System and method for human operator intervention in autonomous vehicle operations

[0001] This disclosure relates generally to control systems for autonomous vehicles, and, in particular, systems for allowing multiple remote human operators to intervene in the operations of autonomous vehicles.

[0002] Unmanned Aerial Vehicles (UAVs) have been used in applications, such as surveillance and agriculture, for years. Some UAVs are capable of performing tasks autonomously, while others require human operators to control them. For example, autonomous UAVs may be launched with instructions to perform certain mission tasks—such as navigating to a destination, taking photos, etc.—and can perform these tasks without human intervention.

[0003] In existing UAV systems, human operators are usually connected to vehicles in a one-to-one relationship. With such relationships, the systems assume that a single human operator will always be reliable and available to intervene on the behalf of the autonomous vehicles, should the need arise. Such one-to-one systems are not fault-tolerant, though, as human operators can become unavailable, communication links can fail, and the like.

[0004] Embodiments discussed herein are related to methods and systems for fulfilling a service request from a user, using an unmanned aerial vehicle.

[0005] In one embodiment a computer server receives an assistance request associated with an autonomous vehicle and selects a remote vehicle operator from a group of remote vehicle operators, where each remote vehicle operator has a control device. The computer server or the control device of the selected remote vehicle operator receives a situation report associated with the autonomous vehicle and an operator message based on the situation report may be sent to the control device.

[0006] An operator command may be received from the control device, and a vehicle command based at least in part on the operator command may be sent to the autonomous vehicle. The vehicle command is configured to cause the autonomous vehicle to change from a first path to a second path.

[0007] The autonomous vehicle is configured to store a command verification value, and to broadcast a status message comprising that command verification value. The autonomous vehicle is also configured to receive a vehicle command that contains a command verification value.

[0008] The autonomous vehicle includes a finite state machine, and is configured to transition from one active state to another state, based on the vehicle command. However, the autonomous vehicle will only transition from one active state to another state if the transition is valid, and if the command verification value in the vehicle command is valid when compared to the command verification value stored by the autonomous vehicle.

[0009] Other embodiments are disclosed herein. The features, utilities and advantages of various embodiments of this disclosure will be apparent from the following description of embodiments as illustrated in the accompanying drawings.

[0022] While the present disclosure has been described with reference to various embodiments, it will be understood that these embodiments are illustrative and that the scope of the disclosure is not limited to them. Many variations, modifications, additions, and improvements are possible. Modules and procedures may be separated or combined in different ways in various embodiments, or described with different terminology. These and other variations, modifications, additions, and improvements may fall within the scope of the disclosure as defined in the claims that follow.

[0023] This document describes an autonomous vehicle system that delivers fault-tolerance and reliability by enabling an autonomous vehicle to be operated by at least one operator from a pool of operators. By utilizing a pool of operators, each operator potentially having a separate communications link, the autonomous vehicle system is able to reduce or minimize the risk that comes with relying on a single operator. The system also provides consistency between commands issued by dispersed operators by resolving conflicts in a structured and predictable way.

[0024] In this disclosure, the autonomous vehicle system is primarily illustrated by way of a practical embodiment in the form of an Unmanned Aerial System (UAS) that operates UAVs. However, the system disclosed herein may be used across many different autonomous vehicle types. For example, in addition to the UAS, which is disclosed herein, this system could also be used to implement a reliable autonomous taxi system using self-driving cars. Similarly, a remote pool of human operators could be used to improve the reliability of autonomous factory robots, etc.

[0025] Unless otherwise noted, the present description of the autonomous vehicle system in connection with the UAS applies equally to other forms of autonomous vehicles. Nevertheless, details that apply to other forms of autonomous vehicles may be noted where they are helpful or illustrative.

[0026] The UAS system described herein provides a platform for performing various target functions, including, but not limited to, package delivery, data capture, mapping, surveillance, and infrastructure provisioning. While specific embodiments of the UAS system are described herein, some embodiments may comprise systems and methods that are not generally relevant to every target function. One skilled in the art will readily recognize the relevance of a recited system or method in relation to the target functions.

[0027] Unmanned Aerial System (UAS)

[0028] The UAS disclosed in this document is an example implementation of an autonomous vehicle system that provides facilities for remote vehicle operator intervention, in real-time, during otherwise autonomous vehicle operations. In this embodiment the autonomous vehicle system corresponds to the UAS, while the individual autonomous vehicles correspond to the UAVs. Moreover, as used herein, the term “autonomous” may refer to operations of an unmanned vehicle that are performed by the vehicle without user intervention and/or control, as well as to describe vehicles that are designed to operate without human intervention and/or control for all or portions of their missions. Accordingly, a vehicle and/or a system may be described as autonomous even though a human operator may choose to override the vehicle's autonomous control.

[0029] FIG. 1A illustrates an embodiment of a UAS and interfacing entities. In this embodiment, the UAS 100 receives a service request from a service requestor 104 and deploys a UAV 102 to fulfill that request. In the event that the UAV 102 encounters a situation that its onboard automation cannot understand or handle (or a human operator becomes aware of a situation that warrants human intervention), the UAS 100 is able to provide human intervention by selecting a remote vehicle operator 108 who can issue commands to the UAV 102. In this embodiment, the UAS 100 comprises a distribution center 101, a UAV 102, and global services 103.

[0030] The service requestor 104 is a human user or an autonomous system that issues a service request to the UAS 100. In the case where the service requestor 104 is a human user, that user may use a remote client device such as a mobile phone, tablet, or personal computer to issue the request. A service request is an instruction to the UAS 100 to provide some service at the destination site 105. The destination site 105 may be any designated location, such as a portion of open ground, a building, a mailing address, a GPS coordinate, or a slice of airspace. In some embodiments, the destination site 105 is the location of a beacon device. The beacon device may be any device that emits a signal that can be used to track or identify a location, such as for example a transponder, a mobile phone, etc. The destination site 105 may also be designated by identifying a particular object, such as, for example, a designated vehicle, a mailbox, a delivery pad, or some other target object that can be tracked to indicate a target location for a service. In another embodiment, the destination site 105 is the location of the service requestor 104, although this need not be the case. Although one service requestor 104 and one destination site 105 are illustrated in this embodiment, in practice there can be many service requestors 104 and destination sites 105.

[0031] The requested service may be any service that can be provided from an airborne platform. For example, in one embodiment, the service request issued by the service requestor 104 is a request to deliver a package containing a specific payload to the destination site 105. In another embodiment, the service request is a request to capture image data using a camera mounted on the UAV 102, at the destination site 105 or along a route to and from the destination site 105. In yet another embodiment, the service request is a request to provide an Internet access point at the destination site 105 using a Wi-Fi gateway mounted on the UAV 102. Many other services can be provided using the UAS 100 at the destination site 105, such as package pickup, surveillance, mapping, data capture using UAV-mounted instruments, etc.

[0032] As mentioned previously, in this embodiment of an autonomous vehicle system, the autonomous vehicle is a UAV 102. In other embodiments of the autonomous vehicle system, the autonomous vehicle may be a self-driving car or truck, a warehouse robot, a manufacturing robot, etc.

[0033] The UAV 102 is an Unmanned Aerial Vehicle. The UAV 102 can be implemented using a variety of systems and airframes. Almost any practical flying platform can be used as the vehicle base for the UAV 102, including gliders, airplanes, balloons, helicopters, etc. In one embodiment, the UAV 102 is implemented using a fixed-wing aircraft with redundant propulsion systems that is optimized for long-range flight. In another embodiment, the UAV 102 is implemented using a quad-rotor aircraft that is optimized for short-range flight and vertical takeoff and landing. In yet another embodiment, the UAV 102 is implemented using a hybrid fixed-wing aircraft, with tilt-rotors, capable of both long-range flight and vertical takeoff and landing. In another embodiment, the UAV 102 is implemented using a fixed-wing aircraft with fixed horizontally oriented motors, configured to provide horizontal thrust, and separate fixed vertically oriented motors configured to provide vertical thrust. The UAV 102 may also be implemented using a lighter than-air-platform such as a balloon, blimp, or other dirigible. One purpose of the UAV 102 in the UAS 100 is to serve as a flexible platform that can be rapidly deployed on demand, with minimum human involvement.

[0034] Although the UAV 102 is an autonomous vehicle that is designed to operate without human assistance in most scenarios, it may occasionally require the intervention of a human controller or pilot. For instance, a global systems operator 106 or a distribution center operator 107 may issue a recall command to the UAV 102 while it is on a mission, due to some external issue, such as inclement weather, a canceled delivery, etc. The UAV 102 may also proactively request human assistance while it is on its mission. For example, the UAV 102 may encounter an environment where its vision and/or navigation algorithms cannot produce a path with a high degree of reliability. In such a scenario, the UAV 102 will send a request for assistance to the global services 103. The global services 103 will select a remote vehicle operator 108 to handle the situation, and that operator can send the UAV 102 one or more commands to help it navigate its environment.

[0035] The UAV 102 may carry any suitable payloads, depending on the nature of the service request received from the service requestor 104. Components of the UAV 102 are explained in more detail in the description for FIG. 2. Although a single UAV 102 is depicted in FIG. 1, there may be more than one UAV 102 in a UAS 100.

[0036] The distribution center 101 is a fixed or mobile facility that facilitates the launch, recharge, communications, repair, and payload logistics for the UAV 102. The distribution center 101 is explained in further detail in the description for FIG. 3. Although a single distribution center 101 is shown in FIG. 1A, there may be more than one distribution center 101 in the UAS 100. In one embodiment, each UAV 102 in the UAS 100 is based at a single distribution center 101, and is repaired, reloaded, and recharged at that distribution center 101. In another embodiment, each UAV 102 can be repaired, reloaded, and recharged at any distribution center 101 in the UAS 100, and UAVs 102 may be routed between distribution centers 101 based on the logistical requirements of current service requests and the projected requirements for future service requests.

