Embedding Online Runtime Verification for Fault Disambiguation on Robonaut2

Abstract

Robonaut2 (R2) is a humanoid robot onboard the International Space Station (ISS), performing specialized tasks in collaboration with astronauts. After deployment, R2 developed an unexpected emergent behavior. R2's inability to distinguish between knee-joint faults (e.g., due to sensor drift versus violated environmental assumptions) began triggering safety-preserving freezes-in-place in the confined space of the ISS, preventing further motion until a ground-control operator determines the root-cause and initiates proper corrective action. Runtime verification (RV) algorithms can efficiently disambiguate the temporal signatures of different faults in real-time. However, no previous RV engine can operate within the limited available resources and specialized platform constraints of R2's hardware architecture. An attempt to deploy the only runtime verification engine designed for embedded flight systems, R2U2, failed due to resource constraints. We present a significant redesign of the core R2U2 algorithms to adapt to severe resource and certification constraints and prove their correctness. We further define an optimization enabled by our new algorithms and implement the new version of R2U2. We encode specifications describing real-life faults occurring onboard Robonaut2 using Mission-time Linear Temporal Logic (MLTL) and detail our process of specification debugging, validation, and refinement. We deployed this new version of R2U2 on Robonaut2, demonstrating successful real-time fault disambiguation and mitigation triggering of R2's knee-joint faults without false positives.

Integrating Runtime Verification into an Automated UAS Traffic Management System

“…However, all test data was recorded and put to use offline in refining our specifications and implementations of R2U2 into each subsystem. We argue that since R2U2 has previously been embedded and used in several successful aerospace applications [7,10,13,17,23], our offline, real-time simulations of this embedding perform representatively to an actual implementation. Note we plan to incorporate R2U2 into the UTM system for the next test.…”

“…R2U2 has implementations in hardware (FPGAs), C++, and C; we choose the latter for embedding in the UTM. R2U2's architecture details appear in a tool overview [20], with additional details from past case studies in [7,10,13,17,23]. R2U2 reads relevant sensor readings off the main system bus, then passes them through lightweight, real-time atomic checkers that filter and discretize the sensor readings.…”

Integrating Runtime Verification into a Sounding Rocket Control System

“…We designed 19 MLTL runtime specifications for Nova Somnium's ACS, shown in Table 3. The total memory for R2U2 monitoring all 19 specifications in parallel was ∼400 kB of memory, which would fit on-board the ACS; we could further reduce memory by employing optimizations from [6] or down-selecting specifications to monitor. To better understand how the specifications are encoded into observation trees for R2U2, see [17,19,20].…”

“…Mission-time Linear Temporal Logic (MLTL) was designed for this purpose [8,13]; it adds finite, integer-bounded intervals to each of the temporal operators in LTL. MLTL has been used in many industrial projects [1,4,6,9,13,14,[19][20][21], and since 2018 has been an official logic of the RV Benchmark Competition [12,16].…”

“…LOLA is a stream-based specification language that previously provided the necessary level of formalization and expressibility for this project [18], but the computational limits of Nova Somnium's ACS are ill-matched for this tool and LOLA's current restriction to past-time specification presents a significant barrier to use. R2U2 was developed to monitor expressive properties of systems in real-time, with little overhead and significant resource constraints [1,6,9,17,19,20]. For this reason, R2U2 is a viable option for integrating RV onto sounding rocket systems.…”