Verifying REACT

1. Verifying REACT • Aleks Milisevic • Will Noble • Martin Rinard • Stelios Sidiroglou-Douskos • Damien Zufferey

2. Overview and Challenges • Programming robots + making sure it works [without a PhD in robotics/control theory/…] • Programming: • Interactions between robots • Interactions with the environment • Verification: • Discrete programs in a continuous world

3. Simple model vs real world • Coordination language: planning and functionality Discrete API / IR Continuous • Hybrid language: controller, sensor, and actuator

4. Coordination • Programming: model-based, event-driven paradigm • Global view of entire system • High-level: “move to” rather than setting power on the motor • Discrete time step and instantaneous actions • Verification • State-space exploration: exhaustive search of possible program executions to find incorrect behaviors • Discrete of state-space is “easier” to explore

5. Discretizing the world Semantics of (1,1): anywhere within the box abstraction of the real world Problem: spurious transitions (arbitrarily close to the borders) Solution: rather than being exact tolerate some error focus on the likely paths 1 2 1 2

6. Likely transitions 1 2 1 Steer the exploration toward likely paths and avoid spurious ones. On the other hand, bugs are mostly found in corner cases (unlikely). 2

7. Delay bounding • Let the verifier pick some unlikely transitions, i.e. introduce “delays”. Consider likely paths where a bounded number of improbable transitions can happen. • Strategy for bounding problems: • In the limit, equivalent to the original problem • Interesting things happens for low bounds • More practical / better complexity

8. Link to the actual world • Discrete controller + continuous dynamics = hybrid system • Finite automaton + ODEs • Complicated model, but simple properties: “move to (x,y,z)” (for a given robot and controller) • Is it doable ? Accurately enough ?

9. Hybrid system: example Spherical car moving along a line in frictionless vacuum. cruise accelerate obstacle stopped brake

10. Hybrid system: trace brake stopped accelerate cruise

11. Simulation vs verification Unfortunately, sensors and actuators have bias, noise, drift… • Looking at a few traces (simulation) is not enough. • To verify a system, we must ideally look at all the traces. • “Run” the system on intervals instead of points.

12. Hybrid system: flowpipes brake stopped accelerate cruise

13. Using the language to simplify the verification • Programing language: • Discrete: sample-hold controller • Continuous: ODEs from robot description • Model checking: • Turn the model into code, rather than extract model from code • Sample-hold: easier to check discrete and continuous separately • Property: simple movement (functionality checked in layer above)

14. Dynamic of robots • Typical verification of hybrid systems: Dynamic is given [by magic] • The robotic / mechanical engineering community seems to already have systems to specify the physical properties of robots: Constructive solid geometry + Bond graphs

15. Dynamic of robots controller Pointers to the appropriate references/tools are appreciated. Thx. Opportunities for collaborations.