Knowledge-Based Systems 27 (2012) 343–351

Contents lists available at SciVerse ScienceDirect

Knowledge-Based Systems

journal homepage: www.elsevier .com/ locate /knosys

A complete first-order temporal BDI logic for forest multi-agent systems q

Lijun Wu a,⇑, Kaile Su b, Abdul Sattar b, Qingliang Chen c,d, Jinshu Su e, Wei Wu f

a School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, Chinab Institute for Integrated and Intelligent Systems, Griffith University, Nathan, QLD, Australiac Department of Computer Science, Jinan University, Guangzhou 510632, Chinad Key Laboratory of Embedded System and Service Computing, Ministry of Education, Tongji University, Shanghai, PR Chinae School of Computer Science, National University of Defense and Technology, Changsha 610054, Chinaf School of Electronics Engineering and Computer Science, Peking University, Beijing 100871, China

a r t i c l e i n f o

Article history:Received 18 April 2011Received in revised form 4 November 2011Accepted 5 November 2011Available online 11 November 2011

Keywords:First-order temporal BDI logicFirst-order temporal BDI interpreted systemForest multi-agent systemModel checkingBDI proof system

0950-7051/$ - see front matter � 2011 Elsevier B.V. Adoi:10.1016/j.knosys.2011.11.006

q Project supported by National Basic Research 92010CB328103 and 2009CB320701; National Natur61073033, 61003056, 60725207 and 6111113018FT0991785, German Science Foundation DFG 446 CHproject of Ministry of Education in China grant No.Laboratory of Embedded System and Service ComputinFunds for the Central Universities of China and FoundaTalents in Higher Education of Guangdong, China Gra⇑ Corresponding author.

E-mail address: wljuestc@gmail.com (L. Wu).

a b s t r a c t

This paper presents a new complete first-order temporal BDI logic and forest multi-agent system. Themain characteristic of the logic is that its semantic model is based on the forest multi-agent system,which enables us to reason about beliefs, desires, and intentions between agents with different layerssuch as father agent and child agent. The logical reasoning and hierarchical structures of the forestmulti-agent system can suitably capture the hierarchical property of the real systems and therefore ispractically realistic. We propose further four classes of first-order BDI interpreted systems and four proofsystems which are sound and complete with respect to corresponding classes of BDI interpreted systems.Finally, we give a case to show how to characterize the forest multi-agent system by using the hierarchi-cal structure of modules, and to solve the model checking problem of first-order temporal BDI logic forthe forest multi-agent system.

� 2011 Elsevier B.V. All rights reserved.

1. Introduction

The modal logics have received considerable attention in artifi-cial intelligence over years [1,2]. Among the most well-known for-malisms is epistemic logic which enables us to reason aboutmental attitudes in multi-agent systems such as knowledge [3,4].However, the logic cannot express more complex mental attitudesand interrelations among them. As one of main modal logics, theBDI logic is investigated and used to reason about more complexmental attitudes such as beliefs, desires, and intentions in multi-agent systems [5,6]. For better expressiveness, a lot of researchersattempted to extend the BDI logic to first-order and temporaldimensions [7,8]. However, no complete first-order temporal BDIlogic is proposed and proved so far, and all researches on BDI logicsare potentially under the assumption that all agents are on thesame layer, and little attention is paid to reasoning about BDI logicwhile multi-agent systems are of hierarchical structures. In fact,

ll rights reserved.

73 Program of China grantal Science Foundation grant3; ARC Future FellowshipV 113/266/0-1, Key research210257, Open Funds of Keyg, the Fundamental Researchtion for Distinguished Youngnt No. LYM09028.

when an agent has a superior agent, its desire may be influencedby its superior. However, it is difficult to specify the relationbetween desire and intention of the agents in different hierarchiesby the above theories.

In the last decade, although the area of multi-agent systems hasbecome an active research field and a lot of related research workhas been pursued [3,9–11,36], but little attention is given to inves-tigate on the structures of multi-agent systems such as hierarchicalstructures of agents and the related logical reasoning about multi-agent systems with hierarchical structures, which have practicalsignificance in the real world.

This paper is to address the deficit. The main contributions ofour paper are as follows. Firstly, we propose a framework of for-est multi-agent system which is denoted by FMAS, and extendthe BDI logic to a complete first-order temporal BDI logic forFMAS, which is called QTBDI logic, where QT stands for quantifiedand temporal. Secondly, we put forward concepts of synchronoussystems with perfect recall or no learning with respect to beliefs,desires and intentions; and investigate four proof systems forFMAS along with their soundness and completeness. The QTBDIlogic and proof systems we present are based on FMAS, which en-able us to reason about different mental attitudes such as beliefs,desires, and intentions between two agents on different layers.For example, let agent j be the superior of agent i; Dju expressesthat agent j desires u (or say the goal of agent j is u); and Iiu ex-presses that agent i intends u (or say agent i chooses an inten-tional series of actions to make u true). Then, clearly, it is

344 L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351

reasonable to assume that Iiu ? Dju _ Diu, which means that anagent may realize its own goal as well as the goal of its superioragent. That is, in hierarchical multi-agent systems agents areautonomous and their existence is not just for realizing the goalsof their supervisors. Thirdly, we propose a way to model checkingQTBDI for FMAS. We describe the FMAS by using the hierarchicalstructure of modules, which plays an important role in modelchecking problem of QTBDI logic for FMAS, because we can trans-fer easily the problem of our model checking to that of LTL modelchecking by the famous model checker SPIN [35] just as ourexample shows.

The structure of the paper is as follows. We propose a frame-work of FMAS in the next section. Then we extend BDI logic tothe QTBDI logic for FMAS in Section 3. Based on this, an interpretedsystem model for QTBDI logic in FMAS is presented and a soundand complete proof system is constructed in Section 4. In Section5 and 6, we explore how to reduce QTBDI model checking to LTLmodel checking by the famous model checker SPIN [35] and givea case study. Some related work is discussed in Section 7. Finally,we conclude this paper in Section 8.

2. Forest multi-agent system

In order to investigate the FMAS, we observe first an example.

Example 1. Suppose we have the following scenario: there is asmall troop which consists of a military officer and two soldierscommanded by the military officer. Now there are four areas andone of them has one enemy. First, the military officer believes,among the four areas, there is one area where there is one enemy,and sets a goal (or say desire) to wipe out the enemy. According tohis belief and desire, the two soldiers intend to realize the goal.

In the example, there are three points that we should pay atten-tion to. Firstly, the example involves mental attitudes such as be-liefs, goals, and intentions which has been investigated by Raoand Georgeff [12]. Secondly, the example also involves existentialquantifiers. Thirdly, the relation of these three people is not equal,since the military officer is the superior to the two soldiers. The to-tal relation among these three people is like a tree. And the mentalattitudes of the superior influence those of its immediate subordi-nates, and vice versa.

