An Airborne Experimental Test Platform - Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design

An Airborne Experimental Test Platform

Although most UAV applications to date have appeared in the military and law enforcement sectors, many important civilian applications exist for these vehicles. Such uses include wildfire surveys, transportation infrastructure inspection, and precision agriculture. Recent advances in guidance, navigation and control (GNC) technology have made these civilian applications possible.

Although most UAV applications to date have appeared in the military and law enforcement sectors, many important civilian applications exist for these vehicles. Such uses include wildfire surveys, transportation infrastructure inspection, and precision agriculture. Recent advances in guidance, navigation and control (GNC) technology have made these civilian applications possible.

Furthermore, UAVs provide an excellent surrogate platform for researching and developing avionics and GNC algorithms intended for the safety-critical application of guiding, navigating and controlling manned aircraft. This not only offers significant cost savings, but testing experimental avionics and algorithms on a UAV also poses less risk.

UAVs have been used as such test platforms before. NASA Armstrong (formerly Dryden) flight research center, for example, has used X-48 and X-56 to test experimental control laws that are too risky to test on manned aircraft.

The University of Minnesota UAV Research Group (UMNURG) focuses on researching, developing, and testing advanced avionics algorithms using low cost UAVs as test platforms. The UMN-URG’s platform allows for safe and cost-effective GNC research that would be impossible with manned aircraft or with simulation-only analysis.

In Part 1 of this series, which appeared in the March/April 2014 issue of Inside GNSS, we described the open flight research platform used for this work, including the experimental aircraft, simulation architecture, and flight software algorithms. In this follow-on article, we present specific examples that highlight how UAVs can be employed in GNC avionics research and development. First, we will describe a GNSS-enabled air data estimation technique whereby an aircraft’s equation of motion is used as a virtual sensor to aid in estimating its airspeed, angle of attack, and sideslip angle.

Next, we discuss the development of navigation algorithms for GNSS-stressed or GNSS-denied environments highlighting how information sharing among UAVs flying in a certain region could be used to coast through GNSS outages. Finally, we present work that focuses on how UAVs can be used to assess the reliability of an avionics system, including certification tools and fault detection algorithms.

GNSS-Enabled Air Data Estimation
An air data system provides information about an aircraft’s speed and orientation (angle of attack and sideslip angle) relative to the outside air. Estimates of airspeed, angle of attack, and sideslip angle are crucial for safely and efficiently operating an aircraft. For example, airspeed is used to define the maximum speed beyond which structural damage can occur. Angle of attack and sideslip angle are used to ensure an airplane does not operate in a region from which recovery from an upset would be impossible.

An air data system is composed of several components. The main ones are a pitot-static system that measures the dynamic and static air pressure, and aerodynamic vanes that measure angle of attack and sideslip angle. These measurements are then processed by an air data computer that refines the air data estimates with temperature and local flow corrections.

One well-known fault mode to this airspeed measuring method is ice accumulation on probe pressure inlets. This causes obstruction that leads to erroneous pressure measurement. As shown in Table 1, ice accretion on air data sensors has been involved in numerous accidents/incidents over the years.

Heating elements are now commonly used on commercial transport aircraft to prevent ice accumulation and probe inlet clogging. Recent climate studies show changes in upper atmosphere weather patterns, which portend more frequent icing encounters such as that which caused the accident of Air France Flight 447.

These concerns have led the aviation industry and government regulatory agencies to ask: “Is there a way to determine aircraft speed and orientation that is immune to ice buildup and can be easily retrofitted into existing aircraft?”

The UMN-URG has developed a method to synthetically estimate these air data quantities using a GNSS receiver, a MEMS inertial measurement unit (IMU), and a mathematical model of the aircraft. We call this method synthetic because it doesn’t rely on direct pressure or aerodynamic angle measurements to estimate the air data quantities.

GNSS receivers and IMUs have become part of the standard aircraft instrumentation. They enable most, if not all, navigation systems these days; so, being able to use these sensors to estimate air data quantities is very attractive.

Although our method requires instrumenting the aircraft with sensors that can measure the control surface deflections and propulsive force in flights, this is not a very demanding requirement. This information is available on most aircraft equipped with an autopilot unit, especially if servos are used to actuate the flight control surfaces.

Our approach to this problem uses a federated extended Kalman filter (EKF) architecture where two estimators are cascaded in series. The functional block diagram of this architecture is shown in Figure 1. This architecture is completely independent of the pitot-static-vane system and is formulated in the filtering framework that allows us to estimate the accuracy of the synthetic estimate of airspeed (V), angle of attack (α), and sideslip angle (β) through the filter error covariance matrix.

