CRISNER: A Practically Efficient Reasoner for Qualitative Preferences
Abstract
We present CRISNER (Conditional & Relative Importance Statement Network PrEference Reasoner), a tool that provides practically efficient as well as exact reasoning about qualitative preferences in popular ceteris paribus preference languages such as CPnets, TCPnets, CPtheories, etc. The tool uses a model checking engine to translate preference specifications and queries into appropriate Kripke models and verifiable properties over them respectively. The distinguishing features of the tool are: (1) exact and provably correct query answering for testing dominance, consistency with respect to a preference specification, and testing equivalence and subsumption of two sets of preferences; (2) automatic generation of proofs evidencing the correctness of answer produced by CRISNER to any of the above queries; (3) XML inputs and outputs that make it portable and pluggable into other applications. We also describe the extensible architecture of CRISNER, which can be extended to new preference formalisms based on ceteris paribus semantics that may be developed in the future.
Keywords:
Qualitative Preferences, Tool, CPnet, Model Checking1 Introduction
Several qualitative preference reasoning languages have been developed in the last two decades, such as CPnets, TCPnets, CPTheories, etc. Despite their relatively high expressive power (compared to quantitative preference formalisms), their widespread application and use in practice is limited, at least in part due to their hardness. The basic reasoning tasks such as dominance and consistency testing are known to be PSPACEcomplete for a simple language such as the CPnet. Another reasoning task, checking whether the equivalence or subsumption of the preferences induced by one agent with respect to those induced by another, is important in multiagent scenarios and negotiation but also known to be hard [17]. Past works to cope with this hardness include restricting the expressivity of the languages to obtain tractable fragments, and heuristics that yield results in acceptable time but not guaranteed to be exactly correct. Nevertheless, there are applications such as negotiation, planning, security policies, etc. that call for exact reasoning about qualitative preferences with guarantees of correctness (e.g., choosing the best policy to defend a computer network).
In this paper, we present CRISNER (Conditional & Relative Importance Statement Network PrEference Reasoner) [14], a tool that provides practically efficient as well as exact reasoning about qualitative preferences in popular ceteris paribus^{1}^{1}1Ceteris paribus is a Latin term for “all else being equal”. [10] preference languages such as CPnets, TCPnets and CPtheories. For a preference specification consisting of a set of qualitative preference statements in any of the above CPlanguages^{2}^{2}2Henceforth, we will refer to the languages CPnets, TCPnets and CPtheories collectively as ‘CPlanguages’ for brevity., the ceteris paribus semantics for dominance, consistency etc. are given in terms of reachability over an induced preference graph wherein each node corresponds to an outcome and each edge from one node to another represents a preference from the latter node to the former node induced by some statement in . CRISNER uses a model checking [8] engine NuSMV [6] to translate preference specifications and queries into appropriate Kripke structure models [11] and reachability properties over them respectively.
Encoding Preferences as Kripke models. Given a specification , CRISNER first succinctly encodes the induced preference graph (IPG) of into a Kripke structure model in the language of the NuSMV model checker. Although Kripke structures are typically used to represent semantics of temporal and modal logics, we leverage earlier work [15, 12] that demonstrated their use for encoding preference semantics. For testing dominance and consistency with respect to each , CRISNER generates the model only once. Subsequently for each preference query posed against , CRISNER translates into a temporal logic formula in computationtree temporal logic (CTL) [13, 7] such that if and only if holds true according to the ceteris paribus semantics of . CRISNER then queries the model checker with the model and which either affirms or returns false with a counterexample. For answering queries related to equivalence and subsumption checking of two sets of preferences and , CRISNER constructs a combined IPG and uses temporal queries in CTL to identify whether every dominance that holds in also holds in and viceversa [17].
Justification of Query Answers. The answers to queries computed by CRISNER are exact and provably correct for dominance, consistency, equivalence and subsumption queries. Because CRISNER uses the model checker for answering queries, CRISNER is also able to provide proofs or justifications to queries that returned false. CRISNER automatically builds proofs evidencing why the query did not hold true, by collecting and examining the model checker’s counterexample and producing a sequence of preference statements whose application proves the correctness of CRISNER’s result.
