Reasoning About the Transfer of Control

We present DCL-PC: a logic for reasoning about how the abilities of agents and coalitions of agents are altered by transferring control from one agent to another. The logical foundation of DCL-PC is CL-PC, a logic for reasoning about cooperation in which the abilities of agents and coalitions of agents stem from a distribution of atomic Boolean variables to individual agents -- the choices available to a coalition correspond to assignments to the variables the coalition controls. The basic modal constructs of DCL-PC are of the form coalition C can cooperate to bring about phi. DCL-PC extends CL-PC with dynamic logic modalities in which atomic programs are of the form agent i gives control of variable p to agent j; as usual in dynamic logic, these atomic programs may be combined using sequence, iteration, choice, and test operators to form complex programs. By combining such dynamic transfer programs with cooperation modalities, it becomes possible to reason about how the power of agents and coalitions is affected by the transfer of control. We give two alternative semantics for the logic: a direct semantics, in which we capture the distributions of Boolean variables to agents; and a more conventional Kripke semantics. We prove that these semantics are equivalent, and then present an axiomatization for the logic. We investigate the computational complexity of model checking and satisfiability for DCL-PC, and show that both problems are PSPACE-complete (and hence no worse than the underlying logic CL-PC). Finally, we investigate the characterisation of control in DCL-PC. We distinguish between first-order control -- the ability of an agent or coalition to control some state of affairs through the assignment of values to the variables under the control of the agent or coalition -- and second-order control -- the ability of an agent to exert control over the control that other agents have by transferring variables to other agents. We give a logical characterisation of second-order control.


Introduction
In recent years, there has been much activity in the development of logics for reasoning about the strategic and cooperative abilities of agents in game-like multi-agent systems.Coalition Logic (Pauly, 2001) and Alternating-time Temporal Logic (ATL) Alur, Henzinger, and Kupferman (2002) are perhaps the best-known examples of such work.These logics have been widely used as a base from which to investigate reasoning about cooperation in multi-agent systems (van der Hoek & Wooldridge, 2003;Jamroga & van der Hoek, 2004;Goranko & Jamroga, 2004).
Although they differ on details, the basic construct in both Coalition Logic and ATL is the cooperation modality, a construct that is written in ATL as C ϕ.The intended meaning of this expression is that the coalition C can cooperate in such a way as to ensure that, no matter what the agents outside C do, the property ϕ becomes true.Another way to think about C ϕ is as meaning that coalition C has the collective power to ensure that ϕ.It is often assumed that powers are additive, in the sense that the powers of a coalition derive from the powers of coalition members, and that adding an agent to a coalition does not reduce the powers of that coalition.However, the origin of an individual agent's powers -that is, where these powers derive from -is rarely discussed in the cooperation logic literature.
One very natural interpretation for powers or abilities in computational systems arises from considering which system components have the ability to assign values to the variables making up the overall system state.Power, in this sense, equates to the ability to choose a value for a particular variable.Motivated by this observation, van der Hoek and Wooldridge developed CL-PC, a cooperation logic in which powers are specified by allocating to every agent a set of Boolean variables: the choices (and hence powers) available to a coalition then correspond to the possible assignments of truth or falsity that may be made to the variables under their control (van der Hoek & Wooldridge, 2005b).The CL-PC expression C ϕ means that coalition C can assign values to the variables under its control in such a way as to make ϕ true.Van der Hoek and Wooldridge gave a complete axiomatization of CL-PC, and showed that the model checking and satisfiability problems for the logic are both PSPACE-complete; they also investigated how CL-PC could be used to characterise the closely related notion of control.However, one drawback of CL-PC is that the power structure underpinning the logic -the distribution of variables to agents -is assumed to be fixed, and hence coalitional powers are static in CL-PC.
Ultimately, of course, the assumption that powers are static is not realistic.For example, the explicit transfer of power and control is a fundamental component of most human organisations, enabling them to avoid bottlenecks with respect to centralised power and control.Moreover, in open environments, where agents join and leave a system at run-time, it may not be possible to know in advance which agents are to fulfill which roles, and so static power allocation schemes are simply not appropriate for such environments.If software agents are to be deployed in environments where power structures are dynamic, then it is important to consider the issues of representing and reasoning about them, and it is to this issue that we address ourselves in the present paper.
We study a variant of CL-PC that allows us to explicitly reason about dynamic power structures.The logic DCL-PC extends CL-PC with dynamic logic operators (Harel, Kozen, & Tiuryn, 2000), in which atomic programs are of the form i ; p j, which is read as 'agent i gives control of variable p to agent j'.The pre-condition of such a program is that variable p is in agent i's allocation of variables, and executing the program has the effect of transferring variable p from agent i to agent j.Thus the dynamic component of DCL-PC is concerned with transferring power in systems, and by using the logic, we can reason about how the abilities of agents and coalitions are affected by such transfers.Note that, as in conventional dynamic logic, atomic programs may be combined in DCL-PC with the usual sequential composition (';'), non-deterministic choice ('∪'), test ('?'), and iteration (' * ') operations, to form complex programs.With these features, DCL-PC provides a rich framework through which to represent and reason about systems in which power/control is dynamically allocated.
In the remainder of the paper, following an introduction to the logic, we make four main contributions with respect to DCL-PC: • First, in Section 2, we give two alternative semantics for the logic: a 'direct' semantics, in which models directly represent the allocation of propositional variables to the agents that control them, and a more conventional Kripke semantics.We prove that these two semantics are equivalent.
• Second, we give an axiomatization of DCL-PC in Section 3, and show that this axiomatization is sound and complete (with respect to both semantics).
• Third, we show in Section 4 that, despite the apparently additional expressive power provided by the dynamic component of DCL-PC, the satisfiability and model checking problems for DCL-PC are no more complex than the corresponding problems for CL-PC (van der Hoek & Wooldridge, 2005b): they are both PSPACE-complete.
• Fourth, we distinguish between first-order control and second-order control in Section 5.
While first-order control, as introduced and studied by van der Hoek and Wooldridge (2005b), is the ability to control some state of affairs by assigning values to variables, second-order control is the ability of an agent to exert control over the ability of other agents to control states of affairs.Agents and coalitions can exercise second-order control by transferring variables under their control to other agents.After informally discussing and introducing secondorder control, we develop a logical characterisation of it, in the sense that we characterise the formulae over which an agent has second-order control.
We conclude in brief with some comments on related work and conclusions.Note that we omit a detailed introduction to cooperation logics and in particular the motivation behind CL-PC, as this was done by van der Hoek and Wooldridge (2005b).

The Logic DCL-PC
In this section, we define the logic DCL-PC.

An Informal Introduction
We begin with an informal introduction; readers who are familiar with both CL-PC and dynamic logic may wish to skim or skip completely this introductory section.
As we noted earlier, DCL-PC extends the logic CL-PC, and we begin by briefly reviewing this logic.CL-PC is intended to allow us to reason about domains containing a collection of agents, and a collection of propositional variables; let A = {1, . . ., n} denote the set of agents, and P denote the variables.It is assumed in CL-PC that each agent in the system controls some subset of the variables P. To keep things simple, it is assumed that agents exercise unique control: every variable is controlled by exactly one agent, and so the variables P are partitioned among the agents A. Where i ∈ A is an agent, we denote the variables under the control of i by P i , so P i ⊆ P. The abilities or powers of an agent in such a scenario correspond to the assignments of truth or falsity that it can make to the variables under its control.Figure 1 illustrates a typical scenario: we have four agents, A = {1, 2, 3, 4}, and eight variables, P = {p, q, r, s, t, u, v, w}.Agent 1 controls variables p and q, (P 1 = {p, q}), while agent 2 controls variable r, (P 2 = {r}), and so on.In the scenario illustrated, variables p, q, s, and w have the value '1' (i.e., 'true'), while all other variables have the value 0 ('false').The language of CL-PC is intended to allow us to represent and reason about such scenarios.To represent the values of variables, we use propositional logic, and so the following formula completely characterises the values of the variables in this scenario: p ∧ q ∧ s ∧ w ∧ ¬r ∧ ¬t ∧ ¬u ∧ ¬v Agents are able to change the value of the variables under their control, and to represent these abilities in CL-PC we use a contingent ability operator (van der Hoek & Wooldridge, 2005b): the expression C ϕ means that, under the assumption that the world remains otherwise unchanged, the set of agents C can modify the value of their variables so as to make ϕ true.With respect to the scenario in Figure 1, for example, we have This is because agent 1 can leave variable p set at true while making variable q false, while agent 2 makes variable r true: this will result in the formula p ∧ r ∧ ¬q being true.
The fact that no matter what coalition C do, ϕ will remain true is expressed by 2 C ϕ.In the scenario in Fig- ure 1, no matter what agent 1 does, r will remain false (assuming again that no other agent acts).Thus we have: As shown elsewhere (van der Hoek & Wooldridge, 2005b), and as defined below, other types of ability operators may also be defined.
Thus far, the operators we have introduced have all been part of the CL-PC language.Let us now start to introduce the dynamic aspects of the language, specific to DCL-PC.First, we have the idea of an atomic transfer program, written i ; p j, meaning 'agent i transfers the power to choose a truth value for the variable p to agent j'.Now, it will be possible to execute a program i ; p j iff the variable p is actually under the control of agent i.For example, with respect to Figure 1, the programs 1 ; p 2 and 2 ; r 1 are executable, while the program 1 ; r 2 is not (since r is not under the control of 1).The (fairly obvious) effect of executing the program 1 ; p 2 is illustrated in Figure 2; note that the actual value of the variable being transferred is unchanged by the transfer.
In DCL-PC, we allow atomic programs to be combined together to make more complex programs using constructs from dynamic logic: ';' (for sequential composition), ' * ' (iteration), and '?' (the 'test' operator).The simplest of these is sequential composition: for example, the program 1 ; p 2; 2 ; r 1 means that, first, agent 1 gives variable p to 2, and then, agent 2 gives r to 1.The operator ∪ is a non-deterministic choice operator.If τ 1 and τ 2 are transfer programs, then τ 1 ∪ τ 2 means 'do either program τ 1 or τ 2 '.The ' * ' operator is used to define iteration: the expression τ * means 'execute the program τ zero or more times' (it is not defined exactly how many times τ will be executed).Finally, the '?' is used to perform tests.The program ϕ? can be executed in a particular scenario only if the formula ϕ is true of that scenario.To illustrate how these operator work, consider the following example programs.p?; 1 ; p 2 This first program says 'if p is true, then agent 1 gives p to agent 2'.Now, since p is true in the scenario in Figure 1, then this program can be executed from the scenario in Figure 1, and the net result is the same as the final scenario in Figure 2.
The following program uses non-deterministic choice, and essentially says 'agent 1 gives either p or q to 2'. ( As is usual with dynamic logic, we can define the iteration and selection constructs used in conventional imperative programming languages from these basic program constructs.For example, the conventional programming construct while ϕ do τ can be defined using the following transfer program construct (see, e.g., Harel et al., 2000): The next step is to see how transfer programs are incorporated with the ability constructs of CL-PC.
To be able to refer to transfer programs and their properties from within the language of DCL-PC, we use the dynamic operators ' τ ϕ' and '[τ ]ϕ'.These operators play the same role in DCL-PC that they play in conventional dynamic logic (Harel et al., 2000).Thus a formula τ ϕ asserts that 'there exists a computation of program τ , starting from the current situation, such that after τ has terminated ϕ holds'.Note that τ ϕ does not assert that τ is guaranteed to terminate, merely that it has at least one terminating computation.And moreover, it does not state that ϕ is satisfied after every terminating computation of τ ; merely that there is some terminating computation that will end in a situation satisfying ϕ.Thus τ acts as an existential quantifier over the computations of τ .The operator [τ ]ϕ is a universal quantifier over the computations of τ .It asserts that after every terminating computation of τ , the property ϕ holds.Note that it does not assert that τ in fact has any terminating computations.
As an example of the use of these constructs, the following formula asserts that if agent 1 gives either p or q to 2, then 2 will be able to achieve (p ∨ q) ∧ r.
It is easy to see that this formula expresses a true property of the scenario in Figure 1: the program (1 ; p 2) ∪ (1 ; q 2) is executable in this scenario, and after it is executed, agent 2 will control variable r and either variable p or variable q.Agent 2 will thus be able to make (p ∨ q) ∧ r true.
To conclude this introductory section, consider the following more complex example.The following DCL-PC formula asserts that it is possible for agent i to give away its variables to agent j, non-deterministically choosing one variable at a time, until agent j has the ability to achieve ϕ. while ¬ j ϕ do

