Temporal logics for multi-agent systems Nicolas Markey LSV ENS - PowerPoint PPT Presentation

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . ✓ ✓ � � � � F ✓ ✓ [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . � � � � F � � � � F [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . ✓ � � � � F � � � � F ✓ [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . � � � � F � � � � F � � � � G ( � � � � F ) [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . p � � � � F � � � � F � � � � G ( � � � � F ) ≡ � � � � G p p p [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . p ✗ ✗ � � � � F � � � � F ✗ ✗ � � � � G ( � � � � F ) ≡ � � � � G p p p [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . Theorem ([AHK02]) Model checking ATL is PTIME -complete. [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002.

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . Theorem ([AHK02]) Model checking ATL is PTIME -complete. Theorem ([LMO08]) In PTIME only if the transition table is given explicitly (size | Moves | | Agt | ) [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002. [LMO08] Laroussinie, Markey, Oreiby. On the Expressiveness and Complexity of ATL. LMCS, 2008

Temporal logics for games: ATL ATL extends CTL with strategy quantifiers � � A � � ϕ expresses that A has a strategy to enforce ϕ . Theorem ([AHK02]) Model checking ATL is PTIME -complete. Theorem ([LMO08]) In PTIME only if the transition table is given explicitly (size | Moves | | Agt | ) Memoryless strategies are sufficient for ATL. [AHK02] Alur, Henzinger, Kupferman. Alternating-time Temporal Logic. J. ACM, 2002. [LMO08] Laroussinie, Markey, Oreiby. On the Expressiveness and Complexity of ATL. LMCS, 2008

Outline of the presentation Introduction 1 Basics of CTL and ATL 2 expressing properties of reactive systems efficient verification algorithms ATL with strategy contexts 3 specifying properties of complex interacting systems expressive power of ATL sc translation into Quantified CTL (QCTL) algorithms for ATL sc Strategy Logic 4 Conclusions and future works 5

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) . . . Player in always . . plays to . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) . . . Player in always . . plays to . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) . . . Player in always . . plays to . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts [BDLM09,DLM10] Example � � � � G ( � � � � F ) . . . Player in always . . plays to ; . . . Player in then plays . . . . . . . . . to . . . . . . . . . . . . . . . . . . . . Brihaye, Da Costa, Laroussinie, Markey. ATL with strategy contexts and bounded memory. LFCS, 2009. Da Costa, Laroussinie, Markey. ATL with strategy contexts: expressiveness and ... FSTTCS, 2010.

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ;

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; � · A · � ϕ ≡ � · Agt \ A · � ϕ (useful for getting formulas that do not depend on Agt);

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; � · A · � ϕ ≡ � · Agt \ A · � ϕ (useful for getting formulas that do not depend on Agt); � · A · � 0 ϕ is similar to � · A · � ϕ but quantifies over memoryless strategies;

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; � · A · � ϕ ≡ � · Agt \ A · � ϕ (useful for getting formulas that do not depend on Agt); � · A · � 0 ϕ is similar to � · A · � ϕ but quantifies over memoryless strategies; � A � ϕ drops the assigned strategies for A .

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; � · A · � ϕ ≡ � · Agt \ A · � ϕ (useful for getting formulas that do not depend on Agt); � · A · � 0 ϕ is similar to � · A · � ϕ but quantifies over memoryless strategies; � A � ϕ drops the assigned strategies for A . [ · A · ] ϕ is dual to � · A · � ϕ : · A · ] ϕ ≡ ¬ � · A · � ¬ ϕ [

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; Definition Semantics of ATL strategy quantifier: G , | = � � A � � ϕ ⇔ ∃ σ A . ∀ π ∈ Out ( , σ A ) . π | = ϕ

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; Definition Semantics of ATL strategy quantifier: G , | = � � A � � ϕ ⇔ ∃ σ A . ∀ π ∈ Out ( , σ A ) . π | = ϕ Semantics of ATL sc strategy quantifier: G , | = σ B � · A · � ϕ ⇔ ∃ σ A . ∀ π ∈ Out ( , σ A ◦ σ B ) . π | = σ A ◦ σ B ϕ

