## 1 Introduction

*Multi-Lane Spatial Logic* (MLSL) comprises an abstract model of a motorway and a spatial logic to reason about traffic configurations [12].
MLSL can be used to, e.g. analyse controllers of (semi) automated driving systems.

In offline monitoring we are given a recorded behavior , a specification and we want to check if satisfies , denoted as .
In this work we perform monitoring for MLSL.
While MLSL has been extended with CTL-like branching time temporal modalities [16], they are not suitable for monitoring.
We formalise what it means for an MLSL formula to hold *globally* in linear time, where we denote ‘globally ’ as .
This means that here is a transition sequence and we instantiate with , where is an arbitrary MLSL formula.

We define a procedure to check if an MLSL formula holds globally in an MLSL transition sequence. For this we adapt a procedure to check satisfiability of a restricted form of MLSL formulas [10]. In this extension we transform the MLSL formula that should hold globally, and the transition sequence to the first-order theory of real closed fields, which is decidable [22] (there called elementary algebra), such that the transformed formula is valid iff holds.

However, it is idealistic to assume that the data we are working with is exact.
Here, we consider errors in positional data (spatial imprecision) and imprecisions of when reservations and claims are set and withdrawn (temporal imprecision).
For temporal robustness other approaches use that they have the satisfaction of temporal atoms as a signal over time.
Here, our temporal formula is and is our temporal atom.
We do not have the truth value of as a signal over time.
For this reason we decided to base the temporal aspect of MLSL on *timed words* [4], from which we then derive MLSL transition sequences.
Then we define temporal robustness by deviating the time stamps in a timed word.
We combine this temporal robustness with our previous work on spatial robustness [18] and define spatio-temporal similarity with a metric.
We then define what it means that an MLSL formula globally holds, even if the transition sequence is subject to spatio-temporal perturbations.
Lastly, we extend our previous transformation to accomodate the spatio-temporal perturbations.

### Related Work

There is a lot of work on monitoring temporal properties in dense time formalisms. This was then extended to checking how robustly (in the spatial sense) a signal satisfies a Metric Temporal Logic formula [8, 7]. This was then extended to consider spatio-temporal robustness of Signal Temporal Logic [6], a temporal logic that works with dense time and dense data. In [9] the authors considered robust satisfaction of Duration Calculus. In all of these works the authors define a multi-valued semantics for their temporal logic. For MLSL we have not been able to define a useful multi-valued semantics, because the atoms do not have quantitative data, which is crucial in the works mentioned above. In [3] the authors perform online monitoring of spatial properties for a driving car. In contrast to our work, they take a very low level view (little abstraction) and they can not easily check arbitrary spatial properties. In [20] the authors formalise traffic and traffic rules in a theorem prover. However, their goal is analysing meta properties, such as ambiguity of traffic rules, rather than automation. Urban MLSL is an extension of MLSL that allows for logical reasoning about traffic scenarios in an urban setting [13, 21].

## 2 Abstract Model for Motorways

We use an abstract formal model for motorway traffic [12], where the traffic configuration at a specific point in time is given by a *traffic snapshot*.
In a traffic snapshot the motorway is represented by two dimensions, a discrete vertical dimension, which represents lanes and a continuous horizontal dimension, which represents the position along a lane.
Then a *reservation* of a car represents space the car physically occupies plus some safety margin, which we assume to be the braking distance.
When a car changes lanes it may have multiple adjacent reservations.
A *claim* of a car represents that the car would like to reserve the claimed space.
With claims we model the turn-signal of a real car.
Additionally, a traffic snapshot has information about the speed and acceleration of each car.
The evolution of traffic over time is modelled as a labelled transition system, where each state is a traffic snapshot.
We give an example traffic snapshot and MLSL formulas to develop some intuition for the formalism.
MLSL Formulas are evaluated on a restricted area of a traffic snapshot called *view*.
We show an example traffic snapshot and view in Figure 1.
In the traffic snapshot, with the given view, the formula

holds. Here, is an abbreviation and means that the subformula holds somewhere in the view, is used to separate adjacent segments within the lane, indicates that the lane segment is free of claims and reservations and means that the segment has a reservation from car . Note that in formulas we use lower case letters to refer to cars. The formula

also is satisfied by the traffic snapshot and the view in Figure 1. With we indicate that the lane segment has a claim of car . Note that and are not exclusive, i.e. in the lane segment where the claim of and the reservation of overlap, both, and are satisfied. We can stack formulas to express that on the lower lane the lower formula holds, and that on the upper lane the upper formula holds. That is, the formula

is satisfied with the complete view, not just somewhere within the view.

Let be a set of cars and be a set of lanes let be the powerset over .
The composition of data from the cars in is a *traffic snapshot*.
We add a function , which gives the braking distance of a car, to the traffic snapshot from [12].
[Traffic Snapshot]
For every car let be the physical length of .
Then a traffic snapshot is defined as , where
is the position of the rear of a car,
is the length of a reservation of a car including its physical length,
is the current speed,
is the current acceleration,
is the set of reserved lanes.
is the set of claimed lanes.
^{1}^{1}todo: 1If Iwant to change font of etc. to roman, I have to use different macros for and !!!

