Model-Checking Auctions , Coalitions and Trust 1 Matt Webster ? Louise Dennis ?

In this paper we tackle the verification of auction models that are at the heart of many market-based multi-agent systems. Specifically, we program auctions with auctions and trust in a BDI-based programming language and then use agent model checking to verify logical properties concerning beliefs within the multi-agent system. 1 Auctions and Verification in Multi-Agent Systems The basic idea of an auction (Klemperer, 2004) is at the heart of many multi-agent scenarios. Not only are auctions central to e-commerce applications, but are implicit within many market-based approaches to agent computation. These include resource-allocation, telecommunications, electricity supply management, agent mobility, task allocation and scheduling. However, although much work has been carried out on the deep analysis of auction mechanisms, such as through formal mechanism design (Wooldridge et al., 2007), the analysis of implementations of auction mechanisms has lagged behind. While there has been some work on the formal verification of auction implementations, such as (Doghri, 2008), this has been lacking an agent perspective. Thus, the more sophisticated agent aspects such as goals, intentions, beliefs and deliberation have not been verified within an auction context. It is this we aim to tackle in this paper. We have been developing techniques for verifying multi-agent systems over a number of years. The agents involved are rational (and, so, are capable of “intelligent” autonomous behaviour) and are represented in a high-level language describing their beliefs, intentions, etc. In particular, we have previously looked at the verification of BDI languages such as GWENDOLEN, and both homogeneous and heterogeneous multi-agent systems (Dennis and Fisher, 2008). In order to carry out formal verification, formal descriptions of both the system being considered and the properties to be verified are required. Producing formal descriptions for multi-agent systems is well understood, with the BDI approach to rational agency being particularly popular (Rao and Georgeff, 1995). Our approach, based on model checking, is outlined in (Bordini et al., 2008; Webster et al., 2009), and is available from http://sourceforge.net/projects/mcapl. A multi-agent program, originally programmed in some agent programming language is executed in an interpreter via an interface to the Agent Infrastructure Layer (AIL). Each agent uses AIL data structures to store its internal state comprising, for instance, a belief base, a plan library, a current intention, and a set of further intentions (as well as other temporary state information). They also use the specific interpreter for the agent programming language built using AIL classes and methods. Therefore, the AIL streamlines the development and verification of heterogenous multi-agent systems. The interpreter defines the reasoning cycle for the agent programming language which interacts with the model checker, essentially notifying it when a new state is reached that is relevant for verification. This allows the model checker, AJPF (Agent JPF), to create a Java product automata from the program and a property defined in the AJPF property specification language. The product automata runs in the JPF virtual machine (see http://javapathfinder.sourceforge.net). This is a Java virtual machine specially designed to maintain backtrack points and explore, for instance, all possible thread scheduling options (that can affect the result of the verification). The JPF model checker is extensible and configurable, which allows us to optimise its performance for AIL-based systems, for instance AJPF has a specialised Property Listener which terminates execution of the product automata if it detects that the property has been, and will remain, satisfied for the rest of the run. 1.1 Example: Auction with Coalitions and Trust A basic sealed-bid English auction scenario was extended to include the possibility of coalitions (Sandholm and Lesser, 1997). In our model, a coalition is when several agents collaborate by pooling their bid resources in order to win the auction. For example, if three agents x,y,z bid 100, 150 and 200 respectively, then z ought to win every time. However, if x and y form a coalition, their collective bid of 250 will be enough to win the auction. 1Work funded by EPSRC project “Model Checking Agent Programming Languages” (EP/D052548). Our simple coalition scenario consists of five agents: one auctioneer, four bidders. At the start of the auction all bidders submit a bid and the auctioneer announces the winner. One of the agents is a coalition-forming agent: if it loses the first auction, it then tries to form a coalition with an agent it trusts. After forming a coalition the agent bids again. Then, if its coalition is successful in winning the auction, it stops. However, if its coalition is unsuccessful then it no longer believes that it can trust the other agent in the coalition, and will try to form another coalition with another agent it trusts. For illustrative purposes a specification for the coalition-forming agent is laid out below in the GWENDOLEN agent programming language; the complete specification is given in (Webster et al., 2009). AGENT: ag2 Initial Beliefs: my name(ag2), trust(ag4), trust(ag5) Initial Goals: +! pbid Plans: ↓Ag tell(B) :> <+B +! pbid : my name(Name)∧¬↑ag1 tell(bid(150,Name)) <↑ag1 tell(bid(150,Name)) +win(A) : [ my name(Name)∧¬win(Name)∧ trust(Ag) ∧¬ f ormed coalition(Ag′)∧¬↑Ag tell(coalition(Name)) ] <[ ↑Ag tell(coalition(Ag)); + f ormed coalition(Ag) ] +win(A) : [ my name(Name)∧¬win(Name)∧ trust(Ag) ∧ f ormed coalition(Ag′)∧¬↑Ag tell(coalition(Name)) ] < ↑Ag tell(coalition(Ag)); + f ormed coalition(Ag); −trust(Ag′)  +agree(A,X) :> <↑ag1 tell(bid(150+X,ag2)) The GWENDOLEN agent specification was converted automatically into a lower-level Java/AIL program and verified that ♦B(a1,win) where a1 forms a coalition with one of the trusted agents after losing the auction to a2, i.e. eventually the agent believes that a1 will win. If it chooses a4 first, it wins and stops. If it chooses a3 first, it loses the auction and distrusts that agent, trying subsequently with a4. It then wins the auction. Verification took place in 20m 30s using 22 MB on a Windows XP PC with an Intel Core 2 Duo (E6750 @ 2.66GHz) CPU and 2 GB of RAM. 2 Concluding Remarks In this paper we have discussed the verification by model-checking of agent-based auction software. We have shown that it is a realistic proposition to model-check the properties of interesting multi-agent implementations within a reasonable time. For example, as we reach the situation where agents form coalitions together, based on a dynamic notion of trust, in order to compete with other agents, then we are not far from realistic agent systems. Clearly, for bigger scenarios improved efficiency will be required (and, indeed, this is something we are actively working on), but the examples implemented and verified in this paper show that small, but non-trivial, market-based multi-agent systems can be automatically verified.