ATL with strategy contexts Definition ATL sc has new strategy quantifiers: � · A · � ϕ is similar to � � A � � ϕ but assigns the corresponding strategy to A for evaluating ϕ ; Definition Semantics of ATL sc strategy quantifier: G , | = σ B � · A · � ϕ ⇔ ∃ σ A . ∀ π ∈ Out ( , σ A ◦ σ B ) . π | = σ A ◦ σ B ϕ � newly selected strategies added to the context: σ A ◦ σ B : a �→ σ A ( a ) if a ∈ A \ B b �→ σ B ( b ) if b ∈ B \ A c �→ σ A ( c ) if c ∈ B ∩ A

What ATL sc can express Client-server interactions for accessing a shared resource: �   � · c · � F access c   c ∈ Clients   ∧ � · Server · � G    �  ¬ access c ∧ access c ′   c � = c ′

What ATL sc can express Client-server interactions for accessing a shared resource: �   � · c · � F access c   c ∈ Clients   ∧ � · Server · � G    �  ¬ access c ∧ access c ′   c � = c ′ Existence of Nash equilibria: � � · A 1 , ..., A n · � ( � · A i · � ϕ A i ⇒ ϕ A i ) i

What ATL sc can express Client-server interactions for accessing a shared resource: �   � · c · � F access c   c ∈ Clients   ∧ � · Server · � G    �  ¬ access c ∧ access c ′   c � = c ′ Existence of Nash equilibria: � � · A 1 , ..., A n · � ( � · A i · � ϕ A i ⇒ ϕ A i ) i Existence of dominating strategy: � · A · � [ · B · ] ( ¬ ϕ ⇒ [ · A · ] ¬ ϕ )

Expressiveness of ATL sc Theorem ATL sc is strictly more expressive than ATL

Expressiveness of ATL sc Theorem ATL sc is strictly more expressive than ATL Proof � � A � � ϕ ≡ � ∅ � � · A · � ˆ ϕ

Expressiveness of ATL sc Theorem ATL sc is strictly more expressive than ATL Proof � · 1 · � ( � · 2 · � X a ∧ � · 2 · � X b ) is only true in the second game. But ATL cannot distinguish between these two games. � 1 . 1 � , � 2 . 2 � � 1 . 1 � , � 2 . 2 � , � 3 . 3 � s s ′ � 1 . 2 � � 2 . 1 � � 1 . 2 � , � 1 . 3 � , � 3 . 2 � � 2 . 1 � , � 2 . 3 � , � 3 . 1 � a a b b

Outline of the presentation Introduction 1 Basics of CTL and ATL 2 expressing properties of reactive systems efficient verification algorithms ATL with strategy contexts 3 specifying properties of complex interacting systems expressive power of ATL sc translation into Quantified CTL (QCTL) algorithms for ATL sc Strategy Logic 4 Conclusions and future works 5

Quantified CTL [ES84,Kup95,Fre01] QCTL extends CTL with propositional quantifiers ∃ p . ϕ means that there exists a labelling of the model with p under which ϕ holds. [ES84] Emerson and Sistla. Deciding Full Branching Time Logic. Information & Control, 1984. [Kup95] Kupferman. Augmenting Branching Temporal Logics with Existential Quantification... CAV, 1995. [Fre01] French. Decidability of Quantifed Propositional Branching Time Logics. AJCAI, 2001.

Quantified CTL [ES84,Kup95,Fre01] QCTL extends CTL with propositional quantifiers ∃ p . ϕ means that there exists a labelling of the model with p under which ϕ holds. � � E F ∧ ∀ p . E F ( p ∧ ) ⇒ A G ( ⇒ p ) [ES84] Emerson and Sistla. Deciding Full Branching Time Logic. Information & Control, 1984. [Kup95] Kupferman. Augmenting Branching Temporal Logics with Existential Quantification... CAV, 1995. [Fre01] French. Decidability of Quantifed Propositional Branching Time Logics. AJCAI, 2001.

