Distributed Control Architecture forAutomated Surgical Task Execution with

Coordinated Robot Arms

Marcello Bonfe ∗ Nicola Preda ∗ Cristian Secchi ∗∗

Federica Ferraguti ∗∗ Riccardo Muradore ∗∗∗ Luisa Repele ∗∗∗

Giovanni Lorenzi ∗∗∗ Paolo Fiorini ∗∗∗

∗ Engineering Department, University of Ferrara, Italy (e-mail:name.surname@unife.it).

∗∗ Department of Science and Methods for Engineering, University ofModena and Reggio Emilia, Italy (e-mail: name.surname@unimore.it)

∗∗∗ Department of Computer Science, University of Verona, Italy,(e-mail: name.surname@univr.it)

Abstract: The paper describes a robot control and coordination framework for the automationof surgical tasks. In the proposed framework, surgeons are supported by autonomous roboticassistants and do not teleoperate robots, unless in case of exceptions in the tasks of therobots. Such robots perform basic surgical actions by combining sensing, dexterity and cognitivecapabilities. The goal is achieved thanks to rigorous assessment of surgical requirements,formal specification of robotic system behavior, including multiple arm coordination andhuman/system interaction, and control software development with state-of-the-art component-based technologies. The paper presents an experimental setup composed of two robots operatingon a US-compatible phantom, demonstrating the feasibility of the approach.

Keywords: Teleoperation, Finite State Machine, UML, Force Control.

1. INTRODUCTION

The introduction of minimally invasive surgery first and,more recently, of surgical robots, has brought new per-spectives to surgery and has significantly improved thequality of many critical surgical tasks. Nowadays, surgicalrobots are usually teleoperated by the surgeons, as inthe case of the well-known da Vinci by Intuitive Surgical(www.intuitivesurgical.com). A more recent telesurgey sys-tem has been developed by the German Aerospace Cen-tre (DLR) Tobergte et al. (2009). However, teleoperatedrobots are not the final answer to surgeon’s accuracy de-mands. The possibility to carry out simple surgical actionsautomatically has been the subject of academic research.A remotely-controlled catheter guiding robot was used inPappone et al. (2006) to automatically perform cardiacablation. However, an experienced operator is required toperform all the procedures. Several works (see e.g. Mayeret al. (2008)) have been done towards the automation ofknot tying in suturing tasks, but requiring manual help inseveral preparatory stages (e.g. grasping the needle). Au-tomatic scissors were proposed in Padoy and Hager (2011),namely the possibility for a surgeon to invoke a thirdrobotic arm to come and automatically cut the threadthat he/she is holding. Though all these works constitutesuccessful automation of simple surgical actions, validatedand commercially distributed autonomous surgical robots

? The research leading to these results has received funding fromthe European Union Seventh Framework Programme FP7/2007-2013under grant agreement n. 270396 (I-SUR).

are quite rare. A notable exception is represented by RO-BODOC (www.robodoc.com), a system capable of interven-tions on rigid tissues (i.e. bones drilling or cutting).

This work is a part of a research project whose goalis to develop a robotic system that can autonomouslyexecute surgical tasks on soft tissues. In particular, thispaper describes the design and realization of a roboticsystem, controlled by a distributed architecture, capableof autonomously executing US-guided insertion of nee-dles into soft bodies, emulating the surgical procedurefor percutaneous cryoablation of small tumoral masses.This task is also called simply puncturing. Exploitingthe framework proposed in Bonfe et al. (2012), we showthat formal methods can be applied to describe the US-supervised puncturing procedure in a precise way. Thisformal description enables automatically the design andsoftware implementation of the robotic control system.Furthermore, for validation purposes, we implemented theproposed architecture on an experimental setup, made bytwo robotic manipulators that autonomously perform thepuncturing task: one robot holds the needle and moves itaccording to a planned trajectory to perform the punc-turing, while the other robot holds an US probe whichimages are used to intra-operatively guide and controlthe needle insertion. Even the pre-operative planning isperformed automatically, by means of a software, in thefollowing called cryo-planner, that implements the algo-rithm proposed in Torricelli et al. (2013). Thanks to themodular and component-based architecture of the system,

Preprints of the 19th World CongressThe International Federation of Automatic ControlCape Town, South Africa. August 24-29, 2014

Copyright © 2014 IFAC 10213

the same methodology and design approach can be appliedto automate other simple surgical tasks.

