A logic of intention and action for regular BDI agents based on bisimulation of agent programs

Abstract

We address the problem of providing a computationally grounded semantics for belief, desire, intention (BDI) agents that explicitly relates intention to action, using as a basis for this connection a notion of bisimulation for agent programs. We first define regular BDI agents, a class of BDI agents inspired by the procedural reasoning system architecture, under the restriction that agent programs are representable as regular expressions. The operational semantics of regular agent programs is formalized using agent program execution graphs, an extension of the process graphs used to formalize regular processes. An agent’s executed program represents an attempt to perform an intended plan and can include branches for both successful execution and the failure of action attempts; intended execution paths are defined in terms of successful executions, and intentions in terms of future successfully executed agent programs. We present Agent Dynamic Logic ($\mathsf {ADL}$), a logic of intention and action that faithfully represents the operational semantics of regular BDI agents. $\mathsf {ADL}$ is a logic in the spirit of BDI logic but also includes the dynamic logic of actions and a reduction of the logic of intention to the logics of action and time. A main contribution of the paper is a completeness result for a subclass of finite $\mathsf {ADL}$ theories with explicit representations of agent plans.

Appendix: Proofs

Lemma 1

If $\mathcal G$, $\mathcal G'$ and $\mathcal G''$ are agent program execution graphs such that $\mathcal G$ is bisimilar to $\mathcal G'$ and $\mathcal G'$ is bisimilar to $\mathcal G''$, then $\mathcal G$ is bisimilar to $\mathcal G''$.

Proof

Suppose $\mathcal G\sim _1 \mathcal G'$ and $\mathcal G' \sim _2 \mathcal G''$ are bisimulations. The obvious relation $\sim$ = $\sim _1 \circ \sim _2$ (i.e., $\sigma \sim \sigma ''$ if there is $\sigma ' \in \mathcal G'$ such that $\sigma \sim _1 \sigma '$ and $\sigma ' \sim _2 \sigma ''$) is a bisimulation between $\mathcal G$ and $\mathcal G''$. This basic property of agent program execution graph bisimulations mirrors the fundamental result of Milner [30]. $\square$

Lemma 2

If $\pi$ and $\pi '$ are bisimilar programs, then for any agent program execution graph $\mathcal G$ and coherent labelling for which $\sigma$ is a situation in $\mathcal G$ labelled $\pi$, there is an agent program execution graph $\mathcal G'$ containing a situation $\sigma '$ and a coherent labelling of $\mathcal G'$ under which $\sigma '$ is labelled $\pi '$ such that $\mathcal G$ is bisimilar to $\mathcal G'$ under a bisimulation mapping $\sigma$ to $\sigma '$.

Proof

Suppose $\sigma$ is a situation in an agent program execution graph $\mathcal G$ and $l$ is a coherent labelling such that $l(\sigma ) = \pi$. Suppose $\pi$ and $\pi '$ are bisimilar programs, so there is a bisimulation on programs $\approx$ such that $\pi \approx \pi '$. Consider the agent program execution graph $\mathcal G'$ whose situations are defined as follows: for each situation $\tau$ in $\mathcal G$, there are (possibly several) situations in $\mathcal G'$ that are copies of $\tau$ corresponding to the different programs that are related to $l(\tau )$ under $\approx$: more precisely, where $l(\tau ) \approx \psi$, there is a situation $\tau _{\psi }$ in $\mathcal G'$ that is a copy of $\tau$ labelled $\psi$. Define $\mathcal R_a'(\tau _{\psi }, \tau _{\psi '}')$ iff $\mathcal R_a(\tau , \tau ')$ and $\psi \xrightarrow {a} \psi '$, and $\tau _{\psi }$ to be terminating in $\mathcal G'$ iff $\tau$ is terminating in $\mathcal G$. It follows that the relation mapping each situation $\tau$ to all its copies $\tau _{\psi }$ is a bisimulation between $\mathcal G$ and $\mathcal G'$. Thus $\mathcal G$ is bisimilar to $\mathcal G'$ and there is a situation $\sigma '$ in $\mathcal G'$ where $\sigma$ is mapped to $\sigma '$ under this bisimulation and $\sigma '$ is labelled $\pi '$. $\square$

Lemma 3

If $\mathcal G$ and $\mathcal G'$ are agent program execution graphs with coherent labellings $l$ and $l'$ and $\mathcal G\sim \mathcal G'$ is an agent program execution graph bisimulation in which $\sigma \sim \sigma '$, where $\sigma$ is a situation in $\mathcal G$ and $\sigma '$ is a situation in $\mathcal G'$, then $l(\sigma )$ and $l'(\sigma ')$ are bisimilar programs.

