arxiv: v1 [cs.lo] 13 Nov 2018

Transcription

1 Losing Connection: Modal Logic of Definable Link Deletion Dazhu Li Department of Philosophy, Tsinghua University, Beijing, China arxiv: v1 [cs.lo] 13 Nov 2018 Abstract. We consider a natural variant of Sabotage Game. Different to the action of Blocker in a sabotage game, links are cut in a local, definable and uniform way, where local is used as usual; definable means that links are cut based on some considerations on the properties of the nodes in the graph; and uniform shows that it is permitted to cut more links than one in each round. As what we will see, this variant can model some interesting scenarios in everyday life. After this, a suitable modal logic is presented to characterize the game. First, we provide some preliminaries for it, including syntax, semantics and some validities. Next, we describe the standard translation and its correctness. Then, an appropriate notion of bisimulation is proposed for the logic introduced. Afterwards, we show a characterization theorem for the logic as a fragment of first-order logic that is invariant for the bisimulation, and investigate its expressive power. Further more, we prove that the logic is also a fragment of some hybrid logics, and provide some considerations on the recursion axioms. Finally, we show that the logic lacks the tree model property and the finite model property, and that the satisfiability problem for it is undecidable. Keywords: Modal Logic, Dynamic Logic, Link Deletion, Undecidability 1 Introduction Consider a common scenario in everyday life: A is driving, and whenever she meets an intersection on the road, her navigation system E will show which direction to take. From the perspective of game theory, agents A and E can be treated as two players who work together to solve a graph reachability problem: in each round, E chooses some links from A s position in the graph, then A moves along one of those links to another node with E; and their winning conditions are same, i.e., A arrives at some goal node. The game described above may remind the reader of the sabotage game. During a single round of a sabotage game, as noted by [7], one player Traveler tries to move from one node to another fixed goal node; while, before the action of Traveler, the other player Blocker cuts one link from the graph to prevent Traveler. Further more, we can also treat the action of E in a sabotage pattern, i.e., considering his action as cutting all other links connected to A s position except the chosen ones. Even so, there are still some substantial differences between these two kinds of games. For example, in terms of the way to cut links, they are different at least in the following three aspects: (a). Local versus global. Player E always moves together with A, i.e., the links which are cut are connected to A s position; while, Blocker can remove a link from any position of the graph. (b). Definable versus arbitrary. The action of E is based on some considerations on properties of the nodes in the graph, say, E will direct A to bypass the next intersection if it is congested; however, Blocker does not take into account any properties of the nodes. (c). Uniform versus stepwise. In each round, player E may cut more links than one; but Blocker cut exactly one link. By these observations, we can see that the game at the outset is a local, definable and uniform version of the sabotage game. For brevity, we call it definable sabotage game, denoted with S d G. Besides, to make it non-trivial, we stipulate that E cuts at least one link in each round. Now let us consider an example.

2 Example 1. In the following graph, players A and E try to arrive at the goal node g from i. For simplicity, only two properties smooth and congested are involved. s i u t v g When the shape circle stands for smooth and square stands for congested, they have a winning strategy. For instance, E begins by cutting the link {i,v} and they move to s; next, in the second round, E cuts both {s,v} and{s,u}, then they move to t; finally, they can arrive at g after E cuts{t,u}. However, they will not be so lucky if we exchange the notations of the properties. The reader can check that, in this situation, they will get stuck at node v after the action of E in the fourth round. It is worthy to note that, when there are various of properties in a given graph, it is not necessary for E to consider the same property in different rounds of the game. With S d G, we can also model some other phenomena in our daily life, e.g. the scenarios involving dropping some particular friends in a social network. In the rest of this paper, we will investigate S d G from a modal perspective. To match the game, we propose a logic named as definable sabotage modal logic which is denoted by S d ML. Outline of the paper. In Section 2, we provide some preliminaries, including the syntax and semantics of S d ML (Section 2.1), and some validities (Section 2.2). In Section 3, we describe the first-order translation for S d ML and check its correctness. Then, in Section 4, we propose a suitable notion of bisimulation for S d ML, and investigate some model theories. In Section 5, we present a characterization theorem for S d ML as a fragment of first-order logic that is invariant for the bisimulation, and investigate its expressive power. In Section 6, we show that S d ML is also a fragment of some hybrid logics (Section 6.1), and provide considerations on the recursion axioms (Section 6.2). Further more, in Section 7, we prove that S d ML lacks the tree model property and the finite model property, and that the satisfiability problem for S d ML is undecidable. In Section 8, we discuss some related work. Finally, we make a conclusion for the article in Section 9. 2 Preliminaries In this section, we introduce the syntax and semantics of S d ML. After that, to understand the new device, we explore some validities. 2.1 Syntax and Semantics As mentioned above, the definable sabotage modal logic S d ML is intended to match S d G. Therefore, its language should be expressive enough to model the actions of the players. For player A, it is natural to think of the standard modality, which characterizes the transition from a node to its successors (see [11]). However, to characterize the way of deleting links in S d G, some dynamic operator is indispensable. The language L d of S d ML is a straightforward extension of the standard modal language L. Except the modality, it also includes a dynamic operator[ ]. The formal definition is as follows: Definition 1 (Syntax). Let P be a countable set of propositional atoms. The formulas of L d are defined by the following grammar in Backus-Naur Form: L d ϕ ::= p ϕ ϕ ϕ ϕ [ ϕ]ϕ 2