[0037] The global services 103 may be comprised of one or more computer server systems, running software services (i.e. computer software programs), accessible through the Internet, which provide offsite support, administration, air traffic control, communications, data storage and logistics functions for the distribution centers 101 and the UAVs 102. In one embodiment, the global services 103 route a service request from a service requestor 104 to a distribution center 101 that is geographically adjacent to (or in relative geographic proximity to) the destination site 105.

[0038] The global services 103 may also receive requests for assistance from the UAV 102 while it is on its mission. Based on such requests, the global services 103 will select a remote vehicle operator 108 from a pool of operators, and provide data about the UAV 102's environment to the remote vehicle operator 108. Based on this provided data, the remote vehicle operator 108 can provide one or more commands to the UAV 102 to help it surmount any problems that its on-board intelligence cannot handle. The global services 103 are explained in more detail in the description for FIG. 4A.

[0039] The global system operator 106 may be a human user that monitors and operates the UAS 100 to ensure the correct and efficient functioning of the system. For example, in some embodiments, the global system operator 106 may monitor the UAS 100 through the computer servers of the global services 103, to ensure that a distribution center 101 has the appropriate payload in stock to fulfill a service request from a service requestor 104. In one example embodiment, the global system operator 106 may use the global services 103 to route new stock of a particular payload to a distribution center 101 in anticipation of that payload stock being depleted.

[0040] There may be more than one global system operator 106, and the global system operators 106 may monitor and provide services for multiple distribution centers 101, UAVs 102, and service requestors 104.

[0041] The distribution center operator 107 is a human user that monitors and operates the distribution center 101. The distribution center operator 107 may ensure that the UAS 100 components that are local to the distribution center 101 function correctly. This includes the UAVs 102 based at the distribution center 101, as well as other components such as launchers, rechargers, payloads, etc. The distribution center 101 provides systems and methods to facilitate the tasks of the distribution center operator 107. For example, in some embodiments, the distribution center operator 107 operating a distribution center 101 is provided with an operator interface that allows her to determine the inventory of each type of payload at that distribution center 101, and that enables her to order more of any type of payload that is in short supply. The distribution center systems and methods that facilitate the distribution center operator 107's work are explained in more detail in the description for FIG. 3.

[0042] The remote vehicle operator 108 is a human user that receives information about the UAV 102 from the global services 103 and may issue commands to the UAV 102 to help it complete its mission. In one embodiment of the system there is a pool of available remote vehicle operators 108 that can provide assistance to any UAV 102 in the system. When the global services 103 receive a request for assistance from a UAV 102, it selects from among the available remote vehicle operators 108 and routes the request to that operator. The remote vehicle operator 108 reviews information about the circumstances of the UAV 102 and sends one or more commands to the UAV 102. Based on these commands, the UAV 102 takes actions that help it to complete its mission. In one embodiment, the roles of the global system operators 106 and the remote vehicle operators 108 are merged. The remote vehicle command process is discussed in more detail in connection with the descriptions for FIG. 4, FIG. 5, and FIG. 6.

[0043] FIG. 1B illustrates one embodiment of a UAV launch process implemented by the UAS 100. As an initial step the global services 103 of the UAS 100 receive 150 a service request from a service requestor 104. The service request specifies a destination site 105, which designates the location where the service is to be delivered. As described herein, the service request may also include payload information, corresponding to a payload requested by the service requestor. The global services 103 then select 151 a suitable distribution center 101 from which to fulfill the service request. In some embodiments, the global services 103 select 151 the distribution center 101 from which to fulfill the service request by determining the distribution center 101 that is closest to the location of the destination site 105. In another embodiment, the global services 103 select 151 a distribution center 101 to fulfill the service request by taking into account both the proximity of the distribution center 101 to the destination site 105 as well as an inventory at the distribution center 101 that indicates the availability of a payload specified in the service request. For example, if the service request is a request to deliver a specific type of item to the destination site 105, the global services 103 will select the distribution center 101 from those distribution centers that are near the destination site 105 and have the requested item in their inventory. Other factors can also be used to select a distribution center 101, such as, for example, the local weather conditions and air traffic at the distribution centers 101.

[0044] Once a distribution center 101 is selected 151, at least a portion of the information in the service request is sent 152 to that distribution center 101. In addition to the destination site location and payload information, the service request may contain other information that is useful at the distribution center 101 for the fulfillment of the service request. For example, in some embodiments, the service request further comprises a time designating when the service request should be fulfilled at the destination site 105.

[0045] A UAV 102 can be selected 153 to fly a mission to fulfill the request, either during the distribution center selection process or afterwards. The UAV 102 that will fly the mission may be selected 153 based on one or more criteria that are relevant to the service request and/or system efficiency. For example, in one embodiment, the UAV 102 is selected 153 based on the charge level of its battery and the distance to the destination site 105. In another embodiment, the UAV 102 is selected 153 based on the instruments that are installed on its airframe and a type of data capture specified in the service request. In yet another embodiment, the UAV 102 is selected 153 based on a package in its payload matching a package specified for delivery in the service request.

[0046] In an alternative embodiment, the UAS 100 does not select from pre-configured UAVs for a given mission. Instead, either the distribution center 101 or the global services 103 determine a set of components that are required to complete the service request, and the distribution center 101 causes a UAV comprising the required components to be assembled for the mission. For example, if the destination site 105 is a certain distance from the distribution center 101, the UAV for the mission can be configured with a suitable battery pack and engines to complete a round-trip flight to that destination.

[0047] The selection 153 of the UAV 102 may occur after the selection 151 of the distribution center, or may be used as a factor in selecting 151 the distribution center 101. For example, the distribution center 101 may be selected 151 from only those distribution centers that have a particular type of UAV airframe, UAV battery, or UAV engine, based on the weight of a payload required by the service request.

[0048] Once the UAV 102 is selected 153 for the mission, mission data is generated 154 for it. The mission data is information that enables the UAV 102 to navigate to the destination site 105 and fulfill the service request. In some embodiments, the mission data includes GPS coordinates for the destination site 105 as well as flight corridor information facilitating navigation to those GPS coordinates. The flight corridor information is discussed in more detail in the descriptions for FIG. 2A and FIG. 3. Further details related to the mission data are discussed in the descriptions for FIG. 2A, FIG. 3, and FIG. 4A. After the mission data is generated 154, it is uploaded into a database on the UAV 102.

[0049] Once the mission data is generated and uploaded 154, the UAV 102 is launched 155. From the time the UAV 102 is launched and until it lands again, it is considered to be on a mission to complete the service request. In one embodiment, the UAV 102 may be launched with a mission to fulfill more than a single service request. In another embodiment, at least a part of the mission data is uploaded and perhaps even generated, after the UAV 102 is launched 155.

[0050] Unmanned Aerial Vehicle (UAV)

[0051] In this disclosure, the embodiment of the autonomous vehicle system described is a UAS 100, where the individual autonomous vehicles are UAVs 102.

[0052] FIG. 2A is a block diagram of a UAV 102 according to one example embodiment. The UAV 102 is an aircraft system with hardware and software modules that enable it to fulfill service requests with little or no human supervision. In one embodiment, the UAV 102 is comprised of a commercially available airframe that is modified to include additional hardware and software modules that enable it to fly autonomously and complete a service request. In another embodiment, the UAV 102 is comprised of a purpose-built airframe with integrated hardware and software modules that enable autonomous operation. The embodiment of the UAV 102 illustrated in FIG. 2A comprises a mission planner 200, a flight controller 201, a sensor system 202, a communications system 203, an actuator control system 204, a propulsion management system 205, a payload management system 206, and a safety system 207. In an embodiment of the UAV 102, two or more of the modules mentioned above may be combined into a single hardware component to reduce complexity, improve reliability, reduce weight, and/or reduce cost. For instance, in one example embodiment, the mission planner 200 and the flight controller 201 may be implemented using software modules that run on the same System On Chip (SOC) hardware.

[0053] Although not depicted in the figure, the modules of the UAV 102 are interconnected via at least one communications bus. The bus allows the modules to communicate with each other to receive and send information and commands. The bus may be implemented using any of the methods known to those with familiarity in aviation and vehicle engineering. For example, the bus may be implemented using the Controller Area Network (CAN) standard. To improve the reliability of the system, embodiments may use additional redundant buses. For example, a dual-CAN bus can be implemented to prevent a bus failure from causing the UAV to lose control.

[0054] The mission planner 200 is a module that provides the other modules of the UAV 102 with high-level directives and goals; the execution of these directives and goals causes the UAV 102 to fulfill a service request. The goals and directives produced by the mission planner 200 are communicated to the other modules of the UAV 102, which may then take other actions to complete a mission, including the generation of additional directives and goals for other modules of the system.

[0055] For instance, in one embodiment, the mission planner 200 determines a set of waypoints that the UAV 102 may traverse in order to reach a destination site 105, and provides the location of a first waypoint to the flight controller 201 as a goal, along with a directive to fly to that location. In this embodiment, the flight controller 201 may then, in turn, compute the orientation and propulsion needed to move the UAV 102 towards the goal location; the flight controller 201 may also generate further directives for other modules, such as, for example, for the actuator control system 204 and for the propulsion management system 205. The directives sent to the actuator control system 204 and the propulsion management system 205 may cause them to take actions that change the orientation of the UAV 102 and propel it towards the goal location. As a result of the actions taken by various modules in the UAV 102 in response to the directives and goals of the mission planner 200, the UAV 102 will fly to the designated first waypoint. Once that goal is achieved, the mission planner 200 may send new goals and directives to the other modules, such that the UAV 102 flies to a second waypoint, and a third waypoint, and so on, until the higher-level goal of reaching the destination site 105 is fulfilled.

[0056] Besides movement directives, the mission planner 200 may issue other directives to the modules of the UAV 102 that cause actions such as dropping of a payload, capturing of image data, transmitting of data, etc. The mission planner 200 may also receive commands from the global services 103, from human operators, or from third-party controllers (such as air traffic controllers), and may issue directives to the UAV 102 modules based on these commands. For instance, in one example embodiment, the mission planner 200, on board a UAV 102, may receive a command from a human operator to fly back to a distribution center 101 due to an approaching storm. In response to this command, the mission planner 200 will produce new goals and directives that are sent to other modules in the UAV 102, and as a result of these new goals and directives, the UAV 102 will change course and return to the distribution center 101.

