The Design and Engineering of Curiosity

by Emily Lakdawalla

  8CHIMRA is pronounced “chimera”

  9JPL (2013)

  10Interview of Rich Rainen and James Erickson conducted September 18, 2014

  © Springer International Publishing AG, part of Springer Nature 2018

  Emily LakdawallaThe Design and Engineering of CuriositySpringer Praxis Bookshttps://doi.org/10.1007/978-3-319-68146-7_4

  4. How the Rover Works

  Emily Lakdawalla1

  (1)The Planetary Society, Pasadena, CA, USA

  4.1 INTRODUCTION

  Curiosity may look superficially like the Mars Exploration Rovers and Sojourner (Figure 4.1), but its redundant systems, powerful science suite, and complicated sample manipulation make it a different beast entirely. The rest of this book describes all the components that enable Curiosity to do science on Mars, how they are supposed to work, and how things have occasionally gone wrong.

  Figure 4.1. Family portrait of the three JPL Mars rovers. In front is Marie Curie, the flight spare of the Sojourner rover, now a museum piece. At left is the Surface System Test Bed for the Mars Exploration Rover mission. At right is the Vehicle System Test Bed for the Curiosity mission. NASA/JPL-Caltech release PIA15279.

  Figure 4.2 shows Curiosity’s external parts, Figure 4.3 its internal ones. Its basic dimensions are outlined in Figure 4.4. The aluminum rover body, also known as the warm electronics box (WEB) is a block 163-by-117-by-46 centimeters in size. It is painted white for thermal control and to reduce the glint of reflected sunlight into cameras. The warm electronics box supports the other external components and keeps the avionics and science instruments inside it within a controlled temperature range.

  Figure 4.2. Overview of external components of rover systems. Not all of the robotic arm is visible in this photo because it was taken with MAHLI, which is mounted on the arm. Base image is the MAHLI self-portrait taken at John Klein on sol 177. NASA/JPL-Caltech/MSSS/Emily Lakdawalla.

  Figure 4.3. Interior of the rover, looking up from below. SAM, CheMin, REMS, AXPS, Mastcam, MAHLI, MARDI, RAD, ChemCam, and DAN PNG and DE are all science instruments. IMUs (inertial measurement units), rover motor controller, and power electronics are all part of the rover avionics. Telecommunications components include the Electra-lite (UHF) radio and X-band transponder, amplifier, and waveguide. Batteries are part of the power system, and the rover integrated pump assembly is part of the thermal control system. NASA/JPL-Caltech/Emily Lakdawalla.

  Figure 4.4. Dimensions of some large elements of the rover in centimeters. NASA/JPL-Caltech/Emily Lakdawalla.

  4.2 POWER SYSTEM AND MMRTG

  Curiosity draws its power from a Multi-Mission Radioisotope Thermoelectric Generator (MMRTG).1 The MMRTG trickles the power that it generates into two rechargeable 42 amp-hour large-cell lithium-ion batteries. The MMRTG generates power using the heat from radioactive decay of 4.8 kilograms of plutonium dioxide (a ceramic form of plutonium-238), of which about 69% of the mass was radioactive plutonium-238 when it was first fueled on October 28, 2008. Plutonium-238 has a half-life of 87.7 years. Power production will decline over time, reducing rover activity. Once the MMRTG no longer generates enough power for survival and communications, the mission will end, probably by 2030, if nothing else ends it earlier. The MMRTG weighs 40 kilograms.

  4.2.1 How the MMRTG works

  A radioisotope thermoelectric generator converts heat into electricity with no moving parts by taking advantage of the thermoelectric effect. Holding two different electrically conductive materials at different temperatures and joining them in a closed circuit generates current. A pair of conductive materials joined in this way is called a thermocouple. A thermocouple has a “hot shoe” and a “cold shoe.” In Curiosity’s MMRTG, the decaying plutonium heats the hot shoes of the thermocouples. External fins splaying out into the Martian air chill the cold shoes.

  The plutonium dioxide ceramic is split into 32 pellets, each weighing 150 grams. Each pellet is clad in iridium. The iridium cladding is a safety feature that blocks the alpha particles emitted by the plutonium pellets. It also has a high melting temperature (2400°C), in case the cooling system fails.

  The MMRTG was carefully designed to survive a launch accident, like a launch pad explosion or a midair breakup, without releasing radioactive material into Earth’s atmosphere or oceans (Figure 4.5). Two pellets go inside a graphite impact shell. A carbon-bonded carbon-fiber sleeve encases the impact shell. Two such sleeves are inside each general-purpose heat source module. The core of the MMRTG is a stack of eight of these modules, and the core is surrounded by an aluminum alloy housing. In the event of a launch accident at high altitude, the aluminum housing would melt, which would scatter the eight modules. Those lower-mass modules would have lower terminal velocities than the whole MMRTG. At their lower velocities, the carbon fiber aeroshells wouldn’t melt upon reentry. Even if the pellets are subjected to large enough forces to break them, their ceramic form means they’ll break into large chunks rather than a dust that could be inhaled.2

  Figure 4.5. Parts of the Multi-Mission Radioisotope Thermoelectric Generator (MMRTG). Emily Lakdawalla after Woerner et al ( 2012 ).