Tool Architecture. CRISNER is developed in pure Java and is domain agnostic in the sense that any set of variables with any domain can be included in a preference specification, although it is optimized for variables with binary domains. It accepts preference specifications and queries in a XML format, which provides a common and generic syntax using which users can specify preferences for CPlanguages. The results (answers and proofs) for the corresponding queries are also saved in the form XML, so that the results can be further transformed into vocabulary that is more easily understandable by domain users. We describe the architecture of CRISNER and how it can be extended to other ceteris paribus preference formalisms that may be developed in the future.
CRISNER has been in development for over two years, and to our knowledge, CRISNER is one of the first attempts to develop practical tools for hard qualitative preference reasoning problems. We hope that CRISNER inspires the use of qualitative preference formalisms in practical real world applications, and the development of further qualitative preference languages.
2 Background: Syntax and Semantics of CPlanguages
Let be a set of preference variables or attributes. For each let be the set of possible values (i.e., domain) such that is a valid assignment to the variable . We use (indexed, subscripted or superscripted as necessary) to denote subsets of . The set of assignments to variables in is the set of alternatives. The valuation of an alternative with respect to a variable is denoted by .
2.1 Preference Relations, Statements & Specifications
Given a set of alternatives, a direct specification of a binary preference relation over is difficult, as it requires the user to compare up to pairs of alternatives, which is prohibitive in time. Hence, many preference languages allow for succinct specification of the preference relation over alternatives in terms of preference relations over the set of attributes that describe the alternatives and their respective valuations or domains.
Preference Relations
Qualitative preference relations can be either (a) intravariable preference relations over valuations of an attribute; or (b) relative importance preference relations over attributes. For any , we will use the notation to denote a preference relation over , the set of partial assignments to attributes in . For a single attribute , the intraattribute preference relation over its valuations () will be denoted by or alternatively . For example, to formally specify that the valuation is preferred to the valuation for attribute where , we will write . We will use the notation to indicate relative importance between attributes or between sets of attributes.
Preference Specifications & Statements
In the CPlanguages, preferences are expressed in terms of a preference specification, which is a set of preference statements. Each statement may specify a binary relation over the set of preference variables (relative importance) and/or a binary relation over the domain of a particular variable (intravariable preference). The syntax of the preference statements is given below.
CPnets [2, 9] allow the specification of only conditional intravariable preferences^{3}^{3}3We use the term CPnets to refer to the more general formalism defined by Goldsmith et al. [9].; TCPnets [5] allow the users to specify pairwise relative importance among variables in addition to conditional intravariable preferences as in CPnets. CPTheories [19] extend TCPnets by further allowing the specification of the relative importance of one variable over a set of variables conditioned on another set of variables. As CPtheories strictly generalize CPnets and TCPnets [19], we give the syntax for CPtheories here. A CPTheory consists of statements of the form
where is an assignment to the set of variables that defines the condition under which the preference holds, , , and and are disjoint. The statement expresses the relative importance of the variable over the set of variables under the condition . Note that CPnets can be expressed as CPTheories by fixing (i.e., ); and TCPnets can be expressed as CPTheories by fixing or . Hence we use the above genera syntactic form to refer to a preference statement in any of the CPlanguages. Figure 1 shows two CPnets and , and a TCPnet where the red dotted arrow from to indicates that is more important than .
2.2 Ceteris Paribus Semantics
The ceteris paribus semantics of the CPlanguages define an induced preference graph with nodes corresponding to the outcomes, and the edges induced by the languagespecific interpretation of preference statements. According to the ceteris paribus interpretation [10, 3], each preference statement allows a set of changes to the valuation(s) of one or more variables in an alternative in order to obtain a more preferred alternative , while other variables remain fixed. Such a change is called an improving flip. The improving flips induced by the different types of preference statements is summarized below; we do not elaborate on the semantics of each CPlanguage, and refer the interested reader to [2, 5, 18] for details of the semantics of the respective languages.
Consider an intravariable preference statement of the form , which can be specified in all the languages we consider. Given two alternatives , the ceteris paribus interpretation of the statement induces an improving flip in if and differ only in , and and . In other words for any statement , the valuation of only one variable can be flipped at a time, and that to a more preferred valuation with respect to , while other variables remain fixed.