This algorithm was tested on the UMNURG’s Ultrastick 120, known as Ibis. The synthetic air data estimates were then compared with measurements made using a calibrated pitot tube and angle of attack and sideslip vanes.

Figure 2 shows the filter performance on one of Ibis’s flights, and we can see that the estimation errors are bounded by the estimate of the 3-σ values. In the nominal flight condition, the accuracy (3-σ) of the synthetic airspeed, angle of attack, and sideslip estimates are less than two meters/second, three degrees, and five degrees, respectively. We could improve these results with a more rigorous system identification process to build a nonlinear aircraft model.

Future Navigation Concepts
The FAA Modernization and Reform Act of 2012 (HR658) requires the Federal Aviation Administration (FAA) to integrate routine unmanned aircraft operations into the national airspace system (NAS). Section 332 of the legislation requires the FAA to “provide for the safe integration of civil unmanned aircraft systems into the national airspace system as soon as practicable, but not later than September 30, 2015.”

The term “safe” is interpreted to mean that UAVs must possess an equivalent level of safety as manned aircraft or must not pose undue hazard to other aircraft or the general public in the vicinity. This implies that integrating UAVs into the NAS must be seamless and that they must be able to operate side by side with manned aircraft.

In this future airspace, GNSS, in particular GPS, will be the key technology used for traffic separation and monitoring. In some of the envisioned concepts, aircraft will self-report their position (by means of automatic dependent surveillance, or ADS-B, technology) with this information being used for air traffic control purposes. In this application, an incorrect or false position report, regardless of whether it was intentional or malicious, could have severe consequences.

The UMN-URG has developed a civilian GPS authentication approach that can deal with this problem. The system works by validating the position report sent by each aircraft against a segment of the GPS signal collected by an authenticator (e.g., air traffic controller). Our experiment shows that this authentication methodology’s resolution is better than 15 meters.

A “swarm” or community of several UAVs operated simultaneously can provide a miniature replica of the future airspace in which one can test such authentication techniques. A community of UAVs can also be used to evaluate information sharing–based navigation concepts that have been envisioned as part of many alternative positioning and timing (APNT) systems for dealing with GNSS-stressed or denied scenarios.

Traffic collision avoidance systems (TCAS) and ADS-B are examples of existing systems that allow such information sharing. Received by modemequipped neighboring vehicles and coupled with relative measurements such as range between the vehicles, this information can serve as an aiding source.

Although TCAS probably won’t be used on small UAVs, sensors providing relative measurements such as range or bearing, are anticipated to become commonly available in the near future as aviation authorities implement requirements for detect-and-avoid capabilities. Furthermore, a data link such as the 900MHz modem can be used to exchange information with a ground station. Therefore, it is not difficult to imagine neighboring vehicles effectively acting like moving beacons that can be used for navigation purposes, improving the positioning accuracy of all vehicles in the area.

Information from aircraft equipped with higher grade navigation equipment can also be shared with other vehicles. While cooperative navigation is useful in general, it is especially helpful for operations in geographic areas experiencing denial (e.g., jamming, blocking, interference) of GNSS signals.

With cooperative navigation, the rate of error growth among vehicles operating in the GNSS-denied zone can be significantly reduced. Drift-free solutions of vehicles operating outside the GNSS-denied zone can be propagated to those affected by the GNSS-denial. This can improve robustness for operating in urban areas or overcoming other sources of GNSS signal interference.

Aiding in the form of inter-vehicle measurements and information exchange introduces a correlation between the state errors of the vehicles. Handling this correlation is the major challenge in making cooperative navigation a reality. The UMN-URG has developed an effective algorithm for accomplishing this, which has been tested in post process using flight test data.

Cooperative navigation is not the only GNSS-denied navigation solution that UMN-URG is considering. A cellphone signal aided dead-reckoning navigator, as shown in Figure 4, is another alternative. Figure 5 shows how the cell phone modem will be integrated into the Goldy flight control system (described in the first article of this series). This is the subject of current and ongoing work and beyond the scope of this article.

Cooperative Navigation Flight Tests
A set of seven flights collected between 2011 and 2013 have been aggregated and used for a cooperative navigation analysis. The ground-track of each flight is shown in Figure 6. During the flights, each UAV had access to the following information: three-axis accelerometer, gyro, and magnetometer measurements, GPS position and velocity, airspeed, and baro-altimeter measurements. (These data were also used to implement the AHRS and dead-reckoning system schematically shown in Figure 4.)