We model the evolution of traffic snapshots as labelled transitions, where we use discrete and continuous transitions. The discrete transitions for a car are to change the acceleration ( with ), set a claim for a lane ( with ), change an existing claim into a reservation ), withdraw an existing claim () and withdraw a reservation from a lane ( with ). The continuous transitions are similar to delay transitions in timed automata, i.e. we update the data affected by time (here position, speed and the derived braking distance). To define the transitions we use substitution and function overriding, i.e. let be , except that the function is replaced by , which maps to the value and agrees on everything else with . [Transitions] Let with and . Further, to compute the braking distance of a car we assume a maximum deceleration value that all cars are capable off. We define

While we give a definition of for all cars, our results also hold with a different definition of for each car. Such an individual definition could depend on properties of the cars, e.g. one definition for light cars and another for heavy cars. However, our results only hold when the function used is a polynomial, i.e. we do not allow exponentiation and trigonometric functions.

Here we take the view that underlying a transition sequence, there is a *timed word* [4].
A timed word is a sequence of events and time stamps.
[Timed Words]
For a set of cars and a car we denote the cars actions as and the set of actions of all cars as .
The joint behavior of the cars in is a timed word where and is a weakly monotonic increasing sequence of time stamps over .
We assume that all timed words have as their last element in a special marker .
For a timed word with and we denote the *projection* to as with , and such that is the longest subsequence of that only has letters from .
Let the of a timed word be the interval .
We define the *time-bounded prefix* with as , where is the largest index such that .
Note that we might have .

We define that the application of a timed word to a traffic snapshot gives a transition sequence. The idea is that we first let time advance to the th time stamp and then perform the th discrete action. Note that we interpret ‘’ as a delay of zero time. [From Timed Words to Transition Sequences] Given a timed word with and and a traffic snapshot , we define the transition sequence as

Further, for we define the *time-bounded transition sequence until * as and we denote the last traffic snapshot in as , i.e. is the traffic snapshot at time .
In the rest of this work we will only consider transition sequences that result from timed words, and that satisfy the constraints from Definition 1.
Additionally, we assume that all transitions labelled with change the state, i.e. a car makes a reservation only if it has a claim, it withdraws a claim only when it has a claim and it withdraws a reservation only if it has two reservations.

We give an example of a timed word and how we create a transition sequence from it. In our examples we give constants representing physical quantities always with their units, i.e. for distances, for time, for speed, and for acceleration. Let us assume that the global, maximal deceleration constant is given as and that each car has a physical length of . Consider a timed word

and a traffic snapshot defined as

Note that is a formulisation of the traffic snapshot from Figure 1. By applying to , we get the transition sequence

depicted in Figure 2. Note that the two delays in the timed word above result from the delay between and ‘’, and from our representation of ‘’ in the transition sequence as a delay. We use this transition sequence as our running example in this work.

In MLSL we reason about traffic configurations from the local perspective of a car, called *view*.
[View]
A view is a tuple , where is the interval of visible lanes, is the extension of the visible lanes and is the owner of the view.
We say that is a subview of if and , where we interpret if and for any set .
We define and .
Additionally, we assume a set of variables ranging over , a special variable and a variable valuation such that .
We define that is an MLSL model.

We lift transition sequences over traffic snapshots to transition sequences over models, as in [16] by moving the view along with its owner. Let be a timed word and a traffic snapshot with , where . For , we define

with , and .

The syntax of MLSL is

where and .
We denote the set of all MLSL formulas with .
We briefly sketch the idea of the logic:
The atom (resp. ) is satisfied when the current view is filled by the reservation (resp. claim) of the car that points to.
The atom is satisfied if the current view does not have a subview where or is satisfied for any car and is satisfied if the extension of the current view has length .
The horizontal chop (resp. vertical chop ) is satisfied if we can cut the current view into two horizontally (resp. vertically) adjacent subviews on which and are satisfied.
In the semantics of the vertical chop operator we follow [10], i.e. we distinguish whether the view contains any lanes before chopping.
[Semantics]
Let , and .
Given a traffic snapshot , a view
and a valuation with
we define the *satisfaction*
of a formula by a model as follows:

We use common abbreviations like , , and .
For an MLSL formula we also use the spatial *somewhere* modality from [12] that is defined as

## 3 Monitoring Globally Properties

In this section we first formalise for an MLSL model , a timed word and an MLSL formula what the statement ‘ holds globally in ’ means. The intuition is that we check for every point in time within the time span of , whether the model in the transition sequence at time satisfies , which in symbols is . Afterwards, we define a transformation that takes as inputs , and , and creates a formula from the first-order theory of real-closed fields [22] (there called elementary algebra). In our transformation we mimic the afore mentioned intuition. The general idea is that represents the initial model, changes the transformed initial model and is checked on the changed model. We use a universally quantified variable and freeze the transformed model at the time given by the value assigned to and discard later changes. Then we check whether holds in the frozen model. As is universally quantified and ranges over the time span of the timed word , is valid iff holds globally in .

