Available online at www.sciencedirect.

com

Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

www.elsevier.com/locate/entcs

Clausal Tableaux for Hybrid PDL

Mark Kaminski Gert Smolka

Saarland University
Saarbrücken, Germany

Abstract
We present the first tableau-based decision procedure for PDL with nominals. The procedure is based
on a prefix-free clausal tableau system designed as a basis for gracefully degrading reasoners. The clausal
system factorizes reasoning into regular, propositional, and modal reasoning. This yields a modular decision
procedure and pays off in transparent correctness proofs.

Keywords: hybrid logic, dynamic logic, tableau systems, decision procedures

1 Introduction
PDL (propositional dynamic logic) [6,13,9] is an expressive modal logic invented
for reasoning about programs. It extends basic modal logic with expressions called
programs. Programs describe relations from states to states and are used to ex-
press modalities. Programs are composed with the operators familiar from regular
expressions. In addition, they may employ formulas so that conditionals and while
loops can be expressed. Fischer and Ladner [6] show the decidability of PDL using
a filtration argument. They also prove that the satisfiability problem for PDL is
EXPTIME-hard. Pratt [17] shows that PDL satisfiability is in EXPTIME using
a tableau method with an and-or graph representation. Goré and Widmann [7,8]
address the efficient implementation of Pratt-style decision procedures.
We consider PDL extended with nominals [14,15], a logic we call hybrid PDL
or HPDL. Nominals are atomic formulas that hold exactly for one state. Nominals
equip PDL with equality and are the characteristic feature of hybrid logic [2]. The
satisfiability problem of HPDL is in EXPTIME [15,18].
We are interested in a tableau system for HPDL that can serve as a basis for
gracefully degrading decision procedures. We found it impossible to extend one of
the existing tableau methods for PDL [17,5,1,7] to nominals. The difficulties are
in the correctness proofs. For Pratt-like methods [17,7], the problem stems from
the fact that the global and-or graph representation is not compatible with nominal

1571-0661 © 2011 Elsevier B.V. Open access under CC BY-NC-ND license.

doi:10.1016/j.entcs.2011.10.009
100 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

propagation (see Remark 5.6 in [10] for a discussion and an example; the problem
is also noted in [19]).
The difficulties led us to the development of a new tableau method for modal
logic. The new method is based on a prefix-free clausal form. In a previous paper [10]
we used the method to give a tableau-based decision procedure for the sublogic of
HPDL that restricts programs to the forms a and a∗ where a is a primitive action.
In the present paper we extend the clausal method to full HPDL and obtain the
first tableau-based decision procedure for HPDL.
Our method factorizes reasoning into regular reasoning, propositional reasoning
and modal reasoning. At each level we realize reasoning with tableau methods.
Nominals are handled at the modal level. Given our approach, the integration
of nominals is straightforward. The modular structure of our decision procedure
pays off in transparent correctness proofs. Each level invites optimizations. The
regular level, in particular, asks for further investigation. It may profit from efficient
methods for translating regular expressions into deterministic automata.
In contrast to previous approaches, we do not rely on the Fischer-Ladner closure.
Instead, we use the notion of a finitary regular DNF that can be obtained at the
regular level.
Following Baader [3] and De Giacomo and Massacci [5], we disallow bad loops
and thus avoid the a posteriori eventuality checking of Pratt’s method [17].
The paper is organized as follows. First we define HPDL and outline the clausal
tableau method with examples. Then we address, one after the other, regular,
propositional, and modal reasoning. Finally, we prove the correctness of the decision
procedure.

2 Hybrid PDL
We define the syntax and semantics of HPDL. We assume that three kinds of names
are given:
• nominals (metavariables x, y, z; denote states)
• predicates (metavariables p, q, r; denote sets of states)
• actions (metavariables a, b, c; denote relations from states to states).
The interpretations of HPDL are the usual transition systems where states are
labelled with predicates and edges are labelled with actions. Formally, an interpre-
tation I is a tuple consisting of the following components:
• A nonempty set |I| of states.
• A state Ix ∈ |I| for every nominal x.
• A set Ip ⊆ |I| for every predicate p.
a
• A relation →I ⊆ |I| × |I| for every action a.
Formulas (metavariables s, t, u) and programs (α, β, γ) are defined as follows:

s ::= x | p | ¬s | s ∧ s | αs
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 101

α ::= a | s | 1 | α + α | αα | α∗

The grammar is to be read inclusive, that is, every nominal and every predicate is a
formula, and every action and every formula is a program. Given an interpretation,
formulas denote sets of states and programs denote relations from states to states.
We use the letters X, Y , Z to denote states. The semantic relations I, X |= s
α
and X −→I Y are defined by mutual induction on the structure of formulas and
programs:

