IMA Readiness for Autonomous Robotic Systems in Extraterrestrial Surface Exploration Missions S

Transcription

1 AIAA SPACE 2010 Conference & Exposition 30 August - 2 September 2010, Anaheim, California AIAA IMA Readiness for Autonomous Robotic Systems in Extraterrestrial Surface Exploration Missions S Mark Villela 1 Mitch Fletcher 2 and Brian Cornelius 3 Honeywell International, DSES 19019N. 59 th Ave., Glendale, AZ, Recent developments in hardware readiness are closing the technological gaps which limited the implementation of robotic autonomy in extraterrestrial surface exploration missions. Innovative applications of wireless technology and avionics architectural principles drawn from the Orion crew module, to name one example, provide solutions for several of these gaps. If future space exploration missions are to grow significantly more complex, greater levels of autonomy must be afforded to robotic systems. This paper describes how Orion s avionics architecture attributes can be leveraged to implement an independent, deterministic Safety partition that prevents non-deterministic autonomous applications from issuing unsafe commands. The certification issues endemic to having autonomous applications operating alongside humans is also addressed. Robust avionic architectures by themselves are not sufficient, requiring aggressive innovations in size, weight and power, to allow the avionics hardware infrastructure to meet stringent robotic mission requirements. The emerging next generation of integrated modular avionics addresses this challenge with smaller, but very capable platforms. Another technology gap being addressed through the use of avionics architectural principles and deterministic wireless technology is the coordination of multiple autonomous systems. As a proof-ofconcept, Honeywell has developed various algorithms and wireless hardware that lead to a deterministic, fault tolerant, reliable wireless backplane. Honeywell has developed a laboratory facility based upon the Simulation & Modeling for Acquisition, Requirements and Training (SMART) concepts. Through this SMARTlab facility multi-robot collaboration can be achieved via interaction of real and simulated robots, rather than requiring the presence of several costly, physical robots. By filling technology gaps associated with space based autonomous systems, recent advances in wireless and simulation technology, along with Orion architectural principles, provide the means for decreasing operational costs and simplifying problems associated with autonomous systems, including those requiring the collaborative work of multiple robotic assets. I. Introduction Executing significantly more complex extraterrestrial surface exploration missions will require the support from autonomous agents and robotic systems, to perform in-space assembly, in situ mining, robotic teleoperation over long communication link delays, etc. Current robotic operations, such as with the Mars Exploration Rovers, require a team of several specialists for each robot. Economic realities preclude this same level of support when numerous autonomous systems are required. Increased autonomy, resulting in decreased human operator interaction, is key to providing a cost-effective solution to this problem. However, governmental agencies have been notoriously reluctant to certify autonomous and typically non-deterministic systems, particularly if humans may be directly affected. For the past 15 years, Honeywell has developed multiple implementations of what has been described as the fifth generation avionics architecture. This successful Integrated Modular Avionics (IMA) architecture has proven to 1 Product Team Leader, Electronic Systems Engineering & Applications, mark.villela@honeywell.com. 2 Chief Engineer, Electronic Systems Engineering & Applications, mitch.fletcher@honeywell.com. 3 Staff Engineer, Electronic Systems Engineering & Applications, brian.cornelius@honeywell.com. 1 Copyright 2010 by the, Inc. All rights reserved.

2 require significantly less size, weight, and power than previous designs, which encourages its application to robotics systems for space exploration. In order to understand how IMAs provide solutions to many of the technical issues associated with space robotics, this paper first describes architectural principles that have proven instrumental to the success of IMAs in aircraft avionics, followed by proposed application of those principles to autonomous systems. The paper concludes with a description of the ongoing proof-of-concept efforts conducted by Honeywell to demonstrate the applicability of these principles to autonomous systems. II. Proven IMA architectural principles Honeywell s IMA architectural principles that apply to autonomous systems include: 1) Hardware & software modularity, commonality, and scalability 2) Full time and space partitioning 3) Table-driven coordinated operations 4) Memory mapped interfaces. Adherence to these principles provides a hardware and software infrastructure that minimizes the impact of system modifications, whether tailoring a core system for a specific application, changing a mission scenario, or upgrading components. Through the use of these architectural principles, responsibility for many of the system level control functions migrates from software developers to system engineers and system integrators. A. Partitioned Software Infrastructure Through a combination of hardware, software, and operational tools, a single computational platform may be robustly partitioned into multiple virtual computers (shown in Figure 1). To achieve a brick wall robust partitioning, its implementations must occur in four domains: 1) Memory space 2) Computation time 3) I/O access 4) Backplane access. In a partitioned architecture, each partition functions as if it were hosted on its own complete and unique computer. A hardware Memory Management Unit (MMU) enforces access rights to memory resources to ensure that a partition s memory resources are protected from access by other partitions. This approach also assures that software and memory failures do not propagate to other partitions. It is worth noting that the time and space Figure 1. Time and Space Partitioning. With time and space partitioning, partitions function as if they were hosted on separate processors. partitioning can also be expanded to include Input/Output and Backplane access partitioning, as demonstrated by Honeywell s expansion to the ARINC-653 standard. B. Table-Driven Control & Memory Mapped Interfaces Each partition may be allowed to communicate with other partitions or directly with I/O devices. This data flow is handled by the system infrastructure, based upon pre-defined system tables that are used by the underlying infrastructure to allocate and control physical processor resources, memory, I/O resource access, and backplane traffic. This scheme creates a highly deterministic, high-reliability system, i.e., data needed by an application is available in local memory when required, and data produced by an application is placed in local memory where the system infrastructure retrieves it and makes it available for consumption where expected (Figure 2). 2

