Wojciech Penczek. Polish Academy of Sciences, Warsaw, Poland. and. Institute of Informatics, Siedlce, Poland.

Transcription

1 A local approach to modal logic for multi-agent systems? Wojciech Penczek 1 Institute of Computer Science Polish Academy of Sciences, Warsaw, Poland and 2 Akademia Podlaska Institute of Informatics, Siedlce, Poland penczek@ipipan.waw.pl 1 Introduction Reasoning about knowledge is one of the fundamental problems in multi-agent systems. Usually, dynamic global state spaces partitioned w.r.t. the agents' information are considered [3]. In the theory of distributed systems, knowledge formulas are interpreted over innite linear or branching runs of the systems [5, 6, 3, 8, 13, 14]. It is clear that capturing changes in state due to actions is crucial for successful modelling of knowledge. Consequently, the knowledge of the agents who do not participate in execution of an action should remain unchanged, whereas the agents executing the action should know the eect of the execution. While these changes are usually present in the frames, logical formalisms quite rarely incorporate them. One of the reasons is that when actions are incorporated into global state formalisms, this leads to high undecidability [7, 8]. The solution to this problem was to interpret formulas on local states of agents [13]. Our frames are dened as general partially ordered structures, a variant of ow event structures [1] including prime event structures, branching runs of Petri Nets, and branching partial order runs of SKTS's. We study a temporal logic (TLCK) interpreted at the local state occurrences. The temporal operators correspond to the relations of causality and concurrency, whereas the knowledge operator corresponds to an indistinguishability relation between local state occurrences. This relation is dened in such a way that knowledge is causally determined. The logic is proved to be decidable in non-deterministic exponential time (2 O(j'j) for formula ') and a complete axiomatization is provided. TLCK does not have the nite model property. Then, a model checking algorithm for a variant of TLCK is given. For systems represented by deterministic Asynchronous Automata it is proved that the complexity of the model checking algorithm for formula ' over automaton A of N-agents is j'j jaj jg A j 2 O(N 3 logn), where jga j is the size of the global state space of A and A is the alphabet of actions. Next, the language of TLCK is extended by cognitive operators Int (intention) and Goal (goal) to be used for specication and verication of multi-agent systems. It is shown how to adapt the model checking algorithm for the new logic.? Partly supported by the State Committee for Scientic Research.

2 2 Branching structures Multi-agent systems are usually composed of sets of local states and transitions (actions). Their partial order behaviours can describe either the relations between occurrences of actions (called events) or occurrences of local states (lso's, for short) or both. The relations involved include in all the cases causality, concurrency, and (or) conict. Denition1 bs. A branching structure (bs) is a triple B = (S;!; k), where 1. S is a countable set, called a set of local state occurrences (lso, for short), 2.! S S is an irreexive, acyclic relation, called the immediate causality (ow) relation such that fs 0 2 S j s 0! sg is nite for each s 2 S (! denotes the reexive and transitive closure of!), 3. k S S is a symmetric, irreexive relation, called concurrency relation, 4. \ k = ; for =!, called causality relation. The relation # = (S S) n ( [?1 [ k), is called the conict relation. The bs's can be viewed as a variant of ow event structures [1], where the carrier S is interpreted as a set of lso's rather than as a set of events. In order to keep our approach as general as possible, but to be able to introduce knowledge operator via indistinguishability relation we assume that N > 0 is a nite number of agents and stick to the following interpretation of S: S = S1[: : :[S N, where S i is a set of lso's of agent i, for 1 i N. Obviously, we assume that (S i S i )\k = ;, which corresponds to the fact that the lso's of each agent cannot be concurrent. This, in fact, means that they are either causally related or in conict. Since lso's can be joint, for each lso s 2 S let agent(s) = fi 2 N j s 2 S i g be the set of agents to whom s belongs. Our idea is that agent i can at most identify his maximal local state occurrence without identifying the way it was reached. This implies that we are not making assumption of perfect recall. Therefore, the conditions on in our setting are as follows: \ = id S and \ # = ;, which implies that = k [ id S ; we call it causal knowledge. Informally speaking, each agent knows the lso's of the other agents that are causally dependent and in conict, so that he only cannot distinguish between the concurrent ones. 3 Temporal logic of causal knowledge (TLCK) In this section we introduce the language of TLCK. We use rst class operators corresponding to the relations!,, k, and a derived operator corresponding to the relation. Introducing an operator for # would likely lead to an undecidable logic [10]. Let P V = fp1; p2; : : :g [ fag i j i 2 Ng be a countable set of propositional variables including propositions corresponding to the agents' numbers. The logical connectives : and ^, as well as modalities [ ] (causally always), (all causally next), and C (concurrency operator) will be used.

