Communication across viewpoints

Communication across ViewpointsGiuseppe AttardiMaria SimiDipartimento di Informatica, Universit�a di Pisa,Corso Italia 40, I-56125 Pisa, ItalyNet: [email protected], [email protected] situation which occurred in a dream provides the framework for discussing propertiesof the theory of viewpoints and in particular the issue of di�erent denotations from di�erentperspectives. We introduce the principle of \referent sharing" in communications and argue thatcommon knowledge resulting from communication should only use constants whose referent is\manifest" to the parties involved.Keywords: viewpoints, contexts, metalevel theories, re ective theories, natural deduction.1 IntroductionWhen several agents interact, their understanding of each other behaviour depends on some commonknowledge they all share as well as on assumptions about each other private knowledge. Thequestion arises then of how such common knowledge comes about. Communication between agentsseems to involve two aspects: ensuring that they all understand the subjects of their sentences andbecoming all aware that the information has been transferred.The �rst aspect requires that the \referents" in communications be shared. The second entails thatcommunication not only involves transfer of knowledge from one agent to another but also extendstheir common knowledge. These two facts together imply that common knowledge resulting fromcommunication should only use constants whose referent is \manifest" to the parties involved.We explore these issues in the framework of the theory of viewpoints [2, 4, 5]. This theory wasconceived as a general and uni�ed formalism for expressing several varieties of relativised truth:beliefs contexts, situations, truth, partitioning a knowledge base in microtheories and so on. Eachof these notions can be represented through viewpoints whose speci�c properties are captured byaxioms, added to the basic theory in order to characterise those viewpoints [26].The theory of viewpoints is a re ective �rst order logic which amalgamates object and metalanguageby using names for each term and statement of the language and which contains an axiomatisationof provability in the style of natural deduction. Re ection rules provide the link between object andmetalanguage and lead to a non conservative but consistent extension of �rst order logic; these rules

have been carefully formulated in order to avoid paradoxes arising from self referential sentences,which trickle in by diagonalisation [20].Viewpoints denote sets of sentences which represent the assumptions of a theory. A statement ofthe form in(0A0; vp), where vp is a viewpoint expression, is interpreted as \statement A is entailedby the assumptions denoted by vp in the current interpretation" 1.The motivations and properties of the theory of viewpoints di�er in several important respects fromexisting proposals and formal accounts of contexts [18, 13, 25, 7, 8].In the formal system by Buva�c and Mason for example [8], the semantics of ist(c; p), to be read as\it is true in context c that p", is essentially (language restrictions apart) entailment: the semanticsassociates to a context a set of models and p is assessed to be true in such models. As a consequencea context will have complete information of what is true in other contexts:(ND) k : ist(k1; ist(k2; �))_ ist(k1;:ist(k2; �))Moreover the context structure, at least in the quanti�ed version [9], is at, according to their ownterminology:(Flat) k : ist(k1; ist(k2; �)), ist(k2; �)In the theory of viewpoints, since they are meant also for modeling belief contexts, the perspectiveof observation is important: the fact that something holds in a viewpoint does not imply that \thefact that it holds" is true in any other viewpoint. Therefore the propertyin(p; vp1)) in(in(p; vp1); vp2)is not desired and is not valid. To achieve this, the semantics provided for in is not entailmentbut rather contextual entailment, so that the viewpoint vp1 is resolved (interpreted) with respectto the context where it appears (i.e. vp2), rather than in a global context. This means that theviewpoint expression vp1 in the antecedent might denote a di�erent set of assumptions from theset of assumptions denoted by the vp1 in the consequent. Note however that:in(p; vp)) in(in(p; vp); vp)is valid, since contextual entailment ensures that viewpoint expressions at di�erent levels of nestingare interpreted coherently: the entailment is in fact restricted to a subclass of all models, those\coherent" with the current context in the interpretation of the viewpoint expressions.As an additional consequence the rules for entering and exiting a context have to preserve thenesting of contexts, as argumented in [6] and as in the propositional version of the theory ofcontexts by Buva�c and Mason [7, 8] but unlike in their quanti�ed version [9].The expressivity we require calls for implicitly de�ned viewpoints and a syntactic treatment of in,so that self referential and mutually referential viewpoints can be de�ned. In many real applications1The notation 0A0 is an abbreviation for a term denoting sentence A. The naming device is not important in thispaper; we will feel free to drop quotes inside in when there is no risk of ambiguities.2

contexts cannot be characterised explicitly by listing the complete set of assumptions. This is alsoan issue raised by McCarthy when he suggests that contexts are to be considered rich objects [18].Therefore, in addition to viewpoints expressed by means of sentence names, we also allow forviewpoint constants and functions and rely on a partial characterisation by means of axioms statingwhat holds in a viewpoint. In particular one can express the rules for the derivation of facts of typein(p; vp). Examples of such assertions are lifting rules [18], which relate two separate viewpoints;for example it is possible to state that whenever a formula satisfying some condition holds in aviewpoint vp1 then a related formula holds in viewpoint vp2.As a special case, we can state that vp1 subsumes vp2:8x in(x; vp1)) in(x; vp2)This allows for compact statements of problems and leaves to the logic machinery the burdenof extracting statement present in viewpoints as necessary during proofs from the rules whichcharaterise them.Note that the possibility of quanti�cation over sentences inside the in operator, excluded in modallogics, is essential to this aim; hence our choice of a syntactic treatment of the in operator.Another important characteristic of the theory of viewpoints is that it is a re ective theory, asopposed to a strati�cation of theories as in [27, 12], despite the troubles created by paradoxes. Thisallows expressing facts which simply cannot be stated without the use of self referential viewpoints.Here are some examples.\John believes that he has a false belief" [21]in(9x in(x; vp(John))^ False(x); vp(John))\Agent a believes that whatever he and agent b believe is true, while b does not believe so"in(8x in(x; vp(a))_ in(x; vp(b))) True(x); vp(a))in(:8x in(x; vp(a))_ in(x; vp(b))) True(x); vp(b))\Agent a and agent b have common knowledge (or belief) that p"in(p; CK) (CK-1)8x in(x; CK)) in(x; vp(a))^ in(x; vp(b)) (CK-2)8x in(x; CK)) in(in(x; vp(a))^ in(x; vp(b)); CK) (CK-3)Note that to faithfully represent common knowledge it is not enough to state that both agentsknow p, but it is also necessary to express that they know that they know p, that they know thatthey know that they know p, : : :and so on.The possibility of recursive fedinitions of viewpoints (for example through lifting axioms or inparticular \auto-lifting" axioms such as CK-3) and of expressing self referential viewpoints leadsto non �nite viewpoints. 3

