## MIZOPEX SDSS

DataHawk

Introduction

The SDSS UAS consists of the 1.5

- lb DataHawk unmanned aircraft (UA) using the CUPIC autopilot, operated by a remote ground control station. The CUPIC autopilot and the ground
control station are custom systems developed at CU for micro UAS . The DataHawk UA is based
on the commercially available Stryker F

- 27C model aircraft foam airframe with electric propulsion by Park Zone Inc., that has been modified by RECUV to include science sensors and

auto pilot capabilities

. Airworthiness of the DataHawk UA is determined using the applicable procedures outlined in MIL

- HDBK

- 516A. Operation of the SDSS UAS will use at minimum a two

man team consisting of a ground based observer, and a pilot

- in

- command (PIC)

. Flight operations are conducted for the purpose of science sensor testing of the Self Deployed Surface Sonde (SDSS) component of the Marginal Ice Zone Ocean and Ice Observations and Processes Experiment (MIZOPEX) , funded by NASA

Proponent Organization

1 Definition of Terms

The de f i nitions given here are provided for clarity. Where applicable, the de f i nitions are taken
from AFS

- 400 UAS POLICY 05

- 01, ASTM F 2395

- 07 Standard Terminology for Unmanned Aircraft Systems, or Title 14, Code of Federal Regulations (14 CFR) part 1.

Research and Engineering Center for Unmanned Vehicles (RECUV)

Landing target : the designated ground target point for the auto landing flight mode, expressed
in GPS coordinates.Auto land fight mode: the vehicle is automatically directed toward the landing target along a

designated landing heading, with an appropriate descent rate based on the altitude where the auto land mode was entered. This mode is enabled by the PIC via the ground station, but is then automatically entered by the auto pilot based on vehicle altitude and heading. This mode can be exited (landing aborted) by command from the PIC , in which case flight returns either to the auto helix or flight termination modes.

Auto helix flight mode : a semi

- autonomous flight mode that di rects the vehicle to a designated
left hand loiter circle laterally, and follows a repeating triangular vertical profile between specified floor and ceiling limits. Loiter circle center and radius, as well as helix floor, ceiling, climb rate, and descent r ate are set by the PIC via ground station controls.

Flight termination mode : : this will turn off the electric propulsion , and co mmand a right turn spiral descent at 30 ft/sec. This brings the aircraft down quickly, but in a controlled and highly
visible w ay

.

This mode is entered automatically by the autopilot upon the following conditions:

- Loss of link

- Loss of GPS

- Outside flight range boundary

- Critically low main battery

This mode can also be entered by the PIC via ground station command , and is the primar y means of de

- confliction with other aircraft that may encroach on the flight range.

Once entered, flight termination mode can be exited if the entry conditions no longer exist, except for the low battery case.

Emergency fight plan : this plan consists o f moving the auto helix mode loiter circle to a safe
location and altitude if all UA systems are nominal. In all other cases, an emergency will induce either landing mode or flight termination mode.

GCS : t he ground control station consists of a Windows

- based laptop computer running the ground station software for display of flight status, entry of commands, and archiving of flight
data. The GCS communicates with the DataHawk UA via a radio modem link in the unlicensed
900 MHz ISM band. The groun d station is powered by the laptop battery, with a 12V car battery backup.

Lost GPS : the UA can continu e to perform normally without a new GPS solution for up to 20

sec

. before a loss of GPS event is detected.LOS : line

- of

- sight is de f ned in AFS

- 400 Policy 05

- 01 as a method of control and collision

avoidance that refers to the pilot or observer directly viewing the UA w ith human eyesight.
Maximum LOS lateral distance is set at 1 mile.

L ost communications : an event where the control sta tion has lost al l communication capability
with the UA. The SDSS has a single 900 MHz uplink and downlink, using the same transceivers
and radios for both link directions.

L ost link : an event where the control station has lost either or both of the uplink and downlink
of a single communication channel. For the SDSS, a lost link event is also a lost communications
event. This event is detected when the 1 Hz “heartbeat” packets sent from the ground station
to the UA are absent for any 40 sec. interval.

M iniature unmanned aircraft : an aircr aft with a maximum gross takeoff weight of 55 lb

. or less. With its maximum weight of 1.5 lb. the DataHawk UA easily qualifies as a miniature UA.

M ode of control : the means by which the pilot uses to direct the activity of the UAS. There are three modes of control in the SDSS : auto helix, auto land, and flight termination . The UAS will use different modes of control in different phases of f ight, selected by the PIC.

PIC : Pilot

- in

- command acts as the mi ssion commander, d irecting all fight, safety and emergency operations and is the person directly responsible for the operation of the UA. The responsibility
and authority of the pilot in command as described by 14 CFR 91.32, Resp onsibility and Authority of the Pilot in Comm and, apply to the SDSS PIC. This de fi nition is not intend ed to suggest that there is any requirement for the UA PIC to be quali fi ed as a crew member of a

man ned aircraft.

R/C : for this document, R/C refers to a description relating to the manual r emote co ntrol of
model aircraft systems as is currently practiced by hobbyists operating under AC 91

- 57. This
de finition is provided to contrast the description and operation of the semi

- autonomous SDSS

versus manual R/C control

.

2.0 Operational Description

Flight operations are conducted for the purpose of science sensor testing of the Self Deployed Surface Sonde (SDSS) component of the Marginal Ice Zone Ocean and Ice Observations and Processes Experiment (MIZOPEX) , funded by NASA.2.1 System Descript ion

2.1 .1 Aircraft System Description
The SDSS UAS consists of the 1.5

- lb DataHawk unmanned aircraft (UA) using the CUPIC Wingspan 37in
Wing Area 3.1 sq. ft.
GTOW 1.5lb Wing Loading 0.48 lb/sq. ft. Length 24in Airfoil unknown

DataHawk UA, showing the elevon control surfaces, rear folding propeller and electric motor, and elastic foam airframe.autopilot, operated by a remote ground control station. The CUPIC autopilot and the ground

control station are custom systems developed at CU for micro UAS

. The DataHawk UA is based
on the commercially available Stryker F

- 27C model aircraft foam airframe with electric

pr opulsion by Park Zone Inc . that has been modified by RECUV to be more rugged, and to include science sensors and autopilot capabilities

.

