University of Toronto Explorer Design Report

Transcription

1 2014 Association of Unmanned Vehicle Systems International Student UAS Competition University of Toronto Aeronautics Team University of Toronto Canada May 28, 2014 University of Toronto Explorer Design Report Abstract This report provides an overview of the UT-X Unmanned Aerial System and the design process leading up to the final product. The operational analysis is first presented, followed by the imposed requirements and the resulting design. The design decisions are driven by the requirements and lead to a Telemaster airframe equipped with a still image target recognition system, and an Pixhawk autopilot capable of completing the mission autonomously.

2 Cover Letter The University of Toronto Aeronautics Team from Toronto, Canada presents the U of T Explorer (UT-X). This system will be used as the competition entry for the AUVSI 2014 Student UAS competition. The team hopes to build upon past success and improve the system through efficient team management and exhaustive testing. UT-X is comprised of both the physical hardware as well as the flight operations crew. The system uses a Senior Telemaster airframe with a modified fuselage and wings to suit our payload needs. The Senior Telemaster has a 91 inch wingspan, a 63 inch fuselage, and a gross nominal weight of 20 lbs. The airframe uses an electric outrunner motor that is powered by three 6 cell Lithium Polymer batteries giving a total endurance of 30 minutes. On board is an Imperx IGV- B6620 digital still image camera that relays data back to the ground control station via a 5.8 GHz Ubiquiti WispStation. Telemetry data and flight commands are communicated to the plane using a 900 MHz Xtend module pair and the safety pilot always has manual override authority through a 433 MHz ezuhf module. The system will be capable of full autonomous flight including autonomous takeoff and landing controlled by the 3DR Pixhawk autopilot. Operations are conducted through a 4 member flight crew, the flight crew as well as their roles are outline in Table 1. Name Title Responsibilities David Koo CCS Operator Planning overall mission and monitoring vehicle performance/status during operation. Oliver Wu Payload Operator Monitoring aerial imagery and target detection. Rikky Duivenvoorden Safety Pilot Manual control of aircraft when necessary. Willian Silva Safety Co-Pilot Flight safety check and communication between pilot and CCS Operator. Table 1: Flight Crew The numerous tests conducted give the team great confidence in the system s ability to successfully perform during the flight demonstration at the 2014 AUVSI SUAS Competition. University of Toronto Aeronautics Team II

3 Contents 1 Systems Engineering Approach Requirements Analysis System Level Requirements Vision Payload Requirements Autopilot Requirements Airframe and Propulsion Requirements Communications Requirements Command and Control Station Requirements Design Rationale Design Process Expected Performance Programmatic Risks and Mitigation Methods System Architecture Vision Payload Subsystem Vision Strategy and Camera Selection System Description Autopilot Subsystem Autopilot Hardware Selection Autopilot Strategy Airframe Subsystem Sizing and Configuration Power & Propulsion Communications Subsystem Safety Pilot RC Link Telemetry Transmission Payload Transmission Command and Control Station Subsystem Mission Control Payload Operation Target Detection Algorithm Safety Pilot Station Testing Evaluation & Results Guidance System Performance Payload System Performance Safety Considerations and Approach Pre-flight Check List Robust Design Safety Pilot Override & Kill Switch Ground Crew Training Risk Management and Mitigation Conclusion 16 6 Acknowledgements 17 University of Toronto Aeronautics Team III