3 where p P. Besides, we define the notions,,, and as usual. In particular, for any L d -formulas ϕ and ψ, ϕ ψ is defined as [ ϕ] ψ, i.e., is the dual operator of[ ]. In the rest of the article, we will use the notions of modal depth md(ϕ) and sabotage depth sd(ϕ) of formulas ϕ L d. These two measures are inductively defined in the following way: md(p)=0 md( ϕ) = md(ϕ) md(ϕ ψ)=max{md(ϕ),md(ψ)} md( ϕ)=md(ϕ)+1 sd(p)=0 sd( ϕ) = sd(ϕ) sd(ϕ ψ)=max{sd(ϕ),sd(ψ)} sd( ϕ)=sd(ϕ) md([ ψ]ϕ) = md(ϕ) sd([ ψ]ϕ) = sd(ϕ) + 1 The operator[ ] is our device to model the way of deleting links in S d G. This will be clarified by the semantics of S d ML. Formulas of L d are evaluated in standard relational models M = W,R,V, where W is the domain, a non-empty set of states, nodes or points; R W 2 is the set of accessibility relations or links between points; and V : P 2 W is the valuation function. For each point w W, we call M,w a pointed model. For brevity, we usually write M,w instead of M,w. For any w,v R, we also write w,v M. Besides, we use R(w) to denote the set {v W w,v R} of successors of w. We now introduce the semantics, which is defined inductively by truth conditions. Definition 2 (Semantics). Given a pointed model M,w and a formula ϕ of L d, we say that ϕ is true in M at w, written as M,wϕ, when M,w p w V(p) M,w ϕ M,w ϕ M,wϕ ψ M,wϕ and M,wψ M,w ϕ f or each v Wsuch that Rwv,M,vϕ M,w[ ϕ]ψ M w,ϕ,wψ where M w,ϕ = W,R\({w} V(ϕ) R(w)),V = W,R\({w} V(ϕ)),V is obtained by deleting all links from w to the nodes that are ϕ. We say that ϕ is satisfiable if there exists some pointed model M,w such that M,wϕ. By Definition 2, the truth conditions for Boolean and modal connectives,, are as usual; M,w[ ϕ]ψ means that after deleting all accessibility relations from w to the nodes that are ϕ, ψ is true at w. Intuitively, operator[ ]is a model update function; the formula ϕ occurring in[ ] stands for a property of some successors of the current point; [ ϕ] is exactly an action of player E in S d G. Recall the game in Example 1. Assume that the propositional atoms p and q refer to the properties smooth (circle) and congested (square) respectively. Then we are able to express the facts of the game with the formulas of L d. Say, that after player E deletes the links from s to the congested points, i.e., u and v, A can move to some smooth node, i.e., i or t, with E can be expressed as that s is [ q] p. Based on Definition 2, S d ML is indeed an appropriate logic to analyze S d G. Before the next step, we introduce some notions. For any two pointed models M 1,w and M 2,v, we say that they are ϕ-sabotage-related (notation, M 1,w M ϕ 2,v ) if and only if M 2,v is M 1 w,ϕ,w ; that they are definable sabotage modally equivalent (notation, M 1,w d M 2,v ) if and only if for each ϕ L d, M 1,w ϕ M 2,v ϕ. Further more, we use the set T d (M,w) = {ϕ L d M,w ϕ} of L d -formulas to denote the theory of w in M. 3

4 2.2 Exploring Validities To demonstrate how the new device [ ] works, we now explore some interesting validities of S d ML. For example, both the following two formulas are valid: [ ϕ]ψ ϕ ψ (1) [ ϕ](ϕ 1 ϕ 2 ) ([ ϕ]ϕ 1 [ ϕ]ϕ 2 ) (2) Their validity follows from the semantics directly. Formula (1) shows that the operator [ ] is self-dual. By formula (2), we can distribute [ ] over an implication. Here it is not hard to check that the validity of (1) and (2) is closed under substitution. Interestingly, this is not a common feature of S d ML. Consider the following formula: [ ]ϕ ϕ (3) Since that no point can be, the operator[ ] changes nothing in a model. Consequently, formula(3) is valid. However, its general schema[ ψ]ϕ ϕ may not be true when we substitute some other formula for. For instance, in formula[ p] p p, p is satisfiable, while[ p] p entails a contradiction. When (3) tells us that replacing some formula in [ ] with other formulas may destroy validity, the following formulas illustrate that we should also be very careful when substituting some formulas for the formula outside[ ]. [ ϕ]p p (4) [ p] q ( p q) (5) [ ϕ 1 ][ ϕ 2 ]p [ ϕ 2 ][ ϕ 1 ]p (6) [ ϕ 1 ][ ϕ 2 ]p [ ϕ 2 ]p (7) Formula (4) illustrates that operator[ ] does not change the truth value of propositional atoms; formula (5) allows us to reduce a formula including[ ] to an L -formula; by (6), the order of different operators[ ] can be interchanged in some cases; and (7) enables us to decrease the sabotage depth of some particular L d -formulas directly. Actually each propositional atom occurring in formulas (4)-(7) can be replaced by any Boolean formula without affecting their validity. However, these schematic validities fail in general when we consider the deletions for complex properties. We only show this phenomenon for principle (6), using the following concrete example: Example 2. Consider the general schematic form [ ϕ 1 ][ ϕ 2 ]ϕ [ ϕ 2 ][ ϕ 1 ]ϕ for the principle (6). Let ϕ 1 := p, ϕ 2 := p, and ϕ := q. Define a model M as follows: w v 1p v 2 q By inspection, one sees that M,w[ p][ p] q and that M,w [ p][ p] q. Therefore the formula[ p][ p] q [ p][ p] q is not true at w in M. 3 Standard Translation for S d ML Obviously the truth conditions for S d ML are first-order, so there must be some recursive first-order translation like for the standard modal logic. However, we already know from sabotage modal logic SML, which 4

5 is used to analyze the sabotage game, that additional arguments may be needed in the recursion: for SML, that extra argument was a finite set of links (see [3]). Interestingly, finding the translation here requires even more delicate analysis of the extra argument. In this section, we describe the translation for S d ML and its correctness. To do so, our method is to introduce a new device, being a sequence consisting of ordered pairs, e.g. v,ϕ, to denote the occurrences of [ ] in a formula, where v is some point, and ϕ is some property of its successors. Let L 1 be the first-order language consisting of countable unary predicates P i N, a binary relation R, and. The details are as follows. Definition 3 (Standard Translation for S d ML). Let x be a designated variable, and O be a finite sequence v 0,ψ 0 ;...; v i,ψ i ;...; v n,ψ n (0i n). Each ψ 0in is a formula of L d, and each v 0in is a point. Then the translation STx O : L d L 1 is defined recursively as follows: ST O x (p)=px ST O x ( )=x x ST O x ( ϕ)= ST O x (ϕ) ST O x (ϕ 1 ϕ 2 )=ST O x (ϕ 1 ) ST O x (ϕ 2 ) STx O ( ϕ)= y(rxy (x v 0 ST y x, (ψ 0 )) (x v i+1 ST v 0,ψ 0 ;...; v i,ψ i y (ψ i+1 )) STy O (ϕ)) 0 i n 1 ST O x ([ ϕ 1]ϕ 2 )=ST O; x,ϕ 1 x (ϕ 2 ) The key inductive clauses in Definition 3 concern the -formulas and [ ]-formulas. Formula ϕ is translated as a first-order formula stating that the current point x has a successor y which is ϕ, and that this accessibility relation is not deleted by the operator [ ] indexed in the sequence O. The first-order translation for[ ϕ 1 ]ϕ 2 says that the translation of ϕ 2 is carried out with respect to the sequence O; x,ϕ 1, and that this translation is realized at the current point x. By this definition, for any formulas ϕ and ψ, the translations of ϕ ψ and[ ϕ]ψ are equivalent. According to Definition 3, the index sequence O may become longer and longer, but it is always finite. For each formula ϕ of L d, ST x x, (ϕ) yields a first-order formula with only x free. Now we use an example to illustrate the translation. Example 3. Consider the formula [ p 1 ] [ p 2 ] p 3. The procedure of the translation for it runs in the following way: ST x, x ([ p 1 ] [ p 2 ] p 3 )=ST x, ; x,p 1 x ( [ p 2 ] p 3 ) = y(rxy (x x ST x, y ST x, ; x,p 1 y ([ p 2 ] p 3 )) = y(rxy (x x ST x, y ST x, ; x,p 1 ; y, p 2 y ( p 3 )) = y(rxy (x x ST x, y z(ryz (x y ST x, z ( )) (x x ST x, (p 1 )) ( )) (x x ST x, (p 1 )) ( )) (x x ST x, (p 1 )) ( )) (x y ST x, (p 1 )) (y y ST x, ; x,p 1 z ( p 2 )) ST x, ; x,p 1 ; y, p 2 z (p 3 ))) = y(rxy (x x ST x, y ( )) (x x ST x, (p 1 )) y y y z y 5

