VALIDATION OF A SOLUTION FROM A PLANNER IN A VEHICLE

Abstract

The invention relates to a method of controlling a device (104) of a vehicle (102) in order to modify a state of the vehicle (102), of the type comprising, for each problem (P) in a domain (D), the domain (D) defining possible actions of the device (104) modifying the state of the vehicle (102) and the problem (P) indicating a starting state of the vehicle (102) and an arrival state of the vehicle (102): - a search, by a planning software (110) installed on an embedded computer system (108) in the vehicle (102), for a solution (S) to the problem (P), the solution (S) listing actions of the domain (D) to go from the starting state to the arrival state; - an evaluation, by a validator software (116) installed on the embedded computer system (108), of the solution (S);and - if the solution (S) is validated by the validator software (116), a transmission of the solution (S) to a control system (106) of the device (104) so ​​that the device successively performs the actions listed in the solution (S). The validator software (116) is first obtained by a translation, by a translator software (114) executed by a computer system (114) external to the vehicle (102), of the domain (D) so that the validator software (116) is dedicated to the domain (D), then installed on the embedded computer system (108). Figure for the abbreviation: Fig. 1;

Description

Title of the invention: VALIDATION OF A SOLUTION FOR A PLANNER IN A VEHICLE Technical field of the invention

[0001] The present invention relates to: - a method of controlling a device of a vehicle by means of a planning software and a validating software, - a software that translates a domain into a validating software, - a validating software, and - a vehicle comprising an embedded computer system on which a planning software and a validating software are installed.

[0002] In the description and claims that follow, a computer system may comprise one or more computers, for example, connected in a network. Technological background

[0003] A method for controlling a device of a vehicle in order to modify a state of the vehicle is known from the prior art, of the type comprising, for each problem in a domain, the domain defining possible actions of the device modifying the state of the vehicle and the problem indicating a starting state of the vehicle and an ending state of the vehicle: - a search, by a planning software installed on a computer system embedded in the vehicle, for a solution to the problem, the solution listing actions from the domain to go from the starting state to the arrival state; - an evaluation of the solution by validation software installed on the embedded computer system; and - if the solution is validated by the validating software, a transmission of the solution to a device control system so that the device successively performs the actions listed in the solution.

[0004] The input domain for the planning software is generally a high-level mission specification, for example, in PDDL language. Furthermore, the planning software is generic in that it can use different domains. Thus, the planning software is generally very complex, in any case too complex to be certified at a level higher than DAL E (Design Assurance Level), which is the lowest level in avionics, the highest level being DAL A. Therefore, the solution provided by the planning software cannot be used as is when the device is at a higher certification level.

[0005] The validator software provides a solution to this problem by successively evaluating the solutions found by the planner software. Thus, the certification level of the solution will be that of the validator software, which is simpler than the planner software.

[0006] For example, there is the validator software for PDDL called "VAL" (https: / / github.com / KCL-Planning / VAL). This validator software is generic, that is to say, it expects as input the domain in which the solution is to be evaluated.

[0007] Consequently, it is large (over 25,000 lines of C++) and was not designed to be embedded in a critical system. In particular, it is designed to store actions defined in the domain in temporary data structures dynamically allocated in memory. This means that neither the memory space to be allocated nor its size is explicitly specified in the VAL validator software, but is allocated during execution as needed. In particular, it is difficult to ensure that sufficient memory remains available when an allocation is requested, which risks interrupting the validator software during its operation.

[0008] Thus, the VAL validator software is still too complex to hope for a DAL B or DAL A certification level.

[0009] It may therefore be desirable to provide a control method that makes it possible to overcome at least some of the aforementioned problems and constraints. Summary of the invention

[0010] A method for controlling a vehicle device is therefore proposed in order to modify a vehicle state, of the type mentioned above, characterized in that the validator software is first obtained by translation, by a translator software executed by a computer system external to the vehicle, of the domain so that the validator software is dedicated to the domain, and then installed on the embedded computer system.

