Comment by retSava | Hacker News Reader

Comment by retSava | Hacker News Reader

Parent Full thread

So many interesting details in this article. Snapdragon 801-based hw running Linux, sensor fusion from three sensors whereof some bought COTS from sparkfun (who make breakout boards for sensors, basically the sensor datasheet recommended design). 3 flights planned, but potentially more which will be planned after the three first. 30 day lifetime window, due to dependecy on the rover, which needs to conserve resources.

I would looooove to know more more more about this. What did dev of this look like (eg simulators)? What's the flight envelope? What are the most important risks and how are they mitigated? What internal discussions took place (do this, prio that, don't do X etc).

Just so much interesting stuff! Can't wait :)

edit: from wikipedia: "Each flight is planned to be at altitudes ranging from 3–5 metres (10–16 ft) above the ground.[1] In up to 90 seconds per flight, it could travel as far as 50 metres (160 ft) downrange and then back to the starting area".

"The helicopter uses counter-rotating coaxial rotors about 1.2 metres (4 ft) in diameter".

Etc. Recommend the wiki page on it: https://en.wikipedia.org/wiki/Mars_Helicopter_Ingenuity

Actually the computing power of Ingenuity surpasses one of the Perseverance rover (and probably by a lot). The rover has a radiation hardened RAD 750 CPU (based on PowerPC 750 architecture, which was introduced in 1997 to compete with Intel's Pentium II [1,2]) with 250-150nm technology process operating at 200Mhz[3]. Ingenuity's Snapdragon 801 can reach up to 2.5 GHz and is based on more energy-efficient 28nm modern (released in 2014) ARM architecture [4]. This CPU even has Wi-Fi and GPS, though probably not much of a use on Mars :)

1. https://arstechnica.com/science/2019/11/space-grade-cpus-how...

2. https://en.wikipedia.org/wiki/RAD750

3. https://mars.nasa.gov/mars2020/spacecraft/rover/brains/

4. https://www.qualcomm.com/products/snapdragon-processors-801

I haven't seen much on the 'sky crane' portion. It seems that it will just use whatever fuel it has left after the landing procedure to just get as far away as possible. It seems like the perfect place to stick some experimental imagery gear: film everything you can all the way down and transmit it back to Perseverance. And there's the possibility that it would survive its crash too with all hardware intact.

There are also two redundant TI MCUs on the copter

>TMS570LC43x high-reliability automotive processor operating at 300 MHz, with 512 K RAM, 4 MB flash memory, UART, SPI, GPIO

https://rotorcraft.arc.nasa.gov/Publications/files/Balaram_A...

Do you know why radiation hardening is not needed for the Ingenuity? Is there a mechanical shield? Or is it just the shorter runtime that makes the use of an off-the-shelf processor acceptable?

I had the opportunity to go down to JPL and speak with team members about this design decision. The space hardened processors are not fast enough to do real time sensor fusion and flight control, so they were forced to move to the faster snapdragon. This processor will have not flips on Mars, possibly up to every few minutes. Their solution is to hold two copies of memory and double check operations as much as possible, and if any difference is detected they simply reboot. Ingenuity will start to fall out of the sky, but it can go through a full reboot and come back online in a few hundred milliseconds to continue flying.

In the far future where robots are exploring distant planets, our best tech troubleshooting tool is to turn it off and turn it on again.

I'm a little surprised they didn't go for three separate computers and compare them for every operation, or something like that, but I'm sure they have their reasons.

I've never seen an off-the-shelf processor that has hardware support for doing that kind of cross-checking on every instruction. And doing it in software would probably add so much overhead that the error-checking would be much more likely to fail than the application code.

If you're willing to relax your real-time constraints a bit, and risk a brief period of incorrect behavior before the error is caught, the problem becomes vastly easier and cheaper to solve.

>off-the-shelf processor that has hardware support for doing that kind of cross-checking on every instruction.

it is usually done with COTS CPU by either running the CPUs in lockstep (the simpler early generations of CPU) or by inserting hardware checkpoints at various points like branches, by number of instructions, etc. A recent such commercial system was the triple Itanium from Tandem/NonStop(HP).

There are the ARM Cortex-R series of processors which have two cores running in lockstep for fault tolerance.

Perhaps the double-memory-and-checking is only done on the control algos and not on sensor fusion/object detection etc?

Kind of "Ok if we for a brief moment believe there's an obstacle in front of us, since it'll be gone next tick, but not ok to turn off motors".

Do you have a source for those fast reboots? It's running Linux after all

A few hundred milliseconds seems easily doable with a custom linux distro.

Unless your /dev/sda wants a fsck. :-)

is Ingenuity running Linux? All of the flight controller software i've seen for autonomous drones don't use an operating system.

Yep, from the article:

"This the first time we’ll be flying Linux on Mars. We’re actually running on a Linux operating system. The software framework that we’re using is one that we developed at JPL for cubesats and instruments, and we open-sourced[0] it a few years ago. So, you can get the software framework that’s flying on the Mars helicopter, and use it on your own project. It’s kind of an open-source victory, because we’re flying an open-source operating system and an open-source flight software framework and flying commercial parts that you can buy off the shelf if you wanted to do this yourself someday. This is a new thing for JPL because they tend to like what’s very safe and proven, but a lot of people are very excited about it, and we’re really looking forward to doing it."

[0]: https://github.com/nasa/fprime

My entirely uninformed opinion is that radiation hardened silicon is something that comes from government that isn't actually needed for most purposes. It's something you do when cost is no object.

I went down this rabbithole not long ago with the rovers on-board computer. The writeup from the people who designed the system was really approachable for someone without any aerospace experience. There's a lot of challenges and tradeoffs involved.

Some takeaways:

> Constrained CPU: 133MHz PowerPC, 128MB RAM, 4GB storage

> Software written in C, OS is VxWorks

> Only get contact a few times a day, rover must be charged and ready each time regardless of uncompleted tasks. Scheduling is hard.

> Some tasks require parts preheated for X time, which depends on ambient temp, they use a lookup table for the time of day instead of measuring the temp directly. (Assume this is for reliability purposes)

> High level activities are constructed in a GUI by the operations team, low-level tasks are written in XML, both are uploaded to the rover as a binary plan file.

It's a good read, do recommend it.

https://ai.jpl.nasa.gov/public/documents/papers/rabideau_iwp...

> Some tasks require parts preheated for X time, which depends on ambient temp, they use a lookup table for the time of day instead of measuring the temp directly. (Assume this is for reliability purposes)

That's an interesting one. Guessing that there also must not be that much variation of temp and weather conditions?

Veritasium did an episode 'Mars Helicopter' containing some interesting discussions with the team that built it.

https://www.youtube.com/watch?v=GhsZUZmJvaM

nm it was already linked elsewhere

This is the coolest part of the mission IMO.

My big question is where does it land? Does it dock with the rover? It seems to power itself via a solar array. About 100 days into the mission they plan on launching the helicopter for the tiny lifespan window.

I think the limit on its lifespan is really, "How long until destroyed by wind/dust". And then how long until it cannot charge its own batteries/sustain itself.

I agree, this is the coolest part, but the most useful part for humanity is MOXIE.

It lands on the ground. And yes, dust on the panels is a big concern. (I work at JPL but not on Perseverance / Ingenuity)

That's really cool; thanks for your work!!

I cant wait to see how Y'all figure out how to get those rock samples back to earth; that's gonnna be nuts XD

There's a bit of info here too : https://www.youtube.com/watch?v=mQu9m4MG5Gc

Reply on news.ycombinator.com