Automatic flight envelope protection for uninhabited air vehicles

[0002] The present invention relates to the field of mission management systems of uninhabited air vehicles, and more particularly to a method and system for automatic flight envelope protection to reduce damage and mishap rates of such vehicles.

[0003] Flight envelope protection is an extension of an aircraft guidance system that prevents the aircraft from exceeding its designed operating limits while in one of the aircraft's standard guidance modes. Modem flight envelope protection features offer automated or semi-automated safety features. In manned aircraft, flight envelope protection is accomplished by the pilot, together with automated systems, using visual, auditory, tactile warning aids, and pilot controls.

[0004] On-ground sensing, usually provided by squat switches, is used to prevent inadvertent activation of ground spoilers and engine reverse thrust. Stall protection systems are used to warn of stalls and prevent stalls from happening. Digital engine controls provide engine protections such as thrust controls and reverse thrust controls.

[0005] These features are designed for the protection of the vehicle and its passengers and are used to prevent the vehicle from exceeding its structural and aerodynamic limitations. Exceeding a vehicle's limitations may lead to damage or complete destruction of the vehicle, termed a mishap.

[0006] Hard protections prevent the pilot from exceeding the flight envelope. Soft protection systems incorporate soft limits that warn pilots of pending or actual envelope exceedance, but allow the pilot to override the limitations.

[0007] With uninhabited (unmanned) aircraft, protection must be achieved automatically without intervention from a ground controller or other outside agent. Existing flight envelope protection systems for manned aircraft alert the pilot, who then must assess the situation and determine what action to take. In the uninhabited aircraft, to achieve automatic flight envelope protection, the method and system must not only be capable of detecting the conditions for alerting, but also determine appropriate corrective actions. This requires sensor signal logic (to replace the pilot's biosensory cues), and control logic, which are capable of overriding other commands (e.g., waypoint navigation) to the aircraft guidance or navigation systems whenever the aircraft enters a guidance condition which is not maintainable.

[0008] Automatic flight envelope protection may be realized as additional software on an existing guidance and navigation processor, or as a separate mission management processor and/or additional sensors and mechanical actuation devices for the aircraft. The main benefit of such protection is to reduce damage and mishap rates of unmanned vehicles by providing designed-in prevention of unsafe or unstable speeds and attitudes from which the vehicle cannot recover.

[0009] Some manned aircraft have extensions of the navigation system for route planning purposes, or have the mission plan or flight plan data entered and stored before initiation of a mission. However, manned aircraft do not usually have onboard planning. Uninhabited aircraft either have groundbased control stations (which, among other things, might transmit preplanned mission data), or mission planning systems (normally on board) which control the execution of the aircraft's mission.

[0010] Presently available mission planning systems for generating guidance or navigation commands for a vehicle (whether it is a ground-based controller, preprogrammed operating sequence, or mission management system) may at times generate commands which the vehicle cannot safely execute. These subsystems are designed prior to flight, and typically use simplified, fleet-wide models of aircraft performance—hence they will occasionally issue commands that a particular vehicle cannot execute.

[0011] For efficiency reasons, users implement fleet-wide envelope protection protocols. These govern all types of vehicles within a fleet. However, certain vehicles require different commands to remain within their flight envelopes. Each vehicle type usually has its own flight envelope. In addition, under various unanticipated flight conditions, mission planning systems may produce completely erroneous outputs for short periods of time. If these commands are simply executed by the guidance, navigation, or control systems they often result in damage to the vehicle or a mishap.

[0012] Some proposed flight envelope protection systems utilize neural networks that have been trained from large sets of known input values. However, these systems cannot detect or respond properly to extreme flight conditions where neither simulated nor measured flight data are likely to be accurate.

