Intensional Protocols for Dynamic Epistemic Logic

Abstract

In dynamical multi-agent systems, agents are controlled by protocols. In choosing a class of formal protocols, an implicit choice is made concerning the types of agents, actions and dynamics representable. This paper investigates one such choice: An intensional protocol class for agent control in dynamic epistemic logic (DEL), called ‘DEL dynamical systems’. After illustrating how such protocols may be used in formalizing and analyzing information dynamics, the types of epistemic temporal models that they may generate are characterized. This facilitates a formal comparison with the only other formal protocol framework in dynamic epistemic logic, namely the extensional ‘DEL protocols’. The paper concludes with a conceptual comparison, highlighting modeling tasks where DEL dynamical systems are natural.

Appendix: Proofs

Proposition 1

Let (X, f, x) be a pointed DEL dynamical system given by multi-pointed action model . Then there exists a singleton uniform DEL protocol that produces the orbit of f from x.

Proof

For each $k\in \mathbb {N}$, let σ_k ∈Γ be such that f^k(x)⊧pre(σ_k). As is X-deterministic, for each k there is at most one such σ_k. Define a uniform DEL protocol p as the smallest protocol for which p_k(s) = Σσ_k (for all s ∈ x) whenever σ_k exists. Then when p is sequentially applied to x using product update, it produces the sequence $\langle f^{k}(x)\rangle _{k\in \mathbb {N}}$ of pointed Kripke models (up to the deletion of redundant states not connected to the designated states, cf. Section 2).□

Proposition 2

If saturated ETL model $(\mathcal {H},\underline {H})$ is generated by a pointed DEL dynamical system, then $(\mathcal {H},\underline {H})$ satisfies seven of the eight properties of Section 4.2, namely Synchronicity, Connected Time-Steps, Perfect Recall, Local No Miracles, Precondition Describable, Precondition Describable, and Point Bisimulation Invariance.

Proof

Let (X, f, x) be a pointed DEL dynamical system with orbit $(f^{k}(x))_{k\in \mathbb {N}}$. The length of a state s in f^k(x) is len(s) := k + 1.

Let $(\mathcal {H},\underline {H})$ be the saturated ETL model generated by (X, f, x). Given the construction of γ in Def. 6, there exists a family of isomorphisms $\{g_{k}\}_{k\in \mathbb {N}}$ with each g_k mapping [[f^k(x)]] to H_k := {h ∈ H : len(h) = k} satisfying g₁(s) = e_s and g_k+ 1((s, σ)) = g_k(s)e_σ. Using this family, it is shown that $(\mathcal {H},\underline {H})$ satisfies the listed properties in order:

Synchronicity. :

Assume for arbitrary h, h^′∈ H that h_ih^′. Then by the construction of the generated _i (Def. 6), $\exists k\in \mathbb {N}:g_{k}^{-1}(h)R_{i}g_{k}^{-1}(h^{\prime })$. Hence $g_{k}^{-1}(h),g_{k}^{-1}(h^{\prime })\in \left [{\kern 3.5pt}[ f^{k}(x)\right ]{\kern 3.5pt}]$. Thus, $len(g_{k}^{-1}(h))=len(g_{k}^{-1}(h^{\prime }))$. Hence, by the construction of g, len(h) = len(h^′).

Perfect Recall. :

Assume for arbitrary he, h^′e^′∈ H that he_ih^′e^′. Then $\exists k\in \mathbb {N}:g_{k}^{-1}(he)R_{i}g_{k}^{-1}(h^{\prime }e^{\prime })$. By construction of f, for the multi pointed action model. As $g_{k}^{-1}(he)R_{i}g_{k}^{-1}(h^{\prime }e^{\prime })$, by definition of ⊗ and clean maps, $g_{k-1}^{-1}(h)R_{i}g_{k-1}^{-1}(h^{\prime })$. Hence, by definition of _i, it follows that h_ih^′.

Local No Miracles. :

Assume that 1) h_ih^′, 2) h₁e_ih₂e^′ and 3) h^∗h₁ for arbitrary he, h^′e^′, h₁e, h₂e^′∈ H. 1) implies that 1*) $g_{k}^{-1}(h)R_{i}g_{k}^{-1}(h^{\prime })$ for k = len(h). 3) implies that len(h) = len(h₁) by Synchronicity. In conjunction with 2), this implies that 2*) $g_{k+1}^{-1}(h_{1}e)R_{i}g_{k+1}^{-1}(h_{2}e^{\prime })$.

By construction of f, . By 2*) and the definition of ⊗ and clean maps, there must be 4) σ_e, such that $\sigma _{e}\mathsf {R}_{i}\sigma _{e^{\prime }}$, for σ_e the σ such that g_k+ 1((s, σ)) = h₁e, for some s ∈ [[f^k(x)]], and $\sigma _{e^{\prime }}$ the σ^′ such that g_k+ 1((t, σ^′)) = h₂e^′, for some t ∈ [[f^k(x)]].

Now assume that $(g_{k}^{-1}(h),\sigma _{e}),(g_{k}^{-1}(h^{\prime }),\sigma _{e^{\prime }})\in \left [{\kern 3.5pt}[ f^{k+1}(x)\right ]{\kern 3.5pt}]$. Then 1*), 4) and Def. ⊗ jointly imply that $(g_{k+1}^{-1}(h),\sigma _{e})R_{i}(g_{k+1}^{-1}(h^{\prime }),\sigma _{e^{\prime }})$. By the definition of the generated _i, it thus follows that he_ih^′e^′.

