Planning to Fail: Incorporating Reliability into Design and Mission Planning for Mobile Robots

Transcription

1 Planning to Fail: Incorporating Reliability into Design and Mission Planning for Mobile Robots Stephen B. Stancliff CMU-RI-TR Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Robotics. The Robotics Institute Carnegie Mellon University Pittsburgh, Pennsylvania September, 2009 Thesis Committee: John Dolan, Chair Brett Browning Michael Nechyba Ashitey Trebi-Ollennu, California Institute of Technology, JPL Copyright c 2009 by Stephen B. Stancliff. All rights reserved.

2 i

3 ABSTRACT Current mobile robots generally fall into one of two categories as far as reliability is concerned highly unreliable, or very expensive. Most fall into the first category, requiring teams of graduate students or staff engineers to coddle them in the days and hours before a brief demonstration. The few robots that exhibit very high reliability, such as those used by NASA for planetary exploration, are very expensive. In order for mobile robots to become more widely used in real-world environments, they will need to have reliability in between these two extremes. In many applications some amount of unreliability is acceptable if it results in reduced costs. Even in applications where a failure probability very near zero is desired (such as planetary exploration), the ability to design robots to a specific reliability goal should allow us to reduce the costs of these highly reliable robots by designing them to be just reliable enough to complete the mission, rather than designing them to be as reliable as possible. In order to design mobile robots with respect to reliability, we need quantitative models for predicting robot reliability and for relating reliability to other design parameters such as cost. To date, however, there has been very little formal discussion of reliability in the mobile robotics literature, and no general method has been presented for quantitatively predicting the reliability of mobile robots. ii

4 This thesis focuses on this problem of predicting reliability for mobile robots and in particular for teams of mobile robots, and proposes solutions for using reliability as a design input for several mobile robot design problems: Given a choice of components from which to assemble a robot, how do we select the ones that will optimize the tradeoff of reliability against other factors such as cost? Given a choice of robots from which to assemble a multirobot team, how do we select the ones which will optimize the reliability tradeoffs for the entire robot team? Given a multirobot team and a list of mission tasks, how do we assign tasks to team members in order to maximize the probability of completing the mission? iii

5 Table of Contents List of Tables List of Figures vii viii Chapter 1. INTRODUCTION Motivation Overview Contributions Outline Chapter 2. SINGLE-ROBOT RELIABILITY Related Work Reliability Background Types of robot failures Reliability model Consequences of constant hazard rate Robots and Tasks Robot decomposition Module task and robot task reliability Single-robot example Summary Chapter 3. MULTIROBOT RELIABILITY Related Work Analytical Solutions for Simple Multirobot Missions Stochastic Simulation for Complex Multirobot Missions Example Results for a Complex Multirobot Mission Comparing teams having different numbers of robots iv

6 3.4.2 Comparing teams with robots having different reliabilities Example Repairable vs. Nonrepairable Robot Teams Summary Chapter 4. DESIGN TRADEOFFS Cost Cost of reliability Expected mission reward Overall cost reliability relationship Example Multirobot Team Size Introduction Analysis Operating Conditions Extrapolation of MTTF to other operating points Operating envelope Summary Chapter 5. MISSION PLANNING Background Illustrating Example Simulation Results Minimax utility function Differences in plan durations Overall planner performance metric Minisum utility function Summary Chapter 6. INCOMPLETE MISSION PLANNERS Greedy Planner Incorporating reliability Incorporating reliability revised method Less-Greedy Planner Compromise Planner Summary v

7 Chapter 7. CONCLUSIONS Summary Contributions Future Research Appendix A. Subsystem Reliability Data 102 Appendix B. Expected Value Calculation 105 Bibliography 108 vi

8 List of Tables 2.1 Module usage during sampling task Components comprising power subsystem Robot subsystem reliabilities Module reliabilities during sampling task Subsystem usage by task Module task reliabilities Baseline team costs and rewards Robot and target parameters Plan durations Naive and expected durations A.1 Power A.2 Communications A.3 Computation & Sensing A.4 Mobility A.5 Manipulator B.1 Robot and target parameters B.2 Plan durations and probabilities B.3 Plan durations expected (minimax) B.4 Plan durations minimax (expected) vii

9 List of Figures 2.1 The bathtub curve Failure rates making up bathtub curve Modular robot concept NASA Hierarchical System Terminology Possible paths for simple mission Same mission as Figure 3.1 but with one repair allowed State transition diagram for complex mission Different numbers of robots Closeup of area of interest from Figure Different component reliabilities Total work completed; two-component robots Improvement of repairable team over nonrepairable team Total work completed; six-component robots Effect of failure rate on repairable team superiority Relative cost of rovers as function of component reliability Expected value of mission as a function of component reliability Net expected gain Comparison of equal-cost teams Effect of operating conditions on bearing MTTF Lines of constant MTTF Exploration mission Chosen plan and backups Plan with shortest expected duration Suboptimal allocations Suboptimal allocations viii

10 5.6 Average increase in mission duration as a function of target count Expected increase in duration as a function of target count Expected increase in mission duration Expected increase in power consumption Planner comparison (first approach) Planner comparison (second approach) How often reliability-enhanced planner chooses a better plan Expected increase in mission duration (greedy planner) Expected increase in mission duration (less-greedy planner) Comparison of greedy and less-greedy planners Comparison of less-greedy and compromise planners How the number of plans tested affects performance ix

11 Chapter 1 INTRODUCTION 1.1 Motivation Many of the most promising applications for mobile robots are those that reduce or eliminate the need for humans to perform tasks in dangerous environments. Examples include space exploration, mining, and toxic waste cleanup. For mobile robots to succeed in keeping humans from these dangers, these robots must be highly reliable so that people do not have to enter the dangerous area to repair or replace failed robots. Unfortunately, most current mobile robots have poor reliability, requiring frequent maintenance and repair. Historical failure data for small field robots reveal that they are either broken or under repair approximately half of the time [1]. Notable exceptions to this observation are the planetary rovers built and operated for NASA by the Jet Propulsion Laboratory (JPL). The current Mars Exploration Rovers (MER), for instance, have now been in operation on Mars for more than 1

