Towards Formal Verification of Freeway Traffic Control Stefan Mitsch - - PowerPoint PPT Presentation

▶
towards formal verification of
SMART_READER_LITE
LIVE PREVIEW

Towards Formal Verification of Freeway Traffic Control Stefan Mitsch - - PowerPoint PPT Presentation

Feb 03, 2024 96 likes •522 views

Towards Formal Verification of Freeway Traffic Control Stefan Mitsch Sarah Loos, and Andr Platzer Information Systems Group Computer Science Department Johannes Kepler University Carnegie Mellon University April 19, 2012 How Can We Prove

slide-1
SLIDE 1

Sarah Loos, and André Platzer Computer Science Department Carnegie Mellon University

Towards Formal Verification of Freeway Traffic Control

Stefan Mitsch Information Systems Group Johannes Kepler University April 19, 2012

slide-2
SLIDE 2

How Can We Prove Complex Highways?

2/22

slide-3
SLIDE 3

How Can We Prove Complex Highways?

Traffic centers aim at global functioning and safety.

3/22

  • bserved by

local sensor range

slide-4
SLIDE 4

How Can We Prove Complex Highways?

3/22

Traffic centers aim at global functioning and safety. Open-loop control systems (give advice, e.g., speed limits)

slide-5
SLIDE 5

How Can We Prove Complex Highways?

3/22

Traffic centers aim at global functioning and safety. Open-loop control systems (give advice, e.g., speed limits) Closed-loop: use car information and feed advice as set values into car controllers

slide-6
SLIDE 6

Traffic Control: Outline

Variable Speed Limit Control Moving Incident Warning Control Moving Incident Warning Control w/ Zeno Avoidance

1 vehicle n traffic advice 1 vehicle 1 incident n traffic advice 1 vehicles 1 incident n traffic advice, 1 warning 4/22

slide-7
SLIDE 7

Traffic Control: Variable Speed Limit

Variable Speed Limit Control Moving Incident Warning Control Moving Incident Warning Control w/ Zeno Avoidance

1 vehicle n traffic advice 1 vehicle 1 incident n traffic advice 1 vehicles 1 incident n traffic advice, 1 warning 4/22

slide-8
SLIDE 8

Variable Speed Limit Challenges

Traffic center: intelligent speed adaptation system

  • Global decisions beyond local sensor range
  • Multiple, sequentially issued speed limits

In-car driver assistance systems: traffic sign detection

  • Find design parameters (camera resolution, etc.)

5/22

slide-9
SLIDE 9

Di Different ntial Dyna l Dynami mic L Logic*

*

Initial Conditions → [Model] Requirements

*The

he s sho hort v version. n.

6/22

slide-10
SLIDE 10

Initial Conditions → [Model] Requirements

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-11
SLIDE 11

Initial Conditions → [Model] Requirements

logical formula logical formula

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-12
SLIDE 12

Initial Conditions → [Model] Requirements

logical formula logical formula

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-13
SLIDE 13

Initial Conditions → [Model] Requirements

logical formula logical formula

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-14
SLIDE 14

Initial Conditions → [Model] Requirements

logical formula logical formula hybrid program

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-15
SLIDE 15

Initial Conditions → [Model] Requirements

logical formula logical formula hybrid program discrete control continuous dynamics

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-16
SLIDE 16

logical formula logical formula hybrid program

→ [(ctrl;dyn)*]

discrete control continuous dynamics

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-17
SLIDE 17

logical formula logical formula hybrid program

→ [(ctrl; x’= ¡v; ¡v’= ¡a)*]

discrete control continuous dynamics

Di Different ntial Dyna l Dynami mic L Logic

6/22

slide-18
SLIDE 18

Traffic Control: Speed Limit Compliance

7/22

Car is able to follow a speed limit advice if .

slide-19
SLIDE 19

Traffic Control: Speed Limit Compliance

Car is able to follow a speed limit advice if .

7/22

slide-20
SLIDE 20

Traffic Control: Speed Limit Compliance

car already follows speed limit advice

Car is able to follow a speed limit advice if .