As far as we know, the previous research work on models ofmodal logics for multi-agent systems considered potentially agentsto be on the same layers. Therefore, it is hard to exploit those mod-els to characterize the above example. In order to specify formallythe example, we reconsider every person as an agent, and theirinterrelation as a tree and the example as a system. Hence, wecan model the system in the above example as a tree multi-agentsystem.

In order to generalize the example, we assume that there areone or more trees in a system. Thus the system is considered as for-est multi-agent system (FMAS). When every tree of a FMAS hasonly one layer, the FMAS is just the multi-agent system that wesay ordinarily.

We assume that FMAS consists of n agents. Every node is anagent, and agent 1 is the root node of the first tree. Every treehas a root node, and the node without child agent is called as leafnode. Every node i that is not leaf node, has at least a child agentand the set of all its child nodes is denoted by child(i). If agent jis not root node, then its father node is denoted by father(j). Inour FMAS, the mental attitudes of every agent influence only itschild agents, but cannot directly influence child agents of its childagents, and vice versa. Every operation of FMAS should be com-pleted together by agents with different layers, for example, if anagent intends to realize a goal and it has a father agent, then itsfather agent should have had the goal.

In fact, the human society can also be considered as a FMAS.Every country is a tree in FMAS. The president of a country is theroot node of the tree (or the country), and chief executive of everystate of the country is the child node (or state node) of the presi-dent node. The mental attitudes of the president node will influ-ence that of its state node.

3. QTBDI logic

In this section, we extend BDI logic to a complete first-order tem-poral BDI logic for FMAS (namely QTBDI logic for FMAS).

3.1. Syntax

We denote QTBDI language for FMAS with n agents by Ln.

Definition 1. Terms and formulas in Ln can be defined in theBackus–Naur Form as follows:

t ::¼ xjf kðt1; t2; . . . ; tkÞu ::¼ Pkðt1; t2; . . . ; tkÞjt¼ t0j:uju! wjBiðuÞjDiðuÞjIiðuÞjOujuUwj8xu

where x is individual variable, fk() is k-ary function, Pk() is k-arypredicate symbol, ‘=’ is identity predicate, and t1, t2, . . . , tk areterms.: and ? are standard proposition connectives, while O(‘‘next

time’’) and U(‘‘until’’) are standard temporal operators. Intuitively,Ou is true if u is true at next step; and uUw is true if u is trueuntil w is true. " is the universal quantifier. Bi(u) and Di(u) mean‘‘agent i believes u’’ and ‘‘agent i desires u’’ respectively. AndIi(u) means ‘‘agent i intends u’’. The intuition behind ‘belief’ isthat, agent i believes property u but u may be false of the envi-ronment. For example, a robot believes that there is an obstacle infront of it, but maybe there is none. Di(u) intuitively means thatagent i’s goal implies that u holds. Ii(u) intuitively means that‘‘agent i will choose an intentional series of actions to make utrue’’.

In what follows, we write u(x) when x (possibly) occurs free inu, and use u[x/y] to denote the result that free variable x in u isreplaced by free variable y.

3.2. QTBDI interpreted system and semantics

To give the semantics of QTBDI logic, we first define the first-or-der temporal BDI interpreted system model in FMAS (QTBDI inter-preted system). Two key points of the system are as follows. Firstly,an agent’s beliefs, desires, and intentions are characterized as rela-tions, and secondly, there are interrelations between mental atti-tudes of agents on different layers in FMAS.

To introduce QTBDI interpreted system, we give some notionsconcerning runs. We assume that a system composes of n agentsin some environment and represent the system’s state or the globalstate as a tuple (se,s1, . . . ,sn), where se is the environment’s localstate and, for each i, si is agent i’s local state. Let Le be a set of pos-sible local states of the environment and Li a set of possible localstates for agent i, for i = 1, . . . ,n. We take S # Le � L1 � � � � � Ln tobe the set of reachable global states of the system. Let T # S � Sbe a transition relation that must be total, that is, for every states 2 S there is a state s0 such that T(s,s0). A run over S is a functionfrom the time domain-the natural numbers in our case-to S. Thus,a run over S can be identified with an infinite sequence of globalstates s0s1s2. . . such that T(si,si+1) holds for all i P 0. A system is aset of runs. We refer to a pair (r,m) consisting of a run r and timem as a point. Given a point (r,m), we denote the global state at

L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351 345

the time point by r(m), the first component of r(m) by re(m), and foreach i (1 6 i 6 n), the (i + 1)th component of the tuple r(m) by ri(m).Thus, ri(m) is the local state of agent i in run r at time m.

For every agent i, we say that (r,m) and (r0,m0) are indistinguish-able to agent i iff riðmÞ ¼ r0iðm0Þ, and write as (r,m) �i (r0,m0).

We characterize an agent’s belief, desire and intention as binaryrelations. Let Bi, Di, and Ii be relations related to agent i’s beliefs, de-sires, and intentions respectively. Intuitively, ((r,m), (r0,m0)) 2 Bi

means that agent i believes r(m) is accessible from r0(m0). Similarly,((r,m), (r0,m0)) 2 Di means that when agent i is in state r(m), r0(m0) isan accessible state that it desires; and (r(m), r0(m0)) 2 Ii means thatwhen agent i attempts to realize its goal, r0(m0) is an accessiblestate from r(m) by choosing some actions.

Therefore, we say that (r0,m0) is belief-accessible to agent i from(r,m) (or say that (r0,m0) and (r,m) are indistinguishable to agent ifrom the viewpoint of belief), and write ðr;mÞ�Bi

ðr0;m0Þ (orrðmÞ�Bi

r0ðm0Þ), iff ((r,m), (r0,m0)) 2 Bi.We say that (r0,m0) is desire-accessible to agent i from (r,m) (or

say that (r0,m0) and (r,m) are indistinguishable to agent i from theviewpoint of desire), and write ðr;mÞ�Di

ðr0;m0Þ (or rðmÞ�Dir0ðm0Þ),

iff ((r,m), (r0,m0)) 2 Di.We say that (r0,m0) is intention-accessible to agent i from (r,m)

(or say that (r0,m0) and (r,m) are indistinguishable to agent i fromthe viewpoint of intention), and write ðr;mÞ�Ii

ðr0;m0Þ (orrðmÞ�Ii

r0ðm0Þ), iff ((r,m), (r0,m0)) 2 Ii.Let Bi(s) = {s0j(s,s0) 2 Bi}, Di(s) = {s0 j(s,s0) 2 Di}, and

Ii(s) = {s0j(s,s0) 2 Ii}.Obviously, all agents should satisfy the positive introspection

property and the negative introspection property, and if an agenti intends to realize a goal (or say desire) and it has father agent,then it is reasonable to assume that either it should have had thegoal or its father agent father(i) have had the goal. Thus, Bi, Di,and Ii should satisfy the following property:

� Bi, Di, and Ii are all transitive and symmetric.� Bi, Di, and Ii are not reflective because u is possibly false when

agent i believes (or desires or intends) u.� For any agent i and s 2 S, Di(s) # Ii(s) holds or Dfather(i)(s) # Ii(s)

holds, which ensures the fact that if an agent i intends to realizea goal (or say desire) and it has father agent, then either itshould have had the goal or its father agent father(i) should havehad the goal.

