CADRE

NASA/JPL-Caltech. Public domain (NASA / US government work).

CADRE is a JPL technology demonstration of cooperative multi-robot operation on the lunar surface: three mobile rovers and one static base station mounted on the lander [9]. It has not flown. Everything reported below as a CADRE result comes from ground testing and simulation.

The problem

Conventional planetary surface operations command one vehicle at a time through a ground-generated sequence. That does not scale to several vehicles, because each added vehicle adds operator effort and consumes bandwidth that is already latency-limited [1], [9]. Ground sequences also respond to an unexpected state by entering safe mode, which forfeits the science that was scheduled afterward; a planner that holds intent and modeled effects onboard can replan and continue with whatever tasks remain constraint-safe [5].

The lunar surface adds three constraints that shape the design. Power and heat bind at opposite ends of the lunar day: when the sun is low energy is scarce and overheating is not a risk, while around lunar noon the rovers can drive only a few minutes before CPU temperature exceeds its 65 degrees C operational limit [1]. Surface obstructions interrupt radio links and partition the network, so a design that needs consistent shared state fails [1], [9]. Surface temperature at 45 degrees latitude reaches a mean 350 K at local noon and falls to a mean 89 K before sunrise, and the equatorial maximum is 391 K, which is the range that applies at Reiner Gamma [3]. In-situ regolith relative density is about 65 percent in the top 15 cm and exceeds 90 percent below 30 cm [4].

The demonstration therefore tests whether a team can accept a goal such as “explore this region” and decompose it onboard into commands for individual mobility systems and instruments [1], [9]. Two experiments are planned. In the exploration experiment the team is given the boundary of a region of unknown content and must observe every reachable portion with onboard stereo cameras and classify it as traversable or obstacle. In the distributed sensing experiment the rovers drive in formation between assigned waypoints while collecting multi-static ground-penetrating radar soundings [1], [9].

What has flown

CADRE itself has not flown. The assigned flight is on an Intuitive Machines Nova-C lander under CLPS task order CP-11, flown as IM-3, to Reiner Gamma on the western lunar near side, with a surface life of the daylight hours of one lunar day, about 14 Earth days [7], [9]. The planning literature gives the flight year as 2025 or 2026 [1]; the program page gives 2026 [7]. Each rover is lowered by tether on its own deployer [9].

Three elements of the design have flown in other vehicles:

• MEXEC on ASTERIA. The Multi-mission EXECutive, the planner CADRE extends to several agents, flew on the ASTERIA CubeSat [5]. It planned and executed uploaded task networks for astronomical and Earth observations. In a second experiment, forced by the spacecraft’s later loss, it recovered a momentum-maintenance violation by dispatching a momentum dump and resuming observations rather than losing them to a reset. Memory capped task networks at about 100 tasks [5]. The Mars 2020 Onboard Planner differs in that it uses a specialized algorithm with limited choice points and a fixed timeline library, whereas MEXEC is multi-mission [5].
• The VOXL and F Prime software base. The ModalAI VOXL port was inherited from the Mars Helicopter and contributes about a fifth of the hand-written flight software lines on each CADRE deployment. Roughly 40 percent of the rover deployment and half of the base station deployment is code shared between the two [10].
• Rover-borne ground-penetrating radar. The Yutu-2 lunar penetrating radar is the flown precedent for CADRE’s primary payload, though it is a single-rover, monostatic instrument. Over nine months its 60 MHz channel reached about 330 m of penetration, but near-surface returns were saturated by coupling with the rover’s own metal structure, so usable analysis began at 52 m, and the 500 MHz channel (about 35 m penetration) filled the shallow profile [18]. Five continuous reflectors were resolved at 51.8, 63.2, 96.2, 130.2 and 225.8 m with stated uncertainties of 1 to 6 m [18].

What is being tried now

The families below are all CADRE-specific unless stated. None has operated on the Moon.

Onboard multi-agent planning

Autonomy is organized as leader election, centralized planning on the leader, decentralized execution on every agent, and multi-agent constraint checking on the leader [1], [9]. Leader election, consensus and distributed spanning-tree construction are standard families in the multi-agent algorithm literature, cataloged alongside formation control and task allocation, where relatively few published algorithms have been field-tested and most of those exchange only simple information such as agent positions [6]. Status: ground-tested on development and flight-model rovers and in simulation.