  To turn the heat from the MMRTG core into power, the safely constructed, hot core is encased in a graphite heat distribution block. Then comes a layer of thermoelectric modules, their hot shoes in contact with the heat distribution block and their cold shoes touching the outer shell of the MMRTG and its heat-radiating fins. The hot shoes operate at a temperature of 520°C, the cold shoes at a still-toasty 75°C during cruise and 150–185°C on Mars, depending on the season.3

  The MMRTG is not very efficient at turning heat into electricity. When first fueled, the thermocouples converted about 110 watts to electricity. The rover’s heat rejection system uses some of the remaining 1900 watts of heat to keep the warm electronics box warm (more on that in section 4.3); the rest of the heat radiates away into the Martian air.

  The rover requires 45 to 70 watts of that power at all times while sleeping.4 It consumes at least 150 watts whenever it is awake, and up to 500 watts while driving. Therefore, the rover is completely dependent upon its batteries and spends most of its time asleep and recharging. It is active for about 6 hours of each Martian day, on average.5

  4.2.2 Performance on Mars

  Upon landing, the MMRTG generated about 114 watts, ranging from 109 to 119 watts over the course of the sol. You might have noticed that this is more power than it generated when it was first fueled, while on Earth. The MMRTG was designed to operate at the lower ambient temperature on Mars, where there is a higher contrast in temperature between the hot and cold shoes of the thermocouples. It generates more power at night, when ambient temperatures are lowest.

  Over time, the performance of the MMRTG decays at a rate of roughly 1 watt per 80 sols. The plutonium decay is exponential – it declines more slowly as time goes on – but the MMRTG performance decay is close to linear. That’s because the thermocouples are also degrading, but unlike the plutonium they degrade faster with age. At the beginning of the mission, engineers estimated that the MMRTG would still be producing 54 watts 17 years after was fueled, on October 28, 2025, which would correspond to sol 4702.6 Even with efficiency improvements, the rover’s activity will be increasingly energy-constrained with time.

  4.2.3 Anomalies

  On sol 456 (November 17, 2013), the rover experienced a partially conductive “soft short” in the MMRTG, apparently caused by a part of the electrical power circuit touching the aluminum housing.7 The Cassini spacecraft had MMRTGs of the same design, and experienced similar shorts. As a result of the short, the voltage difference between the rover’s power bus and chassis changed (from 11 volts to 4 volts on that particular sol). The rover’s power system is robust to such changes in voltage, having been designed with a floating bus. The mission halted activity for 6 sols to investigate the problem, which had spontaneously disappeared by sol 461.8 It occurred again on sols 816, 1084, and 1158, and has been happening more frequently sinc
e. The soft short is annoying because it halts operations, but it does not threaten the health of the rover.9 Table 4.1 lists all the soft shorts to sol 1582.Table 4.1. Dates and effects of Curiosity MMRTG soft shorts to sol 1582. Courtesy Steven Lee.

  Sol

  End Sol

  Sols Since Prior Short

  Character of Short

  456

  461

  n/a

  Intermittent, then Constant

  816

  835

  355

  Intermittent

  1084

  1090

  249

  Intermittent

  1158

  1166

  68

  Constant

  1173

  1181

  7

  Constant

  1187

  1191

  6

  Intermittent

  1204

  1221

  13

  Intermittent, then Constant

  1233

  1239

  12

  Constant

  1247

  1256

  8

  Constant

  1257

  1269

  1

  Intermittent, then Constant

  1284

  1288

  15

  Intermittent, then Constant

  1288

  1289

  1

  Constant

  1338

  1362

  50

  Intermittent

  1373

  1422

  11

  Intermittent

  1445

  1461

  23

  Intermittent

  1473

  1495

  12

  Intermittent

  1530

  1582

  35

  Intermittent, then Constant

  4.3 AVIONICS

  The rover has two redundant sets of avionics controlling all of its functions, referred to as the A-side and B-side.10 Each side has three main processor units. Two redundant rover power analog modules (RPAMs) function like the rover’s cerebellum, controlling all of its essential life support functions: power distribution, system fault protection, and wakeups/shutdowns. The rover compute elements (RCEs) are like the rover’s cerebrum, controlling its higher functions. The rover motor control assembly (RMCA) is like the rover’s motor cortex, controlling all motion of wheels, arm, turret, antenna, mast, and instrument covers. Both A-side and B-side power modules are interconnected with both A-side and B-side computers, as are the two cooling system pumps, two radio transceivers, two inertial measurement units, and individual science instruments. It’s easy to see why testing of the avionics was so time-consuming and challenging: just those four pairs of redundant components yield 16 possible configurations.