We first define a QTBDI frame over FMAS as follows:

Definition 2. The QTBDI frame over FMAS is a tuple hS,B,D, I,Fiwhere S is the set of all states of system, F is a non-empty set ofindividuals; B, D, and I are sets of all relations Bi, Di, and Ii (i = 1,2, . . . ,n) respectively; and Bi, Di, and Ii satisfy the above properties.

Let r be an assignment from the variables in Ln to the individu-als in F. A variant r(x/a) of an assignment r is an assignment thatassigns a 2 F to x and coincides with r on all other variables.

Definition 3. Given an assignment r and a state s in S, aninterpretation IP on a QTBDI frame hS,B,D, I,Fi over FMAS isinductively defined as follows:

� IP(x) = r(x), where x is an arbitrary variable;� IP(fk(t1, t2, . . . , tk)) = IP(fk)(IP(t1), IP(t2), . . . , IP(tk)), where fk is a k-

ary function symbol and IP(fk) is a k-ary function from Fk to F;� IP(Pk(t1, t2, . . . , tk),s) is a k-ary relation on F, where Pk() is a k-ary

predicate symbol;� IP(=,s) is the equality on F.

Now we can define the QTBDI interpreted system as follows:

Definition 4. A QTBDI interpreted system P on a QTBDI framehS,B,D, I,Fi is a pair hR, IPi such that R and IP are the non-empty setof all runs and an interpretation on hS,B,D, I,Fi respectively.

We say the QTBDI interpreted system P is synchronous and withperfect recall iff for every agent i, (r,m) �i (r0,m0) implies thatm = m0 and for every j < m; riðjÞ ¼ r0iðjÞ and if (r(m),r0(m0)) 2 Bi then(r(j),r0(j)) 2 Bi, if (r(m),r0(m0)) 2 Di then (r(j),r0(j)) 2 Di, and if(r(m), r0(m0)) 2 Ii then (r(j),r0(j)) 2 Ii. This means that the agent inthe system with perfect recall can remember its beliefs, desires,and intentions. We say the QTBDI interpreted system P is synchro-nous and with no learning iff for every agent i, (r,m) �i (r0,m0)implies that m = m0 and for every j > m, riðjÞ ¼ r0iðjÞ and if(r(m), r0(m0)) 2 Bi then (r(j),r0(j)) 2 Bi, if (r(m),r0(m0)) 2 Di then(r(j),r0(j)) 2 Di, and if (r(m),r0(m0)) 2 Ii then (r(j), r0(j)) 2 Ii. This meansthat the agent in the system with no learning always keep itsbeliefs, desires, and intentions.

We use Qn to denote the class of QTBDI interpreted systemswith n agents, Qspr

n the class of synchronous QTBDI interpreted sys-tems with perfect recall and n agents, Qsnl

n the class of synchronousQTBDI interpreted systems with no learning and n agents, andQsprnl

n the class of synchronous QTBDI interpreted systems with per-fect recall, no learning, and n agents.

Definition 5. Given an assignment r and a QTBDI interpretedsystem P. Let u and w be formulas in Ln, r be a run in P, (r,m) be apoint in P. Then the satisfaction relation �r is inductively definedas follows:

(P,r,m) �r Pk(t1, t2, . . . , tk) iff hIP(t1), IP(t2), . . . , IP(tk)i 2 IP(Pk(t1,t2, . . . , tk),r(m))(P,r,m) �r (t = t0) iff IP(t) = IP(t0)(P,r,m) �r :u iff (P,r,m) j– u(P,r,m) �r u ? w iff (P,r,m) j– u or (P,r,m) �r w(P,r,m) �r Bi(u) iff (P,r0,m0) �r u for all (r0,m0) such thatðr;mÞ�Bi

ðr0;m0Þ(P,r,m) �r Di(u) iff (P,r0,m0) �r u for all (r0,m0) such thatðr;mÞ�Di

ðr0;m0Þ(P,r,m) �r Ii(u) iff (P,r0,m0) �r u for all (r0,m0) such thatðr;mÞ�Ii

ðr0;m0Þ(P,r,m) �r Ou iff (P,r,m + 1) �r u(P,r,m) �r uUw iff there exists n P m such that (P,r,n) �r wand (P,r,k) �r u for all k with m 6 k < n(P,r,m) �r "xu iff (P,r,m) �r(x/a) u for all a 2 F

The satisfaction relation for formulas containing other proposi-tion operators and LTL temporal connectives can be defined fromabove.

We say that a formula u is valid in a QTBDI interpreted sys-tem P, denoted by P �u, if (P,r,m) �r u holds for every point(r,m) in P. We use � u to denote that u is valid in every QTBDIinterpreted system of Qn, �spr u to denote that u is valid in everyQTBDI interpreted system of Q spr

n ; �snl u to denote that u isvalid in every QTBDI interpreted system of Qsnl

n , and �sprnl u todenote that u is valid in every QTBDI interpreted system ofQsprnl

n .According to our definition, Di(u) is true iff u is true at those

states that are desire accessible to agent i.

4. The proof system

In this section we present a sound and complete QTBDI proofsystem with respect to QTBDI interpreted system over FMAS. It isthe result that extends BDI logic [8,12] to first-order version onFMAS.

346 L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351

4.1. The QTBDI proof system and soundness result

Consider the QTBDI proof system consisting of following axiomsand inference rules, where Xi may stand for Bi, Di and Ii.

M1 All tautologies of propositional calculusM2 (Xiu ^ Xi(u ? w)) ? Xi(w), i = 1,2, . . . ,nM3 Xiu ? XiXiu, i = 1,2, . . . ,nM4 :Xiu ? Xi:Xiu, i = 1,2, . . . ,nM5 Iiu ? Diu _ Dfather(i)u, i = 1,2, . . . ,n, when i has father agent

T1 (Ou ^ O(u ? w)) ? OwT2 O(:u) M :Ou, i = 1,2, . . . ,nT3 uUw M w _ (u ^ O(uUw))

BF "xXiu ? Xi"xuCBF Xi"xu ? "xXiu

EX "xu(x) ? u[x/t]Id t = tFunc (t = t0) ? (fk[x/t] = fk[x/t0])Subst (t = t0) ? (u[x/t] = u[x/t0])

R1 From u and u ? w infer wR2 From u infer Iiu ^ BiuRT1 From u infer OuRT2 From (u0 ? :w) ^u0 infer u0 ? :(uUw)

Similar to [8], our axiomatization for beliefs, desires, and inten-tions is standard S5 (namely, KT45) [3], which is different from [12].

We consider that in FMAS, any agent may realize its own goal aswell as the goal of its superior agent, that is, its existence is not justfor realizing its own goal. Thus, for the relation between desires (orgoals) and intentions, we replace AI2 in [12] with M5 in our proofsystem.

