π as follows:

(p ← β)(x, y) = (P (y) ↔ tr(β)(x)) ∧ q∈AP,q =p (Q(x) ↔ Q(y)); β?(x, y) = tr(β)(x) ∧ (x = y); (π 1 ; π 2 )(x, y) = ∃z π 1 (x, z) ∧ π 2 (z, y). (π 1 ∪ π 2 )(x, y) = π 1 (x, y) ∨ π 2 (x, y);
The formula π(x, y) expresses that y is a π-successor of x. It should be noticed that formulas π(x, y) are in MFO, even though they have two parameters x and y. We consider those formulas as macros to shorten the definitions afterwards, so they are monadic. Formally:

Theorem 25. For all worlds w, u and π, w Proof. By induction on π.

• π = p ← β: w p←β --→ u iff (p ∈ u iff w |= β) and for all q = p, (q ∈ w iff q ∈ u). iff M AP [x ← w, y ← u] |= P (y) ↔ tr(β)(x)
and for all q = p,

M AP [x ← w, y ← u] |= Q(x) ↔ Q(y). iff M AP [x ← w, y ← u] |= (p ← β)(x, y).
• π = β?:

w β? -→ u iff w = u and w |= β iff M AP [x ← w, y ← u] |= (x = y) and M AP [x ← w, y ← u] |= tr(β)(x). iff M AP [x ← w, y ← u] |= β?(x, y). • π = π 1 ; π 2 : w π 1 ;π 2 ---→ u iff there exists v such that w π 1 -→ v and v π 2 -→ u iff there exists v such that M AP [x ← w, y ← u, z ← v] |= π 1 (x, z) ∧ π 2 (z, y). iff M AP [x ← w, y ← u] |= (π 1 ; π 2 )(x, y). • π = π 1 ∪ π 2 : w π 1 ∪π 2 ---→ u iff w π 1 -→ u or w π 2 -→ u iff M AP [x ← w, y ← u] |= π 1 (x, y) or M AP [x ← w, y ← u] |= π 2 (x, y) iff M AP [x ← w, y ← u] |= (π 1 ∪ π 2 )(x, y).

From PAPL-formulas to MMSO-formulas

In the following definition, we define tr X (ϕ)(x) to be the translation of the PAPL-formula ϕ, where x is a first-order variable representing the valuation in which the formula ϕ is evaluated and X is a second-order variable representing the context (namely, the set of valuations that survived the previous announcements). Both variables x and X are the sole free variables of tr X (ϕ)(x). We also define tr(γ)(X, Y) for X γ -→ Y, whose sole free variables are X and Y. Definition 76. Let M = AP M , (π a ) a∈Ag be a symbolic model, ϕ be a PAPL-formula, γ an announcement protocol, X and Y be two second-order variables, and x be a first-order variable. We define the MMSO-formulas tr X (ϕ)(x) and tr(γ)(X, Y) by mutual induction over ϕ and γ, with the notation Y ⊆ X for ∀x(Y(x) → X(x)). tr X (p)(x) = P (x);

tr X (¬ϕ)(x) = ¬tr X (ϕ)(x); tr X (ϕ 1 ∨ ϕ 2 )(x) = tr X (ϕ 1 )(x) ∨ tr X (ϕ 2 )(x); tr X (K a ϕ)(x) = ∀y [(X(y) ∧ π a (x, y)) → tr X (ϕ)(y)]; tr X (C G ϕ)(x) = ∃X G (group X (X G , x) ∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧∀y(X G (y) → tr X (ϕ)(y))) with group X (Y, x) = (Y(x) ∧ ∀y(Y(y) → (∀zX(z) ∧ a∈G π a (y, z) → Y(z))) tr X ( γ ϕ)(x) = ∃Ytr(γ)(X, Y) ∧ Y(x) ∧ tr Y (ϕ)(x) tr(ϕ!)(X, Y) = ∀y Y(y) ↔ (X(y) ∧ tr X (ϕ)(y))); tr(•!)(X, Y) = Y ⊆ X; tr(•! G )(X, Y) = Y ⊆ X ∧ a∈G ∀x (∀y π a (x, y) → (∃z π a (z, y) ∧ Y(z))) → Y(x). tr(γ 1 ; γ 2 )(X, Y) = ∃ZZ ⊆ X ∧ Y ⊆ Z ∧ tr(γ 1 )(X, Z) ∧ tr(γ 2 )(Z, Y) tr(γ 1 ∪ γ 2 )(X, Y) = tr(γ 1 )(X, Y) ∨ tr(γ 2 )(X, Y) tr(γ * )(X, Y) = 2 AP M i=0 tr(γ i )(X, Y)
We now explain the formulas and protocols that are not direct.

Formulas:

• Formula tr X (K a ϕ)(x) mimics the standard translation of modal logic into first-order logic ([BRV01], p. 84), except that we use the MFO-formula π a (x, y) instead of R a (x, y).

• Formula tr x (C G ϕ)(X) first computes in a variable X G the set of G-successors of x by the macro group X (X, x). This macro states that all iterated successors of x are present in X G . Second, the quantification on Y avoid having other worlds in X G by saying that X G is the smallest set Y such that group X (Y, x) is true. Finally, the last part of the formula states that tr y (ϕ)(X) must be true for all y ∈ X G .

• Formula tr x ( γ ϕ)(X) first existentially finds a context Y such that tr(γ)(X, Y) is true, checks that x is in Y (by Y(x) and goes on with tr Y (ϕ)(x).

Protocols:

• Formula tr(ϕ!)(X, Y) asks that Y corresponds to the set of valuations in which ϕ holds (∀y Y(y) ↔ (X(y) ∧ tr X (ψ)(y)))

• Formula tr(•!)(X, Y) imposes that the announcement is a group announcement, which is the same characterization than Proposition 16 page 144.

We now state and prove the correctness of the translation.

Theorem 26. Let M be a symbolic model on AP, ϕ be an PAPL-formula on AP, γ a protocol, and

w ∈ M. Let D M be the set of valuations of M. Let D, D ⊆ D M . Then M, w |= ϕ iff M AP [x ← w, X ← D M ] |= tr X (ϕ)(x), and D γ - → D iff M AP [X ← D, Y ← D ]tr(γ)(X, Y).
Proof. By mutual induction on ϕ and γ.

• ϕ = p: M, w |= ϕ iff p ∈ w iff M AP [x ← w, X ← D M ] |= P (x) • ϕ = ¬ψ: M, w |= ¬ψ iff M, w |= ψ iff M AP [x ← w, X ← D M ] |= tr X (ϕ)(x) iff M AP [x ← w, X ← D M ] |= ¬tr X (ϕ)(x) • ϕ = ϕ 1 ∨ ϕ 2 : M, w |= ϕ 1 ∨ ϕ 2 iff M, w |= ϕ 1 or M, w |= ϕ 2 iff M AP [x ← w, X ← D M ] |= tr X (ϕ 1 )(x) or M AP [x ← w, X ← D M ] |= tr X (ϕ 2 )(x) iff M AP [x ← w, X ← D M ] |= tr X (ϕ 1 )(x) ∨ tr X (ϕ 2 )(x) • ϕ = K a ϕ: M, w |= (K a ψ) iff for all u ∈ D M such that w πa -→ u, M, u |= ψ iff for all u ∈ D M such that w πa -→ u, M AP [y ← u, X ← D M ] |= tr X (ψ)(y) iff for all u ∈ D M such that M AP [x ← w, y ← u, X ← D M ] |= π a (x, y), M AP [y ← u, X ← D M ] |= tr X (ψ)(y) iff M AP [x ← w, X ← D M ] |= ∀y (X(y) ∧ π a (x, y) → tr X (ϕ)(y))
• ϕ = C G ψ: for this case we first need to prove that w

( a∈G πa) * -------→ u if and only if M AP [x ← w, y ← u, X ← D M ] |= ∃X G (group X (X G , x) ∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧ X G (y)): -If w ( a∈G πa) * -------→ u then let D = {v ∈ D M | w ( a∈G πa) * -------→ v}. Obviously we have w, u ∈ D . We now prove that M AP [x ← w, y ← u, X ← D M , X G ← D ] |= (group X (X G , x) ∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧ X G (y))
: by definition of group, we obtain directly that group X (X G , x) is true and if we take another Y such that group X (Y, x) is true, its interpretation will necessarily contain D . -------→ v}, which concludes the proof.

-If M AP [x ← w, y ← u, X ← D M ] |= ∃X G (group X (X G , x) ∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧ X G ( y
M, w |= (C G ψ) iff for all u ∈ D M such that w ( a∈G πa) * -------→ u, M, u |= ψ iff for all u ∈ D M such that M AP [x ← w, y ← u, X ← D M ] |= ∃X G (group X (X G , x) ∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧ X G (y)), M AP [y ← u, X ← D M ] |= tr X (ψ)(y) iff M AP [x ← w, X ← D M ] |= ∃X G (group X (X G , x)∧ ∀Y (group X (Y, x) → X G ⊆ Y) ∧ ∀y(X G (y) → tr X (ϕ)(y))) • ϕ = γ ψ: M, w |= ( γ ψ) iff there exists D such that D ⊆ D M , w ∈ D and M , w |= ψ (where M is M restricted to D ). iff there exists D such that M AP [X ← D M , Y ← D , x ← w] |= tr(γ)(X, Y) ∧ Y(x) ∧ tr x (ψ)(Y) iff M AP [X ← D M , x ← w] |= ∃Y tr(γ)(X, Y) ∧ Y(x) ∧ tr x (ψ)(Y) • γ = χ!: D χ! -→ D iff for all u, u ∈ D iff u ∈ D and M, u |= χ. iff for all u, M AP [y ← u, Y ← D ] |= Y(y) iff M AP [y ← u, X ← D] |= X(y) and M AP [y ← u, X ← D] |= tr X (χ)(y) iff M AP [x ← w, X ← D, Y ← D ] |= ∀y Y(y) ↔ (X(y) ∧ tr X (ψ)(y))
• γ = •! and γ = •! G : both cases use characterizations established in the previous chapter.

•

γ = γ 1 ; γ 2 : D γ 1 ;γ 2 ---→ D iff there exists D such that D ⊆ D ⊆ D and D γ 1 -→ D and D γ 2 -→ D . iff there exists D such that M AP [X ← D, Z ← D ] |= Z ⊆ X ∧ tr(γ 1 )(X, Z) and M AP [Z ← D , Y ← D ] |= Y ⊆ Z ∧ tr(γ 2 )(Z, Y). iff M AP [X ← D, Y ← D ] |= ∃Z Z ⊆ X ∧ Y ⊆ Z ∧ tr(γ 1 )(X, Z) ∧ tr(γ 2 )(Z, Y). • γ = γ 1 ∪ γ 2 : D γ 1 ∪γ 2 ---→ D iff D γ 1 -→ D or D γ 2 -→ D iff M AP [X ← D, Y ← D ] |= tr(γ 1 )(X, Y) or M AP [X ← D, Y ← D ] |= tr(γ 2 )(X, Y). iff M AP [X ← D, Y ← D ] |= tr(γ 1 )(X, Y) ∨ tr(γ 2 )(X, Y) • γ = γ * : D γ * -→ D iff there exists i ∈ {0, 2 AP M } such that D γ i -→ D iff there exists i ∈ {0, 2 AP M } such that M AP [X ← D, Y ← D ] |= tr(γ i )(X, Y) iff M AP [X ← D, Y ← D ] |= 2 AP M i=0 tr(γ i )(X, Y)

Reduction from PAPL-mc to MMSO-sat

Definition 77 (reduction). Given a pointed symbolic Kripke model (M, w) and an PAPLformula ϕ, we let ≤ P (M, w, ϕ) be the MMSO formula T AP ∧tr(w)(x)∧∀yX(y)∧tr X (ϕ)(x).

