Building SWIFI tools from temporal logic specifications

Software-implemented fault injection (SWIFI) is an established experimental technique to evaluate the robustness of software systems. While a large number of SWIFI frameworks exist, virtually all are based on a single-fault assumption, i.e., interactions of simultaneously occurring independent faults are not investigated. As software systems containing more than a single fault often are the norm than an exception [1] and current safety standards require the consideration of “multi-point faults” [2], the validity of this single-fault assumption is at question for contemporary software systems. To address the issue and support simultaneous SWIFI (simFI), we analyze how independent faults can manifest in a generic software composition model and extend an existing SWIFI tool to support some characteristic simultaneous fault types. We implement three simultaneous fault models and demonstrate their utility in evaluating the robustness of the Windows CE kernel. Our findings indicate that simultaneous fault injections prove highly efficient in triggering robustness vulnerabilities.

The integration of software COTS components into safety-critical real-time systems raises serious problems from a dependability viewpoint. Wrappers can be used to assist such an integration by providing additional error detection mechanisms. We recently defined a framework to automatically develop such a type of wrappers from temporal logic specifications. In this paper, we extend this framework to endow wrappers with forward error recovery capabilities based on the concept of recovery actions. Recovery actions consist of variants of basic functions of the target system that are run concurrently to help correct errors. We apply these comprehensive wrappers to a real-time COTS microkernel. Software implemented fault injection (SWIFI) is then used to evaluate the efficiency of the wrappers. This step helped identify the sets of wrappers that maximize the error detection and recovery coverage while meeting hard task deadlines.

In this paper, a motion planning system based on predictive control and temporal logic specifications is established for the welding dual-arm robot with gantry. Firstly, based on the spatial structure of the dual-arm robot with gantry, a novel mathematical model is presented between the joint variables and the terminal attitude and the quaternion replaces the Euler Angle to describe the posture for avoiding gimbal lock. Then a constraint model predictive controller is constructed for the multi-variable, nonlinear and coupling model of the robot and the constraints of the environment. Meanwhile, the temporal logic formula is used for describing the complex welding tasks and reducing the workload of repeated programming. Next the expectation values and constraints are converted by the temporal logic formula will be sent to the predictive controller one by one. Finally, the simulation result shows that the system can effectively solve the problem of motion planning for the welding dual-arm robot with gantry.

Software Implemented Fault Injection (SWIFI) is a well-established technique for fault injection, but with a significant drawback for Real-Time Systems: intrusiveness, also known as probe effect. In fact, for most fault models, additional code has to be run on the same processor that executes the application. The danger lies in some deadlines being missed as a consequence of that overhead. This paper identifies the sources of intrusiveness, and discusses the procedures to measure it. The question of what level of intrusiveness can be considered acceptable is also addressed. A Pentium version of an existing SWIFI tool (Xception), developed with no real-time considerations in mind, was tested on a system composed by off-the-shelf (COTS) components (a standard PC with a Pentium processor and a commercial real-time multitasking kernel). Data collected using this platform shows that the intrusiveness can be quite significant. A technique called Routine Specialization is proposed to lower that overhead. Results obtained from a real-time-oriented injector (RT-Xception) taken from the same system, show a very significant improvement. A comparison with data from other authors shows that with this change SWIFI becomes a viable technique for a wide range of real-time applications.

This paper proposes a novel version of the vehicle routing problem (VRP). Instead of servicing all the customers, feasible solutions of the VRP instance are forced to satisfy a set of complex high-level tasks given as a metric temporal logic (MTL) specification, which allows complex quantitative timing constraints to be incorporated into the problem. For the resulting vehicle routing problem with metric temporal logic specifications (VRPMTL), a mixed-integer linear programming (MILP) based algorithm is provided that solves the problem to optimality. Examples for optimal multi-UAV mission planning are provided where MTL is used as a high level language to specify complex mission tasks.

