Michael Jump

Formal methods for the certification of autonomous unmanned aircraft systems

In this paper we assess the feasibility of using formal methods, and model checking in particular, for the certification of Unmanned Aircraft Systems (UAS) within civil airspace. We begin by modelling a basic UAS control system in PROMELA, and verify it against a selected subset of the CAAs Rules of the Air using the SPIN model checker. Next we build a more advanced UAS control system using the autonomous agent language Gwendolen, and verify it against the small subset of the Rules of the Air using the agent model checker AJPF. We introduce more advanced autonomy into the UAS agent and show that this too can be verified. Finally we compare and contrast the various approaches, discuss the paths towards full certification, and present directions for future research.

Investigation of the Flare Maneuver Using Optical Tau

Airline transport operations are carried out in a wide range of visual and instrument meteorological conditions. However, the pilot can choose to land the aircraft manually using the visual cues available for all but the most limiting of degraded visibilities. How this is achieved may seem rather obvious, but has challenged researchers for some time. Optical flow theory offers a solution: pilots detect motion from the surfaces over which they move. In a relatively recent incarnation, flow theory transforms motion into the temporal, time-to-contact parameter, tau. Research conducted at Liverpool has applied this theory to low-level helicopter flight. The present paper extends the application to the fixed-wing flare. Flight simulation results show that tau-guidance strategies exist for this maneuver. It is shown that, as expected from tau theory, the pilot-selected values of the rate of change of tau with time, tau-dot, and the tau-guide coupling constant, directly influence the acceptability of the touchdown rate achieved. Degraded visual environments are shown, under certain circumstances, to cause a breakdown in the tau relationships observed. Potential uses of these results are presented in terms of application to future pilot vision aids, which is the planned next stage of this work.

Tau Guidance in Boundary-Avoidance Tracking: New Perspectives on Pilot-Induced Oscillations

DOI: 10.2514/1.54065 Tau theory, introduced to the flight control discipline as a model for natural guidance, is shown to provide an approach to predicting a class of adverse aircraft-pilot couplings described as boundary-avoidance tracking events and pilot-induced oscillations. These have previously been modeled a posterior as discrete events using timedependent feedback gains. Drawing on the prospective nature of the time-to-contact variable optical tau � , a new method is proposed for modeling such phenomenon and also for determining the critical incipience for this class of aircraft-pilotcoupling.Inthepresentstudy,theapproachhasbeenappliedtotauguidanceinarotorcrafttrajectory tracking maneuver, to predict the conditions under which aircraft-pilot couplings may occur. In addition, a strong correlation between motion and control activity and the derivatives of tau adds substance to the hypothesis that the pilot’sperceptualsystemworksdirectlywithinvariantsintheoptical flowduringvisualguidance.Resultsfrom flight simulation tests conducted at the University of Liverpool and complementary flight tests carried out with the National Research Council (Canada) advanced systems research aircraft in-flight simulator support the tau control hypothesis. The theory suggests ways that pilots could be alerted to the impending threat of such adverse aircraftpilot couplings.

Progress in the development of guidance strategies for the landing flare manoeuvre using tau‐based parameters

Purpose – To provide a progress report into research conducted to establish guidelines for the development of guidance vision aids.Design/methodology/approach – The first stage of the research is to establish a coherent engineering basis for the methods of (visual) motion perception and control to inform the design of pilot aids that will support flight in degraded visual conditions, particularly when close to the ground. The next stage will then be to construct and evaluate synthetic displays that recover the visual cues necessary to allow flight in degraded visual conditions for a range of manoeuvres using the flight simulation facilities at the University of Liverpool (UoL). The research is guided by tau (time to contact) theory from the field of ecological psychology.Findings – The closure of spatial gaps for a number of aircraft manoeuvres are presented in the tau domain. Analysis of the landing flare manoeuvre suggest that both a constant rate of change of tau strategy and an intrinsic tau‐guidance ...

Towards Certification of Autonomous Unmanned Aircraft Using Formal Model Checking and Simulation

Unmanned aircraft are expected to increase in use in civil applications over the coming years, particularly for the so-called dull, dirty and dangerous missions. Unmanned aircraft will undoubtedly require some form of autonomy in order to ensure safe operations: communications failure could render a completely human-piloted unmanned aircraft dangerous to other airspace users. In order to be used for civil applications, unmanned aircraft must gain government regulatory approval in a process known as certification. This paper presents an approach to gathering evidence for certification of autonomous unmanned aircraft based on formal methods (in particular formal model checking) and flight simulation. In particular, rational agent-based autonomous systems are examined. Rational agents for unmanned aircraft can be model checked using implicit models of the aircraft’s physical environment specified in terms of the different sensor inputs the autonomous system may receive. However this presents difficulties when trying to model check the agents relative to physical quantities such as those found in regulatory documents like the CAA Air Navigation Order. It is shown how this can be remedied using an explicit physical model of the environment within the model checker, and how this explicit physical model can itself be verified through comparison with flight simulations. To conclude, an overview of related and future work is given.

