A Decidable Logic for Complex Contracts

Transcription

1 A Decidable Logic for Complex Contracts Cristian Prisacariu joint work with Gerardo Schneider Precise Modeling and Analysis group (PMA), University of Oslo 21 st Nordic Workshop on Programming Theory (NWPT'09) 15 C. UiO th October 2009, Lyngby, Denmark. A Decidable Logic for Complex Contracts NWPT / 18

2 1 Current and Future work C. UiO A Decidable Logic for Complex Contracts NWPT / 18 Aim and Motivation We want a formal language for specifying/writing contracts with the required theoretical apparatus (+ tool support). Analyze contracts statically Detect contradictions/inconsistencies or superuous contract clauses Analyze the contract by checking if predened properties hold. Determine the obligations (permissions, prohibitions) of a signatory Monitor contracts (dynamically) At run-time to ensure the contract is respected In case of contract violations, act accordingly Tackle the negotiation process (automatically?) Develop a theory of contracts 1 [Molina-Jimenez et al.] Contract composition, Subcontracting, Conformance between a contract and the governing policies

3 Outline - (you will see in this talk) CL, a logic for electronic contracts + (some) theoretic apparatus. The CL logic combines: Deontic Logic (modalities over actions) with Propositional Dynamic Logic (of actions). Allows specication of abstractions of contracts in the particular style of CL, and includes: synchronous actions (i.e., actions done at the same time) conditional obligations, permissions, and prohibitions (nested) contrary-to-duty (thought like exceptions enforced after violation is detected) statements about the outcome of actions in an electronic contract Semantics on normative structures. Can do (within the same syntax): model checking of properties on the abstract model of the contract run-time monitoring of the actions of the parties in the contract C. UiO A Decidable Logic for Complex Contracts NWPT / 18

4 Deontic e-contracts Based on deontic logic and combined with other modal logics It contains constructs to specify at least the legal notions Obligations, Permissions, and Prohibitions A deontic e-contract can be obtained From a conventional contract (legal/nancial context) Written directly in a formal specication language (web services, components, OO) It allows formal reasoning like: theorem proving, model-checking, runtime monitoring Denition A contract is a document which engages several parties in a transaction and stipulates commitments (obligations, rights, prohibitions), as well as penalties in case of contract violations. C. UiO A Decidable Logic for Complex Contracts NWPT / 18

5 (Standard) Deontic Logic In One Slide Concerned with normative and moral notions Focus on [von Wright et al.] obligation, permission, prohibition, optionality, power, immunity, etc The logical consistency of the above notions The faithful representation of their intuitive meaning in law, moral systems, or business organizations Dicult to avoid puzzles and paradoxes Approaches ought-to-do: expressions consider names of actions [Meyer,Segerberg] The Internet Provider ought to send a password to the Client ought-to-be: expressions consider state of aairs (results of actions) Important notions: The average bandwidth ought to be more than 20kb/s conditional obligations, permitions, and prohibitions contrary-to-duty and contrary-to-prohibition [Prakken et al.] C. UiO A Decidable Logic for Complex Contracts NWPT / 18

6 Propositional Dynamic Logic (PDL) Is the logic of regular programs (the logic of actions). The dynamic modality [β]c. [Pratt] [Fischer&Ladner,Harel,...] Semantics over Kripke-like structures (regular relational structures) Variants: over deterministic structures [Parikh,Ben-Ari&Halpern&Pnueli] with intersection of actions (undecidable over det. struct.) [Harel] with loop or repeat for innite programs [Harel&Pratt,Streett] with action negation (undecidable in general; decidable with negation of only atomic actions) embeds Hoare logic, temporal logics, many modal and epistemic logics Example (reading the modalities [ac and a C) a C non-det. - action a can make formula C true a C det. - action a will make formula C true [a]c (non-)det. - action a may allways make formula C true C. UiO A Decidable Logic for Complex Contracts NWPT / 18