Syntax
Formally, the language of DCL-PC is formed with respect to a (fixed, finite, non-empty) set A of agents, and a (fixed, finite, non-empty) set P of propositional variables.Figure 3 defines the syntax of DCL-PC.We use as a logical constant for truth, '¬' for negation, and '∨' for disjunction.As usual, we define the remaining connectives of classical propositional logic as abbreviations: Additionally, where Φ is a set of DCL-PC formulas, we write ϕ∈Φ ϕ to mean that exactly one member of Φ is true: Where Φ = {ϕ 1 , ϕ 2 . . .ϕ n }, we will also write With respect to transfer programs, other constructs from conventional imperative programs may be defined as follows (Harel et al., 2000): while ϕ do τ = ((ϕ?; τ ) * ; ¬ϕ?) repeat τ until ϕ = τ ; (¬ϕ?; τ ) * ; ϕ? skip = ?fail = ⊥?
Where there is no possibility of confusion, we will omit set brackets for cooperation modalities, for example writing 1,2 rather than {1,2} .A DCL-PC formula containing no modalities is said to be an objective formula.
Let P(ϕ) denote the set of propositional variables occurring in DCL-PC formula ϕ, and let A(ϕ) denote the set of all agents named in ϕ (i.e., A(ϕ) is the union of all the coalitions occurring in cooperation modalities in ϕ and all the agents occurring in transfer programs in ϕ).
Although the * operator is useful to define programs succinctly, we will in fact see in Theorem 2 that it is superfluous, which essentially uses the fact that our set of atoms and agents are finite.

Direct Semantics
We now introduce the first of our two semantics for DCL-PC.We call this semantics a 'direct' semantics because it is directly based on the intuitive model that we introduced earlier: every agent has unique control of some set of propositional variables, with every variable being controlled by some agent.
Given a fixed, finite and non-empty set A of agents, and a fixed, finite and non-empty set P of propositional variables, we say an allocation of P to A is an indexed tuple ξ = P 1 , .where there is an indexed element P i for each i ∈ A, such that P 1 , . . ., P n forms a partition of P (i.e., P = i∈A P i and P i ∩ P j = ∅ for all i = j ∈ A).The intended interpretation of an allocation ξ = P 1 , . . ., P n is that P i ⊆ P is the set of propositional variables under agent i's control.That is, agent i has freedom to allocate whatever Boolean values it sees fit to the members of P i .Of course, we could have defined an allocation ξ as a function ξ : P → A, so that ξ(p) denotes the agent controlling propositional variable p; there seems no particular reason for preferring one representation rather than the other, and so for consistency with the historical record, we will adopt the partition representation, as used by van der Hoek and Wooldridge (2005b).Now, we say a model for DCL-PC is a structure: where: • A = {1, . . ., n} is a finite, non-empty set of agents; • P = {p, q, . ..} is a finite, non-empty set of propositional variables; • ξ 0 = P 1 , . . ., P n is the initial allocation of P to A, with the intended interpretation that P i is the subset of P representing those variables under the control of agent i ∈ A; and finally, • θ : P → {tt, ff} is a propositional valuation function, which determines the initial truth value of every propositional variable.
Some additional notation is convenient in what follows.A coalition C is a subset of A, i.e., C ⊆ A.
For any such C ⊆ A, we denote the complement of C, (i.e., A \ C) by C. We will write P C for i∈C P i .For two valuations θ and θ , and a set of propositional variables Ψ ⊆ P, we write θ = θ (mod Ψ) if θ and θ differ at most in the propositional variables in Ψ, and we then say that θ and θ are the same modulo Ψ.We will sometimes understand the model M to consist of a frame F = A, P, ξ 0 together with a propositional valuation function θ.Given a model M = A, P, ξ 0 , θ and a coalition C in M, a C-valuation is a function: Thus a C-valuation is a propositional valuation function that assigns truth values to just the propositional variables controlled by the members of the coalition C. If M = A, P, ξ 0 , θ with ξ 0 = P 1 . . ., P n is a model, C a coalition in M, and θ C a C-valuation, then by M ⊕ θ C we mean the model A, P, ξ 0 , θ , where θ is the valuation function defined as follows and all other elements of the model are as in M. Thus M ⊕ θ C denotes the model that is identical to M except that the values assigned by its valuation function to propositional variables controlled by members of C are determined by θ C .We define the size of a model M = A, P, ξ 0 , θ to be |A| + |P|; we denote the size of M by size(M).

Transfer Program Relations
To give a modal semantics to the dynamic logic constructs of DCL-PC, we must define, for every transfer program τ a binary relation R τ over models such that (M 1 , M 2 ) ∈ R τ iff M 2 is a model that may result from one possible execution of program τ from M 1 .We start by defining the relation R i;pj , for atomic transfer programs of the form i ; p j, i.e., agent i gives control of propositional variable p to agent j.Let M = A, P, ξ 0 , θ and M = A , P , ξ 0 , θ be two models with ξ 0 = P 1 , . . ., P n and ξ 0 = P 1 , . . ., P n .Then In order to define M |= d ϕ, which means that ϕ is true in M under the direct semantics, we need to be able to determine what the interpretation of an arbitrary program is, on M; we define this below.Notice that executing an atomic transfer program has no effect on the valuation function of a model.Transfer programs only affect the distribution of propositional variables to agents.
For the remaining constructs of transfer programs, we define the program relations inductively, in terms of the relations for atomic transfer programs, as defined above.Let the composition of relations R 1 and R 2 be denoted by R 1 • R 2 , and the reflexive transitive closure (ancestral) of relation R by R * .Then the accessibility relations for complex programs are defined as follows (Harel et al., 2000): Notice that the last of these definitions refers to the relation |= d , which of course has not yet been defined.The aim of the next section is to define this relation.We emphasise that, although the relations R ϕ? and |= d mutually refer to one-another, both relations are in fact well-defined (as in conventional dynamic logic).

Truth Conditions
We interpret formulas of DCL-PC with respect to models, as introduced above.Given a model M = A, P, ξ 0 , θ and a formula ϕ, we write M |= d ϕ to mean that ϕ is satisfied (or, equivalently, true) in M, under the 'direct' semantics.The rules defining the satisfaction relation |= d are as follows: We say a formula is objective if it contains no modal constructs (i.e., operators C or τ ).Thus objective formulae are formulae of classical propositional logic.We assume the conventional definitions of satisfiability and validity: a DCL-PC formula ϕ is d -satisfiable iff there exists a DCL-PC model M such that M |= d ϕ, and ϕ is d -valid iff for every DCL-PC model M we have M |= d ϕ.We write |= d ϕ to indicate that ϕ is d -valid.A valid formula is also called a tautology.We say ϕ is feasible if it is satisfiable but not valid.Finally, for any set of formulas Γ and formula ϕ, we define Let us define the box '2 Where C is a coalition and ϕ is a formula of DCL-PC, we write controls(C, ϕ) to mean that C can choose ϕ to be either true or false: By using the controls( Observe that property ( 2) is not true for arbitrary DCL-PC formulas.To see this, take for example the formula i ; p j , no matter whether we define P( i ; p j ) to be {p} or ∅.We have |= d ¬controls(i, i ; p j ): independent of i owning p, exactly one of the two formulas i ; p j and ¬ i ; p j is true.That is, p ∈ P i in M iff M |= d i ; p j .Also note that the ←-direction of the right hand side of ( 2) is not valid for objective ϕ: suppose M = A, P, ξ 0 , θ such that θ(q) = tt, p ∈ P i , and q / ∈ P i .Then, we have M |= d controls(i, p∧q)∧ ¬(controls(i, p) ∧ controls(i, q)): because q 'happens' to be true in M, i controls the conjunction p ∧ q, but not each of its conjuncts.