4 1 Systems Engineering Approach This section presents the concept of the University of Toronto Explorer (UT-X) Unmanned Aerial System (UAS). It describes an analysis conducted on the requirements set out by the competition. This is followed by a discussion of the design process and the rationale used in making design decisions. 1.1 Requirements Analysis AUVSI released a Request for Proposal (RFP) to develop a UAS in support of the U.S. Forest Service with intelligence, surveillance and reconnaissance (ISR). The objective of both competitions is to design a low-cost UAS with a Command & Control Station (CCS) capable of providing surveillance information through aerial imagery. The system requirements for the UAS are derived from meeting the primary tasks identified by the competition rules. Additional requirements were imposed by the secondary tasks being attempted: automatic target detection, actionable intelligence, and emergent target. Finally, several more requirements such as weight were imposed by the team vehicle being used in the Unmanned Systems Canada (USC) competition. The most important high level requirements for the system level as well as each subsystem are presented here System Level Requirements 1-1 UT-X shall perform an unrehearsed area search. 1-2 UT-X system shall be capable of manual override by safety pilot. 1-3 UT-X system shall have a flight termination system to safely terminate flight in the event of extended loss of communication with the CCS or kill signal transmission 1-4 UT-X system shall adhere to the flight restrictions imposed by the competition organizers. 1-5 UT-X system shall have a maximum mission time of 30 minutes. 1-6 UT-X system shall have a maximum preparation time of 15 minutes Vision Payload Requirements 2-1 The Vision Payload shall weigh no more than 1.4 kilograms. 2-2 The Vision Payload shall consume no more than 15 watts of average power. 2-3 The Vision Payload shall provide aerial imagery to the Command & Control Station 2-4 Acquired images shall have a resolution no less than 2 inches from an altitude of 500 ft. 2-5 The Vision Payload shall utilize a gimbal to acquire images directly below the vehicle during flight to within 2 degrees. 2-6 The Vision Payload shall associate each acquired image with a GPS coordinate and associated vehicle heading Autopilot Requirements 3-1 The Autopilot shall weigh no more than kilograms. 3-2 The Autopilot shall consume no more than 5 Watts of average power. 3-3 The Autopilot shall report the vehicle attitude, location, altitude and airspeed to the Command & Control Station. 3-4 The Autopilot shall stabilize vehicle attitude to within 2 degrees of commanded values. 3-5 The Autopilot shall measure altitude to within 1 metre. 3-6 The Autopilot shall measure ground location to within 3 metres. 3-7 The Autopilot shall navigate autonomously to waypoints to within 30 metres. 3-8 The Autopilot shall navigate autonomously to flight altitudes to within 15 metres. 3-9 The Autopilot shall maintain commanded airspeeds to within 1 m/s. University of Toronto Aeronautics Team 1

5 3-10 The Autopilot shall navigate the vehicle to remain within assigned boundaries The Autopilot shall return the vehicle home to land after 10 seconds of lost communication The Autopilot shall switch to manual (RC) flight once the override command is given Airframe and Propulsion Requirements 4-1 The Airframe shall have total lifting capability of at least 10 kilograms. 4-2 The Airframe shall have a dead weight less than 7.4 kilograms, which includes structural weight, control surface actuators, propulsion and energy storage. 4-3 The Airframe shall provide the Vision Payload with a clear view of the ground below. 4-4 The Airframe actuators shall consume an average power of no more than 10 watts. 4-5 The Airframe shall have maximum climb rate of at least 3 m/s. 4-6 The Airframe shall have a nominal airspeed of 20 m/s. 4-7 The Airframe shall have an endurance of at least 30 minutes. 4-8 The Airframe shall maintain level flight at an altitude of at least 180 metres. 4-9 The Airframe shall be propelled by battery powered motor Communications Requirements 5-1 The Onboard Communication shall weigh no more than 0.2 kilograms. 5-2 The Onboard Communication shall consume an average power of no more than 15 Watts. 5-3 The Onboard Communication shall radio interface with the Command and Control Station up to a distance of 2 kilometres. 5-4 The Onboard Communication shall consist of low data rate communication for commands, manual override, and telemetry and high data rate communication for imagery. 5-5 Communications shall be performed on unlicensed or HAM operated bands. 5-6 The high data rate link should support the transfer of a 3 MB/s at a range of 1.5 km Command and Control Station Requirements 6-1 The CCS shall transmit waypoint, altitude and airspeed commands to the vehicle. 6-2 The CCS shall display vehicle position attitude, altitude, and airspeed in real time. 6-3 The CCS shall be capable of switching to manual (RC) flight. 6-4 The CCS shall be capable of modifying mission parameters during flight. 6-5 The CCS shall display vehicle position, attitude and airspeed real-time. 6-6 The CCS shall receive aerial imagery from the vision payload 6-7 The CCS shall be capable of geolocating targets of interest in the aerial imagery. 6-8 The CCS shall be capable of autonomous identification of targets in the aerial imagery. 6-9 The CCS shall be controlled by four operators: one for mission control, one for payload control, and two in case of manual RC flight. 1.2 Design Rationale In executing design decisions, the team referred to the requirements contained in our systems document, created to facilitate the decision making process. Each decision was based on a corresponding trade off that would compare the available solutions. The team members responsible for a particular subsystem had to show compliance of their design decisions with each requirements and had to defend their designs during a Preliminary Design Review (PDR), Critical Design Review (CDR) and Final Design Review (FDR). In all three design reviews, members from other divisions of the team and team alumni were present to critique the design. This rigorous process and its results are summarized in each subsystem s corresponding section. 1 Based on sending one high resolution digital image (6 megabytes) every 2 seconds, over the length scale of the AUVSI field. University of Toronto Aeronautics Team 2