2.2 Pe rformance Characteristics

2.2.1 Modifications

The F

- 27C foam model airframe is modified in several ways. It is reinforced with interior carbon fiber rods and exterior filament tape to take landings on unimproved surfaces without damage. A more robust custom motor mount and fiberglass vertical tails are used , as well as more rugged metal

- gear servos for the elevon control surfaces. The stock electric motor and propeller is replaced with ones that provide less speed and climb performance, but higher efficiency and longer range. A ventral launch hook is installed with a monofilament line cutter for autonomous bungee deployment from a portable launcher.

2.3 Ground Control Station

The custom control station is installed on a Windows

- based laptop computer, using Matlab to program data displays, user controls, and manage communication with the UA. A map of the local area is provided on th e display, and the UA flight path is shown (in green) on this map along with the landing target for the auto landing mode and the designated loiter circle for the auto helix flight mode (blue lines). The flight range boundaries are also shown (red circles)

. Performance Characteristics Climb rate (ft/min) 900 Descent rate (ft/min) 1800 Turn Rate (deg/sec) 30 Cruise Speed (KIAS) 25 Maximum 35 Minimum 20 Approach Speed (kts) 25 Operating Altitudes (feet MSL)
Maximum 10000 Minimum 3 Gross Takeoff Wt (lbs) 1.5User controls are provided to properly initialize the UA and verify all functions before launch, to

set the landing target and heading, set the loiter circle center and radius, set the helix floor and ceiling altitudes, set the helix ascent and descent rates, and set the flight range boundary center, radius, and ceiling. Controls are provided to change modes between the nominal auto helix mode and landing mode and flight termination mode. Additional displays provide
information on aircraft health and s tatus, flight data (e.g. altitude, heading, airspeed, climb rate, etc.), payload sensor data, and quality of the communication link. All flight data is recorded on the laptop, with filenames containing the date and time of the flight for archiving
and late r data retrieval.

2.4 Communications

A single uplink conveys commands and p arameter values to the UA, and a single downlink relays flight information and sensor data to the ground station. Both links use commercial radio modems (Digi XBee Pro XSC) in the 902

- 928 MHz ISM band, using identical radios modules on
the UA and the GCS with a maximum of transmit power of 100mW

. These radios use frequency hopping spread spectrum techniques to minimize the impact of interference. T ypi cal communication slant range is 6 NM . All critical parameters and commands from the ground
station are e choed back to the GSC for verification, and a “heartbeat” packet is uplinked to the Ground control station, hosted on a semi

- rugged laptop computer and running Matlab for data archiving an d display, and operator control of the UA flight modes and parameters

.UA at 1 Hz to provide continuous link status for automatic lost link contingency procedures.

Link status is displayed on the ground station with large figures, so the grou nd station antenna can be pointed manually by the observer , if necessary, to optimize the link signal strength.

2.4 Certified TSO Components

There are no TSO Certified Components in the SDSS system.

2.7 Launch and Recovery

2.7.1 Launch

The DataHawk is launched from a custom portable launcher, consisting of support rails and a length of surgical tubing. The UA is restrained on the launcher with a monofilament tether, that is cut upon command from the PIC via the launch control button on GCS. For safety, the electric motor is engaged automatically after the plane becomes airborne.

2.7.2 Recovery

The DataHawk is constructed of resilient expanded polypropylene foam, and has been further reinforced to land on any surface without damage. In particular, the electric motor and folding propeller are located in the rear to prevent damage during landing, and to present soft foam leading edges to any object during landing. This foam also provides flotation for water landings. No special landing sites are needed, although the PIC can specify particular landing locations and landing headings to account for w ind or to avoid contact with structures or personnel.

2.8 Airworthiness

The DataHawk UA was certifi ed using the applicable sections ou tline d in MIL

- HDBK

- 516A as specified in section 6.3.1 of AFS

- 400 and section 6.1 of UAS Interim Operational App roval Guid ance 08

- 01. The certification was done by the DataHawk certifi cation team led by RECUV member Dr. Dale Lawrence. The DataHawk has been qualified in this process through design, analysis, and through flight testing in restricted airspace in Salina, Kansas, and in Peruvian airspace (under CORPAC approval). Sections referenced in parentheses below refer to the corresponding sections of MIL

- HDBK

- 516A.

2.8.1 Systems Engineering (4.0) 2.8.1.1 Design Criteria (4.1)The DataHawk was designed as a low cost UA suited to the rigors of atmospheric and ocean

science field work, that could be safely operated with a small ground crew and minimal ground support equipment. Maximum advantage was taken of low

- cost commercially a vailable model aircraft components, with the addition of custom avionics, sensors, and software to suit these applications. 2.8.1.2 Tools and Databases (4.2) Design files for custom mechanical, electronic, and software components are archived in a subvers ion repository, and databases of flight data are archived on a RECUV server.

2.8.1.3 Materials Selection (4.3) Materials are selected from commercially available options based on the high durability and low cost needs of the DataHawk science missions, w hile minimizing the consequences of damage or injury in operation. In particular, the entire vehicle is frangible, except for the electric motor and aluminum motor mount, and they were purposefully located in the rear to minimize the potential for harmful contact. 2.8.1.4 Manufacturing, support, and quality (4.4) The DataHawk is assembled in RECUV facilities by Aerospace Engineering students, using commercial and custom made components, under the supervision of RECUV faculty. The RECUV team has the exper tise and knowled ge to meet the level of quality required for small, foam airframe UA s, custom autopilots, and sensor payloads. 2.8.1.5 Operator’s and mainte nance manuals (4.5) The ight logs produced for every ight will have detailed descriptions o f any anomalies or failures. A physical inspection will be conducted prior to each fl ight. Maintenance will be performed as needed by members of the RECUV Fabrication Lab who are skilled in constructing and maintain ing RECUV UAS

. 2.8.1.6 Configuration Id entification (4.6) The configuration of the DataHawk for the SDSS mission is defined by software and hardware files maintained in a subversion repository at the University of Colorado. 2.8.1.7 Configuration status accounting (4.7) The DataHawk UA doe s not employ a CSA system as defi ned in section 3 of MIL

- HDBK

- 61A.

