Subsystem situational decomposition
Action
Options/Steps to
accomplish
action/Functions
Parameters needed complete action
Parameter specifications
Mitigation of risk
Person lifts the robot
Handles
Two on either side
Weight consideration when >1 person is used to lift the
lifting robot
robot
Mini-crane
Holes for hooks/straps
Hole must be at least 1.5" to fit
standard strap hooks
Unstable control of the robot There needs to be 3 hook
while its hanging from straps points in order to safely
connected to mini-crane.
move the robot using a crane
Bumpers/suspension to absorb shock
Module safety when being
dropped
Reinforced chassis and shock
absorption
Durable Chassis
Safety to Personnel
Needs to meet Military safety
standard MIL 883E
Braking system with manual release (parking
brake)
This can be in the form of a button
that engages the brake when the
button is not pressed and disengages
when the button is pressed.
Loose control of vehicle
while it is descending from
the ramp
Manual brakes/emergency
brakes
Limited/no power to the motors
->
->"coasting function" or clutch
Motor controller to control descent speed
Elmo motor controller
Visual inspection of robot
Check off sheet must be completed
Visual inspection is not
adequate in identifying
all malfunctions.
Perform electrical self tests to
identify
other malfunctions
Robot power
bb2590
Battery shorts circuits
Fuse to break circuit
Switch on robot chassis (computer/logic
systems)
Key/toggle switch
Self Tests
Check all subsystem functionality NOT
including drive system (motors)
Deploy Robot Drop from transportation Able to withstand impact
platform
Ramp
Pre-inspection
Power-up
Risks associated with action
Power-up logic
Establish communications w/ base station and
payload
All systems power-up
Motor controller initialization and test
Disengage Emergency Stop switch
© 2014 Carnegie Robotics LLC.
Use or disclosure of document data is subject to the restrictions on the title page
Check motor control input range and
controller configuration.
Emergency stop malfunction
Page 1
Action
Options/Steps to accomplish
action/Functions
Parameters needed complete action
Parameter specifications
Channel in control signals from CPU
Serial/Ethernet/bus
to microcontroller
Receive drive command
Interpret control signals and send
PWM to motor controller
Control brakes intelligently
Failsafe mode for loss of
communications
Power Motors
Supply power to motor controllers
Monitor Power use/motor status
Monitor speed
Monitor power usage
Monitor stall conditions
Drive
View obstacles
Acquire environmental data
First Down step
Belt tension adjustment
Situational limits/caps
Track tread sufficient for step grip
Overcome
Stairs/Obstacles
Managing stairs/obstacles
Overcoming obstacles
Packet loss
Battery rails
Motors: ec60 maxoms
Limited slip to turn
Make sure motors are
powerful enough
to cause slipping
Lighting malfunction
Infrared failsafe
DC/DC converters
Optical encoders
Arduino/MSP430/other uC
Arduino/MSP430/other uC
LED lighting
Camera subsystems
Ultrasound/LIDAR
Environmental interference
Track motor odometry
Wheel slippage causes false
odometry readings
Apply failsafe
Analyze weather
conditions before
operation
Use GPS to confirm
odometry readings
Obtain accelerometer/gyro data
IMU data about system state
Poor or unavailable
GPS connectivity
Faulty IMU readings
Partial automation (autopilot)
Unstable control loop
redundant IMU?
Vigorous control loop
testing
Electronic control of track tension
Active suspension elements
limited max speed up/down stairs
Track slippage
Slopped track front
Independent suspension elements
Sealed/rugged undercarriage
Rugged/durable tread material
Sufficient power/torque to overcome
obstacles
© 2014 Carnegie Robotics LLC.
Use or disclosure of document data is subject to the restrictions on the title page
Proper signal
conditioning and
isolation
Arduino/MSP430/other uC
Detect loss of communication
Run failsafe routine (deceleration)
Wireless E-stop
Obtain GPS data
Manage tipping
Noise in the system
Mitigation of risk
Arduino/MSP430/other uC
Navigation
Track robot state
Risks associated with action
The robot might get stuck or
become inoperable without
enough torque
Situational awareness
Slopped front for small obstacles
Page 2
Action
Options/Steps Parameters needed complete
to accomplish
action
action/Functions
Radio
Storage/Trans Securely holds radios
port
Parameter specifications
Droppable on command
Charge radios
Radio strength/packet loss
measurement
Manual activation
Determine drop necessity
Initialize radios before drop
Risks associated with action
Dropping mechanism fails
Severe packet loss
Too many radios are dropped to reach
desired range
Distance-based drop (linear distance
to last node)
Situational drop (stair head, sharp
Too many radios are dropped to reach
turns, etc,)
desired range
Radio power-up sequence & trigger Radio doesn't power up
Mitigation of risk
Reliable radio
despenser design
Intelligent radio
dropping
Intelligent radio
dropping
Intelligent radio
dropping
Routine maintanence
of the radios
Communications test before drop
Radio Transmitter Drop
Fully charged/self contained
Charging fails
Check all radios for full
charge before
departing
Unit ends up being too expensive
Thorough
benchmarking for
lowest cost solution
Battery failure
Buy high quality, long
lasting batteries
Radio Use
Standby/low-power mode while on
robot
Self-righting/omni-directional
antenna(s)
Radio requirements
Low cost/semi-disposable
Mesh protocol
Status info for each node (batter,
link, etc.
Rugged/durable tread material
Long battery life
© 2014 Carnegie Robotics LLC.
Use or disclosure of document data is subject to the restrictions on the title page
Page 3
Action
Options/Steps Parameters needed complete
to accomplish
action
action/Functions
Parameter specifications
Risks associated with action
Mitigation of risk
Rails
Power requirements
Attachment
means
Electrical connections
Bay count
Bays
Directions of expansion
Protocols
Software
API's
© 2014 Carnegie Robotics LLC.
Use or disclosure of document data is subject to the restrictions on the title page
Too much current is pulled from the
battery and is critically damaged
Real time power data
and electrical limits
Ethernet
RS-485
Payload is not the right size and doesn’t fit
in the module bay
Physical size
Payload Use
Thorough worst case
testing
regulated vs. unregulated
power monitoring/limits
Data connections
Insufficient power is supplied to the
system
Number of possible modules
How payloads can extend outside the
bounds of the bay
Provisions for disjoint payload
connections
(e.g. rear radio deployment module)
Physical (Ethernet) & layer 2 (UDP)
Systems that payloads can/cannot
interact with or control
Make computational power available to
payloads
Provide comms to operator
Page 4