Tableau-based decision procedure for the multi-agent epistemic logic with all coalitional operators for common and distributed knowledge

Abstract

We develop a conceptually clear, intuitive, and feasible decision procedure
for testing satisfi?ability in the full multi-agent epistemic logic CMAEL(CD)
with operators for common and distributed knowledge for all coalitions of
agents mentioned in the language. To that end, we introduce Hintikka structures
for CMAEL(CD) and prove that satisfiability in such structures is equivalent to
satis?fiability in standard models. Using that result, we design an incremental
tableau-building procedure that eventually constructs a satisfying Hintikka
structure for every satisfi?able input set of formulae of CMAEL(CD) and closes
for every unsatisfi?able input set of formulae.

Full text

Page 1

Tableau-based decision procedure for the
multiagent epistemic logic with all coalitional
operators for common and distributed knowledge
Mai Ajspur1, Valentin Goranko2, and Dmitry Shkatov3
1Roskilde University, ajspur@ruc.dk,
2Technical University of Denmark and University of Johannesburg?,
vfgo@imm.dtu.dk
3University of the Witwatersrand, dmitry@cs.wits.ac.za
January 16, 2012
Abstract. We develop a conceptually clear, intuitive, and feasible de-
cision procedure for testing satisfiability in the full multiagent epistemic
logic CMAEL(CD) with operators for common and distributed knowl-
edge for all coalitions of agents mentioned in the language. To that end,
we introduce Hintikka structures for CMAEL(CD) and prove that sat-
isfiability in such structures is equivalent to satisfiability in standard
models. Using that result, we design an incremental tableau-building
procedure that eventually constructs a satisfying Hintikka structure for
every satisfiable input set of formulae of CMAEL(CD) and closes for
every unsatisfiable input set of formulae.
Keywords: multi-agent epistemic logic, satisfiability, tableau, decision proce-
dure
1 Introduction
Over the last three decades, multiagent epistemic logics [9], [27] have been play-
ing an increasingly important role in computer science and AI. The earliest
prominent applications have been to specification, design, and verification of
distributed protocols [23] and [24]; a number of other applications are described
in, among others, [9], [10], and [27]. The most recent, and perhaps more impor-
tant ones are to specification, design, and verification of multiagent systems — a
research area that has emerged on the borderline between distributed computing,
AI, and game theory [36], [45], [47].
1.1Multiagent epistemic logics and decision methods for them
Languages of multiagent epistemic logics considered in the literature contain var-
ious repertoires of epistemic operators. We refer to the basic multiagent epistemic
?Visiting professor
arXiv:1201.5346v1 [cs.LO] 25 Jan 2012

Page 2

logic, containing only operators of individual knowledge for a finite non-empty
set Σ of agents, as MAEL (Multi Agent Epistemic Logic). Since all epistemic
operators of this logic are S5-type modalities, it is also referred to in the litera-
ture as S5n, where n is the number of agents in the language. The logic obtained
from MAEL by adding the operator of common knowledge among all agents in
Σ is then called MAEL(C). This logic, along with MAEL, was studied in [25].
Analogously, if MAEL is augmented with the operator of distributed knowledge
for all agents, then the resulting logic will be called MAEL(D). It was studied
in [10] and [38]. MAEL augmented with operators of both common and dis-
tributed knowledge for the set of all agents, hereafter called MAEL(CD), was
studied in [39], and a tableau-based decision procedure for it was first presented
in [14]. Thus, all logics mentioned so far either do not have both operators of
common and distributed knowledge, or only have those operators for the whole
set of agents in the language.
At the same time, there has recently been an increasing interest in the study
of coalitional multiagent logics (see [30], [31], [32], [2], [40], [13]), i.e. logics whose
languages refer to any groups (coalitions) of agents. These are important, inter
alia, in multiagent systems, where agents may “cooperate” (i.e., form a coalition)
in order to achieve a certain goal. Most of the so far studied logical formalisms
referring to coalitions of agents have only been concerned with formalizing rea-
soning about strategic abilities of coalitions. (A notable exception is [40], where
the Alternating-time Temporal Epistemic Logic ATEL was introduced, whose
language contains both common knowledge and strategic operators for coali-
tions of agents.) Clearly, real cooperation can only be achieved by communica-
tion, i.e., exchange of knowledge. Thus, it is particularly natural and important
to consider multiagent epistemic logics with operators for both common and
distributed knowledge among any (non-empty) coalitions of agents. This is the
logic under consideration in the present paper, hereby called CMAEL(CD)
(for Coalitional Multi-Agent Epistemic Logic with operators of Common and
Distributed knowledge). It subsumes all multiagent epistemic logics mentioned
above, except ATEL.
In order to be practically useful for such tasks as specification and design of
distributed or multiagent systems, the respective logic need to be equipped with
algorithms solving (constructively) its satisfiability problem, i.e. testing whether
a given input formula ϕ of that logic is satisfiable and, if so, providing enough
information for the construction of a model for ϕ. Decidability of modal log-
ics, including epistemic logics, is usually proved by establishing a ‘small model
property’, which provides a brute force decision procedure consisting of exhaus-
tive search for a model amongst all those whose size is within the theoretically
prescribed bounds. The two most common practically feasible general methods
for satisfiability checking of modal logics are based on automata [41] and on
tableaux (see e.g., [33], [3], [11], [46], [8], [19], [12]).
There are various styles of tableau-based decision procedures; see [11], [19]
and [12] for detailed exposition and surveys. An easy to describe but some-
what less efficient and practically unfeasible approach, that we will call maximal
2

