Human-Interactive Autonomous Flight Manager for Precision Lunar Landing

1
Human-Interactive Autonomous Flight Manager for
Precision Lunar Landing

• Lauren J. Kessler
• Laura Major Forest
• ljkessler_at_draper.com
• lforest_at_draper.com

2
Agenda

• ALHAT Overview
• Background
• Definitions
• Landing architecture for Apollo
• Autonomy Roadmap
• Initial Architecture Design
• Functions
• Architecture
• Autonomy
• Human Insertion
• Conclusions

3
ALHAT Project Overview

• Autonomous precision Landing and Hazard detection
  and Avoidance Technology (ALHAT)
• Lunar descent and landing GNC technology
  development project
• The Project includes
• Definition, design, development, test,
  verification, validation and qualification of an
  integrated GNC lunar descent and landing system
  to TRL 6 capable of supporting lunar crewed,
  cargo, and robotic missions

4
ALHAT System Level 0 Requirements

• 1. Landing Location
• The ALHAT System shall enable landing of the
  vehicle at any surface location certified as
  feasible for landing.
• 2. Lighting Condition
• The ALHAT System shall enable landing of the
  vehicle in any lighting condition.
• 3. Landing Precision
• The ALHAT System shall enable landing of the
  vehicle at a designated landing point with a 1
  sigma error of less than 30 meters
• 4. Hazard Detection and Avoidance
• The ALHAT System shall detect hazards, 30 cm and
  larger objects and slopes 5 degrees and greater,
  and provide surface target re-designation.
• 5. Vehicle Versatility
• The ALHAT System shall enable landing of crewed
  (humans on board), cargo (human scale without
  humans onboard) and robotic (smaller exploration
  vehicles without humans onboard) vehicles.
• 6. Autonomy
• The ALHAT System shall have the capability to
  operate autonomously (without command and control
  intervention from sources external to the
  vehicle).
• 7. Crewed Vehicle
• The ALHAT System shall accept supervisory control
  from the onboard crew.
• 8. Interoperability
• The ALHAT System shall be interoperable with
  other elements of the Constellation Architecture.
  
• 9. Standards
• The ALHAT System will adhere to the applicable
  set of measurement units, data and data exchange
  protocols defined by the Constellation Program.

5
AFM Task Motivation

• ALHAT
• Put some definition, thought, and FY07 planning
  towards the A in ALHAT (Aautonomous)
• Desire is to formulate and document an
  understanding WRT
• Defining an overall role of the autonomous flight
  manager (AFM)
• Defining a top level design architecture
  appropriate to ALHAT needs
• What is an appropriate split between the AFM and
  Guidance?
• What is an appropriate split between the AFM and
  HDA?
• What is the functional division between the AFM
  and the human?
• Suggesting a top level implementation
  architecture appropriate to ALHAT needs

6

• Background

7
ESMD Requirements
NASA Autonomy definition Independence from
Mission Control (Earth)

• There is a desire for increasing levels of
  operational autonomy capabilities in order to
  prepare for exploration beyond the Moon
• However, there is also a requirement for manual
  intervention of automated functions critical to
  mission success and crew safety

Exploration Systems Mission Directorate
ESMD-RQ-0011 Preliminary (Rev. E) Exploration
Crew Transportation System Requirements Document
(Spiral 1) Effective Date 24 Mar 2005. Page 31
of 45.
8
Level of AutomationApollo
Human control in a lunar lander
Highly automated lunar lander

• The importance of choosing the correct level of
  automation was recognized in the development of
  the Apollo program.
• Balance between overloading the astronauts and
  providing enough information and tasking so they
  are prepared for decision making if necessary.

9
BackgroundSheridans Levels of Automation

• The roles of the computer and the human depend
  upon
• Frequency of operator interaction
• Complexity of operator interaction
• Autonomy Must be Capable of Interacting Flexibly
  with Humans

Parasuraman, Sheridan, Wickens."A Model for Types
and Levels of Human Interaction with Automation."
IEEE Transactions on Systems, Man, and
Cybernetics-Part A Systems and Humans, Vol. 30,
No. 3., 2000.
10
Functional Flow of Apollo Astronauts and System
Crew input
GNC
Vehicle
Draper, C.S., Whitaker, H.P., Young, L.R. The
Roles of Mend and Instruments in Control and
Guidance Systems for Spacecraft. 15th
International Astronautical Congress, Poland,
1964.
11
Apollo Function Allocation
Role of Computer System
Role of Astronauts

