Table of Revisions

Algorithm In path and motion planning, RRT are used to find feasible trajectories connectinga given set of points in a subset of the state space, which does not contain anyobstacles and is thus called the free configuration space (see [LK01a] and the ref-erences therein). Our abstract RRT-based simulation algorithm contains the samemain steps as the classic RRT algorithms (see for example [KL00]). The free con-figuration space is indeed the state space X . The reachable points are stored in atree T , the root of which corresponds to the initial state. In iteration k, a point xkgoal Static Verification for AnalogExploration based on Random Trees • 105 in X is sampled. This point is called a goal point because it indicates the directiontowards which the tree is expected to evolve. Note that in most RRT algorithms,the sampling distribution of xkgoal is uniform over X . To grow the tree towards x kgoal ,first an initial point xkinit for the current integration step is determined. In the classicRRT algorithms, the point xkinit is a nearest neighbor of x kgoal (in the Euclidean dis-tance): xkinit =argminv∈V k−1 ||xkgoal − v|| where V k denotes the set of all vertices ofthe tree T at the end of iteration k. In our abstract algorithm, we do not specify howthis initial point is computed, but its computation should satisfy some conditionswhich will be detailed later. Then, the procedure BESTSUCCESSOR tries to findthe input so that the corresponding trajectory from xkinit approaches x kgoal as muchas possible, and this results in a new point xknew. The main ingredients of the aboveAlgorithm 7 RRT-based simulation algorithmT.init(x0), k = 1repeatxkgoal = SAMPLING(T k)xkinit = INITIALPOINT(T k,xkgoal)(uk,xknew) = BESTSUCCESSOR(x kinit ,h)NEWEDGE(T k,xkinit ,x knew), k++until k ≥ Kmax abstract algorithm are: sampling a goal point, finding an initial point, computing abest successor. So far, we did not detail how these functions are computed. In thenext section, we study the conditions for preserving the completeness of RRT inthe context of reachability computation.algorithm are: sampling a goal point, finding an initial point, computing abest successor. So far, we did not detail how these functions are computed. In thenext section, we study the conditions for preserving the completeness of RRT inthe context of reachability computation. Reachability Completeness Resolution completeness is an important property of RRT. It guarantees that forany point x in the free configuration space, the probability that the RRT tree T kcontains a vertex which is ε-close to x tends to 1 as the number k of iteration tendsto infinity [KL00, LK01a]. This property thus makes RRT very suitable for solvingsafety verification problems. However, note that the proofs of the completeness inthe path and motion planning context often assume that the whole free configura-tion space is ‘controllable’ in the sense that it is possible to reach any point in Xfrom the initial point x0 (see for example [KL00]). In our verification problem, notall the points in X are reachable from x0. Indeed, if this were true, the verificationproblem would be solved. But we can still prove the resolution completeness withrespect to the computation of the reachable set. We call this property reachabilitycompleteness. The proof of this result follows the idea of the proof in [CL02].However, the lack of the above-mentioned controllability assumption makes theproof more complicated. We first introduce some definitions and intermediate re-sults. 106 • Exploration based on Random TreesStatic Verification for Analog Definition 11. For any set S ⊆ X with positive volume, if the probability thatxkgoal ∈ S is strictly positive, then we say that the sampling process satisfies the fullcoverage sampling property. It is easy to see that the uniform sampling method satisfies this property. As weshall show later, it is a sufficient condition on the sampling process that guaranteesthe resolution completeness. In the remainder of the section, we assume that thesampling of goal points satisfies this property.Given x ∈ Rn and ε > 0, B(x,ε) is the ball with center x and radius ε. For a set Vof points in Rn, we denote the setS x∈V B(x,ε) by N(V,ε).Lemma 26. Let x ∈ Reach be a reachable point. Then, for any ε > 0 there exists afinite K such that ∃v ∈V K : Pr[v ∈ B(x,ε)]> 0 where V K is the set of RRT verticesat iteration K. The proof of this lemma can be found in [DN06]. We point out that the proof usesthe following important assumptions: • (A1) There is a non-null probability that each vertex in V k is selected to bexkinit .• (A2) If R f is a set of reachable states with positive volume, then for all k > 0Pr[xk+1new ∈ R f ]> 0. Intuitively, this assumption means that there is a non-nullprobability that ‘each reachable direction’ is selected. Theorem 27. [Reachability completeness] Given ε > 0 and a reachable pointx ∈ Reach,limk→∞Pr[x ∈ N(V ,ε)] = 1.