6 z(ryz (x y ST z x, ( )) (x y ST z x, (p 1 )) (y y z (Rzz (x z ST x, z ( )) (x z ST x, z (p 1 ) ST x, ; x,p 1 z (p 2 )) ST x, ; x,p 1 ; y, p 2 z (p 3 ))) The first-order formula in Example 3 is much complicated. It can be considered as a small case illustrating that S d ML is succinct notation for a complex part of first-order logic, just similar to SML. Actually the first-order formula above is equivalent to y(rxy P 1 y z(ryz (x y P 1 z) z (Rzz (x z P 1 z P 2 z ) P 3 z))), which states that after deleting all links from the current point x to the P 1 -points, we can still reach to some y such that after deleting all links from y to the points which have P 2 -successors in the new model, each successor of y is P 3. In order to check the result, we now prove the correctness of Definition 3. Theorem 1 (Correctness of the Standard Translation). Let M,w be a pointed model and ϕ be a formula of L d, then: M,wϕ M ST x x, (ϕ)[w] Proof. It can be proven by making an induction on the structure of ϕ. The cases for Boolean and modal connectives are straightforward. When ϕ is[ ϕ 1 ]ϕ 2, the following equivalences hold: M,w[ ϕ 1 ]ϕ 2 there exists M s.t. M,w ϕ 1 M,w and M,wϕ 2 there exists M s.t. M,w ϕ 1 M,w and M ST x, (ϕ 2 )[w] M ST x, ; x,ϕ 1 x (ϕ 2 )[w] M ST x x, (ϕ)[w] The first equivalence follows from the semantics directly; by the inductive hypothesis, the second one holds; the last two equivalences hold by Definition 3. Remark 1. This first-order translation for S d ML is contrasted with that for sabotage modal logic. To translate the latter one, it suffices to maintain a finite set of ordered pairs of nodes encoding the links already deleted (cf.[3]). However we are unable to show the links deleted by operator[ ] with a first-order formula in the same way, since the number of links cut by the operator may be infinite. Further more, Example 2 shows that we should also take care of the order of [ ] in a formula, which is very different from that of sabotage modal logic. Our finite sequence of ordered pairs of nodes and properties solves these problems and yields a translation for S d ML. x 4 Bisimulation for S d ML In this section, we introduce a notion of bisimulation for S d ML. After that, we investigate the relation between the bisimulation and definable sabotage modal equivalence in S d ML. After extending the standard modal language L with the operator [ ], actually the formulas of L d are not invariant under the standard bisimulation any longer (cf. [11]). We use the following example to illustrate this. Example 4. Consider models M 1 and M 2 which are defined respectively as follows: 6

7 Z p w 1 w 2 p v 1 p Z w 3 q v 2 q By the definition of the standard bisimulation, it holds that M 1,w 1 Z M 2,v 1, M 1,w 2 Z M 2,v 1 and M 1,w 3 Z M 2,v 2. However, we have M 1,w 1 [ q] q and M 2,v 1 [ q] q. Therefore bisimulation does not imply definable sabotage modal equivalence any longer. On this account, to capture the first-order fragment resulting from the standard translation, we introduce a new notion of definable sabotage bisimulation (d-bisimulation) between models. It is defined as follows: Definition 4 (d-bisimulation). Let M 1 = W 1,R 1,V 1 and M 2 = W 2,R 2,V 2 be two models. A relation Z d is a d-bisimulation between M 1,w and M 2,v (notation, Z d : M 1,w d M 2,v ) if the following five conditions are satisfied: Atom: If M 1,w Z d M 2,v, then M 1,w p if and only if M 2,v p, for each p P. Zig : If M 1,w Z d M 2,v and there exists w W 1 such that R 1 ww, then there exists v W 2 such that R 2 vv and M 1,w Z d M 2,v. Zag : If M 1,w Z d M 2,v and there exists v W 2 such that R 2 vv, then there exists w W 1 such that R 1 ww and M 1,w Z d M 2,v. Zig [ ] : For each ϕ L d, if M 1,w Z d M 2,v and there exists M 1 such that M 1,w ϕ M 1,w, then there exists M 2 such that M 2,v M ϕ 2,v and M 1,w Z d M 2,v. Zag [ ] : For each ϕ L d, if M 1,w Z d M 2,v and there exists M 2 such that M 2,v ϕ M 2,v, then there exists M 1 such that M 1,w M ϕ 1,w and M 1,w Z d M 2,v. For brevity, we write M 1,w d M 2,v if there is a d-bisimulation Z d such that M 1,w Z d M 2,v. We can find that d-bisimulation extends the standard bisimulation with the back and forth conditions for operator[ ]. In this notion, the conditions for are as usual, and they do not change the model but change the evaluation point along the accessibility relation; while the conditions for[ ]keep the evaluation point fixed but remove some links from the model. According to Definition 4, we know that the pointed models M 1,w 1 and M 2,v 1 in Example 4 are not d-bisimilar. Further more, the following result shows that the notion of d-bisimulation is suitable: Proposition 1 ( d d ). For any pointed models M 1,w and M 2,v, if M 1,w d M 2,v, then M 1,w d M 2,v. Proof. It can be proven by making an induction on the structure of ϕ. (1). ϕ P. By Definition 4, it holds that M 1,wϕ if and only if M 2,vϕ directly. (2). ϕ is ψ. By the inductive hypothesis, it holds that M 1,w ψ if and only if M 2,v ψ. Consequently, we know that M 1,wϕ if and only if M 2,vϕ. (3). ϕ is ϕ 1 ϕ 2. By the inductive hypothesis, for each i {1,2}, we have that M 1,wϕ i if and only if M 2,vϕ i. Thus it holds that M 1,wϕ if and only if M 2,vϕ. (4). ϕ is ψ. If M 1,wϕ, then there exists w 1 W 1 such that R 1 ww 1 and M 1,w 1 ψ. By Zig, there exists v 1 W 2 such that R 2 vv 1 and M 1,w 1 is d-bisimilar to M 2,v 1. By the inductive hypothesis, it holds that M 1,w 1 ψ if and only if M 2,v 1 ψ. It is followed by M 2,v 1 ψ directly. Consequently, we know that M 2,vϕ. Similarly, we are able to conclude M 1,wϕ from M 2,vϕ by Zag. Z 7