In control theory, models of physical processes, such as systems of differential equations, are usually checked against specifications, such as stability and set invariance. In formal methods, rich specifications, such as languages and formulae of temporal logics, are checked against models of software programs and digital circuits, such as finite transition graphs. With the development and integration of cyber physical and safety critical systems, there is an increasing need for computational tools for verification and control of complex systems from rich, temporal logic specifications. The formal verification and synthesis problems have been shown to be undecidable even for very simple classes of infinitespace continuous and hybrid systems. However, provably correct but conservative approaches, in which the satisfaction of a property by a dynamical system is implied by the satisfaction of the property by a finite over-approximation (abstraction) of the system, have received a lot of attention in recent years. Some classes of systems allowing for computationally efficient verification and control from temporal logic specifications are reviewed. For continuous and discrete-time linear systems and continuous-time multi-linear systems, it is shown that finite abstractions can be constructed through polyhedral operations only. By using techniques from model checking and automata games, this allows for verification and control from specifications given as Linear Temporal Logic (LTL) formulae over linear predicates in the state variables. A connection between the existence of Lyapunov functions and finite bisimulations is established for discrete-time linear and switched linear systems. Finally, optimality and correctness requirements are combined in a model predictive approach to generate control strategies for discrete-time linear systems. The usefulness of these computational tools is illustrated with various examples such as verification and synthesis of biological circuits in synthetic biology and motion planning and control in robotics.

In this paper, the problem of synthesizing a hybrid controller for a specification expressed as a temporal logic formula φ is considered. We propose a hierarchical approach which consists of three steps. First, the plant to be controlled is abstracted to a fully actuated system. Using the notion of approximate simulation relation, we design a continuous interface allowing the plant to track the trajectories of its abstraction with a guaranteed precision δ. The second step, which is also the main contribution of this paper, consists in deriving a more robust specification φ′ from the temporal logic formula φ such that given a trajectory satisfying φ′, any other trajectory remaining within distance δ satisfies φ. Third, we design a hybrid controller for the abstraction such that all its trajectories satisfy the robust specification φ′. Then, the trajectories of the plant satisfy the original specification. An application to the control of a second order model of a planar robot in a polygonal environment is considered.

In this paper, we study the problem of learning to satisfy temporal logic specifications with a group of agents in an unknown environment, which may exhibit probabilistic behaviour. From a learning perspective these specifications provide a rich formal language with which to capture tasks or objectives, while from a logic and automated verification perspective the introduction of learning capabilities allows for practical applications in large, stochastic, unknown environments. The existing work in this area is, however, limited. Of the frameworks that consider full linear temporal logic or have correctness guarantees, all methods thus far consider only the case of a single temporal logic specification and a single agent. In order to overcome this limitation, we develop the first multi-agent reinforcement learning technique for temporal logic specifications, which is also novel in its ability to handle multiple specifications. We provide correctness and convergence guarantees for our main algorithm – ALMANAC (Automaton/Logic Multi-Agent Natural Actor-Critic) – even when using function approximation. Alongside our theoretical results, we further demonstrate the applicability of our technique via a set of preliminary experiments.

The normal operation of synchronous modules may be temporarily suspended or finally aborted due to requests of their environment. Hence, if a temporal logic specification has already been verified for a synchronous module, then the available verification result can typically only be used if neither suspension nor abortion will take place. Also, the simulation of synchronous modules has to be finally aborted so that temporal logic specifications referring to infinite behaviors cannot be completely answered. In this paper, we therefore define transformations on temporal logic specifications to lift available verification results for synchronous modules without suspension or abortion to refined temporal logic specifications that take care of these preemption statements. This way, one can establish simulation and modular verification of synchronous modules in contexts where preemptions are used.KeywordsModel CheckTransition SystemTemporal LogicLinear Temporal LogicLinear Temporal Logic FormulaThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The fundamental idea of this work is to synthesize reactive controllers such that closed-loop execution trajectories of the system satisfies desired specifications that ensure correct system behaviors, while optimizing a desired performance criteria. We define the correctness of a system's behavior according to the system's relation to the environment, for example, the output trajectories of the system terminate in a goal set without entering an unsafe set. Using Metric Temporal Logic (MTL) specifications we can capture complex system behaviors and timing requirements, such as the output trajectories must pass through a number of way-points within a certain time frame before terminating in the goal set. Given a Mixed Logical Dynamical (MLD) system and system specifications in terms of MTL formula or simpler reach-avoid specifications, our goal is to find a closed-loop trajectory that satisfies the specifications, in non-deterministic environments. Using an MILP framework we search over the space of input signals to obtain such valid trajectories of the system, by adding constraints to satisfy the MTL formula only when necessary, to avoid the exponential complexity of solving MILP problems. We also present experimental results for planning a path in real-time for a mobile robot through a dynamically changing environment with a desired task specification.