I, X |= x ⇐⇒ X = Ix
I, X |= p ⇐⇒ X ∈ Ip
I, X |= ¬s ⇐⇒ not I, X |= s
I, X |= s ∧ t ⇐⇒ I, X |= s and I, X |= t
α
I, X |= αs ⇐⇒ ∃Y : X −→I Y and I, Y |= s
a a
X −→I Y ⇐⇒ X →I Y
s
X −→I Y ⇐⇒ X = Y and I, X |= s
1
X −→I Y ⇐⇒ X = Y
α+β α β
X −→I Y ⇐⇒ X −→I Y or X −→I Y
αβ α β
X −→I Y ⇐⇒ ∃Z : X −→I Z and Z −→I Y
α∗ α
X −→I Y ⇐⇒ X −→∗I Y
α α
−→∗I denotes the reflexive transitive closure of −→I
Given a set A of formulas, we write I, X |= A if I, X |= s for all formulas s ∈ A.
An interpretation I satisfies (or is a model of) a formula s or a set A of formulas if
there is a state X ∈ |I| such that I, X |= s or, respectively, I, X |= A. A formula s
(a set A) is satisfiable if s (A) has a model.
The complement ∼s of a formula s is t if s = ¬t and ¬s otherwise. Note that
∼∼s = s if s is not a double negation. We use the notations s ∨ t := ¬(∼s ∧ ∼t) and
[α]s := ¬α∼s. Note that ∼αp = [α]¬p and ∼α¬p = [α]p. The size |s| and |α|
of formulas and programs is defined as the size of the abstract syntax tree. For
instance, |ap| = |pq| = 3. Note that |s ∨ t| > |s|, |t| and |[α]s| ≥ |αs| > |α|, |s|.

3 Outline of the Method

Our tableau method is based on a clausal form, which provides for the separation
of regular, propositional, and modal reasoning. We start with a few definitions and
three examples.
A basic formula is a formula of the form p, x, or aαs. A literal is a basic
formula or the complement of a basic formula. A clause (written C, D, E) is a
finite set of literals that contains no complementary pair (i.e., a pair of the form p,
¬p). We interpret clauses conjunctively. Satisfaction of clauses (i.e., I, X |= C) is
102 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

a special case of satisfaction of sets of formulas (i.e., I, X |= A), which was defined
in §2. For instance, the clause {ap, [a](¬p ∧ q)} is unsatisfiable.
A claim is a pair C s consisting of a clause C and a diamond formula s. While
we do not require s ∈ C, for every claim C s that we consider in the following it will
be the case that C supports s. The notion of support is defined formally later such
that C supporting s (or A) and I, X |= C implies I, X |= s (I, X |= A). The request
of a clause C for an action a is Ra C := { [α]s | [aα]s ∈ C }. As an example, consider
the clause C = {ab∗ p, bb∗ p, [a(a + b)∗ ]¬p}. We have Ra C = {[(a + b)∗ ]¬p} and
Rb C = ∅.
Our tableau method works on clauses and links (to be formally defined later)
rather than single formulas. Intuitively, a link is a pair of claims C s D t denoting
that in order for a model to satisfy the diamond literal s in C, it suffices to satisfy
D ∪ {t}. Given a single clause, the method tries to extend it to a tableau branch
in which every diamond literal s in every clause C is realized with a link C s D t
where D is one of the clauses of the branch. Provided the relation induced by the
links is terminating, every such branch is a model of all of its clauses. If every
branch constructed by the method fails to realize some diamond literal with a link
or contains a loop formed by links, we conclude that the input is unsatisfiable. Thus
we obtain a decision procedure for the satisfiability of clauses. At the same time,
the procedure decides the satisfiability of formulas since in HPDL a formula s is
satisfiable if and only if so is the clause {as} (the choice of a does not matter).
The method is implemented with three reasoners. The regular reasoner decom-
poses a program α into simpler (according to some measure) programs β1 , . . . , βn
such that α ≡ β1 + · · · + βn . For instance, a∗ is decomposed into aa∗ and 1.
The propositional reasoner determines for every set A of formulas a set of clauses
supporting A such that I, X |= A if and only if I, X |= C for one of the clauses.
Given the formula a∗ p∧[b∗ ]¬p, for instance, the propositional reasoner determines
the single clause {aa∗ p, ¬p, [bb∗ ]¬p}.
The modal reasoner is the top-level reasoner of our tableau method. For every
satisfiable clause it constructs a finite model whose states are clauses and where
every state C satisfies the clause C. To do so, the modal reasoner starts with
the initial clause and derives further clauses until every diamond literal s in every
clause C is realized with a link. The modal reasoner calls the regular reasoner to
determine the successor formula t and the propositional reasoner to determine the
successor clause D. The tableau method terminates since the derived clauses must
take their literals from a finite set that can be determined from the initial formulas.
Let us now give three examples illustrating our method in action. At this point,
they are there to provide some additional intuition about the method and do not
have to be understood in all details. To fully understand the examples one should
review them after all of the formal prerequisites have been introduced in § 8.
Example 3.1 Consider the following literals and clauses:

s := a(a + b)∗ p C := {t, ¬p, u}

t := b(a + b)∗ p D := {s, t, ¬p, u}
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 103

u := [bb∗ ](¬p ∧ t) E := {p}

We start the modal reasoner with the satisfiable clause C. There is one claim C t to
be realized. We need a clause that supports the formulas (a+ b)∗ p and [b∗ ](¬p ∧ t).
The regular reasoner and the propositional reasoner determine C t and D s as possible
successor clauses and successor literals. The modal reasoner rejects C t since it would
introduce the loop C t C t . The pair D s is fine and adds the clause D and the link
C t D s . The claim C t is now realized. However, the new clause D has two unrealized
claims D s and D t . To realize D s , we need a clause that supports the formula
(a + b)∗ p. The regular and the propositional reasoner yield the pairs E 1p , {s}s ,
and {t}t . We choose E 1p and add the clause E and the link D t E 1p . It remains
to realize D t . To do so, we need a clause that supports the formulas (a + b)∗ p and
[b∗ ](¬p ∧ t). As before, the regular and the propositional reasoner yield C t and D s .
Both are fine. We choose C t and add the link D t C t . This gives us a model for the
initial clause C. A graphical representation of the model looks as follows:

C t, ¬p, u
b b
D s, t, ¬p, u
a
E p

Example 3.2 Consider the following literals:

s := a(a + b)∗ ¬p u := [a(b + a)∗ ]p

t := b(a + b)∗ ¬p v := [b(b + a)∗ ]p

Here is a closed tableau for the unsatisfiable clause {s, u}:

C1 = {s, u}
C2 = {s, p, u, v} C3 = {t, p, u, v}
C1s C2s C1s C3t
C4 = {t, p, u, v} C5 = {s, p, u, v}
C2s C4t C3t C5s

The tableau is closed since all possible links for the claims C4t and C5s introduce
loops. For instance, for C4t the regular and the propositional reasoner yield the
links C4t C2s and C4t C4t . Note that the clause names Ci do not act as prefixes. They
are only used for explanatory purposes.
Example 3.3 Due to the clausal form, the extension of our tableau method to
nominals is straightforward. When we add a new clause to a branch, we add to the
104 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

new clause all literals that occur in clauses of the branch that have a nominal in
common with the new clause. This takes care of nominal propagation. Clauses and
links that are already on the branch remain unchanged.
Consider the clause C = {aa∗ p, [a](x∧¬p), [b]x, b[a]¬p}. The initial tableau
just consisting of C can be developed into a maximal branch as shown below (graph-
ical representation). The numbers indicate the order in which the clauses are intro-
duced. When clause 4 is introduced, nominal propagation from clause 2 takes place.
Note that we obtain a model of all clauses on the branch by taking the clauses 1,
3, 4, and 5 as states and the triples 1a4, 1b4, 4a5, and 5a3 as transitions.
1
aa∗ p, [a](x ∧ ¬p), [b]x, b[a]¬p

2 4
x, aa∗ p, ¬p x, aa∗ p, ¬p, [a]¬p

5
p 3
aa∗ p, ¬p

4 Language-Theoretic Semantics
We define a language-theoretic semantics for programs that treats formulas as
atomic objects. This semantics is the base for the regular reasoner and decouples
it from the propositional reasoner. It is also essential for the correctness proofs of
the modal reasoner. The semantics is an adaption of the language-theoretic model
of Kleene algebras with tests [12].
The letters A, B range over finite sets of formulas. A guarded string is a finite
sequence Aa1 A1 . . . an An where n ≥ 0. The letters σ and τ range over guarded
strings. Every program corresponds to a set of guarded strings, which can be seen
as runs of the program. For instance, the program (pa)∗ b¬p corresponds to the set
of all guarded strings A1 aA2 . . . aAn aAn+1 bAn+2 such that n ≥ 1, p ∈ A1 ∩ · · · ∩ An ,
and ¬p ∈ An+2 (there are no restrictions on An+1 ).
The length |σ| of a guarded string σ = Aa1 A1 . . . an An is n. We use For to denote
the set of all formulas. A language is a set of guarded strings. For languages L and
L and sets of formulas A we define the following:

LA := { B | A ⊆ B ⊆fin For } L0 := L∅
L · L := { ωAω  | ωA ∈ L, Aω  ∈ L } Ln+1 := L · Ln

L∗ := Ln
n∈N

where ω, ω  range over partial, possibly empty guarded strings. Note that L∗ =
L∅ ∪ (L − L∅) · L∗ . We assign to every program α a language Lα:

La := { AaB | A, B ⊆fin For } L(α + β) := Lα ∪ Lβ

 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 105

Ls := L{s} L(αβ) := Lα · Lβ
L1 := L∅ Lα∗ := (Lα)∗

Note that L(s∗ ) = L1 = L((s + t)∗ ).