8 (5). ϕ is[ ϕ 1 ]ϕ 2. If M 1,wϕ, then there exists M 1 such that M 1,w ϕ 1 M 1,w and M 1,w ϕ 2. By Zig [ ], there exists M 2 such that M 2,v ϕ 1 M 2,v and M 1,w is d-bisimilar to M 2,v. By the inductive hypothesis, M 1,wϕ 2 if and only if M 2,vϕ 2. It implies that M 2,vϕ. Similarly, by Zag [ ], we can get M 1,wϕ from M 2,vϕ. Just like the case of sabotage modal logic, the converse of Proposition 1 can be proven under the assumption that models at issue are ω-saturation (cf. [3]). For each finite set Y, we denote the expansion of L 1 with a set Y of constants with L Y 1, and denote the expansion of M to L Y 1 with M Y. Definition 5 (ω-saturation). A model M = W,R,V is ω-saturated if, for every Y W such that Y <ω, the expansion M Y realizes every set Γ(x) of L Y 1 -formulas whose finite subset Γ (x) Γ(x) are all realized in M Y. Not all models are ω-saturated, but every model can be extended to an ω-saturated model with the same first-order theory (see [13]). The extension is got by taking an ultrapower of the initial model with a special kind of untrafilter. From Definition 3, we know that each model of L d has an ω-saturated extension with the same theory of L d. Based on Definition 5, we have the following result: Proposition 2 ( d d ). For any two ω-saturated pointed models M 1,w and M 2,v, if M 1,w d M 2,v, then M 1,w d M 2,v. Proof. We prove this result by showing that the relation d itself satisfies the definition of d-bisimulation. (1). For each p P, the definition of d implies that M 1,w p if and only if M 2,v p directly. This satisfies the condition of Atom. (2). Suppose that there exists w 1 W 1 such that R 1 ww 1. We show that there exists v 1 W 2 such that R 2 vv 1 and that M 1,w 1 d M 2,v 1. For each finite subset Γ oft d (M 1,w 1 ), the following equivalences hold: M 1,w Γ M 2,v Γ M 2 ST x x, ( Γ)[v] M 2 y(rxy ST y x, ( Γ))[v] Therefore every finite subset Γ of T d (M 1,w 1 ) is satisfiable in the set of successors of v. By Definition 5, there exists v 1 W 2 such that R 2 vv 1 and that T d (M 1,w 1 ) is true at v 1. Thus, M 1,w 1 d M 2,v 1. The proof of Zig clause is completed. (3). Similar to (2), it can be shown that the condition of Zag is satisfied. (4). Assume that there exist M 1,w and ϕ L d such that M 1,w M ϕ 1,w. We prove the Zig [ ] clause by showing that there exists M 2 such that M 2,v M ϕ 2,v and that M 1,w d M 2,v. For each finite subset Γ oft d (M 1,w), the following equivalences hold: M 1,w[ ϕ] Γ M 2,v[ ϕ] Γ M 2 ST x x, ([ ϕ] Γ)[v] M 2 ST x x, ; x,ϕ ( Γ)[v] Hence each finite subset of T d (M 1,w) is true at M 2,v, where M 2,v ϕ M 2,v. By Definition 5, T d (M 1,w) is true at M 2,v. It is followed by M 1,w d M 2,v. (5). Similar to (4), it can be proven that the condition of Zag [ ] is satisfied. Thus, pointed models M 1,w and M 2,v are d-bisimilar. The proof is completed. 8

9 5 Characterization of S d ML Based on the notion of d-bisimulation, we can show that S d ML can be characterized as the one-free-variable fragment of first-order logic that is invariant for d-bisimulation, where a first-order formula α(x) is invariant for d-bisimulation means that for all pointed models M 1,w 1 and M 2,w 2 such that M 1,w 1 d M 2,w 2, it holds that M 1 α(x)[w 1 ] if and only if M 2 α(x)[w 2 ]. The details are as follows: Theorem 2 (Characterization of S d ML by d-bisimulation Invariance). An L 1 -formula is equivalent to the translation of an L d -formula if and only if it is invariant for d-bisimulation. Proof. The direction from left to right holds by Proposition 1 directly. For the converse direction, let α be an L 1 -formula with one free variable x. Assume that α is invariant for d-bisimulation. Now we consider the following set: C d (α)={st x, x The result follows from the following two claims: (ϕ) ϕ L d and α ST x, x (ϕ)}. (i). IfC d (α)α, then α is equivalent to the translation of an L d -formula. (ii). It holds that C d (α)α, i.e., for any pointed model M,w, M C d (α)[w] entails that M α[w]. We show (i) first. Suppose that C d (α) α. From the compactness and deduction theorems of firstorder logic, it holds that Γ α for some finite subset Γ ofc d (α). The converse can be shown by the definition ofc d (α) : α Γ. Thus it holds that α Γ proving the claim. As to the claim (ii), let M,w be a pointed model such that M C d (α)[w]. Consider the set Σ = ST x x, (T d (M,w)) {α}. We now show that: (a). The set Σ is consistent; (b). M α[w], thus proving claim (ii). Suppose that Σ is not consistent. By the compactness of first-order logic, it follows that α Γ for some finite subset Γ of Σ. But then, by the definition of C d (α), we get that Γ C d (α), which is followed by Γ ST x x, (T d (M,w)). However, it contradicts to Γ ST x x, (T d (M,w)). Now we show (b). Since Σ is consistent, it can be realized by some pointed model, say, M,w. Note that both the pointed models have same theories, thus M,w d M,w. Now take two ω-saturated elementary extensions M ω,w and M ω,w of M,w and M,w respectively. It can be shown that such extensions always exist (see [13]). By the invariance of first-order logic under elementary extensions, from M α[w ] we know that M ω α[w ]. Further more, by the assumption that formula α is invariant for d-bisimulation and Proposition 2, we conclude that M ω α[w]. By the elementary extension, we know that M α[w], which entails the claim (ii). Consequently, the proof is completed. In particular, just as with SML, the crucial model-theoretic argument involving saturation needs special care, but now with new modifications matching the above format of our translation. Given a first-order property, we now are already able to show whether it belongs to the fragment identified by Theorem 2. Here we use some examples to compare S d ML with SML. As noted by [3], SML can define the length of a cycle. That is to say, for each positive natural number n, there exists a SML formula ϕ such that, for any M = W,R,V and w W, M,wϕ if and only if W,R is a cycle of length n. However, this result does not hold in S d ML. Fact 1 S d ML cannot define the length of a cycle. 9

