TÍTULO TERCERO. ORGANIZACIÓN Y FUNCIONES

cutoff _

SFE(S,

m

¯)= (

max

(

1

,

m

¯(

1

)), . . . ,

max

(

1

,

m

¯(

k

)))

forany

S ∈ SFE

with

k ≥

1 rolesandanym

¯

∈ N

k_.

Fig. 14. Them-stuttering simulation of a bigger system¯ S(¯n)by the cutoff systemS(¯c).

Following thecutoffcalculation, themodelcheckingprocedure checkstheconcrete system

S(¯

c

)

against thetrivialin- stantiation

φ[

trivial

]

of

∀

v_¯

(φ (

v

))

.If

φ[

trivial

]

issatisfiedby

S(¯

c

)

,thentheprocedurereturnstrue,otherwiseitreturnsfalse. Note that,differentlyfromthemodelcheckingprocedures for

SMR

and

SGS

systems,the modelcheckingprocedurefor

SFE

systemsalways producesan output.Weshowthat thisoutputisalwayscorrectinSection 7.3.First,we computeits valuefortheautonomousrobotexample.

7.2. Verifying the autonomous robot example

InSection2.3.3weencodedtheautonomousrobotexampleasaPIIS

S

ARcomposedofanagenttemplate

TR1 represent-

ing robotswithaccessto asensor,an agenttemplate

TR2 representing

robotswithnoaccesstoasensor, anda template environment

E

representingtheenvironment.InSection3.2we expressedtheproperty“wheneverarobot halts,itknows thatitisinthegoalregion”inthefollowing

(

1

,

1

)

-indexedformula:

φ

AR

= ∀

({v},{x})AG

((

h_1

,

v

)→

K_TR1v

((

gr_1

,

v

))∧ (

h_2

,

x

)→

K_TR2x

((

gr_2

,

x

)))

where v is avariableof

TR1, u is

avariableofTR2, theatomicproposition

gr_1 (gr_2,

respectively)holdsinthetemplate states wherethevalue ofthe positioncomponentoftemplate robot 1(templaterobot 2,respectively) isin

{

2

,

3

,

4

}

,and the atomicproposition

h_1 (h_2,

respectively) holdsinthetemplatestateswherethetemplaterobot 1(templaterobot 2, respectively)hashalted.

Wenowusetheprocedure Check_

SFE

toestablishwhetherornottheautonomousrobotmeetstheabovespecification. Wehavethat

¯

c

=

cutoff _

SFE(S

AR

, (

1

,

1

))= (

1

,

1

)

Thus, we need to check whetherornot

S

AR

((

1

,

1

))|= φ

AR

[

trivial

]

.The latter querycan be testedwitha standard model checker; thiswill returntrue thereby establishing thecorrectness of theprotocol irrespectively ofthe number ofrobots present.

7.3. Soundness of the Check_

SFE

procedure

Wenowassessthesoundnessofthe Check_

SFE

procedure.

Theorem7.2.

Given S = T ,E, V∈ SFE

and an m-indexed formula

¯

∀

v¯

φ (

v

¯)

, Check_

SFE(S,∀

v¯

φ (

v

¯))

returns true iff

S |= ∀

v¯

φ (

v

¯)

. We provethisresultbyshowingthat:(i) thecutoffsystem

S(¯

c

)

m-stuttering

¯

simulateseverybigger system;(ii) every bigger systemm-stuttering

¯

simulates

S(¯

c

)

. Differentlyfromthe corresponding resultsforthe

SMR

and

SGS

classes,the absenceofagent-environmentandmulti-roleactions inthe

SFE

classremovesthenecessitytosimulatesynchronisations of the environment on actions that are not admitted by the agents in

A( ¯

m

)

. Indeed, whenever an agent not in

A( ¯

m

)

synchronises withtheenvironment,all agentsofthesamerole (orallagentsinthesystemdependingonthetype ofthe action)synchronisetheenvironmentaswell.

7.3.1. Part A: the cutoff system m-stuttering simulates every bigger system

¯

Consider an arbitrarily big system

S(¯

n

)

withn

¯≥ ¯

c, where

S(¯

c

)

is the cutoff system. Fig. 14 showsthe m-stuttering

¯

simulationbetween

S(¯

n

)

and

S(¯

c

)

.Tosimulateanactionperformedbytheagentsin

A(¯

c

)

in

S(¯

n

)

,

S(¯

c

)

performsthesame action.Anyactionperformedin

S(¯

n

)

thatisnotadmittedby anagentin

A(¯

c

)

isboundtobean asynchronousaction.As onlythestateoftheagentperformingtheactionisupdated,

S(¯

c

)

simulatestheseactionsbyperformingthenullaction.

Lemma 7.3. Consider a PIIS

S = T ,E, V∈ SFE

of k roles and m

¯

≥ N

k. Then,

S(¯

n

)≤

mss_¯

S(¯

c

)

for all n

¯

≥ ¯

c, where c

¯

=

cutoff _

SFE(S,

m

¯)

.