Artificial inter-vehicle range measurements were derived using the GPS measurements. Using real flight data, our research demonstrates the feasibility and attainable performance for a community of vehicles navigating in GNSS-denied environments with the aid of cooperative navigation.

Using the collected flight data from the UAVs, we employed post-processing analysis to determine unaided performance when GPS is unavailable. All seven flights were temporally shifted so as to occur simultaneously. At time t = 110 s, GPS was denied to all aircraft for two minutes. During this time, each aircraft continued to rely on the on-board dead-reckoning system.

The light blue line in Figure 7 shows about 450 meters of uncertainty in the position estimate by the end of the two minutes. Although the data in Figure 7 are particular to Thor Flight 75, similar figures could be generated for the other six UAV flights.

When cooperative navigation is used, however, the final uncertainty after two minutes of GPS outage is only 150 meters, as indicated by the green line in Figure 7. Note that this benefit is entirely due to the inter-aircraft ranging and information exchange, because none of the aircraft has access to GPS. Had even one aircraft had access to GPS or a high-grade inertial navigation system, the navigation capabilities of the entire community would have been significantly improved.

The UMN-URG’s UAV platform and online archival of flight data has served as an enabling tool for cooperative navigation estimator design and validation. Although current development work uses playback of logged flight sensor data, we hope to use the multiple UAV platforms to demonstrate real-time cooperative navigation in the future.

Assessing System Reliability
Actuator and sensor failures are two main causes of major aircraft accidents. A famous example of actuator failure is uncommanded rudder movement encountered on Boeing 737s, that was believed to have been the cause of accidents in 1992.

Sensor failure, however, is more common. Although it doesn’t cause loss of control directly, sensor failure can lead to loss of situational awareness. Faults in an air data system is an example of sensor failure.

UAVs are ideal surrogate platforms to test algorithms that detect and isolate system faults because of the risk these tests pose on manned aircraft. The UMN-URG is using UAVs to help develop robust fault detection and isolation algorithms, as well as a way of certifying these algorithms. Eventually, these could be used to inform airframe design changes to improve fault tolerance.

Control Surface Impairments. In fall of 2013, as part of an undergraduate senior design project, a group of students assessed the reliability of the existing (baseline) UltraStick 120 used by the UMNURG.

The team performed a failure modes and effects analysis (FMEA) as well as a fault tree analysis (FTA). Through this analysis, the team estimated the existing Ultra Stick 120’s catastrophic failure rate as 2.17 failures per 100 hours. This is a type of failures where the aircraft’s controls are critically altered and emergency landing with moderate to high damage is likely. Some examples include loss of radio control or a stuck control surface that leads to an aircraft that is not trimmable.

The team determined the reliability could be improved to 0.128 catastrophic failures per 100 hours with a few simple designs updates. In particular, the team recommended the use of split rudder/elevator surfaces (See Figure 8), as well as a redundant battery and redundant failsafe switch.

The students are currently building the re-designed Ultra Stick 120 that incorporates some of these changes, including the split rudder/elevator surfaces. This redesigned Ultra Stick 120 will serve as the reliability platform for the UMN-URG in the near future.

Fault Detection and Identification (FDI). Reliability and safety requirements for commercial manned flight control electronics are on the order of no more than 10–9 catastrophic failures per flight hour. Commercial aircraft meet this stringent reliability requirement via hardware redundancy throughout the flight control system.

For example, the Boeing 777 flight control electronics consist of three primary flight computing modules that each contains three dissimilar processors. The actuators and sensors have similar levels of redundancy. This configuration allows the system to isolate failures so no single event or component failure can cause the entire aircraft system to fail.

The UMN-URG is investigating model-based analytical redundancy as an alternative to achieve fault tolerance. This approach relies on mathematical models and/or measured data to detect and identify faults instead of additional hardware to ensure against them. The model-based algorithm was developed using a mathematical model of the aircraft, while the data-driven algorithm operates exclusively on raw flight test data.

We devised UAV flight tests with faulted and unfaulted aileron actuators to acquire telemetry data. We subsequently assessed detection performance by playing back the experimental flight data and applying both detection algorithms. The main contribution of this work is its demonstration that experimental data allows for a side-by-side comparison of FDI techniques arising from different philosophies of system health monitoring.

Figure 9 shows results from several experimental flight tests where faults were purposefully injected into the system. In these tests, we considered aileron fault (fa) as well as rate roll rate gyro fault (fp). Our FDI algorithm was able to accurately estimate two faults that occurred at different times in flight.

Certification Tools. Certification is another key issue that the UMN-URG is investigating. Specifically, aircraft designers need to certify the reliability of an analytically redundant system with aviation authorities, e.g., the Federal Aviation Administration (FAA) in the United States or the European Aviation Safety Agency (EASA). The system must not only be highly reliable and safe, but it must also possible to certify the system’s reliability and safety.

