Planning for Autonomous Planetary VehiclesGiuseppe Della Penna*, Benedetto Intrigilat , Daniele Magazzenit and Fabio Mercorio*

*Department of Computer Science, ~University of L' Aquila, L' Aquila - ItalyEmail: giuseppe.dellapenna@univaq.it.fabio.mercorio@univaq.it

tDepartment of Mathematics, University of Roma "Tor Vergata", Rome - ItalyEmail: intrigil@mat.uniroma2.it

tDepartment of Science, ~University of Chieti, Chieti - ItalyEmail: magazzeni@sci.unich.it

Abstract-Autonomous vehicles are often complex systemsthat work in a partially unknown environment, with narrowenergy/time/movement constraints. Formal models for such ve­hicles usually involve hybrid systems with nonlinear dynamics,which are difficult to handle by most of the current planningalgorithms and tools. Therefore, when offline planning of thevehicle activities is required, for example for rovers that operatewithout a continuous Earth supervision, such planning is oftenperformed on simplified models that are not completely realistic.In this paper we show how a model checking based tool, namelyUPMurphi, can be used to generate optimal plans to contml theengine of an autonomous planetary vehicle, working directly onits hybrid model, and thus achieving very accurate results.

Index Terms-planning, autonomous vehicle, hybrid systems

L INTRODUCTION

Autonomous planetary vehicles, commonly known asrovers, are a great challenge in the field of autonomousvehicles, since they have often to take actions on a hazardousground with nan-ow time and energy consumption constraints.

Rovers operating on distant planets may receive commandsfrom Earth operators only once per day, and during the remain­ing time they have to perform a specific mission, which mayinclude moving to a specific place, position some instruments,take measures, etc [1], [2].

Usually, rover activities are converted on the ground into adetailed plan that, once generated and uploaded to the vehicle,drives it for the rest of the mission. Therefore, planning forthis kind of autonomous vehicles should be very precise andtake into consideration many factors [3].

/1. Motivation

As noted, many rover activities begin with a movement thatplaces it in a specified location. Thus, independently from thenature of the rover's mission, reaching the activity locationis the first goal to achieve, and it urust satisfy two mainconstraints: energy and time consumption. Indeed, at the endof the journey, rover batteries must stil1 contain enough chargeto perform the activity, or at least to begin it, assuming thatthe vehicle is equipped with solar panels and in sunlight, so itcan recharge its battery when needed. Moreover, the rover hasto complete its task as soon as possible, since environmentalconditions may quickly change, and in general a shorter task

duration means that the rover will be able to perform moreactivities during the mission time.

Unfortunately, also in this simplified setting, the rover stillrepresents a hybrid system (i.e., described by both discrete andcontinuous variables), and the equations describing values suchas energy consumption are usually nonlinear. Many effortshave been made to improve planning algorithms so as to copewith hybrid systems [4], however nonlinearity continues tobe a relevant problem for many well-known planners such asTM-LPSAT [5], UPPAAL-TIGA [6] or MIPS [7].

Therefore, while a precise planning of the rover activities isimportant, automatically generating an optimal plan w.r.t timeand energy for the rover movements may be a hard task.

B. Contribution

In this paper we show how an explicit model checking­based planner, namely UPMurphi [8], developed the sameauthors, can be used to generate optimal plans to control arover's engine, in order to move it for a specific distancein the least possible time, while satisfying a set of technicalconstraints and trying to save energy.

Indeed, thanks to the model checking algorithms, UPMurphiis able to cope with systems showing high complexity and abehavior that is difficult to predict, as hybrid nonlinear systemsusually are.

In the presented case study, the rover dynamics and be­havior, including some common technical constraints, havebeen modelled through general equations, that may apply to awide range of vehicles. Plans have been optimized to minimizeenergy and time requirements, and the given minimal batterycharge is always preserved. Therefore, the results are quiterealistic.

Indeed, to the best of our knowledge, this is the first suc­cessful attempt to automatically generate time and resource­optimal plans for a rover model of such complexity.

The paper is organized as follows. Section II shows somerelated work about planning algorithms and tools for hy­brid and nonlinear systems. Section III describes the modelchecking approach to the planning problem and introducesthe UPMurphi planner. Section IV defines our case study andcomments the planning results. Finally, Section V containssome closing remarks.