[0057] In one embodiment, the mission planner 200 comprises a finite state machine 208. The finite state machine 208 is a data structure that organizes when and under what circumstances the mission planner 200 issues goals and directives to the other components of the UAV 102, during the course of the UAV 102's mission. Conceptually, the finite state machine 208 comprises a plurality of vehicle states and corresponding valid transitions between those states. At least one of the vehicle states is active at all times during the UAV 102's mission. The mission planner 200 broadcasts goals and directives, over the communications bus, to the other modules of the UAV 102, based on the current vehicle state. The finite state machine 208 transitions from one vehicle state to another vehicle state as the mission progresses, and when the finite state machine 208 enters a new vehicle state, the mission planner 200 may broadcast new goals and directives to the other modules of the UAV 102. For example, in one embodiment, the UAV 102 includes the vehicle states: launch, nominal flight, hold position, deliver package, return, and landing. In this embodiment, the mission planner 200 may begin the mission in the launch state. In the launch state the mission planner may give the flight controller 201 the goal of making the UAV 102 take off. Based on that goal, the flight controller 201 may increase the thrust provided by the engines and may lower the flaps on the wings by issuing directives to the actuator control system 204 and the propulsion management system 205. Once the vehicle is airborne, the finite state machine 208 may transition to the nominal flight state. In the nominal flight state, the mission planner 200 may send the flight controller 201 a directive to fly to a particular goal destination. Once the UAV 102 reaches the destination, the finite state machine 208 may transition to the deliver package state. Based on the deliver package state, the mission planner 200 may send directives to both the flight controller 201 and the payload management system 206, such that the destination site is safely approached, and the payload is released.

[0058] The finite state machine 208 may be represented using a variety of different data structures and can be implemented using a variety of hardware, software, or hybrid hardware-software methods. In one embodiment the finite state machine 208 is implemented by creating a technical specification defining the vehicle states and valid state transitions, and then compiling the technical specification to produce an executable or object code that represents the defined states and transitions. In this embodiment, the executable or object code can be stored in a computer storage medium—such as random access memory, hard disc storage, flash memory—in the UAV 102. In another embodiment the technical specification may be translated into a hardware design that can be implemented using one or more hardware modules.

[0059] The finite state machine 208 also plays a role in the execution of commands received from external sources, such as remote vehicle operators 108, global system operators 106, and distribution center operators 107. These and other functions of the finite state machine 208 are discussed in further detail in the descriptions for FIG. 5, FIG. 6A, and FIG. 6B.

[0060] The mission planner 200 is provided with mission data prior to the launch of the UAV 102 from the distribution center 101. The mission data includes information that enables the mission planner 200 to locate the destination site 105, to determine an appropriate route to that location, and to perform any request-specific actions required to complete the service request. For example, in some embodiments, the mission planner 200 is provided with a destination location, a route to the destination location, and a series of points along the route where images are to be captured with an on-board camera.

[0061] In some embodiments, the mission data includes a local skymap for an area of operation. The area of operation is a geographic region that encompasses the distribution center 101 and the destination site 105. The local skymap includes information about a plurality of flight corridors within the area of operation. In some embodiments, the local skymap is generated from a global skymap, which contains information about flight corridors within a wider geographic area, by selecting the information in the global skymap that pertains to flight corridors within the area of operation.

[0062] A flight corridor is an area of airspace that is designated by the UAS 100 for UAV flight. The local conditions in a flight corridor may be monitored by the UAS 100, and the flight corridors may be used by the UAVs 102 to travel safely and efficiently between locations. The local skymap comprises information about each of a plurality of flight corridors. The information about each flight corridor may include, but is not limited to, data about the flight corridor's location, local wind conditions, local air traffic (i.e. other UAVs and aircraft within the flight corridor), precipitation, aerial hazards, geographic obstacles (e.g. mountains), etc.

[0063] Using the information in the skymap, the mission planner 200 develops a dynamic route from the distribution center 101 to the destination site 105, prior to launch or soon after launch. The dynamic route takes into account the goals of the mission as well as the requirement of the UAV 102 to return to a distribution center 101 after fulfilling the service request. In some embodiments, the mission planner 200 receives a pre-generated route from the distribution center 101 or the global services 103, and modifies that route only as conditions in the skymap change over time.

[0064] The dynamic route is a sequence of flight corridors that the UAV 102 may traverse to fly from its present location to some goal location. As the UAV 102 flies its mission, it may receive updates to the skymap from the UAS 100, including updates concerning local conditions of the flight corridors in the area of operation. The updates may be received from the global services 103, from the distribution centers 101, or from other UAVs 102. In some embodiments, updates may also be received from the service requestors 104, or from third-parties, such as weather information providers, news services, air traffic controllers, satellites, civil aviation authorities, law enforcement, military aviation authorities, etc.

[0065] The mission planner 200 may modify the dynamic route during the mission as the flight corridor updates are received. For example, in some embodiments, the mission planner 200 may alter the dynamic route to avoid flight hazards such as inclement weather, aircraft trespassing into a flight corridor, etc. When the route is modified, the mission planner 200 will re-determine the sequence of flight corridors that will be traversed to reach the goal location.

[0066] FIG. 2B illustrates one embodiment of the mission planner 200's dynamic routing process for a goal location. In the illustrated process the UAV 102 first receives 250 an initial local skymap. The skymap may be received prior to launch or after launch. In one embodiment, a skymap is received from the global services 103 directly. In another embodiment, a skymap is received from the distribution center 101.

[0067] In one embodiment, the skymap that is provided to the UAV 102 is a global skymap that contains data about the entire area that the UAS 100 covers. In another embodiment, the skymap contains information about only the area of operation for the UAV 102's current mission.

[0068] Once the skymap is received 250 the mission planner 200 computes 251 a traversal cost for each flight corridor in the area of operation. The traversal cost for a flight corridor is a measure of the suitability of the corridor's path for a flight to the goal location. The goal location may be any point that the UAV 102 must traverse to complete its mission. For example, the destination site 105 may be the goal location on the outward leg of the UAV 102's mission, while the distribution center 101 may be the goal location on the return leg of the UAV 102's mission. The traversal cost of a flight corridor may take into account many factors, including but not limited to, the wind speed and weather in the flight corridor, the air traffic within the flight corridor, the length and elevation of the flight corridor, and the number and direction of maneuvers required to navigate the flight corridor. The traversal cost for a flight corridor may take into account the predicted energy consumption necessary to fly the UAV 102 along the flight corridor's path. Flight corridors that are predicted to require greater energy to traverse may be assigned a greater traversal cost than flight corridors that require less energy. For example, a flight corridor that has a tailwind may have a lower traversal cost than a flight corridor with a headwind. The traversal cost may also take into account regulatory limits to flight paths. For example, if a flight corridor intersects an area that has been temporarily designated as a no-fly zone by the local aviation authority, the traversal cost for that flight corridor may be set to infinity until the no-fly restriction is lifted.

[0069] In some embodiments, the traversal cost for flight corridors is pre-computed by the global services 103 or the distribution center 101, and is included in the skymap received 250 by the UAV 102.

[0070] After the traversal cost for each flight corridor in the skymap is computed 251 the mission planner 200 determines 252 a lowest cost route from the UAV 102's current position to the goal location, using the flight corridors. Any appropriate path-finding and/or graph traversal algorithms can be used to find the lowest cost route, including the A* algorithm, Dijkstra's algorithm, and other similar algorithms known to those with skill in the art.

[0071] Once the lowest cost route is determined 252, the UAV 102 will traverse 253 the lowest cost route. As the UAV 102 flies to the goal location, it may periodically receive information from the global services 103, the distribution centers 101, other UAVs 102, and third-party information sources (such as weather services, aviation authorities, etc.). Any of the data received from such sources may constitute a local skymap update, in the sense that the traversal cost of one or more flight corridors in the area of operations may need to be changed. For example, if the weather in a particular region changes, the traversal cost of flight corridors in that region may increase or decrease depending on the wind in those flight corridors and the direction that the UAV 102 must fly.

[0072] The mission planner 200 may determine 254 whether a given piece of data received by the UAV 102 constitutes a local skymap update by applying rules and heuristics to the received information. For example, in some embodiments, if the mission planner 200 receives information that pertains to regions outside the area of operations, it may determine that this information does not constitute a local skymap update.

[0073] Some information that the UAV 102 receives may be filtered out from consideration because it is not related to factors that may affect the flight of an aircraft. For example, if the UAV 102 receives information regarding inventory levels at a distribution center 101, this information may be stored or forwarded, but it will not influence the local skymap, since inventory levels will not influence the traversal cost of flight corridors. (Note, however, that changing inventory levels may influence the mission planner 200's selection of a goal destination. For example, after a service request has been fulfilled, a UAV 102 may be routed to land at a distribution center 101 where there are insufficient UAVs in the inventory for future missions, as opposed to the distribution center that it took off from.)

[0074] As long as the mission planner 200 determines 254 that no data requiring an update to the local skymap has been received, the UAV 102 continues to fly on the lowest cost route that has already been determined 252. However, if a local skymap update has been received, then the mission planner 200 will update 255 the traversal cost for each affected flight corridor in the local skymap.

[0075] The mission planner 200 will then re-determine 252 the lowest cost route to the goal location based on the updated traversal costs of the flight corridors in the local skymap.

[0076] As illustrated in FIG. 2A, the UAV 102 also includes a flight controller 201. The flight controller 201 provides the mission planner 200 with guidance, navigation, and control functions. For example, the mission planner 200 is required to know the location, orientation, altitude, and speed of the UAV 102 at various times during the mission, and the flight controller 201 provides this information through a process called state estimation. Similarly, when the mission planner 200 requires the UAV 102 to move from one point to another, it sends commands to the flight controller 201 to achieve that goal. The flight controller 201 communicates over the bus with the sensor system 202, the actuator control system 204, and the propulsion management system 205, to provide the guidance, navigation, and control functions.