The paper is organized as follows: Section 2 introducesthe surgical task selected as case study and the roboticsetup prepared for experiments; Section 3 describes theproposed methodology to collect the requirements andtranslate them into control-oriented specifications; Sec-tion 4 describes the proposed UML design and the systemarchitecture. Finally, results collected during the executionof needle insertion experiments are shown in Section 5,which is followed by conclusions in Section 6.

2. CASE STUDY AND ROBOTIC SETUP

This paper focuses, among the surgical procedures selectedto evaluate the feasibility of robotic automation, on per-cutaneous cryoablation of small tumors. Nevertheless, thesame methodology and design approach will be applied ina near future to automated suture. Percutaneous cryoab-lation requires the use of pre- and intra-operative images(CT, MRI/US) to insert, through the skin, one or morecryoprobe needles into the tumoral mass to be destroyedand to check the real-time position of the tools inside thepatient. Trajectory misalignments are usually due to thedeformation of soft tissues and organ displacement becauseof respiration. Thanks to real-time image registration andaccurately calibrated mechanical arms, needle insertionwould be precisely executed by the robotic system. Thecryoablation operation involves, once needles are correctlyinserted, cycles of freezing and thaw to create an iceballcovering and killing the tumoral cells, while preserving thehealthy tissue and the surrounding abdominal structures(see Permpongkosol et al. (2006)). Major complicationsrefer to bleeding and organ damages caused by the extrac-tion of the probes when the ice ball is not melted enough torelease the needles. The evaluation of the force applied toextract a needle from the patient is, for human surgeons,the only way to detect the melting status of the iceball.Even in this case, robotic assistants equipped with forcesensors and intraoperative processing of US images wouldincrease safety margins during completion of the surgicalprocedure.

To evaluate practical issues and benefits of cryoablationexecution by means of automated robots, an experimentalsetup has been prepared, as shown in Figure 1. The setupallows to emulate a cryoablation operation, apart fromthe actual freezing/defreezing cycle. In fact, cryoablationdevices can only be used in real operating rooms, while theexperimental system is installed in an academic labora-tory. The proposed system includes two industrial roboticmanipulator (Unimate Puma260 robots retrofitted withmodern control hardware and software): the first robotholds the needle, while the second holds the US probe.The end-effector of both robots is equipped with a specifictool adapter that integrates a 6-DOF force/torque sensor.Two types of phantom emulating a human abdomen havebeen used for experiments: in the first, artificial organs,produced using high-fidelity CAD models as described inOpik et al. (2012), are enclosed by a tissue that replicatesthe features of human skin; in the other, providing asimpler, lower cost and easily disposable alternative to thehigher-fidelity one, ex-vivo animal tissues are embedded

into a mixture of water and corn flour. In both cases, thephantom is compatible with US imaging. An 3-D opticaltracking system is used to estimate relative coordinatetransformations among the robots and the phantom. Fi-nally, the setup includes an ultrasound imaging devicewhose images can be visualized on a dedicated graphicalinterface for the surgeons and processed in real-time todetect the position of needle tip, as shown in Mathiassenet al. (2013), and provide intra-operative adaptation ofrobot motion trajectories.

Fig. 1. Experimental setup with coordinate systems andrelated transformations

3. CONTROL AND COORDINATION

3.1 Development process

Validation-oriented design is mandatory for the ap-plication domain of surgical robotics. Therefore, de-sign specifications for control algorithms and supervi-sory/coordination logic have been formalized using a re-quirements engineering approach, which is a more andmore recommended practice for safety-critical systemsdesign. In particular, the methodology applied in thisproject, described more precisely in Bonfe et al. (2012),is developed as follows:

(1) Requirement collection: a group of expert sur-geons is interviewed on the objectives of the surgicalprocess, the main procedures (“best practice”) to beperformed, the elements of the domain and the criticalevents related to the surgical actions.

