Generalized Bundled Fragments for First-Order Modal Logic

When we bundle quantifiers and modalities together (as in ∃ x □ , ♢ ∀ x etc.) in first-order modal logic (FOML), we get new logical operators whose combinations produce interesting bundled fragments of FOML. It is well-known that finding decidable fragments of FOML is hard, but existing work shows that certain bundled fragments are decidable [14], without any restriction on the arity of predicates, the number of variables


Introduction
While propositional modal logic (ML) has had extensive applications in system verification and artificial intelligence, and first-order logic (FOL) in finite model theory and database theory, first-order modal logic (FOML) has been studied much less, as it seems to combine the worst of both computationally, leading to undecidability.FOML is a natural specification language for state transition systems where states are given by first-order descriptions of computational domains, with applicability in the realm of database updates, in the control of infinite-state systems, networks with unbounded parallelism and cryptographic protocols.This motivates the study of decidable fragments of FOML.

70:2
Generalized Bundled Fragments for FOML This is a challenge, since even the two-variable fragment of FOML with one unary predicate is undecidable over almost all useful model classes [15].This situation is to be contrasted against the robust decidability of propositional modal logics ( [16,1,7]), and the many decidable fragments of first-order logic ( [4]).
Despite such discouragement, there have been a few successful attempts: for instance, the monodic restriction, mandating only one free variable in the scope of any modal subformula, yields decidability when combined with a decidable fragment of FOL ( [8,19]).This idea, arising originally from description logics (cf.[9]) has led to applications in temporal and epistemic logics ( [6], [10], [2,3]).
Rather than placing a restriction on variables, or on quantification scope as in the case of guarded fragments [1], Wang ([17]) suggested a fragment in which the existential quantifier and the box modality were always bundled together to appear as a single quantifier-modality pair (∃x□).The resulting fragment of FOML enjoys many attractive properties: finite tree model property, PSpace decision procedure and a simple axiom system, without any restriction on predicates or the occurrences of variables.The new operator ∃x□ captures the logical structure of various knowing-wh expressions such as knowing what, knowing how, knowing why, and so on (cf.[18]), e.g., knowing how to achieve φ can be rendered as there is a plan x such that the agent knows that x can be executed and will guarantee φ.
In [14], we took the next step by considering not only the combination ∃x□ but also its companion ∀x□: the logic with both of these combinations continued to be decidable (over increasing domain models).Such modal-quantifier combinations were thus called bundled fragments of FOML.Over models where the domain remains the same in all states, the fragment with both ∃x□ and ∀x□ is undecidable, while the ∃x□-fragment is still decidable.
Clearly, we can define more bundles such as □∀x, □∃x, etc., and indeed further combinations such as ∀x∀y□, and combinations thereof.These (generalized) bundled fragments offer us many interesting possibilities for system specification: ¬∃x□ (x < c): No element is guaranteed to be bounded by constant c (after update).

∃x□ □∃y (x > y):
There is an element that dominates some element after every update.
□∃x □∀y (x ≤ y): All updates admit a local minimum.∃x□ (∃y□ (x > y) ∧ ∃y□ (x < y)): There is an element that dominates another no matter the update and is dominated by another no matter the update.
Computationally this raises the natural question of what is the most general bundled fragment that is decidable.This is the project taken up in this paper.We consider all possible combinations of the bundled formulas and classify their decidability status.The classification is described in Table 1.We provide a trichotomy: decidable fragments, undecidable fragments and fragments that do not have a finite model property (but where decidability is open).
Towards proving the trichotomy, we first define the notion of loosely bundled fragment which subsumes many decidable bundled fragments of FOML and prove its decidability via a tableau method.We also prove the decidability of another combination of bundled operators where we allow only formulas of the form ∀x□ + □∀x + □∃x (but is not included in the loosely bundled fragment).This requires us to introduce a new proof technique that helps us switch quantifiers in a specific context.
Due to space restrictions, we present only the main ideas and proof techniques of the decidable fragments over increasing domain models in the paper.The proof details, as well as undecidability and lack of finite model property for the other fragments can be found in the detailed technical report in the arXiv [13].
Table 1 Satisfiability problem classification for combinations of bundled fragments over increasing domain models.A " * " means no matter the corresponding bundle is included or not.

