Table Of ContentAutomatic Verification of Parameterised Interleaved
Multi-Agent Systems
Panagiotis Kouvaros Alessio lomuscio
DepartmentofComputing DepartmentofComputing
ImperialCollegeLondon ImperialCollegeLondon
[email protected] [email protected]
ABSTRACT domain specifications are often expressed as epistemic, de-
3
ontic, and ATL formulas; the techniques put forward in the
1 Akeyprobleminverificationofmulti-agentsystemsbymodel
MAScommunityreflectthis[15,13,17]. Explicittechniques
0 checkingconcernsthefactthatthestate-spaceofthesystem
are less efficient, but symbolic checkers such as MCK [13],
2 growsexponentiallywiththenumberofagentspresent. This
mcmas [17] and VerICS [15] are capable of handling state-
makes practical model checking unfeasible whenever the
n spaces of the region of 1015 and beyond. Unfortunately,
system contains more than a few agents. In this paper we
a MAS-based applications, due to the agents’ complex and
put forward a technique to establish a cutoff result, thereby
J
intentional nature, often generate much larger state spaces.
showing that all systems of arbitrary number of agents can
8 To alleviate this problem, a number of techniques, including
be verified by model checking a single system containing a
2 abstraction [7] have been put forward. While these have
number of agents equal to the cutoff of the system. While
been successful in allowing users to tackle larger systems, it
thisproblemisundecidableingeneral,weheredefineaclass
] is still the case that, generally speaking, systems with many
A of parameterised interpreted systems and a parameterised
agents are difficult to verify. Clearly, this has a significant
temporal-epistemic logic for which the result can be shown.
M impact in open MAS populated by a multitude of agents
Weexemplifythetheoreticalresultsonaroboticexampleand
. present an implementation of the technique on top of mcmas, competingorcooperatingtoreachanindividualoracommon
s goal. Theaimofthispaperistocontributetoovercomethis
an open-source model checker for multi-agent systems.
c shortcoming.
[
CategoriesandSubjectDescriptors Tobeginthisinvestigationinaprincipledway,weworkon
1 aclassofMAScomposedofidenticalagentsinteractingwith
v D.2.4[Software/ProgramVerification]: ModelChecking an environment. While this may seem a strong condition,
1 we observe that is a relatively common assumption in many
3 GeneralTerms application areas of interest ranging from robotics, to arti-
4 ficial life, swarm intelligence, services and in open systems
6 Theory; Verification in general. A natural question in these systems is whether
. certain properties hold irrespective of the number of agents
1
Keywords
present. For example, in a remote robotic scenario we may
0
3 Epistemic Logic; Model Checking; Parameterised MAS wish to check that any number of interacting robots will
1 indeed establish a given objective. It is immediate to see
: 1. INTRODUCTION that plain vanillamodel checkingcannotbe of help here. To
v establish this property we would have to consider an infinite
Xi Verification and validation of systems before deployment number of different systems each composed of a different
is increasingly seen of fundamental importance not just in numberofagentsandrunmodelcheckingalgorithmsoneach
ar safety-critical applications, but also in more mainstream of these. Not withstanding the fact that we cannot check an
applications. Multi-Agent Systems (MAS) are no exception. infinitenumberofsystemsinfinitetime,thisclassofsystems
The past ten years have witnessed considerable research is mostly composed of systems for which model checking
in verification techniques aimed at assessing automatically would require an unfeasible amount of memory and time.
whether or not a MAS meets its intended specifications. Tosolvethisproblemwedevelopatechniquethatenables
One of the leading techniques in this area is model check- ustoderivethenumberofagentsthatissufficienttoconsider
ing [5]. InthissettingthesystemunderanalysisSisencoded to show that a property holds in the system for any number
asatransitionsystemMS andaspecificationP isformalised of agents. In line with literature in reactive systems [8, 14],
as a logical formula φP; the model checking procedure is we call this bound the MAS cutoff. In sharp contrast with
responsible for establishing whether MS |=φP, i.e., whether literature in reactive systems we here work with interleaved
or not the system MS satisfies the formula φP. In the MAS interpreted systems [16] and a temporal-epistemic language.
The rest of the paper is organised as follows. In Section 2
Appears in:Proceedings of the 12th International Confer- we define an interleaved semantics that will use throughout
ence on Autonomous Agents and Multiagent Systems (AA- the paper, a logic that we call IACTL∗K which combines
MAS2013),Ito,Jonker,Gini,andShehory(eds.),May,6–10,2013,Saint theuniversalfragmentofCTL∗ without“−neXxt”withaparam-
Paul,Minnesota,USA.
Copyright(cid:13)c 2012,InternationalFoundationforAutonomousAgentsand eterisedversionofepistemiclogic,andestablishastuttering-
MultiagentSystems(www.ifaamas.org).Allrightsreserved.
equivalence simulation result. Section 3 presents the tech-
niquetoestablishthecutoffandpresentsourmaintheoretical W W
result of the paper thereby guaranteeing the soundness of a1 b1
the technique. To exemplify the theory we discuss a robotic
example in Section 4. We discuss our implementation in a3 T G b3 T
Section 5 and present experimental results. We conclude in a2 a2 a1 b1b2 b2
Section 6 also discussing related work.
A R A
(a)Train1 (b)Controller (c)Train2
2. PARAMETERISEDINTERLEAVEDINTER-
Figure 1: An IIS of TGC comprised of two trains.
PRETEDSYSTEMS
Definition 2.1. (Interleaved Semantics) Let G be a
In this section we introduce a framework for reasoning
set of global states. The global interleaved evolution func-
about parameterised multi-agent systems. In particular, we
tion t : G×Act ×···×Act → G is defined as follows:
recall the semantics of interleaved interpreted systems [16] i n
t(g,act ,...,act )=g(cid:48) iff there exists an action a∈ACT
and we introduce that of parameterised interleaved multi- 1 n
such that for all i ∈ Agent(a) we have that act = a and
agent systems. To reason about the temporal-epistemic i
behaviours of agents, we introduce the logic IACTL∗K , a ti(gi,a) = gi(cid:48); and for all i ∈ A\Agent(a), we have that
parameterised extension of ACTL∗ with indexed at−oXmic acti = (cid:15)i and ti(gi,acti) = gi(cid:48) = gi. In short, we write the
propositions and indexed epistemic−mXodalities. above as g→a g(cid:48).
