Agent Composition Synthesis based on ATL

Transcription

1 Agent Composition Synthesis sed on ATL Giuseppe De Gicomo nd Polo Felli Diprtimento di Informtic e Sistemistic SAPIENZA - Università di Rom Vi Ariosto Rom, Itly {degicomo,felli}@dis.unirom1.it ABSTRACT Agent composition is the prolem of relizing virtul gent y suitly directing set of ville concrete, i.e., lredy implemented, gents. It is synthesis prolem, since its solution mounts to synthesizing controller tht suitly directs the ville gents. Agent composition hs its roots in certin forms of service composition dvocted for SOA, nd it hs een recently ctively studied y AI nd Agents community. In this pper, we show tht gent composition cn e solved y ATL (Alternting-time Temporl Logic) model checking. This results is of interest for t lest two contrsting resons. First, from the point of view of gent composition, it gives ccess to some of the most modern model checking techniques nd stte of the rt tools, such s MCMAS, tht hve een recently developed y the Agent community. Second, from the point of view of ATL verifiction tools, it gives novel concrete prolem to look t, which puts emphsis on ctully synthesize winning policies (the controller) insted of just checking tht they exist. Ctegories nd Suject Descriptors I.2.4 [Artificil Intelligence]: Knowledge Representtion Formlisms nd Methods Generl Terms Theory, Verifiction, Algorithms Keywords Agent composition, synthesis, model checking, ATL 1. INTRODUCTION Agent composition is the prolem of relizing virtul gent y suitly directing set of ville concrete, i.e., lredy implemented, gents. It is synthesis prolem, whose solution mounts to synthesizing controller tht suitly directs the ville gents. Agent composition hs its roots in certin forms of service composition dvocted for SOA [20]. However gents provide much more sophisticted context for the prolem, nd in the lst yers, the reserch on gent composition within Cite s: Agent Composition Synthesis sed on ATL, Giuseppe De Gicomo, Polo Felli, Proc. of 9th Int. Conf. on Autonomous Agents nd Multigent Systems (AAMAS 2010), vn der Hoek, Kmink, Lespérnce, Luck nd Sen (eds.), My, 10 14, 2010, Toronto, Cnd, pp Copyright c 2010, Interntionl Foundtion for Autonomous Agents nd Multigent Systems ( All rights reserved. the AI nd Agents community hs een quite fruitful nd severl composition techniques hve een devised, sed on reduction to PDL stisfiility [6, 5, 17], on forms of simultion or isimultion [10, 18, 4, 2], on LTL (Liner time logic) synthesis [15, 14, 9, 12] nd on direct techniques [19]. In this pper, we show tht gent composition cn e solved y ATL model checking. ATL (Alternting-time Temporl Logic) [1] is logic whose interprettion structures re multi-plyer gme structures where plyers cn collorte or confront ech other so s to stisfy certin formule. Techniclly, ATL is quite close to CTL, with which it shres excellent model checking techniques [3]. Differently from CTL, when n ATL formul is stisfied then it mens tht there exists strtegy, for the plyers specified in the formul, tht fullils the temporl/dynmic requirements in the formul. ATL hs een widely dopted y the Agents community since it llows for nturlly specifying properties of societies of gents [21, 8]. The interest of the Agents community hs led to ctive reserch on specific model checking tools for ATL, which y now re mong the est model checkers for verifiction of temporl properties [7]. We show tht indeed gent composition cn e nturlly expressed s checking certin ATL formul over specific gme structure where the plyers re the virtul trget gent, the concrete ville gents, nd controller, whose ctul controlling strtegy hs yet to e defined. The plyers corresponding to the trget nd to the ville gents tem up togheter ginst the controller. The controller tries to relize the trget y looking, t ech point in time, t the ction chosen y the trget gent, nd y selecting ccordingly who, mong the ville gents, ctully performs the ction. In doing this the controller hs to cope with the choice of the ction to perform y the trget gent nd the nondeterministic choice of the next stte of the ville gent tht hs een selected to perform the ction. The ATL formul essentilly requires tht the controller voids errors, where n error is produced whenever no ville gents re le to ctully perform the trget gent s ction currently requested. If the controller hs strtegy to stisfy the ATL formul, then, from such strtegy, refined controller relizing the composition cn e synthesized. In fct, we show tht y ATL model checking we get much more thn single controller relizing composition: we get controller genertor [18] i.e., n implicit representtion of ll possile controllers relizing composition. The results of this pper re of interest for t lest two contrsting resons. First, from the point of view of gent composition, it gives ccess to some of the most modern 499