Syntax and Semantics
The syntax of first-order modal logic is given by extending the first-order logic with modal operators.Note that we exclude equality, constants and function symbols from the syntax.
▶ Definition 1 (FOML syntax).Given a countable set of predicates P and a countable set of variables Var, the syntax of FOML is given by: where P ∈ P has arity n and x, x 1 , . . ., x n ∈ Var.
The boolean connectives ∨, →, ↔, and the modal operator ♢ which is the dual of □, and the quantifier ∀ are all defined in the standard way.The notion of free variables, denoted by FV(α) is similar to what we have for first-order logic with FV(□α) = FV(α).We write α(x) to mean that x occurs as a free variable of α.Also, α[y/x] denotes the formula obtained from α by replacing every free occurrence of x by y.
▶ Definition 2 (FOML structure).An increasing domain model for FOML is a tuple M = (W, D, δ, R, ρ) where W is a non-empty countable set called worlds; The monotonicity condition requiring δ(w) ⊆ δ(v) for (w, v) ∈ R is required for evaluating the free variables present in the formula [11].Because of this, the models are called increasing domain models.
For a given model M we denote W M , R M etc to indicate the corresponding components.We simply use W, R, δ etc when M is clear from the context.

Generalized Bundled Fragments for FOML
To evaluate formulas, we need an assignment function for variables.For a given model M, an assignment function σ : Var → D is relevant at w ∈ W if σ(x) ∈ δ(w) for all x ∈ Var.
▶ Definition 3 (FOML semantics).Given an FOML model M = (W, D, δ, R, ρ) and w ∈ W, and σ relevant at w, for all FOML formulas α define M, w, σ |= α inductively as follows: A formula α is satisfiable if there is some FOML structure M and w ∈ W and some assignment σ relevant at w such that M, w, σ |= α.In the sequel, we will only talk about the relevant σ for a given pointed model.Also, while evaluating α, it is enough to consider σ to be a partial function that gives an interpretation for the free variables of α.A formula α is valid if ¬α is not satisfiable.

Bundled fragments
The motivation for "bundling" is to restrict the occurrences of quantifiers using modalities.For instance, allowing only formulas of the form ∀x□α is one such bundling.We could also have ♢∃yα.Thus, there are many ways to "bundle" the quantifiers and modalities.We call these the "bundled operators/modalities".The following syntax defines all possible bundled operators of one quantifier and one modality: ▶ Definition 4 (Bundled-FOML syntax).The bundled fragment of FOML is the set of all formulas constructed by the following syntax: Note that the duals of the bundled operators give us the formulas of the form ∀x♢α, ∃x♢α, ♢∀xα, ♢∃xα.Also, note that □α can be defined using any one of the bundled operators where the quantifier is applied to a variable that does not occur in α.However, we retain □α in the syntax for technical convenience.
The following constant domain models may help to get familiar with bundles.
Let D M1 = {a, b}, D M2 = D M3 = {c}.□∃xP x holds at w 1 and w 3 but not at w 2 ; ∃x□P x holds only at w 3 ; ¬∀x□P x holds at w 1 and w 2 ; ¬□∀x¬P x holds at all the w i .
We denote ∀□-fragment to be the language that allows only atomic formulas, negation, conjunction, □α and ∀x□α (dually ∃x♢α) formulas, similarly for ∃□-fragment and so on.In general, these fragments are not equally expressive, e.g., as shown by [17], the ∃□-fragment cannot express □∃, ∀□ and □∀ bundles over models with increasing (or constant) domains.
In [14,12] we proved that the ∀□+∃□ and □∀+□∃ fragments are decidable over increasing domain models, while ∀□-fragment and □∀-fragment are undecidable over constant domain models.Since simple bundles become undecidable over constant domain models, in this paper we focus on generalized bundles over increasing domain models.

