Automatic Conversion Software for the Safety Verification of Goal-Based Control Programs

Transcription

1 Subitted, 2009 Internationa Conference on Software Engineering (ICSE) Autoatic Conversion Software for the Safety Verification of Goa-Based Contro Progras Juia M. B. Braan Richard M. Murray Caifornia Institute of Technoogy Departent of Mechanica Engineering 1200 E. Caifornia Bvd., MC Pasadena, CA Abstract Faut toerance and safety verification of contro systes are essentia for the success of autonoous robotic systes. A contro architecture caed Mission Data Syste (MDS), deveoped at the Jet Propusion Laboratory, takes a goabased contro approach. In this paper, a software agorith for converting goa network contro progras into inear hybrid systes is described. The conversion process is a bisiuation; the resuting inear hybrid syste can be verified for safety in the presence of faiures using existing syboic ode checkers, and thus the origina goa network is verified. A oderatey copex goa network contro progra is converted to a inear hybrid syste using the autoatic conversion software and then verified. 1 Introduction Autonoous robotic issions by nature have copex contro systes. In genera, the necessary faut detection, isoation and recovery software for these systes is cubersoe and added on as faiure cases are encountered in siuation. There is a need for a systeatic way to incorporate faut toerance in autonoous robotic contro systes. One way to accopish this coud be to create a fexibe contro syste that can reconfigure itsef in the presence of fauts. However, if the contro syste cannot be verified for safety, the added copexity of reconfigurabiity coud reduce the syste s effective faut toerance. One particuary usefu way to ode faut toerant contro systes is as hybrid systes. Much work has been done on the contro of hybrid systes [13]. When the continuous dynaics of these systes are sufficienty sipe, it is possibe to verify that the execution of the hybrid contro syste wi not fa into an unsafe regie [1]. There are severa software packages avaiabe that can be used for this anaysis, incuding HyTech [9], UPPAAL [14], and VER- ITI [5], a of which are syboic ode checkers. PHAVer, the syboic ode checker used in this paper, is a ore capabe extension of HyTech [7]. PHAVer is abe to exacty verify inear hybrid systes with piecewise constant bounds on continuous state derivatives and is abe to hande arbitrariy arge nubers due to the use of the Para Poyhedra Library. Safety verification for faut toerant hybrid contro systes ensures that the occurrence of certain fauts wi not cause the syste to reach an unsafe state. Often ties, the contro progra used for an appication is not in a for that is conducive to verification. The contro progra ust then be transfored to an acceptabe for by soe suitabe eans. One such too exists for the conversion of AgentSpeak, a reactive goa-based contro anguage, into two anguages: Proea, which is associated with the Spin ode checker [10], and Java, for which JPF2 is a genera purpose ode checker [2]. Another popuar approach is to create correct by design contro progras fro Buchi autoata on infinite words [8], or fro specifications and requireents stated in a restricted subset of LTL [12]. The software contro architecture that the contro progras in this paper are based on is Mission Data Syste (MDS), deveoped at the Jet Propusion Laboratory [6]. MDS is based on a systes engineering concept caed State Anaysis [11]. Systes that use MDS are controed by networks of goas, which directy express intent as constraints on physica states over tie. By encoding the intent of the robot s actions, MDS has naturay aowed ore faut response options to be autonoousy expored by the contro syste [15]. The ain contribution of this work is fora description and anaysis of a goa network conversion agorith that is based on the procedure described in a previous work [4]. This agorith converts goa networks into hybrid autoata

2 in a sound and copete anner; this hybrid syste can then be parsed into a for that is verifiabe using an existing ode checking software. In Section 2, soe supporting inforation about State Anaysis, MDS, and inear hybrid systes is briefy described. In Section 3, a technica description of goa networks, the conversion and verification process, incuding an outine of a proof of the agorith s soundness and copeteness, and a brief overview of the software is given. A oderatey copex exape of the software s execution is described in Section 4, and Section 5 concudes the paper and describes soe future work. 2 Background Inforation 2.1 State Anaysis and Mission Data Syste State Anaysis is a systes engineering ethodoogy that focuses on a state-based approach to the design of a syste [11]. Modes of state effects in the syste that is under contro are used for the estiation of state variabes, contro of the syste, panning, and goa scheduing. State variabes are representations of states or properties of the syste that are controed or that affect a controed state. Exapes of state variabes coud incude the position of a robot, the teperature of the environent, the heath of a sensor, or the position of a switch. Goas and goa eaborations are created based on the odes. Goas are specific stateents of intent used to contro a syste by constraining a state variabe in tie. Goas are eaborated fro a parent goa based on the intent and type of goa, the state odes, and severa intuitive rues, as described in [11]. A core concept of State Anaysis is that the anguage used to design the contro syste shoud be neary the sae as the anguage used to ipeent the contro syste. Therefore, the software architecture, MDS, is cosey reated to State Anaysis. Goa networks in MDS repace coand sequences in ore traditiona contro architectures as