Planning with increasingly complex executive models

We are developing autonomous control systems for mission-critical domains that require hard real-time performance guarantees. To automatically build reactive plans that meet these requirements, we use formal verification (model checking) techniques to assess the quality of plans as they are built. The verification process uses precise timed automaton models of the executive that will run the resulting reactive plan. This reflexive modeling allows our system to formally verify not just that its plans are correct, but that they will be executed correctly.