The Logic of Conflicts between Decision Making Agents LOVE EKENBERG, Dept. of Computer and Systems Sciences, Stockholm University and the Royal Institute of Technology, Electrum 230, SE-164 46 Kista, Sweden and Dept. of Information Technology, Mid Sweden University, SE-851 70, Sundsvall, Sweden. E-mail:
[email protected] Abstract We present a formal model for the analysis of conflicts in sets of autonomous agents restricted in the sense that they can be described in a (first-order) language and by a transaction mechanism. In this model, we allow for enrichment of agent systems with correspondence assertions, expressing the relationship between different entities in the formal specifications of the agents. Thereafter the specifications are analysed with respect to conflicts. If two specifications are free of conflicts, the formulae of one specification together with the set of correspondence assertions do not restrict the models of the other specification, i.e. the agent system does not restrict the individual agents. The approach takes into account static as well as dynamic aspects of this kind of interaction. Classifications of complexity of determining whether two specifications are free of conflicts are also presented. Furthermore, if the agents are allowed to act in accordance with the result of executions of a decision module, a situation may occur where, for example, subsets of their possible goal sets are consistent, but in actual fact the individual agents may nevertheless always terminate in states that are in conflict. Therefore, the model is also enriched by processes for analysing when specifications are compatible with respect to states for which it is reasonable to assume that they eventually will be reached. Keywords: Multi-agent system, conflict detection, conceptual schema, theorem proving.
1 Motivation The agent metaphor has turned out to be most useful for describing complex software artefacts [37], extending the range of process-based specification. This gives even greater range to the areas to which any improvements in the reliability of software specified in a process based formalism can be applied. In particular, this applies to conflicts. A conflict situation in a multi-agent system is often considered to be one in which the negotiation set is empty, i.e. the ultimate goals of the individual agents are incompatible (cf. [44]). Even if we for a while disregard a precise definition of a conflict, it seems plausible that in a complex multi-agent system it may be that it is practically impossible to determine whether a conflict actually prevails. This seems also to be the case even if there are no restrictions on the interactions or communication processes between them. Moreover, even if the agent system can be proven consistent, for instance in the sense of [23], it may be difficult to determine whether this subset is meaningful in the sense that it contains goal states that the agents will reach with a reasonable degree of probability. Work on conflicts between agents has frequently been based on communication between agents and most of the literature is focused on resolving conflicts. This frequently requires a precompiled frame work of co-ordinating plans, as worked on by [37], [38], [30], or expensive run-time protocols for co-ordinating negotiations between agents [35], [42], [26], [25], [5], [7], and altering belief systems as pro-
J. Logic Computat., Vol. 10 No. 4, pp. 583–602 2000
c Oxford University Press
584 The Logic of Conflicts ported in [31]. However, tackling the difficulties in detection and identification of conflicts has received notably less attention. This is in itself a complex task. In the sequel, we suggest a set of concepts and procedures for determining whether an agent system is in conflict. The approach taken is that substantial parts of multi-agent designs can often be formulated as processes (in the sense of algorithms). Agent systems are considered as transition systems that can be specified in some kind of process-based language. It should be emphasized that the process-oriented approach does not require a deterministic perspective. A model could include a set of processes communicating with each other as well as with the environment. However, decentralized architectures of asynchronous processes that have been developed independently create the need to integrate design models and co-ordinate information. Another side to this problem is that different portions of systems may have been developed at different times. Furthermore new sub-systems must continuously be integrated with older systems in a way that will not lead to conflicts or other undesired effects [27]. In this context the exchanged information could contain complex information structures that, for instance, can be analysed with respect to various decision rules. Such a structure can be expressed in a set of conceptual schemata, e.g. first-order formulae integrated with transition models. It is demonstrated that this enables various methods for detecting conflicts between specifications and allows for static and dynamic analyses of multi-agent systems. Some technical details of a general model was investigated in [17], where an approach using integration assertions was chosen to demonstrate how different aspects of integration of such models formulated in first-order logic can be analysed. Different varieties of temporal logic [13] and BDI logic [32] on the other hand are strong contenders for the target language. However, first-order logic remains the choice for this work. This is in agreement with [21] and [2], that argue for the advances of first-order logic to model dynamics in contrast to approaches based on temporal logic. Furthermore, as will be noted below, the representation in firstorder logic has some convenient features from a theorem proving perspective. Thus, agent process specifications are studied as formulae in first-order logic with a transaction mechanism. Such a structure will be referred to as a conceptual schema. As mentioned above, any suitable representation could have been used instead, but conceptual schemata provide a suitable and widespread formalism for our purposes. In the sequel, we show how conflicts in multi-agent systems can be detected and analysed. We also introduce means for separating between meaningful states and states that in actual fact can be reached after certain kinds of restrictions are imposed. Using these, we can investigate whether specifications can be meaningfully integrated with respect to reasonable probable states.
2 Representation In the definitions below, we assume an underlying language L of first-order formulae.1 By a diagram for a set R of formulae in a language L, we mean a Herbrand model of R, extended by the negation of the ground atoms in L that are not in the Herbrand model. Thus, a diagram for L is a Herbrand model extended with classical negation.2
1 As we will explain below, the assumption of a particular language is not necessary, since the concepts can be more generally defined. 2 For our purposes, this is no loss of generality by the well-known result that a closed formula is satisfiable iff its Herbrand expansion is satisfiable. For a discussion of this expansion theorem and its history [14].
The Logic of Conflicts 585 D EFINITION 2.1 A schema S is a structure hR; ERi consisting of a static part R and a dynamic part ER. R is a finite set of closed first-order formulae in a language L. ER is a set of event rules. Event rules describe possible transitions between different states of a schema and will be described below. L(R) is the restriction of L to R, i.e. L(R) is the set fpjp 2 L, but p does not contain any predicate symbol, that is not in a formula in Rg. The elements in R are called static rules in L(R). A static integration assertion expressing the schema S2 in the schema S1 is a closed first-order formula: 8x(p(x) $ F (x)), where p is a predicate symbol in L(S2 ) and F (x) is a formula in L(S1 ). The intuition behind static integration assertions is that they express static relations between objects in the two schemata. E XAMPLE Assume that the static parts of the two schemata S1 and S2 are the following:3
R1 = f:(r(a) _ r(b); r(c) $ r(a)g: R2 = fp(a) ! p(b); p(c) _ :p(b)g: The diagrams for schema S1 are then:
fr(a); r(b); r(c)g f:r(a); r(b); :r(c)g f:r(a); :r(b); :r(c)g: The diagrams for schema S2 are:
fp(a); p(b); p(c)g f:p(a); p(b); p(c)g f:p(a); :p(b); p(c)g f:p(a); :p(b); :p(c)g: A possible integration assertion for the schemata is:
8x(p(x) $ r(x)): The dynamic part of a schema requires a definition of the concept of event rules which is given its semantics through the event concept. Intuitively, an event is an instance of an event rule, i.e. a transition from one diagram to another one. An event rule may be initialized from the environment of the agent system or from another agent included in the system. Initialized event rules map on possible events that may change the state of an instance of a specification. Below, L denotes a language. D EFINITION 2.2 An event rule in L is a structure hP (z); C (z)i. P (z) and C (z) are first-order formulae in L, and z is a vector of variables in the alphabet of L.4 In terms of conceptual modelling, P (z) denotes the precondition of the event rule, and C (z) the post condition. 3 To simplify the presentation, a; b; and c are constants. As can be seen from Definition 2.1, the static part of a schema may have a more general form. 4 The notation A(x) means that x is free in A(x).
