I am the US rep for MicroPilot and market their autopilots to US UAV customers. I have permission from MicroPilot to re-print a white paper they have on their website titled “MP21283x MicroPilot’s Triple Redundant UAV Autopilot” authored by Sarah Vallely in 2010. I think this white paper is more relevant today as the defense and commercial markets are trying to improve UAV reliability when flying in extreme environments in theater as well as in civilian airspace.
MP21283x MicroPilot’s Triple Redundant UAV Autopilot
Triple redundancy (3X) gives autopilot technology the reliability necessary to safely carry out sensitive flight missions and transport valuable payloads. A triple redundant arrangement is comprised of three similar software and hardware systems. If any one of the three systems fails, the remaining two take over, offering a double redundancy arrangement. If one of the other two systems should fail, the third takes over. An additional mechanism is also included to oversee these three systems. Triple redundant systems are highly tolerant of autopilot hardware failures.
Triple redundant autopilots are not new. Military aircrafts such as the RAF’s Trident fleet, used a triple redundant autoland systems in the early 1960’s. Ten years later, the Aérospatiale-BAC Concorde took advantage of 3X technology in its flight control system. Presently, triple redundancy is used in several manned military and commercial aircrafts.
Although 3X technology is established within the aviation industry, triple redundant autopilots are a relatively new addition to unmanned areal vehicles (UAVs). MicroPilot, the leading UAV autopilot manufacturer, is setting the benchmark for triple redundancy UAV autopilots. MicroPilot, based in Manitoba, Canada, has been designing autopilots for fixed-wing, transitional and helicopter UAVs since 1994. In 2006 MicroPilot started designing a triple redundancy autopilot for heli and fixed wing UAVs. The MP21283x product will launch September 2010.
The MP21283x is comprised of three of MicroPilot’s MP21283g autopilots, mounted on an adapter board, or redundancy board. The three MP2128 g’s are prioritized. At the start, the autopilot in position one flies the airframe. If this autopilot should fail, the MP2128 g in position two takes over, and so on. The redundancy board provides several input/output (I/O) ports. The board also includes two RS232 serial ports designed to communicate with a ground control system via radio modems. As a result of this design, users never need to work directly with bare circuit boards. Additionally, the autopilots do not have individual casing, keeping overall weight to a bare minimum. However, the entire redundancy board is enclosed to protect the system.
This white paper covers the benefits of the triple redundant MP21283x and what specific conditions this autopilot is designed for. Features of the MP21283x will also be explained, including multiple communication links, backup high current drivers, backup power supplies, and independently generated servo signals. Synchronization, modification and testing products will be discussed as well.
Who Needs the MP21283x
Any flight mission that cannot be recovered with the implementation of a flight termination system benefits from triple redundancy. A UAV that comes down over a forest or ocean, for example, is difficult to recover. It is also good judgment to install 3X technology in a UAV that flies over built-up and environmentally sensitive geographic areas.
Additionally, when flying expensive airframes, 3X can help cut losses by minimizing crash damage. Likewise, high dollar payloads are better insured with the installation of the MP21283x. MicroPliot’s 3X solution is also a good choice for large UAVs to avoid the glut of complications that come about when these large vehicles come down. High speed UAVs and those taking long missions also benefit from triple redundant technology. Traveling at high speeds does not allow UAVs time to recover from a failure, considering parachute deployment typically involves a complicated multi stage recovery system.
Identify Failures Quickly
The key benefit of the MP21283x is its ability to quickly detect hardware faults, especially those involving sensors. For example, a rate gyro with a full scale reading of 300 degrees per second, results in an attitude error of 30 degrees in just 100 milliseconds. This miscalculation could be devastating, especially if the UAV hovers next to you. Determining sensor discrepancies is no simple matter. Sensor data cannot simply be compared, as noise and phase shift cause correct data to appear faulty.
If your UAV flights call for error-free transitions, the MP21283x is a practical solution. The MP21283x is built to transition vehicle operation seamlessly between autopilots. For example, during takeoff and landing, jumps in control positions can cause damage due to the UAV’s close proximity to the ground. The MP21283x is designed to avoid sudden control inputs, which could cause the UAV to strike the ground. The MP21283x is also design to smoothly transition when a failure takes place on ground or during other critical flight phases (i.e. final approach). Moreover, if failure occurs during initial takeoff roll, the autopilot aborts the takeoff.