6 1.3 Design Process The design approach is a top-down process, building upon the SUAS designed from last year s competition. Figure 1 shows the selected design process and some of the associated tasks for the major subsystems. Preliminary Design involves selection of hardware for each subsystem and executing design decisions based on the aforementioned trade studies. Detailed Design involves the selection low-level components within each subsystem. Finally, validation involves the testing and fine-tuning of each subsystem and integration into the unmanned system. 1.4 Expected Performance Figure 1: Design process work flow The team has performed all flight tests with the flight crew that will be at the competition. A more detailed discussion testing can be found in Section 3. The rigorous testing of UT-X has confirmed that the system will be able to achieve the Threshold and Objective for the tasks outlined in Table 2. Time and resource constraints were the key factor in determining which secondary tasks could not be attempted. Level Task Attempt Threshold Objective Primary Autonomous Flight Primary Search Area Secondary Automatic Target Detection Secondary Actionable Intelligence Secondary Off-Axis Target Secondary Emergent Target Secondary SRIC Secondary Interoperability Secondary IR Search Secondary Air Drop Table 2: Expected Mission Performance University of Toronto Aeronautics Team 3

7 1.5 Programmatic Risks and Mitigation Methods All mission saftey risks and mitigation methods are discussed in detail in Section System Architecture This section shows the detailed system architecture, the components that make up each subsystem and the interaction between subsystems. The five major subsystems are shown: Vision Payload, Communications, Command & Control Station (CCS), Autopilot and Airframe & Propulsion. These subsystems and the overall system architecture are presented in a System Block Diagram in Figure 2. The System Block Diagram (SBD) details the data and command interfaces but does not display mechanical or electrical interfaces. Figure 2: System Block Diagram University of Toronto Aeronautics Team 4

8 2.1 Vision Payload Subsystem Design decisions and specifications are presented for the Vision Payload subsystem to satisfy requirements in Section Vision Strategy and Camera Selection Experience at the last year s USC competition showed that analog video cameras were subject to lossy transmission and low resolution. A single high resolution digital camera was found to be the best choice. Following this strategy, several DSLR cameras were evaluated as possible hardware solutions, shown in Table 3. The Imperx IGV-B6620 with Nikon Normal AF Nikkor 50mm f/1.8d Autofocus Lens was chosen as the best solution, as it is compact and light while providing high image quality, as can be seen in Figure 3. Bobcat IGV-B6620 Camera with Nikon AF Nikkor 50mm f/1.8 Lens Genie TS-C4096 Camera with S-M-C/Super Takumar 28mm F3.5 Nikon D600 Camera with 24-85mm F G ED VR Lens Camera Type Industrial dslr Industrial dslr Professional dslr Image sensor dimensions (mm) x x x 24 Effective Pixels 29MP (6600 x 4400 ) 12MP (4096 x 3072) 24.3MP (6016 x 4016) Cost (CAD $) 0 (Sponsored) 0 (Sponsored) 2700 Mass (lbs) Volume (in 3 ) Table 3: Camera Comparison for Vision Figure 3: IGV-B6620 and an image taken from last year System Description Following the design decisions made previously, the UT-X Vision Payload consists of the camera pointed inertially down and actively stabilized by a custom made gimbal. This imaging solution provides a 390 ft field of view with 0.71in/pixel ground sampling from a 500 ft altitude, which is required to identify target characteristics. The gimbal is servo operated with stabilization inputs provided from the autopilot to point inertially downwards during flight. The camera is interfaced through a computer, the Odroid U2. The Odroid is a low-power, compact, quad-core computer with ARM processor architecture, making it well-suited for UAS applications. The Odroid is interfaces with the camera through the use of the ARAVIS open source Geniecam library to send software triggers and acquire images. The Odroid then performs jpeg University of Toronto Aeronautics Team 5

