VITAMIN: A Compositional Framework for

Model Checking of Multi-Agent Systems

Angelo Ferrando

1 a

and Vadim Malvone

2 b

University of Modena and Reggio Emilia, Italy

Telecom Paris, Institut Polytechnique de Paris, France

Keywords:

Formal Veriﬁcation, Model Checking, Multi-Agent Systems, Software Engineering.

Abstract:

The veriﬁcation of Multi-Agent Systems (MAS) poses a signiﬁcant challenge. Various approaches and

methodologies exist to address this challenge; however, tools that support them are not always readily avail-

able. Even when such tools are accessible, they tend to be hard-coded, lacking in compositionality, and

challenging to use due to a steep learning curve. In this paper, we introduce a methodology designed for the

formal veriﬁcation of MAS in a modular and versatile manner, along with an initial prototype, that we named

VITAMIN. Unlike existing veriﬁcation methodologies and frameworks for MAS, VITAMIN is constructed for

easy extension to accommodate various logics (for specifying the properties to verify) and models (for deter-

mining on what to verify such properties).

1 INTRODUCTION

Software and hardware systems are notoriously chal-

lenging to verify. This difﬁculty generally arises from

their complexity, making formalisation and proper

analysis arduous. At times, it is due to their size,

rendering exhaustive veriﬁcation impractical unless

appropriately abstracted or optimised (e.g., through

symbolic techniques). Regardless of the cause, for-

mally verifying software and hardware systems is a

complex task demanding deep expertise in formal

methods. Given that such expertise is often scarce,

formal veriﬁcation techniques ﬁnd limited usability in

real-world software and hardware development.

Moving from monolithic systems to Multi-Agent

Systems (MAS), formal veriﬁcation becomes even

more complex to achieve. In fact, the process of

testing (Nguyen et al., 2009), debugging (Winikoff,

2017), and verifying (Dennis et al., 2012) such sys-

tems can be quite complex. Solutions which make

the development more reliable are of uttermost im-

portance. Similar to the challenges mentioned for

monolithic systems, MASs encounter the same is-

sues in veriﬁcation. Moreover, as distributed systems

comprising intelligent and independent components

(the agents), their veriﬁcation becomes even more de-

https://orcid.org/0000-0002-8711-4670

https://orcid.org/0000-0001-6138-4229

manding. This is due to the fact that MAS properties

may rely on the rationality of the agents and on how

they interact with each other.

One signiﬁcant development in formal veriﬁca-

tion is Alternating-Time Temporal Logic (ATL) (Alur

et al., 2002), enabling reasoning about agents’ strate-

gies with temporal goals as payoff. However, ATL’s

implicit treatment of strategies limits its suitability for

certain concepts, leading to the introduction of more

powerful formalisms like Strategy Logic (SL) (Mo-

gavero et al., 2014). SL treats strategies as ﬁrst-order

objects, providing a richer framework for strategic

reasoning. While SL’s expressivity is high, it comes at

the cost of non-elementary complete model-checking

and undecidable satisﬁability (Mogavero et al., 2014).

To address this, fragments like Strategy Logic with

Simple-Goals (Belardinelli et al., 2019) have been

proposed, offering better computational properties

while still subsuming ATL. In the context of MAS,

considering agents’ visibility is crucial. The dis-

tinction between perfect and imperfect information

MAS impacts model-checking complexity, with im-

perfect information scenarios often modelled using

indistinguishability relations over MAS states (Reif,

1984). This distinction becomes particularly rele-

vant, for instance, in rendering ATL undecidable in

the context of imperfect information and memory-

ful strategies (Dima and Tiplea, 2011). To overcome

this problem, some works have either focused on

648

Ferrando, A. and Malvone, V.

VITAMIN: A Compositional Framework for Model Checking of Multi-Agent Systems.

DOI: 10.5220/0013349600003890

Paper published under CC license (CC BY-NC-ND 4.0)

In Proceedings of the 17th International Conference on Agents and Artiﬁcial Intelligence (ICAART 2025) - Volume 1, pages 648-655

ISBN: 978-989-758-737-5; ISSN: 2184-433X

an approximation to perfect information (Belardinelli

et al., 2023), developed notions of bounded memory

(Belardinelli et al., 2022), or developed hybrid tech-

niques (Ferrando and Malvone, 2022; Ferrando and

Malvone, 2023).