2 Syntax and proof theoryThe logic of viewpoints has the syntax of classical �rst order logic, extended with the statementsin(0A0; vp), where 0A0 is the name of a statement and vp can be:1. a �nite set of statement names: f0A01;0A02; :::;0A0ng2. a viewpoint term, consisting of a viewpoint function and a list of terms. A viewpoint functionof no argument is a viewpoint constant.For each symbol s of the language (either variable, function, predicate or viewpoint), we denote by0s0 its name. Names for terms and literals are obtained through an appropriate naming schema asin [5].In the following we use the convention that A, B are metavariables for statements, 0A0, 0B0 arequoted statements while vp; vp1; vp2 are metavariables for viewpoints, i.e. expressions denotingsets of sentences. To simplify the notation, we will sometimes use vp; vp1; vp2 for sets of sentencesor, in the case of �nite viewpoints, for the sentence which is the conjunction of the sentencesin the viewpoint. It should be clear from the context which is the intended meaning for suchmeta-variables.The proof theory for viewpoints can be conveniently presented in the style of natural deduction.2.1 Inference rules for classical natural deductionAs customary, the notation � ` A indicates the pending assumptions � in the proof of A inrules where some of the assumptions are discharged, like in the cases of implication introductionand negation introduction. When the pending assumptions are the same in the antecedent andconsequent of a rule they are omitted.The rules for natural deduction are quite standard. For example:A;BA ^B (^ I ) A ^ BA;B (^ E)are the rules for conjunction introduction and elimination, respectively, and� [ fAg ` B� ` (A) B) () I ) A;A) BB () E)are the rules for implication introduction and elimination. The full set of classical rules used ispresented in [6].2.2 Metalevel axiomsThe behaviour of in is characterised by the following axioms and inference rules, which allow classicalreasoning to be performed inside any viewpoint, and at any level of nesting.4

The �rst axiom asserts that all the sentences which constitute a viewpoint hold in the viewpointitself, while the second states monotonicity of viewpoints.in(0A0; f: : : ;0A0; : : :g) (Axiom1)in(0A0; vp)) in(0A0; vp[ f0B0g) (Axiom2)An additional axiom establishes a principle which could be called positive introspection, if we choosean epistemic interpretation for in.in(0A0; vp)) in(0in(0A0; vp)0; vp) (Positive introspection)2.3 Metalevel inference rulesThe following are the rules of re ection and proof in context for the theory of viewpoints: theyare more powerful than classical re ection and rei�cation rules, but still safe from paradoxes asdiscussed in [4].vp1 ` in(0A0; vp2)vp1 [ vp2 ` A (Re ection)We have argued elsewhere for the usefulness of such a strong version of re ection [4], [5].The metalevel should have the same inferencing capabilities of the object level. This could beprovided by means of one meta-inference rule for each classical object level inference rule, asdescribed in [5], or, more succintly, through the following rule of proof in context, together with ameta-rule for implication introduction, which could be regarded as a principle of decontextualisation[13]. Axiom1 and Axiom2 are also necessary to allow for classical reasoning in any viewpoint.vp1 `C Ain(0vp01; vp2) `C in(0A0; vp2) (Proof in context)where the vp1 in the antecedent is a �nite set of sentences and the vp1 in the consequent should beread as the conjunction of the formulae in vp1. The notation `C stands for classically derivable orderivable without using re ection and positive introspection.in(0B0; vp[ f0A0g)in(0A) B0; vp) (Decontextualisation)The converse rule of contextualisation is a derived rule:in(0A) B0; vp)in(0B0; vp[ f0A0g) (Contextualisation)5

The rule of proof in context asserts that a classical proof can be performed in any viewpointprovided the premises of the proof are in the viewpoint. Notice that the consequent of the rule isstill a classical derivation, therefore the rule can be applied repeatedly, to carry out a proof at anylevel of nesting within viewpoints. Therefore, if A `C B then:in(0A0; vp1) `C in(0B0; vp1)in(0in(0A0; vp1)0; vp2) `C in(0in(0B0; vp1)0; vp2)...A corollary of proof in context is the following:Theorem 1 in(0A0; vp), for any logical theorem A of classical natural deduction and for any view-point vp.Proof in context is more powerful and a much more useful rule than classical rei�cation whenworking with implicit viewpoints [6]. Classical rei�cation is also a derived rule:vp `C A` in(0A0; vp) (Rei�cation)2.4 Entering and exiting contextsA useful mechanism when performing proofs in context is the ability to switch contexts and performnatural deduction proofs within viewpoints. The safest way to interpret context switching in theframework of natural deduction proofs with pending assumptions and implicit contexts is simplyto go one level deeper or shallower in nesting, or in other words unnesting and nesting.This means for instance that in order to prove a statement of the formin(0A0; vp1)one may pretend to move inside vp1, and perform a proof using available facts of the formin(0:::0; vp1). If the formula A is itself of the form in(0B0; vp2) one will have to go one level deeper toprove B by using this time just facts of the form in(0in(0:::0; vp2)0; vp1).In [6] we introduced a box notation for natural deduction proofs and viewpoints, making visiblethe structure of dependencies and nested viewpoints in contextual reasoning. The notation is anextension of the box notation introduced by Kalish and Montague [16].For example, the following schema corresponds to the inference rule of negation introduction andshould be read as: \if assuming A a contradiction is reached, then :A is proved".6