Notice that unfortunately, the formula for γ * causes an exponential blowup. We could fix this blowup by creating the set of y that we can construct from X with γ * , but we suspect that it is not possible. Furthermore, the non-deterministic choice in protocol also causes an exponential blowup.

If we want to obtain a polynomial reduction, we thus need to consider PAPL without non-deterministic choice or Kleene star in protocols.

By Corollary 1 and Theorem 26 we get the following.

Theorem 27. M, w, |= ϕ iff ≤ P (M, w, ϕ) is MMSO-satisfiable.
Because the symbolic model checking of APAL is A pol Exptime-hard [START_REF] Charrier | Arbitrary Public Announcement Logic with Mental Programs[END_REF], and PAPL without non-deterministic choice nor star contain APAL, we obtain: Corollary 2. MMSO-satisfiability problem is A pol Exptime-hard.

However, as discussed in the next section, restricting to logic ∃PAPL yields a reduction to the satisfiability problem of monadic first-order logic MFO.

Existential announcement logic into monadic firstorder logic

We first define ∃PAPL.

Definition 78. The syntax of ∃PAPL is defined as follows.

ϕ ::= p | ¬p | ϕ ∧ ϕ | ϕ ∨ ϕ | Ka ϕ | ĈG ϕ | γ ϕ | ψ γ ::= ϕ! | •! | •! G | γ; γ | γ ∪ γ | γ * with ψ ∈ L ELCK .
Notice that here, for the reduction to work, we need to remove the second order quantification in the C G case in the following way.

tr X (C G ϕ)(x) = 2 AP M i=0 ∀y a∈G π a i (x, y) → tr x (ϕ)(y)
It causes an exponential blowup but it is now a first-order formula. If we restrict inputs M, w, ϕ of the PAPL-model checking by letting ϕ ∈ ∃PAPL, then ≤ P (M, w, ϕ) is an MMSO-formula where all second-order quantifiers are existential and are not under the scope of universal quantifiers. Such second-order quantifiers can be removed from the formula ≤ P (M, w, ϕ) resulting in a MFO-formula.

In the next section, we make use of this reduction to solve the symbolic model checking problem against ∃PAPL.

Implementation

We implemented the reduction from ∃PAPL to MFO in OCaml. We also built benchmarks. The code and a readme file can be found at the following link https://github.com/tcharrie/agpal-mmso

Description of the implementation

The input is an ∃PAPL formula of the type agpal_formula in the source code. The type acc_program represents accessibility programs, the type bool_formula boolean formulas, and the type fo_formula MFO-formulas (the output of the code). The function agpal_formula_to_mfo defines the translation from ∃PAPL formulas to MFO formulas (as in Definition 77).

In addition to the algorithm for the reduction, we implemented a function from existential formulas to the TPTP format [START_REF] Sutcliffe | The TPTP Problem Library[END_REF] used by the FO-SAT-solvers, called agpal_formula_to_tptp. It first calls the function agpal_formula_to_mfo, then calls the function mfo_formula_to_tptp that transforms a MFO-formula into its TPTP representation.

Benchmarks

We provide benchmarks for FO-provers built from the muddy children and the Russian card puzzles in order to tests the combinatorial ability of FO-provers.

Muddy children. We consider the following true properties:

• ϕ muddy standard = a∈Ag p a ! a∈Ag ¬(K a p a ∧¬K a ¬p a )! . . . a∈Ag ¬(K a p a ∧¬K a ¬p a )! a∈Ag (K a p a ∨ K a ¬p a )
: standard formalization of the muddy children.

• ϕ muddy arbitrary = a∈Ag p a ! •! a∈Ag (K a p a ∨ K a ¬p a ): variant with an arbitrary announcement.

• ϕ muddy group = a∈Ag p a ! •! Ag a∈Ag (K a p a ∨ K a ¬p a ): variant with a group announcement.

where Ag = {1, . . . , n}.

Russian cards. For this example, agents a and b holds the same number of cards n.

For instance, the classical Russian cards problem corresponds to n

= 3. Let ϕ Russian goal = 2n+1 i=1 (K a p i,b ∨ K a ¬p i,b ) ∧ (K b p i,a ∨ K b ¬p i,a ) ∧ ¬K c p i,a ∧ ¬K c ¬p i,a ∧ ¬K c p i,b ∧ ¬K c ¬p i,

Experiments

To perform the tests, we used the FO-solver Iprover [START_REF] Korovin | iProver -An Instantiation-Based Theorem Prover for First-Order Logic (System Description)[END_REF] on a HP EliteBook 840 G2.

The prover Iprover enabled us to test whether a FO-formula is satisfiable or not. The results are summarized in Figure 6.4.3.

We now briefly comment on the experiments.

Muddy children.

For ϕ muddy arbitrary , the FO-SAT solver seems to perform well in all cases, as arbitrary announcements only require the new context to be included in the previous one. Hence, in this example, it is sufficient to restrict the model to the current world in order to satisfy the goal of ϕ muddy arbitrary . However, for the other tests, namely ϕ muddy standard and ϕ muddy group , the FO-SAT-solver is able to test up to n = 6 agents. This can be explained by the fact public announcements and group announcements add significant combinatorial constraints to the specification.

Russian cards. For the three properties, the tests cannot exceed n = 6 cards, the main reason being that the rules of the game are very combinatorial, as for the muddy children.

Notice that the problems we have considered are puzzles, thus highly combinatorial. For the muddy children puzzle, the existential second-order quantification ranges over 2 2 n subsets. For n = 7, we have 2 2 7 = 2 128 ∼ 10 38 , that is, about the number of positions 1.15868.. × 10 42 of a chess board.

Still, our implementation is promising and provides some interesting benchmarks for FO-provers.

Conclusion

In this chapter, we have expressed the model checking against PAPL as a model checking problem against MMSO, the monadic second-order logic where all predicates are monadic. Unfortunately, the reduction is exponential because of the star operator, but is polynomial if we remove this operator. We have also shown that the existential fragment of PAPL, ∃PAPL, can be expressed in the satisfiability problem of MFO, monadic firstorder logic, and implemented the model checking problem against existential PAPL using a first-order solver.

Perspectives

In this manuscript, we have introduced epistemic logic, studied dynamic operators, and defined symbolic Kripke and event models. We now discuss missing features of DEL and possible perspectives.

In the introduction, we recalled a variety of applications of multi-agent systems, as robots, security, and games. We explained that high-order knowledge was an important notion to consider and claimed that DEL was suited for all these applications. In multirobot systems, it makes perfect sense that the robots have to be able to reason about the other robots' reasoning to enable meaningful collaboration. Actually, DEL is especially adapted when robots interact with other robots that are perfectly rational. Unfortunately, the logic DEL reaches its limits when human agents are considered, because they are not perfectly rational [De +06]. However, in the case when the humans do not reason about the knowledge of robots but the robots do reason about the knowledge of humans, DEL may be suited in the following sense: a robot would have an algorithm to reason about an idealized rational version of the human, and the human would only have to deal with his own knowledge. A potential application would be in cases where the robot must adapt to the human, but not the other way around. If we need humans to collaborate with robots, a solution would be to define AIs that consider all agents to be rational at first, and then lower their expectations if some agent does not act rationally. Introducing levels of rationality for agents in DEL would be a workaround. Technically, it means that if a world in the model is too hard to consider for an agent, he may consider as possible a false world instead. We could express levels of rationality by bounding modal depth for certain agents or considering limited belief (as in [START_REF] Liu | A Logic of Limited Belief for Reasoning with Disjunctive Information[END_REF]).

In Chapters 2 and 3 we showed that the existence of a uniform strategy can be reduced to the model checking against DEL. This result opens up the use of DEL for AIs in games. Yet, for now, few applications currently exist for DEL. One reason is that it is too technical for a non-expert to design the event models. In the near future, we need to have a clear understanding of which event models are relevant in practice, and define a higher-level language to specify them. The third version of Game Description Language (GDL-III) is a promising specification language for DEL, given that they are both equivalent [START_REF] Engesser | Game Description Language and Dynamic Epistemic Logic Compared[END_REF]. GDL-III is well suited for expressing games, but it is not clear yet it if is for expressing properties in multi-agent systems in general. Furthermore we strongly need to develop the implementations of DEL to make it widely convincing. The symbolic model checking for DEL (SMCDEL [START_REF] Van Benthem | Symbolic Model Checking for Dynamic Epistemic Logic[END_REF]) is a possibility, but we need to make it more accessible to non-experts. Hintikka's world [START_REF] Schwarzentruber | Hintikka's World: Agents with Higher-order Knowledge[END_REF] has been developed to help people understand DEL, which is a good start to show researchers and engineers outside of our community how DEL works.

Also, in some applicative scenarios, for instance involving intelligent domestic robots, the system never stops or if it does, it is unknown when the systems stops. This is modeled classically in temporal logic by considering infinite executions of a finite transition system. Because of results about epistemic planning (see Theorem 16), we know that, in DEL, if event models feature knowledge modalities, verifying properties yield an undecidable problem. Nevertheless, we know that it is decidable to reason about infinite executions generated by propositional event models [START_REF] Douéneau-Tabot | Chain-Monadic Second Order Logic over Regular Automatic Trees and Epistemic Planningn Synthesis[END_REF]. In the future, the epistemic planning community will continue working on exhibiting restrictions of DEL (e.g. separable event models) for which this reasoning is decidable.

Finally in real applications, the notion of intentions is crucial. For instance in humanrobot interactions, if the humans says "the keys are on the table", he may also implicitly mean that he wants the robot to take the keys. In the security example, if an attacker takes a key, the information is not only that he obtained these keys but also that he may unlock some door with these keys. In the game Hanabi, when a player gives an information, e.g. "this card has number 2", he does not only mean that the card has number 2 but also that the other player should play this card. If we want to design realistic AIs for this kind of games, we need to include intentions in DEL. Games are suited to study intentions because they are fairly simple and have the same mechanisms for knowledge than real-life examples in robotics and security. That is why, although games seem somehow pointless to study, they remain very interesting because they are a stepping stone to study more intricated problems. A Turing machine is an automaton where a word is written on an input tape. The input tape contains only letters of an alphabet Σ called the input alphabet. The Turing machine then works with a larger alphabet, called the tape alphabet Γ. Anytime on the tape, a unique cell is pointed by a cursor, initially it is the first cell. In each state, when transition (q 1 , a, q 2 , b, +1) is fired, we go from state q 1 to state q 2 by reading the letter a, write the letter a and then move the cursor to the next cell (+1). If the transition contains -1 instead of +1, we go back to the previous cell. Let us give an example.

Index

Example 33. We consider the Turing machine of Figure A.1. The accepting state is in green, the rejecting state in red, the initial state is marked by an incoming edge. Here we consider Σ = Γ = {a, b}. On the tape, initially the word aaaaaaab is written. Here several executions are possible. For instance q 0 → q 1 → q rej is possible by reading two times a. The execution q 0 → q 1 → q 1 → q rej is also possible. Unfortunately, both executions are rejecting, whereas the execution q 0 → q 1 → q 1 → q 1 → q 1 → q 1 → q 1 → q acc is accepting. In this case, because such an execution exists, we say that the Turing machine accepts the input.

Here, the language accepted by this Turing machine is a + b (read at least one a and then end on some b).

We do not define formally the notion of execution here. It is just the data of a sequence of states visited with the state of the tape given in each step. The set of words such that there exist an execution reaching q acc is called the language of M , noted L(M ).

In general, the following decision problem is undecidable:

• Input: a Turing machine M , a word ω.

• Output: yes if ω ∈ L(M ), no otherwise.

It means that it is not possible to find a Turing machine M 0 taking in input any Turing machine M and any word ω and accepting the input if and only if ω ∈ L(M ).

However, Turing machines are used to define complexity classes of algorithms. Indeed, when we restrict the set of possible Turing machines in respect of the length of the execution/the memory needed, we obtain classes of problems that we call complexity classes. In the following definition, we refer to deterministic and non-deterministic Turing machines. Deterministic Turing machines are such that at most one transition is possible in each state for each letter a ∈ Σ. Non-deterministic Turing machines do not have this restriction.