In this paper, we investigate fully-automated controller synthesis of coordination strategies for multi-robot warehouse robotic systems. We consider the scenario where a group of automated guided vehicles (AGVs) deliver goods from starting locations to destinations in a grid-abstracted workspace. We propose a distributed framework with prioritized-based coordination strategy to fulfill the entire planning task. Specifically, the task of each AGV is specified by a Linear Temporal Logic (LTL) specification. The local control strategies are obtained by solving the corresponding LTL reactive synthesis problems. In order to avoid conflicts, we use the prioritized-based coordination strategy to guarantee that the overall systems is safe and live, i.e., AGVs will collide with each other and there is no deadlock and livelock. The proposed design methodology is correct-by-construction with the formal guarantee and is amenable to handle temporal tasks in a flexible manner. Furthermore, the proposed framework is distributed; hence computationally more efficient than the centralized approach. Finally, we demonstrate the proposed distributed framework by simulation examples.

Manipulation planning from high-level task specifications, even though highly desirable, is a challenging problem. The large dimensionality of manipulators and complexity of task specifications make the problem computationally intractable. This work introduces a manipulation planning framework with linear temporal logic (LTL) specifications. The use of LTL as the specification language allows the expression of rich and complex manipulation tasks. The framework deals with the state-explosion problem through a novel abstraction technique. Given a robotic system, a workspace consisting of obstacles, manipulable objects, and locations of interest, and a co-safe LTL specification over the objects and locations, the framework computes a motion plan to achieve the task through a synergistic multi-layered planning architecture. The power of the framework is demonstrated through case studies, in which the planner efficiently computes plans for complex tasks. The case studies also illustrate the ability of the framework in intelligently moving away objects that block desired executions without requiring backtracking.

We present an energy storage controller synthesis method for power systems with respect to metric temporal logic (MTL) specifications. The power systems with both constant impedance loads and constant power loads are modeled as a set of differential–algebraic equations. After a fault is cleared, with uncertainties in the fault clearing time, the generator machine angles and rotor speed deviations will enter a set of postfault initial states. We use the robust neighborhood approach to cover this set using the initial robust neighborhoods of finitely many simulated postfault trajectories. These simulated postfault trajectories meet the frequency regulation requirements specified in MTL as they are driven by the optimal control input signals obtained through a functional gradient descent approach. In this way, all the possible postfault trajectories with the given uncertainties in the fault clearing time are guaranteed to satisfy the MTL specification. Furthermore, we learn a piecewise linear control law from the data of the simulated trajectories to generate a feedback controller.

This article investigates a collaborative rover-copter path planning and exploration with temporal logic specifications under uncertain environments. The objective of the rover is to complete a mission expressed by a syntactically co-safe linear temporal logic (scLTL) formula, while the objective of the copter is to actively explore the environment and reduce its uncertainties, aiming at assisting the rover and enhancing the efficiency of the mission completion. To formalize our approach, we first capture the environmental uncertainties by environmental beliefs of the atomic propositions, under an assumption that it is unknown which properties (or, atomic propositions) are satisfied in each area of the environment. The environmental beliefs of the atomic propositions are updated according to the Bayes rule based on the Bernoulli-type sensor measurements provided by both the rover and the copter. Then, the optimal policy for the rover is synthesized by maximizing a belief of the satisfaction of the scLTL formula through an implementation of an automata-based model checking. An exploration policy for the copter is then synthesized by employing the notion of an entropy that is evaluated based on the environmental beliefs of the atomic propositions, and a path that the rover intends to follow according to the optimal policy. As such, the copter can actively explore regions whose uncertainties are high and that are relevant to the mission completion. Finally, some numerical examples illustrate the effectiveness of the proposed approach.

We develop a sampling-based motion planning algorithm that combines long-term temporal logic goals with short-term reactive requirements. The mission specification has two parts: (1) a global specification given as a linear temporal logic (LTL) formula over a set of static service requests that occur at the regions of a known environment, and (2) a local specification that requires servicing a set of dynamic requests that can be sensed locally during the execution. The proposed computational framework consists of two main ingredients: (a) an off-line sampling-based algorithm for the construction of a global transition system that contains a path satisfying the LTL formula; and (b) an on-line sampling-based algorithm to generate paths that service the local requests, while making sure that the satisfaction of the global specification is not affected. The off-line algorithm has four main features. First, it is incremental, in the sense that the procedure for finding a satisfying path at each iteration scales only with the number of new samples generated at that iteration. Second, the underlying graph is sparse, which implies low complexity for the overall method. Third, it is probabilistically complete. Fourth, under some mild assumptions, it has the best possible complexity bound. The on-line algorithm leverages ideas from LTL monitoring and potential functions to ensure progress towards the satisfaction of the global specification while servicing locally sensed requests. Examples and experimental trials illustrating the usefulness and the performance of the framework are included.