MIZOPEX SDSS 

DataHawk

Introduction

The SDSS UAS consists of the 1.5-lb DataHawk unmanned aircraft (UA) using the CUPIC

autopilot, operated by a remote ground control station. The CUPIC autopilot and the ground 

control station are custom systems developed at CU for micro UAS. The DataHawk UA is based 

on the commercially available Stryker F-27C model aircraft foam airframe with electric 

propulsion by Park Zone Inc., that has been modified by RECUV to include science sensors and 

autopilot capabilities. Airworthiness of the DataHawk UA is determined using the applicable 

procedures outlined in MIL-HDBK-516A. Operation of the SDSS UAS will use at minimum a twoman team consisting of a ground based observer, and a pilot-in-command (PIC). 

Flight operations are conducted for the purpose of science sensor testing of the Self Deployed 

Surface Sonde (SDSS) component of the Marginal Ice Zone Ocean and Ice Observations and 

Processes Experiment (MIZOPEX), funded by NASA

Proponent Organization

1 Definition of Terms

The definitions given here are provided for clarity. Where applicable, the definitions are taken 

from AFS-400 UAS POLICY 05-01, ASTM F 2395-07 Standard Terminology for Unmanned Aircraft 

Systems, or Title 14, Code of Federal Regulations (14 CFR) part 1.

Research and Engineering Center for Unmanned Vehicles (RECUV)

Landing target: the designated ground target point for the auto landing flight mode, expressed 

in GPS coordinates.
Auto land fight mode: the vehicle is automatically directed toward the landing target along a 

designated landing heading, with an appropriate descent rate based on the altitude where the 

auto land mode was entered. This mode is enabled by the PIC via the ground station, but is 

then automatically entered by the autopilot based on vehicle altitude and heading. This mode 

can be exited (landing aborted) by command from the PIC, in which case flight returns either to 

the auto helix or flight termination modes.

Auto helix flight mode: a semi-autonomous flight mode that directs the vehicle to a designated 

left hand loiter circle laterally, and follows a repeating triangular vertical profile between 

specified floor and ceiling limits. Loiter circle center and radius, as well as helix floor, ceiling, 

climb rate, and descent rate are set by the PIC via ground station controls.

Flight termination mode: : this will turn off the electric propulsion, and command a right turn 

spiral descent at 30 ft/sec. This brings the aircraft down quickly, but in a controlled and highly 

visible way.

This mode is entered automatically by the autopilot upon the following conditions:

- Loss of link

- Loss of GPS

- Outside flight range boundary

- Critically low main battery

This mode can also be entered by the PIC via ground station command, and is the primary 

means of de-confliction with other aircraft that may encroach on the flight range. 

Once entered, flight termination mode can be exited if the entry conditions no longer exist, 

except for the low battery case. 

Emergency fight plan: this plan consists of moving the auto helix mode loiter circle to a safe 

location and altitude if all UA systems are nominal. In all other cases, an emergency will induce 

either landing mode or flight termination mode. 

GCS: the ground control station consists of a Windows-based laptop computer running the 

ground station software for display of flight status, entry of commands, and archiving of flight 

data. The GCS communicates with the DataHawk UA via a radio modem link in the unlicensed 

900 MHz ISM band. The ground station is powered by the laptop battery, with a 12V car battery 

backup. 

Lost GPS: the UA can continue to perform normally without a new GPS solution for up to 20 

sec. before a loss of GPS event is detected. 
LOS: line-of-sight is defned in AFS-400 Policy 05-01 as a method of control and collision 

avoidance that refers to the pilot or observer directly viewing the UA with human eyesight. 

Maximum LOS lateral distance is set at 1 mile.

Lost communications: an event where the control station has lost all communication capability 

with the UA. The SDSS has a single 900 MHz uplink and downlink, using the same transceivers 

and radios for both link directions.

Lost link: an event where the control station has lost either or both of the uplink and downlink 

of a single communication channel. For the SDSS, a lost link event is also a lost communications 

event. This event is detected when the 1 Hz “heartbeat” packets sent from the ground station 

to the UA are absent for any 40 sec. interval. 

Miniature unmanned aircraft: an aircraft with a maximum gross takeoff weight of 55 lb. or less.

With its maximum weight of 1.5 lb. the DataHawk UA easily qualifies as a miniature UA. 

Mode of control: the means by which the pilot uses to direct the activity of the UAS. There are 

three modes of control in the SDSS: auto helix, auto land, and flight termination. The UAS will 

use different modes of control in different phases of fight, selected by the PIC. 

PIC: Pilot-in-command acts as the mission commander, directing all fight, safety and emergency 

operations and is the person directly responsible for the operation of the UA. The responsibility 

and authority of the pilot in command as described by 14 CFR 91.32, Responsibility and 

Authority of the Pilot in Command, apply to the SDSS PIC. This definition is not intended to 

suggest that there is any requirement for the UA PIC to be qualified as a crew member of a 

manned aircraft. 

