1 Introduction
Planning refers to the procedure of finding a sequence of actions(i.e., a plan
) which leads a possible world from an initial state to a goal. In the early days of Artificial Intelligence(AI), an agent(i.e., plan generator or executor) was assumed to have complete knowledge about the world but it turned out to be unrealistic. Therefore, planning under
incomplete knowledge earns a lot of attention since late 1990s [15, 6, 22, 10, 19, 17]. A widely accepted solution is to equip the planner with actions for producing knowledge, also called sensing actions, and allow to use conditional plan[10, 24, 25, 23, 16], i.e., plans containing conditional expressions (e.g., IfThenElse structures).Consider the following example [24], say a bomb can only be safely defused if its alarm is switched off. Flipping the switch causes the alarm off if it is on and vice versa. At the beginning we only know the bomb is not disarmed and not exploded, however, we do not know whether or not the alarm is on, i.e., the knowledge about initial state of the domain is incomplete. An agent could correctly defuse the bomb by performing the conditional plan below:
in which is a sensing action that produces the knowledge about the alarm. It is necessary to mention that there exists no feasible classical plans for this scenario, e.g., neither nor could safely disarm the bomb.
To describe and reason about domains with incomplete knowledge, a number of logical frameworks were proposed in the literature. One of wellestablished formalizations is the action language [24, 4]. In contrast to its first order antecedents [15, 22], possesses a natural syntax and a transition function based semantics, both together provides a flexible mechanism to model the change of an agent’s knowledge in a simplified Kripke structure.
In [24] the authors propose several semantics for , all of which, roughly speaking, are based on some transition function from pairs of actions and initial states to states. For convenience we use SBsemantics to denote the semantics based on the transition function which maps pairs of actions and cstates to cstates. Here, a cstate is a pair of a world state and a knowledge state which is a set of world states. One of the results in [4] is that the polynomial plan existence problem under SBsemantics is PSPACEcomplete. Even we restrict the number of fluents determined by a sensing action, the existence of polynomial plan with limited number sensing actions is complete [4]. To overcome the high complexity, Baral and Son [24] have proposed approximations, . It has been proved in [4] that under some restricted conditions polynomial plan existence problem under 0approximation is NPcomplete, that is, it is still intractable because it is widely believed that there is no polynomial algorithm solving an NPcomplete problem.
Although modern planers are quite successful to produce and verify short plans they still face a great challenge to generate longer plans. There have been many efforts to construct transformations from planning or plan verification to other logic formalisms, for example, firstorder logic (FOL) [11, 9, 24], propositional satisfiability (SAT) [20], QBF satisfiability (QSAT), [18, 14], nonmonotonic logics [7, 3, 13], and so on. These approaches provide ways to use existing solvers for planning and plan verification, they do not, however, tell us how to generate and verify new plans from old ones.
It is well known that programming is generally also very hard, however, proof system for program verification allows one to construct new correct programs from shorter ones [1]. Similarly, proof systems for plan verification would be helpful for verifying and constructing longer correct plans.
For a given domain description , two sets of fluent literals, and a plan , we consider the verification problem of determining whether , that is, whether all literals of becomes true after executing in any initial state in which all literals of are true. It seems natural that from and we should obtain . That is,
should be a valid rule. This paper is devoted to develop a sound and complete proof system for plan verification under 0approximation.
One important observation is that constructing proof sequences could also be considered as a procedure for generating plans. This feature is very useful for the agent to do socalled offline planning [12, 5]. That is, when the agent is free from assigned tasks, she could continuously compute (short) proofs and store them into a wellmaintained database. Such a database consists of a huge number of proofs of the form after certain amount of time. W.l.o.g., we may assume these proofs are stored into a graph, where , are nodes and is an connecting edge. With such a database, the agent could do online query quickly. Precisely speaking, asking whether a plan exists for leading state to , is equivalent to look for a path from to in the graph. This is known as the PATH problem and could be easily computed (NLcomplete, see [21]).
The paper is organized as follows. In Section 2 we mainly recall the language of and the 0approximation semantics. In addition, a few new lemmas are proved, which will be used in later sections. Section 3 is devoted to the construction of proof system. Soundness and completeness are proved. Section 4 concludes this paper.
2 The Language
The language [24] proposed by Baral & Son is a well known framework for reasoning about sensing actions and conditional planning. In this section we recall the syntax and the 0approximation semantics of , in addition we prove several new properties (e.g. the monotonicity of 0transition function, see Lemma 2.1 below) which will be used in next section.
2.1 Syntax of
Two disjoint nonempty sets of symbols, called fluent names (or fluents) and action names (or actions) are introduced as the alphabet of the language . A fluent literal is either a fluent or its negation . For a fluent , by we mean . For a fluent literal , we define fln if is a fluent or is . Given a set of fluent literals, is defined as , and fln() is defined as .
The language uses four kinds propositions for describing a domain.
An initialknowledge proposition (which is called vproposition in [24]) is an expression of the form
(1) 
where is a fluent literal. Roughly speaking, the above proposition says that is initially known to be true.
An effect proposition (efproposition for short) is an expression of the form
(2) 
where is an action and , are fluent literals. We say and are the effect and the precondition of the proposition, respectively. The intuitive meaning of the above proposition is that is guaranteed to be true after the execution of action in any state of the world where are true. If the precondition is empty then we drop the if part and simply say: causes .
An executability proposition (exproposition for short) is an expression of the form
(3) 
where is an action and are fluent literals. Intuitively, it says that the action is executable whenever are true. For convenience, we call the expreconditions of the proposition.
A knowledge proposition (kproposition for short) is of the form
(4) 
where is an action and is a fluent. Intuitively, the above proposition says that after is executed the agent will know whether is true or false.
A proposition is either an initialknowledge proposition, or an efproposition, or an exproposition, or a kproposition. Two initialknowledge propositions initially and initially are called contradictory if . Two effect propositions “ causes if ” and “ causes if ” are called contradictory if and is empty.
Definition 2.1
([24]) A domain description in is a set of propositions which does not contain
(1) contradictory initialknowledge propositions,
(2) contradictory efpropositions
Actions occurring in knowledge propositions are called sensing actions, while actions occurring in effect propositions are called nonsensing actions. In this paper we request that for any domain description the set of sensing actions in and the set of nonsensing actions in should be disjoint.
Definition 2.2
(Conditional Plan [24]) A conditional plan is inductively defined as follows:

The empty sequence of actions, denoted by , is a conditional plan;

If is an action then is a conditional plan;

If and are conditional plans then the combination is a conditional plan;

If () are conditional plans and are conjunctions of fluent literals (which are mutually exclusive but not necessarily exhaustive) then the following is a conditional plan (also called a case plan):

Nothing else is a conditional plan.
Propositions are used to describe a domain, whereas queries are used to ask questions about the domain. For a plan , a set of fluent literals, and a fluent literal , we have two kinds of queries:
(5) 
(6) 
Intuitively, query of the form (5) asks whether all literals in will be known to be true after executing , while query of the form (6) asks whether will be either known to be true or known to be false after executing .
2.2 0Approximation Semantics
In this section we arbitrarily fix a domain description without contradictory propositions. From now on when we speak of fluent names and action names we mean that they occur in propositions of .
According to [24], an astate is a pair of two disjoint sets of fluent names. A fluent is true (resp. false) in if (resp. ). Dually, is true (resp. false) if is false (resp. true). For a fluent name outside , both and are unknown. A fluent literal is called possibly true if it is not false (i.e., true or unknown). In the following we often use , to denote astates. For a set of fluent literals, we say is true in an astate if and only if every is true in , .
An action is said to be 0executable in an astate if there exists an exproposition executable if , such that are true in . The following notations were introduced in [24].

(1) is a fluent and there exists “ causes if ” in such that are true in .