Even with strong theoretical foundations, the for-

mal veriﬁcation of MAS heavily depends on tools that

support such techniques. Notably, some tools stand

out as pillars in this ﬁeld, including MCMAS (Lomus-

cio et al., 2017) and STV (Kurpiewski et al., 2019).

MCMAS is recognized as one of the most widely

used model checkers for the strategic veriﬁcation of

multi-agent systems, primarily due to being one of

the earliest tools developed, which served as a foun-

dational proof-of-concept for researchers. Despite the

widespread use of MCMAS in the academic commu-

nity, it exhibits issues that hinder its broader adop-

tion, particularly outside the MAS research commu-

nity itself. Speciﬁcally, its veriﬁcation process is in-

herently hard-coded. In fact, even though MCMAS

has been extended in various ways, it lacks modular-

ity and does not allow a clear separation between dif-

ferent logics and models that causes maintainability

issues. That is, MCMAS lacks the capability of be-

ing transparently extended with new logics and mod-

els for the veriﬁcation of MASs. Furthermore, while

it does offer a graphical interface, users may ﬁnd its

execution challenging, as it requires additional tools,

such as Eclipse, for installation. Moreover, the tool

lacks comprehensive external documentation to assist

developers, and its internal documentation may prove

helpful only to those familiar with its original devel-

opment. It is important to acknowledge that the ob-

served limitations in MCMAS arise from its primary

function as a research tool dedicated to proving theo-

retical contributions. Regarding STV, it is designed to

address speciﬁc veriﬁcation goals in a predetermined

way. Consequently, the resulting tool lacks composi-

tional nature and only supports certain types of logics

and models for the MAS veriﬁcation. If users wish

to verify the MAS against different logics or mod-

els, such ﬂexibility is unavailable to them. Moreover,

the tool lacks comprehensive documentation to assist

users and developers. Additionally, both MCMAS

and STV require a strong background in formal meth-

ods, making them challenging for non-expert users to

employ them. In summary, although widely used and

with a history of successes, both MCMAS and STV

tend to lack modularity and usability.

These two aspects are the ones we decided

to tackle by engineering and developing a formal

veriﬁcation framework for MAS, called VITAMIN

(VerIﬁcaTion of A MultI-ageNt system), which aims

at being both highly compositional, in terms of the

Model

Logic

Model Checker

Interface

User

High-Level

Developer

High and

Low-Level

Developers

Expert

GUI

Non-Expert

GUI

High-Level

Developer

Figure 1: Architecture’s overview.

logic and model formalisms that can be employed,

and highly usable, in terms of the user experience

(from a developer and end-user side). The concept

behind our methodology is to generalise MAS ver-

iﬁcation without being tied to any speciﬁc logic or

model formalism. VITAMIN, even though still under

development, achieves compositionality through its

design, minimising assumptions about the types of

logics and models that can be employed. Its end-

user’s usability is enhanced through a user experi-

ence that guides the entire veriﬁcation process. It is

worth noting that, VITAMIN’s compositionality facili-

tates straightforward extension of its components by

external developers. We refrain from presenting ex-

perimental results for two primary reasons. Firstly,

an empirical evaluation would be beyond the scope

of our work, which focuses on the engineering of

VITAMIN and its foundational aspects. Secondly, due

to VITAMIN’s inherent compositionality, it can read-

ily accommodate the integration of both new and ex-

isting veriﬁcation techniques. Consequently, compar-

ing VITAMIN with existing veriﬁcation tools for MAS

would not be meaningful, as each tool would essen-

tially be compared, in theory, with itself.

2 VITAMIN: ARCHITECTURE

In this section, we focus on the engineering of our ap-

proach. To do so, we present an overview of the tool,

named VITAMIN, in Figure 1, showcasing its main

components. First and foremost, there is a clear sepa-

ration between the logics and models used in our ver-

iﬁcation methodology. This separation of concerns

is of paramount importance as it enables the tool to

evolve independently in both directions. The logics

and models should not be tied to each other, provid-

ing a more ﬂexible environment where different log-

ics can be veriﬁed on distinct models.

