SPIN-Based Linear Temporal Logic Path Planning for Ground Vehicle Missions with Motion Constraints on Digital Elevation Models

Abstract

Linear temporal logic (LTL) formalism can ensure the correctness of mobile robot planning through concise, readable, and verifiable mission specifications. For uneven terrain, planning must consider motion constraints related to asymmetric slope traversability and maneuverability. However, even though model checker tools like the open-source Simple Promela Interpreter (SPIN) include search optimization techniques to address the state explosion problem, defining a global LTL property that encompasses both mission specifications and motion constraints on digital elevation models (DEMs) can lead to complex models and high computation times. In this article, we propose a system model that incorporates a set of uncrewed ground vehicle (UGV) motion constraints, allowing these constraints to be omitted from LTL model checking. This model is used in the LTL synthesizer for path planning, where an LTL property describes only the mission specification. Furthermore, we present a specific parameterization for path planning synthesis using a SPIN. We also offer two SPIN-efficient general LTL formulas for representative UGV missions to reach a DEM partition set, with a specified or unspecified order, respectively. Validation experiments performed on synthetic and real-world DEMs demonstrate the feasibility of the framework for complex mission specifications on DEMs, achieving a significant reduction in computation cost compared to a baseline approach that includes a global LTL property, even when applying appropriate search optimization techniques on both path planners.

1. Introduction

Formally guaranteeing correctness [1] is crucial for synthesizing effective controllers for complex time-critical ground vehicle missions in applications such as disaster, agriculture, and planetary robotics. Moreover, manageable mission specifications for mobile robots must be concise, human readable, and checkable [2], which requires coping with the incompleteness, ambiguity, and inconsistency of informal human descriptions [3]. Linear temporal logic (LTL) offers a modal formalism that allows describing system properties over linear time using propositional and temporal logical operators [4] with a close relation to natural language, and thus to human reasoning [5]. Furthermore, a system whose properties are expressed by LTL formulas can be formally verified by LTL model checking [3].

Previous works have exploited these qualities of LTL for synthesizing controllers for robotic missions. For instance, [6] developed a framework for controlling linear systems using LTL specifications, extending the LTL controller synthesis from the discrete to continuous domain. In another study, ref. [7] proposed an LTL formula for specifying user-defined high-level behaviors for robots that can react to dynamic environment information. Additionally, ref. [8] extended LTL to simulate collaborative multi-robot environments, emphasizing localization and coordination among robots. Other works have addressed uncertain environments by synthesizing reactive controllers that update obstacle information from sensors during navigation. Thus, ref. [9] developed reactive controllers to manage unpredictable conditions to improve adaptability. Moreover, ref. [10] focused on dynamic updates for synthesized controllers, enhancing system robustness in uncertain environments. In general, these control approaches benefit from LTL specifications, which ensure that the desired task is accomplished if it is feasible.

These properties of LTL have been leveraged in other works to incorporate constraints for deliberative path planning. Thus, ref. [11] studied motion coordination for data gathered through communication and buffer constraints where the high level mission specification for the multi-robot team is performed in LTL. In this sense, ref. [12] analyzed inter-task dependencies, which are crucial for the efficiency of multi-robot systems in coordinated tasks. Recent works have addressed different aspects of environment complexity. In [13], two-dimensional (2D) cells were categorized into five levels of terrain cost for a path planning method for a planetary rover, considering factors such as remaining charge, obstacles, illumination, and communication conditions. Moreover, the T* algorithm [14] is an LTL path planner that uses A* opportunistically to generate an optimal trajectory satisfying a temporal logic formula in a 2D environment. In [15], LTL is used to specify mission requirements for sampling-based path planning using a multi-layered framework that can be suitable for complex environments. In [16], a high-level task planner for bipedal robots used LTL to perform reactive game synthesis between the robot and a dynamic environment with stairs leading to a higher platform. Nevertheless, these works primarily used 2D representations of the environment, so uneven terrain constraints were not explicitly considered. To the best of our knowledge, no previous work has addressed LTL path planning for high-level robot missions on digital elevation models (DEMs).

In general, a single generalized LTL formula for synthesizing a robot controller can integrate both the desired robot behavior and the assumptions about the environment [7,8,10]. However, the implementation of this powerful LTL expressiveness with software tools such as a Simple Promela Interpreter (SPIN) [17] or the Temporal Logic Planning (TuLiP) toolbox [18] can suffer from the state-space explosion problem [17]. The work in [19] addressed scalability for task allocation with multiple heterogeneous robots from a global LTL specification, but individual path planning is performed at a lower level. Furthermore, ref. [20] reduced the computation time of the path planning by modeling robot mobility as an abstract weighted transition system.

In this article, we propose a SPIN-based LTL path planning approach for uncrewed ground vehicle (UGV) missions on uneven terrain by defining a system model that includes motion constraints and performing model checking of the mission specification’s LTL property. Since UGV motion constraints for the DEM are incorporated into the system model, they can be omitted from LTL model checking for path planning according to the mission specification. Moreover, we define two SPIN-efficient general LTL formulas for representative UGV missions to reach goals in a specified order or an unspecified order, respectively. The proposed planner is implemented using the open-source model checker SPIN with customized search optimization parameters. Validation experiments conducted on synthetic and real-world DEMs demonstrate the feasibility of the LTL path planning framework for complex mission specifications, achieving a significant reduction in computation cost compared to a SPIN-based baseline approach that considers a global LTL property including both motion constraints and mission specification.

The main contributions of this work are as follows:

• The definition of a system model as a transition system that includes UGV asymmetric slope traversability and maneuverability on uneven terrains represented as DEMs.
• A SPIN-based LTL path planner for UGV missions with customized parameterization for effective search optimization. This LTL planner uses the system model and an LTL property that defines only the UGV mission specification based on DEM goals.
• Two general LTL formulas for specifying two types of UGV missions to reach a DEM partition set, either in a specified order or an unspecified order. These formulas use the until operator, which enables efficient SPIN state-space exploration.

The remainder of the article is organized as follows. Section 2 reviews LTL concepts for path planning, fulfilling mission specifications. Section 3 proposes the design of the LTL-based path planner for UGV missions on uneven DEMSs. Section 4 describes the experimental methodology. Section 5 discusses the experimental results. Finally, Section 6 offers conclusions and ideas for future work.

