Aniello Murano

Reasoning About Strategies: On the Model-Checking Problem

In open systems verification, to formally check for reliability, one needs an appropriate formalism to model the interaction between agents and express the correctness of the system no matter how the environment behaves. An important contribution in this context is given by modal logics for strategic ability, in the setting of multiagent games, such as A<scp>tl</scp>, A<scp>tl</scp>*, and the like. Recently, Chatterjee, Henzinger, and Piterman introduced <i>Strategy Logic</i>, which we denote here by CHP-S<scp>l</scp>, with the aim of getting a powerful framework for reasoning explicitly about strategies. CHP-S<scp>l</scp> is obtained by using first-order quantifications over strategies and has been investigated in the very specific setting of two-agents turned-based games, where a nonelementary model-checking algorithm has been provided. While CHP-S<scp>l</scp> is a very expressive logic, we claim that it does not fully capture the strategic aspects of multiagent systems. In this article, we introduce and study a more general strategy logic, denoted S<scp>l</scp>, for reasoning about strategies in multiagent concurrent games. As a key aspect, strategies in S<scp>l</scp> are not intrinsically glued to a specific agent, but an explicit binding operator allows an agent to bind to a strategy variable. This allows agents to share strategies or reuse one previously adopted. We prove that S<scp>l</scp> strictly includes CHP-S<scp>l</scp>, while maintaining a decidable model-checking problem. In particular, the algorithm we propose is computationally not harder than the best one known for CHP-S<scp>l</scp>. Moreover, we prove that such a problem for S<scp>l</scp> is N<scp>on</scp>E<scp>lementary</scp>. This negative result has spurred us to investigate syntactic fragments of S<scp>l</scp>, strictly subsuming A<scp>tl</scp>*, with the hope of obtaining an elementary model-checking problem. Among others, we introduce and study the sublogics S<scp>l</scp>[<scp>ng</scp>], S<scp>l</scp>[<scp>bg</scp>], and S<scp>l</scp>[1<scp>g</scp>]. They encompass formulas in a special prenex normal form having, respectively, nested temporal goals, Boolean combinations of goals, and, a single goal at a time. Intuitively, for a goal, we mean a sequence of bindings, one for each agent, followed by an L<scp>tl</scp> formula. We prove that the model-checking problem for S<scp>l</scp>[1<scp>g</scp>] is 2E<scp>xp</scp>T<scp>ime</scp>-<scp>complete</scp>, thus not harder than the one for A<scp>tl</scp>*. In contrast, S<scp>l</scp>[<scp>ng</scp>] turns out to be N<scp>on</scp>E<scp>lementary</scp>-hard, strengthening the corresponding result for S<scp>l</scp>. Regarding S<scp>l</scp>[<scp>bg</scp>], we show that it includes CHP-S<scp>l</scp> and its model-checking is decidable with a 2E<scp>xp</scp>T<scp>ime</scp>lower-bound. It is worth enlightening that to achieve the positive results about S<scp>l</scp>[1<scp>g</scp>], we introduce a fundamental property of the semantics of this logic, called <i>behavioral</i>, which allows to strongly simplify the reasoning about strategies. Indeed, in a nonbehavioral logic such as S<scp>l</scp>[<scp>bg</scp>] and the subsuming ones, to satisfy a formula, one has to take into account that a move of an agent, at a given moment of a play, may depend on the moves taken by any agent in another counterfactual play.

The complexity of enriched µ-calculi

The fully enriched μ-calculus is the extension of the propositional μ-calculus with inverse programs, graded modalities, and nominals. While satisfiability in several expressive fragments of the fully enriched μ-calculus is known to be decidable and ExpTime-complete, it has recently been proved that the full calculus is undecidable. In this paper, we study the fragments of the fully enriched μ-calculus that are obtained by dropping at least one of the additional constructs. We show that, in all fragments obtained in this way, satisfiability is decidable and ExpTime-complete. Thus, we identify a family of decidable logics that are maximal (and incomparable) in expressive power. Our results are obtained by introducing two new automata models, showing that their emptiness problems are ExpTime-complete, and then reducing satisfiability in the relevant logics to this problem. The automata models we introduce are two-way graded alternating parity automata over infinite trees (2GAPT) and fully enriched automata (FEA) over infinite forests. The former are a common generalization of two incomparable automata models from the literature. The latter extend alternating automata in a similar way as the fully enriched μ-calculus extends the standard μ-calculus

What makes ATL* decidable? a decidable fragment of strategy logic

Strategy Logic (Sl, for short) has been recently introduced by Mogavero, Murano, and Vardi as a formalism for reasoning explicitly about strategies, as first-order objects, in multi-agent concurrent games. This logic turns out to be very powerful, strictly subsuming all major previously studied modal logics for strategic reasoning, including Atl, Atl*, and the like. The price that one has to pay for the expressiveness of Sl is the lack of important model-theoretic properties and an increased complexity of decision problems. In particular, Sl does not have the bounded-tree model property and the related satisfiability problem is highly undecidable while for Atl* it is 2ExpTime-complete. An obvious question that arises is then what makes Atl* decidable. Understanding this should enable us to identify decidable fragments of Sl. We focus, in this work, on the limitation of Atl* to allow only one temporal goal for each strategic assertion and study the fragment of Sl with the same restriction. Specifically, we introduce and study the syntactic fragment One-Goal Strategy Logic (Sl[1g], for short), which consists of formulas in prenex normal form having a single temporal goal at a time for every strategy quantification of agents. We show that Sl[1g] is strictly more expressive than Atl*. Our main result is that Sl[1g] has the bounded tree-model property and its satisfiability problem is 2ExpTime-complete, as it is for Atl*.

