We introduce the concept of unreliable failure detectors and study how they can be used to solve Consensus in asynchronous systems with crash failures. We characterise unreliable failure detectors in terms of two properties — completeness and accuracy. We show that Consensus can be solved even with unreliable failure detectors that make an infinite number of mistakes, and determine which ones can be used to solve Consensus despite any number of crashes, and which ones require a majority of correct processes. We prove that Consensus and Atomic Broadcast are reducible to each other in asynchronous systems with crash failures; thus the above results also apply to Atomic Broadcast. A companion paper shows that one of the failure detectors introduced here is the weakest failure detector for solving Consensus [Chandra et al. 1992].

: We present a formal model that captures the subtle interaction between knowledge and action in distributed systems. We view a distributed system as a set of runs, where a run is a function from time to global states and a global state is a tuple consisting of an environment state and a local state for each process in the system. This model is a generalization of those used in many previous papers. Actions in this model are associated with functions from global states to global states. A protocol is a function from local states to actions. We extend the standard notion of a protocol by defining knowledge-based protocols, ones in which a process' actions may depend explicitly on its knowledge. Knowledge-based protocols provide a natural way of describing how actions should take place in a distributed system. Finally, we show how the notion of one protocol implementing another can be captured in our model. Some material in this paper appeared in preliminary form in [HF85]. An abridge...

In this paper, we have combined techniques from epistemic and dynamic logic to arrive at a logic for describing multi-agent information change. The key concept of dynamic semantics is that the meaning of an assertion is the way in which the assertion changes the information of the hearer. Thus a dynamic epistemic semantics consist in a explicit formal definition of the information change potential of a sentence. We used these ideas to arrive at the system of Dynamic Epistemic Semantics, which is semantics for a language describing information change in a multi-agent setting. This semantics proved useful for analyzing the Muddy Children paradox, and also for giving a semantics for knowledge programs, since it enabled us to model knowledge change by giving an explicit semantics to the triggers of the information change (the latter being the assertions made, or the messages sent). We feel that this is an important extension, since standard approaches to for example the Muddy Children (e.g. Fagin et al. 1995) generally use static epistemic logics like S5 to describe the situation before and after a certain epistemic event, leaving the transition between `before' and `after' to considerations in the meta-language.

While the intuition underlying a zero knowledge proof system [GMR85] is that no "knowledge" is leaked by the prover to the verifier, researchers are just beginning to analyze such proof systems in terms of formal notions of knowledge. In this paper, we show how interactive proof systems motivate a new notion of practical knowledge, and we capture the definition of an interactive proof system in terms of practical knowledge. Using this notion of knowledge, we formally capture and prove the intuition that the prover does not leak any knowledge of any fact (other than the fact being proven) during a zero knowledge proof. We extend this result to show that the prover does not leak any knowledge of how to compute any information (such as the factorization of a number) during a zero knowledge proof. Finally, we de ne the notion of a weak interactive proof in which the prover is limited to probabilistic, polynomial-time computations, and we prove analogous security results for such proof systems. We showthat, in a precise sense, any nontrivial weak interactive proof must be a proof about the prover's knowledge, and show that, under natural conditions, the notions of interactive proofs of knowledge defined in [TW87] and [FFS87] are instances of weak interactive proofs.

We address the issue of rational communicative behavior among autonomous intelligent agents that have to make decisions as to what, to whom, and how to communicate. We treat communicative actions as aimed at increasing the efficiency of interaction among agents. We postulate that a rational speaker design a speech act so as to maximally increase the benefit obtained as the result of the interaction. We quantify the gain in the quality of interaction as the expected utility, and we present a framework that allows an agent to compute the expected utility of various communicative actions. Our framework uses the Recursive Modeling Method as the representation of the agent's state of knowledge, including the agent's preferences, abilities and beliefs about the world, as well as the beliefs the agent has about the other agents, the beliefs it has about the other agents ' beliefs, and so on. A decision-theoretic pragmatics of a communicative act can be then defined as the transformation it induces on the agent's state of knowledge about its decision-making situation. This transformation leads to a change in the quality of the interaction, expressed in terms of the benefit to the agent. We analyze decision-theoretic pragmatics of a number of important communicative acts, and investigate their expected utility using examples.

... this paper we study two special cases of this framework: full systems and hypercubes. Both model static situations in which no agent has any information about another agent's state. Full systems and hypercubes are an appropriate model for the initial congurations of many systems of interest. We establish a correspondence between full systems and hypercube systems and certain classes of Kripke frames. We show that these classes of systems correspond to the same logic. Moreover, this logic is also the same as that generated by the larger class of weakly directed frames. We provide a sound and complete axiomatization, S5WDn , of this logic, and study its computational complexity. Finally, we show that under certain natural assumptions, in a model where knowledge evolves over time, S5WDn characterises the properties of knowledge not just at the initial conguration, but also at all later congurations. In particular, this holds for homogeneous broadcast systems, which capture settings in which agents are initially ignorant of each others local states, operate synchronously, have perfect recall, and can communicate only by broadcasting.

this article is on protocols allowing the well-functioning parts of such a large and complex system to carry out their work despite the failure of others. Many deep and interesting results on such problems have been discovered by computer scientists in recent years, the incorporation of which into game theory can greatly enrich this field

In an information state where various agents have both factual knowledge and knowledge about each other, announcements can be made that change the state of information. Such informative announcements can have the curious property that they become false because they are announced. The most typical example of that is `fact p is true and you don't know that', after which you know that p,which entails the negation of the announcement formula. The announcement of such a formula in a given information state is called an unsuccessful update. A successful formula is a formula that always becomes common knowledge after being announced. Analysis of information systems and `philosophical puzzles' reveals a growing number of dynamic phenomena that can be described or explained by unsuccessful updates. This increases our understanding of such philosophical problems. We also investigate the syntactic characterization of the successful formulas.

equivalent in asynchronous systems. Thus all our results regarding the solvability of Consensus using failure detectors, apply to Atomic Broadcast as well. The work in this thesis was funded by an IBM graduate fellowship and grants from NSF, DARPA/NASA, the IBM Endicott Programming Laboratory, Siemens Corp and the Natural Siences and Engineering Research Council of Canada. Biographical Sketch Tushar Deepak Chandra was born in New Delhi, India on November 13, 1966. He spent his childhood in various cities in India: Bombay, Calcutta and finally Kanpur. After completing high school at the Doon school, he went on to do a Bachelor of Technology in Computer Science at the Indian Institute of Technology at Kanpur. He joined the graduate program in Computer Science at Cornell University in August 1988. iii This thesis is dedicated to my parents who taught me how to think. iv Acknowledgements A large number of people contributed either directly or i

In this paper, we extend circumscription [McCarthy, 80] to a propositional modal logic of knowledge of one agent. Instead of circumscribing a predicate, we circumscribe the knowledge operator "K " in a formula. In order to have a nontrivial circumscription schema, we extend $5 modal logic of knowledge by adding another modality "Val " and a universal quantifier over base sentences (sentences which do not contain modality). In-tuitively, "Val(P) " means that P is a valid formula. It turns out that by circumscribing the knowledge operator in a formula, we completely characterize the maximally ignorant models of the formula (models of the formula where agents have minimal knowledge).