Quantified CTL [ES84,Kup95,Fre01] QCTL extends CTL with propositional quantifiers ∃ p . ϕ means that there exists a labelling of the model with p under which ϕ holds. � � E F ∧ ∀ p . E F ( p ∧ ) ⇒ A G ( ⇒ p ) ≡ uniq ( ) [ES84] Emerson and Sistla. Deciding Full Branching Time Logic. Information & Control, 1984. [Kup95] Kupferman. Augmenting Branching Temporal Logics with Existential Quantification... CAV, 1995. [Fre01] French. Decidability of Quantifed Propositional Branching Time Logics. AJCAI, 2001.

Quantified CTL [ES84,Kup95,Fre01] QCTL extends CTL with propositional quantifiers ∃ p . ϕ means that there exists a labelling of the model with p under which ϕ holds. � � E F ∧ ∀ p . E F ( p ∧ ) ⇒ A G ( ⇒ p ) ≡ uniq ( ) � true if we label the Kripke structure; � false if we label the computation tree; [ES84] Emerson and Sistla. Deciding Full Branching Time Logic. Information & Control, 1984. [Kup95] Kupferman. Augmenting Branching Temporal Logics with Existential Quantification... CAV, 1995. [Fre01] French. Decidability of Quantifed Propositional Branching Time Logics. AJCAI, 2001.

Semantics of QCTL structure semantics: p ⇔ | = s ∃ p .ϕ | = ϕ

Semantics of QCTL structure semantics: p ⇔ | = s ∃ p .ϕ | = ϕ tree semantics: p ⇔ | = t ∃ p .ϕ | = ϕ p p p

Expressiveness of QCTL QCTL can “count”: E X 1 ϕ ≡ E X ϕ ∧ ∀ p . [ E X ( p ∧ ϕ ) ⇒ A X ( ϕ ⇒ p )] E X 2 ϕ ≡ ∃ q . [ E X 1 ( ϕ ∧ q ) ∧ E X 1 ( ϕ ∧ ¬ q )] [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

Expressiveness of QCTL QCTL can “count”: E X 1 ϕ ≡ E X ϕ ∧ ∀ p . [ E X ( p ∧ ϕ ) ⇒ A X ( ϕ ⇒ p )] E X 2 ϕ ≡ ∃ q . [ E X 1 ( ϕ ∧ q ) ∧ E X 1 ( ϕ ∧ ¬ q )] QCTL can express (least or greatest) fixpoints: µ T .ϕ ( T ) ≡ ∃ t . [ A G ( t ⇐ ⇒ ϕ ( t )) ∧ ( ∀ t . ′ ( A G ( t ′ ⇐ ⇒ ϕ ( t ′ )) ⇒ A G ( t ⇒ t ′ )))] [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

Expressiveness of QCTL QCTL can “count”: E X 1 ϕ ≡ E X ϕ ∧ ∀ p . [ E X ( p ∧ ϕ ) ⇒ A X ( ϕ ⇒ p )] E X 2 ϕ ≡ ∃ q . [ E X 1 ( ϕ ∧ q ) ∧ E X 1 ( ϕ ∧ ¬ q )] QCTL can express (least or greatest) fixpoints: µ T .ϕ ( T ) ≡ ∃ t . [ A G ( t ⇐ ⇒ ϕ ( t )) ∧ ( ∀ t . ′ ( A G ( t ′ ⇐ ⇒ ϕ ( t ′ )) ⇒ A G ( t ⇒ t ′ )))] Theorem QCTL, QCTL ∗ and MSO are equally expressive (under both semantics). [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

QCTL with structure semantics Theorem Model checking QCTL for the structure semantics is PSPACE -complete. [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