12 five years. There are few, if any, other mobile robots that have operated for as long as a year without repair. The reliability of NASA rovers is achieved through the use of highly robust components as well as component redundancy, both of which lead to the robots being very expensive. The cost of the first MER rover was approximately $150M [2]. Other than space exploration and perhaps a few military applications, it is hard to imagine many applications for which a robot price tag in the hundreds of millions of dollars will be acceptable. Therefore, the current NASA design paradigm of making robots as reliable as possible is not broadly applicable. Even in the realm of planetary exploration, the current design paradigm may not be able to provide the reliability required for future missions. In the near future, NASA intends to send rovers to Mars for missions lasting an order of magnitude longer than the original MER mission. Using the current design paradigm, increasing the mission duration by an order of magnitude requires that the rover be built using components with failure rates an order of magnitude lower. Since NASA rovers already make use of some of the most reliable components available, it is doubtful whether components with an order-of-magnitude greater reliability are available, let alone affordable. Both of these situations the unreliability of mobile robots in general and the high cost of reliable NASA rovers reveal the need for principled consideration of reliability as a design parameter for robots and robot missions. To date, however, 2

13 there has been very little formal discussion of reliability in the robotics literature, and no general methods have been presented for using quantitative reliability as an input for robot design or mission planning. 3

14 1.2 Overview This thesis first addresses the question of how to apply existing quantitative reliability estimation methods to mobile robots. Second, we present methods for using reliability as an input parameter in the design of robots and multirobot teams. Finally, we consider how knowledge of robot reliability can be used to improve the performance of multirobot planners. The methods developed in this thesis have their roots in the field of reliability engineering. We have developed a formal representation for mobile robots that allows us to apply common reliability engineering models in a systematic way to determine the probability that a robotic mission will be successfully completed. As is often the case when applying outside fields of knowledge to mobile robots, we have discovered areas where the existing methods fall short and must be modified to deal with the complexities of mobile robot systems. In particular, traditional methods of combining component reliabilities into system reliability assume that the components are independent in terms of reliability. This assumption fails for many multirobot missions. We present a framework for dealing with the complexity that these dependencies add to the problem. We then apply these methods to several single-robot and multirobot design problems, examining the tradeoffs between cost and reliability, between repairable and 4

15 nonrepairable robots, and between teams of many low-reliability robots versus teams of fewer high-reliability robots. Finally, we examine the role of reliability in multirobot task allocation. Specifically, we evaluate the hypothesis that ignoring robot reliability information when generating initial task allocations leads to suboptimal performance. Our results show that this is indeed the case and that the difference in performance is substantial. 5

16 1.3 Contributions The contributions of this dissertation to the robotics community are the following: Introduction of models for reliability prediction from the reliability engineering literature into the mobile robotics literature. A general theoretical framework for applying these reliability engineering methods to robots and multirobot teams. The first quantitative analysis of cost reliability tradeoffs for planetary rover missions. The first quantitative analysis of the tradeoff between robot reliability and team size. The first analysis of the benefit of using reliability knowledge a priori in multirobot mission planning, providing strong evidence that planners which do not use this information choose suboptimal plans. A model for how reliability knowledge can be used to improve task allocation for incomplete multirobot planners. Overall, these contributions allow us to begin considering robot reliability as an input parameter for robot design and operation, rather than as an uncontrolled output resulting from decisions made without regard to reliability. 6

17 1.4 Outline Chapter 2 of this document introduces the relevant terminology and models we borrow from the reliability engineering literature and describes the framework we have developed for applying reliability engineering to the design of mobile robots. This chapter presents an example problem in which we calculate the probability that a planetary exploration rover will successfully complete a sampling mission. Chapter 3 considers the design of multirobot teams. We first present a straightforward method for finding analytical solutions to multirobot missions. Because such methods are impractical for missions of significant complexity, we then introduce a method that uses stochastic simulation for evaluation of more complex missions. In this chapter we evaluate a multirobot mission in which planetary rovers must work cooperatively to install a solar panel array. We also analyze a problem introduced in [3] that compares the performance of a team of repairable robots with that of a nonrepairable team. In Chapter 4 we demonstrate how reliability can be integrated with other design parameters in order to optimize robot design across multiple design constraints. The bulk of this chapter examines the relationship between reliability and cost in the context of a planetary exploration mission. We also examine how operating conditions affect reliability and how single-point reliability data can be extrapolated to off-design operating conditions. 7

18 Chapters 5 and 6 examine the role of quantitative reliability in multirobot mission planning. Specifically, in Chapter 5 we test the hypothesis that it is necessary to consider robot reliability when generating initial task allocations, rather than, as is currently practiced, dealing with reliability only after the fact, by reallocation of tasks after robot failure occurs. In Chapter 6 we extend these results by demonstrating that reliability information can be used to improve plan selection for heuristic planners. Finally, in Chapter 7 we summarize the contributions of this thesis and discuss future directions for this research. 8

19 Chapter 2 SINGLE-ROBOT RELIABILITY This section provides an overview of methods and models from the reliability engineering literature, introduces the representation we use for modeling mobile robots using these methods, and shows how these methods can be applied in order to predict the probability that a single robot will complete a given task. 2.1 Related Work The reliability engineering literature (e.g., [4, 5]) provides methods for predicting the reliability of simple electrical and mechanical devices and also for combining these reliabilities to predict the reliability of complex systems. These methods can be applied in a straightforward fashion to make predictions about the reliability of simple robots executing simple missions. For many robotic applications, however, there are violations of the assumptions upon which the basic reliability engineering methods are based. We address these shortcomings in Chapters 3 and 4. In the mobile robotics literature there is little formal discussion of reliability and 9

20 failure. When reliability is mentioned, it is usually qualitatively, and in passing. Reference [6], for example, mentions intermittent hardware failures as an explanation for gaps in experimental data but makes no attempt at characterizing the failures. A handful of prior papers ([1, 7, 8, 9]) make use of reliability engineering for analysis of mobile robot failure rates. Reference [1] provides an overview of robot failure rates at the system level (i.e., robot model X failed Y times in Z hours of operation) and also breaks down failures according to the subsystem that failed (actuators, control system, power, or communications). Reference [7] extends the work in [1] both by the inclusion of additional failure data of the same type and also by addition of new categories of failure those due to human error. Reference [9] provides a detailed analysis of failures experienced by some of the robots used in searching the World Trade Center wreckage in Reference [10] provides failure data for robots used in long-term experiments as museum guides. While these papers help us to begin to identify the causes of mobile robot failure, they do not provide methods for predicting failures. In contrast to the mobile robot literature, there is considerable work in the area of reliability of robotic manipulators. Examples include [11] and [12]. This work in manipulator reliability has the same shortcomings with respect to mobile robots as the basic reliability methods, in that manipulators are generally simpler devices than mobile robots and are used in fairly static environments. There is some relevant work in the manipulator literature describing how environmental conditions affect 10

