*2.1. HexaMRL*

As shown in Figure 1 the HexaMRL is designed to execute repetitive soft-landing and roving for lunar exploration. Its size is about 1.35 m long, 0.94 m wide and 0.75 m high; it weighs 60 kg, including a 20 kg aluminum shell. The robot consists of a body and six identical legs. Each leg is composed of side IDU, thigh IDU, shank IDU, thigh, rocker, connecting link, sole and shank. All legs are connected to the body that carries the controller, inertial measurement unit (IMU), power system, sensing system, payloads, etc.

**Figure 1.** The six-legged movable and repetitive lander (HexaMRL).

The leg distribution design needs to meet landing and roving functions simultaneously. On the one hand, to withstand the impact force uniformly during buffer landing, all legs are arranged as an equilateral polygon like a regular triangle in Surveyor-1 [2] or Square in Apollo program [3] and Chang'e series [4,6,28]. As for the six-legged lander, the angular interval between adjacent legs should be 60◦. On the other hand, to achieve quick locomotion, all legs will be laid out in a slender shape as in animals like the cheetah, lion or goat, like the hexapod robot RHex [29] or TUM-walking machine [30]. Eventually, as illustrated in Figure 2, the angle between leg 2 and leg 3 is designed to be 54.2◦. Leg 1 (or 2) and leg 5 (or 4) are symmetric about axis-*x*, while leg 1 (or 5) and leg 2 (or 4) are symmetric about axis-*y*.

**Figure 2.** The leg distribution of HexaMRL.

#### *2.2. Leg Mechanism*

The leg mechanism is presented in Figure 3. It has three active DoFs that are actuated by side IDU, thigh IDU and shank IDU to control the mobility of the rocker, thigh and shank, respectively. Let *q* = *αβγ <sup>T</sup>* denote the generalized coordinate vector where *α*, *β* and *γ* are the joint angles of the side, thigh and shank, respectively. The tiptoe position *Ptip* in the leg coordinate frame can be obtained as follows:

$$P\_{tip} = \begin{bmatrix} l\_t \cos \beta + l\_s \cos \gamma \\ \cos a (l\_t \sin \beta + l\_s \sin \gamma) \\ \sin a (l\_t \sin \beta + l\_s \sin \gamma) \end{bmatrix} \tag{1}$$

where *lt* and *ls* are the length of the thigh and shank, separately.

**Figure 3.** The leg mechanism.

The IDU consists of an encoder, servo motor, torque sensor, harmonic reducer, shell, coupler, bearing, etc. During buffer landing, each IDU imitates the dynamic characters of

an active torsion spring and an active torsion damper by the impedance control method, whose control rule can be written as follows:

$$
\pi\_{\rm act} - \pi\_{\rm des} = K\_a(\varphi\_{\rm des} - \varphi\_{\rm act}) + B\_a(\dot{\varphi}\_{\rm des} - \dot{\varphi}\_{\rm act}) \tag{2}
$$

where *τact* and *τdes* are the actual torque and desired torque of IDU, *Ka* and *Ba* are the coefficients of stiffness and damping of active compliance, *ϕdes* and *ϕact* are the desired angle and actual angle of the active joint, . *<sup>ϕ</sup>des* and . *ϕact* are corresponding angular velocity.

#### *2.3. Leg Residual Capacity*

In order to reduce the rocket size, all legs need folding, as in Figure 4a, for compact volume when launched from Earth. Before the buffer landing on the moon, all legs need to deploy from the folded state, as in Figure 4b, to obtain better supporting stability and a larger buffer stroke. Since the mobility demand before and after the deploying task is not the same, the fault-tolerant landing capacity is significantly different as well.

**Figure 4.** Leg function. (**a**) folding; (**b**) deploying.

Here, because the capacities of fault-tolerant are different, we use LB and LA to distinguish the time of fault occurrence on side IDU before and after deploying operation. On the contrary, as for the thigh or shank IDU, distinguishing separate failure times is unnecessary due to them having the same capacities. The normal IDU of the thigh or shank is denoted by N, while the failed IDU is represented by L. When some IDUs are failed, the residual workspaces are illustrated in Figure 5. There are four cases when one IDU fails. Firstly, if the side IDU fails after deploying, and the other two IDUs are normal, this case can be denoted by LANN. Its residual workspace is the purple vertical plane, and the mobility character is expressed as *GI I F* 0, *Rβ*, 0; *Ta*, 0, 0 by *Gf* theory [31]. Where *R<sup>β</sup>* and *Ta* are the swing movement and the stretching/shrinking movement in the leg sagittal plane. Secondly, if the side IDU fails before deploying and the other two IDUs are normal, denoted by LBNN, the residual workspace is the blue horizontal plane, and the mobility character is expressed as *GI I F* 0, *Rβ*, 0; *Ta*, 0, 0 . Thirdly, if the thigh IDU fails, denoted by NLN, the residual workspace is the red surface, and the mobility character is expressed as *GI I F Rα*, *Rβ*, 0; 0, 0, 0 where *Rα* is the abduction/adduction movement. Lastly, if the shank IDU fails, denoted by NNL, the residual workspace is the green surface, and the mobility character is expressed as *GI I F Rα*, *Rβ*, 0; 0, 0, 0 . There are five cases if two IDUs fail, separately denoted by LBNL, LBLN, NLL, LANL and LALN. Their residual workspaces are the dotted curves of green, blue, red, black and purple; their corresponding mobility characters are expressed as *GI I F* 0, *Rβ*, 0; 0, 0, 0 or *GI I <sup>F</sup>* (*Rα*, 0, 0; 0, 0, 0). There are two cases if all three IDUs fail, denoted by LBLL and LALL; their residual workspaces are a fixed point of black and red while the mobility characters are *G<sup>I</sup> <sup>F</sup>*(0, 0, 0; 0, 0, 0).