R/C: for this document, R/C refers to a description relating to the manual remote control of 

model aircraft systems as is currently practiced by hobbyists operating under AC 91-57. This 

definition is provided to contrast the description and operation of the semi-autonomous SDSS 

versus manual R/C control.

2.0 Operational Description

Flight operations are conducted for the purpose of science sensor testing of the Self Deployed 

Surface Sonde (SDSS) component of the Marginal Ice Zone Ocean and Ice Observations and 

Processes Experiment (MIZOPEX), funded by NASA.
2.1 System Description

2.1.1 Aircraft System Description 

The SDSS UAS consists of the 1.5-lb DataHawk unmanned aircraft (UA) using the CUPIC

Wingspan 37in

Wing Area 3.1 sq. ft.

GTOW 1.5lb

Wing Loading 0.48 lb/sq. ft.

Length 24in

Airfoil unknown

DataHawk UA, showing the elevon control surfaces, rear folding 

propeller and electric motor, and elastic foam airframe.
autopilot, operated by a remote ground control station. The CUPIC autopilot and the ground 

control station are custom systems developed at CU for micro UAS. The DataHawk UA is based 

on the commercially available Stryker F-27C model aircraft foam airframe with electric 

propulsion by Park Zone Inc. that has been modified by RECUV to be more rugged, and to 

include science sensors and autopilot capabilities.

2.2 Performance Characteristics

2.2.1 Modifications

The F-27C foam model airframe is modified in several ways. It is reinforced with interior carbon 

fiber rods and exterior filament tape to take landings on unimproved surfaces without damage. 

A more robust custom motor mount and fiberglass vertical tails are used, as well as more 

rugged metal-gear servos for the elevon control surfaces. The stock electric motor and 

propeller is replaced with ones that provide less speed and climb performance, but higher 

efficiency and longer range. A ventral launch hook is installed with a monofilament line cutter 

for autonomous bungee deployment from a portable launcher. 

2.3 Ground Control Station

The custom control station is installed on a Windows-based laptop computer, using Matlab to 

program data displays, user controls, and manage communication with the UA. A map of the 

local area is provided on the display, and the UA flight path is shown (in green) on this map 

along with the landing target for the auto landing mode and the designated loiter circle for the 

auto helix flight mode (blue lines). The flight range boundaries are also shown (red circles). 

Performance Characteristics

Climb rate (ft/min) 900

Descent rate (ft/min) 1800

Turn Rate (deg/sec) 30

Cruise Speed (KIAS) 25

 Maximum 35

 Minimum 20

Approach Speed (kts) 25

Operating Altitudes (feet MSL)

 Maximum 10000

 Minimum 3

Gross Takeoff Wt (lbs) 1.5
User controls are provided to properly initialize the UA and verify all functions before launch, to 

set the landing target and heading, set the loiter circle center and radius, set the helix floor and 

ceiling altitudes, set the helix ascent and descent rates, and set the flight range boundary 

center, radius, and ceiling. Controls are provided to change modes between the nominal auto 

helix mode and landing mode and flight termination mode. Additional displays provide 

information on aircraft health and status, flight data (e.g. altitude, heading, airspeed, climb 

rate, etc.), payload sensor data, and quality of the communication link. All flight data is 

recorded on the laptop, with filenames containing the date and time of the flight for archiving 

and later data retrieval. 

2.4 Communications

A single uplink conveys commands and parameter values to the UA, and a single downlink 

relays flight information and sensor data to the ground station. Both links use commercial radio 

modems (Digi XBee Pro XSC) in the 902-928 MHz ISM band, using identical radios modules on 

the UA and the GCS with a maximum of transmit power of 100mW. These radios use frequency 

hopping spread spectrum techniques to minimize the impact of interference. Typical 

communication slant range is 6NM. All critical parameters and commands from the ground 

station are echoed back to the GSC for verification, and a “heartbeat” packet is uplinked to the 

Ground control station, hosted on a semi-rugged laptop computer and running 

Matlab for data archiving and display, and operator control of the UA flight modes 

and parameters.
UA at 1 Hz to provide continuous link status for automatic lost link contingency procedures. 

Link status is displayed on the ground station with large figures, so the ground station antenna 

can be pointed manually by the observer, if necessary, to optimize the link signal strength. 

2.4 Certified TSO Components

There are no TSO Certified Components in the SDSS system. 

2.7 Launch and Recovery

2.7.1 Launch

The DataHawk is launched from a custom portable launcher, consisting of support rails and a 

length of surgical tubing. The UA is restrained on the launcher with a monofilament tether, that 

is cut upon command from the PIC via the launch control button on GCS. For safety, the electric 

motor is engaged automatically after the plane becomes airborne. 

