Fuhrmann, A. and Morreau M. (eds.) The Logic of Theory Change, Springer Lecture Notes in Artificial Intelligence 465, 1991 E P I S T E M I C E N T R E N C H M E N T W I T H I N C O M P A R A B I L I T I E S A N D R E L A T I O N A L B E L I E F R E V I S I O N * Sten Lindström and Wlodzimierz Rabinowicz1 1. Introduction In an earlier paper (Lindström & Rabinowicz, 1989), we proposed a generalization of the approach to belief revision due to Alchourrón-Gärdenfors-Makinson. Our proposal was to view belief revision as a relation rather than as a function on theories (or belief sets). The idea was to allow for there being several equally reasonable revisions of a theory with a given proposition. The same approach was used - and developed further - in our study (1990) of belief revision and epistemic conditionals. In the present paper, we want to show that the relational approach is the natural result of generalizing in a certain way an approach to belief revision which is due to Adam Grove. In his (1988) paper, Grove presents two closely related modelings of functional belief revision, one in terms of a family of "spheres" around the agent's theory G and the other in terms of an epistemic entrenchment ordering of propositions.2 Intuitively, a proposition A is at least as entrenched in the agent's belief set as another proposition B if and only if the following holds: provided the agent would have to revise his beliefs so as to falsify the conjunction A ∧ B, he should do it in such a way as to allow for the falsity of B. The "sphere"-terminology is natural when one looks upon theories and propositions as being represented by sets of possible worlds. Grove's spheres may be thought of as possible "fallback" theories relative to the agent's original theory: theories that he may reach by deleting propositions that are not "sufficiently" entrenched (according to standards of sufficient entrenchment of varying stringency). To put it differently, fallbacks are theories that are closed upwards under entrenchment: if T is a fallback, A belongs to T and B is at least as entrenched as A, then B also belongs to T. The entrenchment ordering can be recovered from the family of fallbacks by the definition: A is at least as entrenched as B iff A belongs to every fallback to which B belongs. 2 Representing theories and propositions as sets of possible worlds, the following picture illustrates Grove's family of spheres around a given theory G and his definition of revision. Notice that the spheres around a theory are "nested", i.e., simply ordered. For any two spheres, one is included in the other. Grove's family of spheres closely resembles Lewis' sphere semantics for counterfactuals, the main difference being that Lewis' spheres are "centered" around a single world instead of a theory (a set of worlds). Figure 1. The shaded area H in Figure 1 represents the revision of G with a proposition A. The revision of G with A is defined as the strongest A-permitting fallback theory of G expanded with A. In the possible worlds representation, this is the intersection of A with the smallest sphere around G that is compatible with A. (Any revision has to contain the proposition we revise with. Therefore, if A is logically inconsistent, the revision with A is taken to be the inconsistent theory.) The relational notion of belief revision that we are interested in, results from weakening epistemic entrenchment by not assuming it to be connected. In other words, we want to allow that some propositions may be incomparable with respect to epistemic entrenchment. As a result, the family of fallbacks around a given theory will no longer have to be nested. It will no longer be a family of spheres but rather a family of "ellipses". This change opens up the possibility for several different ways of revising a theory with a given proposition. 3 Figure 2. In this figure, the two ellipses represent two different fallback theories for G, each of which is a strongest A-permitting fallback. Consequently, there are two possible revisions of G with A: each one of H and K is the intersection of A with a strongest A-permitting fallback. Given connectedness for epistemic entrenchment, there is a way of defining revision directly from entrenchment, without going via fallbacks. The revision of G with A (in symbols, G∗A ) may then be defined thus (for the interesting case in which A is logically consistent): B ∈ G∗A iff A → B is more entrenched than A → ¬B (relative to G). G∗A defined in this way will coincide with the intersection of A with the maximal A-permitting fallback. However, when we give up connectedness there may not be a unique fallback of this kind. Therefore, this direct way of defining revision from entrenchment is no longer available. Why is it that a non-nested family of fallbacks allows for incomparabilities with respect to epistemic entrenchment? Figure 3 below provides an explanation. In this picture, there is one fallback theory, H, in which A is true but B is not, and another, K, in which B is true but A is not. Hence, neither B is at least as entrenched as A nor vice versa. A and B are incomparable. 4 Figure 3. The next section provides the logical background for our discussion. In Section 3, we introduce an axiom system for epistemic entrenchment without connectedness. We also provide an axiomatic characterization of fallback families. We prove that the two notions are interdefinable and that, in fact, there is a one-to-one correspondence between entrenchment orderings and fallback families. In Section 3, we also show that non-connected epistemic entrenchment orderings can be viewed as intersections of families of connected entrenchment orderings. There is an analogy here with probabilistic representations of epistemic states. Working with a non-connected entrenchment ordering is analogous to a representation of the agent's epistemic state by an "interval-valued" probability assignment. On the other hand, the representation in terms of a family of connected entrenchment orderings is like the approach in which an epistemic state is viewed as a class of real-valued probability assignments. Gärdenfors' functional approach in terms of a unique connected entrenchment ordering corresponds to the classical Bayesian approach in which the epistemic state is identified with a unique real-valued probability assignment. Of course, this is only an analogy; entrenchment orderings and probability functions do not obey the same axioms. In Section 4, we define relational belief revision from (non-connected) epistemic entrenchment, via the intermediate notion of a fallback family. We also show that 5 the original entrenchment ordering can be recovered from the resulting belief revision relation by means of the following definition: (D≤) A is at least as entrenched in G as B iff either (i) A is logically true or (ii) for every theory H, if H is a possible revision of G with ¬(Α∧Β), then B does not belong to H.3 In the same section, we also provide an axiom system for relational belief revision, which, given the definition (D≤), is sufficient for the derivation of our postulates for epistemic entrenchment. We also prove that our axiom system for belief revision is not sufficiently strong to guarantee that all belief revision systems that satisfy our axioms are representable, that is, that they are definable in the appropriate way from an epistemic entrenchment relation. In the special case, when we consider functional belief revision only, our axioms are sufficient to guarantee representability. This result is essentially equivalent to Grove's representation theorem for Gärdenfors-type belief revision in terms of families of spheres. However, the problem of giving a nice axiomatic characterization of just those relational belief revision systems that are representable still remains to be solved. Finally, in Section 5, we discuss the relationship between belief revision and belief contraction. According to Levi (1980), belief revision can be seen as a two-step process: a contraction followed by an expansion. In order to revise our theory G with A, we first contract G with ¬A - move to a weaker theory K in which ¬A is no longer present - and then we expand K with A (i.e., we add A to K and close under logical consequence). In our approach, revision is also viewed as a two-step process, but the first step is different. Instead of contracting G with A, we move to a maximal Apermitting fallback of G. In Section 5, we argue that contractions and maximal fallbacks are different concepts. Nor is it possible to construct contraction from fallbacks, or what amounts to the same, from epistemic entrenchment. Such a construction would yield the so-called postulate of Recovery for contraction, which we reject. According to this postulate, if A ∈ G and K is a contraction of G with A, one can recover the original theory G from K by expanding the latter with A. On the other hand, it is possible to impose reasonable constraints on contraction in the presence of which Levi's definition of revision in terms of contraction will follow from our definition in terms of fallbacks. In this way, the two approaches may, after all, be complementary. 