Formal verification provides strong safety guarantees but only for models of cyber-physical systems. Hybrid system models describe the required interplay of computation and physical dynamics, which is crucial to guarantee what computations lead to safe physical behavior (e.g., cars should not collide). Control computations that affect physical dynamics must act in advance to avoid possibly unsafe future circumstances. Formal verification then ensures that the controllers correctly identify and provably avoid unsafe future situations under a certain model of physics. But any model of physics necessarily deviates from reality and, moreover, any observation with real sensors and manipulation with real actuators is subject to uncertainty. This makes runtime validation a crucial step to monitor whether the model assumptions hold for the real system implementation. The key question is what property needs to be runtime-monitored and what a satisfied runtime monitor entails about the safety of the system: the observations of a runtime monitor only relate back to the safety of the system if they are themselves accompanied by a proof of correctness! For an unbroken chain of correctness guarantees, we, thus, synthesize runtime monitors in a provably correct way from provably safe hybrid system models. This paper addresses the inevitable challenge of making the synthesized monitoring conditions robust to partial observability of sensor uncertainty and partial controllability due to actuator disturbance. We show that the monitoring conditions result in provable safety guarantees with fallback controllers that react to monitor violation at runtime.
In @cite_22 , offline model checking is combined with runtime monitoring for path planning of robots. For offline verification, the method that motion of the robot stays inside a tube around the planned path; staying inside the tube is monitored at runtime. This can only be sound when augmented with additional assumptions on the continuous dynamics between sampling points @cite_32 , which we handle explicitly in our approach @cite_20 . We do not ignore physics models and environment behavior and therefore, our monitors:
@cite_32 @cite_22 @cite_20
1983526786 2127240436 2154912862 2024382047
This paper focuses on the design of a tube-based Model Predictive Control law for the control of constrained mobile robots in off-road conditions with longitudinal slip while ensuring robustness and stability. A time-varying trajectory tracking error model is used, where uncertainties are assumed to be bounded and additive. The robust tube-based MPC is compared with other motion control techniques through simulation and physical experiments. These tests show the satisfactory behavior of the presented control strategy. Formal verification and validation play a crucial role in making cyber-physical systems (CPS) safe. Formal methods make strong guarantees about the system behavior if accurate models of the system can be obtained, including models of the controller and of the physical dynamics. In CPS, models are essential; but any model we could possibly build necessarily deviates from the real world. If the real system fits to the model, its behavior is guaranteed to satisfy the correctness properties verified with respect to the model. Otherwise, all bets are off. This article introduces ModelPlex, a method ensuring that verification results about models apply to CPS implementations. ModelPlex provides correctness guarantees for CPS executions at runtime: it combines offline verification of CPS models with runtime validation of system executions for compliance with the model. ModelPlex ensures in a provably correct way that the verification results obtained for the model apply to the actual system runs by monitoring the behavior of the world for compliance with the model. If, at some point, the observed behavior no longer complies with the model so that offline verification results no longer apply, ModelPlex initiates provably safe fallback actions, assuming the system dynamics deviation is bounded. This article, furthermore, develops a systematic technique to synthesize provably correct monitors automatically from CPS proofs in differential dynamic logic by a correct-by-construction approach, leading to verifiably correct runtime model validation. Overall, ModelPlex generates provably correct monitor conditions that, if checked to hold at runtime, are provably guaranteed to imply that the offline safety verification results about the CPS model apply to the present run of the actual CPS implementation. Building a model of the environment is essential for mobile robotics. It allows the robot to reason about its sourroundings and plan actions according to its intentions. To enable safe motion planning it is vital to anticipate object movements. This paper presents an improved formulation for occupancy filtering. Our approach is closely related to the Bayesian Occupancy Filter (BOF) presented in [4]. The basic idea of occupancy filters is to represent the environment as a 2-dimensional grid of cells holding information about their state of occupancy and velocity. To improve the accuracy of predictions, prior knowledge about the motion preferences is used, derived from map data that can be obtained from navigation systems. In combination with a physically accurate transition model, it is possible to estimate the environment dynamics. Experiments show that this yields reliable estimates even for occluded regions. As sampling-based motion planners become faster, they can be reexecuted more frequently by a robot during task execution to react to uncertainty in robot motion, obstacle motion, sensing noise, and uncertainty in the robot's kinematic model. We investigate and analyze high-frequency replanning (HFR) where, during each period, fast sampling-based motion planners are executed in parallel as the robot simultaneously executes the first action of the best motion plan from the previous period. We consider discrete-time systems with stochastic nonlinear (but linearizable) dynamics and observation models with noise drawn from zero mean Gaussian distributions. The objective is to maximize the probability of success (i.e., avoid collision with obstacles and reach the goal) or to minimize path length subject to a lower bound on the probability of success. We show that, as parallel computation power increases, HFR offers asymptotic optimality for these objectives during each period for goal-oriented problems. We then demonstrate the effectiveness of HFR for holonomic and nonholonomic robots including car-like vehicles and steerable medical needles.