Advanced Diagnostic System on Earth Observing One
Total Page:16
File Type:pdf, Size:1020Kb
Advanced Diagnostic System on Earth Observing One Sandra C. Hayden * Adam J. Sweett Ames Research Center, QSS Group, Inc. Moffen Field, CA, 94035, USA Scott E. Christa* Ames Research Center, AerospaceComputing, Znc., Moffeett Field, CA, 94035, USA Daniel Tran ’ Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA, 91109-8099, USA Seth Shulmanr Goa’a!ard Space Flight Center, Honeywell, Greenbelt, MD, 20771, USA In this infusion experiment, the Livingstone 2 (L2) model-based diagnosis engine, developed by the ComputationalSciences division at NASA Ames Research Center, has been uploaded to the Earth Observing One (EO-]) satellite. L2 is integrated with the Autonomous Sciencecraft Experiment (ASE) which provides an on-board planning capability and a software bridge to the spacecraft’s 1773 data bus. Using a model of the spacecraft subsystems, U predicts nominal state transitions initiated by control commands, monitors the spacecraft sensors, and, in the case of failure, isolates the fault based on the discrepant observations. Fault detection and isolation is done by determining a set of component modes, including most likely failures, wbich satisfy the current observations. All mode transitionS and diagnoses are telemetered to the ground for analysis. The initial L2 model is scoped to EO-1’s imaging instruments and solid state recorder. Diagnostic scenarios for Eal’s nominal imaging timeline are demonstrated by injecting simulated faults on-board the spacecraft. The solid state recorder stores the science images and also hosts: the experiment software. The main objective of the experiment is to mature the L2 techwlogy to Technology Readiness Level (TRL) 7. Experiment resuits are presented, as well as a discussion of the challenging technical issues encountered. Future extensions may explore coordination with the planner, and model-based ground operations. I. Introduction ENESIS project manager, Don Sweetnam, on the Genesis crash in September 2004 after parachutes faded to Gopen: “Keep in mind that when we buttoned the system up at Kennedy Space Center and launched it in 2001, its fate was sealed,” he said. “There was really nothing we could do at this stage to change the outcome.” NASA has recently experienced a string of such failures: Columbia, Mars Polar Lander, Mars Climate Orbiter and Mars Observer. The common theme is that our current space systems have limited capability to recognize when the mission is in danger and recover to save the day. What is called for is a paradigm shift to a new strategy recognizing that mission-critical systems need on-board decision support, especially when operating without human oversight- The technological approach of autonomy has arisen to resolve this challenge. The high-level requirements for autonomous systems may be specified as including: * the capability to detect anomalous conditions and isolate to the root cause fault (aka diagnosis); * PI/PM, Computational Sciences Division, NASA Ames Research Center, MIS 269-3, ALL4 Professional Member. ’ Research Engineer, Computational Sciences Division, NASA Ames Research Center, M/S 269-1, Professional Member. * Systems Engineer, NASA Ames Research Center, MfS 247-2. * ASE Software Lead, Artificial Intelligence Group, NASA Jet Propulsion Laboratory, M/S 126-347. ‘r EO- 1 Flight Operations Team Technical Lead, Flight Control Systems, NASA GSFC, M/S 428-2. 1 American Institute of Aeronautics and AstronaUti~~ * the capability to plan and execute actions to enable mission continuation despite failures (aka recovery). Over the past several years, NASA Ames Research Center (ARC) has been developing autonomous systems with these requirements in mind, and is establishing a track record of mission experience. In 1999, the autonomous Remote Agent Experiment (RAX) flew on the Deep Space One (DS-1) spacecraft [3] with an earlier version of Livingstone. Livingstone is a model-based diagnostic engine developed at Ames by the Model-Based Diagnosis and Recovery (MBDR) group [2]. Since then, the MDBR group has created the next version of Livingstone, called Livingstone 2 (L2). L2 was further developed by Integrated Vehicle Health Management (IVHM) applications: the Propulsion IVHM Technology Experiment for X-Vehicles (PITEX) project [7], performing monitoring and diagnosis of a high-fidelity simuIation of the X-34 Main Propulsion System on flight-like hardware; and on the X-37 IVHM experiment where L2 memory management and coding was modified to meet Boeing’s stringent flight Standards. This paper describes the results of a year-long project in which L2 was uploaded to the Eartb Observing One (EO-1) satellite to conduct diagnostic tests. EO-1 was developed by NASA Goddard Space Flight