Page 3

tableau (also called top-down in [8]), consists in trying to build in one step a
‘canonical’ finite model for any given formula out of all maximal consistent sub-
sets of the closure of that formula. This method always works in (at least) expo-
nential time and usually produces a wastefully large model, if any exists. A more
flexible and more practically applicable version, adopted in the present paper,
is a so called incremental (aka, ‘bottom-up’) tableau building procedure. While
in all known cases, the worst-case time complexity for maximal and incremental
tableaux are the same, the crucial difference is that maximal tableaux always
require the amount of resources predicted by the theoretical worst-case time
estimate, while incremental tableaux work on average much more efficiently4.
1.2 Related work and comparison
The present work is part of a series of papers ([17],[14],[18],[15]) where we have
embarked on the project of developing practically efficient yet intuitive and con-
ceptually clear incremental-tableau-based satisfiability checking procedures for
a range of multiagent logics. This paper builds on the conference papers [14] and
[18] by substantially extending, revising, and improving them.
There are three inherent complications affecting the construction of a tableau
procedure for the logic CMAEL(CD), arising respectively from the common
knowledge (fixpoint-definable operator), the distributed knowledge (with associ-
ated epistemic relation being the intersection of the individual knowledge epis-
temic relations), and the interactions between the knowledge operators over dif-
ferent coalitions of agents.
Several tableau-based methods for satisfiability-checking for modal logics
with fixpoint-definable operators have been developed and published over the
past 30 years, all going back to the tableau-based decision methods developed
for the Propositional Dynamic Logic PDL in [34], for the branching-time tem-
poral logics UB in [3] and CTL in [8, Section 5] and [7]. In terms of handling
eventualities arising from the fixed-point operators our tableau method follows
more closely on the incremental tableaux for the linear time temporal logic LTL
in [46] and for CTL in [8, Section 7].
A particular complication arising in the tableau for CMAEL(CD) stems
from the fact that the epistemic operators, being S5 modalities, are symmetric,
and thus the epistemic boxes have global effect on the model, too. This requires
a special mechanism for propagating their effect backwards when occurring in
states of the tableau. In the present paper we have chosen to implement such
mechanism by using analytic cut rules, going back to Smullyan [37] and Fitting
[11], see also [19] and [28]. More recently, tableaux with analytic cut rules for
modal logics with symmetric relations have been developed in [21], [20], [5].
4This claim can not be made mathematically precise due to the lack of an a priori
probability distribution on formulae of a logic. The interested reader may consult [17]
for comparison of efficiency of the two types of tableaux in the context of Alternating-
time temporal logic ATL.
3

Page 4

We note that there is a natural tradeoff between conceptual clarity and sim-
plicity of (tableau-based) decision procedures on the one hand, and their tech-
nical sophistication and optimality on the other hand. We emphasize that the
main objective of developing the tableau procedure presented here is the con-
ceptual clarity, intuitiveness, and ease of implementation, rather than practical
optimality. While being optimal in terms of worst-case time complexity and in-
corporating some new and non-trivial optimizing features (such as restricted
applications of cut rules) this procedure is amenable to various improvements
and further optimizations. Most important known such optimizations are on-
the-fly techniques for elimination of bad states and one-pass tableau methods
developed for some related logics in [35], [1] and cut-free versions of tableau as
in [1] for MAEL(C), [22] for PDL with converse operators, [29] for the de-
scription logic SHI and of sequent calculi, in [26] for MAEL(C) and in [4] for
LTL and CTL. We discuss briefly the possible modifications of our procedure,
implementing such optimizing techniques in Section 6.
Here is a summary (in a roughly chronological order) of the more closely
related previous work, besides our own, on tableau-based decision procedures
for multiagent epistemic logics with common and/or distributed knowledge:
– the maximal tableaux for MAEL(C), presented in [25];
– the semantic construction used in [10, Appendix A1] to prove completeness
of an axiomatic system for MAEL(D);
– the proof of decidability of MAEL(CD) based on finite model property via
filtration in [39];
– the maximal tableau-like decision procedure for ATL, presented in [44] and
extended to ATEL in [43];
– the exponential-time tableau-based procedure developed in [6] for testing sat-
isfiability in the BDI logic, that has some common features with CMAEL(C);
– the optimized cut-free single-pass tableaux for the multi-agent logic of com-
mon knowledge MAEL(C), in [1]. on tableaux for multiagent logics using
global caching and analytic cuts in [5].
1.3Structure of the paper
In Section 2, we introduce the syntax and semantics of the logic CMAEL(CD).
In Section 3, we introduce Hintikka structures for CMAEL(CD) and show that
Hintikka structures are equivalent to Kripke models with respect to satisfiability
of formulae. Then, in Section 4, we develop the tableau procedures checking for
satisfiability of formulae of CMAEL(CD). In Section 5, we prove the correct-
ness of our procedure in Section 6 we estimate its complexity, discuss it efficiency
and indicate some possible technical improvements. We end with concluding re-
marks pointing out some directions for further development.
4

