 # Proof System for Plan Verification under 0-Approximation Semantics

In this paper a proof system is developed for plan verification problems {X}c{Y} and {X}c{KW p} under 0-approximation semantics for A_K. Here, for a plan c, two sets X,Y of fluent literals, and a literal p, {X}c{Y} (resp. {X}c{KW p}) means that all literals of Y become true (resp. p becomes known) after executing c in any initial state in which all literals in X are true.Then, soundness and completeness are proved. The proof system allows verifying plans and generating plans as well.

## Authors

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Planning refers to the procedure of finding a sequence of actions(i.e., a plan

) which leads a possible world from an initial state to a goal. In the early days of Artificial Intelligence(AI), an agent(i.e., plan generator or executor) was assumed to have complete knowledge about the world but it turned out to be unrealistic. Therefore, planning under

incomplete knowledge earns a lot of attention since late 1990s [15, 6, 22, 10, 19, 17]. A widely accepted solution is to equip the planner with actions for producing knowledge, also called sensing actions, and allow to use conditional plan[10, 24, 25, 23, 16], i.e., plans containing conditional expressions (e.g., If-Then-Else structures).

Consider the following example , say a bomb can only be safely defused if its alarm is switched off. Flipping the switch causes the alarm off if it is on and vice versa. At the beginning we only know the bomb is not disarmed and not exploded, however, we do not know whether or not the alarm is on, i.e., the knowledge about initial state of the domain is incomplete. An agent could correctly defuse the bomb by performing the conditional plan below:

 check;If alarm_off Then defuse Else {switch;defuse}

in which is a sensing action that produces the knowledge about the alarm. It is necessary to mention that there exists no feasible classical plans for this scenario, e.g., neither nor could safely disarm the bomb.

To describe and reason about domains with incomplete knowledge, a number of logical frameworks were proposed in the literature. One of well-established formalizations is the action language [24, 4]. In contrast to its first order antecedents [15, 22], possesses a natural syntax and a transition function based semantics, both together provides a flexible mechanism to model the change of an agent’s knowledge in a simplified Kripke structure.

In  the authors propose several semantics for , all of which, roughly speaking, are based on some transition function from pairs of actions and initial states to states. For convenience we use SB-semantics to denote the semantics based on the transition function which maps pairs of actions and c-states to c-states. Here, a c-state is a pair of a world state and a knowledge state which is a set of world states. One of the results in  is that the polynomial plan existence problem under SB-semantics is PSPACE-complete. Even we restrict the number of fluents determined by a sensing action, the existence of polynomial plan with limited number sensing actions is -complete . To overcome the high complexity, Baral and Son  have proposed -approximations, . It has been proved in  that under some restricted conditions polynomial plan existence problem under 0-approximation is NP-complete, that is, it is still intractable because it is widely believed that there is no polynomial algorithm solving an NP-complete problem.

Although modern planers are quite successful to produce and verify short plans they still face a great challenge to generate longer plans. There have been many efforts to construct transformations from planning or plan verification to other logic formalisms, for example, first-order logic (FOL) [11, 9, 24], propositional satisfiability (SAT) , QBF satisfiability (QSAT), [18, 14], non-monotonic logics [7, 3, 13], and so on. These approaches provide ways to use existing solvers for planning and plan verification, they do not, however, tell us how to generate and verify new plans from old ones.

It is well known that programming is generally also very hard, however, proof system for program verification allows one to construct new correct programs from shorter ones . Similarly, proof systems for plan verification would be helpful for verifying and constructing longer correct plans.

For a given domain description , two sets of fluent literals, and a plan , we consider the verification problem of determining whether , that is, whether all literals of becomes true after executing in any initial state in which all literals of are true. It seems natural that from and we should obtain . That is,

 {X}c1{Y}, {Y}c2{Z}{X}c1;c2{Z}

should be a valid rule. This paper is devoted to develop a sound and complete proof system for plan verification under 0-approximation.

