Workshop on Logic and Games

Gabriel Sandu and Marc Pauly

ESSLLI’01

August, 2001Helsinki, Finland

Contents of this reader

Dietmar Berwanger: Game logic is strong enough for parity games

Valentin Goranko: The basic algebra of game equivalneces

Yde Venema: Representing game algebras

Ahti Pietarinen: Varieties of IFing

Theo Janssen: On the definition of independence in logic

Hans van Ditmarsch: The semantics of concurrent knowledge actions

Joanna Golinska: On which operations are spectra of formulae with Henkin quantifiers closed?

Gregory McColm: Game representations of complexity classes

Andrea Formisano: The edge of 3-variable-inexpressibility beside Tarski’s Peircean formulation of set-pairing

Nicolas Shilov: Games with second-order quantifiers which decide propositional program logics

Game Logic is Strong Enough for Parity Games

Dietmar Berwanger�

Mathematische Grundlagen der InformatikRWTH Aachen

Abstract

This paper is concerned with the expressive power of Parikh's Game Logic inter-

preted in Kripke structures. We show that the syntactical alternation hierarchy of

this logic is strict, by expressing the winning condition for parity games with n prior-

ities. Moreover, it follows that Game Logic is not captured by any �nite level of the

�-calculus alternation hierarchy. We can further conclude that model checking for the

�-calculus is eÆciently solvable i� this is possible for Game Logic.

1 Introduction

Game Logic was developed by Parikh [Par85] for reasoning about neighborhoodmodels, a generalisation of Kripke structures, viewing accessibility as a relationbetween sets of worlds. His formalism extends propositional logic by additionof modal operators whose meanings are assigned by games. Speci�cally, path-forming games for two players are described and the modality re ects the issueof a player to have a winning strategy.

Broadening the game-theoretic perspective, the preservation properties forbisimulation shown by Pauly [Pau00] conveyed Game Logic to the scope of pro-cess theory. Since bisimulation captures the idea of behavioral process equiva-lence, the framework of program speci�cation and veri�cation relies on descrip-tion formalisms which respect this equivalence. In that framework, programstates are often associated to the worlds of a Kripke structure while the statetransitions are modeled by the (binary) accessibility relation.

When interpreted in Kripke structures, as we do in this paper, Game Logic(GL) resembles the Propositional Dynamic Logic (PDL) of Fischer and Ladner.Actually, the only game construction of GL not shared by PDL is the dualizationoperator, expressing a role interchange between the players. However, as weshall prove, this ability of modal negation, invests GL with hardly foreseeableexpressive power.

A useful yardstick for the measure of expressiveness over Kripke models isprovided by the modal �-calculus (L�), the extension of basic modal logic byleast and greatest �xed point constructions. On the one hand, as demonstratedby Janin and Walukiewicz [JW96], this logic is as strong as monadic second-order logic in describing programs up to bisimulation equivalence. On the otherhand, L� displays a hierarchical structure, induced by the number of syntactical

�E-mail: berwanger@informatik.rwth-aachen.de

1

alternations between �xed point operators, which Brad�eld [Bra96] and Lenzi[Len96] have shown to be semantically strict.

Interestingly, most of the formalisms commonly used for process descriptionallow translations into low levels of the L� alternation hierarchy. On its �rstlevel this hierarchy already captures, for instance, PDL as well as CTL, anotherpopular process logic, while their expressive extensions �PDL and CTL� do notexceed the second level.

Still, the low levels of the hierarchy do not exhaust the signi�cant propertiesexpressible in L�. A comprehensive example of formulae strictly distributedover all levels of the alternation hierarchy regards parity games. Thus, strictlyon level n, there is a formula stating that the �rst player has a winning strategyin parity games with n priorities.

Clearly, Game Logic over Kripke structures is subsumed by L�. Moreover, itturns out that every GL-formula can be translated into an equivalent L�-formulawhich uses at most two monadic variables. Though, by alternately nesting thescope of the two variables, formulae of any syntactical alternation level canbe obtained. But note, that the syntactical appearance of a formula does notprovide direct evidence of its hierarchical position. For instance, the fragmentL2 of the �-calculus, introduced in [EJS93], covers all levels of the syntactichierarchy, but, as it was shown in [NS99], all its formulae can be equivalentlytranslated into formulae on the second level. In the light of this antecedenceand the aforementioned results about process logics, one might conjecture that

(1) the two-variable fragment of L� is subsumed by a �nite level of the alter-nation hierarchy and, therefore,

(2) GL is subsumed by a �nite level of the L� alternation hierarchy.

We prove that this is not the case. GL, and hence also the two-variablefragment of L� are suÆciently powerful to express winning conditions of paritygames with arbitrary high indices. Thus, GL contains formulae at arbitrarylevels of the alternation hierarchy of the �-calculus, and the alternation hierarchyof GL is strict.

1.1 Outline

In the background section, we give a brief introduction into Game Logic andparity games. We assume that the reader is familiar with the �-calculus. Foran extensive survey see, e. g., [AN01] or [Eme97].

In the third section we show that in L� the formula expressing that the �rstplayer has a winning strategy in parity games with n priorities can be equiva-lently written with only two variables. As a consequence, we obtain that thealternation hierarchy of two-variable fragment of L� is strict and not subsumedby any �nite level of the L� alternation hierarchy.

Towards a common framework for comparing GL to L�, we introduce, inSection 4, an interpretation of Game Logic in terms of parity games. At handwith this, we construct in Section 5 a GL-formalization of the winning condi-tion in parity games with n priorities. Besides strictness of the GL-alternationhierarchy, this construction also shows that model checking for L� can be donein polynomial time i� eÆcient model checking for Game Logic is possible.

2

2 Background

2.1 Game Logic over Kripke structures

De�nition 1. Departing from a set P of atomic propositions p and a set G ofatomic games g, the formulae of GL are composed according to the followingrules

' := ? j p j :' j ' _ ' j h i' ;

:= g j '? j ; j [ j � j d:

Throughout this paper we consider interpretations of these formulae overunimodal Kripke structures A; v with A = (A;E; (Ap)p2P ). Consequently, Gconsists of a single atomic game g.

Intuitively, the meaning of GL-formulae in a rooted Kripke structure can beunderstood by way of games between two players, angel and demon. Typically,h i' expresses that angel has a strategy to play the game starting at v in sucha way that either ' is true when the game ends, or the game breaks and demonfails. The game-forming rules can be read as follows. 1; 2 means: play 1 �rst,then 2; in 1[ 2 angel �rst chooses one of 1 and 2 and then the chosen gameis played; in �, the game is reiterated, while angel can decide before eachround whether a new round is to be played; in ('?) an independent observerchecks whether ' holds. If so, the play just ends, otherwise it breaks and angellooses. In the atomic game g angel can move to some position reachable fromthe current position. Finally, the dual game d means that the two players swaptheir roles and then is played.

We will not formally de�ne the semantics here. Instead, in Section 4 weprovide an interpretation of GL in terms of parity games, which is equivalentto the standard semantics over Kripke structures as introduced in [Pau99].

To enhance readability we assign precedence to the operators: unary opera-tors bind tighter than binary ones and ; binds tighter than [. Additionally, wede�ne dual operators as a shorthand

'1 ^ '2 := :(:'1 _ :'2) > := :?

1 \ 2 := ( d1 [ d2 )

d Æ := ( d)�d

Using this notation, each game can be equivalently written in such a waythat tests apply only to ?, >, atomic, or negated atomic propositions as follows:

('1 _ '2)? � '1? [ '2? (:')? � ('? d;??) \ >?

('1 ^ '2)? � '1? \ '2? (h i')? � ;'?

This transformation allows us to detangle formulae and games for inductivereasoning. Further, we can exploit the equivalences

:h i' � h di:' '?d � (:'? ;?? d) [>?

( 1; 2)d � d1 ;

d2 ( �)d � ( d)Æ

to bring any GL-formula into a normal form where negation applies only toatomic propositions, and game dualization only to atomic and surrender (??)games.

3

2.2 Parity games and the modal �-calculus

De�nition 2. The formulae of the modal �-calculus L� are constructed withatomic propositions p from a given set P and propositional variables X from agiven set Q according to the grammer:

' := ? j p j X j :' j ' _ ' j 3' j �X:';

where the �xed point rule �X:' applies to formulae '(X) in which the freevariable X appears only positively, that is, under an even number of negations.

To de�ne the meaning of a formula ' under a variable assignment � in agiven Kripke structureA = (A;E; (Ap)p2P ), we describe its extension [[']]�, thatis, the set of worlds in A where ' holds when its free variables are interpretedaccording to �. Thus, atomic propositions p extend to the sets Ap in A, ? tothe empty set, and the extension of free variables X is given by �(X). For thepropositional and modal operators we have

[[:']]� := A n [[']]� ;

[['1 _ '2]]� := [['1]]� [ [['2]]� ;

[[3']]� := f a : (9b: (a; b) 2 E) b 2 [[']]� g :

For a formula �X:', consider the operator '(�) which maps every B � A to theextension [[']]�[X=B] obtained with the assignment � when the value of X is setto B. By the requirement on ' to contain X only positively, this operator ismonotone and hence it has a least �xed point, by the Knaster-Tarski theorem.This provides the semantics of the � operator:

[[�X:']]� :=[

fB � A : B = [[']]�[X=B] g:

The operators ^, 2, and � are introduced as abbreviations to the dual of _, 3,and �, respectively. In this way, �X:' := :�X::'[:X=X ] is interpreted as thegreatest �xed point of '(�).

It is not hard to see that every GL-formula can be translated into an equiv-alent L�-sentence. Furthermore, the following construction, quoted from a pri-vate communication of Marc Pauly, shows that the image of this translation canbe kept within the two-variable fragment of L�.

First, games are translated into L�-formulae with one free variable X or Y ,which are repeatedly reused. This is accomplished by two mappings, �X and �Y ,between GL-games and L�-formulae:

gX := 3X gY := 3Y

( 1 [ 2)X := X1 _ X2 ( 1 [ 2)

Y := Y1 _ Y2

( 1; 2)X := X1 [X := X2 ] ( 1; 2)

Y := Y1 [Y := Y2 ]

('?)X := '] ^X ('?)Y := '] ^ Y

( d)X := : X [X := :X ] ( d)Y := : Y [Y := :Y ]

( �)X := �Y:X _ Y ( �)Y := �X:Y _ X

4

At hand with these, the translation �] associates to any GL-formula an L�-sentence as follows:

p] := p

(:')] := :']

('1 _ '2)] := ']1 _ '

]2

(h i')] := X [X := ']]

Please note, that the translation rule for choice games introduces two oc-curences of the free variable. In the substitution process for the game modalitythese are both replaced by the same expression, thus leading to a possibly ex-ponential blow-up of the obtained L�-sentence. However, this phenomen canbe avoided by translating into the equational �-calculus rather than its linearvariant.

An important framework for the analysis of L� is provided by parity games.

De�nition 3. A parity game is given as a rooted Kripke structure G; v0 with

G = (V; V3; E;);

where V is a set of positions with a designated subset V3, E � V � V is atransition relation, and = (i)1�i�n is a coloring of V with priorities 1; : : : ; ndetermining the winning condition. We denote the set V nV3 by V2; the numbern of priorities is called the index of G.

In a play of G; v0 two players, 3 and 2, move a token along the transitionsof E starting from v0. Once a position v is reached, player 3 performs themove if v 2 V3, otherwise player 2. If the current position allows no furthertransitions, then the player in turn to move looses. In case this never happens,the play is in�nite. Since there are �nitely many priorities, the token will meetsome of them in�nitely often. We look at the least among these priorities: if itis an even number, player 3 wins, otherwise he looses.

For these games we only need a simple notion of a strategy.

De�nition 4. A memoryless strategy for player 3 in the parity game G; v0 is afunction � : V3 ! V assigning to each position v 2 V3 some successor w 2 vE.

The strategy is winning if player 3 wins every play of the game G� ; v0obtained by removing from G the transitions (v; w) from v 2 V3 to w 62 �(v).

Theorem 5 (Memoryless determinacy [EJ91]). In any parity game, either

player 3 or player 2 has a memoryless winning strategy.

Parity games are tightly connected with the �-calculus, some authors evensay parity games are �-calculus. This assumption has several reasons. Forinstance, as proven by Emerson, Jutla, and Sistla, model checking for the �-calculus can be reduced to the problem of deciding the winner of a parity game.

Theorem 6 ([EJS93]). For every structure A; v and formula 2 L� a parity

game G(A; ; v) can be constructed in linear time, such that player 3 has a

winning strategy in this game i� A; v j= .

5

For given in an adequate normal form, so that negation applies to atomicpropositions only and every �xed point variable has a unique binding de�nition,the game G(A; ; v) can be described as follows. The set of positions is

V = f('; a) : ' is a subformula of and a 2 Ag;

whereof V3 holds the positions ('1 _ '2; a), (3'; a), (p; a) with a 62 Ap, and(:p; a) with a 2 Ap. All plays start at ( ; v) and transitions in E are such that

� no moves are possible from (�; a) where � is atomic or negated atomic;

� from ('1 _ '2; a) or ('1 ^ '2; a) transitions lead to ('1; a) and ('2; a);

� from (3'; a) or (2'; a) there are transitions to all positions ('; b) with ba successor of a.

� from (�T:'; a) or (�T:'; a) there is a transition to ('; a);

� from (T; a) with T a �xed point variable de�ned as (�T:'; a) or (�T:'; a)a transition leads to ('; a).

In order to de�ne the coloring of V , let us assume that the �xed point variablesof appear in the order T1; : : : ; Tk. Then, each position (Ti; a) is assigned topriority 2i+ 1 if Ti is a least �xed point variable or to priority 2i+ 2 if Ti is agreatest �xed point variable. All remaining positions receive priority 2k+ 2. Asparer assignment could manage with n priorities when the formula is on then-th L� alternation level.

As a converse to the above result, Emerson and Jutla showed that the prob-lem of establishing whether player 3 has a winning strategy in a given paritygame can be equivalently viewed as a model checking problem for L�.

Theorem 7 ([EJ91]). There is a formula Wn 2 L�, such that in any parity

game G; v0 with n priorities player 3 has a winning strategy i� G; v0 j= Wn.

We give a variant of the formula Wn here.For convenience, let us abbreviate the formula expressing that player 3 can

ensure that a position where ' holds is reached in one move by

.' := (V3 ^3') _ (V2 ^ 2'):

Further, we write >i forWnk=i+1k. Empty disjunctions, like >n , are by

default false. In longer formulae we sometimes omit the ^ symbol and write,e.g., i.' for i ^ .'.

For simplicity, let us assume that n is odd.

De�nition 8. The formula Wn expressing that player3 has a winning strategyin a parity game with n priorities is

Wn := �Z1�Z2 : : : �Zn:

n_i=1

i ^ .Zi:

To understand this expression, let us consider the formulaeWi(') describingthose positions from which player 3 can ensure that

1. either he wins while no priority less than i is ever played, or

2. some position where ' holds is being reached.

6

We obtain for odd i

Wi(') := �Z:Wi+1(' _i ^ .Z);

and for even i

Wi(') := �Z:Wi+1(' _i ^ .Z):

Thus, the above expression for Wn is given by W1(?).As shown by Brad�eld, these formulae are hard instances of the �-calculus

alternation hierarchy.

Theorem 9 ([Bra96]). For any number n, the formula Wn is contained on the

n-th level of the �-calculus hierarchy but there is no formula equivalent to Wn

at level n� 1.

3 Deciding the winner in parity games with two

variables

In this section we rule out the expectation that the weakness of GL can beproved via its translation into the two-variable fragment of L�.

Given n, consider the following formulae for i = 1; : : : ; n

'i(X) := �Y:�(i ^ .Y ) _ (<i ^X) _ (>i ^ 'i+1(Y ))

�when i is odd and, otherwise,

'i(Y ) := �X:�(i ^ .X) _ (<i ^ Y ) _ (>i ^ 'i+1(X))

�:

By removing the conjunctions with <1 and >n from '1 we obtain an L�-sentence which, obviously, does not use more than two variables. Let us denotethis sentence by Wn

(2).

Example. For n = 3 we get

�X:�1.X _>1�Y:

�2.Y _<2X _>2(�X:3.X _<3Y )

��:

Proposition 10. On every parity game of index n we have Wn(2) �Wn.

Proof. For A; v a parity game of index n, let us consider the model checkinggames G := G(A;Wn; v) and G(2) := G(A;Wn

(2); v). Our aim is to show thatPlayer 3 either has a winning strategy in both games or in none of them.

Inspecting the structure of G, we can observe that a winning strategy forplayer 3 is completely speci�ed by the transitions of type (a;3Zi) ! (b; Zi)where i is the priority of a. At every other position (c; �) where 3 has to choose,her choice is already pre�gured in the label of c. Of course, knowing the meaningof Wn, it is no surprise that the choices in the game G boil down to choices in A.

On the other hand, it is easy to verify that the actual choices in the gameG(2) are structure choices as well. Here, they are of the shape (a;3Z)! (b; Z)with Z = X when the priority of a is even and Z = Y otherwise.

But this means that any winning strategy of Player 3 in G can be pro-jected without loss onto a winning strategy on A, which on his part completelydescribes a winning strategy in G(2).

In the same way, it follows that a winning strategy for Player 3 in G(2) canbe translated via A into a winning strategy in G.

7

Since Wn(2) and Wn are both on the n-th level of the L�-hierarchy the fol-

lowing result is immediate.

Theorem 11. The alternation hierarchy of the two-variable fragment of L� is

strict and not contained in any �nite level of the full logic.

4 Parity semantics for Game Logic

In order to provide a common ground for comparing Game Logic to L� we willgive a reading of the semantics of GL in terms of parity games. In contrastto the standard semantics, we expect from this approach to give us access notonly to the truth value of a GL-sentence in a given structure, but also to itsjusti�cation in the form of a proof or rejection.

To be more precise, for a given structure A and a formula 2 L�, a winningstrategy for player 3 in the model checking game G(A; ; v) can be viewed as aproof of A; v j= in an interactive proof system. Acting as a prover, player 3can convince the veri�er, player2, that holds at v, by choosing according to itsstrategy whenever a disjunction or an existential subformula of is considered.In the same way, a memoryless winning strategy for player 2 can be seen as arejection of A; v j= .

Thus, a model checking game for GL similar to the corresponding game forL�, could open the way for the translation of proofs of GL-formulae into proofsof L�-formulae and vice versa, in order to compare their model classes. As thestandard semantics of GL the meaning of games is given by predicate trans-formers, functions on the powerset of the universe, a straightforward approachto verify the validity of a sentence by constructing such functions would be veryineÆcient. In contrast to these, winning strategies for model checking gamesare considerably smaller objects.

At this point we could rely on the games obtained via the translation of GLinto L�, but we choose to avoid this detour for a better understanding.

De�nition 12. Given a formula 2 GL in negation normal form, we de�neits closure cl( ) as the smallest set which contains and is closed under thefollowing operations:

(i) taking of subformulae: for each ' 2 cl( ) any subformula � of ' is alsocontained in cl( );

(ii) game choice: for each h 1 [ 2i' 2 cl( ) we have fh 1i'; h 2i'g � cl( )and likewise for \;

(iii) unrolling: for each h �i' 2 cl( ) also h ; �i' 2 cl( ) and likewise for Æ;

(iv) splitting: for each h 1; 2i' 2 cl( ) also h 1ih 2i' 2 cl( ):

It is not hard to verify that jcl( )j is bounded by O(j j), where j j is thenumber of symbols in .

De�nition 13. To any rooted structure A; v0 and formula 2 GL we associatea parity game G(A; ) with positions

V := f('; a) : 2 cl( ) and a 2 Ag:

Thereof, player 3 holds all positions where the formula is of the shape

? j '1 _ '2 j h�?i' j hgi' j h 1 [ 2i' j h �i'

8

with � standing for ?, > and atomic propositions, possibly negated. Addition-ally, V3 includes

f(p; a) : a 62 Apg [ f(:p; a) : a 2 Apg:

The remaining positions belong to player 2. All plays start at position ( ; v0).The transitions are given as follows.

� From positions (?; a), (>; a), (p; a), or (:p; a) no moves can be done.

� From ('1_'2; a) or ('1^'2; a) two transitions lead to ('1; a) and ('2; a).

� From (h�?i'; a) there is a transition to ('; a), if one of the following holds:

{ � is > or >d;

{ � is p or pd and a 2 Ap;

{ � is :p or (:p)d and a 62 Ap.

Otherwise, no moves can be done.

� From (h 1 [ 2i'; a) transitions lead to (h 1i'; a) and (h 2i'; a).

� From (hgi'; a) there are transitions to each of f('; b) j (a; b) 2 Egg.

� From (h �i'; a) or (h Æi'; a) two transitions lead to ('; a) and (h ; �i'; a).

� From (h 1; 2i; a) there is a transition to (h 1ih 2i'; a).

In order to assign the priorities we �rst introduce a measure for the nestingof alternating stars in GL-games.

De�nition 14. For GL-games in negation normal form we de�ne the followingstar alternation hierarchy:

(i) The �rst level of the hierarchy, ��0 = ��

0 , consists of the �- and Æ-freegames.

(ii) For every higher level, ��i+1 is formed by closing ��

i [ ��i under ; , \, [

and �.

(iii) The level ��i+1 is obtained dually, by closing under Æ instead of �.

Only the positions of the form (h �i'; a) or (h Æi'; a) receive signi�cantpriority colorings. Towards this, we look at the least i such that 2 �i[�i andassign (h �i'; a) to 2i+1 or, respectively, (h Æi'; a) to 2i+2. All remainingpositions are set to some irrelevantly high priority.

Instead of G(A; ); ( ; v0) we will usually write G(A; ; v0).

Theorem 15. A formula 2 GL holds in a rooted structure A; v0 i� player 3

has a winning strategy in the game G(A; ; v0).

We will not give the proof in this place. A straightforward approach usesthe translation of GL into L�.

Note, that the number of positions in G(A; ; v0) is bounded by O(jAj � j j).Since the problem, whether player 3 has a winning strategy in a parity game isknown to be in NP \ Co-NP we can immediately conclude

Corollary 16. The model checking problem for GL over �nite structures is in

NP \ Co-NP.

9

5 The alternation hierarchy of Game Logic

The alternation levels of the L� hierarchy keep track of the number of nestedalternations between least and greatest �xed point operators. In GL, when for-mulae are represented in negation normal form, this corresponds to the nestingof � and Æ operators within the game modalities. We can thus extend the starhierarchy over games from De�nition 14 to a hierarchy over formulae.

De�nition 17. The alternation hierarchy of GL is the sequence (�i)i<! of setsconsisting of formulae in negation normal form, such that

2 �i i� f : h i' 2 cl( ) g � ��i [�

�i :

To populate this hierarchy we follow the lines of the construction of W(2) toformulate the winning condition for player3 in a parity game A = (V; V3; E;)with n priorities.

Like in the explanation to De�nition 8, we will construct games i over theKripke stucture A for which the angelic player has a strategy i� he can ensurein each play of the parity game A that he either wins, or the play reaches apriority less than i. Then, 1 will be the formula we are looking for.

Let f be the composite game corresponding to the .-operator in the previoussection:

f := V3?; g [ V2?; gd

Assuming n is odd, consider the sequence ( i)1�i�n of GL-games starting with

n := (n?; f)�;<n?

and, for any even index i < n,

i :=��i?

d; (i?; f [>i?; i+1)�Æ;<i?

d

while for i < n odd,

i := (i?; f [>i?; i+1)�;<i?

Before we proceed, let us understand which options the players actually havein a game i. First, for a player to hold the star (or circle) means only littlechoice, since he can stop iterating i only when some priority less then i is seen.This is required by the guards <i? and <i?

d at the exit point. But notethat, in that case he is forced to stop iterating. For the demonic player this isstated explicitely by the condition �i at the entrance of the iteration, when iis even. For the angelic player however, this guard needs not to be set as he hasto make his choices in such a way that f is �nally being played and it doesn'thelp to cheat at that point: if the current position in A has priority j he willalways choose towards reaching the subgame (j?; f) in j . Since all [ choicesare determined by the value of j, entering a game i with i < j would leadplayer 3 to fail the test after his next [ choice. Thus, the actual choices takeplace in the structure, that is, when f is being played.

We are interested in 1. Please note, that the meaning of any formula h 1i'does not depend on ', since 1 is either �nished by surrender or it never ends.Thus, we denote h 1i> by Wn

� .

10

Example. For n = 3 we obtain, by replacing <1 with ? and ommitting the ;operator,

��1?f [>1?

��2?

d�2?f [>2?(3?f)

�<3?��Æ

<2?d

��?

�>

Proposition 18. For every parity game A; v of index n we have

A; v j= Wn� i� A; v j=Wn:

Proof. Our intention is to translate the proof of Wn on A; v into a proof of Wn�

on the same structure, and vice versa. Towards this, we look at the model check-ing games resulting from the two formulae G := G(A;Wn; v), and respectively,G� := G(A;Wn

� ; v). Hereon, the proofs appear as winning strategies. Thus,we can rephrase our aim in terms of parity games: If player 3 has a winningstrategy in G then he also has a strategy in G� (and we are able to constructit), and vice versa.

Let us assume that A; v satis�es Wn, i.e., player 3 has a winning strategy� in A; v. Hence, he also has a winning strategy � in G. As we have seen in theproof of Proposition 10, the relevant advices of � are all transitions of the type(a;3Zi)! (b; Zi) where is i the priority of a. In other words, the strategy � ofplayer 3 in G is uniquely determined by his strategy � in A; v.

Now, getting back to GL, in the light of the above remarks concerning thefreedom of choice in i, we can see that for any winning strategy of player 3in G� the relevant choices are structure choices of the type (a; g; �i) ! (b; �i)where, for i the priority of a (assumed odd),

�i = h(i?; f [>i?; i+1)�;<i?; i�1; i�2; � � � 1i>:

Let us consider the strategy �� for player 3 in G� which works like � (and �)on structure choices while preventing him on formula choices (� or \) to loosewhithin the next two steps.

Clearly, �� carries precisely the same information as � . In fact, both strate-gies mirror the winning strategy � on A; v. It is easy to verify that the prioritiesare assigned in a compatible way in G and G�, such that the set of games ob-tained with these strategies are essentially the same for both model checkinggames, consequently, all wins for player 3.

By the same token, we can also show conversely, that a winning strategy forplayer 3 in G� can be transferred via projection onto A; v to a winning strategyin G which concludes the proof.

Since the formula Wn is strict for the n-th level of the L� alternation hier-archy, we can immediately draw the following consequence.

Theorem 19. No �nite level of the �-calculus alternation hierarchy captures

the expressive power of GL.

Obviously, Wn� is contained in �n. Since the translation of GL-formulae into

L� preserves the alternation level, that is, the number of alternated nestings of� and Æ translates into the same number of nested least and greatest �xed pointoperators, and the L� alternation hierarchy is strict, no GL-formula 2 �n�1

can be equivalent to Wn� .

11

Theorem 20. The alternation hierarchy of Game Logic is strict.

Finally, observe that the length of Wn� is at most quadratical in n. Knowing

that model checking of an L�-formula of alternation level n in a structure A; vcan be reduced to the problem of establishing whether player 3 has a winningstrategy in G(A;Wn; v), or equivalently, to the model checking problem forGame Logic G(A; ; v) j= Wn

� , we can state:

Theorem 21. Model Checking for the �-calculus can be performed eÆciently

i� this is the case for Game Logic.

Although the above results show that we can de�ne classes in GL which arearbitrarily hard for L�, a hint not to underestimate its expressive power, thequestion whether Game Logic attaines the full power of L� remains open. Apossible research direction is the investigation of the variable hierarchy of L�.Even if it seems unlikely that this hierarchy collapses on the second level, wehave no evidence yet to separate L� from its two-variable fragment.

References

[AN01] Andr�e Arnold and Damian Niwi�nski. Rudiments of �-calculus, volume 146of Studies in Logic. North Holland, 2001.

[Bra96] Julian C. Brad�eld. The modal mu-calculus alternation hierarchy is strict.In Ugo Montanari and Vladimiro Sassone, editors, Proceedings of the 7th

International Conference on Concurrency Theory, CONCUR '96, volume1119 of Lecture Notes in Computer Science, pages 232{246. Springer-Verlag,August 1996.

[EJ91] E. Allen. Emerson and Charanjit S. Jutla. Tree automata, mu-calculus anddeterminacy (extended abstract). In 32nd Annual Symposium on Founda-

tions of Computer Science, pages 368{377, San Juan, Puerto Rico, 1{4 Oc-tober 1991. IEEE.

[EJS93] E. Allen Emerson, Charnajit S. Jutla, and A. Prasad Sistla. Model checkingin fragments of mu-calculus. In International Conference on Computer Aided

Veri�cation, volume 697 of LNCS, pages 385{396, Berlin, Germany, June1993. Springer.

[Eme97] E. Allen Emerson. Model checking and the mu-calculus. In DIMACS: Se-

ries in Discrete Mathematics and Theoretical Computer Science, volume 31.American Mathematical Society, 1997.

[JW96] David Janin and Igor Walukiewicz. On the expressive completeness of thepropositional mu-calculus with respect to monadic second order logic. InU. Montanari and V. Sassone, editors, Proceedings of the 7th International

Conference on Concurrency Theory, CONCUR'96, volume 1119 of LectureNotes in Computer Science, pages 263{277. Springer-Verlag, August 1996.

[Len96] Giacomo Lenzi. A hierarchy theorem for the mu-calculus. In F. Meyerauf der Heide and B. Monien, editors, Proceedings of the 23rd International

Colloquium on Automata, Languages and Programming, ICALP '96, volume1099 of Lecture Notes in Computer Science, pages 87{97. Springer-Verlag,July 1996.

[NS99] Damian Niwinski and Helmut Seidl. On distributive �xed-point expressions.RAIRO Informatique Theorique, 33(4/5):427{446, 1999.

[Par85] Rohit Parikh. The logic of games and its applications. Annals of discrete

mathematics, 24:111{140, 1985.

12

[Pau99] Marc Pauly. Game constructions that are safe for bisimulation. In J. Ger-brandy, M. Marx, M. de Rijke, and Y. Venema, editors, JFAK. Essays

Dedicated to Johan van Benthem on the Occasion of his 50th Birthday,CD-ROM http://turing.wins.uva.nl/~j50/cdrom/. Amsterdam Univer-sity Press, 1999.

[Pau00] Marc Pauly. From Programs to Games: Invariance and Safety for Bisimula-tion. In Proceedings of 14th Annual Conference of the European Association

for Computer Science Logic CSL 2000, volume 1862 of LNCS, pages 586{496.Springer-Verlag, 2000.

13

The Basic Algebra of Game Equivalences

Valentin Goranko

Department of Mathematics, Rand Afrikaans University

PO Box 524, Auckland Park 2006, Johannesburg, South Africa

E-mail: vfg@na.rau.ac.za

December 29, 2000

Abstract

We give a complete axiomatization of the identities of the basic

game algebra valid with respect to the abstract game board seman-

tics. We also show that the additional conditions of termination and

determinacy of game boards do not introduce new valid identities.

En route we introduce a simple translation of game terms into plain

modal logic and thus translate, while preserving validity both ways,

game identities into modal formulae.

The completeness proof is based on reduction of game terms to a

certain `minimal canonical form', using only the axiomatic identities,

and on showing that the equivalence of two minimal canonical terms

can be established from these identities.

1 Introduction

The original reference on Game Logic is [Parikh, 1985]. The relationshipbetween logic and games has been studied and developed by Lorenzen, Hin-tikka, Ehrenfeucht, Hodges, Blass, Abramsky, Parikh, van Benthem and oth-ers (see [van Benthem, 2000] and [Pauly, 2000a] for details and references).In particular, the problem of establishing the complete axiomatization ofthe identities of the basic game algebra was raised in [van Benthem, 2000].Here we give a solution to that problem.

The paper is organized as follows. In section 1 we introduce the syntaxand semantics of the basic algebra of games in terms of abstract game boardsand in section 2 we give an axiomatization of its valid identities. In section3 we de�ne canonical forms of game terms and show that every game term isprovably equivalent to a minimal canonical one. In section 4 we introduce atranslation of game terms and identities to plain modal logic and show thatit preserves validity of game identities. The converse preservation of validityis proved in section 5 where we also establish other technical results used inthe completeness proof presented in section 6. The paper ends with some

1

further results and concluding remarks, where we show that restriction ofthe semantics to determined and terminating games does not introduce newvalid identities. We also discuss the complexity of the validity problem andthe relations between game algebras and logics.

2 Basic algebra of games

We consider two-player games of a most general type. The game language

GL consists of:

� a set of atomic games Gat = fgaga2A;

� game operations: _;d ; Æ:

For technical convenience, we include an `idle' atomic game � = g0 inGat:

De�nition 1 Game terms:

� Every atomic game is a game term.

� If G;H are game terms then Gd; G _H and G ÆH are game terms.

Besides, we de�ne G ^H := (Gd _Hd)d:Intuitively, the operations d;_;^; Æ mean respectively dualization (swap-

ping the two players' roles), choice of �rst player, choice of second player,and composition of games.

The algebra of game terms will be denoted by GA: Atomic games andtheir duals will be called literals.

Models for GL are game boards:S; f�iaga2A;i=1;2

�where S is a set

of states and �ia � S�P (S) are atomic forcing relations satisfying thefollowing forcing conditions:

� upwards monotonicity (MON): for any s 2 S and X � Y � S; if s�iaXthen s�iaY ;

� consistency of the powers (CON): for any s 2 S;X � S; if s�1aX thennot s�2a(S �X) and (hence) likewise with 1 and 2 swapped.

We also consider the following optional conditions:

� termination of the games (FIN): for any s 2 S; s�iaS: This conditionis of a less imperative nature, since some games may go on forever andnever reach an outcome state. Game boards satisfying that conditionwill be called terminating and the class of terminating game boardswill be denoted by FIN.

2

� determinacy (DET): s�2a(S�X) i� not s�1aX: Game boards satisfyingthat condition will be called determined and the class of determinedgame boards will be denoted by DET.

The forcing relations �i� of the idle game � have a �xed interpretation:s�i�X i� s 2 X: Compositions of idle literals (� or �d) will be called idle gameterms.

Given a game board, the atomic forcing relations are extended to forcingrelations f�iGgG2G;i=1;2 for all game terms, following the recursive de�nitionsgiven in [van Benthem, 2000]:

� s�1GdX i� s�2GX;

� s�2GdX i� s�1GX;

� s�1G1_G2X i� s�1G1

X or s�1G2X;

� s�2G1_G2X i� s�2G1

X and s�2G2X;

� s�1G1ÆG2X i� there exists Z such that s�1G1

Z and z�1G2X for each z 2 Z;

� s�2G1ÆG2X i� there exists Z such that s�2G1

Z and z�2G2X for each z 2 Z:

The meaning1 of s�iGX is: \Player i has a strategy to play the game G so

that if an outcome state is attained, it is in X:"

Proposition 2 Each forcing condition propagates over all forcing relations.

Proof: Routine check.

Note that all idle terms have the same forcing relations as �:

3 Axiomatization of the algebra of games

3.1 Inclusions and identities of game terms

De�nition 3 Let G1 and G2 be game terms and B is a game board.

� G1 is i-included in G2 on B for i = 1; 2; denoted G1 �i G2; if�iG1

� �iG2:

� G1 is included in G2 on B; denoted B j= G1 � G2 if G1 �1 G2 andG2 �2 G1 on B:

1This is the `partial correctness' style of interpreting forcing relations. Alternatively,

they can be interpreted like `total correctness' statements: \Player i has a strategy to play

the game G so that an outcome state is attained and it is in X:"

3

� G1 and G2 are equivalent on B; denoted B j= G1 = G2 if they areassigned the same forcing relations in B:

� Further, G1 is included in G2, denoted G1 � G2 if B j= G1 � G2

for every game board B. Then we also say that G1 � G2 is a valid

term inclusion, also denoted by j= G1 � G2:

� Respectively, G1 and G2 are equivalent, denoted G1 � G2 if theyare equivalent on every game board, i.e. G1 = G2 is a valid term

identity, also denoted by j= G1 = G2:

Analogous notation will be used for validity in a class of game boards,e.g. DET j= G1 = G2 will mean that G1 = G2 is valid in every determinedgame board.

Note that G1 � G2 i� G1 � G2 and G2 � G1: Actually, � can be reducedto � in the well-known lattice-theoretic fashion:

Proposition 4 G1 � G2 i� G1 _G2 � G2 i� G1 ^G2 � G1:

3.2 The axioms of the algebra of games

The main goal of this paper is to make precise and con�rm the conjecture of[van Benthem, 2000] that the following term equivalences provide a completeaxiomatization of the game algebra:

1. Double dualization: G � Gdd;

2. The usual identities for _ in distributive lattices: idempotency, com-mutativity, associativity.

3. Absorption: G1 _ (G1 ^G2) � G1:

4. Distributivity: G1 _ (G2 ^G3) � (G1 _G2) ^ (G1 _G3):

5. Associativity of Æ:

6. Distribution of d over Æ : (G1 ÆG2)d � Gd

1 ÆGd2:

7. Left-distribution for _ and Æ : (G1 _G2) ÆG3 = (G1 ÆG3)_ (G2 ÆG3).

8. Right-distributive inclusion2: G1 Æ G2 � G1 Æ (G2 _ G3). (Accordingto prop. 4, this is equivalent to an identity).

9. The extras for �: multiplicative unit: GÆ� � �ÆG � G and self-duality:� � �d:

2This was missing from the �rst draft. I thank Yde Venema for pointing that out.

4

We denote the set of all these identities by GA�, and the set of thosenot involving � by GA:

Note that the respective identities for ^; as well as the dual absorbtion,distributivity, left-distribution for _ and Æ, right-distributive inclusion G1 Æ(G2^G3) � G1ÆG2; and the two De Morgan's laws for _;^ and d easily followfrom the de�nition of ^ and GA� in the equational logic for the algebra ofgames, which includes the standard set of derivation rules re ecting the factthat � is a congruence in the algebra of games.

Proposition 5 All identities in GA� are valid.

Proof: Routine veri�cation.

Theorem 6 Every valid term identity of the game algebra can be derivedfrom GA� in the standard equational logic.

The proof of this theorem will be presented in a last section, and mean-while we will build up the necessary machinery and obtain auxiliary resultsfor it.

Remark 1 We note that � can be omitted from the language together withits axioms, and the remaining axiom system GA will remain complete forthe reduced language. The proof of this follows the same line as the onepresented here, with a little technical and notational overhead due to theabsence of �:

4 Canonization of game terms

De�nition 7 Canonical game terms are de�ned recursively as follows:

� � is a canonical term.

� Let fGikjk 2 Ki; i 2 Ig be a �nite non-empty family of canonical termsand fgikjk 2 Ki; i 2 Ig be a family of literals such that gik can be anidle literal only if Gik is an idle term. Then

Wi2I

Vk2Ki

gik ÆGik is acanonical term.

Remark 2 Any (or all) index sets I;Ki above can be singletons. Neverthe-less, the respective disjunctions/conjunctions remain in place.

The only essential use of the idle term � here is to facilitate this canonicalpresentation of game terms and to provide a convenient base for structuralinduction on canonical terms. Its use can be circumvented at the cost ofminor technical complications, though.

5

Proposition 8 Every game term G is equivalent, provably in GA�; to acanonical game term.

Proof: First we prove by induction on canonical terms that the dual ofa canonical term is equivalent to a canonical term. The case of � is trivialsince �d � �: Let G = Hd where H =

Wi2I

Vk2Ki

hik Æ Hik and the claim

holds for the canonical terms Hik: Then Hd �

Vi2I

Wk2Ki

hdik ÆHdik which,

using the distributive laws for _ and ^ and using the inductive hypothesisfor the Hik's, converts into an equivalent canonical term.

Now, we prove the main claim by induction on the length of arbitraryterms. The atomic case: g �

WVg Æ �: The case of duals was done above.

The case G = G1 _G2 is almost trivial, using � � � Æ �; if necessary.The remaining case G = G1ÆG2 is treated by induction on G1; assuming

that G2 is canonical. If G1 is a literal, G1ÆG2 can be written asWV

G1 ÆG2

whereW

andV

are over singletons, so it is canonical. The inductive stepfor G1 =

Wi2I

Vk2Ki

gik Æ Gik is enabled by the left-distributive laws forÆ; pushing it inside the

Wand

V; followed by the associativity of Æ which

eventually reduces the case to all GikÆG2 which are covered by the inductivehypothesis. a.

This proof also outlines an algorithm for canonizing game terms whichcan be easily made precise.

Remark 3 Canonical game terms impose a periodic structure in the games:every game is a composition of one or several rounds, each consisting of:

� a choice of player I,

� followed by a choice of player II,

� followed by playing an atomic game by one of the players (dependingof the sign of the literal).

Of course, some of these choices may be vacuous, when only one dis-junct or conjunct is available to choose from, but still the 'ritual' is strictlyfollowed.

De�nition 9 Two canonical terms G;H are isomorphic, denoted G ' H;if one can be obtained from the other by means of successive permutationsof conjuncts (resp. disjuncts) within the same

V's (resp.

W's) in subterms.

In other words, isomorphic terms are the same, up to the order of theconjuncts and disjuncts. Term isomorphism is the intermediate syntacticnotion between identity and semantic equivalence �; which we will eventu-ally prove equivalent to the latter. In fact, isomorphism of terms can bereplaced by genuine identity at the cost of introducing a linear ordering onliterals and terms and applying it to order the

V's and

W's in the de�nition

of canonical terms.

6

Proposition 10 Isomorphic terms are equivalent, provably in GA�.

Proof: Easy.

De�nition 11 We de�ne recursively embedding of canonical terms, de-noted by � as follows:

� �� �;

� Auxiliary notions: if g; h are literals andG;H are canonical terms, gÆGembeds into h ÆH i� g = h and G� H; a conjunction

Vk2K gk ÆGk

embeds into a conjunctionVm2M hm ÆHm if for every m 2M there

is some k 2 K such that gk ÆGk � hm ÆHm:

� Let G =Wi2I

Vk2Ki

gik ÆGik and H =Wj2J

Vm2Mj

hjm ÆHjm: ThenG� H i� every disjunct of G embeds into some disjunct of H.

Proposition 12 If G;H are canonical terms and G � H then G � H isprovable in GA�. To be precise, then GA� ` G _H = H:

Proof: Double induction on G and H; using, inter alia, the right-distributive inclusions.

Thus, embedding of terms is the syntactic counterpart of inclusion.

De�nition 13 Minimal canonical terms:

� � is a minimal canonical term.

� Let G =Wi2I

Vk2Ki

gik Æ Gik be a canonical term where all Gik areminimal canonical. Then G is minimal canonical if:

1. �d does not occur in G:

2. None of gik is � unless Gik is �:

3. No conjunct occurring in a conjunctionVk2K gikÆGik is embedded

into another conjunct from the same conjunction.

4. No disjunct in G is embedded into another disjunct of G:

Thus, minimal canonical terms are systematically 'minimized' canonicalterms.

Proposition 14 Every term G can be reduced to an equivalent minimalcanonical term c(G) and this can be done provably in GA�:

7

Proof: First, transformG to a canonical term, which then can be pruneddown to an equivalent minimal canonical one, using the identities in GA�

(e.g. right-distribution inclusions and the absorption laws for 3 and 4).

From now on, our strategy towards proving Theorem 6 will be to showthat two minimal canonical terms are equivalent i� they are isomorphic.Presumably, that can be done entirely within game semantics. Instead, weintroduce and use for the purpose a simple translation of game terms andidentities to modal logic, which will make our task tangibly easier.

5 Translation of the algebra of games to modal

logic

Here we introduce a translation of GL into plain modal logic. This transla-tion, naturally, resembles Parikh's translation of the languageGL� extendingGL with game iteration (�) into �-calculus, but is simpler, computationallylighter and easier to use. In particular, we will use it in the next section toconstruct counter-models to invalid game equivalences, since Kripke mod-els are rather more transparent, exible and easier to deal with than gameboards.

