1 Introduction
The ability to rationally change one’s knowledge base in the face of new information which possibly contradicts the currently held beliefs is a basic characteristic of intelligent behaviour. Thus the question of belief revision
is of crucial importance in Artificial Intelligence. In the last twenty years this question has received considerable attention, starting from the work of Alchourrón, Gärdenfors, and Makinson Alchourronea:85a – usually abbreviated to just
AGM – who proposed a set of rationality postulates which any reasonable revision operator should satisfy. A semantic construction of revision operators was later provided by Katsuno and Mendelzon Katsunoea:91a, according to which an agent has in its mind a plausibility ordering – a total preorder – over the set of possible worlds, with the knowledge base associated to this ordering being identified with the set of sentences true in all the most plausible worlds. This approach dates back to the work of Lewis Lewis:73a on counterfactuals. It was introduced into the belief revision literature by Grove Grove:88a and Spohn Spohn:88a. Given a new sentence – or epistemic input – , the revised knowledge base is set as the set of sentences true in all the most plausible worlds in which holds. As was shown by Katsuno and Mendelzon Katsunoea:91a, the family of operators defined by this construction coincides exactly with the family of operators satisfying the AGM postulates. Due to its intuitive appeal, this construction came to be widely used in the area. However, researchers soon began to notice a deficiency with it – although it prescribes how to obtain a new knowledge base, it remains silent on how to obtain a new plausibility ordering which can then serve as a target for the next epistemic input. Thus it is not rich enough to deal adequately with the problem of iterated belief revision. This paper is a contribution to the study of this problem.Most iterated revision schemes are sensitive to the history of belief changes^{1}^{1}1An external revision scheme like that of Areces and Becher Arecesea:2001a and Freund and Lehmann Freundea:94a is not., based on a version of the “most recent is best” argument, where the newest information is of higher priority than anything else in the knowledge base. Arguably the most extreme case of this is Nayak’s lexicographic revision [NayakNayak1994, Nayak, Pagnucco, PeppasNayak et al.2003]. However, there are operators where, once admitted to the knowledge base, it rapidly becomes as much of a candidate for removal as anything else in the set when another, newer, piece of information comes along, Boutilier’s natural revision Boutilier:93a,Boutilier:96a being a case in point. A dual to this is what Rott Rott:2003a terms radical revision where the new information is accepted with maximal, irremediable entrenchment – see also Segerberg Segerberg:98a. Another issue to consider is the problem termed temporal incoherence [RottRott2003]:
the comparative recency of information should translate systematically into comparative importance, strength or entrenchment
In an influential paper Darwiche and Pearl Darwicheea:97a proposed a framework for iterated revision. Their proposal is characterised in terms of sets of syntactic and semantic postulates, but can also be viewed from the perspective of conditional beliefs. It is an extension of the formulation by Katsuno and Mendelzon Katsunoea:91a of AGM revision [Alchourrón, Gärdenfors, MakinsonAlchourrón et al.1985]. To justify their proposal Darwiche and Pearl mount a comprehensive argument. The argument includes a critique of natural revision, which is shown to admit too few changes. In addition, they provide a concrete revision operator which is shown to satisfy their postulates. In many ways this can be seen as the prototypical DarwichePearl operator. It is instructive to observe that the two bestknown operators satisfying the DarwichePearl postulates, natural revision and lexicographic revision, form the opposite extremes of the DarwichePearl framework: Natural revision is the most conservative DarwichePearl operator, in the sense that it effects as few changes as possible, while lexicographic revision is the least conservative.
In this paper we show that the DarwichePearl arguments lead naturally to the acceptance of a smaller class of operators which we refer to as admissible. We provide characterisations of admissible revision, in terms of syntactic as well as semantic postulates. Admissible revision ensures that the penultimate input is not ignored completely. A consequence of this is that natural revision is eliminated. On the other hand, admissible revision includes the prototypical DarwichePearl operator as well as lexicographic revision, the latter result also showing that lexicographic revision is the least conservative of the admissible operators. The removal of natural revision from the scene leaves a gap which is filled by the introduction of a new operator we refer to as restrained revision. It is the most conservative of admissible revision operators, and can thus be seen as an appropriate replacement of natural revision. We give a syntactic and a semantic characterisation of restrained revision, and demonstrate that it satisfies desirable properties. In particular, and unlike lexicographic revision, it ensures that older information is not discarded unnecessarily, and it shows that the problem of temporal incoherence can be dealt with.
Although natural revision does not feature in the class of admissible revision operators, we show that it still has a role to play in iterated revision, provided it is first tempered appropriately. We show that restrained revision can also be viewed as a composite operator, consisting of natural revision preceded by an application of a “backwards revision” operator previously studied by Papini Papini:98b.
The paper is organised as follows. After outlining some notation, we review the DarwichePearl framework in Section 2. This is followed by a discussion of admissible revision in Section 3. In Section 4 we introduce restrained revision, and in Section 5 we show how it can be defined as a composite operator. Section 6 discusses the possibility of enriching epistemic states as a way of determining the appropriate admissible revision operator in a particular context. In this section we also conclude and briefly discuss some future work.
1.1 Notation
We assume a finitely generated propositional language which includes the constants and , is closed under the usual propositional connectives, and is equipped with a classical modeltheoretic semantics. is the set of valuations of and (or ) is the set of models of (or . Classical entailment is denoted by and logical equivalence by . We also use to denote the operation of closure under classical entailment. Greek letters stand for arbitrary sentences. In our examples we sometimes use the lower case letters , , and as propositional atoms, and sequences of 0s and 1s to denote the valuations of the language. For example, denotes the valuation, in a language generated by and , in which is assigned the value 0 and the value 1, while denotes the valuation, in a language generated by , and , in which is assigned the value 0 and both and the value 1. Whenever we use the term knowledge base we will always mean a set of sentences which is deductively closed, i.e., .
2 DarwichePearl Revision
Darwiche and Pearl Darwicheea:97a reformulated the AGM postulates [Alchourrón, Gärdenfors, MakinsonAlchourrón et al.1985] to be compatible with their suggested approach to iterated revision. This necessitated a move from knowledge bases to epistemic states. An epistemic state contains, in addition to a knowledge base, all the information needed for coherent reasoning including, in particular, the strategy for belief revision which the agent wishes to employ at a given time. Darwiche and Pearl consider epistemic states as abstract entities, and do not provide a single formal representation. It is thus possible to talk about two epistemic states and being identical (denoted by ) , but yet syntactically different.^{2}^{2}2Personal communication with Adnan Darwiche. This has to be borne in mind below, particularly when considering postulate (. In Darwiche and Pearl’s reformulated postulates is a belief change operator on epistemic states, not knowledge bases. We denote by ) the knowledge base extracted from an epistemic state .
 (1)