2010 Sixth International Conference on Autonomic and Autonomous Systems

978-0-7695-3970-6/10 $26.00 © 2010 IEEE

DOI 10.1109/ICAS.2010.26

131

II. RELATED WORK

The planning problem presented in this paper can be gener­ally defined as planning with resource consumption [9], [10],[11].

Different techniques have been developed by the JPL [12]and applied to such kind of activity planning for NASA rovers.

In particular, the mixed initiative planning [13], supportedby the MAPGEN (Mixed-initiative Activity Plan GENerator)tool [14], [15] has been used for the Deep Space 1 mission.With this approach, humans and machines collaborate in thedevelopment and the management of plans: in particular, theuser provides MAPGEN with a qualitative evaluation of thegenerated plan.

The ASPEN [16], [17] framework has been used to performactivity planning for the Rocky 7 rover. In this framework, afirst automatically generated plan is iteratively refined usingdifferent heuristics to finally fulfill the resource constraints.

Finally, other approaches perform planning with uncer­mainly using probabilistic methods [11], which how­

ever cannot handle problems with high complexity.It is worth noting that none of the above approaches is able

to find optimal plans, i.e., plans that minimize the resourceconsumption. Other well known automatic planners indeedaddress this issue.

In particular, the IM-LPSAT tool [5] works only on lineardomains. This is also the case of the UPPAALffIGA tool [6],[18] that, being built on top ofUPPAAL, allows one to use realvariables only as clocks (i.e., real variables can be modelledonly if their first derivative is 1), thus excluding systems withnonlinear dynamics. Finally, the MIPS planner [7], being basedon symbolic model checking, does not perform well on hybridnonlinear systems.

'fherefore, automatic optimal planning with resource con­sumption on hybrid, nonlinear systems such as rovers is stillan open issue.

III. PLANNING THROUGH EXPLICIT MODEL CHECKING

Model checking algorithms are typically divided in twocategories: symbolic algorithms (e.g., [19)) and explicit al­gorithms (e.g., [20)). Symbolic algorithms, however, do notwork well on hybrid systems with nonlinear dynamics, due tothe complexity of the state transition function [21]. Iherefore,explicit model checking performs better with the kind ofsystems we intend to approach. Also these algorithms aresubject to the well-known state explosion problem: however,the ability to build the system transition graph on demandand generate only the reachable states of the system (throughthe reachability together with many space savingtechniques (see, e.g., [22)), help to mitigate it.

Generally speaking, given a set F; of error states and aset I of initial states for a system, an explicit model checkerincrementally generates all the valid system statesstates), starting from the ones in I and repeatedly applyingthe transition jimction that describes the system dynamics. Ifa state e E E is encountered, the model checker outputs thesequence of states that leads to e.

If we look at error states as goal states, we can use a modelchecker as a planner. Moreover, the use of a breadth firstsearch makes us able to easily find optimal plans. This verysimple fact allows one to use the model checking technology toautomatically synthesize optimal plans for complex systems.

A. Planning on Finite State .H.""m.'

A hybrid system is a system whose state description in­volves continuous as well as discrete variables. In order toapply model checking algorithms and exploit the reachabilityanalysis, the system should have a finite number of states.To this aim, we approximate the system by discretizing thecontinuous components of the state (which we assume to bebounded) and their dynamic behavior. For lack of space, wecannot describe here the approximation process, however thereader can see how our approach works by looking at thecase study in Section IV; a discussion about the mappingfrom hybrid automata to LISs can be found, e.g., in [23],[24]. In the following we tlrst give a formal definition of theapproximated model, the finite state system, and then describehow the planning problem can be solved for such kind ofsystem.

Definition 1 (Finite State System). /1 Finite State System(FSS) 5 is a 4-tuple where: S is a finite set ofstates, 80 E S is the initial state, ./1 is a finite set of actionsand F : S x A x S ---+ {O, I} is the transition function, i.e.

a, SI) = 1 iff the system from state s can reach state Sl

via action a.By abuse of language, we denote with a) the set

of successor states of s through action a, i.e. F(s, a) =

a, Sl) I}.