σ
Given an interpretation I, we define the relations −→I ⊆ |I| × |I| by induction
on the structure of σ:

A
X −→I Y ⇐⇒ X = Y and I, X |= A
Aaσ a σ
X −→I Y ⇐⇒ I, X |= A and ∃Z : X −→I Z and Z −→I Y

Proposition 4.1
α σ
(i) X −→I Y ⇐⇒ ∃ σ ∈ Lα : X −→I Y
σ
(ii) I, X |= αs ⇐⇒ ∃ σ ∈ Lα ∃ Y : X −→I Y and I, Y |= s
σ
(iii) I, X |= [α]s ⇐⇒ ∀ σ ∈ Lα ∀ Y : X −→I Y implies I, Y |= s

5 Regular DNF
We now describe the regular reasoner. The regular reasoner relies on the language-
theoretic semantics and ignores the propositional and modal aspects of the language.
A program is basic if it has the form aα, and normal if it is 1 or basic. Intu-
itively, a regular DNF of a program α is a decomposition of α into normal programs
β1 , . . . , βn such that α ≡ β1 + · · · + βn (or, more formally, Lα = Lβ1 ∪ · · · ∪ βn ). This
simple intuition does not account for tests. The program p, for instance, cannot be
represented by any set of normal programs. Hence formally we proceed as follows.
We use Fα to denote the set of all formulas that occur in α as subprograms.
For instance, F(a¬p + bapq) = {¬p, apq}. Formulas that occur as programs are
called tests. Note that Fα does not include tests that occur in tests occurring in α.

Proposition 5.1 If s ∈ Fα, then, for every t, |s| < |¬s| < |αt| ≤ |[α]t|.

A guarded program is a pair Aα where A is a set of formulas and α is a program.

A guarded program Aα is normal if α is normal. The language of a guarded program
is L(Aα) := LA · Lα. A regular DNF is a function D that maps every program α
to a finite set Dα of normal guarded programs such that:

(i) Lα = L(Bβ)
Bβ∈Dα
(ii) If Bβ ∈ Dα, then B ∪ Fβ ⊆ Fα.
The regular reasoner computes a regular DNF. Kleene’s theorem (regular ex-
pressions translate into finite automata) [16] suggests that regular DNFs exist. We
give a naive algorithm that computes a regular DNF. For space reasons we omit the
correctness proof. The algorithm employs the following inference rules for guarded
106 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

programs.

Aa As Asβ A1β A(α1 + α2 ) A(α1 + α2 )β

Aa1 (A ; s)1 (A ; s)β Aβ Aα1 , Aα2 Aα1 β , Aα2 β

A(α1 α2 )β Aα∗ Aα∗ β

Aα1 α2 β A1 , Aαα∗ Aβ , Aαα∗ β

The notation A ; s stands for the set A ∪ {s}. Also, we write programs of the form
α(βγ) without parentheses as αβγ. Given a set G of guarded programs, we denote
the closure of G under the rules with RG. One can show that RG describes the
same language as G, and that RG is finite if G is finite. If G is a set of guarded
programs, we call a guarded program Aα ∈ G minimal in G if there is no Bα ∈ G
such that B  A. We obtain a regular DNF D by taking for Dα all normal guarded
programs in R{∅α} that are minimal in R{∅α}.
Example 5.2 Consider the program (a + b)∗ . We have:

R{∅(a + b)∗ } = {∅(a + b)∗ , ∅1, ∅(a + b)(a + b)∗ , ∅a(a + b)∗ , ∅b(a + b)∗ }
D{(a + b)∗ } = {∅1, ∅a(a + b)∗ , ∅b(a + b)∗ }
Example 5.3 Consider the program (p + q)∗ where p, q are predicates. We have
D{(p+q)∗ } = {∅1}. We profit from the optimization that only the minimal guarded
programs are taken for the DNF. Otherwise D{(p+q)∗ } would contain three further
elements: {p}1, {q}1, and {p, q}1.

While the above naive algorithm yields a regular DNF for every program α,
its efficiency in practice remains to be seen. For programs without tests (i.e., for
regular expressions), efficient regular DNFs can be obtained via translation into
deterministic finite automata [4]. We expect that similarly efficient regular DNFs
also exist for programs with tests.
We fix some computable regular DNF D for the rest of the paper.
Proposition 5.4
(i) I, X |= αs ⇐⇒ ∃ Bβ ∈ Dα : I, X |= B ;βs
(ii) I, X |= [α]s ⇐⇒ ∀ Bβ ∈ Dα : (∃ t ∈ B : I, X |= ¬t) or I, X |= [β]s

Proof. Follows with Proposition 4.1. 2

6 Propositional DNF
The propositional reasoner relies on a support relation from clauses to formulas that
abstracts from most modal aspects of the language. We define the support relation
C  s by recursion on s.