A (assum.): : :B: : ::B:AThe box notation is useful to visualise the scope of the assumptions made during a natural deductionproof. In performing a proof within a box one can use facts proved or assumed in the same box orin enclosing boxes. Facts cannot be exported from within a box to an enclosing or unrelated box.For proofs in context we introduce a di�erent kind of box, with a double border, to suggest bound-aries which are more di�cult to traverse. The double box represents a viewpoint, i.e. a theory,whose assumptions, if known, are listed in the heading of the box. If the assumptions are notknown the name of the viewpoint is shown. The only two rules for carrying facts in and out of adouble box are the rules corresponding to unnesting and nesting.Importing a fact in a viewpoint:in(0A0; vp)vpA: : : (unnesting)Exporting a fact from a viewpoint:vp: : :A (nesting)in(0A0; vp)The only way to import a fact A in a double box vp is to have a statement in(0A0; vp) in the envi-ronment immediately outside the box. Symmetrically one can obtain in(0A0; vp) in the environmentimmediately outside a double box vp if A appears in a line immediately inside the double box (notinside a further single or double box within the double box). Note that to import a fact into anested double box the rule of unnesting must be applied repeatedly.According to Axiom1, the assumptions of a viewpoint can also be used inside the viewpoint:f0A01; : : : ;0A0ngA1; : : : ; An: : : 7

3 SemanticsThe main problem in providing a semantics to a re ective theory is to decide which truth value toassign to statements of the form R , F (0:R0), which can be built by diagonalisation. Solutionsproposed in the context of logics for truth, can be a source of inspiration.Kripke's account of truth [17] is based on Kleene's three valued logic. In his model the law ofexcluded middle holds, while the principle of bivalence does not: in(0A0; fg) does not hold wheneverA is a classical tautology, like B _ :B. A counterexample is R _ :R, where R is a paradoxicalsentence. The solution by Perlis [21] also does not preserve the principle of bivalence.We adopt therefore a di�erent solution based on the idea of reaching a stable truth value for aformula through an iterative process of revision as in Gupta-Herzberger semantic theory [14, 15].We however retain the notion of truth and validity which Gupta-Herzberger leave undeterminatefor some statements.An adequate semantics must avoid to sanction dangerous formulae. For example in consistentre ective theories, a T axiom likein(0A0; f0B0g)) (B ) A)is often allowed, but in this case the rei�cation rule (called necessitation in the context of modallogics) must be restricted so thatin(0in(0A0; f0B0g)) (B ) A)0; fg)is not derivable. Its derivation in fact would immediately lead to an inconsistent theory [20]. Thesame argument applies to the rei�ed positive introspection.Another problem is accounting for positive introspection, which is a useful principle for our pur-poses, without also having to admit the slightly di�erent, strongerin(0A0; vp1)) in(0in(0A0; vp1)0; vp2)which is not desirable and in fact cannot be proved in our theory. As a consequence, an interpre-tation of in as straightforward entailment or derivability is not satisfactory. Our answer to thisproblem is an interpretation of in as contextual entailment , i.e. entailment restricted to a subclassof all models, to ensure that viewpoints at di�erent levels of nesting are interpreted coherently.We want to interpret in(t1; t2) in a certain modelM, as entailment of t1 from t2, i.e. that whenevert2 holds, then t1 holds. However M establishes an interpretation for viewpoint functions someof which may appear in t1; we must ensure that the same interpretation is used in evaluating t1.Consider for instance:in(0A0; vp)) in(0in(0A0; vp)0; vp)When examining the validity of the consequent, we are already restricted to models where vp isa viewpoint which entails A. Therefore, when we consider whether vp entails in(0A0; vp), we mustcarry over this restriction, and in fact we conclude that in all such models A is entailed by vp.8

The interpretation of in as contextual entailment rests upon the notion of coherence of models. Wesay that two models are coherent with respect to a viewpoint expression vp when they agree on theinterpretation given to the viewpoint constants and functions appearing in vp; formally:De�nition 1 (Model coherence) M�vp N i� [[vp]]M = [[vp]]NCoherence is a re exive, symmetric and transitive relation between models.An interpretation structure M for the theory of viewpoints is a pair hD; Ii de�ned as follows:1. The domain of interpretation D contains also the set of statements S of the language.2. I associates an n-ary function fI : Dn ! D, to each n-ary function symbol f of the language,except the syntax constructors, i.e. those functions that we use to name sentences and termsof the language, whose interpretation is �xed.3. I associates to each n-ary predicate symbol p of the language, an n-ary predicate pI � Dn.4. I associates to each n-ary viewpoint function vp, a function vpI : Dn ! RecSubs(S); therecursive subsets of S.Terms are interpreted with respect to an assignment function g, which assigns elements of D tovariables. The interpretation of terms is classical except for naming terms, whose interpretation isthe term or statement they name. In particular:[[x]]g = g(x)[[0s0]]g = s, for any symbol sIn short we could write, for any term t without variables:[[0t0]] = tFor each formula A, j=M;g A means that A is true in the interpretationM with assignment functiong. The notation g[i=x] represents the assignment function identical to g except that x is bound toi.For the interpretation of statements we proceed by de�ning the notion of true at level n. Forstatements which do not contain variables quanti�ed across in statements, the level corresponds tothe level of nesting of in statements. A statement with a nesting level of n will receive its de�nitivetruth value at level n; while paradoxical statements, to which no �nite level of nesting can beassigned, will keep oscillating periodically between true and false.At level 0, all statements are considered false: not j=0M;g A.For any n > 0: 9