[0011] Thus, because the validator software is dedicated to the domain, it can be simple and therefore more easily certifiable at a high certification level. In particular, the domain actions are explicitly defined in the validator software, so that their memory allocation is done statically, at the time of launch (initialization) of the validator software, which avoids the risk of interruption due to insufficient memory during execution.

[0012] The invention may further include one or more of the following optional features, according to any technically possible combination.

[0013] Optionally, the translation includes: - a generation of computer code implementing an input function designed to receive the starting state and to store the starting state in a state variable; - for each action in the domain, a generation of computer code implementing a so-called action function designed to modify the state variable according to the action considered; - a generation of computer code implementing a so-called sequencing function designed to successively call the action functions corresponding to the actions of the solution in the listed order, in order to successively modify the state variable; and - a generation of computer code implementing a so-called validation function designed to compare the arrival state of the problem to the state variable after an execution of the sequencing function, in order to validate or not the solution.

[0014] Optionally also, each action includes a formula for modifying the vehicle's state, the action function being designed to implement this modification formula.

[0015] Optionally also, at least one action of the domain includes one or more preconditions on the state of the vehicle, the action function being designed to check each precondition of the action considered and to modify the state variable if each precondition is met.

[0016] Optionally, the domain is also in PDDL language.

[0017] Optionally, the translator software is also designed to generate the code SCADE language validation software

[0018] Also proposed is a computer program, referred to as translator software, downloadable from a communication network and / or stored on a computer-readable medium, characterized in that it includes instructions for, when said translator software is executed on a computer system: - generate, from a domain defining possible actions of a device modifying a state of a vehicle including the device, computer code implementing a validator software dedicated to the domain, this validator software being designed to evaluate a solution to a problem indicating a starting state of the vehicle and an arrival state of the vehicle, the solution listing actions of the domain to go from the starting state to the arrival state.

[0019] A computer program, referred to as validator software, downloadable from a communication network and / or stored on a computer-readable medium, is also proposed, characterized in that it includes instructions for, when said validator software is executed on a computer system: - evaluate a solution to a problem in a domain, the domain defining possible actions of the device modifying the state of the vehicle, the problem indicating a starting state of the vehicle and a finishing state of the vehicle, and the solution listing actions from the domain to move from the starting state to the destination state; the instructions being specific to the domain.

[0020] A vehicle, for example an aircraft, comprising is also proposed: - a device; - a device control system; and - an embedded computer system on which is installed: • a planning software designed to search for a solution to a problem within a domain, the domain defining possible actions of the device modifying the vehicle's state, the problem indicating a starting state of the vehicle and an ending state of the vehicle, and the solution listing actions of the domain to transition from the starting state to the ending state, and • a validator software designed to evaluate the solution and, if the solution is validated, transmit the solution to the device's control system so that the device can successively perform the actions listed in the solution; characterized in that the validator software is dedicated to the domain. Brief description of the figures

[0021] The invention will be better understood with the aid of the following description, given solely by way of example and made with reference to the accompanying drawings in which: - [Fig. 1] is a simplified view of an installation comprising, on the one hand, a vehicle equipped with an embedded computer system on which planning software is installed and, on the other hand, an external computer system on which translation software is installed, designed to generate validator software. - [Fig.2] is a block diagram of a method for controlling a device of the vehicle in [Fig.1], - Figure 3 is a simplified view of an embodiment with several validator software programs installed on the embedded computer system, and - [Fig.4] is a simplified view of a computer that may be part of the computer systems used in the invention. Detailed description of the invention

[0022] With reference to [Fig.1], an installation 100 according to the invention will now be described.

[0023] The installation 100 first includes a vehicle 102, such as an aircraft.

[0024] The vehicle 102 includes in particular a device 104, a control system 106 for the device 104 and an embedded computer system 108. The device 104 is for example a guidance and / or trajectory tracking device, or a device for controlling sensors (for example, camera or pose [position and / or attitude]) or actuators (for example, gripping or mobility).

[0025] A planning software 110 is installed on the embedded computer system 108, so that it can be executed by the latter.

