• DOI:10.1109/TCST.2015.2501351
• Corpus ID: 10859394

Correct-by-Construction Adaptive Cruise Control: Two Approaches

@article{Nilsson2016CorrectbyConstructionAC,
  title={Correct-by-Construction Adaptive Cruise Control: Two Approaches},
  author={Petter Nilsson and Omar Hussien and Ayca Balkan and Yuxiao Chen and A. Ames and Jessy W. Grizzle and Necmiye Ozay and Huei Peng and Paulo Tabuada},
  journal={IEEE Transactions on Control Systems Technology},
  year={2016},
  volume={24},
  pages={1294-1307}
}

• Petter Nilsson, Omar Hussien, +6 authors P. Tabuada
• Published 1 July 2016
• Computer Science
• IEEE Transactions on Control Systems Technology

Motivated by the challenge of developing control software provably meeting specifications for real-world problems, this paper applies formal methods to adaptive cruise control (ACC). Starting from a linear temporal logic specification for ACC, obtained by interpreting relevant ACC standards, we discuss in this paper two different control software synthesis methods. Each method produces a controller that is correct-by-construction, meaning that trajectories of the closed-loop systems provably meet the specification. Both methods rely on fixed-point computations of certain set-valued mappings. However, one of the methods performs these computations on the continuous state space whereas the other method operates on a finite-state abstraction. While controller synthesis is based on a low-dimensional model, each controller is tested on CarSim, an industry-standard vehicle simulator. Our results demonstrate several advantages over classical control design techniques. First, a formal approach to control design removes potential ambiguity in textual specifications by translating them into precise mathematical requirements. Second, because the resulting closed-loop system is known a priori to satisfy the specification, testing can then focus on the validity of the models used in control design and whether the specification captures the intended requirements. Finally, the set from where the specification (e.g., safety) can be enforced is explicitly computed and thus conditions for passing control to an emergency controller are clearly defined.