Proof. Choose an arbitraryn

¯≥ ¯

c. We show that

S(¯

n

)≤

mss¯

S(¯

c

)

.Define thesimulationrelation

∼

mss¯

⊆G(¯

n

)×G(¯

c

)

asfol- lows:

Fig. 15. Them-stuttering simulation of the cutoff system¯ S(¯c)by a bigger systemS(¯n).

(

g

,

g

)∈∼

mss_¯ iff lsri

(

g

)=

lsri

(

g

),

for

(

i

,

r

)∈A(

c

¯)

Weshowthat

∼

mss_¯ isanm-stuttering

¯

simulationbetween

S(¯

n

)

and

S(¯

c

)

.Itisclearthat

ι(

n

¯)∼

mss¯

ι(

c

¯)

.Let

g∼

mss¯ gforan arbitrarypairofglobalstatesin

G(¯

n

)×G(¯

c

)

.Weshowsimulationrequirements (i)and (iii).Requirement (i)followsbythe definitionof

∼

mss_¯ .Forsimulationrequirement (iii), let

π∈ (

g

)

.Construct a path

π



∈ (

g

)

asfollows:foreach j

≥

1,

π



(

j

,

Act

)=π(

j

,

Act

)

if

π(

j

,

Act

)∈

_{(i,r)∈A(¯c)}Actr_i;otherwise,

π



(

j

,

Act

)=

.Itcanbecheckedthat

π

 isavalidpath,and that

π(

j

)∼

mss_¯

π



(

j

)

,foreach j

≥

1.Thus,partition

π

and

π

intosingletonblocks.Itfollowsthat

S(¯

n

)≤

mss¯

S(¯

c

)

.

2

7.3.2. Part B: every bigger system m-stuttering simulates the cutoff system

¯

Fig. 15showsthem-stuttering

¯

simulationbetween

S(¯

c

)

and

S(¯

n

)

.An asynchronousaction

a defined

fortemplate

i is

simulatedby

S(¯

c

)

bymeansoftwocases.If

a is

notadmittedintherepertoireofagent

(

i

,

1

)

,then

S(¯

n

)

simplyperforms

a.

If

a is

admittedintherepertoireofagent

(

i

,

1

)

,then,onebyone,theagents

(

i

,

1

),(

i

,

c

¯(

i

)+

1

),. . . ,(

i

,

n

¯(

i

))

perform

a.

Thus, foreachrole

i,

everyagentin

{¯

c

(

i

)+

1

, . . . ,

n

¯(

i

)}

mimicsagent

(

i

,

1

)

.

S(¯

n

)

maythensimulatearole-synchronousactionor aglobal-synchronousactionbyperformingtheactioninquestion.

Lemma7.4.

Consider a PIIS S = T ,E, V∈ SFE

of k roles and m

¯

∈ N

k. Then,

S(¯

c

)≤

mss¯

S(¯

n

)

, where

¯

c

=

cutoff _

SFE(S,

m

¯)

.

Proof. Let n

¯≥ ¯

c. Assume an integer i with 1

≤

i

≤

k. Define n

¯

 to be a k-tuple of integers such that: n

¯



(

i

)= ¯

n

(

i

)+

1;

¯

n

(

j

)= ¯

n

(

j

)

forall j with 1

≤

j

≤

k and j

=

i. Weshowthat

S(¯

n

)≤

mss¯

S(¯

n

)

.Thatis,weprovethatthesystemobtainedby addingoneconcreteagent(ofanarbitraryrole)to

S(¯

n

)

m-stuttering

¯

simulates

S(¯

n

)

.Theinductiveapplicationofthelatter entailsthemainclaimofthelemma.

Assume

r= ¯

n

(

i

)

.Definethesimulationrelation

∼

mss_¯

⊆G(¯

n

)×G(¯

n

)

asfollows:

g

∼

mss_¯ giff lsqj

(

g

)=

ls q j

(

g

)

for

(

j

,

q

)∈A(

n

¯),

lsE

(

g

)=

lsE

(

g

)

and g

→

Ar i∗g 1

_,

_{where tls}r i

(

g1

)=

tls1i

(

g

)

If

g∼

mss¯ g,thenthelocalstatesoftheagentsin

A(¯

n

)

andthelocalstatesoftheenvironmentarethesameinthetwo globalstates.Additionally,theagent

(

i

,

r

)

in

S(¯

n

)

isabletochangeitslocalstatetothelocalstateofagent

(

i

,

1

)

in

S(¯

n

)

viaasynchronoustransitions.Weshowthat

∼

mss¯ isanm-stuttering

¯

simulationbetween

S(¯

n

)

and

S(¯

n

)

.