2 model checking techniques nd tools, such s MCMAS, tht hve een recently developed y the Agent community. Second, from the point of view of ATL verifiction tools, it gives novel concrete prolem to look t, which puts emphsis on ctully synthesize winning policies (the refined controller) insted of just checking tht they exist, s usul in mny contexts where ATL is used for gent verifiction. The rest of the pper is orgnized s follows. In Section 2, we formlly introduce the notion of gent composition. In Section 3, we give some ckground notions on ATL needed in the pper. In Section 4, we devise the encoding of gent composition s n ATL model checking prolem, nd, in Section 5, we show the soundness nd completeness of the proposed technique, s well s its optimlity from the computtionl complexity point of view. In Section 6, we discuss how to use concrete model checker for ATL, nmely MC- MAS, to do the composition synthesis. In Section 7, we conclude the pper with rief discussion on future work. 2. AGENT COMPOSITION In this pper we ddress the Agent Composition Prolem following the pproch proposed in [19, 17, 18]. In such n pproch, gents re chrcterized y their ehviour, modeled s trnsition system (TS), which cptures the gent executions, s well s the ville choices tht, t ech point, the gent hs ville for continuing its execution. Given virtul trget gent, i.e., n gent of which we hve the desired ehvior ut not its ctul implementtion, nd set of ville concrete gents, i.e., set of gents, ech with its own ehvior, tht re indeed implemented, the composition s gol is to synthesize controller, i.e., suitle softwre module, cple of implementing the trget gent y suitly controlling the ville gents. Such module relizes trget gent if nd only if it s le, t every step, to delegte every ction executle y the trget to one of the ville gent. Notice tht, in doing this, the controller hs to tke into ccount not only locl sttes of oth the trget nd the ville gents, ut lso their future evolutions, delegting ctions to ville gents so tht ll possile future trget gent s ctions cn continue to e delegted. We cll such controller composition of the ville gent tht relizes the trget gent. Formlly, n gent is trnsition system, i.e., tuple S = A,S,s 0,δ,F where: Ais the finite set of ctions; S is the finite set of sttes; s 0 is the initil stte; δ S A S is the trnsition reltion; F S is the set of finl sttes. We often write s s insted of s,, s δ. We ssume tht, in ech stte s, there is t lest one ction tht the gent cn perform, i.e., there exists n s such tht s s. The gent cn (ut does not need to) leglly terminte whenever it is in finl stte s F. Note tht, in generl, gents re non-deterministic: δ is defined s trnsition reltion; thus the stte reched fter performing ction Afrom stte s S cnnot e foreseen. When the trnsition reltion is in fct prtil function from S A to t0 t1 () S t s20 s10 (c) S 2 () S 1 s21 s11 s12 Figure 1: Trget gent S t nd ville gents S 1, S 2 t0 t1,1 s10 s20 s11 s20,1,1,1 s12 s20,2,2,1 s10 s21 s11 s21 Figure 2: S t simulted y S 1, S 2,2,1 s12 s21,1,1 S we sy tht the gent is deterministic. We sy tht nondeterministic gents re prtilly (ction) controllle in the sense tht when the gent is instructed to do n ction, the ctul resulting stte is unpredictle y the controller. Conversely, we sy tht deterministic gent is fully (ction) controllle. We ssume tht the ville gents re prtilly controllle while the trget gent, i.e., the gent tht we wnt to relize, is fully controllle. Figure 1 shows the grphic representtion of trget gent S t nd two ville gents S 1 nd S 2. Following wellestlished convention, we grphiclly represent sttes s circles (nodes) nd trnsitions s rrows (edges) leled with ctions. Finl sttes re doule-circled. In [18] it hs een shown tht checking for the existence of n gent composition is equivlent to checking for the existence of vrint of the simultion reltion [10] etween the trget gent nd the ville gents. Such (nondeterministic) simultion reltion cn e defined s follows. Given trget gent S t nd n ville gents S 1,...,S n with S i = A,S i,s i0,δ,f i nd i = t, 1,,n,simultion reltion of S t y S 1,...,S n is reltion R S t S 1 S n such tht s t,s 1,...s n R implies: if s t F t then s i F i for i =1,,n; for ech trnsition s t s t in S t there exists n index j {1,...,n} such tht the following holds: there exists t lest one trnsition s j s j in S j; for ll trnsitions s j s j in S j we hve tht s t,s 1...,s j...,s n R (ll gents ut S remin still). 500