Definition 1 (Preference Semantics for Intraattribute Preference [2])
Given an intraattribute preference statement in a preference specification of the form where and two alternatives , there is an improving flip from to in induced by if and only if

and ,

, and

.
In the above definition, the first condition arises from the intraattribute preference statement ; the second condition enforces the condition in that states that and should concur on the parent variables of ; and the third enforces the ceteris paribus condition that states that and should concur on all the other variables.
TCPnets and CPTheories allow the specification of relative importance preference of one variable over one or more variable respectively. Hence, multiple variables can change in the same improving flip because a statement of relative importance of one attribute over others means that the user is willing to improve the valuation of the more important attribute at the expense of worsening the less important attribute(s).
Definition 2 (Preference Semantics for Relative Importance of one Attribute over a Set [5, 18])
Given a relative importance preference statement in a preference specification of the form where and two alternatives , there is an improving flip from to in induced by if and only if

and ,

, and

.
In the above definition, the first condition arises from the preference statement on ; the second condition enforces the condition in ; and the third enforces the ceteris paribus condition and allows for unrestricted changes to the attributes that are less important than (in ) when this preference statement is applied.
The above interpretations define valid improving flips induced by statements in that correspond to edges in the induced preference graph denoted , whose nodes are the set of all outcomes or alternatives (i.e., the set of all assignments to all preference variables), and which represents the dominance relation over the outcomes. Figure 2 shows the induced preferences graphs for the respective CPnets and TCPnet in Figure 1. Note that the red solid edges in are those induced by the dependency of on in . Similarly, the red dotted edges in are those induced by the relative importance of over in .
3 Preference Queries
Computing answers to preference queries with respect to a given preference specification in the ceteris paribus semantics amounts to making querying properties related to reachability on the induced preference graph. We consider the following preference queries that have been implemented in CRISNER in this paper.
Definition 3 (Dominance & Consistency Testing [2, 9, 19])
Given a preference specification consisting of a set of preference statements , and two outcomes

Dominance Testing () asks whether there a sequence of improving flips from to in ?

Consistency Testing asks whether the preferences induced by are consistent, i.e., is there is a cycle in ?
Definition 4 (Preference Equivalence & Subsumption [17])
Given two preference specifications and two outcomes ,

Preference Subsumption () asks whether .

Preference Equivalence () asks whether and .
3.1 Preference Query Answering via Model Checking
In order to address the PSPACEhardness of the problems of dominance and consistency, CRISNER implements the model checking based approach to preference query reasoning as presented in the series of works by Santhanam et al. [15, 16, 17]. There are two direct benefits of using the model checking approach to answering preference queries. First, by using the model encoding techniques presented in the above works, then dominance and consistency queries can be transformed into equivalent reachability queries on the Kripke model in a straightforward way. The transformation from the preference specification and query to the Kripke model and temporal logic formula respectively is at a syntactic level prior to execution of the model checker (without having to build the induced preference graph); thus preserving the benefits of succinctness of the CPlanguages. When the query is actually executed on the model checker, the induced preference graph is expanded to the extent needed by the model checker to verify the temporal logic formula. This would enable us to leverage the decades of advances in model checking algorithms and tools. The second direct benefit if the model checker returns a counter example to the encoded temporal logic formula (corresponding to the original preference query), which is in terms of states and transition sequences in the Kripke model, then it can be conveniently mapped back to nodes and paths in the induced preference graph. This allows CRISNER to automatically generate justifications for dominance and consistency queries by producing sequences of improving flips in the induced preference graph that either prove the dominance or disprove the consistency.
CTL model checking
We use formulas in computationtree temporal logic (CTL) [8] for verifying reachability within the Kripke model generated by CRISNER. Our choice of model checker is NuSMV [6], an open source and widely used tool. CTL is an extension of propositional logic; CTL uses propositional and temporal connectives to express temporal properties, whose semantics is given in terms of a set of states in the Kripke structure where the properties are satisfied. We briefly outline the syntax and semantics of some CTL connectives below, and refer the reader to [8] for details. The syntax of CTL is described as follows:
The semantics of a CTL formula is given in terms of the set of states in a Kripke structure that satisfy . The propositional constant is satisfied in all states; the proposition holds in states labeled with . The negation of is satisfied if the formula does not hold. The disjunct of two CTL formulas is satisfied by states if at least one of the disjuncts is satisfied. The rest of the operators in the CTL syntax are temporal operators that quantify the states and the transitions. The property is satisfied in any state which can reach some (E, for existential quantification) state in one transition (X, for one step reachability) such that satisfies . The property is satisfied in any state which has some (E) path where every (G) state ’s in the path satisfy . Finally, the property is satisfied in any state which has some (E) path where there exists a state which satisfied and in all states before , is satisfied. Semantics for other CTL formulas are described in terms of the above, e.g., is satisfied in any state from where there exists a path eventually leading to a state that satisfies . This is equivalent to . There are other temporal connectives which we mention and explain as needed in terms of the above in this paper.
