Holistic Contingency Management for Autonomous Unmanned Systems

Transcription

1 Holistic Contingency Management for Autonomous Unmanned Systems Jerry L. Franke, Adria Hughes, and Stephen M. Jameson Lockheed Martin Advanced Technology Laboratories John G. Clark Lockheed Martin Advanced Development Programs Robert J. Szczerba Lockheed Martin Systems Integration-Owego Abstract Contingency Management the problem of recognizing, assessing, and responding to unanticipated events or conditions that impact plan execution is a key enabler for unmanned systems to become autonomous systems that is, able to carry out assigned tasks or missions without continuous human supervision. We present a concept and technology for holistic contingency management that addresses all levels of autonomous system mission execution from real-time flight-critical failures to long-term issues that can affect teams of vehicles. This concept features several key elements: Multi-level assessment: Monitoring, assessment, and response occur at multiple levels. Plan-based assessment: Monitoring is triggered by an assessment of dependencies and constraints on plan execution. Capability-based assessment: Ongoing assessment of vehicle mission-related capabilities based on subsystem and environment status. Predictive assessment: Monitoring and assessment of anticipated future events or conditions.

2 Team-based assessment: Assessment occurs not just of individual vehicles, but at the team level as well. We have implemented a holistic contingency management technology based on this concept to manage detection and response to unexpected events in unmanned vehicle operations. We will describe this Mission Effectiveness and Safety Assessment (MENSA) technology and its application to a number of Department of Defense autonomous system programs. Introduction While removing the pilot from an unmanned vehicle provides numerous advantages (including pilot safety, multiplication of force, and the automation of routine and dangerous missions), the unmanned vehicle paradigm presents a significant challenge to the pilot s situational awareness needed for effective decision making. The dynamics of the battlespace require rapid decision making using data about the state of the world surrounding the vehicle that an unmanned vehicle pilot does not have direct access to. This property makes rapid response to unexpected events during mission execution difficult without some aid to the pilot. The problem is exacerbated in the case of autonomous vehicles, in which the system itself must respond to problems. The sources of events affecting unmanned missions are many (see Figure 1). This requires a high degree of flexibility on the part of the unmanned system to attain mission success. A robust unmanned system must be capable of detecting an event, assessing the event s impact on the mission, planning a response to the system s changed circumstances, and executing those mission changes quickly and decisively. While significant research is being performed in the planning and execution aspects of contingency management, we have specifically addressed the contingency detection and assessment functions required to complete the overall decision cycle.

3 Weather Teammate Failures Vehicle system or payload failure Unexpected battlespace developments Changes in ROE or objective priorities Failure by needed external asset Figure 1. An autonomous unmanned system faces the influence of many unexpected events on its mission. Related Work Autonomous contingency management systems share properties with systems from a number of research areas ranging from low-level autonomic health diagnostics to tactical plan monitoring for command and control. We review these ties below and define their places in the holistic contingency management spectrum in subsequent sections. Vehicle systems have a long history with the area of diagnostic health maintenance. Systems such as NASA s Livingstone [5] [6] provide model- or rule-based diagnosis of system faults for the generation of appropriate responses during mission execution. These systems allow a vehicle to recover from physical or electronic failures autonomically. Related prognostic systems help govern the proactive switching among redundant subsystems and/or execution modes to maintain successful operation of the vehicle. Initial attempts to integrate such systems with planning systems have been published in [4].