3 Let S t e the trget gent nd S 1...,S n e the ville gents. A stte s t S t is simulted y stte s 1,...,s n S 1 S n ( s 1,...,s n simultes s t), denoted s t s 1,...,s n, if nd only if there exists simultion reltion R of S t y S 1...,S n such tht R(s t,s 1,...,s n). Extending this notion to the whole gents, we sy tht S t is simulted y S 1...,S n (or S 1...,S n simulte S t)iff s 0t s 01,...,s 0n, where s 0t nd s 0i, with i =1,...,n, re the initil sttes of the trget gent nd of the ville gents, respectively. Figure 2 shows grphicl representtion of the simultion reltion R etween trget gent the ville gents, where filling ptterns (possily overlpping) re used to denote similr sttes. As shown in [18], we otin the following fundmentl result: Theorem 1. [18] A composition of the ville gents S 1,...,S n relizing the trget gent S t exists if nd only if S t is simulted y S 1,...,S n. In other words, in order to checking for the existence of composition it is sufficient to (i) compute the mximl simultion reltion of S t y S 1,...,S n nd (ii) check whether s 0t,s 01,...,s 0n is in it. Theorem 1 thus reltes the notion of simultion reltion to the one of gent composition showing, siclly, tht checking for the existence of n gent composition is equivlent to checking for the existence of simultion reltion etween the trget gent nd the ville gents. To ctully synthesize controller from the simultion we compute the so clled composition genertor, or CG for short. Intuitively, the CG is progrm tht returns, for ech stte the ville gents my potentilly rech while relizing trget history, nd for ech ction the trget gent my do in such stte, the set of ll ville gents le to perform the trget gent s ction, while gurnteeing tht every future trget gent s ctions cn still e fulfilled. The CG is directly otined y the mximl simultion reltion s follows: Definition 1. (Composition Genertor) Let S t e trget gent nd S 1,...,S n e n ville gents, shring the set of ctions A, such tht S t is simulted y S 1,...,S n nd let S g = { s t,s 1,...,s n s t s 1,...,s n }. TheComposition Genertor (CG) for S t y S 1,...,S n is the function: ω g : S g A 2 {1,...,n} such tht for s g = s t,s 1,...,s n S g nd A ω g(s g,)={i s t s t is in S t nd s i s i is in S i nd s t s 1,...,s i,...,s n } CG is function ω g tht given the sttes of the trget nd ville gents, which re in simultion, nd given n ction, outputs the set of ll ville gents le to perform tht ction in their current stte, while preserving the simultion. If there exists composition of S t y S 1,...,S n, then the composition genertor CG genertes compositions, clled generted compositions, y picking up one mong the ville gents returned y function ω g, t ech step of the (virtul) trget gent execution, strting with ll (trget nd ville) gents in their respective initil stte. Next theorem gurntees tht ll compositions cn e generted y the composition genertor. Theorem 2. [18] Let S t nd S 1,...,S n e s ove. A controller P of s 01,...,s 0n for S t is composition of S 1,...,S n relizing S t if nd only if it is generted composition. 3. ATL Alternting-time Temporl Logic [1] is logic tht cn predicte on moves of gme plyed y set of plyers. For exmple, let Σ e the set of plyers nd A Σ, then the ATL formul A ϕ sserts tht there exists strtegy for plyers in A to stisfy the stte predicte ϕ irrespective of how plyers in Σ\A evolve. The temporl opertors re (eventully), (lwys), (next) nd U (until). The ATL formul p1,p2 ϕ cptures the requirement plyers p1 nd p2 cn cooperte to eventully mke ϕ true. This mens tht there exists t winning strtegy tht p1 nd p2 cn follow to force the gme to rech stte where ϕ is true. ATL formule re constructed inductively s follows: p, for propositions p Π re ATL formule; ϕnd ϕ 1 ϕ 2 where ϕ, ϕ 1 nd ϕ 2 re ATL formule, re ATL formule; A ϕ nd A ϕ nd A ϕ 1Uϕ 2, where A Σ is set of plyers nd ϕ, ϕ 1 nd ϕ 2 re ATL formule, re ATL formule. We lso use the usul oolen revitions. ATL formule re interpreted over concurrent gme structures: every stte trnsition of concurrent gme structure results from set of moves, one for ech plyer. Formlly, such structure is tuple S = k, Q, Π,π,d,δ where: k 1 is the numer of plyers, ech identified y n index numer: Σ = {1,...,k}. Q is finite, non-empty, set of sttes. Π is finite, non-empty, set of oolen, oservle, stte propositions. π : Q 2 Π is leling function which returns the set of propositions stisfied in ech q Q. In ech stte q Q, ech plyer {1,...,k} hs d (q) 1 ville moves, identified with numers {1,...,d (q)}. A move vector for q is tuple j 1,...,j k such tht 1 j d (q) for ech plyer. We denote with D(q) the set {1,...,d 1(q)}... {1,...,d k (q)} of move vectors for q Q. For ech stte q Q nd ech move vector j 1,...,j k D(q), stte q = δ(q, j 1,...,j k ) Q results from stte q if every plyer i {1,...,k} chooses move j i. δ is clled trnsition function nd q is sid to e successor of q. Once the notion of successor is given, we cn provide forml definition of winning strtegy: given gme structure S s ove, strtegy for plyer Σ is function f tht mps every non-empty finite stte sequence λ Q + to one of its moves, i.e., nturl numer such tht if the lst stte of λ is q then f (λ) d (q). A computtion of S is n infinite sequence λ = q 0,q 1,q 2... of sttes such tht for ech i 0, the stte q i+1 is successor 501