586 The Logic of Conflicts D EFINITION 2.3 The set of basic events for a schema hR; ERi is a relation E diagrams for R. An element (; ) belongs to E iff
D D, where D is the set of
(i) = , or (ii) there is a rule hP (z); C (z)i in ER, and a vector e of constants in L, such that P (e) 2 and C (e) 2 . In this case we will also say that the basic event (; ) results from the event rule.5 Note that E is not necessarily a function. Intuitively, this means that an event rule is nondeterministic: if an instance of the precondition of an event rule belongs to a diagram , the event rule results in events (; ) for every diagram , such that the corresponding post condition belongs to . Thus, the approach to the dynamics of a schema differs from the traditional transactional approach in the database area, where an event deterministically specifies a minor modification of a state [1]. Depending of the particular information processor used, this event concept can be restricted in a variety of ways. E XAMPLE ( CONT.) The event rules for the schema S1 are:
Er1a = hr(a); r(b)i Er1b = h:r(a); (:r(b) ^ :r(c))i Er1c = h(:r(a) ^ r(b)); r(a)i: Let:
1 = fr(a); r(b); r(c)g 2 = f:r(a); :r(b); :r(c)g 3 = f:r(a); r(b); :r(c)g: Then the set of basic events for schema is:
f( ; ); ( ; ); ( ; ); ( ; ); ( ; ); ( ; )g; where ( ; ); ( ; ), and ( ; ) follows trivially from (i) in Definition 2.3, ( ; ) is due to Er ; ( ; ) is due to Er , and ( ; ) is due to Er . 1
1
1a
1
2
3
1
1
2
2
2
3
3
3
1
3
3
1
3
1c
3
2
1
3
2
3
1b
A description of a schema is a structure consisting of all diagrams for a schema, together with all possible transitions that are possible with respect to the basic events for the schema. D EFINITION 2.4 The description of a schema S is a digraph hD; E i, where D is the set of diagrams for S , and E is the set of basic events (i.e. arcs in the digraph) for S . E XAMPLE ( CONT.) Figure 1 illustrates a description of schema S1 . The arrows in the figure represent basic events and the circles represent the diagrams for the schema. 5 In [17] an approach using event messages is described. However this concept is not necessary in a model not presupposing a particular information processor.
The Logic of Conflicts 587 (σ1,σ1)
(σ1)
(σ1,σ3)
(σ2)
(σ3,σ1) (σ3,σ2)
(σ2,σ2)
(σ3)
(σ3,σ3)
F IGURE 1. The description of a schema
Using thresholds and other criteria for selecting reasonable paths only, the state space may be reduced. However, in actual real-world applications the possible state space will probably remain very large when taking choice mechanisms into consideration. Therefore, when analysing the processes in a multi-agent system with respect to conflicts, it is often intractable to determine which combination of states that actually may occur by generating all the possible combinations and checking them one by one. An approach to this problem is presented in the following sections.
3 Conflict detection Intuitively, two schemata are in conflict with respect to a set of static integration assertions if one of them together with the integration assertions (IA) restrict the set of diagrams for the other one. This means, for instance, that if the set of goals for an agent A1 and the set of goals for an agent A2 are (partly) incompatible, they are in conflict since the ultimate goals (or ultimate states) of both agents cannot simultaneously be fulfilled, i.e. they restrict each other in this sense. We will say that S2 and S1 are free of conflicts w.r.t. IA iff for each diagram in D1 , there exists a diagram in D2 , such that [ is a diagram for IA. However, to emphasize the independence of a particular underlying language, we formulate the concept somewhat more generally. D EFINITION 3.1 Let IA be a set of static integration assertions expressing S2 in S1 , and let the schemata be expressed as connected digraphs hDi ; Ei i, where Ei Di Di . Define a relation R D1 D2 . (There is no need to assume that the Di s are diagrams in the sense described above.) The definition of freeness of conflicts between S1 and S2 then becomes an instance of R in the following sense: S2 and S1 are free of conflicts w.r.t. IA iff 8 2 D1 9 2 D2 R , where R iff [ j= IA. Otherwise S2 and S1 it are in conflict w.r.t. IA. E XAMPLE ( CONT.) Reconsider the example above. The two schemata S1 and S2 are in conflict w.r.t. 8x(p(x) $ r(x)). The diagram for S1 :
fr(a); r(b); r(c)g
588 The Logic of Conflicts can be extended to:
fr(a); r(b); r(c); p(a); p(b); p(c)g which is a diagram for the integration assertion. Similarly the diagram:
f:r(a); :r(b); :r(c)g can be extended to:
f:r(a); :r(b); :r(c); :p(a); :p(b); :p(c)g: However, the third diagram below cannot be extended in this way.
f:r(a); r(b); :r(c)g: The diagrams for schema S2 are:
fp(a); p(b); p(c)g f:p(a); p(b); p(c)g f:p(a); :p(b); p(c)g f:p(a); :p(b); :p(c)g: Since none of:
f:r(a); r(b); :r(c); p(a); p(b); p(c)g f:r(a); r(b); :r(c); :p(a); p(b); p(c)g f:r(a); r(b); :r(c); :p(a); :p(b); p(c)g f:r(a); r(b); :r(c); :p(a); :p(b); :p(c)g is a diagram for 8x(p(x) $ r(x)), the schemata are in conflict w.r.t the integration assertion. On the other hand, the schemata are free of conflicts w.r.t.