  Because the rover spends most of its time asleep in order to conserve power, it performs wakeups and shutdowns several times per sol. Before the computer shuts down, it sets a countdown timer in the power module; when the timer expires, the power module turns on the main computer again. One function that is partially available even while the rover is asleep is communications. An orbiter can hail Curiosity through a transceiver, requesting the sleeping rover to wake up. This capability would only be needed if the rover lost its clock timing, so did not know when communications passes would occur.11

  4.3.1 The sol 200 anomaly

  On sol 200 (February 27, 2013), the rover sent telemetry to Earth indicating problems in its flash memory on the rover compute element. The memory problems had caused several software tasks to hang, preventing the rover compute element from performing the planned shut down for that day. The software should have handled the memory loss gracefully: onboard fault protection watchdog timers should have caught the issue and placed the rover in a safe state. But the watchdogs were being pacified without actually triggering a safe mode. Without the ability to shut down, the rover could have drained its batteries in three to six days. 12 As the anomaly investigation continued that afternoon, Earth testing revealed that the next time the rover attempted to communicate with Earth, that process would hang, and the computer would shut off the radio, which could leave operators without the ability to command the rover.13

  The mission asked for emergency time on the Deep Space Network to send a series of commands to the rover to swap to the backup computer, just in time before the rover’s radio would be powered off. After 2:00 in the morning in California, or about 8:00 in the morning local time for Curiosity, after both the engineers and the rover had had totally sleepless nights, the signal was sent. Curiosity sent a signal back indicating that the computer swap had been successful, but the signal arrived a heart-straining 3 minutes later than expected.

  Subsequent investigation revealed that the problem originated in a single bad chip in the A-side computer’s flash memory array. They worked around the problem by instructing the A-side computer not to use half of its flash memory. Fortunately, there was plenty of margin available. The software was updated to handle these conditions more gracefully. The rover has used the B-side rover compute element as its primary computer ever since. Engineers patched the flight software to return the A-side computer to service as a reliable backup after sol 772.

  4.3.2 Flight software

  Each of the rover compute elements has a 133 megahertz RAD750 processor running the VxWorks operating system, 256 megabytes of RAM, and 4 gigabytes of flash data storage. (Smartphones in common use at the time of launch operated at about four times the speed with four times the storage.)14 The rover’s flight software includes many autonomous functions to reduce the workload of daily tactical planning. For example, communications windows are scheduled long in advance; an occasionally updated table in rover memory keeps track of all such windows, and the rover automatically executes communications passes within those windows, even if it has to wake itself up to do so.

  The rover’s autonomy has increased over time, thanks to several flight software upgrades. It takes many sols to uplink new software to the rover, and then a minimum of four sols to verify, install, and commit the new software on both of the rover computers. Each of the instruments also has its own flight software, which can be upgraded independently of the main flight software. 15

  4.3.2.1 Flight software version R10.5.8 (sol 8)

  The rover landed running version R9 of its flight software (specifically, version R9.4.7). Immediately after landing, the rover upgraded to version R10.5.6, which removed many of the cruise functions and added in many surface operations functions. When they transitioned to version R10.5.6, they followed by patching the new software to fix a potential problem with the X-band radio transponder, and the rover ran version R10.5.8 for some time.

  4.3.2.2 Flight software version R11.0.4 (sol 484)

  A bit more than a year after landing, as the rover was traveling between Cooperstown and the Kimberley, the engineers began to uplink version R11.0.4. The upgrade actually failed to complete on the first attempt, but finished successfully on sol 484 (see section 3.​5.​3). Version R11 had a number of improvements, new features, and bug fixes that increased operational efficiency:New autonomy to track certain types of unsuccessful data transmission attempts, allowing it to reattempt transmission without being commanded to, saving time for tactical planners.

  Dramatic improvements to data compression, allowing more data to be downlinked in a given pass.

  Improvements to fault protection logic in the event of multiple sequential switches between A and B side computers.

  “Dream mode” ability to initiate heating of rover motors while still asleep.

  Temperature-dependent camera models for the Navcams (necessary for visual odometry and autonomous navigation, see sections 3.​5.​3 and 6.​5) became part of onboard rover software rather than being sequenced from the ground each time.

  Improvements to multi-sol driving capability, includi
ng the ability to save on-board terrain maps during sleep so the rover can use the same one to continue a drive the next day without regenerating it, allowing the rover to spend more time driving.

  Several improvements intended for drilling while parked on a slope: new ability to steer wheels one at a time, improving steering stability on slopes; visual odometry during arm operations, allowing slip checking (see section 6.​4.​3) when drilling on slopes.

  Lots of efficiency, fault protection, and system robustness improvements for sample operations, making both Mars operations and ground planning more efficient.

  Added ability to adjust ChemCam focus position to produce Z-stacks as a single command, making sequencing less onerous.

  “Dream mode” was an especially important improvement to the rover’s efficiency during colder winter months. 16 The first activity of the day often requires preheating motors before they can be used, which can take up to two hours. To have the rover computer powered on and waiting for motor warmup consumes precious energy that would otherwise be available for driving or science. Dream mode solved this problem. To prepare for dream mode, before shutdown, the rover computer delivers a heater schedule to the power analog module. If any preheating is scheduled to begin before rover wakeup, the power analog module can command the heater to turn on while the rover is otherwise asleep. In dream mode, the rover is also capable of checking temperature sensors once an hour while asleep. Although it was in development since before landing, dream mode wasn’t actually used operationally until sol 1180, shortly before the rover’s second winter solstice.