Center (GSFC) under the New Millenium Program (NMP), and launched in November 2000. EO-1 is. an active earth science observation platform, operated by Goddard. In this technology infusion experiment, L2 and the spacecraft diagnostic models were integrated with the Autonomous Sciencecraft Experiment (ASE) [4]. ASE, another NMP project, was developed at NASA Jet Propulsion Laboratory (JF’L), and first ran on-board EO-1 on September 20, 2003. The autonomy software consists of JF’L’s Continuous Activity Scheduling, Planning, Execution and Replanning (CASPER) planner; the science event detection software and the Spacecraft Command Language (SCL), developed by Interface and Control Systems (ICs). SCL provides an executive, a database and visibility to commands issued to the spacecraft, and observations of the spacecraft response telemetry on the 1773 data bus. L2 provides a diagnosis component to ASE, not included before. Two major challenges were encountered during the course of this work: first, the development of a streamlined real-time interface capability to facilitate experiment integration with a real-time system; and second, integration and testing on the flight hardware testbeds. Incremental testing was utilized to build up the system in verifiable pieces, and automated regression testing ensured that new functionality was thoroughly verified before being baselined. The experiment was developed and deployed within a year under tight resource constraints which did not allow for model development to the full extent possible. Several interesting subsystems are not in scope: the attitude control subsystem (ACS) exhibits continuous behavior; the power subsystem interacts with many other client subsystems and serves as a good illustration of the value added by system health management in resolving root cause faults. A few component faults have occurred on the spacecraft; modeling these components and triggering these faults could allow L2 to diagnose actual faults rather than simulations. Software diagnosis is a relatively untouched research area which could also be explored here; complex autonomous systems are a fertile testbed for run-time software validation technologies. The nature of hardware and software models is essentially the same; real-time behavior is captured in the L2 model, abstracted from the underlying implementation. In early September 2004, the combined L2 and ASE software was uploaded to EO-1. After successful checkout procedures, full scenario validation commenced. As of this writing, eight out of the seventeen defined scenarios have been validated, with the remaining scenarios to be completed in several weeks. Performance of the experiment has been flawless with no issues or technical problems. II. Diagnostic Requirements for the Experiment The primary goal of this experiment is to increase the Technology Readiness Level (TRL) of L2 by demonstration on a flight vehicle. However, several significant functional advances in the technology over previous work with Livingstone are to be demonstrated over the course of the experiment; these are shown in Table 1. Table 1: L2 on EO-1’s intended functio~litycompared with previous Livingstone experhwnts acecraft Hardware in the Loo 2 American Institute of Aeronautics and AS@OM~CS Remote Agent was a flight experiment on DSl, using the original Livingstone (Ll). The PITEX experiment applied L2 to the proposed X-34 vehicle, running the diagnosis system on flight-like hardware with simulated data. As seen from the table, the L2 on EO-1 experiment will incorporate all previously developed functionality of L2, and demonstrate additional functionality as well. A subset of these requirements forms the success criteria for the experiment, as explained in the next section. Coverage of a number of diagnostic scenarios and the goal of long-term space operations (for days or weeks) are desired features rather than minimum requirements. A. Minimum Success Criteria In order for the experiment to be deemed successful, a minimum set of features are validated by on-board demonstration. These required features are the Minimum Success Criteria (MSC), identified below. Each MSC must be demonstrated with at least one scenario. In the results section, a scenario which demonstrates each of these requirements is presented. 1) SDacecraft Hardware in the loo^ A The L2 experiment shall be deployed on-board EO-1, and shall demonstrate monitoring of nominal operations and diagnosis of anomalies in the spacecraft subsystems. 2) MultiDle Hmtheses A Multiple alternative fault candidates shall be presented in the failure diagnosis, with an indication of relative likelihood. 3) MultiDle Hmtheses with Backtracking A In light of new evidence, the list of diagnostic fault candidates shall be revised. This may entail a revision