10 Proof. We prove it by an example. Consider two models M 1 and M 2 which are defined respectively as follows: w 1 v w 2 As what we can observe, the underlying frame of M 1 is a cycle of length 2, while the frame of M 2 is a cycle of length 1. By Definition 4, it holds that M 1,w 1 d M 2,v and M 1,w 2 d M 2,v (the d-bisimulation runs via the dashed lines). Therefore the first-order property is not invariant under d-bisimulation. Then, by Theorem 2, S d ML cannot define the length of a cycle. Further more, the literature [3] illustrates that sabotage modal logic can also count successors, i.e., the first-order property there exist n successors of the current point is definable in it. While the following result states that S d ML cannot define this property either: Fact 2 S d ML cannot count the successors of the current point. Proof. In order to prove it, we construct two models which are d-bisimilar: w 1 w w 2 v 7 v 1 The d-bisimulation runs through the dashed lines. The property there exist 2 successors is true at point w, but it fails at v. Intuitively, these differences between S d ML and SML stem from the features of [ ] and the standard sabotage modality. In sabotage modal logic, each occurrence of modality in a formula deletes exactly one link. While, in S d ML, contrary to the stepwise way, [ ] operates uniformly, which blocks our logic to define the first-order properties above. However, Fact 1 and 2 do not entail that S d ML is less expressive than SML with respect to models. Actually, the notion of bisimulation for sabotage modal logic is not an extension of d-bisimulation. When tackling with the cases involving infinite, operator[ ]may show more strength. Here we consider an example. Example 5. We establish a model in the following way: w v 0 v 1... v n... As what we can see, node w has countable successors. By the truth condition for [ ], formula [ ] is true at w in M, which means that all links starting from w are cut by the operator [ ]. However there is no such a formula ϕ of SML that can do this: each occurrence of cuts one link, but the number of occurring in a formula is always finite. Immediately, by Fact 1-2 and Example 5, we have the following result: Fact 3 Regarding expressive power on models, S d ML and SML are not comparable. 10

11 6 From S d ML to Hybrid Logic While an effective first-order translation shows that validity in our modal logic is effectively axiomatizable, it gives no concrete information about a more modal complete set of proof principles. In this section, we provide some considerations on the recursion axioms for S d ML. The recursion axioms for Boolean cases are as usual. However, as for [ ϕ] ψ, there is a problem. Consider the typical method of recursion axioms used in dynamic-epistemic logic, where dynamic operators can be pushed inside through standard modalities. It fails for S d ML, since that after pushing [ ] under a standard modality over successors of the current world, the model change is not local in the successors any longer and it takes place somewhere else (cf.[3]). Hence the principle for [ ϕ] ψ should illustrate the position where the change happens. To do so, it is natural to seek help from hybrid logics, which enable us to name nodes in a model. Consider the hybrid logic with nominals, at and down-arrow operator, which is denoted by H ( ). With its formulas of the form x yϕ, we can manipulate links by naming pairs of points (see [1]). 6.1 A Hybrid Translation for S d ML As a warm-up, we begin with presenting a translation from S d ML to H ( ). Similar to the standard translation defined in Definition 3, a finite sequence O of ordered pairs of variables of nominals and properties, e.g. x,ϕ, is used to denote the occurrences of[ ]in an L d -formula. Here is the formal definition: Definition 6 (The Hybrid Translation for S d ML). Let O be a finite sequence of pairs of variables of nominals and properties, denoted with x 0,ψ 0 ; x 1,ψ 1 ;...; x i,ψ i ;...; x n,ψ n (0 i n). The translation T O : L d H ( ) is recursively defined as follows: T O (p) = p T O ( ) = T O ( ϕ) = T O (ϕ) T O (ϕ 1 ϕ 2 ) = T O (ϕ 1 ) T O (ϕ 2 ) T O ( ϕ) = x ( (@ x x 0 T x0, (ψ 0 )) (@ x s i+1 T x 0,ψ 0 ;...; x i,ψ i (ψ i+1 )) T O (ϕ)) 0in 1 T O ([ ψ]ϕ) = xt O; x,ψ (ϕ) As we know, the truth of a H ( )-formula in some model may depend on the valuation of nominals occurring in it. However, by Definition 6, for each ϕ L d, T x, (ϕ) yields a H ( )-formula with no free variables of nominals. For brevity, in the following of the article, we will leave out the assignment of values to variables in models of H ( ) if there is no ambiguity. Now we show the correctness of Definition 6: Theorem 3 (Correctness of the Hybrid Translation). Let M,w be a pointed model and ϕ be a formula of L d, then M,wϕ M,wT x, (ϕ). Proof. The proof is by induction on the structure of ϕ. The Boolean cases are straightforward, and we only show the non-trivial cases. (1). When ϕ is ψ, the following equivalences hold: M,wϕ there exists v W s.t. Rwv and M,vψ there exists v W s.t. Rwv and M,vT x, (ψ) M,w T x, (ψ) 11