8x(p(a) $ (r(x) $ r(c))): The possible extended diagrams are then:
fr(a); r(b); r(c); p(a); p(b); p(c)g f:r(a); :r(b); :r(c); p(a); p(b); p(c)g f:r(a); r(b); :r(c); :p(a); :p(b); :p(c)g f:r(a); r(b); :r(c); :p(a); :p(b); p(c)g f:r(a); r(b); :r(c); :p(a); p(b); p(c)g: Note that the check for freeness of conflicts may be both too strong and to weak, since not all states in a schema need to be compatible with other states in another schema. In some cases only states including ultimate goals need consideration. If two schemata S1 and S2 ,
The Logic of Conflicts 589 representing the agents A1 and A2 , are in conflict, and the conflicting states contain ultimate goals of the agents, then there is a real conflict with respect to the goals. In the case of goalconflict detection, the relation R in Definition 3.1 can be modified in the following respect. (The definition does not take into account that several states may contain the same goal.) D EFINITION 3.2 Let IA and hDi ; Ei i be as above, and let Gi denote the set of states containing goals of the agent represented by Si . S2 and S1 are free of conflicts w.r.t. IA iff 8 2 G1 9 2 G2 R , where R iff [ j= IA. Otherwise S2 and S1 are in conflict w.r.t. IA. As Definition 3.2 is formulated, the general problem of determining freeness of conflicts is undecidable. With the (in most cases) reasonable assumption that there is a finite number of relevant objects in the agent system as well as in its environment, a language with a finite number of constants may be used. In that case we have a problem in second-order propositional logic that is p2 -complete. This follows from the characterization of the complexity class pk and the observation that the criterion of freeness of conflicts for two schemata is an expression in second-order logic: 8 2D1 9 2D2 R .6 By restricting the formulae in IA as suggested in [17], we obtain a problem that is NP-complete. Even this appears too demanding from a computational point of view. However, given access to an efficient theorem prover, NP-complete problems can, in many cases, be solved within a reasonable time [41]. Most propositional theorem provers have been based either on the resolution principle [33] or on semantic tableaux [3], [39]. A proof system formulated in [28, 29] that is similar to [40] has been investigated in [9]. The conclusion is, roughly, that natural deduction systems with a discharge rule based on the bivalence principle are generally better than those with other types of discharge rules, such as the discharge rule of semantic tableaux.7 ; 8
4 Extending the event concept The definition of freeness of conflicts does only take into consideration the static aspects of the agent behaviour, i.e. how the static properties of one agent affect the static properties of another. Next, we introduce more general dynamic aspects in our model by defining sequential combinations of event rules. D EFINITION 4.1 Given a schema hR; ERi and a set fV1 ; V2 ; : : :; Vk g of event rules in ER. The sequential combination of V1 ; V2 ; : : :; Vk 1 and Vk is denoted by h[P1 (z1 ); C1 (z1 )]; :::; [Pk (zk ); Ck (zk )]i, or shorter, V1 r:::rVk . The semantics for sequential combinations of event rules is given by the concept of instances of event rules. D EFINITION 4.2 Given a schema S =hR; ERi and a set fV1 ; : : :; Vk g of event rules in ER. The following notation will be used: 6 For
a detailed treatment of the different complexity classes, see, [22, p. 96.]. specifically, it is shown that Mondadori’s proof system restricted to subformula proofs p-simulates [8] semantic tableaux but the opposite does not hold. The system of [40] (restricted to subformula proofs) is easily seen to p-simulate Mondadori’s system. 8 The simple rules of [40] have also (independently) received much attention in the constraint programming community. See [43] on the subject (where similar rules are labelled as value inference). 7 More
590 The Logic of Conflicts (i) ^(S; Vi ), is the set of basic events for S resulting from Vi ; i = 1; : : :k .
The combined instances of V1 r : : : rVk is defined by:
(ii) ^(S; V1 r : : : rVk ) = f(; )j there is a , such that (; ) ^ (S; V1 r: : :rVk 1 ) and ( ; ) 2 ^(S; Vk )g; k 2.
2
E XAMPLE ( CONT.) Two of the event rules for the schema S1 are:
Er1a = hr(a); r(b)i Er1b = h:(a); (:r(b) ^ :r(c))i: Then:
^(S ; Er rEr ) = f(fr(a); r(b); r(c)g; f:r(a); :r(b); :r(c)g)g: 1
1a
1b
We may now generalize the event concept by defining an event as either a basic event or an instance of the combined extension of a schema. D EFINITION 4.3 Given a schema S = hR; ERi. The combined extension of S; ^(S ), is the union of ^(S; V ) for all sequential combinations V of event rules in ER. D EFINITION 4.4 Given a schema S
= hR; ERi. An event for S is an ordered pair (; ) 2 ^(S ).
E XAMPLE ( CONT.) Thus, using the same notation as in Figure 2:
^(S ) = f( ; ); ( ; ); ( 1
1
1
2
2
1
; 3 ); (3 ; 1 ); (3 ; 2 ); (1 ; 2 )g:
We will also use a notation for the diagrams that an event traverses. D EFINITION 4.5 Let S =hR; ERi be a schema, and let V event rules in ER.
= V1 r : : : rV k be a sequential combination of
(i) The event path extension for V; (S; V ), is the set of sequences of diagrams for S; (1 ; 2 ; : : : ; k+1 ), such that (i ; i+1 ) 2 ^(S; Vi ). (ii) The event path extension for S; (S ), is the union of (S; V ) for all sequential combinations V of event rules in ER. Figure2 exemplifies these concepts in a part of a description of a schema S . The dots represent diagrams and the arcs represent basic events. The labelled basic events correspond to the labelled instance of (S ) below the graph. (1 ; 5 ) is an instance of ^(S ) through the same sequence of basic events. E XAMPLE ( CONT.) Let S1 be the schema as before, and let V
= Er1 rEr1 . Then: a
b
(S; V ) = f(fr(a); r(b); r(c)g; f:r(a); r(b); :r(c)g; f:r(a); :r(b); :r(c)g)g: Using these concepts, we extend the model to include dynamic integration assertions.
