Property-based Slicing for Agent Verification

Abstract

Programming languages designed specifically for multi-agent systems represent a new programming paradigm that has gained popularity over recent years, with some multi-agent programming languages being used in increasingly sophisticated applications, often in critical areas. To support this, we have developed a set of tools to allow the use of model-checking techniques in the verification of systems directly implemented in one particular language called AgentSpeak. The success of model checking as a verification technique for large software systems is dependent partly on its use in combination with various state-space reduction techniques, an important example of which is property-based slicing. This article introduces an algorithm for property-based slicing of AgentSpeak multi-agent systems. The algorithm uses literal dependence graphs, as developed for slicing logic programs, and generates a program slice whose state space is stuttering-equivalent to that of the original program; the slicing criterion is a property in a logic with LTL operators and (shallow) BDI modalities. In addition to showing correctness and characterizing the complexity of the slicing algorithm, we apply it to an AgentSpeak program based on autonomous planetary exploration rovers, and we discuss how slicing reduces the model-checking state space. The experiment results show a significant reduction in the state space required for model checking that agent, thus indicating that this approach can have an important impact on the future practicality of agent verification.

Next-preserving branching bisimulation

“…Similarly, Rakow in [44] develops an approach for slicing Petri Nets which is guaranteed to preserve LTL −X properties. Bordini et al in [45] slice agent-based systems written in the AgentSpeak language and prove that their approach preserves LTL −X using stuttering equivalence. Hatcliff et al in [46] show the correctness of the Indus slicer, which slices Java programs, using a notion of projection similar to Weiser's projection [2] to demonstrate that their approach preserves LTL −X properties.…”

Property differencing for incremental checking

“…There is a large body of the work on property-based slicing and property-aware testing and verification of programs [12,15,18,21,25,26] as well as on change-impact analysis, e.g., for regression test selection [27,41,49]. The key difference between iProperty and previous work is our property differencing technique and its synergistic application with changeimpact analysis that characterizes impacted behaviors to enable more efficient checking of code conformance to behavioral properties.…”

Using Agent JPF to Build Models for Other Model Checkers

“…Where the model may be used to check a number of properties such pruning is no longer a possibility and the entire program state space must be explored. Similarly, although we have not explored techniques such as property-based slicing [19] in AJPF these would also be difficult to exploit if a full model were to be exported. However, it is likely that in many cases where there are more than a few properties to be checked the additional time taken to produce a complete model will be offset by the time saved in not having to reproduce this model each time a new property needs to be verified.…”