(2) Requirements engineering: surgical requirementsare expressed using a goal-oriented methodologycalled FLAGS (Fuzzy Live Adaptive Goals for Self-adaptive systems, see Baresi et al. (2010)). In partic-ular, the goal model formalizes structural and behav-ioral constraints with the Alloy language (see Jack-son (2012)) and Linear Temporal Logic (LTL, Pnueli(1977)).

(3) Operationalization: the goal model is transformedinto a sequence of operations and adaptations, satis-fying the goals of the surgical procedure. This task isformally defined as a constraint satisfaction problem,whose solution is obtained by using the SAT-solverKodkod embedded in the Alloy Analyzer tool, as

19th IFAC World CongressCape Town, South Africa. August 24-29, 2014

10214

shown in Torlak and Dennis (2008). As a result, thetool provides a state machine representing the wholesystem behavior.

(4) Modular System Design: the state model obtainedafter goal-oriented analysis is refined and partitionedinto the structural units of the overall automatedsystem, applying decomposition methods from classi-cal discrete systems theory and using UML (UnifiedModeling Language, www.uml.org) as a modeling tool.The UML model is then mapped into a component-based software architecture.

(5) System Verification: formal tools like Model Check-ing (see McMillan (1993)) are applied to verify thatthe UML system model preserves the properties ex-pressed by the goal model. This task requires theformalization of an appropriate semantics of the UMLbehavioral specification (i.e. State Diagrams of sys-tem components), since the UML language itself doesnot include a strictly formal one.

(6) Experimental Validation: this task is of coursemandatory before the clinical use of automated de-vices. Though the aim of the proposed research is toevaluate the feasibility of surgical robotics automa-tion only using artificial phantoms, demonstrationsinvolving expert surgeons directly interacting withthe system are primarily important even to achievethis goal.

3.2 System design

The autonomous system being designed in this projectis supervised and controlled by the following modules,corresponding also to software units distributed on dif-ferent computational platforms: a Surgical Interface, theRobot Controllers and the Sensing system with Reasoningand Situation Awareness capabilities. In particular, theSurgical Interface is a software-intensive system allowinghumans (i.e. surgeons and technicians) to drive the sys-tem during both the pre-operative and the intra-operativephase. In the first one, the focus is on detailed planning ofthe surgical intervention (e.g. enumeration and placementof cryoablation needles for maximal tumor coverage thanksto the cryo-planner of Torricelli et al. (2013)). Duringoperations, the interface should provide real-time visualnavigation of the surgical scenario and, if necessary, letsurgeons take control of the system (e.g. by switchingto teleoperated mode). The Robot Controllers are theunits implementing control of surgical actions and taskssequencing during the intraoperative phase. The event-driven behavior extracted from the goal model is mappedinto the control logic of each robot, specified by a UMLState Diagram. Safety-critical requirements put a strongdemand for strict coordination of these components withboth the Surgical Interface and the Sensing/Reasoningmodule. Finally, the composite sub-system implementingadvanced Sensing algorithms and Reasoning for Situa-tion Awareness provides support to the planning task,during the preoperative phase, and prompt identificationof anatomical changes or discrepancy between the tasksbeing executed and the nominal surgical plan, so thatappropriate corrective actions can be triggered. The inter-action among such system components has been specifiedwith the help UML Sequence Diagrams, which represents

scenarios compatible with a given collaborative behavioralspecification, including nominal task execution and possi-ble adaptations.