C  s ⇐⇒ s ∈ C if s is a literal
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 107

C  ¬¬s ⇐⇒ C s
Cs∧t ⇐⇒ C  s and C  t
Cs∨t ⇐⇒ C  s or C  t
C  1s ⇐⇒ C s
C  [1]s ⇐⇒ C s
C  αs ⇐⇒ ∃Bβ ∈ Dα : (∀t ∈ B : C  t) and C  βs if α not normal
C  [α]s ⇐⇒ ∀Bβ ∈ Dα : (∃t ∈ B : C  ¬t) or C  [β]s if α not normal

The last two equivalences of the definition employ the regular DNF D fixed above.
The recursion terminates since either the size of the formula is reduced (verify with
Proposition 5.1) or the recursion is on a formula βs or [β]s where β is normal and
s is unchanged. We say C supports s if C  s. We write C  A and say C supports A
if C  s for every s ∈ A. Note that C  D ⇐⇒ D ⊆ C (recall that C and D denote
clauses).
Proposition 6.1 If C  A and C ⊆ D and B ⊆ A, then D  B.
Proposition 6.2 If I, X |= C and C  A, then I, X |= A.

Proof. Follows with Proposition 5.4. 2

We define propositional DNFs as functions that, applied to a formula set A,

yield a DNF (in the traditional sense) of the conjunction of the formulas in A,
represented as a set of clauses. In other words, we require that a propositional DNF
  
D applied to a set A satisfies the equivalence s∈A s ≡ C∈DA t∈C t.
Formally, a propositional DNF is a function D that maps every finite set A of
formulas to a finite set of clauses such that:
(i) I, X |= A ⇐⇒ ∃D ∈ DA : I, X |= D.
(ii) C  A ⇐⇒ ∃D ∈ DA : D ⊆ C.
Property (ii) for propositional DNFs immediately implies the following proposition.
Proposition 6.3 If C ∈ DA, then C  A.

In the following, we will often use Proposition 6.3 implicitly.

For the termination of the modal reasoner the propositional DNF must have
some additional finiteness property. We need a few preparatory definitions. The
variants of a program α are the basic programs β such that Bβ ∈ Dα for some B.
A base is a set U of basic formulas such that βs ∈ U whenever aαs ∈ U and β
is a variant of α. A base U supports a formula s if the following conditions are
satisfied:
(i) U contains every basic formula that occurs in s.
(ii) If αt occurs in s, α is not basic, and β is a variant of α, then βt ∈ U .
A base supports a set of formulas A if it supports every formula s ∈ A.
Proposition 6.4 Every finite set of formulas is supported by a finite base.
108 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

Proof. Follows from property (ii) for the underlying regular DNF. 2

A propositional DNF D is finitary if for every finite set of formulas A and every
base U supporting A and every clause C ∈ DA it holds that U supports C.
Proposition 6.5 There is a computable finitary propositional DNF.

Proof. The definition of the support relation can be seen as a tableau-style de-
composition procedure for formulas. Using this procedure, one develops A into
a complete tableau. The literals of each open branch yield a clause. All clauses
obtained this way constitute a DNF of A.
The direction “⇐” of property (i) for propositional DNFs follows with Propo-
sition 6.2. That the DNF is finitary follows from the fact that the decomposition
does not introduce new formulas except for diamond formulas obtained with the
finitary regular DNF. 2
Example 6.6 Take the regular DNF given in §5 and the propositional DNF given
in the proof of Proposition 6.5. We have:

D{b∗ p} = {{p}, {bb∗ p}}

D{b∗ p, [b∗ ](q ∧ ¬p)} = {{bb∗ p, q, ¬p, [bb∗ ](q ∧ ¬p)}}
D{a∗ p, [a∗ ]¬p} = ∅
D{(a + b)∗ p} = {{p}, {a(a + b)∗ p}, {b(a + b)∗ p}}

For the third example note that [a∗ ]¬p is the complement of a∗ p.

We fix some computable and finitary propositional DNF D for the rest of the
paper.

7 Diamond Expansion and Nominal Propagation

We now return to the modal reasoner, which was first explained in §3. The modal
reasoner builds a tableau where each branch contains clauses and links. The goal
consists in constructing a branch where every claim is realized with a link and
some further conditions are satisfied. We first make precise how the modal reasoner
derives new clauses.
An expansion of a claim C aαs is a claim D βs such that Bβ ∈ Dα and
D ∈ D(B ;βs ∪ Ra C) for some B. The following proposition formulates an im-
portant property of expansions (the proposition will not be needed later).
Proposition 7.1 Let C s be a claim such that s ∈ C and let I satisfy C. Then
there exists an expansion D t of C s such that I satisfies D.