3 In a robust IMA implementation, no partition is allowed to contaminate another partition's code, I/O, or data storage areas (space partitioning); no partition is allowed to consume shared processor resources to the exclusion of any other partition (time partitioning); no partition is capable of consuming I/O resources to the exclusion of any Figure 2. Independence of Applications. The system infrastructure controls movement between partitions, including the I/O partition, according to pre-defined tables. other partition (I/O partitioning), or cause adverse affects to any other partition as a result of a hardware or software failure unique to that partition. These factors allow a partition running on a single processor to be modified without requiring re-certification of other partitions running on the same processor. Partitions with mixed criticality levels may reside in the same platform, without requiring all partitions to be certified to the highest criticality level. The implementation of this concept has already been certified by the Federal Aviation Administration (FAA). III. Application of IMA Principles to Autonomous Systems and Robotics As described in the introduction, a concern with increased robotic autonomy is its direct effect on the operational safety of a system. Honeywell realized that applying IMA architectural principles to autonomous robotic controls not only addresses safety issues but also provides a fresh approach to the complicated task of multi-robot collaboration. The following sections describe system solutions based upon IMA architectural principles that address each of these areas. A. Safe And Compliant Non-Deterministic Algorithms Two key issues concerning the teleoperation of space exploration robots are the large number of operators currently required to maintain control of each autonomous agent, and the relatively long delays in the communication links between a robot and mission control. As a reference point, the round-trip communication travel time between Earth and the moon is just over 2 seconds. Between Earth and the Sun-Earth L 2 point (about 1.5 million kilometers long) the round-trip light travel time is 10 seconds. For Earth-to-Mars communication, this delay can be as short as 6 minutes to as long as 44 minutes, depending on the relative position of both planets. If the Space Exploration program is to employ several robotic systems in surface exploration, it will need to mitigate the potential increase in facilities, manpower, and robotic autonomy required to support these systems. There must be a substantial simplification in the interaction between mission control and robotics systems. In order to simplify this interaction, autonomous agents must perform many of the decision making and control functions currently performed by human operators. However, these functions often require a degree of non-determinism that could potentially cause the robotic systems to operate in an unpredictable manner, potentially injuring humans or destroying critical equipment. The IMA infrastructure provides the means for isolating non-deterministic applications from the remainder of the system. This protects the autonomous system, and any humans or equipment in the mission theater, from unforeseen consequences that may arise from the use of non-deterministic 3

