Current approaches to the engineering of space software such as satellite
control systems are based around the development of feedback controllers using
packages such as MatLab's Simulink toolbox. These provide powerful tools for
engineering real time systems that adapt to changes in the environment but are
limited when the controller itself needs to be adapted.
  We are investigating ways in which ideas from temporal logics and agent
programming can be integrated with the use of such control systems to provide a
more powerful layer of autonomous decision making. This paper will discuss our
initial approaches to the engineering of such systems.Comment: 3 pages, 1 Figure, Formal Methods in Aerospac

Dennis, Louise A.

Fisher, Michael

Lincoln, Nicholas

Lisitsa, Alexei

Veres, Sandor M.

Electronic Proceedings in Theoretical Computer Science

English

arXiv

Current approaches to the engineering of space software such as satellite control systems are based around the development of feedback controllers using packages such as MatLab's Simulink toolbox. These provide powerful tools for engineering real time systems that adapt to changes in the environment but are limited when the controller itself needs to be adapted. We are investigating ways in which ideas from temporal logics and agent programming can be integrated with the use of such control systems to provide a more powerful layer of autonomous decision making. This paper will discuss our initial approaches to the engineering of such systems

Louise A. Dennis

Michael Fisher

Nicholas Lincoln

Alexei Lisitsa

Sandor M. Veres

Directory of Open Access Journals

M. Bujorianu and M. Fisher (Eds.):Workshop on Formal Methods for Aerospace (FMA)EPTCS 20, 2010, pp. 63–67, doi:10.4204/EPTCS.20.6c© L. A. Dennis et al.This work is licensed under theCreative Commons Attribution License.Agent Based Approaches to Engineering Autonomous SpaceSoftware∗Louise A. DennisDepartment of Computer Science, University of Liverpool, UKL.A.Dennis@liverpool.ac.ukMichael FisherDepartment of Computer Science, University of Liverpool, UKNicholas LincolnDepartment of Engineering, University of Southampton, UKAlexei LisitsaDepartment of Computer Science, University of Liverpool, UKSandor M. VeresDepartment of Engineering, University of Southampton, UKCurrent approaches to the engineering of space software such as satellite control systems are basedaround the development of feedback controllers using packages such as MatLab’s Simulink tool-box. These provide powerful tools for engineering real time systems that adapt to changes in theenvironment but are limited when the controller itself needs to be adapted.We are investigating ways in which ideas from temporal logics and agent programming can beintegrated with the use of such control systems to provide a more powerful layer of autonomousdecision making. This paper will discuss our initial approaches to the engineering of such systems.1 IntroductionModern control systems are limited in their ability to react flexibly and autonomously to changing situ-ations. The limiting factor is the complexity inherent in analysing situations where many variables arepresent. There are many complex, real-world, control systems but we are primarily interested in the(autonomous) control of satellite systems.Consider the problem of a single satellite attempting to maintain a geostationary orbit. Currentsatellite control systems maintain orbits using feedback controllers. These implicitly assume that anyerrors in the orbit will be minor and easily corrected. In situations where more significant errors occur,for example caused by a thruster malfunction, it is desirable to modify or change the controller. Thecomplexity of the decision task is a challenge to standard approaches, and has led, for example, tocomplex, evolutionary control systems. These become very difficult to understand.We approach the problem from the perspective of rational agents [6]. We consider a satellite to bean agent which consists of a discrete (rational decision making) part and a continuous (calculation) part.The discrete part uses the Belief-Desire-Intention (BDI) theory of agency [5] and governs high leveldecisions about when to generate new feedback controllers. The continuous, calculational part is used to∗Work funded by EPSRC grants EP/F037201/1 and EP/F037570/164 Agent Based Approaches to Engineering Autonomous Space Softwarederive controllers and to calculate information from continuous data which can be used in the decisionmaking process; this part can be viewed as a hybrid