 (2)

 (3)

 (4)

If then
 (5)

If and then
 (6)

iff
 (7)

 (8)

If then
Darwiche and Pearl then show, via a representation result similar to that of Katsuno and Mendelzon Katsunoea:91a, that revision on epistemic states can be represented in terms of plausibility orderings associated with epistemic states.^{3}^{3}3Alternative frameworks for studying iterated revision, both based on using sequences of sentences rather than plausibility orderings, are those of Lehmann Lehmann and Konieczny and PinoPérez KP. More specifically, every epistemic state has associated with it a total preorder on all valuations, with elements lower down in the ordering deemed more plausible. Moreover, for any two epistemic states and which are identical (but may be syntactically different), it has to be the case that . Let denote the minimal models of under . The knowledge base associated with the epistemic state is obtained by considering the minimal models in i.e., . Observe that this means that has to be consistent. This requirement enables us to obtain a unique knowledge base from the total preorder . Preservation of the results in this paper when this requirement is relaxed is possible, but technically messy.
The observant reader will note that our assumption of a consistent is incompatible with a successful revision by . This requires that we jettison (6) and insist on consistent epistemic inputs only. (The lefttoright direction of (6) is rendered superfluous by (1) and the assumption that knowledge bases extracted from all epistemic states have to be consistent.) The other difference between the original AGM postulates and the DarwichePearl reformulation – first inspired by a critical observation by Freund and Lehmann Freundea:94a – occurs in (5), which states that revising by logically equivalent sentences results in epistemic states with identical associated knowledge bases. This is a weakening of the original AGM postulate, phrased in our notation as follows:
 (5)

If and then
(5) states that two epistemic states with identical associated knowledge bases will, after having been revised by equivalent inputs, produce two epistemic states with identical associated knowledge bases. This is stronger than (5) which requires equivalent associated knowledge bases only if the original epistemic states were identical. We shall refer to the reformulated AGM postulates, with (6) removed, as DPAGM.
DPAGM guarantees a unique extracted knowledge base when revision by is performed. It sets equal to and thereby fixes the most plausible valuations in . However, it places no restriction on the rest of the ordering. The purpose of the DarwichePearl framework is to constrain this remaining part of the new ordering. It is done by way of a set of postulates for iterated revision [Darwiche PearlDarwiche Pearl1997]. (Throughout the paper we follow the convention that is left associative.)
 (C1)