[0077] The sensor system 202 provides information from sensor instruments to the flight controller 201. In some embodiments, the sensor system 202 comprises several instruments, such as, for example, a Global Positioning System (GPS) unit, an Inertial Measurement Unit (IMU), dynamic pressure sensor, static pressure sensor, air temperature reader, etc.

[0078] The actuator control system 204 includes motorized actuators (or actuators that are moved by any other means, such as hydraulics) that control various moving parts on the UAV 102, including the control surfaces on the airframe. The actuator control system 204 can change the state of the motorized actuators based on commands from the flight controller 201. The actuator control system 204 can also report the current state of the motorized actuators back to the flight controller 201.

[0079] The propulsion management system 205 controls the force exerted by the engines mounted on the UAV 102—for example by adjusting the speed of propellers mounted on a propeller powered UAV—and monitors the amount of fuel and/or battery capacity remaining on the UAV. The flight controller 201 can adjust the speed of travel of the UAV 102 by communicating with the propulsion management system 205.

[0080] The flight controller 201 receives information from the sensor management system 202 and the actuator control system 204, and performs a state estimation that provides a best guess of the UAV 102's position, orientation, and speed to the mission planner 200. The state estimation is continuously updated and checked as the various systems of the UAV 102 provide new information.

[0081] The mission planner 200 determines the high-level goal location that the UAV 102 must travel to and communicates the goal location to the flight controller 201. The mission planner 200 may communicate directives and goals to the flight controller 201 using any appropriate technique(s). For example, in one embodiment, the mission planner 200 communicates movement goals to the flight controller 201 via a sequence of waypoints. In another alternative embodiment, the mission planner 200 communicates movement goals to the flight controller 201 via splines.

[0082] The flight controller 201 receives the movement goals—as waypoints, splines, or any other suitable form—and determines, based on rules or physics-based models, the commands that must be communicated to the actuator control system 204 and the propulsion management system 205 to achieve the movement goals. For example, according to some embodiments, the physics-based models output the required rudder and elevator state, and the engine thrust for the UAV 102, based on the current state estimation (i.e. the UAV 102's position, orientation, and speed), and the local conditions including wind and temperature.

[0083] The communications system 203 comprises transmitters and receivers that enable the UAV 102 to send and receive information using different communications protocols. The communications system 203 may include transmitters and receivers for standard cellular radio technologies such as CDMA, GSM, 3G/4G, LTE, etc., as well as custom line-of-sight and mesh protocols that allow the UAV 102 to directly communicate with a distribution center 101 or another UAV 102.

[0084] Although the UAV 102 is designed to operate autonomously, the mission planner 200 is configured to receive instructions via the communications system 203 that may override the mission planner 200's flight plans. For example, the UAV 102 may receive instructions from a distribution center 101 or the global services 103 that command the UAV 102 to return to base immediately due to bad weather or a passenger aircraft entering the area. On receiving such a command the mission planner 200 will change the movement goals of the UAV 102 and issue new directives to the other modules, so that the UAV 102 adjusts its flight path as necessary.

[0085] Since there are potentially many external parties that could issue commands to the UAV 102, and since the communications links between the UAV 102 and the parties issuing commands may not be reliable, a mechanism may be helpful to ensure that the UAV 102 does not execute contradictory or stale commands. In one embodiment, the finite state machine 208 is used by the mission planner 200 to determine the validity and precedence of commands received from external sources, and to determine the directives and goals that should be sent to the other modules of the UAV 102. This process is described in more detail in the description for FIG. 5.

[0086] The payload management system 206 performs various functions related to the payload carried by the UAV 102, depending on the nature of the service request and the payload. For example, when the payload is attached to the UAV 102 prior to launch, the payload management system 206 will communicate that the attachment is successful to the mission planner 200 and/or the distribution center 101. In the case where the service request is a package delivery, the payload management system 206 also monitors the state of the payload—for example the temperature of the payload in the case where the payload is perishable—and manages the release of the payload at the destination site 105. In this example, the mission planner 200 determines the location, altitude, speed, and orientation of the UAV 102 required to drop the payload safely at the destination site 105, and communicates a command to release the payload at the appropriate time to the payload management system 206. The payload management system 206 receives the command and releases the payload.

[0087] The payload management system 206 may perform other functions depending on the nature of the payload. For example, in the case where the service request is related to surveillance or mapping, the payload management system 206 may interface with a camera system included in the payload and can capture images or video based on instructions received from the mission planner 200. For instance, in this embodiment, the mission planner 200 may issue a command to the payload management system 206 to capture images when the UAV 102 flies over some point of interest in its route.

[0088] The safety system 207 manages various failsafe components mounted on the UAV 102. For example, in one embodiment, the safety system 207 monitors and controls a parachute system that may be deployed based on a command received from the mission planner 200, or based on information received directly from the flight controller 201 or sensor system 202. For instance, if the UAV 102 enters a non-recoverable dive, the safety system 207 may deploy the parachute based on data received from the sensor system 202. In another embodiment, the mission planner 200 may instruct the safety system 207 to deploy a parachute based on a message received from the global services 103 or a distribution center 101. Parachute deployment on command may be useful in situations where an air traffic control process detects the possibility of imminent collision between multiple aircraft in an area with heavy air traffic. Forcing a UAV 102 to deploy its parachute and descend may prevent it from entering the flight path of other aircraft.

[0089] The structure and functionality of the UAV 102 described above has been divided into modules based on one example implementation, but the functionality of various modules may be merged or further split such that there are more or less components than have been illustrated in FIG. 2A. It is also possible to devolve some of the functionality of the various modules directly into the actuators, sensors, and other hardware components of the UAV 102. For instance, the flight controller 201 may communicate directly with a plurality of actuator motors, each of which has the functionality of the described actuator control system 204. Such a decentralization of hardware component control may be beneficial in some implementations from the point of view of fault-tolerance.

[0090] In an autonomous vehicle system, the autonomous vehicles need not be aerial vehicles. In one embodiment, instead of UAVs, the system employs ground-based vehicles, such as self-driving cars, autonomous tractors, autonomous factory robots, etc.

[0091] Distribution Center

[0092] The distribution center 101 handles the local logistics for the UAS 100. When the global services 103 receive a service request from a service requestor 104, the global services 103 will select a distribution center 101 to fulfill the service request according to criteria in the service request, including the location of the destination site 105. The global services 103 will then send at least a portion of the information in the service request to the selected distribution center 101.

[0093] The distribution center 101 is responsible for launching and recovering UAVs 102, maintaining and monitoring inventories of payloads and UAVs 102, and communicating local information to the global services 103. Other functions such as UAV or component selection for missions, mission data preparation, UAV monitoring and communication during the mission, and other tasks can be performed by either the distribution centers 101 or the global services 103, depending on implementation and/or system status. A distribution center operator 107 may be stationed at the distribution center 101 to facilitate the distribution center operations.

[0094] FIG. 3 is a block diagram of a distribution center 101, according to one example embodiment. As mentioned previously, some of the functions performed by this embodiment of the distribution center 101 could be performed by the global services 103 instead. Similarly, some of the functions of the global services 103 could be performed locally by the distribution center 101. System designers with skill in the art may divide the functionality of the global services 103 and the distribution centers 101 in any appropriate way based on the requirements of a particular UAS implementation.

[0095] In this embodiment, the distribution center 101 is comprised of a propulsion inventory management system 301, a payload inventory management system 302, a verification and launch system 303, a distribution center management system 304, an operator interface 312, and a UAV inventory management system 313.

[0096] The distribution center management system 304 serves as the hub of the distribution center 101. In this embodiment, the distribution center management system 304 comprises a mission manager 305, sensor station 306, communications station 307, logistics system 308, skymap database 309, terrain map database 310, and interface handler 311. In one example embodiment, the distribution center management system 304 is implemented using one or more computer servers that have specialized sensor and communications peripherals installed.

[0097] Some of the functions of the distribution center 101 may require the assistance of a human distribution center operator 107. For example, UAV assembly, UAV repair, payload attachment and detachment, UAV recovery, battery replacement, and refueling are tasks that may require human involvement if they are not fully automated. The operator interface 312 allows the distribution center operator 107 to receive information and instructions from the distribution center management system 304 and the global services 103, as well as to send information and instructions back to the distribution center management system 304 and the global services 103. The distribution center management system 304 communicates with the operator interface 312 via the interface handler 311. In some embodiments, the operator interface 312 is an application running on a smartphone, a tablet computer, or a personal computer, and the interface handler 311 communicates with the application via a wireless communications protocol, such as IEEE 302.11.

[0098] The mission manager 305 is a module that is responsible for managing the local aspects of mission operations at the distribution center 101. In some embodiments, the mission manager 305 receives service requests (or data derived from the service requests) from the global services 103, selects a UAV 102 or UAV components that will be assembled into a UAV 102, prepares the mission data that will be utilized by the UAV 102 during the mission, selects an appropriate payload for the mission, tests and launches the UAV 102, and monitors the status of the UAV 102 and payload during the mission. The mission manager 305 communicates with the distribution center operator 107 via the operator interface 312 during various stages of the mission to communicate both the status of the mission, as well as instructions indicating the actions to be taken to facilitate the preparation, loading, launch, and recovery of UAVs 102.

[0099] The mission manager 305 utilizes the other components of the distribution center management system 304 to monitor the status of the local environment and various local components of the UAS 100, including the UAVs 102 and the local inventories.

