HAL Id: hal-00768527
https://hal.inria.fr/hal-00768527
Submitted on 21 Dec 2012
HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entic research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diusion de documents
scientiques de niveau recherche, publiés ou non,
émanant des établissements d’enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.
Provably Safe Navigation for Mobile Robots with
Limited Field-of-Views in Unknown Dynamic
Environments
Sara Bouraine, Thierry Fraichard, Hassen Salhi
To cite this version:
Sara Bouraine, Thierry Fraichard, Hassen Salhi. Provably Safe Navigation for Mobile Robots with
Limited Field-of-Views in Unknown Dynamic Environments. ICRA 2012 - IEEE International
Conference on Robotics and Automation, May 2012, Saint Paul, MN, United States. pp.174-179,
�10.1109/ICRA.2012.6224932�. �hal-00768527�
Provably Safe Navigation for Mobile Robots
with Limited Field-of-Views in Unknown Dynamic Environments
Sara Bouraine
†
and Thierry Fraichard
‡
and Hassen Salhi
?
Abstract— This paper addresses the problem of navigating
a mobile robot with a limited field-of-view in a unknown
dynamic environment. In such a situation, absolute motion
safety, i.e. such that no collision will ever take place whatever
happens, is impossible to guarantee. It is therefore settled for
a weaker level of motion safety dubbed passive motion safety:
it guarantees that, if a collision takes place, the robot will be
at rest. Passive motion safety is tackled using a variant of the
Inevitable Collision State (ICS) concept called Braking ICS,
i.e. states such that, whatever the future braking trajectory
of the robot, a collision occurs before it is at rest. Passive
motion safety is readily obtained by avoiding Braking ICS at all
times. Building upon an existing Braking ICS-Checker, i.e. an
algorithm that checks if a given state is a Braking ICS or not,
this paper presents a reactive collision avoidance scheme called
PASSAVOID. The main contribution of this paper is the formal
proof of PASSAVOID’s passive motion safety. Experiments in
simulation demonstrates how PASSAVOID operates.
I. INTRODUCTION
Robotics technology has matured and Autonomous
Ground Vehicles are becoming a reality. However such
systems remains prone to accidents (see [7]). The liter-
ature review of §II shows that the Robotics community
is displaying a growing interest in designing navigation
schemes for which motion safety can be characterized or
even guaranteed (see the 2012 special issue of Autonomous
Robots on Guaranteeing Motion Safety for Robots). It also
shows that motion safety in the real world remains an open
problem as soon as the term real world implies that:
1) The environment features both fixed and moving ob-
jects whose future behaviour is unknown.
2) The robot has only a partial knowledge of its surround-
ings because of its sensory limitations.
The purpose of this paper is precisely to address such
problems. It can be argued that absolute motion safety
is impossible to guarantee in general unless questionable
assumptions concerning the robot and its environment are
made, e.g. requiring that the velocity of the robot is a multiple
of the maximum velocity of the objects [16], or that the
moving objects should appear beyond a distance which is a
function of their number, sizes and velocities [14]. To cope
with that issue, the position taken in this work is: better
guarantee less than guarantee nothing. To that end, it is
settled for a weaker level of motion safety that guarantees
that, if a collision takes place, the robot will be at rest. As
per [17], this motion safety level is dubbed passive motion
safety. As limited as it may appear at first sight, passive
†
CDTA (AL);
‡
INRIA (FR);
?
Blida Univ. (AL).
Journal article [4] combines [3] and this paper.
motion safety is interesting for two reasons: (1) it allows to
provide at least one form of motion safety guarantee in the
challenging scenarios considered and more important (2) if
every moving object in the environment enforces it then
no collision ever take place at all. The central idea behind
passive motion safety, i.e. using braking trajectories, is not
new, it has been used before in different contexts (see §II).
However, to the best of the authors’ knowledge, it is the first
time it is given a formal treatment in as general a context as
possible whether it concerns the robot’s dynamics, its field-
of-view, or the knowledge (or lack thereof) about the future
behaviour of the moving objects.
