Safety-critical applications often use dependability cases to validate that specified properties are invariant, or to demonstrate a counter example showing how that property might be violated. However, most dependability cases are written with a single product in mind. At the same time, software product lines (families of related software products) have been studied with the goal of modeling variability and commonality, and building family based techniques for both analysis and testing. However, there has been little work on building an end to end dependability case for a software product line (where a property is modeled, a counter example is found and then validated as a true positive via testing), and none that we know of in an emerging safety-critical domain, that of robotic surgery. In this paper, we study a family of surgical robots, that combine hardware and software, and are highly configurable, representing over 1300 unique robots. At the same time, they are considered safety-critical and should have associated dependability cases. We perform a case study to understand how we can bring together lightweight formal analysis, feature modeling, and testing to provide an end to end pipeline to find potential violations of important safety properties. In the process, we learned that there are some interesting and open challenges for the research community, which if solved will lead towards more dependable safety-critical cyber-physical systems.

Surgical robotic systems have a great impact on the application of laparoscopic surgeries in the operating room. The advent of externally operated surgical robots has prompted the first significant shift in general laparoscopic surgeries. Miniature in vivo robots that can be completely inserted in to the abdomen are also being studied to reduce patient trauma. Whereas external surgical robots have a constrained workspace but provide good speed and force capabilities; miniature surgical robots have good local workspace characteristics, but are generally slower and not as powerful. Current efforts to address these limitations include cooperatively using multiple surgical robots to increase dexterous manipulation capabilities, fault tolerance, and overall robustness. In this paper, a cooperative surgical robot system composed of an externally actuated, compact tool-positioning surgical robot, CoBRASurge (Compact Bevel-geared Robot for Advanced Surgery), and an in vivo fixed-base, task assistant Dexterous Robot, is presented to perform laparoscopic surgical procedures. The CoBRASurge functions as a gross end-effector positioning robot and the Dexterous Robot performs internal surgical tasks with fine accuracy, effectively increasing the flexibility of the robot system. The surgical procedure successfully demonstrates the feasibility of using CoBRASurge to provide the surgeon with stable and remotely adjustable repositioning of in vivo robots for laparoscopic procedures in the peritoneal cavity.

Gaining access to the peritoneal cavity through a natural orifice is potentially the next paradigm shift in minimally invasive surgery. Natural orifice translumenal endoscopic surgery (NOTES) provides distinct patient advantages, but is surgically challenging. Access to the peritoneal cavity is limited by the size and complex geometry of the natural lumen, and existing tools do not adequately address these constraints. A miniature in vivo robot with two "arms" and a central "body" has been developed for NOTES. The robot can be advanced through the esophagus and into the peritoneal cavity using an overtube and endoscope. Once completely inserted, the robot provides a stable platform for visualization and dexterous manipulation from arbitrary orientations. In vivo testing of the NOTES robot in a porcine model has been successful. Using the robot, the surgeon was able to explore the abdominal cavity and perform small bowel dissection. In addition, benchtop testing has demonstrated the ability of the robot arm to follow a predetermined path in Cartesian space and shows good results towards future three- dimensional feedback control.

This paper presents a method for determining the feasible processing window for a leader robot that controls a group of follower robots. A processing window is defined as the time interval from the instant the platform starts collecting data to the moment the robot leader finishes planning and communicates with follower robots. The method determines the minimum processing window after considering the different bounds affecting the control of the robot, such as of robot’s processing power, robot sensors and the motion of the robots in the group. We present a derivation of the bounds that affect the processing window of the leader robot and an algorithm for determining the feasible window or adjusting the parameters that affect the processing window in case a feasible processing window cannot be achieved because of an overload condition. The application considered in this paper is a group of mobile robots that self deploy, retrieve, and reconfigure barrels to improve the safety of highway construction/maintenance workers.