A link is a pair C s D t of two claims such that s ∈ C and there is an expansion

Et of C s such that E ⊆ D. A quasi-branch is a finite set Γ of clauses and links
such that {C, D} ⊆ Γ whenever C s D t ∈ Γ. A quasi-branch Γ realizes a claim C s
if Γ contains some link C s D t . A base supports a quasi-branch Γ if it supports every
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 109

clause of Γ. An interpretation I satisfies a quasi-branch Γ (or is a model of Γ) if I

satisfies every clause in Γ.
We call a clause nominal if it contains a nominal. Let Γ be a quasi-branch and A
be a set of formulas. We realize nominal propagation with the notation

AΓ := A ∪ { s | ∃x ∈ A ∃C ∈ Γ : x ∈ C ∧ s ∈ C }

Note that AΓ is the least set of formulas that contains A and all clauses C ∈ Γ that
have a nominal in common with A. Thus (AΓ )Γ = AΓ . Moreover, AΓ = A if A
contains no nominal.
Proposition 7.2 If an interpretation satisfies Γ and C, it satisfies C Γ .
Proposition 7.3 Let U be a base that supports a quasi-branch Γ, C s be a claim
such that s ∈ C ∈ Γ, and D t be an expansion of C s . Then U supports D Γ .

8 Branches and Expansion Rule

A quasi-branch that realizes all its claims does not necessarily have a model. To
guarantee the existence of a model, we impose certain conditions on quasi-branches
that act as invariants of the modal reasoner. One of the conditions is loop freeness.
Example 8.1 Consider the clause C = {aa∗ ¬p, p, q, [aa∗ ](p ∧ q)}. Note that C
∗ ∗
is unsatisfiable, and that {C, C aa ¬p C aa ¬p } is a quasi-branch that realizes every
claim. The link of this quasi-branch describes a loop.
A path in a quasi-branch Γ is a sequence C1 s1 . . . Cn sn of claims such that:
(i) ∀i ∈ [1, n] : CiΓ = Ci .
(ii) ∀i ∈ [1, n − 1] ∃D : Ci si D si+1 ∈ Γ and D Γ = Ci+1 .
A loop in a quasi-branch Γ is a path C1 s1 . . . Cn sn in Γ such that n ≥ 2 and
Cn sn = C1 s1 . A branch is a quasi-branch Γ that satisfies the following conditions:
• Functionality: If C s D t ∈ Γ and C s E u ∈ Γ, then D t = E u .
• Loop-freeness: There is no loop in Γ.
• Nominal coherence: If C ∈ Γ, then C Γ ∈ Γ.
The core of a branch Γ is CΓ := { C ∈ Γ | C Γ = C }. A branch Γ is evident if Γ
realizes C αs for all αs ∈ C ∈ CΓ. We will show that every evident branch has a
model. The modal reasoner works on branches and applies the following expansion
rule:
Expansion Rule
If αs ∈ C ∈ CΓ and Γ does not realize C αs ,
then expand Γ to all branches Γ ; D Γ ; C αs (D Γ )t
such that D t is an expansion of C αs and D Γ is a clause.
Note that a single clause always yields a branch. So the modal reasoner can start
with any clause.
110 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

Proposition 8.2 The modal reasoner terminates on every branch.

Proof. Since branches are finite by definition, we know by Proposition 6.4 that the
initial branch is supported by a finite base. By Proposition 7.3 we know that the
expansion rule only adds clauses that are supported by the initial base. The claim
follows since a finite base can only support finitely many clauses. 2

Given termination, the correctness of the modal reasoner can be established by

showing two properties:
(i) Model Existence: Every evident branch has a model.
(ii) Soundness: Every satisfiable clause can be developed into an evident branch.

9 Model Existence
Proposition 9.1 Let Γ be an evident branch and αs ∈ C ∈ CΓ. Then there exists
a unique path C αs . . . D 1s in Γ.

Proof. The path exists since Γ is loop-free and realizes every claim with a clause
in CΓ. The path is unique since Γ is functional. 2
a
Lemma 9.2 If X −→I Y and I, Y |= B ;βs and Bβ ∈ Dα, then I, X |= aαs.

Proof. Follows with Propositions 4.1 and 5.4. 2

The model existence proof requires a somewhat involved induction, which we

realize with the following lemma.

Lemma 9.3 Let Γ be an evident branch and I be an interpretation such that:

• |I| = CΓ
a
• C →I D ⇐⇒ ∃α, s, t, E : C aαs E t ∈ Γ and D = E Γ for all actions a
• C ∈ Ip ⇐⇒ p ∈ C for all predicates p
• Ix = C ⇐⇒ x ∈ C for all nominals x that occur in Γ
Let |Fα| := max{ |s| | s ∈ Fα }. Then for all n ∈ N:
(i) For every path C αs . . . D 1s in Γ such that |Fα|, |s| < n:
I, C |= αs.
(ii) For all C, D, σ, α, s such that |Fα|, |s| < n − 1:
σ
If C  [α]s, σ ∈ Lα, and C −→I D, then D  s.
(iii) For all C, s such that C ∈ CΓ and |s| = n:
If C  s, then I, C |= s.