To begin with, we consider the modal language ML comprising:

� a set of atomic variables V = V [ fqg where V = fpaga2A and q =2 Vis an auxiliary variable.

� the usual modal connectives: _;^;:;�;}, where } will be regardedas an abbreviation for :�:.

Some terminology and notation:

� Substitution '( =q) : all occurrences of the variable q in ' are substi-tuted by :

� A dual of a modal formula ' with respect to the variable q is 'dq =

:'(:q): Note that ('dq)dq � ':

� Furthermore, we will often treat modal formulae as set operators inthe standard sense, and thus, given a formula '(q); Kripke modelM = hS;R; V i and a set X � S we will allow ourselves the sloppinessof writing '(X) assuming its natural meaning, viz. that q has beenevaluated into X.

8

5.1 The translation:

All duals of modal formulas used in the translation will be with respect toq; so we can safely omit the subscript. Likewise, all substitutions will be ofthe type '( =q); which hereafter we will simply write as '( ):

With every game term G we associate a modal formula m(G) as follows:

� m(�) = q;

� m(ga) = }�(pa ! q) for any non-idle atomic game ga; a 2 A;

� m(G1 _G2) = m(G1) _m(G2);

� m(Gd) = (m(G))d, also denoted by md(G):

� m(G1 ÆG2) = m(G1)(m(G2)):

Note that:

� Every formula m(G); being positive in q, is monotone in q:

� m(gda) is equivalent to �}(pa ^ q). Hereafter we will simply considerthese equal.

� m(G1 ^G2) = m(G1) ^m(G2):

� md(G1 ÆG2) = md(G1)(md(G2)):

Example 15

� m(g1 Æ (g2 _ g3)) = }�(p1 ! (}�(p2 ! q) _ }�(p3 ! q)));

� m((g2_g3)Æg1) = }�(p2 ! }�(p1 ! q))_}�(p3 ! }�(p1 ! q)) =m((g2 Æ g1) _ (g3 Æ g1)):

� m(((g1 Æ g2)_ g1)d Æ g3)) = �}(p1 ^�}(p2 ^}�(p3 ! q)))^�}(p1 ^

}�(p3 ! q)):

5.2 Preservation of validity

The main result regarding this translation is:

Theorem 16 For any game terms G;H; if the game inclusion G � H isvalid on all determined game boards then j= m(G)! m(H).

Proof: By contraposition, suppose M;u 2 m(G) ! m(H) for somemodel M and state u 2M: Then we de�ne a game boardBM =

S; f�iaga2A;i=1;2

�as follows. For every X � S and s 2 S :

s�1aX i� M; s � m(ga)(X);

ands�2aX i� M; s �md(ga)(X):

9

Lemma 17 BM is a determined game board.

Proof of the lemma: The condition MON is immediate from the mono-tonicity of m(G) in q. For CON and DET, notice that M; s 2m(ga)(X) i�M; s � :m(ga)(X) i.e. M; s �md(ga)(:X):

Lemma 18 For every s 2 S; X � S and a term D :

s�1DX i� M; s j= m(D)(X);

s�2DX i� M; s j= md(D)(X):

Proof of the lemma:Structural induction on D: For atomic games this holds by de�nition.

The cases D = Dd1 and D = D1 _D2 are straightforward. Let D = D1 ÆD2

and suppose s�1DX: Then s�1D1Z for some Z � S such that z�1D2

X for eachz 2 Z: Then M; s j= m(D1)(Z) and Z � V (m(D2)(X)), so by monotonicityM; s j= m(D1)(m(D2)(X)); i.e. M; s j= m(D1 ÆD2)(X):

The case of s�2DX is quite analogous, modulo the duality, but we'll doit nevertheless: let s�2D1

Z for some Z � S such that z�2D2X for each z 2 Z:

Then M; s j= md(D1)(Z) and Z � V (md(D2)(X)), so by monotonicityM; s j= md(D1)(m

d(D2)(X)); i.e. M; s j= md(D1 ÆD2)(X):Now, conversely, supposeM; s j= m(D1ÆD2)(X), soM; s j= m(D1)(m(D2)(X)):

Then Z = V (m(D2)(X)) is such that s�1D1Z and z�1D2

X for each z 2 Z; bythe inductive hypothesis. Therefore, s�1D1ÆD2

X: Likewise for s�2D1ÆD2X:

This completes the induction and the proof of the lemma.Finally, recall that M;u j= m(G) and M;u 2 m(H): Let X = V (q):

Then u�1GX while :u�1HX, so BM 2 G � H:

Corollary 19 For any game terms G;H; if DET j= G = H then j=m(G)$ m(H):

6 Some technical results

First, some useful remarks.

� Since K is complete for the class of irre exive tree-like Kripke models,every non-valid translation of a game inclusion or identity can be re-futed in a model rooted at a state s without predecessors. Note thatany re-evaluation of variables at s in such model will not a�ect thetruth or falsity at s of any m(G); except m(�) when the truth of q isaltered, because all occurrences of other variables in these formulaeare in the scope of modal operators.

10

� Let F� = hS�; R�i where S� = f�; y; zg; R� = f(�; y); (y; z); (z; z)g:Then the Kripke model M+ = hS�; R�; V+i ; where V+(q) = f�; zgsatis�es all m(G) at its root �, while the model M� = hS�; R�; V�i ;where V�(q) = ? and V�(pa) = fzg for all a 2 A; falsi�es all m(G)at �: These models can be freely grafted to an irre exive leaf of anymodel (taking care of q; if necessary).

Here's our main technical lemma:

Lemma 20 Let G and H be minimal canonical terms. The following areequivalent:

� G Æ H.

� (�) There is a disjunctVk2K gik ÆGik in G such that every disjunct in

H contains a conjunct hjmiÆHjmi

not including any of the conjunctsgik ÆGik for k 2 K.

� There is a �nite (tree-like) Kripke model M and a state s 2 M suchthat M; s � m(G), M; s 2 m(H) and s has no predecessors in M:

Proof: We prove all equivalences by double induction on the structure ofG and H: The case when both of them are � is vacuous, so suppose otherwiseand let G =

Wi2I

Vk2Ki

gik Æ Gik, H =Wj2J

Vm2Mj

hjm Æ Hjm where theclaim holds for all pairs of Gik's and Hjm's. If one of G and H is � werepresent it as

WV� Æ �:

1) Let G Æ H: Then there is a game board B =S; f�iaga2A;i=1;2

�such

that either G 1 H or H 2 G on B:1.1) Suppose G 1 H: Then there is a state s and a disjunct (the choice

of player I)Vk2Ki

gik Æ Gik such that every conjunct gik Æ Gik enables himto achieve some outcome X from s which he cannot force on H; so everydisjunct

Vm2Mj

hjm ÆHjm in H contains a conjunct hjmiÆHjmi

which lacksthe power for player I to force an outcome X. Thus, none of the termshjmi

ÆHjmi; j 2 J; includes any of gik ÆGik; k 2 Ki:

1.2) Suppose H 2 G: Then player II can force some outcome X inH which she cannot force in G; so every disjunct

Vm2Mj

hjm Æ Hjm in H

(possible choice of I) in H contains a conjunct (the reply of II) hjmiÆHjmi

which contains (s;X) in the forcing relation for II; while this is not the casefor G; so some disjunct

Vk2Ki

gik Æ Gik is such that no term gik Æ Gik in itcontains (s;X) in its forcing relation for II; hence none of gik ÆGik; k 2 Ki

is included in any of hjmiÆHjmi

; j 2 J .Thus, in either case (�) holds.2) Suppose (�): Note that there can be at most one idle term amongst

all fgik ÆGikjk 2 Kig and fhjmiÆHjmi

jj 2 Jg:

11

We will build a Kripke model M which will satisfy all fm(gik ÆGik)jk 2Kig; and hence m(G); while none of fm(hjmi

Æ Hjmi)jj 2 Jg, hence will

falsify m(H): M will be rooted at some state s with no predecessors, whichis needed for the inductive hypothesis because models like this will be graftedat their roots to larger models as the induction goes on.

Depending on the signs of the literals gik; k 2 Ki and hjmi; j 2 J; the set

of all these terms splits into the following subsets:

� T �A= ft� ÆD�j� 2 Ag whose translations must be true at s;

� TB = ftd� ÆD� j� 2 Bg whose translations must be true at s;

� T� = ft ÆD j 2 �g whose translations must be false at s;

� T� = ftdÆ ÆDÆjÆ 2�g whose translations must be false at s:

� Possibly, T� = f� Æ �g:

The terms t�; t�; t ; tÆ above are non-idle atoms. Let p�; p�; p ; pÆ betheir corresponding variables in the modal translation. Thus, we have tosatisfy at s simultaneously the following sets of formulae:

� FA = f}�(p� ! m(D�))j� 2 Ag,

� FB = f�}(p� ^m(D�))j� 2 Bg;

� F� = f�}(p ^ :m(D ))j 2 �g;

� F� = f}�(pÆ ! :m(DÆ))jÆ 2�g:

� Possibly, F� = fqg or F� = f:qg; depending on whether there is anidle term in fgik ÆGikjk 2 Kig or fhjmi

ÆHjmijj 2 Jg respectively.

We build the model M = hW;R; V i as follows:W = fsg [ (A [�) [ ((A [�) � (B [ �)) [W 0; where A;B;�;� are

the index sets above, which will form the 'carcass' of the model, andW 0 willbe sub-models satisfying/falsifying the m(D)0s; which will be grafted to thecarcass accordingly (see further).

� For better readability, in what follows the elements of a productX�Ywill be denoted as xy; for x 2 X; y 2 Y:

R = f(s; x)jx 2 A [�g[f(x; xy)jx 2 A [�; y2 B [ �g[R0 where R0

will be the union of the inherited relations from the grafted sub-models.The rest of the model and the valuation V will be de�ned as follows:

� Every state ��; for � 2 A; � 2 B must satisfy p� ! m(D�) andp� ^m(D�): For that, we set p� true at �� and graft a copy of M+ at��:

12

� Every state � ; for � 2 A; 2 � must satisfy p� ! m(D�) andp ^ :m(D ): If � 6= we set p� false and p true at � and graft acopy ofM� at � : If h� = h then D� Æ D (for, otherwise, t� ÆD� �t Æ D ; which contradicts (�)), hence by the inductive hypothesisthere is a model M� rooted at some u such that M� ; u j= m(D�)while M� ; u 2 m(D ): Then we set p� true and graft a copy of M�

at � :

� Every state �Æ must satisfy p� ^m(D�) and (pÆ ! :m(DÆ): This caseis treated analogously to the previous one.

� Every state Æ must satisfy p ^ :m(D ) and pÆ ! :m(DÆ): For thatwe set p true, pÆ false and graft a copy of M� at Æ.

� Finally, s 2 V (q) i� q 2 F�:

This completes the description of M: It is immediate from the construc-tion that M;u will satisfy all formulae in FA [ FB [ F� [ F� and henceM; s � m(G), while M; s 2 m(H):

3) If M; s � m(G), while M; s 2 m(H) then, by theorem 16, G Æ H.This completes the circle of equivalences and the induction step. a

Corollary 21 For any game terms G;H :

1. j= m(G)! m(H) i� G � H is a valid game inclusion.

2. j= m(G)$ m(H) i� G = H is a valid game identity.

Proof: One direction of (1) is by th. 16. For the other, suppose j=m(G)! m(H): We can assume that G;H are minimal canonical, again dueto th. 16, so G � H by lemma 20. (2) follows immediately from (1). a

Corollary 22 j= G = H i� DET j= G = H:

Given a Kripke modelM and a state s, T (M; s; u) will denote the modelobtained from M by adding two new states u; v such that uRv and vRs:

Lemma 23 Let G;H be any terms and g; h be non-idle literals. Theng ÆG � h ÆH i� g = h and G � H:

Proof: One direction is obvious. The other we prove by contraposition,assuming g 6= h or G Æ H and using the modal translation.

Case 1: g 6= h. We falsify m(g Æ G)! m(h ÆH) at the root of a modelconstructed per cases as follows:

1.1) g = ga; h = gb; a 6= b for some atoms ga; gb: Take a copy ofT (M�; �; u) and set pa false and pb true at �:

1.2) g = ga; h = gdb : Take a copy of F� and set pa and pb false at z:

13

1.3) g = gda; h = gb: Take a copy of T (M+; �; u), add a new successors to v and graft a copy of M� as s; setting pa true at � and pb true ats, so �}(pa ^ m(G)) is true at u; while pb ! m(H) is false at s; hence�(pa ! m(H)) is false at v; so }�(pa ! m(H)) is false at u:

1.4) g = gda; h = gdb ; a 6= b: Take a copy of T (M+; �; u) and set pa trueand pb false at �:

Case 2: g = h and G Æ H: We can assume that G and H are minimalcanonical. Let M; s 2m(G)! m(H) (by lemma 20) and suppose g = ga org = gda: Then setting pa true at s will falsify m(g Æ G) ! m(h ÆH) at u inT (M; s; u).

Thus, in any case we have shown that g ÆG Æ h ÆH: a

Lemma 24 1) g ÆG � � Æ � i� g is an idle literal and G � �:1) � Æ � � g ÆG i� g is an idle literal and � � G:

Proof of the non-trivial directions:If g is non-idle then m(g Æ G) ! m(� Æ �) is falsi�ed at the root of

T (M+; �; u) by setting q to be false at u. Thus, if g ÆG � � Æ � then g is idleand j= m(g ÆG)! m(� Æ �); hence j= m(G)! m(�); so G � �:

Likewise, if g is non-idle then m(� Æ �)! m(g ÆG) is falsi�ed at the rootof T (M�; �; u) by setting q to be true at u. Thus, if � Æ � � g Æ G then g isidle and j= m(�)! m(G); so � � G: a

7 Proof of the completeness of GA�

Lemma 25 If G;H are minimal canonical terms then G � H i� G� H:

Proof: If G � H then G � H is straightforward. For the other di-rection we proceed by double induction on the structure of both terms.The case when both of them are � is trivial, so suppose otherwise and letG =

Wi2I

Vk2Ki

gikÆGik, H =Wj2J

Vm2Mj

hjmÆHjm be minimal canonical

terms (again, representing � asWV

� Æ �) such that G � H and the claimholds for all Gik's and Hjm's, i.e. if one of these is included into anotherthen that inclusion is embedding.

Now, suppose G is not embedded into H: Then there is a disjunctVk2Ki

gikÆGik in G such that every disjunctVm2Mj

hjmÆHjm inH containsa conjunct hjmi

ÆHjmiin which none of gik ÆGik; k 2 Ki is embedded. But

that means, by the inductive hypothesis and lemma 23 and 24, that none ofthese terms is included in any of the hjmi

ÆHjmi; for j 2 J: This is precisely

the condition (�) of lemma 20. Therefore G Æ H:This completes the inductive step and the proof of the lemma.

Proposition 26 If G;H are minimal canonical terms such that G � Hand H � G then G �= H:

14

Proof: Again, double induction on G;H: The case when both of themare � is trivial. Suppose G =

Wi2I

Vk2Ki

gik Æ Gik, H =Wj2J

Vm2Mj

hjm ÆHjm be minimal canonical terms such that G � H and H � G and theclaim holds for all Gik's and Hjm's.

Take any disjunct D from G: It embeds into some disjunct D0 from H;which in turns embeds into some D00 from G; so D is embedded into D00;hence D and D00 must coincide because G is minimal canonical. Therefore,D � D0 and D0

� D; so for every conjunct C in D there is a conjunctC 0 in D0 embedded into C; and there is a conjunct C 00 in D embedded intoC 0; hence C 00 is embedded into C: Again by complete canonicity of G, thatimplies that C and C 00 coincide, hence C � C 0 and C 0

� C: Let C = t Æ Tand C 0 = t0 Æ T 0 for some literals t and t0 and minimal canonical terms T; T 0

for which the inductive hypothesis holds. Therefore, C � C 0 and C 0 � C;hence by lemma 23 and 24, t = t0, T � T 0 and T 0 � T; so T � T 0 andT 0� T by lemma 25, hence T �= T 0 by the inductive hypothesis. Therefore

C �= C 0:Thus, every conjunct from D is isomorphic to a conjunct from D0 and

vice versa. This is a bijection because of the complete canonicity of G andH: Hence, every disjunct from G is isomorphic to a disjunct from H andvice versa. Again, this is a bijection due to the complete canonicity of Gand H: Therefore, G �= H: a

Corollary 27 The minimal canonical terms G and H are equivalent i� theyare isomorphic.

Proof: G � H i� (G � H and H � G) i� (G � H and H � G) i�G �= H:

Proof of Theorem 6: Let G � H and c(G); c(H) be minimal canonicalterms obtained from G and H by reduction withinGA�: Then c(G) � c(H);hence c(G) �= c(H) by corollary 27. Since each of the equivalences G � c(G);c(G) �= c(H); c(H) � H is derivable in GA�; so is G � H: a

8 Concluding remarks

8.1 Valid identities and game board conditions

On one hand, it can be easily veri�ed that all axiomatic identities, and henceall valid ones, remain valid if the condition for consistency of powers (CON)is omitted.3

On the other hand, as corollary 22 shows, determinacy of game boardsdoes not add new valid identities of game terms. This result can be strength-ened: termination can be added, too, without introducing new valid identi-ties.

3This observation is essentially due to Yde Venema, who raised the question.

15

Proposition 28 j= G = H i� (DET\FIN) j= G = H:

Proof: It is suÆcient to modify the proof of lemma 20 by showing thatwhenever G Æ H for minimal canonical terms G and H, the counter-modelfor m(G) ! m(H) can be constructed in such a way that the respectivegame board determined by it as in the proof of theorem 16 is terminatingas well, i.e. s�iaS holds for each atomic game ga (and hence for every gameterm). These conditions impose the following requirements on the Kripkemodel:

� Termination for �. It holds trivially.

� s�1aS i� M; s j= }�(pa ! >) i.e. M; s j= }>: This is satis�ed by thecurrent construction.

� s�2aS i�M; s j= �}(pa^>) i.e. M; s j= �}pa for each non-idle a 2 A:To satisfy this condition we extend the construction in the proof oflemma 20 as follows: for each � 2 A we add one more successor, �0 tos; graft a copy of M+ at �0; and set all pa to be true at �0: Likewise,for each Æ 2� we add one more successor, Æ0 to s; graft a copy of M�

at Æ0; and set all pa to be true at Æ0: That will preserve the truth at sof all formulas from FA [ FB [ F� [ F�; while forcing all �}pa to betrue at s:

Thus, every invalid inclusion G � H can be falsi�ed in a determined andterminating game board. a

8.2 On the complexity of the validity of game identities

As shown in [Parikh, 1985], the validity problem in the full Game Logic isin EXPTIME, hence so is the validity problem for game identities. Morecan be said if we restrict attention to identities of canonical terms.

Corollary 29 The validity problem for identities of canonical terms is inPSPACE.

Proof: The translation of canonical terms to formulae of modal logic ispolynomial in the size of the terms, because only literals occur on the leftof compositions, and the validity in the basic modal logic K is PSPACEcomplete.

Remark 4 In general, however, the modal translation m is exponential inthe size of the terms, e.g. consider the translation of (g11_g21)Æ (g12_g22)Æ::: Æ (g1n _ g2n): This, our translation does not provide directly a PSPACEdecision procedure for the validity in GA; but we conjecture that this is theprecise complexity of that problem.

16

8.3 From game algebras to game logics.

Clearly, the game algebra of a �xed language of game terms can be regardedas a fragment of the corresponding game logic. In particular, every validgame identity G = H corresponds to a pair of valid formulas hGi q $ hHi qand [G]q $ [H]q (in the notation of [Parikh, 1985] and [Pauly, 2000a]) andvice versa.

The dual-free fragment of game logic (with tests) was axiomatized andproved complete in [Parikh, 1985], by modifying appropriately the complete-ness proof for PDL; while the iteration-free game logic, corresponding tothe game language considered here (with additional tests), has been axioma-tized and proved complete in [Pauly, 2000b] using an adaptation of Parikh'hproof, combined with the method of canonical model for neighbourhood se-mantics of modal logic. That proof, however, does not imply the presentcompleteness result because it does not show if the derivation of every validformula of the type hGi q $ hHi q or [G]q $ [H]q can be translated intoequational logic. On the other hand, the modal translation introduced herereadily extends to the iteration-free game logic, and accordingly the methodof proving completeness applied here can be modi�ed to an alternative com-pleteness proof for that logic, by extending the notion of canonical formsto all formulas. We note that this method can also be adapted to provecompleteness of modal logic itself. In fact, that was essentially done quiteawhile ago in [Fine, 1975], where the use of normal forms in modal logicwere promoted.

Finally, the completeness of the full Game Logic introduced in [Parikh, 1985]is still open. We hope that the method applied here can be extended to thegame language with iteration and give a handle to solving that problem,too.

9 Acknowledgments

This work was done during my visit to the Institute for Logic, Language andComputation at the University of Amsterdam in the fall of 2000, supportedby ILLC, research grant GUN 2034353 of the National Research Foundationof South Africa, and the SASOL research fund of the Faculty of NaturalSciences of Rand Afrikaans University. My interest in logics of games and inthe problem solved here was inspired by Johan van Benthem's lectures andnotes on his course "Logic and games" given at ILLC at that time. I amindebted to Johan, Marc Pauly, and Yde Venema for stimulating discussionsand comments, and for important corrections on the �rst draft.

17

References

[van Benthem, 2000] J. van Benthem, Logic and games, Lecturenotes, ILLC report X-2000-03, available athttp://www.illc.uva.nl/Publications/Lists/www-allpubl-2000.html.

[Fine, 1975] K. Fine, Normal Forms in Modal Logic, Notre DameJournal of Formal Logic, vol XVI (2), 1975, 229-237.

[Pauly, 2000a] M. Pauly, Game Logic for Game Theorists, CWI re-port INS-R0017, Sept. 2000.

[Pauly, 2000b] M. Pauly, A Note on the Completeness of Iteration-free Game logic, manuscript, 2000.

[Parikh, 1985] The Logic of Games and its Applications, Ann. of Dis-crete Mathematics, vol 24 (1985), 111-140.

18

Representing Game Algebras

Yde Venema�

June 5, 2001

Abstract

We prove that every abstractly de�ned game algebra can be represented as an algebra

of consistent pairs of monotone outcome relations over a game board. As a corollary

we obtain Goranko's result that van Benthem's conjectured axiomatization for equivalent

game terms is indeed complete.

Keywords game algebra, game theory, lattices with operators, representation theory

1 Introduction

Research into the connections between logic and game theory has become more active inrecent years, cf. van Benthem [4]. Our paper �ts in a line of research that was initiated byParikh [2] and has recently been developed further by van Benthem, Pauly, Goranko andothers, cf. [3, 1]. These researchers study games from a logical perspective analogous to thetheory of processes in computer science. The focus is on an abstract approach in which gamesor game expressions are analyzed in semantic terms; a crucial role in this perspective is playedby so-called outcome relations or e�ectivity functions.

The basic idea is as follows; assume that we are dealing with 2 players, called 0 and 1, andwith a game board which for the moment will be just a set B of objects that we call statesor positions. With any game g and each player i we will associate an outcome relation Ri

g;that is, a relation between positions and sets of positions. Intuitively, if a position p is in therelation Ri

g with the set T of positions, this means that in position p, player i has a strategyof playing the game g in such a way that after play, the resulting state belongs to the set T .In brief, pRi

gT holds if in position p, i can force that the outcome of g will be a position in T .Given these intuitions, there are some restrictions that one should or could impose on

such outcome relations. In this paper we con�ne ourselves to the properties of monotonicity

and consistency :

(monotonicity) if pRigT and T � U then pRi

gU ,

(consistency) if pRigT then not pR1�i

g (B � T ).

�Institute of Logic, Language and Computation, Univ. of Amsterdam, Plantage Muidergracht 24, 1018 TV

Amsterdam. E-mail: yde@science.uva.nl.

1

Here and in the sequel we use the convention that 1� i denotes the adversary of i.This game board perspective o�ers a natural notion of equivalence between games, making

g and h equivalent on a certain game board if both players have the same power in g as in h;that is, if Ri

g = Rih for each player i.

An interesting aspect of the approach by Parikh and others is that various ways to compose

games are studied from an abstract, algebraic perspective. That is, formal game operationsare introduced to construct new games from old. Below we list some of the most naturalgame operations that one could consider in this context:

(choice) g _i h is the game in which the �rst move is that player i chooses whether toplay g or h;

(dualization) �g is the game g but with the roles of the two players reversed;

(composition) g � h is the game in which a play of g is followed by a play of h.

Various other operations have been studied, such as iteration (play g repeatedly until one ofthe players decides to stop) or idle games; however, in this paper we con�ne our attention tochoice, dualization and composition.

Naturally, the outcome relations of composed games should be based on those of theircomponents according to the following de�nition:

pRig_ih

T i� pRigT or pRi

hT;

pRig_1�ih

T i� pRigT and pRi

hT;

pRi�gT i� pR1�i

g T;

pRig�hT i� pRi

gU for some set U such that uRihT for all u 2 U:

(1)

The reader could easily verify that with this de�nition the conditions of monotonicity andconsistency are propagated; for instance, if Ri

g and Rih are monotone outcome relations then,

given (1), so are Rig_ih

, Rig_jh

and Rig�h.

The notion of game equivalence that we introduced earlier can be applied to such composedgames as well, and there are certain interesting laws to be discovered here. For instance, thereader can easily verify that the games (g1 _0 g2) � h and (g1 � h)_0 (g2 � h) will be equivalenton any game board, no matter what the outcome relations of the games g1, g2 and h are.Being slightly more formal, we de�ne a game expression as a term in the algebraic languageover the set of function symbols f_0;_1;�; �g. A game board is a pair B = (B;R) such thatB is a set of positions and R is a map assigning to each atomic game or game variable x apair (R0

x; R1x) of outcome relations; we require the monotonicity and consistency conditions

to hold. Inductively, we use (1) to de�ne outcome relations Rig for each player i and each

game expression g. Now we say that two game expressions are equivalent on a game board

B = (B;R), notation: B j= g � h, if Rig = Ri

h for each player i. We call g and h equivalent ifthey are equivalent on every game board.

An obvious problem is to �nd a complete axiomatization for this semantic notion ofequivalence. A proposal for such an axiomatization was made by van Benthem, cf. ourdiscussion in the next section. It was proved in Goranko [1] that van Benthem's axiomsindeed completely generate the notion of game equivalence. Goranko's proof is based on a

2

syntactic analysis of game expressions and a validity preserving translation of game identitiesinto formulas in the language of basic modal logic.

In this paper we will prove the completeness of van Benthem's axiomatization by purelyalgebraic means. Our main result, Theorem 1, is a strengthening of Goranko's theorem: wewill show that every game algebra (that is, every abstract algebra satisfying van Benthem'saxioms) is in fact isomorphic to an algebra of consistent pairs of outcome relations.

We hope that our algebraic approach will lead to more results in the future. In particular,we plan to concentrate on the following questions:

� the precise connection between our approach and that of Goranko,

� axiomatizations of the notion of game equivalence if further constraints are added tothe outcome relations,

� axiomatizations of the notion of game equivalence in extended languages; in particular,with iteration and perhaps other �xed point operators,

� connections with the game logic as developed by Parikh.

2 Board algebras and game algebras

The aim of this section is to rephrase the axiomatization problem for equivalent game expres-sions in purely algebraic terms. In order to do so, we will de�ne two classes of concrete andabstract algebras called board algebras and game algebras, respectively. We will show that theaxiomatization problem can be solved by showing that every game algebra can be representedas a board algebra; in other words, we will prove an analogous result to Stone's Representa-tion Theorem which states that every abstract Boolean algebra is in fact representable as a�eld of sets.

For notational convenience, and in order to stay close to the algebraic tradition, we willchange our notation for the choice operation symbols, writing _ for _0 and ^ for _1.

Board algebras

We �rst consider the board algebras; these are the concrete game algebras that one canassociate with a game board.

De�nition 2.1 Given a set B, let O(B) = P(B � P(B)) denote the collection of outcomerelations on B, and Om(B), the set of monotone outcome relations. G(B) and Gm(B) denotethe set of pairs of outcome relations and the set of pairs of monotone outcome relations,respectively; that is, G(B) = O(B)�O(B) and Gm(B) = Om(B)�Om(B). Finally, Gmc(B)is the set of consistent pairs of monotone outcome relations. �

Intuitively, any element (R0; R1) 2 Gmc(B) denotes a possible interpretation of a gameplayed on the board B, given our monotonicity and consistency requirements.

3

It will be convenient for us to rephrase the inductive de�nition (1) of outcome relationsfor complex game expressions in terms of operations on O(B) and G(B). De�ne the binaryoperation Æ on outcome relations as follows:

R Æ S := f(p; T ) j pRU for some set U such that uST for all u 2 Ug:

Also, note that outcome relations over B, being subsets of the set P(B �P(B)), are subjectto the standard set-theoretic operations such as taking unions or intersections. Given all ofthis, we invite the reader to check that (1) can be rephrased as follows:

R0g_h = R0

g [R0g;

R0g^h = R0

g \R0g;

R0g�h = R0

g ÆR0g:

while a similar de�nition applies to player 1.Recall that the notion of equivalence between game expressions is de�ned in terms of the

outcome relation for both players. For a proper algebraic phrasing, we thus have to interpretthe function symbols as operations on the set of pairs of outcome relations on a board B.

De�nition 2.2 Fix a set B. First, consider the following operations on the set G(B):

(R1; R2) t (S1; S2) = (R1 [ S1; R2 \ S2);

(R1; R2) u (S1; S2) = (R1 \ S1; R2 [ S2);

(R1; R2)� = (R2; R1);

(R1; R2)2(S1; S2) = (R1 Æ S1; R2 Æ S2):

Now de�ne the full outcome algebra over B to be the structure G(B) = (G(B);t;u;�;2);subalgebras of G(B) are called outcome algebras over B. An outcome algebra of the form(A;t;u;�;2) is called monotone if A � Gm(B) and a board algebra if A � Gmc(B). Thefull monotone outcome algebra over B and the full board algebra over B are de�ned as thestructures Gm(B) = (Gm(B);t;u;

�;2) and Gmc(B) = (Gmc(B);t;u;�;2), respectively.

The class of board algebras is denoted as B. �

Equivalence of game expressions can now simply be stated as the validity of the corre-sponding game equation in the class of board algebras.

De�nition 2.3 Two game expressions g and h are called equivalent, notation: B j= g � h,if the equation g � h is valid in every board algebra. �

The problem of axiomatizing the notion of game equivalence thus reduces to �nding anaxiomatization for the set of game equations that are valid in the class of board algebras.

4

Game algebras

The proposal by van Benthem that we mentioned in the introduction, comprises the followingaxioms.

De�nition 2.4 Consider the following (quasi-)equations:

x _ x � x x ^ x � x (G1)

x _ y � y _ x x ^ y � y ^ x (G2)

x _ (y _ z) � (x _ y) _ z x ^ (y ^ z) � (x ^ y) ^ z (G3)

x _ (x ^ y) � x x ^ (x _ y) � x (G4)

x _ (y ^ z) � (x _ y) ^ (x _ z) x ^ (y _ z) � (x ^ y) _ (x ^ z) (G5)

��x � x (G6)

�(x _ y) � �x ^ �y �(x ^ y) � �x _ �y (G7)

(x � y) � z � x � (y � z) (G8)

(x _ y) � z � (x � z) _ (y � z) (x ^ y) � z � (x � z) ^ (y � z) (G9)

�x � �y � �(x � y) (G10)

y � z ! x � y � x � z (G11)

Here s � t is an abbreviation of the equation s _ t � t.A distributive lattice is any algebra D = (D;_;^) satisfying the equations G1{5; a de

Morgan lattice is an algebraM = (M;_;^;�) satisfying the equations G1{7. Finally, a game

algebra is a structure G = (G;_;^;�; �) satisfying the axioms G1{11. We let G denote theclass of game algebras. �

In words, a distributive lattice is any algebra D = (D;_;^) in which the join _ andthe meet ^ are idempotent (G1), commutative (G2) and associative (G3) operations thatsatisfy the laws of absorption (G4) and distribution (G5). Any expansion of a distributivelattice with a unary complementation operation is called a de Morgan lattice if it satis�esthe de Morgan laws (G6) and (G7). A game algebra is an expansion G = (G;_;^;�; �) ofa de Morgan lattice (G;_;^;�) with an associative (G8) binary operator which satis�es theleft-distributive laws (G9), the dualization axiom (G10), and right-monotonicity (G11).

Note that although we formulated the right-monotonicity law G11 as a quasi-equation, itcan also be phrased equationally as x � y � x � (y _ z).

Rephrasing the problem algebraically

Van Benthem's conjecture can now be rephrased algebraically as the statement that the classesG and B have the same equational theory. In fact, the main Theorem of this paper statessomething stronger, namely, that every game algebra can be represented as a board algebra.

Theorem 1 Every game algebra is isomorphic to a board algebra:

G = IB:

5

To see why this Theorem solves the axiomatization problem, consider two game expres-sions g and h. By our de�nitions, g and h are game equivalent expressions if and only ifB j= g � h. It follows from Birkho�'s Completeness Theorem for equational logic, that g � h

is derivable from G1{11 if and only if G j= g � h. Hence, by Theorem 1 it follows immediatelythat g and h are equivalent game expressions if and only if the equation g � h is derivablefrom the equations G1{11.

The remainder of the paper is devoted to our proof of Theorem 1. Before we go intothe details of the proof, let us brie y sketch the intuitions underlying it. Obviously, the�rst problem that we encounter when trying to represent a game algebra G = (G;_;^;�; �)as a board algebra is to �nd a suitable board. Fortunately however, this problem can betackled easily by concentrating on the lattice reduct (G;_;^) of G: we can use the well-known representation theory of distributive lattices and represent (G;_;^) as a set latticeover the collection BG of its prime �lters (formal de�nitions will follow later). Basically, wewould like to take this set BG as the underlying set of the board algebra representing G.

In order to see how this representation should work, take a slightly alternative perspectiveon the game algebra: associate with each element g of G a map 3g : G! G given by

3ga = g � a:

The game algebra can then be seen as forming a structured family of operations on its latticereduct. Each map 3g is a monotone operation on the lattice (G;_;^) and thus naturallycorresponds to a monotone outcome relation Qg on the set BG . Putting these observationstogether we will show that there is a natural homomorphism from any game algebra to thefull monotone outcome algebra over the set of prime �lters of the lattice reduct of the gamealgebra.

However, there are still two problems that need solving before the above considerationsyield a proof of Theorem 1:

separability In general, we cannot guarantee that the `natural homomorphism' mentionedabove is in fact an embedding. For instance, it could very well be the case that g andh are distinct elements of G, while 3ga = 3ha for all elements a 2 G; but in such asituation, g and h would be represented as identical outcome relations. In order to solvethis problem we will �rst add elements to G, one of which will separate g from h.

consistency The above procedure shows that an arbitrary game algebra is isomorphic to amonotone outcome algebra, but in order to prove Theorem 1 we need to represent gamealgebras as board algebras, that is, consistent monotone outcome algebras. Fortunately,this problem will be quite easy to solve, since we can show that any monotone outcomealgebra can be embedded in a board algebra.

Game modules

It will be quite useful to formalize the perspective of a game algebra as a structured family ofmonotone operations on its lattice reduct. First however, we should note that for technical

6

reasons, when trying to represent a game algebra G = (G;_;^;�; �) we will use its de Mor-

gan reduct (G;_;^;�) rather than its lattice reduct (G;_;^) as the algebra on which theoperations 3g act.

De�nition 2.5 Let G = (G;_;^;�; �) be a game algebra. A module over G is an algebraM = (M;_;^;�;3g)g2G with each 3g a monotone operation on the de Morgan algebra M,such that the following equations hold:

(M1) 3g_hx � 3gx _3hx

(M2) 3g^hx � 3gx ^3hx

(M3) 3g�hx � 3g3hx

(M4) 3�gx � �3g�x

A game module is separable if for all distinct elements g and h of G there is an x 2M suchthat 3gx 6= 3hx. �

Note that with this de�nition, we may indeed see a given game algebra G = (G;_;^;�; �)as a module over its de Morgan reduct if we put 3ga = g � a. We will not introduce anynotation to distinguish these two perspectives on game algebras.

Proof of Theorem 1

Our proof of the representation theorem for game algebras involves the following three steps:

1. In Proposition 5.1 we will prove that every game algebra, seen as a module over itself,can be embedded in a separable module over itself. From this it follows that over everygame algebra there is a separable module.

2. Proposition 4.2 states that if M is a separable module over G, then G is isomorphic tosome monotone outcome algebra over M.

3. Finally, we will prove that any monotone outcome algebra can be embedded in a boardgame algebra, cf. Proposition 6.1.

The proof of Theorem 1 is immediate from these results.

3 Monotone operations on distributive lattices

In this section we brie y sketch the required background knowledge on the representationtheory of distributive lattices and their monotone expansions. None of the results in thissection are originally ours.

7

Representing distributive lattices

The prime examples of distributive lattices are given by the lattices of sets; these are algebrasof the form (A;[;\) with A being some collection of sets which is closed under taking unionsand intersections. In fact, it is well-known that every distributive lattice can be representedas such a set algebra. We brie y recall the basic notions that are needed for stating the resultthat we need.

De�nition 3.1 Let D = (D;_;^) be a distributive lattice. A �lter is a subset F of D whichis upward closed (if a 2 F and a � b then b 2 F ) and closed under meets (if a; b 2 F thena ^ b 2 F ). A �lter F is prime if a _ b 2 F implies that at least one of a and b belongs to F .Let BD denote the set of prime �lters of D.

Given an element a 2 D, de�ne

ba = fp 2 BD j a 2 pg;

that is: ba denotes the set of prime �lters to which a belongs. �

Fact 3.2 For any distributive lattice D, the map c(�) is an embedding of D in (P(BD);[;\).

It will also be useful to introduce the notion of a closed set of prime �lters. There isof course an entire topological theory lurking behind the corner here, but we only need thefollowing tip of this iceberg.

De�nition 3.3 Let D = (D;_;^) be a distributive lattice. Given a set T of prime �lters,let FT denote the set of elements a of D such that a 2 p for every p 2 T , or, equivalently,

FT = fa 2 D j T � bag:A set C of prime �lters is closed if it is the intersection of sets of the form ba; or, equivalently,if C =

Tfba j a 2 FCg. Given a set T of prime �lters, let T be the smallest closed superset of

T ; it is not hard to see that T =Ta2FT

ba. �

Monotone lattice operations

De�nition 3.4 Let D = (D;_;^) be a distributive lattice. A map 3 : D ! D is monotone

if 3a � 3b whenever a � b.A monotone lattice expansion is an algebra (D;_;^;3) such that 3 is a monotone opera-

tion on the distributive lattice (D;_;^). All de�nitions concerning distributive lattices applyto monotone lattice expansions as well. �

The prime example of monotone lattice operations stem from monotone outcome relations.Let R be an outcome relation on B, and de�ne the operation mR : P(B)! P(B) by

mR(T ) = fp 2 B j pRTg:

It is easy to verify that R is monotone if and only if mR is a monotone relation on the powerset lattice of B.

8

In fact, one can show that every monotone lattice operation can be represented as anoperation of the form mR for some monotone outcome relation on the set of prime �lters ofthe lattice.

De�nition 3.5 Given a monotone lattice expansion D = (D;_;^;3), let Q3 be the outcomerelation on the board of prime �lters of D given by

pQ3T i� 3a 2 p for all a 2 FT :

�

Note that for any set T of prime �lters we have pQ3T if and only if pQ3T .

Proposition 3.6 For any monotone lattice expansion D = (D;_;^;3), the map c(�) is an

embedding of D in (P(BD);[;\;mQ3).

Proof. By the earlier fact it suÆces to prove that

c3a = mQ3bafor any element a 2 D. This follows imediately from the observation that for any prime �lterp 2 BD and any a 2 D:

pQ3ba i� 3a 2 p: (2)

In order to prove (2), �rst assume that qQ3ba. Since a 2 Fba it follows that 3a 2 p by de�nition

of Q3. For the other direction, suppose that 3a 2 p and let b be an arbitrary element of Fba.

By de�nition of Fba this means that ba � bb, so by Fact 3.2 we obtain that a � b. Monotonicity

of 3 gives that 3a � 3b, so we �nd 3b 2 p since p is a prime �lter. Because b was arbitrarythis means that pQ3ba, as required. qed

It is obvious that if 3 is a monotone operation on the lattice D, then Q3 is a monotoneoutcome relation on BD.

We will also need the following rather technical lemma which in essence stems fromL. Esakia. Recall that a set A of elements in a lattice D is downward directed if for any�nite subset A0 � A there is an element A 2 A such that a � a0 for every a0 2 A0.

Lemma 3.7 Let A � D be a downward directed set in the monotone lattice expansion D =(D;_;^;3), and let p be some prime �lter of D. Then

pQ3\a2A

ba i� 3a 2 p for all a 2 A:

Proof. Since the direction from left to right follows immediately from the monotonicity ofQ3, we concentrate on the other direction.

Assume that 3a 2 p for all a 2 A, and suppose for contradiction that pQ3Ta2A ba does

not hold. Then by de�nition of Q3 and the fact thatTa2A ba is closed, there is a b 2 D such

9

that 3b 62 p andTa2A ba � bb. We claim that there there are �nitely many elements a0, : : : ,

an in A satisfying a0 ^ � � � ^ an � b.To see why this must be the case, consider the �lter F generated by A; that is, F is the

set of elements d in D for which there are a0; : : : ; an 2 A such that a0 ^ � � � ^ an � d. Ifb would not belong to F then by the Prime Filter Theorem there would be a prime �lter qwith F � q and b 62 q. This q would then be such that q 2

Ta2A ba while q 62 bb, which clearly

cannot be the case. Hence, b does belong to F which proves our claim.Since A is downward directed, there is an element a 2 A such that a � a0 ^ � � � ^ an. But

then we also have that a � b, so by monotonicity of 3 and the fact that 3b 62 p we �nd that3a 62 p which contradicts our assumption that 3a 2 p for all a 2 A. qed

4 Representing game algebras

In this section we will show how we can represent a game algebra G as a monotone outcomealgebra once we know that there is some separable module over G.

The basic idea is as follows. Assume that M = (M;_;^;�;3g)g2G is a module overthe game algebra G. By De�nition 3.5, with every operation 3g of M we may associate amonotone outcome relation Qg on BG (for brevity, we will write Qg rather than Q3g). Therepresentation map embedding the game algebra G in the full monotone outcome algebraover BG will map an element g of G to the pair (Qg; Q�g) of outcome relations on BG . Theinjectivity of this map will follow from the separability of the module; in order to prove thatit is a homomorphism we need the following lemma which is one of the main technical resultsof the paper.

Proposition 4.1 Let M = (M;_;^;�;3g)g2G be a module over the game algebra G =(G;_;^;�; �), and let g and h be arbitrary elements of G. Then we have

1. Qg_h = Qg [Qh,

2. Qg^h = Qg \Qh,

3. Qg�h = Qg ÆQh,

4. if 3ga 6= 3ha for some a 2M then Qg 6= Qh.

Proof. Let p be an arbitrary prime �lter and T be an arbitary set of prime �lters of G.For part 1, we distinguish cases as to the nature of T . We �rst assume that T is of the

form ba for some a 2M . In this case we have the following chain of equivalent statements:

pQg_hba () (2) 3g_ha 2 p

() (axiom M1) 3ga _3ha 2 p

() (2) 3g 2 p or _3ha 2 p

() (def. of Q) pQgba or pQgba() p(Qg [Qh)ba:

10

Now assume that T is an arbitrary set. If pQg_hT then 3g_ha 2 p for all a 2 FT , so bythe proof of the �rst case for all a 2 FT we have 3ga 2 p or 3ha 2 p. We claim that pQgT

or pQhT , for suppose otherwise. Then there are elements bg; bh 2 FT such that 3gbg 62 p and3hbh 62 p. De�ne b := bg ^ bh; it is straightforward to check that b 2 FT . But note thatsince b � bg and 3gbg 62 p, we have 3gb 62 p by monotonicity of 3g and upward closures ofprime �lters. Likewise, we can prove that 3hb 62 p. But then we have that 3g_hb 62 p, sinceby M1 it holds that 3g_hb = 3gb _3hb, and p, being a prime �lter, cannot contain the join3gb _3hb without containing 3gb or 3hb.

