Failsafe Mechanism Design of Multicopters Based on Supervisory Control Theory

In order to handle undesirable failures of a multicopter which occur in either the pre-flight process or the in-flight process, a failsafe mechanism design method based on supervisory control theory is proposed for the semi-autonomous control mode . Failsafe mechanism is a control logic that guides what subsequent actions the multicopter should take, by taking account of real-time information from guidance, attitude control, diagnosis, and other low-level subsystems. In order to design a failsafe mechanism for multicopters, safety issues of multicopters are introduced. Then, user requirements including functional requirements and safety requirements are textually described, where function requirements determine a general multicopter plant, and safety requirements cover the failsafe measures dealing with the presented safety issues. In order to model the user requirements by discrete-event systems, several multicopter modes and events are defined. On this basis, the multicopter plant and control specifications are modeled by automata. Then, a supervisor is synthesized by monolithic supervisory control theory. In addition, we present three examples to demonstrate the potential blocking phenomenon due to inappropriate design of control specifications. Also, we discuss the meaning of correctness and the properties of the obtained supervisor. This makes the failsafe mechanism convincingly correct and effective. Finally, based on Q. Quan, Z. Zhao P. Wang and K.-Y. Cai are with School of Automation Science and Electrical Engineering,Beihang University, Beijing 100191, China (e-mail: qq [email protected], zzy [email protected], [email protected], [email protected]). L. Lin and W. M. Wonham are with the Department of Electrical and Computer Engineering, University of Toronto, Toronto, ON M5S 3G4, Canada (e-mail: [email protected],[email protected]). The corresponding author Q. Quan is also with the Department of Electrical and Computer Engineering, University of Toronto as a visiting professor. Most multicopters have two high-level control modes: semi-autonomous control and full-autonomous control. Many open source autopilots support both modes. The semi-autonomous control mode implies that autopilots can be used to stabilize the attitude of multicopters, and also they can help multicopters to hold the altitude and position. Under such a mode, a multicopter will be still under the control of remote pilots. On the other hand, the full-autonomous control mode implies that the multicopter can follow a pre-programmed mission script stored in the autopilot which is made up of navigation commands, and also can take off and land automatically. Under such a mode, remote pilots on the ground only need to schedule the tasks [1]. April 28, 2017 DRAFT