activesystems2026

Deterministic Rover Controls

Distributed lunar rover control stack separating high-level autonomy, deterministic embedded validation, and industrial actuation.

No hero asset

Fallback architecture graphic

System Abstract

Problem and Constraints

A lunar rover control stack needs to accept autonomy and manual commands while enforcing deterministic limits, timeouts, brakes, and fault states before commands reach industrial motor controllers.

Constraints

Motor EMI
Noisy power
Field reliability
Latency
Watchdogs
Fault recovery
Deterministic command limits

Architecture

Layered System Architecture

Operator Control

Operator Controller

Manual joystick path and debug/control input through a WebSocket channel.

Deterministic Control

ESP32-S3

Validate command strings, clamp setpoints, enforce timeout/brake/fault states, and publish OLED telemetry.

Ethernet Bridge

W5500 SPI Ethernet

Bridge embedded control traffic from SPI Ethernet to the Modbus TCP motor network.

Industrial Actuation

SEW Movimot Motors

Receive Modbus TCP setpoints and execute motor control under validated limits.

Autonomy

Jetson Orin Nano

Run ROS2 autonomy, perception, planning, and command interface into the deterministic control layer.

WebSocketSPIModbus TCPROS2I2C

Measurements

Metrics

Command stream target

20 Hz

Max RPM

600

Max acceleration

200

Max deceleration

400

Control mode

Discrete command strings + validated setpoints

Engineering Decisions

Tradeoffs and Consequences

Decision	Reason	Tradeoff	Consequence
Separate autonomy from deterministic command validation	The Jetson and ROS2 stack are appropriate for perception and planning, but safety-relevant command validation needs a deterministic embedded boundary.	Adds integration complexity between autonomy, manual control, and motor interfaces.	The control layer can reject stale, invalid, or excessive commands before industrial actuation.
Use Modbus TCP for motor control	The motor controllers expose an industrial protocol path suitable for field integration.	Ethernet and power integrity become system-critical.	Industrial actuation can be integrated with embedded command validation.

Failure Analysis

Bring-Up Evidence

Failure analysis

W5500 link loss under motor load

Symptom: The SPI Ethernet path lost link after several minutes during motor operation.
Root cause: A shared noisy 3.3 V rail tied to the motor environment, motor current spikes, EMI, ground bounce, and SPI/Ethernet sensitivity destabilized the link.
Fix direction: Use a clean isolated 3.3 V rail, local bulk and high-frequency decoupling, reset supervision, shorter SPI traces, solid ground return, and shielding where needed.
Maturity signal: Electrical integrity is part of the control architecture, not a separate afterthought.

Artifacts

Evidence Pack

diagram

Control Stack Architecture

Research Value

Publishable Direction

Industrial protocol integration in field robotics.
Real-time separation between autonomy and embedded validation.
Control reliability under noisy motor and power conditions.

Markdown Body

Technical Writeup

Architecture Path

Operator Controller -> WebSocket -> ESP32-S3 -> W5500 SPI Ethernet -> Modbus TCP -> SEW Movimot Motors

Jetson Orin Nano -> ROS2 autonomy -> command interface -> deterministic control layer

Engineering Value

This system shows how a rover control stack can isolate high-level planning from actuation-critical validation. The result is a more inspectable control boundary with manual override, telemetry, brake states, and fault recovery.