[0013] Existing methods of flight envelope protection, which involve the addition or modification of logic hardware in the mission management, guidance and navigation systems, avionics, or primary flight control systems, are not yet fully developed for uninhabited air vehicles, are not sufficiently adaptable to conditions of actual flight, and do not incorporate an integrated systems approach that is capable of balancing vehicle safety with mission objectives under all circumstances. The prior art suffers from:

[0014] limitations and faults of the mission management system and the software which supports it;

[0015] lack of a consistent definition of the flight envelope;

[0016] not linking the flight envelope parameterization to the guidance modes of the system;

[0017] not detecting when the flight envelope is about to be exceeded;

[0018] inadequately defining a corrective action, due to dependence on the availability of input from a pilot; and,

[0019] poor integration with existing mission management, guidance navigation, and flight control systems.

[0020] Automatic Flight Envelope Protection (AFEP) is embodied in software and computational hardware which augments existing guidance, navigation and/or control systems of Uninhabited Air Vehicles (UAV's) (also termed Unmanned, or Autonomous Air Vehicles). These include but are not limited to Cruise missiles, Unmanned Reconnaissance Vehicles (URV's), or Remotely Piloted Vehicles (RPV's). The invention automatically prevents UAV's from flying outside of their safe operating limits when they are subject to guidance commands generated by on-board mission planning systems or ground-based control systems.

[0021] The embodiments of the invention involve means of defining the flight envelope that are specifically suited to UAV'S, means of anticipating and detecting actual or expected exceedance of the flight envelope and means of generating corrective actions which maintain the vehicle within the envelope, while maintaining vehicle controllability and awareness of UAV mission objectives. In addition, this invention includes new means of integrating these features into a system which is interoperable with conventional aircraft guidance, navigation, control, propulsion, and avionic subsystems.

[0022] The invention is a novel mission execution system that is capable of dynamically switching between levels: mission planner/ navigation/ guidance/ flight control. The approach is “memory-less” in that it detects and corrects problems with immediate operating conditions and guidance commands, but relies on existing “memory” of the status of other subsystems (guidance, flight control) to store state information about the system.

[0023] The flight envelope protection algorithms are the lowest level of the vehicle management system, and their corrective actions are inserted between the navigation system 20 and the guidance or flight control system 30. When the current operating point of the aircraft approaches the flight envelope too closely, or from the wrong direction, corrective actions will override or modify the navigation system inputs to the guidance system or the normal guidance system 20 inputs to the primary flight control system 30. The invention retains intact the primary flight control functions, which are usually already designed for safety in the event of equipment failures (but not for other types of mishap prevention).

[0024] The AFEP algorithms accept inputs from air data to determine the current operating point within the flight envelope, from the guidance system 20 primarily the guidance mode and heading command, and from the mission planning system 40 to determine corrective actions which are most compatible with mission parameters, viz., tactical objectives. The flight envelope and current operating point are updated dynamically based on current air and vehicle data.

[0025] The algorithms dynamically determine the most critical distance of the current operating point from the boundary of the flight envelope, and the normal (approach) component of speed, and then compute corrective actions consistent with these parameters. This is preferably done by a “bounding polytope” method.

[0026] The algorithms use the “virtual actuator” (Aerodynamic Control Effector, or ACE) concept to allocate force among available physical actuators. The invention also uses aerodynamic control effectors to simplify the choice of actuators to implement control actions. The advantage of this approach is that ACE systems automatically adopt effective actuator forces and operative limits in the event of equipment failure or battle damage, so that no additional changes are required in the AFEP system. In the event that an ACE system is not available, the AFEP system can be designed to operate with a fixed set of physical actuators.

[0027] The AFEP algorithm contains hybrid logic that selects the corrective action based on the guidance mode of the aircraft, if any.

[0028] AFEP is intended to reduce damage and mishap rates of such vehicles, particularly when they are subject to guidance commands that would otherwise cause the vehicle to become uncontrollable and/or to exceed other operating limits which would cause permanent damage or destruction to the vehicle or its components. The AFEP concept is typically executed onboard the aircraft rather than on the ground. A concomitant benefit is the improvement in mission success rates and UAV availability, since mission success normally requires vehicles to remain operational. Another benefit is to improve the safety of other (manned or unmanned) vehicles which must interoperate with UAV's in commercial or military airspace.

