
- •Contents
- •Foreword to the first edition
- •Preface to the second edition
- •Our motivation for (re)writing this book
- •What’s new and what’s gone
- •The interdependence of chapters and prerequisites
- •Acknowledgements
- •Added for second edition
- •1 Propositional logic
- •1.1 Declarative sentences
- •1.2 Natural deduction
- •1.2.1 Rules for natural deduction
- •1.2.2 Derived rules
- •1.2.3 Natural deduction in summary
- •1.2.4 Provable equivalence
- •1.2.5 An aside: proof by contradiction
- •1.3 Propositional logic as a formal language
- •1.4 Semantics of propositional logic
- •1.4.1 The meaning of logical connectives
- •1.4.2 Mathematical induction
- •1.4.3 Soundness of propositional logic
- •1.4.4 Completeness of propositional logic
- •1.5 Normal forms
- •1.5.1 Semantic equivalence, satisfiability and validity
- •1.5.2 Conjunctive normal forms and validity
- •1.5.3 Horn clauses and satisfiability
- •1.6 SAT solvers
- •1.6.1 A linear solver
- •1.6.2 A cubic solver
- •1.7 Exercises
- •1.8 Bibliographic notes
- •2 Predicate logic
- •2.1 The need for a richer language
- •2.2 Predicate logic as a formal language
- •2.2.1 Terms
- •2.2.2 Formulas
- •2.2.3 Free and bound variables
- •2.2.4 Substitution
- •2.3 Proof theory of predicate logic
- •2.3.1 Natural deduction rules
- •2.3.2 Quantifier equivalences
- •2.4 Semantics of predicate logic
- •2.4.1 Models
- •2.4.2 Semantic entailment
- •2.4.3 The semantics of equality
- •2.5 Undecidability of predicate logic
- •2.6 Expressiveness of predicate logic
- •2.6.1 Existential second-order logic
- •2.6.2 Universal second-order logic
- •2.7 Micromodels of software
- •2.7.1 State machines
- •2.7.2 Alma – re-visited
- •2.7.3 A software micromodel
- •2.8 Exercises
- •2.9 Bibliographic notes
- •3 Verification by model checking
- •3.1 Motivation for verification
- •3.2 Linear-time temporal logic
- •3.2.1 Syntax of LTL
- •3.2.2 Semantics of LTL
- •3.2.3 Practical patterns of specifications
- •3.2.4 Important equivalences between LTL formulas
- •3.2.5 Adequate sets of connectives for LTL
- •3.3 Model checking: systems, tools, properties
- •3.3.1 Example: mutual exclusion
- •3.3.2 The NuSMV model checker
- •3.3.3 Running NuSMV
- •3.3.4 Mutual exclusion revisited
- •3.3.5 The ferryman
- •3.3.6 The alternating bit protocol
- •3.4 Branching-time logic
- •3.4.1 Syntax of CTL
- •3.4.2 Semantics of computation tree logic
- •3.4.3 Practical patterns of specifications
- •3.4.4 Important equivalences between CTL formulas
- •3.4.5 Adequate sets of CTL connectives
- •3.5.1 Boolean combinations of temporal formulas in CTL
- •3.5.2 Past operators in LTL
- •3.6 Model-checking algorithms
- •3.6.1 The CTL model-checking algorithm
- •3.6.2 CTL model checking with fairness
- •3.6.3 The LTL model-checking algorithm
- •3.7 The fixed-point characterisation of CTL
- •3.7.1 Monotone functions
- •3.7.2 The correctness of SATEG
- •3.7.3 The correctness of SATEU
- •3.8 Exercises
- •3.9 Bibliographic notes
- •4 Program verification
- •4.1 Why should we specify and verify code?