Connected Time-Steps. :

For arbitrary h, h^′∈ H assume len(h) = len(h^′). Let $k\in \mathbb {N}$ such that h, h^′∈ H_k. Then $g_{k}^{-1}(h),g_{k}^{-1}(h^{\prime })\in [{\kern 3.5pt}[ f^{k}(x)]{\kern 3.5pt}]$. By definition of product update ⊗, clean maps and the fact that x is connected, $g_{k}^{-1}(h)R^{*}g_{k}^{-1}(h^{\prime })$. By definition of $(\mathcal {H},\underline {H})$ it follows that h^∗h^′.

Precondition Describable. :

For arbitrary e ∈ E, let δ_e = pre(σ_e). Recall that by definition of ⊗, $\forall k\in \mathbb {N}$, $(g_{k}^{-1}(h),\sigma _{e})\in [{\kern 3.5pt}[ f^{k+1}(x)]{\kern 3.5pt}]$ iff $g_{k}^{-1}(h)\models \mathsf {pre}(\sigma _{e})$ and σ_e ∈Σ^k+ 1 (∗). Assume ∃h^′∈ H : h^′e ∈ H and let h ∈ H such that h^′∗h.

⇒: Assume for some $k\in \mathbb {N}$ that (H_k, h)⊧δ_e. Then $g_{k}^{-1}(h)\models \mathsf {pre}(\sigma _{e})$. By assumption, σ_e ∈Σ_k+ 1. By (∗), thus $(g_{k}^{-1}(h),\sigma _{e})\in [{\kern 3.5pt}[ f^{k+1}(x)]{\kern 3.5pt}]$. Therefore, he ∈ H.

⇐: Assume he ∈ H. Then for some $k\in \mathbb {N}$, $g_{k+1}^{-1}(he)=(g_{k}^{-1}(h),\sigma _{e})\in [{\kern 3.5pt}[ f^{k+1}(x)]{\kern 3.5pt}]$. By (∗), $g_{k}^{-1}(h)\models {{\mathsf {pre}}}(\sigma _{e})$. And thus h⊧δ_e.

Precondition Describable. :

For arbitrary he ∈ H (in specific for some $k\in \mathbb {N}$, he ∈ H_k+ 1) let $\delta _{D_{e}}=\mathsf {post}(\sigma _{e})$ where D_e = D₁ ∪ D₂, for p, q ∈Φ such that D₁ = {p : h∉V (p), he ∈ V (p)} and D₂ = {¬q : h ∈ V (q), he∉V (q)}.

Consider an arbitrary p ∈ D₁. Then by definition of the generated ETL model $(\mathcal {H},\underline {H})$, $g_{k}^{-1}(h)\not \in [{\kern 3.5pt}[ p]{\kern 3.5pt}]_{k}$ and $g_{k+1}^{-1}(he)\in [{\kern 3.5pt}[ p]{\kern 3.5pt}]_{k+1}$ (∗). By construction, $g_{k+1}^{-1}(he)=(g_{k}^{-1}(h),\sigma )$ for some σ ∈∇_k+ 1 (∗∗). By definitions of $(\mathcal {H},\underline {H})$ and ⊗, $(g_{k}^{-1}(h),\sigma )\in [{\kern 3.5pt}[ p]{\kern 3.5pt}]_{k+1}$ iff post(σ)⊧p. Then, by (∗) and (∗∗), post(σ)⊧p. As p ∈ D₁ was arbitrary, post(σ)⊧D₁.

The argument for post(σ)⊧D₂ is identical. Conclude that post(σ)⊧D_e and thus $\delta _{D_{e}}\models D_{e}$.

Point Bisimulation Invariance. :

Let arbitrary $C(\mathcal {H}h)\underline {h}=(H_{k},\underline {h})$ and $C(\mathcal {H}h^{\prime })\underline {h^{\prime }}=(H_{l},\underline {h^{\prime }})$ be such that . Hence (∗).

Further, assume for arbitrary h ∈ H_k and h^′∈ H_l that .

⇒: Assume he ∈ H. By construction of g and definition of clean maps, both H_k and H_l are connected components, i.e, ∀h, h^′∈ H_k : h^∗h^′ and idem for H_l. By the Hennessy-Milner Theorem (see Section 7), it follows that h and h^′ satisfy exactly the same modal formulas. Hence, by construction of g and the definition of $\mathcal {H}$, $g_{k}^{-1}(h)$ and $g_{l}^{-1}(h^{\prime })$ satisfy exactly the same modal formulas as well. Now as he ∈ H, $g_{k+1}^{-1}(he)\in \left [{\kern 3.5pt}[ f^{k+1}(x)\right ]{\kern 3.5pt}]$ and thus $g_{k}^{-1}(h)\models \mathsf {pre}(\sigma _{e})$. Hence $g_{l}^{-1}(h^{\prime })\models \mathsf {pre}(\sigma _{e})$ (∗∗). By (∗) and (∗∗), it follows that $(g_{l}^{-1}(h^{\prime }),\sigma _{e})\in \left [{\kern 3.5pt}[ f^{l+1}(x)\right ]{\kern 3.5pt}]$. Hence h^′e ∈ H.

⇐: By the same argument, h^′e ∈ H implies he ∈ H.

This concludes the proof of Proposition 2. □

Proposition 3

Not all saturated ETL models generated by DEL dynamical systems are Component Collection Describable.