3 Denition2. The set of formulas F orm is built up inductively: E1. every member of P V is a formula, E2. if and are formulas, then so are : and ^, E3. if is a formula, then so are [ ] and, C4. if is a formula, then so is C. Let B = (S;!; k) be a bs. Since is a relation denable with k, the bs's can be used directly as frames. However, for technical reasons we extend bs's by the relation =!. The operator K corresponding to is dened in terms of the operator C corresponding to k as K def = C ^. The operator dual to C is dened as: 9C def = :C:. Denition3 (frame). A structure F = (S;!; ; k) is a frame, where { (S;!; k) is a bs, { S = S1 [ : : : [ S N, for some N > 0, { (S i S i ) \ k = ;, for 1 i N. The set of models of TLCK is dened in the standard way except for the fact that for each i 2 N proposition ag i is assigned to all the lso's of agent i. Denition4 model. A model is a tuple M = (F; V ), where F = (S;!; ; k) is a frame and V : S?! 2 P V is a valuation function such that ag i 2 V (s) i s 2 S i, for each ag i 2 P V. Let M = (F; V ) be a model, where F = (S;!; ; k), and s 2 S be a state, and be a formula. M; s j= denotes that the formula is true at the state s in the model M (M is omitted, if it is implicitly understood). This notion is dened inductively as follows: E1. s j= p i p 2 V (s), for p 2 P V, E2. s j= : i not s j=, s j= ^ i s j= and s j=, E3. s j= [ ] i (8s 0 2 S) (s s 0 implies s 0 j= ), s j= i (8s 0 2 S) (s! s 0 implies s 0 j= ), C4. s j= C i (8s 0 2 S) (sks 0 implies s 0 j= ). Notice that s j= C species that holds at all the states concurrent with s. For the operator K, the following condition holds: Proposition5. M; s j= K i holds at all the states s 0 such that s s 0. Let M j= denote that M; s j=, for all s 2 S, and j= denote that M j= for all models M.

4 4 Axiomatization and decidability The proof system for TLCK is composed of 10 axioms and 3 inference rules. The axioms are listed together with the conditions Ci reecting properties of the relations they correspond to. Axioms: A0) All substitution rules of the PC A1) [ ]( ) ) ) ([ ] ) [ ] ) C1 (deductive closure) A2) ( ) ) ) ( ) ) C2 (deductive closure) A3) C( ) ) ) (C ) C) C3 (deductive closure) A4) [ ] ) C4 (reexivity of ) A5) [ ] ) [ ] [ ] C5 (transitivity of ) A6) [ ] ) [ ] C6 (! ) A7) [ ]( ) ) ) ( ) [ ] ) C7 (! ) A8) ) C9C C8 (symmetry of k) A9) (agi ) C(:agi)) C9 ((Si Si) \ k = ; for i 2 N) i2n A10) agi C10 (S = S1 [ : : : [ SN ) i2n Inference rules: Modus Ponens ; ) ` Generalization Rules ` [ ] ` C Theorem 6. The proof system for TLCK is sound and complete (i.e., j= i `, for each ). Theorem 7. Satisability for TLCK is decidable in non-deterministic exponential time (2 O(j'j) for formula '). 5 Synchronous systems In this section we formulate conditions and the specic axioms characterizing bs's corresponding to behaviours of systems communicating via executing S joint events and having disjoint local states. Let B = (S;!; k) be a bs and E = i2n E i be the set of events of the system. We assume that each lso s 2 S is obtained after executing an event e from the set of events E. Notice that in general there can be more than one event satisfying the above. However, if the conict inheritance condition holds, i.e., # #, then each lso s is represented by (e; i), where e is the event and i is the number of an agent executing e. Moreover, the events can be joint, i.e., E i do not need to be disjoint, whereas the sets S i are now disjoint. We introduce the relation loc S S with the following interpretation (s; s 0 ) 2 loc i there is an event e 2 E such that s and s 0 are obtained after executing e. This means that e is a joint event of the agents i and j with s 2 S i and s 0 2 S j. We extend the set of formulas, given in Denition 2, by: L5. if is a formula, then so is L. The operator L corresponds to the relation loc in the following way: L5. s j= L i (8s 0 2 S) ((s; s 0 ) 2 loc implies s 0 j= ).