Proof

Consider the smallest symmetric relation on programs under which $l(\sigma ) \approx l'(\sigma ')$ if there exist $\sigma$ in $\mathcal G$ and $\sigma '$ in $\mathcal G'$ such that $\sigma \sim \sigma '$. We show that $\approx$ is a bisimulation on programs. First, if $l(\sigma )\surd$ then $\sigma$ is terminating in $\mathcal G$, so $\sigma '$ is terminating in $\mathcal G'$, therefore $l'(\sigma ')\surd$. Second, if $l(\sigma ) \xrightarrow {a} \psi$, then by definition there exists some $\tau$ in $\mathcal G$ such that $\mathcal R_a(\sigma , \tau )$ where $l(\tau ) = \psi$, so if $l(\sigma ) \approx l'(\sigma ')$, there exists a process $l'(\tau ')$ such that $l'(\sigma ') \xrightarrow {a} l'(\tau ')$ and $\psi \approx l'(\tau ')$, as required. The reverse direction, relating situations in $\mathcal G'$ to situations in $\mathcal G$, similarly follows from the definition of an agent program execution graph bisimulation. $\square$

Definition 50

A set $\varGamma$ of $\mathsf {ADL}$ formulae over a set of primitive actions $\varPi$ is closed if

Lemma 4

The smallest closed set containing a consistent $\mathsf {ADL}$ formula $\alpha$ exists and is finite.

Proof

This follows from the analogous results for $\mathsf {PDL}$ and $\mathsf {CTL}$ and the fact that there are a finite number of derivatives of any regular process. $\square$

Definition 51

A program is infinite if it has no derivative which has finite length.

Lemma 5

No consistent set of $\mathsf {ADL}$ formulae $S$ is consistent with a formula $do(\pi )$ where $\pi$ is of length $>$ 1 and not an infinite program.

Proof

Suppose to the contrary that there is such a formula $do(\pi )$ consistent with $S$ and a derivation $\pi$ = $\pi _0$ $\xrightarrow {b_1}$ $\pi _1 \cdots \pi _{n-1}$ $\xrightarrow {b_n}$ $\pi _n$ = $\pi '$ where $\pi '$ has finite length. This derivation can be continued until a formula $\pi ''$ with length 2 is reached. By repeated application of $( Succ )$, $S \vdash \langle b_1\rangle \cdots \langle b_n\rangle \cdots do(\pi '')$, however this contradicts $( Ser )$. $\square$

Theorem 2

The set of finite plan explicit $\mathsf {ADL}$ theories is sound and complete with respect to the class of $\mathsf {ADL}$ interpretations.

Proof

More precisely, we show (soundness) all theorems of $\mathsf {ADL}$ are satisfied in all $\mathsf {ADL}$ interpretations, and (completeness) if $\varGamma = Cn (\theta )$ is a finite plan explicit theory such that $\varGamma \ \vdash /\phi$ then there is an $\mathsf {ADL}$ interpretation satisfying $\theta$ and $\lnot \phi$, so that $\varGamma \models /\ \phi$.

The soundness of $\mathsf {ADL}$ is relatively straightforward. Most of the axiom schemes are direct expressions of properties in the definition of $\mathsf {ADL}$ interpretations. $( Null )$ reflects the fact that $\mathcal R_\varLambda = id _\mathcal T$ when $\sigma \in \mathcal T$ iff $\sigma \models do(\varLambda )$. $( D )$ and $( Exh )$ express the seriality of the transition relation $\mathcal R$. $( Att )$, $( Test )$ and $( Err )$ relate to the properties of action theories (Definition 15). $( Prim )$ captures the semantic condition for $do$ formulae with programs of length 1. $( Init )$ says that the only transitions emanating from a situation are those that can be an initial transition of the program executed at that situation.

The $( Succ )$ series of axioms is more complicated. There are pairs of axioms, one for when the program in head normal form does not contain $\varLambda$ and one for when it does. Consider the first axiom scheme (the others are analogous). If $\sigma \models do(\pi )$ where $\pi = \bigcup _{i \in I} b_i;(\bigcup _{j \in J} \pi _j)$, then there is an agent program execution graph $\mathcal G'$ bisimilar to the agent program execution graph $\mathcal G$ in $\mathcal M$ mapping $\sigma$ in $\mathcal G$ to $\sigma '$ in $\mathcal G'$ such that $\sigma '$ is labelled $\pi$. By the definition of coherence, for each primitive action $b_i$, there is an $\mathcal R_{b_i}$-successor $\tau _{ij}'$ of $\sigma '$ with $l'(\tau _{ij}') = \pi _j$. By the definition of bisimulation, there are corresponding successors $\tau _{ij}$ of $\sigma$; thus by definition, each $\tau _{ij} \models do(\pi _j)$. Moreover, by $( Init )$, $( Exh )$ and $( Prim )$, these are the only successors of $\sigma$, so $\sigma$ satisfies the right hand side of the axiom scheme. Conversely, if $\sigma$ satisfies the right hand side, there is a collection of situations $\tau _{ij}$ in a collection of agent program execution graphs $\mathcal G_{ij}$ and coherent labellings $l_{ij}$ with bisimulations $\sim _{ij}$ where $\tau _{ij} \sim _{ij} \tau _{ij}'$ and $l_{ij}(\tau _{ij}') = \pi _j$ for each $\mathcal R_{b_i}$-successor $\tau _{ij}$ of $\sigma$. By Lemma 1, all the $\mathcal G_{ij}$ are bisimilar to one another since they are all bisimilar to $\mathcal G$. So if $\sigma$ is mapped to a predecessor $\sigma _{ij}$ of $\tau _{ij}$ in $\mathcal G_{ij}$, it follows that each $\sigma _{ij}$ is labelled with a program that is bisimilar to $\pi$. Thus by repeated applications of Lemma 2, there is an agent program execution graph bisimulation mapping $\sigma$ to a situation labelled $\pi$, so that $\sigma \models do(\pi )$.