2. Review of LTL Concepts

This section reviews fundamental concepts of LTL, model checking, and LTL path planning for high-level UGV missions.

2.1. Linear Temporal Logic

Linear temporal logic (LTL) is a logical formalism that expresses the behavior of a reactive system over linear time, i.e., the relative order of events. The basic elements of LTL are a set of atomic propositions $\Pi$, and Boolean and temporal operators. An atomic proposition $\pi \in \Pi$ is a statement or assertion that must be true or false.

A well-formed LTL formula $\varphi$ is a finite sequence of symbols satisfying the following grammar:

$$\varphi ::= \pi |\neg \varphi |{\varphi }_1\vee {\varphi }_2\left|◯\varphi \right|{\varphi }_1\mathcal{U}{\varphi }_2,$$

(1)

where $\neg$ and $\vee$ are Boolean operators for negation and disjunction, respectively, and $◯$ and $\mathcal{U}$ are the temporal operators next and until, respectively. This grammar allows defining other LTL derived operators such as the following:

$$\begin{array}{ccc}\hfill \top (\mathrm{or}\mathrm{true})& \stackrel{\mathrm{def}}{=}& \hfill \varphi \vee \neg \varphi ,\hfill \\ \hfill \perp (\mathrm{or}\mathrm{false})& \stackrel{\mathrm{def}}{=}& \hfill \neg \top ,\hfill \\ \hfill {\varphi }_1\wedge {\varphi }_2& \stackrel{\mathrm{def}}{=}& \hfill \neg \left(\neg {\varphi }_1\vee \neg {\varphi }_2\right),\hfill \\ \hfill ◊\varphi & \stackrel{\mathrm{def}}{=}& \hfill \top \mathcal{U}\varphi ,\hfill \\ \hfill \square \varphi & \stackrel{\mathrm{def}}{=}& \hfill \neg ◊\neg \varphi ,\hfill \end{array}$$

(2)

where $\wedge$ denotes conjunction, and $◊$ and $-\square$ are the temporal operators eventually and always, respectively. Unitary operators have the highest precedence, and $\mathcal{U}$ takes precedence over other binary operators and is left-associative, e.g., ${\varphi }_1\mathcal{U}{\varphi }_2\mathcal{U}{\varphi }_3$ stands for $\left({\varphi }_1\mathcal{U}{\varphi }_2\right)\mathcal{U}{\varphi }_3$.

The semantics of $\varphi$ are defined over infinite traces. A trace $\sigma$ is a sequence $\sigma ={\sigma }_1{\sigma }_2\cdots$ of truth assignments to $\Pi$, where ${\sigma }_i\subset \Pi$. A suffix trace is defined as $\sigma \left(i\right)={\sigma }_i{\sigma }_{i+1}\cdots$; thus, $\sigma =\sigma \left(1\right)$. For a given trace $\sigma$, the notation $\sigma \vDash \varphi$ denotes that $\sigma$ satisfies $\varphi$. The satisfaction relationship ⊧ between $\sigma \left(i\right)$ and $\varphi$ is defined as follows:

$$\begin{array}{cc}\hfill \sigma \left(i\right)\vDash \pi \hfill & \hfill \mathrm{iff}\pi \in \sigma {\left(i\right)}_1,\hfill \\ \hfill \sigma \left(i\right)\vDash \neg \varphi \hfill & \hfill \mathrm{iff}\sigma \left(i\right) /\vDash \varphi ,\hfill \\ \hfill \sigma \left(i\right)\vDash {\varphi }_1\vee {\varphi }_2\hfill & \hfill \mathrm{iff}\sigma \left(i\right)\vDash {\varphi }_1\mathrm{or}\sigma \left(i\right)\vDash {\varphi }_2,\hfill \\ \hfill \sigma \left(i\right)\vDash ◯\varphi \hfill & \hfill \mathrm{iff}\sigma (i+1)\vDash \varphi ,\hfill \\ \hfill \sigma \left(i\right)\vDash {\varphi }_1\mathcal{U}{\varphi }_2\hfill & \hfill \mathrm{iff}\exists k>i,\sigma \left(k\right)\vDash {\varphi }_2\mathrm{and}\hfill \\ \hfill \hfill & \hfill \forall (i\le j<k),\sigma \left(j\right)\vDash {\varphi }_1.\hfill \end{array}$$

(3)

2.2. LTL Model Checking

Formal model checking systematically checks whether a formal specification property $\varphi$ is satisfied for a system model ${\mathcal{A}}_S$ defined as a transition system without terminal states. In LTL model checking, the states of this system are defined from $\Pi$, and $\varphi$ as a deterministic finite automaton ${\mathcal{A}}_{\neg \varphi }$ with accepting states that recognizes the language $\mathcal{L}\left({\mathcal{A}}_{\neg \varphi }\right)$ formed by the set of non-admissible traces. Since LTL semantics are defined over traces, model checking is reduced to a reachability problem in the product automaton ${\mathcal{A}}_S\otimes {\mathcal{A}}_{\neg \varphi }$. Then,

$${\mathcal{A}}_S\vDash \varphi \mathrm{iff}\mathrm{finite}\_\mathrm{traces}\left({\mathcal{A}}_S\right)\cap \mathcal{L}\left({\mathcal{A}}_{\neg \varphi }\right)=⌀,$$

(4)

i.e., the correctness of ${\mathcal{A}}_S$ is verified with respect to $\varphi$ if and only if there is no intersection between the finite traces of ${\mathcal{A}}_S$ and $\mathcal{L}\left({\mathcal{A}}_{\neg \varphi }\right)$.

Model checker tools, such as the Uppsala-Aalborg (Uppaal) suite [21], the New Symbolic Model Verifier (NuSMV) [22], TuLiP [18], or SPIN [23], automatically determine whether the model truly satisfies a given property. When the property is not fulfilled, they provide a counterexample trace, i.e, an ${\mathcal{A}}_S$ execution path that reaches an undesired state.

Even if model checking has a sound mathematical foundation based on graph theory, data structures, and logic, model checkers suffer from the state-space explosion problem when the number of states needed to accurately model realistic systems or complex properties exceeds available computer memory [17].

