CONTRIBUTORS
Carlos Areces INRIA Lorraine, 615 rue du Jardin Botanique, 54602 Villers l`es Nancy Cedex, France.
[email protected] Sergei Artemov Computer Science, Graduate Center CUNY, 365 Fifth Avenue, New York, NY 10016, USA.
[email protected] Franz Baader TU Dresden, Department of Computer Science, Institute for Theoretical Computer Science, 01062 Dresden, Germany.
[email protected] Johan van Benthem Institute for Logic, Language & Computation, (ILLC), University of Amsterdam, Plantage Muidergracht 24, 1018 TV Amsterdam, The Netherlands; and Department of Philosophy, Stanford University, Stanford, CA 94305, USA.
[email protected] Patrick Blackburn INRIA Lorraine, 615 rue du Jardin Botanique, 54602 Villers l`es Nancy Cedex, France.
[email protected] Julian Bradfield Computer Science, King’s Buildings, Mayfield Road, Edinburgh EH9 3JZ, UK.
[email protected] Torben Bra¨ uner Department of Computer Science, Roskilde University, PO Box 260, DK-4000 Roskilde, Denmark.
[email protected] Balder ten Cate ISLA - Informatics Institute, University of Amsterdam, Kruislaan 403, 1098SJ, Amsterdam, The Netherlands.
[email protected] Melvin Fitting Department of Mathematics and Computer Science, Lehman College, 250 Bedford Park Blvd. West, Bronx, NY 10468-1589, USA. melvin.fi
[email protected]
viii
Contributors
Silvio Ghilardi Department of Computer Science, Universit` a degli Studi di Milano, via Comelico 39, 20135 Milano, Italy.
[email protected] Valentin Goranko School of Mathematics, University of the Witwatersrand, Private Bag 3, WITS 2050, Johannesburg, South Africa.
[email protected] Ian Hodkinson Department of Computing, Imperial College London, South Kensington Campus, London, SW7 2AZ, UK.
[email protected] Wiebe van der Hoek Department of Computer Science, University of Liverpool, Liverpool L69 3BX, UK.
[email protected] Ian Horrocks School of Computer Science, University of Manchester, Oxford Road, Manchester, M13 9PL, UK.
[email protected] Ullrich Hustadt Department of Computer Science, University of Liverpool, Liverpool L69 3BX, UK.
[email protected] Marcus Kracht Department of Linguistics, UCLA, 405 Hilgard Avenue, 3125 Campbell Hall, Los Angeles, CA 90095-1543, USA.
[email protected] Agi Kurucz Department of Computer Science, King’s College London, Strand, London WC2R 2LS, UK.
[email protected] Sten Lindstr¨ om Ume˚ a universitet, Institutionen f¨ or filosofi och lingvistik, S 901 87 Ume˚ a, Sweden.
[email protected] Carsten Lutz TU Dresden, Department of Computer Science, Institute for Theoretical Computer Science, 01062 Dresden, Germany.
[email protected]
Contributors
ix
Maarten Marx ISLA, Informatics Institute, Universiteit van Amsterdam, Kruislaan 403, 1098 SJ Amsterdam, The Netherlands.
[email protected] John-Jules Meyer Institute of Information and Computer Science, Utrecht University, P.O.Box 80.089, 3508 TB Utrecht, The Netherlands.
[email protected] Lawrence S. Moss Department of Mathematics, Indiana University, Bloomington, IN 47405-7106, USA.
[email protected] Reinhard Muskens Faculty of Philosophy, Tilburg University, PO Box 90153, NL 5000 LE Tilburg, The Netherlands.
[email protected] Martin Otto Mathematics Department, Technische Universit¨ at Darmstadt, Schlossgartenstr. 7, D-64289 Darmstadt, Germany.
[email protected] Marc Pauly Department of Philosophy, Stanford University, Stanford, CA 94305-2155, USA.
[email protected] Mark Reynolds School of Computer Science & Software Engineering, Faculty of Engineering, Computing and Mathematics, The University of Western Australia, M002, 35 Stirling Highway, Crawley, WA 6009, Australia.
[email protected] Ulrike Sattler School of Computer Science, University of Manchester, Oxford Road, Manchester M13 9PL, UK.
[email protected] Krister Segerberg Filosofiska institutionen, Uppsala Universitet, Box 627, 751 26 Uppsala, Sweden. krister.segerberg@filosofi.uu.se Renate Schmidt School of Computer Science, University of Manchester, Oxford Road, Manchester M13 9PL, UK.
[email protected]
x
Contributors
Colin Stirling Computer Science, King’s Buildings, Mayfield Road, Edinburgh EH9 3JZ, UK.
[email protected] Hans-J¨ org Tiede Illinois Wesleyan University, Department of Mathematics and Computer Science, PO Box 2900, Bloomington, IL, 61702-2900, USA.
[email protected] Moshe Y. Vardi Department of Computer Science, Rice University, 6100 S. Main Street, Houston, TX 77005-1892, USA.
[email protected] Frank Veltman Institute for Logic, Language and Computation, University of Amsterdam, Nieuwe Doelenstraat 15, 1012 CP Amsterdam, The Netherlands.
[email protected] Yde Venema Institute for Logic, Language and Computation, University of Amsterdam, Plantage Muidergracht 24, 1018 TV Amsterdam, The Netherlands.
[email protected] Frank Wolter Department of Computer Science, University of Liverpool, Liverpool L69 3BX, UK.
[email protected] Michael Zakharyaschev School of Computer Science and Information Systems, Birkbeck College, Malet Street, London WC1E 7HX, UK.
[email protected]
PREFACE
MODAL LOGIC This Handbook documents the current state of modal logic, a lively area of logical research which was born in philosophy, but which has since made its way into mathematics, linguistics, computer science, AI, and even economic game theory. As with other thriving scientific endeavours, it is not easy, and perhaps not even fruitful, to give an official definition of the subject. From the earliest days of modern modal logic, about a century ago now, there were many different interpretations, formalisms, and applications, and new developments have only added to this diversity. On the other hand, modal logic is also a remarkably coherent field in many ways, and its practitioners have no difficulty recognising research — and colleagues! — as being ‘modal’ in spirit. As editors, we see two broad perspectives that help give rise to this coherence. Writing with very broad strokes of the pen, we might say that the following two conceptions of the field have been particularly influential among modal logicians: • Modal logics as formalisations of modalities. Many natural notions in language and science have a ‘modal’ character, in that they talk about possibility and necessity in some space of relevant situations. This was true for the original philosophical study of metaphysical modality, but it is equally true of modal logics of time, space, obligation, conditionality, knowledge, computation, and action, which have permeated other fields. Under this view, modal logics model natural reasoning concerning ubiquitous notions, and in doing so, they expand the descriptive scope of ‘standard’ logic. Technically, then, modal logics are obtained from standard logical systems (like classical propositional or predicate logic, intuitionistic logic, and so on) by adding new, non-truth-functional operators (that is, modalities). The non-truth-functional nature of the operators, reflecting the larger space of relevant situations, typically leads to systems richer than the underlying logic. • Modal logics as fragments of standard logics. But surprisingly, another viewpoint on modal logic has become equally prominent among its practitioners. Under this view, modal logics inherit their semantics from the standard semantics of classical first or even higherorder predicate logic, but they restrict expressive power by using operators instead of explicit quantification. The term “fragment” carries no negative connotation of poverty here: curbing expressive power leads to systems with logical properties rather different from those of standard logic; the decidability of many modal logics is a striking example. The mathematical study of modal logics in this vein has brought to light a delicate balance between the expressive power and computational complexity of logical systems in general. That is, from this perspective modal logic is better viewed as a methodology for tapping into a core theme in standard logic. It is this second, more technical perspective, which provides much of the mathematical coherence of the field today.
xii
Preface
The first perspective emphasises the descriptive range of modal logic as the study of key concepts and the reasoning patterns they give rise to. The second perspective emphasises the methodological aspect of fine-structure: modal languages bring to light the inner structure of classical systems. But these views are not in conflict. As the Handbook makes abundantly clear, most active research directions in modal logic take something from both. Indeed, the most widespread semantics of modal logic in terms of relational models (used in virtually every chapter of the Handbook) provides a setting in which these perspectives coexist fruitfully. Moreover, the two views help us better understand historical contributions made in the field. For example, the modal system S4 was introduced in the 1920s as an analysis of the concept of necessary implication. But the limited expressive power of the formalism as an account of implicative structure turned out to be the key to S4’s wide range of other applications, and its attractive mathematical behaviour. In short, both perspectives on modal logic are widely applicable, and both have proved historically robust. Let’s take a closer look at them, and see how they are related. Modal logic as the study of old and new modalities Modal logic, conceived of as the formal study of modalities was invented in philosophy almost a century ago — though the informal study of modalities can be traced back much earlier: through the work of the medieval logicians, and back to the ancient Greeks. The first modal operators were introduced in order to solve the paradoxes of material implication and to obtain logics of necessity and possibility; the key figure here is C. I. Lewis, who published his pioneering work in 1918. Putting his idea in modern notation, we take some logical formula ϕ, and by prefixing it with a 2 or a 3 symbol we obtain the expressions 2ϕ (“the proposition ϕ is necessary”) and 3ϕ (“the proposition ϕ is possible”). That is, the box and diamond notation enables us to assert fundamentally new modes of truth concerning the information expressed by ϕ, namely that it is necessary or possible. In 1933, Kurt G¨odel, driven by concerns in the foundations of mathematics, used modal operators to formalise the notion of mathematical provability. In particular, his work enabled intuitionistic logic to be reduced to classical logic extended with a provability operator, and the resulting logic turned out to be Lewis’s system S4. A striking result indeed, but the general point is this: once again, modalities are being used to express fundamentally new modes of truth concerning a piece of information. In particular, now 2ϕ means that ϕ is provable, and 3ϕ means that it is consistent. These early examples of applying modalities to logical formulas to make assertions concerning a novel mode of truth are only the tip of the iceberg. In the decades following the work of Lewis and G¨odel, many modal operators were introduced and investigated, all dealing with truth in some space of possible situations. Tense logic (or temporal logic) arises with the addition of modalities like “eventually” or “earlier”. Deontic logic adds modalities “it is permitted, or obligatory, that”. In epistemic logic we make use of modalities like “it is known that”, either for single agents or for groups. And conditional logics analyse further species of conditional reasoning far beyond Lewis’s original account. This way of thinking about modal logic and modalities underlies the work of some of the field’s most prominent pioneers, including G. H. von Wright, Arthur Prior, Jaakko Hintikka, Hans Kamp, and David Lewis. Then the torch passed to other disciplines. In particular, temporal, dynamic and epistemic logics found their way into computer science, AI, and economic game theory. Temporal logics, of both branching and linear time, are now used in industry for automated verification of hardware and software. Epistemic, temporal and conditional operators are the main ingredient of knowledge-based programming. And modal logics of active agents with knowledge, beliefs, and desires form a theoretical backbone of modern accounts of intelligent dis-
Preface
xiii
tributed computing. Pioneers of modal methods in computer science include Edmund Clarke, Joe Halpern, Zohar Manna, Robin Milner, Rohit Parikh, Amir Pnueli, Vaughan Pratt, and many others — including quite a few of the authors and commentators in this Handbook. But again, diversity reigns, and creation of new modal formalisms for novel reasoning purposes continues unabated. Summing up: it is entirely reasonable to say that modal logics are formalisms used to represent and reason about the plethora of modal notions that underlie, among other things, distributed computations and intelligent actions, and their corresponding modes of truth. They achieve this by making use of new operators, called modalities, whose truth-conditions involve access to some larger space of relevant situations, such as worlds, times, theories, or computational states. If you view modal logic in this descriptive way, you will be in excellent company. Modal logic and the fine-structure of classical logics The invention of graph-based relational semantics (by Jaakko Hintikka, Stig Kanger, and Saul Kripke) in the late 1950s and early 1960s showed that standard modal logics could be regarded as fragments of first or second-order predicate logics. The underlying idea is straightforward. Suppose we read 2ϕ as “necessarily ϕ” and 3ϕ as “possibly ϕ”. Drawing on an idea that dates back to the work of Leibniz, we could view “necessarily ϕ” as a claim that ϕ is true in all possible worlds, and “possibly ϕ” as a claim that ϕ is true in some possible world. Thus, modal operators perform quantification without making use of explicit variables and binding. This idea, when expressed mathematically, has turned out to be the most significant milestone in the history of modal logic. For present purposes, the crucial idea in the above is just this. Because necessity means truth at all worlds, 2 becomes linked to the universal quantifier ∀, and because possibility means truth at some world, 3 becomes linked to the existential quantifier ∃. That is, necessity and possibility have been analysed in terms of classical quantification. The idea that modal operators are essentially concealed forms of classical quantification is fully general: for example, we can think of “eventually ϕ” as meaning “there is some future time at which ϕ holds”, and we can think of “after performing a certain action, ϕ” as meaning “at every state which is accessible by performing a certain kind of action, ϕ holds”. But this is not all there is to the analogy. Viewed in this way, modal logics might just be different notation for classical ones! The creative difference is that the quantification in modal languages tends to be bounded in some way to ‘relevant’ or ‘accessible’ situations lying beyond the current one. In other words, we are working on structured universes of worlds, computational states, or what have you — and access is mediated. Together with the quantifier analogy, this bounded access explains two things. First, a number of properties of modal logics follow at once from those of their classical quantificational counterparts. Second, as the fragments of classical logic that modal operators correspond to typically have less expressive power than full first-order predicate logic, this results in many new properties. For example, the semantic invariances between models appropriate for modal expressive power are not those of classical logic, but rather turn out to be various forms of bisimulation, which preserve local properties of worlds and their transition patterns. Moreover, the study of fragments of classical systems and translations from modal to predicate logic (and sometimes back) has yielded satisfying explanations of why so many modal logics are decidable (unlike classical predicate logic), and why their computational complexity is often relatively low — and in a more activist way, modal analysis has led to the discovery of many new decidable fragments of classical logics. Indeed, the systematic design of modal languages stronger than the formalisms bequeathed to us by the founding fathers has been a major theme in recent research.
xiv
Preface
First-order languages have been the most traditional companions of modal ones, but the same points apply to modal fragments of higher-order languages, and — a significant development in recent years — to modal fragments of classical languages with fixed-point operators expressing iterative or recursive structures in action, computation, and knowledge representation. Summing up: it is also entirely reasonable to say that modal logics are fragments of classical logics, which somehow strike an optimal balance between expressive power and computational simplicity. And if you view modal logic in this way (that is, as a laboratory for fine-structure) you will also be in excellent company. Nowadays, few modal logicians would feel compelled to choose between the two perspectives just outlined. Their respective virtues are clear, and most researchers have assimilated both. Given the current explosion of practical applications and fundamental ideas in the field (amply documented in this Handbook), dogmatism concerning the nature of modal logic is becoming increasingly unsustainable. Let us emphasise this point a bit more. Contemporary modal logic Modal logic today is a vast family of studies of modal notions, with the original philosophical and mathematical motivations still alive, but with an increasing symbiosis with other fields, and in particular, with computer science. Indeed, its interface with computer science (and more generally, informatics) is extremely broad, ranging from hardware and software verification, to ontologies in medical and bio-informatics, and the analysis of query languages for XML documents. Moreover, it also takes in commonsense reasoning in AI, covering issues ranging from representing and reasoning about space and time to modelling complex interactive multi-agent information systems. Nowadays, modal structures seem to occur everywhere, just as they did in the creative explosion of modality in the philosophical logic of the 1950s and 1960s. This independent (re-)discovery of modal operators in different settings is one of the strongest arguments for the stability and naturalness of the modal stance. Here are three striking illustrations of contemporary rediscoveries. The first example is description logic, a branch of knowledge representation and reasoning in AI; nowadays it supplies many of the formalisms used to fix terminologies in medical and bio-informatics, and has been proposed as the language for annotating web pages to develop a semantic web. Since the late 1970s, the description logic community has articulated its fundamental research goal with great clarity: to obtain fragments of predicate logics which are computationally well-behaved but still have the expressive power required in knowledge representation applications. Intriguingly, around 1990 it became apparent that many of the logics obtained by pursuing this goal were in fact modal logics in a different notational guise. Bounded quantification turns out to be as fundamental for description logics as it is for standard modal logics. In this case, of course, the accessible objects are not worlds or situations but individual objects from some application domain (for example, the biological function of a DNA sequence). But many of the underlying ideas are the same, and this observation has opened the doors to joint work with the modal logic community, with benefits to both fields. Another area where modal structure is currently surfacing is in the abstract study of processes in the emerging field of coalgebra. Though modally inspired process theories like dynamic logic, temporal logic, and process algebra have a long history in computer science, coalgebra adds a new twist. Starting from the work by Peter Aczel, Jon Barwise, and others on generalised set theory, coalgebra has now become a theory of finite and infinite processes, with deep connections with universal algebra and other parts of mathematics and theoretical computer science. The crucial feature here is that processes need not be bottom-up inductive, but can instead be topdown co-inductive streams of events. One gets to know a process through observation of events, chewing off the head of the event stream. The surprising discovery has been that such processes
Preface
xv
and their observational analysis again shows clear modal patterns, leading to rapidly developing interfaces between coalgebra, modal logic, and universal algebra. Finally, a third independent rediscovery of modal notions occurred in economic game theory. In the 1970s, Robert Aumann and others introduced formal models of interactive knowledge of agents in order to account for the reasoning underpinning the Nash equilibrium solutions that would be found by rational players of a game. Disregarding some differences in notation and style, the resulting formalisms turned out to be epistemic logics from the philosophical tradition, with operators for various forms of collective knowledge of groups. Over the past three decades, logical analysis of games has become another flourishing interface, with studies of beliefs and preferences in modal languages, and the development of dynamic logics of actions that can change modal attitudes as a game proceeds. Moreover, this modal study of games has now largely merged with that of computational processes, as games are naturally viewed as goal-driven multi-agent forms of computation. Traditional game theory was the mathematics of equilibrium, using methods from analysis and dynamical systems. The modal stance that is now emerging provides a natural level of fine-structure to go with this. Despite this diversity of modal structures, there are also strong unifying tendencies, especially in the mathematical metatheory of the field, which got into its stride in the 1970s with work by Wim Blok, Kit Fine, Dov Gabbay, Rob Goldblatt, Larisa Maksimova, Steve Thomason, and others. Model theory of bisimulation and related frame constructions is one important strand here; among other things, it yielded broad definability techniques for matching modal languages with classical ones, and enabled the interpolation properties of modal languages to be charted. A second major strand is algebraic semantics and the duality between modal algebras and relational structures, which built on seminal work by Bjarni J´onsson and Alfred Tarski from the 1950s; since the rediscovery of their work in the 1970s, as universal algebra has grown in sophistication, so have its ties with modal logic. Another unifying force was the development of genuinely ‘modal’ techniques with wide applicability for proving completeness, axiomatizability and decidability results. And since the 1980s, further unifying mathematical themes have emerged: these include the study of the computational complexity of reasoning and its relation to succinctness; the exploration of the relation between various forms of tree automata, logical games, and the expressivity of modal languages; and the study of logic combinations and related model constructions, which has lead to a theory, still under active development, of various types of products of modal logics. Another unifying tendency is the undeniable fact that the members of this growing modal family keep influencing each other. The word “applications” has a uni-directional ring to it, but it is a fact of life that every road can be walked both ways. For example, the action-oriented modal perspectives that are so prominent at the computer science interface have now crossed back into philosophy, giving rise to theories of information update and belief revision, which describe how agents come to acquire knowledge or change problematic beliefs. Moreover, setting up such systems also brings in conditional logics from the philosophical tradition; these are now seen as underlying belief revision and non-monotonic reasoning in deep and surprising ways. This interdisciplinary and interactive setting is the stage where the drama of contemporary modal logic is played out. Modal structures are being studied in a growing number of areas, and often they seem to arise almost like naturally occurring phenomena; no premeditation by the modal logician is required. And at the same time, in response to this dramatic expansion, modal logicians have had to adopt a far wider range of technical ideas and tools than ever before, tools that lie beyond the placid waters of traditional textbook introductions to the field. It was against this exciting and challenging background that this Handbook was conceived.
xvi
Preface
THE HANDBOOK OF MODAL LOGIC This Handbook presents a detailed overview of the main lines of research in contemporary modal logic. The editors have tried to present a fair picture of the modern scene, and one that (to the extent possible in a one-volume handbook) reflects the scene in its entirety. Moreover, the selection of authors has been made with a view toward representing the most active and creative research communities worldwide The tricky question is: what is the best compromise between “detailed” and “overview”? We felt the field would be best served by a single volume handbook; that is, we opted for judicious selection and bounded access. Not that it would have been difficult to design a multi-volume handbook. On the contrary, the most frequent request we had from our authors was for more generous pages limits; the pull towards detail is strongly felt in a field such as modal logic, and quite rightly so. Many of the most treasured results and insights of the field are the results of years of painstaking work. In a sense, every student of the subject has to retrace these intellectual journeys; short cuts aren’t possible. But the evident need for an accessible overview of the whole, leaving deeper access to valleys and caves to a second stage, suggests that the one volume choice was correct. One of the points that emerged most strongly during the Handbook’s preparation was just how unified modal logic still is. To be sure, some of its branches are now highly technical, whereas other branches are better thought of as conceptual investigations which use the language of modal logic as an aid to precision. Furthermore, some work emphasises generality and takes mathematical criteria as its primary guide, whereas other areas may be highly specific in their focus and take their cue from applications. But in spite of such differences, the field remains stubbornly coherent, and surprisingly comprehensible. It is not an exaggeration to claim that most researchers in modal logic have at least a nodding acquaintance with the majority of the topics discussed in this Handbook, feel that this sort of extensive knowledge is useful, and would like their students to have a map of the terrain at least as wide. This Handbook is an attempt to provide such a map. To put it another way, it tries to gather together the background assumptions, the working knowledge, the mathematical techniques, and the general world view that add up to that somewhat elusive entity “contemporary modal logic”, and to bring it together in a digestible form. We hope it will provide exactly the sort of snapshot of the field that will serve as intellectual nourishment for the next generation of researchers in, and users of, modal logic. We made no serious effort to impose notational or other kinds of uniformity on the authors. This was partly for pragmatic reasons: it was always evident that the attempt to impose a standard notation would please nobody — and who is to say that linguistic diversity is worse than linguistic, or even cultural, uniformity? But there are deeper reasons for our hands-off stance. Research in contemporary modal logic takes place in a shifting environment that jostles the borders of many fields. One modal logician’s interests may lead to the frontiers of linguistics or automated reasoning, another to the foundations of computation and games, and another towards purely mathematical issues concerning topological spaces. Moreover, these interests keep converging, and diverging, in new and often unpredictable ways; we have given some telling examples already. Had this Handbook appeared five years earlier, the borders between various fields would have been drawn somewhat differently, and it is entirely possible that in another five years many will have to be drawn yet again. In the face of such flux, imposing uniformity would be an artificial exercise. Modal logic is a sea, and the point of this Handbook is to help the reader learn to swim in it; pretending it is a swimming pool distorts the truth, and what’s worse, is unhelpful.
Preface
xvii
USING THE HANDBOOK We suspect that most of our readers will be accustomed to navigating their way through weighty research tomes, and will require little in the way of advice. In particular, readers who already know something about modal logic should simply consult the Table of Contents and start where it looks most interesting; while there are cross-references between the chapters, each is, to a great extent, self contained, so this is a viable strategy. Moreover, the Handbook can be used as a reference to the field. In particular, the index gives detailed entries for most common logics, notions, and results. But we have also attempted to make the Handbook accessible to less experienced readers. Now, we should say right away that by “less experienced” we mean less experienced in modal logic. This is a technical volume, and readers without technical background are going to find it difficult. Thus our less experienced reader is someone who already has some understanding of what modern logic is about, and why and where it is useful, and who wants to find out something about what modern modal logic has to offer. The Handbook is structured to provide an answer to such readers. The book has 21 chapters, and is divided into four parts: Basic Theory, Advanced Theory, Variations and Extensions, and Applications. Although independent, together they tell a story, the story of contemporary modal logic. This story starts with the basic tools and techniques, takes the reader to the outer reaches of the underlying mathematical theory, surveys the key points where the modal approach is being adapted and extended, and finishes by examining the various applications which modal logic serves and from which it draws inspiration. Let’s take a closer look at how all this unfolds over the course of the Handbook. Part 1. Basic Theory The chapters in Part 1 lay the foundation for later ones. Together they present an overview of the most fundamental themes, techniques and results in contemporary modal logic. The growing impact of computer science is clearly reflected in the choice of topics: two chapters are wholly devoted to complexity, decision methods, and implementation. Chapter 1. Modal Logic: A Semantic Perspective. Patrick Blackburn and Johan van Benthem. This chapter discusses the semantic ideas underlying modern modal logic, and in particular, Kripke semantics — or relational semantics, as it now (more informatively and fairly) tends to be called. It introduces the basic model theoretic constructions in a modern way, explores links between modal logic and classical (predicate) logic, both on models and on frames, and examines the extent to which the key semantic ideas transfer to richer modal logics and languages while maintaining a relatively low computational complexity. It also introduces some alternative viewpoints: algebraic semantics, neighbourhood semantics, and topological semantics. Chapter 2. Modal Proof Theory. Melvin Fitting. Modal proof theory is the study of syntactic calculi, defined in terms of symbol manipulation, for performing modal logical reasoning. How can such systems be designed? Is there an interesting range of design choices? And how can the syntactic ideas underlying proof calculi be linked with the semantic ideas introduced in Chapter 1? This chapter answers these questions by introducing a wide range of proof styles, and discussing modal completeness theory, the fundamental bridge between proof-theoretical and semantic investigations.
xviii
Preface
Chapter 3. Complexity of Modal Logic. Maarten Marx. The basic modal language, when interpreted over relational models, can be regarded as a decidable fragment of classical logic. But this observation immediately leads to a host of further questions. Given that it is decidable, how difficult is it to compute with? That is, what is the computational complexity of determining validity, or of performing more modest tasks like model checking? And what are the parameters that affect modal complexity results, and what happens when we play with their settings? This chapter, an introduction to the computational complexity of modal logic, provides some fundamental answers. Chapter 4. Computational Modal Logic. Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt. Although Chapter 2 introduced modal proof theory, and Chapter 3 studied the computational complexity of modal logic, only with this chapter do we reach the heartland of computational modal logic: how to build modal inference systems that are efficient in practice. Although it surveys a number of topics, this chapter concentrates on two fundamental issues: how resolution and tableaux methods can be adapted to modal logic, and how these methods are related. Part 2. Advanced theory The chapters in Part 2 provide a deep and wide ranging theoretical analysis of modal logic that is broad enough to apply to many application areas. In some cases they provide deeper perspectives on topics already introduced in Part 1, but often they introduce ideas barely hinted at in earlier chapters. Taken together, they present the central core of contemporary insight into the mathematical structure of modal logic. Chapter 5. Model Theory of Modal Logic. Valentin Goranko and Martin Otto. At the heart of relational semantics is the idea of interpreting modal languages over relational structures by viewing them as fragments of first-order predicate logic or some stronger formalism. This perspective is not only intuitively attractive, it also makes available to modal logic the results and tools developed in such areas as classical model theory and finite model theory. This chapter shows, in great detail, how such tools can be put to work to gain a deep mathematical understanding of modal model theory, and what makes it sui generis. Chapter 6. Algebras and Coalgebras. Yde Venema. This chapter develops in detail the algebraic semantics of modal logic and introduces an alternative coalgebraic approach. Algebraic semantics, which has thrived as a research area since the early 1970s, is important because it makes it possible to apply general techniques from universal algebra to the study of modal logic. The approach has given rise to some of the most penetrating analyses of the mathematics of modality. The more recent coalgebraic approach, which also links up with category theory, is valuable because it offers a uniform mathematical setting in which to analyse dynamic systems in terms of modal logic. Chapter 7. Modal Decision Problems. Frank Wolter and Michael Zakharyaschev. Modal logic is decidable — or at least it is when interpreted on the class of all models. But change the interpreting class of models, and you change the logical validities, and decidability is typically lost when the structural conditions come too close to ‘danger zones’ such as tiling patterns, arithmetic, or other structures allowing for Turing machine computation. This chapter is a detailed examination of how such properties as decidability, the finite model property, and finite axiomatisability are distributed across the lattice of normal modal logics. The emphasis is on providing general results, and drawing attention to important open questions.
Preface
xix
Chapter 8. Modal Consequence Relations. Marcus Kracht. The notion of consequence, which tells us when a conclusion follows from given premises, is a fundamental logical concept, and in the setting of modal logic it can be defined in a number of different ways. This chapter surveys some of the most important ideas, covering in detail such topics as local versus global consequence, reducing multimodal consequence to monomodal consequence, interpolation theorems, and the admissibility of rules. As with Chapter 7, the emphasis is on providing general results which apply across a wide range of logics. Part 3. Variations and Extensions The main focus of the chapters in Parts 1 and 2 was on relatively simple propositional modal systems based on (collections of) 3 and 2 modalities. Such systems are historically central but they don’t exhaust the kinds of logic that now go under the name “modal logic”. The chapters in Part 3 introduce some of the extensions and variations of the basic modal technology that the reader is likely to encounter. Chapter 9. First-order Modal Logic. Torben Bra¨uner and Silvio Ghilardi. First-order modal logics are modal logics in which the underlying propositional logic has been replaced by a first-order predicate logic. These are one of the oldest forms of modal logic, and arguably the most philosophically important. They also pose some of the most difficult mathematical challenges. This chapter first surveys basic first-order modal logics, and then examines recent attempts to find a general mathematical setting in which to analyse them. Chapter 10. Higher-order Modal Logic. Reinhard Muskens. The basic ideas of modal logic have also been extended to higher-order settings, and indeed, extended in a number of different ways. This chapter motivates such extensions, some of them from linguistic semantics in the tradition of Richard Montague, examines some of the more historically influential ones, indicates some of the difficulties that can arise in the transition to higher-order logic, and finally shows how these difficulties can be overcome. Chapter 11. Temporal Logic. Ian Hodkinson and Mark Reynolds. Temporal logic is one of the classic branches of modal logic and is currently one of the most active. It has been remarkably fruitful in the issues it has raised (what kinds of temporal structure should we work with?), the results it has given rise to (it is the source of some of the most interesting expressivity results in modal logic), and as an applied tool (contemporary model checking technology is based on temporal logic). This chapter will introduce the reader to the key issues of this important and diverse area. Chapter 12. Modal μ-Calculi. Julian Bradfield and Colin Stirling. In the late 1960s, pioneers in reasoning about programs adopted some key ideas of modal logic. They repaid the debt handsomely. Among other things, they developed dynamic logic (used in several chapters of this Handbook), and the modal μ-calculus, one of the most interesting modal formalisms to have emerged in the last two decades. This provides second-order expressive power sufficient to generalise the most common temporal logics, but is still decidable and has the finite model property. It raises many intriguing issues about the interface between modal logic, complexity theory, and automata theory. Chapter 13. Description Logic. Franz Baader and Carsten Lutz. Modal logic is sometimes thought of as an intrinsically intensional logic, suitable only for applications such as reasoning about necessity, possibility, and knowledge. But description logics (which developed from pioneering work in the AI community) are undeniably modal logics and, as the description logic community has shown in impressive detail, are extremely well suited for
xx
Preface
reasoning about ordinary individuals and the relations between them. This chapter is a detailed introduction to one of modal logic’s closest neighbours. Chapter 14. Hybrid Logics. Carlos Areces and Balder ten Cate. Standard modal logics use modalities for talking about the relations in relational structures, but don’t contain mechanisms for talking about particular worlds. Hybrid logic arises when mechanisms for naming and asserting identity of worlds are added; to give an analogy, they are to standard modal systems what first-order languages with equality are to equality-free languages. This chapter surveys the proof theory, expressivity, and complexity of a number of the better known hybrid logics, thereby giving a snapshot of the logical territory lying between the basic modal languages and their classical companions. Chapter 15. Combining Modal Logics. Agi Kurucz. The idea of combining modal logics (for example, a modal logic of time with a modal logic of knowledge) is natural for many applications. But how can modal logics be combined, and what happens when you combine them? This chapter surveys two key combination methods (fusions and products) in detail, shows how various properties do (or do not) transfer from the individual logics to the combination, and briefly examines a number of other combination methods. The properties of combined logics turn out to depend in subtle ways on those of their components plus the particular method of combination. Part 4. Applications Historically, modal logic has been profoundly influenced by its applications, which have been extremely diverse in nature. The chapters in Part 4 survey the key application domains, thereby showing where modal logic comes from, where it has visited along the way, and also indicating areas to which it is likely to return. Chapter 16. Modal Logic in Mathematics. Sergei Artemov. Mathematics is one of modal logic’s oldest application areas. In particular, the pioneering work of G¨odel in the 1930s showed that modal logic offered an important perspective on the notion of mathematical provability, and (more recently) modal logics of proof have been developed. But modal logic also gives rise to natural logics of space and dynamic systems, and even turns out to be a tool with applications in set theory. This chapter surveys these themes. In doing so, it emphasises an intriguing duality in interpreting the modal box: either as the universal quantifier “in all worlds”, or as the existential “there exists a proof”. Just when and how such accounts converge is a deep metamathematical issue. Chapter 17. Automata-Theoretic Techniques for Temporal Reasoning. Moshe Y. Vardi. Many modal and temporal logics can be viewed as fragments of monadic second-order logic over trees in a suitable signature, so there is a clear theoretical link (via Rabin’s celebrated decidability theorem) between modal logic and automata theory. But this link turns out to have practical repercussions for computational applications. In particular, by viewing temporal formulas as giving rise to what are known as “alternating automata”, we gain a theoretically transparent but also practical perspective on both validity and model checking, one of the most significant applications of contemporary modal logic. Chapter 18. Intelligent Agents and Common-Sense Reasoning. John-Jules Meyer and Frank Veltman. Modal logics have been used in AI in a number of different ways. This chapter discusses two of its more important roles there. The first is as a logic of agents, and here the chapter takes the reader from basic epistemic and deontic logic to multi-agent logics of beliefs, desires, and
Preface
xxi
intentions. The second is as a model of common sense reasoning, and here the chapter covers modal treatments of counterfactual conditionals and non-monotonic reasoning in a variety of guises, including default reasoning. Chapter 19. Applications of Modal Logic in Linguistics. Lawrence S. Moss and Hans J¨org Tiede. Modal logic is best known in linguistics for the light it throws on semantics; indeed Richard Montague’s use of higher-order modal logic for this purposes is widely considered to be the starting point of modern natural language semantics. Recently, however, modal logic has also been used to analyse syntactic structure, and interesting links with formal language theory have thereby emerged. This chapter discusses both topics, providing a sophisticated view of modern interfaces between logic and natural language. Chapter 20. Modal Logic for Games and Information. Wiebe van der Hoek and Marc Pauly. Game-theoretic ideas have long played an influential rule in analysing various branches of logic, but the focus of this chapter is on using modal logics to describe and reason about games. After introducing the basic ideas of game theory, it systematically investigates how modal logic can be used to do this. Three main topics are discussed: modeling imperfect information and multi-agent information update via dynamic epistemic logics; reasoning about game structure through operations for combining games; and logics of collective action and the power of coalitions of agents over time. Chapter 21. Modal Logic and Philosophy. Sten Lindstr¨om and Krister Segerberg. Modal logic was born in philosophy, and though it has since travelled widely, it still retains important links with the discipline. This chapter first discusses the historical heartland of philosophical modal logic: namely, the scope and limitations of modal logic as an account of necessity and possibility. It then examines two more recent topics: modal logic and the logic of belief change, and modal logic as a logic of action. Together, these chapters present a broad picture of modal logic today. Of course, some choices had to be made, and some bias may remain. In particular, the emphasis throughout has been on relational graph-style models. The editors fully acknowledge that there are other important traditions, such as modal logics based on non-classical logics, proof-theoretic semantics, as well as the more general neighbourhood semantics. Some of these have a historical pedigree reaching back to the 1930s, and they are still very much alive. These approaches do occur at various places in the book, but we have not made them fundamental to the Handbook’s architecture. We think this is a fair reflection of the bulk of current research, but times may change. Some readers may also think that this Handbook has a bias toward propositional model systems, leaving predicate-logical versions underrepresented. This may be true to some extent — however, the chapters on modal predicate logic, modal logic in philosophy, and also temporal logic give a clear account not only of the basic theory of modal predicate logic, but also of recent developments of its mathematics and its relevance to computer science. But there is also a more defiant stance. Predicate logic itself can be profitably viewed as a modal logic of variable assignment and assignment change. And in that light, modal predicate logic is not some privileged enrichment of modal logic. It is really about combining a propositional modal logic of worlds and one of variable assignment. And the reader can learn a lot about both, and about combination methods, from the pages of this Handbook! Once these chapters are seen together, many questions may at once be formulated concerning further relationships between them. The editors considered adding some remarks on this topic,
xxii
Preface
as diversity tempered by the resulting need for system comparison are a major driving force for innovation in the field. But in the end, we have decided to let the chapters, and their juxtaposition, speak for themselves. Finally, we would like to remark that modal logic is as much a community of living people as a family of systems. The results and insights in this Handbook exist only because of a long line of distinguished researchers who have shaped modal logic and its interfaces with computer science and other fields. The Hall of Fame of our field certainly extends beyond the grand old names of the classical period; just read this Handbook, and you will come to know the grand new names by their fruits. COMMENTATORS Following an idea of Dov Gabbay’s used in many publications, we made use of the designated commentator system in this Handbook. That is, in addition to editorial feedback, we attempted to find, for each chapter, a reader who could provide the kind of feedback that would inspire the authors during the writing process. In some cases we chose commentators with special expertise in the topic of the chapter. In other cases, we felt that the comments offered by someone working in a somewhat different area might be more appropriate and helpful. Moreover, whenever possible, we chose authors of other chapters as commentators, as we felt this would improve the Handbook’s coherence. We are extremely grateful to everyone who agreed to undertake this task; in many cases the input of a commentator acted as precisely the catalyst needed to help the full potential of a chapter to emerge. Our commentators were (Chapter 19 had no commentator): Chapter 1: Aleksander Chagrov. Chapter 3: Martin Otto. Chapter 5: Maarten de Rijke. Chapter 7: Rosalie Iemhoff. Chapter 9: Melvin Fitting. Chapter 11: Valentin Goranko. Chapter 13: Silvio Ghilardi. Chapter 15: Carsten Lutz. Chapter 17: Julian Bradfield. Chapter 20: Giacomo Bonanno.
Chapter 2: Heinrich Wansing. Chapter 4: Carlos Areces. Chapter 6: Aleksander Kurz. Chapter 8: Ian Hodkinson. Chapter 10: Grigori Mints. Chapter 12: Yde Venema. Chapter 14: Ulrike Sattler. Chapter 16: Rineke Verbrugge. Chapter 18: Reinhard Muskens. Chapter 21: Vincent Hendricks.
FURTHER INFORMATION We have set up a home page for the Handbook at: http://www.csc.liv.ac.uk/∼frank/MLHandbook We will make available there any corrections that may need to be made, and news concerning future Handbook-related developments. We welcome feedback from our readers. It would not be useful to attempt to list all the workshops, conferences, and journals where work on modal logic is published; given what we have said about its wide range of applications and techniques, it will come as no surprise that such work may be made public in a wide variety of forums. However it is worthwhile taking this opportunity to mention two workshops specifically
Preface
xxiii
devoted to modal logic. The first is Advances in Modal Logic (AiML), modal logic’s main event, which is held every two years. You can find out more about this event, and the associated book series at: http://www.aiml.net Here we’ll simply say that AiML attempts to bring together scholars working in all areas of modal logic and its applications. The second workshop is Methods for Modalities (M4M), see http://m4m.loria.fr M4M is also held every two years. It is more practically oriented than AiML, focusing on the development of computational tools and results for modal logic. ACKNOWLEDGEMENTS Editing a handbook is a lengthy task, and sometimes, very modally, it seems as if all the things that could go wrong take the opportunity to actually do so. Fortunately, we had the benefit of a great deal of support, which generally enabled us to dissolve problems before they became too pressing. Indeed, in retrospect, it’s clear we had a relatively easy time of it, and we would like to thank all the people who made this possible. First, and foremost, we would like to thank the authors of the Handbook’s chapters. They showed enormous enthusiasm for the project, many of them going out of their way to attend a meeting to set the Handbook in motion (in March 2004, Amsterdam; the meeting was kindly sponsored by NWO, KNAW and other Dutch scientific organisations). We received a great deal of valuable feedback from them, and they showed good-humoured patience when faced by style file changes, demands for quick attention to page proofs, and requests for additions or alterations to their chapters. It is a privilege to work with such a lively and cooperative community. The resulting Handbook is a testimony to their efforts. Our deepest thanks to them all. We were also extremely lucky with the support we received on the production side. First, our thanks to Arjen Sevenster, of Elsevier, for his enthusiastic support in making this Handbook happen right from the start, including judicious alternations of leaving us be and prodding, and to Andy Deelen, our contact at Elsevier, for her prompt responses to our questions. We are also extremely grateful to Carlos Areces, Christian G¨unsel, Eric Kow, Oliver Kutz and Dirk Walther for the technical help they gave us with the website, the style files, and the indexing. Special thanks are due to Balder ten Cate for organising the meeting in Amsterdam, and to Guido Governatori, who wrote the LATEX style file used to produce the final version of the Handbook, and who responded quickly and generously to our urgent requests. And, finally, we come to Jane Spurr. Without her, it is hard to imagine how we could have put the Handbook together. It was Jane who grafted the 21 chapters into one big LATEX file overcoming many evil obstacles, who dealt with final corrections, and who found ways of making our numerous formatting requests work. Thanks to her unflagging good humour and patience, the final production stage became a positive pleasure. Patrick Blackburn Johan van Benthem Frank Wolter
Handbook of Modal Logic – P. Blackburn et al. (Editors) © 2007 Elsevier B.V. All rights reserved.
1
MODAL LOGIC: A SEMANTIC PERSPECTIVE Patrick Blackburn and Johan van Benthem
1 2 3
4
5
6
7
8
Introduction . . . . . . . . . . . . . . . . . . . . . Basic modal logic . . . . . . . . . . . . . . . . . . 2.1 First steps in relational semantics . . . . . . . 2.2 The standard translation . . . . . . . . . . . . Bisimulation and definability . . . . . . . . . . . . . 3.1 Drawing distinctions . . . . . . . . . . . . . 3.2 Bisimulation . . . . . . . . . . . . . . . . . 3.3 Invariance and definability in first-order logic . 3.4 Invariance and definability in modal logic . . . 3.5 Modal logic and first-order logic compared . . 3.6 Bisimulation as a game . . . . . . . . . . . . Computation and complexity . . . . . . . . . . . . . 4.1 Model checking . . . . . . . . . . . . . . . . 4.2 Satisfiability and validity: decidability . . . . 4.3 Satisfiability and validity: complexity . . . . . 4.4 Other reasoning tasks . . . . . . . . . . . . . Richer logics . . . . . . . . . . . . . . . . . . . . . 5.1 Axioms and relational frame properties . . . . 5.2 Frame definability and undefinability . . . . . 5.3 Frame correspondence and second-order logic 5.4 First-order frame definability . . . . . . . . . 5.5 Correspondence in richer languages . . . . . . 5.6 Remarks on computability . . . . . . . . . . Richer languages . . . . . . . . . . . . . . . . . . . 6.1 The universal modality . . . . . . . . . . . . 6.2 Hybrid logic . . . . . . . . . . . . . . . . . . 6.3 Temporal logic with Until and Since operators 6.4 Conditional logic . . . . . . . . . . . . . . . 6.5 The guarded fragment . . . . . . . . . . . . . 6.6 Propositional Dynamic Logic . . . . . . . . . 6.7 The modal μ-calculus . . . . . . . . . . . . . 6.8 Combined logics . . . . . . . . . . . . . . . 6.9 First-order modal logic . . . . . . . . . . . . 6.10 General perspectives . . . . . . . . . . . . . Alternative semantics . . . . . . . . . . . . . . . . . 7.1 Algebraic semantics . . . . . . . . . . . . . . 7.2 Neighbourhood semantics . . . . . . . . . . . 7.3 Topological semantics . . . . . . . . . . . . . Modal logic and its changing environment . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2 3 3 10 12 12 13 18 18 21 23 24 24 27 30 31 33 34 35 38 40 41 43 45 46 49 52 54 56 58 61 64 66 68 72 72 75 76 79
2
Patrick Blackburn and Johan van Benthem
1 INTRODUCTION This chapter introduces modal logic from a semantic perspective. That is, it presents modal logic as a tool for talking about structures or models. But what kind of structures can modal logic talk about? There is no single answer. For example, modal logic can be given an algebraic semantics, and under this interpretation modal logic is a tool for talking about what are known as boolean algebras with operators. And modal logic can be given a topological semantics, so it can also be viewed as a tool for talking about topologies. But although we briefly discuss algebraic and topological semantics, for the most part this chapter focuses on modal logic as a tool for talking about graphs. To put it another way, this chapter is devoted to what is known as the relational or Kripke semantics for modal logic. This is the best known and (with the possible exception of algebraic semantics) the best explored style of modal semantics. It is also, arguably, the most intuitive. Over the years modal logic has been applied in many different ways. It has been used as a tool for reasoning about time, beliefs, computational systems, necessity and possibility, and much else besides. These applications, though diverse, have something important in common: the key ideas they employ (flows of time, relations between epistemic alternatives, transitions between computational states, networks of possible worlds) can all be represented as simple graph-like structures. And as we shall see, modal logic is an interesting tool for talking about such structures: it provides an internal perspective on the information they contain. But modal logic is not the only tool for talking about graphs, and this brings us to one of the major themes of the chapter: the relationship between modal logic and other forms of logic. As we shall see, under the graph-based perspective discussed here, modal logic is closely linked to both first- and second-order classical logic. This immediately raises interesting questions. How does modal logic compare with these logics as a tool for talking about graphs? Can modal expressivity over graphs be characterised in terms of classical logic? We shall ask (and answer) such questions in the course of the chapter. Games (in various guises) are another recurring motif. The simple way that modal formulas are interpreted on graphs naturally gives rise to games and game-like concepts. The most important of these is the notion of bisimulation. This is a relation between two models, weaker than isomorphism, which can be thought of as giving rise to a transition-matching game between two players. As we shall see, this concept holds the key to modal model theory and characterises the link with first-order logic. This chapter has two pedagogical goals. The first is to provide a bread-and-butter introduction to relational semantics for modal logic that can be used as a basis for tackling the more advanced chapters in this handbook. Thus the reader will find here definitions and discussions of all the basic tools needed in modal model theory (such as the standard translation, generated submodels, bounded morphisms, and so on). Basic results about these concepts are stated and some simple proofs are given. But we have a second, more ambitious, goal: to help the reader start thinking semantically. We want to give the reader a sense of how modal logicians view structure, and what they look for when exploring new logics. To this end we have tried to isolate the intuitions that guide working modal logicians, and to present them vividly. We also make numerous asides, some of which touch on advanced logical topics. Their purpose is to situate the key ideas in a wider context, and even beginners should try to follow them. Here is our plan. In Section 2, we introduce basic modal languages and the graphs over which they are interpreted. We give the satisfaction definition (which tells us how to interpret modal formulas in graphs) and the standard translation (which links modal logic with classical logic).
Modal Logic: A Semantic Perspective
3
With these preliminaries out of the way, we are ready to go deeper. What can (and cannot) modal languages say about graphs? In Section 3 we introduce the notion of bisimulation and use it to develop some answers; among other things, we characterise modal logic as a fragment of first-order logic. In Section 4 we examine the computability and computational complexity of modal logic. A shift of topic? Not at all. In essence, this section examines modal logic as a tool for talking about finite graphs. In Section 5 we move to the level of frames and reexamine the link between modal and classical logic. As we shall see, at this level the fundamental correspondence is between modal logic and (monadic) second-order logic. In Section 6 we move beyond the basic modal language and discuss a number of richer languages that offer more expressivity. But what makes them all modal? As we shall see, many of the themes explored in earlier sections re-emerge, and point towards an idea that seems to lie at the heart of modal logic: guarding. Moreover, in some cases it is possible to prove Lindstr¨om-style characterisation results. In Section 7 we discuss three alternatives to relational semantics, namely algebraic, neighbourhood, and topological semantics. We conclude in Section 8. Two final remarks. First, although we introduce modal logic from scratch, we assume that the reader has at least a basic understanding of classical first-order logic (especially its modeltheoretic semantics) and some grasp of the notion of computability. Any standard introduction to mathematical logic (Enderton [37] is a good choice) supplies more than enough material to follow the main line of the chapter. Second, we don’t discuss modal proof-theory or related notions such as completeness in any detail (these topics are the focus of Chapter 2 of this handbook). Although we haven’t banished all mention of normal modal logics and completeness from the chapter, in our view traditional introductions to modal logic tend to overemphasise these topics. We want this chapter to act as a counterbalance. As we hope to convince the reader, simply asking the question “But what can I say with these languages?” swiftly leads to interesting territory. 2
BASIC MODAL LOGIC
In this section we introduce the basic modal language and its relational semantics. We define basic modal syntax, introduce models and frames, and give the satisfaction definition. We then draw the reader’s attention to the internal perspective that modal languages offer on relational structure, and explain why models and frames should be thought of as graphs. Following this we give the standard translation. This enables us to convert any basic modal formula into a firstorder formula with one free variable. The standard translation is a bridge between the modal and classical worlds, a bridge that underlies much of the work of this chapter.
2.1 First steps in relational semantics Suppose we have a set of proposition symbols (whose elements we typically write as p, q, r and so on) and a set of modality symbols (whose elements we typically write as m, m , m , and so on). The choice of PROP and MOD is called the signature (or similarity type) of the language; in what follows we’ll tacitly assume that PROP is denumerably infinite, and we’ll often work with signatures in which MOD contains only a single element. Given a signature, we define the basic modal language (over the signature) as follows: ϕ
::= p | | ⊥ | ¬ϕ | ϕ ∧ ψ | ϕ ∨ ψ | ϕ → ψ | ϕ ↔ ψ | m ϕ | [m]ϕ.
That is, a basic modal formula is either a proposition symbol, a boolean constant, a boolean combination of basic modal formulas, or (most interesting of all) a formula prefixed by a diamond
4
Patrick Blackburn and Johan van Benthem
or a box. There is redundancy in the way we have defined basic modal languages: we don’t need all these boolean connectives as primitives, and it will follow from the satisfaction definition given below that, for all m ∈ MOD, [m]ϕ is equivalent to ¬ m ¬ϕ and m ϕ is equivalent to ¬[m]¬ϕ (so boxes and diamonds are what are known as dual connectives, just as ∃ and ∀ are in first-order logic). But we won’t bother picking out a preferred set of primitives, as this is not relevant to our discussion. If there is only one modality in our language (that is, if MOD has only one element) we simply write 3 and 2 for its diamond and box forms. We often tacitly assume that some signature has been fixed, and say things like “the basic modal language”, or “the basic modal language with one diamond”. We won’t need many syntactic concepts in this chapter, but the following ones will be useful. First, the subformulas of a basic modal formula ϕ are ϕ itself together with all the formulas used to build ϕ. Second, we say that a subformula ψ of ϕ occurs positively if it is under the scope of an even number of negations, otherwise we say it occurs negatively (when this definition is applied, subformulas of the form ψ → θ should be read as ¬ψ ∨ θ, and subformulas of the form ⊥ should be read as ¬). Finally, the modal operator depth of a basic modal formula ϕ is the maximum level of nesting of modalities in ϕ, and we write md(ϕ) to denote this number. A model (or Kripke model) M for the basic modal language (over some fixed signature) is a triple M = (W, {Rm }m∈MOD , V ). Here W , the domain, is a non-empty set, whose elements we usually call points, but which, for reasons which will soon be clear, are sometimes called states, times, situations, worlds and other things besides. Each Rm in a model is a binary relation on W , and V is a function (the valuation) that assigns to each proposition symbol p in PROP a subset V (p) of W ; think of V (p) as the set of points in M where p is true. The first two components (W, {Rm }m∈MOD ) of M are called the frame underlying the model. If there is only one relation in the model, we typically write (W, R) for its frame, and (W, R, V ) for the model itself. We encourage the reader to think of Kripke models as graphs (or to be slightly more precise, directed graphs, that is, graphs whose points are linked by directed arrows) and will shortly give some examples which show why this is helpful. Suppose w is a point in a model M = (W, {Rm }m∈MOD , V ). Then we inductively define the notion of a formula ϕ being satisfied (or true) in M at point w as follows (we omit some of the clauses for the booleans): M, w |= p M, w |= M, w |=⊥ M, w |= ¬ϕ M, w |= ϕ ∧ ψ M, w |= ϕ → ψ M, w |= m ϕ M, w |= [m]ϕ
iff
iff iff iff iff iff
w ∈ V (p), always, never, not M, w |= ϕ (notation: M, w |= ϕ), M, w |= ϕ and M, w |= ψ, M, w |= ϕ or M, w |= ψ, for some v ∈ W such that Rm wv we have M, v |= ϕ, for all v ∈ W such that Rm wv we have M, v |= ϕ.
A formula ϕ is globally satisfied (globally true) in a model M if it is satisfied at all points in M, and if this is the case we write M |= ϕ. A formula ϕ is valid if it is globally satisfied in all models, and if this is the case we write |= ϕ. A formula ϕ is satisfiable in a model M if there is some point in M at which ϕ is satisfied, and ϕ is satisfiable if there is some point in some model at which it is satisfied. These definitions are lifted to sets of formulas in the obvious way. For
Modal Logic: A Semantic Perspective
5
example, a set of basic modal formulas Σ is satisfiable if there is some point in some model at which all the formulas it contains are satisfied. A formula ϕ is a semantic consequence of a set of formulas Σ if for all models M and all points w in M, if M, w |= Σ then M, w |= ϕ, and in such a case we write Σ |= ϕ. Instead of writing {ϕ} |= ψ we write ϕ |= ψ. We now have all the concepts needed to begin exploring modal logic. But instead of moving on, let us reflect upon the ideas just introduced. First, note the internal character of the modal satisfaction definition: modal formulas talk about Kripke models from the inside. In first-order classical logic, when we talk about a model, we do so from the outside. A sentence of first-order logic does not depend on the contextual information contained in assignments of values to variables: sentences take a bird’s-eye-view of structure, and, irrespective of the variable assignment we use, are simply true or false of a given model. Modal logic works differently: we evaluate formulas inside models at some particular point. A modal formula is like an automaton placed inside a structure at some point w, and forced to explore by making transitions to accessible points. This may seem a fanciful way of thinking about the satisfaction definition, but it turns out to be crucial. When we isolate the mathematical content of this intuition, we are led, fairly directly, to the notion of bisimulation, the key to modal model theory, which we will introduce in Section 3. Second, note that basic modal languages are syntactically extremely simple: we are working with languages of propositional logic augmented with additional unary operators. And yet these languages clearly pack quantificational punch. Diamonds and boxes can be thought of as macros that encode quantification over Rm -accessible states in a perspicuous variable-free notation. We will shortly define the standard translation, which makes this macro analogy precise. Third, note that Kripke models can (and in our opinion should) be thought of as (directed) graphs. As we have already mentioned, modal logic has been applied in many different areas. What these areas have in common is that they deal with applications in which the important ideas can be represented by relatively simple graph-like structures. Let’s consider some examples, A classic interpretation of Kripke models of the form (W, R, V ) is to regard the elements of W as times, and the relation R as the relation of temporal precedence (that is, Rww means that time w is earlier than time w ). Consider the (directed) graph in Figure 1. This shows a
Figure 1. A simple temporal model. simple flow of time consisting of five points. Here we will take the precedence relation to be the transitive closure of the next-time relation indicated by the arrows (after all, we think of the flow of time as transitive) thus every point ti precedes all points to its right. Note that (as we would expect from the internal perspective provided by modal languages) whether or not a formula is satisfied depends on where (or in this example, when) it is evaluated. For example, the formula 3(p ∧ q) is satisfied at points t1 , t2 and t3 (because all these points are to the left of t4 where both p and q are true together) but not at t4 and t5 . On the other hand, because q is true at t5 , we have that 3q is true at t1 , t2 , t3 and t4 . One special case is worth remarking on: note that for any basic formula ϕ whatsoever, 2ϕ is satisfied at t5 . Why? Because the clause in the satisfaction definition for boxes says that 2ϕ is satisfied if and only if ϕ is satisfied at all R-accessible points. As no points are R-accessible from t5 (it has no points to its right) this condition is trivially met.
6
Patrick Blackburn and Johan van Benthem
The idea of using modal logic as a tool for temporal reasoning is due to Arthur Prior [104, 105]. His work offers what is probably the clearest example of modal logic being appreciated for its internal perspective. In languages such as English and Dutch, the default way of locating information temporally is to use tenses, and tenses locate information relative to the point of speech. For example, if at some time t I say “Clarence will fly”, then this will be true if at some future time t Clarence does in fact fly. Prior viewed tensed talk as fundamental: we exist in time, and have to deal with temporal information from the inside. He believed that the internal perspective offered by modal languages made it an ideal tool for capturing the situated nature of our experience and the context-dependent way we talk about it. Prior called his system tense logic. He wrote F for the forward looking (or future) diamond, and had a second diamond, written P , for looking back into the past (so in Figure 1, P (p ∧ q) is true at t5 , for this point is to the right of t4 , where p and q are true together). Prior needed backward looking operators to mimic the effect of natural language past tense constructions; for further discussion of Prior’s work in this area, see Chapter 19 of this handbook. Our next example brings us to one of the most influential ways of thinking about Kripke models: to give them a process interpretation, which means that we view models as collections of computational states, and the binary relations as computational actions that transform one state into another. This interpretation dates back to the classic work of Hoare [67] and Dijkstra [32]. Let’s look at a simple example. Consider the graph shown in Figure 2. This shows a finite state
Figure 2. Finite state automaton for an bm (n, m > 0). automaton for the formal language an bm (n, m > 0), that is, for the set of all strings consisting of a non-empty block of as followed by a non-empty block of bs. But this is precisely the type of graph we can use to interpret a modal language. In this case it would be natural to work with a language with two diamonds a and b . The a diamond will be used to explore the a-transitions in the automaton, while the b diamond explores the b-transitions. It follows that all formulas of the form
a · · · a b · · · b t (that is, an unbroken block of a diamonds preceding an unbroken block of b diamonds in front of a proposition symbol t which is only true at the terminal node t) are satisfied at the start node s, for all modality sequences of this form correspond to the strings accepted by the automaton. Although simple, this example shows the key feature of many computational interpretations of modal logic: the relations are thought of as processes (here our processes are “read the symbol a” and “read the symbol b”). Note that in this case we are thinking in terms of deterministic processes (each relation is a partial function) but we could just as well work with arbitrary relations, which amounts to working with a non-deterministic model of processes. The process interpretation, in various forms, underlies much of the discussion of this chapter, and it underlies Chapters 12 and 17 of this handbook. Another important application of modal languages is to model the logic of knowledge and
Modal Logic: A Semantic Perspective
7
belief; this line of work was pioneered by Jaakko Hintikka [66], and as the more recent treatise by Fagin, Halpern, Moses, and Vardi [39] makes clear, the study of epistemic logic continues to flourish. Again, simple graph-based intuitions underly this application. Consider, for example, the graph shown in Figure 3. Here we see the epistemic state of a very simple agent. One
Figure 3. Epistemic state of a simple agent. of the epistemic situations making up this state is marked e; this represents the agent’s current knowledge (the agent knows that q is the case). The other situations represent the way the world might be. For example, although neither p nor r are true in the current situation, the agent views situations in which p and q are true together, and situations in which r and q are true together, and even situations in which p and q and r are all true together, as epistemically acceptable alternatives to the current situation e. So 3(p ∧ q) (“p ∧ q is consistent with what the agent knows”), and 3(r ∧q), and 3(p∧q ∧r) are all satisfied at e. Moreover 2q (“the agent knows that q”) is satisfied at e, as at every alternative epistemic situation the information q holds. Hintikka introduced the symbol K for this usage of box (that is, he wrote Kq for “the agent knows that q”) and his notation is still standard in contemporary epistemic logic. Epistemic logic is discussed in Chapters 18 and 20 of this handbook. The next example is important for another reason. Modal logic is often viewed as an intrinsically intensional logic, interpreted using possible world semantics. This view comes from what is probably the most historically influential interpretation of modal logic, namely as the logic of necessity and possibility. In this interpretation, 3 is read as “possibly”, 2 is read as “necessarily”, and the points of Kripke models are regarded as possible worlds. Unfortunately, this interpretation has tended to overshadow the others, at least in certain research communities (some philosophers view modal logic, intensionality, and possible worlds as inextricably intermingled). To ensure that this illusion is dispelled, our last example will be completely extensional. Consider the graph in Figure 4.
Figure 4. Ordinary individuals. This is the sort of extensional information that classical logics (such as first-order logic) are
8
Patrick Blackburn and Johan van Benthem
often used for. But modal logic is at home here too. We can say lots of interesting things about such situations. For example
LOVES ∧ DETESTS LOVES is true when evaluated at Terry: he loves someone and he detests someone who loves someone. Nowadays, modal logic is widely used for reasoning about such extensional situations. In particular, the concept languages which lie at the heart of the description logics used in knowledge representation are often notational variants of (various kinds of) modal languages. Description logics are used in a wide range of applications for representing and reasoning about extensional information. They are treated in depth in Chapter 13 of this handbook. We’re almost ready to define the standard translation, but before doing so let’s deal with three other matters. First, in most branches of logic and mathematics, there is a notion of two structures being isomorphic, which can be glossed as “mathematically indistinguishable”. Let’s take this opportunity to be precise about what isomorphism means in basic modal logic (we give the definition for models and frames with one relation; it generalises straightforwardly to structures with multiple relations). DEFINITION 1 (Isomorphism). Let M = (W, R, V ) and M = (W , R , V ) be models, and f : W → W a bijection. If for all w, v ∈ W we have that Rwv if and only if Rf (w)f (v) then we say that f is an isomorphism between the frames (W, R) and (W , R ) and that these frames are isomorphic. If in addition we have, for all proposition symbols p, that w ∈ V (p) if and only if f (w) ∈ V (p) then we say that f is an isomorphism between the models M and M and that these models are isomorphic. As this definition makes clear, if models M and M are isomorphic, each replicates perfectly the information in the other. Hence the following result is unsurprising: PROPOSITION 2. Let f be an isomorphism between models M and M . Then for all basic modal formulas ϕ, and all points w in M, we have that M, w |= ϕ if and only if M, f (w) |= ϕ. Proof. Immediate by induction on the construction of ϕ (see Lemma 9 for an example of such a proof.) ❑ Second, we want to point out that it is possible to take a more dynamic perspective on the satisfaction definition. In particular, we can think of it as a game. Let’s start with a concrete example. Consider the model in Figure 5.
Figure 5. The formula 323p is true at 1 and 4, but false at 2 and 3. As the reader should check, 323p is true at points 1 and 4, but false at points 2 and 3. Now suppose we play the following evaluation game. This game has two players, a Verifier (V) and a
Modal Logic: A Semantic Perspective
9
Falsifier (F), who disagree about the satisfiability of a formula in some model. The two players react differently to the connectives in the formula: for example, occurrences of disjunction allow V to make a choice as to which disjunct to verify, and play continues with the formula chosen; negation switches the roles of the two players; and diamonds make V pick a successor of the current point, while boxes do the same for F. Moreover, for any proposition symbol p, V wins the p-game if p is true at the current state, otherwise F wins. A player also wins the game if the other player must make a move for a modality but cannot.
Figure 6. Initial segment of a game tree.
So let’s play the game for 323p at 1. Figure 6 shows (an initial segment of) the resulting game tree. Note that V can always win. Her most obvious option is to play 3 in response to the outermost diamond; this leaves F with no possible response when faced with the task of falsifying 23p. But V can also safely play 4 on her first move. As the tree shows, irrespective of F’s response, V can always reach a winning position. What this example suggests is completely general: for any model M, point w, and basic formula ϕ, we have that M, w |= ϕ if and only if V has a winning strategy when the ϕ-game is played in M starting at w. Moreover, as we see in this example, different strategies correspond to different ways of showing that the given formula is true. Finally, some historical remarks. Where does the relational interpretation of modal logic come from? The three authors usually cited as pioneers are Saul Kripke, Jaakko Hintikka, and Stig Kanger. Kripke’s contributions are the best known (indeed relational semantics is often called Kripke semantics) and Kripke [83, 84] are regarded as landmarks in the development of modal semantics. But Hintikka independently developed the idea in his work on logics of knowledge and belief (see, for example, his classic monograph “Knowledge and Belief” [66]). Furthermore, although his work was not well known at the time, Kanger, in a series of papers and monographs published in 1957, introduced relational semantics for modal logic (see, for example, Kanger [77, 78]). Indeed, the idea of relational semantics seems to have been in the air at around this time, and a number of other logicians (for example Arthur Prior and Richard Montague) discussed similar ideas. For a detailed discussion of who did what and when, the reader should consult Goldblatt [59].
10
Patrick Blackburn and Johan van Benthem
2.2 The standard translation We now understand what modal languages are, how they can be interpreted in graphs, and why this can be an interesting thing to do. What next? Well, if we were following a traditional path, we would probably remark that as modal languages are to be used for reasoning, some sort of proof system is called for. For example, if we were working in a language with one modality (and in which we had chosen to define 3 in terms of 2) we might point out that the set of all modal validities (that is, the minimal modal logic) in the language could be axiomatised by a Hilbert-style proof system called K. This proof system can be defined in a number ways; we might, for example, stipulate that the axioms of K consist of all formulas in the language which have the form of a propositional tautology (by which we mean not merely tautologies such as p → p which contain no modalities, but also formulas such as 23p → 23p, which contain modalities but are truth-functionally tautologous too) and all instances of the following axiom schema: 2(ϕ → ψ) → (2ϕ → 2ψ). There are two rules of proof: modus ponens (if ϕ and ϕ → ψ then ψ) and modal generalisation (if ϕ then 2ϕ); in the definitions of these rules, θ is standard notation that means “the formula θ is provable”. Now, this looks like a standard axiomatisation of first-order logic with 2 behaving like ∀. But K has no analogs of the first-order axioms with tricky side conditions on freedom and bondage of variables, such as ∀xϕ → [τ /x]ϕ, where τ is a first-order term. This is no coincidence. As the standard translation given below will make clear, modal logic is essentially a perspicuous variable-free notation for a fragment of first-order logic. But proof systems are not our goal. This chapter is concerned with semantic issues, so quite different aspects of modal logic call for our attention. To get the ball rolling, let’s return to our basic semantic entities (Kripke models) and ask what they actually are. This will provide a point of entry to one of the main themes of the chapter: the relationship between modal and classical logic. So, what is a Kripke model? No mystery here. A Kripke model (W, {Rm }m∈MOD , V ) is what model theorists call a relational structure. That is, we have a domain of quantification W , a collection of binary relations over this domain, and a collection of unary relations as well (after all, V (p) is a unary relation for each p ∈ PROP). But this means that we are not forced to talk about Kripke models using modal languages: they provide us with everything needed to interpret classical languages too. For example, to talk about a model (W, {Rm }m∈MOD , V ) using firstorder logic we would simply make use of a first-order language with a binary relation symbol Rm for every m ∈ MOD, and a unary relation symbol P for every p ∈ PROP. Modal logicians have a name for this language: they call it the first-order correspondence language (for the basic modal language over PROP and MOD). Why “correspondence language”? Because every basic modal formula (in the language over PROP and MOD) corresponds to a first-order formula from this language via the standard translation: STx (p)
= = = STx (ϕ ∧ ψ) = STx ( m ϕ) = STx ([m]ϕ) = STx (⊥) STx (¬ϕ)
Px ⊥ ¬ STx (ϕ) STx (ϕ) ∧ STx (ψ) ∃y(Rm xy ∧ STy (ϕ)) ∀y(Rm xy → STy (ϕ)).
Modal Logic: A Semantic Perspective
11
That is, the standard translation maps proposition symbols to unary predicates, commutes with booleans, and handles boxes and diamonds by explicit first-order quantification over Rm accessible points. The variable y used in the clauses for diamonds and boxes is chosen to be any new variable (that is, one that has not been used so far in the translation). We remarked earlier that diamonds and boxes were essentially a simple macro notation encoding quantification over accessible states; the standard translation expands these macros. Note that STx (ϕ) always contains exactly one free variable (namely x). This free variable is what allows the internal perspective, typical of modal logic, to be mirrored in a classical language: assigning a value to this variable is analogous to evaluating a modal formula inside a model at a certain point. Here’s an example of the translation at work: STx (p
→ 3p)
= = = =
→ STx (3p) P x → STx (3p) P x → ∃y(Rxy ∧ STy (p)) P x → ∃y(Rxy ∧ P y).
STx (p)
As the reader can easily check, p → 3p and its standard translation P x → ∃y(Rxy ∧ P y) are equisatisfiable in the following sense: for any model M, and any point w in M, we have that M, w |= p → 3p if and only if M |= P x → ∃y(Rxy ∧ P y)[x ← w], where the notation [x ← w] means assign w to the free variable x. Unsurprisingly, this relationship is completely general: PROPOSITION 3. For any basic modal formula ϕ, any model M, and any point w in M, we have that M, w |= ϕ iff M |= STx (ϕ)[x ← w]. Proof. There is practically nothing to prove. The clauses of the standard translation mirror the clauses of the satisfaction definition. Hence the result is immediate by induction on the structure of modal formulas. ❑ Thus the standard translation gives us a bridge between modal logic and classical logic. And we can immediately use this bridge to transfer meta-theoretic results for first-order logic to modal logic. PROPOSITION 4. Basic modal logic has the compactness property. That is, if Σ is a set of basic modal formulas, and every finite subset of Σ is satisfiable, then Σ itself is satisfiable. Moreover, basic model logic has the L¨owenheim-Skolem property. That is, if a set of basic modal formulas Σ is satisfiable in at least one infinite model, then it is satisfiable in models of every infinite cardinality. Proof. We show that basic modal logic has the L¨owenheim-Skolem property. Suppose that Σ is a set of basic modal formulas that has at least one infinite model. Let STx (Σ) be the set of (first-order) formulas obtained by standardly translating all the formulas in Σ. Now, as Σ has an infinite model, by Proposition 3 so does STx (Σ). But first-order logic has the L¨owenheimSkolem property, hence STx (Σ) has a model of every infinite cardinality. But, again by appeal to Proposition 3, each of these models satisfies Σ, so basic modal logic has the L¨owenheim-Skolem property too. The argument showing it has the compactness property is similar. ❑ Another easy consequence of the standard translation is that the set of validities (in basic modal languages) is recursively enumerable. For a basic modal formula ϕ is valid iff STx (ϕ) is a first-order validity, and the set of first-order validities is recursively enumerable.
12
Patrick Blackburn and Johan van Benthem
Let’s sum up what we have learned so far. Propositional modal languages are syntactically simple languages that offer a neat (variable-free) notation for talking about relational structures. They talk about relational structures from the inside, using the modal operators to look for information at accessible states. This internal perspective on models, coupled with the simplicity of modal syntax, means that propositional modal logic is an attractive tool for certain applications. Moreover, viewed as a tool for talking about models, any basic modal language can be regarded as a fragment of its corresponding first-order language: the standard translation systematically maps modal formulas to first-order formulas (in one free variable) and makes the quantification over accessible states explicit. This allows us to quickly establish some basic modal meta-theory by appeal to known results for first-order logic. 3
BISIMULATION AND DEFINABILITY
With the basics behind us it is time to look deeper. In particular, it is time to start mapping the expressive strengths and weaknesses of the basic modal language. Now, the expressive power of a language is usually measured in terms of the distinctions it can draw. A language with just the two expressions “like” and “dislike” would provide only the roughest possible classification of the world, whereas a richer language of assent and dissent would make it possible to draw finer distinctions inside the accepted and rejected situations. So what distinctions can modal languages draw? In this section we discuss this question at the level of models, and in Section 5 we shall reconsider it at the level of frames. In what follows it will often be useful to think in terms of pointed models. That is, we shall often present models together with an explicit distinguished point to indicate where we are trying to find a difference.
3.1 Drawing distinctions A modal language (and indeed any logical language whose formulas form a set) can distinguish between some models (M, s) and (N, t), but not between all such pairs. For example, our basic modal language can distinguish the pair of models shown in Figure 7.
Figure 7. (M, s) and (N, t) are modally distinguishable. Here 2(2 ⊥ ∨ 32 ⊥) is a modal formula that distinguishes these models: it is true in M at s, but false in N at t. But now consider the pair of models shown in Figure 8. Is it possible to modally distinguish (M, s) from (K, u)? That is, is it possible to find a (basic) modal formula that is true in M at s, but false in K at u? Note that it is easy to distinguish them if we are
Modal Logic: A Semantic Perspective
13
Figure 8. (M, s) and (K, u) are not modally distinguishable. allowed to use first-order logic: all points in M (including s) are irreflexive, while point u in K is reflexive, hence the first-order formula Rxx is not satisfiable (under any variable assignment) in model M, but it is satisfied in K when u is assigned to x. But no matter how ingenious you are, you will not find any formula in the basic modal language that distinguishes these models at their designated points. Why is this?
3.2 Bisimulation A natural approach to this question is to consider its dual: when should two models be viewed as modally identical? For example, given a process interpretation, when would we view two transition diagrams as representations of the same process? The models M and K of Figure 8 provide an intuitive example: they seem to stand for the same process when we look at possible actions and deadlocks (note that at each state the process can enter a deadlock situation; that is, it can enter a state from which it cannot exit). By contrast, M and N in Figure 7 are different, as the right hand state in N is not threatened with immediate dead-lock. Or consider the epistemic interpretation: when would we want to say that two graphs represent the same epistemic state? For example, we would probably want to identify the two epistemic models shown in Figure 9 at their distinguished points s and t.
Figure 9. Two epistemically equivalent models. After all, in essence both models present us with a two way choice: either we are in an epistemic situation where p holds and there is an accessible epistemic situation where q holds, or we are in an epistemic situation where q holds and there is an accessible epistemic situation where p holds. The intuition that both these graphs code the same epistemic state is captured by our
14
Patrick Blackburn and Johan van Benthem
modal language: the reader will not find any modal formula that distinguishes them. The modal logician’s idea of asking when two distinct structures are modally identical (that is, make the same modal formulas true) lies within an older (and broader) tradition of looking for the structure preserving morphisms in a given mathematical domain, and letting the corresponding theory describe those notions that are invariant for such morphisms. This is the spirit of Klein’s Program in geometry, proposed around 1870, and still influential in many fields. Of course, there is no unique answer to the question of when two structures are the same. This insight was stated forcefully in recent years by President Clinton during the Lewinsky hearings: It all depends on what you mean by “is”. Clinton’s Principle for modal logic means that we should first try to stipulate some notion of structural equivalence for models that is appropriate for modal languages. This is the purpose of the following definition (first formulated in van Benthem [128, 131]). We state it here for models with one relation R, but the definition generalises straightforwardly to models with any number of relations. DEFINITION 5 (Bisimulation). A bisimulation between models M = (W, R, V ) and M = (W , R , V ) is a non-empty binary relation E between their domains (that is, E ⊆ W × W ) such that whenever wEw we have that: Atomic harmony: w and w satisfy the same proposition symbols, Zig: if Rwv, then there exists a point v (in M ) such that vEv and R w v , and Zag: if R w v , then there exists a point v (in M) such that vEv and Rwv. If there is a bisimulation between two models M and N, then we say that M and N are bisimilar. Moreover, we say that two states are bisimilar if they are related by some bisimulation. Putting this in words: two states are bisimilar if they make the same atomic information true and if, in addition, their transition possibilities match. That is, if a transition to a related state is possible in one model, then the bisimulation must deliver a matching transition possibility in the other. Atomic harmony, coupled with the matching transitions concept embodied in the zigzag clauses, make bisimulation a natural notion of process equivalence, and indeed bisimulations were independently discovered in computer science (see Park [100]). Returning to the models M, K, and N considered above (and disregarding proposition symbols) it is easy to see that M and K are bisimilar: the dotted lines in Figure 10 indicate the required bisimulation (note that the indicated bisimulation links the two designated points). Furthermore, it is easy to see that there is no bisimulation that links the designated points of N and K. Why not? Because a move from t to the right-hand world in N has no matching move in K: moving downwards from u is no option (end-points never bisimulate with points having successors) but neither is moving reflexively from u to itself (as one can move from u to a successor which is an endpoint, but this can’t be done from the right-hand world in N). Given any modal model M, bisimulations can be used in a number of ways. The so-called bisimulation contraction makes M as small as possible. To define this, note that it follows from Definition 5 that any union of bisimulations between two models is itself a bisimulation. Therefore the union of all bisimulations between two models is a maximal bisimulation between them. Now form the maximal bisimulation of model M with itself (incidentally, a bisimulation of a model with itself is called an autobisimulation). Define a quotient of M whose points are the equivalence classes, and relate the equivalence class |w| to the equivalence class |v| iff |w| and |v| contain points w and v such that Rw v . The map from points to their equivalence classes is a bisimulation. For example, the bisimulation shown in Figure 10 between M and K is a bisimulation contraction. Bisimulation contractions are the most compact representation of processes,
Modal Logic: A Semantic Perspective
15
Figure 10. (M, s) and (K, u) are bisimilar, (K, u) and (N, t) are not. at least from a modal standpoint. They remove all the redundancies in the representation — but also all aesthetic symmetries. (A butterfly is a redundant object, as one wing contains enough information under this perspective.) Bisimulations can also be used to make bigger models: one important construction which does this is called tree unraveling (for a very early paper using this construction, see Dummett and Lemmon [34]; for an influential paper that made heavy use of it, see Sahlqvist [111]). To unravel a model, take all finite R-sequences of points in M that start at some point w. These sequences form a tree with one-step extensions of sequences as the tree-successor relation. Projection from a sequence to its last element is a bisimulation onto the original model M. As an example, consider the unraveling of the two element model K around its distinguished point u to the infinite comb-like structure shown in Figure 11 (we use v as the name of the other point in this model). Reasoning about trees is often easier than reasoning about arbitrary graphs, and
Figure 11. Unraveling K around u. so this method is of considerable theoretical utility. Moreover, as we shall see in the following
16
Patrick Blackburn and Johan van Benthem
section, tree unraveling is relevant to the decidability of modal logic. Three other model constructions used in modal logic, namely disjoint unions, generated submodels, and bounded morphisms (or p-morphisms) are also bisimulations. Historically, all three constructions were widely used in modal logic more than a decade before the unifying concept of bisimulation was introduced (the classic source for these constructions is Segerberg [113], where they are heavily used, often in combination, to prove completeness theorems). All three constructions are fundamental tools in many areas of modal logic (for example, when reformulated at the level of frames, they are key ingredients in the Goldblatt-Thomason Theorem which we discuss in Section 5) so we take this opportunity to define them for models with one accessibility relation. These definitions generalise straightforwardly to models of arbitrary signature. The simplest construction is forming disjoint unions. If we have a pair of disjoint models (that is, a pair of models (W, R, V ) and (W , R , V ) such that W and W are disjoint) then their disjoint union is the model (W ∪ W , R ∪ R , V + V ), where V + V is the valuation defined by (V + V )(p) = V (p) ∪ V (p), for all proposition symbols p. That is, forming a disjoint union of two models means lumping together all the information in the two graphs. What if the graphs are not disjoint? Then we simply take disjoint isomorphic copies of the two models, and form the disjoint union of the copies. This lumping together process can be generalised to arbitrarily many models, which prompts the following definition. DEFINITION 6 (Disjoint Unions). Given mutually disjoint models Mi = (Wi , Ri , Vi ), where i ranges over the elements of some index the disjoint unionof these models set I, we define to be M = (W, R, V ), where W = i∈I Wi , R = i∈I Ri , and V (p) = i∈I Vi (p) for all proposition symbols p. To form the disjoint union of a collection of models that are not mutually disjoint, we first take mutually disjoint isomorphic copies, and then form the disjoint union of the copies. It is immediate from this definition that any component model Mi of a disjoint union M is bisimilar with M: for the bisimulation relation E we simply take the identity relation. Identity clearly satisfies the atomic harmony and zigzag conditions required of bisimulations. Disjoint unions build bigger models from (collections of) smaller ones. Generated submodels do the reverse. They arise by restricting attention to subgraphs of a given graph that are closed under relational transitions. For example, consider the two graphs in Figure 12. It is clear that
Figure 12. Generating a submodel from s. the graph on the right arises by restricting attention to a certain transition-closed subgraph of the graph on the left, namely the set of point reachable by taking sequences of transitions from s. This motivates the following definition. DEFINITION 7 (Generated Submodels). Let M = (W, R, V ) be a model and let W ⊆ W . We say that a model M = (W , R , V ) is the restriction of M to W if R = R ∩ (W × W ) and for all proposition symbols p we have that V (p) = V (p) ∩ W . We say that W is R-closed
Modal Logic: A Semantic Perspective
17
if for all u ∈ W , if Ruv then v ∈ W . Finally, we say that M is a generated submodel of M iff M is the restriction of M to an R-closed subset of W . If M = (W , R , V ) is a generated submodel of M = (W, R, V ), and S ⊆ W has the property that every w ∈ W is reachable via a finite sequence of R-transitions from some s ∈ S, then we say that M is the submodel of M generated by S. If S is a singleton set {s}, then we say that M is the submodel of M generated by the point s. A generated submodel is bisimilar to the model that gave rise to it: as with disjoint unions, the identity relation relates the two models in the appropriate way. Incidentally, note that every component model of a disjoint union is a generated submodel of the disjoint union. Finally we turn to bounded morphisms (or p-morphisms as they are often called). DEFINITION 8 (Bounded Morphisms). A bounded morphism between models M = (W, R, V ) and M = (W , R , V ) is a function f with domain W and range W such that: Atomic harmony: Points in W and their f -images satisfy the same proposition symbols (that is, w ∈ V (p) iff f (w) ∈ V (p), for all proposition symbols p). Morphism: if Rwv, then R f (w)f (v). Zag: if R f (w)v , then there exists a v (in M) such that f (v) = v and Rwv. If f is a bounded morphism from M to M and f is surjective, then we say that M is a bounded morphic image of M. Bounded morphisms are bisimulations: a bounded morphism is simply a bisimulation in which the bisimulation relation E is an R-preserving morphism f (note that the only essential difference between the two definitions is that the morphism clause replaces the zig clause, and clearly morphism implies zig). Historically, it was the definition of bounded morphisms that inspired the definition of bisimulations. As an example of a bounded morphism between models, consider Figure 13 (again we ignore proposition symbols).
Figure 13. Bounded morphism collapsing the natural numbers to a reflexive point. Here we have collapsed the natural numbers in their usual order to a single reflexive point. It is clear that this map satisfies both the morphism and zig clauses, so it is indeed a bounded morphism.
18
Patrick Blackburn and Johan van Benthem
3.3 Invariance and definability in first-order logic Structural invariances preserve certain patterns definable in appropriate languages. Before pursuing the match between bisimulation and modal logic, let us examine the situation in first-order logic. The archetypal structural invariance is isomorphism between models. As we saw earlier (recall Proposition 2) modal formulas are invariant for isomorphism. More generally, it is well known that if f is an isomorphism between M and N, then for each first-order formula ϕ(x1 , . . . , xk ), and each matching tuple of objects d1 , . . . , dk in M, the following equivalence holds: M |= ϕ[d1 , . . . , dk ] iff N |= ϕ[f (d1 ), . . . , f (dk )], or stated in words: first-order formulas are invariant for isomorphism. On special models, the converse also holds. For example, it is a well-known fact that any two finite models with the same first-order theory are isomorphic. But no general converse holds, as there are many more isomorphism classes of models than complete first-order theories. Invariance for isomorphism is even a defining condition for any logic in abstract model theory. But no matter how strong the logic, the converse still fails whenever the formulas of a logic form a set, as opposed to the proper class of isomorphism types. Thus it makes sense to look at invariance conditions for weaker notions of structural equivalence. For example, a potential isomorphism between two models M and N is a non-empty set I of finite partial isomorphisms satisfying the back-and-forth extension conditions that, whenever f ∈ I and d ∈ M, then there is an e ∈ N such that f ∪ {(d, e)} ∈ I, and vice-versa. Note that isomorphisms induce potential isomorphisms: simply take I to be the family of all finite restrictions. The converse is not true. Matching up all finite sequences of rational numbers with equally long sequences of real numbers (in the same order) is a potential isomorphism between Q and R, even though these two structures are not order-isomorphic for cardinality reasons. It is easy to show that all first-order formulas are invariant for potential isomorphism, but the real match is with a stronger language: two models are potentially isomorphic iff they have the same complete theory in the infinitary first-order logic L∞ω . This formalism also gives rise to much stronger definability results. For example, for each model M there is a sentence δM of L∞ω which holds only in those models N which have a potential isomorphism with M; that is, models can be defined up to potential isomorphism. Moreover, countable models can even be defined (modulo isomorphism) using only countable conjunctions and disjunctions. This is all very nice of course, but infinitary logic is a bit outlandish from a practical viewpoint. Better matches between structural invariance and first-order definability arise in the more fine-grained setting of Ehrenfeucht-Fra¨ıss´e comparison games between models M and N played between a Spoiler (who looks for differences between the models) and a Duplicator (who looks for analogies between them). Models M and N have the same first-order theory up to quantifier depth k iff the Duplicator has a winning strategy in their comparison game over k rounds. We won’t give details here, as we will define a modal comparison game of this sort at the end of the section.
3.4 Invariance and definability in modal logic With these analogies in mind, let us now investigate the modal situation. For a start, modal formulas are invariant for bisimulation: LEMMA 9 (Bisimulation Invariance Lemma). If E is a bisimulation between M = (W, R, V ) and M = (W , R , V ), and wEw , then w and w satisfy the same basic modal formulas.
Modal Logic: A Semantic Perspective
19
Proof. By induction on the construction of modal formulas. The case for proposition symbols is immediate by atomic harmony. The inductive steps for the boolean connectives are straightforward. And the inductive step for 3 formulas shows exactly what the zigzag clauses were designed for. For consider the left to right direction. Given M, w |= 3ϕ and wEw , we want to show that M , w |= 3ϕ. Now, M, w |= 3ϕ means that there is some v in M such that Rwv and M, v |= ϕ. But then (by zig) there must be a point v in N such that vEv and R w v . By the induction hypothesis, M , v |= ϕ, hence M , w |= 3ϕ as required. The argument for the right to left direction is essentially the same, using zag in place of zig. ❑ The result allows us to show failures of bisimulation easily. For example, we have already sketched an argument showing that the models N and K of Figure 10 have no bisimulation between their designated points, but a quicker proof is now possible: these points cannot be bisimilar because there are modal formulas (for example 2(2 ⊥ ∨ 32 ⊥)) which are satisfied at one point but not the other. On the other hand, the dotted lines in Figure 10 show that M and K are bisimilar; it follows that all points linked by a dotted line in these graphs make exactly the same modal formulas true. Another typical application of this result is to show the undefinability of certain structural notions. For example, we can show that irreflexivity is modally undefinable: no modal formula holds in exactly those points w of models such that ¬Rww. To prove this, it suffices to find two bisimilar points in two models, one of which is reflexive, the other irreflexive. One such example is the bisimulation between the designated points of M and K shown in Figure 10. Another is the bounded morphism of Figure 13 which collapses the natural numbers to a single reflexive point. Another consequence of this result is that the disjoint union, generated submodel, and bounded morphism constructions are all satisfaction preserving. More precisely: LEMMA 10. Modal satisfaction is invariant under the formation of disjoint unions, generated submodels, and bounded morphisms. That is: 1. If M = (W, R, V ) is the disjoint union of Mi = (Wi , Ri , Vi ), for i from some index set I, then for all w ∈ Wi and all i ∈ I we have that M, w |= ϕ iff Mi , w |= ϕ. 2. If M = (W , R , V ) is a generated submodel of M = (W, R, V ) , then for all w ∈ W we have that M, w |= ϕ iff M , w |= ϕ. 3. If M = (W , R , V ) is a bounded morphic image of M = (W, R, V ) under the bounded morphism f , then for all w ∈ W we have that M, w |= ϕ iff M , f (w) |= ϕ. Proof. All three results could be proved by induction on the structure on ϕ. But such proofs are unnecessary: we know that disjoint unions, generated submodels, and bounded morphisms are all examples of bisimulations, hence these results follow from Lemma 9. ❑ To sum up the discussion so far, bisimulation implies modal equivalence. But what about the converse? For finite models, we have the following. PROPOSITION 11. If points w and w from two finite models M and N satisfy the same modal formulas, then there is a bisimulation E between M and N such that wEw . Proof. Assume we are working with models containing only a single relation R. We will show that the relation of modal equivalence is itself a bisimulation. That is, we will define the
20
Patrick Blackburn and Johan van Benthem
bisimulation relation E by wEw iff w and w make the same modal formulas true. We now verify that E so defined is indeed a bisimulation. It is immediate that E satisfies atomic harmony. As for zig, assume that wEw and Rwv. Assume for the sake of contradiction that there is no v in M such that R w v and vEv . Let S = {u | R w u }. Now, as w has an R-successor v, we have M, w |= 3. As wEw , we have M , w |= 3 too, hence S is non-empty. Furthermore, as M is finite, S must be finite too, so we can write it as {u1 , . . . , un }. By assumption, for every ui ∈ S there exists a formula ψi such that M, v |= ψi but M , ui |= ψi . It follows that M, w |= 3(ψ1 ∧ · · · ∧ ψn ) and M , w |= 3(ψ1 ∧ · · · ∧ ψn ), which contradicts our assumption that wEw . Hence E satisfies zig. A symmetric argument shows that E satisfies zag too, hence it is a bisimulation. ❑ Thus, on finite models, the expressive power of modal languages matches up exactly with bisimulation invariance. This result can be extended to broader model classes, such as models with finite branching width for successors (note that the proof just given does not depend on the models involved being finite: it would also work for infinite models in which each point has only finitely many R-successors) and suitably saturated models in a model-theoretic sense. But no general converse can hold, for the set-theoretic reasons mentioned earlier. Indeed, the converse does not hold generally even for countable models: not all modally equivalent countable models are bisimilar. Consider the two models in Figure 14 (assume that all proposition symbols are true at all points in both models). Both models have infinitely many branches leading away from their root nodes, but whereas all the branches in the model on the left are of finite length, the model on the right has a branch of infinite length. Now, as the reader should check, both models satisfy the same modal formulas at their root nodes. However there is no bisimulation that links their root nodes; the infinite branch in the model on the right makes it impossible to define one.
Figure 14. Modally equivalent but not bisimilar. This counterexample could be repaired by passing to an infinitary modal language L3 ∞ω with arbitrary (countable) conjunctions and disjunctions. Infinitary modal equivalence occurs between countable models (M, s) and (N, t) whenever there is a bisimulation linking s to t. Furthermore, every countable model (M, s) is defined up to bisimulation by some L3 ∞ω formula δM,s . Again, such infinitary languages are somewhat impractical, but there are some useful bisimulation invariant formalisms which lie between the basic modal language and its infinitary extension. Two examples are propositional dynamic logic and the modal μ-calculus, which are discussed in Section 6. Lemma 9 and its partial converses do not exhaust what needs to be said about the role played by bisimulations in modal model theory. But to gain a deeper understanding, we need to bring in a third component: the first-order correspondence language that we met in Section 2.2 when we introduced the standard translation.
Modal Logic: A Semantic Perspective
21
3.5 Modal logic and first-order logic compared The basic modal language can be viewed as a sort of miniature version of full first-order logic over graph models. The standard translation defined in the previous section shows that each modal formula ϕ corresponds to a first-order formulas STx (ϕ) containing a free variable x. But the converse does not hold: some first-order formulas in the correspondence language are not modally definable. We have already see an example. As the bisimulation between models M and K shows (recall Figure 10) no modal formula defines ¬Rxx. Thus, viewed as a tool for talking about models, modal logic is strictly less expressive than the full first-order correspondence language. And this prompts a further question: given that a modal language is essentially a fragment of the corresponding first-order language, exactly which fragment is it? This question has an elegant answer. First, a preliminary definition. DEFINITION 12. A first-order formula ϕ(x) is invariant for bisimulation if for all models M and M , and all points w in M and w in M , and all bisimulations E between M and M such that wEw , we have that M |= ϕ[x ← w] iff M |= ϕ[x ← w ]. We can now state the main result: basic modal languages correspond to the fragment of their first-order correspondence language that is invariant for bisimulation. More precisely: THEOREM 13 (Modal Characterisation Theorem). order formulas ϕ(x) in one free variable x:
The following are equivalent for all first-
1. ϕ(x) is invariant for bisimulation. 2. ϕ(x) is equivalent to the standard translation of a basic modal formula. Proof. That clause 2 implies 1 is a more or less immediate consequence of Lemma 9. The hard direction is showing that clause 1 implies 2. The original proof can be found in van Benthem [128, 131]. Two other proofs are given in Chapter 5 of this handbook. One is quite close to van Benthem’s original approach, the other is based on games. ❑ Nowadays many different proofs are known for this result, and for various extensions and variants. For example, Rosen [109] showed that the result holds over finite models; this is far from obvious, as the restriction to finite models means that many standard results of first-order model theory (such as the Compactness Theorem) cannot be applied. And Otto [99] showed that the modal equivalent guaranteed to exist by the previous theorem can be restricted to a formula of modal operator depth 2k , where k is the quantifier depth of ϕ(x). Basic modal logic and first-order logic are analogous in many ways. As we mentioned in Section 2, via the standard translation modal logic immediately inherits basic meta-theoretic properties of its more powerful neighbour, such as the Compactness and L¨owenheim-Skolem Theorems. But not all such transfer is automatic. Consider, for example, the Craig Interpolation property: If ϕ |= ψ then there exists a formula θ whose vocabulary is included in that of both ϕ and ψ such that ϕ |= θ and θ |= ψ. Does the same result hold for basic modal formulas ϕ and ψ such that ϕ |= ψ? Appealing to the result for first-order logic gives us a first-order formula θ such that STx (ϕ) |= θ and θ |= STx (ψ). But what guarantees that this interpolant is modally definable? Interpolation does in fact hold for the basic modal language (for a detailed account, see Chapter 8 of this handbook),
22
Patrick Blackburn and Johan van Benthem
but additional work is needed to prove this. Nonetheless, interpolation does mesh well with the above preservation results; here is an improvement on the Modal Characterisation Theorem. We say that a first-order formula ϕ implies ψ along bisimulation if the following implication holds: if E is a bisimulation between (M, s) and (N, t), and M, s |= ϕ, then N, t |= ψ. THEOREM 14 (Modal Characterisation-Interpolation Theorem). for all first-order formulas ϕ(x):
The following are equivalent
1. ϕ(x) implies ψ(x) along bisimulation. 2. There is a modally definable θ in the common vocabulary of ϕ and ψ such that ϕ |= θ and θ |= ψ. Proof. The proof can be found in Barwise and van Benthem [11]. Note that the Modal Characterisation Theorem follows by taking ϕ(x) equal to ψ(x). This result does not imply ordinary modal interpolation as it stands: additional work is again needed. ❑ Behind the above observations is the fact that the cheaply transferred properties are universal in some sense, whereas the universal-existential property of interpolation requires honest work. Even so, there is an intuition (based on decades of positive experience with transferring results) that modal logic and first-order logic share all general meta-properties except decidability. No proofs of significant formulations of this idea have been found so far, but we can point to some broad analogies regarding methods. Generally speaking, bisimulation plays the same role for modal logic that potential isomorphism does for first-order logic. This can even be made precise in the following sense. To each first-order model M we can associate a modal model whose points are the variable assignments into M, and whose accessibility relations are changes from one assignment g to another g(x := d) that resets the value for the variable x to the object d ∈ M. Then two models M and N have a potential isomorphism between them iff their associated modal models are bisimilar; see van Benthem [136] for details. We conclude this discussion with two general results that allow us to switch between modal and first-order relations between models. In essence, both results have the form of a commutative diagram. LEMMA 15 (First Lifting Lemma). The following are equivalent for all models (M, s) and (N, t): 1. (M, s) and (N, t) are modally equivalent. 2. (M, s) and (N, t) have elementary extensions to models (M+ , s) and (N+ , t) which are bisimilar. LEMMA 16 (Second Lifting Lemma). The following are equivalent for all models (M, s) and (N, t): 1. (M, s) and (N, t) are modally equivalent. 2. (M, s) and (N, t) are bisimilar to models (M+ , s) and (N+ , t) which are elementarily equivalent.
Modal Logic: A Semantic Perspective
23
Proof. The first lifting lemma was originally proved in van Benthem [128]. It is the key item in (some proofs of) the Characterisation Theorem (the + -models are suitably saturated elementary extensions which allow the Characterisation Theorem to be proved rather straightforwardly). The second lifting lemma (see van Benthem [134] for the original result, and Andr´eka, van Benthem, and N´emeti [5] for full proof details) involves judicious tree unraveling of the two models, duplicating sub-trees to create uniformity, coupled with an Ehrenfeucht-Fra¨ıss´e argument to establish elementary equivalence. ❑
3.6 Bisimulation as a game Bisimulation can naturally be thought of as a form of process equivalence, but a more dynamic perspective is also possible. We have already seen that the modal satisfaction definition can be recast in the form of a game (recall Figure 6) but the task of determining whether two models are bisimilar can also be viewed in this way. Consider a game between Spoiler (the difference player) and Duplicator (the similarity player) comparing successive pairs in two pointed models (M, w) and (N, w ): If w and w do not agree on atomic information, Spoiler wins the game in zero rounds. In subsequent rounds, Spoiler chooses a state in one model which is a successor of the current w or w , and Duplicator responds with a matching successor in the other model. If the chosen points differ in their atomic properties, Spoiler wins. If one player cannot move, the other wins. Duplicator wins on infinite runs on which Spoiler does not win. This game captures the zigzag behaviour of bisimulations in an obvious sense. It is also determined: one of the two players has a winning strategy. (This is because it is an open GaleStewart game in the sense of game theory.) For example, returning yet again to the models M, N and K considered at the start of this section, we see that Duplicator has a winning strategy in the comparison game for the models M and K starting from their matched designated points, while Spoiler has one for M and N. The following result clarifies the role of these games precisely: LEMMA 17 (Adequacy of Modal Comparison Games). 1. There is an explicit correspondence between Spoiler’s winning strategies in a k-round comparison game between (M, s) and (N, t) and modal formulas of modal operator depth k on which s and t disagree. 2. There is an explicit correspondence between Duplicator’s winning strategies over an infiniteround comparison game between (M, s) and (N, t) and the set of all bisimulations between M and N that link the points s and t. Proof. This result is essentially a fine-grained restatement of the Lemma 9 from a game-theoretic perspective. See Chapter 5 of this handbook for more on game-based approaches to bisimulation. ❑ For example, in the game between the models M and K given earlier, Duplicator wins by choosing responses that stick to the bisimulation links. And in the game between M and N, Spoiler can win in at most three rounds by using the earlier modal difference formula 2(2 ⊥ ∨ 32 ⊥) of modal operator depth three. In each round he can make sure that some modal difference remains at the current match, with the modal operator depth descending each time.
