Assured Graceful Degrada/on with Discrete Controller Synthesis

Size: px

Start display at page:

Download "Assured Graceful Degrada/on with Discrete Controller Synthesis"

Audra Grant
5 years ago
Views:

1 Assured Graceful Degrada/on with Discrete Controller Synthesis Kenji Tei Na/onal Ins/tute of Informa/cs Joint work with Kazuya Aizawa, Waseda University Nicolas D Ippolito, Universidad de Buenos Aires

2 Assurance at development /me control controller (so.ware) monitor environment goal M E = G

3 Modeling approach : LTS and FLTL M and E : labeled transi:on system (LTS) G : fluent linear temporal logic (FLTL) M controllable ac:ons (c1,c2,c3,c4) E G c4 u4 c1 u1 u2 c2 c1 c4 c3 u4 u1 u2 c2 p1 p2 p3 uncontrollable ac:ons (u1,u2,,u4)

4 Example : Automated Warehouse move.e arrive.m controller (so.ware) move.e arrive.e pickup environment pickup- success

5 Modeling an environment by LTS E = (MAP W_ROBOT). MAP=(arrive[ w] - > MAP[ w]), MAP[ w]=( move[ e] - > arrive[ m] - > MAP[ m] move[ w] - > arrive[ w] - > MAP[ w] putdown - > putsuccess - > MAP[ w] pickup - > pickupfail - > MAP[ w]), MAP[ m]=( move[ e] - > arrive[ e] - > MAP[ e] move[ w] - > arrive[ w] - > MAP[ w] putdown - > pu^ail - > MAP[ m] pickup - > pickupfail - > MAP[ m]), MAP[ e]=( move[ e] - > arrive[ e] - > MAP[ e] move[ w] - > arrive[ m] - > MAP[ m] putdown - > pu^ail - > MAP[ e] pickup - > pickupsuccess - > MAP[ e]). W_ROBOT=(arrive[ w] - > ROBOT), ROBOT= (move[direc/on] - > arrive[loca/ons] - > ROBOT pickup - > (pickupsuccess - > ROBOT pickupfail - > ROBOT) putdown - > (putsuccess - > ROBOT pu^ail - > ROBOT) ended - > reset - > ROBOT). Modeling how the state of the env. is changed and how the env. will react

6 Specifying Goals by FLTL []((AT[ w] && X(move[ e])) - > X(!arrive[ w] W pickupsuccess)) []((AT[ e] && X(move[ w])) - > X(!arrive[ e] W putsuccess)) [](putdown- >AT[ w]) []!(!<pickupsuccess,putsuccess> && putdown) [](pickup- >AT[ e]) []!(<pickupsuccess,putsuccess> && pickup) [](<ended,reset> - > (<pickupsuccess,{reset}> && <putsuccess,{reset}>)) fluent AT[x:Loca/ons] = <arrive[x],{move[direc/on]}\{move[x]}>

7 A way to generate M with assurance discrete controller synthesis [D Ippolito, 2010] [D Ippolito, 2011] solve a control problem <E,G> to find an LTS M E G c1 c4 c3 u4 p1 p2 p3 u2 c2 Controller Synthesizer c4 u4 c1 u2 c2 M

8 E may be invalid at run/me control controller (so.ware) monitor environment goal M E = G System may no longer work, or may con4nue, but without any assurances