2.7.2 Recovery

The DataHawk is constructed of resilient expanded polypropylene foam, and has been further 

reinforced to land on any surface without damage. In particular, the electric motor and folding 

propeller are located in the rear to prevent damage during landing, and to present soft foam 

leading edges to any object during landing. This foam also provides flotation for water 

landings. No special landing sites are needed, although the PIC can specify particular landing 

locations and landing headings to account for wind or to avoid contact with structures or 

personnel. 

2.8 Airworthiness

The DataHawk UA was certified using the applicable sections outlined in MIL-HDBK-516A as 

specified in section 6.3.1 of AFS-400 and section 6.1 of UAS Interim Operational Approval 

Guidance 08-01. The certification was done by the DataHawk certification team led by RECUV 

member Dr. Dale Lawrence. The DataHawk has been qualified in this process through design, 

analysis, and through flight testing in restricted airspace in Salina, Kansas, and in Peruvian 

airspace (under CORPAC approval). Sections referenced in parentheses below refer to the 

corresponding sections of MIL-HDBK-516A.

2.8.1 Systems Engineering (4.0)

2.8.1.1 Design Criteria (4.1)
The DataHawk was designed as a low cost UA suited to the rigors of atmospheric and ocean 

science field work, that could be safely operated with a small ground crew and minimal ground 

support equipment. Maximum advantage was taken of low-cost commercially available model 

aircraft components, with the addition of custom avionics, sensors, and software to suit these 

applications. 

2.8.1.2 Tools and Databases (4.2)

Design files for custom mechanical, electronic, and software components are archived in a 

subversion repository, and databases of flight data are archived on a RECUV server. 

2.8.1.3 Materials Selection (4.3)

Materials are selected from commercially available options based on the high durability and 

low cost needs of the DataHawk science missions, while minimizing the consequences of 

damage or injury in operation. In particular, the entire vehicle is frangible, except for the 

electric motor and aluminum motor mount, and they were purposefully located in the rear to 

minimize the potential for harmful contact. 

2.8.1.4 Manufacturing, support, and quality (4.4)

The DataHawk is assembled in RECUV facilities by Aerospace Engineering students, using 

commercial and custom made components, under the supervision of RECUV faculty. The RECUV 

team has the expertise and knowledge to meet the level of quality required for small, foam 

airframe UAs, custom autopilots, and sensor payloads.

2.8.1.5 Operator’s and maintenance manuals (4.5)

The ight logs produced for every ight will have detailed descriptions of any anomalies or 

failures. A physical inspection will be conducted prior to each flight. Maintenance will be 

performed as needed by members of the RECUV Fabrication Lab who are skilled in constructing 

and maintaining RECUV UAS.

2.8.1.6 Configuration Identification (4.6)

The configuration of the DataHawk for the SDSS mission is defined by software and hardware 

files maintained in a subversion repository at the University of Colorado. 

2.8.1.7 Configuration status accounting (4.7)

The DataHawk UA does not employ a CSA system as defined in section 3 of MIL-HDBK-61A.

2.8.2 Structures (5.0)

2.8.2.1 Loads (5.1)

Flights in the scientific application proposed are much less stressful than the aerobatic flights 

the airframe was designed for, with low airspeed and docile helix flight paths at slow climb 

rates. The bungee launcher uses a long section of surgical tubing to produce a gentle launch 

acceleration (0 to 25 kts over 30 feet). Landing loads on unimproved surfaces can be high, but 

the vehicle has been designed to survive many of these hard landings. 

2.8.2.2 Strength (5.2)

The basic airframe has been extensively tested in aerobatic flight by the manufacturer (Park

Zone, Inc.) and this has been further stiffened and ruggedized by RECUV to be more robust to 

hard landings. 

2.8.2.3 Materials, processes, corrosion prevention, nondestructive evaluation, and repair

(5.3)
All of the materials in the DataHawk were selected for immunity to corrosion and weathering 

degradation over the short service life of the vehicle (about 20 flight hours). Minor damage to 

the airframe is easily observed and repaired as needed in the field by gluing or taping the foam. 

Major damage is easily detected by flexing the airframe by hand to check for loss of stiffness, 

e.g. due to a broken internal carbon fiber stiffener. In this case, the airframe is retired and 

discarded. Since field deployment is remote, a spare airframe will be carried to cover this 

possibility.

2.8.2.4 Damage tolerance and durability (5.4) 

The DataHawk was designed to survive harsh landing conditions by using elastic foam where 

contact during landing can occur. Stiffness is provided by internal carbon fiber spars, which are 

protected by the foam exterior. Damage and fatigue due to flight loads are not expected due 

to the relatively small loads, and the short service life (about 20 flight hours). 