If then
 (C2)

If then
 (C3)

If then
 (C4)

If then
The postulate (C1) states that when two pieces of information—one more specific than the other—arrive, the first is made redundant by the second. (C2) says that when two contradictory epistemic inputs arrive, the second one prevails; the second evidence alone yields the same knowledge base. (C3) says that a piece of evidence should be retained after accommodating more recent evidence that entails given the current knowledge base. (C4) simply says that no epistemic input can act as its own defeater. We shall refer to the class of belief revision operators satisfying DPAGM and (C1) to (C4) as DPrevision. The following are the corresponding semantic versions (with ):
 (CR1)

If then iff
 (CR2)

If then iff
 (CR3)

If then only if
 (CR4)

If then only if
(CR1) states that the relative ordering between worlds remain unchanged following an revision, while (CR2) requires the same for worlds. (CR3) requires that, for an world strictly more plausible than a world, this relationship be retained after an revision, and (CR4) requires the same for weak plausibility. Darwiche and Pearl showed that, given DPAGM, a precise correspondence obtains between (C) and (CR) above ().
One of the guiding principles of belief revision is the principle of minimal change: changes to a belief state ought to be kept to a minimum. What is not always clear is what ought to be minimised. In AGM theory the prevailing wisdom is that minimal change refers to the sets of sentences corresponding to knowledge bases. But there are other interpretations. With the move from knowledge bases to epistemic states, minimal change can be defined in terms of the fewest possible changes to the associated plausibility ordering . In what follows we will frequently have the opportunity to refer to the latter interpretation of minimal change. See also the discussion of this principle by Rott dogmas.
3 Admissible Revision
In this section we consider two of the bestknown DPoperators, and propose three postulates to be added to the DarwichePearl framework. The first is more of a correction than a strengthening. We show that the DarwichePearl representation of the principle of the irrelevance of syntax is too weak and suggest an appropriate strengthened postulate. The second is suggested by some of the arguments advanced by Darwiche and Pearl themselves. It eliminates one of the operators they criticise, and is satisfied by the sole operator they provide as an instance of their framework. The addition of these two postulates to the DarwichePearl framework leads to the definition of the class of admissible revision operators. Finally, we point out a problem with Nayak’s wellknown lexicographic revision operator and propose a third postulate to be added. The consequences of insisting on the addition of this third postulate are discussed in detail in Section 4.
As mentioned in Section 2, Darwiche and Pearl replaced the original AGM postulate () with (). Both are attempts at an appropriate formulation of the principle of the irrelevance of syntax, popularised by Dalal Dalal:88a. But whereas () has been shown to be too strong, as shown by Darwiche and Pearl Darwicheea:97a, closer inspection reveals that () is too weak. To be more precise, it fails as an adequate formulation of syntax irrelevance for iterated revision. It specifies that revision by two equivalent sentences should produce epistemic states with identical associated knowledge bases, but does not require that these epistemic states, after another revision by two equivalent sentences, also have to produce epistemic states with identical associated knowledge bases. So, as can be seen from the following example, under DPAGM (and indeed, even if (C1) to (C4) are added) it is possible for to differ from even if is equivalent to and is equivalent to .
Example 1
Consider a propositional language generated by the two atoms and and let be an epistemic state such that . Now consider the two epistemic states and such that , and . Observe that this gives complete descriptions of and . It is tedious, but not difficult, to verify that setting and is compatible with DPAGM. But observe then that , while .
As a consequence of this, we propose that (5) be replaced by the following postulate:
 (5)

If , and then
The semantic equivalent of (5) looks like this:
 (5)

If and then
(5) states that the revision of two identical epistemic states by two equivalent sentences has to result in epistemic states with identical associated total preorders, not just in epistemic states with identical associated knowledge bases.
Proposition 1
(5) and (5) are equivalent, given DPAGM.
Proof:
The proof that (5) follows from (5) is straightfoward. For the converse,
suppose that (5) does not hold; i.e.
and
for some and .
This means
there exist such that but .
Now let be such that . Then ,
but , and so
; a violation of (5).
From this it should already be clear that (5) is a desirable property. This view is bolstered further by observing that all the wellknown iterated revision operators satisfy it; natural revision, the DarwichePearl operator , and Nayak’s lexicographic revision, the first and third of which are to be discussed in detail below. In fact, we conjecture that Darwiche and Pearl’s intention was to replace (5) with (5), not with (5) and propose this as a permanent replacement.
Definition 1
The set of postulates obtained by replacing (5) with (5) in DPAGM is defined as RAGM.
Observe that RAGM, like DPAGM, guarantees that .
Rule (5) is the first of the new postulates we want to add to the DarwichePearl framework. We now lead up to the second. One of the oldest known DPoperators is natural revision, usually credited to Boutilier Boutilier:93a,Boutilier:96a, although the idea can also be found in [SpohnSpohn1988]. Its main feature is the application of the principle of minimal change to epistemic states. It is characterised by DPAGM plus the following postulate:
 (CB)