2.8.2 Structures (5.0) 2.8.2.1 Loads (5.1) Flights in the scientific application proposed are much less stressful than the aerobatic flights the airframe was designed for, with low airspeed and docile helix flight paths at slow climb rates. The bungee launcher uses a long section of surgical tubing to produce a gentle launch acceleration (0 to 25 kts over 30 feet). Landing loads on unimproved surfaces can be high, but the vehicle has been desig ned to survive many of these hard landings. 2.8.2.2 Strength (5.2) The basic airframe has been extensively tested in aerobatic flight by the manufacturer ( Park
Zone , Inc. ) and this has been further stiffened and ruggedized by RECUV to be more robust to hard landings. 2.8.2.3 Materials, processes, corrosion prevention, nondestructive evaluation, and repair (5.3)All of the materials in the DataHawk were selected for immun ity to corrosion and weathering

degradation over the short service life of the vehicle (about 20 flight hours). Minor damage to the airframe is easily observed and repaired as needed in the field by gluing or taping the foam. Major damage is easily detect ed by flexing the airframe by hand to check for loss of stiffness, e.g. due to a broken internal carbon fiber stiffener. In this case, the airframe is retired and discarded. Since field deployment is remote, a spare airframe will be carried to cover this possibility.

2.8.2.4 Damage to lerance and durability (5.4) The DataHawk was designed to survive harsh landing conditions by using elastic foam where contact during landing can occur. Stiffness is provided by internal carbon fiber spars, which are protected by the foam exterior. Damage and fatigue due to flight loads are not expected due to the relatively small loads, and the short service life (about 2 0 flight hours). 2.8.2.5 Flight operating limits (5.5) The airspeed is under closed loop control, with fixed reference values that only vary with altitude. Climb and descent rates are also under closed loop control with maxi mum safe parameter limits enforced in the ground station. Maximum flight range in altitude and radius is specified before launch; leaving this range for any reason causes automatic flight termination. 2.8.2.6 Functionality (5.6) All fl ight control systems are inspected and tested prior to fl ight to ensure they operate freely without binding or de fl ecting as required in 5.6.1. The ground station software locks out the launch command until the proper initialization and checkout of control surfaces, sensors, and propulsion has been completed. 2.8.2.7 Structural dynamics (5.7) The maximum airspeed is well within the incompressible fl ow regime, so d oes not approach the regime for aerolastic an d aeroservoelastic instabilities. Flight tests and pre/post

- flight in s pections verify compliance with Sections 5.7.4

- 5.7.8. The DataHawk UA is not a rotorcraft, therefore sections 5.7.9

- 5.7.11 are ignored. 2.8.2.8 Mass properties interface (5.8) The mass properties of the DataHaw k are static. There is no fuel, and the main battery is a fixed type and size that is rigidly mounted in the vehicle. The preflight checklist includes verification of the proper longitudinal c.g. location by balancing the vehicle at points molded into the foam airframe. 2.8.2.9 Stores/armament interface (5.9) There are no external stores or armaments. 2.8.2.10 Struct ural maintenance manuals (5.10) There are no formal structural maintenance procedures. The airframe is check for damage before every flight as noted in 2.8.2.3. 2.8.2.11 Rotary wing air vehicles (5.11) The DataHawk is not a rotary wing vehicle.2.8.3 Flight technology (6.0)

2.8.3.1 Stability and control (6.1) The DataHawk airframe has stable short period and roll subsidence modes. Stability of the phugoid mode is augmente d by rate damping in the altitude control loop. The spiral mode is stabilized by the bank angle control loop. A heading loop provides tracking of command headings obtained from a globally stable vector field guidance law. Paramet ers in the vector field set the loiter circle location and radius , using GPS position to determine guidance vector directions . Parameters in the altitude loop set the ascent and descent rates and ceiling and floor a ltitudes. In the landing control mode, vector field heading commands are replaced by constant heading commands, and a descending altitude command. In the flight termination control mode, a steep right turn spiral is commanded with a high descent rate using pressure altitude alone, assuring controlled descent if GPS drops o ut. 2.8.3.2 Vehicle control functions (6.2) The DataHawk utilizes an elevon control method, with differential deflection producing roll (aileron) moments, and collective deflection producing pitch (elevator) moments. There are two control surfaces, one on the trailing edge of each wing, and two corr esponding servo actuators, connected by conventional pushrods and control horns. 2.8.3 Aerodynamics and performance (6.3) 2.8.3.1 Flight vehicle (6.3.1) The aerodynamics of the DataHawk derive from the commercial R/C model airplane design of the Stryker F

- 27C from Park Zone , Inc . These have been extensively tested over a wide range of flight conditions including high speed and aerobatic flights. The DataHawk application has a very limited flight envelope by comparison, with low speeds, limited bank angl es, and small climb/descent rates. 2.8.3.2 Installed propulsion capability (6.3.1) A brushless electric motor and a folding propeller provide propulsion for the DataHawk. These are commercial components, selected for their suitability for the flight envel ope of the DataHawk. 2.8.3.3 Flight limits (6.3.2) The restricted DataHawk flight envelope has been investigated in test flights in US restricted air space and by CORPAC permission in Peru, and suitable limits on bank angle, climb/descent rates, and airsp eed have been established for safe flight. These characteristics are not subject to variation with fuel, payload, or stores, since the sensor payload is fixed, and no fuel or stores are carried.2.8.4 Propulsion (7.0)

2.8.4.1 Performance (7.1) The DataHawk is powered by a brushless electric motor that is installed and operated according to manufacturer’s recommendations. The UA is not operated at low altitude (100ft MSL), hence is not expected to encounter icing conditions. 2.8.4.2 Operability (7.2 ) The engine is operated by the autopilot, which has been tested for adequate control system stability margins over the flight regime. The only operator control of the engine is to shut it down by engaging the flight termination mode. 2.8.4.3 Engine stru ctures (7.3) The engine is mounted to a custom aluminum mount that is much stronger than the plastic one supplied by the manufacturer, in order to survive hard landings. This mount is external to the airframe and is inspected before and after every flight for damage and fastener integrity