2.8.2.5 Flight operating limits (5.5)

The airspeed is under closed loop control, with fixed reference values that only vary with 

altitude. Climb and descent rates are also under closed loop control with maximum safe 

parameter limits enforced in the ground station. Maximum flight range in altitude and radius is 

specified before launch; leaving this range for any reason causes automatic flight termination. 

2.8.2.6 Functionality (5.6)

All flight control systems are inspected and tested prior to flight to ensure they operate freely 

without binding or deflecting as required in 5.6.1. The ground station software locks out the 

launch command until the proper initialization and checkout of control surfaces, sensors, and 

propulsion has been completed. 

2.8.2.7 Structural dynamics (5.7)

The maximum airspeed is well within the incompressible flow regime, so does not approach the 

regime for aerolastic and aeroservoelastic instabilities. Flight tests and pre/post-flight 

inspections verify compliance with Sections 5.7.4-5.7.8. The DataHawk UA is not a rotorcraft, 

therefore sections 5.7.9-5.7.11 are ignored.

2.8.2.8 Mass properties interface (5.8)

The mass properties of the DataHawk are static. There is no fuel, and the main battery is a 

fixed type and size that is rigidly mounted in the vehicle. The preflight checklist includes 

verification of the proper longitudinal c.g. location by balancing the vehicle at points molded 

into the foam airframe. 

2.8.2.9 Stores/armament interface (5.9)

There are no external stores or armaments.

2.8.2.10 Structural maintenance manuals (5.10)

There are no formal structural maintenance procedures. The airframe is check for damage 

before every flight as noted in 2.8.2.3. 

2.8.2.11 Rotary wing air vehicles (5.11)

The DataHawk is not a rotary wing vehicle.
2.8.3 Flight technology (6.0)

2.8.3.1 Stability and control (6.1)

The DataHawk airframe has stable short period and roll subsidence modes. Stability of the 

phugoid mode is augmented by rate damping in the altitude control loop. The spiral mode is 

stabilized by the bank angle control loop. A heading loop provides tracking of command 

headings obtained from a globally stable vector field guidance law. Parameters in the vector 

field set the loiter circle location and radius, using GPS position to determine guidance vector 

directions. Parameters in the altitude loop set the ascent and descent rates and ceiling and 

floor altitudes. In the landing control mode, vector field heading commands are replaced by 

constant heading commands, and a descending altitude command. In the flight termination 

control mode, a steep right turn spiral is commanded with a high descent rate using pressure 

altitude alone, assuring controlled descent if GPS drops out. 

2.8.3.2 Vehicle control functions (6.2)

The DataHawk utilizes an elevon control method, with differential deflection producing roll 

(aileron) moments, and collective deflection producing pitch (elevator) moments. There are 

two control surfaces, one on the trailing edge of each wing, and two corresponding servo 

actuators, connected by conventional pushrods and control horns. 

2.8.3 Aerodynamics and performance (6.3)

2.8.3.1 Flight vehicle (6.3.1)

The aerodynamics of the DataHawk derive from the commercial R/C model airplane design of 

the Stryker F-27C from Park Zone, Inc. These have been extensively tested over a wide range of 

flight conditions including high speed and aerobatic flights. The DataHawk application has a 

very limited flight envelope by comparison, with low speeds, limited bank angles, and small 

climb/descent rates. 

2.8.3.2 Installed propulsion capability (6.3.1)

A brushless electric motor and a folding propeller provide propulsion for the DataHawk. These 

are commercial components, selected for their suitability for the flight envelope of the 

DataHawk. 

2.8.3.3 Flight limits (6.3.2)

The restricted DataHawk flight envelope has been investigated in test flights in US restricted air 

space and by CORPAC permission in Peru, and suitable limits on bank angle, climb/descent 

rates, and airspeed have been established for safe flight. These characteristics are not subject 

to variation with fuel, payload, or stores, since the sensor payload is fixed, and no fuel or stores 

are carried.
2.8.4 Propulsion (7.0)

2.8.4.1 Performance (7.1)

The DataHawk is powered by a brushless electric motor that is installed and operated according 

to manufacturer’s recommendations. The UA is not operated at low altitude (100ft MSL), 

hence is not expected to encounter icing conditions.

2.8.4.2 Operability (7.2)

The engine is operated by the autopilot, which has been tested for adequate control system 

stability margins over the flight regime. The only operator control of the engine is to shut it 

down by engaging the flight termination mode. 

2.8.4.3 Engine structures (7.3)

The engine is mounted to a custom aluminum mount that is much stronger than the plastic one

supplied by the manufacturer, in order to survive hard landings. This mount is external to the 

airframe and is inspected before and after every flight for damage and fastener integrity.