21 reliability (e.g., [13]), although here the environmental factor involved is a constant rather than varying with time and task, as is often the case with mobile robots. There is also a significant body of mobile robot research that deals tangentially with reliability by describing methods for detecting and recovering from failures. An example is [14], in which fault detection is used to discard faulty sensor readings among a group of redundant sensors. Our work differs from these in that we are developing methods to predict the probability of failure occurring rather than to respond to failure after it occurs. Our methods are complementary to these since an a priori understanding of the relative probabilities of different failures is helpful for failure diagnosis. 11

22 2.2 Reliability Background Reliability is the ability of a system or component to perform its required functions under stated conditions for a specified period of time [15, p. 170]. In other words, reliability is the probability that no failures will occur before a given time. When evaluating the reliability of a system, we must first identify the ways in which the system may fail and then determine the probabilities of those failures occurring Types of robot failures Mobile robots are complex systems, and as a result there are many factors that can cause the failure of a robotic mission. The laboratory robots with which most researchers are familiar usually fail due to errors in design, manufacturing, or usage. The hardware breaks down due to being poorly designed or constructed; the software has bugs that are revealed only under the stress of a demonstration; and both hardware and software fail because the robots are used in situations beyond the intentions of their designers. While these types of failures are significant and in fact are the dominating failure modes for most mobile robots today ([1],[7],[8]), we contend that these failure modes are not in need of modeling so much as they are in need of correction. These failures are the result of errors that can be reduced, if not eliminated, through process control. Methods for reducing errors in design, manufacturing, software development, and operation are widely used in industry (e.g., ISO 9001 Quality 12

23 Management). As mobile robots become more common and are produced in a manufacturing rather than a research environment, these engineering methods will be applied, yielding a reduction in failures due to errors. We can see that this is possible because some of today s mobile robots are already built with a high degree of quality control in design, construction, and operation. For instance, the planetary rovers built for NASA by JPL are built to very high standards of quality and controlled by highly trained operators, resulting in a very low incidence of failures due to errors. This is largely because much greater care is given to their design, construction, and operation in comparison with most other current mobile robots. Once failures due to errors are largely eliminated, as with the NASA rovers, the remaining failures are due mostly to inherent properties of the materials from which the robot is constructed. An example of such a failure is the degradation of the lubricant in a bearing and the subsequent failure of the bearing. There is no process control that will change the physical reality that lubricants break down and unlubricated bearings fail. Instead, the robot must be designed taking into account the possibility of bearing failure so as to guarantee that there is only a small chance of failure during the mission. The need to address such failures is suggested by the long-term robot museum guide experiments described in [10]. The robots described in that paper possessed self-diagnostic and self-resetting capabilities that allowed them to overcome many 13

24 design and implementation errors. The remaining failures were eventually stochastic and unpredictable, a tire failing here, and a light bulb failing there [10, p. 4]. It is this latter type of failure with which we are primarily concerned. The reliability engineering literature provides well-established models for this type of failure. In the rest of this chapter we demonstrate how these models can be used for the prediction of mobile robot failures and for choosing an optimal set of robot components with respect to reliability requirements. It is possible that some of the other types of failure mentioned above can also be incorporated into these predictions. For instance, models for predicting software errors have been proposed in the literature (e.g., [16],[17]). Incorporation of such models would allow us to provide a more complete picture of mobile robot failure. However, these models have been in existence for a much shorter time than hardware reliability models and have been applied in very few cases, so their ability to predict software failures is unproven. In addition, our goal is to produce tools that can be used in the early stages of mission design. Most of the available software prediction models require input data that are not available in those early stages. We therefore confine ourselves in this work to the category of hardware failures described above Reliability model Reliability models are descriptions of how the instantaneous failure rate (or hazard rate) for a device changes over time. For many electronic and mechanical devices, 14

25 when the hazard rate is plotted as a function of time, the resulting curve resembles Figure 2.1 [4, p. 109]. This characteristic shape is referred to as the bathtub curve. The bathtub curve arises from the superposition of three distinct failure patterns. The first is an exponentially decreasing failure rate which is high at the beginning of the product life (Figure 2.2a). This corresponds to the period during which items fail largely due to defects in materials or construction. There are many early failures, but as defective items drop out of the population, the remaining population has a lower hazard rate. This is referred to as the burn-in or infant mortality period. The second pattern (Figure 2.2b) is an exponentially increasing failure rate which becomes high when components have reached the ends of their useful lives and begin to fail due to deterioration. This is referred to as the wearout phase. The third failure pattern (Figure 2.2c) is a constant failure rate due to random Figure 2.1. The bathtub curve 15

26 (a) Infant mortality (b) Wearout (c) Random failures Figure 2.2. Failure rates making up bathtub curve 16

27 failures. In the middle section of the bathtub curve this failure pattern dominates. This period is referred to as the service life or useful life. In applying the bathtub model to robots, we assume that there will be a period of initial testing which allows burn-in failures to be dealt with before components are placed into service. This is standard procedure for manufacturing of products with small production runs or for products that use cutting-edge technology [18]. At the other end of the bathtub curve, we assume that the service life of components will be specified by their manufacturers and observed in robot design and mission planning so that robot modules will not wear out before the completion of the mission for which they are being designed. Given these two assumptions, the hazard rate of a robot component needs to be known only during the service life phase. This hazard rate is modeled as a constant, which is represented in the literature by λ. It is also important to know when the end of the service life is reached. The reliability of a module can therefore be modeled with just two parameters the (constant) hazard rate and the service life length Consequences of constant hazard rate The reliability of a device with a constant hazard rate is R(t) = e λt. (2.1) 17

