# Multirobot Coordination with Counting Temporal Logics

In many multirobot applications, planning trajectories in a way to guarantee that the collective behavior of the robots satisfies a certain high-level specification is crucial. Motivated by this problem, we introduce counting temporal logics---formal languages that enable concise expression of multirobot task specifications over possibly infinite horizons. We first introduce a general logic called counting linear temporal logic plus (cLTL+), and propose an optimization-based method that generates individual trajectories such that satisfaction of a given cLTL+ formula is guaranteed when these trajectories are synchronously executed. We then introduce a fragment of cLTL+, called counting linear temporal logic (cLTL), and show that a solution to planning problem with cLTL constraints can be obtained more efficiently if all robots have identical dynamics. In the second part of the paper, we relax the synchrony assumption and discuss how to generate trajectories that can be asynchronously executed, while preserving the satisfaction of the desired cLTL+ specification. In particular, we show that when the asynchrony between robots is bounded, the method presented in this paper can be modified to generate robust trajectories. We demonstrate these ideas with an experiment and provide numerical results that showcase the scalability of the method.

## Authors

• 2 publications
• 3 publications
• 9 publications
• ### A Counting Semantics for Monitoring LTL Specifications over Finite Traces

We consider the problem of monitoring a Linear Time Logic (LTL) specific...
04/09/2018 ∙ by Ezio Bartocci, et al. ∙ 0

• ### Scalable Integrated Task and Motion Planning from Signal Temporal Logic Specifications

This paper aims to develop formal methods to achieve a performance guara...
03/29/2018 ∙ by Rafael Rodrigues da Silva, et al. ∙ 0

• ### Reasoning about Quality and Fuzziness of Strategic Behaviours

Temporal logics are extensively used for the specification of on-going b...
05/27/2019 ∙ by Patricia Bouyer, et al. ∙ 0

• ### Synthesis of coordination programs from linear temporal logic

This paper presents a method for synthesizing a reactive program which c...
11/10/2019 ∙ by Suguman Bansal, et al. ∙ 0

• ### Temporal Constraint Satisfaction Problems in Fixed-Point Logic

Finite-domain constraint satisfaction problems are either solvable by Da...
02/21/2020 ∙ by Manuel Bodirsky, et al. ∙ 0

• ### Airways: Optimization-Based Planning of Quadrotor Trajectories according to High-Level User Goals

In this paper we propose a computational design tool that al-lows end-us...
06/27/2019 ∙ by Christoph Gebhardt, et al. ∙ 0

• ### Robust, Expressive, and Quantitative Linear Temporal Logics

Linear Temporal Logic (LTL) is the standard specification language for r...
08/27/2018 ∙ by Daniel Neider, et al. ∙ 0

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## I Introduction

inlineinlinetodo: inlineIt would be a good idea to write about how solution times are sensitive to encoding methods in the introduction, to motivate why so many variants are introduced. Would also be good to add some intuitive explanations around the encodings, for a part there are just new encoding equations without too much explanation.

Multirobot systems can serve modern societies in a variety of ways, ranging from pure entertainment [1, 15] to critical search and rescue missions [24, 20], from construction automation [28] to micromanipulation [16]. The number of robots required to achieve a common goal increases each day to improve the effectiveness and efficiency in such applications. Therefore, there is a need for scalable tools to coordinate the collective behavior of large numbers of robots. In this paper, we introduce counting temporal logics for specifying desired collective behavior of multirobot systems in a concise manner, and provide an optimization-based algorithm to synthesize trajectories that ensure the satisfaction of specifications given in this formalism. We show that counting temporal logics can capture meaningful and interesting multirobot tasks, and that the solution method proposed in this paper scales better with the number of robots than the existing methods. In fact, we show that our method scales to hundreds of robots under certain conditions. Moreover, we do not require robots to be synchronized perfectly or communicate during runtime.

Traditional algorithms for multirobot coordination tend to focus on relatively simple tasks such as reaching a goal state while avoiding unsafe regions and collisions [32, 41, 38], or reaching a consensus [14, 22]. Temporal logics, such as Linear Temporal Logic (LTL), provide a powerful framework for defining more complex specifications, for example: Always avoid collision with obstacles, do not cross into region A before visiting region B, and eventually visit regions A and C repeatedly. Given requirements in a formal language, existing methods such as [5, 18, 39] can generate correct-by-construction trajectories for single-agent systems. The use of LTL specifications has also been considered for multirobot systems [7, 12, 17, 23, 31, 37]

. However, generalizations to multirobot systems suffer from the curse of dimensionality and cannot handle large numbers of robots. Furthermore, LTL does not provide a natural way to define group tasks, hence using LTL in multirobot settings results in long formulas, which are not desired as the complexity of the algorithms depend on the length of the formula.