Example 34. The Turing machine of Figure A.1 is non-deterministic because in q 1 , there are two transitions with letter a: one leading to q 1 and one leading to q rej . We now define complexity classes.

Definition 81 (Complexity classes).

Deterministic time The classes P, Exptime, 2-Exptime, are the classes of deterministic Turing machines whose executions always end in O(P (n)) time, O(2 P (n) ) time, O(2 2 P (n) ) time, etc., where P is a polynomial and n is the size of the input word.

Deterministic space The classes Pspace, Expspace, 2-Expspace, are the classes of deterministic Turing machines whose executions need only O(P (n)), O(2 P (n) ), O(2 2 P (n) ) new cells (the memory) to work. Such classes are not defined with the length of the execution but with the memory needed.

Non-deterministic time and space

The non-deterministic counterparts of these complexity classes are called NPtime (also called NP), NExptime, NPspace, etc.

It is known that P ⊆ NP ⊆ Pspace ⊆ NPspace ⊆ Exptime ⊆ NExptime . . . Interestingly, it is also known that Xspace = NXspace for X ∈ { P, Exp, 2Exp, . . .} (by Savitch's theorem [START_REF] Walter | Relationships Between Nondeterministic and Deterministic Tape Complexities[END_REF]). However, it is not known whether Xtime = NXtime or Xtime = NXtime.

We conclude the classical complexity classes by defining the notion of membership, hardness and completeness of a decision problem in a complexity class: Definition 82 (Membership, Hardness, Completeness). Let P we a decision problem and C a complexity class (Pspace, NExptime . . . ).

We say that P is a member of C if there exist a Turing machine M of C deciding P .

We say that P is hard for C if for all Turing machines of M , there exists a function f running in polynomial time taking in parameter an input M , returning an input of P , and such that M accepts ω if and only if f (ω) is a positive instance of P . P is complete for C if it is a member of C and it is hard for C.

Instead of writing Turing machines to prove the membership of problems, we will write algorithms in pseudo-code. Interestingly, the correspondence between algorithms and Turing machines is direct: an algorithm running in polynomial time/space induces a Turing machine running in polynomial time/space. We now define a different class of Turing machines that will prove very handy to establish the complexity of decision problems later on.

A.2 Alternating Turing machines

Alternating Turing machines [START_REF] Ashok | Alternation[END_REF] are an extension of Turing machines where states now have a type: ∃ or ∀. In an execution, a state labeled with ∃ must have at least one transition which makes the execution succeed. For ∀ states, every compatible transition must make the execution succeed. If all states are ∃, we go back to non-deterministic machines.

Definition 83 (Alternating Turing machine).

An alternating Turing machine is a tuple M = (Q, Σ, Γ, δ, q 0 , q acc , q rej , g) where:

• Q is the finite set of states of M ;

• Σ is the finite input alphabet;

• Γ is the finite tape alphabet with Σ ⊆ Γ;

• δ ⊆ Q × Γ × Q × Γ × {-1, +1}
is the transition function;

• q 0 ∈ Q is the initial state, q acc ∈ Q the accepting state and q rej ∈ Q is the rejecting state;

• g : Q → {∃, ∀} is the quantification function for the states. The word aaaaaaab is now not accepted by the Turing machine. Indeed, when in q 1 , firing the q 1 → q 1 transition and the q 1 → q rej must lead to a successful execution. Yet, the transition to q rej is obviously not successful.

In fact, here, the only word recognized is ab.

Alternating Turing machines create new complexity classes, defined as follows.

Definition 84 (Alternating complexity classes).

Alternating time The classes Aptime, Aexptime, A2Exptime, are the classes of alternating Turing machines whose executions always end in O(P (n)) time, O(2 P (n) ) time, O(2 P (n) ) time, etc., where P is a polynomial and n is the size of the input word.

Alternating space

The classes Apspace, Aexpspace, A2Expspace, are the classes of alternating Turing machines whose executions need only O(P (n)), O(2 P (n) ), O(2

P (n) )
new cells (the memory) to work.

We also define the class A pol Exptime which is the class of alternating Turing machine running in exponential time but there is only a polynomial number of alternation of ∃ and ∀ in any execution.

The main advantage of alternating classes is that they are directly correlated with deterministic class. We have AXtime = Xspace and AXspace = XExptime for every X ∈ { P, Exp, 2Exp, . . .}. For instance, Apspace = Exptime, A2Exptime = 2Expspace. When we wish to analyze the membership of problems, we then choose to establish the complexity with an alternating class of complexity instead of its deterministic class. For that, we write alternating algorithms that we now define.

A.3 Algorithms for alternating complexity classes

Alternating algorithms are standard algorithms augmented with two types of non-deterministic choices: existential (∃) (∃) (∃) choices and universal (∀) (∀) (∀) choices. From an existential choice, the algorithm accepts if there exists a choice that makes the continuation of algorithm accept. From a universal choice, any choice should make the continuation of the algorithm accept. For example, when we write the instruction "(∃) (∃) (∃) w ∈ W ", the algorithm nondeterministically chooses w in W and continues its execution with this chosen world w. As it is an existential choice, the instruction "(∃) (∃) (∃) w ∈ W " succeeds if there is a way to choose w, so that the algorithm accepts. Dually, the instruction "(∀) (∀) (∀) w ∈ W " succeeds whenever any choice of w makes the algorithm accept.

In the following existential and universal choices between several algorithms will be written as follows.

(∃) (∃) (∃) algo 1 or algo 2 (∀) (∀) (∀) algo 1 and algo 2 "(∀) (∀) (∀) algo 1 and algo 2 " means that both algo 1 and algo 2 must accept, "(∃) (∃) (∃) algo 1 or algo 2 " means that either algo 1 or algo 2 must accept.

Instruction I Running time T (I) (Q) (Q) (Q) i ∈ {0, 1} 1 (Q) (Q) (Q) i ∈ {1, ..., n} log 2 (n) (Q) (Q) (Q) u ∈ W log 2 (|W |) Choose W ⊆ W
|W | (∃) (∃) (∃) algo 1 or algo 2 1 + max(T (algo 1 ), T (algo 2 )) (∀) (∀) (∀) algo 1 and algo 2 1 + max(T (algo 1 ), T (algo 2 )) Sub-algorithm proc 1 + T (proc) Execution time of alternating algorithms. The execution time of an alternating algorithm corresponds to the depth of its computation tree. Table A.1 describes the execution time of some instructions up to a constant factor (we write (Q) (Q) (Q) for either (∃) (∃) (∃) or The player only has one possible action, a, that leads either into l 1 or l 2 . The other player that chooses whether the next state is l 1 or l 2 . Both states l 1 and l 2 are indistinguishable for the player, so he does not know which one is the current state. Then in state l 2 , if the player plays b, he wins, otherwise he loses. In state l 1 , whatever the player plays, he wins. Formally the game is defined as follows:

• L = {l I , l 1 , l 2 , l 3 , l 4 , l 5 };

• L G = {l 3 , l 4 };

• Σ = {a, b};

• δ = {(l I , a, l 1 ), (l I , a, l 2 ), (l 1 , a, l 3 ), (l 1 , b, l 3 ), (l 2 , b, l 4 ), (l 2 , a, l 5 )};

• O = {{l I }, {l 1 , l 2 }, {l 3 }, {l 4 }, {l 5 }}.

We now define the notion of history and run in a game.

Definition 86. History and run A history is a sequence of states l I = l 0 , l 1 , . . . , l n such that for all 0 ≤ i ≤ n -1, there exists a ∈ Σ such that (l i , a, l i+1 ) ∈ δ.

A run is a history such that l n is an end state. It is winning if l n ∈ L G , losing otherwise.

There exist games where infinite runs are possible (like Go for instance). For the manuscript we forbid infinite runs since the games we model only have finite runs.

207

B.2 Uniform strategies

We now define the notion of uniform strategies. We begin by considering the previous example.

Example 37. In the game of Figure B.1, the player must first play a in l I . Then, he has to choose an action but does not know whether he is in state l 1 or state l 2 . If he chooses to play a, he wins if the current state is l 1 but loses if the current state is l 2 . Here, in a strategy, we cannot allow the player to play differently depending on the state because he does not know which state is the current one. Therefore to have a winning strategy, playing a is forbidden. Yet, playing b is allowed here because for any of the states l 1 or l 2 , playing b leads to a winning state.

The definition of a uniform strategies is thus the following. Definition 87. Uniform strategy A strategy is a function σ : L + → Σ that assigns an action to a history (l I , . . . , l n ) of visited states.

The strategy σ is said uniform if for all histories (l I , l 1 , . . . , l n ) and (l I , l 1 , . . . , l n ) such that (l i , l i ) ∈ O for all i, σ(l I , . . . , l n ) = (l I , . . . , l n ).

A uniform strategy is said winning if whatever the other player does, by following the strategy the games always end in a winning state. Definition 88. Let σ be a uniform strategy. It is said winning if all runs l I = l 0 , l 1 , . . . , l n such that (l i , σ(l 0 , . . . , l i ), l i+1 ) ∈ δ for all 0 ≤ i ≤ n -1 are winning. (U u , u ) γ 1 ;γ 2 (W, u ) iff there exists W 0 such that (U u , u ) γ 1 (W 0 , u ) γ 2 (W, u ) iff there exists T 0 such that (U, u) γ 1 (T 0 , u) and (T 0 u , u ) γ 2 (W, u ) (by H(γ 1 )). iff there exists T 0 , T such that (U, u) γ 1 (T 0 , u) γ 2 (T, u) and W = T u (by H(γ 2 )). iff there exists T such that (U, u) γ 1 ;γ 2 (T, u) and W = T u .

• γ = γ * : (U u , u ) γ * (W, u ) iff there exists k ≥ 0 such that (U u , u ) γ k (W, u ) iff there exists T such that (U, u) γ k (T, u) and W = T u (by repeating case γ = γ 1 ; γ 2 ). iff there exists T such that (U, u) γ * (T, u) and W = T u .

• γ = •!: this case amounts to γ = •! {f } with f an omniscient agent, meaning that π f = ?. We apply the case γ = •! G to conclude.

• γ = •! G :

-Let T be such that (U, u) •! G (T, u) and T u = W then there exists formulas (ψ a ) a∈Ag such that (U, u) a∈G Kaψa! (T, u). We cannot apply the induction hypothesis here because it may not be true that AP(ψ a ) ⊆ AP . For any agent a ∈ G, let χ a = v∈post πa,U u (T u ) p∈v∩AP p ∧ p∈(AP\v)∩AP ¬p . Intuitively, χ a describes exactly the π a -successors of T u that are in U u . Notice that here all successors of elements in T u are in U u , so χ a actually describes the successors of T u by π a . Let W 0 be such that (U u , u) a∈G Kaχa! (W 0 , u). Let us show that W 0 = T u : * If v 0 ∈ T u then each π a successor of v 0 is in post πa,U u (T u ) so U u , v 0 |= K a χ a . So

v 0 ∈ W 0 . * If v 0 ∈ W 0 , let v ∈ U defined by v = v 0 ∪ (u \ u ).
For any w such that v πa -→ w, we have v 0 πa -→ w so w ∈ post πa,U u (T u ). Then there exists v 1 ∈ T such that v 1 πa -→ w , so v 1 πa -→ w. Furthermore, because v 1 ∈ T , we have U, v 1 |= K a ψ a , so U, w |= ψ a . We then obtain that W, v |= K a ψ a for every agent a ∈ G, so v ∈ T . then (U u , u) •! G (T u , u) and then (U u , u) •! G (W, u) .