Passive motion safety is tackled herein using a variant
of the Inevitable Collision State (ICS) concept [10] called
Braking ICS, i.e. states such that, whatever the future braking
trajectory followed by the robot, a collision occurs before
it is at rest. Passive motion safety is readily obtained by
avoiding Braking ICS at all times. Braking ICS have been
introduced by the authors of this paper in [3] along with
a Braking ICS-Checker, i.e. an algorithm that determines
whether a given state is a Braking ICS or not. To validate
the Braking ICS concept and demonstrate its usefulness, the
Braking ICS-Checker of [3] is integrated here in a reactive
collision avoidance scheme (henceforth called PASSAVOID)
for a mobile robot with a limited field-of-view placed in
an unknown dynamic environment. It operates with a given
time step and its purpose is to compute the control that
will be applied to the robot at the next time step. The
main contribution of this paper is the formal proof of
PASSAVOID’s passive motion safety: it is guaranteed that the
robot will always avoid Braking ICS no matter what happens
in the environment.
The paper is organized as follows: a review of the relevant
literature is done in §II while the problem addressed is
defined in §III. PASSAVOID is then detailed in §IV, the proof
of its passive motion safety is established there along with the
proof that if every moving object enforces it then no collision
ever take place. Finally, experimental results obtained in
simulation are presented in §V.
II. RELATED WORKS
As mentioned above, the Robotics literature is teeming
with works concerned with collision avoidance but most
of them do not offer an explicit formulation of the safety
guarantees they provide or the conditions under which they
must operate (see [9]). The earliest relevant works addressed
the so-called “Asteroid Avoidance Problem”: in 3D, [20]
shows that collision avoidance is always possible if the
robot’s velocity is greater than the asteroids’ velocities. In
2D, [14] shows that collision avoidance is always possible
iff the asteroids appear beyond a “threat horizon”. Likewise,
[16] shows that, for a 2D robot among arbitrarily moving
objects, collision-avoidance is guaranteed iff the maximum
velocity of the robot is a multiple of the maximum velocity
of the objects. Such results are very interesting. Unfortu-
nately, they rely on assumptions that rarely occur in the
real world. A related family of research works are those
seeking to coordinate the motion of a set of robots. Dif-
ferent distributed coordination schemes have been proposed
for which collision avoidance is guaranteed, e.g. [2], [15].
However, this guarantee is lost if the environment contains
uncontrolled moving objects. General motion safety issues
have been studied thanks to the Inevitable Collision States
(ICS) concept developed in [10]. An ICS is a state for which,
no matter what the future trajectory of the robot is, a collision
eventually occurs. ICS provides insight into the complexity
of guaranteeing motion safety since it shows that it requires
to reason about the future evolution of the environment and
to do so with an appropriate lookahead
1
that can possibly be
infinite. Such conditions being next to impossible to obtain in
the real world plus the fact that ICS characterization is very
complex has led a number of authors to consider relaxations
of ICS such as:
• ICS approximation, e.g. [13]: such approximations be-
ing not conservative, the motion safety guarantee is lost.
• τ-Safety, e.g. [11]: the robot is guaranteed to remain in
states where it is safe for a given duration (hopefully
sufficient to compute an updated safe trajectory. . . ).
• Evasive trajectories, e.g. [12]: they guarantee that the
robot can only be in states where it is possible to execute
an evasive trajectory, e.g. a braking manoeuvre for a car
or a circling manoeuvre for a plane.
Recently, authors have proposed probabilistic versions of the
ICS concept, e.g. [1], so as to better capture the uncertainty
that prevails in real world situations. These approaches are
interesting but offer no strict motion safety guarantees since
probabilistic models are used. There are a few research
works taking into account sensory limitations. For instance,
the occlusion problem, i.e. the existence of regions that
are hidden by other objects, is addressed in [21] and [5].
The occlusion and the limited field-of-view problems are
addressed in [10] and [18].
The contribution of this paper is an extension of [17] that
deals with limited field-of-views, occlusions and unknown
future behaviour of the objects. The approach proposed is
based upon a relaxation of ICS that falls into the “evasive
trajectories” family.
III. STATEMENT OF THE PROBLEM
Let A denote the mobile robot at hand. It operates in
a 2D workspace W. Its motion is governed by differential
equations of the form:
˙s = f(s, u) subject to g(s, ˙s) ≤ 0 (1)
1
I.e. how far into the future the reasoning is done.
Fig. 1. Robot with a limited field-of-view (left) and its corresponding
planar field-of-view FOV (right).
where s ∈ S is the state of A, ˙s its time derivative and u ∈ U
a control. S and U respectively denote the state space and
the control space of A. Let A(s) denote the closed subset
of the workspace W occupied by A when it is in s.