SPIN offers features to cope with the state-space explosion and, starting from version 6.5.0, allows the conversion of LTL formulas of arbitrary length. In particular, SPIN includes search optimization techniques [17,24] to reduce the following: (i) The number of explored states; (ii) The memory required. To reduce the number of explored states, SPIN introduces partial order reduction and statement merging (atomic and deterministic step sequences). For memory reduction, SPIN includes the following state vector compression methods:

• Lossless (collapse compression and minimized finite state recognizer), which preserve exhaustive verification capability at the cost of increased runtime requirements.
• Lossy (bitstate hashing and hash-compact methods) to further reduce memory requirements. However, this approach does not guarantee exhaustive verification, which may result in a suboptimal solution.

SPIN supports Promela (acronym for Process Meta Language), a high-level language for modeling system and LTL properties. Promela is a C-like meta-language with very limited expressiveness in order for verification to be efficient, and supports embedded C-code as part of the model specification.

2.3. LTL Path Planning for High-Level UGV Missions

Path planning for high-level UGV missions determines a motion sequence that a UGV must aim to fulfill a given mission specification. This specification can be formulated as an LTL property $\varphi$, describing the order or frequency (eventually or infinitely often) in which truth assignments to atomic propositions in $\Pi$ must occur for a correct mission execution.

LTL path planning for high-level UGV missions is a decision-making process through a nondeterministic ${\mathcal{A}}_S$ using a model checker for $\neg \varphi$ [25]. The nondeterministic transitions of ${\mathcal{A}}_S$ correspond to UGV motions limited by the neighborhood (typically, four neighbors) regardless of the mission. The model checker searches for a counterexample trace $\sigma \vDash \varphi$ that, by not satisfying $\neg \varphi$, fulfills the given LTL property $\varphi$. Thus, the transitions that produce $\sigma$ define the UGV motion sequence that satisfies the specified mission.

3. DEM-Based LTL Path Planning for High-Level UGV Missions

This section presents the core methodology of our framework, detailing the design of the LTL-based path planner for UGV missions on uneven terrains. First, we introduce the definition of the system model according to motion constraints. Next, the SPIN-efficient general LTL formulas designed for high-level UGV missions are proposed. Then, we describe the workflow of LTL model checking using the SPIN tool, emphasizing the optimization techniques employed to cope with state-space explosion. Finally, the section concludes with the interpretation of the LTL model checking results for path planning for UGV mission on DEMs.

3.1. System Model According to Motion Constraints

In this paper, we address path planning for UGV missions on uneven terrains that can be modeled as a DEM, which can be represented by a matrix $Z\in {\mathcal{M}}_{n\times m}\left(\mathbb{R}\right)$ with the altitude in a map projection system (regular grid with distance $\delta$ between points, i.e., DEM cell resolution). We propose a path planner for high-level UGV mission specifications based on DEM and LTL model checking, where UGV motion between DEM cells is constrained by asymmetric slope traversability conditions [26], which depends on both the robot and the terrain [27,28]. Traversability is defined as matrix $T\in {\mathcal{M}}_{n\times m}\left({\{0,1\}}^{\ell }\right)$, where each element $\mathbf{t}(i,j)$ is a Boolean ℓ-vector representing motion feasibility from $(i,j)$ to its ℓ-neighbors according to slope $\alpha$, computed as

$$\alpha =arctan\left({\displaystyle \frac{z(i_{\mathrm{o}},j_{\mathrm{o}})-z(i,j)}{\delta \sqrt{{(i_{\mathrm{o}}-i)}^2+{(j_{\mathrm{o}}-j)}^2}}}\right).$$

(5)

Elements of $\mathbf{t}(i,j)$ are denoted by $t(i,j,{\theta }_{\mathrm{o}})$, $\forall \mathrm{o}\in \{1,2,\cdots ,\ell \}$, where ${\theta }_{\mathrm{o}}$ is the outward heading toward neighboring cells $(i_{\mathrm{o}},j_{\mathrm{o}})$, i.e., a multiple of $\pi /2$ or $\pi /4$ $\mathrm{rad}$ for $\ell =4$ or $\ell =8$, respectively:

$$\begin{array}{ccc}\hfill t(i,j,{\theta }_{\mathrm{o}})=\top \hfill & \hfill \mathrm{iff}\hfill & \hfill {\alpha }_{\min }\le \alpha \le {\alpha }_{\max },\hfill \end{array}$$

(6)

and ${\alpha }_{\min }$ and ${\alpha }_{\max }$ are the minimum and maximum UGV slope constraints, respectively. We adopted null heading for the eastern direction and counterclockwise angle increments.

The system representing the UGV motion on a DEM is modeled as ${\mathcal{A}}_S$, a nondeterministic transition system whose states at discrete time k are given by ${\langle i,j,\theta \rangle }_k$, where $(i,j)$ represents cell coordinates and $\theta$ is the inward heading. As for transitions, we adopted reducing the number of valid transitions by defining motion constraints in order to cope with the state-space explosion and to reduce the computational cost. In particular, as shown in Figure 1, transitions in ${\mathcal{A}}_S$ are defined by a conjunction of four Boolean constraints: (a) slope traversability T; (b) DEM $n\times m$ limits; (c) the set $\Theta$ of allowed on-cell turns $({\theta }_{\mathrm{o}}-\theta )$, which is $\Theta =\{0,\pm \pi /2\}$ for $\ell =4$ (i.e., removing red values from Figure 1), and can be either $\Theta =\{0,\pm \pi /4\}$ (i.e., removing blue values from Figure 1) or $\Theta =\{0,\pm \pi /4,\pm \pi /2\}$ for $\ell =8$, depending on UGV kinematics constraints; and (d) a specific constraint for diagonal transitions requiring that the adjacent four neighboring cells are traversable (e.g., the transition to ${\theta }_{k+1}=\pi /4$ also depends on traversabilities to ${\theta }_{k+1}=0$ and ${\theta }_{k+1}=\pi /2$).