If then
(CB) requires that, whenever is inconsistent with , revising with will completely ignore the revision by . Its semantic counterpart is as follows:
 (CBR)

For , iff
As shown by Darwiche and Pearl Darwicheea:97a, natural revision minimises changes in conditional beliefs, with being a conditional belief of an epistemic state iff . In fact, Darwiche and Pearl show (Lemma 1, p. 7), that keeping and as similar as possible has the effect of minimising the changes in conditional beliefs to a revision. So, from (CBR) it is clear that natural revision is an application of minimal change to epistemic states. It requires that, barring the changes mandated by DPAGM, the relative ordering of valuations remains unchanged, thus keeping as similar as possible to . In that sense then, natural revision is the most conservative of all DPoperators. Such a strict adherence to minimal change is inadvisable and needs to be tempered appropriately, an issue that will be addressed in Section 5. Darwiche and Pearl have shown that (CB) is too strong, and that natural revision is not all that natural, sometimes yielding counterintuitive results.
Example 2
[Darwiche PearlDarwiche Pearl1997] We encounter a strange animal and it appears to be a bird, so we believe it is one. As it comes closer, we see clearly that the animal is red, so we believe it is a red bird. To remove further doubts we call in a bird expert who examines it and concludes that it is not a bird, but some sort of animal. Should we still believe the animal is red? (CB) tells us we should no longer believe it is red. This can be seen by substituting and in (CB), instructing us to totally ignore the observation as if it had never taken place.
Given Example 2, it is perhaps surprising that Darwiche and Pearl never considered postulate (P) below. In this example, the argument for retaining the belief that the creature is red hinges upon the assumption that being red is not in conflict with the newly obtained information that it is a kind of animal. That is, because learning that the creature is an animal will not automatically disqualify it from being red, it is reasonable to retain the belief that it is red. More generally then, whenever is consistent with a revision by , it should be retained if an revision is inserted just before the revision.
 (P)

If then
Applying (P) to Example 2 we see that, if is consistent with , we have . Put differently, (P) requires that you retain your belief in the animal’s redness, provided this would not have been precluded if the observation about it being red had never occurred. (P) was also proposed independently of the present paper by Jin and Thielscher Jinea:2005a where it is named Independence. The semantic counterpart of (P) looks like this:
 (PR)

For and , if then
(PR) requires an world that is at least as plausible as a world to be strictly more plausible than after an revision. The following result was also proved independently by Jin and Thielscher Jinea:2005a.
Proposition 2
If satisfies DPAGM, then it satisfies (P) iff it also satisfies (PR).
Proof: For (P)(PR), let , , , and let be such that . This means that (since is either equal to or to ), and so, by (P), . And therefore , for if not, we would have that , from which it follows that , and so .
For (P)(PR), suppose that . This means
there is a ; that is, for every .
And this means that . For if not, it means there is an in
. Now, since , it follows from DPAGM
that for every , and so (since
.
But it also follows from DPAGM that , and therefore that , and by (PR) it
then follows that ; a contradiction.
Rule (PR) enforces certain changes in the ordering after receipt of . In fact as soon as there exist an world and a world on the same plausibility level somewhere in (in that both and ), (PR) implies . Furthermore these changes must also occur even when is already believed in to begin with, i.e., . (Although of course if then , i.e., the knowledge base associated to will remain unchanged – this follows from DPAGM.) The rules (P)/(PR) ensure input is believed with a certain minimal strength of belief – enough to help it survive the next revision. The point that being informed of can lead to an increase in the strength of an agent’s belief in , even in cases where the agent already believes to begin with, has been made before, e.g., by Friedman and Halpern [p.405]Friedmanea:99a. Note that (P) has the antecedent of (C4) and the consequent of (C3). In fact, (P) is stronger than (C3) and (C4) combined. This is easily seen from the semantic counterparts of these postulates. It also follows that the only concrete example of an iterated revision operator provided by Darwiche and Pearl, the operator they refer to as and which employs a form of Spohnian conditioning [SpohnSpohn1988], satisfies (PR), and therefore (P) as well. Furthermore, by adopting (P) we explicitly exclude natural revision as a permissible operator. So accepting (P) is a move towards the viewpoint that information obtained before the latest input ought not to be discarded unnecessarily.
Based on the analysis of this section we propose a strengthening of the DarwichePearl framework in which (5) is replaced by (5) and (C3) and (C4) are replaced by (P).
Definition 2
A revision operator is admissible iff it satisfies RAGM, (C1), (C2), and (P).
Inasmuch as the DarwichePearl framework can be visualised as one in which worlds slide “downwards” relative to worlds, admissible revision ensures, via (PR), that this “downwards” slide is a strict one.
We now pave the way for the third postulate we would like to add in this paper to the DarwichePearl framework. To begin with, note that another view of (P) is that it is a significant weakening of the following property, first introduced by Nayak et al. Nayakea:96b:
 (Recalcitrance)