. 2.8.4.4 Engine control and accessory systems (7.4) The engine is controlled by a commercial brushless motor controller designed for this purpose, and rated for the motor and propeller used, as well as the range of flight regime allowed. There are no accessory systems . Failure in the engine control system will result in a loss of propulsion. However, this is causes a controlled descent from a low altitude (100ft) at low airspeed (25 kts). Therefore a failure in the motor or its control system will not aff ect safe operation of the UA as required in 7.4.5. 2.8.4.5 Engine monitoring system (7.5) Throttle setting is monitored in the autopilot and relayed to the ground station. Since anomalous operation or failure has such minor safety consequences (see 7.4), more sophisticated engine monitoring is avoided in order to reduce vehicle cost, hence the cost of vehicle loss due to a propulsion anomaly. 2.8.4.6 Engine bearing and lubrication system (7.6) Engine bearings are sealed and there is no lubrication system. Proper bearing lubrication is checked by testing the motor during initialization procedur es before every launch. 2.8.4.7 Engine installations compa ti bility (7.7) All motors are of the same type and size, with common fastener locations and sizes. They are installed according to manufacturer’s recommendations. 2.8.4.8 Failure modes (7.8) Engine failure modes include loss of main battery power, failure of the throttle command from the autopilot, failure of the motor controller, opening or shorting of motor windings, seizing of motor bearings or rotor/stator interference, and failure of the motor/ propeller coupling. All failure modes result in loss of propulsive power. Except for main battery failure, the autopilot provides a controlled descent in case of propulsion failure. Main battery depletion induces
motor

- off flight termination in a control led descent as outlined in emergency procedures in Appendix 8

. Main battery failure results in an uncontrolled descent from 100ft MSL. 2.8.4.9 Flight manual/procedures and limitations (7.9) Operators are trained to be aware of the effects of propulsion fai lure, but there are no operator actions to be taken in this situation. 2.8.4.10 Engine externals (7.10) Wiring to the engine is captured inside and protected by the engine mount

.2.8.4.11 Engine computer resources (7.11)

The motor controller is a self

- contained microprocessor system, and requires no other computer resources. 2.8.4.12 Propellers and associated subsystem components (7.12) The propeller and its attachments are commercial products designed for this purpose and for this thrust and airspeed range. They are attached based on manufacturer’s recommendations. 2.8.4.13 Rotors and associated subsystem components (7.13) The DataHaw k is not equipped with a rotor.

2.8.5 Air Vehicle Subsystems (8.0) 2.8.5.1 Hydraulic and pneumatic systems (8.1) The DataHawk carries no hydraulic or pneumatic systems. 2.8.5.2 Environmental management system (8.2) The DataHawk carries no environmental management systems. 2.8.5.3 Fuel system (8.3) The DataHawk has no fuel system. A lithium polymer battery provides the energy for propulsion. 2.8.5.4 Fire and hazard protection (8.4) The DataHawk UA is not e quipped with on

- board fi re monitoring or prevention systems. However, as per 8.4.19 the ground crew operating the DataHawk UA will be equipped with a fire extinguisher in the event o f a post

- crash or other ground fi re. 2.8.5.5 Landing gear and deceleration systems (8.5) The DataHawk UA does not h ave landing gear. The fuselage structure and wings have been designed to withstand the impact forces during landing. The DataHawk UA is not equipped with a braking system. There is no backup system as outlined in 8.5.9.1 because the DataHawk UA poses minim al ris k to persons or property when conducting ground operations due to it s small size and low airspeed. There are no auxiliary deceleration devices as discussed in section 8.5.11. Ground and launch preparation of the DataHawk UA will be done by the ground crew physic ally carrying the UA, due to it s small size (8.5.12). 2.8.5.6 Auxiliary/emergency power systems (8.6) The DataHawk UA is equipped with a lithium polymer battery to provide primary power for avionics and sensor payload. There is no backup power system. The APS/EPS system is environmentally safe. 2.8.5.7 Aerial refueling system (8.7) The DataHawk cannot be refueled in flight. 2.8.5.8 Propulsion Installations (8.8) The engine/air vehi cle physical interface was verifi ed to be safe through bench and fl ight tests conducted by RECUV as required in 8.8.1. The current throttle setting is the only propulsion system information requi red for the ground crew, and is available through the ground control station. The DataHawk UA will not be flown in adverse w eather conditions, including high winds, heavy precipitation, or in icing conditions. 2.8.5.9 Mechanisms (8.9)The propeller folds when the engine is not operating. Unmodified commercial folding

propellers are used that are designed for this purpose. There are no other mechanisms associated with the propulsion system. The propeller is inspected before every flight

.

2.8.6 Crew Systems (9.0) The DataHawk is unmanned, therefore there are no crew systems.

2.8.7 Diagnostic Systems (10.0) 2.8.7.1 Failure modes (10.1) Due to the simplicity of the DataHawk vehicle and its operation modes, there are only a few failure modes:

- Main battery failure : detected by operator directly via battery voltage telemetry to the ground station.

- Main battery depletion : automatically detected by the autopilot, and detected by operator via battery voltage telemetry to the ground st ation.

- Propulsion failure : detected by operator indirectly via throttle and altitude telemetry to the ground station.

- Structural failure: detected indirectly by the operator via flight path and altitude telemetry to the ground station , and directly by visu al observation of the vehicle behavior.

- Control surface failure : detected indirectly by the operator via flight path and altitude telemetry to the ground station , and indirectly by visual observation of the vehicle behavior.

- Flight computer failure : dete cted directly by loss of downlink telemetry stream, and indirectly by visual observation of the vehicle behavior.

- Flight sensor failure : detected directly by the operator via airspeed , pressure altitude, and bank angle sensor telemetry to the ground station, and indirectly by visual observation of the vehicle behavior.

- Lost GPS : detected automatically by the autopilot, and directly by the operator via downlink telemetry of GPS lock and flight path to the ground station.