2.1 InterleavedInterpretedSystems We assume that the joint silent action is always enabled;
thus, the global transition relation is serial. A sequence of
The interpreted systems (IS) formalism [12] is a stan-
global states and actions π=g1a1g2a2g3... is said to be an
dard semantics for MAS. Here we consider a special class
interleaved path (or simply a path) originating at g1 if for
of interpreted systems, called interleaved interpreted sys-
tems (IIS) [16], in which the agents evolve in parallel asyn- every pair of successor states we have that gi →ai gi+1, for
chronously (i.e., by means of interleaving semantics [5]). every i≥1. We write π(i) to denote the i-th global state in
Differently from standard interpreted systems where actions π. Thesetofallpathsoriginatingfromg isdenotedbyΠ(g).
may be performed by all the agents at the same round, IIS Thelocalpathofagenti∈Ainπ istheprojectionofπ onto
insist on only one local action at the time to be performed i;i.e.,thesequenceπi =g1a1g2a2g3.... Theprojectionofπ
i i i
in the system. If, at any given round, more than one agent onto a set of agents J is the sequence πJ =g1a1g2a2g3....
J J J
admits in its repertoire the action to be performed, then all Wedenotebyπ[i]thesuffixgiaigi+1···ofπ. Astateg∈Gis
agents sharing this action have to perform it at that round. saidtobereachablefromg1 ∈Gifthereisapathg1a1g2···
Thus, the agents communicate by means of shared actions. such that g=gi, for some i≥1.
The temporal evolution of an agent’s local states is accom-
modated to the needs of interleaving; while in standard IS Definition 2.2. (InterleavedInterpretedSystems)Let
the next local state depends on the actions performed by all AP be a set of atomic propositions. An interleaved inter-
agents in the system, in IIS local states depend only on the pretedsystem(IIS),oramodel,isa4-tupleM=(cid:104)G,ι,Π,V(cid:105),
agent’s own action. We summarise the framework of IIS, as whereGisasetofglobalstates,ι∈Gisaninitialglobalstate
(cid:91)
presented in [16], to model interleaved MAS. such that each state in G is reachable from ι, Π= Π(g)
We assume that a MAS is composed of n agents A = g∈G
{1,... n}. Each agent i∈A is characterised by a finite set is the set of all interleaved paths originating from all states
of local states L and a finite set of actions Act . Each Act in G, and V :AP →℘(G) is a valuation function.
i i i
contains a special action (cid:15) which we call the“silent”action;
asthenamesuggests,wheniever(cid:15) isperformed,agenti’slocal Example 2.3. The IIS presented in Figure 1 is the un-
i
state does notchange. We call ACT =(cid:83) Act the union timed version of the Train-Gate-Controller [20]. The system
ofallthesetsAct . Actionsareperformedii∈nAcompiliancewith is composed of a controller and two trains. Each train runs
i
a protocol P :L →℘(Act ) governing which actions can be along a circular track and both tracks pass through a narrow
i i i
performed in a given state. The silent action is enabled at tunnel (state encoded by“T”). The tunnel allows only one
everylocalstate;formally,∀i∈A:∀l ∈L :(cid:15) ∈P (l ). For train to pass through it (and get to state“A”(Away)) at any
i i i i i
each action a, we call Agent(a)={i∈A|a∈Act } the set time. The controller operates the colour (states“G”(Green)
i
ofagentspotentiallyabletoperforma. Theevolutionofthe and“R”(Red))ofthetrafficlights,locatedatbothsidesofthe
agenti’slocalstatesisdescribedbythe(transition)function tunnel, to let the trains enter and leave the tunnel. Initially,
t :L ×Act →L such that t (l ,(cid:15) )=l for each l ∈L . the trains are in state“W”(Waiting) and the controller is
i i i i i i i i i i
Note that t is a function of agent i’s local action only. in state“G”. In the figure the transitions with the same label
i
Aglobalstateg=(l ,··· ,l )∈L ×···×L isann-tuple are synchronised and the (cid:15) actions are omitted.
1 n 1 n
of local states for all the agents in the MAS and represents
2.2 TemplateAgentandParameterisedInter-
thestateofthesystemataparticularinstanceoftime. Given
leavedSystems
aglobalstateg=(l ,...,l ),wewriteg todenotethelocal
1 n i
component l of agent i ∈ A in g. Given a set of agents Several protocols are designed for an unbounded number
i
J ={j ,...,j }⊆A, we write g to denote the tuple of of identical participants. Cache coherence, mutual exclu-
1 |J| J
local components (l ,...,l ) of agents J in g. The local sion, and voting protocols are typical examples in which
j1 j|J|
protocols and the local evolution functions determine how the number of participants (caches, processes, and voters
the system proceeds from one global state to the next. respectively) is independent of the design process. A similar
occurrence happens in MAS with multi-party negotiation Definition 2.5. (ParameterisedInterleavedInterpre-
protocols, auctions and in open systems in general. In the ted Systems)Givenanaturalnumbern≥1andatemplate
followingwedevelopaformalmodelofaparameterisedmulti- agent T = (cid:104)L,ι,Act,P,t,h(cid:105), a parameterised interleaved
agent system, composed of an arbitrary number of identical interpretedsystem (PIIS), composed of n concrete agents, is
agents, that can be used in these circumstances. Given that a tuple T(n)=(cid:104)Gn,ιn,Πn,Vn(cid:105), where Gn =L×[n] is a set
the number of agents is a priori unknown, a parameterised of global states, ιn =(ι ,...,ι ) is an initial (global) state,
1 n
system describes an infinite family of systems where an in- Πn = (cid:91) Π(g) is the set of all interleaved paths originating
stanceinthefamily,orconcreteinstantiation,isobtainedby
g∈Gn
specifying the number of agents in the system. Formally, we fromallstatesinGn,andVn :Gn →℘(AP×A)isalabeling
introduce below parameterised interleaved interpreted sys- function defined by p ∈Vn(g) iff p ∈V (g(i)).
i i i
tems (PIIS), an extension of interleaved interpreted systems,
to model the aforementioned classes of systems. Given a template agent, the above definition denotes an
A PIIS is composed of an arbitrary number of identical infinite family of concrete systems. A member of the family,
agents. We write T(n) to denote a PIIS, where n≥1 is the which we call an instance of the parameterised system, is
parameterspecifyingthenumberofagents,eachconstructed obtained by fixing the value of the parameter n.
from a template agent T. The template agent is an inter-
leaved agent encoded with a set of synchronous actions and 2.3 TheSpecificationLanguageIACTL∗K
−X
a set of asynchronous actions. As it will be clear below, if
The analysis of an agent’s behaviour in a MAS has been
the action performed in a global transition is a synchronous
widely explored using combinations of linear and branching
action, then all agents participate in the global action by
time logics with knowledge. These logics allow us to express
performing the same (synchronous) action. However, if the
how an agent’s knowledge evolves over time. However, we
action performed in a global transition is an asynchronous
cannot use propositional temporal-epistemic logics to reason
action, then exactly one agent participates in the global ac-
aboutanunboundednumberofagents. Toseethis,consider
tion. Therefore, all agents synchronise at any time step in
the parameterised variant of the Train-Gate-Controller and
which a synchronous action is performed.