In order to define the planning problem for such a system,we assume that a set of goal states G ~ S has been specified.Moreover, to have a finite state system, we fix a/inite temporalhorizon T and we require a plan to reach the goal in at mostT actions. Note that, in most practical applications, we alwayshave a maximum time allowed to complete the execution of aplan, thus this restriction, although theoretically quite relevant,has a limited practical impact.

Now we are in position to state the planning problem forfinite state systems.

Definition 2 (Planning Problem on FSS). Let 5 =So, F) be an FSS. Then, a planning problem is a

quadruple P = (5, T) where G ~ S is the set thegoal states, C : S x A ---+ lR+ is the cost function and T isthe finite temporal horizon.

Intuitively, a solution to a planning problem is the minimalcost path in the system transition graph, starting from theinitial state and ending in a goal state. More formally, wehave the following

Definition 3 (Trajectory). A trajectory in the FSS 5 =

so,A,F) is a sequence 7r slals2a2s3a3 ... where,Vi 2': 1, Si E S is a state, ai E A is an action and

132

F(Si, ai, Si+d = 1. If 11 is a trajectory, we write Ks(k) (re,lp.Ka(k)) to denote the state Sk (resp. the action Finally, wedenote with IK I the length of 11, given by the number of statesthe tmiPl'tOl'V

By abuse of language we denote with C (11) the cost of atrajectory 11 = Slaj82a2 ... Sk, Le., C(K) = L:7~}

Definition 4 (Reachable States). Let S E I be an initial statethe FSS S So, F). 17wn, we say that a state SI is

reachable from S iff there exists a trajectory K in S such that1Is (1) sand 1Is (k) Sl for some k > O. We denote withReach(s) the set of states reachable from s.

Definition 5 (Admissible Solution). Let S = (8, So,

be an FSS and let P (S, G, C, T) be a planning problem.171en an admissible solution for P is a trajectory K* in S S.t.:1111 k, k ::; T, (1) So and (k) E G.

Definition 6 (Optimal Solution). An optimal solution is anadmissible solution K* S.t. for all other admissible solutions11

/, ) ::; C(11

/).

In the next section, we present a tool which takes as inputa planning problem and outputs an optimal solution for it.

B. 171e UPlv[urphi Tool

The UPMurphi tool [8] is an optimal universal plannerbuilt on top of the CMurphi [25] model checker. Obviously,UPMurphi can be used as an optimal planner, too.

The CMurphi input consists of a description of the system tobe verified, modelled as a finite state system, and a definitionof the property to be checked, both described in the CMwphidescription a high-level programming language forfinite state asynchronous concurrent systems. In particular,the behavioral part of a CMurphi model is a collection oftransition rules, i.e., guarded commands which consist of acondition and an action.

On the other hand, UPMurphi can be fed with a systemdefined through the CMurphi description language (i.e., asan automaton) as well as through PDDL+ [26] , which isa standard language for planning problems. Note that, tosupport planning problems, the CMurphi input language hasbeen extended in UPMurphi to include the goal construct,used to define the properties that a planning goal state mustsatisfy. TIlis allows one to model the planning domain usingthe formalism that best suits the original system specificationsand simplifies its description. Similarly, plans computed byUPMurphi can be output as binary or textually-encoded state­action tables or as PDDL+ plans.

UPMurphi inherits from CMurphi two important featuresto ease the hybrid systems modelling activity: the typereal (m, n) of real numbers (withm digits for the mantissaand n digits for the exponent), and the use of externallydefined CIC++ functions in the modeling language. In thisway, for example, one can use the CIC++ language constructsand library functions to model complex dynamics involvingcalculations on real values.

Finally, lJPMurphi inherits from CMurphi several tech­niques that help to mitigate the well-known state explosionproblem due to the memory requirements of explicit statespace exploration algorithms. However, it is worth notingthat memory-related problems are common to all the currentplanning algorithms, when the system dynamics involves realvalues and complex mathematical operations.

In particular, UPMurphi implements bit [27]and hash compaction [28], [29] to reduce the memory size ofthe system state representation, and a symmetry reduction al­gorithm to decrease the state space size by detecting equivalentstates.