24
Patrick Blackburn and Johan van Benthem
4 COMPUTATION AND COMPLEXITY We view modal logic as a tool for representing and reasoning about graphs. Our discussion of expressivity has given us some insight into the representational capabilities of modal logic (at least at the level of models) but what about reasoning? In this section we discuss modal reasoning from a computational perspective. We concentrate on the model checking task and the satisfiability and validity problems, but also make some remarks about the global satisfiability and the model comparison tasks. As we shall see, the complexity of the modal version of these tasks is lower than that of their first-order counterparts. Before going further, two general remarks. First, although we are about to study reasoning, we are not about to embark on the study of modal proof systems (apart from anything else, the standard proof systems are only relevant to satisfiability and validity checking, and there is more to modal reasoning than this). Secondly, although we are ostensibly moving on from expressivity issues to computational issues, the two topics are intertwined. In essence, the positive computational results reported here arise from negative expressivity results (for example, the inability of the basic modal language to force the existence of infinite models).
4.1 Model checking The model checking task can be formulated locally: Given a (finite) model M, a point w in M, and a basic modal formula ϕ, is ϕ satisfied in M at w? Or globally: Given a (finite) model M, and a basic modal formula ϕ, is ϕ satisfied at all points in M? Or in a form that subsumes both the local and global perspectives: Given a (finite) model M, and a basic modal formula ϕ, return the set of points in M that satisfy ϕ. In what follows we shall work with the last formulation, which is probably the most common way of thinking about model checking in practice. Now, model checking is clearly a task with computational content — but is it really a reasoning task? In our view, yes. In essence, a model is a ‘flat’ store of information: it consists of a collection of entities, together with a specification of which entities have which properties, and which entities are related by which atomic relations. A modal formula, on the other hand, is a recursively constructed tree. The embedding of connectives and modalities within one another permits relatively short formulas to make interesting assertions, assertions that go way beyond the mere listing of atomic facts. If we add to these differences the practical observation that in typical applications the formula will be much smaller than the model, we see that model checking is about synchronising two very different forms of information: it tells us whether the abstract information embodied in the formula is implicitly present in the model, and gives us a set of points where this implicit information emerges. Viewed this way, model checking is a quintessential reasoning task. Moreover, model checking has turned out to be of great practical importance — indeed, one of the more salutary lessons computer science has taught logic is just how important this modest looking form of reasoning actually is. Nowadays the practical importance of modal model
Modal Logic: A Semantic Perspective
25
checking dwarfs that of determining modal satisfiability or validity (the tasks logicians have traditionally viewed as paramount) as a wide range of practical tasks can be modeled in a computationally natural manner, and efficiently solved, via model checking. A classic example is hardware verification. Even though a computer chip is a concrete object, it gives rise to a natural abstract model, namely the set of all states the chip can be in, and the transitions between them. If a chip is to work satisfactorily, its computational runs (that is, the sequences of states it can follow by making transitions from the initial state) should possess a number of high-level ‘emergent’ properties: for example, these runs should not enter deadlock situations. If we have a modal language that can express the desired properties (for example, absence of deadlock) then by checking the formula in the model representing the chip we can determine whether the design is satisfactory or not. So how should we perform model checking? The standard approach is to use a bottom-up labeling algorithm. To model check a formula ϕ we label every point in the model with all the subformulas of ϕ that are true at that point. We start with the proposition symbols: the valuation tells us where these are true, so we label all the appropriate points. We then label with more complex formulas. The booleans are handled in the obvious way: for example, we label w with ψ ∧ θ if w is labeled with both ψ and θ. As for the modalities, we label w with 3ϕ if one of its R-successors is labeled with ϕ, and we label it with 2ϕ if all of its R-successors are labeled with ϕ. A precise definition of the algorithm for checking diamond formulas is given in the pseudo-code of Figure 15. procedure Check 3(ψ) T := {v | ψ ∈ label (v)} ; while T = ∅ do choose v ∈ T ; T := T \ {v} ; for all w such that Rwv do if 3ψ ∈ / label (w) then label (w) := label (w) ∪ {3ψ} ; end if ; end for all ; end while ; end procedure Figure 15. Model checking 3ψ. The beauty of this algorithm is that we never need to duplicate work: once a point is labeled as making ϕ true, that’s it. This makes the algorithm run in time polynomial in the size of the input formula and model: the algorithm takes time of the order of con(ϕ) × nodes(M) × nodes(M), where con(ϕ) is the number of connectives in ϕ, and nodes(M) is the number of nodes in M. To see this, note that con(ϕ) tells us how many rounds of labeling we need to perform, one of the nodes(M) factors is simply the upper bound on the nodes that need to be labeled, while the other is the upper bound on the number of successor nodes that need to be checked. Thus modal model checking is a computationally tractable task, but this is not the case for first-order logic. In fact, model checking first-order formulas is a PSPACE-complete task (see
26
Patrick Blackburn and Johan van Benthem
Chandra and Merlin [22]). That is, although it is possible to write an algorithm that solves the first-order model checking task using an amount of computer memory that is only polynomial in the size of the input model and formula, the algorithm may require running time that is exponential in the size of the input. The problem, of course, lies with the quantifiers. Assuming that the standard assumptions made in complexity theory are correct, there is no way of adapting the labeling algorithm (or indeed, any other algorithm) to perform first-order model checking in polynomial time. However the labeling algorithm sketched above does adapt to more powerful modal languages, and this is important. As we said above, when model checking we want to state interesting highlevel properties of the situation we are modeling, and often the ordinary 2 and 3 modalities simply aren’t expressive enough. In model checking applications, it is usual to work with treelike models, namely trees of computational runs. On such models 3 is interpreted as “at some immediate successor state”. This is natural, to be sure, but somewhat limited. However, by adding the binary Until modality, we gain access to entire sequences of successor states: M, s |= U (ψ, θ)
iff
there is a t such that sR∗ t and M, t |= ψ, and for all u such that sR∗ u and uR+ t we have M, u |= θ.
Here R∗ is the reflexive transitive closure of the “immediate successor” transition relation R explored by 3, and R+ is its transitive closure. Thus Until gives us a direct handle on the computational runs that can be followed in the model, and this clearly places interesting expressive power at our disposal. Nowadays the Until modality is a fundamental component of some of the most important model checking formalisms — formalisms such as LTL (Linear Time Temporal Logic) and CTL (Computational Tree Logic). For an introduction to these logics, see Chapter 11 of this handbook, or Clarke, Grumberg and Peled [25]. We shall examine the Until operator and the extra expressivity it offers more closely in Section 6.3. Here we simply want to address the following question: how do we extend the labeling algorithm to handle formulas of the form U (ψ, θ)? Here’s the basic idea. First, if any point w is labeled with ψ, label w with U (ψ, θ). Second, if any point v is labeled with θ and at least one R-successor of v is labeled with U (ψ, θ), then label v with U (ψ, θ). It should be clear that these two steps reflect the semantics for Until just given; the pseudo-code given in Figure 16 shows how to make the basic idea precise. Now for an important point. Throughout the previous discussion we have tacitly assumed that we have some way of representing formulas and finite models that is suitable for computational implementation. It is probably not worth sketching details of how this might be done: nowadays it seems safe to assume that most readers of a technical book on logic have at least a nodding acquaintance with programming (indeed, we suspect that most of our readers would find it straightforward to devise a computational syntax for models and modal languages, and to implement simple programs for working with them). Nonetheless, such issues cannot be taken lightly. A major factor in the spectacular progress of model checking has been the development of Binary Decision Diagrams (BDDs) and Ordered Binary Decision Diagrams (OBDDs). BDDs (which are compact representations of boolean expressions) were introduced by Lee [88] and Akers [3], and OBDDs (a more sophisticated form of BDD with fewer representational redundancies) were introduced by Bryant [17]. BDDs were first proposed for model checking by Burch, Clarke, McMillan, Dill, and Hwang [18] and as the title of this paper indicates (“Symbolic model checking: 1020 states and beyond”) this led to a dramatic increase in the size of the models that could be handled. It is important not to underestimate the gap between the labeling algorithm sketched above, and what it takes to make
Modal Logic: A Semantic Perspective
27
procedure CheckU (ψ, θ) T := {v | ψ ∈ label (v)} ; for all v ∈ T do label (v) = label (v) ∪ {U (ψ, θ)} ; end for all ; while T = ∅ do choose v ∈ T ; T := T \ {v} ; for all w such that Rwv do if U (ψ, θ) ∈ / label (w) and θ ∈ label (w) then label (w) := label (w) ∪ {U (ψ, θ)} ; T := T ∪ {w} ; end if ; end for all ; end while ; end procedure Figure 16. Model checking U (ϕ, θ). a working model checker handle a large model. Crossing this gap requires a combination of theoretical insight and computational expertise, and an entire research community is devoted to exploring the issues involved. For a good textbook level introduction to model checking, see Huth and Ryan [72]. This book not only introduces the basic algorithms, it also shows how they can be implemented with the aid of OBDDs. Moreover, it discusses modal checking for the modal μ-calculus (which we introduce in Section 6.7). For a more advanced treatment, see Clarke, Grumberg and Peled [25]. Finally, for an account of model checking via automata-theoretic methods, see Chapter 17 of this handbook.
4.2 Satisfiability and validity: decidability It is often said that modal logic is decidable. This can be read as shorthand for the following claim: the validity problem for the basic modal language (given a basic modal formula ϕ, is ϕ valid?) is decidable. That is, it is possible (ignoring constraints of time and space) to write a computer program which takes a basic modal formula as input, and halts after a finite number of steps and correctly tells us whether it is valid or not. The decidability of modal logic can also be viewed as a claim that the satisfiability problem for the basic modal language (given a basic modal formula ϕ, is ϕ satisfiable in some model?) is decidable. That is, it is possible (again, ignoring constraints of time and space) to write a computer program which takes a basic modal formula as input, and halts after a finite number of steps and correctly tells us whether it is satisfiable in some model or not. The validity and satisfiability problems are dual problems: a modal formula ϕ is valid iff ¬ϕ is not satisfiable, hence if we have a method for solving one problem, we have a method for solving the other. In what follows we show that both problems are decidable; we’ll talk in terms of satisfiability. A lot is known about the decidability of satisfiability problems for various logics, so it is not too difficult to establish modal decidability: we can do so by reducing the problem to known
28
Patrick Blackburn and Johan van Benthem
results for other logics. Here’s an easy example. The satisfiability problem for the two variable fragment of first-order logic (that is, the fragment of first-order logic in which every formula contains only two variables) is decidable. Now, every basic modal formula can be translated into a formula in the two-variable fragment. To see this we need simply make a small adjustment to the standard translation STx . Whenever we translate a 3 or a 2, instead of choosing a completely new variable to quantify over accessible points, we use a second fixed variable (say y). If we later encounter another 3 or 2, we flip back to the original variable x, and so on. More precisely, we redefine STx so it always uses y to quantify over accessible points, and define a twin translation STy which always quantifies using x. Here are the key clauses: STx (3ϕ) STx (2ϕ)
= ∃y (Rxy ∧ STy (ϕ)) = ∀y (Rxy → STy (ϕ))
STy (3ϕ) STy (2ϕ)
= ∃x (Ryx ∧ STx (ϕ)) = ∀x (Ryx → STx (ϕ)).
The interleaving of STx and STy guarantees that for any basic modal formula ϕ, STx (ϕ) will contain only the two variables x and y, and it should be clear that the modified translation is equivalent to the original one. It follows that the satisfiability problem for the basic modal language must be decidable: to test a modal formula for satisfiability, simply translate it with this new version of the standard translation, and then apply the satisfiability algorithm for the twovariable fragment to the output. It is pleasant that modal decidability can be established so easily, but the proof isn’t particularly instructive. The following semantic argument is somewhat more revealing. We shall show that the basic modal language has the finite model property, or to put it another way, that it does not have the expressive strength required to force the existence of infinite models. Needless to say, this is in sharp contrast with first-order logic: even such a simple first-order formula as ∀x¬Rxx ∧ ∀xyz(Rxy ∧ Ryz → Rxz) ∧ ∀x∃yRxy has only infinite models. In fact, the basic modal language has a rather strong form of the finite model property. We shall show the following: THEOREM 18 (Strong Finite Model Property). Let ϕ be a basic modal formula. If ϕ is satisfiable, then it is satisfiable on a finite model containing at most 2s(ϕ) points, where s(ϕ) is the number of subformulas of ϕ. The decidability of the modal satisfiability problem follows immediately from this result. If a modal formula ϕ is satisfiable at all, it is satisfiable on a model containing at most 2s(ϕ) points. As there are (up to isomorphism) only finitely many such models, exhaustive (and exhausting!) search through them all will settle the issue of ϕ’s satisfiability. Just as important as the result is the method we shall use to prove it: filtrations. These are a standard item in the modal logician’s toolkit, and have been used to prove completeness and decidability results for many different modal systems. The basic idea underlying the method is simplicity itself: given a modal formula ϕ and a model M that satisfies it, we make a finite model M by collapsing to a single point all the points within M that satisfy the same subformulas of ϕ. But there is a tricky issue: how should we define the relation on the collapsed points in such a way that ϕ remains true in the finite model? Let’s work through the details and see. We shall say that a set of basic modal formulas Σ is subformula closed if every subformula of every formula in Σ is a member of Σ (that is, if ϕ ∧ ψ ∈ Σ then so are ϕ and ψ, and if ¬ϕ ∈ Σ then so is ϕ; and if 2ϕ ∈ Σ, then so is ϕ, and so on). We now define:
Modal Logic: A Semantic Perspective
29
DEFINITION 19 (Filtrations). Let M = (W, R, V ) be a model, let Σ be a subformula closed set of formulas, and let Σ be the equivalence relation on the states of M defined as follows: w Σ v iff for all ϕ in Σ: (M, w |= ϕ iff M, v |= ϕ). The official notation for the equivalence class of a point w of M with respect to Σ is |w|Σ , but in what follows we’ll usually assume that Σ is clear from context and simply write |w|. Let WΣ = {|w| | w ∈ W }. Suppose MfΣ is any model (W f , Rf , V f ) such that: 1. W f = WΣ . 2. If Rwv then Rf |w||v|. 3. If Rf |w||v| then for all 3ϕ ∈ Σ, if M, v |= ϕ then M, w |= 3ϕ. 4. V f (p) = {|w| | M, w |= p}, for all proposition symbols p in Σ. Then MfΣ is called a filtration of M through Σ. In what follows we’ll drop the subscripts and write Mf instead of MfΣ . Two points should be made about this definition. First, observe Mf is a filtration of M through a subformula closed set of formulas Σ, then Mf contains at most 2|Σ| nodes, where |Σ| is the cardinality of Σ. This should be clear: after all, the points of Mf simply are the equivalence classes in WΣ , and there cannot be more than 2|Σ| of these. Second, the previous definition does not specify an accessibility relation on WΣ — it only imposes constraints (namely clauses 2 and 3) on the properties a suitable accessibility relation Rf should have. That the constraints imposed are sensible is shown by the following result: THEOREM 20 (Filtration Theorem). Let Mf (= (WΣ , Rf , V f )) be a filtration of M through a subformula closed set of basic modal formulas Σ. Then for all formulas σ ∈ Σ, and all nodes w in M, we have M, w |= σ iff Mf , |w| |= σ. Proof. By induction on the structure of formulas. The case for proposition symbols is immediate from the definition of V f , and because Σ is closed under subformulas, the inductive step for the boolean connectives is clear. So suppose 3σ ∈ Σ and M, w |= 3σ. Then there is a v such that Rwv and M, v |= σ. As Mf is a filtration, by the first constraint on Rf (clause 2 of the previous definition) we have that Rf |w||v|. As Σ is subformula closed, σ ∈ Σ, hence by the inductive hypothesis Mf , |v| |= σ. Hence Mf , |w| |= 3σ. Conversely, suppose 3σ ∈ Σ and Mf , |w| |= 3σ. Then there is a state |v| in Mf such that Rf |w||v| and Mf , |v| |= σ. As σ ∈ Σ, by the inductive hypothesis M, v |= σ. Making use of ❑ the second constraint on Rf (clause 3 of the previous definition) yields M, w |= 3σ. It only remains to verify that relations satisfying the constraints demanded of Rf actually exist. They do. Define: 1. Rs |w||v| iff ∃w ∈ |w| ∃v ∈ |v| Rw v . 2. Rl |w||v| iff for all formulas 3ϕ in Σ: M, v |= ϕ implies M, w |= 3ϕ.
30
Patrick Blackburn and Johan van Benthem
It is straightforward to show that both relations satisfy the required constraints. Actually, you can show a little more: if Rf is any relation satisfying the above constraints then Rs ⊆ Rf ⊆ Rl . For this reason, Rs and Rl are said to give rise to the smallest and largest filtrations respectively. So we have proved Theorem 18: the basic modal language indeed has the strong finite model property. As we argued above, this in turn establishes the decidability of the basic modal satisfiability problem. Now, as is well known, the satisfiability problem for full first-order logic is undecidable. First-order logic is the classic example of a language where expressivity has been purchased at the expense of decidability. The basic modal language reverses this trade-off.
4.3 Satisfiability and validity: complexity What do the decidability proofs just given tell us about the computational complexity of the modal satisfiability problem? Only that it can be solved in NEXPTIME (that is, non-deterministic exponential time). This is clear from the filtration proof: to see if ϕ is decidable, we can nondeterministically choose a model containing at most 2s(ϕ) points, and then check whether or not it satisfies ϕ. As we have seen from our discussion of model checking, the checking takes time polynomial in the size of model; however as the model is exponential in the size of the input formula ϕ, this is a complex task. The reduction to the satisfiability problem for the two-variable fragment yields the same upper bound, as this problem is NEXPTIME-complete. But the satisfiability problem for basic modal logic is PSPACE-complete. That is, given a modal formula ϕ, it is possible to write an algorithm to determine whether or not ϕ is satisfiable that uses an amount of computer memory that is only polynomial in the size of ϕ. Now, most complexity theorists believe that PSPACE-complete problems are harder than the satisfiability problem for classical propositional logic (the classic NP-complete problem) but easier than EXPTIME-complete problems, which in turn are believed to be easier than NEXPTIMEcomplete problems. So, given standard complexity-theoretic assumptions, the modal satisfiability problem is probably easier than our earlier decidability proofs suggest. How do we design a PSPACE algorithm for modal satisfiability? We cannot give a detailed answer here, but we can point to an expressive weakness of modal logic which should make it plausible that PSPACE algorithms for modal satisfiability exist. LEMMA 21. Let M = (W, R, V ) be a model, let w ∈ W , let n be a natural number, let Sn,w be the subset of W containing w and all points in W reachable from w by making at most n Rtransitions, and let N be the submodel (Sn,w , R|S , V |S ), where R|S and V |S are the restrictions of R and V respectively to Sn,w . Then, for all basic modal formulas ϕ such that md(ϕ) ≤ n, we have that M, w |= ϕ iff N, w |= ϕ. That is, if we take a model M, and extract a submodel N from it by throwing away all points that are more than n steps away from w, then no formula with modal operator depth of at most n can distinguish the two models at w. Modal formulas have shallow vision. And if we combine this lemma with what we have already learned about finite models and bisimulations, we obtain the following: THEOREM 22. Every formula ϕ in the basic modal language is satisfiable in a model based on a finite tree of depth at most md(ϕ). Proof. As model logic has the finite model property, if a modal formula is satisfiable, it is satisfiable on a finite model M at some point w. As we remarked in the previous section, it is always possible to unravel a model into an equivalent tree-based model. Now, if we unravel M about w, we don’t necessarily obtain a finite model, but (as M is finite) we do obtain a model
Modal Logic: A Semantic Perspective
31
based on a tree with a finite branch factor, and this model satisfies ϕ at its root. If we then chop off all points more than md(ϕ) away from the root we obtain a finite model which (by the previous lemma) satisfies ϕ at its root. ❑ So every modal formula is satisfiable on a shallow tree, and we are now in a position to appreciate how PSPACE algorithms for modal satisfiability work. In essence, they construct shallow trees branch by branch. If a branch is successfully constructed (something which takes only space polynomial in the size of the input formula, as the length of the branch is bounded by md(ϕ)) the branch is discarded (thus freeing up the memory) and the next branch is then constructed. There may be many branches, so it may take exponential time to construct them all, but as all branches are discarded once they are constructed, such an algorithm uses only polynomial space. This sketch has neglected some important issues (such algorithms require space for recording book-keeping details, and we need to ensure that the space used for this is not excessive) but it does describe, in broad terms, how many modal satisfiability algorithms (notably those based on tableaux or games) work. But we should issue a word of warning: it’s not always so easy. Yes, matters are relatively straightforward here, but that is because we have been working with the basic modal language over the class of all models. If we impose restrictions on the class of models we are working with (as we shall do in Section 5) or work with richer modal languages (as we shall do in Section 6), or both, we can easily find ourselves faced with undecidable, or even highly undecidable, satisfiability and validity problems.
4.4 Other reasoning tasks We have discussed the big three (model checking, and satisfiability and validity checking) but this by no means exhausts the reasoning tasks of interest. To conclude this section, let’s briefly consider two others. Although we have stressed the locality of modal logic, some problems demand a global perspective. In particular, if we view a modal formula as a general background constraint, we will typically want it to be globally satisfied: that is, we will be interested in models M such that M |= ϕ. The importance of the global satisfiability problem has been strongly emphasised by the description logic community. Indeed, description logic builds into its architecture the idea of a Terminological Box (or TBox), a collection of formulas that encode background knowledge about some domain (for example, that all men are mortal, that all Martians own flying saucers, or that each employee has a social security number). Description logicians are interested in models in which the TBox is globally satisfied, for these are the models that reflect all the background assumptions. Once the importance of background constraints is realised, it becomes clear that it is not the pure global satisfiability task itself that is of primary interest. Rather, it is the local-global satisfiability task: given formulas ϕ and ψ, is there a model which locally satisfies ϕ and globally satisfies ψ? That is, is it possible to satisfy ϕ subject to the global constraint ψ? Here’s an example. Suppose we’re working in a zoological setting, and are interested in the interaction of maternal love and professional responsibility on the feeding of our furry ursine brethren. To put it another way, suppose we have the following TBox: bear ∨ human bear → ¬human
bear → MOTHER bear bear → [FEDBY](zoo-keeper ∨ mother)
32
Patrick Blackburn and Johan van Benthem
Let’s call this TBox BEAR - CARE. The sort of queries we might be interested in posing are: is it possible to globally satisfy BEAR - CARE and, simultaneously, to locally satisfy
MOTHER (bear ∧ human)? (No, it’s not.) And is it possible to globally satisfy BEAR - CARE and simultaneously to locally satisfy
FEDBY (¬human ∧ ¬mother)? (Yes, it is: BEAR - CARE doesn’t rule out having bears as zoo-keepers. This may well be a bug in the TBox.) Local-global satisfiability problems are also natural in the setting of parsing problems. It is possible to encode various kinds of grammars (such as regular grammars or context-free grammars) as modal formulas (see Chapter 19 of this handbook for a discussion of such approaches). Then, given a string of symbols, the parsing problem is to decide whether it is possible to find a model which embodies all the constraints encoded in the grammar, and which simultaneously satisfies the formula encoding the input string. That is, we would like to globally satisfy the modal formula GRAMMAR and simultaneously locally satisfy INPUT- STRING. Unsurprisingly, both the global, and the local-global satisfiability tasks are tougher than the ordinary satisfiability problem: THEOREM 23. The global satisfiability and the local-global satisfiability tasks for basic modal languages are both EXPTIME-complete. Proof. The stated result is an immediate consequence of Hemaspaandra’s [118, 65] complexity results for the universal modality (we introduce the universal modality in Section 6.1). But the result holds for even stronger languages; see De Giacomo and Lenzerini [28] for related results for more expressive description logics. ❑ EXPTIME-complete problems are decidable but provably intractable: they contain problem instances that will require time exponential in the size of the input to solve (which can mean that they require more time than the expected lifetime of the universe). This, however, is a worstcase scenario. One of the most important recent developments in computational logic has come from the description logic community, who have shown it is possible to specify and implement tableaux-based algorithms for such problems that are remarkably efficient in practice. Moreover, interesting work exists on performing modal theorem proving via (non-standard) translations into first-order logic, so that optimised first-order resolution provers can be applied to the task. For a detailed discussion and comparison of these methods, see Chapter 4 of this handbook, and for a deeper examination of the complexity of modal logic, see Chapter 3. We conclude with a remark on the model comparison task. As bisimulation is the modally fundamental notion of graph equivalence, it is natural to wonder how difficult it is to determine when two models are bisimilar. The corresponding problems for first-order logic (namely, testing for graph isomorphism) is thought to be difficult: there is no known polynomial algorithm for testing for graph isomorphism, though the problem has not been shown to be NP-complete either. In fact, the problem of identifying isomorphic graphs is sometimes regarded as giving rise to a special complexity class of its own. Testing for bisimulation, however, turns out to be computationally tractable, and there are elegant polynomial algorithms which work by discarding pairs of point that cannot make it into any bisimulation (see Dovier, Piazza and Policriti [33]). Again an expressivity result lies behind this result: the maximal bisimulation between two models M and N is explicitly definable
Modal Logic: A Semantic Perspective
33
in a first-order fixed-point language over the disjoint union M N of the two models. Such languages have been studied extensively in computer science, and they are known to have good computational behaviour. Let us summarise our discussion. For a number of tasks, the basic modal language (interpreted over the class of all models) is computationally better behaved than the corresponding first-order language (interpreted over the same models). Figure 17 summarises the relevant facts (PTIME is short for Polynomial Time). Of course, this better computational behaviour comes about because
FOL ML
Model Checking PSPACE-complete PTIME
Satisfiability Undecidable PSPACE-complete
Model Comparison in NP PTIME
Figure 17. First-order logic and modal logic: computational properties summarised. the basic modal language is not nearly as expressive as first-order logic. Thus the pressing questions are: what are the trade-offs? And can this better computational behaviour be lifted to more expressive modal logics, and (if so) how? We shall revisit these questions in the following two sections. 5
RICHER LOGICS
Until now, we have deliberately said rather little about modal logics and what they are. Instead we have acted as if there was only one modal logic of any interest, namely the set of valid formulas (that is, the set of formulas satisfied at all points in all models) or, to put it syntactically, the set of formulas generated by the minimal proof system K (which we defined at the start of Section 2.2). But traditional presentations of modal logic tend to emphasise the multiplicity of modal logics, and devote a great deal of attention to logics richer than K, logics with such names as T, K4, S4, S5, GL, and Grz. Where do richer modal logics come from? As a first approximation (we’ll shortly see why it’s only an approximation) we might say that richer logics emerge at the level of frames, via the concept of frame validity. Let ϕ(p1 , . . . , pn ) be a basic modal formula built out of the proposition symbols p1 , . . . , pn . We say that ϕ(p1 , . . . , pn ) is valid on a frame F = (W, R) at a point w if, for each valuation V for its proposition symbols p1 ,. . . ,pn , we have that ϕ is satisfied in the resulting model at w; in such a case we write F, w |= ϕ. We say ϕ is valid on F if it is valid at each point in F, and we write this as F |= ϕ. Moreover, we say that a modal formula is valid on a class of frames F if it is valid on each frame F in F. Note that a valid formula (as defined in Section 2.1) is simply a formula that is valid on the class of all frames. The starting point for this section is the observation that different applications of modal logic typically validate different modal axioms, axioms over and above those to be found in the minimal system K. For example, if we view our models as flows of time, it is natural to assume that the accessibility relation is transitive, and (as the reader should check) any instance of the schema 2ϕ → 22ϕ is valid on the class of transitive frames (for example, the formula 2p → 22p is valid on such frames, and 2(p ∨ q) → 22(p ∨ q) is too). However no instance of this schema (which for historical reasons is called 4) is provable in K, so if we want a logic for working with temporal flows we should add all its instances as extra axioms, and doing so yields the logic known as K4. Or suppose we are modeling situations where the frame relation has to be treated
34
Patrick Blackburn and Johan van Benthem
as a partial function. As the reader should check, all instances of the schema 3ϕ → 2ϕ are valid on the class of such frames, and none of them can be proved in K, so once again we should add them as extra axioms. Doing so yields the logic called KAlt1 . We begin this section by briefly discussing such axiomatic extensions of K a little further. But our real interest is not the richer logics that arise by adding extra axioms (for an introduction to this topic, see Chapter 2 of this handbook) rather it centres on the following semantic questions: what can modal formulas say about frames, and how do they say it? As we shall see, there is a fundamental expressivity distinction between the level of models and the level of frames: whereas modal logic at the level of models is the bisimulation invariant fragment of first-order logic, at the level of frames it is a fragment of second-order logic.
5.1 Axioms and relational frame properties One of the most attractive features of modal logic is the illumination provided by the fact that modal axioms reflect properties of accessibility relations. A typical modal completeness theorem reads like this: THEOREM 24. A formula is provable in S4 iff it is true in all models based on frames whose accessibility relation is transitive and reflexive. Proof. See Chapter 2 of this handbook (or indeed, virtually any introduction to modal logic). ❑ That is, the theorems of S4 are true in all graphs with a transitive and reflexive relation, while its non-theorems have some transitive and reflexive counter-model; the additional axioms reflect simple visualisable geometric conditions in the semantics. There are many techniques for proving such completeness results, ranging from simple inspection of the canonical model constructed from all complete theories in the logic (this fundamental technique is introduced in Chapter 2 of this handbook) to various types of model surgery (such as filtration, unraveling, and taking bounded morphic images). Moreover, the motivations for proving modal completeness theorems may differ. Sometimes we start with an independently interesting proof system and try to find a useful corresponding class of frames. The classic example of this is the proof system GL, that is K enriched with all instances of the L¨ob axiom schema 2(2ϕ → ϕ) → 2ϕ, which arose via the study of arithmetical provability (see Chapters 2 and 16 of this handbook for further discussion of GL) and was later proved complete with respect to the class of finite trees (where the binary relation interpreting the modalities is the transitive closure of the one-step daughterof tree relation). Sometimes, however, we might start with a natural model class — say an interesting space-time structure — and try to axiomatise its modal validities. The literature is replete with both variants. Nowadays a lot is known about axiomatic extensions of K. For a start, it turns out that there are uncountably many such normal modal logics, as they are often called. It is usual to identify a normal modal logic with the set of formulas it generates, and we say that a modal logic is consistent if it does not contain all formulas. This identification immediately induces a lattice structure on the set of all such logics. The cartography of this landscape is an object of study in its own right; here we shall only mention that, because of the following result, it contains two major highways. THEOREM 25. Let Id be the normal modal logic generated by K enriched with all instances of the axiom schema ϕ ↔ 2ϕ, and let Un be the normal modal logic generated by K enriched with the axiom 2 ⊥. Every consistent normal modal logic is either a subset Id or Un.
Modal Logic: A Semantic Perspective
35
Proof. See Makinson [92] for the original (algebraic) proof. After we have introduced generated submodels and bounded morphisms for frames we will be able to sketch the semantic ideas that underly this result, and we shall do this shortly. ❑ Now, as the reader should check, every instance of ϕ ↔ 2ϕ is valid on frames which consist of a collection of isolated reflexive points, and 2 ⊥ is valid on frames consisting of a collection of isolated irreflexive points. Moreover, using standard techniques it is easy to show that Un is complete with respect to the first frame class, and Id with respect to the second. Thus the semantic content of Theorem 25 is that every normal modal logic is contained in the logic of one of these frame classes; for example, S4 lies on the first road, and GL on the second. But the most important fact to have emerged about normal modal logics is that not all of them have frame-based characterisations. In fact, frame completeness results (such as the result for S4 noted above) are the exception rather than the rule. Thus our earlier remark that richer logics emerged at the level of frames via the concept of frame validity was very much a first approximation: the notion of frame validity simply does not provide an adequate semantic basis for studying all normal modal logics. Here is a concrete example of a frame incompleteness result: THEOREM 26. Let TMEQ be the normal modal logic obtained by enriching K with all instances of the following schemas: ϕ → 3ϕ (T), 23ϕ → 32ϕ (M), 3(3ϕ ∧ 2ψ) → 2(3ϕ ∨ 2ϕ) (E), and (3ϕ ∧ 2(ϕ → 2ϕ)) → ϕ (Q). There is no class of frames that validates precisely the formulas in TMEQ. Proof. See van Benthem [129].
❑
Such incompleteness results (which were first proved in the early 1970s by Thomason [125] and Fine [43]) were important in the development of modal logic. For a start, they forced modal logicians to examine alternative ways of semantically characterising normal modal logics, and this led to a renaissance in algebraic semantics of modal logic (see Chapter 6 of this handbook for more on this topic). But they also had another effect, one more relevant to the present chapter: they stimulated a wave of semantic research at the level of frames. This new wave of research was centred around the notion of frame definability, the topic to which we now turn.
5.2 Frame definability and undefinability Before getting to work, a brief remark. There is another way of thinking about axiomatic extensions of K. Instead of viewing them as giving rise to brand new modal logics, we can simply view them as theories constructed over the minimal logic K in much the same way as a first-order theory (of say, linear orders) is constructed over the set of first-order validities. Nothing of substance hangs on this shift of perspective, but it fits more naturally with our focus on expressivity. So, bearing this in mind, let’s pose the first question: what can modal formulas say about frames? A natural way to approach this is to introduce the concept of frame definability. We shall say that a modal formula ϕ defines a class of frames F iff it is valid on precisely the frames in F. That is, not only must ϕ be valid on every frame in F, it must also be possible to falsify ϕ on any frame that is not in F. So, what classes of frames can modal languages define? Here are some simple examples: PROPOSITION 27. 1. 2p → 22p defines the class of transitive frames; that is, frames such that ∀xyz(Rxy ∧ Ryz → Rxz).
36
Patrick Blackburn and Johan van Benthem
2. 3p → 2p defines the class of frames where the frame relation R is a partial function; that is, frames such that ∀xyz(Rxy ∧ Rxz → y = z). 3. p ↔ 2p defines the class of frames which consist of isolated reflexive points; that is, frames such that ∀xy(Rxy ↔ x = y). 4. 2 ⊥ defines the class of frames which consist of isolated irreflexive points; that is, frames such that ∀xy¬Rxy. Proof. We have already asked the reader to check that these formulas are valid on the class of frames in question. So to complete the proofs of these definability claims we need merely check that each formula can be falsified on any frame that does not belong to the relevant class. Let’s deal with the second example. Suppose (W, R) is a frame where R is not a partial function. This means that there is a point w ∈ W that has two distinct R-successors, say u and v. It follows that we can falsify 3p → 2p on (W, R) at w. For let V be the valuation that makes p true at u and nowhere else. Then (W, R, V ), w |= 3p but (W, R, V ), w |= 2p, since p is not true at v. So we have falsified 3p → 2p on (W, R) as required. ❑ A remark on terminology. Instead of saying, for example, that 2p → 22p defines the class of transitive frames, we often simply say that 2p → 22p defines transitivity. It is also usual to say that 2p → 22p corresponds (at the level of frames) to ∀xyz(Rxy ∧ Ryz → Rxz), or that ∀xyz(Rxy ∧ Ryz → Rxz) is a frame correspondent for 2p → 22p. Now for an important question: how do we go about showing that a class of frames cannot be modally defined? Answering such questions is typically more demanding than proving the type of result noted in Proposition 27, for instead of checking that a given formula defines a given frame class, we now have to prove that no modal formula is capable of this. How can we prove such general results? By finding ways of transforming frames that preserve frame validity. For if we can show that a class of frames F is not closed under such a transformation, it follows that F is not modally definable. Let’s take a closer look. The first step is to find transformations that preserve frame validity. Three lie close to hand: the formation of disjoint unions, generated submodels, and bounded morphic images. In Section 3.2 we defined these constructions at the level of models, and they can be lifted to the level of frames simply by ignoring the requirements imposed on the valuations. For example, a bounded morphism between frames (W, R) and (W , R ) is a function f from W to W that satisfies the morphism condition (if Rwv, then R f (w)f (v)) and the zag condition (if R f (w)v , then there exists a v such that f (v) = v and Rwv), and we say that frame (W , R ) is a bounded morphic image of frame (W, R) if there is a surjective bounded morphism from (W, R) to (W , R ). Lifting these constructions to the level of frames immediately gives us three validity preservation results: THEOREM 28.
For all basic modal formulas ϕ we have that:
1. Let {Fi | i ∈ I} be a family of frames. Then if Fi |= ϕ for every i in I, we have that Fi |= ϕ too. That is, frame validity is preserved under the formation of disjoint unions. 2. Let F be a generated subframe of F. Then if F |= ϕ, we have that F |= ϕ too. That is, frame validity is preserved under the formation of generated subframes. 3. Let F and F be frames and f a surjective bounded morphism from F to F . Then if F |= ϕ, we have that F |= ϕ too. That is, frame validity is preserved under the formation of bounded morphic images.
Modal Logic: A Semantic Perspective
37
Proof. We prove the result for bounded morphisms; we show the contrapositive. Given frames F = (W, R) and F = (W , R ) such that F is a bounded morphic image of F under f , suppose that F |= ϕ. This means that for some valuation V on F and some point w ∈ W we have that (F , V ), w |= ϕ. Let V be the valuation on F defined by V (p) = {u ∈ W | f (u) ∈ V (p)}, for all proposition symbols p. Furthermore, let w be any point such that f (w) = w ; there must be at least one such point as f is surjective. Then the model (F , V ) is a bounded morphic image of the model (F, V ), and hence (F, V ), w |= ϕ. ❑ Applying this theorem immediately gives rise to a crop of non-definability results. Here are some simple ones. Basic modal languages cannot define the class of simply connected frames, that is, the class of frames such that ∀xy(Rxy ∨ Ryx). Why not? Because this class is not closed under the formation of disjoint unions: taking the disjoint union of two frames with this property clearly results in a frame without it. As a second example, the basic modal languages cannot define the class of frames containing an isolated reflexive point. Why not? Because this class is not closed under the formation of generated subframes. For consider a frame consisting of two isolated points, one reflexive, the other irreflexive. This frame belongs to the required class, however the subframe generated by the irreflexive point does not. As a third example, the class of irreflexive frames is not modally definable. Why not? Because it is not closed under the formation of bounded morphic images (recall the bounded morphism of Figure 13 which collapses the natural numbers to a single reflexive point). But frame validity is preserved under this transformation, hence no modal formula can define irreflexivity. For more sophisticated applications of these validity preservation results, see van Benthem [137]. These results also give us insight into the semantic ideas behind Theorem 25. For consider a consistent normal logic. Suppose one of the frames on which it is valid contains an isolated irreflexive point; then (appealing to the preservation of validity under generated subframes) the frame consisting of just that single point validates the logic too. So suppose that no frame containing an isolated point validates the logic. But this means that in all frames that validate the logic, every point has at least one successor. But if we map all the points in such a frame to a singleton reflexive point, the mapping is a bounded morphism. Hence it follows that the logic is validated on frames consisting of isolated reflexive points. As we shall soon see, the three frame transformations just introduced all play a role in the Goldblatt-Thomason Theorem, a characterisation of modally definable classes of elementary frames. But a fourth transformation, namely the formation of ultrafilter extensions, is also needed to complete the statement of this celebrated result, so let’s take this opportunity to define this (somewhat more complex) frame construction. First we recall a standard mathematical concept. Given a non-empty set W , a filter F over W is any subset of 2W (the power set of W ) that contains W and is closed under finite intersection (that is, if X, Y ∈ F then X ∩ Y ∈ F ) and set-theoretic inclusion (that is, if X ∈ F and X ⊆ Y ⊆ W then Y ∈ F ). A filter is called proper if it is distinct from 2W . An ultrafilter is a proper filter U such that for all X ∈ 2W , X ∈ U iff (W \X) ∈ U . A standard result assures us that any proper filter can be extended to an ultrafilter. Bearing this in mind, we make the following definition: DEFINITION 29 (Ultrafilter Extensions of Frames). Let F = (W, R) be a frame. For any X ⊆ W we define l(X) to be {w ∈ W | for all v ∈ W , if Rwv then v ∈ X}. Then the ultrafilter extension ue(F) of F is defined to be the frame (uf(W ), Rue ), where uf(W ) is the set of all ultrafilters on W and Rue is the relation consisting of all pairs of ultrafilters U, U such that for all X ⊆ W , if l(X) ∈ U , then X ∈ U . We can now state the required theorem. Note that the direction of validity preservation is
38
Patrick Blackburn and Johan van Benthem
the reverse of that found in Theorem 28. That is, here frame validity is preserved from the transformed frame (here the ultrafilter extension) back to the original one: THEOREM 30. For any basic modal formula ϕ, if ue(F) |= ϕ then F |= ϕ does too. That is, frame validity reflects ultrafilter extensions. Proof. The use of ultrafilter extensions in modal logic traces back to Goldblatt [57, 58], van Benthem [130], and Fine [44]. For a detailed proof of this theorem, see Proposition 2.59 and Corollary 3.16 of Blackburn, de Rijke and Venema [13]. ❑ Although this transformation is harder to visualise than the previous three, it too gives rise to some simple non-definability results. Here’s a nice example, taken from Goldblatt and Thomason [60], showing that the class of frames satisfying ∀x∃y(Rxy ∧ Ryy) is not modally definable. We can see this as follows. The ultrafilter extension of (N, <), the natural numbers in their usual order, looks a bit like a gigantic lolly-pop. It has an infinite handle, an isomorphic copy of (N, <), consisting of all the principal ultrafilters (that is, those ultrafilters which contain a singleton set {n}, where n is a natural number). This is followed by the lolly: an uncountable collection of non-principal ultrafilters which are all related to one another and reflexively related to themselves. Hence ue(N, <) has the property ∀x∃y(Rxy ∧ Ryy). Why? Because every point in the frame is related to the reflexive points in the lolly. However this formula is clearly not valid on the original frame (N, <). As frame validity reflects ultrafilter extensions, it follows that the class of frames satisfying ∀x∃y(Rxy ∧ Ryy) is not modally definable. For further discussion of ultrafilter extensions from a model-theoretic perspective, see Chapter 5 of this handbook. There is also an important algebraic perspective on ultrafilter extensions, which is discussed in Chapter 6.
5.3 Frame correspondence and second-order logic Now that we have some idea of what basic modal languages can (and cannot) say about frames, we turn to the second question: how do they say it? And here we encounter something interesting. Note that all four classes of frames mentioned in Proposition 27 are definable by simple firstorder formulas — and this is actually rather puzzling. After all, if you think about what it means for a basic modal formula ϕ(p1 , . . . , pn ) to be valid on a frame, we see that this concept is essentially second-order: we quantify across all possible valuations, and valuations assign subsets of frames to proposition symbols. We can make this second-order perspective precise with the help of the standard translation. Let F be a frame, let M = (F, V ) be any model over F, and let w be any point in F. By Proposition 3 we have that (F, V ), w |= ϕ(p1 , . . . , pn ) iff (F, V ) |= STx (ϕ)(P1 , . . . , Pn )[x ← w]. (Here P1 , . . . , Pn are the monadic predicate symbols used to translate the proposition symbols p1 , . . . , pn .) How do we lift this equivalence (which lives at the level of models) to an equivalence at the level of frames (the level where validity is the primary semantic concept)? Very straightforwardly. A formula is valid on a frame iff it is satisfied at any point in the frame under any assignment of subsets of the frame to the proposition symbols. So we only need to universal quantify over the points that can be assigned to x (a first-order quantification) and over the assignments to the monadic symbols P1 , . . . , Pn (a second-order quantification). Doing so gives us the fundamental correspondence between frame validity and second-order logic: F |= ϕ(p1 , . . . , pn ) iff F |= ∀P1 · · · Pn ∀xSTx (ϕ).
Modal Logic: A Semantic Perspective
39
In short, frame validity systematically treats modal formulas ϕ as the universal monadic secondorder closure of their standard first-order translations on relational models. The second-order upgrade of the first-order correspondence language is often called the frame correspondence language or the second-order correspondence language. Let’s look at an example. Recall that in Section 2.2 we showed that the standard translation of p → 3p was P x → ∃y(Rxy ∧ P y). So if we ask what p → 3p defines at the level of frames we can give an immediate answer: it defines the class of frames satisfying the following monadic second-order formula: ∀P ∀x(P x → ∃y(Rxy ∧ P y)).
Now, it’s certainly pleasant to be able to systematically calculate frame correspondences for modal formulas in this way — but the puzzle remains. Indeed, if anything it has become more acute. For most of the modal formulas encountered in practice correspond to simple first-order conditions on frames, yet these conditions are systematically expressed using rather complex second-order expressions. The translation just considered is a good example. As the reader should check, p → 3p corresponds to the first-order formula ∀xRxx (that is, it defines reflexivity). And if you think about it, you will see that ∀P ∀x(P x → ∃y(Rxy ∧ P y)) is indeed a rather roundabout way of expressing reflexivity. For a start, it’s easy to see that this sentence is true on any reflexive frame. Conversely, if this sentence is true on a frame (W, R), then P x → ∃y(Rxy ∧ P y) must be true under any assignment to the free variables x and P . Hence, for any w ∈ W , this formula is true if we assign w to x and {w} to P . This assignment makes the antecedent true (indeed, it is the minimal valuation required to make the antecedent true; the significance of this remark will become clear when we discuss the Sahlqvist Correspondence Theorem) so we must have that ∃y(Rxy ∧ P y) is true too. But this is only possible if Rww. Hence, as w was arbitrary, this means that R must be reflexive, and thus the original secondorder sentence really does express reflexivity. As we said earlier, one of the key questions we are interested in is how modal languages talk about frames. And now we have an answer. They do so via a detour through second-order logic. Moreover, this detour is not eliminable. That is, while experience shows that most common modal formulas correspond to first-order conditions on frames, some modal formulas define conditions that are not elementary. A famous case is L¨ob’s formula, 2(2p → p) → 2p, the characteristic axiom of the logic GL. This defines the conjunction of the transitivity of R with the converse well-foundedness of R (that is, it forbids the existence of infinite chains of related points w1 Rw2 Rw3 Rw4 Rw5 . . .). This condition is non-elementary, as an appeal to the Compactness Theorem for first-order logic shows. Another well-known modal axiom that defines a non-elementary class of frames is the McKinsey formula 23p → 32p. This can be shown by appealing to the L¨owenheim-Skolem Theorem for first-order logic. For full proof details for both the L¨ob and McKinsey examples, see Blackburn, de Rijke and Venema [13]. Summing up, we are confronted with an intriguing situation. At the level of frames, modal formulas systematically correspond to second-order conditions on frames. Nonetheless, in many common cases these second-order conditions turn out to be equivalent to first-order conditions. This raises some interesting questions. Are there criteria that demarcate modal formulas that are essentially first-order at the level of frames from the genuinely second-order ones? And can we characterise the elementary frame classes that are modally definable?
40
Patrick Blackburn and Johan van Benthem
5.4 First-order frame definability As we have just learned, the link between first-order definable frame classes and modal logic is not straightforward. Nonetheless, some elegant general results are known, and we shall briefly discuss three of them here. We first note two results which bear upon the demarcation issue: the Sahlqvist Correspondence Theorem (which isolates a large class of formulas all of which define elementary classes of frames) and a model-theoretic characterisation of the modal formulas which define elementary frame classes. Following this we discuss the celebrated GoldblattThomason Theorem, a model-theoretic characterisation of the elementary frame classes that are basic modal definable. All three results (and others bearing on the theme of elementary frame definability) are discussed in greater detail in Chapter 5 of this handbook. Let’s start with the Sahlqvist [111] result. Upon closer inspection, first-order frame conditions often arise because of the syntactic shape of the defining modal formula — for example the quantifier shape of the first-order formula for transitivity is matched by the sequence of boxes in 2p → 22p. The following theorem gives us a natural account of such correspondences. It trades systematically on the idea (noted when we discussed the second-order definition of reflexivity) of substituting minimal verifying valuations in antecedents. THEOREM 31 (Sahlqvist Correspondence Theorem). There is an effective method for computing first-order equivalents for Sahlqvist formulas, that is, formulas of the form ϕ → ψ with antecedents ϕ constructed from atoms (possibly prefixed by boxes) using conjunctions, disjunctions and diamonds, while consequents ψ can be any modal formula with only positive occurrences of proposition symbols. Proof. The effective method (in the form originally introduced by van Benthem [128, 131]) is usually called the substitution algorithm. The following example will give an idea of how it works. The 4 formula, 2p → 22p, is a Sahlqvist formula and its second-order translation is ∀P ∀x(∀y(Rxy → P y) → ∀y(Rxy → ∀z(Ryz → P z))). Now, if we could eliminate all the occurrences of P in this formula, we would render the secondorder quantification needed to express validity vacuous. But can P be eliminated in a semantically sensible way? Because of the syntactic restrictions that Sahlqvist formulas conform to, it turns out that it can. We do so by replacing P by a first-order expression describing the minimal valuation needed to make the antecedent of 2p → 22p true. Now, the minimal way of making 2p true is to make p true at all successors of the point of evaluation x, so the required substitution is P u := Rxu. Performing this substitution yields the following first-order expression: ∀x(∀y(Rxy → Rxy) → ∀y(Rxy → ∀z(Ryz → Rxz))). The antecedent is now tautologically true, and dropping it leaves us with the expression ∀x∀y(Rxy → ∀z(Ryz → Rxz)). But this is a first-order formula expressing transitivity. For a precise specification of the substitution algorithm, and a proof that it works as required, see Blackburn, de Rijke and Venema [13]. The heart of the proof is to show that a Sahlqvist antecedent is true under any value for its proposition symbols iff it is true under its minimal values. ❑ The Sahlqvist Correspondence Theorem and its proof method are very powerful and can be extended to far stronger modal languages. Nevertheless there are also modal formulas which
Modal Logic: A Semantic Perspective
41
express first-order conditions on frames that are not covered by the theorem. The K4.1 axiom (2p → 22p) ∧ (23p → 32p) is a conjunction of the 4 axiom with the McKinsey axiom. It defines the class of frames with a transitive and atomic relation, that is the class of transitive frames such that ∀x∃y(Rxy ∧ ∀z(Ryz → z = y)). But this first-order equivalence cannot be computed using the substitution method. See van Benthem [137] or Blackburn, de Rijke and Venema [13] for further discussion. So the Sahlqvist result doesn’t fully pin down the modal formulas that define elementary frame classes. However model-theoretic characterisations exist. For example we have: THEOREM 32. A modal formula defines a first-order frame property iff it is preserved under taking ultrapowers of frames. Proof. For the original proof, see van Benthem [131]. For an introduction to ultrapowers, consult Chang and Keisler [23]. ❑ Closure under ultrapowers is an abstract feature, and it is not easy to use it to recognise whether a given modal formula is first-order over frames. But then no simple method can be expected to work: Chagrova [21] shows that the problem of determining whether a modal formula expresses a first-order condition on frames is undecidable. But now for our other question: which elementary classes of frames are modally definable? The classic result here is the Goldblatt-Thomason Theorem. This tells us that the four frame preservation results noted earlier are not merely necessary, they are also sufficient to characterise first-order frame definability: THEOREM 33 (Goldblatt-Thomason Theorem). A first-order frame property is modally definable iff it is preserved under taking disjoint unions, generated subframes, bounded morphic images, and reflects ultrafilter extensions. Proof. The left-to-right direction is just a restatement of the results noted in Theorems 28 and 30. The real work lies in the converse. The original proof, due to Goldblatt and Thomason [60] was algebraic; we briefly discuss this approach in Section 7.1, and an algebraic proof is given in Chapter 6 of this handbook. Nowadays there are also purely model-theoretic proofs; see van Benthem [133] for the earliest of these. ❑
5.5 Correspondence in richer languages Throughout this section we have kept our eyes firmly on the goal of understanding modal expressivity with respect to elementary frame classes. This is an important topic (after all, we want to understand as much as possible about the route modal logic over frames takes from monadic second-order logic back to first-order logic) but it is also natural to wonder about the expressivity of modal logic with respect to non-elementary frame classes. Unfortunately, it is harder to come up with elegant answers here. In particular, we can’t expect sweeping model-theoretic characterisations. Model-theoretic characterisations of elementary frame definability, such as Theorem 32 and the Goldblatt-Thomason Theorem, rest on the conceptual edifice of first-order model theory. Second-order model theory is nowhere near as well developed. Nonetheless, some interesting results are known. For example, it turns out that we can apply the ideas underlying the proof of the Sahlqvist Correspondence Theorem beyond the confines of first-order logic. Let’s briefly consider what is involved. The following discussion is based on
42
Patrick Blackburn and Johan van Benthem
van Benthem [138]. Chapter 5 of this handbook contains a more detailed discussion of related material. The substitution algorithm for Sahlqvist formulas runs into difficulties with more complex antecedents; a classic example is L¨ob’s formula 2(2p → p) → 2p, which defines a nonelementary class of frames. But let’s reflect on why we compute the minimal antecedent values for Sahlqvist formulas. In fact there are two reasons. Firstly, because Sahlqvist antecedents are true under any value for their proposition symbols iff they are true under their minimal values. Secondly, because such minimal predicates are first-order definable. Now, as it happens, the L¨ob antecedent does not fulfil the first-order definability criterion, but this does not mean that all that can be said is that the L¨ob’s formula is intrinsically second-order — for, as it turns out, there is a smallest semantic value for the predicate P which will make its antecedent true. This is the set of points in the frame obtained by taking the intersection of all predicates P validating 2(2p → p) where p is interpreted as P . Such a set must exist, because the standard translation of the L¨ob antecedent has a special syntactic form. Call a first-order formula ϕ(P ) intersective if it has one of the forms: 1. ∀x(ψ(P, Q, x) → P x), with P occurring only positively in ψ(P, Q, x). 2. ψ(P, Q), with P occurring only negatively in ψ. It is easy to show that all formulas ϕ(P ) of this form have the above-mentioned intersection property: if ϕ(P ) holds for any predicate P it holds for the intersection of all predicates P satisfying it. Thus it makes sense to talk about minP.ϕ(P ), the minimal satisfying predicate. Of course, such predicates need not be first-order definable, but it is not hard to show that minimal predicates for intersective first-order formulas are definable in a well-known extension of first-order logic, namely LFP(FOL), first-order logic with monotonic fixed-points (we shall introduce the idea of monotonic fixed-points in more detail when we discuss the modal μ-calculus in Section 6). LFP(FOL) has many uses in computer science; it lies between first-order and second-order logic, and retains many useful model-theoretic properties such as invariance for potential isomorphism (see Ebbinghaus and Flum [35] for an introduction to LFP(FOL)). Now, once we have such a minimal value for the antecedent predicates, it can be substituted into the consequent to obtain a frame equivalent just as before — though now, of course, we obtain an equivalent in LFP(FOL). To return to our example, the standard translation of the L¨ob antecedent ∀y((Rxy ∧ ∀z(Ryz → P z)) → P y) is indeed intersective in the above sense. Therefore, the corresponding frame property of the L¨ob formula can be computed and (as we would expect) the result is an LFP(FOL) formula defining the property of transitivity plus converse well-foundedness. As a second example, consider the axiom of cyclic return: (3p ∧ 2(p → 2p)) → p. Again, this is not a Sahlqvist formula. But again, the antecedent is intersective (once we have moved out the modal 3 to become a prefixed universal quantifier, as before in the substitution algorithm) and gives rise to a simple fixed-point computation for an equivalent frame property: Every point x with an R-successor y can be reached from y by a finite sequence of successive R-steps. We can express this condition in LFP(FOL) as follows. First we define the concept of transitive closure: R+ xy =def minS, xy.Rxy ∨ ∃z(Rxz ∧ Szy).
Modal Logic: A Semantic Perspective
43
We can then capture the stated frame condition by insisting that: ∀xy(Rxy → R+ yx). This is the beginning of a further layering of modal formulas with respect to semantic complexity. For there are also modal formulas with frame equivalents which cannot be expressed in LFP(FOL). One example is the well known axiom in tense logic expressing Dedekind Completeness of linear orders, which is not preserved under the potential isomorphism between the rationals and the reals. And recently, van Benthem and Goranko have shown that the McKinsey formula, whose antecedent is typically non-intersective, does not correspond to any LFP(FOL) formula. We started this chapter by saying that the process interpretation is a fundamental way of viewing modal logic. The present discussion shows that there is a natural link between modal logic and a far more sophisticated logic of processes, namely LFP(FOL). We will return to the process interpretation in Section 6 when we examine Propositional Dynamic Logic and the modal μ-calculus, stronger modal languages which, like LFP(FOL), can express some non-elementary concepts, such as transitive closure.
5.6 Remarks on computability In Section 4 we contrasted the PSPACE decidability of modal logic with the undecidability of first-order logic. But these results concerned satisfiability and validity on the class of all frames. Suppose we restrict attention to particular classes of frames defined by basic modal formulas. There is no reason to suppose that modal satisfiability and validity problems over such frame classes will always be in PSPACE, or even that they will be decidable. And indeed, in many cases they are not not. In some cases, restricting attention to a certain class of frames may lower the computational complexity. For example, suppose we restrict attention to the frames defined by 3p → 2p, that is, the class of frames in which R is a partial function. Then the task of testing basic modal formulas for satisfiability becomes NP-complete, that is, no worse than the satisfiability problem for propositional logic. This is because (as the reader can easily check) if a basic modal formula ϕ has a model based on a frame in this class, then it not only has a finite model in this class, but a model containing at most n + 1 points, where n is the number of modalities in ϕ. Thus a non-deterministic algorithm which guesses a model, checks that it belongs to the frame class, and verifies that the formula is satisfied on it, runs in time polynomial in the size of ϕ. But restricting attention to particular frame classes can easily result in undecidable problems. A recurring theme is the distinction between tree-like and grid-like models. We have already discussed why tree-like models are relevant to modal decidability over the class of all models; here we’ll merely add that many more modal decidability results can be proved by appealing to Rabin’s Theorem (see [107]), which in its simplest form shows that the monadic second-order theory of binary branching trees is decidable. Grid-like models, on the other hand, are (roughly speaking) those that contain regions that look like N×N (the product of the natural numbers with itself) under two orderings: the horizontal ordering (that is, (j, k)Rh (j + 1, k)), and the vertical ordering (that is, (j, k)Rv (j, k + 1)) which together give rise to the characteristic grid-like shape. Now, it is hard to give precise generalisations, but experience shows that while even very strong modal languages tend to be decidable over tree-like models, even quite weak languages can be undecidable over grid-like models; we shall note such an example in Section 6 when we discuss combinations of modal logics. Such undecidability results ultimately trace back to the possibility
44
Patrick Blackburn and Johan van Benthem
of encoding the N × N tiling problem, which is known to be undecidable. For a detailed account of the tiling problem, and a proof that it is undecidable, see Berger [12]. Here we’ll simply say that it is essentially a geometrical puzzle. We are presented with a finite collection of square tile types, of fixed orientation. Each edge of each tile type is coloured. The N×N tiling problem asks: is it possible to write an algorithm which, when presented with such a collection of tile types, can correctly determine whether or not N × N can be tiled, using only tiles of the given type, in such a way that colours on adjacent tile edges match? That is, is it possible to place a tile (of one of these types) on each point of N × N, in such a way that colours match both vertically and horizontally? For some tile types, this is possible, for others it is impossible. However there is no algorithm for deciding for which tile types this can be done; it is a simple, and elegant, example of a computationally undecidable problem. Showing that a modal logic is strong enough to encode this problem is often a straightforward way of showing its undecidability; see Blackburn, de Rijke and Venema [13] for examples of how to use the tiling problem in this way. In a slogan: trees tend to be safe, but beware of grids. Somewhat poetically, we can imagine modal logic as a small boat navigating somewhere on the border between decidability and undecidability, as Figure 18 shows.
Figure 18. Modal logic: tacking between safety and danger. Furthermore, it is important to realise that undecidable problems arise even when attention is restricted to finite frames; see, for example, Urquhart [127]. And indeed, even in the finite case, undecidability turns out to be the norm. It is straightforward to show that there are nondenumerably many distinct frame satisfiability problems over finite frame classes (an elegant demonstration of this, due to Spaan [118], is given as Exercise 6.2.4 of Blackburn, de Rijke and Venema [13]). As there are only denumerably many computable functions, undecidability is almost always guaranteed. So what about recursive enumerability? That is, if we restrict attention to a class of frames F that is defined by a modal formula, is the theory of this frame class (that is, the set of formulas ϕ valid on all frames F) recursively enumerable? Well, if F is elementary, the answer is yes: PROPOSITION 34. Suppose that F is an elementary class of frames defined by a basic modal formula ϕ. Then the set of basic modal formulas that are valid on all frames in F is recursively enumerable. Proof. As F is an elementary class that ϕ defines, ϕ corresponds to some first-order formula α. Now a basic modal formula ψ is valid on frames for ϕ iff its second-order translation
Modal Logic: A Semantic Perspective
45
∀P1 · · · Pn ∀xSTx (ψ) is true in all models of the first-order formula α, that is, iff α |= ∀P1 · · · Pn ∀xSTx (ψ), where |= is classical entailment. But as α is first-order, referring to R only, the predicates P1 · · · Pn do not occur in α and hence this is equivalent to α |= ∀xSTx (ψ). But this is a first-order entailment, and as such entailments are recursively enumerable the result follows. ❑ However once we move beyond the elementary frame classes, even recursive enumerability is lost. A key result here is Thomason’s [126] reduction of the standard consequence relation for the second-order correspondence language to the global frame consequence relation for a basic modal language with one modality. A basic modal formula ϕ is a global frame consequence of Γ if for all frames F, if F |= Γ, then F |= ϕ. It follows that global frame consequence is not recursively enumerable. Indeed, it is even Σ11 -complete, which means it is as hard to decide as the existential second-order theory of the natural numbers under the less-than-or-equal ordering. To put it another way: this is an example of a highly undecidable problem. For further discussion of Thomasons’s work in this area, see Chapter 7 of this handbook. 6 RICHER LANGUAGES So far we’ve been dealing almost exclusively with the basic modal language. We’ve seen that the key to its expressive power lies in the notion of bisimulation and that (at least when interpreted over the class of all models) it has better computational properties than first-order logic. All in all, the basic modal language is really rather elegant, so we might be tempted to ask: is it possible to lift (at least some of) its attractive properties to stronger languages? That is, can we design richer modal languages that retain, or even enhance, those features that make the basic modal language special? In fact, modal logicians have been experimenting with richer languages for years, and in this section we survey some of their work. As we shall see, this line of work adds a new dimension to our understanding of modal logic and relational semantics. But what should count as a richer modal language? It’s easier to explain what shouldn’t. Here’s an obvious example. It is straightforward to extend our basic definitions to cover polyadic modalities (that is, n-place diamonds and boxes). Simply work with models in which there is an n + 1-place relation Rm for every n-place diamond m . We interpret m using the following satisfaction clause: M, w |= m (ϕ1 , . . . , ϕn )
iff for some v1 , . . . , vn ∈ W such that Rm wvi . . . vn we have M, v1 |= ϕ1 and . . . and M, vn |= ϕn .
Now, such n-place modalities are undeniably useful for certain purposes, especially when interpreted over restricted classes of frames. For example, when working with spatio-temporal structures, we might want to add a three place modality to capture the notion of “between”, or we might want to explore the logical theory of function composition, as is done in the branch of modal logic known as arrow logic (see Marx and Venema [94]). Nonetheless, when working with the class of all models, developing the basic semantic theory (standard translation, bisimulation,
46
Patrick Blackburn and Johan van Benthem
and so on) of polyadic modal operators is essentially a matter of sprinkling our earlier work with additional indices. As we shall see, the richer languages explored in this section offer much more. Moreover, their richness takes us in many different directions. Sometimes the enrichment consists of taking a standard language and insisting that a modality be interpreted by some mathematically fundamental relation (the universal modality is a good example). Sometimes the enrichment takes the form of more complex satisfaction definitions (both temporal logic with Until and Since and conditional logic are examples of this). In other cases, syntactic enhancements are introduced to support novel semantic capabilities (hybrid logic, propositional dynamic logic, and the modal μ-calculus all do this) and in one case (the guarded fragment) we enrich by abandoning modal syntax and using first-order syntax instead. Moreover, it is also possible to enrich by combining logics. For example, we might combine two propositional modal logics to enable some application domain to be more accurately modeled, or we might combine modal logic with first-order logic, a move which takes us to the historical heartland of philosophical applications of modal logic. As we shall see, modal logicians have been extremely creative when it comes to devising richer languages. Of course, this variety raises a question of its own: what, if anything, do all these richer languages have in common? That is, what makes them all modal? This is not an easy question to answer. Nonetheless, as we work our way through this landscape a number of themes will recur: robust decidability, the importance of bisimulations, and characterisations of fragments of first- and second-order logic. As we shall see at the end of the section, the idea of restricted quantification that underlies the guarded fragment goes a long way towards accounting for these properties, for both first- and second-order enrichments. Moreover, it is possible to draw on ideas from abstract model theory and prove Lindstr¨om-style characterisation results. In short, we will often be able to lift much of the fundamental semantic theory for basic modal logic to a whole new level, a good indication that the enrichments discussed below are, in an important sense, genuinely modal.
6.1 The universal modality Time to feed the bears again. As we said in Section 4, some problems demand a global perspective. We sometimes want to view a modal formula as a general background constraint, something that must be satisfied at all points in a model. Indeed, because of the importance of background constraints, in many practical situations we are primarily interested in the local-global satisfiability problem, which we formulated as follows: given basic modal formulas ϕ and ψ, is there a model which locally satisfies ϕ and globally satisfies ψ? Now, description logic, with its two level architecture of TBoxes (which impose general constraints) and ABoxes (which give information about particular individuals), acknowledges the importance of this problem (the information in a TBox has to be globally satisfied, while the information in an ABox only has to be locally satisfied). But the ability to impose global constraints is not incorporated into description logic concept languages (which are essentially notational variants of the basic modal languages we are familiar with) and this raises an interesting question. Is it possible to internalise the notion of global satisfiability in a modal language? And if so, what happens? Let’s introduce the universal modality and find out. To keep things simple, suppose we are working in a language with just one modality. We shall add a second modality, and will write E for its diamond form, and A for its box form. The interpretation of E and A is fixed: in any model M = (W, R, V ), both modalities must be interpreted using the universal relation W × W . That
Modal Logic: A Semantic Perspective
47
is, the satisfaction definition for these modalities is: M, w |= Eϕ iff there is a u ∈ W such that M, u |= ϕ M, w |= Aϕ iff for all u ∈ W we have M, u |= ϕ. Thus Eϕ scans the entire model for a point that satisfies ϕ, while Aϕ asserts that ϕ holds everywhere. We have imported the meta-theoretic notion of global truth into our modal object language, or to put it another way, we have internalised the TBox. Accordingly, we call E the universal diamond, and A the universal box. If it is irrelevant whether we mean E or its dual, we simply talk of the universal modality. How can we be sure that adding the universal modality really increases the expressive power at our disposal? That is, are we certain that E and A are not already definable in the basic modal language? We are. One way to see this is via a bisimulation argument (see Example 2.4 in Blackburn, de Rijke and Venema [13] for such a proof). But an easy complexity-theoretic argument also establishes this. Let ϕ and ψ be basic modal formulas. Then the formula Aψ expresses the global satisfiability problem (for the basic modal language) in our new language, and the formula ϕ ∧ Aψ expresses the local-global satisfiability problem (for the basic modal language) again in our new language. Now, we remarked in Section 4 that both these problems are EXPTIME-complete. However the satisfiability problem for the basic modal language is PSPACE-complete. Hence (assuming that PSPACE is strictly contained in EXPTIME , the standard assumption) our ability to express these problems in the enriched language shows that the apparent increase in expressive power is genuine. This in turn raises a new question. Because it can encode these problems, the satisfiability problem for the enriched language is at least EXPTIME-hard. But are some problem-instances even harder? No. Everything is solvable in EXPTIME. THEOREM 35. The satisfiability problem for the basic modal language enriched with the universal modality is EXPTIME-complete. Proof. See Hemaspaandra [65], or her earlier PhD thesis Spaan [118].
❑
But the universal modality not only gives us extra expressivity at the level of models, it also increases our ability to define new classes of frames. Moreover, an elegant variant of the GoldblattThomason Theorem holds for the enriched language. We’ll discuss this result shortly, but let’s first consider two examples of newly definable frame classes. The class of frames of cardinality less than or equal to some natural number n (that is, frames in which |W | ≤ n) is not definable in the basic modal language. Why not? Because basic modal validity is closed under the formation of disjoint unions. Hence any basic modal formula ϕ which allegedly defined this frame class could easily be shown to fail: simply by sticking together enough frames we could validate ϕ on frames of cardinality greater than n. But this condition is definable with the help of the universal modality: n+1 i=1
Epi →
E(pi ∧ pj ).
i=j
As the reader can easily check, this formula is valid on any frame where |W | ≤ n, and can be falsified on any larger frame (in essence, the formula encodes the pigeonhole principle for n + 1 pigeons and n holes). It follows that validity in the enriched language is not preserved under the
48
Patrick Blackburn and Johan van Benthem
formation of disjoint unions. This, of course, is as it should be. We want a genuine universal modality, not something that can be fooled by the addition of new components. Here’s a second example. The condition ∀x∃y Ryx (that is, every point has a predecessor) is not definable in basic modal logic. Why not? Because modal validity is preserved under the formation of generated subframes. Any basic modal formula which putatively defined this class would have to be valid on the frame (N, R), where Rnm iff n > m, the natural numbers under the reverse ordering. But (by preservation under generated subframes) it would then have to be valid on the subframe generated by any number n. But in any such subframe, n has no predecessor, hence the condition is not basic modal definable. But it is definable with the help of the universal modality: p → E3p. It is easy to check that this formula defines the required condition, hence it follows that validity in the enriched language is not preserved under generated subframes. Again, this is the way it should be. A genuinely universal modality will not let us throw away points: its purpose is to keep an eye on the entire frame. It should be intolerant of both additions (disjoint unions) and deletions (generated submodels). And now for the promised result: when it comes to defining elementary frame classes, intolerance towards disjoint unions and generated submodels is precisely what distinguishes the enriched language from the basic modal language. The following result is the Goldblatt-Thomason Theorem for the basic modal language, with closure under disjoint unions and generated subframes stripped away: THEOREM 36. A first-order definable class of frames is definable in the basic modal language enriched with the universal modality iff it is closed under taking bounded morphic images, and reflects ultrafilter extensions. ❑
Proof. See Goranko and Passy [61].
Three comments. First, adding the universal modality also increases our ability to define non-elementary frame classes. For example, the class of frames where the converse of the accessibility relation R is well-founded (that is, where it is impossible to form infinite R-successorship chains) is not definable in basic modal logic. L¨ob’s formula, 2(2p → p) → 2p doesn’t quite pin this condition down (recall that it defines the conjunction of transitivity and converse well foundedness). But the following L¨ob-like formula in the enriched language does: A(2p → p) → p. (This example is from Goranko and Passy [61], the key reference on the universal modality.) Second, it is straightforward to extend the definition of bisimulation so that it works for the basic modal language enriched with the universal modality; all that needs to be done is to insist that the bisimulation be total, that is, that every element in each model is related to at least one point in the other; see de Rijke [30] for a brief discussion. Third, the universal modality has a big brother, the difference operator. The diamond form of this operator is written D, and Dϕ is satisfied at a point w in a model if and only if ϕ is satisfied at some different point v (that is, the difference operator is interpreted using the = relation on W ). The difference operator is strong enough to define the universal modality (Eϕ is just ϕ ∨ Dϕ) but D cannot be defined using E (we leave the proof as an exercise). The difference operator arises naturally in many settings and, like the universal modality, has a smooth meta-theory; see de Rijke [29] for more information.
Modal Logic: A Semantic Perspective
49
6.2 Hybrid logic Basic modal languages have an obvious expressive weakness: they cannot name points. We cannot say this happened then, or that some particular individual has some property, or that two distinct sequences of processes take us from the current state to the same state. For example, in Figure 4 we let the nodes represent particular individuals such as Terry and Judy — but the basic modal language doesn’t let us pick out these individuals. First-order logic, of course, lets us do this. We use constants to name individuals of interest, and the equality symbol for reasoning about their identity. No analogous mechanisms exist in basic modal logic. The basic hybrid language is the result of adding them. At the heart of hybrid logic lies a simple idea, first introduced by Arthur Prior [104, 105] in the 1960s: sort the proposition symbols, and use formulas as terms. Let’s do this right away. Take a language of basic modal logic (with proposition symbols p, q, r, and so on) and add a second sort of proposition symbol. The new symbols are called nominals, and are typically written i, j, k, and l. Both types of proposition symbol can be freely combined to form more complex formulas in the usual way. And now for the key change: insist that each nominal be true at exactly one point in any model. That is, insist (for any valuation V and nominal i) that V (i) be a singleton set. We call the unique point in V (i) the denotation of i. A nominal ‘names’ its denotation by being true there and nowhere else. This change is far from negligible: already we have a more expressive logic. Consider the following basic modal formula: 3(r ∧ p) ∧ 3(r ∧ q) → 3(p ∧ q). This formula can be falsified, as the p-witnessing and q-witnessing points given by the antecedent may be distinct. But now consider the following hybrid formula: 3(i ∧ p) ∧ 3(i ∧ q) → 3(p ∧ q). This is identical to the preceding formula, except that we have replaced the proposition symbol r by the nominal i. But the resulting formula is valid. For now we have extra information: the p-witnessing and q-witnessing successors both make i true, so they are true at the same point, namely the denotation of i. The addition of nominals is the crucial step towards the basic hybrid language, but we need a second ingredient too: satisfaction operators. These are operators of the form @i , where i is a nominal. The formula @i ϕ asserts that ϕ is satisfied at the (unique) point named by the nominal i. That is: M, w |= @i ϕ iff M, u |= ϕ, where u is the denotation of i. Syntactically, satisfaction operators are modalities. And they are semantically well behaved. For a start, all instances of the modal distribution schema are valid: @i (ϕ → ψ) → (@i ϕ → @i ψ). Moreover, satisfaction operators also admit the modal generalisation law: if ϕ is valid, then so is @i ϕ (for any choice of i). Hence satisfaction operators are normal modal operators. Moreover, they are self-dual modalities, for all instances of @i ϕ ↔ ¬@i ¬ϕ are valid. So we are free to regard satisfaction operators as either boxes or diamonds. But for present purposes, the most important point about satisfaction operators is that they give us a modal perspective on the equality relation. To see this, note that formulas like @i j are
50
Patrick Blackburn and Johan van Benthem
well formed. What does this formula assert? It says that “at the denotation of i, the nominal j is satisfied”, or to put it another way, “the point named i is identical to the point named j”. Hence the following schemas are valid: @i i (reflexivity of equality), @i j → @j i (symmetry of equality), @i j ∧ @j k → @i k (transitivity of equality), and @i ϕ ∧ @i j → @j ϕ (replacement). As we hoped, a modal theory of equality is emerging. We will shortly characterise this theory, but before doing so let’s glance at what is happening at the level of frames. Here too there is an increase in expressivity. None of the four first-order definable frame conditions listed below can be defined in basic modal logic. But it is easy to check that each is defined by the hybrid formula written next to them: ∀x¬Rxx ∀xy(Rxy → ¬Ryx) ∀xy(Rxy ∧ Ryx → x = y) ∀xy(Rxy ∨ x = y ∨ Ryx)
i → ¬3i i → ¬33i i → 2(3i → i) @j 3i ∨ @j i ∨ @i 3j
(irreflexivity) (asymmetry) (antisymmetry) (trichotomy).
And now for the main result. Hybridisation has given us some sort of modal theory of equality. But how much of the corresponding first-order theory have we captured? Of course, now when we talk about “corresponding first-order theory” we mean: theory in the first-order correspondence language enriched with constants and the equality symbol. The first step towards an answer is to extend the standard translation to cover nominals and satisfaction operators. So enrich the first-order correspondence language with constants and the equality symbol; to keep the notation uncluttered, we’ll re-use the nominals as first-order constants. Then add the following clauses to the standard translation: STx (i) STx (@i ϕ)
= =
(x = i) STi (ϕ).
That is, nominals i are translated into first-order constants i, and satisfaction operators are translated by substituting the relevant first-order constant for the free-variable x. Note that this translation returns first-order formulas with at most one free variable x, not exactly one. This is because a constant may be substituted for the free occurrence of x. For example, the hybrid formula @i i translates into the first-order sentence i = i. The second step is to extend the notion of bisimulation given in Definition 5 to make it suitable for the basic hybrid language and for the constant-enriched first-order correspondence language: DEFINITION 37 (Bisimulation-with-names). A bisimulation-with-names between models M = (W, R, V ) and M = (W , R , V ) is a non-empty binary relation E between their domains (that is, E ⊆ W × W ) such that whenever wEw we have that: Atomic harmony: w and w satisfy the same proposition symbols, and the same nominals. Zig: if Rwv, then there exists a point v (in M ) such that vEv and R w v , and Zag: if R w v , then there exists a point v (in M) such that vEv and Rwv. Closure: All points named by nominals are related by E. It is easy to check that all basic hybrid formulas are invariant under bisimulations-with-names; the proof is an easy extension of Lemma 9. More interestingly, such bisimulations also give rise to a Characterisation Theorem: THEOREM 38 (Hybrid Characterisation Theorem). The following are equivalent for all firstorder formulas ϕ(x) in at most one free variable x:
Modal Logic: A Semantic Perspective
51
1. ϕ(x) is invariant for bisimulation-with-names. 2. ϕ(x) is equivalent to the standard translation of a basic hybrid formula. Proof. That clause 2 implies 1 is a more or less immediate. The hard direction is showing that clause 1 implies 2. The original proof can be found in Areces, Blackburn and Marx [6]. ❑ In short, basic hybrid logic is a simple notation for capturing exactly the bisimulation-invariant fragment of first-order logic with constants and equality, or to put it another way, basic hybridisation is a mechanism for equality reasoning in propositional modal logic. And it comes cheap. Up to a polynomial, the complexity of the resulting decision problem is no worse than for the basic modal language we started with: THEOREM 39. The satisfiability problem for the basic hybrid language over arbitrary models is PSPACE-complete. Proof. See Areces, Blackburn and Marx [6].
❑
A number of stronger hybrid languages have also been explored. One of the most interesting extensions is to add ↓ (the downarrow binder). This binds occurrences of nominals within its scope to the point of evaluation. That is, to evaluate M, w |=↓i.ϕ, we evaluate M, w |= ϕ but with all occurrences of the nominal i that were bound by ↓ now interpreted as naming w (for details on how to make this informal explanation precise, see Chapter 14 of this Handbook). To put it another way, ↓ lets us create a name for here, and this immediately increases the expressive power at our disposal. For example, in any model M, the formula ↓i.¬3i is true at precisely the irreflexive points; as we noted earlier, no such formula exists in the basic modal language, and indeed, no such formula exists in the basic hybrid language either. Moreover, ↓ interacts beautifully with @. Intuitively, ↓ stores new values for nominals, and @ allows us to retrieve them. As an example of this interaction, consider the following formula which is true in any model at points with at least two successors: ↓i.3↓j.@i3¬j. This formula first names the point of evaluation i, it then declares that i has a successor which it names j, and then (with the help of @) it jumps back to i to assert that i also has a successor distinct from j. But this increased expressivity comes at a price: by introducing ↓ we have sailed over the border into undecidability. As we remarked earlier, the ability to create grid-like models is a useful warning sign of undecidability, and the smooth interaction between ↓ and @ makes it easy to create the unit squares required to build grids: ↓i.3(¬i ∧ ↓j.3(¬i ∧ ¬j ∧ ↓k.@i3(¬i ∧ ¬j ∧ ¬k ∧ ↓l.3k))). If you work through this formula you will see that it demands the existence of four distinct points, which it calls i, j, k, and l, such that Rij, Rjk, Ril and Rlk. Note the characteristic use of the embedded @i to jump us back to the original point of evaluation i; this enables us to construct a second path from i to k that goes via point l. Of course, moving from this observation to a proof that it is possible to code the tiling problem takes more work, but it can be done, and the upshot is: adding ↓ has moved us up to an undecidable fragment of first-order logic.
52
Patrick Blackburn and Johan van Benthem
But which fragment? The answer has two natural formulations. The first has the now-familiar form of a Characterisation Theorem: it turns out that adding downarrow has moved us up to precisely that fragment of first-order logic which is invariant under generated submodels. The second answer has a more syntactic flavour: we have moved up to the bounded fragment of firstorder logic. The bounded fragment consist of all first-order formulas built up from atomic formulas using the booleans and bounded quantifications of the form ∃y(Rτ y ∧ ϕ) and ∀y(Rτ y → ϕ), where τ is a term that does not contain y. The bounded fragment arises naturally in set theory (see Levy [89]) and arithmetic (see Buss [20]). In the mid-1960s, Feferman and Kreisel [41, 40] characterised the bounded fragment as the fragment of first-order logic invariant under generated submodels. It is intriguing that hybrid logic should have arrived at the same fragment by such a different route. For full formulations and proofs of these results, see Areces, Blackburn and Marx [6]. For a detailed overview of hybrid logic, covering the results mentioned and much else besides, see Chapter 14 of this handbook.
6.3 Temporal logic with Until and Since operators We turn now to another historically early enrichment: the addition of the binary U (Until) and S (Since) operators. These were introduced in the late 1960s by Hans Kamp [76], who added them to Arthur Prior’s basic (F and P based) tense logic, and proved an elegant result: U and S are expressively complete with respect to Dedekind complete strict total orders (we discuss Kamp’s result below). But, beautiful though this is, it is not what led to the present popularity of these operators. Rather, around 1980, Gabbay, Pnueli, Shelah and Stavi [53] observed that Until offers precisely what is required to state what computer scientists call guarantee properties, and this led to its widespread adoption for reasoning about programs. Given the number of researchers currently active in temporal logic for program verification, Until may well be the best known and most widely used modal operator of all: it plays a key role in LTL (Linear Time Temporal Logic), CTL (Computational Tree Logic), and CTL∗ (a highly expressive system that contains both LTL and CTL as sublogics). For an introduction to these logics, see Chapter 11 of this handbook, or Clarke, Grumberg and Peled [25]. Now, we briefly met the Until operator in Section 4 when we discussed model checking. There we defined it in terms of R+ and R∗ , the transitive and reflexive transitive closures of the underlying relation R used by the 3 over tree-like models. Here we shall define Until and Since in their most general form: M, w |= U (ϕ, ψ)
iff
M, w |= S(ϕ, ψ)
iff
there is a v such that Rwv and M, v |= ϕ, and for all u such that Rwu and Ruv we have M, u |= ψ. there is a v such that Rvw and M, v |= ϕ, and for all u such that Rvu and Ruw we have M, u |= ψ.
Putting this in words, Until asserts that there is some point in the future where ϕ holds, and that at all points between the point of evaluation and this future ϕ-witnessing point, ψ holds. Since functions in the same way, but towards the past. Note the ∃∀ pattern of quantification in the satisfaction definitions. These operators are neither diamonds nor boxes; they are something new and (as we shall see) more powerful. What can we say with them? For a start, they have all the power of ordinary diamonds: U (ϕ, ) has the same meaning as 3ϕ. But now we can say more: these operators are tailormade for stating guarantee properties, requirements of the form “Some event will happen, and
Modal Logic: A Semantic Perspective
53
until that event takes place, a certain condition will hold”. For if we represent the event by ϕ and the condition by ψ, then U (ϕ, ψ) clearly captures what is required. But how can we be sure that we can’t state guarantee requirements in the basic modal language? A simple bisimulation argument demonstrates this. Consider the two models shown in Figure 19. The two models are clearly bisimilar (simply link both points in the right-hand model
Figure 19. Until is not definable in basic modal logic. to the single point in the left-hand model; all proposition symbols are false at all points in both models, though this is irrelevant to the following argument). This means that the two models agree on the truth of all basic modal formulas at all points. But the models disagree on the value of U (, ⊥). This formula is false in the model on the left, but true at both points in the model of the right. We conclude that no basic modal formula can capture the effect of Until. But this is a little too easy. Until is typically used for temporal reasoning tasks, and the two models just shown have little to recommend them as flows of time. But it turns out that Until cannot be defined even if we work with models with more structure. For a start, even if we restrict our attention to transitive models, Until is not basic modal definable. For consider the two models shown in Figure 20; we are interested in the transitive closure of the relation indicated by the arrows. These models are bisimilar (link w0 and w1 with w , link t0 and t1 with t , and so on). So suppose that there is some formula in the basic modal language that captures the effect of U (p, q). Any such formula would be true in the left-hand model at points w0 and w1 . For consider what happens at w0 (the argument for w1 is analogous). There is a point to its future (namely v1 ) that makes p true and at all points lying in between (and there is only one, namely u) we have that q is satisfied. However any such formula would be false in the right-hand model at w , for here there are two points between w and v (namely u and t ) and t does not satisfy q. As w is bisimilar to w0 and w1 , we conclude that no basic modal formula can capture the effect of Until. And this result can be strengthened. Even if we restrict ourselves to linear models, the basic modal language can’t define Until, and it can’t do so on the real numbers either (see Proposition 7.10 in Blackburn, de Rijke and Venema [13]).
Figure 20. Even on transitive frames, Until is not definable in basic modal logic. So adding S and U to the basic modal language yields new expressivity — but how much? We shall now discuss Kamp’s Theorem, which shows that on certain classes of structures (a class
54
Patrick Blackburn and Johan van Benthem
that includes the real numbers) these operators capture the entire one free variable fragment of the first-order correspondence language. This result was one of the earliest (and is still one of the most striking) purely semantic results in modal logic. First, note that Until and Since correspond to fragments of the familiar first-order correspondence language that we have been working with throughout the chapter. After all, we can translate them as follows: STx (U (ϕ, ψ)) STx (S(ϕ, ψ))
= ∃z (Rxz ∧ STz (ϕ) ∧ ∀y (Rxy ∧ Ryz → STy (ψ))) = ∃z (Rzx ∧ STz (ϕ) ∧ ∀y (Rzy ∧ Ryx → STy (ψ))).
Incidentally, observe that we need three variables to specify this translation, whereas we only needed two for the basic modal language. Now, the three variable fragment of first-order logic is known to be undecidable, thus the translation doesn’t give us an easy decidability result for the enriched modal language, though its satisfiability problem over arbitrary models is in fact decidable. We’ll understand why a little later when we discuss the packed fragment. So what does Kamp’s Theorem say? First some preliminary definitions. Let M be a class of models. We say that a modal language is expressively complete over M, if every formula (in one free variable) from the first-order correspondence language is equivalent to a formula in the modal language (when we restrict attention to models from M). Which class of models is Kamp’s Theorem about? A strict total order is any frame (with one binary relation R) that is transitive, irreflexive, and linear (that is, ∀xy(Rxy ∨ x = y ∨ Ryx)). A strict total order is Dedekind complete if every subset with an upper bound has a least upper bound. Standard examples of Dedekind complete strict total orders are the real numbers (R, <) and the natural numbers (N, <) under their usual orderings. And now we have: THEOREM 40 (Kamp’s Theorem). The basic modal language enriched with U and S is expressively complete with respect to models based on Dedekind complete strict total orders. Proof. The original proof is in Kamp’s thesis [76]. Elegant modern proofs, and proofs of stronger expressive completeness results, can be found in Gabbay, Hodkinson and Reynolds [52]. See also Chapter 11 of this handbook. ❑ Much more could be said about the Until and Since operators, but we will confine ourselves to the following remark. Because of their ∃∀ pattern of quantification, for some time it was unclear how best to define a suitable notion of bisimulation. However Kurtonina and de Rijke [87] and Sturm [120] have given definitions which enable characterisation theorems to be proved.
6.4 Conditional logic Although formulas of the form ϕ → ψ are often glossed as “if ϕ then ψ”, the truth conditions that classical logic gives to the → symbol (and in particular, the fact that ϕ → ψ is true when ϕ is false) means that → does not mirror the more interesting meanings that conditionals can have in natural language. This has inspired numerous attempts to introduce conditional connectives (say, >) that better mimic the logic(s) of natural language conditionals. Indeed, such aspirations have given birth to an entire branch of logic, namely Relevance Logic, which nowadays is a well-established branch of the study of substructural logics (see Restall [108]). But there is a modal approach to conditionals too. Its motivation comes from the following intuition: a conditional ϕ > ψ can (often) be read as an invitation to assume the antecedent (perhaps making some adjustments to accommodate its truth) and check if the consequent is
Modal Logic: A Semantic Perspective
55
true. A characteristic inferential feature of this reading is the failure of monotonicity in the antecedent. “If I catch the 6.22 train at Amsterdam Central (ϕ), I will be home on time (ψ)” is true on the most natural reading of the conditional, but adding an unusual further condition may make it false, as the sentence “If I catch the 6.22 train at Amsterdam Central (ϕ), and the dikes break (θ), I will be home on time (ψ)” demonstrates. Models for modal-style conditional reasoning are triples M = (W, C, V ). Here W is a nonempty set (whose elements are usually called worlds), V is a valuation, and C is a ternary relation of relative similarity , or (as it is sometimes put in the literature) a relation of relative ‘comparison’ or ‘preference’ between worlds. It is useful to write Cwuv as Cw uv and to read this as saying that “w has more in common with u than v”. It is standard to demand that each Cw satisfies ∀uvz(Cw uv ∧ Cw vz → Cw uz), w-centred transitivity, and ∀uCw uu, w-centred reflexivity. Moreover, some authors, most famously David Lewis, also demand w-centred comparability, that is, ∀uv(Cw uv ∨ Cw vu). A good way to visualise the relation Cw uv is to think of u and v as two concentric circles around w. If u and v are distinct, then u is a concentric circle closer to w than v is. The simplest truth condition for conditionals is the following, which come from David Lewis’s groundbreaking book “Counterfactuals” [90]. It fits in well with our intuitions (at least on finite models): M, w |= ϕ > ψ
iff all minimal worlds in the w-centred ordering Cw uv at which ϕ is true are also worlds where ψ holds.
This satisfaction clause can be phrased more succinctly as follows: all minimal ϕ-worlds are ψ-worlds. Note that the ϕ-minimal worlds around w are the only ones we consider. As the minimal worlds satisfying the stronger condition ϕ ∧ θ need not be the ones satisfying ϕ, in this way we get a semantic distinction which accounts for the failure of monotonicity in the antecedent. But what about infinite models? Then there need not be any minimal worlds satisfying the antecedent (we might have a chain of ϕ-satisfying concentric circles coming ever closer to w). Here’s a way of handling this: switch to the following more complex truth condition (to keep things readable, we shall write use ϕ(v) as shorthand for M, v |= ϕ, and similarly for ψ): M, w |= ϕ > ψ
iff ∀u(ϕ(u) ⇒ ∃v(Cw vu & ϕ(v) & ∀z((Cw zv & ϕ(z)) ⇒ ψ(z)).
This says that the conditional ϕ > ψ holds if, whenever ϕ holds at some circle u, then there is some smaller circle v where ϕ holds such that all circles z within v satisfy ψ. This is rather awkward to process in first-order logic, but it can be clearly expressed in modal logic if we make use of a unary modality c (which looks inwards for a circle closer to the centre) together with the universal modality A. For then we can simply say: ϕ > ψ =def A(ϕ → c (ϕ ∧ [c](ϕ → ψ)). This more complex truth-condition validates a minimal logic which includes such principles as upward monotonicity in the consequent: ϕ > ψ implies ϕ > (ψ ∨ θ). Further properties of the similarity ordering enforce special axioms via standard frame correspondences. Assuming just reflexivity and transitivity yields the minimal conditional logic originally axiomatised by Burgess [19] and Veltman [143], while assuming also comparability of the ordering gives rise to the logics obtained by Davis Lewis.
56
Patrick Blackburn and Johan van Benthem
What about complexity? A number of interesting results are known: THEOREM 41. The satisfiability problem for the minimal conditional logic (that is, where Cw uv is transitive and reflexive) is PSPACE-complete when formulas with arbitrary nestings of conditionals are allowed, and NP-complete for formulas with bounded nesting of conditionals. Proof. See Friedman and Halpern [50]. These authors also prove that if uniformity is assumed (that is, if all worlds agree on what worlds are possible) the complexity rises to EXPTIMEcomplete, even for formulas with bounded nesting. Moreover, they show that if absoluteness is assumed (that is, all worlds agree on all conditional statements) the decision problem is NPcomplete for formulas with arbitrary nesting. ❑ In general, conditional logic has not been studied semantically in the same style as most modal languages, though there is no reason why it cannot be. For example, bisimulations could be defined for > in much the same spirit as they are defined for temporal logics with Until and Since. Likewise, issues of frame definability beyond the minimal setting can be explored; for example, van Benthem [137] notes correspondences between conditional axioms and triangle inequalities concerning concrete geometrical relations of relative nearness in space. Many recent technical developments in conditional logic, however, have to do with its connection with belief revision theory (see G¨ardenfors and Rott [55]). In that setting, a conditional ϕ > ψ means “if I revise my current beliefs with the information that ϕ, then ψ will be among my new beliefs”; see, for example, Ryan and Schobbens [110]. For more on these topics, see Chapters 20 and 21 of this handbook.
6.5 The guarded fragment The richer modal languages so far examined have clearly been modal in a syntactic sense; all use the typical “apply operator to formula” syntax. The guarded fragment, however, arises as an attempt to directly isolate fragments of first-order logic that can plausibly be called modal. So the modal languages we shall consider here are syntactically first-order. The clue leading to the guarded fragment is the standard translation of the modalities. This treats modalities as macros embodying restricted forms of first-order quantification, in particular, quantification restricted to successor states: STx (3ϕ) STx (2ϕ)
= ∃y(Rxy ∧ STy (ϕ)) = ∀y(Rxy → STy (ϕ)).
As we saw earlier, it is this restricted form of quantification that lets bisimulation emerge as the key model-theoretic notion. And bisimulation, via the tree model property, leads to decidability. Thus at least one pleasant property of modal logic can plausibly be traced back to its use of a restricted form of quantification. So it is natural to ask whether other first-order fragments defined by restricted quantification have such properties. This line of enquiry leads to the guarded fragment and its relatives. The first step takes us to the guarded fragment, which was introduced by Andr´eka, van Benthem, and N´emeti [5]. Guarded formulas ϕ are built up as follows: ϕ
::= Qx | ¬ϕ | ϕ ∧ ψ | ϕ → ψ | ∃y(G(x, y) ∧ ϕ(x, y)) | ∀y(G(x, y) → ϕ(x, y)).
Modal Logic: A Semantic Perspective
57
Here x and y are finite tuples of variables, Q is a predicate symbol (of appropriate arity for the tuple x), and G, the symbol used in the guard, is a predicate symbol too (thus the guard is an atomic formula). The key point to observe is that in the clauses for the quantifiers, all the free variables of ϕ appear in the guard. The set of all guarded first-order formulas is called the guarded fragment. THEOREM 42. The guarded fragment is decidable. Its satisfiability problem is 2EXPTIMEcomplete, and EXPTIME-complete if we have a fixed upper bound on the arity of predicates. Moreover, the guarded fragment has the finite model property. Proof. See Gr¨adel [62] for the complexity results and a direct proof of the finite model property. An earlier (algebraic) proof of the finite model property can be found in Andr´eka, Hodkinson, and N´emeti [4]. ❑ The guarded fragment is a natural generalisation of the first-order formulas obtainable under the standard translation, but does it go far enough? For example, adding Until to a basic modal language yields a decidable logic, but the standard translation of U (p, q), namely ∃y (Rxy ∧ P y ∧ ∀z ((Rxz ∧ Rzy) → Qz)), does not belong to the guarded fragment, and it can be shown that it is not equivalent to a formula in the guarded fragment either. This suggests that it may be possible to pin down richer restrictedquantification first-order fragments that retain decidability, and several closely related extensions of the guarded fragment, such as the loosely guarded fragment (see van Benthem [135]) and the packed fragment (see Marx [93]) have been proposed which do precisely this. Let’s take a quick look at the packed fragment. The packed fragment allows us to use composite guards γ instead of just atomic guards G. Let γ be a formula whose free variables are {x1 , . . . , xk }. Then γ packs {x1 , . . . , xk } if γ is a conjunction of formulas of the form xi = xj , R(xi1 , . . . , xin ) or ∃xR(xi1 , · · · , xin ), and moreover, for any two distinct free variables xi and xj , there is a conjunct in γ in which they both occur free. The packed fragment is the smallest fragment of modal logic that contains all atomic formulas, and is closed under boolean combinations and packed quantification. That is, if ψ is a packed formula, and γ packs ψ, and all the free variables of ψ are free in γ, then ∃x(γ ∧ φ) and ∀x(γ → φ) are packed too. As an example, consider again the standard translation of U (p, q), namely ∃y (Rxy ∧ P y ∧ ∀z ((Rxz ∧ Rzy) → Qz)). This is not packed as the guard of the subformula ∀z ((Rxz ∧ Rzy) → Qz)) has no conjunct in which x and y occur together. But this is easy to fix. The following (logically equivalent) formula is packed: ∃x (Rxy ∧ P y ∧ ∀z ((Rxz ∧ Rzy ∧ Rxy) → Qz)). And indeed, the packed fragment turns out to be computationally well behaved: THEOREM 43. The packed fragment is decidable. Its satisfiability problem is 2EXPTIMEcomplete. Moreover, it has the finite model property. Proof. The complexity result follows from results in Gr¨adel [62]. The original proof of the finite model property for the packed fragment (and the loosely guarded fragment) can be found in Hodkinson [68]; a more elegant proof can be found in Hodkinson and Otto [69]. ❑
58
Patrick Blackburn and Johan van Benthem
In short, we have isolated two decidable fragments of first-order logic which are expressive enough to generalise many common modal languages. Moreover, these fragments have attractive properties besides decidability. Basic modal logic resembles first-order logic in most of its metaproperties, even those (such as Craig Interpolation, Beth definability, and the standard modeltheoretic preservation theorems) that do not follow straightforwardly from the fact that it is a firstorder fragment. The guarded fragment shares this good behaviour to some extent, witness the Łos-style preservation theorem for submodels given in Andr´eka, van Benthem, and N´emeti [5]. But subsequent work has shown that the picture is somewhat mixed. There is indeed a natural notion of guarded bisimulation (see Andr´eka, van Benthem, and N´emeti [5]) which characterises the guarded fragment as a fragment of first-order logic. Moreover, Beth definability holds (see Hoogland, Marx and Otto [71]). However Craig interpolation fails in its strong form, though it holds when we view guard predicates as part of the logical vocabulary (see Hoogland and Marx [70]). This is a good moment to take stock of some of the first-order fragments we have encountered in the course of this chapter, and their interrelationships. Figure 21 summarises the relationships
Figure 21. Some modally significant fragments of first-order logic. between first-order logic, the more restricted (but undecidable) bounded fragment, and the still more restricted (but decidable) guarded fragment. Also shown are the fragments of first-order logic corresponding to the basic modal language, and the fragment corresponding to the basic language enriched with Until. Here L2 and L3 indicate the two and three variable fragments respectively; the basic language fits into the former, but the Until enriched language spills over into the latter.
