A Neutral Temporal Deontic STIT Logic? Kees van Berkel(B) and Tim Lyon Institut für Logic and Computation, Technische Universität Wien, Austria {kees,lyon}@logic.at Abstract. In this work we answer a long standing request for temporal embeddings of deontic STIT logics by introducing the multi-agent STIT logic TDS. The logic is based upon atemporal utilitarian STIT logic. Yet, the logic presented here will be neutral: instead of committing ourselves to utilitarian theories, we prove the logic TDS sound and complete with respect to relational frames not employing any utilitarian function. We demonstrate how these neutral frames can be transformed into utilitarian temporal frames, while preserving validity. Last, we discuss problems that arise from employing binary utility functions in a temporal setting. Keywords: Deontic logic * Logics of agency * Modal logic * Multi-agent STIT logic * Temporal logic * Utilitarianism 1 Introduction With the increasing integration of automated machines in our everyday lives, the development of formal decision-making tools, which take into account moral and legal considerations, is of critical importance [2,9,10]. Unfortunately, one of the fundamental hazards of incorporating ethics into decision-making processes, is the apparent incomparability of quantitative and qualitative information-that is, moral problems most often resist quantification [16]. In contrast, utility functions are useful quantitative tools for the formal analysis of decision-making. Initially formulated in [5], the influential theory of utilitarianism has promoted utility calculation as a ground for ethical deliberation: in short, those actions generating highest utility, are the morally right actions. For this reason, utilitarianism has proven itself to be a fruitful approach in the field of formal deontic reasoning and multi-agent systems (e.g. [1,12,15]). In particular, in the field of STIT logic-agency logics developed primarily for the formal analysis of multi-agent choice-making-the utilitarian approach has received increased attention (e.g. [1,15]). Unfortunately, each available utility function comes with its own (dis)advantages, giving rise to several puzzles (some of them addressed in [12,13]). To avoid such problems, we provide an alternative ? This is a pre-print of an article published in Logic, Rationality, and Interaction. The final authenticated version is available online at: https://doi.org/10.1007/ 978-3-662-60292-8_25. Work funded by the projects WWTF MA16-028, FWF I2982 and FWF W1255-N23. 2 K. van Berkel and T. Lyon approach: instead of settling these philosophical issues, we develop a neutral formalism that can be appropriated to different utilitarian value assignments. The paper's contributions can be summed up as follows: First, we provide a temporal deontic STIT logic called TDS (Sec. 2). With this logic, we answer a long standing request for temporal embeddings of deontic STIT [4,12,15]. Second, although TDS is based upon the atemporal utilitarian STIT logic from [15], the semantics of TDS will be neutral: instead of committing to utilitarianism, we prove soundness and completeness of TDS with respect to relational frames not employing any utilitarian function (Sec. 3). This approach also extends the results in [3,11,14] by showing that TDS can be characterized without using the traditional branching-time (BT+AC) structures (cf. [4]). Third, we show how neutral TDS frames can be transformed into utilitarian frames, while preserving validity (Sec. 4). Last, we discuss the philosophical ramifications of employing available utility functions in the extended, temporal setting. In particular, we will argue that binary utility assignments can turn out to be problematic. 2 A Neutral Temporal Deontic STIT Logic In this section, we introduce the language, semantics, and axiomatization of the temporal deontic STIT logic TDS. In particular, we provide neutral relational frames characterizing the logic, which omit mention of specific utility functions. The logic will bring together atemporal deontic STIT logic, presented in [15], and the temporal STIT logic from [14]. Definition 1 (The Language LTDS). Let Ag = {1, 2, ..., n} be a finite set of agent labels and let V ar = {p1, p2, p3...} be a countable set of propositional variables. The language LTDS is given by the following BNF grammar: φ ::= p | ¬φ | φ ∧ φ | φ | [i]φ | [Ag]φ | Gφ | Hφ | ⊗i φ where i ∈ Ag and p ∈ V ar. The logical connectives disjunction ∨, implication →, and bi-conditional ↔ are defined in the usual way. Let ⊥ be defined as p∧¬p and define > to be p∨¬p. The language consists of single agent STIT operators [i], which are choice-operators describing that 'agent i sees to it that', and the grand coalition operator [Ag], expressing 'the grand coalition of agents sees to it that'. Furthermore, it contains a settledness operator , which holds true of a formula that is settled true at a moment, and thus, holds true regardless of the choices made by any of the agents at that moment. The operators G and H have, respectively, the usual temporal interpretation 'always going to be' and 'always has been'. Last, the operator ⊗i expresses 'agent i ought to see to it that'. We define , 〈i〉, 〈Ag〉 and i as the duals of , [i], [Ag] and ⊗i, respectively (i.e. φ iff ¬¬φ, etc.). Furthermore, let Fφ iff ¬G¬φ and Pφ iff ¬H¬φ, expressing 'φ holds somewhere in the future' and 'φ holds somewhere in the past', respectively. Finally, deliberative STIT and deliberative ought are obtained accordingly: [i]dφ iff [i]φ ∧ ♦¬φ and ⊗di φ iff ⊗iφ ∧ ¬φ. For a discussion of these operators we refer to [12,14]. A Neutral Temporal Deontic STIT Logic 3 In line with [3,6,11,14], we provide relational frames for TDS instead of introducing the traditionally employed, BT+AC frames (cf. [4]). Explanations of the individual frame properties of Definition 2 can be found below. Definition 2 (Relational TDS Frames and Models). A TDS-frame is defined as a tuple F = (W,R, {R[i] | i ∈ Ag},R[Ag],RG,RH, {R⊗i | i ∈ Ag}). Let R[α](w) := {v ∈W |(w, v) ∈ R[α]} for [α] ∈ Boxes where Boxes := {,G,H, [Ag]}∪ {[i] | i ∈ Ag}∪{⊗i | i ∈ Ag}. Let W be a non-empty set of worlds w, v, u... and: I For all i ∈ Ag, R,R[i],R[Ag] ⊆W×W are equivalence relations such that: (C1) R[i] ⊆ R. (C2) For all u1, ..., un ∈ W , if Ruiuj for all 1 ≤ i, j ≤ n, then⋂ iR[i](ui) 6= ∅. (C3) For all w ∈W , R[Ag](w) ⊆ ⋂ i∈AgR[i](w). I RG ⊆ W × W is a transitive and serial binary relation and RH is the converse of RG, such that: (T4) For all w, u, v ∈ W , if RGwu and RGwv, then RGuv, u = v, or RGvu. (T5) For all w, u, v ∈ W , if RHwu and RHwv, then RHuv, u = v, or RHvu. (T6) RG ◦ R ⊆ R[Ag] ◦ RG (relation composition ◦ is defined as usual). (T7) For all w, u ∈W , if u ∈ R(w), then u 6∈ RG(w). I For all i ∈ Ag, R⊗i ⊆W×W are binary relations such that: (D8) R⊗i ⊆ R. (D9) For all w ∈ W there exists a v ∈ W such that Rwv