28 Thus, the reliability of a device with a constant hazard rate is equal to one at the beginning of the service life and decays exponentially towards zero. Manufacturers usually specify the reliability of a device in terms of mean time to failure (MTTF). During the service life, the hazard rate and MTTF are related as MTTF = 1 λ. (2.2) The relationships in Eq. 2.1 and 2.2 allow us to calculate the probability of failure of a component from the manufacturer s published MTTF. It is important to remember that this MTTF applies only during the constant-hazard-rate portion of the bathtub curve. It is a common mistake to assume that MTTF, since it has units of time, measures how long an item will last. Most components will fail due to wearout long before the time corresponding to MTTF is reached. Reference [19] has this to say about the confusion: Note that there is no direct connection or correlation between service life and failure rate. It is possible to design a very reliable product with a short life. A typical example is a missile for example: it has to be very, very reliable ([MTTF] of several million hours), but its service life is only 0.06 hours (4 minutes)! 25 year old humans have an [MTTF] of about 800 years (about 0.1%/year) but not many have a comparable service life. Just because something has a good [MTTF], it does not necessarily have a long service life as well. [19, p. 5] One of the reasons that the constant hazard rate model is commonly used is because many reliability calculations are much simpler under this model than other models. 18

29 This model is closed under the operations of combining devices in serial and parallel, while most other reliability models are not [20, p. 47]. Another useful property is the lack of memory of the exponential function; i.e., the probability that a device will fail in the next hour of operation is the same at any point within the constant-failure-rate portion of the bathtub curve [20, p. 43]. Some devices used in mobile robots do not follow the constant-failure-rate model. Devices that fail due to mechanical wearout, such as bearings, are better fitted by more complex reliability models. However, the reliability of these devices can be approximated piecewise by regions of constant failure rate. This allows for the simpler calculations of the exponential model to be used within each segment of the approximation [20, p. 44]. 19

30 2.3 Robots and Tasks Robot decomposition In order to allow for a systematic evaluation of mobile robot reliability, we have developed a formal method for representing robots and their subsystems. For our analyses we consider robots to be made of multiple modules, as in Figure 2.3. We use module here to refer to a specific instantiation of a robot subsystem. A subsystem is a functional division of the robot that can be conceived as being engineered, assembled and tested independently of other subsystems (Figure 2.4). The methods presented here are not dependent on this particular definition of module or subsystem, but this definition makes it possible to consider modules as interchangeable building blocks for robots, allowing us to use reliability and other criteria to choose the best set of modules for a given mission. Figure 2.3. Modular robot concept 20

31 Figure 2.4. NASA Hierarchical System Terminology [21] Combining module reliabilities to obtain the reliability of an entire robot is straightforward when the constant-hazard-rate model is used. Modules are considered to be either in series or parallel. In a series combination, all modules must be functioning for the system to function. In a parallel combination, only one module must be functioning for the system to function. For a series combination the overall reliability is the product of the component reliabilities, i.e., N R s = R i, (2.3) and the overall hazard rate is the sum of the hazard rates for the modules, i.e., i=1 λ s = N λ i. (2.4) i=1 21

32 For modules in parallel, the overall unreliability (1 minus the reliability) is the product of the component unreliabilities: (1 R S ) = N (1 R i ). (2.5) i=1 If the modules are identical (which is usually the case), then the overall hazard rate for the parallel combination is λ S = λ ( N ) 1. (2.6) Module task and robot task reliability We use task completion as our fundamental utility measure. We assume that the mission can be decomposed into distinct tasks and that these tasks are assigned to particular robots. Using task completion as our fundamental measure allows us to compare different robot and team configurations based on how many tasks they can complete, how quickly they can complete tasks, the percentage of a complex mission that they can complete, etc. To calculate the probability that a module will survive a mission task (module task reliability), the MTTF of the module must be known, along with the expected usage of the module during that task. For instance, we might be told that Task 1 will take six hours, using modules A and B for the entire six hours and using module C for three hours. 22

33 In order to discretize the calculations, we evaluate the probability of failure only at the end of a task. We assume that the entire task is completed whether there is a failure or not; i.e., all failures occur after completion of the task. This assumption does not limit the usefulness of our method because if one needs to know whether a robot failed in the middle of a task, the tasks can simply be restated into subtasks to provide a desired level of granularity. Given the module task reliability for each module, we can use the equations for combining reliabilities (given in Section 2.3.1) to determine the probability that the robot will fail during the task (robot task reliability) Single-robot example We now apply the formulas from the preceding sections to predict the probability that a robot will complete a mission task. Consider a planetary exploration rover that is tasked to extract core samples. The rover is composed of five modules: Power Computation and Sensing Mobility Communications Manipulator 23

34 Table 2.1. Module usage during sampling task Module Usage (h) Power 8 Computation & Sensing 8 Mobility 6 Communications 2 Manipulator 4 The duration of the task is eight hours, and the amount of time each module is used during the task is given in Table 2.1. For each module, we obtained reliability data from JPL that are representative of components used in NASA s planetary robots. As an example, the breakdown of components and reliabilities for the power module is shown in Table 2.2. The entire list of component reliabilities is provided in Appendix A. Table 2.2. Components comprising power subsystem Component Quantity MTTF (h) Battery 2 4.8M Battery control board 2 2.5M Mission clock 1 10M Power distribution unit 1 588k Power control unit 1 5.3M Shunt limiter 1 88k Electrical heater 2 333k Radioisotope heater 2 73k Thermal switch 2 11k 24

35 Table 2.3. Robot subsystem reliabilities Module MTTF (h) Power 4.20k Computation & Sensing 4.77k Mobility 19.7k Communications 11.9k Manipulator 13.8k These component reliabilities were combined for each module according to Eq. 2.4, giving the module MTTFs listed in Table 2.3. Using these overall module failure rates and Eq. 2.1, we can calculate the probability that each module will still be functioning at the end of the task. For the power module, this gives R = e ( 4202) 8 = %. (2.7) The reliabilities for the other modules for this task are found similarly and are shown in Table 2.4. Table 2.4. Module reliabilities during sampling task Module Module Task Reliability Power % Computation & Sensing % Mobility % Communications % Manipulator % 25

36 Finally, we combine all of the module reliabilities using Eq. 2.3 to give an overall robot task reliability of %. 26

37 2.4 Summary In this chapter, we introduced definitions and models from the reliability engineering literature and provided a representation that can be used to apply these models to mobile robots. We then demonstrated how our representation can be used to predict the probability that a single robot will complete a given task. This type of calculation is useful for selecting components from which to build a robot to meet mission requirements. For example, given several mobility modules with different reliabilities and costs, we can calculate the robot task reliabilities for robots using each alternative and then select the lowest-cost module that meets the mission requirements. 27

