<title>Protective operating system shell environment for robots</title>

This paper describes the synthesis of a protective operating system shell environment for robots. The approach is designed to protect the robot from the effects of errors in the lower level manipulator system and the higher level plan. This shell is composed of a number of fault tolerance tasks at a discrete decision making level. In order to separate the various functions of a robotic system and to better monitor the interactions of the components, we use models from the design of computer operating systems. The user communicates with a "shell" which is wrapped around a "kernel." One of the duties of the robot fault tolerance shell should be to enforce a protocol between the user commands and the robot fault tolerance capabilities. In this paper, we describe an implementation to conform to a formal protocol which explicitly includes fault tolerance. Each of the discrete layers in the robot control system will be modeled by a separate finite state machine (FSM). The FSMs encapsulate the redundancy and fault tolerance capabilities of the system in a uniform manner. Our FSMs will be designed to be dynamically growing and contracting as for example when new sensors are added or as sensors fail. From these FSMs we can develop a shell capability analysis utility that monitors the current fault tolerance status of the robot system. For example, the process of checking to see if the fault reconfigured robot can still complete its plan can be approached as a conformance testing problem. When faults cause joints to be lost, the reduced robot will be viewed as a subset of the original robot. Test sequences can be developed to determine if the reduced robot conforms to the original robot specification with respect to the user's original plan. A "critic" utility in the shell can also check for obstacles and will halt the robot to protect it from possible damage.National Science FoundationSandia National LaboratoryNAS