5 Notice that the operator L allows for specifying the situation obtained after executing any event. The operator dual to L is denoted by 9L. Next, we give the list of conditions and then the list of the corresponding axioms for synchronizing systems: C11 C12 C13 C14 C15 A11 A12 A13 A14 A15 Conditions: S i \ S j = ;, for each i 6= j loc is reexive loc is symmetric if s! s 0, 9i 2 N s.t. s and s 0 are obtained after executing events of agent i loc k Axioms: W i2n (ag i ^ Vj6=i :ag j ) L ) ) L9L V i2n (ag i ) (9L(ag i ))) L ) C Theorem 8. The proof system of TLCK extended by the axioms A11 { A15 is sound and complete w.r.t. the models extended by the relation loc and satisfying additionally C11 { C15. When we asume that our frames satisfy the conict inheritance condition, we do not know whether the logic is still decidable and nitely axiomatizable. In this case we consider the model checking problem. 5.1 Model checking for synchronous systems Asynchronous automata [15] are considered as nite generators of our models. Denition 9. An asynchronous automaton (AA) over a distributed alphabet (A1; : : :; A N ) is a tuple A = (fw i g i2n ; f!g a a2a ; W0; fwi F g i2n ), where { W i is a set of local states of agent i, {! a W agent(a) W agent(a), where W agent(a) = i2agent(a)w i, and agent(a) = fi 2 N j i 2 A i g. { W0 G A = i2n W i is the set of initial states, { W F i W i is the set of nal states of process i, for each i 2 N. We deal with deterministic AA's extended by valuation functions V : G A! 2 P V. The model checking problem, formulated as B j= ', where B is a branching run of AA (see [12] for the construction) is decidable, but for an unrestricted ' we can oer only a non-elementary procedure. When we restrict ' by disallowing the nesting of operator K, we get the following theorem.