The Logic of Conflicts 591
(1 ; 5 )
(1 ; 2 )
(2 ; 3 )
(3 ; 4 )
( 4; 5 )
(1 ; 2 ; 3 ; 4 ; 5 ) F IGURE 2. Basic events, events and event paths
5 Dynamic enrichment This section generalizes the concepts from Section 3, by giving semantics for some dynamic aspects of schemata. Testing for static freeness of conflicts is in general not enough. For instance, assume that schemata S1 and S2 , representing the agents A1 and A2 , are free of conflicts in the static sense. Consider an event ( 0 ; 0 ) in the description of S2 . Since the schemata are free of conflicts, there are elements and in the description of S1 , such that [ 0 and [ 0 are diagrams for IA. However, it may still be the case that there is no path from to in the description of S1 , and consequently no possibility for schema S1 to be in state when starting from state . Consequently, even if freeness of conflicts prevails, the agents may still restrict each other when the dynamic behaviour of the agents are considered. To avoid such a situation the schemata should be checked for dynamic freeness of conflicts. The idea behind this concept can be illustrated as follows: if the schemata S1 and S2 , representing the agents A1 and A2 , are dynamically free of conflicts, then for every event in the schema S2 representing a transition from a state 0 to a state 0 , there is a corresponding sequence of events in the schema S1 . This sequence starts from a state of S1 not in conflict with 0 and terminates in a state not in conflict with 0 . Naturally, to determine dynamic freeness of conflicts in this sense is a very demanding problem from a computational viewpoint, but sometimes it is possible to reduce the amount of combined instances that should be investigated by explicitly expressing which parts of a specification should have a similar behaviour as parts of another specification. The following shows how this can be done in the case where one event rule corresponds to a sequential combination of event rules. D EFINITION 5.1 Let S1 = hR1 ; ER1 i and S2 = hR2 ; ER2 i be two schemata. An identifying dynamic integration assertion expressing the schema S2 in the schema S1 is an expression ([V ]; [U1 ; : : : ; Un ]), where V is an event rule in ER2 and U1 ; : : : ; Un are event rules in ER1 . We may restrict the semantics of an identifying dynamic integration assertion as in the following definition. D EFINITION 5.2 Let S1 and S2 be two schemata, and let ID = ([V ]; [U1 ; : : : ; Un ]) be an identifying dynamic integration assertion expressing the schema S2 in S1 . ID is adequate for S1 ; S2 , and IA, if: (i) For all ( 0 ; 0 ) 2 ^(S2 ; V ), there is a sequence of events
592 The Logic of Conflicts
(1 ; 2 ; : : : ; ; +1 ) 2 (S1 ; U1 r : : : rU ), such that 1 [ 0 and +1 [ 0 are both diagrams for IA. (ii) For all (1 ; 2 ; : : : ; ; +1 ) 2 (S1 ; U1 r : : : rU ), there is an event (0 ; 0 ) 2 ^(S2 ; V ), such that 1 [ 0 and +1 [ 0 are both diagrams for IA. n
n
n
n
n
n
n
n
If only (i) above is fulfilled, then we will say that ID is semi-adequate for S1 ; S2 and IA. When (1 ; 2 ; : : : ; n ; n+1 ) and ( 0 ; 0 ) correspond in the way described in (i) or (ii), they are called compatible with ID. E XAMPLE ( CONT.) Let:
S1 = hf:r(a) _ (r(b); r(c) $ r(a)g; fh(r(a); r(b)i; h:r(a); (:r(b) ^ :r(c))ig S2 = hfp(a) ! p(b); p(c) _ :p(b)g; fh(p(a) ^ p(b)); :p(b)igi IA = f8x(p(a) $ (r(x)$r(c)))g ID = f[h(p(a) ^ p(b)); :p(b)i]; [hr(a); r(b)i; h:r(a); (:r(b) ^ :r(c))i]g:
Then:
^(S ; h(p(a) ^ p(b)); :p(b)i) = f(fp(a); p(b); p(c)g; f:p(a); :p(b); p(c)g); (fp(a); p(b); p(c)g; f:p(a); :p(b); :p(c)g)g: 2
As we have seen, the only member in
(S1 ; hr(a); r(b)irh:r(a); (:r(b) ^ :r(c))i) is
f(fr(a); r(b); r(c)g; f:r(a); r(b); :r(c)g; f:r(a); :r(b); :r(c)g)g: However, neither
f:r(a); :r(b); :r(c)g [ f:p(a); :p(b); p(c)g; nor f:r(a); :r(b); :r(c)g [ f:p(a); :p(b); :p(c)g is a diagram for IA. Thus, ID is not semiadequate for S1 , S2 and IA. This argument is illustrated in Figure 3. In Figure 3 the following notation is used:
1 = fr(a); r(b); r(c)g 2 = f:r(a); :r(b); :r(c)g 3 = f:r(a); r(b); :r(c)g 1 = fp(a); p(b); p(c)g 2 = f:p(a); p(b); p(c)g 3 = f:p(a); :p(b); p(c)g 4 = f:p(a); :p(b); :p(c)g: We modify our earlier definition of freeness of conflicts and incorporate the requirement of adequacy by the following definition.
The Logic of Conflicts 593 (σ1)
(τ1)
σ1 U τ1 |= ΙΑ
(τ2)
(τ1,τ3)
(σ1,σ3)
(τ1,τ4)
(τ3)
(σ3) (σ3,σ2)
σ2 U τ3 |= ΙΑ
(τ4)
σ2 U τ4 |= ΙΑ (σ2)
F IGURE 3. ID is not semiadequate for S1, S2 and IA
D EFINITION 5.3 Let S1 =hR1 ; ER1 i and S2 =hR2 ; ER2 i be two schemata. Also, let IA be a set of static integration assertions expressing the schema S2 in S1 , and let D be a set of IDs. S1 and S2 are dynamically free of conflicts w.r.t. IA and D, if: (i) S1 and S2 are free of conflicts w.r.t. IA; (ii) S2 and S1 are free of conflicts w.r.t. IA; (iii) All the IDs in D are semi-adequate for S1 ; S2 , and IA. E XAMPLE ( CONT.) Let S1 ; S2 , IA, and ID be as in the examples before. As we have seen (iii) is not valid in this case. Since the ID is violated in this respect, S1 and S2 are not dynamically free of conflicts w.r.t. IA and ID.