system.2 ArchitectureAgentPartMATLAB JAVAMODEL OF SYTEMRational Agent PartThin Environment LayerAGENTFile SystemReal Time Control Send DataActData FlowControl FlowAbstraction EngineShared BeliefsReasoningReasonActSenseContinuous CalculateFigure 1: Implemented Hybrid Agent ArchitectureOur prototype system is shown in Fig. 1. We have implemented a simulated environment and realtime satellite control system in MatLab using the Simulink tool kit. The continuous agent part is alsoimplemented in MatLab. MatLab has no easy provision for threaded execution which forces us to useseparate instances for the Real Time aspects (i.e. the feedback controller and simulated environment)and for the Continuous Agent part. The agent also contains a discrete agent part which is currentlyimplemented in the Gwendolen agent programming language1. Gwendolen [2] is implemented on top ofJAVA.The real time control system sends information (which may be pre-processed) to the agent part of thesystem. When it acts, the discrete part of the agent may either cause the continuous agent part to performsome calculation (and wait for the results) or it may send an instruction to the real time control system toalter its controller. Since the new controller has been created “on the fly” by the continuous part, someaspects of this controller are stored in the shared file system (accessed by both MatLab processes).The discrete agent part is divided into an abstraction engine which takes continuous data suppliedby the satellite simulation and transforms this data into discrete shared beliefs which are accessed by a1The choice of language was dictated entirely by convenience. It is a subject for further work to examine more widely usedBDI-languages and evaluate which is most appropriate for the system.L. A. Dennis et al. 65reasoning engine which makes decisions about how to behave. The discrete part is split in two becausereasoning is comparatively slow compared to the flow of data coming in from the simulation. It canbecome “clogged” up with the need to react to changing information if it tries to perform both theabstraction tasks and the reasoning tasks at once. The separation of abstraction and reasoning is boththeoretically clean and practical at an implementational level.3 BDI Programming AspectsThe architecture lets us represent the high-level decision making aspects of the program in terms of thebeliefs and goals of the agent and the events it observes. So, for instance, when the agent observes theevent that the satellite is in a new position (information relayed to it by the real time controller) it can callon the continuous part to calculate whether this position is within acceptable bounds of the desired orbit(i.e. whether the existing real-time controller is capable of maintaining the orbit). If, as a result of this, itgains a belief that the satellite has strayed from the orbit it can request the continuous part to calculate anew path for the satellite to follow using techniques described in [4].Similarly, if the satellite has strayed from its bounds, the discrete agent part can examine its beliefsabout the current status of the thrusters and, if necessary, instruct the continuous part to generate a newfeedback controller which takes into account any malfunctions or inefficiencies in the thrusters.Such programs can be expressed compactly in the BDI-programming style without the need forprogramming large decision trees to consider all possible combinations of thruster status and satellitepositions. This should then reduce the probability of error in the decision-making parts of the programand opens the possibility that existing techniques for model checking such programs [1] can be adaptedto verify this part.3.1 Geostationary Orbit Case StudyThe agent code for the geostationary orbit is shown in code fragments 3.1 and 3.2. Fragment 3.1 showsthe code for the abstraction engine. Every time it “perceives” the satellite position (stateinfo) it callsupon MatLab to calculate whether or not this position is within bounds (comp_distance) and thenasserts and removes shared beliefs appropriately.The code is shown as a series of plans of the form trigger:{guard} ←deeds where the trigger issome event observed by the agent, the guard is a set of facts that must be true before the plan is activatedand the deeds are a stack of deeds to be executed. +b is the addition of a belief, b, and -b is the removalof the belief, b. In a guard B b means that b is believed.Code fragment 3.1 Geostationary Orbit Control (Abstraction Engine)1+stateinfo(L1, L2, L3, L4, L5, L6) :2{B