6 2. Logics We consider a fixed sentential language L with the following symbols: (i) atomic sentences: p1, p2,... ; (ii) classical connectives: ⊥ (falsity), → (the material conditional); (iii) possibly some non-classical connectives; (iv) parentheses. The set Φ of sentences is the smallest set such that: (i) all atomic sentences are in Φ; (ii) ⊥ ∈ Φ; (iii) if A, B ∈ Φ, then (A → B) is in Φ; (iv) if o is an n-ary non-classical connective in L and A1,..., An are in Φ, then o(A1,..., An) ∈ Φ. The connectives ¬ (negation), ∧ (conjunction), ∨ (disjunction) and ↔ (the material biconditional) are introduced as abbreviations in the metalanguage in the usual way. For instance, ¬A = A → ⊥. A logic L is a set of sentences such that: (i) all truth-functional tautologies are in L; (ii) L is closed under modus ponens. For every logic L and set Γ of sentences, we define CnL(Γ) to be the smallest set of sentences that includes Γ ∪ L and is closed under modus ponens. We say that A is an L-consequence of Γ (also written as Γ aL A) if A ∈ CnL(Γ). Note that every logic L satisfies compactness and the deduction theorem: (i) if Γ aL A, then for some finite ∆ ⊆ Γ, ∆ aL A; (ii) if Γ ∪ {A} aL B, then Γ aL A → B. Let L be a logic. L is (absolutely) consistent if and only if L ≠ Φ. A set Γ ⊆ Φ is said to be L-consistent if CnL(Γ) ≠ Φ. A is said to be L-consistent if {A} is L-consistent. Γ is an L-theory if and only if L ⊆ Γ and Γ is closed under modus ponens. In other words, Γ is an L-theory just in case Γ = CnL(Γ). Note that every L-theory is a logic in its own right. A set Γ is L-maximal if and only if Γ is L-consistent and for every ∆, if Γ ⊆ ∆ and ∆ is L-consistent, then Γ = ∆. Every L-maximal set is an L-theory. G, H, K, T, T',... are variables ranging over L-theories. The set of such theories is denoted by TL. 3. Epistemic Entrenchment In the following, we let L be a consistent logic. Definition 3.1. Let G be any L-theory. An epistemic entrenchment ordering for G is a binary relation ≤ of the sentences in L satisfying the following postulates: (≤1) If A ≤ B and B ≤ C, then A ≤ C. (Transitivity) (≤2) If A aL B, then A ≤ B. (Dominance) (≤3) If A ≤ B and A ≤ C, then A ≤ B ∧ C. (Conjunctive Closure) (≤4) If ⊥ ∉ G, then A ∉ G iff A ≤ ⊥. (Bottom) (≤5) If Τ ≤ A, then aL A. (Top) 7 Here, Τ =df ¬⊥. If A ≤ B, we say that B is at least as (epistemically) entrenched in G as A. (If we want to make the reference to G explicit, we write A ≤G B rather than A ≤ B. Sometimes, we might also write B ≥ A or B ≥G A instead of A ≤ B.) The corresponding strict ordering < is defined by: A < B iff A ≤ B and not B ≤ A. A < B is to be read as "B is (epistemologically) more entrenched in G than A". We also define the corresponding equality relation, A and B are (epistemologically) equally entrenched in G (in symbols, A ≈ B or A ≈G B), as: A ≤ B and B ≤ A. Let us now look at the intuitive motivation for the above axioms. The theory G consists of all those sentences (in L) that are accepted (or believed) by the agent. Although the agent has full belief in all the sentences in G, some of his beliefs are held more firmly than others: the more firm - or epistemically entrenched - a belief is, the less willing the agent is to give it up when faced with new information. In other words, A ≤ B holds just in case the agent's determination to keep B in the face of new information is at least as strong as his determination to keep A. The axioms (≤1) - (≤5) should be viewed as rationality requirements on such a relation for logically omniscient agents. Clearly, the relation ≤ should be transitive, that is, we have (≤1). Furthermore, if A aL B, then the agent being logically omniscient knows that he cannot keep A without keeping B and he also knows that he cannot give up B without giving up A. Being rational he realizes that he cannot fight what is unavoidable. Thus, he should be at least as willing to give up A as to give up B (alternatively, he should be at least as determined to keep B as to keep A). This line of reasoning yields Axiom (≤2). Axiom (≤3) says that if the agent's determination to keep B is at least as strong as his determination to keep A and his determination to keep C is also at least as strong as his determination to keep A, then the agent's determination to keep the conjunction B ∧ C is at least as strong as his determination to keep A. For, clearly, if he were to give up B ∧ C, he would give up either B or C (or both), but his preparedness to give up A is at least as strong. Intuitively, the relation of epistemic entrenchment is only defined for sentences that are accepted, i.e., that belong to G. It is, however, convenient to extend it to sentences that are not in G by stipulating that those sentences are less entrenched than all the sentences in G. This convention is expressed in Axiom (≤4). In the presence of (≤1) and (≤2), Axiom (≤4) is equivalent to the conjunction of the following two conditions: (≤4.1) If A ∉ G and B ∈ G, then A < B. (≤4.2) If A ∉ G and B ∉ G, then A ≈ B. 8 It follows from (≤2) that if aL A, then Β ≤ A, for all B. In particular, we have Τ ≤ A in this case. Axiom (≤5) says that the logical truths are the only sentences A such that Τ ≤ A. In other words, the logical truths are precisely those sentences that are maximally entrenched. Intuitively, those are only the sentences that the agent is determined to keep under any circumstances. Observe that we differ from Gärdenfors (1988) in not assuming epistemic entrenchment relations to be connected. If we were to add: A ≤ B or B ≤ A (Connectedness) our axioms would be equivalent to Gärdenfors' postulates (EE1) - (EE5). In particular, connectedness together with (≤1) and (≤3) would imply Gärdenfors' postulate: (EE3) A ≤ A ∧ B or B ≤ A ∧ B (Conjunctiveness) Proof: By connectedness, we have: A ≤ B or B ≤ A. Suppose now that A ≤ B (the other case is similar). Connectedness also yields A ≤ A. Hence, by (≤3), A ≤ A ∧ B. o Conversely, (EE3) together with Transitivity and Dominance, which are among Gärdenfors' postulates, imply Connectedness. (EE3) and Dominance yield: A ≈ A ∧ B or B ≈ A ∧ B, that is, A ∧ B is equally entrenched as A or equally entrenched as B. In fact, on Gärdenfors' approach, A ∧ B is equally entrenched as the least entrenched sentences among A and B. On our approach, however, A and B may be incomparable with respect to epistemic entrenchment, in which case A ∧ B is strictly less entrenched than both A and B. Instead of Gärdenfors' (EE3), we have: if A ≤ B, then A ≤ A ∧ B. In fact, we have the following "definition" of ≤ in terms of ≈: A ≤ B iff A ≈ A ∧ B. In the following, we let G be any fixed L-theory and ≤ an epistemic entrenchment ordering for G. Definition 3.2. (a) A set Γ of sentences is a filter (relative to ≤) if it satisfies the following conditions: (i) Γ ≠ ∅; (ii) If A ∈ Γ and A ≤ B, then B ∈ Γ; 9 (iii) If A, B ∈ Γ, then A ∧ B ∈ Γ. Alternatively, we can characterize a filter as a non-empty set Γ of sentences which satisfies the following two conditions: (iv) A, B ∈ Γ iff A ∧ B ∈ Γ; (v) If A ≈ B, then A ∈ Γ iff B ∈ Γ. It is easily seen that these characterizations are equivalent. We say that a filter Γ is proper if ⊥ ∉ Γ. (b) We let F(≤) be the set of all filters. We also refer to the elements of F(≤) as fallbacks (with respect to ≤). Proper filters are also called proper fallbacks. (c) A family of sets X is said to be directed (with respect to ⊆) if for any Γ and ∆ in X, there is a Σ in X such that Γ ⊆ Σ and ∆ ⊆ Σ. In other words, X is directed if every finite subset of X has an upper bound in X. Intuitively, a proper fallback (w. r. t. an entrenchment ordering ≤ for G) is a weakening of G - a subtheory of G - which we obtain by removing from G all sentences that are not "sufficiently entrenched". We choose as