For the other direction, suppose that p(Qg [Qh)T ; that is, we have that pQgT or pQhT .Without loss of generality, suppose the �rst; now take any a 2 FT ; from pQgT it follows that3ga 2 p, whence also 3g_ha 2 p since 3ga � 3g_ha 2 p. Since a was an arbitrary element ofFT , this shows that pQg_hT .

Part 2 of the proposition can be proved along similar lines | we omit the details.

For part 3, �rst suppose that p(Qg Æ Qh)T . That is, we have some set U � BM suchthat pQgU and every u 2 U satis�es uQhT . Now consider an arbitrary element a such thatT � ba; by de�nition of Qh it holds that 3ha 2 u for all u 2 U , whence U � d3ha. So by theassumption that pQgU we �nd that 3g3ha 2 p. But by M3 we know that 3g3ha = 3g�ha.So, 3g�ha 2 p, and since a was arbitrary, this shows that pQg�hT .

For the other direction, suppose that pQg�hT . First assume that T is some closed set C;

recall that FC is the set of elements b of M such that C � bb. De�neU =

\fd3hb j b 2 FCg:

From this de�nition it is immediate that for every element u 2 U , and each b 2 FC it holdsthat 3hb 2 u; this shows that uQhC for every u 2 U . We also claim that

pQgU: (3)

First observe that the set A = f3hb j b 2 FCg is a downward directed subset of M . Hence,by Lemma 3.7, in order to prove that pQgU it suÆces to show that 3ga 2 p for everya 2 A. Hence, take an arbitrary element a 2 A; by de�nition of A, a is of the form 3hb

for some b in FC . It then follows from the assumption pQg�hC that 3g�hb 2 p, so from3g�hb = 3g3hb = 3ga we have established that indeed 3ga 2 p. This proves (3) and hence,shows that p(Qg ÆQh)C.

In case T is an arbitrary, (not necessarily closed) set of prime �lters, we may use the aboveproof and infer from pQg�hT that there is some set U such that pQgU and uQhT for all u 2 U .Since this implies that uQhT for all u 2 U , we have indeed established that p(Qg ÆQh)T .

Finally, for part 4 of the proposition, suppose that 3ga 6= 3ha for some element of M.It follows from the Prime Filter Theorem that there is a prime �lter p that contains exactlyone of these two elements, say, 3ga 2 p, 3ha 62 p. It is then immediate that pQgba but notpQhba whence Qg 6= Qh. qed

From Proposition 4.1 the following is virtually immediate.

11

Proposition 4.2 Let M = (M;_;^;�;3g)g2G be a separable module over the game algebra

G = (G;_;^;�; �). Then the map rep : G! G(BM) given by

rep(g) = (Qg; Q�g)

is an embedding of G in Gm(M).

Proof. We �rst prove that rep is a homomorphism, that is, preserves the game operations_, ^, � and �. For the join operator this follows from:

rep(g _ h) = (Qg_h; Q�(g_h))

= (Qg_h; Q�g^�h)= (Qg [Qh; Q�g \Q�h)= (Qg; Q�g) t (Qh; Q�h)= rep(g) t rep(h);

each step in this series of identities is an obvious consequence of the de�nitions, of the factthat G is a game algebra, or of Proposition 4.1. We omit the proof for the meet operatorwhich is similar. Concerning dualization, we have

rep(�g) = (Q�g; Q��g) = (Q�g; Qg) = (Qg; Q�g)� = (rep(g))�:

As our last game operation we treat composition:

rep(g � h) = (Qg�h; Q�(g�h))

= (Qg�h; Q�g��h)= (Qg ÆQh; Q�g ÆQ�h)= (Qg; Q�g)2(Qh; Q�h)= rep(g)2rep(h):

This proves that rep is indeed a homomorphism: G ! (Gm(B);t;u;�;2)

Finally, the injectivity of the representation map follows from the assumed separability ofthe module and part 4 of Proposition 4.1. qed

5 Separability

In this section we will prove that every game algebra can be seen as a separable game module.

Proposition 5.1 Let G = (G;_;^;�; �) be a game algebra. Then G, seen as a game module

over itself, can be embedded in a separable game module G0 over G.

Proof. In this proof we will �x a game algebra G = (G;_;^;�; �). Recall that the moduleperspective on G means that we identify G with the structure (G;_;^;�;3g)g2G. We willshow that G can be embedded in a G-module (G0;_0;^0;�0;30g)g2G. To do so, we will �rstconcentrate on extending the de Morgan reduct (G;_;^;�) of G, and then show how toextend the operations 30g to the extended de Morgan lattice. The basic intuition underlying

12

our approach is that we aim at adding a single separating element to M ; that is, an object sthat will satisfy 30gs = g for every g 2 G.

The �rst part of the construction can be applied to arbitrary de Morgan lattices; �x suchan algebra M = (M;_;^;�). In a number of steps we will de�ne an extension M0 of Mwhich satis�es certain nice properties.

To start with, recall that a distributive lattice (and hence, a de Morgan algebra) is boundedif it contains a smallest element ? and a largest element >. An equivalent, equationalde�nition would be to require that the identities x_> � > and x^? � ? hold (plus, in thecase of a de Morgan algebra, �> � ?). It is easy to see that any distributive lattice D canbe embedded in a bounded such lattice Db with carrier Db := D ] f>;?g | the analogousstatement holds for de Morgan algebras but we will not have direct need of this. Note thatin our de�nition of the set Db we always add new elements to D (even if the algebra D itselfalready has a top and bottom element).

Given our de Morgan lattice M = (M;_;^;�), let M 00 be the set (M [f>;?g)2 (that is,M 00 is the cartesian square of the set M b, and let _0 and ^0 be the coordinatewise join andmeet operations on M 00. In other words, the algebra (M 00;_0;^0) is the distributive latticeproduct (M;_;^)b � (M;_;^)b. The operation �0 : M 0 !M 0 is de�ned by

�0(x; y) = (�y;�x);

and we de�neM00 as the structure (M 00;_0;^0;�0). It should be stressed thatM00 is in generalnot isomorphic to the product Mb �Mb.

Claim 1 If M is a de Morgan algebra, then M00 is a bounded de Morgan algebra. Fur-thermore, the diagonal map � : M ! M 00 given by �(a) = (a; a) is an embedding of M inM00.

Proof of Claim We leave this proof as an exercise to the reader. J

The separating element s of M0 will be the pair (>;?); note that this pair is its ownde Morgan dual: �(>;?) = (>;?). Our target algebra M0 will be in a sense the minimalsubalgebra of the algebra M00 which (i) contains the image of M under the embedding �together with the separating element s and (ii) can be made into a module over G later on.For a more precise de�nition, consider the following subset M 0 of M 00:

M 0 = (M [ f>g)� (M [ f?g) [ f(>;>); (?;?)g:

We will use the same notation for the operations _0, ^0 and �0 and their restrictions to toM 0, and we leave it to the reader to verify that the set M 0 is closed under these operations.Let M0 be the algebra (M 0;_0;^0;�0).

Claim 2 IfM is a de Morgan algebra, thenM0 is a bounded de Morgan algebra. Moreover,the diagonal map � : M !M 0 is an embedding of M in M0.

The proof of this Claim is straightforward by our earlier observations.

Finally, we turn to the de�nition of the module G0. Let (G0;_0;^0;�0) be de�ned as above.It is left to de�ne an operation 30g : G

0 ! G0, for every element g 2 G. Before we give theformal de�nition, let us �rst mention some of the requirements that guided our intuitions:

13

1. Since we want the diagonal map � : G ! G0 to be an embedding of G in G0, we needthat 30g(a; a) = (3ga;3ga) whenever a 2 G. This makes it natural to put 30g(a; b) =(3ga;3gb) for arbitrary a; b 2 G.

2. The element (>;?) will be the separating element of G0; this means we have to put30g(>;?) = (g; g) for every g 2 G.

3. The above considerations leave open the problem of what to do with the other elementsof M 0. Note that since the pair (?;>) is not an element of M 0, these other elementswill be either of the form (>; a) with a 6= ?, or else (a;?) with a 6= >. Since theseelements are bigger (smaller, respectively) than any of the elements we encountered inthe �rst two items above, we can and will simply de�ne 30g(>; a) to be the top element(>;>) of the algebra, and 30g(a;?) to be the bottom element (?;?). (This is in factthe only reason why we need these top and bottom elements in the algebra G0.)

Formally, we de�ne, for an arbitrary element g 2 G, the map 30g : G0 ! G0 by putting

30g(a; b) =

8>><>>:

(3ga;3gb) if a; b 2 G;

(g; g) if a = > and b = ?;(>;>) if a = > and b 6= ?;(?;?) if a 6= > and b = ?:

Given a game algebra G, let G0 be the module (G0;_0;^0;�0;30g)g2G.

Claim 3 If G is a game algebra, then G is a separable game module.

Proof of Claim We have already seen that the structure (G0;_0;^0;�0) is a de Morganalgebra, and it is easy to see that the operations 30g are all monotone. The conditions M1{4can be checked via straightforward case distinctions.

For instance, take M3 and consider an arbitrary element g 2 G and an arbitrary element(a; b) 2 G0. We will show that

30�g�

0(a; b) = �030g(a; b):

by a case distinction on the nature of a and b.If both a and b belong to G, then 30�g�

0(a; b) = 30�g(�b;�a) = (3�g(�b);3�g(�a)) =(�3gb;�3ga) = �0(3ga;3gb) = �030g(a; b). The case that a = > and b = ? gives30�g�

0(a; b) = 30�g�0(>;?) = 30�g(?;>) = (�g;�g) = �0(g; g) = �030g(>;?) = �030g(a; b):

If a = > and b is distinct from ?, we �nd 30�g�0(a; b) = 30�g�

0(>; b) = 30�g(�b;?) =(?;?) = �0(>;>) = �030g(>; b) = �030g(a; b): Finally, the case that a 6= > while b = ? issimilar to the previous one. Since this distinction covers all possible cases this proves that M3holds of G0. We omit the proofs concerning the other axioms since they are in fact simplerthan the one given here for M3.

Note that separability of G0 is immediate by the de�nition: if g and h are distinct elementsof G then 30g(>;?) = (g; g) 6= (h; h) = 30h(>;?). J

Since the diagonal map � : a 7! (a; a) is obviously an embedding of the G-module G inthe G-module G0, this proves the proposition. qed

14

6 Consistency

In this section we will prove that every monotone outcome algebra is isomorphic to a boardalgebra. This means that the consistency requirement does not give any extra valid equations.

Proposition 6.1 Let A = (A;t;u;�;2) be a monotone outcome algebra over the set B.

Then A is isomorphic to a board algebra over the set B0 = B [ f1g (where 1 62 B).

Proof. Suppose that A = (A;t;u;�;2) is a monotone outcome algebra over the set B, andlet 1 be an object not in B.

Given a monotone outcome relation R over B, let R0 be given as the following outcomerelation over the set B0 = B [ f1g:

R0 = f(1; T ) j 1 2 Tg [ f(p; T ) j p 2 B; 1 2 T and (p; T�) 2 Rg;

where T� denotes the set T nf1g. It is obvious that any pair of relations (R0; S0) is consistentsince for any p 2 B0 we have (p; T ) 2 R0 only if p 2 T and likewise for S0. Thus (p; T ) 2 R0

implies that (p;B0 n T ) 62 S0.We claim that the function mapping a pair of outcome relations (R;S) to the pair (R0; S0)

is an embedding of A in the board algebra over B. This follows immediately from theobservation that the operation (�)0 distributes over unions, intersections and compositions ofrelations.

We �rst consider union and prove that

(R [ S)0 = R0 [ S0: (4)

In order to prove (4), �rst suppose that (p; T ) 2 (R [ S)0. In case p = 1 it is easy to seethat (p; T ) belongs to both R0 and S0, so we certainly have that (p; T ) 2 R0 [S0. Now assumethat p 2 B. In this case, (p; T ) 2 (R [ S)0 gives that 1 2 T and (p; T�) 2 R [ S. Now, if(p; T�) 2 R then (p; T ) 2 R0 and if (p; T�) 2 S then (p; T ) 2 S0. In both cases we �nd that(p; T ) 2 R0[S0. This shows that (R[S)0 � R0[S0. We omit the proof for the other inclusionwhich is equally straightforward.

This proves (4) and thus shows that (�)0 distributes over unions; the case for intersectionsis similar and left to the reader. Concerning composition, we will prove that

(R Æ S)0 = R0 Æ S0: (5)

First suppose that (p; T ) 2 (R Æ S)0. In case p = 1 we have 1 2 T . Then we alsohave 1S0T , so by 1R0f1g and the de�nition of composition on outcome relations we �nd(1; T ) 2 R0 Æ S0, with f1g as the `middle set'. If on the other hand p belongs to B we have1 2 T and (p; T�) 2 R Æ S. That is, for some set U � B we have (p; U) 2 R and (u; T ) 2 S

for all u 2 U . De�ning U+ = U [ f1g, we see that (p; U+) 2 R0. Also, for an arbitraryelement u 2 U we have (u; T ) 2 S0, and since 1 2 T we also �nd (1; T ) 2 S0. Thus weobtain (p; T ) 2 R0 Æ S0, with U+ as the `middle' set.

For the other direction, assume that (p; T ) 2 R0 Æ S0. This means that for some setU � B0 we have (p; U) 2 R0 and (u; T ) 2 S0 for all u 2 U . In case p = 1 we �nd 1 2 U

15

by (1; U) 2 R0; then by (1; T ) 2 S0 we obtain that 1 2 T ; thus by de�nition of (R Æ S)0

it follows that (1; T ) 2 (R Æ S)0. In case p 2 B, we obtain (p; U�) 2 R by de�nition of R0.Likewise, for all u 2 U� it follows that (u; T�) 2 S. Thus (p; U�) 2 R Æ S. Then, from(p; U) 2 R0 it follows that 1 2 U , so from (1; T ) 2 S0 we �nd that 1 2 T . By de�nition of(R Æ S)0 this means that (p; T ) 2 (R Æ S)0.

This proves (5) and hence �nishes the proof of the proposition. qed

References

[1] V.F. Goranko. The basic algebra of game equivalences. Technical Report PP{2000-12,ILLC, University of Amsterdam, 2000.

[2] R. Parikh. The logic of games and its applications. Annals of Discrete Mathematics,24:111{140, 1985.

[3] M. Pauly. Game logic for game theorists. Technical Report INS{R0017, CWI, Amsterdam,2000.

[4] J. van Benthem. Logic in games. ILLC, University of Amsterdam, 2000. Lecture Notes.

16

VARIETIES OF IFING

AHTI PIETARINEN

Abstract. This paper explores some interpretational issues concerning thefamily of independence-friendly (IF) logics developed by Hintikka and Sandu.An informational approach to the associated game-theoretic semantics is high-lighted, and various IF phenomena is related to the concepts of game theory.In particular, by carefully spelling out the partitional information structure ofthe extensive semantic games for IF logics, one can settle the problems con-cerning the character of imperfect information in IF logics or in one of its newextensions.

1. Introduction

The information-hiding forward-slash operator `/' introduced and studied e.g. inHintikka & Sandu 1989, Hintikka 1996, Hintikka & Sandu 1997 can be applied toall logics which admit of a coherent game-theoretic interpretation. This operator isintended to transform the otherwise sequential and perfect left-to-right information ow in formulas non-sequential and imperfect. These logics have been termedindependence-friendly (IF) logics. The method of `IFing' improves the expressivecapacities of logics, but also makes them highly complex: in �rst-order logic, forexample, its IFed version is equivalent to the �1

1 fragment of second-order logic,while its validity problem is not in �n

m; n;m 2 !.The original Henkin{Hintikka{Sandu semantics for IF �rst-order logic is given

by game-theoretic semantics, where the slashing is taken to signal players' imper-fect information. That is, when making choices, one of the players may not possessall the information about the choices that were made in the past. Various interpre-tational problems ensue when the transmission of information between players isnot just linear or partially ordered, but can also be non-transitive or asymmetric,or when players refer to their own choices and knowledge about them.

2. What is IFing?

Henkin (1961) suggested replacing the usual linear order of quanti�ers with par-tial orders:

8x 9y8z 9w

Pxyzw:(1)

This pre�x amounts to a genuine extension of �rst-order logic, since by using itone can express Mostowski generalised quanti�er there exist in�nitely many ele-ments such that (Henkin, 1961). It follows that a set of axioms for logic with a

Date: May 2001.Key words and phrases. IF logic, game-theoretic semantics, imperfect information, partitional

information.Work on this paper has been partially supported by the Osk. Huttunen Foundation. An

anonymous referee has provided many valuable comments on the earlier version of this paper.

1

2 AHTI PIETARINEN

Henkin quanti�er is not recursive, and so the logic with Henkin quanti�ers is neithercompletely axiomatisable nor compact.

A similar approach has been advocated in Hintikka & Sandu 1989, Hintikka1996, Hintikka & Sandu 1997. In this approach, a forward-slash operation `/' isapplied to rewrite Henkin quanti�ers in a linearised format. This time the ideabehind Henkin quanti�ers becomes generalised.

De�nition 2.1. Let Qx ;Q 2 f8; 9g and � � ; � 2 f^;_g be well-formed �rst-order formulas in L!! in the scope of Q1x1 : : :Qnxn. Let A = fx1 : : : xng. Thenthe IF �rst-order language L�!! is formed as follows.

� if B � A, then (Qx=B) and �(�=B) are well-formed formulas of L�!!.

Let us call `/' an outscoping device, and customarily write fx1 : : : xng as x1 : : : xn.Even more generally, indices in B can be assumed not to be bound by any Qi.

For example, the following are well-formed formulas of L�!!:

9x (P1x(_=x)P2x)::8x1 : : :8xn:(9y=x1 : : : xn)Px1 : : : xny:

Adapting the game-theoretic ideas to the case where moves for propositional con-nectives _, ^ can be made without perfect information, one also gets a propositionalsubsystem of IF �rst-order logic.

It is reasonable to represent disjunctions and conjunctions as indexed disjunc-tions and conjunctions to distinguish between di�erent occurrences of them.

De�nition 2.2. Let be the smallest class of formulas of propositional logic Lsuch that

� all literals S 2 ,� if ' 2 then

Wj02I 'j0 2 and

Vi02I 'i0 2 .

De�nition 2.3. Let � be the smallest class of formulas of an extended proposi-tional logic L� of L such that in addition to De�nition 2.2,

� if ' 2 and U is a �nite set of indices then (Wj02I =U)'j0 2 and

(Vi02I =U)'i0 2 ; U \ I = ;.

The models for the language will be of the form A = hIA; (pA)p2PROPi, where IA

is a two-element set fLeft;Rightg, and each pA is a set of �nite sequences of indicesfrom IA (Sandu & Pietarinen, 2001).

3. Characterising special classes of games

3.1. Games in extensive forms. Let us �x a family of actions A, where a �nitesequence haiini=1; n 2 ! represents the consecutive actions of players N (no chancemoves), ai 2 A:

De�nition 3.1. An extensive game G of perfect information is a �ve-tuple

GA = hH;Z; P;N; (ui)i2N i

such that

� H is a set of �nite sequences of actions h = haiini=1 from A, called historiesof the game. We require that:{ the empty sequence hi is in H ;

VARIETIES OF IFING 3

{ if h 2 H; then any initial segment of h is in H too, i.e. if h = haiini=1 2H then pr(h) = haiin�1i=1 2 H for all n, where pr(h) is the immediatepredecessor of h (= ; for h = ;).

� Z is a set of maximal histories (complete plays) of the game. If a historyh = haiini=1 2 H can continue as h0 = haiin+1i=1 2 H , h is a non-terminalhistory and an+1 2 A is a non-terminal element, otherwise they are terminal.Any h 2 Z is terminal.

� P : H n Z ! N is the player function which assigns to every non-terminalhistory a player N whose turn is to move.

� each ui; i 2 N is the payo� function, that is, a function which speci�es foreach maximal history the payo� for player i.

For any non-terminal history h 2 H we de�ne

A(h) = fx 2 A j h _ x 2 Hg:

A (pure) strategy for a player i is any function

fi : P�1(fig)! A

such that fi(h) 2 A(h); where P�1(fig) is the set of all histories where player i is tomove. A strategy speci�es an action also for histories that may never be reached.

A strictly competitive game is a particular case of a game de�ned as above, inwhich N = fV; Fg and in addition:

� uV (h) = �uF (h);� either uV (h) = 1 or uV (h) = �1 (that is, V either wins or loses);

for all terminal histories h 2 Z.

Theorem 3.1 (Zermelo, 1913). For a two-player strictly competitive game with�nitely many possible positions: the player can avoid his loss for only �nitely manymoves if his opponent plays correctly i� the opponent is able to force a win.1

Nowadays it is customary to refer to Zermelo and say that every �nite strictlycompetitive perfect information two-player game is determined: either the player 1or player 2 has a winning strategy.

3.2. Extensive semantic games of perfect information. Let the structure Abe a � -structure with a signature � of a nonempty domain jAj on which the gameis being played. Let Sub(') denote a set of subformulas of '.

De�nition 3.2. An extensive form semantic game G(';A) associated with an L!!-formula ' is exactly like an extensive game G de�ned above, except that it has oneextra-element: a labelling function L : H ! Sub(') such that

� L(hi) = ' (the root);� for every terminal history h 2 Z;L(h) is a literal.

In addition, the components H;L; P; uV and uF jointly satisfy the following re-quirements:

� if L(h) = _ � or L(h) = ^ �; then h _ Left 2 H; h _ Right 2 H;L(h _ Left) = ; and L(h _ Right) = �;

� if L(h) = _ �, then P (h) = V ;� if L(h) = ^ �; then P (h) = F ;� if L(h) = 9x' or L(h) = 8x', then h _ a 2 H for every a 2 jAj;� if L(h) = 9x', then P (h) = V ;

4 AHTI PIETARINEN

� if L(h) = 8x', then P (h) = F ;� for every terminal history h 2 Z :

{ if L(h) = Pt1 : : : tm and A j=+ Pt1 : : : tm; then uV (h) = 1 and uF (h) =�1;

{ if L(h) = Pt1 : : : tm and A j=� Pt1 : : : tm; then uV (h) = �1 and uF (h) =1.

The notion of strategy is de�ned in the same way as before. A winning strategyfor i is a set of strategies fi that leads i to ui(h) = 1 no matter how the player �i(the player other than i) decides to act.

It is further seen that:

A j=+ ' if and only if there exists a winning strategy for V in G�(';A):

A j=� ' if and only if there exists a winning strategy for F in G�(';A):

3.3. Imperfect information and informational partition. To represent im-perfect information by means of extensive form games, let us extend GA to a six-tuple

G�A = hH;Z; P;N;L; (ui)i2N ; (Ii)i2N i

with an additional component (Ii)i2N :

De�nition 3.3. Ii is an information partition of P�1(fig) (the set of historieswhere i moves) such that for all h; h0 2 Sij ; h _ x 2 H if and only if h0 _ x 2

H; x 2 A; j = 1 : : :m; i = 1 : : : k;m � k. Sij is an information set.

The games are exactly as before, except that now players might not have all theinformation about the past features of the game. This is done by means of theinformation partition, which partitions histories into information sets (equivalenceclasses). Those histories that belong to the same information set are indistinguish-able to players, and thus a player may not be informed about what the actualhistory that has been played would be.

In imperfect information games, the strategy function is required to be uniformon indistinguishable histories:

if h; h0 2 Sij 2 Ii then fi(h) = fi(h0); for i 2 N:

Since histories h 2 H are mapped by a labelling function L(h), one sees thatL(h) 2 Sij , that is, information sets consist of subformulas of '.

For all h; h0 2 H , extensive semantic games of imperfect information G�(';A)further satisfy

� The consistency condition:

if h; h0 2 Sij 2 Ii then A(h) = A(h0):

� The von Neumann & Morgenstern condition:

if h; h0 2 Sij 2 Ii then length(h) = length(h0); for all i 2 N:

The idea behind consistency is that if a player does not distinguish between twohistories h and h0, then the choices available to him after h must be the same asthose available to him after h0: The von Neumann & Morgenstern condition, on theother hand, puts constraints on the past of indistinguishable histories.

VARIETIES OF IFING 5

3.4. Imperfect recall. Let 4 be a partial order on the tree structure of exten-sive form games G and G�. We say that an extensive form game satis�es non-absentmindedness if for any h; h0 2 H , h; h0 2 Sij , if h 4 h0 then h = h0.

Let a depth d(Q) of a logical component Q in a formula be de�ned inductively ina standard way. It can be observed that G�(';A) for L�!!-formulas ' satisfy non-absentmindedness. This is because all logical components Q in any L�!!-formula 'have a unique depth d(Q), and hence every subformula of ' has a unique positionin G�, as given by L(h). Thus for any two subformulas of ' at h; h0 2 H within Sij ,

h 64 h0 and h0 64 h.So for any L�!!-formulas ' and , if is a subformula of ' at h 2 H and � is

a subformula of at h0 2 H , and and � are labelled at the same play h 2 Z, if 2 Sij and � 2 S

kl then i = k and j = l. (Since there is no (Ii)i2N in G, it trivially

satis�es non-absentmindedness.)Let Z(h) be a set of plays that pass through any h 2 H , if h becomes a subse-

quence of any h0 2 Z(h). Likewise, let Z(ai) be a set of plays that pass throughan action ai 2 A (or a sequence of actions haiini=1), if a

i 2 h0 2 Z(ai). De�ne aprecedence relation <� between any two information sets Sij ; S

ik 2 Ii as:

If h; h0 2 Sij � Sik such that h � h0, then Sij <� Sik.

Thus Sij <� Sik says that there exists a play h00 2 Z passing through h and h0.

If non-absentmindedness holds then any h00 2 Z passes through Sij or Sik at most

once.Let P�1(fig) be the set of histories where i moves playing a strategy fi. An

information set is relevant for fi, if Sij \ P

�1(fig) is non-empty.

Let Sij 2 Ii. A game G�A has perfect recall1, if

Sij is relevant for fi implies Sij � P�1(fig) for all fi.

This de�nition says that while players move within their information sets theywill have perfect recall in the sense of not forgetting information that they possess.

There is also an alternative way of characterising perfect recall. A game G�A hasperfect recall2, if

Sij <� Sik implies the existence of a sequence of actions haiini=1 2 A avail-

able from Sij such that Z(Sik) � Z(haiini=1).

For otherwise there will be wider information sets occurring for a player later onin the game. So this de�nition says, roughly, that a player does not forget his orher actions.

Hence, by means of information partition, we can make �ne-grained distinctionsbetween forgetting information and forgetting actions.

It can now be observed that games G�(';A) for L�!!-formulas ' do not satisfythese de�nitions of perfect recalli, i = 1; 2. This is because any L�!!-formula 'which contains a subformula = Q1x1 : : : (Q2xn=x1), Q1; Q2 = 9 or Q1; Q2 = 8and d(Q1) < d(Q2), gives rise to a partition where a subformula of ' beginningwith Q2 induces S

ik and a subformula of ' beginning with Q1 induces S

ij such that

Sij <� Sik. Thus the actions haiini21 2 jAj that the player i 2 f9;8g chooses for

Q1x1 are available from Sij , but then clearly Z(haiini21) � Z(Sik). On the otherside, perfect recall1 depends on allowing `non-standard' information sets that arenot relevant for player's strategies fi. But any such information set violates perfectrecall1, where all P

�1(fig) are L(P�1(fig)).

6 AHTI PIETARINEN

Syntactically speaking, a formula ' in L�!! has perfect recalli, i�

� for any (Q1i1=U1); (Q2i2=U2) in ', if either Q1; Q2 = 9 or Q1; Q2 = 8 andd(Q1) < d(Q2), then i1 62 U2, and

� for any (Qj1=U); (Q1j2=U1); (Q2j1=U2) in ', if either Q1; Q2 = 9 or Q1; Q2 =8 and d(Q) < d(Q1) < d(Q2) and j1 62 U1, then j1 62 U2; j2 62 U1.

The former clause is about player forgetting his or her own actions. The lattersays that two components of the same type may have imperfect recall even if thelatter is not independent of the former, provided that they have acquired di�erentinformation from elements higher up in a formula.

Thus it becomes possible to study fragments of imperfect information logic whereimperfect recall does not hold, or holds in some restricted sense. In the latter case weare dealing with aspects of bounded recall (Lehrer, 1988), as well as with imperfectmonitoring of actions and information transmission.

Similar considerations hold for the propositional versions of IF logics.

4. Interpretational issues

4.1. The team interpretation. The original semantics for IF �rst-order logic wasgiven by Hintikka{Sandu version of Henkin{Hintikka game-theoretic semantics.2 Aquestion emerges about the interpretation of the game-theoretic notion of informa-tion forgetting (imperfect recall), however.

A somewhat standard approach to imperfect recall in game theory is to considerplayers to consist of members (or agents, multiple selves, see von Neumann &Morgenstern 1944, p. 53). While this approach is not unproblematic, it immediatelyprovides a way to understand such games.3 More precisely, then, a team T is a(�nite) set of non-coordinating players i = f1 : : : ng who have identical payo�s ui(h)but who act individually. The teams V and F have a �nite number of individualmembers Vl 2 V and Fk 2 F; l; k � n for �nite positive integers l; k.4

The members of a team are not allowed to communicate because this woulddestroy team's ability, when viewed as one player, to genuinely forget something.The members of the same team all receive the payo� ui(h) when the outcome of aplay is solved. In addition, the information for individual team members remainspersistent although teams, viewed as single players, do not forget information.

Whenever a move associated with the team V or the team F is regarded asindependent of the move made by the member of the same team, a new memberVl 2 V or Fk 2 F; 0 < i; j � n makes the new move.

4.2. Teams but no forgetting. Let us observe that if we allow IFed connectives,just two moves is enough for i = 2. An example is provided by

8x(P1x (_=x) P2x);(2)

that is, by

8x

_i02I

=x

!Pi0x;(3)

with Pi0x as atomic. A play of the game goes on as follows. First, F chooses anindividual from jAj (say, a), and the game is continued as G�((P1a (_=x)P2a); jAj).Now, V is not informed of F 's move, but because the atomic Pi0x has been instan-tiated with the name `a', this information would be recoverable by observing thedisjuncts.

VARIETIES OF IFING 7

The way out is that also in this case, V is regarded as a team of two members:V1 is informed of the name of the chosen individual, here a, and V2 chooses one ofthe disjuncts. If V2 chooses i

0 = Left, if P1a is true, V wins, if false F wins.5

4.3. Remarks. The team approach should not be taken too literally, however,since it merely is a modelling device. There can still be just two principle players,each member of the team heeding the same strategic purpose as, and sharing thesame preferences with, the principle player. What the team games aim is at explain-ing what happens when information is dispelled from the players' memory. For ifthe information is not persistent, players could inde�nitely oscillate between vary-ing amount of information, and to prevent this players split into individual agentsor members of the team, each of them acting individually but being coordinatedby the two principle players. There is no coordination, signalling or informationtransmission between agents, however, and agents are making decisions based onthe private or local information they have acquired from the game. One can thinkof this as there being an implicit mapping from the `information set' (member set)of the principle player to its individual members, so that the principle player wouldplay the role of the members, each at the time, possessing at any time only theamount of information that belongs to that single agent. Ultimately, we get anagent normal form of a game, whenever an agent for each information set is aseparate player of a team.

Having an indexed set of multiple agents is useful in other respects too. InIF logics, situations sometimes arise (e.g. in modal logics) where one would liketo have an explicit way of representing whose information sets are in question,since there is no reason to assume that a player's information sets would alwayscome with those histories where player plans his or her actions. Consequently,the team approach generalises the ordinary game-theoretic model of informationpartition, which traditionally consists of information sets associated with playersbut defectively required to be marked at those histories where the players plan theirdecisions.

5. Extensions of IF logics

5.1. Information uctuation. Let us present some examples where formulas ofIF �rst-order logic go beyond their Henkin quanti�er ancestors. First, often alsoF 's strategies are important, so one does not restrict attention merely to functionaldependencies triggered by existential-universal pre�xes. This duality provides oneway of looking at the phenomenon of partiality, for example, as the games do nothave to be determined. Partiality is then a purely objective fact about the modelin question, not related to the limitations of knowledge or any epistemologicalimpediment of agents.6

Second, formulas of IF logic are not only partially ordered, unlike Henkin quan-ti�ers. To see this let us consider two examples. First, consider

8x9y(9z=x)Pxyz:(4)

In IF logic, all the logically active components are dependent unless otherwiseindicated by the slash. Therefore 9y depends on 8x and (9z=x) depends on 9ybut not on 8x. This is not a partial ordering of quanti�ers, but a non-transitiveone. To see the di�erence to partially ordered case, one can consider an extensiveform representation of the associated games, and observe that there are non-trivial

8 AHTI PIETARINEN

information sets associated with the player making the third move which are locatedat the second level in the game, including all the nodes at that level within the sameinformation set.7

Another example is given by the formula

8x9y(9z=y)Pxyz:(5)

Here existential quanti�ers are independent, but they both depend on the universalquanti�er. This kind of ordering and the corresponding information ow would benon-Euclidean, and its representation involves two non-singleton information setsfor the latter member of the veri�er team in the third round of moves.

Consider also the case given by

8x(9y=x)9z Pxyz:(6)

This formula says that the second quanti�er is independent of 8x, and that the thirdone depends on both previous quanti�ers. Since there is a non-singleton informationset at the second level in the associated game, this set does not a�ect forthcomingmoves. It has to be indexed for the �rst member making the second moves, but notfor the second member making the third moves. If there is imperfect information,it may not hold later. Therefore, in addition to forgetting, players can also be saidto acquire new information, or bring up something that has been forgotten, andsuch patterns might repeat and alternate inde�nitely, depending on the complexityof the formula in question.

5.2. Consequences to game theory. The phenomenon of informational increasere ects what happens in screening games (Rasmusen, 1994, p.166) where the �rstplayer is uninformed of certain aspects of the game and the second player, beingfully informed, can screen his or her actions. In signalling games, which are closelyrelated to imperfect recall as they also involve teams of players, the informed playermoves �rst and can signal previous features of the game to the subsequent unin-formed player. If in the former case the types of the �rst and the second playerare the same, then screening amounts to learning, and likewise, the phenomenonof signalling means, for the two players of the same type, that information is beingforgotten.

These phenomena need to be carved up a right game-theoretic joints, however.The game-theoretic notion of information (time) consistency says that the notionof time has an unambiguous meaning in that the information partition distinguishesbetween the past, present and future choices in an unambiguous way. This is whatis captured in assuming information sets be partially ordered in the sense of <�.

One should assume that the partitional structure (Ii)i2N that G�(';A) givesrise to is time consistent, that is, Sij 2 Ii are partially ordered. Now this holdsfor �rst-order ', but for propositional logic, information sets may not always bepartially ordered. An example is provided by

(p1 (_=^) p2) ^ (q1 _ q2):(7)

Is the associated game well de�ned? One option is to give up partitional informationstructure and let information sets be asymmetric. Thus even single actions canconditionalise the existence of imperfect information itself.

Furthermore, players could sometimes try to recover the identity of the informa-tion set they are at by looking at the available choices also in cases where there is

VARIETIES OF IFING 9

a possibility that some of the histories in an information set are terminal ones. Anexample of this is

(p1 (_=^) p2) ^ p3:(8)

In this and similar cases apparently violating the uniformity requirement, we canapply an idempotence law and add super uous moves so that a player repeatedlychooses p3 to make otherwise terminal histories non-terminal. How this is done inextensive games is straightforward.8

Extensive form games with the associated information partition provide a gen-eral perspective to imperfect information in logic, although such a perspective ison the one hand too limited (too static to account for all aspects of the players'informational con�gurations within games) while too general on the other. Thereason for the latter is that there are examples of games which do not have anycounterparts in current IF syntax, such as intensionalised (conditionalised) imper-fect information, arising whenever a particular choice made by a player determineswhether some later component is evaluated under information hiding or not. Anexample of such a game is given by a situation where the existence of imperfectinformation can be made to depend on whether a player chooses a particular in-dividual. The information such games decode can be tried to be captured withformulas such as

8x9y(9z=[x=a1] : : : [x=an]! x)Pxyz:(9)

This formula is intended to make explicit the fact that information hiding can beconditional upon a particular action made by a player in any play of the game.

Further examples of non-IF representable games are those where any two nodesin one information set have a di�erent number of successor actions (as happensin modal logic), or those where information sets apparently cannot be partially or-dered, such as (7). A completely unlimited manipulation of informational situationsby means of a general notion of information structures paves the way of having acompletely IFed logic, re ecting game instances in the syntax.

In the remainder of this paper, some further ideas of extending IF logics beyondthe received territory are explored.

5.3. Signalling. The following examples discuss the phenomenon of IF logics ob-served in Hodges 1997a and Janssen 1999.

Intuitively, formulas with empty or dummy quanti�ers should be equivalent toformulas without them, since there is no variable instantiation in matrices. Forexample, in

8x9y9z Pxz;(10)

the �rst existential quanti�er 9y does not play any role, and thus is equivalent to

8x9z Pxz:(11)

For cases with imperfect information, however, the situation changes, since in

8x9y(9z=x)Pxz;(12)

the dummy 9y may mediate the otherwise hidden information from x to z. However,without the dummy quanti�er this formula is not determined and lacks a de�nitetruth-value. With one, it may become true.

10 AHTI PIETARINEN

.......................

....................................................................................... ..........

..........................................................................................

..........................................................

..........................................................

...............................................................

.......................................................

.......................................................

.......................................................

.......................................................

.......................................................

.......................................................

...........................................................

...................................................................

.....................................................

...................................................................

.......................................................

a

a

b

a bbabab

F : 8x9y(9z=x)Pxz

9y(9z=x)Paz 9y(9z=x)Pbz

(9z=x)Paz(9z=x)Paz(9z=x)Paz

Paa Pab Paa Pab Pba Pbb Pba Pbb

(1;�1)

a

(9z=x)Paz

(1;�1)

a bb

V2 :

V1 :

SV2

1SV2

2

: : : : : :

Figure 1. A team game G�(�;A), � = 8x9y(9z=x)Pxz.

Yet it is possible to restore the non-determinacy of games for (12) with dummyquanti�ers, by using games of imperfect recall with non-transitive information ow.Dummy variables prompt a move by player, but these individuals are not assignedto variables, that is, they are not actively used. Later on, a player may forgetthis choice by bifurcating into multiple members. As to the �rst example, there isone non-singleton information set SV21 , whereas V1 makes a move for the dummyvariable. The formula with Pxz, interpreted as an identity relation, is not false instructures with more than two elements, since F cannot have a winning strategy,and it is not true, either, since V2 making the last move does not have informationabout which element F has chosen. The corresponding extensive game is drawnin Figure 1. It is also seen that it is information that V forgets during the game,rather than the actions she has made.

A related phenomenon happens with allegedly redundant disjuncts. For example,in

8x((9y=x)Pxy _ (9y=x)Pxy);(13)

that is, in

8x_i02I

(9y=x)Pi0xy; Pi0xy = Pj0xy;8i0j0 2 I;(14)

the player V might receive otherwise forbidden information about the actions for xthrough the mediating disjunction, and thus the formula would not be equivalentto 8x(9y=x)Pxy. However, in our imperfect recall setting where the team membersdo not communicate V2 does not have a winning strategy for she does not know F 'schoice, and thus the team V as a whole cannot have a winning strategy. This isbecause she cannot pool together the strategies that the members have been using.Since there is no winning strategy for F either, the game becomes non-determined.The extensive form game for this example is drawn in Figure 2.

Other examples in Janssen 1999 can be dealt with in like manner. Hence theteam games provide a general perspective to informational independence.

5.4. Symmetry. We can also have a possibility of creating symmetric dependencebetween quanti�ers. In such cases one can be said to have more dependence thanin classical logic (Hintikka, 2001).

There are two ways of achieving this. The �rst strategy codi�es symmetry be-tween quanti�ers or connectives and some other components that reside deeper ina formula. This would require a new syntactic notion, such as a dualised `co-slash'

VARIETIES OF IFING 11

....................

.......................................................................................... ..........

......................

....................................................................

..........................................................

..........................................................

...............................................................

.......................................................

.......................................................

.......................................................

.......................................................

.......................................................

.......................................................

.......................................................

...........................................................

...................................................................

.....................................................

...................................................................

a

a

b

a bbabab

Paa Pab Paa Pab Pba Pbb Pba Pbb

V2 :

Right

(1;�1)(1;�1)

(9y=x)Pay (9y=x)Pay (9y=x)Pay (9y=x)Pay

Left Left Right(9y=x)Pay _ (9y=x)Pay (9y=x)Pby _ (9y=x)Pby

SV2

1

: : : : : :

SV2

2

F :

V1 :

8x((9y=x)Pxy _ (9y=x)Pxy)

Figure 2. A team game G�(�;A), � = 8x((9y=x)Pxy _ (9y=x)Pxy).

(inscoping) operator. For example

(8xny)9y Pxy(15)

means that 8x depends on 9y, in spite of the fact that 9y depends on 8x. One canthus generate formulas with cyclic dependencies whose evaluation would requirecertain extensions to traditional semantic games, departing from the conventionaltree structure of extensive form of games.9

The second way is to have a logic with identity, and code the symmetrical de-pendencies in the following manner (Hintikka, 2001):

8t8x9u8y(9z=x)((x = z ^ y = u)! Ptxy):(16)

In general, this symmetry is brought out by formulas which have identities be-tween variables connected with quanti�ers that are independent as marked by theslashing. The extra dependence comes out in the form of a constrained choice:when making a choice for z, V 's strategy depends (she is informed of) the choicesfor t and y, but not that of x. But a member of V nonetheless has to try to �nd avalue which makes the identity x = z true although she does not know the value forx. Similar thing happens with u, whose value is, for the verifying purposes, equalto y although this choice depends only on t and x. Putting these cases together,one sees that V has two strategies, f(t; y) and g(t; x), the former being equal to xand the latter being equal to y, so that x is a function of t and y and y is a functionof t and x. One can thus create a �xed point merely by using standard notions of�rst-order logic with equality plus imperfect information.

In symmetric formulas, V 's purpose is to �nd a value for a variable z which isequal to any value for x. Therefore, such a constrained action works for choicesrather than moves (sets of choices), where particular choices are not assumed to beknown when a player is making a constrained action. Hence conjunction, for exam-ple, can in this version of symmetry be interpreted as a parallel conjunction ratherthan a sequential one. A similar constrained choice arises even with the ordinary9x9y (x = y), for instance. Its independent version 9x(9y=x) (x = y) would notbe strongly equivalent to it, since the games for the latter can be non-determinedeven if there is only one (imperfect recall) player, if the member strategies cannotbe pooled together.

5.5. Instantiation. The notion of instantiation in IF logics is related to the con-cept of independencies between individuals. In short, instantiation means that alsothe variables occurring at the right-hand side of the slash need to be instantiated

12 AHTI PIETARINEN

in the course of the game. This is because in

8x9y(8z=xy)(9u=xy)Pxyzu;(17)

when making a choice for z, F is not informed of the particular instances of x and yare which have been made earlier in the game, and likewise, when making a choicefor u, V does not know the particular values of x and y (cf. (2)). Thus from thethird move onwards, the game is played on (8z=ab)(9u=ab)Pxyzu rather than on(8z=xy)(9u=xy)Pxyzu; with the relevant variables instantiated with the individualconstants named, say a and b (Hintikka (2001)).

It is interesting to note that the instantiation is already re ected, although notexplicitly notated, in the extensive form where one typically speaks of moves ratherthan choices. But one can also envisage imperfect information about just someparticular individual actions in addition to moves. In this case a modi�cation of theordinary informational partition of extensive form representation to an alternativechoice partition becomes useful.10

5.6. Delayed forgetting. One can generate new forms of imperfect informationand recall by iterating the slash:

8x9y(9z=(y=x))Pxyz:(18)

This amounts to the notion of `delayed forgetting', where V forgets her choiceonly afterwards, at a position where she already is making some later decisions.Such a game di�ers from the one with merely a single slash application (like in8x9y(9z=xy)Pxyz), because in the former, V is perfectly informed of F 's move forx. This di�erence can be observed from the respective extensive form representa-tions which have di�erent information partitions.