and for all u ∈W , if R[i]vu then R⊗iwu. (D10) For all w, v, u, z ∈W , if Rwv,Rwu and R⊗iuz, then R⊗ivz. (D11) For all w, v ∈ W , if R⊗iwv then there exists u ∈ W s.t. Rwu, R[i]uv, and for all z ∈W , if R[i]uz then R⊗iwz. A TDS-model is a tuple M = (F, V ) where F is a TDS-frame and V is a valuation mapping propositional variables to subsets of W , that is, V : V ar → P(W ). We label the properties of Definition 2 referring to choice (Ci), those relating to temporal aspects (Ti), and those capturing deontic properties (Di). Observe that, since R is an equivalence relation, we obtain equivalence classes R(w) = {v | (w, v) ∈ R}. Furthermore, by condition (C1) we know that R[i] is an equivalence relation partitioning the equivalence classes of R. We call R(w) a moment and for each v in a moment R(w), we refer to R[i](v) as a choice-cell for agent i at moment R(w). In the following, we shall frequently refer to moments and choices in the above sense. Condition (C2) captures the pivotal independence of agents principle for STIT logics, ensuring that at every moment, any combination of different agents' choices is consistent: i.e., simulta4 K. van Berkel and T. Lyon neous choices are independent (see [4, 7C.4]). (C3) ensures that all agents acting together is a necessary condition for the grand coalition of agents acting.1 The conditions on RG and RH establish that the frames we consider are irreflexive, temporal orderings of moments. Properties (T4) and (T5) guarantee that histories-i.e., maximally ordered paths of worlds passing through moments-are linear. Condition (T6) ensures the STIT principle of no choice between undivided histories: if two time-lines remain undivided at the next moment, no agent has a choice that realizes one time-line and excludes the other (see [4, 7C.3]). Consequently, this principle also ensures that the ordering of moments is linearly closed with respect to the past and allows for branching with respect to the future: in other words, TDS-frames are treelike.2 Last, (T7) ensures the temporal irreflexivity of moments; i.e., the future excludes the present. For an elaborate discussion of the temporal frame conditions we refer to [14]. Last, the criteria (D8)-(D11) guarantee an essentially agentive characterization of the obligation operator ⊗i (cf. the impartial 'ought to be' operator in [12]). Condition (D8) ensures that ideal worlds are confined to moments: i.e., the ideal worlds accessible at a moment neither lie in the future nor in the past. (D9) ensures that, for each agent there is at every moment a choice available that is an ideal choice (cf. the corresponding 'ought implies can' axiom A14). Furthermore, (D10) expresses that, for each agent, if a world is ideal from the perspective of a particular world at a moment, that world is ideal from the perspective of any world at that moment: i.e., ideal worlds are settled upon moments. Condition (D11) captures the idea that every ideal world extends to a complete ideal choice: i.e., no choice contains both ideal and non-ideal worlds. Last, note that conditions (C2) and (D9) together ensure that every combination of distinct agents' ideal choices is consistent, i.e., non-empty. Definition 3 (Semantics for LTDS ). Let M be a TDS-model and let w ∈ W of M . The satisfaction of a formula φ ∈ LTDS in M at w is defined accordingly: 1. M,w|= p iff w ∈ V (p) 2. M,w|= ¬φ iff M,w 6|= φ 3. M,w|=φ∧ψ iff M,w|=φ and M,w|=ψ 4. M,w|= φ iff ∀u∈ R(w), M,u|= φ 5. M,w|= [i]φ iff ∀u∈ R[i](w), M,u|= φ 6. M,w|= ⊗iφ iff ∀u∈ R⊗i(w), M,u|= φ 7. M,w|=[Ag]φ iff ∀u∈R[Ag](w),M, u|=φ 8. M,w|= Gφ iff ∀u∈ RG(w), M,u|= φ 9. M,w|= Hφ iff ∀u∈ RH(w), M,u|= φ Global truth, validity, and semantic entailment are defined as usual (see [7]). The axiomatization of TDS is a composition of [15], together with [14]. (Note that in the language LTDS each agent label represents a distinct agent.) 1 In future work, we aim to study condition (C3) strengthened to equality, as in [14]. In such a setting, completeness is obtained by proving that each TDS-frame can be transformed into a frame (satisfying the same formulae) with strengthened (C3); hence, showing that the logic does not distinguish between the two frame classes. 2 The main reason why the grand coalition operator [Ag] is added to our language, is because it will allow us to axiomatize the no choice between undivided histories principle (see A25 of Definition 4). For a discussion of [Ag] we refer to [14]. A Neutral Temporal Deontic STIT Logic 5 Definition 4 (Axiomatization of TDS). For each i ∈ Ag we have, A0 All propositional tautologies. A1 (φ→ ψ)→ (φ→ ψ), A2 φ→ φ A3 φ→  φ A4 [i](φ→ ψ)→ ([i]φ→ [i]ψ) A5 [i]φ→ φ A6 〈i〉φ→ [i]〈i〉φ A7 [Ag](φ→ ψ)→ ([Ag]φ→ [Ag]ψ) A8 [Ag]φ→ φ A9 〈Ag〉φ→ [Ag]〈Ag〉φ A10 ∧ 0≤i≤n [i]φk →  ∧ 0≤i≤n[i]φk A11 ∧ 1≤i≤n[i]φi → [Ag] ∧ 1≤i≤n φi A12 ⊗i(φ→ ψ)→ (⊗iφ→ ⊗iψ) A13 φ→ ([i]φ ∧ ⊗iφ) A14 ⊗iφ→ [i]φ A15 ⊗i φ→ ⊗i φ A16 ([i]φ→ [i]ψ)→ (⊗iφ→ ⊗iψ) A17 G(φ→ ψ)→ (Gφ→ Gψ) A18 Gφ→ GGφ A19 Gφ→ Fφ A20 H(φ→ ψ)→ (Hφ→ Hψ) A21 φ→ GPφ A22 φ→ HFφ A23 FPφ→ Pφ ∨ φ ∨ Fφ A24 PFφ→ Pφ ∨ φ ∨ Fφ A25 F♦φ→ 〈Ag〉Fφ R0 `TDS(ψ→φ) and `TDSψ implies `TDS φ R1 `TDSφ implies `TDS[α]φ, [α]∈{,G,H} R2 `TDS (¬p∧(Gp∧Hp))→ φ implies `TDS φ, given p 6∈ φ A derivation of φ in TDS from a set Γ , written Γ `TDS φ, is defined in the usual way (See [7, Def. 4.4]). When Γ=∅, we say φ is a theorem, and write `TDS φ. The axioms, A1−A3, A4−A6 and A7−9 express the S5 behavior of , [i] (for each i∈Ag) and [Ag], respectively. A10 is the independence of agents axiom. A11 captures that 'all agents acting together implies the grand coalition of agents acting'. A13 is a bridge axiom linking ⊗i to  and [i] to  (cf. (C1) and (D8) of Definition 2). A14 corresponds to the 'ought implies can' principle (cf. (D9) of Definition 2). A15 ensures that, when possible, obligatory choices are settled upon moments (cf. (D10) of Definition 2). A16 can be understood as a conditional monotonicity principle for ideal choices (cf. (D11) of Definition 2). Axioms A12 and A13, together with the necessitation rule R1, ensure that ⊗i is a normal modal operator. With respect to the temporal axioms, A17−A19 capture the KD4 behavior of G, whereas, axioms A21 and A22 ensure that H is the converse of G. A23 and A24 capture connectedness of histories through moments and A25 characterizes no choice between undivided histories. Last, R2 is a variation of Gabbay's irreflexivity rule (the proofs of Theorem 1 and 2 give an indication of the rule's functions). 