our entrenchment standard some non-empty subset Γ of G which is closed under conjunctions and whose elements are all sufficiently entrenched for our purposes and we keep only those sentences that are at least as entrenched as some sentences in Γ. Lemma 3.3. The set F(≤) of all filters (or fallbacks) with respect to ≤ has the following properties: (F1) Every element of F(≤) is an L-theory. (F2) If X is a subset of F(≤), then ∩X ∈ F(≤). (F3) If X is a non-empty directed set of elements in F(≤), then ∪X ∈ F(≤). (F4) If H ∈ F(≤) and ⊥ ∉ H, then H ⊆ G. (F5) L ∈ F(≤). (F6) G ∈ F(≤). For the proof of this lemma and the proofs of the main lemmas and theorems to follow, see the Appendix. (F2) says that F(≤) is a closure system.4 A closure system satisfying condition (F3) is called algebraic. F(≤) is a complete lattice (with respect to the ordering under inclusion), where for each X ⊆ F(≤), inf(X ) = ∩X and sup(X) = ∩{H ∈ F(≤): ∪X ⊆ H}. The bottom (or least element) of F(≤) is L and its top (or greatest element) is the inconsistent L-theory K⊥ (= ∩∅). If G is consistent, then the proper or consistent elements of F(≤) are exactly those that are included in G. In this case, the set of all proper filters is 10 directed and G is its union. It should also be noted that if X is a non-empty directed set of proper filters, then ∪X is a proper filter. For any set of sentences Γ, there exists a smallest member of F(≤) which includes Γ, namely ↑(Γ) = ∩{H ∈ F(≤): Γ ⊆ H}. We refer to ↑(Γ) as the filter generated by Γ. Lemma 3.4. If Γ ≠ ∅, then ↑(Γ) = {A: ∃ B1,..., Bn ∈ Γ (n ≥ 1), B1 ∧ ... ∧ Bn ≤ A}. Lemma 3.5. The operation ↑: P(Φ) → P(Φ) satisfies the following conditions: (↑1) Γ ⊆ ↑(Γ). (↑2) ↑(Γ) = ↑(↑(Γ)). (↑3) If Γ ⊆ ∆, then ↑(Γ) ⊆ ↑(∆). (↑4) CnL(Γ) ⊆ ↑(Γ). (↑5) If ⊥ ∉ G, then ⊥ ∉ ↑(Γ) iff Γ ⊆ G. (↑6) ↑(G) = G. (↑7) ↑(∅) = L. (↑8) ↑({A ∧ B}) = ↑({A, B}). (↑9) If Γ ≠ ∅, then ↑(Γ) = ∪{↑(∆): ∆ ⊆ Γ and ∆ is finite}. Moreover, F(≤) = {Γ ⊆ Φ: ↑(Γ) = Γ}. The proof of Lemma 3.5 is omitted here. (The proofs of (↑8) and (↑9) use Lemma 3.4.) Lemma 3.6. A ≤ B iff for every H ∈ F(≤), if A ∈ H, then B ∈ H. Proof: The left-to-right direction is trivial. To prove the other direction, assume that not(A ≤ B). Consider F = {C: A ≤ C}. We want to show that F is a filter such that A ∈ F and B ∉ F. A ∈ F by (≤2), and B ∉ F by the assumption. From (≤1) follows that F is closed upwards under ≤. Let C, D ∈ F. Then A ≤ C and A ≤ D. So by axiom (≤3), A ≤ C ∧ D, which means that C ∧ D ∈ F. Hence, F is a filter o Corollary 3.7. A ≤ B iff ↑({B}) ⊆ ↑({A}). Definition 3.8. Let G be an L-theory. A fallback family for G is a family F of sets of sentences satisfying the conditions (F1) - (F6) of Lemma 3.3. 11 Let G be a given L-theory. For any epistemic entrenchment ordering ≤ for G, we call F(≤) the fallback family for G determined by ≤, where F(≤) is the family of all filters with respect to ≤. As we have seen above, Lemma 3.3, F(≤) is indeed a fallback family. We also saw (Lemma 3.6) that the relation ≤ is definable in terms of F(≤). Thus, every epistemic entrenchment ordering ≤ for G can be thought of as being defined from a fallback family, namely from the family F(≤). Suppose now that ≤ and ≤' are epistemic entrenchment relations such that F(≤) = F(≤'). Via Lemma 3.6 we then get that ≤ = ≤'. That is, the relation of determination between entrenchment relations and fallback families is one-to-one. Next, we want to show that for any fallback family F, the relation ≤ defined by: (D) A ≤ B iff for all H ∈ F if A ∈ H, then B ∈ H. is an epistemic entrenchment relation and that, furthermore, F = F(≤). That is, there is a one-to-one correspondence between epistemic entrenchment relations and fallback families (for a given G).such that for any entrenchment relation the corresponding fallback family is set-theoretically definable from it and vice versa. Lemma 3.9. Let F be any fallback family for G and ≤ the corresponding ordering of the sentences in L defined by condition (D). Then ≤ is an epistemic entrenchment ordering for G. Proof: We prove that ≤ satisfies the postulates (≤1) - (≤5) for entrenchment orderings. The easy verifications of (≤1) - (≤3) using (F1) and (D) are omitted. (≤4) Suppose ⊥ ∉ G. Assume also that A ∉ G. Consider any H ∈ F such that A ∈ H. Then not(H ⊆ G), so by (F4), ⊥ ∈ H. Hence, by (D), A ≤ ⊥. For the other direction, assume that A ≤ ⊥. If A ∈ G, then by (F6) and (D), ⊥ ∈ G. Hence, A ∉ G. (≤5) Suppose Τ ≤ A. (F5) and (D) then yield A ∈ L. o In view of the previous Lemma, for any fallback family F for G, we may speak of the ordering ≤ which is defined from F via (D) as the epistemic entrenchment ordering corresponding to F. Lemma 3.10. Let F be a fallback family for G and let ≤ be the corresponding entrenchment ordering. Then F = F(≤). That is, the elements of F are precisely the filters with respect to the corresponding entrenchment ordering. Proof: We first prove that F ⊆ F(≤). Let H ∈ F. Using (F1) and (D), it is easy to verify that H is a filter with respect to ≤. That is, H ∈ F(≤). For the other direction, let H ∈ F(≤). Then using Lemma 3.5, we get Η = ∪{↑(∆): ∆ ⊆ Η and ∆ is finite} = ∪{↑({A}): A ∈ H} 12 However, for any A, ↑({A}) = {Β: A ≤ B}, by Lemma 3.4. Hence, by (D), for any B, B ∈ ↑({A}) iff for all K ∈ F, if A ∈ K, then B ∈ K. That is, ↑({A}) = ∩{K ∈ F: A ∈ K}. (F2) then yields that ↑({A}) ∈ F, for any A. Now, {↑({A}): A ∈ H} is a non-empty directed set. For let A1, A2 ∈ H. Then ↑({A1}), ↑({A2}) ⊆ ↑({A1 ∧ A2}). Hence, by (F3), ∪{↑({A}): A ∈ H} ∈ F. That is, H ∈ F. o Lemma 3.11. An epistemic entrenchment ordering ≤ is connected iff the corresponding fallback family F(≤) is a chain (i.e., is linearly ordered by inclusion). Proof: Suppose the entrenchment ordering ≤ for G is connected, i.e., for all sentences A, B (∗) A ≤ B or B ≤ A. We want to show that for all H, K ∈ F(≤), H ⊆ K or K ⊆ H. Suppose that neither H ⊆ K nor K ⊆ H. Then there are A, B such that A ∈ H, A ∉ K, B ∈ K and B ∉ Η. But then by the definition of a filter, neither A ≤ B nor B ≤ A, contrary to (∗). For the other direction, assume that F(≤) is linearly ordered by inclusion. Consider any sentences A, B. Then ↑({B}) ⊆ ↑({A}) or ↑({A}) ⊆ ↑({B}). This implies, by Corollary 3.7, that A ≤ B or B ≤ A. o Notice that if F(≤) is a chain, then every non-empty subset of F(≤) is directed. It follows that F(≤) in this case is closed under the formation of arbitrary unions of nonempty subsets. Definition 3.12. Let ≤ be an epistemic entrenchment ordering for G. A fallback H in F(≤) is said to be A-permitting if ¬A ∉ H. H ∈ F(≤) is a maximal A-permitting fallback (for G) if: (i) ¬A ∉ H; and (ii) for any K ∈ F(≤), if H ⊂ K, then ¬A ∈ K. Lemma 3.13. Let ≤ be an epistemic entrenchment ordering for G. Every A-permitting fallback in F(≤) is included in a maximal A-permitting fallback. Proof: Let H ∈ F(≤) such that ¬A ∉ H. We let K = {K ∈ F(≤): H ⊆ K and ¬A ∉ K}. K ≠ ∅, since H ∈ K. Let ∅ ≠ C ⊆ K be a chain in K. Then C is a directed set, so by (F3), ∪C ∈ F(≤). Clearly, H ⊆ ∪C. Moreover, ¬A ∉ ∪C, for otherwise, for some K ∈ C, ¬A ∈ K, which is impossible. Hence, ∪C ∈ K. We have shown that every non-empty 13 chain in K has an upper bound in K. Zorn's lemma then yields that K has a maximal element. o We shall end this section by showing that entrenchment orderings that do not satisfy connectedness can be represented by families of connected entrenchment orderings. The basic idea, due to Hans Rott (personal communication), is the following: Consider any non-empty set XG of entrenchment orderings for G. Then, as is easily seen, ∩XG is an entrenchment ordering for G. That is, ∩XG satisfies the postulates (≤1) - (≤5). Now, if XG is a non-empty family of connected entrenchment orderings for G, then, of course, ∩XG is an entrenchment ordering for G. However, ∩XG need not be connected! This idea gives rise to a question: Can any epistemic entrenchment ordering ≤ for G be represented as ∩XG for some non-empty family XG of connected entrenchment orderings for G? Below, we show that the answer to this question is affirmative. Consider any entrenchment ordering ≤ for G. We say that ≤' is a connected extension of ≤ (relative to G) if ≤' satisfies the following conditions: (i) ≤ ⊆ ≤'; (ii) ≤' is a connected entrenchment ordering for G. ≤' is a minimal connected extension of ≤, if it in addition to (i) and (ii) satisfies: (iii) for any ≤", if ≤" satisfies (i) and (ii), then ≤" ⊄ ≤'. We let E(≤) and ME(≤) be the set of all connected extensions and the set