A Kripke Semantics
Although the direct semantics naturally captures the notions of propositional control and transfer of control, for some purposes -establishing completeness in particular, and relating it to the main stream of modal logic -it is more convenient to formulate the semantics for DCL-PC using conventional Kripke structures (Chellas, 1980;Blackburn, de Rijke, & Venema, 2001).The idea is that, given the (fixed, finite, non-empty) set A of agents and (fixed, finite, non-empty) set P of propositional variables, there will be a possible world for every possible allocation of the variables in P to the agents in A and every possible propositional valuation function over P. Between those worlds, there are basically two 'orthogonal' accessibility relations (cf. Figure 4): a 'horizontal' and a 'vertical' one.First of all, we have a 'horizontal' relation R i for agent i between two worlds u and v if agent i is able, given the valuation θ u in u, to turn it into the valuation θ v as described by v, just by choosing appropriate values for her variables.Formally, (u, v) ∈ R i iff θ u = θ v (mod P i ).That is, R i is an equivalence relation.In what follows, we drop the symbolic distinction between worlds and valuations, i.e., we use θ for denoting a world and a valuation interchangeably.Notice  that the 'horizontal' relation does not affect the allocation ξ: it remains unchanged.Let us therefore define our Kripke models to be M = Θ, R i∈A , ξ , where Θ is the set of all valuations θ over P. It is important to realize that the sets A of agents and P of variables are fixed, but the allocations of variables to agents may vary.We denote the set of all such Kripke models by K(A, P).We will call a pair (M, θ) a pointed Kripke model, and we will sometimes omit the brackets for such a pair.
Secondly, the 'vertical' accessibility relation is between pointed models (M, θ) and (M , θ ), where M = Θ, R i∈A , ξ , M = Θ, R i∈A , ξ ∈ K(A, P), which indicate a change of the allocation ξ to ξ .Since such a change of allocation does not affect the current world, we have for such pairs that θ = θ .Slightly abusing notation, we define (M, θ)(i ; p j)(M , θ ) exactly when θ = θ and p ∈ P i , and either i = j and M = M , or else P i = P i \ {p} and P j = P j ∪ {p}, and all the other sets P h remain the same.
The truth relation |= K interpreting formulas over Kripke structures holds between pairs of the form (M, θ) and formulas ϕ.Its definition is as follows (we omit the Boolean cases and the cases for complex transfer programs): For a set of formulas Γ and a formula ϕ, we define 4 illustrates the Kripke semantics.Note that for the sets P i and P j in the Kripke model M we have P i = P i \{p} and P j = P j ∪{p}.Note that in the clause for C ϕ, the two pointed models M, θ and M, θ are 'the same except for at most the atoms in P C '.This is a special case of two models being 'similar upto a set of atoms' (French, 2006;Ghilardi & Zawadowski, 2000).

Remark 2 Note that in fact, in the Kripke semantics, formulas are not interpreted in a model and a valuation only, but in the context of other models (which are reached by the atomic program i ; p j).
There are finitely many of them, one for each ξ.Call this collection of models κ.In fact, this κ is the structure with respect to which formulas are interpreted.In that sense, there is only one Kripke model for the language (w.r.t.A, P): it is κ.We will prove completeness with respect to this unique two-dimensional model, in Section 3.

The following lemma is easily established by induction on ϕ:
Lemma 2 For any fixed sets of agents A and propositional variables P, the direct semantics and the Kripke semantics are equivalent, i.e., for any ϕ, any M ∈ K(A, P) with M = Θ, R i∈A , ξ , and any model M = A, P, ξ, θ : As usual, we define M |= K ϕ as ∀θ : M, θ |= K ϕ, and |= K ϕ as ∀M : M |= K ϕ.

A Complete Axiomatization
A sound and complete axiomatization for DCL-PC is presented in Figure 5.For the ease of exposition, we divide the axiomatization into five categories, as follows.While the 'Propositional Component' and the 'Rules of Inference' are straightforward, the 'Dynamic Component' is an immediate adaptation of Propositional Dynamic Logic (Harel et al., 2000).The 'Control Axioms' are inherited from CL-PC (van der Hoek & Wooldridge, 2005b).(The occurrence of (p) refers to a literal with atomic proposition p: it is either p or ¬p, with the obvious meaning for ¬ (p).)Note that allocation specifies that every propositional variable is assigned to exactly one agent (i.e., we have an allocation), while in contrast, for the fixed allocation ξ that was assumed in CL-PC, one could explicitly state that controls(i, p), for every p ∈ P i (van der Hoek & Wooldridge, 2005b).
For the 'Transfer & Control Axioms', atomic permanence states that no program τ changes the valuation.From this, one easily extends this to arbitrary objective formulas (obtaining objective permanence, see Theorem 1 below).The axiom persistence 1 (control) says that i's control over p is not affected when we move to another valuation, and axiom persistence 2 (control) specifies Propositional Component Prop ϕ where ϕ is any objective tautology where p ∈ P(ψ), and where i = j or p = q precondition(transfer) i ; p j → controls(i, p) transfer controls(i, p) → i ; p j controls(j, p) func controls(i, p) how i remains in control over p, even when a transfer program is executed: either the variable passed in that program is not p, or the delegating agent is not i.The axiom precondition(transfer) expresses that agents can only give variables away that they possess, and, finally func says that the transition relation associated with an atomic transfer program is functional: at most one resulting world emerges.
The following theorem lists some properties of DCL-PC, where controls(C, p) is defined in equation (1) above.

The axioms K(i), T(i), B(i), and effect(i) have coalitional counterparts K(C), T(C), B(C),
and effect(C) that are all derivable for any coalition C.
controls(C, p) → 2 j controls(C, p), i.e., the property persistence 1 (control) is also derivable when we replace agent i by an arbitrary coalition C.
Proof: See Appendix A.

QED
Consider the language without dynamic transfer operators, in which we only have propositional logic with cooperation modalities C .Models for these are M, M ∈ K(A, P).In this program-free language, every formula is equivalent to one without any occurrences of coalition operators van der Hoek and Wooldridge (2005b).For instance, suppose that We now establish a similar result for the language including programs.Any world (M, θ) is completely characterized when we know which variables are true in it, and what the allocation of variables to agents is.In such a case, the truth of all objective formulas, formulas involving abilities and transfer programs is completely determined.
Lemma 3 Let ϕ be an arbitrary DCL-PC formula and ζ a conjunction of assertions of the form controls(j, p) or ¬controls(j, p).Then, in DCL-PC, we can derive it is sufficient to prove the claim for an individual agent i.Moreover, we can move all conjuncts of ζ out one by one, once we know that where ±controls(j, p) is either controls(j, p) or ¬controls(j, p).We do the reasoning for the nonnegated case (the other one is similar However, by using the theorem persistence(non-control) from Figure 6 (which we derive below), we have for the second disjunct that ¬controls(j, p) ∧ i (ϕ ∧ controls(j, p)) ↔ ⊥.That concludes the proof.
For persistence(non-control), the right-to-left direction follows immediately from T(j).For the other direction, assume that ¬controls(i, p).From allocation we derive that and from this, by persistence 1 (control), we get k =i 2 j controls(k, p).For every k = i, we have controls(k, p) → ¬controls(i, p), which follows from allocation.Hence, using Necessitation, we have 2 j (controls(k, p) → ¬controls(i, p)).From Axiom K(j), it now follows that 2 j controls(k, p) → 2 j ¬controls(i, p).Combining this with k =i 2 j controls(k, p), we obtain the desired conclusion 2 j ¬controls(i, p).