• Sensor functions
• Terrain Relative Navigation (TRN)
• Landmark tracking to confirm location (during
  PDI)
• Hazard Detection and Avoidance (HDA)
• Determine if there are hazards in the landing
  zone via the reticle on the window
• Scheduling functions
• Astronauts gave the commands to change modes,
  start accepting radar data, etc
• Monitoring and diagnosis
• Astronauts constantly checked fuel levels,
  attitude, velocity, etc
• Manual control
• Semi-automated or fully manual

• Traditional GNC functions
• Navigation
• Current vehicle location
• Guidance
• Maneuver commands required to achieve guidance
  target condition
• Command examples rate of descent, attitude, etc
• Control
• Control actuation commands
• Command examples nozzle position, engine
  throttle, etc

Nevins, J.L., Man-Machine Design for the Apollo
Navigation, Guidance, and Control
System-Revisited. NASA report, January
1970. Klump, A.R., A Manually retargeted
automatic descent and landing system for LEM.
Report-539, March 1966.
12
Types of Astronaut Input

• Management by Interruption
• Guidance mode control
• Via the DSKY
• Changes to Guidance target conditions (P64)
• Designate a new landing aim point (via rotational
  hand controller)
• Inputs to Control (P66 semi-auto mode)
• Crew controlled the attitude to maneuver the
  vehicle by commanding the nozzles in the form of
  an angular acceleration command signal
• Altitude or altitude rate were held constant by
  the computer, the crew could change these through
  the Rate of Descent switch
• Vehicle commands (P67 - full manual mode)
• Crew controlled engine throttle manually
• Attitude was controlled by the Digital Autopilot
• This mode was rarely used because of the high
  workload required

Nevins, J.L., Man-Machine Design for the Apollo
Navigation, Guidance, and Control
System-Revisited. NASA report, January
1970. Klump, A.R., A Manually retargeted
automatic descent and landing system for LEM.
Report-539, March 1966.
13

• AFM Requirements

14
ALHAT Program

• GNC System Functions
• Determine current navigation state
• Determine vehicle commands needed to reach next
  state target condition
• Hazard Detection and Avoidance Functions
• Detailed sensor input on landing site
• Algorithms determine the characteristics of the
  landing site
• Identified Autonomy Need
• Mission management tasks to
• Replace heavy ground involvement during Apollo
• Reduce onboard crew workload and error probability

15
Need for Autonomous Flight Manager

• Apollo design resulted in high crew workload and
  room for human error
• Landing footprint capability was primarily a
  mental calculation and rough estimate
• Astronauts had to rely on memory stores developed
  through extensive training for vital information
• No relative size indicatorsastronauts reported
  significant difficulty sensing sink rates and
  lateral motion
• Limited redesignation options due to LM window
  constraints
• New Landing Requirements
• Lower risk
• Challenging terrain (close to an asset or
  feature)
• Higher precision
• Tighter budget
• Need for lower cost training
• Technology improvements enable automating many of
  the tasks required by Apollo astronauts to help
  in achieving the new requirements
• Example technologies that have paved the way
• Flight management systems autopilots
• Autonomous vehicles (e.g., UUVs)
• NASA technologies

16
Autonomy Requirements

• Autonomously provide adaptive behavior for
  unmanned operations
• Handle the dynamic nature of the missions within
  the boundaries of the pre-mission planning
• Un-assisted by earth-based support
• while allowing human-interaction in manned
  operations
• Without a separate, unique software solution
• In accordance with the Human Rating Requirements
• Allow for manual intervention of safety critical
  functions

17
Proposed Level of Autonomy
Supervisory control the human operator has the
authority to inhibit and/or override any
safety-critical automated function of the descent
and landing system

• Required for robotic missions
• Disallowed for crewed flights (HRR)

• Design target for crewed flights

Human Operator
Human Operator
Human Operator
Human Operator
Human Operator
Controller
Display
Controller
Display
Controller
Display
Controller
Display
Display
Computer
Computer
Computer
Computer


Minor loops closed by computer
Major loops closed by computer
Actuator
Sensor
Actuator
Sensor
Actuator
Sensor
Actuator
Sensor
Actuator
Sensor
Task
Task
Task
Task
Task
Manual Control
Fully Automatic
Supervisory Control
18
Types of Autonomy

• Premise
• Autonomous systems are an aid to humans rather
  than a replacement
• Focuses on the attributes of planning,
  perception, adaptation, learning and diagnosis
• Types of Autonomy
• Scripted
• Systems that are essentially autopilots
• Perform preplanned scripts of actions based on
  anticipated events
• Supervised
• Allows for an evolving mission sequence
• Intelligent
• Allows for an evolving mission objective
• Intended to execute abstract human directives
• Accommodates (adapts) to unplanned events

