Canadarm (SRMS)

NASA. Public domain (NASA / US government work).

Overview

The Shuttle Remote Manipulator System was the robotic arm of the Space Shuttle Orbiter, built in Canada and delivered to NASA as the Canadian contribution to the Shuttle program. It was specified to deploy satellites from the payload bay and to retrieve them, and its whole design follows from that requirement plus the constraint that it had to be carried in the payload bay envelope and could never be tested at full scale in one gravity [1].

It is the direct design ancestor of Canadarm2, and the comparison between the two is the clearest available account of what a station arm needs that a Shuttle arm did not [3].

Specifications

Parameter	Value	Source
Length	15.24 m	[1], [3]
Effective reach from the base	about 10.7 m	[3]
Mass	410 kg	[11]
Degrees of freedom	6, no kinematic redundancy	[1], [3]
Boom lengths	6.38 m and 7.06 m	[6]
Boom exterior diameter	about 0.33 m, graphite epoxy	[6]
Rated payload	29,484 kg in an 18.24 by 4.56 m envelope	[5]
Tip positioning accuracy	51 mm (2 in) and 1 degree	[3]
Tip force limit	44 N normal to the end effector, 25.4 mm deflection fully extended	[5]
Unloaded tip speed	0.60 m/s	[11]
Loaded tip speed	0.06 m/s	[11]
Gear ratio	about 738:1 at the wrist drives, 1842:1 at the shoulder	[7]
End effector diameter and length	0.34 m by 0.46 m	[2]
End effector mass	29.5 kg	[2]
Capture envelope	about 0.1 m lateral and axial, 15 degrees roll	[2]
Capture time	under 3 s	[2]
Rigidize time	under 20 s	[2]
Rigidized interface capacity	474.5 N m bending, 949 N m roll	[2]
Maximum capture closing velocity	0.061 m/s	[5]
Payload arrest distance	within 608 mm	[5]
Force-moment sensing	none	[1]
Design life	100 mission cycles over 10 years, MTBF 8,333 h	[2]

Mission profile

Parameter	Value	Source
Host	Space Shuttle Orbiter, bolted to the payload bay longeron	[3]
First flight	STS-2, November 1981
Missions flown	91
Program end	July 2011
Roles beyond deployment and retrieval	satellite rescue and repair, mobile work platform for extravehicular crew, ISS assembly, Orbiter thermal protection system inspection after the loss of Columbia
Operator station	Orbiter aft flight deck

Rows with no marker are from [1].

Kinematics and workspace

The arm is approximately 15.24 m long with six in-line joints arranged anthropomorphically: shoulder yaw and shoulder pitch, elbow pitch, and wrist pitch, wrist yaw and wrist roll [1], [3]. All joints except wrist roll have travel limits smaller than plus or minus 180 degrees, and the effective reach envelope is about 10.7 m from the base of the arm.

Six joints are the minimum for arbitrary position and orientation of the end effector, so the arm has no kinematic redundancy. Every end-effector pose is reached by essentially one joint solution, and the arm therefore has singular configurations it cannot control through. Three are documented: the shoulder singularity, with the wrist yaw joint directly over the shoulder yaw axis, where plus or minus Y translation commands cannot be executed; the planar pitch or elbow singularity, with the arm straight out, where commands along plus X in end-effector mode are unavailable; and wrist gimbal lock, with wrist yaw at plus or minus 90 degrees, where some roll commands are impossible [1]. The flight software works around the shoulder and wrist cases in automatic and manual modes. When the wrist yaw joint comes within about 0.9 m of being directly over the shoulder joint during a Y translation, the software reorients the arm to drive in a circle around the singularity and then resumes the translation [1]. The elbow case is handled as an ordinary joint travel limit.

The two booms are thin-walled circular graphite epoxy tubes about 0.33 m in diameter, 6.38 m and 7.06 m long, with internal stabilization rings that keep shell ovalization frequencies above 180 Hz and resist local buckling [6]. Stiffness, not strength, drove the structure: the arm had to place its tip within 51 mm and one degree while holding a large payload [3].

