EMBEDDED SOFTWARE DESIGN AND SYSTEM INTEGRATION FOR ROTORCRAFT UAV USING PLATFORMS 1 Benjamin Horowitz Judith Liebman Cedric Ma T. John Koo Thomas A. Henzinger Alberto Sangiovanni-Vincentelli Shankar Sastry EECS, University of California, Berkeley Abstract: Automation control systems typically incorporate legacy code and components that were originally designed to operate independently. Furthermore, they operate under stringent safety and timing constraints. Current design strategies deal with these requirements and characteristics with ad hoc approaches. In particular, when designing control laws, implementation constraints are often ignored or cursorily estimated. Indeed, costly redesigns are needed after a prototype of the control system is built due to missed timing constraints and subtle transient errors. In this paper, we use the concepts of platform-based design, and the Giotto programming language, to develop a methodology for the design of automation control systems that builds in modularity and correct-by-construction procedures. We illustrate our strategy by describing the (successful) application of the methodology to the design of a time-based control system for a rotorcraft Uninhabited Aerial Vehicle (UAV). Keywords: helicopter control, autonomous vehicles, control system design, interfaces, programming approaches, real-time systems, time schedule controllers, embedded systems 1. INTRODUCTION low, this design methodology could yield working im- plementations. However, recent incidents where incor- Automation of traditionally human-controlled do- rect software caused severe problems, e.g. the Mars mains has long been a driving force within the au- Polar Lander and the Ariane rocket, point out the risks tomatic control research community. From industrial of an outdated methodology. plants to vehicles, from airplanes to home appliances, the application of embedded controllers has become Automation control systems have several key proper- pervasive, aided by the relentless increase in the ca- ties in common: pabilities of integrated circuit technology and by ad- (1) They operate under stringent real-time con- vances in control theory. For cost and safety rea- straints. sons, the CPUs of choice were not top of the line in (2) They often integrate subsystems that were de- terms of speed and, since most control applications re- signed to work independently — for example, quire real-time responses, the control laws were often sensors from different vendors. “cheap” empirically validated heuristics. Also, soft- (3) Their proper operation is important to ensure ware designers used unsound techniques (e.g., com- human safety. munication among tasks using shared variables). As (4) They can utilize legacy code such as device long as the complexity of the systems to control was drivers or controllers. These traits of automation control systems present 1 Research supported in part by DARPA under contract no. challenges to system design methodologies. Often, F33615-98-C-3614, Software Enabled Control, administered by attempts to replace or incorporate subsystems and AFRL, Dayton OH legacy code result in a design overhaul. Furthermore, hovering, forward flight, turning at a fixed point, and every design iteration requires exhaustive testing to so on. More advanced maneuvers include formation provide high reliability. Such problems result from flying and obstacle avoidance. However, it is difficult the improper coupling of functional design and imple- to achieve even basic autonomous flight, since the mentation. helicopter is unstable and dangerous. Moreover, it is difficult to obtain an accurate dynamic model of We present a design methodology for embedded con- the helicopter (Koo and Sastry, 1998). In spite of troller design via a challenging example of automatic the challenges, the BEAR team managed to build a control: a rotorcraft UAV. The difficulty and com- working flight control system that makes autonomous plexity of the application serves well the purpose of flight possible. underlining the features of the design method and demonstrating its power. One main goal of our de- sign strategy is to build in modularity in order to 2.2 The Flight Control System make code reuse and substitutions of subsystems sim- ple. The other main goal is to guarantee performance The primary components in the first generation flight without exhaustive testing. We draw on the principles system are actuators, sensors, and a control computer. of platform-based design (Sangiovanni-Vincentelli, The actuators consist of servomotors controlling the 2002). A platform, in this context, is a layer of ab- collective pitch, cyclic pitch, throttle, and tail rotor. straction that hides the unnecessary details of the un- The primary sensors of the flight control system are derlying implementation. We borrow the concept of as follows: platform-based design from the electronics industry and tailor it to work with automation control systems. Inertial Navigation System (INS). The INS consists The choice of a software platform to guarantee timing of accelerometers and rotational