suppose that we want to express the property: “for every
Definition 2.4. (TemplateAgent)Givenasetofpropo- i ∈ A, whenever i is in the tunnel, then it knows that no
othertrainisinthetunnelatthesametime”. Thisproperty
sitionsAP,a templateagentisatupleT =(cid:104)L,ι,Act,P,t,h(cid:105),
encodes all distinct pairs of trains. Therefore, to express
where L is a finite nonempty set of template states from
the property for a TGC composed of n trains we need to
which ι ∈ L is the unique initial template state, Act =
ActS∪ActA∪(cid:15)isafinitesetoftemplateactions,whereActS construct a (long) formula composed of 2!(cid:0)n2(cid:1) conjuncts. In
isasetofsynchronousactions,ActA isasetofasynchronous general we would like to express properties that are inde-
actions, and ActS∩ActA∩{(cid:15)}=∅, P :L→℘(Act) is the pendent of the number of agents in the system, as if we
were able to quantify over agents. To overcome these short-
protocol such that for all l ∈L, (cid:15)∈P(l), t:L×Act→L
comings we introduce the indexed temporal-epistemic logic
is the (deterministic) template evolution function such that
IACTL∗K . Indexed logics are commonly used in parame-
for all l ∈ L, t(l,(cid:15)) = l, and h : L → ℘(AP) is a labeling −X
terised systems [8]; therefore, an indexed temporal-epistemic
function for the template states.
logic is a natural choice for reasoning about parameterised
Given a template agent T, T(n) denotes the parallel com- MAS.
position of n concrete agents1 A={1,··· ,n}. Each agent IACTL∗K adds indexed epistemic modalities to the
−X
i ∈ A is obtained by subscripting the states and actions universal fragment of CTL∗ [4] (the logic CTL∗, without
−X
of T as follows: Li = L×{i}, Acti = ActS ∪ActAi ∪(cid:15)i, thenext-timeoperator,extendedwithindexedatomicpropo-
where ActA =ActA×{i}; synchronous template actions are sitions). We consider a stuttering-insensitive logic (i.e., a
i
not subscripted. For a concrete action a ∈ Acti, we write logic insensitive to repeated occurrences of the same state,
tl(a) to refer to the corresponding template action; analo- or equivalently a logic without the next-time operator [5]),
gously, for a concrete state li ∈Li, we write tl(li) to refer since the next-time operator can be used to count the num-
to the corresponding template state l. The local protocol ber of agents in the system [4, 9] leading the parameterised
Pi :Li →℘(Acti) of the i-th agent is defined by a∈Pi(li) verification problem to undecidability [9].
iff tl(a)∈P(l). The evolution function ti :Li×Acti →Li Intuitively, any IACTL∗K−X formula ϕ represents an
of the i-th agent is defined by ti(li,a)=li(cid:48) iff t(l,tl(a))=l(cid:48). ACTL∗K−X formula for each concrete system T(n), n≥c,
We associate with each i ∈ A a local labeling function where c is the number of unique indices contained in ϕ; the
Vi :Li →℘(AP×{i}) defined by pi ∈Vi(li) iff p∈h(l). formula corresponding to T(n) is the conjunction of all for-
TheglobaltransitionsweconsiderinPIISareasinDefini- mulae that can be constructed from ϕ by instantiating the
tion 2.1. A global transition from a global state g complies indices with every c-tuple of distinct agents in T(n).
with the definition if either a synchronous action is enabled
for all agents in g or an asynchronous action a ∈ Act 2.3.1 SyntaxandsemanticsofIACTL∗K
i i −X
is enabled for an agent i ∈ A in g. Indeed, if a ∈ ActS, We assume a set VS of variable symbols which we use to
then Agent(a) = A; if ai ∈ ActAi , for some i ∈ A, then index the atomic propositions and the epistemic modalities.
Agent(a) = {i}. Therefore, synchronous actions play the There are two types of formulas in IACTL∗K : (i) state
−X
role of shared actions in IIS, only that synchronous actions formulas which are true at a state and (ii) path formulas
are shared by all agents. We now define parameterised inter- which are true on a path.
leaved interpreted systems.
1When it is clear from the context, we write“agent”instead Definition 2.6. (Syntax of IACTL∗K−X) The state
of“concrete agent”. and path formulae of IACTL∗K over a set AP of proposi-
−X
tionsandasetVS ofvariablesymbolsareinductivelydefined Definition 2.8. (Satisfaction) Let T(n)=(cid:104)G,ι,Π,V(cid:105)
as follows: be a parameterised interleaved interpreted system, let π =
g1,a1,g2,... be a path of T(n), let g∈G be a state of T(n),
• S1. if p∈AP and v∈VS, then p and ¬p are state
v v andletϕbeanIACTL∗K formula. Satisfactionofϕatg,
formulas; −X
denoted (T(n),g)|=ϕ, or simply g|=ϕ, and satisfaction of
• S2. if ϕ and ψ are state formulas, then ϕ∧ψ, ϕ∨ψ ϕ on π, denoted (T(n),π)|=ϕ, or just π|=ϕ, is inductively
and K ϕ (v∈VS) are state formulas; defined as follows:
v
• S3. if ϕ is a state formula which contains exactly
S1. g|=p iff p ∈V (g );
(cid:86) i i i i
J ⊆VS variablesymbols, then ϕisastateformula;
J g|=¬pi iff not g|=pi, for pi ∈AP×A;
• S4. ifϕisapathformula,thenA(ϕ)isastateformula; S2. g|=ϕ∧ψ iff g|=ϕ and g|=ψ;
g|=ϕ∨ψ iff g|=ϕ or g|=ψ;
• P1. any state formula ϕ is also a path formula; g|=K ϕ iff g(cid:48) |= ϕ for every g(cid:48) ∈ G such
i
that g =g(cid:48);
• P2. ifϕandψ arepathformulas, thenϕ∧ψ andϕ∨ψ i i
(cid:86)
S3. g|= ϕ(J) iff g|=ϕ(C)foreveryC ∈{I |I ⊆
are path formulas; J
A and |I|=|J|};
• P3. if ϕ and ψ are path formulas, then U(ϕ,ψ) and S4. g|=Aϕ iff π|=ϕforeverypathπsuchthat
R(ϕ,ψ) are path formulas. π(1)=g;
(cid:86) P1. π|=ϕ iff π(1)|=ϕ for any state formula
The connective serves as a universal agent quantifier
J ϕ;
ranging over all |J|-tuples of pairwise distinct agents. Given
P2 π|=ϕ∧ψ iff π|=ϕ and π|=ψ;
a formula ϕ, a variable v ∈ VS, occurring in ϕ, is said to
(cid:86) π|=ϕ∨ψ iff π|=ϕ or π|=ψ;
be bound if it is in the scope of a connective; otherwise,
J P3 π|=U(ϕ,ψ) iff thereisani≥1suchthatπ[i]|=
v is said to be free. A formula in which there are no free
ψ andπ[j]|=ϕforall1≤j <i;
occurrences of variables is said to be a sentence. The logic
π|=R(ϕ,ψ) iff for every i, if π[j] (cid:50) ϕ, for all
IACTL∗K consists of the set of all path sentences. For
−X 1≤j <i, then π[i]|=ψ.