the contro input to the syste. A goa network consists of a set of goas, a set of tie points, and tepora constraints. A goa ay cause other constraints to be eaborated on the sae state variabe and/or on other causay reated state variabes. The goas in the goa network and their eaborations are schedued by the scheduer software coponent so that there are no conficts in tie, goa order or intent. Each schedued goa is then achieved by the estiator or controer of the state variabe that is constrained. A goa that is achieved at soe eve by a controer is caed a controed goa; a other goas are passive. Eaboration aows MDS to hande tasks ore fexiby than contro architectures based on coand sequences. One exape is faut toerance. Re-eaboration of faied goas is an option if there are physica redundancies in the syste, any ways to accopish the sae task, or degraded odes of operation that are acceptabe for a task. The eaboration cass for a goa can incude severa predefined tactics. These tactics are sipy different ways to accopish the intent of the goa, and passive goas constrain the conditions in which a tactic ay be executed. This capabiity aows for any coon types and cobinations of fauts to be accoodated autoaticay by the contro syste [15]. 2.2 Linear Hybrid Autoata There are severa syboic ode checkers avaiabe that are capabe of verifying inear hybrid autoata. A inear hybrid autoaton H consists of the foowing coponents [9]: 1. A finite, ordered ist of continuous state variabes, X = {x 1,x 2,..., x n }, and their tie derivatives, Ẋ = { x 1, x 2,..., x n }. 2. A contro graph, (V, E), where V is the set of contro odes or ocations of the syste, and E is the set of contro edges or transitions between the different odes of the syste. 3. The set of invariants for each ocation, inv(v), the set of initia conditions for each ocation, init(v), and the set of fow conditions, which are equations that dictate how state propagates in each ocation, dif(v, Ẋ), where v V. 4. The set of transition abes, Σ, and transition actions or reset equations, A. This hybrid autoaton specification can be iustrated using a sipe exape. Suppose there is an autonoous unanned air vehice (UAV) whose task is to fy to a point and then aintain that position for soe aount of tie. The speed at which the UAV can fy is deterined by its syste heath (the cobined heath vaue of a its sensors). This syste is described by two autoata, H 1 and H 2, shown in Figure 1. The sets of continuous variabes associated with these autoata are X 1 = {x, t}, where x is the position and t is a tier, and X 2 = {s}, where s is a easure of syste heath; the associated tie derivatives beong to the appropriate sets. The ocations and transition arrows (inus the conditions) ake up sets V n and E n, where n =1, 2, respectivey. The initia conditions are x = 0 for H 1 and s = 0 for H 2. The transition conditions fro GS1 and GS2 to Maint are x x d, Σ 1 (these sae transition edges have reset conditions on the tier, t =0 A); the reated invariants of those two ocations are x < x d, where x d, <x d. This eans that as soon

3 goa network, where T 1 <T 2 <... < T K+1 for increasing tie. Each goa has severa functions associated with it. 1. start(gn in,jn ) returns the goa s starting tie point. 2. end(gn in,jn ) returns the goa s ending tie point. 3. svc(gn in,jn ) returns the state variabe constrained by the goa. 4. c(g i,j,gn in,jn ) returns true if the two goas have constraints that are consistent (see Definition 3.1 beow) and fase otherwise. 5. cons(gn in,jn ) returns the constraint (or invariant) on the state variabe; cons(gn in,jn ) Q R, where R is the set of rea nubers and Q = {=,, <, >,, }. Figure 1: Hybrid autoata exape as x reaches x d,, which ay be a ower bound on the desired transition state vaue, the transitions can occur, but the transition wi definitey occur when x = x d. Likewise, the other invariant conditions and transitions in both autoata dictate when the transitions wi occur. Finay, the differentia equations that contro the fow of the variabes are isted in each ocation. These coponents fuy describe a inear hybrid syste that can be successfuy verified using HyTech or PHAVer. The reachabiity anaysis used in the safety verification of these hybrid autoata finds the set of a states that are connected to a given initia state by a vaid run. This can cause a huge exposion of the state space, however, so syboic ode checkers partition the state space into sets that are siiar in the given reachabiity anaysis. For exape, given soe interesting condition, PHAVer wi return the set of the state space in which it is reachabe; these interesting conditions given to the software are generay unsafe conditions for the particuar syste. 3 Conversion and Verification Procedure 3.1 Fora Description of Goa Networks Let G be the set of a goas in a goa network, where G = G U. The set G = {g i1,j1 1,g i2,j2 2,..., g i N,j N N } consists of a controed goas in a goa network, where i n is the parent goa index and j n is the tactic nuber into which the goa is eaborated, for n =1,..., N. The set of passive goas is U = {u i1,j1 1,u i2,j2 2,..., u i M,j M M }, where i is the index of the goa s parent goa (which is aways a controed goa) and j is the goa s tactic nuber for =1,...M. Let T = {T 1,T 2,..., T K+1 } be the set of tie points in the 6. entry(gn in,jn ) Q Rreturns the condition on the goa s constrained state variabe that ust be true when entering the goa. 7. exit(gn in,jn ) Q R returns the condition on the goa s constrained state variabe that ust be true before exiting the goa. Definition 3.1. Two goas g i,j and gn in,jn are consistent if svc(g i,j ) svc(gn in,jn ), or if svc(g i,j ) = svc(gn in,jn ) and the goas constraints are abe to be erged or executed concurrenty. Passive goas have the sae functions associated with the as the controed goas do, except the entry ogic is just the goa constraint and the exit ogic is aways true. Since passive goas constrain the conditions in which a tactic ay be executed, if those conditions becoe fase, the tactic fais. The foowing two functions give eaboration ogic and faiure destination of each tactic, which is a group of goas with the sae parent index nubers (i n ) and tactic nubers (j n ). 