- Lost link : detected automatically by the autopilot, and directly by the operator via downlink telemetry of link signal strength and “heartbeat” packet drop outs. The consequences of these failure modes, as well as operator responses, are outlined i n the attached emergency procedures document

. 2.8.7.2 Operation (10.2) The autopilot automatically detects main battery depletion, lost GPS, and lost link failures. Its response in all cases is to transition to flight termination mode. All other failure modes are detected by the operator based on ground station data display or by visual detection of anomalous flight behavior by the observer. Only the low battery (imminent depletion) and lost link failures have effective operator responses. All other failures r esult in either uncontrolleddescent, controlled descent, or flight leaving the designated flight range which causes

automatic flight termination. This diagnostic system will not induce failures in the DataHawk UA as required in 10.2.3.

2.8. 8 Avionics (11.0) 2.8.8.1 Avionics architecture (11.1) The DataHawk avionics complement consists of the CUPIC autopilot, IR horizon sensors for bank angle, a pitot/static sensor for airspeed, an absolute pr essure sensor for altitude, GPS for lat eral position and ground speed, a brushless speed controller for propulsion, a data radio for uplink of commands and downlink of flight parameters and sensor data, and payload sensors for the science mission. Real time control loops run at 100 Hz and 10 Hz, with data downlinks at 10Hz and 1 Hz. Consistent with the low cost and minimal consequences of failure for the DataHawk, none of its avionics systems are redundant. 2.8.8.2 Avionics subsystems (11.2) All necessary ight information is provided to the ground crew thr ough the ground control

s tation as required in 11.2.1

. Flight controls on the ground station are activated via screen buttons and data entry fields on a semi

- rugged laptop computer designed for outdoor use, and are sufficiently reliable for the DataHawk ap plication. The control link between the ground

s tation and CUPIC on

- board the UA is a single point of failure. L oss of this link results in automatic flight termination. Normally, the aircraft survives with little damage and risk to persons and property is minimal due to the low kinetic energy and elastic foam airframe

. All systems on the DataHawk have been qualified by test in an environmental chamber for ambient temperatures from +40C to

- 40C. Safe operating power limits have been designed with multip le levels of regulation and adequate voltage margins, along with low a battery voltage warning on the ground station. 2.8.8.3 Avionics air vehicle installation (11.3) The avionics were designed by the RECUV team at CU, and installation is accomplished in

- house following the procedures established by that design. In particular, antenna location, orientation, and type have been designed and tested to provide reliable GPS reception and telemetry links.

2.8.9 Electrical System (12.0) 2.8.9.1 Electric power generation system (12.1) The DataHawk electrical power is provided by a lithium polymer battery. The battery will be fully charged (checklist item) prior to any fl ight. The CUPIC autopilot p rovides power source monitoring (voltage ) during fl ight. No backu p power systems is supplied. 2.8.9.2 Electrical Wiring, including power distribution (12.2The electrical wiring used throughout the DataHawk UA is appropriat e to handle the required

loads, specifi cally the wiring used for the propulsion motor, power sour ce, and contr ol servos as required in 12.2.1 and 12.2.2. Power distribution on the DataHawk is done through a wiring harness that uses 2

- pin JST and conventional 3

- pin servo connectors that have been used for several years by the RECUV team with zero failu res.

2.8.10 Electromagnetic Environmental Effects (13.0) 2.8.10.1 Component/subsystem E3 qualification (13.1) External interference sources in the 900MHz band in populated areas can degrade the link telemetry link margin slightly, but no such interference is expected in the remote operating region of this application. 2.8.10.2 System

- level E3 qualification (13.2) Mutual electromagnetic compatibility has been verified by integrated system testing for interference and induced noise levels within tolerance levels. The system has also been flight tested in the beam of a high

- power radar at Jicamarca, Peru, with no ob servable effects. Electrostatic charging issues in flight are avoided with direct supply return line wiring to all subsystems. No lightning protection systems are supplied. No electro

- expl osive devices are used.

2.8.11 System Safety (14.0) 2.8.11.1 Syst em safety program (14.1) A systematic safety program was developed for the DataHawk, identifying safety issues at the outset of the program, and addressing these issues through the vehicle design, ground station design, concept of operations, and software design. Key aspects considered were range safety, failure modes and effects, and safety of operating and other ground personnel and property. 2.8.11.2 Safety design requirements (14.2) The DataHawk system is designed to be small and slow in order to limi t kinetic energy. It is designed to be frangible, with a soft elastic foam exterior to limit contact pressures that can cause injury or damage. It is designed to fly low to avoid other air traffic. It is designed to be simple to operate, reducing the lik elihood of operator error. 2.8.11.3 Software safety program (14.3) Software development occurred under specific safety requirements, including positive identification of flight code version, verification of all critical ground station commands, verificati on of all critical initialization and pre

- flight check list items with appropriate function lockouts. A software management system was used to track changes.

2.8.12 Computer Resources (15.0) 2.8.12.1 Air vehicle processing architecture (15.1) DataHawk processing is accomplished by a main microcontroller on the CUPIC autopilot module. Other microcontrollers ar e embedded in sensors (GPS), actuators (main motor controller, servos), and data radios, that are non

- user

- programmable and provide specific low le vel functions. No redundancy is provided in this architecture, consistent with the low cost and minor consequences of failure in this design. 2.8.12.2 Functional design integration of processing elementsThe CUPIC processor provides timing and flow control to all flight functions, sending commands

to the motor controller and servos, and downlink data to the radio. On board sensors are sampled at regular intervals. External asynchronous events (GPS packets, uplink command packets) are handled with interrupt service routines.

2.8.12.3 Subsystem/processing elements All autopilot electronics are located on a single board, as there are no redundant systems. Timing and control flow are designed using a d eterministic time

- slot based architecture, with corresponding test ports for verification of sufficient computational margin to prevent execution time overflow. In flight restart after watch

- dog reset is not available, although this anomaly has never been encountered. Software configuration is maintained via a subversion change management system. Communications use a frequency

- hopping spread spectrum technique, checksum error detection, and extensive packet validity checks to ensure security.

2.8.13 Mai ntenance (16.0) There are no regularly scheduled maintenance items in the DataHawk system, except for battery charge state on the UA and the GCS. These are verified prior to every flight by checklist. Other systems are checked for proper functioning prior to flight during the initialization steps, and the airframe is visually inspected for any damage. Field maintenance in case of damage or failure in any system consists of replacing an item with a spare of the same part, gluing or taping the airframe as n eeded (minor damage), or replacement of the airframe (major damage).