Different from [12], our proof system does not include the ax-iom Diu ? Biu, because in some cases maybe it does not hold,for example, in Example 1, if agent i desires u or adopts u as a goalwhere u expresses ‘‘we wipe out enemy’’, then clearly, it is notappropriate to say that the agent i believes u, but should say thatthe agent i believes ‘‘we are able to wipe out enemy’’. Let w express‘‘we are able to wipe out enemy’’. Obviously w means the ability forus to wipe out enemy and is different from u.

Similar to [13], we have the axioms for time T1, T2, and T3. RT1and RT2 are similar to RT1 and RT2 of [24]. In fact, if u is valid, thenfor any system P and any point (r,n), (P,r,m) � u. Certainly, it alsoholds (P,r,m + 1) � u. Namely, (P,r,m) � Ou. Thus, Ou is valid.

We denote the above QTBDI proof system by QPS. Now we addthe following axioms to QPS.

MT1 XiOu ? OXiuMT2 OXiu ? XiOu

The formula DiOu ? ODiu means that if agent i’s current goalimplies u holds next time, then at next time its goal will implyu. In other words, agent i persists on its goal.

Theorem 1. QPS is sound with respect to Qn.

Proof. We only prove the validity of M5. The validity proof of otheraxioms follows the similar line of [3,8].

The validity proof of M5: Assume that P 2 Qn and (P,r,m) �r Iiu .According to the third property of Bi, Di, and Ii, if Di(s) # Ii(s) holds,then for any point (r0,m0) such that (r(m), r0(m0)) 2 Di, we have that(r(m), r0(m0)) 2 Ii by Di(s) # Ii(s). And by (P,r,m) �r Iiu, we can getthat (P,r0,m0) �r u. Thus (P,r,m) �r Diu. If Dfather(i)(s) # Ii(s) holds,then for any point (r0,m0) such that (r(m), r0(m0)) 2 Dfather(i), we havethat (r(m),r0(m0)) 2 Ii by Dfather(i)(s) # Ii(s). And by (P,r,m) �r Iiu, wecan get that (P,r0,m0) �r u. Thus (P,r,m) �r Dfather(i)u. Therefore,(P,r,m) �r Diu _ Dfather(i)u. h

Theorem 2. QPS+MT1 is sound with respect to Qsprn .

Proof. We only prove the validity of MT1. The validity proof ofother axioms follows the similar line of [3,8].

The validity proof of MT1: Assume that P 2 Qsprn and (P,r,m)

�r DiOu. Let (r0,m0) be any point such that ðr;mþ 1Þ�Diðr0;m0Þ. By

P 2 Qsprn , we can get m0 = m + 1 and so (r(m),r0(m)) 2 Di and

(r,m) �i (r0,m). By (P,r,m) �r DiOu and P 2 Qsprn , we have that

(P,r0,m) �r Ou. Thus, (P,r0,m) �r Ou and so (P,r0,m + 1) �r u.Hence, we have (P,r,m + 1) �r Diu. It follows that (P,r,m) �r ODiu.Therefore, (P,r,m) �r DiOu ? ODiu. h

Theorem 3. QPS+MT2 is sound with respect to Qsnln .

Proof. The proof of Theorem 3 is similar to that of Theorem 2. ByTheorems 2 and 3, we easily attain the following theorem. h

Theorem 4. QPS+MT1+MT2 is sound with respect to Q sprnln .

4.2. Completeness

The section is devoted to investigating completeness of QTBDIproof system. The proof of completeness is the extension of somestandard techniques to our system [10,13]. In order to do this,we need to give some definitions as follows.

If C is a finite set of formulas, then we writeV

C for the conjunc-tion of formulas in C.

Definition 6. u is said to be derivable in QTBDI proof system fromthe finite set C of formulas in Ln, and write C ‘ u, iff ‘

VC ? u.

Clearly it is not difficult to get the following Lemmas 1 and 2.

Lemma 1. if C ‘ u1 and ‘ u1 ? u2, then C ‘ u2.

Lemma 2. if C ‘ u1 and C ‘ u1 ? u2, then C ‘ u2.

Definition 7 ("-Property). A set C has "-property iff for eachu 2 C and each variable x, there is some variable y such that ifu[x/y] 2 C, then "xu(x) 2 C .

Definition 8 (Complete set). A set C of formulas is said to be acomplete set iff it has "-property and for every u 2 C either:u 2 C or is of the form :u1 and u1 2 C.

Definition 9 (Closure). The closure of a formula u, denoted bycl(u), is the set C of all subformulas of u, which has "-propertyand for every u 2 C either :u 2 C or u is of the form :u1 andu1 2 C.

Clearly cl(u) is a complete set.

Definition 10. A formula u is said to be consistent if it is not thecase ‘ :u. A finite set C of formulas is said to be consistent if it isnot the case C ‘\(\ expresses false).

L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351 347

Definition 11 (Maximal consistent subset). A set X of formulas is amaximal consistent subset of the set C iff X is a consistent subsetof C and for every u 2 C either u 2X or :u 2X.

Definition 12 (Saturated subset). Let C be a complete set of formu-las. A set X of formulas is said to be a saturated subset of C iff X isa maximal consistent subset of C and has "-property.

The following saturation lemma shows a consistent subset ofthe complete set C can be extended to be a saturated subset ofC. The lemma is similar to that presented by Hughes and Cresswell[14].

Lemma 3 (Saturation lemma). If D is a consistent subset of acomplete setC, then there is a saturated subset X of C in Lþn such thatD # X, where Lþn is the language Ln with countably many newindividuals.

In what follows, we denote {Ouju 2C} by OC, where C is a setof formulas in Lþn . Now we construct a pre-frame which is calledcanonical frame.

Definition 13. Given a formula w, the canonical frame M overlanguage Lþn is a tuple hS,),B,D, I,Fi such that:

� S is the set of saturated sets of cl(w);� ) is a binary relation on S, for s, t 2 S, s) t iff s [ Ot is

consistent;� Bi is a binary relation on S, for s, t 2 S, (s, t) 2 Bi iff

{ujBiu 2 s} # t; B is the set of all relations Bi (i = 1,2, . . . ,n);� Di is a binary relation on S, for s, t 2 S, (s, t) 2 Di iff

{ujDiu 2 s} # t; D is the set of all relations Di (i = 1,2, . . . ,n);� Ii is a binary relation on S, for s, t 2 S, (s, t) 2 Ii iff {ujIiu 2 s} # t; I

is the set of all relations Ii (i = 1,2, . . . ,n);� F is s set of equivalence classes ½v � ¼ fv 0jv ¼ v 0;v 0 2 Lþn , and v is

a closed term}, for each closed term v 2 Lþn .

We easily get Lemmas 4 and 5 by following similar line of [13].

Lemma 4. For any u 2 cl(u), and any s 2 S,

1. If u is of the form O/, then for all states t such that s) t, s ‘ u ifft ‘ /;

2. If u is of the form u1Uu2, then s ‘ u iff there exists an n P 0 and asequence of states s = s0) s1) � � � ) sn such that sn ‘ u2, andsm ‘ u1 for all m < n.