In other words, V forgets F 's �rst choice when making her second move, ratherthan forgetting it outright. The possibility of such a delayed memory dysfunctionemphasises the dynamic nature of information in games, since the sets may appearat an arbitrary instance within a game, independently of whether a player movesat the history where the set is to appear. In general, iterative information hidingcaptures a notion of regret or reconsideration of one's past choices.

5.7. Dynamism of information and double slashes. A double-slash notationhas been proposed as an alternative syntax for informationally independent log-ics (see Hintikka 1996, and a compositional semantics in Hodges 1997b and fullabstractness in Hodges 2000). A double-slash formula corresponding to a Henkinquanti�er is

(8x==zu)(9y==zu)8z9uPxyzu:(19)

The meaning is that the quanti�ed left-hand side variable is independent of thequanti�ed right-hand side variables that reside deeper in the sentence. One curiosityof such formulas is that one can have perfectly classical-looking subformulas thatnevertheless may have been exempted from the scope of some outer quanti�ers.

No game semantics has been given to this operator, however, and so a questionarises whether the imperfect information semantics functions as before. The an-swer is positive, but since imperfect information is marked at the variables whichat the moment of the decision are not independent of anything occurring deeperdown in the formula, the game should proceed with a separate bookkeeping sys-tem annotating the future independencies as the game proceeds. The double-slash

Notes 13

thus says something like `choose a, bearing in mind that actions for, say x, will beindependent of it'. Of course, if the player who chose a will be making choices forx, he or she has to be assumed to forget the choice of a later on.

One way of implementing such a system can be found in extensive form gamesthemselves. Here again we run across the fact that the traditional way of rep-resenting players' information by a partitional structure may turn out to be toorigid and a more dynamic view is needed. One manifestation of the rigidity is thealready mentioned location problem, which says that the information sets do nothave to coincide with the notion of a player moving at the histories within thoseinformation sets. Hence information sets can be marked at the histories further upin a game tree than the actual location of the player associated with the informa-tion set. What this amounts to in terms of the double-slash notation is that theactions prompted by the components on the left-hand side may be indistinguish-able to some future player, realised so that the nodes immediately following thehistories for the slashed quanti�er are encircled as (possibly separate) informationsets, one for each variable on the right-hand side of the double-slash. Obviouslyone cannot yet know, at this point, whose information sets they are going to be,until the quanti�ers that bind those variables, or some other components deeper inthe formula, are reached.

The method of double-slashing thus vindicates a dynamic approach to the no-tion of information set. Such a notation is also useful when one considers hidingof information at actions rather than decision nodes, because what notions like(8x==y) say is that the choices for y do not depend on x (in general it is possibleto conceive both double and single slash operations as dependence markers insteadof independence markers).

6. Conclusions

The wider picture behind this paper is that by investigating and manipulatingthe informational structure of extensive semantic games one not only gets di�erentgames but also derives di�erent logics. A slight change in the partition of histo-ries can describe situations beyond the expressive capabilities of ordinary syntaxof IF logic. But also changes in IF syntax are conceivable, such as dependence,slash-iteration, and intensionalised imperfect information. As observed here, thesechanges can in most cases be dealt within the framework of extensive games. How-ever, symmetric formulas are examples of situations where concurrent games areadvisable instead of the traditional ones. Also, the dynamic nature of informationsets needs to be further studied both in logical and in game-theoretical contexts.

Notes

1In contrast to many claims in the literature, Zermelo did not anticipate or invent `backwardinduction' in his paper (in backward induction, one starts from the immediate predecessors ofterminal nodes in a game tree, and selects a choice maximising the outcome over all alternativeactions, deleting the nodes that come immediately after this node, and assigning an outcome toit. This reasoning is then recursively applied to all histories, until the root of the tree is reached).Neither did Zermelo prove the existence of winning strategies (determinacy) of the game of chess.

Rather, he was interested in the question of what properties does a position in a game have tohave so that White, independently of how Black plays, can enforce a win in at most n moves.

2Also, the semantics is given for sentences, not for open formulas in general. There exists anextension of game-theoretic semantics also for formulas (Hodges, 1983).

14 Notes

3The idea of multi-person or multi-self games behind imperfect recall or game-theoretic forget-ting goes back to von Neumann & Morgenstern 1944, Strotz 1956, Isbell 1957. Hintikka 1996, p.49refers to such two-person (and in general multiple-person) team games explicitly. Recently, imper-fect recall has been studied in Piccione & Rubinstein 1997. Binmore (1996) criticises multiple-selfgames on the basis that they lack realistic `physical' applications.

4Thus coalition games which assume coordination, do not provide proper models for under-standing informationally independent logics and imperfect recall, and indeed they have not beenconsidered in relation to imperfect recall in game-theoretic literature.

5The referee remarks that instead of thinking of the variable choice via syntactic substitutionbut via variable assignments, then the formula is still P1x (_=x)P2x, and observing the disjunctswould not help unless the variable assignment can be observed.

6Speaking of `knowledge' in connection with strategies is in fact misleading, since players donot really know their winning strategies. The existence of winning strategies is an objective factabout the model in question, not related to players' knowledge about them.

7An alternative is to use n information sets at the third level corresponding to n choices thathave been made when planning the �rst move. It can be argued that this option is not as exibleas the former, and it would not work for IFed modal logic, for example, the reason being thepossibility of there being a di�ering number of alternative choices existing for decision nodeswithin an information set.

8Other laws such as commutativity, distributivity and modularity have their game-theoreticcorrespondents as well. The modularity law in particular provides a de�nite illustration of animperfect information phenomenon, and its orthomodular variations are central in quantum logics,for example.

9Cf. Alpern 1993, Selten & Wooders 2001 for work on extensive form games with cycles (relatedto deterministic graphical games), and Abramsky & Melli�es 1999 and de Alfaro & Henzinger 2000study concurrent games that depart from the extensive tree structure of games altogether.

10In game theory, one often uses choice partitions instead of information partitions, but theyare usually considered to provide tantamount information.

References

Abramsky, S., and Melli�es, P.-A., 1999. `Concurrent games and full completeness',in Proceedings of the 14th Annual IEEE Symposium on Logic in Computer Sci-ence, IEEE Computer Society Press, 431{442.

de Alfaro, L., and Henzinger, T.A., 2000. `Concurrent omega-regular games', inProceedings of the 15th Annual IEEE Symposium on Logic in Computer Science,IEEE Computer Society Press, 141{154.

Alpern, S., 1993. `Stationary equilibria for deterministic graphical games', in K.Binmore, A. Kirman, and P. Tani (eds), Frontiers of Game Theory, Cambridge,Mass.: MIT Press, 95{102.

Binmore, K., 1996. `A note on imperfect recall', in W. Albers, W. G�uth, P. Ham-merstein, B. Moldovanu, and E. van Damme (eds), Understanding StrategicInteraction{Essays in Honor of Reinhard Selten, New York: Springer-Verlag,51{62.

Henkin, L., 1961. `Some remarks on in�nitely long formulas', in (no editor given)In�nistic Methods. Proceedings of the Symposium on Foundations of Mathemat-ics, Warsaw, Panstwowe (2{9 September 1959), Naukowe: Wydawnictwo, NewYork: Pergamon Press, 167{183.

Hintikka, J., 1996. The Principles of Mathematics Revisited, New York: CambridgeUniversity Press.

Hintikka, J., 2001. `What is IF logic and why do we need it?', ms.Hintikka, J., and Kulas, J., 1983. The Game of Language: Studies in Game-Theoretical Semantics and its Applications, Dordrecht: Reidel.

Notes 15

Hintikka, J., and Sandu, G., 1989. `Informational independence as a semantical phe-nomenon', in J.E. Fenstad, I.T. Frolov, and R. Hilpinen (eds), Logic, Methodologyand Philosophy of Science, Vol. 8, Amsterdam: North-Holland, 571{589.

Hintikka, J., and Sandu, G., 1997. `Game-theoretical semantics', in J. van Benthem,and A. ter Meulen (eds), Handbook of Logic and Language, Amsterdam: Elsevier,361{410.

Hodges, W., 1983. `Elementary predicate logic', in D. Gabbay, and F. Guenthner(eds), Handbook of Philosophical Logic Vol. 1, Dordrecht: Reidel, 1{131.

Hodges, W., 1997a. `Compositional semantics for a language of imperfect informa-tion', Logic Journal of the IGPL, 5, 539{563.

Hodges, W., 1997b. `Some strange quanti�ers', in J. Mycielski, G. Rozenberg, andA. Salomaa (eds), Structures in Logic and Computer Science, Berlin: Springer-Verlag, 51{65.

Hodges, W., 2000. `Formal features of compositionality', ms, to appear inJournal of Logic, Language and Information. Available electronically asftp://ftp.maths.qmw.ac.uk/pub/preprints/hodges/formcomp.ps.

Isbell, J., 1957. `Finitary games', in D. Dresher, A.W. Tucker, and P. Wolfe (eds),Contributions to the Theory of Games, Vol. 3, Princeton: Princeton UniversityPress, 79{96.

Janssen, T.M.V., 1999. `On the interpretation of IF logic', in P. Dekker (ed.),Proceedings of the 12th Amsterdam Colloquium, Amsterdam: University of Am-sterdam, 139{144.

Lehrer, E., 1988. `Repeated games with stationary bounded recall', Journal of Eco-nomic Theory, 46, 130{144.

von Neumann, J., and Morgenstern, O., 1944. Theory of Games and EconomicBehavior, New York: John Wiley.

Piccione, M., and Rubinstein, A., 1997. `On the interpretation of decision problemswith imperfect recall', Games and Economic Behavior, 20, 3{24.

Rasmusen, E., 1994.Games and Information (�rst edition 1989), Cambridge, Mass.:Blackwell.

Sandu, G., and Pietarinen, A., 2001. `Partiality and games: Propositional logic',Logic Journal of the IGPL, 9, pp. 107{127.

Selten, R., and Wooders, M.H., 2001. `Cyclic games: an introduction and someexamples', Games and Economic Behaviour, 34, 138{152.

Strotz, R.H., 1956, `Myopia and inconsistency in dynamic utility maximization',Review of Economic Studies, 23, 165{180.

Zermelo, E., 1913. `�Uber eine Anwendung der Mengenlehre auf die Theorie desSchachspiels', in E.W. Hobson, and A.E.H. Love (eds), Proceedings of the FifthInternational Congress of Mathematicians, Vol. 2, Cambridge: Cambridge Uni-versity Press, 501{504. (Translation by U. Schwalbe, and P. Walker: `On anapplication of set theory to the theory of the game of chess', in Schwalbe, U.,and Walker, P., 1997. `Zermelo and the early history of game theory', ms, 12{15.)

Department of Philosophy, University of Helsinki, P.O. Box 9, FIN-00014 Helsinki

University, Finland

E-mail address: pietarin@cc.helsinki.fi

On the de�nition of independence in logic

Theo M.V. Janssen,

Institute for logic, language and computation

University of Amsterdam

email: theo@wins.uva.nl

Abstract

In this paper it is argued that Hintikka's game theoretical semantics

for Independence Friendly logic does not formalize the intuitions about

independent choices. It is rather a formalization of imperfect information.

An alternative semantics which formalizes intuitions about independence

is proposed for a fragment of Independence Friendly logic.

1 Introduction

This paper deals with the de�nition of independent choices in logic. This notionarises in game theoretical semantics. There the truth of a formula is determinedby a game between two players, one who tries to check the formula, and onewho tries to refute it. A version of such games, introduced by J. Hintikka, is IFlogic: independence friendly logic. In IF logic the quanti�er 9y=x arises, whichmeans that a value for y has to be chosen independent of the value for x, andthe disjunction _=x � where a subformula has to be chosen independent ofx. IF logic is described in a number of publications e.g. Hintikka (1974), Sandu(1993), Hintikka (1996), Hintikka & Sandu (1997).

Hintikka calls the players Me and Nature, or Veri�er and Falsi�er, but wewill follow Hodges (1997a) and call them 9loise (female) and 8belard (male); thishas the advantage that pronouns can be used without the danger of confusion.Furthermore, the names re ect the choices the players make (in the situationsarising in this paper): 9loise makes the choice for 9y; 9y=x ;_, and _=x , and8belard for 8 and ^. A formula is true if 9loise has a winning strategy and falseif 8belard has one.

Below, some examples are given which illustrate the aims of IF logic. These,and all later examples, are interpreted on the natural numbers (N). For vari-ables bound by universal quanti�ers always x's will be used, and for existentialquanti�ers y's.

(1) 8x 9y=x [x = y]

When 8belard has chosen, 9loise has to choose y independently of the value ofx, and therefore it may happen that she selects another value. Hence 9loisehas no winning strategy, the formula is `not true'. Also 8belard has no winningstrategy, so the formula is neither true nor false. For the variant with 6= insteadof =, the same holds, neither `true' nor `false'.

1

(2) 8x 9y=x [y � x]

The strategy `let y be 0' is winning for 9loise whatever 8belard plays, hence theformula is `true'.

(3) 8x[x = 7 (_=x) x 6= 7]

This is `not true', because without information on x a guaranteed correct choicebetween the disjuncts is not possible.

(4) 8x19y18x2 9y2=x1 [x1 < y1 ^ x2 < y2]

The choice of y2 is independent of x1, but may depend on x2. A more familiarrepresentation of this example is by means of a branching quanti�er:

(5)

�8x1 9y18x2 9y2

�[x1 < y1 ^ x2 < y2]

The formula is true (on N).Hintikka claimed that a compositional semantics for IF logic would not be

possible. However, Hodges has given a compositional interpretation (Hodges(1997a), Hodges (1997b)). By doing so, he clari�ed several aspects of the logic.

The main aim of this paper is to show that the semantics for IF logic, viz.game theoretical semantics, does not capture the intuitions about independence.In section (2) many examples will be given which argue for this, and an alterna-tive interpretation, called subgame semantics, will be proposed in section (4).

2 Con icts with intuition

2.1 Context

Consider:

(6) 8x[x 6= 2 _ 9y=x [x = y]]

In the formula it is mentioned that it is possible that x di�ers from 2. This isno news, x runs over all numbers. Furthermore, as 9y=x indicates, informationconcerning x should play no role when y is selected. We have seen in example(1) that such an independent choice is not possible. But in game theoreticalsemantics the context in which this subformula occurs makes a di�erence. For9y=x 9loise always chooses y := 2 (read as: `for y is chosen the value 2' or `ybecomes 2'). Her strategy for the disjunction is: if x happens to be di�erentfrom 2, choose the left hand side of the conjunction (which then is true), andotherwise choose the right hand side (which then becomes true by her choicefor y). So (6) is true in game theoretical semantics.

In (1) 9loise could not �nd a y independent of x such that x = y. Accordingto my intuition that also means that she cannot �nd an x in situations whereshe can deduce from the context that x = 2, because she is supposed not to usethe value of x. Using this information is cheating. This illustrates that gametheoretical semantics semantics does not formalize independence.

If one has to �nd a value for y that equals the value of x, that is, intuitively,as diÆcult as �nding a value that is di�erent. If one knows the value of x, both

2

tasks can be done easily, and if they have to be performed independently ofthe value of x, there are no strategies to solve these tasks. However, in gametheoretical semantics changing = into 6= makes a di�erence. It turns the truesentence (6) into (7) which is not true.

(7) 8x[x 6= 2 _ (9y=x)[x 6= y]]

On the other hand:

(8) 8x[x = 2 _ (9y=x)[x 6= y]]

is true in game theoretical semantics (strategy y := 2). These variants showagain that the interpretation does not correspond with intuitions on indepen-dence.

2.2 Repetition

It is no printing error that in (9) the same subformula occurs twice.

(9) 8x[(9y=x)[x 6= y] _ (9y=x)[x 6= y]]

According to my intuition, if one cannot �nd a y independent of x, one cannot�nd that if one may do so, at one's choice, in a left hand side subformula, or inthe right hand side one. It remains the same choice, and is as diÆcult on theleft as on the right.

In game theoretical semantics, however, (9) is true. A possible strategy isas follows. If x = 3 then 9loise chooses the left subformula, and follows therethe strategy always to choose y := 4. Otherwise, she chooses right, where herstrategy is to choose y := 3. Whatever the value of x is, she always ends in asituation such that x 6= y is true. So this is a winning strategy: the formula istrue.

The above example shows a very strange property of game theoretical se-mantics: �_� is not in all contexts equivalent with �. The formula [(9y=x)[x 6=y]_ (9y=x)[x 6= y], with x as free variable, is an example. This remarkable phe-nomenon is discovered by Janssen (1997). An example concerning conjunctionwill be given in section 2.5.

Again, one might expect that �nding a value y that equals x will be asdiÆcult as �nding one di�erent from x. However changing 6= into = in (9)makes a di�erence:

(10) 8x[(9y=x)[x = y] _ (9y=x)[x = y]]

A strategy for the left disjunct has to be a constant function, say y := n, andthe same for the right disjunct, say y := m. This means that 9loise can onlydesign a strategy that works for two values of x, whereas 8belard has manymore choices. So she has no winning strategy, the formula is not true.

When we have as many disjuncts as there are elements in the domain, theformula becomes true again. In game theoretical semantics the in�nite disjunc-tion is true on N:

(11) 8x[(9y=x)[x = y] _ (9y=x)[x = y] : : :]

The point of this section is not that the laws of traditional logic are broken(although that is not attractive), but that intuitions concerning independenceare violated.

3

2.3 Existential quanti�ers

Consider

(12) 8x9y1 9y2=x [x = y2]

This examples resembles example (1), the di�erence is that a vacuous quanti�ery1 is inserted. The information that there exists a number tells us nothingnew, so one might expect that this change makes no di�erence for the task to�nd a y2 independent of x. In the compositional semantics for IF logic, givenin Hodges (1997a), the surprising result holds that (12) is true. The strategy9loise follows for 9y2=x is to play y2 := y1. This strategy does not mention thevalue for x, and therefore is allowed. The strategy for 9y1 is to play y1 := x;this dependence is allowed because 9y1 has no slash. So y1 = x, and, sincey2 = y1, it follows that x = y2. By choosing these strategies, 9loise always wins(although the formula without the empty quanti�cation is not true).

This result is not accordance with intuitions about independence. The valueof y2 is carefully chosen in such a way that it equals x, hence it is very dependenton x.

The issue is clari�ed in Hintikka (1996), which appeared after Hodges (1997a)was written. Hintikka says `the small extra speci�cation that is needed is thatmoves connected with existential quanti�ers are always independent of earliermoves with existential quanti�ers' (Hintikka 1996, p. 63). This means thatin case an existential quanti�er 9y2 occurs within the scope of 9y1, then 9y2should be interpreted as if it was written as 9y2=y1 . In the appendix to Hin-tikka's book, Sandu presents a formal interpretation of IF logic in which thisindependence of existential variables on other ones is formalized (Hintikka 1996,p.256). That such an independence was always intended, can be seen for in-stance in the examples given in one of the earlier papers on game theoreticalsemantics: Hintikka (1974). We will refer in the sequel to this independence ofexistential quanti�ers on other ones as the `slashing convention'.

This convention means that Hodges (1997a) does not give a compositionalsemantics for IF logic, but for a closely related language in which existentialquanti�ers at one's choice may depend on each other or may be independent.In Hodges (1997b) it is indicated how a compositional semantics of IF logic withthe slashing convention can be obtained.

The slashing convention has consequences which are intuitively very strange.Consider:

(13) 9y19y2[y1 = y2]

Due to the convention the second quanti�er is implicitly slashed for the �rst.This means that the formula is equivalent with:

(14) 9y1 9y2=y1 [y1 = y2]

It is, according to my intuition, impossible to �nd a y2 independent of y1 suchthat the two are equal. This intuition is shared by de Swart, Verhoe� & Brands(1997, p.63) in their review of Hintikka (1996): `Hintikka makes the confusingremark at page 63 saying that all existential variables are independent. If so9y19y2[y1 = y2] would not be true in a given model'. The same opinion is givenin the unpublished PhD-dissertation Pietarinen (2001, p.73): `9y19y2[y2 = y1]

4

has two existential quanti�ers where 9y1 depends on 9y2 [. . . ] this formula istrue over the structure of the natural numbers, but not one with independentexistential quanti�ers. Therefore the sentence 9y1 9y2=y1 [y2 = y1] is not clas-sically valid.' If these authors were right, formula (13) would not be true, andthat would imply that IF logic would not be a conservative extension of ordinary�rst order logic, thus contradicting the claim of Hintikka (1996, p.65).

These intuitions about (13) and (14) are not re ected in their game theoret-ical interpretation: (14) is in game theoretical semantics a true formula. Onesees this as follows. Let n be some natural number. 9loise's strategy for the�rst quanti�er is y1 := n, and for the second quanti�er y2 := n. This secondstrategy does not mention y1, and therefore it is formally independent of y1. So,although in (13) and (14) the strategies for y1 and y2 must be the same and achange in the strategy for y1 has immediate consequences for the strategy fory1, they are nevertheless formally independent in game theoretical semantics.

One might think that the slashing convention is too strong, and that it wouldmake it impossible for 9loise to win a game like (15), since here the choice fory2 clearly depends on y1.

(15) 8x9y1[y1 > x ^ 9y2[y2 > y1]]

This example, however, is true in game theoretical semantics. The solutionis that the strategy for y2 incorporates a recalculation of the strategy for y1.Suppose that we have the strategy y1 := x + 17 and would like to apply thestrategy y2 := y1 + 2. Then, obeying the slashing convention, we now followthe strategy y2 := (x + 17) + 2. So again, although y1 and y2 are formallyindependent, their values have a close relationship. Note that in example (12)this recalculation is not possible because y2 is slashed for x.

The examples (13) and (14) illustrate again that there is a di�erence betweenintuitions on independence and the formalization of independence in game the-oretical semantics.

2.4 Disjunction

In example (16) the same problem arises as we have seen for quanti�ers in (12).

(16) 8x9y[x = 4 _=x x 6= 4]

Also here the dummy variable y can be used to transfer information concerningx to the choice for _ which must be independent of x. The trick is to let y := xand decide on to _=x using the value of y. Here the same solution could beused as for (12): a disjunction is implicitly slashed for the existential variableswhich have scope over it. Although Hintikka does not mention this variant ofthe slashing convention, it is followed in the appendix by Sandu (Hintikka 1996,p.256). So (16) is not true in game theoretical semantics.

The slashing convention for disjunctions applied to

(17) 9y[y = 4 _ y 6= 4]

yields

(18) 9y[y = 4 _=y y 6= 4].

5

According to my intuition of independence, (18) is not true because it requiresto make independent of y a choice between y = 4 and y 6= 4. Nevertheless, itis true in game theoretical semantics. For the existential quanti�er the strategyis y := 2, and for the disjunction the strategy is to take always the right handside (so this strategy does not depend on y). So instead of letting the value of ydetermine the choice (which is not allowed), the strategy for 9y determines thechoice.

The slashing convention also applies to:

(19) 8x9y[y = 0 _=x y > 0]

and gives us:

(20) 8x9y[y = 0 _=fx; yg y > 0]

Examples (19) and (20) are true in game theoretical semantics: select a strategyfor 9y and choose a corresponding strategy for _=fx; yg .

I agree with the result for (19): it is true { but for another reason. Intuitivelyvariable x plays no role in the formula, no relation between y and x is laid, andtherefore the choice between y = 0 and y > 0 has nothing to do with x. But(20) should not be true because a choice between y = 0 and y > 0 is intuitivelynot possible without knowledge of y.

This discussion tells us that independence is not a syntactic notion. Onemust not blindly change _=x into _=fx; yg because it occurs in the scopeof 9y. It is, as example (19) shows, a semantic notion. The crucial question iswhether for another value of x the choice would be made di�erently, or the samestrategy could be applied. Since in (19) for any value of x the same strategiescan be used for 9y and for _=x they are independent of x, although both choicesarise within the scope of 8x. In example (18) the situation is di�erent: for othervalues of y the choice between y = 4 and y 6= 4 would be di�erent, so this choicecannot be made independent of y. This illustrates that independence is a kindof modal notion: it asks for what would we do if x would have another value?If we can apply the same strategies in related circumstances with another valuefor x, there is independence, otherwise not. Since we will de�ne independencein a semantic way, we will not adopt the slashing convention.

2.5 8belard's choices

In section (2.3) and (2.4), we have seen how 9loise could use her own choices tosignal to herself. But also moves by 8belard can be used to do so:

(21) 8x18x2[x1 6= x2 _ 9y=x1 [y = x1]]

My intuition says that (21) should not be true because the left disjunct is notin all cases true, and the right disjunct is not true at all. However, 9loise canuse the value of x2 to signal the value of x1. She follows the strategy y := x2,and that is an allowed winning strategy in game theoretical semantics.

We have met in section (2.2) an example where � _ � was not equivalentwith �. For conjunction the same phenomenon arises, due to related strategiesof 8belard. In the example below 8x=y says that 8belard has to choose a valuefor x independent of the choice of y by 9loise. First, notice that he has nowinning strategy for

6

(22) 9y8x=y[x 6= y].

One might expect that he also has no a winning strategy if he may choosewhether he will falsify the formula on the left hand side of a conjunction or onthe right hand side:

(23) 9y[8x=y[x 6= y] ^ 8x=y[x 6= y]]

The strategy for this game is analogous to the one for (9). 8belards strategy for^ could be to choose the left disjunct if y = 3, and the right disjunct otherwise.On the left he follows the strategy x := 4, and on the right x := 3. So hehas a winning strategy for the formula; hence (23) is false. So here again aremarkable property of the game theoretical interpretation : � ^ � is not in allcontexts equivalent with �.

2.6 Discussion

The examples given in this section illustrate that although in game theoreticalsemantics the strategies for 9x=y and _=x indeed are not based directly on thevalue of x, any information about the value of x which can be deduced fromother sources may be used: the form of other parts of the formula (example(8)), and strategies used elsewhere in the formula (examples (9) and (13)). Thisindirect information can go that far, that the value of x is known, and then astrategy can be based upon that information (example (6)). The examples showthat the results of game theoretical semantics do not correspond with intuitionsabout independent choices.

For these reasons, I conclude that game theoretical semantics is not a formal-ization of `informational independence', but of `imperfect information'. It is notimpossible that Hodges would agree with this opinion, because the title of hispaper Hodges (1997a) is `Compositional semantics for a language of imperfectinformation', and not `: : : for a language of informational independence'.

3 Towards a formalization

3.1 Introduction

In this paper it will be tried to give an interpretation of IF logic which accountsfor the intuitions discussed before. This section gives an informal descriptionand illustrative examples whereas in section (4) a formal de�nition will be given.

The alternative proposed in this paper is based on the notion `subgame',and therefore it will be called `subgame semantics'. Any subformula of a game(a sentence) is considered as a subgame, and therefore the notion `game' isgeneralized to formulas with free variables. A game is a pair consisting of aformula, and for each y the information on which x's they may depend. Thevalues of these free variables form the initial position for that game. Such agame can be played from a position inherited from a larger game, or from aninitial position set up for the occasion.

9loise may have a plan which describes how she will react on moves of 8belardand which guarantees her a win. Such a plan consists of winning strategies foreach subgame. After execution of such a strategy, so after a move, a new sub-game is entered. One might describe the situation with the following metaphor.

7

Associated with a (sub)game there is a shelf of strategies, and when a subgameis entered in a certain initial position, a strategy is taken from its shelf which �tson that position, and it is followed until a new subgame is entered. So a winningstrategy cannot depend on variables that do not occur in the subgame. Also thelarger context in which the subformula occurs, is irrelevant: the strategy mustbe winning in that subgame for the current initial situation.

A choice function for 9y is a function which has as argument the initialposition of the subgame and yields a value for y. Such a choice function is awinning strategy if it brings 9loise in a winning position for some subgame. Achoice function for 9y=x is a function of the same kind, but does not dependdirectly or indirectly on the value of x. This means that for other values of xand of the variables which depend on x, application of the strategy will yield thesame choice. The examples given in section (2) have learned us that a choiceindependent of x should not be tailored to special (imperfect) information on x,but should also be useful in situations where x has another value. Therefore awinning strategy for 9y=x is de�ned as a choice function that also yields a winfor other values of x, provided the values of y's that depend on x are given asuitable value. For _ and _=x the choice functions and winning strategies arede�ned analogously.

The above requirements on winning strategies imply that not all conceivablestrategies are available; only those which would also work if the game was playedin isolation or as subgame of another larger game, and, for independent choices,strategies which would also work in comparable situations. So in comparisonwith game theoretical semantics approach, less strategies are available.

It might be useful to emphasize the distinction with other metaphors of`independence' one �nds in the literature. It is not assumed that there areplayers who forget a value for a variable and may remember it later. It is notassumed that there are teams of players in which for each new variable a newplayer is introduced who gets only partial information. The present approachdi�ers, in a mathematical sense, from other approaches in the aspect that it isnot based on equivalence classes of information sets within its game tree. Onemight say that in the present approach equivalence classes are introduced amongthe information sets in all games in which the subgame arises.

Below the requirements on winning strategies for 9x=y and _=x will be willbe illustrated and motivated with examples. Summarizing, these requirementsare:1. The strategy does not depend on x, neither directly, nor indirectly.2. It brings 9loise in a winning position.3. If the value of x is changed, 9loise can win by the same choice, provided that

variables depending on x are suitably chosen.

3.2 Requirement 1: strategy does not depend on x

An example illustrating indirect dependency is;

(24) 8x9y1 9y2=x1 [y2 = x]

In (24) the strategy y2 := x is not winning because it depends directly on x;and y2 := y1 is not winning because it depends indirectly on x. 9loise has nowinning strategy for this game.

An example concerning direct dependency is:

8

(25) 8x 9y=x [x > 0 _ [x = 0 ^ y = x]]

For 9y=x in (25) the strategies y := 0 and y := x both bring 9loise in a winningposition. But the latter depends directly on x, therefore only y := 0 is a winningstrategy.

This �rst requirement corresponds with Hintikka's interpretation of 9y=x .His interpretation says that there is a strategy function with as arguments thepreviously chosen values for the 8-variables except for x; that previously chosen9 variables are not incorporated is guaranteed by the slashing convention (seesection (2.3)). In subgames semantics it is only required that a strategy isindependent from the 9-variables which depend on x. So it seems that thesubgame semantics has more variation in dependence because more variablescan be dependent on each other. This di�erence is, however, immaterial, sincethe values of the 9{variables which do not depend on x can be recalculatedand thus the e�ect of dependency is achieved. We have seen examples of thisrecalculation, e.g. in example (15): 8x9y1[y1 > x^9y2[y2 > y1]], where we havechosen the strategy y2 := (x1 + 17) + 2, thus recalculating the value of y1 forwhich the strategy y1 := x1 + 17 was followed.

3.3 Requirement 2: Winning

The second requirement on winning strategies must of course be ful�lled, thestrategy must bring 9loise in a winning position. The same requirement alsoholds for game theoretical semantics. So requirements 1. and 2. on winningstrategies are equivalent with Hintikka's requirements on winning strategies for9y=x and _=x . Our third condition is going to put further restrictions onthe winning strategies. Consequently, what is true in subgame semantics (thesemantics proposed in this paper) is also true in game theoretical semantics,but not vice versa. From section (2) we know that this was intended.

3.4 Requirement 3a: If x is changed the same choice wins

Consider the subgame:

(26) 9y=x [x 6= y]

The strategy y := x + 1 is of course not a winning strategy: that strategydepends directly on x. In (26) only strategies which always yield the same valueare allowed. Assume that in the initial position x equals 2. Then the strategyy := 3 would bring 9loise a win. But this strategy is not winning if the value ofx is changed to 3, and therefore the strategy y := 3 does not satisfy the thirdrequirement. This holds for any constant strategy. So there is no a winningstrategy for subgame (26) in a position where x = 2. As a consequence

(27) 8x[x 6= 2 _ 9y=x [x 6= y]]

is not true. The left disjunct is not true for x = 2, and, as we have seen, thenthere is side no winning strategy for the right hand side.

For the same reason there is no winning strategy for (26) in positions withanother value of x. Consequently (28) is not true, no matter which strategy9loise follows for _.

(28) 8x[ 9y=x [x 6= y] _ 9y=x [x 6= y]]

9

3.5 Requirement 3b: provided that variables depending

on x are suitably chosen

The branching formula

(29) 8x19y18x2 9y2=x1 [x1 < y1 ^ x2 < y2]

has as subgame

(30) 9y2=x1 [x1 < y1 ^ x2 < y2]

A strategy yielding a win in this subgame is y2 := x2 + 2. If the value of x1 ischanged, this strategy will not always give a win because x1 may become largerthan y1 and then the left conjunct is not true. In order to win the game forother values of x1 at all, a suitable value for y1 has to be chosen, and when thatis done, the choice y2 := x2 + 2 wins. Hence it is a winning strategy.

An example discussed before (see (19)) is:

(31) 8x9y[y = 0 _=x y > 0]

The strategy for 9y is to choose y := 0, and for _=x always to choose L. Thatlatter strategy is clearly independent from x and brings 9loise in a winningposition since previously y := 0 was played. For another value of x the samestrategy for _=x wins, provided the value of y is chosen to remain 0.

4 De�nitions

4.1 The Game

In comparison with existing work on IF logic, some limitations are obeyed:

1. Only the `truth' of a sentence is de�ned, not `falsehood'.2. Negation is not incorporated in the fragment.3. Only independence of a single variable is considered (and not of a set of

variables).4. Only independence of 9loise 's choices on those by 8belard is considered, not

vice versa.5. Indexed relations, disjunctions or conjunctions are not in the fragment.

The variables are distinguished in two classes: the 8-variables x1; x2; : : :and the 9-variables y1; y2; : : :. Their range is denoted with A; in the examplesthat is N: the natural numbers 0; 1; 2; : : : .

The relation symbols are R1; R2; : : :; each with a �xed arity. In the ex-amples the binary relation symbols =; 6=; <, and � are used.

If in a certain context only one 8-variable occurs, its index is omitted; thesame for the 9-variables and R-symbols.

Formulas are de�ned as follows:

1. If v1; : : : vn are variables, and n is the arity of R, then R(v1; ::vn) is a formula.

2. If and � are formulas, x is an 8-variable and y an 9-variable, then also thefollowing expressions are formulas: ^�, _�, _=x �, 8x , 9y , 9y=x .Note that universal quanti�ers can only bind x's, and existential quanti�ersonly y's.

10

FV (�), the set of free variables in �, consists of those variables in �,including the x's in _=x and 9y=x , which do not occur in � as �rst variableafter a 9 or 8 symbol. FV8(�) are the free 8-variables in �, and FV9(�) the free9-variables.

A dependency pair is a pair hy;Xi, where X is a set of 8-variables. It willbe used to indicate that y occurs in the scope of the x's in X. A dependency

set D is a set of dependency pairs in which each y occurs at most once. Ifhy;Xi2 D then D(y) = X . D� is the restriction of D to free variables in �: itis the set obtained from D by omitting all occurrences of variables which do notoccur free in �; if X becomes empty, or if y must be omitted, the whole pair isomitted.

A game is a pair h�;Di, where � is a formula, and D a dependency set.

4.2 Positions

A position gives the information what the values of the relevant variables are.The name `position' is chosen in analogy with a position in a chess game whichgives the information where the pieces stand. In both cases more informationis needed in order to continue the game.

The following notations concern positions:p A position: a �nite partial function with as domain the vari-

ables, and as range the possible values for those variables.p� the restriction of p to FV (�)p �

�ax

�the function obtained by extending p with the value a for ar-gument x, or, if p was already de�ned for x, by adapting it toyield a for x.

P the set of all positionsP� the restriction of P to the free variables in �p �x q the position p di�ers from q only with respect to the value of

xp �W q the position p di�ers from q only with respect to the values of

the variables in the set W

The notation is also used in combinations, e.g. [p ��ax

�] denotes the restric-

tion to the free variables in obtained from position p ��ax

�.

The initial position for a formula without free variables is the empty position:no values for free variables, and no dependency set. Formulas with free variablesusually arise as subgame of a larger game and their initial position is inherited.If p and D in the larger game are de�ned for more variables than the freevariables in �, then they are restricted to those free ones. Formulas with freevariables can also be fresh games and then 8belard and 9loise �rst choose valuesfor their free variables.

4.3 Moves

A move is transition from the initial position p in a game h�;Di to a initialposition in some of its subgames. The possible moves in position p depend onthe form of �:

� Case � � R(v1; : : : vn)Here no moves are possible, the game ends.

11

� Case � � ^ �8belard chooses L or R. If he chooses L, then game h ;D i is played fromposition p . Otherwise game h�;D�i is played from position p�.

� Case � � 8x 8belard chooses a value for x, say a, and the game proceeds by playing h ;Difrom position [p �

�ax

�] .

� Case � � _ � or � � _=x �9loise chooses L or R. If she chooses L, game h ;D i is played from positionp . If she chooses R, game h�;D�i is played from position p�.As we have seen in the examples, the addition =x indicates that the choice

has to be made independent of the value of x. However, when a move isdone in a game, this di�erence cannot be perceived. Independence has to dowith strategies and will be de�ned in connection with them.

� Case � � 9y 9loise chooses a value for y, say b. Then game h ;D [ fhy; FV8(�)igi isplayed from position [p �

�by

�] . The extension of the dependency set says

that y is occurring in the scope of all free x's occurring in , and its valuemay depend on them.

� Case � � 9y=x 9loise chooses a value for y, say b. Then game h ;D [ fhy; FV8(�)infxggiis played from position [p �

�by

�] . The extension of the dependency set

tells us that y may depend on the free x's occurring in , except for the xmentioned in 9y=x . The di�erence between 9y and 9y=x will be de�nedwhen we consider winning strategies.

4.4 Choice functions

A choice function C� for a formula � is a function which for all positions de-scribes which choice 9loise will make. There are two types:If � � _ � or � � _=x � then C�:P� ! fL;Rg.If � � 9y or � � 9y=x then C�:P� ! A.C� is unde�ned for other �'s.

The di�erence between _ and _=x , and between 9y and 9y=x will be de�nedwhen we consider winning strategies.

4.5 Winning positions and winning strategies

A winning strategy for 9loise is a choice function which has certain propertiesand brings her in a winning position for some subgame. A winning position for9loise is a position where she can follow a winning strategy. So the one notionis needed in order de�ne the other. Therefore the notions winning position

and winning strategy (for 9loise ) in game h�;Di are de�ned together byinduction on the construction of �:

� case � � R(v1; v2; : : : vn)Let wi be the value of vi in p. Position p is a winning position if the tuplehw1; : : : wni belongs to the interpretation of R.

� Case � � _ �The choice brings 9loise into a winning position.

12

Position p is a winning position p is a winning position in game h ;D ior if p� is a winning position in game h�;D�i. A choice function C� is awinning strategy if it bring 9loise in such a winning position.

� Case � � _=x �.Let Y be the set of 9-variables which depend, according to D, on x. Positionp is winning if there is a choice function C� which satis�es the three require-ments mentioned below. Such a choice function is called a winning strategy.We formulate the requirements for the case C�(p) = L; for C�(p) = R theyare analogous.

1. The choice function does not depend directly or indirectly on x.If q �x;Y p then also C�(q) = L.

2. The choice is winning

p is a winning position in game h ;D i.

3. If the value of x is changed, the the same choice wins, provided the vari-

ables which depend on x are suitably chosen

If q �x p then there is an r �Y q such that r is a winning position ingame h ;D i.

� Case � � 9y The choice brings 9loise into a winning position.

Position p is winning if there is b such that [p ��by

�] is a winning position

in the game h ;D [ fhy; FV8(�)igi. A choice function is a winning strategyfor 9loise in position p for game � if it yields such a value.

� Case � � 9y=x Position p is winning if there is a choice function C� which satis�es the threerequirements mentioned below. Such a choice function is a winning strategy.Let Y be the set of 9-variables which depend, according to D, on x, and letb be the value C�(p).

1. The choice function does not depend directly or indirectly on x.If q �x;Y p then also C�(q) = b.

2. The choice is winning

[p ��by

�] is a winning position in the game h ;D [ fhy; FV8(�) n fxgigi.

3. If the value of x is changed, the same choice wins provided the variables

which depend on x are suitably chosen

If q �x p then there is an r �Y q such that [r��by

�] is a winning position

in game h ;D [ fhy; FV8(�) n fxgigi.

5 Remarks

5.1 Disjunction

The de�nition for _=x resembles the one for 9y=x . The �rst de�nition couldbe obtained from the second by de�ning _=x as 9v=x [v = 0^ ] _ [v 6= 0 ^ �].

5.2 Branching quanti�ers

Theorem The interpretation of branching quanti�er sentences in game seman-tics is equivalent with their interpretation in subgame semantics.

13

Proof Consider the branching quanti�er sentence:

(32) 8x19y18x2 9y2=x1 �(x1; y1; x2; y2)

We will show that (34) and (33) are equivalent:

(33) 9loise has a winning strategy for game (32) in subgame semantics

(34) 9loise has a winning strategy for game (32) in game theoretical semantics

(33) ) (34). As explained in Section (3.3) a winning strategy in subgamesemantics is a winning strategy in game semantics which satis�es some furtherconditions.(34) ) (33). Suppose (32) is true in game semantics. That means (see e.g.Hintikka & Sandu (1997, p.366-367)) that there are functions f and g such thatfor any x1 and x2 it holds that:

(35) �(x1; fx1; x2; gx2)

We will now show that 9loise has a winning strategy in subgame semantics.Her strategy for the subgame 9y18x2 9y2=x1 �(x1; y1; x2; y2) is to choose y1 :=fx1, and for the subgame 9y2=x1 �(x1; y1; x2; y2) to choose y2 := gx2. Whatremains to be shown is that the strategy for 9y2=x1 is a winning strategy, i.e.that it satis�es the three requirements.

1. independent

That the strategy is independent from x1 is obvious.

2. winning

Let p be the initial position of subgame 9y2=x1 �(x1; y1; x2; y2). Assumethat the values of x1 and x2 are a and b respectively. We know that, due to9loise's previous move, y1 = fa. Then the move y2 := gb is a winning movebecause (35) implies that �(a; fa; b; gb) holds.

3. another value

Let p be the initial position of subgame 9y2=x1 �(x1; y1; x2; y2). Assumethat the values of x1 and x2 are a and b respectively. Let q �x1 p andassume x1 = c in q. We know from (35) that �(c; fc; b; gb). Thereforeq �

�fcy1

���gby2

�is a winning position in game �. So indeed, there is an r �y1 q

such that r ��gby2

�is winning position.

Acknowledgments

I especially thank Wilfrid Hodges for his comments on earlier versions and formany stimulating discussions about trump semantics; without this interactionthe ideas in this paper would not have emerged. I thank Johan van Benthemand Gabri�el Sandu for organizing a visit to Helsinki; it was a push to workagain on the subject. I am indebted to three anonymous referees for pointingout errors in previous versions. I thank Alexandru Baltag, Cees Doets, Dick deJongh, Marc Pauly, Jouko Vaananen, Yde Venema, Gabri�el Sandu and AllardTamminga for their remarks during my research on this subject. All remainingerrors are mine.

14

References

Hintikka, J. (1974), `Quanti�ers vs. quanti�cation theory', Linguistic Inquiry

5, 153{177.

Hintikka, J. (1996), The principles of mathematics revisited, Cambridge Univer-sity Press, Cambridge.

Hintikka, J. & Sandu, G. (1997), Game-theoretical semantics, in J. van Ben-them & A. ter Meulen, eds, `Handbook of logic and language', Elsevier,Amsterdam and The MIT Press, Cambridge, Mass., chapter 6, pp. 361{410.

Hodges, W. (1997a), `Compositional semantics for a language of imperfect in-formation', Journal of the IGPL 5(4), 539{563.