[0100] The mission manager 305 maintains contact with the global services 103 and local UAVs 102 through the communications station 307. Information about service requests is received from the global services 103, and information about local conditions, ongoing missions, inventories, etc., is transmitted back to the global services 103. The communications station 307 may have transmitters and receivers for several different standard telecommunications protocols, including, but not limited to GSM, CDMA, GSM, 3G/4G, LTE, etc. In addition to these standard protocols, the communications station 307 may also support line-of-sight or mesh protocols to enable direct communications with UAVs 102 and other distribution centers 101. Finally, the communications station 307 may also include a wired connection to the Internet for high-speed communication with the other components of the UAS 100 and third-party information providers. The mission manager 305 may send some of the information received via the communications station 307 to the operator interface 312, so that the distribution center operator 107 can monitor the status of UAVs 102 or other components of the UAS 100 that are relevant to a local mission.

[0101] The sensor station 306 is primarily used to gather local weather data for the distribution center 101's location. The sensor station 306 may include pressure sensors, thermometers, wind sensors, precipitation detectors, etc. The sensor station 306 may also be used to detect and track UAVs 102 using instruments such as radars, radio trackers, and optical object recognition systems. The mission manager 305 may present information from the sensor station 306 to the distribution center operator 107 via the operator interface 312, so that the distribution center operator 107 can take actions necessary to protect the UAVs 102 and distribution center 101 from inclement weather. For example, if the sensor station 306 detects an approaching storm, the mission manager 305 may display a notification to the distribution center operator 107 via the operator interface 312, and the distribution center operator 107 can follow procedures to recover UAVs 102 that have already been launched, to abort missions that have not been launched, and the like.

[0102] The logistics system 308 tracks the inventory levels of various components at the distribution center 101, and reports these inventory levels to the global services 103 and the mission manager 305. This inventory information may be used when selecting a particular distribution center 101 to fulfill a service request.

[0103] The logistics system 308 interfaces with the propulsion inventory management system 301, the payload inventory management system 302, and the UAV inventory management system 313 to determine the inventory levels of fuel/batteries, payloads, and UAVs/UAV components, respectively. The logistics system 308 is capable of requesting deliveries of additional stock when inventory levels fall below a threshold level or when inventory levels are predicted to fall below a threshold level within a specified period of time.

[0104] The global services 103 may monitor the inventory levels reported by the logistics system 308 and may proactively dispatch additional inventory items to a distribution center 101 based on current inventory levels or the predicted inventory levels in the future. The logistics system 308 may also directly notify the distribution center operator 107 of inventory shortages, or of errors with specific items in an inventory, via the operator interface 312. Based on these notifications, the distribution center operator 107 may restock or repair items as needed.

[0105] Each item at the distribution center 101 may be affixed with a tracking tag that can be monitored by the logistics system 308. Various technologies can be used to implement the tracking tags, including bar codes, RFID tags, NFC tags, etc. These tags may be affixed to every item at the distribution center 101 that requires tracking, including UAVs 102, UAV components, payloads, batteries, spare parts, etc. The tags associate an object identifier with each tracked physical object at the distribution center 101. For example, each payload at the distribution center 101 will have an object identifier associated with it that is indicated by the tag affixed to it. The object identifier may be read from the tag by way of a reader that is configured to scan the tag. For example, an RFID tag would be read using an RFID reader, an NFC tag using an NFC reader, etc.

[0106] The object identifiers can be used to determine the type of an object that has been scanned as well as its unique identity. For example, the tag affixed to a payload object will identify that the object is a payload of a specific type, as well as that it is a specific instance of that payload, different from other payloads of the same type in the inventory. In some embodiments, the object identifier can be used to determine a database entry associated with the object in an inventory database.

[0107] The logistics system 308 reports the inventory levels for objects associated with each object identifier to the global services 103.

[0108] Propulsion related components of the UAVs, such as batteries and/or fuel, are stored and tracked by the propulsion inventory management system 301. The propulsion inventory management system 301 also has means for recharging batteries, refilling fuel tanks, etc. The propulsion inventory management system 301 reports the inventory levels and status of fuel and/or batteries to the logistics system 308. For example, the propulsion inventory management system 301 may track not only the number of batteries stocked at a particular distribution center 101, but may also track the level of charge in each of those batteries and the expected time for each battery to reach full charge. Additional properties of batteries may also be tracked, such as battery capacity, charge retention over time, etc.

[0109] The mission manager 305 is made aware, via the logistics system 308, of the battery charge levels and/or fuel available for UAVs prior to a mission launch. The mission manager 305 determines the energy resources that are required for each UAV 102 based on the service requests and may instruct the distribution center operator 107 to replace batteries on a UAV 102 or to refuel a UAV 102 to ensure that the aircraft has sufficient energy to complete a mission. For example, the mission manager 305 may instruct the distribution center operator 107, via the operator interface 312, to load a battery having a particular charge state onto a specific UAV 102 prior to that UAV 102 being launched on a mission.

[0110] The payload inventory management system 302 tracks inventory levels and status for various payloads that may be mounted to the UAVs 102. The payload inventory management system 302 may also provide recharging, refrigeration, and other maintenance related functions related to specific payloads. For instance, if the payload is a vaccine, then the payload inventory management system 302 may provide a refrigerated storage container for vaccine doses and may monitor and report the temperature in the storage container and the number of doses stored in the container to the logistics system 308. The mission manager 305 may notify the distribution center operator 107 of the status of various payloads stored at the distribution center 101 via the operator interface 312. For example, in some embodiments, the mission manager 305 may send a notification to the operator interface 312 to notify the distribution center operator 107 that a particular vaccine stored in the payload inventory management system 302 has expired. Based on this notification the distribution center operator 107 may remove the expired vaccine from storage and replace it with new stock.

[0111] The UAV inventory management system 313 tracks the assembled UAVs 102 and UAV components stored at the distribution center 101, and reports this information to the logistics system 308. The mission manager 305 or global services 103 may query the logistics system 308 to determine the UAV resources available for missions at a particular distribution center 101, and may allocate these resources based on the requirements of service requests received by the UAS 100. When a particular UAV configuration is required to fulfill a mission, the mission manager 305 may send instructions to the distribution center operator 107, via the operator interface 312, to assemble a particular set of UAV components—stored in the UAV inventory management system 313—to construct a UAV suitable to complete that mission. As UAVs or UAV components are added and removed from the inventory, the UAV inventory management system 313 tracks not only the availability of these resources, but also the status of components, such as their condition and need for replacement. This information may be used by the mission manager 305 and the global services 103 to order deliveries of new UAVs 102 or components for the distribution center 101.

[0112] The mission data that will be uploaded to the UAV 102 is prepared based on the requirements of the service request received from the global services 103. Although we discuss the preparation of the mission data by the mission manager 305, alternative embodiments are possible, where either the global services 103 or the mission planner 200 onboard the UAV 102, prepare the mission data. The mission data includes not only the location of the destination site 105 and the payload required to satisfy the service request, but also information required to generate a flight route to the destination location. The information required for route generation is stored locally in the skymap database 309 and the terrain map database 310.

[0113] The skymap database 309 contains data about a plurality of flight corridors in the geographic region served by the distribution center 101. The skymap database 309 may be at least partially synchronized with a global skymap database 400 that is part of the global services 103. The flight corridor data includes information about the real-time conditions within the flight corridors, such as weather, air traffic, etc. The local skymap database 309 updates the flight corridor data based on the latest information received from the global services 103, other distribution centers 101, and third parties (such as weather services and air traffic controllers). UAVs 102 that have recently flown in a flight corridor may also send data to the distribution center 101 about the last monitored conditions present in the flight corridor, and this information may be used by the skymap database 309 to update the relevant flight corridor data. When the local skymap database 309 at the distribution center 101 has more recent information about a flight corridor than the global skymap database 400, the global skymap database 400 is updated via the communications station 307. The reverse is also true, and the latest updates from the global skymap database 400 are received via the communications station 307 and incorporated into the local skymap database 309.

[0114] The terrain map database 310 contains terrain data, which is information about the terrain and ground obstacles in the geographic region served by the distribution center 101. This terrain data can be stored in a number of ways, including but not limited to, as raw images, as a heightmap, and as a three-dimensional (3D) mesh. The global services 103 also include a global terrain map database 401, which is at least partially synchronized with the local terrain map database 310. As in the case with the skymap databases, the terrain map database 310 is updated based on data captured from UAVs 102 during their mission flights. For example, if a UAV 102 flies over a location and captures information regarding a new obstacle that was not present at that location in the terrain map database 310, the terrain map database 310 will be updated with the new information via data received from the UAV 102, either during the mission, or after the UAV 102 has been returned to the distribution center 101.

[0115] Although the information about the flight corridors from the skymap database 309 may be sufficient to route the UAV 102 to the destination site 105, information about the ground that the UAV 102 is flying over can also be useful during various phases of the mission. For instance, during UAV launch and recovery, the terrain and obstacles near the launch and recovery sites are relevant. In addition, if the service request requires a package delivery, then the terrain and obstacles at the destination site 105 are relevant, as the UAV 102's mission planner 200 must determine a location from which to drop the payload such that the payload lands in an accessible place and does not damage local structures, objects, or persons.

[0116] The information from the terrain map database 310 is also useful for fulfilling service requests that require surveillance or mapping. In some instances, the terrain data from the terrain map database 310 can be used to fulfill a surveillance or mapping request without launching a UAV. For example, if a UAV 102 has recently captured imagery at a destination site 105 at a particular location, and a subsequent service request asks for image capture at the same location, within some threshold time limit, then the most recent information from the destination site 105 that has been stored in the terrain map database 310 can be sent to the service requestor 104.

[0117] To prepare the mission data locally, the mission manager 305 first determines the location of the destination site 105 from the service request information received from the global services 103. Based on this destination location, and the launch location, which is typically the location of the distribution center 101, the mission manager 305 determines the relevant area of operations for the mission, and extracts the data associated with this geographic region from the skymap database 309 and the terrain map database 310. The extracted information is sent to the UAV 102 as part of the mission data. In some embodiments, the mission manager 305 also provides the UAV 102 with a lowest cost route to the destination site 105 as part of the mission data. Depending on the implementation, the route can be dynamically updated by the global services 103, the mission planner 200 in the UAV 102, and/or the mission manager 305. When the connectivity to the UAV 102 cannot be guaranteed during the mission flight, the mission planner 200 onboard the UAV 102 may be allowed to dynamically update the route. The process for dynamic route generation is explained in more detail in the description for FIG. 2B. In embodiments discussed in connection with FIG. 2B, the UAV 102 receives the skymap data and determines the lowest cost route to the destination site 105 using the onboard mission planner 200, instead of receiving the route from the mission manager 305.

