First GoPiGo3 Robot Runs "Validated Safe" URML Program

[slowrunner]

GoPiGo3 Robot "Lyrical-Dave" Ran A URML Program!

Be careful what you type - your robot may be listening. This morning I awoke to notices that the URML/examples/gopigo3 had been updated to notice a real robot was available when running a URML program.

Not being awake enough, (only one cup of coffee...), I did a git pull to bring the updates down to my GoPiGo3 robot Lyrical-Dave, and copied the GoPiGo3 "runtime" into my test folder, and typed ./run_adapter.py -h out of habit when about to attempt new code.

I was immediately alerted to my error, by the sound of Lyrical-Dave's motors coming from the next room. Oh boy, what trouble did he get into now?

(gopigo3) ubuntu@U26LDave:~/LyricalDave/systests/urml/mygopigo3$ ./run_gopigo3.py -h
[gopigo3 example] using the real easygopigo3 backend
wrote /home/ubuntu/LyricalDave/systests/urml/mygopigo3/gopigo3-report.txt

I raced into the next room to see Dave spinning 90 degrees and driving under a chair. My heart was racing as fast as Dave.

I checked the report to see what "validated safe" URML program I had unintentionally unleashed:

(gopigo3) ubuntu@U26LDave:~/LyricalDave/systests/urml/mygopigo3$ more gopigo3-report.txt 
URML on a basic GoPiGo3 (Raspberry Pi, easygopigo3, no ROS) - Discussion #523.
English-shaped intent, validated against the GoPiGo3 manifest, then executed
onto the wheels. Frameless robot, so motion is `drive` / `turn` by amount (RFC-0630).
robot: gopigo3_basic   drive_type: differential   max drive: 2.0 m

[VALID] announce, then drive 1 m (the translated command from #497/#523)
   executed 2 steps, success=True
   wheel + speech calls, in order:
     emit_speech  -> espeak 'Driving forward 1 meter'
     drive_by     -> easygopigo3.drive_cm(100.0)

[VALID] short patrol: turn, drive, turn, drive, announce, report
   executed 6 steps, success=True
   wheel + speech calls, in order:
     turn_by      -> easygopigo3.turn_degrees(90.0)
     drive_by     -> easygopigo3.drive_cm(50.0)
     turn_by      -> easygopigo3.turn_degrees(-90.0)
     drive_by     -> easygopigo3.drive_cm(50.0)
     emit_speech  -> espeak 'Patrol complete'
     emit_report

On a GoPiGo3 with the GoPiGo3 software installed (see Dexter Industries'
Installation FAQ), the real easygopigo3 is used automatically and these same
validated programs drive the wheels. No code changes are needed.

I don't recall hearing Dave speak, so I have some debugging of the emit_speech primitive after my heart calms from Dave obediently performing the "intent" it heard.

Of course, Dave wanted to tell the world

https://fosstodon.org/@cyclical_obsessive/116811057601974296

[idoco2003]

This made my day. Lyrical-Dave is the first robot anywhere to run a validated URML program, and I love that he did it before you finished your coffee.

You also found a real bug, and an embarrassing one for a project whose whole pitch is validate before actuate: the example drove your robot when you typed -h. That is on me. A demo should never surprise-move a robot, least of all this one.

Fixed in PR #543:

• The script is now a dry run by default. A bare run, or -h, validates and prints the planned wheel and speech calls and moves nothing.
• To actually drive the wheels you pass --execute, which prints a warning first. It still auto-detects the real easygopigo3, but only when you opt in, and with no code to edit.

So now ./run_gopigo3.py -h does what habit expects, and ./run_gopigo3.py --execute is the "let Dave loose" button.

On the silence: that was a gap too. The default speech backend is espeak, and if espeak is missing or the Pi has no audio out, it said nothing and gave you nothing to debug. It now prints on stderr when it cannot speak. Better still, Dave already has a say node, so pass your own speak callback and route "announce" through it, no espeak needed:

GoPiGo3Adapter(speak=lambda text: dave_say(text))

Thank you for running it for real, footgun and all. That is the first time the whole loop, English to validated program to a robot actually moving, has closed outside my own machine. Dave earned the Mastodon post.