Choosing the MP21283x over the MP2128LRC
For those debating between MicroPilot’s MP21283x and the MP2128LRC, here are some tips to help you decide which product best fits your needs. Although the LRC offers such features as redundant radio modems, redundant RC override, integrated radio modems, and a backup microprocessor, the MP21283x may be a better solution. The LRC backup processor allows a backup pilot to fly the UAV manually in the event of a failure; however, completing flights without the autopilot is difficult. For example, manual flight is challenging particularly if the UAV is far from its destination. Not only do flying maneuvers need to be made manually, failures also need to be identified by hand (i.e. the backup pilot must monitor the UAV continuously for failures, allowing for ample recovery time). Due to MP21283x’s redundant features, this product weighs and costs more than the MP2128LRC. Therefore, if weight and price are key factors, the MP2128LRC is a better choice.
MP21283x Ultimate Reliability Measures
In addition to the three MP2128gs incorporated into the MP21283x, MicroPilot’s triple redundant autopilots provide even more backup components. These include provisions for multiple communication links, backup high current drivers, backup power supplies, and independently generated servo signals. Two different types of global positioning systems are also used to improve reliability.
Multiple Communication Links: The MP21283x acts as the UAV’s communication hub. Two radio modems can be installed, which offers two independent lines of communication between the autopilot and the ground control station. Devices such as pan tilt zoom cameras (PTZ) and aircraft transponders (which enable ground control to identify the UAV) can also be connected to the autopilot. The MP21283x’s redundant datalink between the UAV and the ground control station insures the UAV operator can continue to monitor and control the UAV as well as other important on-board equipment even if one radio link fails. The MP21283x switches communication links when flight operation is transferred from one autopilot to another autopilot. This ensures the operator on the ground is always monitoring and controlling the autopilot flying the UAV. See Figure 2.
To conserve communication channels, non-essential devices, such as data collection systems (i.e an air quality monitor), are connected to only one autopilot. However, critical devices, such as the transponder, are plugged into a communication port that automatically switches between autopilots in the event of an autopilot failure.
High Current Drivers: The MP21283x simplifies its installation with eight high current drivers. The MP21283x can switch devices on and off that take high volumes of current (i.e. navigation lights and landing lights) without additional circuitry. Each of the three MP2128g autopilots is connected to eight high current drivers. These are parallel connections. This arrangement allows any of the autopilots to turn on a high current driver. As long as one autopilot is functioning, any of the devices connected to the high current drivers can be enabled.
Independent Power Supplies: Each MP2128g incorporated into the triple redundant MP21283x has an independent power supply. In addition, separate input pins are installed for power and ground in each backup autopilot. To ensure reliability, no components share a single power supply. Therefore, in the event that a component fails, only a single autopilot is affected.
Pass or Fail OK Signals: For a triple redundant arrangement to truly function, a part of the system must know if and when an autopilot fails. Otherwise, a dysfunctional autopilot could continue to be in charge of the UAV and eventually drive the aircraft into the ground. The three individual MP2128gs continuously watch state information from the other two autopilots. Each autopilot uses pulses to let the redundancy board know which autopilots are functioning properly. Based on the pulses the redundancy board receives, the board determines which autopilot operates the UAV.
Other systems that send a variety of signals (or logic levels), indicating different levels of autopilot function, have a higher chance of running into complications. When an autopilot malfunctions in a logic level system, the autopilot generates an OK signal when it should not. Therefore, instead of telling the redundancy board the autopilot is not functioning properly, it leads the redundancy board to believe the autopilot is operating correctly. To counter this, the MP21283x evaluates the pass/fail signal from all autopilots. In this system, if a pulse is sent other than OK, the autopilot is deemed not working. Pulse timing is also monitored. Out-of-spec pulses are ignored, avoiding readings of misleading OK signals.
Triple GPS: In the event that one or more GPS systems fail, three are present on the redundancy board – two Ublox GPS modules and one Novatel GPS. The primary autopilot is hooked up to the Novatel GPS module.
All of these aforementioned quality backup measures give the MP21283x the reliability factor UAV operators need to successfully complete sensitive and expensive missions.
Tri-autopilot Synchronization
Synchronization is key to automated flight function. For example, when implementing a target geolocation acquisition (TGA) system, the camera, GPS, and inertial measurement unit (IMU) must be in sync to determine an approximate ground position. Adding to the complexity, a redundant system calls for a whole new level of synchronization. Triple redundancy requires a variety of synchronized data within all three autopilots. There are six forms of data that must be synchronized:
- Critical state information from feedback loops
- Ground control data
- Mission data
- Scripting language
- Sensor data
- Autopilot sanity
The MP21283x incorporates an inter autopilot communication system within the MP21283x. This system synchronizes data and settings among all three autopilots, limits sudden jumps in the control outputs, and synchronizes systems to the same uplink data. “If the operator changes waypoints, targets or altitude, updated data propagates to the remaining autopilots. Without proper synchronization, flight missions can be jeopardized entirely if flight operation is transferred to another autopilot programmed with outdated data,” says Howard Loewen, MicroPilot President.
