next up previous
Next: Contingent Failure Up: Miscellaneous Issues Previous: Branch Merging

Fail-safe Planning

As we discussed in Section 6.2, Cassandra's operation relies on being able to determine, even if only indirectly, the outcome of any uncertainty. However, this may not always be possible, and it is not a necessary precondition for the existence of a viable plan. In the bomb-in-the-toilet problem, for example, there is a valid plan that Cassandra cannot find: to dunk both packages.

This suggests a method for constructing plans in the face of uncertainty when the outcome of the uncertainty cannot be determined---what one might call fail-safe plans. Whenever uncertainty arises it is in principle possible that there might be a non-contingent plan that would achieve the goal whatever the outcome of the uncertainty. To find such a plan, the planner must construct a version of the contingency plan in which all actions in the contingency branches arising from the uncertainty will be executed unconditionally. Cassandra has been extended in just such a way, by adding a new type of decision, one to execute all branches in parallel [Collins and Pryor 1995]. A plan containing such a decision is only sound if none of the actions that must be performed to achieve the goal in one contingency interfere with any of the actions that must be performed in any other contingency, and the ability to perform the actions is independent of the outcome of the uncertainty. These conditions clearly hold for the bomb-in-the-toilet problem.

Cassandra can reason about this possibility because its labeling scheme distinguishes those actions that must not be performed in a given contingency from those that need not be performed. It is possible to execute all branches only if the actions in each branch may be performed (but need not) in all the other branches.

When a parallel decision is added to the plan in the extended version of Cassandra, new goals are added in the usual way but the labeling is handled differently. The branches are not separated, so that Cassandra can no longer reason that the causal links in one branch will not be affected by actions in another branch.



next up previous
Next: Contingent Failure Up: Miscellaneous Issues Previous: Branch Merging



Louise Pryor <louisep@aisb.ed.ac.uk>;
Last modified: Mon Mar 18 18:07:50 1996