2.8.14 Armament/Stores Integration (17.0) The DataHawk carries no armaments.

2.8.15 Passenger Safety (18.0) The DataHawk carries not passengers.

2.8.16 Other Considerations (19.0) Science data sensors are the only non

- essential payload components, and these do not affect safety of flight when mounted in the vehicle and connected to the autopilot according to the DataHawk design specifications. Flight software does not depend on the se sensors for any critical functions.

2.9 Lost Link ProceduresThe received signal strength of both uplink and downlink is displayed on the GCS with large

numbers so that the PIC can re

- point the ground station antenna for improved link margin, if

neces sary, and thereby avoid a lost link event due to incorrect antenna orientation. Both uplink and downlink use the same transceivers and antennas. If a lost link event occurs the only operator actions are to attempt to re

- acquire the link by pointing the ant enna, or by checking
antenna connections with the GCS. If the link cannot be restored with these actions within 40 sec., flight software will automatically transition to flight termination mode, bringing the UA down rapidly in a controlled right turn spir al. Flight termination mode is disengaged automatically if the link is restored.

2.10 Lost Communication Procedures

In the SDSS, a lost link event is also a lost communication event, and the operating procedure is
the same as for a lost link.

2.11 Emergency Procedures

The contents of this chapter pertain to the operations during abnormal and emergency situations. It is impossible to de velop guidelines and procedures to deal with all situations. The judgment, ski ll, and training of all persons involved are necessary to bring an abnormal o r emergency situation to a safe conclusion. Accordingly, it may be appropriate to refer to other publications such as FAR and AIM manuals. The guidance in this chapter is in the form of descriptions and detailed procedures. Un less safety is jeopardized they shall be applied in the handling of Abnormal and Emergency situations.

These procedures are written specifically for the DataHawk UA, using the CUPIC autopilot and corresponding Ground Control Station (GCS) sy stem developed at CU, operating at the Oliktok Point flight range by personnel from the Uni versity of Colorado at Boulder. Any changes in the COA may also require these procedures to be appropriately adapted.

In general, the response to an in

- fligh t emerg ency is to engage flight termination mode to bring the UA down to the ground rapidly. In less critical situations, such as a severe change in
weather , the landing mode is engaged, bringing the UA down at a specified glide slope and
hea ding to land at the pre

- designated landing coordinates . All incidents and accidents will follow reporting and notification processes and requirements as laid out in FAA Orders 8020.11, 7210.56, and in NTSB 830.T hese procedures are written for a 2

- person team consisting of t he pilot

- in

- command ( PIC )

acting as a mission commander and pilot

- at

- the

- controls (PAC) , and one ground

- based
observer.

2.11.1 Distress Message

A hand

- held VHF radio will be used to broadcast a distress message in emergency situations that have the p otential to affect other air traffic, and to aid in maintaining a safe a irspace when traffic is present in the COA airspace. M essages will be broadcast on 122.8 MHz, corresponding to the UNICOM frequency of the closest airport (Ugnu

- Kaparuk, private)

.

The distress message will contain the following in formation, and will be given in the order listed below. Once broadcast, the message w ill be repeated every five (5) minutes, upon changes in condition or known location, or upo n any update requests received. Once the urgent condition is over, a fin al message will be broadcast to notify any traffic that t he emergency condition is

over.

- `` PAN

- PAN, PAN

- PAN, PAN

- PAN ’’

- ``local traffic”

- ``this is unmaned aircraft DataHawk operating at Oliktok Point ’’

- The nature an d type of the distress

- Operator's intention

- Last known UA position and heading

- UA Altitude

- Hours and minutes of flight time remaining

- Weather

- Other useful information such as visible landmarks, aircraft color, and that no people
are on board

2.11.2 O perati onal Emergency Procedures

0

- 1. Pilot / Operator / Observer unable to perform duties

If either the observer or the PIC becomes incapacitated during the flight , the UA will be commanded to enter flight termination mode by the remaining crew member.0

- 2. Loss of LOS b y Observer

Loss of LOS by the observer can happen when the UA is farther than one (1) lateral mile or higher than 3000' vertical feet from the observer as set in AFS 400 Policy 05

- 01. Loss of LOS can also be caused by equipment failure when u sing aids to vision (e.g. binoculars), reduc tion of LOS range due to abrupt changes in weather or lighting conditions, or by losing visual tracking acquisition of the UA.

- The observer will inform the PIC if LOS has been lost for more than 5 seconds.

- If the re is other air traffic in the area when LOS is lost, the PIC will immediately command flight termination mode.

- If there is no other air traffic in the area, the observer will try to re

- acquire LOS for up to 30 seconds. Failing this, the PIC will command flight termination mode.

0

- 2. Loss of Communica tion Between PIC and Observer The observer will be stationed in close physical proximity to the GCS and the PIC, with
direct voice communication between observer and PIC. Loss of communication can
occur due to in capacitation of either crew member (see 0

- 1), or due to high background acoustic noise levels (e.g. from industrial machinery).

- If communication cannot be restored for 30 seconds, the PIC will command flight
termination mode.

0

- 3. Loss of Communication with ATC Since the DataHawk will be operated in class G airspace, during daylight hours, more
than 5 NM from an airport, below 4 00ft AGL, and away from high traffic areas, ATC
contact will not be maintained.

0

- 4. UA Leaves COA Boundary Uncontrollable

This condition can occur only upon multiple system failures of the communication and navigation systems. For example , if a lost communication event occurs and the navigation solution (e.g. GPS) is thought to be accurate by the UA, though it is off in its solution, then there is a chance for the UA to leave the COA boundary. Alternatively

, if a loiter circle location is not loaded correctly or is the wrong geograph ic location, this could lead to the condition of the UA departing the COA boundary if communi cation to re

- load the circle location has been lost.Failure of both servos on the UA could result in the control surfaces becoming stuck, preventing

corrective actions from the autopilot or GCS.