The complete behavioral specification of the robot controland supervision units is given by UML State Diagramsassociated to the control logic for the robot holding theneedle and for the robot holding the US probe. Figure 2shows the hierarchical state machine related to the needleinserting robot. As can be seen, the hierchical features ofUML State Diagrams allow to embed exception handlingmechanisms, by means of transitions exiting compositestates. In both state machines, in fact, the robotic taskcan be stopped because of an e STOP event, that can betriggered either by the surgeons, through the SurgicalInterface, or by the Sensing/Reasoning and SituationAwareness module. In particular, the latter is in chargeof detecting if the needle is too close or even touchinga forbidded region, like for example a bone, a nerve oranother organ not involved in the cryoablation, by meansof real-time monitoring of the needle motion within ananatomical atlas of the patient. Another undesired eventis triggered if any force value measured by the sensorsexceeds a given limit. Whatever is the exception event,if the task execution can be restarted after appropriatevalidation of the surgeons, the transitions marked bythe e taskRecovered event are executed. Eventually, thesystem allows the surgeon to switch to a teleoperatedmode.

2:NeedleTaskAuto

3:Ready

4:MovingToSkin 5:TouchingSkin

6:InsertingNeedle

7:MotionPaused

9:ExtractingNeedle

8:WaitCryoCycle

1:InitRobot

10:TaskStopped

e_TaskConfigured

e_skinReached

e_moveToReadye_moveToSkin

e_insertNeedle

e_insertNeedle

e_tumorReached

e_extractNeedle

e_extractNeedle

e_tumorReached

e_pauseMotion

e_skinReached

e_STOP

e_taskRecovered

e_taskAborted

e_taskCompleted

e_moveToReady

e_pauseMotion

11:TaskTeleoperation

e_teleopReqe_autoReq

e_taskAborted

Fig. 2. UML State Diagram of the behavioral specificationfor the controller of robot holding the needle

3.3 Model Checking

Formal verification of the UML design model requiresthe definition of its operational semantics, according to

19th IFAC World CongressCape Town, South Africa. August 24-29, 2014

10215

the execution model of the target implementation frame-work. Since the proposed UML design has been imple-mented using the component-based Orocos frameworkwww.orocos.org) and rFSM (written in Lua, www.lua.org),an execution engine for hierarchical state machines, thepeculiar features of the latter must be carefully consid-ered. A detailed analysis of the semantics of the rFSMmodel and its differences with the one informally describedby the UML standard can be found in Klotzbucher andBruyninckx (2012). Summarizing, the main differences are:UML assumes that events are queued and processed oneat a time, while rFSM collects all events occurred since theprevious step of the machine and clears them after the stepexecution; UML gives higher priority to transitions whosesource state is at lower hierarchical levels, while rFSMreverts the rule; rFSM does not support concurrency.

Assuming that an rFSM machine is embedded into agiven Orocos component with input and output eventports, it is possible to formalize the UML design modelimplemented in Orocos-rFSM as a modular transitionsystem, as described in Bonfe et al. (2005). The referenceprovides also rules to translate the formal model into theinput language of the Cadence SMV (Symbolic ModelVerifier) tool, which is still one of the model checkersthat handles most efficiently the well-known state-spaceexplosion problem.

It is important to remark that the events collection mech-anism of rFSM is quite different from the PLC-like execu-tion model described in Bonfe et al. (2005) and required aspecific adaptation. In particular, the modular features ofthe SMV language have been exploited to define an eventmodule, whose internal boolean state is true if the eventhas occurred, but has not been cleared by the executionof the step of its “container” rFSM module. The modulein SMV code is the following:

MODULE rFSM_EV(Event, Clear)

VAR Occurred : boolean;

ASSIGN

init(Occurred):=0;

next(Occurred):= case !Occurred & Event : 1;

Occurred & Clear : 0;

1 : Occurred;

esac;

The SMV module related to an rFSM machine will includean rFSM EV for each input and output event:

MODULE rFSM_Robot(ExecStep,e_STOP,..)

VAR

e_STOP_ev: rFSM_EV(e_STOP, (Exec = FINISHED));

..

Exec : {IDLE, STEP, FINISHED};

The module has also a boolean input ExecStep that triggersthe execution of its step. This input will be set by anexternal scheduling function. Input events are clearedwhen the step execution is completed, a condition definedby a value of the enumerated variable Exec.