4 applications. The table-driven, memory-mapped nature of the IMA architecture assures that no unsafe commands can be sent to the system actuators. Figure 3 illustrates this capability. Since no partition is allowed to interfere with the operation of another partition, the impact of any uncontrolled activity by a non-deterministic partition can be bounded by the IMA infrastructure. Furthermore, since any extrapartition communication (with another partition or I/O device) is fully controlled by pre-determined system tables, buffer partitions can be placed between any non-deterministic application and the associated sensors and actuators. One of these buffer partitions, known as a Safety Partition, can be fully certified, for example, for use in proximity to humans. This partition would monitor the position of humans or other items of interest, and restrict the robot s autonomous operation if needed. All commands issued by mission applications, regardless of the level of determinism or non-determinisms, are transferred first to the Safety Partition. Only commands that comply with safety requirements are relayed to the actuators via Sensor/Actuator Access Partitions. Using this approach, even learning algorithms and neural networks may safely operate in a human-rated environment or any other area with high value assets that might be susceptible to damage by a rogue robot. Under this scheme, only the safety partition would require certification for safe operation. Application software would be relieved of the requirement for safety certification, allowing previously un-certifiable software to be used in the presence of humans or other critical assets. Application of a system architecture that can assure the safety of humans and equipment against the effects of non-deterministic applications may prove sufficient to bridge the gap that has existed between non-deterministic systems and government certification. B. Wireless virtual backplane and multi-robot collaboration A key Honeywell communication architectural concept, known as Virtual Backplane, is a method for interfacing a variable numbers of nodes in such a way that they all appear to be peers. Regardless of the physical architecture for interfacing the nodes, all I/O data are available to all applications, as if the I/O interfaces were directly connected to the host processor (Figure 4). While the Virtual Backplane was originally designed for interactions between various dissimilar functions onboard commercial aircraft, the architectural concept applies equally well for coordinating multiple robots. This architecture also allows for modules to be optimally defined to reduce weight and to allow local thermal issues to be considered in the architectural implementation. Additionally, new modules (or robots) can be added for extended availability, increased redundancy, and/or increased processing and/or I/O capability. The ability to add or remove modules with little impact on the existing architecture provides an approach that is easily scaled to meet program requirements. We expanded the Virtual Backplane concept to a wireless environment (see Figure 5). The wireless Virtual Backplane architecture is an integration of multiple algorithms at various networking layers, and is currently in a development stage. 4 Figure 3. Safe and Compliant Control System. IMA architectural principles provide the infrastructure for the safe use of non-deterministic algorithms Figure 4. Virtual Backplane Implementation. The Virtual Backplane logically connects each unit, regardless of the physical implementation.

5 In order to have a wireless Virtual Backplane as the communication infrastructure for safety-critical control applications hosted by Honeywell s modular integrated avionic architecture, two technical hurdles have to be conquered. First, the wireless Virtual Backplane will provide end-to-end deterministic communications (cardinal and ordinal determinism). Second, the wireless Virtual Backplane should guarantee the information integrity and communication reliability required by safety-critical controls applications. In addition, since robots are moving end systems, the wireless Virtual Backplane needs to satisfy the above requirements with mobility (i.e., variable distance, speed, and heading direction). Solutions to these two problems are described below. Most of robotics control commands are transmitted in periodic traffic (in multiple different frequencies). Due to the real-time processing requirements, these commands must be transmitted deterministically both in time and in order. In addition, transmitting safety-critical data with cardinal and ordinal determinism is also an effective way to explicitly detect the originator of misbehaviors (identifies when a fault happened and therefore who generated it). Real-time safety-critical system architecture with cardinal and ordinal determinism would dramatically improve system reliability, and therefore form the foundation for upper layer deterministic applications. However, most of existing wireless systems use collision detection and avoidance type of algorithm to contend for access to RF media. When such a system is used with a real-time schedulable operating system, it would not only degrade the determinism already scheduled by applications and the operating system, the arbitration process would also result in packet losses. Funded by Honeywell internal R&D, we have developed, implemented, and demonstrated a deterministic wireless system, which uses Time Division Multiple Access (TDMA) at the Media Access Control (MAC) layer to regulate the access to media. Our deterministic wireless systems have been demonstrated in a multi-robot IMA control environment, with results showing that packet loss rate and effective throughput are dramatically improved. During the system architecting phase of this project, we plan on defining a way to integrate this technology into a wireless Virtual Backplane network stack, which in turn will be integrated with a modular integrated avionics platform. With the development of a wireless Virtual Backplane, a new approach can be developed to address the complex task of multi-robot collaboration. Currently, multi-robot collaboration is largely viewed as a networking problem dealing with multiple independent systems. With a wireless Virtual Backplane architecture, the logical architecture is unaffected by the physical location of sensors, effectors, and processing elements. Therefore, a single control application may treat the Figure 5. Wireless Virtual Backplane. a reliable, deterministic wireless comm. scheme enables a Virtual Backplane approach to multi-robot interaction. Figure 6. Multi-Robot Collaboration. Use of IMA architectural principles provides a scheme for treating multiple robots as a single system. entire multi-robot system as a single entity, with each robot hosting a subset of the overall collection of sensors and effectors (see Figure 6). 5