3.2 Encoding Preference Queries in CTL
Here we outline the overall strategy to obtain answers to preference queries in the languages CPlanguages. We assume that CRISNER is given a preference specification and a preference query that is a test for either a dominance, consistency, preference subsumption or preference equivalence. The task of CRISNER is then to compute whether holds (or not) with respect to the ceteris paribus semantics of .
Dominance Testing
Testing dominance of an outcome over another amounts to simply checking reachability from one outcome to another in . To answer the dominance query , CRISNER constructs a temporal logic formula that corresponds to reachability from to in and executes the query on the NuSMV [6] model checker, affirming dominance if and only if the model checker returns true. Defining to be the set of preference variables in and to be the formula encoding the set of variables assigned in the outcome , the above dominance can be encoded in the following CTL formula:
Consistency Testing
Consistency testing amounts to checking that there are no cycles in . To test consistency for , CRISNER verifies the following CTL formula, which states that for all start states (If no start states are initialized, NuSMV nondeterministically considers all states in the Kripke model as start states ), there must be no reachable node from which there is a path back to , i.e. there is no cycle in .
In the above, holds whenever the destination state of a current state results from an improving flip as per the underlying preference semantics.
Preference Subsumption and Equivalence
Preference equivalence (subsumption) checking [17] amounts to testing whether the preferences induced by two preference specifications and are the same (or such that one subsumes the other) or not. Given and , CRISNER constructs an SMV model of the combined induced preference graph (CIPG) [17] that encodes the union of preferences induced by ’s preference statements and the reverse of those induced by ’s preference statements. In order to answer whether subsumes the preferences induced by or not, CRISNER constructs the following temporal logic formula that is verified by NuSMV if and only if subsumes (we use and to refer to the for the models corresponding to and respectively.
The above states that whenever there is an improving flip in from to an outcome (..), then there exists a sequence of improving flips () from that outcome in back to . In the above, all possible is captured by the proposition start. Preference equivalence is checked by in turn verifying that and .
4 XML Input Language
CRISNER accepts a preference specification for any of the CPlanguages in an XML format. The preference specification consists of a declaration of the preference variables, their domains and a set of preference statements. Each preference statement is of the form discussed in Section 2.1, and expresses an intravariable and/or relative importance preference relation over the domain of a variable.
4.1 Defining Preference Variables
Figure 3 shows part of a preference specification defining variables and their domains. The preference variable has a binary domain with values and , whereas has a domain . Note that CRISNER supports domain valuations with string values that are combinations of letters and numbers, as allowed by NuSMV.
4.2 Specifying Conditional Preference Statements
The listing in Figure 4 shows a portion of a preference specification that declares preferences over values of the variable conditioned on the variables and respectively. The VARIABLE tag identifies the variable whose preferences are being specified. Note that there can be multiple conditions or no conditions as well. In addition, there can also be multiple preferences for a variable, e.g., if there is a variable with domain of then to specify the total order one would encode as one preference followed by . CRISNER requires that the variable names and their assignments match with the preference variable declarations in the file; otherwise the tool reports an appropriate error stating that the variable is not defined in the preference specification.
4.3 Specifying Relative Importance Preferences
In order to allow specification of relative importance of one variable over another, as in a TCPnet, CRISNER allows the tag REGARDLESSOF within a preference statement. Figure 5(a) declares a preference statement that says (in addition to the fact that ) that is relatively more important than . In order to specify relative importance of one variable over a set of other variables (simultaneously) as allowed by a CPtheory, the user can specify multiple REGARDLESSOF tags within the same preference statement. For instance, Figure 5(b) shows a preference statement that declares that is relatively more important than .