6.6 Propositional Dynamic Logic The richer modal languages so far discussed extend the first-order expressive power available for talking about models: the universal modality adds quantification over W ×W , hybridisation gives access to constants and equality, Until and Since and conditional logic add richer quantificational patterns, and the guarded-fragment cheerfully replaces modal syntax with first-order syntax. But the next two languages we shall discuss take us in a different direction: both add second-order expressive power. Now, in Section 5 we saw that modal languages have second-order expressive
Modal Logic: A Semantic Perspective
59
power (via the concept of validity) at the level of frames. But in the languages we now consider, second-order expressivity arises directly: it is hardwired into the satisfaction definitions, and hence is available at the level of models. In particular, Propositional Dynamic Logic (henceforth PDL) offers us an (infinite collection of) transitive closure operators, and the modal μ-calculus offers us a general mechanism for forming fixed-points. Significantly, both PDL and the modal μcalculus were born in theoretical computer science. Finite structures are crucial to the theory and practice of computation, and basic results of finite model theory (see Ebbinghaus and Flum [35]) show that first-order logic is badly behaved when interpreted over finite structures. Nowadays it is standard practice to extend first-order languages with second-order constructs (such as the ability to take transitive closures or form fixed-points) when working with finite models, and in the languages we now consider, such ideas are put to work in modal logic. Let’s start by looking at the weaker of the two languages, namely PDL. The underlying idea (to extend modal logic with a modality for every program) is due to Vaughan Pratt [102], and the language now called PDL was first investigated by Fisher and Ladner [47, 48]. PDL contains an infinite collection of diamonds. Each has the form π , where π denotes a non-deterministic program. The intended interpretation of π ϕ is that “some terminating execution of π from the current state leads to a state with the information ϕ”. The dual assertion [π]ϕ states that “every terminating execution of π from the current state leads to a state with the information ϕ”. Crucially, the inductive structure of programs is made explicit in PDL’s syntax, as complex programs are built out of basic programs using four program constructors. Suppose we have fixed a set of basic programs a, b, c, and so on. We are allowed to define complex programs π over this base as follows: Choice: if π1 and π2 are programs, then so is π1 ∪ π2 . It non-deterministically executes either π1 or π2 . Composition: if π1 and π2 are programs, then so is π1 ; π2 . It first executes π1 and then executes π2 . Iteration: If π is a program, then so is π ∗ . It executes π a finite (possibly zero) number of times. Test: if ϕ is a formula, then ϕ? is a program. It tests whether ϕ holds, and if so, continues; if not, it fails. Hence PDL makes available the following (inductively defined) algebra of diamonds. First we have diamonds a , b , c , and so on, for working with the basic programs. Then, if π1 and π2 are diamonds and ϕ is a formula, π1 ∪ π2 , π1 ; π2 , π1∗ and ϕ? are diamonds too. Note the unusual syntax of the test constructor diamond: it makes a modality out of a formula. This means that the sets of PDL formulas and modalities are defined by mutual induction. How do we interpret PDL? Syntactically we’re simply dealing with a basic modal language in which the modalities are indexed by a structured set. So a model for PDL will have the form we are used to, namely (W, {Rπ | π is a program }, V ), a suitably indexed collection of relations together with a valuation. Moreover, the usual satisfaction definition is all that is required: diamonds existentially quantify over the relevant transitions, and boxes universally quantify over them. Nonetheless, something more needs to be said. Given the intended interpretation of PDL, most of these models are uninteresting. We want models built over frames which do justice to the intended meaning of our program constructors. Which models are these?
60
Patrick Blackburn and Johan van Benthem
Nothing much needs to be said about the interpretation of the basic programs: any binary relation can be regarded as a transition relation for a non-deterministic program (though if we were interested in deterministic programs, we would insist on working with frames in which each basic program was interpreted by a partial function). Nor need much be said about the test operator. Unusual though its syntax is, its intended interpretation in any model M is simply Rϕ? = {(w, v) | w = v and M, w |= ϕ}. But the three remaining constructors demand that we impose inductive structure on our frames. Here’s what is required: Rπ1 ∪π2 Rπ1 ;π2 ∗ R π1
= = =
R π1 ∪ R π2 , Rπ1 ◦ Rπ2 (= {(x, y) | ∃z (Rπ1 xz ∧ Rπ2 zy)}), (Rπ1 )∗ , the reflexive transitive closure of Rπ1 .
These restrictions are the natural set-theoretic ways of capturing the “either-or” nature of nondeterministic choices (for Rπ1 ∪π2 ), the idea of executing two programs in a sequence (for Rπ1 ;π2 ) ∗ and the idea of iterating the execution of a program finitely many times (for Rπ1 ). Accordingly, we make the following definition. Let Π be the smallest set of programs containing the basic programs and the programs constructed over them using the constructors ∪, ;, and ∗ . Then a regular frame over Π is a frame (W, {Rπ | π ∈ Π}) where Ra is a binary relation for each basic program a, and for all complex programs π, Rπ is the binary relation constructed inductively using the above clauses. A regular model over Π is a model built over a regular frame (that is, regular models are regular frames together with a valuation). When working with PDL over the programs in Π, we will be interested in regular models for Π, for these are the models that ∗ capture the intended interpretation. All very simple and natural — but by insisting that Rπ1 be interpreted by the reflexive transitive closure of Rπ1 , we have given PDL genuinely secondorder expressive power. A straightforward application of the Compactness Theorem shows that first-order logic cannot define the transitive closures of arbitrary binary relations, so with this definition we’ve moved beyond the confines of first-order logic. Unsurprisingly, compactness fails in PDL. To see this, consider the following infinite set of formulas: { π ∗ p, ¬p, [π]¬p, [π][π]¬p, [π][π][π]¬p, . . .}. It is clear that every finite subset of this set has a regular model: we simply make p true at a state reachable by taking n + 1 (non-reflexive) π-steps out from the current state, where n is the maximal level of nesting of boxes. But the entire set cannot be satisfied at any state in any regular model. So we have genuine second-order expressivity at our disposal. What can we do with it? Well, for a start, at the level of models, we can express some familiar algorithmic constructs: (p? ; a) ∪ (¬p? ; b) a; (¬p?; a)∗ ; p? (p?; a)∗ ; ¬p?
if p then a else b. repeat a until p. while p do a.
Note the crucial role played by ∗ in capturing the effect of the two loop constructors. Moreover, the second-order expressivity built in at the level of models spills over into the level of frames. Here’s a nice illustration. Via the concept of validity, PDL itself is strong enough to
Modal Logic: A Semantic Perspective
61
define the class of regular frames (something which cannot be done in a first-order language). Now, it is not hard to give conditions that capture choice and composition. The formula
π1 ∪ π2 p ↔ π1 p ∨ π2 p is valid on precisely those frames satisfying Rπ1 ∪π2 = Rπ1 ∪ Rπ2 , and
π1 ; π2 p ↔ π1 π2 p is valid on precisely those frames satisfying Rπ1 ;π2 = Rπ1 ◦ Rπ2 . ∗ But these are first-order conditions. What about iteration? We demanded that the relation Rπ used for the program π ∗ be the reflexive transitive closure of the relation Rπ used for π. This constraint cannot be expressed in first-order logic; how can we impose it via PDL validity? As follows. First we demand that
π ∗ ϕ ↔ ϕ ∨ π ; π ∗ ϕ be valid. This says that a state satisfying ϕ can be reached by executing π a finite number of times if and only if ϕ is satisfied in the current state, or we can execute π once and then find a state satisfying ϕ after finitely many more iterations of π. Second, we demand that [π ∗ ](ϕ → [π]ϕ) → (ϕ → [π ∗ ]ϕ) be valid too. This is called Segerberg’s axiom. Work through what it says: as you will see, in essence it is an induction schema. A frame validates all instances of the four schemas just introduced if and only if it is a regular frame. Summing up, at both the level of models and frames, PDL has a great deal of expressive power. Hence the following result is all the more surprising: THEOREM 44. PDL has the finite model property and is decidable. Its satisfiability problem is EXPTIME-complete. Proof. The finite model property, decidability, and EXPTIME-hardness results for PDL were proved in Fisher and Ladner [47, 48]. The existence of an EXPTIME algorithm for PDL satisfiability was proved in Pratt [103]. ❑ But we are only half-way through our story. With the modal μ-calculus we will climb even higher in second-order expressivity hierarchy, and we will do so without leaving EXPTIME.
6.7 The modal µ-calculus The modal μ-calculus is the basic modal language extended with a mechanism for forming least (and greatest) fixed-points. It is highly expressive (as we shall see, it is stronger than PDL) and computationally well behaved. Moreover it has a beautiful bisimulation-based characterisation. All in all, it is one of the most significant languages on the modal landscape. It was introduced in its present form by Dexter Kozen [80]. The idea underlying the modal μ-calculus is to view modal formulas as set-theoretic operators, and to add mechanisms for specifying their fixed-points. Now, a set-theoretic operator on a set W is simply a function F : 2W → 2W . But how can we view modal formulas as settheoretic operators? Consider a formula ϕ containing some proposition symbol (say p). In any
62
Patrick Blackburn and Johan van Benthem
model, ϕ will be satisfied at some set of points. If we systematically vary the set of points that the valuation assigns to p, the set of points where ϕ is satisfied will typically vary too. So we can view ϕ as inducing an operator over the points of some model, namely the operator that takes as argument the subset of W that is assigned to p, and returns the set of points where ϕ is satisfied with respect to this assignment. Let’s make this precise. We will work in a language with a collection of diamonds π , so models have the form M = (W, {Rπ }π∈MOD , V ). For any proposition symbol p, V (p) is the set of points in M where p is satisfied. Let’s extend V to a function that returns, for arbitrary formulas ϕ, the set of points in M that satisfy ϕ (we won’t invent a new name for this extended valuation, we’ll simply call it V ). The required definition is a simple reformulation of the satisfaction definition for the basic modal language: V (p) = V (¬ϕ) = V (ϕ ∧ ψ) = V ( π ϕ) =
V (p) for all proposition symbols p W \V (ϕ) V (ϕ) ∩ V (ψ) {w | for some v ∈ W , Rπ wv and v ∈ V (ϕ)}.
Furthermore, for any proposition symbol p and any U ⊆ W we shall write V[p←U ] for the (extended) valuation that differs from the (extended) valuation V , if at all, only in that it assigns U to p. That is, V[p←U ] (p) = U , and for any q = p, V[p←U ] (q) = V (q). Then the operator induced by a formula ϕ (relative to a proposition symbol p) is the function that maps any U ⊆ W to V[p←U ] (ϕ). Now to bring fixed-points into the picture. A subset X of W is a fixed-point of a set-theoretic operator F on W if F (X) = X. This is clearly a special property: which set-theoretic operators have fixed-points, and how do we calculate them? The Knaster-Tarski Theorem (see Knaster [79] and Tarski [123]) gives important answers. Firstly, this theorem tells us that fixed-points exist when we work with monotone set-theoretic operators (an operator F is monotone if X ⊆ Y implies that F (X) ⊆ F (Y )). Secondly, this theorem tells us that if F is a monotone operator on a set W , then F has a least fixed-point μF , which is equal to {U ⊆ W | F (U ) ⊆ U }, and also a greatest fixed-point νF , which is equal to {U ⊆ W | U ⊆ F (U )}. That is, both μF and νF are solutions to the equation F (X) = X, and furthermore, for any other solution Z, we have that μF ⊆ Z ⊆ νF . The least and greatest fixed-points given by the Knaster-Tarski Theorem are the fixed-points the modal μ-calculus works with. But how can we specify these fixed-points using modal formulas? By enriching the syntax with an operator μ that binds occurrences of proposition symbols. That is, we shall write expressions like μp.ϕ, in which all free occurrence of the proposition symbol p in ϕ are bound by μ. The intended interpretation of μp.ϕ is that it denotes the subset of W that is the least fixed-point of the set-theoretic operator induced by ϕ with respect to p. Fine — but how do we know that this fixed-point exists? If ϕ is arbitrary, we don’t. However if all free occurrences of p in ϕ occur positively (that is, if they all occur under the scope of an even number of negations) then a simple inductive argument shows that the set-theoretic operator induced by ϕ is monotone, and hence (by the Knaster-Tarski Theorem) has least (and greatest) fixed-points. Accordingly we impose
Modal Logic: A Semantic Perspective
63
the syntactic restriction that the μ operator can only be used to bind a proposition symbol when all free occurrences of the variable occur positively. With this restriction in mind we define: V (μp.ϕ) = {U ⊆ W | V[p←U ] (ϕ) ⊆ U }. That is, the set assigned to μp.ϕ is the least fixed-point of the operator induced by ϕ. What can we say with the modal μ-calculus? Consider the expression μp.(ϕ ∨ π p). Read this as defining “the least property (subset) p such that either ϕ is in p or π p is in p”. What is this set? A little experiment will convince you that it must be {w ∈ W | M, w |= ϕ or there is a finite Rπ -sequence from w to v such that M, v |= ϕ}. (The reader should check that this set really is the one given to us by the Knaster-Tarski Theorem.) Note that this is exactly the set of points that make the PDL formula π ∗ ϕ true. How do we specify greatest fixed-points? With the help of the ν operator. This is defined as follows: νp.ϕ =def ¬μp.¬ϕ(¬p/p), where ϕ(¬p/p) is the result of replacing occurrences of p by ¬p is ϕ. This expression is wellformed: if ϕ is a formula that we could legitimately apply the μ operator to (that is, if all occurrences of p occur under the scope of an even number of negations), then so is ¬ϕ(¬p/p). The reader should check that this operator picks out the following set: V (νp.ϕ) =
{U ⊆ W | U ⊆ V[p←U ] (ϕ)}.
That is (in accordance with the Knaster-Tarski Theorem) it picks out the greatest fixed-point of the operator induced by ϕ. As a further exercise, the reader should check that νp.(ϕ ∧ [π]p) denotes the following set: {w ∈ W | M, w |= ϕ and at every v reachable from w by a finite Rπ -sequence, M, v |= ϕ}. Note that this is exactly the set of points w that make the PDL formula [π ∗ ]ϕ true. In view of these examples, it should not come as a surprise that PDL can be translated into the modal μ-calculus. Here are the key clauses: ( π1 ∪ π2 ϕ)mu ( π1 ; π2 ϕ)mu ( π ∗ ϕ)mu
= = =
π1 (ϕ)mu ∨ π2 (ϕ)mu
π1 π2 (ϕ)mu μp.((ϕ)mu ∨ ( π p)mu ), where p does not occur in ϕ.
In fact the modal μ-calculus is strictly more expressive than PDL. The simplest example of a construct that PDL cannot model but that the modal μ-calculus can is the repeat operator. The expression repeat(π) is true at a state w if and only if there is an infinite sequence of Rπ transitions leading from w. Proving that this is not expressible in PDL is tricky, but it can be expressed in the modal μ-calculus: the formula νp. π p does so. Moreover, the temporal logics
64
Patrick Blackburn and Johan van Benthem
standardly used in computer science, such as LTL, CTL, and CTL∗ , can also be embedded in the modal μ-calculus. For remarks and references on this topic, see Chapter 12 of this handbook. All in all, the modal μ-calculus is a highly expressive language. In spite of this, it is extremely well behaved, both computationally and in other respects. For a start we have that: THEOREM 45. The modal μ-calculus has the finite model property and is decidable. Its satisfiability problem is EXPTIME-complete. Proof. The original decidability proof was given in Kozen and Parikh [81]. The finite model property was first established in Street and Emerson [119]. The complexity result is from Emerson and Jutla [36]. ❑ Furthermore, experience shows that the modal μ-calculus is also well behaved when it comes to model checking — indeed it is widely believed that its model checking task can be performed in polynomial time. However, at the time of writing, this conjecture has resisted all attempts to prove it. Moreover, the modal μ-calculus has an elegant semantic characterisation. Suppose we add the following clause to the standard translation for basic modal logic: STx (μp.ϕ)
= ∀P (∀y((STx (ϕ) → P y) → P y)).
This clearly captures the intended semantics of μ. But note that by adding this clause we are viewing the standard translation as taking us to monadic second-order logic, for here we bind the unary predicate symbol P . This language is already familiar to us: it’s the frame correspondence language introduced in Section 5, but here we’re using it to express a correspondence at the level of models. Thus (even at the level of models) the modal μ-calculus is a fragment of monadic second-order logic. But which fragment? This one: THEOREM 46 (Modal μ-Calculus Characterisation Theorem). The modal μ-calculus is the bisimulation invariant fragment of monadic second-order logic. Proof. See Janin and Walukiewicz [73].
❑
For more on the modal μ-calculus, see Chapter 12 of this handbook. As well as giving a detailed technical overview, the chapter also gives an informal introduction to thinking in terms of fixed-points, which is often a stumbling block when the modal μ-calculus is encountered for the first time.
6.8 Combined logics We now turn to what is (at first glance) one of the simplest methods of obtaining a richer modal language: combine two pre-existing ones. But for all its apparent simplicity, this method of enrichment swiftly leads to difficult territory. Many applications lead naturally to the idea of combined logics. A good example is planning. Planning involves a collection of agents who must reason about what they are going to do given that they know the effects of actions, and where getting more information may be important for solving the problem at hand. Hence Robert Moore [98] proposed a combined language for this task. His language offered both epistemic and action modalities, making it possible to say things like Ki [a]ϕ “agent i knows that doing a has the effect ϕ”
Modal Logic: A Semantic Perspective
65
and [a]Ki ϕ “doing a makes agent i know that ϕ”. Actually, Moore also considered combinations of PDL with epistemic operators, as plans are usually complex actions with program structure. The fun starts when we ask how the two logics live together. For example, should they simply live side by side, the simple fusion of the two component logics? Or are there interactions between them? Obviously this depends on what we are modeling. For example, should Ki [a]ϕ imply [a]Ki ϕ? In general, no. After all, I may know that after drinking I am boring, but unfortunately after drinking I no longer know that I am boring (that is, drinking is not an epistemically transparent action). Nor need the converse implication hold for actions that deliver genuinely new information. After consulting my account manager, I know I am broke, but I do not know now that after the consultation I am broke. If our application does not require the modeling of such interactions, then we are dealing with the simplest possible combination of two decidable modal logics, and the result is again decidable. But for some applications we might want to enforce these interactions. Let Ra be the accessibility relation for action a, and let ∼i be the epistemic relation for agent i. The following frame correspondences tell us what these interactions give rise to: F |= Ki [a]p → [a]Ki p F |= [a]Ki p → Ki [a]p
iff ∀xyz((Ra xy ∧ y ∼i z) → ∃u(x ∼i u ∧ Ra uz)) iff ∀xyz((x ∼i y ∧ Ra yz) → ∃u(Ra xu ∧ u ∼i z)).
The first principle says that new uncertainty links between the results of an action are inherited from existing ones; this is a version of the game-theoretic principle of perfect recall. The other direction is called no learning. These are powerful interaction principles. Indeed, they impose a grid-like interaction between the relations interpreting the modalities, hence the possibility arises of showing undecidability by encoding the tiling problem. A good source of information on this topic is Halpern and Vardi [64]. Among other things they show that the combined modal epistemic logic of agents with perfect recall, though still decidable, is highly complex, and that if a common knowledge operator (that is, using PDL notation, a box of the form [(∼1 ∪ · · · ∪ ∼n )∗ ]) is added, the problem becomes undecidable. This is a natural example of the bad computational behaviour that combinations of relatively simple decidable modal logics can give rise to. Moreover the air of mystery (“How can a description of well behaved agents get so complex?”) quickly gets dispelled once we realise that the behaviour of special agents may have a rich mathematical structure that makes their logic tough. In recent years there has been intensive theoretical work on combinations of modal logic. The goal has been to provide general transfer results: given two (or more) modal logics, and a method of combining them, when do properties such as decidability, finite model property, and finite axiomatisability transfer from the component logics to the combined logic? The simplest way of combining two modal logics is to take their fusion. Given two modal logics L1 and L2 (in languages with disjoint sets of modal operators) then their fusion L1 ⊗ L2 is the smallest logic L in their joint language that contains them both. Fusions of modal logic have been investigated in detail (key papers include Kracht and Wolter [82], Fine and Schurz [46], and Wolter [144]), and have some pleasant transfer properties. For example, to axiomatise the fusion logic L, it suffices to take the axioms for each of the components (that is, no interaction axioms involving modalities from both language are required). Moreover, both the finite model property and decidability transfer from the component logics to the fusion. But this good behaviour reflects the fact that fusion is a combination method designed to minimise the interaction between the component modalities. What of combination methods
66
Patrick Blackburn and Johan van Benthem
which allow strong interaction between the modalities? The best studied combination technique here is the formation of products of modal logics. Given two frames F1 = (W1 , R1 ) and F2 = (W2 , R2 ), their product F1 × F2 is the frame (W1 × W2 , Rh , Rv ). Here Rh is the binary relation on W1 × W2 defined by (u1 , v1 )Rh (u2 , v2 ) iff u1 R1 u2 and v1 = v2 ; and Rv is the relation defined by (u1 , v1 )Rv (u2 , v2 ) iff v1 R2 v2 and u1 = u2 . The idea of taking products of modal logics is an old one (dating back to at least Segerberg [114]) and is a widely used combination method in many applications of modal logic. But the product construction creates frames which allow for very strong interactions between the modalities, and there are far fewer transfer results for this method of combination; indeed, there are many negative results showing transfer of decidability failures. Work on combination of logics, from both applied and theoretical perspectives, is one of the liveliest areas of research in contemporary modal logic. For a detailed survey of fusions, products, and methods of combinations between these extremes, see Chapter 15 of this handbook.
6.9 First-order modal logic We turn now to what is arguably one of the least well behaved modal languages ever proposed: first-order modal logic. However, in one of those twists that make intellectual history so fascinating, first-order modal logic has come to be accepted (at least in philosophical quarters) as the most important modal logic of all. For many philosophers, modal logic is first-order modal logic. This is not to say that first-order modal logic is philosophically uncontroversial. Indeed, as is discussed in Chapter 21 of this handbook, one of the liveliest debates in 20th century analytic philosophy was ignited when Quine [106] questioned the coherence of the enterprise. But two advances led to its acceptance. The first was the development of the relational semantics of first-order modal logic (Kripke [83, 85] are key papers here) and the second was the publication of “Naming and Necessity” (Kripke [86]) which presented what is probably the most widely accepted philosophical interpretation of the technical machinery. While these developments did not dispel all the controversy, nowadays first-order modal logic together with (some form of) relational semantics, is generally regarded as a well understood (perhaps even boringly familiar) tool of philosophical analysis. Viewed from a mathematical perspective, however, things look rather different. Had firstorder modal logic never existed, a logician who proposed its (now standard) syntax and relational semantics might have been regarded as audacious, perhaps downright careless. Why? Because, in essence, first-order modal logic is a combined logic. As we have just seen, combining two modal logics while retaining interesting properties is no easy matter. So it should not come as too much of a surprise that combining propositional modal logic with first-order logic is unlikely to be plain sailing. In what follows we shall sketch the standard syntax and semantics, and mention some of its problematic features. First the syntax (we omit some of the clauses for the booleans): ϕ
::= P (x1 , . . . , xn ) | x = y | ¬ϕ | ϕ → ψ | 3ϕ | 2ϕ | ∃xϕ | ∀xϕ.
Here P is an n-place predicate symbol and the xi are individual variables. So (given the clauses for the quantifiers and booleans) it is clear that we have a full first-order language at our disposal, and hence (because of the presence of the modalities) we can now search for first-order information at accessible states in the familiar way. But we can do more. The clauses for the quantifiers hide a subtlety: if a formula ϕ contains free first-order variables within the scope of a
Modal Logic: A Semantic Perspective
67
modality, then formulas of the form ∀xϕ and ∃xϕ bind variables within the scope of the modality. This possibility is what led to Quine’s philosophical objections (“no binding into intensional contexts”). And from a technical perspective it means we are combining two very different styles of logic in a way that allows a strong form of interaction. The standard semantics for first-order modal logic comes in a number of variant forms. One basic choice concerns the domain of quantification: should the quantifiers range over some fixed domain of quantification (the constant domain semantics), or should each point be associated with its own domain (the varying domain semantics)? Here we shall present the varying domain semantics; for a discussion of the constant domain approach, and of equivalences between the constant domain, varying domain, and other approaches, see Chapter 9 of this handbook, or Fitting and Mendelsohn [49]. DEFINITION 47. A varying domain model is a tuple (W, R, D, {δw }w∈W , {Vw }w∈W ). Here W is a non-empty set; R is a binary relation on W ; D (the domain of quantification) is a nonempty set; for all w ∈ W , δw ⊆ D; and for all w ∈ W , Vw is a function that assigns to each n-place predicate symbol a subset of Dn . That is, we have the familiar modal machinery from the propositional case (note that (W, R) is just a frame, and the Vw are essentially our familiar valuations upgraded to interpret first-order n-place predicate symbols P rather than proposition symbols p) augmented by a specification (the δw ) of the individuals the quantifiers at each state w range over. We interpret first-order modal logic by taking such a model, together with an assignment of values to variables (that is, a function g that maps the individual variables to elements of D), and using the following satisfaction definition: M, g, w |= P (x1 , . . . , xn ) M, g, w |= x = y
iff iff
(g(x1 ), . . . g(xn )) ∈ Vw (P ), g(x) = g(y),
M, g, w |= ¬ϕ M, g, w |= ϕ → ψ M, g, w |= 3ϕ
iff iff iff
not M, g, w |= ϕ, M, g, w |= ϕ or M, g, w |= ψ, for some v ∈ W such that Rwv we have M, g, v |= ϕ,
M, g, w |= 2ϕ M, g, w |= ∃xϕ
iff iff
M, g, w |= ∀xϕ
iff
for all v ∈ W such that Rwv we have M, g, v |= ϕ, for some g ∼x g where g (x) ∈ δw we have M, g , v |= ϕ, for all g ∼x g such that g (x) ∈ δw we have M, g , v |= ϕ.
(Here g ∼x g means that the assignments g and g are identical save possibly in the value they assign to the variable x.) This language is capable of expressing some important distinctions. Consider, for example, the formulas ∀x2ϕ and 2∀xϕ. The first asserts, of each existing entity, that it has the property ϕ at all accessible states. The second asserts that, at each accessible state, each entity that exists at that particular state has property ϕ. Should either of these formulas imply the other? That is, should we accept as valid either of the following two principles? ∀x2ϕ → 2∀xϕ 2∀xϕ → ∀x2ϕ
Barcan formula Converse Barcan formula
Instead of trying to answer such tricky philosophical questions (which bear on the de dicto/de re distinction, discussed in Chapter 9 of this handbook) let us consider what they say in the light of
68
Patrick Blackburn and Johan van Benthem
the relational interpretation just given. It is not difficult to see that the Barcan formula is valid in a varying domain model iff that model has decreasing domains, that is, if for all w, v ∈ W , Rwv implies δv ⊆ δw . And the Converse Barcan formula is valid on precisely increasing domain models, that is, models with the property that Rwv implies δw ⊆ δv . So to insist on the validity of both principles is to force an even stronger interaction between the quantifiers and modalities: it takes us to a locally constant domain semantics in which Rwv implies δw = δv . This is a good example of the clarity that relational semantics can bring to difficult conceptual issues, and shows why first-order modal logic can be useful in philosophical logic and natural language semantics. So what’s the problem? Simply this: for all its analytical utility, first-order modal logic under its standard semantics is not well behaved mathematically. Early signs of trouble appeared in Fine [45], which showed that interpolation and the Beth property fail for first-order S5 under the varying domain semantics, and for any first-order modal logic between K and S5 under the constant domain semantics. As S5 is both philosophically central (it is widely considered to embody the logic of “necessarily” and “possibly”) and semantically straightforward (it is the logic of frames in which R is an equivalence relation) these are strong negative results indeed. Worse was to come. It turns out that it is possible to take a propositional modal logic that is complete with respect to some class of frames, axiomatically extend it in the manner naturally suggested by the standard semantics, and yet to wind up with an incomplete first-order modal logic (see Ghilardi [56], Shehtman and Skvortsov [117], Corsi and Ghilardi [26], Cresswell [27]). Now, the issue here is not so much the incompleteness in itself (as we have already discussed, even in the propositional modal logic, frame incompleteness results are the norm) rather it is the loss of completeness in the transition from the propositional case to the first-order case that is worrying. To use the terminology introduced when we discussed combinations of logics: the standard relational semantics for first-order logic is a method of combination for which transfer of completeness fails. Such results have led to renewed technical interest in first-order modal logic. The semantics of first-order modal logic has come under intense scrutiny, and a number of alternative semantics have been proposed which enable completeness results to be transferred. Some of this work has been model-theoretic (see, in particular, van Benthem’s [132] use of functional frames) but most of it has been highly abstract, employing the language of category theory; for a detailed account of such work, see Chapter 9 of this handbook. More recently, the hybrid logic community has pointed out that upgrading the underlying propositional modal language to a hybrid language is another way to repair the situation: interpolation is regained (see Areces, Blackburn and Marx [7]), indeed, regained constructively (see Blackburn and Marx [15]) and general positive results on transfer of completeness can be proved (see Blackburn and Marx [14]). All in all, first-order modal logic is one of the most intriguing areas of modal logic: the most venerable system of all poses some of the most interesting questions about what it is to be modal.
6.10
General perspectives
Moving to richer languages better fitted for particular applications is a standard feature of current research. It is true that in some quarters sticking to the poorest modal base language of the founding fathers (despite its evident handicaps in expressive power and mathematical convenience) is still something of a religion. But the idea of designing extensions is not some new-fangled notion; its roots stretch back to the work of von Wright [145] and Prior [104, 105], and the idea was central to the work of the Sofia School (see, for example, Passy and Tinchev [101] for insightful comments on what modal logic is and why one might want to enrich it). Still, pointing to a
Modal Logic: A Semantic Perspective
69
noble heritage is not enough. We need to address a tricky question: what makes these languages modal? Being precise here is difficult. As we have seen, there is a wide range of extensions. Moreover, each application imposes its own concerns and peculiarities. Nevertheless, there is a guiding idea that lies behind most examples of this form of language design: obtaining a reasonable balance between expressive power and computational complexity. So the question we should focus on is: what makes such natural balances arise? As we have seen, many richer modal languages are fragments of the full language of firstorder logic over some appropriate similarity type of relations and properties. We can see this by translation, just as we did with the basic modal language (we saw that the complex truth conditions for the Until and Since are definable by first-order formulas, and the same is true for the conditional connective, the universal modality, and the apparatus of hybrid logic). Now, there have been various attempts to find general patterns explaining which parts of first-order logic are involved in modal languages. Gabbay [51] observed that modal languages tend to translate into so-called finite variable fragments of first-order logics, that is, fragments using only some finite number of variables, fixed or bound. For example, we have seen that the basic modal language can make do with only two variables, and temporal logic with Until and Since, and conditional logic, only require three. Finite variable fragments have some pleasant computational behaviour; for example, their model checking complexity is in PTIME (see Vardi [141]) as opposed to PSPACE for the full first-order language. On the other hand, as we have already mentioned, satisfiability is already undecidable for first-order fragments with three variables, so the real reason for the low complexity of modal languages lies elsewhere. A different type of analysis for the latter phenomenon was given in the paper “Why is modal logic so robustly decidable?” (Vardi [142]). This emphasises the semantic adequacy of the tree-like models obtainable via bisimulation unraveling of arbitrary graph models. This type of explanation is important as it transcends first-order logic; on the other hand it does not provide much in the way of concrete syntactic insight. For the latter, the current best explanation is the one provided by the guarded fragment and its relatives (which are, arguably, the strongest known modal languages). As we saw, guarded fragments locate the essence of modal logic in the restriction on the quantification performed by the modalities. One attractive property of this analysis is its logical resilience: it turns out that it extends beyond the setting of first-order enrichments to secondorder enrichment too, something that was not forseen when the guarded fragment was first isolated. A striking example is the result in Gr¨adel and Walukiewicz [63] that the extension of the guarded fragment with the fixed-point operators μ and ν remains decidable. By way of contrast, validity for full first-order logic extended with these operators is non-axiomatisable, indeed, nonarithmetical. This observation shows that the modal philosophy embodied in the idea of guarded fragments is not restricted to first-order extensions: often modal fragments can bear the weight of additional higher-order apparatus (such as fixed-point operators) which would send the full first-order correspondence languages into a tailspin complexity wise. Our discussion of PDL and the modal μ-calculus has shown that this is the case for the basic modal language. Gr¨adel and Walukiewicz’s result for the guarded fragment shows that this type of behaviour persists higher up: guarded quantification can support higher-order constructions too. Perhaps guarding can be a fruitful strategy in even more exotic modal settings? One setting worth exploring is infinitary modal logic. This logic (which was used extensively in Barwise and Moss [10] and Baltag [8] for investigating non-well founded set theory; see Chapter 16 of this handbook) provides a perfect match with bisimulation: two pointed models are bisimilar if and only if they satisfy the same formulas in a modal language that allows arbitrary infinite conjunctions and disjunctions. Moreover a modal characterisation theorem holds. Now, decidability is a
70
Patrick Blackburn and Johan van Benthem
non-issue in this setting, but what about existential semantic properties such as interpolation and Beth Definability? It is known that interpolation holds for infinitary modal logic (see Barwise and van Benthem [11]), but can such results be lifted to infinitary guarded fragments? Another setting worth exploring in this way is second-order propositional modal logic, in which we can quantify over proposition symbols (see Fine [42] for some early results, ten Cate [124] for a more recent discussion, and Chapter 10 of this handbook for a brief overview). The equation “modality = guarding” should be simultaneously regarded as a hypothesis to be tested in richer settings, and as a useful heuristic for isolating further logics worth calling modal. Not that we should put all our eggs in one basket. Perhaps the notion of modality is too diffuse for any single approach to exhaust, and in any case it is worth looking for alternatives. Another approach is to apply ideas from abstract model theory (see Barwise and Feferman [9]). This was first done in de Rijke [30], who proved a modal analog of Lindstr¨om’s [91] celebrated characterisation of first-order logic. The original form of Lindstr¨om’s theorem says that an abstract logic L extending first-order logic coincides with first-order logic iff it has the compactness and L¨owenheim-Skolem properties. Another way of stating the theorem is that an abstract logic L extending first-order logic coincides with first-order logic iff it has the compactness and Karp properties. (The Karp property is that all formulas are invariant for potential isomorphism, where a potential isomorphism is a non-empty family of finite partial isomorphisms closed under the usual back and forth extension properties; recall our discussion of partial isomorphisms in Section 3.3). We shall discuss a (slightly reformulated) version of de Rijkes’s result and a more recent characterisation due to van Benthem. What is an abstract modal logic? Here’s the conception that underlies our reformulation of de Rijke’s result. We give it in terms of pointed models (M, w), that is, a model together with a point of evaluation. DEFINITION 48 (Very abstract modal logics). Let L be a set of formulas, and |=L its satisfaction relation, that is, a relation between pointed models and L-formulas. A very abstract modal logic is a pair (L, |=L ) with the following properties: 1. Occurrence property. For each ϕ in L there is an associated finite language L(λϕ ). The relation (M, w) |=L ϕ is a relation between L-formulas ϕ and models (M, w) for languages L containing L(λϕ ). That is, if ϕ is in L, and M is an L-model, then (M, w) |=L ϕ is either true or false if L(λϕ ) ⊆ L, and undefined otherwise. 2. Expansion property. The relation (M, w) |=L ϕ depends only on the restriction of M to L(λϕ ). That is, if (M, w) |=L ϕ and (N, w) is an expansion of (M, w) to a larger language, then (N, v) |=L ϕ. A very abstract modal logic (L, |=L ) extends basic modal logic if for every basic modal formula there exists an equivalent L-formula (that is, if for each basic modal formula ϕ there exists an L-formula ψ such that for any model (M, w) we have (M, w) |= ϕ iff (M, w) |=L ψ). De Rijke’s characterisation centres on the familiar bisimulation invariance property and the finite depth property. A very abstract modal logic L has the finite depth property iff for any L-formula ϕ there is some natural number k such that for all models M, M, w |= ϕ iff M|k, w |= ϕ, where M|k is the model M restricted to just those points that can be reached from w in k or fewer R-steps. De Rijke builds invariance for bisimulation into the notion of abstract modal
Modal Logic: A Semantic Perspective
71
logic, so his statement of his Lindstr¨om-style result has the form: any abstract modal logic with the finite depth property that extends the basic modal language is the basic modal language. Reformulating his result in terms of very abstract modal logics, thereby making the bisimulation invariance condition explicit, results in: THEOREM 49. Suppose L is a very abstract modal logic extending the basic modal language. Then L coincides with the basic modal language iff L has the finite depth and invariance for bisimulation properties. Proof. See de Rijke [30, 31]. For a textbook-level exposition of the proof, see Theorem 7.60 of Blackburn, de Rijke and Venema [13]. ❑ This is an informative result. Nonetheless, the finite depth property seems somewhat engineered to capture the basic modal language, and it is natural to look for generalisations. However, because of the expressive limitations of modal languages, this is not straightforward. The proof of the Lindstr¨om Theorem for first-order logic typically proceeds by contradiction: to show that an abstract first-order formula has a first-order equivalent, one typically builds a model where ϕ is true in one part, ¬ϕ in another, and uses the expressive power of first-order logic to link the two parts of the model by a chain of partial isomorphisms, thereby reaping the contradiction. This style of argument does not lift easily to modal languages: the basic modal language is too impoverished to encode the chains of bisimulations linking the two parts of the model that would be required to mimic this proof technique directly. However, as van Benthem [139] observed, there is a way around this. The key idea is to strengthen the definition of a very abstract modal language by demanding it fulfils the relativisation condition: DEFINITION 50 (Abstract modal logics). An abstract modal logic L is a very abstract modal logic that has the relativisation property: for any L-formula ϕ and proposition symbol p not occurring in ϕ, there is a formula Rel(ϕ, p) which is true at a model (M, w) iff ϕ is true at (M|p, w), which is the submodel of M consisting of just those points that satisfy p. Relativisation is a natural property (most logics satisfy it) but the key point is to observe is how it is used in the proof of the following theorem: in essence, it provides a model-theoretic tool which enables us to give an alternative proof without resorting to explicit codings of bisimulations. This leads to van Benthem’s version of the Lindstr¨om Theorem for modal logic: THEOREM 51. Suppose L is an abstract modal logic extending the basic modal language. Then L coincides with the basic modal language iff L satisfies compactness and invariance for bisimulation. Proof. We know that the basic modal language satisfies compactness (Proposition 4) and invariance for bisimulation (Lemma 9) so the left to right direction is clear. For the reverse direction, assume that L has these properties. We claim that the following holds: in a compact abstract modal logic L which is invariant for bisimulations, every formula has the finite depth property. If we can show this, the result follows from Theorem 49. We prove the claim as follows. Let ϕ be any formula in L. Suppose for the sake of a contradiction that ϕ lacks the finite depth property. Then for any natural number k there exists a model (Mk , w) and a cut-off version (Mk |k, w) which disagree on the truth value of ϕ. Without loss of generality, assume that the following happens for arbitrarily large k: (Mk |k, w) |= ϕ, and (Mk , w) |= ¬ϕ (here we use the fact that abstract modal logics are closed under negation). Now take a new proposition symbol p, and consider the following set Σ of L-formulas: {¬ϕ, Rel(ϕ, p)} ∪ {2n p | for all natural numbers n}.
72
Patrick Blackburn and Johan van Benthem
(By 2n p we mean p prefixed by a sequence of n boxes.) Given our assumptions, this set is finitely satisfiable: we choose k sufficiently large, and make p true in the k reachable part of one of the above sequences of models. But then, by compactness for our abstract modal logic L, there must be a model (N, v) for the whole set Σ at once. But this leads to a contradiction as follows. We focus on the generated submodel (Nv , v) consisting of v and all points finitely reachable from it. Now, the identity relation is a bisimulation between any pointed model and its unique generated submodel. Hence, by the assumed invariance for bisimulation, formulas of L have the same truth value in any pointed model and its generated submodel. Now, given our definition of Σ, ¬ϕ holds in (N, v), and hence also in (Nv , v). On the other hand, since (N, v) |= Rel(ϕ, p), we have (N|p, v) |= ϕ. But by the truth of all the formulas of the form 2n p, p holds in the whole generated submodel (Nv , v). Therefore we have that ϕ holds in (Nv , v). Contradiction. Hence the claim is established and the theorem follows. ❑ One surprising consequence of this result is that the Modal Characterisation Theorem (Theorem 13) follows from it; see van Benthem [139] for details. It remains to be seen how widely applicable this technique is. For example, it is not straightforwardly applicable to languages with the universal modality, as these lack the finite depth property. However it can be lifted to the guarded fragment. As we mentioned in Section 6.5, there is a notion of guarded bisimulation. And using this notion, together with the relativisation technique leads to: THEOREM 52. Suppose L is an abstract modal logic extending the guarded fragment. Then L coincides with the guarded fragment iff L satisfies compactness and invariance for guarded bisimulation. Proof. See van Benthem [139].
❑
7 ALTERNATIVE SEMANTICS As we said at the start of this chapter, one of the most instructive ways of thinking about modal logic is to view it as a tool for talking about graphs. But to view modal logic exclusively through the lens of relational semantics would be a mistake; interesting alternatives exist, and in this section we introduce three of them: algebraic semantics, neighbourhood semantics, and topological semantics. As we shall see, each of these semantics has something new to offer. But we shall come across much that is familiar, for all three are linked in various ways with relational semantics.
7.1 Algebraic semantics The basic idea of algebraic semantics is simple: view modal formulas as terms (or polynomials) and evaluate them in the appropriate type of algebra. So the key question is: what kinds of algebra are appropriate for modal logic? The answer is: boolean algebras with operators, or BAOs. A boolean algebra is a triple A = (A, +, ×, −, 1, 0) such that both + (join) and × (meet) are commutative and associative binary operations, each of which distributes over the other. The unary operation − (complement) must satisfy the equations x + (−x) = 1 and x × (−x) = 0. The nullary operations (or constants) 1 and 0 must satisfy the equations x×1 = x and x+0 = x.
Modal Logic: A Semantic Perspective
73
Even if you have never encountered boolean algebras before, a moment’s reflection should make it clear that they are an algebraic mirror of propositional logic. To see this, read + as ∨, × as ∧, − as ¬, 1 as , 0 as ⊥, and = as ↔. So it only remains to provide algebraic structure that mirrors the diamonds. This motivates the following definition. DEFINITION 53 (Boolean Algebras with Operators). A boolean algebra with operators, or BAO, is a pair B = (A, m), where A is a boolean algebra and m is a unary operator on A that satisfies the equations m(x + y) = m(x) + m(y), and m(0) = 0. Note that the logical analogs of these two equations are 3(ϕ ∨ ψ) ↔ (3ϕ ∨ 3ψ), and 3⊥ ↔ ⊥, both of which are valid in relational semantics. Thus we now have an algebraic mirror for all components of the basic modal language. We interpret the basic modal language in BAOs in the usual algebraic fashion. That is, given a BAO, we view the proposition symbols as variables ranging across the elements of the algebra, and interpret each logical operator by its corresponding algebraic operation. More precisely, let B be a BAO, and V be a function mapping each proposition symbol to an element of B; we call such a function V an algebraic valuation. We extend V to a function that gives the result of evaluating arbitrary basic modal formulas in B via the following recursive clauses: V (ϕ ∨ ψ) = V (ϕ ∧ ψ) = V (¬ϕ) = V (3ϕ) =
V (ϕ) + V (ψ) V (ϕ) × V (ψ) −V (ϕ) mV (ϕ)
It is now possible to prove the following algebraic completeness result: THEOREM 54. A basic modal formula belongs to the minimal modal logic K iff it evaluates to the value 1 in all modal algebras under all algebraic valuations. Proof. Straightforward. The key point is to use a technique standard in algebraic logic, namely to create the Lindenbaum-Tarski Algebra for K. The elements of the Lindenbaum-Tarski Algebra are equivalence classes of K-provably equivalent formulas; the operations are defined with the aid of the connectives. All and only the K-provable formulas evaluate to 1 in this algebra, and hence the result follows. For a detailed discussion, see Chapter 6 of this handbook. ❑ In fact, a far stronger result can be proved: any axiomatic extension of K (that is, any normal modal logic) is complete with respect to some class of algebras. And the proof is not difficult. In essence, one replicates the completeness proof for K, but works with the Lindenbaum-Tarski Algebra which satisfies the additional axiomatic constraints. As we saw earlier (recall Theorem 26) there is no general completeness result for normal modal logics with respect to frames. This is an important difference between algebraic and relational semantics. Nonetheless, it is likely that some readers will feel a little cheated. Isn’t the whole approach really just syntax in disguise? After all, algebraic semantics matches the modal language with algebraic operations that transparently mirror fundamental validities of the original logic. This does not seem like genuine semantic analysis: it has more the flavour of linking two distinct, but closely related, syntactic realms. Moreover, the algebraic satisfaction definition has a global rather than a local flavour. This is true, but somewhat besides the point, for in spite of the general completeness result just noted, we have not yet entered the heartland of algebraic semantics. For what algebraic semantics really provides is a doorway to a larger mathematical universe. The power of algebraic semantics
74
Patrick Blackburn and Johan van Benthem
comes from the wealth of ideas and techniques it enables us to bring to bear on problems in modal logic. Some of these techniques take us back, via a novel path, to the heart of relational semantics, but others take us to new territory. Let’s look a little deeper. An important theme in algebra is the representation of abstract mathematical structures by concrete set-theoretic structures. The point of a representation theorem is to show that some abstractly specified class of algebras picks out an intended class of concrete structures. So representation theorems are rather like completeness theorems: they show that the abstract (often equational) specification is strong enough to ensure that every abstract algebra is isomorphic to a concrete algebra. Two classic examples are Cayley’s Theorem, which shows that every finite group is isomorphic to a collection of permutations, and the Stone Representation Theorem, which shows that every abstract boolean algebra is isomorphic to a field of sets (that is, a boolean closed collection of subsets of some W that contains W ) with × viewed as intersection, + viewed as union, and − viewed as set-theoretic complement. Now, in 1952, several years before relational semantics was officially invented, J´onsson and Tarski [74, 75] proved a remarkable representation theorem for BAOs: they showed that every abstract BAO could be represented as a relational structure. Inexplicably, their paper made no mention of modal logic. This was unfortunate as their paper contained all the technical machinery needed to define relational semantics and prove relational completeness results for most commonly occurring modal logics. In essence, their result allows relational completeness proofs to be factored into an algebraic completeness step (which makes use of the Lindenbaum-Tarski Algebra) followed by a representation step (which turns this algebra into a relational structure). Nowadays, the J´onssonTarski Theorem is rightly considered a cornerstone of modal logic; for a detailed proof of the theorem, and examples of how to put it to work, see Chapter 6 of this handbook. Another important theme goes under the name of duality theory. As we saw in Section 5, there are four key transformations on frames (disjoint unions, generated submodels, bounded morphisms, and ultrafilter extensions) and, as the Goldblatt-Thomason Theorem tells us, closure of a frame class under these model-theoretic constructions is necessary and sufficient to ensure its basic modal definability. But as we have already remarked (see Theorem 33) the original proof of the Theorem was algebraic. What’s the algebraic connection? This: each of these four operations on frames corresponds to an operation on classes of algebras. Viewed this way, the Goldblatt-Thomason Theorem can be seen as a modal version of the Birkhoff Theorem, which identifies equationally definable classes of algebras with those classes of algebras that are closed under the formation of subalgebras, homomorphisms, and products. For a detailed discussion, we again refer the reader to Chapter 6. But important as these two examples are, they merely hint at the wealth of techniques made available by the algebraic connection. Algebraic semantics has repeatedly proved itself a powerful analytical tool. To give another classic example, Blok [16] was able to give a detailed analysis of frame incompleteness by drawing on algebraic methods. In particular, he did so by investigating splittings (a concept from lattice theory) of the lattice of normal modal logics; for a discussion of Blok’s work, see Chapter 7 of this handbook. Moreover, in many cases algebraic methods have been adapted to richer modal languages. A nice example is provided by the universal modality. In the algebraic setting, the universal modality allows us to define a discriminator term, that is, a term denoting an operator that maps 0 to 0 and all other elements to 1. Algebras with discriminator terms are particularly straightforward to work with (see Chapter 6 of this handbook) thus here algebraic semantics sheds interesting light on a relationally-natural extension of the basic modal language. But algebraic semantics also illuminates areas where relational semantics has little to say. For example, it turns out that the boolean structure of the
Modal Logic: A Semantic Perspective
75
underlying algebras is not particularly significant. That is, it is possible to analyse modalities algebraically even if we don’t have full classical propositional logic at our disposal. Such logics can be important in various settings, and relational semantics at present offers little in the way of insight. For further remarks and references on this application of algebraic semantics, see Chapter 6 of this handbook.
7.2 Neighbourhood semantics For some applications, relational semantics is too strong. For example, 3(ϕ ∨ ψ) → (3ϕ ∨ 3ψ) is valid under relational semantics. But if we read 3ϕ as making the game-theoretic assertion that the player has a strategy forcing the outcome to satisfy ϕ, we might be inclined to reject it: why should possession of a strategy for a disjunction imply possession of a strategy for one of the disjuncts? For example, suppose we play a game with the following moves: you have the right to decide whether we go to a movie or a concert, and I can decide which particular movie or concert we go to. Suppose the movie I want to see is Crash, and that my favourite music is Mozart. It follows that I can force Crash ∨ Mozart, but (because it’s you who determines the movie/concert option) I can’t determine which of these two options will actually take place. Similarly, if we interpret 2ϕ epistemically we have further grounds for objection. For a start, relational semantics validates the following principle: 2(ϕ → ψ) → (2ϕ → 2ψ). Moreover, it validates the following pattern of inference: if |= ϕ then |= 2ϕ. These work together to enforce a strong form of logical omniscience: if an agent knows ϕ, then she knows all its logical consequences. Such considerations have led to a search for weaker semantics. Perhaps the best known of these is neighbourhood semantics (introduced in Montague [96, 97] and Scott [112] and explored in Segerberg [113]). The key idea of neighbourhood semantics has a topological flavour: each point w in a model is associated with a collection of subsets of the domain (the neighbourhoods of w) and a formula of the form 2ϕ is true at w iff the set of points in a model satisfying ϕ is a neighbourhood of w. Let’s make this precise. A neighbourhood model is a triple (W, R, V ) where W is a non-empty set of states, V is a valuation, and R relates points w ∈ W to subsets of W (that is, R ⊆ W × 2W ). For any w ∈ W , let Nw be {U ⊆ W | wRU }; we call Nw the set of neighbourhoods of w. We interpret boxed formulas as follows: M, w |= 2ϕ iff {u ∈ W | M, u |= ϕ} ∈ Nw , and use the dual definition for diamonds: M, w |= 3ϕ iff {u ∈ W | M, u |= ϕ} ∈ Nw . Neighbourhood semantics is a generalisation of relational semantics. To see this, note that given any relational model M = (W, R, V ) we can form a neighbourhood model Mn = (W, Rn , V ) by stipulating, for each w ∈ W and U ⊆ W , that Rn wU iff U = {u ∈ W | Rwu}. That is, for each w ∈ W , Nw is the singleton set containing the set of points that are Raccessible from w. Hence, for all w ∈ W and all basic modal formulas ϕ, we have that M, w |= ϕ iff Mn , w |= ϕ. In short, we can turn any relational model into an equivalent neighbourhood model.
76
Patrick Blackburn and Johan van Benthem
Figure 22. Neighbourhood model that falsifies 2(ϕ → ψ) → (2ϕ → 2ψ) at u. But we cannot do the reverse. Consider a model M = (W, R, V ) such that W = {t, u, v, w}, V (p) = {t, u} and V (q) = {u, v}, and Nu = {V (p), PIMQ}, where PIMQ = {u, v, w}. Such a model is shown in Figure 22; note that PIMQ is the set of points where p → q is true. Hence M, u |= 2(p → q), as PIMQ ∈ Nu . Furthermore, M, u |= 2p, as V (p) ∈ Nu . However M, u |= 2q, for V (q) ∈ Nu . So M, u |= 2(ϕ → ψ) → (2ϕ → 2ψ). As this formula is valid under relational semantics, no relational model equivalent to M exists. Moreover, the inferential principle characteristic of relational semantics (if |= ϕ then |= 2ϕ) no longer holds. To see this, it suffices to consider a model M consisting of a single point w such that Nw = ∅. Then M, w |= , but M, w |= 2. In fact, all that remains in neighbourhood semantics is the weaker principle: if |= ϕ ↔ ψ then |= 2ϕ ↔ 2ψ. Thus neighbourhood semantics does not enforce logical omniscience. Neighbourhood semantics has been criticised as under-motivated. It may banish the spectre of logical omniscience, but does it do so in a principled way? After all, isn’t there something stipulative, indeed ad-hoc, about simply asserting that certain subsets and not others are in the neighbourhood of a given point? There is a grain of truth in such criticisms, nonetheless we should not be too quick to dismiss the approach. For some applications, asserting that certain neighbouring regions are important is probably the best we can do in the way of semantic analysis. Furthermore, like relational semantics, neighbourhood semantics offers an entire framework for semantics; imposing further restrictions on neighbourhoods (for example, demanding that neighbourhoods be superset closed) is a mechanism which permits finer-grained semantic analyses to be attempted. See Chellas [24] for an introduction to some of the options here. Neighbourhood semantics has some pleasant properties. For a start (if NP = P SP ACE, the standard assumption) it is better behaved computationally than relational semantics: THEOREM 55. The satisfiability problem for neighbourhood semantics is NP-complete. Proof. See Vardi [140]. The key observation is that if a formula ϕ is satisfiable in a neighbourhood model, then it is satisfied in a model with at most |ϕ|2 states, where |ϕ| is the number of symbols in ϕ. ❑ Moreover, neighbourhood semantics meshes well with the algebraic and co-algebraic approaches discussed in Chapter 6 of this handbook.
7.3 Topological semantics Topological semantics is one of the oldest modal semantics, and the first in which deep technical results were proved. In 1938, Tarski [122] showed that S4 (the logic which in relational semantics is complete with respect to transitive and reflexive frames) is complete with respect to
Modal Logic: A Semantic Perspective
77
topological spaces. Then, in 1944, McKinsey and Tarski [95] showed that S4 is the modal logic of the real numbers, and indeed of any metric separable space without isolated points. Since this pioneering work, topological semantics has been deeply (if somewhat sporadically) studied, and many interesting results have been proved (see for example Esakia [38] and Shehtman [115]) but for many years it was rather isolated from the modal mainstream. More recently, however, partly because of the growing interest in logics of space, there has been a revival of interest. For an overview of developments in topological semantics since the time of Tarski, see Chapter 16 of this handbook; here we will introduce its basic ideas in a way that emphasises connections with our account of relational semantics. Our discussion is based on Aiello, van Benthem, and Bezhanishvili [2]. A topological space is a pair (W, τ ), where W (the domain) is a non-empty set and τ (the topology) is a collection of subsets of W that contains both ∅ and W , is closed under finite intersections (that is, if O, O ∈ τ then O ∩ O ∈ τ ) and closed under arbitrary unions (if {Oi }i∈I ∈ τ then i∈I Oi ∈ τ ). A topology τ such that τ = 2W is called discrete, and a topology such that τ = {∅, W } is called trivial. If (W, τ ) is a topological space and O ∈ τ then O is called an open set. If w is a point in an open set O, then O is called an open neighbourhood of w. A closed set is the complement of an open set. A topological model is a triple M = (W, τ, V ) where (W, τ ) is a topological space and V is a valuation (in the sense familiar from relational semantics). We interpret proposition symbols and booleans in the usual way, but what about the modalities? Boxed formulas are handled as follows: M, w |= 2ϕ iff (∃O ∈ τ )(w ∈ O and (∀u ∈ O)(M, u |= ϕ)). That is, 2ϕ is true at w iff it is true at all the points of some open neighbourhood of w. Diamonds are handled dually: M, w |= 3ϕ iff (∀O ∈ τ )(w ∈ O implies (∃u ∈ O)(M, u |= ϕ)). That is, 3ϕ is true at w iff it is true at some point in each open neighbourhood of w. At first blush, this looks very different from relational semantics. And there are some obvious semantic differences. For example, the characteristic axioms of S4, namely 2p → p and 2p → 22p, are valid on all topological models, so the minimal logic is stronger than in relational semantics. But a closer look reveals the similarities. For a start, like relational semantics, topological semantics is local: the truth value of a formula at a point only depends on what happens inside the open neighbourhoods of that point. More precisely, suppose that w is a point in a topological model M, and that O is an open neighbourhood of w. Let M|O be the model with domain O whose open sets are all the open subsets of O in M, and whose valuation is the restriction of the valuation V of M to O (that is V |O(p) = V (p) ∩ O). Then a simple induction shows that for all basic modal formula ϕ, and all points w ∈ O, M, w |= ϕ iff M|O, w |= ϕ. Nor is it hard to find other similarities. For example, the fact that S4 has the finite model property with respect to relational semantics is neatly matched by the fact that the basic modal language has the finite model property with respect to topological semantics. But the similarities run deeper than these examples might suggest. In particular, topological semantics gives rise to a natural notion of bisimulation: DEFINITION 56 (Topo-bisimulation). A topo-bisimulation between two topological models M = (W, τ, V ) and M = (W , τ , V ) is a non-empty binary relation E between their domains (that is, E ⊆ W × W ) such that whenever wEw we have that: Atomic harmony: w and w satisfy the same proposition symbols,
78
Patrick Blackburn and Johan van Benthem
Zig: if w ∈ O ∈ τ , then there is an open set O ∈ τ such that w ∈ O and (∀u ∈ O )(∃u ∈ O)(uEu ), and Zag: if w ∈ O ∈ τ , then there is an open set O ∈ τ such that w ∈ O and (∀u ∈ O)(∃u ∈ O )(uEu ). If there is a topo-bisimulation between two topological models M and N, then we say that M and N are topo-bisimilar. Moreover, we say that two states are topo-bisimilar if they are related by some topo-bisimulation. Let’s restate the zig clause informally: it says that for two points w and w to be topo-bisimilar, then for any open neighbourhood O of w it must be possible to find an open neighbourhood O of w such that every point u in O is topo-bisimilar to some u in O. Figure 23 illustrates this idea (the dotted line connecting u and u needs to be interpreted universally: every u is linked to some u).
Figure 23. Zig (and zag) for topo-bisimulations Such bisimulations are topologically natural. Two basic concepts of topology are open maps and continuous maps. For any topological spaces (W, τ ) and (W , τ ), a function f from W to W is called open if for all O ∈ τ we have that f (O) ∈ τ , and it is called continuous if for all O ∈ τ we have that f −1 (O ) ∈ τ . It is easy to see that every open and continuous map induces topo-bisimulations: given a valuation on one space, take its image in the other, and the resulting models are topo-bisimilar. But topo-bisimulations are also modally natural. For a start, we have the following analog of Lemma 9: LEMMA 57 (Topo-bisimulation Invariance Lemma). If E is a topo-bisimulation between M = (W, τ, V ) and M = (W , τ , V ), and wEw , then w and w satisfy the same basic modal formulas. Proof. A routine induction.
❑
As a simple illustration, we noted above that M and M|O (the localisation of M to some open set O) were equivalent. But this is unsurprising. The identity relation between the domains of the two models is a topo-bisimulation, hence the result is a special case of this lemma. What about the converse? Characterisation results for the general case are tricky to state (we would need to discuss what a suitable correspondence language for topological semantics is, and this would take us too far afield). But we do have an analog of Proposition 11:
Modal Logic: A Semantic Perspective
79
PROPOSITION 58. If points w and w from two finite topological models M and N satisfy the same modal formulas, then there is a topo-bisimulation E between M and N such that wEw . So far so good. But just how expressive is the basic modal language in the new setting? To pose the question a little more forcefully: what (interesting) topological conditions can the basic modal language enforce via the concept of validity? Here’s one example. The formula p ↔ 2p is valid on a topological model iff that model bears the discrete topology (that is, iff every subset of the domain is open). This is pleasant, but many fundamental properties lie beyond the reach of the basic language. For example, a topological space (W, τ ) is connected iff the only elements of τ that are both open and closed are W and ∅. But this condition is not basic modal definable. For suppose for the sake of a contradiction that some formula ϕ does define connectedness. Consider the topological space with domain {1, 2} under the discrete topology; this space is not connected as {1} and {2} are both open and closed. Hence we can define a model M on this space that will falsify ϕ at some point, say 1. But then M|{1} will falsify ϕ at 1 too, as M and M|{1} are topo-bisimilar. But M|{1} bears the trivial topology, hence it is a connected space, so it should validate ϕ. We conclude that connectedness is undefinable. All in all, the basic modal language turns out to be disappointingly weak when it comes to standard topological conditions. But then why stick with the basic modal language? As readers of this chapter are well aware, there are interesting ways of augmenting modal expressivity, and recently these have begun to be explored in the topological setting. For example, Shehtman [116] and Aiello and van Benthem [1] observe that connectivity becomes definable when the universal modality is added to the language: A(3p → 2p) → (Ap ∨ A¬p). And Gabelaia notes that the T0 condition (for any two points x and y there exists either an open / Ox or an open neighbourhood Oy of y such that x ∈ / Oy ) neighbourhood Ox of x such that y ∈ is definable in the basic hybrid language by @i ¬j → (@j 2¬i ∨ @i 2¬j), and that the T1 condition (every singleton set is closed) is definable by i ↔ 3i. Gabelaia [54] proves an analog of the Goldblatt-Thomason Theorem for the basic modal language with respect to topological semantics, and Sustretov [121] has extended the result to the basic hybrid language enriched with the universal modality. However Sustretov also shows that the T2 condition (every distinct pair of points is contained in disjoint open neighbourhoods) is not definable in this richer language. 8
MODAL LOGIC AND ITS CHANGING ENVIRONMENT
Traditional motivations for and applications of modal logic came from philosophy, and dealt with such topics as modality, knowledge, conditionals, and obligations. Other strands dealt with more mathematical topics, leading to modal logics of time, space, or provability. As time went by,
80
Patrick Blackburn and Johan van Benthem
additional influences made modal logic even more diverse. Sources included computer science (for modal logics of computation and general processes), Artificial Intelligence (for modal logics for knowledge representation, non-monotonic reasoning, and belief revision), linguistics (for modal logics of grammatical structure), and the internet (for modal logics of trees). This web of new interfaces is still growing. Modern computer science, with its emphasis on new information carriers and networks of intelligent computing agents, also brings in modal logics of image processing, agency and security. And the empirical social sciences are joining in too, witness current applications of modal logic in economic game theory, or for modeling the powers of agents in social choice theory. In the face of this diversity, the resilience of relational semantics is quite remarkable. Although nearly half a century old, its central ideas remain applicable, and applicable even when we enrich our conception of what a modal logic actually is. But what are the central ideas of relational semantics? In essence, this chapter has tried to make the following point clear: during the 50 or so years that relational semantics has existed, our understanding of it has become both broader and deeper. Originally conceived as a way of distinguishing and characterising logics (via soundness and completeness theorems) modal logicians have gradually unearthed the deeper mathematical themes that lie behind the seemingly modest facade of relational semantics; themes such as expressivity at the level of models versus the level of frames, the importance of bisimulation and other game-like constructions, the systematic links between the modal universe and many varieties of classical logic, ranging from first-order logic, through second-order logic, to the farther reaches of infinitary logic. Turning this perceived semantic unity into theorems is not always easy; work on combined modal logic still tends to be heavy on negative results, and firstorder modal logic remains difficult territory. But unifying themes, such as guarding, and the possibility of applying ideas from abstract model theory, have emerged. Indeed, we are tempted to conclude by playing devil’s advocate: even the alternative semantics we have encountered indicate that something semantically central lies at the heart of relational semantics. For example, the J´onsson-Tarski Theorem reveals that relational semantics has an important algebraic core, and our excursion to the land of topological semantics revealed the centrality of the concept of bisimulation. Prediction is always a dangerous game (especially when it is about the future) but we believe that the interplay between theory and practice that has characterised research on modal logic throughout its history will continue to deepen our understanding of its semantic core. And, forced to place our bets, we would probably say: modal logics of games (see Chapter 20 of this handbook) will be a deep source of further insight, as will the co-algebraic semantics (discussed in Chapter 6).
ACKNOWLEDGEMENTS We are extremely grateful to Carlos Areces for his painstaking editorial advice, to Aleksander Chagrov for his detailed list of corrections and recommendations, to Eric Kow for his patient work on the diagrams and formatting, to Sara Hobin for her meticulous proofreading and assistance with the cross-referencing, and to Dmitry Sustretov for checking Section 7. Special thanks to Daniel Gor´ın, Sergio Mera, Diego Figueira, and Santiago Figueira (the Buenos Aires crew) for giving the chapter its final trial.
Modal Logic: A Semantic Perspective
81
BIBLIOGRAPHY [1] M. Aiello and J. van Benthem. Logical patterns in space. In Words, Proofs and Diagrams, pages 5–25. CSLI Publications, 2002. [2] M. Aiello, J. van Benthem, and G. Bezhanishvili. Reasoning about space: The modal way. Journal of Logic and Computation, 13(6):889–929, 2003. [3] S. Akers. Binary decision diagrams. IEEE Transactions on Computers, C-27(6):509–516, 1978. [4] H. Andr´eka, I. Hodkinson, and I. N´emeti. Finite algebras of relations are representable on finite sets. Journal of Symbolic Logic, 64:243–267, 1999. [5] H. Andr´eka, J. van Benthem, and I. N´emeti. Modal languages and bounded fragments of predicate logic. Journal of Philosophical Logic, 27:217–274, 1998. [6] C. Areces, P. Blackburn, and M. Marx. Hybrid logics: Characterization, interpolation and complexity. Journal of Symbolic Logic, 66(3):977–1010, 2001. [7] C. Areces, P. Blackburn, and M. Marx. Repairing the interpolation theorem in quantified modal logic. Annals of Pure and Applied Logics, 123(1–3):287–299, 2003. [8] A. Baltag. STS: a structural theory of sets. In M. Zakharyaschev, K. Segerberg, M. de Rijke, and H. Wansing, editors, Advances in Modal Logic, Volume 2. CSLI Publications, 2000. [9] J. Barwise and S. Feferman. Model-Theoretic Logics. Springer, 1985. [10] J. Barwise and L. Moss. Vicious Circles. CSLI Publications, 1996. [11] J. Barwise and J. van Benthem. Interpolation, preservation, and pebble games. Journal of Symbolic Logic, 29:881– 903, 1999. [12] R. Berger. The undecidability of the domino problem. Memoirs of the American Mathematical Society, 66(72), 1966. [13] P. Blackburn, M. de Rijke, and Y. Venema. Modal Logic. Cambridge University Press, 2001. [14] P. Blackburn and M. Marx. Tableaux for quantified hybrid logic. In U. Egly and C. Fernm¨uller, editors, Automated Reasoning with Analytic Tableaux and Related Methods, International Conference, TABLEAUX 2002, Copenhagen, Denmark, July/August 2002, Proceedings, volume 2381 of LNAI, pages 38–52. Springer, 2002. [15] P. Blackburn and M. Marx. Constructive interpolation in hybrid logic. Journal of Symbolic Logic, 68(2):463–480, 2003. [16] W. Blok. The lattice of modal algebras: An algebraic investigation. Journal of Symbolic Logic, 45:221–236, 1980. [17] R. Bryant. Graph-based algorithms for boolean function manipulation. IEEE Transactions on Compilers, C-35(8), 1986. [18] J. Burch, J. Clarke, K. McMillan, D. Dill, and J. Hwang. Symbolic model checking: 1020 states and beyond. In IEEE Symposium on Logic in Computer Science, 1990. [19] J. Burgess. Quick completeness proofs for some logics of conditionals. Notre Dame Journal of Formal Logic, 22:76–84, 1979. [20] S. Buss. Bounded arithmetic and propositional proof complexity. In H. Schwichtenberg, editor, Logic and Computation, pages 67–122. Springer, 1997. [21] L. Chagrova. An undecidable problem in correspondence theory. Journal of Symbolic Logic, 56:1261–1272, 1991. [22] A. Chandra and P. Merlin. Optimal implementation of conjunctive queries in relational databases. In Proceedings 9th ACM STOC, pages 77–90, 1977. [23] C. Chang and H. Keisler. Model Theory. North-Holland Publishing Company, Amsterdam, 1973. [24] B. Chellas. Modal Logic, an Introduction. Cambridge University Press, 1980. [25] E. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, 1999. [26] G. Corsi and S. Ghilardi. Semantical aspects of quantified modal logic. In Knowledge, Belief, and Strategic Action, pages 167–195. Cambridge University Press, 1992. [27] M. Cresswell. Incompleteness and the Barcan formula. Journal of Philosophical Logic, 24:379–403, 1995. [28] G. De Giacomo and M. Lenzerini. TBox and ABox reasoning in expressive description logics. In L. Aiello, J. Doyle, and S. Shapiro, editors, KR’96: Principles of Knowledge Representation and Reasoning, pages 316–327. Morgan Kaufmann, San Francisco, California, 1996. [29] M. de Rijke. The modal logic of inequality. Journal of Symbolic Logic, 57(2):566–584, 1992. [30] M. de Rijke. Extending Modal Logic. PhD thesis, ILLC, University of Amsterdam, 1993. [31] M. de Rijke. A Lindstr¨om theorem for modal logic. In A. Ponse, M. de Rijke, and Y. Venema, editors, Modal Logic and Process Algebra: A Bisimulation Perspective, volume 53 of Lecture Notes, pages 217–230. CSLI Publications, 1995. [32] E. Dijkstra. A Discipline of Programming. Prentice Hall, 1976. [33] A. Dovier, C. Piazza, and A. Policriti. An efficient algorithm for computing bisimulation equivalence. Theoretical Computer Science, 311(1-3):221–256, 2004. [34] M. Dummett and E. Lemmon. Modal logics between S4 and S5. Zeitschrift f¨ur mathemathische Logik und Grundlagen der Mathematik, 5:250–264, 1959. [35] H. Ebbinghaus and J. Flum. Finite Model Theory. Perspectives in Mathematical Logic. Springer, 1995. [36] E. Emerson and R. Jutla. The complexity of tree automata and logics of programs. SIAM Journal on Computing, 29:132–158, 1999.
82
Patrick Blackburn and Johan van Benthem
[37] H. Enderton. A Mathematical Introduction to Logic. Academic Press, New York and London, second edition, 2001. [38] L. Esakia. Diagonal constructions, L¨ob’s formula, and Cantor’s scattered spaces. In Studies in Logic and Semantics, pages 128–143. Metsniereba, 1981. In Russian. [39] R. Fagin, J. Halpern, Y. Moses, and M. Vardi. Reasoning about Knowledge. The MIT Press, 1995. [40] S. Feferman. Persistent and invariant formulas for outer extensions. Compositio Mathematica, 20:29–52, 1968. [41] S. Feferman and Kreisel G. Persistent and invariant formulas relative to theories of higher order. Bulletin of the American Mathematical Society, 72:480–485, 1966. [42] K. Fine. Propositional quantifiers in modal logic. Theoria, 36:331–346, 1970. [43] K. Fine. An incomplete logic containing S4. Theoria, 40:23–29, 1974. [44] K. Fine. Some connections between elementary and modal logic. In S. Kanger, editor, Proceedings of the Third Scandinavian Logic Symposium. Uppsala 1973. North-Holland Publishing Company, 1975. [45] K. Fine. Failures of the interpolation lemma in quantified modal logic. Journal of Symbolic Logic, 42(2):201–206, 1979. [46] K. Fine and G. Schurz. Transfer theorems for stratified modal logics. In J. Copeland, editor, Logic and Reality, Essays in Pure and Logic. In memory of Arthur Prior, pages 169–213. Oxford University Press, 1996. [47] M. Fischer and R. Ladner. Propositional modal logic of programs. In Proceedings 9th ACM Symposium on Theory of Computation, pages 286–294, 1977. [48] M. Fischer and R. Ladner. Propositional dynamic logic of regular programs. Journal of Computer and System Sciences, 18:194–211, 1979. [49] M. Fitting and R. Mendelsohn. First-Order Modal Logic. Kluwer Academic Publishers, 1998. [50] N. Friedman and J. Halpern. On the complexity of conditional logic. In Proceedings of the 4th International Conference on Principles of Knowledge Representation (KR ’94), pages 202–213, 1994. [51] D. Gabbay. An irreflexivity lemma with applications to axiomatizations of conditions on linear frames. In U. M¨onnich, editor, Aspects of Philosophical Logic, pages 67–89. Reidel, 1981. [52] D. Gabbay, I. Hodkinson, and M. Reynolds. Temporal Logic: Mathematical Foundations and Computational Aspects. Oxford University Press, 1994. [53] D. Gabbay, A. Pnueli, S. Shelah, and J. Stavi. On the temporal analysis of fairness. In Proceedings 7th ACM Symposium on Principles of Programming Languages, pages 163–173, 1980. [54] D. Gabelaia. Modal definability in topology. Master’s thesis, University of Amsterdam, 2001. [55] P. G¨ardenfors and H. Rott. Belief revision. In D. Gabbay, C. Hogger, and J. Robinson, editors, Handbook of Logic in Artificial Intelligence and Logic Programming, number 4, pages 35–132. Clarendon Press, 1995. [56] S. Ghilardi. Incompleteness results in Kripke semantics. Journal of Symbolic Logic, 56:517–538, 1991. [57] R. Goldblatt. Metamathematics of modal logic I. Reports on Mathematical Logic, 6:41–78, 1976. [58] R. Goldblatt. Metamathematics of modal logic II. Reports on Mathematical Logic, 7:21–52, 1976. [59] R. Goldblatt. Mathematical modal logic: a view of its evolution. Journal of Applied Logic, 1:309–392, 2003. [60] R. Goldblatt and S. Thomason. Axiomatic classes in propositional modal logic. In J. Crossley, editor, Algebra and Logic, pages 163–173. Springer, 1974. [61] V. Goranko and S. Passy. Using the universal modality: Gains and questions. Journal of Logic and Computation, 2:5–30, 1992. [62] E. Gr¨adel. On the restraining power of guards. Journal of Symbolic Logic, 64:1719–1742, 1999. [63] E. Gr¨adel and I. Walukiewicz. Guarded Fixed Point Logic. In Proceedings of 14th IEEE Symposium on Logic in Computer Science LICS ‘99, Trento, pages 45–54, 1999. [64] J. Halpern and M. Vardi. The complexity of reasoning about knowledge and time, I: lower bounds. Journal of Computer and Systems Sciences, 38(1):195–237, 1989. [65] E. Hemaspaandra. The price of universality. Notre Dame Journal of Formal Logic, 37:174–203, 1996. [66] J. Hintikka. Knowledge and Belief. Cornell University Press, 1962. [67] C. Hoare. An axiomatic basis for computer programming. Communications of the ACM, 12:567–580, 1969. [68] I. Hodkinson. Loosely guarded fragment of first-order logic has the finite model property. Studia Logica, 70:205–240, 2002. [69] I. Hodkinson and M. Otto. Finite conformal hypergraph covers and Gaifman cliques in finite structures. Bulletin of Symbolic Logic, 9:387–405, 2003. [70] E. Hoogland and M. Marx. Interpolation and definability in guarded fragments. Studia Logica, 70:373–409, 2002. [71] E. Hoogland, M. Marx, and M. Otto. Beth definability for the guarded fragment. In H. Ganzinger, D. McAllester, and A. Voronkov, editors, Logic for Programming and Automated Reasoning, 6th International Conference LPAR99, Tbilisi, Georgia, volume 1705 of LNAI, pages 273–285. Springer, 1999. [72] M. Huth and M. Ryan. Logic in Computer Science. Cambridge University Press, 2nd edition, 1994. [73] D. Janin and I. Walukiewicz. On the expressive completeness of the propositional mu-calculus with respect to second order logic. In Proceedings CONCUR ’96, volume 1119 of Lecture Notes in Computer Science, pages 263–277. Springer, 1996. [74] B. J´onsson and A. Tarski. Boolean algebras with operators, Part I. American Journal of Mathematics, 73:891–939, 1952. [75] B. J´onsson and A. Tarski. Boolean algebras with operators, Part II. American Journal of Mathematics, 74:127–162, 1952.
Modal Logic: A Semantic Perspective
[76] [77] [78] [79] [80] [81] [82] [83] [84] [85] [86] [87] [88] [89] [90] [91] [92] [93] [94] [95] [96] [97] [98] [99] [100] [101] [102] [103] [104] [105] [106] [107] [108] [109] [110] [111] [112] [113] [114] [115]
83
H. Kamp. Tense Logic and the Theory of Linear Order. PhD thesis, University of California, Los Angeles, 1968. S. Kanger. The morning star paradox. Theoria, pages 1–11, 1957. S. Kanger. Provability in Logic. Almqvist & Wiksell, 1957. B. Knaster. Un th´eor`eme sur les fonctions d’ensembles. Annales de la Soci´et´e Polonaise de Math´ematiques, 6:133– 134, 1928. D. Kozen. Results on the propositional mu-calculus. Theoretical Computer Science, 27:333–354, 1983. D. Kozen and R. Parikh. A decision procedure for the propositional mu-calculus. In Proceedings of the 2nd Workshop on Logic of Programs, volume 164 of LNCS, pages 313–325. Springer, 1983. M. Kracht and F. Wolter. Properties of independently axiomatizable bimodal Logics. Journal of Symbolic Logic, 56:1469–1485, 1991. S. Kripke. A completeness theorem in modal logic. Journal of Symbolic Logic, 24:1–14, 1959. S. Kripke. Semantic analysis of modal logic I, normal propositional calculi. Zeitschrift f¨ur mathemathische Logik und Grundlagen der Mathematik, 9:67–96, 1963. S. Kripke. Semantical considerations on modal logic. Acta Philosophica Fennica, 16:83–94, 1963. S. Kripke. Naming and necessity. In Semantics of Natural Language. Reidel, 1972. N. Kurtonina and M. de Rijke. Bisimulations for temporal logic. Journal of Logic, Language and Information, 6:403–425, 1997. C. Lee. Representation of switching circuits by binary-decision programs. Bell System Technical Journal, 38:985– 999, 1959. A. L´evy. A Hierarchy of Formulas in Set Theory, volume 57 of Memoirs of the American Mathematical Society. 1965. D. Lewis. Counterfactuals. Blackwell, 1973. P. Lindstr¨om. On extensions of elementary logic. Theoria, 35:1–11, 1969. D. Makinson. Some embedding theorems for modal logic. Notre Dame Journal of Formal Logic, pages 252–254, 1971. M. Marx. Tolerance logic. Journal of Logic, Language and Information, 6:353–373, 2001. M. Marx and Y. Venema. Multidimensional Modal Logic, volume 4 of Applied Logic Series. Kluwer Academic Publishers, 1997. J. McKinsey and A. Tarski. The algebra of topology. Annals of Mathematics, 45:141–191, 1944. R. Montague. Pragmatics. In R. Klibansky, editor, Contemporary Philosophy: a Survey, pages 102–122. Florence, La Nuova Italia Editrice, 1968. R. Montague. Universal grammar. Theoria, 36:373–398, 1970. R. Moore. A formal theory of knowledge and action. In J. Hobbs and R. Moore, editors, Formal Theories of the Commonsense World, pages 319–358. Ablex, Norwood, New Jersey, 1985. M. Otto. Elementary proof of the van Benthem-Rosen characterisation theorem. Technical Report 2342, Fachbereich Mathematik, Technische Universit¨at Darmstadt, 2004. D. Park. Concurrency and automata on infinite sequences. In Proceedings 5th GI Conference, pages 167–183. Springer, 1981. S. Passy and T. Tinchev. An essay in combinatory dynamic logic. Information and Computation, 93(2):263–332, 1991. V. Pratt. Semantical considerations on Floyd-Hoare logic. In Proceedings 17th IEEE Symposium on Computer Science, pages 109–121, 1976. V. Pratt. Models of program logics. In Proceedings 20th IEEE Symposium on Foundations of Computer Science, pages 115–222, 1979. A. Prior. Past, Present and Future. Clarendon Press, Oxford, 1967. A. Prior. Papers on Time and Tense. Oxford University Press, New edition, 2003. Edited by Hasle, Øhrstrom, Bra¨uner, and Copeland. W. Quine. Three grades of modal involvement. In The Ways of Paradox and Other Essays, pages 156–174. Random House, 1953. M. Rabin. Decidability of second-order theories and automata on infinite trees. Transactions of the American Mathematical Society, 141:1–35, 1969. G. Restall. An Introduction to Substructural Logics. Routledge, 2000. E. Rosen. Modal logic over finite structures. Journal of Logic, Language and Information, 6:427–439, 1997. M. Ryan and P. Schobbens. Counterfactuals and updates as inverse modalities. Journal of Logic, Language and Information, 6:123–146, 1997. H. Sahlqvist. Completeness and correspondence in the first and second order semantics for modal logic. In S. Kanger, editor, Proceedings of the Third Scandinavian Logic Symposium. Uppsala 1973., pages 110–143. North-Holland Publishing Company, 1975. D. Scott. Advice on modal logic. In K. Lambert, editor, Philosophical Problems in Logic, pages 143–173. Reidel, 1970. K. Segerberg. An Essay in Classical Modal Logic. Filosofiska Studier 13. University of Uppsala, 1971. K. Segerberg. Two-dimensional modal logics. Journal of Philosophical Logic, 2:77–96, 1973. V. Shehtman. Modal logics of domains of the real plane. Studia Logica, 42:63–80, 1983.
84
Patrick Blackburn and Johan van Benthem
[116] V. Shehtman. “Everywhere” and “Here”. Journal of Applied Non-classical Logics, 9:369–380, 1999. [117] V. Shehtman and D. Skvortsov. Semantics of non-classical first-order predicate logics. In Mathematical Logic, pages 105–116. Plenum Press, New York, 1990. [118] E. Spaan. Complexity of Modal Logics. PhD thesis, ILLC, University of Amsterdam, 1993. [119] R. Street and E. Emerson. An automata theoretic decision procedure for the propositional mu-calculus. Information and Computation, 81:249–2644, 1989. [120] H. Sturm. The true bisimulations for ’since’ and ’until’. Logic and Logical Philosophy, 10:173–183, 2002. [121] D. Sustretov. Hybrid definability in topological spaces. Technical report, University of Amsterdam, 2005. ILLC Technical Report PP-2005-14. [122] A. Tarski. Der Aussagenkalk¨ul und die Topologie. Fund. Math., 31:103–134, 1938. [123] A. Tarski. A lattice-theoretical fixpoint theorem and its applications. Pacific Journal of Mathematics, 5:285–309, 1955. [124] B. ten Cate. Model Theory for Extended Modal Languages. PhD thesis, Institute for Logic, Language and Computation, University of Amsterdam, 2004. [125] S. Thomason. An incompleteness theorem in modal logic. Theoria, 40:150–158, 1974. [126] S. Thomason. Reduction of second-order logic to modal logic. Zeitschrift f¨ur mathemathische Logik und Grundlagen der Mathematik, 21:107–114, 1975. [127] A. Urquhart. Decidability and the finite model property. Journal of Philosophical Logic, 10:367–370, 1981. [128] J. van Benthem. Modal Correspondence Theory. PhD thesis, Mathematisch Instituut & Instituut voor Grondslagenonderzoek, University of Amsterdam, 1976. [129] J. van Benthem. Two simple incomplete modal logics. Theoria, 44:25–37, 1978. [130] J. van Benthem. Canonical modal logics and ultrafilter extensions. Journal of Symbolic Logic, 44:1–8, 1980. [131] J. van Benthem. Modal Logic and Classical Logic. Bibliopolis, 1983. [132] J. van Benthem. Beyond accessibility: Functional models for modal logic. In Diamonds and Defaults, pages 1–18. Kluwer, 1993. [133] J. van Benthem. Modal frame classes revisited. Fundamenta Informaticae, 18:307–317, 1993. [134] J. van Benthem. Bisimulation: the never ending story. In J. Tromp, editor, A dynamic and quick intellect. Liber Amicorum Paul Vit´anyi, pages 23–27. CWI Amsterdam, 1996. [135] J. van Benthem. Dynamic bits and pieces. Technical Report LP-97-01, Institute for Logic, Language and Computation, University of Amsterdam, 1997. [136] J. van Benthem. Modal foundations for predicate logic. Bulletin of the IGPL, 5(2):259–286, 1997. [137] J. van Benthem. Correspondence theory. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, 2nd Edition, number 3, pages 325–408. Kluwer Academic Publishers, 2001. [138] J. van Benthem. Minimal predicates, fixed points and definability. Journal of Symbolic Logic, 70:696–712, 2005. [139] J. van Benthem. A new modal Lindstr¨om theorem. Technical Report PP-2006-06, Institute for Logic, Language and Computation, University of Amsterdam, 2006. [140] M. Vardi. On the complexity of epistemic reasoning. In Proceedings 4th IEEE Symposium on Logic in Computer Science, pages 243–252, 1989. [141] M. Vardi. On the complexity of bounded variable queries. In Proceedings 14th ACM Symposium on Principles of Database Systems, pages 266–276. 1995. [142] M. Vardi. Why is modal logic so robustly decidable? In DIMACS Series in Discrete Mathematics and Theoretical Computer Science 31, pages 149–184. AMS, 1997. [143] F. Veltman. Logics for Conditionals. PhD thesis, University of Amsterdam, 1985. [144] F. Wolter. Fusions of modal logics revisited. In M. Kracht, M. de Rijke, H. Wansing, and M. Zakharyaschev, editors, Advances in Modal Logic, Volume 1, pages 361–369. CSLI Publications, 1998. [145] G. von Wright. An Essay in Modal Logic. North-Holland Publishing Company, 1951.
Handbook of Modal Logic – P. Blackburn et al. (Editors) © 2007 Elsevier B.V. All rights reserved.
2
MODAL PROOF THEORY Melvin Fitting
1 2
3 4 5
6
7 8
9 10 11 12 13
14
Introduction . . . . . . . . . . . . . . . . . . . . . . . Modal Axiomatics . . . . . . . . . . . . . . . . . . . 2.1 Normal Axiom Systems . . . . . . . . . . . . . 2.2 Soundness and Completeness . . . . . . . . . . 2.3 Difficulties, and GL . . . . . . . . . . . . . . . 2.4 Sahlqvist Formulas . . . . . . . . . . . . . . . Deduction, and the Deduction Theorem . . . . . . . Natural Deduction . . . . . . . . . . . . . . . . . . . 4.1 Classical Natural Deduction . . . . . . . . . . 4.2 Modal Natural Deduction . . . . . . . . . . . . Semantic Tableaus . . . . . . . . . . . . . . . . . . . 5.1 A Classical Tableau System . . . . . . . . . . 5.2 Destructive Modal Tableaus . . . . . . . . . . 5.3 Soundness and Completeness . . . . . . . . . . 5.4 The Logic GL . . . . . . . . . . . . . . . . . . 5.5 Tableau Remarks . . . . . . . . . . . . . . . . Prefixed Tableaus . . . . . . . . . . . . . . . . . . . . 6.1 A Prefixed System for K . . . . . . . . . . . . 6.2 Soundness and Completeness . . . . . . . . . . 6.3 Other Modal Logics . . . . . . . . . . . . . . . Gentzen Systems . . . . . . . . . . . . . . . . . . . . 7.1 Classical Propositional Sequents . . . . . . . . 7.2 Modal Propositional Sequents . . . . . . . . . Hypersequents . . . . . . . . . . . . . . . . . . . . . 8.1 Hypersequents for S5 . . . . . . . . . . . . . . 8.2 Examples . . . . . . . . . . . . . . . . . . . . . 8.3 Soundness and Completeness . . . . . . . . . . Logics of Knowledge . . . . . . . . . . . . . . . . . . 9.1 A Basic Logic of Knowledge . . . . . . . . . . 9.2 Common Knowledge . . . . . . . . . . . . . . Converse . . . . . . . . . . . . . . . . . . . . . . . . . The Universal Modality and the Difference Modality What Are the Limitations . . . . . . . . . . . . . . . Quantified Modal Logic . . . . . . . . . . . . . . . . 13.1 Syntax and Semantics . . . . . . . . . . . . . . 13.2 Constant Domain Tableaus . . . . . . . . . . . 13.3 Soundness and Completeness . . . . . . . . . . 13.4 Variations . . . . . . . . . . . . . . . . . . . . Conclusion . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
86 87 88 89 91 93 93 95 95 96 99 99 101 103 106 107 108 109 110 112 113 114 116 117 117 118 119 121 121 123 126 128 130 130 130 131 132 134 135
86
Melvin Fitting
1
INTRODUCTION
We have an interest in those modal formulas that are valid, relative to some suitable notion of validity. But verifying directly that a formula meets a validity condition is generally non-constructive. In part to get around this non-constructivity, formal proof procedures have been created, using a rich variety of mechanisms. A formal proof is a finitary certificate of validity for a formula, and a proof procedure is a specification of the requirements for being a proof. A proof procedure is sound if only valid formulas have proofs—we probably would say an unsound proof procedure is simply not a proof procedure. A proof procedure is complete if all valid formulas have proofs. For modal logics, historically, proof procedures preceded semantics, so the description above is a little anachronistic. But this is not an historical account, and anyway relational semantics is now well-developed, so let us continue as if history never happened. It will be helpful to settle some terminology first. We assume we have an infinite list of propositional letters, typically P , Q, . . . . Formulas are built up from these in the usual way. For the time being we take as primitive implication (⊃), falsehood (⊥), and necessity (), with negation defined by ¬X = (X ⊃ ⊥), truth by = ¬⊥, disjunction by (X ∨ Y ) = (¬X ⊃ Y ), conjunction by (X ∧ Y ) = ¬(X ⊃ ¬Y ), equivalence by (X ≡ Y ) = ((X ⊃ Y ) ∧ (Y ⊃ X)), and possibility by ♦X = ¬¬X. We’ll use X, Y , . . . for arbitrary formulas. A normal modal logic is a set of formulas L meeting the following conditions. First, L contains all tautologies and all instances of the formula (X ⊃ Y ) ⊃ (X ⊃ Y ). Second, L contains Y if it contains X and X ⊃ Y . Third, L contains X if it contains X. Fourth and finally, with each formula X, L also contains all substitution instances of X—the result of uniformly replacing propositional letters with more complex modal formulas. A large variety of formal proof procedures have been created over the years. No proof procedure suffices for every normal modal logic. Well then, what about semantically determined ones? Given any collection of frames, it is not hard to see that the set of formulas valid in all of them is a normal modal logic. No proof procedure suffices for every normal modal logic determined by a class of frames. Certain families of frames meeting special mathematical conditions determine normal logics that have had applications, and these have been given standard names—the same names are commonly used for the frame families and for the normal modal logics they determine. These normal logics tend to have proof procedures, though not every kind of proof procedure may be applicable, even to the most used of these logics. Table 1 shows the frame conditions that are most common in the literature. When traditional names are available I have employed them, but other naming conventions are in use as well. For instance, B is also known as KTB. In this chapter I will present several kinds of proof procedures, using the logics of Table 1 as examples. I will not attempt to say, for each proof procedure, exactly what range of logics it is good for. Such things are often difficult to determine. But some proof procedures apply to a fairly broad range of normal logics, others to a narrower range. Some provide proofs that humans find intuitively appealing, others are better for machine implementation. I merely wish to display something of the variety available.
Modal Proof Theory
Name K T K4 S4 KB B S5 D KD4
87
Frame Condition none reflexive transitive reflexive, transitive symmetric reflexive, symmetric reflexive, transitive, symmetric serial serial, transitive
Table 1. Some Frame Families for Normal Modal Logics
2
MODAL AXIOMATICS
Axiomatic proof procedures are perhaps the easiest to explain to people. Rules are simple to state and motivate. Candidates for proofs are easily checked for correctness. Unfortunately, axiomatic proofs are generally hard to discover. Today, when automatibility of proof procedures is an important concern, axiomatic systems receive increasingly short shrift. Nonetheless, axiomatic characterizations often make it relatively easy to compare modal logics, and knowing the axioms and rules for a logic supplies a special understanding, even if one does not spend much time constructing axiomatic proofs. And there are modal logics with axiom systems but no decent automatable proof procedures. Let us begin our discussion of proof procedures with axiom systems, then. An axiomatic proof is a sequence of formulas, each of which is from a specified collection, called axioms, or follows from earlier terms of the sequence by a rule of derivation. An axiomatic proof proves its last line, or equivalently, proves each of its lines. A proved formula is a theorem of the axiomatic system. Of course there is an effectiveness requirement—we should be able to tell whether a formula is an axiom or not, and whether a rule of inference is applicable or not. This will be obvious for the axiom systems considered here. Axiom systems differ from each other in the choice of axioms and rules of derivation. They also differ in which propositional connectives and modal operators are taken as primitive, but this is not a deep issue. Early modal axiom systems differed considerably from modern ones in their choices, but this is not an historical account. All current axiom systems for normal modal logics follow the style introduced in [31], so this will be the approach here. Axioms are particular formulas. It is common to specify them by giving axiom schemes. An axiom scheme is a pattern, and any formula matching that pattern is an axiom. When axiom schemes are used, typically a proof procedure will have a finite number of axiom schemes but an infinite number of axioms. An alternative method is to specify a finite number of axioms, and adopt substitution of formulas for propositional letters as an explicit rule of inference. This tends to be more complicated, and we will follow the axiom scheme approach.
88
Melvin Fitting
2.1 Normal Axiom Systems Ever since [31], modal axiom systems have been modular –whenever possible, systems build on other ones instead of starting over. In particular, modal axiom systems (usually) build on classical propositional logic. Since classical logic is well-understood, we can skip detailed consideration of it. Among our axioms will be the following. Classical Logic All tautologies, or at least enough of them to ensure the derivability of all the rest. In addition we will always assume we have the following axiom scheme. Normality Scheme All formulas of the form (X ⊃ Y ) ⊃ (X ⊃ Y ) And as rules of inference, there is the familiar modus ponens, plus the essentially modal necessitation rule, introduced by G¨ odel. Modus Ponens Conclude Y from X and X ⊃ Y Necessitation Conclude X from X The Rule of Necessitation requires some comment. It does not say X is necessary if it is true—it says X is necessary if it has a proof. The idea is, things that are provable are surely necessary—they must hold under all circumstances. It is standard to call the minimal axiom system in the sense above K, for Kripke—in fact it axiomatizes the normal modal logic K, as will be shown below. All other axiom systems we consider will be obtained by adding extra axioms to K. First examples of modal axiomatic proofs are almost always the same, so let us round up the usual suspects. To begin, (X ∧ Y ) ⊃ X is a theorem of K. Better said, any formula of this form is a theorem, but we won’t be so precise from now on. Here is a proof. 1. 2. 3. 4.
(X ∧ Y ) ⊃ X ((X ∧ Y ) ⊃ X) ((X ∧ Y ) ⊃ X) ⊃ ((X ∧ Y ) ⊃ X) (X ∧ Y ) ⊃ X
tautology from 1 by Necessitation Normality Scheme Modus Ponens on 2, 3
Having seen this, it should be easy for you to show that the following is a derived rule in the axiom system—that is, any proof making use of it can be expanded to a proper proof not using it. Regularity Conclude X ⊃ Y from X ⊃ Y With Regularity, it is trivial to show that (X ∧ Y ) ⊃ Y is a theorem, and consequently so is (X ∧ Y ) ⊃ (X ∧ Y ), using classical reasoning. Here is an abbreviated proof of the converse. We thus have (X ∧ Y ) ≡ (X ∧ Y ). 1. 2. 3. 4. 5.
X ⊃ (Y ⊃ (X ∧ Y )) X ⊃ (Y ⊃ (X ∧ Y )) (Y ⊃ (X ∧ Y )) ⊃ (Y ⊃ (X ∧ Y )) X ⊃ (Y ⊃ (X ∧ Y )) (X ∧ Y ) ⊃ (X ∧ Y )
tautology from 1 by Regularity Normality Scheme from 2 and 3 by classical logic from 4 by classical logic
Modal Proof Theory
89
Other common modal axiom systems are obtained by adding axiom schemes to K. The standard names for several of these schemes are given in Table 2. If scheme T , say, is added to K, we will call the resulting axiom system T , and similarly for the other cases. Name K T K4 S4 KB B S5 D KD4
Axiom Schemes no additional axioms X ⊃ X X ⊃ X T + K4 X ⊃ ♦X T + KB T + K4 + KB X ⊃ ♦X or ♦ D + K4
Table 2. Some Normal Modal Logics Incidentally, there is a whole class of modal logics called regular that are weaker than the normal modal logics. They are axiomatized by replacing the Necessitation Rule by the Regularity Rule. They too have a semantics, and the usual variety of proof procedures, but we will not be considering them further here—[19] has a treatment.
2.2
Soundness and Completeness
Suppose we have a normal modal logic that is characterized semantically, as the set of formulas valid in a certain class of frames. Let us call the modal logic L, the frames Lframes, and models based on them L-models. So, X ∈ L if and only if X is true at every possible world of every L-model. And suppose we have a candidate for an axiomatization of L: a collection of axiom schemes, L, which we add to the axiomatic system K. How might one show soundness and completeness for the axiomatization L, relative to the class of L-models? Soundness is generally a simple matter for axiom systems. One establishes that every line of a proof in L is valid in all L-models, and hence all theorems are valid. To do this it is enough to show all axioms are valid, and the rules preserve validity. That the rules of L (that is, of K) preserve validity is immediate. The Rule of Necessitation corresponds directly to one of the conditions for a normal modal logic, and Modus Ponens to another. All that is left is to verify the validity of the axioms. And clearly, all tautologies, and instances of the Normality Scheme, are valid in every model—this is simple to check. So soundness comes down to the following straightforward issue: is it the case that all instances of L axiom schemes are valid in L-frames? It is easily checked that instances of scheme T are valid in T-frames, instances of K4 are valid in K4-frames, and so on. This kind of thing gives all the ‘standard’ soundness results—in particular, for all the axiomatic systems of Table 2 with respect to the corresponding frame classes of Table 1. Completeness is more work—sometimes much more—but often the method of canonical models works uniformly and well. Suppose, as above, that L is a set of axiom schemes. We construct the canonical model M for L.
