SS 2018 Software Verification Strategic Reasoning Prof. Dr. Holger Schlingloff 1,2 Dr. Esteban Pavese 1 (1) Institut für Informatik der Humboldt Universität (2) Fraunhofer Institut für offene Kommunikationssysteme FOKUS
Recap Syntax of TCTL? Semantics? Model checking? What is a region? What is a DBM?
Multi-Agent Systems Example: Robots and Carriage circular track, one carriage, two robots which can push if one robot pushes, the carriage moves in the corresponding direction if both robots push or no robot pushes, the carriage does not move
Models transition system for carriage M ⊨ EG+ pos1 M ⊨ EG+pos1 wait s0 on wait push s1 push on transition system for carriage M ⊨ EG+ pos1 M ⊨ EG+pos1 M ⊨ AG+EF+pos1 and for robots wait, push s0
Is CTL expressive enough? A: No matter which (enabled) transitions are taken, holds in the system E: There is a way to control the system such that holds EG+ pos1: There is a strategy to stay in pos1 EG+pos1: There is a strategy to avoid in pos1 Who is deciding what to do? What if robot 1 and robot 2 are independent agents (actors, players, …)? Robot 1 „wants“ to keep the cart in pos1 Robot 2 „wants“ to avoid that the cart is in pos1
New Modalities i : There is a strategy for robot i to enforce that holds, no matter what the other robot does M ⊭ 1 G+ pos1: There is no strategy for robot 1 to enforce that the cart stays in pos1 (robot 2 may always push it away) M ⊨ 2 G+pos1: There is a strategy for robot 2 to enforce that the cart avoids pos1, no matter what robot 1 does (in pos0 – push; in pos2 – wait) Valid or not? M ⊨ 1 F+ pos1 M ⊨ 1 G+pos1 M ⊨ 2 F+pos1 M ⊨ 2 ( pos0 U+ pos1) M ⊨ 1 G+( pos0 Xpos2)
Strategies What is a strategy, then? Need to extend the notion of a transition system A concurrent game structure is a tuple CGS = (Agt, St, Act, δ, s0) which consists of a finite set of agents or players Agt = {a1,…, an}, a non-empty set of states St, a set of individual actions Act, a transition relation δ St x 2(Agt x Act) x St that determines whether the successor state s’ is reachable from state s by a combined action α = {(a1, αa1), …, (an, αan)}, and an initial state s0 St. Example: Agt = {1,2}, St={q0, q1, q2}, Act={wait, push}, s0=q0, δ={(q0,(push, wait), q1), (q0,(push, push), q0), …}
Strategies Given a CGS, a (memoryless) strategy si for agent ai in a concurrent game structure is a function si: St Act. That is, a strategy tells an agent which action to choose in a particular state. A combined action α is consistent with the strategies {s1 … sk} for agents {a1 … ak} in state s if (ai, si(s)) α for all i. An execution following strategies {s1, …, sk} for agents {a1, …, ak} is an execution (s0, α0, s1, α1, …), where every αi is consistent with the strategies in si. Remark 1: Determinism, final states, acceptance, … Remark 2: Given strategies for all agents in a deterministic game structure, there is only one possible execution following these strategies.
Turn-based deterministic two-player games TDCGS = (Agt, St, Act, δ, s0, avail, turn), where (Agt, St, Act, δ, s0) CGS, i.e. has agents Agt = {a1, a2}, states St = Sta1 x Sta2, Act = Acta1 Acta2, s0St, transition relation δ: St x Act St; avail Agt x St x Act is an availability relation that defines whether an individual action is available to an agent at a state, turn: St Agt is a turn-function indication which players may act, and avail (aj, s) iff turn(s) = ai, for i{1,2}. Clearly, for each TDCGS there is an equivalent CGS (i.e., TDCGS are special CGS)
Example Train-Gate-problem: If out of gate, the train can issue a request The gate can grant or deny the request If granted, the train my move into the gate The gate can reopen after the train left
Properties Whenever the train is out of the gate and does not have a grant to enter the gate, the controller can prevent it from entering the gate: AG* ((out_of_gate ∧ ¬grant) → ctr G* out_of_gate) Whenever the train is out of the gate, the controller cannot force it to enter the gate: AG* (out_of_gate → ¬ ctr F* in_gate) AG* (out_of_gate → [[ ctr]] G* out_of_gate) Whenever the train is out of the gate, the train and the controller can cooperate so that the train will enter the gate: AG* (out_of_gate → ctr train F* in_gate) Whenever the train is out of the gate, it can eventually request a grant for entering the gate, in which case the controller decides whether the grant is given or not: AG* (out_of_gate → train F*(request ∧ ctr F* grant ∧ ctr G* ¬grant)) Whenever the train is in the gate, the controller can force it out in the next step: AG* (in_gate → ctr X out_of_gate).
Coalitions and ATL If there are more than two agents / players, some of them may want to build coalitions. Let Agt = {a1,…, an}, then ai, aj, ak means „agents ai, aj, and ak can collaborate to bring about “ (or something which is wirkungsgleich) Semantics: There is a common strategy for {ai, aj, ak} such that holds if this strategy is followed ATL::= p | | (ATL ATL) | A X ATL | A G * ATL | A (ATL U* ATL) where A Agt is a subset of all agents. CTL is a subset of ATL, where E = Agt and A = i.e., EF* = Agt F*, AG* = G* , etc.
ATL vs. CTL Consider the ATL formulas G* ((out_of_gate ∧ ¬grant) → ctr G* out_of_gate) G* (out_of_gate → [[ ctr]] G* out_of_gate) They provide more information than the CTL formula AG*(out_of_gate → EG* out_of_gate) While the CTL formula only requires the existence of a computation in which the train is always out of the gate, the two ATL formulas guarantee that no matter how the train behaves, the controller can prevent it from entering the gate, and no matter how the controller behaves, the train can decide to stay out of the gate. ATL: R. Alur, T. A. Henzinger, and O. Kupferman. Alternating-time Temporal Logic. Journal of the ACM, 49:672–713, 2002. Slides: https://pdfs.semanticscholar.org/presentation/75e1/bfb9cfd964f2723f76a609124d2ff467c3a6.pdf
Example Two robots {r1, r2} working in a factory with three machines {m1, m2, m3} Machines can be busy, or idle and waiting to be serviced by a robot Robots can be idle, or servicing a particular machine There can be at most one robot servicing a machine at any particular moment in time Model: Agt = {m1, m2, m3, r1, r2} St = {busy, idle}3 x {idle, serv1, serv2, serv3}2 Actions for the machines: {go_idle, go_busy} Actions for the robots: {go_idle, go_servi} Properties: There exists a strategy for the robots such that every machine is eventually served There exists a strategy for the machines such that always a machine is idle …
ATL model checking In principle, ATL MC is no harder than CTL MC The MC algorithms of ATL and CTL are very similar The function Pre, when given a set A of players and a set of states, returns the set of states q such that from q, the players in A can cooperate and enforce the next state to lie in .
Complexity of ATL MC Complexity is O(|M| * ||) This does not hold for ATL* (doubly exponential) Also other extensions (ATL with fairness, ATL with memory, ATL with real time, ATL with knowledge and belief, etc.) are all highly complex
Implementation: MCMAS MCMAS is an OBDD-based MC for MAS supports ATL with additional epistemic operators runs currently only on Linux-based systems (or VMs) Structure of an MCMAS agent: local states actions availability relations („protocol“) transition relation („evolution“) Structure of an ISPL program agents evaluation (for abbreviations in formulas) initial states groups (for abbreviations in formulas) fairness constraints ATL formulas to be checked