The leader runs a strategic planner in MEXEC, which comprises a planner, an executive and a timeline library the planner searches for valid intervals in which to place tasks [1], [5]. A task carries an ID, a name, a ground-specified priority, a command, expected impacts and constraints, either of which may apply before, during or after the task. Constraints are state constraints bounding a system state between limits, or precedence constraints; state constraints divide into pre-execution constraints checked before start and maintenance constraints checked throughout [5].

The planner runs at 1 Hz, evaluating replan triggers, committing new tasks, deleting old ones and checking multi-agent constraints, and commits any task whose start falls within a five-second window [5]. The plan interval must exceed the worst-case planner cycle, and the commit window must be at least as long as the plan interval, because tasks are committed only at the start of a cycle [5]. Replanning is triggered by conflict detection, task failure and experiment milestones. Scheduling unschedules every uncommitted task, applies current measured state, then greedily schedules the rest in priority order, each as close to its preferred start as constraints allow, and rejects any that cannot be placed without violation [5]. Completed work is not carried in the planning state, because the maps capture it in the exploration experiment and the rover positions capture it in distributed sensing, which is what lets one scheduling process serve every replan [1], [9].

Each agent controller observes only its own state, checks constraints before and during execution, may delay a task whose starting constraints are unmet, and may declare a task failed on a maintenance violation, then issues cleanup commands to leave the agent recoverable [9]. Constraints that depend on another agent’s state are checked on the leader. A leader cannot delay a task it does not control, so it issues an abort, reduced to a single task ID to maximize the chance of timely delivery over a disrupted link [1], [9].

Leader election and shared state

A distributed minimum spanning tree algorithm, GHS, selects a unique appointer every ten seconds. The appointer designates as leader the agent whose state is farthest from violating its thermal and power constraints [1], [9]. Beyond the textbook construction the implementation adds persistence across agents leaving and rejoining, reelection driven by health, tolerance of clock drift, a weight on the incumbent that damps leader churn, and a designated survivor holding a copy of the leader’s information [11]. In a four-agent case study with rovers dropped and reconnected one at a time, message counts fell as the graph shrank and leader ordering tracked the expected ranking of normalized state of charge and CPU temperature [11].

The shared state database runs over SQLite with a custom synchronization protocol. State needed for strategic planning is synchronized to the leader and the survivor every ten seconds. It deliberately gives up inter-agent consistency in the CAP sense in favor of availability and partition tolerance: stale leader information degrades plan quality but cannot produce uncoordinated action, because only the leader plans [1], [9]. Planning-relevant information is held on at least two agents, so it is lost only if both fail within the ten seconds before a replacement pair is elected [1].

Resource-aware planning: power and thermal

Battery state of charge, CPU temperature and time are the resources the planner models explicitly [1], [9]. The planner predicts state of charge linearly from the power loads of every behavior a task starts, against known battery capacity, with recharge and heater discharge estimated coarsely from lunar time of day. It assumes a uniform 80 percent of any electrical load is dissipated as usable heat and omits array loss from rover tilt [1], [9]. Each task declares its state change through the MEXEC impact mechanism so later tasks can be checked against predicted values [5].

Thermal simulations covered a range of solar elevations [1]. Sun angle and operating mode were the dominant factors in heating rate and CPU temperature was the most constrained state in every run, so the planner models CPU temperature alone as a single-node model. Starting CPU temperature had minimal effect on the subsequent heating rate and was dropped; the rate is steep initially and levels off after about two minutes [1]. Piecewise task splitting would gain little compared with replanning more often, so a linear rate was kept [5]. When the sun is high, stopping the drive lets the arrays recharge the batteries, and at other times the agent must be commanded into low-power mode through an explicit shutdown task [1], [9].

An FPGA outside autonomy control runs a hardware timer that shuts all agents down twice each hour and restarts them [1]. Every experiment must therefore make progress in bounded 25-minute increments, and the planner must stop driving and enter low-power mode before the timer expires so logs and state can be written [1], [9].