If then
Semantically, (Recalcitrance) corresponds to the following property, as was pointed out by Booth Booth:2005a and implicitly contained in the work of Nayak et al. Nayakea:2003a:
 (R)

For , ,
(Recalcitrance) is a property of the lexicographic revision operator, the second of the wellknown DPoperators we consider, and one that is just as old as natural revision. It was first introduced by Nayak Nayak:93a and has been studied most notably by Nayak et al. Nayak:94b,Nayakea:2003a, although, as with natural revision, the idea actually dates back to Spohn Spohn:88a. In fact, lexicographic revision is characterised by DPAGM (and also RAGM) together with (C1), (C2) and (Recalcitrance), a result that is easily proved from the semantic counterparts of these properties and Nayak et al.’s semantic characterisation of lexicographic revision in Nayakea:2003a. Informally, lexicographic revision takes the assumption of “most recent is best”, on which the Success postulate is based, and adds to it the assumption of temporal coherence. In combination, this leads to the stronger assumption that “more recent is better”.
An analysis of the semantic characterisation of lexicographic revision shows that it is the least conservative of the DPoperators, in the sense that it effects the most changes in the relative ordering of valuations permitted by DPAGM (or RAGM for that matter) and the DarwichePearl postulates. Since it is also an admissible revision operator, it follows that it is also the least conservative admissible operator.
The problem with (Recalcitrance) is that the decision of whether to accept after a subsequent revision by is completely determined by the logical relationship between and – the epistemic state is robbed of all influence. The replacement of (Recalcitrance) by the weaker (P) already gives more influence in the outcome. What we will do shortly is constrain matters further by giving as much influence as allowed by the postulates for admissible revision. Such a move ensures greater sensitivity to the agent’s epistemic record in making further changes.
Note that lexicographic revision assumes that more recent information takes complete precedence over information obtained previously. Thus, when applied to Example 2, it requires us to believe that the animal, previously assumed to be a bird, is indeed red, because is a recent input which does not conflict with the most recently obtained input. While this is a reasonable approach in many circumstances, a dogmatic adherence to it can be problematic, as the following example shows.
Example 3
While holidaying in a wildlife park we observe a creature which is clearly red, but we are too far away to determine whether it is a bird or a land animal. So we adopt the knowledge base . Next to us is a person with knowledge of the local area who declares that, since the creature is red, it is a a bird. We have no reason to doubt him, and so we adopt the belief . Now the creature moves closer and it becomes clear that it is not a bird. The question is, should we continue believing that it is red? Under the circumstances described above we want our initial observation to take precedence, and believe that the animal is red. But lexicographic revision does not allow us to do so.
Other examples along similar lines speaking against a rigid acceptance of (Recalcitrance) are those of Glaister [p.31]Glaister:98a and Jin and Thielscher [p.482]Jinea:2005a.
While (P) allows for the possibility of retaining the belief that the animal is red, it does not enforce this belief. The rest of this section is devoted to the discussion of a property which does so. To help us express this property, we introduce an extra piece of terminology and notation.
Definition 3
and counteract with respect to an epistemic state , written , iff and .
The use of the term counteract to describe this relation is taken from Nayak et al. Nayakea:2003a. means that, from the viewpoint of , and tend to “exclude” each other. We will now discuss a few properties of this relation. First note that depends only on the total preorder obtained from . Indeed we have iff both and . This in turn can be reformulated in the following way, which provides a useful aid to visualise a counteracts relation:
Proposition 3
iff there exist , such that both and for all .
Proof:
First note that, since obviously , may be rewritten as . Using the fact that
is a total preorder, it is easy to see that
this can hold
iff there exists such that for all . In the
same way we may rewrite as , which is then equivalent to saying
there exists such that for all .
In other words, Proposition 3 says iff there exist both an world and a world which are strictly more plausible than the most plausible worlds. Other immediate things to note about are that it is symmetric, and that it is syntaxindependent, i.e., if and then . Furthermore if and are logically inconsistent with each other then , but the converse need not hold (see the short example after the next proposition for confirmation). Thus can be seen as a weak form of inconsistency. The next result gives two more properties of :
Proposition 4
Given RAGM, the following properties hold for :
(i)
If and then
(ii)
If and then
Proof:
(i)
Suppose and . To show we need to show both and . For the former we already have both and from and respectively. Since it follows from RAGM that for any , we
can conclude from this . For the latter we already have both and from
and respectively. And from this we can conclude , again using RAGM (specifically ()).
(ii)
Suppose and . Firstly, if either or then we must have by
RAGM and so as required. So suppose both and . Then, since and , this means we have both and . Since it follows from RAGM that
for any , it
follows from these two that and so also in this case as required.
The first property above says that if counteracts with two sentences separately, then it counteracts with their disjunction, while the second says that it cannot counteract with a disjunction without counteracting with at least one of the disjuncts. Obviously these properties also hold for the binary relation of logical inconsistency. However one departure from the inconsistency relation is that it is possible to have both and
. To see this assume for the moment
is generated by just three propositional atoms and take , and . Then take to be such that its lowest plausibility level contains only the two valuations and , and the next plausibility level only the valuation .We are now ready to introduce our third postulate. It is the following:
 (D)