Proof. By induction on n. See [11] for details. 2

Theorem 9.4 (Model Existence) Every evident branch has a finite model.

Proof. Follows with Lemma 9.3 (iii). See [11] for details. 2
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 111

10 Soundness
We have now arrived at the crucial part of the correctness proof. Ideally, we would
like to show that a satisfiable branch with an unrealized claim can always be ex-
panded. However, this is not true.

Example 10.1 Consider the following branch where s := [aa∗ ](q ∨ [a]¬p):

aa∗ p, ¬p, q, s aa∗ p, [a]¬p, s aa∗ p, ¬p, [a]¬p, s

The branch is satisfiable. Still it is impossible to realize the claim for the third
clause since each of the two possible expansions introduces a loop.

Following [10], we solve the problem with the notion of a straight model. A
straight model requires that all links on the branch make progress towards the
fulfillment of the diamond literal they serve. Every satisfiable initial branch has a
straight model, and every unrealized claim on a branch with a straight model I can
be expanded such that I is a straight model of the expanded branch.
Let I be an interpretation and A be a set of formulas. The depth of A and αs
in I is defined as

δI A(αs) := min{ |σ| | σ ∈ Lα and

σ
∃X, Y ∈ |I| : I, X |= A and X −→I Y and I, Y |= s }

where min ∅ = ∞ and n < ∞ for all n ∈ N.

Proposition 10.2 δI As < ∞ iff I satisfies A ; s.

Proof. Follows with Proposition 4.1. 2

In particular, we have δI Cs < ∞ for every s ∈ C ∈ Γ if I is a model of Γ.

A link C s D t is straight for an interpretation I if δI Cs > δI Dt whenever
δI Cs > 0. A straight model of a quasi-branch Γ is a model of Γ such that every link
C s D t ∈ Γ is straight for I.

Proposition 10.3 Let I be a model of a quasi-branch Γ. Then δI As = δI AΓ s.

Lemma 10.4 (Straightness) A quasi-branch that has a straight model contains

no loops.

Proof. By contradiction. Let I be a straight model of a quasi-branch Γ and

C1 s1 . . . Cn sn be a loop in Γ. Then n ≥ 2 and C1 s1 = Cn sn . It suffices to
show that δI Ci si > δI Ci+1 si+1 for all i ∈ [1, n − 1]. Let i ∈ [1, n − 1]. Then
si = aαt, Ci si D si+1 ∈ Γ, and D Γ = Ci+1 for some a, α, t, and D. Since every
σ ∈ L(aα) contains the action a, we have δI Ci si > 0. Since Ci si D si+1 is straight
for I, δI Ci si > δI Dsi+1 . Hence δI Ci si > δI Ci+1 si+1 by Proposition 10.3 since
D Γ = Ci+1 . 2
112 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113

Theorem 10.5 (Soundness) Let I be a straight model of a branch Γ and let

αs ∈ C ∈ Γ such that Γ does not realize C αs . Then there is an expansion D t
of C αs such that Γ ; D Γ ; C αs (D Γ )t is a branch and I is a straight model of
Γ ; D Γ ; C αs (D Γ )t .

Proof. Since I satisfies C, by Proposition 10.2, there is some σ ∈ Lα and X, Y ∈ |I|

σ
be such that |σ| = δI C(αs) and I, X |= C and X −→I Y and I, Y |= s. Since
αs is a literal, α = aβ and σ = Aaτ for some a, β, A, and τ ∈ Lβ. Let Z ∈ |I|
a τ
be such that X −→I Z and Z −→I Y . Let Bγ ∈ Dβ such that τ ∈ L(Bγ). Then
I, Z |= B and I, Z |= γs by Proposition 4.1 (ii). Moreover, I, Z |= Ra C. Thus,
by property (i) for propositional DNFs, there is some D ∈ D(B ;γs ∪ Ra C) such
that I, Z |= D. Clearly, D γs is an expansion of C αs and, since τ ∈ L(Bγ),
δI D(γs) ≤ |τ | = |σ| − 1 < δI C(αs). Then, by Proposition 10.3, δI D Γ (γs) <
δI C(αs). Therefore, I is a straight model of Γ ; D Γ ; C αs (D Γ )γs . Moreover,
Γ ; D Γ ; C αs (D Γ )γs satisfies the nominal coherence and functionality conditions.2