3.2. LTL Formulas for High-Level UGV Mission Specifications

In this paper, we introduce two SPIN-efficient general LTL formulas for representative high-level UGV missions. With this purpose, we define a set $\mathcal{X}$ of non-overlapping state partitions. Each partition ${\mathcal{X}}_{\mathrm{p}}=\{\langle i_{\mathrm{p}1},j_{\mathrm{p}1},{\theta }_{\mathrm{p}1}\rangle ,\langle i_{\mathrm{p}2},j_{\mathrm{p}2},{\theta }_{\mathrm{p}2}\rangle ,\cdots \}\in \mathcal{X}$ consists of a set of states to which an atomic proposition ${\pi }_{\mathrm{p}}$ is associated:

$$\begin{array}{ccc}\hfill {\pi }_{\mathrm{p}}=\top \hfill & \hfill \mathrm{iff}\hfill & \hfill {\langle i,j,\theta \rangle }_k\in {\mathcal{X}}_{\mathrm{p}}.\hfill \end{array}$$

(7)

Only mission-relevant DEM cells need to be considered in the partitions. The mission specification for a partition is fulfilled if the UGV can reach any state within the partition with the corresponding inward heading.

Regarding the optimization criterion, SPIN imposes minimization of the number of counterexample states. Thus, the objective of the path planner for high-level UGV mission is to obtain a path with the minimum number of ${\mathcal{A}}_S$ transitions that reaches all goal partitions of a specified set $\mathcal{G}=\{{\mathcal{G}}_1,{\mathcal{G}}_2,\dots ,{\mathcal{G}}_{\left|\mathcal{G}\right|}\}\subseteq \mathcal{X}$. Furthermore, mission specifications can include (1) a partition of forbidden states, $\mathcal{F}\in \mathcal{X}:\mathcal{F}\notin \mathcal{G}$ associated to atomic proposition ${\pi }_{\mathrm{f}}$,

$$\begin{array}{ccc}\hfill {\pi }_{\mathrm{f}}=\top \hfill & \hfill \mathrm{iff}\hfill & \hfill {\langle i,j,\theta \rangle }_k\in \mathcal{F},\hfill \end{array}$$

(8)

and/or (2) the requirement to return to the initial cell coordinates $(i_0,j_0)$ after the mission is completed using an atomic proposition ${\pi }_{\mathrm{r}}$,

$$\begin{array}{ccc}\hfill {\pi }_{\mathrm{r}}=\top \hfill & \hfill \mathrm{iff}\hfill & \hfill \left((i_k,j_k)=(i_0,j_0)\right)\wedge \left({\theta }_k\in {\Theta }_{\mathrm{r}}\right),\hfill \end{array}$$

(9)

where ${\Theta }_{\mathrm{r}}$ is the specified set of allowed inward headings for returning.

When verifying complex systems with SPIN, it is crucial to choose LTL formulas that enable efficient state-space exploration [25]. LTL formulas that use the temporal operator $\mathcal{U}$ (until) explicitly enforce a strict event order and avoid certain conditions, which reduces the state space, making it easier for SPIN to find counterexamples. Conversely, LTL formulas with global restrictions and nested eventualities (e.g., $\square \neg {\pi }_{\mathrm{f}}\wedge ◊\left({\pi }_1\wedge ◊\left({\pi }_2\wedge ◊\left({\pi }_3\wedge ◊{\pi }_4\right)\right)\right)$) can slow down the state-space exploration process. Therefore, we propose two general LTL formulas using $\mathcal{U}$ for reaching goal partitions $\mathcal{G}$:

(1)

In a given order (i.e., ${\mathcal{G}}_1$ then ${\mathcal{G}}_2$, and so on),

$${\varphi }_{\mathrm{g}1}\stackrel{\mathrm{def}}{=}\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}\bigcup _{ı=\left|\mathcal{G}\right|}^1{\pi }_{ı},$$

(10)

where ${\displaystyle \bigcup _{ı=\left|\mathcal{G}\right|}^1{\pi }_{ı}={\pi }_{\left|\mathcal{G}\right|}\mathcal{U}{\pi }_{\left|\mathcal{G}\right|-1}\mathcal{U}\cdots \mathcal{U}{\pi }_1}$

(2)

In an unspecified order,

$$\begin{array}{cc}\hfill {\varphi }_{\mathrm{g}2}\hfill & \hfill \stackrel{\mathrm{def}}{=}\underset{ı=1}{\overset{\left|\mathcal{G}\right|}{\bigwedge }}\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_{ı}\right)\hfill \\ \hfill \hfill & \hfill =\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_1\right)\wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_2\right)\hfill \\ \hfill \hfill & \hfill \wedge \cdots \wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_{\left|\mathcal{G}\right|}\right).\hfill \end{array}$$

(11)

 

Moreover, the following three simplifying conditions could be considered in actual missions:

• There is a single goal partition, i.e., $\left|\mathcal{G}\right|=1$;
• There is no forbidden partition ($\mathcal{F}=⌀$), i.e., ${\pi }_{\mathrm{f}}=\perp$;
• The UGV must not return to the initial cell, i.e., ${\pi }_{\mathrm{r}}=\top$;

Using different combinations of these simplifying conditions in Equations (10) and (11) results in the well-known simple LTL formulas presented in

Table 1. Simplified linear temporal logic formulas (LTL) for high-level uncrewed ground vehicle (UGV) missions.

$\mathcal{F}=\mathit{⌀}$	Returns	LTL Formula $\mathit{\varphi }$
$\left|\mathcal{G}\right|=1$
no	no	$◊{\pi }_1$
yes	no	$\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_1$
no	yes	$◊{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_1$
yes	yes	$\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_1$
$\left|\mathcal{G}\right|>1$ and in a given order
no	no	${\displaystyle ◊{\pi }_{\left|\mathcal{G}\right|}\mathcal{U}\bigcup _{ı=\left|\mathcal{G}\right|-1}^1{\pi }_{ı}}$
yes	no	${\displaystyle \neg {\pi }_{\mathrm{f}}\mathcal{U}\bigcup _{ı=\left|\mathcal{G}\right|}^1{\pi }_{ı}}$
no	yes	${\displaystyle ◊{\pi }_{\mathrm{r}}\mathcal{U}\bigcup _{ı=\left|\mathcal{G}\right|}^1{\pi }_{ı}}$
$\left|\mathcal{G}\right|>1$ and no specific order
no	no	${\displaystyle \underset{ı=1}{\overset{\left|\mathcal{G}\right|}{\bigwedge }}◊{\pi }_{ı}}$
yes	no	${\displaystyle \underset{ı=1}{\overset{\left|\mathcal{G}\right|}{\bigwedge }}\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{ı}\right)}$
no	yes	${\displaystyle \underset{ı=1}{\overset{\left|\mathcal{G}\right|}{\bigwedge }}◊{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_{ı}}$

. This result corroborates the generality of the proposed formulas, which can be applied for more complex missions.

