A Trusted Autopilot Architecture for Gps-denied and Experimental Uav Operations

Unmanned and autonomous systems require a great deal of human trust, especially in order to gain acceptance for high-risk mission applications. In the aerial domain, loss of vehicle control, crashing or leaving the safety of the designated range can present a hazard to human safety as well as property. This represents a key barrier in current safety review processes when considering an experimental autopilot. Our approach couples a trusted autopilot with the experimental autopilot in order to facilitate testing and evaluation of immature technology, while ensuring safety is maintained. Such a system performs in a similar manner to the analogous scenario where an experienced human co-pilot oversees an unexperienced pilot. The Merlin trusted autopilot architecture is presented here, leveraging visual odometry as an additional redundancy in the standard GPS/IMU navigation system, while also integrating novel failsafe behaviors representative of the many dangerous failure situations that are commonly encountered on a UAV test range. In addition, this robust autopilot architecture, with its multiple redundancies, failsafe behaviors and system monitoring functions, presents an appealing platform for testing new and experimental UAV flight packages. Custom hardware has been developed to host this trusted autopilot with an openinterface approach in order to facilitate extensibility to these experimental designs. Initial architecture design and results from testing of the failsafe behaviors and visual odometry navigation system are presented.