Vincenzo Ciancia, Stephen Gilmore, Diego Latella, Michele Loreti, Mieke Massink from 2nd FoCAS Workshop on Fundamentals of Collective Adaptive Systems at SASO 2014

1. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Data veri

2. cation for collective adaptive systems:
spatial model-checking of vehicle location data
Vincenzo Ciancia Consiglio Nazionale delle Ricerche, Pisa
Stephen Gilmore LFCS, University of Edinburgh
Diego Latella Consiglio Nazionale delle Ricerche, Pisa
Michele Loreti Universita di Firenze and IMT Lucca
Mieke Massink Consiglio Nazionale delle Ricerche, Pisa
FoCAS @ SASO, London, 8th September 2014
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 1/30

3. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Outline
1 Collective adaptive systems and data correctness
GPS measurements and physical limitations
2 Application: smart public transport
Identifying error conditions in GPS data for vehicles
On-line and o-line processing
3 Spatial logic and spatial model-checking
Closure
Spatial until
Reachability
4 Spatial model-checking in practice
Detecting diversions and o-road positions
Evaluating street portions, proximity to stops
Detecting out-of-order observations in data
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 2/30

4. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Outline
1 Collective adaptive systems and data correctness
GPS measurements and physical limitations
2 Application: smart public transport
Identifying error conditions in GPS data for vehicles
On-line and o-line processing
3 Spatial logic and spatial model-checking
Closure
Spatial until
Reachability
4 Spatial model-checking in practice
Detecting diversions and o-road positions
Evaluating street portions, proximity to stops
Detecting out-of-order observations in data
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 3/30

5. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Collective adaptive systems
. . . depend on accurate data
The collective adaptive systems which we consider depend on
real-time data collection subsystems which allow them to
re
ect on their operation,
detect problems in their service, and
report these problems back to system operators or to system
users.
These data collection systems are often built from physical
components such as sensors and receivers which have limits to
their engineering, meaning that they can, and do, sometimes
deliver inaccurate measurement data.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 4/30

6. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Collective adaptive systems
. . . must deal with physical limitations
GPS-based location, spatial presence and situation play an
increasing role in systems but satellite-based triangulation
requires very precise measurement of extremely fast signals.
Environmental factors impact on the accuracy of this
triangulation.
Signal bounce o tall buildings can interrupt the GPS signal.
Heavy cloud cover, humidity and
atmospheric pressure have an
impact on measurements.
Errors in GPS readings are to be
expected.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 5/30

7. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Collective adaptive systems
. . . must deal with inaccurate data
Physical components can only deliver accurate information up to
their physical limits and size and weight considerations often
severely curtail the amount of processing which can be done on
an embedded device.
These practicalities mean that the responsibility for dealing with
erroneous data lies with the system itself, and that it must make
eorts to automate the process of data checking and cleaning
before acting in response to data received.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 6/30

8. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Outline
1 Collective adaptive systems and data correctness
GPS measurements and physical limitations
2 Application: smart public transport
Identifying error conditions in GPS data for vehicles
On-line and o-line processing
3 Spatial logic and spatial model-checking
Closure
Spatial until
Reachability
4 Spatial model-checking in practice
Detecting diversions and o-road positions
Evaluating street portions, proximity to stops
Detecting out-of-order observations in data
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 7/30

9. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Data correctness
. . . for vehicles in a
eet of buses
We illustrate the theory with a concrete example of detecting
errors in vehicle location data for buses in the city of Edinburgh.
In the case of vehicle location data for a bus
eet, we have a
natural sense of data correctness.
Buses are not o-road vehicles so they should at all
times be positioned on a road or in a small
number of other speci

10. c locations, such
as a garage.
Our overall goal is to classify bus
eet
vehicle location data points as being
plausible or suspect, and this closely
aligns with their being on a road
(or, allowing for measurement error,
at least near to a road).
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 8/30

11. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
A spatial veri

12. cation problem
. . . identifying error conditions in GPS data for vehicles
1. The GPS data received could be classi

13. ed as being suspect or
corrupt, by virtue of being too far from the expected data|this
may indicate a problem with the hardware of the measurement
device.
2. The data could indicate a problem in that, if it is correct, then
one of the vehicles in the
eet is far from its expected position
on its planned route|this may indicate a problem with the
delivery of the service or it may be due to driver error.
3. The data seems plausible, and suggests a valid position for a
vehicle but this vehicle seems to have deviated from its planned
route for reasons of operational problems such as road closures
or engineering works|this may indicate a problem with the road
network.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 9/30

14. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Automated classi

15. cation of data
. . . scaling problem detection to operate at large scale
A human observer can apply human
intelligence to detect an erroneous
GPS reading by plotting it on a map
and comparing against the position
of roads and buildings.
However, this type of intelligent watchfulness cannot scale to
tracking an entire
eet of buses (around 700 in the case of the
city of Edinburgh) so we seek a scalable approach to detecting
GPS errors which can be automated.
We are using a novel spatial model-checker to implement this
scalable approach.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 10/30

16. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Processing on-line or o-line
. . . identifying error conditions in GPS data for vehicles
The methods presented here could either be used for on-line or
o-line data processing.
In on-line data processing the smart infrastructure within the
collective adaptive system would attempt to identify and classify
problems in real-time, alerting operators to problems as they
occur.
In o-line data processing the infrastructure would attempt to
identify and classify problems with the bene

