Planners are central to the notion of complex autonomous systems. They provide the flexibility that autonomous systems need to be able to operate unattended in an unknown and dynamically-changing environment. However, they are notoriously hard to validate. This paper reports an investigation of how redundant, diversified models can be used as a complement to testing, in order to tolerate residual development faults. A fault-tolerant temporal planner has been designed and implemented using diversity, and its effectiveness demonstrated experimentally through fault injection. The paper describes the implementation of the fault-tolerant planner and discusses the results obtained. The results indicate that diversification provides a noticeable improvement in planning dependability (measured, for instance, by the robustness of the plans it produces) with a negligible performance overhead. However, further improvements in dependability will require implementation of an on-line checking mechanism for assessing plan validity before execution.
展开▼
