All UAVs integrate a Flight Control Computer, commonly known as Autopilot. Many would say that is the key piece of equipment to get the best out of your air vehicle. Therefore, during the development of your flight control system it is important to choose the right supplier for the flight control computer or autopilot. There are not so many options in the market, even though you can always start with open source solutions for your demonstrator.
This post is focused on highlighting the information you may need if your unmanned solution aims specific or certified categories. Until now nobody cared about certification, mainly because there were no certification standards released and some functional tests were mainly enough for most national authorities and customers. National and international Aviation Safety Agencies have spent quite a lot of time to come up with reasonable guidelines tailored for this new segment. In the meantime, there were heterogeneous regulations and permission levels all over the world. Most of the medium sized UAV manufacturers using non-safety-critical equipment found just few regions to sell their remotely piloted products. Finally, we can see the light at the end of the tunnel. Now we can find new guidelines and standards are coming in order to guide the UAS design, development, maintenance and operation. Besides, international authorities have stablished
So, what do you need to know to select and integrate a Flight Control System into your certified category or specific category UAS.
First, you need to know what you really need
That is where confusions have arisen. For instance, I have heard many times that for the “Autopilot” is mandatory to be compliant with DO178C/DO254/DO160, which could be part of the story, but not enough. And it seriously depends on the application and the operation context. So, the first question should be “what do you really need?” To answer that question some activities should be performed beforehand, such as a certification plan, concepts of operation, operations risk assessment and a system safety assessment. Only with that information you can know the architecture you need, the reliability requirements of the units involved and the Development Assurance Level of those units, apart from a bunch of requirements and functions that each unit should implement. Only once you have that information you can identify what you are looking for regarding your “Autopilot” as well as the other units that belong to the Flight Control System.
Find the right autopilot supplier
For more than a decade UAVs have been using an embedded computer implementing all the flight control system functions apart from sensor fusion, communications, and air vehicle management. Besides, the flight control SW implemented did not follow any quality process demonstrating that it is bug-free, reliable, and stable. Now, some manufacturers suddenly stated that they recently became compliant with those aviation standards that everyone is seeking. Let’s figure out how much truth is in their words:
- Do they have a quality system? You should expect avionic systems suppliers should be compliant with at least ISO9001 or ISO9100, depending who manufactures their HW. In fact, they do not need to be certified, but ISO9001 is much cheaper to get than DO178C DAL C and would facilitate the implementation of the DO178C.
- Do they have the processes? Development of aviation safety critical electronic units require a minimum a set of procedures, processes, and functions, such as configuration control, change management, requirements management, HW development plan, SW development plan… aligned with aviation standards (ARP4754A) or similar. This is not just to know that what they are supplying is good, it is also because the Autopilot must be customized for your aircraft (always) and they will have to follow al those processes as well as documenting them. You should review and audit those before you start working with them.
- Do they really have the HW/SW datapacks? SW and HW qualification generate a set of deliverables that prove the compliance with the standards and must be demonstrated in front of the authorities. So, you may want to review the datapacks yourself or ask an external specialist to review whether what they promise is true or not.
- Do they have the team? HW and SW qualification requires a large team depending on the Development Assurance Level implemented in the unit. Some manufacturers promise certifiable equipment, while they don’t even have the basis and the team to accomplish the minimum.
- Unit obsolescence. Ask for the obsolescence foreseen for the equipment you are receiving, because you should be expecting to deliver something to your customer that will last at least a decade. Besides, in your agreement they must back your system for life. You should be able to provide replacement when needed to your customer.
- Never, flight control laws are directly tuned while flying. If the supplier promises to tune your aircraft gains while flying,… something is going wrong. If they really comply with the standard processes, they should provide compliance that the flight control laws are verified to be implemented in your aircraft before start flying. They do not need to provide you their algorithms or SW, but to build the evidence that shows compliance with your flying quality requirements. Obviously, you can always start with a demonstrator project for different purposes, but thinking about certification requires a different approach.