(2) is a fluent and there exists “ causes if ” in such that are true in .

(3) is a fluent and there exists “ causes if ” in such that possibly true in .

(4) is a fluent and there exists “ causes if ” in such that are possible true in .

(5) is a fluent and “ determines ” is in .
For an asate and a nonsensing action 0executable in , the result after executing is defined as
The extension order on astates is defined as follows [24]:
Please note that if then for a fluent literal we have

if is true (resp. false) in then is true (resp. false) in ,

if is unknown in then must be unknown in , and

if is possibly true in then is possibly true in .
Consequently, for any nonsensing action and astates and such that and is 0executable in , we have

is 0executable in .

, and .

, and .
Then we have the following proposition.
Proposition 2.1
For any nonsensing action and astates and such that and is 0executable in , we have
The 0transition function of is defined as follows [24].

If is not 0executable in , then .

If is 0executable in and is a nonsensing action, .

If is 0executable in and is a sensing action, then .

.
Let be two sets of astates, we write if for every astate in , there is an astate in such that .
The next proposition follows directly from Proposition 2.1. and the definition of above.
Proposition 2.2
Suppose and is an action 0executable in , then .
The extended 0transition function , which maps pairs of conditional plans and astates into sets of astates, is defined inductively as follows.
Definition 2.3
Remark 2.1
From the definitions above we know that transition functions and of a domain description do not depends on any initialknowledge proposition. In other words, if two domain descriptions and contain the same non initialknowledge propositions, then their transition functions coincide.
A condition plan is 0executable in if .
Lemma 2.1
(Monotonicity Lemma) Let be a plan, be two sets of astates. Suppose , and is 0executable in every astate on . Then .
Proof: We proceed by induction on the structure of the plan .

Suppose consists of only an action . Consider an arbitrary astate . Then there is an astate such that . Since , pick such that . It is sufficient to show that for some .
If is a nonsensing action , then the assertion follows directly from Proposition 2.2. Suppose is a sensing action. Then must be of the form because is a sensing action, here . Then clearly must be in . The assertion follows since .

Suppose is case plan case . endcase. Consider any astate . Let be such that and . Since is 0executable in , some is true in . Then is also true in since . Then by the induction hypothesis, . Thus, there is such that . Consequently,

Suppose . By induction hypothesis . Then by the definition of we have
An astate is called an initial astate of if is true in for any fluent literal such that the initialknowledge proposition “initially ” is in .
Suppose is a domain description, is a conditional plan, is a set of fluent literals, and a literals. The semantics for the queries are given below:
Definition 2.4
([24])

if for every initial astate , the plan is 0executable in , and is true in every astate in .

if for every initial astate , the plan is 0executable in , and is either true or false in every astate in .
Let , . Obviously, is the least initial astate of , that is, for any initial astate . The following lemma follows easily from Lemma 2.1.
Lemma 2.2

if and only if the plan is 0executable in , and true true in every astate in .

if the plan is 0executable in , and is either true or false in every astate in .
3 A Proof System for 0Approximation
A consistent set of literals determines a unique astate by and . And conversely an astate determines uniquely the set . Obviously, if and only if is true in for any literal .
In the following we will not distinguish sets of literals and astates from each other. For example, Res) is nothing but Res which can be regarded as a set of literals. Analogically, we have notations and , which can be regarded as collections of sets of literals.
Definition 3.1
Let be a domain description without initialknowledge propositions. Suppose are two sets of fluent literals. By we mean Here ini.
Remark 3.1
Suppose is a general domain description (that is, initiallyknowledge propositions are allowed). Let be the set of all noninitialknowledge propositions of , and let . Then is equivalent to .
3.1 The Proof System PR for Knows
In the remainder of this section we fixed a domain description without initialknowledge propositions. We always use to denote consistent set of fluent literals. The proof system PR consists of the following groups of axioms and rules 16.

AXIOM 1. (Empty)

AXIOM 2. (Nonsensing Action)
Where is a nonsensing action 0executable in .

