SAFER++

1. SAFER++ VDM++ and UML Thomas Christensen & Tommy Pedersen

2. Agenda • Discussion • VDM++ code • Summary

3. Discussion • How to compensate for a defective thruster ?

4. Discussion • How to compensate for a defective thruster ? • Cases: • Rotation around one axis only • Translation along one axis only • Multi-axis rotation • Multi-axis translation

5. Discussion

6. Discussion • Case: Rotation around one axis only • Example: • +pitch (Clockwise around y-axis) • Thrusters B1 and F3 are fired (left side thrusters)

7. Discussion • Case: Rotation around one axis only • Example: • +pitch (Clockwise around y-axis) • Thrusters B1 and F3 are fired (left side thrusters) • Thruster B1 fails.. • Compensate by: • Disabling B1 and F3 • Firing equivalent right side thrusters, B2 and F4

8. Discussion • Case: Translation along one axis only • Example: • Forward translation (along +X-axis) • All forward thrusters are fired, F1, F2, F3, F4

9. Discussion • Case: Translation along one axis only • Example: • Forward translation (along +X-axis) • All forward thruster are fired, F1, F2, F3, F4 • Thruster F3 fails... • Compensate by: • Disabling diagonally opposite thruster F2 • Keep firing F1 and F4 (½ power)

10. Discussion • Case: Multi-axis rotation • Example: • -pitch, -yaw (CCW around z and y-axes) • Thrusters B4 and F1 are fired

11. Discussion • Case: Multi-axis rotation • Example: • -pitch, -yaw (CCW around z and y-axes) • Thrusters B4 and F1 are fired • Thruster B4 fails... • Problem.... • No equivalent thruster combinations

12. Discussion • Case: Multi-axis rotation • Possible solution 1: • Rotate backwards

13. Discussion • Case: Multi-axis rotation • Possible solution 1: • Rotate backwards • Fire opposite thrusters, F4, B1 • SAFER rotates to same position (backwards) • Problems: • Counter-intuitive movement. (Warning light ?) • May use more GN2 for propulsion

14. Discussion • Case: Multi-axis rotation • Possible solution 2: • Replace single multi-axis rotation by multiple single-axis rotations. • Single-axis rotations can always be performed by alternative thrusters. • ”Step-wise” rotation • Problems: • R(a+Δa,b+Δb,c+Δc) ≠ R(a,b,c)R(Δa,Δb,Δc)

15. Discussion • Case: Multi-axis rotation • Possible solution 3: • Don’t compensate • Example: • -pitch -yaw, (CCW around z and y-axes) • Thrusters B4 and F1 are fired • Thruster B4 fails... • Use F1 only

16. Discussion • Case: Multi-axis rotation • Possible solution 3: • Don’t compensate • Problems: • Wider turn radius. • Thruster output constant, cannot boost to compensate

17. Discussion • Case: Multi-axis translation • Not possible • Translation prioritized • X > Y > Z • Only one axis at a time

18. Discussion • Summary • Cases: • Compensation possible • Rotation around one axis only • Translation along one axis only • Compensation not feasible • Multi-axis rotation • Compensation not relevant • Multi-axis translation

19. VDM++ SelectThrusters() == ... if numberOfDefThr = 0 then selected := selected else if numberOfDefThr = 1 then if card (selected inter defThrusters) = 0 then selected := selected else selected := CompensateSingle(selected, defThrusters) else if numberOfDefThr > 1 then if card (selected inter defThrusters) = 0 then selected := selected else if card (selected inter defThrusters) = 1 then selected := CompensateSingle(selected, defThrusters) else if card (selected inter defThrusters) > 1 then selected := CompensateMultiple(selected, defThrusters)

20. VDM++ CompensateSingle : set of ThrusterPosition * set of ThrusterPosition ==> set of ThrusterPosition CompensateSingle(selected, defective) == let transType : TransformationType = GetTransformationType(intcmd) in cases transType: <ONE_AXIS_TRANSLATION> -> alt_thrusters = (tran_single_axis(defective union DiagonalMap(defective))) <ONE_AXIS_ROTATION> -> alt_thrusters = (OppositeMap(defective) union OppositeMap(selected\defective)), <NO_MOVEMENT> -> alt_thrusters = {}, others -> alt_thrusters = {} return alt_thrusters;

21. VDM++ TransformationType = <ONE_AXIS_TRANSLATION> | <ONE_AXIS_ROTATION> | <TWO_AXIS_ROTATION> | <THREE_AXIS_ROTATION> | <TRANSLATION_ROTATION_COMBO> | <NO_MOVEMENT>; public DiagonalMap : map ThrusterPosition to ThrusterPosition = { -- Back Thruster positions <B1> |-> <B4>, <B2> |-> <B3>, <B3> |-> <B2>, <B4> |-> <B1>, ... public OppositeMap : map ThrusterPosition to ThrusterPosition = { -- Back Thruster positions <B1> |-> <F4>, <B2> |-> <F3>, <B3> |-> <F2>, <B4> |-> <F1>,

22. VDM++ tran_single_axis : map set of ThrusterPosition to set of ThrusterPosition = { -- +X translation {<F1>, <F4>} |-> {<F2>, <F3>}, {<F2>, <F3>} |-> {<F1>, <F4>}, -- -X translation {<B1>, <B4>} |-> {<B2>, <B3>}, {<B2>, <B3>} |-> {<B1>, <B4>}, ...

23. VDM++ GetTransformationType : IntegratedCommand ==> TransformationType GetTransformationType() == let mk_(tran, rot) = intcmd.GetCommand() in if rot(Command`ROLL) = <Zero> and rot(Command`PITCH) = <Zero> and rot(Command`YAW) = <Zero> and tran(Command`X) = <Zero> and tran(Command`Y) = <Zero> and tran(Command`Z) = <Zero> then return <NO_MOVEMENT> else if rot(Command`ROLL) = <Zero> and rot(Command`PITCH) = <Zero> and rot(Command`YAW) = <Zero> and (tran(Command`X) <> <Zero> or tran(Command`Y) <> <Zero> or tran(Command`Z) <> <Zero>) then return <ONE_AXIS_TRANSLATION> else ...

24. VDM++ public CompensateMultiple : set of ThrusterPosition * set of ThrusterPosition ==> set of ThrusterPosition CompensateMultiple(selected, defective) == return {};

25. Summary • Strategies for compensating for defective thrusters • Single-axis translation and rotation can be compensated for. • Multi-axis translation is not possible. • Multi-axis rotation cannot safely be compensated for. • VDM++ code