-If (U u , u) •! G (W, u) then there exist formulas (ψ a ) a∈G such that (U u , u) a∈G Kaψa (W, u). For any agent a ∈ G, we take the same χ a than before. Let W 0 be such that (U u , u) a∈G Kaχa! (W 0 , u). Let us show that W 0 = T u : Title: Theoretical complexity of reasoning in dynamic epistemic logic and study of a symbolic approach.

Keywords : multi-agent system, model checking, epistemic logic, computational complexity, symbolic model, epistemic planning.

Abstract :

We study the theoretical complexity of reasoning tasks involving knowledge in multi-agent systems. We consider dynamic epistemic logic (DEL) as a natural way of expressing knowledge, which allows to express nested knowledge of agents and partially observed dynamic actions. We

show complexity results for model checking and satisfiability of DEL formulas, and define a symbolic approach for these problems. We also study DEL-based planning and quantification over specific actions: public announcements.

Definition 2 .Figure 1

 21 Figure 1.1: A simple Kripke model.

Figure 1

 1 Figure 1.2: The Kripke model for the muddy children puzzle for two children a, b.

Figure 1 . 3 :

 13 Figure 1.3: Example of an event model

  pre :a∈Ag m a post : / Ag pre :a∈Ag ¬(K a m a ∨ K a ¬m a )

Figure 1 . 4 :

 14 Figure 1.4: Event models in the muddy children puzzle

Figure 1

 1 Figure 1.5: Example of the product of the Kripke model of Figure 1.1 page 37 and the event model of the Figure 1.3 page 41.

Definition 7 .

 7 Let M = (W, (R a ) a∈Ag , V ) be a Kripke model. Let E = (E, (R E a ) a∈Ag , pre, post) be an event model. The product of M and E is M ⊗ E = (W , (R a ) , V ) where: • W = {(w, e) ∈ W × E | M, w |= pre(e)}; • ((w, e), (w , e )) ∈ R a iff (w, w ) ∈ R a and (e, e ) ∈ R E a ; • V ((w, e)) = {p ∈ AP | M, w |= post(e, p)}. Example 8. Figure 1.5 shows the product operation of the Kripke model of Figure 1.1 and the event model of the Figure 1.3.

  After the father says that at least one child is muddy.{m a , m b } a, bAfter the father asks the question.

Figure 1 . 6 :

 16 Figure 1.6: Kripke models in the execution of muddy children puzzle with 2 agents a, b.

Figure 1 . 7 :

 17 Figure 1.7: Example of an event model (E , E 0 ) for the C max(i,j) 0 construction.

Figure 1 .

 1 Figure 1.9 gives an example.

  e : pre : p post : p ← K a p f : pre : post : q ← ¬K b q b a a, b c e,p : pre : K a p post : p e ← c e,p ⊥ : pre : ¬K a p post : p e ← ⊥

Figure 1 .

 1 Figure 1.10 gives an example of a (E 1 , E 1 0 ) event model and of a (E , E 0 ) event model.

  E and w -→ e = w -→ e ::e: mc yes (M -→ E , w -→ e , post(e, p))

Figure 2 . 1 :

 21 Figure 2.1: Model checking procedures for DELCK (in gray: quantities associated to each procedure call).

Figure 2

 2 Figure 2.4: Algorithm for the satisfiability problem of a DELCK-formula ϕ.

Figure 2

 2 Figure 2.5: (Expected) Kripke model that represents the computation tree of M on the input instance ω.

  Played token from Player • Played token from Player × • × Attempted move from Player • Attempted move from Player × •

Figure 2 . 7 :

 27 Figure 2.7: Example of a play of blind tic tac toe .

Figure 2 . 8 :

 28 Figure 2.8: Example of coordinates for blind tic tac toe

×

  is defined similarly by replacing • by ×.Notice that formula ϕ win• has quadratic size compared to n.

Figure 2

 2 Figure 2.9: The initial Kripke model for blind tic tac toe.

Example 14 (

 14 Programs for muddy children). Since child a sees the forehead of b but not her own, the program for a amounts to modifying the truth value of m a . That is, π a = set(m a ), and symmetrically π b = set(m b ).

Definition 42 (

 42 Symbolic Kripke models). A symbolic Kripke model is a tuple M = AP M , β M , (π a ) a∈Ag where: • AP M is a finite set of atomic propositions; • β M is a Boolean formula over AP M ; • and π a is a program over AP M for each agent a. A symbolic model naturally denote a Kripke model as follows. Definition 43 (Semantics of symbolic Kripke models). Given a symbolic Kripke model M = AP M , β M , (π a ) a∈Ag the Kripke model represented by M, written M M is the model (W, { a -→} a∈Ag , V ) where:

} ∅ π a π a π b π b π a , π b π a , π b π a , π b π a , π bFigure 3

 3 Figure 3.1: π a = set(p a ), π b = set(p b ), and π f = ?

  Figure 3.1 shows M M for two children a and b. Example 19 (A Kripke model with multi-valuations). We consider the Kripke model M of Figure 3.2a with AP = {p}, in which valuations {p} and ∅ appear twice. In this figure, Agent b believes that Agent a believes that p is true (i.e. K b K a p holds with K interpreted as a belief operator). For succinctly representing M, we introduce a new atomic proposition p bel that marks possible worlds for b. We now have AP = {p, p bel } and obtain the Kripke model in Figure 3.2b, with the following programs: π a = (¬p bel ?) ∪ (p bel ?; (p← )): Agent a believes p in the p bel -worlds, and is omniscient in the ¬p bel -worlds. π b = (p bel ← ): Agent b knows the value of p but believes that p bel is true. Notice that in the symbolic Kripke model for muddy children, each program π a has linear size compared to |Ag|, |AP M | = |AP| and |β M | = 1. Therefore, the size of the

Proposition 9 .

 9 Ê(E E ) and E are equivalent. Proof. Let E = (E, (R E a ) a∈Ag , pre, post) and Ê(E E ) = (E , (R E a ) a∈Ag , pre , post ). We prove that for any Kripke model M = (W, (R M a ) a∈Ag , V ), M ⊗ E and M ⊗ Ê(E E ) are APbisimilar. Let B is the set of tuples ((w, e), (w, e )) with w ∈ W , e ∈ E and e = {p e }. Such a bisimulation is well defined because M, w |= pre(e) if and only if M, w |= pre| {pe} , because pre| {pe} = pre(e). We prove that B is a bisimulation: • AP-conservation: for all p ∈ AP, we have M, w |= post(p) if and only if M, w |= post(p)| {pe} so p ∈ V M⊗E ((w, e)) if and only if p ∈ V Ê(E E ) ((w, e)). The AP-conservation is thus proven. • Zig and Zag: we have (w, e) a -→ (u, f ) if and only if w and only if {p e } π a,E --→ {p f } therefore (w, e) a -→ (u, f ) if and only if (w, e ) a -→ (u, f ). The Zig and Zag properties are directly deduced from this fact.

Figure 3 . 3 :

 33 Figure3.3: The event model A p corresponding to an attention-based announcement p for two agents a 1 and a 2 . The model consists of nine events. The six edges pointing to the dashed box point to all four events in the box.

Figure 3 . 4 :

 34 Figure 3.4: Model checking procedures for DELCK (in gray: quantities associated to each procedure call).

Figure 3 . 7 :

 37 Figure 3.7: Example of a set of cards for V = {1, . . . , 13} (here J = 11, Q = 12, K = 13) and C = {♠, ♣, ♥, ♦}.

Figure 3

 3 Figure 3.10: Two indistinguishable worlds for Agent a

  e ϕ : pre : ϕ post : / e ¬ϕ : pre : ¬ϕ post : / Ag \ G

Figure 4 . 1 :

 41 Figure 4.1: Algorithm mc for model checking L it C -1 0

  [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF].Definition 55. A two-counter machine M is a sequence of instructions (I 0 , . . . , I N ) where • For < N , I is either inc(i), goto( ) or gotocond(i, ), with i ∈ {1, 2}, ≤ N and = ;•I N = halt.We call program line a pair k:I k .Example 23. The following four programs lines define a two-counter machine M ex : 0:inc(1) 1:gotocond(1, 3) 2:goto(0) 3:halt A configuration of a two-counter machine M is a triple ( , c 1 , c 2 ) where ∈ {0, . . . , N } is the program counter and c 1 , c 2 ∈ N are the two data counters. Let C M = {0, . . . , N } × N × N be the set of all possible configurations.

Figure 4 . 3 :

 43 Figure 4.3: Pointed epistemic model representing the initial configuration (0, 0, 0).

  Figure 4.3. We call configuration model a pointed epistemic model of the form (M, w) ( ,c 1 ,c 2 ) .

Figure 4 . 4 :

 44 Figure 4.4: Examples of non valid epistemic models.

Figure 4 . 5 :

 45 Figure 4.5: Event model portion repl( , ) for = .

Figure 4 . 6 :

 46 Figure 4.6: Event model (E, e) :goto( ) for :goto( ).

Figure 4 . 7 :p 2 q 2 Figure 4 . 8 :

 47248 Figure 4.7: Event model portions lengthen(i) and shorten(i).

Figure 5 . 1 :

 51 Figure 5.1: Example of hands for the Russian cards puzzle

Proposition 15 .

 15 Let ϕ ∈ P AP L and M be a symbolic model. For every U ⊆ U and u ∈ T , U, u |= ϕ iff U ϕ u , u ϕ |= ϕ where U ϕ u = {v ϕ | v ∈ U and for all p ∈ AP \ AP(ϕ), p ∈ v iff p ∈ u} with v ϕ = v∩AP(ϕ).

Proposition 16 .

 16 Let AP be a finite set. For all set W, w∈ W, ϕ, (W, u) |= •! G ϕ iff there exist (U a ) a∈G ⊆ W, such that U a = ∼ pre πa,W (post πa,W (U a )),and a∈G U a , w |= ϕ Proof. In Appendix E.2.

proc

  Figure 5.2: Algorithm for program relation verification.

  Figure 5.4: Algorithm in yes to check membership in the current context.

  Figure 5.5: Iteration algorithm access * yes for symbolic accessibility relations (arbitrary-free and star-free case).

  proc mainmc(w, ϕ)accepts whenever U , w |= ϕ mc yes (U , w, ϕ)

  Figure 5.6: Model checking sub-procedure mc yes that handles protocols with arbitrary announcements and Kleene star.

  a a c ␣ ␣ ␣ ␣ ␣ should be in an accepting state 0 th part (existential) 1 st part (universal) 2 nd part (existential) (A(ω) -1) th part . . .

  Figure 5.11: Tableaux for executions of M

w ∅ : ∅ w p {p} w q {q} a a a Figure 5

 a5 Figure 5.12: Example of a Kripke model for the hardness proof of Theorem 23 with AP(β) = {p, q}.

Figure 5 .

 5 Figure 5.15: Dual path searching algorithm exec yes for announcements.

Definition 69 .

 69 A model M of MMSO is a structure (D, (P M ) p∈AP ) where D is a nonempty domain and each predicate P M is such that P M ⊆ D. We will use the classical notation of the form M [...] for the model M extended with (first-order and second-order) variable assignments: for instance, M [x ← e, y ← e , X ← D , Y ← D ] is the model M in which first-order variables x and y are interpreted by element e ∈ D and e ∈ D respectively, and second-order variables X and Y are interpreted by element D ⊆ D and D ⊆ D respectively.

  unique because each valuation is represented exactly one time in D and by Definition 73, P mimics the role of the atomic propositions in the valuations. -M AP |= ϕ exists because all valuations are represented in D. Therefore M AP |= T AP and thus M |= T AP . ⇒: Let M be such that M |= T AP . Let D be the domain of M and P be the monadic predicates of M . We define the mapping f : D → D such that for all e ∈ D, f (e) is the valuation {p | e ∈ P } ∈ D. We conclude by showing that f is an isomorphism.

  π -→ u if, and only if, M AP [x ← w, y ← u] |= π(x, y).