One important observation is that constructing proof sequences could also be considered as a procedure for generating plans. This feature is very useful for the agent to do so-called off-line planning [12, 5]. That is, when the agent is free from assigned tasks, she could continuously compute (short) proofs and store them into a well-maintained database. Such a database consists of a huge number of proofs of the form after certain amount of time. W.l.o.g., we may assume these proofs are stored into a graph, where , are nodes and is an connecting edge. With such a database, the agent could do on-line query quickly. Precisely speaking, asking whether a plan exists for leading state to , is equivalent to look for a path from to in the graph. This is known as the PATH problem and could be easily computed (NL-complete, see ).

The paper is organized as follows. In Section 2 we mainly recall the language of and the 0-approximation semantics. In addition, a few new lemmas are proved, which will be used in later sections. Section 3 is devoted to the construction of proof system. Soundness and completeness are proved. Section 4 concludes this paper.

## 2 The Language AK

The language  proposed by Baral & Son is a well known framework for reasoning about sensing actions and conditional planning. In this section we recall the syntax and the 0-approximation semantics of , in addition we prove several new properties (e.g. the monotonicity of 0-transition function, see Lemma 2.1 below) which will be used in next section.

### 2.1 Syntax of AK

Two disjoint non-empty sets of symbols, called fluent names (or fluents) and action names (or actions) are introduced as the alphabet of the language . A fluent literal is either a fluent or its negation . For a fluent , by we mean . For a fluent literal , we define fln if is a fluent or is . Given a set of fluent literals, is defined as , and fln() is defined as .

The language uses four kinds propositions for describing a domain.

An initial-knowledge proposition (which is called v-proposition in ) is an expression of the form

 {\bf initially} p (1)

where is a fluent literal. Roughly speaking, the above proposition says that is initially known to be true.

An effect proposition (ef-proposition for short) is an expression of the form

 a\bf{ casues} p{ \bf if} p1,⋯,pn (2)

where is an action and , are fluent literals. We say and are the effect and the precondition of the proposition, respectively. The intuitive meaning of the above proposition is that is guaranteed to be true after the execution of action in any state of the world where are true. If the precondition is empty then we drop the if part and simply say: causes .

An executability proposition (ex-proposition for short) is an expression of the form

 {\bf executable} a {\bf if } p1,⋯,pn (3)

where is an action and are fluent literals. Intuitively, it says that the action is executable whenever are true. For convenience, we call the ex-preconditions of the proposition.

A knowledge proposition (k-proposition for short) is of the form

 a {\bf determines} f (4)

where is an action and is a fluent. Intuitively, the above proposition says that after is executed the agent will know whether is true or false.

A proposition is either an initial-knowledge proposition, or an ef-proposition, or an ex-proposition, or a k-proposition. Two initial-knowledge propositions initially and initially are called contradictory if . Two effect propositions “ causes if ” and “ causes if ” are called contradictory if and is empty.

###### Definition 2.1

() A domain description in is a set of propositions which does not contain

Actions occurring in knowledge propositions are called sensing actions, while actions occurring in effect propositions are called non-sensing actions. In this paper we request that for any domain description the set of sensing actions in and the set of non-sensing actions in should be disjoint.

###### Definition 2.2

(Conditional Plan ) A conditional plan is inductively defined as follows:

1. The empty sequence of actions, denoted by , is a conditional plan;

2. If is an action then is a conditional plan;

3. If and are conditional plans then the combination is a conditional plan;

4. If () are conditional plans and are conjunctions of fluent literals (which are mutually exclusive but not necessarily exhaustive) then the following is a conditional plan (also called a case plan):

 {\bf case} φ1→c1. ⋯. φn→cn. {\bf endcase}
5. Nothing else is a conditional plan.