rate sensors that performance is of particular interest. We focus on the provide frequent estimations of the helicopter’s po- Giotto software platform (Henzinger et al., 2001b) sition, velocity, orientation, and rate of rotation. Al- and show how it aids the development of correct con- though this estimate is provided at a high rate — troller software. To quantitatively assess the resulting roughly 100 Hz— the error in estimate could grow design, we present a hardware-in-the-loop simulation unbounded over time, due to sensor noise and limits framework. in sensor accuracy. Global Positioning System (GPS). The GPS solves The structure of this paper is as follows. In Section 2, the INS drift problem by providing a position mea- we lay the groundwork for the helicopter example. surement whose error is small —on the order of Next, in Section 3, we introduce the reader to the 1 cm— and bounded over time. However, this ac- principles of platform-based design. In Section 4, we curate measurement is also infrequent —roughly 5 describe a language for programming time-based con- Hz. troller applications. Finally, in Section 5, we present a rotorcraft UAV design which employs the concepts of An integrated INS-GPS solution uses a Kalman filter the previous three sections. to provide frequent updates of the estimated state of the helicopter. This Kalman filter is run by the flight computer, which also computes a control law and 2. BACKGROUND FOR A MODEL HELICOPTER sends the result to the actuators. Experimental system identification was used to obtain In this section, we introduce the Berkeley Aerial a dynamic model of the helicopter: the flight control Robot (BEAR) helicopters, and motivate the redesign computer logged the response of the helicopter and of their embedded software. We begin with a brief the pilot commands, and these logs were compared. description of the BEAR helicopters and of why au- The information attained through system identifica- tonomous flight is difficult (Section 2.1). We next dis- tion was then used to synthesize a controller for the he- cuss the first generation flight control system (Sec- licopter. For more information, refer to (Shim, 2000; tion 2.2), and describe some of its limitations (Sec- Shim et al., 1998). tion 2.3). Finally, we describe what is needed for a second generation system (Section 2.4) to overcome these limitations. 2.3 Limitations of the First Generation System With basic autonomous flight successfully demon- 2.1 The BEAR Helicopters strated, the BEAR team then set off to equip a num- ber of helicopters with a similar flight control sys- The first goal of the BEAR project was to build a tem. Over time, two new and unfamiliar challenges flight control system for small, remotely controlled emerged. The first challenge resulted from a widening helicopters. The aim was to fly autonomously and to choice of devices: as the fleet of helicopters became provide a base for research in other areas such as more diverse, so did the selection of sensors, actua- vision. Basic autonomous flight capabilities include tion schemes, and computing hardware. Each device provided or received data at different speeds, used different data formats, communicated using different Application Space protocols, and so on. The tightly integrated flight con- trol system was not prepared to handle the diverse as- sortment of new devices. Inevitably, any change to the System original system required an extensive software rewrite Platform followed by an extended verification process. In short, Platform Interface the original embedded software was not written with Stack modularity in mind. Yet it would be prohibitively ex- pensive to rewrite all of the software for each particu- lar combination of devices. Architecture Space The second challenge resulted from the event-based nature of the first generation flight control computer. Fig. 1. The system platform stack To ensure the fastest possible response, the computer run on different helicopters, which may have very was set up to process the incoming sensor data as different physical dynamics and devices. soon as it arrived and to immediately send the control output to the actuators. As an example of the prob- lems that arose in this event-based system, consider 3. PLATFORM-BASED DESIGN METHODS the following first generation setup. The GPS and INS were synchronized with each other but not with the Automation control systems, such as the BEAR heli- control computer. The GPS sent readings to the con- copters, can be designed with legacy code reuse and trol computer at 5 Hz. The INS sent readings at 100 safety guarantees, and without deficiencies in sub- Hz. The control computer ran the control task at 50 system integration. This section presents the building Hz. Because of the lack of synchronization, the sensor blocks that will later be used to design such a system. data seen by the control computer ranged from 0 ms to 10 ms out of date. Due to clock drift, this amount of The building blocks we use are those of platform- time was nondeterministic. Similarly, the servos were based design.