If then
(D) requires that, whenever and counteract with respect to , should be disallowed when an revision is followed by a revision. That is, when the revision of takes place, the information encoded in takes precedence over the information contained in . Darwiche and Pearl Darwicheea:97a considered this property (it is their rule (C6)) but argued against it, citing the following example.
Example 4
[Darwiche PearlDarwiche Pearl1997] We believe that exactly one of John and Mary committed a murder. Now we get persuasive evidence indicating that John is the murderer. This is followed by persuasive information indicating that Mary is the murderer. Let represent that John committed the murder and that Mary committed the murder. Then (D) forces us to conclude that Mary, but not John, was involved in the murder. This, according to Darwiche and Pearl, is counterintuitive, since we should conclude that both were involved in committing the murder.
Darwiche and Pearl’s argument against (D) rests upon the assumption that more recent information ought to take precedence over information previously obtained. But as we have seen in Example 3, this is not always a valid assumption. In fact, the application of (D) to Example 3, with and , produces the intuitively correct result of a belief in the observed animal being red: ).
Another way to gain insight into the significance of (D) is to consider its semantic counterpart:
 (DR)

For , , and , if then
(DR) curtails the rise in plausiblity of worlds after an revision. It ensures that, with the exception of the most plausible worlds, the relative ordering between an world and the worlds more plausible than it remains unchanged.
Proposition 5
Whenever a revision operator satisfies RAGM, then satisfies (D) iff it satisfies (DR).
Proof: For (D)(DR), suppose that , , , , and let be such that . Then and , and so, by (D). . From this it follows that . For if not, we would have that , which means that , and therefore that ; a contradiction.
For (D)(DR), suppose that and that
, but assume that .
This means there is a that is also in .
Now observe that since is an model.
Also, since , it follows from RAGM that is a model,
and therefore . Our supposition of
means that .
Since it thus follows that there is a such that .
By (DR) it then
follows that . But then cannot be a model of ;
a contradiction.
4 Restrained Revision
We now strengthen the requirements on admissible revision (those operators satisfying RAGM, (C1), (C2) and (P)) by insisting that (D) is satisfied as well. To do so, let us first consider the semantic definition of an interesting admissible revision operator. Recall that RAGM fixes the set of ()minimal models, setting them equal to , but places no restriction on how the remaining valuations should be ordered. The following property provides a unique relative ordering of the remaining valuations.
 (RR)

, iff
(RR) says that the relative ordering of the valuations that are not ()minimal remains unchanged, except for worlds and worlds on the same plausibility level; those are split into two levels with the worlds more plausible than the worlds. So RAGM combined with (RR) fixes a unique ordering of valuations.
Definition 4
The revision operator satisfying RAGM and (RR) is called restrained revision.
It turns out that within the framework provided by admissible revision, it is only restrained revision that satisfies (D). We prove this with the help of the following lemma, asserting the equivalence of (RR) to (CR1), (CR2), (PR) and (DR) in the presence of RAGM.
Lemma 1
Whenever a revision operator satisfies RAGM, then satisfies (RR) iff it satisfies (CR1), (CR2), (PR), and (DR).
Proof: For (CR1)(RR), pick . If then (CR1) follows from RAGM. If not, it follows from RAGM that , and then (CR1) follows from a direct application of (RR). For (CR2)(RR), pick . From RAGM it follows that , and then we obtain (CR2) from a direct application of (RR).
Observe that (RR) can be rewritten as
 (RR)

