Holistic Contingency Management for AutonomousUnmanned Systems

Jerry L. Franke, Adria Hughes, and Stephen M. JamesonLockheed Martin Advanced Technology Laboratories

{jfranke,ahughes,sjameson}@atl.lmco.com

John G. ClarkLockheed Martin Advanced Development Programs

john.g.clark@lmco.com

Robert J. SzczerbaLockheed Martin Systems Integration-Owego

robert.j.szczerba@lmco.com

Abstract

Contingency Management—the problem of recognizing, assessing, and responding to

unanticipated events or conditions that impact plan execution—is a key enabler for unmanned

systems to become autonomous systems—that is, able to carry out assigned tasks or missions

without continuous human supervision. We present a concept and technology for holistic

contingency management that addresses all levels of autonomous system mission execution—

from real-time flight-critical failures to long-term issues that can affect teams of vehicles. This

concept features several key elements:

• Multi-level assessment: Monitoring, assessment, and response occur at multiple levels.

• Plan-based assessment: Monitoring is triggered by an assessment of dependencies and

constraints on plan execution.

• Capability-based assessment: Ongoing assessment of vehicle mission-related capabilities based

on subsystem and environment status.

• Predictive assessment: Monitoring and assessment of anticipated future events or conditions.

• Team-based assessment: Assessment occurs not just of individual vehicles, but at the team

level as well.

We have implemented a holistic contingency management technology based on this concept

to manage detection and response to unexpected events in unmanned vehicle operations. We will

describe this Mission Effectiveness and Safety Assessment (MENSA) technology and its

application to a number of Department of Defense autonomous system programs.

Introduction

While removing the pilot from an unmanned vehicle provides numerous advantages

(including pilot safety, multiplication of force, and the automation of routine and dangerous

missions), the unmanned vehicle paradigm presents a significant challenge to the pilot’s

situational awareness needed for effective decision making. The dynamics of the battlespace

require rapid decision making using data about the state of the world surrounding the vehicle that

an unmanned vehicle pilot does not have direct access to. This property makes rapid response to

unexpected events during mission execution difficult without some aid to the pilot. The problem

is exacerbated in the case of autonomous vehicles, in which the system itself must respond to

problems.

The sources of events affecting unmanned missions are many (see Figure 1). This requires a

high degree of flexibility on the part of the unmanned system to attain mission success. A robust

unmanned system must be capable of detecting an event, assessing the event’s impact on the

mission, planning a response to the system’s changed circumstances, and executing those

mission changes quickly and decisively. While significant research is being performed in the

planning and execution aspects of contingency management, we have specifically addressed the

contingency detection and assessment functions required to complete the overall decision cycle.

Weather

Failure by neededexternal asset

Vehicle system orpayload failure

Teammate Failures

Changes in ROE orobjective priorities

Unexpectedbattlespace

developments

Figure 1. An autonomous unmanned system faces the influenceof many unexpected events on its mission.

Related Work

Autonomous contingency management systems share properties with systems from a number

of research areas ranging from low-level autonomic health diagnostics to tactical plan monitoring

for command and control. We review these ties below and define their places in the holistic

contingency management spectrum in subsequent sections.

Vehicle systems have a long history with the area of diagnostic health maintenance. Systems

such as NASA’s Livingstone [5] [6] provide model- or rule-based diagnosis of system faults for

the generation of appropriate responses during mission execution. These systems allow a vehicle

to recover from physical or electronic failures autonomically. Related prognostic systems help

govern the proactive switching among redundant subsystems and/or execution modes to maintain

successful operation of the vehicle. Initial attempts to integrate such systems with planning

systems have been published in [4].

Reflexive response systems provide closed-loop response to specific sensor events, such as

detected obstacles or weapons radar lock-on. Due to the reaction times required for these types of

events, low-level mechanisms tend to be self-contained, specialized to the vehicle or subsystems

involved, and operate independently of the unmanned system’s plans.

Contingency planning systems attempt to identify specific events that may occur in the future

and plan alternate routes or courses of action to respond to those events [3]. Typically, these

contingencies take the form of decision points in the plan at which multiple branches may be

taken. This provides well-established, pre-determined responses to predictable events during the

course of mission execution. The dynamic contingency management functions described in this

paper provide a means through which contingency planning systems can be supplemented with

systems that have the capability to trigger response to those planned contingencies in addition to

unexpected events as well.