Proof

Let Ms and f be as in Fig. 7 (cf. [56]) and X be the orbit of f from Ms. Then the ETL model generated by the DEL dynamical system (X, f) from initial model Ms is not Component Collection Describable.

Consider A = {fⁿ(Ms) : n is even}. There does not exist a φ such that for all x ∈ X, x⊧φ iff x ∈ A: Assume the modal depth of φ is k. Let m > k. Then f^m(Ms)⊧φ iff f^m+ 1(Ms)⊧φ as two such models will not differ in the first m + 1 relational steps from the point. Hence the ETL model generated by (X, f) from Ms is not Component Collection Describable. □

Fig. 7

Initial Kripke model Ms and pointed action model. The orbit of f from Ms produces non-bisimilar models forever: the unique state not satisfying p will split, inserting a new p-state as it’s child with τ; any other state gets exactly one child:

Proposition 4

If $(\mathcal {H},\underline {H})$ is a saturated ETL model that satisfies all eight properties of Section 4.2, then there exists a pointed DEL dynamical system that generates $(\mathcal {H},\underline {H})$.

Proof

Proposition 4 is shown by constructing a DEL dynamical system (X, f) with f the clean map of a X-deterministic multi-pointed action model and an initial Kripke model x ∈ X such that the saturated ETL model $(\mathcal {H}^{\prime },\underline {H}^{\prime })=(E^{\prime },H^{\prime },\mathtt {R}^{\prime },V^{\prime },\underline {H}^{\prime })$ generated by (X, f) from x is ETL isomorphic to $(\mathcal {H},\underline {H})$. The latter is shown by induction on len(h) of $h\in \mathcal {H}$ for a map γ^∗ : E→E^′. As in Def. 5, for h = e₀...e_n, write γ^∗(h) := γ^∗(e₀)...γ^∗(e_n).

As $(\mathcal {H},\underline {H})$ satisfies property Connected Time-Steps, the ETL model is a saturated component branch. To emphasize this, in this proof $(\mathcal {H},\underline {H})$ is written $(\mathcal {H}_{\mathbf {b}},\underline {H})$.

• 1. Initial Kripke model

To obtain a practical and consistent naming of states, the initial Kripke model x = ([[x]], R, [[⋅]], s) is set to be a re-naming of the initial component of b: Let $[{\kern 3.5pt}[ x]{\kern 3.5pt}]=\{\sigma _{e}:e\in \mathbf {b}_{0}\underline {h}\}$. For the relations and valuation of the initial model, simply copy over the relations and valuation from the initial component of b: For all $i\in \mathcal {A}$, let $\sigma _{e}R_{i}\sigma _{e^{\prime }}$ iff e_ie^′, and for all p ∈Φ, let σ_e ∈ [[p]] iff e ∈ V (p). Finally, let the point of x be the copy of the point of $\mathbf {b}_{0}\underline {h}$: Let $s=\sigma _{\underline {h}}$.

• 2. Constructing (X, f)

To define the DEL dynamical system (X, f), first construct a multi-pointed action model . In words, construct so that for each time-step b_k of the component branch b, Γ contains a designated action $\underline {\sigma }_{k}$ connected to a set of actions [[Σ_k]] ⊆ [[Σ]] such that the single -pointed action model ${\Sigma }^{\prime }{{~}_{\{\underline {\sigma }_{k}\}}}$ obtained from restricting Σ to [[Σ_k]] produces the equivalent of $\mathbf {b}_{k+1}\underline {h}$ from the Kripke model-equivalent of $\mathbf {b}_{k}\underline {h}$. In the precondition of $\underline {\sigma }_{k}$, include a formula $\delta _{\mathbf {b}_{k}\underline {h}}$ characterizing $\mathbf {b}_{k}\underline {h}$. As $(\mathcal {H}_{\mathbf {b}},\underline {H})$ is Component Collection Describable by assumption, such a formula exists.

Formally, construct piece-wise as follows: Let $\mathbf {b}_{k}\underline {h}$ and $\mathbf {b}_{k+1}\underline {h}$ be given. Σ_k+ 1σ is constructed such that C(f^k(x) ⊗Σ_kσ)s^′ mirrors the structure of $\mathbf {b}_{k+1}\underline {h}$:

Let the single-pointed action model ${\Sigma }_{k+1}\underline {\sigma }_{k+1}$ be ([[Σ_k+ 1]], R_k+ 1, pre_k+ 1, $\mathsf {post}_{k+1},\underline {\sigma }_{k+1})$, given by

$$ \begin{array}{@{}rcl@{}} && \left[{\kern3.5pt}[ {\Sigma}_{k+1} \right]{\kern3.5pt}] =\left\{ \sigma_{e}:he\in\mathbf{b}_{k+1}\right\}~\text{with}~\underline{\sigma}_{k+1}=\sigma_{e}~\text{such that}~\exists h:he\in\mathbf{b}_{k+1}\cap\underline{H}.\\ &&(\sigma_{e},\sigma_{e^{\prime}})\in\mathsf{R}_{i}~\text{iff}~\exists he,h^{\prime}e^{\prime}\in\mathbf{b}_{k+1}:(he,h^{\prime}e^{\prime})\in\mathsf{R}_{i}. \end{array} $$

$$ pre(\sigma_{e})=\left\{\begin{array}{ll} \delta_{e} & \text{if }\sigma_{e}\not=\underline{\sigma}_{k+1}\\ \delta_{e}\wedge\delta_{\mathbf{b}_{k}\underline{h}} & \text{else} \end{array}\right. $$

with δ_e and $\delta _{\mathbf {b}_{k}\underline {h}}$ given by Precondition Describable and Component Collection Describable, respectively.

