Issue 39 Unmanned Systems Technology August/September 2021 Maritime Robotics Mariner l Simulation tools focus l MRS MR-10 and MR-20 l UAVs insight l HFE International GenPod l Exotec Skypod l Autopilots focus l Aquaai Mazu

88 Focus | Autopilots Network architecture If an autopilot is to accomplish flight control, guidance and vehicle-wide diagnostics effectively, a robust network linking it with the various subsystems is critical. The use of CAN as an effective comms bus has become widespread for its well-founded capabilities in intelligent prioritisation of signal data, checksums for signal integrity, and relaying many different forms and amounts of information without needing the copious wiring harnesses typical of traditional aerospace and automotive electrics. However, the rising demand for greater autopilot integrity among defence and commercial-urban unmanned systems operators lays bare a fundamental weakness in many such vehicles’ network architectures, even if certified components are being used. Maximising integrity means removing all single points of failure. The typical approach taken to achieving this consists of installing dual- or triple-redundant navigation sensors, flight control computers and actuators. Having separate sets of sensors and processors means that, in addition to redundancy, majority voting can take place between their readings and outputs to identify if one is malfunctioning and reject it accordingly. This approach has been made much easier in recent years through the carrier-and-core modular approach that enables fast plug-and-play integration of multiple autopilots on a single board, but a few key problems still remain. For one, a triple-redundant autopilot with majority voting can still fail if two of its three sensor-processor groupings are returning incorrect results. More concerning, however, is that by and large these redundant systems still run through some form of singular multiplexer in order to arbitrate between them and output a single command to each actuator. That multiplexer forms an unavoidable single point of failure in conventional redundant flight control networks. Attempting to resolve this problem by making the multiplexer more robust, or certifying it to DO-178 or DO-254, can become extremely costly, difficult to scale and problematic to define, given how new so many unmanned systems components and technologies are compared with the standards. One alternative approach to the issue of integrity has been the development of a new type of common network bus across which all sensors, flight controllers and actuators can communicate freely. This is enabled by having all the electronics broadcasting their data outputs onto the network, making all of them available as sources of information, and all of them actively receive the types of data inputs needed to accomplish their functions. By eliminating all single points of failure, this ‘masterless’ network approach to flight controllers has been tested to achieve an integrity that is an order of magnitude higher than conventional arbitration arrangements. It also enables denser comms and thus potentially tens of actuators, sensors and processors on a single aircraft, with test UASs achieving extreme levels of redundancy and reliability in their flight control as a result. While in many commercial operations this would be over-actuation, life-saving deliveries and strategically imperative defence operations would probably benefit from this technique, enabling UAVs to be quite literally shot full of holes and yet continue flying. Furthermore, as BVLOS commercial deliveries by UAV increasingly look to become a reality of daily life, the question of how to enable safe sharing of airspace through technology is asked more often, particularly since new technology is invented and commercialised far quicker than it is certified by aviation regulators. A few standards for sharing airspace are now available though, such as Remote ID, Mode-S Extended Squitter, Mode 5 IFF and FLARM. The question of air-to- air collision avoidance is also spurring development of lightweight interrogators that could enable UAVs to actively scrutinise other standards-compliant aircraft in their vicinity. More and more autopilot systems are being designed for compatibility with transponders designed for operating compliance with these standards, such is the importance of installing reliable detect & avoid capabilities on UAVs. However, there is clearly a lot of fragmentation and a lack of agreement on which technological direction everyone should go in. One potential solution being developed consists of something akin to a masterless network architecture over the internet, over which compliant aircraft (both manned and unmanned) can August/September 2021 | Unmanned Systems Technology New ‘masterless’ network architectures running from sensors to processors and actuators can eliminate any single point of failure (Courtesy of Distributed Avionics)