12 M,w x ( (@ x x T x, ( )) T x, (ψ)) M,wT x, (ϕ) The first equivalence holds by the semantics of L d ; the second one follows from the inductive hypothesis; the third and fourth equivalences follow by the semantics of H ( ); and the last one holds by Definition 6. (2). When ϕ is[ ϕ 1 ]ϕ 2, we have the following equivalences: M,w[ ϕ 1 ]ϕ 2 there exists M s.t. M,w ϕ 1 M,w and M,wϕ 2 there exists M s.t. M,w ϕ 1 M,w and M,w T x, (ϕ 2 ) M,w T x, ; x,ϕ 1 (ϕ 2 ) M,w T x, (ϕ) The first equivalence is based on the semantics of L d ; the second one holds by the inductive hypothesis; and the last two equivalences follow by Definition 6. Therefore, for each ϕ L d, it always holds that M,w ϕ if and only if M,w T x, (ϕ). So we conclude that Definition 6 is correct. 6.2 Considerations on Recursion Axioms Now we proceed to consider the recursion axioms. As what we mentioned, the Boolean cases are straightforward. They are as follows: Fact 4 Let ϕ, ψ and χ be formulas of L d, and p P. Then the following equivalences hold: [ ϕ]p p (8) [ ϕ] ψ [ ϕ]ψ (9) [ ϕ](ψ χ) [ ϕ]ψ [ ϕ]χ (10) The validity of (8)-(10) follows from the semantics of L d directly. Before considering the case for, we show the case for[ ] first. 1 Recall the validity (7), which enables us to decrease sd(ψ) in some special formulas[ ϕ]ψ. But it is too weak to meet our requirement. Anyway this is not an intractable problem for us. Fact 5 Let [ ϕ][ ψ]χ be a formula of L d, then the following equivalence is valid: where x and y are new nominal variables. [ ϕ][ ψ]χ x[ x [ ϕ]@ y ψ)]χ (11) Proof. We prove it by showing that M w,ϕ w,ψ and M w, [ ϕ]@ y ψ) are same, where w V(x). Suppose not, then there exists v W such that w,v M w,ϕ w,ψ while w,v M w, [ ϕ]@ y ψ), or that w,v M w, [ ϕ]@ y ψ) while w,v M w,ϕ w,ψ. Now consider the first case. By w,v M w, [ ϕ]@ y ψ), it holds that x [ ϕ]@ y ψ where v V(y). By w,v M w,ϕ w,ψ, we have that M w,ϕ,v ψ. Since M w,ϕ w,ψ is a submodel of M w,ϕ, it holds that w,v M w,ϕ. Consequently, we know that M,v ϕ, which entails that M w,ϕ,vψ. Now there exists a contradiction. When it is the second case. By w,v M w, [ ϕ]@ y ψ), it holds that M,v x [ ϕ]@ y ψ where v V(y). Then we know that w,v M w,ϕ. Further more, by w,v M w,ϕ w,ψ, it holds that M w,ϕ,v ψ which entails a contradiction. 1 Actually, the principle for[ ]is not necessary to show a complete set of recursion axioms for S d ML, cf. [7]. 12

13 Some operators of H ( ) occur in (11). Based on Definition 6, we know that it is equivalent with some formula of H ( ). Consider formula x[ x [ ϕ]@ y ψ)]χ. By the semantics, it is true at a pointed model M,w means that w is χ in the new model M w, [ ϕ]@ y ψ), where V(x)={w}. Intuitively, the new model is obtained by removing the links from w to the points which are ϕ, and to the points which are ψ after removing all links from w to the ϕ-points. This is exactly what[ ϕ][ ψ]χ states. Now we move to the case for. What is required is a H ( )-formula which provides us a way to push operator[ ] to the successor of the current point. It seems like that the following result will work: Fact 6 For each[ ϕ] ψ L d, the following equivalence holds: where x and y are new nominal variables. [ ϕ] ψ x y( x [ ϕ]@ y ψ) (12) Proof. Let M,w be a pointed model. For the direction from left to right, we suppose that M,w[ ϕ] ψ and M,w x y( x [ ϕ]@ y ψ). Then we know that w ( V(x)) has a successor v ( V(y)) such that M,v x [ ϕ]@ y ψ. From M,w[ ϕ] ψ, it follows that M w,ϕ,w ψ. Since M,v ϕ, w,v is remained in M w,ϕ. Thus it holds that M w,ϕ,vψ. Besides, M,v x [ ϕ]@ y ψ entails that M,w[ ϕ]@ y ψ. Consequently, it holds that M w,ϕ,v ψ, which entails a contradiction. For the converse direction, we assume that M,w x y( x [ ϕ]@ y ψ) and M,w [ ϕ] ψ. By the semantics of S d ML, there exists v W such that w,v R\({w} V(ϕ)) and M w,ϕ,v ψ. Consider the case where w and v are named as x and y respectively. It holds that M y ψ. Consequently, we know that M w,ϕ,w@ x [ ϕ]@ y ψ. Further more, w,v R\({w} V(ϕ)) implies that w,v R and M,v ϕ. Thus we conclude that M,w x y( x [ ϕ]@ y ψ). In (12), formula x y( x [ ϕ]@ y ψ) is true at M,w says that for each v M, if v R(w) and v is not ϕ, then v is ψ after deleting all links from w to the ϕ-points. It expresses the meaning of formula [ ϕ] ψ. However, it is not the final solution to, since it still needs some extra formulas to tackle with the formulas of the form[ ϕ]@ y ψ. Consider the following result. Fact 7 For any propositional atom p, L d -formulas ϕ, ψ and χ, and nominal variables x, y and z, the following equivalences hold: [ ϕ]@ x x p (13) [ ϕ]@ x ψ [ ϕ]@ x ψ (14) [ ϕ]@ x (ψ χ) [ ϕ]@ x ψ [ ϕ]@ x χ (15) [ ϕ]@ x ψ y@ x z( x y [ ϕ]@ z ψ) (16) Proof. The validity of (13)-(15) is straightforward. We now consider (16). Let M, w be a pointed model. From left to right. Suppose that M,w[ ϕ]@ x ψ and M,w y@ x z( x y [ ϕ]@ z ψ). Let u M such that V(x) = {u}. Then it holds that M,u z( x y [ ϕ]@ z ψ) where w V(y). Therefore there exists v M such that Ruv, v V(z) and M,v x y [ ϕ]@ z ψ. By M,v x y), it holds that u,v M w,ϕ. Further more, by M,v@ y [ ϕ]@ z ψ, it holds that M w,ϕ,v ψ, which contradicts to M,w[ ϕ]@ x ψ. From right to left. We suppose that M,w y@ x z( x y [ ϕ]@ z ψ) and that M,w [ ϕ]@ x ψ. Let u W such that V(x) = {u}. Then there exists v W such that u,v M w,ϕ and M w,ϕ,v ψ. By M,w y@ x z( x y [ ϕ]@ z ψ), it holds that M,v@ y [ ϕ]@ z ψ where w V(y) and v V(z). Consequently, we have that M w,ϕ,vψ which entails a contradiction. Given a formula of the form[ ϕ]@ x ψ, (14) and (15) allow us to push[ ϕ] through Boolean operators in ψ; (16) presents a method to push[ ϕ] through in ψ. However, none formulas of (12)-(16) are ideal. Since, for serving as the recursion axioms for L d, (12) should not require any further axioms. What we 13

