A Modal Temporal Logic for Reasoning about Change 
Eric Mays 
Department of Computer and Information Science 
Moore School of Electrical Engineerlng/D2 
University of Pennsylvania 
Philadelphia, PA 19104 
ABSTRACT 
We examine several behaviors for query 
systems that become possible with the ability to 
represent and reason about change in data bases: 
queries about possible futures, queries about 
alternative histories, and offers of monitors as 
responses to queries. A modal temporal logic is 
developed for this purpose. A completion axiom for 
history is given and modelling strategies are 
given by example. 
I INTRODUCTION 
In this paper we present a modal temporal 
logic that has been developed for reasoning about 
change in data bases. The basic motivation is as 
follows. A data base contains information about 
the world: as the world changes, so does the data 
base -- probably maintaining some description of 
what the world was like before the change took 
place. Moreover, if the world is constrained In 
the ways it can change, so is the dat~ base. We 
are motivated by the benefits to be gained by 
being able to represent those constraints and use 
them to reason about the possible states of a data 
base. 
It is generally accepted that a natural 
language query system often needs to provide more 
than just the literal answer to a question. For 
example, \[Kaplan 82I presents methods for 
correcting a questionerls misconceptions (as 
reflected in a query) about the contents of a data 
base, as well as providing additional information 
in suvport of the literal answer to a query, By 
enriching the data base model, Kaplan's work on 
correcting misconceptions was extended in \[Mays 
801 to distinquish between misconceptions about 
data base structure and data base contents. In 
either case, however, the model was a static one. 
By incorporating a model of the data base in which 
a dynamic view is allowed, answers to questions 
can include an offer to monitor for some condition 
which might possibly occur in the future. The 
following is an example: 
U: "Is the Kitty Hawk in Norfolk?" 
S: "No, shall I let you know when she is?" 
IThJs work is partially supported by a grant 
from the Natlonal Science Foundation, NSF-MCS 
81-07290. 
But just having a dynamic view is not adequate, it 
is necessary--r-y--~at the dynamic view correspond to 
the possible evolution of the world that is 
modelled. Otherwise, behaviors such as the 
following might arise: 
U: "Is New York less than 50 miles from 
Philadelphia?" 
S: "No, shall I let you know when it is?" 
An offer of a monitor is said to be competent only 
if the conditlon to be monitored can possibly 
occur. Thus, in the latter example the offer is 
not competent, while in the former it is. This 
paper is concerned with developing a lo~ic for 
reasoning about change in data bases, and 
assessing the impact of that capability on the 
behavior of question answering systems. The 
general area of extended interaction in data base 
systems is discussed in \[WJMM 831. 
As just pointed out, the ability to represent 
and reason about change in data bases affects the 
range and quality of responses that may be 
produced by a query system. Reasoning about prior 
possibllty admits a class of queries dealing with 
the future possibility of some event or state of 
affairs at some time in the past. These queries 
have the general form: 
"Could it have been the case that p?" 
This class of queries will be termed 
counterhistoricals in an attempt to draw some 
parallel with counterfactuals. The future 
correlate of counterhistoricals, which one might 
call futurities, are of the form: 
"Can it be the case that p?" 
i.e. in the sense of: 
"Might it ever be the case that p?" 
The most interesting aspect of this form of 
question is that it admits the ability for a query 
system to offer a monitor as a response to a 
question for relevant information the system may 
become aware of at some future time. A query 
system can only competently offer such monitors 
when it has this ability, since otherwise it 
cannot determine if the monitor may ever be 
satisfied. 
II REPRESENTATION 
We have chosen to use a modal temporal logic. 
There are two basic requirements which lead us 
toward logic and away from methods such as Petri 
nets. F~rst, it may be desirable to assert that 
some proposition is the case without necessarily 
38 
specifying exactly when. Secondly, our knowledge 
may be disjunctive. That is, our knowledge of 
temporal situations may be incomplete and 
indefinite, and as others have argued \[Moore 821 
(as a recent example), methods based on formal 
logic (though usually flrst-order) are the only 
ones that have so far been capable of dealing with 
problems of this nature. 