The UML State Diagram specifying the behavior of anrFSM module is encoded preserving the hierarchy of statesinto variables with enumerated values like:

Root : {InitRobot, NeedleTaskAuto, TaskStopped, ..};

SUBNeedleTaskAuto : {Ready, ..., MotionPaused};

and the predicates to evaluate the current configurationof the machine, the set of enabled and firable (i.e. higherpiority) transitions and the initialization and execution ofa step, similar to those described in Bonfe et al. (2005).

An SMV program is completed by the declaration of amain module (i.e. the top-level) and by the specificationof desired properties of the system. As said before, thedesired properties can be expressed using LTL, in the sameway that leaf goals are specified by the goal model of therequirements specification.

4. SYSTEM ARCHITECTURE

In this section the main Orocos software components of thecontrol architecture developed for the experimental setuppresented in Section 2 are described. Such components arehighly configurable and reusable, so that in a near futurethey will be easily adapted to a newer robotic structure,specifically designed for the surgical applications addressedwithin the I-SUR project (www.isur.eu).

OptiTrack interface and Registration components:these components wraps respectively the communicationvia TCP/IP with the OptiTrack device and the algorithmsfor estimating the required homogeneous transformationsamong the reference systems of interest, shown in Figure 1.The first component provides the poses of the groups ofmarkers associated to the robot with the needle and therobot holding the US probe. The actual registration, in-stead, allows to estimate the transformation TO

R mappingpoints in the robot reference system ΣR into the OptiTrackreference system ΣO and transformation TO

T relating thereference systems of the trolley ΣT and of the robot.

All these homogeneous transformations allow us to per-form the following pre-operative initialization:

(1) map the points on the skin and inside the tumorcoming from the cryo-planner and given in the phan-tom reference system PP

skin, PPtumor into the global

reference system POskin, PO

tumor,(2) map these points into the two robot reference sys-

tems: PRnskin, PRn

tumor, PRusskin, PRus

tumor, where the nstands for needle and us for US,

(3) plan the movement of the robot holding the needleto guarantee a straight line trajectory in Cartesiancoordinate between PRn

skin and PRntumor,

(4) plan the movement of the robot holding the US probeto guarantee that the needle (i.e. the straight linetrajectory designed before) is in the working regionof the US probe.

Trajectory Generator component: this componentcan compute reference trajectories either in joint spaceor in Cartesian space, from a given initial position to thetarget position.

ForceSensor interface component: in the experimentstwo instances of this component have been used, one for anAtiMini45 force-torque (F/T) sensor, mounted on the USprobe holding adapter, and the other for an AtiNano17F/T sensor, mounted on the needle holding adapter.The component receives sensor measurements through aTCP/IP communication with Ati NetBox data-acquisitionsystem and provides a vector of double precision values,

19th IFAC World CongressCape Town, South Africa. August 24-29, 2014

10216

containing forces (Fx, Fy, Fz) and torques (Tx, Ty, Tz), ona real time output port.

Force/Position Control component: this componentimplements the joint space position control (using a PIDscheme) and a direct force control algorithm, implementedas an outer loop cascaded with position control, as de-scribed in Siciliano and Villani (1999). The outer forcecontrol loop is not always active, because the robots movefreely at the beginning and when they touch the phantoma force controller is needed.

SOEM Interface component: this component uses theSOEM (Simple Open EtherCAT master) to communicatewith the robot control electronics developed specificallyfor the proposed experimental setup. SOEM is an open-source project implementing an EtherCAT (Ethernet forControl Automation Technology) master node. The con-trol electronics includes a EtherCAT slave modules forencoder acquisition (Beckhoff EL5152) and analog outputs(Beckhoff EL4004), the latter connected to Maxon Motorspower amplifiers. Thanks to this software and hardwaresetup, the complete control system for a Puma260 robotcan be deployed as shown in Figure 3.

Fig. 3. Orocos components deployment for the controlsoftware implementation of the robot holding USprobe

Communication Bridge component: this componenthandles the communication among components running indifferent computers, so that the full collaborative behaviorof the overall architecture (i.e. including the SituationAwareness module and the Surgical Interface) can beexecuted. The component provide the additional degreeof flexibility and extensibility of the system, thanks to thedefinition of a specific Orocos-CORBA interface.