7/22

slide-21
SLIDE 21

Traffic Control: Speed Limit Compliance

car is still able to brake

Car is able to follow a speed limit advice if .

car already follows speed limit advice

7/22

slide-22
SLIDE 22

Traffic Control: Speed Limit Compliance

Initial Conditions → [Model] Requirements

To Prove:

8/22

slide-23
SLIDE 23

Traffic Control: Speed Limit Compliance

Initial Conditions → [Model] Requirements

To Prove:

8/22 h

✔

slide-24
SLIDE 24

Design Implications (Traffic center)

9/22

Traffic center must be able to measure or estimate car parameters

  • Position, current velocity
  • Maximum acceleration, braking power

Communication delay must be bounded

  • May not be possible with wireless

communication: fault-tolerant design

slide-25
SLIDE 25

Design Implications (Driver assistance 1/2)

10/22

Image size

  • Adjust 60km/h to 50km/h speed limit

braking at 2m/s2 takes 26m braking distance

  • Camera features:
  • Speed limit sign: width = 12 pixels

Image processing tradeoff (higher resolution vs. processing speed)

(2011)

slide-26
SLIDE 26

Design Implications (Driver assistance 2/2)

Image processing tradeoff Requirement: 20px width (a) Replace 63mm lens with 102mm (b) Increase algorithm performance 1040px instead of 640px image (c) Keep lens/camera, but brake harder braking at 3.4m/s² instead of 2m/s² gives braking distance of 16m

11/22

slide-27
SLIDE 27

Traffic Control: Incident Warning

Variable Speed Limit Control Moving Incident Warning Control Moving Incident Warning Control w/ Zeno Avoidance

1 vehicle n traffic advice 1 vehicle 1 incident n traffic advice/warnings 1 vehicles 1 incident n traffic advice, 1 warning 12/22

slide-28
SLIDE 28

Incident Warning Challenges

Traffic center: long-term incident warning (e.g., accidents, traffic jams, wrong-way drivers)

  • Motion towards car
  • May exceed local sensor coverage

In-car driver assistance systems: short-term

  • Find design parameters (camera resolution, etc.)
  • Estimate system performance (e.g., speed reduction)

13/22

slide-29
SLIDE 29

Traffic Control: Incident Warning

14/22

Car is able to react to an incident warning if .

slide-30
SLIDE 30

Traffic Control: Incident Warning

As before: speed limit compliance Requirements inside or

  • utside warning area

14/22

Car is able to react to an incident warning if .

slide-31
SLIDE 31

Traffic Control: Incident Warning

Car can still brake before warning area, keeping in mind that incident may move towards car Outside warning area After incident

14/22

Car is able to react to an incident warning if .

slide-32
SLIDE 32

Traffic Control: Incident Warning

Inside warning area Warning is in front

  • f incident

Car will reach warning faster than incident Car already passed warning

14/22

Car is able to react to an incident warning if .

slide-33
SLIDE 33

Traffic Control: Incident Warning

Initial Conditions → [Model] Requirements

To Prove:

15/22

slide-34
SLIDE 34

Traffic Control: Incident Warning

Initial Conditions → [Model] Requirements

To Prove:

15/22 h

✔

slide-35
SLIDE 35

Design Implications (Traffic center)

Traffic center must be able to measure or estimate incident parameters

  • Position and velocity of incident

Assume reasonable car behavior

  • Car is not allowed to wait for incident
  • Unreasonably small minimum velocity

results in large warning area

16/22

slide-36
SLIDE 36

Design Implications (Driver assistance)

Fast-moving incidents exceed local sensor range

  • 30m/s car and incident (e.g., wrong-way

driver)

  • 4m/s² accel., 9m/s² braking, 0.1s reaction
  • 163m sensor range for a complete stand

still

17/22

slide-37
SLIDE 37

Traffic Control: Incident Warning

Variable Speed Limit Control Moving Incident Warning Control Moving Incident Warning Control w/ Zeno Avoidance

1 vehicle n traffic advice 1 vehicle 1 incident n traffic advice/warnings 1 vehicles 1 incident n traffic advice, 1 warning 18/22

slide-38
SLIDE 38

Traffic Control: Incident Warning

Avoid Zeno-type effects when warning cars

19/22

slide-39
SLIDE 39

Conclusions

Closed-loop traffic control: cope with limited local sensor coverage globally in traffic centers

  • Incidents, may move towards cars

Traffic control models are formally verified Derive design decisions from verified models

  • Image processing performance, camera resolution, etc.
  • Local sensor range

20/22

slide-40
SLIDE 40

Future Work

  • Dedicated up- and downlinks for communication
  • Multiple control decisions during one

communication roundtrip

  • Advanced physical models (curves, road

conditions, etc.)

  • Collaborative, global control actions in a fleet of

cars (V2V communication)

21/22

slide-41
SLIDE 41

Conclusions Reference

22/22 For the full paper see:

Stefan Mitsch, Sarah M. Loos, and André Platzer. Towards Formal Verification

  • f Freeway Traffic Control. In International Conference on Cyber-Physical

Systems, ICCPS, Beijing, China, April 17-19. 2012.