19
ALHAT Autonomy ChallengeProposed Level of
Autonomy

• Types of Autonomy

Scripted Perform preplanned scripts of actions
based on anticipated events
Supervised Allows for an evolving mission sequence
Intelligent Allows for an evolving mission
objective

• Implement at the supervisory level
• Dovetails with the goal of Human-supervisory
  control
• ALHAT System exchanges data with the landing
  vehicles cockpit
• Helps the ALHAT System to achieve the low level
  of risk required for a crewed vehicle
• Onboard human supervisory awareness is directly
  supported by the ALHAT System design
• Does not try to tackle the higher complexity and
  abstraction of evolving mission objectives
• Allows for real-time human insertion (in the
  crewed and cargo missions) while being flexible
  enough to replace the human (in robotic
  missions), with pre-planned decision rules.

20
ALHAT Function Allocation
Role of Computer System
Role of Astronauts

• Approval of specific scheduling functions
• Example Begin de-orbit
• Supervise the ALHAT closed loop tasks
• Monitor the following and diagnose any deviations
  from expectations
• Vehicle behavior, trajectory, surface landmarks,
  landing zone hazards, vehicle health and status
• Redirect AFM
• If there are unexpected deviations or changes to
  the mission goals, the crew can redirect the
  vehicle
• Input new target conditions
• Modify buffer on vehicle tolerances
• Issue an abort

• Traditional GNC functions
• Sensor functions
• TRN HDA
• Scheduling functions
• GNC mode changes
• Sensor data acquisition
• Monitoring and diagnosing
• AFM will compare current state against predicted
  state along the trajectory (including human
  input, health status)
• AFM will determine if state deviations require
  re-planning of landing sequence
• Re-planning
• AFM will adjust target conditions to create a new
  feasible plan (when triggered by diagnosis)

21
Functional Role of AFM
Vehicle
Optional manual control commands
Optional actuation commands
Control System
Maneuver commands
ALHAT
Guidance Navigation System
Optional guidance commands
Target conditions
AFM
Constraint changes, overrides, target conditions,
etc
Crew
22
AFM Architecture
23
Autonomy Software ArchitectureBased on
Sense-Act-Think Paradigm

• Drapers implementation All-Domain Execution
  and Planning Technology (ADEPT)
• Planner
• Creates plan and modifies current plan when
  necessary (triggered by Diagnoser)
• Can generate multiple plans, especially in a
  decision support role for human interaction
• Execution
• Interprets the current plan
• Issues commands to
• subordinate planning level
• physical system to be controlled

• Monitor
• Validates best estimates of the sensed data
• Monitors operation of the system being controlled
• Diagnoser
• Analyzes difference vector identified by the
  monitor
• Determine root cause impact on capabilities of
  system being controlled
• External Coordination Module
• Provides interface between system being
  controlled and other control elements e.g.
  humans, other systems

24
Hierarchical DecompositionOverview

• Temporal Decomposition
• Simplify implementation of solution to real-time,
  closed-loop planning problems
• Higher levels create plans with greatest temporal
  scope, but low level of detail in planned
  activities
• Lower levels temporal scope decreases, but
  detail of planned activities increases

• Functional Decomposition
• Each level of the planning hierarchy is
  decomposed into key functional components
• Inputs and outputs
• Connectivity/relationship
• Constraints (e.g. performance, operational)

Diagnosis
Plan Generation Selection

• Re-plan if needed
• Elevate issue to higher level (if required)

• Produce new mission plan

Monitoring
Plan Execution

• Check progress against plan

• Translate plan into executable command

25
Activity HierarchyExample
Mission
DeOrbitBurn
Coast
PreDescentPlan

• A mix of time-based decomposition functional
  decomposition

26
Trajectory Monitoring Planning

• The execution of the precision landing sequence
  will be governed by the use of state corridors
• Union of a family of possible state trajectories
  with associated guidance target conditions
• State includes such things as velocity, attitude,
  fuel usage, position, etc.
• Developed far in advance of the mission
• If there are deviations outside the nominal
  corridor, then AFM re-planning is triggered
• Re-planning consists of selecting new target
  conditions relative to preplanned state corridor
  options

