A Model-based Approach to Reactive Self-Con guring Systems

This paper describes Livingstone, an implemented kernel for a model-based reactive self-con guring autonomous system. It presents a formal characterization of Livingstone's representation formalism, and reports on our experience with the implementation in a variety of domains. Livingstone provides a reactive system that performs signi cant deduction in the sense/response loop by drawing on our past experience at building fast propositional con ict-based algorithms for model-based diagnosis, and by framing a model-based con guration manager as a propositional feedback controller that generates focused, optimal responses. Livingstone's representation formalism achieves broad coverage of hybrid hardware/software systems by coupling the transition system models underlying concurrent reactive languages with the qualitative representations developed in model-based reasoning. Livingstone automates a wide variety of tasks using a single model and a single core algorithm, thus making signi cant progress towards achieving a central goal of model-based reasoning. Livingstone, together with the HSTS planning and scheduling engine and the RAPS executive, has been selected as part of the core autonomy architecture for NASA's rst New Millennium spacecraft. Introduction and Desiderata NASA has put forth the challenge of establishing a \virtual presence" in space through a eet of intelligent space probes that autonomously explore the nooks and crannies of the solar system. This \presence" is to be established at an Apollo-era pace, with software for the rst probe to be completed in 1997 and the probe (Deep Space 1) to be launched in 1998. The nal pressure, low cost, is of an equal magnitude. Together this poses an extraordinary challenge and opportunity for AI. To achieve robustness during years in the harsh environs of space the spacecraft will need to radically recon gure itself in response to failures, and then navigate around these failures during its remaining days. To achieve low cost and fast deployment, oneof-a-kind space probes will need to be plugged together Authors listed in reverse alphabetical order. quickly, using component-based models wherever possible to automatically generate ight software. Finally, the space of failure scenarios and associated responses will be far too large to use software that requires prelaunch enumeration of all contingencies. Instead, the spacecraft will have to reactively think through the consequences of its recon guration options. We made substantial progress on each of these fronts through a system called Livingstone, an implemented kernel for a model-based reactive self-con guring autonomous system. This paper presents a formalization of the reactive, model-based con guration manager underlying Livingstone. Several contributions are key. First, the approach uni es the dichotomy within AI between deduction and reactivity (Agre & Chapman 1987; Brooks 1991). We achieve a reactive system that performs signi cant deduction in the sense/response loop by drawing on our past experience at building fast propositional con ict-based algorithms for modelbased diagnosis, and by framing a model-based con guration manager as a propositional feedback controller that generates focused, optimal responses. Second, our modeling formalism represents a radical shift from rst order logic, traditionally used to characterize modelbased diagnostic systems. It achieves broad coverage of hybrid hardware/software systems by coupling the transition system models underlying concurrent reactive languages (Manna & Pnueli 1992) with the qualitative representations developed in model-based reasoning. Reactivity is respected by restricting the model to concurrent propositional transition systems that are synchronous. Third, the long held vision of modelbased reasoning has been to use a single central model to support a diversity of engineering tasks. For modelbased autonomous systems this means using a single model to support a variety of execution tasks including tracking planner goals, con rming hardware modes, recon guring hardware, detecting anomalies, isolating faults, diagnosis, fault recovery, and sa ng. Livingstone automates all these tasks using a single model and a single core algorithm, thus making signi cant progress towards achieving the model-based vision. Livingstone, integrated with the HSTS planning and