Thanks,
Ido

[idoco2003]

@slowrunner this is going up on urml.dev as a field note, crediting you and Dave. As last time, here is the near-final before it goes live, so you can change anything, especially anything about you or Dave.

It reuses the Lyrical-Dave photo you shared, credits you as @slowrunner with links to your LyricalDave repo and your Mastodon post, and it is honest that the footgun was ours, not yours.

---

This week a community member who goes by @slowrunner closed the loop the whole project is built around. An English sentence, validated into a robot program, executed on real hardware. His GoPiGo3, Lyrical-Dave, drove across the room. Then it drove under a chair.

Lyrical-Dave, @slowrunner's GoPiGo3 ROS 2 robot. Photo: @slowrunner.

The headline

This is the first time the full URML loop has run end to end outside a maintainer's machine: English, to a validated program, to a robot that moves, on an educational two-wheel buggy and a Raspberry Pi, with no cloud. The loop closed on someone else's robot, in their own home. That is the milestone.

How it actually happened, which is the better story

We had just shipped an update to the GoPiGo3 example so it would notice a real robot and use it. @slowrunner pulled the update onto Dave, copied the example into his test folder, and ran it with -h, out of habit, expecting a help message. Instead he heard motors in the next room. He raced in to find Dave spinning ninety degrees and heading under a chair, his heart, in his words, racing as fast as Dave's.

He told it himself, with good humor: be careful what you type, your robot may be listening.

The part we are not proud of, and fixed

URML's entire pitch is validate before actuate. Nothing moves until it is checked. And our own example moved a robot when someone typed -h. That is precisely the failure the project exists to prevent, and we had built it into the demo.

So we fixed it the same day. The example is now a dry run by default. Run it, or run it with -h, and it validates the program and prints the wheel and speech commands it would issue, and moves nothing. To actually drive the robot you pass --execute, which warns you first. Actuation is opt-in, the way it should have been from the start.

The lesson is the project's own, turned back on itself: a validated-safe program is only safe if running the tool cannot surprise you into executing it. The gate has to sit in front of the motor, including in the demo.

What the robot was actually told

The "validated safe" program Dave ran was a short patrol: announce, drive a meter, turn, drive, return home. Every step had been checked against Dave's declared capabilities, a frameless two-wheel buggy with wheel encoders, before a single wheel turned. The validator did its job. The demo's invocation did not. Now both do.

One footnote: Dave moved but stayed silent. The example's default speech path is espeak, and on Dave it produced no sound and, worse, no error. That was a gap too, so the adapter now says on its log when it cannot speak, and a robot with its own voice, like Dave's ROS say node, can be wired straight in.

Why we are writing this down

The validator-first design held: the robot did only what was declared possible and checked safe. What failed was operational glue around the demo, and a user caught it on his own hardware in the most memorable way possible. That is what early adoption looks like, and it is worth more than a clean launch.

The full thread, including Dave's own account, is on the discussion board. Lyrical-Dave's code is at github.com/slowrunner/LyricalDave.

---

If that reads right to you, it goes live. Anything to fix, just say and I will change it.

Thanks,
Ido

[slowrunner]

The description of "patrol" is not accurate - and including the urml can create a "teaching moment"

        "profile": ["educational"],
        "behavior": {
            "type": "sequence",
            "on_error": "abort_and_report",
            "steps": [
                {"turn": {"angle": 90}},
                {"drive": {"distance": 0.5}},
                {"turn": {"angle": -90}},
                {"drive": {"distance": 0.5}},
                {"speak": {"utterance": "Patrol complete"}},
                {"report": {"to": "run_log", "facts": {"patrol": "done"}, "status": "success"}},
            ],

otherwise "ready for pub". Dave is onto his next adventure learning to express himself in the "Universal" robot language.

[idoco2003]

Good catch, and thank you. That is exactly the kind of error I want caught before it sits on the site. You are right: it was turn ninety, drive half a meter, turn back, drive half a meter, announce, report, not "drive a meter and return home." Corrected (PR #41).

I also took your teaching-moment suggestion and put the actual program in the post, in full, with a line on what the validator checked against Dave's manifest before any wheel turned. One real URML program on the page is worth more than my prose describing it.

So it is fixed and going live with the URML shown, credited to you for the catch. Thank you for reading it that closely.

Enjoy Dave's next adventure in the universal robot language.

Thanks,
Ido