9 Assuming More Realis/c... MAP[ w]=( move[ e] - > arrive[ m] - > MAP[ m] move[ w] - > arrive[ w] - > MAP[ w] putdown - > putsuccess - > MAP[ w] pickup - > pickupfail - > MAP[ w]),... []((AT[ w]0&&0x(move[ e]))07>0x(!arrive[ w]0w0pickupsuccess))0 []((AT[ e]0&&0x(move[ w]))07>0x(!arrive[ e]0w0putsuccess))0 [](putdown7>at[ w])0 []!(!<pickupsuccess,putsuccess>0&&0putdown)0 [](pickup7>at[ e])0 []!(<pickupsuccess,putsuccess>0&&0pickup)0 [](<ended,reset>07>0(<pickupsuccess,{reset}>0&&0<putsuccess,{reset}>))0... MAP[ w]=( move[ e] - > (arrive[ m] - > MAP[ m] (arrive[ w] - > MAP[ w]) move[ w] - > arrive[ w] - > MAP[ w] putdown - > putsuccess - > MAP[ w] pickup - > pickupfail - > MAP[ w]),... []((AT[ w]0&&0x(move[ e]))07>0x(!arrive[ w]0w0pickupsuccess))0 []((AT[ e]0&&0x(move[ w]))07>0x(!arrive[ e]0w0putsuccess))0 [](putdown7>at[ w])0 []!(!<pickupsuccess,putsuccess>0&&0putdown)0 [](pickup7>at[ e])0 []!(<pickupsuccess,putsuccess>0&&0pickup)0 [](<ended,reset>07>0(<pickupsuccess,{reset}>0&&0<putsuccess,{reset}>))0

10 How much should we assume? high E op:mis:c G rich rich risk Everything works ideally Everything can go wrong func:onality low E pessimis:c G poor poor

11 Graceful Degrada/on by Self- adapta/on M E G adapta/on engine M E G controller (so.ware) control monitor environment goal relaxed goal

12 Ques/ons How can the system be made to degrade gracefully with assurance? How can the system determine how much it should degrade?

13 Objec/ve We propose a framework for adapta/on engine enabling graceful degrada/on G G M E = G M simulate M Avoiding too much degrada:on should not degrade the system too much Providing assurance should assure that the system aoer degrada/on sa/sfies a selected level of goals Performing degrada:on seamlessly should not stop or restart the system M should simulate M

14 Approach : Models@Run./me Revising environment model at run/me to fit the environment Genera/ng behavior specifica/on with assurance at run/me by using algorithmic techniques, in par/cular discrete controller synthesis Change behavior of the system in accordance with the generated model

15 Overall architecture func/onality level selec/on G 1 G N Analyzer Adapta:on Engine 2. determine func. level G i cached controllers Planner discrete controller synthesis 1. update env. model E knowledge M 3. generate controller Monitor Executer env. model learning execu:on traces enactment M control 4. hot- swap controller enactor System

16 0. Ini/aliza/on 1. Specify levels of func:onali:es G 1... G N 2. Describe the ini:al environment model E 0 c4 c3 u2 c2 c1 u4 3. Select a func. level and construct the ini:al controller c1 u4 G i M 0 c4 u2 c2

1. Monitor: Environment Model Updates update E t to generate E t+1 so that E t+1 can explain execu/on traces of the system find and add unmodeled uncontrollable transi/ons When a robot performed move.

17 1. Monitor: Environment Model Updates update E t to generate E t+1 so that E t+1 can explain execu/on traces of the system find and add unmodeled uncontrollable transi/ons When a robot performed move.w ac/on at e, the environment will respond arrive.m or arrive.e rule learning for environment model update[sykes,2013] c1 u4 '#()*+,&! 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 " #! 0(0<,64 0"#%&")),&>! -)(##,&! c4 c3 u2 c2 E t E t+1 Δ t+1 Monitor c1 c4 c3 u4 u2 c (%,4,#7348"6,)4!"#$%"&! %'%()*+,- $./(%#!!! $! B#"?),6A,!,#(0%8,#%! 0"#%&")),&4./,01%,&! ;34<"%=>?(54 0"#%&")),&4 execu:ng trace 0"#%&")!!"#$%&!

be explained later) 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 0(0<,64 0"#%&")),&>! G 1.