Page 5

2 Syntax and semantics
2.1 Syntax of CMAEL(CD)
The language of CMAEL(CD) contains a fixed, at most countable, set AP
of atomic propositions, typically denoted by p,q,r,...; a finite, non-empty set
Σ of (names for) agents5, typically denoted by a,b,..., while sets of agents,
called coalitions, will be usually denoted by A,B,...; a sufficient repertoire of
the Boolean connectives, say ¬ (“not”) and ∧ (“and”); and, for every non-empty
coalition A, the epistemic operators DA(“it is distributed knowledge among A
that ...”) and CA(“it is common knowledge among A that ...”). The formulae
of CMAEL(CD) are thus defined by the following BNF expression:
ϕ := p | ¬ϕ | (ϕ1∧ ϕ2) | DAϕ | CAϕ,
where p ranges over AP and A ranges over the set P+(Σ) of non-empty subsets of
Σ. The other Boolean connectives can be defined as usual. We denote formulae
of CMAEL(CD) by ϕ,ψ,χ,... and omit parentheses in formulae whenever it
does not result in ambiguity.
The distributed knowledge operator DAϕ intuitively means that an “A-
superagent”, who knows everything that any of the agents in A knows, can
obtain ϕ as a logical consequence of their knowledge. For example, if agent a
knows that ψ and agent b knows that ψ → χ, then D{a,b}χ is true even though
neither a nor b knows χ. The operators of individual knowledge Kaϕ (“the agent
a knows that ϕ”), for a ∈ Σ, can be defined as D{a}ϕ, henceforth simply written
Daϕ. Then, we define KAϕ :=?
knowledge” among A, i.e., that every agent in A knows that ϕ and knows that
every agent in A knows that ϕ, etc. Formulae of the form ¬CAϕ are referred to
as (epistemic) eventualities, for the reasons given later on.
a∈ADaϕ.
The common knowledge operator CAϕ intuitively means that ϕ is “public
2.2Coalitional multiagent epistemic models
Formulae of CMAEL(CD) are interpreted in coalitional multiagent epistemic
models. In order to define those, we first need to introduce coalitional multiagent
epistemic structures and frames.
Definition 1. A coalitional multiagent epistemic structure (CMAES) is a tuple
G = (Σ,S,{RD
A}A∈P+(Σ),{RC
A}A∈P+(Σ))
where
5The notion of agent used in the present paper is an abstract one; in the context
of distributed systems, for example, agents can be thought of as processes making
up the system; in the context of multiagent systems, they can be thought of as
independent software components of the system.
5

Page 6

1. Σ is a finite, non-empty set of agents6;
2. S ?= ∅ is a set of states;
3. for every A ∈ P+(Σ), RD
4. for every A ∈ P+(Σ), RC
Ais a binary relation on S;
Ais the reflexive, transitive closure of?
B⊆ARD
B.
Definition 2. A coalitional multiagent epistemic frame (CMAEF) is a CMAES
F = (Σ,S,{RD
A}A∈P+(Σ),{RC
A}A∈P+(Σ)),
where each RD
Ais an equivalence relation satisfying the following condition:
A=?
(Here, and further, we write RD
If condition (†) above is replaced by the following, weaker one:
(††) RD
then F is a coalitional multiagent epistemic pseudo-frame (pseudo-CMAEF).
(†) RD
ainstead of RD
a∈ARD
{a}, where a ∈ Σ.)
a
A⊆ RD
Bwhenever B ⊆ A,
Note that in every (pseudo-)CMAEF RD
a∈ARD
to requiring that RC
Also, note that each RC
A⊆?
a∈ARD
a, and hence?
a∈ARD
B⊆ARD
B=
?
a. Hence, condition 4 of Definition 1 in (pseudo-) CMAEFs is equivalent
Ais the transitive closure of?
a, for every A ∈ P+(Σ).
Ain a (pseudo-)CMAEF is an equivalence relation.
Definition 3. A coalitional multiagent epistemic model (CMAEM) is a tuple
M = (F,AP,L), where F is a CMAEF with a set of states S, AP is a set of atomic
propositions, and L : S ?→ P(AP) is a labeling function, assigning to every state
s the set L(s) of atomic propositions true at s.
If F is a pseudo-CMAEF, then M = (F,AP,L) is a multiagent coalitional
pseudo-model (pseudo-CMAEM).
The notion of truth, or satisfaction, of a CMAEL(CD)-formula at a state
of a (pseudo-)CMAEM is defined in the standard Kripke semantics style. In
particular:
– M,s ? DAϕ iff (s,t) ∈ RD
– M,s ? CAϕ iff (s,t) ∈ RC
Aimplies M,t ? ϕ;
Aimplies M,t ? ϕ.
Definition 4. Given a (pseudo-)CMAEM M, a CMAEL(CD)-formula ϕ is
satisfiable in M if M,s ? ϕ holds for some s ∈ M; ϕ is valid in M if M,s ? ϕ
holds for every s ∈ M.
A formula ϕ is satisfiable if it is satisfiable in some CMAEM; it is valid,
denoted ? ϕ, if it is valid in every CMAEM.
6Notice that we use the same symbol, “Σ”, both for the set of names of agents in
the language and for the set of agents in CMAES’s. It will always be clear from the
context which set we refer to.
6