[0026] The planning software 110 is designed to receive a domain D and a problem P in this domain D. The domain D defines in particular possible actions of the device 104, these actions modifying a state of the vehicle 102. The problem P indicates a starting state of the vehicle 102 and an ending state of the vehicle 102. The planning software 110 is thus designed to search for a solution S to the problem P in the domain D, this solution S listing actions from the domain D to go from the starting state to the ending state.

[0027] The installation 100 further comprises a computer system 112 external to the vehicle 102.

[0028] A translator software 114 is installed on the landed computer system 112. The translator software 114 is designed to translate the domain D into a validator software 116, that is to say to generate the validator software 116 from the domain D.

[0029] The validator software 116 is designed, once installed on the embedded computer system 108 (as illustrated by the dotted arrow in [Fig. 1]), to receive the problem P and the solution S to this problem P found by the planner 110 in order to validate or not the solution S. If the solution S is validated, the validator software 116 is designed to transmit the solution S to the control system 106, so that the latter commands the device 104 so that the device 104 successively performs the actions listed in the solution S.

[0030] As will be explained in more detail later, the validator software 116 is dedicated to domain D, so that it only needs to receive the problem P and the solution S to validate the latter, but not the domain D.

[0031] With reference to [Fig.2], a method 200 according to the invention for controlling the device 104 will now be described.

[0032] The process 200 first comprises a preparatory phase 202, grouping the following steps 204 to 210.

[0033] Thus, during a step 204, the translator software 114 obtains the domain D.

[0034] As indicated above, domain D defines possible actions of device 104, these actions modifying the state of vehicle 102.

[0035] Each action in domain D includes in particular a formula for modifying the state of vehicle 102.

[0036] Furthermore, one or more of the actions in domain D may include one or more preconditions on the state of the vehicle 102, these preconditions having to be checked for the implementation of the action.

[0037] For example, the domain can be written in PDDL (Planning Domain Description Language), in which case the definition of each action follows a specific formalism. This formalism can be illustrated by the following example of an action consisting of pouring the contents of a first jug called jugl into a second jug called jug2: (:action for zparameters (?jugl ?jug2 - jug) :precondition (> (capacity ?jug2) (amount ?jug2)) :effect (and (when ; jugl compLetely emptied (>= (- (capacity ?jug2) (amount ?jug2)) (amount ?jugl)) (and (increase (amount ?jug2)(amount ?jugl)) (assign (amount ?jugl) 0) ) (when ; jugl partiaLLy emptied ... condition omitted ... ... effects omitted ... )

[0038] The characters ":action" introduce the action. The characters ":parameters" introduce the parameters used by the action. In this example, these are the parameters jugl and jug2. The characters ":precondition" introduce the preconditions of the action. In this example, this is the condition that the capacity of jug2 is greater than the contents of jug2. The characters ":effect" introduce the formula for modifying the state. In this example, when jugl is completely emptied, the contents of jug2 are increased by the contents of jugl, and the contents of jugl are set to zero. The case where jugl is only partially emptied is omitted from the example above.

[0039] During a step 206, the translator software 114 analyzes the domain D to search for the actions of the domain D, and, for each action found, the precondition(s) of that action and the formula of that action.

[0040] For example, the translator software 114 identifies groups of characters in domain D, indicating the presence of the elements sought.

[0041] For example, in the case of the PDDL language, the translator software 114 identifies the characters ":action" to find each action. In addition, the translator software 114 identifies the characters ":precondition" and ":effect" to find the preconditions and the action formula, respectively.

[0042] During a step 208, the translator software 114 generates computer code constituting the validator software 116.

[0043] More specifically, the translator software 114 generates computer code implementing an input function designed to receive the starting state and to record the starting state in a state variable.

[0044] The translator software 114 further generates, for each action found, computer code implementing a so-called action function designed to modify the state variable according to the action in question. The action function is designed to check each precondition, if present, of the action in question, and, if each precondition is met, to implement the formula for modifying the action in question.

[0045] The translator software 114 further generates computer code implementing a so-called sequencing function designed to successively call the action functions corresponding to the actions of the solution in the listed order, in order to successively modify the state variable.

[0046] The translator software 114 further generates computer code implementing a so-called validation function designed to compare the arrival state of the problem to the state variable after execution of the sequencing function, in order to validate or not the solution.