QED
Soundness of the axiom schemes in Figure 5 is readily checked.We now proceed to prove that the axiomatic system for DCL-PC in Figure 5 is complete.First, we introduce some notation.Definition 1 Given the set of propositional variables P, a valuation description π is a conjunction of literals (p or ¬p) over them such that every propositional variable in P occurs in one literal.
Notice that, for each propositional variable p ∈ P, it holds that either π → p, or π → ¬p.We denote the set of all valuation descriptions over P with Π.Notice that, for each valuation θ, there is a Definition 2 Given the set of propositional variables P and the set of agents A, an allocation description υ is a conjunction of formulas of the form controls(i, p) where for every p ∈ P, there is exactly one i ∈ A such that controls(i, p) appears in υ.
We denote the set of all allocation descriptions with Υ.Notice that allocations ξ and conjunctions υ correspond to each other: For each allocation ξ = P 1 , . . ., P n of the variables in P over the agents in A, there is a υ ξ ∈ Υ such that Therefore, we refer to formulas υ as allocation descriptions.Given two allocation descriptions υ, υ ∈ Υ, we say υ(i ; p j)υ if the following three conditions are satisfied: υ → controls(i, p), υ → controls(j, p), and υ and υ agree on all other control expressions.
Definition 3 Let, for any allocation description υ, Π υ ⊆ Π be a set of valuation descriptions.Then, a formula of the form υ∈Υ Π υ ∧ υ (3) will be called a proposition description.
We will later, in Theorem 2, see that every formula ϕ is equivalent to a proposition description.The intuition here is that the truth of ϕ requires, for every allocation description υ, some possible truth values of atoms to be fixed.To give an example, suppose there are two agents i and j, and three atoms p, q and r.Consider the formula ϕ = i ; p j (q ∧ j (p ∧ r)).In order to find the equivalent proposition description, we must, for every υ ∈ Υ make proper choices for Π υ .If υ implies ¬controls(i, p) this allocation would make ϕ false (since i cannot transfer control over p), so for those υ, we have to choose Π υ to be the empty set, ensuring that ( Π υ ∧ υ) is equivalent to ⊥.If υ implies controls(i, p), there are basically two cases: either υ also implies controls(j, r), and the constraint on Π υ is that Π υ is equivalent to q, or else υ implies ¬controls(j, r), in which case Π υ is equivalent to q ∧ r.
We now first collect some facts about valuation descriptions, allocation descriptions, and proposition descriptions.Recall that, for any set Φ of DCL-PC formulas, ϕ∈Φ ϕ is used as shorthand for Lemma 4 Given the set Π of valuation descriptions π, and the set Υ of allocation descriptions υ, the following six items are satisfied: 6. Let n be the number of agents, and k the number of propositional variables.Then there are not more than N(n, k) = 2 2 nk provably non-equivalent proposition descriptions.

Proof:
1.This follows from Prop and the definition of Π: the π's are mutually exclusive and cannot all be false.
2. Item ( 2) is easily seen to be equivalent to the allocation axiom: allocation implies υ∈Υ υ, and, for every allocation description υ ∈ Υ, we have that υ implies allocation.
3. Item (3) is immediate from Item (2) and axiom Prop.In particular, using Prop we derive from 4. Assume υ.For the right-to-left direction, also assume π , for some valuation description π with π ≡ π (mod C, υ).This means that π and π only differ in some variables p 1 , . . ., p m for which controls(C, p j ) is implied by υ (for j = 1 . . .m).Note that π is an objective formula.We can write π as We can repeat this process until we get But, by definition of π , this implies C π.We show the other direction from left to right by contrapositive: fix π and υ and assume and υ → controls(C, p)} be the set of the literals over variables that are not under control of the agents in C at the allocation υ.Notice that all valuations π ≡ π (mod C, υ) agree with π on the literals in Q(π, υ).We can use propositional reasoning to derive from From υ, it follows, for each literal (p) ∈ Q(π, υ), that ¬controls(C, (p)), which, by equation (1), equals C ¬ (p) → ¬ C (p).But then, we can derive (p)∈Q(π,υ) ¬ C (p).Using K(C), we obtain ¬ C (p)∈Q(π,υ) (p).Hence, ¬ C π.
5. First of all, from (υ ∧ i ; p j υ , follows υ → controls(i, p).Hence, given υ, we have that all formulas i ; p j ψ and [i ; p j]ψ are equivalent by func.In particular, we have i ; p j .Let us first show for literals (q) that (q) ↔ i ; p j (q).For negative literals ¬q, ¬q ↔ i ; p j ¬q equals q ↔ [i ; p j]q, which follows from atomic permanence(;).For positive literals q, we use func to obtain q ↔ [i ; p j]q, which again holds by atomic permanence(;).Now, given υ, we have q ↔ i ; p j q and ¬q ↔ i ; p j ¬q.Then, for any valuation description π, we also have π ↔ i ; p j π.It remains to show that υ ↔ i ; p j υ .From left to right, note that we have controls(i, p) → i ; p j controls(j, p) by transfer.For any other controls expression implied by υ, this follows from persistence 2 (control) and func.Finally, consider the direction from right to left: i ; p j υ → υ.We have to show that, first, i ; p j controls(j, p) → controls(i, p), and, second, that i ; p j controls(h, q) → controls(h, q), for each controls(h, q) (with q = p) implied by υ .The first part follows immediately from precondition(transfer).For the second part, let h be an agent and q = p a variable such that υ implies controls(h, q).Suppose i ; p j controls (h, q).By allocation, we have that i ; p j k =h ¬controls(k, q).But then the contrapositive of persistence 2 (control) yields k =h ¬controls(k, q).It follows by allocation that controls(h, q). 6. Item 6 follows from a straightforward counting argument of proposition description formulas.
The number of proposition descriptions depends on the cardinalities of the sets Π and Υ.
Given the number n = |A| of agents, and the number k = |P| of propositional variables, it is easy to see that there are 2 k valuation descriptions in Π, and n k allocation descriptions in Υ (i.e., the number of ways we can distribute k variables over n agents).Observe that any proposition description formula is obtained by assigning a set of valuation descriptions π to each allocation description υ.Hence, there are 2 2 k ×n k proposition descriptions.Since 2 2 k ×n k ≤ 2 2 nk , we obtain with N(n, k) = 2 2 nk an upper bound for the number of different proposition description formulas.

QED
We now present the main result of this section.We first formulate it, reflect briefly on it, and then give its proof.
Theorem 2 For every DCL-PC formula ϕ, there are sets According to Theorem 2, we can get rid of all the i ; p j ψ.To show that our derivation system is good enough to establish that, is the main task of its proof.But let us first convince ourselves semantically that such a normal form makes sense.Remember that every model M comes with its own allocation ξ.A formula like i ; p j ψ is true at M, θ, if ψ is true in a model that looks like M, but in which control over p is transferred from i to j.But this means that some formula ψ must already be true at M, θ, where i takes the role of j for as far as p is concerned.For instance, i ; p j (q ∧ j (p ∧ r)) is true at M, θ, if q ∧ j r ∧ controls(i, p) is true under the current allocation ξ.This formula has no reference to other 'layers' anymore.More precisely, i ; p j (q ∧ j (p ∧ r)) is equivalent to q ∧ ((p ∧ r) ∨ (¬p ∧ r)) ∧ controls(i, p) ∧ ¬controls(j, r) ∨ q ∧ ((p ∧ r) ∨ (¬p ∧ r) ∨ (p ∧ ¬r) ∨ (¬p ∧ ¬r)) ∧ controls(i, p) ∧ controls(j, r) .Proof: The proof is by induction on the norm ||•|| which is defined on DCL-PC formulas as follows: where N = N(n, k) is the number defined in Lemma 4, Item (6).
Finally, replacing the second occurrence of p with its just derived equivalent formula, we get p → υ∈Υ Π υ (p) ∧ υ .The other direction follows by simple propositional reasoning.
Consider the induction step.
, for every υ ∈ Υ.For the following equivalences, we only need propositional reasoning: • ϕ = C ψ.For every υ ∈ Υ, we set We can derive the following equivalences: The equivalence in (11) holds by the induction hypothesis.Using K(i), this is equivalent to (12) (for any diamond we have The equivalence of the latter and ( 13) is by Lemma 3.
ψ, which has an equivalent formula of the right form by the induction hypothesis.
ψ, which has an equivalent formula of the right form by the induction hypothesis.
By the induction hypothesis, we know that all except the last conjunct have an equivalent normal form.But since there are only N different such forms, the conjunct [τ ] N ψ must be equivalent to one of the earlier conjuncts And by the induction hypothesis, λ has an equivalent formula of the right form.The '←' direction of ( 19) is obvious since λ 'is just the first part' of the 'unraveling' ψ∧[τ ]ψ∧[τ ][τ ]ψ . . . of [τ * ]ψ using axioms mix(τ ) and K(τ ).To show the other direction it is sufficient to derive λ → [τ * ]λ, because, by the fact that ψ is just one of the conjuncts in λ, this immediately gives λ → [τ * ]ψ.To show the derivability of λ → [τ * ]λ, we will use ind(τ ).First of all, we show λ → [τ ]λ.To see this, note that Then we obtain from λ a sequence B 0 , B 1 , . . ., B N of N + 1 formulas in normal form.Since there are at most N provably non-equivalent formulas by Lemma 4, Item (6), we know that there is a B j that equals a previous B a with a < j ≤ N. Let B j be the first such repetition in this sequence.Notice that we have now