, iff
Now, for (PR)(RR), pick and . If then (PR) follows from RAGM. If not, it follows from a direct application of (RR). For (DR)(RR), pick , , and . Then (PR) follows from a direct application of (RR).
For (CR1), (CR2), (PR), (DR)(RR), let
and suppose that and (i.e. ).
We have to show that and either or .
Assume this is not the case. Then or both and .
Now, the second case is impossible because, together with and (PR) it
implies that ; a contradiction. But the first case is also impossible.
To see why, observe that by (CR1) it implies that and cannot both be models, by (CR2) and cannot both be models, by (DR) it cannot be
the case that and . And by (PR) it cannot be the case
that and . This concludes the first part of the proof of (CR1), (CR2), (PR), (DR)(RR). For the second part, let and suppose first that
. If then follows from (CR1).
If then follows from (CR2).
If and then follows from (PR).
If and then follows from (DR).
Now suppose that and either or .
If then follows either from (CR1) or (PR), depending
on whether or . And similarly, if then follows either from (CR2) or (PR), depending
on whether or .
Theorem 2
RAGM, (C1), (C2), (P) and (D) provide an exact characterisation of restrained revision.
Proof:
The proof follows from Lemma 1, Proposition 2, Proposition 5,
and the correspondence between (C1) and (CR1), and (C2) and (CR2).
Another interpretation of (RR) is that it maintains the relative ordering of the valuations that are not ()minimal, except for the changes mandated by (PR). From this it can be seen that restrained revision is the most conservative of all admissible revision operators, in the sense that effects the least changes in the relative ordering of valuations permitted by admissible revision. So, in the context of admissible revision, restrained revision takes on the role played by natural revision in the DarwichePearl framework.
In the rest of this section we examine some further properties of restrained revision. Firstly, Examples 3 and 4 share some interesting structural properties. In both, the initial knowledge base is pairwise consistent with each of the subsequent sentences in the revision sequence, while the sentences in each revision sequence are pairwise inconsistent. And in both examples the information contained in the initial knowledge base is retained after the revision sequence. These commonalities are instances of an important general result. Let denote the nonempty sequence of inputs , and let denote the revision sequence . Furthermore we shall refer to an epistemic state as compatible provided that for every in .
 (O)

If is compatible then
(O) says that as long as is not in direct conflict with any of the inputs in the sequence , the entire has to be propagated to the knowledge base obtained from the revision sequence . This is a preservation property that is satisfied by restrained revision.
Proposition 6
Restrained revision satisfies (O).
Proof:
We denote by , for , the revision sequence
(with ).
We give an inductive proof that, for and ,
for . In other words, every world
is always strictly below every non world. From this the result follows
immediately. For this amounts to showing that
which follows immediately from the definition of and .
Now pick any and assume that .
We consider four cases. If then it follows by (CR1) that
. If then it follows by (CR2) that
. If and then it follows
by (PR) that . And finally, suppose and . By compatibility there is an ,
and by the inductive hypothesis, . So , and then it follows by (DR) that .
Although restrained revision preserves information which has not been directly contradicted, it is not dogmatically wedded to older information. If neither of two successive, but incompatible, epistemic states are in conflict with any of the inputs of a sequence , it prefers the latter epistemic state when revising by .
Proposition 7
Restrained revision satisfies the following property:
 (Q)

If and are both compatible but , then and
Proof:
It follows immediately from Proposition 6 that
. And
then follows from the consistency of .
Next we consider another preservation property, but this time, unlike the case for (O) and (Q), we look at circumstances where is incompatible with some of the inputs in a revision sequence.
 (S)

If and then
Note that, given RAGM, the antecedent of (S) implies that . Thus (S) states that if is believed initially, and that a subsequent commitment to either or its negation would not change this fact, then after the sequence of inputs in which is preceded by and , the second input concerning is nullified, and the older input regarding is retained.
Proposition 8
Restrained revision satisfies (S).
Proof:
Suppose the antecedent holds. If then the consequent holds. In fact this
can be seen from the property (T) in Proposition 10 below. So
suppose . Then either or
. This latter doesn’t hold by one of the assumptions together with (C2), so the former must hold. This implies by (P). Combining this with the other assumption we
get . In this case we get (again using
(T)), while (since
) ((T) once more), which in turn equals by (C2). Since this is in turn equal to
by RAGM as required.
We now provide a more compact syntactic representation of restrained revision. First we show that (C1) and (P) can be combined into a single property, and so can (C2) and (D).
Proposition 9
Given RAGM,