5. EXPERIMENTAL RESULTS

This section reports the result of an experiments whichcan be also seen in the video that can be found at http://youtu.be/HQkhNzm6O8I. The goal is to show and comparethe time series of forces and the states of the robotscontrol logic (see Figure 2) The proposed experimentalsetup goes through the following steps triggered by thesurgeon through the user interface:

(1) The surgeon pushes the Ready button. Both robotsmove from their nest position to the ready positionwhere the needle and the US probe are mounted. Atthe end of this phase both robots are in the “Ready”state.

(2) The surgeon pushes the Start button. The robotsreceive their nominal trajectories and move the needleand the US probe in contact with the phantom. Dur-ing this phase the robot controllers go through the fol-lowing states: “MovingToSkin” and “TouchingSkin”.

(3) When the surgeon pushes the InsertNeedle button,the robot holding the needle starts the insertion (“In-sertingNeedle”) until it reached the target point. Inthis case the state of its control logic is “WaitCry-oCycle”.

(4) Since the actual cryoablation is not available in thecurrent setup, the final step is for the surgeon to pushthe button Finish to bring the robots back in the“Ready” state.

Figure 4 reports the force applied by the US probe on thephantom, along the approaching axis only.

Fig. 4. Force applied to the US probe during the emulatedcryoblation task.

The robot starts from an initial idle state (1). Whenthe surgeon presses the Ready button the robot goesto a “ready” position (2). During this phase the forceis not controlled because the robot is moving in freemotion. In “Ready” the US probe is mounted on the end-effector. During the phase (3) the US probe reaches theskin and when the measured force along the main axisof the probe exceed a threshold (4), the force controlleris switched on. This controller stabilizes the force around2 N which guarantees a good quality of the US images.During the procedure, the probe executes some rotationsto emulate the research of the needle in US image, inphases (7),(8),(9). These rotations change a little bit theforce as it is possible to see in Figure 4. At the end ofthe procedure the robot is in a “TaskStopped” state ofthe rFSM. Figure 5 shows the force measured by the F/Tsensor located on the robot holding the needle along the

19th IFAC World CongressCape Town, South Africa. August 24-29, 2014

10217

main axis of the needle. The oscillations in the phase“Ready” (3) are only due to a small flexibility of thecurrent prototype of the needle holding adapter.

Fig. 5. Force applied to the needle during the emulatedcryoblation task. (The numbers refer to the states inFigure 2.)

In the “MovingToSkin” (4) phase the force changes be-cause the robot moves in free motion and the sensor isextremely sensitive. At the end of this movement the tipof the needle touches the skin and so the force is constant.During the insertion, the needle passes through differentlayers (skin, tumor) and this explains why the profile ofthe force increases (in absolute value). The force becomesstable during the “WaitCryoCycle” (8) state. After fewseconds the needle is extracted and so the force valueshave opposite sign. The needle is removed in state (5) andthe robot goes back in nest under pure position control.

6. CONCLUSIONS

In this paper we presented a robot control and coordi-nation framework for the automation of simple surgicaltasks. We formalized the design specifications using arequirements engineering approach and derived the statemachines for the control of the robots involved in the op-eration. Then, we implemented the proposed architectureusing component-based design tools, i.e. Orocos frameworkand rFSM, in order to handle properly the distributednature of our system. The proposed approach has beenvalidated through an experimental setup where two robotsexecute autonomously a puncturing task on a phantomreplicating the human abdomen. The goal of the experi-ments was to show and compare the time series of forcesand the states of the state machines controlling the tworobots. Future work aims at extending the task-relatedstate machines to include different operating scenarios.Then, we will implement the Situation Awareness moduleas it has been defined in the architecture proposed in thispaper and we will integrate it in the experimental setup.Finally, we will apply the same methodology proposedin this paper to perform other simple surgical tasks, e.g.suturing of planar wounds.