3.3. LTL Model Checking Workflow with SPIN

In this work, we adopted the SPIN workflow with breadth-first search (BFS) [17] for synthesizing an LTL path planner for high-level UGV missions (see Figure 2). Unlike the default depth-first search, which is more suitable for model checking than for planning, BFS can find a counterexample with the shortest trace at a lower computational cost.

This workflow begins with using Promela to model ${\mathcal{A}}_S$ and the LTL property to be verified. This Promela source file is used by SPIN to generate an LTL verification program in ANSI C. Then, our compile time options for specific search optimization techniques are partial order reduction, the BFS algorithm, (-DBFS) and lossless collapse compression (-DCOLLAPSE). Then, an iterative LTL verification process is performed until either no new nodes are added to the unweighted search graph (i.e., no counterexample is found) or a trail file is generated with the shortest counterexample (i.e., ${\mathcal{A}}_S$ does not satisfy the LTL property).

3.4. LTL Model Checking for Synthesizing a Path Planner for UGV Missions

Since ${\mathcal{A}}_S$ was designed considering motion constraints, these can be omitted from LTL model checking for path planning that fulfills the high-level UGV mission. The LTL property used to verify in the LTL model checking workflow (see Figure 2) is a negated LTL mission specification $\neg \varphi$, i.e., the negation of (10) or (11) (or other simplified or derived formula from these). For LTL path planning, “no counterexample” means that the UGV mission cannot be satisfied; otherwise, the trail file returns the shortest counterexample, which needs to be mapped from the product automaton states to the system model states to obtain a DEM path.

4. Experimental Methodology

This section describes the hardware and software used in the experiments, defines a baseline path planner for comparison, and presents mission specifications for a synthetic DEM and a larger-scale real-world DEM.

4.1. Hardware and Software

The DEM-based LTL path planner was executed on a $2.10$ $\mathrm{G}$$\mathrm{Hz}$ i7-13700F processor made by Intel Corp. (Santa Clara, CA, USA) with 16 $\mathrm{G}$B of RAM, running Microsoft© Windows 11 Pro. The required software was installed in a container on Docker Desktop v.4.32.0 including Ubuntu 22.04.4 LTS and MATLAB R2023b by Mathworks (Natick, MA, USA) to run the main planner script and generate graphical representations. SPIN v6.5.2 was used as the model checker, gcc 11.4.0 as the C compiler, and Promela to (1) describe the system models with embedded C-code as part of the model specification and (2) formulate DEM-based high-level UGV missions as LTL properties.

4.2. Comparison with a Baseline Path Planner

In this article, we propose an approach for SPIN-based LTL path planning on DEMs by defining a system model that incorporates the set of UGV motion constraints, allowing these constraints to be omitted from LTL model checking. This contrasts with previous works in LTL path planning [7,8,10], where a single generalized LTL formula integrates both the desired robot behavior and the environment assumptions.

To the best of our knowledge, no previous works have addressed LTL path planning on DEMs. Therefore, for comparison purposes, we define a baseline SPIN-based LTL path planner with a generalized LTL formula integrating mission specification and motion constraints on DEMs, and a system model that only considers cell neighborhoods for transitions.

In this baseline planner, the generalized LTL formula is

$${\varphi }_{\mathrm{base}}\stackrel{\mathrm{def}}{=}\varphi \wedge \square \left({\pi }_{\mathrm{a}}\wedge {\pi }_{\mathrm{b}}\wedge {\pi }_{\mathrm{c}}\wedge {\pi }_{\mathrm{d}}\right),$$

(12)

which means that the mission specification $\varphi$ must be satisfied, and all motion constraints must always be fulfilled. In particular, the truth assignments to the four motion constraints described in Section 3.1 are defined as atomic propositions ${\pi }_{\mathrm{a}},{\pi }_{\mathrm{b}},{\pi }_{\mathrm{c}}$, and ${\pi }_{\mathrm{d}}$, respectively, from the current ${\langle i,j,\theta \rangle }_k$ and previous ${\langle i,j,\theta \rangle }_{k-1}$ model states, as follows:

$$\begin{array}{ccc}{\pi }_{\mathrm{a}}=\top & \hfill \mathrm{iff}\hfill & \hfill (k=0)\vee t(i_{k-1},j_{k-1},{\theta }_k),\hfill \\ {\pi }_{\mathrm{b}}=\top & \hfill \mathrm{iff}\hfill & \hfill (1\le i_k\le n)\wedge (1\le j_k\le m),\hfill \\ {\pi }_{\mathrm{c}}=\top & \hfill \mathrm{iff}\hfill & \hfill (k=0)\vee \left(({\theta }_k-{\theta }_{k-1})\in \Theta \right),\hfill \\ {\pi }_{\mathrm{d}}=\top & \hfill \mathrm{iff}\hfill & \hfill (k=0)\vee \left({\theta }_k\in \{0,\pi /2,\pi ,3\pi /2\}\right)\hfill \\ & \hfill \hfill & \hfill \vee \left(t(i_{k-1},j_{k-1},{\theta }_k)\wedge t(i_{k-1},j_{k-1},{\theta }_k\pm \pi /4)\right).\hfill \end{array}$$

(13)

4.3. Mission Specifications in a Synthetic DEM

We defined a synthetic DEM with obstacles, mounds, and slopes (see Figure 3, Figure 4, Figure 5 and Figure 6), with $n\times m=17\times 17$ and $\delta =$ 1 $\mathrm{m}$. The DEM has a forbidden partition $\mathcal{F}$ indicated by cells marked with an “X”, and four mission-oriented partitions, ${\mathcal{X}}_1$ to ${\mathcal{X}}_4$, represented by cells labeled with corresponding numbers.

Partition ${\mathcal{X}}_1$ (and also ${\mathcal{X}}_3$) exemplifies cells from different regions sharing the same role in the mission (e.g., charging stations or communication relays that could be distributed throughout the environment). Moreover, partitions ${\mathcal{X}}_3$ and ${\mathcal{X}}_4$ need to be given inward headings (indicated by triangle cell labels).