QED
We know from Lemma 4 that there are only finitely many different normal forms: since every formula has such a normal form, there can be only finitely many non-equivalent formulas.We also know from the proof of Theorem 2 above that, for [τ * ]ψ, we only have to consider a finite number of conjuncts [τ ] i ψ in its unraveling.
Corollary 1 There are only finitely many pairwise non-equivalent formulas of DCL-PC.In fact, given the number n of agents, and k of propositional variables, we have: where M = 2 nk and N = 2 2 nk (as defined in Lemma 4, Item (6)).
Completeness of a derivation system with inference relation with respect to a semantics means that every semantically valid formula is also provable: |= ϕ ⇒ ϕ.In order to prove completeness, often the contrapositive of this is shown: ϕ ⇒ |= ϕ.That is, every consistent formula ¬ϕ has a model.A popular technique in modal logic is to construct a dedicated model -the canonical model, (cf.e.g., Blackburn et al., 2001) -for any consistent formula ψ.That canonical model is a 'bridge' between syntax and semantics: it consists of all maximal consistent sets Σ (as worlds), and is constructed in such a way that membership of a world in Σ and truth in the corresponding world coincide.
For DCL-PC this works straightforwardly as follows.Fix the finite sets A and P, and take a consistent formula ψ.Build a maximal consistent set ∆ 'around it'.Let the normal form of ψ, guaranteed by Theorem 2, be υ ( Π υ ∧ υ).Since ∆ is maximal consistent, for some υ, we have ( Π υ ∧ υ) ∈ ∆.Again, by maximal consistency of ∆, it must contain, for exactly one π ∈ Π υ , the formula π ∧ υ.But π uniquely determines a valuation θ = θ π , whereas υ determines an allocation ξ = ξ υ .In other words, ∆ uniquely determines a pointed Kripke model (M, θ) with M = Θ, R i∈A , ξ .All the worlds in Θ are determined by P, and all R i∈A (the horizontal layer of M, in terms of Figure 4) are determined by the Control Axioms.The availability of all the right models M = Θ, R i∈A , ξ (the vertical layer in Figure 4) is determined by the Delegation and Control Axioms.As a result, we can directly interpret all subformulas of the form i ; p j ϕ and C ϕ in the proper way, in (M, θ).
This argument easily extends to strong completeness, which states that for all sets of formulas Γ and all formulas ϕ, we have Γ |= K ϕ ⇒ Γ ϕ.To see this, suppose Γ ϕ, i.e., Γ ∪ {¬ϕ} is consistent.Since there are only finitely many pairwise non-equivalent formulas, there must be a formula ψ that is equivalent with Γ ∪ {¬ϕ}.By the previous argument, we find a pointed model (M, θ) such that (M, θ) |= K ψ.For this model we also have (M, θ) |= K Γ ∪ {¬ϕ}.Hence, not every model for Γ is one for ϕ, i.e., Γ |= K ϕ.Strong completeness also follows by an alternative way of resaoning: note that our language is compact: i.e., if Γ |= K ϕ, there there is a finite set Γ ⊆ Γ such that Γ |= K ϕ.This is seen as follows: we know from Corollary 1 that there are at most M different formulas that are not provably equivalent, for an M that depends on the number of agents and the number of atoms.But then, by soundness, there are also at most M semantically different formulas in Γ. Putting those formulas in Γ gives the desired result.Strong completeness then follows from (weak) completeness with compactness.
All in all, we obtain the following (also using Lemma 2).
Theorem 3 The language of DCL-PC is compact.Moreover, the axiomatic system DCL-PC is sound and complete with respect to both the Kripke and the direct semantics.It is also strongly complete.or 'fail' otherwise 5.
P m = P m for all m ≤ n, m = i, j 12.
return program-eval(τ  That is, for all sets of DCL-PC formulas Γ and for every DCL-PC formula ϕ, we have

Complexity
The model checking and satisfiability problems for CL-PC are PSPACE-complete (van der Hoek & Wooldridge, 2005b), and since DCL-PC subsumes CL-PC, this implies a PSPACE-hardness lower bound on the corresponding problems for DCL-PC.The obvious question is then whether the additional dynamic constructs of DCL-PC lead to a more complex decision problem -and in particular, whether DCL-PC satisfiability matches the EXPTIME-completeness of PDL satisfiability (Harel et al., 2000).In this section, we show that the model checking and satisfiability problems are in fact no worse than CL-PC: they are both PSPACE-complete.Notice that EXPTIME-completeness is usually regarded as the characteristic complexity of logics in which there is a modal operator and another operator representing the transitive closure of this operator (Blackburn et al., 2001).
Note that when we consider the model checking problem in this section, we consider the problem with respect to direct models, not Kripke models.Of course, with respect to satisfiability, it makes no difference: a formula is satisfiable with respect to direct models iff it is satisfiable w.r.t.Kripke models.
Before proving PSPACE-completeness for DCL-PC model checking, consider some auxiliary notions first.A program sequence is a transfer program that is composed of atomic transfer programs, tests, and sequential composition only.A program τ admits a program sequence β if τ can be un-folded into β by recursively applying the following rules: For any atomic transfer program (i ; p j), test ϕ?, and transfer programs τ m (m ≥ 0): τ 1 ; τ 2 ; . . .; τ n , for some n ≥ 0, where τ m = τ , for all m ≤ n The following two lemmas establish that membership in the accessibility relation R τ for a transfer program τ can be decided in polynomial space.
Lemma 5 For all transfer programs τ and all (direct) models M and M , (M, M ) ∈ R τ implies that τ admits a program sequence β of length at most exponential in the length of τ such that (M, M ) ∈ R β .In fact, the length of β can be limited to 2 |τ | 3 .Proof: Let τ , M, and M be as in the lemma.The proof is by induction on the structure of τ .The only interesting case is where τ = τ * ; the other cases are straightforward.Suppose By the transitivity of R τ * , we can assume that the sequence M 0 , . . ., M n is such that M i = M j , for all i, j with 1 ≤ i < j ≤ n, i.e., the sequence of models contains no loops.The induction hypothesis yields that τ admits program sequences β 1 , . . ., β n such that β i is of length at most 2 |τ | 3 and (M i−1 , M i ) ∈ R β i for each i with 1 ≤ i ≤ n.But then β = β 1 ; β 2 ; . . .; β n is a program sequence admitted by τ * such that (M, M ) ∈ R τ * .In the following, it is shown that β has the required length.Note that all models reachable from M = A, P, ξ, θ via R τ * only differ in the allocation ξ of propositional variables in P to the agents in A. More precisely, they differ in the allocation of propositional variables to agents that occur in τ .Thus there are at most m such reachable models, where is the number of propositional variables occurring in τ and m the number of agents occurring in τ .Notice that n does not exceed m ; otherwise the sequence M 0 , . . ., M n contains loops contradicting the assumption.Together with the fact that m ≤ |τ | |τ | ≤ 2 |τ | 2 , an upper bound for the length of β can be given as follows:

QED
Lemma 6 For all programs τ and all (direct) models M and M , the membership problem (M, M ) ∈ R τ can be decided in PSPACE.
Proof: Let τ be a program and let M, M be two (direct) models.Consider the following algorithm that decides (M, M ) ∈ R τ by using the function program-eval(• • • ) in Figure 7: Step 1 ensures that the value of d is such that Then it is obvious by construction of the algorithm that the non-deterministic choices in the lines 15 and 20 of Figure 7 yield that program-eval(τ, M, d) = M .Notice that the algorithm terminates since the recursive calls in the lines 14, 16, and 17 are applied on strict subprograms only and the recursive call in Line 22 is followed by the one in Line 14 while the parameter d limits the recursion depth.
The above algorithm can be run in polynomial space.To see this, notice that the function DCL-PC-eval(• • • ), which is called in Line 3, can be computed in polynomial space and that the parameter d is encoded in binary.Moreover, the stack of an algorithm computing the function program-eval(• • • ) can be limited to a size polynomial in the length of τ .Note that the stack only needs to store the currently evaluated program and the programs at the backtracking points, which are introduced at the nested function call in Line 14.But since this nested function call is applied on strict subprograms, there are only linearly many backtracking points needed at a time.Although the algorithm is non-deterministic, it follows from the well-known fact NPSPACE equals PSPACE (Savitch, 1970) that it runs in PSPACE.

QED
Using the previous two lemmas, we can now prove the following.

Theorem 4
The model checking problem DCL-PC (w.r.t.direct models) is PSPACE-complete.
Proof: Given that DCL-PC subsumes the PSPACE-hard logic CL-PC, we only need to prove the upper bound.Consider the function DCL-PC-eval(• • • ) in Figure 8. Soundness is obvious by construction.First note that the algorithm is strictly analytic: recursion is always on a sub-formula of the input.That the algorithm is in PSPACE follows from the fact that the loops at lines 10-12 and 15-18 involve, in the first case simply binary counting with the variables P C , and in the second simply looping through all direct models over A and P: we do not need to store these models once they are checked, and so this can be done in polynomial space.Finally, Lemma 6 yields that the check (M, M ) ∈ R τ on Line 16 can be done in polynomial space.QED Now, we make use of the following result, the proof of which is identical to the equivalent result proved by van der Hoek and Wooldridge (2005b).
We can now prove the following.

Theorem 5
The satisfiability checking problem for DCL-PC is PSPACE-complete.
for each C-valuation θ C 11.
for each model M over A, P 16.

QED
Notice that the PSPACE complexity for checking satisfiability depends upon the fact that models for DCL-PC are concise, and that hence we can loop through them all in polynomial space (we do not need to 'remember' a model after it has been considered).