9 compression of the image to make the image file a suitable size for transmission. The Odroid also has a connection with the autopilot GPS unit and is able to associate each aerial image with a GPS coordinate, altitude reading, and heading. Finally, it uses the payload communications radio, which transmits the imagery to the CCS. 2.2 Autopilot Subsystem Design decisions and specifications are presented for the Autopilot subsystem to satisfy requirements in Section Autopilot Hardware Selection Table 4 shows an analysis of autopilot hardware alternatives. Autopilots from 3D Robotics are well-suited as they are open source, and provide a good compromise between affordability and processing power. While the previously used APM 1 was suitable for the needs of this year s competition, the Pixhawk was chosen as an upgrade because it provides an independent processor and power line for RC override, adding an additional level of safety. HKPilot Mega 2.5 APM 2.6 3DR Pixhawk Cost (CAD $) Processor 8 bit ATMega MHz 8 bit ATMega2560,16 MHz 32 bit ARM Cortex M4 Processor, 168 MHz Memory 256 KB, 4 MB Flash 256 KB, 4 MB Flash 256 KB RAM, 2 MB Flash Sensors Rate Gyro Accelerometer, Altimeter, Magnetometer, Airspeed GPS (5 Hz), Rate Gyro Accelerometer, Altimeter, Magnetometer, Airspeed GPS, Rate Gyro, Accelerometer, Altimeter, Magnetometer, Airspeed Inputs/Outputs 8 Digital, 12 Analog, 14 PWM/Servo Outputs, 8 Digital, 12 Analog microusb UART, microusb Mass (g) Autopilot Strategy Table 4: Tradeoffs for Autopilot Architecture The 3DR Pixhawk autopilot comes equipped with an onboard 6 DoF IMU, 3 DoF gyroscope, 3 DoF accelerometer, magnetometer and high rate GPS. It provides capability for automatic takeoff, automatic landing, and waypoint guided autonomous flight. It receives a PPM signal input from the RC controller for manual override and flight. The lawnmower pattern search is chosen as the guidance strategy to survey the airfield primarily due to its ease of implementation. This search pattern provides an advantage to the airframe, autopilot and vision systems as the majority of the flight path consists of straight line flying. Waypoints can be added to the mission to search for emergent targets. The autopilot is monitored and controlled on the CCS using the open source Mission Planner software. A screenshot and an example of the search plan from last year s competition is shown in Figure Airframe Subsystem Design decisions and specifications are presented for the Airframe subsystem to satisfy requirements in Section Sizing and Configuration The preferred option for airframe was an an off the shelf Senior Telemaster airframe. Additional reinforcement is added to the wing structure and the fuselage is modified to fit the required payload. Table 5 shows the airframe specifications. This airframe has extensive flight heritage in UAV flight, which provided strong motivation to use it for this year s competition. Figure 5 shows the Telemaster airframe taking off. University of Toronto Aeronautics Team 6

10 Figure 4: Mission Planner and Example Flight Plan Wing Span Wing Area Fuselage Length Fuselage Width Empty Weight Payload Weight MTOW 94 in sq.in. 64 in. 5 in. 19 lbs 3 lbs 22 lbs Table 5: Airframe Specifications for the Senior Telemaster Power & Propulsion Using flight test data on a similar airframe along with theoretical predictions, the team estimated the airframe drag coefficient to be 0.2. To overcome this drag and adhere to the climb requirements previously set it was determined that the motor had to provide a total static thrust of 12 lbs, and a dynamic thrust of 7.7 lbs at the 39 knot cruise speed. The team also determined it would be favourable to use an electric motor instead of internal combustion to mitigate vibration. Additional requirements were set on the batteries used to allow for the total required flight time. Using MotoCalc, the optimal motor, propeller, battery combination was found to have the specifications shown in Table 6. The NTM Prop Drive Motor was chosen in combination with three Turnigy 6s 5000mAh LiPo batteries. The Turnigy 16x10 cherokee wood propeller was found to be the most efficient. Motor RPM/V Max Current (A) No Load Current (A) No Load Resistance (mω) Battery Voltage (V) Current (A) Propeller Diameter (in) Pitch (in) Table 6: Power & propulsion desired specifications 2.4 Communications Subsystem Design decisions and specifications are presented for the Communication subsystem to satisfy requirements in Section UT-X requires three wireless communications channels: safety pilot override, telemetry link to the autopilot, and payload data transmission. Each piece of communications hardware was chosen to meet the range requirements and preference was given to systems with flight heritage. Table 7 summarizes the communications hardware. University of Toronto Aeronautics Team 7