**Figure 5.** The leg residual workspace. (**a**) One fault; (**b**) two or three faults.

Noticeably, the lander must possess the up/down movement character during the buffer landing period. Therefore, only the fault case LANN satisfies the mobility demand and has the fault-tolerant landing capacity, further symbolized as E11. The other three cases with one fault don't have fault-tolerant landing capacity and are symbolized as E12, uniformly. All cases with two or three faults cannot finish fault-tolerant landing, so the fault time before or after deploying operation will not be distinguished, and the symbol LA or LB will be replaced by L. Finally, the two faulted IDUs cases are denoted as E2, while the three faulted IDUs case is written as E3. The detailed fault-tolerant capacity of the leg is shown in Table 1.


**Table 1.** Fault-tolerant capacity of single leg.

#### **3. Landing Configuration Analysis**

When more than one IDU fails, different legs may be involved, and their spatial distribution will affect the landing performance. The landing performance will be determined by the configuration that consists of the supporting polygon of the foothold of the remaining normal legs and the position of the lander's center of mass. The stabilities in landing configurations are different, and we systematically assess this by the dimensionless index *SAI*. Then, we establish a synthesis equation to deduce all possible configurations under a certain number of failed IDUs.

#### *3.1. Classification*

Specifically, we need to consider the equivalent leg when the landing configurations are analyzed. As shown in Figure 2, all legs have different effects on landing performance because their interval angles are not equal to 60◦. However, legs 1, 2, 4 and 5 are a group of equivalent legs while legs 3 and 6 are the other group, and the influence of equivalent legs on landing performance is the same.

Noticeably, there are three basic properties for landing configuration. (1) The landing performance is different if the landing configuration is different. (2) The configuration is the same if one equivalent leg fails, e.g., leg 1 or 2 failed. (3) If configuration 1 coincides with configuration 2 after rotation and symmetry operations, the two configurations are considered the same, e.g., legs 1 and 3 or legs 3 and 6.

The classification of landing configuration is shown in Figure 6. The red point denotes the center of mass, while the purple points express the footholds. The solid purple lines illustrate the leg position, while the blue dotted lines show the body contour. The supporting polygon constructed by the footholds of remaining normal legs is denoted by the green plane. The relationship between the normal supporting leg and landing configuration is illustrated in Table 2. As for six-legged landing, there is only one configuration (C6 <sup>6</sup> = 1) called VI-1. As for five-legged landing, there are six configurations (C<sup>5</sup> <sup>6</sup> = 6) that are further divided into two groups: V-1 includes supporting leg 2-3-4-5-6, 1-3-4-5-6, 1-2-3-5-6 and 1-2-3-4-6; V-2 consists of supporting leg 1-2-4-5-6 and 1-2-3-4-5. As for four-legged landing, there are fifteen configurations (C4 <sup>6</sup> = 15) that are detailly classified into six groups: IV-1 includes supporting leg 3-4-5-6 and 1-2-3-6; IV-2 includes supporting leg 2-4-5-6, 1-3-4-5, 1- 2-4-6 and 1-2-3-5; IV-3 includes supporting leg 2-3-5-6 and 1-3-4-6; IV-4 includes supporting leg 2-3-4-6 and 1-3-5-6; IV-5 includes supporting leg 2-3-4-5, 1-4-5-6 and 1-2-5-6; IV-6 includes supporting leg 1-2-4-5. As for three-legged landing, there are twenty configurations (C3 <sup>6</sup> = 20) categorized in six groups: III-1 includes supporting leg 1-2-3, 1-2-6, 3-4-5 and 4-5-6; III-2 includes supporting leg 1-2-4, 1-2-5, 1-4-5 and 2-4-5; III-3 includes supporting leg 1-3-4, 1-4-6, 2-3-5 and 2-5-6; III-4 includes supporting leg 1-3-5 and 2-4-6; III-5 includes supporting leg 1-3-6, 2-3-6, 3-4-6 and 3-5-6; III-6 includes supporting leg 2-3-4 and 1-5-6. Here, the analysis of configuration consisting of one or two legs is omitted because the lander cannot finish a fault-tolerant landing.

**Figure 6.** Classification of landing configuration.


**Table 2.** Analysis table of landing configuration under fault combinations.
