Source of Acquisition NASA Goddad Space Flight Center International Journal on Software Tools Technology Transfer manuscript No. (will be inserted by the editor) Christopher A. Rouff - Michael G. Hinchey - Walter F. Truszkowski - James L. Rash Experiences applying Formal Approaches in the Development of Swarm-Based Space Exploration Systems Abstract NASA is researching advanced technologies being replaced with missions that involve smaller collab- for future exploration missions using intelligent swarms orating spacecraft, analogous to swarms in nature [13]. of robotic vehicles. One of these missions is the Au- This approach offers several advantages: the ability to tonomous Nan0 Technology Swarm (ANTS) mission that send spacecraft to explore regions of space where tradi- will explore the asteroid belt using 1,000 cooperative au- tional craft simply would be impractical, greater redun- tonomous spacecraft. The emergent properties of intel- dancy (and, consequently, greater protection of assets), ligent swarms make it a potentially powerful concept, and reduced costs and risk, to name but a few. Concept but at the same time more difficult to design and ensure swarm missions entail the use of unmanned autonomous that the proper behaviors will emerge. NASA is investi- vehicles (UAVs) flying approximately one meter above gating formal methods and techniques for verification of the surface of Mars, which will cover as much of the sur- such missions. The advantage of using formal methods face of Mars in three seconds as the now famous Mars is the ability to mathematically verify the behavior of rovers did in their entire time on the planet; the use of a swarm, emergent or otherwise. Using the ANTS mis- armies of tetrahedral walkers to explore the Mars and sion as a case study, we have evaluated multiple formal Lunar surface [12]; constellations of satellites flying in methods to determine their effectiveness in modeling and formation; and, the use of miniaturized spacecraft to ex- ensuring desired swarm behavior. This paper discusses plore the asteroid belt, where heretofore it has been im- the results of this evaluation and proposes an integrated possible to send exploration craft without the high like- formal method for ensuring correct behavior of future lihood of loss 1131. NASA intelligent swarms. These new approaches to exploration simultaneously pose many challenges. The missions will be unmanned Keywords Validation . Verification . Formal Methods . and highly autonomous. They will also exhibit the prop- Swarm erties of autonomic systems, being self-protecting, self- healing, self-configuring, and self-optimizing. Many of these missions will be sent to parts of the solar system 1 Introduction where manned missions are simply not possible, and to where the round-trip delay for communications to space- NASA is investigating new paradigms for future space craft exceeds 40 minutes, meaning that the decisions on exploration, heavily focused on the (still) emerging tech- responses to exploration opportunities as well as prob- nologies of autonomous and autonomic systems [45,46]. lems and undesirable situations must be made zn sztu Traditional missions, reliant on one large spacecraft, are rather than from ground control on Earth. The degree of autonomy and intelligence that such ChristoDher A. Rouff missions will possess would require a prohibitive amount SAIC of testing. Furthermore, with learning and autonoinic Intelligent Systems Division properties, such as self-optimizing and self-healing. emer- McLean. VA USA Email. rouffcQsaic.com gent behavior patterns simply cannot be fully predicted. The authors believe that formal specification techniques Michael G Hinchey, Walter F Ruszkowski, James L Rash and formal verification will play important roles in the NASA Goddard Space Flight Center Information Systems Division future development of NASA space exploration missions Greenbelt, MD. USA Formal methods will likely play a major role in the spec- E-mail {michael g hinchey, walter f truszkows ki. ification and analysis of forthcoming missions. enahling james 1 rash}Onasa gov software assurance and proof of correctness of the be- 2 Fbuffet d. havior of the swarm, even (it is projected) when this behavior is emergent (as a result of composing a large number of interacting entities, producing behavior that was not foreseen). Formal models derived may also be Asteroid beltv used as the basis for automating the generation of much of the code for the mission [20]. To address the challenge in verifying the above mis- Rulers Lagrangian point sions, a NASA project, Formal Approaches to Swarm habitat Technology (FAST), is investigating appropriate formal methods for use in such missions, and is beginning to apply these techniques to specifying and verifying parts of a NASA swarm-based concept mission. The remain- Earth der of this paper gives an overview of swarm technologies and the ANTS swarm-based mission, presents the results of evaluation of a number of formal methods for verify- ing swarm-based missions, and