an IACTL∗K formula ϕ, we write ϕ(J) to indicate that:
−X
(i) all variables in J ⊆ VS and only them occur free in def def
ϕ, and (ii) ϕ does not contain any (cid:86) connectives. The We use the following abbreviations: (cid:62) ≡ pv∨¬pv, ⊥ ≡
J def
path quantifier A stands for“for all paths”. The temporal pv ∧¬pv, for some p ∈ AP and v ∈ VS, Fϕ ≡ U((cid:62),ϕ)
operatorsU andRstandfor“until”and“release”respectively; def
(“Eventuallyϕ”), Gϕ ≡ R(⊥,ϕ)(“Alwaysϕ”). Aformulaϕ
the formula U(ϕ,ψ) is read as“ϕ holds continuously until
issaidtobetrueinT(n),denotedT(n)|=ϕ,iff(T(n),ι)|=
ψ holds”, whereas the formula R(ϕ,ψ) is read as“ϕ releases
ϕ. Given a PIIS T(n) = (cid:104)G,ι,Π,V(cid:105) be a parameterised
ψ”. The operator K denotes the epistemic modality; Kvϕ interleaved interpreted system and ϕ be an IACTL∗K
−X
is read as“each concrete agent i ∈ A knows ϕ”(since we
formula, the model checking problem concerns establishing
(cid:86)
considersentencesonly,visalwaysboundbya connective;
J whether (T(n),ι)|=ϕ.
therefore v ranges over all agents).
Consider the TGC again; we can now easily express the 2.3.2 SymmetryreductiontoACTL∗K
−X
properties previously stated with the IACTL∗K formula
−X Symmetry reduction techniques have been used to reduce
(cid:86)
AG(inTunnel →K ¬inTunnel ).
{v,u} v v u thecomplexityofmodelcheckingtemporal-epistemicproper-
Thespecificationsweconsiderinthispaperareoftheform
ties of multi-agent systems [6]. Since a PIIS is composed of
(cid:86)
ϕ(J). Since these formulas range over all |J|-tuples of
J identical agents, intuitively, there is an inherent symmetry
distinct agents, a standard model checking procedure would
in the system that we can exploit. Indeed, we adapt a sim-
have to consider every instantiation of ϕ(J). However, a
ilar result for reactive systems from [11] and we show that
(cid:86)
rIAesCulTtLw∗eKobtaicnanisbtehartedmuocdedeltcohemckodinegl cahfeocrkminuglaa sJinϕg(leJ)in∈- an IACTL∗K−X formula (cid:86)Jϕ(J) is equivalent to a single
−X instantiation ϕ({1,...,|J|}) of ϕ(J).
stantiation of ϕ(J), thereby simplifying the complexity of
the model checking procedure. Note that an instantiation of Lemma 2.9. T(n)|=(cid:86) ϕ(J) iff T(n)|=ϕ({1,...,|J|}).
ϕ(J) is an ACTL∗K formula, built as follows: J
−X Proof. (Sketch)(⇒)Obvious. (⇐)SupposethatT(n)|=
Definition 2.7. ACTL∗K−X formulae over a set AP of ϕ({1,··· ,k}) and let J(cid:48) ={j1,··· ,jk} be an arbitrary set
atomic propositions and a set A of agents are defined as in ofk agents. Letζ :A→Abeabijectivemapping(permuta-
Definition 2.6 but omitting (S3) and replacing (S1) and (S2) tion) such that ∀i∈{1,··· ,k}:π(i)=j . Given an object
i
with: S1’. if p∈AP and i∈A, then pi and ¬pi are state o (either a state or a formula), let ζ(o) denote the object o(cid:48)
formulas; S2’. if ϕ and ψ are state formulas, then ϕ∧ψ, obtainedbyreplacingeachoccurrenceofanyi∈Awithζ(i).
ϕ∨ψ and Kiϕ (i∈A) are state formulas; As g→a g(cid:48) is iff ζ(g)ζ→(a)ζ(g(cid:48)), and g =g(cid:48) is iff (ζ(g)) =
i i ζ(i)
For an ACTL∗K formula ϕ, we write ϕ(J) (J ⊆A) to (ζ(g(cid:48))) , we get that (T(n),ζ(ι))|=ζ(ϕ({1,··· ,k}), and
−X ζ(i)
indicate that for each subformula K ψ and each proposition therefore (T(n),ζ(ι)) |= ϕ(J(cid:48)). As ζ(ι) = ι, we get that
i
p of ϕ we have that i,j ∈J. We write ACTL∗KJ for the (T(n),ι)|=ϕ(J), therefore T(n)|=(cid:86) ϕ(J).
j −X J
restriction of ACTL∗K to all path formulae of the form
−X
ϕ(J). We interpret IACTL∗K formulae over PIIS. The Given a system instance T(c), model checking a formula
treemlaptioornalamndodtahlietieepsiasrteeminitcermproe−dtXeadlitoiveesratrheeignltoebraplrtertaendsiotvioenr (cid:86)moJdϕe(lJc)heisckeiqnugivaanleAntC(TbyL∗tKhe−XsemfoarnmtuiclsaooffIcA!(cid:0)C|JcT|(cid:1)L∗cKon−jXun)cttos
the equality of the local components of the global states. of the form ϕ(C), where C ∈{I |I ⊆{1,··· ,c} and |I|=
|J|}. The above lemma heavily reduces the complexity of It follows that if we are able to show that the cutoff in-
modelcheckingIACTL∗K formulaebyreducingthec!(cid:0)c(cid:1) stanceT(c)isJ-stutteringequivalenttoanarbitrarysystem
−X |J|
conjuncts to one. For example, model checking the formula instance T(n), then we can use T(c) to check whether a for-
(cid:86){v,u}AG(inTunnelv →Kv¬inTunnelu) can be reduced mula(cid:86)Jϕ(J)∈IACTL∗K−X holdsforanarbitrarynumber
to model checking the simpler formula AG(inTunnel → of agents.
1
K ¬inTunnel ).