90
Melvin Fitting
Call a set S of formulas L-inconsistent if there is a finite subset {X1 , . . . , Xn } of S such that (X1 ∧ . . . ∧ Xn ) ⊃ ⊥ is a theorem of L. Call S L-consistent if it is not Linconsistent, and maximally L-consistent if it is L-consistent and has no proper extension that is L-consistent. Lindenbaum’s Lemma applies, in the usual way, to say that every L-consistent set has a maximal L-consistent extension. Since the proof of Lindenbaum’s Lemma is by a construction that will come up several times, in various forms, let me remind you of how it goes. Lindenbaum Construction Suppose S is L-consistent. Enumerate the (countably many) formulas of the language, Z1 , Z2 , . . . , and define the following sequence of sets. S1 = S (1) Sn ∪ {Zn } if L-consistent Sn+1 = otherwise Sn One then shows that S1 ⊆ S2 ⊆ S3 ⊆ . . ., each Sn is L-consistent, ∪n Sn is Lconsistent, and ∪n Sn is maximally L-consistent. In fact, this construction is more general than it would first seem. Say a collection C of sets is of finite character provided S ∈ C if and only if every finite subset of S is in C. (It is immediate from the definition above that the collection of L-consistent sets is of finite character.) The Lindenbaum construction can easily be adapted to show: if S ∈ C and C is of finite character, then S can be extended to a maximal member of C. This observation makes things a little easier for us later on. Now, let M = W, R, V be the model constructed as follows. G is the set of all maximally L-consistent sets of formulas. For w, w ∈ G, wRw provided {X | X ∈ w} ⊆ w . And finally, w ∈ V(P ) provided P ∈ w. This is the canonical model for L. The chief fact concerning it is the so-called Truth Lemma: for every formula X and possible world w ∈ G X ∈ w if and only if M, w X
(2)
The Truth Lemma is proved by induction on the degree of X. The atomic case is by definition, and the propositional connective cases are straightforward. Here is a sketch of the modal case. We wish to show (2) is true for Z under the assumption that it holds for simpler formulas, in particular, for Z. Half is simple. Suppose Z ∈ w, and let w be an arbitrary world such that wRw . By definition of R, Z ∈ w ; by the induction hypothesis, M, w Z; so since w was arbitrary, M, w Z. The other direction requires more work. Suppose Z ∈ w. Consider the set S = {X | X ∈ w} ∪ {¬Z}. This is L-consistent, because if not, there would be a finite subset {X1 , . . . , Xn } of w such that 1. 2. 3. 4.
(X1 ∧ . . . ∧ Xn ∧ ¬Z) ⊃ ⊥ (X1 ∧ . . . ∧ Xn ) ⊃ Z (X1 ∧ . . . ∧ Xn ) ⊃ Z (X1 ∧ . . . ∧ Xn ) ⊃ Z
definition of inconsistent by classical reasoning from 1 Regularity on 2 using results shown earlier
But each Xi ∈ w, and it follows from the maximal L-consistency of w that Z ∈ w, which is a contradiction. Thus we know that S is L-consistent. Extend it to a maximal
Modal Proof Theory
91
L-consistent set w . By definition, w ∈ G and clearly wRw . And ¬Z ∈ w so Z ∈ w and by the induction hypothesis, M, w Z, hence M, w Z. With the Truth Lemma established, it follows that the canonical model is a universal counter-model for L—it provides counterexamples for all non-theorems of L. For, suppose X is not a theorem of axiom system L. Then {¬X} is L-consistent, and so can be extended to a maximal L-consistent set w. w is a world of the canonical model and, since X ∈ w, by the Truth Lemma, M, w X. If the canonical model for L happens to be an L-model, this establishes completeness since, if X is not a theorem of L, there is an L-model in which X fails—the canonical one. Since K imposes no conditions on frames, we now have the completeness of axiom system K relative to K. As a matter of fact, the canonical model for T is a T-model, for K4 is a K4-model, and so on for the various entries in Tables 1 and 2. Here is a sketch of the verification for one case—K4. Let M = G, R, V be the canonical model for K4—I’ll show it is transitive. Well, suppose w1 , w2 , w3 ∈ G and w1 Rw2 and w2 Rw3 . And say X ∈ w1 . Since X ⊃ X is an axiom of K4, and possible worlds of the canonical model are maximally consistent, hence deductively closed, it follows that X ∈ w1 . By definition of R in the canonical model, X ∈ w2 , and hence X ∈ w3 . It has been shown that {X | X ∈ w1 } ⊆ w3 , so w1 Rw3 , and thus we have transitivity. I’ll leave it to you to check the other cases. Thus in one construction we have completeness for a large class of axiom systems, relative to a large class of frame families.
2.3
Difficulties, and GL
One should not go away with the impression that canonical models solve all problems. There are standard axiomatically formulated logics for which completeness results can be proved relative to a class of frames, but not by a direct canonical model technique. A simple example is the well-known provability logic GL, axiomatized by adding the GL schema (X ⊃ X) ⊃ X to K4 (or equivalently, to K, though this takes some work to show). See [8, 9, 56] for the full story. GL is sound and complete with respect to two different classes of frames. One class, call it GLw , consists of transitive, well-founded frames—well-founded frames are those in which there are no infinite sequences of worlds w1 , w2 , w3 , . . . , with wi Rwi+1 . (Technically, it is the relation that is converse to R that is well-founded, but we can ignore the point here.) The other class, call it GLf , consists of frames that are transitive, irreflexive, and finite. For applications to arithmetic the class GLf is the more interesting, but clearly one cannot prove completeness of GL with respect to GLf using canonical models for the simple reason that a canonical model is infinite, and hence not a member of the designated class of frames. In this section I’ll briefly sketch how the logic can be handled axiomatically. We will see it again after tableaus have been introduced. Every GLf frame is also a GLw frame, so a soundness proof with respect to GLw establishes soundness with respect to both. And for this it is enough to show all instances of the schema (X ⊃ X) ⊃ X are valid in GLw frames. Well, suppose we had a model M = G, R, V , based on a GLw frame, and a possible world w1 of it, such that M, w1 (P ⊃ P ) but M, w1 P . By the latter, there must be a world w2 with w1 Rw2 and M, w2 P . Of course we also have M, w2 P ⊃ P . It follows that M, w2 P . Hence there exists a world w3 with w2 Rw3 and M, w3 P . Since R is transitive, M, w3 P ⊃ P . It follows that M, w3 P . So we can repeat the
92
Melvin Fitting
argument, getting a world w4 accessible from w3 , at which we have M, w4 P and M, w4 P ⊃ P , and so on. This contradicts well-foundedness of the frame. Hence there can be no such model M, so (P ⊃ P ) ⊃ P must be valid in all GLw frames. Once again, every GLf frame is also a GLw frame, so a completeness proof with respect to GLf will show completeness with respect to both. As noted above, a canonical model construction cannot work. But something not radically different from it does. Let Z be a formula that is not provable—I will construct a GLf model, MZ , that invalidates it. Define sub(Z) to be the set of all subformulas of Z, and negations of subformulas of Z—a finite set. Now, let GZ be the collection of all maximally GL-consistent subsets of sub(Z)—again a finite set. It is easy to see that any GL-consistent subset of sub(Z) can be extended to a maximal such set. Next I’ll define an auxiliary relation (used shortly to define the actual accessibility relation): for w, w ∈ GZ , set wR0 w if {X, X | X ∈ w} ⊆ w . Now, here is the real thing: for w, w ∈ GZ , set wRZ w if wR0 w but not w R0 w. Finally, let w ∈ VZ (P ) provided P ∈ w. We thus have our model MZ = GZ , RZ , VZ . It is obvious that GZ is finite. It is equally obvious that RZ is irreflexive. If we had that RZ was transitive, we would know that MZ was a GLf model. In fact, this is the case, but for readability I’ll give the argument in a separate paragraph. Suppose w1 RZ w2 and w2 RZ w3 ; I’ll show w1 RZ w3 . I’ll leave the key step to you: show that R0 is transitive. Given this, we must have w1 R0 w3 , since we have w1 R0 w2 and w2 R0 w3 , and R0 is transitive. If we had w3 R0 w1 , since we have w1 R0 w2 and R0 is transitive, we would have w3 R0 w2 , and we do not. Thus we do not have w3 R0 w1 . It follows that w1 RZ w3 . Thus MZ is an GLf model. To show it is a counter-model to Z we need an analog of the Truth Lemma stated earlier as (2). The original version must be replaced with the following For X ∈ sub(Z), X ∈ w if and only if MZ , w X
(3)
The proof of (3) is almost the same as that of (2), by induction on the complexity of X. I’ll just give one step, but it is the most significant one. Suppose that (3) is known / w. I’ll show MZ , w X. for the formula X, w ∈ GZ , X ∈ sub(Z), and X ∈ We are assuming X ∈ / w. Let S be the set {Y, Y | Y ∈ w} ∪ {X, ¬X}. This is GL-consistent, because if not, there would be a finite subset {Y1 , . . . , Yn } of w such that 1. (Y1 ∧ . . . ∧ Yn ∧ Y1 ∧ . . . ∧ Yn ∧ X ∧ ¬X) ⊃ ⊥ definition of inconsistent 2. (Y1 ∧ . . . ∧ Yn ∧ Y1 ∧ . . . ∧ Yn ) ⊃ (X ⊃ X) by classical reasoning from 1 3. (Y1 ∧ . . . ∧ Yn ∧ Y1 ∧ . . . ∧ Yn ) ⊃ (X ⊃ X) Regularity on 2 4. (Y1 ∧ . . . ∧ Yn ∧ Y1 ∧ . . . ∧ Yn ) ⊃ (X ⊃ X) distributing over ∧ (Section 2.1) 5. (Y1 ∧ . . . ∧ Yn ) ⊃ (X ⊃ X) using the K4 axiom 6. (Y1 ∧ . . . ∧ Yn ) ⊃ X using the GL axiom
Modal Proof Theory
93
But each Yi ∈ w, and so X ∈ w, a contradiction. Thus we know that S is GLconsistent. Extend it to a maximal GL-consistent subset w of sub(Z). By definition, w ∈ GZ . Also by definition, wR0 w . And we do not have w R0 w since X ∈ w but X ∈ / w. Thus wRZ w . And ¬X ∈ w so X ∈ w and by the induction hypothesis, MZ , w X, hence MZ , w X. With (3) established, there must be a possible world in the model M at which the unprovable formula Z is false (a maximal consistent extension of {¬Z}). Thus we have completeness. A canonical model is a universal counter-model—it invalidates all unprovable formulas. The present construction, while very similar, does not produce any such thing. Each formula, Z, is invalidated in a counter-model, MZ , of its own. The construction above makes use of a variant of a technique known as filtration. A more standard version would begin by constructing a model in which worlds are maximal consistent sets, in the usual sense, and then identifying those worlds that agree on the subformulas of Z. This is one technique among many for constructing models when the canonical construction does not work. These constructions are often ingenious, often intricate, and beyond the scope of the present chapter.
2.4 Sahlqvist Formulas Though canonical models do not solve all completeness problems, they do for the logics considered in Section 2.2. One naturally wonders what these logics have in common that makes them so nice. In [54] a remarkable answer to this question was given—see [6] for an insightful, elegant treatment. Sahlqvist defined syntactically a class of modal formulas having two important properties. First, there is an algorithm (Sahlqvist-van Benthem) for associating with each formula of the class a first-order condition on frames. These frames will validate the corresponding modal formulas. And second, the canonical model for a logic axiomatized by Sahlqvist formulas will satisfy the first-order conditions determined by the formulas. Thus, the canonical model technique must work for modal logics whose axioms are Sahlqvist formulas. All formulas in Table 2 are Sahlqvist formulas, and the frame conditions they determine using the Sahlqvist-van Benthem algorithm are those in Table 1. On the other hand, the GL scheme, (X ⊃ X) ⊃ X is not Sahlqvist, the frame classes GLf and GLw are not first-order definable, and canonical models do not work. A full discussion of the fundamental Sahlqvist results (and their limitations) can be found elsewhere in this book, in Chapters 1 and 7, so I will say no more about them here.
3 DEDUCTION, AND THE DEDUCTION THEOREM In many logics (classical logic is the classical example) one introduces a notion of derivation, or deduction, or consequence—besides what is provable, what follows from what. Typically, Y follows from a set S of formulas, premises, in some axiomatic system if Y becomes provable when members of S are added to the system’s axioms. Then one connects deduction and provability by showing a deduction theorem: Y is a consequence of the set S ∪ {X} if and only if X ⊃ Y is a consequence of S. Taking S to be empty we have the important special case: Y has a derivation from X if and only if X ⊃ Y follows
94
Melvin Fitting
from ∅, that is, if and only if X ⊃ Y is a theorem of the original axiomatic system. This is an important tool, both theoretically and practically, because it allows us to prove an implication X ⊃ Y by carrying out a derivation, of Y from X, and such a derivation is often easier to discover since we have more material to work with, namely we have X. Modal logic raises problems for the notion of deduction. Suppose we want to show X ⊃ Y in some modal axiom system by deriving Y from X. So we add X to our axioms. Say, to make things both concrete and intuitive, that X is “it is raining” and Y is “it is necessarily raining.” Since X has been added to the axiom list the necessitation rule applies, and from X we conclude X, that is, Y . Then the deduction theorem would allow us to conclude that if it is raining, it is necessarily raining. This does not seem right—nothing would ever be contingent. On the other hand, if we are working in the modal logic K, and we want to see what happens if we strengthen it to T by adding all instances of the scheme X ⊃ X, we certainly want the necessitation rule to apply to these instances. Things are not simple. In the examples above, instances of the axiom scheme X ⊃ X are clearly intended to be understood as logical truths, and we would expect the necessitation rule to apply to them. But “it is raining” is a contingent truth, and necessitation should not apply. In modal logics, a proper notion of deduction must allow two kinds of premises, global , to which the necessitation rule applies, and local , to which it does not. The following definition is from [21]. DEFINITION 1. Let L be a set of axiom schemes for a normal modal logic—extending K. Let S and U be sets of formulas (not schemes) and X be a single formula (also not a scheme). The formula X is deducible from the set S of global premises and the set U of local premises in L if there is a sequence of formulas ending with X, consisting of a global part, coming first, and a local part, coming last. In the global part each formula is an instance of a member of L, a member of S, or follows from earlier formulas by modus ponens or necessitation. In the local part each formula is an instance of a member of L, a member of U , or follows from earlier formulas by modus ponens (necessitation is not allowed in this part). If X is so deducible, this is symbolized by S L U → X. The working content of the definition above is simple: in an axiomatic derivation of X in L one can proceed as one does in a proof, using members of S and U as additional axioms, except that once we start using members of U , the necessitation rule can no longer be applied. Since we have two kinds of premises, we have two versions of the deduction theorem. Here they are. THEOREM 2 (Deduction). Let S and U be sets of formulas, X and Y be single formulas, and L be a set of axiom schemes extending K. 1. S L U ∪ {X} → Y if and only if S L U → (X ⊃ Y ). 2. S ∪ {X} L U → Y if and only if S L U ∪ {X, X, 2 X, 3 X, . . . } → Y . The proof of the theorem above is a variation on that of the classical deduction theorem. I’ll omit it here. The significant thing is that there are two versions. In reading the literature in modal logic it is important to notice, when an author talks of deduction, whether the premises are local or global. Both versions appear, often without the local/global qualification, and this can lead to some confusion.
Modal Proof Theory
95
There is a semantic counterpart of the local/global distinction, which accounts for the terminology. DEFINITION 3. Let L be a family of frames, thus characterizing a normal modal logic. Let S and U be sets of formulas (not schemes) and X be a single formula (also not a scheme). The formula X is a semantic consequence of the set S of global premises and the set U of local premises in L provided, for every L-model M in which all members of S are valid (true at every possible world), for each possible world w of M at which all members of U are true, X is true. This is symbolized by S |=L U → X. In Section 2.2 soundness and completeness issues were discussed. There is a more general notion, taking deduction into account. DEFINITION 4. Let L be a set of axiom schemes, extending K, and let L be a class of frames. L is strongly complete (and sound) with respect to L provided, for all sets S and U of formulas, and for all formulas X: S L U → X ⇐⇒ S |=L U → X. Completeness arguments using canonical models tend to actually establish strong completeness. This is the case for all the axiom systems of Table 2 relative to the corresponding classes of frames in Table 1. It is not always so straightforward, however. In Section 2.3 I mentioned axiomatically formulated GL, and a corresponding class of frames GL. This is an instance where completeness, but not strong completeness is the case. Strong completeness cannot be taken for granted. 4 NATURAL DEDUCTION Someone once said that in mathematics every important theorem eventually becomes a definition. Well, the Deduction Theorem is sufficiently important that proof systems have been created with it as part of the basic machinery, rather than being a derived rule. Such systems are called natural deduction systems, and were originally introduced by Gentzen, [29], and Jaskowski, [40]. Prawitz wrote a classic study of these systems, [52]. Modal versions have been introduced, with those of Fitch being the best-known [16, 55]. Here I’ll briefly sketch a classical and several modal natural deduction systems.
4.1 Classical Natural Deduction Recall that our basic classical connectives are ⊃ and ⊥, with other connectives taken as defined. In particular, ¬X is X ⊃ ⊥. I’ll only give rules for these, though rules for other connectives can be introduced. In a natural deduction proof, assumptions are made, then eventually these assumptions are discharged using a principle like that embodied in the Deduction Theorem. Parts of proofs involving assumption, reasoning, and assumption discharge are called subordinate proofs, and are characteristic of natural deduction systems. Notation differs for indicating a subordinate proof. I’ll enclose it in a box. The rules are given in Table 3. There is some variety to what is called a natural deduction system in the literature. Sometimes proofs have a tree structure, as in [52]. Here natural deduction proofs are Fitch-style, [17], in which a proof is a sequence of formulas, as in axiom systems. In
96
Melvin Fitting
.. . X .. . X .. .
X X⊃Y Y
Y X⊃Y Discharge
Modus Ponens
.. . X .. . Repetition
¬X .. . ⊥ X Negation
Table 3. Classical Natural Deduction Rules addition, subordinate proofs can be started at any point—parts of a proof might be boxed, and boxes can be nested, but they cannot overlap. The first formula in a box is understood to be an assumption—a premise. Then the Discharge rule in Table 3 incorporates the principle of the Deduction Theorem: having assumed X as a premise, and having deduced Y , the premise X can be discharged and X ⊃ Y concluded. Premise discharge is symbolized by closing off a box, thus ending a subordinate proof. Before explaining the other rules, one more notion is needed. I’ll say that in a proof, two formulas, or a formula and a box, are at the same level if they are inside the same (nested) boxes. Modus Ponens, in Table 3, can only be applied if X and X ⊃ Y are at the same level (though the order of the two formulas does not matter). Likewise in the Repetition rule, the upper occurrence of X must be at the same level as the box into which X is shown being repeated. A formula is a theorem of this natural deduction system if it is the last line of a proof and does not occur inside a box. Figure 1 contains an example of a simple classical proof, in this system, of (¬Q ⊃ P ) ⊃ ((¬Q ⊃ ¬P ) ⊃ Q). In this, 1, 2, and 4 are premises; 3 is from 1 by Repetition; 5 is from 2 by Repetition; 6 is from 4 and 5 by Modus Ponens; 6 is just 6 unabbreviated; 7 is from 3 by Repetition; 8 is from 4 and 7 by Modus Ponens; 9 is from 6’ and 8 by Modus Ponens; 10 is by Negation; 11 and 12 are by Discharge. If we drop the Negation rule, exactly intuitionistic implication is captured. If Negation is replaced by a rule allowing us to conclude X from ⊥, this gives us intuitionistic negation. Other intuitionistic connectives can be captured as well, but this is too far afield for present purposes. Also, various derived rules will probably have occurred to you—for instance, Repetition can involve deeply nested boxes, instead of just going ‘one box in.’ Conditions were stated as they were to allow the easy addition of modal rules. I’ll leave simplifications to you.
4.2
Modal Natural Deduction
Recall that whether or not the necessitation rule applied to premises in an axiomatic deduction led us to distinguish between two kinds of premises, local and global. A similar point comes up with natural deduction proofs, and we are led to create two kinds of subordinate proofs. One kind is as before, and follows the standard rules. The other kind is called a strict subordinate proof. I will symbolize it by enclosing it in a double-walled box. Think of a strict subordinate proof as an argument taking place in
Modal Proof Theory
97
1. ¬Q ⊃ P 2. ¬Q ⊃ ¬P 3. ¬Q ⊃ P 4. 5. 6. 6 . 7. 8. 9.
¬Q ¬Q ⊃ ¬P ¬P P ⊃⊥ ¬Q ⊃ P P ⊥
10. Q 11. (¬Q ⊃ ¬P ) ⊃ Q 12. (¬Q ⊃ P ) ⊃ ((¬Q ⊃ ¬P ) ⊃ Q) Figure 1. Classical Natural Deduction Proof an arbitrary alternative world. Equivalently, think of it as an argument taking place within the scope of a necessitation operator. A strict subordinate proof does not have an initial premise, as ordinary subordinate proofs do, and one can be started at any point. Whatever is shown in a strict subordinate proof has actually had its necessity established, consequently the Discharge rule is different. The Repetition rule is also different, since strict subordinate proofs involve alternative worlds. The basic rules are in Table 4. .. . X .. . .. . X .. .
Y
Strict Repetition
Strict Discharge
.. . Y
Table 4. Modal Natural Deduction Rules for K An example of a proof using the classical and the modal natural deduction rules can be found in Figure 2. It is a proof of (X ⊃ Y ) ⊃ (X ⊃ Y ). In it, 1 and 2 are premises; 3 is by Repetition from 1; then a strict subordinate proof is started; 4 and 5 are from 2 and 3 by Strict Repetition; 6 is from 4 and 5 by Modus Ponens; 7 is from 6 by Strict Discharge; 8 is by Discharge; and 9 is by Discharge. The logic captured by these rules is K. Certain other logics can also be treated this way, by suitable additions to the rules. In fact the underlying idea serves us as a lead-in to other proof procedures, starting in the next section. I’ll give rules for some, but not
98
Melvin Fitting
1. (X ⊃ Y ) 2. X 3. (X ⊃ Y ) 4. X 5. X ⊃ Y 6. Y 7. Y 8. X ⊃ Y 9. (X ⊃ Y ) ⊃ (X ⊃ Y ) Figure 2. Modal Natural Deduction Proof all of the logics from Table 1—treatments of other logics can be found in [10, 17, 55]. If S is a set of formulas, I define a set S in a logic-dependent way, in Table 5. The motivation is, if all members of S are true at a possible world of an L model, all members of S will be true at any alternative world, for L being any of the logics listed in Table 5. Logic K, T, D K4, S4, KD4 KB, B, S5
S {X | X ∈ S} {X | X ∈ S} ∪ {X | X ∈ S} {X | X ∈ S} ∪ {X | X ∈ S} ∪ {¬¬X | X ∈ S} Table 5. Definition of S
For each of the logics covered in Table 5, the Strict Repetition rule of Table 4 should be replaced by the following. Note that the new rule for K coincides with the one stated in Table 4. Strict Repetition Rule If S is the set of formulas in a proof, that are above a strict subordinate proof, and at the same level as it, any member of S can be entered into the strict subordinate proof. For K, K4, and KB, the rules given so far are complete. For T, B, S4, and S5, we add a rule allowing us to infer X from X. and for D and KD4, we instead add a rule allowing us to infer ¬¬X from X. Figure 3 displays a proof using the rules for K4. In it, 1 and 2 are premises; 3 is from 1 by Repetition; 4 is from 2 and 5 is from 3 by Strict Repetition; 6 is from 4 and 7 is from 5 by Strict Repetition; 8 is from 6 and 7 by Modus Ponens; 9 is from 8 by Strict Discharge, as is 10 from 9; 11 is by Discharge, as is 12. Completeness is easy to show. Begin by giving natural deduction proofs of all (appropriate) axioms. Modus Ponens is one of the rules. And it is easy to show that theorems are closed under a Necessitation Rule (carry out a proof of X inside a strict box, and conclude X outside it). Then natural deduction completeness follows from axiomatic completeness. Soundness is a bit more work; see [19] for details.
Modal Proof Theory
99
1. (X ⊃ Y ) 2. X 3. (X ⊃ Y ) 4. X 5. (X ⊃ Y ) 6. X 7. X ⊃ Y 8. Y 9. Y 10. Y 11. X ⊃ Y 12. (X ⊃ Y ) ⊃ (X ⊃ Y ) Figure 3. K4 Natural Deduction Proof While I have been discussing proofs, these natural deduction systems encompass derivations as well. A local premise can be added to a derivation provided it is not added inside a strict subderivation. A global premise can be added at any point, even inside a strict subderivation. Then soundness and strong completeness can be shown for the logics of Table 5. 5 SEMANTIC TABLEAUS Both axiom systems and natural deduction are forward reasoning systems. One starts with axioms and rules, and finishes with the desired theorem. Such systems, while elegant, are often difficult for proof discovery, and are not good candidates for automation. Various backward reasoning systems have been invented. These begin with the desired result and work backward from there to create a proof. For classical logic, resolution is such a system—it was designed for machine implementation, and over the years has been the basis for very efficient classical theorem provers, [22, 43]. However, resolution does not tend to adapt well to non-classical logics (though see [20]). Semantic tableaus, or tableaus for short, were introduced in [5], and took on their current form independently in [44] and [57]. They too have also had successful computer implementations, and have turned out to be more flexible than resolution in adapting to a rich variety of logics. A very thorough presentation of tableaus can be found in [11]. This section presents tableau systems for several propositional modal logics, but naturally, I’ll begin classically.
5.1 A Classical Tableau System Tableaus can be developed using signed or unsigned formulas. I’ll present a signed version, and briefly discuss an unsigned one afterward. A signed formula is simply T X or F X, where X is a formula. Intuitively, these signed formulas assert that X is true or false respectively, in some context. One begins a proof search with F X, and
100
Melvin Fitting
attempts to produce a contradiction, thus showing that X cannot be false under any circumstances. Tableaus take the form of trees, customarily written with the root at the top, and branching downward. Intuitively, each branch represents one ‘case.’ There are rules for “growing” trees—one for each connective and sign. For axiom systems it was convenient to have a small number of connectives, with others defined from them. There is no corresponding advantage for tableaus, so I’ll take ¬, ∧, ∨, and ⊃ as primitive from now on, and also (truth constant) as well as ⊥ (falsehood constant). However, ≡ is still best thought of as a defined connective. ‘Tree growing’ rules involving negation are straightforward, and are given in Table 6. For each, if the signed formula above the line occurs (anywhere) on a tableau branch, the signed formula below can be added to the branch end. Rules for the binary connectives come in groups, and I’ll make use of Smullyan’s unifying notation here [57]. Table 7 defines what are called alpha and beta signed formulas and for each, two components. Using this, the binary connective rules are summarized in Table 8. These rules say: if an alpha formula occurs on a branch, its two components can be added successively to the branch end; if a beta formula occurs, the branch can be split, with one component added to each of the new branch ends. F ¬X TX
T ¬X FX
Table 6. Negation Rules
α T X ∧Y F X ∨Y FX⊃Y
α1 TX FX TX
β T X ∨Y F X ∧Y TX⊃Y
α2 TY FY FY
β1 TX FX FX
β2 TY FY TY
Table 7. Alpha and Beta Formulas
α α1 α2
β1
β |
β2
Table 8. Alpha and Beta Rules
Figure 4 contains an example of a tree, constructed by starting with the signed formula F ¬(X ∧ Y ) ⊃ (¬X ∨ ¬Y ). In it, 2 and 3 are from 1 by α; 4 is from 2 by negation; 5 and 6 are from 4 by β, 7 and 8 are from 3 by α, just as 9 and 10 are, on the right branch; 11 is from 7 by negation; 12 is from 10 by negation. Not every applicable rule has been used—neither 8 nor 9 has had a negation rule applied to it. A tableau branch is called closed if it contains T Z and F Z for some formula Z, or if it contains F , or T ⊥. A tableau is closed if every branch is closed. Intuitively, a closed branch represents an impossible situation, and a closed tableau tells us that every
Modal Proof Theory
F ¬(X ∧ Y ) ⊃ (¬X ∨ ¬Y ) T ¬(X ∧ Y ) 2. F ¬X ∨ ¬Y 3. F X ∧ Y 4.
101
1.
, l
,
, , F X 5. F ¬X 7. F ¬Y 8. T X 11.
l
ll
F Y 6. F ¬X 9. F ¬Y 10. T Y 12.
Figure 4. Propositional Tableau Example situation is impossible. The tableau of Figure 4 is closed, because of 5 and 11, and 6 and 12. A tableau proof of X is a closed tableau beginning with F X. Thus Figure 4 constitutes a tableau proof of ¬(X ∧ Y ) ⊃ (¬X ∨ ¬Y ). It can be shown that exactly the classical tautologies have tableau proofs in this system, but I’ll postpone any discussion of soundness and completeness until modal rules have been introduced. A tableau version of consequence—deduction from premises—is easy. One says X follows from a set S of formulas if there is a closed tableau starting with F X, allowing the additional rule that for any Z ∈ S, T Z can be added to the end of any branch. Finally, I have used signed formulas, but one could just as well work with an unsigned version. Instead of F X use ¬X, and instead of T X, just use X. I’ll leave a full formulation to you (or see [22, 57]). The use of signs brings some additional power, however. It is easier to establish a connection with the Gentzen sequent calculus, as we will do in Section 7. There is a simple signed tableau system for intuitionistic logic, something that is not possible without signs. And one can add extra signs to create proof systems for many-valued logics.
5.2 Destructive Modal Tableaus Modal tableaus come in more than one version. Some logics have destructive tableau systems, [19, 33]. These will be presented in this section—a different approach is given in Section 6. The terminology comes from the fact that some destructive tableau rule applications lose information. Destructive tableau proofs tend to be more useful metatheoretically than other kinds of tableaus—for example, one can devise a simple proof of interpolation theorems using such tableau systems. To continue the uniform treatment begun with the alpha/beta grouping, two new categories, nu and pi, and their components are introduced in Table 9, to take care of the modal operators—both and ♦ are taken as primitive now. In Table 5 I gave a definition of S for several modal logics. As it happens, logics whose semantics involve symmetry don’t have simple (or any) destructive tableau systems, so these must be dropped. And I’m now allowing more connectives and modal operators as primitive than before. So a definition appropriate for this section is given in Table 10—
102
Melvin Fitting
ν T X F ♦X
ν0 TX FX
π T ♦X F X
π0 TX FX
Table 9. Nu and Pi Formulas connections with the earlier version should be clear. A few observations about this definition. First, for all six of the logics we have monotonicity: S1 ⊆ S2 implies S1 ⊆ S2 . And second, for the K4, S4, D4 group we have S ⊆ S . Both of these are easily checked, and both play a role in later soundness and completeness proofs. Logic K, T, D K4, S4, D4
S {ν0 | ν ∈ S} {ν0 , ν | ν ∈ S}
Table 10. Revised Definition of S Destructive tableau rules for the logics of Table 10 are as follows. First, all the classical rules of the previous section continue to apply. And in addition there are the rules given in Table 11. These rules require some comment. The second, from ν to get ν0 , is of the same general kind as earlier tableau rules: a branch containing ν can have ν0 added to the end. The third is slightly different since it is premiseless: at any point on a tableau branch we can add T ♦. The first, however, is of a very different nature. Let us call it the π rule, though technically what is displayed is actually several rules, depending on the definition of S . The π rule says that, given a branch containing π, and with S as the entire set of (other) signed formulas on it, that branch can be replaced with a new one containing the members of S , and π0 . The π rule is the reason for the terminology destructive—application of this rule removes formulas. For all logics:
S, π S , π0
For T and S4:
ν ν0
For D and D4:
T ♦
Table 11. Destructive Modal Rules An example of a destructive tableau can be found in Figure 5. It provides a tableau proof, in the K4 system, of (♦X ∧ Y ) ⊃ ♦(X ∧ Y ). In it, 2 and 3 are from 1, and 4 and 5 are from 2 by α. Then a destructive π rule applies, with 3 as the π formula. The original branch is replaced by a new one, shown below the line, with 6 from 3, 7 and 8 from 4, and 9 and 10 from 5; formulas 1 and 2 disappear entirely. Another π rule application now happens, with 8 as the π formula, producing the new branch shown below the second line. Item 11 is from 8; 12 and 13 are from 6; 14 and 15 are from 7; 16 and 17 are from 9. Finally β applied to 13 produces 18 and 19, and both branches are closed. Destructive rules add a level of complexity to tableaus. Tableau rules are nondeterministic—they say what can be done, but the order of rule application is not specified. It can be shown that, for the classical system of Section 5.1, a kind of Church-Rosser
Modal Proof Theory
103
F (♦X ∧ Y ) ⊃ ♦(X ∧ Y ) 1. T ♦X ∧ Y 2. F ♦(X ∧ Y ) 3. T ♦X 4. T Y 5. F ♦(X ∧ Y ) 6. T ♦X 7. T ♦X 8. T Y 9. T Y 10. T X 11. F ♦(X ∧ Y ) 12. F X ∧ Y 13. T ♦X 14. T ♦X 15. T Y 16. T Y 17. , l , l , l F X 18. F Y 19. Figure 5. K4 Destructive Tableau Example property applies. If a formula X is a tautology, any attempt to provide a closed tableau for F X will succeed, no matter in what order the rules are applied, provided only that on each branch, every non-atomic formula eventually has a rule applied to it. The π rule changes things. We might have a tableau branch containing, among other things, both T ♦X and T ♦Y . Either could be used as π in a π-rule application, but when so used, it will cause the deletion of the other formula. It can happen that a proof is obtainable when one choice is made, but not the other—we can choose badly. This means that a systematic proof search must allow backtracking, and so will be inherently more time-consuming than a systematic search in the classical system—see Chapter 3 for a full discussion.
5.3 Soundness and Completeness A proof of soundness can also serve to motivate the rules of Table 11. We’ll say a signed formula is realized at a possible world w of a model M if the formula is T X and M, w X, or the formula is F X and M, w X. Let L be one of the six logics for which tableau rules have been provided. Call a set S of signed formulas L-satisfiable if there is some L model M, and some possible world, w, of it that realizes all the members of S. Call a tableau branch L-satisfiable if the set of signed formulas on it is L-satisfiable. And call a tableau L-satisfiable if some branch is. The key fact is that satisfiability is an invariant for tableau construction. That is, each tableau rule preserves L-satisfiability. Let us call a rule sound if it has this satisfiability preserving feature. It is the need to have sound rules that dictates some of the features of the systems we have seen—for
104
Melvin Fitting
instance, this is why the version of S that works for K4 will not serve for K. PROPOSITION 5. Suppose T is an L tableau that is L-satisfiable. If any L tableau rule is applied to T the resulting tableau is still L-satisfiable. Proof. Suppose branch θ of T is L-satisfiable, say its members are realized at world w of model M. And say a tableau rule is applied to T . If it is applied on a branch other than θ, the resulting tableau is trivially L-satisfiable, so now assume the tableau rule has been applied on θ. If the applied rule was a β rule, then θ branches, technically it is replaced with two new branches which we’ll call θ, β1 and θ, β2 , using the obvious notation. Since β was realized at w, a check of each case in the definition of β shows that either β1 is realized at w, or β2 is. Consequently, either the branch θ, β1 is satisfied, at w, or the branch θ, β2 is. Either way the resulting tableau is L-satisfiable. The argument if the rule application was an α or a negation rule is even simpler, and is omitted. Now suppose the applied rule was the π rule from Table 11. The key thing we need is this. For each of the logics under consideration, if members of S are realized at world w of an L model M, and if w is any world of M that is accessible from w, then members of S are realized at w . Verification of this is left to you. Now, suppose θ consists of the members of S, and the signed formula π, and w realizes all the signed formulas on θ. Since π is realized at w, there must be an alternate world w at which π0 is realized. As we just noted, at w all members of S are realized. Then in the resulting tableau there is still a satisfiable branch, though its members are realized at a different world than the one realizing the members of the original branch. The other rules from Table 11 are straightforward. ❑ PROPOSITION 6. If X has a proof using the tableau rules for L, then X is L valid. Proof. I’ll show the contrapositive. Suppose X is not L valid; so there is some world of some L-model at which X is false, Then {F X} is L-satisfiable. Any tableau proof of X must start with the tree with only F X, at its root. This is an L-satisfiable tableau, so Proposition 5 says only L-satisfiable tableaus will be produced. An L-satisfiable tableau cannot be closed. Hence X can have no L tableau proof. ❑ Next we turn to completeness. A common way of showing completeness for tableau systems involves devising a systematic way of applying tableau rules. Such a systematic approach is presented for classical logic in [57], for instance. While such a method has utility when computer implementations are involved, it is often hard work. Fortunately the method used to show completeness for axiom systems in Section 2.2 can also be applied, and is much simpler. First we need a small generalization of the notion of tableau. So far we have started tableau constructions with a single signed formula. From now on, if S is a finite set of signed formulas, a tableau for S will be any tableau starting with a single branch containing the members of S, and continuing using the usual tableau rules. Then, a tableau proof of a formula X is a closed tableau for the set {F X}. Let L be one of the logics for which tableau rules have been provided in Table 11. Call a set S of signed formulas L-inconsistent if there is a closed L tableau for some finite subset of S, and call S L-consistent if it is not L-inconsistent. Clearly this notion of
Modal Proof Theory
105
L-consistency is of finite character, and so the Lindenbaum construction applies, see (1). Every L-consistent set of signed formulas can be extended to a maximal L-consistent set. We construct a model M = G, R, V much like we did in Section 2.2. G is the collection of all maximal L-consistent sets of signed formulas. For w1 , w2 ∈ G, w1 Rw2 provided w1 ⊆ w2 . And finally, w ∈ V(P ) provided T P ∈ w. One cannot, at this point, show an exact counterpart of (2) (though it is, in fact, true). But one can show the following, involving an implication instead of an equivalence. For every signed formula X and possible world w ∈ G X ∈ w =⇒ w realizes X in the model M
(4)
The proof is by induction on the complexity of signed formulas. Since we have several connectives as primitive now, I’ll make use of uniform notation. Here are the cases needed to establish (4). Suppose P is atomic. If T P ∈ w then M, w P by definition of V, so T P is realized at w. Likewise if F P ∈ w, since w is L-consistent, T P ∈ w, and so M, w P , and again F P is realized at w. The negation cases are straightforward, and are omitted. Suppose we have a β signed formula, β ∈ w, and (4) and is known for β1 and β2 . Since w is L-consistent, it follows from the tableau rules that one of w ∪ {β1 } or w ∪ {β2 } is L-consistent. Then it follows by maximality of w that either β1 ∈ w or β2 ∈ w. By the induction hypothesis, either β1 or β2 is realized at world w of M. And an examination of the cases in the definition of β formulas shows this is enough for β to be realized at w as well. The α case is similar, and is omitted. Suppose we have a ν formula, ν ∈ w, and (4) is known for ν0 . Let w be any member of G with wRw . For each choice of L, ν0 ∈ w and since w ⊆ w by definition of R, ν0 ∈ w . By the induction hypothesis, w realizes ν0 . A check of cases in the definition of ν shows that, since w was arbitrary, ν is realized at w. Finally, suppose we have a π formula, π ∈ w, and (4) is known for π0 . Using the π rule from Table 11, it follows that w ∪ {π0 } is consistent. Let w be a maximal L-consistent extension of this. Then w ∈ G and since π0 ∈ w , the induction hypothesis gives us that π0 is realized at w . Finally, since wRw , it follows, for each case in the definition of π, that π is realized at w. Now that (4) has been established, putting the final pieces together is easy. For L being any of the six logics from Tables 10 and 11, one can easily check that the construction described above produces a model M that is, in fact, an L-model. Here is part of such a verification. For any of the six logics being treated, S1 ⊆ S2 implies S1 ⊆ S2 . For L being one of K4, S4, or D4, S ⊆ S . Now, suppose w1 Rw2 and w2 Rw3 . Then w1 ⊆ w2 and w2 ⊆ w3 , so w1 ⊆ w2 ⊆ w3 . So if L is one of K4, S4, or D4, w1 ⊆ w3 , and hence w1 Rw3 . Thus for these three logics, the model is transitive. I’ll leave the other conditions to you. Now, if X is not provable by L-tableaus, {F X} is L-consistent. Extend it to a maximal L-consistent set w, which will be a world of the L model constructed above. It is a world at which X is false, by (4). Thus X is not L-valid. This establishes the following. PROPOSITION 7. For L being one of K, T, D, K4, S4, D4, the L tableau rules are complete.
106
Melvin Fitting
5.4 The Logic GL In Section 2.3 we saw that, while a straight canonical model argument was not able to prove completeness for GL, still a completeness argument could be given. A variation of that argument works for an appropriate destructive tableau system for GL as well. I’ll sketch this here. First of all, what are the GL destructive tableau rules? Use the definition of S for K4, from Table 10. In addition, the π-rule itself needs modification. Following [57], define the conjugate of a signed formula as follows: T X = F X and F X = T X. Thus conjugation amounts to switching the sign. Now, here is the curious but appropriate π rule for GL, [8, 19]. S, π S , π0 , π An example of a proof in this system appears in Figure 6, of the L¨ ob formula (P ⊃ P ) ⊃ P . In it, 2 and 3 are from 1 by α. Then a π-rule application is made, with 3 as the π formula. This replaces the original branch with a new one, shown below the line in the Figure. Formulas 4 and 5 are from 3 and 6 and 7 are from 2. Then 8 and 9 are from 7 by β, and both branches are closed. F (P ⊃ P ) ⊃ P 1. T (P ⊃ P ) 2. F P 3. F P 4. T P 5. T (P ⊃ P ) 6. T P ⊃ P 7. , l , l , l F P 8. TP
9.
Figure 6. GL Destructive Tableau Example Soundness is shown by the same method as earlier, Proposition 5, and the argument now is just like before, except for the new π rule. So, I’ll just show the following: if S ∪ {π} is GLw -satisfiable, so is S ∪ {π0 , π}. Well, suppose M = G, R, V is a GLw model in which the members of S ∪ {π} are realized at possible world w1 , but there is no world at which the members of S ∪ {π0 , π} are realized. Since w1 realizes π there must be a world, w2 , with w1 Rw2 , with w2 realizing π0 . And since w1 realizes the members of S, it is easy to see that w2 must realize the members of S . Since no world in M realizes the members of S ∪ {π0 , π}, it must be that w2 cannot realize π, and hence must realize π—that is, w2 realizes all members of S ∪ {π0 , π}. But now, since π is realized at w2 , there must be a world w3 with w2 Rw3 such that π0 is realized at w3 . Since S is realized at w2 then S is realized at w3 , but for the K4 definition, S ⊆ S , so all of S is realized at w3 . Then, as at w2 , we must have that π is realized at w3 . That is, at w3 , just as at w2 , we have all the members of S ∪ {π0 , π} realized. This pattern repeats—there must be an accessible world w4 realizing this set, and so on. But
Modal Proof Theory
107
this contradicts the non-existence of infinite chains in GLw models. Thus if S ∪ {π} is GLw -satisfiable, so is S ∪ {π0 , π}, and soundness follows. For completeness, a modification of the proof in Section 2.3 will work. Let Z be a formula with no GL tableau proof—I’ll construct a GLf counter-model. This time, let sub(Z) be the set of all signed subformulas of Z—all T X and F X with X a subformula of Z. Define consistency the way we did in Section 5.3—a set of signed formulas is GL-consistent if no GL tableau for a finite subset closes. Now, construct a model MZ = GZ , RZ , VZ as follows. GZ is the set of all maximally consistent subsets of sub(Z). A consistent subset of sub(Z) extends to a maximally consistent subset. Define w ∈ VZ (P ) if T P ∈ w. Set w1 R0 w2 provided w1 ⊆ w2 . Then define w1 RZ w2 if w1 R0 w2 but not w2 R0 w1 . We now have a model MZ . Just as in Section 2.3, it is finite, irreflexive, and transitive. Finally, a variant of (3) holds for it. I state it as (5) and leave its proof to you. With it, completeness (but not strong completeness) follows in the usual way. For a signed formula X ∈ sub(Z), X ∈ w implies w realizes X
(5)
5.5 Tableau Remarks Unlike the proof procedures examined earlier in this chapter, tableau systems obey a subformula principle—all formulas occurring in a proof are subformulas of the formula being proved. Often this is expressed by saying tableaus are analytic. The modus ponens rule of axiom systems and of natural deduction systems is the reason they do not obey a subformula principle. Analyticity makes the finding of proofs a simpler thing and accounts for why tableau systems have frequently been automated while natural deduction and axiom systems have rarely been. Indeed, proofs of decidability for logics having tableau systems can often be based on analyticity. There is an important non-analytic rule that is sometimes added to tableau systems, the cut rule. It says, at any point in a tableau construction we can split the end of a branch, labeling the two new branch nodes with T X and F X, for an arbitrary formula X. Since X can be any formula, obviously analyticity is violated. There is a more restricted version of the rule, in which X is required to be a subformula of the formula being proved—this is called analytic cut. Why consider an unrestricted cut rule? Historically, it was introduced by Gentzen [29] in the closely related context of the sequent calculus (see Section 7). Gentzen wanted to constructively establish that tableau (sequent calculi) and axiom systems were equivalent for both classical and intuitionistic logic. The presence of a cut rule makes it easy to show this—cut roughly corresponds to modus ponens. Then Gentzen gave a complicated constructive argument that showed any application of a cut rule in a proof could be eliminated. This fact, and its constructive proof, have been very influential, with important consequences, but it is not appropriate to go into this here. Suffice it to say that a cut rule can be added to any of the tableau systems of Section 5.2 without changing the class of provable formulas—that is, cut elimination can be proved for these systems, with proofs going back to [47, 48]. Proofs using cut, at least classically, can be significantly shorter than cut-free proofs. Cut elimination for classical first-order logic can introduce a non-elementary blow-up in proof depth. The corresponding situation for modal logics seems not to have been much studied, but is probably similar. There has been recent work on designing proof systems
108
Melvin Fitting
making proofs of cut elimination easier to establish. These go under the name display logics. See [4, 58]. Cut elimination for our modal systems can be shown constructively by extending Gentzen’s argument, but the arguments are fussy. A non-constructive proof is quite simple, however. The cut rule is easily seen to be a sound rule—it preserves L-satisfiability, for each L we have considered. Then the soundness proof of Section 5.3 extends—if X has an L-tableau proof, allowing the cut rule, X must be L valid. But by our completeness result, Proposition 7, if X is L valid it must have an L-tableau proof without cut. Consequently, if X is provable using L-tableaus plus cut, X is provable using L-tableaus without cut. A rule that can be added to a proof procedure without changing the class of theorems is called an admissible rule. What we have just shown is that cut is an admissible rule. Incidentally, now that we know this, it is easy to see that the implication (4) is actually an equivalence. This follows since, using cut, for each formula X, either T X or F X must be in any maximal L-consistent set, and closed tableaus using cut can be replaced by closed tableaus not using cut. Why consider analytic cut? For one thing, it can shorten proofs, and does not violate the subformula principle, so proof search procedures can incorporate it in a reasonable way. It has sometimes been included in tableau implementations for this reason. The reader cannot fail to have noticed that while nine representative modal logics were introduced in Table 1, tableau systems were given for only six of them. Tableau systems for the other three are missing, though if analytic cut is allowed, destructive tableau systems can be created, [33]. In this respect our representative normal modal logics are actually representative—more logics have axiom systems than have cut-free destructive tableau systems. Since tableau systems are useful for automation, a number of attempts have been made to augment tableaus with additional machinery so that more logics can be covered. We will see more of this starting in Section 6. Finally there is the matter of deduction, and the possibility of a strong completeness theorem. For the logics of Section 5.2, this is an easy matter. If a formula X is a global premise, one is allowed to add T X to any open tableau branch at any point. If X is a local premise, one can add it to any open tableau branch provided the π-rule in Table 11 has not yet been applied on that branch. Then our soundness and completeness arguments do, in fact, extend to prove strong soundness and completeness—I omit the proof. It should be noted that there are logics, GL is an example, that have sound and complete tableau systems, but which do not extend to allow these additional premise-adding rules. (Otherwise one could establish compactness for GL, and there is a simple example in [19] showing that local compactness fails.) Things must be carefully checked. 6 PREFIXED TABLEAUS In a destructive modal tableau an application of a π rule corresponds to a move to an alternative world—this appears explicitly in the argument for the soundness of the π rule. But the π rule loses information. If we are attempting to apply such a rule in a logic whose semantics involves symmetry, we can expect problems. With symmetry we can leave a world and return to it, so to speak. But in a destructive tableau, having lost information, there is no mechanism to regain it (except, sometimes, analytic cut). In order to get around this problem various mechanisms have been introduced to retain
Modal Proof Theory
109
information about other worlds during a proof—for instance in [37] a method of semantic diagrams is presented, in which multiple-world information is retained by the use of multiple boxes. Prefixed tableaus provide additional machinery using a device that is especially syntactic in nature. These tableau systems were introduced in [18, 19], but took on their present modular form in [46, 33]. They can also be seen as a particular kind of labeled deductive system, see [27].
6.1
A Prefixed System for K
A prefix is a finite sequence of positive integers, which I will write using a dot as separator, for example, 1.2.3.2.3. The informal idea is that a prefix names a possible world, with 1.2.3.2.1, 1.2.3.2.2, 1.2.3.2.3, and so on, all naming worlds accessible from 1.2.3.2. A prefixed (signed) formula is σ T X or σ F X, where σ is a prefix and X is a formula. The informal idea is that a prefixed formula asserts the underlying formula is true/false at the world named by the prefix. A prefixed tableau proof of X begins with 1 F X, informally asserting that X is false in some world, named by 1. It continues using branch extension rules to be given in a moment. The goal is to produce a closed tableau, where now a branch is closed if it contains σ T X and σ F X for some formula X (note that the prefix is the same in both cases). A branch is also closed if it contains σ T ⊥ or σ F . And a tableau is closed if each branch is closed, as usual. The branch extension rules for the propositional connectives are as before, except that prefixes are carried along. They are given in Table 12. σ T ¬X σF X
σ F ¬X σT X
σα σ α1 σ α2
σ β1
σβ |
σ β2
Table 12. Prefixed Classical Rules The modal rules for K are given in Table 13. A prefix has been used on a branch if it already occurs on the tableau branch. It is new if it does not occur. The intuition should be fairly clear. If a π formula is true at a world named by prefix σ, then π0 must be true at an alternative world. We want to pick a name for that world, a prefix. Since the world is accessible from the world named by σ, we want a prefix that extends σ by one number, and otherwise it should be uncommitted, hence the newness requirement. The ν rule is similarly motivated. σν σ.n ν0 for σ.n used
σπ σ.n π0 for σ.n new
Table 13. Modal Tableau Rules for K Figure 7 contains an example of a proof in this K tableau system, of (♦P ∧ ♦Q) ⊃ ♦♦(P ∧ Q). In it, 2 and 3 are from 1, and 4 and 5 are from 2 by α, 6 is from 4 by π, 7
110
Melvin Fitting
is from 5 by ν, 8 is from 7 by π, 9 is from 3 and 10 is from 9 by ν, 11 and 12 are from 10 by β, and 13 is from 6 by ν. Closure is by 11, 13 and 8, 12. 1 F (♦P ∧ ♦Q) ⊃ ♦♦(P ∧ Q) 1. 1 T ♦P ∧ ♦Q 2. 1 F ♦♦(P ∧ Q) 3. 1 T ♦P 4. 1 T ♦Q 5. 1.1 T P 6. 1.1 T ♦Q 7. 1.1.1 T Q 8. 1.1 F ♦(P ∧ Q) 9. 1.1.1 F P ∧ Q 10. , l , l , l , l 1.1.1 F P 11. 1.1.1 F Q 12. 1.1.1 T P 13. Figure 7. Prefixed K Tableau Prefixed tableaus can be used for derivations as well as for proofs, in quite a simple way. To use X as a global premise, one may add σ T X to the end of any open branch, for any prefix σ that appears on the branch. To use X as a local premise, one may add 1 T X only.
6.2 Soundness and Completeness So far I have only given prefixed rules for K. But rules for other logics do not change the basic ideas very much, so I’ll prove soundness and completeness now, while things are at their simplest. Soundness is by the usual tableau argument—see Section 5.3 for details in the destructive tableau setting. For prefixed formulas, I’ll say a set S of prefixed, signed formulas is satisfiable (properly speaking, K satisfiable) if there is a model M, and a mapping N from the prefixes in S to possible worlds in M, such that if σ X ∈ S then X is realized at N (σ) in M, where X is a signed formula. As before, a tableau branch is satisfiable if the set of prefixed formulas on it is satisfiable, and a tableau is satisfiable if some branch is. I’ll leave it to you to establish that each tableau rule converts a satisfiable tableau into another satisfiable tableau. And trivially, a closed tableau cannot be satisfiable. Now soundness follows exactly as in Section 5.3. Modal operators have strong similarities to quantifiers, and that observation plays a role now. For starters, the Lindenbaum construction of (1) needs to be ‘Henkinized.’ We’ll say a set S of prefixed signed formulas is K-consistent if no K-tableau for a finite part of S is closed; S is π-complete provided, if σ π ∈ S then for some integer k, σ.k π0 ∈ S; and S omits infinitely many integers if the set of integers that do not appear in prefixes in S is infinite. It is a fact that every K-consistent set S of prefixed sentences that omits infinitely many integers can be extended to a set that is maximally K-consistent and
Modal Proof Theory
111
π-complete. This can be done via the following Henkin-style modification of the earlier construction, (1). Lindenbaum-Henkin Construction Suppose S is a K-consistent set of prefixed sentences that omits infinitely many integers. Enumerate the (countably many) prefixed signed formulas of the language, σ1 X1 , σ2 X2 , . . . , and define the following sequence of sets. S1 = S ⎧ ⎨ Sn ∪ {σn Xn } Sn ∪ {σn π, σn .k π0 } Sn+1 = ⎩ Sn
if K-consistent and Xn is not π if K-consistent, Xn is π, and σn .k is new otherwise
(6)
In this construction, ‘new’ means σn .k does not occur in Sn or in π(= Xn ). It is not hard to see that if S omits infinitely many integers, this will also be the case with each Sn . Also, if S ∪ {σn π} is K-consistent, then Sn ∪ {σn π, σn .k π0 } will also be K-consistent provided σn .k is new, and if Sn omits infinitely many integers, there will be such a prefix that is new. I’ll leave it to you to check that if S is K-consistent and omits infinitely many integers, then ∪n Sn will be maximally K-consistent and π-complete. Suppose X is not provable using the prefixed K-tableau rules. Then {1 F X} is Kconsistent, and obviously omits infinitely many integers. Extend it to a maximally Kconsistent, π-complete set, S, using the construction above. Let G be the set of prefixes that occur in S. For prefixes σ and τ in G, set σRτ if τ is σ.n for some integer n. For a propositional letter P , let σ ∈ V(P ) if σ T P ∈ S. This gives us a model M = G, R, V . Incidentally, note that the model is constructed from a single maximally consistent set, rather than a family of them, as was the case with destructive tableaus. This is a key difference between the two types of tableaus: prefixed tableau branches keep track of multiple worlds; destructive tableau branches have information about a single world at a time. Now we need a truth lemma. It says: for every signed formula X , the following is true. σ X ∈ S =⇒ σ realizes X in the model M
(7)
Equation (7) has a straightforward proof, which I’ll leave to you. Once we have it completeness is immediate, since {1 F X} ∈ S and so X is false at world 1 of the model M. The completeness proof just given is simple, but there is another way of proving completeness that provides additional information. One can give an algorithm that systematically expands K tableaus. If the algorithm is properly crafted, one can show that either it will produce a proof, or it will terminate with an unclosed tableau. If it terminates, the set of formulas on any open branch can play the role of the set S in the proof above; (7) can be proved for it. In this way we not only get completeness, but a concrete decision procedure as well. Such an algorithm is given in [19, Ch 8, sect 4]. With some of the other logics to be discussed in the next section, termination is not as simple as it is with K, and may involve loop-checking. I do not pursue this further here.
112
Melvin Fitting
T
σν σ ν0
4r
σ.n ν σν
4
σν σ.n ν
D
σ T X σ T ♦X
B
σ.n ν σ ν0
σ F ♦X σ F X
For prefixes σ and σ.n already occurring on the tableau branch: Table 14. Modal Tableau Rules
6.3 Other Modal Logics Following [46, 33], other standard modal logics can be handled in a modular fashion. First, some additional tableau rules, and their names, are given in Table 14. Next, some common modal logics can be given prefixed tableau proof systems by adding various combinations of these rules to those for K. How to do this for several modal logics is summarized in Table 15. I omit proofs of soundness and completeness— they are straightforward variants of what worked for K. Logic T K4 S4 KB B S5 D D4 DB
Special Rules T 4 T, 4 B B, 4 T , 4, 4r D D, 4 D, B
Table 15. Prefixed Tableau Systems Note that, unlike with destructive modal tableaus, there are straightforward prefixed tableau systems for logics involving symmetry in their semantics. In particular, there is a system for S5. In this case, and this case only, there is actually a simpler version that will also serve—let us call it the Simple S5 System. Instead of taking prefixes to be sequences of positive integers, take them to be single positive integers. And replace the modal rules of Tables 13 and 15 with those in Table 16. Essentially, this works because there is an alternate Kripke semantics for S5 in which the accessibility relation holds between any two worlds. Figure 8 displays a proof using these Simple S5 Rules, of P ⊃ ♦P .
Modal Proof Theory
nν k ν0 for k used
113
nπ k π0 for k new
Table 16. Simple Tableau Rules just for S5 1 F P ⊃ ♦P 1 T P 2. 1 F ♦P 3. 2 F ♦P 4. 1 F P 5.
1.
Figure 8. A Prefixed S5 Tableau Proof It was shown in [42] that for K, T, and S4, satisfiability is PSpace complete (more generally, for modal logics between K and S4). It was also shown that for S5 it drops to NP complete. This is reflected in the existence of the simple tableau system for S5 given here. On the other hand, for multi-modal logics, which will be considered in Section 9, satisfiability is PSpace complete, [34], even for multi-modal S5, and so we should not expect a simple multi-modal version for this logic, unlike in the mono-modal case. A thorough discussion of complexity issues can be found in this volume, in Chapter 3.
7
GENTZEN SYSTEMS
A sequent is written X1 , . . . , Xn −→ Y1 , . . . , Yk , where the Xi and Yj are formulas. It is informally taken to mean the conjunction of the formulas on the left of the arrow has the disjunction of the formulas on the right as a consequence. Either n or k can be 0, with an empty conjunction treated as true, and an empty disjunction as false. A sequent calculus is a specification of rules for deriving sequents from sequents. But how something is written does not determine its mathematical properties. What actually is a sequent? A list of formulas, X1 , . . . , Xn say, in a sequent can represent at least three different mathematical objects: a set, a multiset, or a sequence. In Gentzen’s original treatment, [29], a formula list represented a sequence. Gentzen provided rules permitting, for example, the permutation of members of a list, or the duplication of members. If a formula list is taken to represent a multiset, permutation need not be specified, but formula duplication still must be provided for. If a formula list is taken to represent a set, even duplication rules can be omitted. Rules like permutation, duplication, and a few others, are called structural rules. By using a multiset or a sequence, and at the same time omitting various structural rules, a family of substructural logics has been created, with linear logic and relevance logic as the best-known representatives, [14, 50, 53]. By restricting the right side of a sequent to have at most one formula, intuitionistic logic can be captured. This is not the place to go into what is a very extensive subject—here we are interested in modal logic over a classical logic base. Consequently here lists will be thought of as designating sets, which means structural rules are not needed—they are
114
Melvin Fitting
built into the data structure, so to speak.
7.1 Classical Propositional Sequents With it understood that lists represent sets, the Gentzen system rules for classical propositional logic will now be given. I use boldface letters, with and without subscripts, to denote formula lists, which represent sets. If I write S, X I mean the list consisting of the members of S, together with X, and similarly for other obvious notational conventions. A sequent calculus is a forward reasoning system: certain sequents are taken as axioms, and there are rules for deducing a sequent from others. Note that the rules each introduce exactly one connective, and there is one rule for an introduction on the left of the arrow, and one for the right. Axioms
Negation Rules
SL , X −→ SR , X SL , ⊥ −→ SR SL −→ SR , SL , X −→ SR SL −→ SR , ¬X SL −→ SR , X SL , ¬X −→ SR
Conjunction Rules
SL , X, Y −→ SR SL , X ∧ Y −→ SR SL −→ SR , X SL −→ SR , Y SL −→ SR , X ∧ Y
Disjunction Rules
SL , X −→ SR SL , Y −→ SR SL , X ∨ Y −→ SR SL −→ SR , X, Y SL −→ SR , X ∨ Y
Implication Rules
SL , Y −→ SR SL −→ X, SR SL , X ⊃ Y −→ SR SL , X −→ SR , Y SL −→ SR , X ⊃ Y
A Gentzen system proof of a sequent is a tree having the sequent at its root— customarily the root is written at the bottom—with axioms at leaves, and with each non-leaf following from its children by one of the rules above. A proof of a formula X is taken to be a proof of the sequent −→ X. Figure 9 shows a proof in this system, of ¬(X ∧ Y ) ⊃ (¬X ∨ ¬Y ). I’ll leave it to you to supply reasons for the steps. Soundness for this sequent calculus is easily established. Define a mapping from se-
Modal Proof Theory
115
X −→ ¬Y, X Y −→ ¬X, Y −→ ¬X, ¬Y, X −→ ¬X, ¬Y, Y −→ ¬X ∨ ¬Y, X −→ ¬X ∨ ¬Y, Y −→ ¬X ∨ ¬Y, X ∧ Y ¬(X ∧ Y ) −→ ¬X ∨ ¬Y −→ ¬(X ∧ Y ) ⊃ (¬X ∨ ¬Y ) Figure 9. Gentzen Sequent Proof quents to formulas as follows. [X1 , . . . , Xn −→ Y1 , . . . , Yk ]f = [(X1 ∧ · · · ∧ Xn ) ⊃ (Y1 ∨ · · · ∨ Yk )] [X1 , . . . , Xn −→]f = [(X1 ∧ · · · ∧ Xn ) ⊃ ⊥]
(8)
[−→ Y1 , . . . , Yk ] = [ ⊃ (Y1 ∨ · · · ∨ Yk )] f
This mapping is in keeping with the remarks at the beginning of the section about the informal meaning of a sequent—conjunctions entailing disjunctions. It is easy to show that if images of the premises of a sequent rule are classically valid formulas, so is the image of the conclusion. Also, images of all sequent axioms are classically valid formulas. So the image of every provable sequent, under this mapping, is valid. If a formula X has a sequent proof, the sequent −→ X is provable, hence its image is valid. But [−→ X]f is ⊃ X, and it follows that X is valid. Gentzen systems predate tableaus by many years. They were introduced as a tool for the analysis of proofs, while tableaus were introduced as a convenient mechanism for proof search. But tableaus were heavily influenced by Gentzen systems—indeed there is a simple correspondence between sequents and sets of signed (unprefixed) formulas. Define a mapping from finite sets of signed formulas to sequents as follows. {T X1 , . . . , T Xn , F Y1 , . . . , F Yk }s is the sequent X1 , . . . , Xn −→ Y1 , . . . , Yk
(9)
Thus the mapping puts T -signed formulas on the left and F -signed formulas on the right. Now, a key fact is the following. LEMMA 8. Let S be a finite set of signed formulas. If there is a closed tableau for S using the classical tableau rules of Section 5.1, then the sequent S s is provable using the sequent rules of this section. Proof. Let us say S closes with depth d if d is the smallest number such that there is a closed tableau for S with d tableau rule applications. The proof is by induction on d. If S closes with depth 0, it must contain T X and F X for some X, or T ⊥, or F . In each case S s is a sequent calculus axiom. Now suppose S closes with depth d and the result is known for sets that close with depth less than d. Say that T X ∧ Y ∈ S and in a d-step tableau for S the first rule application is to this signed formula. It follows that there must be a closed tableau for S ∪ {T X, T Y } with fewer than d rule applications. By the induction hypothesis, the sequent image of this set must have a sequent calculus proof. Let SL be the list
116
Melvin Fitting
of formulas that occur in S with a sign of T , and let SR be the list of formulas in S with a sign of F . Then [S ∪ {T X, T Y }]s is the sequent SL , X, Y −→ SR , and so this must be provable. Then by one of the two sequent rules for conjunction, the sequent SL , X ∧ Y −→ SR is provable, but this is S s . The other cases are similar. ❑ With this established, we quickly get the following. PROPOSITION 9. The classical propositional sequent calculus is complete. Proof. For Proposition 7 a completeness proof for a destructive modal tableau system was given. It is easy to see that a completeness proof for the non-modal part is extractable. Leaving this to you, we have that if X is classically valid, there must be a closed classical tableau for {F X}. By the Lemma above, the sequent −→ X must then be provable, and hence X has a sequent calculus proof. ❑ It is important to understand what is behind the proof of Lemma 8. In the one induction case given in detail, a tableau and a sequent rule for conjunction were involved. Here they are, side by side. T X ∧Y TX TY
SL , X, Y −→ SR SL , X ∧ Y −→ SR
Notice that, via the mapping from sets of signed formulas to sequents, these rules correspond in a fairly obvious way, except that each is an upsidedown version of the other. This is the case with every tableau and sequent rule. It is what makes Lemma 8 work. Once this correspondence is understood, it is easy to see that the sequent proof in Figure 9 and the tableau proof in Figure 4 are just presentations, in their respective systems, of the same construction. The correspondence between tableaus and Gentzen system proofs is worked out in detail in [57], where the two systems are developed simultaneously.
7.2 Modal Propositional Sequents Now that the correspondence between tableau proofs and sequent proofs is clear in the classical case, we have a guiding principle to follow in turning destructive modal tableau rules into modal sequent rules. We want them to be ‘upside down’ counterparts. If we do it properly we are guaranteed completeness, since we already have tableau completeness proofs. Here is a sequent version for K that does this. First, the definition of S needs a dual version. S = {X | X ∈ S}
S = {X | ♦X ∈ S}
And now, the additional rules needed for K are the following. SL , X −→ SR SL , ♦X −→ SR
SL −→ SR , X SL −→ SR , X
For K4 the definitions above must be replaced with the following, though the form of the rules stays the same. S = {X, X | X ∈ S}
S = {♦X, X | ♦X ∈ S}
Modal Proof Theory
117
For S4 we use the system for K4 together with the following additional rules, the T ones. SL −→ SR , X SL , X −→ SR SL , X −→ SR SL −→ SR , ♦X Clearly, any of the modal logics with a destructive tableau system also has a sequent calculus proof system.
8
HYPERSEQUENTS
Just as tableaus have been fitted out with extra machinery, such as prefixes, sequent calculi have also been enhanced. Hypersequents add machinery that makes it possible to provide proof systems for several well-known non-classical logics—see [3]. While they provide a uniform mechanism that can deal with a rich variety of logics, here I will only discuss the hypersequent calculus for S5.
8.1
Hypersequents for S5
A hypersequent is written X1 −→ Y1 | X2 −→ Y2 | · · · | Xn −→ Yn . In this expression each component, Xi −→ Yi , is a sequent (so each Xi and Yi is a list of formulas), and the expression itself is a list of sequents. Intuitively a hypersequent should be read disjunctively—one of the sequents is the case—though exact details vary from logic to logic. Various non-classical logics can be captured by imposing special conditions on how lists behave, but for S5 things are rather simple. As we did in Section 7, a list will be thought of as designating a set, and hence permutation and repetition is built in. A proof of a formula X is a proof of the hypersequent with the single component → X, where the notion of a proof of a hypersequent is about to be defined. Much as with a Gentzen system, there are axioms, and rules for deducing hypersequents from hypersequents. Axioms are component-wise versions of those in Section 7.1: a hypersequent C1 | C2 | · · · | Cn is an axiom if some Ci is an axiom in the sequent sense. The rules for the classical propositional connectives also carry over component-wise. Here are the rules for conjunction, as an example. In them, the Ci and Di are sequents. C1 | · · · | Cn | SL , X, Y −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL , X ∧ Y −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , X | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , Y | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , X ∧ Y | D1 | · · · | Dk We want a proof system for S5. Since this extends S4, besides the classical rules we need the S4 modal rules, from the end of Section 7.2, in hypersequent form of course. There are four such S4 rules. First there are the K4 rules, in which S = {X, X | X ∈ S} and S = {♦X, X | ♦X ∈ S}.
118
Melvin Fitting
C1 | · · · | Cn | SL , X −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL , ♦X −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , X | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , X | D1 | · · · | Dk And here are the hypersequent T rules. C1 | · · · | Cn | SL , X −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL , X −→ SR | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , X | D1 | · · · | Dk C1 | · · · | Cn | SL −→ SR , ♦X | D1 | · · · | Dk So far the rules have made no special use of the hypersequent mechanism; they have all been direct counterparts of sequent calculus rules. There is one final rule that turns the system into one for S5, and in it the full mechanism comes into play. First some terminology. Call a formula modal if it is of the form X or ♦X. I’ll say the pair of sequents X1 −→ Y1 and X2 −→ Y2 is a modal splitting of the sequent U −→ V if, first, X1 ∪ X2 = U and Y1 ∪ Y2 = V and, second, all formulas in X1 and in Y1 are modal. (It is not assumed that X1 and X2 are disjoint, and similarly for Y1 and Y2 ). Modal Splitting Rule If the sequents Ci1 and Ci2 are a modal splitting of Ci , then: C1 | · · · | Ci−1 | Ci | Ci+1 | · · · | Cn C1 | · · · | Ci−1 | Ci1 | Ci2 | Ci+1 | · · · | Cn
8.2 Examples I’ll first give some useful derived rules, and then a hypersequent proof that makes use of them. The first derived rule is weakening, which allows the introduction of additional formulas into sequents. It says the following. Weakening Rule
C1 | · · · | Cn | X −→ Y | D1 | · · · | Dk C1 | · · · | Cn | X, U −→ Y, V | D1 | · · · | Dk
Sometimes weakening is taken as a basic rule in the sequent calculus, but in our case it is built in indirectly. Note that sequent axioms were not of the form X −→ X, but allowed side formulas, SL , X −→ SR , X, and similarly for the other two axiom forms. All the various rules allow us to carry side formulas along, and also the K rules allow for the introduction of additional side formulas. Given this, showing that weakening is a derived rule is an easy induction on proof complexity. The next derived rules are peculiar to hypersequents—there is no underlying sequent version. Derived ν Rules C1 | · · · | Cn | X, A −→ Y | U, A −→ V | D1 | · · · | Dk C1 | · · · | Cn | X, A −→ Y | U −→ V | D1 | · · · | Dk
Modal Proof Theory
119
C1 | · · · | Cn | X −→ Y, ♦A | U −→ V, A | D1 | · · · | Dk C1 | · · · | Cn | X −→ Y, ♦A | U −→ V | D1 | · · · | Dk Derived π Rules C1 | · · · | Cn | X, ♦A −→ Y | A −→ | D1 | · · · | Dk C1 | · · · | Cn | X, ♦A −→ Y | D1 | · · · | Dk C1 | · · · | Cn | X −→ Y, A | −→ A | D1 | · · · | Dk C1 | · · · | Cn | X −→ Y, A | D1 | · · · | Dk Here is a hypersequent derivation showing that the first of the ν rules above is a derived rule. The Repetition label refers to the fact that for us lists represent sets, and so repeated sequents can be combined. C1 | · · · | Cn | X, A −→ Y | U, A −→ V | D1 | · · · | Dk T Rule C1 | · · · | Cn | X, A −→ Y | U, A −→ V | D1 | · · · | Dk Modal Splitting C1 | · · · | Cn | X, A −→ Y | A −→ | U −→ V | D1 | · · · | Dk Weakening C1 | · · · | Cn | X, A −→ Y | X, A −→ Y | U −→ V | D1 | · · · | Dk Repetition C1 | · · · | Cn | X, A −→ Y | U −→ V | D1 | · · · | Dk Showing that the π rules are derived ones is simpler, and does not make use of the Modal Splitting rule. Here is the verification for the first one. C1 | · · · | Cn | X, ♦A −→ Y | A −→ | D1 | · · · | Dk K4 Rule C1 | · · · | Cn | X, ♦A −→ Y | ♦A −→ | D1 | · · · | Dk Weakening C1 | · · · | Cn | X, ♦A −→ Y | X, ♦A −→ Y | D1 | · · · | Dk Repetition C1 | · · · | Cn | X, ♦A −→ Y | D1 | · · · | Dk Finally, Figure 10 displays a hypersequent proof of P ⊃ ♦P , in which use is made of some of the derived rules. Note that it begins with a hypersequent axiom, since P −→ ♦P, P is a sequent axiom. P −→ ♦P, P | −→ ♦P Derived ν Rule P −→ ♦P | −→ ♦P Derived π Rule P −→ ♦P Implication Rule −→ P ⊃ ♦P Figure 10. A Hypersequent Proof
8.3 Soundness and Completeness Equations (8) in Section 7.1 define a translation from sequents into formulas. Following [3] this is extended to hypersequents as follows. [C1 | C2 | · · · | Cn ]f = C1f ∨ C2f ∨ . . . ∨ Cnf
(10)
120
Melvin Fitting
Suppose we could show all hypersequents that are provable in the S5 system just presented have translates that are valid in S5. If the formula X were provable, there would be a hypersequent proof ending in the single-component hypersequent −→ X, and its hypersequent translate is ( ⊃ X), which would be valid. But if ( ⊃ X) is S5 valid, so is X. Consequently, showing soundness for the S5 hypersequent calculus comes down to showing all provable hypersequents have S5 valid translates. It is easy to see that the translation of each hypersequent axiom is S5 valid. So if we can show that each of the hypersequent rules preserves validity of translation, we have soundness. This is straightforward for most of the hypersequent calculus rules. The only one needing serious work is the modal splitting rule. Let us say that component C is X, ♦Y, Z −→ U, ♦V, W, and that X, ♦Y −→ U, ♦V and Z −→ W is a modal splitting of it. (I write X to denote the list of formulas in X with prefixed to each, and similarly for ♦Y.) It is enough to show the S5 validity of the following. [X, ♦Y, Z −→ U, ♦V, W]f ⊃ {[X, ♦Y −→ U, ♦V]f ∨ [Z −→ W]f } Writing this out in full, we get the following formula. ♦Yi ∧ Zi ) ⊃ ( Ui ∨ ♦Vi ∨ Wi )] ⊃ [( Xi ∧ i
i
i
i
i
i
i
i
{[( Xi ∧ ♦Yi ) ⊃ ( Ui ∨ ♦Vi )] ∨ [ Zi ⊃ Wi ]} i
i
i
i
Despite the intimidating appearance of this, it has a simple proof using the Simple Tableau System for S5 given in Section 6.3. I’ll leave this to the reader. A direct proof of completeness can be found in [3], but for us it is easier to show that Simple S5 Tableau System proofs can be translated into hypersequent proofs, and then rely on tableau completeness. In (9) a mapping from finite sets of signed formulas to sequents was given. Now that is used to define a mapping from finite sets of prefixed signed formulas to hypersequents as follows. For a finite set S of prefixed signed formulas (using positive integers as prefixes): S s = C1 | C2 | · · · | Cn where Ck = {X | k X ∈ S}s
(11)
Now a version of Lemma 8 can be proved for the current set-up. LEMMA 10. Let S be a finite set of prefixed signed formulas. If there is a closed tableau for S using the Simple S5 Tableau rules of Table 16 then the hypersequent S s is provable using the rules of this section. Proof. As with Lemma 8 the proof is by an induction on the depth of S, where the depth is the smallest number d such that there is a closed Simple S5 Tableau for S with d tableau rule applications. The argument for the classical connectives is just the hypersequent analog of what we did before. I’ll consider one of the modal cases, and leave the others to you. Suppose S closes with depth d, the result is known for sets that close with depth less than d, the prefixed formula n T A ∈ S, and there is a d-step closed tableau for S in which the first rule application is to this prefixed formula, adding the formula k T A to the tableau branch, where k already occurs (so it must be in S). Of course there is a closed tableau for S ∪ {k T A} with fewer than d rule applications. From the induction
Modal Proof Theory
121
hypothesis, the hypersequent image of this set must have a hypersequent proof. By definition, [S ∪ {k T A}]s = · · · | X, A −→ Y | · · · | U, A −→ V | · · · where X, A and Y are the lists of members of S ∪ {k T A} with a prefix of n and signs of T and F respectively, and U, A and V are the members with a prefix of k and signs of T and F respectively. But then, using one of the Derived ν Rules, the hypersequent · · · | X, A −→ Y | · · · | U −→ V | · · · will also be provable, and this is S s .
❑
PROPOSITION 11. The S5 hypersequent calculus is complete. Proof. If X is S5 valid, there is a closed Simple S5 Tableau for {1 F X}. By the Lemma, there must be a hypersequent proof of the hypersequent whose only component is −→ X, and so X has a hypersequent proof. ❑ In a clear sense, the hypersequent calculus for S5 (with the derived rules) bears the same relationship to the Simple S5 Tableau System that the sequent calculi of Section 7 have to destructive modal tableau systems. 9
LOGICS OF KNOWLEDGE
Up to now only mono-modal logics have been considered. Things become more interesting when several modal operators are combined in a single logic. This is the first of several sections in which we examine such multi-modal logics, and is the simplest of these sections. Most proof methods adapt to multi-modal logics with varying degrees of difficulty, but from now on I will concentrate almost exclusively on prefixed tableaus. These generally make the jump to multi-modal logics with a certain grace. One natural multi-modal logic is a logic of knowledge, first investigated in detail in [36]; also see [15] for a more recent account.
9.1 A Basic Logic of Knowledge In a logic of knowledge there is a set, usually finite, of knowers {k1 , k2 , . . . , km }. Informally I’ll use a, b, . . . to range over the set of knowers. For each knower a there is a corresponding modal operator, Ka . We read Ka X as “a knows X.” Each Ka is like from earlier sections. It is not as common to have dual modal operators, but I will—I’ll use K a for the operator dual to Ka , that is, ¬Ka ¬. A dual knowledge operator is like ♦ from earlier sections. Informally, K a X can be read, “X is compatible with what a knows.” Properties of actual knowledge are difficult to specify. We might know X and also X ⊃ Y , but not know Y simply because we never thought about it. What standard logics of knowledge capture is not actual knowledge, but potential knowledge—what one is entitled to know. The switch to potential knowledge means we drop all considerations of complexity—we potentially could know a tautology with 10100 symbols, for instance. But the switch to an idealized point of view does simplify the theory. It is rather easy
122
Melvin Fitting
to see that, under such an assumption, a knowledge modality should be a normal modal operator. But, what else should be required? Since one cannot know something that is false, we would want Ka X ⊃ X, the T axiom. On the other hand belief (also idealized) is somewhat similar to knowledge, and if it is belief we are trying to examine, we would not want this axiom. Often a certain degree of introspection is assumed—if one knows something, that fact is also known—that is Ka X ⊃ Ka Ka X. Thus we might want knowledge operators to obey the S4 conditions. Further, negative introspection is also often assumed—if one does not know something, it is known that it is not known—that is ¬Ka X ⊃ Ka ¬Ka X. All these together make a knowledge operator obey the S5 conditions. But keep in mind that lesser, or different, assumptions may be appropriate in particular cases. The semantics for a logic of knowledge is simple—a frame is a structure G, Rk1 , Rk2 , . . . , Rkm where G is the usual set of possible worlds, and we have an accessibility relation for each knower. A model is based on such a frame in the standard way, by specifying which propositional letters are true at which worlds. If M is such a model, truth at possible worlds is defined in the usual way, but with the modal condition: M, w Ka X if and only if M, w X for each w ∈ G with wRa w . Often each Ra is taken to be an equivalence relation, corresponding to S5, but other assumptions can be made, and they do not need to be the same for each knower. An axiomatic treatment of a logic of knowledge is quite straightforward. One simply assumes the appropriate modal axioms (and necessitation rule) for each Ka . I will skip further discussion. Various other proof systems can be adapted to logics of knowledge, but prefixed tableau systems are most ‘practical,’ and quite natural. They are all that will be covered here. We now take a prefix to be a sequence 1.n1 a1 .n2 a2 . . . . where, except for the first item, 1, each term consists of a positive integer, n, and a knower, a. The idea is, σ.na is intended to designate a world that is accessible from the world σ designates, via the accessibility relation for knower a. The propositional connective tableau rules are as they were in the mono-modal case. Before stating the new modal rules, the earlier nu/pi notation must be modified, since it does not keep track of which knowledge operator we are dealing with. This is done in Table 17. νa T Ka X F K aX
ν0a TX FX
πa T K aX F Ka X
π0a TX FX
Table 17. Multi-Modal Nu and Pi Formulas In Table 13, tableau rules for mono-modal K were given. In the multi-modal setting these rules are replaced by those in Table 18. Likewise the mono-modal tableau rules of Table 14 must be replaced with those in Table 19. σ νa σ.na ν0a for σ.na used
σ πa σ.na π0a for σ.na new
Table 18. Multi-Modal Tableau Rules for K
Modal Proof Theory
Ta
σ νa σ ν0a
4ra
σ.na ν a σ νa
4a
σ νa σ.na ν a
Da
σ T Ka X σ T K aX
Ba
σ.na ν a σ ν0a
123
σ F K aX σ F Ka X
For prefixes σ and σ.na already occurring on the tableau branch: Table 19. Multi-Modal Tableau Rules To illustrate how this works, Figure 11 displays a derivation using these rules. In it we have a logic of knowledge with two knowers, a and b. It is assumed that the T and 4r rules apply to Kb while only the K rules apply to Ka . The figure presents a derivation of Ka ¬Kb (X ⊃ Y ) from Ka ¬Kb ¬Kb ¬Y and Ka X. In the tableau, 4 is from 3 by π a ; 5 is from 4 by negation; 6 is from 5 by T ; 7 is from 2 and 8 is from 1 by ν a ; 9 is from 8 by negation; 10 is from 9 by π b ; 11 is from 10 by negation; 12 is from 11 by 4rb ; 13 is from 12 by T ; 14 is from 13 by negation; and 15 and 16 are from 6 by β. I’ll omit proofs of soundness and completeness. They are quite straightforward extensions of the mono-modal proofs given earlier. This is so for both the tableau and the axiomatic treatments. Finally, as formulated above, knowers were independent beings. One might want to consider relationships between them such as, for instance, that b knows everything that a knows, or that if a knows something, b knows that a knows it. The most straightforward way of handling such things is to formulate them as axiom schemes. For instance, the first condition gives us the scheme Ka X ⊃ Kb X and the second gives us Ka X ⊃ Kb Ka X. These can be added to an axiomatic formulation of a basic logic of knowledge, or can be taken as global assumptions in a tableau treatment. In many cases such assumptions can be reformulated as tableau rules too. For instance, the two conditions just mentioned correspond to the following two tableau rules. σ νa σ.nb ν0a for σ.nb used corresponding to Ka X ⊃ Kb X
σ νa σ.nb ν a for σ.nb used corresponding to Ka X ⊃ Kb Ka X
Conditions relating knowers are infinitely varied. I will not attempt to provide a general theory for them, but leave it to you to deal with them on a case-by-case basis.
9.2
Common Knowledge
A formula X is common knowledge among a group of knowers if X is true, everybody knows X, everybody knows that everybody knows X, and so on. If our knowers are,
124
Melvin Fitting
1 T Ka ¬Kb ¬Kb ¬Y 1. 1 T Ka X 2. 1 F Ka ¬Kb (X ⊃ Y ) 3. 1.1a F ¬Kb (X ⊃ Y ) 4. 1.1a T Kb (X ⊃ Y ) 5. 1.1a T X ⊃ Y 6. 1.1a T X 7. 1.1a T ¬Kb ¬Kb ¬Y 8. 1.1a F Kb ¬Kb ¬Y 9. 1.1a.1b F ¬Kb ¬Y 10. 1.1a.1b T Kb ¬Y 11. 1.1a T Kb ¬Y 12. 1.1a T ¬Y 13. 1.1a F Y 14. , ,
,
, 1.1a F X 15.
l
l
l
l 1.1a T Y
16.
Figure 11. Logic of Knowledge Tableau Example say, k1 , . . . , kn , let us abbreviate Kk1 ϕ ∧ . . . ∧ Kkn ϕ by Eϕ, and read it “everybody knows ϕ.” Then common knowledge of X is, informally, the infinite conjunction X ∧ EX ∧ EEX ∧ EEEX ∧ . . ., which we can represent as CX. Of course this is not a real formula, though it can serve for motivation. Semantically, we want CX to be true at a state if X is true at every reachable state, where a state is reachable if there is some path to it along which each state is accessible from the previous one using any one of the accessibility relations Rki . This seems simple enough, but capturing common knowledge axiomatically involves a fixpoint axiom and a rule of inference that is not obvious, [15]. Common knowledge cannot be captured at all by a conventional cut-free tableau system, [1], and it seems unlikely that it can be captured by a prefixed tableau system either. However, common knowledge applications often fall into two categories: how is common knowledge obtained, and how is common knowledge used given that it has been obtained. Many problems and puzzles involve only the latter, and this is relatively simple. In terms of the illegal equivalence CX ≡ X ∧EX ∧EEX ∧EEEX ∧. . ., obtaining common knowledge is the right-left implication, which has an infinitary antecedent, but using common knowledge involves the left-right implication, and this can be replaced with the legal, though infinite, list CX ⊃ X, CX ⊃ EX, CX ⊃ EEX . . . . In terms of tableaus using, though not obtaining, common knowledge is captured by rules that can deal with occurrences of C in negative positions in formulas being proved (which become positive positions when the formula is signed with F to begin a tableau proof). The rules are in Table 20. They are sound, but not complete, though they are complete with respect to a generalized version of common knowledge. I do not go into this here—see [2] for an investigation of a related system. To show how these rules work, I’ll make use of the familiar muddy children puzzle. There are, say, three children sitting in a circle, call them a, b, and c. Each can see the
Modal Proof Theory
σ T CX σ.na T CX for σ.na used
125
σ T CX σT X
Table 20. Common Knowledge Tableau Rules foreheads of the others, but not their own. Their legal guardian and designated puzzle person puts a spot of mud on each of their foreheads. At this point each child knows that the other two have muddy foreheads, but does not know the status of their own. Then the puzzle person announces, “at least one of you has a muddy forehead.” Note that they already knew this—the effect of the announcement is to make the statement common knowledge. Then they are asked if they know whether or not their forehead is muddy. They do not, and say so. They are asked again, with the same result. They are asked a third time, and all know their forehead is muddy. The problem is to account for this. To formalize this, let A have the intended meaning, the forehead of a is muddy, and similarly for B and C. At the start, each knows the set-up, so it is common knowledge that each knows the status of the others foreheads. That is, we have the following. C(Ka B ∨ Ka ¬B) C(Ka C ∨ Ka ¬C) C(Kb A ∨ Kb ¬A) C(Kb C ∨ Kb ¬C) C(Kc A ∨ Kc ¬A) C(Kc B ∨ Kc ¬B)
(12) (13) (14) (15) (16) (17)
Let S be the formula asserting that someone knows the status of their forehead: Ka A∨ Ka ¬A ∨ Kb B ∨ Kb ¬B ∨ Kc C ∨ Kc ¬C. Also let P ⊃ Q abbreviate ¬(P ⊃ Q). Now, at the start it is announced that someone has a muddy forehead, A ∨ B ∨ C. Everybody hears the announcement and sees that everyone heard, and so common knowledge is obtained: C(A ∨ B ∨ C). Then it is asked if anyone knows the status of their forehead, and they do not, so C(A ∨ B ∨ C) ⊃ S. Since everyone hears the answers, this is common knowledge for the next round, C(C(A ∨ B ∨ C) ⊃ S). But still nobody knows, and so C(C(A ∨ B ∨ C) ⊃ S) ⊃ S, and this is common knowledge for the next round, C(C(C(A ∨ B ∨ C) ⊃ S) ⊃ S). This time everybody knows their forehead is, in fact muddy. This is expressed by the following. C(C(C(A ∨ B ∨ C) ⊃ S) ⊃ S) ⊃ (Ka A ∧ Kb B ∧ Kc C)
(18)
Formally, (18) is a consequence of (12) – (17) as local premises, assuming no more than T knowledge for each knower. A tableau proof can be found in Figure 12 of C(C(C(A ∨ B ∨ C) ⊃ S) ⊃ S) ⊃ Ka A. In it some simple derived rules have been used. One is: conclude σ T X and σ F Y from σ T X ⊃ Y , which simply omits the step involving the definition of ⊃. The other is: conclude σσ T X from σ T CX, where σσ is any prefix that extends σ and occurs on the branch. This is a simple combination of the two rules given earlier for C. In the tableau: 2 and 3 are from 1 by α; 4 is from 3 by π a ; 5 is from
126
Melvin Fitting
2 by the derived C rule; 6 and 7 are from 5 by the derived ⊃ rule; 8 is from 7 by α and the definition of S; 9 is a premise; 10 is from 9 by the derived C rule; 11 and 12 are from 10 by β; 13 is from 11 by T c ; 14 is from 8 by π c ; 15 is from 12 by ν c ; 16 is from 15 by negation; 17 is from 6 by the derived C rule; 18 and 19 are from 17 by the derived ⊃ rule; 20 is from 19 by α and the definition of S; 21 is a premise; 22 is from 21 by the derived C rule; 23 and 24 are from 22 by β; 25 is from 23 by T b ; 26 is a premise; 27 is from 26 by the derived C rule; 28 and 29 are from 27 by β; 30 is from 28 by T b ; 31 is from 20 by π b ; 32 is from 24 by ν b ; 33 is from 32 by negation; 34 is from 29 by ν b ; 35 is from 34 by negation; and 32 is from 18 by the derived C rule. Closure is by 4 and 13; 16 and 25; 14 and 30; and 31, 32, 33, 35 and applications of the β rule. In the version of the puzzle embodied in (18) the assumption was that everybody had a muddy forehead. If only two do, say a and b, those who have muddy foreheads know this on the second round. Here is an expression of this. ¬C ⊃ [C(C(A ∨ B ∨ C) ⊃ S) ⊃ (Ka A ∧ Kb B)]
(19)
This, too is provable using the tableau rules given above, but now we must assume the S5 rules for knowers a and b. On the other hand, the two children a and b can see the forehead of c, know it is not muddy, and can see each other and so know that they both know it, and so on. That is, ¬C is not just true, it is common knowledge between a and b. If the antecedent ¬C in (19) is replaced by this relativized common knowledge assumption, whose proper formulation I’ll leave to you, S5 rules are not needed. The methods extend to n children with k muddy, but you doubtless get the general idea. 10
CONVERSE
Suppose we have a model M = G, R, V with a single accessibility relation, but two modal operators, say and −1 . Let us say has its usual interpretation, M, w X if M, w X for all w ∈ G with wRw , but suppose −1 is understood via M, w −1 X if M, w X for all w ∈ G with w Rw. The difference is easy to miss: uses R, but −1 uses the relation converse to R, often written R−1 . This gives us a natural multimodal logic, but with the modalities intimately connected. One place where such things come up is temporal logic—future and past are converse in this sense. Another place is CPDL, propositional dynamic logic with converse. I don’t want to get into these topics here (see [32, 35]) but if we assume a simple underlying modality, K, T, or something of this sort, a tableau system capable of dealing with converse is not complicated. I will discuss it briefly in this section—it is based on the treatment in [30]. See [6] for an axiomatic version. The simplest way to approach the subject is to build on earlier work. Suppose we use a logic of knowledge with two knowers, a and b, and from now on identify Ka with and Kb with −1 . Then, for starters, we want the tableau rules from Table 18, or perhaps from Table 19 too if more complex assumptions about are being made. Converseness is a relationship between our two knowers, of the sort discussed at the end of Section 9. It can be captured by the following tableau rules. σ.na ν b σ ν0b
σ.nb ν a σ ν0a
Modal Proof Theory
1 F C(C(C(A ∨ B ∨ C) ⊃ S) ⊃ S) ⊃ Ka A 1 T C(C(C(A ∨ B ∨ C) ⊃ S) ⊃ S) 2. 1 F Ka A 3. 1.1a F A 4. 1.1a T C(C(A ∨ B ∨ C) ⊃ S) ⊃ S 5. 1.1a T C(C(A ∨ B ∨ C) ⊃ S) 6. 1.1a F S 7. 1.1a F Kc C 8. 1 T C(Kc A ∨ Kc ¬A) 9. 1.1a T Kc A ∨ Kc ¬A 10.
127
1.
, l
,
,
,
1.1a T Kc A 11. 1.1a T A 13.
l l
l
1.1a T Kc ¬A 12. 1.1a.1c F C 14. 1.1a.1c T ¬A 15. 1.1a.1c F A 16. 1.1a.1c T C(A ∨ B ∨ C) ⊃ S 17. 1.1a.1c T C(A ∨ B ∨ C) 18. 1.1a.1c F S 19. 1.1a.1c F Kb B 20. 1 T C(Kb A ∨ Kb ¬A) 21. 1.1a.1c T Kb A ∨ Kb ¬A 22.
, ,
,
,
1.1a.1c T Kb A 23. 1.1a.1c T A 25.
l
l
l l
1.1a.1c T Kb ¬A 24. 1 T C(Kb C ∨ Kb ¬C) 26. 1.1a.1c T Kb C ∨ Kb ¬C 27.
,
,
, ,
1.1a.1c T Kb C 28. 1.1a.1c T C 30.
l
l
l
l
1.1a.1c T Kb ¬C 29. 1.1a.1c.1b F B 31. 1.1a.1c.1b T ¬A 32. 1.1a.1c.1b F A 33. 1.1a.1c.1b T ¬C 34. 1.1a.1c.1b F C 35. 1.1a.1c.1b T A ∨ B ∨ C 32.
Figure 12. Muddy Children Puzzle
128
Melvin Fitting
I think we’re at a point where I can omit soundness and completeness arguments. Table 21 shows a simple proof in this system, of P ⊃ Kb K a P . In it, 2 and 3 are from 1 by α, 4 is from 3 by π in Table 18; 5 is from 4 by a ν rule above. 1 F P ⊃ Kb K a P 1 T P 2. 1 F Kb K a P 3. 1.1b F K a P 4. 1 F P 5.
1.
Table 21. Converse Modality Tableau Example
11
THE UNIVERSAL MODALITY AND THE DIFFERENCE MODALITY
Logics of knowledge combine many ‘ordinary’ modal operators, but there has been considerable investigation of the effects of adding special, expressive, modal operators to a standard modal logic. Two of these that are especially powerful and interesting are the universal modality, also called the global modality in [6], and the difference modality. Discussion of, and axiomatization for both can be found in [6]. Suppose we have a multi-modal logic L of the kind considered in Section 9, in which the individual modal operators are among those of Table 15, or K of course. That is, we have a prefixed tableau system for L. The universal modal operator, written E, is a kind of possibility operator that can be read “somewhere.” That is, EX informally asserts that X holds at some possible world. Note that the accessibility relation plays no role in this. The dual necessity-like operator is written A. In a model M for L with these operators added, we want the following conditions. M, w EX ⇐⇒ M, w X for some w ∈ M M, w AX ⇐⇒ M, w X for every w ∈ M To provide prefixed tableau rules for these operators, we need a small extension of the system in Section 9. There a prefix was a sequence of the form 1.n1 a1 .n2 a2 . . . ., beginning with 1. From now on prefixes can begin with any positive integer. The nu/pi definition is extended in the obvious way, in Table 22. ν T AX F EX
ν0 TX FX
π T EX F AX
π0 TX FX
Table 22. Universal Modality Nu and Pi Formulas The tableau rules for E and A are given in Table 23. These are to be added to the rules for the other modal operators of L. Soundness and completeness proofs are not difficult, and I omit them. I make one observation, however. It is easy to see that models produced by earlier completeness
Modal Proof Theory
σν σ ν0 for σ used
129
σπ n π0 for n new
Table 23. Universal Modality Tableau Rules
proofs for prefixed tableau systems all have a tree structure, since that is the syntactical structure of prefixes. This is no longer the case when the universal modality is present. Instead models are more like forests—sets of trees. The difference modality, also read as elsewhere, is a possibility-like operator, too. The formula DX informally can be read as asserting that X holds somewhere else. There is, of course, a dual operator, but since the tableau rules take a somewhat more complex form, I won’t consider it. Once again, a discussion and axiomatization for this operator can be found in [6]. As to prefixed tableau rules, the addition to L given in Table 24 will do.