Axioms $(\forall \bigcirc )$ and $(\forall _c\bigcirc )$ define the $\mathsf {CTL}$ operators in terms of the $do$ operator for programs of length 1 and the $\mathsf {PDL}$ formulae that represent the transition relation. For programs of length $>$ 1, the soundness of the first $( Eq )$ inference rule follows from Lemma 2, and that of the second $( Eq )$ inference rule follows from Lemma 3, underlining the central role of these lemmas in the formulation of $\mathsf {ADL}$. For the remaining cases of the first rule, observe that if $\pi$ is bisimilar to a program $\psi$ of length 0, then both must be bisimilar to $\varLambda$, so $\sigma \models do(\pi )$ iff $\sigma \models do(\psi )$ iff $\sigma \models do(\varLambda )$ iff $\sigma \in \mathcal T$. Similarly, if $\pi$ is bisimilar to a program $\psi$ of length 1 that does not terminate, $\pi$ and $\psi$ must both take only the same set of single transitions, hence $\sigma \models do(\pi )$ iff $\sigma \models do(\psi )$.

For completeness, follow the standard filtration approach using the syntactic analogue of $\varGamma$-filtration as outlined in Goldblatt [20]. That is, starting with a finite plan explicit theory $Cn (\theta )$ and a formula $\phi$ such that $Cn (\theta ) \ \vdash /\phi$, a finite model of $\alpha = \theta \wedge \lnot \phi$ is defined as follows. Without loss of generality, by applying the logics of achievement and attempts, $\alpha$ does not include any programs of the form $achieve ~\gamma$ and the only attempts are on primitive actions, and by use of $( Eq )$, all programs $\pi$ occurring in expressions $do(\pi )$ are in head normal form. First, a finite set of atomic propositions $\mathcal L$ and a finite set of atomic programs $\varPi$ are needed: the proposition symbols in $\mathcal L$ are those contained in $\alpha$; the primitive actions $\varPi$ are those occurring in a subformula $do(\pi )$ or $[\pi ]\beta$ of $\alpha$ (if the first of these sets is empty, create a new atomic proposition; the second cannot be empty). Now take the smallest closed set containing $\alpha$, which by Lemma 1 is a finite set $\varGamma$; note that $\varGamma$ contains a formula $do(\pi )$ where by Lemma 1, $\pi$ is an infinite program. Of interest are equivalence classes of maximal consistent sets of $\mathsf {ADL}$ formulae: if $\varSigma$ is the set of all maximal consistent sets of $\mathsf {ADL}$ formulae over the language $\mathcal L$ so defined, an equivalence relation on $\varSigma$ is defined by setting $\sigma \sim _\varGamma \tau$ if $\sigma \cap \varGamma = \tau \cap \varGamma$. Let $\varSigma _\varGamma$ be the set of all equivalence classes under $\sim _\varGamma$. Since $\varGamma$ is finite, $\varSigma _\varGamma$ is also finite. For a maximal consistent set of $\mathsf {ADL}$ formulae $\sigma$, let $\sigma _\varGamma \in \varSigma _\varGamma$ be the equivalence class to which $\sigma$ belongs. We sometimes write $\beta \in \sigma _\varGamma$ as a shorthand for $\beta \in \tau$ whenever $\tau \in \sigma _\varGamma$ (conflating the equivalence class $\sigma _\varGamma$ with the set of formulae contained in all members of that class).

As a preliminary step to defining an $\mathsf {ADL}$ interpretation, where $\varSigma$ is the set of all maximal consistent sets of $\mathsf {ADL}$ formulae, consider the model structure on $\varSigma$ obtained by defining $R_a$ for the primitive actions using the standard definition $R_a(\sigma , \tau )$ if $\{\beta : [a]\beta \in \sigma \} \subseteq \tau$. Now consider the set $\varSigma _\varGamma$ of equivalence classes, where the relation $R_a$ on $\varSigma _\varGamma$ for primitive actions is defined using the least $\varGamma$-filtration of the corresponding $R_a$ on $\varSigma$, $R_{\beta ?}(\sigma , \sigma )$ if $\beta \in \sigma$, and $\mathcal R_\pi$ for a complex program $\pi$ is defined using the standard model condition for $\mathsf {PDL}$. The reason for using the least filtration is that this is required for that part of the construction relating to $\mathsf {CTL}$ formulae.