Long-term human space exploration will require contingencies for emergency medical procedures including some capability to perform surgery. The ability to perform minimally invasive surgery (MIS) would be an important capability. The use of small incisions reduces surgical risk, but also eliminates the ability of the surgeon to view and touch the surgical environment directly. Robotic surgery, or telerobotic surgery, may provide emergency surgical care in remote or harsh environments such as space flight, or extremely forward environments such as battlefields. However, because current surgical robots are large and require extensive support personnel, their implementation has remained limited in forward environments, and they would be difficult, or impossible, to use in space flight or on battlefields. This paper presents experimental analysis of miniature fixed-base and mobile in vivo robots to support MIS surgery in remote and harsh environments. The objective is to develop wireless imaging and task-assisting robots that can be placed inside the abdominal cavity during surgery. Such robots will provide surgical task assistance and enable an on-site or remote surgeon to view the surgical environment from multiple angles. This approach is applicable to long-duration space flight, battlefield situations, and for traditional medical centers and other remote surgical locations.

Mobile robotic systems must sense constraints imposed by a dynamically changing environment and predictably react to those changes in real-time. Complexity arises in mobile robotic systems because the computing platform travels through the environment with which the system is interacting. These systems have spatio-temporal requirements in the sense that correct behavior is defined in terms of both space and time. The focus of this paper is mobile robotic platforms that must sense their environment and avoid obstacles as they navigate from one point to another. We present a design and analysis methodology for these platforms that integrates spatio-temporal attributes with fixed priority realtime scheduling through the use of zone and processing window abstractions. We propose an algorithm for adjustment of the processing window in order maximize the speed of the robot as it faces obstacles in the environment.

A mobile in vivo camera robot was developed to provide the ability for a single port biopsy procedure. Such a robot can be inserted into the abdominal cavity through a standard trocar. The surgeon controls the robot using visual feedback from the on-board camera. Measurements were made to identify the forces required to successfully biopsy in vivo tissue, including clamping and tearing forces. The robot design was developed around these parameters and the need to traverse the abdominal environment using specially designed wheels. This mobility allows the biopsy robot to move to the area of interest to sample specific tissues. The lead-screw linkage system that actuated the graspers allows for large force production through careful mechanical design. In vivo testing of this system in a porcine (pig) model has been successful. The robot is capable of traversing the entire in vivo abdominal environment and has successfully been used to biopsy hepatic tissue. In addition, experimental analysis of the biopsy mechanism shows good results towards more elaborate tissue manipulation in the future

Laparoscopy is abdominal surgery performed with long tools inserted through small incisions. The use of small incisions reduces patient trauma, but also eliminates the surgeon's ability to view and touch the surgical environment directly. These limitations generally restrict the application of laparoscopy to procedures less complex than those performed during open surgery. This paper presents a theoretical and experimental analysis of miniature, wheeled, in vivo robots to support laparoscopy. The objective is to develop a wireless mobile imaging robot that can be placed inside the abdominal cavity during surgery. Such robots will allow the surgeon to view the surgical environment from multiple angles. The motion of these in vivo robots will not be constrained by the insertion incisions. Simulation and experimental analyses have led to a wheel design that can attain good mobility performance in in vivo conditions

We present an autonomous, mobile, robotics application that requires dynamic adjustments of task execution rates to meet the demands of an unpredictable environment. The Robotic Safety Marker (RSM) system consists of one lead robot, the foreman, and a group of guided robots, called robotic safety markers (a.k.a., barrels). An extensive analysis is conducted of two applications running on the foreman. Both applications require adjusting task periods to achieve desired performance metrics with respect to the speed at which a system task is completed, the accuracy of RSM placement, or the number of RSMs controlled by the foreman. A static priority scheduling solution is proposed that takes into consideration the strict deadline requirements of some of the tasks and their dynamic periods. Finally, a schedulability analysis is developed that can be executed online to accommodate the dynamic performance requirements and to distinguish between safe operating points and potentially unsafe operating points.

The Cliff-bot system consists of three individual planetary rovers that work as a team to explore the surface of a cliff. Two of the rovers, designated “Anchor-bots”, assist the motion of a third rappelling “Cliff-bot” down and along a cliff face using tethers. A decentralized control technique is used to control the motion of the three rovers. The objective of this study is to develop several control algorithms that will create a robust and reliable Cliff-bot system. Control is accomplished by combining and prioritizing several different control algorithms into a hybrid deliberative-reactive control structure. Many different algorithms have been successfully developed and tested to provide the Cliff-bot system with stable and robust navigation of terrain slopes of at least 70 degrees.

