A Formal Safety Net for Waypoint-Following in Ground Robots

We present a reusable formally verified safety net that provides end-to-end safety and liveness guarantees for two-dimensional waypoint-following of Dubins-type ground robots with tolerances and acceleration. First, we model a robot in differential dynamic logic and specify assumptions on the controller and robot kinematics. Second, we prove formal safety and liveness properties for waypoint-following with speed limits. Third, we synthesize a monitor, which is automatically proven to enforce model compliance at runtime. Fourth, our use of the VeriPhy toolchain makes these guarantees carry over down to the level of machine code with untrusted controllers, environments, and plans. The guarantees for the safety net apply to any robot as long as the waypoints are chosen safely and the physical assumptions in its model hold. Experiments show that these assumptions hold in practice, with an inherent tradeoff between compliance and performance.