The shoulder end is bolted to the Orbiter longeron and the end effector is fitted to the far end only [3]. This is the structural reason the SRMS could not relocate itself. It has one base and one hand, and the base is a fixed structural attachment rather than a capture interface. Canadarm2 answered this by making the arm symmetric about the elbow, with an identical Latching End Effector at each end and seven offset joints of plus or minus 270 degrees travel, so either end can grapple a Power Data Grapple Fixture and become the base and the arm can walk end over end along the station [3].

Joint design and actuation

Each degree of freedom is a motor module driving a gearbox, with local electronics that interpret drive commands originating in the cabin [1]. The motors are brushless DC and identical in all six joints, chosen that way to minimize qualification effort, to avoid brush maintenance, and because small motors through a high-ratio gearbox weigh far less than direct-drive motors of the same output torque.

Each gearbox has two stages. The first is a high-speed stage whose reduction ratio varies from joint to joint to meet that joint’s torque requirement. The second is identical in all joints and is a planetary design chosen to maximize the number of load paths, which gives high stiffness and low backlash [1]. Published overall ratios are approximately 738:1 at the three wrist drives and 1842:1 at the shoulder [7]. Joint housings are fabricated aluminum with steel and titanium in the higher load-bearing components, and the gears are Carpenter Custom 455 steel [1].

Backdrivability was the governing requirement. External loads applied to the tip can generate forces and moments beyond the structural capability of the arm, and a joint that backdrives bleeds off that load instead of reacting it [1]. Meeting the backdrive requirement demanded high gearbox efficiency, which in turn demanded manufacturing tolerances tight enough that gears had to be picked by a select-on-manufacture program with a low yield. The same logic drove two further features: motor current limits in forward drive and in backdrive were matched to the measured gearbox efficiencies so that the joint could not apply excessive load in either direction, and the brakes had to permit backdriving while applied, so that a fault which set the brakes could not turn the arm into a rigid strut. Dynamic braking, decelerating a joint using the motor itself, was also built into the joint design.

End effector

The end effector is 0.34 m in diameter, 0.46 m long, and masses 29.5 kg [2]. It grapples a payload fitted with a grapple fixture consisting of an 11 in grapple pin with a knob on the end [3], an optical target, and three alignment cams that mate to cam lobes on the end effector rim [1], [3].

Capture is by snare rather than by jaws. Three cables are stored in grooves in a fixed ring and a rotating ring inside the open mouth of the effector. Rotating the inner ring through 80 degrees draws the three cables into a closing triangle around the grapple pin [2]. The mechanism is entirely insensitive to which way the pin is clocked and tolerates large misalignment, which is what a snare buys over a gripper: the capture envelope is about 0.1 m of lateral and axial misalignment and up to 15 degrees of roll, with a radial capture zone of 0.099 m to 0.123 m. Capture completes in under 3 seconds, which matters because the arm is closing on a payload with a relative velocity of up to 0.031 m/s and must tolerate impact at up to 0.122 m/s.

Rigidizing is a separate motion. Once the snares are closed the carriage carrying the snare rings is drawn about 25 mm back into the body of the effector on three ball screws of 0.0051 m lead, pulling the grapple pin knob against the cam lobes with roughly 3,560 N and seating the payload with no residual freedom [2]. Belleville springs set the preload between 2,670 N and 3,114 N so that the joint stays loaded across the thermal range, where the pin load varies between 3,290 N and 3,650 N. Rigidizing takes under 20 seconds. The rigidized interface transfers 474.5 N m of bending with no interface separation and 949 N m of roll moment [2].

A single brushless DC motor drives both functions, with clutches separating the capture and rigidize mechanisms and spur gearing setting output torque [2]. Release in the prime mode is limited to a residual moment of 9.5e-6 N m imparted to the payload, which matters when releasing a free flyer that must not be tumbled. A backup release driven by a negator spring motor of about 70.6 mN m through a dog-tooth clutch can open the snares from any carriage position, at the cost of a much larger 0.068 N m release moment [2]. If the end effector fails while grappled, the standard Flight Releasable Grapple Fixture can be released by a spacewalking crew member from the payload side [1].