As for the UGV, the initial state ${\langle i,j,\theta \rangle }_0=\langle 15,4,3\pi /2\rangle$ is depicted as a red spot with an arrow for the heading. We adopted UGV slope constraints ${\alpha }_{\min }=-\pi /18\mathrm{rad}(-10°)$ for downhill and ${\alpha }_{\max }=\pi /12\mathrm{rad}(15°)$ for uphill, which are representative of asymmetric behaviour of actual UGVs [26].

Four distinctive high-level UGV missions were analyzed:

(1)

Example of general LTL formula ${\varphi }_{\mathrm{g}1}$, Equation (10), see Figure 3.

The UGV must eventually reach ${\mathcal{X}}_1$ to ${\mathcal{X}}_4$ in the given order, avoiding $\mathcal{F}$, to finally return to $(i_0,j_0)$ with any inward heading (i.e., ${\Theta }_{\mathrm{r}}=\{\theta ,0\le \theta \le 2\pi \}$):

$$\begin{array}{c}\hfill {\varphi }_1\stackrel{\mathrm{def}}{=}\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_4\mathcal{U}{\pi }_3\mathcal{U}{\pi }_2\mathcal{U}{\pi }_1\hfill \\ \hfill =\left(\left(\left(\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\right)\mathcal{U}{\pi }_4\right)\mathcal{U}{\pi }_3\right)\mathcal{U}{\pi }_2\right)\mathcal{U}{\pi }_1.\hfill \end{array}$$

(14)

To enhance clarity, extra parentheses have been added to the LTL formula, even though the LTL grammar in Section 2.1 specifies that the $\mathcal{U}$ operator is left-associative, as is typical in SPIN’s interpretation.

(2)

Example of general LTL formula ${\varphi }_{\mathrm{g}2}$, Equation (11), see Figure 4.

The UGV must eventually reach ${\mathcal{X}}_1$ to ${\mathcal{X}}_4$ with no specific order, avoiding $\mathcal{F}$, to finally return to $(i_0,j_0)$ with any inward heading:

$$\begin{array}{c}{\varphi }_2\stackrel{\mathrm{def}}{=}\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_1\right)\wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_2\right)\\ \wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_3\right)\wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_4\right).\end{array}$$

(15)

(3)

Example of a combination of Equations (10) and (11), see Figure 5.

The UGV must eventually reach ${\mathcal{X}}_1$, then ${\mathcal{X}}_2$, and then ${\mathcal{X}}_3$ and ${\mathcal{X}}_4$ with no specific order, avoiding $\mathcal{F}$, to finally return to $(i_0,j_0)$ with any inward heading:

$$\begin{array}{c}\hfill {\varphi }_3\stackrel{\mathrm{def}}{=}\left(\left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_4\right)\wedge \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_3\right)\right)\hfill \\ \hfill \mathcal{U}{\pi }_2\mathcal{U}{\pi }_1.\hfill \end{array}$$

(16)

(4)

Example of a simplified LTL formula (Table 1), see Figure 6.

The UGV must eventually reach ${\mathcal{X}}_4$, avoiding $\mathcal{F}$, to finally return to $(i_0,j_0)$ with any inward heading:

$${\varphi }_4\stackrel{\mathrm{def}}{=}\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{r}}\mathcal{U}{\pi }_4.$$

(17)

4.4. Mission Specification in a Real DEM

Additionally, to evaluate planning performance in a larger-scale real-world DEM, we used an $n\times m=292\times 232$ with $\delta =$ 2 $\mathrm{m}$ obtained from an aerial ortophoto (see Figure 7). This DEM captures 135,488 m² of an experimental area for realistic disaster response exercises [29], featuring dirt roads, rubble mounds, diverse vegetation, crushed vehicles, and partially buried pipelines [30].

In this case, the high-level UGV mission specification corresponds to a casualty evacuation starting from ${\langle i,j,\theta \rangle }_0= \langle$366,991, 4,064,448, $\pi /2\rangle$ depicted as a red spot with an arrow for the heading. The forbidden partition, marked by black cells, represents areas occupied by victims and tents. The goal partitions, marked by yellow cells, are designated areas close enough for the UGV to access and assist the victims while maintaining a safe distance. As for the UGV slope constraints, we consider appropriate values for safe casualty evacuation, i.e., ${\alpha }_{\min }=-\pi /18\mathrm{rad}(-10°)$ for downhill and ${\alpha }_{\max }=\pi /30\mathrm{rad}(6°)$ for uphill.

The mission is specified by the following LTL formula:

$$\begin{array}{cc}{\varphi }_5\stackrel{\mathrm{def}}{=}& \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{robotic}}\mathcal{U}{\pi }_{\mathrm{medical}}\mathcal{U}{\pi }_1\right)\wedge \\ & \left(\neg {\pi }_{\mathrm{f}}\mathcal{U}{\pi }_{\mathrm{robotic}}\mathcal{U}{\pi }_{\mathrm{medical}}\mathcal{U}{\pi }_2\right),\end{array}$$

(18)

i.e., the UGV must eventually reach two geolocated victims to evacuate them to a medical tent and finally return to the robotic tent.

5. Experimental Results

This section discusses the resulting paths, compares experimental results of the proposed method with respect to the baseline LTL path planned described in Section 4.2, and analyzes performance.

5.1. Path Planning Analysis

Figure 3, Figure 4, Figure 5, Figure 6 and Figure 7 illustrate the resulting paths (red lines) for the UGV example missions, Equations (14)–(18), respectively. The arrows are color-coded to show the UGV’s motion toward each goal partition in the mission sequence. The same color is used in the macron mark above the corresponding partition number in the goal cell. Different colors in the arrows indicate the UGV motion toward the next goal partition to be reached.

For the synthetic DEM, Figure 3, Figure 4, Figure 5 and Figure 6 show results for the different on-cell turn constraints $\Theta$. In the first three missions, only $\Theta =\{0,\pm \pi /2\}$ and $\Theta =\{0,\pm \pi /4,\pm \pi /2\}$ produce result paths. The limited manoueverability of $\Theta =\{0,\pm \pi /4\}$, which does not allow $\pi /2$ turns, prevents paths from being found without encountering obstacles or reaching the DEM boundary limits. This limitation is evident in the wide loop around the elevated area on top of Figure 6b for ${\varphi }_4$, which is the only mission that achieves a path with this motion constraint.