of all minimal connected extensions of ≤, respectively. The next theorem says that an entrenchment ordering ≤ for G that is not connected can be represented by any set X of connected extensions of ≤ that contains all the minimal connected extensions. Theorem 3.14. If ≤ be an entrenchment ordering for G and let X be any set of connected entrenchment orderings such that ME(≤) ⊆ X ⊆ E(≤). Then ≤ = ∩X. According to the above theorem, there are in general many different sets of connected entrenchment orderings for G that have the same non-connected ordering as their intersections. Therefore, the representation of epistemic entrenchment in terms of sets of connected relations is more finegrained or discriminating than the representation in terms of non-connected relations. But perhaps such a representation would be too discriminating. From the intuitive point of view, it is easy to understand what it means to say that the agent's entrenchment ordering is incomplete (non-connected): from his point of view, there are propositions that are incomparable with re14 spect to entrenchment; perhaps because these propositions are so different from each other, or perhaps because they are totally unrelated. But what is the meaning of the claim that the agent's state consists of a class of entrenchment orderings? Is the idea that the agent vacillates between different entrenchment orderings? That he sometimes changes his beliefs according to one ordering and sometimes according to another? Or is it rather that his epistemic state is indeterminate? But then why not simply say that his entrenchment ordering is incomplete? There is an analogy here with the probabilistic representation of an agent's epistemic state. The agent's belief state can be represented as (i) a definite real-valued probability function over propositions (the classical Bayesian approach), or (ii) a probability function that takes intervals as values, or as (iii) a class of real-valued probability functions. A class Π of ordinary probability functions, if it satisfies certain conditions, determines an interval-valued probability function. We assigne to a proposition A the interval [inf(P(A)), sup(P(A))], where P varies over the members of Π. It is clear, of course, that different classes may induce the same probability intervals. One could say that Gärdenfors' approach in terms of a single connected entrenchment ordering corresponds to alternative (i) above; our approach using an incomplete entrenchment ordering is like the alternative (ii); while working with a class of connected entrenchment orderings is similar to alternative (iii). But entrenchment relations are not like probability orderings: the axiom (≤3) - Conjunctive Closure - would be absurd if ≤ were interpreted as 'at most as probable as'. Therefore, the analogy should not be taken too far. 4. Relational Revision The Alchourrón-Gärdenfors-Makinson approach treats belief revision as a function on theories: for any theory G and any sentence A, there is a unique revision of G with A. If we think of revision as being defined out of an epistemic entrenchment ordering ≤ of sentences, then the functional approach is a natural consequence of the assumption that epistemic entrenchment is connected. Intuitively, when the agent in belief state G receives a new piece of information A, he selects a maximal A-permitting fallback for G and adds A to it. That is, we have the following definition of revision in terms of epistemic entrenchment. Definition 4.1. Let ≤ be an epistemic entrenchment ordering for G. We say that H is a revision of G with A relative to ≤ if either ¬A ∈ L and H = Φ or there exists some 15 maximal A-permitting fallback K in F(≤) such that H = K + A. (Here, K + A, the expansion of K with A, is CnL(K ∪ {A}).) If ≤ is connected, then the family F(≤) of all fallbacks for G is a chain, so there is a unique maximal A-permitting fallback for G. In fact, this fallback is the set of all B such that B ≤/ ¬A. Accordingly, in this case there is a unique revision of G with A. If, however, we give up the requirement of connectedness, that is, if we allow sentences to be incomparable with respect to epistemic entrenchment, then there may be several maximal A-permitting fallbacks and hence also several revisions of G with A. Revision becomes relational rather than functional. In the next definition, we formulate a system of axioms for relational belief revision. Definition 4.2. A (relational) belief revision system (b.r.s.) is an ordered pair <L, R> such that L is a consistent logic, R ⊆ TL × Φ × TL and the following requirements are satisfied for all L-theories G, H and all sentences A, B: (R1) (∃H ∈ TL)(GRAH). (Seriality) (R2) If GRAH, then A ∈ H. (Success) (R3) If ¬A ∉ G and GRAH, then H = G + A. (Expansion) (R4) If ¬A ∉ L and GRAH, then ⊥ ∉ H. (Strong Consistency) (R5) If aL A ↔ B, then GRAH iff GRBH. (Substitutivity) (R6) If GRAH and ¬B ∉ H, then GRA∧B(H + B) (Revision by Conjunction) (R7) If GRAH and ∀K(GRA∨BK → ¬A ∉ K), then ∃K(GRA∨BK and H = K + A). We read GRAH as "H is a (possible) revision of G with A". In the presence of functionality: If GRAH and GRAK, then K = H, the axioms (R1) - (R7) are equivalent to Gärdenfors' (1988) axioms (K*1) - (K*8) for belief revision. Lemma 4.3. If <L, R> is a belief revision system, then it satisfies the following principles: (R8) If GRA∧BH and ∀K(GRAK → ¬B ∉ K), then ∃K(GRAK and H = K + B) (R9) If (i) GRA∨BH and ¬B ∈ H; and (ii) ∀K(GRB∨CK → ¬B ∉ K), then GRA∨CH and ¬C ∈ H. (Transitivity) 16 Moreover, in the presence of the other axioms (in fact, only (R2) and (R5) are needed), (R7) and (R8) are equivalent principles. As we shall see next, if belief revision is defined from a system of entrenchment orderings - one for each theory G - then it satisfies the axioms (R1) - (R7). Moreover, the original system of entrenchment orderings will be seen to be definable from the corresponding belief revision system. First, however, we introduce the notion of an entrenchment system and the equivalent notion of a fallback system. Definition 4.4. (a) An (epistemic) entrenchment system (e.e.s.) is an ordered pair <L, ≤ > such that L is a consistent logic and ≤ is a function which assigns to every L-theory G an epistemic entrenchment relation ≤G for G. (b) A fallback system is an ordered pair <L, F> such that L is a consistent logic and F is a function which assigns to every L-theory G a fallback family FG for G. In view of the results in the previous section, there is a natural one-to-one correspondence between entrenchment systems and fallback systems. The next theorem states that every entrenchment system (or equivalently, every fallback system) determines a belief revision system. Theorem 4.5. Let <L, ≤ > be an entrenchment system. Define <L, R> as follows: for all L-theories G, H and all sentences A, (DR) GRAH iff H is a revision of G with A relative to ≤G. Then <L, R> is a belief revision system, that is, it satisfies the axioms (R1) - (R7). In addition, the following equivalence holds for all A, B and G: (D≤) A ≤G B iff either B ∈ L or ∀H(if GR¬(A∧B)H, then A ∉ H). That is, if the belief revision system <L, R> is defined from an entrenchment system <L, ≤ > by means of (DR), then <L, ≤ > can be recovered from <L, R> via (D≤). Theorem 4.6. Let <L, R> be a belief revision system and define for every L-theory G and all A, B: (D≤) A ≤G B iff either B ∈ L or ∀H(if GR¬(A∧B)H, then A ∉ H). The so constructed system <L, ≤ > is an epistemic entrenchment system. 