Hodges, W. (1997b), Some strange quanti�ers, in J. Mycielski et al, ed., `Struc-tures in Logic and Computer Science', number 1261 in `Lecture notes incomputer science', Springer, Berlin, pp. 51{65.

Janssen, T.M.V. (1997), A compositional semantics for the game-theoreticalinterpretation of logic, in M. Stokhof P. Dekker & Y. Venema, eds, `Pro-ceedings of the Eleventh Amsterdam Colloquium, dec. 1997', ILLC/ Deptof Philosophy, University of Amsterdam, pp. 181{185.

Pietarinen, A. (2001), Games logic plays. Informational independence in gametheoretical semantics, PhD thesis, School of cognitive and computing sci-ences. Preliminary version.

Sandu, G. (1993), `On the logic of informational independence and its applica-tions', Journal of Philosophical Logic 22, 26{60.

de Swart, H., Verhoe�, T. & Brands, R. (1997), `Hintikka's \The principles ofmathematics revisited"', Logique et Analyse 159, 281{289.

15

The semantics of concurrent knowledge actions

Hans P. van Ditmarsch�;y

May 30, 2001

Abstract

We extend a relational semantics for actions [vD01a] to include theinterpretation of concurrent actions. A concurrent action typically tran-forms a state into a set of two states. For this extension, we need to liftthe notion of accessibility between worlds in a given state to one betweensets of states. We provide descriptions of concurrent actions in games,and in the Muddy Children problem.

1 Introduction

Concurrency is an established topic in the area of theoretical computer scienceand dynamic logic [Pel87, Gol92, HKT00]. Also to a game theorist the needfor precise descriptions of simultaneous actions in games is obvious [OR94]. Inthe area of dynamic epistemics [Pla89, FHMV95, Ger99, BMS00, vD00, vD01a]it has not yet been satisfactorily covered. What kinds of actions that describeknowledge changes may be assumed to take place simultaneously? First wedescribe our motivating example. Imagine a number of players holding cardssitting around a table. Players only know their own cards. One of the players,who is holding two cards, is simultaneously showing one of these cards to anotherplayer with his left hand, and his other card to yet another player with his righthand. Unless players can refer to previous actions, there appears to be noway to describe this action as the sequence of two actions showing a singlecard, because the same card may then be shown twice. Another clear case ofa concurrent action is `not stepping forward' in the Muddy Children problem.Current descriptions [GG97] of this action do not show the �ne structure of thatcommunication. We start with another example of an action that can be seenas simultaneous execution, in a context that is familiar to the community:

Anne and Bert are in a bar, sitting at a table. A messenger comes in anddelivers a letter to Anne. The letter contains either an invitation for a night

�(as of Oct 2001) Computer Science, University of Otago, Box 56, Dunedin 9015, NewZealand. Email: hans@cs.otago.ac.nz.yFor their hospitality I thank the School of Computer Science, University of St. Andrews,

Scotland.

1

p :p1; 2

p p :p2 p :p

p :p

2

2 2

1; 2

p :p

p :p

p :p

p :p

111; 2

1

2 2

2 2

12

1

tellread

cheat

double

Figure 1: Actions for two agents and one atom. Points of models are underlined.Assume transitivity of access. In the case of cheat and double, only one of morepossible executions is shown.

out in Amsterdam, or an obligation to give a lecture instead. Anne and Bertcommonly know that these are the only alternatives. This situation can bemodelled as follows: There is one atom p, describing `the letter contains aninvitation for a night out in Amsterdam', so that :p stands for the lectureobligation. There are two agents 1 (Anne) and 2 (Bert). Arc is the modelhfu; vg; f�1;�2g; V i with both �1 and �2 the universal relation on fu; vg, andwith V (p) = fug. Now suppose p is actually the case. This corresponds to thestate (Arc; u). We list four actions that are executable in that state. Figure 1pictures (some) states resulting from their execution. For simplicity, all worldsin the �gure are named by their atomic description, i.e. with either p or :p.

Example 1 (tell) Anne is invited for a night out in Amsterdam and reads theletter aloud.

Example 2 (read) Bert is seeing that Anne reads the letter. This is publiclyknown.

Example 3 (cheat) Bert orders a drink at the bar so that Anne may have lookedat the contents of the (unsealed) letter. Bert suspects her of having cheated. Thisis publicly known.

Example 4 (double) Bert orders a drink at the bar while Anne goes to thebathroom. They now suspect each other of having looked at the contents of theletter. This is publicly known.

Such actions have been described as knowledge actions (with correspondingdynamic modal operators) in a multiagent dynamic epistemic language [vD00,

2

vD01a]. Knowledge actions are interpreted as a relation between states, as inthe �gure. The descriptions of the actions in this language are:

tell L12?pread L12(L1?p [ L1?:p)cheat L12(L1?p [ L1?:p[?>)

(double) L12(L1?p [ L1?:p[ ?>) ; L12(L2?p [ L2?:p[ ?>)

For example, we may paraphrase the description of cheat as: `(1 and 2 learnthat ((1 learns that p) or (1 learns that not p) or (nothing happens))'. `Nothinghappens' is represented by the test on truth >. In this example ?> can bereplaced by the choice ?p[ ?:p: `either p is true or p is false' (but nobody �ndsout about that).

We have not speci�ed in cheat whether agent 1 has actually cheated ornot. To describe that, we need another operator, local choice [vD00]. It is notessential to understand our treatment of concurrency.

We put (double) between parentheses because we prefer a di�erent descrip-tion of that action. In (double), the operator `;' stands for sequential execution.Note that 1 (possibly) cheats �rst and 2 second, although there is no reason toassume this order. A description that is independent of the order of cheatingseems truer to the form of the action and therefore preferable. The need fora notion of concurrrency appears if we paraphrase the action as follows: p iseither true or false, and in both cases 1 may learn about that, or 2, or both,or neither. This leaves us with eight alternatives. To describe that 1 and 2both learn p we introduce a program constructor \ for concurrent execution;we write: L1?p \ L2?p. Our preferred description of double is:

double L12((L1?p \ L2?p) [ (L1?:p \ L2?:p) [ L1?p [ L1?:p [ L2?p [ L2?:p[ ?>)

What is the interpretation of the action L1?p \ L2?p, i.e. what does it meanthat 1 and 2 both learn p at the stage where they are not yet aware of eachother's actions? It should hold that 1 knows p and that 2 knows p, but that 1does not know that 2 knows p and vice versa. We prefer a solution that avoidscomplications such as 1 and 2 not knowing the actual state of the world.

Let s be the state where 1 has learnt p and let s0 be the state where 2 haslearnt p in (Arc; u). Our requirement is met if execution of action L1?p \ L2?ptransforms state (Arc; u) into the set fs; s0g of two states, and if we de�ne thata formula holds after (every) execution of L1?p \ L2?p in (Arc; u) if it holdsin either s or s0. When executing double in (Arc; u), the set fs; s0g reappearsas a world in the cube-shaped state in �gure 1. Our solution to modellingconcurrency is therefore to introduce sets of states as semantic objects.

The operation of concurrency is not de�ned in [vD00, vD01a]. We continuewith the formal de�nitions that incorporate these ideas, in section 2. We give asyntax and semantics for knowledge actions, and in section 2.3 we give examples.We describe the simultaneous card-showing action in example 5. The MuddyChildren problem will be treated in example 6. In section 3 we discuss otherissues, such as the operator of local choice.

3

2 Knowledge actions

2.1 Syntax

To a standard multiagent epistemic language with common knowledge for aset A of agents and a set P of atoms [MvdH95, FHMV95], we add dynamicmodal operators for programs that are called knowledge actions and that de-scribe actions. The language LA and the knowledge actions KAA are de�ned bysimultaneous induction.

De�nition 1 (Dynamic epistemic logic { LA) LA(P ) is the smallest set suchthat, if p 2 P; '; 2 LA(P ); a 2 A;B � A;� 2 KAA(P ), then

p;:'; (' ^ );Ka';CB'; [�]' 2 LA(P )

Other propositional connectives and modal operators are de�ned by abbrevia-tions. Outermost parentheses of formulae are deleted whenever convenient. Aswe may generally assume an arbitrary P , write LA instead of LA(P ).

De�nition 2 (Knowledge actions { KAA) Given a set of agents A and aset of atoms P , the set of knowledge actions KAA(P ) is the smallest set suchthat, if ' 2 LA(P ); �; �0 2 KAA(P ); B � A, then:

?';LB�; (� ; �0); (� [ �0); (� \ �0) 2 KAA(P )

Outermost parentheses of actions are deleted whenever convenient. We generallywrite KAA instead of KAA(P ). The program constructor LB is called learning.We name knowledge actions after their main constructor, e.g. ?' is a test, �\�0

is a concurrent knowledge action, etc.

2.2 Semantics

Given a set of agents A and a set of atoms P , a (Kripke) model M =hW; fRaga2A; V i consists of a domain W of worlds, for each agent a 2 A a bi-nary accessibility relation Ra onW , and a valuation V : P ! P(W ). Givena model, the operator gr returns the set of agents: gr(hW; fRaga2A; V i) = A;this is called the group of the model. The group of a set of models is the unionof the groups of these models. In an equivalence model (commonly knownas an S5 model) all accessibility relations are equivalence relations. We thenwrite �a for the equivalence relation for agent a. If w �a w

0 we say that wis the same as w0 for a, or that w is equivalent to w0 for a. Write �B

for (S

a2B �a)�. For a given model M , D(M) returns its domain. Instead of

w 2 D(M) we also write w 2M . Given a modelM and a world w 2M , (M;w)is called a state, w the point of that state, and M the model underlyingthat state. Also, if M is clear from the context, write w for (M;w). (By wayof `pointing' to a world we put a line over it. Similarly, we visually point to aworld in a �gure by underlining it.) All notions for models are assumed to be

4

similarly de�ned for states. We introduce the abbreviations SA(P ) for the classof equivalence states for agents A and atoms P and S�A(P ) :=

SB�A SB(P ).

As before, drop the `P '.The semantics of LA (on equivalence models) is de�ned as usual [MvdH95],

plus an additional clause for the meaning of dynamic operators. The interpre-tation of a dynamic operator is a relation between an equivalence state and aset of equivalence states (see de�nition 5).

De�nition 3 (Semantics of LA) Let (M;w) = s 2 SA and ' 2 LA, whereM = hW; f�aga2A; V i. We de�ne s j= ' by induction on the structure of '.

M;w j= p :, w 2 V (p)M;w j= :' :, M;w 6j= '

M;w j= ' ^ :, M;w j= ' and M;w j=

M;w j= Ka' :, 8w0 : w0 �a w )M;w0 j= '

M;w j= CB' :, 8w0 : w0 �B w )M;w0 j= '

M;w j= [�]' :, 8S � S�A : (M;w)[[�]]S ) 9(M 0; w0) 2 S :M 0; w0 j= '

In the clause for [�]' we require ' to hold in just one (and not necessarily all)of the states of S0. The notion h�i is dual to [�] and is de�ned as s j= h�i' ,9S � S�A : s[[�]]S and 8s0 2 S : s0 j= '. Our treatment of dynamic operators issimilar to approaches in dynamic logic [Pel87, Gol92]. The interpretation of aconcurrent knowledge action is typically a relation between one state and a setof two states. The set S may consist of states for di�erent groups, all of whichmust be contained in or equal to A.

We lift equivalence of worlds in a state to equivalence of states and to equivalenceof sets of states. This is necessary because sets of states will occur as worlds inde�nition 5 of local interpretation, so that access between such worlds will bebased upon properties of these sets of states.

De�nition 4 (Equivalences of states and of sets of states)Let (M;w); (M;w0); (M 00; w00) 2 SA, let S; S0 � S�A, let a 2 A. Then:

(M;w) �a (M;w0) :, w �a w0

(M;w) �a (M00; w00) :, 9v 2M : (M; v)$ (M 00; w00) and (M;w) �a (M; v)

S �a S0 :, (8s 2 S : a 2 gr(s)) 9s0 2 S0 : s �a s

0) and(8s0 2 S0 : a 2 gr(s0)) 9s 2 S : s �a s

0)

In the second clause, $ stands for `is bisimilar to' [BdRV01]. The (implicit)symmetric closure in third clause of the de�nition is needed to keep �a anequivalence relation. The obvious overloading of the notation �a is justi�able:if s and s0 are states for di�erent (nonsimilar) underlying models, they can byde�nition never be the same for any agent. Therefore, when s �a s

0 we can see�a as the equivalence for a in the model underlying both s and s0. Similarlyfor S �a S

0.

5

We now continue with de�ning the local interpretation of knowledge actions.In the de�nition we use the following notations: let M be a model, thenD(M)' = fv 2 D(M) j M; v j= 'g; Let R;R0 : W ! P(W ) be two re-lations from some domain W to subsets of that domain, then the composi-tion (R Æ R0) of R and R0 is de�ned as follows: let v 2 W;V � W , then:(R Æ R0)(v; V ) :, 9V 0 : R(v; V 0) and 8v0 2 V 0 : 9V 00 � V : R0(v0; V 00) and V =Sv02V 0fV 00 j R0(v0; V 00)g.

De�nition 5 (Local interpretation of knowledge actions) Let � 2 KAA

and s = (M;w) 2 SA, where M = hW; f�aga2A; V i. Let S � S�A (and also allother sets of states in the de�nition). The local interpretation [[�]] of � in sis de�ned by inductive cases:

s[[?']]S , S = f(hW'; ;; V �W'i; w)gs[[LB�

0]]S , 9S0 : S = f(hW 0; f�0aga2B ; V0i; S0)g; s[[�0]]S0; gr(W 0) � B

s[[�0 ; �00]]S , s([[�0]] Æ [[�00]])Ss[[�0 [ �00]]S , s[[�0]]S or s[[�00]]Ss[[�0 \ �00]]S , 9S0; S00 : s[[�0]]S0; s[[�00]]S00; and S = S0 [ S00

The model hW 0; f�0aga2B; V0i in the clause for interpreting LB�

0 is de�ned asfollows. Let S0; S00 2W 0; a 2 B; (M 00; w0) = s0 2 S0; p 2 P . Then:

W 0 = fS j 9v 2M : v �B w and (M; v)[[�0]]SgS0 �0a S

00 , S0 �a S00 and [ a 62 gr(S0) [ gr(S00))

9v; v0 2M : (M; v)[[�0]]S0; (M; v0)[[�0]]S00 and v �a v0 ]

S0 2 V 0(p) , w0 2 V s0(p)

For all actions except concurrent knowledge actions it is more intuitive to thinkof their interpretation as a relation between states than as a relation betweena state and a set of states: if s[[�]]fs0g, we like to think of s0 as the result ofexecuting � in s. The notational abbreviation s[[�]]s0 :, s[[�]]fs0g allows us tokeep using this helpful intuition. Further, if the interpretation is functional aswell, write s[[�]] for the unique s0 such that s[[�]]s0. In the next subsection wegive examples. We start with some general observations.

In dynamic logic, a successful test does not change the current state. In ourframework, a test removes all worlds in the current state where the test does nothold and removes all access between worlds. Therefore, a test generally resultsin a di�erent state. What remains unchanged is merely the point of the currentstate.

To execute an action LB�0 in a state s, we do not just have to execute �0

in s, but we also have to consider executing �0 in any other state s0 that is�B accessible from s. The results are the worlds in the state that results fromexecuting LB�

0 in s. Such worlds (that are sets of states) can be distinguishedfrom each other by an agent a 2 B in two cases: either a occurs in both setsof states and he cannot distinghuish between them, or a doesn't occur in these

6

sets of states, so that he cannot distinguish between them anyway, and as wellhe could not distinguish their [[�0]]-origins either.

It is also essential that gr(W 0) � B. Agents in B learn something in LB�0,

whereas agents in gr(W 0) learn something in �0, because gr(W 0) depends on theagents occurring in learning operators in �0. This constraint gr(W 0) � B guar-antees that local interpretation is correct. E.g., if 1 and 2 learn something aboutan action involving 1, 2 and 3, in the resulting state 3 would not consider theactual state to be possible, as he is unaware of 1 and 2 having learnt something.So the resulting state will not be an equivalence state. However, computing theclause for LB�

0 results in an equivalence state, that will therefore obviously notrepresent the (not S5) knowledge of the agents correctly.

Local interpretation is called local, because we only interpret the agents thatare actually learning something in the action. In contrast to [Ger99], we do notworry about what other agents have learnt at that stage of the interpretation,i.e. we postpone computing the global e�ects of learning. This also explains whywe interpret concurrent actions �\�0 without modelling interferences of agentsin � with agents in �0: such dependences are described by operators binding� \ �0.

2.3 Examples

We apply de�nition 5 to compute the interpretation of example 2 in the introduc-tion, the action read. Write u for (Arc; u) and v for (Arc; v). The interpretationof read = L12(L1?p [ L1?:p) on u is de�ned in terms of the interpretation ofL1?p [ L1?:p on any state (Arc; x) such that x is �12-accessible from u, i.e.both on u and v. We compute the interpretation of L1?p [ L1?:p on u, theother case is similar. To interpret L1?p [ L1?:p on u we may either interpretL1?p on u or L1?:p. Only the �rst can be executed (because at some furtherstage of interpreting the second program, the test ?:p fails in world u where pholds). The interpretation of L1?p on u is de�ned in terms of the interpretationof ?p on any state (Arc; x) that is �1-accessible from u; ?p can only be executedwhen p holds, that is on u.

u[[?p]]: The interpretation of ?p on u is the state s0 (actually the singletonset of states s0) that consists of u only, with empty access, where p holds onu, and where u is the point of that state. As s0 is the unique state such thatu[[?p]]s0 we may write u[[?p]] instead of s0.

u[[L1?p]]: The single world in the domain of the interpretation of L1?p onu is fu[[?p]]g. We have that fu[[?p]]g �1 fu[[?p]]g, because u[[?p]] �1 u[[?p]], be-cause u �1 u in u[[?p]]. Further, p holds on fu[[?p]]g. This also completes theinterpretation of L1?p [ L1?:p on u.

v[[L1?:p]]: Is computed similarly to the case u[[L1?p]]. Now p does not hold.This also completes the interpretation of L1?p [ L1?:p on v.

u[[L12(L1?p [ L1?:p)]]: The domain of the state resulting from executingread on u is ffu[[L1?p]]g; fv[[L1?:p]]gg, abbreviated as fS; S0g. As 2 does notoccur in either world of this domain, and initially 2 already could not distinguish

7

p :p1,2 p :p1,2

= =

u -1;2 v -1;21,2 u -1;2 v -1;21,2

u -; v -;

fu -;g -1 fv -;g -1

ffu -;g -1g -1;2 ffv -;g -1g -1;22

=

p :p2

?p ?:p

L1?p L1?:p

L12(L1?p [ L1?:p)

Figure 2: Computing the interpretation of read in (Arc; u). Re exive access is ex-plicitly given (as an exception), by labelled arrows -. Points of states are underlined.E.g., u -; stands for the state (hfug; ;; V (p) = fugi; u). In the last step we revertto our more familiar notation of merely naming worlds by their atomic descriptions.Names are merely identi�ers of worlds!s

u from v, 2 cannot distinguish S from S0. Similarly, 2 cannot distinguish S fromS, and S0 from S0.

However, for agent 1 S and S0 are di�erent: we have that fu[[L1?p]]g 6�1

fv[[L1?:p]]g, because u[[L1?p]] 6�1 v[[L1?:p]], because u[[L1?p]] 6 $ v[[L1?:p]]: thestates u[[L1?p]] and v[[L1?:p]] are nonsimilar.

Re exive access for 1 can still be added, though: e.g., fu[[L1?p]]g �1 fu[[L1?p]]gfollows from u[[L1?p]] �1 u[[L1?p]] follows from fu[[?p]]g �1 fu[[?p]]g in the modelfor u[[L1?p]], see above.

We have now completed the interpretation of read in (Arc; u). For a morevisual overview, see �gure 2.

The interpretation of tell = L12?p on u, example 1, can be computed along thesame lines as that of read but is much simpler. The interpretation of double =L12((L1?p \ L2?p) [ (L1?:p \ L2?:p) [ L1?p [ L1?:p [ L2?p [ L2?:p[ ?>) ismore complex. The choice action bound by L12 can be executed in four waysin u, and similarly in four ways in v. These result in the eight worlds of thecube-shaped model in Figure 1. We have given di�erent visualizations of thatin Figure 3. We merely compute a detail of access involving concurrency.

The node labelled ffu -;g -1g (discounting underlines) is the set of states Ssuch that u[[L1?p]]S, i.e. S = fu[[L1?p]]g. The node labelled ffu -;g -1; fw -;g -2gis the set of states S0 such that u[[L1?p \ L2?p]]S

0, i.e. S0 = S1 [ S2 such thatu[[L1?p]]S1 and u[[L2?p]]S2, i.e. S

0 = fu[[L1?p]]; u[[L2?p]]g. We have that S is thesame for agent 1 as S0, because u[[L1?p]] 2 S can be mapped to u[[L1?p]] 2 S0

and because, vice versa, u[[L1?p]] 2 S0 can be mapped to u[[L1?p]] 2 S and agent

8

fu -;g fv -;g

ffu -;g -1

g ffv -;g -1

g

ffu -;g -2

g ffv -;g -2

g

ffu -;g -1

; fv -;g -2

g ffv -;g -1

; fv -;g -2

g

1; 2

1

1 1

2 2

2 2

2

1 1

fu[[?>]]g fv[[?>]]g

fu[[L1?p]]g fv[[L1?:p]]g

fu[[L2?p]]g fv[[L2?:p]]g

fu[[L1?p]]; u[[L2?p]]g fv[[L1?:p]]; v[[L2?:p]]g

1; 2

1

1 1

2 2

2 2

2

1 1

Figure 3: Di�erent ways of visualizing the execution of double in (Arc; u) (i.e. u),in the case where 1 and 2 both cheated. Compare to Figure 1. Points of states areunderlined. In the left cube, except for re exive access for 1 and 2, all worlds andaccess are drawn. In the right cube, worlds are named as the unique sets of statesresulting from executing the (seven) subprograms of double.

1 does not occur in u[[L2?p]] 2 S0.

Two more examples illustrate the application of the language.

Example 5 (twocards) There are three players (1,2,3) and four cards. Thecards are shu�ed and dealt to the players. Player 3 is dealt two cards. Player 3now shows one card (only) to player 1, with his left hand, and (simultaneously)the other card (only) to player 2, with his right hand.

Suppose the cards are called north, east, south and west (n; e; s; w). Atomicpropositions ca describe that player a holds card c. The action twocards isdescribed by the knowledge action:

twocards L123(Si6=j2fn;e;s;wg(L13?i3 \ L23?j3))

In each game state this action has two possible executions: player 3 may choosewhether to show player 1 his i or his j card, the other card is then necessarilyshown to player 2.

An (instance of an) action such as twocards may be a move in a knowledgegame [vD01b] where players try to �nd out what the deal of cards is. Examplesare the Family Game (gathering four of a kind), Memory, and Cluedo. In suchcases the precise descriptions of the consequences of moves is needed to com-pute individual preference relations of players, and thus also a prerequisite forcomputing optimal strategies. Abstract simultaneous move games [OR94] mayprovide other examples of concurrent actions. Generally, a payo� is merely stip-ulated for a given action and a given game state. However, a precise descriptionof actions may be required in the less abstract case that the next game stateis computed from a given structured action and structured state, after which

9

110

101

011 111

2

3

1

100

(010) 110

001 101

011 111

1

3

2

2 2

3

1

(100)

010 110

001 101

011 111

1

2 2

1

3 3

1

100

010 110

(001) 101

011 111

3

2

2

1

3 3

1

set of 3 states

Figure 4: None of the children has stepped forward after father has told that at leastone of them is muddy. The actual state is 110: 1 and 2 muddy. Each world of theresulting state is actually a set of three states. This is visualized for world 101.

the payo� can be determined from the structure of the next game state. Thisrequires further investigation.

A beautiful metalevel description of the well-known Muddy Children problemcan be found in [FHMV95]. A run of the system for the problem consists of asequence of public announcements. An object level description is provided in[GG97]. Public announcement of ' corresponds in LA to a knowledge actionLA?'.

Example 6 (stand) There are three children 1, 2, and 3. `Father' tells themthat there is at least one muddy child, and that who knows whether he is muddymay step forward. Nobody steps forward.

Let mi stand for `child i is muddy'. The declaration of father that there isat least one muddy child is described by L123?(m1 _ m2 _ m3). In [Pla89,GG97, Bal99] the action stand, of nobody stepping forward, is analysed as thepublic announcement of a conjunction describing that none of the children knowswhether he/she is muddy. This corresponds to the KAA action:

L123?((:K1m1 ^ :K1:m1) ^ (:K2m2 ^ :K2:m2) ^ (:K3m3 ^ :K3:m3))

This description, although correct, does not take into account the �ne structureof the action. Because the children simultaneously publish that they don't knowwhether they are muddy, we prefer an analysis where `nobody steps forward' isan action that is composed of subprograms `1 does not step forward', '2 doesnot step forward' and `3 does not step forward'. A description that takes that

10

into account, is:

stand L123( L123?(:K1m1 ^ :K1:m1)\L123?(:K2m2 ^ :K2:m2)\L123?(:K3m3 ^ :K3:m3) )

Abbreviate the last description as L123(stand(1) \ stand(2) \ stand(3)). Let110 stand for the pointed equivalence model corresponding to the situation110 where 1 and 2 are muddy, and 3 is clean, and where father has made hisannouncement. The execution of stand in that state 110 results in the state110[[stand]] that consists of the four worlds where at least two children are mud-dy, see Figure 4. All worlds in this state are actually sets of three states. E.g. theworld 101 in 110[[stand]] is the set of three states f101[[stand(1)]]; 101[[stand(2)]];101[[stand(3)]]g, corresponding to, respectively, the state resulting from 1 declar-ing that he doesn't know that he is muddy after father's announcement in state101, etc.

3 Further observations

3.1 Equivalence

Consider interpreting the formula [L1?K1p]K1p in singleton state (hfwg;�1

= fw;wg; V (p) = fwgi; w). The state resulting from executing L1?K1 is(hfwg; ;; V (p) = fwgi; w). In that state, the interpretation of K1p is unde-�ned, because access for agent 1 is not given (note that we did not state that�1 = ;). So there are well-formed LA formulae that are uninterpretable. Thisproblem is a result of the restriction of our semantics to equivalence (S5) states.An action is interpreted as a relation between states for a group of agents A, andsets of states where each state in such a set is for a subgroup B � A of agents.Other approaches [Ger99, BMS00] are not restricted to equivalence states andde�ne the interpretation of an action as a relation between Kripke states for agroup of agents A (only), where some of the agents may have empty accessibilityrelations.

There are various ways to repair the semantics, one of them to extend it toKripke states. However, the study of equivalence states (and their counterpart,interpreted systems [FHMV95]) seems to provide a powerful paradigm in itself.We venture to suggest that established mathematics for numerical partitionsmay be applied there. An appealing solution that may possibly have advantagesfor the axiomatization of the logic (see further), is a syntactic restriction onconstructs [�]' that will force ' to be interpretable. This can be done asfollows:

In de�nition 1 on page 4, change the clause for that construct into:

[�]' 2 LA , � 2 KAA and ' 2 Lgr(�)

where the notion of group (gr) is extended to formulae and actions. We omitdetails. This involves clauses as gr(LB�) = B and gr(� \ �0) = gr(�) \ gr(�0).

11

However, with this restriction we also rule out some things we wanted to beable to express, such as that 1 knows p after both 1 and 2 learn that p: [L1?p\L2?p]K1p, which will be clear from the presented clauses for gr. We are as yetuncertain how to proceed.

3.2 Local choice

In Figure 1 on page 2, only one of two possible executions of cheat is pictured,and only one of four possible executions of double. Generally, actions are as-sumed to be state transformers, in other words: deterministic, or yet in otherwords: their interpretations are functional. We can enlarge our action languageto include such functional actions by adding another construct to the language:local choice. Simultaneously with dynamic epistemic logic LA and knowledgeactions KAA we have to de�ne the bundles Bu(�) of a given knowledge action� 2 KAA. A bundle of a knowledge action represents a subtree in the structuraltree of that action. We add a clause to de�nition 2 of the knowledge actions KAA

on page 4. Given an action � 2 KAA and a bundle b 2 Bu(�), also !b� 2 KAA.The interpretation of local choice is de�ned by induction on the structure of�, and a simpler, context sensitive, reading of actions with local choice is alsode�ned. For details, see the appendix on page 14. The pictured executions ofcheat and double are then uniquely described by the actions (where read anddouble should be written in full, naturally):

!(1(1((�))))read!(0((�);(�)))double

or, using simpler notation:

L12(L1?p [ L1?:p[ !?>)L12(!(L1?p \ L2?p) [ (L1?:p \ L2?:p) [ L1?p [ L1?:p [ L2?p [ L2?:p[ ?>)

For example, we can paraphrase L12(L1?p [ L1?:p[ !?>) as follows: `(1 and 2learn that either (1 learns that p) or (1 learns that not p) or (nothing happens)),and (nothing happens)'.

3.3 Theory

Bisimilarity of states is likely to be preserved under execution of knowledgeactions. The results in [vD00] will be generalized (case LB� of the proof thereneeds to be revised; case � \ �0 is obvious).

It is yet unclear how the expressive power of the current language relates tothat of the language without \. Note that both for the action double, example4, and for the action stand, example 6 (`Muddy Children'), we have given equiv-alent actions not using \. However, in both cases the structure of the actionis much clearer when described with \: the obvious advantage of the extendedlanguage is in clear and understandable speci�cations of actions. We do notknow a knowledge action without \ that describes the card showing action in

12

example 5. In the area of dynamic logic, the language CPDL (concurrent PDL),that is somewhat related to LA, is more expressive than PDL, see [Pel87], page458.

3.4 Axiomatization

Work on the axiomatization of the language is immature. If a syntactic re-striction on [�]' is added, as suggested in section 3.1, all the following relevantaxioms are sound:

[?'] $ ('! )[� \ �0]'$ ([�]' _ [�0]')[� [ �0]'$ ([�]' ^ [�0]')[�]'$

Vb2Bu(�)[!b�]'

A solution will be inspired by previous work of [Ger99, BMS00] and may alsopro�t from rewriting the interaction between learning and common knowledgeoperators as �xpoints in �-calculus [BS01]. Our present hope is that this inter-action may provide an interesting example of a double �xpoint.

3.5 Other approaches

As already mentioned, our concurrency operator \ is similar to that in concur-rent PDL [Pel87]. A di�erent way to express `things happening at the same time'is with the intersection operator ^ (commonly written as \) [HKT00], de�nedas [[� ^ �0]] = [[�]] \ [[�0]]. This appears to be similar to the `parallel execution'operator + in [Bal99], where this is used, in combination with the suspicionoperator, for simulating nondeterministic choice. However, that operator seemsto be not intended and have no use for concurrency (personal communication).

Our semantics of concurrent knowledge actions also appears to be relatedto game theoretical semantics for (extensions of) PDL [Par85, Pau00, Net01].This requires further investigation.

References

[Bal99] A. Baltag. A logic of epistemic actions. Manuscript, 1999.

[BdRV01] P. Blackburn, M. de Rijke, and Y. Venema. Modal Logic. Cambridge U-niversity Press, Cambridge, 2001. Cambridge Tracts in Theoretical Com-puter Science. To appear.

[BMS00] A. Baltag, L.S. Moss, and S. Solecki. The logic of public announcements,common knowledge and private suspicions. In Proceedings of TARK 98,2000. To appear.

[BS01] J. Brad�eld and C. Stirling. Modal logics and mu-calculi: an introduction.In J. A. Bergstra, A. Ponse, and S. A. Smolka, editors, Handbook of ProcessAlgebra, Amsterdam, 2001. Elsevier Science.

13

[FHMV95] R. Fagin, J.Y. Halpern, Y. Moses, and M.Y. Vardi. Reasoning about

Knowledge. MIT Press, Cambridge MA, 1995.

[Ger99] J.D. Gerbrandy. Bisimulations on Planet Kripke. PhD thesis, Universityof Amsterdam, 1999. ILLC Dissertation Series DS-1999-01.

[GG97] J.D. Gerbrandy and W. Groeneveld. Reasoning about information change.Journal of Logic, Language, and Information, 6:147{169, 1997.

[Gol92] R. Goldblatt. Logics of Time and Computation. CSLI Publications, Stan-ford, 2 edition, 1992. CSLI Lecture Notes No. 7.

[HKT00] D. Harel, D. Kozen, and J. Tiuryn. Dynamic Logic Foundations of Com-puting Series. MIT Press, Cambridge MA, 2000.

[MvdH95] J.-J.Ch. Meyer and W. van der Hoek. Epistemic Logic for AI and Comput-

er Science. Cambridge Tracts in Theoretical Computer Science 41. Cam-bridge University Press, Cambridge, 1995.

[Net01] I. Netchitailov. An extension of game logic with parallel operators. Mas-ter's thesis, ILLC, University of Amsterdam, 2001.

[OR94] M.J. Osborne and A. Rubinstein. A Course in Game Theory. MIT Press,Cambridge MA, 1994.

[Par85] R. Parikh. The logic of games and its applications. In M. Karpinskiand J. van Leeuwen, editors, Topics in the theory of computation Annalsof Discrete Mathematics 24, pages 111{139, Amsterdam, 1985. ElsevierScience.

[Pau00] M. Pauly. Game logic for game theorists. Technical report, CWI, Amster-dam, 2000. CWI Technical Report INS-R0017.

[Pel87] D. Peleg. Concurrent dynamic logic. Journal of the ACM, 34(2):450{479,1987.

[Pla89] J.A. Plaza. Logics of public communications. In M.L. Emrich, M.S. Pfeifer,M. Hadzikadic, and Z.W. Ras, editors, Proceedings of the 4th International

Symposium on Methodologies for Intelligent Systems, pages 201{216, 1989.

[vD00] H.P. van Ditmarsch. Knowledge games. PhD thesis, University of Gronin-gen, 2000. ILLC Dissertation Series DS-2000-06.

[vD01a] H.P. van Ditmarsch. Descriptions of game actions. Journal of Logic,

Language and Information, 2001. To appear.

[vD01b] H.P. van Ditmarsch. Knowledge games. Bulletin of Economic Research,2001. To appear.

Appendix: Local choice

Simultaneously with dynamic epistemic logic and knowledge actions we de�nethe set of bundles Bu(�) of a knowledge action �. A bundle of a knowledgeaction represents a subtree in the structural tree of that action. First we add aclause to de�nition 2 of the knowledge actions KAA on page 4. If action � 2 KAA

and bundle b 2 Bu(�), then action !b� 2 KAA. The program constructor !bis called local choice. In [vD00], local choice was not a generally applicable

14

program constructor, and because of that a class of knowledge action typeswas distinguished from a class of knowledge actions. That distinction has nowdisappeared.

De�nition 6 (Bundle) The set of bundles of a knowledge action is de�nedon the structure of knowledge actions, by inductive cases.

Bu(?') = f�gBu(LB�) = f(b) j b 2 Bu(�)g

Bu(� ; �0) = f(b; b0) j b 2 Bu(�) and b0 2 Bu(�0)gBu(� [ �0) = f0(b) j b 2 Bu(�)g [ f1(b) j b 2 Bu(�0)gBu(� \ �0) = f(b; b0) j b 2 Bu(�) and b0 2 Bu(�0))g

Bu(!b�) = fbg

Given a knowledge action, the operator Bu returns the set of bundles of that ac-tion. A bundle is a string consisting of bullets, zeros, ones and parentheses, thatrepresents a subtree of the structural tree of an action. The parentheses playan essential part, e.g. in case LB� in the de�nition \enclosing in parentheses"is the actual operation.

We have to extend de�nition 5 of local interpretation with the case � = !b�0.

This is done by induction on the structure of �:

s[[!�? ]]S , s[[? ]]Ss[[!(b)LB0�1]]S , s[[LB0�1]]S; S = f(M 0; S0)g; s[[!b�1]]S0

s[[!(b;b0)(�1 ; �2)]]S , s[[!b�1 ; !b0�2]]Ss[[!0(b)(�1 [ �2)]]S , s[[!b�1]]Ss[[!1(b)(�1 [ �2)]]S , s[[!b�2]]Ss[[!(b;b0)(�1 \ �2)]]S , s[[!b�1 \ !b0�2]]S

s[[!b!b�1]]S , s[[!b�1]]S

Local choice constrains the interpretation of the knowledge action bound byit, such that it becomes functional, or in other words: a state tranformer. Theclause for !b!b�

0 expresses that an interpretation that is already functional cannotbe constrained further.

De�nition 7 (Notational equivalent for local choice) By inductive cases:

!()?' := ?'!(I)LB� := LB !I�

!0(I)(� [ �0) := (!!I� [ �0)

!1(I)(� [ �0) := (�[ !!I�

0)!(I;J)(� ; �0) := (!I� ; !J�

0)!(I;J)(� \ �

0) := (!I� \ !J�0)

!I !I� := !I�

In other words, we may delete `!' everywhere except where choice really matters,i.e. in constructs of the form �0[ !� or !� [ �0. We also use associativity of [and write, e.g., (� [ �0[ !�00) instead of (�[ !(�0[ !�00)). See also [vD00].

15

JOANNA GOLI!SKA

On which operations are spectra of formulae with Henkin quantifiers closed?1

Abstract: It is known that various complexity�theoretical problems can be translated into some

special spectra problems (see e.g. [Fagin "974], [Blass�Gurevitch "986]). So questions about

complexity classes are translated into question about expressive power of some languages. In this

paper we investigate spectra of some logics with Henkin quantifiers in empty vocabulary. This

problem has been investigated firstly in [Krynicki�Mostowski "992] and [Krynicki�Mostowski

"995] and developed in [Goli#ska "999] and [Goli#ska�Zdanowski 2000]. We will present some

new results concerning closure of spectra of sublogics with Henkin quantifiers. All considered

results can be treated as results about expressive power of certain languages in finite models.

Scholz defined the spectrum of a formula ϕ to be the set of cardinalities of finite structures

in which ϕ is true and the spectrum of a logic as the set of spectra of all formulae of this logic. The

spectrum problem usually is considered as one of the following:

". Scholz problem: to give a characterisation of the spectrum of a given logic.

2. Asser problem: is the spectrum of a given logic closed on complement?

We can generalize the Asser problem in the following way: on which operations spectra for a

given logic are closed? Of course, a good description of spectra of a logic would be very useful in

any attempt of solving problems of this kind.

The most important and most interesting theorem related to the spectrum problem is Fagin's

theorem. Fagin in [Fagin "974] considered generalized spectra of existential second order

formulae. A generalized spectrum of ϕ is the class of finite models M such that ϕ holds in M. He

proved that a class of existential second�order formulae captures NP. Blass and Gurevitch [Blass�

Gurevitch "986] showed that the same holds for positive formulae with Henkin quantifiers. These

above theorems allows to prove that Asser problem is equivalent to well�known open problem of

theory of computational complexity �does NP=co�NP?�.

The subject of our investigation is the spectrum problem formulated for the logic with

branched quantifiers in the empty vocabulary (with equality). In this case generalized spectra and

spectra in the sense of Scholz are equivalent. This is so because for empty vocabulary models are

uniquely, up to isomorphisms, determined by their cardinalities. We consider languages with

Henkin quantifiers of various kinds. For background, basic notions and results see [Krynicki�

Mostowski "995].

Basic notations and old results

We repeat here shortly the basic definitions for Henkin quantifiers.

Definition 1(Henkin prefixes as dependency relat ions)

A Henkin prefix (a branched prefix) is a triple Q = (AQ, EQ, DQ), where AQ and EQ are disjoint

finite sets of variables called respectively universal and existential variables of Q, and DQ is a

relation between universal and existential variables of Q (DQ ⊆ AQ × EQ), called the dependency relation of Q. If (x, y) ∈ DQ then we say that the existential variable y depends on the universal

variable x in Q.

Example Let Q = ({x", x2}, {y", y2}, {(x", y"), (x2, y2)}). Prefix Q can be written down in a more intuitive

way as

∀ x1 ∃ y1

∀ x2 ∃ y2

" Some of the results presented in this paper were achieved when the author worked under the supervision

of PhD M. Mostowski.

Definition 2 (Skolemizat ion of branched prefixes)

Let Q be a Henkin prefix binding universal variables x1, ..., xn and existential variables y1, ..., yk ;

let xi be a sequence of the universal variables of Q on which yi depends in Q, for i = ", ..., k. Then

we define a skolemization of Qϕ relative to Q, sk(Q, ϕ), as the results of substituting in ϕ fi(xi) in

place yi, for i = ", ..., k. The function symbols f1, ..., fk introduced in this way have to be new and

distinct one from another. They are called the Skolem functions introduced by skolemization of Qϕ

relative to Q.

Definition 3 (Logic with branched quantifiers *L )

We define a logic *L as an assignment to every vocabulary σ of a pair *

σL = (Fσ(H),! *σL

), where

Fσ(H) is the set of all formulae with Henkin quantifiers and ! *σL

is an extension of the satisfaction

relation for elementary logic by the following condition:

M! *σL

Qϕ[p] if and only if there are operations F1, ..., Fk defined on the universe of M such that

(M, F1, ..., Fk)! *σ ′L

∀ x sk(Q, ϕ)[p], where F1, ..., Fk interpret the respective Skolem functions

introduced by skolemization of Qϕ relative to Q, σ’ is the extension of the vocabulary σ by these

Skolem functions, and x is a sequence of all universal variables of Q.

We consider the following classes of branched quantifiers.

The class of quantifiers nH of the following form

∀ x1 ∃ y1

...........

...........

∀ xn ∃ yn

and the class of quantifiers knA of the following form

∀ x1 ∃ y1

..............

..............

∀ xn ∃ yn

∀ z11 ∀ z12 ∃ w1

.............. ∀ zk1 ∀ zk2 ∃ wk

By L( nH )n∈ω , L("nA )n∈ω , L(

knA )n,k∈ω we denote the logics which are the extensions of the

elementary logic by all formulae with quantifiers respectively nH , "nA ,

knA , for n, k = 2, 3, ...

Definition 4 By a simple positive formula of a given logic with branched quantifiers we mean a formula of the

form Qϕ, where ϕ is a quantifier free formula, and Q is a quantifier prefix.

We consider only spectra of simple positive formulae. By the theorem of Blass�Gurevitch [Blass�

Gurevitch "986] each class of models in NP is definable by a such formula. So this restriction does

not restrict the problem considered from the complexity point of view.

Definition 5 (The spectrum of a formula)

Let ϕ be any sentence of a logic L in empty vocabulary. The spectrum of a formula ϕ, Spec(ϕ), is

the set:

Spec(ϕ) = df {n ∈ ω : there is a model M such that card(M) = n and M $ ϕ }.

Definition 6 (The spectrum of a logic L)

Let FL be the set of sentences of a logic L in empty vocabulary. The spectrum of the logic L, Spec(L), is the set:

Spec(L) =df {Spec(ϕ) : ϕ ∈ FL}

If there is a formula ϕ of the logic L such that the spectrum of ϕ is the set A ⊆ ω, we will say that

the set A is L � spectrum.

The spectrum problem

Let L be one of the logics L( nH )n∈ω , L("nA )n∈ω , L(

knA )n, k∈ω . What is Spec(L) ?

The characterisation of spectra of the above considered logics would additionally solve the

following open problem: is there any essentially infinite class of branched quantifiers not

equivalent to all Henkin quantifiers.

Krynicki considered quantifiers which are a weak version of Henkin quantifiers nH . They

can be defined by the following equivalence:

M$ nF x", ..., xn, y", ..., yn ϕ(x, y)[v] iff M$ nH x1 ... xn y1 ... yn [ϕ(x, y) ∧

∧ ∧∧∧∧ i≠j (xi = xj ⇒ yi = yj)][v]

In the paper [Krynicki�Mostowski "992] it has been proved that the spectra of logic with all

Krynicki quantifiers in empty vocabulary are boolean combinations of the sets of the following

form:

{A ⊆ ω : card(A) < ω} and {{x ∈ ω : x ≡ a (mod b), a < b, a, b ∈ ω}}

So the characterization of the spectrum of the logic with Krynicki quantifiers supplies the large

class of sets of natural numbers belonging to the spectrum of the logic with Henkin quantifiers.