38 Chapter 3 MULTIROBOT RELIABILITY The reliability engineering methods presented in the previous section fall short when applied to multirobot teams. The equations for combining reliabilities of subsystems (Eq ) assume that the failure of one subsystem is independent of the failure of other subsystems. This is a reasonable assumption when combining component reliabilities to create larger assemblies, and even when combining assemblies to produce an entire robot. When combining robots to make a robot team, however, this assumption is not reasonable in many cases. For most multirobot missions, the failure of one robot will affect the tasking of other robots so that their reliabilities are not independent. In this chapter we present a method that overcomes this limitation, allowing us to calculate the probability of completing a multirobot mission. 3.1 Related Work There is considerable work in the multirobot domain that examines how to diagnose and/or recover from robot failures. For example, [22] describes a behavior-based 28

39 robot control architecture that is able to adapt to robot failures and communication failures, and [23] discusses detection and recovery from multiple types of failure in a market-based planner. As in the single-robot domain, our work differs from these in that we are developing methods to predict the probability of failure before it occurs rather than to respond to failure after it occurs. The only known work preceding ours in the area of predicting mobile robot team reliability is [3]. That paper s methods are similar to ours in that they are based in the reliability engineering literature, but that work has a narrow focus on teams of robots with cannibalistic repair capability. In contrast, we are developing a general methodology that can be applied to a wide variety of robot teams and missions. We revisit [3] in more depth in Section

40 3.2 Analytical Solutions for Simple Multirobot Missions For very simple missions, it is possible to enumerate by hand all of the possible outcomes. One way of doing this is by drawing a tree diagram such as in Figure 3.1. We can use such a tree to derive an analytical solution for the probability of mission completion (PoMC). For the two-task, two-robot mission shown in Figure 3.1, the analytical solution is PoMC = P(R 1 T 1 )P(R 2 T 1 )P(R 1 T 2 )P(R 2 T 2 ), (3.1) where P(R n T m ) is the probability that robot n survives task m. If the robots are identical, then this becomes PoMC = P(T 1 ) 2 P(T 2 ) 2. (3.2) Figure 3.1. Possible paths for simple mission. (R 1 + = Robot 1 alive; R 1 = Robot 1 dead) 30

41 3.3 Stochastic Simulation for Complex Multirobot Missions In more realistic mission scenarios, the failure of one robot will have an impact on the probability of failure of the other robots on the team so that the probability of mission completion cannot be calculated in a straightforward manner. The simplest example of such dependence is when there are a fixed number of tasks to be completed and the tasks will be allocated among available robots until all tasks are completed or all robots have failed. In this case, when one robot fails, there is a greater amount of work to be performed by the remaining robots, which increases the probability that they will fail. Robot reliabilities are also interdependent when robot tasks are not executed independently. This is the case, for instance, when there are tasks that require two or more robots to work together. If one of the robots performing a joint task fails, perhaps the remaining robots can still complete the task, but with increased stress on their components, which then increases their chance of failure. Or perhaps that task is abandoned, in which case the remaining robots have a decreased chance of failure. Another type of reliability interdependence is introduced if the robot team is capable of repairing a failed team member. Since repairing a failed robot requires action on the part of other robots, the failed robot is repaired at the cost of increased probability of failure for the robots executing the repair. Repairing a failed team member may therefore in some cases decrease the probability of mission completion. 31

42 Figure 3.2 illustrates how mission complexity increases when such interdependence is introduced. This figure represents the same mission as Figure 3.1, but with the addition of the ability to repair one failed robot. The addition of this single repair capability has increased the number of leaf nodes from 7 to 25. For a realistic scenario with several robots, multiple tasks, and perhaps dozens of spare parts, the tree becomes complex enough that a direct analytical solution is infeasible. For these more complex missions, we have developed a method of estimating mission reliability using stochastic simulation. In this method, we represent the mission using a state transition diagram, as in Figure 3.3. (Details of the mission represented by Figure 3.3 are given in Section 3.4.) The state machines represented by these diagrams can be implemented in software in order to explore the space stochastically. At each task node, the state of the robot team is evaluated by choosing a random value between zero and one for each module and comparing that value with the module task reliability for that module for the current task. The branch in the diagram corresponding to the resulting Figure 3.2. Same mission as Figure 3.1 but with one repair allowed 32

43 team state is followed, and the process continues until the simulation reaches either Success or Failure. Start # Robots <2? Y Failure N # Panels =0? Y Success N Transit (2 robots) Transit (1 robot) Y # Robots <2? Y # Spares >0? N Failure N Assemble N # Robots >0? Y Return Figure 3.3. State transition diagram for complex mission 33

44 The simulation is repeated many times, with each Success result being assigned a score of one and each Failure result being assigned a score of zero. The average score of a large number of trials then gives the overall probability of mission completion. While this method has computational limitations, it is a significant improvement over the direct analytical method, which can require days of tedious hand calculations and has a high potential for human error. 34

45 3.4 Example Results for a Complex Multirobot Mission Consider a planetary exploration mission where a team of robots is tasked to install a solar panel array for a measurement and observation outpost. The mission consists of carrying solar panels from the landing site to the outpost and then assembling them. The size of the solar panels is such that two robots are needed to carry and assemble one panel. For the purposes of this analysis, the task of assembling a solar panel is broken down into three subtasks: Transit to the outpost; Assemble the panel; and Return to the landing site. The state transition diagram for this mission was shown in Figure 3.3. Working through that figure from the top, we see that if there are fewer than two robots then the mission is a failure. If there are at least two robots, then if there are no panels left to be installed, then the mission is a success. If there are at least two robots, and there are panels still remaining to be installed, then the robots will pair off and carry panels to the outpost (Transit task). After the Transit task, if there are fewer than two robots alive and if there are spare robots at the landing site, then the spares will Transit to the outpost until at least two robots are available to Assemble or until there are no more spare robots (in the latter case, the mission 35