T nX
T σ1 X
T σ DX T σ2 X
···
T σk X
F σ DX F σ X
In the T rule: n is a new integer, and σ1 , . . . , σk are all prefixes used on the branch other than σ. In the F rule: σ is any prefix used on the branch other than σ. Table 24. Difference Modality Tableau Rules Figure 13 displays a sample proof using these rules, of DDP ⊃ (P ∨ DP ), which is one of the axioms for D in [6]. In it, 2 and 3 are from 1 by α; 4 and 5 are from 3 by α; 6 is from 2 by the T D rule (note that at this point there are no prefixes on the branch other than 1, and 2 is new); 7 and 8 are from 6 by the T D rule (3 is new, and 1 is the only prefix on the branch other than 2); 9 is from 5 by the F D rule. 1 F DDP ⊃ (P ∨ DP ) 1. 1 T DDP 2. 1 F P ∨ DP 3. 1 F P 4. 1 F DP 5. 2 T DP 6. , l , l , ll , 3 T P 7. 1 T P 8. 3 F P 9. Figure 13. Prefixed Difference Modality Tableau
130
Melvin Fitting
12
WHAT ARE THE LIMITATIONS
Going beyond the logics we have looked at so far are those using a fixpoint construction. That is, in the semantics some modal operator is modeled by a device that involves minimizing (or maximizing) some monotone operator on the set of possible worlds. Such logics are very powerful, and very resistant to tableau methods. It is an area needing further research. Here is a brief rundown of the most common fixpoint logics. Propositional dynamic logic is, perhaps, the original example, see [35] for a thorough treatment. In this multi-modal logic, modal operators correspond to computer programs. The semantical treatment of the while operator requires a fixpoint construction. From early on there was a tableau system for the logic, [51]. It is, however, of a specialized nature that so far has not lent itself well to treatment by the general methodologies of this chapter. Propositional dynamic logic was extended to the propositional μ-calculus in [41], with modal operators in the language corresponding directly to fixpoint constructions. I do not know how to bring tableau methods to bear. Finally, common knowledge was discussed above, in Section 9.2. It was made clear that the tableau rules given were only for using common knowledge, and could not handle its acquisition. Common knowledge is yet another example of a fixpoint modality, and another example of one for which satisfactory tableau rules do not exist. 13
QUANTIFIED MODAL LOGIC
As if propositional modal logic wasn’t complicated enough, each one can be extended to a first-order version in a multiplicity of ways [28, 37, 26]. For starters, domains of quantification can be different at different worlds, or the same at all worlds, or related in ways that depend on relative accessibility. When each possible world has its own domain of quantification, one can think of these domains as representing what exists at each world. In this case quantifiers are actualist—they quantify over what actually exists. When the domain of quantification is the same for all worlds, one can think of the common domain as the realm of possible existents. Then quantifiers are possibilist. These two versions correspond to well-established philosophical positions, but this is not the place to discuss them. As it happens, constant domain, possibilist quantification is the easiest to capture using prefixed tableaus. And, as it happens, varying domain semantics can be embedded into a constant domain version easily and naturally. So, in this section I’ll briefly sketch prefixed tableau systems for constant domain, possibilist versions of the propositional modal logics that were treated earlier, and then say a little about other versions of quantified modal logic.
13.1 Syntax and Semantics We need a first-order language. I’ll assume we have relation symbols of arity 1, 2, . . . . In the interests of simplicity, there will be no constant or function symbols. I’ll also assume there is an infinite list of variables. Atomic formulas are expressions of the form P (v1 , . . . , vn ) where P is a relation symbol of arity n, and v1 , . . . , vn are variables. Formulas are built up from atomic formulas in the usual way, using modal operators ( and ♦ only, for the time being), propositional connectives, and quantifiers. I’ll take both
Modal Proof Theory
131
∀ and ∃ as primitive in this section. I’ll assume the notion of free and bound variable is understood, and so the notion of closed formula, or sentence. A constant domain model is a structure M = G, R, D, I where: G, R is a frame as before; D is a non-empty set, the domain of quantification; and I is an interpretation, assigning to each n-ary relation symbol P and each possible world w an n-place relation I(P, w) on D. We are primarily interested in the behavior of sentences, but formulas with free variables come into things, so we need one more piece of machinery. A valuation in a model M = G, R, D, I is a mapping v from the set of variables to the domain, D, of the model. The chief semantic notion is symbolized M, w v X and is read: formula X is true at world w of model M with respect to valuation v. The definition follows. In it, a valuation v is an x-variant of a valuation v if the two valuations agree on all variables except possibly x. Atomic M, w v P (x1 , . . . , xn ) if and only if v(x1 ), . . . , v(xn ) ∈ I(P, w) Negation M, w v ¬X if and only if not-M, w v X Propositional Connectives M, w v X ∧Y if and only if M, w v X and M, w v Y , and similarly for the other connectives. Necessity M, w v X if and only if M, w v X for every w ∈ G with wRw . Possibility M, w v ♦X if and only if M, w v X for some w ∈ G with wRw . Universal Quantifier M, w v (∀x)ϕ if and only if M, w v ϕ for every valuation v that is an x-variant of v. Existential Quantifier M, w v (∃x)ϕ if and only if M, w v ϕ for some valuation v that is an x-variant of v. As might be expected, if X has no free variables, M, w v X for some valuation v if and only if M, w v X for every valuation v. Consequently we can speak of the truth or falsity of a sentence at a world in a model without mentioning the valuation. I’ll say a sentence X is L valid, where L is some normal modal logic determined by a class of frames, if X is true at every world of every model G, R, D, I such that G, R is an L frame, for every non-empty domain D and every interpretation I.
13.2
Constant Domain Tableaus
The goal is to extend the tableau systems of Section 6 to take constant domain quantification into account. As it happens, this is accomplished easily by a combination of modal rules and standard tableau quantification rules, [22, 57]. Tableau proofs will be of sentences only. As usual in treatments of first-order logic, there will be a version of existential instantiation—if (∃x)P (x) is true then P (x) is true for some value of x, so we introduce a symbol intended to designate such a value. For this purpose there is a second list of variables, disjoint from the first. These new variables are called parameters. Formulas with parameters as free variables play a role in proofs, but they have no part in what we are trying to prove. From now on, by sentence I mean a closed formula none of whose variables are parameters.
132
Melvin Fitting
Let L be one of the propositional modal logics for which a prefixed tableau system was given in Section 6. For a constant domain, first-order version of this we use the propositional rules for L from before, and add to them rules for quantifiers. To make it easier to state the new rules, two new formula classifications are introduced, following [57]. In giving them, I’ll adopt the following convention. If I write ϕ(x) it is intended to represent a formula in which at most x may occur free; then a subsequent occurrence of ϕ(p) represents the result of substituting the parameter p for every free occurrence of x in ϕ(x). Note that since parameters cannot be quantified, we needn’t worry about ‘accidental’ capture of p in such a substitution. Now, Table 25 contains the new formula cases, and Table 26 gives the new tableau rules. The γ rule allows any parameter to be used, while the δ rule requires a parameter that is new to the branch. γ T (∀x)ϕ(x) F (∃x)ϕ(x)
γ(p) T ϕ(p) F ϕ(p)
δ(p) T ϕ(p) F ϕ(p)
δ T (∃x)ϕ(x) F (∀x)ϕ(x)
Table 25. Gamma and Delta Formulas σγ σ γ(p) for any p
σδ σ δ(p) for p new
Table 26. Quantifier Rules Figure 14 displays a proof of (∀x)P (x) ⊃ (∀x)P (x), an instance of the Barcan formula, using the propositional K rules. In it, 2 and 3 are from 1 by α; 4 is from 3 by π; 5 is from 4 by δ (p is a new parameter); 6 is from 2 by γ; 7 is from 6 by ν. 1 F (∀x)P (x) ⊃ (∀x)P (x) 1 T (∀x)P (x) 2. 1 F (∀x)P (x) 3. 1.1 F (∀x)P (x) 4. 1.1 F P (p) 5. 1 T P (p) 6. 1.1 T P (p) 7.
1.
Figure 14. Prefixed K Barcan Formula Proof
13.3
Soundness and Completeness
By now several soundness and completeness arguments for tableau systems have been given. I think we are at the point where we can be somewhat more terse. A set S of quantified formulas is satisfiable if there is a model M = G, R, D, I , a valuation v, and a mapping n from the prefixes in S to possible worlds in M, such that if σ T X ∈ S then M, n(σ) v X and if σ F X ∈ S then M, n(σ) v X. A tableau branch is satisfiable if
Modal Proof Theory
133
the set of formulas on it is, and a tableau is satisfiable if some branch is. A proof that tableau rule applications preserve satisfiability can be left to you. The new thing here is the quantifier rules, and they are handled exactly as with standard classical tableau arguments. Once this is established, soundness is by the usual argument. Completeness is a mix of modal and classical techniques. To keep the discussion uncluttered, I’ll assume the underlying logic is K; adapting the argument to other logics that have prefixed tableau systems is straightforward. For starters, the Lindenbaum construction of (1) and (6) needs to be ‘doubly Henkinized,’ to take care of both prefixes and quantifiers. I’ll work with formulas that can contain free variables, but they must all be parameters. Call a set S of prefixed signed formulas ∃-complete provided, if σ δ ∈ S then for some parameter p, σ δ(p) ∈ S. The notion of π-completeness was defined in Section 6.2, as was the notion of omitting infinitely many integers. S omits infinitely many parameters if the set of parameters not occurring in formulas of S is infinite. We still say a set S is K-consistent if no K-tableau for a finite part of S is closed (though now the tableau rules include those for quantifiers). Every K-consistent set S of prefixed formulas that omits infinitely many integers and omits infinitely many parameters can be extended to a set that is maximally K-consistent, πcomplete, and ∃-complete. This can be done via the following modification of the earlier construction, (6). Double Lindenbaum-Henkin Construction Suppose S is a K-consistent set of prefixed sentences. Enumerate the prefixed signed formulas of the language, σ1 X1 , σ2 X2 , . . . , whose only free variables are parameters, and define the following sequence of sets. S1 = S ⎧ if K-consistent and Xn is not π or δ Sn ∪ {σn Xn } ⎪ ⎪ ⎪ ⎪ ⎨ Sn ∪ {σn π, σn .k π0 } if K-consistent, Xn is π, and σn .k is new Sn ∪ {σn δ, σn δ(p)} if K-consistent, Xn is δ, Sn+1 = ⎪ ⎪ and p is a new parameter ⎪ ⎪ ⎩ otherwise Sn (20) I’ll leave it to you to check that ∪n Sn is maximally K-consistent, and both π-complete and ∃-complete. Now tableau completeness follows easily. Suppose the sentence X is not provable using the constant domain K-tableau rules. Then {1 F X} is K-consistent, omits infinitely many parameters (all of them), and omits infinitely many integers. Extend it to a maximally K-consistent, π-complete, ∃-complete set S. Define a model M =
G, R, D, I as follows. G is the set of prefixes in S. For σ and τ in G set σRτ if τ = σ.n for some n. This much is exactly as in Section 6.2. Let D be the set of parameters. For an n-place relation symbol P , I(P, σ) = { p1 , . . . , pn | σ T P (p1 , . . . , pn ) ∈ S}. Now that we have a model, we need a version of the truth lemma, which for propositional prefixed tableaus took the form of (7). The version we need now is the following. σ T Z ∈ S =⇒ M, σ v Z for some v σ F Z ∈ S =⇒ M, σ v Z for some v
(21)
This is proved by induction on Z. I leave the argument to you. But the consequence
134
Melvin Fitting
is that the unprovable sentence X is falsified in this model, at world 1. Thus we have completeness for quantified K. Extending the argument to other logics is an exercise.
13.4 Variations In the previous section I presented, in some detail, prefixed tableaus for constant domain K, and in outline versions for other constant domain logics. The other extreme is to have a semantics with varying domains, with no special conditions imposed on these domains. Thus, domains from different possible worlds might be disjoint, overlap, coincide, whatever. Recall, varying domain semantics is appropriate for actualist quantification, while constant domain semantics corresponds to possibilist quantification. One way of developing prefixed tableaus for varying domain semantics is to introduce a different set of parameters for each prefix. This approach is worked out in detail in [26]. There is, however, a much simpler approach, one that builds directly on what has already been done here. Let us introduce a special one-place relation symbol, E, and read E(x) informally as x actually exists. And let us also introduce relativized quantifiers: (∀E x)ϕ abbreviates (∀x)[E(x) ⊃ ϕ], and (∃E x)ϕ abbreviates (∃x)[E(x)∧ϕ]. If we use these relativized quantifiers, with the prefixed tableau rules given above, the result corresponds exactly to varying domain semantics. Loosely speaking, it is the interpretation of the E predicate, which can change from world to world, that gives us the effect of varying domains. What was just said is not entirely accurate. One generally takes domains of quantification to be non-empty. The approach outlined above does not impose such a requirement, since the interpretation of E at a world might, in fact, be empty. But there is a simple way around this. Recall how local and global premises were used in propositional prefixed tableaus—see the end of Section 6.1. The same thing works even with quantifier rules added. So, if we want only non-empty domains, we just take (∃x)E(x) as a global premise, which means σ T (∃x)E(x) can be added to any tableau branch, for any prefix already present. Other conditions are sometimes imposed on varying domains. Monotonicity is a common assumption: if wRw then the domain associated with world w is a subset of that associated with world w . Anti-monotonicity is also used occasionally, if wRw then the domain associated with w is a subset of that associated with w. Both can easily be incorporated into the present approach. For monotonicity, take (∀x)[E(x) ⊃ E(x)] as a global premise. For anti-monotonicity, use (∀x)[♦E(x) ⊃ E(x)] as a global premise. As an example, in Figure 14 there is a proof of the Barcan formula, using possibilist quantification. Try and prove the corresponding actualist quantification version, (∀E x)P (x) ⊃ (∀E x)P (x). You can’t, with or without (∃x)E(x) as a global premise. But it is provable if we assume anti-monotonicity, taking (∀x)[♦E(x) ⊃ E(x)] as a global premise. A proof can be found in Figure 15. In this, 2 and 3 are from 1 by α; 4 is from 3 by π; 4 is 4 unabbreviated; 5 is from 4 by δ; 6 and 7 are from 5 by α; 2 is 2 unabbreviated; 8 is from 2 by γ; 9 and 10 are from 8 by β; 11 is a global premise; 12 is from 11 by γ; 13 and 14 are from 12 by β; 15 is from 13 by ν; 16 is from 10 by ν. Closure is by 6 and 15, 9 and 14, 7 and 16. In the same way that possibilist quantifiers and quantification rules were added to mono-modal logics, they can be added to a multi-modal logic such as one of the logics of knowledge discussed in Section 9. Indeed, one could even introduce an actually exists
Modal Proof Theory
135
predicate for each knower, Ea , and give each modality its own domain of quantification at each world. But I think we have taken things far enough. 1 F (∀E x)P (x) ⊃ (∀E x)P (x) 1 T (∀E x)P (x) 2. 1 F (∀E x)P (x) 3. 1.1 F (∀E x)P (x) 4. 1.1 F (∀x)[E(x) ⊃ P (x)] 4 . 1.1 F E(p) ⊃ P (p) 5. 1.1 T E(p) 6. 1.1 F P (p) 7. 1 T (∀x)[E(x) ⊃ P (x)] 2 . 1 T E(p) ⊃ P (p) 8.
1.
, ,
, , 1 F E(p) 9. 1 T (∀x)[♦E(x) ⊃ E(x)] 1 T ♦E(p) ⊃ E(p) 12.
l l
11.
, l , l , l 1 F ♦E(p) 13. 1 T E(p) 1.1 F E(p) 15.
l l
1 T P (p) 10. 1.1 T P (p) 16.
14.
Figure 15. Anti-Monotonicity and Barcan Formula
14
CONCLUSION
We have reached the end of the chapter, but not the end of the subject. The literature on modal proof theory is vast, and there are many different approaches besides what was covered here. Here is a select list of pointers (for which I thank the reader for this chapter, Heinrich Wansing). There are higher-arity sequent systems, [7]; higherlevel sequent systems, [13]; higher-dimensional sequent systems, [45]. There are display sequent systems, [4, 12, 53, 58, 60], which are particularly appropriate for temporal systems. See [61] for the relationship between these and hypersequents. In addition, there are relational proof systems, [49]; and multiple-sequent systems, [38, 39]. And for general treatments, see [59, 62]. Quantified classical logic generally admits constant and function symbols, and equality. Adding these to quantified modal logic requires choices. Are constant and function symbols to be rigid—having the same designation at each world—or non-rigid? If nonrigidity is the choice, a device called predicate abstraction can be added to help sort out ambiguities that arise. How does one deal with the contingent equality of the number 9 and the number of the planets, but not their synonymy? Such things can, in fact, be dealt with, and prefixed tableau systems exist that can help sort things out. See [26] for
136
Melvin Fitting
a thorough discussion, and [23] for an abbreviated one. Also [25] contains a presentation of a rich first-order system along these lines. After first-order comes second-order, and full type theory. This tends to get enormously complex. Tableau systems for a version of modal type theory can be found in [24]. To a certain extent I have followed my own interests in this chapter. I’ve tried to keep it in control, but I think my biases show. The reader should keep in mind that this is an enormous subject, and my tastes may not be that of others. Start here, don’t finish here. BIBLIOGRAPHY [1] L. Alberucci and G. Jaeger. About cut elimination for logics of common knowledge. Annals of Pure and Applied Logic, 133:73–99, 2005. [2] Sergei Artemov. Evidence-based common knowledge. Technical Report TR-200418, CUNY Program in Computer Science, 2004. http://www.cs.gc.cuny.edu/ sartemov/publications/EBKrevised.pdf. [3] Arnon Avron. The method of hypersequents in the proof theory of propositional non-classical logics. In W. Hodges, M. Hyland, C. Steinhorn, and J. Truss, editors, Logic: Foundations to Applications, pages 1–32. Oxford Science Publications, 1996. [4] N. D. Belnap. Display logic. Journal of Philosophical Logic, 11:375–417, 1982. [5] E. W. Beth. The Foundations of Mathematics. North-Holland, Amsterdam, 1959. [6] Patrick Blackburn, Maarten de Rijke, and Yde Venema. Modal Logic. Cambridge University Press, Cambridge, UK, 2001. [7] S. Blamey and L. Humberstone. A perspective on modal sequent logic. Publications of the Research Institute for Mathematical Sciences, Kyoto University, 27:763–782, 1991. [8] George Boolos. The Unprovability of Consistency. Cambridge University Press, 1979. [9] George Boolos. The Logic of Provability. Cambridge University Press, 1993. Paperback 1995. [10] T. Borghuis. Interpreting modal natural deduction in type theory. In M. de Rijke, editor, Diamonds and Defauots, pages 67–102. Kluwer, Dordrecht, 1993. [11] Marcello D’Agostino, Dov Gabbay, Reiner H¨ ahnle, and Joachim Posegga, editors. Handbook of Tableau Methods. Kluwer, Dordrecht, 1998. [12] S. Demri and R. Gor´e. Cut-free display calculi for nominal tense logics. In Proc. Tableaux ‘99, Lecture Notes in AI, pages 155–170, Berlin, 1999. Springer-Verlag. [13] K. Doˇsen. Sequent systems for modal logic. Journal of Symbolic Logic, 50:149–159, 1985. [14] K. Doˇsen and P. Schroeder-Heister, editors. Substructural Logics. Oxford University Press, Oxford, 1993. [15] R. Fagin, J. Halpern, Y. Moses, and M. Vardi. Reasoning About Knowledge. MIT Press, Cambridge, 1995. [16] F. B. Fitch. Symbolic Logic, An Introduction. The Ronald Press, New York, 1952. [17] Frederick Fitch. Natural deduction rules for obligation. American Philosophical Quarterly, 3:27–38, 1966. [18] Melvin C. Fitting. Tableau methods of proof for modal logics. Notre Dame Journal of Formal Logic, 13:237–247, 1972. [19] Melvin C. Fitting. Proof Methods for Modal and Intuitionistic Logics. D. Reidel Publishing Co., Dordrecht, 1983. [20] Melvin C. Fitting. Destructive modal resolution. Journal of Logic and Computation, 1:83–97, 1990. [21] Melvin C. Fitting. Basic modal logic. In Dov M. Gabbay, C. J. Hogger, and J. A. Robinson, editors, Handbook of Logic in Artificial Intelligence and Logic Programming, number 1, pages 368–448. Oxford University Press, 1993. [22] Melvin C. Fitting. First-Order Logic and Automated Theorem Proving. Springer-Verlag, 1996. First edition, 1990. [23] Melvin C. Fitting. First order alethic modal logic. In Dale Jacquette, editor, A Companion to Philosophical Logic, chapter 27, pages 410–421. Blackwell, Malden, MA, 2002. [24] Melvin C. Fitting. Types, Tableaus, and G¨ odel’s God. Kluwer, 2002. [25] Melvin C. Fitting. First-order intensional logic. Annals of Pure and Applied Logic, 127:171–193, 2004. [26] Melvin C. Fitting and Richard Mendelsohn. First-Order Modal Logic. Kluwer, 1998. Paperback, 1999.
Modal Proof Theory
137
[27] Dov M. Gabbay. Labelled Deductive Systems. Number 33 in Oxford Logic Guides. Oxford University Press, 1996. [28] James W. Garson. Quantification in modal logic. In Dov Gabbay and Franz Guenthner, editors, Handbook of Philosophical Logic, number 2, pages 249–307. D. Reidel, 1984. [29] Gerhard Gentzen. Investigation into logical deduction. In M. E. Szabo, editor, The Collected Papers of Gerhard Gentzen, pages 68–131. North-Holland, 1969. Originally published as ‘Untersuchungen u ¨ber das logische Schliessen’, in Mathematische Zeitschrift 39 (1935), 176–210 and 405–431. [30] G. De Giacomo and F. Massacci. Combining deduction and model checking into tableaux and algorithms for converse-PDL. Information and Computation, 162:117–137, 2000. [31] Kurt G¨ odel. An interpretation of the intuitionistic propositional calculus. In Solomon Feferman, editor, Kurt G¨ odel, Collected Works, Volume One, pages 300–303. Oxford, 1986. Originally published as ‘Eine Interpretation des intuitionistischen Aussagenkalk¨ uls’, in Ergebnisse eines mathematischen Kolloquiums, vol 4, pp 39–40 (1933). [32] R. Goldblatt. Logics of Time and Computation. CSLI Lecture Notes, Stanford, 1987. [33] Rajeev Gor´ e. Tableau methods for modal and temporal logics. 1998. In [11]. [34] J. Y. Halpern and Y. Moses. A guide to completeness and complexity for modal logics of knowledge and belief. Artificial Intelligence, 54:319–379, 1992. [35] D. Harel, D. Kozen, and J. Tiuryn. Dynamic Logic. MIT Press, Cambridge, 2000. [36] Jaakko Hintikka. Knowledge and Belief. Cornell University Press, 1962. [37] G. E. Hughes and M. J. Cresswell. A New Introduction to Modal Logic. Routledge, London, 1996. [38] A. Indrzejczak. Generalized sequent calculus for propositional modal logics. Logica Trianguli, 1:15–31, 1997. [39] A. Indrzejczak. Cut-free double sequent calculus for S5. Logic Journal of the IGPL, 6:505–516, 1998. [40] S. J` askowski. On the rules of suppositions in formal logic. Studia Logica, 1, 1934. [41] Dexter Kozen. Results on the propositional μ-calculus. In E. Schmidt, editor, Proceedings of the Ninth International Colloquium on Automata, Languages, and Programming, Lecture Notes in Computer Science, 140, pages 348–359. Springer, 1982. [42] Richard E. Ladner. The computational complexity of provability in systems of modal propositional logic. SIAM J. Comput., 6:467–480, 1977. [43] A. Leitsch. The Resolution Calculus. Springer Verlag, Berlin, 1997. [44] Zbigniew Lis. Wynikanie semantyczne a wynikanie formalne (logical consequence, semantic and formal). Studia Logica, 10:39–60, 1960. Polish, with Russian and English summaries. [45] A. Masini. 2-sequent calculus: a proof theory of modalities. Annals of Pure and Applied Logic, 58:229–246, 1992. [46] Fabio Massacci. Strongly analytic tableaux for normal modal logics. In Alan Bundy, editor, Proceedings of CADE 12, volume 814 of Lecture Notes in Artificial Intelligence, pages 723–737, Berlin, 1994. Springer-Verlag. [47] M. Ohnishi and K. Matsumoto. Gentzen method in modal calculi I. Osaka Mathematical Journal, 9:113–130, 1957. [48] M. Ohnishi and K. Matsumoto. Gentzen method in modal calculi II. Osaka Mathematical Journal, 11:115–120, 1959. [49] E. Orlowska. Relational proof systems for modal logics. In H. Wansing, editor, Proof Theory of Modal Logic, pages 55–77, Dordrecht, 1996. Kluwer Academic Publishers. [50] F. Paoli. Substructural Logics: A Primer. Kluwer, Dordrecht, 2002. [51] V. R. Pratt. A practical decision method for propositional dynamic logic. In Proceedings of the Tenth Symposium on the Theory of Computation, pages 326–337, 1978. [52] Dag Prawitz. Natural Deduction, A Proof-Theoretical Study. Acta Universitatis Stockholmiensis, Stockholm Studies in Philosophy 3. Almqvist & Wiksell, Stockholm, 1965. [53] G. Restall. An Introduction to Substructural Logics. Routledge, London, 2000. [54] H. Sahlqvist. Completeness and correspondence in the first and second order semantics for modal logic. In Steig Kanger, editor, Proceedings of the Third Scandinavian Logic Symposium, Uppsala 1973, pages 110–143, Amsterdam, 1975. North-Holland Publishing Company. [55] D. Siemens Jr. Fitch-style rules for many modal logics. Notre Dame Journal of Formal Logic, 18:631–636, 1977. [56] Craig Smory´ nski. Self-reference and Modal Logic. Universitext, Springer-Verlag, 1985. [57] Raymond M. Smullyan. First-Order Logic. Springer-Verlag, Berlin, 1968. Revised Edition, Dover Press, New York, 1994. [58] H. Wansing. Sequent systems for normal modal propositional logics. Journal of Logic and Computation, 4:125–142, 1994. [59] H. Wansing, editor. Proof Theory of Modal Logic. Kluwer Academic Publishers, Dordrecht, 1996. [60] H. Wansing. Displaying Modal Logic. Kluwer Academic Publishers, Dordrecht, 1998. [61] H. Wansing. Translation of hypersequents into display sequents. Journal of the IGPL, 6:719–733, 1998.
138
Melvin Fitting
[62] H. Wansing. Sequent systems for modal logics. In D. Gabbay and F. Guenthner, editors, Handbook of Philosophical Logic, number 8, pages 61–145. Kluwer Academic Publishers, Dordrecht, 2nd edition, 2002.
Handbook of Modal Logic – P. Blackburn et al. (Editors) © 2007 Elsevier B.V. All rights reserved.
3
COMPLEXITY OF MODAL LOGIC Maarten Marx
1
Introduction . . . . . . . . . . . . . . . . . . . . . 1.1 Examples of decision problems in modal logic 1.2 A simple and a hard problem . . . . . . . . . 1.3 The model checking problem . . . . . . . . . 1.4 The consequence problem . . . . . . . . . . . 1.5 A tiling logic . . . . . . . . . . . . . . . . . 2 Decision algorithms . . . . . . . . . . . . . . . . . 2.1 Selection of points . . . . . . . . . . . . . . 2.2 Filtration . . . . . . . . . . . . . . . . . . . 2.3 Hintikka set elimination . . . . . . . . . . . . 2.4 Hintikka set elimination without constraints . . 2.5 Forcing exponentially deep paths . . . . . . . 2.6 Tree automata . . . . . . . . . . . . . . . . . 2.7 Pseudo-models . . . . . . . . . . . . . . . . 3 Complexity . . . . . . . . . . . . . . . . . . . . . . 3.1 Computability . . . . . . . . . . . . . . . . . 3.2 Computational complexity . . . . . . . . . . 3.3 The complexity of modal decision problems . 3.4 Reductions . . . . . . . . . . . . . . . . . . 3.5 Tiling . . . . . . . . . . . . . . . . . . . . . 3.6 Language design and complexity . . . . . . . 4 Historical notes . . . . . . . . . . . . . . . . . . . .
1
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
139 140 141 143 145 147 148 149 150 151 153 153 155 158 164 164 165 167 168 168 175 176
INTRODUCTION
This chapter is a basic introduction to the field of computational complexity in modal logic. We are mostly concerned with the following question: given a formula A and a set of formulas C, does there exists a model in which all of C is true at every world and A is true at some world? In other words, is C |= ¬A or C |= ¬A the case? This is the complement of the (global) consequence problem: C |= A (is A true in every model in which all of C is true at every world). The special case of the consequence problem in which C is the empty set is called the validity problem, and its complement is the satisfiability problem. For finite C, the local consequence problem reduces to the validity problem, because of the deduction theorem.
140
Maarten Marx
For many modal logics, these problems are decidable. Here we look at the difficulty of deciding them. This is the topic of the theory of computational complexity. As Wikipedia has it: Computational complexity theory is part of the theory of computation dealing with the resources required during computation to solve a given problem. The most common resources are time (how many steps it takes to solve a problem) and space (how much memory it takes). Complexity theory differs from computability theory, which deals with whether a problem can be solved at all, regardless of the resources required. Standard references to this field are [27] and [32]. Organization. The current section introduces common decision problems in modal logic and derives three useful properties of modal logics. In Section 2 we discuss the basic methods of establishing decidability and complexity results for the satisfiability problem in modal logic. In Section 3 we review the basic notions of computational complexity theory and after that we reduce several tiling problems to modal satisfiability problems in order to obtain lower complexity bounds. These say roughly that —up to a polynomial— one cannot give a better algorithm for the problem at hand. Throughout the text, we hardly give references. We end with some historical notes. Links to Wikipedia. This chapter contains a lot of terminology with which the average logician might not be familiar. We have used links to the relevant Wikipedia entries to facilitate the reader. When viewing this document in a PDF reader, clicking on the highlighted terms should open the relevant Wikipedia page in a browser.
1.1 Examples of decision problems in modal logic This chapter is about solving problems in modal logic. What is a problem? A problem for us is a yes/no question. These problems are typically formalized as set-membership problems. Here are some examples. Suppose first that a logic L is presented as a set of wffs (well formed formulas), as in Chapter 2 of this handbook. Then membership in L is the same as being valid. Thus the validity problem equals the L membership problem. Alternatively, we can define a modal logic as a triple (Wffs, Struc, |=), a set of wffs, a class of models, and a relation between the two. (To be precise, |= is a relation between a model M, a world w and a wff A.) This is essentially the way logics are defined in abstract model theory; see Chapter 1 of this handbook for further discussion. In this richer setting, more natural decision problems show up: Model checking 1. Given a finite model M, is M a member of Struc? 2. Given a finite model M in Struc, a world w in M and a formula A ∈ Wffs, does M, w |= A hold? Satisfiability Given a formula A ∈ Wffs, does there exists a model M in Struc and a world w in M such that M, w |= A hold?
Complexity of Modal Logic
141
Consequence Given a set of wffs C and a wff A, does M |= C implies M |= A for every model M? Model comparison problems Given two finite models, does there exists a bisimulation between the two? Definability Given a set of wffs T and a propositional variable p, does T define p? The latter means that in any model of T , the interpretation of p is uniquely determined by the interpretation of the accessibility relations and the other propositional variables in T . Proof Given a sequence s of wffs ending in A, is s a Hilbert style proof of A in some given axiom system? Note that all these problems can be casted as set membership problems. There are also other types of problems whose complexity can studied, for example, • Given that A → B is a validity, find a Craig interpolant C. • Given a first order formula ϕ(x) which is invariant for bisimulation, find the equivalent modal formula. In the next subsection we have a closer look at the satisfiability problem, the model checking problem and the consequence problem. The wish to compute with models and wffs leads to certain desirable properties for logics. We collect three of these and derive some basic results for logics satisfying these properties. We finish this introduction with an example showing how different the satisfiability problem and the consequence problem may behave.
1.2 A simple and a hard problem Consider a logic L presented as a set of wffs, as in Chapter 2 of this handbook. Then (1) is a natural problem. (1)
Given a string s, is s an element of L?
On close inspection (1) consists of two rather different problems: (2) (3)
Given a string s, is s a wff? Given a wff s, is s an element of L?
Problem (1) is often called the validity problem, the set L being the set of valid wffs. Usually it is stated as (3). One can blur the distinction between (1) and (3) because logics are designed in a certain way. Namely it is assumed that problem (2) is much simpler than problem (3). In fact it is assumed that problem (2) can be solved in a practically feasible manner. Before we make this last notion precise let us look at an example. The wffs of the basic modal language were given by the grammar: ϕ ::= pi | ¬ϕ | (ϕ ∧ ϕ) | 3ϕ. We can see this as shorthand for the following recursive definition, given as a Prolog program: : − integer(I). wff(p I) wff(¬ F) : − wff(F). wff((F ∧ G)) : − wff(F), wff(G). wff(3 F) : − wff(F).
142
Maarten Marx
The set of wffs computed by this program is the least fixed point of this recursive definition. In other words it is the smallest set of strings s such that wff(s) succeeds. Now suppose we run a computer with this program and ask it to determine whether wff(s) is true, for an arbitrary string s. Does it always terminate? And if so, can we estimate beforehand —based solely on the input s— when it will terminate? The first question is answered positively, and we can prove it by induction on the length of the input string. From this proof follows also a positive answer to the second question: The number of recursive calls is bounded by the number of symbols in s. This number is closely connected to the amount of time. For our purposes, it is not really relevant to measure time in seconds. For one thing, computers are getting faster every day, so that would make the results quickly outdated. But however fast a machine, it still has to do a number of “basic computation steps”, given a program. Now, depending on the granularity of our analysis, we determine ourselves what a basic computation step is and what not. In the above example for instance, we may assume that for each string s it takes one computation step to match s with the argument of a head in one of the clauses. Then by induction on the length of s (notation |s|), we can show that the machine needs at most |s| steps to find the answer (exactly |s| in case s happens to be a wff). We say that the time required by the machine is linear in the length of the input, or more informally we say that the program is in linear time. The notation which is often used is O(|s|) (read this as “of the order |s|”). The big O notation is a way of stating bounds that ignores multiplicative constants and low order terms. This is an example of a computation which is practically feasible: the amount of time necessary grows proportionally with the length of the input. Now we look at a program which is not practically feasible. Suppose you are given a propositional formula and the question is whether it is a tautology. This is a typical example of a task that one would like a computer to solve. From a theoretical point of view, the problem is clearly solvable. One can answer the question by writing out the truth table and checking whether the last column contains true in every row. This procedure just tries out all possible truth assignments to the propositional variables and checks whether each of them makes the formula true. The reader should convince him/herself that this check is easy: once a truth assignment is chosen, the check can be done using at most as many steps as the number of subformulas of the input formula. But unfortunately the number of checks grows exponentially with the number of propositional variables in the input. For a formula with n variables, 2n checks have to be made. With some patience (on our side) a computer can carry this out for us. But each time the input formula contains just one more propositional variable, the time we may have to wait doubles. Very rapidly patience alone is not sufficient anymore: even on the fastest computers now available, we would need to wait longer than the lifetime of the universe for input strings containing as many variables as there are characters in this sentence. Thus the procedure is not practically feasible, as it takes time 2O(n) , for n the number of variables. We have seen two examples, a linear and an exponential procedure. The practically feasible algorithms are commonly taken to be the procedures which on any input s terminate in at most p(|s|) steps, where p(x) is a polynomial function in x. So, returning to the beginning, we wanted to solve problem (1) and showed that it splits into two subproblems (2) and (3). We really want to pay attention to problem (3). (In the case of propositional logic, we just saw that (3) seems much harder to solve than (2).) Now if a logic satisfies the following, we can safely ignore (2). Desirable property 1. There exists a practically feasible algorithm which decides for any string whether it is a wff of the logic.
Complexity of Modal Logic
143
One can view the wffs as the data of the logician. In case of logics presented as a set of strings, they are the only data he has. The property states that access to the data is easy.
1.3 The model checking problem As discussed above, a modal logic can also be defined as a triple (Wffs, Struc, |=), a set of wffs, a class of models, and a relation between the two. (To be precise, |= is a relation between a model M, a world w and a wff A.) Given these data, there is one obvious problem: (4)
Given a finite model M in Struc, a world w in M, and a wff A, does M, w |= A hold?
This is often called the model checking problem. In Chapter 1, two procedures are presented which decide this problem for the basic modal language. It was assumed that wffs and models can be encoded as input to a computer program. But it was also assumed that the encodings were correct! That is, they really encoded models and wffs. But just as in the case of problem (1) deciding this is part of the problem. Let’s see in detail how this works. The input of problem (4) consists of three parts 1. a string sM encoding the model M; 2. a string sw encoding the world w; 3. a string sA encoding the wff A. To count as an admissible input to the problem (4) these strings have to satisfy certain properties: (5) (6) (7)
sM encodes a model M and M is an element of Struc; sw is the encoding of a world in M; sA is the encoding of a wff.
Problem (7) gave rise to our first desirable property. It sounds reasonable to ask the same for problem (5): thus we ask for a procedure which takes at most p(|sM |) steps, for some polynomial function p to decide whether 1) the string encodes a model, and 2) whether the model belongs to Struc. The first part is not problematic; if we use reasonable encodings (cf. [1] or [10]) this step is practically feasible. The second part, checking whether the model belongs to Struc, is quite a different matter. Here we do not check a simple property, like whether a string is a wff, or encodes a model. Here we check whether the model belongs to a class of models. This is a problem for which it is not even clear that it is decidable in general. In fact [4] (exercise 6.2.4) asks the reader to create a logic for which this problem is undecidable (a simple cardinality argument suffices to show that there must be classes for which membership is undecidable). In modal logic it is common to define the class of models Struc as the class on which a finite set of modal formulas is valid. That means —if the truth definition is first-order— that the class is defined by a sentence from monadic second-order logic of the following shape: block of universal quantifiers ranging over sets followed by a first order formula in the signature of the accessibility relations of the logic. Intuitively, the language in which we define the class of models influences the complexity of deciding membership in that class: the greater expressivity the language offers, the more difficult it
144
Maarten Marx
can be to decide membership. This intuition is made precise in the field of descriptive complexity theory [23]. Starting with Fagin’s Theorem [12] it turned out that classes of models which are defined by their complexity in deciding membership correspond exactly to classes defined in certain well-known logical formalisms. Fagin’s Theorem states that the following are equivalent, for C a class of finite structures, • membership in C can be decided in non deterministic polynomial time in the size of the input structure; • C is definable by a sentence of existential second-order logic. Problems which can be decided in non-deterministic polynomial time are said to be in NP. Boolean satisfiability is the most prominent example of a problem in NP. As stated above some NP problems are generally believed not to be practically feasible. For more about NP, see Section 3. A class of structures defined by a universal second-order sentence is the complement of a class of structures defined by an existential second-order sentence. The complexity class coNP consists of all problems whose complement is in the complexity class NP. (In computational complexity theory, the complement of a decision problem is the decision problem resulting from reversing the yes and no answers.) Thus Fagin’s Theorem also connects the complexity class Co-NP with universal second-order definability. It is also generally believed that Co-NP hard problems cannot be solved in a practically feasible manner. Desirable property 2. • The class of models of a logical system is definable by a universal second-order sentence. • Equivalently, the class is defined such that checking membership for finite models is in co-NP. The most natural way of defining classes of structures in modal logic —by giving a number of modal axioms— leads in general to an impractical decision procedure. But of course this is the general case. For instance, it is easily seen that checking whether a model satisfies the axiom 3 is practically feasible. In fact, it turns out that most well-known modal logics have a practically feasible model recognition problem, for instance all logics axiomatized by Sahlqvist axioms. This is because for first-order definable classes the membership problem is decidable in polynomial time. In fact this even holds for a powerful second-order extension of it [23]: THEOREM 1 (Immerman–Vardi). Let C be a class of finite structures. If C is defined by a sentence in first-order logic expanded with a least fixed point operator (in notation FO(LFP)), then checking membership in C can be done in polynomial time in the size of the input structure. Compared to Fagin’s Theorem, Theorem 1 only states one (the easy) direction, and not an equivalence. In fact it is still an open problem to find the language corresponding to polynomial time. (Though it is solved on ordered structures: i.e., models which come with a linear order on their domain. Restricted to classes of ordered structures the converse of Theorem 1 holds as well, which is the full Immerman-Vardi Theorem.) In the rest of this chapter we will only deal with modal systems whose class of models is definable in FO(LFP), which implies that membership is decidable in polynomial time.
Complexity of Modal Logic
145
The complexity of |=. Having settled the hairy details, we can finally look at the problem (4). What we really ask here is the complexity of the relation |=. As models and formulas are the data of logic we must be able to access the data, thus we insist that (4) is decidable. How difficult it is to decide (4) in a particular case is a topic carefully studied in finite model theory and in database theory [1, 10]. Note that in the formulation of (4) the complexity is solely due to the expressive power of the language. There is something particular about the design of many modal languages which cause (4) to be practically feasible. We explain that now. As indicated in Chapter 1, the definition of |= is given in terms of first-order logic. As we can see from the standard translation, the basic modal language corresponds to a fragment of first-order logic which contains only two variables. Obviously this is also true when considering more than one modality, but fails when considering polyoadic modalities; see Chapter 5, Section 1.5. But still the meaning of an n-ary modality is defined there using n + 1 variables. So each modal similarity type τ which has a bound n on the arity of its operators corresponds to a n + 1 variable fragment of first-order logic. Note that the definition of modal similarity type is general enough to allow a type with infinitely many modalities, each having a different arity. Such modal languages do not correspond to finite variable fragments. Being a bounded variable fragment seems to be a distinguishing feature of modal languages. There is also a nice complexity theoretic argument for requiring boundedness in terms of variables: the model checking problem for each bounded variable fragment of first order logic is practically feasible, while it is not for full first order logic [38]. THEOREM 2 (Immerman–Vardi). Given a first-order formula ϕ(¯ x) in a fixed bounded variable fragment, a first-order model M and a sequence a ¯ of elements from the domain of M, it is decidable in polynomial time in |ϕ(¯ x)| and |M| whether M |= ϕ(¯ a). This gives us the third desirable property: the definition of |= must be given in terms of a bounded variable fragment of first-order logic. Note that |= could alternatively be defined as the standard translation. Desirable property 3. The definition of |= is given as a polynomial time computable function from the set of wffs to a bounded variable fragment of first order logic. We immediately obtain that in favorable cases the model checking problem is practically feasible. THEOREM 3. Let L be a logical system satisfying the desirable properties 1 and 3. Let its class of models be defined by a FO(LFP) sentence. Then the model checking problem is decidable in polynomial time.
1.4 The consequence problem The consequence problem C |= A is the central problem in logic. Here we restrict to finite C and study its complement: (8)
Given wffs C and A, can A be satisfied on a model M ∈ Struc which globally satisfies C?
Recall that M globally satisfies C if M, w |= C holds for all worlds w in M. We call this problem satisfiability under constraints. Without C we call it simply the satisfiability or local satisfiability problem.
146
Maarten Marx
There is no reason to believe a priori that this problem is decidable for a given modal system, even if it satisfies all design criteria. However there exists a sufficient condition which yields decidability in a straightforward manner. DEFINITION 4. Let f be some computable function. A logical system (Wff, Struc, |=) is said to have the f –bounded model property if for all wffs C, A, it holds that whenever A is satisfiable in a C model (in Struc) it is satisfiable in a C model (in Struc) whose size is bounded by f (|C|, |A|). THEOREM 5. For any logical system having all three desirable properties, and having the f – bounded model property, problem (8) is decidable. Proof. Consider arbitrary wffs C and A. Then by the bounded model property the answer to (8) is yes if and only if there exists a model M in Struc whose size is bounded by f (|C|, |A|) which globally satisfies C and locally satisfies A. Up to isomorphism there are finitely many structures of that size, so we can write a procedure which lists all of them (using some representation). By property 2 we can decide whether a structure is in Struc. By Theorem 2 we can check in polynomial time in f (|C|, |A|), |C| and |A| whether a structure globally satisfies C and locally satisfies A. So we have to make a finite number of such checks, which yields the theorem. ❑ The procedure sketched in the last proof highlights a particular feature of algorithms designed to solve a problem in which one asks for the existence of a certain object. Note that this is the distinguishing feature between problems (4) and (8). In problem (4) we are given three objects, a model, a world and a wff and we have to determine whether they stand in the |= relation. In problem (8) we are just given the constraint C and the wff A and we asked for the existence of a model. The algorithm for problem (8) uses the algorithm for problems (4) and (5) every time it “tries” a model from its long list of candidates. So the algorithm for (8) naturally divides into two parts: • a (difficult) search for the right candidate model; • an (easy) check that the candidate is correct (i.e., the model is in Struc, it globally satisfies C, and locally satisfies A). For these kind of problems a special computational model has been designed which reflects the sketched division of labor. These are called non-deterministic computations. For a nondeterministic computation, the search for the right candidate takes no more time than required to write it down plus the time it takes to check whether a potential candidate is a real candidate. This discussion is captured in the next theorem: THEOREM 6. Let the logical system (Wff, Struc, |=) satisfy all desirable properties. If Struc is defined by an FO(LFP) sentence and the system has the f –bounded model property, then there is some polynomial p such that (8) is decidable by a non-deterministic algorithm taking time p(f (|C|, |A|), |C|, |A|). The proof of Theorem 18 in Chapter 1 can be extended to show that the basic modal logic has the 2(|C|+|A|) bounded model property; see Proposition 10 below. Thus (8) can be decided by a non-deterministic algorithm which takes exponential time in the length of the input. Later on we see that we can do better, the non-determinism is not necessary. We finish the introduction by giving an example of a logic for which (8) is undecidable in general but decidable in nondeterministic polynomial time in the special case when the set of constraints is empty.
Complexity of Modal Logic
1.5
147
A tiling logic
We present an undecidable problem which is particularly well-suited for modal logics. Moreover finite variants of it exist which are useful in proving complexity results as we will see later on. These are the tiling problems. A tile is a one-by-one square which has a ‘color’ on each of its sides; these colors are given by four functions ‘right’, ‘left’, ‘up’ and ‘down’. Given a set T of tiles containing one special tile T0 , a tiling of the grid N × N by T is a map t from N × N to T satisfying, for all n, m ∈ N: t(0, 0) right(t(n, m)) up(t(n, m))
= T0 , = left(t(n + 1, m)), = down(t(n, m + 1)).
Tiles are assumed to be fixed in orientation, so the above conditions say that colors of adjacent tiles match. (We note that it is not required to use all tiles of T in a tiling of N × N.) If such a tiling exist, we say that T can tile N × N. The following problem is undecidable. N × N tiling: Given a finite set T of tiles, can T tile N × N? We will now define a modal system Tile which is tailored to encode the above tiling problem. The language of Tile contains two unary modalities right and up . In a model of the form (W, Rr , Ru , V ), these modalities receive their meaning in the usual way: M, s |= right ϕ M, s |= up ϕ
⇐⇒ ⇐⇒
M, t |= ϕ for some t with Rr st, M, t |= ϕ for some t with Ru st.
The class Struc of models of Tile consists of all models (W, Rr , Ru , V ) in which Rr and Ru are (the graphs of) two commuting total functions. In particular, grid models satisfy the following condition: (9)
∀xyz((Rr xy ∧ Ru xz) → ∃w(Rr zw ∧ Ru yw)).
THEOREM 7. Problem (8) is undecidable for the logic Tile. Proof. We reduce the N × N–tiling problem to the satisfiability problem for Tile. We present a procedure that outputs for every instance T of the tiling problem, wffs CT and AT such that the following are equivalent • T can tile N × N; • there exists a model M in Struc which globally satisfies CT and locally satisfies AT . Take for any set T = {T0 , T1 , . . . , Tk } of tiles a corresponding set {t0 , t1 , . . . , tk } of propositional variables. Let AT be t0 . Define CT as the conjunction of the following formulas (where i ranges over
0,. . . ,k): A1 0≤i≤k ti t A2 → ¬t i j i=j
0≤i≤k [ti → right {tj | right(Ti ) = left(Tj )}] A3 0≤i≤k
A4 [ti → up {tj | up(Ti ) = down(Tj )}] . 0≤i≤k It is almost immediate that T tiles N×N if and only if there exists a Tile model where CT holds throughout and t0 is satisfied at some world. (The reader should verify that in hard direction of the proof property (9) of grid models is crucial.) Thus we have reduced the undecidable tiling problem to problem (8) for the logic Tile. ❑
148
Maarten Marx
We hasten to remark that the undecidability of this system has nothing to do with the fact that we are dealing with more than one modality here; one can easily transform this example into an undecidable modal system in the basic modal language. It is interesting to note that without constraints which hold globally these grid logics become quite harmless. In fact, the grid–like nature of their models ensures that every locally satisfiable formula A is satisfiable in a model whose size is at most (|A| + 1)2 + 1. THEOREM 8. Every locally Tile satisfiable formula A is satisfiable in a Tile model of size at most (|A| + 1)2 + 1. As a corollary, Tile has a local satisfiability problem which is decidable in non-deterministic polynomial time. Proof. Let M satisfy A at s. Let k be the modal depth of A. Thus k ≤ |A|. Let M be the smallest substructure of M which contains s together with all states reachable in at most k (Rr - or Ru -) steps from s and which satisfies property 9. By Lemma 21 in Chapter 1, A is still satisfied in the model M . The size of the universe of M is at most (k + 1)2 . Unfortunately M is not yet a Tile model, because not every state has a Rr and Ru successor. In order to mend this, add one dummy state x to the universe of M and put a link from w to x for all states w (including x itself) that do not have a successor yet. That is, define W + = W ∪ {x}, Rr+ = Rr ∪ {(w, x) | Rr wy for no y in M }, and likewise for Ru+ . Let the valuation stay the same, i.e., define V + (p) = V (p) for all p. The resulting model M+ is a Tile model. Clearly A is still satisfied at s in this new model, since x is ‘too far away’ to have any effect on the truth of A. (The k-bisimulation between M and M is also a k-bisimulation between M and M+ .) This proves the first part of the theorem. The complexity result follows from Theorem 6. ❑ 2 DECISION ALGORITHMS We have seen some very general results and some very basic desirable properties. Now we look at actual algorithms for deciding the satisfiability problem under constraints and the local satisfiability problem for a number of typical cases. All presented decision algorithms are based on the following idea: show that for each wff A, the following are equivalent: (10) (11)
A is satisfiable on a Struc model. There exists a finite structure MA satisfying • a finite number of decidable properties, and • the size of MA is bounded by some function f (|A|).
From the discussion in the previous section it should be clear that decidability of the local satisfiability and the validity problems follow from this. A similar reduction will be given for the satisfiability problem under constraints. Note that an upper bound on the time used by the algorithm follows from 1) the function f and 2) the difficulty of checking the properties on MA . First let’s look at the kind of structures MA we are after and what kind of properties we can expect. In the simplest case we just ask that MA belongs to Struc and MA , w |= A for some world w. Often this is either not possible (for instance, if the logic does not have the finite model property) or MA gets unnecessarily large.
Complexity of Modal Logic
149
For the first case, consider the basic modal language interpreted on models (ω, succ, V ), hence n |= 3A ⇐⇒ n + 1 |= A. Obviously this logic does not have the finite model property as Struc consists of infinite models only. Still using the technique from the proof of Theorem 8 we can show that each satisfiable A is satisfiable at world 0 in a model ({0, 1, . . . , modal depth(A), dummy}, succ , V ), which is linear in |A|. Here succ is the set {(n, n + 1) | n < modal depth(A)} ∪ {(modal depth(A), dummy), (dummy, dummy)}. For the second case consider the same language but interpreted on finite binary trees. Let 3 be interpreted by the first child relation. By the same reasoning as above any satisfiable A can be satisfied at the root of a tree of depth modal depth(A). But a binary tree of this depth contains 2modal depth(A) many leaves! This model contains a lot of useless information. The only important part for the satisfiability of A at the root is its left most branch. So in both cases we could do with a pseudo-model and that is what MA is in general. The relation with some real model can be the identity, it can be a modal depth(A) bounded bisimulation or a more intricate or ad hoc relationship. In principle everything is fine as long as the equivalence between (10) and (11) holds. We will now review the most popular techniques to create structures MA . We interleave the analysis with examples of formulas enforcing large models.
2.1 Selection of points Let A be a satisfiable basic modal wff. Then, by Theorem 22 in Chapter 1, A is satisfiable at the root of a tree of depth at most modal depth(A). This looks like a good candidate for a finite model, the only problem is that it can be infinitely branching. Here selection of points comes in. We first need an important concept: the set of A relevant formulas. All relevant formulas will be subformulas of A; we need a bit extra though. Given a formula B, let ∼B denote the formula C if B is of the form ¬C; otherwise, ∼B is the formula ¬B; we say that a set Σ of formulas is closed under taking single negations if ∼B ∈ Σ whenever B ∈ Σ. This notion enables us to pretend that a finite set is closed under taking negations by treating ∼B as if it were the real negation of B. Now given a set of formulas Σ, let Cl (Σ) be the smallest set of formulas that extends Σ and is closed under taking subformulas and single negations. When A is a formula, we denote the set Cl ({A}) of relevant A formulas by Cl (A); it is easy to see that the cardinality of Cl (A) is linear in the length of A. We call Cl (A) the closure of A. Now let M be the chopped tree of finite depth which satisfies A at the root. For any world w A (w)) as the set {B ∈ Cl (A) | M, w |= B}. Now in M define the A theory of w (notation: θM if we can create a model MA ⊆ M such that root the root of M is still in MA , and A A (w) = θM (w), succ for each w in MA , θM A
then A is still satisfied at the root of MA . We create MA by selecting for each world w just A A (w) = θM (w). Starting at the root, choose, for enough successors in order to ensure that θM A every subformula of A of the form 3ϕ, a successor of the root at which ϕ is true (if such a successor exists at all). Obviously, at most b successors need to be chosen, where b is the number of diamond subformulas of A. Hence, by deleting all successors that were not chosen and their descendants from the model, we obtain a tree model whose branching degree at the root is at
150
Maarten Marx
most b. A simple verification shows that A still holds at the root. Now repeat this process at each of the chosen successors of the root and continue until the leaves of the tree are reached. Obviously A is still satisfied at the root. The result is our desired MA . Clearly conditions root and succ are satisfied and we have shown PROPOSITION 9. Any satisfiable modal formula A can be satisfied at a the root of a finite tree model with the following properties: • the depth is bounded by the modal depth of A, and • the branching degree is bounded by the number of diamond subformulas of A. The number of worlds in this model is exponential in the modal depth of the formula A. It seems that in the worst case such a size is unavoidable. We now show a formula which exemplifies this worst case behavior. We define, for each natural number n, a satisfiable formula A(n) with the following two properties • the size of A(n) is quadratic in n, and • when A(n) is satisfied in any model M at state s, then M contains as a substructure an isomorphic copy of the binary tree of depth n whose root is s. Thus the size of the smallest model satisfying A(n) is exponential in |A(n)|. The idea underlying the definition of A(n) is very simple: take n propositional variables p0 , . . . , pn−1 and write a formula which when satisfied forces a binary branching tree in which every possible valuation on {p0 , . . . , pn−1 } occurs at some leaf. Thus the model certainly contains 2n different states. The formula is constructed using two macros: branch(pi ) and store(pi ) defined as follows: branch(pi ) store(pi )
:= 3pi ∧ 3¬pi := (pi → 2pi ) ∧ (¬pi → 2¬pi ).
The formula A(n) then is given as ⎡ ⎤ (12) branch(p0 ) ∧ 2i ⎣branch(pi ) ∧ store(pj )⎦ , 1≤i
0≤j
in which 2i abbreviates a sequence of i many boxes. The formula works as follows. Suppose M, s |= A(n). Then the branch part of A(n) states that every node t reachable in i R–steps from s has two different successors, one forcing pi and another forcing ¬pi . The store part of the formula states that successors of t created by the branch part satisfy precisely the same proposition letters p0 , . . . , pi−1 as does t. We leave it to the reader to verify that the interplay of the branch and store macros forces a binary tree of depth n, as desired.
2.2 Filtration Let C, A be wffs. Assume that there exists a model M and a world w0 such that M |= C and M, w0 |= A. Now if C contains for instance the formula 3, then M cannot be a finite tree. So the selection of points method does not work in the presence of global constraints. Instead we will choose enough worlds from the model M to create a new small model.
Complexity of Modal Logic
151
We will show that there exists a model M containing 2O(|C|+|A|) many worlds such that A,C (w), for worlds w M |= C and M , w |= A. The model M is defined from the theories θM in M. Thus the domain of M is the set A,C {θM (w) | w in M}.
Note that the worlds in M are sets of formulas. We want to create a model such that each world describes which relevant wffs are true in it. I.e., we want a A,C Truth Lemma For all wffs B ∈ Cl (A, C), for all worlds θM (w), A,C A,C B ∈ θM (w) if and only if M , θM (w) |= B.
The desire to have this truth lemma puts three constraints on the model M : valuation V is defined such that for all propositional variables pi , A,C A,C pi ∈ θ M (w) if and only if θM (w) ∈ V (pi ).
Relation R is defined such that min For all worlds x, if 3B ∈ x, then there exists a world y such that R (x, y) and B ∈ y. max For all worlds x, y in M , for all 3B ∈ Cl (A, C) if R (x, y) then B ∈ y only if 3B ∈ x. The truth lemma can be shown by induction on the length of the wff. It holds for every model M satisfying these three constraints. The first constraint determines the definition of V . For R , we have more freedom. Any relation satisfying both min and max will do. For instance, R can be defined as follows: R (x, y) if and only if for all 3B ∈ Cl (A, C), B ∈ y only if 3B ∈ x. Note A,C (w) which together that when proving the truth lemma we use two properties of the sets θM state that these sets of formulas do not contain blatant propositional inconsistencies: A,C A,C A,C and For B ∧ D ∈ Cl (A, C), B ∧ D ∈ θM (w) ⇐⇒ B ∈ θM (w) and D ∈ θM (w). A,C A,C not For B ∈ Cl (A, C), ∼B ∈ θM (w) ⇐⇒ B ∈ θM (w).
The model M thus obtained is called the filtration of the model M through the set of formulas A,C (w0 ) is a world in Cl (A, C). Note that —by the truth lemma— M |= C, and —because θM A,C M — M , θM (w0 ) |= A. Thus we have shown PROPOSITION 10. If A is satisfiable in a model which globally satisfies C, then A is satisfiable in a model which globally satisfies C and whose set of worlds is bounded by 2O(|C|+|A|) .
2.3 Hintikka set elimination We now give an algorithm which constructs the model whose existence was just shown. The idea comes straight from the proof of the truth lemma. That inductive proof shows that if we can find a set G of subsets of Cl (A, C) such that HS1 every element of G contains C; HS2 there is an element of G which contains A;
152
Maarten Marx
HS3 every element of G satisfies the properties and and not HS4 for every element X of G, for every formula 3B ∈ Cl (A, C), if 3B ∈ X, then there exists a Y ∈ G such that 1. B ∈ Y , and 2. for all 3D ∈ Cl (A, C) if D ∈ Y then 3D ∈ X. then, we can prove the truth lemma, and A is satisfiable in a model which globally satisfies C. The filtration described above shows the other direction: if A is satisfiable in a model which globally satisfies C, then a set G satisfying HS1–HS4 exists. So we describe a procedure which tries to create that set G. Let S0 consists of all sets Δ ⊆ Cl (A, C) which contain C and which satisfy properties and and not. Thus conditions HS1 and HS3 hold for S0 . Clearly S0 can be effectively computed and |S0 | ≤ 2O(|A|+|C|) . We now inductively construct a sequence of sets of sets of formulas S0 S1 S2 S3 · · ·. During this construction we try to find witnesses for diamond formulas. We say that a set X ∈ Si is ready if only for the set X, condition HS4 holds with G replaced by Si . In other words, the set Si contains witnesses for all diamond formulas in X. If every set in Si is ready and Si satisfies HS2, then return ’A is satisfiable in a global C model’. If there is no set in Si containing A, then return the negation of the last statement. Otherwise, let Si+1 consists of all ready sets in Si and continue the construction. Since Si Si+1 , the construction is guaranteed to terminate in at most 2O(|A|+|C|) stages. Why is this algorithm correct? If the algorithm answers ’satisfiable’, then it has found a set of subsets of Cl (A, C) satisfying the four HS conditions. But then we can create a model out of them, just as we did in the filtration. For instance, we can define R to be minimal. Now we use the conditions to show that the truth lemma holds. Conversely, suppose that A is locally A,C (w) | w in M}. It is easy to show that G satisfiable in a C model M. Let G be the set {θM satisfies the four HS conditions, and that the algorithm will never delete any element in G in any of its stages. Thus it will return ’satisfiable’. How many computation steps does this procedure take? It lasts at most 2O(|A|+|C|) stages. At every stage we check whether Si satisfies properties HS2 and HS4. How can we find out how long each check takes? The simplest way is to formalize the whole procedure in terms of first-order logic and use the results about first-order model checking. We can view the power set of Cl (A, C) as the domain of a first order model, which has unary predicates for each formula in Cl (A, C). Then the conditions HS1–HS4 become just first-order conditions on that model. For instance, we have ∀x(P∼B (x) ↔ ¬PB (x)). with PB the unary predicate corresponding to the modal formula B. We have to write as many of such first-order conditions as there are subformulas of A and C. Also note that they can all be written using just two first-order variables. But we know that given a model and a first-order formula in a fixed number of variables, checking whether that formula is true in that model can be done in time polynomial in the size of the model and the formula. But the size of each model corresponding to a set Si is bounded by 2O(|A|+|C|) . So each check can be done in a polynomial number of steps in 2O(|A|+|C|) , which is just 2O(|A|+|C|) many steps. We must make at most 2O(|A|+|C|) many such checks, so the whole algorithm takes 2O(|A|+|C|) many steps. Subsets of Cl (A, C) satisfying HS3 are called Hintikka Sets after Jaakko Hintikka who first employed them.
Complexity of Modal Logic
153
2.4 Hintikka set elimination without constraints The last algorithm is very impractical: it takes exponentially many steps for every input. This is because in the first step it already creates all possible candidates for worlds in the model. When the set of constraints is empty we can do better using a non-deterministic algorithm. The idea is the following. Let A be the formula for which we want to decide whether it is locally satisfiable. Guess a set X ⊆ Cl (A) and check whether it satisfies HS2 and HS3. Suppose it does. Then it is a candidate for the root of a model for A. Now we must check HS4 for X. Instead of finding the witnesses Y in some set of candidates, we create them on the fly. Now the important point is what the structure of these Y should be. As the Y will be placed in a model one step away from the root, it is wasteful to prove the truth lemma for Y for all formulas in Cl (A). In order to prove the truth lemma at the root X, we only need that it holds at Y for the set of formulas Cl {B|3B ∈ Cl (A)}. And so forth for every next level. (We urge the reader to verify this.) This is the idea behind the next algorithm: the further we are away from the root, the less diamond formulas we have to find witnesses for. In fact, the recursion depth of the algorithm is bounded by exactly the modal depth of the input formula A. What the algorithm is really doing is searching for the tree model that we constructed in the selection of points proof given above. The algorithm presented in Figure 1 implements this search for a tree model. We claim that for sets of formulas Δ and Σ such that Σ is closed under taking subformulas and single negations, K–World(Δ, Σ) will be true iff there exists a tree model M such that at the root s, for all B ∈ Σ, (M, s |= B ⇐⇒ B ∈ Δ). This function can be used to solve satisfiability for the basic modal system, since A is satisfiable iff there exists a set Δ ⊆ Cl (A) such that A ∈ Δ and K–World(Δ, Cl (A)) is true. Note that with each recursive call of K-World, the size of the set Σ decreases, since we include formulas of smaller modal depth only. Thus the recursion depth is bounded by the modal depth of the input formula A. That the function is correct can be shown by induction on the size of Σ; we leave this to the reader. Now what about the complexity of this algorithm? Obviously, if we feed it the binary-branching tree formula given below Proposition 9 it needs as many steps as there are nodes in the tree, 2n , for n the number of propositional variables in the formula. But besides the number of steps, we also measure the amount of memory space a machine needs for a specific algorithm. In the Hintikka set elimination algorithm the space used was exponential in the input formula, as the set of all candidates had to be stored. At first sight, the K–World algorithm needs just as much space, as it will create a complete tree model, if it can. But K– World can be implemented in such a way that it only needs to store at most one complete branch of the tree model plus a little storage for administration. The idea is that once it has checked that it can create certain desired witnesses, it can remove those witnesses from memory. It just needs to remember not to do that check again, which is easily implemented. As the length of each branch is bounded by the modal depth of A, the whole algorithm needs a polynomial amount in |A| of memory space. This argument is made precise in Chapter 4.
2.5 Forcing exponentially deep paths Now we will see that global constraints destroy the polynomially bounded depth of paths of the satisfying models for the basic modal system. In particular, we create a globally satisfiable constraint which, when satisfied, forces a branch in the model containing an exponential number of different Hintikka sets. The algorithm sketched in the previous subsection used only polynomial space because the paths in the satisfying model could be kept “short”.
154
Maarten Marx
Assume that Δ and Σ are finite sets of formulas such that Δ ⊆ Σ and Σ is closed under taking subformulas and single negations. K–World(Δ, Σ) if and only if • Δ satisfies properties and and not with respect to Σ, that is, not For B ∈ Σ, either ∼B ∈ Δ or B ∈ Δ. and For B ∧ D ∈ Σ, B ∧ D ∈ Δ ⇐⇒ B ∈ Δ and D ∈ Δ. • for each formula 3B ∈ Δ there is a set ΔB ⊆ Σ such that – B ∈ ΔB , – (∀3D ∈ Σ) : D ∈ ΔB ⇒ 3D ∈ Δ, and – K–World(ΔB , Cl ({D | 3D ∈ Σ})). Figure 1. The function K-World decides K satisfiability.
A simple way of forcing the existence of exponentially deep R-paths is to employ binary counters. By a binary counter we will understand a device that can have natural numbers as values, represented as binary strings of 0s and 1s; one should also be able to increment this value by one. We will use a set {p0 , . . . , pn−1 } of propositional variables to implement an n-ary binary counter (n-ary means that the counter is reset to zero after reaching 2n − 1). We use these variables to encode the n bits of the counter, with p0 encoding the least significant and pn−1 the most significant bit. The variable pi being true in a given state, encodes the fact that the ith bit of the counter is 1 in that state. The key idea to an encoding into the modal language lies in the following characterization of adding 1 to a binary counter. If a = an−1 . . . a0 and b = bn−1 . . . b0 are two n–bit counters, then b = a + 1 (mod 2n ) precisely when the following holds: either bi = 0 and ai = 1 for all i (this is when we start counting at 0 again), or, for some k ≤ n − 1 we have that (1) ak = 0, and bk = 1, (2) aj = 1 and bj = 0 for all j < k, and (3) ai = bi for all i > k. In a picture: 10110 00000 10110
0 0 1 k
1111 0001 0000
a b = a + 1.
We want to write wffs A(n) and C(n) which force a counter to take on all values from 0 to 2n − 1, in consecutive states. In particular, we want that if M |= C(n) and M, s0 |= A(n), then {p ,...,pn−1 } M contains an R-path of length 2n − 1 starting at s0 . Moreover all sets θM0 (si ), for si lying on this path, are different. We take care that the formulas have length only O(n2 ). The formula A(n)expresses the fact that the counter is initially set to 0: ¬p0 ∧ . . . ∧ ¬pn−1 .
Complexity of Modal Logic
155
The formula C(n) will be a conjunction of three wffs which should hold globally in a model. The first conjunct expresses that every state has a successor: 3. The next two conjuncts take care of addition. They express that whenever an R–transition is made in the model the binary counter is increased by one. First the simple case of resetting the counter: (p0 ∧ . . . ∧ pn−1 ) → 2(¬p0 ∧ . . . ∧ ¬pn−1 ). Finally, the last conjunct of C(n) covers the case when we have to ‘carry one’. This conjunct will itself be a conjunction, having a conjunct of the following form for every k such that 0 ≤ k < n: pj ) → 2(pk ∧ ¬pj ) ∧ store(pi ), (¬pk ∧ j
j
i>k
with store(pi ) as defined above and the empty conjunction set to true. We leave it to the reader to check the correctness of this formula. Note that Proposition 9 states that a wff in the basic modal language can only force models with R–paths at most its modal depth. Now the modal depth of C(n) is just two for every n, while the minimal R–depth of models satisfying C(n) is 2n − 1. The difference is that C(n) is a constraint which should hold globally.
2.6 Tree automata The simplest way to see if a formula is satisfiable is to try to construct a model for it. This is what the K-World algorithm does. In fact it constructs a tree model if it can. Having constraints, constructing a tree model has to be done with care as it can become infinite (e.g., if the constraint is 3). In effect one has to detect looping. Looping will occur as the tree is labeled with sets of relevant wffs (the Hintikka Sets) and there are just finitely many of them. We can see the Hintikka Set elimination algorithm as a particular way to implement this. Tree automata (in particular B¨uchi tree automata) are yet another way of dealing with infinite models. We describe those here and relate them to the other approaches. But before we go into them, we briefly look at a related problem: satisfiability on finite trees. Suppose we ask, given A and C, is A locally satisfiable in a finite tree that globally satisfies C? It seems not easy to adjust the Hintikka set elimination algorithm. We can use a tableaux approach (because we can compute a bound on the depth of the trees) but the complexity of it seems horrendous. As it turns out, a tree automaton approach has the right level of abstraction to deal with both infinite and finite trees in a unified manner. Chapter 17 describes the automata-theoretic approach to temporal reasoning. A finite state automaton is a device to recognize (finite or infinite) strings in a given finite alphabet. Every automaton defines a language (a set of strings). The key result about these automata is a characterization theorem: a language L can be defined by a finite state automaton if and only if it can be defined by a regular expression. Recall the model (ω, succ, V ) of the logical system from the introduction of this section. Let V be restricted to Σ, a finite set of propositional variables. Then we can view this model as an infinite string in the alphabet P(Σ), indicating which variables are true at which worlds. The idea of model checking by automata is that for every formula A one creates an automaton AA which accepts exactly those “models as strings” in which A is true at the origin.
156
Maarten Marx
But we can do more with AA . We could try to check if AA can accept any string at all. In other words, if A is locally satisfiable. This is called the emptiness problem of an automaton and for B¨uchi automata this problem is practically feasible. Now finite state automata are fine for linear models, but in general models in modal logic are graphs. A number of interesting modal systems though have the tree model property. Tree automata generalize sequential automata in that they recognize ranked trees. So we can use the same idea as sketched above to decide satisfiability for the basic modal system using tree automata. In fact, tree automata might be used in any situation in which the models have a tree like property. Arguably the most powerful complexity results in modal logic –in particular for systems in which |= has a second-order definition– have been obtained by employing tree automata. We sketch the idea in a simple situation, satisfiability under constraints for the basic modal system. First come the technical notions. Let [n] denote the set {1, . . . , n}. An n-ary Σ-tree T is a labeling of the set [n]∗ by letters from an alphabet Σ. That is, T : [n]∗ −→ Σ. The empty sequence is called the root of the tree. A (non-deterministic) B¨uchi automaton on n-ary trees is a tuple A = (Σ, S, ρ, So , F ) where • Σ is a finite alphabet. • S is a finite set of states. • ρ : S × Σ −→ P(S n ) is the transition function. For each state s ∈ S and letter σ ∈ Σ, it yields the set of possible S labellings of the n successors of state s. • S0 ⊆ S is the set of initial states. • F ⊆ S is the set of final states. A run of an automaton A on a tree T is a labeling of the nodes of T (notation r : T −→ S) by states S such that • the root is labeled by an initial state (that is r() ∈ S0 ), and • the transitions obey the transition function ρ. That is, for each node x we have r(x · 1), . . . , r(x · n) ∈ ρ(r(x), T (x)). A run r : T −→ S is accepting if every branch of r visits F infinitely often. That is, for every branch root, x1 , x2 , . . . of T there are infinitely many i’s such that r(xi ) ∈ F . We will now show how B¨uchi automata relate to our earlier notions and how they are used to decide satisfiability. Let A, C be basic modal wffs. We have seen the following equivalences: 1. A is locally satisfiable in a model which globally satisfies C. 2. There exists a set G ⊆ P(Cl (A, C)) satisfying conditions HS1–HS4. 3. A is satisfiable at the root of an n-ary tree which globally satisfies C. Here n is determined by the number of 3 subformulas in A and C. We can think of the tree in the last item as being labeled by elements of G (telling us immediately which subformulas of A and C are true in which worlds, without having to apply the truth definition). We call this tree model with the extra labels a Hintikka tree for A, C, if the root is labeled with a Hintikka set containing A. So we can add a fourth equivalent statement:
Complexity of Modal Logic
157
(iv) There exists a Hintikka tree for A, C. Now our strategy must be clear. Given A and C we must build an automaton AA,C which takes n-ary trees labeled by subsets of Cl (A, C) as input and accepts if and only if the input is a Hintikka tree for A, C. Then we have a fifth equivalent statement: (v) The set of trees accepted by AA,C is not empty. As checking emptiness can be done in polynomial time (in the size of the automaton), the complexity of the algorithm based on (v) depends on the complexity of the function creating AA,C from A and C. As we will see this takes time bounded by an exponential in |A| and |C|. Thus the size of AA,C is similarly bounded and we obtain an exponential time decision algorithm. We create AA,C as follows. Let G− be the set of subsets of Cl (A, C) satisfying HS1 and HS3. For simplicity we assume that C implies 3, so that every model is infinite. This is easily lifted. Let the number of 3 subformulas in A and C be n. AA,C is a B¨uchi automaton (Σ, S, ρ, So , F ) on n-ary trees with • Σ = S = F = G− . • S0 = {x ∈ G− | A ∈ x}. • ρ is defined as follows. ρ(X, X) is the set of all sequences X1 , . . . , Xn such that 1. for all 3B ∈ X, there is an Xi such that B ∈ Xi , and 2. for all 3D ∈ Cl (A, C), for all Xi , if D ∈ Xi , then 3D ∈ X. On all other inputs, ρ returns the empty set. With all machinery developed so far it is straightforward to show that AA,C accepts a tree T if and only if T is a Hintikka tree for A, C. Thus the decision algorithm based on checking emptiness of AA,C is correct. Now we show how we can check for finite tree satisfiability. Clearly we do not assume that C implies 3 otherwise the problem is already solved. But we do add 3 to the set Cl (A, C). Then we create AA,C as follows: • Σ = S = G− . • S0 is as before. • F = {x ∈ G− | 3 ∈ x}. • ρ is defined for X containing 3 as before and for X ∈ F as ρ(X, X) = X, . . . , X . That is, the automaton gets into a self-loop once it reaches a state which should not have successors. Now, this automaton accepts a tree if and only if T is a Hintikka tree for A, C and every node has a descendant which is the root of a subtree all of its nodes are labeled by one and the same set from F . In a real model we just cut off these subtrees leaving only their roots (which after all say that they do not have successors). Vardi [39] has argued that the tree model property of modal logic is the reason for its robust decidability. Robust means here that expansions of the basic modal language with powerful possibly second-order operators does not destroy decidability. One way to show this is to show that the language is a fragment of the monadic second-order logic of trees, and use the decidability of the latter, which is proved using automata.
158
Maarten Marx
2.7 Pseudo-models The models we constructed so far were not really pseudo-models, in fact they could all be considered as ordinary models. Now we look at two examples in which we shall be working with structures which look very much different from the intended models of the logics. Two dimensional modal logic The first logic that we consider here is —just as the tiling logic— also based on grid-like structures, but here we only require that the models are two-dimensional in nature, there will be no functions around. The language has two diamonds, 30 and 31 , with the standard truth definition. The models are of the form M = (W, ≡0 , ≡1 , V ), where we require that (W, ≡0 , ≡1 ) is in fact a square over some set U . That is, W consists of the set U × U of all pairs over U , while s ≡i t holds if si = ti : the i-th coordinate of s and the i-th coordinate of t should be the same. Denote the resulting system as S52 . As a modal system, S52 might look rather obscure, but as a logic it is well-known. In fact it is the exact modal counterpart of a restricted fragment of first-order logic with two variables in a signature having a binary relation symbol R for every propositional variable r. This is seen as follows. First observe that the S52 model M = (W, ≡0 , ≡1 , V ) with W = U × U is uniquely determined by the set U and the valuation V . Note that for any propositional variable r, V (r) ⊆ U × U , i.e., a binary relation. Thus V can also be seen as an interpretation of the set of binary relation symbols R corresponding to each propositional variable, and we can view (U, V ) as an ordinary first-order model. Also observe that we may identify assignments s mapping the two variables x0 and x1 to U with pairs (s(x1 ), s(x0 )) ∈ W . Thus viewing the states of the modal models as assignments, we may read the statement ‘ϕ holds in (U, V ) under assignment s’ modally as ‘in model (U × U, ≡0 , ≡1 , V ), ϕ is true at state s’. Because S52 models are squares, the truth definition of the diamonds can be rewritten exactly as the definition of the first-order existential quantifiers: M, (a, b) |= 30 ϕ ⇐⇒ there exists a such that M, (a , b) |= ϕ. Thus 3i is another way of writing ∃xi . In a related way, one can define modal systems S5n corresponding to first-order logic with n variables for any n. This is done in the field of cylindric modal logic, see [42, 29, 15]. Note that in this modal system, the local satisfiability and the satisfiability problem under constraints collapse. This is because A is locally satisfiable in a C model if and only iff A ∧ 20 21 C is locally satisfiable. Thus we consider the local satisfiability problem only. That problem is decidable, and a proof for this uses some kind of finite model property as well. Here, instead of defining a finite model for A by selecting points out of the old model, we will identify points in the big model and define the finite model as a sort of quotient structure which we call –as before– filtration of the original model. It will turn out that this filtration will not be a square itself but a square-like structure that we here dub a pseudo-square. This is a model with an underlying frame (W, R0 , R1 ) in which both R0 and R1 are equivalence relations, and their composition should be the universal relation. That is, (W, R0 , R1 ) has to validate (13) R0 and R1 are equivalence relations and ∀xy∃z(R0 xz ∧ R1 zy). For these kind of structures, we can prove the following proposition. (The system also has the bounded finite model property with respect to squares, but this is much harder to establish
Complexity of Modal Logic
159
[31, 18].) As we saw before, decidability follows immediately, because it is decidable whether a finite structure is a pseudo-square (this is a first-order property). PROPOSITION 11. Any S52 -formula A is satisfiable in a square iff it is satisfiable in a pseudosquare of size not exceeding 2|A| . Proof. We concentrate on the left to right direction of this proof since we are only interested in explaining the notion of filtration to a pseudomodel at the moment. (For the other direction of the proof, one shows that given a pseudo-square model, one can always find a square that is bisimilar to it — in fact, bisimilar through a functional bisimulation, see [29]). Suppose that A is satisfied somewhere in the square model M = (W, ≡0 , ≡1 , V ). From this we will prove that A is true somewhere in a filtration Mf of M. As before, as the domain of Mf we take the set of theories: Cl(A)
W f = {θM
(w) | w in M}.
Again we want to prove a truth lemma, so the valuation is now also fixed. What would be a good definition for the relations R0 and R1 on W f ? In general, this is where the filtration method needs some creative input. Now, if the only requirement were that A is to be true somewhere in the resulting model, there is a whole family of definitions that work (in the sense that they ensure that the conditions min and max are satisfied). But the extra constraint, viz., that the resulting model should be a pseudo-square, puts some extra restrictions. In any case, the following definition works: Cl(A)
Ri (θM
Cl(A)
(s), θM
(t)) if for all 3i ϕ ∈ Cl (A): M, s |= 3i ϕ iff M, t |= 3i ϕ.
(The reader should check that this is well-defined.) We can now prove the main claim concerning filtrations, the truth lemma: Cl(A)
(14) for all formulas ϕ ∈ Cl (A), for all θM
Cl(A)
(s): Mf , θM
Cl(A)
(s) |= ϕ iff ϕ ∈ θM
(s).
This claim is proved by a formula induction as before. For the diamond cases, one should check that min and max indeed hold for the given definition of the relations. For min, use the fact that ϕ → 3i ϕ is valid for every ϕ in this logic (because ≡i is a reflexive relation). For max, use the fact that s ≡i t implies that M, s |= 3i ϕ iff M, t |= 3i ϕ. This proves (14), so in order to prove the left to right direction of the Proposition we only have to show that Mf is a pseudo-square. We leave it to the reader to verify that both R0 Cl(A) and R1 are equivalence relations. In order to check the other condition, consider sets θM (s) Cl(A) and θM (t). Now the fact that M is a square and that s and t are pairs comes in handy. Cl(A) Cl(A) Let z = (s0 , t1 ). Then s ≡0 z ≡1 t. But then it follows that R0 (θM (s), θM (z)) and Cl(A) Cl(A) R1 (θM (z), θM (t)), which shows that indeed, the composition of R0 and R1 is the univer❑ sal relation on Mf . The reader might wonder whether we can construct the pseudosquare by a Hintikka Set elimination procedure as well, just as we did with the basic modal system. The only difference is that we have to end up in a pseudosquare, whereas with the basic modal system any model was allowed. But how to implement the check for the condition ∀xy∃z(R0 xz ∧ R1 zy)? Suppose it fails for some Hintikka sets, x, y. Which one should we remove from the set of candidates? It seems we have to consider both possibilities. But then we get an algorithm which takes far longer than the original Hintikka set elimination procedure. Instead of 2|A| many stages we have |A| 22 many. In section 3.5 we will show that indeed this is a harder problem than the satisfiability problem under constraints for the basic modal system.
160
Maarten Marx
The until operator We now consider the modal system given by the propositional language expanded with the binary until operator U, the class of all models of the form (W, R, V ) and an interpretation of U as in the chapter on temporal logic (recalled below). Note that this is not a modal system in the strict sense of Chapter 5 of this handbook, as U has a dual existential–universal definition: M, s |= U(ϕ, ψ) if and only if there exists u such that R(s, u) and M, u |= ϕ and for all t such that R(s, t) and R(t, u) it holds that M, t |= ψ. Our previous methods do not work for this language as they were based on reasoning on trees. It is not hard to see that the formula U(p, ) ∧ ¬U(p, p) is satisfiable but not in a tree. Nevertheless, we will show that this system does have a finite pseudo-model property, and we use this property for showing that it has a decidable satisfiability problem. To start with, let LU be the language obtained by expanding the classical propositional language with the binary connective U. It is convenient to use the following notation: for s and u elements of the domain of some model W , (15) M, su |= ψ iff for all t satisfying Rst and Rtu, M, t |= ψ, because we can now rephrase the truth definition of the until operator as follows: (16)
M, s |= U(ϕ, ψ)
iff
for some u such that Rsu M, u |= ϕ and M, su |= ψ.
Let M denote the class of all models (W, R, V ). We call the resulting modal system (LU , M, |=) the until system. Note that LU is normally interpreted on models in which R is a linear order, but here we disregard this extra complicating factor. Different from our earlier proofs, we will not use any kind of finite model property in order to prove decidability for the until system. This is not because the system does not have the bounded finite model property (it does); our proof method is for didactic purposes. The idea behind the mosaic method is that we construct a finite pseudo-model that we will call a linked set of mosaics. One then has to show that a formula is satisfiable if and only if there exists such a linked set of mosaics for it. What then are mosaics? One could best describe them as little pieces of a model that, if linked together in a nice way, contain sufficient information to construct a real model. Concerning the notion of a mosaic then, the first question is what information we are interested in. This question is easy to answer: as in all previous proofs we are only interested in the truth of subformulas of A. The second question then should be: how large should the little pieces of model be? In all previous proofs, the parts we worked with consisted of just one world. The definition of the until operator makes that this is not enough. We need to define a new concept. Call a subset of the domain of a model M = (W, R, V ) packed if every two distinct elements s and t of the subset are R-related (that is, we require that Rst or Rts). Our patchwork pieces then will be packed sets of size at most three. The number three here derives from the fact that the truth definition of U(ϕ, ψ) employs three variables. In fact, if one would try to devise a standard translation or a bisimulation game for the LU -language, the number three would show up as the minimal number of variables needed and as the minimal size of the windows that cover the models during the game. During a game one would see that these windows will only be placed on packed sets of the models. Note that in a tree model there are no packed sets of size three, only of size two. Also note that in the two dimensional logic the packed sets in a model are exactly the rows and the columns. Abstracting from the origin of these pieces, we arrive at the following definition. From now on we let A be an arbitrary but fixed LU formula. A is the formula whose satisfiability needs
Complexity of Modal Logic
161
to be decided. As usual, we let Cl (A) denote the closure under single negations of the set of subformulas of A. DEFINITION 12. An A-type mosaic is a quadruple μ = (X, R, Aϕ , Bϕ )ϕ∈Cl(A) such that X is a set of size at most three; R and every Bϕ are binary relations on X; and every Aϕ is a unary relation on X. When A is clear from the context, we just use “mosaic”. The basic idea underlying this definition is that Aϕ holds of a point if we ‘want’ ϕ to be true at it, while Bϕ holds of a pair of points if we ‘want’ ϕ to be true at each point between them. Obviously, not every such structure is part of some model — we need some further constraints for that. Call a mosaic coherent if it satisfies the following conditions (phrased in first-order logic and to be read universally): (C0) Rxy ∨ Ryx ∨ x = y (C1) A¬ϕ x ↔ ¬Aϕ x (C2) Aϕ∧ψ x ↔ Aϕ x ∧ Aψ x (C3) Bϕ∧ψ xy ↔ Bϕ xy ∧ Bψ xy (C4) (Rxy ∧ Ryz ∧ Bϕ xz) → Aϕ y (C5) (Rxy ∧ Aϕ y ∧ Bψ xy) → AU(ϕ,ψ) x A few words of explanation: C0 reflects the fact that we only took packed subsets of the model as the domain of our mosaic mini-models. C1–C3 are self-explanatory; note that there is no analog of C1 for the B-predicates since there is a hidden universal quantifier in the meaning of a predicate Bϕ , cf. (15). Finally, C4 and C5 are rather obvious consequences of our intuitive meaning of the A- and B-predicates and the truth definition of the until operator. How difficult is it to check whether an A–type mosaic is coherent, measured as a function of |A|? The size of an A–type mosaic is bounded by a polynomial in |A|. The length of the firstorder formula formalizing coherence is bounded by a polynomial in |A|, and is written using just three (again!) variables. So this check can be made using p(|A|) steps for some polynomial p. The conditions C0–C5 take care of all universal constraints on the A- and B-predicates; but of course there are existential demands as well which we will call requirements. A requirement of a mosaic μ = (X, R, Aϕ , Bϕ )ϕ∈Cl(A) is one of the two following types of object: for s, t ∈ X (a) (AU(ϕ,ψ) , s) such that AU(ϕ,ψ) s, (b) (notBϕ , s, t) such that Rst and not Bϕ st. In order to explain requirements of type (a), suppose that we want the formula U(ϕ, ψ) to be true at a point s; if there is a point t in the mosaic such that Rst, Aϕ t and Bψ st, then the mosaic itself directly fulfills the requirement (by (C5)). This will rarely be the case however; the whole point of the mosaic method is that requirements can be fulfilled by distinct mosaics as well, as follows. A link between two mosaics μ and μ is simply a partial isomorphism between the two structures. We say that a link f : μ → μ fulfills the requirement (AU(ϕ,ψ) , s) of μ if there is some t in μ with Rf (s)t, Aϕ t and Bψ f (s)t. Likewise, a link f : μ → μ fulfills the requirement (notBϕ , s, t) if there is some u in μ with Rf (s)u, Ruf (t) and ¬Aϕ u. A collection L of mosaics is called a linked set of mosaics if every requirement of every mosaic μ ∈ L is fulfilled via some link f : μ → μ to some μ also in L. It is a linked set of mosaics for A if it contains a mosaic with non-empty AA . Given a collection L of A-type mosaics, how difficult is it to check that it is a linked set of mosaics for A? We can view such a collection L as one first-order structure in the same signature as A-type mosaics in which all the mosaics are pairwise disjoint. Then the universe of L is bounded by three times the number of mosaics. Checking coherence of all mosaics can be done using |L| checks each taking p(|A|) computation steps, for a polynomial p. That L is a
162
Maarten Marx
linked set of mosaics for A is a simple first-order statement: ∃xAA (x). But also the existence of partial isomorphisms can be expressed in first-order logic, by a formula in five variables whose length is polynomially bounded by |A|. So the check can be made using a polynomial number of steps in |L| and |A|. Now the main result concerning mosaics is the following. PROPOSITION 13. An LU -formula A is satisfiable if and only if there is a linked set of mosaics for A. THEOREM 14. It is decidable in 2O(|A|) steps whether an LU -formula A is satisfiable. Proof. We can adjust the Hintikka set elimination algorithm given for the system K in order to deal with mosaics. This is done as follows. Let S be the set of all A-type mosaics (up to isomorphism). It is not hard to show that |S| ≤ 2O(|A|) . Let S0 ⊆ S be the subset containing all coherent mosaics. Thus S0 can be computed in polynomial time in |S| ≤ 2O(|A|) and |A|. We now inductively construct a sequence of sets of mosaics S0 S1 S2 S3 · · ·, just as in the proof for the system K∗ . The idea is that we delete mosaics from Si if they have a requirement which can not be fulfilled inside Si . We already showed that the checks to be made at each stage of the algorithm take time polynomial in the size of Si and |A|. As |S| ≤ 2O(|A|) , there are at ❑ most 2O(|A|) stages, thus the whole algorithm can be performed in 2O(|A|) steps. We end with the rather involved proof of the correctness of the algorithm. Proof of Proposition 13 The left to right direction of the proof is easy: suppose that M = (W, R, V ) is a model for A. Out of this model we will cut a linked set of mosaics for A, as follows. Let P be the collection of all packed subsets of W of size at most three. Associate with any set X ∈ P a mosaic μX based on the set X, with R as in M and with every Aϕ and Bϕ defined as given by the truth of ϕ in M. We leave it as an exercise for the reader to verify that the collection of all these mosaics forms indeed a linked set of mosaics. The direction from right to left in the Proposition is the hard one, although the key idea underlying its proof is quite intuitive. We will construct a model for A step by step; that is, we will approximate our model via a series of finite structures that we call networks. A network is a structure N = (W, R, Aϕ , Bϕ )ϕ∈Cl(A) of the same type as a mosaic but not bounded in size. A network is called coherent if it satisfies the conditions C1–C5 above. To ask for C0 would be too much; instead we require coherent networks N to satisfy the following: (liveness) every packed set X of size at most three comes from a mosaic; that is, for each such set X ⊆ W there is a partial isomorphism f : N → μ such that f is defined on X. Liveness means that — through the mosaics — we are in control of certain small parts of the model: the packed sets of size at most three. Why only these sets? The truth definition of U provides the answer. The meaning of U(ϕ, ψ) depends only on these small packed sets in the model. A defect of a network is a requirement that is not directly fulfilled in the network itself, and a network is called saturated if it has no defects. A network is perfect if it is both coherent and saturated. This name is well-chosen, since perfect networks are the ones that we are after. The reason for this is that with every network N = (W, R, Aϕ , Bϕ )ϕ∈Cl(A) we can associate a modal model in an obvious way: it is defined as the structure N ◦ = (W, R, V ◦ ) with V ◦ (p) = Ap for all variables p occurring in A. But only for perfect networks can we prove the following truth lemma.
Complexity of Modal Logic
163
CLAIM 15. If N is a perfect network, then for all formulas ϕ ∈ Cl (A) and all points s, t in N : 1. s ∈ Aϕ iff N ◦ , s |= ϕ, 2. if Rst, then (s, t) ∈ Bϕ iff N ◦ , st |= ϕ. P ROOF OF C LAIM The proof of this claim is by induction on the complexity of ϕ. We only consider the case where ϕ is of the form U(ψ, χ), and only prove part (ii) of the Claim (the first part is simpler). By the induction hypothesis and the truth definition of U, in order to prove (ii) it suffices to show that for all pairs of points s and t such that Rst, we have that (s, t) ∈ Bϕ iff u ∈ Aϕ for some u with Rsu and Rut. The left to right direction immediately follows from the fact that N is perfect and thus all requirements of type (b) are fulfilled. For the other direction, suppose that s, t and u are points satisfying Rst, Rsu, Rtu and u ∈ Aϕ . Observe that {s, t, u} is a packed set of size at most three, whence we may use the (liveness) condition. This yields a partial isomorphism f from N to some mosaic μ such that f is defined for each of s, t and u. It follows that Rf (s)f (t), Rf (s)f (u), Rf (t)f (u) and f (u) ∈ Aϕ ; but then it follows from condition C4 that (f (s), f (t)) ∈ Bϕ . Returning to N this shows that (s, t) ∈ Bϕ , which is what we needed to prove. ❑ From the previous claim it follows that in order to show that A is satisfiable, it suffices to show that there is a perfect network for it, that is, a perfect network such that AA is not empty. CLAIM 16. There is a perfect network for A. P ROOF OF C LAIM The proof of this claim consists of three parts. First we show that there is some network for A (not necessarily perfect). This is easy, since we are given a linked set of mosaics for A: as our network we simply take any mosaic with non-empty AA . The second and main part of the proof consists in showing that any defect of any network can be repaired; that is, we can find a bigger network in which the defect no longer occurs. Without going too much into technical detail, let us see how to repair a defect of type (b) (defects of type (a) are repaired in a similar way). Suppose that s and t are points of the network N such that Rst and not Bϕ st for some subformula ϕ of A, while there is no point u between s and t such that ¬Aϕ u. The idea now is simply to repair this defect by adding a new point to the network. What kind of point? Well, since we have Rst we know that s and t come from a mosaic; that is, there is a partial isomorphism f from N to some mosaic μ. Obviously, (notBϕ , f (s), f (t)) is a requirement of this mosaic. But since we are working in a linked set of mosaics, there must be some link g between μ and μ and some u in μ such that Rg(f (s))u, Rug(f (t)) and ¬Aϕ u. Now simply add an entirely new point r to the network; make sure that the relations between s, t and r are such that this part of the model is isomorphic to μ . It is thus obvious that we have repaired the defect, and that the new structure is a network. In order to keep the liveness condition it is essential not to relate r to any other point besides s and t: in this way the only new packed sets are {r, s, t} and its subsets. Finally, these two parts provide the material and the tools for constructing the desired perfect network for A. Starting from the mosaic for A (which is of course a network), we repair defects, one by one, step by step, thus constructing a sequence N0 , N1 , . . . of networks. Using some standard combinatorics we can ensure that the limit of the chain of networks is a network without defects. In particular, if we always take new points from a fixed set, say ω, we can enumerate the set of all (potential) defects of any network of the chain; if at each step of the construction we
164
Maarten Marx
repair the current network’s defect with the lowest number in this enumeration, we can create a perfect network. ❑
3 COMPLEXITY [27] lists the following as the basic questions of computer science: What is an algorithm? What can and what cannot be computed? When should an algorithm be considered practically feasible? In the previous sections we have —sometimes between the lines— used the available answers to these questions. Before we go back to modal logic we catch a brief glimpse of the theories of computability and computational complexity. Readers familar with this can jump immediately to subsection 3.5.
3.1 Computability What is an algorithm? It is much easier to decide that a certain procedure can be labeled an algorithm than to give a definition. But a definition is needed when we want to prove that no algorithm exists to decide a certain problem. Recall that is what we did with the tiling logic in Section 1.3. Such a definition should be very robust. We would not like that later someone comes up with a procedure for deciding satisfiability under constraints for the tiling logic which we have to accept as an algorithm. As it turned out, the first proposal, now called Turing machine, named after its inventor Alan Turing, was immediately right. For a definition of Turing machines see any complexity or finite model theory textbook or Wikipedia. Every other model of computation that has been defined up to now has been shown to be equivalent to the Turing machine model. The so-called Church Turing thesis, turns these empirical facts into a principle: Church–Turing Thesis. The Turing machine that terminates on all inputs is the precise formal notion corresponding to the intuitive notion of an algorithm. More precisely, for Σ a finite alphabet and S ⊂ Σ∗ a set of Σ-strings, there exists an algorithm for deciding membership of Σ-strings in S if and only if there exists a Turing machine which terminates on all input strings s ∈ Σ∗ and correctly outputs the answer to the question whether s ∈ S. The reader may substitute his preferred sufficiently powerful programming language for Turing machine in the thesis (as each sufficiently powerful language is equivalent in computation power to the Turing machine model). Note that the thesis speaks about all inputs. That is the reason why we had to be so careful in Section 1 when we spoke about the desirable properties of a logic. Everyone with a limited amount of programming experience has created programs which do not terminate on some inputs. Such programs are not useful for deciding a yes/no problem, simply because for the particular input on which it does not terminate we do not get an answer. This is a good place to discuss the notion of semi-decision. A yes/no problem is said to be semidecidable if a program (a Turing machine) exists which terminates on all yes instances and on all no instances it does not terminate. The set of valid first-order sentences is the prime example of such a set. It is semi-decidable but not decidable. Note that if both the yes and the no instances (that is, both “halves” of the problem) are semi-decidable, we can decide the whole language.
Complexity of Modal Logic
165
The reason is that on any input we can start both programs, one which terminates on the yes, and the other which terminates on the no-instances. Whatever instance we have, one program must terminate, so we have a decision procedure. Thus a problem is decidable iff both halves of it are semi-decidable. See [27] for a detailed argument. This is all we want to say about computability. The Church-Turing thesis yields an exact measure between the computable and the non computable problems. There is theory about the difficulty of a problem regardless whether it is a computable or a non computable problem. For instance, we just saw that first-order validity is not computable but still semi-decidable. A natural question is whether there exist even harder problems: those that cannot even be semi-decided. Indeed they do exist, and tiling problems have been developed for these cases as well. For instance, add to the tiling problem an extra special tile T ∗ and ask whether a tiling exists such that T ∗ occurs infinitely often on the first row. The complement of our original tiling problem is semi-decidable (Why? Because we can formalize it in terms of first-order logic!), but this is not true anymore for this extended version. Cf., [22] for further reading. As this chapter is about complexity we now take a closer look at the computable problems.