17. t of hindsight,
providing plausible retrospective explanations for events so that
the service operators can review their service and provide reports
for service regulators or other authorities, and use the insights
gained to improve the service at the next oering (for example,
the following day).
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 11/30

18. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Outline
1 Collective adaptive systems and data correctness
GPS measurements and physical limitations
2 Application: smart public transport
Identifying error conditions in GPS data for vehicles
On-line and o-line processing
3 Spatial logic and spatial model-checking
Closure
Spatial until
Reachability
4 Spatial model-checking in practice
Detecting diversions and o-road positions
Evaluating street portions, proximity to stops
Detecting out-of-order observations in data
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 12/30

19. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial logic
Operators of the logic: closure
The spatial logic consists of a very small number of basic
operators that, in turn, are used to de

20. ne a number of useful
derived operators.
The closure operator has its origin in topological spatial
logics. The formula is satis

21. ed by a point x in space if x
satis

22. es or it is a direct neighbour of a point satisfying .
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 13/30

23. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checker input
Computing the closure of the blue points
B B
B B
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 14/30

24. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checker output
Computed closure, repainted blue as green
G G
G G G G
G G G G
G G
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 15/30

25. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial logic
Operators of the logic: spatial until
The spatial until-operator U is a spatial version of the temporal
until operator.
A point x in space satis

26. es the formula
U
whenever it is included in an area A consisting of points
satisfying formula and there is no way out from A unless
passing through points in an area B that satis

27. es .
The spatial until-formula is weak in the sense that U also
holds when all points in the space satisfy and none of them .
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 16/30

28. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial logic
The green nodes satisfy green until blue (G UB)
B B B
B G G G B
B G G G B
B G G G B
B B B
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 17/30

29. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial logic
Operators of the logic: reachability
The

30. rst derived operator is the reachability operator R .
It is de

31. ned in terms of the spatial until operator as follows
(: ) U (:)
R , :
and, abstracting from some details, it identi

32. es those points
from which can be reached passing only by points satisfying .
The formulation of reachability uses a double negation because
the spatial until-formula is weak.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 18/30

33. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checker input
Computing reachability R ^ ((R _ Y )R Y )
R Y R R R
R R R R
Y R R
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 19/30

34. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checker output
Computed reachability R ^ ((R _ Y )R Y ), repainted
O Y R R R
O R R R
Y O O
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 20/30

35. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Outline
1 Collective adaptive systems and data correctness
GPS measurements and physical limitations
2 Application: smart public transport
Identifying error conditions in GPS data for vehicles
On-line and o-line processing
3 Spatial logic and spatial model-checking
Closure
Spatial until
Reachability
4 Spatial model-checking in practice
Detecting diversions and o-road positions
Evaluating street portions, proximity to stops
Detecting out-of-order observations in data
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 21/30

36. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checking in practice
Applying spatial model-checking to annotated maps
We use an OpenStreetMap representation for
the map from which the names of streets have
been removed for clarity. Main streets used for
bus routes are pink, side streets are white.
Diverted buses are seen as being on side
streets which are o the main bus route.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 22/30

37. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checking in practice
Applying spatial model-checking to annotated maps
Bus positions are represented by blue squares
on the map in a range of shades of blue. Bus
stops are represented by orange squares.
Errors in GPS data show up as bus
observations which are not on any road.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 23/30

38. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Diversions and o-road positions
Input to the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 24/30

39. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Diversions and o-road positions
Output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 24/30

40. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Diversions and o-road positions
Annotated output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 24/30

41. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Spatial model-checking in practice
Using street portions to segment roads
Occasionally it will be useful to segment roads
by the position of buses. This is done by
dilating a bus position until it

42. lls the road.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 25/30

43. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Street portions, proximity to stops
Input to the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 26/30

44. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Street portions, proximity to stops
Output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 26/30

45. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Street portions, proximity to stops
Annotated output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 26/30

46. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Introducing temporal aspects
Representing subsequency in timestamps through colour
The colour of a bus darkens slightly from one
observation to the next. In this case the
observation nearer to the bus stop has a later
timestamp than the observation which is
further away from the bus stop.
Unexpected changes in position are signi

47. cant.
If a later timestamped observation shows the
bus less further along its route then this
usually indicates a data error because buses
rarely reverse along a road.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 27/30

48. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Out-of-order observations in data
Input to the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 28/30

49. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Out-of-order observations in data
Output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 28/30

50. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Out-of-order observations in data
Annotated output from the model-checker
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 28/30

51. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Conclusions
The use of a spatial model checker provides us with a
sophisticated tool for checking complex properties over systems
where location plays an important role, as it does in many
collective adaptive systems.
Using this tool we have been able to detect and correct a wide
range of location-related errors in vehicle location data.
Future work
Future work will focus on enhancing the logic and the model checker
with a temporal perspective. Stochastic and probabilistic aspects are
also of great interest in collective adaptive systems, and are
inherently related to time. The study of such aspects is also planned
in the near future.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 29/30

52. qu. .a.n..Ɵ...c..........o...............l www.quanticol.eu
Acknowledgements
This work is supported by the EU project QUANTICOL: A
Quantitative Approach to Management and Design of Collective
and Adaptive Behaviours, 600708.
The authors thank Bill Johnston of Lothian Buses and Stuart
Lowrie of the City of Edinburgh council for providing access to
the data related to bus positions.
Thank you for your attention.
Stephen Gilmore, University of Edinburgh | FoCAS@SASO, London, 8th September 2014 | 30/30