11 Figure 5: Modified Senior Telemaster on the runway RC Control Telemetry Payload Operating Frequency 433 MHz 900 MHz 5.8 GHz Max Effective Range 27 mi 40 mi 0.8 mi Transmit Power 28 dbm 1W 23 dbm Onboard Weight 4.2 oz. 0.6 oz oz. Table 7: Communications Summary Safety Pilot RC Link The safety pilot transmission system will use the Immersion RC EzUHF system operating at 433 MHz. EzUHF provides very high transmission power for devices of this type, making it an extremely reliable choice for this competition. The main advantage of this frequency band is to avoid interference with the commonly used 2.4 GHz brand. EzUHF enters a failsafe mode to be entered in the event of transmission loss, which will take over autopilot control and command the vehicle to mission termination. The receiver is capable of outputting a PPM control signal, making it compatible for operation with the Pixhawk Autopilot Telemetry Transmission The low-rate transmission will use the 900 MHz frequency band with UART protocol to interface with peripheral equipment and use an omnidirectional antenna. The Xtend from Digi International Ltd. was chosen to be the transmission equipment for its superior transmission range and low power current draw Payload Transmission From the available unlicensed frequencies that can support the required data rate, the 5.8 GHz frequency band was chosen to avoid interference with equipment at 2.4 GHz. The Ubiquiti WispStation M5 was chosen as it provides a major competitive advantage over other alternatives. Its high power allows for weak signals to transmit information. On the ground station, a Rocket M5 with a 10 dbi omni directional antenna was chosen. While directional antennas are available with up to 27 dbi gain, they are difficult to point reliably at the UAV during flight. This combination of hardware is capable of providing at least 36 Mbps at a distance of just under 1 mile, which translates to roughly 18 megabytes every 4 seconds. This is sufficient to transmit the high resolution aerial imagery at the same rate that it is acquired. University of Toronto Aeronautics Team 8

12 2.5 Command and Control Station Subsystem Design decisions and specifications are presented for the Command & Control Station subsystem (CCS) to satisfy requirements in Section The CCS subsystem is composed of the safety pilot station and two computer stations, one for autopilot control and one for payload operation Mission Control The Mission Control station of the CCS adds the operator input into the UAV control through the assignment of waypoints to completing the objectives of the competition. This is done using the Mission Planner software which is developed open source by 3D Robotics. This software displays real time updates of vehicle health, speed, position, and altitude to the operator during flight. This software also allows the operator to re-task the plane during a mission by sending waypoint commands or changing a search area boundary. A screenshot of the software is shown in Figure 4. Prior to attempting a mission, the flight crew will develop a comprehensive mission plan Payload Operation The Payload Control station of the CCS controls the vision payload on UT-X using a custom developed software. This software interfaces with the onboard computing on the Vision Payload to download and display images to the payload operator. It allows the operator to zoom into the picture and identify targets of interest in the imagery. A screenshot is shown in Figure 6. Figure 6: Payload control software user interface Target Detection Algorithm The payload software also integrates an detection algorithm that is able to automatically detect, recognize, and locate targets following the AUVSI format. This algorithm was developed in-house, making extensive use of the OpenCV library as well as MATLAB. The full image is first transferred to from the RGB colour space to the HSV colour space. To distinguish colourful objects from the background, an image histogram is computed on the hue intensities of the resulting image. The peak hue value is identified as the background intensity and subtracted from the hue image. A threshold is then applied to create a binary image of distinct objects. Blobs or clusters of connected University of Toronto Aeronautics Team 9