An $\mathsf {ADL}$ interpretation $\mathcal M$ is now defined as follows (this is still only an initial model since it will need to be adjusted to handle the $\mathsf {CTL}$ formulae of $\mathsf {ADL}$). In a modification to the standard technique that enables agent program execution to be modelled, the set of situations $\mathcal S$ in $\mathcal M$ is not the set $\varSigma _\varGamma$, but is defined to be the set of all tuples $\langle \sigma _\varGamma , \pi , \pi _c\rangle$ where $\sigma _\varGamma \in \varSigma _\varGamma$ is an equivalence class of maximal consistent sets of $\mathsf {ADL}$ formulae, as above, and $\pi$ and $\pi _c$ are infinite programs such that $do(\pi ), \mathsf Cdo(\pi _c) \in \varGamma$ and $do(\pi ), \mathsf Cdo(\pi _c) \in \sigma _\varGamma$ (that is, in all elements of the class $\sigma _\varGamma$). Note that this set is finite since the formulae $do(\pi )$ and $do(\pi _c)$ are drawn from the finite set $\varGamma$. The intuition behind this definition is that $\mathcal S$ contains multiple “copies” of the situations in $\varSigma$ that agree on the propositional content, including formulae of the form $do(\pi )$ and $\mathsf Cdo(\pi _c)$, but that generate different transitions depending on the execution of the programs. This intuition is reflected in the following definition of the binary relations on $\mathcal S$ for primitive actions: for $b = attempt ~a$, $\mathcal R_b(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \tau _\varGamma , \pi ', \pi _c'\rangle )$ if $R_b(\sigma , \tau )$ and $\pi \xrightarrow {b} \pi '$, and $\mathcal R_a(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \tau _\varGamma , \pi ', \pi _c'\rangle )$ if $R_a(\sigma , \tau )$, $\pi \xrightarrow {b} \pi '$ and $\pi _c \xrightarrow {a} \pi _c'$ otherwise. For a $\mathsf {PDL}$ test $\beta ?$, $R_{\beta ?}(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \sigma _\varGamma , \pi , \pi _c\rangle )$ if $\beta \in \sigma _\varGamma$, and otherwise, $\mathcal R_\pi$ is defined using the standard model conditions for $\mathsf {ADL}$ (here applied to the situations in $\mathcal S$). The transition relation $\mathcal R$ on $\mathcal S$ is defined by setting $\mathcal R= \bigcup _{b \in \varPi } \mathcal R_b$ for the set of primitive attempt actions $b$, i.e., $\mathcal R(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \tau _\varGamma , \pi ', \pi _c'\rangle )$ iff $\mathcal R_b(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \tau _\varGamma , \pi ', \pi _c'\rangle )$ for some primitive attempt $b$, in accordance with the definition of an action theory (Definition 15).

It remains to define $\mathcal T$, $\mathcal A$, $S^+$, $\mathcal B$ and $\mathcal V$. The set of terminating situations $\mathcal T$ in $\mathcal S$ is defined by setting $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal T$ iff $\pi \surd$. The set of actual situations $\mathcal A$ is defined by the condition $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal A$ if $\epsilon \not \in \sigma _\varGamma$. To define the $\mathcal B$ relation, there need to be situations in $\mathcal S^+$ representing the epistemic alternatives of each situation in $\mathcal S$. For each situation $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal S$, define situations $\langle \sigma _\varGamma , \pi , \pi _c, B\rangle$ that each contain a maximal consistent set of propositions $B$ over $\mathcal L$ consistent with the set of formulae $\mathsf B\beta$ in $\sigma _\varGamma$. That is, for each situation $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal S$, define the set of consistent situations $\mathsf B(\langle \sigma _\varGamma , \pi , \pi _c\rangle )$ = $\{\langle \sigma _\varGamma , \pi , \pi _c, B\rangle : \{\beta : \mathsf B\beta \in \sigma _\varGamma \} \subseteq B\}$. $\mathcal S^+$ is now defined to be the set of situations $\mathcal S\cup \bigcup _{\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal S} \mathsf B(\langle \sigma _\varGamma , \pi , \pi _c\rangle )$. The $\mathcal B$ relation can now be defined by setting $\mathcal B(\langle \sigma _\varGamma , \pi , \pi _c\rangle , \langle \sigma _\varGamma , \pi , \pi _c, B\rangle )$ if $\langle \sigma _\varGamma , \pi , \pi _c, B\rangle \in \mathsf B(\langle \sigma _\varGamma , \pi , \pi _c\rangle )$. The valuation function $\mathcal V$ on $\mathcal S^+$ is defined as usual by setting $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal V(p)$ if $p \in \sigma _\varGamma$, and $\langle \sigma _\varGamma , \pi , \pi _c, B\rangle \in \mathcal V(p)$ if $p \in B$, for an atomic proposition $p$ in $\mathcal L$. Note that by $( Test )$, for test actions, the set of successors of an actual situation is an error situation iff the test on beliefs fails, and the successors of an error situation are all error situations, and by $( Err )$, for a non-test action, a situation is an error situation iff all its successors are error situations.

This defines an initial $\mathsf {ADL}$ model $\mathcal M= \langle \mathcal S, \mathcal T, \mathcal A, \mathcal R, \{\mathcal R_\pi \}, \mathcal S^+, \mathcal B, \mathcal V\rangle$. To show completeness, we need to verify the “truth lemma,” i.e., that $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models \beta$ iff $\beta \in \sigma _\varGamma$ whenever $\beta \in \varGamma$ for every situation $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal A$, so that the original formula $\alpha$ holds at some particular situation in the final constructed $\mathsf {ADL}$ model (see below). The steps in this proof follow roughly the same order as the semantic definitions for $\mathsf {ADL}$. So as a preliminary, note that it follows from the definitions that the truth lemma holds for the propositions of $\mathcal L$ and for belief formulae $\mathsf B\beta$. As an intermediate result, let us show this in the case of the $\mathsf {PDL}$ formulae with respect to the initial model $\mathcal M$, ignoring the $\mathsf {CTL}$ formulae for the moment.