1 2
3. MODELCHECKINGPARAMETERISED
2.3.3 InvarianceofACTL∗K
−X INTERLEAVEDINTERPRETEDSYSTEMS
As noted above, the idea of cutoff techniques in reactive
We now present a technique for model checking param-
systems is to find a system instance, called the cutoff in-
eterised interleaved interpreted systems. In particular, we
stance, which can be used to show that a property holds for
propose an efficient and automated methodology for answer-
all instances. A notion of equivalence between the system
ing the following verification query:
instances can be of help here. Stuttering-insensitive logics
are accompanied with the standard notion of stuttering sim- ∀n≥|J|:T(n)|=ψ, where ψ=(cid:94)ϕ(J)∈IACTL∗K
−X
ulation[18]. Asystemstutteringsimulatesanothersystemif
J
foreverybehaviourofthelatter,thereisastutteringequiva-
In other words, we want to be able to check that for any
lent behaviour of the former. Informally, two behaviours are
number n≥|J|ofagentsinthesystem,andforany|J|-tuple
stuttering equivalent if the behaviours coincide when each
C ofdistinctagents,thepropertyϕ(C)holds. Notethatthe
sequence of stutter steps (i.e., steps that do not affect the
number of systems we wouldlike to verify is unboundedand
labeling of the states) are collapsed to one step. Since we
so is, in principle, the state space of the systems themselves.
consider only universal path quantification, it follows that
any ACTL∗ formula satisfied by the simulating model is Therefore, traditional techniques to handle the state explo-
−X
sion problem cannot be of help here, and therefore we need
also satisfied by the simulated model. Below we extend the
notion of stuttering equivalence to ACTL∗K . Since our touseadifferentapproachtoreducethestatespace. Thekey
−X
observation is that in certain circumstances it is sufficient to
specifications are of the form ϕ(J), referring only to agents
analyseonlyafinitenumberofsystemstodeduceproperties
J ⊆A,weprojectthevaluationfunctionontoJ. Thisprojec-
about any larger system. Inspired by the work on cutoffs in
tion,denotedV| ,isdefinedbyV| (g)=V(g)∩{p |i∈J},
J J i
thecontextofreactivesystems[8,10,14],wesaythataMAS
for every state g∈G.
cutoff c is a value of the system parameter for which the
Definition 2.10. (J-Stuttering simulation) system instance T(c) exhibits all the behaviour admitted by
A relation ∼ ⊆G×G(cid:48) is a J-stuttering simulation be- any system instance T(n), n≥c, with respect to a certain
Jss
tween two models M=(cid:104)G,ι,Π,V(cid:105) and M(cid:48) =(cid:104)G(cid:48),ι(cid:48),Π(cid:48),V(cid:48)(cid:105) specification ψ being considered.
if the following conditions hold:
Definition 3.1. (MAS Cutoff) Let T(n) be a parame-
1. ι∼Jss ι(cid:48); terisedinterleavedinterpretedsystemandletψ∈IACTL∗K−X
(cid:86)
be of the form ϕ(J). A natural number c≥|J| is said to
2. if g∼ g(cid:48) then J
Jss be a MAS cutoff for ψ if T(c)|=ψ⇔∀n≥c:T(n)|=ψ.
(a) if g = g1, for i ∈ J, then g(cid:48) = g(cid:48)1 for some g(cid:48)1
i i i i
such that g1 ∼ g(cid:48)1; It follows that if a cutoff can be identified, then model
Jss
checking an infinite family of systems can be reduced to
(b) V| (g)=V| (g(cid:48)) and for every path π of M that
J J model checking all system instances up to the cutoff. In
starts at g, there is a path π(cid:48) of M(cid:48) that starts
reactivesystemsthecutoffusuallydependsonthesystemat
at g(cid:48), a partition B ,B ... of π, and a partition
1 2 hand and identification methodologies are typically accom-
B(cid:48),B(cid:48),... of π(cid:48) such that for each j ≥1, B and
1 2 j panied by the following shortcomings: (i) either the cut-off
B(cid:48) arenonemptyandfinite, andeverystateinB
j j isnotguaranteedtobethesmallest[8,10],or(ii)thecut-off
is related by ∼ to every state in B(cid:48).
Jss j is not guaranteed to exist leading to incomplete methodolo-
A model M(cid:48) J-stuttering simulates a model M, denoted gies[14]. Bycontrast,weherepresentasoundandcomplete
M ≤ M(cid:48), if there is a J-stuttering simulation between methodology for identifying the smallest cutoff in model
M anJdssM(cid:48). Two models M and M(cid:48) are called J-stuttering checking PIIS. Indeed, the following lemma shows that the
simulation equivalent if M≤Jss M(cid:48) and M(cid:48) ≤Jss M. Any smallest cutoff for an ACTL∗K{−1X,...,k} formula ϕ is precisely
ACTL∗KJ formula is preserved under J-stuttering simula- k, the total number of agents appearing in the epistemic
−X
tion equivalence. modalities and the propositions. Following this lemma, we
use Lemma 2.9 to show that the cutoff for IACTL∗K
−X
Theorem 2.11. LetMandM(cid:48) betwoJ-stutteringsimu- formulae of the form (cid:86) ϕ(J) is |J|.
J
lation equivalent models. Then, (M,ι)|=ϕ iff (M(cid:48),ι(cid:48))|=ϕ,
for any ACTL∗KJ formula ϕ. Lemma 3.2. If ϕ({1,...,k}) is an ACTL∗K{1,...,k} for-
−X −X
Proof. Stuttering simulation equivalence is known to mula, then T(n)|=ϕ({1,...,k}) iff T(k)|=ϕ({1,...,k}),
for all n≥k.
preserve ACTL∗ formulae [18]. Since atomic propositions
−X
inACTL∗J formulaereferonlytoagentsJ ⊆A,J-stuttering Proof. Choose an arbitrary n≥k. Let [n]={1,...,n}
−X
simulation equivalence preserves ACTL∗−JX formulae. Using and[k+1,n]=[n]\[k]. WeshowthatT(n)≤[k]ss T(k)and
induction on the structure of ϕ it is easy to show that J- T(k)≤[k]ss T(n). The lemma then follows.
stutteringsimulationequivalencealsopreservesACTL∗KJ−X (⇒(T(n)≤[k]ss T(k)))Definearelation∼[k]ss={(g,g(cid:48))∈
formulae. Gn×Gk |g =g(cid:48)}. We show that ∼ is a [k]-stuttering
[k] [k]ss
simulationbetweenT(n)andT(k). Letg∼ g(cid:48). Suppose Corollary 3.4. Modelcheckingparameterisedinterleaved
[k]ss
thatg =g1 forsomei∈[k]andletg(cid:48)1 =g1 . Wehavethat interpreted systems against IACTL∗K formulae of the form
i i [k] (cid:86)
gi(cid:48) =gi(cid:48)1 and g1 ∼[k]ss g(cid:48)1. Now let π=g1a1g2a2g3..., g1 = Jϕ(J) is decidable.