proposes an integrated formal method for verifying swarm-based systems. Fig. ANTS Concept 2 Swarm Technologies 1 Mission Swarms [1,2] consist of a large number of simple agents different things, develop different goals, and thereby be- that have local interactions (between each other and the come a heterogeneous swarm. Intelligent swarms may environment). There is no central controller directing the also from the beginning be made up of heterogeneous swarm and no one agent has a global view; they are elements, such as the NASA concept mission described self-organizing based on the emergent behaviors of the below, reflecting different capabilities as well as a possi- simple interactions. This type of behavior is observed in ble social structure. This makes verifying such systems insects and flocks of birds. Bonabeau et al. [SI, who stud- even more difficult since the swarms are no longer made ied self-organization in social insects, state that “com- up of homogeneous members with limited intelligence plex collective behaviors may emerge from interactions and communications. among individuals that exhibit simple behaviors” and The remainder of this section gives an overview of describe emergent behavior as “a set of dynamical mech- the NASA ANTS concept swarm-based mission. We are anisms whereby structures appear at the global level of using the ANTS mission as an example test-bed and a system from interactions among its lower-level compo- case study, for the purpose of evaluating multiple formal nents.” The emergent behavior is sometimes referred to methods in the specification, validation, and verification as the macroscopic behavior and the individual behavior of swarm-based missions. and local interactions as the microscopic behavior. Agent swarms are often used as a modeling technique and as a tool to study complex systems [16]. In swarm 2.1 ANTS Mission Overview simulations, a group of interacting agents [48] (often ho- mogeneous or near homogeneous agents) is studied for The Autonomous Nano-Technology Swarm (ANTS) con- their emergent behavior. Examples of the use of swarm cept mission [12-141 will involve the launch of a swarm simulations includes studying flocks of birds [9,30], busi- of autonomous pico-class (approximately 1kg) spacecraft ness and economics 1271, and ecological systems [37]. In that will explore the asteroid belt for asteroids with cer- swarm simulations, each of the agents is given certain tain scientific characteristics. Figure 1 gives an overview parameters that it tries to maximize. In terms of bird of the ANTS mission [45]. In this mission, a transport swarms, each bird tries to find another bird to fly with, ship, launched from Earth, will travel to a point in space and then fly off to one side and slightly higher to reduce where net gravitational forces on small objects (such as its drag. Eventually the birds form flocks. Swarms axe pico-class spacecraft) are negligible (a Lagrangian point). also being investigated for use in applications such as From this point, 1000 spacecraft, that have been manu- telephone switching, network routing, data categorizing, factured en route from Earth, will be launched into the and shortest path optimizations [5]. asteroid belt. The asteroid belt presents a large risk of Intelligent swarm technology is where the individual destruction for large (traditional) spacecraft. Even with members of a swarm also exhibit intelligence [4,5]. With pico-class spacecraft, 60 to 70 percent of them are ex- intelligent swarms, membeis may be heterogeneous or pected to be lost. Because of their small size, each space- homogeneous. Even if members start out as homoge- craft will carry just one specialized instrument for col- neous, due to their differing environments they may learn lecting a specific type of data from asteroids in the belt. Formal Approaches in Swarm-Based Systems 3 To implement this mission, a heuristic approach is - Self-Healing: ANTS must self-heal to recover from being considered that provides for a social structure to damage due either to solar storms or to collision with the spacecraft that uses a hierarchical behavior analo- asteroids or (possibly) other ANTS spacecraft. Loss gous to colonies or swarms of insects, with some space- of a particular type of instrument may require the craft directing others. Artificial intelligence technologies launch of a replacement from Earth; loss of a ruler or such as genetic algorithms, neural nets, fuzzy logic, and messenger may involve a worker being “upgraded” on-board planners are being investigated to assist the to fulfill that role. Additionally, loss of power may mission to maintain a high level of autonomy. Crucial require a worker to be killed off [41]. to the mission will be the ability to modify its opera- - Self-Protecting: In addition to protection from colli- tions autonomously to reflect the changing nature of the sion with asteroids and other spacecraft] ANTS teams mission and the distance and low bandwidth communi- must protect themselves from solar storms, where cations back to Earth.