For example, data shared between ground control station and the flying autopilot must be uploaded to the other two autopilots. If a UAV flying at 100 feet receives an altitude change of 400 feet, this data needs to find its way into the other two MP2128g’s. Otherwise, the UAV returns to flying at 100 feet if control is transferred between autopilots. This could lead to a variety of problems, especially if flying over built-up, or mountainous, areas.
Furthermore, each autopilot must be programmed with the same mission. If not, after switching operation between autopilots, the new autopilot will execute a completely different set of waypoints. The MP2128g missions also include scripting language that allows MicroPilot customers to easily restructure their operations. These commands can have several states and/or modify the internal state of the autopilot. Synchronizing these commands on all three autopilots ensures states are kept consistent in the event of an operation transfer between autopilots.
Supporting Products
MicroPilot’s UAV autopilots are available with a complete suite of development tools. MicroPilot modified several of its auxiliary products to support the MP21283x. For example, its update program was simplified to more efficiently renew data stored in three separate autopilots. Horizonmp and in-the-loop simulator programs are also members of MicroPilot’s suite of MP21283x development tools.
HORIZONmp: MicroPilot’s ground control station software, HORIZONmp, includes a built-in software in the loop simulator. To provide the most realistic level of simulation, the SWIL is designed to accurately simulate three autopilots, as opposed to one. This simulation product also tests the inter autopilot communication system incorporated into the 3x.
qHWIL Simulator: MicroPilot includes a quasi hardware in the loop simulator. This MicroPilot product injects sensor data and retrieves servo positions through a serial port. The qHWIL simulator provides simulator data for three separate autopilots.
trueHWIL Simulator: MicroPilot provides a trueHWIL solution for all of its autopilots. This product inserts sensor data and retrieves control information electronically, providing the highest fidelity simulation available in the industry. The trueHWIL is designed to provide independent sensor data to all three autopilots.
Future Products
While the MP21283x provides the highest reliability UAV autopilot system and supporting products available to date, MicroPilot continues to improve its triple redundancy suite. For example, future MP21283x products will incorporate sensor sharing. With this feature, if an autopilot loses one of its sensors, it can still fly the UAV by accessing data from another autopilot’s sensor within the redundant system. As a result, sensor failures become less serious.
Dual autopilot redundancy is another feature MicroPilot is currently perfecting. With this system, an MP21283x operating on only two autopilots is better equipped to detect a partially failed autopilot.
Triple Confidence
MicroPilot’s MP21283x offers the high degree of redundancy UAV operators need to conduct UAV flights over geographical areas that offer little hope for recovering a lost
vehicle. When flight termination systems are not enough to protect your assets, whether they are expensive airframes or high- dollar payloads, a triple redundancy autopilot is worth the investment. “Three autopilots, dual radios, power device backups, and reliable servo signals are a few of the features the MP21283x offers UAV manufacturers and operators,” says Loewen. “We kept our sights high when we designed our new triple redundant autopilot and supporting products.” Let the technology behind the MP21283x give you the assurance required to lift off.
For more information on MicroPilot’s autopilots, please visit my MicroPilot page at www.uavpropulsiontech.com/micropilot.
Key UAV News for the Week:
- Aurora expands LightningStrike testing, eyes FVL
- Watch: Russia’s heavy duty Chimeral drone
- China: We’re ready if US ‘stirs up any conflict’ in South China Sea
- Yamaha Motor Corp. launches U.S. crop UAV spraying from Napa
Industry Events for MAY:
- Xponential 2016 – May 3-5, New Orleans, LA, www.xponential.org.
- 2016 SOFIC (Special Operations Forces Industry Conference) – May 23-26, Tampa, FL, www.sofic.org.
- Nordic UAS Event – June 1-3, Odense, Denmark. http://www.nordicuasevent.com/
- Demand for Unmanned – June 15-16, Washington, DC. http://www.aiaa-aviation.org/unmanned/?utm_source=UTM&utm_medium=web&utm_content=calendar&utm_campaign=Unmanned2016
- Eurosatory – June 13-17, Paris, France. http://www.eurosatory.com/
- Sensor Expo – June 22-23, San Jose, CA. http://www.sensorsexpo.com/
Quote for the week:
“We cannot become what we want to be by remaining what we are.” – Max DePree
UAV Propulsion Tech is unmanned aerial vehicle (UAV) hardware solution provider of propulsion, servo, autopilot, rescue/recovery parachutes, electric turbofans, pneumatic launchers, fuel flow/level sensors, hyperspectral cameras, INS, digital compasses, fuel cells, motors/generators, GCS and gyro-stabilized EO/IR gimbal solutions. Click on the HOME link above or go to www.uavpropulsiontech.com for more info.