Shortly, bit compression saves memory by using every bitof the state descriptor, the memory structure maintainingthe state variables, instead of aligning them on byte bound­aries, whereas hash compaction stores compressed values(also called state instead of full state descriptors.Together, these two techniques can dramatically reduce thememory needed to explore huge state spaces.

IV. CASE STUDY: THE AUTONOMOUS PLANETARY

VEHICLE

This section presents a motivating case study where plan­ning is applied to automatically control the engine of anautonomous vehicle during a planetary exploration mission.

As described in tlle introduction, the rover model as wellas the environmental conditions have been defined to beas general as possible, to achieve realistic results, and thegenerated plan will be optimized for the shortest time and thelowest energy consumption, as a real mission would require.

The rover can be naturally modelled as a hybrid system,with several nonlinear characteristics. Thus, we have a dy­namics very hard to compute, which makes planning quitedifficult.

The rover model used in our case study is based on theMars exploration rover described in [30].

In general, an exploration rover moves on the planet surfaceto observe different phenomena andlor try some experiments.TIle rover can recharge its batteries through a solar panel, butrecharge cannot take place continuously, and the energy fromthe panels is not enough to directly power the rover. Therefore,it must minimize the energy consumption in order to havealways enough battery charge for tlle next activity.

Moreover, the rover has limited communication and com­putation resources, so it must be programmed with a detailedplan of activity and then left operating, without any chance torecover from an error or recompute its mission. If somethingwrong or unexpected happens, the best that the rover can dois to stop, reset and wait for the next Earth connection to getnew instructions.

The plan we want to generate does not address the actualroute of the rover, but controls the vehicle and instru­ments during the route itself. Routing is a different problem, sojust we assume that a (possibly straight) route of lengthhas been separately planned and will be used to control thesteering of the rover wheels.

133

When moving, the rover is subject to friction and drift dueto the - often unpredictable - ground characteristics. Thus,every meters, it has to stop for tc seconds to look at itsactual position and conditions, before starting to move.These frequent stops may also be useful to ensure a propercooling of the rover wheels and instruments, if moving in ahot environment. For sake of generality, in the following weshall call these stops "cooling tasks". However, we assumethat the route duration be less or equal to tmn;c seconds, sincethe overall rover mission should not exceed a reasonable limit.

The rover has a base energy consumption gs Joule/second,used to power its CPU.

The energy (expressed in Joule/second) required to movethe rover with speed v and acceleration ~i can be evaluated byapplying the function f of Equation 1, where m is thevehicle mass and is its frontal area (see [31] for details).

TABLE ICONSTANT VALUES FOR THE ROVER MODEL

p Air density 0.1 Kg/m6

9 Gravitational acceleration 3.8 m./s"

rn Vehicle mass 71.73 Kg11 Kinetic friction coefficient 0.8

Crna :£ Initial battery charge 18.000 CCrain Min final battery charge 17.000 C

1)rna:c Max speed 10 em/saTnax Max acceleration 5 em/s L

g, CPU energy reqUIrements 25 J/s

Ie Cooling duration 6 s

dm,ax Distance between coolings 1.30 mgc Cooling energy requirements 10 J/s

dfinal Final distance 2mtrnax Max plan duration 60 s

In the equation, constants p, g indicate the planet air densityand its gravitational constant, respectively, whereas Cd andCTT are the drag and rolling coefficients of the rover.

Finally, the cooling tasks require a constant energy of gcJoule/second.

The rover dynamics (Le., the covered distance d, the speedv and the acceleration 'v) is given by Equation 2.

where a( t) is the acceleration given by the rover motor at timet and If is the kinetic friction coefficient for the rover wheels.

We assume that, in each communication session, the Earthcontrol sends to the rover a plan to drive it to the next place,and the commands needed to start the correspondingSuch plan consists of a sequence of actions, to be performedat I second intervals, chosen from the set A = {accelerate,decelerate, continue (moving at constant speed), perform acooling task}.

The plan must obey the following constraints:

• the rover must not exceed the speed of vmn';;

• the rover must stop every to perform a cooling task;• the rover must stop after (to start the activity) with

a residual battery charge not lower than Cmin;

• the rover route must not require more than tmnx seconds.