[0029] FIG. 1 is a logical representation of UAV Onboard Signal Processing, showing the addition of AFEP blocks.

[0030] FIG. 2 is a flow chart representing the processing steps within the AFEP block.

[0031] FIG. 3 is a functional chart representing the processing steps for flight envelope protection for UAVs.

[0032] The invention is embodied in the mission management, guidance, navigation, control (GNC) and avionics systems architecture of the unmanned air vehicle. The relationship of the AFEP system to the other existing subsystems is shown in FIG. 1. The invention incorporates executable computer programs, and may also include a separate processor unit (CPU) upon which this code is executed, additional sensor interfaces, and/or interfaces to various aircraft subsystems.

[0033] In some embodiments, these elements might be implemented as separate hardware components or as extensions to existing computing, sensor, or vehicle control subsystems. Otherwise, FIG. 1 may be interpreted as a software process block diagram. How those elements are implemented depends on the particular vehicle. If the vehicle has an adaptable processing unit the invention need only extend its abilities, if the vehicle does not have adequate sensing devices, the invention would incorporate the required sensors. Regardless of how they are implemented, however, the interfaces in FIG. 1 are significant to the invention in the following sense:

[0034] (1) The AFEP unit 10 is logically interposed between the navigation and guidance system 20 and the flight control system 30.

[0035] (2) The AFEP unit 10 receives inputs from the mission planner 40, from the vehicle avionics subsystem 23; it may receive inputs from additional sensor or payload subsystems 27.

[0036] (3) The AFEP unit 10 produces outputs to the flight control system 30 or override switch 21 and (if it is present) to the mission management system 40.

[0037] In varying embodiments, these subsystems may be merged, or may be absent, or may be implemented via a ground data link and pilot-in-the-loop, without affecting the fundamental signal flow shown in FIG. 1.

[0038] The top-level logic of the flight envelope protection software is shown in FIG. 2. The steps in this logic are now described:

[0039] Next Mission Command 100—A waypoint or mission command is obtained from the mission management system 40. Without AFEP, this command (possibly after some preliminary calculations) is fed directly to the navigation 20 and/or guidance 25 system to be executed. With AFEP, this command is pre-evaluated to determine whether it is within the flight envelope of the vehicle, and is overridden 21 by an achievable command from the AFEP system if this is not the case. This modification of the data path includes the fact that this system examines one command in advance of the command currently executed.

[0040] Interpolate Next Step 110—Normally, a mission level command will require path interpolation, which is often done partly or completely by the navigation system 20. If not, then this function needs to be performed in the AFEP system; if so, then the AFEP system needs to obtain incremental waypoint outputs from the navigation system 20.

[0041] Exceed Envelope Limits 120 (decisions)—The next interpolated step is evaluated to determine whether it exceeds envelope limits. These limits may include the consideration of both vehicle and earth-centered coordinates, and generally require dynamic updates based on vehicle avionics sensor 23 inputs to the AFEP system 10 (as indicated in the higher level diagram in FIG. 1). If limits are exceeded, the AFEP logic (see subsequent steps) is invoked; if not, then the original mission plan is executed (by issuing the planned command to the guidance system), and this test is re-applied at the next interpolated step of the flight plan. Each mission command is pre-tested before it is issued, and the flight envelope limits are calculated on-line.

[0042] Calculate corrected command 130—In this step the originally planned command is modified so that the flight envelope will not be exceeded. In the most typical case of a gradual exceedance of the envelope, the command will be corrected in such a way as to move along the flight envelope in the direction of the original command, as projected onto the surface of the envelope (more complex logic being used when multiple surfaces, such as corners, are approached). In the case of an interruption or discontinuity in the command sequence, a replan will be sought and limit protection will be based on recent command history prior to the anomaly. This step calculates corrected commands that achieve short term envelope avoidance.