1. startsin(i n,j n ) returns the condition in which the tactic is eaborated initiay. 2. faito(i n,j n ) returns the goa index to which execution goes upon faiure. If the goa fais to Safing, the output of this function is Safe. The foowing goa cassifications and reationships are iportant in describing the execution of a goa network. Definition 3.2. A goa is root goa if it has no parent goa. It is signified by i n =0and j n =0. Definition 3.3. Two goas g i,j if i i n j = j n. Definition 3.4. Two goas g i,j i = i n j = j n. and g in,jn n and g in,jn n are copatibe are sibings if

4 Root goas are the ancestors of a the other goas in a goa network. Two goas are copatibe as ong as they are not eaborated into different tactics fro the sae parent goas. Incopatibe goas can never be executed at the sae tie in a goa network. Sibing goas are goas that are eaborated fro a parent goa into the sae tactic; sibing goas are aways copatibe and aways executed at the sae tie if active during the sae tie points. A vaid execution of the goa network consists of a sequence of aternating fow and transition conditions, φ If (t f )...φ I2 (t 2 )ρ I2I 1 φ I1 (t 1 )X 0, (1) where X 0 is the set of initia conditions of the controed state variabes, φ In (t n ) is the set of fow conditions associated with the executabe set of goas θ In and propagated forward in tie t n steps, and ρ In+1I n is the transition between the executabe sets of goas θ In and θ In+1. Due to the structure iposed on the tie points (described in the next section), goas can be grouped into K groups, G k, k =1,..., K where G k = {g in,jn n G start(gn in,jn ) T k end(gn in,jn ) T k+1 }. (2) Certain subsets of the goas in each set G k can be executed at the sae tie; these subsets are caed executabe sets, θ I. The set of a executabe sets that are buit fro the goas in G k is Θ k. Each executabe set of goas θ I Θ k satisfies the foowing properties: 1. A goas in the executabe set are active between the appropriate tie points; for a gn in,jn θ I, gn in,jn G k. 2. A root goas in the group are in each executabe set; for a gn 0,0 G k, gn 0,0 θ I. 3. If a parent goa in the executabe set has chidren in the group, at east one of those chidren wi aso be in the executabe set; for a gn in,jn θ I, if there exists g i,j G k, n, s.t. i = n, then there exists g i,j θ I s.t. i = n. 4. The parent goas of a goas in an executabe set are aso in the set; for a gn in,jn θ I, if there exists g i,j G k, n, s.t. i n =, then g i,j θ I. 5. The sibings of a goas in the executabe set are aso in the set; for a gn in,jn θ I, if there exists g i,j G k, n, s.t. i = i n j = j n, then g i,j θ I. 6. Let D n be the set of goas descended fro gn 0,0 / G k. Then, if D n G k then there exists g i,j D n G k s.t. g i,j θ I. Figure 2: Path for the sipe rover exape are co- 7. For a gn in,jn patibe. are con- 8. For a gn in,jn sistent.,g i,j,g i,j θ I, g in,jn n θ I, g in,jn n and g i,j and g i,j 9. Let ν I θ I be the set of a passive goas associated with the contro goas gn in,jn θ I. Then, for a u in,jn n,u i,j ν I, u in,jn n and u i,j are consistent. There are two different types of transitions between the goas in the goa network, transitions based on goa copetion, ρ c IJ,k Scop, and transitions based on goa faiure, ρ f IJ,k Sfai, where S cop and S fai are the sets of a copetion and faiure transitions, respectivey. The transition ρ c IJ,k is fro θ I Θ k to θ J Θ k+1, and ρ c IJ,k = θ I exit(g in,jn n ) θ J entry(g i,j ) θ J startsin(g i,j ). (3) The transition ρ f IJ,k is fro θ I Θ k to θ J Θ k. Let F be the set of faiing accopanying goas in executabe set θ I and et H = { u in,jn n F faito(i n,j n )}. Then, if Safe H, ρ f ISafe,k = cons(un in,jn ) cons(u i,j ). (4) F ν I \F Ese, ρ f IJ,k = F cons(u in,jn n ) ν I \F cons(u i,j ) ν J cons(u i,j ). (5) For both ρ c IJ,k and ρf IJ,k, ony transition conditions that evauate to true are taken. Vaid transitions are a those that are not invarianty fase. A sipe exape to iustrate these concepts invoves a robot with three sensors traversing a path, shown in Figure 2, to get to one point of interest, whose seection depends on

5 Figure 3: Goa network for the sipe rover exape. The circes represent tie points and the rectanges represent goas. Chid goas eaborated fro a parent goa are under the dashed ine that is beow the parent goa and the tactics are separated by the OR. Tabe 1: Seect Goa Function Outputs for Sipe Rover Exape Goa svc cons entry exit g 0,0 1 Pos (rate) (=, 0) (=, 0) True g 1,1 2 Pos (=,C1) True (=,C1) g 2,1 4 Ori (=,θ 0 ) True (=,θ 0 ) g 3,1 5 Pos (=,P1) True (=,P1) g 3,2 7 Pos (=,P2) True (=,P2) u 2,1 1 SH (, P) (, P) True u 5,1 2 SH (=, G) (=, G) True the heath of the sensors. The state variabes in this probe are as foows: robot position, robot orientation, and syste heath, which depends ony on the vaues of the three sensor heaths. Figure 3 depicts the goa network used to contro the rover and Tabe 1 has the function outputs for soe goas; goas that are siiar to one isted are not shown. The rover can traverse the first segent of the path as ong as the coposite syste heath is fair or good. The rover then decides to go to P1 or P2 based on the syste heath; it picks P1 if the heath is good and P2 if the heath is fair. If the heath at any tie is poor, the robot safes due to the faito functions of a tactics. The startsin ogic for a tactics