ModelCheckingofRoboticControlSystems.pptVIP

Sebastian Scherer basti@ Model Checking of Robotic Control Systems Presenting: Sebastian Scherer Authors: Sebastian Scherer, Flavio Lerda, and Edmund M. Clarke Outline Motivation Why verification Scope Control software Method Case Study Conclusions Why verify robot software? Failure is expensive: Interplanetary exploration Crash / Rollover Autonomy increases responsibility: Human interaction Large forces and momenta The scope of our approach Control systems are implemented in software Main loop is only a small fraction of the control software: Initialization Exception handling Conversion Fatal bugs can be in any line of the code. Outline Motivation Method Capabilities Limitations Method Model Checking Case Study Conclusions Capabilities of our method Utilizes environment (plant) of the control system. Simulates behaviour: Determines stability. Models influence of noise. Checks performance specifications. Computes ranges of trajectories. Checks programming errors: Null pointer exceptions. Dead lock, concurrency bugs. Errors affecting the behavior. Code checked is identical to executed code. Limitations of our method Discrete method: Makes assertions only about a particular initial condition. Continuous states are approximated up to a fixed point precision. Precision often determines the length of a simulation trace and the size of the state space to explore. Noise is approximated by a discrete set of values. Detailed model: Requires model relating inputs and outputs. Additional memory and computation time. Assumptions: Time elapses only while tasks sleep. Unbounded variables like time and distance must be abstracted manually. Model check software with a physical environment Method Execute the source code. After all tasks sleep execute the environment. Equivalent states are not revisited. Method Software executes until all tasks yield. Method Software executes until all tasks yield. Commands are set. Sensors are read. Time elapses Method Software executes until all