The first part of the proof is for formulae of the form $do(\psi )$. The proof proceeds by induction on programs $\psi$. First, consider a program $\psi$ of length 0 and a situation $\langle \sigma _\varGamma , \pi , \pi _c\rangle$. We show that $do(\psi ) \in \sigma _\varGamma$ iff $\pi \surd$. Now $\pi \surd$ iff the head normal form of $\pi$ contains a $\varLambda$ term. Thus $\pi \surd$ and $do(\pi ) \in \sigma _\varGamma$ implies $do(\varLambda ) \in \sigma _\varGamma$ by $( Null )$, and since $\psi$ is bisimilar to $\varLambda$, $do(\psi ) \in \sigma _\varGamma$ by $( Eq )$. Conversely, if $do(\psi ) \in \sigma _\varGamma$ for $\psi$ of length 0, then since $\psi$ is bisimilar to $\varLambda$, $do(\varLambda ) \in \sigma _\varGamma$ by $( Eq )$, so then $do(\varLambda \cup \pi ) \in \sigma _\varGamma$ by $( Null )$. But then by $( Eq )$, $\pi$ must be bisimilar to $\varLambda \cup \pi$ since both are of length $>$ 1, so $\pi \surd$. So $do(\psi ) \in \sigma _\varGamma$ iff $\pi \surd$ iff $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal T$ iff $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do(\psi )$. The same result for formulae $\mathsf Cdo(\psi )$ of length 0 follows from $( Null )$.

Consider programs $\psi$ of length 1 such that not $\psi \surd$. Then $do(\psi ) \in \sigma _\varGamma$ iff $\psi$ is bisimilar to $attempt ~(a_1 \cup \cdots \cup a_n)$. But by $( Prim )$, $do( attempt ~(a_1 \cup \cdots \cup a_n)) \in \sigma _\varGamma$ iff $\langle a_i\rangle \top \in \sigma _\varGamma$ for $i = 1, \ldots , n$, and $[a_i]\bot \in \sigma _\varGamma$ for all other $i$, which holds iff there exist $a_i$-transitions from $\langle \sigma _\varGamma , \pi , \pi _c\rangle$ for $i = 1, \ldots , n$ and for no other $a_i$, i.e., iff $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do( attempt ~(a_1 \cup \cdots \cup a_n))$. It similarly follows that $\mathsf Cdo(a_1 \cup \cdots \cup a_n) \in \sigma _\varGamma$ iff $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models \mathsf Cdo(a_1 \cup \cdots \cup a_n)$.

For programs $\psi$ such that $|\psi | > 1$, where all primitive actions in $\pi$ are of the form $b = attempt ~a$, suppose that $do(\psi ) \in \sigma _\varGamma$ and $\psi$ is also of this form. Since $do(\pi )$ and $do(\psi )$ are both contained in $\sigma _\varGamma$, $\mathcal E\vdash \pi = \psi$, so $\pi$ and $\psi$ are bisimilar programs. Therefore, to show that $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do(\psi )$, by Lemma 2, it suffices to show that $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do(\pi )$. To this end, we need to find a coherent labelling $l$ of $\mathcal G= \langle \mathcal S, \mathcal T, \mathcal A, \mathcal R\rangle$ and an agent program execution graph $\mathcal G'$ with a coherent labelling $l'$ such that $\mathcal G\sim \mathcal G'$ and a situation related to $\langle \sigma _\varGamma , \pi , \pi _c\rangle$ that is labelled $\pi$. For the desired $\mathcal G'$, simply take $\mathcal G$ itself and consider the obvious labelling where $\langle \tau _\varGamma , \pi ', \pi _c'\rangle$ is labelled $\pi '$ for all situations in $\mathcal S$. The obvious labelling is coherent because: (i) $\langle \tau _\varGamma , \pi ', \pi _c'\rangle \in \mathcal T$ iff $\pi '\surd$ by definition, (ii) $\mathcal R_b(\langle \tau _\varGamma , \pi ', \pi _c'\rangle , \langle \tau _\varGamma ', \pi '', \pi _c''\rangle )$ implies $\pi ' \xrightarrow {b} \pi ''$ by the definition of $\mathcal R_b$, and (iii) if $\pi ' \xrightarrow {b} \upsilon$ then there exists $\langle \tau _\varGamma ', \upsilon , \pi _c''\rangle \in \mathcal S$ with $\mathcal R_b(\langle \tau _\varGamma , \pi ', \pi _c'\rangle , \langle \tau _\varGamma ', \upsilon , \pi _c''\rangle )$ by $( Succ )$ and the construction of $\mathcal M$. Thus $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do(\pi )$. Conversely, if $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models do(\psi )$, there is an agent program execution graph $\mathcal G'$ with a coherent labelling $l'$ such that $\mathcal G\sim \mathcal G'$ for some labelling $l$ of $\mathcal G$, in which a situation related to $\langle \sigma _\varGamma , \pi , \pi _c\rangle$ is labelled $\psi$. By Lemma 3, it follows that $\pi$ and $\psi$ are bisimilar programs, hence by Theorem 1 of Corradini, De Nicola and Labella [12], $\mathcal E\vdash \pi = \psi$, and so, since $do(\pi ) \in \sigma _\varGamma$, $do(\psi ) \in \sigma _\varGamma$ by $( Eq )$.

