Butler, Michael

Paxton, Martin

Waldron, Xanthippe

Wilkinson, Toby

Southampton (e-Prints Soton)

A Formal Approach to Multi-UAV RouteValidation?Toby Wilkinson??, Michael Butler, Martin Paxton, and Xanthippe WaldronUniversity of Southampton, UK{stw08r, mjb}@ecs.soton.ac.ukTEKEVER Ltd, UK{martin.paxton, xanthippe.waldron}@tekever.comAbstract. We present ongoing work to apply Event-B to the valida-tion of routes for an Unmanned Aircraft System consisting of a GroundControl Station and two or more UAVs. We extend the mathematicallanguage of Event-B to include a theory of continuous paths in 3-D Eu-clidean space that allows important safety properties describing the safeseparation of UAVs to be formalised in a natural manner. Refinement ofthe model allows a mathematically verified route validator algorithm tobe systematically derived.Keywords: Event-B, Autonomous Systems, Verification.1 IntroductionThe capabilities of Unmanned Aircraft Systems (UAS) are rapidly increasing,but this makes the task of demonstrating that such systems are safe increasinglydifficult. This difficulty manifests itself in two ways; the inherent complexityof the systems themselves, and the compressed timescales under which thesesystems are developed.To address these issues engineers need better ways to capture and analyse thesystem requirements, and better ways for building modular systems, in whichthe verification evidence for individual components can be combined to provideverification evidence for the system as a whole. DO-178C [7] opens the door tothe use of formal methods in the certification of civil aircraft, and this approachis also applicable to the development of Unmanned Aircraft Systems.An emerging scenario is for a single UAS to have multiple UAVs that collab-orate to perform a collection of tasks. For such a system, even if it is deployed in? This document is an overview of MOD sponsored research and is released to informprojects that include safety-critical or safety-related software. The information con-tained in this document should not be interpreted as representing the views of theMOD, nor should it be assumed that it reflects any current or future MOD pol-icy. The information cannot supersede any statutory or contractual requirements orliabilities and is offered without prejudice or commitment.?? Supported by the ASUR Programme project 1014 C6 PH1 104.2 T. Wilkinson, M. Butler, M. Paxton, and X. Waldronsegregated airspace, there is still a safety requirement that at all times the UAVsremain a safe distance apart. The routes that are assigned to the UAVs musttherefore be checked to determine that they are safe. One possible architecturefor such a UAS is to have a separate route validator function that checks theoutput of the planning function that generates the routes. The idea being thatthe route validator can be made simpler than the route generator, and thereforeits correctness more easily shown.In this paper we present ongoing work to demonstrate how a route validatorfunction can be systematically derived from a natural mathematical formulationof the properties required of a set of routes (one per UAV) to be safe. We dothis by extending the mathematical language of the formal method Event-Bwith a mathematical theory of continuous paths in 3-D Euclidean space. Thisallows safety properties like minimum safe separation to be naturally and clearlyformalised. Then through systematic refinement the model can be refined to oneyielding a mathematically verified algorithm for route validation. A key step inthe refinement chain is the data refinement of the continuous path associatedwith each UAV with a corresponding list of waypoints. The gluing invariantthen reconstructs each UAV’s route as the piecewise linear path between thewaypoints. Proof obligations are generated to ensure that these paths are indeedcontinuous.In a final step we aim to (manually at this stage) produce code that imple-ments the verified algorithm.2 Event-BEvent-B [2] is a development of the B-Method [1] that extends the scope offormal modelling to allow for reasoning at the system level. This distinguishesEvent-B from traditional program verification methods like Hoare logic [5] thatonly allow for reasoning about the software parts of a system.Event-B uses set theory and first-order logic as a modelling notation, and oneof the key features of Event-B is the support for refinement. Through refinementa system can be represented at different levels of abstraction, and mathematicalproof is used to verify the consistency between refinement levels.The modelling approach is to construct an initial abstract model that de-scribes the main purpose of the system, and successively refine this model tolayer in other features. Each refinement