$\mathsf {post}(\sigma _{e})=\delta _{D_{e}}$ :

as given Postcondition Describable.

Let the multi-pointed action model be given by, for , and ${\Gamma }={\bigcup _{k:\mathbf {b}_{k}\in \mathbf {b}}\{\underline {\sigma }_{k}\}}$. This is well-defined: For pre and post, this follows from Precondition Describable and Postcondition Describable.

Let X be the closure of {x} under the operation . On X, is guaranteed to be deterministic as any two characteristic formulas $\delta _{\mathbf {b}_{k}\underline {h}}$ and $\delta ^{\prime }_{\mathbf {b}_{k^{\prime }}\underline {h^{\prime }}}$ are not simultaneously satisfiable. Finally, let f be the clean map of on X. Then (X, f) is a DEL dynamical system with x ∈ X.

• 3. Constructing the Isomorphism

Let $(\mathcal {H}^{\prime },\underline {H}^{\prime })=(E^{\prime },H^{\prime },\mathtt {R}^{\prime },V^{\prime },\underline {H}^{\prime })$ be the saturated ETL model generated by (X, f) from x. Define the two mappings: γ^‡ : E→[[Σ]] with γ^‡(e) = σ_e and γ : [[Σ]]→E^′ for γ(σ) = e_σ cf. Def. 6. From these, define γ^∗ : E→E^′ as γ^∗ := γ ∘ γ^‡.

Define subsets of E based on history length: For all $k\in \mathbb {N}$ let E₀ = {e : e ∈b₀} and E_{k+ 1 ≥ 1} = {e : h ∈b_k, he ∈b_k+ 1}⊆ E. Let $E^{\prime }_{k},k\in \mathbb {N},$ be given mutatis mutandis. Let $\gamma _{k}^{\dagger }:E_{k}\longrightarrow [{\kern 3.5pt}[{\Sigma }_{k}]{\kern 3.5pt}]$, $\gamma _{k}:[{\kern 3.5pt}[{\Sigma }_{k}]{\kern 3.5pt}]\longrightarrow E_{k}^{\prime }$ and $\gamma _{k}^{*}:E_{k}\longrightarrow E_{k}^{\prime }$ be the restrictions of γ^‡, γ and γ^∗ to E_k × [[Σ_k]], $[{\kern 3.5pt}[{\Sigma }_{k}]{\kern 3.5pt}]\times E^{\prime }_{k}$ and $E_{k}\times E^{\prime }_{k}$, respectively. Then, of course, $\gamma ^{*}=\bigcup _{k\in \mathbb {N}}\gamma _{k}^{*}$, whereby $\gamma ^{*}(e)=e^{\prime }_{\sigma _{e}}$. By induction on len(h), $h\in \mathcal {H}$, it is now shown that γ^∗ is an ETL isomorphism.

Claim: The mapγ^∗is a bijection. By the construction of γ^‡ and γ, each $\gamma _{k}^{*}$ is an injection: if e ≠ e^′, then $\gamma _{k}^{*}(e)\neq \gamma _{k}^{*}(e^{\prime })$. By construction, it is also guaranteed that $\gamma _{k}^{*}$ is a surjection: $\forall e^{\prime }\in E^{\prime }\exists e\in E:\gamma _{k}^{*}(e)=e^{\prime }$. Hence for each $k\in \mathbb {N}$, $\gamma _{k}^{*}$ is a bijection.

Furthermore, γ^∗ is a total map: if e ∈ E_k ∩ E_m, then $\gamma _{k}^{\dagger }(e)=\gamma _{m}^{\dagger }(e)$ (i.e., σ_e ∈ [[Σ_k]] ∩ [[Σ_m]]) and γ_k(σ_e) = γ_m(σ_e). Thus γ ∘ γ^‡(e) is well-defined and in $E_{k}^{\prime }\cap E_{m}^{\prime }$.

Finally, γ^∗ inherits injectivity and surjectivity from its restrictions. Hence, the map γ^∗ is a bijection.

Claim: The mapγ^∗is an ETL isomorphism. The claim is shown by 4 inductive sub-proofs.

• 1) Domain and Temporal Structure.

  Base. Let h ∈ H₀. This is the case iff γ^‡(h) ∈ f⁰(x) (by construction of initial Kripke model) iff $\gamma \circ \gamma ^{\dagger }(h)\in H^{\prime }_{0}$ (by Def. 6).

  Step. It is shown that he ∈ H_k+ 1 iff $\gamma ^{*}(he)\in H^{\prime }_{k+1}$.

  ⇒: Assume he ∈ H_k+ 1. Then h ∈ H_k. By the induction hypothesis, γ^‡(h) ∈ [[f^k(x)]]. By construction of Σ_k+ 1, γ^‡(e) ∈ [[Σ_k+ 1]]. By the same construction and Precondition Describable, γ^‡(h)⊧pre(σ_e). Hence (γ^‡(h), γ^‡(e)) ∈ [[f^k+ 1(x)]]. By Def. 6, in particular the construction of H_k+ 1, $\gamma ((\gamma ^{\dagger }(h),\gamma ^{\dagger }(e)))\in H^{\prime }_{k+1}$.