4 Reflexive response systems provide closed-loop response to specific sensor events, such as detected obstacles or weapons radar lock-on. Due to the reaction times required for these types of events, low-level mechanisms tend to be self-contained, specialized to the vehicle or subsystems involved, and operate independently of the unmanned system s plans. Contingency planning systems attempt to identify specific events that may occur in the future and plan alternate routes or courses of action to respond to those events [3]. Typically, these contingencies take the form of decision points in the plan at which multiple branches may be taken. This provides well-established, pre-determined responses to predictable events during the course of mission execution. The dynamic contingency management functions described in this paper provide a means through which contingency planning systems can be supplemented with systems that have the capability to trigger response to those planned contingencies in addition to unexpected events as well. Similar technologies have been explored in planning domains outside the world of unmanned system control. For example, Lockheed Martin s Air Campaign Monitor provides a means for assessing the severity of anomalies in the expected state of the battlespace with respect to air operations plans [1]. These operations plan execution monitoring systems are designed to help commanders make decisions about contingencies at an operations level. Operations plan execution monitoring systems operate on a larger time granularity than unmanned system mission execution, thus exist above the level of functional scope for autonomous system contingency management. However, such systems might use autonomous contingency management systems as one source of observables for their plan assessment functions.

5 Holistic Contingency Management To enable fast, effective response to the full spectrum of unexpected events an unmanned system may face, we consider a holistic approach that provides for monitoring and assessment at many levels of granularity, both in system complexity and in time (see Figure 2). This approach matches the current trend in hierarchical planners, which provide planning functions at multiple levels of scope. Figure 2. A holistic view of contingency management assesses mission success across a broad array of causes and timelines. At the lowest levels of the contingency management spectrum are the autonomic health maintenance and closed-loop control mechanisms that provide rapid response to immediate problems during vehicle operation. These functions cover contingencies such as obstacle avoidance, switching among redundant subsystems, turbulence compensation, and fire response. In developing our contingency management approach, we ve added further levels to the hierarchy. The first set of functions to be developed involved assessing the operating context of

6 an unmanned system with respect to the system s mission plans. Contingencies detected and assessed at this level include changes in vehicle operational capabilities due to changes in system health, tactical response to pop-up threats through avoidance or opportunistic targeting, adjustment of plans to account for changes in the weather or to meet new rules of engagement, or replanning due to changes in objectives. By extending mission-level contingency management temporally, the unmanned system can acquire the ability to look ahead and respond proactively to likely upcoming problems. A threat may not immediately affect a plan, but given its expected movement, will it cause a problem later in the plan? While a sensor s degraded capabilities may still be sufficient for the unmanned system s tasking, do health prognostics predict a continuing degradation or potential loss of function by the sensor? The ability to do predictive assessment of potential contingencies is a powerful tool for achieving mission success even in the most dynamic environments. Because multi-system, collaborative operations are being explored in many current programs, it is important to consider contingency management at a team level as well as at the individual system level. Team operations introduce new types of problems that must be detected and handled. If the team mission plan contains tasks that are collaborative (e.g., one system designating a target for another system to prosecute), how do modifications or delays in one system s plan affect the other system? If one system s needed sensor fails, can another member of the team take on that system s tasking? How does the current communications environment impact the team s coordinated plans? Assessment of events and conditions such as these provide a bridge between contingency management for a single system and high-level mission execution monitoring systems.

7 Implications on Planning Systems The introduction of holistic contingency management into unmanned systems suggests a variety of design criteria to autonomous planning systems. Plans generated by the system should include information about the factors considered in forming the plan, including hard constraints on objective timelines, acceptable tactical risk, and resource use. In addition, the planner should accept the dynamic introduction of new constraints or modifications to existing constraints as mission execution yields events that modify both the vehicle and battlespace state. One example of such a planning system is Lockheed Martin s TeamWorks multi-vehicle planning system (see Figure 3). TeamWorks planning provides task allocation for teams of multiple heterogeneous vehicles and autonomous unmanned missions with a variety of mission objective types. Based on numerous mission variables (e.g., fuel, fuel burn rate, available weapons/sensors, weather, threats, etc.), the system generates routes for each vehicle in a team to produce the optimal overall team plan. New events, such as pop-up threats and new objectives, can be added to the constraint mix dynamically to allow the system to generate a plan cost analysis to determine how the team should best handle the new event. To support the dynamic replanning aspect of its operation, TeamWorks planning interacts with Lockheed Martin s contingency management system, described in the next section. Figure 3. TeamWorks is one example of an autonomous planning system that can support dynamic response to contingencies at the mission level.