step modifies or extends the model inorder to introduce new functionality, or add further details of how some goal isachieved. The resulting chain of refinements facilitates abstraction since it al-lows us to postpone treatment of some system features to later refinement steps.Abstraction and refinement together allow us to manage system complexity.System properties that must always remain true are defined in a model asinvariants on the model variables, and Event-B defines proof obligations to en-sure that the invariants are preserved by all events. The refinement of a model(usually referred to as the abstract model) by another model (referred to as theconcrete model) also generates proof obligations, and these must be dischargedA Formal Approach to Multi-UAV Route Validation 3in order to show that any behaviour of the concrete model satisfies the abstractbehaviour. Gluing invariants are used to specify the relationship between thevariables of the abstract and concrete models, and give rise to proof obligationsfor pairs of abstract and corresponding concrete events.The Rodin Platform is an Eclipse-based open source IDE for Event-B thatprovides effective support for refinement and mathematical proof [3]. Rodin in-cludes automatic tools to generate the proof obligations associated with a model,and provers that attempt to automatically discharge these obligations.Rodin can also be extended with plug-ins that provide additional function-ality, and these include:1. ProB a model checker and animator [6].2. The UML-B plug-in which supports modelling and refinement of class dia-grams and state machines, and translates models into Event-B [8].3. The Theory plug-in which supports extension of the mathematical modellinglanguage of Event-B, and associated proof rules for the Rodin provers [4].3 Case Study: Multi-UAV Route ValidationOur case study is route validation for a UAS (Unmanned Aircraft System) con-sisting of a Ground Control Station (GCS) and two or more UAVs. The casestudy itself is synthetic, but has been developed in conjunction with TEKEVERLtd 1, and is therefore representative of a real system.In this hypothetical system, the GCS (in conjunction with the operator)generates a route for each of the UAVs (possibly generated by some planningalgorithm based upon a set of tasks), and these are then checked by a routevalidator to determine that they are safe.The route validator must ensure that a set of routes (one per UAV) satisfythe following safety properties:1. Mutual deconfliction (safe separation between UAVs).2. That the UAVs stay within airspace constraints (the segregated airspaceassigned to the UAS and any no-fly areas).3. That the UAVs avoid terrain and other obstacles.The main focus in the case study will be on the first of these, the need tomaintain safe separation between UAVs.The output from the case study will be a (manually generated) implemen-tation of the mathematically verified route validator. TEKEVER aim to testthis implementation in one of their systems, however a complete solution willrequire further development. For example, one question that would need to beaddressed is how do the new routes sit with respect to a UAV’s current position,capabilities, and status?1 TEKEVER is a company headquartered in Portugal, with an Aerospace, Security,Defence and Space division focusing on the development of unmanned systems, in-cluding UAVs. The company has a number of different UAV platform types rangingfrom smaller hand-launched aircraft through to >4m wingspan multi-sensor plat-forms that are being developed in part for maritime search and patrolling missions.4 T. Wilkinson, M. Butler, M. Paxton, and X. Waldron4 Our ApproachThe idea behind our approach, is that through the development of domain spe-cific mathematical theories, it is be possible to provide an environment in whichcomplex safety properties can be easily and clearly stated. Moreover, such anenvironment can facilitate experimentation with different formulations of sys-tem safety properties during the requirements gathering and analysis phases ofsystem development.For example, in our case study two possible formal statements of the decon-fliction safety property may be:∀a, b ∈ U . ∀t ∈ R . a 6= b⇒ min sep ≤ d(ra(t), rb(t)),or∀a, b ∈ U . ∀t ∈ R . a 6= b⇒ ∀ta, tb ∈ (t−∆t, t+∆t) . min sep ≤ d(ra(ta), rb(tb)).Here U is a set of UAVs, and the first statement says that for any pair a andb of distinct UAVs, and any time t, then the distance between the position ra(t)of a at time t, and the position rb(t) of b, is at least min sep.The second statement is similar, but now allows for the fact that the UAVsmay not keep to the time schedule associated with their routes, and instead mayarrive early or late at any point. Here ∆t is some fixed bound on how early orlate we believe a UAV could be.In both formulations, ra:R → R3 is a continuous path in 3-D Euclideanspace, and d:R3 × R3 → [0,∞) is the usual Euclidean metric. Thus in ourformalisation of the safety properties we are working with real numbers (definedaxiomatically and including the least upper bound axiom) and not floating pointapproximations, and moreover we potentially have access to the full expressivepower of continuous mathematics and the differential and integral calculus. 