g,beapathofT(n)originatingfromg. Weconstructapath Proof. By Theorem 3.3, it suffices to model check the
ρ of T(k) originating from g(cid:48) as required by [k]-stuttering system instance of |J| agents against ϕ([|J|]).
simulation. Let ρ = g1 a(cid:48)1g2 a(cid:48)2g3 ..., where a(cid:48)j = aj if
[k] [k] [k]
aj ∈ (cid:83) Act and a(cid:48)j = (cid:15) otherwise, be the sequence The above is in line with literature in reactive systems [3,
i∈[k] i 8, 10, 9], where although it has been shown that verification
obtained by the projection of π onto [k]. By assumption on
ofparameterisedsystemsis,ingeneral,undecidable[2],posi-
the joint silent action, ρ is a valid path of T(k). We define
tive results have been obtained by imposing restrictions on
a partition B ,B ,... of π and a partition B(cid:48),B(cid:48),... of ρ
1 2 1 2 the systems and the properties, thereby obtaining decidable
such that |B | = |B(cid:48)| = 1 for each j ≥ 1. It follows that
j j subclasses.
B ∼ B(cid:48) for each j ≥1. Therefore, T(n)≤ T(k).
j [k]ss j [k]ss
(⇐(T(k)≤ T(n))) The idea is to allow every agent
[k]ss 4. ANEXAMPLE:AUTONOMOUSROBOT
i∈[k+1,n] in T(n) to mimic agent 1 (in T(n)). For this
purpose, define a relation ∼ by Forillustrationpurposesweexemplifythetheorypresented
[k]ss
aboveonamodifiedversionoftheautonomousrobotexample
(cid:110)
(g,g(cid:48))∈Gk×Gn |g=g(cid:48) ∧∃a∗ ∈ActA :∀i∈[k+1,n]: from [12]. In this example a robot runs along an endless
[k]
straight track where its position is specified over discrete
(cid:0)a∗ ∈P (g(cid:48))∧tl(t (g(cid:48),a∗))=tl(g(cid:48))(cid:1)∨tl(g(cid:48))=tl(g(cid:48))(cid:9)
i i i i i i 1 i 1 locations numbered 0,1,2,···. The robot can move only
If g ∼ g(cid:48), then each agent i ∈ [k+1,n] in g(cid:48) is ei- forward along the track starting at position 0. A faulty
[k]ss
ther at the same local state with agent 1 in g(cid:48) or agent i sensor is attached to the robot measuring its position; a
is able to change its state to the state of agent 1 by per- sensor reading at location q can be any of the values in
forming the asynchronous action a∗i. We show that ∼[k]ss Rq ={q−1,q,q+1}. Themovementoftherobotiscontrolled
is a [k]-stuttering simulation between T(k) and T(n). Let bytheenvironment. Theonlyactiontherobotcanperformis
g∼ g(cid:48). Simulation requirement 2(a) follows by a similar tohalt;iftherobotdoesnothalt,theenvironmentmaymove
[k]ss
argument used in the left to right direction of the lemma. the robot one position forward at each time step; once the
For simulation requirement 2(b), note that since the global robothalts,theenvironmentcannolongermoveit. Thegoal
evolution function is deterministic, a path g1a1g2a2··· is of the robot is to never exit the goal region GR={2,3,4}
uniquely defined by the sequence g1a1a2···. We inductively upon entering into it and to never halt in the restricted
define a function f which maps a path ρ=g1a1g2a2g3···, region RR={0,1} . A sound and complete solution to the
g1 =g, in T(k) into a path in T(n). autonomousrobotproblem[12]isfortherobottodonothing
while the value of its sensor is less than 3, and to halt once
• f(g1a1g2a2g3···) = g(cid:48)a∗ ...a∗ f(a1g2a2g3), where the value of its sensor is greater than or equal to 3. We
{j ···j }={i∈[k+1,nj]1|tl(gj(cid:48))d(cid:54)=tl(g(cid:48))}; generalise this problem in a parameterised setting.
1 d i 1
We assume an arbitrary number of robots each running
• f(a1g2a2g3···)=a1f(a2g3···), if a1 ∈/ ActA;
1 along its own track and each equipped with its own faulty
• f(a1g2a2g3···)=a1tl(a1) ···tl(a1) f(a2g3···), if sensor. The environment may move all non-halted robots
k+1 n
a1 ∈ActA; one position forward at each time step. We represent this
1
scenario by means of PIIS. We arbitrarily choose eight
We partition π into singleton blocks B1,B2,··· and we distinctlocations;notethatthenumberoflocationsdoesnot
partitionf(π)=g1a1···intothesequenceB(cid:48),B(cid:48),···,where affectthescenarioaslongasitisgreaterthanfour. Sincewe
1 2
Bi(cid:48) = gj, if aj−1 ∈ (cid:83)z∈[2,k]Actz, and Bi(cid:48) = gj···gj+d, if use interleaving semantics, we assume that the environment
aj−1,··· ,aj+d−1 ∈(cid:83) Act andaj+d ∈(cid:83) Act . moves each robot in sequence, however, we insist on the
z∈{1}∪[k+1,n] z z∈[k] z
ItfollowsthatB ∼ B(cid:48),therefore,T(k)≤ T(n). environment to move all robots before moving a robot twice.
j [k]ss j [k]ss We proceed to define the template agent T. A template
A consequence of the above lemma is the following: state is a 4-tuple l = (p,s,h,m), where p and s represent
the position of the robot and the value of its sensor respec-
Theorem 3.3. Let ψ be an IACTL∗K−X formula of the tively, h represents whether or not the robot has halted,
(cid:86)
form ϕ(J). Then, ∀n≥|J|:T(n)|=ψ iff T(|J|)|=ψ. and m is a binary variable representing whether or not
J
Proof. By exploiting symmetry (Lemma 2.9), it suffices the environment has moved the robot in an interleaving
to prove the result for ϕ([|J|]) (Lemma 3.2). sequence (a sequence in which the environment moves all
non-halted robots from position q to q +1). Therefore,
The above theorem is our main theoretical result. It fol- L={(p,s,h,m)|0≤p,s≤7 and h,m∈{(cid:62),⊥}}istheset
(cid:86)
lowsthattoverifyaformula ϕ(J)onallsysteminstances, of template states from which we define ι=(0,0,⊥,⊥) as
J
itsufficestoverifytheformulaϕ([J])forthesysteminstance the initial template state. A robot can either do nothing
T(|J|). Since in the MAS literature most properties are or halt; the set ActA of asynchronous template actions is
expressed by using one or two epistemic and propositional ActA = {null,null+, null−,halt}; the null actions repre-
indices, this dramatically improves our verification abilities. sent the environment moving the robot a position forward
Furthermorewecancombinethistechniquewithothersavail- and either providing a correct sensor reading (null) or not
able in the literature. Indeed, upon obtaining the instance (null+,null−). A robot can move to position q+1 only if
T(|J|) we can further apply partial order reductions [16], all non-halted robots have moved to position q; the unique
abstraction [7], data symmetry reduction [6], etc., to further synchronoustemplateactionn s(nextstep)synchronisesall
reduce the state space of the model. robots before the environment can move a robot. As it will
be clear below, when a null action is performed at position Model Instantiations Time(s) Memory(KiB)
q, then m is set to (cid:62) and the protocol selects the action n s Robots States
.