46 fails). The robots then pair off to Assemble the panels, and any robots that survive that task Return to the landing zone. For this example all of the robots on the team are identical. The usage times for each module for each task are shown in Table 3.1. These usage times along with the subsystem reliabilities from Table 2.3 are used to calculate the module task reliabilities for this mission, which are shown in Table 3.2. For the example mission scenario described above, once the tasks, the task durations, and the baseline module reliabilities are established, then the input variables for the model are the number of robots on the team, the reliability of the components used, and the mission duration (number of panels to be installed). Table 3.1. Subsystem usage by task (h) Subsystem Transit Assemble Return Power Computation & Sensing Mobility Communications Manipulator

47 By examining how the probability of mission success varies as these inputs are changed, we can answer questions such as For a given mission duration and component reliability, what is the fewest number of robots needed to meet a certain probability of mission completion? and If additional robots are added beyond the minimum number, can we use lower reliability components, and if so, how much lower? We explore these questions in Sections and 3.4.2, respectively Comparing teams having different numbers of robots Figure 3.4 compares the simulation results for teams with different numbers of robots, with all robots having the component reliabilities listed in the above tables. We see from this figure that adding even one robot beyond the minimum (two) increases the probability of mission success dramatically, even for relatively short missions. However, there is a diminishing improvement as additional robots are Table 3.2. Module task reliabilities Subsystem Transit Assemble Return Power 99.86% 99.81% 99.86% Computation & Sensing 99.87% 99.92% 99.87% Mobility 99.97% 99.96% 99.97% Communications 99.98% 99.97% 99.98% Manipulator 100% 99.94% 100% 37

48 added to the team. We can use this figure to answer the first question above. For example, for a mission specifying that 30 panels are to be installed with a probability of mission completion of at least 95%, then the team must include at least four robots (Figure 3.5). Probability of mission completion (%) robots 3 robots 4 robots 5 robots Mission duration (number of panels) Figure 3.4. Different numbers of robots Probability of mission completion (%) Design point 85 2 robots 3 robots 4 robots 5 robots Mission duration (number of panels) Figure 3.5. Closeup of area of interest from Figure

49 3.4.2 Comparing teams with robots having different reliabilities If additional robots are added beyond the minimum required, it should be possible to use less-reliable components in those robots and still achieve a required mission reliability. Figure 3.6 shows the simulation results for teams of four robots with component reliabilities ranging from 10% to 100% of the baseline amounts from Table 2.3. When varying the reliability of the components, we apply a constant multiplier to all of the subsystem MTTF values in Table 2.3. For instance, when we refer to a team with 10% of the MTTF of the baseline team, we are multiplying all the values in Table 2.3 by 10%. Figure 3.6 shows that for very short missions a team of four robots with only 10% of the reliability of the baseline team can provide a higher probability of mission Probability of mission completion (%) robots (100) 4 robots (50) 4 robots (25) 4 robots (10) Mission duration (number of panels) Figure 3.6. Different component reliabilities 39

50 completion compared to the baseline two-robot team. As the length of the mission increases, the reliability required for the four-robot team to equal the performance of the baseline team increases, but the four-robot, 50%-lower-MTTF team still outperforms the baseline team even for fairly long missions (on the order of a year). 40

51 3.5 Example Repairable vs. Nonrepairable Robot Teams As mentioned earlier, there is one previous paper ([3]) in the literature that looks at reliability as a design parameter for mobile robot teams. In this section we compare our method to the one in that paper by analyzing the example mission given in that paper. The mission considered in [3] is one where a team of robots are moving dirt. The dirt-moving task is a continuous task, where the amount of dirt moved is proportional to the total robot lifetime, where total robot lifetime is the sum of the lifetimes of all robots on the team. The robots making up a team are identical and are made of discrete modules. When an individual module fails, a robot is dead. During its lifetime each robot moves dirt at a constant rate. The basic comparison made in [3] is between teams of repairable and nonrepairable robots. For repairable teams, a robot can be repaired by a teammate using spare modules. The spare modules are taken from other failed robots at the beginning of the mission there are no spares. Two conditions are therefore necessary for repair to take place: There must be a functional robot to execute the repair, and there must be spare modules of the correct type available. No time is elapsed during a repair, and the repair task does not itself contribute to robot failure. 41

52 Using the method described in Section 3.3, we simulated this mission. Figures 3.7, 3.8, and 3.9 show, on the left, the results presented in [3] and, on the right, our results. These figures show that, qualitatively, our results are very similar to those in the previous paper. One thing that is not specified in [3], and that makes exact comparison difficult, is the failure rate, λ. Figure 3.10 shows the same results as Figure 3.8 for several Units of work completed nonrepairable repairable Number of robots Figure 3.7. Total work completed; two-component robots (left figure from [3]) Percent increase in work completed (repairable/nonrepairable) Number of robots Figure 3.8. Percent improvement of repairable team over nonrepairable team; two-component robots (left figure from [3]) 42

53 values of λ. While the overall conclusion (that repairable teams are superior) remains the same, the degree of superiority depends highly on the failure rate. The effects of varying failure rate are not addressed in [3]. These results show that our method is capable of achieving results similar to the method in [3]. What is different is that the method used in that paper is an analytical method, similar to that presented in Section 3.2 of this document and with all the Units of work completed nonrepairable repairable Number of robots Figure 3.9. Total work completed, six-component robots (left figure from [3]) 120 Percent increase in work completed (repairable/nonrepairable) λ = 0.80 λ = 0.84 λ = 0.88 λ = 0.92 λ = 0.96 λ = Number of robots Figure Effect of failure rate on repairable team superiority 43

54 shortcomings of that method. The mission scenarios addressed in [3] are very simplistic, and that paper fails to address the difficulty of using analytical methods for complex missions. The most complex mission scenario presented in that paper considers a team with three robots and two nonidentical modules, for which the solution is given as 18l l 1 l l 2 2 (l 1 + l 2 )(3l 1 + 2l 2 )(2l 1 + 3l 2 ). (3.3) The amount of time required to develop such analytical solutions, and the significant likelihood for human error in their derivations, makes these methods undesirable even for fairly simple missions. They become impractical for missions of any significant complexity. 44

55 3.6 Summary In this chapter, we showed how reliability prediction for multirobot teams is often a different type of problem than for single robots due to the interdependence of robot reliabilities, making analytical reliability solutions impractical for multirobot missions that have significant complexity. We introduced a method using stochastic simulation to estimate mission reliabilities for such missions, and we demonstrated the use of this method to determine the optimal team size for a multirobot mission. Finally, we used this method to analyze the relative effectiveness of repairable and nonrepairable robot teams in revisiting a problem previously introduced into the literature by [3]. Our results here demonstrate that our method can produce similar results to the prior work, while also allowing for analysis beyond that shown in the prior work. 45