Characterizing Control
One of the main concerns in the original study of CL-PC (van der Hoek & Wooldridge, 2005b) was to investigate the logical characterization of control: the extent to which we could characterize, in the logic, what states of affairs agents could reliably control.Control was distinguished from ability in the sense that, for example, no agent could be said to control a tautology, even if one might be prepared to concede that an agent would have the ability to bring about a tautology.The starting point for the study of control (van der Hoek & Wooldridge, 2005b) was the controls(i, p) construct: as we have already seen, such an expression will be true iff the variable p is under the control of agent i.This led to an analysis and characterization of the types of formulas that an agent could be said to control.The type of control studied by van der Hoek and Wooldridge derives from the ability of agents to choose values for the propositional variables under their control.Let us refer to this type of control, where an agent is directly able to exert some influence over some state of affairs by assigning values to its variables, as first-order control.In this section, we undertake a similar study of control in the richer setting of DCL-PC.Here, however, we have a second type of control, which derives from the ability to transfer control of variables to other agents.Thus, for example, if i controls p, she also 'has the power' to ensure for instance controls(j, p), where j is an agent different from i.This control is expressed through the transfer modality: i ; p j controls (j, p).We refer to this type of control as second-order control.We will see that these types of 'control' are indeed rather orthogonal.For instance, i ; p j j ϕ (i can give p to j, who then can achieve ϕ) and i,j ϕ (i and j can cooperate, to achieve ϕ) are logically incomparable.For example, taking ϕ = j ; p i gives |= d controls(i, p) → ( i ; p j ϕ ∧ ¬ i,j ϕ) while for ϕ = i ; p j and assuming i = j, we have However, if the goal is an objective formula, we can relate atomic control and transfer, as we will shortly see.
To begin our study, consider the transfer program Then give i ϕ would express that i has a way to give one of her propositional variables to one of the agents (possibly herself) in such a way that consequently ϕ holds.Thus, give * i ϕ means that i can distribute her variables among the agents in such a way that afterwards ϕ holds.Hence, when reasoning about i's power, the strongest that she can achieve is any ϕ for which i ϕ ∨ give * i ϕ, expressing that i can achieve ϕ by either choosing an appropriate value for her variables, or by distributing her variables over A in an appropriate way.Note that both i ϕ and give * i ϕ imply give * i i ϕ, and hence any ϕ for which give * i i ϕ holds can be seen as what i can achieve on her own.We will come back to the program give i below.
The program give can be generalized to incorporate coalitions that can give away variables, and those that can receive: let This program give C;D lets an arbitrary agent i from the coalition C either give any of her variables p to an arbitrary member of the coalition D, or do nothing (i.e., give them to herself).Now, for objective formulas ϕ, we have the following, where i is a dedicated agent from C: C ϕ ↔ give * C;{i} i ϕ.In words: the agents in the coalition C can choose values for their variables such that ϕ, if and only if they have a way to give all their variables to the dedicated agent i, who then can achieve ϕ.Note that we are in general not able to eliminate all occurrences of 's, since this is the only way to express first-order control, i.e., to reason about a 'different valuation'.
For some examples in the language without transfer, we refer to a paper by van der Hoek and Wooldridge (2005b), especially to the example 'Bach or Stravinsky', (i.e., Example 2.4, van der Hoek & Wooldridge, 2005b).Before looking at two examples of control in a dynamic setting, note that A allows the following inference, for any objective formula ϕ: This inference says that the grand coalition A can achieve any satisfiable objective formula.
Example 1 Suppose we have n agents: 1, . . ., n.Each controls a flag r i (i = 1 . . .n) to indicate that they desire control over a particular resource, modeled with a variable p.It is not that they want p to be true or false every now and then, (which could be taken care of by a central agent executing a program making p false and true alternatively), but rather, they want to control p eventually.Let + n denote addition modulo n, and, similarly, − n subtraction modulo n.Let skip denote ?, i.e., a test on a tautology.Consider the following program: The program grant-req(i) makes agent i pass on the resource p whenever she has it and somebody else needs it, where the need is checked in the order starting with the agent with the next + n index.Note that the 'use' of this variable p, i.e., making it true or false, is not encoded in our program constructs.Now consider the program pass-on(i, j) = grant-req(i); . . .; grant-req(j − n 1).
The program pass-on(i, j) will pass control over the variable p to agent j, provided that initially r j is set and one of the agents in the sequence i, i + n 1, . . ., j − n 1 owns it.This can be expressed as follows: That is: if agent i flags a request r i for resource p, then, after the program pass-on(i + n 1, i) has been executed, i will be under control of p. Notice that the previous example 'freely' passes on a variable along chains of agents, thereby taking for granted that they can control that variable on the fly, and making it true or false at will.In the following example, control over a variable is not only important, but also the truth of some side conditions involving them.

Example 2
We have a scenario with three agents: two clients c 1 and c 2 , and a server s.The server always has control over one of the propositional variables p 1 and p 2 , in particular s wants to guarantee that those variables are never true simultaneously.At the same time, c 1 and c 2 want to ensure that at least one of the variables p i (i = 1, 2) is true, where variable p i belongs to client c i .We can describe the invariant of the system with the formula Inv: Consider the following transfer program β: β = (controls(s, p 1 )? ; s ; p 1 c 1 ; c 2 ; p 2 s) ∪(controls(s, p 2 )? ; s ; p 2 c 2 ; c 1 ; p 1 s) * .
This says that an arbitrary number of times one variable p i is passed from the server to the client c i , and another variable p j (i = j) from the client c j to the server.Using Inv and β, we can describe the whole scenario as follows: A general characterization of the types of formulas that agents and coalitions could control was given by van der Hoek and Wooldridge (2005a), and our aim is now to undertake the same study for DCL-PC.It will appear that this can be done on a local and a global level, but we will also see that the notion of control that we inherited from CL-PC, has a natural generalization in our context.
The next corollary establishes a result concerning the characterization of control.Its first item says that of no strict sub-coalition C = A of A, is it valid that C controls something.In other words, control of such a coalition is always a feature of a specific model, in particular, a specific allocation.According to the second item, the grand coalition A derivably, or in all models, controls exactly those formulas ϕ with the property that their equivalent form υ∈Υ ( Π υ (ϕ) ∧ υ) is such that for every allocation description υ, the formula Π υ (ϕ) is a contingency, i.e., not a tautology and neither a contradiction.If ϕ is a propositional formula, we have ϕ ↔ Π υ (ϕ) and it is easy to see that ϕ being a contingency is sufficient and necessary to have |= K controls(A, ϕ).On the other hand, if ϕ is for instance controls(i, p), then Π υ (ϕ) = Π if υ → controls(i, p) and Π υ (ϕ) equals .And indeed, |= K controls(A, ϕ).Contrast this with ϕ = p ∧ controls(i, p).If follows easily from the truth definition of the Kripke semantics defined in Section 2.6, and from Theorem 2 and Theorem 3.
Corollary 2 Let M be a Kripke model, C any coalition C ⊆ A with C = A, and let ϕ be ranging over DCL-PC formulas.Then it follows that: have M, θ |= K C ¬ϕ, for each θ.But, given υ, A cannot choose a valuation satisfying ϕ on the current allocation described by υ, i.e., M, θ |= K ¬ A ϕ. Hence, in either case we have |= K controls(A, ϕ).Consider the other direction from right to left.Suppose ϕ is equivalent to υ∈Υ ( Π υ (ϕ)∧υ) while, for no υ, the set Π υ (ϕ) is either Π or ∅.Let M = Θ, R i∈A , ξ be a Kripke model.Remember that υ ξ is the allocation description corresponding to the allocation ξ.By the fact that Π υ ξ = ∅, there is a valuation description π ∈ Π υ ξ such that the corresponding valuation θ π satisfies ϕ at (M, θ π ).But then, A can choose θ π in order to satisfy ϕ, and thus we have M, θ |= K A ϕ, for any θ.Similarly, we have M, θ |= K A ¬ϕ which follows by the fact that Π υ ξ = Π.Hence, we have |= K controls(A, ϕ).

QED
One may ask for a more local characterization of what a coalition controls: for which Kripke models M and valuations θ do we have M, θ |= K controls(C, ϕ)?For this notion of control, the answer can be immediately read off from Theorem 6, to be given shortly.That theorem is about a more general notion: to recover a characterization result for the current notion controls(i, ϕ), we would only need the items (1b) and (2b) of Theorem 6.
The notion of control discussed so far is that taken from CL-PC: we have lifted the characterization results to our richer language.However, as is clear from our discussion earlier in this section, a more appropriate notion of control of an individual i in our language might be obtained using the program give * i , where give i is defined in (20).Note that i ϕ → give * i i ϕ is valid, and hence that give * i seems a more general way to reason about i's control: it is about what i can achieve both by toggling its propositional variables and delegating some of them.One can easily discuss this at the coalitional level, by lifting Definition (20) to the case of coalitions C as it was suggested in (21) with give C;D .However, we stick to the individual case here for simplicity.Let us therefore define This definition says that agent i controls a formula ϕ iff there is a way to distribute her propositional variables over the agents such that after i makes appropriate choices for her remaining variables, ϕ holds, but there is also a way of distributing her variables that enables her to enforce ¬ϕ.From the validity of i ϕ → give * i i ϕ, we infer that controls(i, ϕ) implies CONTROLS(i, ϕ).Notice that the implication the other way around is not valid since controls(i, •) can never be true for control of other agents over variables.For example, CONTROLS(i, controls(j, p)) holds iff p ∈ P i .From this, we know that controls(i, p) → CONTROLS(i, controls(j, p)) is a theorem, which basically says that when having control over a variable, you can freely choose to keep it or pass it on.However, controls(i, p) → controls(i, controls(j, p)) is not valid, we even have controls(i, p) → ¬controls(i, controls(j, p)): once agent i owns p, she cannot choose to keep p or to pass it on by only toggling her propositional variables.
Before we state our characterization result, we introduce some more notation.For any two Kripke models M = Θ, R i∈A , ξ and M = Θ, R i∈A , ξ in K(A, P) and for any agent i, we say that M ≥ i M if the allocations ξ = P 1 , . . ., P i , . . ., P n and ξ = P 1 , . . ., P i , . . ., P n are such that P i ⊆ P i and, for all j = i, P j ⊆ P j .That is, M is obtained from M by executing give * i .In such a case, we also say ξ ≥ i ξ .