In contrast to flrst-order representations, 
modal temporal logic makes a fundamental 
distinction between variability over time (as 
expressed by modal temporal operators) and 
variability in a state (as expressed using 
propositional or flrst-order languages). Modal 
temporal logic also reflects the temporally 
indefinite structure of language in a way that is 
more natural than the commaon method of using 
state variables and constants in a flrst-order 
logic. On the side of flrst-order logic, however, 
is expressive power that is not necessarily 
present in modal temporal logic. (But, see \[K amp 
68\] and \[GPSS 80\] for comparisons of the 
expressive power of modal temporal logics with 
flrst-order theories.) 
There are several possible structures that 
one could reasonably imagine over states in time. 
The one we have in mind is discrete, backwards 
linear, and infinite in both directions. We allow 
branching into the future to capture the idea that 
it is open, but the past is determined. Due to 
the nature of the intended application, we also 
have assumed that time is discrete. It should be 
stressed that this decision Is not motivated by 
the belief that time itself is discrete, but 
rather by the data base application. Furthermore, 
in cases where it is necessary for the temporal 
structure to be dense or continuous, there is no 
immediate argument against modal temporal logic in 
general. (That Is, one could develop a modal 
temporal logic that models a continuous structure 
of time \[RU 71\].) 
A modal temporal structure is composed of a 
set oP states. Each state is a set of propositions 
which are true of that state. States are related 
by an immediate predecessor-successor relation. A 
branch of time is defined by taking some possible 
sequence of states accessible over this relation 
from a given state. The future fragment of the 
logic is based on the unified branching temporal 
logic of \[BMP 81\], which introduces branches and 
quantifies over them to make it possible to 
describe properties on some or all futures. Thls 
is extended with an "until" operator (as in \[K amp 
68\], \[GPSS 801) and a past fragment. Since the 
structures are backwards linear the existential 
and universal operators are merged to form a 
linear past fragment. 
A. Syntax 
Formulas are composed from the symbols, 
- A set ~of atomic propositions. 
Boolean connectives: v, -. 
Temporal operators: AX (every next), EX 
(some next), AG (every always), EG (some 
always), AF (every eventually), EF (some 
eventually), AU (every until), EU (some 
until), L (immediately past), P (sometime 
past), H (always past), S (since). AU, EU, 
and S are binary; the others are unary. 
For the operators composed of two symbols, 
the first symbol ("A" or "E") can be 
thought of as quantifying universally or 
existentially over branches in time; the 
second symbol as quantifying over states 
within the branch. Since branching is not 
allowed into the past, past operators have 
only one symbol. 
using the rules, 
- If p~, then p is a formula. 
- If p and q are formulas, then (-p), 
(p v q) are formulas. 
- If m is a unary temporal operator and p is 
a formula, then (m p) is a formula. 
- If m is a binary temporal operator and p 
and q are formulas, then (p m q) is a 
formula. 
Parentheses will occasionally be omitted, and &, 
-->, 4--> used as abbreviations. (In the next 
section: "Ax" should be read as the universal 
quantifier over the variable x, "Ex" as the 
existential quantifier over x.) 
B. Semantics 
A temporal structure T is a triple (S,~, R) 
where, 
- S is a set of states. 
-~'~:(S -+ 2 ~) is an assignment of atomic 
propositions to states. 
- R C (S x S) is an accessibility relation 
on--S. Each state is required to have at 
least one successor and exactly one 
predecessor -- i.e., As (Et (sRt) & E!t 
(tRs)). 
Define b to be an s-branch 
b = (..., S_l , S=So, Sl, ...) such that siRsi+ 1. 
The relation ">" is the transitive closure of 
R. 