14 need is a direct one-step principle for. Here we are not going to present a solution for this issue, but providing some considerations illustrating that there may exist no recursion axiom for in H ( ). Now let us consider what the recursion axiom for [ ϕ] ψ should be like in H ( ) if there exists. When there is no requirement for other principles, the formula to the right of the axiom must be of the form ( ϕ [ χ]ψ), where χ must and nominal variables. Further more, none of those operators could occur in any other positions except χ in this form, or else some extra recursion axioms are required. However, it seems like impossible to find such a form for[ ϕ] ψ. There are two reasons: First, formula χ should tell us the position where the change induced by[ ϕ] took place. Thus we need to name the evaluation point. Consequently, the form above cannot meet this requirement, and it should be x ( ϕ [ χ]ψ) x must occur in χ. 2 However, some further axiom for is required now. Next, even we can find a principle of the form ( ϕ [ χ]ψ), it is still not enough. Let us consider a special case where md(ψ) > 0, e.g., ψ = σ. After pushing [ χ] into the scope of in σ, by the form above, we can get a formula like ( χ [ χ ]σ), i.e., the formula occurring in [ ] becomes into the antecedent of a new formula. However, based on the discussion above, χ must and nominal variables. Thus some extra recursion axioms for these operators are required again. Based on these speculations, we guess that there exists no a recursion axiom for [ ϕ] ψ in H ( ). However, Definition 3 has already showed a recursive first-order translation for S d ML, thus there must be some sort of recursion axioms for it. So it poses a question for us: Open Problem. What should a complete set of recursion axioms for S d ML be? The solution for this question may be not unique, but we need to find another language which is more expressive. 7 Undecidability of S d ML Up to now, we have already shown that, on the one hand, S d ML is more expressive than the standard modal logic; on the other hand, it is also a fragment of the hybrid logic H ( ). It is well-known that the satisfiability problem for the standard modal logic is decidable; while, as noted by [10], H ( ) is undecidable. So a tantalizing problem is: is S d ML decidable or not? Actually, there are some fragments of H ( ) which are decidable. For instance, [12] shows that after removing all formulas containing a nesting of, and, H ( ) becomes decidable. In this section, we will investigate the question above. It will be showed that the answer is negative, i.e., the satisfiability problem for S d ML is undecidable. Before this result, we will show that S d ML lacks the tree model property and the finite model property. Proposition 3. The logic S d ML does not have the tree model property. Proof. Consider the following formulas: (R 1 ) p p p (R 2 ) (p p p) (R 3 ) [ p] p Let ϕ r = R 1 R 2 R 3. We now show that, for any M = {W,R,V} and w W, if M,w ϕ r, then the evaluation point w is reflexive. By (R 1 ), w has some p-successor(s) and some p-successor(s). Besides, (R 2 ) states that, each its p-successor w 1 also has at least one p-successor w 2 and at least one p-successor w 3. Further more, from (R 3 ) we know that, after deleting all links from w to the p-points, w 1 does not have p-successors any longer. If w 1 is not w, then ϕ r cannot be true at w. In other words, for each v W, if Rwv and M,v p, then v = w, i.e., R(w) V(p) = {w}. So if formula ϕ r is true, the evaluation point must be reflexive (with at least one p-successor). A model for ϕ r is the M 2 in Example 4, and ϕ r is true at the point v 1. 2 This is also an important reason why we need the hybrid logic. 14

15 Remark 2. In the proof of Proposition 3, with the formula ϕ r, we define a reflexive p-point w which also has at least one p-successor. Intuitively, our intention is to use those p-successors to make a test. For each p-successor v of w, its property is very similar to w: it also has some p-successor(s) and some p-successor(s). After deleting the links from w to the p-points, we check whether the point v still has p-successor(s) or not. If v does still have some p-successor(s), v must be different from w. While, if v does not have p-successor(s) any longer, v must be w. We will use this skill several times in the rest of this section. Further more, S d ML also lacks the finite model property. In order to show this, inspired by [10], we will construct a spy point, i.e., a point which has access in one step to any reachable point in the model. Theorem 4. S d ML does not have the finite model property. Proof. Let ϕ be the conjunction of the following formulas: (F 1 ) s p s ( s p) ( s p) ( p ) (F 2 ) (p (s p) ( s p) ((s p) ( s p))) (F 3 ) (p (s s ( s p))) (F 4 ) [ p] (p (s ( s p))) (F 5 ) (p ( s (s p) ( s p) ((s p) ( s p)))) (F 6 ) (p ( s (s p s ( s p)))) (F 7 ) [ p] (p ( s p (s p ( s p)))) (Spy) (Irr) (No-3cyc) (Trans) (p ( s [ s] (s p ( s p (s p))))) (p [ s] s) (p [ s] [ s] ( s p ( s p s))) (p [ s] ( s p [ s] (s p ( s p s s)))) First, we show that the formula ϕ is satisfiable. Consider a model M = W,R,V where the underlying frame F = W,R is defined as follows: v 0 v 2 v w w 0 w 1 w 2 w 3... Further more, for each i {0,1,2}, v i W \(V(p) V(s)); for each i N, w i V(p) (W \ V(s)); and the point w V(s) V(p). Then it holds that M,w ϕ. Therefore, there exists at least one model satisfying formula ϕ. Next, we show that for any M ={W,R,V} and w W, if M,wϕ, then W is infinite. For brevity, define that B ={v W v R(w) V(p)}, i.e., B is the set of the p-successors of w. In the following proof, we assume that all previous conjuncts hold. By formula(f 1 ), the evaluation point w is(s p), and it cannot see any s-points. In particular, w cannot see itself. Besides, w has some p-successor(s) (i.e., B /0) and some p-successor(s) (i.e., R(w)\ B /0). Further more, each point in R(w)\B is a dead-end. 15