In [16] the authors extend MLSL with branching CTL-like temporal modalities.
As branching time modalities are not suited for monitoring, we define a linear time *globally* modality, which is satisfied if the subformula is satisfied at every point in time.
[Global Satisfaction]
A transition sequence globally satisfies a spatial property (denoted as ) iff at every point in time within the span of the formula is satisfied.
Formally,

We consider formulas from first-order theory of real-closed fields with the signature and standard interpretation. The satisfiability problem of this logic is decidable [22]. We denote the set of all formulas as and the set of real-valued variables as . This logic shares symbols with MLSL, such as , and .

However, from the context it will be clear to which logic symbols belong.
We denote the *variable assignment* with , which assigns variables a value.

In our transformation the state of a car at a time point is given by the variables from in the tuple . For any car and timed word let . Now, let (d for data) be a list of length such that it has for each car a list of length and at we have an aforementioned tuple of variables. Note that the lists for the cars may be of different lengths. We refer to the list that has for each car the first (resp. final) entry with (resp. ). Consider the timed word from Example 2. Then let

For and we show the structure of in Figure 3.

For real-valued variables, which we consider as not assigned, we introduce a special value such that . Given a traffic snapshot we assume w.l.o.g. that for all cars we have if only reserves lane and if does not have a claim. Further, let be globally available. [Transforming Initial Models] For a traffic snapshot over a set of cars , let for a car be the values in the set and be the value in the set . With the variables we define

For each car the transformation of an action () is split into a transformation of a delay action () and into a transformation of a discrete action (). We point out that we treat the ‘’ marker as an action that does not change anything. [Transforming Actions] For some car and an index let . For and a variable indicating a delay we define

with and similar for the other variables.

Now we can define a transformation for the time-bounded prefix , where is a timed word and . The model at time is stored in the variables . To achieve this we ignore all changes after time . To define our transformation of time-bounded prefixes, we assume a structure that has entries , similar to . For a car and a projected timed word we identify time stamps with variables that have the constraint and . [Transforming Timed-Bounded Transition Prefixes] For let , and . Then we define

(1) | ||||

(2) | ||||

(3) |

The first implication (1) considers the case where the effect of the action takes place before or at time . Hence, we completely represent the effect in our transformation. If the condition of the second implication (2) is satisfied, we know that delaying by time units takes us past . Hence, we only delay by time units, exactly to time point and do not transform . Instead of we transform ‘’, which ensures that all variables retain their values. The third implication (3) ensures that we do not manipulate the model anymore, after time point . Note that in the conditions of the implications for each exactly one condition is satisfied.

We need a method to check if an MLSL model satisfies an MLSL formula.
In [10] the authors defined a transformation to check satisfiability of an MLSL formula that is restricted to a finitely bounded set of cars (called well-scoped MLSL with scopes).
Their transformation creates a quantified linear integer-real arithmetic formula that is valid iff is satisfiable.
We simplify their transformation to instead check whether for a *given model* it holds that .
The adapted transformation takes two parameters: the first is a tuple , defining the cars to consider (here we have ), the current lanes with , the current extension as variables , and the valuation function .
The second parameter is the MLSL formula.
The formula that creates is from the first-order theory of real-closed fields and represents the semantics of MLSL.
For this the formula creates suitable constraints on .
Note that negation in MLSL is represented with by negation in the first-order theory of real-closed fields, i.e. for all and MLSL formulas we have .
The following claim states that we can algorithmically determine if an MLSL formula is satisfied by a model.
Let with and let for the variables be available.
We constrain with and define .
Then for any MLSL formula we have

where is evaluated on the variables .

Now we can define our transformation to check globally properties. The intuition of the transformation is that it checks if we can stop the evolution of at all time points and store the model at that time in the variables subscripted with ‘f’ and then evaluate on this stored model. Note that we use the variables to represent the extension at time . [Transforming Globally Properties] Given a model and a timed word over a finite set we use the variables with the constraints and . Let , then for an MLSL formula we define

where is evaluated over .

Given a timed word , an MLSL model and an MLSL formula

The previous claim states that we can reduce checking to checking for validity. This is equivalent to being unsatisfiable. As the satisfiability of first-order theory of real closed fields is decidable [22], we get the following theorem, assuming that the above claim holds. It is decidable whether an MLSL formula holds globally in an MLSL transition sequence.

Consider the timed word and the traffic snapshot from Example 2 and the MLSL formula *no potential collision*

which is a generalisation of the potential collision formula from [12]. The formula states that nowhere in the current view, there is an overlap of the claims or reservations from two different cars. Let the view be and the valuation be , then we define . We give an overview of how our procedure works to find that does not hold.

To test whether ‘there is never a potential collision’ holds in we check for validity. We show that is not valid by giving a satisfying assignment for its negation. The negation evaluates to

Comments

There are no comments yet.