The satisfaction of a formula p at a state s 
in a structure T, <T,s> I = p, is defined as 
follows : 
<T,s>I = p iff pG~s), for p~ 
<T,s>l = -p iff not <T,s>i=p 
<T,s>l = p v q Iff <T,s>J=p or <T,s>l=q 
39 
<T,s>L = AGp iff AbAt((t~b & t>s) -9 <T,t>l=p) 
(p is true at every time of every future) 
<T,s>\[= AFp Iff AbEt(tfb & t>s & <T,t>\[=p) 
(p is true at some time of every future) 
<T,s>i = pAUq iff 
AbEt(tf"b & t>s & <T,t>i=q & 
At'((t'~b & s<t'<t) -9 <T,t'>l=p))) 
(q is true at some--time of every future and until 
q is true p is true) 
<T,s>I= AXp i ff At(sRt --> <T,t>I=p) 
(p is true at every immediate future) 
<T,s>l= EGp iff EbAt((tSb & t>s) -9 <T,t>l=p) 
(p is true at every time of some future) 
<T,s>l= EFp iff EbEt(tfb & t>s & <T,t>{=p) 
(p fs true at some time of some future) 
<T,s>1 = EXp iff Et(sRt & <T,t>l=p) 
(p is true at some immediate future) 
<T,s>I = pEUq iff 
EbEt(teb & t>s & <T,t>I=q & 
At'((t'eb & s<t'<t) --> <T,t'>I=p))) 
(q is true at some time of some future and in that 
future until q is true p is true) 
<T,s>~= Hp iff AbAt((tfb & t<s) -~ <T,t>l=p) 
(p is true at every time of the past) 
<T,s>l= Pp iff AbEt(t~b & t<s & <T,t>I=p) 
(p is true at some time of The past) 
<T,s>J= Lp iff A=(tRs --> <T,t>l=p) 
(p is true at the immediate past) 
<T,s>I= pSq iff 
AbEt(tGb & t<s & <T,t>I=q & 
At'((t'~b & s>t'>t) -9 <T,t'>l=p))) 
(q is true at some time of the past and since q is 
true p is true) 
A formula p is valid iff for every structure 
T and every state s in T, <T,s> I= p. 
III MODELLING CHANGE IN KNOWLEDGE BASES 
As noted earlier, this logic was developed to 
reason about change in data bases. Although 
ultlmately the application requires extension to a 
flrst-order language to better express varlabillty 
within a state, for now we are restricted to the 
propositional case. Such an extenslon is not 
wfthout problems, but should be manageable. 
The set of propositional variables for 
modelling change in data bases is divided into two 
classes. A state proposition asserts the truth of 
some atomic condition. An event proposition 
associates the occurence of an event with the 
state in which it occurs. The idea is to impose 
constraints on the occurence of events and then 
derive the appropriate state description. To be 
specfic, let Osl...Qsn be state propositions and 
Qel...Oem be event propos~tlons. If PHI is a 
boolean formula of state propositions, then 
formulas of the form: 
(PHI -9 EX Qei) are event constraints. To derive 
state descriptions from events frame axioms are 
required: 
(Qei -9 ((L PHIl) -9 PHI2)), 
where PHIl and PHI2 are boolean ~ormulas of state 
propositions. In the blocks world, and event 
constraint would be that If block A was clear and 
block B was clear then move A onto B is a next 
possible event: 
((cleartop(A) & cleartop(B)) -9 EX move(A,B)). 
Two frame axioms are: 
(move(A,B) -9 on(A,B)) and 
(move(A,B) --> ((L on(C,D)) -9 on(C,D))). 
If the modelling strategy was left as just 
outlined, nothing very significant would have been 
accomplished. Indeed, a simpler strategy would be 
hard to imagine, other than requiring that the 
state formulas be a complete description. This can 
be improved in two non-trivial ways. The first is 
that the conditions on the transitions may 
reference states earlier than the last one. 
~econdly, we may require that certain conditions 
might or must eventually happen, but'not 
necessarily next. As mentioned earller, these 
capabilities are important consideratlons for us. 
By placing biconditionals on the event 
constraints, it can be determined that some 
condition may never arise, or from knowledge of 
some event a reconstruction of the previous state 
may be obtained. 
The form of the frame axioms may be inverted 
using the until operator to obtain a form that is 
perhaps more intuitive. As specified above the 
form of the frame axioms will yield identical 
previous and next state propositions for those 
events that have no effect on them. The standard 
example from the blocks world is that moving a 
block does not alter the color of the block. If 
there are a lot uf events llke move that don't 
change block color, there will be a lot of frame 
axioms around stating that the events don't change 
the block color. But if there is only one event, 
say paint, that changes the color of the block, 
the "every until" (AU) operator can be used to 
state that the color of the block stays the same 
unti\] it is painted. This strategy works best if 
we maintain a single event condition for each 
state; i.e, no more than a single event can occur 
In each state. For each application, a decision 
must be made as to how to best represent the frame 
axioms. Of course, if the world is very 
complicated, there will be a lot of complicated 
frame axioms. I see no easy way around this 
problem in this logic. 