27
Nature of Pre-calculated Trajectory Corridors

• GNC analysis and trade studies will be used to
  determine corridor approach and target
  conditions, including
• How the trajectory corridors will be defined
• Pre-calculated, or predict-ahead, or combination
• The hard target conditions used to define the
  phase transitions
• e.g. altitude, velocity, attitude, fuel state
• The AFM will not select from an infinite amount
  of options, only the set of contingencies will be
  considered
• Defining the corridors up-front
• Reduces required on-board computing
• Narrows the VV of the re-planning options to
  data developed far in advance of the mission

28
AFM Astronaut Insertion
29
Types of Astronaut InputInto AFM

• Management by Interruption (changes to the target
  conditions)
• Crew can update the conditions used by the AFM
  based on the evolving mission, within specified
  bounds (e.g., input a new landing aimpoint)
• Management by consent (Authority to Proceed)
• Execution will not occur unless the crew consents
  to a proposed action (e.g., de-orbit burn)
• Management by exception (time-outs)
• Execution will occur within a specified timeframe
  if the crew does not prevent the AFM from
  proceeding (e.g., phase change out of a
  non-sustainable orbit)

30
Specific Crew Interaction with ALHAT
SystemCalled out by the Level 0 Comments
Specific Crew Interactions with ALHAT
Types of Human Insertion

• Landing site re-designation
• Adjustments to the descent and landing planning
  constraints
• Mission phase initiation and approval
• Abort decisions
• Fault identification and recovery

• Management by interruption (changes to target
  conditions)

• Management by consent (Authority to Proceed)
• Management by exception (time-outs)

31
Crew Landing Site Re-designationExample
Notional display for terminal descent

• HDA sensors algorithms will identify hazardous
  regions
• AFM will determine alternate landing sites and
  present the top 5 alternate options with key
  information about each option
• Crew will not have to integrate data across
  multiple instruments to determine key decision
  criteria
• During landing, the crew can redesignate to any
  of the alternate landing sites
• New landing aimpoint will become an input to the
  AFM

32
Crew Landing Site Re-designation Low level
Insertion into AFM
Mission
PoweredDescent
DeOrbitBurn
Coast
PreDescentPlan
TerminalDescent

• The constraints of the lowest level controller
  are updated based on crew input
• This is handled similar to something in the
  environment causing a local re-plan

New landing aimpoint
33
Crew Landing Site Re-designation High Level
Insertion into AFM
Mission
TransferOrbit
DeOrbitBurn
Coast
PreDescentPlan
New landing aimpoint
TerminalDescent

• If human change is outside the capability of the
  planner, the activity will require re-planning
  from its parent

34
Conclusions

• New landing and safety requirements necessitate
  an additional technology to handle mission
  planning and monitoring activities
• GNC will provide the detailed maneuver and
  control commands
• AFM will update GNC target conditions as
  necessary
• AFM must provide mechanism for human redirection
  and interruption
• Real-time autonomy architecture will need to
  support human insertion at multiple levels and
  quickly adapt to human input
• Design of AFM architecture and Crew Interface
  design are tightly coupled
• Technology development to mature AFM to TRL6 will
  continue as part of the ALHAT program

35
References
36
References

• Parasuraman, Sheridan, Wickens."A Model for Types
  and Levels of Human Interaction with Automation."
  IEEE Transactions on Systems, Man, and
  Cybernetics-Part A Systems and Humans, Vol. 30,
  No. 3., 2000.
• Exploration Systems Mission Directorate
  ESMD-RQ-0011 Preliminary (Rev. E) Exploration
  Crew Transportation System Requirements Document
  (Spiral 1) Effective Date 24 Mar 2005. Page 31
  of 45.
• Draper, C.S., Whitaker, H.P., Young, L.R. The
  Roles of Men and Instruments in Control and
  Guidance Systems for Spacecraft. 15th
  International Astronautical Congress, Poland,
  1964.
• Sheridan, T.B. Humans and Automation System
  Design and Research Issues, 2002
• Boff, K.R. Ch. 40, Handbook of Perception and
  Human Performance, Moray, 1986.
• Nevins, J.L., Man-Machine Design for the Apollo
  Navigation, Guidance, and Control
  System-Revisited. NASA report, January 1970.
• Klump, A.R., A Manually retargeted automatic
  descent and landing system for LEM. Report-539,
  March 1966.
• Card, S. K., Moran, T. P., Newell, A. (1983).
  The psychology of human-computer interaction.
  Hillsdale, NJ Lawrence Erlbaum Associates.
• Ricard, M., Kolitz, S., The ADEPT Framework for
  Intelligent Autonomy, presented at NATO Research
  and Technology Organization Workshop on
  Intelligent Systems for Aeronautics, April 2002.