18 2. Analysis: Func/onality- level Selec/on Determine a func/onality level G j from {G 1,...G N } G j can be sa/sfied in E t+1 The system can degrade to G j without stopping or restar/ng itself Func/onality level selec/on (will be explained later) 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 0(0<,64 0"#%&")),&>! G 1... current level E t+1 c1 G i c4 u4 u2 G N c2 Analyzer G j '#()*+,&! (%,4,#7348"6,)4!"#$%"&! %'%()*+,- $./(%#! " #!!! $! B#"?),6A,!,#(0%8,#%! $! 0"#%&")!!"#$%&! 0"#%&")),&4./,01%,&! ;34<"%=>?(54 0"#%&")),&4 c3

3. Plan: Discrete Controller Synthesis Generate an LTS M t+1 guaranteeing sa/sfac/on of G j in E t+1 Discrete controller synthesis [D Ippolito, 2010] [D Ippolito, 2011] solve a control problem <E,G>

19 3. Plan: Discrete Controller Synthesis Generate an LTS M t+1 guaranteeing sa/sfac/on of G j in E t+1 Discrete controller synthesis [D Ippolito, 2010] [D Ippolito, 2011] solve a control problem <E,G> to find an LTS M E t+1 u4 c1 M u2 t+1 c4 c2 u4 c3 c1 Planner c4 G j u2 c2 '#()*+,&! (%,4,#7348"6,)4!"#$%"&! %'%()*+,- $./(%#! 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 " #!!! $! B#"?),6A,!,#(0%8,#%! $! 0"#%&")!!"#$%&! 0(0<,64 0"#%&")),&>! 0"#%&")),&4./,01%,&! ;34<"%=>?(54 0"#%&")),&4

4. Execute: Enactor Hot- swap controller model from M t to M t+1 It can be done without

interpret LTS and orchestrate high- level opera/ons provided by the system E t+1 c4 u4 c1

0(0<,64 0"#%&")),&>! -)(##,&! u4 c1 c4 u1 c2 u2 enactor 234156(%,4,#7348"6,)4!"#$%"&!

20 4. Execute: Enactor Hot- swap controller model from M t to M t+1 It can be done without stopping the system because M t+1 simulates M t Enactment framework [Braberman, 2013] interpret LTS and orchestrate high- level opera/ons provided by the system E t+1 c4 u4 c1 u2 c2 Executer '#()*+,&! 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 " #! 0(0<,64 0"#%&")),&>! -)(##,&! u4 c1 c4 u1 c2 u2 enactor (%,4,#7348"6,)4!"#$%"&! %'%()*+,- $./(%#!!! $! 0"#%&")),&4./,01%,&! ;34<"%=>?(54 0"#%&")),&4 $! System 0"#%&")!!"#$%&!

21 Q: How can the system determine how much it should degrade? 01/2$/*+,-3,45,%! 9346,%,&8$#,4:1#034),7,)4 0(0<,64 0"#%&")),&>! G 1... current level E t+1 G i u4 c1 u1 u2 c4 c3 G N c2 Analyzer How does the system find the highest level? M t+1 exists such that (1) M t+1 E t+1 = G j (provide assurance) G j '#()*+,&! (%,4,#7348"6,)4!"#$%"&! %'%()*+,- $./(%#! G j " #!!! $! B#"?),6A,!,#(0%8,#%! $! 0"#%&")!!"#$%&! 0"#%&")),&4./,01%,&! ;34<"%=>?(54 0"#%&")),&4 (2) M t+1 simulate M t (perform degrada:on seamlessly)

22 Naive Strategy : Synthesize, then check Solve a control problem <E t+1,g i > [synthesized] Pick up G j [!synthesized] Check M t+1 sim. M t Simple and straigh^orward synthesized controller M t+1 can be used for the next controller Computa/onally inefficient N control problems should be solved at worst [simulate] [!simulate] G j M t+1

Advanced Strategy: Check without Synthesis Pick up G i Update winning region for E t+1 and G j Check whether M t forces E t+1 to the winning region winning region W Gi,Et the set of all states s such

23 Advanced Strategy: Check without Synthesis Pick up G i Update winning region for E t+1 and G j Check whether M t forces E t+1 to the winning region winning region W Gi,Et the set of all states s such that no system forces E t to sa/sfy G i from s controller strategy should avoid the winning region e.g. a winning region for G i = p a10 u W Gi a7 c a1 x u a6 v z c a5 u a3 c p a9 a4 u a8 c y u a2 w c [!reached] G j [reached] update winning region W Gi,Et+1 is obtained from W Gi,Et and Δ t+1 determine states newly added in the region by checking updated part in env. model