Definition 14. An infinite sequence A = (s0,s1, . . .) of states in thecanonical frame M is acceptable iff

1. sn) sn+1 for all n P 0, and2. for all n P 0, if u1Uu2 2 sn, then there exists an m P n such that

sm ‘ u2 and sk ‘ u1 for all k with n 6 k < m.

Lemma 5. Every finite sequence of states s0) s1) � � � ) sn may beextended to an infinite acceptable sequence of states.

Now we construct a canonical QTBDI interpreted system on thecanonical frame M.

Definition 15. A canonical QTBDI interpreted system P on thecanonical frame M is a tuple hR, IPi such that:

� R is the set of runs which correspond to acceptable sequences ofstates in M;

� IP is an interpretation on M such that:For any point (r,m) 2 R,1. IP(v) = [v],2. IP(fk(v1,v2, . . . ,vk)) = IP(fk)([v1], [v2], . . . , [vk]) = [fk(v1,v2, . . . ,vk)],3. h[v1], [v2], . . . , [vk]i 2 IP(Pk(v1,v2, . . . ,vk), r(m)) iff Pk(v1,v2, . . . ,

vk) 2 r(m).

We can easily prove the following Lemmas 6 and 7 by usinginduction on k together with axiom M2 and propositionalreasoning.

Lemma 6. If {u1, . . . ,uk,:/} is not consistent, then ‘ u1 ? (u2 ?(� � �? (uk ? /)� � �)).

Lemma 7. Suppose that u1,u2,. . . ,uk, and / are formulae in Lþn , then

‘ Biðu1 ! ðu2 ! ð� � � ! ðuk ! /Þ � � �ÞÞÞ! ðBiu1ðBiu2 ! ð� � � ! ðBiuk ! Bi/Þ � � �ÞÞÞ;

‘ Diðu1 ! ðu2 ! ð� � � ! ðuk ! /Þ � � �ÞÞÞ! ðDiu1ðDiu2 ! ð� � � ! ðDiuk ! Di/Þ � � �ÞÞÞ;

‘ Iiðu1 ! ðu2 ! ð� � � ! ðuk ! /Þ � � �ÞÞÞ! ðIiu1ðIiu2 ! ð� � � ! ðIiuk ! Ii/Þ � � �ÞÞÞ:

Lemma 8 (Truth lemma). Let u is a formula in cl(w) andr = (s0,s1, . . .) is a run in R. Then for all n P 0, (P, r,n) �r u iff sn ‘ u.

Proof. The proof is by induction on the structure of u. The caseswhere u is of the form :u1 or u1 ? u2 or Ow are trivial. We onlyneed to consider the other four cases:

Case 1: u is of the form Pk(t1, t2, . . . , tk). By definition of satisfac-tion relation, we have

ðP; r;nÞ�rPkðt1; t2; . . . ; tkÞ iff hIPðt1; rðmÞÞ; IPðt2; rðmÞÞ; . . . ;

IPðtk; rðmÞÞi 2 IPðPk; rðnÞÞiff h½t1�; ½t2�; . . . ; ½tk�i2 IPðPk; rðnÞÞiff Pkðt1; t2; . . . ; tkÞ 2 rðnÞiff sn ‘ Pkðt1; t2; . . . ; tkÞ

Case 2: u is of the form "x/(x). We first prove ) direction.Assume that sn ‘ "x/(x) does not hold. Then "x/(x) R sn. Since sn is the maximal consistent subset ofcl(w), :"x/(x) 2 sn. So by "-property, there is some var-iable y such that :/[x/y] 2 sn, and so /[x/y] R sn and itdoes not hold that sn ‘ /[x/y]. By the induction hypoth-esis, we have (P,r,n) j–r(x/y) /[x/y]. Hence, it follows that(P,r,n) j–r "x/(x). Therefore, (P,r,n) �r "x/(x) impliessn ‘ "x/(x). Conversely, assume that sn ‘ "x/(x), thenby axiom EX, sn ‘ /[x/t]. And by the induction hypothe-sis, we have that (P,r,n) �r(x/t) /[x/t]. By the arbitrarinessof r(x/t), we obtain (P,r,n) �r "x/(x).

Case 3: u is of the form u1Uu2. Assume that (P,r,n) �r u1Uu2.Then by the semantic of U and induction hypothesis,we have that there exists some m P n such thatsm ‘ u2 and sk ‘ u1 for n 6 k < m. By Lemma 4(2), it fol-lows that sn ‘ u1Uu2. Conversely, assume thatsn ‘ u1Uu2, then there exists some m P n such thatsm ‘ u2 and sk ‘ u1 for n 6 k < m. By induction hypothe-

348 L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351

sis, we have that (P,r,m) �r u2 and (P,r,k) �r u1 forn 6 k < m. Therefore, by the semantic of U, we obtain(P,r,n) �r u1Uu2.

Case 4: u is of the form Bi/. We first prove that sn ‘ Bi/ implies(P,r,n) �r Bi/. Assume that sn ‘ Bi/ and sn is a state ofrun r = (s0,s1, . . .). And suppose that r0 = (t0, t1, . . .) and mare such that ðr;nÞ�Bi

ðr0;mÞ. Then (sn, tm) 2 Bi, by Bi/2 sn, we have / 2 tm, that is tm‘/. By induction hypo-thesis, we attain (P,r0,m) �r /. It follows that(P,r,n) �r Bi/. Conversely, assume that (P,r,n) �r Bi/and r = (s0,s1, . . .). It follows that the set {ljBil 2 sn}[ {:/} is not consistent. Otherwise, by Lemma 3, it canbe extended to a saturated set t, and we have that(sn, t) 2 Bi. Since t can be considered as a sequence ofstates with one state, by Lemma 5, we can extend it tobe an infinite acceptable sequence of states r0 = (t0, t1, . . .)with t0 = t. Clearly, we have ðr;nÞ�Bi

ðr0;0Þ, but r0(0) ‘ :/.By induction hypothesis, it follows that (P,r0,0) �r :/.The means that (P,r,n) �r :Bi/, contradicting our origi-nal assumption. Since{ljBil 2 sn} _ {:/} is not consis-tent, there must be a finite subset, say {l1, . . . , lk,:/},which is not consistent. Thus, by Lemma 6, we have‘ l1 ? (l2 ? (� � �? (lk ? /)� � �)). By R2, we have‘Bi(l1 ? (l2 ? (� � �? (lk ? /)� � �))). By Lemma 7, itfollows that ‘ Bi(l1 ? (l2 ? (� � �? (lk ? /)� � �))) ?(Bil1 ? (Bil2 ? (� � �? (Bilk ? Bi/)� � �))). By R1, we get‘ Bil1 ? (Bil2 ? (� � �? (Bilk ? Bi/)� � �)). Because l1, . . . ,lk 2 {ljBil 2 sn}, we certainly have Bil1, . . . ,Bilk 2 sn.Hence, sn ‘ Bil1, . . . ,sn ‘ Bilk. By applying repeatedlyLemmas 1 and 2, it follows that sn ‘ Bi/. The cases where/ is of the form Di/ or Ii/ are similar to the case 4. h

Now we apply Lemma 8 to prove the completeness result.