Similar technologies have been explored in planning domains outside the world of unmanned

system control. For example, Lockheed Martin’s Air Campaign Monitor provides a means for

assessing the severity of anomalies in the expected state of the battlespace with respect to air

operations plans [1]. These operations plan execution monitoring systems are designed to help

commanders make decisions about contingencies at an operations level. Operations plan

execution monitoring systems operate on a larger time granularity than unmanned system

mission execution, thus exist above the level of functional scope for autonomous system

contingency management. However, such systems might use autonomous contingency

management systems as one source of observables for their plan assessment functions.

Holistic Contingency Management

To enable fast, effective response to the full spectrum of unexpected events an unmanned

system may face, we consider a holistic approach that provides for monitoring and assessment at

many levels of granularity, both in system complexity and in time (see Figure 2). This approach

matches the current trend in hierarchical planners, which provide planning functions at multiple

levels of scope.

Figure 2. A holistic view of contingency management assessesmission success across a broad array of causes and timelines.

At the lowest levels of the contingency management spectrum are the autonomic health

maintenance and closed-loop control mechanisms that provide rapid response to immediate

problems during vehicle operation. These functions cover contingencies such as obstacle

avoidance, switching among redundant subsystems, turbulence compensation, and fire response.

In developing our contingency management approach, we’ve added further levels to the

hierarchy. The first set of functions to be developed involved assessing the operating context of

an unmanned system with respect to the system’s mission plans. Contingencies detected and

assessed at this level include changes in vehicle operational capabilities due to changes in system

health, tactical response to pop-up threats through avoidance or opportunistic targeting,

adjustment of plans to account for changes in the weather or to meet new rules of engagement, or

replanning due to changes in objectives.

By extending mission-level contingency management temporally, the unmanned system can

acquire the ability to look ahead and respond proactively to likely upcoming problems. A threat

may not immediately affect a plan, but given its expected movement, will it cause a problem

later in the plan? While a sensor’s degraded capabilities may still be sufficient for the unmanned

system’s tasking, do health prognostics predict a continuing degradation or potential loss of

function by the sensor? The ability to do predictive assessment of potential contingencies is a

powerful tool for achieving mission success even in the most dynamic environments.

Because multi-system, collaborative operations are being explored in many current programs,

it is important to consider contingency management at a team level as well as at the individual

system level. Team operations introduce new types of problems that must be detected and

handled. If the team mission plan contains tasks that are collaborative (e.g., one system

designating a target for another system to prosecute), how do modifications or delays in one

system’s plan affect the other system? If one system’s needed sensor fails, can another member

of the team take on that system’s tasking? How does the current communications environment

impact the team’s coordinated plans? Assessment of events and conditions such as these provide

a bridge between contingency management for a single system and high-level mission execution

monitoring systems.

Implications on Planning Systems

The introduction of holistic contingency management into unmanned systems suggests a

variety of design criteria to autonomous planning systems. Plans generated by the system should

include information about the factors considered in forming the plan, including hard constraints

on objective timelines, acceptable tactical risk, and resource use. In addition, the planner should

accept the dynamic introduction of new constraints or modifications to existing constraints as

mission execution yields events that modify both the vehicle and battlespace state.

One example of such a planning system is Lockheed Martin’s TeamWorks™ multi-vehicle

planning system (see Figure 3). TeamWorks™ planning provides task allocation for teams of

multiple heterogeneous vehicles and autonomous unmanned missions with a variety of mission

objective types. Based on numerous mission variables (e.g., fuel, fuel burn rate, available

weapons/sensors, weather, threats, etc.), the system generates routes for each vehicle in a team to

produce the optimal overall team plan. New events, such as pop-up threats and new objectives,

can be added to the constraint mix dynamically to allow the system to generate a plan cost

analysis to determine how the team should best handle the new event. To support the dynamic

replanning aspect of its operation, TeamWorks™ planning interacts with Lockheed Martin’s

contingency management system, described in the next section.

Figure 3. TeamWorks™ is one example of an autonomous planning systemthat can support dynamic response to contingencies at the mission level.