6 Using this scheme, the correlated control of the multiple robots is simplified from a problem in networking and collaboration to one of a single application running on one robot correlating the activities of multiple sensors and effectors on multiple robots. Alternately, the control application could reside in multiple partitions on one or more robots, but the end result is similar. In either case, the processing power necessary to implement the control application can be hosted in a limited number of robots, while the processing elements on the remaining robots could be minimized to reduce size, weight, and power. These simple controllers would be responsible for low-level control of the sensors, effectors, and robot actuators in response to commands from the control application. The control application could be redundantly hosted on multiple robots to provide a fault-tolerant system architecture. C. Miniaturized Re-Configurable Avionics Robust IMA architectures, by themselves are not sufficient, requiring aggressive innovations in size, weight and power to allow the avionics hardware infrastructure to meet the stringent robotic mission requirements. The emerging next generation of integrated modular avionics is taking this challenge head-on, with improvements aimed at allowing their use in smaller space exploration vehicles. Reduction of Size, Weight and Power (SWaP) is paramount for next-generation space avionics, ultimately resulting in avionics units similar in SWaP to today s average Smartphone. In the past 2 years, Honeywell has been aggressively pursuing miniaturization of electronics building blocks to facilitate this leap forward in technology, via IR&D projects. Honeywell has developed concept designs for miniaturized re-configurable avionics equivalent to 1/10 th of the SWaP of the current Orion Vehicle Management Computer (VMC). This savings is achieved primarily through miniaturization of many of the building blocks used in space avionics processor, I/O controller, analog, and digital interfaces. The processing solution will consist of System-on-Chip (SoC) devices configured as Self- Checking Pairs (SCPs) for high-integrity computing capability. As a first step, the VMC processor was shrunk to 25% of its original size using Multi-Chip Module (MCM) technology, and then further miniaturized using SoC technology (Figure 7). The Honeywell SoC will be developed using IBM s 45-nm Silicon- On-Insulator (SOI) technology and represents a throughput equivalent to 2x that of its Orion VMC counterpart at equivalent clock speed at 1/10 th the power. This throughput is expandable to 12x at higher clock speeds. The SoC contains IBM s 476FP next-generation Power PC processor, and also contains a massive array of embedded DRAM on chip, essentially a massive L2 cache. In addition, the SoC contains numerous I/O interfaces required for space avionics applications, and satellite I/O processors to facilitate data movement between the I/O system and main memory. The use of IBM s 45-nm SOI process results in a SoC that is relatively immune to Single Event Latchup (SEL) failures in radiation environments. The planned implementation uses 2 SoC configured as a self-checking pair in a modular System-in-Package (SiP) that also contains local power supplies and non-volatile memory (Figure 8). The I/O solution is comprised primarily of custom ASICs for I/O control and scheduling, analog I/O, and digital I/O signals. The I/O ASICs can be configured to interface with a variety of signal types analog discrete, RS-422, etc. such that a single I/O card design can be used in a wide variety of applications. For robustness over temperature extremes and radiation extremes, these devices may be implemented using the Silicon Germanium 6 Figure 7. VMC Processor Miniaturization. Figure 8. SCP SiP Concept.

7 (SiGe) library developed by the NASA Advanced Avionics Processor System (AAPS) project in conjunction with Georgia Tech University. Combined with the I/O ASICs mentioned above, Honeywell has proposed typical architectures for a variety of space applications, such as the Constellation Space Suit avionics shown in Figure 9. This IMA design benefits from a next-generation power supply design that employs a game-changing technology dubbed storage-free converter. Such technology permits dramatic SWaP reduction over traditional power supply designs by realization of a DC-DC converter that is above 99% efficient. Internal communications in the VMC are planned to be implemented via PCI Express (PCIe). This commercial standard will be ruggedized for space applications and includes operation modes that will dramatically reduce power consumption. As a companion to the miniaturized avionics, Honeywell has also developed the concept design for the next-generation of Time Triggered Ethernet Figure 9. Proposed Constellation Space Suit Avionics. (TTE) networks, identified as TT-E V2. In conjunction with partner TT-Tech, Honeywell is developing miniaturized electronics that will be used for deployment of a 10/100/1000base-T network, the higher-capability successor of the current Orion Time Triggered Gigabit Ethernet (TT-GbE) technology. IV. Honeywell Proof-of-Concept Efforts To demonstrate the applicability of the above concepts to autonomous systems and robotics, Honeywell has developed a Robotics System Integration Laboratory (RSIL) to support proof-of-concept demonstrations. Specifically, Honeywell has focused its early autonomous systems efforts on four inter-related tracks: 1) Robotics Figure 10. Robotics Moonyard. Honeywell s testbed includes a 100 x 100 moonyard. Controls Subsystem; 2) Autonomy; 3) Simulation and Modeling; and 4) Deterministic Wireless Communication. Applicability to robotics systems is demonstrated using commercial robots (3 MobileRobots P3AT robots) and a prepared moonyard. The moonyard measures approximately 100 x 100 and consists of a sand base with elevated and depressed areas, rocky fields, boulders, and 2 mounds (see Figure 10). A. Robotics Controls Subsystem Track The Robotics Controls Subsystem Track demonstrates the applicability of IMA architectural concepts to smaller systems such as mobile robots in space. Efforts include developing a baseline architecture for a common robotics control subsystem and scaling the architectural principles to meet the size, weight, and power budgets available. Initial efforts have concentrated on porting a commercial time and space partitioned real-time operating system, Green Hills INTEGRITY 653, to a representative processor. Current operational space robotics tend toward use of 100 MHz PowerPC processors. For initial testing, Honeywell is using a commercial processor board that exceeds the 100 MHz performance level due to lack of available alternatives. To demonstrate operational feasibility, the 7

