Model-based Programming: From Embedded Systems To Robotic Space Explorers

Transcription

1 Model-based Programming: From Embedded Systems To Robotic Space Explorers Brian C. Williams CSAIL Massachusetts Institute of Technology

2 Failures Highlight The Challenge of Robustness Clementine Mars Climate Orbiter Mars Orbiter Mars Polar Lander courtesy of JPL

3 Complexity Is In Coordinating Subsystems Large collections of devices must work in concert to achieve goals Devices indirectly observed and controlled. Must manage large levels of redundancy. Need quick, robust response to anomalies throughout life.

4 Mars Polar Lander Failure Leading Diagnosis: Legs deployed during descent. Noise spike on leg sensors latched by software monitors. Laser altimeter registers 50ft. Begins polling leg monitors to determine touch down. Latched noise spike read as touchdown. Engine shutdown at ~50ft. Fault Aware Systems: Create embedded languages That reason and coordinate on the fly from models Programmers are overwhelmed by the bookkeeping of reasoning about unlikely hidden states

5 Mission Design Begins With A Storyboard engine to standby

6 Mission Storyboards Specify Evolving States engine to standby Descent engine to standby : heating standby off sec

7 Mission Storyboards Specify Evolving States engine to standby Spacecraft approach: 270 mins delay relative position wrt Mars not observable based on ground computations of cruise trajectory

8 Mission Storyboards Specify Evolving States engine to standby Switch navigation mode: Earth-relative Inertial = Star IMU Tracker only + IMU

9 Mission Storyboards Specify Evolving States engine to standby Rotate spacecraft: command ACS to entry orientation

10 Mission Storyboards Specify Evolving States engine to standby Rotate spacecraft: once entry orientation achieved, ACS holds attitude

11 Mission Storyboards Specify Evolving States engine to standby Separate from cruise stage: cruise stage pyro latches stage

12 Mission Storyboards Specify Evolving States engine to standby Separate from cruise stage: when entry orientation achieved, fire primary pyro latch cruise stage pyro latches stage

13 Specify Evolving States engine to standby Separate from cruise stage: when entry orientation achieved, fire primary pyro latch stage

14 gine to standby Storyboards Elaborated With Failure Scenarios Separate from cruise stage: in case of failure of primary latch, fire backup pyro latch cruise stage stage

15 gine to standby Storyboards Elaborated With Failure Scenarios Separate from cruise stage: in case of failure of primary latch, fire backup pyro latch cruise stage stage

16 Like Storyboards, Model-based Programs Specify The Evolution of Abstract States Model-based executive maps between state and sensors/actuators. Embedded programs evolve actions by interacting with plant sensors and actuators: Read sensors Set actuators Model-based programs evolve abstract states through direct interaction: Read abstract state Write abstract state Embedded Program Model-based Embedded Program Obs S Plant Cntrl Obs S Model-based Executive S Plant Cntrl

17 Descent Example Turn camera off and engine on EngineA EngineB EngineA EngineB Science Camera Science Camera

18 Model-based Programs Control program specifies state trajectories: fires one of two engines sets both engines to standby prior to firing engine, camera must be turned off to avoid plume contamination in case of primary engine failure, fire backup engine instead Plant Model describes behavior of each component: OrbitInsert():: (do-watching ((EngineA = Thrusting) OR (EngineB = Thrusting)) (parallel (EngineA = Standby) (EngineB = Standby) (Camera = Off) (do-watching (EngineA = Failed) (when-donext ( (EngineA = Standby) AND (Camera = Off) ) (EngineA = Thrusting))) (when-donext ( (EngineA = Failed) AND (EngineB = Standby) AND (Camera = Off) ) (EngineB = Thrusting)))) Nominal and Off nominal qualitative constraints likelihoods and costs

19 Plant Model component modes described by finite domain constraints on variables deterministic and probabilistic transitions cost/reward Engine Model Camera Model (thrust = zero) AND (power_in = zero) (thrust = zero) AND (power_in = nominal) (thrust = full) AND (power_in = nominal) Off 2 kv Standby Firing 0 v kv 0.01 Failed one per component operating concurrently 0 v (power_in = zero) AND (shutter = closed) (power_in = nominal) AND (shutter = open) Off On 0 v 0.01 off- cmd standby- cmd standby- cmd fire- cmd turnoff- cmd turnon- cmd v 0 v

20 tate-based Execution: The model-based program sets the tate to thrusting, and the deductive controller.... Oxidizer tank Fuel tank Deduces that thrust is off, and e engine is healthy Plans actions to open six valves Deduces that a valve failed - stuck closed Determines that valves on the backup engine will achieve thrust, and plans needed actions.

21 OrbitInsert():: (do-watching ((EngineA = Firing) OR RMPL Model-based (EngineB = Firing)) Program (parallel (EngineA = Standby) (EngineB = Standby) Control (Camera Program = Off) (do-watching (EngineA = Failed) (when-donext ( (EngineA = Standby) AND (Camera = Off) ) Executes concurrently (EngineA = Firing))) Preempts Queries (hidden) states Asserts (EngineB (hidden) = Firing)))) state (when-donext ( (EngineA = Failed) AND (EngineB = Standby) AND (Camera = Off) ) Titan Model-based Executive Generates target goal states conditioned Control on Sequencer state estimates System Model State estimates State goals Open Open Closed Valve Close Stuck open Stuck 0.01 closed inflow iff outflow Tracks Mode Estimation Deductive likely Controller plant states Observations Commands Plant Tracks Mode least cost Reconfiguration goal states