[0047] For example, the computer code of the validator software 116 may be in SCADE language. In this case, the previous action would be converted into the following computer code: (:action for zparameters (?jugl ?jug2 - jug) :precondition (> (capacity ?jug2) (amount ?jug2)) :effect (and (when ; jugl compLeteLy emptied (>= (- (capacity ?jug2) (amount ?jug2)) (amount ?jugl)) (and (increase (amount ?jug2)(amount ?jugl)) (assign (amount ?jugl) 0) ) ) (when ; jugl partiaLly emptied ... condition omitted ... ... effects omitted ... )

[0048] Because the validator software 116 explicitly includes input, action, sequencing and output functions, the data structures used by the latter are allocated statically at the time of the launch of the validator software 116.

[0049] During a step 210, the validator software 116 generated by the translator software 114 is installed on the embedded computer system 108, in order to be executed by this last. This installation includes in particular a compilation of the validator software 116 into machine code executable by the embedded computer system 108. For example, the SCADE language is first converted into C code, the latter then being compiled into machine code.

[0050] The process 200 then includes an operational phase 212, grouping the following steps 214 to 224.

[0051] During a step 214, the planning software 110 obtains the domain D and a problem P in this domain D, this problem P indicating a starting state of the vehicle 102 and an arrival state of the vehicle 102.

[0052] During a step 216, the planning software 110 searches for a solution S to the problem P, this solution S listing actions from the domain D to go from the starting state to the arrival state.

[0053] During a step 218, the validator software 116 evaluates the solution S found by the planner software 110, in order to validate or not this solution S.

[0054] During a step 220, if the solution S is not validated by the validator software 116, the latter does not transmit the solution S to the control system 106.

[0055] During a step 222, if the solution S is validated by the validator software 116, the latter transmits the solution S to the control system 106.

[0056] During a step 224, the control system 106 commands the device 104 to successively carry out the actions listed in the solution S.

[0057] Operational phase 212 is repeated for each new problem P in domain D, received by the planning software 110.

[0058] Since the planner software 110 is generic, it is capable of finding solutions to problems in different domains Di...Dn. Thus, with reference to [Fig. 3], generally speaking, as many validator software programs 1161... 116N as there are domains Di...DN will be installed on the embedded computer system 108. Each of these validator software programs 116i... 116N will be dedicated to one of the respective domains Di...DN and obtained by the translator software 114, to which this domain Di...DN will have been provided as input. Each of these validator software programs 116i... 116N will thus be designed to evaluate the solution Si...SN of a problem Pp...PN in the associated domain Dp...DN.

[0059] Each computer system 108, 112 may include one or more computers such as the computer 400 illustrated in [Fig. 4]. The computer 400 includes a data processing unit 402 (such as a microprocessor) and a main memory 404 (such as RAM, or Random Access Memory) accessible by the processing unit 402. The computer 400 further includes, for example, a network interface and / or a computer-readable medium, such as a local medium 406 (such as a local hard disk drive) or a remote medium (such as a hard disk drive). remote and accessible via the network interface through a communication network) or removable media (such as a USB flash drive, a CD, a Compact Disc, or a DVD, a Digital Versatile Disc) readable by a suitable drive on the computer 400 (such as a USB port or a CD and / or DVD drive). A computer program 408, for example, all or part of the software 110, 114, 116, containing instructions for the processing unit 402, is stored on the local storage 406 and / or downloadable via the network interface. This computer program 408 is, for example, intended to be loaded into main memory 404 so that the processing unit 402 can execute its instructions.

[0060] In conclusion, it is clear that a validator software such as the one described above is simple enough to obtain a high level of certification.

[0061] It should also be noted that the invention is not limited to the embodiments described above. It will indeed be apparent to those skilled in the art that various modifications can be made to the embodiments described above, in light of the information just disclosed to them.

[0062] In the detailed presentation of the invention given above, the terms used shall not be interpreted as limiting the invention to the embodiments set forth in this description, but shall be interpreted as including all equivalents which can be foreseen by a person skilled in the art by applying their general knowledge to the implementation of the teaching which has just been disclosed to them.