16 From (F 2 ), we know that each element in B can see some (s p)-point(s) and some ( s p)-point(s), but cannot see any p-points. It implies that each point in B has a successor distinct from itself. According to(f 3 ), for any w 1 B, each its s-successor can see some( s p)-point(s), but cannot see any s-points. Based on(f 4 ), after removing all links from w to the p-points, for all w 1 B, each its s-successor w 2 has no ( s p)-successors any longer. Thus (F 4 ) entails that each w 1 B can see w, and that for each (s p)-point w 2 W, if w 2 is a successor of w 1, then w 2 must be w. Formulas(F 2 )-(F 4 ) show the properties of the( s p)-points which are accessible from w in one step. Similarly, formulas(f 5 ), (F 6 ) and (F 7 ) play the same role as (F 2 ), (F 3 ) and (F 4 ) respectively, but focusing on showing the properties of the( s p)-points which are accessible from w in two steps. In particular, the formula (F 7 ) guarantees that every ( s p)-point w 1 which is accessible from w in two steps can also see w, and that for each(s p)-point w 2 W, if w 2 is a successor of w 1, then w 2 must be w. Formula (Spy) says that, for each ( s p)-point w 1 which is accessible from w in two steps, after removing the links from w 1 to the s-points, each successor w 2 of w 1 is (s p) and w 2 has a s p- successor w 3 which only has(s p)-successors. By (F 7 ), we know that w 2 = w. Further more, by (F 2 ), w 3 should have some ( s p)-successor(s) if the cut induced by [ s] does not take place at w 3. So it holds that w 3 = w 1. In such a way, (Spy) makes the evaluation point w be a spy-point, and it ensures that each ( s p)-point w 1 which is accessible from w in two steps can also be accessible from w in one step. By (Irr), for each w 1 B, after removing the link from w 1 to w, each successor of w 1 still can see w. Therefore, it holds that each w 1 B is irreflexive. Further more, (No-3cyc) disallows cycles of length 2 or 3 in B; (Trans) forces the accessibility relation R to transitively order B. Hence B is an unbounded strict partial order, thus B is infinite and so is W. Now we have already shown that ϕ is satisfiable, and that for each pointed model M,w, if M,wϕ, then M is an infinite model. Therefore the proof is completed. Now, by encoding the N N tiling problem, we show that S d ML is undecidable. A tile t is simply a 1 1 square, of fixed orientation, with coloured edges right(t), left(t), up(t) and down(t). The N N tiling problem is: given a finite set of tile types T, is there a function f : N N T such that right(f(n,m))=left(f(n+1,m)) and up(f(n,m))=down(f(n,m+1))? This problem is known to be undecidable (see [16]). Following the ideas in [10], we will use three modalities s, u and r. Correspondingly, a model M ={W,R s,r u,r r,v} now has three kinds of accessibility relations. We will construct a spy point over the relation R s. The relations R u and R r represent moving up and to the right, respectively, from one tile to the other. Besides, the operator[ ]will work in the usual way, i.e., all of the three kinds of relations should be cut if the current point have some particular successors via them. 3 Let us see the details. Theorem 5. The satisfiability problem for S d ML is undecidable. Proof. Let T ={T 1,...,T n } be a finite set of tile types. For each T i T, we use u(t i ), d(t i ), l(t i ), r(t i ) to represent the colors of its up, down, left and right edges respectively. Besides, we code each tile type with a fixed propositional atom t i. Now we will define a formula ϕ T such that ϕ T is satisfiable if and only if T tiles ω ω. Consider the following formulas: (M 1 ) s p s s s ( s p) s ( s p) s ( p s ) (M 2 ) s (p s s (s p s ( s p))) (M 3 ) [ p] s (p s (s p s ( s p))) (M 4 ) s (p ( s p s s (s p s ( s p)))) {u,r} (M 5 ) [ p] s (p s (s p s ( s p))) {u,r} 3 There is also no problem if we use three kinds of dynamic operators which correspond to the three accessibility relations. Actually it can be showed that, in the proof of Theorem 5, these three accessibility relations are always disjoint. 16

17 (M 6 ) s (p ( u r u ( s p) r ( s p))) {u,r} (M 7 ) s (p [ s] ( s s s s)) {u,r} (Spy) s (p [ s] s (s p s ( s p u r ))) {u,r} (Func) s (p [ s] [ s] s s ( s p s s ( u r )) {u,r} (UR-no-Cycle) s (p [ s] u r s s [ s] r u s s) (URU-no-Cycle) s (p [ s] u r u s s) (Conf) s (p [ s] u [ s] r [ s] s s ( s p s s r ( u r ) u s s r u ( u r ))) (Unique) s (p t i (t i t j )) 1 i n (Vert) s (p 1 i n (Horiz) s (p 1 i n 1 i< j n (t i u 1 j n, u(t i )=d(t j ) (t i r 1 j n, r(t i )=l(t j ) Define ϕ T as the conjunction of the formulas above. Let M = {W,R s,r u,r r,v} be a model and w W. Suppose that M,wϕ T. We now show that M is a tiling of N N. For brevity, define G ={v W v R s (w) V(p)} where R s (w) = {v W R s wv}, and we will use its elements to represent the tiles. In the following proof, we also assume that all previous conjuncts hold. Formula (M 1 ) is similar to (F 1 ) occurring in the proof of Theorem 4, except that (M 1 ) focuses on the relation R s only. By (M 2 ), each tile w 1 has some successor(s) via the relation R s, and each such successor w 2 is (s p) and also has some( s p)-successor(s) via R s. Formulas(M 1 ) and(m 2 ) imply that R s is irreflexive. Formula(M 3 ) ensures that each tile w 1 can see w via R s, and that for each (s p)-point w 2 W, if w 2 is accessible from w 1 via R s, then w 2 = w. (M 4 ) states that each tile has some successor(s) via R u and some successor(s) via R r. Besides, each point which is accessible from a tile via R u or R r is very similar to a tile: it is ( s p); and it has some (s p)-successor(s) w 1 via R s where each w 1 can see some( s p)-point(s) via R s. By formula (M 5 ), each w 1 W which is accessible from a tile via R u or R r can see w via R s. Further more, for each(s p)-point w 2 W, if it is accessible from w 1 via R s, then w 2 = w. Formula(M 6 ) ensures that each w 1 W which is accessible from some tile via R u or R r also has some successors via R u and some successors via R r. Besides, each its successors via R u or R r is( s p). From formula(m 7 ), it follows that both the relations R u and R r are irreflexive and asymmetric. By (Spy), we know that the evaluation point w is a spy point via the relation R s. Note that formula (M 4 ) says that each tile has some tile(s) above it and some tile(s) to its right. Now, with (Func), we have that each tile has exactly one tile above it and exactly one tile to its right. By (UR-no-Cycle), no tile can be above/below as well as to the left/right of another tile. Besides, the formula (URU-no-Cycle) disallows cycles following successive steps of the R u, R r, and R u relations, in this order. Further more, (Conf ) ensures that the tiles are arranged as a grid. The formula (Unique) ensures that each tile has a unique type. (Vert) and (Horiz) force the colors of the tiles to match properly. Thus we conclude that M is indeed a tiling of N N. Now we show the other direction. Suppose that the function f : N N T is a tiling of N N. Define a model M ={W,R s,r u,r r,v} as follows: W =(N N) {w,v} t j )) t j )) R s ={ w,v } { w,n n N} { n,w n N} R u ={ n,m, n,m+1 n,m N} 17