6 Complexity and language-independence Above, it was noted that the problem of determining freeness of conflicts is P 2 -complete. We can also see that a similar result holds for the computational complexity of the problem of determining semi-adequacy. For simplicity, we describe this using an example. The general case is very similar. Assume that we have two schemata S1 and S2 , a set of integration assertions IA and an identifying dynamic integration assertion ID = ([< A(x); B (x) >]; [< C (x); D(x) >; < E (x); F (x) >]). Also, there is no loss of generality to assume that the only possible terms that may execute an event rule are e1 and e2 . Let H (S1 ) be the Herbrand expansion of the rules in S1 . Make three copies of H (S1 ) and index all the predicate symbols in the first copy by b, in the second copy by m, and in the third copy by a. We then denote the copies by Hb (S1 ); Hm (S1 ), and Ha (S1 ), respectively. Also
594 The Logic of Conflicts define H (IA); H (IA); H (S ), and H (S ) analogously. Consider the set H (ID) = f([< A (e ); B (e ) >]; [< C (e ); D (e ) >; < E (e ); F (e ) >]); ([< A (e ); B (e ) >]; [< C (e ); D (e ) >; < E (e ); F (e ) >]); ([< A (e ); B (e ) >]; [< C (e ); D (e ) >; < E (e ); F (e ) >]); ([< A (e ); B (e ) >]; [< C (e ); D (e ) >; < E (e ); F (e ) >])g. This is the set of the possible variants of the ID, when b
b
a
b
2
m
2
2
b
1
a
1
b
m
a
1
1
2
m
m
2
a
m
1
m
2
a
1
b
m
1
a
bma
1
m
2
1
a
2
a
1
1
2
b
2
b
a
1
b
a
2
2
b
2
2
the event combinations are instanced in all possible ways with respect to e1 and e2 . We can now observe that ID is semi-adequate for S1 and S2 if for all diagrams for Hb (S2 ) ^ Ha (S2 ) ^ [(Ab (e1 ) ^ Ba (e1 )) _ (Ab (e2 ) ^ Ba (e2 ))], there is a diagram for
Hb (S1 ) ^ Hm (S1 ) ^ Ha (S1 ) ^ [(Cb (e1 ) ^ Dm (e1 )) _ (Cb (e2 ) ^ Dm (e2 ))] ^ [(Em (e1 ) ^ Fa (e1 )) _ (Em (e2 ) ^ Fa (e2 ))], such that [ is a diagram for Hb (IA) ^ Ha (IA).
Since we have no restriction of the formulas in a schema (except that they are first-order formulas) the general problem of determining adequacy is undecidable. However, if we restrict our attention to languages with a finite number of constants, after the transformation above we have a problem in second order propositional logic that is P 2 -complete. Finally, as in the static case, a dynamic conflict does not necessarily mean that the ultimate goals of the agents are in conflict. This shortcoming can be remedied in a way similar to the static case. It should also be observed that similar to the concept of static freeness of conflicts, the concepts of the dynamic counterparts may be generalized independent of a specific underlying language such as first-order logic. Given two schemata S1 and S2 expressed as connected digraphs hDi ; Ei i, where Ei Di Di and R D1 D2 are relations as before. Further, let Eij Di : : : Di (where the Cartesian product operates on j Di s), let Ei+ be the set of Eij ; j = 1; 2; : : : ; and let T E1 E2+ . A generalized definition of semi-adequacy is then:
8( ; ) 2 E 9( ; : : : ; ) 2 E ( ; T ; : : : ; ^ R ^ R ): 1
2
1
1
i
+ 2
1
2
1
i
1
1
2
i
The main point is again that the relations R and T are general and do not by themselves require a specific underlying language. Similar to defining freeness of conflicts as an instance of the relation R, it is straightforward to define the requirement of adequacy or more general concepts of dynamic freeness of conflicts as instances of the relation T .
7 Decision-making agents The model described above can be extended to include specifications with more complex data structures. One particular interesting issue is how decision theoretical aspects can be analysed. The model used below is based on the idea that agents continuously receive data and have to act with respect to these. Very often, in real-life situations, the available information is indeterminate, and there is no access to numerically precise data. Various aspects of this have been treated by us in [15, 16] and [18], but has not earlier been integrated in a model for goaldirected behaviour of agents according to plans. Below it is described how these decision theoretical issues can be integrated in specifications and how this affects the possibility of conflicts. In our earlier work, indeterminate information is represented in information frames consisting of linear systems of inequalities. These represents properties of sets of possible strategies that a set of agents has to decide about. Furthermore, the agent system may have information of the individual agents’ ability to give adequate estimates concerning the issues involved. However, the details of this particular decision theoretical model are not important for our
The Logic of Conflicts 595 purposes herein, so only some basic ideas will be recapitulated.9 Furthermore, the model can be substituted by any normative competitor.10 For simplicity, in the overview below we follow [16] and consequently assume a centralized rather than a decentralized decision structure (cf. [20] and [24]). When introducing definitions similar to those in [15], a corresponding decentralized scenario is easily modelled, as well as scenarios where more information about the strategies is available, for example, in terms of probabilities and utilities of different consequences of the strategies. The general idea is that indeterminate information is represented in information frames consisting of linear systems of weak inequalities. These represent (i) properties of sets of possible strategies of which a set of agents has to decide, and (ii) properties of individual agents, e.g. their ability to give adequate estimates concerning the issues involved. Below, we use the term credibility to denote the latter property. Suppose, for instance, that the relative credibility for an agent Ai is greater than 0.5 but less than 0.9, measured on some suitable scale. In this case, the translation will be ci 2 [0.5,0.9], represented by the two linear inequalities ci 0:5 and 0:9 ci . In general, interval sentences are of the form: ‘The credibility of Ai lies between the numbers ai and bi ’ and are translated into ci 2 [ai ; bi ]. Comparative sentences are of the form: ‘The credibility of Ai is greater than the credibility of Aj ’. Such a sentence is translated into the inequality ci cj . Each statement is thus represented by one or more constraints. We call the conjunction of constraints of the types above, together with the normalization constraint in ci = 1, the credibility base (C). The strategy base (U) consists of similar translations of imprecise estimates expressing the utility of the strategies.11 A strategy base with n agents and m strategies is expressed in strategy variables fu11 ; : : : ; u1n ; : : : ; um1 ; : : : ; umn g stating the utility of the strategies according to the different agents. The term uij denotes the utility of strategy Si with respect to agent Aj . The collection of credibility and utility statements constitutes an information frame. It is assumed that the variables’ respective ranges are real numbers in the interval [0,1]. Below, we will refer to an information frame as a structure (C,U). To see how these ideas are implemented, consider Figure 4 in which a specification of a process type expressed in the graphical notation of SDL88 is shown.
P
We will not explain the features of SDL88 in detail. Instead we rely on the fact that the intuition for the semantics of such a specification is sufficiently clear for the purpose of this article.12 To enable the methods for determining conflicts in specifications to be used, and to allow analysis of the integrated model, the relevant set of agent specifications are transformed into first-order formulae and a transition model.13 The basic symbols used in the graphical representation of SDL88 are as follows. An oval represents a state. A nicked box represents the consumption of a signal from the process’ queue. A pointed box sends a signal. Plain boxes contain assignments and other operations 9 The reader is referred to [15, 16] and [18] for a more careful treatment of the model in centralized and decentralized architectures. 10 [11] provides comparisons with other models for representing and evaluating decision situations in imprecise domains. 11 The values can be cost values, utility values, or values on any other appropriate scale, cf. [36]. 12 [6] provides the reader with the formal syntax and semantics of SDL88. 13 A treatment of the details of such a transformation is beyond the scope of this paper. [12] demonstrates how this can be done in the case of SDL88.
