Autonomous Guidance Under the Hood

Luigi's Rolickin Roadsters at DCA

These days most automated guided vehicles (AGVs) are built for industrial use. A typical application might be in an automobile plant moving parts or materials around the factory. In an industrial environment, safety primarily means preventing the vehicle from running into another vehicle, an obstacle, or personnel.

Early Guide by Wire Patent Details

Control design for Dark Ride systems has its roots in industrial automation technologies. Initially, the two big players in Themed Entertainment (Disney, Universal) had to develop their own standards and safety systems. In the 1960's these were similar to systems developed for railroads (ie; block control) and often used relay logic. As safety became more important, and markets began to spread, industry, professional organizations and governments began cooperating in developing standards with a goal towards globalization.

The parallels between controling Themed Entertainment and Industrial Automation are obvious, but in two areas the requirements and tolerances are very different; Timing and Safety. Show Timing can require "frame rate synchronization" of events and both acceptable injury thresholds and frequency of occourance are much lower, particularly at the highest SIL (Safety Integrity Level) or PL ratings.

Logan Industrial AGV

Back in 2014, Prism Systems was contracted develop an AGV for an Orlando area theme park. Unlike industrial material movers, the cargo would be people and the primary function was providing an “experience” while moving them thru a show. This presented a number of significant challenges in both software and control system design.

Prism initially chose to use Programmable Logic Controllers for safety functions; and monitoring to protect the guests and operators from injury or death. Safety PLCs, EthernetIP, laser scanners, video cameras and light curtains provided multiple layers of protection. The final solution had several features combined to achieve a Safety Integrity Level (SIL) 2 rating, which equates to one failure per 1 to 10 million hours of operation. For one system that would be nearly 150 years of operation, 18 hours per day.

Obtaining that level of safety required the use of Safety Rated PLCs communicating with Safety Point I/O, modular programming using standard and safety Add-on Object Instructions (AOIs),
EthernetIP communication using a Safety Layer Protocol, safety rated laser scanners, light curtains, vision systems to detect intrusion in forbidden areas and produced/consumed tags to other Safety rated PLCs communicating over an EthernetIP Safety Layer.

Arrow's Wire Guided Vehicle; Danny the Dragon (1960)

Designing Safety into Free-Range AGVs

Autonomously Guided Vehicles historically have navigated in one of two modes: free range or fixed path. Fixed-path AGVs have followed buried wires (Danny the Dragon, Tower of Terror) or magnetic tape, with or without modulated RF.  Fixed path is similar to traditional tracked dark rides in that the vehicles are constrained to specific routes and speeds.  Some vendors have chosen to call fixed path "Trackless" technology, even though the vehicle's path(s) are fully planned in advance.

Free-ranging AGV's may use a combination of inertial navigation, laser scanners, optical encoders and sensors, buried magnets and RFID tags. They typically also refer to an onboard electronic map. They may have onboard or wayside vision systems monitoring for obstacles. RF tracking and ranging systems using WiFi and indoor GPS have also been developed.

2getThere 3rd Generation Autonomous Vehicle

One recent development in the human transporting AGVs is the 2getThere ParkShuttle, which currently carries over 2,400 passengers per day.  In 2017, 2getThere signed a long term agreement with Oceaneering International, parent of dark ride vehicle maker Oceaneering Entertainment Systems, "to collaborate in the design, development and advance of automated people-mover systems serving the US markets and entertainment venues worldwide."  The 2getThere guidance system uses both buried magnets and RFID tags. In 2014 Oceaneering's Advanced Technology Group acquired FROG AGV Systems.  That same year, OES won the 2014 Thea Award  for Breakthrough Technology for it's Dynamic, Tru-Trackless™ ride vehicle system. That is the technology behind the Sea World Antarctica Empire of the Penguin ride system.

Sea World - Empire of the Penguin

Disney has been developing AGV technology for over 40 years and Universal recently dipped its toe in the water with the Kong - Skull Island attraction. Disney AGV systems include Aquatopia, Pooh's Hunny Hunt and Mystic Manor in Tokyo, Ratatouille at Disneyland Paris and Luigi's Rockin' Roadsters at DCA.

One of the primary industrial applications of Free Ranging AGVs has been in maritime container terminals, where they transport cargo from the dock area to conventional over the road trucks. Many of the current AGV Technology vendors have been developing this technology for three decades, so it's natural for their hardware to be tried in themed entertainment.