[0118] In some embodiments, the UAV 102 stores complete mirrors of the skymap database 309 and the terrain map database 310, instead of only subsets of the information in these databases. This can be done when the size of the databases is small enough that the storage resources on the UAV 102 are sufficient to store the entire dataset. When this is not the case, a subset of the information may be stored in the UAV 102, as described earlier. Similarly, in the case where the local skymap database 309 and local terrain map database 310 have sufficient storage capacity, the entire global skymap database 400 and global terrain map database 401 may be stored locally at the distribution center 101. Subsets of the global data may be extracted and stored locally only when the global data sets are too large for complete local mirroring to be economical.

[0119] The verification and launch system 303 is responsible for testing, verification, and launching of UAVs 102. The UAVs 102 are loaded into the verification and launch system 303, and their components are tested to ensure that they will perform during the mission. Any faulty components are identified at this stage and brought to the attention of the distribution center operator 107 via the operator interface 312. The verification and launch system 303 also verifies, via the affixed tags, that each component in the assembled UAV 102 is a component allocated by the mission manager 305 for the current mission. For example, the verification and launch system 303 detects the battery and engines attached to the UAV 102, and ensures that they have adequate charge and performance for the mission, prior to launch. Any discrepancies are brought to the attention of the distribution center operator 107 for correction. Similarly, the verification and launch system 303 verifies that the payload loaded onto the UAV 102 is the right payload for the current mission.

[0120] Once the verification and launch system 303 verifies the UAV 102, the UAV 102 is launched, and the mission manager 305 continues to monitor the aircraft during the mission flight. The mission manager 305 receives status updates from the UAV 102, and these status updates enable the mission manager 305 to track the progress of the mission at least intermittently. The mission manager 305 may present information related to the UAV 102's status to the distribution center operator 107 via the operator interface 312. In the event that there is some local event that requires a mission termination, such as, for example, an approaching storm, either the mission manager 305 or the distribution center operator 107 (or both), via the operator interface 312, can send a command to the UAV 102, through the communications station 307, to instruct the UAV 102 to return to the distribution center 101.

[0121] The structure and functionality of the distribution center 101 described above has been divided into modules based on one example implementation, but the functionality of various modules may be merged or further split such that there are more or fewer components than have been illustrated in FIG. 3. For instance, it is possible to implement many parts of the distribution center management system 304, including the mission manager 305, communications station 307, logistics system 308, and interface handler 311 on a single piece of computer hardware, such as a computer server or embedded SOC. Similarly, the different inventory management systems could be merged under a single inventory manager, while the verification and launch system 303 could be split into a separate verification system and launch system.

[0122] Global Services

[0123] The global services 103 are a collection of software services running on one or more computer servers, accessible through the Internet or another communications protocol. In one example embodiment, the global services 103 are software modules running on virtual machines in a third-party data center, such as Amazon Web Services or Google Cloud.

[0124] One purpose of the global services 103 is to provide a global infrastructure to coordinate, support, and manage multiple distribution centers 101, service requestors 104, and UAVs 102. However, in some embodiments, it is conceivable that the functionality of the global services 103 is provided by a local computer server, and that the server serves a local set of UAVs 102, distribution centers 101, and service requestors 104—possibly only a single one of each.

[0125] One or more global system operators 106 and remote vehicle operators 108 connect to the global services 103 and provide human intervention for systems that cannot be fully automated (or require temporary human assistance). The global system operators 106 and remote vehicle operators 108 typically connect to the global services 103 through control devices. A control device may be a computer workstation, a personal computer, a tablet device, a smartphone, or any other computing device that can communicate through a network with the global services 103. For instance, in one example embodiment, a global system operator 106 uses a laptop computer, with an Internet connection, to connect to the global services 103 executing on a computer server, which is also connected to the Internet.

[0126] In the example embodiment illustrated in FIG. 4A, the global services 103 are configured to serve a plurality of distribution centers 101, UAVs 102, and service requestors 104. In this embodiment, the global services 103 comprise a global skymap database 400, a global terrain map database 401, a data manager 402, a service request handler 403, a global logistics manager 404, an air traffic control system 405, a system interface manager 406, and a remote vehicle manager 407.

[0127] As discussed earlier, the global skymap database 400 and the global terrain map database 401 are global repositories for skymap and terrain map data in the UAS 100. As was the case with the local versions of these databases, the information in these databases can be represented in various ways depending on the needs of the UAS 100. Although these databases are represented as single units in the illustrated embodiment, in practice the databases may be implemented using several mirrored data stores to provide improved read speed, redundancy, and error recovery.

[0128] The data manager 402 manages data-writes into, and data-reads out of the global databases. For example, as updates to the local skymap databases 309 and local terrain map databases 310 are communicated to the global services 103, the data manager 402 ensures that the information is stored in the appropriate database and that the latest information is always available and is not overwritten by out-of-date information. The data manager 402 also manages information received from outside of the UAS 100 and integrates this information into the global databases. For instance, information received from third-party weather information providers, aviation authorities, and external air traffic controllers may be integrated into the global skymap database 400. Similarly, third-party topographical data, map imagery, and surveillance data may be integrated into the global terrain map database.

[0129] The data manager 402 also manages the updates sent to the local databases at each distribution center 101. In one embodiment, as the global skymap database 400 and global terrain map database 401 are updated, the data manager 402 will monitor the regions where those updates are relevant, and will send at least a portion of those updates to distribution centers 101 that are in the relevant regions. In another embodiment, the mission manager 305 at a distribution center 101 in a particular region will periodically request information about that region from the global services 103, and the data manager 402 will determine the set of information that is relevant to that region from the global databases, and will send that information to the distribution center 101, where the information may be integrated into the local databases. Similarly, a UAV 102 in flight may request information about its current location from the global services 103, and the data manager 402 may similarly determine the relevant information that should be sent back to the UAV 102 based on the UAV 102's location.

[0130] The service request handler 403 manages service requests sent by service requestors 104 that are received by the global services 103. When a service request is received by the global services 103, the service request handler 403 will communicate with the global logistics manager 404 to determine a distribution center 101 that is suitable for handling the service request locally. As mentioned previously, the selection of the distribution center 101 may take into account not only the location of a destination site 105 specified in the service request, but also the logistic requirements of the request, such as payload, UAV capability, etc. For instance, a service request may include information that specifies a payload type required to complete the request, and the distribution center 101 may be selected based on the availability of that payload type at various distribution centers 101.

[0131] The payload type may be specified directly by means of a payload identifier associated with a type of payload, or it may be specified by implication. For example, a camera payload may be specified by implication if the service request is a request for image data at the destination site 105.

[0132] In some embodiments, the service request handler 403 takes input from a global system operator 106 to determine the distribution center 101 that will be used to fulfill a service request.

[0133] Once the distribution center 101 and UAV 102 have been identified and reserved to fulfill a service request, the service request handler 403 may notify the service requestor 104 that the service request is in process. The service request handler 403 may also receive information from the distribution center 101 and/or the UAV 102 that allows a predicted time of mission completion to be estimated and sent to the service requestor 104.

[0134] The service request handler 403 is capable of communicating with the service requestor 104 via the system interface manager 406. A human service requestor 104 will typically send a service request to the global services 103 by means of some remote client device such as a mobile phone, a tablet, or a personal computer. The system interface manager 406 is capable of sending information to the client device operated by the service requestor 104 that is configured to be displayed on the client device. For example, in one embodiment, the system interface manager 406 functions as a web server, and the client device connects to the web server and displays a web page that is downloaded from the system interface manager 406. In this example, the service requestor 104 can receive and send information to the global services 103 via the displayed web page. In another embodiment, the system interface manager 406 exposes an application interface over the Internet (such as a representational state transfer, or “REST” interface), and an application running on the client device is configured to display information received from the global services 103 to the service requestor 104, and to send information inputted by the service requestor 104 back to the global services 103.

[0135] The service request handler 403 may also play an active part in determining the route a UAV 102 takes on a mission to complete a service request. For example, the service request handler 403 may use the system interface manager 406 to query a service requestor 104 for the precise location of the destination site 105, and the information provided by the service requestor 104 may be used to refine the flight route used by the UAV 102 in fulfilling the service request.

[0136] The structure and functionality of the global services 103, described above, has been divided into modules based on one example implementation, but the functionality of various modules may be merged or further split such that there are more or fewer components than have been illustrated in FIG. 4A. For example, it is possible to merge the skymap and terrain map databases into a single data store. Some of the services illustrated can be moved outside the UAS 100, for example, the air traffic control system 405 and the global logistics manager 404 may be operated outside the UAS 100 as independent services, accessible through an Application Programming Interface (API). These and other changes to the structure do not change the overall architecture of the system, and systems with such changes may operate in the same or similar manner as the system disclosed.

[0137] FIG. 4B illustrates one example embodiment of a process that may be used to refine a UAV 102's flight route for a mission, using information from a service requestor 104. In some embodiments, the process described with respect to FIG. 4B is performed by the service request handler 403. In other embodiments, all or part of the process is performed by another module or portion of the global services 103.

[0138] This embodiment of the process begins when the service request is received 450. Based on the service request, an approximate service region is determined 451. The service region may be a geographic area around a requestor-defined destination site 105, or it may be a geographic area determined based on a location associated with the service requestor 104, such as, for example, a human requestor's home address, or the GPS-determined location of a client device operated by the service requestor 104.