QCTL with structure semantics Theorem Model checking QCTL for the structure semantics is PSPACE -complete. Proof Membership : labelling algorithm. (nondeterministically) pick a labelling, Iteratively check the subformula. Hardness : QBF is a special case (without even using temporal modalities). [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

QCTL with structure semantics Theorem Model checking QCTL for the structure semantics is PSPACE -complete. Proof Membership : labelling algorithm. (nondeterministically) pick a labelling, Iteratively check the subformula. Hardness : QBF is a special case (without even using temporal modalities). Theorem QCTL satisfiability for the structure semantics is undecidable. [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata:

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata:

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) δ ( q 0 , ) = ( q 1 , q 1 ) δ ( q 0 , ) = ( q 2 , q 2 ) δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 )

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) δ ( q 0 , ) = ( q 2 , q 2 ) δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 )

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 )

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 )

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 q 1 q 1 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 )

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 q 1 q 1 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 ) q 1 q 1 q 1 q 1

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 q 1 q 1 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 ) q 1 q 1 q 1 q 1 q 1 q 1

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 q 1 q 1 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 ) q 1 q 1 q 1 q 1 q 1 q 1 q 1 q 1

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof Using (alternating) parity tree automata: δ ( q 0 , ) = ( q 0 , q 1 ) ∨ ( q 1 , q 0 ) q 0 δ ( q 0 , ) = ( q 1 , q 1 ) q 0 q 1 δ ( q 0 , ) = ( q 2 , q 2 ) q 1 q 0 q 1 q 1 δ ( q 1 , ⋆ ) = ( q 1 , q 1 ) δ ( q 2 , ⋆ ) = ( q 2 , q 2 ) q 1 q 1 q 1 q 1 q 1 q 1 q 1 q 1 This automaton corresponds to E U

QCTL with tree semantics Theorem Model checking QCTL with k quantifiers in the tree semantics is k - EXPTIME -complete. Satisfiability of QCTL with k quantifiers in the tree semantics is ( k+1) - EXPTIME -complete. Proof polynomial-size tree automata for CTL; quantification is handled by projection, which first requires removing alternation (exponential blowup); an automaton equivalent to a QCTL formula can be built inductively; emptiness of an alternating parity tree automaton can be decided in exponential time.

Translating ATL sc into QCTL player A has moves m A 1 , ..., m A n ; from the transition table, we can compute the , A , m A set Next ( i ) of states that can be when player A plays m A reached from i . [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

Translating ATL sc into QCTL player A has moves m A 1 , ..., m A n ; from the transition table, we can compute the , A , m A set Next ( i ) of states that can be when player A plays m A reached from i . � · A · � ϕ can be encoded as follows: ∃ m A 1 . ∃ m A 2 . . . ∃ m A n . i ⇔ � ¬ m A A G ( m A this corresponds to a strategy: j ) ; the outcomes all satisfy ϕ : � � G ( q ∧ m A ⇒ X Next ( q , A , m A i )) ⇒ ϕ A . i [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

Translating ATL sc into QCTL player A has moves m A 1 , ..., m A n ; from the transition table, we can compute the , A , m A set Next ( i ) of states that can be when player A plays m A reached from i . Corollary ATL sc model checking is decidable, with non-elementary complexity. Corollary ATL 0 sc (quantification restricted to memoryless strategies) model checking is PSPACE -complete. [DLM12] Da Costa, Laroussinie, Markey. Quantified CTL: ... CONCUR, 2012.

Hardness of model checking ATL sc Encode QLTL satisfiability Example: Φ = ∀ p 1 . ∃ p 2 . G ( p 2 ⇐ ⇒ X p 1 ) .

Hardness of model checking ATL sc Encode QLTL satisfiability Example: Φ = ∀ p 1 . ∃ p 2 . G ( p 2 ⇐ ⇒ X p 1 ) .

Hardness of model checking ATL sc Encode QLTL satisfiability Example: Φ = ∀ p 1 . ∃ p 2 . G ( p 2 ⇐ ⇒ X p 1 ) . p 1 p 1 p 1 p 1