Tau Flare or not Tau Flare: that is the question: Developing Guidelines for an Approach and Landing Sky Guide

Airline transport operations are carried out in a wide range of visual and instrument meteorological conditions. For all but the most limiting of degraded visibility situations, however, the pilot can choose to land the aircraft manually, using the visual cues available through the cockpit windshield. The answer to the question - how is this achieved, which gives the paper its title, tau flare or not tau flare ? – may seem rather obvious but has actually challenged researchers for some time. The optical flow theory of visual perception offers solutions in terms of the way pilots pick up motion from the surfaces over which they move. In a relatively recent incarnation, flow theory transforms motion into the temporal, time-to-contact parameter tau, defined as the time to close on a surface at current closure rate. Research conducted at Liverpool has applied this theory to low-level helicopter flight. The present paper builds upon this work and reports on the application of the theory to fixed wing aircraft during approach and landing. Using data from piloted flight simulation experiments, the results show how tau-guidance strategies exist for the flare and touchdown manoeuvre in terms of the rate of change of the tau of height above the runway surface and in terms of coupling the tau of height above the runway surface with a general intrinsic tauguide. Furthermore, it is shown that the values of the rate of change of tau with time, taudot, and the coupling constant selected by the pilot, directly influence the acceptability of the touchdown rate achieved. The introduction of a degraded visual environment is shown, under certain circumstances, to cause a breakdown in the tau relationships observed. Potential uses of these results are presented in terms of application to future pilot vision aids, which is the planned next stage of this work. Such displays may work in one of two ways or indeed, a combination of both: the first is a display to command a specific tau relationship that the pilot must follow; the second is a display that provides an indirect mechanism to allow the pilot to couple onto an appropriate tau guidance mechanism for the flare. Application of this work to the fields of flight safety and flight training is also briefly discussed.

Methods to Assess the Handling Qualities Requirements for Personal Aerial Vehicles

This paper describes the development of a methodology to assess the handling qualities requirements for vertical takeoff and landing-capable personal aerial vehicles. It is anticipated that such a personal aerial vehicle would be flown by a “flight-naive” pilot who has received much less training than is typically received even by today’s general aviation private pilots. The methodology used to determine handling requirements for a personal aerial vehicle cannot therefore be based entirely on existing best practice; the use of highly experienced test pilots in a conventional handling assessment limits the degree to which results apply to the flight-naive pilot. Using rotary-wing handling qualities methods as a start point, this paper describes both existing and newly developed alternative methods to subjectively and objectively analyze the performance and workload of flight-naive pilots in typical personal aerial vehicle tasks. A highly reconfigurable generic flight dynamics simulation model that has been...

Certification of a Civil UAS: A Virtual Engineering Approach

The use of Unmanned Autonomous Systems (UAS) is becoming an increasingly routine activity in military theatres of operation, particularly for the oft-cited ‘dull, dangerous and dirty’ missions. There is growing acceptance that UAS will find similar utility within the corresponding civilian missions and beyond. UAS technologies are maturing rapidly but the associated regulations to allow open access to civilian airspace are yet to be fully formulated. Current UK practice is therefore to allow UAS operation only in segregated airspace (airspace denied to all other potential users) or in non-segregated airspace but restricted to line-of-sight operations, below 400ft only. There is therefore a growing need to develop a means by which UAS can operate alongside existing airspace users, in all classes of nonsegregated UK airspace. The University of Liverpools Virtual engineering Centre, is developing tools and techniques that will allow both industry and regulators to establish a ‘design for certification’ ethos within the supply chain where safety-critical software and hardware is required. The processes will include requirements capture and validation phases, as well as a means of testing and evaluating whole UAS/sub-system virtual prototypes, with a view to being able to demonstrate compliance with the relevant airworthiness codes as early as possible in the design cycle.

Prediction and Simulator Verification of Roll/Lateral Adverse Aeroservoelastic Rotorcraft–Pilot Couplings

The involuntary interaction of a pilot with an aircraft can be described as pilot-assisted oscillations. Such phenomena are usually only addressed late in the design process when they manifest themselves during ground/flight testing. Methods to be able to predict such phenomena as early as possible are therefore useful. This work describes a technique to predict the adverse aeroservoelastic rotorcraft–pilot couplings, specifically between a rotorcraft’s roll motion and the resultant involuntary pilot lateral cyclic motion. By coupling linear vehicle aeroservoelastic models and experimentally identified pilot biodynamic models, pilot-assisted oscillations and no-pilot-assisted oscillation conditions have been numerically predicted for a soft-in-plane hingeless helicopter with a lightly damped regressive lead–lag mode that strongly interacts with the roll mode at a frequency within the biodynamic band of the pilots. These predictions have then been verified using real-time flight-simulation experiments. The...

Handling Qualities Requirements for Future Personal Aerial Vehicles

This paper describes research to develop handling qualities guidelines and criteria for a new category of aircraft: the personal aerial vehicle, which it is envisaged will demand no more skill to fly than that associated with driving a car today. Testing of concept personal aerial vehicle response types has been conducted with inexperienced “pilots” ranging from private pilot’s license holders through to those with no prior flight experience. The objective was to identify, for varying levels of flying skill, the personal aerial vehicle response type requirements that will ensure safe and precise flight. Conventional rotorcraft response types such as “rate command”, “attitude command/attitude hold” are unsuitable for likely personal aerial vehicle pilots. However, response types such as “translational rate command” and “acceleration command, speed hold” permit “flight-naive” pilots to perform demanding tasks repeatably and with the required precision.