Existing methods that use temporal logic to define multirobot specifications, such as [12, 37], require that each robot be assigned an independent task, a tedious and error-prone process when the number of robots is large. In many applications, completion of a task depends not on identities of robots, but on the number of robots satisfying a property. Take for example an emergency response scenario where hundreds of autonomous vehicles are deployed to locate and help the victims. In such a scenario, it is reasonable to assume that most of the vehicles would have identical capabilities and that the identity of the vehicle is not important to the rescuers, as long as the given tasks are accomplished. On the other hand, tasks might depend on the number of agents satisfying a property. For instance, one might require sufficiently many robots to surveil a particular area to look for victims. Or, one might need to limit the number of rescuers in certain regions to avoid unsafe areas or congestion. We call this type of specification temporal counting constraints and propose a novel logic called counting linear temporal logic plus (cLTL+) to specify them. This logic is two-layered similar to [40]. The inner logic defines tasks that can be satisfied by a single robot, for instance surveiling an area in the previous emergency response scenario. The outer logic requires sufficiently many (or not too many) robots to satisfy tasks given as inner logic formulas. For example, one might express a task that “at least and not more than robots to surveil an area” using cLTL+.

After introducing the logic, we propose an optimization-based method to generate individual trajectories that collectively satisfy specifications given in cLTL+. The method proposed in this paper uses an integer linear programming (ILP) formulation of temporal specifications with the assumption that robots are perfectly synchronized. We later relax this assumption and show how to generate solutions robust to bounded synchronization errors.

We also discuss several variants of the cLTL+ syntax. Firstly, we introduce a fragment of cLTL+, namely counting linear temporal logic (cLTL). We show that an alternative solution method could scale to systems with hundreds of robots when specifications are given in cLTL and robots have identical dynamics. The logic cLTL and associated synthesis algorithms can be seen as an extension of a special class of counting problems that deal with invariant specifications, first proposed in [25, 26]. Secondly, we present an extension to the syntax of cLTL+ to define tasks that could be carried out only by a certain group of robots. For example, one might require a surveillance task to be conducted by robots that are equipped with suitable cameras. This extension allows us to assign tasks to specific group of robots. Finally, we show that continuous state dynamics can be handled directly within our framework.

As another contribution of this paper, we discuss how to relax the synchronous execution assumption and generate trajectories that can be executed asynchronously. Robustness against noise and parameter uncertainty has been extensively studied for single robot systems [42], and also extended to consensus problems [36]. However, additional factors need to be addressed when dealing with multirobot systems. Unlike single robot systems, multirobot systems might tolerate the failure of individual agents without sacrificing task fulfillment. Such a notion of robustness against failing robots is examined in [8, 19, 33]. Another consideration in multirobot coordination problems is the robustness against synchronization errors. Perfect synchronization of robots might not be practical in real-life applications. The authors of [37] characterized a class of LTL formulas that are robust to asynchrony and provided bounds on the deviation from optimality in the presence of asynchrony. However, for general LTL specifications, correctness cannot be guaranteed using this approach. A method that is based on prioritizing robots and planning individual trajectories sequentially was recently proposed in [9]. Trajectories generated with this approach, however, depend highly on how the robots are prioritized—feasible solutions can be missed if priorities are not correctly assigned. In this paper we propose a new definition of robust satisfaction of temporal logic formulas, similar in spirit to [10]. We then provide small modifications to our method to generate trajectories that satisfy this notion of robustness, and show that the method is sound and partially complete.

Preliminary versions of this paper appeared in [33] and [34]. This paper provides a more comprehensive treatment of counting temporal logics and corresponding synthesis problems, including partially complete robust encodings, full proofs and several extensions. Moreover, experimental results implementing the synthesized trajectories in Robotarium [29] are provided. The rest of the paper is organized as follows. Background information is provided in Section II. Section III introduces the syntax and semantics for cLTL+ and cLTL. Section IV formally defines the synchronous coordination problem and proposes a solution. An alternative solution, which can solve a special set of problems more efficiently, is also provided in the same section. Section V introduces a time-robustness concept and presents necessary modifications to the method in order to generate robust solutions. Section VI presents two extensions. We demonstrate the efficacy of the methods presented in this paper via numerical and experimental results in Section VII before concluding the paper in Section VIII.