¡
For each valuation description π ∈ Π, let θ π be the valuation that is described by π, and, for each allocation description υ ∈ Υ, let ξ υ be the allocation described by υ, and let P υ i be the set of propositional variables controlled by agent i in ξ υ .
Theorem 6 Let ϕ be a DCL-PC formula with ϕ ≡ υ∈Υ Π υ (ϕ) ∧ υ , as given by Theorem 2. Let M = Θ, R i∈A , ξ be a Kripke model of K(A, P), and θ a world in M.Then, for each agent i ∈ A, M, θ |= K CONTROLS(i, ϕ) iff the following two conditions are satisfied: 1.There is a υ ∈ Υ and a π ∈ Π υ (ϕ) such that (a) ξ ≥ i ξ υ , and 2. There is a υ ∈ Υ and a π ∈ Π \ Π υ (ϕ) such that (a) ξ ≥ i ξ υ , and We first demonstrate the requirements ( 1) and ( 2) of Theorem ( 6).Suppose that θ satisfies (p ∧ ¬q ∧ r), Agent i = 1 owns p in M, Agent 2 owns q and r, and Agent 3 has no propositional variables in M. First of all, to see why Item (1b) is needed, we have to guarantee that for some M , θ , it holds that M , θ |= K 1 ϕ.That means that, even after 1 has given away some of her atoms (resulting in some allocation ξ ), she still should be able to make ϕ true.This is possible for ϕ = (¬p ∧ ¬q ∧ r): Agent 1 could simply stay within the current allocation ξ and just make p false.However, this is not possible for ϕ = (¬p ∧ ¬q ∧ r ∧ controls(3, p)) since, once 1 has delegated control of p to 3, agent 1 cannot make p false anymore.Moreover, an agent i can only give atoms away, so any model with allocation ξ υ that makes it possible for her to satisfy ϕ should be one for which ξ ≥ i ξ υ , which explains Item (1a).Item (2a) has exactly the same motivation, and requirement (2b) is easily understood to be similar to (1b), once one realizes that the normal form of ¬ϕ can be expressed in terms of the normal form of ϕ as follows: For a simple illustrating example, suppose there are only two allocations ξ 1 and ξ 2 , and ϕ is equivalent to Note that ϕ's normal form describes the valuations on ξ 1 and ξ 2 where ϕ is satisfied.The normal form of ¬ϕ is complementary to the one of ϕ in the sense that it describes the valuations on ξ 1 and ξ 2 where ϕ is falsified: Proof: We illustrate our proof with a pictorial story that shows why the requirements 1 and 2 of the theorem are both sufficient and necessary.Given that ϕ is equivalent to υ∈Υ ( Π υ (ϕ) ∧ υ) by Theorem 2, semantically this means that ϕ corresponds to a collection of the 'shaded areas', as depicted in Figure 9. Now, for CONTROLS(i, ϕ) to be true at a world θ in a Kripke model M = Θ, R i∈A , ξ , Agent i has to be able to move inside such a shaded area, and to move outside it as well.But moving inside a shaded area, means being able to first go to a model with allocation ξ υ , and then to a world θ π within that model such that the valuation description π is in Π υ .Notice that i can move to allocation ξ υ only by delegating control over her variables to other agents (hence the requirement ξ ≥ i ξ υ ), and i can move to valuation θ π only by toggling her remaining variables in P υ i at ξ υ (hence the condition θ π = θ (mod P υ i )).This shows that Condition 1 is equivalent to M, θ |= K give * i i ϕ.Accordingly, Condition 2 corresponds to being able to move outside of a shaded area in Figure 9. Semantically, this means being able to first go to a model with allocation ξ υ , and then to a world θ π within that model such that the valuation description π is not in Π υ .Consequently, Condition 2 is equivalent to M, θ |= K give * i i ¬ϕ, which finishes the proof.QED

Possible Extensions and Refinements
In this section, we consider some possible extensions and refinements to the framework we have presented in this paper.We do not claim to have substantial results relating to these extensions -the aim is simply to indicate some possible directions for future research.

Separating First-and Second-Order Control
In DCL-PC as presented here, an agent can assign a value to a variable (exercising first-order control) iff it can 'give this variable away' (exercising second-order control).That is, for any pair of agents i, j and propositional variable p, we have the following.
A moment's reflection should confirm that this is not always how things work in human societies.We might empower an individual to make a choice on our behalf, but we might not be happy with the idea that this individual could in turn transfer this power to somebody else.Sometimes, it might be acceptable; but certainly not in all cases.
We can straightforwardly distinguish between these situations by extending our models and modifying the semantics of our language as follows.A model M is now defined to be a structure: where the components A, P, ξ 0 , and θ are as originally defined, and ρ = ρ 1 , . . ., ρ n is a tuple of subsets of P, with elements indexed by agents A, such that ρ 1 , . . ., ρ n forms a partition of P. Now, the intended interpretation of such models is as follows: • the partition ξ 0 defines who (initially) has the ability to assign values to which variables (i.e., who has first-order control of variables); while • the partition ρ defines who can transfer control of which variables (i.e., who has second-order control of variables).
Syntactically, the logic that we define to reason about such structures is identical to DCL-PC, however the semantics are different.In fact, the only element of the semantics that we need to change relates to the definition of the accessibility relation for atomic transfer programs.
(b) if k = j then: With this setup, first-order control is dynamic, and can be changed by transfer programs, while second-order control as defined in ρ is static.Moreover, the fact that an agent has first-order control of a variable does not mean it has second-order control: we no longer have the equivalence (24).

Hierarchies and Networks of Control
Of course, there is no reason why one should stop at second-order control.One could extend the setup with a finite hierarchy of control levels, with each level u > 1 defining who can transfer control of variables at level u − 1, and level u = 1 defining who can exercise first-order control.We then need to extend atomic programs to indicate which level of control is being transferred.Atomic programs then take the form: i ; u p j to mean that agent i transfers level u control to agent j.The semantics of the language become yet more involved, but are straightforward to define.Somewhat related ideas were studied by Boella and van der Torre (2008).
Another direction is to consider multiple agents having 'write access' to propositional variables.For example, we might consider an 'authority relation' P ⊆ A × A, with the intended interpretation that (i, j) ∈ P means that everything that i is empowered to everything that j is empowered to do.Propositional variables are then allocated to sink nodes in P (i.e., agents with no outgoing edges in P).One might then ask, for example, whether structural properties of the graph P characterise formulae of the object language.

Related Work
Although other researchers have begun to develop formal systems for reasoning about delegation and the transfer of control (e.g., Li, Grosof, & Feigenbaum, 2003), to the best of our knowledge DCL-PC is the first such system to have a rigorous semantics, and a complete axiomatization.Also, the emphasis of Li et al. (2003) is on decentralized 'trust management', in which roles like that of a requester, credentials and an authorizer are distinguished.In the work presented here, the emphasis is more on what coalitions can achieve, if they are allowed to hand over control over propositional variables.Norman and Reed (2002) consider a logic of delegation, particularly focussing on group delegation.The logic underpinning this work is a 'STIT' (sees to it that) logic, in which the main operator is of the form S i A, meaning 'agent i sees to it that A'.This extends to delegation by considering expressions of the form S i S j (i sees to it that j sees to it that . . .').For example, an axiom in the resulting system is: The work of Norman and Reed represents a serious attempt to develop a philosophically robust logic for delegation, appropriate for use in computational systems.However, their notion of delegation is very different to ours, (crudely, agents delegate responsibility, rather than transfer control), and the dynamic logic flavour of DCL-PC is absent.Finally, relatively few technical results relating to the logic are presented.Jones and Sergot (1996) consider the problem of reasoning about power that an individual obtains by virtue of an organisational role.There, the notion of actions that are carried out in order to empower agents with certain capabilities is central, and Jones and Sergot also consider the interplay of such actions and ability.However, the logical formalisation is rather different -again a STIT-like language is used, rather than our dynamic logic framework, and relatively few technical results relating to the framework are presented.However, the setting of Jones and Sergot (1996) is much more general than ours: we focus only on propositional control.In somewhat related work, Boella and van der Torre (2006) present a formalisation of power delegation in the setting of normative multi-agent systems.They consider, for example, the issue of how delegated goals interact with other goals.The framework provides a rich and compelling setting for investigating questions relating to delegation.However, no overarching object language is developed for representing this framework, and relatively few technical results are presented relating to the framework.It would be interesting to consider whether the dynamic logic approach developed within the present paper might be adapted to the framework of Boella and van der Torre.
With respect to logics for reasoning about controlled variables, Boutilier (1994) presents a logic intended to capture notions such as 'I can achieve my plan using actions that only relate to variables under my control'.In spirit, this logic is very close to the kind of situation we are aiming to model, although the technical details of Boutilier's logic (the way control is captured in the logic) are different.Moreover, Boutilier's logic does not consider multi-agent aspects, or the dynamics of control as we do in the present paper.
We refer the reader to the work of van der Hoek and Wooldridge (2005b) for an extensive discussion and many references for logics of ability.Gerbrandy (2006) generalises the results of van der Hoek and Wooldridge, by considering situations in which an agent has only partial control of a variable, or where it shares control with others.Gerbrandy also shows how logics of propositional control are related to cylindrical modal logic (Venema, 1995).Specifically, the generalisation of CL-PC considered by Gerbrandy can be understood as a cylindrical modal logic, immediately yielding a complete axiomatization and decidability/undecidability results for various fragments of the system.A somewhat related formalism is discussed by van Benthem, Girard, and Roy (2009).This formalism is intended to enable reasoning about ceteris paribus preferences (in the sense of 'all other things being equal').Van Benthem et al. develop a logic with a modality Γ ϕ, where Γ is a set of propositional formulae; the intended interpretation of Γ ϕ in a state u is that there is a state v agreeing with u on the valuation of formulae Γ in which ϕ is true.There seems quite a close connection between DCL-PC and the formalism of van Benthem et al., although we leave the details for future work.
Our framework explains control in terms of what the agents can change or whcih atoms they can choose to be true or false.Sauro (2006) addresses the question of how agents can change the world, where control of coalitions is defined in terms of actions in the agents' repertoire.Finally, note that as discussed by van der Hoek and Wooldridge (2005b), the logic CL-PC is closely related to the well-known formalism of quantified Boolean formulae, and it is not hard to see that there is also a close relationship between DCL-PC and quantified Boolean formulae.However, while we may not ultimately have any gain is formal expressive power when using DCL-PC rather than quantified Boolean formulae, we do benefit with respect to the naturalness of expression in DCL-PC.Quantified Boolean formulae have no explicit notion of agency or the dynamics of control, and representing these aspects within quantified Boolean formulae leads to formulae that are unintuitive and hard to understand.