2.8.4.4 Engine control and accessory systems (7.4)

The engine is controlled by a commercial brushless motor controller designed for this purpose, 

and rated for the motor and propeller used, as well as the range of flight regime allowed. There 

are no accessory systems. Failure in the engine control system will result in a loss of 

propulsion. However, this is causes a controlled descent from a low altitude (100ft) at low 

airspeed (25 kts). Therefore a failure in the motor or its control system will not affect

safe operation of the UA as required in 7.4.5.

2.8.4.5 Engine monitoring system (7.5)

Throttle setting is monitored in the autopilot and relayed to the ground station. Since 

anomalous operation or failure has such minor safety consequences (see 7.4), more 

sophisticated engine monitoring is avoided in order to reduce vehicle cost, hence the cost of 

vehicle loss due to a propulsion anomaly. 

2.8.4.6 Engine bearing and lubrication system (7.6)

Engine bearings are sealed and there is no lubrication system. Proper bearing lubrication is 

checked by testing the motor during initialization procedures before every launch.

2.8.4.7 Engine installations compatibility (7.7)

All motors are of the same type and size, with common fastener locations and sizes. They are 

installed according to manufacturer’s recommendations. 

2.8.4.8 Failure modes (7.8)

Engine failure modes include loss of main battery power, failure of the throttle command from 

the autopilot, failure of the motor controller, opening or shorting of motor windings, seizing of 

motor bearings or rotor/stator interference, and failure of the motor/propeller coupling. All 

failure modes result in loss of propulsive power. Except for main battery failure, the autopilot 

provides a controlled descent in case of propulsion failure. Main battery depletion induces 

motor-off flight termination in a controlled descent as outlined in emergency procedures in 

Appendix 8. Main battery failure results in an uncontrolled descent from 100ft MSL.

2.8.4.9 Flight manual/procedures and limitations (7.9)

Operators are trained to be aware of the effects of propulsion failure, but there are no operator 

actions to be taken in this situation. 

2.8.4.10 Engine externals (7.10)

Wiring to the engine is captured inside and protected by the engine mount.
2.8.4.11 Engine computer resources (7.11)

The motor controller is a self-contained microprocessor system, and requires no other 

computer resources. 

2.8.4.12 Propellers and associated subsystem components (7.12)

The propeller and its attachments are commercial products designed for this purpose and for 

this thrust and airspeed range. They are attached based on manufacturer’s recommendations. 

2.8.4.13 Rotors and associated subsystem components (7.13)

The DataHawk is not equipped with a rotor. 

2.8.5 Air Vehicle Subsystems (8.0)

2.8.5.1 Hydraulic and pneumatic systems (8.1)

The DataHawk carries no hydraulic or pneumatic systems. 

2.8.5.2 Environmental management system (8.2)

The DataHawk carries no environmental management systems. 

2.8.5.3 Fuel system (8.3)

The DataHawk has no fuel system. A lithium polymer battery provides the energy for 

propulsion. 

2.8.5.4 Fire and hazard protection (8.4)

The DataHawk UA is not equipped with on-board fire monitoring or prevention systems. 

However, as per 8.4.19 the ground crew operating the DataHawk UA will be equipped with a 

fire extinguisher in the event of a post-crash or other ground fire.

2.8.5.5 Landing gear and deceleration systems (8.5)

The DataHawk UA does not have landing gear. The fuselage structure and wings have been 

designed to withstand the impact forces during landing. The DataHawk UA is not equipped with 

a braking system. There is no backup system as outlined in 8.5.9.1 because the DataHawk UA 

poses minimal risk to persons or property when conducting ground operations due to its small 

size and low airspeed. There are no auxiliary deceleration devices as discussed in section 8.5.11.

Ground and launch preparation of the DataHawk UA will be done by the ground crew physically 

carrying the UA, due to its small size (8.5.12).

2.8.5.6 Auxiliary/emergency power systems (8.6)

The DataHawk UA is equipped with a lithium polymer battery to provide primary power for 

avionics and sensor payload. There is no backup power system. The APS/EPS system is 

environmentally safe.

2.8.5.7 Aerial refueling system (8.7)

The DataHawk cannot be refueled in flight. 

2.8.5.8 Propulsion Installations (8.8)

The engine/air vehicle physical interface was verified to be safe through bench and flight tests 

conducted by RECUV as required in 8.8.1. The current throttle setting is the only propulsion 

system information required for the ground crew, and is available through the ground control 

station. The DataHawk UA will not be flown in adverse weather conditions, including high 

winds, heavy precipitation, or in icing conditions. 

2.8.5.9 Mechanisms (8.9)
The propeller folds when the engine is not operating. Unmodified commercial folding 

propellers are used that are designed for this purpose. There are no other mechanisms 

associated with the propulsion system. The propeller is inspected before every flight.