- The autopilot does payload and mission management? Non safety critical functions, such as encoding video and moving the payload gimbal are not safety critical functions. If they have these functions inside the same box, they should have a good reason explaining why a failure in that SW/HW section is not going to impact the safety critical part. Qualifying that piece of SW/HW is a waste of time and money, and if safety critical part and non-safety critical part are connected somehow then is because they did not run a proper safety assessment of the system.
- Can you configure the autopilot on your own? If the supplier lets you configure control gains, flight envelope limits or operation limitations, and write your own drivers… Then they should tell you that the unit and SW qualifications would be lost unless you have the proper processes (DO178C) and generate the delta datapack while qualifying that piece of code on your own or run the verification and validation tests as a supplement to the verification phase.
- Environmental qualification. Either MIL-STD-810G or DO160 standards are widely applied in aviation. You should check whether the environmental conditions are compliant with your aircraft required conditions and that the qualification tests are really performed. One thing is what they state and another what they have really tested.
- Testing, testing, and testing. The system you are building suffers several verification stages while is being integrated: unit level testing, system level testing, UAS level testing,… The Unit level verification test plan is part of the initial information you must request when qualifying your supplier’s autopilot. You should observe that the test plan should be customized to your aircraft and system requirements, but if they are “qualified” is because they have gone already through that process. You can request that documentation or part of it for audit.
- Environmental Stress Screening. All electronic units pass through certain specified vibration and temperature cycling tests in order to discard the manufacturing and assembly issues that may reduce its initial reliability below required levels. This is also a plan that you can request for review.
Even though you may have observed that there are many points where you can identify that the potential supplier has not been really honest with you there are others that are really doing their homework. There are other suppliers that are working really hard to provide solutions that will become certifiable by the time the new regulations are released.
Autopilot is not a COTS and never plug&play
An autopilot is a customized solution for your aircraft and the units around it. It is never a plug&play solution or COTS. So, if someone tells you that it will work right away is not being completely honest with you. Besides, customization implies identifying new requirements, performing new tests modifying code (at least), which should follow the processes to keep compliance with DO178C.
Despite that, there are suppliers that offer a great scope of options for customization, which reduces a lot the process, in the end every flight control solution is unique (HW/SW) for each aircraft design.
A certifiable Flight Control System is not cheap
In case you want buy your flight control solution and get it customized, and later integrated, you should know the costs that are reasonable in the market. You may expect a 6 zeros figure for certified category and 5 zeros for specific category. There are details that may change the total amount, but at least you can identify if that is closer to your expectations.
Having said that, following the right approach will reduce the overall development process while avoiding undesired risks. There are currently potential solutions that may reduce a lot the customization and integration costs, but this time from an architecture level. So, if you really want to mitigate risk and money you may seek an iterative-incremental project lifecycle while designing your flight control system following a top-down approach instead of bottom-up.
Integration, verification and validation
You will have to deal with Integration, Verification and Validation. When the different units are acquired the integration and verification process should be performed in a controlled way, performing hardware in the loop simulations for verification purposes at system level. Besides ground and flight-testing activities should be performed to verify and validate that the system behaves properly, specially under failure conditions, degraded modes and contingencies. All these processes and capabilities respond to the “Systems Engineering Master Plan” and “Test and Evaluation Master Plan”, that should comply with aerospace standard requirements. You the aircraft integrator should have all those plans and capabilities implemented before going approaching the final integration stages. In the meantime, if you are not DOA (Design Organization Approval) you should seek that in parallel with you UAV certification process.
As you can see the point of acquiring a certifiable “Autopilot” for your UAV is not as straight forward as buying something that complies with DO178C and DO254, installing it and start flying. It is much more than that, and not having the big picture will certainly lead you to buying expensive piece of electronics and still not being able to certify your UAS. It may not even make it any safer or reliable.
In Abionica Solutions, we have been more than a decade working on flight control solutions for small and large UAVs. We provide systems engineering and flight controls design support for flight control solutions and help our customers find the right flight control unit supplier; specify the customization required; support the integration and verification, and help on the difficult path towards the certification.