changing the way the world does · –each cell with 1 or 0 neighbours dies, as if by solitude...

34
Changing the way the world does software

Upload: others

Post on 11-Sep-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Changing the way the world does

software

Page 2: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

EMERGENT BEHAVIOUR

Page 3: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Illustrating emergence throughJohn Conway’s Game of Life

• For a space that is populated

– Each cell with 1 or 0 neighbours dies, as if by solitude

– Each cell with 4 or more neighbours dies, as if by overpopulation

– Each cell with 2 or 3 neighbours survives

• For a space that is unpopulated

– Each cell with 3 neighbours becomes populated

Page 4: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Single Cell

Page 5: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Single Cell dies

Page 6: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Evolution of 3 Cells

1 2 3

Page 7: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Evolution of 3 Cells

4

1 2 3

5

Page 8: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Evolution of 3 Cells

4

1 2 3

5

Page 9: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Emergent Behaviour

Generation 10 Generation 0 Generation 5

Generation 20

Generation 15

Generation 26 Generation 27 Generation 28

Generation 29

Page 10: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Advantages of a Swarm Approach - 1

• Flexible

• Robust

– Tasks are completed even if some agents fail.

• Scalable

– From a few agents to many.

• Decentralized

– There is no central control.

Page 11: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Advantages of a Swarm Approach - 2

• Self-organized

– The solutions are emergent.

• Adaptation

– The swarm system can not only adjust to predetermined stimuli but also to new stimuli.

• Parallelism

– Agents' operations are inherently parallel.

Page 12: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

ASSURING SWARMS

Page 13: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Technologies Used

SoftwareRequirements

Kapture®

SoftwareDesign

English

Simulink®

Modelworks®

Review

Kapture: English syntax with formal semantics

Modelworks: Gives formal semantics to Simulink

Page 14: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Motivation for Our Tools: DO-178C

• At Section 4.4, Software Life Cycle Environment Planning:

– “The basic principle is to choose requirements development and design methods, tools, and programming languages that limit the opportunity for introducing errors, and verification methods that ensure that errors introduced are detected

Page 15: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Effort per Model - PICASSOS

~80%

~60%~60%~70%

~80%

~80%

Blind seeded with 48 errorsModelworks found 49 errors

Page 16: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

VERIFICATION OF ALPHA AND BETA SWARM ALGORITHMS (BASED ON COLLECTION OF AUTONOMOUS SEA VESSELS)

Page 17: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Screenshot of Multiple Definitions in Kapture

Page 18: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Becomes Disconnected

Page 19: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Example of intermediate language generated from Kapture

Page 20: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Results

• Revealed flaw in alpha algorithm in a tenth of a time of published results, verified beta algorithm and explored fault tolerance.

• Demonstrated that requirements for an individual’s contribution to a swarm could be: – captured in a comprehensible template language with a

formal semantics that has a natural language description;– used as a specification to verify a low level design (i.e. can

be directly coded from) in Simulink and Stateflow;– And the swarm property was automatically verified from

the requirements of the individual.

• As opposed to academic approaches…

Page 21: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Panagiotis Kouvaros and Alessio Lomuscio. Verifying Emergent Properties of SwarmsProceedings of the Twenty-Fourth International Joint Conference on Artificial Intelligence (IJCAI 2015)

Page 22: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Recent Work

• Investigating compositional framework for swarms that guarantee desired swarm properties, no matter what the size of the swarm.– Developing a protocol method to guarantee swarm property as

swarm increases.

• Evaluating approach using swarm algorithm from which desired geometric shapes emerge from individual robot/drone behaviour.– Such a shape could be used to present a decoy to an adversary.

• The swarm algorithm has been incorporated into a Simulink and Stateflow design for a verified collision avoidance system for a BVLOS aircraft.

Page 23: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

BVLOS ASIDE FOR INDIVIDUAL AIRCRAFT

Page 24: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Basic BVLOS Collision AviodanceVignette

Page 25: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Collision Avoidance Case Study

Page 26: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Pathological Vignette

30

Page 27: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ
Page 28: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

BACK TO SWARMING

Page 29: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Overhead images*, order is left to right

Column formation

Wedge formation

Line formation

Diamond formation

*Images from A General Algorithm for Robot Formations UsingLocal Sensing and Minimal CommunicationJakob Fredslund, Maja J Mataric

Page 30: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Verification

• Expressed the requirements for the algorithm using the D-RisQ Kapture tool.

• Formally verified requirements for the algorithm against a specification of the desired shape moving through 3-D space.

• Formally verified the Simulink/Stateflowdesign against the individual requirements of the algorithm.

Page 31: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

Follower: keep in formation

Conductor: listen to navigator

Entity architecture

Conductor?

Page 32: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ

BVLOS subsystem Navigator

• Go to waypoint

• Avoid collision

Page 33: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ
Page 34: Changing the way the world does · –Each cell with 1 or 0 neighbours dies, as if by solitude –Each cell with 4 or more neighbours dies, as if by overpopulation ... using the D-RisQ