Hazard Relative Navigation - Towards Safe Autonomous Planetary Landings in Unknown Terrain

Many successful landings have been performed on celestial bodies such as Mars, the Moon, Venus and others. All of these had in common that they were designed such that they had to land in regions, which were supposedly free of any hazards or that a certain level of risk was accepted. However, while rocks and other geological features are nightmares of any landing engineer they are the dream targets of scientists. Therefore, currently landing-site selection is a trade-off between the scientists’ wishes and the engineers’ fears. To bring the engineering capabilities closer to what the scientists desire, landing capabilities need to be advanced. Therefore, this work tries to answer the research question: Are autonomous safe landings in hazardous and potentially unknown environments possible? which lead to the following two sub-questions: 1. How can a landing vehicle autonomously assess the safety of a potentially unknown and unmapped landing site? 2. How can a landing vehicle ensure a safe touch down avoiding autonomously detected hazards? To answer these question two methods are developed in this work: a hazard-detection algorithm, capable of autonomous assessment of the landing region, and a hazard-relative navigation algorithm, enabling precise touch-down relative to the detected hazards and selected safe landing site. Both methods were thoroughly tested both in a software, but also in a hardware-in-the-loop environment. From a study of three feasible camera-based hazard-detection technologies, stereovision-based hazard-detection is found to be the most feasible candidate for on-board hazard detection and landing-site assessment. Therefore, a stereo method is implemented to reconstruct three-dimensional surface maps from a pair of descent input images. Based on these maps, the slope and roughness of the landing region is computed. In addition, the terrain texture and illumination is assessed. From this information a hazard map of the landing region can be constructed, enabling the autonomous selection of a safe landing site. A thorough sensitivity study of this algorithm using software-in-the-loop tests showed that the algorithm can perform hazard assessment at altitudes of 200 m and lower at camera baselines of 2 m and less. Baselines in this order were found to be feasible for current lander designs (for example, the ESA Lunar Lander or the NASA Mars Science Laboratory). Enabling stereo-based hazard detections at altitudes of 200 m represents xixii SUMMARY an improvement of a factor of 2 with respect to the only known prior study conducted in this area. Moreover, this research demonstrates that based on the resulting hazard maps selecting a safe landing site is possible. Out of the entire landing-region map, only 1% or less of all sites were wrongly identified as safe sites while actually being unsafe. After extensive testing in a software environment using artificial images simulated by a software, PANGU, based on a lunar analogue surface model, the next step was to validate the performance using real input images. To this end the testbed for relative optical navigation (TRON) at DLR Bremen was used. This is a facility where real images of a lunar analogue surface model can be acquired, alongside ground-truth state measurements. The hardware-in-the-loop tests of the hazard-detection method showed that successful selection of a safe landing site is still possible even when using real images with the associated problems, such as noise, problematic illumination and the challenges of camera calibration. However, the maximum percentage of undetected hazardous sites increased to only 2.5%. As the successful development of a hazard-detection function was the prerequisite for the development of hazard-relative navigation methods, this step was taken next. Linking the hazard detection and a relative-navigation method by using the computed hazard-detection surface maps as an input for the navigation filter is a novel approach. This idea enables a hazard (map) relative navigation without the addition of further errors from linking the hazard maps and the navigation output. This approach was implemented by following the paradigm of simultaneous localisation and mapping (SLAM), frequently used to drive robots in unknown surroundings. Here, map measurements are used for updating a navigation filter and thus achieving more precise and accurate state knowledge. Based on the robustness and computational efficiency, an error-state Kalman filter was used as a state observer. In a SLAM manner the hazard-map features are appended to the state and are thus also predicted and updated. The developed filter was first tested during extensive software-in-the-loop testing. To date, the very final phase of the descent, as studied in this work, is flown on IMU-only propagation. This method is used as a benchmark. Final hazard-relative landing ellipses of 20£20 m were achieved opposed to 60£ 60 m of the current state-of-the-art benchmark method. Precisions of 10 m to 20 m are required for the successful implementation of hazard avoidance, thus hazard avoidance is possible using the proposed filter. Moreover, it was proven that the filter removes 99% of all errors in the altitude measurements as compared to the benchmark, and is thus capable of very accurate and precise altitude estimation. On a set of 500 runs less than 1% of outliers occurred, demonstrating that the method is not only accurate and precise, but also robust. An outlier is defined as any execution where the final error is higher than the final error achieved without the filter, i.e., any situation where the filter performs worse than pure IMU propagation. During an other validation campaign at TRON at DLR Bremen, it was found that the hazard relative navigation method was capable of performing even better using these real images, the hazard-relative landing ellipse size could be further reduced to 6£9 m,SUMMARY xiii which is an improvement of more than a factor of 2 as opposed to the software-in-theloop tests. This further improvement is likely linked to the infinite resolution of the TRON terrain as opposed to the finite resolution of the terrains used during the software tests. On the altitude component, the results were slightly less accurate than the softwareint-the-loop results, which is in-line with the findings from the hazard-detection testing. Still, the altitude is estimated very well, with a error reduction of 97%. Also during the hardware test the method proved to be robust and no outliers were generated. Concluding, the feasibility of hazard-relative navigation was demonstrated, the precisions achieved are clearly good enough for the successful avoidance of hazards detected in the landing site. Using the hazard-detection method it is possible to select a safe landing site autonomously on-board