## Ii System and behavior descriptions

This section introduces the notation used in the rest of the paper and provides system and behavior definitions required to formally state the problem we seek to solve.

The set of nonnegative integers is denoted by and the set of positive integers up to is denoted by . We use

to denote the vector of all

’s. We define a set membership indicator function such that given a set A, if and otherwise. The cardinality of a set is denoted by . We next define transition systems that are used to model the robot dynamics.

###### Definition 1.

A transition system is a tuple where is a finite set of states, is a transition relation, is a finite set of atomic propositions, and is a labeling function.

We say that satisfies or holds at if for and . A transition system is said to be action deterministic if all transitions are controllable. In this work, we assume that robot dynamics are modeled by action deterministic transition systems. This implies that, if the transition relation includes , then there exists a controller that can steer a robot from state to state . Action deterministic transition systems could capture the behavior of many complex systems and could be obtained using abstraction methods [30, 39] or motion primitives [11, 21, 27]. Such abstract graph-based representations are commonly used for describing the behavior of robotic teams [3, 41].

###### Definition 2.

Given a transition system , an infinite sequence of states such that is called a trajectory. For a given trajectory , the corresponding trace is defined as .

The transition system and the trajectories associated with robot are denoted by and , respectively. As indicated by this notation, we allow the dynamics of robots to differ but require that they share the same atomic propositions. Note that this requirement could be achieved without loss of generality, as one can define a global atomic proposition set simply by taking the union of all atomic propositions. For a collection of transition systems (or a collection trajectories), we drop and write (or ) when the range of is clear from the context.

The collective behavior of a multirobot system depends not only on the individual trajectories but also on how they are interleaved. If robots are not synchronized, there are infinitely many ways a collection of trajectories could be executed. Depending on how the asynchrony plays out, a given property might or might not be satisfied by a given collection of trajectories. Since it is difficult to synchronize a large number of robots perfectly in practice, we allow robots to move asynchronously. To reason about asynchronous executions, we define local counters:

###### Definition 3.

A mapping is called a local counter if it satisfies the following:

 k(0)=0,k(t)≤k(t+1)≤k(t)+1,limt→∞k(t)=∞. (1)

The set of all local counters is denoted by .

A local counter is used to keep track of how far a robot has moved along its trajectory. If denotes the trajectory and denotes the local counter of robot , the position of at time is given by . Equation (1) guarantees that initial conditions are respected, the order of states in a trajectory is preserved, and that robots eventually make progress.

Given a collection of trajectories, a particular execution is uniquely identified by local counters:

###### Definition 4.

An -dimensional collective execution is a mapping from global time to local counters, i.e., where for all . The set of all -dimensional collective executions is denoted by .

For a collection of trajectories and a collective execution , we use to denote the unique execution of the trajectories corresponding to . To illustrate the concept of collective execution, we present the following example:

###### Example 1.

Let the following three trajectories

 π1=π2=π3=s2s3s4s8s12…s13s9s5s6s7…s16s12s11s10s9….

denote the trajectories of a red, green, and a blue robot, respectively. An arbitrary collective execution is illustrated in Figure 1. Local counters are initially set as at time ; that is, each robot is initially positioned at . Every robot completes a transition by time , so local counters are updated as . The red and the blue robots move slower than expected and fail to complete two transitions by time . The green robot, on the other hand, successfully completes two transitions by time . Thus, local counters are updated as . Similarly, the values of the local counters up to can be seen from Figure 1.

As stated before, when robots are allowed to move asynchronously, there are infinitely many collective executions given a collection of trajectories. Without a bound on asynchrony, it might be impossible to achieve meaningful tasks. For this reason, we introduce the following definition.

###### Definition 5.

A collective execution is called -bounded if

 maxt∈N,n,m∈[N](|kn(t)−km(t)|)≤τ.

The set of all -bounded -dimensional collective executions is denoted by .

A collective execution is called a synchronous execution. In a synchronous execution, all robots start and complete their transitions simultaneously. The synchronous execution where for all and is called globally synchronous.

## Iii Counting logics: syntax and semantics

This section provides the syntax and semantics of counting linear temporal logic plus (cLTL+), as well as the smaller fragment counting linear temporal logic (cLTL) which allows for more efficient solutions under certain conditions.