596 The Logic of Conflicts process p1
dcl v1 Typ1 dcl v2 Typ2
st1
i2
i1(v2)
u1 to process 2
u4 to process 3
u2 to process 3
v1:=f(v2)
u3(v1) to process 3
v1>0 true st2
false st3
F IGURE 4. A process specification in SDL
on data contained in process variables. A diamond shape represents a decision node where the course of the transition depends on the outcome of evaluating some variable. The symbols are connected by a uni-directional arc. A series of shapes and arcs builds a path that represents a procedural sequence. Paths follow a general downward direction. Every such path from one state symbol to the next represents a sequence of configurations under a transition relation. The name of the process type p1 is in the top left hand corner of the graph where the variables v 1 and v 2 are also declared and typed. The first symbol in the figure is an empty oval representing the start state of the process. Every process has a start state. When an instance of a process is created, the instance automatically transits from the start state to the first state, carrying out whatever operations are specified along the way. In Figure 4 there are no intermediary operations. Continuing with the example, the process instance waits in state st1 until it receives an input signal of type i1 or i2, upon which a transition is fired. If the input signal is of type i1 then the variable v 2 is implicitly assigned the value of the parameter carried by the signal i1. The transition then proceeds to an output symbol which sends signal u1 to process 2. If the signal is of type i2 then signal u4 is sent to process 3. The next four symbols are common to both paths. Signal u2 is sent to process 3, variable v 1 is assigned the value of f (v 2), and a decision node is reached. If at this node v 1 has a value exceeding zero the transition terminates leaving the process instance in state st2, otherwise in st3. The process will remain in its new state until another transition is fired. We will focus on the decision nodes of the representation since they, in a certain sense, define the possible choice mechanisms in the processes. In the terminology suggested here, strategies correspond to uni-directional arcs from the decision node to the next symbol in the specification. This means that the arcs in the process specifications are evaluated with respect
The Logic of Conflicts 597 to their utilities by the individual agents. A decision problem may then be analysed with respect to various decision rules. For instance, the interesting choices may be the ones that are pareto optimal in certain respects, or the ones that do not violate specific thresholds. Often, there is also a need for further discriminating criteria. For instance, the decision may be investigated with respect to stability constraints. That a decision is stable in this respect can mean that it is not affected when values close to the borders of the various intervals are ignored. Different kinds of algorithms for solving these kinds of problems have already been implemented in a tool for human decision makers [10]. Since they are independent of the particular agent architecture used, they can easily be adapted to automated evaluation in decision nodes in the sense described above. In a specification allowing for the evaluation of information frames, a decision node may be of two kinds. It can be a regular node in the conventional sense, but also a node involving the more intricate structure. An example of the latter is shown in Figure 5, where the selection criteria is a bit more complex. If the expected value of arc S1 (E (S1 )) is greater than the expected value of arc S2 (E (S2 )), and this is the case for 50% or more of the values consistent with (C; U )14 , the left arc is chosen. Otherwise, the right arc is chosen.
E(S1) > E(S2) true in 50% of (C,U)
not true in 50% (C,U)
F IGURE 5. Extending the decision abilities of an agent system
Thus, the agents are modelled with an underlying assumption of benevolence in the sense that they always obey the decisions taken at the decision nodes. An aspect which should be noted in the following is that the model is independent of whether the possible strategies given in a decision node have similarities with strategies in other nodes in other specifications. The only proviso in this respect is that in a multi-agent system the agents have the possibility to express utility estimates concerning all possible strategies in a set of specifications. The general model is very liberal in this respect and the principles that should govern a particular implementation are naturally domain dependent. Naturally, an information frame may also be changed, for instance, when the agent system is updated. However, we will assume that this is implicit in the information frames discussed below. As we have seen, the paths worth considering in a process description as described above are dependent of the particular information frames possible in the different decision nodes. Thus, it is possible to characterize the reasonable decision space modulo a set of decision rules. The set of states that are accessible with respect to this space may then be considerably reduced. Only states that satisfy certain requirements defined by the information frames and 14 This means that if the expected value of strategy S is greater than the expected value of S in a reasonable 1 2 subspace of the solution set to the constraints involved, the left arc is chosen. The semantics and algorithms for evaluating decisions in vague domains are provided in [11].
598 The Logic of Conflicts the decision rules should be possible candidates for actual goals of the agents represented by the specifications. D EFINITION 7.1 Let MA be a set of process specifications fP1 ; : : : ; Pm g, and let Nij be a decision node in the process Pj . An information frame in node Nij is a structure Iij (C,U), where C and U are finite lists of linear constraints in the credibility and utility variables. These represent the credibility and utility estimates of the agents in MA. As was mentioned above, the decision taken in a particular node depends also on the decision rule used at that node. One such candidate is a variant of the criterion of pareto optimality. First we define a weighted mean value of the values of the different arcs from a decision node. The weights in this sum are the various credibilities asserted by the agents (or in a simplified case a decision making agent) in the system. The intuition for the notions below is that the term ci denotes the credibility of agent i, and that the term uij denotes the utility of arc i in the opinion of agent j . D EFINITION 7.2 Given an information frame Ikl (C; U ); E (pi ) denotes the expression c1 ui1 + : : : + chi uihi , where ci and uij are variables in C and U respectively. Let ai and bi be two vectors of real numbers (a1 ; : : : ; ahi ) and (bi1 ; : : : ; bihi ). ai biE (pi ) denotes the expression a1 bi1 + : : : + ahi bihi (where ai and bij are numbers substituted for ci and uij in E (pi )). Next, we define the concept of an admissible arc. An admissible arc is, in some sense, pareto optimal. D EFINITION 7.3 Given an information frame Ikl (C; U ), an arc pi is at least as good as an arc pj iff ai biE (pi ) ai bjE (pj ) 0, for all ai ; bi ; bj , where fc1 = a1 g& : : : &fchi = ahi g is consistent with the constraints in C and fui1 = bi1 g& : : : &fuihi = bihi g&fuj 1 = bj 1 g& : : : &fujhi = bjhi g is consistent with the constraints in U . pi is better than pj iff pi is at least as good as pj and ai biE (pi ) ai bjE (pj ) > 0, for some ai ; bi ; fj , such that fc1 = a1 g& : : : &fchi = ahi g is consistent with C and fui1 = bi1 g& : : : &fuihi = bihi g&fuj 1 = bj 1 g& : : : &fujhi = bjhi g is consistent with the constraints in V . pi is admissible iff no other pj is better than pi . Observe that these concepts are defined locally, i.e. with respect to a given decision node in a given process specification. The following definition is a bit more informally stated. It defines the meaning of a path between the initial state of a specification and a particular state that may be reached from the initial state according to the specification. Two ordered symbols in a specification are consecutive if the second symbol immediately (along an arc) follows the first. D EFINITION 7.4 Let Pi be a process specification and let sj be a state in Pi . (sj ; Pi ) is a set of ordered lists of consecutive symbols in Pi , from the initial state symbol to the state symbol denoting sj .