j=nM;g p(t1; t2; :::; tn) i� h[[t1]]g; [[t2]]g; :::; [[tn]]gi 2 pIj=nM;g (:A) i� not j=nM;g Aj=nM;g (A^ B) i� j=nM;g A and j=nM;g Bj=nM;g (A_ B) i� j=nM;g A or j=nM;g Bj=nM;g (8x:A) i� for all d in D, 9k: j=kM;g[d=x] AThe truth of in statements at level n is de�ned on the basis of the truth at level n � 1. Theinterpretation of in is contextual entailment , i.e. entailment restricted to a subclass of all models,to ensure that viewpoints at di�erent levels of nesting are interpreted coherently.j=nM;g in(t1; t2) i� for all N such that (N �t2 M), not j=n�1N ;g [[t2]]g or j=n�1N ;g [[t1]]gIn most cases, this process of revision stabilises in the sense that the truth value of statements settlesto either true or false from a certain level onward. There are however paradoxical statements, likethe counterpart of the liar statement, which do not stabilise at any �nite level of revision butcontinue to oscillate between di�erent truth values. To such statements false will be assigned asultimate truth value.A statement is said to be stably true accordingly to whether or not the revision process stabilises:j=�M;g A i� 9k:8n > k: j=nM;g AStable truth is however too coarse, since all statements which do not stabilise are considered false:therefore for any such statement R both R and :R would be false. One further step is necessaryto distinguish among the statements which do not stabilise.The notion of truth is classical except for in statements which relies on stable truth:j=M;g in(t1; t2) i� j=�M;g in(t1; t2)Validity is de�ned as usual:j= A i� 8M; g: j=M;g AThe notation vp j= A means that A is true in every model of vp.We can verify that our semantics has the required properties.Note. The law of excluded middle holds both at the object level:A _ :Aand at the metalevel: 10

in(0A _ :A0; vp)However this does not imply that in(0A0; vp)_in(0:A0; vp), which would be undesirable since it wouldsanction the completeness of any viewpoint.Consider the formula R, such that R, in(0:R0; fg), which corresponds to the Liar sentence. Theparadox is avoided since the Liar sentence is false in every model: j= :R.We summarise a few relevant properties of our semantics:1. j=�M A implies j=M A but not vice versa.2. in(0A0; f0B0g)) (B ) A) is valid.3. (in(0A0; fg)) A) is valid.4. in(0in(0A0; fg)) A0; fg) is not valid.5. in(0in(0A0; f0B0g)) (B ) A)0; vp) is not valid.6. in(0A0; vp)) in(0in(A; vp)0; vp), is valid.7. in(0A0; vp)) in(0in(0A0; vp)0; vp2) is not valid.4 Sharing of referents in communicationWe will illustrate with an example several features of the theory of viewpoints and how to reasonin it. The example is meant to illustrate several issues related to the modeling of communicationsamong agents holding di�erent viewpoints about the same state of a�airs and in particular usingdi�erent expressions to denote the objects of interest.One morning Beppe told Maria about the following dream.You and me are traveling by train, and you have both our tickets. I go to the toilet.After my return the ticket inspector passes and asks for unchecked tickets.I do nothing, since I know that you have my ticket. You do nothing since you havealready shown both tickets to the inspector while I was away. The inspector does notremember seeing my ticket and therefore he asks me for it. At this point I ask you whyyou do not show the ticket to the inspector.We will attempt a formalisation of the reasoning of each agent involved in the situation describedabove at di�erent times, providing a rational account for the agent's behaviour.In the reasoning by the inspector and by Maria, they both assume knowing certain informationabout each other. Each one should have obtained such information through the transaction thathappened between them when Maria showed the tickets to the inspector. The transaction shouldbe modeled in such a way that some information ows from one agent to the other and that both11

agents become aware not only of the transaction but also that the other is aware of the informationconveyed in the transaction.The proper way to model the e�ect of a communication act is by extending the common knowledgeof the participants. The e�ect is not only that some information is added to the knowledge ofthe recipients of the communication, but also that the recipients' awareness of such informationenriches the viewpoint of the originator of the communication, and the recipients become aware ofthis and so on.Communication also raises a problem about terms and denotations: i.e. which constants should beused in the formalisation of the communicated knowledge. For instance, in the interaction betweenMaria and the inspector while Beppe is away, how can Maria refer to Beppe? In our solution wedecided that she can't refer to Beppe directly, since she has no way to ensure that her reference toBeppe will be the same as the one of the inspector.The only things to which she can refer in her interaction with the inspector are what we call\manifest constants", i.e. constants to which she can point directly (for instance because they areobjects in the scene), or indirectly through terms built upon other manifest constants (for instanceHusband-of(M), or Person-sitting(there)). We could even use Person-named(\Beppe"), since thename \Beppe" is part of the common vocabulary, however the referent of such name may not bethe same in all viewpoints.Quine speaks about \observations terms", which are terms that are or can be taught by ostension,and whose application in each particular case can therefore be checked intersubjectively [24].Learning, and in particular language learning, is predicated on observation terms and hence onostension: as children learning the language, we get on to various simple terms and key phrases bydirect association with appropriate experiences. When we have progressed a bit with this kind oflearning, we learn further usages contextually [23].We require that any statement expressing common knowledge between two agents, gained as a resultof a communication, only uses manifest constants: we call this the principle of referent sharing incommunicating knowledge.Therefore in the example, the transaction between Maria and the inspector will be expressed bymeans of the manifest constant ticket2 which refers to the actual ticket that Maria hands over tothe inspector. If we were to use Ticket(B), where B is the constant denoting Beppe, we wouldunduly transfer Maria's knowledge that Beppe's ticket has been checked to the viewpoint of theinspector.A di�erent approach would be not to worry about terms used in the communication and rely ona theory which provides for di�erent denotations of terms in di�erent contexts, as for example thetheories of context discussed by Buva�c, Guha and McCarthy.5 Formalisation of Beppe's dreamThe following notation will be used in the formalisation of the example introduced above.12