Let ˜u : [0, t
f
] −→ U denote a control trajectory, i.e. a
time-sequence of controls, t
f
is the duration of ˜u. The set
of all possible control trajectories is denoted
˜
U. Starting from
an initial state s
0
at time 0, a state trajectory ˜s, i.e. a time-
sequence of states, is derived from a control trajectory ˜u by
integrating (1); ˜s(s
0
, ˜u, t) denotes the state reached at time
t. A control trajectory ˜u
b
∈
˜
U such that ˜s
b
(s
0
, ˜u
b
, t
b
) is a
state where A comes to a halt (and remains so) is a braking
trajectory for s
0
and t
b
is its braking time. The set of all
possible braking trajectories for s
0
is denoted
˜
U
s
0
b
.
Assuming that A is equipped with range sensors such as
laser telemeters or range cameras, it can only perceive a
subset of W; this subset is A’s field-of-view; its shape is
arbitrary. It is henceforth denoted FOV. Accordingly, W is
partitioned in three subsets: (1) FOV, (2) FOV
c
, the part
which is unseen (FOV
c
= W \ cl(FOV)) and (3) ∂FOV,
the boundary between the two. Both FOV and FOV
c
are
open sets. It seems reasonable to assume that A is “looking
around itself”; in other words that A(s) ⊂ FOV where A(s)
denotes the region of W occupied by A when it is in s. To
account for the existence of 3D range sensors, e.g. Velodyne
LIDAR, FOV can contain holes representing objects entirely
perceived by the sensory system of A. Accordingly, ∂FOV
and FOV
c
are not necessarily singly connected (see Fig. 1).
FOV represents the region of W which is free of objects
at the sensing time while ∂FOV ∪ FOV
c
represent objects
(fixed or moving, seen and unseen). Recall that motion safety
requires reasoning about the future motion of the objects
in the environment. The model of the future used herein
is conservative: it is assumed that A cannot distinguish the
fixed from the moving objects (hence every object observed
is treated as a potentially moving object), and that it has
no information whatsoever about their future behaviour.
Accordingly, given an upper-bound on the velocity of the
objects, every point in ∂FOV ∪ FOV
C
d is modeled as a disc
that grows as time passes, i.e. a cone in space×time (see [3]).
IV. PASSIVELY SAFE NAVIGATION
A. Braking ICS
Ref. [3] introduces a relaxation of the original ICS concept
called Braking ICS. A Braking ICS (henceforth denoted
ICS
b
) is a state for which, no matter what the future
trajectory of the robot is, it is impossible to stop before a
collision takes place. Braking ICS and passive safety are
two dual concepts: a state which is not a Braking ICS is
p-safe. An efficient Braking ICS-Checker (henceforth called
ICS
b
-CHECK) is also presented in [3], it checks whether a
given state is a Braking ICS or not for a given model of the
future.
B. PASSAVOID
In order to demonstrate passive motion safety and to
validate the Braking ICS concept, a navigation scheme
(henceforth called PASSAVOID) has been developed for a
mobile robot A with a limited field-of-view placed in a
unknown dynamic environment. PASSAVOID’s primary task
is to keep A in p-safe states, or equivalently, to drive A
away from Braking ICS. PASSAVOID guarantees passive
motion safety no matter what happens in the environment. In
other words, if a collision takes place, it is guaranteed that
A will be at rest when it occurs. PASSAVOID relies upon
ICS
b
-CHECK to operate. It is a reactive navigation scheme
that operates with a given time step δt. At each time step,
its purpose is to compute the constant control u that will be
applied to A during the next time step; u must be admissible,
i.e. the corresponding state trajectory must be p-safe (in other
words, it must be ICS
b
-free).
PASSAVOID operates like most standard reactive collision
avoidance schemes, (e.g. [6], [8]). In all cases, their operating
principle is to first characterize forbidden regions in a given
control space and then select an admissible control, i.e. one
which is not forbidden. Accordingly collision avoidance also
depends on the ability of the collision avoidance scheme at
hand to find such an admissible control. In the absence of a
formal characterization of the forbidden regions, all schemes
resort to some form of sampling of the control space with the
inherent risk of missing the admissible regions. PASSAVOID
also resorts to sampling in order to find an admissible con-
trol. However, in contrast with standard collision avoidance
schemes, PASSAVOID is designed in such a way that it is
guaranteed that, if an admissible control exists, it will be
part of the sampling set.
Fig. 2. PASSAVOID’s operating principle (left), and example of a δ-braking
trajectory (right).