In particular, we must ensure that, after moving to the givenlocation, the rover has still enough battery charge available forits activity.

Finally, the plan must drive the vehicle to its goal as soonas possible, since saving time allows the rover to completemore activities before its life terminates.

The dynamics and constraints given above have been firstmodelled as a hybrid automaton, shown in Figure 1. The stateof the automaton is s = q) E 8, where q E {stopped,

where sEE A. Here. = 0 since all the actions areinstantaneous and do not require energy.

This definition of C allows one to perform optimization onboth energy and time, as required, still giving more importance

otherwise

if qi

if qi = cn,C)I:i.no

if qi E { no eneTgy, }blown

~+tn1,o,::l;-'i

o

running, breaking, cooling, engine blown, no energy} and x =

(d, a, v, T,The rover is initially in a stopped state, where the only

energy consumption is given by gs. \\i'hen started, the roverenters the running state and moves as described by Equation2 while its energy consumption is increased by the valuegiven by Equation 1. The vehicle can accelerate and deceleratewith steps of . After meters, the vehicle startsbreaking and, once stopped, it begins the cooling phase,with the corresponding energy consumption. After 6 secondsof cooling (T~; in the automaton), the vehicle restarts andcontinues in the running state.

The automaton also shows two possible failure conditions:if the rover moves faster than the max allowed speed V mwc , itsengine blows up blown state): in this case, the entiremission could fail. On the other hand, if the consumed energyexceeds the limit Crnin, the rover stops (no energy state), usingthe residual energy to wait for Earth instructions.

We fixed the model constants to the values given in Table I,most of which are obtained from rover specifications like [2]and [1]. Note that we assume that the rover operates on theMars surface.

Finally, according to Definition 3, we evaluate the cost ofthe generated plan through the function defined asfollows:

(1 )

(2)a(t) - 11, . g'0(1)

. (1 2 (~)))v) = 2"' p' v . Cd· fa +rn· g. CTT + g .v

134

restartTc = 6

start

d':=O a':=Ov':=O c':=cT':=O T'M:= 0

acceleratea' := a + 1.5

maxDistanced = dMAX

engineExplodeV> VM/V,

engineExplode

V> VM/V,

energyEndC < Cmin

arrestv=OT'c := 0

energyEndC < Cmin

d=Ov=O1-=0

energyEndc = 0

Fig. 1. Hybrid automaton for the Autonomous Planetary Vehicle case study

Fig. 2. Optimal plan evolution: battery charge, speed and acceleration.

4030 3515 20 25

time [s]

10

:018000

E 179900

"S 179800Q 17970

~ 179601ii 17950J:l

"0 17940Q)

1ii 17930ii5

1792010

~2 '¥

.2..2. c-0 0 0

Q)

~Q)Q. -2 ](j)

-4

plan duration,

Finally, the generated plan has been further validated bysimulating its execution on the rover modeL The graphs inFigure 2 show the evolution of some important rover statevariables during the simulation, which ends correctly afterd final = 2 m, In particular, we can compare the batterydischarge graph with the rover speed and acceleration duringthe entire course, Note that, in the highlighted cooling phase,the battery discharge rate is higher even if the vehicle isstopped, due to the instruments activation,

Course length 43 sEnergy consumption 77.3 C

Residual battery charge 17,922.7 C

Time in Stopped state 1 sTime in Running state 32 sTime in Breaking state 4 sTime in Cooling state 6 s

TABLE IIOPTIMAL PLAN STATISTICS

to the energy component. Indeed, usually the mission could beaccomplished even if it requires some seconds more than theplanned limits, whereas running out of battery charge couldlead to dangerous failures,

The resulting model has been translated to a FSS, encodedin the CMurphi description language, with the same statevariables and transition function of the hybrid automatonin Figure 1, In this phase, the continuous state variableshave been suitably discretized: in particular, we applied anapproximation of 0,1 to all the variables, thus the total numberof different states of the FSS is 2.2 . 1013

,

To build the optimal plan, the FSS was given in input toUPMurphi, which generated 939,477 reachable states in 2,257seconds, with a peak memory requirement of 500 ME. Notethat the reachability analysis performed by the tool allowed usto consistently prune the system state space,