RULE 3. (Sensing Action)
Where is a sensing action 0executable in , and are all sets of fluent literals such that fln and is consistent.

RULE 4. (Case)
Where is the case plan case . endcase.

RULE 5. (Composition)

RULE 6 (Consequence)
Definition 3.2
A proof sequence (or, derivation) of PR is a sequence such that each is either an axiom in PR or is obtained from some of by applying a rule in PR.
By , we mean that appears in some proof sequence of PR, that is, can be derived from axioms and rules in PR.
Example 3.1
([24]) Let
Let be the case plan: case and be the plan: . Then the following is a proof sequence of PR.

(1)
(AXIOM 2) 
(2)
((1) and RULE 4) 
(3)
(AXIOM 1) 
(4)
((3) and RULE 4) 
(5)
((2), (4) and RULE 3) 
(6)
(AXIOM 2) 
(7)
((6) and RULE 5)
Remark 3.2
One important observation is that constructing a proof sequence could also be considered as a procedure for generating plans. This feature is very useful for the agent to do socalled offline planning [12, 5]. That is, when the agent is free from assigned tasks, she could continuously compute (short) proofs and store them into a wellmaintained database. Such a database consists of a huge number of proofs of the form after certain amount of time. W.l.o.g., we may assume these proofs are stored into a graph, where , are nodes and is an connecting edge. With such a database, the agent could do online query quickly. Precisely speaking, asking whether a plan exists for leading state to , is equivalent to look for a path from to in the graph. This is known as the PATH problem and could be easily computed (NLcomplete, see [21]).
3.1.1 Soundness of PR
Theorem 3.1
(Soundness of PR) PR is sound. That is, for any conditional plan and any consistent sets of fluent literals, implies .
Proof: Suppose . Then has a derivation. We shall proceed by induction on the length of the derivation. Let and be 0transition functions of . Please note that for any set of fluent literals, the 0transition functions of are the same as and , respectively (see Remark 2.1).

Suppose is an axiom in AXIOM 1. Then and . Clearly, .

Suppose is an axiom in AXIOM 2, i.e., consists of only a nonsensing action which is 0executable in , and . Since , it follows that .

Suppose is obtained by applying a rule in RULE 3. Then for some sensing action 0executable in , and is obtained from , , , where are all sets of fluent literals such that fln and is consistent. By the induction hypothesis,
That is, all literals in are true in every set in . Please note that . By the definition of (see Definition 2.3),
Therefore, .

Suppose is obtained by applying a rule in RULE 4. That is, is a plan , where is a case plan such that for some , and has been derived. By the induction hypothesis, we have . By Definition 2.3, we have . Then, all literals of are true in . Thus, .

Suppose is obtained from and by applying a rule in RULE 5. By the inductive hypothesis,

Suppose is obtained by applying a rule in RULE 6. That is, there is and such that has been derived. Then by the induction hypothesis, all literals in is known to be true in , so are literals in . By Lemma 2.1 we have . Therefore, .
Altogether, we complete the proof.
3.1.2 Completeness of PR
Theorem 3.2
(Completeness of PR) PR is complete. That is, for any conditional plan and any consistent sets of fluent literals, implies .
Proof: Suppose . We shall show . We shall proceed by induction on the structure of .

Suppose consists of only an action . Then is 0executable in .

Case 1. is a nonsensing action. Then all literals in are true in Res, that is, Res. By Axiom 2, . Then by RULE 6, we obtain .

Case 2. is a sensing action. Consider any . We shall show . Suppose otherwise, then is still consistent. Then . Thus should also be true in every astate in . On the other hand, is true in every astate in since . This is a contradiction. Thus . Then for any set such that fln and is consistent, we have . Now applying RULE 3 we obtain .


Suppose is a case plan case . endcase. Since , it follows that for some (otherwise, would not be 0executable in ). Then . By the induction hypothesis,
Comments
There are no comments yet.