4 of q i. The strtegy f determines, for every finite prefix λ of computtion, move f (λ) for plyer. Hence, strtegy f induces set of computtions tht plyer cn enforce. Given stte q Q, set A {1,...,k} of plyers, nd set F = {f A} of strtegies, one for ech plyer in A, we define the outcomes of F from q to e the set out(q, F A)ofq-computtions tht the plyers in A collectively cn enforce when they follow the strtegies in F A. A computtion λ = q0,q1,q2,... is then in out(q, F A) if q 0 = q nd for ll positions i>0every plyer follows the strtegy f to rech the stte q i+1, tht is, there is move vector j 1,...,j k D(q i) such tht j = f (λ[0,i]) for ll plyers A, ndδ(q i,j 1,...,j k )=q i+1. Now we cn provide forml definition of the stisfction reltion: we write S, q = ϕ to indicte tht the stte q stisfies formul ϕ with respect to gme structure S. = is defined inductively s follows: q = p, for propositions p Π, iff p π(q). q = ϕ iff q = ϕ. q = ϕ 1 ϕ 2 iff q = ϕ 1 or q = ϕ 2. q = A ϕ iff there exists set F A of strtegies, one for ech plyer in A, such tht for ll computtions λ out(q, F A), we hve λ[1] = ϕ. q = A ϕ iff there exists set F A of strtegies, one for ech plyer in A, such tht for ll computtions λ out(q, F A) nd ll positions i 0, we hve λ[i] = ϕ. q = A (ϕ 1 Uϕ 2) iff there exists set F A of strtegies, one for ech plyer in A, such tht for ll computtions λ out(q, F A), there exists position i 0 such tht λ[i] = ϕ 2 nd for ll positions 0 j<i,we hve λ[j] = ϕ 1. As for opertor (eventully), we oserve tht A ϕ is equivlent to A (true Uϕ). Concerning computtionl complexity, the cost of ATL model-checking is liner in the size of the gme structure, s for CTL, very well-known temporl logic used in model checking[3], of which ATL is n extension. 4. AGENT COMPOSITION VIA ATL Now we look t how to use ATL for synthesizing compositions. To do so we introduce concurrent gme structure for the gent composition prolem, reducing the serch for possile compositions to the serch for winning strtegies in the multi-plyer gme plyed over it. Given trget gent S t nd n ville gents S 1,...,S n with S i = A,S i,s0 i,δ i,f i with i = t, 1,...n, we define gme structure NGS for our prolem s follows. We strt y slightly modifying the ville gents S i (i = 1,...,n) y dding new stte err i, disconnected, through δ i, to the other sttes, nd such tht err i F i. We lso define two convenient nottions: Act i(s) tht denotes the set of ctions ville to the gent i (i = t, 1,...,n) in its locl stte s, i.e., Act i(s) ={ A <s,,s > δ i for some s }. Succ i(s, ) tht denotes the set of possile successor sttes for plyer i (i = t, 1,...,n) when it performs ction from its locl stte s, i.e., Succ i(s, ) ={s S i < s,,s > δ i}. The gme structure NGS = k, Q, Π,π,d,δ is defined s follows. Plyers. The set of plyers Σ is formed y one plyer for ech ville gent, one plyer for the trget gent, nd one plyer for the controller. Ech plyer is identified y n integer Σ = {1,...,k}. i {1...n} for the ville gents (n = k 2) t = k 1 is the trget virtul gent k is the controller Gme structure sttes. The sttes of the gme structure re chrcterized y the following finite rnge functions: stte i : returns the current stte of the gent i (i = t, 1,...,n); it rnges over s S i. sch : returns the scheduled ville gent, i.e., the gent tht performed the lst ction; it rnges over i {1,...,n}. ct t : returns the ction requested y the trget, it rnges over A. finl i : returns whether the current stte stte i of gent i is finl or not (i = t, 1,...,n); it rnges over oolens. Q is the set of sttes otined y ssigning vlue to ech of these functions, nd Π is the set of propositions of the form (f = v) corresponding to ssert tht function f hs vlue v. Notice tht we cn use directly finite rnge functions, without fixing ny specific encoding for the technicl development tht follows. The function π, given stte q of the gme structure returns the vlues for the vrious functions. For simplicity, we will use the nottion stte i(q) =s insted of (stte i = s) π(q). Initil sttes. The initil sttes Q 0 of the gme structure re those q 0 such tht: every gent is in its locl initil stte, stte i(q 0)=s 0i nd finl i(q 0)=true iff s 0i F i (i = t, 1,...,n), ct t(q 0)= for some ction Act(s 0t), nd sch(q 0) = 1 (this is dummy vlue, which will e not used in ny wy during the gme). Plyers moves. The moves tht the plyer i (i =1,...,n), representing the ville gent S i, cn perform in stte q re: 8 < {s s Succ i(stte i(q), ct t(q))} Moves i(q) = if Succ i(stte i(q), ct t(q)) : {err i} otherwise. 502