11 Final Remarks
The main innovation of the present paper over our previous paper [10] is the notion
of a finitary regular DNF. This makes it possible to cover all PDL programs and
still have transparent correctness proofs.
It is straightforward to extend the clausal tableau method for HPDL to satisfac-
tion formulas @x s. To deal with such formulas, one adds an additional expansion
rule at the modal level as presented in [10]. Also, the optimizations for the modal
level of clausal tableaux discussed in [10] carry over to HPDL.
It can be seen by a straightforward analysis that the decision procedure utiliz-
ing the naive regular reasoner presented in § 5 and the tableau-based propositional
reasoner sketched in Proposition 6.5 runs in NEXPTIME.
We expect that the clausal method can be extended to difference modalities.
Less clear is the possibility of extending the method to converse modalities. As re-
cently shown by Goré and Widmann [8], converse modalities can be efficiently dealt
with by Pratt-style decision procedures. Their treatment of converse, however, does
not seem to carry over to our approach. On the other hand, Pratt-style procedures
do not seem compatible with nominals (see [10,19]). Hence, developing a grace-
fully degrading decision procedure for a logic featuring eventualities, nominals, and
converse modalities at the same time remains a challenging open problem.

Acknowledgment
We would like to thank a referee for valuable remarks that helped to improve the
paper.
 M. Kaminski, G. Smolka / Electronic Notes in Theoretical Computer Science 278 (2011) 99–113 113

References
[1] Abate, P., R. Goré and F. Widmann, An on-the-fly tableau-based decision procedure for PDL-
satisfiability, in: C. Areces and S. Demri, editors, Proc. 5th Workshop on Methods for Modalities
(M4M-5), Electr. Notes Theor. Comput. Sci. 231 (2009), pp. 191–209.

[2] Areces, C. and B. ten Cate, Hybrid logics, in: P. Blackburn, J. van Benthem and F. Wolter, editors,
Handbook of Modal Logic, Studies in Logic and Practical Reasoning 3, Elsevier, 2007 pp. 821–868.

[3] Baader, F., Augmenting concept languages by transitive closure of roles: An alternative to
terminological cycles, Technical Report RR-90-13, DFKI (1990).

[4] Berry, G. and R. Sethi, From regular expressions to deterministic automata, Theor. Comput. Sci. 48
(1986), pp. 117–126.

[5] De Giacomo, G. and F. Massacci, Combining deduction and model checking into tableaux and algorithms
for converse-PDL, Inf. Comput. 162 (2000), pp. 117–137.

[6] Fischer, M. J. and R. E. Ladner, Propositional dynamic logic of regular programs, J. Comput. System
Sci. (1979), pp. 194–211.

[7] Goré, R. and F. Widmann, An optimal on-the-fly tableau-based decision procedure for PDL-
satisfiability, in: R. A. Schmidt, editor, CADE 2009, LNCS 5663 (2009), pp. 437–452.

[8] Goré, R. and F. Widmann, Optimal tableaux for propositional dynamic logic with converse, in: J. Giesl
and R. Hähnle, editors, IJCAR 2010, LNCS 6173 (2010), pp. 225–239.

[9] Harel, D., D. Kozen and J. Tiuryn, “Dynamic Logic,” The MIT Press, 2000.

[10] Kaminski, M. and G. Smolka, Terminating tableaux for hybrid logic with eventualities, in: J. Giesl and
R. Hähnle, editors, IJCAR 2010, LNCS 6173 (2010), pp. 240–254.

[11] Kaminski, M. and G. Smolka, Clausal tableaux for hybrid PDL, Technical report, Saarland University
(2011). URL www.ps.uni-saarland.de/Publications/details/KaminskiSmolka:2011:HPDL.html

[12] Kozen, D. and F. Smith, Kleene algebra with tests: Completeness and decidability, in: D. van Dalen
and M. Bezem, editors, CSL’96, LNCS 1258 (1996), pp. 244–259.

[13] Kozen, D. and J. Tiuryn, Logics of programs, in: Handbook of Theoretical Computer Science, Volume
B: Formal Models and Sematics, Elsevier, 1990 pp. 789–840.

[14] Passy, S. and T. Tinchev, PDL with data constants, Inf. Process. Lett. 20 (1985), pp. 35–41.

[15] Passy, S. and T. Tinchev, An essay in combinatory dynamic logic, Inf. Comput. 93 (1991), pp. 263–332.

[16] Perrin, D., Finite automata, in: Handbook of Theoretical Computer Science, Volume B: Formal Models
and Sematics, Elsevier, 1990 pp. 1–57.

[17] Pratt, V. R., A near-optimal method for reasoning about action, J. Comput. System Sci. 20 (1980),
pp. 231–254.

[18] Sattler, U. and M. Y. Vardi, The hybrid μ-calculus, in: R. Goré, A. Leitsch and T. Nipkow, editors,
IJCAR 2001, LNCS 2083 (2001), pp. 76–91.

[19] Widmann, F., “Tableaux-based Decision Procedures for Fixed Point Logics,” Ph.D. thesis, Australian
National University (2010).