Page 7

The satisfaction condition for the operator CAcan be re-stated in terms of
reachability. Let M be a (pseudo-)CMAEM with state space S and let s,t ∈ S.
We say that t is A-reachable from s if either s = t or, for some n ≥ 1, there
exists a sequence s = s0,s1,...,sn−1,sn= t of elements of S such that, for every
0 ≤ i < n, there exists ai∈ A such that (si,si+1) ∈ RD
that the satisfaction condition for CAis equivalent to the following one:
ai. It is then easy to see
– M,s ? CAϕ iff M,t ? ϕ for every t that is A-reachable from s.
The following claim be easily verified.
Proposition 1. ? CAϕ ↔ (ϕ ∧?
Remark If Σ = {a}, then Daϕ ↔ Caϕ is valid for all ϕ. Thus, the single-
agent case is essentially trivialized and, therefore, we assume throughout the
remainder of the paper that the set Σ of names of agents in the language of
CMAEL(CD) contains at least 2 agents.
a∈ADaCAϕ).
3 Hintikka structures for CMAEL(CD)
We are ultimately interested in (constructive) satisfiability of (finite sets of)
formulae in models. However, the tableau procedure we present in this paper
checks for the existence of a more general kind of semantic structure for the
input formula, namely a Hintikka structure. In Section 3.1, we introduce Hin-
tikka structures for CMAEL(CD). In Section 3.2 we show that satisfiability in
Hintikka structures is equivalent to satisfiability in models; consequently, testing
for satisfiability in a Hintikka structure can replace testing for satisfiability in a
model.
3.1 Fully expanded sets and Hintikka structures
There are two fundamental differences between (pseudo-)models and Hintikka
structures for CMAEL(CD), which make working with the latter substantially
easier than working directly with models. First, while models specify the truth
value of every formula of the language at each state, Hintikka structures only do
so for the formulae relevant to the evaluation of a fixed formula θ (or, a finite
set of formulae Θ) at a distinguished state. Second, the relations in (pseudo-)
models have to satisfy certain conditions (see Definition 2), while in Hintikka
structures conditions are only placed on the labels of states. These labeling
conditions ensure, however, that every Hintikka structure generates, through
the constructions described in Section 3.2, a pseudo-model so that membership
of formulae in the labels is compliant with the truth in the resultant pseudo-
model. We then show how to convert a pseudo-model into a bona fide model in
a “truth-preserving” way.
To describe Hintikka structures, we need the concept of fully expanded set.
Such sets contain all the formulae that have to be satisfied locally at the state un-
der consideration. We divide all the formulae that are not elementary in the sense
7

Page 8

that their satisfaction at the state does not imply satisfaction of any other formu-
lae at the same state (such as p ∈ AP or ¬DAϕ) into α-formulas and β-formulas.
The former are formulae of a conjunctive type, i.e. their truth implies the truth
of all their α-components at the same state, while the latter are of a disjunctive
type: their truth implies the truth of at least one of their β-components at the
same state. Table 3.1 shows the α- and β-formulas of CMAEL(CD) together
with their α- and β-components. The following claims are straightforward, the
cases of common knowledge using Proposition 1.
α-formula
¬¬ϕ
ϕ ∧ ψ
DAϕ
CAϕ
α-components
{ϕ}
{ϕ,ψ}
{DAϕ,ϕ}
{ϕ} ∪ {DaCAϕ | a ∈ A}
β-formula
¬(ϕ ∧ ψ)
¬CAϕ
β-components
{¬ϕ,¬ψ}
{¬ϕ} ∪ {¬DaCAϕ | a ∈ A}
Table 1. α- and β-formulas of CMAEL(CD) with their respective components
Lemma 1. 1. Every α-formula is equivalent to the conjunction of its α-components.
2. Every β-formula is equivalent to the disjunction of its β-components.
Definition 5. The closure of the formula ϕ is the smallest set of formulae cl(ϕ)
such that:
1. ϕ ∈ cl(ϕ);
2. cl(ϕ) is closed with respect to α- and β-components of all α- and β-formulae,
respectively;
3. for any formula ψ and coalition A, if ¬DAψ ∈ cl(ϕ) then ¬ψ ∈ cl(ϕ).
Definition 6. For any set of formulae ∆ we define cl(∆) :=?{cl(ϕ) | ϕ ∈ ∆}.
A set of formulae ∆ is closed if ∆ = cl(∆).
Remark 1. Intuitively, the closure of a set of formulae Γ consists of all formulae
that may appear in the tableau whose input is the set of formulae Γ.
Definition 7. A set of formulae is patently inconsistent if it contains a con-
tradictory pair of formulae ϕ and ¬ϕ.
Definition 8. A set ∆ of CMAEL(CD)-formulae is fully expanded if it sat-
isfies the following conditions:
– ∆ is not patently inconsistent;
– if ϕ is an α-formula and ϕ ∈ ∆, then all α-components of ϕ are in ∆.
– if ϕ is a β-formula and ϕ ∈ ∆, then at least one β-component of ϕ is in ∆.
8