8 Implementing Contingency Management To provide a standard means for inserting the capabilities necessary to apply our holistic contingency management approach to varied unmanned systems, we developed the Mission Effectiveness and Safety Assessment (MENSA) architecture (see Figure 4). MENSA provides the necessary monitoring and assessment functions required for detecting and responding to unexpected events during unmanned missions. MENSA is constructed to interoperate with a variety of autonomous planning systems in a number of different domains via a set of clear, standard interfaces. Because of this design choice, MENSA can also be used directly as a decision aid for unmanned system operators. Plans, status, environment data, commands Input Processing Alerting Replan alerts CM Administrator Plan Dependency Analysis Plan Impact Analysis Contingency identification Monitoring Manager Monitor, assessor tasking Contingency detection Assessment Manager Pop-up Threat Target of Opp. Vehicle Health Comms Health Orders Change Monitors Sensor Health Weapons Health ROE Compliance Mission Safety Strike Capability Flight Capability Assessors Sensor Capability Tactical Effectiveness Figure 4. Our Mission Effectiveness and Safety Assessment (MENSA) architecture provides scalable contingency management functions for autonomous systems. Its scalable architecture makes MENSA highly flexible and broadly applicable. MENSA s monitoring and assessment functions are encapsulated by agents that are specialized to each

9 contingency type. These agents are activated through XML workflows, providing a means to quickly reconfigure MENSA dynamically during runtime. This agent-based design makes adding new functions or contingency types to the system simple and straightforward. By embodying the holistic contingency management approach, MENSA operates at multiple levels of the unmanned system organizational hierarchy. At the vehicle level, MENSA performs monitoring and assessment functions in relation to a single system s capabilities and mission. At the team level, MENSA performs monitoring and assessment functions in relation to a collaborating team of systems capabilities and mission. MENSA analyzes incoming mission plans to identify the capabilities of the system required for mission success along with other key plan dependencies, such as avoiding pop-up threats and following no-fly zone parameters. Having identified these dependencies, MENSA determines the elements of the vehicle s subsystems and environment it should monitor for status changes. While the system conducts its mission, MENSA continually monitors and evaluates both system state and battlespace conditions to detect changes that may affect mission success. Similar monitoring is performed for teams of systems. If a change is detected in one of the elements being monitored, MENSA assesses the event to determine if platform capabilities or battlespace environment has changed in a way that would affect the current mission. If the plan would be affected, MENSA produces a replan alert so that an autonomous planning system (or the operator) can replan around the new variables introduced into the system s operation. MENSA is designed to support real-world operations, which sometimes require exceptions to normal mission procedures and tactics to attain mission success. For example, while a vehicle typically should avoid exposing itself to a threat, some critical targets might require such

10 exposure to successfully prosecute. For those exceptional cases, we have provided an override mechanism to MENSA that allows an operator to instruct the system to suppress replanning related to one or more specific contingencies. By using the contingency override mechanism, the operator can better control the balance between vehicle safety and mission success at critical points in the mission plan. Because MENSA performs an overall assessment of a system s operational capabilities as part of its functions, MENSA can also report the health state of the system. The health state contains details of the system s operational capabilities (such as maximum speed, remaining endurance, etc.) in addition to individual subsystem health status. MENSA s assessment of operational capabilities mimics the reasoning an unmanned system s operator performs when making decisions during planning. MENSA performs the same assessment functions for aggregations of capabilities at the team level. Integration with Mission Management Architectures The MENSA contingency management capability is a key component of overall unmanned system mission management architectures, tightly integrated with an avionics system. The following section outlines a representative dynamic mission management architecture to provide a context for the MENSA component. The architecture, known as the KineForce Mission Management Architecture, was developed by Lockheed Martin for the dynamic mission planning and execution of heterogeneous manned and unmanned vehicle teams [2]. The system is segmented into seven major components (see Figure 5) that each impact the contingency management process: Contingency management: Detects, assesses, and responds to unexpected events. Mission planning: Develops plans and replans for the team and for individual vehicles.