(45) Proof. We first notice that the reachable set Reach is connected; therefore, forany ε > 0 the set Br(x) = Reach∩B(x,ε) is always non-empty with strictly pos-itive volume. Hence, using the full coverage sampling property, the probabilityPr[xkgoal ∈ Br(x)] > 0 for all k > 0. We call dk(x) =minv∈V k ||x− v|| the distancefrom x to V k. Initially, V 0 ={x0}, and hence d0(x) =||x−x0||. If at iteration k, thetree already contains a vertex inside Br(x) implying that x ∈ N(V k,ε), then (45) isproved. It remains to prove (45) for the case where all the points in V k are outsideBr(x). We have seen that Pr[xkgoal ∈ Br(x)]> 0, and we suppose that xkgoal ∈ Br(x).Because the whole set Br(x) is reachable, by Lemma 26, there exists a finite k′ > ksuch that∃v ∈V k′ : Pr[v ∈ Br(x)]> 0.Note that v ∈ Br(x) implies dk ′(x) < dk(x). In addition, dk(x) is non-increasingwith respect to k; therefore the expected value of the distance to x at iteration k′must be smaller than that at iteration k, that is E(dk ′(x)) < E(dk(x)). Therefore,limk→∞Pr[d(x)< ε] = 1, which means that limk→∞Pr[x ∈ N(V k,ε)] = 1 . Static Verification for AnalogExploration based on Random Trees • 107 Remark. The validity of the proof of the reachability completeness requires theassumptions (A1) and (A2). These assumption guarantee that for any reachablepoint x there is a non-null probability that the new vertex xk+1new reduces the distancefrom x to the tree. In fact, the selection of xkgoal controls the growth of the treeby determining both the initial point xkinit and the direction of the expansion ineach iteration. Consequently, to preserve the completeness it suffices to guaranteethe satisfaction of the assumptions (A1) and (A2). The following lemma shows asufficient condition for (A2) to be verified. Lemma 28. If the control set U is finite and for each u ∈U Pr[uk = u] > 0, thenthe assumption (A2) is satisfied. The proof of this lemma can be found in [DN06]. In the classic RRT algorithms,the initial point for each iteration is a nearest neighbor of the goal point, and thenew vertex is then computed by solving an optimal control problem (whose ob-jective is to minimize the distance to the current goal point). These two problemsare difficult, especially for non-linear systems in high dimensions. In the follow-ing, we shall exploit the above remark to derive a variant of the RRT algorithmwhich has lower complexity. Indeed, to determine the initial points we shall useapproximate nearest neighbors.Although this completeness property is mainly of theoretical interest, it is a wayto explain the good space-covering property of the RRT algorithm, which makes itsuccessful in solving robotic motion planning problems. This property also makesRRTs very suitable for our goal of developing a high-confidence simulation-basedvalidation method. Indeed, we build on top of the RRT algorithm a guiding tool tobias the exploration in order to achieve a good coverage of the system’s behaviorswe want to check. To this end, we need a coverage measure, which is the topic ofSection7.4. 7.3 Approximate RRTs Approximating Neighbors In this section, we show the construction of our approximate RRTs. The coordi-nates of the tree vertices are stored in a data structure which is similar to a kd-tree.We assume that the state space X is a box B . Each node of the tree has exactlytwo children. The information associated with a node s consists of a partitioning 108 • Exploration based on Random TreesStatic Verification for Analog Algorithm 8 Compute the box that contains xs = root(T ), H = /0while (!ISLEAF(T ,s)) dok = s.axis(), d = s.pos()if (x[k]≥ d) thens = s.RIGHTCHILD(), σ =−1elses = s.LEFTCHILD(), σ = 1end ifH = H ∪{H (k,d,σ)}end whileb = constructBox(H), Vs = s.ptset()return (s, b, V ) axis k = s.axis() and a partitioning position d = s.pos(), which define a partition-ing plane x[k] = d. The additional information associated with a leaf is a pointset Vs = s.ptset(). Each node thus corresponds to a box, defined recursively asfollows. The box of the root of the tree is B . If the box at the node s is b, andits left and right child nodes are respectively s1 and s2, then the boxes b1 and b2at s1 and s2 are the results of dividing the box b by the partitioning plane of theparent node s. We now show how to perform two important operations on theaRTT tree: adding a new point and finding a neighbor. To add a new point x inthe tree, we use the procedure CONTAININGLEAF in Algorithm 8, which traversesthe tree from its root to a leaf whose box contains x; this box is thus called thecontaining box of x. This procedure also collects all the half-spaces defining thecontaining box b and the point set V at the leaf. Then, the new point x is added inV . In the algorithm, H (k,d,σ) denotes the half-space defined as {x | σx[k]≤ σd}.If the new point set needs to be split, the box b is partitioned into two sub-boxesand two new children of s are created to store the points inside each sub-box. Itis easy to see that the containing box b of x does not necessarily contain a nearestneighbor of x, which may indeed be in a neighboring box. However, we restrictthe search for a neighbor only within the containing box. More concretely, let(s,b,Vs) = CONTAININGLEAF(x) where x = xkgoal , then we compute a neighbor ofx as:xinit =argminv ∈Vs ||x− v||.