5 <s12,s20,,1>, 2, s11, s21, t0 <s12,s20,>, 2, <err,s21,,2> s11, s20, t1 <err,s21,,2> <err,s20,,1>, 1, <err,s21,,1> <s11,err,,1> s11, s20, t1, 1, s10, s20, t0 <s11,err,> <s12,err,>, 2, s10, err, t1 <err,s20,,1> <err,s21,,1>, 1, err, s20, t0 <s11,err,> <s12,err,> <s12,err,,1> <err,s20,,2> <s11,err,,1>, 1, s10, s20, t0, 1, s12, s21, t1 <s10,err,,1> <s10,err,,2> <s10,err,,1> <s12,s20,,1> <err,s20,,2> (), 2, s11, s20, t0, 2, s12, err, t0 <s12,err,,1> <s12,err,,1> <s10,s20,,1> <s10,s21,,1> <s12,err,>, 1, s10, s21, t0, 1, s12, s20, t1, 1, s11, s21, t1, 2, s11, err, t1 stte 1 stte 2 stte t ct s10 s20 t0 {1} s10 s20 t1 {2} s10 s21 t0 {2} s11 s20 t0 {1} s11 s20 t1 {2} s11 s21 t0 {1,2} s12 s20 t1 {1} s12 s21 t1 {1} () Figure 3: () A frgment of gme structure nd () the corresponding ω ACG The moves tht the plyer k, representing the controller, cn do in stte q re: Moves k (q) ={1,...,n}. The moves tht the plyer t, representing the trget gent S t, cn perform in stte q re (with little use of nottion, nd reclling tht the trget gent is deterministic): Moves t(q) =Act t(succ(stte t(q), ct t(q))). Notice tht the plyer t chooses in the current turn the ction tht will e executed next. The numer of moves is d i(q) = Moves i(q) nd, wlog, we cn ssocite some enumertion of the elements in Moves i(q). Gme trnsitions. The gme trnsition function δ is defined s follows: δ(q, j 1,...,j k ) is the gme structure stte q such tht: sch(q )=j k stte w(q )=j w if j k = w stte i(q )=stte i(q) i w stte t(q )=s t, where {s t} = Succ(stte t(q), ct t(q)) ct t(q )=j t finl i(q )=true iff stte i(q ) F i. Figure 3() shows frgment of the gme structure NGS for the exmple in Figure 1. Nodes represent sttes of the gme nd edges represent gme trnsitions lelled with move vectors (for simplicity, sttes where one of the gents is in err re left s sink nodes). ATL formul to check for composition. Checking the existence of composition is reduced to checking the ATL formul ϕ, over the gme structure NGS, defined s follows: ϕ = k ( i=1,...,n(stte i err i) (finl t ( i=1,...,nfinl i = true)) ) 5. RESULTS Given trget gent S t nd n ville gents S 1,...,S n, let NGS = k, Q, Π,π,d,δ e the gme structure nd ϕ the ATL formul defined ove. The set of winning sttes of the gmes is: [ϕ] NGS = {q Q q = ϕ} Referring to Figure 3() grey sttes re those in [ϕ] NGS. From [ϕ] NGS we cn uild n ATL Composition Genertor ACG for the composition of S 1,...,S n for S t exploiting the set [ϕ] NGS. Definition 2. (ATL Composition Genertor) Let NGS nd ϕ e s ove. We define the ATL Composition Genertor ACG s tuple ACG = A, {1,...,n},S NGS, SNGS,ω 0 ACG,δ ACG where: Ais the set of ctions, nd {1,...,n} is the set of plyers representing the ville gents, s in NGS; S NGS [ϕ] NGS}; = { stte t(q), stte 1(q),..., stte n(q) q S 0 NGS = { stte t(q 0), stte 1(q 0),..., stte n(q 0) q 0 Q o S NGS}; δ ACG : S NGS A {1,...,n} S NGS is the trnsition function, defined s follows: s t,s 1,...,s n δ ACG( s t,s 1,...,s n,,w) iff there exists q [ϕ] NGS with s i = stte i(q) for i = t, 1,...,n, = ct t(q), s t Succ t(s t,) such tht for ech q = δ(q, s 1,,s n,,w), with sch(q ) = w, s w Succ w(s w,), s i = s i for i w, nd Act t(q), we hve q [ϕ] NGS. ω ACG : S NGS A 2 {1,...,n} is the gent selection function: ω ACG( s t,s 1,...,s n,) = {i s t,s 1,...,s n with s t,s 1,...,s n δ ACG( s t,s 1,...,s n,,i)}. Figure 3() shows the gent selection function ω ACG of the ATL Composition Genertor for the gme structure of Figure 3(). Next theorem sttes the soundness nd completeness of the method sed on the construction of ACG for computing gent compositions. 503