  ⇐: Assume $\gamma ((\gamma ^{\dagger }(h),\gamma ^{\dagger }(e)))\in H^{\prime }_{k+1}$. Then (γ^‡(h), γ^‡(e)) ∈ [[f^k+ 1(x)]] by Def. 6, so γ^‡(h) ∈ [[f^k(x)]] and γ^‡(e) ∈ [[Σ_k+ 1]]. By the induction hypothesis, h ∈ H_k. If he∉H_k+ 1, a contradiction is reached: pre(γ^‡(e)) is satisfied by exactly those γ^‡(h) ∈ [[f^k(x)]] such that (γ^‡(h), γ^‡(e)) ∈ [[f^k+ 1(x)]] – by the construction of action models in this proof and as $(\mathcal {H}_{\mathbf {b}},\underline {H})$ is Precondition Describable. So he ∈ H_k+ 1.

• 2) Epistemic relations.

  Base. It follows by construction of initial Kripke model and Def. 6.

  Step. It is shown that ∀he, h^′e^′∈b_k+ 1, he_ih^′e^′ iff $\gamma ^{*}(he)\mathtt {R}^{\prime }_{i}\gamma ^{*}(h^{\prime }e^{\prime })$.

  ⇒: Assume that he_ih^′e^′. By Perfect Recall, h_ih^′. By the induction hypothesis, γ^‡(h)R_iγ^‡(h^′). By construction of Σ_k+ 1, γ^‡(e)R_iγ^‡(e^′). By definition of ⊗, (γ^‡(h), γ^‡(e))R_i(γ^‡(h^′), γ^‡(e^′)). By Def. 6, γ((γ^‡(h), γ^‡(e)))_iγ((γ^‡(h^′), γ^‡(e^′))).

  ⇐: Assume γ((γ^‡(h), γ^‡(e)))_iγ((γ^‡(h^′), γ^‡(e^′))). By Def. 6, (γ^‡(h), γ^‡(e))R_i(γ^‡(h^′), γ^‡(e^′)). By definition of ⊗, both γ^‡(h)R_iγ^‡(h^′) and γ^‡(e)R_iγ^‡(e^′). So by construction of Σ_k+ 1, ∃h₁e, h₂e^′∈b_k+ 1 : h₁e_ih₂e^′. By the induction hypothesis, h_ih^′. Further, note that ∀h, h^′∈b_k : h^∗h^′. Hence, by Local No Miracles, he_ih^′, e^′.

• 3) Valuation.

  Base. It follows by construction of initial Kripke model and Def. 6.

  Step. It is shown that ∀he ∈b_k+ 1, he ∈ V (p) iff γ(he) ∈ V^′(p).

  ⇒: Assume he ∈ V (p) . Either i) h ∈ V (p) or ii) h∉V (p). If i), then by the induction hypothesis, γ ∘ γ^‡(h) ∈ V^′(p). By construction of Σ_k+ 1, post(γ^‡(e))⊮¬p. Hence (γ^‡(h), γ^‡(e)) ∈ [[p]]_k+ 1. By Def. 6, γ((γ^‡(h), γ^‡(e))) ∈ V^′(p). If ii), then by the induction hypothesis, γ^‡(h)∉ [[p]]_k. As $(\mathcal {H}_{\mathbf {b}},\underline {H})$ is Postcondition Describable, by construction of Σ_k+ 1, post(γ^‡(e))⊧p. Thus (γ^‡(h), γ^‡(e)) ∈ [[p]]_k+ 1. By Def. 6, γ((γ^‡(h), γ^‡(e))) ∈ V^′(p).

  ⇐: Assume γ((γ^‡(h), γ^‡(e))) ∈ V^′(p). Then (γ^‡(h), γ^‡(e)) ∈ [[p]]_k+ 1 by Def. 6. Again, either i) γ^‡(h) ∈ [[p]]_k or ii) γ^‡(h)∉ [[p]]_k. If i), then by the induction hypothesis, h ∈ V (p). For a contradiction, suppose he∉V (p). Then post(γ^‡(e))⊧¬p. But by construction of Σ_k+ 1, post(γ^‡(e))⊮¬p. This is a contradiction. Hence he ∈ V (p). If ii), then by the definition of ⊗, post(γ^‡(e))⊧p. By the induction hypothesis, h∉V (p). If it was the case that he∉V (p), then post(γ^‡(e))⊮p. Contradiction. Thus he ∈ V (p).

• 4) Points.

  Base. It follows by construction of initial Kripke model and Def. 6.

  Step. It is shown that $\underline {he}\in \underline {H}_{k+1}$ iff $\gamma ^{*}(\underline {he})\in \underline {H}_{k+1}^{\prime }$. Let f^k(x) = Nt and f^k+ 1(x) = Ms.

⇒: Assume $\underline {he}\in \underline {H}_{k+1}$. By the induction hypothesis, $\gamma ^{\dagger }(\underline {h})=t$. By saturation of b_k, $\exists e\in E:\underline {h}e\in \mathbf {b}_{k+1}\cap \underline {H}$. By construction of Σ_k+ 1, γ^‡(e) ∈ [[Σ_k+ 1]] and, as $(\mathcal {H}_{\mathbf {b}},\underline {H})$ is Precondition Describable, $\gamma ^{\dagger }(\underline {h})\models \mathsf {pre}(\gamma ^{\dagger }(e))$. By construction of f, f^k+ 1(x) = C(Nt ⊗ (Σ_k+ 1, γ^‡(e))) = C(N ⊗Σ_k+ 1, (t, γ^‡(e))) = Ms. By Def. 6, $\gamma (s)=\gamma (\gamma ^{\dagger }(\underline {he}))\in \underline {H}^{\prime }_{k+1}$.