70:5
Note that we can have more general bundled operators of the form ∀x∀y□α etc.This naturally raises the question of what is the most general fragment of this form that is decidable.Towards this, we define a general fragment that subsumes all known decidable bundled fragments so far.

The Loosely Bundled Fragment
Note that a bundled formula of the form ∃x□α imposes a restriction that there is exactly one modal formula in the scope of ∃x.But this is a strong requirement.We weaken this condition to allow formulas of the form ∃xβ where β is a boolean combination of atomic formulas and modal formulas.Moreover, we can allow a quantifier alternation of the form As we will see, the fact that the existential quantifiers are outside the scope of universal quantifiers can help us to obtain decidability results over increasing domain models.
Let LBF be the set of all formulas that can be obtained from the grammar of α above.Note that the syntax does not allow a quantifier alternation of the form ∀x∃y α.Also, inside the scope of quantifier prefix ∃ * ∀ * , we can only have boolean combinations of atomic and modal formulas.The ∃ * ∀ * fragment in FO, (Bernays-Schönfinkel-Ramsey class) has a similar quantifier prefix structure but is different in spirit since there is no modality.
The loosely bundled fragment subsumes some of the combinations of bundled fragments.Hence proving the decidability for LBF implies the decidability for these combinations as well.
Note that many combinations of bundled operators (for instance □∀ + ∃□) do not form a subfragment of LBF.

Tableau Procedure
Note that the formulas of LBF are in negation normal form (where ¬ appears only in front of atomic formulas).We first define some useful terms and notations.
Intuitively, C(φ) is the set of all subformulas of φ that are "to be evaluated" at the current world.An Existential-safe formula φ does not need any witness from the current local domain in order to make the formula true.The notions of components and existential-safeness will play a role in the tableau-based decision procedure to be introduced below.
Before going into the specific tableau rules, we first explain the general method.A tableau is a tree-like structure generated from a single formula α by repeatedly applying a few rules with some auxiliary information as the root of the tree.Intuitively, a tableau for α is a pseudo model which can be transformed into a real model of α under some simple consistency conditions.We can then decide the satisfiability of a formula by trying to find a proper tableau.As in [17], a tableau T in our setting is a tree structure such that each node is a triple (w, Γ, σ) where w is a symbol or a finite sequence of symbols intended as the name of a possible world in the real model, Γ is a finite set of FOML-formulas, and σ is an assignment function for variables.Since we intend to use the set of variables as the domain in the tableau-induced real model, σ is simply a partial identity function on Var, i.e., σ(x) = x for all x ∈ Dom(σ) ⊆ Var, where the domain of σ, Dom(σ), is intended to be the local domain of the real model.The intended meaning of the node (w, Γ, σ) is that all the formulas in Γ are satisfied on w with the assignment σ, thus we also write (w : Γ, σ) for the triple.
A tableau rule specifies how the node in the premise of the rule is transformed to or connected with one or more new nodes given by the conclusion of the rule.Applying the rules can generate a tree-like structure, a tableau, which is saturated if every leaf node contains only literals.For any formula α, we refer to a saturated tableau of α simply as a tableau of α.Further, a saturated tableau is open if in every node (w : Γ, σ) of the tableau, Γ does not contain both β and ¬β for any formula β. 2We call a formula clean if no variable occurs both bound and free in it and every use of a quantifier quantifies a distinct variable.A finite set of formulas Γ is clean if Γ, the conjunction of all formulas in Γ, is clean.Note that every FOML-formula can be rewritten into an equivalent clean formula.For instance, the formulas ∃x□P x∨∀x♢Qx and P x∧□∃xQx are not clean, whereas ∃x□P x ∨ ∀y♢Qy and P x ∧ □∃yQy are their clean equivalents respectively.Clean formulas help in handling the witnesses for existential formulas in the tableau in a syntactic way.
Consider a finite set of formulas Γ that is clean.Suppose we want to expand Γ to Γ ∪ {α 1 , . . .α k }, then even if each of α i is clean, it is possible that a bound variable of α i also occurs in some φ ∈ Γ or another α j .To avoid this, first, we rewrite the bound variables in each α i one by one by using the fresh variables that do not occur in Γ and other previously rewritten α j .
Such a rewriting can be fixed by always using the first fresh variable in a fixed enumeration of all the variables.When Γ and {α 1 , . . .α k } are clear from the context, we denote α * i to be such a fixed rewriting of α i into a clean formula.It is not hard to see that the resulting finite set Γ ∪ {α * 1 , . . .α * k } is clean.