  )) then let D be the interpretation of X G . By the deifnition of group, D contains {v ∈ D M | w ( a∈G πa) * -------→ v}, and it is the smallest one, so the interpretation of X G is necessarily {v ∈ D M | w ( a∈G πa) *

Figure 6 . 1 :

 61 Figure 6.1: Results for the implementation of the reduction from ∃PAPL to MFO, using the FO-SAT-solver Iprover.

Figure A. 1 :

 1 Figure A.1: Example of a Turing machine

Figure A. 2 :

 2 Figure A.2: Example of an alternating Turing machine

  l 4 are the winning states, l 1 , l 2 are indistinguishable for the player.

Figure B. 1 :

 1 Figure B.1: Example of a game with imperfect information

Example 38 .

 38 In the game of Figure B.1, the strategy defined by σ(l I ) = a, σ(l I , l 1 ) = σ(l I , l 2 ) = a is not winning but the strategy defined by σ(l I ) = a, σ (l I , l 1 ) = σ (l I , l 2 ) = b is winning. ϕ case ϕ = p: inval no (p, M -→ E , w -→ e ) case ϕ = (ϕ 1 ∨ ϕ 2 ): (∀) (∀) (∀) choose i ∈ {1, 2}; mc no (M -→ E , w -→ e , ϕ i ) case ϕ = ¬ψ: mc yes (M -→ E , w -→ e , ψ). case ϕ = K a ψ: (∃) (∃) (∃) choose u case ϕ = E, E 0 ψ: (∀) (∀) (∀) choose e ∈ E 0 ; (∃) (∃) (∃) mc no (M -→ E , w -→ e , pre(e)) or mc no (M -→ E :: E, w -→ e :: e, ψ). case ϕ = C G ψ: (∃) (∃) (∃) choose u -→ f ∈ M -→ E (∀) (∀) (∀) access * yes (w -→ e , u -→ f , G, B M,ϕ , M -→ E )and in yes (u E and w -→ e = w -→ e ::e: mc no (M -→ E , w -→ e , post(e, p)) proc in no (w -→ e , E, w -→ e = w -→ e ::e: (∃) (∃) (∃)

  π = p←β: if (w |= β ∧ (u = w ∪ {p})) ∨ (w |= β ∧ (u = w \ {p})) then accept else reject case π = π 1 ; π 2 : (∀) (∀) (∀) v ∈ U ; (∃) (∃) (∃) relation no (w, v, π 1 ) or relation no (v, u, π 2 ) case π = π 1 ∪ π 2 : (∀) (∀) (∀) relation no (w, u, π 1 ) and relation no (w, u, π 2 ) case π = β?: if w = u ∨ w¬ |= P L β then accept else reject • γ = γ 1 ; γ 2 :

Titre:

  Complexité théorique du raisonnement en logique épistémique dynamique et étude d'une approche symbolique Mot clés : système multi-agents, vérification de modèles, logique épistémique, complexité de calcul, modèle symbolique, planification épistémique.Résumé : Nous étudions la complexité théorique de tâches de raisonnement mettant en jeu la connaissance des agents dans les systèmes multi-agents. Nous considérons la logique épistémique dynamique (DEL) comme une façon naturelle d'exprimer la connaissance, qui permet d'exprimer la connaissance d'ordre supérieur des agents et des actions dynamiques partiellement ob-servées. Nous montrons des résultats de complexité algorithmique pour la vérification de modèles et la satisfiabilité de formules de DEL, et définissons une approche symbolique pour ces mêmes problèmes. Nous étudions également la planification basée sur DEL ainsi que des quantifications sur certaines actions : les annonces publiques.

  Tout d'abord, je tiens à remercier chaleureusement Sophie Pinchinat pour toutes ces années passées dans l'équipe LogicA. Son enthousiasme et sa passion pour son métier ont été une grande inspiration durant ma thèse, et sa grande vision du domaine m'a beaucoup aidé à aborder mon sujet sous d'autres angles. Sophie a été également d'un soutien moral indéfectible durant mes périodes chargées, et je suis très reconnaissant et honoré d'avoir pu préparer mon doctorat dans son équipe. Je remercie également de tout coeur François Scwharzentruber, qui m'a très bien encadré pendant ma thèse.

	THÈSE DE DOCTORAT DE
	L'UNIVERSITE DE RENNES 1
	COMUE UNIVERSITE BRETAGNE LOIRE
	Ecole Doctorale N°601
	Mathématique et Sciences et Technologies
	de l'Information et de la Communication
	Spécialité : Informatique
	Par
	« Tristan CHARRIER »

C'est un chercheur qui aime aussi beaucoup son métier, et c'était un plaisir de travailler avec lui. Sa sympathie et son humour étaient très agréables à vivre au quotidien. En outre, et quoi qu'il en dise, c'est un excellent enseignant, qui désire réellement que ses étudiants réussissent et qui sait faire preuve de beaucoup de pédagogie, et j'ai beaucoup appris à ses côtés. Son énergie entrainante m'a motivé jusqu'au bout de ma thèse, et pour cela merci.

Table 1 :

 1 Toutes les preuves utilisent les classes de complexité alternantes, définies par des algorithmes/machines de Turing enrichis par des choix existentiels et universels. En effet, comme rappelé en Annexe A, ces classes sont directement corrélées avec les classes de complexité classiques et permettent d'exprimer très intuitivement les complexités des problèmes de décision. Nous appliquons le résultat de vérification de modèles pour exprimer Publications durant ma thèse. similaires à ceux de PDL, ce qui permet d'étendre la planification épistémique dans le cas où toutes les actions sont des annonces publiques. Nous prouvons que le problème de vérification de modèles symboliques pour PAPL est A pol Exptime-complet (voir Annexe A), qui est une classe entre Exptime et Expspace. Ce résultat de complexité est différent du cas non symbolique, qui est Pspace-complet.• Le Chapitre 6 décrit une réduction depuis le problème de vérification de modèles symboliques vers la vérification de modèles de MMSO : la logique du second-ordre monadique où tous les prédicats sont monadiques. Nous considérons le fragment existentiel de PAPL et montrons que nous pouvons implémenter la vérification de modèles sur ce fragment en utilisant la logique du premier ordre monadique (MFO).

	Référence

• Le Chapitre 1 définit la syntaxe et la sémantique de la logique épistémique dynamique (DEL). Nous définissons d'abord la logique épistémique, avec la notion de connaissance commune, et introduisons après les opérateurs dynamiques, définis par les modèles d'événement. Nous rappelons également quelques axiomes définissant les classes de modèles usuelles. En particulier, nous définissons S5 pour les modèles pour la connaissance et KD45 pour les modèles pour la croyance. Nous prouvons ensuite des résultats d'expressivité pour DEL : toute formule de DEL avec des modèles d'événement sans connaissance commune peut être exprimée en une formule équivalente où tous les modèles d'événements ont des formules sans connaissance d'ordre supérieur. • Le Chapitre 2 définit les problèmes de vérification de modèles et de satisfiabilité pour DEL avec connaissance commune (DELCK). Nous étendons les résultats de [AS13] pour DELCK en prouvant que le problème de vérification de modèles est Pspace-complet (tout comme DEL) et le problème de satisfiabilité est 2-Exptimecomplet (alors qu'il est NExptime-complet pour DEL). l'existence d'une stratégie uniforme dans le jeu du morpion fantôme, c'est à dire le morpion où les joueurs ne voient pas directement les coups de l'adversaire. • Le Chapitre 3 introduit les représentations symboliques des modèles de Kripke et des modèles d'événements, en utilisant des programmes de DL-PA. Nous montrons que nous ne perdons pas en expressivité en introduisant ces modèles symboliques et que la représentation est exponentiellement plus succincte dans les cas usuels. Ensuite, nous montrons que les complexités pour les problèmes de vérification de modèles et de satisfiabilité restent les mêmes que dans le cas non symbolique. Nous appliquons le résultat pour montrer que l'existence de stratégies uniformes dans le jeu de bridge peut se décider avec un algorithme Pspace. • Le Chapitre 4 est dédié à la planification épistémique. Nous prouvons en premier des résultats de décidabilité lorsque les modèles sont séparables, c'est à dire que les préconditions des événements sont disjointes. Dans ce cas, la planification épistémique est NP-complète si les événements sont non-ontiques et Pspacecomplète sinon. Nous prouvons ensuite que la planification épistémique est Pspacecomplète lorsque tous les modèles d'événement en entrée sont propositionnels (mais pas forcément séparables). Enfin, nous montrons que la planification épistémique est indécidable lorsque les modèles d'événement en entrée sont non-ontiques et ont des préconditions avec des formules de profondeur modale 2. • Le Chapitre 5 considère le problème de vérification de modèle pour APAL et GAL, introduisant une logique qui étend les deux, nommée la logique de protocoles d'annonces publiques (PAPL). Cette logique considère des protocoles d'annonce qui combinent des annonces publiques et des annonces arbitraires via des programmes

Table 2 :

 2 Publications during my PhD.

	• Chapter 5 considers symbolic model checking of APAL and GAL, introducing
	a unifying logic called Public Announcement Protocol Logic (PAPL). This logic
	features announcement protocols that combine public announcements and arbitrary
	announcements in a PDL fashion, which allows to extend epistemic planning in the
	case where events are announcements. We show that the symbolic model checking
	for PAPL is A pol Exptime-complete (see Appendix A), which is a class between
	Exptime and Expspace. The complexity result is noticeably different from the
	Pspace-completeness of the model checking of PAPL in the non-symbolic case.
	• Chapter 6 describes a reduction from the symbolic model checking of APAL into
	the model checking of MMSO: second-order logic where all predicates occurring in

  .1. Let ϕ = C {a,b} ¬K a p. If we want to check whether M, w |= ϕ, we first compute the set of worlds satisfying p. Here, there is only w. For K a p, we verify that all worlds a-accessible satisfy p, which is the case for no world here. Then both w and u satisfy ¬K a p. Finally for ϕ, we must check that all worlds that are accessible by a combination of a and b satisfy ¬K a p, so both w and u satisfy ϕ.

Table 1

 1

	.3: Axioms for epistemic logic
	Example 5. Both Kripke models of Figures 1.1 and 1.2 are S5 models.

  Figure 2.3: Computation tree rooted at mc yes (M, w, E, E 0 ¬C G p). The quantities associated to each procedure call used for the proofs change a little bit compared to Definition 9 page 45. The first difference is |C G ϕ| := log 2 B M,ϕ +1+|ϕ|. Since B M,ϕ is polynomial in the size of the biggest M -→ E , which itself is single-exponential in the size of M in the worst case, it means that B M,ϕ is single-exponential in M, therefore adding log 2 B M,ϕ in the new size of a formula |ϕ| is polynomial in |M| + |ϕ| as given in

			existential choice of
			an event e in E 0
	height of the computation tree = execution time	existential choice of the intermediate world vg in ME	universal choice of uf in ME
	Definition 9. Furthermore, in the algorithms, when |M → -E | is written, it is not the number of worlds of |M -→ E | here but |M| + E∈ -→

ME) access * no (we, vg, G, B M,ϕ 2 , ME) access * no (vg, uf, G, B M,ϕ 2 , ME) . . . . . . . . . mc yes (ME, uf, p) inval yes (p, uf, ME) mc yes (M, u, post(e, p)) . . . . . . a∈G R ME a -steps or that p in uf . Checking that p holds in uf is performed by the call of inval yes (p, uf, ME), which itself check that the postcondition post(e, p) holds in u. E |E|, which is clearly linear in |M| + |ϕ| at all times.