proximity_to_centre(V1)} ←3comp_distance(L1, L2, L3, L4, L5, L6, Val),4+proximity_to_centre(Val);56+proximity_to_centre(in) : {B proximity_to_centre(out)} ←7-proximity_to_center(out),8remove_shared(proximity_to_centre(out)),9assert_shared(proximity_to_centre(in));1011+proximity_to_centre(out) :12{B proximity_to_centre(in),66 Agent Based Approaches to Engineering Autonomous Space Software13B stateinfo(L1, L2, L3, L4, L5, L6)} ←14-proximity_to_centre(in),15remove_shared(stateinfo(A1, A2, A3, A4, A5, A6)),16assert_shared(stateinfo(L1, L2, L3, L4, L5, L6)),17remove_shared(proximity_to_centre(in)),18assert_shared(proximity_to_centre(out));Fragment 3.2 reacts to the dynamic information about whether the satellite is within bounds or not.It may call a MatLab function, plan_approach_to_centre which returns the name of a plan tomove a satellite back within bounds. apply_controls and maintain_path are actions applied to thesimulation of the satellite which apply a named plan, or continue normal operation as appropriate. Thesyntax +!g indicates the acquisition of a goal.Code fragment 3.2 Geostationary Orbit Control1+proximity_to_centre(out) : {>} ←2-proximity_to_centre(in),3+!get_to_centre;45+proximity_to_centre(in) : {>} ←6-proximity_to_centre(out),7maintain_path;89+!get_to_centre :10{B proximity_to_centre(out),11B stateinfo(L1, L2, L3, L4, L5, L6)} ←12plan_approach_to_centre(P, locn(L1, L2, L3, L4, L5, L6)),13+!try_execute(P) ;1415+!try_execute(P) : {B proximity_to_centre(out)} ←16apply_controls(P);3.2 Decision and ControlThe important aspect of both the above example and the architecture in general is that the (MatLab) con-trol systems take care of the detailed calculation of continuous functions (paths, etc), while the rationalagent takes care of high-level decisions about targets and plans. This separation of concerns simplifiesboth parts and avoids the problems associated with large, opaque, complex, adaptive and evolutionarycontrol systems.4 Future WorkWe are currently working on our prototype system and case study which will allow us to make com-parisons of this agent approach to autonomous decision-making in satellite systems to approaches basedon finite state machines and standard control. We also are interested in investigating the use of tempo-ral logic and model checking to generate forward planning capabilities for the agent along the lines ofthose investigated by Kloetzer and Belta [3]. We aim to explore the possibility of using model checkingto verify aspects of the agent’s behaviour. Given that we already have a formal verification system forGwendolen agents [1], there is a strong possibility that we can extend this to cope with (abstractionsof) the continuous part. As the diagram below shows, we already have model-checking tools for theL. A. Dennis et al. 67discrete/finite parts. Our interest now is how far such techniques can be extended to account for otheraspects of the agent’s behaviour.Discrete and FiniteAgentPartMATLAB"RealWorld"JAVARational Agent PartThin Environment LayerAbstraction EngineShared BeliefsReasoningContinuous References[1] R. H. Bordini, L. A. Dennis, B. Farwer, and M. Fisher. Automated verification of multi-agent programs.In Proceedings of the 23rd IEEE/ACM International Conference on Automated Software Engineering (ASE2008), pages 69–78, L’Aquila, Italy, September 2008.[2] L. A. Dennis and B. Farwer. Gwendolen: A BDI Language for Verifiable Agents. In B. Löwe, editor, Proc.AISB’08 Workshop on Logic and the Simulation of Interaction and Reasoning, Aberdeen, 2008. AISB.[3] M. Kloetzer and C. Belta. A Fully Automated Framework for Control of Linear Systems From TemporalLogic Specifications. IEEE Transactions on Automatic Control, 53(1):287–297, 2008.[4] N. Lincoln and S. Veres. Components of a Vision Assisted Constrained Autonomous Satellite FormationFlying Control System. International Journal of Adaptive Control and Signal Processing, 21(2-3):237–264,October 2006.[5] A. S. Rao and M. Georgeff. BDI Agents: From Theory to Practice. In Proc. 1st International Conference onMulti-Agent Systems (ICMAS), pages 312–319, June 1995.[6] M. Wooldridge and A. Rao, editors. Foundations of Rational Agency. Applied Logic Series. Kluwer AcademicPublishers, Mar. 1999.

Agent Based Approaches to Engineering Autonomous Space Software

The University of Manchester - Institutional Repository

Agent Based Approaches to Engineering Autonomous Space Software

Abstract

Similar works

Full text

Available Versions

Directory of Open Access Journals

The University of Manchester - Institutional Repository