The following definition characterizes the set (Pi ) of reasonable states in a specification Pi . A state is a member in such a set if there is a path leading to the state, where all decision nodes in the path are followed by admissible arcs, i.e. it should be possible to choose them with respect to the information frames and the decision rules in the nodes.
The Logic of Conflicts 599 D EFINITION 7.5 Let MA be a set of process specifications. Given a set of information frames fIij (C; U )g in MA, a state sk in the process Pj belongs to the set (Pj ) iff there is a list L in (sk ; Pj ), such that for each decision node symbol Nij in L, there is a succeeding symbol in L that follows immediately from Nij in Pj and along an arc that is admissible with respect to Iij (C; U ). Again, it should be emphasized that, even if the presentation above presupposes a particular decision rule, there are no particular restrictions on the decision rules used by a decision node, and a variety of criteria and norms (cf. [4]) could be implemented. A more general model are discussed in [19] and could easily be adapted to the present model. Different rules may also be grouped into hierarchies in the various nodes. The same applies to stability conditions as demonstrated in Figure 5, where the decision is dependent on how stable the solutions are with respect to variations in the underlying information frame. Various kinds of stability conditions are discussed in [10].
8 Reasonable Goals In section 5 we defined what it is meant by that two schemata are free of conflicts - two schemata are in conflict with respect to a set of static integration assertions if one of them together with the integration assertions restrict the set of diagrams, containing ultimate goals, for the other one. However, including decision making aspects, the number of interesting goals is often decreased by requiring that the set of goals should also be states that are on paths containing only admissible arcs. Therefore, we require that the goal set under consideration should be reasonable in the following sense.15 D EFINITION 8.1 Let Pi be a process modelled by a schema Si . The reasonable goal set Gi in Si is the set f : is a goal in Si and 2 (Pi )g. Thus, in case of a reasonable goal conflict detection, the relation R in the earlier definition could be modified in the following respect. D EFINITION 8.2 Let IA and hDi ; Ei i be as above. Further, let Gi denote the reasonable goal set in schema Si . S2 and S1 are free of conflicts with respect to IA iff 8 2 G1 9 2 G2 R , where [ j= IA. Otherwise S2 and S1 are in conflict with respect to IA. It is possible that two specifications that were in conflict before an update of the information frames became free of conflicts by the update, and vice versa. This is because a goal in a schema may cease to be a member in the reasonable goal set when new information is provided. It should also be observed that significant information concerning possible schema conflicts may be obtained even if the information frames are not entirely known. Note that an information frame containing only trivial constraints (i.e. scaling and normalization constraints) is weaker than any possible information frame containing the trivial constraints. By generalizing this observation, we can see that a characterization of the possible information frames may in some cases be sufficient. D EFINITION 8.3 Let MA be a set of process specifications. Given a set of possible information frames fIij (C; U )g in decision node Nj in the process Pi in MA. The characterization of fIij (C; U )g is the union of the solution sets to the information frames in this set. 15 We
restrict the presentation to the static case. The dynamic case is treated analougously.
600 The Logic of Conflicts Consequently, the trivial information frame is a characterization of all possible information frames. Naturally, the more information that can be provided in terms of constraints in the characterization, the more significant information can be derived about the reasonable goals in advance, but the main point here is that even when quite a weak characterization prevails, information about reasonable goals can be acquired. Goals unreasonable with respect to a characterization will never be reasonable with respect to an information frame in the characterization (provided that the characterization is correct, in the sense that it really corresponds to the possible information frames).
9 Concluding Remarks The work described in this paper has two purposes. Firstly, it is motivated by the difficulties to determine whether complex agent systems in actual fact are in conflict. Secondly, the set of goals compatible when investigating the system from a meta-perspective may not be reasonable in the sense that the agents actually have a possibility to reach them. The latter may be the case when the agents are forced to abandon possible paths leading to goals because the utility is too low in a particular environment or when the probability to achieve them along a specific path is too low according to certain risk constraints. The model described above can also be utilized in several ways in different phases in the execution of a multi-agent system. First, assume that the possible sets of estimates can be characterized in an exact way at a certain point. Then the procedures suggested can be utilized to determine exactly the reasonable goal sets at this point. If this cannot be done in entirety, for instance when estimating future configurations in advance, the decision nodes may contain weaker constraints in terms of characterizations. Even these could be utilised for determining probable paths through the processes. If the frames in the latter situations turn out to be too tolerant, sensitivity analyses and contractions can be used to determine thresholds for possible estimates by evaluating the solution sets of the characterizations and determine, for instance, when an admissible arc ceases to be admissible. If these thresholds are violated, the goals along certain paths cease to be reasonable. This kind of constraints can also include stability properties of the results. For instance, if a decision is unstable in the sense that it is very sensitive already for small contractions of the intervals in the information frames, it may violate certain norms accepting only stable situations, and for this reason be undesirable.
Acknowledgements This work was performed mainly at IIASA, International Institute for Applied Systems Analysis, A-2361 Laxenburg, Austria. This work was supported by the Swedish Foundation for International Cooperation in Research and Higher Education (STINT). The author is also indebted to Guy Davies, Paul Johannesson, Magnus Boman and Mats Danielson, DECIDE Research Group, for discussions and remarks.
References [1] S. Abiteboul and V. Vianu. Equivalence and optimization of relational transactions. Journal of ACM, 35, 130– 145, 1988.
