Real-Time Execution Control for Autonomous Systems

International audienceThere is an increasing need for advanced autonomy in complex embedded real-time systems such as robots, satellites, or UAVs. Still, the growing complexity of the decision capabilities of these systems raises a major problem: how to prove that the system is not going to end in a dangerous state (for itself or for humans)? How to guarantee that the robot will not grab a sample on the ground with its arm, while moving (which could supposedly break the arm)? How to make sure that the satellite RCS jets are not fired when the camera lens protection is off? How do we make sure that a service robot for elderly people is not moving faster than 20cm.s −1 ? This paper presents some recent developments of the LAAS architecture for autonomous systems. In particular, we specify the role of the Execution Control level of this architecture. This level has a fault protection role with respect to the commands issued by the decisional level, which are transmitted to the system (through the functional level). It acts as a real-time "safety bag" 1 , to make sure that the commands issued are consistent with the current state of the system and with a formal model of the acceptable states. To implement this component, we present a new approach and a new tool inspired by the model checking domain. We introduce a new language (EX o GEN) to specify the model of acceptable and required states of the system (valid contexts for requests to functional modules and resources usage). This language is compiled offline in an OBDD (Ordered Binary Decision Diagram) like structure which is then used online to check the specified constraints in real-time. This tool is seamlessly integrated in the LAAS architecture and relies on the other tools used to build autonomous systems (G en oM, OpenPRS, etc). We have deployed it on a number of robotics platforms (ATRV and XR4000 robots). We show that such an approach allows us to improve the runtime dependability of the system at a minimal acceptable cost (compared to the possible loss of the complete system), but could also be extended to check more complex temporal properties of the system off line