The same coupling of power, heat and route is being worked on a neighboring micro-rover. For MoonRanger, a south-pole rover, thermal modeling gives a surface operating band of -10 to 35 C, needs at least 9.5 W of lander-supplied heater power in dark cislunar transit, and limits roving in permanently shadowed regions to about one hour, set by the external laser and sun sensors dropping below cold-soak limits, not by the avionics [16]. All of those figures are predictions; the paper contains no thermal vacuum test data [16]. MoonRanger’s autonomy design is a proposal as well: a space-hardened processor for motors and proprioceptive safeguarding beside a quad-core Linux computer for perception and planning, with laser line striping to replace stereo in darkness, and a reported 5 percent of distance traveled in dead-reckoning drift at a lunar analog site [17].

Formation driving for distributed sensing

Ground operators specify a team waypoint typically tens of meters from the start, a formation as a set of inter-rover distances, and a maximum allowable deviation that, if respected, ensures sufficient radar data quality [1], [9]. The leader computes a team trajectory by sampling-based motion planning over the joint state space and assigns each rover a time-stamped corridor, or tube. If every rover stays inside its tube, the allowable deviation in inter-rover distance is guaranteed; if one cannot, all stop and the leader plans a new collision-free trajectory [1], [9].

Other published formation planners have not left simulation or small indoor tests. A two-layer planner for a three-vehicle road-following convoy, an A-star seed path refined by a local optimizer, held a 2.5 m lateral spread and a 5 m minimum trailing distance in simulation, at 0.0016 s per vehicle per cycle for the graph planner and 0.69 s for the optimizer on a desktop Xeon [20]. It is a terrestrial problem and the runtimes do not transfer to a flight processor [20]. A gesture-command study of three toy rovers in a maze compared group levels of autonomy with one traverse per condition (96, 79 and 58 s) and no variance reported [21].

Exploration and mapping

The exploration algorithm is semi-centralized: an elected leader partitions the unexplored area by k-means into as many non-overlapping subregions as there are rovers, and each rover explores its own subregion from frontier points without further coordination, which keeps communication low and removes inter-robot collision management from the exploration task [1], [8]. Maps are synchronized periodically to the leader, which merges them into a joint map and recomputes subregions as the unknown area shrinks [1], [8]. Frontier targets are computed from the shared traversability map, and rovers are assigned targets that minimize cost while maintaining communication with the base [2]. Global map construction runs on MoonDB, a centralized database on the base station, whose data volume grows with agent count and extent and bottlenecks map building [2].

Map merging is a general scaling problem. In terrestrial multi-robot SLAM evaluated on DARPA Subterranean Challenge data with up to four robots, candidate loop closures grow quadratically with robots and area, so only a prioritized fraction can be computed centrally and the best prioritization rule differed between environments [15]. That is underground field data, not a space analog [15].

A federated alternative has been evaluated on the same problem, as a proposal tested on datasets rather than on rovers: each agent trains a 2D neural-field map on its local traversability map online and transmits only network parameters, about 399 KB for a 200,000-parameter network at 16 bits, to the base station for aggregation [2]. Communication payload falls by 89.5 to 93.8 percent against raw maps, but only 0.7 percent against a JPEG-compressed grayscale map at similar quality. Meta-training with Reptile on Earth datasets such as KITTI cuts the iterations to reach target map performance by about 80 percent against random initialization, validated on the Athabasca Glacier and DoMars16k datasets [2].

Team autonomy of this kind has been demonstrated outside space. JPL’s CARACaS architecture ran four full-size unmanned surface vessels in a harbor patrol with no human in the tasking loop, with distributed plans agreeing over 80 percent of the time despite communication problems; nearly all anomalies traced to perception, not autonomy [19]. It is maritime, two-dimensional and obstacle-sparse, and bounds nothing about delay, radiation or flight processors [19].

Communications

The base station is the gateway between the rovers and Earth and also performs computation for the team [1], [9]. The inter-agent link is a Microhard mesh radio set with a minimum aggregate of 1 Mbps shared by the three rovers and the base station, and motor electromagnetic interference limits reliable transfer to windows when the rovers are not driving [14]. Time-sensitive command and status traffic is therefore kept out of MoonDB, each class of shared data has its own sharing policy and frequency, and maps are merged with OpenGL shaders and reconciled afterward against a pose graph fusing visual-inertial odometry. The clean-room experiments with three rovers are preliminary and report no bandwidth, packet loss or synchronization latency under the 1 Mbps link [14].