5 Encoding Preferences as SMV Models
CRISNER encodes Kripke models for a preference specification as described earlier. Now we discuss constructs in NuSMV used by CRISNER for the encoding.
5.1 Encoding Preference Variables & Auxiliary Variables
In order to encode the CPnet in our earlier example, CRISNER generates the code for the SMV model as shown in Figure 6. We explain the translation of a preference specification into an SMV model by CRISNER through this example.
CRISNER defines just the main module, with 3 variables corresponding to the preference variables in and another variable , which we will explain shortly. We overload to refer to variables in the Kripke model and variables in the preference specification, hence valuations of in a state in the Kripke model respectively correspond to the valuations of the preference variables in the preference specification . The variables are state variables in the SMV model i.e., their valuations stored by the model checker for each state explored during model checking.
The IVAR variables are modeled as input variables, i.e., their valuations are not stored as part of each state. The model checker initializes them nondeterministically for each state so that all paths are open for exploration by the model checker during verification. Each preference statement is translated into an appropriate guard condition for a transition in the Kripke model, and the semantics of variables either allows or disallows the change in the value of the corresponding preference variable , in accordance with the improving flip semantics.
Identifying transitions corresponding to improving flips. The additional variable is defined to be exactly when the model checker transitions from a state corresponding to one outcome to a state corresponding to another outcome (not transitions between states corresponding to the same outcome). Hence, we can conveniently refer to transitions in the Kripke models that correspond to improving flips by constraining to have valuation in the destination state.
Referencing start states explored by NuSMV. The FROZEN variables a_0, b_0, c_0 are constrained to be fixed with the values of the variables respectively at the start of the model checking algorithm via the DEFINE and INIT constructs. This allows us to refer to the state nondeterministically picked by the model checker as the start of model exploration using . This is used for computing consistency, preference subsumption and preference equivalence.
5.2 Encoding Preference Statements
Encoding Intravariable Preferences. To encode a intravariable preference statement for a variable with a condition on the other variables, the next(x) construct encodes guards such that the valuations of the other variables correspond to those in the condition , and valuation of is while all other variables are set to . As an example, next(a) includes a transition such that changes from to precisely when and (, allowing only to change in that transition), which corresponds to the improving flip induced by conditioned on the value of in the CPnet (Figure 6).
Encoding Relative Importance. For modeling relative importance preference statements, multiple IVAR variables can be assigned in guard conditions such that the more important and less important preference variables can change in the same transition  corresponding to an improving flip for relative importance. For example, Figure 7 shows a snippet of the SMV code that models the transitions arising from the relative importance of over as in the TCPnet shown in Figure 1(c). Note that and are set to for the second guard condition of next(b), allowing to change to a preferred value trading off . In order to model relative importance as in a CPtheory where one variable is more important than multiple others, a similar encoding is used, except that all the corresponding variables are set to .
5.3 Justification of Query Results
In addition to answering preference queries posed against preference specifications, CRISNER also provides a justification of the result where appropriate. In order to obtain justification, CRISNER uses the counterexamples returned by NuSMV model checker whenever a temporal logic formula is not satisfied.
Extracting a Proof of Dominance. In the case of a dominance query, if CRISNER returns true, we construct another temporal logic formula that states the negation of the dominance relationship, which obtains a sequence of outcomes corresponding to an improving flipping sequence from the lesser preferred to the more preferred outcome from the model checker. Suppose that we want to obtain proof that an alternative dominates another alternative . This means that holds. We then verify , which obtains a sequence of states in the Kripke model corresponding to an improving flipping sequence from to from the model checker corresponding to an improving flipping sequence from to which serves as the proof of dominance.
Extracting a Proof of Inconsistency. In the case of a consistency query (see Section 3.2), CRISNER returns a sequence of outcomes corresponding to an improving flipping sequence from an outcome to itself (indicating a cycle in the induced preference graph) whenever the preference specification input is inconsistent.
Extracting a Proof of Nonsubsumption. For a preference subsumption query , CRISNER provides an improving flip from one outcome to another induced by but not induced by whenever the query does not hold.