In a physically redundant configuration, a failed component is detected by directly comparing the behavior of each redundant component. Hence, these architectures tend to detect faults accurately and quickly. Their performance can be certified from known hardware component failure rates using FMEA and FTE methodology.

The reliability of systems that use analytical redundancy, on the other hand, depends on the performance of the detection algorithm as well as the hardware component failure rates. However, with the latter method new failure modes are introduced due to the mixed use of analytical algorithms and hardware components. Thus, different tools are required to assess the reliability of analytically redundant systems.

Over the years, the UMN-URG has developed analytical tools to assess the reliability of analytically redundant systems. For example, we derived a theoretical method to assess the probabilistic performance for a dual redundant system as shown in Figure 10. Applying this method, we compute the system failure rate per hour based on knowledge of the failure rates for the hardware components and, for the FDI logic, knowledge of specific probabilistic performance metrics.

This probabilistic method can complement the use of Monte Carlo simulations when evaluating the system’s reliability. Although this method is faster and more efficient, it can only be applied given sufficient information about the hardware components and the FDI algorithms.

Renewed interest has emerged for developing new avionics and GNC algorithms for safety-critical systems. The UMNURG’s research focuses on developing, testing and certifying such algorithms using low-cost UAVs as test platforms. In particular, we develop multisensor navigation and estimation algorithms, fault detection and isolation algorithms, and system reliability assessment and certification tools. We use UAVs to test them.

The open-source infrastructure encourages collaboration with the entire research community, especially through sharing flight data. All information on the research platforms, including archived flight, data are available on the UMN-URG’s website.

The work described in this article was supported by the United States Department of Homeland Security (DHS) for supporting this work through the National Center for Border Security and Immigration under grant number 2008-ST-061-BS0002, the National Science Foundation under Grant No. 0931931 titled “CPS: Embedded Fault Detection for Low-Cost, Safety-Critical Systems,” and NASA under Grant No. NRA NNX12AM55A titled “Analytical Validation Tools for Safety Critical Systems Under Loss-of-Control Conditions.’’

Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the DHS, the National Science Foundation, or NASA. We also want to acknowledge the members of the senior design team: Jeremy Amos, Erik Bergquist, Jay Cole, Justin Phillips, Shawn Reimann, and Simon Shuster.

Additional Resources
Freeman, P., “Robust fault detection for commercial transport air data probes,” Master’s thesis, University of Minnesota, November 2011
Freeman, P., and R. Pandita and N. Srivastava and G. Balas, “Modelbased and Data-driven Fault Detection Performance for a small UAV,” IEEE/ ASME Transactions on Mechatronics, Vol. 18, No. 4, pp. 1300-1309, 2013
Hu, B., and P. Seiler, “Certification Analysis for a Model-based UAV Fault Detection System,” in Proceedings of the AIAA Guidance, Navigation, and Control Conference, AIAA Paper No. AIAA- 2014-0610, National Harbor, Maryland, 2014
Freeman, P., and P. Seiler, and G. Balas, “Robust Fault Detection for Commercial Transport Air Data Probes,” IFAC 18th World Congress, Milan, Italy, pp. 13723-13728, August 2011
Hu, B., and P. Seiler, “A Probabilistic Method of Certification of Analytically Redundant Systems,” in Proceedings of the 2nd International Conference of Control and Fault-Tolerant Systems (Sys-Tol), pp. 13-18, Nice, France, 2013
Lie, F. A., and D. Gebre-Egziabher, “Synthetic Airdata System,” AIAA Journal of Aircraft, Vol. 50, No. 4, pp.1234-1249, July, 2013
Li, Z., and D. Gebre-Egziabher, “Performance Analysis of a Civilian GPS Position Authentication System,” NAVIGATION, Journal of the Institute of Navigation, Vol. 60, No. 4, pp. 249-265, 2013
Mokhtarzadeh, H., and D. Gebre-Egziabher, “Cooperative Inertial Navigation,” NAVIGATION, Journal of The Institute of Navigation, accepted for publication March 2014
Mokhtarzadeh, H., and D. Gebre-Egziabher, “Potentials of Inertial Navigation Aided by Position Broadcasts and Relative Measurements, ” in Proceedings of the Institute of Navigation (ION) International Technical Meeting, pp. 426-443, San Diego, California, 2013
Pandita, R., “Dynamic Flight Envelope Assessment with Flight Safety Application”, Ph.D. Thesis, University of Minnesota, 2010.