Robust Hybrid and Embedded Systems Design Jerry Ding, Gabe Hoffmann, Haomiao Huang, Vijay Pradeep, Jonathan Sprinkle, Steven Waslander, Edward Lee, Shankar Sastry, Claire Tomlin MURI Review Meeting Frameworks and Tools for High-Confidence Design of Adaptive, Distributed Embedded Control Systems Berkeley, CA September 6, 2007

2 Outline Requirements specification Function modeling and simulation SW/HW architecture modeling and simulation Systems design Code generation and verification Allocation and scheduling analysis Our MURI…. “Top down meets bottom up” Verification methods and tools at each layer Automatic generation of verified code Automatic generation of test suites for each layer Tools and testbeds for low level software analysis In this talk: Reachable sets for verifying hybrid control protocols Quadrotor testbed: control and software architecture

3 3 δ ΔWΔW Target Set for Refueling human operated boom human pilot δ = Long. Tolerance for Catching Boom ΔW = Lat. Tolerance for Catching Boom Reachable sets for verifying control protocols: aerial refueling example Boeing

4 Stationary 7 Stationary 1 Stationary 2 Stationary 3 Stationary 4 (Fueling) Stationary 5 Stationary 6 Formation Transition Language Move Back Break Away {x ∈ G 12 } Move Left Precapture {x ∈ G 23 } Move Forward Capture {x ∈ G 34 } Move Back Postcapture or Fuel Wave Off Move Right Break Away {x ∈ G 56 } {x ∈ G 45 } Move Forward Rejoin {x ∈ G 67 } G ij = Target Set of Manuever from Stationary i to Stationary j Fallback 2Fallback 1Fallback 3Fallback 4Fallback 5 FB FB = Fall back command

5 Reachable sets for Formation Transition Generate state-based reachable sets which can be used to verify that taking a certain action is or is not safe Flare vs. TOGA maneuver: Vehicles/personnel are prevented from transitioning in unsafe situations Intersection calculations are extremely fast (milliseconds)

6 Reachable Sets for Individual Transitions Targets are small sets of states around the way points Reachable Set for Precapture Time Horizon: 10s

7 Simulation of Capture Sets Complete refuel sequence with capture sets for all maneuvers User input specifies transitions between waypoints Capture sets can be used to minimize allotted time for each maneuver In event of waveoff, UAV attempts to go back to previous waypoint Capture set gives information about whether UAV can return to previous waypoint within a given time horizon

8 Unsafe Sets for Individual Transitions During any formation transition, need to prevent UAV from entering into collision with tanker Unsafe set is set of states that can reach an unsafe zone within a given time horizon Unsafe Set for Capture Time Horizon: 5s Unsafe zone is set of locations within a certain radius of the tanker Provides information on which maneuver should be executed to prevent collision

9 Simulation of Multiple Reachable Sets UAV starts in unsafe zone for capture Want to reach capture zone without any collisions Yellow: Unsafe Capture Magenta: Unsafe Left Turn Green: Capture Reachable Set Red: Unsafe Move Forward Capture Zone Desired Trajectory

10 Simulation of Multiple Reachable Sets Visualization of unsafe sets together with capture sets allows for construction of a sequence of safe maneuvers to enter capture zone

11 Synthesizing MATLAB scripts After attaching semantics to the Formation Transition Language, we will be able to synthesize the MATLAB scripts, based on generalizations of the prototypes which we’ve built by hand. Then, “fallback” states can change, based on the model built, not the static code.

12 Another example: Analysis of Traffic Alert and Collision Avoidance System (TCAS) NASA

13 Outline Requirements specification Function modeling and simulation SW/HW architecture modeling and simulation Systems design Code generation and verification Allocation and scheduling analysis Our MURI…. “Top down meets bottom up” Verification methods and tools at each layer Automatic generation of verified code Automatic generation of test suites for each layer Tools and testbeds for low level software analysis In this talk: Reachable sets for verifying hybrid control protocols Quadrotor testbed: control and software architecture

14 Quadrotor testbed: control and software architecture Autonomous UAVs Onboard computation & sensors State and environment estimation Attitude, altitude, position and trajectory control 4 flightworthy vehicles More are being made Testbed goals Quadrotor UAV design Cooperative multi-agent control Mobile sensor networks Stanford Testbed of Autonomous Rotorcraft for Multi-Agent Control (STARMAC)

15 STARMAC history

16 STARMAC Electronics System WiFi b ≤ 5 Mbps ESC & Motors Phoenix-25, Axi 2208/26 IMU 3DMG-X1 76 or 100 Hz Ranger SRF08 13 Hz Altitude GPS Superstar II 10 Hz I 2 C 400 kbps PPM 100 Hz UART 19.2 kbps Robostix Atmega128 Low level control UART 115 kbps CF 100 Mbps Stereo Cam Videre STOC 30 fps 320x240 Firewire 480 Mbps UART 115 Kbps LIDAR URG-04LX 10 Hz ranges Ranger Mini-AE Hz Altitude Beacon Tracker/DTS 1 Hz WiFi g+ ≤ 54 Mbps USB Mbps RS kbps Timing/ Analog Analog RS232 UART Stargate 1.0 Intel PXA255 64MB RAM, 400MHz Supervisor, GPS PC/104 Pentium M 1GB RAM, 1.8GHz Est. & control