2.8.6 Crew Systems (9.0)

The DataHawk is unmanned, therefore there are no crew systems. 

2.8.7 Diagnostic Systems (10.0)

2.8.7.1 Failure modes (10.1)

Due to the simplicity of the DataHawk vehicle and its operation modes, there are only a few 

failure modes:

- Main battery failure: detected by operator directly via battery voltage telemetry to the 

ground station.

- Main battery depletion: automatically detected by the autopilot, and detected by 

operator via battery voltage telemetry to the ground station.

- Propulsion failure: detected by operator indirectly via throttle and altitude telemetry to 

the ground station.

- Structural failure: detected indirectly by the operator via flight path and altitude 

telemetry to the ground station, and directly by visual observation of the vehicle 

behavior. 

- Control surface failure: detected indirectly by the operator via flight path and altitude 

telemetry to the ground station, and indirectly by visual observation of the vehicle 

behavior.

- Flight computer failure: detected directly by loss of downlink telemetry stream, and 

indirectly by visual observation of the vehicle behavior.

- Flight sensor failure: detected directly by the operator via airspeed, pressure altitude,

and bank angle sensor telemetry to the ground station, and indirectly by visual 

observation of the vehicle behavior.

- Lost GPS: detected automatically by the autopilot, and directly by the operator via 

downlink telemetry of GPS lock and flight path to the ground station.

- Lost link: detected automatically by the autopilot, and directly by the operator via 

downlink telemetry of link signal strength and “heartbeat” packet drop outs. 

The consequences of these failure modes, as well as operator responses, are outlined in the

attached emergency procedures document.

2.8.7.2 Operation (10.2)

The autopilot automatically detects main battery depletion, lost GPS, and lost link failures. Its 

response in all cases is to transition to flight termination mode. All other failure modes are 

detected by the operator based on ground station data display or by visual detection of 

anomalous flight behavior by the observer. Only the low battery (imminent depletion) and lost 

link failures have effective operator responses. All other failures result in either uncontrolled 
descent, controlled descent, or flight leaving the designated flight range which causes 

automatic flight termination. This diagnostic system will not induce failures in the DataHawk

UA as required in 10.2.3.

2.8.8 Avionics (11.0)

2.8.8.1 Avionics architecture (11.1)

The DataHawk avionics complement consists of the CUPIC autopilot, IR horizon sensors for bank 

angle, a pitot/static sensor for airspeed, an absolute pressure sensor for altitude, GPS for lateral 

position and ground speed, a brushless speed controller for propulsion, a data radio for uplink 

of commands and downlink of flight parameters and sensor data, and payload sensors for the 

science mission. Real time control loops run at 100 Hz and 10 Hz, with data downlinks at 10Hz 

and 1 Hz. Consistent with the low cost and minimal consequences of failure for the DataHawk, 

none of its avionics systems are redundant. 

2.8.8.2 Avionics subsystems (11.2)

All necessary ight information is provided to the ground crew through the ground control 

station as required in 11.2.1. Flight controls on the ground station are activated via screen 

buttons and data entry fields on a semi-rugged laptop computer designed for outdoor use, and 

are sufficiently reliable for the DataHawk application. The control link between the ground 

station and CUPIC on-board the UA is a single point of failure. Loss of this link results in 

automatic flight termination. Normally, the aircraft survives with little damage and risk to 

persons and property is minimal due to the low kinetic energy and elastic foam airframe. All 

systems on the DataHawk have been qualified by test in an environmental chamber for ambient 

temperatures from +40C to -40C. Safe operating power limits have been designed with 

multiple levels of regulation and adequate voltage margins, along with low a battery voltage 

warning on the ground station. 

2.8.8.3 Avionics air vehicle installation (11.3)

The avionics were designed by the RECUV team at CU, and installation is accomplished in-house 

following the procedures established by that design. In particular, antenna location, 

orientation, and type have been designed and tested to provide reliable GPS reception and 

telemetry links. 

2.8.9 Electrical System (12.0)

2.8.9.1 Electric power generation system (12.1)

The DataHawk electrical power is provided by a lithium polymer battery. The battery will be 

fully charged (checklist item) prior to any flight. The CUPIC autopilot provides power source 

monitoring (voltage) during flight. No backup power systems is supplied. 

2.8.9.2 Electrical Wiring, including power distribution (12.2
The electrical wiring used throughout the DataHawk UA is appropriate to handle the required 

loads, specifically the wiring used for the propulsion motor, power source, and control servos as 

required in 12.2.1 and 12.2.2. Power distribution on the DataHawk is done through a wiring 

harness that uses 2-pin JST and conventional 3-pin servo connectors that have been used for 

several years by the RECUV team with zero failures. 