  ϕ + |ϕ|+1 and is strictly greater than the quantity for access * no

  Now, we define the following structure that takes care of the consistency of the box modalities K a , C G . The Hintikka structure for ϕ is H := (H, (R a ) a∈Ag ) where:

	Compute the Hintikka structure H := (H, (R a ) a∈Ag ) for ϕ repeat Remove any Hintikka set h from H if ( Ka ) either there is ( -→ e , Ka ψ) ∈ h but no h ∈ R a (h) with ( -→ e , ψ) ∈ h with -→ e → a -→ e and in-→ e ∈ h ; Definition 29. function isDELCK-sat?(ϕ) ( ĈG ) or there is (

there exists e ∈ E 0 s.t. in -→ e ::e ∈ h and ( -→ e ::e, ϕ) ∈ h; 2 (7) ( -→ e , [E 0 ]ϕ) ∈ h iff for all e ∈ E 0 , we have in -→ e ::e ∈ h implies ( -→ e ::e, ϕ) ∈ h; (8) in ∈ h; (9) in -→ e ::e ∈ h iff in -→ e ∈ h and ( -→ e , pre(e)) ∈ h; (10) ( -→ e ::e, p) ∈ h iff ( -→ e , post(e)(p)) ∈ h. Point (1) means that if a Hintikka set contains ( -→ e , ϕ), then it means that -→ e should be executable (in the intuitive world represented by the Hintikka set). Point (4) means that Hintikka sets are consistent. Point (5) says that if ϕ is common knowledge then ϕ is true. Points (6) and (7) mimics the truth condition given in Definition 8. Point (8) means the empty sequence of events is always executable. Point (9) means that -→ e ::e is executable iff -→ e is executable and the precondition of e holds after having executed -→ e .

Point (10) means that the truth of atomic proposition p after a non-empty sequence -→ e ::e of events is given by the truth of its postcondition before the last event e.

accept else reject endFunction

  a 1 , . . . , a k ∈ G and in-→ e (i) ∈ h i . until no more Hintikka sets are removed if there is still a Hintikka set in H containing ( , ϕ) then

  ) of Definition 28. Compute R a according to Definition 29. The loop is repeated at most the number of Hintikka sets in H, that is O(2 2 |ϕ| ) times, since at least one Hintikka set is removed or we exit the loop. Both tests ( Ka ) and ( ĈG ) can be performed by depth-first search algorithm running in polynomial time in the size of the graph, that is of size double-exponential in |ϕ|. Proof. (⇒) Let M, w such that M, w |= ϕ. Given a world u, we note h(u) the Hintikka set obtained by taking in -→ e if -→ e is executable in u and ( -→ e , ψ) if ψ holds in u, -→ e . We show that no Hintikka set h(u) is removed from H. In particular, h(w) is not removed, and contains ( , ϕ) so the algorithm isDELCK-sat? accepts ϕ.

	Proposition 6. ϕ is DELCK-satisfiable iff isDELCK-sat? accepts ϕ.

Table 2

 2

.1: Clauses of DELCK-formula tr(ω) .

  is true iff it is Player •'s turn (resp. Player ×'s turn) to play;• p end is true iff the game has ended.A state of the game is then represented by a world uniquely characterized by a valuation on AP.

	Example 13. Consider for instance the empty grid:

The empty grid is represented by the world with valuation {t • }, since no p z

• and no p z × is true, it is Player •'s turn to play and since the game has not ended yet. Consider now the following grid:

  pl • , E pl • ) for Player • playing is now the following: it contains one event e z •,play and one event e z •,inf o for each possible position z in the grid, and all are pointed. Figure 2.13 gives an example with a 2 × 2 grid.

	(1,1) e •,play
	(1,2) e •,play
	(2,1) e •,play
	(2,2) e •,play
	Let us know define formally (E pl • , E pl • ) ( (E pl × , E pl × ) is defined similarly by switching •
	and ×'s roles).
	Definition 36 (Event model (E pl

• , E pl • )). The event model (E pl • , E pl • ) = (E, (R E a )

a∈Ag , pre, post) is defined as follows:

  Player i has card (v, c) in his hand tu i i ∈ {1, . . . , n} It is Player's i turn to play p i,v,c i ∈ {1, . . . , n}, v ∈ V, c ∈ C Player i has played card (v, c) in the current deal. ∈ C, the data of the hand H 1 of the leader and of the dummy players H

	w l	l ∈ {0, . . . , |V |×|C| n	}	Player 1 had currently won l deals.
	tr c	c ∈ C		Color c = c t is the trump color.
	du i	i ∈ {1, . . . , n}		The leader plays the hand of Player i (meaning
				that Player i is dummy or the leader)
	de c	c ∈ C		c is the current color of the deal.
			Table 3.1: Set AP for bridge.
		color c t

Input: n players, a set of values V , a set of colors C such that n divides |V | × |C|, an integer k ≤ |V |×|C| n , a set of dummy players D ⊆ {2, . . . , n}, an optional trump h i,v,c i ∈ {1, . . . , n}, v ∈ V, c ∈ C d for d ∈ D.

Table 3

 3

.2: Clauses of β M formula for bridge. n i=1 eq |V |×|C| n

  We now state the correctness of Algorithms mc yes , access * yes , in yes , and mainmc (Proposition 17). Given a list L = ϕ 1 ; . . . ; ϕ n of announcements, a valuation w, a formula ϕ, and i ≤ 2 #AP we have:

	Proposition 17. mc yes (L, w, ϕ) accepts	iff W L , w |= ϕ;
	mc no (L, w, ϕ) accepts	iff W L , w |= ϕ;
	access * yes (L, w, u, π, i) accepts iff there are w 1 , . . . , w j-1 ∈ W L such that
		w	π

  access no (w, v, π) or access no(u, v, π)

	Figure 5.10: Algorithm that checks that	∼ pre π,W (post π,W (W )) ⊆ W .
	We now state the correction (Proposition 18).
	Proposition 18. We have:
	mc yes (L, w, ϕ) accepts	iff W L , w |= ϕ;
	mc no (L, w, ϕ) accepts	iff W L , w |= ϕ;
	access * yes (L, w, u, π, i) accepts iff there are w 1 , . . . , w j-1 ∈ W L such that
		w	π -→ w 1	π -→ . . .	π -→ w j-1	π -→ u and j ≤ i;
	access * no (L, w, u, π, i) accepts iff for all w 1 , . . . , w j-1 ∈ W L such that j ≤ i,
		it is false that w	π -→ w 1	π -→ . . .	π -→ w j-1	π -→ u;
	in yes (L, w) accepts	iff w ∈ W L ;
	in no (L, w) accepts	iff w ∈ W L ;
	exec yes (W, w, W , γ) accepts	iff (W, w) γ (W , w)
	exec no (W, w, W , γ) accepts	iff (W, w) γ (W , w)
	exec * yes (W, w, W , γ, i) accepts iff (W, w) γ j (W , w) for some j ≤ i
	exec no (W, w, W , γ) accepts	iff (W, w) γ (W , w) for all j ≤ i
	stable yes (W, W , π) accepts	iff	∼ pre π,W (post π,W (W )) ⊆ W
	stable no (W, W , π) accepts	iff	∼ pre π,W (post π,W (W )) ⊆ W
	mainmc(w, ϕ) accepts	iff U , w |= ϕ.

  1 is equivalent to n k=1 t k . • Non-deterministically choose values for {p 1 , . . . , p n } such that at least one p i 's value changes: set = (p 1 , . . . , p n ) := ((p 1 ?; p 1 ← ) ∪ (¬p 1 ?; p 1 ←⊥)) ; . . . ; ((p n ?; p n ← ) ∪ (¬p n ?; p n ←⊥)) ; set(p 1 , . . . , p n ) ;

	
	 ¬	(p i ↔ p i )
	i∈{1,...,n}

  ?; (p 1 ←⊥); . . . ; (p n ←⊥)

  K set(cur) cur) ∧ (¬cur → K set(cur) ¬cur) at a given time, the cursor has a unique position

	Tableau structure
	1. K(x←x+1∪x=2 P (|ω|) -1?);set(state,symbol,cur,tr)	If x < 2 P (|ω|) , the x + 1 th cell exists
	2. K(t←t+1∪t=2 P (|ω|) -1?);set(state,symbol,cur,tr)	if t < 2 P (|ω|) , time t + 1 exists
	States
	3. ∃!(state q ) q∈Q	the machine is in a unique state
	4. state q → K set(x,state,symbol,cur,tr) state q	the state of the machine only depends on time
	Cursor
	5. Kset(x,symbol,cur,tr) cur	on each possible tape, there must be a cursor
	6. cur → K set = (x,symbol,cur,tr) ¬cur	the cursor has a position
	7. (cur → Tape
	8. ∃!(symbol a ) a∈Γ	a tape cell contains a unique letter
		on each cell, there is no world in which all atomic
	9. symbol a → K set(symbol) symbol a	propositions are the same except the letter written in the cell
	Transitions
	10. ∃!(tr δ ) δ∈δ	there is a unique transition to be triggered
	11. δ∈δ tr δ → K set(x,state,symbol,cur,tr) tr δ	the triggered transition only depends on time
	12. a∈Γ (¬cur ∧ symbol a ) → K t←t+1 symbol a	Tape cells that are not under the cursor remain un-changed

Table A .

 A 1: Execution time of alternating algorithms where |AP| is the cardinal of AP.

  ( a∈G R a ) j for all j ≤ i case i = 1:

	proc access no (w -→ e , u -→ f , a, M → -E ) accepts whenever (w -→ e , u -→ f ) ∈ R a case -→ E = : if (w, u) ∈ R M a then accept else reject case -→ E = -→ E :: E, -→ e = -→ e :: e, -→ f = -→ f :: f : proc in no (w -→ e , M -→ E ) accepts whenever w -→ e ∈ M -→ E case -→ E = : reject case -→ E = -→ E ::E, w -→ e = w -→ e ::e: (∃) (∃) (∃) mc no (M -→ E , w -→ e , pre| ve ) or in no (w -→ e , M |M -→ E | -→ E ) |M -→ E |
	if (e, f ) ∈ R E a then accept else access no (w -→ e , u -→ f , a, M → -E ) proc access * no (w -→ e , u -→ f , G, i, M -→ E ) accepts whenever (w -→ e , u -→ f ) ∈ if u -→ f = w -→ e then reject else (∀) (∀) (∀) choose a ∈ G; access no (w -→ e , u -→ f , a, M |M -→ E | + log i -proc access no (w -→ e , u -→ f , a, M -→ E ) accepts whenever (w -→ e , u -→ f ) ∈ R a case -→ E = : relation no (w, u, π a ) case -→ E = -→ E :: E, -→ e = -→ e :: e, -→ f = -→ f :: f : → E ) (∃) (∃) (∃) access no (w -→ e , u -→ f , a, M -→ E ) or relation no (e, f, π E a ) case i ≥ 2: (∀) (∀) (∀) choose v -→ g ∈ M -→ E (∃) (∃) (∃) in no (v -→ g , M -→ E ) or access * no (w -→ e , v -→ g , G, i/2, M -→ E ) or access * no (v -→ g , u -→ f , G, i/2, M -→ E ) proc access * no (w -→ e , u -→ f , G, i, M -→ |M -→ E | + log i |M -→ E | E ) accepts whenever (w -→ e , u -→ f ) ∈ ( → e , u -→ f , a, M -→ E )
	D.2 Algorithms for Chapter 3 proc mc no (M -→ E , w -→ e , ϕ) accepts whenever M -case i ≥ 2: (∀) (∀) (∀) choose v -→ g ∈ M -→ E (∃) (∃) (∃) in no (v -→ g , M -→ E ) or access * no (w -→ e , v -→ g , G, i/2, M → -E ) or access * → g , u -→ f , G, i/2, M -→ E ) no (v -→ E , w -→ e |= ϕ case ϕ = p: inval no (p, M -→ E , w -→ e ) proc relation no (w, u, π)	|M -→ E | + |ϕ|
	case ϕ = K a ψ: (∃) (∃) (∃) choose u -→ f ∈ M → -E (∀) (∀) (∀) access yes (w -→ e , u -→ f , a, M → -E ) and in yes (u -→ f , M → -E ) and mc no (M → -E , u -→ f , ψ)
	case ϕ = E, β 0 ψ:
	(∀) (∀) (∀) choose e such that e |= β 0 ; (∃) (∃) (∃) mc no (M -→ E , w -→ e , pre| ve ) or mc no (M → -E :: E, w -→ e :: e, ψ).
	case ϕ = C G ψ: (∃) (∃) (∃) choose u -→ f ∈ M → -E (∀) (∀) (∀) access * yes (w -→ e , u -→ f , G, B M,ϕ , M → -E ) and in yes (u -→ f , M → -E ) and mc no (M → -E , u -→ f , ψ)
	proc inval no (p, w -→ e , M → -E )	|M → -E |
	accepts whenever p ∈ V (w -→ e ) case -→ E = : if p ∈ w then accept else reject case -→ E = -→	→ e , M → -E )

mc no (M -→ E , w -→ e , pre(e)) or in no (w -

case ϕ = (ϕ 1 ∨ ϕ 2 ): (∀) (∀) (∀) choose i ∈ {1, 2}; mc no (M -→ E , w -→ e , ϕ i ) case ϕ = ¬ψ: mc yes (M -→ E , w -→ e , ψ). E ::E, w -→ e = w -→ e ::e: mc no (M -→ E , w -→ e , post(p)| ve ) a∈G R a ) j for all j ≤ i case i = 1: if u -→ f = w -→ e then reject else (∀) (∀) (∀) choose a ∈ G; access no (w -