In the above, counterexamples returned by NuSMV are in terms of states and transitions in the Kripke model; CRISNER parses and transforms the counterexamples back into a form that relates to the preference variables, outcomes and improving flips in the induced preference graph of the preference specification, and saves it in an XML format.
6 Architecture
CRISNER is built using the Java programming language^{4}^{4}4Third party libraries used by CRISNER are listed in the project site [14].. The architecture of CRISNER consists of several components as depicted in Figure 8.
The XML parser is used to parse the preference specifications and preference queries input by the user^{5}^{5}5While currently CRISNER does not use XML schema or DTD to validate the XML input, we plan to enforce that in future.. The CPlanguage translator is a critical component that constructs the SMV code for the Kripke model for the preference specification input. It declares the necessary variables with their domains, sets up the DEFINE, TRANS and INIT constraints and finally generates guard conditions for enabling transitions corresponding to improving flips induced by each preference statement (as discussed in Section 3.1).
CRISNER provides two interfaces for preference reasoning. The first is a simple command line menudrive console interface where the user can provide either (a) one preference specification as input and then use the menu to pose dominance and consistency queries, or (b) two preference specifications as input and pose a subsumption or equivalence query. The answer (true/false) obtained and the justification for the answer (where possible) is provided on the console. Another way of using CRISNER is to specify preference queries in an XML file that contains a dominance or consistency or preference equivalence or subsumption query, and identifies the preference specification against which the query should be executed. The query translator component parses queries specified in XML format and provides it to the Reasoner component. Further details about the XML tags and examples of preference specification, preference queries and sample SMV code generated by CRISNER are available from CRISNER’s project website http://www.ece.iastate.edu/~gsanthan/crisner.html.
The Reasoner is another critical component in CRISNER that constructs a temporal logic formula corresponding to the preference query posed by the user, and invokes the NuSMV model checker to verify the formula. The result and any counter examples generated by the model checker are parsed by the Results Translator, and saved in XML format by the XML Encoder. If a counter example is applicable to the preference query, then the Justifier parses the XML output and executes any followup queries on the model checker (e.g., verification of the negation of the dominance query) to provide the user with the appropriate proof.
Extensibility.
Although CRISNER currently supports the CPnet, TCPnet and CPtheory formalisms, it can be extended to support another qualitative preference language, as long as the semantics of the language is described in terms of an induced preference graph. To extend support, the XML parser must be extended to support the syntax of the new language; and the CPlanguage translator must be extended to generate SMV code according to the semantics of the new language. We are currently working on including support for the conditional importance network (CInet) [4] language for representing and reasoning with preferences in the context of fair division of indivisible goods. As another example, one can think of a new preference formalism may allow expression of preferences of one partial assignment of variables over another. In such a case, the CPtranslator component can be extended to include a translation for such a preference statement into guard conditions in the Kripke model representing the induced preference graph. CRISNER can also be extended to support new preference queries, for example, computing a weak order or total order extension of the partial order induced by a preference specification. In this case the Query translator and Reasoner should be extended to translate the new queries into one or more appropriate temporal logic formulas (as described in [12]) and the Justifier should be extended to construct and execute follow up queries that obtain proofs for the answers.
Scalability.
While we have not yet performed a systematic experiment studying CRISNER’s runtime performance for preference specifications of different sizes (number of preference variables), our preliminary tests have revealed that CRISNER answers dominance (including the computation of justification for a when applicable) in less than a minute on average for upto 30 variables on a 8GB Corei7 Windows 7 desktop. Although CRISNER allows variables with domain size , the model checking performance degrades quickly with increasing ; this can be alleviated by configuring the NuSMV model checker to use multiway decision diagrams [1].
7 Concluding Remarks
We presented CRISNER, a tool for specifying and reasoning with qualitative preference languages such as CPnet, TCPnet and CPtheory. CRISNER translates preference specifications and queries with respect to them provided in XML format into a Kripke structure and corresponding temporal logic (CTL) queries in the input language of the NuSMV model checker. Currently CRISNER supports dominance, consistency, preference equivalence and subsumption testing for the above languages. The obtained results from the model checker, including proofs of dominance, inconsistency or nonsubsumption, are translated by CRISNER back in terms of the vocabulary of the input preference specification and saved in XML format. CRISNER’s architecture supports extension to other preference queries and preference languages such as CInets whose semantics are in terms of the induced preference graph.
