Adaptive Cruise Control: Hybrid, Distributed, and Now Formally Verified

Abstract

Abstract. Car safety measures can be most effective when the cars on a street coordinate their control actions using distributed cooperative control. While each car optimizes its navigation planning locally to ensure the driver reaches his destination, all cars coordinate their actions in a distributed way in order to minimize the risk of safety hazards and collisions. These systems control the physical aspects of car movement using cyber technologies like local and remote sensor data and distributed V2V and V2I communication. They are thus cyber-physical systems. In this paper, we consider a distributed car control system that is inspired by the ambitions of the California PATH project, the CICAS system, SAFESPOT and PReVENT initiatives. We develop a formal model of a distributed car control system in which every car is controlled by adaptive cruise control. One of the major technical difficulties is that faithful models of distributed car control have both distributed systems and hybrid systems dynamics. They form distributed hybrid systems, which makes them very challenging for verification. In a formal proof system, we verify that the control model satisfies its main safety objective and guarantees collision freedom for arbitrarily many cars driving on a street, even if new cars enter the lane from on-ramps or multi-lane streets. The system we present is in many ways one of the most complicated cyber-physical systems that has ever been fully verified formally.

ModelPlex: verified runtime validation of verified cyber-physical system models

“…The axiomatic-style prototype synthesizes correct-by-construction monitors and produces a proof of correctness during the synthesis without the need to recheck. To evaluate our method, we synthesize monitors for prior case studies of nondeterministic hybrid models of autonomous cars, train control systems, and robots (adaptive cruise control [20], intelligent speed adaptation [25], the European train control system [38], and ground robot collision avoidance [26]), see Table 2. For the model, we list the dimension in terms of the number of function symbols and state variables, as well as the size of the safety proof for proving (2), i. e., number of proof steps and the number of proof branches.…”

Towards Formal Verification of Freeway Traffic Control

“…While investigating detection quality and computation speed, both being undisputedly important characteristics of these systems, none of the works focused on the safe operation bounds of such a system. Verification of safety has been the focus of Loos et al [6] in their work on adaptive cruise control. Their model focused on mutual safety of cars following each other on a highway.…”

“…We, thus, need to find appropriate bounds for traffic center decisions. Moreover, our model allows physical entities on a freeway (e.g., incidents) to move opposite to the driving direction, which was assumed not to happen in [6]. Movement authorities, which are somewhat similar to speed limits, have been used in verifying the European train control system [23].…”

“…Another challenge is to identify safe margins on the system within which traffic flow can be optimized without endangering safety. A first step towards the verification of safety in road traffic control has been taken in previous work [6] by verifying that cars with local adaptive cruise control cannot collide. As a next step, we introduce global control by highway authorities.…”

“…This distributed intelligent speed adaptation system focuses on a specific aspect of freeway traffic control, and, hence, complements other vehicle control systems. Specifically, the proposed global control system is not intended to handle conventional local vehicle control (e.g., adjust speed to slower vehicles ahead, or lane change maneuvers, which are assumed to be handled, e.g., by an adaptive cruise control system [6]), but only to consider incidents and other speed control causes that go beyond the sensor coverage of a local controller. For this, we identify constraints on the input and output parameters that car and traffic center controllers need to obey to remain within the safely operable bounds of the system.…”