Dense real-time games

The rapid development of complex and safety-critical systems requires the use of reliable verification methods and tools for system design (synthesis). Many systems of interest are reactive, in the sense that their behavior depends on the interaction with the environment. A natural framework to model them is a two-player game: the system versus the environment. In this context, the central problem is to determine the existence of a winning strategy according to a given winning condition. We focus on real-time systems, and choose to model the related game as a nondeterministic timed automaton. We express winning conditions by formulas of the branching-time temporal logic TCTL. While timed games have been studied in the literature, timed games with dense-time winning conditions constitute a new research topic. The main result of this paper is an exponential-time algorithm to check for the existence of a winning strategy for TCTL games where equality is not allowed in the timing constraints. Our approach consists on translating to timed tree automata both the game graph and the winning condition, thus reducing the considered decision problem to the emptiness problem for this class of automata. The proposed algorithm matches the known lower bound on timed games. Moreover, if we relax the limitation we have placed on the timing constraints, the problem becomes undecidable.

Optimal-Reachability and Control for Acyclic Weighted Timed Automata

Weighted timed automata extend timed automata with costs on both locations and transitions. In this framework we study the optimal reachability and the optimal control synthesis problems for the automata with acyclic control graphs. This class of automata is relevant for some practical problems such as some static scheduling problems or air-traffic control problems. We give a nondeterministic polynomial time algorithm to solve the decision version of the considered optimal reachability problem. This algorithm matches the known lower bound on the reachability for acyclic timed automata, and thus the problem is NP-complete. We also solve in doubly exponential time the corresponding control synthesis problem.

Enriched mu--calculi module checking,

The model checking problem for open systems has been intensively studied in the literature, for both finite-state (module checking) and infinite-state (pushdown module checking) systems, with respect to Ctl and Ctl*. In this paper, we further investigate this problem with respect to the \mu-calculus enriched with nominals and graded modalities (hybrid graded Mu-calculus), in both the finite-state and infinite-state settings. Using an automata-theoretic approach, we show that hybrid graded \mu-calculus module checking is solvable in exponential time, while hybrid graded \mu-calculus pushdown module checking is solvable in double-exponential time. These results are also tight since they match the known lower bounds for Ctl. We also investigate the module checking problem with respect to the hybrid graded \mu-calculus enriched with inverse programs (Fully enriched \mu-calculus): by showing a reduction from the domino problem, we show its undecidability. We conclude with a short overview of the model checking problem for the Fully enriched Mu-calculus and the fragments obtained by dropping at least one of the additional constructs.

The Complexity of Enriched Mu-Calculi

The fully enriched μ-calculus is the extension of the propositional μ-calculus with inverse programs, graded modalities, and nominals. While satisfiability in several expressive fragments of the fully enriched μ-calculus is known to be decidable and ExpTime-complete, it has recently been proved that the full calculus is undecidable. In this paper, we study the fragments of the fully enriched μ-calculus that are obtained by dropping at least one of the additional constructs. We show that, in all fragments obtained in this way, satisfiability is decidable and ExpTime-complete. Thus, we identify a family of decidable logics that are maximal (and incomparable) in expressive power. Our results are obtained by introducing two new automata models, showing that their emptiness problems are ExpTime-complete, and then reducing satisfiability in the relevant logics to these problems. The automata models we introduce are two-way graded alternating parity automata over infinite trees (2GAPTs) and fully enriched automata (FEAs) over infinite forests. The former are a common generalization of two incomparable automata models from the literature. The latter extend alternating automata in a similar way as the fully enriched μ-calculus extends the standard μ-calculus.

MCMAS-SLK: A Model Checker for the Verification of Strategy Logic Specifications

Model checking has come of age. A number of techniques are increasingly used in industrial setting to verify hardware and software systems, both against models and concrete implementations. While it is generally accepted that obstacles still remain, notably handling infinite state systems efficiently, much of current work involves refining and improving existing techniques such as predicate abstraction.

Graded computation tree logic

In modal logics, graded (world) modalities have been deeply investigated as a useful framework for generalizing standard existential and universal modalities in such a way that they can express statements about a given number of immediately accessible worlds. These modalities have been recently investigated with respect to the mu-calculus, which have provided succinctness, without affecting the satisfiability of the extended logic, i.e., it remains solvable in ExpTime. A natural question that arises is how logics that allow reasoning about paths could be affected by considering graded path modalities. In this paper, we investigate this question in the case of the branching-time temporal logic CTL (GCTL, for short). We prove that, although GCTL is more expressive than CTL, the satisfiability problem for GCTL remains solvable in ExpTime. This result is obtained by exploiting an automata-theoretic approach. In particular, we introduce the class of partitioning alternating Büchi tree automata and show that the emptiness problem for them is ExpTime-Complete. The satisfiability result turns even more interesting as we show that GCTL is exponentially more succinct than graded mu-calculus.

Pushdown module checking

Model checking is a useful method to verify automatically the correctness of a system with respect to a desired behavior, by checking whether a mathematical model of the system satisfies a formal specification of this behavior. Many systems of interest are open, in the sense that their behavior depends on the interaction with their environment. The model checking problem for finite–state open systems (called module checking) has been intensively studied in the literature. In this paper, we focus on open pushdown systems and we study the related model–checking problem (pushdown module checking, for short) with respect to properties expressed by CTL and CTL* formulas. We show that pushdown module checking against CTL (resp., CTL*) is 2Exptime-complete (resp., 3Exptime-complete). Moreover, we prove that for a fixed CTL* formula, the problem is Exptime-complete.