On the Role of Formal Analysis Tools for Engineering the Environment of Self-Organising Multi-Agent Systems

In this article, we focus on the role of the environment in a self-organising system and how to apply self-organisation principles to build a multi-agent system (MAS) environment. We discuss a design methodology for complex systems with emergent properties: our approach mainly relies on the use of formal analysis tools and languages in order to provide better guarantees of effective global system behaviour. In order to explain the details of the methodology, we analyse a case of dynamic resource allocation strategy for a MAS environment. 1 Self-Organisation and MAS Environment The typical MAS scenario involves a set of autonomous situated entities able to interact with each other and the environment in order to achieve a common goal: as pointed out in [1], since agents are limited in capabilities, they cannot control, neither completely perceive, the global dynamics of the system. On the other hand, self-organising systems (SOSs) are systems composed of entities with such a partial control, and which locally interact in order to create or maintain an ordered structure under environment perturbations: in these systems—due to the intricacy of interactions—it may happen that global phenomena emerge [2]. The MAS community started considering self-organisation theory as an inspiration for system development only in the last few years, specifically since the first applications inspired by ants behaviour. Since then, several related initiatives flourished such as Amorphous Computing [3] and Autonomic Computing [4]. In this article we focus on the idea that the environment is the key element in the engineering of a MAS featuring self-organising properties. In the definition of self-organising system there is a crucial aspect which is sometime underestimated: “under environment perturbations” means that the environment plays an active role, which may be interpreted as hostile due to the fact that it perturbs agent situation. Typically, agents have to learn—by evolution or other mechanisms—how to reduce the possibly disrupting effect of the environment: for example flocking reduces wind friction, while schooling let fishes avoid predators [2]. Indeed, it is the agent-environment coupling that creates the feedback loop, balancing between positive and negative feedback [2]. Furthermore, the environment can also be seen as a collective memory used for self-organisation purposes, as it can be designed to retain the history of the actions of the agents [5]. Consider e.g. pheromone trails in ant colonies, where the environment collects the pheromone laid by the ants, performing aggregation, diffusion and evaporation processes. Self-organising is hence considered as “reducing agent complexity”, for some part of complexity is delegated to—i.e. is hidden into—the environment. A dual aspect is that environment design may benefit from using self-organisation principles. In general, it is desirable that a software system self-configures and automatically recovers from errors, i.e. that it adopts self-healing—a basic principle of Autonomic Computing [4]. The environment in general might exploit self-organising techniques for the management of services to agents: for example, in this article we describe a case of dynamic resource allocation, though other applications such as security [6, 7] could be used. As far as engineering the environment is relevant in the development of selforganising MAS, in this paper we focus on methodological aspects. We note that currently no AOSE methodologies—see e.g. Gaia [8] and SODA—take into account self-organisation issues. The few exceptions, such as ADELFE [9], still do not promote any kind of practice in order to guarantee effectiveness of global system properties. For example, how can we design the environment features of a MAS exploiting stigmergic-coordination so as to guarantee that the agents will eventually find a path between the source and the target location? Based on initial explorations we developed in [10, 7], our goal here is to outline a methodological approach to address this kind of questions. 2 Towards a Methodology for Designing Self-Organising Systems Our approach plugs into the design stage of system development, and can be possibly used in combination with existing methodologies—future works in this context will pursue this research line. The first observation is that it is not very clear—both for agent-based and traditional methodologies—how the deliverable of the analysis process maps onto a specific design. There is often an early design stage where several approaches have to be evaluated, for example making preliminary feasibility tests: in this stage we do not want to deal with all the details of a complete design. The first step of our approach occurs in this stage: we use formal languages to specify abstract models of possible architectural solutions, in order to nurture evolving ideas. Specifically, in the case of self-organising systems where complex patterns arise from low level interaction, selective models can make us focus on the most crucial properties of interest. The use of formal languages for this scope has several advantages like unambiguity and precise selection of the subsystem to model, as well as opening to the possibility of using general purpose tools to perform automatic analysis. These formal models are then used in the second stage to generate simulation runs, where expected behaviours of the system are previewed and analysed. Simulation is a very useful tool to provide a first feedback on the suitability of a solution: if the simulation results are not satisfying another approach can be tested or some parameter can be adjusted—i.e. we go back to the first phase until we get useful results. Though it is widely believed that simulations