Propositions are used to describe a domain, whereas queries are used to ask questions about the domain. For a plan , a set of fluent literals, and a fluent literal , we have two kinds of queries:

 Knows X after c (5)
 Kwhether p after c (6)

Intuitively, query of the form (5) asks whether all literals in will be known to be true after executing , while query of the form (6) asks whether will be either known to be true or known to be false after executing .

### 2.2 0-Approximation Semantics

In this section we arbitrarily fix a domain description without contradictory propositions. From now on when we speak of fluent names and action names we mean that they occur in propositions of .

According to , an a-state is a pair of two disjoint sets of fluent names. A fluent is true (resp. false) in if (resp. ). Dually, is true (resp. false) if is false (resp. true). For a fluent name outside , both and are unknown. A fluent literal is called possibly true if it is not false (i.e., true or unknown). In the following we often use , to denote a-states. For a set of fluent literals, we say is true in an a-state if and only if every is true in , .

An action is said to be 0-executable in an a-state if there exists an ex-proposition executable if , such that are true in . The following notations were introduced in .

(1) is a fluent and there exists “ causes if ” in such that are true in .

(2) is a fluent and there exists “ causes if ” in such that are true in .

(3) is a fluent and there exists “ causes if ” in such that possibly true in .

(4) is a fluent and there exists “ causes if ” in such that are possible true in .

(5) is a fluent and “ determines ” is in .

For an a-sate and a non-sensing action 0-executable in , the result after executing is defined as

 Res0(a,σ):=((T∪e+a(σ))∖F−a(σ),(F∪e−a(σ))∖F+a(σ))

The extension order on a-states is defined as follows :

 (T1,F1)⪯(T2,F2)  if and only if  T1⊆T2,F1⊆F2.

Please note that if then for a fluent literal we have

• if is true (resp. false) in then is true (resp. false) in ,

• if is unknown in then must be unknown in , and

• if is possibly true in then is possibly true in .

Consequently, for any non-sensing action and a-states and such that and is 0-executable in , we have

• is 0-executable in .

• , and .

• , and .

Then we have the following proposition.

###### Proposition 2.1

For any non-sensing action and a-states and such that and is 0-executable in , we have

 Res0(a,σ1)⪯Res0(a,σ2).

The 0-transition function of is defined as follows .

• If is not 0-executable in , then .

• If is 0-executable in and is a non-sensing action, .

• If is 0-executable in and is a sensing action, then .

• .

Let be two sets of a-states, we write if for every a-state in , there is an a-state in such that .

The next proposition follows directly from Proposition 2.1. and the definition of above.

###### Proposition 2.2

Suppose and is an action 0-executable in , then .

The extended 0-transition function , which maps pairs of conditional plans and a-states into sets of a-states, is defined inductively as follows.

###### Definition 2.3

()

When is a case plan case . endcase,

 ˆΦ0(c,σ):={ˆΦ0(cj,σ),if φj is true in σ,{⊥},if non of φ1,⋯,φk is true in σ.

.

.

###### Remark 2.1

From the definitions above we know that transition functions and of a domain description do not depends on any initial-knowledge proposition. In other words, if two domain descriptions and contain the same non initial-knowledge propositions, then their transition functions coincide.

A condition plan is 0-executable in if .

###### Lemma 2.1

(Monotonicity Lemma) Let be a plan, be two sets of a-states. Suppose , and is 0-executable in every a-state on . Then .

Proof: We proceed by induction on the structure of the plan .

1. Suppose consists of only an action . Consider an arbitrary a-state . Then there is an a-state such that . Since , pick such that . It is sufficient to show that for some .

If is a non-sensing action , then the assertion follows directly from Proposition 2.2. Suppose is a sensing action. Then must be of the form because is a sensing action, here . Then clearly must be in . The assertion follows since .

