Formal verification of Mobile Robot Protocols

Mobile robot networks emerged in the past few years as a promising distributed computing model. Existing work in the literature typically ensures the correctness of mobile robot protocols via \emph{ad hoc} handwritten proofs, which, in the case of asynchronous execution models, are both cumbersome and error-prone. In this paper, we propose the first formal model and general verification (by model-checking) methodology for mobile robot protocols operating in a discrete space (that is, the set of possible robot positions is finite). Our contribution is threefold. First, we formally model using synchronized automata a network of mobile robots operating under various synchrony (or asynchrony) assumptions. Then, we use this formal model as input model for the DiVinE model-checker and prove the equivalence of the two models. Third, we verify using DiVinE two known protocols for variants of the ring exploration in an asynchronous setting (exploration with stop and perpetual exclusive exploration). The exploration with stop we verify was manually proved correct only when the number of robots is $k>17$, and $n$ (the ring size) and $k$ are co-prime. As the necessity of this bound was not proved in the original paper, our methodology demonstrates that for several instances of $k$ and $n$ \emph{not covered} in the original paper, the algorithm remains correct. In the case of the perpetual exclusive exploration protocol, our methodology exhibits a counter-example in the completely asynchronous setting where safety is violated, which is used to correct the original protocol