17 STARMAC Network Wifi Netgear Rangemax g+ ≤ 54 Mbps Ground GPS Superstar II Control Laptop Computer Pentium Core Duo 1 GB RAM, 2.16 GHz Running Labview and ssh sessions RS kbps Ethernet 100 Mbps

18 STARMAC Quadrotor Helicopter Battery Lithium Polymer Brushless DC Motors Axi 2208/26 Sonic Ranger SRF08 Inertial Measurement Unit (IMU) 3DMG-X1 High Level Control Processor Stargate SBC or PC/104 Low Level Control Processor Robostix GPS Superstar II Electronic Speed Controller Phoenix 25 Plastic Tube Straps Carbon Fiber Tubing Fiberglass Honeycomb LIDAR Hokuyo URG-04LX Stereo Vision Videre Systems Small Vision System

19 Quadrotor Helicopter Actuation Yaw Torque Roll/Pitch Torque Total Thrust Two pairs of counter rotating blades provide torque balance Angular accelerations and vertical acceleration are controlled by varying the propeller speeds.

20 COMM CLASS GUI & Storage Sensor Processing Controller Planner Real Time Controller GPS LIDAR ROBO GND Estimator GPS Calc State Estimator GPS comm Lidar comm GND comm Flyers Flyer comm GUI (10 Hz) Logging Enviro LIDAR Robo comm signal serial UDP Interfaces Fcn call all any STARMAC Code Architecture

21 Information Seeking Target Localization Other Testbed Applications Decentralized Collision Avoidance

22 Multi-Vehicle Flight

24 backups

25 Decision Authority Language The decision authority language can be specified as a series of handshakes between the UAV and the human operators

26 Simulation of Latencies and Waveoff 1. Regular run, without faults Green: Tanker Red: UAV MATLAB simulation environment Plots trajectories of tanker and UAV Updated in real-time at 1 second intervals Allows fault injection by user UAV executes fallback immediately upon fault

27 Simulation of Latencies and Waveoff Separate waveoff for tanker and ground operators Latencies simulated as delay between waveoff and UAV confirm Fallback executed only when UAV confirms Latencies currently hard coded 2. Tanker waveoff during “precapture” Green: Tanker Red: UAV

28 Simple Illustration of Reachable Sets It has been shown (Mitchell, et al. 2005) that the reachable set is the solution to the Hamilton-Jacobi PDE: The level set function Φ(x,t) defines implicitly the boundary of the reachable set at time t In general, the solution is difficult to obtain analytically A numerical toolbox for MATLAB is available to approximate the solution (Mitchell )

29 Simulation of Capture Sets In event of waveoff, UAV attempts to go back to previous waypoint Capture sets gives information about whether UAV can return to previous waypoint within a given time horizon

30 Dynamics Not analogous to a pendulum Equations of motion largely decoupled * ignoring blade flapping effects

31 Low Level Control Algorithm Initialize hardware Loop Wait for termination of IMU data collection Retrieve A/D measurements Retrieve ultrasonic measurement, reinitiate Compute control inputs for each motor Set motor control inputs in PWM hardware Initialize transmission of status End Event Driven Real-time execution based on Known transmission / receipt rates Measurement of code chunk execution times

32 Low Level Control “Threads” Main (76 Hz) Interface for all threads Computes control inputs Controls hardware PWM Control I2C Communication (initiate ultrasonic measurements, retrieve results) A/D Conversion Digital I/O Stargate Receive (10 Hz) Parses control packets IMU Receive (76 Hz) Parses IMU data Computes checksum (using ring buffers) Stargate Send (76 Hz) Buffered transmission of low level control status IMU Send (irregular) Buffered transmission of data requests (only needed to initiate continuous data)

33 Timeline IMU RX SG RX SG TX IMU TX Main (this is an asynchronous event) Timing is based on IMU measurements Main requires additional timing considerations for A/D I2C Control bytes from SG RX are used as they arrive

34 Inputs to Atmega128 IMU (3DMGX1) Packet 0x31 UART serial communication Continuous at 76 Hz (or 100 Hz), after initialized Header byte, 11 data fields with 16 bit entries, 16 bit checksum Ranger (SRF08) I 2 C serial communication Polled at 13 Hz Range return values, no checksum Stargate or PC104 UART serial communication Continuous at 10 Hz TSIP (Trimble standard interface protocol) command packets ID byte 4 command bytes

35 Atmega128 Outputs IMU (3DMGX1) UART serial communication Initialize continuous data with 1 command Ranger (SRF08) I 2 C serial communication Poll at 13 Hz Command to initiate measurement Stargate or PC104 UART serial communication Send at 76 Hz (timed by IMU) TSIP (Trimble standard interface protocol) status packets ID byte ~30 data bytes

36 Functionality to Develop Heart beat / Watchdog functionality Real time guarantees Interrupt driven I2C, A/D Ultrasonic timing measurement