6 Theorem 3. Let S t e trget gent nd S 1,...,S n n ville gents. Let ACG = A, {1,...,n},S ACG,S 0 ACG,ω ACG,δ ACG nd ω g e, respectively, the ATL Composition Genertor nd the Composition Genertor for S t y S 1,...,S n.then 1. s t,s 1,...,s n S ACG iff s t s 1,...,s n nd 2. for ll s t,s 1,...,s n such tht s t s 1,...,s n nd for ll A, we hve tht ω ACG( s t,s 1,...,s n,)=ω g( s t,s 1,...,s n,) Proof. We focus on (1) since (2) is direct consequence of 1 nd of the definition ω ACG. ACG s correctness is siclly proven showing tht the set S in ACG is simultion reltion ( i.e., it stisfies the constrints (i) nd (ii) in the definition of simultion reltion), nd it is hence contined in which is the lrgest one. As for completeness, we show tht there exists no generted composition P for S t nd S 1,...,S n which cnnot e generted y ω ACG. Towrd contrdiction let us ssume tht one such P exists. Then there exists history of the system coherent with P, such tht, considering the definition of ACG either () the requested ction cn t e performed in trget s current stte s t, () trget s current stte s t is finl ut t lest one of the current sttes of the s i (i =1,...,n) ville gents is not, or (c) no ville gent is le to perform the requested ction in its own current stte s i (i = 1,...,n), tht is if ll successor gme sttes reched fter performing it re error sttes. But () cnnot hppen y construction of ACG eing the history coherent with P, nd if either of () nd (c) hppens we get tht s t s 1,...,s n contrdicting the ssumption tht P is generted composition. Anlogously of wht done for the composition genertor in Section 2, we cn define the notion of ACG generted compositions: i.e., the compositions otined y picking up one mong the ville gents returned y function ω ACG, t ech step of the (virtul) trget gent execution strting with ll gents (trget nd ville in their initil stte). Then, s direct consequence of Theorem 3 nd the results of [18], we hve tht: Theorem 4. Let S t e trget gent nd S 1,...,S n n ville gents. Then (i) if [ϕ] NGS then every controller generted y ACG is composition of trget gent S t y S 1,...,S n nd (ii) if such composition does exist, then [ϕ] NGS nd every controller tht is composition of the trget gent S t y S 1,...,S n cn e generted y the ATL Composition Genertor ACG. By reclling tht model checking ATL formuls is liner in the size of the gme structure, nlyzing the construction ovewehve: Theorem 5. Computing ATL composition genertor (ACG) is polynomil in the numer of sttes of the trget nd ville gents nd exponentil in the numer of ville gents. Proof. The results follows y the construction of the gme structure NGS ove nd from the fct tht model checking ATL formul over gme structure cn e done in polynomil time. From Theorem 4 nd the EXPTIME-hrdness of result in [11], we get new proof of the complexity chrcteriztion of the gent composition prolem [18]. Theorem 6. [18] Computing gent composition is EXPTIME-complete. 6. IMPLEMENTATION In this section we show how to use the ATL model checker MCMAS [7] to solve gent composition vi ATL model checking. In prticulr, following the definition of gme structure NGS, we show how to encode instnces of the gent composition prolem in ISPL (Interpreted Systems Progrmming Lnguge) which is the input formlism for MCMAS. For redility, we show here sic encoding, ccording to the definition of NGS; some refinement will e discussed t the end of the section. ISPL distinguishes etween two kinds of gents: ISPL stndrd gents nd one ISPL Environment. In rief, oth ISPL stndrd gents nd the ISPL Environment re chrcterized y (1) set of locl sttes, which re privte with the exception of Environment s vriles declred s Osvrs; (2) set of ctions, one of which is choosen y the ISPL gent in every stte; (3) rule descriing which ction cn e performed y the ISPL gent in ech locl stte (Protocol); nd (4) function descriing how the locl stte evolve (Evolution). We encode oth the ville gents nd the trget gent of our prolem s ISPL stndrd gents, while we encode the controller in the Environment. Ech ISPL stndrd gent fetures vrile stte, holding the current stte of the corresponding gent, while the ISPL Environment hs two vriles: sch nd ct, which correspond to propositions sch nd ct t in Π, i.e., respectively, the ville gent chosen y the controller to perform the requested trget gent s ction, nd the trget gent s ction itself. The specil vlue strt is introduced for technicl convenience: we need to generte stte for ech possile ction the trget gent my request t the eginning of the gme. All vriles hve enumertion type, rnging over the set of vlues they cn ssume ccording to the definition of NGS. We illustrte the ISPL encoding of our running exmple. Consider the sme ville nd trget gents s in Figure 1. The code for the ISPL Environment Environment: Semntics = SA; Agent Environment Osvrs: sch : {S1,S2,strt}; ct : {,,strt}; end Osvrs Actions = {S1,S2,strt}; Protocol: ct=strt : {strt}; Other : {S1,S2}; end Protocol Evolution: sch=s1 if Action=S1; sch=s2 if Action=S2; ct= if T.Action=; ct= if T.Action=; end Evolution end Agent 504