- •4.2 A framework for software verification
- •4.2.1 A core programming language
- •4.2.2 Hoare triples
- •4.2.3 Partial and total correctness
- •4.2.4 Program variables and logical variables
- •4.3 Proof calculus for partial correctness
- •4.3.1 Proof rules
- •4.3.2 Proof tableaux
- •4.3.3 A case study: minimal-sum section
- •4.4 Proof calculus for total correctness
- •4.5 Programming by contract
- •4.6 Exercises
- •4.7 Bibliographic notes
- •5 Modal logics and agents
- •5.1 Modes of truth
- •5.2 Basic modal logic
- •5.2.1 Syntax
- •5.2.2 Semantics
- •Equivalences between modal formulas
- •Valid formulas
- •5.3 Logic engineering
- •5.3.1 The stock of valid formulas
- •5.3.2 Important properties of the accessibility relation
- •5.3.3 Correspondence theory
- •5.3.4 Some modal logics
- •5.4 Natural deduction
- •5.5 Reasoning about knowledge in a multi-agent system
- •5.5.1 Some examples
- •5.5.2 The modal logic KT45n
- •5.5.3 Natural deduction for KT45n
- •5.5.4 Formalising the examples
- •5.6 Exercises
- •5.7 Bibliographic notes
- •6 Binary decision diagrams
- •6.1 Representing boolean functions
- •6.1.1 Propositional formulas and truth tables
- •6.1.2 Binary decision diagrams
- •6.1.3 Ordered BDDs
- •6.2 Algorithms for reduced OBDDs
- •6.2.1 The algorithm reduce
- •6.2.2 The algorithm apply
- •6.2.3 The algorithm restrict
- •6.2.4 The algorithm exists
- •6.2.5 Assessment of OBDDs
- •6.3 Symbolic model checking
- •6.3.1 Representing subsets of the set of states
- •6.3.2 Representing the transition relation
- •6.3.4 Synthesising OBDDs
- •6.4 A relational mu-calculus
- •6.4.1 Syntax and semantics
- •6.5 Exercises
- •6.6 Bibliographic notes
- •Bibliography
- •Index
5.5 Reasoning about knowledge in a multi-agent system |
335 |
5.5.2 The modal logic KT45n
We now generalise the modal logic KT45 given in Section 5.3.4. Instead of having just one , it will have many, one for each agent i from a fixed set A = {1, 2, . . . , n} of agents. We write those modal connectives as Ki (for each agent i A); the K is to emphasise the application to knowledge. We assume a collection p, q, r, . . . of atomic formulas. The formula Ki p means that agent i knows p; so, for example, K1 p K1¬K2K1 p means that agent 1 knows p, but knows that agent 2 doesn’t know he knows it.
We also have the modal connectives EG, where G is any subset of A. The formula EG p means everyone in the group G knows p. If G = {1, 2, 3, . . . , n}, then EG p is equivalent to K1 p K2 p · · · Kn p. We assume similar binding priorities to those put forward on page 307.
Convention 5.22 The binding priorities of KT45n are the ones of basic modal logic, if we think of each modality Ki, EG and CG as ‘being’ .
One might think that φ could not be more widely known than everyone knowing it, but this is not the case. It could be, for example, that everyone knows φ, but they might not know that they all know it. If φ is supposed to be a secret, it might be that you and your friend both know it, but your friend does not know that you know it and you don’t know that your friend knows it. Thus, EGEG φ is a state of knowledge even greater than EG φ and EGEGEG φ is greater still. We say that φ is common knowledge among G, written CG φ, if everyone knows φ and everyone knows that everyone knows it; and everyone knows that; and knows that etc. So we may think of CG φ as an infinite conjunction
EG φ EGEG φ EGEGEG φ . . . .
However, since our logics only have finite conjunctions, we cannot reduce CG to something which is already in the logic. We have to express the infinite aspect of CG via its semantics and retain it as an additional modal connective. Finally, DG φ means the knowledge of φ is distributed among the group G; although no-one in G may know it, they would be able to work it out if they put their heads together and combined the information distributed among them.
Definition 5.23 A formula φ in the multi-modal logic of KT45n is defined by the following grammar:
φ ::= | | p | (¬φ) | (φ φ) | (φ φ) | (φ → φ) | (φ ↔ φ) |
(Ki φ) | (EG φ) | (CG φ) | (DG φ)

336 5 Modal logics and agents
|
x2 |
|
|
p, q |
|
R1 |
R1, R2 |
|
x1 |
|
|
x3 |
|
|
q |
|
|
R1, R3 |
p |
p |
|
x4 |
x6 |
|
R3 |
||
|
q
R1, R2
x5
Figure 5.13. A KT45n model for n = 3.
where p is any atomic formula, i A and G A. We simply write E, C and D without subscripts if we refer to EA, CA and DA.
Compare this definition with Definition 5.1. Instead of , we have several modalities Ki and we also have EG, CG and DG for each G A. Actually, all of these connectives will shortly be seen to be ‘box-like’ rather than ‘diamond-like’, in the sense that they distribute over rather than over – compare this to the discussion of equivalences on page 308. The ‘diamondlike’ correspondents of these connectives are not explicitly in the language, but may of course be obtained using negations, i.e. ¬Ki¬, ¬CG¬ etc.
Definition 5.24 A model M = (W, (Ri)i A, L) of the multi-modal logic KT45n with the set A of n agents is specified by three things:
1.a set W of possible worlds;
2.for each i A, an equivalence relation Ri on W (Ri W × W ), called the accessibility relations; and
3.a labelling function L : W → P(Atoms).
Compare this with Definition 5.3. The di erence is that, instead of just one accessibility relation, we now have a family, one for each agent in A; and we assume the accessibility relations are equivalence relations.
