“It is all about operating cost. It has to come down,” says Chris Van Buiten, vice president for technology and innovation. Typical loss rates for unmanned aircraft today are 1/1,000 flight hours. At $12 million a copy for an unmanned Black Hawk or Radier, that means replacement cost of $12,000 per hour: “Lose two, and the program is terminated,” he says. Even a loss rate of 1/10,000 hr., for a replacement cost of $1,200/hr. “is still not acceptable. The floor is 1/100,000 hr., which is what we see in combat with the Black Hawk, for a $120/hr. replacement cost.”
The company's approach is not to develop an autonomous vehicle, but an autonomy architecture that is platform-agnostic and can be used in manned, optionally piloted and unmanned vehicles; inserted into the existing fleet and designed into future products; and incorporated into aircraft built by Sikorsky or its competitors, as a system or an “app.” “This is as much about the process as the product,” says Van Buiten. “We are getting into the world of software apps and upgrades with products that are truly vehicle-agnostic and platform-independent.”
To certify an autonomous system, the definition of flight-critical functions must be expanded to include perception, path planning and decision making, says Cherepinsky. It requires an approach that permits some level of emergent—and not predetermined or “deterministic”—behavior not allowed by today's airworthiness rules. Sikorsky's architecture deterministically bounds the emergent behavior so the autonomous system can be certified by current methods.
Within Matrix, the perception block includes all the algorithms to process data from onboard and offboard sensors. Processed data are passed to the world model, which contains not only a terrain database to orient the vehicle, but information on its mission objectives. Next come the path-planning and decision-making algorithms, which determine how the vehicle behaves. These are divided into simple, deterministic low-level intelligence (LLI) algorithms, and high-level intelligence (HLI) algorithms that are the source of emergent behavior. “We will start with low-level algorithms that are predictable, as the basis of the core intelligence, then work up to emergent behavior bounded by algorithms. The FAA is receptive to this,” says Cherepinksy.
Low-level algorithms have the authority to override any high-level commands, and provide a safe envelope within which the high-level intelligence operates. “The HLI algorithms contain the bulk of the true intelligence of the vehicle. Since these algorithms are not flight-critical, they can contain complex and/or nondeterministic behavior,” Cherepinksy says.
The HLI block is bounded by low-level intelligence algorithms “that understand what is happening,” he says. “As long as the high-level intelligence operates within bounds, its behavior is allowed,” he says. “If it goes out of bounds, the low-level intelligence block takes over. If the aircraft is flying low and fast and it sees the HLI pushing the limits, LLI takes over and saves the aircraft.”
A key is robust contingency management. “Unlike previous flight control systems, where if an actuator fails you abort the mission, here you do not have to do that. The autonomous mission manager evaluates the state of the vehicle and adjusts the mission,” says Cherepinsky. “Today's control systems lack software to tell them what to do when something goes wrong. Fault detection is great—it can tell when a sensor has failed, but lacks the next step: what to do about it and what to do without it.”
Current unmanned aircraft are painstakingly preprogrammed. “The key is not to attempt to program every contingency, but to allow some emergent behavior,” he says. “You need enough robustness in the autonomy that it will do something; you don't know exactly what, but you can bound it and be comfortable with it. That's hard to do, but is where we are headed.”
Sikorsky is taking a step-by-step approach. “As we move into this future with less-deterministic processes, the system software will evolve over time,” says Miller. “We are moving away from determinism is a slow manner, and trying not to take a leap.” Autonomy starts as an “insurance policy to deal with the latency and intermittency of communication with the aircraft. As it evolves, more capability moves to the autonomous side and the certification challenges become more critical,” he says.