In Figure 3, both paths satisfy the goal partition order specified by ${\varphi }_1$. However, different turn constraints cause partition ${\mathcal{X}}_3$ to be reached at different states. The shortest path length (84 vs. 109 states) is achieved with the least restrictive maneuverability (i.e., Figure 3b). Figure 4 corresponds to ${\varphi }_2$, which does not impose a specific order. As a result, the goal partition sequence is different: ${\mathcal{X}}_2,{\mathcal{X}}_4,{\mathcal{X}}_3,$ and ${\mathcal{X}}_1$ for $\Theta =\{0,\pm \pi /2\}$ (see Figure 4a), and ${\mathcal{X}}_1,{\mathcal{X}}_3,{\mathcal{X}}_4,$ and ${\mathcal{X}}_2$ for $\Theta =\{0,\pm \pi /4,\pm \pi /2\}$ (see Figure 4b) by reducing the path length (93 vs. 70). Figure 5 corresponds to ${\varphi }_3$, where the order for the last two partitions was not specified. In this case, both turn constraints yield the same goal partition sequence, even if the least restrictive manoeuverability (see Figure 5b) produces a shorter path (80 vs. 105). Figure 6 corresponds to ${\varphi }_4$, a simpler mission that only needs to reach ${\mathcal{X}}_4$ before returning to the initial position (in any heading). This figure illustrates the difference between the path length in terms of states (seen as the number of traversed cells), which is the LTL optimization criterion imposed by SPIN, and the actual path length (since diagonal cell motions are longer). Thus, paths in Figure 6a–c have 55, 48, and 44 states that correspond to 54 $\mathrm{m}$, $54.9$ $\mathrm{m}$, and $47.6$ $\mathrm{m}$, respectively.

As for the real DEM, Figure 7 illustrates the path for the multi-victim evacuation mission ${\varphi }_5$ specified by Equation (18). In particular, the figure shows the path for $\Theta =\{0,\pm \pi /2\}$. Figure 7a reveals that the resulting path is close to the dirt roads in the environment, which correspond mostly with low terrain gradients (as seen in Figure 7b).

5.2. Comparison with the Baseline Path Planner

Table 2. Comparison of the proposed method against the baseline LTL path planner in synthetic and real-world DEMs: computation times, explored states, required memory, and path length.

Neighborhood and $\mathbf{\Theta }$	${\mathit{t}}_{\mathbf{SPIN}}$ ($\mathbf{s}$)	${\mathit{t}}_{\mathbf{comp}}$ ($\mathbf{s}$)	Explored States	Memory (MB)	${\mathit{t}}_{\mathbf{search}}$ ($\mathbf{s}$)	${\mathit{t}}_{\mathbf{map}}$ ($\mathbf{s}$)	Path Length	${\mathit{t}}_{\mathbf{total}}$ ($\mathbf{s}$)
Synthetic DEM:	ours/base	ours/base	ours/base	ours/base	ours/base	ours/base	ours/base	ours/base
LTL formula ${\varphi }_1$, Equation (14)
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.47/0.97	3.10/28.58	20,774/20,774	36/36	0.33/0.35	0.11/0.12	109/109	4.02/30.02
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.46/1.02	3.11/27.05	3619/3619	36/36	0.17/0.20		no path	3.74/28.27
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.47/1.06	3.12/28.07	78,892/78,992	136/136	0.92/1.09	0.12/0.12	84/84	4.63/33.34
LTL formula ${\varphi }_2$, Equation (15)
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.52/1.07	3.03/28.75	69,348/69,348	36/36	0.60/0.69	0.12/0.13	93/93	4.28/30.65
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.52/1.03	3.08/27.19	7243/7243	36/36	0.19/0.25		no path	3.79/28.47
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.52/1.06	3.12/27.86	261,020/261,020	136/136	2.07/3.04	0.12/0.13	70/70	6.41/32.10
LTL formula ${\varphi }_3$, Equation (16)
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.48/1.05	3.22/34.88	25,408/25,408	36/36	0.34/0.41	0.13/0.15	105/105	4.17/36.49
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.49/1.17	3.34/32.95	3619/3619	36/36	0.17/0.21		no path	4.00/34.33
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.49/1.32	3.34/34.45	95,251/95,251	136/136	1.05/1.24	0.10/0.13	80/80	4.99/37.13
LTL formula ${\varphi }_4$, Equation (17)
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.36/0.34	0.92/1.09	8156/8156	36/36	0.21/0.21	0.12/0.13	55/55	1.61/1.77
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.33/0.37	0.95/1.12	6478/6478	36/36	0.18/0.18	0.13/0.14	48/48	1.60/1.81
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.36/0.36	0.97/1.18	31,078/31,078	136/136	0.46/0.46	0.10/0.11	44/44	1.90/2.13
Real-world DEM:
LTL formula ${\varphi }_5$ Equation, (18), with |-DCOLLAPSE| compile time option
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.43/0.58	2.09/8.44	1,041,104/1,041,104	>16,045/16,045	229.79/237.39	0.46/0.42	315/315	232.94/246.94
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.41/0.55	2.15/8.21	state explosion	>16,384/>16,384	38.16/38.68			40.81/47.56
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.42/0.59	2.15/8.45	state explosion	>16,384/>16,384	52.30/53.14			54.95/62.24
LTL formula ${\varphi }_5$, Equation (18), with |-DBITSTATE| compile time option
$\ell =4,\Theta =\{0,\pm \pi /2\}$	0.41/0.50	2.14/8.49	1,030,053/1,028,812	>0 1900/1900	66.26/67.10	0.16/0.15	315/315	68.97/76.25
$\ell =8,\Theta =\{0,\pm \pi /4\}$	0.39/0.53	2.05/8.07	1,720,797/1,740,253	>0 3600/3600	106.30/113.37	0.15/0.16	245/247	108.90/122.14
$\ell =8,\Theta =\{0,\pm \pi /4,\pm \pi /2\}$	0.38/0.55	2.06/8.22	3,861,489/3,885,223	>0 6800/7000	386.84/399.17	0.15/0.15	243/244	389.44/408.09