2To allow the above safety properties to be directly stated in a model of theroute validator we are using the Theory plug-in to extend the mathematicallanguage of Event-B to include a theory of 3-D Euclidean space (defined as anormed real vector space with an inner product and the usual metric).At the abstract level the routes passed to the route validator are simply arbi-trary continuous paths, and safety invariants can be expressed directly as above.Then using data refinement the route associated with each UAV is replaced by alist of waypoints, pairs of position and time, where each waypoint represents thelocation of the UAV at the specified time. The gluing invariant for the data re-finement defines how the route for each UAV can be reconstructed as a piecewiselinear path between the waypoints.We have developed within the Theory plug-in a mathematical theory of con-tinuous paths and piecewise linear paths, and defined a mathematical function2 The Rodin theory of real numbers currently has a definition of continuous functions,but not differentiation or integration. Adding the basic definitions would be easy(within the Theory plug-in), but to be useable all the basic theorems of a firstcourse in real analysis would need to be included too.A Formal Approach to Multi-UAV Route Validation 5that generates the piecewise linear path associated with a list of waypoints. Proofobligations were generated to show that the piecewise linear path produced bythis function was indeed a continuous path, and this then established that thedata refinement from routes to waypoint lists was sound.Work is ongoing to refine the model by splitting the events into more fine-grained steps until a verified algorithm for the route validator is produced. Theaim is to do this in a modular fashion so that different formulations of thesafety properties can be tried, with the corresponding changes to the algorithmlocalised, and the re-verification (proof) effort minimised.During the project we also aim to produce code (at this stage manually)that implements the verified algorithms, however, the modelled algorithms willbe expressed in terms of genuine real variables, whereas any implementationin software will necessarily use floating point variables. There is therefore thepossibility that the coded implementations could deviate from the behaviour ofthe mathematically verified algorithms. We hope to address this issue in futurework, but it is out of scope for this project.5 Conclusion and Future WorkThe approach outlined above shows much promise for the formal development ofmulti-UAV route planning systems. Future work could include development ofmore complete specifications and algorithms for the route validator function, orthe development using the Theory plug-in of a theory of floating point numbers,and further data refinement of the model from real to floating point variables.References1. Abrial, J.-R.: The B-Book: Assigning Programs to Meanings. Cambridge UniversityPress (1996)2. Abrial, J.-R.: Modeling in Event-B: System and Software Engineering. CambridgeUniversity Press (2010)3. Abrial, J.-R., Butler, M., Hallerstede, S., Hoang, T.S., Mehta, F., Voisin, L.: Rodin:an open toolset for modelling and reasoning in Event-B. International Journal onSoftware Tools for Technology Transfer 12(6), 447–466 (2010)4. Butler, M., Maamria, I.:Practical Theory Extension in Event-B. In: Liu, Z. andWoodcock, J. and Zhu, H. (eds.) Theories of Programming and Formal Methods –Essays Dedicated to Jifeng He on the Occasion of His 70th Birthday, LNCS, vol.8051, pp. 67–81. Springer (2013)5. Hoare, C.A.R.: An axiomatic basis for computer programming. Commun. ACM12(10), 576–580 (1969)6. Leuschel, M., Butler, M.: ProB: an automated analysis toolset for the B method.International Journal on Software Tools for Technology Transfer 10(2), 185–203(2008)7. RTCA, Inc.: DO-178C, Software Considerations in Airborne Systems and Equip-ment Certification (December 2011)8. Snook, C., Butler, M.: UML-B: Formal modeling and design aided by UML. ACMTransactions on Software Engineering and Methodology 15(1), 92–122 (2006)

A Formal Approach to Multi-UAV Route Validation

Abstract

Similar works

Full text

Available Versions

Southampton (e-Prints Soton)