7 Notice tht the vlues of sch re unconstrined; they depend on the ction chosen y the environment, which chooses them so s to stisfy the ATL formul of interest. Insted, ct stores the ction tht the trget gent hs chosen to do next. The sttement Semntics = SA specifies tht only one ssignment is llowed in ech evolution line. This implies tht evolution items re prtitioned into groups such tht two items elong to the sme group if nd only if they updte the sme vrile nd tht they re not mutully excluded s long s they elong to different groups. Next we show the encoding s ISPL stndrd gents S1 nd S2 for the ville gents S1 nd S2. Agent S1 Vrs: stte : {s10,s11,s12,err}; end Vrs Actions = {s10,s11,s12,err}; Protocol: stte=s10 nd Environment.ct= : {s11,s12}; stte=s11 nd Environment.ct= : {s12}; stte=s12 nd Environment.ct= : {s10}; Other : {err}; end Protocol Evolution: stte=err if Action=err nd Environment.Action=S1; stte=s10 if Action=s10 nd Environment.Action=S1; stte=s11 if Action=s11 nd Environment.Action=S1; stte=s12 if Action=s12 nd Environment.Action=S1; end Evolution end Agent Agent S2 Vrs: stte : {s20,s21,err}; end Vrs Actions = {s20,s21,err}; Protocol: stte=s20 nd Environment.ct= : {s20,s21}; stte=s21 nd Environment.ct= : {s20}; Other : {err}; end Protocol Evolution: stte=err if Action=err nd Environment.Action=S2; stte=s20 if Action=s20 nd Environment.Action=S2; stte=s21 if Action=s21 nd Environment.Action=S2; end Evolution end Agent Ech ISPL stndrd gent for the ville gents reds vrile Environment.ct which hs een chosen in the previous gme round nd chooses next stte to go to mong those rechle through tht ction. If such n ction is not ville to the gent in its current stte, then err is chosen. If the ISPL stndrd gent is the one chosen y the controller, then y reching such n error stte, it flsifies the ATL formul. Finlly, we show the encoding s ISPL stndrd gent T of the trget gent T. Agent T Vrs: stte : {t0,t1}; end Vrs Actions = {,}; Protocol: Environment.ct=strt: {}; stte=t0 nd Environment.ct= : {}; stte=t1 nd Environment.ct= : {}; end Protocol Evolution: stte=t1 if stte=t0 nd Environment.ct=; stte=t0 if stte=t1 nd Environment.ct=; end Evolution end Agent The ISPL stndrd gent T reds the current ction Environment.ct in the ISPL Environment Environment, which stores its own previous choice, nd virtully mkes the corresponding trnsition (rememer tht the trget gent is deterministic) getting to the new stte. Then, it selects its next ction mong those ville in its next stte. Consider for exmple the first Evolution sttement: stte=t1 if stte=t0 nd Environment.ct=. Such cn e red s follows: if current stte is t0 nd the (lst) ction requested is, then request n ction chosen mong those ville t stte t1, nmely the set {} in this cse. Note tht, considering the definition of Environment, the ISPL stndrd gent T chooses the ction to e stored in Environment.ct t the next turn of the gme. The ISPL code is completed s follows. Evlution Error if S1.stte=err or S2.stte=err; S1Finl if S1.stte=s10 or S1.stte=s11; S2Finl if S2.stte=s20 or S2.stte=s21; TFinl if T.stte=t0; end Evlution InitSttes S1.stte=s10 nd S2.stte=s20 nd T.stte=t0 nd Environment.ct=strt nd Environment.sch=strt; end InitSttes Groups Controller = {Environment}; end Groups Formule <Controller> G (!Error nd (TFinl -> (S1Finl nd S2Finl)) ); end Formule where we define some computed propositions for convenience (Evlution), the initil stte of the gme (InitStte), the group of gents ppering in the ATL formul (Groups), nd the ATL formul itself (Formule). All of these prt directly correspond to wht descried in Section 4: in prticulr the ATL formul requires tht ll ISPL stndrd gents for ville gents hve to e in finl stte if the one for the trget does, nd none of the ISPL stndrd gent for ville gents cn e in error stte (since this cn only e reched whenever the scheduled ville gent cnnot ctully replicte requested ction). Stndrd MCMAS checks if the ATL formul ϕ is stisfied in the specified gme structure NGS. However, we used n ville prototype of MCMAS tht cn ctully return convenient dt structure with the set of ll sttes of the gme structure tht stisfy the ATL formul, nmely the 505

8 set [ϕ] NGS, nd the trnsitions mong them. Using such dt structure we wrote simple Jv progrm tht ctully computes ω ACG of Definition 2, thus otining prcticl wy to generte ll compositions. The whole pproch is quite effective in prctice. In prticulr, we hve run some experimentl comprisons with direct implementtions of the simultion pproch proposed in [18], nd our MCMAS sed system is generlly two orders of mgnitude fster. We lso compre it with implementtions sed on tlv [14] tht re tilored for the gent composition prolem [12], nd the results of the two systems re similr, even if we used completely stndrd MCMAS implementtion nd prototypicl dditionl components. We close the section y oserving tht the ISPL