The resulting plan is synthetically described in Table II. Thetable also shows the distribution of the plan duration amongthe different states of the hybrid automaton in Figure 1,

It is worth noting that the plan optimization allowed us tosave 922,7 C with respect to the required minimal batterycharge, and 17 seconds with respect to the maximum allowed

135

V. CONCLUSIONS

In this paper we have shown how model checking basedplanning, and in particular the UPMurphi tool, can be used togenerate time and resource-optimal plans to control the engineof an autonomous planetary vehicle during an explorationmission. The general characteristics of this kind of vehicle,together with the environmental conditions and the missionconstraints, often lead to hybrid models with nonlinear dy­namics, that are difficult to manipulate for most of the otherplanning tools. Thus, the application of UPMurphi can behelpful to plan the activities of complex, realistic models ofautonomous vehicles.

REFERENCES

[11 S. Hayati, R. Volpe, P. Backes, J. Balaram, R. Welch, R. Ivlev, G. 111arp,S. Peters, T. Ohm, R. Petras, and S. Laubach, "The Rocky 7 rover:A Mars sciencecraft prototype," in in Proceedings IEEE Internation£llConference on Robotics and Autom£ltion, 1997, pp. 2458-2464.

[2] H. W. Stone, "Mars Pathfinder microrover: A low-cost, low-powerspacecraft," in the 1996 AIAA Forum on AdvancedDevelopments in Space 1996.

[31 R. Washington, K. Golden, J. Bresina. D. E. Smith, C. Anderson, andT. Smith, "Autonomous rovers for Mars exploration," in Proc. IEEEAerospace Con):, 1999.

[4] S. Edelkamp, "Taming numbers and durations in the modelintegrated planning Journal of Artificial IntelligenceSpecial issue on the Intel11£ltional Planning Competition., 2002.

[51 J.-A. Shin and E. Davis, "Processes and continuous change in a SAT­based planner," /1rt~f. Intell., vol. 166, no. 1-2, pp. 194-253, 2005.

[61 G. Behrmann, A. Cougnard, A. David, E. Fleury, K. G. Larsen, andD. Lime, "UPPAAL-TIGA: Time for playing games!" in CilY, 2007,pp. 121-125.

[7] S. Edelkamp and M. Helmert, "MIPS: The model-checking integratedplanning system," AI Magazine, vol. 22, no. 3, pp. 67-72, 2001.

[81 G. Della Penna, B. Intrigila, D. Magazzeni, and F. Mercorio, "UPMur­phi: a tool for universal planning on PDDL+ problem~," in Proceedingsof the 19th International Conference on AutoYf1£lted Planning andScheduling (ICAPS 2009). AAAI Press, 2009, pp. 106-113.

191 1'. Bacchus and M. Ady, "Planning with resources and concurrency:A forward chaining approach," in IJCAI, 2001, pp. 417-424. [Online].Available: ci teseer. ist.psu.edu/articlelbacchusO Iplanning.html

[10] P. Haslum and H. Geffner, "Heuristic planning with time and resources,"in Proceedings of the 6th European Conference on Planning, Toledo,Spain, 2001.

[11] J. Bresina, R. Dearden, N. Meuleau, D. Smith, and R. Washington,"Planning under continuous time and resource uncertainty: A challengefor AI," in In Proceedings of the Eighteenth on Uncertaintyin Artificial Intelligence. Morgan Kaufmann, pp. 77-84.

[12] Jet Propulsion Laboratories, http://www.jpl.nasa.gov/.[13] M. H. Burstein, B. Beranek, N. Inc, and D. V. Mcdermott, "Issues

in the development of human-computer mixed-initiative planning," inCognitive Technology. Elsevier, 1996, pp. 285-303.

[14] M. Ai-Chang, J. Bresina, 1.. Charest, A. Chase, J. C. jung Hsu,A. Jonsson, B. Kanefsky, P. Morris, K. Rajan, J. Yglesias, B. G. Chafin,W. C. Dias, and P. E Maldague, "MAPGEN: Mixed-initiative planningand scheduling for the Mars exploration rover mission," IEEE IntelligentSystems, vol. 19, no. 1, pp. 8-12, 2004.