is reated to the accopanying passive goas. 3.2 Procedure Description Hybrid syste anaysis toos can be used to verify the safe behavior of a hybrid syste; therefore, a procedure to convert goa networks into hybrid systes is an iportant too for goa network verification. A anua process for converting certain types of goa networks is described in [4] and [3]. These goa networks can have severa state variabes and severa ayers of goa eaborations, however tie points ust be we-ordered, which eans the tie points fire in the order that they are isted in the eaboration. This restriction ony states that the goa network has aready been schedued and that goas cannot switch order; it gives no restriction on the aount of tie between tie points. For the software, one ore restriction is currenty necessary; no goas with non-trivia exit conditions can be spit by a tie point due to the way that the exit condition ust be handed. Each state variabe constrained in the goa network is abeed as either controabe, uncontroabe, or dependent. A controabe state variabe (CSV) is directy associated with a coand cass; an exape of a CSV is a heater switch that can be coanded on and off. An uncontroabe state variabe (USV) is not associated with a coand cass in any way; an exape of a USV is wind veocity. A dependent state variabe (DSV) has ode dependencies on at east one controabe state variabe; an exape of a dependent state variabe coud be the teperature of an instruent, if there are ways to affect that teperature (heater, powering off the instruent). The first autoaton created in the conversion is caed the goas autoaton. This autoaton has execution paths of the for ψ If (t f )τ If I f 1...ψ I2 (t 2 )τ I2I 1 ψ I1 (t 1 )X 0 (6) where X 0 is the set of initia conditions on the controed state variabes, ψ In (t n )=dif(v In,X)(t n ) is the fow associated with ocation v In for t n tie steps, and τ InI n 1 is the transition fro ocation v In to v In 1. First, soe definitions are isted. Definition 3.5. A branch goa is a goa gn in,jn G k such that for a g i,j G k,i n; in other words, it is a goa that has no chid goas in the sae group as itsef. Definition 3.6. Two ocations, v In and v I, are copatibe if for a gn in,jn v In and for a g i,j v I, gn in,jn and are copatibe. g i,j There are four sets of procedures used to create the goas autoaton. First, ocations of the goas autoaton are created. For each group of goas G k, k =1,..., K, a group of ocations V k is created using these procedures: 1. Let V k = {v I1,v I2,..., v IB } where B is the nuber of branch goas in G k, v In = {g i bn,j bn b n g i bn,j bn b n is a branch goa}, and I n = {b n }. 2. For a gn in,jn,g i,j G k s.t. gn in,jn v In and g i,j v I, if the goas are copatibe, i = i n j = j n n, then et v I = v I v In = {g i,j,gn in,jn }, where I = {, n} and reove v In and v I fro V k. 3. For a v In V k and for a g i,j v In :

6 (a) If there exists ga ia,ja G k s.t. a = i then ga ia,ja v In. (b) If there exists ga ia,ja G k s.t. i a = i j a = j a then ga ia,ja v In. (c) If there exists ga 0,0 G k then ga 0,0 v In. This step is not needed, since a root goas wi be added to the ocation with the previous two steps. 4. Cobine copatibe ocations using the foowing procedure: (a) Let Vk i,i=1, be the set of origina ocations. (b) For a v In,v I Vk i, n, if v I n and v I are copatibe, et v Ij = v In v I,v Ij V i+1 k. (c) For a v In Vk i, if for a v I j V i+1 k, (v In v Ij ), add v In to V i+1 k. For a v In,v I V i+1 k, n, if v In = v I, reove v In. (d) Increent i. Repeat Steps (b)-(d) unti for a v In,v I Vk i, n, v I n and v I are incopatibe. (e) Set V k = V i k. 5. For a v In V k and for a g i,j c(g i,j,g i,j ), reove v In.,g i,j 6. For a v In V k and for a u i,j,u i,j c(u i,j,u i,j ), reove v In. v In, if v In, if The first two steps of the procedure basicay set up the initia ocations to contain each of the owest eve goas; if the group of goas was drawn in a tree structure with the chidren descended fro the parent goas, these goas are the furthest branches. The next step adds a the ancestor goas and sibings of ancestor goas up the goa tree fro the branch goa to each of the branch goa ocations. Parent goas ay be represented in any ocations, but each branch goa is represented in ony one ocation and the cobination of the goas in each ocation is the set of a goas in the group. These first three steps guarantee that each goa in a group is represented in at east one ocation. Fro the properties of executabe sets, properties 1, 2, 4, and 5 are satisfied by these three steps; a goas are in the sae group, and so are active between the sae consecutive tie points, and a root goas, parent goas, and sibing goas of each goa in the ocation are aso in each ocation. The fourth step is the ocation cobining procedure. The ocations that are copatibe are cobined in such a way so that a possibe cobinations of copatibe ocations are created and so that the fina outcoe is a set of incopatibe ocations. It can be shown that this cobination procedure produces a possibe executabe sets for each group. This step satisfies the properties 3, 6, and 7 of executabe sets; each parent in a ocation can be shown to have at east one chid goa in the ocation as a resut of this procedure, descendants of root goas that are not in the group are present in each ocation because they are copatibe with the root goas (and descendants) that are in the group, and due to construction, a goas in the ocation are copatibe. Finay, the ast two steps reove ocations that have inconsistent goas. This satisfies properties 8 and 9 of executabe sets. Transitions for the goas autoaton are created using three different procedures, one for each type of transition condition. The first two are based on the copetion transitions in the goa network. First, the procedure for creating transitions fro the preceding group connector (or initiay for the first group, V 1 ) to each ocation is as foows, for a V k,k =1,..., K: 1. For a v In V k, transition edges are created fro the preceding group connector (or initiay for k =1) to the ocation. 