3.2 Computational complexity In Section 1 we spoke about practically feasible algorithms, and defined them to be those which take at most p(n) computation steps, for p a polynomial function in n with n representing the length of the input. We were rather vague on what constitutes a computation step, but we can now make that precise using the Turing machine model: it is a step taken by a Turing machine. Even inside the practically feasible and inside the not practically feasible algorithms it makes sense to try to distinguish problems of different complexity. As we are mostly concerned with non practically feasible problems we take a closer look there. Let us first give a formal enough definition of the class P of problems solvable in polynomial time. DEFINITION 17. A Turing machine is polynomially time bounded if there is a polynomial p(n) such that the machine always halts after at most p(n) steps, where n is the length of the input. A problem is solvable in polynomial time (a function is computable in polynomial time) if there is a polynomially time bounded Turing machine that solves it (that computes it). The class of all problems solvable in polynomial time is called P. Within the class of non practically feasible algorithms we have those which take exponential time. We define the class EXPTIME of problems solvable in exponential time by requiring that there is some polynomial p such that the Turing machine must halt on all inputs after at most 2p(n) steps. Similarly we can define the class of 2EXPTIME problems, solvable in at most p(n) steps, and so on. These classes form a hierarchy and it is known that all inclusions are 22 strict. Consider the class EXPTIME. Can we find interesting and natural subclasses here? We can look at the amount of working memory a Turing machine needs in its computation. At our level of discussion it is enough to know that in every computation step of a Turing machine, the machine can read and write a symbol of a specified finite alphabet in a cell of a tape. The tape corresponds to the memory of the Turing machine. Clearly machines are conceivable which take a long time before they reach their decision but which use only a limited amount of memory. A good example is the “bad way of doing model checking” described in Chapter 1. We can define space classes similarly to time classes: DEFINITION 18. A Turing machine is polynomially space bounded if there is a polynomial p(n) such that no computation of the machine scans more than p(n) tape cells. The class of all
166
Maarten Marx
problems solvable by a polynomially space bounded Turing machine is called PSPACE. It should be clear that P is contained in PSPACE. Note that there is no bound on the amount of time for polynomially space bounded computations. Still we have PSPACE is contained in EXPTIME. To see this, consider the number of ways a tape containing p(n) cells can be written, in an alphabet containing two symbols. That is 2p(n) . This bounds the number of configurations of a Turing machine. If a PSPACE machine takes more than exponential time, then it has repeated some configuration so it must be in an infinite loop. This is not possible because it must terminate on each input. Non-determinism. The Turing machine model we had in mind was the deterministic Turing machine. This is what we typically think of when we think of a computer program: the output state of a computer program is uniquely determined by its input state (that is, by its input). Moreover, for every intermediate state there is exactly one state in which the program can be at the next computation step. In essence, a program is a function from input states to output states. One of the more difficult abstractions made of a Turing machine is a non-deterministic Turing machine. Non-deterministic programs are very useful when the problem consists of a (difficult) search for a solution and an (easy) check whether the solution is correct. The prime example of such a problem is boolean satisfiability: given a propositional formula, does there exists a valuation of the proposition letters such that the formula evaluates to true? For a formula with n letters there are 2n many possible valuations, an enormous search space. To check whether a given valuation evaluates to true is very easy (the number of steps is polynomially bounded by the number of connectives in the formula). We can write a non-deterministic program which scans the formula from left to right, and has the following non-deterministic rule if you read pi for the first time, then either replace all occurrances of pi by true or replace all occurrances of pi by false. Consider the application of this rule as one computation step. After scanning the complete formula the program can simply check whether the result evaluates to true. Thus if a formula is satisfiable the program can answer fast and correctly. If the formula is not satisfiable, then none of the choices will lead to a state in which the program will answer that it is. So this program decides the satisfiability problem. We say that a non-deterministic Turing machine decides a problem if • for every yes instance of the problem, there is at least one computation that accepts the input, and • for every no instance, every computation rejects the input. Note the asymmetry in this definition. Deterministic Turing machines have just one computation on each given input: this is exactly what determinism requires. But the above non-deterministic program has 2n many different computations on a formula with n variables. Each of them leads to an accepting or rejecting state in p(n) steps, for p a polynomial. This is the time we measure. DEFINITION 19. NP is the class of problems decided by a polynomially time bounded nondeterministic Turing machine. NEXPTIME is the class of problems decided by an exponentially time bounded non-deterministic Turing machine.
Complexity of Modal Logic
167
Still the reader might ask how long a non-deterministic polynomially time bounded computation really takes. Where “really” means implemented on a deterministic Turing machine. This is one of the greatest puzzles in computer science. The answer is simply: At present we can only do it using an exponentially time bounded deterministic Turing machine. We do not know if we can do better, but we consider it unlikely. In other words, the question whether P =NP is wide open, though it is generally believed that the two classes are different. Thus we have the following inclusions P ⊆ NP ⊆ PSPACE ⊆ EXPTIME ⊆ NEXPTIME, and all we know at present is that (N)P (N)EXPTIME.
3.3 The complexity of modal decision problems In Section 2 we gave several decision algorithms and analyzed their complexity in rather loose terms. In fact these arguments can be made rigorous without too much ado. Thus we can use them to argue that the problems discussed earlier are in certain complexity classes. We briefly list the results: 1. Propositional satisfiability is in NP. 2. Local satisfiability of the logical system tile is in NP. 3. Local satisfiability of the basic modal system K is in PSPACE. 4. Satisfiability under constraints of the basic modal system K is in EXPTIME. 5. Local satisfiability of two dimensional modal logic is in NEXPTIME. These are nice results but they do not tell us very much, except that for none of them we have found a practically feasible algorithm. Surely that does not mean that no such algorithm exists. We would like to have a similar situation as with decidability: either we show a problem is decidable or we show it is undecidable. Thus we would like to be able to show that a problem is not in P , or it is in PSPACE, but not in NP, etc. Unfortunately, except for some problems in EXPTIME, we cannot show that a problem is not in P. At present we just do not know how to do that. As a second best to showing that a problem in NP is not in P we can show that it is a core problem in NP. A really desirable property of a core problem Q in NP would be that if Q happens to be in P, then every problem in NP is also in P. In other words, if you are able to find a polynomial time algorithm for Q, you have found one for all problems in NP. Even though this property sounds extremely strong, we now have hundreds of core problems in NP (cf., [16]). These are called NP complete problems and the crucial notion in their definition is that of a polynomial time reduction.
168
Maarten Marx
3.4 Reductions We have used a reduction from an undecidable problem (tiling) to another problem to show that the latter is also undecidable. The reduction used in the proof of Theorem 7 took an instance of the tiling problem and produced two formulas A and C. The crucial point of the reduction was that it was a computable function. Computability was all we needed to transfer undecidability. In the case at hand we want to transfer a similar negative property: most likely not in P. But then we should not ask for mere computability, but for computability in polynomial time. Note that the given reduction of the tiling problem is polynomial time computable. It is an example of a polynomial reduction of one problem into another. This simple and intuitive notion is very powerful. To recapitulate: if there is a polynomial reduction from problem A to problem B, then B is at least as hard as A. If we can solve B efficiently (that is, if B ∈ P), then the same holds for A. But if A requires exponential time, then so does B. DEFINITION 20. A problem Q is said to be NP complete if Q is in NP and for every problem Q in NP there is a polynomial reduction from Q to Q. We invite the reader to show that NP complete problems have the desired property of core problems discussed above. We define complete problems for the other complexity classes in exactly the same way, all the time using polynomial reductions. From the definition it looks very difficult to show that a given problem which is in NP is also NP complete, because of the universal quantifier. But that is just appearance, as any problem in NP can be decided by a non deterministic polynomially time bounded Turing machine. Thus we need to reduce the acceptance problem of such machines. The first problem shown NP complete was boolean satisfiability (This is known as Cook’s Theorem.) Once you have one NP complete problem it is much easier to get more. Because the composition of two polynomial reductions is a polynomial reduction all one needs to do to establish NP completeness of a problem Q in NP is to reduce a known NP complete problem to it. Similarly for the other complexity classes. Thus when doing a complexity analysis of a problem one should try to establish a matching upper and lower complexity bound: that is, establish that the problem is complete for some complexity class. The upper bound indicates the amount of time and space needed by the best known algorithm. The matching lower bound that —with the present state of knowledge in computer science— one cannot do better. Note that “cannot do better” is a rather relative notion. For one thing, both 10 · n and n10 are polynomial functions. As none of the problems we look at is solvable by a practically feasible algorithm anyway, it is at this stage of the discussion enough to use the rather broad but robust complexity classes we discussed. We will now establish those required lower bounds for the problems listed in the beginning of Section 3.3. When we have reduced a known NP complete problem to a problem Q we say that Q is NP hard, and so on. Such reductions yield good insight in the expressive power and the design of the modal system.
3.5 Tiling We will establish matching lower bounds by reductions to finite versions of the tiling problem discussed in Section 1.3. We start with the simplest finite version, square tiling. The problem is as before, we are given a set of tiles T , containing a special tile T0 , and a natural number n. Note that n is part of the input. The problem is whether the n × n square can be tiled using the tiles T with the constraints
Complexity of Modal Logic
169
that T0 is placed at the four borders on the square. Interestingly, the complexity of this problem depends on how the size n is given. FACT 21. 1. The n × n tiling problem with n given in unary is NP complete. 2. When n is given in binary it is NEXPTIME complete. To get in the mood let us show that propositional satisfiability is NP hard, by reducing the tiling problem to it. So consider an instance of the problem consisting of an n and a set of tiles T = {T0 , T1 . . . , Tk }. We want to create a propositional formula AnT which is satisfiable iff there exists a T tiling of the n × n square. Moreover the formula AnT must be computable in polynomial time from T and n. AnT will be constructed from the set of propositional variables {ptxy | 0 ≤ t ≤ k, 0 ≤ x, y < n}. The intended meaning of ptxy is “Tile Tt is placed on position (x, y)”. Note that there are n2 · (k + 1) variables ptxy . AnT is a conjunction of clauses. It consists of the following parts: • At each point in the square, exactly one tile is placed: (p0 ∨ . . . ∨ pkxy ) (at least one) 0≤x,y≤n−1 xy t t (at most one) 0≤x,y≤n−1 ¬(pxy ∧ pxy ). 0≤t=t ≤k
• The special tile T0 is placed all along the edges of the square: (p00i ∧ p0n−1i ∧ p0i0 ∧ p0in−1 ). (border) 0≤i≤n−1
• Colors must match horizontally and vertically:
t t (horizontal) 0≤x,y
0≤t≤k t t (vertical) 0≤x,y
Clearly this formula is computable from the instance. It is also not hard to show that it is a correct reduction: the formula is satisfiable if and only if the instance can tile the given square. But in order to show that we have given a polynomial reduction, we need to argue that the formula is polynomially computable from the given tiling instance. What is the size of the formula? Look at the last conjunct (vertical). It consists of n2 · (k + 1) conjunctions each containing at most k + 2 variables and k + 1 connectives. What is the size of a propositional variable? Naively we think of propositional variables as letters p, q, r . . . so it is tempting to assume that they have size 1. But if we encode variables in some standard way, e.g. as strings of zeroes and ones, then the more we have of them the more bits we need. We always assume that we use a binary encoding, so for our n2 · (k + 1) many variables we need log(n)2 · log(k + 1) bits for each variable. Thus the total size of (vertical) is O(n2 · log(n)2 · k 2 · log(k)). We obtain similar bounds for the other conjuncts. Note how lucky we are that n was given in unary. Otherwise, when n had been given in binary, we had already 2n · 2n · (k + 1) many propositional variables, so our reduction would never have been polynomial. We will use the binary version of square tiling later on. First we look at a variant called corridor tiling.
170
Maarten Marx
Corridor tiling. Given a set of tiles T , a special tile T0 and an integer n in unary. The problem is whether there exists a height m such that the rectangle n×m can be tiled by T , with all borders tiled by T0 . FACT 22. Corridor tiling is PSPACE complete. Corridor tiling is very well-suited to obtain results for linear structures. Consider the logical system succ consisting of the basic modal language, its models are all initial segments of the natural numbers with successor, and 3 is interpreted by the successor function. PROPOSITION 23. The problem whether A is (locally) satisfiable in a model which globally satisfies C is PSPACE hard for the system succ. Proof. Of course we reduce corridor tiling. Let T = {T0 , . . . , Tk } and n determine an instance. We use variables ptx for 0 ≤ x ≤ n − 1 and 0 ≤ t ≤ k. We view an initial segment of the natural numbers as the corridor. Then ptx gets a familiar meaning: M, i |= ptx means that “Tile Tt is placed at position (x, i). Having this interpretation it seems straightforward to write down the constraints: • The side edges are tiled by T0 : p00 ∧ p0n−1 • Every position is tiled by exactly one tile:
p0x ∨ . . . ∨ pkx .
0≤x≤n−1
¬(ptx ∧ ptx ).
0≤x≤n−1, 0≤t=t ≤k
• Colors match horizontally by
((ptx →
0≤x
ptx+1 ).
{t |right(Tt )=left(Tt )}
• Colors match vertically by
((ptx → 2
0≤x≤n−1, 0≤t,t ≤k
ptx ).
{t |up(Tt )=down(Tt )}
• Every row either has a successor or it is the last one: 3 ∨ (p00 ∧ . . . ∧ p0n−1 ). These are all the universal constraints. Now we need worlds in which the formula (p00 ∧. . .∧p0n−1 ) is true, one for the bottom row and one for the top. It is natural to use the locally satisfiable formula for the bottom row. Thus let A::=(p00 ∧ . . . ∧ p0n−1 ) ∧ 3.
Complexity of Modal Logic
171
3 is there to ensure that the real tiling starts. But how are we to ensure that the corridor ends? It is conceivable that A is satisfiable in an infinite model making all constraints true in which never another world containing (p00 ∧ . . . ∧ p0n−1 ) exists. This encoding seems hopeless but a closer inspection of the problem helps us out. Suppose an instance is a yes instance. Then there exists some m such that n × m can be tiled. We have placed no maximum on m but a little combinatorics show that we can. If a yes instance exists, there exists one in which no row is repeated in the corridor. (Because if there is, we can cut the whole intermediate part out and still have a yes instance.) How many rows of length n can we make with k + 1 tiles? At most (k + 1)n . That gives an upper bound on m. If a tiling exists there exists one with at most 1 + (k + 1)n many rows. Now we can use the counter formula from Section 2.5 to create a binary counter starting at 0 at the world in which A is true and we just add a constraint stating that the world with counter value (k + 1)n is the last but one world in the model. The counter formula has size polynomial in k and n and the complete formula is polynomial in the size of the input. We leave the details of checking correctness to the reader. ❑ Corridor tiling is highly suited for linear structures but it does not seem easy to use it for establishing the PSPACE lower bound for local K satisfiability. For one thing we cannot enforce such deep models without constraints. On the other hand, we can enforce models with an exponential number of leaves. Luckily there are also two person game versions of square and corridor tiling, which are PSPACE and EXPTIME complete, respectively. One play of a game is naturally represented by a sequence of game-positions, representing the moves made by the two players. All plays on a specific board can then be represented by a tree, such that each play is a complete branch in the tree. (For instance, think of chess. Each node represents the board at that stage of the game. The root represents the start position. It has exactly as many successors as there are possible opening moves for white. From each successor there is again one successor for each legal move of black, and so on.) When working with games we are often not interested if a player can win some play, rather we want to know if she can win every play. If so, we say she has a winning strategy. As modal logic and trees are closely related, it seems a good idea to encode game trees. That is just what we will do. Tiling games are played as follows. There are two players, a male and a female who alternate in placing tiles. She starts at the origin and they work their way up from left to right, and at the end of a row they start again at the left most position of the next row. Players must obey the matching color rules. She wins a play is she can establish a complete tiling. Otherwise he wins. She has a winning strategy is she can win every play. Clearly she can win some play iff a tiling exists. But the question whether she can win every play seems harder. And indeed FACT 24. 1. The problem whether she has a winning strategy in the square tiling game (n given in unary) is PSPACE complete. 2. The same problem for corridor tiling is EXPTIME complete. We use the square tiling game to show PSPACE hardness of local K satisfiability. The corridor game can be used to show EXPTIME hardness for the satisfiability problem under constraints. This is a fairly straightforward extension of the square game, using the same type of variables as in corridor tiling and also using a counter formula. Complete proofs are given in [6, 37, 4]. PROPOSITION 25. The local satisfiability problem for the basic modal system is PSPACE hard.
172
Maarten Marx
Proof. Let T = {T0 , . . . , Tk }, n be an instance of the square tiling game. Use the same propositional variables as in square tiling. Use the branch and store macros of Section 2.1 to create an at most n2 − 1 deep tree containing all possible legal plays. (Add the required extra constraints about matching colors and the uniqueness of tiles from square tiling where needed.) It might be convenient to use an extra variable encoding whose turn it is. Let that be she indicating that she is to move. Now there exists a tiling if there is an n2 − 1 deep path in the tree. The female player has a winning strategy if she can win every game. We can formalize this using the notion of a winning position. Let wp be a variable denoting whether a position is winning for the female player. All leaves at depth n2 − 1 are winning, and only those leaves. Now we inductively define winning positions for the intermediate nodes in the tree. If she is to move, then a position is winning iff she can move to a winning position: she → (wp ↔ 3wp). If he is to move, then a position is winning for her iff he can move at all, and all his moves lead to winning positions for her: ¬she → (wp ↔ (3 ∧ 2wp). Of course these formulas must be true everywhere in the game tree. But, because the tree is of depth only n2 − 1, this can be enforced by a formula of polynomial size in n. Now she has a winning strategy iff the root of the game tree is a winning position for her. Further details are left to the reader. ❑ To end this section we give a more involved reduction, based on ideas from Lewis [26]. As it is the most difficult one, we spell it out completely. We show NEXPTIME hardness for a number of modal systems of which the two-dimensional modal logic from Section 2.7 is a special case. All have the same language and the models are of the same shape, with two accessibility relations H and V . Let Grid be the class of models satisfying (17) ∀xy(∃z(xV z ∧ zHy) ↔ ∃z(xHz ∧ zV y)) (18) ∀xyz((xHy ∧ xV z) → ∃w(yV w ∧ zHw)). These frame conditions make the models have a grid like nature. (17) states that V − H and H −V paths commute, while (18) states a Church–Rosser like condition. They are both Sahlqvist definable by respectively 3h 3v ϕ ↔ 3v 3h ϕ and 3v 2h ϕ → 2h 3v ϕ, respectively. These conditions play an important role in the study of products of modal logic [15]. Note that all two dimensional models are in Grid. PROPOSITION 26. Let Grid be any subclass of Grid containing all finite two dimensional frames. The local satisfiability problem for the modal system with class of models Grid is NEXPTIME hard. Proof. Let Grid be as in the proposition. We will reduce the square tiling problem with n given in binary to the satisfiability problem of the modal system with class of models Grid . Without loss we may assume that we have to tile the 2n × 2n square. Let an instance (2n , T ), with T = {T0 , . . . , Tt } be fixed. We will define a formula An,T which describes this instance. In order to obtain the lower bound we show that (A) An,T is computable in polynomial time in n and |T |.
Complexity of Modal Logic
173
(B) if T tiles 2n × 2n , then An,T is satisfiable in a finite two dimensional model, and (C) if An,T is Grid –satisfiable, then T tiles 2n × 2n . Given (A), (B) and (C) we have an effective reduction from the NEXPTIME-complete tiling problem to Grid -satisfiability, and the result follows. We first describe how we represent a T -tiling of 2n × 2n in an S52 model. Let (N, E) be a binary tree of depth 2n with nodes N and edges E. The elements of N are 2n-long strings in the alphabet {0, 1, 2}, placed in the tree as in Figure 2. (We use the symbol 2 to make all nodes a string of the same length). 22 @ @
00
02 @ @
01
@ 12 @ @ 10 11
Figure 2. binary tree of depth 2 Let F = (N × N, ≡0 , ≡1 ) be the two dimensional frame with base N . Our formula An,T will contain the following propositional variables: d denotes the nodes in the tree, located on the diagonal e denotes the daughter relation in the tree p1 , . . . , p2n pi stands for the i-th bit of the strings encoding the nodes one variable for each tile, t0 , . . . , tt and variables ph1 . . . ph2n , th0 . . . tht , pv1 . . . pv2n , tv0 . . . tvt , whose meaning will become clear later on. We now describe a valuation v on F of these variables. (Because we use V for one of the accessibility relations, we denote the valuation of a model by v in this proof.) v(d) = {(x, y) ∈ N 2 | x = y} v(e) = {(x, y) ∈ N 2 | xEy} v(pi ) = {(x, x) ∈ N 2 | x(i) = 1} v(pvi ) = {(x, y) ∈ N 2 | (x, x) ∈ v(pi )} v(phi ) = {(x, y) ∈ N 2 | (y, y) ∈ v(pi )}. Let T be a tiling of the 2n × 2n -grid. A pair (k, l) ∈ 2n × 2n can be represented by a binary number of length 2n; the first n places for k and the second n for l. We now make a tile variable ti true at a leaf x in the tree (N, E) precisely if the tile Ti tiles the pair (k, l) whose representation is x, that is (x, x) ∈ v(ti ) ⇐⇒ Ti tiles (k, l) and (∀i ≤ n)x(i) = k(i) and (∀n < i ≤ 2n)x(i) = l(i − n). The thi and tvi variables obtain their valuation just as the phi and pvi . We now describe An,T and show that it is satisfied at the pair (a, a) in (F , v), where a is the root of the tree (N, E). We first describe a binary tree of depth 2n, using the propositional variables p1 , . . . p2n . This will provide us with (2n )2 leaves each encoding an element in the 2n ×2n grid. We use here the “branch and store” formula from Section 2.1 again.
174
Maarten Marx
Let E A be an abbreviation for 31 (e∧30 (d∧A)), and define [E]A = ¬ E ¬A. We use E as n 0 n+1 n A = [E][E] A. an ordinary K-modality. [E] is an abbreviation defined as: [E] A = A and [E] 2n k d ∧ [E] [E]⊥ k<2n [E] [ ( E pk+1 ∧ E ¬pk+1 ) ∧ (19)
i≤k ((pi
→ [E]pi ) ∧ (¬pi → [E]¬pi )) ] .
Note that the leaves in such a tree make d ∧ [E]⊥ true. Clearly (19) is satisfied at (a, a). The other formulas have a rather redundant formulation if we think about two-dimensional models. Since we want to prove the proposition for a wide class of logics, we have to use this particular formulation. The next two formulas say that on any leaf, precisely one tile variable t holds. Clearly they are satisfied at (a, a). 2n (20) 22n ti ] 0 21 [(d ∧ [E]⊥) → (21)
2n 22n (ti 0 21 [ 1≤i≤t
1≤i≤t
→
¬tj )].
j=i
The following formula ensures that the tile T0 is placed along the edges. 2n 22n 0 21 [d ∧ [E]⊥ ∧
(22)
((¬p1 ∧ . . . ∧ ¬pn ) ∨ (p1 ∧ . . . ∧ pn ) ∨ (¬pn+1 ∧ . . . ∧ ¬p2n ) ∨ (pn+1 ∧ . . . ∧ p2n )) → t0 ]
The next set of formulas capture the behavior of the variables indexed by h and v. First we write formulas which take care of the proper inheritance of information: Let xi stand for any of {pi , ti , ¬pi , ¬ti } 2n h (23) 22n 1 [30 (xi ) → xi ] 2n v (24) 22n 0 [31 (xi ) → xi ]
Then we propagate the new variables in the right direction. Obviously (F, v) |= (23)–(26). h 2n h (25) 22n 1 [xi → 20 xi ] 2n v v (26) 20 [xi → 22n 1 xi ]
Now we can express that colors match: (27)
h 2n v 22n {tj | 1 ≤ j ≤ t} → 0 21 [ xh = xv ∧ yh = yv + 1 ∧ ti ∧
h {tj | up(Ti ) = down(Tj )} ]
(28)
h 2n v {tj | 1 ≤ j ≤ t} → 22n 0 21 [ yh = yv ∧ xh = xv + 1 ∧ ti ∧
h {tj | right(Ti ) = left(Tj )} ] .
Here we use the following abbreviations: xh = xv abbreviates (phi ↔ pvi )
i≤n h v h v h v xh = xv + 1 abbreviates i≤n [ l
Complexity of Modal Logic
175
and similar for the y coordinates where we use the pi ’s between pn+1 and p2n . We show that
(27) holds everywhere in the model (F, v). Let (k, l) |= xh = xv ∧ yh = yv +1 ∧ tvi ∧ {thj | 1 ≤ j ≤ t}. Then both k and l are leaves in (N, E) by the valuation of the ti . Then k encodes a pair (x, y) and l a pair (x, y+1) in the grid. Because (k, l) |= tvi , (k, k) |= ti , and Ti tiles (x, y). But since colors match (x, y+1) must be tiled by a Tj such that top(Ti ) = down(Tj ). Then (l, l) |= tj and indeed (k, l) |= thj , as desired. So we have provided the formula An,T and shown (B). Clearly the length of this formula is polynomial in |T | and n, and it can effectively be obtained given n and T . This proves (A). Finally we show that the given formula is indeed powerful enough to describe a tiling. So let An,T be Grid satisfiable. Then An,T is satisfied in a model M = (W, H, V, v) which satisfies (17) and (18). Now suppose that M, w |= An,T . Then formula (19) forces a binary tree of depth 2n starting at w, in which the leaves encode all possible valuations of the pi -variables. By (17), every leaf in that tree can be reached from w by making 2n horizontal, followed by 2n vertical steps. So (20) and (21) ensure that at each leaf precisely one tile variable holds. Choose such a tree starting at w and define a tiling of the grid, using the encoding given above. By (20) and (21) this is a well-defined tiling. By (22), the tile T0 is placed along the edges. Now we check that colors match. Suppose that Ti tiles (x, y) and Tj tiles (x, y + 1). Then by (17) we have the following situation in our model: wV 2n aH 2n l and wH 2n bV 2n k for some worlds a and b, where k is a leaf encoding (x, y) and M, k |= ti and l a leaf encoding (x, y+1) and M, l |= tj . By the inheritance formulas (23) and (24) we have M, a |= (x, y+1)h ∧ thj and M, b |= (x, y)v ∧ tvi , where (x, y+1)h abbreviates the conjunction of phi and ¬phi such that pi and ¬pi are true at l, etcetera. Now by (18) we have a world c such that aH 2n c and bV 2n c, so M, c |= (x, y + 1)h ∧ thj ∧ (x, y)v ∧ tvi by the propagation formulas (25) and (26). But then by (27) the colors must indeed match. The same argument with (28) shows that colors match horizontally. This proves (C), hence the proposition. ❑
3.6 Language design and complexity We briefly look at the effect of the design of the modal language on the complexity of the satisfiability problem. We restrict ourselves to the basic modal language. Modal languages all come with an infinite number of propositional variables. What happens if we fix them to some arbitrary finite number n? That is, all formulas are build from propositional variables p1 , . . . , pn only. Let us first look at propositional logic. For the full language the satisfiability problem is NP hard. Note that we crucially used the fact that we have an unbounded number of proposition letters in the lower bound proof. If we restrict the number of variables to some fixed n, the problem becomes solvable in linear time: write out the truth table, it contains at most 2n rows, and make all (at most 2n ) checks. Each check can be done using linear time in the length of the input wff. Of course we must still make a lot of checks but the number is fixed by the design of the language, and not dependent on the input. Does this also hold for the satisfiability problem of the basic modal system? Halpern [19] showed that it does not. With one propositional variable the satisfiability problem is still PSPACE hard. Here we will explain the idea and give a more efficient encoding as well. What we need is a polynomial time computable translation from arbitrary modal formulas to modal formulas in just one propositional variable, say q, which preserves satisfiability. Then PSPACE hardness of
176
Maarten Marx
the full modal language is inherited by the small language. This is Halpern’s translation: (pi )t = 3(¬q ∧ 3i q) (·)t commutes with all connectives Again 3i abbreviates a string of i diamonds, thus the translation is only linear if the i in pi is given in unary. If i is given in binary, the translation is exponential. We now show that for each wff A, A is satisfiable iff At is satisfiable. The right to left direction is easy and left to the reader. For the other direction, let M = (W, R, V ) and let M, w0 |= A. Create a new model = R, M = (W , R , V ) such that W consists of W plus a suitable supply of new worlds, RW W ⊆ V (q) and for all w ∈ W add a path wRw1 R . . . Rwj to M iff M, w |= pj . The wi are all different and not yet in W . Of these new worlds only set wj ∈ V (q). Use new worlds for every w ∈ W and every propositional variable pj . An induction on the length of the formula shows that for all w ∈ W , for all subformulas B of A, M, w |= B iff M , w |= B t . As M, w |= A that means that At is satisfied in M. This idea can be used to get a linear translation if the indices of the p’s are given in binary. Instead of coding pi by an i long string of worlds, we encode it by a string of worlds which mimicks the binary encoding of i. For instance, the encoding of p101 would be 3(¬q ∧ 3(q ∧ 3(¬q ∧ 3q))), in which the leading ¬q is as before to separate “coding” worlds from “real” worlds and the rest of the world sequence is a replica of the string 101. The length of the string of worlds is fixed for all pi and depends only on the number of variables in the input formula to be translated. Clearly the translation is linear. Details are left to the reader. Note that we need formulas of unbounded modal depth to encode as many propositional variables as we like. What if we fix the modal depth of our formulas? Then the problem becomes NP complete which is an immediate consequence of the tree model property. Recall that each satisfiable formula A is satisfiable in a tree of depth d the modal depth of A and branching factor b bounded by the number of diamond formulas in A, hence by |A|. The number of worlds in such a tree is bounded by bd+1 , which —since d is now considered fixed— is simply linear in |A|. If we fix both the number of propositional variables and the modal depth we are rapidly leaving the realm of logic, as then there are only a finite number of wffs up to logical equivalence. A straightforward argument shows that the satisfiability problem then can be decided in linear time. See [19] for further details. 4
HISTORICAL NOTES
We give pointers to further literature and try to sketch a little of the historical development by mentioning some of the milestones. This is not intended to be exhaustive. The chapters 4, 13 and 17 on computational modal logic, description logic and automata for temporal logic, respectively contain useful pointers as well. A detailed set of historical notes together with references to the relavant literature can be found in the notes ending Chapter 6 of [4]. For background, one can consult textbooks on computational complexity [27, 32] and finite model theory [10, 28]. The chapter on computability and complexity in [4] contains detailed arguments of most proofs which are just sketched here and an extended annotated bibliography.
Complexity of Modal Logic
177
One might say that Cook’s Theorem bootstrapped the field of complexity of modal logics [9]. Ladner [25] established the first completeness results for the best known modal logics, focusing on local satisfiability: NP–completeness for S5 and PSPACE–completeness for K,T and S4. The K-World algorithm is from that paper, but using the abstract tableaux developed by Hemaspaandra [36]. The branch and store formula from section 2.1 originates also from [25]. The field took off with Fisher–Ladner [14] and Pratt [33], showing the EXPTIME lower and upper bound for Propositional Dynamic Logic PDL, respectively. This was a large generalization from earlier work: PDL is a multi modal language and the definition of |= is second-order. Moreover within PDL the satisfiability problem under constraints can be reduced to the local satisfiability problem. Pratt introduced the technique of elimination of Hintikka Sets. In the eighties the field exploded: results for ever more complex modal systems were obtained. Halpern and Moses [20] (the original is from 1985) researched epistemic logic with multiple modalities and transitive closure operators in the tradition of Ladner and Pratt. PSPACE completeness of linear temporal logic with until was settled by Sistla and Clarke [35]. Vardi and Wolper [41] showed how B¨uchi tree automata can be used for powerful modal logics. A little later, the complexity of the satisfiability problem of one of the most expressive modal logics — the modal μ-calculus— was settled (still EXPTIME–complete) by Emerson and Jutla [11]. More recently, Vardi and co-authors have shown that this result is robust under a number of expansions of the language [40, 34, 24]. There are a number of motivations for studying the complexity of modal satisfiability problems. Description logic is concerned with building knowledge bases and the main computational question is whether a knowledge base is consistent. This field contains a wealth of complexity results, for an enormous variety of modal systems, cf., the handbook [3]. Temporal logic model checking is used in automated program verification, see [7, 8]. Epistemic logic and combinations of epistemic and temporal logics play a role in the analysis of distributed computer programs. Cf., [13] and numerous articles by the authors of that book. Several attempts have been made to explain why so many modal logics are decidable and why so often their satisfiability problem under constraints is complete for EXPTIME. Vardi [39] emphasizes the tree model property, Andr´eka, van Benthem, N´emeti [2] the fact that |= is defined in a guarded fragment of first (or second) order logic, which are really two sides of the same coin, as shown by Gr¨adel [17]. This explanation focuses on the definition of |= and works if the class of structures of a modal system is large enough to allow tree models. Hemaspaandra [36] looks at the frame conditions and their influence, and also at the effect of joining several modal systems. Marx, Venema [30] indicate the importance of “locality” principles (like being in a fixed variable fragment) and the “looseness” principle given by the tree model property. The use of tiling to establish lower bounds has a number of —usually very enthusiastic— advocates, cf., for instance [37, 27, 5, 21]. ACKNOWLEDGEMENT Some of the material in this chapter has been taken from [30]. The author thanks Martin Otto for very helpful comments.
178
Maarten Marx
BIBLIOGRAPHY [1] S. Abiteboul, R. Hull, and V. Vianu. Foundations of Databases. Addison-Wesley, 1995. [2] H. Andr´eka, J. van Benthem, and I. N´emeti. Modal languages and bounded fragments of predicate logic. Journal of Philosophical Logic, 27(3):217–274, 1998. [3] F. Baader, D. Calvanese, D. McGuinness, D. Nardi, and P. Patel-Schneider, editors. Description Logic Handbook. Cambridge University Press, 2002. [4] P. Blackburn, M. de Rijke, and Y. Venema. Modal Logic. Cambridge University Press, 2001. [5] E. B¨orger, E. Gr¨adel, and Y. Gurevich. The Classical Decision Problem. Springer Verlag, 1997. [6] B. Chlebus. Domino-tiling games. J. Comput. Syst. Sci., 32:374–392, 1986. [7] E. Clarke, O. Grumberg, and D. Peled. Model checking. MIT Press, 1999. [8] E.M. Clarke and B.-H. Schlingloff. Model checking. pages 1367–1522. Elsevier Science Publishers, 2000. [9] S. Cook. The complexity of theorem proving procedures. In Proc. 3rd ACM SYMP. on Theory of Computing, pages 151–158, 1971. [10] H.-D. Ebbinghaus and J. Flum. Finite Model Theory. Perspectives in Mathematical Logic. Springer, 1995. [11] E. Emerson and C. Jutla. The complexity of tree automata and logics of programs. In Proceedings of the 29th IEEE Symposium on Foundations of Computer Science, pages 328–337. IEEE Computer Society Press, 1988. [12] R. Fagin. Contributions to the Model Theory of Finite Structures. PhD thesis, U. C. Berkeley, 1973. [13] R. Fagin, J.Y. Halpern, Y. Moses, and M.Y. Vardi. Reasoning about Knowledge. The MIT Press, 1995. [14] M. Fisher and R. Ladner. Propositional dynamic logic of regular programs. J. Comput. Syst. Sci., 18(2):194–211, 1979. [15] D. Gabbay, A. Kurucz, F. Wolter, and M. Zakharyaschev. Many-Dimensional Modal Logics: Theory and Applications. Number 148 in Studies in Logic and the Foundations of Mathematics. Elsevier, North-Holland, 2003. [16] M.R. Garey and D.S. Johnson. Computers and Intractibility. A Guide to the Theory of NP-Completeness. W.H. Freeman, 1979. [17] E. Gr¨adel. On the restraining power of guards. Journal of Symbolic Logic, 64(4):1719–1742, 1999. [18] E. Gr¨adel, P. Kolaitis, and M. Vardi. On the decision problem for two–variable first order logic. Bulletin of Symbolic Logic, 3(1):53–69, 1997. [19] J. Halpern. The effect of bounding the number of primitive propositions and the depth of nesting on the complexity of modal logic. Artificiall Intelligence, 75(2):361–372, 1995. [20] J.Y. Halpern and Y.O. Moses. A guide to completeness and complexity for modal logics of knowledge and belief. Artificial Intelligence, 54:319–379, 1992. [21] D. Harel. Recurring dominoes: making the highly undecidable highly understandable. In Proc. of the Conference on Foundations of Computing Theory, volume 158 of LNCS, pages 177–194. Springer, 1983. [22] D. Harel. Recurring dominoes: making the highly undecidable highly understandable. Annals of Discrete Mathematics, 24:51–72, 1985. [23] N. Immerman. Descriptive Complexity. Springer, 1998. [24] O. Kupferman, U. Sattler, and M. Vardi. The complexity of the graded mu-calculus. In Proceedings of the Conference on Automated Deduction, volume 2392 of Lecture Notes in Artificial Intelligence. Springer Verlag, 2002. [25] R. Ladner. The computational complexity of provability in systems of modal propositional logic. SIAM journal of computing, 6(3):467–480, 1977. [26] H. Lewis. Complexity results for classes of quantificational formulas. Journal of Computer and System Sciences, 21:317–353, 1980. [27] H.R. Lewis and C.H. Papadimitriou. Elements of the Theory of Computation (second edition). Prentice-Hall, 1998. [28] L. Libkin. Elements of Finite Model Theory. Springer, 2004. [29] M. Marx and Y. Venema. Multi-dimensional Modal Logic. Applied Logic Series. Kluwer Academic Publishers, 1997. [30] M. Marx and Y. Venema. Local variations on a loose theme: modal logic and decidability. In E. Gr¨adel, P. Kolaitis, L. Libkin, M. Marx, J. Spencer, M. Vardi, Y. Venema, and S. Weinstein, editors, Finite Model Theory and its Applications. Springer–Verlag, 2004. [31] M. Mortimer. On languages with two variables. Zeitsch. f. math. Logik und Grundlagen d. Math., 21:135–140, 1975. [32] Ch. Papadimitriou. Computational Complexity. Addison–Wesley, 1994. [33] V. Pratt. Models of program logics. In Proceedings of the 20th IEEE symposium on Foundations of Computer Science, pages 115–122, 1979. [34] U. Sattler and M. Vardi. The hybrid mu-calculus. In R. Gor´e, A. Leitsch, and T. Nipkow, editors, Proceedings of the International Joint Conference on Automated Reasoning, volume 2083 of LNAI, pages 76–91. Springer Verlag, 2001. [35] A. Sistla and E. Clarke. Complexity of propositional linear temporal logics. J. Assoc. Comput. Mach., 32(3):733–749, 1985. [36] E. Spaan. Complexity of modal logics. PhD thesis, University of Amsterdam, Institute for Logic, Language and Computation, 1993. [37] P. van Emde Boas. The convenience of tilings. In A. Sorbi, editor, Complexity, Logic and Recursion Theory, volume 187 of Lecture notes in pure and applied mathematics, pages 331–363. Marcel Dekker Inc., 1997.
Complexity of Modal Logic
179
[38] M. Vardi. On the complexity of bounded–variable queries. In Proceedings of the ACM 14th Symposium on Principles of Database Systems, pages 266–276, 1995. [39] M. Vardi. Why is modal logic so robustly decidable? In DIMACS Series in Discrete Mathematics and Theoretical Computer Science 31, pages 149–184. American Math. Society, 1997. [40] M. Vardi. Reasoning about the past with two-way automata. Lecture Notes in Computer Science, 1443:628+, 1998. [41] M.Y. Vardi and P. Wolper. Automata-theoretic techniques for modal logics of programs. J. Comput. Syst. Sci., 32:183–221, 1986. [42] Y. Venema. Cylindric modal logic. Journal of Symbolic Logic, 60(2):591–623, 1995.
Handbook of Modal Logic – P. Blackburn et al. (Editors) © 2007 Elsevier B.V. All rights reserved.
4
COMPUTATIONAL MODAL LOGIC Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
1 2 3
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Syntax, semantics, and reasoning problems of modal logics . . . . . . . . . . Translation-based methods . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Local satisfiability in multi modal Kn . . . . . . . . . . . . . . . . . 3.2 Global satisfiability, non-logical axioms, transitive modalities, and K4n 3.3 Converse modalities and the modal logics KBn and KB4n . . . . . . 3.4 Implementation and optimisation . . . . . . . . . . . . . . . . . . . . 3.5 Other extensions (counting, nominals) . . . . . . . . . . . . . . . . . 4 Tableau-based algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Tableau algorithms in general . . . . . . . . . . . . . . . . . . . . . . 4.2 Local satisfiability for multi modal Kn . . . . . . . . . . . . . . . . . 4.3 Transitive modalities and K4n . . . . . . . . . . . . . . . . . . . . . 4.4 Non-logical axioms and background theories . . . . . . . . . . . . . . 4.5 Converse modalities . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Converse modalities and background theories . . . . . . . . . . . . . . 4.7 Other extensions (counting, nominals, transitive closure, and fixpoints) . 5 Other computational approaches . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Automata-based algorithms . . . . . . . . . . . . . . . . . . . . . . . 5.2 Modal resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Sequent-based approaches . . . . . . . . . . . . . . . . . . . . . . . . 5.4 Inverse method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Other reasoning problems . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1 Model checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Proof checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Computing correspondences . . . . . . . . . . . . . . . . . . . . . . 6.4 Model generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.5 Bisimulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.6 Modal logic programming . . . . . . . . . . . . . . . . . . . . . . . . 7 Review and Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . .
181 183 186 186 200 202 203 207 207 208 209 217 219 222 223 224 226 226 227 229 230 231 231 231 232 233 234 236 237
INTRODUCTION
As we have seen in preceding chapters, the worst case complexity of basic reasoning tasks, such as deciding the satisfiability of a modal formula, is at least NP-complete for almost all modal logics. Moreover, for logics extended with features that are useful in practice, the worst case complexity can be much higher, e.g., ExpTime-complete for Kn extended with non-logical
182
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
axioms (background theories), and NExpTime-complete for Kn extended with converse modalities, graded modalities and nominals. Some may regard these results as discouraging and the question arises whether automated computation with such logics can be feasible in practice. Fortunately, the kinds of pathological formulae/theories that give rise to these worst case results seem to be rarely encountered in realistic applications, and this has allowed for the successful development and deployment of automated reasoning systems for modal logics and their notational variant, description logics; see Chapter 13 of this handbook. Applications of such systems include, e.g., multi-agent systems [53, 60, 196], configuration [137], conceptual modelling [73], information integration [32], and ontology tools and applications [125, 131, 167, 189, 138, 197]. Even for application derived formulae/theories, however, naive implementations of theoretical proof systems, such as the tableau calculi presented in Chapter 2 of this handbook, are unlikely to be of practical utility. As pointed out in [40], without the use of an analytic cut rule, the minimal length of proofs using these calculi can exceed that of proofs using the truth table method for certain propositional (and modal) formulae. Further, not only is it important that short proofs exist, but also how we go about finding a proof or a counter-model. Much of the work presented in this chapter deals with techniques that reduce the size of the search space or help to traverse the search space more efficiently. Successful modern reasoning systems crucially employ specialised reasoning techniques along with optimisations to dramatically improve typical case performance; cf. for example [85, 90, 97, 115, 116, 158, 159]. In this chapter, we focus on reasoning and optimisation techniques used in tableau-based algorithms and translation-based methods. Translation-based methods make use of the fact that a wide variety of modal logics can be translated into first-order logic; in fact, they can be considered as characterising certain fragments of first-order logic as explained in Section 2 of Chapter 1 of this handbook. To the translated modal formulae, we can apply first-order reasoning methods, in particular, refinements of resolution [16]. Using this combination of a translation method and resolution has some obvious advantages. Any modal logic which can be embedded into first-order logic can be treated. The translations are straightforward, and can be performed in time O(n log n), so the engineering effort is minimal. For the resolution part, standard resolution provers can be used, or otherwise they can be used with small adaptations. Modern resolution provers [169, 183, 194] are among the most sophisticated and fastest first-order logic theorem provers currently available. The translation method is generic, it can handle first-order modal logics, undecidable modal logics, and combinations of modal and non-modal logics. In all cases, soundness and completeness of the method is immediate from results showing that the translation is satisfiability equivalence preserving and the soundness and completeness of the resolution calculus for first-order logic. The semi-decidability of first-order logic and the behaviour of first-order resolution on first-order formulae does not give us, however, any immediate insight into the modal fragment of first-order logic, which certainly is decidable, or the behaviour of first-order resolution on translated modal formulae. While termination of a resolution derivation from a translated modal formula is not always guaranteed, there are various ways, using different translations and different refinements of resolution, of obtaining translation-based decision procedures. In Section 3, we discuss some of these approaches and illustrate them using the modal logics Kn , K4n , KBn , K n (Kn with converse modalities), and KB4n . Also, using the modal logic Kn , we want to provide some fundamental understanding of how modern resolution provers work in general, what kind of optimisations are available, and how they can be used to provide effective and practical decision procedures for modal logics.
Computational Modal Logic
183
Tableau-based algorithms are closely related to the prefixed tableau systems presented in Section 6 of Chapter 2 of this handbook. In Section 4, we first explain the exact relationship between the two before describing a tableau algorithm which decides the satisfiability of formulae in the basic multi-modal logic Kn . We then discuss implementation and optimisation techniques which can be used to turn this tableau algorithm into an effective and practical decision procedure for Kn . Following the same structure, we also describe tableau-based algorithms for the modal logics K4n , Kn with non-logical axioms, K n , and their combinations and discuss implementation issues of those algorithms. Whereas the Kn tableau algorithm terminates “automatically”, we use certain cycle detection mechanisms to ensure termination for other modal logics. It can be easily seen that these mechanisms must be chosen carefully to preserve correctness of the algorithm and, at the same time, to enable termination as soon as possible so as to avoid an unnecessarily long search. Interestingly, it has been shown by state of the art description logic reasoners [159, 90, 160] that such tableau algorithms are amenable to optimisation, and that they behave better than their worst-case complexity or that of the corresponding reasoning problem suggest: they implement non-deterministic double exponential decision procedures for logics that are ExpTime-complete. In Section 5, we give an overview of alternative computational approaches to the satisfiability problem in modal logics. These include automata-based algorithms, direct resolution, the inverse method, and sequent-based approaches. In Section 6, we survey reasoning problems other than satisfiability and provability which are relevant for applications of modal logics, namely, model checking, proof checking, and computing correspondence properties for modal axiom schemata. Finally, we conclude the chapter with a brief review and discussion of current and future research. 2
SYNTAX, SEMANTICS, AND REASONING PROBLEMS OF MODAL LOGICS
Throughout this chapter, we use a notation that is compatible with the one presented in Chapter 1 of this handbook. We will use the symbols p, q, pi , qi , . . . for propositional variables. Here, we will be concerned with extensions and variants of the multi-modal logic Kn . The set of Kn formulae is the smallest set that contains all propositional variables, is closed under Boolean operators, and contains [i]ψ and i ψ for each 1 ≤ i ≤ n and each Kn formula ψ. Formulae of the form [i]ψ and i ψ are called box formulae and diamond formulae, respectively. In different sections, we will consider different normal forms of Kn formulae, and thus we are generous here and allow all kinds of Boolean operators and abbreviations, e.g. ∧, ∨, ¬, →, (for any tautology), ⊥ (for ¬), etc. As usual, the semantics of Kn is defined in terms of relational, Kripke structures or frames. A frame is a tuple W, R of a non-empty set W (of worlds) and a mapping R from natural numbers i, 1 ≤ i ≤ n to binary relations over W , thus R(i) ⊆ W × W . Here and in the rest of the chapter, we use Ri as an abbreviation of R(i), and we say that w is i-accessible from v if Ri (v, w). A model is given by a triple M = W, R, V , where W, R is a frame and V is a mapping from propositional variables to subsets of W . The notion of a formula ψ being true in a model M at a world w ∈ W is inductively defined as follows (we omit the definition for most Boolean operators).
184
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
M, w M, w M, w M, w M, w M, w
|= |= |= |= |= |=
p ¬ψ ψ∧φ ψ∨φ [i]ψ
i ψ
iff iff iff iff iff iff
w ∈ V (p) not M, w |= ψ M, w |= ψ and M, w |= φ M, w |= ψ or M, w |= φ M, v |= ψ, for all v with Ri (w, v) M, v |= ψ, for some v with Ri (w, v)
A modal formula φ is satisfiable in Kn if there exists some M = W, R, V such that, for some w ∈ W , M, w |= φ. In this case, we say that φ is satisfied in M. φ is valid in Kn if, for every M = W, V and every w ∈ W , M, w |= φ; φ and ψ are equivalent if φ ↔ ψ is valid. As usual, satisfiability and validity are inter-reducible, i.e., φ is satisfiable iff ¬φ is not valid, and φ is valid iff ¬φ is unsatisfiable. Thus, in what follows, we will mostly concentrate on a single inference problem, namely satisfiability testing. It is well-known that the satisfiability problem (and thus validity) in Kn is PSpace-complete [93, 129] (see also Chapter 3 of this handbook), and there are various decision procedures for this problem [49, 93, 129] and implementations thereof [87, 90, 120, 159]. Many of these procedures exploit the fact that any satisfiable Kn formula is satisfied in a finite tree model (i.e., one where the relational structure of the frame forms a finite tree) of depth linear in the size of the input formula. In this chapter, we will discuss in depth a resolution-based algorithm (in Section 3) and a tableau-based algorithm (in Section 4) for the satisfiability of Kn , and then explain how these two basic algorithms can be modified to also decide more expressive modal logics. We will often restrict our attention to formulae in negation normal form (NNF). In formulae in NNF, ∧, ∨, and ¬ are the only Boolean connectives used, and negation occurs only in front of propositional variables. Each formula of Kn and all extensions of Kn discussed in this chapter can be easily transformed into an equivalent formula in NNF in linear time, by pushing negation inwards, using a combination of de Morgan’s laws and the duality between box and diamond formulae. In this chapter we refer to a number of extensions of Kn which we define in the following. K4n , KBn , and KB4n . We will discuss decision procedures for K4n , the multi-modal logic of transitive frames, KBn , the multi-modal logic of symmetric frames, and KB4n , the multi-modal logic of symmetric and transitive frames. All these logics share the same language with Kn , but their semantics is based on different classes of frames. As K4n models, we only consider those models that are based on frames (W, R) in which each Ri is transitive, i.e., where for any u, v, w ∈ W , Ri (u, v) and Ri (v, w) imply Ri (u, w). For example, i i p ∧ [i]¬p is Kn satisfiable, whereas the same formula is K4n unsatisfiable. As KBn models, we only consider models that are based on frames (W, R) in which each Ri is symmetric, i.e., where for any u, v ∈ W , Ri (u, v) implies Ri (v, u). An example of a formula which is Kn and K4n satisfiable, but KBn unsatisfiable, is ¬p ∧ i [i]p. Finally, KB4n models are based on frames (W, R) where each Ri is symmetric and transitive. The formula i ¬p ∧ i [i]p, for example, is KB4n unsatisfiable, but satisfiable in Kn , K4n , and KBn . The modal logic K4n is axiomatised by the axioms of the modal logic Kn (see, for example, Chapter 2 of this handbook), plus the axiom schema 4 below. Similarly, KBn is axiomatised by adding the axiom schema B to the axiomatisation of Kn . Finally, for KB4n , we add both axiom schemas B and 4. Axiom 4 Axiom B
[i]φ → [i][i]φ φ → [i] i φ
Computational Modal Logic
185
The modal logic K4n is of interest since both tableau-based algorithms and translation-based methods require additional techniques to ensure termination. The modal logic KBn only requires a rather straightforward modification of the reasoning procedures we present for Kn , but raises some implementation issues for tableau systems. It is also worthwhile to remember that, in classical tableau systems, the treatment of KBn requires some form of cut rule. Finally, the procedures we present for KB4n combine the techniques we introduce for K4n and KBn . Non-logical axioms. We consider background theories, i.e., finite sets Γ = {γ1 , . . . , γn } of non-logical axioms γi . A model M satisfies a background theory Γ if, for each w ∈ W and each γ ∈ Γ, M, w |= γ. As a reasoning problem, we are interested in the satisfiability of a formula φ w.r.t. a background theory Γ, i.e., whether there exists a model M that satisfies both φ and a background theory Γ. Note that, in such a model, φ has to be true in at least one world, whereas all formulae in Γ have to be true in all worlds. Next, we explain why we discuss algorithms that reason w.r.t. background theories. Firstly, considering background theories makes reasoning more difficult, i.e., satisfiability w.r.t. background theories is ExpTime-complete [173], and thus they present a considerable challenge for automated reasoning tools. As with K4n , tableau algorithms for reasoning w.r.t. background theories no longer terminate on all inputs. However, in contrast to K4n , background theories allow us to enforce models with paths of exponential length using the standard encoding of incrementation modulo 2n on n propositional variables representing a binary counter (see, for example, page 14 of [133] for such a formula). The latter can be viewed as a symptom of the increased complexity since we might have to consider and search models with paths of exponential length. Secondly, background theories can be viewed as a weak form of the universal modality, i.e., φ is satisfiable w.r.t. Γ iff [0]γ, φ∧ γ∈Γ
is satisfied in a model based on a frame W, R with R0 = W × W . In such a model, [0] is called the universal modality because it can be used to access all worlds. In [4], it was shown how to reduce satisfiability in Kn with the universal modality (i.e., where the universal modality might also occur at a deeper modal level) to satisfiability w.r.t. background theories. Thirdly, background theories can be used to “internalise” axioms or “circumscribe” frame conditions. To do this, we first restrict our attention to formulae in negation formal form. As an example, let us consider K4n as discussed above and a K4n formula φ in NNF. It can be shown that φ is satisfiable iff φ is Kn satisfiable w.r.t. the background theory {[i]ψ → [i][i]ψ | [i]ψ is a subformula of φ and 1 ≤ i ≤ n}. Finally, background theories are notational variants of description logic TBoxes or terminologies, which are used in applications to hold the intensional domain knowledge [44, 173]; see also Chapter 13 of this handbook. A TBox is (the description logic variant of) a background theory of the form {φi → ψi | 1 ≤ i ≤ m}. Restricting non-logical axioms to implications is (i) not a real restriction: we can transform each background theory Γ into a single implication of the form → ψ∈Γ ψ; (ii) quite natural in various application, and (iii) enables the use of efficient optimisation techniques in tableau systems [109], which we will discuss in Section 4.4. Converse modalities. We discuss modifications of our algorithms to decide satisfiability of K n formulae w.r.t. background theories, where K n is the extension of Kn that allows the use of converse modal parameters i in modalities. That is, [i ]φ and i φ are also well-formed formulae. The mapping R is extended to converse modal parameters as follows: Ri = {(w, v) |
186
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Ri (v, w)}. Converse modalities are of interest because they occur naturally in applications, e.g., in description logics [105, 171] and temporal logics [163, 187], and because they require reasoning techniques that are able to reason in both directions over relations. For example, to detect the unsatisfiability of the formula q ∧ i (p ∧ [i ]¬q), one has to reason both ways over Ri . This is similar to the kind of reasoning required for KBn but slightly more tricky since, in K n , reasoning in “both ways” over a relation depends also on the worlds related by Ri . For example, the KBn formula [i]ψ is equivalent to the K n formula [i]ψ ∧ [i ]ψ. Graded/deterministic modalities. We discuss modifications of the tableau algorithm to handle deterministic and graded modalities. The former have (atomic) modal parameters i whose interpretation Ri has to be a functional relation. To understand graded modalities, note that a diamond formula i φ can be read as “in at least one i-related world, φ is true”, and a box formula [i]φ can be read as “in at most zero i-related worlds, φ is not true”. Graded modalities generalise these formulae: Kcn (resp. K,c n ) is the extension of Kn (resp. Kn ) where we also allow for formulae of the form i m φ and [i]m φ. We read i m φ as “in at least (m + 1) i-related worlds, φ is true” and [i]m φ as “in at most m i-related worlds, φ is true”. The semantics is extended in the obvious way. M, w |= i m φ iff there are at least m + 1 worlds v ∈ W with Ri (w, v) and M, v |= ψ M, w |= [i]m φ iff there are at most m worlds v ∈ W with Ri (w, v) and M, v |= ψ Please note that ¬[i]m φ is equivalent to i m ¬φ and that, by adding → [i]1 to our background theory, we restrict models to those in which Ri is a functional relation. Thus algorithms that can handle both graded modalities and background theories can also handle deterministic modalities. From a complexity point of view, adding graded/deterministic modalities rarely effects are both PSpace-complete without background the worst case complexity, e.g., Kcn and K,c n theories [93, 186] and ExpTime-complete w.r.t. background theories [173, 184, 186]. From a practical reasoning perspective, graded modalities add quite some difficulty: consider, e.g., the formulae [i]3 ∧ i 1 (p ∨ q) ∧ i 1 (¬p ∨ q) and [i]1 p ∧ [i]1 ¬p ∧ i 2 q. The former is satisfiable, but we have to find that the two diamond formulae can be satisfied via a “common” i-related world. The latter is unsatisfiable, but we have to find that a third i-related world in which neither p nor ¬p holds cannot exist. Nominals. In their simplest form, nominals [5, 163] are propositional variables that are true in exactly one world; we use o1 , o2 , . . . for these variables and indicate the availability of nominals in a logic by the superscript ·o as, e.g., in Kon . Nominals are of interest for automated reasoning since they destroy the tree model property (TMP) (see Chapter 1 of this handbook) of a logic. For example, the formula o2 ∧ i (o1 ∧ i o2 ) has only models with a cycle of length two. We mentioned above that Kn enjoys this property (and so do its extensions with converse and graded modalities and background theories), and that this property is exploited by tableau- and some resolution-based algorithms. Interestingly, adding nominals to K n takes the complexity from PSpace- to ExpTime-completeness [5], and adding nominals to K,c n takes the complexity with background theories. to NExpTime-completeness [186]. Here, we will consider K,o n 3 TRANSLATION-BASED METHODS
3.1 Local satisfiability in multi modal Kn As outlined in Chapter 1 of this handbook, using the standard translation formulae of the basic modal logic K can be embedded into first-order logic. This translation is also called the relational translation, since it is based on the relational Kripke semantics for modal logic. In the following
Computational Modal Logic
187
we denote this translation by πr and present here its straightforward generalisation to multimodal Kn . πr (, x) =
πr (⊥, x) = ⊥ πr (¬ϕ, x) = ¬πr (ϕ, x)
πr (p, x) = Pp (x)
for ∈ {∧, ∨, →, ↔} πr ( i ϕ, x) = ∃y (Ri (x, y) ∧ πr (ϕ, y)) πr ([i]ϕ, x) = ∀y (Ri (x, y) → πr (ϕ, y))
πr (ϕ ψ, x) = πr (ϕ, x) πr (ψ, x)
In the translation, each propositional variable p is uniquely associated with a unary predicate symbol Pp , while each modal parameter i, 1 ≤ i ≤ n, is uniquely associated with a binary predicate symbol Ri . In addition, x is an arbitrary first-order variable while y is an arbitrary first-order variable distinct from x. This translation is satisfiability equivalence preserving, that is, for every modal formula ϕ, ϕ is Kn satisfiable iff πr (ϕ, x) is first-order satisfiable. The free variable x is assumed to be existentially quantified. The currently predominant method for reasoning about first-order formulae is resolution [170]. The method requires that a first-order formula or set of first-order formulae ϕ is first transformed into a satisfiability equivalent set of clauses N0 . This set of clauses is then saturated using the resolution rule and factoring rule shown in Figure 1. That is, given a clause set Ni , i ≥ 0, these inference rules are applied (top-down) to clauses already in the set and the conclusion C of such an application is added to Ni to give us the clause set Ni+1 . This process continues until either (i) the current clause set Ni contains the empty clause (i.e. ⊥) or (ii) no new clauses can be derived, that is, any conclusion of an application of the resolution and factoring rules to clauses in Ni is already contained in Ni . Any clause set containing the empty clause is unsatisfiable. Thus, in the case (i), Ni is unsatisfiable and by the soundness of the resolution calculus, so is N0 . This implies that ϕ is unsatisfiable, since N0 is satisfiable iff ϕ is satisfiable. In the case (ii), if Ni does not contain the empty clause, Ni is satisfiable and it is possible to construct a model for Ni . By the completeness of the resolution calculus, N0 is satisfiable. It follows that ϕ is satisfiable. Due to the undecidability of first-order logic, there is in general no guarantee that, after a finite number of steps, we either always encounter case (i) or (ii). If we apply the inference rules of the resolution calculus in a fair way, then the completeness of the resolution calculus ensures that, eventually, the empty clause is derived. However, if the formula ϕ and the clause set N0 are satisfiable, then the saturation process may continue indefinitely (unless suitable resolution refinements and/or translation methods are used, see below). The last observation is also true if the formula ϕ we are considering belongs to a decidable fragment of first-order logic or is the result of translating a formula belonging to a decidable modal logic like Kn . However, starting with [123], a large number of fragments of first-order logic have been shown to be decidable by resolution or refinements of resolution [48, 65, 76, 82, 117, 179]. C ∨ A1 ¬A2 ∨ D (C ∨ D)σ where σ is the most general unifier of atoms A1 and A2
Resolution:
C ∨ L1 ∨ L2 (C ∨ L1 )σ where σ is the most general unifier of literals L1 and L2
Factoring:
Figure 1. The resolution calculus R
188
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Let us start by considering what happens if we apply the basic unrefined resolution calculus to the relational translation of modal formulae. Consider, for example, the modal formula ϕ1 = [2](p → 1 p). Its translation πr (ϕ1 , x) is the first-order formula ψ1r = ∀y (R2 (x, y) → (Pp (y) → ∃z (R1 (y, z) ∧ Pp (z)))). The corresponding set of clauses N0r consists of the two clauses (1) ¬R2 (a, x) ∨ ¬Pp (x) ∨ R1 (x, f (x)) (2) ¬R2 (a, y) ∨ ¬Pp (y) ∨ Pp (f (y)) where a is a constant introduced during the clause form transformation (for the free variable x in ψ1r ). We assume that the variables in two clauses to which we want to apply the resolution rule are renamed so that they are variable disjoint, and we consider such variant clauses to be equal. There are several possibilities to apply the resolution rule to clauses (1) and (2). For example, we can resolve clause (1) on its second literal, ¬Pp (x), with clause (2) on its third literal, Pp (f (z)). The conclusion is [(1)2,R,(2)3] (3) ¬R2 (a, f (z)) ∨ R1 (f (z), f (f (z))) ∨ ¬R2 (a, z) ∨ ¬Pp (z) Clause (3) resolves with clause (2) and yields [(2)3,R,(3)4] (4) ¬R2 (a, f (y)) ∨ ¬R2 (a, f (f (y))) ∨ R1 (f (f (y)), f (f (f (y)))) ∨ ¬R2 (a, y) ∨ ¬Pp (y) This clause also resolves with clause (2), and again, the conclusion resolves with (2), and so forth. Repeatedly resolving the newly derived clauses with (2) yields clauses with increasingly more literals and increasingly more complex terms. All these clauses are new, that is, none is the same as an input clause or a clause derived earlier. As the formula ϕ1 and its translation ψ1r are satisfiable, we are not able to derive the empty clause. So, the saturation process will continue indefinitely. There are three approaches that we can take to solve this termination problem: 1. We can develop and use alternative translations of modal formulae to first-order (clause) logic, and try to find a translation for which resolution is a decision procedure. 2. We can develop and use refinements of resolution which restrict the application of the inference rules of the resolution calculus and use powerful redundancy elimination methods. 3. We can develop and use alternative inference methods for first-order logic. These three approaches are not mutually exclusive, in particular, alternative translations can be combined with both refinements of resolution and alternative calculi. Investigations following the first approach have resulted in the introduction of the optimised functional translation of Kn to sorted first-order logic, more precisely, to a monadic fragment of sorted first-order logic called basic path logic [149, 177]. Basic path logic has a sort SW for the set of worlds W and a sort Si for each modal parameter i, 1 ≤ i ≤ n, in a modal logic. It has n binary functions [ ]i of sort SW × Si → SW . Also there are special unary predicates def i of sort SW representing subsets of W . Each propositional variable p is uniquely associated with a unary predicate symbols Pp of sort SW . Commonly, the optimised functional translation πof is defined as a two step process: (i) the application of the functional translation to a modal formula which translates it to basic path logic, followed by (ii) the application of a quantifier exchange operation which converts the first-order formula obtained from the functional translation into
Computational Modal Logic
189
prenex normal form and moves all existential quantifiers inwards as far as possible. Since we focus here only on the satisfiability problem, we can give a simplified presentation of the optimised functional translation obtained in just one step. πof (, s) = πof (p, s) = Pp (s)
πof (⊥, s) = ⊥ πof (¬ϕ, s) = ¬πof (ϕ, s) for ∈ {∧, ∨, →, ↔}
πof (ϕ ψ, s) = πof (ϕ, s) πof (ψ, s) πof ([i]ϕ, s) = ∀y:Si (def i (s) → πof (ϕ, [s y:Si ]i )) πof ( i ϕ, s) = def i (s) ∧ πof (ϕ, [s y:Si ]i )
where s denotes a (world) path and y:Si denotes a variable of sort Si . The omission of the quantifiers in the definition for i ϕ is intensional. The optimised functional translation of a modal formula ϕ in negation normal form is now given by πof (ϕ, x:SW ), where x:SW is an arbitrary variable of sort SW , and x:SW as well as the y:Si from πof ( i ϕ, s) are free variables which are implicitly existentially quantified. As an example, consider again the modal formula ϕ1 = [2](p → 1 p). Its optimised functional translation is ϕof 1 = πof (ϕ1 , x:SW ) = ∀y:S2 (def 2 (x:SW ) → (Pp ([x:SW y:S2 ]2 ) → (def 1 ([x:SW y:S2 ]2 ) ∧ Pp ([[x:SW y:S2 ]2 z:S1 ]1 )))). In the representation of paths we often remove all occurrences of the binary functions [ ]i except for the outermost occurrence and also leave out the index of that remaining occurrence, e.g. [[x:SW y:S2 ]2 z:S1 ]1 is written as [x:SW y:S2 z:S1 ]. It is straightforward to restore the original path based on the remaining information. Intuitively, a path term like [x:SW y:S2 z:S1 ] represents a path from a world x to another, possible identical, world in a Kripke frame via a series of ‘steps’ along the accessibility relations of the frame. Here an R2 -step is followed by an R1 -step, which is indicated by the sorts S2 and S1 associated with the variables y and z, respectively. The def i predicates express ‘definability’ for a world in the sense that def i (s) is true iff the world s has an i-successor. The standard translation πr accommodates axiom schemas like 4 and B by adding first-order formulae (RB ) (R4 )
∀x y (Ri (x, y) → Ri (y, x)) ∀x y z ((Ri (x, y) ∧ Ri (y, z)) → Ri (x, z))
representing the relational frame properties corresponding to these axiom schemas. By contrast, in the case of the optimised functional translation, we add so-called functional frame properties in the form of (conditional) equations between path terms, for example (FB )
∀x:SW ∀y:Si ∃z:Si (def i (x:SW ) → def i ([x:SW y:Si ]) ∧ def i (x:SW ) → x:SW = [[x:SW y:Si ] z:Si ])
(F4 )
∀x:SW ∀y:Si ∀z:Si ∃u : Si ((def i (x:SW ) ∧ def i ([x:SW y:Si ])) → [[x:SW y:Si ] z:Si ] = [x:SW u : Si ])
Functional frame properties corresponding to axiom schemas 5, D, T, G, as well as functional frame properties corresponding to weak density, irreflexivity, and McKinsey’s axiom can be found in [177]. THEOREM 1 ([149]). Let Kn Σ be a complete modal logic such that the functional frame properties corresponding to the axiom schemas in Σ are a set of first-order formulae FΣ . Then ϕ is satisfiable in Kn Σ iff FΣ ∧ πof (ϕ, x:SW ) is first-order satisfiable.
190
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
If we are only interested in establishing the satisfiability of formulae in the basic modal logic Kn or extensions of Kn by the axiom schema D for some or all modalities, then the use of sorted first-order logic and binary function symbols can be avoided by using k-ary predicates where the sort information is coded into the predicate names [95, 116]. The k-ary predicate symbols are Pp,σ and def i,σ where p denotes a propositional symbol, σ is a k-sequence of natural numbers and 1 ≤ i ≤ n, n ≥ 0. We use x to denote a sequence of variables x1 , . . . , xk , and we use ‘’ and ‘.’ for the empty sequence and the concatenation operation on sequences, respectively. (, x, k, σ) = πof πof (p, x, k, σ) =
πof (⊥, x, k, σ) = ⊥
Pp, if σ = and k = 0 Pp,σ (x1 , . . . , xk ) otherwise
(¬ϕ, x, k, σ) = ¬πof (ϕ, x, k, σ) πof πof (ϕ ψ, x, k, σ) = πof (ϕ, x, k, σ) πof (ψ, x, k, σ) πof ([i]ϕ, x, k, σ) πof ( i ϕ, x, k, σ)
= ∀xn+1 (def i,σ (x) →
for ∈ {∧, ∨}
πof (ϕ, x.xk+1 , k+1, σ.i))
= def i,σ (x) ∧ πof (ϕ, x.xk+1 , k+1, σ.i)
The translation of a modal formula ϕ in negation normal form is given by πof (ϕ, , 0, ). In the case of the modal logic KDn , and in fact for any modal logic where an accessibility relation Ri is serial, all occurrences of def i,σ can be replaced with the logical constant . , called the polyadic optimised functional translation, takes advantage of The translation πof two observations:
1. All paths in πof (ϕ, x:SW ) start with x:SW and since this variable is free, it is implicitly existentially quantified, and is interpreted as a constant. Therefore, removing x:SW from all paths is a satisfiability equivalence preserving transformation. 2. The variables in the paths occurring in πof (ϕ, x:SW ) are prefix stable, that is, for any variable xi+1 :Sji there exists a unique prefix [x:SW x0 :Sj0 . . . xi :Sji ] such that every path containing xi+1 :Sji has the form [x:SW x0 :Sj0 . . . xi :Sji xi+1 :Sji+1 . . . xk :Sjk ]. Thus, if a variable occurs at position i in one path, then it occurs at position i in all paths. This property is due to a characteristic ordering of variables in the path terms determined by the structure of modal formulae and is a reflection of the tree model property. Also, since variables do not ‘move’, the sort information can be associated with the position at which a variable occurs instead of with the variable itself. Thus, we can code the sort information into predicate names. Replacing Pp ([x:SW x0 :Sj0 . . . xk :Sjk ]) by Pp,SW Sj0 ...Sjk (x, x0 , . . . , xk ) is therefore a satisfiability equivalence preserving transformation. Taking both observations together, and also taking advantage of the assumption that each sort Si is uniquely identified by its index i, we see that we can replace Pp ([x:SW x0 :Sj0 . . . xk :Sjk ]) with Pp,j0 ...jk (x0 , . . . , xk ). For the modal formula ϕ1 = [2](p → 1 p) the translation using πof is ψ1of = ∀y (def 2, →
(Pp,2 (y) → (def 1,2 (y) ∧ Pp,21 (y, z)))). The corresponding set N0of of clauses again consists of two clauses. (5) ¬def 2, ∨ ¬Pp,2 (y) ∨ def 1,2 (y) (6) ¬def 2, ∨ ¬Pp,2 (y) ∨ Pp,21 (y, z)
Computational Modal Logic
191
Unlike for the clausal form of the relational translation of ϕ1 , for these two clauses there is no possibility to apply either the resolution rule or the factoring rule. For, we see that Pp,21 (y, z) in clause (6) is not unifiable with Pp,2 (y) in clause (5), nor is it unifiable with Pp,2 (y) in clause (6). So, for this particular example we are able to conclude that N0of , ψ1of , and ϕ1 are satisfiable without the need to perform a single inference step. With this translation, is termination of the saturation process guaranteed? Consider the modal formula ϕ2 = [2](¬p ∨ [1]q) ∨ [2]p. Its optimised functional translation is
ψ2of = ∀y(def 2, → (¬Pp,2 (y) ∨ ∀z(def 1,2 (y) → Pq,21 (y, z)))) ∨ ∀u(def 2, → Pp,2 (u)). The corresponding set N0of of clauses consists of just one clause (7) ¬def 2, ∨ ¬Pp,2 (y) ∨ ¬def 1,2 (y) ∨ Pq,21 (y, z) ∨ ¬def 2, ∨ Pp,2 (u). We consider clauses to be multisets of literals, that is, a literal can occur more than once in a clause, as is the case with the literal ¬def 2, in clause (7). It is sometimes convenient to consider clauses as sets of literals. However, this complicates the completeness proof for resolution calculi which commonly proceeds by lifting ground level derivations to the non-ground level. This lifting is easier if clauses are considered to be multisets on both the ground and the nonground level. Furthermore, multisets make the computational effort explicit which has to go into removing duplicate literals from clauses. We can resolve clause (7) with itself on the second literal and the last literal. Remember that this means that we first have to generate a variable-disjoint copy of clause (7) to serve as second premise of a resolution step. The conclusion is [(7)2,R,(7)6] (8) ¬def 2, ∨ ¬Pp,2 (y1 ) ∨ ¬def 1,2 (y1 ) ∨ Pq,21 (y1 , z1 ) ∨ ¬def 1,2 (y2 ) ∨ Pq,21 (y2 , z2 ) ∨ ¬def 2, ∨ Pp,2 (u2 ) ∨ ¬def 2, ∨ ¬def 2, . We observe that the number of occurrences of ¬def 2, has doubled, to four, and also that we now have two subclauses ¬def 1,2 (y1 ) ∨ Pq,21 (y1 , z1 ) and ¬def 1,2 (y2 ) ∨ Pq,21 (y2 , z2 ) which are variants of each other.1 Note that these two subclauses are not simply duplicates, so in a clauses-as-sets setting they would still remain, while all the duplicates of ¬def 2, would not occur. Clause (8) can again be resolved with itself or with clause (7). A possible resolvent is: [(7)2,R,(8)8] (9) ¬def 2, ∨ ¬Pp,2 (y3 ) ∨ ¬def 1,2 (y3 ) ∨ Pq,21 (y3 , z3 ) ∨ ¬def 1,2 (y1 ) ∨ Pq,21 (y1 , z1 ) ∨ ¬def 1,2 (y2 ) ∨ Pq,21 (y2 , z2 ) ∨ ¬def 2, ∨ Pp,2 (u2 ) ∨ ¬def 2, ∨ ¬def 2, ∨ ¬def 2, ∨ ¬def 2,
We can continue this process indefinitely, producing bigger and bigger clauses. This shows that the saturation process does not terminate. We observe, however, that resolution is not the only inference rule that can be applied to clause (8): we can also apply the factoring rule. Indeed, there are several possibilities to do so, for example, we can apply the factoring rule to Pq,21 (y1 , z1 ) and Pq,21 (y2 , z2 ). The resulting factor is: [(8)4,F,(8)6]
(10) ¬def 2, ∨ ¬Pp,2 (y1 ) ∨ ¬def 1,2 (y1 ) ∨ ¬def 1,2 (y1 ) ∨ Pq,21 (y1 , z1 ) ∨ ¬def 2, ∨ Pp,2 (u2 ) ∨ ¬def 2, ∨ ¬def 2, .
1 We consider two formulae or clauses to be equal iff they are variants of each other, that is, they are syntactically equal modulo variable renaming.
192
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
We see that the clause (10) is a subclause of the clause (8) from which it was derived. Clause (10) thus subsumes clause (8). In general, a clause C subsumes a clause D iff there is a substitution σ such that Cσ is a subclause of D. Subsumed clauses are redundant and can be removed from a clause set without losing completeness. Further factoring steps are possible on clause (10), for example, on the two occurrences of ¬def 1,2 (y1 ). It turns out that the final clause that we can derive by a series of factoring steps is a condensation of clause (8). By definition, a condensation Cond(C) of a clause C is a minimal subclause of C which is also an instance of C. A clause C is condensed iff there exists no condensation of C which is a strict subclause of C. For any clause C, Cond(C) subsumes C, and hence C is redundant in the presence of Cond(C) and can be removed. This justifies that we can systematically replace clauses with their condensation. The condensation of clauses (7) and (8) are the clauses (7 ) ¬def 2, ∨ ¬Pp,2 (y) ∨ ¬def 1,2 (y) ∨ Pq,21 (y, z) ∨ Pp,2 (u) (8 ) ¬def 2, ∨ ¬Pp,2 (y1 ) ∨ ¬def 1,2 (y1 ) ∨ Pq,21 (y1 , z1 ) ∨ Pp,2 (u2 ). These two clauses are variants of each other, that is, we regard them as equal. So, the only clause derivable from (7 ) is identical to (7 ), which means the saturation process terminates. It turns out that systematically replacing clauses by their condensation is sufficient to guarantee termination not only for this particular example formula, but for any modal formula in Kn or KDn . (ϕ, , 0, ). Then the saturation THEOREM 2 ([175]). Let ϕ be a modal formula and N0 = πof process from N0 by the resolution calculus R defined in Figure 1 in which clauses are systematically and eagerly replaced with their condensation always terminates with a clause set Nn , and ϕ is K(D)n unsatisfiable iff Nn contains the empty clause.
It is important to understand how Theorem 2 is to be interpreted. The theorem says that R plus condensing is a decision procedure for this translation of modal satisfiability problems. It does not stipulate that we must use R plus condensing. Rather, the theorem sets out the minimal requirement or weakest condition we have to impose on a saturation process by R to ensure that it terminates. It states that, as long as we keep clauses condensed, we can use any refinement of the calculus R , we can perform inference steps on any literals in a clause and can perform inference steps in any order, and the saturation process is still guaranteed to terminate. Condensing can be simulated by factoring and subsumption deletion. Consequently, any firstorder theorem prover which implements some refinement of R (and subsumption deletion, which is standardly available) can serve as a decision procedure for Kn and KDn . The question as to which particular refinement of resolution to use (determining which inference steps are required for completeness) and which particular strategies and heuristics to use (determining the order in which inference steps are performed) is then subject to both theoretical and empirical investigation. We leave empirical aspects aside for the moment and instead focus on refinements of resolution. A wide range of refinements of resolution can be formulated in the general resolution calculus of Bachmair and Ganzinger; full details can be found in [16]. In the general resolution calculus, here denoted by R S , inference rules are parameterised by an admissible ordering ! on literals and a selection function S. Essentially, an admissible ordering is a total (well-founded) strict ordering on the ground level such that for literals: . . . ! ¬An ! An ! . . . ! ¬A1 ! A1 . This is extended to the non-ground level in a canonical manner. A selection function S assigns to each clause a possibly empty set of occurrences of negative literals. If C is a clause, then the
Computational Modal Logic
N N ∪ {Cond(C)} if C is either a resolvent or a factor of clauses in N .
Deduction:
N ∪ {C} N if C is redundant in N . Deletion:
N ∪ {C ∨ D} Splitting: N ∪ {C} | N ∪ {D} if C and D are variable-disjoint.
193
C ∨ A1 ¬A2 ∨ D (C ∨ D)σ where (i) σ is the most general unifier of atoms A1 and A2 , (ii) no literal is selected in C, and A1 σ is strictly !-maximal with respect to Cσ, and (iii) ¬A2 is either selected, or ¬A2 σ is maximal with respect to Dσ and no literal is selected in D. Resolution:
C ∨ A1 ∨ A2 (C ∨ A1 )σ where (i) σ is the most general unifier of atoms A1 and A2 , and (ii) no literal is selected in C and A1 σ is !-maximal with respect to Cσ. Positive Factoring:
Figure 2. Expansion and inference rules of R S literal occurrences in S(C) are selected. No restrictions are imposed on the selection function. The calculus comprises expansion rules of the general form N N1 | · · · | Nn where both the numerator N and the denominators N1 , . . . , Nn (n ≥ 1) are finite sets of clauses. Expansion rules are applied top-down. There are three kinds of expansion rules: Deduction, Deletion and Splitting which are defined in Figure 2. The inferences rules consist of the resolution and the factoring rule also defined in Figure 2. The left premise of the resolution rule is called the positive premise and the right premise is called the negative premise. The implicit assumption is that the premises have no common variables. Resolvents are conclusions of resolution steps, while factors are conclusions of factoring steps. A derivation in R S from a set of clauses N is a finitely branching, ordered tree T with root N and nodes which are sets of clauses. The tree is constructed by applications of the expansion rules to the leaves. We assume that no resolution or factoring inference (on the same premises) is performed twice on the same branch of the derivation. A branch N (= N0 ), N1 , . . . in a derivation T is called a closed branch in T iff the clause set j≥0 Nj contains the empty clause, otherwise it is called an open branch. We call a branch B in a derivation tree complete (with
respect to R S ) iff no new successor nodes can be added with RS to the endpoint of B, otherwise it is called an incomplete branch. A derivation T is a refutation iff every path N (= N0 ), N1 , . . . in it is a closed branch, otherwise it is called an open derivation. In general, the calculus R S can be enhanced with standard simplification rules such as tautology deletion and subsumption deletion. In fact, it can be enhanced by all simplification rules which are compatible with a general notion of redundancy [16, 18]. For example, C is redundant in N ∪ {Cond(C)}. A set N of clauses is saturated up to redundancy with respect to a particular refinement of resolution if the conclusion of every inference from non-redundant premises in N is either contained in N , or else is redundant in N . Aderivation T from N is called fair if, for any path N (= N0 ), N1 , . . . in T with limit N∞ = j≥0 k≥j Nk , it is the case that each clause C which can be deduced from non-redundant premises in N∞ is contained in some Nj . Intuitively, fairness means that no non-redundant inferences are delayed indefinitely. For a finite
194
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
complete branch N (= N0 ), N1 , . . . Nn , the limit N∞ is equal to Nn . THEOREM 3 ([18]). Let T be a fair R S derivation from a set N of clauses. Then 1. if N (= N0 ), N1 , . . . is a path with limit N∞ , then N∞ is saturated (up to redundancy), 2. N is satisfiable iff there exists a path in T with limit N∞ such that N∞ is satisfiable, and 3. N is unsatisfiable iff for every path N (= N0 ), N1 , . . . the clause set j≥0 Nj contains the empty clause. As an aside, we note that it follows from the decidability result for the optimised functional translation (Theorem 2) that we can use any instance of R S for the clause sets obtained by applying πof to modal formulae in Kn or KDn . In particular, this gives us full flexibility with respect to orderings and selection functions. Furthermore, by Theorem 2, even instances of R S without splitting will terminate. The purpose of the ordering ! and the selection function S is to restrict the set of literals in a clause to which resolution and factoring can be applied. This limits the number of inferences performed and consequently reduces the search space. For example, reconsider the clause set N0of consisting of just the clause (7) ¬def 2, ∨ ¬Pp,2 (y) ∨ ¬def 1,2 (y) ∨ Pq,21 (y, z) ∨ ¬def 2, ∨ Pp,2 (u). Using an ordering we could restrict inference steps to the literals Pq,21 (y, z) and Pp,2 (u). Now ¬Pp,2 (y) can no longer be resolved with Pp,2 (u), since ¬Pp,2 (y) is neither maximal nor selected. Alternatively, using a selection function we could restrict inference steps to the negative literals ¬def 2, or ¬Pp,2 (y). Again, no inference steps are possible. Let us reconsider our very first example, the set of clauses N0r obtained via the relational translation of ϕ1 = [2](p → 1 p): (1) ¬R2 (a, x) ∨ ¬Pp (x) ∨ R1 (x, f (x)) (2) ¬R2 (a, y) ∨ ¬Pp (y) ∨ Pp (f (y)) If we use an ordering ! such that R1 (x, f (x)) is maximal in clause (1) and Pp (f (y)) is maximal in clause (2), then no inference steps are possible on N0r . Likewise, if we select the literals ¬R2 (a, x) and ¬R2 (a, y) in their respective clauses, then again no inference steps are possible. This raises the question whether it is possible to obtain decision procedures for Kn satisfiability based on the relational translation πr and the calculus R S by using particular ordering or selection functions. To simplify matters, we use a technique called structural transformation. The purpose of the structural transformation is to convert the first-order translation into a more manageable form. Before we describe it formally, we need to define some basic notions. The polarity of (occurrences of) modal or first-order subformulae is defined as usual. Any occurrence of a proper subformula of an equivalence has zero polarity. For occurrences of subformulae not below a ‘↔’ symbol, an occurrence of a subformula has positive polarity if it is inside the scope of an even number of (explicit or implicit) negations, and it has negative polarity if it is inside the scope of an odd number of negations. For any first-order formula ϕ, if λ is the position of a subformula in ϕ, then ϕ|λ denotes the subformula of ϕ at position λ and ϕ[ψ → λ] is the result of replacing ϕ|λ at position λ by ψ. The set of all the positions of subformulae of ϕ is denoted by Λ(ϕ). Structural transformation, also referred to as renaming, associates a predicate symbol Qλ and a literal Qλ (x) with each element λ of Λ ⊆ Λ(ϕ), where x = x1 , . . . , xn are the free variables
Computational Modal Logic
195
of ϕ|λ , the symbol Qλ does not occur in ϕ and two symbols Qλ and Qλ are equal only if ϕ|λ and ϕ|λ are equivalent formulae. In practice, one may want to use the same symbols for variant subformulae, or subformulae which are obviously equivalent, for example, ϕ ∨ ψ and ψ ∨ ϕ. − Let Def + λ (ϕ) = ∀x (Qλ (x) → ϕ|λ ) and Def λ (ϕ) = ∀x (ϕ|λ → Qλ (x)). The definition of Qλ is the formula ⎧ + ⎪ if ϕ|λ has positive polarity, ⎨Def λ (ϕ) Def λ (ϕ) = Def − (ϕ) if ϕ|λ has negative polarity, λ ⎪ ⎩ + − Def λ (ϕ) ∧ Def λ (ϕ) otherwise. The corresponding clauses are called definitional clauses. Now, assume that Λ is a set of positions in a formula ϕ and that we want to systematically replace subformulae at positions in Λ while adding definitions for the newly introduced predicate symbols. A convenient way to do so, is to start by the renaming innermost subformulae, and then to proceed up towards the root of ϕ. Formally, define Def Λ (ϕ) inductively by: Def ∅ (ϕ) = ϕ and
Def Λ∪{λ} (ϕ) = Def Λ (ϕ[Qλ (x) → λ]) ∧ Def λ (ϕ),
where λ is maximal in Λ ∪ {λ} with respect to the prefix ordering on positions. A definitional form of ϕ is Def Λ (ϕ), where Λ is a subset of all positions of subformulae of ϕ (usually, nonatomic or non-literal subformulae). THEOREM 4 (e.g. [29, 161]). Let ϕ be a first-order formula. Then 1. ϕ is satisfiable iff Def Λ (ϕ) is satisfiable, for any Λ ⊆ Λ(ϕ), and 2. Def Λ (ϕ) can be computed in polynomial time (or linear time if new symbols are introduced for all formulae occurring in Λ). By Λm (ϕ) we denote the set of positions in πr (ϕ, x) corresponding to non-atomic subexpressions of the modal formula ϕ. Structural transformation allows us to keep the structure of the clauses we have to deal with very simple. This in turn simplifies the characterisation of classes of clause sets that can be derived from some initial clause set using R S . For example, assume that, in the relational translation of the modal formula ϕ3 = [2] 1 p, we apply structural transformation to all positions that correspond to non-atomic subexpressions of the original modal formula ϕ3 . The result is the set of formulae on the left of Figure 3, while the clausal form is given on the right. In general, the formulae we obtain in this way from the relational translation of modal formulae (as well as the corresponding sets of clauses) belong to quite a number of decidable fragments of first-order logic, for example, the two-variable fragment, the guarded fragment [3], Maslov’s class K [135], and fluted logic [165, 166]. Resolution decision procedures have been developed for the guarded Q[2]1p (x) ∧∀x (Q[2]1p (x) → ∀y (R1 (x, y) → Q1p (y))) ∧∀x (Q1p (x) → ∃y (R1 (x, y) ∧ Pp (y)))
Q[2]1p (a)∗ ¬Q[2]1p (x) ∨ ¬R2 (x, y)∗ ∨ Q1p (y) ¬Q1p (x) ∨ R1 (x, f (x))∗ ¬Q1p (x) ∨ Pp (f (x))∗
Figure 3. The structural transformation and the clausal form of [2] 1 p
196
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
fragment [48, 76], for Maslov’s class K [111, 117], for fluted logic [179] and various other classes related to modal logics, see e.g. [65, 82, 83, 111]. Here we use the results for the clausal class DL∗ defined in [49]. DL∗ is a variation of the class of DL-clauses, that was introduced in [119] for the purpose of deciding expressive description logics. In order to simplify the definition of DL∗ , all clauses are assumed to be maximally split. The components in the variable partition of a clause are called variable-disjoint or split components, that is, split components do not share variables. If C1 , . . . , Cn are the split components of C, then we say C can be decomposed into C1 , . . . , Cn . A clause which cannot be split further is called a maximally split clause or an indecomposable clause. Now, a maximally split clause C is a DL∗ -clause iff the following conditions are satisfied: (i) all literals are unary, or binary; (ii) there is no nesting of function symbols; (iii) every functional term in C contains all the variables of C (this condition implies that, if C contains a functional ground term, then C is ground); (iv) every binary literal (even if it has no functional terms) contains all the variables of C. It can be shown that all clauses in structural form obtained from Def Λ (πr (ϕ, x)) for a modal formula ϕ belong to DL∗ [49]. In order to decide the class DL∗ , we use the following ordering. First we define an order >d on terms: s >d t if s is deeper than t, and every variable that occurs in t, occurs deeper in s. Then {t1 , . . . , tm }. Here >mul is the we define P (s1 , . . . , sn ) ! Q(t1 , . . . , tm ) as {s1 , . . . , sn } >mul d d multiset extension of >d [16]. So we have P (f (x)) ! P (a), P (x) and P (x, y) ! Q(x), but not P (f (x)) ! P (f (a)). The selection function S is empty. We denote this particular instance of ord . the resolution calculus R S by R In the example in Figure 3, the maximal literals (with respect to !) are marked with ∗ . These are the literals that we may apply resolution or factoring to. In order to prove that the procedure Rord is indeed a decision procedure we have to show that it is complete and terminating. Completeness follows immediately from the completeness of R S . Termination follows from the fact, that over a finite signature, there are only finitely many maximally split DL∗ -clauses (module variable renaming), and the fact that, from DL∗ -clauses, Rord produces only clauses that are again in DL∗ , or are splittable into components in DL∗ (cf. [111, 119]). THEOREM 5 ([49, 180]). Let Σ be an arbitrary set of axiom schemas such that Kn Σ is complete and the clausal form of the relational frame properties FΣ corresponding to the axiom schemas in Σ are expressible in DL∗ . Let ϕ be a Kn formula and let N be the clausal form of FΣ,ϕ = FΣ ∧ Def Λm (ϕ) (πr (ϕ, x)). Then 1. ϕ is unsatisfiable in Kn Σ iff FΣ,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in double exponential time; if Σ is empty, then any derivation from N in Rord (up to redundancy) terminates in exponential time, and Here, and in subsequent theorems, we assume that the complexity of redundancy elimination is at most exponential in the size of a clause set. The theorem remains true for Rord without the splitting rule, but condensing is key for decidability. It is usually the case that, when studying modal decidability problems by analysing the decidability of related clausal classes, one comes to realise that stronger results are possible than
Computational Modal Logic
197
initially anticipated. In [49], extensions of Kn with PDL-like relational operations have been studied. Relational operations expressible in DL∗ include intersection, union, complementation, and converse, as are non-logical axioms. In Rord , the inferences performed are determined by a refinement based on an ordering and the empty selection function. We now consider results from [49, 119, 121, 180] for a different refinement which is based solely on a selection function and an optional ordering. More precisely, the calculus is based on maximal selection of negative literals. This means the selection function S selects exactly the set of all negative literals in any non-positive clause. When no ordering refinement ! is used, the resolution rule of R S can be replaced with the following rule. Resolution with maximal selection: C1 ∨ A1 · · · Cn ∨ An ¬An+1 ∨ . . . ∨ ¬A2n ∨ D (C1 ∨ . . . ∨ Cn ∨ D)σ provided that for every i, 1 ≤ i ≤ n, (i) σ is the most general unifier of Ai and An+i , (ii) Ci ∨ Ai and D are positive clauses, (iii) no Ai occurs in Ci , and (iv) the ¬An+i are selected. The negative premise is ¬An+1 ∨ . . . ∨ ¬A2n ∨ D and the other premises are the positive premises. The literals Ai and An+i are the eligible literals. Let Rhyp be the instance of R S based on maximal selection and no ordering. This means that the rules are the above resolution rule, positive unordered factoring and splitting. This refinement of resolution is also referred to as hyperresolution plus splitting. Condensation is not needed, but could of course be added without losing completeness and will improve the performance of the procedure. Tautology deletion is used as a simplification rule. All derivations in Rhyp are generated by strategies in which no application of the resolution or factoring with identical premises and identical consequence may occur twice on the same path in any derivation. In addition, deletion rules, splitting, and the deduction rules are applied in this order, except that splitting is not applied to clauses which contain a selected literal. All clauses occurring in the clausal form of Def Λm (ϕ) (πr (ϕ, x)) for a modal formula in Kn have one of the forms described in Figure 4 [49, 119]. The literals marked with + are selected in the clauses by the maximal selection function S. The notation P(s) in the figure represents some literal with a unary predicate symbol and argument term s, and R(s, t) represents some literal with a binary predicate symbol and argument terms s and t (not necessarily in this order). Two occurrences of P(s) or R(s, t) need not be identical, for example, ¬Qψ (x) ∨ Pp (x) ∨ Qχ (x) is an instance of ¬Qψ (x) ∨ P(x) ∨ P(x), while ¬Qψ (x) ∨ ¬Ri (y, x) ∨ Qχ (y) is an instance of ¬Qψ (x) ∨ ¬R(x, y) ∨ P(y). As all non-unit clauses of a typical input set contain a selected literal, all definitional clauses P(a) ¬Qψ (x)+ ∨ ¬Pp (x)+
if ψ = ¬p
¬Qψ (x) ∨ P(x) [∨ P(x)]
if ψ = φ1 ∧ φ2 [ψ = φ1 ∨ φ2 ]
¬Qψ (x) ∨ ¬R(x, y) [∨ P(y)]
if ψ = [i]⊥ [ψ = [i]φ]
+ +
+
¬Qψ (x) [∨ P(f (x))] +
¬Qψ (x)+ ∨ R(x, f (x))
if ψ = i [ψ = i φ]
Figure 4. Schematic clausal forms for Kn
198
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
can only be used as negative premises of resolution steps. To begin with, there is only one candidate for a positive premise, namely, the ground unit clause Qϕ (a) (which representing the input formula ϕ). Inferences with such ground unary unit clauses produce ground clauses consisting of positive literals only, which are split into ground unit clauses. It can be shown that maximally split (non-empty) inferred clauses have one of two forms: P(s), or R(s, f (s)), where s is a ground term [119]. In general, s is a nested non-constant functional ground term, which is typically avoided in resolution decision procedures based on an ordering refinement because, in most situations, nesting causes unbounded computations. For the class of clauses under consideration, however, any derived clause is smaller than its positive parent clauses with respect to a well-founded ordering which reflects the structure of the formula. THEOREM 6 ([119, 121]). Let ϕ be a Kn formula and let N be the clausal form of the formula Def Λm (ϕ) (πr (ϕ, x)). Then 1. ϕ is unsatisfiable in Kn iff there is a refutation of N by Rhyp , and 2. any Rhyp derivation from N terminates. THEOREM 7 ([49]). Let ϕ be a Kn formula. The space complexity for testing the satisfiability of a modal formula ϕ with Rhyp is bounded by O(ndm ), where n is the number of symbols in ϕ, d is the number of different diamond subformulae in ϕ, and m is the modal depth of ϕ.2 Formulae in Kn translate by the relational translation into the guarded fragment, in particular, into the two-variable guarded fragment GF2 . It is not difficult to see that formulae in Kn are in fact translated into the subfragment GF − , introduced in [134]. Under the assumption that either (i) there is a bound on the arity of predicate symbols in GF − formulae, or (ii) that each subformula of a GF − formula has a bounded number of free variables, the satisfiability problem of GF − is PSpace-complete, the same as for the satisfiability problem of Kn . Obviously, there is a bound of two on the arity on predicate symbols occurring in the relational translation of modal formulae in Kn . From these observations a well-known result follows. THEOREM 8. The computational complexity of the satisfiability problem of Kn is PSpacecomplete. In [81] it is shown that Rhyp can be implemented as a modification of the main procedure of a standard (saturation based) first-order theorem prover with splitting (e.g. ( M ) SPASS [120, 174, 192, 194]) to provide a space optimal decision procedure for GF − . A direct consequence is the following. THEOREM 9 ([81, 180]). Rhyp can be turned into a polynomial space resolution decision procedure for Kn . A more detailed description of how this can be done is given in Section 3.4. Another interesting aspect of Rhyp is that it can polynomially simulate tableau algorithms [118, 119, 121]. In general, a proof system A polynomially simulates (p-simulates) a proof system B iff there is a function g, computable in polynomial time, mapping proofs of any given formula ϕ in B to proofs of ϕ in A [38]. To establish a correspondence between tableau proofs and derivations in Rhyp , we make use of the fact that each subformula ψ of a given modal formula ϕ corresponds to a predicate symbol Qψ in Def Λm (ϕ) (πr (ϕ, x)). Every node w occurring in a tableau completion tree corresponds to a term tw occurring in a Rhyp derivation. A formula ψ 2 The
modal depth of a formula ϕ is the maximal nesting of modal operators i or [i] in ϕ.
Computational Modal Logic
199
occurring in a set labelling a node w corresponds to a unit clause Qψ (tw ) and any edge between nodes w and v with label i in a completion tree corresponds to a unit clause Ri (tw , f (tw )) in a Rhyp derivation, where tw is the term corresponding to node w and f (tw ) is the term corresponding to node v, for some function symbol f . Given these correspondences, each application of a tableau expansion rule to a completion tree can be simulated by at most two applications of expansion rules in a Rhyp derivation. This p-simulation result extends to tableau algorithms for many extension of Kn , for example extensions by the modal axiom schemas T, D, B, 4, and 5 [121]. It also extends to other forms of tableau and sequent-style calculi. The notion of p-simulation leaves open the possibility that an algorithm based on the proof system A which p-simulates a proof system B would have to search a much larger search space to find a proof for a given formula than an algorithm based on B. For Rhyp , however, it is possible to show that the search space corresponds to that of the tableau algorithm for Kn presented in Section 4.2 [121]. Related simulation results of tableau procedures for description logics can be found in [118, 119], see also [65]. All these simulation results provide valuable insights into the similarities and difference between tableau methods and resolution. On the one hand, the view presented is that many tableau algorithms are essentially hyperresolution with lazy translation to first-order logic. On the other hand, because of the generality of the setting (first-order logic) it is even possible to exploit the close link with hyperresolution and use it as a basis for systematically developing new tableau procedures. Using this approach, a new tableau decision procedure was essentially ‘read off’ in [49] from a translation-based hyperresolution decision procedure for an expressive PDL-style modal logic. For the modal logic Kn , an improved version of the relational translation is presented in [9]. In the original presentation, this translation consists of two steps, first mapping a formula from one multi-modal logic into another, and then applying the relational translation to it. Our presentation merges both steps into one. We uniquely associate a unary predicate symbol Pp,σ with every propositional variable p and sequence σ of modalities. Similarly, we uniquely associate a binary predicate symbol Rσ with every sequence σ of modalities. Then the tree(-based) relational translation πtr is defined as follows. πtr (⊥, x, σ) = ⊥ πtr (, x, σ) = πtr (¬ϕ, x, σ) = ¬πtr (ϕ, x, σ) πtr (p, x, σ) = Pp,σ (x) πtr (ϕ ψ, x, σ) = πtr (ϕ, x, σ) πtr (ψ, x, σ) for ∈ {∧, ∨, →, ↔} πtr ([i]ϕ, x, σ) = ∀y(Rσ.i (x, y) → πtr (ϕ, y, σ.i)) πtr ( i ϕ, x, σ) = ∃y(Rσ.i (x, y) ∧ πtr (ϕ, y, σ.i)) The translation of a modal formula is given by πtr (ϕ, x, ). The tree relational translation can be viewed as incorporating a feature of the (optimised) functional translation into the relational translation. Whereas the relational translation uses a family of binary predicate symbols Ri , where i is a modal parameter, the tree relational translation uses a larger family of binary predicate symbols Rσ , where σ is a sequence of modal parameters representing a path from the initial world, to encode transitions between worlds. Another difference is that in the tree-based translation the σ are also encoded into the unary predicates. THEOREM 10. A modal formula ϕ is satisfiable in Kn iff πtr (ϕ, x, ) is first-order satisfiable. If we restrict ourselves to K, that is, our logic has only one modality, then the sequence σ in the definition of πtr only serves as a unary coding of the natural numbers. Thus, we can further
200
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
simplify the translation by using πtr (ϕ, x, 0) as translation of a modal formula and modifying the translation πtr as follows. πtr ([i]ϕ, x, σ) = ∀y(Rσ+1 (x, y) → πtr (ϕ, y, σ+1)) πtr ( i ϕ, x, σ) = ∃y(Rσ+1 (x, y) ∧ πtr (ϕ, y, σ+1)) All other cases in the definition of πtr remain unchanged. In [8] it is shown that we can use the following ordering to ensure that derivations in R S from the clausal form of πtr (ϕ, x, 0) of a K formula ϕ terminates: Pσ (s1 , . . . , sn ) ! Qδ (t1 , . . . , tm ) if either σ < δ, or σ = δ and n > m. This result can easily be extended to Kn by defining the ordering ! as Pσ (s1 , . . . , sn ) ! Qδ (t1 , . . . , tm ) if either length(σ) < length(δ) or length(σ) = length(δ) and n > m. This ordering restriction can be seen to force a kind of top-down approach. THEOREM 11. Let ϕ be a modal formula in Kn and let N be the clausal form of πtr (ϕ, x, ). Then any derivation from N in Rord (up to redundancy) without splitting terminates. One of the interesting aspects of this result is that it does not require the use of structural transformation (nor does it require the use of the splitting rule, but condensing is crucial).