40 
A. Completion of History T-reg ~--> (AX T-add) 
As previously mentioned, we assume that the 
past is determined (i.e. backwards linear). 
However this does not imply that our knowledge of 
the past is complete. Since in some cases we may 
wish to claim complete knowledge with respect to 
one or more predicates in the past, a completion 
axiom is developed for an intuitively natural 
conception of history. Examples of predicates for 
which our knowledge might be complete are 
presidential inaugurations, employees of a 
company, and courses taken by someone in college. 
In a first order theory, T, the completion 
axiom with respect to the predicate Q where 
(Q cl)...(Q cn) are the only occurences of Q in T 
is: 
Ax((Q x) ~-~ x=cl v...v x=cn). From right to left 
on the bicondltional this just says what the 
orginal theory T did, that Q is true of cl...cn. 
The completion occurs from left to right, 
asserting that cl...cn are the only constants for 
which Q holds. Thus for some c' which is not equal 
to any of cl...cn, it is provable in the completed 
theory that ~(Q c'), which was not provable in the 
original theory T. This axiom captures our 
intuitive notions about Q. 2 The completion axiom 
for temporal logic is developed by introducing 
time propositions. The idea is that a conjunct of 
a time proposition, T, and some other proposition, 
Q, denotes that Q is true at time T. If time 
propositions are linearly ordered, and Q occurs 
only in the form 
P(Q & TI) &...& P(Q & Tn) in some theory M, then 
the h~story completion axiom for M with respect to 
Q is 
H(Q 4--> T1 v...v Tn). Analogous to the first- 
order completion axiom, the direction from left to 
right is the completion of Q. An equivalent first- 
order theory to M in which each temporal 
proposition Ti is a first-order constant tl and Q 
is a monadic predicate, 
(Q tl) &...& (Q tn), has the flrst-order 
completion axiom (with Q restricted to time 
constants of the past, where tO is now): 
Ax<t0 ((Q x) ~-+ x=tl v...v x=tn). 
B. Example 
The propositional variables T-reg, T-add, T- 
drop, T-enroll, and T-break are time points 
intended to denote periods in the academic semster 
on which certain activities regarding enrollment 
for courses is dependent. The event proposition 
are Qe-reg, Qe-pass, Qe-fail, and Qe-drop; for 
registering for a course, passing a course, 
failing a course, and dropping a couirse, 
respectively. The only state is Qs-reg, which 
means that a student is registered for a course. 
2\[Clark 781 contains a general discussion of 
predicate completion. \[Reiter 82\] discusses the 
completion axiom with respect to circumscription. 
T-add ~--> (AX T-drop) - drop follows add 
T-drop ~-~ (AX T-enroll) - enroll follows drop 
T-enroll (-~ (AX T-break) - break follows enroll 
((T-reg v T-add) & ~Qs-reg & -(P Qe-pass)) ~-~ 
(EX Qe-reg) - if the period is reg or add and 
a student is not registered and has not 
passed the course then the student may next 
register for the course 
((T-add v T-drop) & Qs-reg) ~-) (EX Qe-drop) - if 
the period is add or drop and a student is 
registered for a course then the student may 
next drop the course 
(T-enroll & Qs-reg) ~-+ (EX Qe-pass)) - if the 
period is enroll and a student is registered 
for a course then the student may next pass 
the course 
(T-enroll & Qs-reg) ~-~ (EX Qe-fail)) - if the 
period is enroll and a student is registered 
for a course then the student may next fail 
the course 
Qe-reg -+ (Os-reg AU (Qe-pass v Qe-fail v 
Qe-drop)) - if a student registers for a 
course then eventually the student will pass 
or fall or drop the course and until then the 
student will be registered for the course 
((L -Qs-reg) & -Qe-reg) --> -Qs-reg) - not 
registering maintains not being registered 
AX(Qe-reg & Qe-pass & Qe-fail & Qe-drop & Qe-null) 
- one of these events must next happen 
-(Qe-i & Qe-j), for -l=j (e.g. -(Qe-reg & Qe- 
pass)) - but only one 
IV COUNTERHISTORICALS 
A counterhistorlcal may be thought of as a 
special case of a counterfactual, where rather 
than asking the counterfactual, "If kangaroos did 
not have tails would they topple over?", one asks 
instead "Could I have taken CSEII0 last 
semester?". That is, counterfac=uals suppose that 
the present state of affairs is slightly different 
and then question the consequences. 