Now consider formulae $\mathsf Cdo(\psi )$ where $|\psi | > 1$ and $\psi$ is a program all of whose primitive actions are not of the form $attempt ~a$. Consider the labelling of the intended agent program execution graph where $\langle \tau _\varGamma , \pi ', \pi _c'\rangle$ is labelled $\pi _c'$ for each situation $\langle \tau _\varGamma , \pi ', \pi _c'\rangle$ in this graph. As above, this labelling is coherent so $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models \mathsf Cdo(\pi _c)$, and so also as above, since $\pi _c$ and $\psi$ are bisimilar programs, $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models \mathsf Cdo(\psi )$ by Lemma 2. Conversely, if $\langle \sigma _\varGamma , \pi , \pi _c\rangle \models \mathsf Cdo(\psi )$, there is an agent program execution graph $\mathcal G'$ with a coherent labelling $l'$ such that $\mathcal G\sim \mathcal G'$ for some labelling $l$ of the intended agent program execution graph $\mathcal G$ in which a situation related to $\langle \sigma _\varGamma , \pi , \pi _c\rangle$ is labelled $\psi$. Again, by Lemma 3, it follows that $\pi _c$ and $\psi$ are bisimilar programs, hence by Theorem 1 of Corradini, De Nicola and Labella [12], $\mathcal E\vdash \pi _c = \psi$, and so, since $\mathsf Cdo(\pi _c) \in \sigma _\varGamma$, $\mathsf Cdo(\psi ) \in \sigma _\varGamma$ by $( Eq )$.

Next consider $\mathsf {PDL}$ formulae $[\pi ]\beta$. When $\pi$ is an atomic program (primitive action or test), this follows from the definitions. When $\pi$ is a complex program, this uses the proof that $\mathcal M$ is a $\varGamma$-filtration of the canonical $\mathsf {PDL}$ model, Theorem 10.7 of Goldblatt [20, pp. 114–115], which establishes the inductive steps. More precisely, for all programs $\pi$, it is shown there, where $R_\pi '$ is the $\varGamma$-filtration defined in the standard way: (F1) if $R_\pi (\sigma , \tau )$ then $R_\pi '(\sigma _\varGamma , \tau _\varGamma )$, and (F2) if $\mathcal R_\pi '(\sigma _\varGamma , \tau _\varGamma )$ then for all $\beta$, if $[\pi ]\beta \in \varGamma$ and $\sigma \models [\pi ]\beta$ then $\tau \models \beta$. In the context of $\mathsf {ADL}$, it follows by definition of the construction of $\mathcal M$ that: (F1) if $R_\pi (\sigma , \tau )$ then for every situation $\langle \sigma _\varGamma , \psi , \psi _c\rangle \in \mathcal A$, $\mathcal R_\pi (\langle \sigma _\varGamma , \psi , \psi _c\rangle , \langle \tau _\varGamma , \psi ', \psi _c'\rangle )$ for some situation $\langle \tau _\varGamma , \psi ', \psi _c'\rangle \in \mathcal A$, and (F2) if $\mathcal R_\pi (\langle \sigma _\varGamma , \psi , \psi _c\rangle , \langle \tau _\varGamma , \psi ', \psi _c'\rangle )$ then for all $\beta$, if $[\pi ]\beta \in \varGamma$ and $\sigma \models [\pi ]\beta$ then $\tau \models \beta$. Note that $( Comp )$ is used for sequencing, $( Alt )$ for union, and $( Mix )$ and $( Ind )$ for iteration. The inductive step for iteration relies on the finiteness of the $\mathsf {ADL}$ interpretation. $( Null )$ is used when the program $\pi$ is $\varLambda$. This is sufficient to establish the truth lemma with respect to the initial model $\mathcal M$ for the $\mathsf {PDL}$ formulae of $\mathsf {ADL}$ (ignoring the $\mathsf {CTL}$ component), since the inductive step has been established for the propositions over $\mathcal L$ and formulae of the form $do(\psi )$, $\mathsf Cdo(\psi )$ and $\mathsf B\gamma$.

We now come to the $\mathsf {CTL}$ formulae of $\mathsf {ADL}$. We apply to $\mathcal M$ the “unravelling” construction of Emerson and Halpern [15] used to show the completeness of $\mathsf {CTL}$, adapted to the framework of filtrations by Goldblatt [20]. In our context, this construction produces from $\mathcal M$ a new $\mathsf {ADL}$ model $\mathcal N$ built from the situations and transition relations in $\mathcal M$. First note that $\mathcal R$ (in $\mathcal M$) is defined to be $\bigcup _{b \in \varPi } \mathcal R_b$ for the primitive attempt actions $b$, where each $\mathcal R_b$ is the least filtration of $R_b$ on $\varSigma$ defined by $R_b(\sigma , \tau )$ if $\{\beta : [b]\beta \in \sigma \} \subseteq \tau$. It follows that $\mathcal R$ is the least filtration of $R_{b_1 \cup \cdots \cup b_n}$ defined by $R_{b_1 \cup \cdots \cup b_n}(\sigma , \tau )$ if $\{\beta : [b_1 \cup \cdots \cup b_n]\beta \in \sigma \} \subseteq \tau$. This means that the conditions required to apply the unravelling construction as given in Goldblatt [20, pp. 101–108] are satisfied.