Theorem 5. QPS is complete with respect to Qn, namely, for anyu 2 Ln, if � u then ‘ u.

Proof. Suppose that it does not hold that ‘ u, then :u is a consis-tent formula. Let w = :u. Then :u must be in some saturated set sin cl(w). Hence, we have s ‘ :u. From cl(w) and the above method,we can construct a corresponding canonical frame and a corre-sponding canonical interpreted system P 2 Qn. By Lemma 5, s canbe extended to a run r = (s0,s1, . . .) where s0 = s. By Lemma 8 ands0 ‘ :u, we get (P,r,0) �r :u, which contradicts that � u . There-fore, it holds that ‘ u. h

Following similar line of Theorem 5 and [24], we can get Theo-rems 6 and 7.

Theorem 6. QPS+MT1 is complete with respect to Qsprn , namely, for

any u 2 Ln, if � u then ‘ u.

Theorem 7. QPS+MT2 is complete with respect to Qsnln , namely, for

any u 2 Ln, if � u then ‘ u.From Theorems 6 and 7, it is not hard to get Theorem 8.

Theorem 8. QPS+MT1+MT2 is complete with respect to Q sprnln ,

namely, for any u 2 Ln, if � u then ‘ u.

5. Model checking for QTBDI logic

Model checking for multi-agent system has become an impor-tant topic. However, researchers pay little attention to modelchecking for BDI logic. Some general approaches to model check-

ing for BDI logic were presented [15,16]. Nevertheless, these ap-proaches did not give the method of generating model fromactual system and so could not easily be applied to verify realmulti-agent systems. Su et al. presented an approach to modelchecking for BDI logic by symbolic model checking techniques[8]. However, they did not take the first order BDI logic intoaccount.

In this section, our aim is to solve the model checking prob-lem of QTBDI logic for FMAS. The problem is described as fol-lows: given a QTBDI interpreted system P = hR, Ii and a formulau of QTBDI logic, determine whether or not u is true in the ini-tial states of every run of R, i.e. "r 2 R whether or not it holdsthat (P,r,0) � u.

The main line of our technique for model checking is that wefirst reduce problem of the QTBDI model checking to that of LTLmodel checking, then use SPIN [35] to solve the problem of LTLmodel checking. To do this, we need to introduce some definitionsand notations.

Following similar way to local propositions presented by Engel-hardt et al. [17,18], we define local-belief propositions, local-desirepropositions, and local-intention propositions. The three localpropositions play an important role in reduction of model checkingfor QTBDI logic to LTL model checking. In what follows Xi maystand for Bi, Di, and Ii.

Definition 16. Assume i is an agent and u is a propositional logicformula, and P is a QTBDI interpreted system. u is said to be Xi-local iff for all points (r,n) and (r0,m) in P such thatðr;nÞ�Xi

ðr0;mÞ; ðP; r;nÞ � u iff (P,r0,m) � u.

For convenience of expression, we denote by �QTBDI the satisfac-tion relation for QTBDI logic, and �LTL the satisfaction relation forLTL logic. Let P be an interpreted system for QTBDI logic and P0

be the corresponding interpreted system of P for LTL by eliminatingaccessibility relations and quantifiers from the interpreted systemP. If u is a QTBDI formula and P is an interpreted system for QTBDIlogic, we use MCQTBDI(P,u) to indicate that "r we have(P,r,0) �QTBDI u. If u is a LTL formula, and P0 is an interpreted sys-tem for LTL, we use MCLTL(P0,u) to indicate that "r we have(P0,r,0) � LTLu.

In this section, we mainly investigate how to solve the problemof model checking for the formulas with forms of Biu, Diu, Iiu, and"xu.

For the formula with form of "xu, we have the followingtheorem.

Theorem 9. Let P be an interpreted system, P0 be the correspondingLTL interpreted system of P. (r,n) be a point in P, F be a finite set ofindividuals, and u be a LTL formula, Then (P, r,n) �QTBDI "xu(x) iff(P0, r,n) �LTL

Va2Fu[x/a].

The theorem is easy to be proved by the semantic of "xu(x).In what follows }u ¼ trueUu and �u ¼ :}:u. To deal with

the problem of model checking for the formulas with the formsof Biu, Diu, and Iiu, we define a function lp() which takes parame-ters as an interpreted system, an equivalence relation, and a LTLformula u, and returns a corresponding local proposition that glob-ally implies u:

� lp((P,r,n),Xi,u) = w if there is a Xi-local proposition w such thatMCLTL(P,h(w ? u)) and (P,r,n) �LTL w;� lp((P,r,n),Xi,u) = False if there is no such formula exists.

By using the function lp(), we can reduce the QTBDI modelchecking for the formulas with the forms of Biu, Diu, and Iiu toLTL model checking.

L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351 349

Theorem 10. Let P be an interpreted system, and P0 be thecorresponding LTL interpreted system of P, (r,n) be a point in P, andu be a LTL formula such that lp((P, r,n),Xi,u) = w. Then (P, r,n)�QTBDI Xiu iff (P0, r,n) �LTL w.

The theorem is easy to be proved by the definition of lp() andfollowing the proof line presented by Hoek and Wooldridge [18].Note that the approach can be also used to deal with the nestedbelief, desire, and intention operators.

6. A case study

We take the Example 1 as a case. The military officer is consid-ered as agent1, soldier 1 as agent2, and soldier 2 as agent3. Thefour areas are denoted by the set M = {a1,a2,a3,a4}. Every agent isdefined as a module. The system consists of a main module foragent1 and two submodules for agent2 and agent3 respectively.

In the main module named as A(), at the beginning, agent1believes there is an enemy in some area x (namely B1(enemy(x))),and desires to wipe out the enemy in the area x (namely D1(wipe-out(x))). Then agent1 calls two submodules to operate until the en-emy in the area x has been wiped out and it believes that theenemy has been wiped out (B1(wipedout(x))). The main module isdepicted in pseudo code in the following algorithm.

Algorithm 1. The description of module A()

B1(enemy(x));D1(wipeout(x));repeat

A1();A2();

until wipedout(x) ^ B1(wipedout(x))

The first submodule of A(), named as A1(), describes the opera-tion of agent2 who is a child agent of agent1. Agent2 goes to thearea x, and attacks the enemy until the enemy in the area x hasbeen wiped out and it believes that the enemy has been wipedout (B2(wipeouted(x))). The module is depicted in pseudo code inthe following algorithm, where goto(2,x) means that agent2 goesto the area x, and attack(2,x) means that agent2 launches an attackon the enemy in the area x.

Algorithm 2. The description of submodule A1()

if I2(wipeout(x)) thengoto(2,x);repeat

attack(2,x);until wipedout(x) ^ B2(wipesout(x))

end if

The description of the second submodule A2() is similar to thatof submodule A1().

