The document describes RoboStar Technology's approach to software engineering for robotics. It involves modeling robot behavior and physical systems, automatically generating simulations from models, and testing and verifying properties through model checking and simulation. The goal is to produce certified control software for safe robotic systems through this model-driven development approach.

1. RoboStar Technology
Software Engineering for Robotics
Ana Cavalcanti
University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
November, 2019
Thanks:
Alvaro Miyazawa, Pedro Ribeiro, Augusto Sampaio, Jon Timmis, Jim Woodcock
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 1 / 37

2. Current approach to development in robotics
1st phase: Abstract model
state machine
1st phase: Abstract model
state machine
controller
code
hardware
simulation
discrete
environment
simulation
2nd phase: Simulation
controller
code
hardware
simulation
discrete
environment
simulation
2nd phase: Simulation
low-level
code robot environment
3rd phase: Implementation
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 2 / 37

3. Example state machines
Figure 1: Complete state diagram illustrating the operation of the Relay Chain algorithm. The three core states are chain
AUVs in the Relay Chain, explore AUVs in the exploratory shoal and navigate AUVs moving between chain and explore. The
initialisation flow chart is shown in (a)
.
end AUVs are special cases. As discussed in the initialis-
ing section the start AUV remains at the water’s surface and
initialises chain formation. The end AUV is both a member
of them in the chain. They aim to stay in a position halfway
between the AUVs on either side of them. If the halfway
distance exceeds a ‘stress threshold’ then it will stay nearer
Becky Naylor, Mark Read, Jon Timmis, and Andy Tyrrell.
The Relay Chain: Communication between an Exploratory Underwater Shoal and a Surface Vehicle.
ALIFE 14: Proceedings of the 14th International Conference on the Synthesis and Simulation of Living Systems.
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 3 / 37

4. Example state machines
“A group of e-puck robots transporting an object
(blue box) towards a goal (red cylinder).”
Jianing Chen, M. Gauci and R. Gross. “A strategy for transporting tall objects with a swarm of miniature mobile
robots”. In: Robotics and Automation (ICRA), 2013 IEEE International Conference on. 2013, pp. 863–869.
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 4 / 37

5. Our approach
RoboChart + RoboWorld
Model
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 5 / 37

6. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart+ RoboWorld
Model
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 6 / 37

7. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart+ RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 7 / 37

8. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 8 / 37

9. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 9 / 37

10. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
YES
Robotics
Simulator
valid?
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 10 / 37

11. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Robotics
Simulator
valid?
NO
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 11 / 37

12. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Robotics
Simulator
valid?
NOYESDeployment
Code AUTOMATIC
GENERATION
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 12 / 37

13. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Robotics
Simulator
valid?
NOYES
Test
cases
CONVERSION
Test
cases
Test
cases
Deployment
Code AUTOMATIC
GENERATION
System
Testing
correct?
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 13 / 37

14. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboChart + RoboWorld
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Robotics
Simulator
valid?
NOYES
Test
cases
CONVERSION
Test
cases
Test
cases
Deployment
Code AUTOMATIC
GENERATION
System
Testing
correct?
NO
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 14 / 37

15. Our approach
AUTOMATIC
GENERATION
Proof ModelRoboWorld+RoboChart
Model
Model checkers
Theorem provers
Properties of
interest
valid?
NO
RoboSim
Model
AUTOMATIC
GENERATION
YES
Robotics
Simulator
valid?
NOYES
Test
cases
CONVERSION
Test
cases
Test
cases
Deployment
Code AUTOMATIC
GENERATION
System
Testing
correct?
NOYES
Code Proofs
Test results and assumptions
Environment restrictions
CERTIFIED
FOR SAFE USE
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 15 / 37

16. Our approach
Control Software Platform Services Environment Assumptions
RoboChart + RoboWorld
Control Software
Platform
Physical Model Scenario
RoboSim
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 16 / 37

17. Our approach
Control Software Platform Services Environment Assumptions
RoboChart + RoboWorld
Control Software
Platform
Physical Model Scenario
RoboSim
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 17 / 37

