Autonomous Systems to Formal Models (AS2FM)

• AS2FM is a systematic workflow that transforms informal autonomous system descriptions into mathematically precise models, facilitating analysis and certification.
• It maps diverse system components to established formalisms such as transition systems, hybrid automata, and MDPs for rigorous, multi-modal verification.
• The approach integrates offline and runtime verification, enabling controller synthesis and safety assurance for complex, cyber-physical systems.

Autonomous Systems to Formal Models (AS2FM) denotes a research program and engineering workflow for turning autonomous systems into mathematically precise artifacts that can be specified, analyzed, verified, synthesized, and monitored. In the FMAS workshop series, autonomous systems are characterized as highly complex systems that act without human intervention, are often embedded in robotic platforms, and exhibit the properties of safety-critical, cyber-physical, hybrid, and real-time systems; within that setting, AS2FM is the systematic passage from requirements, architectures, controllers, environments, and runtime interactions to formal models and specifications suitable for model checking, theorem proving, runtime verification, synthesis, and certification-oriented assurance (Luckcuck et al., 2020, Luckcuck et al., 2022, Farrell et al., 2023, Luckcuck, 2020). In a narrower and more recent sense, “AS2FM” is also the name of a tool-supported framework that translates ROS 2 and Behavior Tree robotic systems into JANI for Statistical Model Checking (Henkel et al., 26 Aug 2025).

1. Scope, rationale, and conceptual boundaries

AS2FM is motivated by the observation that autonomous systems combine discrete decision-making, continuous physical dynamics, timing constraints, uncertainty, environment interaction, and, increasingly, learning-enabled components. The central engineering question is how to move from an informal or semi-formal autonomous-system description to formal models and properties for which statements of the form $M \models \varphi$ are meaningful and computationally actionable (Luckcuck, 2020, Yin et al., 2024).

Across the literature, the AS2FM pipeline is described as a sequence such as: informal autonomous system description $\rightarrow$ formal models/specifications $\rightarrow$ formal analysis/verification $\rightarrow$ feedback into design and certification. This is not a single formalism. It is a family of mappings in which different parts of the system are formalized differently: executive logic as agent programs or transition systems, continuous plant dynamics as differential equations or hybrid automata, uncertainty as MDPs or stochastic hybrid systems, mission requirements as temporal logic or contracts, and deployment-time enforcement as runtime monitors or shields (Luckcuck, 2020, Yin et al., 2024).

A recurring misconception is that AS2FM is only an offline verification workflow. In fact, the literature consistently includes runtime verification, runtime enforcement, and monitor generation as integral parts of the method, especially when full offline verification is infeasible because of adaptivity, environmental openness, or opaque ML components (Luckcuck, 2020, Gruteser et al., 2024, Henkel et al., 26 Aug 2025).

2. Core formalisms and model classes

The most common AS2FM target models are transition systems, hybrid automata, timed automata, MDPs, contracts, and logic-based specifications. For discrete control and software, a standard abstraction is a transition system

$\mathcal{T} = (S, Act, \rightarrow, s_0),$

with states, actions, transitions, and an initial state. For continuous-time control systems with disturbance, a common model is

$\dot{z} = f(z,u,d),$

and for hybrid systems this is lifted to structures such as

$$\mathcal{H} = (Q, X, \mathrm{Init}, \mathrm{Inv}, f, E, \mathrm{Guard}, \mathrm{Reset}),$$

where $Q$ is a set of discrete modes and $X$ is the continuous state space (Bui et al., 2020, Yin et al., 2024).

For uncertainty and decision-making under uncertainty, AS2FM frequently targets MDPs and related stochastic models. A standard form is

$\mathcal{M} = (S, A, P, R),$

with probabilistic transition kernel $\rightarrow$0, or richer stochastic hybrid models when continuous state and stochastic evolution must be retained (Yin et al., 2024). In quantitative timing settings, EAST-ADL timing constraints have been translated into PrCCSL and then into Proof Objective Models for Simulink Design Verifier, with probabilistic weakly-hard semantics expressed as

$\rightarrow$1

for clock relations such as subclock, coincidence, exclusion, causality, and precedence (Kang et al., 2018).