Counterhlstorlcals, on the other hand, question 
how a course of events might have proceeded 
otherwise. If we picture the underlying temporal 
structure, we See that althouKh there are no 
branches into the past, there are branches from 
the past into the future. These are alternative 
histories to the one we are actually in. 
Counterhlstoricals explore these alternate 
41 
histories. 
Intuitively, a counterhistorlcal may be 
evaluated by "rolling back" to some previous state 
and then reasoning forward, dlsregarding any 
events that actually took place after that state, 
to determine whether the speclfied condition might 
arise. For the question, "Could I have registered 
for CSEII0 last semester?", we access the state 
specified by last semester, and from that state 
description, reason forward regarding the 
possibility of registering for CSEII0. 
However, a counterhistorlcal is really only 
interesting if there is some way in which the 
course of events is constrained. These constraints 
may be legal, physical, moral, bureaucratic, or a 
whole host of others. The set of axioms in the 
previous section is one example. The formalism 
does not provide any facility to dlstinquish 
between various sorts of constraints. Thus the 
mortal inevitability that everyone eventually dies 
is given the same importance as a university rule 
that you can't take the same course twice. 
In the logic, the general counterhistorical 
has the form: P(EFp). That is, is there some time 
in the past at which there is a future time when p 
might possibly be true. Constraints may be placed 
on the prior time: 
P(q & EFp), e.g. "When I was a sophomore, could I 
have taken Phil 6?". One might wish to require 
that some other condition still be accessible: 
P(EF(p & EFq)), e.g. "Could I have taken CSE220 
and then CSEII0?"; or that the counterhistorical 
be immediate from the most recent state: 
L(EXp). (The latter is interesting in what it has 
to say about possible alternatives to -- or the 
inevitability of -- what is the case now. \[WM 831 
shows its use in recognizing and correcting event- 
related misconceptions.) For example, in the 
registration domain if we know that someone has 
passed a course then we can derive from the axioms 
above the counterhistorical that they could have 
not passed: 
((P Qe-pass) -+ P(EF-Qe-pass). 
V FUTURITIES 
A query regarding future possibility has the 
general logical form: EFp. That is, is there some 
future time in which p is true. The basic 
variations are: AFp, must p eventually be true; 
EGp, can p remain true; AGp, must p remain true. 
These can be nested to produce infinite variation. 
However, answering direct questions about future 
possibility is not the only use to be made of 
futurities. In addition, futurities permit the 
query system to competently offer monitors as 
responses to questions. (A monitor watches for 
some specified condition to arise and then 
performs some action, usually notification that 
the condition has occurred.) A monitor can only be 
offered competently if it can be shown that the 
condition might possibly arise, given the present 
state of the data base. Note that if any of the 
stronger forms of future possibility can be 
derived it would be desirable to provide 
information to that effect. 
For example, if a student is not registered 
for a course and has not passed the course and the 
time wasprior to enrollment, a monitor for the 
student registering would be competently made 
given some question about registration, since 
((~Qs-reg & -(P Qe-pass) & ~X(AF Te)) -+ 
(EF Qe-reg)). However, if the student had 
previously passed the course, the monitor offer 
would not be competent, since 
((-Qs-reg & (P Qe-pass) & AX(AF Te)) -+ 
-(EF Qe-reg)). 
Note that if a monitor was explicity 
requested, "Let me know when p happens," a 
futurity may be used to determine whether p might 
ever happen. In addition to the processing 
efficiency gained by discarding monitors that can 
never be satisfied, one is also in a position to 
correct a user's mistaken belief that p might ever 
happen, since in order to make such a request s/he 
must believe p could happen. Corrections of this 
sort arise from Intensional failures of 
presumptions in the sense of \[Mays gOl and \[WM 
8~I. If at some future time from the monitor 
request, due to some intervening events p can no 
longer happen, but was originally possible, an 
extensional failure of the presumption (in the 
sense of \[Kaplan 82\]) might be said to have 
occurred. 
The application of the constraints when 
attempting to determine the validity of an update 
to the data base is important to the determination 
of monitor competence. The approach we have 
adopted is to require that when some formula p is 
considered as a potential addition to the data 
base that it be provable that EXp. Alternatively 
one could just require that the update not be 
inconsistent, that is not provable chat .~X~p. The 
former approach is preferred since it does not 
make any requirement on decidability. Thus, in 
order to say that a monitor for some condition p 
\[s competent, it must be provable that EFp. 