Implementing Contingency Management

To provide a standard means for inserting the capabilities necessary to apply our holistic

contingency management approach to varied unmanned systems, we developed the Mission

Effectiveness and Safety Assessment (MENSA) architecture (see Figure 4). MENSA provides

the necessary monitoring and assessment functions required for detecting and responding to

unexpected events during unmanned missions. MENSA is constructed to interoperate with a

variety of autonomous planning systems in a number of different domains via a set of clear,

standard interfaces. Because of this design choice, MENSA can also be used directly as a

decision aid for unmanned system operators.

Pop-upThreat

CM Administrator

InputProcessing

Alerting

PlanDependency

Analysis

PlanImpact

Analysis

Replan alerts

Plans, status,environment data,

commands

Monitors Assessors

Monitor, assessor tasking

Contingency identification

Contingency detection

OrdersChange

Targetof Opp.

SensorHealthComms

Health

WeaponsHealth

VehicleHealth

ROECompliance

MissionSafety

StrikeCapability Sensor

Capability

FlightCapability

TacticalEffectiveness

MonitoringManager

AssessmentManager

Figure 4. Our Mission Effectiveness and Safety Assessment (MENSA) architectureprovides scalable contingency management functions for autonomous systems.

Its scalable architecture makes MENSA highly flexible and broadly applicable. MENSA’s

monitoring and assessment functions are encapsulated by agents that are specialized to each

contingency type. These agents are activated through XML workflows, providing a means to

quickly reconfigure MENSA dynamically during runtime. This agent-based design makes adding

new functions or contingency types to the system simple and straightforward.

By embodying the holistic contingency management approach, MENSA operates at multiple

levels of the unmanned system organizational hierarchy. At the vehicle level, MENSA performs

monitoring and assessment functions in relation to a single system’s capabilities and mission. At

the team level, MENSA performs monitoring and assessment functions in relation to a

collaborating team of systems’ capabilities and mission.

MENSA analyzes incoming mission plans to identify the capabilities of the system required

for mission success along with other key plan dependencies, such as avoiding pop-up threats and

following no-fly zone parameters. Having identified these dependencies, MENSA determines the

elements of the vehicle’s subsystems and environment it should monitor for status changes.

While the system conducts its mission, MENSA continually monitors and evaluates both system

state and battlespace conditions to detect changes that may affect mission success. Similar

monitoring is performed for teams of systems.

If a change is detected in one of the elements being monitored, MENSA assesses the event to

determine if platform capabilities or battlespace environment has changed in a way that would

affect the current mission. If the plan would be affected, MENSA produces a replan alert so that

an autonomous planning system (or the operator) can replan around the new variables introduced

into the system’s operation.

MENSA is designed to support real-world operations, which sometimes require exceptions to

normal mission procedures and tactics to attain mission success. For example, while a vehicle

typically should avoid exposing itself to a threat, some critical targets might require such

exposure to successfully prosecute. For those exceptional cases, we have provided an override

mechanism to MENSA that allows an operator to instruct the system to suppress replanning

related to one or more specific contingencies. By using the contingency override mechanism, the

operator can better control the balance between vehicle safety and mission success at critical

points in the mission plan.

Because MENSA performs an overall assessment of a system’s operational capabilities as

part of its functions, MENSA can also report the health state of the system. The health state

contains details of the system’s operational capabilities (such as maximum speed, remaining

endurance, etc.) in addition to individual subsystem health status. MENSA’s assessment of

operational capabilities mimics the reasoning an unmanned system’s operator performs when

making decisions during planning. MENSA performs the same assessment functions for

aggregations of capabilities at the team level.

Integration with Mission Management Architectures

The MENSA contingency management capability is a key component of overall unmanned

system mission management architectures, tightly integrated with an avionics system. The

following section outlines a representative dynamic mission management architecture to provide

a context for the MENSA component. The architecture, known as the KineForce™ Mission

Management Architecture, was developed by Lockheed Martin for the dynamic mission planning

and execution of heterogeneous manned and unmanned vehicle teams [2]. The system is

segmented into seven major components (see Figure 5) that each impact the contingency

management process:

• Contingency management: Detects, assesses, and responds to unexpected events.

• Mission planning: Develops plans and replans for the team and for individual vehicles.

• Collaboration: Manages interaction among team members and provides team membership

status.