8 processor clock speed has been de-rated to its minimum rate, and the available processor resources have been further de-rated via the offline IMA tools. Future efforts include adding full table-driven, memory-mapped control to the commercial ARINC-653 operating system. Demonstration of a prototype control subsystem for robots that incorporates IMA architectural principles provides the first step toward developing a common control system for a variety of robots, tailored to specific mission needs. B. Autonomy Track The Autonomy Track has focused on using time and space partitioning to demonstrate the concept of safe and compliant non-deterministic algorithms, as described earlier. IMA principles provide the infrastructure required to protect humans or critical equipment during operation of autonomous applications. Future efforts envision employing this safe and compliant infrastructure in the demonstration of a variety of autonomous applications, including multi-robot collaboration, autonomous mission planning and operations, and autonomous tasking of astronaut assistant robots. C. Simulation and Modeling Track Honeywell has developed a laboratory facility based upon the Simulation & Modeling for Acquisition, Requirements and Training (SMART) concepts developed by the Department of Defense. This SMARTlab Modeling and Simulation Facility has been used to provide a 3-dimensional simulation environment of various devices including robots and autonomous systems. Using this resource, Honeywell has developed simulations of the physical Figure 11. Virtual Moonyard. Modeling and Simulation Facility provides simulations of the physical moonyard and robots. moonyard and the MobileRobots robots and developed real-to-virtual interfaces that allow the physical and virtual robots to interact with each other, and with the physical and simulated environments. Multi-robot collaboration using several robots can be achieved via the interaction of real and simulated robots, rather than requiring the presence of several physical robots. Figure 11 provides a screen shot of the simulated moonyard with several simulated MobileRobots robots. D. Deterministic Wireless Communication Track Honeywell has developed a deterministic wireless communication scheme that applies TDMA algorithms to the MAC layer of wireless protocols. This scheme has been successfully applied to the Zigbee ( ) and protocols, with improvements that provide increased reliability and fault-tolerance, both required in order to implement a full wireless Virtual Backplane. A similar scheme is being applied to the protocol. Deterministic wireless communication has been demonstrated between robots, and between robots and a base station. V. Summary The Space program has the potential to use an unprecedented number of robotic systems for the surface exploration of moons, planets, and asteroids. However, current space robotics development and operation costs can be prohibitive if the number of robots increases significantly. To reduce these operating costs, decreased human control will be needed. However, this decreased control implies a level of autonomy that is normally only achieved through non-deterministic algorithms. To date, governmental certification authorities have been reluctant to qualify non-deterministic algorithms. Drawing from success in the aircraft industry, Honeywell has architected a controls infrastructure that addresses both of these needs. Architectural principles inherent in Honeywell s Integrated Modular Avionics systems form the basis of a hardware and software infrastructure that is flexible, scalable, and easily tailored to specific implementations or mission scenarios. These same principles enable a method for safely employing nondeterministic algorithms without fear of injury to humans or damage to critical equipment. In addition, applying 8

9 state-of-the-art wireless technology to this same architecture results in a simplified approach to multi-robot collaboration. Scientists and engineers are developing a new generation of avionics computational platform. With aggressive goals of size, weight, and power, this new hardware will enable the use of state-of-the-art avionics architectures in semi-autonomous and autonomous robots for space exploration. VI. Contacts Mitch Fletcher, Chief Engineer Honeywell International Inc. Defense & Space North 59th Avenue Glendale, Arizona Telephone: (602) Cell: (602) Fax (602) mitch.fletcher@honeywell.com Mark Villela, Robotics Product Team Leader Honeywell International Inc. Defense & Space North 59th Avenue Glendale, Arizona Telephone: (602) Cell: (623) Fax (602) mark.villela@honeywell.com 9