- In this situation, the first priority of the PIC is to main tain as safe of an airspace surrounding the UA as possible. Although the autopilot has automatic failsafe logic to engage flight termination mode if the flight range boundaries in altitude and lateral radius are exceeded, the PIC will broadcast a PAN

- PAN message as descr ibed in Section
2.11.1

.

- I f the observer is not able to maintain LOS with the UA, the PIC will initiate lost plane procedures to locate the aircraft.

0

- 5. Near Midair Collision

A near midair collision is defined as an incident associated with the operation of the UA in which a possibility of coll ision occurs as a result of proximity of less than 500ft to a nother
aircraft as determined by the PIC or the observer , or a report is received from a nother aircraft’s flight crew stating that a collisi on hazard existed between two or more aircraft. It is the responsibility of the UA ground crew and/or other flight crews to determine whether a nea r midair collision did actually occur and, if so, to initiate a NMAC report as outli ned in FAA Order
8020.1 1 and/or in AIM ( http://www.faa.gov/ATpubs/AIM/ ).

- Traffic and collision avoidance is governed by FAR Part 91.113. However, since the
DataHawk UA is significantly more maneuverabl e than any manned aircraft, the
DataHawk will always give way to all other manned aircraft. Since the DataHa wk is flying low (< 100ft AGL), it is unlikely that it can be above any manned aircraft, hence the primary de

- confliction strategy is to engage fli ght termination mode causing rapid descent of the UA to avoid a near midair collision event. However, the PIC will decide the best course of action in unusual circumstances, e.g. in cases of a helicopter at extremely low altitudes in a landing pattern or hoisting operations. Other actions consist of moving the loiter circle to at safer location or safer radius, or engaging landing
mode.

- The UA observer will advise the PIC of an impending conflict and suggest the best course
of action to avoid a NMAC even t. If an impending conflict is detected in time to safely respond as above, the PIC will broadcast a warning PAN

- PAN message to inform other traffic of the hazard and the intent of the UA operator.

0

- 6. Accident and Crash Recovery

The recovery response plan o utlines the specific duties and responsibilities applicable to the personnel required to perfo rm an accident investigation in the event of a catastrophicfailure. A running log of all actions encompasses agencies notified, person's names, and time s

of cont act will be maintained by the PIC. Notification and reportin g of all aircraft accidents and incidents will follow guidance as outlined in FAA Order 8020.11, 7210.56 and NTSB 830.

- Because of the small size of the UA the likelihood of significant damage to s urrounding
structures is small. There is no on

- board fuel, so a post

- crash fire is extremely unlikely. However, to avoid hazardous fumes, the procedure in this event is to let the aircraft
burn when no t endangering life or property.

0

- 7. Lost Aircraft Procedu res

A lost plane emergency occurs when there is a communication failure leading to a lost communication event, and during the lost communication e vent the observer has lost LOS of
the UA. With these two com bined events the safe operation of the UA can no longer be
maintained.

- In this situation, the first priority of the PIC is to maintain as safe of an airspace surrounding the UA as possible. This is done by broadcasting a PAN

- PAN message as described in Section 2.11.1. Following this, recovery operatio ns will commence starting
at the last known location of the UA.

2.11.3 Ground Control Station Emergency Procedures

G

- 1. GCS Power Failure

Failure of the main battery or power supply of the laptop computer running the GCS software is an unlikely occurrence, since the laptop is a semi

- rugged type with more reliable components, and because a car battery backup is utilized.

- In this event, there is no action t o be taken by the ground crew, since re

- boot procedures (e.g. after replacing the laptop battery or checking external connections) will require more than the 40 second time out period for lost link. After this period, the flight software automatically enga ges flight termination mode.

G

- 2. GCS Lock Up

Lock up can be caused by a crash of either the Realterm of the Matlab programs that make up the GCS , or by a crash of the Window operating system

.

- In this event, the programs will be closed and restarted by the PIC. If this cannot be accomplished within the 40 second lost link time out period, the flight software will automatically engage flight termination mode.G

- 3. GCS Radio Failure

This can result from electronics hardware failure, or the failure of a cable or connector linking the radio with the laptop computer or between the radio and the antenna.

- In this event, the PIC will verify radio and antenna connections. If this is not t he problem, a spare radio module cannot be substituted in time before the 40 second lost link time out expires, and the UA will automatically enter flight termination mode.

2.11.4 DataHawk UA Emergency Procedures

A

- 1. Lost Link.

Since there is only a si ngle communication link between the DataHawk UA and the GCS,
a lost link constitu tes a lost communication event. The CUPIC autopilot detects a lost link event by the absence of 1 Hz “heartbeat” packets in the uplink for 40 seconds.

- The ground station dis play shows the link strength, and a 40 second timer for lost link time out. Both can be used by the PIC to avoid lost link, or to attempt to restore the link by pointing the ground antenna for improved signal strength, or by inspecting radio and
antenna cables and connectors for faults. If these actions are ineffective and the time out expires, the UA will automatically enter flight termination mode due to a lost link

event.

- If the link is restored, the UA will automatically exit flight termination mode.

- A fter the communication timeout has occurred, if there is traffic in the COA airspace the PIC will begin broadcasting the appropri ate PAN

- PAN message every 5 minutes for the
duration of the lost

- communication event, or until the UA is on the ground.

A

- 2. Lost GPS

The autopilot counts the number of valid GPS updates in any 20 second interval. If the number of valid updates drops to zero, a lost GPS event is detected.

- A lost GPS event causes an automatic engagement of flight termination mode.

- Flight termination is cancelled if a valid GPS fix is received.

- There are no operator actions in this event.

A

- 3. Engine Out

Failur e of the propulsion system during the auto helix operating mode results in a controlled gliding descent. Both the landing and flight termination modes have the motor
turned off.- The PIC will decide the safest course of action in this event. The options ar e to a) do

nothing, so the UA will descend to the ground on a circular helix, b) engage landing mode, so the UA will descend to the ground on a fixed heading toward the landing coordinates, or c) engage flight termination mode, so the UA will descent rapi dly in a spiral to the ground.

A

- 4. Main battery depletion

The main battery state is displayed on the ground station (voltage, and percent capacity remaining), for the PIC to use in planning for landing as the battery nears its voltage cutoff limit.
If the cutoff limit is reached, the UA automatically enters flight termination mode, and this
mode cannot be exited once it is entered for this reason.

