Our research group (Ofer Eldad, Andrew Alexander, and Christian Claudel) at the University of Texas at Austin has implemented a supervisory control algorithm we developed to protect the flight envelope with either human control or autopilot.
Our test platform is the Bormatec Maja shown below:
The basic idea of the supervised control algorithm is to predict possible states at a future point in time given all possible allowable inputs and disturbances and then limit the control surfaces so that the UAV remains in a "safe state" regardless of human / autopilot input. This algorithm is based on our prior work published by the AIAA Journal of Guidance, Control, and Dynamics titled "Real-Time Computation of Safe Input Sequences for Unmanned Aerial Vehicles".
The "safe state" can be defined as keeping the angle of attack in a certain range, and/or limiting the max velocity, or any other function or combination of functions of the UAV's state that is considered desirable such as minimum altitude and/or maximum vertical acceleration and more.
The algorithm is implemented on an Odroid XU-4 that is connected to a Pixhawk. The Odroid receives sensor input in real time from the Pixhawk, and uses these measurements to get an estimate of the current state using an Unscented Kalman Filter (UKF) for the UAV's 12 states (position, velocity, orientation, rotation rates) in addition to angle of attack, sideslip, and airspeed.
Only IMU measurements are used (accelerometer, gyro, magnetometer) for this flight envelope protection system. The pitot tube and GPS don't need to be used (and are not used in this implementation). This sacrifices good knowledge of position, but we are not interested in good position data for these flight tests.
In order to get the angle of attack, angle of sideslip, and airspeed, we use machine learning based on IMU measurements along with control surface / throttle inputs.
The video below shows a sample pitch maneuver performed by human controller. In this maneuver, the safe elevator input sequence is characterized by an ellipse (projection of 8 dimensional ellipsoid onto 2-dimensional sub-space). Once the commanded elevator input (blue circle) deviates outside of the allowable region, the Odroid overrides the pilot input to the elevator (red triangle) to ensure the angle of attack doesn't exceed a maximum defined value (here 15 degrees).
This system is similar in spirit to alpha-protection systems implemented on Airbus aircraft.
Comments
This is a good paper on the UKF, how it is implemented, and how it compares to the EKF.
It's a bit difficult in places because the UKF is more complicated to set up, but I think there's enough there to get at least a basic understanding of the premise.
thx Ofer for these explanations. Makes me realize how more there is to learn! do you have a 101 documentation on UKF I could start reading (engineer level) ?
Hi Hugues, That's a good question. The differences I see between this system and the EKF that is already used are:
1) The EKF uses kinematic equations since it does not know the aircraft it is placed on. For example, it can use the current pitch angle, and the pitch rate to predict the future pitch angle and use that prediction to filter incoming measurements. However, it has no knowledge of the dynamic model for the aircraft, its aerodynamic coefficients and the aerodynamic forces. The UKF uses a dynamic model which includes the aerodynamic forces to not only predict future orientation angles (kinematically), but also predicts future rotation rates (dynamically). The same can be said for predicted accelerations.
2) Our implementation uses machine learning to estimate the angle of attack, angle of sideslip, and airspeed. This is not available to the EKF (unless a pitot tube is used, but this data is pretty noisy in our experience and adds complexity to the implementation).
3) Given the previous two points, we have many more options in terms of what states we can limit (rotation rates, accelerations, angle of attack, and of sideslip) in addition to limiting all the states that the EKF can. The incorporation of additional data from dynamic model makes the estimates better even for those states available to the EKF.
4) Our implementation takes an approach inspired by reachability analysis where we look forward in time and take into account all allowable human / autopilot inputs in addition to possible disturbances (wind / gusts). This forward simulation cannot be achieved using the EKF and makes our system more robust and able to handle a wider variety of environmental conditions.
5. Our system can handle a combination of limitations that would otherwise not be possible. Maybe you don't care as much about a high pitch angle if the angle of attack is still low, etc.
6. All other things being equal, the Unscented Kalman Filter (UKF) is known to be a better filter than the EKF in terms of more accurately capturing the non-linearities inherent to the dynamic system.
All in all, I would say that this system is much more versatile and offers a much wider range of options for limiting commands by either a human operator or an autopilot for those reasons.
I hope this makes sense, let me know.
Hello Ofer,
To understand the improvements that this intelligent system brings, in what way is it better or different than the current Ardupilot where EKF is laready used an,d where we can set a bunch of parameters to define maximum pitch/roll angles in FBWA mode for ex ?
@Muscate Thanks for the kind words!
I agree that many expensive aircraft have these, and like you said they typically have fixed parameters for these limiters which makes them a bit constrained. For example, even modern F-16 variants have two flight categories where these parameters are modified (Air-to-Air configuration and Air-to-Ground configuration) which is quite limited.
We think that this approach is more modular and easily adaptable to a larger range of aircraft and a large range of scenarios (not just alpha limiter) with fairly inexpensive and simple sensors that can be helpful in maintaining safe flight.
We are still developing this system, but thought this would be a good point in time to share some results with the community. It's always exciting to see the theory working out in real life!
A lot of (expensive) airplanes have a similar system. They engineers know the theoretical and tested limits of the plane, ie when its going to stall and so on, when program a limiter in the flight controller.
A well known example is the French Rafale fighter jet vs the Swede Gripen. Both use canards which have to be computer controlled as they can put the airplane into a stall that is nearly irrecoverable. These (in addition to the Eurofighter of course) were the first well-known planes with high AoA canards.
The Swedes software, or measurements, or calculus wasn't up to snuff and there were a lot of rumors - until during a demo the Gripen was put into a stall due to the canards and crashed. They have now fixed it by limiting the movement in certain conditions.
None of these, to my knowledge, actually use ML. They use fixed functions and fixed known-bad/known-good parameters, then the model force the plane inside of these - though this may have evolved (the software is full of secrecy though I'm guessing Airbus and Dassault probably use the same software, due to their origins.. last I spoke to an engineer there was in the 90's though)
Anyhow, that's great and interesting work - it seems to me that the hardest (and most interesting) is to estimate what limits and how the limits are set on frames you don't have an army of engineers and testers to set the values for.
Thanks for sharing this stuff with us and congratulations on your results!
@Marcus I would say that's the goal :)
Another way to look at it is that since it takes possible disturbances into account, this sort of system may be used to safely fly in more gust-prone conditions than would otherwise be possible.
Would you say it's almost impossible to crash?
So basically, you are aiming to emulate an skilled pilot that trough experience instinctively knows what maneuvers a plane can and can't do. And then add it to the Autopilot. Nice work.