[0043] Notify planner of Envelope Violation 140—The mission planning software is notified of envelope violations, since these may have long term implications for the mission plan. In one embodiment, the invention uses available online (viz., either on-board, or ground station based) replanning methods if these are available. If so, the replanner will compute a modification of the long term mission plan and update the current mission plan. Thus, this step corrects for long term implications of unintended flight envelope penetration, which cannot be resolved without consideration of the entire mission objectives and resource availability. In the event that a replanner is not available, the method continues to seek the best approximation, within the operating envelope capabilities of the aircraft, to the original plan.

[0044] Send Command to Flight Control System 150—The new command (with or without correction) is issued to the flight control system 30. Although this represents the normal command pathway, it may be viewed as novel within the current context, because of the fact that the flight envelope corrections do not require modifications to the normal Flight Control System. In the present case, very short term errors are corrected by the action of the flight control system itself.

[0045] Measure Aircraft State 160—The aircraft state is measured to determine that the command is being executed as planned. This step is standard, and is often performed within the control system.

[0046] Mission command Completed 170 (decision)—The mission command is evaluated vs. plan to determine whether the plan is being executed correctly. If not, the envelope limiting cycle will be initiated once again.

[0047] The steps “exceed envelope limits”, “calculate corrected command”, and “measure aircraft state” are now described in greater detail.

[0048] Exceed Envelope Limits Logic

[0049] The concept of “flight envelope” is normally applied to situations where some subset of the generalized coordinates of the vehicle (normally, either position or momentum variables) are held at (quasi) static values, and one considers “points” in position momentum space which are operationally feasible. One can consider all possible constant settings of any subset of actuators 70, and represent all (six) generalized position and (six) generalized momentum (or velocity) coordinates of the vehicle. Normally, a primary flight control system (PFCS) 30 loop is required for these flight conditions to be stable in the sense that the derivatives of some combination of position or momentum variables are constant; normally, the PFCS 30 itself has modes, and one can consider that these might be further employed. Aside from modifying dynamics, the effect of a PFCS 30 is to provide static (as well as dynamic) coupling of certain control variables, which has the effect of constraining the effective flight envelope, so that the new inputs to the PFCS 30 replace the original inputs to individual actuators 73, 75. This can be modeled as follows:

[0050] {dot over (x)}_E=u^Ecos θ cos ψ+v^E(sin φ sin θ cos ψ−cos φ sin ψ)+w^E(cos φ sin θcos ψ+sin φ cos ψ)

[0051] {dot over (y)}_E=u^Ecos θ sin ψ+v^E(sin φ sin θ sin ψ+cos φ cos ψ)+w^E(cos φ sin θsin ψ−sin φ cos ψ)

[0052] {dot over (z)}_E=−u^Esin θ+v^Esin φ cos θ+w^Ecos φ cos θ

[0053] {dot over (φ)}=p+(qsin φ+rcos φ)tan θ

[0054] {dot over (θ)}=q(cos φ−rsin φ

[0055] {dot over (ψ)}=(qsin φ+rcos φ)sec θ

[0056] where for wind W,

[0057] u^E=u+W_x;v^E=v+W_y;w_E=w+W_z  (1)

[0058] are the generalized position equations (1), and the generalized momentum equations (2) are:

[0059] X−mg sin θ=m({dot over (u)}^E+qw^E−rv^E)

[0060] Y+mg cos θ sin φ=m({dot over (v)}^E+ru^E−pw^E)

[0061] Z+mg cos θ cos φ=m({dot over (w)}^E+pv^E−qu^E)

[0062] L=I_x{dot over (p)}−I_zx{dot over (r)}+qr(I_z−I_y)−I_zxpq+qh′_z−rh′_y

[0063] M=I_y{dot over (q)}rp(I_x−I_z)+I_zx(p²+r²)+h′_x−ph′_z

[0064] N=I_z{dot over (r)}−I_zx{dot over (p)}+pq(I_y−I_x)+I_zxqr+ph′_y−qh′_x  (2)