B: BeppeM : Mariavp(B; t): Beppe's viewpoint at time tvp(M; t): Maria's viewpoint at time tvp(C; t): the ticket inspector's viewpoint at time tCK(x; t): common knowledge of the set of agents denoted by x at time t;in the example we will use All for everybody,BM for Beppe and Maria and MC for Maria and the inspector;Ticket(x): x's ticket;Has(x; y): x holds y;Shows(x; y; t): x shows ticket y to the inspector at time t;Checked(x): ticket x has been checked.Common knowledge of a set of agents plays a signi�cant role in this example and we express it asone theory for lifting axioms provided for each involved agent to access it. A general formulationof common knowledge which will serve the purpose of the example, is the following.Axioms for common knowledge:(1) 8x; y; z; t in(x; CK(y; t))^ z 2 y ) in(x; vp(z; t))(2) 8x; y; z; t in(x; CK(y; t))^ z 2 y ) in(in(x; vp(z; t)); CK(y; t))to be used in conjunction with the following:(3) All = fM;B;Cg(4) BM = fB;Mg, MC = fM;CgAxioms (1) and (2) provide a proper account of common knowledge to a group of agents, allowingto derive the commonly known facts in any viewpoint, no matter how nested. In particular axiom(2) is used to achieve the appropriate level of nesting in CK, and axiom (1) to lift from the CKviewpoint at time t to any other relevant viewpoint at time t.For example assuming:(a) 8t in(Has(M;Ticket(B)); CK(BM; t))it is possible to derivein(in(Has(M;Ticket(B)); vp(M; t3)); vp(B; t3))which will appear in the proof as line (33), with the following steps:(b) in(Has(M;Ticket(B)); CK(BM; t3)) (a)(c) in(in(Has(M;Ticket(B)); vp(M; t3)); CK(BM; t3)) (2, 4, b)13

(d) in(in(Has(M;Ticket(B)); vp(M; t3)); vp(B; t3)) (1, 4, c)To be more concise, we will skip similar derivation steps from common knowledge from now on.The speci�c knowledge of the problem can be expressed as follows:(5) 8t in(Has(M;Ticket(B))^Has(M;Ticket(M)); CK(BM; t))Both Beppe and Maria know that Maria has both tickets, at any time;(6) 8t in(Has(x; y)^ x 6= z ) :Has(z; y); CK(All; t))Corresponds to the common sense knowledge that only one person can hold a given object.Next we need axioms to describe Maria's act of showing the tickets to the inspector and its e�ect,i.e. the information conveyed in that act. They deserve some discussion.In formalising the information ow one must avoid that also unintended information be transferredbetween viewpoints.For example, one might express as follows the fact that once Maria has shown her tickets, theinspector checks them and thereafter they both know that they have been checked:(7') 8t > t0 in(Shows(M;Ticket(M); t0)^ Shows(M; ticket2; t0); vp(M; t))Maria knows that she has shown both tickets at time t0;(8') 8t > t0 in(Ticket(B) = ticket2; vp(M; t))Maria knows that the second ticket is Beppe's;(9') in(8t00 > t0 Shows(M; y; t0)) in(Checked(y); CK(MC; t00)); CK(All; t))It is common knowledge that after Maria has shown a ticket, at any later time she and theinspector know that the ticket has been checked.However this solution has a aw: applying the law of substitutivity in Maria's viewpoint, Mariaknows that Shows(M; ticket2; t0) and also Shows(M;Ticket(B); t0) and therefore she can con-clude, for instance, that in(Checked(Ticket(B)); vp(C; t3)). The e�ect is therefore that she undulytransfers her information about ticket2 being Beppe's ticket to the viewpoint of the inspector.The solution is then to separate the information ow from the conclusion that each agent is ableto draw from the information gathered.First, we state that showing the ticket is common knowledge of both Maria and the inspector. Thisis the information that is actually transmitted.(7) 8t > t0 in(Shows(M;Ticket(M); t0)^ Shows(M; ticket2; t0); CK(MC; t))Maria and the inspector know that she has shown both tickets at time t0; while the �rst ticketcan be referred to as Maria's ticket the second one is simply \a second ticket" in the commonknowledge viewpoint;(8) 8t > t0 in(Ticket(B) = ticket2; vp(M; t))Maria knows that the second ticket is Beppe's (while the inspector doesn't);14

The �rst statement uses ticket2 and cannot use Ticket(B) since this is not a manifest constant andis therefore forbidden by the principle of referent sharing in a statement on common knowledge.And now we allow each agent to draw his own conclusion about which tickets have been checked:(9) 8t0 > t in(8y Shows(M; y; t)) Checked(y); CK(MC; t0))It is common knowledge of Maria and the inspector that after Maria has shown a ticket, theticket has been checked.Using these statements, we can easily prove the following two lemmas that will be used in theformal account of the reasoning. The �rst lemma, corresponds to the fact that Maria knows thather ticket and Beppe's have been checked by the inspector.Lemma 1 8t > t0 in(Checked(Ticket(B))^ Checked(Ticket(M)); vp(M; t))The second lemma, that will be used in Maria's reasoning, corresponds to the fact that she knowsthat the inspector is aware of having checked her ticket and a second one, referred to as ticket2.Lemma 2 8t > t0 in(in(Checked(Ticket(M))^ Checked(ticket2); vp(C; t)); vp(M; t))in particular, the following facts that Maria will use in her reasoning, can also be proved in viewpointvp(M; t3).Checked(Ticket(B)) ^ Checked(Ticket(M)) (7, 8, 9)in(Checked(ticket2; vp(C; t3)) (7, 9)while it is not the case that the inspector, nor Maria reasoning about the inspector, can deduce:Checked(Ticket(B))Finally we formalise the �rst request from the inspector (the request to show unseen tickets), which,at time t1, becomes part of common knowledge in the following form:(10) 8t � t1 in(:Checked(Ticket(y))^Has(x; T icket(y)), Shows(x; T icket(y); t1); CK(All; t))Figure 1 summarises the axioms that have been used in the statement of the problem.We can now proceed to give a formal account of the reasoning of the di�erent agents at the di�erenttimes involved.This is the reasoning in Beppe's viewpoint, at time t1.15