Conclusions
In this paper, we have built upon the logic CL-PC of strategic cooperative ability, in which the control that agents have over their environment is represented by assigning them specific propositional variables, for which the agents that 'own them' can determine their truth value.We added a dynamic component to this logic, thus obtaining the language DCL-PC in which one can reason about what agents (and coalitions of agents) can achieve by setting their assigned variables, or by giving the control over them to others.We gave two different but equivalent semantics for this languagea direct and a more conventional Kripke semantics -and provided a complete axiomatization for them.The key property that establishes the proof of completeness for DCL-PC's axiomatic system is the fact that every formula in the language is provably equivalent to a normal form: a disjunction of conjunctions of literals over propositional variables p and assertions of the form controls(i, p).We also investigated the complexity of the model checking and satisfiability problems for DCL-PC, and showed that these problems are no worse than for the program-free fragment CL-PC: they are both PSPACE-complete.We demonstrated that, for the special case where ability in ATL is interpreted as in (D)CL-PC, this implies a simpler satisfiability problem for ATL.
There are several avenues for further development of this work.First of all, it is interesting to add the assignments that the agents can perform to the transfer actions they can perform, so that the two dimensions of what agents can achieve become projected in one dimension.Although parallel execution is not a program construct in our language, and hence one could still not model situations where an agent chooses some values for its atoms, and at the same time transfers control of some other atoms, one could at least reason about the effect of programs that do a combination of truth assignments and transfer of control in sequence, or in a choice.Secondly, in many realistic systems, Property (22) may be too general: often, we want to specify that the overall system satisfies some constraints.For this, it seems appropriate, however, not only to reason about what agents can achieve, but also about what they should guarantee.The framework of Social Laws (Moses & Tennenholtz, 1995;van der Hoek, Roberts, & Wooldridge, 2005) could be set to work in order to express that under certain conditions, an agent will not set a certain propositional variable to 'true', or that she will not pass on control over a certain variable to a specific agent, or that the overall system behaves in such a way that every agent gets a fair chance to trigger a specific variable (i.e., use a specific resource) infinitely often.Another interesting direction would be to consider how to allow for the fact that agents outside a transfer program might change their variables while the program is executing.This might require some consideration of the semantics of parallel action.Relatedly, it would be interesting to make it possible to capture the temporal properties of the system, outside of transfer programs.Here, some combination of temporal and dynamic logic might be appropriate.
Similarly, we could weaken the allocation axiom to allow for some propositional not being under control of any agents, capturing the idea that not all facts are modifiable (by the agents under consideration).Another extension would be to assign control over atoms to coalitions, rather than individual agents.This could cater for 'power' in social contexts, with the typical example being that any coalition bigger than a threshold n can lift a piano.Finally, an implementation of a theorem prover for the logic would of course be interesting.Finally, an implementation of a theorem prover for the logic would of course be interesting.Now, we prove objective permanence(;) by induction on ϕ.The induction base, where ϕ is a propositional variable, follows from atomic permanence(;).Consider the induction step.Suppose the theorem is proven for ψ and take ϕ = ¬ψ.Assume i ; p j .It is to show that ¬ψ ↔ [i ; p j]¬ψ which is equivalent to showing that ψ ↔ i ; p j ψ.This follows from (25) and the induction hypothesis.As a final step in the induction, suppose objective permanence(;) is proven for ψ 1 and ψ 2 .This means we can assume that i ; p j → (ψ 1 ↔ [i ; p j]ψ 1 ) ∧ (ψ 2 ↔ [i ; p j]ψ 2 ) (26) Now take ϕ = ψ 1 ∨ ψ 2 .Obviously, if we have ψ 1 ∨ ψ 2 , we have [i ; p j](ψ 1 ∨ ψ 2 ), which proves i ; p j → (ϕ → [i ; p j]ϕ).For the other direction, suppose, given i ; p j , that [i ; p j](ψ 1 ∨ ψ 2 ).We use (25) to conclude i ; p j (ψ 1 ∨ ψ 2 ), and by classical modal reasoning we then obtain i ; p j ψ 1 ∨ i ; p j ψ 2 .By (25) and the induction hypothesis we get (ψ 1 ∨ ψ 2 ), which concludes our proof.
• Using K(τ ) and Necessitation, we can derive the fact ¬ τ → [τ ]ϕ.Using this fact, it is possible to show with propositional reasoning that objective permanence is equivalent to The proof is by induction on the structure of the transfer program τ .The first case of the induction base, where τ is an atomic program, holds by atomic permanence(;).
Now we consider formulas ϕ 2 , starting by their base case controls(h, q).Assume controls(i, p): we now first show the left to right direction.If p = q, we get from persistence 2 (control) that [i ; p j; j ; p i]q.If p = q we consider three subcases: (1) h = i.We then derive, from controls(i, p), using transfer, that i ; p j controls(j, p) and controls(j, p) → j ; p i controls(i, p): with func and comp(τ ), this gives controls(i, p) → [i ; p j; j ; p i]controls(i, p).(2) h = i, h = j.Given controls(i, p), we then have [i ; p j] → ψ for any ψ, and we are done.(3) h = i, h = j.We can use persistence 2 (control) twice to get controls(h, q) → [i ; p j; j ; p i]controls (h, q).Finally, given controls(i, p), we derive the right to left direction, that is, we derive [i ; p j; j ; p i]controls(h, q) → controls(h, q).First assume p = q and suppose we would have ¬controls(h, q).Then, by allocation, we have that for some agent k = h, we have controls(k, q), and by persistence 2 (control) we get [i ; p j; j ; p i]controls(k, q), which clearly contradicts [i ; p j; j ; p i]controls (h, q).Now suppose p = q.Again, we have three subcases.( 1) If h = i, the conclusion follows from the overall assumption controls(i, p).(2) Suppose h = i, h = j.The same reasoning applies as in case (1).Finally, (3) suppose h = i, h = j.
Since controls(i, p) is given, we have i ; p j controls(j, p) (by transfer), and hence i ; p j; j ; p i controls (i, p).Now, if we would have [i ; p j; j ; p i]controls(j, p), with i = j, this leads to a contradiction (use allocation and the fact that h = i, h = j), so indeed we derive [i ; p j; j ; p i]controls(j, p) → controls(j, p).
• For reverse, similar to inverse.
2. This was proved by van der Hoek and Wooldridge (2005b).
3. The definition of controls(C, p) is C p ∧ C ¬p.Let C = {a 1 , a 2 , . . ., a C }.By axiom control(i), we have i∈C controls(i, p) → i∈C ( i p ∧ i ¬p).By the contrapositive of T(i), we have ϕ → i ϕ.We can apply this repeatedly for all agents in C, giving ϕ → a 1 a 2 • • • a C ϕ.This is, according to Comp-∪, the same as ϕ → C ϕ. (Note that we have now proven the contrapositive of T(C).)This gives us i∈C controls(i, p) → i∈C ( C i p ∧ C i ¬p).Using Comp-∪ again, we see that the consequent of this implication is equivalent to C p ∧ C ¬p.For the other direction, we first show at − most(control) of Figure 6.From (p) we get, using axiom T(i) and contraposition, i (p).Assuming moreover i ¬ (p), with axiom control(i), gives controls(i, p).From allocation we then obtain ¬controls(j, p), for any agent j = i.Using control(j), we get ¬ j p ∨ ¬ j ¬p, i.e., ¬ j (p) ∨ ¬ j ¬ (p).Since T(j) gives us j (p), we obtain ¬ j ¬ (p), i.e., 2 j (p).Now suppose ¬ i∈C controls (i, p).By allocation, we have x∈A\C controls(x, p).That means that for one such x, we have x p ∧ x ¬p.Now we do a case distinction based on p ∨ ¬p.In the first case, we assume p, and derive, for all i ∈ C, that 2 i p, and thus 2 C p.
Hence ¬ C ¬p, from which we get ¬controls(C, p).In the case of ¬p, we similarly have, for all i ∈ C, that 2 i ¬p, which gives ¬ C ¬¬p, and again ¬controls(C, p).All in all, no matter whether p or ¬p, we get ¬controls(C, p).
4. This is easy: the previous item showed that controls(C, p) means that i∈C controls(i, p).
Applying persistence 1 (control), we get i∈C 2 j controls(i, p).But since controls(i, p) → controls(C, p) if i ∈ C, we also have, for any i ∈ C, that 2 j controls(i, p) → 2 j controls(C, p) (use Necessitation and K(j)).This proves 2 j controls(C, p).QED

Figure 2 :
Figure 2: The effect of executing an atomic transfer program.

iff 1 .
p ∈ P i (agent i controls p to begin with) 2. in case i = j: (a) M = M (agent i gives p to herself, with no change in the model) 3. in case i = j: (a) P i = P i \ {p} (agent i no longer controls p afterwards); (b) P j = P j ∪ {p} (agent j controls p afterwards); and (c) all other components of M are as in M.
and 'No' otherwise.To see that this algorithm is correct, it is shown that program-eval(τ, M, d) = M iff (M, M ) ∈ R τ .For the direction from left to right, it is readily checked that program-eval(τ, M, d) = M implies the existence of a program sequence β admitted by τ of length at most |τ | × d such that (M, M ) ∈ R τ .Clearly, R β ⊆ R τ and thus (M, M ) ∈ R τ .Consider the direction from right to left.From (M, M ) ∈ R τ , it follows by Lemma 5 that there is a program sequence β admitted by τ of length at most

Figure 8 :
Figure 8: A model checking algorithm for DCL-PC.
••• ' to be the dual of the cooperative ability modality ' ••• ' as: •, •) construct, we can capture the distribution of propositional variables among the agents in a model.