The operating principle of PASSAVOID is illustrated in
Fig. 2. Let s
0
denote the current state of A and U a sampled
set of controls: U = {u
1
. . . u
m
}. A given control u
j
∈ U is
applied to A for a duration δt. It takes A from the state s
0
to
the state s
j
= ˜s(s
0
, u
j
, δt). If the state trajectory between s
0
and s
j
is p-safe then u
j
is admissible. Using the Sufficient
Safety Condition established in [19], the admissibility of u
j
can equivalently be verified by checking that (1) the state
trajectory between s
0
and s
j
is collision-free (with respect to
the model of the future), and that (2) s
j
is p-safe, i.e. it is not
a Braking ICS. This procedure is applied for every control
in U ; it yields a set of admissible controls denoted U
∗
from
which PASSAVOID can pick the control to apply during the
next time step. This selection can be made arbitrarily if one
is only concerned with the survival of A or it can be made
so as to ensure convergence towards a given goal (using for
instance a global navigation function, a potential field, or
even a partial motion planning scheme).
Such a scheme works well as long as an admissible control
can be found in U. But if, at the end of the day, U
∗
is empty,
it means that every control in U takes A to a Braking ICS. In
other words, passive motion safety will not be achieved and
a collision will take place while A is still moving. To address
this issue, it is necessary to guarantee that U = {u
1
. . . u
m
}
contains at least one admissible control. It is possible to
achieve this by carefully designing PASSAVOID. To that end,
a number of definitions and properties are required. They are
introduced now. The concepts of δ-braking trajectory and δ-
passive safety are defined first. They are just specific types
of braking trajectory and passive safety:
Def. 1 (δ-Braking Trajectory): A braking trajectory ˜u
∗
∈
˜
U
s
0
b
of duration t
∗
is a δ-braking trajectory if it is constant
over intervals of fixed duration δt.
A δ-braking trajectory is just a special type of braking
trajectory (see Fig. 2). It yields a corresponding type of
passive motion safety:
Def. 2 (δ-Passive Safety): A state s
0
is δ-passively safe or
δ-p-safe if it exists one δ-braking trajectory ˜u
∗
starting at s
0
which is collision-free until A has stopped.
Then two useful properties are established:
Property 1 (P-Safe States): If the state s
0
is p-safe and
the braking trajectory ˜u
b
∈
˜
U
s
0
b
starting at s
0
is collision-free
until A has stopped then every state ˜s(s
0
, ˜u
j
, t), 0 < t ≤ t
b
is also p-safe.
Proof: Suppose that ∃t
i
∈]0, t
b
] such that ˜s(s
0
, ˜u
b
, t
i
)
is not p-safe then, by definition, ∀˜u
j
∈
˜
U
s
i
b
, ˜u
j
yields a
collision before A stops. This also applies to the braking
trajectory corresponding to the restriction of ˜u
b
to the time
interval [t
i
, t
b
] which yields a contradiction.
Note that Property 1 also applies to δ-p-safe states.
Property 2 (δ-Passive Safety Guarantee): If the state s
0
is δ-p-safe then there exists at least one admissible control
u
∗
that PASSAVOID can use to drive A to a state which is
also δ-p-safe.
Proof: Since s
0
is δ-p-safe, there exists at least a one
δ-braking trajectory ˜u
∗
starting at s
0
which is collision-free
until A has stopped. As per Property 1, the state ˜s(s
0
, ˜u
∗
, δt)
is δ-p-safe. Let u
∗
denote the value of ˜u
∗
over the time
interval [0, δt[, u
∗
is an admissible control.
Property 2 is fundamental for the design of a version of
PASSAVOID whose passive motion safety can be guaranteed.
PASSAVOID simply has to drive A from one δ-p-safe state
to the next. Now, assuming that s
0
is δ-p-safe, property 2
Algorithm 1: PASSAVOID.
Input: s
0
, the current δ-p-safe state of A; δt, the time
step; model of the future.