Tableaux for LBF
The tableau rules for the LBF fragment are described in Fig. 1.The (∧) and (∨) rules are standard, where we make a non-deterministic choice of one of the branches for (∨).The rule (END) says that if we are left with only modules and there are no ♢ formulas, then the branch does not need to be explored further.The (♢) rule creates one successor world for every ♢ formula at the current node and includes all the □ formulas that need to be where satisfied along with the ♢ formula and σ is inherited in the successor worlds to preserve the increasing domain property.The (∃) rule picks x itself as the witness to satisfy ∃xφ and (∀) rule expands the set of formulas to include a clean version of φ[z/y] for every variable z in the current local domain.
Note that only the (♢) rule can change (the name of) the possible world, thus creating a new successor.It simply extends the name w by new symbols v i for each successor.Therefore there can be many nodes in the tableau sharing the same world name but such nodes form a path.Given w we use t w to denote the last node sharing the first component w.Given a node t = (w : Γ, σ) in a tableau, we use Dom(t) to denote the domain of σ.
Also, there is an implicit ordering on how the rules are applied: (♢) rule can be applied at a node (w, Γ, σ) only if all formulas of Γ are modules and hence may be applied only after the (∧, ∨, ∀, ∃) rules have been applied as many times as necessary at w. Similarly (∀) rule can be applied only when Γ is Existential-safe which means that the (∃) rule cannot be applied anymore at the current node.
▶ Proposition 8.For every tableau T and every node v = (w, Γ, σ) in T , if v is a leaf then either Γ contains only literals or there is some rule that can be applied at v.
The proposition is true since the LBF ensures that if Γ is not Existential-safe and the (∧, ∨, ♢, END) rules cannot be applied, then it has to be the case that there is some ∃xφ ∈ Γ, for which we can apply the (∃) rule.
▶ Theorem 9.For any clean LBF formula θ, let σ r be an identity mapping over FV(θ) ∪ {z} where z does not occur in θ.There is an open tableau T with root (r : {θ}, σ r ) iff θ is satisfiable in an increasing domain model.
Proof.First, we claim that the rules preserve the cleanliness of the formulas.To see this, we verify that for every rule, if Γ in the antecedent of the rule is clean, then the Γ ′ obtained after the application of the rules is also clean.This is obvious for (∧), (∨), (♢) and (END) rules.The (∃) rule preserves cleanliness because it frees variable x which is not bound by any other quantifier in the antecedent.The (∀) rule preserves cleanliness by rewriting.Claim.For every node (w : Γ, σ) in T and for every LBF formula φ, if φ ∈ Γ then M, w, σ |= φ.
The claim is proved using a standard argument by induction on the height of the nodes of T from the leaves to the root (details in [13]).Thus, from the claim it follows that M, r, σ r |= θ since the label of the root of T is (r : {θ}, σ r ).
(⇐) From Proposition 8 it follows that we can always apply some rule until every leaf node (w : Γ, σ) is such that Γ contains only literals.Thus every (partial) tableau can be extended to a saturated tableau.To prove that such a tableau is open, it suffices to show that all rules preserve satisfiability (details in [13]).◀ Note that the depth of the tableau is linear in the size of the formula.However, as we have to rewrite formulas using new variables when applying (∀) rule, the size of the domain is exponential in the size of the formula.Hence, the tableau procedure can be implemented in ExpSpace.▶ Corollary 10.LBF is decidable in ExpSpace.