Verification

Verification used a graded set of venues: batch planning, ROS simulation, the Dragonfarm testbed of networked VOXL modules running the full flight software, development model rovers with flight-equivalent computing and actuation but a reduced sensor suite, and the flight models [1], [10]. The exploration algorithm was tested on prototype Mercury-7 rovers running a ROS navigation stack in JPL’s Moon Yard, then on development models running the flight software in the Mars Yard, including night testing under floodlighting and 30-minute wake-sleep duty cycles [8]. Regions ranged from 6 by 6 m to 22 by 13 m, with distributed sensing goals 6 to 20 m from the start, in terrain from sparse to cluttered rock and crater fields [8]. Across 15 development model runs the rovers explored 2,724 square meters in about 25 hours, averaging 0.035 square meters per second over the last five [8]. Flight models, confined to the clean room, carried temperature and state of charge sensors the development models lacked and ran Autonomy Day-in-the-Life tests exceeding 9 hours of continuous FPGA-driven wake-sleep cycling with all four agents, which the three-agent development fleet could not reproduce [1].

The chassis is a conventional aluminum box [12]. For such a rigid box, qualifying to a Gaussian random vibration spectrum with a few dB of margin bounds the non-Gaussian response of a real launch, which is not true of flexible structures such as JPL’s PUFFER chassis [12]. Rover batteries use Saft MP176065-xtd lithium-ion cells chosen from a JPL wide-temperature development effort that spanned low-temperature electrolytes and high-temperature formulations [13].

The numbers

Specifications

Parameter	Value	Source
Agents	3 mobile rovers plus 1 lander-mounted base station	[9]
Locomotion	four wheels	[9]
Power	solar, with rechargeable battery per rover; base station powered by the lander	[9], [1]
Minimum battery state of charge modeled by the planner	20 percent, given as an example	[1], [9]
Flight computer	ModalAI VOXL, Qualcomm Snapdragon with integrated GPU	[2], [10]
Flight software framework	F Prime, inherited in part from the Mars Helicopter VOXL port	[1], [10]
Flight software size	73,239 hand-written F Prime component lines on the rover deployment, 59,833 on the base station	[10]
CPU operational temperature limit	65 degrees C	[1]
Enforced wake-sleep cycle	shutdown at 25 and 55 minutes past each hour, restart at 0 and 60 minutes past	[1], [9]
Onboard sensing	stereo camera pair per rover, navigation sensors, ground-penetrating radar	[1], [9]
Inter-agent link	Microhard mesh radios, at least 1 Mbps aggregate	[14]
Planner rate and commit window	1 Hz; 5 s	[5]
Leader election and state sync period	10 s	[1], [9]

Mission profile

Parameter	Value	Source
Lander	Intuitive Machines Nova-C, CLPS task order CP-11, flown as IM-3	[7], [9]
Landing site	Reiner Gamma, western lunar near side	[7]
Launch	2026	[7]
Surface duration	daylight hours of one lunar day, about 14 Earth days	[7], [9]
Deployment	each rover lowered from the lander by tether	[7]

Test results

Test	Result	Source
Exploration, 15 development model runs, Mars Yard	2,724 m2 explored in about 25 h	[8]
Exploration rate, last five runs	0.035 m2/s	[8]
Federated map payload against raw maps	89.5 to 93.8 percent lower	[2]
Federated map payload against JPEG grayscale	0.7 percent lower	[2]
Meta-training effect on iterations to target map quality	about 80 percent fewer	[2]
Flight-model day-in-the-life test	over 9 h continuous wake-sleep cycling, 4 agents	[1]
Yutu-2 radar, 60 MHz and 500 MHz channels (flown precedent)	about 330 m and about 35 m penetration	[18]

What is not established

Rover mass, dimensions, top speed, battery capacity, radio bands, link margins, radiation tolerance approach and onboard memory sizing are not given in the retrieved planning and architecture papers or on the program pages. The mission has not flown: the exploration and distributed-sensing algorithms, the flight software line counts and the leader-election and formation results come from ground testing, simulation and one prior flight of the MEXEC executive on a different spacecraft [5], [1]. The clean-room communications experiments report no bandwidth, loss or latency figures [14]. The federated mapping result is a dataset evaluation, and its 0.7 percent gain over JPEG compression is the figure that bounds its value [2]. The formation, convoy and maritime autonomy comparisons are terrestrial or simulated and do not bound lunar behavior [19], [20]. The physical characteristics of the CP-11 landing site and the payload manifest are not published.