(1) 8x; y; z; t in(x; CK(y; t))^ z 2 y ) in(x; vp(z; t))(2) 8x; y; z; t in(x; CK(y; t))^ z 2 y ) in(in(x; vp(z; t)); CK(y; t))(3) All = fM;B;Cg(4) BM = fB;Mg, MC = fM;Cg(5) 8t in(Has(M;Ticket(B))^Has(M;Ticket(M)); CK(BM; t))(6) 8t in(Has(x; y)^ x 6= z ) :Has(z; y); CK(All; t))(7) 8t > t0 in(Shows(M;Ticket(M); t0) ^ Shows(M; ticket2; t0); CK(MC; t))(8) 8t > t0 in(Ticket(B) = ticket2; vp(M; t))(9) 8t0 > t in(8y Shows(M; y; t)) Checked(y); CK(MC; t0))(10) 8t � t1 in(:Checked(Ticket(y))^Has(x; T icket(y)),Shows(x; T icket(y); t1); CK(All; t))(21) :in(Checked(Ticket(B)); vp(C; t2))(27) in(:in(Checked(Ticket(B)); vp(C; t2)); vp(C; t2))Figure 1: Problem statement16

vp(B; t1)(11) Has(M;Ticket(B)) (5)Maria has my ticket;(12) :Has(B; Ticket(B)) (11, 6)I do not have my ticket;(13) Checked(Ticket(B)) _ :Has(B; Ticket(B))) :Shows(B; Ticket(B); t1) (10)Since I do not have a ticket the request from the inspector does not apply to me.(14) :Shows(B; Ticket(B); t1) (12, 13)I do not have to show my ticket.Therefore Beppe does nothing. Maria reasons as follows at the same time.vp(M; t1)(15) in(Checked(Ticket(B)) ^ Checked(Ticket(M)) (lemma 1)The inspector has already checked our tickets;(16) Checked(Ticket(B)) _ :Has(M;Ticket(B))) :Shows(M;Ticket(B); t1) (10)The request of the inspector does not apply to Beppe's ticket;(17) :Shows(M;Ticket(B); t1) (15, 16)I do not have to show Beppe's ticket;(18) Checked(Ticket(M))_ :Has(M;Ticket(M))) :Shows(M;Ticket(M); t1) (10)The request of the inspector does not apply to my ticket;(19) :Shows(M;Ticket(M); t1) (15, 18)I do not have to show my ticket.Therefore also Maria has good reasons for doing nothing. After this, at time t2, the commonknowledge is enriched as follows for the fact that nobody shows any ticket:(20) 8t � t2 in(8x; y :Shows(x; y; t1); CK(All; t))Moreover we have the fact that the inspector doesn't remember seeing Beppe's ticket, which is partof the statement of the problem; this however is not common knowledge but it is asserted outsideany viewpoint.(21) :in(Checked(Ticket(B)); vp(C; t2)) (Axiom)17

Reasoning about the inspector in the external viewpoint, where the problem has been stated, andincluding axioms (1)-(10) plus axiom (21).(22) in(8x :Shows(x; T icket(B); t1); vp(C; t2)) (20)the inspector notices, as anybody, that nobody shows Beppe's ticket at time t1;(23) in(Checked(Ticket(B)) _ 8x :Has(x; T icket(B)); vp(C; t2)) (10, 22)he reasons that either the ticket has been checked or nobody has Beppe's ticket.(24) in(9x Has(x; T icket(B)); vp(C; t2)) (Assumption)Assume the inspector believes that somebody has Beppe's the ticket;(25) in(Checked(Ticket(B)); vp(C; t2)) (23, 24)he should at least believe that Beppe's ticket has been checked; but he doesn't by (21),therefore:(26) :in(9x Has(x; T icket(B)); vp(C; t2)) (24, 25, 21)the inspector cannot deduce that somebody has Beppe's ticket.This same reasoning can be performed by the inspector himself, provided we postulate the addi-tional, and reasonable, assumption that he is aware of the fact that he doesn't remember. This canbe made explicit in the statement of the problem or alternatively derived from (21) by negativeintrospection (assuming this is a valid principle in general).vp(C; t2)(27) :in(Checked(Ticket(B)); vp(C; t2)) (Axiom)(28) :in(9x Has(x; T icket(B)); vp(C; t2))a realisation by the inspector of the fact that he cannot tell whether somebody has Beppe'sticket.As a consequence he asks Beppe to show his ticket. It is now common knowledge, at time t3, thatthe inspector does not know whether somebody has Beppe's ticket.(29) in(:in(9x Has(x; T icket(B)); vp(C; t3)); CK(All; t3))Beppe now, at time t3, reasons as follows. 18