Page 9

Intuitively, a non-patently inconsistent set is fully expanded if it is closed un-
der applications of all local (pertaining to the same state of a structure) formula
decomposition rules.
Definition 9. The procedure FullExpansion applies to a set of formulae Γ
and produces a (possibly empty) family of sets FE(Γ), called the family of full
expansions of Γ, obtained as follows: start with the singleton family {Γ}; if Γ
is patently inconsistent, halt and return FE(Γ) = ∅; otherwise repeatedly apply,
until saturation, the following set replacement operations, each time to a non-
deterministically chosen set Φ from the current family of sets F and a formula
ϕ ∈ Φ; though, we prioritize the eventualities in Γ so that these formulae are
processed first:
1. If ϕ is an α-formula with α-components ϕ1and ϕ2, then replace Φ by Φ ∪
{ϕ1,ϕ2}.
2. If ϕ is a β-formula such that none of its β-components is in Φ, then replace
Φ with the family of extensions
{Φ ∪ {ψ} | ψ is a β-component of ϕ}
3. If ϕ = ¬CAψ and ¬ψ / ∈ Φ, but some of the other β-components of ϕ is in
Φ, then add to F the set Φ ∪ {¬ψ}
The following proviso applies to the procedure above: if a patently inconsistent
set is added to F as a result of such application, it is removed immediately
thereafter.
Saturation occurs when no application of a set replacement operation can
change the current family F. At that stage, the family FE(Γ) of sets of formulae
is produced and returned. Reaching a stage of saturation is guaranteed to occur
because all sets of formulae produced during the procedure FullExpansion are
subsets of the finite set cl(Γ).
Notice that the procedure FullExpansion allows adding not more than one
β-component of a formula ϕ = ¬CAψ to the initial set, besides ¬ψ.
In what follows, we will need the following proposition.
Proposition 2. For any finite set of formulae Γ:
?
Proof. By Lemma 1, every set replacement operation applied to a family F
preserves the formula?{?∆ | ∆ ∈ FE(Γ)} up to logical equivalence. At the
We now define Hintikka structures for CMAEL(CD):
?
Γ ↔
???
∆ | ∆ ∈ FE(Γ)
?
.
beginning, that formula is?Γ, hence the claim follows.
Definition 10. A coalitional multiagent epistemic Hintikka structure (CMAEHS)
is a tuple
(Σ,S,{RD
such that:
A}A∈P+(Σ),{RC
A}A∈P+(Σ),AP,H)
9

Page 10

– (Σ,S,{RD
– AP is a set of atomic propositions;
– H is a labeling of the elements of S with sets of CMAEL(CD)-formulae
that satisfy the following constraints, for every s,s?∈ S:
CH1 H(s) is fully expanded;
CH2 If ¬DAϕ ∈ H(s), then (s,t) ∈ RD
CH3 If (s,s?) ∈ RD
CH4 If ¬CAϕ ∈ H(s), then (s,t) ∈ RC
Definition 11. Let H be a CMAEHS with state space S. A CMAEL(CD)-
formula θ is satisfiable in H if θ ∈ H(s), for some s ∈ S. Likewise, a set of
CMAEL(CD)-formulae Θ is satisfiable in H if Θ ⊆ H(s), for some s ∈ S.
A}A∈P+(Σ),{RC
A}A∈P+(Σ)) is a CMAES (recall Definition 1);
Aand ¬ϕ ∈ H(t), for some t ∈ S;
A, then DBϕ ∈ H(s) iff DBϕ ∈ H(s?), for every B ⊆ A;
Aand ¬ϕ ∈ H(t), for some t ∈ S.
3.2Equivalence of Hintikka structures and models for CMAEL(CD)
Here we show that satisfiability in Hintikka structures is equivalent to satisfia-
bility in models. For brevity, we only deal with single formulae; the extension to
finite sets of formulae is straightforward. The main complications in the proofs
below arise due to the presence of distributed knowledge operators in the lan-
guage of a logic.
Here we will prove that a CMAEL(CD)-formula θ is satisfiable in a CMAEM
iff it is satisfiable in a CMAEHS. First, we show that satisfiability in a CMAEM
implies satisfiability in a CMAEHS. Then, we show that satisfiability in a CMAEHS
implies satisfiability in a pseudo-CMAEM, which in turn implies satisfiability in
a CMAEM.
That satisfiability in a CMAEM implies satisfiability in a CMAEHS is almost
immediate. Given a CMAEM M with a set of states S, define the extended
labeling function L+
Mfrom S to the power-set of CMAEL(CD)-formulae as
follows: L+
M(s) = {ϕ | M,s ? ϕ}. It is then routine to check the following.
Lemma 2. Let M = (Σ,S,{RD
satisfying θ and let L+
{RC
CMAEM implies satisfiability in a CMAEHS.
A}A∈P+(Σ),{RC
A}A∈P+(Σ),AP,L) be a CMAEM
Mbe the extended labeling on M. Then, (Σ,S,{RD
A}A∈P+(Σ),AP,L+
A}A∈P+(Σ),
M) is a CMAEHS satisfying θ. Therefore, satisfiability in a
For the converse direction we need two steps, done in Lemma 3 and Lemma 4.
Lemma 3. Let θ be a CMAEL(CD)-formula satisfiable in a CMAEHS. Then,
θ is satisfiable in a pseudo-CMAEM.
Proof. Let H = (Σ,S,{RD
θ. We construct a pseudo-CMAEM M?satisfying θ out of H as follows.
First, for every A ∈ P+(Σ), let R?D
sitive closure of?
R?C
A}A∈P+(Σ),{RC
A}A∈P+(Σ),AP,H) be an CMAEHS for
Abe the reflexive, symmetric, and tran-
Band let R?C
Aand R?C
A, for every A ∈ P+(Σ). Second, let L(s) = H(s) ∩ AP, for every s ∈ S.
A⊆BRD
Abe the transitive closure of?
a∈AR?D
a.
A⊆
Thus, both R?D
Aare equivalence relations and RD
A⊆ R?D
Aand RC
10