[0139] Based on this geographic area, the service request handler 403 queries the data manager 402 for terrain information for the service region. The geographic area of the service region is associated with specific terrain data in the global terrain map database 401. The data manager 402 extracts the terrain data associated with the geographic area of the service region from the global terrain map database 401. The terrain data may be in any relevant form, such as image data, height map data, voxel data, contour data, 3D mesh data, etc. Based on the extracted terrain data, the service request handler 403 generates 452 a displayable representation of the geographic area of the service region. The displayable representation may be in any form that can be visualized on a client device. For example, the displayable representation may be an image, a series of images, a 3D mesh, etc.

[0140] The displayable representation is sent to the client device operated by the service requestor 104, where it is displayed. The service requestor 104 is then presented 453 with a route refinement User Interface (UI) that enables the service requestor 104 to select relevant route parameters that can be used to adjust and refine a route. The relevant route parameters depend on the nature of the service request, but are related to information that allows the UAV 102 to refine its flight path at the destination location. For example, in the case of a service request that is a package delivery, the displayable representation on the client device may be a map image of the region where the delivery is requested, and the route refinement UI may allow the service requestor 104 to select a precise point on the image, which will correspond to a location where the UAV 102 will deliver the package. In this example, the route parameter is the selected point, which corresponds to a geographic location within the geographic area of the service region.

[0141] In a different embodiment, the displayable representation is a 3D mesh, and a 3D render of the delivery location is displayed on the client device. In this embodiment, the service requestor 104 selects a trajectory in three dimensions, which the UAV 102 will follow to approach the delivery point. In this case the route parameters may be a spline that defines the three-dimensional trajectory selected by the service requestor 104. The route refinement selection, whether a point, a trajectory, or some other data, is sent to the global services 103.

[0142] The global services 103 receives 454 the route refinement selection from the client device, and then validates 455 the route refinement selection to confirm that the route refinement selection will not cause the UAV 102 to crash or cause the mission to otherwise fail. Validation is done to ensure that the service requestor 104 has not introduced human error into the routing process. For example, a service requestor 104 could specify a delivery location that is in a body of water, or a trajectory that intersects a building.

[0143] Validation may be done using the data in the global terrain map database 401. For example, in some embodiments, validation is performed by checking that the geometry of the route refinement selection received from the client device does not intersect the geometries of objects or terrain in the global terrain map database 401.

[0144] If the route refinement selection is not valid, the system interface manager 406 will send information to the client device that will cause a “selection invalid” indicator to be presented 456 on the client device, so the service requestor 104 realizes that the route refinement selection previously made cannot be used. Additional information may also be sent, such as, for example, information explaining how the previous route refinement selection was invalid, or visual cues that highlight the invalid route refinement selection in the displayed representation of the region. For instance, an invalid selected trajectory or point may be highlighted in red in a map or 3D render. The client device may then present 453 the route refinement selection UI once more, and send a new route refinement selection to the global services 103.

[0145] Once a route refinement selection has been received 454 and validated 455 by the global services 103, the information from the route refinement selection can be used to generate a route or partial route that can be incorporated 457 into mission data that is uploaded into the UAV 102 that will fulfill the service request. For example, if the route refinement selection indicates a location for a package delivery, then the destination site 105 location can be refined to that point, and that refined location may be sent to the distribution center 101 for upload to the UAV 102, or it may be sent directly to the UAV 102. The mission planner 200 of the UAV 102 may use the refined location when it is determining a route to the destination site 105. Similarly, if the route refinement selection is a trajectory that indicates an approach route to the destination site 105, that trajectory can be included in the mission data, and the mission planner 200 in the UAV 102 can incorporate that trajectory in the flight path that the UAV 102 takes on its approach to the destination site 105.

[0146] In some embodiments, the service request handler 403 solicits route refinement selection input from the global system operators 106 and/or the remote vehicle operators 108, instead of (or in addition to) soliciting the route refinement selection input from the service requestors 104. The process for obtaining route refinement selections from a global system operator 106 or remote vehicle operator 108 is almost identical to that used for a service requestor 104. In this embodiment the control devices operated by the global system operators 106 or remote vehicle operators 108, are used to display the route refinement selection UI and to collect and send the route refinement selections to the global services 103.

[0147] Returning to FIG. 4A, the service request handler 403 utilizes the global logistics manager 404 to obtain information required for distribution center 101 and UAV 102 selection. The global logistics manager 404 tracks the inventory information in each local logistics system 308 at each distribution center 101. The global logistics manager 404 may proactively route additional stock to local distribution centers 101 when supplies of any inventory item are depleted, are below some threshold quantity, or are predicted to be depleted within some threshold time. The global logistics manager 404 may also notify a global system operator 106 in the event of an inventory shortage at a distribution center 101. The global system operator 106 may take actions outside the UAS 100 to route new inventory items to the distribution center 101, such as, for example, ordering and shipping items from a third-party warehouse.

[0148] In one embodiment, the global logistics manager 404 relocates UAVs 102 from a first distribution center 101 that has an excess of UAVs to a second distribution center 101 that has a shortage of UAVs. In this embodiment, the global logistics manager 404 may monitor the daily, monthly, or yearly patterns of service requests to determine the estimated UAV requirements at each distribution center 101 over a period of time. Based on these estimated UAV requirements, the global logistics manager 404 may preemptively relocate UAVs from one distribution center 101 to another. The relocation of UAVs 102 may be done using third-party shippers, or the relocation may be done by sending requests to the distribution centers 101 to launch UAVs 102 with destination sites 105 set to other distribution centers 101. As an optimization, these relocation flights may be scheduled during times when the service request volume is low, for example, late at night or during holidays.

[0149] The air traffic control system 405 is responsible for tracking the UAVs 102 and aircraft that are known to be in flight in the area served by the UAS 100. The air traffic control system 405 receives information from the distribution centers 101, the UAVs 102 in flight, and from third-party air traffic information providers. The information received by the air traffic control system 405 includes the known positions of aircraft in the area of the UAS 100, as well as flight routes that are registered with the system. Distribution centers 101 and/or UAVs 102 may register flight routes for missions, with the air traffic control system 405. The air traffic control system 405 may also allow UAVs and aircraft operated by third parties to register their flight routes.

[0150] The air traffic control system 405 provides real-time information updates regarding the positions of aircraft and UAVs to UAVs 102 that are flying missions. Using this information, the mission planners 200 onboard the UAVs 102 may modify their flight routes to avoid colliding with other aircraft. The air traffic control system 405 may offer similar information updates to UAVs and other aircraft that are operating outside the UAS 100 in order to maintain a safer airspace for all aircraft operations.

[0151] The air traffic control system 405 also provides information to the service request handler 403 and the global logistics manager 404. Information from the air traffic control system 405 may be used to influence the selection of distribution centers 101 for service requests and the relocation of UAVs 102. For example, a service request may be routed away from distribution centers 101 where there is an excess of air traffic in the vicinity, and UAV relocation may be timed to avoid periods when air traffic is at its highest.

[0152] The remote vehicle manager 407 provides autonomous vehicles, such as the UAVs 102, with a human operator on demand. In the course of a mission, a UAV 102 may encounter a situation that its mission planner 200 or flight controller 201 cannot understand or safely handle. For example, an autonomous vehicle in an urban environment may not have the necessary routing and vision systems to handle path-determination and object avoidance in such a complex setting. Thus, an autonomous vehicle, such as a UAV 102, may fly under the control of its onboard mission planner 200 and flight controller 201 while in a relatively simple and uncluttered environment outside a city, but may then request human assistance once a city is entered.

[0153] FIG. 4C illustrates a process used by one embodiment of the remote vehicle manager 407 to provide remote vehicle assistance in response to a request. The process begins when the remote vehicle manager 407 receives 480 a request for assistance associated with a UAV 102. The request may come directly from the UAV 102, or it may be received from some intermediary party or system, such as an air traffic system, or from a distribution center 101 or other part of the UAS 100. The request for assistance may be accompanied by a situation report associated with the UAV 102. The situation report may include information such as the location of the UAV 102, its speed and direction of travel, etc. The situation report may also include image, video, or other data representing the surroundings of the UAV 102.

[0154] The remote vehicle manager 407 will then select 481 a remote vehicle operator 108 from a pool of available remote vehicle operators 108. A remote vehicle operator 108 may be selected based on several different factors. For example, in one embodiment the remote vehicle operator 108 is selected based on the quality of the communications link between the control device used by the remote vehicle operator 108 and the UAV 102. In another embodiment the remote vehicle operators 108 each have a rating or score associated with them, where the rating or score of an operator represents the skill or reliability of the remote vehicle operator 108, and the remote vehicle manager 407 selects 481 a remote vehicle operator 108 based on his or her score.

[0155] The remote vehicle operators 108 may also sell their services on a pay-per-use basis. In this embodiment, each operator will have a price associated with him or her, and the remote vehicle manager 407 may select an operator based on price. Of course, the remote vehicle manager 407 may also use two or more of these selection criteria together, as well as other selection criteria.

[0156] Once a remote vehicle operator 108 is selected, the remote vehicle manager 407 will generate 482 an operator message based on the situation report received from the UAV 102. The operator message contains information about the environment and situation of the UAV 102. This information is sent 483 to the control device used by the selected remote vehicle operator 108. The control device is configured such that on receiving the operator message, it displays a visual representation of the UAV 102's environment and situation to the remote vehicle operator 108.

[0157] Additional information may be sent from the UAV 102 directly to the control device used by the remote vehicle operator 108, without involving the global services 103. In one embodiment, the situation report is never sent from the UAV 102 to the global services 103, but instead, the report is sent directly to the control device used by the remote vehicle operator 108. In this embodiment the remote vehicle manager 407 skips the generation 482 of the operator message, and instead, the control device of the remote vehicle operator 108 directly generates the necessary visuals for the operator from the situation report. In some embodiments, the situation report is sent both to the remote vehicle manager 407 and the control device of the remote vehicle operator 108.

[0158] In one embodiment, the UAV 102 sends information in real-time to the control device used by the remote vehicle operator 108. For example, the UAV 102 may send a video stream from an on-board camera to the control device.