13 Figure 7: Finding targets on a test image pixels are then identified on this image. Blobs meeting basic size and shape criteria are considered potential targets. Figure 7 shows this process. Afterwards, each potential target image is extracted and converted to an LAB colour space. Disregarding the light (L) component, a K-means clustering is applied to the pixel A and B values to identify groups of similar colors. Using this clustering, the image should be segmented into three main regions - a letter, a shape, and the background. Any potential target not meeting this criteria is disregarded. A sobel edge method is applied to extract the boundary points and tangent angles of the shape and letters. For both sets of boundary points, a collection of shape contexts are computed. The shape context is a rotation and scale invariant rich shape descriptor introduced for character recognition by Belongie et al.[1]. The shape context computed is compared to a database of computed shape contexts for polygons, numbers, and letters to identify the target characteristics. The target is geolocated using the GPS tag on the image and its pixel location relative to the image center. Figure 8 illustrates the progression from target image to shape boundary. Figure 8: Identifying target characteristics on test image Safety Pilot Station The safety pilot and co-pilot are stationed at the take-off location to maintain visual contact with the aircraft. The safety co-pilot is given a 2-way radio to communicate with the ground control station operator and a RC transmitter in the event a manual override is required. University of Toronto Aeronautics Team 10

14 3 Testing Evaluation & Results The system was verified through a series of tests that were conducted in five phases, as shown in Table 8. Each testing phase had a series of objectives. The first three phases of the system testing have proven to be very successful showing the functionality of each component as expected including link ranges, payload image resolution, and ground control station software stability. The final two phases of testing are an on-going process in that they are constantly being used to improve the system. With every additional mission the team performs the data is used to augment autopilot performance, payload performance and the overall process when conducting a mission. The numerous flight tests the team has currently performed give the team great confidence in the ability of the system to meet all objective requirements. Test Phase I: Subsystem tests Determine if each subsystem performs as specified Ensure acquired hardware is functional Test Phase II: Integration tests Ensure all subsystems function together as expected on the ground Verify functionality of image processing and payload control software Test Phase III: Mission Rehearsal & Airworthiness Simulate mission with full flight crew to rehearse operation Determine the takeoff and landing speeds and distances required Determine the maximum range and endurance, and the corresponding flight speeds Determine the optimum CG location and required aircraft trims Test Phase IV: Communications and Autopilot Performance Test the ground control station and communication link Tune the autopilot control loops Check that the autopilot can maintain steady flight Verify all failsafe functions Test Phase V: Payload Data Quality & Full Mission tests Determine the quality of the images obtained by the payload Verify accuracy of target geolocation Verify the performance of the camera stabilization system Review mission procedures and check lists, ensure proper training of flight crew 3.1 Guidance System Performance Table 8: Testing of the UT-X System Extensive Phase IV flight testing took place at a RC flying airfield close to the University of Toronto. Attitude control loops for the autopilot were tuned mid flight to ensure that the aircraft could maintain level flight. Afterwards, an arbitrary set of waypoints were set around the field to test that the aircraft could navigate its way through the points within a tolerable turning radius. Figure 9 shows the path of the aircraft recorded in the telemetry log of the autopilot. The plane can clearly be seen to navigate a snake pattern across the airfield, with slight overshoot in its cornering. Due to the small size of the RC airfield, the communications links were not tested to their full extent here. However, experience at previous year s USC competition in Alma, Quebec, showed that both the telemetry and safety pilot transmission links functioned well at distances of up to 3 km. 3.2 Payload System Performance Additional testing took place to tune the camera settings such as exposure time and aperture to ensure that the image quality was sufficient to distinguish target details. Due to the constant University of Toronto Aeronautics Team 11

15 Figure 9: Telemaster GPS path while flying a waypoint guided lawnmower search motion of the aircraft, the exposure time is set very low and consequently aperture is set fairly high. To test the quality, several targets were made out of 2ft x 2ft squares of wood and placed around the RC airfield. Various letters were drawn on the targets and the location of each target was recorded. The aircraft was then tasked to fly over these areas and attempt to photograph the targets. Figure 10 shows an aerial photograph of a blue four placed on a green wood square. The photograph shows excellent resolution for distinguishing the target shape and alphanumeric. In addition, the onboard GPS unit correctly associated the image with latitude and longitude coordinates of , Figure 10: Aerial imagery taken during test flight University of Toronto Aeronautics Team 12