4
The (Un)decidability Border Note that the fragment LBF cannot express formulas of the form ∀x∃y□ α and also ∀x□∀y□∀zα.There are many combinations of the bundled fragments that can express thesse formulas (like ∃□ + □∀ and ∀□ + ∃□ + □∃ fragments).In fact, we can prove that a bundled fragment is undecidable if we can assert both ∀x∃y□α and ∀x□∀y□∀z α in the fragment.
To prove this, we can use tiling encoding where ∀x∃y□α can be used to assert that every "grid point" x has a horizontal/vertical successor y.In this case, it is important that both quantifiers are applicable over the same local domain and □α in ∀x∃y□α ensures that the witness y acts uniformly across all the descendants.The second formula ∀x□∀y□∀z α is used to verify the "diagonal property" of the grid.In the companion technical report of this paper [13] we prove these results formally.Also, note that there are fragments like ∃□ + □∃ where ∀x∃y□α is expressible but not ∀x□∀y□∀z α.In these cases, we can prove that such fragments do not have a finite model property.This is also proved in the companion technical report [13] where we show that this fragment gives a formula that can induce a linear order on the local domain of some world in the model and assert that this linear order does not have a maximal element.This leaves us with the fragments that cannot express ∀x∃y□α formulas and LBF is one such fragment which we proved to be decidable.The fragments ∀□ + ∃□ and □∀ + □∃ also fall in this category and since they are subfragments of LBF, decidability follows.So we only need to consider the fragment ∀□ + ∃□ + □∀ to complete the terrain (cf.Table .
Note that even though we cannot express formulas of the form ∀x∃y□φ in the fragment, ∀x∃y♢φ is still allowed.For instance, the formula ♢∀x ∃y♢α is in the fragment.Thus, we can have ∀x∃y♢φ but not ∀x∃y□φ.Intuitively this means that the different witnesses y for each x can work on different successor worlds.The fragment cannot enforce the interaction between x and y at all successors.This property can be used to prove that we can reuse the witnesses by creating new successor subtrees as required.
To get the decidability for ∀□ + □∀ + □∃ fragment, the main idea is to prove that the formulas of the form ∀x∃y♢φ can be satisfied by picking some boundedly many witnesses y that will work for all x.This is the same as proving that if ∀x∃y♢φ is satisfiable then ∃y 1 , . . .∃y l ∀x ♢φ[y/y i ] is satisfiable (where l is bounded).We illustrate the proof idea with an example.▶ Example 11.Consider the formula α := ∀x □¬P xx ∧ ∃y♢P xy which is a subformula of the fragment.Let T , r |= α where T is a tree model rooted at r. Now we will modify T to obtain M which is also a tree model rooted at r such that M, r |= ∃y The model M is obtained by extending T in the following way.Let δ T (r) = D r .To obtain M, first we extend the local domain of r by adding a fresh element a.The idea is that for every d ∈ D r (when assigned to x) we will ensure that the new element a can be picked as the y-witness.To achieve this, we do the following: For every d ∈ D r let d ′ ∈ D r and (r, s d ) ∈ R T such that T , s d |= P dd ′ .Let T d be the subtree of T rooted at s d .We will create a new copy of T d and call its root u d .Now, in the new subtree rooted at u d , we make the new element a "behave" like d ′ and we add an edge from r to u d .So, in particular, M will have (r, u d ) ∈ R M such that M, u d |= P da.Since we do this construction for every d ∈ D r we obtain that for all d ∈ D r we have M, r |= ♢P da.Now note that while evaluating α at (M, r) the ∀x quantification will now also apply to a (since a is added to the local domain at r in M).But then, we cannot use a itself as the witness for a since we also need to ensure that M, r |= ∀x□¬P xx.Hence we will add another element b that acts as a witness for a.Further, b also needs a witness.But now we can choose a to be the witness for b since that does not violate the formula ∀x□¬P xx.