Page 11

It is then immediate to check that B ⊆ A implies R?D
M?= (Σ,S,{R?D
Basically this construction relabels the edges of a Hintikka structure such
that if a directed edge is labelled with a coalition A, it is made bidirectional and
is further labelled with all coalitions that are subsets of A. Hereafter the relation
is then made transitive and reflexive. The labels of the states are reduced to only
containing (positive) atoms. Figure 1 illustrates the process of transforming the
Hintikka structure on the left into the pseudo-model on the right.
A
⊆ R?D
B, and hence,
A}A∈P+(Σ),{R?C
A}A∈P+(Σ),L) is a pseudo-CMAEM.
{¬Da¬p,Dbq,q}
{a},{b}
??
{a,b}??{Dbq,q,¬C{a,b}r,¬r}
{a,b}
??
{¬¬p,p,Dbq,q}
;
{q}
{a, b},
{a}, {b}
??
??
{a},{b}
??
??
{a, b},
{a}, {b}??{q}
{a, b},
{a}, {b}
??
{p.q}
??
{a,b},{a},{b}
??
{a},{b}
??
Fig.1. Example on transforming a Hintikka structure to a pseudo-model using the
construction from the proof of Lemma 3
To complete the proof of the lemma, we show, by induction on the structure
of the formulae in cl(θ) that, for every s ∈ S and every formula χ, the following
hold:
(i) χ ∈ H(s) implies M?,s ? χ;
(ii) ¬χ ∈ H(s) implies M?,s ? ¬χ.
The statement of the lemma then follows.
Let χ be some p ∈ AP. Then, p ∈ H(s) implies p ∈ L(s) and, thus, M?,s ? p;
if, on the other hand, ¬p ∈ H(s), then due to (CH1), p / ∈ H(s) and thus p / ∈ L(s);
hence, M?,s ? ¬p.
Assume that the claim holds for all subformulae of χ; then, we have to prove
that it holds for χ, as well.
Suppose that χ is ¬ϕ. If ¬ϕ ∈ H(s), then the inductive hypothesis immedi-
ately gives us M?,s ? ¬ϕ; if, on the other hand, ¬¬ϕ ∈ H(s), then by virtue
of (CH1), ϕ ∈ H(s) and hence, by inductive hypothesis, M?,s ? ϕ and thus
M?,s ? ¬¬ϕ.
The case of χ = ϕ ∧ ψ is straightforward, using (CH1).
Suppose that χ is DAϕ. Assume, first, that DAϕ ∈ H(s). In view of the
inductive hypothesis, it suffices to show that (s,t) ∈ R?D
assume that (s,t) ∈ R?D
conclusion immediately follows from (CH1). If, on the other hand, s ?= t, then
there exists an undirected path between s and t along the relations of the form
Aimplies ϕ ∈ H(t). So,
A. There are two cases to consider. If s = t, then the
11

Page 12

RD
hence, by (CH1), ϕ ∈ H(t), as desired.
Assume, next, that ¬DAϕ ∈ H(s). In view of the inductive hypothesis, it
suffices to show that there exists t ∈ S such that (s,t) ∈ R?D
(CH2), there exists t ∈ S such that (s,t) ∈ RD
the desired conclusion follows.
Suppose now that χ is CAϕ. Assume that CAϕ ∈ H(s). In view of the
inductive hypothesis, it suffices to show that if t is A-reachable from s in M?,
then ϕ ∈ H(t). So, assume that either s = t or, for some n ≥ 1, there exists a
sequence of states s = s0,s1,...,sn−1,sn= t such that, for every 0 ≤ i < n,
there exists ai∈ A such that (si,si+1) ∈ R?D
conclusion follows from (CH1). In the latter, we can show by induction on i, for
0 ≤ i < n, using (CH3) and (CH1), that DaiCAϕ ∈ H(si). Then, in particular,
Dan−1CAϕ ∈ H(sn−1), and again, by (CH3), Dan−1CAϕ ∈ H(t) and thus by
(CH1), CAϕ ∈ H(t) and ϕ ∈ H(t).
Assume, on the other hand, that ¬CAϕ / ∈ H(s). Then, the desired conclusion
follows from (CH4), the inclusion RC
B, where each B is a superset of A. Then, in view of (CH3), DAϕ ∈ H(t);
Aand ¬ϕ ∈ H(t). By
Aand ¬ϕ ∈ H(t). As RD
A⊆ R?D
A,
ai. In the former case, the desired
A⊆ R?C
A, and the inductive hypothesis.
We now prove that satisfiability in a pseudo-CMAEM implies satisfiability
in a CMAEM. To that end, we use a modification of the construction from [10,
Appendix A1] to show that if θ is satisfiable in a pseudo-CMAEM, then it is
satisfiable in a “tree-like” pseudo-CMAEM that actually turns out to be a bona
fide CMAEM. To present the proof, we need some preliminary definitions.
Definition 12. Let M = (Σ,S,{RD
CMAEM and let s,t ∈ S. A maximal path from s to t in M is a sequence
s0,A0,s1,A1,...,sn−1,An−1,snwhere s = s0and t = sn, such that n = 0 and
s = t or, for every 0 ≤ i < n, (si,si+1) ∈ RD
hold for any B with Ai⊂ B ⊆ Σ. A segment ρ?of a maximal path ρ starting
and ending with a state is a sub-path of ρ.
A}A∈P+(Σ),{RC
A}A∈P+(Σ),AP,L) be a (pseudo-)
Ai, but (si,si+1) ∈ RD
Bdoes not
Notice that, in general, there might be several maximal paths between a pair
of states.
For a path τ = s0,A0,s1,...,sn−1,An−1,sn, we denote by τ|ithe sub-path
of τ starting in s0and ending in si, i.e. τ|i= s0,A0,s1,...,Ai−1,siand by |τ|
the length of τ, i.e. n. We denote the last element of a path τ, which is a state,
by l(τ) and the second last element of τ, which is a coalition, by sl(τ).
Lemma 4. Let θ be a CMAEL(CD)-formula satisfiable in a pseudo-CMAEM;
then, θ is satisfiable in a CMAEM.
Proof. Suppose that θ is satisfied in a pseudo-CMAEM M at state s. Let
Ms= (Σ,S,{RD
ated by s. Then, Ms,s ? θ since Msand M are locally bisimilar at s. Next, we
unravel Msinto a model M∗= (Σ,S∗,{R∗D
as follows.
A}A∈P+(Σ),{RC
A}A∈P+(Σ),AP,L) be the submodel of M gener-
A}A∈P+(Σ),{R∗C
A}A∈P+(Σ),AP,L∗),
12