### Iii-a cLTL+

The logic cLTL+ is a two-layer logic similar to censusSTL [40]. The inner logic is identical to LTL and is used to describe tasks that can be satisfied by a single robot. For example, tasks such as “avoid collisions with obstacles at all times” or “eventually visit region can be described by the inner logic. The outer layer then specifies the evolution of the number of robots required to satisfy an inner logic formula. Using the earlier examples, we can specify tasks such as “All robots must avoid collisions with obstacles” or “At least five robots should eventually visit region ” using cLTL+.

An inner logic formula over a set of atomic propositions is defined recursively as follows:

 ϕ::=True∣ap∣¬ϕ∣ϕ1∧ϕ2∣◯ϕ∣ϕ1Uϕ2, (2)

where is an atomic proposition and and are inner logic formulas. The symbols and correspond to the logical operators negation and conjunction, and the temporal operators next and until, respectively. Other commonly used operators can be derived from these operators, such as disjunction , release , eventually , always , etc. We use to denote the set of all inner logic formulas defined according to (2). Although the inner logic is identical to LTL, we present the semantics here for the sake of completeness.

Let be a trace and let be an inner logic formula. Satisfaction of by at step is denoted by and is defined as follows:

• ,

• for any atomic proposition , if and only if ,

• if and only if and ,

• if and only if ,

• if and only if , and

• if and only if there exists such that and for all .

If , then we say that satisfies and write for short. We say that a trajectory satisfies if , and write .

After defining the inner logic, we now present the syntax for cLTL+ which is based on a new proposition type: a temporal counting proposition () is an inner logic formula paired with a nonnegative integer, i.e., . The inner logic formula defines a task and specifies the number of robots needed to satisfy it. For example, is a temporal counting proposition that evaluates to if the task “” is satisfied by at least five robots.

The following grammar can now be used to recursively define cLTL+ formulas:

 μ::=True∣tcp∣¬μ∣μ1∧μ2∣◯μ∣μ1Uμ2, (3)

where is a temporal counting proposition and and are cLTL+ formulas. Identical to inner logic, other commonly used operators can be derived from (3).

Let be a collection of trajectories and be a collective execution. Semantics of the outer logic is similar to the semantics of the inner logic, but they are defined for executions of collections of trajectories. Satisfaction of a cLTL+ formula by the pair at time , denoted as , is defined as follows:

• ,

• for any temporal counting proposition , we say if and only if ,

• if and only if and ,

• if and only if ,

• if and only if , and

• if and only if there exists such that and for all .

If , then we say that the pair satisfies and write for short.

### Iii-B cLTL

Having defined the cLTL+, we now introduce counting linear temporal logic (cLTL), which corresponds to the fragment of cLTL+ where the inner logic is constrained to the grammar . Temporal counting propositions in cLTL have the special form where the inner logic is restricted to atomic propositions instead of an LTL formula, i.e., . As a result of this restriction, cLTL enforces robots to “synchronize”. The following example depicts the differences between cLTL and cLTL+ formulas:

###### Example 2.

Consider the following cLTL+ formulas: , , and for .

Here the inner formula of , “”, is an atomic proposition. Hence, is also a cLTL formula where the task “” can be satisfied by any robot, simply by visiting a state where holds. The temporal counting proposition “” is satisfied at time if at least robots to satisfy at time . Moreover, the temporal operators “” in the outer layer necessitate that the temporal counting proposition is satisfied infinitely many times. Thus, there should be an infinite number of instances where is simultaneously satisfied by more than robots in order for to be satisfied.

On the other hand, neither nor can be specified in cLTL. In both formulas, the inner formula contains temporal operators which are not allowed in the cLTL syntax. The difference between and is that the latter relaxes the simultaneity requirement. The inner formula can be satisfied by any robot if the robot satisfies infinitely many times. The integer is the smallest number of robots that needs to satisfy the inner formula. Hence, the cLTL+ formula requires at least robots to satisfy infinitely many times, but as opposed to they need not do so simultaneously. For any given time the number of robots that satisfy might never exceed , or even . Note that any collective trajectory that satisfies also satisfies , but the converse is not true.

The difference between and is more subtle. Any collective trajectory that satisfies would also satisfy . The converse is also true if the number of robots is finite. However, in the hypothetical scenario where there are infinitely many robots, can be satisfied even if no robot satisfies more than once.