18. Our approach
Control Software Platform Services Environment Assumptions
RoboChart + RoboWorld
Control Software
Platform
Physical Model
Scenario
RoboSim
Platform Services
realisation
abstraction
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 18 / 37

19. Our approach
Control Software Platform Services Environment Assumptions
RoboChart + RoboWorld
Control Software
Platform
Physical Model
Scenario
RoboSim
Platform Services
realisation
abstraction
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 19 / 37

20. A very small RoboSim example - d-model
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 20 / 37

21. Behaviour for RoboSim: cycle simulation
while
true
read sensors
process data
write to
actuators
cycle
period
{
...
Buffered parallelism
Visible behaviour: registerRead and registerWrite
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 21 / 37

22. Behaviour for RoboSim: cycle simulation
while
true
read sensors
process data
write to
actuators
cycle
period
{
...
Buffered parallelism
Visible behaviour: registerRead and registerWrite
?
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 21 / 37

23. p-model: physical model
Inspired by facilities offered by simulators
Basic notions: links, joints, sensors, actuators
Sensors, actuators, joints: system of differential algebraic
equations
Diagrammatic notation: block diagram
Linked to a module: platform mapping
Sensors and actuators → Variables, events, and operations
Automatic generation
XML-based SDF for simulation
CSP-based model for reasoning
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 22 / 37

24. p-model: physical model
Advantages over XML-based notations
Diagrammatic notation
Customised editor
Well-formedness constraints
Simple and clear mechanism to define poses (position and
orientation)
Indexing for collections of sensors and actuators
Structuring mechanisms
Extensibility
Modelling of behaviour: differential algebraic equations
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 23 / 37

25. A very small example - Not the footbot
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 24 / 37

26. A very small example - Not the footbot
link
link
body
body
joint
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 25 / 37

27. A very small example - Not the footbot
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 26 / 37

28. Joints - a small example
Part of a library
Behaviour: DAE systems
Relate inputs and outputs
May involve local variables and constants
Constants can be defined at instantiation
Sensors and actuators can be defined
in a similar way.
Equations can be obtained by curve
fitting based on experiments.
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 27 / 37

29. Actuator - a small example
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 28 / 37

30. Parts - a small example
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 29 / 37

31. Parts - a small example
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 30 / 37

32. Parts - a small example
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 31 / 37

33. Platform mappings
Association between d-model and p-model
Defines variables, events, and operations
Variable: input to actuators
Input events: predicate and communicated values, if any
Output events: assignment to inputs of actuators
Operations: actions or DAE systems
Very simple definitions: no time
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 32 / 37

34. Platform mapping - a small example
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 33 / 37

35. Automatic generation of simulations
Translation to SDF
Automatic
Useful tool for validation
Various physics engines
Equations are (mostly) ignored
Proof of properties is possible
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 34 / 37

36. RoboTool support for our approach
Eclipse plug-ins: www.cs.york.ac.uk/robostar/
RoboChart
Models
Requirements
ARGoS
RoboTool
C++
PRISM Storm
Reactive Modules
Formalism
CSP and
timed-CSP
Qualitative Results
Simulation
Quantitative
Results
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 35 / 37

37. So, what next?
RoboSim
Implementation
Refinement technique
Soundness
Case studies: driverless pod, sandwich maker, ...
Support to user
Properties language
Modelling of environment
Test generation
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 36 / 37

38. RoboSoft - A Royal Academy of Engineering Event
www.cs.york.ac.uk/robostar/robosoft
13-14 November, 2019 London, UK
Some of the invited speakers
Robin Bloomfield, UK
Davide Brugali, Italy
Kerstin Eder, Bristol Robotics Lab
Gusz Eiben, The Netherlands
Michael Fisher, Liverpool
Arnaud Gotlieb, Norway
Felix Ingrand, France
Patrizio Pelliccione, Sweden
Christian Schlegel, Germany
Alan Winfield, Bristol Robotics Lab
Ana Cavalcanti University of York, UK - RoboStar (www.cs.york.ac.uk/RoboStar)
RoboStar Technology – Software Engineering for Robotics 37 / 37