Post-rigidization pointing accuracy is 0.15 degrees in roll and 0.4 degrees in pitch and yaw [2]. Interface stiffness is at least 7864 N m/deg in bending and 3389.5 N m/deg in torsion, and bending capacity rises to 1627 N m once the interface has separated by 3 degrees. The end effector draws 125 W of heater power in operation and 88 W in survival mode [2].

Design life was 100 mission cycles at five operations per mission over ten years, with a mean time between failures of 8,333 hours; brakes and clutches were life-limited to 50 missions [2].

The effector also carries a Special Purpose End Effector connector fed by sixteen power and data lines routed the length of the arm. Mated to an Electrical Flight Grapple Fixture, it passes power and data to the grappled payload, and it was intended as the growth path for powered special-purpose end effectors [1].

Force and moment sensing

The SRMS had no force or moment sensor. The operator inferred contact loads from the joint responses, camera views, and the compliance of the arm itself. Force moment accommodation, in which measured contact loads are fed back into the rate commands to make constrained-motion tasks such as berthing easier, is identified in the program’s own lessons-learned as a capability the SRMS lacked and future arms should have [1]. Wrist force-moment sensing was added on Canadarm2 [3].

Structurally the tip is compliant by design. Weight and envelope limits capped the arm at 44 N (10 lbf) applied at right angles to the end effector, at which load the fully extended arm deflects 25.4 mm [5]. That accuracy has to hold while handling payloads to 29,484 kg in an 18.24 m by 4.56 m envelope, inside a payload bay whose minimum clearance around a payload is 76.2 mm. Capture is legal only below 0.061 m/s of relative velocity, and payload arrest must complete within 608 mm [5].

The control system models the arm’s compliance rather than treating it as a structural residual. An admittance model of the arm retains 15 to 20 dynamic modes with a 1000 lb payload against 4 to 6 unloaded, and resolves end-effector orientation to 0.01 degrees [6]. The Orbiter digital autopilot updates at 25 Hz and the smallest RCS thruster pulse has a 40 ms rise time [8], so attitude control inputs and arm structural modes occupy overlapping frequency ranges and the two systems have to be analyzed together.

Power and energy

The arm ran on the Orbiter 28 V bus [1]. Published figures exist for the end effector alone: 125 W maximum for operation and 88 W for its heaters [2]. The 28 V bus later proved a constraint. When the Orbiter Boom Sensor System was added after Columbia, the existing SPEE cabling could not carry the current its sensors needed at 28 V, and the workaround was to draw from a 120 V source in the Shuttle that had been installed for ISS use [1].

Thermal

The 34,000 eclipse cycles per 5.8 years measured on LDEF [10] set the cycling load for any externally mounted structure, and gearbox and bearing lubricant has to hold its film at 1e-4 to 1e-7 torr, where vapor pressure rather than viscosity governs the selection [9]. The arm is wrapped in thermal blankets and carries an active, thermostatically controlled, redundant heater system [1]. End effector limits are representative of the mechanical hardware: minus 25 C to plus 70 C operating, minus 36 C to plus 81 C survival, and minus 50 C to plus 81 C qualification. The motor module, which dissipates internally, is rated minus 10 C to plus 85 C operating and minus 36 C to plus 96 C survival [2]. Thermal excursion is also a structural concern at the grapple interface, and the Belleville preload range was sized so that rigidize pin load stays within 3,290 N to 3,650 N across the thermal limits.

Compute and avionics

Control is split between cabin electronics and arm-based electronics. The cabin equipment comprises the displays and controls panel with its two hand controllers and the Manipulator Controller Interface Unit, which is the main arm processor and handles all data transfer between the arm, the panel, and the Shuttle general purpose computer [1].

The trajectory computation lives in the Shuttle GPC. Flight software uses the Jacobian relating joint rates to the rates of the selected point of resolution, which may be a point on the end effector or a point within the payload, and inverts it to obtain commanded joint rates. When the Jacobian determinant goes to zero there is no solution, which is what makes the singularities above operationally binding [1]. The redundant seventh joint that resolves this on later station arms was not available: wrist roll travels plus or minus 360 degrees but the remaining five joints travel less than plus or minus 180 degrees [3]. The GPC issues rate and current limit commands to the arm-based electronics, and each joint’s local electronics closes the servo loop [1].