• Situational awareness: Creates Common Relevant Operating Picture (CROP) for team that

captures battlespace state.

• Communications management: Manages the interaction with the vehicle’s communications

systems and provides communications status.

• Air vehicle management: Manages the air vehicle’s flight systems, sensors, and weapons,

providing status for each subsystem, and generates low-level reflexive response trajectories.

• Resource meta-controller: Manages mission processor resources and provides mission

management processor state.

DARRS025..ppt

Air Vehicle

Collaboration

Mission Planning

Situational Awareness

Contingency Management

Communications

Functional Modules

Intelligent Agents

Knowledge/DataModels

Resource Meta-Controller

Weapons/Sensors

Air Vehicle Management

Flight Control System

Collaborative AutonomyMission Management

Communications Management

Figure 5. The KineForce™ system is one example of an autonomous mission managementsystem that takes advantage of advanced contingency management capabilities.

As a part of this architecture, MENSA implements contingency monitoring and plan impact

analysis for mission events such as air vehicle flight capability degradation, pop-up threats and

targets of opportunity, friendly and neutral movement within the battlespace, loss of team

members, and mission equipment failures. MENSA can also determine when an emergency

mission abort is required and provides the system’s operator with control over the level/type of

contingency monitoring performed. MENSA analyzes mission plans and information regarding

the changing situation (e.g., new objectives, new constraints, new obstacles, new threats, new

targets, and changes in vehicle/team capabilities), issuing alerts when plans will no longer satisfy

objectives and constraints.

At the team level, MENSA receives alerts of contingencies that cannot be handled at a

vehicle level and issues replan alerts to team mission planning components to redistribute tasking

among the team. This supports a team-wide contingency resolution escalation process where

reaction to unplanned events that affect the execution of the vehicle system’s mission (see Figure

6). In addition, MENSA performs team-level capability assessment, aggregating mission

capability information from all team members into a definition of total system mission

capabilities.

MENSA, as part of the KineForce™ mission management architecture, has been used to

demonstrate advanced autonomy concepts for multi-asset teamed operations in simulation. In

addition, in 2005, the system provided contingency management services to Lockheed Martin

test-flights of teamed SilverFox UAVs. MENSA triggered replans of the system’s search

objectives in response to team membership changes over the course of the mission and provided

system capability assessment to the mission operator.

Figure 6. By supporting team-level assessment and replanning, MENSA enablesa contingency escalation process in which only the contingencies that

cannot be handled autonomously are elevated to the operator.

Conclusions

The ability to detect and respond to events that affect unmanned system plans is critical to

achieving mission success and has, to date, been a roadblo ck to attaining higher levels of

autonomy in unmanned operations. A holistic contingency management approach provides a

structured framework for designing systems that enable robust mission execution. This approach,

as reduced to practice in the MENSA general contingency management architecture, supports

autonomous response to unexpected events encountered during mission execution. By applying

MENSA to numerous planning and mission management systems in both simulated and physical

system environments, we have demonstrated the effectiveness of the holistic contingency

management approach in meeting high-level autonomy needs.

References

[1] Allen, James P. and McCormick, John M., “Adaptive Plan Monitoring Systems for MilitaryDecision Support,” Proceedings of the 2005 AAAI Spring Symposium, 2005.

[2] Jameson, Steve, et al., “Collaborative Autonomy for Manned/Unmanned Teams,”Proceedings of the American Helicopter Society 61th Annual Forum, 2005.

[3] Linden, Theodore A. and Glicksman, Jay, “Contingency Planning for an Autonomous LandVehicle,” International Joint Conference on Artificial Intelligence, 1987.

[4] Reichard, Karl M. and Crow, Eddie C., “Intelligent Self-Situational Awareness forUnmanned and Robotic Platforms,” Proceedings of AUVSI Unmanned Systems NorthAmerica 2005, 2005.

[5] Schwabacher, Mark, et al., “The NASA Integrated Vehicle Health Management technologyexperiment for X-37,” Proceedings of the SPIE AeroSense 2002 Symposium, 2002.

[6] Williams, Brian C. and Nayak, P. Pandurang, “A model-based approach to reactive self-configuring systems,” Proceedings of the Thirteenth National Conference on ArtificialIntelligence, 1996.