11 Collaboration: Manages interaction among team members and provides team membership status. Situational awareness: Creates Common Relevant Operating Picture (CROP) for team that captures battlespace state. Communications management: Manages the interaction with the vehicle s communications systems and provides communications status. Air vehicle management: Manages the air vehicle s flight systems, sensors, and weapons, providing status for each subsystem, and generates low-level reflexive response trajectories. Resource meta-controller: Manages mission processor resources and provides mission management processor state. Collaborative Autonomy Mission Management Resource Meta-Controller Mission Planning Contingency Management Functional Modules Situational Awareness Intelligent Agents Collaboration Air Vehicle Management Communications Management Knowledge/Data Models Air Vehicle Flight Control System Weapons/Sensors Communications Figure 5. The KineForce system is one example of an autonomous mission management system that takes advantage of advanced contingency management capabilities.

12 As a part of this architecture, MENSA implements contingency monitoring and plan impact analysis for mission events such as air vehicle flight capability degradation, pop-up threats and targets of opportunity, friendly and neutral movement within the battlespace, loss of team members, and mission equipment failures. MENSA can also determine when an emergency mission abort is required and provides the system s operator with control over the level/type of contingency monitoring performed. MENSA analyzes mission plans and information regarding the changing situation (e.g., new objectives, new constraints, new obstacles, new threats, new targets, and changes in vehicle/team capabilities), issuing alerts when plans will no longer satisfy objectives and constraints. At the team level, MENSA receives alerts of contingencies that cannot be handled at a vehicle level and issues replan alerts to team mission planning components to redistribute tasking among the team. This supports a team-wide contingency resolution escalation process where reaction to unplanned events that affect the execution of the vehicle system s mission (see Figure 6). In addition, MENSA performs team-level capability assessment, aggregating mission capability information from all team members into a definition of total system mission capabilities. MENSA, as part of the KineForce mission management architecture, has been used to demonstrate advanced autonomy concepts for multi-asset teamed operations in simulation. In addition, in 2005, the system provided contingency management services to Lockheed Martin test-flights of teamed SilverFox UAVs. MENSA triggered replans of the system s search objectives in response to team membership changes over the course of the mission and provided system capability assessment to the mission operator.

13 Figure 6. By supporting team-level assessment and replanning, MENSA enables a contingency escalation process in which only the contingencies that cannot be handled autonomously are elevated to the operator. Conclusions The ability to detect and respond to events that affect unmanned system plans is critical to achieving mission success and has, to date, been a roadblo ck to attaining higher levels of autonomy in unmanned operations. A holistic contingency management approach provides a structured framework for designing systems that enable robust mission execution. This approach, as reduced to practice in the MENSA general contingency management architecture, supports autonomous response to unexpected events encountered during mission execution. By applying MENSA to numerous planning and mission management systems in both simulated and physical system environments, we have demonstrated the effectiveness of the holistic contingency management approach in meeting high-level autonomy needs.

14 References [1] Allen, James P. and McCormick, John M., Adaptive Plan Monitoring Systems for Military Decision Support, Proceedings of the 2005 AAAI Spring Symposium, [2] Jameson, Steve, et al., Collaborative Autonomy for Manned/Unmanned Teams, Proceedings of the American Helicopter Society 61th Annual Forum, [3] Linden, Theodore A. and Glicksman, Jay, Contingency Planning for an Autonomous Land Vehicle, International Joint Conference on Artificial Intelligence, [4] Reichard, Karl M. and Crow, Eddie C., Intelligent Self-Situational Awareness for Unmanned and Robotic Platforms, Proceedings of AUVSI Unmanned Systems North America 2005, [5] Schwabacher, Mark, et al., The NASA Integrated Vehicle Health Management technology experiment for X-37, Proceedings of the SPIE AeroSense 2002 Symposium, [6] Williams, Brian C. and Nayak, P. Pandurang, A model-based approach to reactive selfconfiguring systems, Proceedings of the Thirteenth National Conference on Artificial Intelligence, 1996.