- The PIC will assist the observer in determining the location of the landing due to flight
termination.

A

- 5. Autopilot Failure

This can be due to onboard power failure, electronics hardware failure, flight sensor failure, or actuator (servo or control surface) failure. All result in uncontrolled flight.

- In this situation, the first priority of the PIC is t o maintain as safe of an airspace surrounding the UA as possible. This is done broadcasting a PAN

- PAN message as describ ed in Section 2.11.1, repeating every 5 minutes until the UA has been verified to be on the ground, or until the maximum flight time of the UA has expired.

- The observer will track the UA using all reasonable effort to not lose LOS.

- if the observer is not able to maintain LOS with the UA, the PIC will initiate lost plane procedures to locate the aircraft.

A

- 6. Structural Failure

The response to a structural failure is de termined by the type of failure and in what condition the failure put the UA in. In addition, there are some failures that the autopilot will be abl e to accommodate, and others that will result in uncontrolled fligh t.

- T he observer will inform the PIC of any noticeable structural failures suggest the best
course of action.

- I t is up to the PIC, using their skill and knowledge, to determine what the safest course of action is. The options are: a) i f the autopilot seems to be f lying the UA safely, the landing mode will be commanded; b) if safe flight is compromised, the flight termination mode will be commanded; c) if the UA is no longer flying, every attempt will be made toobserve the descent to assist the observer in later determining the cause of the failure.

A

- 7. Degrading Performance of the Autopilot

Degrading or poor performance of the autopilot can be caused by noisy or failed

sensors, loss of power regulation, friction in actuators, etc.

- In this event, th e PIC will determine if this degradation is likely to affect safety of flight. If so, either the landing mode or the flight termination mode will be engaged, as appropriate
, to best maintain range safety.

2.12 Avionics Equipment

Equipment Suffix Type X (No DME, no transponder)
GPS Yes Moving map indicator (GCS) Yes Tracking capability Yes TCA/MCAS No
ELT No Transponder No

2.13 Lights

Landing No Position/Navigation No Anti

- collision No Infrared (IR) No

2.14 Spectrum Analysis Approval

Data Link Yes Control Link(s) Yes(1) Operations using R/C per Title 47 CFR 95 No NTIA/FCC Authorization No Attachment

2.15 Data LinkThe SDSS data link is a single communication channel, operating in the unlicensed 902

- 928 MHz

ISM band, using a spread spectrum frequency hopping protocol with Di gi XBee Pro XSC radio hardware, with 0.1W maximum power output. The radio complies with the speci fi cations
described in Title 47 Part 15.247. A monopole antenna provides a doughnut shaped pa ttern with vertical polarization that is well suited to the low operation altitude of the DataHawk.

2.16 Control Link

The SDSS control link is a single communications channel, operating in the unlicensed 902

- 928
MHz ISM band, using a spread spectrum frequ ency hopping protocol with Digi XBee Pro XSC radio hardware, with 0.1W maximum power output. This link shares the same transceiver and
antenna hardware with the data link. The radio complies with the speci fi cations described in
Title 47 Part 15.247. The ground antenna is a higher gain monopole than that on the UA, but is also vertically polarized and provides a doughnut shaped pattern that is well suited to the low altitude operation of the DataHawk UA.

3.0 Operations

3.1 ATC Communications

Two

- Way V oice Capability Transmitter VHF Band Yes Quantity 1
In

- Flight Retunable Yes UHF Band No Quantity 0
In

- Flight Retunable No HF Band No Quantity 0
In

- Flight Retunable No Receiver VHF Band Yes Quantity 1
In

- Flight Retunable Yes UHF Band No Quantity 0
In

- Flight Retunable No HF Band No Quantity 0
In

- Flight Retunable No Guard (Emergency) FrequenciesVHF Yes

Quantity 1
UHF No Quantity 0 Instantaneous Two

- Way Voice Direct to pilot Yes SATCOM No Relay to aircraft No

3.2 Electronic Surveillance/Detection Capability

EO/IR No Terrain detection No Weather/icing detection No Onboard radar No Other No Attachment Electronic detection system No Electronic detection systems attachment No Attachment Radar observation No NAS Operational Capability No Attachment

3.3 Visual Surveillance/Detection Capability

Maximum distance from UA Vertical 3000 ft Horizontal 1.0 NM Aircraft based (chase aircraft) No Visual obs from one or more ground sites Yes Forward or side looking cameras No

3.4 Ground Based Observer Visual Surveillance/Detection Capability

A ground based observer trained in FAR Part 91 will be used to provide see

- and

- avoid capabilities for the operation of the SDSS UAS. No chase aircraft will be employed nor wi ll a ground based chase vehicle be necessary . The UA is not equipped wit h any camera to provide
forward or side looking capabilities.

At no time will the UA be allowed t o be any further than 1.0 NM mile horizontally, or than 400 ft vertically from th e grou nd based observer. The observer will be co

- located with the PIC and
the GCS. The o bservers will follow FAR Part 91.113 Right

- of

- Way Rules for providing tra ffic andcollision avoidance. Since the DataHawk UA is signi fi cantly mo re maneuverable than an y

manned category of aircraft, the DataHawk UA will always give way to all manned aircraft.

Communication between an observer and the PIC will consist of the following information:

- Notification of traffic detection

- Traffic course and altitude update

- Sugges ted traffic avoidance actions (none, landing mode, flight termination mode)

- Significant weather changes

- Anomalous flight characteristics of the UA

Whe n an observer describes the traffi c, bearing will be given relative to the location of the UA, using card inal and intercardinal compass directions. Altitude will be given in feet AGL.

3.5 Aircraft Performance Recording

Flight data record Yes Control station recording Yes Voice recording No

3.6 Flight Operations Area

Flight operations are conducted for the purpose of pilot training and science sensor testing &
calibrations of the onboard instrumentation.

3.7 Flight Crew Qualifications

The operations crew for the SDSS comprises a two

- person ground crew, consisting of a PIC and an observer. Neither the PIC n or the observer are allowed to serve both functions at the same time. Emergency procedures have been defined in the event one becomes incapacitated.