⇐: Assume $\gamma (\gamma ^{\dagger }(\underline {he}))\in \underline {H}^{\prime }_{k+1}$. By Def. 6, $f^{k+1}(x)=(C(N\otimes {\Sigma }_{k+1}),(t,\gamma ^{\dagger }(\underline {e})))$. By induction hypothesis, $\gamma ^{\dagger -1}(t)=h\in \underline {H}_{k}$. By construction of the Action Model, $\gamma ^{\dagger }(\underline {e})=\gamma ^{-1}(e)$ for e such that $\exists h^{\prime }:h^{\prime }e\in \underline {H}_{k+1}$ and $h^{\prime }\in \underline {H}_{k}$. As points in H_m are unique for all m by Def. 7, h^′ must be h. Thus $he\in \underline {H}_{k+1}$.

This concludes the proof of Proposition 4.¹□

Lemma 1

If there exists an image-finite and concluding pointed DEL dynamical system that generates $(\mathcal {H},\underline {H})$, then $(\mathcal {H},\underline {H})$ is image-finite and concluding.

Proof

As the DEL dynamical system is image-finite, for all $k\in \mathbb {N}$ with f^k(x) = Ms, R_i is image-finite (for all i ∈ I). The construction of the generated ETL model (see Definition 6) ensures that for all H_k, _i is image-finite (for all i ∈ I,). Hence $(\mathcal {H},\underline {H})$ is image-finite.

If the DEL dynamical system terminates, then there is a $k\in \mathbb {N}$ such that f^k(x) is undefined. Let f^k− 1(x) = Ms and $\gamma (s)=\underline {h}$. As f^k(x) is undefined, there is no σ such that γ(s)γ(σ) ∈ H. Hence, there is no e such that $\underline {h}e\in H$. Note that by construction of $\underline {{\underline {H}}}$, for all $\underline {h}^{\prime }\in \underline {H}$: $\underline {h}^{\prime }\sqsubseteq \underline {h}$. Thus, all $\underline {h}^{\prime }\in \underline {H}$ are finite and hence $(\mathcal {H},\underline {H})$ concludes.

If the DEL dynamical system is periodic, f^k(x) = f^k+m(x) for some k ≥ 0 and m > 0. Let f^k(x) = Ms and f^k+m(x) = M^′s^′, and let $\gamma (s)=\underline {h}$ and $\gamma (s^{\prime })=\underline {h}^{\prime }$. By construction, $\underline {h}\sqsubseteq \underline {h}^{\prime }$. From Ms = M^′s^′ it follows that . Thus, all $\underline {h}^{\prime \prime }\in \underline {H}$ such that $\underline {h}^{\prime \prime }\sqsubseteq \underline {h}$ are repeating. Furthermore, note that for all $n\in \mathbb {N}$, f^k+n(x) = f^k+m+n(x). Now for arbitrary $n\in \mathbb {N}$, let f^k+n(x) = Mⁿsⁿ and f^k+m+n(x) = M^n′s^n′, and let $\gamma (s^{n})=\underline {h}^{n}$ and $\gamma (s^{n\prime })=\underline {h}^{n\prime }$. By same argument as above, $\underline {h}^{n}$ is repeating. As n is arbitrary, all $\underline {h}^{\prime \prime }\in \underline {H}$ such that $\underline {h}^{\prime \prime }\sqsupseteq \underline {h}$ are repeating. Thus, all $\underline {h}^{\prime \prime }\in \underline {H}$ are repeating and hence $(\mathcal {H},\underline {H})$ concludes. □

Lemma 2

If a saturated ETL model $(\mathcal {H},\underline {H})$ is image-finite, concluding and satisfies Connected Time-Steps, then $(\mathcal {H},\underline {H})$ is Component Collection Describable.

Proof

Let $(\mathcal {H},\underline {H})$ be an image-finite and concluding saturated ETL model. Set $\mathcal {B}:=\{C(\mathcal {H}h):h\in \underline {H}\}$, the set of all connected components in $(\mathcal {H},\underline {H})$. As all $C(\mathcal {H}h)\in \mathcal {B}$ are image-finite, by the Hennessy-Milner Theorem (see Section 7), for each pair $\underline {h}_{1},\underline {h}_{2}\in \underline {H}$ if , there exists a formula $\varphi _{\underline {h}_{1},\underline {h}_{2}}$ distinguishing between $\underline {h}_{1}$ and $\underline {h}_{2}$: $\underline {h}_{1}\models \varphi _{\underline {h}_{1},\underline {h}_{2}}$ while $\underline {h}_{2}\not \models \varphi _{\underline {h}_{1},\underline {h}_{2}}$.

Let be the equivalence class . Then, since $(\mathcal {H},\underline {H})$ is concluding, the set is finite. Therefore, the conjunction is well-defined for any $\underline {h}_{1}\in \underline {H}$. This conjunction distinguishes $\underline {h}_{1}$ from any point in $\underline {H}$ that is not bisimilar to $\underline {h}_{1}$. Denote this formula $\varphi _{\underline {h}{}_{1}}$.