2. Transition conditions for each edge are created, τ s n,k = v In 3. For a g i,j entry(g i,j ) startsin(g i,j ). (7) v In v In, if svc(g i,j controabe state variabe, cons(g i,j as a reset action. τ s n,k ) returns a discrete ) is added to 4. If τn,k s is invarianty fase, the corresponding transition edge is deeted. The procedure for creating exit transitions fro the ocations to the foowing group connector (or to the Success ocation for k = K) is as foows, for a V k,k =1,..., K: 1. For a v In V k, the transition edges are created fro the ocation to the foowing group connector (or to the Success ocation if k = K). 2. Transition conditions for each edge are created, τ e n,k = v In exit(g i,j ). (8) 3. If τn,k e is invarianty fase, the corresponding transition edge is deeted. Finay, the procedures for creating faiure transitions between ocations within groups is as foows, for a V k,k = 1,..., K: 1. For a v In V k, et U n = {F 1,F 2,...} where F are a possibe cobinations of u i,j A n, where set A n contains a unique u i,j v In (repeated constraints are excuded).

7 2. For a F U n, et f = { u i,j v In, faito(i,j )}. 3. For a v In V k and for a F U n, if Safe f, create a transition edge fro v In to the Safing ocation. The transition condition associated with the edge is τ f nsafe,k = cons(u i,j ) ). F A n\f cons(u i,j 4. For a v In V k and for a F U n, if Safe / f, τ f na,k = F cons(u i,j ) (9) cons(u i,j ) cons(u i,j ). (10) A n\f A a If τ f na,k is not invarianty fase, create a transition edge fro v In to v Ia whose transition condition is τ f na,k. 5. Reove any transition edge whose condition, τ f nsafe,k or τ f na,k is invarianty fase. The first two steps create a possibe sets of faiure conditions for a given ocation and then the set of ocations to which the execution continues for each of these sets of faiure conditions. The third and fourth steps create the transition and condition depending on the contents of the fai to set. If Safe is not in the set, then the ocation that the faiure transition goes to depends on which ocation s passive goa conditions agree with the faiure conditions. Finay, the ast step reoves any invarianty fase transition. This concudes the procedure to create the goas autoaton. Next, separate hybrid autoata are created for each USV and DSV in the foowing way. These autoata drive state transitions for the state variabes that are not propagated by the fow equations in the goas autoaton s ocations. 1. The ocations of each autoaton are created fro the discrete states or discrete sets of states that the state variabe is constrained to be in the goa network if there are passive goas on that state variabe or if the state variabe is discrete. If not, then the ocations are based on the different rates of change that the variabe can have. 2. The transitions between the ocations are based on the ode of the state variabe; the transitions ay be odeed as stochastic if they are uncontroabe or dependent on soething that is not odeed, such as tie of day. The transitions ay be based on state variabes on which there are ode dependencies, and the transition conditions are derived fro those odes. Once the hybrid syste is created, the verification work begins. 1. Specify the unsafe set. This is what the hybrid syste is verified against; when the syste is said to be verified, that eans that the unsafe set is not reached. 2. Run the hybrid syste with the unsafe set through ode checking software; currenty, PHAVer is the defaut syboic ode checking software used. 3. Make and record any changes needed to verify the hybrid autoaton. Transate these changes into adjustents to the goa network. 3.3 Soundness and Copeteness It is possibe to prove that this conversion procedure is a bisiuation between the goa network and the goas autoaton. By construction, the ocations of the hybrid autoaton correspond exacty to the executabe sets of the goa network, and the transitions of the goas autoaton are exacty those of the goa network. The foowing two eas are used to show that the ocations of the goas autoaton correspond one to one with a of the executabe sets of the goa network. Lea 3.7. For a Θ k,k =1,..., K and for a θ I,θ J Θ k,i J, θ I is incopatibe with θ J. Lea 3.8. If there exists v Ir V k s.t. there exists gn in,jn v Ir where there is a g i,j G k,i = n but for a g i,j v Ir,i n then there exists v Is V k s.t. v Ir is copatibe with v Is. Lea 3.7 says that each executabe set of goas is incopatibe with every other executabe set. This just eans that each executabe set of goas in a group contains at east one different tactic fro a coon parent goa than every other executabe set in the group. The proof is by contradiction; one can show using the properties of executabe sets that if two executabe sets are copatibe, they are the sae set. Lea 3.8 says that if a ocation in the goas autoaton contains a parent goa but none of the parent goa s chidren, that ocation wi be copatibe with another ocation in the group. Because of the construction procedure that cobines ocations unti a in a group are incopatibe, this ea shows that the ocations satisfy property 3 in the executabe set specifications. The proof is by induction; one can show that this ea is true in the initia set of ocations Vk 1 and then that is aso true in a foowing sets. The foowing proposition uses the eas to show that a executabe sets are represented one to one by ocations. It is easy to see fro this proposition that the fow conditions φ In = ψ In for corresponding executabe sets and ocations.

