Formal verification of mobile robot protocols

Abstract

Mobile robot networks emerged in the past few years as a promising distributed computing model. Existing work in the literature typically ensures the correctness of mobile robot protocols via ad hoc handwritten proofs, which, in the case of asynchronous execution models, are both cumbersome and error-prone.In this paper, we propose the first formal model and general verification (by model-checking) methodology for mobile robot protocols operating in a discrete space (that is, the set of possible robot positions is finite). Our contribution is threefold. First, we formally model using synchronized automata a network of mobile robots operating under various synchrony (or asynchrony) assumptions. Then, we use this formal model as input model for the DiVinE model-checker and prove the equivalence of the two models. Third, we verify using DiVinE two known protocols for variants of the ring exploration in an asynchronous setting (exploration with stop and perpetual exclusive exploration).The exploration with stop we verify was manually proved correct only when the number of robots is k > 17, and n (the ring size) and k are co-prime. As the necessity of this bound was not proved in the original paper, our methodology demonstrates that for several instances of k and n not covered in the original paper, the algorithm remains correct. In the case of the perpetual exclusive exploration protocol, our methodology exhibits a counter-example in the completely asynchronous setting where safety is violated, which is used to correct the original protocol.

Optimally Gathering Two Robots

“…However, we expect the complexity of the proof to go beyond what is tractable by a human, and would like to consider the possibility of using formal methods. Currently, modelchecking [15,4,17,21] and program synthesis [6,19] cannot scale to an arbitrary number of robots, and proof assistant techniques [2,11,10,3] do not yet permit to reason about the ASYNC model. Most likely, solving self-stabilizing gathering with n robots in ASYNC will require significant advances in mobile robot formalization.…”

Asynchronous Arbitrary Pattern Formation: the effects of a rigorous approach

“…The need of new ways of expressing algorithm in ASYNC is widely recognized. For instance, in [1,19,27] a formal model to describe mobile robot protocols under synchrony and asynchrony assumptions is provided. So far, these only concern robots operating in a discrete space i.e., with a finite set of possible robot positions.…”

“…In such a case r is said to belong to (or compose) a multiplicity. 1 The definition of stationary robot provided in [22] is slightly different but also inaccurate. In fact, it does not catch the third scenario about active robots described by our definition.…”

Parameterized verification of algorithms for oblivious robots on a ring

“…Formal methods encompass a long-lasting path of research that is meant to overcome errors of human origin. Unsurprisingly, this mechanized approach to protocol correctness was successively used in the context of mobile robots [7,13,5,2,20,9,4,22,3]. When robots are not constrained to evolve on a particular topology (but instead are allowed to move freely in a bidimensional Euclidian space), the Pactole (http://pactole.lri.fr) framework has been proven useful.…”

“…In the discrete setting that we consider in this paper, model-checking proved useful to find bugs in existing literature [5,14] and assess formally published algorithms [13,5,22]. Automatic program synthesis (for the problem of perpetual exclusive exploration in a ring-shaped discrete space) is due to Bonnet et al [7], and can be used to obtain automatically algorithms that are "correct-by-design".…”