3.2 Global satisfiability, non-logical axioms, transitive modalities, and K4n So far we have focused on local satisfiability, that is, the problem whether for a given modal formula ϕ, there exists a model M = W, R, V and a world w ∈ W such that M, w |= ϕ. Now we turn to the problem of determining whether there is a model M such that for all worlds w ∈ W M, w |= ϕ, i.e. is ϕ globally true in some model. The modifications necessary to allows us to determine the global satisfiability of a modal formula in Kn based on the relational translation are minimal: ϕ is globally satisfiable in Kn iff ∀x πr (ϕ, x) is first-order satisfiable. Is it straightforward to see that the clausal form N of Def Λm (ϕ) (∀x πr (ϕ, x)) still consists only of DL∗ clauses. Consequently, Rord can decide the satisfiability of the clause set N . THEOREM 12. Let Σ be an arbitrary set of axiom schemas such that Kn Σ is complete and the clausal form of the relational frame properties FΣ corresponding to the axiom schemas in Σ is in DL∗ . Let ϕ be a modal formula in Kn and let N be the clausal form of FΣ,ϕ = FΣ ∧ Def Λm (ϕ) (∀x πr (ϕ, x)). Then 1. ϕ is not globally satisfiable in Kn Σ iff FΣ,ϕ is not first-order satisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in double exponential time and in exponential time, if Σ is empty. For local and global Kn -satisfiability w.r.t. to a background theory of non-logical axioms the same result is true. Furthermore the complexity of ordered resolution is optimal. THEOREM 13. Let Γ = {γ1 , . . . , γn } be a finite set of of modal formulae and let ϕ be a modal formula. Let FΓ,ϕ be the first-order formula ∃x πr (ϕ, x) ∧ i=1,...,n ∀x πr (γi , x) and let N be the clausal form of Def ΛΓ,ϕ (FΓ,ϕ ), where ΛΓ,ϕ contains all non-atomic positions of FΓ,ϕ . Then 1. ϕ is unsatisfiable in Kn w.r.t. Γ iff FΓ,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord ,
Computational Modal Logic
201
2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in exponential time. In contrast to Rord , derivations in Rhyp from the clausal form of Def ΛΓ,ϕ (FΓ,ϕ ), as defined in Theorem 13, are not guaranteed to terminate. Tableau algorithms face the same problem, and the solution typically used is a technique called blocking. See Sections 4.3 and 4.4 for details. This technique can be transferred to the context of first-order clausal logic and Rhyp derivations as described in [118]. It involves the addition of a blocking rule which at certain points during a derivation adds equations t1 ≈ t2 between ground terms t1 and t2 to the clause set, rendering inferences on literals involving the greater of the two terms redundant. One of the interesting properties of this approach is that completeness follows immediately from the general completeness result for Rhyp [18], only soundness needs to be established. Another way of combining blocking with Rhyp is presented in [27]. In addition, optimisations techniques like lazy unfolding and absorption, which will be discussed in detail in Section 4.4, are in-built and therefore free in Rhyp . However, for Kn extended with axiom schemas sometimes quite different approaches are required. For example the formula ∀xyz ((Ri (x, y)∧Ri (y, z)) → Ri (x, z)) stating the transitivity of Ri is not a formula in any of the relevant decidable first-order fragments. The corresponding clause does not belong to DL∗ either. To handle transitive modal logics one possibility is to use the ordered chaining calculus introduced in [15] for binary relations satisfying the general schema Ri ◦ Rj ⊆ Rk . A decision procedure for a first-order fragment covering the modal logics K4, KD4, and KT4, and their multi-modal variants, which is based on ordered chaining, is presented in [77]. Recent work in [124] presents an extension of R S which can decide the guarded fragment with transitive guards. This provides a decision procedure for all modal logics translatable into this fragment. In the following we present another approach, the axiomatic translation approach [181], which allows a variety of modal logics with transitive modalities to be embedded in DL∗ . Consequently this allows the use of Rord to decide these logics. This method is not restricted to transitive modal logics and applies to a large class of modal logics. Remember that structural transformation introduces for each modal subformula [i]ψ of a modal formula ϕ a predicate symbol Q[i]ϕ in πr (ϕ, x). The general principle of the axiomatic translation approach for K4n is the following. For every transitive modality [i] and every subformula [i]ψ of the formula ϕ, add the first-order formula (A4 )
∀xy ((Q[i]ψ (x) ∧ Ri (x, y)) → Q[i]ψ (y)).
to the translation. The main technical question with the axiomatic translation principle is to know how many instances of such a ‘schema formula’ need to be added to the translation. In the Hilbert axiomatisation, axioms such as 4 are valid for all substitution instances. Since we do not have access to a substitution rule, we need to make sure from the outset that enough instances of the schema formulae are present in the translation of ϕ. (Of course, this does not preclude a lazy implementation which delays the translation of subformulae and the inclusion of instances of schema formulae until absolutely necessary.) The clausal form of A4 is ¬Q[i]ψ (x) ∨ ¬Ri (x, y) ∨ Q[i]ψ (y), which is a DL∗ clause (and a guarded clause). THEOREM 14. Let ϕ be a modalformula and Ξ the set of all subformulae of the form [i]ψ of ϕ. Let F4 be the first-order formula [i]ψ∈Ξ ∀xy ((Q[i]ψ (x) ∧ Ri (x, y)) → Q[i]ψ (y)). Let N be the clausal form of F4,ϕ = F4 ∧ Def Λm (ϕ) (πr (ϕ, x)). Then
202
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
1. ϕ is unsatisfiable in K4n iff F4,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in exponential time. The same result is true for global satisfiability in K4n and also reasoning with respect to nonlogical axioms. Theorem 14 reduces reasoning in K4n to reasoning in Kn with background theories. Consequently, Rhyp combined with a blocking rule provides an alternative decision procedure for K4n .
3.3 Converse modalities and the modal logics KBn and KB4n Extending the results of Section 3.1 to modal logics with converse modalities or to the modal logics KBn and KB4n is straightforward. For converse modalities we have to extend our definition of the relational translation πr as follows: πr ([i ]ϕ, x) = ∀y (Ri (y, x) → πr (ϕ, y))
πr ( i ϕ, x) = ∃y (Ri (y, x) ∧ πr (ϕ, y))
Then, Theorem 13 extends to the following. of K THEOREM 15. Let Γ = {γ1 , . . . , γn } be a finite set of n formulae and let ϕ be a Kn formula. Let FΓ,ϕ be the first-order formula ∃x πr (ϕ, x) ∧ i=1,...,n ∀x πr (γi , x)). Let N be the clausal form of Def ΛΓ,ϕ (FΓ,ϕ ) where ΛΓ,ϕ contain all non-atomic positions of FΓ,ϕ . Then
1. ϕ is unsatisfiable in K n w.r.t. Γ iff FΓ,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in exponential time. In the case of the modal logic KBn we extend the relational translation (or the axiomatic translation) by adding the relational frame property RB corresponding to B, namely ∀xy (Ri (x, y) → Ri (y, x)), to the translation of ϕ. Finally, in the case of KB4n we restrict ourselves to the axiomatic translation and again add the relational frame property RB to the translation of ϕ. In all these cases, the clausal form N of the translated modal formulae as well as that of RB consists only of DL∗ clauses. Consequently, Rord provides us with a decision procedure for the satisfiability of N . THEOREM 16. Let ϕ be a KBn formula and let N be the clausal form of the first-order formula FB,ϕ = ∀xy (Ri (x, y) → Ri (y, x)) ∧ Def Λm (ϕ) (πr (ϕ, x)). Then 1. ϕ is unsatisfiable in KBn iff FB,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in exponential time.
Computational Modal Logic
203
The result extends easily to global satisfiability and non-logical axioms. So, the axiomatic translation for KB is another reduction into DL∗ , but also GF2 , and Rord is an exponential time decision procedure [181]. Besides Rord we can also use Rhyp to decide the satisfiability of N (this is a consequence of the main results in [82, 83]). THEOREM 17. Let ϕ be a KB4n formula and let Ξ be the set of all subformulae of the form [i]ψ of ϕ. Let FB4 be the first-order formula ∀xy (Ri (x, y) → Ri (y, x)) ∧ [i]ψ∈Ξ ∀xy ((Q[i]ψ (x) ∧ Ri (x, y)) → Q[i]ψ (y)). Let N be the clausal form of FB4,ϕ = FB4 ∧ Def Λm (ϕ) (πr (ϕ, x)). Then 1. ϕ is unsatisfiable in KB4n iff FB4,ϕ is first-order unsatisfiable iff there is a refutation of N by Rord , 2. N is a set of DL∗ clauses, and 3. any derivation from N in Rord (up to redundancy) terminates in exponential time. As described in Section 3.1, in the case of the optimised functional translation, we add so-called functional frame properties in the form of (conditional) equations between path terms to accommodate additional axiom schemas like 4 and 5. Alternatively, one can replace syntactic unification in the inference rules of R with theory unification [175, 176]. The resulting calculus is called theory resolution. So far, the only decision procedures for modal logics like K4n or KBn based on theory resolution make use of a term depth bound, that is, any derived clause involving terms of depth greater than a pre-computed bound dependent on the modal formula whose satisfiability is tested will be removed [175, 178]. This section is an incomplete discussion of the different uses of first-order resolution. Due to space restrictions we have only been able to present a few of the translations that are available and have omitted a lot of details. Other translation methods are surveyed in [64, 148]. See also the surveys [65, 49, 122, 180, 182].
3.4 Implementation and optimisation In this section, we give a brief overview of the implementation of the resolution calculus presented in Section 3.1 and discuss some of the issues involved in using such an implementation for theorem proving in modal logic. For further details on the implementation of first-order theorem provers see e.g. [193, 169, 183]. The procedure ResolutionProver presented in Figure 5 is the main procedure implementing the calculus R S . The input is a set N of clauses. The output on termination is a proof of unsatisfiability or a saturated clause set. The procedure operates on two sets of clauses, US and WO (the set of usable clauses and the set of worked-off clauses). The set WO contains all the clauses that have already been used as premises in inference steps (or can never be used as premises) and the set US contains all the clauses that still need to be considered as premises. In our particular case, the input set N is the clausal form of the translation of some modal formula. The procedure proceeds as follows. First, the input set N is simplified by the function ired, that is, all tautologies and strictly subsumed clauses are deleted from N (this is achieved by the two argument ired function). The set N is then divided into two sets: the usable clauses US and the worked-off clauses WO. The set US contains all the clauses which are candidates for
204
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Procedure ResolutionProver(N) local WO, US, N EW, Given; begin WO := ∅; US := ired(N,N); Stack := emptystack(); while (US = ∅) and (⊥ ∈ US or not stackempty(Stack)) do if (⊥ ∈ US) then (Stack, US, WO) := backtrack(Stack, US,WO); else begin (Given, US) := choose(US); if (splittable (Given)) then begin N EW := firstsplitcase(Given); Stack := push(Stack, secondsplitcase(Given)) end else begin WO := WO ∪ {Given}; N EW := inf(Given, WO); end end (N EW, WO, US) := ired(N EW, WO, US); return(US) end Figure 5. Standard inference loop in a saturation theorem prover
inferences and the set WO contains all the clauses that have already been selected for inferences. Initially, the set WO is the empty set, while US contains all clauses of N remaining after application of ired. Next the procedure enters the main inference loop in which it remains while the set US is not empty and the empty clause ⊥ has not been derived or there are still alternative branches of the derivation tree that need to be considered. Within the main loop it is first checked whether the set US contains the empty clause. If so, the current branch of the derivation is a closed branch and backtracking takes the computation to a different branch of the derivation. Otherwise the function choose selects a clause from US. This clause is called the given clause. If the splitting rule can be applied to the given clause, one of its two split components is taken to be the newly derived clause, which is stored in N EW, and the other split component is pushed onto a stack. Basically, this creates a new branch in the derivation tree that is explored later, if it turns out that the current branch can be closed. This corresponds to a depth-first construction of the derivation tree. If the splitting rule cannot be applied, we add the given clause to the set WO and compute all conclusions of inferences by resolution and factoring between the given clause and clauses in WO using the function inf. After removing redundant clauses from the sets US, WO, as well as the newly derived clauses (this is achieved by the three argument ired function), the remaining new clauses are added to the set US, and a new iteration of the main
Computational Modal Logic
205
loop is entered. Important points to note about the ResolutionProver procedure are the following. First, in the main inference loop, the function inf computes all conclusions derivable from the given clause and clauses in WO. For example, suppose we use the Rhyp instance of R S . Let the set US contain the clauses Q1ϕ (t), D0 = ¬Q1ϕ (x)∨R1 (x, f (x)), and D1 = ¬Q1ϕ (x)∨Qϕ (f (x)), as well as n clauses of the form Ci+1 = Q[1]ψi (t) and Di+1 = ¬Q[1]ψi (x) ∨ ¬Ri (x, y) ∨ Qψi (y), for 1 ≤ i ≤ n. If we first choose each Di , 0 ≤ i ≤ n+1 they are simply moved to WO, without any new clause being inferred from them. The same is true if we continue by choosing each Ci+1 in turn. Finally, when we choose Q1ϕ (t), the clauses Ri (t, f (t)) and Qϕ (f (t)) is computed by inf and moved to US. When R1 (t, f (t)) becomes the given clause, inf computes in one step the clauses Qψi (f (t)), for 1 ≤ i ≤ n. This corresponds to the application of the tableau inference rule w : i ϕ w : [i]ψ1 · · · w : [i]ψn v:ϕ v : ψ1 · · · v : ψn where v is an i-successor of w. However, if we choose clauses starting with D0 , followed by D1 , and then Q1ϕ (t), inf infers R1 (t, f (t)) and Qϕ (f (t)), corresponding to an application of the 3-rule in the tableau algorithm defined in Figure 8. If we proceed by choosing R1 (t, f (t)), then each Ci+1 directly followed by Di+1 , inf infers Qψi (f (t)), corresponding to a series of applications of the 2-rule in Figure 8. This shows that the way in which clauses are selected by choose gives us added flexibility in how the search for a refutation is directed. Second, the ordering ! and the selection function S only influence the function inf without changing what has just been said. Concerning the selection function S the user is able to select among a fixed set of pre-defined selection functions. The selection function which selects every negative literal in any clause is usually included in that set. Concerning the ordering !, state-of-the-art first-order theorem provers standardly contain implementations of recursive path orderings, lexicographic path orderings or Knuth Bendix orderings, which are parameterised by an ordering on the signature of the input clause set N , which the user can specify. Refinements of the particular ordering ! defined in Section 3.1 can be obtained by either recursive path orderings or Knuth Bendix orderings (definitions of orderings and ordering extensions can be found in [52]). Third, the remaining functions in ResolutionProver are firstsplitcase and secondslitcase which basically determine the order in which branches of a derivation tree are investigated. Again, it is possible to exercise control on this order by using some heuristic. Fourth, the implementation of backtrack has significant influence on the performance of the prover. On the stack we only store the second split component that may need to be considered at a later point, but not the current state of WO and US. The information required to return WO and US to the correct state on backtracking is stored in each clause, allowing us to remove clauses which are no longer derivable and restoring clauses which are no longer redundant after backtracking. When we derive a contradiction it is not necessary to backtrack to the state associated with the split component currently on top of the stack. Instead more intelligent forms of backtracking are possible. For example, the theorem prover SPASS [194] implements branch condensing. Here, on backtracking, all first components not used to derive a contradiction are removed from the set US as well as all the corresponding second split components on the stack. The prover then backtracks to the second split component which is now on top of the stack, removing clauses which are no longer derivable and restoring clauses which are no longer redundant. For further details see [193]. This form of intelligent backtracking is closely related but not identical to conflict-directed backjumping [78, 164]. See also Section 4.2.
206
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
An alternative to explicit splitting is splitting through new propositional variables [168] implemented in the theorem prover VAMPIRE [169] or the generalisation called separation in [179]. In the splitting through propositional variables approach, a clause C ∨ D with variable-disjoint components C and D is replaced with two clauses C ∨ p and D ∨ ¬p, where p is a new propositional variable called a split propositional variable. The ordering ! and the selection function S are extended to ensure that p is minimal in D ∨ ¬p and ¬p is selected in D. This makes it impossible for the clause C ∨ D to be derived from the two new clauses and also blocks D ∨ ¬p for inferences until we derive a clause in which p is maximal. The derivation of a contradiction from the split component C in explicit splitting then corresponds to the derivation of a clause E ∨ p where E consists solely of split propositional variables. If p is maximal in E ∨ p we can derive E ∨D which corresponds to backtracking to the branch of the derivation in which D is true. Note that this again is a form of intelligent backtracking since E ∨ p is a representation of all the split components involved in deriving a ‘contradiction’. Thus, in backtracking we ignore all other splits not represented by a split propositional variable in E ∨ p. Unlike branch condensing and (conflict-driven) backjumping, however, those splits are still present. A disadvantage of splitting through new propositional symbols is that subsumption and reductions such as unit propagation are not as effective as for explicit splitting. De Nivelle [47] has suggested modifications of the standard inference and redundancy elimination rules which take account of split propositional variables. Both explicit splitting and splitting through new propositional variables split a clause C ∨ D into split components C and D. The two branches of the derivation do not necessarily investigate disjoint sets of Kripke/first-order models. For variants of splitting we have the option to add the negation of C, ¬C, to the branch on which D is true. However, in contrast to propositional logic, the benefit is less obvious. For example, assume that C is Q[i]p (a) and that the clause set to which we add ¬C = ¬Q[i]p (a) contains already the unit clause Q[i](p∧q) (a). We can propagate the unit clause ¬C to all clauses in the clause set which removes all occurrences of Q[i]p (a) from those clauses. However, the contradiction between ¬Q[i]p (a) and Q[i](p∧q) (a) is not detected. This is true even if the clause set contains the definitional clauses Q[i]p (x) ∨ R(x, f (x)), Q[i]p (x) ∨ ¬Pp (f (x)), which we can use to derive R(a, f (a)) and ¬Pp (f (a)). Only when R(a, f (a)) and Q[i](p∧q) (a) together with the definition clauses ¬Q[i](p∧q) (x) ∨ ¬R(x, y) ∨ Pp (y) (and ¬Q[i](p∧q) (x) ∨ ¬R(x, y) ∨ Pq (y)) are used to derive Pp (f (a)), is a contradiction detected. Note also that the clause R(a, f (a)) might trigger the derivation of a large number of additional clauses which would not be derived in the absence of ¬Q[i]p (a) or its definitional clauses. In general, the computational effort expended to this point might be great without a guarantee that there is a payoff. Termination is however not compromised. Used as a procedure to test the satisfiability of a Kn formula ϕ with any refinement of R S and any of the translations presented in this section, ResolutionProver requires exponential space in the size of ϕ. In [81] we have shown how ResolutionProver can be turned into a space optimal decision procedure for the class GF − . This modified procedure provides also a polynomial space decision procedure for the relational translation of Kn and KBn formulae. If we focus on Kn , then a simple modification of ResolutionProver as described in Figure 6 is sufficient. The procedure uses an additional local variable t which stores the term we currently focus on. Initially it is the only ground term in N , and is returned by groundTerm. The procedure choose selects the given clauses in a particular order. It starts by choosing non-ground clauses. This transfers all definitional clauses from US to WO without any inference steps being performed. Then it selects ground clauses in an order which ensures that the derivation corresponds to a depth-first exploration of the completion tree in a tableau derivation. Finally, ired is modified so
Computational Modal Logic
Procedure ResolutionProver(N) local WO, US, N EW, Given, t; begin t := groundTerm(N); ... (Given, US, t) := choose(US, t); ... (N EW, WO, US) := ired(N EW, WO, US, t); ... end
207
Procedure choose(US, t) begin if (C ∈ US where C is non-ground) then return( C, US − {C}, t ) else if (Q(t) ∨ C ∈ US) then return( Q(t) ∨ C, US − {Q(t) ∨ C}, t ) else if (Ri (t, s) ∈ US) then return( Ri (t, s), US − {Ri (t, s)}, s ) else if (Ri (u, v) ∈ US with v having greatest depth in US) then return( Ri (u, v), US − {Ri (u, v)}, v ) end
Figure 6. Modified procedures for a polynomial space decision procedure for Kn that it removes from WO all clauses containing argument terms which are not subterms of the term t. This modification ensures that the information on terms which have been fully explored and does not contribute to a refutation is removed, bringing the space requirements down to polynomial space.
3.5 Other extensions (counting, nominals) The modal logics Kcn and K,c with graded modalities and the modal logic Kon with nominals n can be translated to first-order logic using a number of different embeddings. The simplest one is an extension of the relational translation as follows (the symbol oi denotes a nominal). πr ( i m ϕ, x) = ∃y1 . . . ym (Ri (x, y1 ) ∧ . . . ∧ Ri (x, ym ) ∧ y1 ≈
y2 ∧ . . . ∧ ym−1 ≈ ym ) πr ([i]m ϕ, x) = ∀y1 . . . ym+1 ((Ri (x, y1 ) ∧ . . . ∧ Ri (x,ym+1 )) → (y1 ≈ y2 ∨ . . . ∨ yn ≈ ym+1 )) πr (oi , x) = (x ≈ oi ) The superposition calculus [14] and the basic superposition calculus [17] are extensions of R S with rules for equality reasoning. In [113, 112] it is shown that the basic superposition calculus can be used to decide the satisfiability of knowledge bases in the SHIQ description logic. It follows that it can also be used to decide the satisfiability of formulae in Kcn and K,c n . c An extension of the optimised functional translation to Kn is presented and shown to be sound and complete in [150].
4 TABLEAU-BASED ALGORITHMS In this section, we describe tableau-based decision procedures for modal logics and discuss their complexity and implementation issues. First, we discuss various choices for presenting tableau algorithms in general, and then present the basic tableau algorithm for Kn together with a detailed discussion of implementation and optimisation issues. Next, we modify this algorithm to handle K4n , background theories, converse modalities, and their combinations, and point out relevant modifications concerning the implementation and optimisation.
208
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Intuitively, a tableau algorithm tries to construct, for an input formula ϕ, a model of ϕ; i.e., to decide the validity of a formula ψ, the tableau algorithm is started with ¬ψ. Depending on the modal logic, it is often convenient to consider an abstraction of models rather than models, namely a so-called tableau.
4.1 Tableau algorithms in general We start with a description of a tableau algorithm for multi modal Kn . Roughly speaking, this algorithm takes the input formula ϕ and deduces constraints on the model it is going to build by breaking it down into its sub-formulae. We will first describe different styles in which this attempt at a model construction has been described and relate them to each other. The “breaking down” is realized through tableau expansion rules; quite often, we find one such expansion rule per logical constructor. For example, if we know that ψ1 ∧ ψ2 should be true in world w of the model we are constructing, then we break the conjunction down and explicitly add the constraints that each ψi has to be true in w. Next, we discuss the rules that handle box- and diamond formulae. Intuitively, if we know that i ψ should be true in world w, then we “generate” a witness world w , which is i-accessible from w and in which ψ is true. This can be formalised in different ways: • for certain modal logics such as Kn , one can first handle all formulae talking about a single world, then collect all constraints concerning another world and process these, and so on [129]. This approach is sometimes called “distructive” [92] (see also Chapter 2) because we can forget the constraints concerning an “old” world once we procede to the next one. • labelled tableaux are closely related to propositional tableaux: they are sets of labelled formulae that partially describe a model: each formula is labelled with the world it should be true in (see Chapter 2 of this handbook). For example, the case where 1 ψ is true in world w would translate to finding the labelled formula w : 1 ψ in our tableau, and the 3-rule adds labelled formulae w : ψ and w1w , where the latter encodes that w is 1-accessible from w. This information is required if we find, additionally, a formula of the form w : [1]ψ : in this case, the 2-rule adds w : ψ . Alternatively, one can store the information that w is i-accessible from w in the labels by using appropriate sequences instead of atomic “names” w, w . We start with the empty sequence labelling the input concept, and then append these labels, e.g., as follows: if a world is generated for a labelled formula s : i ψ, we name this world s(i, ψ) and simply introduce the new labelled formula s(i, ψ) : ψ. Please note that si : ψ does not suffice because 1 ψ ∧ 1 ¬ψ is satisfiable, but only in a world that has two distinguished 1acccessible worlds. • other tableau algorithms explicitly store the relational structure of the model (or tableau) they are building. More precisely, they work on labelled graphs (often trees) where nodes represent worlds and labelled edges represent i-accessibility. Moreover, nodes are labelled with the set of formulae that should be true in the corresponding world. Thus, instead of finding two labelled formulae w : ψ and w : ψ in a tableau, we would find both formulae in the label of the node w , written {ψ , ψ } ⊆ L(w ). An advantage of this approach is that all information concerning a single world is kept in the same place. For example, it allows for the detection of obvious inconsistencies such as w : p and w : ¬p by a test that is local to L(w). When considering logics with converse
Computational Modal Logic
209
or graded modalities, the advantages of this “one node per world” approach become even more pronounced. State-of-the-art implementations of modal tableau algorithms adopt this approach [159, 90], which is why we have chosen it for this section. Similarly, the ∨-rule is often formulated using either branching or non-determinism in the model construction. For example, if we know that ψ1 ∨ ψ2 should be true in w, then the ∨-rule can be formalised in the following two ways: • we branch our model construction into two, one in which ψ1 is true in w and one in which ψ2 is true in w, and then continue with the construction of each branch independently. This is how non-deterministic constructors are handled in standard first order and modal logic tableau: the tableau rules expand a tree where each branching represents a nondeterministic choice, and thus where each path stands for a possible model. • we non-deterministically choose one ψi to be true in w. This yields a non-deterministic algorithm which, when implemented, requires back-tracking to be complete. From a computational perspective, this approach is preferable since, in contrast to the above “branching” alternative, it preserves the useful “one node per world” property. Additionally, it can easily be adapted to exploit techniques developed for solving SAT problems, such as David-Putnam and related heuristics [41, 87]. State-of-the-art implementations of modal tableau algorithms handle disjunctions (and possibly other non-deterministic operators) in this way, and are combined with intelligent back-tracking (or back-jumping) and heuristics to make the “good” choice first, see Section 4.2. The algorithms described in this chapter will use the latter, non-deterministic formulation, and will work on a single model/tableau at any world in time, where all information concerning each world is stored in a single node. Figure 7 shows two example applications of different tableau algorithms to decide the satisfiability of the K formula ψ = 1 p ∧ 1 q ∧ [1](¬p ∨ ¬q). On the left hand side, we show the result of a standard labelled tableau, where we use sequences as labels. First, we have broken down the conjunctions, then generated two new labels (1, p) and (1, q) for the two diamond formulae. Next, we have expanded the box formula for both new worlds, and finally branched for the disjunctions. The resulting tree stands for four different attempts to construct a model, one for each path from a leaf node to the root. Only the one ending in the filled node corresponds to a model since all other branches contain obvious inconsistencies: e.g., the first one contains both (1, p) : p and (1, p) : ¬p. On the right hand side, we show a (successfull) application of the non-deterministic version of a tableau algorithm working on trees. It has generated three nodes wi with labels that are completely expanded sets of formulae. Here, the edges stand for the accessibility relations, i.e., w2 and w3 are 1-accessible from w1 . In contrast, on the left hand side, (the formulae along) one path in the tree represents a model, i.e., edges relate formulae that are true in the same model.
4.2 Local satisfiability for multi modal Kn Before we describe the algorithm, we introduce an appropriate data structure in which to represent models (and later tableaux). Firstly, it will be convenient to assume that all formulae descriptions are in negation normal form (see Section 2). The tableau algorithms presented in this section work on completion trees: a completion tree is a finite tree where each node x is
210
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
ε:ψ ε : 1 p ε : 1 q w1
ε : [1](¬p ∨ ¬q) (1, p) : p
1
{ψ, 1 p, 1 q, [1](¬p ∨ ¬q)} 1
(1, q) : q (1, p) : ¬p ∨ ¬q
w2 {p, ¬q}
w3 {q, ¬p}
(1, q) : ¬p ∨ ¬q (1, p) : ¬p
(1, p) : ¬q (1, q) : ¬q
(1, q) : ¬p (1, q) : ¬q
(1, q) : ¬p
Figure 7. Two application of tableau algorithms to the same formula. labelled with a set L(x) of formulae, and edges are labelled with modal parameters. A node y is called an i-successor of a node x if y is a successor of x and the edge from x to y is labelled with i. A completion tree is said to be closed if it contains a node x with {p, ¬p} ⊆ L(x); a completion tree that is not closed is open, and it is complete if no expansion rule applies—the expansion rules are given in Figure 8. Please note that they are formulated in such a way that, if a rule is applicable (i.e., the corresponding condition is satisfied by the current completion tree), then its application indeed changes the tree. To decide the satisfiability of φ (in NNF), the tableau algorithm is started with a completion tree consisting of the root node x0 only, with L(x0 ) = {φ}. It applies the expansion rules until the completion tree becomes closed or complete, and returns “φ is satisfiable” if the expansion rules can be applied such that they yield a complete and open tableau, and “φ is unsatisfiable” otherwise. The “can be applied” formulation is due to the non-deterministic ∨-rule, as discussed in Section 4.1. Also, the algorithm does not fix any order in which the rules are to be applied, which means that an implementation has to/can chose a “good” one. ∧-rule: ∨-rule: 3-rule: 2-rule:
If then If then If then If then
there is a node x with ψ1 ∧ ψ2 ∈ L(x) and {ψ1 , ψ2 } ⊆ L(x), L(x) := L(x) ∪ {ψ1 , ψ2 }. there is a node x with ψ1 ∨ ψ2 ∈ L(x) and {ψ1 , ψ2 } ∩ L(x) = ∅, L(x) := L(x) ∪ {ψi } for some i ∈ {1, 2}. there is a node x with i ψ ∈ L(x) and x has no i-successor y with ψ ∈ L(y), create a new i-successor y of x with L(y) := {ψ}. there is a node x with [i]ψ ∈ L(x) and x has an i-successor y with ψ ∈ L(y), L(y) := L(y) ∪ {ψ}.
Figure 8. The expansion rules for Kn . Before discussing the properties of this algorithm, we would like to point out that the tableau
Computational Modal Logic
211
rule w : i ϕ v:ϕ
w : [i]ψ1 · · · w : [i]ψn v : ψ1 · · · v : ψn
mentioned in Section 3.4 of this chapter corresponds, in our notation, to If there is a node x with { i ϕ, [i]ψ1 , . . . , [i]ψn } ⊆ L(x), then create a new i-successor y of x with L(y) := {ϕ, ψ1 , . . . , ψn }. The fact that our algorithm decides satisfiability of Kn formulae is an immediate consequence of the following lemma, for which we first need to define the semantics of completion trees. Let T be a completion tree, M = W, R, V a model, and π a (total) mapping from the nodes of T to W . Then M is said to satisfy T via π if, for each node x in T, 1. for each ψ ∈ L(x), we have M, π(x) |= ψ and 2. for each i successor y of x, we have Ri (π(x), π(y)). LEMMA 18. Let φ be a Kn formula and T a completion tree generated by the tableau algorithm for φ. 1 When applied to φ, the tableau algorithm terminates. 2 If M satisfies T via π and one of the expansion rules is applicable to T, then this rule can be applied in such a way that it yields a T satisfied by M via π or an extension of π. 3 If T is complete, then there exists a model M and a mapping π such that M satisfies T via π iff T is open. Lemma 18.1 is due to the fact that (i) the breadth and depth of the completion tree are bounded linearly by the length of φ, (ii) node labels are sets of subformulae of φ, and (iii) the completion tree is built in a monotonic way, i.e., each rule strictly increases node labels or adds new nodes. Property (i) is due to the fact that there are at most |φ| diamond modalities in φ and that the maximal modal depth of formulae in node labels strictly decreases from a node to its (i-)successors. Lemma 18.2 is an immediate consequence of the semantics of Kn and completion trees. For example, let the 3-rule be applicable to some T with i ψ ∈ L(x), and let M satisfy T via π. Hence M, π(x) |= i ψ, and thus there exists some w ∈ W with Ri (π(x), w) and M, w |= ψ. As a consequence, we can extend π to π(y) = w for y the newly introduced node, and M satisfies the result of this rule application via (the extended) π. The “if” direction of Lemma 18.3 is easy since each open completion tree can be viewed as a model with W the set of nodes, x ∈ V (p) if p ∈ L(x), and Ri (x, y) if y is an i-successor of x. The only-if direction of Lemma 18.3 is trivial. THEOREM 19. The Kn tableau algorithm decides Kn satisfiability and can be implemented in polynomial space. As an immediate consequence of Lemma 18 and the fact that each model M satisfying ψ is one that satisfies the initial completion tree (and vice versa), we thus have the first point of Theorem 19. The second part follows from the following observations. As a consequence of (i) and (ii) in the proof sketch of Lemma 18.1, we can store each branch of a completion tree in space bounded polynomially in the length of ψ. Next, we observe that we can consider each branch independently, and thus we can build the completion tree in a depth first manner, keeping only a single branch in memory at each point in time. Finally, our ∨-rule is non-deterministic, but it is known how to transform a non-deterministic polynomial space algorithm into a deterministic one that also runs in polynomial space [172].
212
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Implementation Issues Even this “simplest” modal logic Kn extends propositional logic, and thus the complexity is rather discouraging from an implementational perspective: we may have to consider a number of models (or completion trees) that is exponential in the size of the input formula. Moreover, because the completion tree is usually built in a depth first manner, with the ∧- and ∨-rules being exhaustively applied to a given node before creating any modal successors with the 3-rule, it is easy to find formulae with unsatisfiability “hidden” in the leaves of the tree for which a naive implementation will always exhibit pathological worst case behaviour. Consider, for example, the formula: (11)
φ = (p1 ∨ q1 ) ∧ . . . ∧ (pn ∨ qn ) ∧ i ψ ∧ [i]¬ψ.
There are 2n different ways in which the combination of the ∧-and ∨-rules can be applied to a node whose label is initialised with {φ}, but in each case subsequent applications of the 3- and the 2-rules will eventually lead to a closed completion tree. A naive implementation of the trace technique with “chronological” backtracking search would consider all 2n possible expansions before concluding that the input formula is unsatisfiable; this kind of unproductive backtracking search in often referred to as thrashing. Fortunately, a wide range of optimisation techniques has been developed in order to improve the efficiency with which the algorithm explores the space of possible models [104, 103]. Although these optimisations may lead to a situation in which the worst case behaviour would actually be much worse than the theoretical worst case, empirical studies have shown that such optimised algorithms are very effective with typical formulae, i.e., formulae derived from applications. These techniques include normalisation and simplification, dependency directed backtracking, SAT based search techniques, simplification of node labels, heuristics and caching. Normalisation and Simplification As usual, our description of the Kn tableau algorithm assumes that the input formula is in negation normal form (NNF); this simplifies the (description of the) algorithm, but it means that a completion tree will only be closed when a propositional variable and its negation occur in the same node label. For example, when testing the satisfiability of the formula (p ∧ q) ∧ ¬(p ∧ q), the transformation into NNF would give (p ∧ q) ∧ (¬p ∨ ¬q); in practise this means that, in spite of the “obvious” contradiction, backtracking search will be performed in order to determine that the formula is unsatisfiable. For this reason, practical algorithms do not transform the input concept into NNF, but include a ¬-rule that performs a single (negation) normalisation step (e.g., applying the ¬-rule to ¬(p ∧ q) ∈ L(x) would cause ¬p ∨ ¬q to be added to L(x)), and a completion tree is closed if it contains a node x with {ψ, ¬ψ} ⊆ L(x) for an arbitrary formula ψ. Moreover, in order to facilitate the detection of such closure conditions, the input formula is normalised and simplified so that logically equivalent formulae are more often syntactically equivalent. This is achieved by (recursively) applying a set of rewrite rules to the input formula, and by ordering conjuncts w.r.t. some total ordering. For example, we re-write ∨ and 3 formulae as negated ∧ and 2 formulae, respectively; we remove redundant parentheses between conjunctions; we order conjuncts; and we simplify formulae using the following equivalences: (ψ ∧ ψ) ↔ ψ, ¬¬ψ ↔ ψ, (ψ ∧ ¬ψ ∧ ρ) ↔ ¬, (ψ ∧ ) ↔ ψ, (ψ ∧ ¬) ↔ ¬, and [i] ↔ . If the above transformations are applied to the formula φ from the above example (11), then
i ψ would be rewritten as ¬[i]¬ψ, ¬[i]¬ψ ∧ [i]¬ψ would be rewritten as ¬ and (p1 ∨ q1 ) ∧ . . . ∧ (pn ∨ qn ) ∧ ¬ would be rewritten as ¬, a formula that is trivially unsatisfiable.
Computational Modal Logic
213
If ψ1 was added to L(x) by the ∧-rule for ψ1 ∧ ψ2 ∈ L(x), then dep(ψj , x) := dep(ψ1 ∧ ψ2 , x) for each j ∈ {1, 2} ∨-rule for ψ1 ∨ ψ2 ∈ L(x), then dep(ψj , x) := dep(ψ1 ∨ ψ2 , x) ∪ {b} for each j ∈ {1, 2} 3-rule for i ψ1 ∈ L(x ), then dep(ψ1 , x) := dep( i ψ1 , x ) then dep(ψ1 , x) := dep([i]ψ1 , x ) ∪ dep( i ψ2 , x ) 2-rule for [i]ψ1 ∈ L(x ), where x was generated by the 3-rule for i ψ2 ∈ L(x ) Figure 9. Inductive definition of dep(ψ, x) Dependency Directed Backtracking As we saw in the above example (11), inherent unsatisfiability concealed in sub-formulae can lead to large amounts of unproductive backtracking search known as thrashing. Although the normalisation and simplification technique described above solved the problem for this example, this might not have been the case if the unsatisfiability caused by the modal sub-formulae had been slightly less trivial. Consider, e.g., the following, only slightly modified formula φ : (12)
φ = (p1 ∨ q1 ) ∧ . . . ∧ (pn ∨ qn ) ∧ i (ψ ∧ ρ) ∧ [i]¬ψ.
To avoid an exponential search in the case of φ , a more sophisticated solution is required, and can be found by adapting a form of dependency directed backtracking called backjumping, which has also been used, e.g., in solving constraint satisfiability problems [19] and (in a slightly different form) in the HARP theorem prover [153]. Intuitively, backjumping works by labelling each formula ψ in the label of a node x with a dependency set dep(ψ, x) indicating the branching points (i.e., applications of the ∨-rule) on which it depends. In case the completion tree is closed because it contains some node x with {ψ, ¬ψ} ∈ L(x), we use dep(ψ, x) and dep(¬ψ, x) to identify the most recent branching point b on which ψ or ¬ψ depends. The algorithm can then jump back to b over intervening branching points without exploring any alternative branches (non-deterministic choices), and make a different non-deterministic choice which might not lead to the same closure condition being encountered. In case no such b exists, the closure did not depend on any non-deterministic choice, and the algorithm stops. To be more precise, a branching point is simply a non-negative integer b indicating the b-th ∨-rule application in the run of the tableau algorithm. Initially, for x0 the root node and φ the input formula, dep(φ, x0 ) := ∅. The sets dep(ψ, x) are then defined inductively as shown in Figure 9. In this way, each formula in each node label is associated with a dependency set. If the completion tree is closed because it contains some node x with {ψ, ¬ψ} ∈ L(x), the closure dependency set S := dep(ψ, x) ∪ dep(¬ψ, x), and the algorithm backtracks to the b-th ∨-rule application (or exits if b = 0). The procedure for expanding a completion tree T is given in Figure 10. For an input formula φ, T is initialised to contain a single node x0 with L(x0 ) = {φ} and dep(φ, x0 ) := ∅; φ is satisfiable if Satisfiable(T,0) returns {−1} and unsatisfiable otherwise. For example, when expanding the formula φ from 12 above, the ∧-rule might first be applied exhaustively via recursive calls to Satisfiable, resulting in {p1 ∨ q1 , . . . , pn ∨ qn , i (ψ ∧ ρ), [i]¬ψ} ⊆ L(x0 ) and dep(ψj , x0 ) = ∅ for each formula ψj ∈ L(x0 ). These dependencies reflect the fact that, so far, no non-deterministic choices have been made. A top-down and “left to right” strategy might then cause Branch to be called n times, with, for the j-th call, b = j, f1 = pj , f2 = qj and
214
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Procedure Satisfiable(T,b) local f ; begin if for some node x in T, {ψ, ¬ψ} ∈ L(x) then return(dep(ψ, x) ∪ dep(¬ψ, x)) else if T is complete then return({−1}) else begin f := some unexpanded formula in node x in T if f is of the form ψ1 ∨ ψ2 then return(Branch(T,b + 1,x,ψ1 ,ψ2 ,dep(f, x))) else begin expand f (as per Fig. 8 and 9) return(Satisfiable(T,b)) end end end
Procedure Branch(T,b,x,f1 ,f2 ,D) local S, T-saved; begin T-saved := T add f1 to L(x) with dep(f1 , x) = {b}∪D S := Satisfiable(T,b) if b ∈ S then return(S) else begin T := T-saved add f2 to L(x) with dep(f2 , x) = b∪d return(S ∪ Satisfiable(T,b)) end end
Figure 10. Procedure for tableau expansion with backjumping D = ∅, so that p1 , . . . , pn are added to L(x0 ) with dep(pj , x0 ) = j. Next, recursive calls to Satisfiable would expand: i (ψ ∧ ρ) ∈ L(x0 ), causing the generation of an i-successor x1 of x0 with L(x1 ) = {ψ ∧ ρ} and dep(ψ ∧ ρ, x1 ) = ∅; [i]¬ψ ∈ L(x0 ), causing ¬ψ to be added to L(x1 ), with dep(¬ψ, x1 ) = ∅; and ψ ∧ ρ ∈ L(x1 ), causing ψ and ρ to be added to L(x1 ), with dep(ψ, x1 ) = dep(ρ, x1 ) = ∅. The completion tree would then be closed, as {ψ, ¬ψ} ⊆ L(x1 ), and Satisfiable would return dep(ψ, x1 ) ∪ dep(¬ψ, x1 ) = ∅. If we were using chronological backtracking, the recursion would return to the n-th branching point, i.e., the one where Branch was called with b = n, f1 = pn and f2 = pn . T would be restored to its state prior to adding pn to L(x0 ), and the rule would be applied again such that qn was added to L(x0 ). Using backjumping, however, we return from Branch immediately because b ∈ S. This is obviously true for all of the preceding branching points, so all calls to Branch will return without expanding the completion trees obtained by adding the various qj to L(x0 ), and Satisfiable will eventually return ∅, allowing us to conclude that φ is unsatisfiable. SAT Based Search Techniques Even with the addition of dependency directed backtracking, a naive implementation of the 3-rule is inherently inefficient as it can lead to the repetition of parts of the expansion. For example, given an input formula (13)
φ = (ρ ∨ ψ1 ) ∧ . . . ∧ (ρ ∨ ψn ),
where ψ1 ∧ . . . ∧ ψn is satisfiable but ρ is not, the procedure described above would lead to the construction of n (possibly large) closed completion trees, each with ρ ∈ L(x0 ), before a complete and open completion tree is constructed. This problem can be avoided by using more sophisticated search techniques. One of best
Computational Modal Logic
215
known of these is the Davis-Putnam algorithm, originally designed for solving propositional satisfiability (SAT) problems [42]. The basic idea behind Davis-Putnam is that, instead of branching on unexpanded disjunctions, we branch on a formula ψ such that ψ occurs in an unexpanded disjunction in a node x of the completion tree and {ψ, ¬ψ} ∩ L(x) = ∅; the algorithm then searches the two possible trees obtained by adding ψ or ¬ψ to L(x). This basic technique is usually enhanced with heuristics and simplification rules (which we will discuss in more detail below); in particular, we usually branch first on formulae that occur in many unexpanded disjunctions and, if {ψ ∨ ρ, ¬ψ} ⊆ L(x), then ψ ∨ ρ is deterministically expanded by adding ρ to L(x). It is easy to see that if this strategy is applied to φ above, we would branch first on ρ (as it occurs in n unexpanded disjunctions), and at most one closed completion tree (if ρ is tried first) would be constructed before finding a complete and open one. This technique has been shown to be very effective with formulae generated at random using generators adapted from those used to generate SAT problems [87, 114]. Such problems typically include a relatively small number of propositional variables (so there is likely to be significant repetition of the sub-formulae occurring in disjunctions), and have a very low modal depth (so the importance of propositional reasoning is emphasised); this is because large numbers of propositional variables and/or a high modal depth would result in almost all problems of reasonable size being trivially satisfiable. Formulae from applications, however, typically do not exhibit these characteristics, and Davis-Putnam is much less effective—in fact it can even be counter-productive if the negated formulae that Davis-Putnam introduces are large and/or complex [103]. An alternative technique used in [56] is to enhance the standard chronological backtracking method with a no-good list for each node, i.e., a set of formulae, each of which has already been shown to lead to a closed completion tree when it is added to the node label by an application of ∨-rule. Formulae in the no-good list are not considered when applying the ∨-rule. Using this technique with φ above, ρ would be added to the no-good list after the first application of the ∨-rule leads to a closed completion tree. In subsequent applications of the ∨-rule, ρ would not be considered, and ψj would always be selected. This technique has the advantage that wasted search is avoided without adding negated formulae that could themselves lead to additional (possibly non-deterministic) expansion. Note that, when using these (and other) optimisations in addition to backjumping, care must be taken to ensure that all dependencies are being taken into consideration. For example, when using a no-good list to restrict the possible choices made by the ∨-rule, it is important to also consider the dependencies associated with the relevant formulae in the no-good list. Simplification of Node Labels As well as the standard tableau expansion rules described in Figure 8, additional inference rules can be applied to the formulae occurring in a node label, usually with the objective of simplifying them and reducing the number of ∨-rule applications. The most commonly used simplification, often called Boolean Constraint Propagation (BCP) [74], is again derived from SAT solvers, where it is usually used in conjunction with the DavisPutnam procedure. The basic idea is to identify a disjunction ψ1 ∨ . . . ∨ ψn ∈ L(x) such that the negations of all but one of the ψj are already elements of L(x); when this is the case, the formula can be deterministically expanded by adding the relevant ψj to L(x). This amounts to applying the following inference rule ¬ψ1 , . . . , ¬ψn , ψ1 ∨ . . . ∨ ψn ∨ ψ ψ to the formulae in a node label, which is a restricted variant of hyper resolution, see 3.1.
216
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
As we have already seen, when ¬ρ is added to L(x0 ) during the expansion of φ above, the BCP rule can be applied to all the remaining φ ∨ ψj formulae, leading to a complete and open completion tree without any further applications of the ∨-rule. Note that, as with the more sophisticated search techniques described above, careful consideration needs to be given to the dependencies of formulae added by such inference rules if they are to be used together with backjumping. Heuristics As mentioned in Section 4.1, one advantage of the non-deterministic formulation of the ∨-rule is that an algorithm can try to choose a “good” order in which to try the different possible expansions. In practise, this usually means using heuristics to select the way in which the ∨-rule is applied to the disjunctions in a node label, and the order in which the successor nodes created by 3-rule applications are expanded; in either case, a heuristic function is used to compute the relative “goodness” of candidate formulae/nodes. When using the Davis-Putnam technique, the well known MOMS heuristic [74] is often used to select the formulae on which to branch; it tries to select formulae that will maximise the effect of BCP and so minimise the number of non-deterministic choices needed in order to complete the completion tree [103]. There is little evidence, however, that (a suitably adapted form of) this heuristic is effective with modal formulae, and even some evidence to suggest that interference with the backjumping optimisation makes it counter productive [103]. An alternative heuristic, whose design was prompted by this observation, tries to maximise the effect of backjumping by preferentially selecting formulae with low valued dependencies [103, 99]. This heuristic has the added advantage that it can also be used to select the order in which successor nodes are expanded. Caching When using the top-down construction strategy, all information from predecessors is added to a node label before it is processed. This means that, when a given node has been fully expanded (i.e., the expansion rules have been exhaustively applied to it), a successor node y with L(y) = {ψ1 , . . . , ψn } can be treated as an independent problem, equivalent to testing the satisfiability of ψ1 ∧ . . . ∧ ψn . A completion tree may contain many such nodes, and the labels of nodes tend to be quite similar, particularly as the labels of i-successors of a node x each contain the same formulae resulting from 2-rule applications to [i]ψ-formulae in L(x). For some formulae, this may result in the same sub-problem being solved again and again. In order to avoid this, it is possible to cache and re-use the results of such sub-problems. The usual technique is to use a hash table to store the satisfiability status of node labels (i.e., sets of formulae treated as a conjunction). Before applying any expansion rules to a new node x, the cache is interrogated to determine if the satisfiability status of L(x) is already known. If it is known, then the result can be used without further expansion, i.e., L(x) can be treated as though it were either {⊥} (for unsatisfiable) or {} (for satisfiable). If the satisfiability status of L(x) is not known, then L(x) is added to the cache, and its status set to satisfiable if a complete and open completion tree rooted in x can be constructed, and to unsatisfiable otherwise. Since the satisfiability of a set of formulae L implies the satisfiability of each subset of L, and the unsatisfiability of a set of formulae L implies the unsatisfiability of each superset of L, this basic idea can be extended to check for satisfiable supersets of L(x) and unsatisfiable subsets of L(x). However, this requires a considerably more sophisticated data structure if cache operations are to be efficient [100, 86]. Apart from the problem of the storage required for the cache, another more subtle disadvantage of caching is that, in the case where the cache returns “unsatisfiable” for L(x), there is no information about the cause of the unsatisfiability that can be used to derive the dependency
Computational Modal Logic
217
information required for backjumping. Backjumping can still be performed by combining the dependency sets of all of the formulae in L(x), but this is likely to overestimate the set of branching points on which the unsatisfiability depends. Another useful form of caching is a technique known as model merging [103, 91]. The idea here is to prove the satisfiability of a node label L(x) by showing that open and complete completion trees for L1 , . . . , Lk with L1 ∪ . . . ∪ Lk = L(x) can be combined into an open and complete completion tree for L(x) by simply “gluing” their root nodes together. This is possible if there are no “interactions” between the various completion trees, e.g., if there are no j, k such that either ψ ∈ Lj and ¬ψ ∈ Lk or i ψ ∈ Lj and [i]ρ ∈ Lk for some i, ψ and ρ. Thus model merging involves (a) cashing satisfiable sets of formulae that occur as root labels of open and complete completion trees, and (b) trying to prove the satisfiability of some L(x) by finding cached sets Lj that do not interact in the above sense.
4.3 Transitive modalities and K4n The main problem one has to overcome when modifying the Kn tableau algorithm presented in Section 4.2 to K4n is termination. Please recall that the Kn tableau algorithm terminates “automatically” since it builds a tree of bounded depth and breadth in a monotonic way. As we will see, this is not the case for K4n . Consider, e.g., the K4n formula i ψ ∧ [i] i ψ. A K4n tableau algorithm would start with a root node x0 labelled with this formula, then apply the ∧-rule, and then generate an i-successor x1 . Next, the 3-rule would be applicable and it would add i ψ to L(x1 ). Thus the 3-rule would generate an i-successor x2 of x1 . At his point, the difference between Kn and K4n becomes apparent: in K4n models, Ri has to be transive, and thus x2 should be i-accessible from x0 , i.e., i ψ would also need to be true in (the world represented by) x2 . Hence, we would need a (new) rule that adds i ψ to L(x2 ). However, this would trigger the applicability of the 3-rule, which would generate an i-successor x3 of x2 . Now we can use Ri ’s transitivity again to argue that i ψ needs to be added to L(x3 ), and continue the whole pattern to construct an infinite i-chain. Thus the tableau algorithm would not terminate: in contrast to the Kn tableau algorithm, the maximal modal depth of formulae in node labels no longer decreases from a node to its successors. To regain termination, we observe that, creating this infinite path, we keep repeating the same actions. More precisely, the node labels of the nodes x1 , x2 , . . . are all identical. In the following, we show how we can prevent this “looping” using a cycle detection mechanism called “blocking”. Intuitively, after the creation of x2 and the application of the 2-rule, we could have noticed that L(x2 ) = {ψ, i ψ} = L(x1 ), and decided to not apply the 3-rule to x2 because (i) we would continue repeating ourselves and (ii) it is not necessary since L(x1 ) = L(x2 ) implies that we can use (the world represented by) x1 for the world represented by x2 . The latter means that we can build a model M with (x1 , x1 ) ∈ Ri in which M, x1 |= ψ and, from the semantics, M, x1 |= i ψ. The other problem we have to overcome is how we are going to take care of Ri ’s transitivity. Consider an i-successor y of a node x. Now if y has in turn an i-successor z, then this situation represents a model in which (x, z) ∈ Ri , i.e., z “should” also be an i-successor of x. That is, if [i]ψ ∈ L(x), then ψ should be in L(z). One possible way to achieve this would be to give up on working on completion trees, and instead work on graphs where we would add the additional i-edge between x and z. For implementation purposes, however, trees are clearly advantagous, and thus we choose to employ an alternative technique: the same effect as adding the additional i-edge between x and z can be obtained by adding [i]ψ to L(y) for each [i]ψ ∈ L(x). This will
218
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
be realized in a modified 2-rule. Now we formalise this in our tableau algorithm. First, we define the notion of a blocked node. We use ancestors and offsprings in the usual way; a node x is directly blocked if it has an ancestor x with L(x) ⊆ L(x ); a node is blocked if it is directly blocked or if it has an ancestor that is directly blocked. Next, we take this notion into account in the K4n expansion rules, which are given in Figure 11. Compared to the Kn expansion rules, these expansion rules only apply to nodes that are not blocked (however, 2-rule can add formulae to the label of a directly blocked node), and the 2−rule “pushes” box formulae in the way discussed above. ∧-rule:
there is a node x that is not blocked with ψ1 ∧ ψ2 ∈ L(x) and {ψ1 , ψ2 } ⊆ L(x), L(x) := L(x) ∪ {ψ1 , ψ2 }. ∨-rule: there is a node x that is not blocked with ψ1 ∨ ψ2 ∈ L(x) and {ψ1 , ψ2 } ∩ L(x) = ∅, L(x) := L(x) ∪ {ψi } for some i ∈ {1, 2}. 3-rule: there is a node x that is not blocked with i ψ ∈ L(x) and x has no i-successor y with ψ ∈ L(y), then create a new i-successor y of x with L(y) := {ψ}. 2-rule: If there is a node x that is not blocked with [i]ψ ∈ L(x) and x has an i-successor y with ψ ∈ L(y), then L(y) := L(y) ∪ {ψ, [i]ψ}. If then If then If
Figure 11. The expansion rules for K4n . To convince ourselves that this algorithm indeed decides satisfiability of K4n formulae, we sketch the same technical lemma as for Kn . LEMMA 20. Let ψ be a K4n formula and T a completion tree generated by the tableau algorithm for ψ. 1. When applied to ψ, the tableau algorithm terminates. 2. If M satisfies T via π and one of the expansion rules is applicable to T, then this rule can be applied in such a way that it yields a T satisfied by M via (possibly an extension of) π. 3. If T is complete, then there exists a model M and a mapping π such that M satisfies T via π iff T is open. Again, we only sketch the proof. Termination is due to the same three observations as in the sketch of Lemma 18, but the reason for the bound of the depth of the tree is more involved (and the bound is now quadratic). Consider three nodes x, y, and z where y is an i-successor of x and z a j-successor of y. If i = j, then the maximal modal depth of formulae in the label of z is strictly smaller than the one in the label of y. If i = j, then either L(z) ⊆ L(y) or y was generated for a different different diamond formula in L(x) than z in L(y). In the former case, z is blocked. The latter case can only occur linearly often in the length of the input formula. As a consequence, paths in the completion tree are of length at most quadratic in the length of the input formula. Lemma 20 (ii) is similar to the Kn case, but we have to exploit the transitivity of Ri to explain why pushing [i]ψ from a node to its i-successor preserves M being a model via π. Finally, the construction of a model from an open, complete completion tree in Lemma 20 (iii) is slightly modified: firstly, only un-blocked nodes represent worlds in the model. Secondly, we also add (x, y ) to Ri if x has an i-successor y which is blocked and y is an ancestor of y with
Computational Modal Logic
219
L(y) ⊆ L(y ). Thirdly, we extend Ri so that it is transitively closed, i.e., if {(x, y), (y, z)} ⊆ Ri , then we also have (x, z) ∈ Ri . The same reasons as for Kn then yield the following theorem. THEOREM 21. The K4n tableau algorithm decides K4n satisfiability and can be implemented in polynomial space. Implementation Issues As we have seen, the main difference between the tableau algorithms for Kn and K4n is the introduction of blocking. In fact the blocking condition described above, which specifies a subset relationship between the labels of blocked and blocking nodes, is already optimised w.r.t. the one originally described in [93], which specified label equality. The subset condition means that blocking can occur sooner, thus avoiding possibly costly expansion. Consider, for example, a node x labelled as follows: (14)
L(x) = {ρ, ψ, i ψ, [i] i ψ},
With subset blocking, an i-successor y of x with L(y) = {ψ, i ψ, [i] i ψ} would be blocked by x; with equality blocking, a block would not be established until an i-successor z of y is constructed, with L(z) = L(y). This may lead to significant additional work if ψ is itself a large and/or complex formula. Apart from blocking, the algorithm is very similar to the Kn case, and most of the optimisation techniques described in Section 4.2 can be applied without modification. Blocking does, however, mean that additional care is required when caching and re-using the satisfiability of a set of formulae, because the satisfiability of the set of formulae in the label of a blocked node is contingent on the satisfiability of the set of formulae in the label of the blocking node [103]. This dependency also extends to the satisfiability of the sets of formulae in the labels of any nodes on the path between the blocking node and the blocked node. Consider, for example, a node x labelled as in 14 above, where ψ is unsatisfiable. As we have seen, an application of the 3-rule to i ψ ∈ L(x), followed by applications of the 2rule to [i] i ψ ∈ L(x), would lead to the creation of an i-successor y of x with L(y) = {ψ, i ψ, [i] i ψ}, and no expansion rule would be applicable to y as it would be blocked by x. Updating the cache to indicate that the set of formulae L(y) is satisfiable would, however, clearly be an error, as ψ is unsatisfiable.
4.4 Non-logical axioms and background theories Now that we have understood how to handle transitivity in K4n , understanding how to handle background theories is easy. Consider the satisfiability of a formula φ w.r.t. the background theory Γ = {γ1 , . . . , γn }, and remember that the nodes of our completion tree represent worlds of the model we are trying to build, which has to be a common model of φ and Γ. Moreover, ψ ∈ L(x) stands for the fact that ψ is true in the world (represented by) x. As before, at least one node (the root node) will carry φ in its label. Additionally, we will make sure that all nodes will carry each γi in their label. As a consequence, we will have a similar problem with termination as we have seen for K4n , i.e., the maximal modal depth of formulae in node labels does no longer decrease from a node to its successor. Fortunately, we can use the same blocking technique as for K4n : a node x is directly blocked if it has an ancestor x with L(x) ⊆ L(x ), and it is blocked if it is directly blocked or if it has an ancestor that is directly blocked. The expansion rules for
220
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Kn w.r.t. background theories are given in Figure 12: they contain the Kn 2−rule, an additional Γ-rule that adds Γ to each node label, and the K4n restriction to blocked nodes. We call the resulting algorithm the extended Kn tableau algorithm. ∧-rule:
there is a node x that is not blocked with ψ1 ∧ ψ2 ∈ L(x) and {ψ1 , ψ2 } ⊆ L(x), L(x) := L(x) ∪ {ψ1 , ψ2 }. ∨-rule: there is a node x that is not blocked with ψ1 ∨ ψ2 ∈ L(x) and {ψ1 , ψ2 } ∩ L(x) = ∅, L(x) := L(x) ∪ {ψi } for some i ∈ {1, 2}. 3-rule: there is a node x that is not blocked with i ψ ∈ L(x) and x has no i-successor y with ψ ∈ L(y), then create a new i-successor y of x with L(y) := {ψ}. 2-rule: If there is a node x that is not blocked with [i]ψ ∈ L(x) and x has an i-successor y with ψ ∈ L(y), then L(y) := L(y) ∪ {ψ}. Γ-rule: If there is a node x that is not blocked with Γ ⊆ L(x), then L(x) := L(x) ∪ Γ. If then If then If
Figure 12. The expansion rules for Kn with background theories. We can state and prove an analogous technical lemma as for Kn and K4n , and then use the same reasons to conclude the following theorem. THEOREM 22. The extended Kn tableau algorithm decides satisfiability w.r.t background theories. However, in contrast, we no longer can implement our tableau algorithm in polynomial space: firstly, it is known that satisfiability of Kn formulae w.r.t. background theories is ExpTimecomplete (we can adapt the proofs in [68, 162]). Secondly, we can easily construct a formula and a background theory such that each of their model contains a path of length exponential in the input formulae: we can use propositional variables p1 , . . . , p as a “binary counter” for numbers between 0 and 2 − 1, and non-logical axioms to enforce that, if the pi at a world w represent a number k, then the pi at a world w with (w, w ) ∈ Ri represent the number k + 1 mod . Thirdly, in the worst case, our algorithm indeed constructs completion trees that are of depth exponential in the length of the input formulae: for K4n , we could argue that the maximal modal depth decreases from a node to a j-successor of its i-successor (if i = j). For Kn with background theories, this is no longer true. As a consequence of this exponential length and the non-deterministic ∨-rule, our tableau algorithm runs, in the worst case, in non-deterministic double exponential time—which is clearly sub-optimal. In [56], an optimal tableau algorithm for (the description logic) variant of Kn with background theories was presented; however, to the best of our knowledge, this algorithm has never been implemented, whereas the sub-optimal one described here has proven to work surprisingly well in practice [159, 90]. Implementation Issues One obvious consequence of the above algorithm is that expansion of the formulae in Γ occurs in every node in the completion tree, and this can easily lead to an explosion in the size of the completion tree or in the number of different possible completion trees that can be (nondeterministically) constructed for a given input formula. For example, if Γ = { i ψ1 , . . . , i ψn }, a completion tree containing nn! + 1 nodes will be constructed. Similarly, if γ ∈ Γ, with
Computational Modal Logic
221
γ = ((p1 ∨ q1 ) ∧ . . . ∧ (pn ∨ qn )), and the input formula leads to the construction of a completion tree containing k nodes, then there are 2kn different ways to apply the ∧- and ∨-rules to the resulting k copies of γ. This explosion in the size of the search space can easily lead to a catastrophic degradation in performance, even when optimisations such as backjumping and caching are employed [102]. Fortunately, optimisations known as lazy unfolding and absorption have proved to be very effective in reducing the size of the search space, particularly for background theories derived, e.g., from class based knowledge representation formalisms. Lazy Unfolding In background theories, formulae are often (restricted to be) of the form p → ψ or p ↔ ψ for some propositional variable p. A theory Γ = {p1 ↔ ψ1 , . . . , p ↔ ψ , p+1 → ψ+1 , . . . , p+m → ψ+m } is said to be unfoldable, if it satisfies the following conditions. • Formulae in Γ are unique. I.e., for each propositional variable p, Γ contains at most one formula of the form p ↔ ψ (i.e., pi = pj for 1 i < j ), and if it contains a formula of the form p ↔ ψ, then it does not contain any formulae of the form p → ψ. (Note that an arbitrary set of formulae {p → ψ1 , . . . , p → ψn } can be combined into a single formula p → (ψ1 ∧ . . . ∧ ψn ).) • Γ is acyclic. I.e., there is no formula pi ↔ ψi ∈ Γ such that pi occurs either directly or indirectly in ψi .3 A propositional variable p occurs indirectly in a formula ψ if there is a propositional variable formula p such that p occurs directly in ψ, and there is a formula p ↔ ψ ∈ Γ such that p occurs either directly or indirectly in ψ . Instead of being dealt with using the Γ-rule, such a set of formulae can be lazily unfolded during the tableau expansion. I.e., for a formula p1 → ψ1 ∈ Γ, if pi is added to L(x) for some node x, then ψi is also added to L(x), and for a formula pj ↔ ψj ∈ Γ, if pj (¬pj ) is added to L(x) for some node x, then ψj (resp. ¬ψj ) is also added to L(x). It is obvious that an arbitrary background theory Γ can be divided into an unfoldable part Γu and a general part Γg such that Γu ∪ Γg = Γ and Γu ∩ Γg = ∅. The unfoldable part Γu can then be dealt with using lazy unfolding while the general part Γg is dealt with using the Γ-rule. In fact it has been shown that the definition of an unfoldable theory can be extended somewhat while still allowing the use of the above lazy unfolding technique. In particular, the formulae occurring on the left hand side of (bi-) implications can also be negated propositional variables, and the acyclicity condition can be relaxed by distinguishing positive and negative occurrences of propositional variables in a stratified theory [109, 132]. Absorption Given the effectiveness of lazy unfolding in dealing with the unfoldable part of a background theory Γ, it makes sense to try to rewrite the formulae in Γ so that the size of Γg can be reduced. Absorption is just such a rewriting optimisation. The idea behind absorption derives from the observation that (apparently non-unfoldable) formulae in Γg are often of the form p ∧ ρ → ψ. This formula can be rewritten as p → (ψ ∨ ¬ρ), which allows it to be moved from Γg to Γu , provided that Γu does not already contain a formula of the form p ↔ ψ . In case Γu does contain such a formula, then the technique can be extended by using the formulae in Γu to perform further rewriting. E.g., if p ↔ ψi ∈ Γu and p → ψj ∈ Γg , then the second formula can be rewritten as ψi → ψj and, if ψi is of the form q ∧ ψi , the formula 3 For
the purposes of lazy unfolding, only cycles consisting entirely of ↔ axioms are problematical.
222
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
can be further rewritten as q → ψj ∨ ¬ψi . A more detailed description of the various re-writings used in absorption can be found in [109].
4.5 Converse modalities So far, our tableau algorithms only use expansions rules that are either local to a single node, create new successors, or push formulae from a node label into the label of a successor. The objective of this section is to discuss a tableau algorithm for K n , i.e., Kn with converse modalities. can be polynomially reduced to the satisfiability of Kn It is well-known that satisfiability in K n w.r.t. background theories [43]. However, from an implementation perspective, this approach is not feasible since it leads to a dramatic performance degradation, and we thus present a direct algorithm. As mentioned in Section 2, K n requires reasoning in both ways over relations Ri . For our tableau algorithm, this will simply mean that we push formulae up and down in a completion tree. To realize this, we define the notion of an i-neighbour, which requires a few other concepts: firstly, to avoid numerous case distinction, we introduce a function Cv(·) on modal parameters as follows:4 Cv(i) = i and Cv(i ) = i. Next, we consider completion trees where each edge is labelled with a possibly converse modal parameter i or i . Finally, for α a (possibly converse) modal parameter, we call a node y an α-neighbour of a node x if y is an α-successor of x or if x is a Cv(α)-successor of y. The expansion rules for K n are identical to those for Kn , with the only difference being that the 2- and the 3-rules now consider α-neighbours instead of α-successors (but the 3-rule still generates an α-successor if no appropriate α-neighbour is available); they can be found in Figure 13. ∧-rule: ∨-rule: 3-rule: 2-rule:
If then If then If then If then
there is a node x with ψ1 ∧ ψ2 ∈ L(x) and {ψ1 , ψ2 } ⊆ L(x), L(x) := L(x) ∪ {ψ1 , ψ2 }. there is a node x with ψ1 ∨ ψ2 ∈ L(x) and {ψ1 , ψ2 } ∩ L(x) = ∅, L(x) := L(x) ∪ {ψi } for some i ∈ {1, 2}. there is a node x with α ψ ∈ L(x) and x has no α-neighbour y with ψ ∈ L(y), create a new α-successor y of x with L(y) := {ψ}. there is a node x with [α]ψ ∈ L(x) and x has an α-neighbour y with ψ ∈ L(y), L(y) := L(y) ∪ {ψ}.
Figure 13. The expansion rules for K n. We can state and prove an analogous technical lemma as for Kn , and then use similar reasons to conclude the first part of following theorem. THEOREM 23. The K n tableau algorithm decides Kn satisfiability and can be implemented in polynomial space. To implement the K n tableau algorithm in polynomial space, we can use the following “restart” technique: for each node x, we first apply the ∧- and the ∨-rule exhaustively.5 Next, if a formula is added to L(x) by the 2-rule for some [α]ψ in a Cv(α)-successor of x, then we disregard the whole sub-tree below x and re-start its construction from scratch. As a consequence of this “strategy”, all branches of a completion tree are independent, and we can still construct a completion tree depth first. that Kn with converse modalities provides modal parameters i and i for 1 ≤ i ≤ m. note that we never made any assumptions or restrictions on the order in which the rules are to be applied.
4 Remember 5 Please
Computational Modal Logic
223
Implementation Issues Although the restart technique can be used to enable K n completion trees to be constructed using a depth first strategy, the technique is not used in practice as rebuilding discarded parts of the completion tree can be very costly (and space usage is rarely a problem in practice). Without this technique, however, extra care is required when using some of the optimisation techniques described above. Without the depth first strategy, the satisfiability of (the formula represented by) the label of a node x can no longer be treated as an independent problem, because the results of expanding x might affect its predecessor (unless x is the root node). This means that, although we can reuse cached unsatisfiability results from the cache as before, we must either disregard satisfiable results, or use more sophisticated caching techniques (e.g., storing additional information that would allow us to check for possible interactions with the predecessor node) [103]. Computation of the dependencies used in backjumping is also made more difficult by the loss of the depth first strategy. In particular we need to consider the dependency set of the i formula in x that led to the generation of an i-successor y in order to compute dep(ψ, y) when ψ is added to L(y) as a result of a 2-rule application to a formula [i]ψ ∈ L(x). With depth first expansion, this is usually accomplished by combining 3-rule applications with all relevant 2-rule applications. Without depth first expansion, this is usually achieved by extending the labelling of either nodes or edges with the dependency set of the 3-formula that caused them to be added to the completion tree. Finally, without the depth first strategy it is necessary, in general, to save the state of the whole completion tree at each ∨-rule application (as mentioned above, the depth first strategy allows state saving and restoring to be restricted to a single node label). This problem can be ameliorated by using a lazy state saving strategy, where node labels are only saved when they are about to be extended by some rule application.
4.6 Converse modalities and background theories In the last sections, we have seen how to extend the basic Kn tableau algorithm to a decision procedure for K4n , for Kn with background theories, and for K n . For the first two extensions, we discussed a technique to “artificially” ensure termination while preserving soundness and completeness. For the third extension, we introduced the concept of neighbours and modified the expansion rules as to work up and down the completion tree. In this section, we will put these techniques and concepts together—and show that their combination requires a further adjustment. To be more precise, in this section, we discuss a tableau algorithm for K n with background theories, i.e., converse modal parameters can occur both in the input formula and in the formulae of the background theory. Next, we discuss the expansion rules, which are given in Figure 14. Clearly, in the presence of converse modal parameters, we use the notion of α-neighbours. Similarly, in the presence of background theories, we use the Γ-rule, and we use blocking to ensure termination. However, the combination of background theories with converse modal parameters requires two modifications. Consider an i-successor y of x with [i ]ψ ∈ L(y), and assume that y is blocked and x is not blocked. Hence there is some node y with L(y) ⊆ L(y ). In case the tableau algorithm stops with an open, complete completion tree, we will try to construct a model M from this tree, and we will have (x, y ) ∈ Ri . Now L(y) ⊆ L(y ) implies that [i ]ψ ∈ L(y ), and we thus have to show that M, x |= ψ. However, if we would not apply the 2-rule to y
224
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
because y is blocked, we might not find ψ ∈ L(x), and thus our construction might fail. This observations leads to the first modification: 1. we call a node indirectly blocked if it is blocked, and if its predecessor is blocked as well. Then we apply all but the 3-rule to nodes that are not indirectly blocked. In our example case, y was indirectly blocked, and thus the 2-rule would add ψ into L(x). Next, consider some [i ]ψ ∈ L(y ) \ L(y). The same reasons as for [i ]ψ imply that we should find ψ ∈ L(x)—which we would not since our blocking condition only requires L(y) ⊆ L(y ). This observation leads to the second modification: 2. a node x is directly blocked if it has an ancestor x with L(x ) = L(x). For obvious reasons, we refer to the former blocking condition as subset blocking, and to this new condition as equality blocking. Please note that, in this setting, it is unavoidable that blocking is “dynamic”, that is, a blocked node can later become not blocked. In contrast, with a certain strategy for the order of rule applications, this can be avoided in the Kn case. ∧-rule:
If
∨-rule:
then If
3-rule:
then If
2-rule:
then If
Γ-rule:
then If then
there is a node x that is not indirectly blocked with ψ1 ∧ ψ2 ∈ L(x) and {ψ1 , ψ2 } ⊆ L(x), L(x) := L(x) ∪ {ψ1 , ψ2 }. there is a node x that is not indirectly blocked with ψ1 ∨ ψ2 ∈ L(x) and {ψ1 , ψ2 } ∩ L(x) = ∅, L(x) := L(x) ∪ {ψi } for some i ∈ {1, 2}. there is a node x that is not blocked with α ψ ∈ L(x) and x has no α-neighbour y with ψ ∈ L(y), create a new α-successor y of x with L(y) := {ψ}. there is a node x that is not indirectly blocked with [α]ψ ∈ L(x) and x has an α-neighbour y with ψ ∈ L(y), L(y) := L(y) ∪ {ψ}. there is a node x that is not indirectly blocked with Γ ⊆ L(x), L(x) := L(x) ∪ Γ.
Figure 14. The expansion rules for K n with background theories.
4.7 Other extensions (counting, nominals, transitive closure, and fixpoints) In this section, we discuss two other extensions of our tableau algorithms. Firstly, we discuss c K,o n , the extension of Kn with background theories and nominals. Secondly, we discuss Kn , the extension of Kn with graded modalities, and also how to ensure termination in the additional presence of background theories. Finally, we discuss modal logics with a transitive closure operator and fixpoints. Further add nominals to K n with background theories with background theories is of interest because it lacks the tree models property and K,o n because it requires another form of non-local reasoning. The former point was already discussed in Section 2. To see the latter point, consider the formula i (p ∧ o) ∧ j o ∧ [j][ ] i (p ∧ o) ∧ j (o ∧ [ ]q). The first three conjuncts imply the existence of an infinite
Computational Modal Logic
225
(possibly cyclic) Ri -path w1 , w2 , . . . such that the world in which o is true is -accessible from each wk . The fourth conjunct implies that, in all wk , q is true—however, this is only “detected” when the 3-rule is applied to the fourth conjunct. To handle, additionally, nominals, we can further modify our extended K n tableau algorithm as follows. Firstly, we give up completion trees. More precisly, if o1 , . . . , o are all nominals occurring in φ and Γ, we start our tableau with + 1 root nodes xi , where L(x0 ) = {φ} and L(xi ) = {oi }, for each 1 ≤ i ≤ . Then, whenever we find a nominal oi in a node x = xi , we merge x into xi ; that is, we merge x and xi ’s labels and incoming and outgoing edges. As a consequence of this merging, we will possibly find several edges going into a nominal node xi ; however, removing these edges clearly yields a forest structure. Correctness is then straightforward, and termination is due to the fact that (a) each path starting at some xj is of bounded length because of blocking, and (b) if a successor node was created for some 3iψ ∈ L(x), then we will not create it “again”, even if x was merged into another node. For details, see [5, 106]. Further add graded modalities to Kn In this section, we will discuss, on a rather abstract level, what modifications are necessary to handle graded modalities i n φ and [i]n φ; for a more detailed description, see [108, 101]. Firstly, following our previous approach, it is quite obvious that, when we find i n ψ ∈ L(x), we should make sure that we find n + 1 i-successors yj of x with ψ ∈ L(yj ). Usually, when we do not find them, we create them all in a single step. Similarly, if we find [i]n ψ ∈ L(x), we must make sure that we do not find more than n i-successors yj of x with ψ ∈ L(yj ). Thus, if there are more such i-successors, we merge two of them, say yj and yk , i.e., we merge yk ’s node label and outgoing edges into yj ’s and remove yk , thus reducing the number of such i-successors by one. Secondly, in the presence of contradicting graded modalities i n ψ and [i]n ψ with ψ → ψ and n ≤ n in the label of a node x, the above naive approach would lead to the repeated generation and merging of i-successors of x, and thus to non-termination. To prevent this “yoyo”effect, when introducing n + 1 i-successors for some i n ψ ∈ L(x), we use an explicit inequality relation between these i-successors, do not merge “explicitly unequal” nodes, and extend the notion of a clash to also cover the case where [i]n ψ ∈ L(x) but x has more than n “explicitly unequal” i-successors with ψ in their label. Thirdly, these modification yield a terminating yet unsound decision procedure: consider, for example, the formula [i]1 p ∧ [i]1 ¬p ∧ i 2 q. With the modifications made so far, our tableau algorithm would generate three (explicitly unequal) i-successors yj of a root node x0 with q ∈ L(yj ), stop, and return “satisfiable”, which is clearly the wrong answer. The reason for this incorrect answer is that we only merge surplus i-successors for some [i]n ψ if we already know that they must satisfy ψ, i.e., if ψ is found in their label. However, as the previous example shows, this is not enough: if [i]n ψ ∈ L(x), we must determine, for each i-successor yj , whether it does or does not satisfy ψ. We can do this using an additional, non-deterministic choose-rule that adds, to each such i-successor, either ψ or the negation normal form of ¬ψ. For Kn , these modifications lead to a decision procedure for satisfiability, even in the presence of either background theories or converse modalities (where we only have to take care to count and merge i-neighbours correctly). However, for K n with background theories, we need a further modification, namely one to the blocking condition: otherwise, the algorithm is not correct (see, e.g., the example in [105]). Since this logic lacks the finite model property, a construction
226
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
of a model from a completion tree uses standard unravelling where, instead of a path going to a blocked node, it goes to the node blocking it. Now, in the presence of graded modalities, we must make sure that this does not lead to additional i-accessible worlds which thus would violate some graded modal formulae. Roughly speaking, we ensure this using double blocking, i.e., instead of a node being blocked by an ancestor, a node and its predecessor is blocked by an ancestor and its respective predecessor. For details, see [105, 108]. Implementation Issues As we have seen, the tableau algorithm K n requires a more complex blocking condition in order to ensure that a completion tree can be unravelled into an infinite tableau. This can adversely affect performance, because blocks can take (much) longer to establish, and the completion tree can thus grow (much) larger. The problem can be ameliorated by using a more precise (weaker) blocking condition that identifies the cases where double blocking is really needed (i.e., where a cyclical model cannot be built from a branch of the completion tree blocked using the original single blocking condition), and compares only those parts of the node label pairs that are relevant to determining if the completion tree could be unravelled to give an infinite tableau [107]. Transitive Closure and Fixpoints There are various extension of modal logics with transitive closure operators and general fixpoints, see Chapter 12 of this handbook. However, there are only few “practicable” satisfiability algorithms in the sense that one could dare to implement them and expect a reasonable behaviour in any non-trivial case.6 To the best of our knowledge, there are only two such algorithms based on tableau, namely the ones described in [11, 45] for extensions of Kn with transitive closure, and there has only been a single attempt at an implementation, namely in the system DLP [159]. For this kind of extensions, automata-based techniques (see 5.1) seem to be suited best: for example, the only known decision procedure for the μ-calculus is based on automata, see Chapter 12 of this handbook.
5 OTHER COMPUTATIONAL APPROACHES
5.1 Automata-based algorithms Roughly speaking, automata-based algorithms work as follows. To decide the satisfiability of a logic L, we first show an appropriate tree-model property for L, i.e., prove that each satisfiable L formula is satisfiable in a model (or an abstraction of a model) whose relational structure forms a tree. For example, it is well-known that each satisfiable Kn formula is satisfiable in a tree model which is, additionally, finite [93]. For other logics, e.g., K4n , we can easily show that each satisfiable formula has a model with an infinite tree abstraction, where we can obtain a model from such an abstraction by transitively closing the accessibility relations [93]. Secondly, for an L formula φ, we define an automaton Aφ such that Aφ accepts all tree models of φ (or abstractions thereof). Depending on the logic and its model properties, we use automata on finite or on infinite trees. Thus we have reduced the satisfiability of formulae in L to the emptiness 6 For other reasoning problems such as model checking, these algorithms exist and have been implemented successfully, see Chapter 17 of this handbook.
Computational Modal Logic
227
problem of a certain class of automata, and we can use well-known algorithms to decide these emptiness problems. For a variety of logics, this approach has several of advantages. Consider, for example, Kn with background theories. It can easily be seen that this logic enjoys the tree model property, and thus we only need to devise the construction of an automaton Aφ . Using alternating automata, this construction is quite straightforward and yields, surprisingly, a (worst-case) optimal decision procedure (for a similar construction for a more powerful logic see, e.g., [188]): the automaton Aφ is of size polynomial in the input tree, and testing its emptiness can be done in deterministic exponential time [128]. Thus, in contrast to the tableau algorithm described in Section 4.4, we effortlessly obtain a deterministic algorithm, and do not even need to take care of termination or finite models: using automata on infinite trees makes this unnecessary. Concerning the implementability of automata-based approaches, we observe that their worstcase complexity often coincides with their best-case complexity: to decide the emptiness of alternating automata, we first translate them into non-deterministic ones that are then tested for emptiness, i.e., we first build a structure of exponential size, for which we then decide emptiness in polynomial time [128]. In case we directly use non-deterministic automata, they tend to be of size exponential in the size of the input formula, and we are thus confronted with the same problem. Thus, any naive implementation is doomed to failure. However, there are at least two ways out: in [158], it was shown how BDDs can be used to efficiently represent and handle large automata, thus proving that (variations of) automata-based algorithms can be implemented efficiently using appropriate data structures. In [12], it was shown how an automata-based approach can be transformed mechanically into a tableau-based decision procedure: as a consequence, we only need to “hand-craft” the automata-based algorithm, and then get both a (possibly optimal) worst-case upper bound and a (possibly practicable) tableau-based algorithm for free.
5.2 Modal resolution In the late 1980s and early 1990s various direct resolution methods for modal logics have been investigated [1, 10, 33, 46, 59, 61, 72, 79, 126, 139, 140]. According to [139] a resolution method for a logic L is determined by specifying (i) a class of formulae called clauses, (ii) a reduction method which allows us to transform any formula of L into a finite set of clauses, (iii) a calculus consisting of a set of resolution rules for deriving clauses (and possibly redundancy elimination and simplification rules), and (iv) a derivation process which starts from an initial set of clauses and constructs a sequence of derivable clauses. One can then define a modal resolution method to be a resolution method in which clauses are formulae of the modal logic L under consideration. This definition excludes methods which do not use a clausal form from the outset, e.g. destructive modal resolution [72], or methods which use auxiliary labels, e.g. prefixed resolution [6] and labelled modal resolution [7]. Methods which use additional modal operators like the resolution calculus for temporal logics of knowledge presented in [54] can be considered to be borderline cases. In the following we focus on the modal resolution method of [59] but follow the presentation in the survey paper [64], where a more complete overview of various direct resolution methods and other methods can be found. A modal
of K is in disjunctive normal form iff it is a (possibly empty) disjunction of
formula the form Li ∨ 2Dj ∨ 3Ak where each Li is a propositional literal, each Dj is a modal normal formula in disjunctive normal form, and each Ak is a modal formula in conjunctive form. A modal formula is in conjunctive normal form iff it is a conjunction Dl where each
228
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Axioms axiom1: p, ¬p ⇒ ⊥ axiom2: Resolution rules ∨-rule1: A ∨ D, B ∨ D ⇒ C ∨ D ∨ D if A, B ⇒ C ∨-rule2: A∨C⇒B∨C if A ⇒ B 3-rule1: 3(A, B, N ) ⇒ 3(A, B, C, N ) if A, B ⇒ C 3-rule2: 3(A, N ) ⇒ 3(B, A, N ) if A ⇒ B K-rule1: 2A, 3(B, N ) ⇒ 3(B, C, N ) if A, B ⇒ C K-rule2: 2A, 2B ⇒ 2C if A, B ⇒ C 2-rule: 2A ⇒ 2B if A ⇒ B Simplification rules ∨-simp1: ⊥∨D→D 3-simp: ∧-simp: ∨-simp2: A∨A∨D→A∨D
⊥, A ⇒ ⊥
3⊥ → ⊥ ⊥, N → ⊥
Figure 15. Modal resolution rules of [59] for K. (The symbols A, B, C, D, D denote clauses, N denotes a set of clauses, and (A, N ) denotes the union of {A} and N . No distinction is made between a set N of clauses and the conjunction of its elements.)
Dl is a modal formula in disjunctive normal form. A formula in disjunctive normal form is also called a (modal) clause. Any modal formula ϕ can be transformed into an equivalent formula in conjunctive normal form cnf(ϕ). In the following, we do not distinguish between a conjunction of clauses and a set of clauses. The calculus CK of [59] is given by the set of axioms, resolution rules, and simplification rules shown in Figure 15. The intended meaning of A, B ⇒ C and A ⇒ C is that the conjunction of the formulae on the left-hand side of ⇒ implies the formula on its right-hand side. In contrast, the meaning of A, B → C is that occurrences of A and B in a conjunction can be simplified to, that is, replaced by, C. Analogously, A → C, means that occurrences of A can be replaced by C. Every formula A has a unique normal form nf(A) under the simplification rules of Figure 15 (modulo commutativity and associativity of ∨ and ∧). Various extensions of K have been considered, including extensions by the axiom schemas D, T, and 4. For each of these axiom schemas the calculus CK needs to be extended with additional rules: for D with 2⊥ ⇒ ⊥, for T with 2A, B ⇒ C if A, B ⇒ C, while for 4 with the two rules 2A, 2B ⇒ 2C if 2A, B ⇒ C and 2A, 3(B, N ) ⇒ 3(B, C, N ) if 2A, B ⇒ C. We denote the calculi obtained by adding these rules to CK by CKD , CKT , and CK4 , respectively. Let L be one of K, KD, KT, K4. Given sets of clauses N and (C, N ) we say (C, N ) can be derived in one step from N in CL iff either there are clauses A and B in N such that A, B ⇒ C in CL or there is a clause A in N such that A ⇒ C in CL , and C = nf(C ) in CL . A derivation of N from N in CL is a sequence N = N0 , N1 , . . . , Nn = N such that for every i, 0 ≤ i < n, Ni+1 can be derived from Ni in one step. A refutation of N in CL is a derivation of ⊥ from N in CL . If a refutation of N exists, then N is CL -refutable. In [59] it is shown that a modal formula ϕ is valid in L iff cnf(¬ϕ) is CL -refutable. This soundness and completeness result is shown in [10] to also hold for a number of refinements of this modal resolution method and the extension by subsumption deletion. So far, little work seems to have been conducted on devising specialised and efficient data structures and algorithms for modal resolution methods. Due to the extra structural information
Computational Modal Logic
229
that modal formulae carry, which is reflected in the more complicated clausal form, the data structures and algorithms developed for efficient propositional and first-order resolution provers cannot be utilised easily to implement modal resolution methods.
5.3 Sequent-based approaches Sequent calculi were introduced by Gentzen [80] as a tool for studying natural deduction. The central property of sequent calculi is cut elimination which usually yields consistency as an easy corollary. The first sequent calculi and cut elimination results for modal logics have been established in the early fifties [39], see [89] for further historic references. A sequent is a structure of the form Γ Δ, where Γ and Δ are (finite) lists, multisets, or sets of formulae; Δ is also quite often restricted to be a singleton set or the empty set. A sequent calculus for a logic L consists of two parts: (i) a finite set of axioms, (ii) a finite set of rules of the form S1 S1 S2 with conclusion S and premises S1 and S2 , where S, S1 , and S2 denote sequents. S or S The rules can usually be divided into two major groups: logical rules, which introduce a new logical formula either on the left or on the right of the turnstile , and structural rules, which operate on the structure of the sequents. Of particular interest, both from a proof-theoretical and a computational point of view is the cut rule, a rule of the form A, Γ2 Δ2 Γ1 Δ1 , A Γ1 , Γ2 Δ1 , Δ2 where, in general, A is an arbitrary formula, called the cut formula. A sequent calculus proof of a goal sequent S is a tree whose nodes are labelled with sequents, such that (i) the root of the tree is labelled with S, (ii) each leaf node is an instance of an axiom of the calculus, and (iii) each sequent labelling a non-leaf node n follows by one of the rules of the calculus from the sequents labelling the children of n. This notion of a proof does not prescribe a particular approach to the construction of the proof of a sequent S. However, it is quite natural to proceed by backward reasoning, that is, to start with a tree consisting only of the root node labelled with S and to apply rules from bottom to top, taking the sequent labelling a node of the tree to be the conclusion of a rule and adding children to the tree labelled with the premises of the rule. The construction is complete if all the current leaf nodes are labelled with instances of axioms. In contrast, in forward reasoning one would start with one or more leaf nodes labelled with instances of axioms and build the tree toward its root node labelled with S. This approach is basically taken in the inverse method, see Section 5.4. For further details on sequent calculi see Sections 7 and 8 of Chapter 2 of this handbook. From a computational point of view, sequent calculi pose several challenges and also provide insights that can help to improve systems based on tableau calculi or the inverse method. First, the cut rule is problematic for backward reasoning, since we can choose an arbitrary formula to be the cut formula. We can try to show that we can restrict ourselves to cut formulae which are subformulae of formulae in the goal sequent S while retaining completeness of the calculus. The result would be a calculus with analytic cut. However, from a practical point of view, while for analytic cuts we can only choose finitely many different cut formulae, the search space may still be too large. Alternatively, one can try to show that for any sequent S there exists a proof without any application of the cut rule. In such a case, we can omit the cut rule from the calculus and obtain a cut-free sequent calculus. While for some modal logics it is rather straightforward to devise cut-free sequent calculi, for others it is much more challenging, for example, for S5 [30, 151, 152], and for some it is an open problem, for example, for PDL
230
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
and converse PDL [127]. We are also not aware of cut-free systems for modal logics with the common knowledge operator. Second, in the presence of the axiom schema 4, systems based on sequent calculi face the same non-termination problems as systems based on tableau calculi. Recall from Section 7 of Chapter 2 one of the additional rules required for K4, 2Y1 , . . . , 2Ym , Y1 , . . . , Ym , A 3Z1 , . . . , 3Zn , Z1 , . . . , Zn Γ, 2Y1 , . . . , 2Ym , 3A 3Z1 , . . . , 3Zn , Δ where Γ and Δ are sequences of formulae not containing a 2-formula and 3-formula, respectively. Here, the premise is not necessarily ‘simpler’ than the conclusion which can lead to situations in which this rule can be applied infinitely many times when using backward reasoning. To ensure termination a form of loop-check has to be used, that is, a check which detects whenever the ‘same’ sequent occurs twice on a branch of a proof. If in turn we would like to formulate the rules of our calculus in such a way that the applicability of rules does not depend on information about the whole branch of a proof or even the whole proof, additional history information has to accompany each sequent in a proof. What minimal history information for loop-checks is necessary to ensure termination on a variety of modal logics, including KT and S4, is investigated in [96, 98]. These results transfer directly to tableau calculi. Finally, sequent-based systems face the same problems as tableau-based systems when trying to prove formulae involving disjunctions on the left or conjunctions on the right of the turnstile. Naturally, similar solutions as presented in Section 4, in particular, simplification and forms of intelligent backtracking, have also been considered in the context of sequent-based systems, most notably in the work of [25, 96, 97].
5.4 Inverse method The inverse method is a variant of the sequent calculus [51, 135] which carries its name because it works from sub-goals to goals, whereas standard sequent-based approaches work in the other direction. For example, if it has already been proven that φ is false and ψ is true, then the inverse method will deduce from this that φ → ψ is true. For this kind of forward reasoning to work, we need to be able to focus on an acceptably small set of axioms, and an acceptably small set of goals and sub-goals. For many modal logics, we can restrict our attention to such ‘acceptably small’ sets of formulae since they enjoy the sub-formula property, i.e. every valid formula φ has a derivation in which only (negated or unnegated) sub-formulae of φ occur [51]. Calculi for modal logics using the inverse method have been developed in [139, 140, 190]. The inverse method has been shown to be suitable for efficient modal logic theorem proving and is amenable to optimisations [190]. Interestingly, the inverse method is closely related to automata-based approaches [13]. More precisely, the algorithm that decides emptiness of automata (the problem to which satisfiability of a variety of modal logics can be reduced, see Section 5.1) can be viewed as being a notational variant of the inverse method. Both start with propositional axioms (in the automata emptiness test, these correspond to unreachable states), and saturate these axioms using basically the same deduction rules. As a consequence, it should be possible to translate a variety of automata-based decision procedures into the inverse method, thus obtaining an efficient implementation (or a good starting point for its implementation) basically for free.
Computational Modal Logic
231
6 OTHER REASONING PROBLEMS In this chapter, we have focused on one specific reasoning problem, satisfiability or, dually, validity. There are, however, other interesting reasoning problems for modal logics that are useful for certain applications. We will discuss some of them in this section and we refer the reader to Section 5 of Chapter 13 of this handbook for reasoning problems that are motivated by applications of description logics.
6.1 Model checking Model checking is the problem of deciding whether M, w |= ϕ for a given Kripke structure M, a world w, and a modal formula ϕ. It is used for system verification, e.g. to verify a piece of softor hardware, as follows: • M represents the system: worlds are viewed as states the systems can be in, • modal parameters represent actions which take the system from one state into another (or several others), • w is some initial state, and • ϕ is a temporal logic formula describing a desired behaviour of the system. Whereas satisfiability algorithms have to reason w.r.t. all structures (possibly from a given class), model checking is concerned with a single structure, and thus quite different: model checking is often less complex than satisfiability, and there are industrial strength implementations of model checking algorithms capable of handling large systems and formulae from rather expressive logics. We refer the interested reader to Chapter 17 of this handbook and [34, 35].
6.2 Proof checking Proof checking is the problem of deciding whether a given derivation P is a proof of a given formula ϕ, commonly with respect to a fixed calculus C for a logic L. It requires a language in which we are able to formalise derivations. The formalisation of a derivation may simply be a sequence or a tree-structure of formulae, but may also contain additional information about which and how inference rules of the calculus C have been used in each step of the derivation. The motivation for proof checking is the fact that advanced theorem proving systems are rarely verified. Thus, like any other piece of software they invariably include errors which can lead the system to provide incorrect answers, including, providing an incorrect proof P for a given formula ϕ. Simplifying theorem proving systems to an extend that would allow their verification in all likelihood results in systems which are too slow to be useful. However, such system may still be sufficiently powerful to check the correctness of a given derivation P . Thus, a natural approach is to use a highly optimised but unverified system to find a proof P for a given formula ϕ which is then independently checked for correctness by a slower, verified system. Proof checking has received considerable attention in the context of higher-order logic [155, 195] and is taken seriously in the context of first-order logic [136]. However, we are not aware of any work in this direction in the context of modal logics, although the problem of incorrect theorem provers also exists in this field. Note that in the context of the translation approach we can rely on first-order proof checkers augmented with a verified program for translating modal formulae into first-order clause sets.
232
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
Even more complex is the problem of verifying the non-existence of a proof. For the modal logics we have considered in this chapter we would also expect decision procedures to correctly determine in finite time that a given formula ϕ has no proof. A justification for this can be given by a model or representation of a model M for ¬ϕ, produced by the decision procedure. A verified model checker could then be used to independently verify that M is indeed a model of ¬ϕ.
