David J. Musliner

CIRCA: a cooperative intelligent real-time control architecture

Most research into applying AI techniques to real-time control problems has limited the power of AI methods or embedded reactivity in an AI system. An alternative, cooperative architecture is presented. It uses separate AI and real-time subsystems to address the problems for which each is designed. A structured interface allows the subsystems to communicate without compromising their respective performance goals. By reasoning about its own bounded reactivity, cooperative intelligent real-time control architecture (CIRCA) can guarantee that it will meet hard deadlines while still using unpredictable AI methods. With its abilities to guarantee or trade off the timeliness, precision, confidence, and completeness of its output, CIRCA provides more flexible performance than previous systems. >

World modeling for the dynamic construction of real-time control plans

Abstract As intelligent, autonomous systems are embedded in critical real-world environments, it becomes increasingly important to rigorously characterize how these systems will perform. Research in real-time computing and control has developed ways of proving that a given control system will meet the demands of an environment, but has not addressed the dynamic planning of control actions. Building an agent that can flexibly achieve its goals in changing environments requires a blending of real-time computing and AI technologies. The Cooperative Intelligent Real-time Control Architecture (CIRCA) implements this blending by executing complex AI methods and guaranteed real-time control plans on separate subsystems. We describe the formal model of agent/environment interactions that CIRCA uses to build control plans, and we show how those control plans are guaranteed to meet domain requirements. CIRCAs world model provides the information required to make real-time performance guarantees, but avoids unnecessary complexity.

Coordinated deployment of multiple, heterogeneous robots

To be truly useful, mobile robots need to be fairly autonomous and easy to control. This is especially true in situations where multiple robots are used, due to the increase in sensory information and the fact that the robots can interfere with one another. The paper describes a system that integrates autonomous navigation, a task executive, task planning, and an intuitive graphical user interface to control multiple, heterogeneous robots. We have demonstrated a prototype system that plans and coordinates the deployment of teams of robots. Testing has shown the effectiveness and robustness of the system, and of the coordination strategies in particular.

Self-adaptive software for hard real-time environments

Researchers in the Automated Reasoning group at the Honeywell Technology Center and at the University of Michigan are developing adaptive intelligent software for high-risk situations. We are building a system called Self-Adaptive CIRCA (based on our cooperative intelligent real-time control architecture model) that combines the assurance of hard real-time systems with the self-modeling, self-monitoring, and self-modifying capabilities of self-adaptive software. The article describes elements of the system that are working now, as well as new components that we are still in the process of designing and building.

Exploiting Implicit Representations in Timed Automaton Verification for Controller Synthesis

Automatic controller synthesis and verification techniques promise to revolutionize the construction of high-confidence software. However, approaches based on explicit state-machine models are subject to extreme state-space explosion and the accompanying scale limitations. In this paper, we describe how to exploit an implicit, transition-based, representation of timed automata in controller synthesis. The CIRCA Controller Synthesis Module (CSM) automatically synthesizes hard real-time, reactive controllers using a transition-based implicit representation of the state space. By exploiting this implicit representation in search for a controller and in a customized model checking verifier, the CSM is able to efficiently build controllers for problems with very large state spaces. We provide experimental results that show substantial speed-up and orders-of-magnitude reductions in the state spaces explored. These results can be applied to other verification problems, both in the context of controller synthesis and in more traditional verification problems.

Certification considerations for adaptive systems

Advanced capabilities planned for the next generation of unmanned aircraft will be based on complex new algorithms and non-traditional software elements. These aircraft will incorporate adaptive and intelligent control algorithms that will provide enhanced safety, autonomy, and high-level decision-making functions normally performed by human pilots, as well as robustness in the presence of failures and adverse flight conditions. This paper discusses the characteristics of adaptive algorithms and the challenges they present to certification for operation in the National Airspace System (NAS). We provide mitigation strategies that may make it possible to overcome these challenges.

Execution monitoring and recovery planning with time

Focusing on the J.F. Allen and J.A. Koomen (1983) temporal planning scheme, the authors characterize the possible locations for failure during plan execution. By observing the interval collapse criterion during plan generation, the planner is able to integrate the planning of goal-directed actions and execution verification actions. This allows the planner to schedule sensor usage and reason about sensing and data processing delays. The authors also present a simple and robust recovery planning scheme which inserts corrective steps into the original plan. The authors generate purely inserted recovery plans efficiently, without destroying the original plan and without unnecessary temporal inferencing.<<ETX>>

FUZZBUSTER: Towards Adaptive Immunity from Cyber Threats

Todays computer systems are under relentless attack from cyber attackers armed with sophisticated vulnerability search and exploit development toolkits. To protect against such threats, we are developing FUZZBUSTER, an automated system that provides adaptive immunity against a wide variety of cyber threats. FUZZBUSTER reacts to observed attacks and proactively searches for never-before-seen vulnerabilities. FUZZBUSTER uses a suite of fuzz testing and vulnerability assessment tools to find or verify the existence of vulnerabilities. Then FUZZBUSTER conducts additional tests to characterize the extent of the vulnerability, identifying ways it can be triggered. After characterizing a vulnerability, FUZZBUSTER synthesizes and applies an adaptation to prevent future exploits.

Delegating to Automation Performance, Complacency and Bias Effects under Non-Optimal Conditions

We have advocated adaptable automation approaches—those in which the human retains the role of instructing and tasking—and specifically have used the metaphor of a sports team’s “playbook”. Several prior experiments have shown benefits to flexible play calling, so the present work focuses on performance in “non-optimal play environments” (NOPEs) where the defined plays are a poor fit resulting in a need to either modify them dynamically (provide additional instruction) or to abandon play-level automation and resort to more manual levels of control. We might expect that prolonged play usage under optimal conditions would result in automation complacency effects and even loss of training. In two reported experiments, we find little evidence for complacency effects and, instead, show that having access to plays sometimes provides benefits even during NOPE intervals where they were not (directly) useful.

Applications of model checking at Honeywell Laboratories

This paper provides a brief overview of five projects in which Honeywell has successfully used or developed model checking methods in the verification and synthesis of safety-critical systems.