## Iv Synchronous coordination problem and its solution

This section provides the formal definition of the synchronous multirobot coordination problem and provides an optimization-based solution for cLTL+ specifications. Subsequently, an alternative solution is proposed for the special case where the specifications are given in cLTL and the robots have identical dynamics. The alternative solution is shown to scale much better with the number of robots. In fact, the number of robots has almost no effect on the solution time and problems with hundreds of robots can be solved with the alternative method as demonstrated in Section VII.

###### Problem 1.

Given robots with dynamics , initial conditions , and a cLTL+ formula over , synthesize a collection such that the globally synchronous execution of satisfies , i.e., .

In order to solve Problem 1, we generate individual trajectories in a centralized fashion. Robots then follow these trajectories in a distributed fashion, using local controllers without runtime communication. To generate trajectories we encode the robot dynamics and the cLTL+ constraints using integer linear constraints and pose the synthesis problem as an integer linear program (ILP). This approach is inspired by the bounded model-checking literature [6]. In particular, we focus the search on individual trajectories on prefix-suffix form. That is, for a given integer , we aim to construct individual trajectories of the form and find an integer such that for all , . In the following, we present ILP encodings of dynamic and temporal constraints.

### Iv-a Globally synchronous robot dynamics

Given the transition system that represents the dynamics of robot , consider the adjacency matrix corresponding to the transition relation . We use a Boolean vector with a single nonzero component to denote the state of robot at time . For example, assume and that robot is at at time . Then, . With a slight abuse of notation, we equivalently write .

Given adjacency matrices corresponding to and a set of inital conditions , the dynamics of robot are captured as follows:

 wn(t+1)≤Anwn(t),wn(0)=πn(0),1Twn(t)=1, (4)

for all and for all . The trajectory corresponding to the sequence can then be extracted by locating the nonzero component in each .

### Iv-B Loop constraints

To ensure that the generated trajectories are in prefix-suffix form, we introduce binary variables and the following constraints:

 wn(h) ≤wn(t)+1(1−zloop(t)), (5a) wn(h) ≥wn(t)−1(1−zloop(t)), (5b) h−1∑t=0zloop(t) =1 (5c)

for all and for all . These constraints guarantee that there exists a unique such that and . For all other time instances, the first two inequalities are trivially satisfied.

### Iv-C Inner logic constraints

We next recursively describe how counting temporal logic constraints can be translated into integer constraints. Let be an inner logic formula given according to (2) and be the horizon length. For each robot , we introduce binary decision variables for and ILP constraints such that if and only if . Hence, satisfaction of an inner formula by the robot is equivalent to . We use the following encodings to recursively create the corresponding ILP constraints:

ap (atomic proposition): Let be an atomic proposition and let the states of be given by the set . We define the vector such that the entry of is if and only if . That is, encodes the labeling function . Then we introduce the following constraints for all :

 (vϕn)Twn(t)≥zϕn(t),(vϕn)Twn(t)

(negation): Let . Then for all ,

 zϕn(t)=1−zφn(t),t=0,…,h−1. (7)

(conjunction): Let . Then for all and for all ,

 zϕn(t)≤zφin(t),for i=1,…,Iand,zϕn(t)≥1−I+I∑i=1zφin(t). (8)

(disjunction): Let . Then for all and for all ,

 zϕn(t)≥zφin(t),for i=1,…,Iand,zϕn(t)≤I∑i=1zφin(t). (9)

With a slight abuse of notation, we also use Boolean operators on these optimization variables. For example, for , we write instead of stating the inequalities in (9). Encoding of the temporal operators is then as follows:

(next): Let , then for all

 zϕn(t)=zφn(t+1),t=0,…,h−2 and, zϕn(h−1)=h−1⋁t=0(zφn(t)∧zloop(t)). (10)

(until): if , then for all

 zϕn(t)=zφ2n(t)∨(zφ1n(t)∧zϕn(t+1)),t≤h−2,zϕn(h−1)=zφ2n(h−1)∨(zφ1n(h−1)∧(h−1⋁t=0(zloop(t)∧~zϕn(t)))),~zϕn(t)=zφ2n(t)∨(zφ1,nt∧~zϕn(t+1)),t≤h−2,~zϕn(h−1)=zφ2n(h−1), (11)

where are auxiliary binary variables. As shown in [6], not introducing auxiliary variables results in trivial satisfaction of the until operator.