8 Proposition 3.9. For a Θ k,k =1,..., K and for a θ I Θ k, there exists v In V k s.t. θ I v In. The proof of Proposition 3.9 uses the procedure steps for the ocation creation and the two previous eas to show that a of the executabe set properties are satisfied by the ocations that resut fro the ocation creation procedure. Likewise, the two foowing eas reate the transitions of the goa network to the transitions of the hybrid autoaton and the proofs are aso by construction using the transition creation procedures. Figure 4: Speed iit goa network. shown. Tie points 1 and 3 are Lea For a ρ c ij Scop, there exists an equivaent transition τ ij,k Σ c k =Σe k Σs k+1. Lea For a ρ f IJ,k Sfai and for a ρ f ISafe,k S fai in the goa network, there exists an equivaent transition τ f IJ,k Σf k and τ f ISafe,k Σf k in the resuting hybrid autoaton. Finay, the Lea 3.12 proves that the transitions are the sae between the goa network and the goas autoaton and Theore 3.13 proves that the conversion procedure is a bisiuation. Lea A transitions of the goa network are represented in the goas autoaton. Proof. Since ony two types of transitions are aowed in the goa network, this stateent is true due to Leas 3.11 and Theore The conversion procedure is a bisiuation between the goa network and the goas autoaton. Proof. By Proposition 3.9 and Lea 3.12, a executions of the goa network are represented by paths in the hybrid autoaton constructed fro the goa network by using the conversion procedure. Because of this, a executions of the goa network are represented by an execution path through the hybrid autoaton. There are no executions in the hybrid autoaton that do not represent an execution of the goa network because each transition and ocation in the hybrid autoaton was constructed fro a corresponding transition and executabe set of goas in the goa network. Therefore, the conversion procedure is sound in that if the hybrid autoaton is verified for soe unsafe set, the goa network is aso verified. This is easy to see since every execution path in the goa network is represented in the hybrid autoaton; so, if there exists a path in the goa network in which the given unsafe set is reachabe, that path wi aso be present in the hybrid autoaton. The conversion procedure is aso copete, in that if the goa network is verifiabe, the hybrid autoaton wi aso be verifiabe. There are no extra execution paths in the hybrid autoaton that are not present in the goa network; in fact, there is a way to rebuid the origina goa network and goa ogic fro the hybrid autoaton. 3.4 Sipe Rover Exape The conversion and verification procedure can be iustrated using an extension of the sipe rover exape introduced in Section 3.1. In this version, a speed iit goa with two tactics (two speed iits) is added; the speed iit is chosen by the syste heath vaue, uch ike the exape in Section 2.2. This extension to the goa network is depicted in Figure 4. The sae state variabes are used in this exape, and both position and orientation are controabe state variabes and the syste heath state variabe is uncontroabe. The startsin ogic of both speed iit tactics are based on the accopanying passive goas. The faito ocation depends on the syste heath vaue; if poor, both tactics fai to Safe, but if fair for the first tactic or good for the second tactic, the tactics fai to the other tactic. A contro goa cobinations in the goa network are consistent. The goa network has four tie points and therefore three groups. The first group has three sets of sibing branch goas ({g 2,1 4,u2,1 1 }, {g9,1 10,u9,1 4 }, and {g9,2 11,u9,2 5 } fro steps 1 and 2 of the ocation creation agorith) that cobine to for two incopatibe ocations in step 4 of the ocation creation agorith, created fro the cobination of the one tactic of g 1,1 2 ({g 1,1 2,g2,1 4,u2,1 1,g0,0 9 } fro step 3 of the ocation creation agorith) and the two tactics of g 0,0 9 ({g 0,0 9,g9,1 10,u9,1 4 } and {g0,0 9,g9,2 11,u9,2 5 }). The second group starts with four sets of sibing branch goas that cobine into four ocations, which covers a possibe execution paths of the goa network between those tie points. However, two ocations were reoved due to inconsistent accopanying goas due to step 6 of the ocation creation agorith (u 5,1 2 and u 9,2 5 for one ocation, and u 7,1 3 and u 9,1 4 for the other). The third group has ony one goa, and therefore ony one ocation. The transitions into the ocations either initiay (group 1) or fro the group connector are conditioned by startsin eaboration ogic, which is just the accopanying passive