So to complete the construction, we pick some arbitrary d ∈ D r for which we have some d ′ ∈ D r and (r, s d ) ∈ R T such that T , s d |= P dd ′ .We create two copies of T d (subtree rooted at s d ) and call their roots as v d and w d respectively.In the subtree rooted at v d we ensure that a and b "behave" like d, d ′ respectively and in the subtree rooted at w d we ensure that a and b "behave" like d ′ , d respectively.In particular, we have M, v d |= P ab and M, w d |= P ba.Finally we add edges from r to v d and from r to w d in M. Note that in principle, it is possible for an ∃ quantified formula to occur in the scope of a ∀ quantifier as a boolean combination with other ∃ quantified formulas and modules.Moreover, these additional formulas can assert some "type" information that may force us to pick additional witnesses.For example, if the formula is ∀x □(¬P xx∧Rx)∨□(¬P xx∧¬Rx) ∧∃y♢ Rx → (P xy ∧¬Ry) ∧ ¬Rx → (P xy ∧Ry) then we need two initial y-witnesses a 1 , a 2 where one is used for witness whose "type" is □(¬P yy ∧ Ry) and other for witness whose "type" is □(¬P yy ∧ ¬Ry) and we also need the corresponding additional witnesses b 1 , b 2 .In general, the formula can force us to pick witnesses of a particular "1-type" which means we might need exponentially many witnesses.
Thus, we need to replace one ∃ inside the scope of ∀ by 2l many ∃ quantifiers outside the scope of ∀ where l is bounded exponentially in the size of the given formulas.We now prove this formally.
For any formula φ if α ∈ C(φ) we denote this by φ[α].This means that α does not occur inside the scope of any modality in φ.Further, for every α ∈ C(φ) and a formula β, we denote φ[β/α] obtained by rewriting φ where every occurrence of α in φ is replaced by β.
In particular, we are interested in the case where α is of the form ∃y♢ψ. Thus we always consider φ [∃y♢ψ].
For every l ≥ 0 if y = y 1 , y ′ 1 . . .y l , y ′ l are fresh variables, we denote y♢ψ to be the formula which is a big disjunction where each disjunct replaces y in ψ with one of y i or y ′ i .Further, we denote φ[y♢ψ/∃y♢ψ] as simply φ[y♢ψ].For instance, for the formula φ := P x ∨ ∃y♢Qxy where ψ := ∃y♢Qxy, for l = 2 and y = y 1 , y ′ 1 , y 2 , y ′ 2 being fresh variables, φ[y♢ψ] is given by: The size of a formula, denoted by |φ|, is the number of symbols occurring in φ and for a finite set of formulas Γ, let |Γ| = φ∈Γ |φ|.
Note that the ∃y quantifier is pulled outside the scope of the ∀x quantifier and replaced with a bounded number of witnesses y 1 , y ′ 1 , y ′ 2 , y ′ 2 . . .y l , y ′ l .Consequently ♢ ψ is replaced with a disjunction each replacing y with one of y i or y ′ i for every i ≤ l.To prove the lemma first we formally define the tree editing operation described in the example.Given a tree model T rooted at r, let d ̸ ∈ D T .To add the new domain element d to a local domain of r, we also need to specify the "type" of the new element d at r and its descendants.Towards this, we pick some domain element c that is already present in δ(r) and assign the type of d to the type of c at every world.Then for all interpretations σ and for all FOML formulas φ and for all w ∈ W we have: The proposition holds since there is no equality in the syntax and at every world in the extended model, the new element d "behaves" like c and the old elements "behave" like themselves (details in [13]).Now we are ready to prove Lemma 12.
For every domain element a ∈ δ T (r) define: Note that Π(r, a) formalizes the notion of "type" of a at the world r.This includes the information of all subformulas that are true at the current world, when a universal variable is instantiated with a. Also, since the size of |C(α)| is at most the size of Γ ′ , the set Π( where ω 1 and ω 2 are defined as follows: For all h ̸ = j, ω and w i be the root of T i 1 and T i 2 respectively.Add the edges from r to v i and from r to w i in M. The two copies of subtrees are intended to provide witnesses for ∃y♢ψ for d j and d ′ j respectively.We need the two copies to ensure that ω 1 and ω 2 are well defined in the case when i = j and a j ̸ = b. We now explain the idea behind the construction.Note that T c 0 rooted at u c is created for every c ∈ δ T (r) such that T , r, σ  To see why the corollary is true, by Lemma 12 we get some l ≤ 2 |Γ ′ | , and we can pad sufficiently many dummy variables to get a strict equality.This gives us a useful tableau rule which we call (∀∃♢) rule for ∀□ + □∀ + □∃ fragment, described in Fig. 2. The full tableau rules for ∀□ + □∀ + □∃ is given by the tableau rules of LBF (Fig. 1) along with the (∀∃♢)-rule.▶ Theorem 16.For any clean ∀□ + □∀ + □∃ formula θ, let σ r be an identity mapping over FV(θ) ∪ {z} where z does not occur in θ.
There is an open tableau with (r : {θ}, σ r ) as the root iff θ is satisfiable in an increasing domain model.
The proof follows along the lines of Theorem 9.The only interesting part of the proof is to show that the (∀∃♢) rule preserves satisfiability and this is by Lemma 12(details in [13]).
Note that at if we start with a formula of length n then the application of (∀∃♢) rule will blow up the formula to size 2 n .So we have a tableau procedure that can be implemented as an algorithm in ExpSpace.