### Iv-D Outer logic constraints

Similar to the inner logic, we proceed by transforming a cLTL+ formula into ILP constraints. Given a cLTL+ formula and a time horizon , we create binary decision variables , where and ILP constraints . While doing so, we ensure that if and only if where is the globally synchronous collective execution. We remind the reader that since ILP constraints are created recursively, creating the constraints for formula will create the constraints for all the inner logic formulas appearing in . We denote by the set of all resulting constraints that encode the satisfaction of , and by , the set of all variables created in this process.

We provide encodings only for counting propositions since the rest of the semantics are identical. Let be a temporal counting proposition. Then

 m>N∑n=1zϕn(t)−Myμ(t)≥m−M, (12)

where is a sufficiently large positive number, in particular, . Note that when , the inequality on the right reduces to . Moreover, the inequality on the left is trivially satisfied since . Conversely, when , the inequality on the right is trivially satisfied and the inequality on the left reduces to . Therefore, if and only if the number of robots that satisfy at time is greater than or equal to . Conversely, () if and only if the number of robots that satisfy at time is less than . Therefore, the ILP constraints in (12) are correct and consistent with the semantics of cLTL+.

### Iv-E Overall optimization problem and its analysis

The following optimization problem is formed to generate a solution to an instance of Problem 1 given a horizon length :

 (13)

Next we analyze this solution approach. The following theorem shows that the solutions generated by (13) are sound.

###### Theorem 1.

If the optimization problem in (13) is feasible for a cLTL+ formula , then a collection of trajectories can be extracted from such that .

###### Proof.

Constraint (4) guarantees that the collection of trajectories generated from are feasible, consistent with the initial conditions and with the system dynamics. Furthermore, (5) ensures that these solutions can be extended to infinite trajectories of the form . The ILP encodings (6)-(11) of LTL formulas are sound [6], and the same encodings are also used for cLTL+ formulas by replacing with , where is any cLTL+ formula. The only exception is that (6) is replaced with (12), which we showed to be correct. Therefore, the constraint together with guarantees that . Thus, if (13) is feasible, then the globally synchronous execution of solves Problem 1. ∎

As a corollary, it is easy to show that stutter invariance of formulas (see Theorem 7.92 from [2]) allows the generalization of the soundness result from globally synchronous executions to all synchronous executions:

###### Corollary 1.

If does not contain any next operator , neither in the inner nor in the outer logic, then for all synchronous executions .

The following theorem shows that encodings presented in (4)-(13) are complete:

###### Theorem 2.

If there is a solution to Problem 1, then there exists a finite such that (13) is feasible.

###### Proof.

In order to show that prefix-suffix form solutions are complete, we reduce Problem 1 to a regular LTL control synthesis problem, for which prefix-suffix solutions have been shown to be complete [2].

Let be the set of all inner logic formulas defined according to (2) over . Given any cLTL+ formula , one can define an equivalent LTL formula over a new set of atomic propositions . For each temporal counting proposition in , we define a new set of LTL formulas over , where is obtained by replacing every atomic proposition with the corresponding . We then define , where is the set of all -element subsets of , hence . Note that, is equivalent to , meaning that any collective execution that satisfy one will also satisfy the other. Even though this method increases the number of atomic propositions linearly and the length of the formula combinatorially with the number of robots, it will transform a cLTL+ formula into a regular LTL formula over a finite set of atomic propositions.

Next we create a product transition system with the set as its atomic propositions. Now Problem 1 is reduced to a standard LTL synthesis problem and it can be solved using a model-checker to generate a prefix-suffix solution or to declare the non-existence of solutions (see e.g., [4]). ∎

###### Remark 1.

The proof of Theorem 2 highlights the advantages of using cLTL+ in scenarios where robot identity is not critical for accomplishing the collective task. Although the problem can be reduced to a standard LTL synthesis problem as the proof suggests, the reduction results in a synthesis problem on a product transition system with size exponential in the number of robots, and with an LTL formula that is combinatorially longer than the cLTL+ formula. Indeed, without a convenient logic, just writing down that LTL formula would be a tedious and error-prone task.

A few remarks on the complexity are in order. An instance of (13) has decision variables and constraints where is the solution horizon, is the number of robots, is the number of states of the largest transition system and is the length of the cLTL+ formula . Enforcing collision avoidance introduces additional constraints.