24 Advanced Strategy: Check without Synthesis Et+1 Pick up G i Update winning region for E t+1 and G j M t a10 u W Gi a7 c a1 x u a6 v z c a5 u a3 c p a9 a4 u a8 c y u a2 w c Check whether M t forces E t+1 to the winning region Does M t E t+1 reach to W Gi,Et+1? if yes, M t+1 does not exist such that M t+1 E t+1 = G j [reached] M t+1 simulate M t [!reached] G j

25 Case studies automated warehouse produc/on cell

26 Automated Warehouse!"!#$%&'(%)!(*+!#,! '!!" &#!" &!!" %#!" %!!" $#!" 012(342)5678"5+9+5"*+5+(342" (427:455+:"*827;+*6*" For func. selec/on!! '" &#$" For func. selec/on + controller synthesis!! #!!" +!" *!" $!!" #!" &" )!" (!"!"!#$%&'(%)!(*+!#,! '!!" &#!" &!!" %#!" %!!" $#!" $!!"!" ()*+$" 012(342)5678"5+9+5"*+5+(342" (427:455+:"*827;*6*" Naive strategy ()*+%" ()*+&" ()*+'" ()*+#" ()*+," ()*+-" ()*+." ()*+/" ()*+$!" ()*+$$" ()*+$%" ()*+$&" ()*+$'" ()*+$#" %#$" %"!#$"!" ()*"+,-./0-)1234"15651" 7515./0-" 0.7% in the worst % on average '!" &!" %!" $!" #!"!",-."/0123" 35.8% in the worst 13.6% on average #!"!" ()*+$" ()*+%" Advanced strategy ()*+&" ()*+'" ()*+#" ()*+," ()*+-" ()*+." ()*+/" ()*+$!" ()*+$$" ()*+$%" ()*+$&" ()*+$'" ()*+$#"

27 Produc/on Cell '#!!!" 012(342)5678"5+9+5"*+5+(342"!"!#$%&'(%)!(*+!#,! '!!!!" &!!!" %!!!" $!!!" (427:455+:"*827;+*6*" For func. selec/on!!!#!'"!#!&$" For func. selec/on + controller synthesis!! #!!" +!" *!" #!!!"!#!&" )!"!" '#!!!" ()*+'" 012(342)5678"5+9+5"*+5+(342" ()*+#" ()*+," ()*+$" ()*+-" ()*+%" ()*+." ()*+&" ()*+/" ()*+'!" ()*+''" ()*+'#" Naive strategy ()*+'," ()*+'$" ()*+'-"!#!%$"!#!%" (!" '!" &!" %!" '!!!!" (427:455+:"*827;+*6*"!#!!$" $!"!"!#$%&'(%)!(*+!#,! &!!!" %!!!" $!!!" #!!!"!" ()*"+,-./0-)1234" 15651"7515./0-" 2.5% in the worst 0.176% on average #!"!",-."/0123" 99.2% in the worst 44.9% on average!" ()*+'" ()*+#" Advanced strategy ()*+," ()*+$" ()*+-" ()*+%" ()*+." ()*+&" ()*+/" ()*+'!" ()*+''" ()*+'#" ()*+'," ()*+'$" ()*+'-"

28 Conclusion How does the system cope with development /me uncertainty? How do we select appropriate level of func/onality considering risks and func/onality? We propose a framework enabling graceful degrada/on revise environment run/me generate behavior specifica/on with run/me change behavior of the run/me We introduce two strategies to find the highest level of func/onality that can be guarantee and to which the system can seamlessly degrade

Kenji Tei Associate Professor National Institute of Informatics, Japan

Kenji Tei Associate Professor National Institute of Informatics, Japan tei@nii.ac.jp http://researchmap.jp/teikenji/?lang=english Joint work with Moeka Tanabe, Ezequiel Castellano, Leandro Nahabedian,