In what follows we are searching for characterisation of spectra of some sublogics of simple

positive formulae of the logics with quantifiers nH and knA .

Firstly we will present a few nontrivial examples of spectra of formulae of the logics with

quantifiers nH and knA .

Theorem 1[Goli#ska�Zdanowski 2000]

There is a formula ϕ with quantifier "8A such that Spec(ϕ) = {k ∈ ω : k is a nonprime}.

This formula has the following form:

∀ x1 ∃ y1

∀ x2 ∃ y2

∀ x3 ∃ y3 ∀ z1 ∃ w1

∀ z2 ∃ w2 (ϕ0 ∧ ϕ1 ∧ ϕ2 ∧ ϕ3), where

∀ z3 ∃ w3

∀ s ∃ t ∀ p ∃ r

∀ a ∀ b ∃ c

ϕ0 : = (∧∧∧∧ 0≤i<j≤3 (xi = xj ⇒ yi = yj) ∧ ∧∧∧∧ 0≤i<j≤3 (zi = zj ⇒ wi = wj);

ϕ1 : = (t = x2 ∧ s = x1) ⇒ (y1 = y2 ∧ ¬(x1 = x2));

ϕ2 : = (r = z2 ∧ p = z1) ⇒ (w1 = w2 ∧ ¬(z1 = z2));

ϕ3 : = {(c = x2 ∧ c = z2 ∧ a = x1 ∧ b = z1 ∧ x3 = z3) ⇒ [y1 = y2 ∧ w1 = w2 ∧ (( y1 = y3 ∧ w1 = w3 )⇒

x3 = c)]}

To prove this theorem it is sufficient to justify the following two lemmas.

Lemma 1

The cardinality of a model M is a nonprime ⇔ M is finite and there are functions f, g defined on

the universe of the model M such that the following conditions are satisfied:

(a) Let�s take equivalence classes of relations Rf, Rg defined as follows:

(x, y) ∈ Rf =df f(x) = f(y)

(x, y) ∈ Rg =df g(x) = g(y)

These classes have at least two elements.

(b) Each equivalence class of the first relation has exactly one element in common with each

equivalence class of the second one.

Proof

(⇒ ) Let us assume that card(M) is a nonprime. Thus there are n, k ∈ ω, n > " and k > " such that

n · k = card(M). We can enumerate elements of the universe of M in such way that: M =

!n

i "={xi1, ..., xik}.

Let f(xij) =df xnj and g(xij) =df xik .

Functions f, g defined in this way satisfy the conditions (a) � (b) (Picture "). From the above definitions of f, g we obtain that equivalence classes of the relation Rf have the

following form Pj = {xij : i = ", ..., n}, for j = ", ..., k, and equivalence classes of the relation Rg

have the following form Si = {xij : j = ", ..., k}, for i = ", ..., n. Each equivalence class of the

relation Rf and Rg has at least two elements (of course, if card(M) is a nonprime). Thus condition

(a) is satisfied. Moreover Pj ∩ Si = {xij}, for any i ∈ {", ..., n}, j ∈ {", ..., k}. Therefore each

equivalence class of the relation Rf has exactly one element in common with each equivalence

class of the relation Rg. Thus condition (b) is satisfied.

(⇐ ) Let us assume that M is finite and there are functions f, g defined on the universe of a model

M satisfying conditions (a) and (b). We will show that these functions describe a diagram which

has n · k elements (Picture "), for some n, k ∈ ω.

Since any two equivalence classes of a given relation are identical or disjoint, thus we can assume

that M = !n

i "=Si = !

k

j "=Pj, where Si � the equivalence class of the relation Rg, Pj � the

equivalence class of the relation Rf. From condition (a) we have that each equivalence class of the

relation Rf has at least two elements. Let Pj = {x1j, ..., xpj), (p ≥ 2). We will show that for each j ∈

{", ..., k}, p = n. From (b) it is known that for each j ∈ {", ..., k}, Pj has exactly one element in

common with each equivalence class of the relation Rg. Since all equivalence classes of the

relation Rg are disjoint, there are exactly n of these classes and each element of Pj also belongs to

some equivalence class of the relation Rg, therefore Pj has exactly n elements. Thus we obtain that

each equivalence class of the relation Rf has exactly n elements and n ≥ 2. In a similar way we

obtain also that k ≥ 2. Because there are exactly k of equivalence classes of the relation Rf and each

of them has n elements (n, k ≥ 2), the universe of a model M has n · k elements, what ends the

proof.

Q.E.D.

Picture 1

P1 P2 P3 Pk

x11 X12 x13 . . . . . . x1k S1

x21 x22 x23 . . . . . . x2k S2

x31 x32 x33 . . . . . . x3k S3

. . . .

. . . .

xn1 xn2 xn3 . . . . . . xnk Sn

f(xij) = xnj

g(xij) = xik

Lemma 2 There are functions f, g defined on the universe of a model M satisfying conditions (a) and (b)

from lemma " ⇔ M$ ∃ f ∃ g ∀ x ∀ y ∃ z ∃ w ∃ p ∀ s (ϕ1 ∧ ϕ2 ∧ ϕ3), where

ϕ1 : = (f(x) = f(z) ∧ ¬(x = z)),

ϕ2 : = (g(x) = g(w) ∧ ¬(x = w)),

ϕ3 : = {f(x) = f(p) ∧ g(y) = g(p) ∧ [(f(x) = f(s) ∧ g(y) = g(s)) ⇒ p = s]}

Proof Let us observe that the formula ∃ f ∃ g ∀ x ∀ y ∃ z ∃ w ∃ p ∀ s (ϕ1 ∧ ϕ2 ∧ ϕ3) is equivalent to the

formula ∃ f ∃ g {∀ x ∃ z (f(x) = f(z) ∧ ¬(x = z)) ∧ ∀ x ∃ w (g(x) = g(w) ∧ ¬(x = w)) ∧

∧ ∀ x ∀ y ∃ p ∀ s{f(x) = f(p) ∧ g(y) = g(p) ∧ [(f(x) = f(s) ∧ g(y) = g(s)) ⇒ p = s]}}.

Therefore:

M$ ∃ f ∃ g {∀ x∃ z (f(x) = f(z) ∧ ¬(x = z)) ∧ ∀ x∃ w (g(x) = g(w) ∧ ¬(x = w)) ∧ ∀ x∀ y∃ p∀ s{f(x) = f(p)

∧ g(y) = g(p) ∧ [f(x) = f(s) ∧ g(y) = g(s) ⇒ p = s]} iff there are f, g defined on the universe of M

such that:

(") for each element x, there is a different from it element y such that

[f(x) = f(y)];

(2) for each element x, there is different from it element y such that

[g(x) = g(y)];

(3) for each x, y, there is exactly one element z such that

[f(x) = f(z) ∧ g(y) = g(z)];

iff there are f, g defined on the universe of M such that the equivalence classes of Rf and Rg

defined in lemma " has at least two elements and each equivalence class of the relation Rf has

exactly one element in common with each equivalence class of the relation Rg.

Q.E.D.

One may prove by skolemization that the formula from lemma " is equivalent to the formula

from the theorem ". Therefore theorem " follows from lemmas " and 2.

A similar idea can be applied for proving that the set of squares is a spectrum of the

formula with quantifier A8". It suffices to add the condition that f and g have the same number of

equivalence classes.

Theorem 2[Goli#ska "999]

There is a formula ϕ with quantifier "8A such that Spec(ϕ) = {k2

: k ∈ ω and k > "}.

This formula has the following form:

∀ x1 ∃ y1

∀ x2 ∃ y2

∀ x3 ∃ y3 ∀ z1 ∃ w1

∀ z2 ∃ w2 (ϕ0 ∧ … ∧ ϕ5), where

∀ z3 ∃ w3

∀ s ∃ t ∀ p ∃ r

∀ a ∀ b ∃ c

ϕ0 : = (∧∧∧∧ 0≤i<j≤3 (xi = xj ⇒ yi = yj) ∧ ∧∧∧∧ 0≤i<j≤3 (zi = zj ⇒ wi = wj);

ϕ1 : = (t = x2 ∧ s = x1) ⇒ (y1 = y2 ∧ ¬(x1 = x2));

ϕ2 : = (r = z2 ∧ p = z1) ⇒ (w1 = w2 ∧ ¬(z1 = z2));

ϕ3 : = {(c = x2 ∧ c = z2 ∧ a = x1 ∧ b = z1 ∧ x3 = z3) ⇒ [y1 = y2 ∧ w1 = w2 ∧ (( y1 = y3 ∧ w1 = w3 )⇒

x3 = c)]}

ϕ4 : = (y1 = x2 ⇒ y1 = y2) ∧ (w1 = z2 ⇒ w1 = w2);

ϕ5 : = [z1 = x1 ⇒ ( x1 = y1 ⇔ z1 = w1)];

Generalizing the construction of Krynicki and Mostowski from [Krynicki�Mostowski "995] we

obtain also:

Theorem 3[Goli#ska�Zdanowski 2000]

There is a formula ϕk with quantifier 72 +kH such that Spec(ϕk) = {(km � ")/ (k �") : m ∈ ω}.

This formula has the following form:

∀ x0 ∃ y0

.............

∀ xk+" ∃ yk+"

∀ z0 ∃ t0 ϕk : = ∃ r ............ (ϕ0 ∧ ... ∧ ϕ7)

∀ z3 ∃ t3

∀ u0 ∃ w0

............

∀ uk�" ∃ wk�"

∀ v ∃ s

where

ϕ0 : = (∧∧∧∧ 0≤i<j≤k+1 (xi = xj ⇒ yi = yj) ∧ ∧∧∧∧ 0≤i<j≤3 (zi = zj ⇒ ti = tj) ∧

∧ ∧∧∧∧ 0≤i<j≤k�1 (ui = uj ⇒ wi = wj ));

ϕ1 : = (x0 = r ⇔ x0 = y0) ∧ (z0 = r ⇒ z0 = t0); ϕ2 : = ((x0 = z0 ∧ x1 = z1 ∧ y0 = z2 ∧ y1 = z3) ⇒ (t0 = t1 ⇔ t2 = t3));

ϕ3 : = ((∧∧∧∧ "0

−=

ki (yi = yi+1) ∧ ∧∧∧∧ k

i 0= (¬(yi = r))) ⇒ ∨∨∨∨ 0≤i<j≤k (xi = xj));

ϕ4 : = (∧∧∧∧ "0

−=

ki

¬(yi = r) ∧ x0 = u0 ∧ ∧∧∧∧ 2

0

−=

ki (xi+1 = wi) ∧ ∧∧∧∧ 2

0

−=

ki (wi = ui+1)) ⇒

⇒ ((y0 = ... = yk�1) ∧ ∧∧∧∧ 2

0

−=

kj

∧∧∧∧ ji 0= ¬(wj = ui));

ϕ5 : = ((∧∧∧∧ ki 0= (yi = yi+1) ∧ x0 = r) ⇒ ∨∨∨∨ 0≤i<j≤k+1 (xi = xj));

ϕ6 : = (xk = r ∧ ∧∧∧∧ "0

−=

ki

¬(xi = r) ∧ x0 = u0 ∧ ∧∧∧∧ "0

−=

ki

(xi+1 = wi) ∧ ∧∧∧∧ "

0

−=

ki

(wi = ui+1)) ⇒

⇒ ((y0 = ... = yk) ∧ ∧∧∧∧ "0

−=

kj

∧∧∧∧ ji 0= ¬(wj = ui));

ϕ7 : = ((z0 = y0 ∧ t0 = t1 ∧ z1 = v ∧ x1 = s) ⇒ (y1 = v)).

Theorems "-3 supply the large class of sets of natural numbers belonging to the spectrum of the

logic with Henkin quantifiers, but do not belonging to the spectrum of the logic with function

quantifiers. It follows from theorems "-2 that nonprimes and square numbers are definable in logic

with Henkin quantifiers. It is interesting whether the complement of these spectra are also (") in

the spectrum of the positive formulae with Henkin quantifiers or (2) in the spectrum of the same

sublogics. The negative answer for the first question would mean that the spectrum of logic with

Henkin quantifiers is not closed under complement, hence NP is not equal to P. The negative

answer for the second question would mean that the spectra of some sublogics is not closed under

complement.

Operations on spectra

Searching for general descriptions of spectra of considered logics we have put the question:

for which operations are these spectra closed? It is easy to see that all these spectra are closed on

unions and intersections. And what's more?

Let us consider the following operations on sets of natural numbers.

Definition 7 (Ari thmetical operat ions)

Let A, B be sets of natural numbers. We define the arithmetical operations of addition, multiplication, subtraction and exponentation in the following way:

A ! B = {n + m : n ∈ A, m ∈ B}

A " B = {n · m : n∈ A, m ∈ B, n, m > "}

A ! c = { n + c : n ∈ A}, where c ∈ ω

A " c = { n · c : n ∈ A}, where c ∈ ω

A # B = {n � m : n ∈ A, m ∈ B, n > m}

A # c = {n � c : n ∈ A, n > c}, where c ∈ ω

kA = {kn

: n ∈ A}, where k ∈ ω, k > "

Definition 8 We say that Spec(L) is closed on an operation �• �, if for every A, B ∈ Spec(L), holds A • B ∈

Spec(L).

The question arises whether the spectrum of a given logic with Henkin quantifiers is closed

on the arithmetical operations defined above. In a case of a positive answer we would obtain a

more general characterization of the spectrum for considered language. We have two theorems

giving partial answers.

Theorem 4[Goli#ska�Zdanowski 2000]

Let A, B ⊆ ω be spectra of simple positive formulae of the following forms respectively:

Qϕ (x1, ..., xn, y1, ..., ym)

Q�ϕ�(p1, ..., ps, q1, ..., qt) , where

Q and Q� are Henkin quantifiers,

ϕ and ϕ� are quantifier free formulae,

x1, ..., xn and y1, ..., ym � are universal and existential variables from Q respectively,

p1, ..., ps and q1, ..., qt � are universal and existential variables from Q� respectively,

Then A ! B = Spec(ψ) , where ψ has the following form:

∀ α1 ∃ β1

..........

∃ a ∃ b .......... (ψ0 ∧ ... ∧ ψ3) , where

∀ αk ∃ βk

Q Q�

k = n + m + s + t;

ψ0 : = ∧∧∧∧ ki 2= (α1 = α i ⇒ β1 = βi);

ψ1 : = [¬(a = b) ∧ (α1 = β1 ⇒ (α1 = a ∨ α1 = b) ∧ (β1 = a ∨ β1 = b))];

ψ2 : = {[∧∧∧∧ ni "= (xi = α i) ∧ ∧∧∧∧ m

i "= (yi = αn+i) ∧ ∧∧∧∧ ni "= (a = βi)] ⇒ [ϕ ∧ ∧∧∧∧ m

i "= (a = βn+i)]};

ψ3 : = {[∧∧∧∧ si "= (pi = αn+m+i) ∧ ∧∧∧∧ t

i "= (qi = αn+m+s+i) ∧ ∧∧∧∧ si "= (b = βn+m+i)] ⇒ [ϕ� ∧

∧ ∧∧∧∧ ti "= (b = βn+m+s+i)]};

Theorem 5 [Goli#ska�Zdanowski 2000]

Let A, B ⊆ ω be spectra satisfying assumptions of theorem 4.

Then A " B is the spectrum of ψ, where ψ is of the following form:

∀ s1 ∃ t1

..........

..........

∀ sn+m ∃ tn+m

∀ r1 ∃ w1

.......... (ψ0 ∧ ... ∧ ψ6) , where

..........

∀ rs+t ∃ ws+t

∀ a ∃ b

∀ c ∃ d

∀ α ∀ β ∃ γ Q Q’

ψ0 : = (∧∧∧∧ 0≤i<j≤n+m (si = sj ⇒ ti = tj) ∧ ∧∧∧∧ 0≤i<j≤s+t (ri = rj ⇒ wi = wj);

ψ1 : = (s2 = t1 ⇒ t1 = t2) ∧ (r2 = w1 ⇒ w1 = w2);

ψ2 : = (b = s2 ∧ a = s1 ⇒ t1 = t2 ∧ ¬(s1 = s2));

ψ3 : = (d = r2 ∧ c = r1 ⇒ w1 = w2 ∧ ¬(r1 = r2));

ψ4 : = {(γ = s2 ∧ γ = r2 ∧ α = s1 ∧ β = r1 ∧ s3 = r3) ⇒ [t1 = t2 ∧ w1 = w2 ∧ ( t1 = t3 ∧ w1 = w3 ⇒

s3 = γ)]};

ψ5 : ={[∧∧∧∧ ni "= (xi = si) ∧ ∧∧∧∧ n

i "= (si = ti) ∧ ∧∧∧∧ mi "= (yi = si+n)] ⇒ [ϕ ∧ ∧∧∧∧ m

i "= (si+n = ti+n)]};

ψ6 : ={[∧∧∧∧ si "= (pi = ri) ∧ ∧∧∧∧ s

i "= (ri = wi) ∧ ∧∧∧∧ ti "= (qi = ri+s)] ⇒ [ϕ’ ∧ ∧∧∧∧ t

i "= (ri+s = wi+s)]};

Proofs of theorem 4-5 will be proved in the author�s presentation.

Remark Theorems 4 and 5 will be also true for formulae of the form: ∃ x1 ... ∃ xn Qϕ, where Qϕ is a simple

positive formula.

Our theorems have the following corollaries:

Corollary 1

Let L’ ( nH )n∈ω be the class of formulae of the form ∃ z1 ... ∃ zz Qϕ, where Qϕ is simple positive

formula with a quantifier nH . Then Spec(L’ ( nH )n∈ω ) is closed on addition.

Corollary 2

Let L’ (knA )n,k∈ω be the class of formulae of the form ∃ z1 ... ∃ zz Qϕ, where Qϕ is a simple positive

formula with a quantifier knA . Then Spec(L’ (

knA )n,k∈ω ) is closed on addition and multiplication.

(Let us note that we cannot formulate similar corollaries with respect to the class of formulae with

quantifiers "nA .)

Corollary 3

There is a quantifier free formula ϕ and a prefix Q of type "−k

nA such that the spectrum of Qϕ is

the set {m ∈ ω : ∃ j1 ... ∃ jk (m = ∏∏∏∏i=1k ji) and ∀ i≤s (ji > ")}.

New results

With presented results many questions arise. First of all, we can ask whether the presented

examples of spectra of formulae of the logic L(knA )n,k∈ω are also the spectra of the logic

L( nH )n∈ω . A negative answer would mean that the logic L( nH )n∈ω is semantically weaker than

the logic with all Henkin quantifiers. Maybe, the set of nonprimes is a good candidate for the

spectrum which is not a spectrum of a formula with any quantifier nH . The related problem is the

following: to find a formula with the minimal quantifier knA

which define a given spectrum of

L(knA )n,k∈ω � formula. One of the famous methods of showing nondefinability are Ehrenfeucht�s

games. Krynicki in [Krynicki 77] gave gametheoretical characterisation of the elementary

equivalence with respect to L( 2H ). It can be easily extend to L( nH )n∈ω . However, it seems that

gametheoretic method in application to a logics with all quantifiers nH is not a promising way of

showing nondefinability considering combinatorial difficulties. Probably it would be better to

apply games to formulae of the form nH ϕ, where ϕ is a quantifier free formula. At present the

author is working on this problem. Any possible results are going to be shown in the author�s

presentation.

The second problem is the following: are the complements of the considered spectra

definable by a simple positive formula of the same logic.

The third problem concerns corollaries " and 2. We have shown that some sublogics of

L( nH )n∈ω and L(knA )n,k∈ω are closed respectively on addition and on addition and multiplication.

Thus, the question arises: �can these theorems be generalized for all formulae of the mentioned

logics�.

The next open problem is �which of the considered spectra are closed on others operations,

for example subtraction and exponentation�.

We will show that:

• the set of nonprimes is definable by a formula with quantifier "4A and the set {(km

� ")/(k�

") : m ∈ ω} is definable by a formula with quantifier 4+kH . So results from theorems " and

3 can be improved. The ideas used in constructions of these formulae seem interesting from

combinatorial point of view.

• the complement of the set of k�ary full tree (for fixed k) and the complement of the set of

primes are definable by simple positive formulae of the logics L( nH )n∈ω and L(knA )n,k∈ω

respectively.

• considered logics are closed on exponentation.

• spectrum of simple positive formulae with quantifier nH is closed on multiplication iff

nonprimes are definable by a simple positive formula with quantifier nH .

• the sublogics of simple positive formulae of L(knA )n,k∈ω are closed on subtractions defined

as follows:

A #$ c = {n � c : n ∈ A, n > c}, where c ∈ ω.

A #2 B = {n � m : n ∈ A, m ∈ B, n > m, (n � m)2 ≥ n}.

Affiliations JOANNA GOLI!SKA

Institute of Philosophy, Warsaw University

e�mail: joszaG@poczta.onet.pl

References [Blass�Gurevitch "986] Blass, A., Gurevitch, Y., Henkin quantifiers and complete problems, Annals of Pure and Applied Logic 32 ("986), pp. "�"6.

[Fagin "974] Fagin, R., Generalized first order spectra and polynomial–time recognizable sets, SIAM–AMS Proceedings 7 ("974), pp. 43�73.

[Goli#ska�Zdanowski 2000] Goli#ska, J., Zdanowski, K., Spectra of Formulae with Henikin Quantifiers, it apears in:

Proceedings of ""th International Congress of Logic, Methodology and Philosophy of Science

[Goli#ska "999] Goli#ska, J., The Spectrum Problem for the Language with Henkin Quantifiers, The Master Thesis,

Warsaw University, Warszawa, "999.

[Krynicki 77] Krynicki, M., Henkin Quantifiers and Decidability, in: Proceedings of the Symposium on Mathematical Logic in Helsinki’75, S. Miettinen and J. Väänänen (eds.), "977, pp. 89�90

[Krynicki�Mostowski "992] Krynicki, M., Mostowski, M., Decidability problems in languages with Henkin quantifiers,

Annals of Pure Applied Logic 58 ("992), pp."49�"72.

[Krynicki�Mostowski "995] Krynicki, M., Mostowski, M., Henkin Quantifiers, in: Quantifiers I , Krynicki, M., Mostowski, M., Szczerba, L., W., (eds), Kluwer Academic Publishers, pp. "93�262.

[Mostowski 2000] Mostowski, M., private communication

[Scholz "952] Scholz, H., Ein Ungelöstes Problem in der Symbolischen Logik, Journal of Symbolic Logic "7, "952, pp.

"60

Game Representations of Complexity Classes

Gregory L. McColmDepartment of MathematicsUniversity of South Florida

Tampa, FL 33620(813) 974-9550, fax (813) 974-2700

e-mail mccolm@math.usf.eduURL http://www.math.usf.edu/�mccolm

May 28, 2001

Abstract

Many descriptive and computational complexity classes have game-theoretic representations. These

can be used to study the relation between di�erent logics and complexity classes in �nite model theory.

The notion of representing a property as a game is an old one. I claim that a given graph is connected,you deny it and demand that I connect a pair of vertices of your choice, etc. However, it is only recentlythat logical properties were represented as combinatorial games in any systematic way. Here, we look atone particular area where games can represent logics, namely, games representing logics that themselvesrepresent computational complexity classes.

During the 1960s and 1970s, several computational complexity classes appeared, including Nondeter-ministic Logarithmic Space (NLOGSPACE), Deterministic Polynomial Time (PTIME), NondeterministicPolynomial Time (NPTIME), the Polynomial Hierarchy (PH), Polynomial Space (PSPACE), and Deter-ministic Exponential Time (EXPTIME). (The classical theory of these spaces is described in the classicalreference [GaJ79].) During the 1970s and 1980s, several logics \captured" some of these complexity classes:

� In [F74], it was proven that the NPTIME computable queries are precisely the queries expressible inexistential second order logic.

� In [V82], it was proven that (given an ordering) the PSPACE computable queries are precisely thequeries expressible in While (renamed PFP in [AbV91]).

� In [V82] and [I83], it was proven that the PTIME computable queries are precisely the queries express-ible in (positive elementary) �xed point logic (given an ordering).

� In [I87], it was proven that the NLOGSPACE computable queries are precisely the queries expressiblein transitive closure logic (given an ordering).

These and similar results appearing in the 1980s formed the beginning of what has become \DescriptiveComplexity Theory," which is described in [I99]. Descriptive Complexity Theory became the primary focusfor \Finite Model Theory," and is perhaps the main reason that �nite model theory branched o� fromclassical (i.e., in�nite) model theory; for a description of Finite Model Theory, see [EF95].

But we are interested in representing algorithms as games.

1

� In [Mo72], a game quanti�er was introduced, and expanded on in [Ac75]. From these arises the gamefor (positive elementary) least �xed point logic described in [Mo74].

� In [HaK84] and [AbV89], game semantics based on Datalog but resembling the Game Theoretic Se-mantics of Hintikka (see [HiS97]) are introduced; [HaK84] presents a variant of the game for (positiveelementary) least �xed point logic.

� In [Mc95a], a game in the tradition of [HaK84] is presented to deal with problems arising from Strati�edDatalog (see [Ko91]). This was accompanied by a representation of the transitive closure hierarchy in[GrM96].

For more on the in�nitary version of logical game theory, see [Ko85]. We will be sticking to �nitary gamesin this abstract.

(We should not overlook \alternating turing machines," as in [CKS81], which presented game-playing,or alternation, as a generalization of nondeterminacy.)

In this abstract, we review the system introduced in [Mc95a], look at extant game representations of twoclassical logics, including one that captures PTIME. We outline new game representations of logics knownto capture DLOGSPACE, the polynomial hierarchy PH, PSPACE, and EXPTIME. We also develop a logic,based on a �nitary variant of the classical game quanti�er a, that captures PSPACE.

We will presume familiarity with the computational complexity classes NLOGSPACE, PTIME, PH,PSPACE, and EXPTIME: for an introduction to these, see [GaJ79] or even [WW86].

I would like to thank the referee for several useful suggestions and comments.

1 Computational Complexity Classes

and the Languages that Capture Them

This section consists of background material in Finite Model Theory: for more on this, see [EF95] or [I99].One begins with a schema (or \signature") consisting of some relation symbols R1; : : : (where each Ri is

of a particular arity arity(Ri)), and some constant symbols c1; : : :. This schema is used to to provide symbolsfor explicit descriptions of relational structuresM = hM;RM1 ; : : : ; c

M1 ; : : :i, where

� The set M = jMj is the domain of M.

� For each i, RMi �Marity(Ri) is an arity(Ri)-ary relation on M .

� For each k, cMk 2M .

These relations and constants are the extensional relations and constants; we count equality as one of theextensional relations. One also is given a list of variables v1; : : :, and the relation symbol =.

We will frequently use the same notation for symbols and for the objects that those symbols represent.One important notion. We will often want to expand a structure by adding a relation: if M =

hM;RM1 ; : : : ; cM1 ; : : :i is a structure and R is an a-ary relation symbol, we can expandM by taking a relation

RM � jMja, and letting (M; R) = hM;RM1 ; : : : ; RM; cM1 ; : : :i. Usually, we will have RM be a linear order,

and if we have it, we say that we \have an ordering."

De�nition 1.1 Fix a class C of relational structures of a common schema. A query is a function f suchthat for some nonnegative integer a, for each M 2 C, f(M) � jMja, i.e., f(M) is an a-ary relation on M.If a = 0, then f(M) 2 fTRUE, FALSEg for all M 2 C, and f is called a boolean query.

2

We will often use a relation symbol to refer to the query represented by that relation symbol: thus ongraphs, the symbol \path" can be used for the graph reachability query, so that for any graph G and anyx; y 2 jGj, path(G)(x; y) � pathG(x; y) is the assertion that in G, there is a path from x to y.

The nicest queries are those de�nable by First Order formulas. We will presume that the readers arefamiliar with First Order (FO) logic on these structures, and proceed directly to more expressive logics.

1.1 Least Fixed Point Logic

Perhaps the most popular �xed point logic is the First Order + (positive) Least Fixed Point (FO + posLFP) logic of [Mo74] and [AhU79].

First, given a relation variable symbol S, a second order formula '(: : : ; S; : : :) is S-positive if it has nosecond order quanti�cations and if all occurrences of S in ' are positive, viz., none are within any negatedsubformulas. And given a tuple �S = S0; S1; : : : ; S� , ' is �S-positive if ' is Si-positive for each i.

Second, from these �S-positive formulas, we can generate the FO + pos LFP expressible queries as follows.A system of �S-positive formulas 'i(�xi; S0; : : : ; S�), i = 0; : : : ; �, is operative if, for each i, length(�xi) =arity(Si). Such a system can be iterated as follows. First, let '�1i = ? for each i, and then for each

nonnegative integer �, let '�+1i (�x) � 'i(�x; '�0; : : : ; '

��). Finally, let '1i =

S� '

�i , as we will stick to �nite

relational structures in this paper.

De�nition 1.2 A query R is FO + pos LFP expressible if there exists an operative system of �S-positiveformulas '0; : : : ; '� such that for each relational structure M, RM = ('10 )M.

One example is Connectivity on the class of graphs hV;Ei. The usual algorithm is based on the operativesystem

'0(S0; S1) � 8x8yS1(x; y)

'1(x; y; S0; S1) � x = y _ 9z[E(x; z) ^ S1(z; y)]:

Note that in this induction, '�1(x; y) is equivalent to \the distance from x to y is at most �", so that '11 isthe binary Graph Reachability query. Thus we have the boolean query,

'10 () � 8x; y [9path from x to y];

and the induction closes in d+ 1 iterations, where d is the diameter of the graph.

Remark 1.1 It turns out ([I83]) that on �nite structures, the class of FO + pos LFP expressible queries isclosed under negation. Thus without loss of generality we can refer to this logic as FO + LFP.

One critical point. It is not hard to show that \the graph has an even number of vertices" cannotbe expressed in FO + LFP. However, if every structure inputted came with a linear order represented bya symbol <, then using this symbol, we can construct an \FO + LFP with ordering" (or FO< + LFP)operative system �' such that for any graph G, G j= '10 i� G has an even number of vertices.

Theorem 1.1 (Vardi ([V82]) and Immerman ([I83])) In the presence of an ordering, a query is FO+ LFP expressible i� it is PTIME computable.

This theorem is proven by using relations to represent machine positions, i.e., machine states plus the(polynomial-size) tape memory, and simulating the computation. See [I99] for details.

3

One important sublogic of FO + LFP is the transitive closure logic FO + pos TC. This logic is de�nedin terms of the transitive closure operator

TC[�](�x; �y) � �x = �y _ 9n9�u09�u1 � � � 9�un

"�x = �u0 ^

n�1̂

i=0

�(�ui; �ui+1)

!^ �un = �y

#:

The logic FO + pos TC is constructed by the following recursion.

� All First Order formulas are in FO + pos TC.

� If � is an FO + pos TC formula with an even number of arguments, then TC[�] is in FO + pos TC.

� If � and are in FO + pos TC, then so are � ^ , � _ , 9x�, and 8y .

This is an important logic:

Theorem 1.2 (Immerman [I87]) In the presence of an ordering, the logic FO + pos TC expressiblequeries are precisely the NLOGSPACE computable queries.

It is quirkier than FO + LFP:

Remark 1.2 In general, the class of FO+ pos TC expressible queries is not closed under negation ([GrM96]);however, in the presence of an ordering, FO + pos TC is closed under negation ([I88, Sz88]), and thusNLOGSPACE is closed under complementation.

1.2 Second Order Logics

Second order (SO) logic permits the use of relation variables, such as the following sentence for connectivityon graphs:

8S [(9xS(x) ^ 9y:S(y))! 9x9y(S(x) ^ :S(y) ^ Edge(x; y))] :

We will look at three logics entangled in SO logic.Let's �rst consider just adding a least �xed point operator to SO, to get formulas '(�x; �S; �S) where each

Sj is a third order object, i.e., a set of tuples (�y; �T ), where �y is a tuple of elements of a structure M while�T is a tuple of relations of that structure M. (For a detailed description of such \objects of higher type,"see [KeM77].) Just like FO + LFP, SO + LFP is generated by constructing operative systems of S-positiveformulas and by repeated parallel iterations, generating their least �xed points. And by virtually the sameproof as that of Theorem 1.2, we get:

Theorem 1.3 In the presence of an ordering, a query is SO + LFP expressible i� it is EXPTIME com-putable.

Ho-hum. What's more interesting perhaps is the complexity class in between PH and EXPTIME: poly-nomial space (PSPACE). We exhibit two logics that can capture this complexity class.

For the �rst, and extant, logic, we start with the PFP operator, which is sort of a second order versionof the TC operator.

De�nition 1.3 If � is any formula whose free variables are �u; S, then PFP[�](S; �y) is:

S(�y) _ 9n9U09U1 � � � 9Un

"S = U0 ^

n�1̂

i=0

8�x[Ui+1(�x)$ �(�x; Ui)]

!^ Un(�y)

#:

4

Then the logic FO + pos PFP is constructed by the following recursion.

� All FO formulas are in FO + pos PFP.

� If � is a FO + pos PFP formula, then PFP[�] is in FO + pos PFP.

� If � and are in FO + pos PFP, then so are � ^ , � _ , 9x�, and 8y�.

This logic was introduced in its current form in [AbV91], and has following important property:

Theorem 1.4 (Vardi, [V82]) In the presence of an ordering, the FO + PFP expressible queries are pre-cisely the PSPACE computable queries.

But we can reach into the depths of descriptive set theory for a language that captures PSPACE, evenin the absence of an ordering. This is essentially a �nitary version of game quanti�cation as seen in [Mo80].Restrict attention to structures with an ordering, and let S range over relations of 2n arguments, for somen. Let n = n1 + n2.

Given a formula �, let aS�(S) mean that in the following game, Eloise can succeed in getting an SM

such thatM j= �(SM). Let �x0; �x1; : : : ; �xkMkn be a lexicographic ordering of the n-tuples under the ordering.(Since we could start the game by having Eloise construct an ordering, it is not necessary to have one given.)Start with SM := ?. For each i, the ith pair of moves consists of Eloise choosing an n1-tuple �y, and thenAbelard choosing an n2-tuple �z. After the pair of moves, set S

M := SM [ f(�xi; �y; �z)g, and repeat. Continueuntil they've played kMkn moves. Then if SM is the relation generated, Eloise wins i� M j= �(SM).

Let SO + pos a be the logic resulting from extending Second Order logic with the game quanti�er.Theorem 3.3 below says that FO + pos a captures PSPACE.

2 About First Order Games

Imagine a game in which there are two players, Eloise and Abelard, one asserting that a certain statement isTRUE, the other that it is FALSE. For example, suppose that Eloise claims that a given graph is connected,while Abelard denies this, claiming that the graph is not connected. For example, a game for Connectivitywould work as follows. Abelard would be permitted to choose any two vertices x and y. If the graph isconnected, Eloise would be expected to construct a path from x to y. She would construct a sequencex0; x1; : : : ; xn, where x = x1, xn = y, and for each k < n, Edge(xk; xk+1). She would win i� she reaches y(thus, if the game goes on forever, she loses).

One can see from this example that Eloise has a winning strategy i� the given graph is indeed connected.The idea is to reduce any model-theoretic property to a game, where Eloise wins on a given model M i� Mactually satis�es the property.

2.1 Game Programs

We imagine that the game will be played on a structure M, with a bunch of pebbles as pieces, and thatat any time, the game is in one of several game states, and where the state determines whose move it is,and what kind of move the enabled player can make. Thus at any time, the game will be in a position(s;x; y; z; : : :), where s is a state, and pebble 1 will be on vertex x, pebble 2 on vertex y, and so on. Wepermit multiple pebbles on a single vertex. (Here, each state has a particular arity, i.e., a particular numberof arguments.) The game will proceed from position to position, starting at a distinguished state START,i.e., in a position (START; �x) (where �x is the possibly empty input tuple), and continuing until a terminalstate is reached, the game ends, and we see who wins. The rules will be in a Datalog-like form, so:

(current state; pebbled positions) :� legal moves:

5

Each state will have its own rule, indicating what is to be done next.A game program will be a set of rules, one for each game state. Here are the kinds of rules.

Junctive rules. The rule could be `disjunctive' or `conjunctive' (in which case we say that the associatedstate is also `disjunctive' or `conjunctive', resp.). First, consider a disjunctive rule. Let �x1 = xi1 ; : : : ; xid1and �x2 = xj1 ; : : : ; xjd2 each list variables only from �x = x1; : : : ; xd: let i1; : : : ; id1 ; j1; : : : ; jd2 2 f1; : : : ; dg.Then

(s; �x) :� (s1; �x1) _ (s2; �x2)

means that if the game is in state s, and the pebbles p1; : : : ; pd are on x1; : : : ; xd resp., then Eloise decideseither to:

� go to state s1, with pebbles p1; : : : ; pd1 on xi1 ; : : : ; xid1 resp., or to:

� go to state s2, which pebbles p1; : : : ; pd2 on xj1 ; : : : ; xjd2 .

In a sense, as the states are somewhat like assertions about tuples of vertices, for Eloise to claim that s isTRUE at �x, she has to claim that either s1 is TRUE at �x1 or that s2 is TRUE at �x2. Since she only has todefend one or the other, she is permitted to choose which junct to defend.

Notice that there may be some rearranging of pebbles. For example, for the rule

(s;x; y) :� (s1;x) _ (s2; y; x);

if the game is in state s with pebble p1 on the �rst argument and p2 on the second, then if Eloise chooses togo to state s2, the pebbles must be switched (if Eloise chose to go to state s1, pebble p1 would stay put andpebble p2 would be removed). This is actually analogous what happens in a computer: the variables are likethe variable-names of a higher language, while the pebbles are like the registers of the machine. From nowon, we will rearrange pebbles without comment.

Similarly, the conjunctive rule (s; �x) :� (s1; �x1) ^ (s2; �x2) means that Eloise is claiming that she candefend both juncts, so Abelard is permitted to decide which junct to challenge.

Quantitative rules. Here, one or the other player is permitted to place a pebble: the state is `existential'or `universal' depending on which player moves. Let �x0 consist of variables chosen from �x. Thus the existentialrule

(s; �x) :� 9y(s0; �x0; y)

means that if the game is in state s with pebbles on the vertices �x, then Eloise is to choose a vertex y, andthen rearranging pebbles so now the tuple �x0; y is properly pebbled, the game continues from (s0; �x0; y). Here,Eloise is asserting the existence of a vertex y such that she can win from (s0; �x0; y).

If instead, Eloise claimed that for every y, she would win from (s0; �x0; y), we would expect her to beable to defend any position (s0; �x0; y) Abelard challenges. Hence the universal rule would permit Abelard tochoose which y he cared to challenge. The result is the universal rule (s; �x) :� 8y(s0; �x0; y), which says thatAbelard chooses y, and then the game continues from (s0; �x0; y).

The junctive and quantitative rules dictate the course of the game: notice that the extensional relationsand constants of the relational structure never appear during the game, which consists of purely predicatecalculus manipulations. It is at the end of the game that the structure itself appears.

Terminal Rules. A terminal rule describes the end of a game. Given an extensional relation symbolR, the rule

(s;x1; : : : ; xl) :� R(xi1 ; : : : ; xik )

6

says that if the game is in a position (s;x1; : : : ; xl), where R(xi1 ; : : : ; xik ), then the game is over and Eloisewins; while if :R(xi1 ; : : : ; xik ), then Abelard wins. And the rule (s;x1; : : : ; xl) :� :R(xi1 ; : : : ; xik ) says thatif the game is in a position (s;x1; : : : ; xl) where :R(xi1 ; : : : ; xik ), then the game ends and Eloise wins, whileif R(xi1 ; : : : ; xik ), Abelard wins. (We also permit the terminal rules (s;x) :� x = c and (s;x) :� x 6= c,where c is an extensional constant.)

Remark 2.1 The rules presume that if the game never ends, then Eloise loses: it is up to Eloise to establishthat the debated assertion is TRUE.

And the obvious de�nitions:

De�nition 2.1 Given a game program � and structure M, the game played on M using the program � isdenoted G(�;M).

And:

De�nition 2.2 A query ' is represented by a game program � on a class C of relational structures i� foreach M 2 C, M j= ' i� Eloise has a winning strategy for G(�;M).

2.2 On the Topology of the Games

We can imagine a owchart of a game program, like Figure 1 below, as a digraph, with states as verticesand arcs indicating legal moves. We can use the old FORTRAN style of box shapes to indicate initialand terminal versus junctive versus quantitative states. Important: in the owchart, we use \reset" toshift pebbles (variable values) around. We usually overlook such bookkeeping in the same way that higherlanguages overlook addressing.

De�nition 2.3 Let � be a game program. The owchart of �, denoted F (�), is the digraph whose nodesare the states of �, and such that there is an arc from state s to state s0 in F (�) i� s0 occurs in the body ofthe rule for s in �.

Incidentally, if s0 occurs in the body of the rule for s, write s ! s0. Let�! be the re exive transitive

closure of !, and let+! be the irre exive transitive closure of !, i.e., s

+! t i� there exists a u such that

s! u and u�! t.

De�nition 2.4 The state s is recursive if s+! s.

De�nition 2.5 Let � be a game program with owchart F (�). A subroutine of � is a maximal stronglyconnected subdigraph of recursive nodes of F (�).

A subroutine is like a brick, and we consider the program as being made up of bricks, giving the generalshape of the program. The nonrecursive game states are only as so much mortar binding the bricks.

2.3 Non-Recursive Games

The easiest logic to represent by a class of games is FO itself. The theory of FO-like games was developedin a series of papers by Hintikka and others (see, e.g., [HiS97]). We go through the representation of FOitself to give the basic idea. (The following is sort of a distillation from [HiK83, Chapts. 1 & 3].) Take a FOformula �, and by induction on �'s subformulas ', construct the following game program.

7

� If '(�v) � R(�v), where R is an extensional relation, we have the terminal rule (s; �v) :� R(�v). Inparticular, if '(v; w) � v = w, then we have the terminal rule (s; v; w) :� v = w. Simliarly, wecan get terminal rules (s; �v) :� :R(�v) and (s; v; w) :� v 6= w for the subformulas '(�v) � :R(�v)and '(v; w) � v = w, resp. And (s; v) :� v = c and (s; v) :� v 6= c are rules for the subformulas'(v) � v = c and '(v) � v 6= c, resp., where c is an extensional constant.

� If '(�v) � '1(�v1) �'2(�v2) for a junction � 2 f^;_g, and where �v1 and �v2 both list variables from �v, wehave the junctive rule (s; �v) :� (s'1 ; �v1) � (s'1 ; �v2).

� If '(�v) � Qw (�v0; w), where �v0 is a list of variables from �v, then we have the quantitative rule(s; �v) :� Qw(s ; �v

0; w).

As a formula �(�v) has �nitely many subformulas, this induction will produce a �nite game program, startingwith a rule whose head is (START�; �v).

And the converse is also possible: given a �nite game program with no recursive states, one can construct aformula for it by reversing the above recursion. Then by induction on subformulas, formalizing the argumentof [Hi82] (reappearing as [HiK83, Chapt. 1]):

Theorem 2.1 There is a one-to-one correspondence between FO formulas and non-recursive game programssuch that the following is true. For each FO sentence � corresponding to a game program �, and for eachstructure M, M j= � i� Eloise has a winning strategy for G(�;M).

Idea of Proof. If we have a sentence � and a corresponding program �, then for each subformula of �,there will be a corresponding state s' and vice versa. Proceed by induction on subformulas to prove that

for any �x 2 jMjarity(�x), (M; �x) j= i� Eloise wins from (s ; �x). For example, if (�v) � 1(�v1) ^ 2(�v2),then (s ; �v) :� (s 1 ; �v1) ^ (s 2 ; �v2). Then:

� (M; �x) j= i�:

� (M; �x1) j= 1 and (M; �x2) j= 2 i�:

� by induction, Eloise wins from both (s 1 ; �x1) and (s 2 ; �x2) in G(�;M), i�:

� no matter which of (s 1 ; �x1) or (s 2 ; �x2) Abelard challenged in G(�;M), Eloise goes on to win, i�:

� Eloise wins from (s ; �x) in G(�;M).