### Iv-F cLTL encodings

Given an instance of Problem 1, if the specification can be expressed in cLTL and all robots have identical dynamics, more efficient encodings could be defined. In the following, we first define the problem where cLTL encodings could be used and then provide the corresponding encodings:

###### Problem 2.

Given robots with identical dynamics , initial conditions , and a cLTL formula over , synthesize a collection of trajectories such that the globally synchronous collective execution of satisfies , i.e., .

Let the set of states be enumerated such that . Instead of individually encoding the dynamics of each robot, we define an aggregate state vector where the row of denotes the number of robots at state . Similarly, the aggregate input is defined as a vector where denotes the number of robots that transition from state to . Note that the aggregate input is state-dependent since the total number of robots sent from a particular state to others cannot be greater than the number of robots in that state. Furthermore, the number of robots sent from a state can only be a non-negative integer. An input satisfying these conditions is called admissible and denotes the set of all admissible inputs for a given state . The set can be captured by the following set of equalities:

 Υ(w)=⎧⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎨⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎩{uji}:|S|∑j=1uji=wiuji=0 if (vi,vj)∉→uji∈N⎫⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎬⎪ ⎪ ⎪ ⎪ ⎪ ⎪⎭. (14)

The evolution of aggregate state can be captured by the following linear equalities:

 w(t+1)=Bu(t),u(t)∈Υ(w(t)), (15)

where is defined as where

is the identity matrix of size

and is the Kronecker product.

Loop constraints for aggregate states can be written as:

 w(h)≤w(t)+1(1−zloopt),w(h)≥w(t)−1(1−zloopt). (16)

Inner logic constraints are no longer needed since the cLTL inner logic is constrained to the grammar where . In the outer logic, only the encoding of temporal counting propositions in (12) needs modification. Let be a and be the set of states. We define the vector similar to (6), that is, the entry of is if and only if . Then, for all , the constraints

 vaw(t)≥m−M(1−yμt)vaw(t)≤m+Myμt (17)

ensure that if and only if the number of robots that satisfy is greater than or equal to . The rest of the outer logic encodings are not modified and used as before.

Given a time horizon , the following optimization problem is formed to generate solutions to an instance of Problem 2:

 Find u(0),…,u(h−1),zloop,ycLTL+s.t.(???),(???),(???),ILP(μ) and yμ(0)=1. (18)

We now show how a solution of (18) can be mapped to a collection of individual trajectories. Given initial conditions , and , randomly choose robots from state and assign their next state as . This is always possible since is well defined and . Continuing in this manner, we can generate the collection whose globally synchronous collective execution satisfies the specification . Details of a similar constructions of individual trajectories can be found in [26].

Before proceeding to the asynchronous problem, we remind the reader of two important things: (i) the ILP constraints in (18) are consistent with cLTL+ semantics, therefore soundness and completeness guarantees follow from Theorems 1 and 2. (ii) An instance of (18) has decision variables and constraints where is the number of transitions and is the length of the formula. Crucially, the number of decision variables and constraints does not depend on the number of robots. Therefore, it easily scales to very large number of robots as demonstrated in Section VII.

## V Robustness to asynchrony

Incorporating a concept of time-robustness into our algorithm is useful since it is difficult to perfectly synchronize the motion of robots in real-life applications. This section presents small modifications to the original algorithm that allow one to synthesize trajectories that are robust to bounded synchronization errors.

Synchronous execution assumes that multiple robots can transition from one discrete state to another at the same time. However, this is not always possible in reality where robots may move slower or faster than intended, leading to asynchronous switching times as illustrated in Figure 1. To exemplify, consider a task that requires multiple robots to satisfy a certain proposition at the same time. Let be a , be a collection of trajectories and be a synchronous collective execution. Assume that holds for a single time step and fails to hold for all others, i.e., for some and for all . While such a satisfies for the synchronous execution it is not always a desirable collection, because if becomes asynchronous due to one of the robots moving slower than intended, correctness guarantees would no longer be valid and would not be satisfied. This fact motivates us to generate solutions that are robust to such asynchrony.

For most non-trivial specifications however, finding a collection of trajectories that is robust to unbounded asynchrony would be challenging if not impossible. If, however, an upper bound on the asynchrony is known, one can generate robust solutions such that satisfaction of the task is guaranteed even under the worst-case scenario.

To reason about asynchronicity we define the concept of anchor time for collective executions.

###### Definition 6.

For a given collective execution , the anchor time mapping maps the time index to the smallest local counter value , i.e., .