9 Figure 6: Fow chart of the conversion software execution Figure 5: Autoata for rover exape goa constraints in each tactic, and entry transition ogic contributions fro a goas in the group. The faiure transitions between the ocations in the groups or fro the ocations to the Safe ocation are due to the accopanying goas and the faito function of the goas present; if the syste heath becoes poor at any tie, the goa network safes. The transition ogic out of the ocations to the foowing group connector or to the Success ocation (group 3) are the exit ogic conditions for each of the copetion goas present in the ocation (the GetTo goas). The fina version of the goas autoaton can be found in Figure 5. The ony pertinent uncontroabe state variabe is the syste heath state variabe, which can be odeed as three discrete state vaues, which becoe ocations, with stochastic transitions between the. The syste heath autoaton is shown in Figure 5. Finay, the unsafe set is deterined; this is any condition that the designer decides the rover shoud never reach. The autoata and thus the goa network can now be verified using ode checking software. 3.5 Conversion Software Design The autoatic conversion software converts a given goa network when the goas, state variabes, goa ogic inforation, and the unsafe set specification are input. The output of the software is an input fie for a ode checking software. The software is written in Matheatica because of the ist structure it epoys and its extensive ibrary of patternatching functions. The genera outine for the structure of the conversion software is shown in Figure 6. In addition to the input and output parsers, there are four ain parts to the actua conversion agorith: ocation creation, constraint erging, transition creation, and ocation reova. The conversion software s input parser takes an XML fie with a specified structure and transates it into severa ists that the Matheatica code can use. Input spec- ifications consist of a the pertinent goa network inforation. A DTD fie for the XML input fie can be found at braan/fies/phaver.txt. The four ain parts of the conversion software generay foow the conversion procedure outined in Section 3. The output of these agoriths describe the goas autoaton and a of the uncontroabe and dependent state variabes autoata in a very generic for so that they ay be used with an output parser that transates the ists into code for any ode checker that uses autoata theory to verify systes. The fina output is a fie that can be run through the respective ode checker. The ocation creation agorith and the transition creation agoriths foow the conversion agoriths presented in the previous section exacty. The constraint erging agorith cobines the constraints on a of the controed goas that constrain the sae state variabe in each ocation. If the goas are consistent, the resuting erged constraint is found fro the origina constraints. This agorith aso assigns dynaica update equations to each ocation once the fina erged constraints have been found. The ocation reova agorith checks if any ocation acks entry conditions and if so, reoves the ocation and a other faiure transitions originating fro that ocation for state space considerations. The agorith aso checks for other ocations that woud warrant reova, however it can be shown that none of these conditions wi ever occur due to the way transitions and ocations are created. 4 Copex Rover Exape This exape invoves an autonoous rover whose utiate goa is to foow a given path to a specified end point. This rover has three ain sensor systes: GPS, LADAR, and an inertia easureent unit (IMU). The path choice and speed iit aong the chosen path is dependent on the cobined heath of these sensors. Each sensor degrades or fais in a specified way. The GPS can experience periods of reduced accuracy (e.g. sateite dropouts) or faiure (eec-

10 Tabe 2: State Variabe Types Controabe Dependent Uncontroabe Position Re. Sun Orientation GPS Heath Heading LADAR Heath Abient Tep. IMU Power Syste Heath Sun Ange Heater Switch IMU Teperature IMU Heath Figure 9: IMU Teperature goa network. Tie points 1 and 5 are present in this goa network. Figure 7: Path goa network. Tie points 1 through 5 are present in this goa network. goas. There are four CSVs, five DSVs and three USVs. The conversion software found 46 ocations (incuding the Success ocation) in four groups. In a, there are nine autoata with 67 tota ocations. The conversion software took ess than five seconds to generate the PHAVer code for this syste. The unsafe set for this probe consists of the foowing conditions: 1. The rover is not stopped when the IMU is off and the GPS is degraded. 2. The rover oves forward when the sun is pointing directy into the LADAR unit. Figure 8: Speed iit goa network. present in this goa network. Tie points 1 and 5 are trica or structura signa interference), and these can both be odeed as recoverabe stochastic events. The LADAR heath depends on the ocation of the sun in the sky. If the sun is shining directy into the LADAR, its easureents cannot be used. Soe degradation of the LADAR s capabiities occur at ess direct sun anges, as we. Finay, the IMU heath is dependent on the teperature of the device. If the teperature of the IMU is too ow, a heater can be used to heat the sensor. If the IMU teperature gets too high, the unit ust be powered off. The ists of state variabe types for each state variabe can be found in Tabe 2. The goa networks for this task are shown in Figures 7-9. The first goa network describes the path the robot wi take, the second is the speed iits that wi appy to the robot, and the third describes the IMU teperature anageent ethod. There are 21 controed goas, incuding eight parent The hybrid autoata coud be