Claims

Demands

1. Method (200) of controlling a device (104) of a vehicle (102) in order to modify a state of the vehicle (102), of the type comprising, for each problem (P) in a domain (D), the domain (D) defining possible actions of the device (104) modifying the state of the vehicle (102) and the problem (P) indicating a starting state of the vehicle (102) and an ending state of the vehicle (102): - a search (216), by a planning software (110) installed on an embedded computer system (108) in the vehicle (102), for a solution (S) to the problem (P), the solution (S) listing actions from the domain (D) to go from the starting state to the arrival state; - an evaluation (218), by a validator software (116) installed on the embedded computer system (108), of the solution (S); and - if the solution (S) is validated by the validator software (116), a transmission (222) of the solution (S) to a control system (106) of the device (104) so ​​that the device successively performs the actions listed in the solution (S); characterized in that the validator software (116) is first obtained by a translation (208), by a translator software (114) executed by a computer system (114) external to the vehicle (102), of the domain (D) so that the validator software (116) is dedicated to the domain (D), then installed (210) on the embedded computer system (108).

2. A method (200) according to claim 1, wherein the translation comprises: - a generation of computer code implementing an input function designed to receive the starting state and to store the starting state in a state variable; - for each action in the domain, a generation of computer code implementing a so-called action function designed to modify the state variable according to the action considered; - a generation of computer code implementing a so-called sequencing function designed to successively call the action functions corresponding to the actions of the solution in the listed order, in order to successively modify the state variable; and - a generation of computer code implementing a so-called validation function designed to compare the arrival state of the problem to the state variable after an execution of the sequencing function, in order to validate or not the solution.

3. Method (200) according to claim 1 or 2, wherein each action includes a vehicle state modification formula (102), the action function being designed to implement this modification formula.

4. Method (200) according to any one of claims 1 to 3, wherein at least one action of the domain (D) has one or more preconditions on the state of the vehicle (102), the action function being designed to check each precondition of the action under consideration and to modify the state variable if each precondition is met.

5. Method (200) according to any one of claims 1 to 4, wherein the domain (D) is in PDDL language.

6. Method (200) according to any one of claims 1 to 5, wherein the translator software (114) is designed to generate the computer code of the validator software (116) in SCADE language.

7. A computer program, referred to as translator software (114), downloadable from a communication network and / or stored on a computer-readable medium, characterized in that it comprises instructions for, when said translator software (114) is executed on a computer system (108): - generating, from a domain (D) defining possible actions of a device (104) modifying a state of a vehicle (102) comprising the device (104), computer code implementing validator software (116) dedicated to the domain (D), this validator software (116) being designed to evaluate a solution (S) to a problem (P) indicating a starting state of the vehicle (102) and an ending state of the vehicle (102), the solution (S) listing actions of the domain (D) to go from the starting state to the arrival state.

8. Computer program, referred to as validator software (116), downloadable from a communication network and / or stored on a computer-readable medium, characterized in that it includes instructions for, when said validator software (116) is executed on a computer system (108): - evaluate a solution (S) to a problem (P) in a domain (D), the domain (D) defining possible actions of the device (104) modifying the state of the vehicle (102), the problem (P) indicating a starting state of the vehicle (102) and an ending state of the vehicle (102), and the solution (S) listing actions of the domain (D) to go from the starting state to the ending state; the instructions being dedicated to domain (D).

9. Vehicle (102), for example an aircraft, comprising: - a device (104); - a control system (106) for the device (104); and - an embedded computer system (108) on which is installed: • a planning software (110) designed to search for a solution (S) to a problem (P) in a domain (D), the domain (D) defining possible actions of the device (104) modifying the state of the vehicle (102), the problem (P) indicating a starting state of the vehicle (102) and an ending state of the vehicle (102), and the solution (S) listing actions from the domain (D) to go from the starting state to the ending state, and • a validator software (116) designed to evaluate the solution (S) and, if the solution (S) is validated, transmit the solution (S) to the control system (106) of the device (104) so ​​that the device (104) successively performs the actions listed in the solution (S); characterized in that the validator software (116) is dedicated to the domain (D).