Another noteworthy aspect in Figure 1 is the pres-

VITAMIN: A Compositional Framework for Model Checking of Multi-Agent Systems

649

ence of an interface dedicated to handling the actual

formal veriﬁcation. Further details on this aspect are

discussed in the subsequent sections. It is crucial to

emphasise that, similar to the logics and models, the

veriﬁcation component foreseen in our methodology

is independent and highly compositional. As an il-

lustration, we can choose to verify ATL properties

on a Concurrent Game Structure (CGS) (Alur et al.,

2002), and such veriﬁcation can be executed in differ-

ent ways. For instance, we may opt for an explicit

veriﬁcation based on ﬁx-point (similar to what is done

in the case of CTL properties), or alternatively, sym-

bolically encode the model as a Binary Decision Di-

agram (BDD) and perform symbolic (i.e., implicit)

model checking, or ﬁnally, abstract the model to

cope with its complexity and perform the veriﬁca-

tion on the resulting abstracted model. These exam-

ples underscore how the actual veriﬁcation, consider-

ing a logic and a model, can be achieved in various

ways. Importantly, this aspect is kept separate from

the tool’s ecosystem to avoid hard-coding within it.

One additional aspect to note in Figure 1 is the

type of users envisioned in our approach. Rather

than the standard end-user, we assume the presence

of three user categories. The ﬁrst one corresponds to

what we commonly refer to as an end-user: a user

who utilises the veriﬁcation approach solely for ver-

ifying a MAS, without the intention or objective of

extending or modifying the tool itself. In addition to

the standard User, we envisage the access to two lev-

els of developer users: the High-Level Developer,

who concentrates on formal veriﬁcation aspects, and

the Low-Level Developer, who focuses on optimi-

sation and low-level implementation.

High-Level Developer users possess experi-

ence in model checking within MAS and are responsi-

ble for developing the Model and Logic components

and can develop the explicit veriﬁcation via Model

Checker Interface. They can achieve this by ex-

tending existing models and logics or by introducing

entirely new ones into the architecture. Importantly,

as each model in the Model component, each logic in

the Logic component, and each explicit veriﬁcation

algorithm in the Model Checker Interface com-

ponent is developed as an independent module, the

enrichment of these components with new modules

does not introduce errors into previously validated

modules. These developers are concerned with prop-

erly deﬁning and verifying the models and logics in

the system, without delving into the intricacies of cre-

ating high-performance software solutions.

The task of optimising such implementations is

undertaken by Low-Level Developer users who

possess expertise not only in model checking within

MAS but also in software engineering. They are re-

sponsible for enhancing the implementation provided

by High-Level Developers by leveraging optimi-

sation techniques, which can encompass both algo-

rithmic and data structure improvements. For ex-

ample, a High-Level Developer may propose a

logic and its veriﬁcation on an explicit model, and a

Low-Level Developer, starting from such an imple-

mentation, may offer an optimised solution based on

the veriﬁcation of an implicit model, such as BDDs.

To bridge the gap between these two types of

developers, we have introduced the Model Checker

Interface component in our methodology. This

component, developed by low-level developers, is in-

tended to be utilised by end-users and high-level de-

velopers to seamlessly use the optimisations.

Thanks to the presented architecture, the strengths

of our approach include: (Modularity) it allows

transparent extension without the need for core engine

modiﬁcations. (User-Friendlyness) it enables end-

users to use the software without requiring expertise

in formal veriﬁcation. (Distribution) the composi-

tionality of the veriﬁcation components enables their

distribution on different machines. (Documentation)

we prioritise the development of internal and external

documentation to assist users and developers in effec-

tively utilising and extending the tool.

3 VITAMIN: DETAIL ON THE

ARCHITECTURE MODULES

We now delve more into the details of the components

of the architecture behind our veriﬁcation methodol-

ogy. To help us present it, we present a diagram for

each of such components. Note that, the colours are

consistent with the ones used in Figure 1, which de-

tails the more general diagram of the architecture and

its components in a whole. Speciﬁcally, we can see

how the compositionality is achieved through hierar-

chical structures; where in the root we have the gen-

eral notion, and going deeper into the resulting hierar-

chy, we have various instantiations to serve different

veriﬁcation purposes.

3.1 Model

As illustrated in Figure 2, the model component

is structured hierarchically. At the root, we ﬁnd

the concept of a model, while further down in the

hierarchy, two crucial branches of system models

emerge: Monolithic and Multi-Agent. The for-

mer represents the standard model for software and

ICAART 2025 - 17th International Conference on Agents and Artiﬁcial Intelligence

650

Model

Monolithic

Multi-Agent

Kripke

Structure

Labelled

Transition System

Interpreted

System

Concurrent Game

Structure

...

