A Formal Model of a Multi-Robot
Control and Communication Task
Eric Klavins
1
Computer Science Department
California Institute of Technology, Pasadena, CA
klavins@caltech.edu
Abstract
We introduce the Computation and Control Language
(CCL), a guarded-command language for expressing
systems wherein control and computation are inter-
twined. A CCL program consists of a set of guarded
commands that may update continuous or discrete vari-
ables and that can be reasoned about using a simple
temporal logic. In this paper, a detailed case study of
a robot capture-the-flag system, called the “RoboFlag
Drill”, is encoded in CCL and certain properties of it
are verified. The example consists of a self-stabilizing
communications protocol whose behavior depends on
the actions taken by the robots in their environment.
The paper concludes with a brief overview of our initial
implementation of the formal semantics of CCL as a
practical programming language.
1 Introduction
We are interested in designing large scale decentralized
systems with multiple computational and controlled el-
ements such as multi-vehicle systems or automated fac-
tories. Generally, to understand and control these sys-
tems, a combination of control, computation and com-
munication theory is needed at various different levels.
In any non-trivial system, these seemingly separate as-
pects of system design become intermingled. The re-
sult is that, for example, the verification of the control
part of the design depends heavily on the design of the
communications part, requiring, ideally, that these two
aspects of the design inhabit the same formalism.
For instance, the problem we consider in this paper
(Section 3.2) involves a group of robots that must de-
fend their flag against a group of opponent robots in
a capture-the-flag like game. Thus, each robot must
perform a low level motion control task (tracking an
opponent) and simultaneously take part in a high level
communications protocol with the other robots (to de-
cide who should track what opponent). The protocol
1
This research is supported in part by AFOSR grant number
F49620-01-1-0361.
we propose is self-stabilizing [6] under certain circum-
stances (explored in Section 6) that depend on the mo-
tions of the robots. The stable configuration of the
protocol corresponds to a reasonable agreement among
the defending robots about who will track whom and
is important for the entire control scheme to function
correctly.
We specify this system in a formalism called the Com-
putation and Control Language (CCL). CCL is inspired
by the UNITY formalism for parallel programming [3]
but is adapted to dynamical systems and control tasks.
Simply put, a CCL program consists of a set of guarded
commands that are executed in some order at each step
in the evolution of the system. One feature of CCL is
that the dynamics of the environment are modeled by a
subset of the commands and not by separate differential
equations. The result is that the distinction between
the internal (logical) and external (physical) states of
the system under consideration is lost, allowing a single
set of tools to be used for modeling, specification and
analysis.
The main contributions of the paper are the introduc-
tion of CCL (Section 3) including a formal description
of its semantics (Section 4) and the logic used to rea-
son about CCL programs (Section 5). The static oper-
ator (Definition 5.4) that deals with arbitrary schedules
is, in particular, new. We also present a detailed case
study of the use of CCL with a simplified version of
the above-mentioned capture-the-flag system which we
both specify (Section 3.2) and verify (Section 6). Ul-
timately we intend for CCL to be used to not only for
modeling and analysis of systems but also as a pro-
gramming tool in its own right. Thus we also describe
a runtime CCL interpreter (Section 7). We begin with
a review of related work.
2 Related Work
The UNITY formalism was introduced in [3] and is used
to specify and reason about concurrent reactive systems
[13] and has been extended to real time systems [2].
Although UNITY was designed as a reasoning tool, an