vp(B; t3)(30) :in(9x Has(x; T icket(B)); vp(C; t3)) (29)The inspector does not know whether somebody has my ticket;(31) in(Checked(Ticket(B)); vp(C; t3)) (Assumption)Assume the inspector thinks that he has seen my ticket;(32) in(9x Has(x; T icket(B)); vp(C; t3)) (10, 31)He should also believe that somebody has my ticket, but he doesn't by (30);(33) :in(Checked(Ticket(B)); vp(C; t3)) (31, 32, 30)therefore he does not believe that my ticket has been checked;vp(M; t3)(34) :Shows(M;Ticket(B); t1) (20)Maria knows that she did not show my ticket when asked;(35) Has(M;Ticket(B)) (5)Maria knows that she has the ticket;(36) :Checked(Ticket(B)) ^Has(M;Ticket(B)), Shows(M;Ticket(B); t1) (10)Maria is aware of what the inspector said;(37) Checked(Ticket(B)) (34, 35, 36)Maria believes that my ticket has been checked.Therefore Beppe notices a di�erence between the inspector's viewpoint and Maria's viewpoint (lines33 and 37); that's why he asks Maria why she doesn't show his ticket.Finally, solicited by the request of the inspector and, further, from Beppe himself, Maria reasonsas follows.19

vp(M; t3)(38) :in(Checked(Ticket(B)); vp(C; t3))The inspector is not aware of the fact that he checked Beppe's ticket(similar to Beppe's reasoning above).(39) in(Checked(ticket2; vp(C; t3)) (lemma 2)but he certainly remembers having checked a second ticket;(40) :in(ticket2 = Ticket(B); vp(C; t3)) (38, 39)he doesn't realize that the second ticket is Beppe's one(otherwise there would be a contradiction).So she decides that in order to resolve the question she must tell the inspector that the secondticket is Beppe's one. This goes a little beyond Beppe's dream, but it looks like a plausible reasonof the fact that the inspector does not remember: Maria, showing both tickets Beppe being absentcould not refer to Beppe as the owner of the second ticket.6 Technical points about this exampleThe reasoning performed by the agents involved in the situation described by the example is simpleand intuitive, yet it appears that its formal account has some requisites in terms of expressivity ofthe logical representation language to make it an interesting case study. In the following we willdiscuss additional aspects of the proposed formalisation.6.1 Viewpoint functionsWe have several agents (Maria, Beppe, the inspector) and several times corresponding to situationswith di�erent knowledge involved. We use vp(a; t), a viewpoint function denoting the viewpointof agent a at time t; the example shows the importance of viewpoint functions with variablesquanti�ed in; this way it is possible to express, for example, that a certain fact holds from a certaintime on, or, if necessary, that there is a time when a fact holds.6.2 Propagation of ignoranceThe inspector does not remember having checked Beppe's ticket, and as a consequence he makeseverybody aware of the fact that he does not know whether Beppe has a ticket, and as a furtherconsequence Maria can realize that the inspector does not know that the second ticket he has seenis Beppe's ticket.Note that in the example we do not deal with deduction of ignorance from the fact somebody cannotdeduce something, a property which is in general undecidable in a �rst order setting (see [1, 10] for20

examples of this approach). In other words ignorance in not \introduced" but only \propagated".All we do is to use a much more conservative and sound pattern of reasoning for propagation ofignorance, namely: if we have :in(A; vp) and we want to prove :in(B; vp), we can assume in(B; vp)and try to prove in(A; vp); if this succeeds, we have succeeded in proving :in(B; vp).In other words the following is a sound rule of inference::in(A; vp); in(B ) A; vp):in(B; vp) (Propagation of Ignorance)6.3 Viewpoint consistency is an optionIn the example we do not deal with nonmonotonic aspects such as changes of mind, assumptions bydefault, resolving contradictions, and so on. In this problem once a piece of knowledge is acquiredin a viewpoint it is also assumed to hold in successive viewpoints in time.Dealing with nonmonotonic aspects would require writing problem dependent axioms stating whatchanges and what doesn't from one viewpoint to the next in time.In this respect some of the ideas presented in connection with the step/active logics by Perlis andco-authors look promising [22, 19]. As an example we could exploit their approach to resolvingcontradictions, once they manifest explicitly, by failing to inherit to the next step contradictingassumptions.This can be done since consistency of viewpoints is an option: the axiom :in(false; vp) does nothold in general; a viewpoint can become inconsistent without a�ecting other viewpoints nor theglobal reasoning context. This means that in the presence of a contradictory viewpoint, without theconsistency axiom, the inconsistency does not propagate outside and one can consistently reasonabout it and adopt the best strategy available to create a new consistent viewpoint.7 Implementation of viewpointsThe implementation of the Omega description logic [3] provided a viewpoints mechanism whichemphasised a hierarchical organisation of viewpoints. Viewpoints, as the other descriptions ofthe Omega system, could be arranged in a lattice, where a viewpoint inherited from another byincluding all the sentences belonging to it. Thereafter a viewpoint would inherit all the logicalconsequences from its ancestor viewpoints. This proved useful for instance to create viewpointsdescribing a basic theory (e.g. natural deduction), from which more speci�c viewpoints could becreated by adding new statements.A new implementation of the theory of viewpoints is in progress using the Coq Proof Assistantwhich supports the development of higher order logics [11]. The logical language used by Coq is avariety of type theory, called the Calculus of Inductive Constructions.The �-calculus notation can be used as a uniform encoding for expressions, assertions and proofs.Type checking rules enforce well-formedness conditions. According to the Curry-Howard isomor-phism, assertions are represented as types and proofs are represented as terms whose type is the21