(46) It is important to note that this approximation is sufficient to preserve the resolutioncompleteness. Indeed, for any arbitrary vertex v∈Vs, the Voronoi cell Cv of v withrespect to b has positive volume. Due to the full coverage sampling property, theprobability that the goal point is in Cv ∩ b is positive and thus the probability thatv is the initial point xkinit as determined in (46) is also positive. The reason we usethis approximation is that it has lower complexity with respect to dimension thanthe computation of exact nearest neighbors. It is important to note that althoughthe resolution completeness is preserved, excessive error in this approximationmight slow down significantly the convergence of the algorithm. Consequently, wecontrol the error by fixing a maximum size of the containing boxes in the partition. Static Verification for AnalogExploration based on Random Trees • 109 An additional rule for partitioning is the maximal number of points in each box. 7.4 Coverage Measure As mentioned earlier, simulation coverage is a way to evaluate the simulation qual-ity. More precisely, it is a way to relate the number of simulations to carry out withthe fraction of the system’s behaviors effectively explored. The classic coveragenotions mainly used in software testing, such as statement coverage and if-then-else branch coverage, path coverage (see for example [ZHM97, T99]), are notappropriate for the trajectories of continuous and hybrid systems defined by differ-ential equations. However, geometric properties of the hybrid state space can beexploited to define a coverage measure which, on one hand, has a close relationshipwith the properties to verify and, on the other hand, can be efficiently computed orestimated. In this work, we are interested in point coverage and focus on a mea-sure that describes how ‘well’ the explored points represent the reachable set ofthe system. This measure is the star discrepancy in statistics, which characterizesthe uniformity of the distribution of a point set within a region. Star Discrepancy as Simulation Coverage In this section, we present a brief introduction of the star discrepancy. The readeris referred to the excellent books on this topic, such as [KN74, BC97, M99, T00].The star discrepancy is an important notion in equidistribution theory as well as inquasi-Monte Carlo techniques (see for example [E01]).We assume that the state space X is a box B =[l1,L1]× . . .× [ln,Ln], called thebounding box. Given a set of k points P = {p1, p2, . . . , pk} where each point pi isin B . The star discrepancy of P with respect to the box B is defined as: D∗(P,B ) =supJ∈ΓD(P,J) where D(P,J) is the local discrepancy with respect to J, a sub box of B of the formJ =∏i=1[li,βi] withβi ∈ [li,Li]. The set Γ is the set of all such sub-boxes. Thelocal discrepancy is defined as follows: D(P,J) = |k− λ(J)λ(B )| 110 • Exploration based on Random TreesStatic Verification for Analog where A(P,J) is the number of points of P that are inside J, and λ(J) is the volumeof the box J. Note that 0 < D∗(P,B )≤ 1.Intuitively, the star discrepancy is a measure for the irregularity of a set of points.A large value D∗(P,B ) means that the points in P are not much equidistributedover B . Simulation Coverage. Let P be the set of all points explored by a simulation.The coverage of this simulation is defined as: Cov(P) = 1−D∗(P,B ). This meansthat a large value of Cov(P) indicates a good coverage quality. Estimation of the Simulation Coverage The computation of the star discrepancy is not easy (see for example [N72, DE93,WF97]). Many theoretical results for one-dimensional point sets are not general-izable to higher dimensions, and among the fastest algorithms we can mention theone proposed in [DE93] of time complexity O (k1+d/2). In this work, we do nottry to compute the star discrepancy but approximate it by estimating a lower andupper bound. These bounds are then used to decide whether the box b has been‘well explored’ or it needs to be explored more. This estimation is based on theresults published by Eric Thiémard [T00, T00]. Let us briefly recall these results.Although in these results, the box B is [0,1]n, we have extended to the general casewhere B can be any full-dimensional box.We define a box partition of B as a set of boxes Π= {b1, . . . ,b} such that∪i=1b =B and the interiors of the boxes b do not intersect. Each such box is called anelementary box. Given a box b =[α1,b2]× . . .× [αn,bn] ∈ Π, we define b =[l1,b1]× . . .× [ln,bn] and b− =[l1,α1]× . . .× [ln,αn]. Recall that the boundingbox is B =[l1,L1]× . . .× [ln,Ln] (see Figure 18 for an illustration). For any finite