may be the only tool to investigate self-organising systems and emergent phenomena, we observe that from an engineering point of view they do not provide true guarantees: the actual system might in some specific cases exhibit completely different behaviours. In spite simulation is a valuable tool both to observe qualitative behaviours and provide a coarse set of system parameters, we also see potentialities in formal analysis tools. Indeed, in the third stage we thus envision the use of model checking tools to verify system properties [11], and specifically emergent ones. The model checking process involves both system specifications and statements about the properties to verify: these elements are used by the model checker to explore the states space of the target system in order to test if the statements hold [11]. These statements might be expressed in several formalisms and affect the model checking algorithm: in common languages we can express statements such as “will deadlock eventually occur in the system?”. Traditional model checking algorithms deal only with finite state deterministic systems [11], which are apparently not good approximations for a selforganising system. However, it is often possible to constrain the state space, or to apply abstraction techniques to see a syntactically infinite system as a semantically finite one [12]. Moreover, model checking algorithms exist that are able to handle probabilistic systems [13]: in this model it is possible to express statements such as “is there a probability greater than 50% that the property X will eventually occur ?”. Other examples also consider time, and can deal with statements like “will the system reach the state S within 5 seconds with a probability greater than 90% ?”. As far as self-organising systems are concerned, good models of system behaviour should be able to describe stochastic phenomena, i.e. phenomena which duration and/or execution time is aleatory. Sometimes, stochasticity is inherent to the problem subject to investigation and cannot be abstracted away: for example the time to execute an agent’s action could be an aleatory variable. In general, emergence of properties appears to be intrinsically related to stochasticity, hence, we would like to investigate how it may affect the way to model check emergent system properties. At the end of this investigation we would like to be able to answer questions such as “will the emergent property X occur in the system within 5 minutes with a probability greater than 95% ?”. Answering that kind of statements will help us to better understand the dynamics of selforganising systems and improve the design and engineering process of modern complex systems. Applying forthcoming research results in the context of model checking for stochastic systems is hence an important part of our research. 3 Designing a MAS Environment In this section we describe an example application of this approach, whose simplicity should help focussing on the most relevant details. We want to deploy a MAS, where agents can exploit resources provided by the environment. Due to scalability and quality of service issues, we would like the environment to adaptively allocate resources depending on the number of requests. Hence, the objective is to design a dynamic resource allocation (DRA) strategy. From Section 2, we recall that the first stage is about formalising candidate solutions without providing all the details of a real design. Since the number of agents inside the system is an aleatory variable, any scheduling algorithm which makes assumptions about the number of agents cannot be applied. A simple strategy that promotes a self-organising style is such that: (i) each resource that receives a request clones itself, (ii) after an arbitrary idle time the resource is deallocated. We can now model the above strategy using a formal language like π-calculus—as we already did in [7]—or any other formal language that suits the requirements listed in Section 2: in particular we use the Maude tool [14] because it eventually supports our approach at each stage. A formal model enable investigation by simulating system dynamics. Having analysed the simulation results for several parameters values, we found three qualitative behaviours: (i) insufficiency of resources, (ii) dynamic equilibrium and (iii) redundancy of resources. In particular, the second one adapts the resource number to the actual number of agents: if the arrival rate of agents is constant, we observe a periodical evolution of the number of agents to be served and the number of free resources, see Figure 1. Notice that the dynamic equilibrium condition is an emergent property of the system! From the first two stages we have a formal model of the strategy, we have analysed simulation results providing evidence of a qualitative behaviour, and we have devised a coarse set of parameters to tune the system. The third stage would be to about giving guarantees of the observed behaviour, i.e. verifying properties of the system via model checking: this is very important, since the system includes stochastic phenomena and each simulation run is different. Referring to the DRA strategy, an interesting property to verify might be “will the number of free resources lie in the range (A,B) with a probability greater than 95% ?”: this statement assumes that the parameters are tuned in order to have a dynamic equilibrium condition and the range is adjusted according to the parameters values. If this condition is verified, we have stronger guarantees—with respect to simulations results—that the system 1 For the sake of clarity, in this example we consider only a single kind of resource and abstract away the inner working details. 2 Details about the use of Maude and the model specifications will be provided in the extended version of the article. 0 20 40 60 80 100 120