Formal verification of autonomous vehicle platooning

Abstract

The coordination of multiple autonomous vehicles into convoys or platoons is expected on our highways in the near future. However, before such platoons can be deployed, the new autonomous behaviours of the vehicles in these platoons must be certified. An appropriate representation for vehicle platooning is as a multiagent system in which each agent captures the "autonomous decisions" carried out by each vehicle. In order to ensure that these autonomous decision-making agents in vehicle platoons never violate safety requirements, we use formal verification. However, as the formal verification technique used to verify the agent code does not scale to the full system and as the global verification technique does not capture the essential verification of autonomous behaviour, we use a combination of the two approaches. This mixed strategy allows us to verify safety requirements not only of a model of the system, but of the actual agent code used to program the autonomous vehicles.(V2V) communication is used at a lower (continuous control system) level to adjust each vehicle's position in the lanes and the spacing between the vehicles. V2V is also used at higher levels, for example to communicate joining requests, leaving requests, or commands dissolving the platoon. So a traditional approach is to implement the software for each vehicle in terms of hybrid (and hierarchical) control systems and to analyse this using hybrid systems techniques.However, as the behaviours and requirements of these automotive platoons become more complex there is a move towards much greater autonomy within each vehicle. Although the human in the vehicle is still responsible, the autonomous control deals with much of the complex negotiation to allow other vehicles to leave and join, etc. Traditional approaches involve hybrid automata [12] in which the continuous aspects are encapsulated within discrete states, while discrete behaviours are expressed as transitions between these states. A drawback of combining discrete decision-making and continuous control within a hybrid automaton is that it is difficult to separate the two (high-level decision-making and continuous control) concerns. In addition, the representation of the high-level decision-making can become unnecessarily complex.As is increasingly common within autonomous systems, we use a hybrid autonomous systems architecture where not only is the discrete decision-making component separated from the continuous control system, but the behaviour of the discrete part is described in much more detail. In particular, the agent paradigm is used [26]. This style of architecture, using the agent paradigm, not only improves the system design from an engineering perspective but also facilitates the system analysis and verification. Indeed, we use this architecture for actually implementing automotive platoons, and we here aim to analyse the system by verification.Safety certification is an inevitable concern in the development of more autonomous road vehicles, and verifying the safety and reli...

Robotics and Integrated Formal Methods: Necessity Meets Opportunity

“…To ensure that a robotic system can cope in real-world scenarios, it must be able to react appropriately to an unknown and dynamic environment. When formally modelling robotic systems, the environment is often ignored [19] or assumed to be static and known, prior to the robot's deployment [17,23,34], which is often neither possible nor feasible in the real world. Other approaches abstract away from the environment and rely on predicates representing sensor data about the environment [13].…”

Assessing the Safety and Reliability of Autonomous Vehicles from Road Testing

“…The same applies if evidence for the ML functions or the whole system is available (e.g. from automated testing [18] or formal verification [19], [20]). c) considers that while road testing data are collected, the AVs are being updated.…”

Formal Specification and Verification of Autonomous Robotic Systems

“…The work in [159] combines MAZE (an extension of Object-Z for multi-agent systems) and Back's action refinement to enable top-down development of robot swarms. In [101], an agent controlling a car is verified using AJPF, and the timing properties are verified using Uppaal. This is extended, in [102] with a spatial reasoning calculus.…”

“…The verified agent is plugged into a flight simulator [173] to visualise the verified scenarios. The work in [101,102] describes a GWENDOLEN agent controlling a driverless car in a vehicle platoon. AJPF is used to verify safety properties related to the car joining and leaving a platoon, and for maintaining a safe distance during platooning.…”