Disjunctions, and quanti�ers and terminal rules, are handled similarly. �

2.4 A Game for FO + pos LFP

Now we look at recursive game programs. We have the following result, outlined in [Mc95a], but originallyfrom [HaK84]:

Theorem 2.2 ([HaK84]) A query is FO + LFP expressible i� it is represented by a �rst order gameprogram.

The proof in [Mc95a] gives a very close relationship between FO + LFP formulas and the �rst ordergames. For example, the Connectivity system

'0(S0; S1) � 8x8yS1(x; y)

'1(x; y; S0; S1) � x = y _ 9z[E(x; z) ^ S1(z; y)]:

8

is associated with the program

(START; ) :� 8x(SOURCE;x)

(SOURCE;x) :� 8y(GAP;x; y)

(GAP;x; y) :� (EQUALS;x; y) _ (GAP-AUX;x; y)

(EQUALS;x; y) :� x = y

(GAP-AUX;x; y) :� 9z(NEXT;x; y; z)

(NEXT;x; y; z) :� (EDGE;x; z) ^ (GAP; z; y)

(EDGE;x; y) :� Edge(x; y):

Notice that every rule de�nes a subformula of one of the formulas of the operative system: for each states, there is a subformula such that Eloise wins from (s; �x) on M i� M j= (x; �'1). Note that in playingthe game, when one reaches a position \(GAP; u, v)", corresponding to the subformula S1(u; v), this alsocorresponds to the subformula '1(u; v;�). An in general, when playing the game for '10 for the operativesystem '0; : : : ; '� , Eloise wins from (sSi ; �x) i� Si(�x) (where Si = '1i ) i� 'i(�x; �'

1) i� Eloise wins from(s'i ; �x), viz., sSi = s'i .

Also, this allows one to cook up a \ owchart" of a game program, by drawing a digraph whose nodes arethe states, and whose arcs show moves that can be made from state to state. Here is the owchart madefrom the game program of Connectivity.

reset x := z

START: A chooses x

SOURCE: A chooses y

RLGAP: E chooses L or Rx = y

NEXT: A chooses L or RL R

Edge(x,z)

GAP-AUX: E chooses z

existential subroutine

Figure One

2.5 Subroutines and Transitive Closure

Using subroutines (see Subsection 2.2), we can get some �ner results game representation results, such asthose involving complexity measures in [Mc95b]. Here we present a di�erent kind of representation resultfrom those.

De�nition 2.6 A game program � is existentially cyclic if, in the owchart of �, each subroutine is a cycle,all of whose quantitative states are existential.

9

Then:

Theorem 2.3 A query is FO + pos TC expressible i� it is represented by an existentially cyclic gameprogram.

Idea of Proof. The basic idea is captured by looking at a game program in which the initial state is inthe sole subroutine. Call a state s supporting if it is not recursive but there is a recursive state s0 such thats0 ! s. Then the relations represented by the supporting states represent FO queries.

We employ a trick, and show that in the game, going through the cycle once is equivalent to: from theinitial position, Eloise chooses all the vertices she intends to pebble in quantitative moves provided the gameactually gets that far throughout the cycle. So from (START; �x), choosing �y, if � is the (FO) assertion thatif Abelard chooses to leave the cycle, he will lose, then �(�x; �y) asserts that Eloise can safely (presume to)to go from �x to �y. And if ' asserts that Eloise will win in the next round, we have represented a query9�yfTC[�](�x; �y) ^ '(�y)g. �

3 Second Order Games

We can extend these \�rst order" games to \second order" games where a player can play relations as wellas tuples. A position then is a tuple

(s;S0; : : : ; Sn;x0; : : : ; xm)

and we have the usual terminal, junctive, and (�rst order) quanti�cation moves. In addition, we have:Subterminal rules. The rule

(s; �S; �x) :� Si(�y);

where �y is a list of constants and variables from �x, means that for the relations SMj , j = 0; : : : ; n and the

tuple �xM, Eloise wins from (s; �SM; �xM) i� SMi (�yM) is true. We also have rules (s; �S; �x) :� :Si(�x).Second Order Quanti�cation. We can quantify over relations. The rule

(s; �S; �x) :� 9T (s0; �S0; T ; �y)

says that onM, from (s; �SM; �xM), Eloise can choose TM, and for �S0M a tuple of relations from �SM, and for�yM a tuple of elements from �xM, the game continues from (s0; �S0M; TM; �yM). Similarly, the rule

(s; �S; �x) :� 8T (s0; �S0; T ; �y)

says that Abelard chooses TM.Recall from [StM73] that queries are SO-expressible i� they are PH computable. And another distillation

of [HiK83, Chapts. 1 & 3] gives us:

Theorem 3.1 A query is SO expressible i� it is represented by a non-recursive second order game program.

So PH consists of queries representable by bounded SO games. And for unbounded SO games, we getthe following very unsurprising extension of Theorem 1.3:

Theorem 3.2 For any query, the following are equivalent.

� The query is SO + LFP expressible.

� The query is EXPTIME computable.

10

� The query is represented by a second order game program.

So EXPTIME is represented by a second order game programs. Let's restrict these games and look atPSPACE.

We want to replace second order quanti�cation with a rule that says \you can make a move by puttinga piece on another position on the board." In other words, when a player selects a relation, that relationmust be an extension of a relation by adding some tuples:

Monotonic (Second Order) Quantitative Rules. These are of the form

(s; �S; �x) :� (QT � Si)(s0; �S0; T ; �y):

This means for the �xed i, the player to move (Eloise if Q = 9, Abelard if Q = 8) from (s; �SM; �xM) mustchoose TM � SMi , and the game continues from (s0; �S0M; TM; �yM).

If we have only monotonic second order quantitative rules, call the game program Second Order Mono-tonic.

And we get:

Theorem 3.3 Let be a query. Over relational structures with an ordering, the following are equivalent.

1. The query is PSPACE computable.

2. The query is representable by a monotonic second order game program.

3. The query is FO + pos a expressible.

Idea of Proof. We outline the proof in the presence of an ordering; it remains true in the absence ofan ordering. In the presence of an ordering, (1) is equivalent to FO + pos PFP expressibility. Recall thenomenclature of Subsection 1.2.

(1) =) (2). First, use the FO + pos PHP expressibility of recall that the PHP operator (of De�ni-tion 1.3) generated a sequence of relations U until a relation satisfying a condition ' was reached. Play thefast TC game on the sequence of relations U0; U1; � � � ; Un, with Eloise �rst playing the initial relation U0, arelation Un such that '(Un). Then Eloise plays Ubn=2c, Allen responds by choosing LEFT or RIGHT, Eloiseplays Ubn=4c or Ub3n=4c, resp., and so on, until (after a polynomial number of sets of moves) they reach Um,Um+1, and Eloise wins i� 8�x[Um+1(�x)$ �(�x; Um)] (assuming '(Un)).

(2) =) (3). This is a straightforward if messy simulation.(3) =) (1). Do a depth �rst tree search from each position, searching all successive possible moves, to

�nd if it is a winning position, as in [CKS81]. As the game is polynomially long, this takes exponentiallymany steps, but in polynomial space. �

References

[AbV89] S. Abiteboul & V. Vianu, Fixpoint extensions of First Order Logic and Datalog-like LanguagesProc. 4th IEEE Symp. Logic in Comp. Sci. (LICS'89), 71{79.

[AbV91] S. Abiteboul & V. Vianu, Generic Computation and its Complexity, 32nd IEEE Symp. on theFound. of Comp. Sci. (FOCS'91), 209 { 219.

[Ac75] P. Aczel, Quanti�ers, games and inductive de�nitions, Proc. 3rd Scandinavian Logic Symp.(North-Holland, 1975), 1{14.

[AhU79] A. Aho & J. Ullman, Universality of data retrieval languages, Proc. 6th ACM Symp. Princi-ples of Programming Languages (1979), 110-117.

11

[CKS81] A. Chandra, D. Kozen & L. Stockmeyer, Alternation, J. ACM 28:1 (1981), 114{133.

[EF95] H.-D. Ebbinghaus & J. Flum, Finite Model Theory (Springer-Verlag, 1995).

[F74] R. Fagin, Generalized �rst-order spectra and polynomial time recognizable sets, in: R. Karp, ed.,Complexity of Computations (SIAM-AMS Proc. 7, 1974) 43{73.

[GaJ79] M. R. Garey & D. S. Johnson, Computers and Intractability: A Guide to the Theory ofNP-Completeness (Freeman, 1979).

[GrM96] E. Gr�adel & G. McColm, Hierarchies in transitive closure logic, strati�ed Datalog and in�nitarylogic, Ann. Pure Appl. Logic 77 (1996) 169{199.

[HaK84] D. Harel & D. Kozen, A programming language for the inductive sets, and applications, Infor-mation and Control 63 (1984), 118-139.

[Hi82] J. Hintikka, Game-Theoretical Semantics: Insights and Prospects, Notre Dame J. FormalLogic 23 (1982), 219{241.

[HiK83] J. Hintikka & J. Kulas, The Game of Language: Studies in Game-Theoretical Semanticsand its Applications (D. Reidel, 1983).

[HiS97] J. Hintikka & G. Sandu, Game-Theoretic Semantics, in: J. van Benthem & A. ter Meulen, eds.,Handbook of Logic & Language (MIT Pr. & North-Holland, 1997) 361{410.

[I83] N. Immerman, Languages which capture complexity classes, Proc. 15th ACM Symp. Theoryof Comp. (STOC'83), 347{354.

[I87] N. Immerman, Languages that capture complexity classes, SIAM J. Computing 16 (1987),760{778.

[I88] N. Immerman, Nondeterministic space is closed under complementation, SIAM J. Comput. 17(1988), 935{939.

[I99] N. Immerman, Descriptive Complexity (Springer-Verlag, 1999).

[KeM77] A. Kechris & Y. Moschovakis, Recursion in Higher Types, in: J. Barwise, ed., Handbook ofMathematical Logic (North-Holland, 1977), 681{737.

[Ko85] P. Kolaites, Game Quanti�cation, in: J. Barwise & S. Feferman, eds., Model-Theoretic Logics(Springer-Verlag, 1985), 365{421.

[Ko91] P. Kolaitis, The expressive Power of Strati�ed Logic Programs, Inf. & Comp. 90 (1991), 50{66.

[Mc95a] G. McColm, Pebble Games and Subroutines in Least Fixed Point Logic, Information and Com-putation 122:2 (1995), 201{220.

[Mc95b] G. McColm, Dimension Versus Number of Variables, and Connectivity, too,Math. Log. Quart.41 (1995), 111{134.

[Mo72] Y. Moschovakis, The Game Quanti�er, Proc. AMS 31:1 (1972), 245-250.

[Mo74] Y. Moschovakis, Elementary induction on abstract structures, (North-Holland, 1974).

[Mo80] Y. Moschovakis, Descriptive Set Theory (North-Holland, 1980).

12

[StM73] L. J. Stockmeyer & A. R. Meyer, Word problems requiring exponential time Proc. 5th Symp.Theory of Comp. (STOC'1973), 1{9.

[Sz88] R. Szelepcs�enyi, The Method of Forced Enumeration for Nondeterministic Automata, Acta In-formatica 26 (1988), 279{284.

[V82] M. Vardi, Complexity of relational query languages, Proc. 14th ACM Symp. Theory ofComp. (STOC'1982), 137{146.

[WW86] K. Wagner & G. Wechsung, Computational Complexity (D. Reidel, 1986).

13

The edge of 3-variable-inexpressibility beside

Tarski's Peircean formulation of set-pairing

A. Formisano�, E.G. Omodeoy, A. Policritiz

Abstract

The n-variable expressibility of elementary (set-)theoretical conceptsassumes critical relevance within Tarski's program of formalization ofmathematics [TG87].

Tarski and Givant's approach to the equational formalization of settheory inspires ongoing research aimed at automating equational set-reasoning and strongly motivates the study of equational formalizationsof logical theories.

Our main result consists in proving the 3-variable inexpressibility of akernel set-theory (namely, (E)^ (W)^ (L)). Being well-known the factthat the theory (E)^ (N)^ (W)^ (L) is 3-variable expressible, this re-sult gives a precise characterization of the borderline to be crossed for anadequate \algebrization" of Set Theory.

As a by product, we give solution to an open problem (regarding thesingle axiom (W)), by exposing an alternative proof of a result statedin [Kwa81] whose original proof was considered somewhat unsatisfactoryby the authors of [TG87].

1 Goals of this study

In his seminal paper [Zer08], Zermelo calls axiom of elementary sets an axiomwhich asserts that:� there is a set, ;, which is devoid of elements;

� a singleton set fxg can be formed out of any object x of the domain ofdiscourse; and, more generally,

� an unordered pair fx; yg can be formed out of objects x; y whatsoever.In the original list of postulates for set theory proposed by Zermelo, this

axiom occupies the second position, after the extensionality axiom stating thatdistinct sets cannot have precisely the same elements.

Let us place ourselves in the framework of a set theory which does not caterfor individuals or proper classes: then extensionality can be stated as simply as

�Universit�a di Perugia, Dip. di Matematica e Informatica; email: formis@dipmat.unipg.ityUniversit�a di L'Aquila, Dip. di Informatica; email: omodeo@univaq.itzUniversit�a di Udine, Dip. di Matematica e Informatica; email: policriti@dimi.uniud.it

1

(E) 8x 8 y�x 6= y ! 9 v ( v 2 x $ v =2 y )

�,

and Zermelo's postulate of elementary sets can be decomposed as the conjunc-tion of the following null-set axiom and pairing axiom:

(N) 9 z 8 v v =2 z,(P) 8x 8 y 9 p 8 v

�v 2 p $ ( v = x _ v = y )

�.

Several studies (cf., among others, [Daw99, KV96, Hod93]) indicate the num-ber of distinct variables as a signi�cative measure of complexity for sentences.In this context, one may be led to thinking that (P) is somewhat deeper than(E), because it involves 4 variables instead of 3. Alfred Tarski, however, discov-ered a sentence (OP) which is logically equivalent to (P), involves 3 variablesaltogether, and explicitly states the existence of ordered pairs . To understandTarksi's idea, one should bear in mind the encoding of ordered pairs in the form�

x; y�

=Def

�fx; y g; fx g

devised by Kuratowski in 1921, and accept also the set

�fx; y g; fx g; ;

as a

legitimate |though redundant| encoding for the same ordered pair. By wayof �rst approximation, (OP) can be formulated as follows:

(OP) 8x 8 y 9 q ( q �0 x ^ q �1 y ),where the abbreviating relators �0 and �1 designate (quasi-)projections associ-ated with ordered pairs of the above kind and are de�ned as follows:

q � x $Def 9 s�x 2 s ^ s 2 q ^ :9u (u 2 s ^ u 6= x )

�,

viz., there is a singleton s in q to which x belongs;q �0 x $Def q � x ^ :9 v ( q � v ^ v 6= x ),

viz., there is a unique singleton s in q, and x belongs to s;q �1 y $Def 9w

�y 2 w ^ w 2 q

�^ :9 z

�9 t ( z 2 t ^ t 2 q ) ^ :q �0 z ^ z 6= y

�,

viz., q has either the form ffx; yg; fxgg or the formffx; yg; fxg; ;g, for some x.

Then, in unfolding �0 and �1 within (OP) according to their de�nitions, oneshould judiciously rename bound variables so as to bring no variables other thanx; y, and q into play. In particular the conjunct q �0 x, once fully unfolded, willbe

9 y�x 2 y ^ y 2 q ^ :9 q ( q 2 y ^ q 6= x )

�^ :9 y

�9x�y 2 x ^ x 2 q ^ :9 q ( q 2 x ^ q 6= y )

�^ y 6= x

�:

Likewise, q �1 y unfolds within (OP) into9x ( y 2 x ^ x 2 q ) ^ :9x

�9 y (x 2 y ^ y 2 q ) ^ : q �0 x ^ x 6= y

�,

where q �0 x should be unfolded, in its turn, as before.As discussed in depth in [TG87], an important by-product of having the ele-

mentary set postulate recast in 3 variables (as just shown) is that any �rst-ordertheory of sets to which (N) and (P) belong (either as axioms or as theorems)can, through this rendering, be translated into the arithmetic of (dyadic) rela-tions. Namely, into the algebraic formalism which developed in the forties (cf.[Tar41, JT48, CT51]) from the far-reaching studies on logic carried out by Peirceand Schr�oder in the late 19th and early 20th century. Recently, this approach

2

3 =Def 2�1 33 =Def 3 Æ 3� =Def 3 Æ (3 n 3Æ � )�0 =Def � n � Æ � �1 =Def 33 n (33n�0 )Æ �

(E) � = 3Æ2\3Æ2 (N) 1l = 1l Æ2 Æ 1l

(OP) 1l = �0�1 Æ �1 (R) 1l Æ2 = 1l Æ (2 n 3Æ2 )

Priorities (from highest to lowest): �1, Æ, \, n

Figure 1: Peircean speci�cation of a very weak set theory

to the formalization of set theory via relation algebras inspired several researchaimed at automating equational set-reasoning (cf. [FOT00, FO00]).

Figure 1 shows a translation into this formalism1 of (N), (OP), and (R),the last of which is von Neumann's regularity axiom

(R) 8x 9 r�( r 2 x _ r = x ) ^ :9 v ( v 2 r ^ v 2 x )

�.

In this paper we will consider a version of the elementary set postulate whichis a bit stronger than the one, (N)^ (P), discussed above. In conjunctionwith (N), our postulate has clauses catering for the single-element addition andremoval operations x; y 7! x [ fyg and x; y 7! x n fyg:

(W) 8x 8 y 9w 8 v�v 2 w $ ( v 2 x _ v = y )

�,

(L) 8x 8 y 9 ` 8 v�v 2 ` $ ( v 2 x ^ v 6= y )

�.

Taking advantage of the presence of (E), exploiting a notion of orderedpair which slightly di�ers from the one due to Kuratowski, and proceeding in away similar (but much simpler) to the way (P) was restated as (OP), we willsucceed in recasting (N)^ (W)^ (L) as a 3-variable sentence.

In earlier studies, we noticed that investigating (N) and (W) in isolationfrom (L) is not convenient. To make an example, a set uni�ability algorithmwhich works under (E), (N), (W), and (R) can be found even in absence of(L), and in such a weak axiomatic framework it would also be possible to supplya `disjunctive syllogistic decomposition' for systems of the form8>>><

>>>:fs11; : : : ; s1n1g = fd11; : : : ; d1m1

gfs21; : : : ; s2n2g = fd21; : : : ; d2m2

g...

......

fsK1; : : : ; sKnKg = fdK1; : : : ; dKmKg

(in the unknowns sij ; dih); however, bringing the disjuncts of the decomposi-tion to the pleasant form of normalized systems of set-equations only becomespossible when (L) is available (cf. [OP95]).

This paper provides a new argument in favor of treating the triad (N), (W),(L) as a single postulate: the conjunction of these three sentences can be statedvery tersely by an equivalent sentence which involves 3 variables altogether.

1The notation in Figures 1 and 2 complies with the one we have used in [FO00].

3

Since (N)^ (W) yields (P), something close to Tarski's statement in 3 variablesof (N)^ (OP) would be achievable for (N)^ (W) as well; but the outcomewould be much lengthier and more cryptic than for the said triad.

The question then naturally arises whether the conjunction (W)^ (L) is,by itself, expressible in 3 variables. We will answer this question negatively, byconstructing two structures A and B, one satisfying (W)^ (L)^ (E) whereasthe other satis�es :(W)^:(L)^ (E), and by showing via a technique (basedon the so-called pebble games, see [Imm82, Bar77, IK89]) that the sentences in 3variables that A makes true are the same which are made true by B. Since (E)involves 3 variables only, no sentence in 3 variables can be logically equivalentto (W)^ (L), to (W), or to (L).

Our conclusion is, to the best of our knowledge, an original result, eventhough M. Kwatinetz apparently achieved the related result that (W) taken inisolation from (L) and (E) cannot be stated in 3 variables (cf. [Kwa81, pp. 55{57], and contrast it with [TG87, p. 63]). Our own reconstruction of the latterresult is provided in Sec.3, as an exercise in the use of pebble games preparatoryto the new and more engaging result.

2 Expressibility of (E)^ (N)^ (W)^ (L) in 3 vari-ables

Also in our statement of the axiom of elementary sets, the notion of orderedpair will be the hinge of the formulation in three variables. The pairs we havein mind are as follows:

hx; y i =Def

�f y g less x ; f y g with x

,

where the binary functions less and with , and the constant ;, result from theSkolemization of (L), (W), and (N), respectively, and

f v; w g =Def ; with v with w ; f v g =Def f v; v g :Although the structure of such pairs only marginally departs from the above-

recalled Kuratowski's pair notion, we need to assume the extensionality axiom,(E), which is not necessary with the traditional approach.

Proceeding in a way similar (but much simpler) to the way (P) got restatedas (OP), we achieve the following restatement of (N)^ (W)^ (L):

(D) 8x 8 y 9 d�y 2 d ^ 8 v

�9w( v 2 w ^ w 2 d )

^ 9 `( v =2 ` ^ ` 2 d ) $ v = x� �

;

which under the renaming v 7! y ; w 7! x ; ` 7! x of bound variables becomes a3-variable sentence. This (D) says that one can build the set

�y less x; y with x

out of sets x; y whatsoever. Only indirectly, it enables one to form singletons,the null set ;, and ordered pairs of the form hx; yi.

As a matter of fact, by bringing (D) into Skolemized form we get

(D0) Y 2 Æ(X;Y ) ^ 8 v�9w�v 2 w ^ w 2 Æ(X;Y )

�^ 9 `

�v =2 ` ^ ` 2 Æ(X;Y )

�$ v = X

�;

4

22 =Def 2 Æ 2 622 =Def 3 Æ 3

valve(P;Q) =Def P n �Æ (P nQ ) � =Def 622 \ valve(22; 622)(D) 1l = � Æ 3

� =Def ��1 % =Def

�valve(22;�)

��1

Figure 2: Peircean speci�cation of a strengthened axiom (D) of elementary sets,and of projections �;% pertaining to it

where uppercase variables are meant to be universally bound. This is equivalentto the conjunction of (N), (W), and (L), in the following sense:� under (N), (W), and (L), one can de�ne

Æ(X;Y ) =Def fY lessX ; Y withX gand then derive (D0);

� under (E) and (D0), one can prove that(W0) 9w 2 Æ(X;Y ) 8 v( v 2 w $ v 2 Y _ v = X ) ;(L0) 9 ` 2 Æ(X;Y ) 8 v( v 2 ` $ v 2 Y ^ v 6= X ) ;(N0) 9 s 2 Æ(Æ(X;Y ); Y ) 9 e 2 s 9 z 2 Æ(s; e) 8 v v =2 z ;

whence (N), (W), and (L) readily follow.

Figure 2 shows a translation of (D) into the arithmetic of relations, alongwith a Peircean speci�cation of conjugated projections �;% which correspondto our notion hx; yi of ordered pair very much like the expressions �0;�1 inFigure 1 designate projections associated with Kuratowski's pair notion. In thearithmetic of relations it can easily be proved that��1 Æ � � � and %�1 Æ % � �, viz., �;% designate partial functions.

We also suceeded in deriving the analogue 1l = � Æ% of (OP) from (D) and(N); on the other hand, we have been unable to obtain it without using (N).Here is a possible explanation of this failure: it might be the case that (N)does not follow from (D) in the arithmetic of relations, even though it does in�rst-order logic.

3 Inexpressibility of (W) in 3 variables

Preliminary to a stronger result to be discussed in Sec.4, in what follows weshow that (W) in not expressible in 3 variables. We proceed by exhibitingtwo structures, A and B, which model (W) and :(W), respectively. Theinexpressibility of (W) in 3 variables will be proved by showing that thesestructures satisfy the same collection of sentences in (at most) 3 variables. Inturn, the equivalence of A and B w.r.t. sentences in 3 variables will be provedby a model-theoretic method introduced in [Imm82] (and essentially alreadypresent in [Bar77]). The technique is based on a restricted form of Ehrenfeucht-Fra��ss�e game between two players, to be named Duplicator and Spoiler, each ofwhich has 3 pebbles available.

5

We need the following pieces of notation and the subsequent de�nition:

X� =Def f i 2 X | i < 0 g;X+ =Def f i 2 X | i > 0 g;

E(X) =Def f i 2 X | i� 1 =2 X _ i+ 1 =2 X g;I(X) =Def f i 2 X | i� 1 =2 X ^ i+ 1 =2 X g;[i; j] =Def fh 2 Z | i 6 h ^ h 6 j g;h(X) =Def minf i 2 N | E(X) � [�i; i] g;F (X) =Def X \ [�h(X); h(X)];c(X) =Def jI(X)j+ jE(X) n I(X)j=2;

where N = f 0; 1; 2; : : :g, Z= N [ f�i | i 2 N g, X � Z, and i; j 2 Z.

De�nition 1 A subset A of Z is said to be representable if it meets thecondition

0 =2 A ^��A�

�� < @0 ^ jN nAj < @0:

�

By little re ection, one sees that any representable set A can be uniquely de-composed in the form of a disjoint union

A =

�[i=1

[n2�i�1; n2�i] [��1[j=0

[p2�j ; p2�j+1] [ fh 2 Z|h > p2�� g ;

of non-void intervals some of which may be singletons, one of which is in�nite,and whose endpoints form the set

E(A) = E�(A) [E+(A) = fn1; : : : ; n2��g [ f p0; : : : ; p2�� g,where the n's are negative integers, the p's are positive integers, and �; � 2 N.The `footprint' F (A) of such an A is a set which, despite having �nite cardinality,fully characterizes A; an easy calculation gives that c(A�) = c(F (A�)) = � andc(F (A+)) = � + 1. Notice that h(A) = h(F (A)) and c(A) = c(F (A)) hold forany representable set A; moreover, a �nite set X � Z equals F (A) for somerepresentable A if and only if X \ N 6= ; holds along with 0 62 X \ N.

The respective domains of A and B are de�ned as follows:A =Def Z0 [

�A � Z|A is representable

;

B =Def Z0 [�B � Z|B 2 A ^ jF (B)j is even

;

where Z0 = Z n f0g. The interpretation 2A of the membership relator in A isde�ned to be the relation:

a1 2A a2 $Def a2 2 Z

0 _�a2 2 A nZ0 ^ a1 2 a2 [ (A nZ0)

�;

with a1; a2 2 A. The interpretation 2B of membership in B is analogous.

Lemma 2 Consider the structures A and B. Then the following holds:

(a) A j= (W);

(b) B j= :(W).

6

Proof.

(a) The element-addition operation withA can be de�ned as follows for any pair

a1; a2 of operands in A:

a1 withA a2 =Def

�a1 if a2 2A a1,a1 [ fa2g otherwise.

In fact, when a2 2A a1 does not hold, then a1 is representable and a2 2 Z0:therefore, obviously, a1[fa2g is representable (hence it belongs to A), andits 2A-elements in Z0 are precisely its elements.

(b) To show that B is not a model of (W), consider any of the sets Bi =f�i;�i+ 1g [ fi; i + 1; i + 2g [ fi + 4; : : :g with i > 1. Clearly Bi 2 B,because F (Bi) = f�i;�i+1; i; i+1; i+2; i+4g has cardinality 6. However,Bi [ fi+ 3g =2 B; in fact, F (Bi [ fi+ 3g) = f�i;�i+ 1; ig. �

Lemma 3 Duplicator has a winning strategy in any 3-pebble-game played onthe two structures A, B.

Proof. A winning strategy for Duplicator is the following:

first move. If Spoiler plays his �rst pebble on a1 2 A (respectively, onb1 2 B), then Duplicator can respond by choosing any b1 2 B (resp.,a1 2 A) such that a1 2 Z0 $ b1 2 Z0.

second move. Suppose that Spoiler plays his second pebble on a2 2 A,then Duplicator replies by choosing b2 2 B so that a2 2 Z0 $ b2 2 Z0.Moreover,

� If a1+` 2 Z0 and a2�` 2 A n Z0 (for ` = 0 or ` = 1), then Duplicatorchooses any b2, such that a1+` 2

A a2�` $ b1+` 2B b2�`.

� If a1; a2 2 A n Z0, then consider the Venn diagram generated by a1and a2. There are exactly two regions of this diagram that have�nite cardinality. Let them be X1; X2 (with Xi ( ai for i = 1; 2).Duplicator replies by choosing an object b2. Consider the two regionsof the Venn diagram generated by b1 and b2, say Y1; Y2 (with Yi ( bifor i = 1; 2). The choice of Duplicator must satisfy the condition:Xi = ; $ Yi = ; for both i = 1; 2. It is easy to verify that such ab2 always exists.

If Spoiler plays his second pebble in B, then the strategy for Duplicatoris completely analogous.

third move. Assume that two pebbles have been played on a1; a2 2 A, andthe other two have been played on b1; b2 2 B. As before, if Spoiler playshis third pebble on a3 2 A, then Duplicator responds by choosing anyb3 2 B such that a3 2 Z0 $ b3 2 Z0. (If Spoiler plays in B, then thestrategy for Duplicator is similar.)

There are some further conditions that b3 must satisfy, depending on theobjects chosen during the previous moves:

7

� If a1; a2 2 Z0 and a3 2 A n Z0, then the following must hold: 8i 2f1; 2g (ai 2A a3 $ bi 2B b3).

� If a1+`; a3 2 Z0 and a2�` 2 A n Z0 (for ` = 0 or ` = 1), then b3 must

satisfy the following condition: a3 2A a2�` $ b3 2B b2�`.

� If a1+` 2 Z0 and a2�`; a3 2 A n Z0 (for ` = 0 or ` = 1), then b3must satisfy the following conditions: a1+` 2

A a3 $ b1+` 2B b3;

moreover, if X2�` and X3 (resp. Y2�` and Y3) are the regions of theVenn diagram generated by a2�` and a3 (resp. b2�` and b3), thenXi = ; $ Yi = ; must hold for i 2 f2� `; 3g.

� If a1; a2 2 A n Z0 and a3 2 Z0, then Duplicator chooses b3 in such away that 8i 2 f1; 2g (a3 2A ai $ b3 2B bi).

� If a1; a2; a3 2 A n Z0, then let X1; : : : ; X6 be the six regions ofthe Venn diagram generated by a1; a2; a3 that have �nite cardinal-ity. Moreover, let Y1; : : : ; Y6 be the corresponding regions gener-ated by b1; b2 and the newly chosen b3. The following must hold:8i 2 f1; : : : ; 6g (Xi = ; $ Yi = ; ).

For each one of the cases listed above, it is straightforward to verify thatDuplicator can always choose some b3 satisfying the associated condition.

The above-outlined strategy by which Duplicator can respond to the third movecan also be exploited to respond to every subsequent move of Spoiler. �

Proposition 4 The sentence (W) cannot be expressed in 3 variables.

Proof. By Lemma 3 and the main result on pebble games (see [Imm82, Hod93]),there exist two structures which model the same sentences in (at most) 3 vari-ables. Since such structures disagree on the truth value of (W), it follows thatthere is no sentence in 3 variables which is logically equivalent to (W). �

4 Inexpressibility of (E)^ (W)^ (L) in 3 vari-ables

In what follows, we will show that the conjunction (E)^ (W)^ (L) cannot bestated by means of a 3-variable sentence. In analogy with the way we havetreated (W) alone, we will construct two structures, A =

�A;2A

�and B =�

B;2B�, both satisfying (E), such that (W) and (L) are true in A and false

in B. Representable subsets of Z, together with all pertaining notation (h; F; c,etc.), will again enter into the construction of A and B.

We start by putting

A =Def

�A � Z|A is representable

;

B =Def

�X 2 A | jN \ F (X)j > c(X�)

[�N+ [ f�1g

;

8

and, preliminary to de�ning the interpretations 2A;2B of the membership re-lator in the two structures, we arbitrarily �x a bijection

g : fx � Z| jxj < @0 g �! N

such that the following two conditions are met, for all �nite sets X;Y � Z:

1) h(X) < h(Y ) implies g(X) < g(Y );

2) there are in�nitely many ` 2 N such that

g�f�`g [ (X n f0g) [ fm;m+ 1; : : : ; `g

�= 22�`�1 ;

where m = max(X [ f1g);

3) if g(X) = 22�`�1 for some ` 2 N+ , then:

�`; ` 2 X and 0 =2 X ; moreover, F�1(X) 2 B.

The construction of such a g can be carried out as follows:

g := ;; g(;) := 0; g(f0g) := 1;for ` := 1, 2, 3; : : : (ad inf.) loop

let x � Z and r 2 N be such that 2r � (2 � g(x) + 1)� 1 = `;m := max(x [ f1g);w := f�`g [ (x n f0g) [ fm;m+ 1; : : : ; `g;if jw+j 6 c(w�) then w := f�`; 1; `g; end if ;g(w) := jgj;for v � [�`; `] \Z such that v 62 dom g loop

g(v) := jgj;end loop;

end loop.

Example 5 Taking into account that the overall number of �nite sets X � Zwith h(X) < ` is 22�`�1, and that r = 1; 0; 2; 0; 1 and n = 0; 1; 0; 2; 1 are thevalues satisfying the equation ` = 2r �(2�n+1)�1 for ` = 1; 2; 3; 4; 5, one straight-forwardly �gures out that g(f�1; 1g) = 2, g(f�2; 1; 2g) = 8, g(f�3; 1; 2; 3g) =32, g(f�4;�1; 1; : : : ; 4g) = 128, g(f�5; 1; : : : ; 5g) = 512. Any of the setsf�1g, f�1; 0g, f1g, f0; 1g, and f�1; 0; 1g could be taken as g�1(3): depend-ing on whether or not �1 2 g�1(3), it will turn out either that g�1(2048) =f�6;�1; 1; : : : ; 6g or that g�1(2048) = f�6; 1; : : : ; 6g. �

Next, in terms of g, we de�ne two bijective functions

fA : A �! Zn f0g; fB : B �! Zn f0g;

which associate integer indices with representable sets. Here is fA:

fA(X) =Def min�X n

�fA(Y ) | Y 2 A ^ g(F (Y )) < g(F (X))

�;

9

and fB is de�ned in an entirely analogous way. These de�nitions clearly makesense and ensure the injectivity of fA and fB; indeed, g induces an enumerationa0; a1; a2; : : : of all representable sets via their footprints, that is, the relation �introduced below is isomorphic to the standard well-order of N:

De�nition 6 By �, we indicate the dyadic relation

a0 � a00 $Def g(F (a0)) < g(F (a00))

de�ned between elements a0; a00 of A. �

Membership is then interpreted in terms of fA in A, and in terms of fB in B:

X 2A Y i� fA(X) 2 Y ; V 2B W i� fB(V ) 2 W;

where X;Y 2 A and V;W 2 B. The veri�cation that both A and B satisfy (E)while (W) and (L) are true in A and false in B are left to the reader.2 Noticealso that X 2A X and Y 2B Y hold for all X 2 A and Y 2 B.

Example 7 On the basis of what we have observed in Example 5, we cantabulate the beginning of fA and fB as follows, representing sets a in A by theirfootprints F (a) and assuming speci�c values for the function g constructedearlier:

F (a) g(a) fA(a) fB(a) h(a)

f�1; 1g 2 �1 �1 1f1g 4 1 1 1

f�2; 1; 2g 8 �2 �2 2f�2; 2g 10 2 -- 2

f2g 11 3 2 2f�2;�1; 2g 13 4 -- 2

f�2;�1; 1; 2g 14 5 3 2f�1; 2g 20 6 -- 2

f�3; 1; 2; 3g 32 �3 �3 3f�3; 3g 33 7 -- 3

f�3; 2; 3g 35 8 4 3f3g 40 9 5 3...

......

......

f�4;�1; 1; : : : ; 4g 128 �4 �4 4...

......

......

f�5; 1; : : : ; 5g 512 �5 �5 5...

......

......

f�6;�1; 1; : : : ; 6g 2048 �6 �6 6...

......

......

2Actually, we can reuse in the present context the same counterexample to (W) describedin the proof of Lemma 2(b).

10

(Values that are printed in boldface cannot be a�ected by the choices madeduring the construction of g.)

Observe that the symmetric di�erence

fa 2 A | fA(a) < 0g 4 fb 2 B | fB(b) < 0g

equals ; and that fA(b) = fB(b) holds for any b 2 fa 2 A | fA(a) < 0g. �

Let us now prove a few simple, yet useful, facts. Our next propositionshows, among other things, that fA and fB are surjective on Znf0g (as we haveannounced before):

Lemma 8 For all ` 2 N n f0; 1; 2g, there are representable sets a; b; b0 withb; b0 2 B such that

fA(b0) = fB(b

0) = �` ; fA(a) = fB(b) = ` ;h(b0) = ` ; and h(a) = h(b) < ` :

Similar statements, with h(a) = h(b) = `, hold when ` = 2; 1.

Proof. The cases ` = 1; 2 have been examined within Example 7.For ` > 2, recall that the �nite set x � Z with h(x) = ` whose value

g(x) is smallest satis�es 0 =2 x and �` 2 x, and hence is the footprint ofa representable set; accordingly, since �` =2 y for any �nite set y � Z withh(y) < `, we have fA(F

�1(x)) = �`. Notice then that f�`; `� 1; `g = F (b0),f`g = F (b1), and f�`; ` � 2; ` � 1; `g = F (b2) hold for some b0; b1; b2 2 B,and that h(b0) = h(b1) = h(b2) = `. Therefore: fB(b0) = �` holds unlessfB(b

0) = �` holds for some b0 � b0; fB(b1) = ` holds unless fB(b) = ` holds forsome b � b1; and one gets at least three fB-images fB(bi) |one of which is �`|from the set f�`g[f`; `+1; : : :g while assigning fB-images to representable setsc with h(c) = `. �

Corollary 9 Either fA(a) = �h(a), or fA(a) > h(a) |in particular, fA(a) >h(a) if h(a) > 2| holds, for each set a 2 A. The situation with fB(b), b 2 B,is entirely analogous. �

Lemma 10 Let a; a0 2 A and b; b0 2 B. Then:

i. if a0 � a and h(a0) = h(a), then fA(a) > h(a0) > 0(note that there are only two speci�c as for which fA(a) = h(a) holds);

i0. if b0 � b, h(b0) = h(b), then fB(b) > h(b0) > 0(note that there are only two speci�c bs for which fB(b) = h(b) holds);

ii. fA(a0) > h(a) implies a0 2A a; fA(a

0) < �h(a) implies a0 =2A a;

ii0. fB(b0) > h(b) implies b0 2B b; fB(b

0) < �h(b) implies b0 =2B b.

11

Proof. The thesis i readily follows from Corollary 9, by virtue of the con-dition 3) imposed on g. That condition ensures in fact that the set x withh(x) = h(a) for which the value g(x) is smallest satis�es the equation x = F (a00)for some representable set a00, so that fA(a

00) = �h(a) and a 6= a00 becausea00 4 a0. We also have a00 2 B, whence the analogue i0 of i follows.

The theses ii and ii0 readily follow from the remark that fh(a); h(a) +1; : : :g � a and f: : : ;�h(a) � 2;�h(a) � 1g \ a = ; for every representableset a. �

The following notion will play a crucial role in the proof that A and B areindistinguishable by means of a 3-pebble game:

De�nition 11 An embedding of A into B is an injective function k : A �! Bwhich meets the conditions

a0 2A a00 $ k(a0) 2B k(a00) ;

b 2B k(a0) ^ b =2B k(a00) ! 9 a 2 A b = k(a) ;

for all a0; a00 2 A and b 2 B. �

The reader may bene�t from the following, equivalent, way of expressingthe requirements in the de�nition of embedding in terms of symmetric set-di�erence:3

�(a00) � f�(a0) | a0 2 a00g ^ �(a00) \ f�(a0) | a0 =2 a00g = ;;

�(a0)4 �(a00) = f�(a) | a 2 a0 4 a00g;

where a0; a00 2 A.We will see below that an embedding of A into B exists. Before we proceed

to verifying this, we must prove a very useful technical lemma:

Lemma 12 The well-order � satis�es the following implication for all a0; a00 2A:

a00 � a0 !�fA(a

0) > 0 $ a0 2A a00�;

i.e., a representable set a0 either belongs to every predecessor of its or to none,as dictated by the sign of fA(a

0).Likewise, for b0; b00 2 B:

b00 � b0 !�fA(b

0) > 0 $ b0 2A b00�.

Proof. Assume a00 � a0, i.e. g(F (a00)) < g(F (a0)), so that h(a00) = h(F (a00)) 6h(F (a0)) = h(a0). In case h(a00) < h(a0): if fA(a

0) < 0, then fA(a0) = �h(a0) <

�h(a00) by Corollary 9 and hence a0 =2A a00 by Lemma 10(ii); if fA(a0) > 0,

then fA(a0) > h(a0) > h(a00) and hence a0 2A a00 again by Corollary 9 and

Lemma 10(ii). In case h(a0) = h(a00), since a00 � a0 we obtain fA(a0) > h(a00) > 0

and a0 2A a00 from Lemma 10(i,ii).3When using operators (e.g. [;\) or relators (e.g. �) between elements of a given struc-

ture, we will generally mean to denote their interpretations within the given structure (e.g.[A;\A, or �B).

12

The proof of the second part of the statement proceeds analogously. �

The following pseudo-algorithm, which exploits the enumeration a0; a1; : : :of A associated with �, will guarantee the existence of an embedding from Ainto B (see Lemma 15):

k := ;;for i := 0, 1, 2; : : : (ad inf.) loop

let ai be the next element of A w.r.t. �;pick bi in B so that, for all j < i, �(aj) 6= bi and the followingconditions are met:

i. aj 2A ai $ k(aj) 2B bi,

ii. fA(ai) > 0 $ bi 2B k(aj),

iii.k(aj)4 bi = f k(a0) | a0 6= ai ^ (a0 2A aj $ a0 =2A ai) g

[ (if ai =2Aaj then fbig else ; end if) ;

k(ai) := bi;end loop.

The analysis of this procedure is carried out with the following three propo-sitions.

Lemma 13 Let b 2 B and a; a0 2 A. If fA(a0) 2 [�h(a); h(a)], then [�h(a0); h(a0)] �[�h(a); h(a)] and, moreover, a0 � a, or a = a0 and fA(a

0) = �h(a0), orfA(a

0) = h(a0) = h(a). Likewise, if fB(b) 2 [�h(a); h(a)], then [�h(b); h(b)] �[�h(a); h(a)] and, moreover, b � a, or a = b and fB(b) = �h(b), or fB(b) =h(b) = h(a).

Proof. Assume fA(a0) 2 [�h(ai); h(ai)]. Since, by Corollary 9, either fA(a

0) =�h(a0) or fA(a0) > h(a0) holds, we get [�h(a0); h(a0)] � [�h(a); h(a)]. If thisinclusion is strict, then a0 � a follows directly from the de�nition of �, also inlight of the condition 1) to which g is subject. Otherwise h(a0) = h(a) and,accordingly, a0 4 a if fA(a

0) < 0, and h(a0) 2 f1; 2g: if fA(a0) < 0 and a = a0

then fA(a0) = �h(a0), and if fA(a

0) > 0 then fA(a0) = h(a0).

The second part of the thesis is proved similarly. �

Corollary 14 Let a; a0a00 2 A. If a00 � a and a0 2A a004 a, then either a0 � a,or a0 = a and fA(a) = �h(a).

Proof. Assume that a00 � a and a0 2A a00 4 a. It easily follows from a00 � athat a00 4 a � [�h(a); h(a)] n fh(a)g. The thesis then follows by Lemma 13. �

Lemma 15 The previous procedure does not terminate and de�nes a function� which is an embedding of A in B.