Figure 2: Model component insights.

hardware systems, such as Kripke Structures (Chel-

las, 1980) and Labelled Transition Systems (Keller,

1976). These models are used to depict the behaviour

of centralised systems. However, such models typi-

cally do not account for the presence of autonomous

entities (such as agents) and lack a proper means

to characterise their independent and rational be-

haviours. To address this, the methodology supports

the notion of multi-agent models, including Concur-

rent Game Structures (CGSs) (Alur et al., 2002) and

Interpreted Systems (ISs) (Fagin et al., 1995).

It is worth noting that, we envision the possibil-

ity of further extending the structure of the hierarchy

for the model component. Nevertheless, in its initial

phase, we have chosen to consider the two most inﬂu-

ential and commonly used branches of models, par-

ticularly for specifying system behaviour (at least for

veriﬁcation purposes).

3.2 Logics

As depicted in Figure 3, an independent structure is

in place to manage the various logics available. The

necessity for such a hierarchy arises from the diverse

nature of the logics that can be employed for the

veriﬁcation of Multi-Agent Systems (MAS). Speciﬁ-

cally, in our methodology we distinguish between two

types of formalisms for denoting properties to be ver-

iﬁed: Temporal and Strategic. The former encom-

passes more standard temporal logics, such as Linear

Temporal Logic (LTL) (Pnueli, 1977) or Computation

Tree Logic (CTL) (Clarke and Emerson, 1981). The

latter involves more recent strategic logics, with ex-

amples including Alternating-Time Temporal Logic

(ATL) (Alur et al., 2002) or Strategy Logic (SL) (Mo-

gavero et al., 2014).

Given VITAMIN’s intrinsic compositional ap-

proach to handling logics, it allows for the addition

of branches in the hierarchy. However, in its initial

phase, we chose the two most studied and commonly

used branches of logics for veriﬁcation purposes.

Logic

Temporal

Strategic

Linear Temporal

Logic

Computation Tree

Logic

Alternating-time

Temporal Logic

Strategy

Logic

...

Figure 3: Logic component insights.

Model Checker

Interface

Temporal

Model Checker

Strategic

Model Checker

Linear Temporal

Logic

Computation Tree

Logic

Alternating-time

Temporal Logic

Strategy

Logic

...

Figure 4: Model Checker Interface insights.

3.3 Model Checker Interface

Once the model and logic are chosen, the next step in

our methodology is their veriﬁcation. This is obtained

through the Model Checker Interface, presented

in Figure 4. Notice that, each leaf of Figure 4 repre-

sents a meta-node that can be further decomposed as

shown in Figure 5 for the case of Strategy Logic.

To better comprehend the role of such a compo-

nent, it is noteworthy that our methodology incorpo-

rates a selection mechanism connected to the model

checker interface. This mechanism enables the choice

of the appropriate model checker usage, considering

the selected model and logic. The interface is conﬁg-

ured to analyse the model description and logical for-

mula, determining the class of model among a set of

predeﬁned model classes to which the model belongs

(Model component) and the class of logic among a set

of predeﬁned logic classes to which the formula be-

longs (Logic component). Then, given the model and

logic, the model checker interface selects the most ef-

ﬁcient veriﬁcation method. For instance, by assuming

the number of states as main parameter of the prob-

lem, the model checker interface could select an ex-

Strategy

Logic

Explicit MC

Implicit MC

Abstract MC

Figure 5: Meta-node for Strategy Logic.

VITAMIN: A Compositional Framework for Model Checking of Multi-Agent Systems

651

Expert User

Model

Specify

Formula

Specify

GUI

Non-Expert User

AI-guided modeling

Formula

NLP-based speciﬁcation

GUI

agents?

states?

actions?

Verify

Outcome

Parsing

Model

Parsing

Formula

Internal model

representation

Internal formula

representation

Model Checker

Selection

Which logic?Which model?

Model Checker

Interface

Temporal

Model Checker

Strategic

Model Checker

ATL

...

Actual veriﬁcation with

selected model checker

Model

Figure 6: Our methodology’s ﬂowchart for a ATL.

plicit method for models with less than ﬁfty states,

an implicit method for models with less than one-

hundred states, and an abstract method with more than

one-hundred states.