56 Chapter 4 DESIGN TRADEOFFS The methods presented in the previous chapters provide estimates of the probabilities of task and mission completion. We have shown how these estimates can be used to compare the performance of different robot teams. However, these reliability estimates by themselves are not terribly useful for mission design. If reliability existed in a vacuum, then we would simply build the most reliable robots possible for every mission. In designing a real-world mission it is necessary to consider other performance metrics and trade them off against reliability. In this chapter we explore some of the possible tradeoffs that can be made. 4.1 Cost One of the most important factors in robot mission design is cost. For a given mission, we would like to be able to determine which team configuration will meet the mission specifications, including reliability, at the lowest cost. The reliability of planetary rovers is related to overall mission cost in two ways. 46

57 First, there is the increased cost associated with building higher-reliability rovers. Second, there is the increased expected value of the mission when using higher-reliability rovers due to a higher probability of mission success Cost of reliability In choosing components from which to build rovers, a designer would usually make choices among a small number of alternative components, each providing a certain reliability for a certain cost. In the early stages of mission design, however, the mission designer may not yet have information about specific components. In this case, it is useful to have a parametric model of the cost reliability relationship. Reference [24] provides a general model for this relationship, which is given as { c = exp (1 f) (R } i R min ), (4.1) (R max R i ) where R i is a reliability of interest between R min and R max ; f is the feasibility of reliability improvement (a number between 0 and 1); and c is the ratio of the cost of R i to the cost of R min. Figure 4.1 shows the relative cost of rovers with differing component reliabilities. The costs are plotted as a percentage of the baseline rover cost, using R min = 0, R max = 1 and f = Launch costs are also significantly affected by rover reliability. More-reliable rovers will weigh more, due to the generally-larger size of more-reliable components 47

58 and also due to increased component redundancy. We have not found a model for the reliability weight relationship in the literature. As an initial approximation we assume that the relationship between weight and reliability is directly linear and that the relationship between launch costs and weight is also directly linear Expected mission reward Any robotic mission must have some inherent value to it. For some missions there will be an obvious economic or strategic value to which a dollar amount can be assigned. For a mission that lacks such an obvious dollar value, the cost of the mission itself can be used as a lower bound for this inherent mission value, since the sponsors presumably expect some positive return on their investment. Multiplying the probability of mission success by the inherent value of the mission Rover cost (% of baseline team) f = 0.95 f = 0.90 f = Component reliability (% of baseline) Figure 4.1. Relative cost of rovers as function of component reliability 48

59 gives an expected reward for a given team configuration. For example, Figure 4.2 shows the relationship between component reliability and expected mission value for a six-rover team performing the solar-panel-assembly mission described in Chapter Overall cost reliability relationship Taking the expected mission value calculated above and subtracting the rover development and launch costs gives an estimate of the net expected gain for the mission. We ignore operating costs here since we expect them to be roughly constant with respect to rover reliability (probably slightly higher for lower-reliability rovers due to the increased need for human intervention). In order to combine these costs meaningfully, we assign real dollar values to the 100 Expected value (% of max value) Component reliability (% of Table 3 values) Figure 4.2. Expected value of mission as a function of component reliability 49

60 various costs for the baseline team (Table 4.1). These values are estimated from the costs of the MER mission, along with the assumption that the rovers for this mission would be somewhat cheaper and smaller than the MER rovers due to advances in technology and also because they are single-purpose machines. These values are used to calculate the net expected gain, which is plotted in Figure 4.3a along with its constituent parts. The most significant thing revealed by this figure is that there is clearly an optimal reliability range with respect to the expected gain of the mission and that this optimal reliability is significantly lower than the reliability of the baseline legacy design. Figure 4.3a shows that for low-reliability rovers the cost of failure drives the net expected gain down, while for very-high-reliability rovers the high cost of the rovers themselves drives the expected gain down. The optimal reliability range therefore lies in a middle region where neither of these costs is as high. In order to evaluate the effects of some of our assumptions, we repeated the above analysis for different values of the feasibility constant (since this value was arbitrary) and of the mission inherent value (since we used a lower-bound estimate for this Table 4.1. Baseline team costs and rewards Item Cost ($ Millions) Robot cost (entire team) 150 Launch cost (entire team) 300 Inherent value of mission

61 value). These results are shown in Figures 4.3b and 4.3c. These figures show that while the shape of the expected gain curve changes with these parameters, the overall trends remain the same: Both figures support the argument that the optimal range for mission reliability with respect to mission gain is at a lower level than we would intuitively expect. 51

62 $ (Millions) Expected value -300 Rover cost Launch cost Expected gain Component reliability (% of baseline) (a) f = 0.95, value = $450M $ (Millions) Expected value -200 Rover cost Launch cost Expected gain Component reliability (% of baseline) (b) f = 0.5, value = $450M $ (Millions) Expected value -200 Rover cost Launch cost Expected gain Component reliability (% of baseline) (c) f = 0.95, value = $900M Figure 4.3. Net expected gain 52

63 4.2 Example Multirobot Team Size Using the reliability cost relationship presented in Section 4.1, we revisit the solar panel mission from Chapter 2, with the goal of addressing a claim that has been made in the literature about one benefit of multirobot systems Introduction Applications of multirobot systems can be divided into two categories: those where multiple robots are necessary for task completion and those where a single robot could complete the task but where multiple robots are desirable for reasons other than task completion. An example application falling into the first category is soccer a single robot cannot play soccer. An example application in the second category is area coverage while in many cases an area can be covered by a single robot, it may be preferable to use more than one robot in order to cover the area more quickly. When the mission itself does not dictate a particular robot team configuration, there are multiple requirements that a mission designer must consider. Three important factors that we consider here are time, cost, and reliability. Time can be a reason for using more robots than the minimum required because, for some tasks, having extra robots can reduce the time required to complete the 53