• In security, the agents are the attacker and the owner of a system. For instance in web security[START_REF] Perlman | Network security: private communication in a public world[END_REF], the owner wants the attacker to have the least possible knowledge. Indeed, if the attacker obtains information about the system, he may be able to compromise it, for instance in privilege escalation attacks. Also in cryptography[START_REF] Menezes | Handbook of Applied Cryptography[END_REF], the owner usually wants to ensure that the transmitted information is not decrypted by the attacker. Indeed, the information can be easily intercepted by the attacker, but if he does not own the encryption key, he cannot find the content of the message. We may also mention here attack detection, usually done with attackdefense trees[START_REF] Kordy | Foundations of Attack-Defense Trees[END_REF], where for instance the attacker wants to access some hidden resource in a building (a document typically), and has to infiltrate the building without being seen. In this case, it is quite the contrary of the web security example. Indeed, the attacker is the one who wants to leak the least possible information, and the defender must gain knowledge of the attacker's whereabouts.

Created by Antoine Bauza in 2010, edited by Cocktail Games and XII Singes.

Created by Bakafire in 2014, edited by Z-Man Games and BakaFire Party.

Edited by Nintendo.

Actually, Chapter 6 gives the reduction to first-order formulas, which gives a way to define BDDs afterwards.

Announcement to a group of agents of the value of a formula ϕ, the other agents being uncertain of the announced value.

Which is not surprising, in Chapter 4 we will see that their paper falls into epistemic planning with separable events.

The definition given here contains 'too many' formulas. We could have given a much more thorough definition, but the definition would have been more complicated to understand and the closure would have had the same asymptotic size.

We explicitly mentioned in-→ e ::e ∈ h for uniformity with the semantics. However, note that it is implied by point (1).

If not, we add a double exponential counter to the machine and we abort the execution after a double exponential number of steps.

Succinctness is needed for the input of decision problems. Therefore, we do not require the Kripke model in a symbolic version. It would not change the decision problem.

We have applied the model checking result to show that the existence of a uniform strategy in bridge is a Pspace-problem. In fact, the examples of blind tic tac toe and bridge are similar, since in both it is possible to describe the input Kripke model with a representation of polynomial size, and the length of the game is always polynomial. For all games of this kind, we suspect that the existence of a uniform strategy is in Pspace. It

Bisimulation up to modal depth d.

Actually a better bound is proved in[START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF].

More precisely, the reachable parts of the pointed epistemic models are isomorphic.

Section 4.1 is a more general proof for separable event models

This protocol is non-deterministic as the number of times can be any finite number.

The other implication is always true.

Remerciements

event model containing common knowledge is in no C j i with i, j ∈ N. We suspect that no polynomial translation exist in this case.

And some example of event models that are not separable:

• Semi-private assignments: e : pre : post : p ← e ⊥ : pre :

• The event model (E (1,1)

• , E (1,1)

•

) from Figure 2.10 page 79.

We now detail the results we obtain for epistemic planning when the event models in input are separable.

Theorem 13. We consider the epistemic planning problem with the additional restriction that E only contains separable event models with trivial postconditions. Then this new epistemic planning problem is NP-complete.

Proof. Hardness: direct from [START_REF] Bolander | Complexity Results in Epistemic Planning[END_REF].

Membership:

We define the following algorithm: proc existplan(M, w, E, ϕ G ) (∃) (∃) (∃) k ∈ {0, . . . , |M|} (∃) (∃) (∃) (E 1 , E 1 0 ), . . . , (E k , E k 0 ) ∈ E k Let M cur , w cur = M, w for i = 1 to k:

(∃) (∃) (∃) e ∈ E i 0 if M cur , w cur |= pre(e) then reject else M cur , w cur = M cur ⊗ E i , (w cur , e) if M cur , w cur |= ϕ G then accept else reject

The algorithm tries to find the plan by choosing non determiniscally the sequence of event models executed. Here it is important to notice that since the event models are separable and non-ontic, it is sufficient to consider a plan of at most |M| event models, since each application of an event model will either remove a world, an epistemic edge or do nothing. We then update the Kripke model in M cur . Since the event models are separable, then the product update is performed in polynomial time. Finally, we check that ϕ G , which is a formula of ELCK is satisfied in M cur . Since the model checking against ELCK is in P (see Appendix C) this concludes the proof. (∀) (∀) (∀) u ∈ U (∃) (∃) (∃) access * no (L, w, u, a∈G π a , 2 #AP ) or in no (L, u) or mc yes (L, u, ψ) case ϕ = ψ! χ: (∀) (∀) (∀) mc yes (L, w, ψ) and mc yes (L :: ψ, w, χ) case ϕ = ψ? χ: (∀) (∀) (∀) mc yes (L, w, ψ) and mc yes (L, w, χ) case ϕ = τ 1 ∪ τ 2 χ: (∃) (∃) (∃) mc yes (L, w, τ 1 χ) or mc yes (L, w, τ 2 χ) case ϕ = τ 1 ; τ 2 χ: mc yes (L, w, τ 1 τ 2 χ) Figure 5.3: Algorithm mc yes for model-checking against star-free and arbitrary-free formulas.

Model checking against formulas with star-free and arbitraryfree protocols

The aim of this subsection is to prove the following theorem.

Theorem 17. The symbolic model checking problem against P AP L-formulas with starfree and arbitrary-free protocols is in Pspace.

The algorithm for the symbolic model checking problem against formulas with a starfree and arbitrary-free protocols is the following, where [ ] is (initially) the empty list of announcements, w is the current valuation and ϕ is the formula to model check. The algorithm for mc yes is described in Figure 5.3.

We now detail algorithm mc yes of Figure 5.3. In a call mc yes (L, w, ϕ), L is the list of all previous announcements, w ∈ U is a valuation, and ϕ is a formula. We write L :: ϕ for the list L followed by ϕ. The call mc yes (L, w, ϕ) accepts whenever W L , w |= ϕ, where the set of valuations W L is the restriction of U to worlds satisfying all the announcements in list L. Notice that the overall complexity is confined to Aptime by avoiding an explicit representation of the announcement context W L : instead, we use the list L of previous announcements, that implicitly denotes this context. proc access * yes (W, w, u, π, i) proc exec * yes (W, w, W , γ, i)

accepts whenever (W, w)

) and exec * yes (W , w, W , γ, i/2) Figure 5.9: Iteration algorithm exec * yes .

Now we define protocols to keep the current valuation (keepval), remove the current valuation (removeval), consider the next valuation (nextval):

• keepval = !: the model is unchanged;

we change the value of ι and if ι has no successor (meaning that ι is the current valuation/integer) then valuation p should be different from valuation ι;

• nextval = Ksucc(ι) !: we remove valuations without successors (we remove valuation ι = 1 . . . 1, then valuation ι = 1 . . . 10, etc.).

The protocol is then:

where formula end states the protocol is over. Formally: end := K set(AP ) (ι = 0). In the reduction of Subsection 5.

Non-symbolic model checking of PAPL

The aim of this section is to prove the following theorem.

Theorem 23. The non-symbolic model checking against PAPL is Pspace-complete.

Hardness

To prove the Pspace-hardness, we reduce the Quantified Boolean Formula (QBF) problem which is known to be Pspace-complete [START_REF] Sipser | Introduction to the Theory of Computation[END_REF].

where Q i is a quantifier, either ∀ or ∃, and p i ∈ AP for all i ∈ {1, . . . , n}, and β is a propositional formula.

We define the following translation tr that takes a QBF formula and return a PAPL formula.

Definition 65 (Translation tr from QBF to PAPL).

The reduction is indeed polynomial and we can verify easily that ϕ is true if and only if M, w ∅ |= tr(ϕ), which concludes the Pspace-hardness proof.

Membership

For the membership, we simply adapt the algorithms of Section 5.4.2 into the non-symbolic case (Figures 5.13, 5.14, 5.15, 5.16 and 5.17). The main difference is that access yes (w, u, π a ) is now replaced by a checking of (w, u) ∈ R a . In each recursive call, the time taken is now polynomial, because choosing W ⊆ W takes a polynomial amount of time. To insure that the notations are uniform with the symbolic case, we supposed that M is fixed and only focus on the current set of worlds W . We leave apart the detail of the algorithms since they are very similar to 5.4.2. As usual, the dual procedures are in Appendix D.

) and mc yes (W , w, χ)

Figure 5.13: Model checking sub-procedure mc yes that handles protocols with arbitrary announcements and Kleene star. Chapter 6

Implementation of Succinct Epistemic Logic with Arbitrary Announcements

In this chapter, we focus on the implementation of symbolic model checking of PAPL in practice. For that, we reduce the model checking of PAPL into the model checking of monadic monadic second-order logic (MMSO), that is, monadic second order logic where all predicates are monadic, not only the quantified ones.

Since the model checking of PAPL is A pol Exptime-complete, it seems rather unreasonable to have an implementation of the full logic. That is why we consider the existential fragment of PAPL, ∃PAPL , and reduce the model checking of ∃PAPL into the satisfiability of monadic first-order logic (MFO), that is first-order logic where all predicates are monadic.

The chapter is divided as follows:

• First, we briefly recall the definitions of first and second-order logics.

• Second, we reduce the model checking of PAPL into the satisfiability of MMSO.

• Third, we reduce the model checking of ∃PAPL into the satisfiability of MFO.

• Finally we conclude.

The content of the chapter was initially published in [START_REF] Charrier | Model Checking Against Arbitrary Public Announcement Logic: A First-Order-Logic Prover Approach for the Existential Fragment[END_REF], but for APAL and GAL instead of PAPL. Therefore, we extend the results to PAPL here.

First and second-order logics

Monadic monadic second-order logic MMSO and its fragment monadic first-order logic MFO are central in the proposed approach. These monadic fragments of MSO and FO

The model checking problem for MFO and MMSO is defined as follows.

Definition 71 (Model checking problem).

• Input: a model M , a formula ϕ of MMSO/MFO such that all free variables (i.e.

variables not bound by a quantifier) are assigned in M .

• Output:

Definition 72 (Satisfiability problem).

• Input: a formula ϕ.

• Output: yes if there exists M with variable assignments such that M |= ϕ, no otherwise.

Notice that for MMSO, the model checking problem and satisfiability problem are equivalent, since ϕ is satisfiable if and only if M |= ∃x 1 . . . ∃x n ∃X 1 . . . ∃X m ϕ where x 1 , . . . , x n , X 1 , . . . , X m are the free variables of ϕ and M is arbitrary.

