Automata using simulations

Our goal now is to reduce the space required by the automaton constructed bymkAutoECby

simulatingthe equivalence classes (§3.2.3).

The following locale captures the framework ofvan der Meyden(1996b):

locale SimIncrEnvironment =

IncrEnvironment jkbp envInit envAction envTrans envVal jview envObs jviewInit jviewIncr

for jkbp :: "(’a, ’p, ’aAct) JKBP" and envInit :: "’s list"

and envAction :: "’s _⇒ ’eAct list"

and envTrans :: "’eAct ⇒ (’a ⇒ ’aAct) ⇒ ’s ⇒ ’s" and envVal :: "’s ⇒ ’p ⇒ bool"

and jview :: "(’a, ’s, ’tv) JointView" and envObs :: "’a ⇒ ’s ⇒ ’obs"

and jviewInit :: "(’a, ’obs, ’tv) InitialIncrJointView" and jviewIncr :: "(’a, ’obs, ’tv) IncrJointView" + fixes simf :: "’s Trace _⇒ ’ss"

fixes simRels :: "’a ⇒ (’ss × ’ss) set" fixes simVal :: "’ss ⇒ ’p ⇒ bool"

assumes simf: "sim MC (mkKripke (simf ‘ jkbpC) simRels simVal) simf" context SimIncrEnvironment

begin

Note that the back tick‘is Isabelle/HOL’s relational image operator. In context it says thatsimf must be a simulation fromjkbpCto its image undersimf.

Firstly we lift our canonical trace sets and Kripke structures through the simulation.

abbreviation jkbpCSn :: "nat ⇒ ’ss set" where "jkbpCSn ≡ simf ‘ jkbpCn"

abbreviation jkbpCS :: "’ss set" where "jkbpCS ≡ simf ‘ jkbpC" abbreviation MCSn :: "nat ⇒ (’a, ’p, ’ss) KripkeStructure" where

"MCSn ≡ mkKripke jkbpCSn simRels simVal"

abbreviation MCS :: "(’a, ’p, ’ss) KripkeStructure" where "MCS ≡ mkKripke jkbpCS simRels simVal"

We often use the equivalence class of simulated traces generated by agenta’s view:

abbreviation sim_equiv_class :: "’a _⇒ ’s Trace ⇒ ’ss set" where

"sim_equiv_class a t _≡ simf ‘ { t’ _∈ jkbpC . jview a t’ = jview a t }"

abbreviation jkbpSEC :: "’ss set set" where "jkbpSEC ≡ S

a. sim_equiv_class a ‘ jkbpC"

We can show that the temporal slice of the simulated structure is adequate for determining the actions of the JKBP. The proof is routine but tedious, exploiting the sub-model property (§3.2.2).

lemma jkbpC_jkbpCSn_jAction_eq: assumes tCn: "t ∈ jkbpCn n"

shows "jAction MC t = jAction (MCSn n) (simf t)" end

It can be shown that a suitable simulation into a finite structure is adequate to establish the existence of finite-state implementations (van der Meyden 1996b, Theorem 2): essentially we apply the simulation to the states ofmkAutoEC. However this result does not make it clear how the transition function can be algorithmically constructed. One approach is to maintainjkbpC

while extending the automaton, which is quite space inefficient.

Intuitively we wish to compute the possiblesim_equiv_classsuccessors of a givensim_equiv_class

without reference tojkbpC, and this should be possible as the reachable simulated worlds must contain enough information to differentiate themselves from every other simulated world that represents a trace on which the agents act differently.

This leads us to ask for some extra functionality of our simulation, which we detail in the locale shown in Figure3.1. Note that these definitions are stated relative to the environment and the JKBP, allowing us to treat specialised cases such as having a single agent (§3.7.3) and broadcast environments (§3.7.4and §3.7.5).

Firstly we relate the concrete representation’repof equivalence classes under simulation to differ from the abstract representation’ss setusing the abstraction functionsimAbs; there is no one-size-fits-all concrete representation, as we will see.

Secondly we ask for a functionsimInit a iobsthat faithfully generates a representation of the equivalence class of simulated initial states that are possible for agentagiven the valid initial observationiobs.