17 Suppose that we consider a belief revision system <L, R>. Are our axioms on belief revision (cf. Definition 4.2) sufficient to guarantee that <L, R> is representable, that is, that there is some epistemic entrenchment system <L, ≤ > such that for all L-theories G, H and all sentences A, (DR) GRAH iff H is a revision of G with A relative to ≤G. By Theorem 4.6, we know that in terms of <L R> we can define an entrenchment system <L, ≤R>. Suppose now that we define a belief revision system <L, S> from <L, ≤R>, where GSAH holds just in case H is a revision of G with A relative to ≤ R G . In view of Theorem 4.5, we know that R is representable if and only if R = S. It can be shown that this representability problem has a negative answer. Not all belief revision systems are representable. The reason for this is that our set of axioms for R is not sufficiently strong to exclude an unintended interpretation of belief revision - an interpretation in which belief revisions are not required to be "minimal". Thus, suppose that we have an entrenchment ordering ≤ for G and define the corresponding family F(≤) of fallbacks. Now, suppose that we define belief revision in terms of F(≤), not as we have done before (cf. Definition (DR) in Theorem 4.5), but as follows: (D 'A ) GR 'A H iff either (i) ¬A ∈ L and ⊥ ∈ H; or (ii) ¬A ∉ G and H = G + A; or (iii) ¬A ∈ G and there is a (not necessarily maximal) Apermitting fallback K in F(≤) such that H = K + A. It is easy to check that all the belief revision axioms (R1) - (R7) hold for R' given this interpretation. At the same time, the intended relation R is included in the non-intended R'. In general, R will be properly included in R'. This can be seen if one starts from a connected entrenchment ordering ≤. Then R but not R' will be functional. Now, we are going to show that R' will not in general be representable. Suppose that R ⊂ R' and that R' is representable. Then there exists an entrenchment ordering ≤' such that R' is definable from ≤' via definition (DR). But then by Theorem 4.5, ≤' is definable from R' by means of (D≤). We are now going to show that ≤ = ≤'. This will entail a contradiction, because the revision relation R obtainable from ≤ via (DR) differs from the revision relation R' obtainable from ≤' via the same definition. Proof that if R' is representable, then ≤ = ≤'. 18 By (D≤) and the fact that R ⊆ R', it follows immediately that ≤' ⊆ ≤. For the other direction, suppose that A ≤ B. In the limiting case when B ∈ L, it is immediate that A ≤' B. Thus, in order to prove A ≤' B, for the principal case when B ∉ L, suppose that GR'¬A∨¬B H. We have to show that A ∉ H. Suppose that A ∈ H. Then there must exist a (¬A ∨ ¬B)-permitting fallback K in F(≤) such that H = K + (¬A ∨ ¬B). But then by lemma 3.13, there exists a maximal (¬A ∨ ¬B)-permitting fallback T such that K ⊆ T. Since, A ∈ H, (i) A ∈ T + (¬A ∨ ¬B). But, by the definition of R, we have that (ii) GR¬A∨¬B(T + (¬A ∨ ¬B)). But, (i) and (ii) contradict the assumption that A ≤ B. o We have seen that in general belief revision systems are not representable. This negative result naturally gives rise to the question: how can our system of axioms for relational belief revision be strengthened (in a nice way) so as to guarantee representability? The situation is different, however, if we want to add functionality: functional belief revision systems are always representable. The theorem below is essentially equivalent to Grove's (1988) representation theorem for functional belief revision in terms of families of spheres. Our proof, however, is different from his. (See the Appendix.) Theorem 4.7. Let <L, R> be a functional belief revision system. Define the corresponding entrenchment system <L, ≤ > by means of (D≤) and let <L, S> be the belief revision system obtained from <L, ≤ > via (DR). Then R = S. At the end of the previous section, we have discussed the possibility of representing the agent's belief state as a set XG of connected entrenchment orderings for a given belief set G. If one were to choose this approach, one would have two alternative ways of defining relational belief revision. Alternative 1. Go to the intersection ∩XG. As we already know, ∩XG is an entrenchment ordering. Then define R in the standard way from ∩XG via F(∩XG). Alternative 2. For any ≤' in XG, define the corresponding revision relation R≤' via F(≤'). Since each such ≤' is connected, R≤' will of course be a function. Then, we define: GSAH iff for some ≤' in XG, GR ≤' A H. It is easy to check that S satisfies all our axioms for relational belief revision. Alternative 2 is more liberal than alternative 1. We get more possible revisions that way. In order to see this, the reader should note that every fallback in F(∩XG) 19 is a fallback in F(≤'), for some ≤' in XG. Therefore, every maximal A-permitting fallback in F(∩XG) is a maximal A-permitting fallback in F(≤'), for some ≤' in XG. But the converse need not hold: a maximal A-permitting fallback in F(≤') may not be a maximal A-permitting fallback in F(∩XG). In what follows, we keep to our preferred interpretation of relational belief revision in terms of a single epistemic entrenchment ordering. 5. Fallbacks and Contractions According to Isaac Levi (1980, sect. 3.5), belief revision should be seen as a two-step process. In order to revise G with A, we first contract G with ¬A and then expand the resulting belief set with A. On our approach, belief revision is also a two-step process. A possible revision of G with A is obtained by first moving to a maximal Apermitting fallback of G and then expanding this fallback with A. This similarity between the two descriptions of belief revision might suggest the identification of contractions with maximal fallbacks: one might think that H is a possible contraction of G with A just in case H is a maximal ¬A-permitting fallback of G. (If A is a logically true, we let G itself be the only contraction of G with A.) This tentative suggestion appears in Rott (1989).5 If we look at theories as sets of possible worlds (where the latter might be identified with L-maximal theories), then the following figure illustrates the present proposal: Figure 4. 20 This way of defining contractions might invite an objection: According to the Alchourrón-Gärdenfors-Makinson approach, contraction is assumed to satisfy the postulate of recovery. In terms of our relational approach, this postulate amounts to the following claim: (Recovery) If A ∈ G and GR -A H, then H + A = G, where GR -A H should be read as: "H is a possible contraction of G with A". According to Recovery, if one contracts a theory with A and then expands the contraction with A, one recovers the theory one has started with. Now, it is easy to see that if one moves from a theory G containing A to a maximal ¬A-permitting fallback H and then expands H with A, one will not normally recover G.6 In order to see this, let A and B be two equally entrenched sentences in G such that their disjunction is logically true, but they are not contradictories (For instance, let A and B be "X is good or neutral" and "X is neutral or bad", respectively.) Since A and B are equally entrenched, it follows from the definition of fallbacks in terms of entrenchment that any ¬A-permitting fallback H must be ¬B-permitting as well. Now, consider H + A. It is easy to see that B ∉ H + A. Otherwise, we would have that A → B ∈ H, which in view of the fact that A ∨ B ∈ L and that B ∉ H, is impossible. But since B ∈ G, it follows that G ≠ H + A. To illustrate: Figure 5. It is obvious that in this example, H + A differs from G. Thus, if belief contraction should satisfy Recovery, contractions cannot be identified with maximal fallbacks. 21 However, the strength of this objection may well be doubted. Recovery is not a particularly convincing condition on contraction. As is easily seen, it has the following consequence: If B ∈ G and B aL A, then GR A H implies that B ∈ H + A. This principle is quite surprising. According to it, if we believe that Jesus was God's son and then retract our belief in Jesus' historical existence, then we are going to recover our belief Jesus' divine origin upon learning that Jesus actually existed. It is difficult to see why this should be the case. For a sustained criticism of Recovery from this point of view, see Niederée (1990). It should also be noted that Isaac Levi has never accepted the Recovery Postulate for contraction. However, there is another objection against identifying contractions with maximal fallbacks that we find much more convincing. As we know, fallbacks have the following property: if a fallback H is ¬A-permitting and B is at most as entrenched as A, then H is ¬B-permitting as well (This is an easy consequence of the fact that fallbacks are closed upwards under entrenchment.) Therefore, if we were to identify contractions with maximal fallbacks, we would have to accept the following principle: If GR -A H and B ≤G A, then B ∉ H. That is, when contracting with A, we would have to give up all the beliefs that are at most as entrenched as A, even those that are quite unrelated to our original belief in A. For example if we were called upon to give up some very entrenched belief of ours, for instance that the Earth rotates around the Sun, we would have to give up all beliefs that are less entrenched, even though they might be quite independent of the belief that is being contracted. For example, we would no longer be able to believe that