encoding shown here, which directly reflects the theoreticl construction done ove, could e esily refined (though possily t expenses of clrity) with t lest two mjor improvements. First, we cn mssively reduce the numer of error sttes from the resulting structure, giving ISPL Environment oth copy of ville gents sttes nd protocol function which only schedules ISPL stndrd gents tht re ctully le to perform the current trget ction, ccording to their own protocols. If none of the ISPL stndrd gents is le to fullfill this condition, then n error ction is selected, nd the successor stte is flgged with oolen vrile set to true in the Environment. Locl error sttes re no more needed nd the Error definition in the Evlution section needs to e chnged ccordingly. Second, the system cn e forced to loop fter such n error condition is reched, e.g. forcing ll ISPL gents to select n error ction, thus voiding to generte further (error) sttes. 7. CONCLUSIONS In this pper we hve shown tht gent composition cn e nturlly nd effectively solved y ATL model checking. This gives effective techniques for gent composition sed on current ATL model checkers. The connection etween gent composition nd ATL nd more generlly the work on ATL-sed gent verifiction cn e quite fruitful in the future. First of ll, such work cn stimulte the ATL community on focusing more on the prolem of ctully extrcting the strtegies to led to the stisfction of ATL formule, moving from ATL-sed verifiction to ATL-sed synthesis. Then severl dvncements in the recent work on ATL within the Agent community cn e of gret interest for gent composition. For exmple, the recent work on using ATL together with forms of epistemic logics to cpture the different knowledge of the vrious gents could give effective techniques to del with prtil oservility of the ehviors of the ville gents in the gent composition. Currently known techniques re mostly sed on elief-stte construction [16, 13, 4] nd hve mostly resisted effective implementtions. We pln to look into this issue in the future. Acknowledgments We would like to thnk Alessio Lomuscio, Hongyng Qu nd Frnco Rimondi for the development of some experimentl components of MCMAS tht return full witnesses of ATL formule, which hve proven to e essentil for our work. We would like lso to thnk Riccrdo De Msellis nd Fio Ptrizi for discussions nd insights, nd the nonymous reviewers for their vlule comments. 8. REFERENCES [1] R. Alur, T. A. Henzinger, nd O. Kupfermn. Alternting-time temporl logic. Journl of the ACM, 49(5): , [2] P. Blini, F. Cheikh, nd G. Feuillde. Algorithms nd complexity of utomt synthesis y synhcronous orchestrtion with pplictions to we services composition. Electronic Notes in Theoreticl Computer Science, 229(3):3 18, July [3] E. M. Clrke, O. Grumerg, nd D. A. Peled. Model checking. The MIT Press, Cmridge, MA, USA, [4] G. De Gicomo, R. De Msellis, nd F. Ptrizi. Composition of prtilly oservle services exporting their ehviour. In ICAPS, [5] G. De Gicomo nd S. Srdiñ. Automtic synthesis of new ehviors from lirry of ville ehviors. In IJCAI, pges , [6] D. Hrel, D. Kozen, nd J. Tiuryn. Dynmic Logic. The MIT Press, [7] A. Lomuscio, H. Qu, nd F. Rimondi. Mcms: A model checker for the verifiction of multi-gent systems. In CAV, pges , [8] A. Lomuscio nd F. Rimondi. Model checking knowledge, strtegies, nd gmes in multi-gent systems. In AAMAS, pges , [9] Y. Lustig nd M. Y. Vrdi. Synthesis from component lirries. In FOSSACS, pges , [10] R. Milner. An lgeric definition of simultion etween progrms. In IJCAI, pges , [11] A. Muscholl nd I. Wlukiewicz. A lower ound on we services composition. Logicl Methods in Computer Science, 4(2), [12] F. Ptrizi. Simultion-sed Techniques for Automted Service Composition. PhD thesis, DIS, Spienz Univ. Rom, [13] M. Pistore, A. Mrconi, P. Bertoli, nd P. Trverso. Automted composition of we services y plnning t the knowledge level. In IJCAI, pges , [14] N. Pitermn, A. Pnueli, nd Y. S r. Synthesis of rective(1) designs. In VMCAI, pges , [15] A. Pnueli nd R. Rosner. On the synthesis of rective module. In POPL, pges , [16] J. Rintnen. Complexity of plnning with prtil oservility. In ICAPS, pges , [17] S. Srdiñ, F. Ptrizi, nd G. De Gicomo. Automtic synthesis of glol ehvior from multiple distriuted ehviors. In AAAI, [18] S. Srdiñ, F. Ptrizi, nd G. De Gicomo. Behvior composition in the presence of filure. In KR, pges , [19] T. Ströder nd M. Pgnucco. Relising deterministic ehvior from multiple non-deterministic ehviors. In IJCAI, [20] J. Su, editor. IEEE Dt Engineering Bulletin: Specil Issue on Semntic We Services, volume 31:2, [21] M. Wooldridge. An Introduction to MultiAgent Systems. John Wiley & Sons, 2nd edition,