64 task. For instance, in an area coverage task, multiple robots can work in parallel in order to accomplish the task more quickly. Cost is an important consideration in team size. There is the cost of additional robots. There is the cost of robot components more robust components cost more. There are operating costs such as transportation and maintenance, which may be higher for a larger team. Infrastructure costs are likely to be greater for a larger team; for instance, a larger team may require more communications bandwidth. The third performance criterion we consider here is reliability, expressed as the probability of mission completion (PoMC). A requirement for a mission to have a certain probability of successful completion can dictate the minimum number of robots required for the mission. For example, if one robot has a 90% probability of surviving a task, but the mission requirement is for a 97% probability of having one robot survive the task, then one way to meet this requirement is by sending two robots (giving a 99% chance that one would survive). These criteria (time, cost, reliability) are highly interdependent. As an example, adding more robots to a mission increases the cost, but it can also reduce the amount of time required to complete the mission. Reducing the mission duration means that the robots don t need to survive as long, so they can be built of lower-reliability components, which reduces the cost. These relationships among team size, component reliability, cost, time, and mission success have been mentioned in the robotics literature, but only in passing and 54

65 only in qualitative terms. In particular, researchers often claim that multirobot systems provide greater reliability than single-robot systems (e.g., [25], [26], [27], [28]). Superficially, such a claim seems obviously true if three robots are sent to do a task instead of one, there is a greater chance of completing the task. When one examines the above claim in greater depth, however, finding the answer can be complicated. In this example, the cost of completing the task has been tripled by sending three robots. If these same additional funds were instead invested to improve the reliability of a single robot, then which would be more likely to complete the task the three robots or the single superior robot? The answer is no longer obvious Analysis We briefly remind the reader of the mission previously described in Chapter 2: A team of robots is tasked to transport and assemble solar panels. The solar panels are large, so that two robots are required to carry and assemble each panel. The baseline team consists of a pair of highly reliable robots. Using the cost reliability relationship in Eq. 4.1, we can determine alternative team configurations with the same overall cost. For example, we find that a team with four robots, each 55

66 made of components with 40% of the MTTF of the baseline components, would cost about the same, using a feasibility of 0.5. Figure 4.4 shows the simulation results for these two teams. We see here that the team with four lower-reliability robots has a higher mission reliability than the baseline team for missions shorter than 85 panels. The larger, lower-reliability team would therefore be the more cost-effective solution for shorter missions, while the smaller, high-reliability team would be more cost-effective for longer missions R (100%) 4R (40%) 80 PoMC (%) Mission duration (number of panels) Figure 4.4. Comparison of equal-cost teams 56

67 4.3 Operating Conditions The reliability engineering methods presented in Chapter 2 lack an explicit accounting of operating and environmental conditions. Much of reliability engineering was originally developed for analysis of systems installed in fairly static environments such as nuclear power plants. Mobile robot components are exposed to dynamic operating and environmental conditions, particularly in the case of planetary exploration rovers, which, for example, are subjected to temperature differences of hundreds of degrees between day and night. The reliabilities of many of the components in a mobile robot will vary under different operating conditions. It is therefore necessary to examine how the standard reliability engineering methods can be adapted to take into account varying operating conditions Extrapolation of MTTF to other operating points The MTTF provided by a device manufacturer represents the hazard rate under a single set of operating conditions. In order to make reliability predictions over a range of operating conditions, we need to extrapolate MTTF at different operating conditions from the single-point MTTF. Models relating how operating conditions affect reliability are available for many components. These relationships are used, for instance, in accelerated-life testing, where devices are subjected to extreme operating conditions in order to induce failure, and the observed failure rates are then extrapolated back to normal operating conditions. 57

68 An example of a robot component whose reliability is affected by operating conditions is a mechanical bearing. Such bearings are often found in robot motors and joints. The failure rate of mechanical bearings is significantly affected by operating conditions such as temperature, rotational speed, and load. Here we show how the single-point MTTF for a mechanical bearing can be extrapolated over a range of temperature and load conditions. Reliability of bearings is often expressed by the L 10 life, which is the time at which 10% of the population has failed. For a mechanical bearing the L 10 value is given by L 10 = ( ) d ( ) C 10 6, (4.2) P 60n where C is the rated bearing load, P is the actual bearing load, d reflects the type of bearing (d = 3.0 for a ball bearing, d = 3.3 for a roller bearing), and n is the rotational speed [29]. Holding the speed constant and using d = 3.0, we find that the life is related to the applied load as L 10 L 10,0 = ( P0 P ) 3, (4.3) where the subscript 0 indicates the manufacturer s published reliability data. To relate L 10 life and hazard rate, we use Eq. 2.1 with R = 90%, giving λ = ln (0.9) L 10. (4.4) 58

69 Combining Eq. 4.3 with Eq. 4.4 gives the relationship between hazard rate and operating load: λ = MTTF ( ) 3 0 P λ 0 MTTF =. (4.5) P 0 Bearing life is also greatly affected by temperature since the lubricant in the bearing breaks down faster at higher temperatures. The approximate relationship used for the effect of temperature on bearing failure is that every 10 C rise in temperature doubles the failure rate [30], or λ = MTTF 0 λ 0 MTTF = T T 0 2( 10 ). (4.6) We can combine multiple environmental factors, assuming that they are independent. In this case we can determine the effect of combined load and temperature changes on the MTTF of a bearing, which is λ = MTTF ( ) 3 0 P λ 0 MTTF = 2 ( T T 0 10 ). (4.7) P 0 Eq. 4.7 is plotted in Figure 4.5. This figure shows that MTTF varies greatly even over a fairly small range of temperatures and loads. This illustrates why the single-point MTTF provided by manufacturers is inadequate to describe the reliability of devices operating under significantly different conditions from those under which the MTTF was established. 59

70 4.3.2 Operating envelope Figure 4.6 shows some of the lines of constant MTTF resulting from Eq These lines illustrate how operating conditions can be traded off against one another as well as against reliability. For instance, if a robot is to be operated in a high-temperature environment, it may be desirable to operate the robot motors at lower speeds in order to compensate for the increased ambient temperature. On the other hand, if the speed of the robot was a critical mission requirement, then we could continue to operate the robot at full speed, but with a quantitative understanding of the tradeoff being made with respect to reliability. Such tradeoffs could be automated in a sophisticated rover that would monitor ambient conditions and modify its mission profile in order to maintain a target mission reliability, in much the same way that human workers will slow down when working under adverse environmental conditions. Figure 4.5. Effect of operating conditions on bearing MTTF 60