3.4 User Interface

Here, we focus on the way the end-user interacts with

VITAMIN. In VITAMIN, we categorise end-users based

on their knowledge of formal methods. Speciﬁcally,

we distinguish between Expert and Non-Expert

users. In both cases, being end-users of the system,

they would beneﬁt from a Graphical User Interface

(GUI) to guide them through the veriﬁcation.

In Figure 6, we present an ideal interaction ﬂow

for both types of users.

On the left, we depict the interaction involving an

expert user, which is more straightforward and direct.

Since the user is experienced with formal methods,

they can simply upload the corresponding ﬁles for the

model and formula through a GUI. These ﬁles must

be compatible with the format expected by the spe-

ciﬁc instantiation. Once these ﬁles are provided as

input, the veriﬁcation continues.

On the right, the interaction is guided, as the non-

expert user lacks experience with formal methods. To

address this, our methodology solicits details and in-

formation about the model and the formula. These

information can be gathered through a sequence of

questions to the user. For instance, the user may be

asked about the number of agents he/she thinks to

employ in the MAS, or, how many and which kind

of actions are available for such agents. These exam-

ples serve only as illustrations, demonstrating the sys-

tem’s potential to guide non-expert users. By follow-

ing such a constrained step-by-step process, a non-

expert user can interact in a more natural way. Once

information about the model is supplied, we may con-

tinue by seeking additional details about the formula.

The communication in this phase can also be handled

through natural language. Questions during this step

may inquire about the speciﬁc property of interest,

which might involve considering temporal informa-

tion. It is worth noting that this step is inspired by

what is commonly done in the FRET framework (Gi-

annakopoulou et al., 2020) (and similar ones), where

users can describe formal properties in a constrained

natural language, and it is the system’s responsibility

to generate the corresponding formal property in the

chosen formalism.

At the conclusion of the guided process, akin to

the expert user, the non-expert user can proceed with

the veriﬁcation steps illustrated in Figure 6. This pro-

cess begins with a parsing step, in which the model

and formula are parsed, leading to the creation of an

internal representation. Following the parsing step,

the veriﬁcation process advances with the selection of

an appropriate model checker to address the veriﬁca-

tion of the model against the given formula. Subse-

quently, the veriﬁcation result is returned to the user.

4 IMPLEMENTATION

In this section, we focus on the instantiation of

VITAMIN and what the tool currently supports.

VITAMIN is implemented in Python and its GUI is ac-

cessible through a web browser (https://vitamin-app.

streamlit.app/), which makes the tool cross-platform.

This accessibility is facilitated by utilising the

Streamlit

Python library, which supports the trans-

parent sharing of Python programs via HTTP proto-

col. Furthermore, the source code of the architec-

ture of VITAMIN can be found in https://github.com/

VITAMIN-organisation/VITAMIN-public. It is im-

portant to note that this repository contains only the

architecture, while the source codes of the individual

https://streamlit.io/

ICAART 2025 - 17th International Conference on Agents and Artiﬁcial Intelligence

652

modules are not publicly available. However, they can

be freely utilised through VITAMIN’s browser GUI. It

is worth mentioning that the actual implementation of

the modules is beyond the scope of this paper, as its

goal is to present the engineering and architecture of

the VITAMIN framework. As mentioned in the paper,

VITAMIN supports the interaction with both expert and

non-expert users.

4.1 Non-Expert User Experience

Figure 7 displays a screenshot of VITAMIN’s GUI

where the user is asked about the number of agents to

employ in the MAS to verify. In this speciﬁc exam-

ple, the user wants to create a MAS comprising two

agents, named A0 and A1.

Figure 7: VITAMIN asks the user for the agents of the MAS.

After the number of agents has been given to the

system, the process continues with the number of

states. As reported in Figure 8, the user inserts the

number of states he/she wishes to add to the MAS

model under analysis. In this speciﬁc case, the user

chooses to add four states, which are then named: S0,

S1, S2, and S3. Once both agents and states have been

collected, VITAMIN asks for the actions that the agents

can perform in the states. Figure 9 reports the step

where VITAMIN asks the user to assign the actions

to the agents created previously, in the states added

previously. In this speciﬁc scenario, the user decides

that the agents can perform three actions, which are

named: A, B, and C.

Now that the agents have actions to perform,

VITAMIN requires the user to specify which actions

can be performed by which agent in which state.