2. Suppose is case plan case . endcase. Consider any a-state . Let be such that and . Since is 0-executable in , some is true in . Then is also true in since . Then by the induction hypothesis, . Thus, there is such that . Consequently,

3. Suppose . By induction hypothesis . Then by the definition of we have

 ˆΦ0(c,Σ1)=⎛⎜⎝⋃σ′∈ˆΦ0(c1,Σ1)ˆΦ0(c2,σ′)⎞⎟⎠⪯⎛⎜⎝⋃σ′′∈ˆΦ0(c1,Σ2)ˆΦ0(c2,σ′′)⎞⎟⎠=ˆΦ0(c,Σ2)

An a-state is called an initial a-state of if is true in for any fluent literal such that the initial-knowledge proposition “initially ” is in .

Suppose is a domain description, is a conditional plan, is a set of fluent literals, and a literals. The semantics for the queries are given below:

###### Definition 2.4

()

• if for every initial a-state , the plan is 0-executable in , and is true in every a-state in .

• if for every initial a-state , the plan is 0-executable in , and is either true or false in every a-state in .

Let , . Obviously, is the least initial a-state of , that is, for any initial a-state . The following lemma follows easily from Lemma 2.1.

###### Lemma 2.2
• if and only if the plan is 0-executable in , and true true in every a-state in .

• if the plan is 0-executable in , and is either true or false in every a-state in .

## 3 A Proof System for 0-Approximation

A consistent set of literals determines a unique a-state by and . And conversely an a-state determines uniquely the set . Obviously, if and only if is true in for any literal .

In the following we will not distinguish sets of literals and a-states from each other. For example, Res) is nothing but Res which can be regarded as a set of literals. Analogically, we have notations and , which can be regarded as collections of sets of literals.

###### Definition 3.1

Let be a domain description without initial-knowledge propositions. Suppose are two sets of fluent literals. By we mean Here ini.

###### Remark 3.1
• The idea of the notation comes from programming verification where in the sense of total correctness means that any computation of starts in a state satisfying will terminates in a state satisfying . (see e.g. )

• By Lemma 2.2, if and only if is true in every a-state in .

Suppose is a general domain description (that is, initially-knowledge propositions are allowed). Let be the set of all non-initial-knowledge propositions of , and let . Then is equivalent to .

### 3.1 The Proof System PR0d for Knows

In the remainder of this section we fixed a domain description without initial-knowledge propositions. We always use to denote consistent set of fluent literals. The proof system PR consists of the following groups of axioms and rules 1-6.

AXIOM 1. (Empty)

 {X}[ ]{X}.

AXIOM 2. (Non-sensing Action)

 {X}a{(Res0(a,X))}.

Where is a non-sensing action 0-executable in .

RULE 3. (Sensing Action)

 {X∪X1}c{Y},⋯,{X∪Xm}c{Y}{X}a;c{Y}.

Where is a sensing action 0-executable in , and are all sets of fluent literals such that fln and is consistent.

RULE 4. (Case)

 φi⊆X,  {X}ci;c′{Y}{X}c;c′{Y}.

Where is the case plan case endcase.

RULE 5. (Composition)

 {X}c1{Y′},{Y′}c2{Y}{X}c1;c2{Y}.

RULE 6 (Consequence)

 X′⊆X,{X′}c{Y′},Y⊆Y′{X}c{Y}.
###### Definition 3.2

A proof sequence (or, derivation) of PR is a sequence such that each is either an axiom in PR or is obtained from some of by applying a rule in PR.

By , we mean that appears in some proof sequence of PR, that is, can be derived from axioms and rules in PR.

###### Example 3.1

() Let

 D:=⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩check determines alarm_offdefuse causes disarmed if alarm_offdefuse causes exploded if ¬alarm_offswitch causes ¬alarm_off if alarm_offswitch causes alarm_off if ¬alarm_offexecutable check if ¬explodedexecutable switch if ¬explodedexecutable defuse if ¬exploded⎫⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎬⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎭

Let be the case plan: case  and be the plan: . Then the following is a proof sequence of PR.