(C1) and (P) are together equivalent to the single rule
 (C1P)

If then

(C2) and (D) are together equivalent to the single rule
 (C2D)

If then .
Proof: For (C1),(P)(C1P), suppose . By (P) it follows that which means, by RAGM, that . By (C1) it follows that , and thus that . For (C1)(C1P), suppose that . Then by RAGM, and so by (C1P). But since it follows that . For (P)(C1P), suppose that . Then by (C1P) which means, by RAGM, that .
For (C2),(D)(C2D), suppose that . By (D),
. By RAGM this means that
.
Now, by (C2) it follows that
.
So .
But since , we get by RAGM that
, from which it follows that
.
For (C2)(C2D), suppose that . Then
for any and by
by (C2D). For (D)(C2D), suppose that
. Then by (C2D) and since
, it follows that .
Both (C1P) and (C2D) provide conditions for the reduction of the twostep revision sequence to a singlestep revision (if only as regards the resulting knowledge base). (C1P) reduces it to an ()revision when is consistent with a revision. (C2D) reduces it to a revision, ignoring completely, when and counteract with respect to . Now, it follows from RAGM that the consequent of (C1P) also obtains when . Putting this together we get a most succinct characterisation of restrained revision.
Proposition 10
Only restrained revision satisfies RAGM and:
 (T)

Proof:
From Theorem 2 and Proposition 9 it is sufficient
to show that RAGM, (C1P) and (C2D) hold iff RAGM and (T) hold. So, suppose
that satisfies RAGM and (T). (C1P) follows from the bottom part of (T),
while (C2D) follows from the top part. Conversely, suppose that
satisfies RAGM, (C1P) and (C2D). If it follows
from (C2D) that . If not, we consider two
cases. If it follows from (C1P) that
.
Otherwise it has to be the case that .
But then it follows from RAGM that .
If we were to replace “” in the first clause in (T) by the stronger “ and are logically inconsistent”, we would obtain instead the characterisation of lexicographic revision given by Nayak et al. Nayakea:2003a.
Proposition 10 allows us to see clearly another significant property of restrained revision. For if then we know directly from (D), while if then Proposition 10 tells us and so by RAGM. Thus we see in the state the epistemic status of (either accepted or rejected) is always completely determined, i.e., we have proved:
Proposition 11
Restrained revision satisfies the following property:
 (U)

If then
(Given its similar characterisation just mentioned above, it is easy to see lexicographic revision satisfies (U) too.) Like (P), property (U) can be read as providing conditions under which the penultimate revision input should be believed. Its antecedent is simply saying is consistent with . Thus (U) is saying the penultimate input should be believed as long as it is consistent to do so. By chaining (U) together with (C4), we easily see that (U) actually implies (P) in the presence of (C4). As a consequence, we obtain the following alternative axiomatic characterisation of restrained revision.
Theorem 3
RAGM, (C1), (C2), (C4), (U) and (D) provide an exact characterisation of restrained revision.
For (U), we are also able to provide a simple semantic counterpart property. It corresponds to a separating of all the worlds from all the worlds in the total preorder following an revision, in that each plausibility level in either contains only worlds or contains only worlds:
Proposition 12
Whenever a revision operator satisfies RAGM, then satisfies (U) iff it satisfies the following property:
 (UR)

For and , either or
Proof: For (U)(UR) suppose (UR) doesn’t hold, i.e., there exist , and such that both and . Letting be such that we get from RAGM and thus both (because of respectively). Hence (U) doesn’t hold.
For (U)(UR) suppose (U) doesn’t hold, i.e., there exist such that both
. Then there exist and
such that (by RAGM) . Since both and
are minimal worlds we must have both and
. Hence give a counterexample to (UR).
Finally in this section we turn to two properties first mentioned (as far as we know) by Schlecta et al. Schlechtaea:96a (see also the work of Lehmann et al. Lehmannea:2001a):
 (Disj1)

 (Disj2)

(Disj1) says that if a sentence is believed after any one of two sequences of revisions that differ only at step (step being in one case and in the other), then the sentence should also be believed after that sequence which differs from both only in that step is a revision by the disjunction . Similarly, (Disj2) says that every sentence believed after an revision should be believed after at least one of  and . Both conditions are reasonable properties to expect of revision operators.
Proposition 13
Restrained revision satisfies (Disj1) and (Disj2).
To prove this result we will make use of the properties of the counteracts relation given in Proposition 4, along with the following lemma.
Lemma 4
If and then