6 Theorem 10. The complexity of the model checking algorithm for formula ' over automaton A of N -agents is (j'j? m) + m jaj) jg A j 2 O(N 3 logn), where jg A j is the size of the global state space of A and m is the number of the subformulas of ' of the form. A similar result holds also for a dierent denition of knowledge (called, the most recent causal knowledge) dened by the following indistinguishability relation: s r s 0 i e 0 is a maximal j-event in the past of e (i.e., e 0 e), for s = (e; i) and s 0 = (e 0 ; j). 5.2 Introducing Goals and Intentions For specication and verication of multi-agent systems the operators of intentions Int and goals Goal are usually introduced. Denition11. Let B = (S;!; k) be a bs satisfying the conict inheritance condition. A maximal, conict-free substructure (R;! R ; k R ) of B is a run. The set of all runs of B is denoted by R. The language of TLCK is extended by operators R and [ ] R with the semantics similar to and [ ], but interpreted over a run R. Denition12 (new frame). A structure F R = (B; R; GOAL; IN T ) is a frame, where R 2 R, and GOAL; IN T : S?! 2 R is a function. GOAL(s) gives the runs satisfying the goal of the agent at s. IN T (s) gives the runs the agent wants to follow from s. Denition13. A model is a tuple M R = (F R ; V ), where F R is a frame and V : S?! 2 P V is a valuation function such that ag i 2 V ((e; i)), for each (e; i) 2 S and ag i 2 P V. M j= denotes that the formula holds in all the models M R for R 2 R. The notion of s j= for s = (e; i) 2 S is dened inductively for the new operators: E3. s j= R() i s 2 R implies (8s 0 2 R) (s! R s 0 implies s 0 j= ). s j= [ ] R () i s 2 R implies (8s 0 2 R) (s! R s0 implies s 0 j= ). G. s j= Goal() i for each R 0 2 GOAL(s) there is s 0 = (e 0 ; i) 2 R 0 such that s s 0 and s 0 j=, I. s j= Int() i for each R 0 2 IN T (s) there is s 0 = (e 0 ; i) 2 R 0 such that s s 0 and s 0 j=. As before, when we do not allow for nesting the cognitive operators in ', the following theorem holds. Theorem 14. The model checking algorithm for formula ' over automaton A of N -agents is of the complexity ((j'j? m) + m jaj) jg A j N 2 O(N 3 logn), where jg A j is the size of the global state space of A and m is the number of the subformulas of ' of the form.

7 References 1. G. Boudol and I. Castellani, Permutations of transitions: an event structure semantics for CCS and SCCS, LNCS 354, pp. 411{427, Springer-Verlag, Emerson, E.A., Halpern, J.Y., Decision Procedures and Expressiveness in the Temporal Logic of Branching Time, Proc. of 14th Annual ACM Symp. on Theory of Computing, San Francisco, pp , 1982, also appeared in Journal of Computer and System Sciences, vol. 30 (1), pp. 1{24, R. Fagin, J.Y. Halpern, Y. Moses, and M.Y. Vardi. Reasoning about knowledge, MIT Press, R. Fagin, J.Y. Halpern, Y. Moses, and M.Y. Vardi Knowledge-based programs, Distributed Computing 10, pp. 199{225, J. Halpern, and R. Fagin, Modelling knowledge and action in distributed systems, Distributed Computing, Vol. 3 (4), pp. 159{177, J. Halpern, and Y. Moses, Knowledge and Common Knowledge in a Distributed Environment, JACM, Vol. 37 (3), pp. 549{587, R.E. Ladner and J.H. Reif, The logic of distributed protocols, Proc. of TARK 1986, pp. 207{221, K. Lodaya, K. Parikh, R. Ramanujam, P.S. Thiagarajan, A logical study of distributed transition systems, Information and Computation, vol. 19, (1), pp. 91{ 118, K. Lodaya, R. Ramanujam, P.S. Thiagarajan, Temporal logic for communicating sequential agents: I, Int. J. Found. Comp. Sci., vol. 3(2), pp. 117{159, M. Mukund, P.S. Thiagarajan, An Axiomatization of Well Branching Prime Event Structures. Theoretical Computer Science 96, pp. 35{72, W. Penczek, Temporal Approach to Causal Knowledge, International Journal of the IGPL, Vol. 8(1), pp. 87{99, W. Penczek and S. Ambroszkiewicz, Model checking of local knowledge formulas, Proc. of FCT'99 Workshop on Distributed Systems, ENTCS Vol. 28, R. Ramanujam, Local knowledge assertions in a changing world, In Proc. of the Sixth Conference TARK 1996, Theoretical Aspects of Rationality and Knowledge, Y. Shoham editor, pp. 1{14, A. S. Rao and M. P. George, Modelling rational agents within a BDI{ architecture. In R. Fikes and E. Sandewall, editors, Proc. of the 2rd International Conference on Principles of Knowledge Representation and Reasoning (KR'91), pp. 473{484, W. Zielonka, Notes on nite asynchronous automata, RAIRO-Inf. Theor. et Appli., vol 21, pp. 99{139, This article was processed using the LaT E X macro package with LLNCS style