7 The Contract Specication Language CL C := φ 0 O C (α) P(α) F C (α) C C [β]c α := 0 1 a α α α α α + α β := 0 1 a β β β β β + β β C? and are the classical propositional implication and false O C (α), P(α), F C (α) are the deontic modalities over actions (i.e. statements about the deontic status of the actions of a contract) with the associated reparations C (encoding our notion of contrary-to-duty) [β] action parameterized dynamic modality of PDL (encoding statements about the outcome of the actions) α and β are synchronous actions (encoding complex actions of a contract) [Fischer&Ladner] [Milner,Berry] [Meyer,Segerberg] φ 0 Φ B are propositional constants (encoding basic statements about the state of the contract) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

8 Particularities of CL Synchronous Actions Actions, a A B (nite set of basic actions): α := 0 1 a α α α α α + α β := 0 1 a β β β β β + β β C? synchrony ( ), actions done at the same time [Milner,Berry] causal sequence ( ), unrestricted choice (+), bounded repetition ( ), guarding tests (?) [Kozen,Harel,Pratt] [Meyer,Segerberg] synchrony axiom: (α α) (β β) = (α β ) (α β) α, β A B Example Obliged to provide telephone and internet at the same time. O(t i) It is forbidden to drive and talk at the mobile. F (d m) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

9 Particularities of CL Conicts, Violations, Contrary-to-duty conict relation # on basic actions [Nielsen&Winskel,Berry] E.g.: conicting actions (which cannot be done at the same time) like: go west and go east may give an inconsistency if O(a) O(b) violation of obligations as action negation α intuitively α is a choice of all actions which take us outside α E.g.: consider two atomic actions a and b then a b is b + a a contrary-to-duty (temporal CTDs) [Broersen et al.] reparation enforced after violating action is detected [Meyer] Not enforced in the same world as the primary obligation [Governatori&Rotolo,Prakken&Sergot,Makinson&van der Torre] Not the same as O(α) [α]c [Meyer et al.] The reparation C, is attached to the obligation. C. UiO A Decidable Logic for Complex Contracts NWPT / 18

10 Semantics on Normative Structures A Normative Structure is: N = (W, R 2 A B, V, ϱ) W is a set of worlds (states/nodes) V : ΦB 2 W is a valuation function of the propositional constants R 2 AB : 2 A B 2 W W is a function returning for each label a partial function (i.e. deterministic struct.) on the set of worlds ϱ : W 2 Ψ is a marking function of worlds with markers from Ψ = { a, a a A B } restriction: w W, a A B is not the case that a ϱ(w) and a ϱ(w) [van der Meyden,Castro&Maibaum] N, i = O C (α) i I (α) S i N, and t γ t I (α), s γ s N s.t. t S s γ γ then a A B if a γ then a ϱ(s ), and s γ s N I (α),i rem, a A B if a γ then a ϱ(s ), and N, s = C s N with t Ŝ s t leafs(i (α)). C. UiO A Decidable Logic for Complex Contracts NWPT / 18

11 Motivating Properties of CL Why all that complication? Answer: to capture notions we nd natural in legal contracts 1 main: = O C (α) O C (γ) O C (α γ) 2 avoid conicts: = (O C (α) F C (α)) (the restriction on ϱ) if α # γ then = (O C (α) O C (γ)) ( # the conicting relation) 3 required implications: if α = γ then = O C (α) O C (γ) =O C (α) P(α) = P(α) F C (α) = F C (α) F C (α γ) = F C (α + γ) F C (α) F C (γ) = P(α β) P(α) [α]p(β) = P(α + γ) P(α) P(γ) = F (α β) F (α) α F (β) =O C (α γ) O C (α) [α]o C (γ) 4 avoid unnatural implications: = O C (α) O C (α γ) = O C (α + γ) O C (α γ) = O C (α γ) O C (α + γ) = O C (α) O C (α + γ) = O C (α + γ) O C (α) = F C (α γ) F C (α) = P(α γ) P(α) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