Specifications are commonly written in temporal and modal logics. Canonical examples include safety properties such as

$\rightarrow$2

liveness properties such as

$\rightarrow$3

and bounded-response properties such as

$\rightarrow$4

For componentized systems, contract-based formulations of the form $\rightarrow$5 or $\rightarrow$6 are used to encode assumptions and guarantees and to enable compositional verification (Luckcuck, 2020, Pinto et al., 2023).

3. Typical AS2FM workflows

A canonical AS2FM workflow begins by selecting a component or concern—executive decisions, ML outputs, safety constraints, missions, or movement regions—extracting the relevant requirements, choosing a formalism, and then building a model that preserves the structure needed for verification or synthesis. “Using Formal Methods for Autonomous Systems: Five Recipes for Formal Verification” organizes this as five recurring strategies: verifying executive decisions, controlling machine learning, verifying and enforcing safety claims, verifying tasks and missions, and logical barriers (Luckcuck, 2020).

In executive-decision verification, symbolic decision logic is modeled as a BDI agent program, state machine, or transition system, and checked against temporal-logic formulations of legal, safety, or ethical rules. In machine-learning control, the learned component is treated as a black box and enclosed by a formal governor, runtime monitor, or shield specified by invariants or temporal constraints on outputs. In safety-case verification, safety documentation is translated into temporal properties or contracts, and verified statically before being reused as runtime monitors. In mission verification, tasks become Hoare-style contracts $\rightarrow$7 and missions become compositions of task contracts and temporal patterns. In logical-barrier methods, forbidden regions of state space are encoded directly as safety properties or barrier-like constraints (Luckcuck, 2020).

A more specialized workflow appears in the ROS 2 and BT setting. The AS2FM tool introduces High-Level SCXML for ROS 2 interfaces, Behavior Tree runtime aspects, non-deterministic behavior, and timers; lowers HL-SCXML to SCXML; translates the resulting event-based state machines into a JANI model consisting of a network of MDPs; and then applies Statistical Model Checking in tools such as SMC Storm (Henkel et al., 26 Aug 2025). A parallel automotive workflow is provided by CommonUppRoad, which implements the mapping

$\rightarrow$8

with automatic model conversions between CommonRoad and UPPAAL (Gu et al., 2024).

4. Verification, synthesis, and runtime assurance

AS2FM supports several verification modalities. Model checking is used for finite-state, timed, and probabilistic abstractions; theorem proving is used for hybrid dynamics, contracts, and algorithmic correctness; runtime verification is used when design-time guarantees are partial; and synthesis is used to derive controllers correct by construction (Luckcuck, 2020, Yin et al., 2024).

For hybrid safety, one prominent line uses Hamilton–Jacobi reachability. In the FPGA-based real-time verification work, obstacles are encoded as target sets via a level-set function $\rightarrow$9, and the unsafe set is propagated backward by solving an HJ variational inequality whose value function $\rightarrow$0 defines a backward reachable tube

$\rightarrow$1

A state with $\rightarrow$2 is formally outside the backward reachable tube, hence safe for the horizon under the assumed dynamics and disturbance model. The implementation reported deterministic latency of $\rightarrow$3 s for a 4D car model and an update frequency of approximately $\rightarrow$4 Hz, enabling real-time formal verification with a 4D car model by re-solving the HJ PDE as the environment changes (Bui et al., 2020).

Formal synthesis is treated as a central AS2FM endpoint in the survey of safety-critical controller synthesis. There the problem is categorized by deterministic, non-deterministic, and stochastic system models, and by logic, real-time, and real-valued specifications; both abstraction-based approaches and abstraction-free methods such as control barrier functions are included (Yin et al., 2024). A practical implication is that AS2FM is not merely about verifying a given controller. It also covers controller derivation from formal specifications, including safe reinforcement learning under formally synthesized shields (Yin et al., 2024, Gu et al., 2024).

Runtime assurance closes the loop when offline verification is incomplete. In the KI-LOK train demonstrator, steering safety is ensured by formal analysis using the B method while perception reliability is improved with a runtime certificate checker; these are linked in a demonstrator integrated into ProB, enabling runtime monitoring, runtime verification, and statistical validation of formal safety properties using a formal B model (Gruteser et al., 2024). This suggests a general AS2FM pattern in which formally verified control envelopes and runtime filters compensate for incomplete tractability or incomplete transparency elsewhere in the autonomy stack.