Page 13

First, call a maximal path ρ in Msan s-max-path if the first component of
ρ is s, and let S∗be the set of all s-max-paths in Ms. Notice that s by itself is
an s-max-path with l(s) = s.
For every A ∈ P+(Σ), let
R?D
i.e. (ρ,τ) ∈ R?D
A. Next, let R∗D
that (ρ,τ) ∈ R∗D
ρ0,...,ρn∈ S∗with ρ = ρ0and τ = ρnsuch that for all i < n, either (ρi,ρi+1) ∈
R?D
condition holds:
A= {(ρ,τ) | ρ,τ ∈ S∗, τ||τ|−1= ρ and sl(τ) ⊇ A},
Aif τ extends ρ with one step labelled by a coalition containing
Abe a reflexive, symmetric, and transitive closure of R?D
Aholds for two distinct paths ρ and τ iff there exists a sequence
A. Notice
Aor (ρi+1,ρi) ∈ R?D
A. It then follows that the following downward closure
(DC) If (ρ,τ) ∈ R∗D
The relations R∗C
of M∗, we put L∗(ρ) = L(l(ρ)), for every ρ ∈ S∗. Notice that M∗is tree-like in
the sense that the structure (S∗,{R?D
By this construction we basically remove all ‘non-maximal’ edges between
two vertices from the part of the given pseudomodel that can be reached by
the given state s. Then we build paths by starting in s and then traversing the
resulting graph via the edges. E.g., if we consider the pseudo-model M in Figure
1, and we let the top-left-most state be s, then M,s ? ¬Da¬p∧Dbq. S∗will in
this case be all paths starting in s and following the links in the graph.
Aand B ⊆ A, then (ρ,τ) ∈ R∗D
Aare defined as in any CMAEF. To complete the definition
B.
A}A∈P+(Σ)) is a tree.
s
{a,b}
??
??
{a},{b}
??
??
{a,b}??r
{a,b}
??
t
{a,b}
??
??
{a},{b}
??
I.e. ρ = (s,{a,b},s,{a},t) and τ = (s,{a,b},r,{b},t) are in S∗, while ρ?=
(s,{a},s,{b},t) / ∈ S∗.
We have (ρ,τ) / ∈ R∗D
(τ,(s,{a,b},r,{a,b},s)) ∈ R∗D
In this example, L∗(ρ) = L∗(τ)= L(t) = {p,q}.
It is clear from the construction, namely from (DC), that M∗is a pseudo-
CMAEM, and in the following, we will show that condition (†) of Definition 2
also holds, so that M∗is a CMAEM.
First, we notice that, since M∗is tree-like, we have (ρ,τ) ∈ R∗D
exists k ≥ 0, with k ≤ |ρ| and k ≤ |τ|, such that
a, (ρ,τ) / ∈ R∗D
b.
band (ρ,τ) / ∈ R∗D
a,b. On the other hand,
def.
Aiff there
ρ|k= τ|k, and
for all k < i ≤ |τ| and k < j ≤ |ρ|,A ⊆ sl(τ|i) and A ⊆ sl(ρ|j).
(1)
13