Conclusion
In this paper, we have studied the decidability of bundled fragments of FOML, where we have no restrictions on the use of variables or arity of relations.Specifically, we proved the decidability of the loosely bundled fragment LBF and the ∀□ + □∀ + □∃ fragment.The decidability of these fragments hinges on the observation that ∀x∃y□α is not expressible.A NexpTime lower bound follows for ∀□ + ∃□ and □∀ + □∃ (via encoding the corresponding version of the tiling problem [13]), which implies the same lower bound for LBF and ∀□ + □∀ + □∃.There is a significant gap between the upper and lower complexity bounds and we need sharper technical tools for investigating lower bounds for bundled fragments.Note that the quantifier prefix in LBF is of the form ∃ * ∀ * and hence any extension of this quantifier prefix or extending LBF with negation closure will result in a fragment that will be able to express ∀x∃y□ α (and hence will not have the finite model property, [13]).In this sense, LBF is the largest fragment in which ∀x∃y□α is not (syntactically) expressible.For the fragment ∀□ + □∀ + □∃ we introduced a technique to pull out ∃ quantifiers outside the immediate scope of ∀ and obtain a finite model property.This technique may be useful in studying other fragments of first-order modal logic.
The results in the paper, along with those in [13], provide a trichotomy classification of combinations of bundled operators over increasing domain models (Table 1).The fragments in which we can express both ∀x∃y□α and ∀x□∀y□∀zβ are undecidable, fragments in which we can express the former but not the latter lack finite model property (but decidability is open) and fragments where we cannot express the former are decidable.Similar trichotomy can also be proved for satisfiability over constant domain models [13].
We have considered only the "pure" fragments, without constants, function symbols, or equality.The addition of constants is by itself simple, but equality complicates things considerably.Since equality is extensively used in specifications, mapping fragments with equality is an important direction.The study of bundles over models with various frame conditions is also relevant for applications.Unfortunately, while it is clear that equivalence frames lead to undecidability [17], even with transitive frames the situation is unclear.Obtaining good decidable fragments over linear frames is an important challenge.
In the context of verification of infinite-state systems, we are often more interested in the model checking problem than in satisfiability.If the domain is finite, the problem is no different from model checking of first-order modal logic.However, we are usually interested in the specification being checked against a finitely specified (potentially infinite) model, e.g., when the domain elements form a regular infinite set.This is a direction to be pursued in the context of bundled fragments.
We have presented tableau-based decision procedures that are easily implementable, but inference systems for reasoning in these logics require further study.