Moreover, as is finite, all sets $A\subseteq \underline {H}$ for which $\underline {h}\in A$ and implies $\underline {h}^{\prime }\in A$ are finite. Hence, for any such A, the disjunction $\bigvee _{\underline {h}_{1}\in A}\varphi _{\underline {h}{}_{1}}$ is well-defined. This disjunction distinguishes the connected components in A from those not in A. □

Lemma 3

Let {(X_j, f_j)}_{j ∈ J} be minimal in generating $\mathcal {H}$ and let (X_j, f_j, x_j) generate the saturated ETL model $(\mathcal {H}_{j},\underline {H}_{j})$. Then $(\mathcal {H}_{j},\underline {H}_{j})$ is the component branch sub-model for some saturated component branch $(\mathbf {b},\underline {H})$ of $\mathcal {H}$.

Proof

Let $\mathcal {H}=(E,H,\mathtt {R},V)$ be generated by {(X_j, f_j)}_{j ∈ J}. Let b_j be the sequence of connected components $\mathbf {b}_{j,k}=C(\mathcal {H},h)$ for all $h_{k}\in \underline {H}_{j}$, ordered on history length k. Suppose for proof by contradiction that b_j is both non-maximal and finite (cf. Def. 7). As b_j is finite, there is a $k\in \mathbb {N}$ such that for all h ∈b_{j, k} there is no e ∈ E such that he ∈b_{j, k+ 1}. However, as b_j is non-maximal, there is a h ∈b_{j, k} and some e ∈ E such that $\underline {h}e\in H$. This implies that there is an ETL model $(\mathcal {H}_{j^{\prime }},\underline {H}_{j^{\prime }})$ that extends $(\mathcal {H}_{j},\underline {H}_{j})$. Hence there is a DEL dynamical system $(X_{j^{\prime }},f_{j^{\prime }})$, j^′∈ J, such that ${f_{j}^{n}}(x_{j})=f_{j^{\prime }}^{n}(x_{j})$ for all n ≤ k − 1. Hence, (X_k, f_k) is redundant in generating $\mathcal {H}$, contradicting the assumption that {(X_j, f_j)}_{j ∈ J} is minimal. Thus, $(\mathbf {b}_{j},\underline {H}_{j})$ is a saturated component branch that gives $(\mathcal {H}_{j},\underline {H}_{j})$. □

Theorem 2

Let an image-finite and concluding ETL model $\mathcal {H}$ be given. $\mathcal {H}$ is generatable up to ETL isomorphism by a family of image-finite and concluding pointed DEL dynamical systems, if, and only if, there exists a saturation of each component branch b of $\mathcal {H}$ such that $(\mathcal {H}_{\mathbf {b}},\underline {H})$ satisfies all eight properties of Section 4.2.

Proof

Left-to-right: Suppose $\mathcal {H}$ is generatable by a family of image-finite and concluding DEL dynamical systems {(X_j, f_j)}_{j ∈ J}. Let $(\mathcal {H}_{j},\underline {H}_{j})$ be the saturated ETL model generated by (X_j, f_j) (cf. Def. 6). By Lemma 3, $(\mathcal {H}_{j},\underline {H}_{j})$ is a component branch sub-model of $\mathcal {H}$ for some saturated component branch $(\mathbf {b},\underline {H}_{k})$ of $\mathcal {H}$. As $(\mathcal {H}_{j},\underline {H}_{j})$ was generated by an image-finite and concluding DEL dynamical system, the saturation $\underline {H}_{j}$ of $\mathcal {H}_{j}$ makes $(\mathcal {H}_{j},\underline {H}_{j})$ satisfy all 8 properties of Section 4.2 by Proposition 2 and Lemma 2.

Right-to-left: Let B be the set of all component branches of $\mathcal {H}$ and assume that for each b ∈ B, there exists a saturation such that $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ satisfies all eight properties of Section 4.2. As $\mathcal {H}$ is image-finite and concluding, also each $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ is image-finite and concluding. By the constructions in the proof of Prop. 4, it follows that each $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ is generatable up to ETL isomorphism by a DEL dynamical system that is image-finite and concluding.

Let (X_b, f_b, x_b) be the pointed DEL dynamical system that generates $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ up to isomorphism, as given by the construction in the proof of Prop. 4. Let $(\mathcal {H}^{\prime }_{\mathbf {b}},\underline {H}^{\prime }_{\mathbf {b}})$ be the specific ETL model generated by (X_b, f_b, x_b), as given by Def. 6. It will now be shown that the union structure U_B = (E_B, H_B, _{B, i}, V_B)_{i ∈ I} of $\{(\mathcal {H}^{\prime }_{\mathbf {b}},\underline {H}^{\prime }_{\mathbf {b}})\}_{\mathbf {b}\in \mathbf {B}}$ is isomorphic to $\mathcal {H}=(E,H,\mathtt {R}_{i},V)_{i\in I}$. To this end, the existence of a bijection g : H→H_B will be shown.

Let g_b be the isomorphism between $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ and $(\mathcal {H}^{\prime }_{\mathbf {b}},\underline {H}^{\prime }_{\mathbf {b}})$, guaranteed to exist by Prop. 4 and specifically given by 1) the construction of a DEL dynamical system from a saturated component branch of the proof of Prop. 4 and 2) the construction for generating an ETL model from a DEL dynamical system of Def. 6. Combining the state-history naming schemes used in these two constructions yield g_b given by

$$ \begin{array}{@{}rcl@{}} g_{\mathbf{b}}(h)= & \left\{\begin{array}{ll} e^{\prime}_{\sigma_{h}} & \text{if }len(h)=1\\ g_{\mathbf{b}}(h^{\dagger})e^{\prime}_{\sigma_{e}}\text{ with }h=h^{\dagger}e & \text{else} \end{array}\right. \end{array} $$

The history names from $\mathcal {H}_{\mathbf {b}}$ are hereby carried over as indices to the histories of $\mathcal {H}^{\prime }_{\mathbf {b}}$.

