Formal Methods for Automatic Deployment of Robotic Teams

ION In this article, we assume that the dynamics of the individual robots are described by differential equations ẋi = fi(xi,ui), i= 1, . ,n, where xi is the state of the i-th robot and ui is its control. For example, for the Khepera III robots we use in our experiments, and which can be modeled as unicycles, the state is composed of position and orientation in the plane, and the control consists of translational and rotational velocities, which can be immediately mapped to speeds of the two wheels. As already stated, in order to use formal verification techniques that allow for rich specification languages, we need to develop finite models of robot motion through a process called abstraction. To begin this process, we observe that common task specifications are given with respect to regions of the environment or properties associated with these regions. The environment can then be geometrically partitioned based on these regions of interest. Such a discretization of the environment allows us to control robots with realistic continuous dynamics using finite models of robot motion (i.e., finite transition systems), by employing results on the constructions of finite quotients for continuous and hybrid systems [9], [13]. The key idea is to establish a certain notion of “equivalence” between an infinite control system (ẋi = fi(xi,ui)) describing the motion of a robot in a partitioned environment and a finite transition system Ti describing the motion of a robot between vertices of a graph. This notion of equivalence allows us to solve the original problem with finite transition systems, while guaranteeing the correctness of the solution for the original continuous robot dynamics. It also drastically reduces the computational complexity required to solve the problem. The graph on which the transition system evolves is the partition quotient of the environment, i.e., the vertices of this graph label regions defined by the partition and the edges correspond to adjacency relations. A transition system Ti = (V,v0i,→i) is a finite state system with states V (the set of vertices of the environmental quotient graph), an initial state v0i (starting region), and transitions →i in between adjacent vertices. The transitions →i of each Ti capture the motion capabilities of robot i. If a controller can be designed to drive the robot from any point within a region v to exit through a desired facet and enter an adjacent region v′ in finite time, then we allow the transition v→i v′ in the corresponding transition system. Thus, there is a one-on-one correspondence between a transition in →i and a motion primitive in the form of a state feedback controller u ′ i (xi). Moreover, at a region v, we can choose any of its available transitions, by implementing the corresponding motion primitive. Therefore, the transition system Ti is deterministic. We usually omit the motion primitive u ′ i (xi) since it is captured by the transition v→i v′. For popular partition schemes including simplicial [7], [9], rectangular [8] and polyhedral [2], [13], [19], [26] decompositions1, continuous feedback controllers that drive a robot from any point inside a region to a desired facet have been developed for linear, piecewise-affine, and non-holonomic (unicycle) dynamical models. Moreover, these feedback controllers can often be designed with computationally efficient procedures using only polyhedral operations. Similar procedures can be used to design controllers so that a region v is an invariant for the trajectories of the continuous system (i.e., a robot is controlled to stay inside region v). In this case the controller corresponds to the transition v→i v. Once such a transition system Ti is constructed, we can see that it is equivalent to the continuous control system in this sense: Following a sequence of transitions on Ti is equivalent to moving through the sequence of corresponding regions using the motion primitive paired with each transition. In fact, the transition system Ti and the continuous system can be formally related by either “simulation” or “bisimulation” relations [22], which are strong notions of equivalence between two systems. We use a sequence of transitions to control a robot modeled as a finite deterministic transition system. A sequence of transitions on a transition system can always be executed by implementing the lower level motion primitive corresponding to each transition. Thus, this robot control strategy is hybrid in nature (the robot uses a different continuous controller depending on its current transition). As an example, consider deploying Khepera robots modeled by unicycle dynamics in a 2-D rectangular environment with polygonal regions {π1,π2,π3,π4} of interest (see Fig. 2). A polygonal partition of the environment can be quickly and efficiently constructed. A set of affine vector fields can be 1Such partitions can only be performed if regions of interest are polyhedral, which we assume here. This is not a strong limitation since regions of any shape can be bounded by polytopes with arbitrarily close approximations.