thereby disallowing a robot to move at position q+1 before 2 201 2 0 9010
all robots have moved to position q. 3600 13..2569049022××11002577 3857400 81688 6348497440432
The template protocol P selects one of the null actions 90 timeout 8010 timeout timeout
at position q when m = ⊥ and the sensor reading is less
than 3. The synchronous action n s is the only allowed Table 1: mcmas verification results for ϕAR3.
action when m = (cid:62). Whenever the sensor reading is
mcmas [17]. The extended model checker, currently named
greater than 2, the halting condition is satisfied, therefore,
mcmas-p, is available from [1]. ISPL, the input language of
the protocol selects the halt action: P((p < 7,s < 3,h =
⊥,m = ⊥)) = {null,null+,null−}; P((p = ∗,s = ∗,h = mcmas, was suitably extended to allow for the definition of
PIIS and to support the specification of indexed formulae.
∗,m = (cid:62))) = {n s}; P((p = ∗,s ≥ 3,h = ⊥,m = ⊥)) =
ThedescriptionofaPIISinthislanguage(calledPISPL)in-
{halt},where∗expressesanyvalue. Thetemplateevolution
cludes the declaration of a template agent. This declaration
function contains the following transitions: (p,s,⊥,⊥)n→ull
differs from agent declarations in ISPL by having sections of
(p+1,p+1,⊥,(cid:62)); (p,s,⊥,⊥) nu→ll+ (p+1,p+2,⊥,(cid:62)); asynchronous and synchronous actions, and an initial state
(p,s,⊥,⊥)nu→ll− (p+1,p−1,⊥,(cid:62));(p,s,⊥,(cid:62))n→s(p,s,⊥,⊥) section. We refer to [1] for the PISPL description of the
autonomous robot example. The specifications supported by
and (p,s,⊥,⊥)h→alt(p,s,(cid:62),(cid:62)). mcmas-p are expressed in indexed ACTLK .
−X
We introduce the following atomic propositions: AP = Given a PIIS and a formula to be verified, mcmas-p de-
{h(halted),g(goal region),r(restricted region)}. The inter- termines the cutoff c for the system as in Theorem 3.3 by
pretation of these propositions is given by the following counting the number of unique indices used in the specifi-
valuation function: V(h) = {l ∈ L | l3 = (cid:62)}, V(g) = {l ∈ cation to be tested. A concrete system of c agents, each an
L|2≤l1 ≤4}, and V(r)={l∈L|0≤l1 ≤1}. indexed copy of the template agent, is then automatically
Weverifythatthehaltingconditionissoundandcomplete constructedandrepresentedsymbolically. Thespecifications
in the parameterised variant of the autonomous robot by are automatically reduced to formulae in ACTLK , as de-
(cid:86) −X
model checking the formulae ϕAR1 = {i}AG(gi →AG(gi)) scribed in Lemma 2.9. The OBDD-based algorithms utilised
and ϕ = (cid:86) AG(r → ¬h ). The specification ϕ by mcmas are then used to verify the system against the
AR2 {i} i i AR1
expresses“for every robot i, if i is within the goal region, reduced ACTLK−X formulae. We also note that the BDD
theni neverexitsthe goal region”. The formulaϕ states encodingofthejointprotocolisdifferentfromthatof mcmas
AR2
that“for every robot i, if i is within the restricted region, to enforce the interleaving semantics used here.
then i has not halted”. Note that the combined state space ExperimentalResults. Inordertoevaluatethemethod-
for the systems to be checked is unbounded. Observe also ology presented, we illustrate the unfeasibility of running
that model checking the above specifications is equivalent model checking algorithms on each concrete system instance.
to model checking the formulae AG(g → AG(g ))∧···∧ Weconsideredtheparameterisedautonomousrobotscenario
1 1
AG(gn →AG(gn))andAG(r1 →¬h1)∧···∧AG(rn →¬hn), against the specification ϕAR3 which we verified on an Intel
on each system instance T(n), n ≥ 1. This is clearly not Core i7processor clockedat 2.20 GHz, with6144 KiBcache,
possible to check via standard model checking techniques. and running 64-bit Fedora 17, kernel 3.3.4. The results are
However, by using Lemmas 2.9 and 3.2 we can deduce that reported in Table 1. The Robots and States columns respec-
the MAS cutoff is equal to 1 and reduce the problem to tively show the system instance (number of robots) and its
checkingtheformulasAG(g →AG(g ))andAG(r →¬h ) state space; the Instantiations column shows the number of
1 1 1 1
on the system instance T(1). Clearly the latter is a simple the possible instantiations of ϕAR3, each to be verified by
problem and, indeed, we can easily check the specification is the model checker; the Time and Memory columns show
verified, thereby deducing that the parameterised query is the CPU time and memory usage respectively. These re-
also satisfied. sults show that, as expected, the state space and the length
To proceed in our analysis further, we can also verify of the formulae to be verified grow exponentially with the
that if a robot halts, then it knows that every other robot’s number of agents in the system. As a consequence of this,
positioniswithinthegoalregion,asexpressedbytheformula verification quickly becomes unfeasible under the time and
ϕ =(cid:86) AG(h →K g ). Also we could check that a memory constraints. This is exemplified for the system of
AR3 {i,j} i i j
robot knows that every other robot halted at the same time: 90 robots, where mcmas did not finish within the timeout
ϕ =(cid:86) AG(h →K h ). Similarlytowhatabove,the of one hour. In addition to this, of course, the plain model
AR4 {i,j} i i j
formulaeϕ andϕ canbereducedthroughLemma2.9 checking approach cannot ever ensure the property holds on
AR3 AR4
to ϕ(cid:48) =AG(h →K g ) and ϕ(cid:48) =AG(h →K h ), a system of arbitrary many agents. In comparison mcmas-p
AR3 1 1 2 AR4 1 1 2
which can be verified on the system instance T(2) obtained constructedandverifiedasystemof2robotsinunder0.1sec-
by using a cutoff equal to 2 through Lemma 3.2. Also in onds thereby showing the property holds for an unbounded
this case we can check the result on the much smaller model number of agents.
and verify that the formula ϕ(cid:48) holds while ϕ(cid:48) does
AR3 AR4
not (since the sensor readings may differ). So we infer that
6. CONCLUSIONSANDRELATEDWORK
ϕ holds on the unbounded system while ϕ does not.