Port of Rotterdam AGV's

In our story, the free-ranging the AGVs moved in groups thru the themed environment, primarily guided by inertial navigation. Dual encoders on the wheels kept track of distance down the ride path.  Since errors accumulate over time due to wear and slippage, RFID tags embedded in the floor provided dead-reckoning points for positional corrections. Gyroscopes provided vehicle orientation, also called "pose".

Precision of Control

Each vehicle used a PC-based supervisory control system interfacing with subsystems that determined position and propelled the vehicle. Another PLC based controller provided external control of all the vehicles. 

Multiple AGVs moved simultaneously and each one only knew its own position. The supervisory processor communicated wirelessly with each vehicle from the wayside, tracking location and telling the vehicles where and when to go next. This "Mother may I?" approach has been typical of dark ride systems partly because of the need to integrate with existing wayside technology which controls the show.

WinAC RTX F Controller

Prism ultimately transitioned to a faster WinAC controller partly because it was safety rated. This was achieved by using a real-time operating system (RTOS) underlying Windows, which meant that the PLC software was also running on top of Windows, but still in the RTOS kernel.  This allowed separation of communications and errors in the operating system from the operation of the PLC, so if Windows had an fault, the safety code could continue to run. Network communications were also handled outside the operating system, which would also allow communications to continue if one of the other modules failed. This was made possible because multi-threading and memory protection had been developed for inductrial PCs. Processing times were about 20ms per operation, close to what is needed for "frame rate" synchronization.

Software Design

Safety related applications must mitigate all possible contingencies.  Prism chose unified modeling language (UML) which works well for PLC programming, especially when using state machines or sequence diagrams. The development team tried to uncover every possible scenario and response before coding began. This was accomplished with frequent and thorough reviews throughout the development process.

There were four main parts within the software:

· Vehicle interface manager
· Zone manager
· Vehicle manager (vehicle and group)
· Station manager

Each component is a logical section within the same PLC program, but running in protected memory and having segregated duties and communication channels to the other components.

The Vehicle Interface Manager handled all the logic and communications to the vehicles. Communication was wireless and used custom formatted IP packets. Messages were buffered and had extensive error checking. If malformed packets were received, or communications were not timely, the vehicle was stopped. This is another major difference between industrial applications, where the effort is to try to work through faults, and amusement parks where the default error response is a ride or vehicle stop.

The Vehicle Interface Manager was always requesting the vehicle's position. Its PLC queried each vehicle in the fleet, determined where it was, where it needed to be, and then sent commands back. Communication had to be low latency since the vehicle only knew its trajectory for the next block - which was usually about six to eight feet long.

The Vehicle Manager tracked both vehicle groups and individual vehicles and handled all associated functions. Multiple vehicles would travel through the attraction as a single group. Groups also had group-level tasks related to how they acted in each show scene.. Within a group, each vehicle also had different responsibilities and individual vehicles could respond independently.

The Station Manager primarily handled triggered functions (e.g., vehicles advancing, door movements, charging, station gates) but contained the highest level of safety components, such as pressure mats, laser scanners and vision systems, because it was responsible for knowing where people were.

The Zone Manager also kept track of all the vehicles and had all information about each vehicle in the attraction: where it was located, what group it was associated with and what route it was taking. It used this information to zone and block out different routes to make sure vehicles didn't collide with one another.

In amusement park rides (roller coasters, dark rides), zone blocking/protection is one of the oldest ways of maintaining a safe ride environment. It was perfected in the railroad industry and incorporated in Disneyland's Matterhorn Bobsleds by Arrow Development in 1961. Tracks are divided into zones. When vehicle or group moves into a zone it “claims” that zone and no other vehicles can be commanded or allowed to move into it until the block is released.

The Zone Manager is a core element of ride safety. Although not a safety process itself, its algorithms ensure that vehicles never deliberately collide with one another.

These core principles have worked well for over 50 years. What comes next will probably get a boost from the anti-collision technology being developed in the automotive industry, where all the major players are working towards self driving cars. That is built on a very different base than Themed Entertainment, which is more like a choreographed dance of elephants than a sprint to the finish line.

Given the change in philosophy hinted at in new ride systems in which guest input influences the story there are some big and rewarding challenges ahead.

GM Self Driving Car Concept