verified after epoying severa reduction techniques that are outside the scope of this paper and soe corrections to the autoata. The verification software found reachabe states in the origina autoata that entered the unsafe set, so the autoata had to be corrected to ensure that the unsafe set was not entered. The transitions into the ocations where the IMU power is off and the speed is not zero ust aso have a condition that the GPS Heath is GOOD or FAIR to satisfy the unsafe set. These changes were added, verified, and then transated back into the goa network by adding a new tactic in the speed iit goa network, which can be found in Figure 10. This akes the contro progra conservative but verifiabe with respect to the given unsafe set. 5 Concusion and Future Work The goa network conversion software presented in this paper is capabe of quicky and accuratey converting copicated goa networks into a bisiiar inear hybrid autoata that can be verified using existing syboic ode

11 Kirk Reinhotz, and the rest of the MDS tea at JPL for feedback, suggestions, answered questions, and MDS and State Anaysis instruction. This work was funded by AFOSR. References Figure 10: Redesigned speed iit goa network. checking software such as PHAVer. This autoatic too aows ore goa networks to be verified due to its speed and ease of use, which is a proising deveopent for goabased contro progras, particuary for contro architectures such as MDS. There are any directions in which future work ay go. The ost natura specification of the unsafe set is in ters of constraints on state variabes, whie soe ode checking software need the unsafe set in ters of ocations as we. It ay be possibe to autoaticay transate the natura specification of the unsafe set to the syntax needed by the specific ode checker. The verification step of the process is not autoated, but certain parts of it ay have the potentia to be. There are severa reduction techniques that work we with the structure of the hybrid autoata that is output fro the conversion procedure; for exape, it ay be possibe to verify the syste group by group or to cobine uncontroabe state variabe autoata to reduce the state space (both depend on the unsafe set specified). Aso, the changes that are ade to the hybrid autoata during the verification procedure ust be tracked and transated back into changes to the goa network, soething that aso ay be autoated. Finay, using Spin as the ode checker for systes that ay have utipe goa networks that run asynchronousy sees ike a proising direction for goa networks that have restricted state spaces. Whie these changes woud be beneficia to this process, the software as it currenty stands is a treendous iproveent over anua ethods and aows ore copex goa networks to be quicky converted for verification. 6 Acknowedgeents The authors woud ike to gratefuy acknowedge Kenny Meyer, Miche Ingha, David Wagner, Robert Rasussen, [1] R. Aur, T. Henzinger, and P.-H. Ho. Autoatic syboic verification of ebedded systes. IEEE Transactions on Software Engineering, 22(3): , [2] R. H. Bordini, M. Fisher, W. Visser, and M. Woodridge. Prograing Muti-Agent Systes, voue LNAI 3067, chapter Verifiabe Muti-agent Progras, pages [3] J. M. Braan and R. M. Murray. Conversion and verification procedure for goa-based contro progras. Technica report, Caifornia Institute of Technoogy, CatechCD- STR: , [4] J. M. Braan, R. M. Murray, and D. A. Wagner. Safety verification of a faut toerant reconfigurabe autonoous goabased robotic contro syste. IEEE/RSJ Internationa Conference on Inteigent Robots and Systes, [5] D. Di and H. Wong-Toi. CAV 95: Coputer-aided Verification, chapter Verification of rea-tie systes by successive over and under approxiation, pages Springer, [6] D. Dvorak, R. Rasussen, G. Reeves, and A. Sacks. Software architecture thees in JPLs Mission Data Syste. IEEE Aerospace Conference, [7] G. Frehse. PHAVer: Agorithic verification of hybrid systes past HyTech. Internationa Conference on Hybrid Systes: Coputation and Contro, [8] G. D. Giacoo and M. Y. Vardi. ECP-99, voue LNAI 1809, chapter Autoata-Theoretic Approach to Panning for Teporay Extended Goas, pages [9] T. A. Henzinger, P.-H. Ho, and H. Wong-Toi. HyTech: A ode checker for hybrid systes. Internationa Journa on Software Toos for Technoogy Transfer, [10] G. Hozann. The Spin Mode Checker: Prier and Reference Manua. Addison-Wesey, [11] M. Ingha, R. Rasussen, M. Bennett, and A. Moncada. Engineering copex ebedded systes with State Anaysis and the Mission Data Syste. AIAA Journa of Aerospace Coputing, Inforation and Counication, 2(12): , Deceber [12] H. Kress-Gazit, G. E. Fainekos, and G. J. Pappas. Wheres Wado? Sensor-based tepora ogic otion panning. IEEE Internationa Conference on Robotics and Autoation, pages , [13] G. Labinaz, M. M. Bayoui, and K. Rudie. A survey of odeing and contro of hybrid systes. Annua Reviews of Contro, [14] K. Larsen, P. Pettersson, and W. Yi. UPPAAL in a nutshe. Internationa Journa on Software Toos for Technoogy Transfer, 1(1-2): , [15] R. D. Rasussen. Goa-based faut toerance for space systes using the Mission Data Syste. IEEE Aerospace Conference Proceedings, 5: , March 2001.