In our notation, given an initial set of situations $\mathcal S$, the construction involves the definition of a “$\varGamma$-tree” for each situation $\sigma \in \mathcal S$: such trees are “glued” together to form a final model $\mathcal N$. A $\varGamma$-tree for a situation $\sigma$ is a tree such that the nodes of the tree are “copies” of the situations in $\mathcal S$ (nodes $n$ each with an associated element $\overline{n}$ of $\mathcal S$), the root of the tree is associated with $\sigma$, and the transition relation $\rho$ is such that: (i) if $\rho (n, m)$ then $\mathcal R(\overline{n}, \overline{m})$, and (ii) if $\forall \bigcirc \beta \in \varGamma$ and $\forall \bigcirc \beta \notin \overline{n}$ then $\beta \notin \overline{m}$ for some node $m$ such that $\rho (n, m)$.

The first part of the proof involves showing that whenever $\forall (\alpha \,\mathcal U\beta ) \in \varGamma$, if $\forall (\alpha \,\mathcal U\beta ) \in \sigma$ (i.e., in all elements of the equivalence class used to define $\sigma$), there is a $\varGamma$-tree whose root is associated with $\sigma$ such that $\alpha$ is realized at every interior node of the tree and $\beta$ is realized at every leaf, and similarly for $\forall _c (\alpha \,\mathcal U\beta )$. Here $\beta$ is realized at a node $n$ if $\beta \in \overline{n}$. However, the definition of this tree requires the selection, for each node $n$ in the tree, of suitable successors $m$ where, for all formulae $\forall \bigcirc \gamma \in \varGamma$, if $\forall \bigcirc \gamma \notin \overline{n}$, $\gamma \notin \overline{m}$ for some such successor $m$, and similarly for $\forall _c\bigcirc \gamma$. Furthermore, in order to respect the definition of program execution in the $\mathsf {ADL}$ model $\mathcal M$, whenever a successor $m$ of a situation $n$ is chosen, if $\overline{n} = \langle \sigma _\varGamma , \pi , \pi _c\rangle$ and $\overline{m} = \langle \tau _\varGamma , \pi ', \pi _c'\rangle$ (where $\pi \xrightarrow {a} \pi '$ for some primitive attempt action $a$ by definition), every possible successor $m'$ of $n$ for which $\overline{m'} = \langle \tau _\varGamma , \pi '', \pi _c''\rangle$ for some $\pi ''$ such that $\pi \xrightarrow {a} \pi ''$ is added as a successor of $n$. As $\forall \bigcirc \gamma \rightarrow \forall _c\bigcirc \gamma$ is a theorem of $\mathsf {ADL}$, this also guarantees that for all formulae $\forall _c\bigcirc \gamma \in \varGamma$, if $\forall _c\bigcirc \gamma \notin \overline{n}$, $\gamma \notin \overline{m}$ for some such successor $m'$, since the set of all possible successors of $n$ includes at least one reached by a successful transition (hence this transition is included in the intended agent program execution graph).

The proof proceeds by showing that for every situation $\sigma \in \mathcal S$, there is a $\varGamma$-tree with root $r$ for which $\overline{r} = \sigma$ such that: (i) if $\forall \bigcirc \beta \in \varGamma$ and $\forall \bigcirc \beta \notin \overline{r}$ then $\beta \notin \overline{m}$ for some node $m$ such that $\rho (r, m)$, and similarly for $\forall _c\bigcirc \beta$, and (ii) every “eventuality” formula $\forall (\alpha \,\mathcal U\beta )$ and $\exists (\alpha \,\mathcal U\beta )$ in $\varGamma$ is fulfilled at $r$, and similarly for $\forall _c (\alpha \,\mathcal U\beta )$ and $\exists _c (\alpha \,\mathcal U\beta )$. For $\forall (\alpha \,\mathcal U\beta )$, this means that if $\forall (\alpha \,\mathcal U\beta ) \in \overline{r}$, every branch of the tree realizes $\alpha \,\mathcal U\beta$, and similarly, for $\exists (\alpha \,\mathcal U\beta )$, if $\exists (\alpha \,\mathcal U\beta ) \in \overline{r}$, some branch of the tree realizes $\alpha \,\mathcal U\beta$. This part of the construction involves extending the $\varGamma$-tree for $\sigma$ defined previously a finite number of times to fulfil all the eventuality formulae in $\varGamma$.