We present the design and implementation of a real-time model for the global control of robotic highway safety markers. Problems addressed in the system are: 1) poor scalability and predictability as the number of markers increases, 2) jerky movement of markers, and 3) false-hits caused by environment objects. We extensively analyze the system and offer two solutions: a basic solution and an enhanced solution. They are built respectively upon two task models: the periodic task model and the variable rate execution task model. The former is characterized by four static parameters: phase, period, worst case execution time and relative deadline. The latter has similar parameters. Its parameter values, however, are allowed to change at arbitrary times. We then examine two typical real-time scheduling approaches: rate monotonic (RM) priority driven and earliest deadline first (EDF). Analysis of their sufficient conditions shows that our system is feasibly schedulable under either RM or EDF. This conclusion justifies that the path for each safety marker can be guaranteed to be smooth under the designed real-time system. For the scalability issue, we present a sufficient condition for the upper bound on the number of barrel robots that can be reliably controlled. One key technique integrated into our real-time system is the Hough transform. We refine its traditional implementation so that, for the task of detecting safety markers, the time complexity decreases and the reliability increases with only slight additional storage for search windows. The basic idea behind our improvements is to limit the search window for safety markers.

Dynamic voltage scaling (DVS) algorithms save energy by scaling down the processor frequency when the processor is not fully loaded. Many algorithms have been proposed for periodic and aperiodic task models but none support the canonical sporadic task model. A DVS algorithm, called DVSST, is presented that can be used with sporadic tasks in conjunction with preemptive EDF scheduling. The algorithm is proven to guarantee each tasks meets its deadline while saving the maximum amount of energy possible with processor frequency scaling. DVSST was implemented in the /spl mu/C/OS-II real-time operating system for embedded systems and its overhead was measured using a stand-alone Rabbit 2000 test board. Though theoretically optimal, the actual power savings realized with DVSST is a function of the sporadic task set and the processor's DVS support. It is shown that the DVSST algorithm achieves 83% of the theoretical power savings for a robotic highway safety marker real-time application. The difference between the theoretical power savings and the actual power savings is due to the limited number of frequency levels the Rabbit 2000 processor supports.

We have developed a cliff robot that is capable of descending a cliff and autonomously navigating to way-points on the cliff wall. This aggressive mobility system consists of an ensemble of three tethered robots, which cooperate under tight coordinated control and collective state estimation. The distributed task is described as a behavior network, which consists of a network of controllers spread across the robots and which interact through communication links to achieve a collective control objective. Fielded experimental results show that the cliff robot is capable of navigating to designated way-points on a cliff wall using the proposed control scheme.

This paper presents the application of an action module planning method to an experimental climbing robot named LIBRA. The method searches for a sequence of physically realizable actions, called action modules, to produce a plan for a given task. The search is performed with a hierarchical selection process that uses task and configuration filters to reduce the action module inventory to a reasonable search space. Then, a genetic algorithm search finds a sequence of actions that allows the robot to complete the task without violating any physical constraints. The results for the LIBRA climbing robot show the method is able to produce effective plans.

Recently a planetary rover returned important scientific information from Mars. More ambitious missions are planned. New planning methods are required that allow rovers to explore challenging areas with a high level of autonomy. This paper presents a planning methodology based on a physics-based model of the rover and environment. Plans are developed that allow a rover to perform a mission while explicitly considering constraints such as power, actuator, wheel slip, and vehicle stability limits. Results obtained from detailed rover simulations are presented.

Long development times and high costs prevent robots from being practical for use in many important field missions. Here a modular design approach is proposed to produce a rapidly deployable low cost field robotic system. An inventory of components such as actuated joints, links, power supplies, and software modules are assembled to produce a field robotic system for a specified task. The proposed design method uses a hierarchical selection process combined with a genetic algorithm to select a robot configuration and action plan for a given task. This method is applied to an inspection task required for the preservation of the USS Constitution, an historic naval ship.