Regarding the properties of MMSO and MFO, it is known that the satisfiability problem of a MFO-formula is NExptime-complete [BGW93; Lew80]. Also, there are plenty of FO provers: Isabelle, iprover, Z3 [START_REF] Mendonça De Moura | Z3: An Efficient SMT Solver[END_REF], CVC4 [START_REF] Barrett | CVC4[END_REF]. In particular, the prover iprover won CASC 2016 in EPR division [START_REF] Sutcliffe | The CADE ATP System Competition-CASC[END_REF].

PAPL into monadic monadic second-order logic

We reduce the model checking against PAPL to the satisfiability problem of MMSO. Intuitively, second-order variables denote current sets of valuations, called contexts, and first-order variables denote possible worlds/valuations. We present the reduction in four steps:

1. we define an MMSO-theory that enforce the MMSO-model to contain all valuations (Theorem 24); 2. we translate arbitrary accessibility programs into first-order logic (Theorem 25);

3. we translate PAPL formulas into MMSO (Theorem 26); 4. we give the reduction of the PAPL-model checking into the MMSO-satisfiability problem (Theorem 27).

The theory of models of valuations

In this section, we fix a set of atomic propositions AP. Since we evaluate PAPL-formulas on a symbolic model M meant to denote the Kripke model with all valuations, we therefore need to enforce that all such valuations are captured.

Definition 73. The model of valuations M AP on AP is the structure M AP = (D, (P M AP ) p∈AP ) with D is the domain of all valuations on AP and the interpretation of P is defined by as

In what follows, we write P AP for the set of atomic predicates associated to some

Definition 74. Let β be a Boolean formula over AP. We define the first-order formula tr(β)(x) to be formula β in which each occurrence of p ∈ AP is replaced by P (x). Similarly, for a valuation w, we define tr(w)(x) for the formula describing w where all p are replaced by P (x).

Example 32. Let w = {p, q} a valuation over AP = {p, q, r}. tr(w)(x) = P (x) ∧ Q(x) ∧ ¬R(x).

We define a theory T AP such that M AP satisfies T AP and every model satisfying

Currently, in an arbitrary structure (D, (P M i ) p i ∈AP ), two distinct elements e, e in D may be such that e ∈ P M i iff e ∈ P M i for all p i ∈ AP. To prevent it, we define ϕ unique = ∀x∀y(x = y) ↔ p∈AP (P (x) ↔ P (y)). It says that two elements satisfy the same predicates (i.e. are the same valuation) iff they are equal. We define too ϕ exists says that for each valuation, for each atomic proposition p, there exists another valuation that differs only on p. In other words, ϕ exists = ∀x p∈AP ∃y (P (x) ↔ ¬P (y)) ∧ q∈AP,q =p (Q(x) ↔ Q(y)) , imposing all valuations to appear in the model. By letting T AP = {ϕ unique , ϕ exists }, we get the following.

Theorem 24. For all MMSO-models M , we have

Reminder on Complexity Classes

A.1 Classical classes

Through the manuscript, we analyze the complexity of many decision problems. First we define what a decision problem is.

Definition 79 (Decision problem).

A decision problem is a problem that only has two outputs for any input: yes or no. It will be presented in the following way.

• Input: . . .

• Output: yes if . . . , no otherwise.

Decision problems are naturally associated to the concept of Turing machines. They are automata, thus taking a word (the input) and saying yes/no, but expressive enough to capture all algorithms we can write.

Definition 80 (Turing machine). A Turing machine is a tuple M = (Q, Σ, Γ, δ, q 0 , q acc , q rej ) where:

• Q is the finite set of states of M ;

• Σ is the finite input alphabet;

• Γ is the finite tape alphabet with Σ ⊆ Γ;

• q 0 ∈ Q is the initial state, q acc ∈ Q the accepting state and q rej ∈ Q is the rejecting state;

Reminder on Uniform Strategies

The definitions from this chapter are inspired from [START_REF] Krzysztof | Lectures in game theory for computer scientists[END_REF]. For more information about game theory and uniform strategies, the reader may refer to this book. In particular, although here games are finite, the book considers infinite games.

B.1 Games with imperfect information

We consider the setting of two-player games such that one player does not have perfect knowledge of the state of the game whereas the other does. The reason is explained afterwards when winning strategies are defined. Such games are defined as follows.

Definition 85 (Game with imperfect information). A game with imperfect information is a tuple G = L, l I , L G , Σ, δ, O where:

• L is a finite set of states;

• l I is the initial state;

• L G ⊆ L is the set of winning states;

• Σ is a finite alphabet of actions;

• δ ⊆ L × Σ × L is the transition function;

• O is a partition of L called the observations.

Here we suppose that states in L G are end states, meaning there are no outgoing transitions from states in L G .

Intuitively, in such games, one player has not full knowledge of the current state of the game and plays the actions, and the other player chooses which transition is taken. The aim for the player controlling the action is to reach one of the states in L G , the goal of the other player is to avoid it.

Appendix C

Model Checking against ELCK is in

P

This Appendix is dedicated to the proof of the following theorem:

Theorem 28. The model checking problem against ELCK is in P.

The proof is an extension of the proof for CTL [START_REF] Baier | Principles of model checking[END_REF]. Indeed, CTL corresponds to ELCK with one agent and the until operator added. We just add here multi-agent aspects.

Let M = (W, (R a ) a∈Ag , V ) be a Kripke model. The algorithm of Figure C.1 computes the set of worlds W ϕ satisfying a formula ϕ. The correctness proof is direct for propositional constructions. For ϕ = K a ψ, we construct the set of worlds W satisfying ψ and compute the set of worlds W such that all a-successors fall in W , which corresponds to the set of worlds satisfying ψ. For ϕ = C G ψ, we first compute the set of worlds W satisfying ψ, and then repeat a loop where we remove the worlds from W with a successor by an agent of G which is not in W . In the end, as for the A operator for CTL, we obtain exactly the set of worlds satisfying C G ψ.

For the complexity of the algorithm, the only real matter is for case ϕ = C G ψ, since it contains a while loop. Notice that the while loop only removes worlds from W and stops when no world is removed in an iteration, therefore there is at most |W | loops, which remains polynomial.

Let W = setof worlds(M, ψ) Let p stop = ⊥ while ¬p stop : w,u,π 1 ) and relation no (w, u, π 2 ) case π = β?: if w = u ∨ w¬ |= P L β then accept else reject Star-free fragment proc in no (L, w)

accepts whenever for all k < i and w 1 , . . . , w k-1 , it is false that w

access yes (w, u, π a ) and in yes (L, u) and mc no (L, u, ψ)

) and in yes (L, u) and mc no (L, u, ψ)

accepts whenever for all k < i and w 1 , . . . , w k-1 , it is false that w

accepts whenever (W, w)

D.4 Non symbolic model checking

proc mc no (W, w, ϕ)

) and mc no (W, u, ψ) case ϕ = γ χ:

accepts if w = u and there do not exist v 1 , . . . , v k ∈ W L with k < i such that

proc exec * no (W, w, W , γ, i)

accepts whenever (W, w) γ i (W , w)

Proofs of Chapter 5 E.1 Proof of Proposition 15

We prove the following more general Lemma: Lemma 6. Let ϕ ∈ P AP L, γ be a protocol and M be a symbolic model. Let AP be such that AP(ϕ) ⊆ AP . Then:

where

We show H(ϕ) and H(γ) by mutual induction over ϕ and γ.

• ϕ = p: clearly U, u |= p iff U u , u |= p.

• ϕ = ¬ψ:

iff for all (a 1 , . . . , a m ) ∈ G, U u , u |= K a 1 . . . K am ψ (by repeating m times the previous reasoning and using H(ψ)). iff U u , u |= ϕ.

• ϕ = γ ψ: U, u |= ϕ iff there exists T ⊆ U such that (U, u) γ (T, u) and T, u |= ψ.

iff there exists T ⊆ U such that (U, u) γ (T, u) and T u , u |= ψ (by

iff there exists T such that T = U and T u = W and U, u |= ϕ. iff there exists T such that (U, u) ϕ? (T, u) and W = T u .

• γ = ϕ!:

-

Intuitively, T is the extension of W by taking values of u outside AP . We obtain directly that T

H(ϕ)

). We conclude that there exists T such that (U, u) ϕ! (T, u) and W = T u .

-If there exists T such that (U, u) ϕ! (T, u) and W = T u then w ∈ W iff there exists v ∈ T such that v = w. For such v, we have by definition of T , U, v |= ϕ, so

iff there exists T such that (U, u) γ 1 (T, u) and W = T u or there exists T such that (U, u) γ 2 (T, u) and W = T u (by H(γ 1 ) and H(γ 2 )). iff there exists T such that (U, u) γ 1 (T, u) or (U, u) γ 2 (T, u), and W = T u . iff there exists T such that (U, u) γ 1 ∪γ 2 (T, u) and W

Now we have AP(χ a ) ⊆ AP for all agents a ∈ G so we conclude by case γ = ϕ! that there exists T such that (U, u) a∈G Kaχa! (T, u) and T u = W .

E.2 Proof of Proposition 16

We first prove that for any Agent a and any two sets of valuations U ⊆ W ⊆ U , the two following statements are equivalent:

1. There exists an arbitrary-free formula ψ such that for any valuation w ∈ W ∩ U , (W, w) Kaψ! (U, w);

2. U = ∼ pre πa,W (post πa,W (U )).

We prove first prove that 1. implies 2. Suppose that there exists an arbitrary-free formula ψ such that for any valuation w ∈ W ∩U , (W, w) Kaψ! (U, w). We prove U = ∼ pre πa,W (post πa,W (U )) by double inclusion.

• First, notice that by definition of post πa,W (U ), any element u of U has all its π asuccessors in post πa,W (U ), so that u ∈ ∼ pre πa,W (post πa,W (U )). Therefore U ⊆ ∼ pre πa,W (post πa,W (U )).

• Second, let u ∈ ∼ pre πa,W (post πa,W (U )). By definition of ∼ pre πa,W , for any v π a -successor of u, we have v ∈ post πa,W (U ). As a consequence, for each of those v, there exists u ∈ U such that u πa -→ v. Since by assumption, for any valuation w ∈ W ∩ U , (W, w ) Kaψ! ---→ (U, w ), we have in particular W, u |= K a ψ. Since u πa -→ v, we also have W, v |= ψ. Because v is an arbitrary π a -successor of u, we can state that W, u |= K a ψ, so that u survives after the announcement K a ψ!, that is u ∈ U . We have shown that U ⊇ ∼ pre πa,W (post πa,W (W )), which achieves the proof of that 1. implies 2.

We now show that 2. implies 1. Suppose U = ∼ pre πa,W (post πa,W (W )). We show that there exists an arbitrary-free formula χ a such that (W, w) Kaχa! (U, w) for any w ∈ W ∩ U . We prove that the arbitraryfree formula χ a defined by

221

Clearly, for any world v, we have W, v |= χ a iff v ∈ post πa,W (U ). We have w ∈ U iff w ∈ ∼ pre πa,W (post πa,W (U )), iff for all π a -successor v ∈ W of w, we have v ∈ post πa,W (U ), iff for all v ∈ W , w πa -→ v implies W, v |= χ a iff W, w |= K a χ a . We conclude (W, w) Kaχa! (U, w).

We have just shown that the existence of a K a χ a -formula to announce is equivalent to the existence of a set of valuations U such that U = ∼ pre πa,W (post πa,W (U )). With the semantics of •! G ϕ, justifying the existence of K a ψ a -formulas for each a ∈ G that can be announced is equivalent to justifying the existence of sets U a such that U a = ∼ pre πa,W (post πa,W (U a )). Furthermore, (W, u) ( a∈G Kaψa)! ( a∈G U a , u). To conclude, searching for a formula of the form a∈G K a ψ a ! with W, u |= a∈G K a ψ a ! ϕ is equivalent to searching for U a such that U a = ∼ pre πa,W (post πa,W (U a )) and a∈G U a , u |= ϕ.