Note that in the case study, we assume that the goal (namely,wipeout(x)) of agent1 will be sent to agent 2 and agent 3, andagent2 and agent3 will choose an intentional series of actions tomake the goal true. Thus, I2(wipeout(x)) will be true and modulesA1() and A2() will operate to realize the goal.

From the above depiction of the system, we know that FMAScan be described well by using the hierarchical structure of mod-ules. This enables us to describe easily the FMAS in PROMELA ofSPIN [35] which is a famous model checker for LTL logic.

The property that system needs to satisfy is that if there is anarea x in which agent1 believes there is an enemy, and it desires

to wipe out the enemy in the area, then eventually the enemy inthe area x is wiped out and agent1 believes that the enemy hasbeen wiped out. The property is formally represented as follows:

�ð9xB1ðenemyðxÞÞ ^ D1ðwipeoutðxÞÞÞ! }ðwipedoutðxÞ ^ B1ðwipedoutðxÞÞÞ ð1Þ

In order to deal with the model checking problem of formula(1), we first eliminate the quantifier $. The problem of checking(1) becomes that of checking:

�

_

a2M

B1ðenemyðaÞÞ ^ D1ðwipeoutðaÞÞ !ð

}ðwipedoutðxÞ ^ B1ðwipedoutðaÞÞÞÞ ð2Þ

To deal with (2), for every a 2M, according to the definition oflp(), we must first find a B1-local proposition u1(a) for enemy(a),a D1-local proposition u2(a) for wipeout(a), and a B1-local proposi-tion u3(a) for :enemy(a). Note that enemy(a) and :enemy(a) arethemselves B1-local, and wipeout(a) is itself D1-local. Hence, theproblem of model checking (2) can be reduced to that of LTL modelchecking:

�

_

a2M

ððenemyðaÞ ^wipeoutðaÞÞ ! }wipeoutedðaÞÞ ð3Þ

The property (3) can be directly checked by using model checkerSPIN [35]. We verify the property (3) on a PC with CPU P4 2.4 Gand memory 1G, with the result: true, number of states: 235124,transitions: 31564, and verification time: 0.89 s.

The above model checking can be also implemented by ad-vanced techniques such as symbolic model checking by MCMAS[27] and NuSMV [30], and other techniques [28–32].

7. Related work

7.1. BDI logic

BDI logic is an important logic for MAS. Much effort has beendevoted to the research on it. Rao and Georgeff put forward analternative possible-worlds formalism for BDI-architectures andcaptured, for the first time, the process of belief, goal, and intentionrevision, which is crucial for understanding rational behavior, andrelation between beliefs, and desires, and intentions was discussedin detail [12]. However, they did not construct a sound and com-plete axiomatisation and did not investigate hierarchical structureof MAS and mental attitudes between agents with different layers.Su et al. presented a computational model of BDI-agents and stud-ied corresponding method of model checking [8]. Their BDI modelis computationally grounded in that the BDI model can be associ-ated with a computer program, and formulas involving agent’s be-liefs, desires (goals) and intentions can be understood as propertiesof program computations. Some work such as [33] does considerthe subtle connection of mental attitudes, and even the social com-mitment [34]. However, these proposals do not include the powerof first-order quantification.

The above researches are potentially under the assumption thatall agents are on the same layer, paying no attention to reasoningabout BDI logic while multi-agent systems are of hierarchicalstructures.

7.2. First-order epistemic logic

In recent years, attention has been paid to first-order epistemiclogics. In [10], Belardinelli and Lomuscio investigated the quanti-fied epistemic logics and discussed their completeness, but theydid not consider temporal property. In [25], they investigated aclass of first-order temporal epistemic logics for the specification

350 L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351

of multi-agent systems and several monodic fragments of first-or-der temporal epistemic logic that are both sound and complete.[26] investigated first-order temporal epistemic logic with distrib-uted and common knowledge and reported a completeness resultfor the monodic fragment of the logic. However, the above workdid not consider the more complex mental attitudes such asbeliefs, desires, and intentions, and not consider the relation ofmental attitudes between different agents on different layers.

7.3. Multi-agent system

Multi-agent system is an active research field in recent years,and some researches on hierarchical multi-agent system have beendone [19–21]. However, these researches only apply hierarchicalmulti-agent system in system organization and system control,and little attention is paid to reasoning about mental attitudes be-tween agents with different layers in MAS. In fact, in real world,mental attitudes between two agents with different layers ofteninfluence mutually. For instance, the mental attitudes of a superioragent often impact that of its junior agent. And in the paper, weintroduce FMAS and investigate the reasoning about mental atti-tudes between agents with different layers, such as beliefs, desires,and intentions.

7.4. Model checking BDI logic

Model checking multi-agent systems has become an activeresearch topic. Much research work has been carried out on modelchecking knowledge in multi-agent systems [18,22,23]. However,little attention is paid to model checking BDI logic. Some generalapproaches to model checking BDI logic was proposed in [15,16],but the techniques given there could not easily be applied to veri-fying real multi-agent systems [8]. An efficient approach to modelchecking BDI agents by symbolic model checking techniques waspresented in [8], but the approach does not adapt to model check-ing hierarchical multi-agent systems much. The key point of ourwork is that we describe FMAS by using the hierarchical structureof modules and thus easily reduce model checking BDI logic forFMAS to LTL model checking by the famous model checker SPIN[35].

8. Conclusions

First-order BDI logic allows for greater expressiveness com-pared to propositional formalisms, and so has been successfully ap-plied to reason about mental attitudes such as beliefs, desires, andintentions in MAS [12]. However, little attention is paid to investi-gate on the structures of multi-agent systems such as hierarchicalstructures of agents and logical reasoning about multi-agentsystems with hierarchical structures, which have practical signifi-cance in the real world.

This paper has proposed a framework of forest multi-agent sys-tem (FMAS) which can capture the hierarchical property of the realworld. Furthermore, a complete first-order temporal BDI logic forFMAS has been presented, which enables us to reason aboutbeliefs, desires, and intentions between two agents on differentlayers. We have extended the semantics of BDI interpreted systemmodel to first-order version and FMAS, and have put forward fourproof systems which are sound and complete with respect to cor-responding classes of BDI interpreted systems. In order to solve themodel checking problem of QTBDI logic for FMAS, we have definedeach agent as a module, every child agent of each agent as a sub-module of module for the agent, and thus FMAS as hierarchicalstructure of modules. These definitions are convenient to describeFMAS in PROMELA of SPIN [35] and thus play an important role in

model checking for QTBDI logic for FMAS, which makes us easilyreduce QTBDI model checking to LTL model checking by the fa-mous model checker SPIN [35]. We have given a case study whichshows how to describe FMAS by using the hierarchical structure ofmodules, and to solve the model check problem of first-order tem-poral BDI logic for FMAS.

For our future work, we plan to further investigate the structureof FMAS and cooperation between agents, and combine them withother modal logics such as logic of knowledge, and explore theselogics by more complex real-world examples.

References

[1] P. Blackburn, J. van Benthem, F. Wolter, Handbook of modal logic, CambridgeTracts in Theoretical Computer Science, vol. 53, Elsevier, 2007.