This process allows a natural deﬁnition of transitions

amongst states through agents’ actions. The transi-

tions are reported by the user through VITAMIN’s GUI.

In Figure 10, we report only a subset of A1’s transi-

tions to improve readability. In this speciﬁc scenario,

agent A1 can perform only action A in state S1 to move

to state S2, and actions B and C to move to state S3.

For the remaining transitions, both for A0 and A1, the

Figure 8: VITAMIN asks the user the states of the model.

Figure 9: VITAMIN asks the user for the agents’ actions.

reader can refer to Figure 11.

Figure 10: VITAMIN asks the user for transitions.

At this point, VITAMIN has all the information it

needs to represent the model graph created by the

user. To allow the user to validate the resulting model,

VITAMIN shows the graph result to the user, as re-

ported in Figure 11. VITAMIN supports the graphical

visualisation of the model and allows the user to vali-

date it before moving on in the veriﬁcation process.

Finally, given the model produced step-by-step by

guiding the user through all the details needed to pop-

ulate the model, VITAMIN can conclude the process by

asking the formula to verify on the obtained model.

Figure 12 reports the last step of the VITAMIN’s pro-

cess where the user can specify the formal property to

VITAMIN: A Compositional Framework for Model Checking of Multi-Agent Systems

653

Figure 11: VITAMIN displays the graph from the gathered

information for user validation.

verify on the model. In this speciﬁc case, the user de-

cides to specify an ATL formula and, in particular, to

verify whether the agents can reach state S3 by collab-

orating. Such a property is veriﬁed then by VITAMIN

and concluded as satisﬁed on the model of the MAS.

VITAMIN’s current instantiation requires the for-

mula to be speciﬁed, however, a step-by-step mech-

anism could be employed as well. Nonetheless, dif-

ferently from the model scenario, the formula may re-

quire additional engineering since it may largely de-

pend on the formalism chosen by the user.

Figure 12: VITAMIN asks the user for the formula to verify

on the previously constructed model of the MAS.

4.2 Expert User Experience

Here, we show how an expert user interacts with

VITAMIN. Speciﬁcally, this is achieved by the deﬁni-

tion of the model of the MAS and the formal property

the user wishes to verify. Differently from the non-

expert user, VITAMIN does not guide the expert user,

but it expects the model and formula as input.

VITAMIN is born to handle different types of mod-

els and logics. Due to its design, it is not lim-

ited to any speciﬁc model (resp., logic) since each

model (resp., logic) can be seen as an independent

component of the system. However, to give an ex-

ample, we show how to deﬁne a MAS model as a

CGS in VITAMIN. Figure 13 displays a screenshot of

VITAMIN’s GUI where the user can upload the CGS

of the MAS to verify. The model has to follow a spe-

ciﬁc format that has been chosen for the deﬁnition of

CGSs in VITAMIN. Naturally, because of their compo-

sitionality, these format choices are exclusive to how

VITAMIN handles CGSs and do not concern the de-

velopment of other formalisms for model representa-

tion. So, if VITAMIN supported Interpreted Systems

(like MCMAS), it would be free to choose the format

that best suits such models, without being concerned

about how CGSs are modelled, and vice versa.

Figure 13: Screenshot of VITAMIN’s GUI with an example.

Figure 14: Screenshot of VITAMIN’s GUI.

After the model has been uploaded by the user,

VITAMIN expects the formula to be veriﬁed on the lat-

ter. This step, similarly to the non-expert user sce-

nario, is obtained by letting the user ﬁll a ﬁeld box in

the VITAMIN’s GUI. Figure 14 displays a screenshot

of the GUI where the user ﬁlls the box with the for-

mula of interest to verify on the model. Once both the

model and formula are given, the veriﬁcation process

may start and the result of the veriﬁcation is returned

back to the user.

ICAART 2025 - 17th International Conference on Agents and Artiﬁcial Intelligence

654

5 CONCLUSIONS AND FUTURE

WORK

In this paper, we introduced VITAMIN, a compre-

hensive and versatile framework designed for model

checking of Multi-Agent Systems and beyond. Our

emphasis was on the engineering aspects and deci-

sions made during the development of VITAMIN.

We acknowledge that VITAMIN is an ongoing

project that will require additional reﬁnement, but

recognise that its current state already represents a

noteworthy advancement in the realm of tools for the

formal veriﬁcation of MAS. This is especially notable

given its potential for further study and extension, fa-

cilitated by its inherent compositionality.