16 4 Safety Considerations and Approach At its maximum flying weight of 22 lbs and cruise speed of 40 knots, the UT-X aircraft has enough potential energy to cause serious injury or property damage. This energy combined with a rapidly spinning propeller and highly-combustible lithium-polymer batteries requires that operational safety be the highest priority for the team. The UT-X safety plan consists of four elements: pre-flight checklist, robust design, safety-pilot override, and ground crew training. 4.1 Pre-flight Check List The cornerstone of the UT-X system safety plan is a pre-flight checklist, which has been developed and expanded throughout flight testing to create a comprehensive set of checks. These include verification of the autopilot, sensors, CCS, communication links, propulsion systems, control surfaces, center of gravity, mechanical and electrical connections, and weather conditions. 4.2 Robust Design The UT-X system design includes several safety features. The propulsion battery voltage is monitored in real-time via the telemetry link, and the avionics battery has been sized to provide over 3 times the necessary capacity for the maximum endurance. In addition, communication equipment has been designed to have large frequency separation. All electrical connectors are positively restrained and use shielded cables, and the avionics are held in RFI/EMI shielded enclosures. 4.3 Safety Pilot Override & Kill Switch At any point during a flight, the safety-pilot can take over manual control of the aircraft using a dedicated switch on his RC transmitter. This override function is implemented using a hardware multiplexer on the Pixhawk autopilot, so it is entirely independent of the autopilot software. In addition, the RC transmitter has a programmable failsafe function that is triggered when the RC link is lost, and this has been programmed to turn off the motor and put the airplane in a spiral dive. 4.4 Ground Crew Training Before each flight, all flight crew members are briefed on the flight objectives, flight path, altitudes, take-off and landing locations, and duration. During take-off and landing, the CCS Operator calls out the airspeeds for the safety pilot. The co-pilot is responsible for making the pilot aware of any obstacles on the ground. When the aircraft is within visual range, the safety pilot has full discretion to take over control whenever the aircraft is not behaving as expected. When the aircraft travels out of visual range the pilot will notify the CCS Operator, who will then begin to communicate the position and state of the aircraft to the pilot at regular intervals. The CCS Operator is also responsible for commanding use of the kill switch if needed. 4.5 Risk Management and Mitigation The team has identified the most prominent single-point failures in each of the subsystems, and decided on the appropriate response actions in each case. These are listed in Table 9 and all flight crew members have been briefed on this information. Three outcomes have been identified for the failure cases: Mission Continues Mission Failure, aircraft recoverable Mission Abort, Catastrophic University of Toronto Aeronautics Team 13

17 The kill switch flight termination function is the key component of the risk management strategy, as it is the last resort for bringing the aircraft down within the flight boundary, when controlled flight is no longer possible. Triggering the kill switch will always result in a catastrophic failure, but this is a safer and more acceptable outcome than the alternative scenario of an uncontrolled fly-away. Use of the kill switch is delegated to the safety-pilot when the aircraft is within visual range and to the GCS Operator when the aircraft is outside of visual range. The visual range boundary is defined as the maximum distance at which the pilot can see the aircraft position, orientation, and heading. This is an important boundary because it can mean the difference between a recoverable failure and a catastrophic one. For example, failure of the 900 MHz telemetry link within visual range is a recoverable failure since the safety pilot can take over, but outside of visual range such a failure would justify use of the kill switch because there is no longer any visual or radio contact with the aircraft. These single point failures along with other project risks have been classified in a risk matrix to make the team more aware of the known risks. The risk matrix follows a 5 point grading scale for likelihood and consequence, with 5 in either category being a worst case scenario. These risks fall under one of three profiles based on their summed score in the two categories, denoted as Score in the table below. In Table 9 the colour coding of the item number corresponds to the risk s profile in our risk matrix. Low likelihood, low consequence Score 4 Low likelihood, high consequence or vice versa 4<Score 7 High likelihood, high consequence Score>7 Accept, risk is accepted by the team and no further action is required. Monitor, risk must be continuously monitored to potentially degrade or augment rating. Action required, some system change must be realized to reduce this risk. University of Toronto Aeronautics Team 14