REFERENCES

Baresi, L., Pasquale, L., and Spoletini, P. (2010). FuzzyGoals for Requirements-Driven Adaptation. In Pro-ceedings of the International Requirements EngineeringConference, 125–134.

Bonfe, M., Boriero, F., Dodi, R., Fiorini, P., Morandi,A., Muradore, R., Pasquale, L., Sanna, A., and Secchi,C. (2012). Towards automated surgical robotics: Arequirements engineering approach. In Proc. of theIEEE RAS & EMBS Int. Conf. on Biomedical Roboticsand Biomechatronics (BioRob).

Bonfe, M., Fantuzzi, C., and Secchi, C. (2005). Verificationof behavioral substitutability in object-oriented modelsfor industrial controllers. In Proc. IEEE Int. Conf. onRobotics and Automation (ICRA). Barcelona, Spain.

Jackson, D. (2012). Alloy. http://alloy.mit.edu/.Klotzbucher, M. and Bruyninckx, H. (2012). Coordinating

robotic tasks and systems with rFSM statecharts. Jour-nal of Software Engineering for Robotics, 3(1), 28–56.

Mathiassen, K., Dall’Alba, D., Muradore, R., Fiorini, P.,and Elle, O.J. (2013). Real-time biopsy needle tipestimation in 2D ultrasound images. In Proc. of theIEEE Int. Conf. on Robotics and Automation (ICRA).Karlsruhe, Germany.

Mayer, H., Nagy, I., Burschka, D., Knoll, A., Braun, E.,Lange, R., and Bauernschmitt, R. (2008). Automationof manual tasks for minimally invasive surgery. InProceedings of the Fourth International Conference onAutonomic and Autonomous Systems, 260–265.

McMillan, K. (1993). Symbolic Model Checking: an Ap-proach to the State Explosion Problem. Kluwer Aca-demic Publishers.

Opik, R., Hunt, A., Ristolainen, A., Aubin, P.M., andKruusmaa, M. (2012). Development of high fidelity liverand kidney phantom organs for use with robotic surgicalsystems. In Proc. of the IEEE RAS & EMBS Int. Conf.on Biomedical Robotics and Biomechatronics (BioRob).

Padoy, N. and Hager, G.D. (2011). 3D thread trackingfor robotic assistance in tele-surgery. In Proceedings ofthe IEEE/RSJ International Conference on IntelligentRobots and Systems (IROS), 2102–2107.

Pappone, C., Vicedomini, G. Manguso, F., Gugliotta, F.,Mazzone, P., Gulletta, S., Sora, N., Sala, S., Marzi, A.,Augello, G., Livolsi, L., Santagostino, A., and Santinelli,V. (2006). Robotic magnetic navigation for atrialfibrillation ablation. Journal of the American Collegeof Cardiology, 47(7).

Permpongkosol, S., Nielsen, M., and Solomon, S. (2006).Percutaneous Renal Cryoablation. Urology, 68(1Suppl.), 19–25.

Pnueli, A. (1977). The Temporal Logic of Programs. InProceedings of the Annual Symposium on Foundationsof Computer Science, 46–57.

Siciliano, B. and Villani, L. (1999). Robot Force Control,volume 540 of Springer International Series in Engi-neering and Computer Science. Springer.

Tobergte, A., Konietschke, R., and Hirzinger, G. (2009).Planning and control of a teleoperation system forresearch in minimally invasive robotic surgery. In Proc.of the IEEE International Conference on Robotics andAutomation (ICRA), 4225–4232. Kobe, Japan.

Torlak, E. and Dennis, G. (2008). Kodkod for Alloy users.In Proceedings of the 1st ACM Alloy Workshop.

Torricelli, M., Ferraguti, F., and Secchi, C. (2013). Analgorithm for planning the number and the pose of theiceballs in cryoablation. In Proc. of the Int. Conf. ofthe IEEE Engineering in Medicine and Biology Society(EMBC). Osaka, Japan.

19th IFAC World CongressCape Town, South Africa. August 24-29, 2014

10218