M F C S 2 0 2 2 (
⇒): Let T be an open tableau rooted at (r : {θ}, σ r ).Define a model M = (W, D, δ, R, ρ) as follows:W = {w | (w : Γ, σ) is a node in T } D = Var R = {(w, v) | v is of the form wv ′ for some v ′ }For every w ∈ W, define δ(w) = Dom(t w ) where t w is the last node of w in T For every w ∈ W and p ∈ P, define ρ(w, P ) = {x | P x ∈ Γ where t w = (w, Γ, σ)}Clearly, M is an increasing domain model, and since z ∈ Dom(σ r ), there is no empty local domain.As T is an open tableau, ρ is well-defined.
Thus, we have: δ M (r) = δ T (r) ∪ {a, b} and M, r |= ∃y 1 ∃y 2 ∀x □¬P xx ∧ ♢P xy 1 ∨ ♢P xy 2 .With the above construction, this assertion can be verified by assigning y 1 and y 2 to a and b respectively.

▶ Definition 13 .▶ Proposition 14 .
Given a tree model T = (W, D, R, δ, ρ) rooted at r, let d ̸ ∈ D and c ∈ δ(r).Define the operation of "adding d to δ(r) by mimicking c", denoted by T d →c = (W, D ′ , R, δ ′ , ρ ′ ) where: D ′ = D ∪ {d} for all w ∈ W we have δ ′ (w) = δ(w) ∪ {d} For every w ∈ W and predicate P define ρ ′ (w, P ) = {e ′ | there is some e ∈ ρ(w, P ) and e ′ is obtained from e by replacing zero or more occurrences of c in e by d}.Suppose that we want to extend the domain with d = d 1 • • • d n which are fresh.Let ω : d → D ′ where D ′ ⊆ δ T (r) and we want each d i to mimic ω(d i ).Then we denote T ω to be the tree obtained by T d1 →ω(d1) d2 →ω(d2)... dn →ω(dn).Let T = (W, D, R, δ, ρ) be a tree model rooted at r with T d →c being an extended tree where d ̸ ∈ D and c ∈ δ(r).
[13]ed u c where d j mimics c ′ in the subtree rooted at u c .All these together indicate that we can use d j and the subtree rooted at u c in M to verify that M, u c , σ [xy →cdj ] |= ψ.Also note that for all h ̸ = j the fresh elements d h and d ′ h mimic a h in the subtree T c 0 (i.e, we have not added any extra "types").Further, we want the type of d i and d ′ i at r in M to mimic the type of a i at r in T .All type information is taken care of in M 0 where both d i and d ′ i mimic a i except the formula ∃y♢ψ.So if T , r, σ [x →ai] |= ∃y♢ψ then we need a witness to verify M, r, σ [x →di] |= ∃y♢ψ and M, r, σ [x →d ′ i ] |= ∃y♢ψ.If the witness for y for a i is b and Π(r, b) = Λ j then we want d ′ jto be the witness for d i and d j to be the witness for d ′ i .Consequently if s i is the world such that a → s i ∈ R T and T , s i , [xy → a i b] |= ψ then we create two new copies of subtree T i rooted at s i and call it T i 1 and T i 2 .By construction, in particular, the new element d i mimics a i and d ′ j mimics b in T i 1 .Similarly d ′ i mimics a i and d j mimics b in T i 2 .Thus, we can pick d ′ j to be the witness for d i (and consider T i 1 ) and pick d j to be the witness for d ′ i (and consider T i 2 ).Also, it is important to note that for every r → v ∈ R M , if d i mimics c and d ′ i mimics c ′ at v then we will always have Π(r, c) = Π(r, c ′ ) = Λ i = Π(r, a i ).Now it can be verified that M, r, σ |= Γ ∧ ∃y 1 ∃y ′ 1 ...∃y l ∃y ′ l ∀xφ[y♢ψ].The details are provided in[13].