[15] J. L Bresina, A. K.Jonsson, P. H. Morris, and K. Rajan, "Activityplanning for the Mars exploration rovers," pp. 40-49, 2005.

[16] S. Chien, G. Rabideau, R. Knight, R. Sherwood, B. Engelhardt, D. Mutz,T. Estlin, B. Smith, F. Fisher, T. Barrett, G. Stebbins, and D. Tran, "As­pen - automated planning and scheduling for space mission operations,"in in Space Ops, 2000.

[17] P. G. Backes, G. Rabideau, K. S. T. Y, and S. Chien, "Automatedplanning and scheduling for planetary rover distributed operations,"in of the IEEE Conference on Robotics and /illtOlf1£ltion(ICRA), pp. 984-991.

[18] "UPPAAL-TIGA Web Page: http://www.cs.aau.dk!..~adavid/tiga/ ... 2007.

[l9] J. R. Burch, E. M. Clarke, K. 1.. McMillan, D. 1.. Dill, and 1.. J. Hwang,"Symbolic model checking: 1020 states and beyond," Inf. Comput.,vol. 98, no. 2, pp. 142-170, 1992.

[20] S. Edelkamp, A. 1.. Lafuente, and S. Leue, "Directed explicit modelchecking with HSF-SPIN," in SPIN '01: of the 8th inter-national SPIN workshop on Model checking of New York,NY, USA: Springer-Verlag New York, Inc., 2001, pp. 57-79.

[21] G. Della Penna, B. Intrigila, 1. Melatti, M. Minichino, E. Ciancamerla,A. Parisse, E. Tronci, and M. Venturini Zilli, "Automatic verification ofa turbogas control system with the munp verifier," in Hybrid Systems:Computation and Control, 6th Internatior1£l1 Workshop, HSCC 2003Prague, Czech Republic, April 3-5, 2003, Proceedings, ser. LectureNotes in Computer Science, O. Maler and A. Pnueli, Eds., vol. 2623.Springer, 2003, pp. 141-155.

[22] G. Della Penna, B. Intrigila, 1. Melatti, E. Tronci, and M. VenturiniZilli, "Exploiting transition locality in automatic verification of finitestate concurrent " STYT, vol. 6, no. 4, pp. 320-341, 2004.

[23] M. Fox and D. "Modelling mixed discrete-continuous domainsfor planning," J. Intell. Res. (JAIR), vol. 27, pp. 235-297, 2006.

[24] T. Henzinger, "The of hybrid automata," in Proceedings of the11th Annual Symposium on Logic in Computer Science. IEEE ComputerSociety Press, 1996, pp. 278-292.

[25] Cached Murphi Web Page, ..http://www.dsi.uniromal.itl~tronci/cached.murphi.html," 2006.

[26] M. Fox and D. Long, "PDDL+: An extension to PDDL2.1 for modellingplanning domains with continuous time-dependent effects," TechnicalReport, Dept. of Computer Science, University of Durham, 2001.

[27] Murphi Web Page, ''http://sprout.stanford.edu/dili/murphLhtml,''2004.

[28] U. Stern and D. Dill, "Using magnetic disk instead of main memory inthe munp verifier," in Computer Aided 10th lntemation£llConference, CAV '98, Vancouver; BC, June 28 - July 2, 1998,Proceedings, ser. Lecture Notes in Computer Science, A. J. Hu andM. Y. Vardi, Eds., vol. 1427. Springer, 1998, pp. 172-183.

[29] U. Stern and D. 1.. Dill, "Improved probabilistic verification by hashcompaction," in ClL4.RME '95: Proceedings of the IFlP WG 10.5Advanced Research Working on Correct Hardware Designand Verification Methods. UK: Springer-Verlag, 1995, pp.206-224.

[30] D. Lee, "Design and verification of the Mars exploration roverpayload," in Proceedings of Workshop on Spacecraft andDynamic Environments, 2003.

[31] E. Tate and S. Boyd, "Finding ultimate limits of performance for hybridelectric vehicles," in Proceedings of of .4.utomotive Engineers2000 Future Transportation Technology 2000.

136