3 Soundness and Completeness of TDS In this section, we prove that TDS is sound and complete relative to the class of TDS-frames. In the next section, we show how such frames are transformable into frames employing utility assignments. This allows one to model and reason about utilitarian scenarios in a more fine-grained manner, while obtaining completeness of the logic without commitment to particular utility functions. Unless stated otherwise, all proofs in this section can be found in App. A. 6 K. van Berkel and T. Lyon Theorem 1. (soundness of TDS) ∀φ ∈ LTDS, `TDS φ implies |= φ. We prove completeness by constructing maximal consistent sets belonging to a special class and build a canonical TDS model adopting methods from [8,14]. Definition 5. A set of formulae Γ ⊆ LTDS is a maximally consistent set (MCS) iff (i) Γ 6`TDS ⊥, and (ii) for any set Γ ′ ⊆ LTDS, if Γ ⊂ Γ ′, then Γ ′ `TDS ⊥. Definition 6. (canonical model for TDS) Let [α] ∈ Boxes and let 〈α〉 be the operator dual to [α]. We define the canonical model to be the tuple Mdt := (W dt,Rdt , {Rdt[i] | i ∈ Ag},R dt [Ag], R dt G ,RdtH , {Rdt⊗i | i ∈ Ag}, V dt) such that: – W dt := {Γ ⊂ LTDS | Γ is an MCS}; – for all Γ,∆ ∈ W dt, (Γ,∆) ∈ Rdt[α] iff for all φ ∈ LTDS, if [α]φ ∈ Γ , then φ ∈ ∆ (for each [α] ∈ Boxes); – V dt is a valuation function s.t. ∀p ∈ Atom, V dt(p) := {∆ ∈W dt | p ∈ ∆}. Definition 7. (diamond saturated set [14]) Let X be a set of MCSs and let 〈α〉 be dual to [α] ∈ Boxes. We say that X is a diamond saturated set iff for all Γ∈X, for each 〈α〉φ ∈ Γ there exists a ∆ ∈ X such that R[α]Γ∆ and φ∈∆. In order to ensure that our canonical model will be irreflexive, we introduce a mechanism that allows us to encode MCSs with information that impedes reflexive points in the model. We call these encoded sets IRR-theories and restrict our canonical model to consist of these sets only. Last, we use the notation M |X to indicate a model M whose domain is restricted to the set X (see [8, Ch.6]). Lemma 1. Let X be a diamond saturated set with Γ ∈ X, φ ∈ LTDS, and let Mdt|X be the canonical model restricted to X. Then, Mdt|X , Γ |= φ iff φ ∈ Γ . Proof. Proven in the usual manner by induction on φ (see [7, Lem. 4.70]). Following [14], we let IRR-theories be those sets of TDS formulae that (i) are maximally consistent, (ii) contain a label name(p) := ¬p ∧ (Gp ∧ Hp), uniquely labeling a moment and (iii) for any world that is reachable through any 'zig-zagging' sequence of diamond operators, that is, every zig-zagging formula φ of the form, 〈α1〉(φ1 ∧ 〈α2〉(φ2 ∧ ... ∧ 〈αn〉φn))...) where 〈αi〉 is dual to [αi] ∈ Boxes with 1 ≤ i ≤ n, there exists a corresponding zig-zagging formula φ(q) (where q is a propositional variable) of the form, 〈α1〉(φ1 ∧ 〈α2〉(φ2 ∧ ... ∧ 〈αn〉(φn ∧¬q ∧(Gq ∧ Hq)))...) labeling reachable worlds. Let us make the above formally precise: Definition 8. (irr-theory) [14] Let Zig be the set of all zig-zagging formulae in LTDS and let name(p):= ¬p∧(Gp∧Hp) where p is a propositional variable. A set of formulae Γ is called an IRR-theory iff the following hold: A Neutral Temporal Deontic STIT Logic 7 – Γ is a MCS and name(p) ∈ Γ , for some propositional variable p; – if φ ∈ Γ ∩ Zig, then φ(q) ∈ Γ , for some propositional variable q. Henceforth, we refer to IRR as the set of all IRR-theories in LTDS. We now present lemmata relevant to the use of IRR-theories in canonical models. Lemma 2. Let φ ∈ LTDS be a consistent formula. Then, there exists an IRRtheory Γ such that φ ∈ Γ . Lemma 3. (existence lemma) Let Γ be an IRR-theory and let 〈α〉 be dual to [α] ∈ Boxes. For each 〈α〉φ ∈ Γ there exists an IRR-theory ∆ such that R[α]Γ∆. Subsequently, it must be shown that the canonical model restricted to the set IRR of IRR-theories (i.e., Mdt|IRR) is in fact a TDS model (henceforth, we use W dt and IRR interchangeably). First, we provide lemmata ensuring that the model satisfies the desired temporal and deontic properties of Definition 2. The first two follow from [14] and the latter four results are proven in App. A. Lemma 4 ([14]). (property (C2)) Let Γ1, ..., Γn ∈ IRR such that RdtΓiΓj for all 1 ≤ i, j ≤ n. Then, there exists a ∆ ∈ IRR such that Rdt1 Γ1∆, ...,Rdtn Γn∆. Lemma 5 ([14]). (property (T6)) Let Γ,Σ,Π ∈ IRR such that RdtG ΓΣ and RdtΣΠ. Then, there exists a ∆ ∈ IRR such that Rdt[Ag]Γ∆ and R dt G ∆Π. Lemma 6. (property (D9)) Let Γ ∈ IRR. Then, there exists a ∆ ∈ IRR such that RdtΓ∆ and for every Σ ∈ IRR, if Rdt[i]∆Σ, then R dt ⊗iΓΣ. Lemma 7. (property (D11)) Let Γ,∆ ∈ IRR such that Rdt⊗iΓ∆. Then, there exists a Σ ∈ IRR such that RdtΓΣ, Rdt[i]Σ∆, and for all Π ∈ IRR, if R dt [i]ΣΠ, then Rdt⊗iΓΠ. Lemma 8. The canonical model Mdt|IRR belongs to the class of TDS models. Theorem 2. (completeness) If φ ∈ LTDS is a consistent formula, then φ is satisfiable on a TDS-model. 4 Transformations to Utilitarian Models In this section, we investigate a truth preserving transformation from TDS models to utilitarian STIT models, embedded in a temporal language. In particular, we are concerned with the semantic characterization of the dominant ought [12, Ch.4]. We start with defining the semantic machinery needed to treat these oughts. In particular, we will introduce a utility function util that maps natural numbers (i.e. utilities) to worlds in our domain. In contrast to [12,15], we do not restrict the assignment of utilities to complete histories where all worlds on a maximal linear path have identical utility. The reason will be addressed at the 8 K. van Berkel and T. Lyon end of the section, where we discuss a problem related to utility assignments over histories, arising in temporal extensions of STIT. The pivotal notion involved in the dominant ought is that of a state: Agent i cannot influence the choices of all other agents and, for this reason, one can regard the joint interaction of all agents excluding i, as a state (of nature) for i. To be more precise, we define a state Rs[i](v) for i at v accordingly, Rs[i](v) = ⋂ k∈Ag\{i} Rk(v) Consequently, all possible combinations of choices available to the agents Ag\{i}, are the different states available at that moment to agent i. Subsequently, we define a preference order ≤ over choices (and subsets thereof). Let R[i](v),R[i](z) ⊆ R(w), then weak preference is defined accordingly, R[i](v) ≤ R[i](z) ⇐⇒ ∀v∗ ∈ R[i](v),∀z∗ ∈ R[i](z), util(v∗) ≤ util(z∗) That is, for an agent a choice is weakly preferred over another, when all values of the possible outcomes of the former are at least as high as those of the latter (where util(v) is the number assigned to v, etc). Strict preference is defined as, R[i](v) < R[i](z) ⇐⇒ R[i](v) ≤ R[i](z) ∧R[i](z) 6≤ R[i](v) Next, a dominance order  over choices R[i](v),R[i](z)⊆R(w) is defined as, R[i](v)  R[i](z) ⇐⇒ ∀Rs[i](x) ⊆ R(w),R[i](v) ∩R s [i](x) ≤ R[i](z) ∩R s [i](x) We say an agent's choice weakly dominates another, if the values of the outcomes of the former are weakly preferred to those of the latter choice, given any possible state available to that agent. For a discussion of dominance orderings see [12, Ch. 4]. Again, in the usual way we obtain strict dominance, R[i](v) ≺ R[i](z) ⇐⇒ R[i](v)  R[i](z) ∧R[i](z) 6 R[i](v) On the basis of the above, we now formally introduce temporal utilitarian STIT frames and models, defined over relational Kripke frames. Definition 9 (Relational TUS Frames and Models). Let R[α](w) := {v ∈ W |(w, v) ∈ Rα} for [α] ∈ {, [Ag],G,H} ∪ {[i]|i ∈ Ag}. A relational Temporal Utilitarian STIT frame (TUS-frame) is defined as a tuple F = (W,R, {R[i]|i ∈ Ag},R[Ag],RG,RH, util) where W is a non-empty set of worlds w, v, u... and: – For all i ∈ Ag, R, R[i], R[Ag] ⊆W ×W are equivalence relations for which conditions (C1)-(C3) of Definition 2 hold. – RG ⊆ W ×W is a transitive and serial binary relation, whereas RH is the converse of RG, and the conditions (T4)-(T7) of Definition 2 hold. – util : W 7→ N is a utility function assigning each world in W to a natural. A TUS-model is a tuple M = (F, V ) where F is a TUS-frame and V is a valuation function assigning propositional variables to subsets of W : i.e., V : V ar 7→ P(W ). A Neutral Temporal Deontic STIT Logic 9 Notice that the above TUS frames only differ from TDS frames through replacing the relations R⊗i and corresponding conditions (D8)-(D11) (for each i ∈ Ag) with the utility function util. We observe that the assignment of utilities to worlds is agent-independent. Nevertheless, since the choices of an agent depend on which worlds are inside the choice-cells available to the agent, the resulting obligations are in fact agent-dependent. Let us define the new semantics: Definition 10 (Semantics of TUS models). Let M be a TUS-model, w ∈W of M and ||φ||M = {w |M,w |= φ}. We define satisfaction of a formula φ ∈ LTDS as follows: – Clause (1)-(10) are the same as those from Definition 3, with the exception of clause (7), which we replace by the following clause (7∗): M,w |= ⊗iφ iff ∀R[i](v) ⊆ R(w) if R[i](v) 6⊆ ||φ|| then ∃R[i](z) ⊆ R(w) s.t. (i) R[i](v) ≺ R[i](z), (ii) R[i](z) ⊆ ||φ|| and (iii) ∀R[i](x) ⊆ R(w),R[i](z)  R[i](x) implies R[i](x) ⊆ ||φ|| Clause (7∗) is interpreted accordingly: Agent i ought to see to it that φ iff for every choice R[i](v) available to i that does not guarantee φ there (i) exists a strictly dominating choice R[i](z) that (ii) does guarantee φ and (iii) every weakly dominating choice R[i](x) over R[i](z) also guarantees φ. In other words, all choices not guaranteeing φ are strictly dominated only by choices guaranteeing φ. (We note that clause (7∗) is obtained through an adaption of the definition provided in [12] to relational frames.) We show that the logic TDS is also sound and complete with respect to the class of TUS-frames. Theorem 3. (soundness) ∀φ ∈ LTDS, if `TDS φ, then Cuf |= φ. Proof. We prove by induction on the given derivation of φ in TDS. The argument for axioms A0-A6 and A12 is the same as in Theorem 1. The validity of the axioms A7-A11 can be easily checked by applying semantic clause (7∗) of Definition 9. We now prove that the class Cuf of TUS-frames characterizes the same set of formulae as the class Cdf of TDS frames. We prove both directions separately: Theorem 4. ∀φ ∈ LTDS we have Cuf |= φ implies Cdf |= φ. Proof. We prove by contraposition assuming Cdf 6|= φ. Hence, there is a TDSmodel, Md = (W,R, {Ri|i ∈ Ag},RH,RG,RAg, {R⊗i |i ∈ Ag},V) such that Md, w |= ¬φ for some w ∈ W. We use Md to construct a model M in Cuf , such that: M = (W,R, {Ri|i ∈ Ag},RG,RH,RAg, util,V) We show that M, w′ |= ¬φ for some w′ ∈ W. To define M let W := W, R := R, Ri := Ri, RH := RH, RG := RG, RAg := RAg, V(p) := V(p) and let util be a function assigning each w ∈ W to a natural number, satisfying the following criteria: 10 K. van Berkel and T. Lyon 1. ∀i ∈ Ag,∀w, v, z ∈ W, if v, z ∈ R(w), v ∈ Rsi (w) \ R⊗i(w), and z ∈ Rsi (w) ∩R⊗i(w), then util(v) ≤ util(z); 2. ∀w, v, z ∈ W, if v ∈ R(w)\R⊗Ag (w) and z ∈ R⊗Ag (w), then util(v)<util(z); 3. ∀w, u, z ∈W , if v, z ∈ Rsi (w) ∩R⊗i(w), then util(v) = util(z); Let R⊗Ag := ⋂ i∈AgR⊗i , we call R[i](v) ⊆ R⊗i(w) an optimal choice for agent i. (It can be easily checked that the function util can be constructed.) We state the following useful lemma (the proof of which is found in App. A). Lemma 9. The following holds for any TDS frame: (1) ∀v ∈ R(w),R(w) = R(v); (2) ∀v ∈ Ri(w),Ri(w) = Ri(v); (3) ∀v ∈ Rsi (w),Rsi (w) = Rsi (v);(4) ∀v ∈ R(w) we get R⊗i(v) = R⊗i(w); (5) ∀R[i](z) ⊆ R(w), either R[i](z) ⊆ R⊗i(w) or R[i](z) ∩R⊗i(w) = ∅. We observe that conditions (C1)-(C3) and (T4)-(T7) will be satisfied in M since all of the relations of Md, with the exception of R⊗i , are identical to those in M. Moreover, util complies with Definition 9 and so M is in fact a TUS model. The desired claim will follow if we additionally show that ∀ψ ∈ LTDS and ∀w ∈ W: Md, w |= ψ ⇐⇒ M, w |= ψ We prove the claim by induction on the complexity of ψ. Base Case. Let ψ be a propositional variable p. By the definition of V in M it follows directly that Md, w |= p iff w ∈ V iff w ∈ V iff M, w |= p. Inductive Step. The cases for the propositional connectives and the modalities [α] ∈ {,H,G, [Ag]} ∪ {[i]|i ∈ Ag} are straightforward. We consider the nontrivial case when ψ is of the form ⊗iφ. Let us first prove the left to right direction. (=⇒) AssumeMd, w |= ⊗iφ. We show that M, w |= ⊗iφ. By the semantics for ⊗i (Definition 9) it suffices to prove that: ∀Ri(v) ⊆ R(w) if Ri(v) 6⊆ ||φ||M, then ∃Ri(u) ⊆ R(w) such that the following three clauses hold: (i) Ri(v) ≺ Ri(u); (ii) Ri(u) ⊆ ||φ||M; and (iii) ∀Ri(x) ⊆ R(w), Ri(u)  Ri(x) implies Ri(x) ⊆ ||φ||M. Let Ri(v) ⊆ R(w) be arbitrary and assume that Ri(v) 6⊆ ||φ||M. We prove that there is a Ri(u) ⊆ R(w) for which conditions (i)-(iii) hold. First, we prove the existence of such a Ri(u) ⊆ R(w): By (C1) and (D9) of Definition 2, we know, ∃u ∈ W such that Ri(u) ⊆ R(w) and Ri(u) ⊆ R⊗i(w). (1) We also know by (D9) that ∀j ∈ Ag\{i},∃uj ∈ R(w) such that Rj(uj) ⊆ R⊗j (w). By (IOA) we know that ⋂ j∈Ag\{i}Rj(uj)∩Ri(u) 6= ∅, i.e., there exists a u∗ ∈ ⋂ j∈Ag\{i}Rj(uj)∩Ri(u). Consequently, we obtain the following statement, u∗ ∈ ⋂ j∈Ag\{i} R⊗j (w) ∩R⊗i(w) = R⊗Ag (w). (2) Last, by construction of M we know Ri(u) = Ri(u). We show that (i)-(iii) hold: (i) We show Ri(v)≺Ri(u), that is, (a) Ri(v)  Ri(u) and (b) Ri(u) 6≺ Ri(v): (a) Recall, Ri(v)6⊆ ||φ||M, we know ∃v∗∈ Ri(v) s.t. M, v∗ 6|= φ. By definition of M, v∗∈ Ri(v) and by (IH) we getMd, v∗ 6|= φ. Consequently, by the assumption A Neutral Temporal Deontic STIT Logic 11 that Md, w |= ⊗iφ, and the fact that Md, v∗ 6|= φ, it follows that v∗ 6∈ R⊗i(w). Hence, we know that Ri(v)6⊆ R⊗i(w), which implies R⊗i(w) ∩ Ri(v) = ∅ by Lemma 9−(5). Therefore, by this fact along with statement (1) above, we know that, For all x, uH, vH ∈ W, if vH ∈ Rsi (x) ∩ Ri(v) and uH ∈ Rsi (x) ∩ Ri(u), then vH ∈ Rsi (x)\R⊗i(w) and uH ∈ Rsi (x) ∩R⊗i(w). Let x, uH, vH ∈ Wd be arbitrary and assume that vH ∈ Rsi (x) ∩ Ri(v) and uH ∈ Rsi (x)∩Ri(u). By the statement above, it follows that vH ∈ Rsi (x)\R⊗i(w) and uH ∈ Rsi (x)∩R⊗i(w), which in conjunction with criterion 1 on the function util implies that util(vH) ≤ util(uH). Therefore, the following holds, For all x, uH, vH ∈ W, if vH ∈ Rsi (x)∩Ri(v) and uH ∈ Rsi (x)∩Ri(uH), then util(vH) ≤ util(u). It follows that ∀Rsi (x) ⊆ R(w), Rsi (x)∩Ri(v) ≤ Rsi (x)∩Ri(u). Hence, by the definition of  and the definition of M, we obtain Ri(v)  Ri(u). (b) We need to show Ri(u) 6 Ri(v). By definition of , it suffices to show that ∃x, ∃uH,∃vH∈ W s.t. Ri(x)⊆ R(w), uH∈ Ri(u)∩Rsi (x), vH∈ Ri(v)∩Rsi (x) and util(vH)<util(uH). Consider ⋂ j∈Ag\iRj(uj)∩Ri(u) 6= ∅ from statement (2). Let Rsi (x) := ⋂ j∈Ag\i Rj(uj). Clearly, R s i (x) ⊆ R(w). By (IOA) we know that Rsi (x)∩Ri(v) 6= ∅ (where Rsi (x) = ⋂ j∈Ag\iRj(uj)), and so, Rsi (x)∩Ri(v) 6= ∅ by the definition of M. Therefore, ∃vH ∈ Rsi (x)∩Ri(v). Since u∗ ∈ ⋂ j∈Ag\iRj(uj)∩ Ri(u) (see paragraph above statement (2)), we know that u∗ ∈ ⋂ j∈Ag\i Rj(uj)∩ Ri(u), implying that u ∗ ∈ Rsi (x) ∩ Ri(u). Since also Ri(v) ∩ R⊗Ag (w) = ∅, as derived in part (i), we obtain vH ∈ R(w) \R⊗Ag (w). By criterion 2 of util, and the facts vH ∈ R(w) \R⊗Ag (w) and u∗ ∈ R⊗Ag (w), by statement (2), we have that util(vH) < util(u∗). Therefore, Ri(u) 6 Ri(v). (ii) By assumptionR⊗i(w)⊆||φ||Md and statement (1) we getRi(u) ⊆ R⊗i(w). By IH we have ||φ||Md=||φ||M and since Ri(u)=Ri(u) we know Ri(u) ⊆ ||φ||M. (iii) We prove the case by contraposition and show that ∀Ri(x) ⊆ R(w), if Ri(x) 6⊆ ||φ||, then Ri(u) 6 Ri(x). Let Ri(x) by an arbitrary choice-cell in R(w) and assume that Ri(x) 6⊆ ||φ||M. We aim to prove that Ri(u) 6 Ri(x). By definition of  it suffices to show that ∃Rsi (y) ⊆ R(w) such that ∃uH ∈ Ri(u) ∩ Rsi (y), ∃xH ∈ Ri(x) ∩ Rsi (y), and util(xH) < util(uH). By the assumption that Ri(x) 6⊆ ||φ||M, we know ∃xH ∈ Ri(x) such that M, xH 6|= φ. Clearly, xH ∈ Ri(x), and by (IH) we know that Md, xH 6|= φ. Since Md, w |= ⊗iφ, we obtain (w, xH) 6∈ R⊗i , and by Lemma 9−(5) we obtain Ri(x) 6⊆ R⊗i(w). By statement (2) we had u∗ ∈ R⊗Ag (w) and u∗ ∈ R⊗i(w). Also, we know u∗ ∈ Ri(u) by paragraph preceding statement (2). Since, u∗ ∈ ⋂ j∈Ag\{i}Rj(uj)∩ Ri(u), we also have u∗ ∈ ⋂ j∈Ag\{i}Rj(uj). Let Rsi (u∗) := ⋂ j∈Ag\{i}Rj(uj). By (IOA) we obtain Ri(x) ∩ Rsi (u∗) 6= ∅, implying that there exists some xH ∈ Ri(x) ∩ Rsi (u∗). It follows from (D9) and the fact Ri(x) 6⊆ R⊗i(w) that xH 6∈ R⊗Ag (w), which with the fact u∗ ∈ R⊗Ag (w), implies by definition of util (criterion 2) that util(xH) < util(u∗). By the definition of M, we have 12 K. van Berkel and T. Lyon xH ∈ Ri(x) ∩ Rsi (u∗), u∗ ∈ Ri(u) ∩ Rsi (u∗) and util(xH) < util(u∗), which implies the desired claim. (⇐=) We now prove the right to left direction: Assume M, w |= ⊗iφ. We reason towards a contradiction by assumingMd, w 6|= ⊗iφ. Hence, there exists a world v ∈ R⊗i(w) such thatMd, v 6|= φ. By (D11) we obtain R[i](v) ⊆ R⊗i(w) and hence R[i](v) 6⊆ ||φ||Md . By (IH) and the definition of M, we obtain Ri(v) 6⊆ ||φ||M. This fact, in conjunction with the assumption M, w |= ⊗iφ, implies that there exists some Ri(z) ⊆ R(w) such that the following holds: (i) Ri(v) ≺ Ri(z); (ii) Ri(z) ⊆ ||φ||M; and (iii) ∀Ri(x) ⊆ R(w), Ri(z)  Ri(x) implies Ri(x) ⊆ ||φ||M. By Lemma 9−(5) and the fact that Ri(z) = Ri(z), we know that either (a) Ri(z) ⊆ R⊗i(w) holds or (b) Ri(z) ∩R⊗i(w) = ∅ holds. Assume (a). We know Ri(v) ≺ Ri(z) and therefore, Ri(z) 6 Ri(v). Hence, ∃Rsi (x) ⊆ R(w),∃z∗ ∈ Ri(z) ∩ Rsi (x),∃v∗ ∈ Ri(v) ∩ Rsi (x) such that util(v∗) < util(z∗). We also know Ri(v) ⊆ R⊗i(w) and Ri(z) ⊆ R⊗i(w) and thus we obtain z∗, v∗ ∈ R⊗i ∩Rsi (x). Consequently, by the definition of util (criterion 3), we get util(v∗) = util(z∗). Contradiction. Assume (b). We know Ri(v) ≺ Ri(z) and therefore, Ri(z) 6 Ri(v). Hence, ∃Rsi (x) ⊆ R(w),∃z∗ ∈ Ri(z) ∩ Rsi (x),∃v∗ ∈ Ri(v) ∩ Rsi (x) such that util(z∗) 6≤ util(v∗). Then, by definition of util (criterion 1), either (I) z∗ 6∈ Rsi (x)\R⊗i(w) or (II) v∗ 6∈ Rsi (x)∩R⊗i(w). Suppose (I), since z∗ ∈ Rsi (x) we infer z∗ ∈ Rsi (x) and thus conclude z∗ ∈ R⊗i(w). However, by earlier assumption Ri(z)∩R⊗i(w) = ∅ we obtain z∗ 6∈ R⊗i(w). Contradiction. Suppose (II), then since v∗ ∈ Rsi (x) we infer v∗ 6∈ R⊗i(w). However, R[i](v) ⊆ R⊗i(w). Contradiction. Corollary 1. (completeness) ∀φ ∈ LTDS, if Cuf |= φ, then `TDS φ. Proof. Follows from Theorem 4 above, together with Theorem2. Theorem 5. ∀φ ∈ LTDS, we get Cdf |= φ implies Cuf |= φ. Proof. Follows from Theorem 2 together with Theorem 3. The Problem with Two-Valued Utility Functions. A well studied candidate function for assigning utilities to histories, is the two-valued approach where the range of utilities is {0, 1} (e.g. [12,15]). As a concluding remark of the present section, we briefly discuss the philosophical ramifications of using binary utility functions in a temporal setting. Observe that, at a moment where all worlds have a utility of 1 (or all 0), every obligation becomes vacuously satisfied by definition-in such a scenario we would have ⊗iφ iff φ-and every choice for each agent will ensure all optimal outcomes (see clause (7∗) of Definition 10).3 If in such a scenario, following [12,15], utilities are assigned to complete histories and thus remain constant through time, all obligations will also be vacuously satisfied at every future moment from thereon (namely, as one moves into the future, the set of histories passing through a moment can only decrease or stay the same). That at such 3 This also holds when all intersections of choices of agents contain both a 1 and a 0. A Neutral Temporal Deontic STIT Logic 13 moments all obligations are vacuously satisfied means that no obligation can be violated. Unfortunately, this also implies that at such moments contrary-toduty (CTD) reasoning-i.e., reasoning about obligations that come into being when a previous obligation has been violated-becomes impossible because CTD obligations require the possibility to violate one's obligations in the first place (e.g. see [17]). In order to reason with CTD obligations in temporal utilitarian STIT logics, we need to ensure that obligations can be violated, that is, we must consider deliberative obligations: ⊗di φ := ⊗iφ ∧ ¬φ. This means that, for an obligation ⊗di φ to hold, there exists a choice that does not guarantee φ and, by definition, the latter choice must be strictly dominated by (only) φ choices. In the binary setting this means that for all optimal choices, there is at least one outcome with a strictly higher utility (which must be 1). Unfortunately, this has a drawback since at such moments at least one of the following holds: (1) Worlds in the intersection of all agents acting in accordance with their duty all have value 1. (2) Worlds in the intersection of all agents violating their duty all have value 0. Relative to the aforementioned, Fig. 1 illustrates the (only) three scenarios possible in a two-agents, two-choices setting: Sub-figure (i) implies the impossibility of future CTD reasoning in all cases in which at least one agent satisfies its obligation. Sub-figure (ii) implies that there is no future CTD possible in every case witnessing at least one agent violating its obligation. Last, sub-figure (iii) indicates that future CTD obligations can only occur if one of the agents satisfies her obligation if and only if the other violates his. (With the impossibility of future CTD reasoning we mean that from that moment onward, all obligations will be vacuously satisfied.) All three cases are undesirable since they do not allow for future recuperation in those situations in which they clearly should. The above exhibits that, although⊗i does not depend on any temporal aspect (e.g. [15]), we can identify utility functions that are less suitable for temporal extensions of STIT. Binary functions relative to moments only, do not cause these problems, although they have their own issues [12]. In the case where the function ranges over the set of reals, it is possible to assign utilities in such a way that there is always CTD reasoning possible. In future work, we aim to specify such utility functions, making particular use of temporal aspects of TDS-frames. 