Thirdly thesimObsfunction allows us to partition the results of simTransaccording to the recurrent observation that agentamakes of the equivalence class.

locale AlgSimIncrEnvironment =

SimIncrEnvironment jkbp envInit envAction envTrans envVal

jview envObs jviewInit jviewIncr simf simRels simVal for jkbp :: "(’a, ’p, ’aAct) JKBP"

and envInit :: "’s list"

and envAction :: "’s ⇒ ’eAct list"

and envTrans :: "’eAct ⇒ (’a ⇒ ’aAct) ⇒ ’s ⇒ ’s" and envVal :: "’s ⇒ ’p ⇒ bool"

and jview :: "(’a, ’s, ’tv) JointView" and envObs :: "’a ⇒ ’s ⇒ ’obs"

and jviewInit :: "(’a, ’obs, ’tv) InitialIncrJointView" and jviewIncr :: "(’a, ’obs, ’tv) IncrJointView" and simf :: "’s Trace ⇒ ’ss"

and simRels :: "’a _⇒ (’ss _× ’ss) set" and simVal :: "’ss _⇒ ’p _⇒ bool" + fixes simAbs :: "’rep ⇒ ’ss set"

and simObs :: "’a ⇒ ’rep ⇒ ’obs" and simInit :: "’a ⇒ ’obs ⇒ ’rep" and simTrans :: "’a ⇒ ’rep ⇒ ’rep list" and simAction :: "’a ⇒ ’rep ⇒ ’aAct list" assumes simInit:

"_∀a iobs. iobs _∈ envObs a ‘ set envInit −→ simAbs (simInit a iobs)

= simf ‘ { t’ _∈ jkbpC. jview a t’ = jviewInit a iobs }" and simObs:

"_∀a ec t. t _∈ jkbpC ∧ simAbs ec = sim_equiv_class a t

−→ simObs a ec = envObs a (tLast t)" and simAction:

"∀a ec t. t ∈ jkbpC ∧ simAbs ec = sim_equiv_class a t

−→ set (simAction a ec) = set (jAction MC t a)" and simTrans:

"∀a ec t. t ∈ jkbpC ∧ simAbs ec = sim_equiv_class a t

−→ simAbs ‘ set (simTrans a ec) = { sim_equiv_class a (t’ s)

|t’ s. t’ s ∈ jkbpC ∧ jview a t’ = jview a t }"

Figure 3.1: TheSimEnvironmentlocale extends theEnvironmentlocale with simulation and algo- rithmic operations. The backtick‘is Isabelle/HOL’s image-of-a-set-under-a-function operator.

Fourthly, the functionsimActioncomputes a list of actions enabled by the JKBP on a state that concretely represents a canonical equivalence class.

Finally we expect to compute the list of represented sim_equiv_classsuccessors of a given

sim_equiv_classusingsimTrans.

With these functions in hand, we can define our desired automaton:

definition (in AlgSimIncrEnvironment)

mkAutoSim :: "(’a, ’obs, ’aAct, ’rep) JointProtocol" where "mkAutoSim ≡ λa.

(| pInit = simInit a,

pTrans = λobs ec. (SOME ec’. ec’ _∈ set (simTrans a ec) _∧ simObs a ec’ = obs),

pAct = simAction a |)"

The automaton faithfully constructs the simulated equivalence class of the given trace:

lemma (in AlgSimIncrEnvironment) mkAutoSim_ec: assumes "t _∈ jkbpC"

shows "simAbs (runJP mkAutoSim t a) = sim_equiv_class a t"

It is then a short step to the following version of Theorem 2 ofvan der Meyden(1996b):

theorem (in AlgSimIncrEnvironment) mkAutoSim_implements: "implements mkAutoSim" The reader may care to contrast these structures with theprogression structuresofvan der Mey- den(1996c), where states contain entire Kripke structures, and expanding the automaton is alternated with bisimulation reduction to ensure termination when a finite-state implementa- tion exists (see §6.2.4) We also use simulations in AppendixAto show the complexity of some related model checking problems.

We now review a simpledepth-first search(DFS) theory, and an abstraction of finite maps, before presenting the algorithm for constructing implementations of KBPs.