Assurance of Model-Based Autonomy for Robotic Space Missions

NASA's robotic space missions must make use of on-board automation and autonomy to control themselves when communication with Earth is slow (due to light-time delays across the solar system) or unavailable. As mission concepts become more ambitious, increasingly capable forms of autonomy are required - ones that go well beyond executing a single preformulated script. Assurance of autonomy - the means by which would-be mission proposers, reviewers and managers will be provided the confidence to trust their expensive assets to autonomous control - is a challenging necessity. In this paper we look at assurance of some more capable forms of autonomy that use models - models of the environment in which system is to operate, and models of the asset (spacecraft, rover, helicopter, etc.) itself. The latter models must cover the different factors crucial to the asset's health and operation. For example, managing electrical power - its source, storage and consumption - is needed, and models are used to predict the power balance over time. Likewise important is managing the thermal conditions - temperature of the asset, its sensitive instruments, its mechanisms, etc. These models are used by the on-board controller to plan and schedule the asset's activities and to monitor the health of the hardware to take remedial action if need be when things go wrong (due to temporary faults, or permanent degradations and failures). However, the computational resources on-board are typically but a fraction of those available on Earth. As a result, the on-board models are deliberate simplifications of those created for ground operations, simplified for tractable execution within those limited computational resources. Several key assurance challenges that stem from this are the following: What process should we follow to derive simplified models so that the simplifications won't mislead the asset into performing a dangerous activity? How will we know the combination of simplified models remains sufficiently accurate (e.g., the power model's simplifications when coupled with the thermal model's simplifications don't compound one another)? What can we have the asset do to detect if things are straying too far from model predictions in time to do something about it? This paper describes approaches to answering these questions, through a combination and adaptation of techniques for analysis, testing and monitoring drawn from other (non-space) domains.