[0065] where h′=[h′_x, h′_y, h′_z,] are the components of the net rotor inertias relative to the body frame of the aircraft and are assumed to be constant or slowly varying with respect to time. In these equations [X, Y, Z] and [L, M, N] are the aerodynamic forces and moments which include the control forces and moments. The net result of the feedback laws in the form (3), where error and measurement noise terms have not been explicitly shown are:

[0066] {right arrow over (F)}=[X,Y,Z,L,M,N]′={right arrow over (F)}(x_E,y_E,z_E,u^E,v^E,w^E,φ,θ,ψ,p,q,r,{overscore (u)},{overscore (v)},{overscore (w)},{overscore (p)},{overscore (q)},{overscore (r)})  (3)

[0067] In this example, the commanded velocity and angular rates are shown by overbars (in other autopilot configurations, attitude and altitude may also be controlled). One expression of the flight envelope is obtained by setting the time derivatives in (1), (2), subject to (3), equal to zero. The flight envelope can be derived from the vector set of equations (4):

[0068] {right arrow over (G)}=[{dot over (u)}^E,{dot over (v)}^E,{dot over (w)}^E,{dot over (p)},{dot over (q)},{dot over (r)}]′=0  (4)

[0069] by solving for the actual steady rates (u, v, w, p, q, r) in terms of the commanded velocity and angular rates, and then finding the envelope of all solutions of (u, v, w, p, q, r) as the commanded variables are varied (noting that at several extremes of the flight envelope, the actual steady rates will not be equal to the commanded steady rates due to nonlinearities in the aerodynamic terms, and due to the limits in the ranges of the commanded variables).

[0070] For every point on the flight envelope there exists at least one set of extreme PFCS inputs and/or modes which holds that point in steady flight. An alternative view is that if the vehicle is in steady flight at a particular point in the flight envelope, then an inversion of the dynamic map of the aircraft (with the PFCS in place, if appropriate) can be used to evaluate whether a commanded change in position or orientation is within the marginal control authority that is available at the current operating point. In other words, the inversion map shows the changes in controls required in order to achieve a commanded change in position or orientation. The commanded change is within the flight envelope if the changes in all controls are within their admissible ranges of motion (and/or motion rates).

[0071] The V-N envelope is normally derived by assuming that there is a longitudinal axis control system, and that the roll and yaw commands (and actual steady rates) are set to zero. It expresses the relationship of vertical force (m{dot over (w)}^E) and actual forward speed (u), as a function of the implicit variables commanded climb rate ({overscore (w)}) and forward speed ({overscore (u)}). The V-H envelope is also derived for the longitudinal axis control problem, but for the case of an altitude hold condition (commanded z_E). In this mode, the controller controls altitude (z) while holding altitude rate (w) to zero.

[0072] The online computation of an inverse mapping could be demanding, therefore an alternative embodiment, is as follows:

[0073] (a) An inner approximation of the flight envelope (in any number of dimensions, to any specified degree of accuracy) can be obtained as the intersection of half-spaces. Each half-space can be specified by a normal vector and distance from the origin of the envelope coordinates (5).

[0074] {right arrow over (n)}·{right arrow over (e)}≧d_i,∀i=1, . . . N  (5)

[0075] where n_iis the normal vector to the I-th face of the flight envelope, e is a vector from the origin to a test point in the plane of the flight envelope, and N is the number of faces of the flight envelope (with higher N providing greater accuracy); d_iis the distance of the ith face of the approximating region from the origin in the coordinates of the flight envelope.

[0076] (b) The current operating point (which is estimated from air data and other onboard sensors) can be also represented as a vector. By taking the inner product of this vector with each of the normal vectors, and subtracting it from the distance of the envelope, one can tell from the set of signs of all of these quantities whether the operating point is inside or outside of the flight envelope, and in fact can determine the distance to the nearest face of the polytope approximation of the flight envelope, as well as which face it is on.

[0077] s_i=sgn({right arrow over (n)}_i·{right arrow over (e)}−d_i);δi_i=|{right arrow over (n)}_i·{right arrow over (e)}−d_i|  (6)

[0078] (c) The distance from the flight envelope and if appropriate, speed of motion of the operating point toward the nearest boundary can be used to determine to a first approximation whether corrective action is required.