Work in progress includes adding support for dominance and consistency testing with CInets, which is useful in multiagent fair division problems. In the future, we plan to add support for computing weak order and total order extensions to consistent and inconsistent preference specifications, which is useful in applications like stable stable matching and recommender systems. We also plan to add support for reasoning with group preferences, i.e., reasoning about the preferences of multiple agents.
References
 [1] Abed, S., Mokhtari, Y., AitMohamed, O., Tahar, S.: Numdg: A new tool for multiway decision graphs construction. Journal of Computer Science and Technology 26(1), 139–152 (2011)
 [2] Boutilier, C., Brafman, R.I., Domshlak, C., Hoos, H.H., Poole, D.: Cpnets: A tool for representing and reasoning with conditional ceteris paribus preference statements. J.Art.Intel.Res. 21, 135–191 (2004)
 [3] Boutilier, C., Brafman, R.I., Hoos, H.H., Poole, D.: Reasoning with conditional ceteris paribus preference statements. In: UAI. pp. 71–80 (1999)
 [4] Bouveret, S., Endriss, U., Lang, J.: Conditional importance networks: A graphical language for representing ordinal, monotonic preferences over sets of goods. In: IJCAI. pp. 67–72 (2009)
 [5] Brafman, R.I., Domshlak, C., Shimony, S.E.: On graphical modeling of preference and importance. J. Artif. Intell. Res. (JAIR) 25, 389â424 (2006)
 [6] Cimatti, A., Clarke, E., Giunchiglia, E., Giunchiglia, F., Pistore, M., Roveri, M., Sebastiani, R., Tacchella, A.: NuSMV Version 2: An OpenSource Tool for Symbolic Model Checking. In: ComputerAided Verification. pp. 359–364. Springer, Copenhagen, Denmark (July 2002)
 [7] Clarke, E.M., Emerson, E.A., Sistla, A.P.: Automatic verification of finitestate concurrent systems using temporal logic specifications. ACM TOPLAS 8(2), 244–263 (1986)
 [8] Clarke, E., Grumberg, O., Peled, D.: Model Checking. MIT Press (January 2000)
 [9] Goldsmith, J., Lang, J., Truszczynski, M., Wilson, N.: The computational complexity of dominance and consistency in cpnets. J.Art.Intel.Res. 33, 403–432 (2008)
 [10] Hansson, S.O.: What is ceteris paribus preference? Journal of Philosophical Logic 25(3), pp. 307–332 (1996), http://www.jstor.org/stable/30226574
 [11] Kripke, S.A.: Semantical considerations on modal logic. Acta Philosophica Fennica 16(1963), 83–94 (1963)
 [12] Oster, Z.J., Santhanam, G.R., Basu, S., Honavar, V.: Model checking of qualitative sensitivity preferences to minimize credential disclosure. In: Proc. of FACS. pp. 205–223. Springer LNCS (2012)
 [13] Queille, J.P., Sifakis, J.: Specification and verification of concurrent systems in CESAR. In: International Symposium on Programming. pp. 337 – 351. Springer Verlag (1982)
 [14] Santhanam, G.R.: Crisner a qualitative preference reasoner. http://www.ece.iastate.edu/~gsanthan/crisner.html (2015), [Online; accessed 06February2015]
 [15] Santhanam, G.R., Basu, S., Honavar, V.: Dominance testing via model checking. In: AAAI. pp. 357–362. AAAI Press (2010)
 [16] Santhanam, G.R., Basu, S., Honavar, V.: Representing and reasoning with qualitative preferences for compositional systems. J. Artif. Int. Res. 42(1), 211–274 (Sep 2011), http://dl.acm.org/citation.cfm?id=2208436.2208443
 [17] Santhanam, G.R., Basu, S., Honavar, V.: Verifying preferential equivalence and subsumption via model checking. In: Algorithmic Decision Theory, pp. 324–335. Springer (2013)
 [18] Wilson, N.: Extending cpnets with stronger conditional preference statements. In: AAAI. pp. 735–741 (2004)
 [19] Wilson, N.: Computational techniques for a simple theory of conditional preferences. Artificial Intelligence 175, 1053 – 1091 (2011)