2.8.10 Electromagnetic Environmental Effects (13.0)

2.8.10.1 Component/subsystem E3 qualification (13.1)

External interference sources in the 900MHz band in populated areas can degrade the link 

telemetry link margin slightly, but no such interference is expected in the remote operating 

region of this application. 

2.8.10.2 System-level E3 qualification (13.2)

Mutual electromagnetic compatibility has been verified by integrated system testing for 

interference and induced noise levels within tolerance levels. The system has also been flight 

tested in the beam of a high-power radar at Jicamarca, Peru, with no observable effects. 

Electrostatic charging issues in flight are avoided with direct supply return line wiring to all 

subsystems. No lightning protection systems are supplied. No electro-explosive devices are 

used. 

2.8.11 System Safety (14.0)

2.8.11.1 System safety program (14.1)

A systematic safety program was developed for the DataHawk, identifying safety issues at the 

outset of the program, and addressing these issues through the vehicle design, ground station 

design, concept of operations, and software design. Key aspects considered were range safety, 

failure modes and effects, and safety of operating and other ground personnel and property. 

2.8.11.2 Safety design requirements (14.2)

The DataHawk system is designed to be small and slow in order to limit kinetic energy. It is 

designed to be frangible, with a soft elastic foam exterior to limit contact pressures that can 

cause injury or damage. It is designed to fly low to avoid other air traffic. It is designed to be 

simple to operate, reducing the likelihood of operator error. 

2.8.11.3 Software safety program (14.3)

Software development occurred under specific safety requirements, including positive 

identification of flight code version, verification of all critical ground station commands, 

verification of all critical initialization and pre-flight check list items with appropriate function 

lockouts. A software management system was used to track changes. 

2.8.12 Computer Resources (15.0)

2.8.12.1 Air vehicle processing architecture (15.1)

DataHawk processing is accomplished by a main microcontroller on the CUPIC autopilot 

module. Other microcontrollers are embedded in sensors (GPS), actuators (main motor 

controller, servos), and data radios, that are non-user-programmable and provide specific low 

level functions. No redundancy is provided in this architecture, consistent with the low cost and 

minor consequences of failure in this design. 

2.8.12.2 Functional design integration of processing elements
The CUPIC processor provides timing and flow control to all flight functions, sending commands 

to the motor controller and servos, and downlink data to the radio. On board sensors are 

sampled at regular intervals. External asynchronous events (GPS packets, uplink command 

packets) are handled with interrupt service routines. 

2.8.12.3 Subsystem/processing elements

All autopilot electronics are located on a single board, as there are no redundant systems. 

Timing and control flow are designed using a deterministic time-slot based architecture, with 

corresponding test ports for verification of sufficient computational margin to prevent 

execution time overflow. In flight restart after watch-dog reset is not available, although this 

anomaly has never been encountered. Software configuration is maintained via a subversion 

change management system. Communications use a frequency-hopping spread spectrum 

technique, checksum error detection, and extensive packet validity checks to ensure security. 

2.8.13 Maintenance (16.0)

There are no regularly scheduled maintenance items in the DataHawk system, except for 

battery charge state on the UA and the GCS. These are verified prior to every flight by checklist. 

Other systems are checked for proper functioning prior to flight during the initialization steps, 

and the airframe is visually inspected for any damage. Field maintenance in case of damage or 

failure in any system consists of replacing an item with a spare of the same part, gluing or 

taping the airframe as needed (minor damage), or replacement of the airframe (major 

damage). 

2.8.14 Armament/Stores Integration (17.0)

The DataHawk carries no armaments. 

2.8.15 Passenger Safety (18.0)

The DataHawk carries not passengers. 

2.8.16 Other Considerations (19.0)

Science data sensors are the only non-essential payload components, and these do not affect 

safety of flight when mounted in the vehicle and connected to the autopilot according to the 

DataHawk design specifications. Flight software does not depend on these sensors for any 

critical functions. 

2.9 Lost Link Procedures
The received signal strength of both uplink and downlink is displayed on the GCS with large 

numbers so that the PIC can re-point the ground station antenna for improved link margin, if 

necessary, and thereby avoid a lost link event due to incorrect antenna orientation. Both uplink 

and downlink use the same transceivers and antennas. If a lost link event occurs the only 

operator actions are to attempt to re-acquire the link by pointing the antenna, or by checking 

antenna connections with the GCS. If the link cannot be restored with these actions within 40 

sec., flight software will automatically transition to flight termination mode, bringing the UA 

down rapidly in a controlled right turn spiral. Flight termination mode is disengaged 

automatically if the link is restored. 

2.10 Lost Communication Procedures

In the SDSS, a lost link event is also a lost communication event, and the operating procedure is 

the same as for a lost link. 