The Logic of Conflicts 601 [2] J. van Benthem and J. Bergstra. Logic of transition systems. Journal of Logic, Language and Information, 3, 247–283, 1995. [3] E. W. Beth. The Foundations of Mathematics. North Holland, 1959. [4] M. Boman. Norms in artificial decision making. Artificial Intelligence and Law, 7, 17–35, 1999. [5] N. Carver and V. Lesser. The DRESUN testbed for research in FA/C distributed situation assessment: Extensions to the model of external evidence. Proceedings of the First International Conference on Multi-Agent Systems, pp. 33–40, 1995. [6] CCITT. CCITT Recommendation Z.100: Specification and Description Language SDL. (Blue Book, Volume X.1-X.5): ITU General Secretariat-Sales Section, Places des Nations, CH-1211 Geneva 20, 1988. [7] J. Chu-Carroll and S. Carberry. Communication for conflict resolution in multi-agent planning. Proceedings of the First International Conference on Multi-Agent Systems, pp. 49–56, 1995. [8] S. Cook and R. Reckhow. The relative efficiency of propositional proof systems. Journal of Symbolic Logic, 44, 36–50, 1979. [9] M. D’Agostino. Investigations into the complexity of some propositional calculi. Technical Monograph PRG88, Ph. D. Thesis, Oxford University, 1990. [10] M. Danielson. Computational Decision Analysis. PhD Thesis, Department of Computer and Systems Sciences: Royal Inst. of Technology, 1997. [11] M. Danielson and L. Ekenberg. A framework for analysing decisions under risk. European Journal of Operations Research, 104, 474–484, 1998. [12] G. Davies and L. Ekenberg. Agent metaphors for analysing telematic services. Proceedings of IATA, LNAI 1437, pp. 156–170, Springer Verlag, 1998. [13] C. Dixon, M. Fisher and M. Wooldridge. Resolution for temporal logics of knowledge. Journal of Logic and Computation, 8, 345–372, 1998. [14] B. Dreben and W. D. Goldfarb. The Decision Problem: Solvable Classes of Quantification Formulas, AddisonWesley, Reading, MA, 1979. [15] L. Ekenberg. Modelling decentralised decision making. Proceedings of ICMAS’96, pp. 64–71, AAAI/The MIT Press, 1996. [16] L. Ekenberg, M. Danielson, and M. Boman. From local assessments to global rationality. International Journal of Intelligent and Cooperative Information Systems, 5, 315–331, 1996. [17] L. Ekenberg and P. Johannesson. A formal basis for dynamic schema integration. Proceedings of 15th International Conference on Conceptual Modelling ER’96, pp. 211–226, Lecture Notes in Computer Science, Springer-Verlag, 1996. [18] L. Ekenberg, M. Danielson, and M. Boman. Imposing security constraints on agent-based decision support. Decision Support Systems International Journal, 20, 3–15, 1997. [19] L. Ekenberg, M. Boman, and J. Linneroth-Bayer. General risk constraints. To appear in Journal of Risk Research, 2000. [20] E. Ephrati and J. S. Rosenschein. The Clarke tax as a consensus mechanism among automated agents. Proceedings of the Ninth National Conference on Artificial Intelligence, pp. 173–178, AAAI Press/The MIT Press, 1991. [21] P. Johannesson and P. Wohed. Modelling Agent Communtication in a first order logic. Accounting Management and Information Technologies, 8, 5–22, 1998. [22] D. S. Johnson. A catalogue of complexity Classes. In Handbook of Theoretical Computer Science, A, J. van. Leeuwen, ed., Amsterdam: Elsevier, 1990. [23] M. J. Katz and J. S. Rosenschein. Verifying plans for multiple agents. Journal of Experimental and Theoretical Artificial Intelligence, 5, 39–56, 1993. [24] S. Kraus, E. Ephrati and D. Lehmann. Negotiation in a non-cooperative environment. Journal of Experimental and Theoretical Artificial Intelligence, 3, 255–282, 1991. [25] S. Kraus and J. Wilkenfeld. The function of time in cooperative negotiations. Proceedings of the Ninth National Conference of Artificial Intelligence, pp. 179–184, 1991. [26] K. Kuwabara and V. R. Lesser. Extended protocol for multistage negotiation. Proceedings of the Ninth Workshop on Distributed Artificial Intelligence, pp. 129–161, Rosario, Washington, 1989. [27] Ee-Peng Lim, J. Srivastava and S. Shekhar. Resolving attribute incompatibility in database integration: an evidential reasoning approach. Dept. of Computer Science, Univ. of Minnesota, publication 1063–6382/94, 1994.
602 The Logic of Conflicts [28] M. Mondadori. Classical Analytical Deduction. Annali dell’Universit di Ferrara, Sezione III, Discussion paper, n. 1, Universita di Ferrara, 1988. [29] M. Mondadori. Classical Analytical Deduction, part II. Annali dell’Universit di Ferrara, Sezione III, Discussion paper, n. 5, Universita di Ferrara, 1988. [30] Y. Moses and M. Tennenholtz. Artificial social systems part1: Basic principles. Technical Report CS90-12, Weizmann Institute, 1990. [31] A. S. Rao and M. P. Georgeff. BDI agents: from theory to practice. Proceedings of the First International Conference on Multi-Agent Systems, pp. 313–319, 1995. [32] A. S. Rao and M. P. Georgeff. Decision procedures for BDI logics. Journal of Logic and Computation, 8, 293–342, 1998. [33] J. A. Robinson. A machine oriented logic based on the resolution principle. Journal of the ACM, 12, 23–41, 1965. [34] J. S. Rosenschein. Synchronization of multi-agent plans. Proceedings of National Conference of Artificial Intelligence, pp. 115–119, 1982. [35] J. S. Rosenschein and G. Zlotkin. Rules of Encounter. The MIT Press, 1994. [36] P. Shoemaker. The expected utility model: its variants, purposes, evidence and limitations. Journal of Economic Literature, XX, 529–563, 1982. [37] Y. Shoham. Agent-oriented programming. Artificial Intelligence, 60, 51–92, 1993. [38] Y. Shoham and M. Tennenholtz. On social laws for artificial agent societies: off-line design. Artificial Intelligence, 73, 231–252, 1993. [39] R. M. Smullyan. First-Order Logic. Springer Verlag, 1968. [40] G. St˚almarck. System for Determining Propositional Logic Theorems by Applying Values and Rules to Triplets that are Generated from a Formula. US, Patent No. 5 276 897 1995. [41] G. St˚almarck, L. Ekenberg, S. Berg, I. Olsson and F. Nordberg. Pilot study of formal analysis of service interaction, validation and verification. Telia Research AB, 1996. [42] K. P. Sycara. Resolving goal conflicts via negotiations. Proceedings of the Seventh National conference on artificial Intelligence, pp. 245–250, St. Paul Minnesota, 1988. [43] P. van Hentenryck. Constraint Satisfaction in Logic Programming. MIT Press, 1989. [44] G. Zlotkin and J. S. Rosenschein. Incomplete information and deception in multi-agent negotiation. Proceedings of 12th IJCAI, pp. 225–231, 1991.
Received 21 July 1997