(1)
(AXIOM 2)

(2)
((1) and RULE 4)

(3)
(AXIOM 1)

(4)
((3) and RULE 4)

(5)
((2), (4) and RULE 3)

(6)
(AXIOM 2)

(7)
((6) and RULE 5)

###### Remark 3.2

One important observation is that constructing a proof sequence could also be considered as a procedure for generating plans. This feature is very useful for the agent to do so-called off-line planning [12, 5]. That is, when the agent is free from assigned tasks, she could continuously compute (short) proofs and store them into a well-maintained database. Such a database consists of a huge number of proofs of the form after certain amount of time. W.l.o.g., we may assume these proofs are stored into a graph, where , are nodes and is an connecting edge. With such a database, the agent could do on-line query quickly. Precisely speaking, asking whether a plan exists for leading state to , is equivalent to look for a path from to in the graph. This is known as the PATH problem and could be easily computed (NL-complete, see ).

#### 3.1.1 Soundness of PR0d

###### Theorem 3.1

(Soundness of PR) PR is sound. That is, for any conditional plan and any consistent sets of fluent literals, implies .

Proof: Suppose . Then has a derivation. We shall proceed by induction on the length of the derivation. Let and be 0-transition functions of . Please note that for any set of fluent literals, the 0-transition functions of are the same as and , respectively (see Remark 2.1).

1. Suppose is an axiom in AXIOM 1. Then and . Clearly, .

2. Suppose is an axiom in AXIOM 2, i.e., consists of only a non-sensing action which is 0-executable in , and . Since , it follows that .

3. Suppose is obtained by applying a rule in RULE 3. Then for some sensing action 0-executable in , and is obtained from , , , where are all sets of fluent literals such that fln and is consistent. By the induction hypothesis,

 D⊨0{X∪Xi}c1{Y},\ \ for i=1,⋯,m.

That is, all literals in are true in every set in . Please note that . By the definition of (see Definition 2.3),

 ˆΦ0(c,X)=m⋃i=1ˆΦ0(c1,X∪X′i).

Therefore, .

4. Suppose is obtained by applying a rule in RULE 4. That is, is a plan , where is a case plan such that for some , and has been derived. By the induction hypothesis, we have . By Definition 2.3, we have . Then, all literals of are true in . Thus, .

5. Suppose is obtained from and by applying a rule in RULE 5. By the inductive hypothesis,

 D⊨0{X}c1{Y′} and D⊨0{Y′}c2{Y}.

Then for any , we have (i.e., ). Thus, by Lemma 2.1, . Then

 ˆΦ0(c2,Y′)⪯⎛⎜⎝⋃S∈ˆΦ0(c1,X)ˆΦ0(c2,S)⎞⎟⎠=ˆΦ0(c,X),

It follows that .

6. Suppose is obtained by applying a rule in RULE 6. That is, there is and such that has been derived. Then by the induction hypothesis, all literals in is known to be true in , so are literals in . By Lemma 2.1 we have . Therefore, .

Altogether, we complete the proof.

#### 3.1.2 Completeness of PR0d

###### Theorem 3.2

(Completeness of PR) PR is complete. That is, for any conditional plan and any consistent sets of fluent literals, implies .

Proof: Suppose . We shall show . We shall proceed by induction on the structure of .

1. Suppose consists of only an action . Then is 0-executable in .

• Case 1. is a non-sensing action. Then all literals in are true in Res, that is, Res. By Axiom 2, . Then by RULE 6, we obtain .

• Case 2. is a sensing action. Consider any . We shall show . Suppose otherwise, then is still consistent. Then . Thus should also be true in every a-state in . On the other hand, is true in every a-state in since . This is a contradiction. Thus . Then for any set such that fln and is consistent, we have . Now applying RULE 3 we obtain .

2. Suppose is a case plan case endcase. Since , it follows that for some (otherwise, would not be 0-executable in ). Then . By the induction hypothesis,