Actuator sizing for a space manipulator trades motor and gearbox mass against the payload inertia that has to be controlled, and the options available in this class were reviewed across the same period [7]. The Servo Power Amplifiers in the arm-based electronics were redesigned during the program. Studies of the payloads the arm would have to handle during station assembly showed that controllability would not be satisfactory for those masses, and the amplifier redesign restored it [1].

Autonomy

The SRMS was not autonomous. Every motion was commanded by a crew member, and the automatic modes are pre-planned trajectories rather than any form of onboard decision making [1].

Autonomy is present only in fault protection. Built-in test equipment runs throughout the system, and the flight software adds a consistency check for runaway detection. Runaway was the dominant hazard, because a joint receiving unlimited motor current could drive a payload into the Orbiter. The check defines an envelope around the commanded motor rate for each joint, built from an offset from zero commanded rate, a second offset from the commanded rate, and a decay applied when a command is removed or changed. Actual motor rate must stay inside that envelope, and an excursion is annunciated only if it persists for more than four consecutive computation cycles, to avoid false alarms from command transients. Envelope constants were tuned so that a runaway is stopped within about 0.6 m of travel [1]. Self-checks elsewhere in the electronics stop the arm and drive caution and warning displays that tell the operator what failed and what capability remains. No runaway ever occurred in flight.

Communications

The arm has no radio link of its own. It is hardwired into the Orbiter avionics through the MCIU, and all telemetry reaches the ground through the Orbiter downlink. Video from the arm cameras goes to the aft flight deck monitors and to the same downlink.

Payload and instruments

The SRMS carries no science instruments. Its sensing exists to serve the operator.

Three camera assemblies were flown. A color camera on a pan and tilt unit near the elbow gave general situational awareness. A fixed camera on the wrist looked straight down the grapple axis and was the primary cue for capture: the operator flew the arm until the grapple fixture target fell inside an overlay drawn on the CRT display, then triggered capture from a switch on the rotational hand controller. A third, the SRMS side-view camera, was added after Columbia on the inboard side of the wrist joint for awareness during thermal protection system inspection [1]. A light assembly is co-located with the wrist camera. The optical target on the grapple fixture and the alignment cams are what convert that camera view into a capture decision, since the snare tolerates 0.1 m and up to 15 degrees but not an arbitrary approach [2].

The Orbiter Boom Sensor System, added for return to flight, is the closest thing to an instrument payload. It is a 15 m boom carried on the starboard manipulator positioning mechanisms, fitted with cameras and laser sensors, that the SRMS grapples and uses as an extension to reach and image the Orbiter underside [1]. Every post-Columbia mission used the SRMS and OBSS together to survey all critical thermal protection system surfaces, and the combination was certified as a stable enough platform to hold a spacewalking crew member at the boom tip for tile repair [1].

Modes of operation

Five families of mode were available [1].

Automatic covered both pre-programmed sequences and operator-commanded auto sequences. The latter required the operator to enter a final position and orientation before motion began. Auto sequences were used mainly for surveys and long repositioning maneuvers.

Manual augmented was the mode used for grappling, berthing and unberthing, tracking and capturing free flyers, and coarse positioning. The operator commanded the position and orientation of the point of resolution in real time through the hand controllers, with the software resolving those commands into joint rates. Maximum joint rates were set before flight and depended on the payload being handled. A vernier submode reduces control authority to 10 percent for precision work [5].

Single joint drive gave the operator one joint at a time under computer support, used mostly for cradling the arm.

Direct drive and backup drive were hardwired reduced-capability modes that applied a fixed voltage to a joint drive amplifier, single joint only, for use when the computer-supported modes were lost.

In manual augmented mode the translational hand controller commanded end effector motion in planes parallel to the Orbiter translation planes and the rotational hand controller commanded angular rates about axes parallel to Orbiter roll, pitch and yaw, originating at the end effector reference point. Either set of axes could be transposed by software to the end effector or to the mass centroid of the payload, after which commanded motion was defined in that frame instead [4].