We exploit these properties of Ri in the graphical illustrations of Kripke models for KT45n. For example, a model of KT453 with set of worlds {x1, x2, x3, x4, x5, x6} is shown in Figure 5.13. The links between the worlds have to be labelled with the name of the accessibility relation, since we have several relations. For example, x1 and x2 are related by R1, whereas x4 and
5.5 Reasoning about knowledge in a multi-agent system |
337 |
x5 are related both by R1 and by R2. We simplify by no longer requiring arrows on the links. This is because we know that the relations are symmetric, so the links are bi-directional. Moreover, the relations are also reflexive, so there should be loops like the one on x4 in Figure 5.11 in all the worlds and for all of the relations. We can simply omit these from the diagram, since we don’t need to distinguish between worlds which are self-related and those which are not.
Definition 5.25 Take a model M = (W, (Ri)iA, L) of KT45n and a world x W . We define when φ is true in x via a satisfaction relation x φ by induction on φ:
x p |
i p L(x) |
x ¬φ |
i x φ |
x φ ψ |
i x φ and x ψ |
x φ ψ |
i x φ or x ψ |
x φ → ψ |
i x ψ whenever we have x φ |
x Ki ψ |
i , for each y W , Ri(x, y) implies y ψ |
x EG ψ |
i , for each i G, x Ki ψ |
x CG ψ |
i , for each k ≥ 1, we have x EGk ψ, |
x DG ψ |
where EGk means EGEG . . . EG – k times |
i , for each y W , we have y ψ, |
|
|
whenever Ri(x, y) for all i G. |
Again, we write M, x φ if we want to emphasise the model M.
Compare this with Definition 5.4. The cases for the boolean connectives are the same as for basic modal logic. Each Ki behaves like a , but refers to its own accessibility relation Ri. As already stated, there are no equivalents of , but we can recover them as ¬Ki¬. The connective EG is defined in terms of the Ki and CG is defined in terms of EG.
Many of the results we had for basic modal logic with a single accessibility relation also hold in this more general setting of several accessibility relations. Summarising,
a frame F for KT45n (W, (Ri)iA) for the modal logic KT45n is a set W of worlds and, for each i A, an equivalence relation Ri on W .
a frame F = (W, (Ri)iA) for KT45n is said to satisfy φ if, for each labelling function L : W → P(Atoms) and each w W , we have M, w φ holds, where M = (W, (Ri)iA, L). In that case, we say that F φ holds.
The following theorem is useful for answering questions about formulas involving E and C. Let M = (W, (Ri)iA, L) be a model for KT45n
338 5 Modal logics and agents
and x, y W . We say that y is G-reachable in k steps from x if there are w1, w2, . . . , wk−1 W and i1, i2, . . . , ik in G such that
x Ri1 w1 Ri2 w2 . . . Rik−1 wk−1 Rik y
meaning Ri1 (x, w1), Ri2 (w1, w2), . . . , Rik (wk , y). We also say that y is G- reachable from x if there is some k such that it is G-reachable in k steps.
Theorem 5.26
1.x EGk φ i , for all y that are G-reachable from x in k steps, we have y φ.
2.x CG φ i , for all y that are G-reachable from x, we have y φ.
PROOF:
1. First, suppose y φ for all y G-reachable from x in k steps. We will prove that x EGk φ holds. It is su cient to show that x Ki1 Ki2 . . . Kik φ for any i1, i2, . . . , ik G. Take any i1, i2, . . . , ik G and any w1, w2,. . . , wk−1 and y such that there is a path of the form x Ri1 w1 Ri2 w2 . . . Rik−1 wk−1 Rik y. Since y is G-reachable from x in k steps, we have y φ by our assumption, so x Ki1 Ki2 . . . Kik φ as required.
Conversely, suppose x EGk φ holds and y is G-reachable from x in k steps. We must show that y φ holds. Take i1, i2, . . . , ik by G-reachability; since x EGk φ
implies x Ki1 Ki2 . . . Kik φ, we have y φ. 2. This argument is similar.
Some valid formulas in KT45n The formula K holds for the connectives Ki, EG, CG and DG, i.e. we have the corresponding formula schemes
Ki φ Ki (φ → ψ) → Ki ψ
EG φ EG (φ → ψ) → EG ψ
CG φ CG (φ → ψ) → CG ψ
DG φ DG (φ → ψ) → DG ψ.
This means that these di erent ‘levels’ of knowledge are closed under logical consequence. For example, if certain facts are common knowledge and some other fact follows logically from them, then that fact is also common knowledge.
Observe that E, C and D are ‘box-like’ connectives, in the sense that they quantify universally over certain accessibility relations. That is to say, we may define the relations REG , RDG and RCG in terms of the relations Ri, as follows:
REG (x, y) i Ri(x, y)
RDG (x, y) |
i |
Ri(x, y) |
||
RC |
G |
(x, y) |
i |
Rk (x, y) |
|
|
|
EG |
for some i G for all i G for each k ≥ 1.