Proof. First of all notice that the procedure does not terminate, since it isalways possible to determine an element bi satisfying the conditions: it will be

13

suÆcient to take

bi = f�`g [ ffB(�(am)) |m < i ^ am 2A aig [ \m<i

�(am) n ffB(�(am)) |m < i ^ am =2A aig

!;

for a suitable `.The de�nition of g guarantees, in fact, that whenever fA(ai) < 0, we can

always �nd a bi whose index is small enough as to guarantee that bi is in B.Choosing previous elements whose negative index is suÆciently small, we alsohave that whenever the index of ai is positive the corresponding bi is in B.

By choosing an index whose absolute value is suÆciently large, we can satisfyii. Corollary 14 guarantees that also iii will be true.

At this point, let us assume that a0 2A a. If a0 � a, then �(a0) 2B �(a) byi. Otherwise a � a0, and therefore fA(a

0) > 0 by the basic property of �, sincea0 2A a. From this, by ii, it follows that �(a0) 2B �(a).

From the above argument we can conclude that �(a) �B f�(a0) | a0 2A ag:

The case in which a0 =2A a is entirely symmetric and we have that �(a) \B

f�(a0) | a0 =2A ag = ;:

The last property characterizing the notion of embedding follows directlyfrom iii. �

In order to prove the impossibility to distinguish the `rich' structure A fromthe `poor' structure B by means of sentences involving only three variables, wewill again use pebble games.

We need to introduce some de�nitions characterizing a sort of partial em-bedding that will be used when we must update the embedding suggesting thestrategy to Duplicator.

De�nition 16 We will denote as �-closure of a set X, the minimum �xedpoint de�ned as: �X = �X(a; b 2 X ! a4 b � X): �

Notice that the �-closure is de�ned as a �x-point of a monotone increasingoperator. Let � X denote the set fy | (9x 2 X)(y 4 x)g. By Corollary 14 wehave that �X �� X . Moreover, it is easy to see that � X is �nite wheneverX is a �nite set.

From now on, let a (resp. b), with or without subscripts or superscripts,

indicate a generic element ofA (resp. B) and let a1; : : : ; ai = ~a and b1; : : : ; bi = ~b.

De�nition 17 We say that �f~ag and �f~bg, are isomorphic, �f~ag ' �f~bg,if there exists an 2-isomorphism from the �rst into the second sending aj to bjfor j 2 f1; : : : ; ig. �

An isomorphism between �-closures is a sort of partial embedding and thefollowing lemma proves the possibility of extending partial embeddings.

14

Lemma 18 If �f~ag ' �f~bg, then (8b)(9a)(�f~a; ag ' �f~b; bg):

Proof. Let us prove the result by induction on n =����f~b; bg n�f~bg���. Let � be

the isomorphism whose existence is guaranteed by �f~ag ' �f~bg.

n = 0: This case corresponds to the case in which b 2 �f~bg and hence the thesisis proved with a = �(b).

n = 1: In this case, for all b0 2 �f~bg, b�b0 � �f~bg. Let us de�ne a as follows:

a =�fa0 | �(a0) 2 �f~bg ^ �(a0) 2 bg [

\�f~ag

�nfa0 |�(a0) 2 �f~bg^�(a0) =2 bg:

First of all, it is easy to see that for all a0 2 �f~ag,

� a 6= a0 and

� a4 a0 � �f~ag:

From this we have that �f~a; ag n �f~ag = fag. The thesis easily follows onceveri�ed that, putting a = �(b), we have an 2-isomorphism.

n > 1: Consider a generic element b0 2 �f~b; bg n�f~bg such that b0 6= b. Sincethe �-closure is de�ned by a monotone increasing operator, we have that n0 =����f~b; b0g n�f~bg��� < n. The thesis easily follows from the inductive hypothesis.

�

The previous lemma is not symmetric, the statement with (8a)(9b), is false.

Theorem 19 The structures A and B cannot be distinguished using a 3-pebblegame.

Proof. We must prove that there exist a strategy allowing to Duplicator to wina 3-pebble game played on the rich and poor structures.

Consider the i-th round of the game and consider the �rst move (by Spoiler).Consider also an embedding �i : A �! B to be used by Duplicator as an oraclefor its strategy (let �0 be any �xed embedding).

If Spoiler puts its pebble on a0 2 A, then Duplicator will respond with theelement b0 = �i(a

0) 2 B and �i+1 remain �i. If Spoiler puts its pebble on anelement b0 = �i(a

0) 2 B, then Duplicator will respond with an element a0 2 Aand, again, �i+1 remain �i.

We are left with the case in which Spoiler puts its pebble on an elementb0 2 B such that b0 =2 �i[A]. In this hypothesis let us also suppose that two moreelements b00 = �i(a

00) and b000 = �i(a000) in B have been marked with a pebble

(the other cases are simpler). It will be convenient to observe that, by the thirdproperty of the notion of embedding, since b0 is not the image of an element inA, we can conclude that b0 =2 b1 4 b2 for any b1; b2 2 �i[A]. Hence, either b0

belongs to all the elements in the image of �i or to none of them.Given a = N+ and b = �i(a), the embedding �i guarantees that �fa; a00; a000g '

�fb; b00; b000g and hence we can apply Lemma 18 with b = b0 in order to determinethe element a0.

15

At this point, consider the set � fa; a0; a00; a000gn�fa; a0; a00; a000g. All the ele-ments in this set belong either to any or to none of the elements in �fa; a0; a00; a000gand the presence of a guarantees that all elements having positive index belongto any element in �fa; a0; a00; a000g while all those having negative index belongto none of the elements in �fa; a0; a00; a000g.

Let �0 be the order obtained putting all the elements in � fa; a0; a00; a000g n�fa; a0; a00; a000g after those in �fa; a0; a00; a000g. It can be easily veri�ed that �0

can be used in our pseudo-algorithm for the determination of a new embedding�i+1 as follows: �x �i+1 on the segment �0 fa; a0; a00; a000g(= �fa; a0; a00; a000g)to be the 2-isomorphism whose existence is guaranteed by �fb; b0; b00; b000g '�fa; a0; a00; a000g. The remaining part of the de�nition of �i+1 can be given re-launching the pseudo-algorithm from the �rst (w.r.t. �0) ah not belonging to�0 fa; a0; a00; a000g. �

5 Open issues

An issue which this paper leaves open is whether (R)^ (W)^ (L)^ (E) is |inanalogy with (N)^ (W)^ (L)^ (E)| expressible in 3 variables: showing thecontrary would call for the construction of structures A and B de�nitely morecomplicated than those we have exploited in Sec.4.

Another open issue is whether the �rst-order sentence (D) in 3 variablesinto which we have restated the conjunction (N)^ (W)^ (L) still retains, oncetranslated into the arithmetic of relations, the power of yielding (the translatedversion of) (N). If it did, then (D) would yield that � and % designate conju-gated projections. However, we conjecture that it does not: if this expectationgets con�rmed, then a strikingly simple illustration will come to light of theinequipollence, in means of proof, of �rst-order logic (involving a single dyadicrelator and no constants or logical symbols) with the arithmetic of relations.(Concerning this well-known inequipollence, cf. [TG87, p. 53�.].)

References

[Bar77] J. Barwise. On Moschovakis closure ordinals. Journal of Symbolic Logic,42:292{296, 1977.

[CS00] R. Caferra and G. Salzer, editors. Automated Deduction in Classical and

Non-Classical Logics, LNCS 1761 (LNAI). Springer-Verlag, January 2000.

[CT51] L. H. Chin and A. Tarski. Distributive and modular laws in relation algebras.University of California Publications in Mathematics, 1(9):341{384, 1951.new series.

[Daw99] A. Dawar. Finite models and �nitely many variables. Banach Center Publi-

cations, 46, 1999.

[FO00] A. Formisano and E. Omodeo. An equational re-engineering of set theories.In Caferra and Salzer [CS00], pages 175{190.

[FOT00] A. Formisano, E. G. Omodeo, and M. Temperini. Goals and benchmarks forautomated map reasoning. Journal of Symbolic Computation, 29(2), 2000.Special issue. M.-P. Bonacina and U. Furbach, eds.

16

[Hei77] J. van Heijenoort, editor. From Frege to G�odel - A source book in mathemat-

ical logic, 1879{1931. Source books in the history of the sciences. HarvardUniversity Press, 3rd printing edition, 1977.

[Hod93] I. Hodkinson. Finite variable logics. Bulletin of the European Association for

Theoretical Computer Science, 51:111{140, October 1993. Columns: Logicin Computer Science.

[IK89] N. Immerman and D. Kozen. De�nability with bounded number of boundvariables. Information and Computation, 83(2):121{139, November 1989.

[Imm82] N. Immerman. Upper and lower bounds for �rst order expressibility. Journalof Computer and System Sciences, 25(1):76{98, August 1982.

[JT48] B. J�onsson and A. Tarski. Representation problems for relation algebras.Bull. Amer. Math. Soc., 54:80,1192, 1948.

[KV96] P. G. Kolaitis and M. Y. Vardi. On the expressive power of variable-con�nedlogics. In Proceedings, 11th Annual IEEE Symposium on Logic in Computer

Science, pages 348{359, New Brunswick, New Jersey, 1996. IEEE ComputerSociety Press.

[Kwa81] M. K. Kwatinetz. Problems of expressibility in �nite languages. PhD thesis,University of California, Berkeley, 1981.

[OP95] E. G. Omodeo and A. Policriti. Solvable set/hyperset contexts: I. Somedecision procedures for the pure, �nite case. Comm. Pure Appl. Math., 48(9-10):1123{1155, 1995. Special issue in honor of J.T. Schwartz.

[Tar41] A. Tarski. On the calculus of relations. Journal of Symbolic Logic, 6(3):73{89, 1941.

[TG87] A. Tarski and S. Givant. A formalization of Set Theory without variables, vol-ume 41 of Colloquium Publications. American Mathematical Society, 1987.

[Zer08] E. Zermelo. Untersuchungen �uber die Grundlagen der Mengenlehre I. InHeijenoort [Hei77], pages 199{215. (English translation).

17

Games with Second-Order Quanti�ers

which Decide

Propositional Program Logics

N.V. Shilov �

Research On Program Analysis System (ROPAS)Department of Computer Science

Korean Advanced Institute of Science and Technology (KAIST)shilov@ropas.kaist.ac.kr

June 11, 2001

Abstract

The paper demonstrates how second-order quanti�cation and �nitegames can be exploited for deciding complicated propositional programlogics like the propositional �-Calculus with converse (�C�). This ap-proach yields a new proof that �C� is in EXPTIME.

Automata-theoretic technique is a very powerful and popular approach fordeciding complicated propositional program logics [19, 20, 3]. The �rst pa-per [19] has studied elementary decidability of Propositional Dynamic Logicof looping and converse (�PDL�). The next paper [20] has established ele-mentary decidability and �nite model property for the propositional �-Calculus(�C). The last paper [3] has proved exponential decidability for this logic. Re-cently (in 1998) this approach yielded exponential decidability for the propo-sitional �-Calculus with program converse (�C�) [21] { a logic which amalga-mates �PDL� and �C. Basically, the automata-theoretic approach comprisestwo stages: �rst, a reduction of the decidability problem for a particular logic tothe emptiness problem for a particular class of automata, and then applicationof a direct decision procedure for this emptiness problem.

Close relations between automata and games have been studied in [7]. Onthis base, indirect automata-free decision procedures for propositional program

�While on leave from A.P. Ershov Institute of Informatics Systems of Siberian Division ofRussian Academy of Science, Novosibirsk, Russia

1

logics can be extracted from the automata-theoretic decision procedures. In con-trast, we would like to suggest a direct alternative to this roundabout approachfor a particular logic of this kind �C�. The suggested approach includes:

� second-order quanti�cation for eliminating �xpoints, non-determinism,propositional connectives and box-modalities;

� special �nite game interpretation for generalized halting assertions (i.e.,quanti�ed assertions about halting of programs)

� model checking as a decision procedure for existence of winning strategiesin these special �nite games.

It yields in EXPTIME-complexity for �C�. We would like to refer the sug-gested approach as Program Schemata Technique (PST) due to reasons de-scribed below.

In general PST is based on a reduction of the decidability of a propositionalprogram logic to the validity problem of a variant of the Second Order Propo-sitional Dynamic Logic of owcharts (SOPDL) in a class of Herbrand models.SOPDL is a variant of Propositional Dynamic Logic (PDL) [4] with second orderquanti�ers (weak as well as strong) and non-deterministic monadic owcharts(or program schemata). Standard Herbrand models are models of the Second-order logic of several (n) monadic Successors (S(n)S) [10], i.e., free semi-groupsgenerated from program symbols.

In particular we consider SOPDL with converse (SOPDL�) and Herbrandmodels with converse, i.e., free groups generated from program symbols. Wedemonstrate that the validity problem in Herbrand models with converse fortest-free formulae of SOPDL� is in EXPTIME. This is based on a polyno-mial reduction of the problem to the same problem but for sentences in thespecial form of quanti�ed halting assertions for owcharts where every path isconsistent with some model. The last problem can be interpreted as a prob-lem of a winning strategy in a �nite game with some fairness constraints. Thisgame-theoretic problem can be solved by means of model checking a special �Cformula FAIRWIN in the corresponding �nite model.

The syntax and semantics of �C� and SOPDL� are presented in the section1. A game-theoretic framework is de�ned in the section 2. A game-theoretic in-terpretation for quanti�ed halting assertions is sketched in the section 3. Resultson the decidability and expressive power of �C, �C�, SOPDL, and SOPDL�

are presented in the section 4. Some concluding remarks are also presented inthe last section 5.

2

1 Two Program Logics: �C� and SOPDL�

The syntax of �C is constructed from boolean values B and �nite alphabets ofprogram symbols A and propositional variables P as follows:

F�C ::= B j P j (:F�C) j (F�C ^ F�C) j (F�C _ F�C) j

j ([A]F�C) j (hAiF�C)| {z }modalities

j (�P :F�C) j (�P :F�C)| {z }�xpoints

(�xpoints are applicable to formulae without instances of a bounded variablein range of an odd number of negations). The semantics of �C is de�ned inmodels, which are called Kripke structures or transition systems. In modelsprogram symbols are interpreted as binary relations and propositional variables- as unary predicates. Formally speaking, a model M is a pair (DM ; IM ) wherethe domain DM is a nonempty set, and the interpretation IM is the disjointunion of mappings PM : P ! 2DM and RM : A ! 2(DM�DM ). Elements of thedomain DM are called states. Let us de�ne a set M(formula) of states of amodel M = (DM ; IM ) where a formula is valid in the model:

� M(true) = DM , M(false) = ;, M(p) = IM (p)for boolean values and propositional variables;

� M(:�) = DM nM(�),M(� ^ ) = M(�) \M( ) and M(� _ ) = M(�) [M( );

� M(hai�) = fs : (s; s0) 2 IM (a) and s0 2M(�) for some s0 2 DMg,M([a]�) = fs : (s; s0) 2 IM (a) implies s0 2M(�) for every s0 2 DMg;

� M(�p:�) =TfS � DM :MS=p(�) = Sg,

M(�p:�) =SfS � DM :MS=p(�) = Sg,

where MS=p agrees with M almost everywhere but IMS=p(p) = S.

Let us de�ne the propositional �-Calculus with converse (�C�) as an extensionof �C by converse of program symbols with the following syntax and semantics:

30. M(ha�i�) = fs : (s0; s) 2 IM (a) and s0 2M(�) for some s0 2 DMg,M([a�]�) = fs : (s0; s) 2 IM (a) implies s0 2M(�) for every s0 2 DMg.

Converse in this setting is reasoning about the past.The syntax of SOPDL is constructed from the same alphabets as the syntax

of �C. It consists of program schemata and formulae.Schemata S. In brief, program schemata are nondeterministic owcharts witha �xed single program variable (which can be omitted), program symbols in-stead of monadic function symbols in assignments and boolean combinations ofpropositional variables instead of predicate symbols in conditions. A detailedde�nition follows. Let us use the Natural numbers extended by1 as labels. The

3

label 0 is call the start-label while the label 1 - the exit-label. An assignmentis an expression l : a goto L, where l is a label, a is a program symbol and L isa �nite set of labels1. A test is an expression l : if A then L+ else L�, wherel is a label, A is a boolean formula2 and L+, L� are �nite sets of labels1. A(program) scheme is a �nite set of assignments and tests.Formulae FSO. The syntax of SOPDL formulae is very similar to the syntax of�C formulae, but it uses program schemata instead of program symbols, strongand weak quanti�ers instead of �xpoints, additional reachability modalities:

FSO ::= B j P j (:FSO) j (FSO ^FSO) j (FSO _FSO) j ([S]FSO) j (hSiFSO) j

j (9P :FSO) j (8P :FSO)| {z }strong quanti�ers

j (9fP :FSO) j (8fP :FSO)| {z }

weak quanti�ers

j (2FSO) j (3FSO)| {z }reachability modalities

The semantics of SOPDL is de�ned in the same models as semantics of �Cbut this time we would like to represent models as labeled directed graphs withstates as nodes marked by interpreted propositional variables and interpretedprogram symbols as edges. The semantics of program schemata in models areinput-output binary relations on states which can be de�ned in di�erent butequivalent manners [6, 8, 9]: for every model M and every scheme � semanticsM(�) is a binary relation on states (please refer appendix A.1 for a formalde�nition in a structured-operational style). Semantics of formulae in modelsare validity sets: for every model M and for every formula � semanticsM(�) isa set of states where the formula is valid in the model (please refer appendix A.2for a formal de�nition). Elementary formulae and propositional operations havethe usual semantics. For a program scheme � the semantics of the associatedmodalities [�] and h�i is the same as for usual K-modalities but with respectto the input-output semantics of �. Modalities 2=3 are the \in every/somereachable state". The semantics of quanti�ers is straightforward from theirnames - \for every/some interpretation of a propositional variable as a (�nite)set of states".

Let us de�ne SOPDL with converse (SOPDL�) as an extension of SOPDLby converse of program symbols in assignments. A converse assignment is anexpression l : a � goto L, where l is a label, a is a program symbol and L isa �nite set of labels. Semantics of converse is the inverse of binary relations:

IM (a�) =�IM (a)

��for every program symbol in every model. Converse in

this setting is backward computations. (Please refer appendix A.1 for a formalde�nition.)

1The empty set ; (abort) is admissible also.2i.e. a propositional combination of B and P

4

2 Finite Games with Fairness Constraints

A �nite game of two players A and B is a tuple (P; MA; MB; F ) where Pis a nonempty �nite set of positions, MA;MB � (P n F ) � P are moves of Aand B, F � P is a set of �nal positions. A session of the game is a sequenceof positions s0; :::sn; ::: where all even pairs are moves of one player whileall odd pairs are moves of another player (ex., all (s2i; s2i+1) 2 MA while all(s2i+1; s2i+2) 2MB). A player loses a session i� after a move of the player thesession enters a �nal position. A player wins a session i� another player loses thesession. A strategy of a player is a subset of the player's possible moves. Every�nite games (P;MA;MB ; F ) is a �nite model. The following formula WIN

� win:�:final ^ hmoveAi

�:final ^ [moveB ](final _ win)

��

is valid in those positions of (P;MA;MB ; F ) where the player A has a winingstrategy against the counterpart B [13, 14].

A fairness constraint for a �nite game (P;MA;MB ; F ) is a property of posi-tions, i.e. it holds in some positions and does not hold in others. A �nite gamewith fairness constraints is a tuple (P;MA;MB; F; C) where (P;MA;MB ; F ) isa �nite game, while C is a �nite set of fairness constraints. Fairness constrainsprohibit sessions where some constraint holds in�nitely often: a session meetsthe constraints C i� every constraint in C holds �nitely often only in the ses-sion. In contrast, fairness conditions prohibit sessions where some conditionholds �nitely often only.

It is possible (just similar to model checking of fair executions in [1]) to trans-form the above formulae WIN to another formula FAIRWIN which is validin those positions of (P;MA;MB ; F ) where the player A has a wining strategyagainst the counterpart B for sessions which meets the fairness constraints C.Formula FAIRWIN can be constructed as follows.

Let FAIR(_C) be a formula

�q:�([moveA]q ^ [moveB ]q) ^ �r:

�(_C) _ ([moveA]r ^ [moveB ]r)

��;

F INAL be a formula final_FAIR(_C), and FAIRWIN be another formula

� win:�:FINAL ^ hmoveAi

�:FINAL ^ [moveB ](FINAL _ win)

��:

Then

� FAIR is valid in those positions of (P;MA;MB; F ) where every in�nitesession is fair with respect to _C;

� FAIRWIN is valid in those positions of (P;MA;MB; F ) where the playerA has a wining strategy in sessions which satis�es the constraints C.

5

(Please see [15] for a proof.)Complexity of checking of a �xed formula of �C in a �nite model is poly-

nomial of an overall size of the model, since complexity of model checkingis an exponential functions where the power depends of a formula only (ex.,Faster Model Checking Algorithm [2]). Hence complexity of checking the for-mula FAIRWIN in a model (P;MA;MB; F ) is polynomial of an overall size ofthe model.

The following Traveling Couple Puzzle illustrates games with fairness con-straints.

� A Country consists of major cities and small towns connectedby an one way road network. Every road has either scenic views, or(exclusive) a shopping center. Some towns have either a historic site,or (exclusive) a movie theater. All other towns have a police station,or (exclusive) tra�c jams. A family couple is traveling around theCountry, Husband would like to reach the Capital, while Wife hasnot any desired destination. Every time when they are in a city,they discuss their further road preferences in turns:

1. Wife de�nes roads after historic sites,

2. Husband de�nes roads after police stations,

3. Wife de�nes roads after movies theaters,

4. Husband de�nes roads after tra�c jams.

Then the couple moves through the road network in accordance withtheir preferences until they reach a city again. Husband and wifeare free in their preferences but they can select roads with shoppingcenters after visiting towns with movie theaters or police stations�nite times at most. Problem: From what cities the couple caneventually reach the Capital while carry out all their preferencesalong a trip?

This puzzle can be presented as a �nite game between Husband and Wife withas a single fairness constraint as follows: the couple is visiting a shopping centerlocated on a road from a town with a (movie theater)/(police station).

3 Deciding Halting Assertions

We need three auxiliary notions: free schemata, generalized halting assertions

and Herbrand models. A scheme is said to be free i� every path in the schemeis consistent with some model and there is no aborts in the scheme (i.e. goto ;,then ; or else ;). A (generalized) halting assertion is a formula

�(Q p)�(h�itrue)

�

6

where (Q p)� is a quanti�er pre�x and � is a program scheme with simple tests(i.e. where all test conditions are propositional variables or their negations).

Herbrand models have �xed domain DH and �xed interpretation RH ofprogram symbols, while interpretation P of propositional variables is variable.A de�nition of Herbrand models without converse is quite simple [12]. Thedomain DH in this case is A� { a free semi-group generated by A, i.e. a setof words A� which can be presented as an in�nite tree. The interpretation RH

in this case of a program symbol a is a total function RH(a) : DH ! DH

such that w 7! aw for every w 2 A�. In particular, Herbrand models withoutconverse are models for Rabin's Second Order Logics of Monadic SuccessorsS(n)S [10]. In the presence of the converse the de�nition of Herbrand models is

more complicated. The domain DH in this case is (A� [A)�=A� { a free group

generated by A, i.e. a free semi-group (A� [ A)� factored by equivalenceA�

generated by equalities aa� = a�a = � for all a 2 A. For every w 2 (A� [ A)�

let us denote the equivalence class w=A� as bweA. Let " be the unity element

b�eA of (A� [A)�=A�. The interpretation RH in this case of a program symbol

a is a total function RH(a) : DH ! DH such that bweA 7! baweA for everyw 2 (A� [ A)�.

Theorem 1 The validity problem in Herbrand models with converse for gener-

alized halting assertions with free schemata is in EXPTIME.

Sketch of proof. We would like to to reduce the validity problem for gener-alized halting assertions with free schemata in Herbrand models with converseto a problem of a winning strategy in a special �nite game with fairness con-straints. This game-theoretic problem can be solved by model checking of �Cformula FAIRWIN in the corresponding model. A general case is discussedin the appendix B. Here we would like to explain how to reduce to the Trav-eling Couple Puzzle a validity problem in Herbrand models with converse for ageneralized halting assertion 8 h c: 9f p s: 8f m t: 9 t j:

�h�itrue

�with a free

scheme � and propositional variables h c, p s, m t, and t j.Let us remark that, when a propositional variable is tested for its boolean

value for every next time during an execution of a free schemata in a Herbrandmodel with converse, it is always tested in a new state (i.e. a state where thisvariable was not tested yet) since every path in a free scheme is consistent withsome model. Hence after every next assignment during an execution of a freescheme in Herbrand models with converse we can to select arbitrary booleanvalue for a testing propositional variable. Thus we can adopt in the scheme �

� the exit label 1 as the Capital,

� all assignments as major cities,

� all tests with condition h c as towns with a historic sites,

7

� all tests with condition p s as towns with a police station,

� all tests with condition m t as towns with a movie theater,

� all tests with condition t j as towns with a tra�c jam,

� all then alternatives as roads with shopping centers,

� all else alternatives as roads with scenic views.

In these settings �nite interpretations for m t and p s correspond to �nite se-lections of shopping centers located on roads from towns with movie theaters orpolice stations. Thus a validity in Herbrand models with converse of the asser-tion 8 h c: 9f p s: 8f m t: 9 t j:

�h�itrue

�can be checked by model checking

the formula FAIRWIN in the corresponding �nite game. 2

4 Expressive Power and Decidability

Theorem 2 The diagram below depicts all expressibilities between listed logics:

�C < SOPDL

^ k�C� < SOPDL�

All listed expressibilities have linear complexity and are test-free.

Sketch of proof. First, �C< �C� since �C� formula (ha�ip) is not expressiblein �C. Next, proofs for �C < SOPDL and �C� < SOPDL� are identical:�xpoints are expressible in terms of second-order quanti�cation as

(�p: (p))$ (8p:(2( (p)! p)! p)) and (�p: (p))$ (9p:(2(p! (p)) ^ p));

but a formula (8p:(haip$ hbip)) is not expressible in terms of �xpoints. Finally,SOPDL� = SOPDL since all program schemata in formulae can decomposedwith aid of �xpoints into singletons, which consist of a single assignment, con-verse assignment, or a test, these the �xpoints can be eliminated as above, andthe converse can be eliminated in accordance with the following equivalences:

(ha�i )$ 8p:(2( ! [a]p)! p) and ([a�] )$ 9p:(2(haip! ) ^ p):

2

Exponential upper and low bounds for PDL [8] are well-known. It triviallyimplies the same low bound for �C while the upper bound is exponential also[12, 3]. Unfortunately SOPDL is undecidable [12]. Hence

Theorem 3 SOPDL and SOPDL� are undecidable.

8

The situation for SOPDL� changes in Herbrand models with converse. It isknown [11] that the �-Calculus in Herbrand models is as expressive as S(n)S. Itimplies that �C and SOPDL have the same expressive power in Herbrand modelswithout converse. It is known also, that �C and SOPDL both are decidable inHerbrand models without converse [12] with exponential upper bound.

Theorem 4 Test-free formulae of SOPDL� in Herbrand models with converse

are equivalent to generalized halting assertions with free schemata which can be

constructed in linear time.

Sketch of proof. A general case is discussed in the Appendix C. Belowwe explain how to construct an equivalent (modulo Herbrand models with con-verse) generalized halting assertions with free schemata for a particular test-freeSOPDL� formula (a PDL-like notation is in use):

8h: (hf�; gih _ [f�; g]:hl

8h: (hf�; gihh?itrue _ [f�; g] h:h?itrue)l

8h: (9fp: (hwhile p do f ; gihh?itrue) _ 8fm: (hwhile m do f ; gih:h?itrue))l

8h: (9fp: (hwhile p do f ; g ;h?itrue) _ 8fm: (hwhile m do f ; g ;:h?itrue))l

8h: 9fp: 8f m: 9 t:hif t then (while p do f ; g;h?) else (while m do f ; g;:h?)itrue

where p, m and t are new propositional variables and A? stays for a programscheme f(0 : if A then f1g else f1g) ; (1 : a goto f1g)g. 2

As a consequence of theorems 2, 4 and 1 we get the following

Theorem 5 �C and �C� are in EXPTIME.

Sketch of proof. First let us remark that the decidability problem for �C�

can be reduced to the validity problem for �C� in total models (where all actionsymbols are interpreted as binary relations which are de�ned in all states) withaid of new propositional variables (to simulate partial binary relations).

The validity problem for �C� in total models can be to the validity problemfor �C� in Herbrand models with converse as follows. For every program symbola let fa and ga be new program symbols. Let us substitute schemata (f�a ; ga)and (g�a ; (f

�a )�) instead of a and a� in formulae. For example, if a formula

is (haih _ [a]:h) then it results in (hf�a ; gaih _ [f�a ; ga]:h). Then a formulais satis�able in total models i� after this substitution the resulting formula issatis�able Herbrand models with converse. This fact can be proved similarly tothe corresponding property for �C [12] and is closely related to a so-called treemodel property [21, 5].

9

In accordance with the theorems 2, �C� formulae are equivalent to some test-free SOPDL� formulae. Then (in accordance with the theorems 4) the decid-ability problem for these test-free SOPDL� formulae in Herbrand models withconverse is equivalent to the validity problem in these models for some general-ized halting assertions with free schemata. The last problem is in EXPTIME(in accordance with the theorems 1).

Let us consider the following example. As we discussed above, a formula(haih _ [a]:h) is valid in all total models i� (hf�a ; gaih _ [f

�a ; ga]:h) is valid in

all Herbrand models with converse. Then (hf�a ; gaih _ [f�a ; ga]:h) is valid in all

Herbrand models with converse i� 8 h: (hf�a ; gaih_[f�a ; ga]:h) is. Let us skip sub-

scripts for simplicity. Then the last formula becomes a formula 8h: (hf�; gih _[f�; g]:h in the sketch of proof of the theorem 4, and it is equivalent in Her-brand models with converse to a generalized halting assertion 8h: 9fp: 8f m: 9 t:(hif t then (while p do f ; g;h?) else (while m do f ; g;:h?)itrue). This par-ticular halting assertion has the form 8 h c: 9f p s: 8f m t: 9 t j:

�h�itrue

�from sketch of proof of the theorem 1. Hence the validity problem in Herbrandmodels with converse for this generalized halting assertion can be interpretedas a particular instance of the Traveling Couple Puzzle and solved. 2

5 Conclusion

Close connections between model checking �C and games were studied in [16, 17,18]. In particular, [16] de�ned in�nite model checking games and established anequivalence of local model checking to an existence of a winning strategy. Then[17] de�ned �nite �xed point games and characterized indistinguishability ofstates by means of formulae with bounded amounts of modalities and �xpointsin terms of winning strategies with bounded amounts of moves. The last citedpaper [18] exploited model-checking games for practical e�cient local modelchecking. In addition [17] de�ned a second order propositional modal logic 2M ,corresponding games and established indistinguishability of states by meansof formulae with bounded amounts of modalities and quanti�ers in terms ofwinning strategies with bounded amounts of moves. Roughly speaking, 2M isa fragment of SOPDL without weak second order quanti�ers. So it is possibleto summarize that [16, 17, 18] exploit in�nite games for model checking �Cformulae. In contrast, this paper presents how model checking �nite games candecide �C�. Several natural algorithmic problems remain for further research.First is decidability of SOPDL� in Herbrand models with converse. Anotherproblem is axiomatization of the �C�. In this context we would like to remarkthat axiomatization of �C was an open problem during 10 years and it wassolved by I. Walukiewicz in 1993 only [22, 23] on base of theory of in�nitegames and automata on in�nite trees.

10

References

[1] Clarke E.M., Grumberg O., Peled D. Model Checking. MIT Press, 1999.

[2] Cleaveland R., Klain M., Ste�en B. Faster Model-Checking for Mu-Calculus.

Lecture Notes in Computer Science, v.663, 1993, p.410-422.

[3] Emerson E.A., Jutla C.S. The Complexity of Tree Automata and Logics of

Programs. SIAM J. Comput., v.29, n1, 1999, p.132-158.

[4] Fisher M.J. Ladner R.E. Propositional dynamic logic of regular programs. J.Comput. System Sci., v.18, n.2, 1979, p.194- 211.

[5] Gr�adel E. Why are modal logics so robustly decidable? The Bulletin of theEATCS, 68(1999), 90-103.

[6] Greibach S.A. Theory of Program Structures: Schemes, Semantics, Veri�-

cation. Lecture Notes Computer Science, v. 36, 1975.

[7] Gurevich Yu., Harrington L. Trees, automata and games. Journal of theACM, 1982.

[8] Harel D. Dynamic Logic. Handbook of Philosophical Logic, v.II, Reidel Pub-lishing Company, 1984 (1-st ed.), Kluwer Academic Publishers, 1994 (2-nded.), p.497-604.

[9] Harel D., Sherman R. Propositional Dynamic Logic of Flowcharts. Informa-tion and Control, v.64, 1985, p.119-135.

[10] Rabin M.O. Decidability of second order theories and automata on in�nite

trees. Trans. Amer. Math. Soc., v.141, 1969, p.1-35.

[11] Schlinglo� H. On expressive power of Modal Logic on Trees. Lecture Notesin Computer Science, v.620, 1992, p.441-450.

[12] Shilov N.V. Program schemata vs. automata for decidability of program

logics. Theoretical Computer Science, v.175, n.1, 1997, p.15-27

[13] Shilov N.V. and Yi K. Program Logics Made Easy. Korea Advanced In-stitute of Science & Technology, ROPAS Technical Memo No. 2000-7,http://ropas.kaist.ac.kr/lib/doc/ShYi00.ps.gz.

[14] Shilov N.V. and Yi K. Puzzles for Learning Model Checking, Model Check-

ing for Programming Puzzles, Puzzles for Testing Model Checkers. ElectronicNotes in Theoretical Computer Science, v.43, 2001 (to appear).

[15] Shilov N.V. and Yi K.Model Checking Puzzles in �-Calculus. Joint Bulletinof the Novosibirsk Computing Center and A.P.Ershov Institute of Informat-ics Systems, n. 13, 2001 (to appear).

11

[16] Stirling C. Local Model Checking Games. Lecture Notes in Computer Sci-ence, v.962, 1995, p.1-11.

[17] Stirling C. Games and Modal Mu-Calculus. Lecture Notes in ComputerScience, v.1055, 1996, p.298-312.

[18] Steven P., Stirling C. Practical Model Checking Using Games. LectureNotes in Computer Science, v.1384, 1998, p.85-101.

[19] Streett R.S Propositional dynamic logic of looping and converse is elemen-

tary decidable. Information and Control, v.54, n.1-2, 1982, p.121-141.

[20] Streett R.S. Emerson E.A. An Automata Theoretic Decision Procedure for

the Propositional Mu-Calculus. Information and Computation, v.81, n.3,1989, p.249-264.

[21] Vardi M.Y. Reasoning about the past with two-way automata'. LectureNotes in Computer Science, v.1443, 1998, p.628-641.

[22] Walukiewicz I. On completeness of the �-calculus. IEEE Computer SocietyPress, Proc. of 8-th Ann. IEEE Symposium on Logic in Computer Science,1993, p.136-146.

[23] Walukiewicz I. Completeness of Kozen's Axiomatization of the Proposi-

tional �-Calculus. Inform. and Comp., v. 157, n 3, 2000, 142-182.

Appendices

A SOPDL semantics

A.1 Semantics of program schemata

s < (�; 0) >M s0

(s; s0) 2M(�) s < (�;1) >M s

(l : a goto L) 2 � ; l0 2 L ; (s; s0) 2 IM (a) ; s0 < (�; l0) >M s00

s < (�; l) >M s00

(l : a� goto L) 2 � ; l0 2 L ; (s0; s) 2 IM (a) ; s0 < (�; l0) >M s00

s < (�; l) >M s00

(l : if A then L+ else L�) 2 � ; l0 2 L+ ; s j=M A ; s < (�; l0) >M s00

s < (�; l) >M s00

(l : if A then L+ else L�) 2 � ; l0 2 L� ; s j=M (:A) ; s < (�; l0) >M s00

s < (�; l) >M s00

12

A.2 Semantics of formulae

� M(true) = DM , M(false) = ;, M(p) = IM (p)for boolean values and propositional variables;

� M(:�) = DM nM(�),M(� ^ ) = M(�) \M( ) and M(� _ ) = M(�) [M( );

� M(h�i�) = fs : (s; s0) 2M(�) and s0 2M(�) for some s0 2 DMg,M([�]�) = fs : (s; s0) 2M(�) implies s0 2M(�) for every s0 2 DMg;

� M(3�) = fs : s0 2M(�) for some s0 2 CM (s)g,M(2�) = fs : s0 2M(�) for every s0 2 CM (s)g,where CM (s) is in the weakly connected component of s in in M ,presented as an oriented graph

�DM ;

Sa2A IM (a)

�;

� M(8(f)p:�) =T

(finite) S�DMMS=p(�),

M(9(f)p:�) =S

(finite) S�DMMS=p(�),

where MS=p agrees with M almost everywhere but IMS=p(p) = S.

B Proof of Theorem 1

Let us choose and �x a halting assertion Q1p1:::Qnpn(h�itrue) where Q1, ...Qn are quanti�ers, p1, ... pn are di�erent propositional variables and � is a freescheme. Without loss of generality we can suppose that� the start-label 0 marks an assignment in �,� each label marks the unique operator in �,� all propositional variables occurring in � are in p1, ... pn,� n � 0 is an even number,� all quanti�ers with odd numbers are either 8 or 8f ,� all quanti�ers with even numbers are either 9 or 9f .

Let us denote by SP a set of all labels l which are either 1 or which markassignments in �. For all labels l1, l2 2 L and boolean values v1, ... vn let uswrite l1

v1:::vn; l2 i� there exists a path through tests only which is consistent

with these values. Let us also extend the set of boolean values B by tow values? and > and denote this extended set by B0.

Let us de�ne a �nite game with fairness constraints (P;MA;MB; F; C) forthe generalized halting assertion �xed above. Let P be SP � B0. For all l 2 SP ,1 � k < n, boolean values v1,... vk and v let

(l; v1; :::vk; ?; :::?| {z }(n�k)�times

) �! (l; v1; :::vk; v; ?; :::?| {z }(n�k+1)�times

)

be an admissible move for both players A and B. For all l1; l2 2 SP and booleanvalues v1,... vn let

(l1; v1; :::vn) �! (l2;>; :::>)

13

be an admissible move for the player A i� l1v1:::vn; l2. For all l 2 SP let

(l;>; :::>) �! (l;?; :::?)

be an admissible move for the player B. Let F consists of the unique �-nal position (1;?; :::?) while the fairness constraints C be (val(p) = true)for all propositional variables p bounded by weak quanti�ers 8f or 9f . Thegame is over. Its overall size is exponential of the size of the initial assertionQ1p1:::Qnpn(h�itrue).

Let us remark that in Herbrand models with converse when a propositionalvariable is tested for its boolean value for every next time during an executionof a free schemata, it is always tested in a new state (i.e. a state where thisvariable was not tested yet). Hence the player A has a winning strategies inthe position (0;?; :::?) for sessions which satis�es the fairness constraints i� theinitial generalized halting assertion is valid in Herbrand models with converse.Model checking the formula FAIRWIN in the model (P; MA; MB; F ) solves thevalidity problem for Q1p1:::Qnpn(h�itrue) in Herbrand models with converse.We have to remark that an overall size of the above game with fairness constraintis linear in size of a scheme and exponential in size of quanti�er pre�x. Hencemodel checking the formula FAIRWIN is exponential of size of the generalizedhalting assertion. 2

C Proof of Theorem 4

Construction is similar to a corresponding proof for SOPDL in Herbrand mod-els without converse [12], but this time we would like to use another schemeuni for simulation of reachability modalities: it should be a test-free scheme,which visits every element of the Herbrand Domain with converse only once.It comprises two stages: preprocessing and while loop. Let us introduce sometechnical notations. Elementary owcharts are the following schemata:

� (a) � f0 : a goto f1gg and (a�) � f0 : a� goto f1gg,

� (A?) � f(0 : if A then f1g else f1g) ; (1 : a goto f1g)g,

where a is an program symbol, while A is a boolean formula. Let (�;�) and(if A then alpha else �) stay for the sequential composition and for the deter-ministic choice of schemata �, � and boolean formula A (Fig. 1). Let us remarkalso that elementary schemata are free, sequential composition of free schematawith disjoint sets of propositional variable is a free as well as deterministic choicebetween free schemata by means of a new propositional variable.Preprocessing.

� Elimination of complex conditions. For all formulae � and , for a newpropositional variable q the formula � is equivalent to the formula 9q:(2(q $ ) ^ �(q= )).

14

composition

!�!�! , A%&

choice

��&%

Figure 1: Structured operations

� Normalization i.e. �ltration of negation up to propositional variables in ac-cordance with the traditional modal logic equivalences:

(:(:�)) $ �,(:(� ^ ))$ ((:�) _ (: )),(:(h�i�)) $ ([�](:�)),(:(3�))$ (2(:�)),(:(8(f)p:�))$ (9(f)p:(:�)).

� Converse elimination. In accordance with the proof for the expressibility ofSOPDL� in SOPDL in the theorem 2: equivalence (ha�i ) $ 8p:(2( ![a]p)! p) holds for every formula .� Elimination of reachability modalities. Equivalence of formulae 2�, 3� andformulae ([uni]�), (hunii�) holds for every formula � and a scheme uni whichvisits every element of the Herbrand domain with converse. We are especiallyinterested in a scheme uni which visits every element only once: this schemeevery time after an assignment a 2 A can pass control nondeterministically toany assignment except a� and vice versa, every time after an assignment a� itcan pass control nondeterministically to any assignment except a. An exampleof uni for A consisting of two program symbols f and g is presented on �g. 2.

1 1- %,!� f ! g -�

" - % "j 0 j# . & #

,!� g� ! f� -�

. &1 1

Figure 2: Program uni for A = ff; gg

� Initiation. Every elementary subformula p or :p is equivalent to a haltingassertion < (p?) > true and < ((:p)?) > true respectively.Loop while the formula is not a generalized halting assertion:� Elimination of propositional operations _ and ^. For all disjoint quanti-

15

�er pre�xes3 (Q0p0)� and (Q00p00)�, for all program schemata � (disjoint3 with(Q00p00)�) and � (disjoint3 with (Q0p0)�) the following formulae are equivalent inHerbrand models with converse:

(((Q0p0)�h�itrue) _ ((Q00p00)�h�itrue)) and(Q0p0)�(Q00p00)�9q:(hif q then � else �itrue),

(((Q0p0)�h�itrue) ^ ((Q00p00)�h�itrue)) and(Q0p0)�(Q00p00)�8q:(hif q then � else �itrue),

where q is a new propositional variable.� Elimination of nesting modalities. For every scheme � let deP (�) be a deter-ministic scheme which simulates non-deterministic goto , then and else of � bydeterministic tests with respect to values of a vector of new propositional vari-ables P and pass control to a new emergency label e in the case when all newvariables are falsi�ed. For example, the non-deterministic goto in the assign-ment l : a goto fl1 ; l2g is simulated by a fragment presented on �g. 3 where p1and p2 are new propositional variables P , e is the emergency label. Then for allquanti�er pre�x (Qp)� and program schemata � and � the following formulaeare equivalent in Herbrand models with converse:

(h�i((Qp)�h�itrue)) and (9P: (Qp)� (hdeP (�) ; �e�loopitrue)),([�]((Qp)�h�itrue)) and (8fP: (Qp)� (hdeP (�) ; �e�haltitrue)),

where �e�loop � (� [ f(e : goto feg)g) is an extension of � which loops inemergency, and �e�halt � (� [f(e : goto finftyg)g) is an extension of � whichhalts in emergency.

l : a �! p1��! p2

��! e

# + # +l1 l2

Figure 3: Fragment dep1p2(l : a goto fl1 ; l2g)

Reduction is over. Let us remark that it always terminates since each iterationof the loop decreases amount of propositional operations and nesting modali-ties. Let us also remark that if an initial SOPDL� formula is test-free then allschemata in it are free as well as all imposed determinations deP (uni). Hence ap-plications of sequential composition and deterministic choice to these schematalead to free schemata again. 2

3i.e. without common propositional variables

16