Composition and correctness of heterogeneous planning systems

Abstract

Autonomous systems present many new opportunities, especially for exploration in hazardous environments. One technique for building increasingly capable planning systems is to compose existing planners to enable specialization and division of subproblems. These systems require new analysis techniques, appropriate for ensembles of planners, if they are to be trusted with safety- and mission-critical roles in the future. Current state-of-the-art techniques address parts of this problem--including analysis of middlewares such as ROS and complex control systems--but have not yet provided analysis methods to address the particular correctness needs of composite planning systems. Applying formal methods to model the internal communications of planning architectures is a promising way to address this gap.

In this thesis, I develop a formal modeling method which enables proofs of correctness for planning system architectures which use a rich common data structure for both their inputs and outputs. The method is demonstrated through a case study of Enterprise, a system of planners developed at the MIT Model-Based Embedded and Robotic Systems (MERS) group which communicate using the Qualitative State Plan (QSP). The verification requirements of this system inform the development of a formal semantics for first order logic, defined in terms of the common data structure, which is useful for modeling systems of planners. Sentences in this logic can be used to express formal specifications about a planner's behavior, including correctness properties which are important for autonomous operations of critical systems. Using the logic one can also describe systems of planners built around this common data structure.

Modeling of the Enterprise architecture and components in the case study demonstrates the usefulness of the technique. The analysis method allows varying the level of abstraction by permitting the assumption of certain component behaviors by the architect. This allows the analysis to treat planners as "black-box" implementations while describing the rest of the system. Systems of planners can be described using specification composition, which enables description of various architectures. The use of intuitionistic mathematics enables mechanization of the logic in a variety of computer proof assistants to enable machine-checked proofs and implementation of planners by refinement from specification. Mechanization and opportunities to extend the method to more expressive logics are discussed as future work.