5. Compositional, heterogeneous, and learning-enabled extensions

One of the most developed AS2FM directions is compositional verification. AlgebraicSystems treats requirements, behaviors, architectures, safety/security models, and timing/resource models as different model views, each living in a distinct algebra, and uses categorical semantics, functors, and vertical and horizontal composition to make formalisms and tools interoperable (Bakirtzis et al., 2022). In the autonomous taxi case study, this becomes a contract-based methodology in which route generation, trajectory generation, trajectory following, state estimation, and environment assumptions are decomposed into contracts whose joint guarantees must refine the top-level autonomous taxi contract (Pinto et al., 2023).

The taxi work also exposes a major AS2FM difficulty: heterogeneous viewpoints are often expressed in different specification languages. Its protocol view is expressed in PLTL, while functional properties such as route validity, centerline following, and hold-short stopping are expressed in many-sorted first-order logic. The paper identifies six research needs: semantics of composition of viewpoints expressed in different specification languages, libraries of formal models for autonomous systems, methods to lift verification results generated by automated reasoning tools to the specification level, probabilistic contract frameworks to reason about imperfect implementations, standard high-level functional architectures for autonomous systems, and a theory of higher-order contracts (Pinto et al., 2023).

Learning-enabled components amplify these issues. The recent AS2FM ROS 2 framework targets full ROS 2 systems including Behavior Trees and environment models, then converts them into JANI so that Statistical Model Checking can be used at design time; in a ROS 2-based robotic manipulation use case it successfully identified problems and was verifiable in less than one second using consumer hardware, while the reported verification runtime scaled linearly with the size of the model instead of exponentially (Henkel et al., 26 Aug 2025). By contrast, the stronger theoretical thesis advanced in “Computational Irreducibility as the Foundation of Agency” defines autonomy as universal computation in an agent–environment loop and proves that at least one non-trivial external prediction problem is undecidable for such systems (Azadi, 5 May 2025). That thesis is a formal account of autonomy rather than a consensus FMAS engineering assumption, but it sharpens a recurring AS2FM concern: strong autonomy and full external predictability need not be jointly attainable.

6. Case studies, limitations, and future directions

AS2FM has been instantiated in domains including autonomous cars, trains, satellites, quadrotors, manipulation systems, and airport taxiing. The quadrotor work models a search-and-retrieve mission in continuous time, then uses Monte Carlo simulation to calibrate a PRISM MDP; the resulting model checking bounds contained the Monte Carlo estimates for mission success, actuator fault probability, and expected mission time, illustrating an informed-abstraction workflow from realistic continuous dynamics to symbolic probabilistic verification (Ireland et al., 2016). In satellites, a Domain Specific Modelling Language based on the composition of deterministic finite state machines with safety conditions, timeouts, and transitions that accept durations as a parameter is compiled to Lustre to obtain a provably correct onboard telecommand verifier (Mussot et al., 2020).

The limitations are equally consistent across the literature. Scalability remains central: grid-based HJ reachability faces the curse of dimensionality, exhaustive model checking of rich autonomy stacks is often infeasible, and multi-agent systems require compositional or hierarchical methods (Bui et al., 2020, Yin et al., 2024). Heterogeneous-model composition remains semantically underdeveloped, particularly when protocol, geometric, dynamical, probabilistic, and learning-related views must be composed into one argument (Bakirtzis et al., 2022, Pinto et al., 2023). Tool maturity and explainability are also persistent issues: solver outputs are often detached from the level of contracts and functional architectures, and theorem-prover-centric workflows remain demanding for non-specialists (Pinto et al., 2023, Grov et al., 2016).

Future AS2FM work therefore converges on a recognizable agenda: richer libraries of reusable formal models and patterns; stronger integration of model-driven engineering with formal semantics; probabilistic and higher-order contract theories; safe learning under runtime or synthesized shields; and toolchains that preserve traceability from requirements to models, verification artifacts, and deployment-time monitors (Bakirtzis et al., 2022, Pinto et al., 2023, Henkel et al., 26 Aug 2025). The overall direction is not toward a single universal formalism, but toward systematic mappings between autonomous-system artifacts and interoperable formal models that preserve enough semantics for rigorous reasoning while remaining computationally tractable.