Output: u
Sample U ; U = {u
1
. . . u
m
}// [1
]Select the control space sampling set U2
U
∗
= K(s
0
); // Initialize adm. controls3
forall u
j
∈ U ; // Compute adm. controls4
do5
s(δt) = ˜s(s
0
, u
j
, δt);6
if ˜s(s
0
, u
j
, [0, δt[) is collision-free and s(δt) is7
δ-p-safe then
U
∗
= U
∗
∪ {u
j
}; // u
j
admissible8
end9
end10
// Select and return one adm. control
Select u ∈ U
∗
;11
return u;12
guarantees the existence of at least one admissible control
u
∗
which, if applied to A for the duration δt, will take it
to another δ-p-safe state. In general, a δ-p-safe state s has
more than one admissible control. Let K(s) denote this set
of admissible controls, it is dubbed the kernel K(s). Now,
in order to guarantee its passive motion safety, PASSAVOID
must include K(s
0
) in its control space sampling set. This
is precisely what PASSAVOID does (see Algorithm 1, line
#2). PASSAVOID features two important steps: computing the
kernel K(s
0
) (line #2) and checking whether the state s(δt)
is δ-p-safe (line #6). It turns out that these two procedures
are related and can be done by a straightforward adaptation
of ICS
b
-CHECK which is not detailed here due to lack of
space (see [4]).
Now, provided that the initial state of the system A is δ-
p-safe, Property 2 allows PASSAVOID to have at its disposal
at each time step an admissible control that can be used
to drive A from one δ-p-safe state to the next (forever if
need be). Concerning the assumption on the initial state
being δ-p-safe, it is satisfied when A is at rest, and the null
control is admissible. In other words, starting with A at rest,
PASSAVOID has an admissible control readily available that
can be used right away if the situation demands it (this is true
even if δt is very small). At the end of the day, PASSAVOID
is provably passively safe in the sense that it is guaranteed
that A will always stay away from Braking ICS no matter
what happens in the environment.
C. Passively Safe Multi-Robot Navigation
In the introduction, it was stated that, if every moving
object in a given environment was passively safe, then no
collision should take place at all. It turns out that this
property is straightforward to demonstrate. Let A
1
and A
2
denote two robots that are driven by a provably passively safe
navigation scheme such as PASSAVOID. As per Properties 1
and 2, both A
1
and A
2
are in a δ-p-safe state at all times.
In other words, the following holds:
∀t, s
1
(t) 6∈ ICS
b
1
and s
2
(t) 6∈ ICS
b
2
(2)
where s
i
(t) and ICS
b
i
respectively denote the state at time t
and the corresponding Braking ICS set for robot A
i
, i = 1, 2.
Assuming that a collision can take place between A
1
and
A
2
with one of them having a non zero velocity yields a
contradiction. It cannot happen.
V. SIMULATION RESULTS
To validate the Braking ICS concept and demonstrate its
usefulness, ICS
b
-CHECK and PASSAVOID have both been
implemented and tested in simulation.
A. Model of the Robot
The model of A is that of a standard car-like vehicle with
two fixed rear wheels and two orientable front wheels. A
state of A is a 5-tuple s = (x, y, θ, v, ξ) with (x, y) the
coordinates of the rear axle midpoint, θ the orientation of
A, v the linear velocity of system, and ξ the orientation
of the front wheels (steering angle). A control of A is a
couple u = (u
α
, u
ξ
) with u
α
the linear acceleration of the
rear wheels and u
ξ
the steering angle velocity. Let L denote
the wheelbase of A. The motion of A is governed by the
following differential equations:
˙x
˙y
˙
θ
˙v
˙
ξ
=
v cos θ
v sin θ
v tan ξ/L
0
0
+
0
0
0
1
0
u
α
+
0
0
0
0
1
u
ξ
(3)
with |v| ≤ v
max
, |ξ| ≤ ξ
max
, |u
α
| ≤ u
α
max
and |u
ξ
| ≤ u
ξ
max
.
B. PASSAVOID at Work
To illustrate how PASSAVOID works, two scenarios have
been selected. The first one is called the 1D Compactor
scenario, it is simple but it helps to understand the kind of
behaviour that PASSAVOID will yield when A is confronted
to a clearly identified dangerous situation. The second one
is called the Blind Crowd scenario; its primary purpose is
to illustrate the performances of PASSAVOID in complex
situations. The results obtained are also illustrated in a short
film provided as a multimedia attachment to this paper
2
. In
both cases, PASSAVOID had no information regarding the
future trajectories of the moving objects. PASSAVOID did not
attempt to drive A to a given goal. Its primary purpose was to
keep A in p-safe states. Its secondary purpose was to keep A
moving. In other words, the admissible control selection (line
#10 of Algorithm 1) was biased towards controls yielding
a non-zero linear velocity. This choice was made so as to
avoid the straightforward answer to the passive motion safety
problem which is simply to brake down and stop forever (by
doing so, A reaches and stays in a p-safe state).