Salman Rushdie has written "Satanic Verses". This is not how we do our contractions. Thus, the identification of contractions with maximal fallbacks does not seem to work. There is an alternative, however, which we should consider and which goes back to Grove (1988). We have used maximal fallbacks to define revisions. We might now also use them to define contractions in the following way: (Grove) GR -A H iff A ∈ L and G = H, or there is a maximal ¬A-permitting fallback K in F(≤G) such that H = G ∩ (K + ¬A). In the figure below, the shaded area represents Grove's contraction. The theory G ∩ (K + ¬A) is represented by the union of the sets of worlds corresponding to G and K + ¬A. 22 Figure 6. Given our interpretation of revision in terms of fallbacks, (Grove) amounts to the following definition of contraction in terms of revision: (Harper) GR A H iff there is some K such that GR¬AK and H = G ∩ K. (Harper) is the relational version of the so-called Harper Identity: G -A = G ∩ G ∗ ¬A . (Cf. Gärdenfors, 1988, sect. 3.6; G -A and G ∗ A here stand for functional contraction and functional revision of G with A, respectively.) (Grove) also yields Levi's reduction of revision to contraction, namely (Levi) GRAH iff for some K, GR - ¬A K and H = K + A. Unfortunately, Grove's proposal implies Recovery for contraction. In fact, Recovery follows from Harper (given Success), and as we have seen, Harper follows from Grove. It seems, therefore, that Grove's contractions are too strong from the intuitive point of view. On the other hand, we have seen that our original proposal (contractions = maximal fallbacks) gives us contractions that are too weak: we loose all the propositions that are at most as entrenched as the proposition we contract with. One would like to say that the truth lies somewhere in between the two extremes: the original proposal and Grove's definition seem to give us the "lower" and the "upper" limit for contraction. This idea could be expressed as the following set of adequacy conditions on the contraction relation: (C1) If GR -A H and A ∉ L, then there exists some maximal ¬A-permitting fallback K in F(≤G) such that K ⊆ H ⊆ G ∩ (K + ¬A) 23 (C2) For every maximal ¬A-permitting fallback K in F(≤G), there exists some L-theory H such that GR -A H and K ⊆ H ⊆ G ∩ (K + ¬A). (C3) If A ∈ L, then GR -A H iff G = H. (C3) takes care of the limiting case. The figure below illustrates the principal case, in which A ∉ L: Figure 7. As is easily seen, K and G ∩ K + ¬A are the lower and the upper limit for the contraction H represented by the shaded area. Clearly, the present proposal does not imply Recovery (nor does it imply Harper, for that matter): in figure 7, H + A differs from the original theory G. Also, on this proposal, some propositions that are at most as entrenched as A may be retained in a contraction with A (cf. proposition B, in the figure). Although it does not imply Harper, the present proposal entails the Levi identity. Lemma 6.1. Let <L, ≤ > be an entrenchment system and let R be the corresponding revision relation defined from ≤ via (D≤). Suppose that R - ⊆ TL × Φ × TL is any relation satisfying (C1) - (C3). Then R and Rsatisfy Levi. This fact shows that there is no fundamental incompatibility between our definition of revision from entrenchment and Levi's interpretation of revision in terms of contraction. Given that the contraction relation respects the entrenchment ordering in the way indicated by (C1) - (C3), the two interpretations of revision are going to coincide. 24 Appendix: Proofs of Lemmas and Theorems Proof of Lemma 3.3: (F1) Let Γ ∈ F(≤). Suppose Γ aL A. We have to show that A ∈ Γ. By the compactness of L, there are B1,..., Bn ∈ Γ such that B1,..., Bn aL A. By the deduction theorem and propositional logic, aL B1 ∧ ... ∧ Bn → A. That is,.B1 ∧ ... ∧ Bn aL A. (≤2) then yields that B1 ∧ ... ∧ Bn ≤ A. By the closure of Γ under ∧, B1 ∧ ... ∧ Bn ∈ Γ. But then, since Γ is closed upwards under ≤, A ∈ Γ. (F2) Let X ⊆ F(≤). Consider ∩X. L ⊆ ∩X, so ∩X ≠ ∅. Suppose that A ∈ ∩X and A ≤ B. Then A ∈ H, for all H in X. Consequently, B ∈ H, for all H in X. That is, B ∈ ∩X. We have shown that ∩X is closed upwards under ≤. Now, let A, B ∈ ∩X. Then A and B both belong to all theories in X. Hence, the same is true for A ∧ B. It follows that A ∧ B ∈ ∩X. This completes the proof that ∩X is a filter. (F3) Let X be a non-empty directed set of elements in F(≤). Consider ∪X. Clearly, L ⊆ ∪X, so ∪X ≠ ∅. Suppose A ∈ ∪X and A ≤ B. Then, for some H ∈ X, A ∈ H. Since H is a filter, B ∈ H. It follows that B ∈ ∪X. Now, let A, B ∈ ∪X. Then there are H1 and H2 in X such that A ∈ H1 and B ∈ H2. Since X is directed, there is a K ∈ X such that H1 ⊆ K and H2 ⊆ K. Hence, A, B ∈ K. But then A ∧ B ∈ K, since K is a filter. Hence, A ∧ B ∈ ∪X. (F4) Suppose H is a proper filter. We want to show that H ⊆ G. If G is inconsistent, there is nothing to prove. So, we assume that ⊥ ∉ G. Suppose now that A ∈ H. Since H is proper, not(A ≤ ⊥). It follows by (≤4) that A ∈ G. Hence, H ⊆ G. (F5) Let A ∈ L and A ≤ B. Then Τ aL A. Using (≤2) we then get T ≤ A. (≤1) yields Τ ≤ B. This in turn implies B ∈ L by means of (≤5). Since L is non-empty and closed under conjunction, it follows that L is a filter. (F6) If G is inconsistent, then clearly G ∈ F(≤). So assume that ⊥ ∉ G. Suppose A ∈ G and A ≤ B. Using (≤4) we conclude that not(A ≤ ⊥). This together with A ≤ B then implies not(B ≤ ⊥) (using (≤1)). Applying (≤4) again, we get B ∈ G. Hence, G is closed upwards under ≤. Since, G is an L-theory, it is non-empty and closed under conjunctions. Hence, G ∈ F(≤). o Proof of Lemma 3.4: Let ∆ = {A: ∃ B1,..., Bn ∈ Γ (n ≥ 1), B1 ∧ ... ∧ Bn ≤ A}. We want to show that: (i) ∆ ⊆ ↑(Γ); and (ii) ↑(Γ) ⊆ ∆. (i) Let H ∈ F(≤) such that Γ ⊆ H. Suppose that ∃ B1,..., Bn ∈ Γ (n ≥ 1), B1 ∧ ... ∧ Bn ≤ A. Then, by by the definition of a filter, B1 ∧ ... ∧ Bn ∈ H. Hence, once again by the definition of a filter, A ∈ H. Thus, ∆ ⊆ ↑(Γ). (ii) It suffices to prove that ∆ is a filter that includes Γ. Let A ∈ Γ. By (≤2), A ≤ A, so A ∈ ∆, by the definition of ∆. Thus Γ ⊆ ∆. Since Γ ≠ ∅, it follows that ∆ ≠ ∅. 25 Suppose that A ∈ ∆ and A ≤ B. Then, for some B1,..., Bn ∈ Γ, B1 ∧ ... ∧ Bn ≤ A. By (≤1) it follows that B1 ∧ ... ∧ Bn ≤ B. Hence, B ∈ ∆. Now, let A1, A2 ∈ ∆. Then there are B1,..., Bn, C1,..., Cm ∈ Γ such that B1 ∧ ... ∧ Bn ≤ A1 and C1 ∧ ... ∧ Cm ≤ A2. But B1 ∧ ... ∧ Bn ∧ C1 ∧ ... ∧ Cm ≤ B1 ∧ ... ∧ Bn and B1 ∧ ... ∧ Bn ∧ C1 ∧ ... ∧ Cm ≤ C1 ∧ ... ∧ Cm by (≤2). Hence, by (≤1), B1 ∧ ... ∧ Bn ∧ C1 ∧ ... ∧ Cm ≤ Ai (i = 1, 2). It follows, using (≤3) that B1 ∧ ... ∧ Bn ∧ C1 ∧ ... ∧ Cm ≤ A1 ∧ A2. Thus, A1 ∧ A2 ∈ ∆. o Proof of Theorem 3.14: Suppose that ME(≤) ⊆ X ⊆ E(≤). That ≤ ⊆ ∩E(≤) immediately follows from condition (i) in the definition of a minimal connected extension of ≤. But since X ⊆ E(≤), ∩E(≤) ⊆ ∩X. Hence, ≤ ⊆ ∩X. In order to prove that ∩X ⊆ ≤, suppose that for some A and B, A ≤/ B. We want to show that for some ≤' ∈ ME(≤), A ≤/ ' B. If A ≤/ B, then for some fallback K ∈ F(≤), A ∈ K but B ∉ K (Cf. Lemma 3.6). We are now going to prove two claims: Claim 1. If K ∈ F(≤), then there is some maximal chain C in F(≤) such that K ∈ C. Claim 2. If C is a maximal chain in F(≤), then the entrenchment ordering ≤' defined from C via: (D) A ≤' B iff for all H ∈ C, if A ∈ H, then B ∈ H, belongs to ME(≤). Since we have assumed that A ∈ K but B ∉ K, it will follow from claims 1 and 2 that for some ≤' ∈ ME(≤), A ≤/ ' B. But then, since ME(≤) ⊆ X, there is some ≤' ∈ X such that A ≤/ ' B. It follows that ≤ ⊆ ∩X. To prove Claim 1, consider the set K = {C: C is a chain in F(≤) and K ∈ C}. It is easy to see that K is non-empty and that every chain C ⊆ K has an upper bound in K (namely, ∩C). Hence, by Zorn's lemma, there is a maximal element C in K. Q.E.D. To prove claim 2, consider a maximal chain C in F(≤) and define ≤' via (D). It is obvious that C is a fallback family for G. Therefore, by Lemma 3.9, ≤' is an entrenchment ordering for G. Moreover, ≤' is connected (cf. Lemma 3.11). It is also clear that ≤ ⊆ ≤'. It remains to show that ≤' satisfies condition (iii) in the definition of a minimal connected extension of ≤. Suppose it does not. Then, there is some connected entrenchment ordering ≤" for G such that ≤ ⊆ ≤" ⊂ ≤'. Then, by lemma 3.11, F(≤") is a chain. Since ≤ ⊆ ≤", F(≤") ⊆ F(≤). Since ≤" ⊂ ≤', C (= F(≤')) ⊂ F(≤'). But this is impossible, since a maximal chain in F(≤) cannot be properly included in another chain in F(≤). o Proof of Lemma 4.3: We first show how to obtain (R8) from (R7). In (R7) replace A by A ∧ B and B by A. We then get: 26 If GRA∧BH and ∀K(GR(A∧B)∨AK → ¬(Α ∧ B) ∉ K), then ∃K(GR(A∧B)∨AK and H = K + (Α ∧ B)). However, since (A ∧ B) ∨ A is tautologically equivalent to A, we have by (R5): If GRA∧BH and ∀K(GRAK → ¬(Α ∧ B) ∉ K), then ∃K(GRAK and H = K + (Α ∧ B)). This in turn implies (using (R2)): If GRA∧BH and ∀K(GRAK → ¬B ∉ K), then ∃K(GRAK and H = K + (Α ∧ B)). Using (R2) again, we get: If GRA∧BH and ∀K(GRAK → ¬B ∉ K), then ∃K(GRAK and H = K + B), that is, (R8). To get (R7) from (R8), replace A by A ∨ B and B by A in (R8). We thus obtain: If GR(A∨B)∧AH and ∀K(GRA∨BK → ¬A ∉ K), then ∃K(GRA∨BK and H = K + A). Using (R5), we get: If GRAH and ∀K(GRA∨BK → ¬A ∉ K), then ∃K(GRA∨BK and H = K + A), which is (R7). Next, we derive (R9) from the other principles. First, substitute A ∨ B for A and C for B in (R7). We then get: (∗) If GRA∨BH and ∀K(GRA∨B∨CK → ¬(A ∨ B) ∉ K), then ∃K(GRA∨B∨CK and H = K + (A ∨ B)). We now assume the antecedent of (R9), that is: (i) GRA∨BH and ¬B ∈ H; and (ii) ∀K(GRB∨CK → ¬B ∉ K), in order to prove the consequent, namely: GRA∨CH and ¬C ∈ H. Claim 1: ∀K(GRA∨B∨CK → ¬(A ∨ B) ∉ K). In order to prove Claim 1, suppose that GRA∨B∨CK and ¬(A ∨ B) ∈ K. Assume also that K is inconsistent. Then, by (R4), ¬(A ∨ B ∨ C) ∈ L. This implies that also ¬(B ∨ C) ∈ L. By (R1), there is some K' such that GRB∨CK'. (R2) yields that B ∨ C ∈ K'. Hence, K' is inconsistent and, therefore, K' = K. Thus, GRB∨CK. Then (ii) yields ¬B ∉ K, contrary to the assumed inconsistency of K. Hence, K is consistent. By the supposition and (R2), we have that C ∈ K. Hence, B ∨ C ∈ K. K is consistent, so ¬(B ∨ C) ∉ K. Since K = K +(B ∨ C), we then get using (R1) and (R3), GRB∨CK. Finally, (ii) yields ¬B ∉ K, contrary to the supposition. From (i), Claim (1) and (∗) we conclude that there is a K such that: 27 GRA∨B∨CK and H = K + (A ∨ B). Observe that it follows from Claim (1) that K is consistent. ¬B ∈ K implies that A ∨ B → ¬B ∈ K. But A ∨ B → ¬B is tautologically equivalent to ¬B, so ¬B ∈ K. This in turn implies that K + (A ∨ B) = K + A, so H = K + A. Claim 2: GRA∨CK. In order to prove this, we first observe that A ∨ C ∈ K. This follows from the facts that A ∨ B ∨ C ∈ K and ¬B ∈ K. Since K is consistent, we have that ¬(A ∨ C) ∉ K. (R1) and (R3) then yields GRA∨CK + (A ∨ C). But K + (A ∨ C) = K, so GRA∨CK. Claim 3: ¬C ∈ K. Suppose ¬C ∉ K. Then ¬(B ∨ C) ∉ K. Hence, GRB∨CK + (B ∨ C). (ii) then yields ¬B ∉ K + (B ∨ C), but this contradicts the fact that ¬B ∈ K. It follows from Claim 2 using (R2) that A ∨ C ∈ K. This together with Claim 3 implies that A ∈ K. Hence, H = K + A = K. Thus, we have proved that GRA∨CH and ¬C ∈ H. o Proof of Theorem 4.5: (R1). If ¬A ∈ L, then GRAΦ, by Definition 4.1. Suppose now that ¬A ∉ L. Then L is an A-permitting fallback in F(≤G). By Lemma 3.13, there exists a maximal A-permitting fallback K relative to ≤G. Let H = K + A. Then, by the definition of R and Definition 4.1, GRAH. (R2) Follows from Definition 4.1 and the definition of R. (R3) Suppose ¬A ∉ G and GRAH. All proper fallbacks are included in G (condition (F4)). Since G is A-permitting, G must be the only maximal A-permitting fallback for G. By the supposition, H = K + A, for some maximal A-permitting fallback for G. Hence, H = G + A. (R4) Suppose ¬A ∉ L and GRAH. Then there is some maximal A-permitting fallback K such that H = CnL(K ∪ {A}). But if ⊥ ∈ H, then (A → ⊥) ∈ K, that is, ¬A ∈ K. This is contrary to K being A-permitting. Hence, ⊥ ∉ H. (R5) If aL A ↔ B, then the maximal A-permitting fallbacks are exactly the maximal B-permitting ones. We also have that ¬A ∈ L iff ¬B ∈ L, in this case. Hence, GRAH iff GRBH. (R6) Suppose GRAH and ¬B ∉ H. Then there is a maximal A-permitting fallback K in F(≤G) such that H = K + A. Suppose ¬(A ∧ B) ∈ K. Then A → ¬B ∈ K. The deduction theorem then yields ¬B ∈ H, contrary to the supposition. Thus K is A ∧ Bpermitting. Assume now that K ⊂ K' and that K' is A ∧ B-permitting. Then K' is A-permitting, contrary to the assumption that K is maximal A-permitting. Hence, K is maximal A 28 ∧ B-permitting. But this in turn implies that GRA∧B(K + (A ∧ B)). But, K + (A ∧ B) = (K + A) + B = H + B. Hence, GRA∧B(H + B). (R7) Suppose that GRAH and ∀K(GRA∨BK → ¬A ∉ K). By (R1), there exists a theory K0 such that GRA∨BK0. The supposition, then implies that ¬A ∉ K0. Hence, ¬A ∉ L. It follows that there exists a maximal A-permitting fallback K1 in F(≤G) such that H = K1 + A. Claim: K1 is a maximal A ∨ B-permitting fallback. Suppose not. Then there is a A ∨ B-permitting fallback K2 such that K1 ⊂ K2. Now, let K = K2 + (A ∨ B). Then GRA∨BK and ¬A ∈ K, contrary to the assumption. Let now K = K1 + (A ∨ B). Then GRA∨BK and H = K1 + A = K1 + (A ∨ B) ∧ A = (K + (A ∨ B)) + A = K + A. That is, ∃K(GRA∨BK and H = K + A). Finally, we prove the equivalence: (D≤) A ≤G B iff either B ∈ L or ∀H(if GR¬(A∧B)H, then A ∉ H). Suppose A ≤G B and that B ∉ L. Let GR¬(A∧B)H. A ∧ B ∉ L, so H is consistent by (R4). It follows that there exists a maximal ¬(A ∧ B)-permitting fallback K in F(≤G) such that H = K + ¬(A ∧ B). Assume now that A ∈ H. Then ¬(A ∧ B) → A ∈ K. But ¬(A ∧ B) → A is tautologically equivalent to A, so A ∈ K. A ≤G B then implies by Lemma 3.6 that B ∈ K. It follows that B ∈ H. On the other hand, ¬A ∨ ¬B ∈ H and A ∈ H imply that ¬B ∈ H, which contradicts the consistency of H. Hence, A ∉ H. This concludes the proof of the left-to-right direction of (D≤). For the direction from right to left, we first note that B ∈ L implies that A ≤G B, by (≤2). Suppose A and B satisfy the condition ∀H(if GR¬(A∧B)H, then A ∉ H) and let K ∈ F(≤G) be such that B ∉ K, that is, K is ¬B-permitting. It follows that K is also ¬(A ∧ B)-permitting, so, by Lemma 3.13, there is a maximal ¬(A ∧ B)-permitting fallback K' in F(≤G) such that K ⊆ K'. Let H = K' + ¬(A ∧ B). Then GR¬(A∧B)H, so by the supposition, A ∉ H. Since K ⊆ K' ⊆ H, it follows that A ∉ K. We have shown that for all K ∈ F(≤G), if A ∈ K, then B ∈ K. Finally, Lemma 3.6 yields that A ≤G B. o Proof of Theorem 4.6: Consider any L-theory G and let ≤ be ≤G defined via (D≤). We proceed to prove that ≤ satisfies the axioms for an entrenchment ordering (cf. Definition 3.1). We first prove Dominance. (≤2) Suppose that A aL B. We have to show that A ≤ B, that is, either B ∈ L or ∀H(if GR¬(A∧B)H, then A ∉ H). Suppose B ∉ L and consider any H such that GR¬(A∧B)H. ¬(A ∧ B) is L-consistent, since B ∉ L. Thus, by Strong Consistency, H is L-consistent. By Success, ¬(A ∧ B) ∈ H. Suppose A ∈ H. Then ¬B ∈ H. Since A aL B, we also have that B ∈ H, contrary to the consistency of H. Thus, A ∉ H. 29 (≤1) Suppose A ≤ B and B ≤ C. We have to show that A ≤ C. Suppose that the latter condition does not hold. Then by (D≤), C ∉ L and there is a H such that (i) GR¬(A∧C)H and A ∈ H. Since C ∉ L, (≤2) entails that B ∉ L. This together with A ≤ B implies that (ii) ∀K(if GR¬(A∧B)K, then A ∉ K). (i) and (ii) yield by (R9) that (iii) GR¬(C∧B)H and B ∈ H. (To see this substitute in (R9) ¬C, ¬A and ¬B for A, B and C, respectively.) Given that C ∉ L. (iii) implies via (D≤) that not B ≤ C, contrary to the assumption. (≤3) We first prove that the following principle holds for belief revision: (C) If GRA∨B∨CH and ¬C ∈ H, then GRA∨C(H+A) or GRB∨C(H+B). The proof of (C) mainly depends on Revision by Conjunction (R6). First, note that (C) would hold if H is L-inconsistent. To prove this, one uses Strong Consistency and Success. Hence, assume GRA∨B∨CH, ¬C ∈ H and that H is consistent. Success and the consistency of H imply that ¬A ∉ H or ¬B ∉ H. Suppose that ¬A ∉ H. Note that aL A ∨ C ↔ [(A ∨ B ∨ C) ∧ (A ∨ C)]. Since ¬A ∉ H, ¬(A ∨ C) ∉ H. Thus, applying Revision by Conjunction and Substitutivity, we get GRA∨C(H+(A∨C)). But ¬C ∈ H, so H+(A∨C) = H + A. By a similar reasoning, we can prove that GRB∨C(H+B), if ¬B ∉ H. This completes the proof of (C) To prove (≤3), assume that A ≤ B and A ≤ C but not A ≤ B ∧ C. Let us first consider the case when either B ∈ L or C ∈ L. Then B ∧ C is tautologically equivalent to either C or B. In each case, Dominance and Transitivity will imply that A ≤ B and A ≤ C entails A ≤ B ∧ C. Therefore, suppose that neither B ∈ L nor C ∈ L. Since we have assumed that not A ≤ B ∧ C, (D≤) implies that for some Η, GR¬(A∧B∧C)H and A ∈ H. Substituting in (C) ¬C for A, ¬B for B and ¬A for C, we get: If GR¬C∨¬B∨¬CH and Α ∈ H, then GR¬C∨¬Α(H+¬C) or GR¬B∨¬A(H+¬B), or equivalently: If GR¬(A∧B∧C)H and Α ∈ H, then GR¬(A∧C)(H+¬C) or