AR3 AR4
Inthispaperwehavedevelopedatechniquetoverifythat
a temporal-epistemic property holds in a MAS irrespectively
5. EVALUATION
of the number of agents present in the system. The problem
Implementation. We have implemented the presented is undecidable in general but we have defined a suitable
methodologyasanextensiontotheopen-sourcemodelchecker semantics (that of PIIS) for which we gave a sound and
complete procedure for determining a cutoff for a system. [3] E. Clarke, M. Talupur, and H. Veith. Proving ptolemy
To do so we have defined a suitable parameterised logic and right: The environment abstraction framework for
developed stuttering-equivalence simulation results for it on model checking concurrent systems. In Proc. of
PIIS. We find the result significant as it opens the way for TACAS’08, pages 33–47. Springer, 2008.
the verification of a large number of protocols previously [4] E.M. Clarke, O. Grumberg, and M.C. Browne.
verified only for individual instances containing a limited Reasoning about networks with many identical finite
numberofagents. Opensystemswithanunboundednumber state processes. Inf. and Comput., 81(1):13–31, 1989.
ofhomogeneousparticipants,e.g.,includingnegotiationsand [5] G. Clarke, O. Grumberg, and D.A. Peled. Model
auctions, seem particularly suitable for this analysis. Checking. The MIT Press, 1999.
Related Work. Existingliteratureonparameterisedver- [6] M. Cohen, M. Dam, A. Lomuscio, and H. Qu. A
ification [3, 19, 21, 10, 8, 14] is limited to reactive systems symmetry reduction technique for model checking
and plain temporal logics. Moreover, mainstream method- temporal-epistemic logic. In Proc. of IJCAI’09, pages
ologies [10, 8, 14] do not guarantee soundness, completeness 721–726, 2009.
andtheidentificationofthesmallestcutoffatthesametime.
[7] M. Cohen, M. Dam, A. Lomuscio, and F. Russo.
In [14] a cutoff is identified by enumerating the system in-
Abstraction in model checking multi-agent systems. In
stances and finding the smallest instance able to simulate
Proc. of AAMAS’09, pages 945–952, 2009.
a“special”structure which includes the behaviour of every
[8] E. Emerson and V. Kahlon. Reducing model checking
instance. Although the technique is widely applicable and
of the many to the few. In CADE’00, pages 236–254.
independent of the communication topology, a cutoff is not
Springer, 2000.
guaranteed to exist. Results closer to those in this paper
[9] E.A. Emerson and V. Kahlon. Model checking guarded
are the sound and complete techniques put forward in [10,
protocols. In LICS’03, pages 361–370. IEEE, 2003.
8]. Similarly to this contribution, [10, 8] present stuttering-
[10] E.A. Emerson and K.S. Namjoshi. Reasoning about
simulationresultsbetweenthecutoffmodelandeverysystem
rings. In Proc. of POPL’95, pages 85–94. ACM, 1995.
instance thereby ensuring soundness and completeness; how-
ever,theresultsin[10]areapplicabletoringtopologiesonly [11] E.A. Emerson and A.P. Sistla. Symmetry and model
andthe techniquein[8]doesnotidentifythesmallestcutoff. checking. Formal methods in system design,
Inadditiontocutoffs,abstractiontechniqueshaveofcourse 9(1):105–131, 1996.
been used in parameterised verification. In [19] concrete [12] R. Fagin, Y. Moses, J.Y. Halpern, and M.Y. Vardi.
states are counter abstracted; an abstract state is a tuple of Reasoning about knowledge. The MIT Press, 2003.
counters, one for each local state, denoting the number of [13] P. Gammie and R. Van Der Meyden. Mck: Model
system participants in the state. This process can be auto- checking the logic of knowledge. In CAV, pages
mated, but it is only applicable to a narrow class of systems 256–259. Springer, 2004.
and it is restricted to liveness properties. Environmental [14] Y. Hanna, D. Samuelson, S. Basu, and H. Rajan.
abstraction [3] extends counter abstraction by counting the Automating cut-off for multi-parameterized systems. In
number of participants that satisfy a given predicate and, ICFEM’10, pages 338–354. Springer, 2010.
although achieving wider applicability, the methodology has [15] M. Kacprzak, W. Nabia(cid:32)lek, A. Niewiadomski, et al.
not been automated yet. In [21] a network invariant is iden- Verics 2007-a model checker for knowledge and
tifiedwhichexhibitsthebehaviourofallsysteminstances; if real-time. Fundam. Inform., 85(1):313–328, 2008.
the invariant satisfies a property, then the property is satis- [16] A. Lomuscio, W. Penczek, and H. Qu. Partial order
fied by all system instances. A network invariant, however, reductions for model checking temporal-epistemic logics
is not guaranteed to exist, and, even when it does, its identi- over interleaved multi-agent systems. Fundam. Inform.,
fication is not automated. In addition, none of these works 101(1):71–90, 2010.
tackle epistemic logic, nor MAS semantics, as we do here.
[17] A. Lomuscio, H. Qu, and F. Raimondi. Mcmas: A
Future Work. A current limitation of the PIIS formal-
model checker for the verification of multi-agent
ism is that agents cannot evolve differently depending on
systems. In CAV, pages 682–688. Springer, 2009.
the environment’s action. This limits the application of the
[18] W. Penczek, M. Szreter, R. Gerth, and R. Kuiper.
techniquetoparticularsystemssuchdifferentnetworktopolo-
Improving partial order reductions for universal
gies. In future work we plan to alleviate this limitation as
branching time properties. Fundam. Inform.,
well as apply the methodology here presented to protocols
43(1):245–267, 2000.
of practical interests.
[19] A. Pnueli, J. Xu, and L. Zuck. Liveness with (0,
1,infinity)-counter abstraction. In CAV, pages 93–111.
Acknowledgments.
Springer, 2002.
The research described in this paper is supported by the
[20] W. Van Der Hoek and M. Wooldridge. Tractable
EPSRC Research Project“Trusted Autonomous Systems”
multiagent planning for epistemic goals. In Proc. of
(grant No. EP/I00520X/1).
AAMAS’02, pages 1167–1174. ACM, 2002.
[21] P. Wolper and V. Lovinfosse. Verifying properties of
7. REFERENCES large sets of processes with network invariants. In
Automatic Verification Methods for Finite State
[1] MCMAS-P, Model Checking Parameterised
Systems, pages 68–80. Springer, 1990.
Multi-Agent Systems. http://tiny.cc/z25wlw.
[2] K.R. Apt and D.C. Kozen. Limits for automatic
verification of finite-state concurrent systems.
Information Processing Letters, 22:307–309, 1986.