5 Conclusion and Future Work In this paper, we extended deontic STIT logic [15] to the temporal setting, incorporating the logic from [14]. In doing so, we answered a long standing open question for temporal embeddings of deontic STIT (e.g. see [4,12,15]). We showed that the resulting logic TDS is sound and complete with respect to its class of frames. We dubbed these frames neutral since they allowed us to obtain adequacy of the calculus, while allowing us to refrain from committing to specific utility functions. Subsequently, we showed how these neutral frames can be transformed into particular utilitarian models, while preserving truth. We also briefly argued 14 K. van Berkel and T. Lyon ∀1 ∀1 ∀1 ∃0 R(w) (i). { i j { φ φ φ ¬φ ∃1 ∀0 ∀0 ∀0 R(w) (ii). { i j { φ φ φ ¬φ ∀1 ∃1∃0 ∃1∃0 ∀0 R(w) (iii). { i j { φ φ φ ¬φ Fig. 1. The only three scenarios where ⊗iφ∧ ⊗j φ∧¬φ holds true at R(w) (for Ag = {i, j} with 2 choices). Choices of i are vertically presented, those of j horizontally. The symbol ∀n means every history is assigned value n, and ∃n means that some history is assigned n, for n ∈ {0, 1}. Optimal choices are shaded and darker shaded when overlapping. At all ∀k outcomes (with k ∈ {0, 1}), CTD reasoning becomes impossible. that in a temporal setting, binary value assignments to histories can generate undesirable behavior with respect to contrary-to-duty obligations. For future work, we leave open the problem of whether temporal STIT (from [14]) and its deontic extension TDS are decidable. Furthermore, we aim to investigate alternative utility assignments that explicitly exploit the temporal aspects of TDS; e.g., it might be interesting to consider a dynamic approach taking into account that natural agents have limited foresight relative to (future) utilities. References 1. Abarca, A.I.R., Broersen, J.: A Logic of Objective and Subjective Oughts. In: JELIA 2019: Joint European Conference on Logics in Artificial Intelligence. Springer, Cham, pp.629-641 (2019) 2. Arkoudas, K., Bringsjord S., Bello, P.: Toward ethical robots via mechanized deontic logic. In: AAAI Fall Symposium on Machine Ethics, pp.17–23 (2005) 3. Balbiani, P., Herzig, A., Troquard, N.: Alternative axiomatics and complexity of deliberative STIT theories. Journal of Philosophical Logic, 37(4), pp.387–406. Springer (2008) 4. Belnap, N, Perloff, M., Xu, M.: Facing the future: Agents and choices in our indeterminist world. Oxford University Press on Demand, Oxford (2001) 5. Bentham, J.: An Introduction to the Principles of Morals and Legislation. (1789) 6. Berkel, K. van, Lyon, T.: Cut-free Calculi and Relational Semantics for Temporal STIT Logics. In: JELIA 2019: Joint European Conference on Logics in Artificial Intelligence, Springer Cham (2019) 7. Blackburn, P., de Rijke, M., Venema, Y.: Modal logic. Cambridge University Press, Cambridge (2001) 8. Gabbay, D. M., Hodkinson, I., Reynolds, M.: Temporal logic: Mathematical foundations and computational aspects. Oxford University Press, Oxford (1994) 9. Gerdes, J.C., Thornton, S.M.: Implementable ethics for autonomous vehicles. In: Autonomes fahren, pp.87–102. Springer Vieweg, Berlin, Heidelberg (2015) A Neutral Temporal Deontic STIT Logic 15 10. Goodall, N.J.: Machine ethics and automated vehicles. In: Road vehicle automation, pp.93–102 . Springer, Cham (2014) 11. Herzig, A., Schwarzentruber, F.: Properties of logics of individual and group agency. In: Advances in Modal Logic (7), pp. 133–149. College Publications (2008) 12. Horty, J.: Agency and Deontic Logic. Oxford University Press (2001) 13. Horty, J. and Pacuit, E.: Action Types in STIT Semantics. The Review of Symbolic Logic 10(4), pp. 617–637 (2017) 14. Lorini, E.: Temporal STIT logic and its application to normative reasoning. Journal of Applied Non-Classical Logics 23 (4), pp. 372–399 (2013) 15. Murakami, Y.: Utilitarian deontic logic. In: Advances in Modal Logic (5), pp. 211– 230. King's College Publications (2005) 16. Nayebpour, M. and Koehn, D.: The Ethics of Quality: Problems and Preconditions. In: Journal of Business Ethics 44(1), pp. 37–48. Kluwer Academic Publishers (2003) 17. Prakken, H., Sergot, M.: Contrary-to-duty obligations. Studia Logica 57(1), pp.91– 115 (1996) A Proofs Theorem 1 (soundness) ∀φ ∈ LTDS, `TDS φ implies |= φ. Proof. It suffices to show that all axioms are valid and all inference rules preserve validity over the class of TDS frames. The rules R0 and R1, as well as axioms A0−A11, and A17−A25 can be easily checked (See [14]). We show that A13−A16 are valid and that the R2 preserves validity. Let M be an arbitrary TDS-model with w a world in M . A13. Assume M,w |= φ and also that R[i]wu and R⊗iwv. By conditions (C1) and (D8), we know that R[i] ⊆ R and R⊗i ⊆ R, respectively. Therefore, it follows that Rwu and Rwv, which implies M,u |= φ and M,v |= φ by the assumption. This implies that M,w |= [i]φ and M,w |= ⊗iφ. A14. Assume M,w |= ⊗iφ. By condition (D9), there exists a v such that Rwv, and for all u in the model M , if R[i]vu, then R⊗iwu. Suppose further that R[i]vz for an arbitrary z; from this, and the previous statement, we may conclude that R⊗iwz holds, which by the initial assumption implies that M, z |= φ. Therefore, M, v |= [i]φ, and since Rwv holds for some v, we have that M,w |= ♦[i]φ. A15. Assume M,w |=  ⊗i φ. Thus, there exists a u such that Rwu and M,u |= ⊗iφ. Consider an arbitrary v and z such that Rwv and R⊗ivz. By condition (D10), and the fact that Rwu, Rwv, and R⊗ivz hold, we may conclude that R⊗iuz holds. Consequently, M, z |= φ holds; this fact, in conjunction with the assumption that Rwv and R⊗ivz hold for arbitrary v and z, implies that M,w |= ⊗i φ. A16. Assume M,w |= ([i]φ → [i]ψ), M,w |= ⊗iφ, and R⊗iwu for an arbitrary u. By condition (D11), the assumption R⊗iwu, implies that there exists a world v such that (i) Rwv, (ii) R[i]vu, and (iii) for all z, if R[i]vz, then R⊗iwz. The initial assumption, along with fact (i) that Rwv, entails that M, v |= [i]φ → [i]ψ. Suppose that R[i]vx for an arbitrary