The end effector itself had an automatic and a manual mode. In the standard automatic mode the rigidize command followed snare closure without operator action; in manual mode the operator commanded snare close and rigidize separately [1].

Late in the program a Position Orientation Hold Submode was added to manual augmented mode. The SRMS is a rate command system, so before POHS the position and attitude of the point of resolution were computed for display only and any drift had to be corrected by the operator. POHS projects a reference trajectory from the commanded rate and adds correction commands proportional to the deviation from it. The effect on uncommanded motion was large: on STS-31, without POHS, uncommanded motion exceeded 0.6 m and nearly 10 degrees, while on STS-103 with POHS active it was under 25 mm and about half a degree [1]. POHS was later extended to the OBSS case, where the crew had almost no direct view of the boom under the Orbiter.

Ground operations

The arm was operated from the aft flight deck of the Orbiter by a crew member at the RMS workstation, using overhead and aft window views plus TV monitors, the displays and controls panel, and the two hand controllers [1]. The workstation layout was constrained early: the translational hand controller had to fit a 6 by 4 by 4.5 inch envelope, be usable by fifth-percentile female through ninety-fifth-percentile male crew members at a common design eye point, and be a displacement device rather than a force stick, with rate-dependent viscous damping generated in the stick itself rather than downstream in electronics, so as to preserve tactile feedback. Full-scale force was capped at 10 lbf because the operator is weightless and has nothing to brace against [4].

Ground support was simulation-heavy, and unusually so, because the arm could not support its own weight in one gravity and so could never be exercised as a complete system on the ground [1]. Four facilities carried the load:

• An air-bearing flat floor rig that blew air through pads under the arm’s support feet to offload gravity, allowing genuine multi-joint operation in a single plane. The arm could be mounted pitch-coupled, driving the three pitch joints, or yaw-coupled, driving the two yaw joints, with wrist roll available in either. It verified arm controls, tip accuracy, tip force, straight-line controllability, current limit response, and behavior under end effector to grapple fixture misalignment [1].
• SIMFAC, a manned real-time simulator at the contractor built around a TI 980B computer, used to develop the control laws and the hand controllers against the full 29,484 kg payload case [5]. Hand controller configuration and the resulting operator workload were evaluated on it directly [4].
• The Shuttle Engineering Simulator at JSC, combining an SRMS model with an aft cockpit mockup in a dome display. It modeled the Orbiter digital autopilot alongside the arm, so that coordinated operations between the arm operator and the pilot could be rehearsed with the 25 Hz autopilot and the arm’s structural modes coupled through the Orbiter [8]. It was used for engineering evaluation of software and procedure changes, for crew training, and repeatedly during flights to test proposed fixes to on-orbit problems [1].
• The Shuttle Avionics Integration Laboratory, which ran a hardware-in-the-loop MCIU against a computer model of the rest of the arm.

A Math Model Working Group coordinated the several independent modeling efforts, and the program identifies that structured multi-group forum as a lesson in its own right [1]. Arm models were upgraded continuously and by 2004 the real-time model had the fidelity of the best non-real-time model of the 1980s.

Technologies developed

The snare end effector and the grapple fixture it mates to became the standard space robotic capture interface. Canadarm2, Dextre, the Japanese Experiment Module arm and the European Robotic Arm all use snare-type latching end effectors on standardized fixtures, and the ability to grapple with 0.1 m and 15 degrees of misalignment tolerance is what makes robotic capture of a free-flying vehicle practical at all [2], [3].

Backdrivable high-ratio joints with matched forward and backdrive current limits established the load-protection approach used on later station arms, where the payload can outmass the arm by orders of magnitude and structural overload is the dominant failure mode [1].

Resolved-rate control from two hand controllers, with the point of resolution and the command frame both selectable in software, is the interface every subsequent space manipulator has inherited [1], [4].

Four limits of the design are documented. Six degrees of freedom without redundancy left singularities the software had to steer around [3]; no force-moment sensing made constrained motion difficult [1]; a bolted base meant the arm could not relocate itself; and 28 V cabling sized to the original requirement constrained later capability growth. Canadarm2 addressed the first three with a seventh joint, wrist force-moment sensors, and symmetric latching end effectors.