Thecaseof

ι(

n

¯)∼

mss¯

ι(

n

¯



)

followstrivially.Supposethat g

∼

mss¯ g foran arbitrarypairofglobalstatesin

G(¯

n

)×G(¯

n

)

. We show simulation requirements (i) and(iii). The former requirement followsby the definitionof

∼

mss_¯ .For the latter requirement,let

π∈ (

g

)

.Byinductiononthelengthof

π

,weconstructapath

π



∈ (

g

)

suchthat:(i)

π

isasrequired bythem-stuttering

¯

simulation;(ii)

tls

ri

(π



[])=

tls

1 i

(π



[])

. Forthe base step, g

∼

mss¯ g gives g

→

Ar

i∗ g

1_{, where tls}r

i

(

g1

)=

tls 1

i

(

g

)

. Let

π

 be the pathfrom g to g1.The first blocks

B

1

,

B₁ aredefinedasfollows:

B

1

=

g and B₁ isthesequenceofstatesin

π

.Clearly, g is

∼

mss¯ -relatedtoeverystate in

π

.

For the inductive step, assume that for a prefix

[

x

−

1

]π

we have already constructed a prefix

[

x

−

1

]π

 such that

tlsr_i

(π



(

x

−

1

))=

tls1_i

(π



(

x

−

1

))

,andapartitionofthestatesin

[

x

−

1

]π

and

[

x

−

1

]π

intocorrespondingblocks.Wenow definethenextblocks Bxand

B

x.Therearetwocases.

Fig. 16.MCMAS-Parchitecture.

1.

π(

x

−

1

,

Act

)∈/

A1

i. Define Bx

=π(

x

)

and Bx

=π



(

x

)

,where

π



(

x

−

1

)→

π(x−1,Act)

π



(

x

)

. The inductive hypothesis

gives

π(

x

−

1

)∼

mss_¯

π



(

x

−

1

)

and

tls

ri

(π



(

x

−

1

))=

tls 1

i

(π



(

x

−

1

))

.Therefore,

π



(

x

−

1

)→

π(x−1,Act)

π



(

x

)

isavalid

transition,

π(

x

)∼

mss¯

π



(

x

)

,and

tls

ri

(π



(

x

))=

tls 1 i

(π(

x

))

. 2.

π(

x

−

1

,

Act

)∈

A1

i. Let

a be

the corresponding template action of

π(

x

−

1

,

Act

)

. Define Bx

=π(

x

)

and Bx

=π



(

x

)◦

π



(

x

+

1

)

,where

π



(

x

−

1

)→

(a,1)

π



(

x

)→

(a,r)

π



(

x

+

1

)

.Theinductivehypothesisgives

π(

x

−

1

)∼

mss¯

π



(

x

−

1

)

and

tlsr_i

(π



(

x

−

1

))=

tls1_i

(π



(

x

−

1

))

. Therefore,

π



(

x

−

1

)→

(a,1)

π



(

x

)→

(a,r)

π



(

x

+

1

)

are validtransitions,

π(

x

)∼

mss¯

π



(

x

)

,

π(

x

)∼

mss¯

π



(

x

+

1

)

,and

tls

ri

(π



(

x

+

1

))=

tls

1 i

(π



(

x

))

.

Simulation requirement (iii) istherefore satisfied. It follows that

S(¯

n

)≤

mss_¯

S(¯

n

)

. Bythe inductive application of the latterandbytransitivityof

≤

mss¯ ,weobtainthat

S(¯

c

)≤

mss¯

S(¯

n

)

.

2

Corollary7.5.

Consider a PIIS S = T ,E, V∈ SFE

of k roles and an m-indexed formula

¯

∀

v¯

φ (

v

¯)

. Then,

S(¯

c

)|= ∀

v¯

φ (

v

¯)

iff

∀¯

n

≥

¯

c

.S(¯

n

)|= ∀

v¯

φ (

v

¯)

, where c

¯=

cutoff _

SFE(S,

m

¯)

.

Proof. Let n

¯≥ ¯

c be arbitrary. ByTheorem 3.9 itsuffices to show that

S(¯

n

)≤

mss¯

S(¯

c

)

and

S(¯

c

)≤

mss¯

S(¯

n

)

.The former is givenbyLemma 7.3.ThelatterisgivenbyLemma 7.4.

2

This concludes theproof ofTheorem 7.2.Corollary 7.5 givesa methodology forsolving the PMCPby modelchecking the cutoff system. Differently from Corollary 5.13and Corollary 6.6,where certain conditions are assumed, by means of

Corollary 7.5 we always solve the PMCP forany givensystem andspecification. In other words,while Check_

SMR

and Check_

SGS

donotprovideananswertothePMCPintheabsenceofanagent-environmentsimulation, Check_

SFE

always providesasolution.Therefore,thePMCPforthe

SFE

classofPIISisdecidable.

Corollary7.6.

The PMCP for the SFE

class of PIIS is decidable.

In document NOTA. El presente texto es un documento de divulgación sin ningún carácter oficial, que recoge la norma íntegra actualizada. (página 35-39)