VI DISCUSSION 
This work has been influenced most strongly 
by work within theory of computation on proving 
program correctness (IBMP 811 and \[GPSS 801) and 
within philosophy on temporal logic \[RU 711..The 
work within AI that is most relevant is that of 
\[McDermott 821. Two of McDermott's major points 
are regarding the openess of the future and the 
continuity of time. With the first of these we are 
in agreement, but on the second we differ. This 
difference is largely due to the intended 
application of the logic. Ours is applied to 
changes in data base states (which are discrete), 
whereas McDermott's is physical systems (which are 
continuous). But even within the domain of 
physical systems it may be worthwhile to consider 
discrete structures as a tool for abstraction, for 
42 
which computational methods may prove to be more 
tractable. At least by considering modal temporal 
logics we may be able to gain some insight into 
the reasoning process whether over discrete or 
continuous structures. 
We have not made at serlous effort towards 
implementation thus far. A tableau based theorem 
prover has been implemented for the future 
fragment based on the procedure given in \[BMP 81\]. 
It is able to do problems about one-half the size 
of the example given here. Based on this limited 
experience we have a few Ideas which might improve 
its abilities. Another procedure based on the 
tableau method which is based on ideas from \[BMP 
81\] and \[RU 71\] has been developed but we are not 
sufficiently confident In its correctness to 
present ft at this point. 
ACKNOWLEDGEMENTS 
I have substantially benefited from comments, 
suggestions, and discussions wlth Aravlnd Joshi, 
Sltaram Lanka, Kathy McCoy, Gopalan Nadathur, 
David Silverman, Bonnie Webber, and Scott 
Weinstein. 
Reasoning About Processes and Plans," 
Cognitive Science (6), I982. 
\[Moore 82\] R.C. Moore, "The Role of Logic in 
Knowledge Representation and Commensense 
Reasoning," Proceedings of AAAI 82, 
Pittsburgh, Pa., August 1982. 
\[RU 711N. Rescher and A. Urquhart, Temporal 
Logic, Sprlnger-Verlag, New York, 1971. 
\[Relter 82\] R. Relter, "Circumscription Implies 
Predicate Completion (Sometimes)," 
Proceedings of AAAI 82, Pittsburgh, Pa., 
August \[982. 
\[WJMM 83\] B. Webber, A. Joshi, E. Mays, 
K. McKeown, "Extended Natural Language Data 
Base Interactions," International Journal of 
Computers and Mathematics, Spring 83. 
\[W'M 83\] B. Webber and E. Mays, "Varieties of User 
Misconception: Detection and Correction", 
Proceedings of IJCAI 83. 
REFERENCES 
\[BMP 81\] M. Ben-Ari, Z. Manna, A. Pneuli, "The 
Temporal Logic of Branching Time," Eighth ACM 
Symposium on Principles of Programming 
Languages, Williamsburg, Va., January \[981. 
\[Clark 78\] K.L. Clark, "Negation as Failure," in 
Logic and Data Bases, H. Gallalre and 
J. Minker (eds.), Plenum, New York. 
\[GPSS 80\] D. Gabbay, A. Pneull, S. Shelah, 
J. Stavl, "On the Temporal Analysis of 
Fairness, Seventh ACM Symposium on Principles 
of Programming Languages, 1980. 
\[Kamp 68\] J.A.W. Kamp, Tense Logic and the Theory 
of Linear Order, PhD Thesis, UCLA, |968. 
\[Kaplan 82\] S.J. Kaplan, "Cooperative Responses 
from a Portable Natural Language Query 
System," Artificial Intelligence (19, 2), 
October 1982. 
\[Mays 80\] E. Mays, "Failures in Natural Language 
Systems: Appllcations to Data Base Query 
Systems," Proceedings of AAAI 80, Stanford, 
Ca., August \[980. 
\[Mays 82\] E. Mays, "Monitors as Responses to 
Questions: Determining Competence," 
Proceedings of AAAI 82, Pittsburgh, Pa., 
August 1982. 
\[McDermott 82\] D. McDermott, "A Temporal Loglc for 
43 