[0159] Regardless of how it receives the situation information about the UAV 102, the control device will display visuals based on the situation information to the remote vehicle operator 108. Based on the situation information, the remote vehicle operator may issue one or more operator commands intended for the UAV 102. For example, the remote vehicle operator 108 may issue a command to the UAV 102 commanding it to return to the distribution center 101. These operator commands are typically designed to cause the UAV 102's finite state machine 208 to transition from one vehicle state (the then-active vehicle state) to another vehicle state.

[0160] The operator commands are received 484 by the remote vehicle manager 407. The operator commands may be sent 485 from the remote vehicle manager 407 to the UAV 102, without modification, as vehicle commands, or the operator commands may be first error-checked and/or validated by the remote vehicle manager 407, and then (if necessary or desirable) modified before being sent 485 to the UAV 102 as vehicle commands.

[0161] On receiving the vehicle commands, the UAV 102 will typically transition from one vehicle state to another vehicle state, and take the actions necessary to execute the vehicle commands. For instance, a command to drop a payload will cause the UAV 102 to approach a destination site 105 and drop the payload. In another example, a command to return to the distribution center 101 would cause the UAV 102 to change a current flight path to a new path that takes it back to the distribution center 101. The process used by autonomous vehicles, such as the UAV 102, to execute remotely issued vehicle commands is explained in more detail in the description for FIG. 5.

[0162] In one embodiment, the remote vehicle operator 108 may issue commands directly to the UAV 102, without first sending the commands to the global services 103 (e.g., without sending them to the remote vehicle manager 407). Commands sent to the UAV 102 without first being sent to the global services 103 may include granular commands such as, for example, a command to increase or decrease speed, turn, ascend, descend, etc. In this embodiment, the UAV 102 can be considered to be under the direct control of the remote vehicle operator 108. A real-time video feed sent from the UAV 102 to the control device operated by the remote vehicle operator 108 may facilitate such remote operation. Commands may be entered by the remote vehicle operator 108 via any appropriate mechanism, such as keyboard inputs, yoke or control stick manipulations, and the like.

[0163] Remote Command Process for Autonomous Vehicles

[0164] The communications links between the various entities described in this disclosure are not always reliable. For example, the messages between the distribution center 101, the global services 103, the remote vehicle operators 108, and the UAVs 102 (the autonomous vehicles), may be delayed or lost altogether. For instance, the UAV 102 may send an update at 10:00 AM to inform the global services 103 that a payload has been delivered to the destination site 105. That update message may be delayed and may not reach the global services until 10:05 AM. Meanwhile, the global services 103, having received no update from the UAV 102 by 10:03 AM, may issue a command to the UAV 102 to fly to the destination site 105. If the UAV 102 acts on this stale command, it may return to the destination site 105 even though it has already made its delivery.

[0165] To prevent these sorts of errors, the UAV 102 uses a finite state machine 208 and a stored command verification value. In one embodiment, the command verification value is a command count value, indicating a number of commands executed by the UAV 102, stored in computer memory or in a computer register. In another embodiment, the command verification value is a stored vehicle timestamp indicating the time the last command executed by the UAV 102 was issued. The finite state machine 208 comprises a plurality of vehicle states and corresponding valid transitions between those states. The stored command verification value is used to track the last valid command received by the UAV 102. The UAV 102 periodically transmits status messages indicating both the current active vehicle state in its finite state machine 208 as well as its current stored command verification value. These status messages can be monitored by all parties in the system, including the distribution centers 101, the global services 103, and the remote vehicle operators 108. When any party issues vehicle commands to the UAV 102 it must include not only the command to be executed but also a command verification value that is valid when compared to the stored command verification value of the UAV 102. By validating the command verification value included in a vehicle command, as well as insuring that the state transition caused by the command is valid, the UAV 102 can avoid errors caused by stale commands. The process is explained in more detail below.

[0166] FIG. 5 illustrates one embodiment of a remote command process for autonomous vehicles. The process begins when the autonomous vehicle—the UAV 102—receives 500 a vehicle command from an external party, such as a remote vehicle operator 108 or the global services 103. The vehicle command is an instruction for the UAV 102 to perform a particular action, as well as data relevant to that action. A command verification value that can be used for command validation may also be included with the vehicle command. In one embodiment, the command verification value included in the vehicle command by a party issuing the command, is a count of the vehicle commands executed by the UAV 102, which is broadcast in a status message by the UAV 102, periodically. For example, a vehicle command issued by a party may include an instruction to fly to a particular destination, GPS data for that location, and a command verification value of 1001 corresponding to a command count value of 1001 received from the UAV 102 in the last broadcast status message.

[0167] Once the vehicle command is received 500, the mission planner 200 of the UAV 102 determines 510 the new vehicle state that the finite state machine 208 must activate to execute the command. For example, in one embodiment, if the UAV 102 is on the way to deliver a payload at the destination site 105, the finite state machine 208 will be in the nominal flight state, i.e. the nominal flight state will be the current active state. If the UAV 102 then receives a vehicle command to return to its launch site, it will have to activate the return vehicle state in order to return to the distribution center 101. In this example the new vehicle state that will be activated is the return state.

[0168] The mission planner 200 will then check 520 if the transition from the current active vehicle state to the new vehicle state is one of the valid transitions in the finite state machine 208. If the transition is not valid, the command will be rejected 550.

[0169] If the transition is valid, the mission planner 200 will then validate 530 the command verification value received in the vehicle command against the command verification value stored by the UAV 102. In one embodiment, the command verification value is a count of the vehicle commands executed by the UAV 102 thus far (i.e. a command count value or command counter), and validating the command verification value comprises checking that the command verification value included in the vehicle command is equal to the command counter stored by the UAV 102.

[0170] If the command verification value in the vehicle command is not valid when compared to the command verification value stored by the UAV 102, the vehicle command will be rejected 550. However, if the command verification value is valid, then the finite state machine 208 will transition 540 to the new vehicle state (by activating the new vehicle state). The command verification value stored by the UAV 102 will also be updated. In an embodiment where the command verification value is a command counter, the stored command verification value is updated by incrementing it (i.e. incrementing the command counter).

[0171] Once the stored command verification value is updated, the UAV 102 will transmit status messages indicating the new vehicle state and the new command verification value. Any parties that see the updated status message will know both the new vehicle state as well as the updated command verification value. Parties that do not see the new status message before they issue vehicle commands to the UAV 102 will use the old command verification value, which is now stale, and, therefore, their vehicle commands will be rejected. In this way, the UAV 102 avoids executing stale vehicle commands.

[0172] In an alternative embodiment, the command verification value of the UAV 102 can be implemented using a stored vehicle timestamp that indicates the time when the last command executed by the UAV 102 was issued. The UAV 102 can broadcast this stored vehicle timestamp as part of a status message that can be monitored by other parties in the system. In this embodiment, a party sending a command to the UAV 102 must include a timestamp with the vehicle command, which indicates the time that the command was issued. Validation of the vehicle command in this embodiment is done by checking that the timestamp included in the vehicle command (i.e. the command timestamp) is later in time than the timestamp stored by the UAV 102 (i.e. the stored vehicle timestamp). Performing this validation ensures that the UAV 102 will never execute a stale command, as any vehicle command that is received by the UAV 102 that is older than an already executed vehicle command will have a command timestamp that is earlier than the stored vehicle timestamp, and thus will be rejected.

[0173] FIG. 6A illustrates the vehicle state transitions and status message broadcast in an example embodiment that uses a command counter as the stored command verification value. In this example, the finite state machine at some time T₀ 601 is in the nominal flight state. The vehicle states are depicted by the named circles, and the valid transitions are the directional arrows between the circles. The nominal flight state is active, as indicated by the bold outline around that state in the figure. In this example, the command counter is set at 504, indicating that the autonomous vehicle has executed 504 previous commands.

[0174] At time T₁, the autonomous vehicle will broadcast a status message 602 indicating the command counter value of 504 as well as the current vehicle state nominal flight.

[0175] At time T₂, the autonomous vehicle receives a vehicle command 603 that contains the command verification value 504 and a command to return to base. Since there is a valid state transition between the nominal flight state and the return state, and since the command verification value of the vehicle command is equal to the command counter, the finite state machine at time T₃ 604 will transition to the return state, and the command counter will be incremented to 505.

[0176] The status message broadcast at time T₄ 605 will indicate a command counter value of 505 and a vehicle state of return. Parties that wish to issue future vehicle commands to the autonomous vehicle will need to use the updated command counter value for their command verification values in vehicle commands, and to issue commands that take into account the new vehicle state. For example, if a new command requests the autonomous vehicle to make a delivery approach, that command will be rejected, as there is no transition between the return state and the delivery approach state; if a new command includes the old command verification value of 504, the command will be rejected since that command verification value will not be valid when compared to the new command counter value of 505.

[0177] FIG. 6B illustrates the vehicle state transitions and status message broadcast in an example that uses the stored vehicle timestamp and command timestamp embodiment of the system. In this example, the finite state machine at some time T₀ 611 is again in the nominal flight state. The stored vehicle timestamp is set at 16:04:32, indicating that the autonomous vehicle had previously executed a vehicle command that was issued at that time.

[0178] At time T₁, the autonomous vehicle will broadcast a status message 612 indicating the stored vehicle timestamp value of 16:04:32 as well as the current vehicle state nominal flight.

[0179] At time T₂, the autonomous vehicle receives a vehicle command 613 that contains the command timestamp value 16:05:30 and a command to return to base. Since there is a valid state transition between the nominal flight state and the return state, and since the command timestamp is later than the stored vehicle timestamp, the finite state machine at time T₃ 614 will transition to the return state, and the new stored vehicle timestamp will be 16:05:30.

[0180] The status message broadcast at time T₄ 615 will indicate the new stored vehicle timestamp and a vehicle state of return. Future vehicle commands will only be executed if their command timestamps are later than this new value.