12 Theoretical results Completeness of the algebra of synchronous actions w.r.t. standard models of sets of guarded concurrent strings. (as corollary we can use in the semantics of CL the equivalent guarded concurrent trees of the actions) Decidability of the satisability problem for CL (complexity of the satisability is at least exponential) Tree model property for CL Runtime monitoring using a trace semantics for CL (uses automata theoretic techniques) Trace semantics is consistent with the full semantics of CL based on normative structures Properties of CL in the form of validities and non-validities (which should lead to an axiomatization) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

13 Conclusion You have seen CL: An action-based specication language for electronic contracts How the language combines Propositional Dynamic Logic over synchronous actions with Deontic Logic over actions. Semantics on normative structures (deterministic and with a simple marking function) CL was used for runtime monitoring CL in a restricted form was used for model checking CL has a particular view of CTDs CL combines several particular notions: structured actions (regulated by an action algebra) synchronous actions conicting denitions action negation (to encode violations) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

14 Current and Future Work Theoretical tools for CL Axiomatization!? Tableaux based proof system!? Extensions of CL deadlines parties (as directed obligations? or types for actions?) [Castro&Maibaum] [Dignum et al.] [Herrestad&Krogh,Groote et al.] classical timeless CTDs (dyadic operators over actions?) Controlled natural language for CL (ACL and DRS) Applications of CL (in computer science) to behavior interfaces in OO to service-oriented architectures [Prakken&Sergot,Governatori&Rotolo] [Fuchs et al., Kamp&Reyle] C. UiO A Decidable Logic for Complex Contracts NWPT / 18

15 Thank you! C. UiO A Decidable Logic for Complex Contracts NWPT / 18

16 Related Work C. Molina-Jimenez et al.: monitoring contracts written directly as FSM Fischer&Ladner, D.Harel, V.Pratt : Propositional Dynamic Logic PDL R.Milner, G.Berry : on SCCS and Synchrony model J.J. Meyer, K.Segerberg : Dynamic Deontic Logic (over actions) J.J. Meyer&F.Dignum&J.Wieringa et al. : combination with temporal logic, time, encoding into modal µ-calculus,... M.Nielsen&G.Winskel : concurrency models and conict relation J.Broersen et al. : action negations and Deontic logic G.Governatori&A.Rotolo, H.Prakken&M.Sergot, D.Makinson&L.van der Torre : contrary-to-duty van der Meyden : Deontic Logic of Permissions (over actions) P.Castro&T.Maibaum : complete, compact deontic action logic (tableaux system) D.Kozen et al. : on Kleene algebra (the algebra behind actions) J.F.Groote et al. : mcrl2 complex action algebra G.H.von Wright : Deontic Logic :-) C. UiO A Decidable Logic for Complex Contracts NWPT / 18

17 Contracts and Informatics 1 Programming by contract or Design by contract (e.g., Eiel) Relation between pre- and post-conditions of routines, method calls, invariants, temporal dependencies, etc 2 In the context of web services (SOA) Service-Level Agreement, usually written in an XML-like language (e.g. WSLA) 3 Behavioral interfaces Specify the sequence of interactions between dierent participants. The allowed interactions are captured by (sets of) correct traces 4 Contractual protocols (coordination models) To specify the interaction (coordination) between communicating entities 5 Policy in multi-agent systems (agent societies) 6 Deontic e-contracts: representing Obligations, Permissions, Prohibitions, Power, etc C. UiO A Decidable Logic for Complex Contracts NWPT / 18

18 Predecessors Deontic Logics of Actions A foundation of actions is important for deontic logic. The rst investigations in this direction; (pioneers) [von Wright,Segerberg] Dynamic Deontic Logic (DDL) [Meyer'88] The rst encoding of deontic modalities in PDL (in a logic of actions) O(a) = [a]v not performing a sees a violation marker V Dynamic Logic of Permission More complex markers (for permissions this time) [van der Meyden'90] Deontic Logic in modal µ-calculus encoding in a more expressive logic than PDL. Technically cleaner. But aims at dierent properties than DDL. [Broersen&Wieringa&Meyer] Deontic Logic and Temporal or Modal Logics Deontic operators are stand alone but combined with temporal modalities for more expressivity. [Dignum et al.] C. UiO A Decidable Logic for Complex Contracts NWPT / 18