6.3 Computing correspondences Recall from Chapter 1 of this handbook the notion of a modal formula ϕ(p1 , . . . , pn ) over propositional variables p1 , . . . , pn being true in frame F iff for every world w and every valuation mapping V for its propositional variables we have (F, V ), w |= ϕ, and the notion of a modal formula ϕ defining a class of frames iff ϕ is true in precisely the frames in the class. It straightforward to see that a modal formula ϕ over p1 , . . . , pn is true in a frame F iff the monadic second-order formula ∀Pp1 . . . Ppn ∀x πr (ϕ, x) is true in the class of all models over the frame F. There are methods for reducing such second-order formulae to equivalent first-order formulae and there are methods for reducing the second-order logic formulation of modal axioms to the corresponding frame properties. Computing the first-order equivalents of modal formulae (if they exists) amounts to the elimination of the universal or existential monadic second-order quantifiers. For example, if we are interested in establishing the relational frame properties corresponding to a modal formula ϕ, then we either have to eliminate the universal monadic second-order quantifiers from ∀Pp1 . . . Ppn ∀x πr (ϕ, x), or, equivalently, the existential monadic second-order quantifiers from ∃Pp1 . . . Ppn ∃x πr (¬ϕ, x). There can be no algorithm which is guaranteed to find a firstorder equivalent formula if there exists one. Still, a number of automated algorithms are known which provide a partial solution to the quantifier elimination problem, namely SCAN [75, 58], DLS [55, 185] and SQEMA [37]. SCAN and DLS are based on a form of resolution while SQEMA can be viewed as a modalized DLS algorithm. Here we briefly review the SCAN algorithm, but more details of DLS and other quantifier elimination algorithms can be found in [36, 147]. The SCAN algorithm involves three stages: (i) transformation to clausal form and (inner) Skolemisation; (ii) C-resolution; (iii) reverse Skolemisation (unskolemisation). The input of SCAN is a second-order formula of the form ∃Q1 . . . ∃Qk ψ, where the Qi are unary predicate variables and ψ is a first-order formula. In the first stage SCAN converts ψ into clausal normal form by transformation into conjunctive normal form, Skolemisation, and clausifying the Skolemised formula. In the second stage SCAN performs a special kind of constraint resolution, called C-resolution, the two main inference rules are given in Figure 16. It generates all and only resolvents and factors with the second-order variables that are to be eliminated, which in the case of computing frame correspondence properties includes all existentially quantified second-order variables. When all C-resolvents and C-factors with respect to a particular Qi -literal and the rest of the clause set have been generated, purity deletion removes all clauses in which this literal occurs. The subsumption deletion rule is optional for the sake of soundness, but helps simplify clause sets in the derivation. If the C-resolution stage terminates, it yields a set N of clauses in which the specified secondorder variables are eliminated. This set is satisfiability equivalent to the original second-order
Computational Modal Logic
233
formula. If no clauses remain after purity deletion, then the original formula is a tautology; if Cresolution produces the empty clause, then it is unsatisfiable. If N is non-empty, finite and does not contain the empty clause, then in the third stage, SCAN attempts to restore the quantifiers from the Skolem functions by reversing Skolemisation. This is not always possible, for instance if the input formula is not first-order definable. If the input formula is not first-order definable and stage two terminates successfully yielding a non-empty set not containing the empty clause then SCAN produces equivalent second-order formulae in which the specified second-order variables are eliminated but quantifiers involving Skolem functions occur and the reverse Skolemisation typically produces Henkin quantifiers. If SCAN terminates and reverse Skolemisation is successful, then the result is a first-order formula logically equivalent to the second-order input formula. SCAN can compute the frame correspondence properties for very many well-known axioms including T, 4, and 5. Recent work has in fact shown that the SCAN algorithm is complete for the class of all Sahlqvist formulae, in the sense that, when given a Sahlqvist formula it will successfully compute an equivalent first-order formula for it [88].
6.4 Model generation A problem closely related to the satisfiability problem is the problem of generating (counter-) models. Ideally we want to construct finite models if they exist. It is possible to use both tableau and resolution methods to prove that logics have the finite model property and also to give procedures for constructing standard Kripke models. Although tableau provers do not always output models, it is well-known that tableau procedures implicitly generate models (of some kind) for satisfiable input problems. This is especially true for semantic tableau procedures which are defined by structural rules and use explicit accessibility relations. Modal tableau procedures of the kind described in Section 4 which use propagation rules for handling the additional axioms do construct models but often they are just skeleton models which need to be completed with respect to the relational correspondence properties and then give standard Kripke models. In first-order logic it is well-known that hyperresolution like tableau methods can be employed both as a reasoning method and a Herbrand model builder [31, 65]. It has been shown that the methods using Rhyp and the relational translation described in Section 3 require hardly any extra effort to construct a modal model [49, 121, 180]. It is usually a simple matter to read off a Kripke model from the saturated set of ground unit clauses which represents a Herbrand model. In general this set will be infinite in the limit, but when Rhyp is a decision procedure then the set is finitely bounded and consequently a finite Kripke model can be defined. In more detail, a Herbrand interpretation is a set of ground atoms. By definition a ground atom A is true in an interpretation H iff A ∈ H and it is false in H iff A ∈ H. Now, extend the C ∨ Q(s1 , . . . , sn ) ¬Q(t1 , . . . , tn ) ∨ D C ∨ D ∨ s1 ≈ t1 ∨ . . . ∨ sn ≈ tn provided the two premises have no variables in common and are distinct clauses C ∨ Q(s1 , . . . , sn ) ∨ Q(t1 , . . . , tn ) C-Factoring: C ∨ Q(s1 , . . . , sn ) ∨ s1 ≈ t1 ∨ . . . ∨ sn ≈ tn C-Resolution:
Figure 16. The calculus of SCAN
234
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
definition as expected to the Boolean combination of ground atoms. A clause C is true in H iff for all ground substitutions σ there is a literal L in Cσ which is true in H. A set N of clauses is true in H iff all clauses in N are true in H. If a set N of clauses is true in an interpretation H then H is referred to as a Herbrand model of N . It is proved in [49, 121] that the combination of the relational translation and Rhyp can be used as a finite Herbrand model generator for the modal logics Kn , K n and the extensions with T, D, B (actually more general results are proved). In general Herbrand models are not unique and can be large. Therefore it is useful to have a method for generating minimal Herbrand models. An interpretation H is a minimal Herbrand model for a set N of clauses iff H is a Herbrand model of N and for no Herbrand model H of N , H ⊂ H holds. Various approaches to generating minimal Herbrand models with hyperresolution are known [26, 31, 94, 144]. It follows from [31] and investigations of GF − and the class BU in [81, 82] that with a moderate extension of Rhyp , denoted here by Rhyp min , it is possible to guarantee the generation of all and only minimal Herbrand models for any modal and description logic reducible to a decidable class of range restricted clauses. It is necessary to use a depth-first strategy, a complement splitting rule should be used so that the first model generated is a minimal Herbrand model, and a model constraint propagation rule is necessary to prevent the generation of non-minimal Herbrand models (see Figure 17). The procedure Rhyp min is generally sound and complete and is a minimal Herbrand model building procedure for range-restricted clauses [31]. An alternative is to use the generalisation [81, 82] of an approach of [144]. It is not difficult to see that model generation procedures and the mentioned minimal Herbrand model generation procedures can be developed by using hyperresolution and the other translation methods. Because of the close connection to tableau, corresponding tableau procedures can be defined and all results carry over to the tableau setting (see [49, 121]).
6.5 Bisimulation Chapter 1 of this handbook has introduced the notion of a bisimulation between two Kripke models. A bisimulation between models M = W, R, V and M = W , R , V is a binary relation E ⊆ W × W such that whenever E(w, w ) the following three properties hold: Atomic: for all propositional variables p, w ∈ V (p) iff w ∈ V (p); Zig: if Ri (w, v) for some i, then there exists v in M such that E(v, v ) and Ri (w , v ); and Zag: if Ri (w , v ) for some i, then there exists v in M such that E(v, v ) and Ri (w, v).
Complement splitting:
N ∪ {C ∨ D} N ∪ {C, ¬D} | N ∪ {D}
where D is a ground clause. N N ∪ {¬A1 ∨ . . . ∨ ¬An } where {A1 , . . . , An } is the finite Herbrand model of an open branch which is complete with respect to Rhyp . The model constraint propagation rule extends all branches in the derivation tree (to the right) which are not complete with respect to Rhyp min . Model constraint propagation:
Figure 17. Additional rules for minimal Herbrand model generation
Computational Modal Logic
235
One important property of bisimilar models is that they satisfy the same μ-calculus formulae, that is, let E(w, w ) hold then a μ-calculus formula ϕ is true at w in M iff ϕ is true at w in M . The notion of bisimulation not only plays an important rˆole in modal logic, as an equivalence principle between Kripke models, but also in other fields, for example, concurrency theory, set theory, and formal verification. An algorithm for ‘on the fly’ verification of bisimulations is presented in [66]. A related problem is that of bisimulation minimisation, that is, the problem of finding the minimal Kripke model bisimilar to a given Kripke model. In particular, in the context of formal verification by model checking (see Section 6.1 and Chapter 17 of this handbook for further details), bisimulation minimisation provides an easily and automatically computable way to reduce the number of states of a model while preserving the truth and falsehood of the formulae that hold in it. Let M = W, R, V be a Kripke model and E be an equivalence relation on W . Let [w]E denote the equivalence class of a world w ∈ W with respect to E. The set of all equivalence classes is a partition of W and M. The bisimulation minimisation of a Kripke model M is the quotient M/E = W , R , V where W R V (p)
= {[w]E | w ∈ W }, = {([w]E , [w ]E ) | w, w ∈ W ∧ R (w, w )}, and = {[w]E | w ∈ V (p)}
for every propositional variable p such that E is the maximal equivalence relation on W which is also a bisimulation between M and itself. A partition P is stable with respect to E iff for each pair [w]E , [w ]E of equivalence classes with respect to E either [w]E ⊆ E −1 ([w ]E ) or [w]E ∩ E −1 ([w ]E ) = ∅. In the computation of the bisimulation minimisation of a Kripke model we can basically follow two strategies. One is a negative strategy in which we start with the coarsest partition P such that E(w, w ) iff w ∈ V (p) iff w ∈ V (p) for every positional variable p and split classes whenever P is not stable. Another is a positive strategy in which we start with the finest partition P in which each equivalence class consists of a single world and the bisimulation minimisation is constructed via a sequence of steps in which we merge two or more classes. An algorithm following the negative strategy is presented in [156] which has the optimal worst-case running time, namely O(|R|log|W |). An implementation of this algorithm is presented in [67]. Other algorithms following a negative strategy are presented in [28, 130]. They take advantage of the fact that in a number of applications we are only interested in the part of a Kripke model reachable from a designated start world. In this case, equivalence classes associated with unreachable worlds need not be taken into account when considering the stability of an equivalence class associated with a reachable world. An algorithm following the positive strategy is presented in [157]. Recently, [57] has introduced an algorithm combines both the positive and negative strategy by using the algorithms of [156] and [157] as subroutines. For a range of special cases this algorithm terminates in time O(|R| + |W |). Finally, [71] presents on-the-fly model checkers for invariant properties incorporating the bisimulation minimisation algorithms of [28, 130, 156]. From an empirical comparison they draw the conclusion that in this context an optimised version of the algorithm of [156] performs better than the other two.
236
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
6.6 Modal logic programming The problem of extending logic programming languages with modal operators has received a lot of attention in the late 1980s and early 1990s, at about the same time most of the direct resolution methods mentioned in Section 5.2 were developed and also work on the translation methods described in Section 3 intensified. Consequently, work in this area can again be divided between direct approaches and translation approaches. Following the direct approach, [21, 20] presents a declarative semantics and an SLD resolution calculus for a class of modal logic programs in modal logics KD, KT, and S4, while [22, 23] present a framework for developing the fixpoint and operational semantics of a class of multimodal logic programs where additional properties of modal operators can be described by axiom schemas of the form [i1 ][i2 ] · · · [im ]p → [j1 ][j2 ] · · · [jn ]p, so-called inclusion axioms. More recent work includes [142] presenting a fixpoint semantics, least model semantics, and an SLD resolution calculus for modal logic programs in modal logics extending K with a non-empty selection of the axiom schemas B, D, T, 4 and 5. Also, modal logic programs in [142] are as expressive as the general modal Horn fragment which allows arbitrary occurrences of the modal operators 2 and 3 in programs clauses and goals. Following the translation approach, [50] applies the functional translation to multi-modal logic programs in the modal logics KD, KT, KD4, KT4, KF (F is the functionality axiom), and simple inclusion axioms of the form [i]p → [j]p. In these logics, the functional translation of goals and program clauses in the general modal Horn fragment are in the first-order Horn fragment. For computations SLD resolution extended by theory unification is used. In [146] presents an application of the semi-functional translation [145, 148] to modal logic programs in modal logics KB and KDB, as well as KD, KT, and their extension by one or both of the axiom schemas 4 and 5. The semi-functional translation combines features of the relational and functional translation. For modal formulae in negation normal form, subformulae of the form 2ϕ are translated using the relational translation, while subformulae of the form 3ϕ are translated using the functional translation. A functional simulator axiom needs to be added to the translation to link the relational and functional aspects of the translation. The semi-functional translation has the advantage over the functional translation that the frame properties of many modal logics, including the ones listed above, can be specified by simple first-order Horn theories without equality. Consequently, the use of theory unification and theory resolution can be avoided. Furthermore, if the semi-functional translation is applied to goals and program clauses in the general modal Horn fragment, then the resulting first-order clauses are themselves Horn. Together with the fact that the frame properties are expressed by Horn clauses, this implies that unmodified SLD resolution can be used to execute the translated modal logic programs. The functional and semi-functional translation have been incorporated into MSPASS [120, 174]. Implementations of systems based on the direct approach include MOLOG [62, 63], MProlog [141, 143], and TIM [21]. However, just as for the direct resolution approaches described in Section 5.2, little work seems to have been conducted on developing specialised and efficient data structures and algorithms for such systems, with the exception of [2] which describes an abstract machine model for MOLOG, in analogue to the Warren Abstract Machine model for Prolog [191]. There has also been considerable work on temporal logic programming. For surveys on this work which also cover some of the approaches to modal logic programming mentioned above see [154, 70, 84]. There is currently renewed interest in modal and temporal logic programming in the context of multi-agent system development [24, 53, 69] and related areas.
Computational Modal Logic
7
237
REVIEW AND DISCUSSION
In this chapter we have examined computational approaches to modal logics. Although we have considered a variety of computational approaches and reasoning problems, we have focused on the use of translation-based and tableau-based algorithms for deciding the satisfiability of a formula, both with and without reference to a background theory. This focus was motivated by the dominance of translation-based and tableau-based approaches in implemented systems, and by the importance of satisfiability testing in applications such as the verification of multi-agent systems and ontology engineering. The reason for the dominance of these two approaches is that they have proved amenable to implementation and optimisation techniques that dramatically improve typical case performance; the use of such techniques is crucial if reasoning systems are to be effective in applications. The applicability and effectiveness of optimisation techniques and refinements is, however, highly dependent on the logic under consideration and on the class of problem being solved. For example, in the context of tableau-based algorithms, caching must be used with care in the presence of converse modalities, and semantic branching search, while highly effective for randomly generated problems, may be ineffective (and perhaps even counter productive) for problems derived from ontology engineering applications. Similarly, in the context of translation-based algorithms, hyperresolution may be the most suitable approach for randomly generated problems in the modal logic Kn , while ordered resolution is more effective for problems derived from ontology engineering applications. Regarding the two approaches, both have advantages and disadvantages. Tableau-based methods generally require full implementation, but this allows the implementor to choose and finetune the optimisations, data structures, and algorithms for effective operation in the intended application. In contrast, no major implementation effort is needed for translation-based methods, but a careful choice of translation, refinement of resolution, and operational parameters is required to guarantee termination and effectiveness of the first-order logic prover on the class of problems being solved. The choice of approach may ultimately depend on the logic in question: tableau-based methods seem to have some advantages in the presence of graded modalities (counting), for example, whereas translation-based methods can handle and may be better for boolean modal logics (role negation). Currently, tableau-based approaches are the most widely used in ontology applications, with description logic systems such as FaCT++, Racer and Pellet [159, 90, 160]. In contrast, translation-based methods have a number of other uses, for example, computing correspondence properties and modal logic programming. The use of implemented systems in realistic applications brings with it new challenges, both with respect to the expressive power of the logics being used, and the size and complexity of the problems to be solved. The W3C standard ontology language OWL, for example, corresponds to a logic with transitive, converse and graded modalities, as well as nominals, and ontology applications may call for reasoning with respect to very large background theories. For the logic corresponding to OWL, a tableau-based algorithm has only recently been introduced [110], a translation-based algorithm using the basic superposition calculus is still under development [112], and the development of computational and optimisation techniques is the subject of considerable ongoing research. Similarly, as mentioned in the introduction, agent frameworks consist of complex multi-modal logics, typically including a dynamic component, allowing the representation of dynamic activity via a temporal or a dynamic logic. Ongoing research is focusing on developing advanced computational methods and optimisation techniques for such frameworks.
238
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
BIBLIOGRAPHY [1] M. Abadi and Z. Manna. Modal theorem proving. In J. H. Siekmann, editor, Proceedings of the 8th International Conference on Automated Deduction (CADE-8), volume 230 of Lecture Notes in Computer Science, pages 172–189. Springer, 1986. [2] J.-M. Alliot, A. Herzig, and M. Lima Marques. Implementing Prolog extensions: a parallel inference machine. In Proceedings of the International Conference on Fifth Generation Computer Systems ’92, pages 833–842. IOS Press, 1992. [3] H. Andr´eka, I. N´emeti, and J. van Benthem. Modal languages and bounded fragments of predicate logic. Journal of Philosophical Logic, 27(3):217–274, 1998. [4] C. Areces. Logic Engineering. The Case of Description and Hybrid Logics. PhD thesis, ILLC, University of Amsterdam, 2000. [5] C. Areces, P. Blackburn, and M. Marx. A road-map on complexity for hybrid logics. In Annual Conference of the European Association for Computer Science Logic (CSL ’99), volume 1683 of Lecture Notes in Computer Science, pages 307–321. Springer, 1999. [6] C. Areces, H. De Nivelle, and M. de Rijke. Prefixed resolution: A resolution method for modal and description logics. In H. Ganzinger, editor, Proceedings of the 16th International Conference on Automated Deduction (CADE16), volume 1632 of Lecture Notes in Artificial Intelligence, pages 187–201. Springer, 1999. [7] C. Areces, M. de Rijke, and H. De Nivelle. Resolution in modal, description and hybrid logic. Journal of Logic and Computation, 11(5):717–736, 2001. [8] C. Areces, R. Gennari, J. Heguiabehere, and M. de Rijke. A simple ordering for deciding modal logic. Forthcoming. [9] C. Areces, R. Gennari, J. Heguiabehere, and M. de Rijke. Tree-based heuristic in modal theorem proving. In W. Horn, editor, Proceedings of the 14th European Conference on Artificial Intelligence (ECAI 2000), pages 199–203. IOS Press, 2000. [10] Y. Auffray, P. Enjalbert, and J.-J. Hebrard. Strategies for modal resolution: Results and problems. Journal of Automated Reasoning, 6:1–38, 1990. [11] F. Baader. Augmenting concept languages by transitive closure of roles: An alternative to terminological cycles. Technical Report RR-90-13, Deutsches Forschungszentrum f¨ur K¨unstliche Intelligenz (DFKI), Kaiserslautern, Germany, 1990. An abridged version appeared in Proceedings of IJCAI-91, pp. 446–451. [12] F. Baader, J. Hladik, C. Lutz, and F. Wolter. From tableaux to automata for description logics. Fundamenta Informaticae, 57(2-4):247–279, 2003. [13] F. Baader and S. Tobies. The inverse method implements the automata approach for modal satisfiability. In Proceedings of the International Joint Conference on Automated Reasoning (IJCAR-01), volume 2083 of Lecture Notes in Artificial Intelligence, pages 92–106. Springer, 2001. [14] L. Bachmair and H. Ganzinger. Rewrite-based equational theorem proving with selection and simplification. Journal of Logic and Computation, 4(3):217–247, 1994. [15] L. Bachmair and H. Ganzinger. Ordered chaining calculi for first-order theories of transitive relations. Journal of the ACM, 45(6):1007–1049, 1998. [16] L. Bachmair and H. Ganzinger. Resolution theorem proving. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume I, chapter 2, pages 19–99. Elsevier, 2001. [17] L. Bachmair, H. Ganzinger, C. Lynch, and W. Snyder. Basic paramodulation. Information and Computation, 121(2):172–192, 1995. [18] L. Bachmair, H. Ganzinger, and U. Waldmann. Superposition with simplification as a decision procedure for the monadic class with equality. In G. Gottlob, A. Leitsch, and D. Mundici, editors, Proceedings of the Third Kurt G¨odel Colloquium (KGC ’93), volume 713 of Lecture Notes in Computer Science, pages 83–96. Springer, 1993. [19] A. B. Baker. Intelligent Backtracking on Constraint Satisfaction Problems: Experimental and Theoretical Results. PhD thesis, University of Oregon, 1995. [20] P. Balbiani, L. Farinas del Cerro, and A. Herzig. Declarative semantics for modal logic programs. In Proceedings of the 1988 International Conference on Fifth Generation Computer Systems, pages 507–514. ICOT, 1988. [21] P. Balbiani, A. Herzig, and M. Lima Marques. TIM: The Toulouse Inference Machine for non-classical logic programming. In H. Boley and M. M. Richter, editors, Proceedings of the International Workshop on Processing Declarative Knowledge (PDK ’91), volume 567 of Lecture Notes in Artificial Intelligence, pages 366–382. Springer, 1991. [22] M. Baldoni. Normal Multimodal Logics: Automatic Deduction and Logic Programming Extension. PhD thesis, Dipartimento di Informatica, Universit degli Studi di Torino, Torino, Italy, April 1998. [23] M. Baldoni, L. Giordano, and A. Martelli. A framework for a modal logic programming. In M. J. Maher, editor, Joint International Conference and Symposium on Logic Programming, pages 52–66. MIT Press, 1996. [24] M. Baldoni, A. Martelli, V. Patti, and L. Giordano. Programming rational agents in a modal action logic. Annals of Mathematics and Artificial Intelligence, 41(2-4):207–257, 2004. [25] P. Balsiger, A. Heuerding, and S. Schwendimann. Logics Workbench 1.0. In H. de Swart, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX ’98), volume 1397 of Lecture Notes in Artificial Intelligence, pages 35–35. Springer, 1998.
Computational Modal Logic
239
[26] P. Baumgartner, J. D. Horton, and B. Spencer. Merge path improvements for minimal model hyper tableaux. In N. V. Murray, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX ’99), volume 1617 of Lecture Notes in Artificial Intelligence, pages 51–65. Springer, 1999. [27] P. Baumgartner and R. A. Schmidt. Improved bottom-up model generation. In U. Furbach and N. Shankar, editors, Proceedings of the Third International Joint Conference on Automated Reasoning (IJCAR 2006), Lecture Notes in Artificial Intelligence. Springer, 2006. To appear. [28] A. Bouajjani, J.-C. Fernandez, and N. Halbwachs. Minimal model generation. In E. M. Clarke and R. P. Kurshan, editors, Proceedings of the 2nd International Workshop on Computer Aided Verification (CAV ’90), volume 531 of Lecture Notes in Computer Science, pages 197–203. Springer, 1991. [29] T. Boy de la Tour. An optimality result for clause form translation. Journal of Symbolic Computation, 14:283–301, 1992. [30] T. Bra¨uner. A cut-free Gentzen formulation of the modal logic S5. Logic Journal of the IGPL, 8(5):629–643, 2000. [31] F. Bry and A. Yahya. Positive unit hyperresolution tableaux for minimal model generation. Journal of Automated Reasoning, 25(1):35–82, 2000. [32] Diego Calvanese, Giuseppe De Giacomo, Maurizio Lenzerini, Daniele Nardi, and Riccardo Rosati. Description logic framework for information integration. In A. G. Cohn, L. K. Schubert, and S. C. Shapiro, editors, Proceedings of the 6th International Conference on Principles of Knowledge Representation and Reasoning (KR ’98), pages 2–13. Morgan Kaufmann, 1998. [33] M. Cialdea. Resolution for some first order modal systems. Theoretical Computer Science, 85:213–229, 1991. [34] E. M. Clarke, O. Grumberg, and D. Peled. Model Checking. MIT Press, 1999. [35] E. M. Clarke and B.-H. Schlingloff. Model checking. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume II, chapter 24, pages 1635–1790. Elsevier, 2001. [36] W. Conradie, V. Goranko, and D. Vakarelov. Elementary canonical formulae: a survey on syntactic, algorithmic, and model-theoretic aspects. In R. A. Schmidt, I. Pratt-Hartmann, M. Reynolds, and H. Wansing, editors, Advances in Modal Logic, Volume 5, pages 17–51. King’s College Publications, London, 2005. [37] W. Conradie, V. Goranko, and D. Vakarelov. Algorithmic correspondence and completeness in modal logic. i. the core algorithm SQEMA. Logical Methods in Computer Science, 2(1:5):1–26, 2006. [38] S. A. Cook and R. A. Reckhow. The relative efficiency of propositional proof systems. Journal of Symbolic Logic, 44(1):36–50, 1979. [39] H. B. Curry. The elimination theorem when modality is present. Journal of Symbolic Logic, 17:249–265, 1952. [40] M. D’Agostino. Are tableaux an improvement on truth-tables? Journal of Logic, Language, and Information, 1:235–252, 1992. [41] M. Davis, G. Logemann, and D. Loveland. A machine program for theorem proving. Communications of the ACM, 5:394–397, 1962. [42] M. Davis and H. Putnam. A computing procedure for quantification theory. Journal of the ACM, 7:201–215, 1960. [43] G. De Giacomo. Eliminating ‘converse’ from converse PDL. Journal of Logic, Language and Information, 5(2):193– 208, 1996. [44] G. De Giacomo and M. Lenzerini. Boosting the correspondence between description logics and propositional dynamic logics (extended abstract). In Proceedings of the 12th National Conference on Artificial Intelligence (AAAI-94), pages 205–212. AAAI Press, 1994. [45] G. De Giacomo and F. Massacci. Combining deduction and model checking into tableaux and algorithms for converse-pdl. Information and Computation, 160(1–2):117–137, 2000. [46] H. De Nivelle. Ordering refinements of resolution. PhD thesis, Technische Universiteit Delft, The Netherlands, 1996. [47] H. De Nivelle. Splitting through new proposition symbols. In R. Nieuwenhuis and A. Voronkov, editors, Proceedings of the 8th International Conference on Logic for Programming, Artificial Intelligence, and Reasoning (LPAR 2001), volume 2250 of Lecture Notes in Artificial Intelligence, pages 172–185. Springer, 2001. [48] H. De Nivelle and M. de Rijke. Deciding the guarded fragment by resolution. Journal of Symbolic Computation, 35(1):21–58, 2003. [49] H. De Nivelle, R. A. Schmidt, and U. Hustadt. Resolution-based methods for modal logics. Logic Journal of the IGPL, 8(3):265–292, 2000. [50] F. Debart, P. Enjalbert, and M. Lescot. Multimodal logic programming using equational and order-sorted logic. Theoretical Computer Science, 105(1):141–166, 1992. [51] A. Degtyarev and A. Voronkov. The inverse method. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume I, chapter 21, pages 179–272. Elsevier Science, 2001. [52] N. Dershowitz and D. A. Plaisted. Rewriting. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume I, chapter 9, pages 533–607. Elsevier, 2001. [53] J. Dix, S. Kraus, and V. S. Subrahmanian. Temporal Agent Reasoning. Artificial Intelligence, 127(1):87–135, 2001. [54] C. Dixon, M. Fisher, and M. Wooldridge. Resolution for temporal logics of knowledge. Journal of Logic and Computaton, 8(3):345–372, 1998. [55] P. Doherty, W. Lukaszewics, and A. Szalas. Computing circumscription revisited: A reduction algorithm. Journal of Automated Reasoning, 18(3):297–336, 1997. [56] F. M. Donini and F. Massacci. Exptime tableaux for ALC. Artificial Intelligence, 124(1):87–138, 2000.
240
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
[57] A. Dovier, C. Piazza, and A. Policriti. An efficient algorithm for computing bisimulation equivalence. Theoretical Computer Science, 311(1-3):221–256, 2004. [58] T. Engel. Quantifier elimination in second-order predicate logic. Diplomarbeit, Fachbereich Informatik, Universit¨at des Saarlandes, Saarbr¨ucken, 1996. [59] P. Enjalbert and L. Fari˜nas del Cerro. Modal resolution in clausal form. Theoretical Computer Science, 65(1):1–33, 1989. [60] R. Fagin, J. Y. Halpern, Y. Moses, and M. Y. Vardi. Reasoning About Knowledge. MIT Press, 1996. [61] L. Fari˜nas del Cerro. A simple deduction method for modal logic. Information Processing Letters, 14(2):49–51, April 1982. [62] L. Fari˜nas del Cerro. MOLOG: A system that extends PROLOG with modal logic. New Generation Computing, 4:35–50, 1986. [63] L. Fari˜nas del Cerro and A. Herzig. MOLOG. http://www.irit.fr/ACTIVITES/EQ ALG/Herzig/ molog.html. [64] L. Fari˜nas del Cerro and A. Herzig. Modal deduction with applications in epistemic and temporal logics. In D. M. Gabbay, C. J. Hogger, and J. A. Robinson, editors, Handbook of Logic in Artificial Intelligence and Logic Programming: Epistemic and Temporal Reasoning, volume 4, pages 499–594. Clarendon Press, Oxford, 1995. [65] C. Ferm¨uller, A. Leitsch, U. Hustadt, and T. Tammet. Resolution decision procedures. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume II, chapter 25, pages 1791–1849. Elsevier, 2001. [66] J. Fernandez and L. Mounier. Verification bisimulations ‘on the fly’. In J. Quemada, J. A. Ma˜nas, and E. V´azquez, editors, In Proceedings of the Third International Conference on Formal Description Techniques (FORTE ’90), pages 95–110. North-Holland, 1990. [67] J.-C. Fernandez. An implementation of an efficient algorithm for bisimulation equivalence. Science of Computer Programming, 13(2–3):219–236, 1990. [68] M. J. Fischer and R. E. Ladner. Propositional dynamic logic of regular programs. Journal of Computer and System Science, 18:194–211, 1979. [69] M. Fisher, C. Ghidini, and B. Hirsch. Organising logic-based agents. In M. G. Hinchey, J. L. Rash, W.t Truszkowski, C. Rouff, and D. F. Gordon-Spears, editors, Revised Papers of the Second International Workshop on Formal Approaches to Agent-Based Systems (FAABS 2002), volume 2699 of Lecture Notes in Artificial Intelligence, pages 15–27. Springer, 2003. [70] M. Fisher and R. Owens. An introduction to executable modal and temporal logics. In Proceedings of the IJCAI-93 Workshop on Executable Modal and Temporal Logics, volume 897 of Lecture Notes in Artificial Intelligence, pages 1–20. Springer, 1995. [71] K. Fisler and M. Y. Vardi. Bisimulation and model checking. In L. Pierre and T. Kropf, editors, Proceedings of the 10th IFIP WG 10.5 Advanced Research Working Conference on Correct Hardware Design and Verification Methods (CHARME ’99), volume 1703 of Lecture Notes in Computer Science, pages 338–341. Springer, 1999. [72] M. Fitting. Destructive modal resolution. Journal of Logic and Computation, 1(1):83–97, 1990. [73] E. Franconi and G. Ng. The i.com tool for intelligent conceptual modelling. In Working Notes of the ECAI2000 Workshop on Knowledge Representation Meets Databases (KRDB2000), pages 45–53. CEUR, 2000. [74] J. W. Freeman. Improvements to Propositional Satisfiability Search Algorithms. PhD thesis, Department of Computer and Information Science, University of Pennsylvania, 1995. [75] D. M. Gabbay and H. J. Ohlbach. Quantifier elimination in second-order predicate logic. South African Computer Journal, 7:35–43, 1992. Also published in B. Nebel, C. Rich, W. R. Swartout, editors, Proceedings of the Third International Conference on Principles of Knowledge Representation and Reasoning (KR ’92), pages 425–436. Morgan Kaufmann, 1992. [76] H. Ganzinger and H. De Nivelle. A superposition decision procedure for the guarded fragment with equality. In Proceedings of the Fourteenth Annual IEEE Symposium on Logic in Computer Science (LICS ’99), pages 295–303. IEEE Computer Society Press, 1999. [77] H. Ganzinger, U. Hustadt, C. Meyer, and R. A. Schmidt. A resolution-based decision procedure for extensions of K4. In M. Zakharyaschev, K. Segerberg, M. de Rijke, and H. Wansing, editors, Advances in Modal Logic, Volume 2, volume 119 of Lecture Notes, chapter 9, pages 225–246. CSLI Publications, Stanford, 2001. [78] J. Gaschnig. Performance measurement and analysis of certain search algorithms. Technical report CMU-CS-79-124, Computer Science Department, Carnegie Mellon University, Pittsburgh, PA, USA, 1979. [79] C. Geissler and K. Konolige. A resolution method for quantified modal logics of knowledge and belief. In J. Y. Halpern, editor, Proceedings of the 1st Conference on Theoretical Aspects of Reasoning about Knowledge, pages 309–324. Morgan Kaufmann, 1986. [80] G. Gentzen. Untersuchungen u¨ ber das logische Schließen. Mathematische Zeitschrift, 39:176–210, 405–431, 1935. English translation in M. E. Szabo, editor, The Collected Papers of Gerhard Gentzen, pages 68–131, North-Holland, 1969. [81] L. Georgieva, U. Hustadt, and R. A. Schmidt. Computational space efficiency and minimal model generation for guarded formulae. In R. Nieuwenhuis and A. Voronkov, editors, Proceedings of the 8th International Conference on Logic for Programming, Artificial Intelligence, and Reasoning (LPAR 2001), volume 2250 of Lecture Notes in Artificial Intelligence, pages 85–99. Springer, 2001.
Computational Modal Logic
241
[82] L. Georgieva, U. Hustadt, and R. A. Schmidt. A new clausal class decidable by hyperresolution. In A. Voronkov, editor, Proceedings of the 18th International Conference on Automated Deduction (CADE-18), volume 2392 of Lecture Notes in Artificial Intelligence, pages 260–274. Springer, 2002. The long version is Preprint CSPP-18, University of Manchester, UK. [83] L. Georgieva, U. Hustadt, and R. A. Schmidt. Hyperresolution for guarded formulae. Journal of Symbolic Computation, 36(1–2):163–192, 2003. [84] M. Gergatsoulis. Temporal and modal logic programming languages. In A. Kent and J. G. Williams, editors, Encyclopedia of Microcomputers, chapter Volume 27, Supplement 6, pages 393–408. Marcel Dekker, 2001. [85] E. Giunchiglia, F. Giunchiglia, R. Sebastiani, and A. Tacchella. Sat vs. translation based decision procedures for modal logics: A comparative evaluation. Journal of Applied Non-Classical Logics, 10(2):145–172, 2000. [86] E. Giunchiglia and A. Tacchella. A subset-matching size-bounded cache for satisfiability in modal logics. In R. Dyckhoff, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX 2000), volume 1847 of Lecture Notes in Artificial Intelligence, pages 237–251. Springer, 2000. [87] F. Giunchiglia and R. Sebastiani. Building decision procedures for modal logics from propositional decision procedures - the case study of modal K. In M. McRobbie and J. K. Slaney, editors, Proceedings of the 13th Conference on Automated Deduction (CADE-13), volume 1104 of Lecture Notes in Artificial Intelligence, pages 583–597, New Brunswick, NJ, USA, 1996. Springer. [88] V. Goranko, U. Hustadt, R. Schmidt, and D. Vakarelov. SCAN is complete for all Sahlqvist formulae. In R. Berghammer, B. M¨oller, and G. Struth, editors, Revised Selected Papers of the 7th International Seminar on Relational Methods in Computer Science and the 2nd International Workshop on Kleene Algebra, volume 3051 of Lecture Notes in Computer Science, pages 149–162. Springer, 2004. [89] R. Gor´e. Tableau methods for modal and temporal logics. In M. D’Agostino, D. Gabbay, R. H¨ahnle, and J. Posegga, editors, Handbook of Tableau Methods, pages 297–396. Kluwer, 1999. [90] V. Haarslev and R. M¨oller. Consistency testing: The RACE experience. In R. Dyckhoff, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX 2000), volume 1847 of Lecture Notes in Artificial Intelligence, pages 1–18. Springer, 2000. [91] Volker Haarslev and Ralf M¨oller. High performance reasoning with very large knowledge bases: A practical case study. In Proceedings of the 17th International Joint Conference on Artificial Intelligence (IJCAI 2001), pages 161– 168. Morgan Kaufmann, 2001. [92] R. H¨ahnle. Tableaux and related methods. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, chapter 3, pages 101–178. Elsevier Science Publishers (North-Holland), Amsterdam, 2001. [93] J. Y. Halpern and Y. Moses. A guide to completeness and complexity for modal logic of knowledge and belief. Artificial Intelligence, 54:319–379, 1992. [94] R. Hasegawa, H. Fujita, and M. Koshimura. Efficient minimal model generation using branching lemmas. In D. McAllester, editor, Proceedings of the 17th International Conference on Automated Deduction (CADE-17), volume 1831 of Lecture Notes in Artificial Intelligence, pages 184–199. Springer, 2000. [95] A. Herzig. A new decidable fragment of first order logic, June 1990. In Abstracts of the 3rd Logical Biennial, Summer School & Conference in honour of S. C. Kleene, Varna, Bulgaria. [96] A. Heuerding. Sequent Calculi for Proof Search in Some Modal Logics. PhD thesis, Universit¨at Bern, Switzerland, 1996. [97] A. Heuerding, G. J¨ager, S. Schwendimann, and M. Seyfried. The Logics Workbench LWB: A snapshot. Euromath Bulletin, 2(1):177–186, 1996. [98] A. Heuerding, M. Seyfried, and H. Zimmermann. Efficient loop-check for backward proof search in some nonclassical propositional logics. In P. Miglioli, U. Moscato, D. Mundici, and M. Ornaghi, editors, Proceedings of the 5th International Workshop on Theorem Proving with Analytic Tableaux and Related Methods (TABLEAUX ’96), volume 1071 of Lecture Notes in Artificial Intelligence, pages 210–225. Springer, 1996. [99] J. Hladik. Implementation and optimisation of a tableau algorithm for the guarded fragment. In U. Egly and C. G. Ferm¨uller, editors, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX 2002), volume 2381 of Lecture Notes in Artificial Intelligence, pages 145–159. Springer, 2002. [100] J¨org Hoffmann and Jana Koehler. A new method to index and query sets. In Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI-99), pages 462–467. Morgan Kaufmann, 1999. [101] B. Hollunder and F. Baader. Qualifying number restrictions in concept languages. In Proceedings of the 2nd International Conference on the Principles of Knowledge Representation and Reasoning (KR ’91), pages 335–346. Morgan Kaufmann, 1991. [102] I. Horrocks. Optimising Tableaux Decision Procedures for Description Logics. PhD thesis, University of Manchester, 1997. [103] I. Horrocks. Implementation and optimisation techniques. In Franz Baader, Diego Calvanese, Deborah McGuinness, Daniele Nardi, and Peter F. Patel-Schneider, editors, The Description Logic Handbook: Theory, Implementation, and Applications, pages 306–346. Cambridge University Press, 2003. [104] I. Horrocks and P. F. Patel-Schneider. Optimizing description logic subsumption. Journal of Logic and Computation, 9(3):267–293, 1999.
242
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
[105] I. Horrocks and U. Sattler. A description logic with transitive and inverse roles and role hierarchies. Journal of Logic and Computation, 9(3), 1999. [106] I. Horrocks and U. Sattler. Ontology reasoning in the SHOQ(D) description logic. In B. Nebel, editor, Proceedings of the 17th International Joint Conference on Artificial Intelligence (IJCAI 2001), pages 199–204. Morgan Kaufmann, 2001. [107] I. Horrocks and U. Sattler. Optimised reasoning for SHIQ. In F. van Harmelen, editor, Proceedings of the 15th European Conference on Artificial Intelligence (ECAI 2002), pages 277–281. IOS Press, July 2002. [108] I. Horrocks, U. Sattler, and S. Tobies. Practical reasoning for expressive description logics. In H. Ganzinger, D. McAllester, and A. Voronkov, editors, Proceedings of the 6th Int. Conf. on Logic for Programming and Automated Reasoning (LPAR ’99), volume 1705 of Lecture Notes in Artificial Intelligence, pages 161–180. Springer, 1999. [109] I. Horrocks and S. Tobies. Reasoning with axioms: Theory and practice. In A. G. Cohn, F. Giunchiglia, and B. Selman, editors, Proceedings of the 7th International Conference on the Principles of Knowledge Representation and Reasoning (KR 2000), pages 285–296. Morgan Kaufmann, 2000. [110] Ian Horrocks and Ulrike Sattler. A tableaux decision procedure for SHOIQ. In Proceedings of the 19th International Joint Conference on Artificial Intelligence (IJCAI 2005), pages 448–453, 2005. [111] U. Hustadt. Resolution-Based Decision Procedures for Subclasses of First-Order Logic. PhD thesis, Univ. d. Saarlandes, Saarbr¨ucken, Germany, 1999. [112] U. Hustadt, B. Motik, and U. Sattler. Reducing SHIQ− description logic to disjunctive datalog programs. In D. Dubois, C. Welty, and M.-A. Williams, editors, Proceedings of the 9th International Conference on Knowledge Representation and Reasoning (KR 2004), pages 152–162. AAAI Press, 2004. [113] U. Hustadt, B. Motik, and U. Sattler. A decomposition rule for decision procedures by resolution-based calculi. In F. Baader and A. Voronkov, editors, Proceedings of the 11th International Conference on Logic for Programming, Artificial Intelligence (LPAR 2004), volume 3452 of Lecture Notes in Artificial Intelligence, pages 21–35. Springer, 2005. [114] U. Hustadt and R. A. Schmidt. On evaluating decision procedures for modal logic. In M. E. Pollack, editor, Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI-97), pages 202–207. Morgan Kaufmann, 1997. [115] U. Hustadt and R. A. Schmidt. Simplification and backjumping in modal tableau. In H. de Swart, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX ’98), volume 1397 of Lecture Notes in Artificial Intelligence, pages 187–201. Springer, 1998. [116] U. Hustadt and R. A. Schmidt. An empirical analysis of modal theorem provers. Journal of Applied Non-Classical Logics, 9(4):479–522, 1999. [117] U. Hustadt and R. A. Schmidt. Maslov’s class K revisited. In H. Ganzinger, editor, Proceedings of the 16th International Conference on Automated Deduction (CADE-16), volume 1632 of Lecture Notes in Artificial Intelligence, pages 172–186. Springer, 1999. [118] U. Hustadt and R. A. Schmidt. On the relation of resolution and tableaux proof systems for description logics. In T. Dean, editor, Proceedings of the 16th International Joint Conference on Artificial Intelligence (IJCAI-99), pages 110–115. Morgan Kaufmann, 1999. [119] U. Hustadt and R. A. Schmidt. Issues of decidability for description logics in the framework of resolution. In R. Caferra and G. Salzer, editors, Automated Deduction in Classical and Non-Classical Logics, volume 1761 of Lecture Notes in Artificial Intelligence, pages 191–205. Springer, 2000. [120] U. Hustadt and R. A. Schmidt. MSPASS: Modal reasoning by translation and first-order resolution. In R. Dyckhoff, editor, Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX 2000), volume 1847 of Lecture Notes in Artificial Intelligence, pages 67–71. Springer, 2000. [121] U. Hustadt and R. A. Schmidt. Using resolution for testing modal satisfiability and building models. Journal of Automated Reasoning, 28(2):205–232, 2002. [122] U. Hustadt, R. A. Schmidt, and L. Georgieva. A survey of decidable first-order fragments and description logics. Journal of Relational Methods in Computer Science, 1:251–276, 2004. [123] W. H. Joyner Jr. Resolution strategies as decision procedures. Journal of the ACM, 23(3):398–417, 1976. [124] Y. Kazakov and H. De Nivelle. A resolution decision procedure for the guarded fragment with transitive guards. In D. A. Basin and M. Rusinowitch, editors, Proceedings of the Second International Joint Conference on Automated Reasoning (IJCAR 2004), volume 3097 of Lecture Notes in Artificial Intelligence, pages 122–136. Springer, 2004. [125] Holger Knublauch, Ray Fergerson, Natalya Noy, and Mark Musen. The prot´eg´e OWL plugin: An open development environment for semantic web applications. In Sheila A. McIlraith, Dimitris Plexousakis, and Frank van Harmelen, editors, Proceedings of the 2004 International Semantic Web Conference (ISWC 2004), volume 3298 of Lecture Notes in Computer Science, pages 229–243. Springer, 2004. [126] K. Konolige. Resolution and quantified epistemic logics. In J. H. Siekmann, editor, Proceedings of the 8th International Conference on Automated Deduction (CADE-8), volume 230 of Lecture Notes in Computer Science, pages 199–208. Springer, 1986. [127] M. Kracht. Tools and Techniques in Modal Logic, volume 142 of Studies in Logic and the Foundations of Mathematics. Elsevier, 1999.
Computational Modal Logic
243
[128] O. Kupferman and M.Y. Vardi. Weak alternating automata and tree automata emptiness. In Proceedings of the 30th ACM SIGACT Symposium on Theory of Computing (STOC-98), pages 224–233. ACM Press, 1998. [129] R. E. Ladner. The computational complexity of provability in systems of modal propositional logic. SIAM Journal of Computing, 6(3):467–480, 1977. [130] D. Lee and M. Yannakakis. Online minimization of transition systems (extended abstract). In Proceedings of the 24th Annual ACM symposium on Theory of Computing, pages 264–274. ACM Press, 1992. [131] Thorsten Liebig and Olaf Noppens. Ontotrack: Combining browsing and editing with reasoning and explaining for OWL Lite ontologies. In Sheila A. McIlraith, Dimitris Plexousakis, and Frank van Harmelen, editors, Proceedings of the 2004 International Semantic Web Conference (ISWC 2004), volume 3298 of Lecture Notes in Computer Science, pages 244–258. Springer, 2004. [132] C. Lutz. Complexity of terminological reasoning revisited. In H. Ganzinger, D. A. McAllester, and A. Voronkov, editors, Proceedings of the 6th Int. Conf. on Logic for Programming and Automated Reasoning (LPAR ’99), volume 1705 of Lecture Notes in Artificial Intelligence, pages 181–200. Springer, 1999. [133] C. Lutz. NExpTime-complete description logics with concrete domains. In R. Gor´e, A. Leitsch, and T. Nipkow, editors, Proceedings of the International Joint Conference on Automated Reasoning (IJCAR-01), volume 2083 of Lecture Notes in Artificial Intelligence, pages 45–60. Springer, 2001. [134] C. Lutz, U. Sattler, and S. Tobies. A suggestion of an n-ary description logic. In P. Lambrix, A. Borgida, M. Lenzerini, R. M¨oller, and P. Patel-Schneider, editors, Proceedings of the 1999 International Workshop on Description Logics (DL ’99), pages 81–85. Link¨oping University, 1999. [135] S. Ju. Maslov. The inverse method for establishing deducibility for logical calculi. In V. P. Orevkov, editor, The Calculi of Symbolic Logic I: Proc. of the Steklov Institute of Mathematics edited by I. G. Petrovskiˇı and S. M. Nikol’skiˇı, Nr. 98 (1968), pages 25–96. Amer. Math. Soc., Providence, Rhode Island, 1971. [136] W. McCune and O. Shumsky. Ivy: A preprocessor and proof checker for first-order logic. In M. Kaufmann, P. Manolios, and J. Moore, editors, Computer-Aided Reasoning: ACL2 Case Studies, pages 265–282. Kluwer, 2000. [137] Deborah L. McGuinness and Jon R. Wright. An industrial strength description logic-based configuration platform. IEEE Intelligent Systems, pages 69–77, 1998. [138] P. Mika, D. Oberle, A. Gangemi, and M. Sabou. Foundations for service ontologies: Aligning OWL-S to dolce. In S.I. Feldman, M. Uretsky, M. Najork, and C.E. Wills, editors, Proceedings of the Thirteenth International World Wide Web Conference (WWW 2004), pages 563–572. ACM Press, 2004. [139] G. Mints. Gentzen-type systems and resolution rules. Part I: Propositional lo gic. In Proceedings of COLOG-88, volume 417 of Lecture Notes in Computer Science, pages 198–231. Springer, 1990. [140] G. Mints, V. Orevkov, and T. Tammet. Transfer of sequent calculus strategies to resolution for S4. In H. Wansing, editor, Proof Theory of Modal Logic, volume 2 of Applied Logic Series, pages 17–31. Kluwer, 1996. [141] L. Nguyen. MProlog. http://www.mimuw.edu.pl/∼nguyen/mprolog/. [142] L. Nguyen. A fixpoint semantics and an sld-resolution calculus for modal logic programs. Fundamenta Informaticae, 55(1):63–100, 2003. [143] L. A. Nguyen. The modal logic programming system MProlog. In J. J. Alferes and J. A. Leite, editors, Proceedings of the 9th European Conference on Logics in Artificial Intelligence (JELIA 2004), volume 3229 of Lecture Notes in Artificial Intelligence, pages 266–278. Springer, 2004. [144] I. Niemel¨a. A tableau calculus for minimal model reasoning. In Proceedings of the 5th International Workshop on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX ’96), volume 1071 of Lecture Notes in Artificial Intelligence, pages 278–294. Springer, 1996. [145] A. Nonnengart. First-order modal logic theorem proving and functional simulation. In R. Bajcsy, editor, Proceedings of the 13th International Joint Conference on Artificial Intelligence (IJCAI-93), pages 80–85. Morgan Kaufmann, 1993. [146] A. Nonnengart. How to use modalities and sorts in prolog. In C. MacNish, D. Pearce, and L. M. Pereira, editors, Proceedings of the European Workshop on Logics in Artificial Intelligence (JELIA ’94), volume 838 of Lecture Notes in Artificial Intelligence, pages 365–378. Springer, 1994. [147] A. Nonnengart, H. J. Ohlbach, and A. Szalas. Quantifier elimination for second-order predicate logic. To appear in Logic, Language and Reasoning: Essays in honour of Dov Gabbay, Part I, Kluwer. [148] H. J. Ohlbach, A. Nonnengart, M. de Rijke, and D. Gabbay. Encoding two-valued nonclassical logics in classical logic. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume II, chapter 21, pages 1403–1486. Elsevier Science, 2001. [149] H. J. Ohlbach and R. A. Schmidt. Functional translation and second-order frame properties of modal logics. Journal of Logic and Computation, 7(5):581–603, 1997. [150] H. J. Ohlbach, R. A. Schmidt, and U. Hustadt. Translating graded modalities into predicate logic. In H. Wansing, editor, Proof Theory of Modal Logic, volume 2 of Applied Logic Series, pages 253–291. Kluwer, 1996. [151] M. Ohnishi and K. Matsumoto. Gentzen method in modal calculi. Osaka Mathematical Journal, 9:113–130, 1957. [152] M. Ohnishi and K. Matsumoto. Gentzen method in modal calculi II. Osaka Mathematical Journal, 11:115–120, 1959. [153] F. Oppacher and E. Suen. HARP: A tableau-based theorem prover. Journal of Automated Reasoning, 4:69–100, 1988.
244
Ian Horrocks, Ullrich Hustadt, Ulrike Sattler, and Renate Schmidt
[154] M. A. Orgun and W. Ma. An overview of temporal and modal logic programming. In D. M. Gabbay and H. J. Ohlbach, editors, Proceedings of the First International Conference on Temporal Logic (ICTL ’94), volume 827 of Lecture Notes in Artificial Intelligence, pages 445–479. Springer, 1994. [155] S. Owre, S. Rajan, J. M. Rushby, N. Shankar, and M. K. Srivas. PVS: Combining specification, proof checking, and model checking. In R. Alur and T. A. Henzinger, editors, Proceedings of the 8th International Conference on Computer-Aided Verification (CAV ’96), volume 1102 of Lecture Notes in Computer Science, pages 411–414. Springer, 1996. [156] R. Paige and R. Tarjan. Three partition refinement algorithms. SIAM Journal on Computing, 16(6):973–989, 1987. [157] R. Paige, R. E. Tarjan, and R. Bonic. A linear time solution to the single function coarsest partition problem. Theoretical Computer Science, 40:67–84, 1985. [158] G. Pan and M. Y. Vardi. Optimizing a BDD-based modal solver. In F. Baader, editor, Proceedings of the 19th International Conference on Automated Deduction (CADE-19), volume 2741 of Lecture Notes in Artificial Intelligence, pages 75–89. Springer, 2003. [159] P. F. Patel-Schneider and I. Horrocks. DLP and FaCT. In Proceedings of the International Conference on Automated Reasoning with Analytic Tableaux and Related Methods (TABLEAUX ’99), volume 1397 of Lecture Notes in Artificial Intelligence, pages 19–23. Springer, 1999. [160] Pellet OWL reasoner. Maryland Information and Network Dynamics Lab, 2003. [161] D. A. Plaisted and S. Greenbaum. A structure-preserving clause form translation. Journal of Symbolic Computation, 2:293–304, 1986. [162] V. R. Pratt. Models of program logics. In Proceedings of the 20th Annual Symposium on Foundations of Computer Science, 1979. [163] A. Prior. Past, Present and Future. Oxford University Press, 1967. [164] P. Prosser. Hybrid algorithms for the constraint satisfaction problem. Computational Intelligence, 9(3):268–299, 1993. [165] W. V. Quine. Variables explained away. In Proceedings of the American Philosophy Society, volume 104, pages 343–347, 1960. [166] W. V. Quine. Algebraic logic and predicate functors. In R. Rudner and I. Scheffler, editors, Logic and Art: Esssays in Honor of Nelson Goodman. Bobbs-Merrill, 1971. [167] A. L. Rector, W. A. Nowlan, and A. Glowinski. Goals for concept representation in the GALEN project. In Proceedings of the 17th Annual Symposium on Computer Applications in Medical Care (SCAMC ’93), pages 414–418, 1993. [168] A. Riazanov and A. Voronkov. Splitting without backtracking. In B. Nebel, editor, Proceedings of the 17th International Joint Conference on Artificial Intelligence (IJCAI 2001), pages 611–617. Morgan Kaufmann, 2001. [169] A. Riazanov and A. Voronkov. The design and implementation of Vampire. AI Communications, 15(2–3):91–110, 2002. [170] J. A. Robinson. A machine-oriented logic based on the resolution principle. Journal of the ACM, 12:23–41, 1965. [171] U. Sattler. Description logics for the representation of aggregated objects. In W. Horn, editor, Proceedings of the 14th European Conference on Artificial Intelligence (ECAI 2000), pages 239–243. IOS Press, 2000. [172] W. J. Savitch. Relationsship between nondeterministic and deterministic tape complexities. Journal of Computer and System Science, 4:177–192, 1970. [173] K. Schild. A correspondence theory for terminological logics: Preliminary report. In Proceedings of the 12th International Joint Conference on Artificial Intelligence (IJCAI-91), pages 466–471. Morgan Kaufmann, 1991. [174] R. A. Schmidt. MSPASS. http://www.cs.man.ac.uk/∼schmidt/mspass. [175] R. A. Schmidt. Optimised Modal Translation and Resolution. PhD thesis, Universit¨at des Saarlandes, Saarbr¨ucken, Germany, 1997. [176] R. A. Schmidt. E-unification for subsystems of S4. In T. Nipkow, editor, Proceedings of the 9th International Conference on Rewriting Techniques and Applications (RTA ’98), volume 1379 of Lecture Notes in Computer Science, pages 106–120. Springer, 1998. [177] R. A. Schmidt. Decidability by resolution for propositional modal logics. Journal of Automated Reasoning, 22(4):379–396, 1999. [178] R. A. Schmidt. Decidability by resolution for propositional modal logics. Journal of Automated Reasoning, 22(4):379–396, 1999. [179] R. A. Schmidt and U. Hustadt. A resolution decision procedure for fluted logic. In D. McAllester, editor, Proceedings of the 17th International Conference on Automated Deduction (CADE-17), volume 1831 of Lecture Notes in Artificial Intelligence, pages 433–448. Springer, 2000. [180] R. A. Schmidt and U. Hustadt. Mechanised reasoning and model generation for extended modal logics. In H. C. M. de Swart, E. Orlowska, G. Schmidt, and M. Roubens, editors, Theory and Applications of Relational Structures as Knowledge Instruments, volume 2929 of Lecture Notes in Computer Science, pages 38–67. Springer, 2003. [181] R. A. Schmidt and U. Hustadt. A principle for incorporating axioms into the first-order translation of modal formulae. In F. Baader, editor, Proceedings of the 19th International Conference on Automated Deduction (CADE-19), volume 2741 of Lecture Notes in Artificial Intelligence, pages 412–426. Springer, 2003. The long version is Preprint CSPP22, University of Manchester, UK.
Computational Modal Logic
245
[182] R. A. Schmidt and U. Hustadt. First-order resolution methods for modal logics. In A. Podelski, A. Voronkov, and R. Wilhelm, editors, Volume in memoriam of Harald Ganzinger, Lecture Notes in Computer Science. Springer, 2006. To appear. [183] S. Schulz. E: A Brainiac theorem prover. Journal of AI Communications, 15(2/3):111–126, 2002. [184] E. Spaan. Complexity of Modal Logics. PhD thesis, University of Amsterdam, 1993. [185] A. Szalas. On the correspondence between modal and classical logic: An automated approach. Journal of Logic and Computation, 3(6):605–620, 1993. [186] S. Tobies. Complexity Results and Practical Algorithms for Logics in Knowledge Representation. PhD thesis, RWTH Aachen, 2001. [187] J. van Benthem. Temporal logic. In D. Gabbay, C. Hogger, and J. Robinson, editors, Handbook of Logic in Artificial Intelligence and Logic Programming, Volume 4, pages 241–350. Oxford Scientific Publishers, 1996. [188] M. Y. Vardi. Reasoning about the past with two-way automata. In Proceedings of the 25th Int. Colloq. on Automata, Languages, and Programming, volume 1443 of Lecture Notes in Computer Science, pages 628–641. Springer, 1998. [189] U. Visser, H. Stuckenschmidt, G. Schuster, and T. V¨ogele. Ontologies for geographic information processing. Computers & Geosciences, 28(1):103–117, 2002. [190] A. Voronkov. Theorem proving in non-standard logics based on the inverse method. In Proceedings of the 11th Conference on Automated Deduction (CADE-11), volume 607 of Lecture Notes in Artificial Intelligence, pages 648– 662. Springer, 1992. [191] D. H. D. Warren. An abstract prolog instruction set. Technical Note 309, SRI International, Menlo Park, CA, USA, 1983. [192] C. Weidenbach. S PASS. http://spass.mpi-sb.mpg.de. [193] C. Weidenbach. Combining superposition, sorts and splitting. In A. Robinson and A. Voronkov, editors, Handbook of Automated Reasoning, volume II, chapter 27, pages 1965–2013. Elsevier, 2001. [194] C. Weidenbach et al. System description: S PASS version 1.0.0. In H. Ganzinger, editor, Proceedings of the 16th International Conference on Automated Deduction (CADE-16), volume 1632 of Lecture Notes in Artificial Intelligence, pages 378–382. Springer, 1999. [195] W. Wong. Validation of HOL proofs by proof checking. Formal Methods in System Design, 14(2):193–212, 1999. [196] M. Wooldridge. Reasoning about rational agents. MIT Press, 2000. [197] C. Wroe, C. A. Goble, A. Roberts, and M. Greenwood. A suite of DAML+OIL ontologies to describe bioinformatics web services and data. International Journal of Cooperative Information Systems, 12(2):597–624, 2003.
Handbook of Modal Logic – P. Blackburn et al. (Editors) © 2007 Elsevier B.V. All rights reserved.
5
MODEL THEORY OF MODAL LOGIC Valentin Goranko and Martin Otto
1
2
3
4
5
6
7
8
Semantics of modal logic . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1 Modal languages . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Kripke frames and structures . . . . . . . . . . . . . . . . . . . . . 1.3 The standard translations into first- and second-order logic . . . . 1.4 Theories, equivalence and definability . . . . . . . . . . . . . . . . 1.5 Polyadic modalities . . . . . . . . . . . . . . . . . . . . . . . . . . Bisimulation and basic model constructions . . . . . . . . . . . . . . . . 2.1 Bisimulation and invariance . . . . . . . . . . . . . . . . . . . . . 2.2 Classical truth-preserving constructions . . . . . . . . . . . . . . . 2.3 Proving non-definability . . . . . . . . . . . . . . . . . . . . . . . Bisimulation: a closer look . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Bisimulation games . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Finite bisimulations and characteristic formulae . . . . . . . . . . 3.3 Finite model property . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Finite versus full bisimulation . . . . . . . . . . . . . . . . . . . . 3.5 Largest bisimulations as greatest fixed points . . . . . . . . . . . . 3.6 Bisimulation quotients and canonical representatives . . . . . . . 3.7 Robinson consistency, local interpolation, and Beth definability . 3.8 Bisimulation-safe modal operators . . . . . . . . . . . . . . . . . . Modal logic as a fragment of first-order logic . . . . . . . . . . . . . . . 4.1 Finite variable fragments of first-order logic . . . . . . . . . . . . 4.2 The van Benthem–Rosen characterisation theorem . . . . . . . . . 4.3 Guarded fragments of first-order logic . . . . . . . . . . . . . . . . Variations, extensions, and comparisons of modal logics . . . . . . . . . 5.1 Variations through refined notions of bisimulation . . . . . . . . . 5.2 Extensions beyond first-order . . . . . . . . . . . . . . . . . . . . 5.3 Model theoretic criteria . . . . . . . . . . . . . . . . . . . . . . . . Further model-theoretic constructions . . . . . . . . . . . . . . . . . . . 6.1 Ultrafilter extensions . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Ultraproducts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Modal saturation and bisimulations . . . . . . . . . . . . . . . . . 6.4 Modal definability of properties of Kripke structures . . . . . . . . General frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1 General frames as semantic structures in modal logic . . . . . . . 7.2 Constructions and truth preservation results on general frames . . 7.3 Special types of general frames and persistence of modal formulae Modal logic on frames . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1 Modal definability of frame properties . . . . . . . . . . . . . . . . 8.2 Modal logic versus first-order logic on frames . . . . . . . . . . . . 8.3 Modal logic and first-order logic with least fixed points . . . . . . 8.4 Modal logic and second-order logic . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
252 252 252 253 254 256 256 257 258 262 263 263 264 266 270 273 274 276 278 278 278 281 285 288 289 290 295 296 296 298 299 301 302 303 304 306 310 310 311 316 317
250
9
Valentin Goranko and Martin Otto
Finite model theory of modal logics . . . . . . 9.1 Finite versus classical model theory . . 9.2 Capturing bisimulation invariant Ptime 9.3 0-1 laws in modal logic . . . . . . . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
. . . .
318 318 320 321
INTRODUCTION Model theory is about semantics; it studies the interplay between a logical language (logic) and the models (structures) for that language. Key issues therefore are expressiveness and definability. At the basic level these concern the questions which structural properties are expressible and which classes of structures are definable in the logic. These basic questions immediately lead to the study of model constructions; to the analysis of models and of model classes for given formulae or theories; to notions of equivalence between structures with respect to the truth of formulae; and to the study of preservation phenomena. Modal logics1 come as members of a loosely knit family and have various links to other logics – classical first- and second-order logic as well as, for instance, temporal and process logics stemming from particular applications. Correspondingly, the key issues mentioned above may also be studied comparatively, both within the family and in relation to other relevant logics. Such a comparative view can support an understanding of the internal coherence of the rich family of modal logics. It also offers a perspective to place modal logics in the wider logical and model theoretic context. In regard to the coherence of the family of modal logics, it is important to understand in model theoretic terms what it is that makes a logic ‘modal’. For that aim we devote a major part of this chapter to the discussion of bisimulation. Many other features of the ‘modal character’ can be understood in terms of bisimulation invariance; this is true most notably of the local and restricted nature of quantification. Due to these features modal logic enjoys very specific features, and in many respects its model theory can be developed along lines that have no direct counterparts in classical model theory. In regard to the wider logical context, there is a rich body of classical work in modal model theory that measures modal logic against the backdrop of classical first- and second-order logic into which it can be naturally embedded. But, beside this ‘classical picture’, there are also many links with other logics, partly designed for other purposes or studied with a different perspective from that of classical model theory. In the classical picture, both first- and second-order logic have their role to play. This is because modal logic actually offers several distinct semantic levels, as will be reviewed in the following section which provides an introduction to the model theoretic semantics of modal logic. So, a modal formula is traditionally viewed in four different ways, subject to two orthogonal dichotomies – Kripke structures (also called Kripke models) versus Kripke frames and local versus global. The fundamental semantic notion in basic modal logic is truth of a formula at a state in a Kripke structure; this notion is local and of a first-order nature. Semantics in Kripke frames is obtained, if instead one looks at all possible propositional valuations 1 In this chapter we use the term modal logic (despite the established tradition in the literature on modal logic) in a typical model-theoretic sense, as a (propositional) modal language equipped with suitable relational (Kripke) semantics, rather than proof systems over such languages, determined by a set of axioms and inference rules, such as K, S4, etc. We refer to the latter as ‘axiomatic extensions’.
Model Theory of Modal Logic
251
over the given frame (in effect an abstraction through implicit universal second-order quantification over all valuations); this semantics, accordingly, is of essentially secondorder nature. On the other hand, the passage from local to global semantics is achieved if one looks at truth in all states (an abstraction through implicit universal first-order quantification over all states). While all these semantic levels are ultimately based on the local semantics in Kripke structures, the two independent directions of generalisation, and in particular the divide between the (first-order) Kripke structure semantics and the (second-order) frame semantics, give rise to very distinct model theoretic flavours, each with their own tradition in the model theory of modal logic. Still, these two semantics meet through the notion of a general frame (closely related to a modal algebra). History. The origins of model theory of modal logic go back to the fundamental papers of J´ onsson and Tarski [78, 79], and Kripke [86, 87] laying the foundations of the relational (Kripke) semantics, followed by the classical work of Lemmon and Scott [91]. Some of the most influential themes and directions of the classical development of the model theory of modal logic in the 1970/80s have been: the completeness theory of modal axiomatic systems with respect to the frame-based semantics of modal logic, and the closely related correspondence theory between that semantics and first-order logic [117, 28, 123, 124, 113, 42, 51, 125, 127, 128]; and the duality theory between Kripke frames and modal algebras, via general frames [42, 43, 44, 45, 114]. Also at that time, the theory of bisimulations and bisimulation invariance emerged in the semantic analysis of modal languages in [125, 128]. For detailed historical and bibliographical notes see [5], and the survey [49] for a recent and comprehensive historical account of the development of modal logic, and in particular its model theory. Overview. The sections of this chapter are roughly arranged in three parts or main tracks, reflecting the semantic distinctions outlined above. The first part provides a common basic introduction to some of the key notions, in particular the different levels of semantics in section 1, followed by the concept of bisimulation and bisimulation respecting model constructions in section 2. This more general thread is taken up again in section 6 with some more advanced model constructions, and also in the final section 9 devoted to some ideas in the finite model theory of modal logic. A second track, comprising sections 3 to 5, is primarily devoted to modal logic as a logic of Kripke structures (first-order semantics): section 3 continues the bisimulation theme; section 4 is specifically devoted to the role of modal logic as a fragment of first-order logic; section 5 illustrates some of the richness of modal logics over Kripke structures in terms of variations and extensions. The third track is devoted to a study of modal logic as a logic of frames (the secondorder semantics). This comprises more advanced constructions such as ultrafilter extensions and ultraproducts in section 6, basic model theory of general frames in section 7, and a survey of classical results on frame definability and relations with second-order logic in section 8. Most of the other chapters in this handbook supplement this chapter with important model-theoretic topics and results. In particular, we refer the reader to Chapters 1, 3, 6, 7 and 8.
252
Valentin Goranko and Martin Otto
1
SEMANTICS OF MODAL LOGIC
1.1 Modal languages A (unary, poly-)modal similarity type is a set τ of modalities α ∈ τ . Beside τ , we fix a (countable) set Φ of propositional variables or atomic propositions. With τ and Φ we associate the modal language ML(τ, Φ), in which every α ∈ τ labels a modal diamond operator α . The formulae of ML(τ, Φ) are recursively defined as follows: ϕ := ⊥ | p | (ϕ1 → ϕ2 ) | α ϕ, where p ∈ Φ and α ∈ τ , and unnecessary outer parentheses are dropped. The logical constant and connectives ¬, ∧, ∨, ↔ may be introduced on an equal footing or are regarded as standard abbreviations. The operator [α], defined by [α] ϕ := ¬ α ¬ϕ, is the box operator dual to α . A formula not containing atomic propositions is called a constant formula. To keep the notation simple, we regard the set Φ as fixed, and will usually not mention it explicitly. So we write ML(τ ), or also just ML when τ is clear from the context or irrelevant. We use the same notation for the set of all formulae of ML(τ, Φ), and in general identify notationally logical languages with their sets of formulae. In the monomodal case of a modal similarity type consisting of a single unary modality, the only diamond and box are denoted by just 3 and , respectively. DEFINITION 1. The nesting depth δ of a formula is defined recursively as follows: δ(⊥) = δ(p) = 0; δ(ϕ1 → ϕ2 ) = max(δ(ϕ1 ), δ(ϕ2 )); δ( α ϕ) = δ(ϕ) + 1. The fragment MLn (τ ) comprises all formulae of ML(τ ) with nesting depth ≤ n.
1.2 Kripke frames and structures With the modal similarity type τ we associate a relational similarity type consisting of binary relations Rα for α ∈ τ . For simplicity we also denote this derived relational type by τ . DEFINITION 2. A (Kripke) τ -frame is a relational τ -structure F = W, {Rα }α∈τ where W = ∅ and Rα ⊆ W × W for each α ∈ τ . The domain W of F is denoted by dom(F). The relations (Rα )α∈τ are the accessibility or transition relations in F. The elements of W , traditionally called possible worlds, will also be referred to, depending on the context, as states, points, or nodes. A pointed τ -frame is a pair (F, w) where w ∈ dom(F). We also write wRα u rather than Rα wu or (w, u) ∈ Rα . Given a τ -frame F =
W, {Rα }α∈τ , every Rα defines two unary operators, Rα and its dual [Rα ], on P(W ) as follows:
Rα (X) := {w ∈ W | wRα u for some u ∈ X}
and
where X := W \ X denotes the complement of X in W .
[Rα ](X) := Rα (X)
Model Theory of Modal Logic
253
DEFINITION 3. A Kripke structure (Kripke model ) over a τ -frame F = W, {Rα }α∈τ is a pair M = F, V where V : Φ → P(W ) is a valuation, assigning to every atomic proposition p the set of states in W where p is declared true. The set W is the domain of M, denoted dom(M). We often specify Kripke structures directly: M = W, {Rα }α∈τ , V . A pointed Kripke structure is a pair (M, w) where w ∈ dom(M). In any Kripke structure M = F, V the valuation V can be extended to a valuation of all formulae, which is again denoted by V . That extension is defined recursively as follows:2 V (⊥) := ∅; V (ϕ1 → ϕ2 ) := V (ϕ1 ) ∪ V (ϕ2 ); V ( α ϕ) := Rα (V (ϕ)) (and V ([α] ϕ) = [Rα ] (V (ϕ)). While first-order sentences express properties of a structure as a whole, modal formulae always make implicit reference to a distinguished (current) state in a Kripke structure. So the basic semantic notion in modal logic is truth of a formula at a state of a Kripke structure, with derived notions of validity also in Kripke structures and frames. DEFINITION 4. A τ -formula ϕ is: (i) true at the state w of the τ -structure M = F, V , denoted M, w |= ϕ, if w ∈ V (ϕ). This is the same as saying that ϕ is true in the pointed structure (M, w). A formula that is true at a state of some τ -structure is satisfiable. (ii) valid in M, denoted M |= ϕ, if M, w |= ϕ for every w ∈ dom(F), i.e., if V (ϕ) = dom(F). (iii) (locally) valid at the state w of F, denoted F, w |= ϕ, if M, w |= ϕ for every τ -structure M over F. This is the same as saying that ϕ is valid in the pointed frame (F, w). (iv) valid in F, denoted F |= ϕ, if F, w |= ϕ for every w ∈ dom(F). Equivalently: M |= ϕ for every τ -structure M over F. (v) valid, denoted |= ϕ, if F |= ϕ for every τ -frame F.
1.3
The standard translations into first- and second-order logic
With the modal language ML(τ, Φ), we associate the following purely relational vocabularies: – the relational version of τ itself, consisting of Rα for α ∈ τ , and again denoted by just τ . – the expansion τΦ of the relational vocabulary τ by unary predicates {P0 , P1 , . . .} associated with the atomic propositions p0 , p1 , . . . ∈ Φ. Correspondingly, FO(τ ) and FO(τΦ ) are the first-order languages with vocabularies τ and τΦ , respectively. We regard a τ -frame as a τ -structure in the usual sense, and a Kripke structure over a τ -frame as a τΦ -structure, with Pi interpreted as V (pi ). We use the same notation for Kripke structures and for the associated first-order structures, as this causes no confusion. Wherever necessary, we will highlight the distinction by writing |=FO to explicitly appeal to first-order semantics. 2 In algebraic terms (see Chapter 6), the extended valuation is the unique homomorphism from the free τ -algebra of formulae to the modal algebra associated with the model M, extending V .
254
Valentin Goranko and Martin Otto
Truth and validity of a modal formula in a Kripke structure are first-order notions in the following sense. Let VAR = {x0 , x1 , . . .} be the set of first-order variables of FO(τΦ ). The formulae of ML(τ ) are translated into FO(τΦ ) by means of the following standard translation [124, 127], parameterised with the variables from VAR: • ST(pi ; xj ) := Pi xj for every pi ∈ Φ; • ST(⊥; xj ) := ⊥; • ST(ϕ1 → ϕ2 ; xj ) := ST(ϕ1 ; xj ) → ST(ϕ2 ; xj ); • ST( α ϕ; xj ) := ∃y(xj Rα y ∧ ST(ϕ; y)), where y is the first variable in VAR \ {xj }. Note that only xj is free in ST(ϕ; xj ). Furthermore, for the standard translation it suffices to use only the variables x0 and x1 (free or bound) in an alternating fashion. This yields a translation into the two-variable fragment FO2 of first-order logic. Also, the standard translation of any modal formula falls into the guarded fragment of first-order logic. These observations are taken up in section 4. The standard translation is semantically faithful in the following sense. PROPOSITION 5. For every pointed Kripke structure (M, w) and ϕ ∈ ML(τ ), M, w |= ϕ iff M, w |=FO ST(ϕ; x0 ). While the semantics and validity for modal formulae over Kripke structures is thus essentially first-order, validity of a modal formula in a frame goes beyond first-order logic. Indeed, paraphrasing the definition in terms of the standard translation, a modal formula ϕ is valid in a frame iff its standard translation is true in that frame under every interpretation of the unary predicates occurring in it. PROPOSITION 6. For every pointed Kripke frame (F, w) and ϕ ∈ ML(τ ) with atomic propositions among p0 , . . . , pn : F, w |= ϕ iff F, w |= ∀P0 . . . ∀Pn ST(ϕ; x0 ). Consequently, F |= ϕ iff F |= ∀P0 . . . ∀Pn ∀x0 ST(ϕ; x0 ).
1.4 Theories, equivalence and definability With every logic L comes an associated notion of logical equivalence between structures. Two structures of the appropriate type are equivalent with respect to L if no property expressible in L distinguishes between them, i.e., if their L-theories are the same. In this sense, first-order logic gives rise to the notion of elementary equivalence. Correspondingly, modal equivalence is indistinguishability in modal logic. Each view of the semantics of modal logic – in terms of (pointed or plain) structures or frames – corresponds to a notion of modal theories and modal equivalence. DEFINITION 7. The modal theory of a pointed Kripke τ -structure (M, w) is the set of all formulae of ML(τ ) satisfied in (M, w): ThML (M, w) := {ϕ ∈ ML(τ ) | M, w |= ϕ}. Correspondingly, the modal theory of M is ThML (M) := {ϕ ∈ ML(τ ) | M |= ϕ}. The modal theories of a frame and pointed frame, as well as of classes of (pointed) Kripke structures or frames, are defined likewise.
Model Theory of Modal Logic
255
The basic notion of modal equivalence, corresponding to the notion of truth at a state of a Kripke structure, is an equivalence relation on the class of pointed Kripke structures (M, w). Natural variants cover the derived notions for plain Kripke structures, and for pointed or plain frames. DEFINITION 8. For two pointed Kripke τ -structures (M, w) and (M , w ): (M, w) and (M , w ) are ML-equivalent, denoted (M, w) ≡ML (M , w ), iff they satisfy exactly the same formulae of ML, i.e., iff ThML (M, w) = ThML (M , w ). Modal equivalence between Kripke structures, frames, and pointed frames are defined likewise. Definability in modal logic means different things corresponding to the different levels of the semantics. We distinguish local versus global definability (truth at a state versus validity throughout a frame/structure), and definability at the level of structures versus frames (truth/validity for a given valuation versus for all valuations). Given a formula ϕ ∈ ML(τ ), the classes of pointed Kripke structures, Kripke structures, pointed frames and frames defined by ϕ are denoted as KS(ϕ), PKS(ϕ), FR(ϕ), and PFR(ϕ), respectively: PFR(ϕ)= (F, w) (F, V ), w |= ϕ for all valuations V KS(ϕ)= M M |= ϕ for all w ∈ dom(M) FR(ϕ)= F (F, V ), w |= ϕ for all w and for all valuations V
PKS(ϕ)= (M, w) M, w |= ϕ
DEFINITION 9. A class P of pointed Kripke τ -structures is (modally) definable in the language ML(τ ) if P = PKS(ϕ) for some formula ϕ ∈ ML(τ ). Definable classes of Kripke structures, frames, and pointed frames are defined likewise. EXAMPLE 10. Here are some examples of modally definable classes of Kripke frames and structures. The class of pointed Kripke structures (M, w), where M = W, R, V , such that w has at least one successor not satisfying p for which every successor satisfies q, is defined by the formula 3(¬p ∧ 2q). The formula p → 2p defines the class of Kripke structures in which the valuation of p is closed under the accessibility relation. The class of frames in which every state has a successor is defined by the formula 3; the same formula defines the class of pointed frames (F, w) in which w has a successor. The formula 3p → 2p defines the class of frames K in which every state has at most one successor. It is straightforward to show that the formula is valid in every such frame. For the converse: if the formula fails at some state w of a Kripke structure over a frame F, then p is true at some successor of w. But since 2p is false at w, there must be another successor of w where p fails. Hence F does not satisfy the defining property of K. Other standard examples of modally definable classes of frames include the classes of: reflexive frames, defined by 2p → p; transitive frames, defined by 2p → 22p; symmetric frames, defined by 32p → p, etc. For more examples see [117, 75, 127, 128]. Proposition 5 implies that the definability of classes of (pointed) Kripke structures by modal formulae is a special case of first-order definability. Consequently, modal logic shares many basic model-theoretic results with first-order logic, such as compactness and L¨ owenheim–Skolem theorems (see [12, 68]). We will discuss the model theoretic aspects of modal logic as a fragment of first-order logic on Kripke structures in section 4.
256
Valentin Goranko and Martin Otto
On the other hand, Proposition 6 indicates that modal definability of (pointed) frames is a form of Π11 -definability, and the model-theoretic consequences of that fact will be discussed in section 8. In particular, we will see that it is indeed essentially second-order.
1.5 Polyadic modalities In polyadic modal logics one considers modalities α of arbitrary arities r(α) ∈ N, which give rise to formulae α (ϕ1 , . . . , ϕn ) if n = r(α). The interpretation of an nary modal operator α is given in terms of (n + 1)-ary relations Rα in corresponding frames, and an n-ary operator on subsets of these frames, in such a way that the semantics is faithfully captured n in the standard translation ST( α (ϕ1 , . . . , ϕn ; xj )) := ∃y1 . . . ∃yn (xj Rα y1 . . . yn ∧ i=1 ST(ϕi ; yi )), where y1 . . . yn are the first n variables in VAR \ {xj } (and xj Rα y1 . . . yn is just a notational variant for Rα xj y1 . . . yn ). Polyadic modalities were first studied from an algebraic perspective, as normal and additive operators in Boolean algebras, by J´ onsson and Tarski [78, 79]. All the essential model theoretic features of modal logic can be generalised to this more liberal setting, albeit with some care and sometimes unavoidable notational complications. In [41] Goguadze et al define and develop systematically an interpretation of polyadic languages into monadic ones, and simulations of polyadic by monadic logics, which transfer a number of important properties, such as frame completeness, finite model property, canonicity and first-order definability. On the other hand, so called purely modal polyadic languages are defined in [55], where all logical connectives except negation are treated as binary modalities, and modalities can be composed. Thus, all polyadic modal formulae are built from (composite) boxes and diamonds applied to literals, making their syntactic structure much simpler. Throughout this chapter we will only treat monadic modalities explicitly.
2
BISIMULATION AND BASIC MODEL CONSTRUCTIONS
A major concern in model theory is the analysis of logical equivalence of structures in comparison with other natural notions of structural equivalence, in particular equivalences of a more combinatorial or algebraic nature. Bisimulation equivalences as studied below prove to be the algebraic/combinatorial counterparts to modal equivalence. For first-order logic this combinatorial approach leads to the well-known characterisation of elementary equivalence via Ehrenfeucht–Fra¨ıss´e games (see [68, 108, 26, 25]). Variations of the basic Ehrenfeucht–Fra¨ıss´e idea apply to many other logics including modal logic. Modal equivalence can thus be put into the general Ehrenfeucht–Fra¨ıss´e framework. We shall sketch this connection in section 4. The very natural game associated with modal equivalence has, however, also been invented and studied independently and in its own right, with the notions of zig-zag relation (van Benthem) and bisimulation equivalence (Hennessy, Milner, Park). We therefore put an autonomous, modal treatment before the discussion of relationships with the general framework of Ehrenfeucht–Fra¨ıss´e and pebble games.
Model Theory of Modal Logic
2.1
257
Bisimulation and invariance
While the notion of logical equivalence is static, it can often be characterised in more dynamic, game-theoretic terms. The concept of bisimulation equivalence, which is closely related to corresponding games, is one of the most productive ideas in the model theory of modal logics, temporal logics, logics for concurrency, etc. Just as it has multiple roots in these various branches of logic, many variants have been employed to capture specific notions of “behavioural equivalence” between all kinds of transition systems that are interesting in their own right for various application areas – and not necessarily with any ‘logic’ in mind. }α∈τ , V be two DEFINITION 11. Let M = W, {Rα }α∈τ , V and M = W , {Rα Kripke τ -structures. A bisimulation between M and M is a non-empty relation ρ ⊆ W × W satisfying the following conditions for any wρw :
Atom equivalence: w and w satisfy the same atomic propositions, hereafter denoted by w # w . Forth: For any α ∈ τ , if wRα u for some u ∈ W , then there is some u ∈ W such that u and uρu . (Any α-transition at w in M can be matched at w in M .) w Rα Back: Similarly, in the opposite direction: for any α ∈ τ , and w Rα u there is some u ∈ W such that wRα u and uρu . (Any α-transition at w in M can be matched at w in M.)
M
w• _ _ _ ρ _ _ _ _ • <w M << <<α α < _ _ _ _ _ _ _ _ _ _ _< u • • u ρ
back & forth
That ρ is a bisimulation between M and M is denoted as ρ : M M . If, moreover, ρ is such that every element in M is linked to some element of M and vice versa, we say that ρ is a global bisimulation and that M and M are globally bisimilar. DEFINITION 12. Two pointed Kripke structures (M, w) and (M , w ) are bisimilar or bisimulation equivalent, denoted (M, w) (M , w ), if there is a bisimulation ρ between M and M such that wρw . Bisimulations between (pointed) frames can be defined likewise, by omitting atom equivalence. Thus, a relation ρ is a bisimulation between two frames F and F , iff it is a bisimulation between the respective Kripke structures F, V⊥ and F , V⊥ where the valuations V⊥ and V⊥ render every atomic proposition false at every state of the respective frame. DEFINITION 13. Let C be a class of structures appropriate for the logical language L (e.g., pointed Kripke structures for ML). Let ≈ be an equivalence relation on C. Then L is preserved under ≈ over C, or L is ≈-invariant over C, iff for any A ≈ A in C and any ϕ ∈ L: A |= ϕ ⇔ A |= ϕ, i.e., A and A are L-equivalent. In other words: ≈ is a refinement of ≡L , or ≈ ⊆ ≡L .
258
Valentin Goranko and Martin Otto
Invariance phenomena give insights into the semantics of the logic involved, and also often provide key tools for the model theoretic study of the logic (e.g., model constructions guided by ≈ equivalence). The relationship between modal logics and bisimulation equivalences provides an excellent example of such a fruitful companionship. It would be straightforward to prove the following by induction on the structure of modal formulae, straight from the definition of bisimulations. However, this will also fall out as a corollary of the more instructive analysis of the associated bisimulation games. We therefore meanwhile only state the fact. THEOREM 14 (bisimulation invariance). ML(τ ) is bisimulation invariant: if (M, w) (M , w ), then (M, w) ≡ML (M , w ). Consequently, for every constant formula θ ∈ ML(τ ) and pointed τ -frames (F, w) and (F , w ): if (F, w) (F , w ), then (F, w) |= θ iff (F , w ) |= θ.
2.2
Classical truth-preserving constructions
Bisimulations induced by maps from one frame to another have classically been studied as bounded morphisms or p-morphisms. We state the corresponding back-and-forth conditions, which are slightly simpler in the case of such a functional relationship, and treat some particularly important special cases. The use of generated and rooted substructures, bounded morphic images, tree unfoldings and disjoint unions in connection with classical model constructions for modal logic is based on truth preservation for modal formulae. These constructions were introduced for basic modal logic [117, 7] before the notion of bisimulation was developed and its importance for modal logic realised. Via duality theory, which connects the relational semantics for modal logic with an algebraic semantics, bounded morphisms, generated subframes and disjoint unions correspond respectively to the fundamental universal algebraic notions of subalgebras, homomorphic images, and direct products. For details see Chapter 6 of this handbook, as well as [78, 43, 44, 114] and [5, Ch. 5]. The preservation results encountered in these special cases of a passage to bisimilar structures highlight to various degrees one of the key characteristic features of the semantics of modal logic: its explicit locality and restricted nature of quantification. Unlike first-order logic, whose global quantification over the entire universe makes truth generally dependent on the entire structure, the truth of a modal formula in a Kripke structure is evaluated relative to a ‘current’ state and admits access to the rest of the structure only along the edges of the accessibility relations. Passage from a given structures to a bisimilar tree structure, obtained via a simple bounded morphism, shows for instance that any satisfiable formula of basic modal logic is satisfied at the root of a tree structure (tree model property, see Corollary 24; this can be further strengthened to a finite tree model property, see Lemma 35). Conversely, preservation results can be used to show that certain properties are not modally definable. We shall see some classical examples of this in section 2.3. Bounded morphisms }α∈τ , V be Kripke DEFINITION 15. Let M = W, {Rα }α∈τ , V and M = W , {Rα structures. A function ρ : W → W is a bounded morphism from M to M if its graph is a bisimulation between M and M . We denote a bounded morphism as in ρ : M −→ M .
Model Theory of Modal Logic
259
Bounded morphisms between frames are similarly defined. If ρ is onto, then M is a bounded morphic image of M (and similarly for frames). Thus, for each u ∈ W , a bounded morphism ρ uniquely singles out a bisimilar state ρ(w) in W . The bisimulation conditions for a bounded morphism between two Kripke structures correspondingly become: Atom equivalence: w # ρ(w) for every w ∈ W . ρ(u). Forth: For any w ∈ W and α ∈ τ , if wRα u for some u ∈ W , then ρ(w)Rα u for some u ∈ W , then u = ρ(u) for Back: For any w ∈ W and α ∈ τ , if ρ(w)Rα some u ∈ W such that wRα u.
Bisimulation invariance yields the following preservation results. COROLLARY 16. Bounded morphisms preserve truth and validity of modal formulae. More specifically, if ρ : M −→ M is a bounded morphism and ϕ ∈ ML(τ ), then: (i) for all u ∈ dom(F): M, u |= ϕ iff M , ρ(u) |= ϕ. (ii) If ρ is onto, then M |= ϕ iff M |= ϕ, i.e., ThML (M) =ThML (M ). (iii) If F, u |= ϕ, then F , ρ(u) |= ϕ. (iv) If ρ is onto, then F |= ϕ implies F |= ϕ. For the latter two claims one just has to note that each model M = F , V over the frame F can be pulled back to give a model M = F, V over the frame F via V (p) := ρ−1 [V (p)] = {w ∈ dom(F) | ρ(w) ∈ V (p)}. This turns ρ into a bounded morphism from M to M . Note, however, that not every model over F is obtained in this manner. We turn to several basic model constructions involving bounded morphisms: generated substructures, rooted substructures, tree unfoldings and disjoint unions. Generated and rooted substructures If R ⊆ W 2 is any binary relation over W , and W ⊆ W , we write R W for the restriction of R to W , R W = R ∩ (W × W ). Similarly for a valuation V on W , V W stands for its restriction to W . DEFINITION 17. Let F = W, {Rα }α∈τ be a frame, or M = F, V a Kripke structure over F, respectively, and W ⊆ W . (i) The induced subframe of F over W is the frame F := F W = W , {Rα W }α∈τ . The subframe relationship is denoted F ≤ F. (ii) F = F W is a generated subframe of F, denoted F F, if W is closed under all accessibility relations in the sense that wRα u for w ∈ W implies u ∈ W . (iii) The induced substructure of M over W is the Kripke structure M = M W =
F W , V W , denoted M ≤ M. If F W F, then M is a generated substructure of M, denoted M M. Obviously, for M M the inclusion map ρ : W → W is a bounded morphism. By bisimulation invariance, we therefore have the following. PROPOSITION 18. For all Kripke structures M M and for every formula ϕ of ML(τ ):
260
Valentin Goranko and Martin Otto
(i) for every u ∈ dom(M ) : M, u |= ϕ iff M , u |= ϕ. (ii) M |= ϕ implies M |= ϕ. Likewise, for frames F F and u ∈ dom(F ): F, u |= ϕ iff F , u |= ϕ, and F |= ϕ implies F |= ϕ. The latter claim holds since every Kripke structure over F is induced by a Kripke structure on F. A particularly important case of generated subframes deals with the set of all states = reachable from a fixed state. A path in a frame F = W, {Rα }α∈τ is a sequence w (w0 , α1 , w1 , . . . , αk , wk ), where wi−1 Rαi wi for i = 1, . . . , k (this path is rooted at w0 and has length k). A path of length k = 0, w = (w0 ), is identified with its root w0 . For [u]. For every path w u ∈ W , we denote the set of all paths rooted at u by W as above Then we define the ‘terminal state’ function f (w) = wk where k is the length of w. [u]} W [u] := {f (w) |w ∈W is the set of all states in F reachable from u (including u itself). DEFINITION 19. Let F = W, {Rα }α∈τ be a frame, M = F, V a Kripke structure over F, and u ∈ W . (i) The subframe of F rooted at u is the frame F[u] = F W [u]. (ii) The substructure of M rooted at u is the Kripke structure M[u] = M W [u]. (iii) F (respectively M) is rooted at u if W [u] = W . Clearly, for any u ∈ W : F[u] F and M[u] M, respectively. Therefore, we obtain the following. COROLLARY 20. For every Kripke structure M M and formula ϕ of ML(τ ): (i) for all u ∈ W : M, u |= ϕ iff M[u], u |= ϕ. (ii) M |= ϕ implies M[u] |= ϕ. (iii) Likewise for (pointed) frames. Thus, any satisfiable formula is satisfiable at the root of a rooted Kripke structure. Tree unfoldings An important model construction based on a canonical bounded morphism is the unfolding or tree unravelling of a Kripke structure M = W, {Rα }α∈τ , V from some u ∈ W . This construction was introduced in [113], where the tree model property (cf. Corollary 24 below) was proved, too. [u] → W , which maps the path w Recall the map f : W = (u = w0 , α1 , w1 , . . . , αk , wk ) to its terminal state f (w) = wk . The unfolding of M[u] of M at u is based on the set [u] of all paths rooted at u, with the natural definition of accessibility relations and a W valuation that turns f into a bounded morphism. DEFINITION 21. The unfolding (or, unravelling) of M = W, {Rα }α∈τ , V from some [u], {R α }α∈τ , V with root u = (u), u ∈ W is the rooted Kripke structure M[u] := W where [u], f (w)R α := {(w, (w, α, w )) | w ∈W α w }, R −1 (p) := f [V (p)]. V
Model Theory of Modal Logic
261
Indeed, M[u] is a tree structure with root u = (u) in the sense of the following definition. DEFINITION 22. A pointed frame F = W, {Rα }α∈τ with distinguished state u ∈ W is a tree with root u if F is rooted at u and every state w ∈ W is reachable from u by a unique path. Accordingly, every Kripke structure over (F, u) is a tree structure. OBSERVATION 23. For every pointed Kripke structure (M, u) the terminal state map [u] → W [u] is a bounded morphism of the unfolding M[u] f: W onto M[u]. As M[u] is a tree structure with root u = (u), we obtain the following. Also compare Lemma 35 below. COROLLARY 24 (tree-model property). at the root of a tree.
Every satisfiable modal formula is satisfiable
Disjoint unions Disjoint unions are well known for relational structures: the component structures are put side by side without any relational links between the components. Assuming that the given family of Kripke structures or frames is based on universes that are pairwise disjoint, we may just take the set-theoretic union of the universes, accessibility relations, and valuations, respectively. If the given frames are not disjoint, they first need to be replaced by isomorphic copies over universes that are pairwise disjoint. To be specific, define the disjoint union of an arbitrary family W i i∈I of (not neces sarily disjoint) sets as i∈I W i := i∈I (W i × {i}). With this formalisation, we have the i × {i}) of each component set into natural injection or embedding εj : W j → i∈I (W the disjoint union, which maps w ∈ W j to (w, j) ∈ i∈I (W i × {i}). i DEFINITION 25. Consider a family of τ -frames Fi = W i , {Rα }α∈τ i∈I and a family i i i over these. of Kripke structures M = F , V i∈I i i (i) The disjoint union of F i∈I is the frame i∈I Fi = i∈I W , {Rα }α∈τ , where i w1 . (w0 , i0 )Rα (w1 , i1 ) iff i0 = i1 = i and w0 Rα i (ii) The disjoint union of M i∈I is the Kripke τ -structure i∈I Mi = Fi , V i∈I where V (p) = i∈I V i (p). It is immediate that the natural injection εj : W j → i∈I W i isomorphically embeds Mj into i∈I Mi and is indeed a bounded morphism with image j [Mj ] # Mj and j [Mj ] i∈I Mi . We therefore obtain the following, by bisimulation invariance and based on previous observations. i PROPOSITION 26. Given a family of τ -frames Fi = W i , {Rα }α∈τ i∈I , a family of Kripke structures Mi = Fi , V i i∈I over these frames, and ϕ ∈ ML(τ ): (i) For every j ∈ I and w ∈ dom(Mj ): Mj , w |= ϕ iff i∈I Mi , (w, j) |= ϕ. (ii) For every j ∈ I and w ∈ dom(Fj ): Fj , w |= ϕ iff i∈I Fi , (w, j) |= ϕ. (iii) i∈I Mi |= ϕ iff Mi ϕ for every i ∈ I. (iv) i∈I Fi |= ϕ iff Fi |= ϕ for every i ∈ I. The following structural observation [127] links some of the ideas explored in this section.
262
Valentin Goranko and Martin Otto
PROPOSITION 27. Any Kripke structure is the bounded morphic image of a disjoint union of rooted Kripke structures, and indeed of tree structures. For a proof of the proposition, consider the families of the {M[u]}u∈W or {M[u]} u∈W . The desired bounded morphisms (from the disjoint unions of these families back onto M) are the unions of the projection and inclusion or terminal state maps defined on the components of these disjoint unions.
2.3 Proving non-definability To show that a given property of structures is definable in a given logic, it suffices simply to find a defining formula. Showing that a property is not definable, however, is not so straightforward, and often requires elaborate arguments. A standard method for establishing non-definability of a property P (i.e., of the class of structures satisfying that property) in a logic L is to show that P is not closed under some construction preserving truth (validity) of all formulae of L. Now that we have at hand constructions that preserve truth and validity of modal formulae, we can use them to show that various properties of frames and structures are not modally definable. Compare Definition 9 for the relevant notions of definability. At the level of pointed Kripke structures, modal formulae capture only properties that are local in the sense that whether or not M, w |= ϕ only depends on (M[w], w). In other words, modal formulae are incapable of expressing any property of (M, w) that involves points beyond M[w]. For instance, there is no ϕ ∈ ML such that M, w |= ϕ iff M |= p. Indeed, one can always add to M an extra point (as a disjoint union), not reachable from w, where p is false. The resulting pointed structure (M , w) is bisimilar to (M, w), whence ϕ would have to be equally true or false at w in both. Likewise, at the level of Kripke structures, there is no ϕ ∈ ML such that M |= ϕ iff the accessibility relation of the underlying frame F is reflexive. This follows for instance from the fact that the unfolding of any frame is irreflexive. If M is reflexive, then so is the generated substructure M[u], which however is also a bounded morphic image of the irreflexive M[u]. Reflexivity, however, is well-known to be definable in terms of frame validity by the formula p → p. In other words, the class of reflexive frames is definable by the second-order sentence ∀P ∀x(∀y(Rxy → P y) → P x). Intuitively, in terms of truth in Kripke structures, modal formulae can make very little reference to the underlying frame. We turn to properties of frames and non-definability in terms of frame validity, which is maybe the most interesting facet of modal expressiveness. One can show, for instance, that (unlike reflexivity) irreflexivity is not a modally definable frame property. This property is not preserved under surjective bounded morphisms, while surjective bounded morphisms preserve frame validity. One may consider unfoldings as above, or also the (irreflexive) frame F = {w1 , w2 }, {(w1 , w2 ), (w2 , w1 )} and its bounded morphic image F = {w}, {(w, w)} , which is reflexive. Hence any ϕ valid in the former would also be valid in the latter. Similarly, the class of non-reflexive frames (i.e., ones having at least one irreflexive point) is not definable in terms of validity of modal formulae, because it is not closed under passage to generated subframes. Likewise, the classes of finite frames, connected frames, or of frames with a universal accessibility relation (R = W 2 ), are not definable in terms of frame validity of modal formulae, as they are not closed under disjoint unions.
Model Theory of Modal Logic
263
For another interesting example, consider the property of a frame to be a reflexive partial ordering. It is not modally definable, because anti-symmetry is not preserved under surjective bounded morphisms. Indeed, Z, ≤ is antisymmetric, but the mapping of it onto the symmetric frame F above, sending all odd numbers to w1 and all even ones to w2 , is a surjective bounded morphism (and remains so, even when we add an inverse or past modality, as in basic temporal logic). However, the preservation results we have discussed so far are insufficient to capture frame non-definability. A witness is the following more subtle example: the property of continuity, or Dedekind completeness is not modally definable in modal logic, but to see that using a non-preservation argument is not easy. Ultimately, this follows from the fact that R, ≤ (which is continuous) and Q, ≤ (which is not) have the same modal theory (i.e., the same formulae of basic modal logic are valid in these frames); see [46].3 Finally, note that preservation under generated subframes,
