F UNCIONES Y ACTIVIDADES DE MONITOREO Y EVALUACIÓN QUE REALIZA LA UNIDAD RESPONSABLE

Rao and Georgeff discussed the very first model-based theoretic approach to verify BDI-agent system [103]. In the paper, they defined three propositional BDI logic languages, CTL_BDI, CCTL_BDI(Committed CTL_BDI), and CTL^*_BDI, based on the branching temporal logics CTL ², Fair CTL and CTL^*, respectively, to increase their expressive power under BDI system context. There are two types of well-formed formulas in the three languages. A state formula is a description of a particular world at a particular time. A path formula is true in a particular world along with a particular path. After discussing the expressive power and model checking using the three different languages, Rao and Georgeff summarized that the complexity of model checking for CTL_BDI has the same or greater complexity than linear temporal logic (LTL) model checking, and has the potential of verifying practical agent-oriented systems using expressive multi-modal, branching-time logics.

In recent years, research has focused on extending existing model checking systems and technologies to agent and multi-agent systems, such as [8, 13, 16, 14, 139]. In 2003, Bordini, Fisher, Pardavila and Wooldridge [14] introduced AgentSpeak(F), a variation of AgentSpeak(L), that can be translated directly to Promela³, a model specification

1Model checking refers to automatically and exhaustively checking if a given technique hasn’t been applied to industrial scale cases [12]

2CTL: Computation Tree Logic

3Promela: Process Meta Language

language for SPIN⁴ model-checking system. AgentSpeak(F) is still immature, and there is more work to be done to improve the efficiency and scalability. Similarly, the multi-agent programming language MABLE, proposed in 2002, can also be translated to Promela and verified by SPIN [139]. One year later, Bordini, Fisher, Visser, and Wooldridge [15] stated an alternative approach, in which AgentSpeak(L) is translated to Java program and then is verified using JPS (Java Path Finder), an existing model checking tools developed by NASA.

Meanwhile, in 2003, Benerecetti and Cimatti [8] presented another approach of validating multi-agent systems, which is based on describing the system using Multi-Language FSM, the expected properties of a system specified in modal temporal logic, and a decision procedure based on model checking techniques. The algorithm described has been implemented in NuMAS system (NuSMV for Multi-Agent Systems) that is built on top of NuSMV symbolic model checker [8].

Based on the common semantic basis for BDI languages [38], and their previous works on verifying BDI-agent system using JPF, Bordini, Dennis, Farwer, and Fisher discussed the automated verification using this common semantic basis [13]. The previous works on model checking agent-based system are mostly bounded to one particular programming language. Bordini et al. [13] introduced the Agent Infrastructure Layer (AIL) that encloses the main concepts of a wide range of agent programming languages. The idea is that all that the agent-based systems developed using languages that are supported by AIL can be translated, and run in an AIL-based interpreter using AIL data structures and Java classes provided by the AIL toolkit. In addition to AIL, there is an MCAPL interface that provides the support for model checking multi-agent systems against specifications written in Property Specification Language (PSL). The reason for such a translation is to provide a unified framework to verify agent-based systems developed in different languages. The verification of translated

4SPIN: Simple Promela Interpreter

source code is done using AJPF, an extended version of JPF. AJPF has AIL classes embedded in and extended to support temporal logic model checking. Some simple case studies on simple agent systems show AJPF is more than 150 times faster than JPF [13]. However, agent systems studied were too simple to show that the approach is applicable to large-scale practical systems.

On the other hand, there are new model-checking methodologies and formal languages designed exclusively for agent and multi-agent systems, such as MCMAS [79] that supports CTL, ATL (Alternating-time Temporal logic [3]), and mv µK-calculus. ATL is designed to model multi-player games. The complexity of model checking with ATL has been shown to be the same complexity as the theorem-proving problem, which is EXPTIME-complete for “full” ATL, and PSPACE-complete for a fragment of ATL.

mv µK-calculus [74] is an expressive logic used to specify knowledge and time in a multi-agent system. Hoek and Wooldridge [118] showed CKL_n (a temporal logic of knowledge) based model checking on distributed agent systems, and showed that it is possible to reduce CKLn model checking to linear temporal logic model checking.

The current technologies of model checking agent and multi-agent systems are immature [12]. In some BDI-agent programming languages, such as AgentSpeak(L) and most of its extensions, the agent does not understand the meaning of its actions.

Agents in such systems will select actions based on its belief and knowledge. Therefore, when statically verifying a system (without executing), the verification can only be done at the level of checking the accepted order of actions. Moreover, all current model checking methods are not able to prove a foundational propriety in BDI-agent systems, that is the consistency within the plan library. The possible inconsistency that could occur within a plan library may include,

1. effect of a plan does not realize its designed goal;

2. not all possible effects of a plan realize its designed goal;

3. there are goals that are not realized by any plan;

4. under a certain context, there is no plan that is feasible to realize a goal.

Last but not least, efficiency and scalability are limitations of current model checking methods.