Define the mapping g : H→H_B by g(h) = g_b(h) for $h\in \mathcal {H}_{\mathbf {b}}$. This mapping is well-defined as either i) for exactly one b ∈B, $h\in \mathcal {H}_{\mathbf {b}}$ (in which case g(h) is well-defined), or ii) if $h\in \mathcal {H}_{\mathbf {b}}$ and $h\in \mathcal {H}_{\mathbf {b^{\prime }}}$, then $g_{\mathbf {b}}(h)=g_{\mathbf {b}^{\prime }}(h)$. The latter is ensured as history names are carried over in exactly the same way by g_b and $g_{\mathbf {b}^{\prime }}$, by construction. Hence $g=\bigcup _{\mathbf {b}\in \mathbf {B}}g_{\mathbf {b}}$ is a well-defined map. It is an injection: For h ∈ H and h^′∈ H, if h ≠ h^′, then g(h)≠g(h^′) by the unique naming convention of the maps g_b, b ∈B. It is also a surjection: it is well-defined and |H| = |H_B| as by construction $|H^{\prime }_{\mathbf {b}}|=|H{}_{\mathbf {b}}|$ for all b ∈B, and $H=\bigcup _{\mathbf {b}\in \mathbf {B}}H{}_{\mathbf {b}}$ and $H_{\mathbf {B}}=\bigcup _{\mathbf {b}\in \mathbf {B}}H^{\prime }_{\mathbf {b}}$. Hence g is a bijection.

That g is also the sought ETL isomorphism follows as $(\mathcal {H}_{\mathbf {b}},\underline {H}_{\mathbf {b}})$ is isomorphic to $(\mathcal {H}^{\prime }_{\mathbf {b}},\underline {H}^{\prime }_{\mathbf {b}})$, for all b ∈B, cf. Prop. 4. This completes the proof. □

Lemma 4

The saturated ETL model properties Synchronicity, Perfect Recall and Postcondition Describable persist under ETL model union.

I.e.: Let $\{(\mathcal {H}_{j},\underline {H}_{j})\}_{j\in J}$ be a countable set of saturated ETL models. If all $(\mathcal {H}_{j},\underline {H}_{j})$ satisfy either of the mentioned properties, then the (unsaturated) union structure U_J satisfies that property.

Proof

Synchronicity, Perfect Recall and Postcondition Describable persist because they are defined on histories which occur uniquely in the ETL forest, which makes them local by nature. Hence these properties are evaluated locally within a branch to ensure that there will be no conflicts when taking the union of different ETL sub-models.□□

Property 5

Local No Miracles, Precondition Describable, Point Bisimulation Invariance and Connected Time-Steps do not persist under union.

Proof

Local No Miracles does not persist under union: Consider a family of two DEL dynamical systems (that each individually satisfy property Local No Miracles.) with multi-pointed action models f and g with equal initial Kripke model x = {h, h^′, h₁, h₂} where h_ih^′ and h^∗h₁ (by default, as initial models are connected), but disjoint Kripke models at the next level: f¹(x) = {he, h^′e^′} and g¹(x) = {h₁e, h₂e^′} where h₁e_ih₂e^′ while not he_ih^′e^′. In this example, Local No Miracles fails because not he^∗h₁e.

Precondition Describable does not persist under union: Consider a family of two DEL dynamical systems (that each individually satisfy property Precondition Describable) with multi-pointed action models f and g with equal initial Kripke model x = {h, h^′} with h^∗h^′ (by default as initial models are connected), but disjoint Kripke models at the next level: f¹(x) = {he} and g¹(x) = {h^′e}. Then it is possible that h^′⊧δ_e while h⊮δ_e, which breaks property Precondition Describable. It is left as an open question whether a suitably weakened version of Precondition Describable exists.

That Point Bisimulation Invariance is not preserved under union follows as the property is stated based on a saturation, but the union structure is unpointed, and hence unsaturated. If the union structure would be pointed with the set of points chosen as the union of the sets of points from the united ETL models, then the resulting set of points need not be a saturation, as the united ETL models may overlap, but have distinct points. In that case, the union structure would be “oversaturated”.

Connected Time-Steps does not persist under union as histories within the same time-step are no longer necessarily epistemically connected in a union of disconnected ETL sub-models. □

Proposition 5

If an ETL model $\mathcal {H}$ is generated by a family of pointed DEL dynamical systems (possibly neither image-finite nor concluding), then $\mathcal {H}$ satisfies Synchronicity, Perfect Recall, Postcondition Describable and Very Local No Miracles and Local Bisimulation Invariance.

Proof

That $\mathcal {H}$ satisfies Synchronicity, Perfect Recall and Postcondition Describable follows from Prop. 2 and Lemma 4.

That $\mathcal {H}$ satisfies Very Local No Miracles follows directly by the additional requirement compared to Local No Miracles that he^∗h₁e.

That $\mathcal {H}$ satisfies Local Bisimulation Invariance follows as 1) any ETL model that satisfies Point Bisimulation Invariance also satisfies Local Bisimulation Invariance, 2) Local Bisimulation Invariance is a property local to a connected component, and 3) connected components remain untouched under union.□