formula they prove. Proving a formula is therefore seen as exhibiting a term of a given type (provingconstructively that the type is populated).For de�ning a new logic system one has to provide:1. a de�nition of w�'s: by de�ning a signature for terms and formulas;2. a de�nition of the logical axioms: asserting the existence of constants, whose type is thegeneric formula corresponding to the axiom schema;3. a de�nition of the inference rules: asserting the existence of constants, of functional type,mapping the premises into the conclusions;Using the higher order features of the language the naming device used for reifying sentences atthe metalevel and for the formulation of the re ection rules is greatly simpli�ed: sentences arerepresented as terms at any level.An important task will be to prove that the presentation of the logic (by means of a speci�csignature) is adequate in the sense that the encoding is a compositional bijection between thesyntactic entities (terms, formulas, proofs) of the logical system and certain valid �-terms in thesignature. In particular we will have to prove that the higher order does not introduce any additionaltheorems.8 ConclusionWe have discussed properties of a theory of viewpoints which extends a classical natural deductioncalculus with sentences of the type in(A; vp) and with axioms and inference rules for contextualreasoning.We argued that an appropriate formalisation of the e�ect of communication acts is to extend thecommon knowledge of the participants with statements which can only contain terms made out ofmanifest constants, so that referent sharing is ensured.References[1] L. C. Aiello, D. Nardi, M. Schaerf (1988). Reasoning about Knowledge and Ignorance, inInternational Conference of 5th generation Computer System, Tokyo, 618-627.[2] G. Attardi and M. Simi (1984). Metalanguage and reasoning across viewpoints, in ECAI84:Advances in Arti�cial Intelligence, T. O'Shea (ed.), Elsevier Science Publishers, Amsterdam.[3] Attardi G., M. Simi (1986). A Description Oriented Logic for Building Knowledge Bases,Proceedings of the IEEE , 74(10), October 1986, 1335-1344.[4] G. Attardi and M. Simi (1991). Re ections about re ection, in Allen, J. A., Fikes, R., andSandewall, E. (eds.) Principles of Knowledge Representation and Reasoning: Proceedings ofthe Second International Conference. Morgan Kaufmann, San Mateo, California.22

[5] G. Attardi and M. Simi (1993). A formalisation of viewpoints, TR-93-062, International Com-puter Science Institute, Berkeley, appears also in Fundamenta Informaticae, 23, numbers 2,3,4,Jun-Aug 1995, 149-173.[6] G. Attardi and M. Simi (1994). Proofs in context, in Doyle, J. and Torasso, P. (eds.) Prin-ciples of Knowledge Representation and Reasoning: Proceedings of the Fourth InternationalConference. Morgan Kaufmann, San Mateo, California.[7] S. Buva�c and I.A. Mason (1993). Propositional Logic in Context, Proc. of the Eleventh AAAIConference, Washington DC, 412-419.[8] S. Buva�c, V. Buva�c, and I.A. Mason (1995). Metamathematics of Contexts, Fundamenta In-formaticae, 23, numbers 2,3,4, Jun-Aug 1995, 263-301.[9] S. Buva�c (1995). Quanti�cational Logic of Context, Proceedings of the Workshop on ModelingContext in Knowledge Representation and Reasoning (held at the Thirteenth InternationalJoint Conference on Arti�cial Intelligence).[10] A. Cimatti and L. Sera�ni (1994). Multi Agent Reasoning with Belief Contexts: the Approachand a Case Study, proceedings of ECAI-94, Workshop on Agent Theories, Architectures, andLanguages.[11] C. Cornes, J. Courant, J.C. Filliatre, G. Huet, P. Manoury, C. Paulin-Mohring, C. Mu~noz, C.Murthy, C. Parent, A. Sa��bi, B. Werner (1995). The Coq Proof Assistant, Reference Manual -Version 5.10, Project Coq, INRIA-Rocquencourt.[12] F. Giunchiglia, L. Sera�ni, Multilanguage hierarchical logics (or: how we can do without modallogics), Arti�cial Intelligence, 65:29-70, 1994.[13] R.V. Guha (1991). Contexts: A Formalization and Some Applications, MCC Technical ReportNumber ACT-CYC-423-91, also published as technical report STAN-CS-91-1399-Thesis.[14] A. Gupta, Truth and paradox, Journal of Philosophical Logic, 11, 1982, 1-60.[15] H. Herzberger, Notes on naive semantics, Journal of Philosophical Logic, 11, 1982, 61-102.[16] D. Kalish and R. Montague (1964). Logic: techniques of formal reasoning, New York, Harcourt,Brace & World.[17] S. Kripke, Outline of a theory of truth, Journal of Philosophy , 22(1), 1975, 690-716.[18] J. McCarthy (1993). Notes on Formalizing Context, Proceedings of the Thirteenth InternationalJoint Conference on Arti�cial Intelligence, Chambery.[19] M. Miller (1995). Context Shifts and Clashes in Dialogues: An Active Logic Perspective,Fundamenta Informaticae, 23, numbers 2,3,4, Jun-Aug.[20] R. Montague (1963). Syntactical treatment of modalities, with corollaries on re exion princi-ples and �nite axiomatizability, Acta Philosoph. Fennica, 16, 153-167.23

[21] D. Perlis (1985). Languages with self-reference I: foundations, Arti�cial Intelligence, 25:301-322.[22] J. J. Elgot-Drapkin, D. Perlis (1990). Reasoning Situated in Time I: Basic Concepts, Journalof Experimental and Theoretical Arti�cial Intelligence.[23] W.V. Quine (1953). On Mental Entities, The Ways of Paradox and other essays, HarvardUniversity Press, 221-227.[24] W.V. Quine (1968). Linguistics and Philosophy, The Ways of Paradox and other essays, Har-vard University Press, 56-59.[25] Y. Shoham (1991). Varieties of contexts, in Vladimir Lifschitz (ed.), Arti�cial Intelligence andthe Mathematical Theory of Computation: Papers in Honor of John McCarthy, AcademicPress, 393-407.[26] M. Simi (1991). Viewpoints subsume belief, truth and situations, in Trends in Arti�cial Intel-ligence, Proc. of 2nd Congress of the Italian Association for Arti�cial Intelligence, Ardizzone,Gaglio, Sorbello (Eds), Lecture Notes in Arti�cial Intelligence 549, Springer Verlag, 38-47.[27] R.W. Weyhrauch (1980). Prolegomena to a theory of mechanized formal reasoning, Arti�cialIntelligence, 13(1,2):133-170.

24