The final model $\mathcal N$ is constructed by adjoining all the $\varGamma$-trees so defined, possibly reintroducing cycles: starting with any tree, any leaves $\tau$ are replaced by their corresponding $\varGamma$-trees, repeatedly doing so until all such replacements have been made. More precisely, the situations $\mathcal S_\mathcal N$ in the model are all the nodes from the $\varGamma$-trees so constructed, and the relation $\mathcal R_\mathcal N= \rho$ as defined by the construction. Each node in the model is associated with a situation $\overline{n}$, which is some situation $\langle \sigma _\varGamma , \pi , \pi _c\rangle \in \mathcal S$. The other definitions for $\mathcal N$ are inherited from the initial model $\mathcal M$. $\mathcal R_a$ on $\mathcal S_\mathcal N$ for a primitive action $a$ is defined so that $\mathcal R_a(n, m)$ iff $\mathcal R_a(\overline{n}, \overline{m})$ and $\pi \xrightarrow {a} \pi '$, where $\overline{n} = \langle \sigma _\varGamma , \pi , \pi _c\rangle$ and $\overline{m} = \langle \tau _\varGamma , \pi ', \pi _c'\rangle$. As for $\mathcal M$, the relations $\mathcal R_\pi$ on $\mathcal S_\mathcal N$ are defined using the standard model conditions for $\mathsf {PDL}$. The terminating situations $\mathcal T_\mathcal N$ of $\mathcal S_\mathcal N$ are defined so that $n \in \mathcal T_\mathcal N$ iff $\overline{n} \in \mathcal T$. For the $\mathcal B$ relation, for each situation in $\mathcal S_\mathcal N$, as for $\mathcal S$, a set of belief-alternative situations $\mathsf B(n) = \mathsf B(\overline{n})$ is created with $\mathcal B(n, m)$ iff $m \in \mathsf B(n)$. The set of situations $\mathcal S_\mathcal N^+$ in $\mathcal N$ is the union of $\mathcal S_\mathcal N$ and all the sets $\mathsf B(n)$. Finally, the valuation $\mathcal V_\mathcal N$ on $\mathcal S_\mathcal N^+$ is inherited directly from $\mathcal M$.

It remains to verify the truth lemma for the newly constructed $\mathsf {ADL}$ model $\mathcal N$, i.e., that $n \models \beta$ iff $\beta \in \sigma _\varGamma$ where $\overline{n} = \langle \sigma _\varGamma , \pi , \pi _c\rangle$, whenever $\beta \in \varGamma$, for every situation $n \in \mathcal S_N$. As in the case of $\mathcal M$, for formulae over $\mathcal L$ and belief formulae $\mathsf B\gamma$, this is straightforward.

For formulae $do(\psi )$, for programs of length 0 and 1, this follows from the definitions of $\mathcal R_\mathcal N$ for the primitive actions and the properties of $\varGamma$-trees, since $\forall \bigcirc \beta \equiv [a_1 \cup \cdots \cup a_n]\beta$ when $do(a_1 \cup \cdots \cup a_n) \in \sigma _\varGamma$ and $\forall _c\bigcirc \beta \equiv [a_1 \cup \cdots \cup a_n]\beta$ when $do( attempt ~(a_1 \cup \cdots \cup a_n)) \in \sigma _\varGamma$. For programs $\psi$ such that $|\psi | > 1$, the construction of $\varGamma$-trees guarantees that, given any coherent labelling of the agent program execution graph $\mathcal G$ in $\mathcal M$, the relation $\sim$ between $\mathcal G$ and $\mathcal G_N$, where $\mathcal G_N$ is the agent program execution graph in $\mathcal N$, defined by setting $\sigma \sim n$ iff $\overline{n} = \sigma$, is a bisimulation on agent program execution graphs (where the label of $n$ is just the label of $\overline{n}$). Thus $n \models do(\psi )$ iff $\overline{n} \models do(\psi )$ iff $do(\psi ) \in \sigma _\varGamma$ where $\overline{n} = \langle \sigma _\varGamma , \pi \rangle$. Hence the truth lemma is established for formulae $do(\psi )$. A similar argument applies for formulae $\mathsf Cdo(\psi )$ with respect to the intended agent program execution graph in $\mathcal M$.

For the $\mathsf {PDL}$ formulae of $\mathsf {ADL}$, analogous to the filtration properties shown above for $\mathcal M$, for any situation $n \in \mathcal A_\mathcal N$: (F1) if $R_\pi (\sigma , \tau )$ then for every situation $n \in \mathcal S_\mathcal N$, if $\overline{n} = \langle \sigma _\varGamma , \psi , \psi _c\rangle$, $\mathcal R_\pi (n, m)$ for some situation $m \in \mathcal S_\mathcal N$ with $\overline{m} = \langle \tau _\varGamma , \psi ', \psi _c'\rangle$, and (F2) if $\mathcal R_\pi (n, m)$ where $\overline{n} = \langle \sigma _\varGamma , \psi , \psi _c\rangle$ and $\overline{m} = \langle \tau _\varGamma , \psi ', \psi _c'\rangle$, then for all $\beta$, if $[\pi ]\beta \in \varGamma$ and $n \models [\pi ]\beta$ then $m \models \beta$. This is sufficient to establish the truth lemma for the $\mathsf {PDL}$ formulae of $\mathsf {ADL}$, this time also using the inductive step in the case of the $\mathsf {CTL}$ formulae.

Finally, for the $\mathsf {CTL}$ formulae of $\mathsf {ADL}$, the proof in Goldblatt [20] establishes the truth lemma for formulae of the form $\forall \bigcirc \beta$, $\forall (\alpha \,\mathcal U\beta )$ and $\exists (\alpha \,\mathcal U\beta )$. For formulae of the form $\forall _c\bigcirc \beta$, $\forall _c (\alpha \,\mathcal U\beta )$ and $\exists _c (\alpha \,\mathcal U\beta )$ with respect to the intended agent program execution graph, the argument is analogous. The final model $\mathcal N$ thus gives a model for the original formula $\alpha$, as required to show the completeness of $\mathsf {ADL}$. $\square$