For a -bounded collective execution and a given time step , at least one local counter has the value and all other local counters are limited to an interval: for all . For the globally synchronous collective execution , the anchor time mapping is the identity mapping on . In Figure 1, “anchoring robots” at each time step are highlighted with a black circle and anchor times are written in bold.

Having defined the “anchor time”, we now formally define the concept of robust satisfaction for a collection of trajectories.

###### Definition 7.

A collection of trajectories -robustly satisfies at time , denoted

 Π,t⊨τμ, (19)

if and only if for all and for all ,

 (Π,K),T⊨μ. (20)

In other words, a specification is -robustly satisfied at time by if every -bounded collective execution of satisfies at all time instances for which the anchor time is . Consider the set of trajectories and an asynchronous collective execution given in Example 1. For to hold; we must have , for all since . Additionally, the same argument must hold for every possible . If , we say that the collection satisfies cLTL+ formula and write for short.

Before presenting modified encodings that incorporate robustness to asynchrony, we remind the reader that the robots are allowed to stutter as indicated by Definition 3. Any inner logic formula containing ‘’ can always be violated by a single robot when robots are allowed to stutter. Hence, we restrict attention to the case where inner logic formulas are in LTL. We further assume that a cLTL+ formula is given in positive normal form (PNF) according to the following syntax:

 μ::= True∣tcp∣μ1∧μ2∣μ1∨μ2, (21)
###### Remark 2.

The negation operator can be omitted without loss of generality for two reasons. First, any LTL formula can be transformed into positive normal form (PNF) [2], where the negation operator appears only before atomic propositions. Since the syntax of cLTL+ is identical to LTL, hence any cLTL+ formula can also be written in PNF where negation only appears before ’s. Second, given an arbitrary temporal counting proposition , the statement can be replaced by . Clearly, if there are at least robots satisfying , then is satisfied by less than robots; hence, . Thus, the omission of the negation operator is without loss of generality.

Finally, we formally define the robust version of Problem 1 as follows:

###### Problem 3.

Given robots with dynamics , initial conditions , a cLTL+ formula given in PNF over LTL, and an upper bound on the asynchrony , synthesize a collection of trajectories that -robustly satisfies , i.e., .

We propose slight modifications to the encodings presented in Section IV to generate a collection of trajectories that are -robust. Firstly, we define new Boolean vectors to represent the state of robot “after the loop” such that for some and . Secondly, given temporal counting proposition , we introduce a new decision variable for each :

 rϕn(t) =τ⋀k=0zϕn(t+k),for 0≤t

Note that, is defined for all due to newly defined additional state vectors. These new variables can be seen as the robust versions of . In order for to hold, robot needs to satisfy the inner logic formula not only at time step , but also for the next steps. Since at anchor time , the local times are bounded as , this robustification ensures that robot satisfies at anchor time , regardless of the asynchrony.

We now define the modified outer logic constraints. As before, these constraints are constructed recursively. Let be a such that . Then (12) is modified as

 m>N∑n=1rϕn(t)−Myμ(t)≥m−M. (23)

For the special case where , we use

 1>N∑n=1rϕn(t)−M~yμ(t)≥1−M,N>N∑n=1zϕn(t)−M¯yμ(t)≥N−M,yμ(t)=~yμ(t)∨¯yμ(t). (24)

In the synchronous setting, satisfying a temporal counting proposition only for an instant would be enough. However, this is not desirable since robots might not be perfectly synchronized. Equations (23) and (24) ensures that all -bounded executions satisfy at all time instances with anchor time , by replacing each with its robust counterpart . As a result, even in the worst case of asynchrony, there would be an instant where is satisfied.

Encodings of some of the outer level operators are also modified slightly. For conjunction and next operators, no modification is needed: if and where each is a cLTL+ formula in PNF form, then and .

Disjunction is encoded in two different ways: If all operands are temporal counting propositions, i.e, where , then

 yμ(t)=⋁iyμi(t)∨(N∑n=1r(⋁iϕi)n(t)>∑i(mi−1)) (25)

is used. Note that is only defined if all are . In all other cases, we use the standard encoding:

 yμ(t)=⋁iyμi(t). (26)

If the disjunction contains both s and other formulas, then it can be re-written to leverage the less conservative encodings in (25). The motivation behind (25) is that, a collection might not -robustly satisfy neither or but can still -robustly satisfy as demonstrated by the following example:

###### Example 3.

Let be a cLTL+ formula and let a collection be given with the following traces:

 σ(π1