GR¬(A∧B)(H+¬B). Since we have assumed the antecedent, the consequent holds, i.e., GR¬(A∧C)(H+¬C) or GR¬(A∧B)(H+¬B). Since A ∈ H, A ∈ H + ¬C and A ∈ H + ¬B. The first disjunct above therefore implies the existence of some K such that GR¬(A∧C)K and A ∈ K. This, however, contradicts the assumption that A ≤ C and C ∉ L. Analogously, the second disjunct contradicts the assumption that A ≤ B and B ∉ L. This concludes the proof. (≤4) Note that Expansion has the following special case: (Τ) If ⊥ ∉ G and GRΤH, then H = G. To prove (≤4), we first consider the case when ⊥ ∉ G and A ∉ G. We have to show that A ≤ ⊥, i.e., that either ⊥ ∈ L (which is excluded by the assumption 30 that L is consistent). or that ∀H(if GR¬(A∧⊥)H, then A ∉ H). Suppose that GR¬(A∧⊥)H. Since ¬(A ∧ ⊥) is L-equivalent to Τ, (Τ) and Substitutivity yield that H = G. But then A ∉ H, since we have assumed that A ∉ G. Next, we consider the case when ⊥ ∉ G and A ≤ ⊥. We have to show that A ∉ G. Since A ≤ ⊥ and ⊥ ∉ L, ∀H(if GR¬(A∧⊥)H, then A ∉ H). By Seriality, there exists a theory H such that GR¬(A∧⊥)H. By the same reasoning as above, H = G. Since A ∉ H, A ∉ G. (≤5) Suppose that Τ ≤ A. Then by (D≤), either A ∈ L, and we are done, or ∀H(if GR¬(Τ∧A)H, then Τ ∉ H). But Τ ∈ Η, for every theory H, so the latter alternative contradicts Seriality. Hence, A ∈ L. o Proof of Theorem 4.7: Suppose that R is functional, and that, for any G, we define ≤G in terms of R via (D≤). We then define F(≤G) from ≤G and, finally, we define S from F(≤G) via (DR). We want to prove that R ⊆ S, that is, for all G, H and A, if GRAH, then GSAH. It will then follow that S ⊆ R. To see this, we argue as follows: Since R is functional, ≤G will be connected. It follows that also S is functional. Suppose now that GSAH. By Seriality, GRAK, for some K. R ⊆ S then yields that GSAK. By the functionality of S, K = H. Hence, GRAH. Suppose now that GRAH. We want to prove that GSAH. If ¬A ∈ L, then, by Success, H is inconsistent. It immediately follows from the definition of S, that GSAH, in this case. Thus, we assume that ¬A ∉ L. Now, define: K = {B: not(B ≤G ¬A)}. We want to show that: (1) K ∈ F(≤G); (2) ¬A ∉ K; (3) for every T ∈ F(≤G), if K ⊂ T, then ¬A ∈ T. (1) -(3) imply that K is a maximal A-permitting fallback in F(≤G). Finally, we want to prove (4) H = K + A. Then it will follow that GSAH. Proof of (1): We first prove that K is closed upwards under ≤G. Suppose that B ∈ K (i.e., not(B ≤G ¬A)) and B ≤G C. We want to show that C ∈ K. If C ∉ K, then C ≤G ¬A. But then, since B ≤G C and ≤G is transitive, B ≤G ¬A, contrary to the assumption. Next, we prove that K is closed under conjunction. Suppose that B ∈ K and C ∈ K. We want to show that B ∧ C ∈ K. Suppose that this is not the case. Then B ∧ C ≤G ¬A. However, the connectedness of ≤G yields that B ≤G C or C ≤G B. In the 31 former case, B ≤G B (≤2) and B ≤G C, so B ≤G B ∧ C (by (≤3)). In the latter case, we get C ≤G B ∧ C in a similar way. Hence, B ≤G B ∧ C or C ≤G B ∧ C. But then, by transitivity, B ≤G ¬A or C ≤G ¬A. This contradicts the assumption that B ∈ K and C ∈ K. Proof of (2): ¬A ∉ K, since otherwise we would have that not ¬A ≤G ¬A, which is impossible given the fact that ≤G satisfies Dominance. Proof of (3): If K ⊂ T, then, for some C ∈ T, C ∉ K. Thus, C ≤G ¬A. But then, since T is closed upwards, ¬A ∈ T. Proof of (4): We want to prove that H = K + A, i.e., (i) B ∈ H iff A → B ∈ K. To prove (i) it is sufficient to prove: (ii) B ∈ H iff not(A → B ≤G ¬A). Now, by (D≤) and the fact that ¬A ∉ L, and the fact that R is functional, (iii) not(A → B ≤G ¬A) iff A → B ∈ T, where T is the (unique!) R-revision of G with ¬((A → B) ∧ ¬A). Now, ¬((A → B) ∧ ¬A) is L-equivalent to A. Hence, by Substitutivity, T is the R-revision of G with A. But then, T = H. Thus, to prove (ii), it is sufficient to prove: (iv) B ∈ H iff A → B ∈ H. But this is trivial in view of the fact that A ∈ H (by Success). o Proof of Lemma 5.1: We first consider the limiting case, in which ¬A ∈ L. In this case, (a) GRAH iff ⊥ ∈ H (by Success and Seriality) and (b) GR - ¬A K iff G = K, by (C3). To prove Levi from right to left, assume that GRAH. Then, by (a), ⊥ ∈ H. Therefore, since ¬A ∈ L, H = G + A. Also, by (b), GR-¬A G. Hence, the r. h. s. of Levi is satisfied for K = G. For the other direction, suppose that for some K, GR-¬A K and H = K + A. Since ¬A ∈ L, ⊥ ∈ H. But then (a) implies that GRAH. We now consider the principal case, in which ¬A ∉ L. We first prove Levi from left to right. Suppose GRAH. Then, by definition, there is some maximal A-permitting fallback K such that H = K + A. By (C2), there is some theory T such that GR-¬A T and K ⊆ T ⊆ G ∩ H. We want to show that H = T + A. Since K ⊆ T, the monotonicity of expansion yields K + A ⊆ T + A, that is, H ⊆ T + A. Since, T ⊆ H and H + A = H, monotonicity yields T + A ⊆ H. For the other direction of Levi, suppose that for some K, GR-¬A K and H = K + A. By (C1), there is a maximal A-permitting fallback T such that T ⊆ K ⊆ G ∩ (T + A). 32 By the definition of revision, GRA(T + A). Thus, GRAH will follow if we can prove that K + A = T + A. Since T ⊆ K, T + A ⊆ K + A. Since K ⊆ T + A, K + A ⊆ (K + A) + A = K + A. o NOTES * The inspiration for this paper comes from our discussions with the participants of the Workshop on the Logic of Theory Change - Konstanz, October 13 15, 1989. We want to thank them a l l . Special thanks go to the organizers of the conference André Fuhrmann and Michael Morreau. We are also grateful to Sven Ove Hansson and Hans Rott for their very helpful comments on an earlier version. 1 Department of Philosophy, University of Uppsala, Villavägen 5, S-752 36 Uppsala, Sweden. 2 Actually, Grove works with an ordering of epistemic plausibility . But as Gärdenfors (1988, sect. 4.8) points out, the notions of plausibility and entrenchment are interdefinable. Thus, a proposition A is at least as plausible as a proposition B given the agent's beliefs if and only if non-B is at least as entrenched as non-A in the agent's belief set. The notion of epistemic entrenchment is primarily defined for the propositions that belong to the agent's belief set: one adopts the convention tha t propositions that are not believed by the agent are minimally entrenched. On the other hand, the notion of plausibility primarily applies to the propositions that are incompatible with the agent's beliefs (the propositions that are compatible with what he believes are all taken to be equally and maximally plausible). Thus, this is a notion of conditional plausibility. A is at least as plausible as B in this sense iff the following holds: on the condition that I would have to revise my beliefs with A ∨ B, I should change them in such a way as to allow for A. 3 Cf. our informal characterization of epistemic entrenchment above. 4 For the notion of a closure system and other basic notions from universal algebra and lattice theory that appear in this section, see for example Grätzer (1979), Chap 1 and Rasiowa & Sikorski (1970), Chap 1. 5 Rott assumes connectedness for entrenchment. Therefore, he works with nested families of fallbacks, or, as he calls them, "EE-cuts". 6 Cf. Rott (1989), for the same observation. REFERENCES Alchourrón, C. E., Gärdenfors, P., and Makinson, D. (1985) 'On the logic of theory change: Partial meet contraction and revision functions', Journal of Symbolic Logic 50, 510-530. Gärdenfors, P. (1988) Knowledge in Flux: Modeling the Dynamics of Epistemic States, Bradford Books, MIT Press. Grove, A. (1988) 'Two modellings for theory change', Journal of Philosophical Logic 17, 157-170. Grätzer, G. (1979) Universal Algebra (Second Edition), Springer Verlag. Levi, I. (1980) The Enterprise of Knowledge, the MIT Press. Lindström, S. and Rabinowicz, W. (1989) 'On Probabilistic Representation of NonProbabilistic Belief Revision', Journal of Philosophical Logic 18, 69-101. Lindström, S. and Rabinowicz, W. (1990) 'Belief Revision, Epistemic Conditionals and the Ramsey Test', Uppsala Philosophy Reports no 1, 1990. Niederée, R. (1990) 'Multiple Contraction. A Further Case Against Gärdenfors' Principle of Recovery', this volume. Rasiowa, H., and Sikorski, R. (1970) The Mathematics of Metamathematics (Third edition), PWN -Polish Scientific Publishers, Warsaw. Rott, H. (1989) 'Two Methods of Contractions and Revisions of Knowledge Systems'. In Michael Morreau (ed.), Proceedings of the Tübingen Workshop on Semantic Networks and Non-Monotonic Reasoning, Vol. 1, SNS-Bericht 89-48, Tübingen, pp. 2847.