Note that VITAMIN is currently in a prototype

stage. Certain aspects presented in this paper such as

Natural Language Processing (NLP) support for non-

expert users and the Model Checker Interface

part, are still in development. However, everything

related to veriﬁcation and compositional representa-

tion in VITAMIN has already been implemented and

tested across various scenarios, each highlighting dif-

ferent models and formulas for veriﬁcation.

Our future plans include the continued expansion

of VITAMIN, along with sharing it with the MAS

community. Additionally, we intend to present its

extensions in future research endeavours, exploring

possible instantiations of models and logics within

the tool. While this work has primarily focused on

VITAMIN’s engineering and architecture, future re-

search will delve into speciﬁc instantiations (of what

we called the VITAMIN’s components).

REFERENCES

Alur, R., Henzinger, T. A., and Kupferman, O. (2002).

Alternating-time temporal logic. J. ACM, 49(5):672–

713.

Belardinelli, F., Ferrando, A., and Malvone, V. (2023). An

abstraction-reﬁnement framework for verifying strate-

gic properties in multi-agent systems with imperfect

information. Artif. Intell., 316:103847.

Belardinelli, F., Jamroga, W., Kurpiewski, D., Malvone, V.,

and Murano, A. (2019). Strategy logic with simple

goals: Tractable reasoning about strategies. In IJCAI

2019, pages 88–94.

Belardinelli, F., Lomuscio, A., Malvone, V., and Yu, E.

(2022). Approximating perfect recall when model

checking strategic abilities: Theory and applications.

J. Artif. Intell. Res., 73:897–932.

Chellas, B. F. (1980). Modal Logic - An Introduction. Cam-

bridge University Press.

Clarke, E. M. and Emerson, E. A. (1981). Design and syn-

thesis of synchronization skeletons using branching-

time temporal logic. In Logics of Programs, pages

52–71.

Dennis, L. A., Fisher, M., Webster, M. P., and Bordini,

R. H. (2012). Model checking agent programming

languages. Autom. Softw. Eng., 19(1):5–63.

Dima, C. and Tiplea, F. L. (2011). Model-checking ATL un-

der imperfect information and perfect recall semantics

is undecidable. CoRR, abs/1102.4225.

Fagin, R., Halpern, J. Y., Moses, Y., and Vardi, M. Y.

(1995). Reasoning About Knowledge. MIT Press.

Ferrando, A. and Malvone, V. (2022). Towards the combi-

nation of model checking and runtime veriﬁcation on

multi-agent systems. In PAAMS, pages 140–152.

Ferrando, A. and Malvone, V. (2023). Towards the veriﬁca-

tion of strategic properties in multi-agent systems with

imperfect information. In AAMAS, pages 793–801.

Giannakopoulou, D., Pressburger, T., Mavridou, A., Rhein,

J., Schumann, J., and Shi, N. (2020). Formal require-

ments elicitation with FRET. In REFSQ.

Keller, R. M. (1976). Formal veriﬁcation of parallel pro-

grams. Commun. ACM, 19(7):371–384.

Kurpiewski, D., Jamroga, W., and Knapik, M. (2019). STV:

model checking for strategies under imperfect infor-

mation. In AAMAS, pages 2372–2374.

Lomuscio, A., Qu, H., and Raimondi, F. (2017). MC-

MAS: an open-source model checker for the veriﬁca-

tion of multi-agent systems. Int. J. Softw. Tools Tech-

nol. Transf., 19(1):9–30.

Mogavero, F., Murano, A., Perelli, G., and Vardi, M. Y.

(2014). Reasoning about strategies: On the model-

checking problem. ACM Trans. Comput. Log.,

15(4):34:1–34:47.

Nguyen, C. D., Perini, A., Bernon, C., Pav

on, J., and

Thangarajah, J. (2009). Testing in multi-agent sys-

tems. In AOSE, pages 180–190.

Pnueli, A. (1977). The temporal logic of programs. In

FOCS, pages 46–57.

Reif, J. H. (1984). The complexity of two-player games

of incomplete information. J. Comput. Syst. Sci.,

29(2):274–301.

Winikoff, M. (2017). Debugging agent programs with

why?: Questions. In AAMAS, pages 251–259.

VITAMIN: A Compositional Framework for Model Checking of Multi-Agent Systems

655