[0079] Calculate Corrected Command Logic

[0080] (d) If corrective action is required, the duration, direction and magnitude of thrust required for envelope avoidance (e.g., within a specified time) can be calculated. Normally, the corrective thrust will be applied in a direction that is normal to the closest face of the flight envelope. Using the Aerodynamic Control Effector (“ACE”) concept, actuators can be chosen in such a way that the desired force can be applied. At this time, the mission management system 40 is notified that the flight envelope boundary is near to the operating point, so that re-planning may occur. The definition of the particular boundary also may include which face of the envelope is being approached.

[0081] (e) Constant offsets are applied to the inputs of the PFCS 30 for the desired period of time. Monitoring of the operating point continues according to (a)-(d). During this time, mission re-planning should occur, so that the envelope is avoided; alternatively, the mission management system 40 may issue an “override” command to disable the flight envelope protection algorithm if an excursion from the flight envelope is considered to be necessary for vehicle survival.

[0082] (f) Control offset action ceases when the operating point is again within safe distance of the flight envelope. This may occur due to the shift of the operating point from the correction applied in (e), from a change in the mission command, or due to vehicle or atmospheric changes. It is possible that the operating point will now exhibit “chattering” or “sliding” in the plane of the (nearest hyperplane inner approximation to the) flight envelope boundary; this is not an error, but should be expected under certain conditions. This sliding motion will continue until the operating point finds a (possibly local) minimum which is least inconsistent with the mission command inputs; in some cases, it is possible that a slowly osculating pattern of motion of the operating point on one or more hyperplanes just inside the flight envelope boundary will be encountered. These should be viewed as normal occurrences which are consistent with, and in fact, required by, the nature of the flight envelope protection problem. During this motion, the mission planning algorithm will be repeatedly notified of the proximity of the operating point to the boundary.

[0083] (g) When flight envelope protection action is no longer required, the offsets to the PFCS 30 are removed by deactivating the override logic 21, and return to normal flight is automatic. The proposed flight envelope protection algorithm leaves the PFCS 30 inner loop algorithms and limit protections in place, and does not introduce any additional short term dynamics (e.g., delays or integral action) into the system. Therefore, the PFCS 30 continues to operate as designed throughout the flight envelope protection intervention. Since the magnitude of the offset actions is continuously “phased in” near the boundary, the PFCS 30 is not subjected to any large disturbances. Since an “inner” polytope approximation of the flight envelope is used, there remains a small amount of residual control authority available to the PFCS 30 as the boundary is approached; the ACE (equivalent effector) approach will automatically select the most effective combinations of control surfaces to achieve the boundary avoidance. Finally, if the vehicle slightly exceeds the flight envelope (e.g., due to a gust or transient dynamics), the flight envelope protection algorithm will continue to act in a consistent manner to return it to the nearest point inside the boundary.

[0084] FIG. 3 depicts the data flow of the processing steps for flight envelope protection. The AFEP 10 receives feedback states from a sensor signal system 35, a mission management system 40 and a guidance and navigation system 24 and sometimes a payload system 27. The AFEP 10 calculates, a control command signal from these feedback and command signal inputs to determine if the vehicle is approaching its flight envelope. Any control signals that fall outside the flight envelope are modified appropriately to fall within the flight envelope. All signals conforming to the flight envelope are transmitted to the primary flight control system 30 which executes the mission commands.

[0085] Accordingly, it should be readily appreciated that the method and system for automatic flight envelope protection to reduce damage and mishap rates of uninhabited vehicles of the present invention has many practical applications. This invention may be applied to unmanned vehicles, cruise missiles, and remotely piloted vehicles as well as other types of vehicles. Additionally, although the preferred embodiment has been illustrated and described, it will be obvious to those skilled in the art that various modifications can be made without departing from the spirit and scope of this invention. Such modifications are to be considered as included in the following claims unless the claims expressly recite differently.