x; from fact (iii) we may conclude that R⊗iwz, which with the assumption that M,w |= ⊗iφ, implies 16 K. van Berkel and T. Lyon that M, z |= φ. Hence, M,v |= [i]φ, implying that M, v |= [i]ψ. Last, since we know that R[i]vu by fact (ii), we can conclude that M,u |= ψ. Therefore, M,w |= ⊗iφ→ ⊗iψ. Last, we show soundness of the IRR-rule from Tstit. Recall the rule: ¬p ∧(Gp ∧ Hp))→ φ if p is atomic and does not occur in φ φ We assume that p does not occur in φ. We prove the result by contraposition and assume that φ is invalid. Therefore, we know there exists a model M = (F, V ) s.t. F is a TDS-frame and M,w 6|= φ for some w ∈ W of M . We define another TDS-model M ′ = (F, V ′) over the frame F and define the valuation V ′ as follows: V ′(q) := { V (q) if q 6= p, W \ R(w) otherwise. where R(w) = {v|(w, v) ∈ R} (i.e. the valuation V ′ of p contains all worlds except for those sharing the same moment with w). Clearly, since φ does not contain p and the other atomic propositions are valued in the same way in M as in M ′ we get that M ′, w |= ¬φ. However, by the construction of V ′ and because F is irreflexive by condition (T7), we have that M ′, w |= ¬p∧(Gp∧Hp)) (the irreflexivity excludes the possibility that for some u ∈ R(w), M ′, u |= p ∧ ¬p). Since,M ′, w 6|= φ, by Definition 3, we have thatM ′, w 6|= (¬p∧(Gp∧Hp))→ φ. Hence, we conclude that (¬p ∧(Gp ∧ Hp))→ φ is invalid as well. Lemma 10. Let Γ be a MCS. Then, Γ has the following properties: – Γ `TDS φ iff φ ∈ Γ ; – φ ∈ Γ iff ¬φ 6∈ Γ ; – φ ∧ ψ ∈ Γ iff φ ∈ Γ and ψ ∈ Γ . Proof. We prove each of the claims in turn: (i) Assume that φ 6∈ Γ . Since Γ is a maximal, we know that Γ ∪{φ} is inconsistent, i.e., Γ `TDS φ→ ⊥. Due to the fact that Γ is consistent, we know that Γ 6`TDS φ. For the opposite direction observe that if φ ∈ Γ , then trivially Γ `TDS φ. (ii) Suppose that φ ∈ Γ . Observe that if ¬φ ∈ Γ as well, then Γ would be inconsistent; hence, ¬φ 6∈ Γ . For the backwards direction, assume that ¬φ 6∈ Γ . If φ 6∈ Γ as well, then since Γ is a MCS, we know that both Γ∪{φ} `TDS ⊥ and Γ ∪ {¬φ} `TDS ⊥. However, this implies that Γ `TDS φ ∧ ¬φ, thus contradicting the consistency of Γ . This implies that φ ∈ Γ . (iii) If φ ∧ ψ ∈ Γ , then by fact (i) φ ∈ Γ and ψ ∈ Γ since both φ and ψ are derivable from Γ when φ∧ψ ∈ Γ . The opposite direction is proved similarly. Lemma 11. Let 〈α〉 be dual to [α] ∈ Boxes. Then, R[α]Γ∆ iff for all φ ∈ LTDS, if φ ∈ ∆, then 〈α〉φ ∈ Γ . A Neutral Temporal Deontic STIT Logic 17 Proof. Let 〈α〉 be dual to [α] ∈ Boxes and let Γ and ∆ be maximally consistent IRR-theories. We prove both directions of the equivalence. First, assume that R[α]Γ∆ holds and consider an arbitrary φ ∈ ∆. Since ∆ is a MCS, we know that ¬φ 6∈ ∆, which implies by the definition of R[α] that [α]¬φ 6∈ Γ . Due to the fact that Γ is a MCS, this implies that¬[α]¬φ ∈ Γ , which further implies that 〈α〉φ ∈ Γ . For the opposite direction of the equivalence assume that for all φ ∈ LTDS, if φ ∈ ∆, then 〈α〉φ ∈ Γ . Let ψ ∈ LTDS and assume that [α]ψ ∈ Γ . Then, since Γ is a MCS, we know that 〈α〉¬ψ 6∈ Γ . Therefore, ¬ψ 6∈ ∆, which implies that ψ ∈ ∆ since ∆ is a MCS. Since ψ was arbitrary, we have established that R[α]Γ∆. Lemma 2 Let φ ∈ LTDS be a consistent formula. Then, there exists an IRRtheory Γ such that φ ∈ Γ . Proof. Let φ ∈ LTDS be a consistent formula. We enumerate the formulae of LTDS so that each formula in odd position is an element of Zig and make use of this enumeration to build an increasing sequence of consistent theories Γ0, Γ1, ..., Γn, ... We let Γ0 := {φ ∧¬p ∧(Gp ∧ Hp)} for some propositional variable p not occurring in φ. We define the sequence of Γn (for n > 0) as follows: Assume that Γn is defined and consider ψn of the enumeration. We know that either Γn ∪ {¬ψn} is consistent or Γn ∪ {ψn} is consistent. If Γn ∪ {¬ψn} is consistent, set Γn+1 := Γn ∪ {¬ψn}. If Γn ∪ {ψn} is consistent, then there are two cases to consider: either (i) n is even or (ii) n is odd. If n is even, then set Γn+1 := Γn ∪ {ψn}. Otherwise, set Γn+1 := Γn ∪ {ψn, ψn(q)}, where q is a propositional variable not occurring in Γn or ψ. We define our desired maximally consistent IRR-theory as follows: Γ := ⋃ n∈N Γn To finish the proof we need to show that Γ is both a MCS and IRR-theory. We first prove that (i) Γ is a MCS and then show that (ii) Γ is an IRR-theory. To prove claim (i), it is useful to first prove that for all n ∈ N, each Γn is consistent. We show this claim by induction on n. In the base case, assume for a contradiction that Γ0 = {φ ∧ ¬p ∧ (Gp ∧ Hp)} is inconsistent. Hence, ¬p∧(Gp∧Hp)∧φ `TDS ⊥, which further implies that `TDS ¬p∧(Gp∧Hp)→ (φ → ⊥). We may infer from the rule R2 that `TDS φ → ⊥. However, we know that φ is consistent, meaning that 6`TDS φ→ ⊥. We have thus obtained a contradiction implying then that Γ0 is in fact consistent. For the inductive step assume that Γn is consistent. We want to show that Γn+1 is consistent. This trivially follows by the definition of Γn+1. To prove that Γ is a MCS, we must show that Γ is both consistent and maximal. Assume for a contradiction that Γ is inconsistent. Then, this implies that for some finite subset Γ ′ of Γ , Γ ′ ` ⊥. However, if this is the case, then there exists some Γn such that Γn `TDS ⊥. We know that this cannot be the case by the previous paragraph, and so, Γ must be consistent. Assume now that there exists some Γ ′ such that Γ ⊂ Γ ′ and Γ ′ 6`TDS ⊥. Let ψ ∈ Γ ′ \ Γ . Since ψ 18 K. van Berkel and T. Lyon is a formula in LTDS, we know that if was considered at some point during the construction of the sequence Γ0, Γ1, ..., Γn, ... Since ψ 6∈ Γ this implies that there exists some Γm such that Γm∪{ψ} is inconsistent. Therefore, Γm `TDS ¬ψ, which implies that Γ `TDS ¬ψ. Due to the fact that Γ ⊂ Γ ′, it follows that Γ ′ `TDS ¬ψ and Γ ′ `TDS ψ since ψ ∈ Γ ′, which is a contradiction. Therefore, Γ is a MCS. We now prove that Γ is an IRR-theory. By construction we know that φ ∧ ¬p∧(Gp∧Hp) ∈ Γ0 ⊂ Γ , and since Γ is a MCS, it follows that ¬p∧(Gp∧ Hp) ∈ Γ , thus satisfying the first condition of being an IRR-theory. The second condition of being an IRR-theory is satisfied by the fact that whenever a formula ψ ∈ Zig is added to Γm ⊂ Γ , for m ∈ N, the formula ψ(q) is added as well with q fresh. Lemma 3 Let Γ be an IRR-theory and let 〈α〉 be dual to [α] ∈ Boxes. For each 〈α〉φ ∈ Γ there exists an IRR-theory ∆ such that R[α]Γ∆. Proof. Similar to [14, Lem. 16]. Lemma 6 Let Γ be an IRR-theory in W . Then, there exists an IRR-theory ∆ ∈ W such that RdtΓ∆ and for every IRR-theory Σ ∈ W dt, if Rdt[i]∆Σ, then Rdt⊗iΓΣ. Proof. Let Γ be an arbitrary IRR-theory in W dt. Since Γ is an IRR-theory, there is a propositional variable p such that name(p) ∈ Γ . Define ∆0 := {[i]φ| ⊗i φ ∈ Γ} ∪ {ψ|ψ ∈ Γ} ∪ {name(p)}. We will prove by contradiction that ∆0 is consistent and then extend ∆0 to an IRR-theory. If ∆0 is inconsistent, then `TDS ([i]φi ∧ ... ∧ [i]φn ∧ ψ1 ∧ ... ∧ ψn ∧ name(p))→ ⊥ where ψ1, * * * , ψm ∈ {ψ|ψ ∈ Γ} and [i]φ1, * * * , [i]φk ∈ {[i]φ| ⊗i φ ∈ Γ}. Let φ = φ1 ∧ ... ∧ φn and ψ = ψ1 ∧ ... ∧ ψn. Since, `TDS [i]φ ↔ [i]φ1 ∧ ... ∧ [i]φn we get `TDS ψ ∧ name(p)→ ¬[i]φ By necessitation for  and the  K-axiom, we get `TDS (ψ ∧ name(p)) → ¬[i]φ, which implies `TDS ψ∧name(p)→ ¬ [i]φ. Clearly, becauseψ ∈ Γ , name(p) ∈ Γ and `TDS name(p) → name(p), we have that Γ `TDS ¬ [i]φ. This implies that ¬ [i]φ ∈ Γ since Γ is an IRR-theory. Also, since ⊗iφ1, ...,⊗iφn ∈ Γ we have ⊗iφ1 ∧ ... ∧ ⊗iφn ∈ Γ since Γ is an IRR-theory. By `TDS ⊗iφ ↔ ⊗iφ1 ∧ ... ∧ ⊗iφn we conclude ⊗iφ ∈ Γ as well. Since ⊗iφ → [i]φ ∈ Γ because the formula is an instance of axiom A14, we obtain by modus ponens that [i]φ ∈ Γ . Since Γ is an IRR-theory (and hence consistent) we obtain a contradiction, which proves that ∆0 is consistent. We now extend ∆0 to an IRR-theory ∆ by first defining an increasing sequence ∆0, ∆1, ..., ∆n, ... of sets of formulae. Suppose that ∆n is consistent A Neutral Temporal Deontic STIT Logic 19 and defined, and enumerate the formulae of LTDS so that each formula in odd position is an element of Zig; we aim to define ∆n+1. Consider the formula ψn. Either, ∆n ∪ {¬ψn} is consistent or ∆n ∪ {ψn} is consistent. If the former holds, then set ∆n+1 := ∆n ∪ {¬ψn}. If the latter holds, then there are two subcases to consider: either n is even, in which case, we set ∆n+1 := ∆n ∪ {ψn}, or n is odd, in which which case, ∆n ∪ {ψn} is consistent and ψn ∈ Zig. We show that in the latter subcase we can find a propositional variable q such that ∆n ∪{ψn, ψn(q)} is consistent; we then define ∆n+1 := ∆n ∪ {ψn, ψn(q)}. Observe that i (name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn) ∈ Γ (3) For otherwise, ⊗i((name(p) ∧ ∧ χ∈∆n\∆0 χ)→ ¬ψn) ∈ Γ since Γ is an IRR-theory and has the properties specified by Lemma 10. By the definition of ∆0 it follows that [i]((name(p) ∧ ∧ χ∈∆n\∆0 χ)→ ¬ψn) ∈ ∆n Using the fact that `TDS [i]θ → θ holds for any formula θ, we infer that ∆n `TDS (name(p) ∧ ∧ χ∈∆n\∆0 χ)→ ¬ψn Since ∆n `TDS name(p) ∧ ∧ χ∈∆n\∆0 χ we may conclude that ∆n `TDS ¬ψn, which contradicts the fact that ∆n ∪ {ψn} is consistent. Therefore, since Γ is an IRR-theory and (1) holds, we know that i (name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q)) ∈ Γ (4) Using this fact, we may prove that ∆n+1 := ∆n ∪ {ψn, ψn(q)} is consistent, for suppose otherwise. Then, there exist ζ1, * * * , ζm ∈ {ζ|ζ ∈ Γ} and [i]ξ1, * * * , [i]ξk ∈ {[i]ξ| ⊗i ξ ∈ Γ} such that `TDS ζ1 ∧ * * * ∧ ζm → ([i]ξ1 ∧ * * * ∧ [i]ξk → ¬(name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q))) By ⊗i necessitation and the ⊗i K-axiom, we can derive `TDS ⊗i(ζ1∧* * *∧ζm)→ ⊗i([i]ξ1∧* * *∧ [i]ξk → ¬(name(p)∧ ∧ χ∈∆n\∆0 χ∧ψn(q))) 20 K. van Berkel and T. Lyon Using axiom A13 we obtain `TDS (ζ1∧* * *∧ ζm)→ ⊗i([i]ξ1∧* * *∧ [i]ξk → ¬(name(p)∧ ∧ χ∈∆n\∆0 χ∧ψn(q))) By our assumption and the fact that Γ is an IRR-theory, we know that (ζ1 ∧ * * * ∧ ζm) ∈ Γ , implying that ⊗i([i]ξ1 ∧ * * * ∧ [i]ξk → ¬(name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q))) ∈ Γ We infer the following using modal reasoning ⊗i[i](ξ1 ∧ * * * ∧ ξk)→ ⊗i¬(name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q))) ∈ Γ One can confirm that `TDS ⊗iθ → ⊗i[i]θ (See [15]) holds for any formula θ, and therefore ⊗i(ξ1 ∧ * * * ∧ ξk)→ ⊗i¬(name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q))) ∈ Γ Our assumption implies that ⊗i(ξ1 ∧ * * * ∧ ξk) ∈ Γ , and so ⊗i¬(name(p) ∧ ∧ χ∈∆n\∆0 χ ∧ ψn(q))) ∈ Γ This contradicts (2) and proves that ∆n ∪ {ψnψn(q)} is consistent. It is easy to infer that ∆ is an IRR-theory by an argument similar to Lemma 2. Clearly, RdtΓ∆ holds by the definition of ∆. Last, let Σ be an arbitrary IRR-theory in W dt. Assume that Rdt[i]∆Σ holds and let ⊗iξ ∈ Γ . By definition [i]ξ ∈ ∆, and so, ξ ∈ Σ by the definition of the relation Rdt[i], which completes the proof. Lemma 7 Let Γ and ∆ be IRR-theories in W dt such that Rdt⊗iΓ∆. Then, there exists an IRR-theory Σ ∈ W such that RdtΓΣ, Rdt[i]Σ∆, and for all Π ∈ W dt, if Rdt[i]ΣΠ, then R dt ⊗iΓΠ. Proof. To prove this lemma, we proceed differently compared to Lemma 6, making explicit use of the existence lemma (Lemma 3). Let Γ and ∆ be IRR-theories in W dt such that Rdt⊗iΓ∆. Then, there is a name(p) for some p such that name(p) ∈ ∆. Since φ → 〈i〉φ ∈ ∆ for any φ ∈ LTDS we know 〈i〉name(p) ∈ ∆. Hence, by Lemma 3 we know there exists a Σ ∈ W dt for which Rdt[i]∆Σ. First, we show (i) Rdt[i]Σ∆, then we show (ii) R dt ΓΣ and last we show (iii) for any Π ∈W dt for which Rdt[i]ΣΠ, we have R dt ⊗iΓΠ. A Neutral Temporal Deontic STIT Logic 21 (i) Recall Rdt[i]∆Σ, take an arbitrary [i]φ ∈ Σ, it suffices to show that φ ∈ ∆. By Lemma 11, we know that 〈i〉[i]φ ∈ ∆. Since `TDS 〈i〉[i]θ → θ for any θ ∈ LTDS (by axiom A5, A6, and propositional reasoning) we obtain φ ∈ ∆; hence Rdt[i]Σ∆. (ii) Assume an arbitrary φ ∈ Γ . We prove that φ ∈ Σ. We know `TDS φ → ⊗iφ (axiom A13). Hence, since Γ is an IRR-theory, we obtain ⊗iφ ∈ Γ . Furthermore, `TDS ⊗iφ → ⊗i[i]φ (See [15]), and therefore, ⊗i[i]φ ∈ Γ . Since Rdt⊗iΓ∆ we get [i]φ ∈ ∆ and thus, by the fact that R dt [i]∆Σ, we know φ ∈ Σ. We conclude RdtΓΣ. (iii) Take an arbitrary Π ∈ W dt. Assume Rdt[i]ΣΠ. and ⊗iφ ∈ Γ . Since ⊗iφ → ⊗i[i]φ ∈ Γ , ⊗i[i]φ ∈ Γ . Furthermore, since `TDS ⊗i[i]θ → ⊗i[i][i]θ for any θ ∈ LTDS (A5, A6, R1, A12), we know ⊗i[i][i]φ ∈ Γ , and thus [i][i]φ ∈ ∆. Consequently, we get [i]φ ∈ Σ and last φ ∈ Π, giving us Rdt⊗iΓΠ. Lemma 8 The canonical model Mdt|IRR belongs to the class of TDS models. Proof. The argument thatMdt|IRR possesses properties (C1), (C2), (C3)∗, (T4)− (T7) is the same as in [14, Lem. 19]. Therefore, we need only confirm that the model satisfies conditions (D8)-(D11). The fact that Mdt|IRR satisfies conditions (D9) and (D11) follows from Lemma 6 and 7. We additionally prove that Mdt|IRR satisfies conditions (D8) and (D10). (D8) Let Γ and ∆ be arbitrary IRR-theories. Assume that Rdt⊗iΓ∆ and assume that φ ∈ ∆. Hence, by Lemma 11, we know that iφ ∈ Γ . Since ¬φ→ ⊗i¬φ ∈ Γ , we have iφ → φ ∈ Γ . Hence, φ ∈ Γ , which implies that RdtΓ∆. (D10) Let Γ,∆,Σ,Π ∈ W dt ∩ IRR and assume that RdtΓ∆, RdtΓΣ, and Rdt⊗iΣΠ. We will show that R dt ⊗i∆Π. Let φ ∈ LTDS and assume φ ∈ Π. Then iφ ∈ Σ and, hence, 	i φ ∈ Γ by Lemma 11. Since `TDS ( ⊗i φ→ ⊗i φ)→ ( 	i φ→ 	i φ) and ⊗i φ→ ⊗i φ ∈ Γ we may infer that 	i φ→ 	i φ ∈ Γ . Due to the fact that 	i φ ∈ Γ , we obtain 	i φ ∈ Γ , and so, iφ ∈ ∆. Therefore, Rdt⊗i(∆,Π). Theorem 2 If φ ∈ LTDS is a consistent formula, then φ is satisfiable on a TDS-model. Proof. Suppose that φ ∈ LTDS is consistent. By Lemma 2, we can extend φ to an IRR-theory Γ such that φ ∈ Γ . By Lemma 3, we know that the set IRR is a diamond saturated set, and so, by Lemma 1, we know that Mdt|IRR, Γ |= φ iff φ ∈ Γ . Hence, we can conclude that Mdt|IRR, Γ |= φ. By Lemma 8 we know that Mdt|IRR is a TDS-model; therefore, φ is satisfiable on a TDS-model.