offers a comparison of the proposed method against the baseline LTL path planner (see Section 4.2) for mission specifications in synthetic (${\varphi }_1$ to ${\varphi }_4$) and real-world (${\varphi }_5$) DEMs. The table presents the total computation time $t_{\mathrm{total}}$ and partial times for the LTL workflow processes (see Figure 2): $t_{\mathrm{SPIN}}$ for the generation of the LTL verifier in C, $t_{\mathrm{comp}}$ for the compilation, $t_{\mathrm{search}}$ for the breadth-first search for the counterexample, and $t_{\mathrm{map}}$ for the mapping of the shortest path. Additionally, the table shows the number of explored states and the required memory during the counterexample search phase, as well as the length (i.e., the number of ${\mathcal{A}}_S$ states) of the resulting shortest path. Furthermore, the path for each LTL mission specification has been computed for three different sets $\Theta$ of allowed on-cell turns (see Section 3.1).

Both LTL path planners leverage SPIN’s specific search optimization techniques, which reduce the number of explored states and the required memory. Consequently, the memory requirements and the number of explored states are the same for both methods. The state-space explosion problem (i.e., reaching the memory limit of 16,384 MB in our hardware platform) occurs for both cases with $\ell =8$ in the real-world DEM, so no resulting paths are provided. This can be explained by the real-world DEM having a significantly larger number of cells and a higher ratio of children per node due to the smoother terrain compared to the synthetic DEM.

To achieve a solution with the available hardware, we selected the lossy “bitstate hashing” (-DBITSTATE) compression method in the compile options. Table 2 shows the results using both -DCOLLAPSE and -DBITSTATE. With the lossy method, the computational time for ${\varphi }_5$ with $\Theta =\{0,\pm \pi /2\}$ was reduced by 70.4%, the state-space explosion problem was mitigated (reducing the required memory by 88.2%), and the resulting suboptimal path length was equal to the shortest path length obtained with lossless compression.

All in all, Table 2 shows an average reduction of 52.4% in $t_{\mathrm{total}}$ with our proposal compared to the baseline planner. The most remarkable decrease occurs in $t_{\mathrm{SPIN}}$, where the lower complexity of the LTL property reduces the generation time of the C-file verifier (37.2%) and, consequently, the compilation time $t_{\mathrm{comp}}$ (72%).

5.3. Performance Analysis

The results for different DEM sizes in Table 2 (i.e., $17\times 17$ for ${\varphi }_1$ to ${\varphi }_4$ in the synthetic DEM, and $292\times 232$ for ${\varphi }_5$ in the real-world DEM) indicate that DEM size mainly affects $t_{\mathrm{search}}$ but is not relevant for other processes of the SPIN workflow. The real-world environment is larger and has a smoother relief, which causes a higher number of states and valid transitions in the system model ${\mathcal{A}}_S$. This can explain the higher memory (about 16 $\mathrm{G}$B, for the real-world mission vs. 160 $\mathrm{M}$B for synthetic DEMs) needed to save the nodes expanded (about $3.9\times {10}^6$ vs. $0.26\times {10}^6$, respectively) by the BFS algorithm.

The set $\Theta$ also influences the counterexample search time. Thus, the less restrictive set $\Theta =\{0,\pm \pi /4,\pm \pi /2\}$ implies a higher ratio of children per node in each BFS iteration, which increases $t_{\mathrm{search}}$ and $t_{\mathrm{total}}$ but could reduce the resulting path length. For $\Theta =\{0,\pm \pi /4\}$, a larger number of traversable neighboring cells are required to move through the environment, which, in some cases (e.g., ${\varphi }_1$, ${\varphi }_2$ and ${\varphi }_3$), prevents finding a path that satisfies the mission.

The complexity of the system model and/or the LTL formula describing the high-level mission specification, i.e., the number of states of the automaton product ${\mathcal{A}}_S\otimes {\mathcal{A}}_{\neg \varphi }$, affects $t_{\mathrm{SPIN}}$ and $t_{\mathrm{comp}}$. Thus, for LTL formulas with lower complexity, i.e., ${\varphi }_4$ and ${\varphi }_5$, these times are shorter. $t_{\mathrm{map}}$ is irrelevant, with values between 100 and 500 $\mathrm{m}$$\mathrm{s}$, increasing slightly for longer path lengths.

6. Conclusions

In this paper, we proposed a SPIN-based linear temporal logic (LTL) path planner for uncrewed ground vehicle (UGV) missions on uneven terrain. Our approach leverages existing search optimization techniques available in the open-source Simple Promela Interpreter (SPIN) model checker. First, the system model incorporates UGV motion constraints for a digital elevation model (DEM), including factors such as asymmetric slope limitations and maneuverability constraints like on-cell turns. These constraints are integrated into the system model, allowing them to be omitted from the LTL model checking process and focusing solely on verifying mission specifications. To enhance the efficiency of state-space exploration, we defined two general SPIN-efficient LTL formulas for specifying UGV missions. These formulas allow for reaching a set of goal DEM partitions in either a specified or unspecified order. The proposed planner was implemented using SPIN with customized search optimization parameters.

For experimental analysis, the planner was validated on both synthetic and real-world DEMs. Specifically, we tested four representative high-level missions on a synthetic DEM and applied the framework to plan a multi-victim evacuation mission in a real large-scale DEM of 135,488 m². The experimental results show that our approach significantly reduces the total planning time, particularly in the generation and compilation of the LTL verifier’s source code, compared to a baseline planner. While both approaches apply SPIN’s search optimization techniques, resulting in no significant differences in path search time, our method demonstrates clear advantages in the preparatory stages of the planning process. Regarding the observed limitations, the proposed method encounters scalability challenges in large-scale DEMs. This is a common issue for graph-search approaches.

In future work, it will be valuable to explore enhancements to search algorithms in directed weighted transition systems that model UGV motion over DEMs with a broader set of motion constraints. These constraints could encompass non-uniform velocities and any-angle motion primitives. Furthermore, focusing on optimizing travel time rather than just the number of cells traversed may offer a more effective criterion for path planning in time-critical missions within challenging environments. Furthermore, future work will address the integration of the planner into the control architecture of a UGV with appropriate path tracking and motion control methods for rough terrain.