Page 14

rs
`
` ... `r l(ρ|k) = l(τ|k)
⊇ A
⊇ A
` ... `
⊇ A
`⊇ A`
⊇ A
r l(τ)
` ... ` ⊇ A `r
l(ρ|n−1)
⊇ Ar l(ρ)
Fig.2. The situation from (1) drawn in M, i.e. the dots/circles belongs to S, and the
links are links in RD
(The situation is depicted in Figure 2.) As stated, we have to prove that
R∗D
follows from (DC). For the converse, assume that (ρ,τ) ∈ R∗D
a ∈ A. Then, for every a ∈ A, according to (1), there exists ka≥ 0 such that
ρ|ka= τ|kaand {a} ⊆ sl(τ|i),sl(ρ|j) for every |τ| ≥ i > kaand every |ρ| ≥ j > ka.
Now, let k be the largest kasatisfying this condition (such a k exists since M∗
is tree-like). Then, ρ|k= τ|k, and for every a ∈ A, the inclusions {a} ⊆ sl(τ|i)
and {a} ⊆ sl(ρ|j) hold for every |τ| ≥ i > k and every |ρ| ≥ j > k. Therefore,
condition (1) is fulfilled for A and k, and hence (ρ,τ) ∈ R∗D
Finally, it remains to prove that M∗satisfies θ. From (1) we see, that if
(ρ,τ) ∈ R∗D
It is now easy to check that the relation Z = {(ρ,l(ρ)) | ρ ∈ S∗} is a bisimulation
between M∗and Ms. Since (s,l(s)) ∈ Z, it follows that M∗,s ? θ, and we are
done.
A=?
a∈AR∗D
afor every A ∈ P+(Σ). The left-to-right inclusion immediately
aholds for every
A, as desired.
A, then (l(ρ),l(τ)) ∈ RD
A, since every RD
Ais an equivalence relation.
Theorem 1. Let θ be a CMAEL(CD)-formula. Then, θ is satisfiable in a
CMAEHS iff it is satisfiable in a CMAEM.
Proof. Immediate from Lemmas 2, 3, and 4.
4Tableau procedure for testing satisfiability in
CMAEL(CD)
In this section, we present our tableau algorithm for checking (constructive) sat-
isfiability of formulae of CMAEL(CD). We start off by explaining the general
philosophy underlying our tableau procedure and then present it in detail.
4.1Basic ideas and overview of the tableau procedure
Traditionally, the propositional tableau method works by decomposing the for-
mula whose satisfiability is being tested into its α-, resp. β- components – re-
peatedly, until producing all full expansions of that formula. All these compo-
nents belong to the closure of the input formula. When the closure is finite (as
it is usually the case with modal and temporal logics) the termination of the
tableau-building procedure is guaranteed because there are only finitely many
full expansions.
14

Page 15

Furthermore, in the tableau method for the classical propositional logic that
decomposition into components produces a tree representing an exhaustive search
for a Hintikka set, the propositional analogue of Hintikka structures, for the in-
put formula. If at least one branch of the tree remains open, it produces a full
expansion of the input formula, which is a Hintikka set for this formula. In this
case, the formula is pronounced satisfiable; otherwise, it is declared unsatisfiable.
In the case of modal and temporal logics, local decomposition steps, producing
full expansions, are interleaved with steps along the accessibility/transition re-
lations, producing sets of formulae that are supposed to be true at successors of
the current state. These sets are subjected, again, to local decomposition into
components, eventually producing their full expansions, etc. In order to distin-
guish fully expanded sets from those produced after transition to successors, we
will deal with two types of nodes of the tableau, respectively called ‘states’ and
‘prestates’. In order to ensure termination of the construction process, we will
systematically reuse states and prestates labelled with the same sets of formulae.
The tableau procedure for testing a formula θ for satisfiability attempts to
construct a non-empty graph Tθ(called itself a tableau) representing “sufficiently
many” CMAEHSs for θ in the sense that if θ is satisfiable in any CMAEHS, then
it is satisfiable in a CMAEHS represented by the tableau. The procedure consists
of three major sub-procedures, or phases: construction, prestate elimination, and
state elimination. During the construction phase, we build the pretableau Pθ—
a directed graph whose nodes are sets of formulae of two types: states7and
prestates, as explained above. States represent (labels of) states of the CMAEHSs
that the tableau attempts to construct, while prestates are only used temporarily,
during the construction phase.
During the prestate elimination phase, we create a smaller graph Tθ
Pθ, called the initial tableau for θ, by eliminating all the prestates of Pθand
adjusting its edges, as prestates have already fulfilled their role of keeping the
graph finite and can, therefore, be discharged.
In the case of classical propositional logic, the only reason why it may turn
out to be impossible to produce a Hintikka set for the input formula is that
every attempt to build such a set results in a collection of formulae containing a
patent inconsistency. In the case of logics with fixpoint-definable operators, such
as CMAEL(CD), there are two other reasons for a tableau not to correspond
to any Hintikka structure for the input formula. The first one has to do with
realization of eventualities —formulas of the form ¬CAϕ, whose truth condition
requires that ¬ϕ “eventually” becomes true — in the tableau graph. Apply-
ing decomposition rules to eventualities in the construction of the tableau can
postpone indefinitely the realization by keeping “promising” that the realization
will happen further down the line, while that “promise” never becomes fulfilled.
Therefore, a “good” tableau should not contain states with unrealized eventu-
0out of
7From now on we will use the term “state” in two related but distinct senses: as a
state of a tableau and as a state of a semantic structure (frame, model, Hintikka
structure). The use of term “state” will usually be clear from the context or explicitly
specified.
15