[2] A. Chagrov, M. Zakharyaschev, Modal Logic, Clarendon Press, 1997.[3] R. Fagin, J. Halpern, Y. Moss, M. Vardi, Reasoning about Knowledge[M], MIT

Press, 1995.[4] J.-J.C. Meyer, W. van der Hoek, Epistemic logic for AI and computer science,

Cambridge Tracts in Theoretical Computer Science, vol. 41, CambridgeUniversity Press, 1995.

[5] M.E. Bratman, Intension, Plan, and Practical Reason, Harvard University Press,Cambridge, MA, 1987.

[6] P.R. Cohen, H.J. Levesque, Intension is choice with commitment, ArtificialIntelligence 42 (3) (1990) 213–261.

[7] A.S. Rao, M.P. Georgeff, Decision procedures for BDI logics, Journal of Logic andComputation 8 (3) (1998) 293–344.

[8] Kaile Su, Abdul Satter, Kewen Wang, Guido Governatori, Observation-basedmodel for BDI-agent, in: Proceedings of AAAI-05.

[9] Michael Wooldridge, Nick Jennings, Intelligent agents: theory and practice,Knowledge Engineering Review 10 (2) (1995) 49–62.

[10] F. Belardinelli, A. Lomuscio, Quantified epistemic logics for reasoning aboutknowledge in multi-agent systems, Artificial Intelligence 173 (9-10) (2009)982–1013.

[11] Lijun Wu, Jinshu Su, Kaile Su, Xiangyu Luo, Zhihua Yang, A concurrent dynamiclogic of knowledge, belief, and certainty for multi-agent systems, Knowledge-Based Systems 23 (2) (2010) 162–168.

[12] A.S. Rao, M.P. Georgeff, Modeling rational agents within a BDI- architecture, in:Proceeding of Second International Conference on Principles of KnowledgeRepresentation and Reasoning, 1991.

[13] R. van der Meyden, Axioms for knowledge and time in distributed systemswith perfect recall, in: Proceedings of the Ninth IEEE Symposium on Logic inComputer Science, 1993.

[14] G. Hughes, M. Cresswell, A New Introduction to Modal Logic, Routledge, NewYork, 1996.

[15] A.S. Rao, M.P. Georgeff, A model theoretic approach to the verification ofsituated reasoning systems, in: Proceedings of the 13th International JointConference on Artificial Intelligence, 1993, pp. 318–324.

[16] M. Benerecetti, A. Cimatti, Symbolic model checking for multi-agent systems,in: Proceedings of the MoChart-2002, pp. 1–8.

[17] K. Engelhardt, R. van der Meyden, Y. Moses, Knowledge and the logic of localpropositions, in: Proceedings of the 1998 Conference on Theoretical Aspects ofReasoning and Knowledge (TARK98), Evanston, IL, July 1998, pp. 29–41.

[18] W. van der Hoek, Michael Wooldridge, Model Checking Knowledge and Time,in: Proceedings of SPIN 2002, Springer, Berlin, 2002, pp. 25–26.

[19] D. Choinski, W. Nocon, M. Metzger, Multi-agent system for hierarchical controlwith self-organising database, in: Proceedings of the First KES Symposium onAgent and Multi-Agent Systems-Technologies and Applications, Lecture Notesin Artificial Intelligence, vol. 4496, Springer, Berlin, 2007, pp. 655–664.

[20] M.E. Andani, F. Bahrami, P. Jabehdar-Maralani, A.J. Ijspeert, MODEM: a multi-agent hierarchical structure to model the human motor control system,Biological Cybernetics (2009) 361–377.

[21] Emmanuel Adam, Ren Mandiau, Roles and hierarchy in multi-agentorganizations, in: Fourth International Central and Eastern EuropeanConference on Multi-Agent Systems, CEEMAS, Springer, Berlin, 2005, pp.539–542.

[22] R. van der Meyden, Kaile Su, Symbolic model checking the knowledge of thedining cryptographers, in: Proceedings of the IEEE CSFW-04, pp. 280–291.

[23] Kaile Su, Model checking temporal logics of knowledge in distributed systems,in: AAAI-04, 98-103, AAAI Press.

[24] J. Halpern, R. Meyden, M.Y. Vardi, Complete axiomatisations for reasoningabout knowledge and time, SIAM Journal on Computing 33 (3) (2003) 674–703.

[25] F. Belardinelli, A. Lomuscio, Interactions between time and knowledge in afirst-order logic for multi-agent systems, in: Proceedings of the TwelfthInternational Conference on the Principles of Knowledge Representation andReasoning (KR 2010), AAAI Press, pp. 38–48.

[26] F. Belardinelli, A. Lomuscio, First-order linear-time epistemic logic with groupknowledge: an axiomatisation of the monodic fragment, in: FundamentaInformaticae, IOS Press, 2010, pp. 175–190.

[27] A. Lomuscio, Hongyang Qu, F. Raimondi, MCMAS: a model checker for theverification of multi-agent systems, CAV (2009) 682–688.

L. Wu et al. / Knowledge-Based Systems 27 (2012) 343–351 351

[28] M. El-Menshawy, J. Bentahar, R. Dssouli, Symbolic model checkingcommitment protocols using reduction, Declarative Agent Languages andTechnologies VIII, LNCS 6619 (2011) 185–203.

[29] M. Cohen, M. Dam, A. Lomuscio, H. Qu, A Symmetry Reduction technique formodel checking temporal epistemic logic, in: IJCAI09, AAAI Press,pp. 721–726.

[30] A. Lomuscio, C. Pecheur, F. Raimondi, Verification of knowledge and time withNuSMV, in: Proceedings of IJCAI07, Hyderabad, India, pp. 1384–1389.

[31] J. Bentahar, J.-J. Meyer, W. Wan, Model checking communicative agent-basedsystems, Knowledge-Based Systems 22 (3) (2009) 142–159.

[32] E. Pulvermueller, S. Feja, A. Speck, Developer-friendly verification of process-based systems, Knowledge-Based Systems 23 (7) (2010) 667–676.

[33] S. Parsons, C. Sierra, N.R. Jennings, Agents that reason and negotiate byarguing, Journal of Logic and Computation 8 (3) (1998) 261–292.

[34] Mohamed El Menshawy, Jamal Benthar, Hongyang Qu, Rachida Dssouli, On theverification of social commitments and time, in: Tumer, Yolum, Sonenberg,Stone, (Eds.), Proceedings of Tenth International Conference on AutonomousAgents and Multiagent Systems (AAMAS 2011), Taipei, Taiwan, May 2–6, 2011,pp. 483–490.

[35] G.J. Holzmann, The model checker SPIN, IEEE Transactions on SoftwareEngineering 23 (5) (1997) 279–295.

[36] B. Khosravifar, J. Bentahar, M.Gomrokchi, R. Alam, CRM: An efficient trust andreputation model for agent computing, Knowledge-Based Systems,doi:10.1016/j.knosys.2011.01.004.