18 # Failure Mode Possible Causes Ground Crew Response Consequence Autopilot software failure Autopilot hardware failure Loss of autopilot communication link Software bug Accelerometer, GPS, gyroscope, airspeed, or pressure-altitude sensor failure Electronics failure Power loss 900 MHz link equipment failure RF interference Manual control will still function, so the safety pilot will take control and land the aircraft at the predetermined landing area or a safe alternate site. If within visual range and manual control is functional, the safety pilot will land the aircraft. If outside of visual range or manual control is not functional, the safety pilot will trigger the Kill Switch to terminate the flight. If within visual range, the safety pilot will take control. If link is regained the mission can resume. If within visual range, the safety pilot will take control. If link is not regained the safety pilot will land the aircraft. If outside of visual range, the Kill Switch will be triggered to terminate the flight. Mission failure, aircraft recoverable Mission failure, aircraft recoverable Catastrophic Mission continues Mission failure, aircraft recoverable Catastrophic Loss of manual RC control link Ground control station failure Propulsion system failure or degradation Control surface failure or degradation Transmitter/receiver failure Out of RC radio range RF interference Software failure Operating system crash Power loss Motor failure ESC failure Propeller failure Low battery power Servo motor failure Servo arm linkage mechanism failure Control surface structural failure The Kill Switch will trigger automatically when the RC link is lost, and this will terminate the flight. If within visual range, the safety pilot will take control and land the aircraft. If outside of visual range, the Kill Switch will be triggered to terminate the flight. If possible, the safety pilot will land the aircraft at the landing area or a safe alternate site. Otherwise, the Kill Switch will be triggered at a safe distance from the ground crew and bystanders. If possible, the safety pilot will land the aircraft at the landing area or a safe alternate site. Otherwise, the Kill Switch will be triggered at a safe distance from the ground crew and bystanders. Catastrophic Mission failure, aircraft recoverable Catastrophic Mission failure, aircraft recoverable Catastrophic Mission failure, aircraft recoverable Catastrophic University of Toronto Aeronautics Team 15

19 8 Payload sensor failure 9.1 Loss of payload communication link Severe weather Abrupt encounter with another aircraft Complete loss of control of the aircraft: Fly-away Payload camera failure Camera gimbal failure Video transmission equipment failure Tracking antenna mechanism failure RF interference Weather conditions outside the operating envelope A low-flying aircraft enters the flight area Failure of two or more of the following critical systems: autopilot hardware, RC control, propulsion, control surfaces. If within visual range, the safety pilot will take control and land the aircraft. If outside of visual range, the GCS Operator will issue a return-to-home command, and the safety pilot will take over when the aircraft is in visual range. If link is regained the mission can resume. If the link is not regained, the safety pilot will land the aircraft. The safety pilot will take control and land the aircraft at the predetermined landing site or at a safe alternate site. All other aircraft have the right of way. The safety pilot will take control and perform avoidance maneuvers. The aircraft will be landed at the predetermined landing area or at an alternate site as soon as it is safe to do so. The Kill Switch will be triggered to terminate the flight. If the aircraft is not responsive to the Kill Switch, the GCS Operator will note the last know position and heading and report the it to the competition organizers, local authorities, and air traffic control. Mission failure, aircraft recoverable Mission continues Mission failure, aircraft recoverable Mission failure, aircraft recoverable Mission failure, aircraft recoverable Catastrophic Table 9: Single point failure and risk classification. Item number color coding indicates risk profile. 5 Conclusion UT-X is a unique system the aims to complete the mission tasks using the highest level of flight autonomy. This system is complimented by a custom built software suite for payload operation and mission proven ground control software. The system uses a high end industrial camera for payload to minimize area search time, while on ground algorithms automatically process the images to detect targets. The system and its individual subsystems have gone through an exhaustive 5 phase testing process to ensure the system will meet all Threshold and Objective requirements for all primary mission tasks. The system has also undergone testing to ensure that it will achieve several of the secondary tasks which include automatic target detection, actionable intelligence, and emergent targets. Extensive risk analysis and safety precautions ensure a high likelihood of success and the safety of the system operators as well as competition attendees. University of Toronto Aeronautics Team 16

20 References [1] J. Malik S. Belongie and J. Puzincha. Shape matching and object recognition using shape contexts. April Acknowledgements The team would like to thank the numerous sponsors, and alumni/industry advisors that made this project possible. University of Toronto Aeronautics Team 17