2.11 Emergency Procedures

The contents of this chapter pertain to the operations during abnormal and emergency 

situations. It is impossible to develop guidelines and procedures to deal with all situations. The 

judgment, skill, and training of all persons involved are necessary to bring an abnormal or 

emergency situation to a safe conclusion. Accordingly, it may be appropriate to refer to other 

publications such as FAR and AIM manuals. The guidance in this chapter is in the form of 

descriptions and detailed procedures. Unless safety is jeopardized they shall be applied in the 

handling of Abnormal and Emergency situations.

These procedures are written specifically for the DataHawk UA, using the CUPIC autopilot and 

corresponding Ground Control Station (GCS) system developed at CU, operating at the Oliktok 

Point flight range by personnel from the University of Colorado at Boulder. Any changes in the 

COA may also require these procedures to be appropriately adapted. 

In general, the response to an in-flight emergency is to engage flight termination mode to bring 

the UA down to the ground rapidly. In less critical situations, such as a severe change in 

weather, the landing mode is engaged, bringing the UA down at a specified glide slope and 

heading to land at the pre-designated landing coordinates. All incidents and accidents will 

follow reporting and notification processes and requirements as laid out in FAA Orders 8020.11, 

7210.56, and in NTSB 830.
These procedures are written for a 2-person team consisting of the pilot-in-command (PIC)

acting as a mission commander and pilot-at-the-controls (PAC), and one ground-based 

observer. 

2.11.1 Distress Message

A hand-held VHF radio will be used to broadcast a distress message in emergency situations 

that have the potential to affect other air traffic, and to aid in maintaining a safe airspace when 

traffic is present in the COA airspace. Messages will be broadcast on 122.8 MHz, corresponding 

to the UNICOM frequency of the closest airport (Ugnu-Kaparuk, private).

The distress message will contain the following information, and will be given in the order listed 

below. Once broadcast, the message will be repeated every five (5) minutes, upon changes in 

condition or known location, or upon any update requests received. Once the urgent condition 

is over, a final message will be broadcast to notify any traffic that the emergency condition is 

over.

- ``PAN-PAN, PAN-PAN, PAN-PAN’’

- ``local traffic”

- ``this is unmaned aircraft DataHawk operating at Oliktok Point’’

- The nature and type of the distress

- Operator's intention

- Last known UA position and heading

- UA Altitude

- Hours and minutes of flight time remaining

- Weather

- Other useful information such as visible landmarks, aircraft color, and that no people 

are on board

2.11.2 Operational Emergency Procedures

0-1. Pilot / Operator / Observer unable to perform duties

If either the observer or the PIC becomes incapacitated during the flight, the UA will be 

commanded to enter flight termination mode by the remaining crew member. 
0-2. Loss of LOS by Observer

Loss of LOS by the observer can happen when the UA is farther than one (1) lateral mile 

or higher than 3000' vertical feet from the observer as set in AFS 400 Policy 05-01. Loss of LOS 

can also be caused by equipment failure when using aids to vision (e.g. binoculars), reduction of 

LOS range due to abrupt changes in weather or lighting conditions, or by losing visual tracking 

acquisition of the UA.

- The observer will inform the PIC if LOS has been lost for more than 5 seconds.

- If there is other air traffic in the area when LOS is lost, the PIC will immediately 

command flight termination mode. 

- If there is no other air traffic in the area, the observer will try to re-acquire LOS for up to 

30 seconds. Failing this, the PIC will command flight termination mode.

0-2. Loss of Communication Between PIC and Observer

The observer will be stationed in close physical proximity to the GCS and the PIC, with 

direct voice communication between observer and PIC. Loss of communication can 

occur due to incapacitation of either crew member (see 0-1), or due to high background 

acoustic noise levels (e.g. from industrial machinery). 

- If communication cannot be restored for 30 seconds, the PIC will command flight 

termination mode. 

0-3. Loss of Communication with ATC

Since the DataHawk will be operated in class G airspace, during daylight hours, more 

than 5 NM from an airport, below 400ft AGL, and away from high traffic areas, ATC 

contact will not be maintained. 

0-4. UA Leaves COA Boundary Uncontrollable

This condition can occur only upon multiple system failures of the communication and 

navigation systems. For example, if a lost communication event occurs and the navigation 

solution (e.g. GPS) is thought to be accurate by the UA, though it is off in its solution, then there 

is a chance for the UA to leave the COA boundary. Alternatively, if a loiter circle location is not 

loaded correctly or is the wrong geographic location, this could lead to the condition of the UA 

departing the COA boundary if communication to re-load the circle location has been lost. 
Failure of both servos on the UA could result in the control surfaces becoming stuck, preventing 

corrective actions from the autopilot or GCS. 

- In this situation, the first priority of the PIC is to maintain as safe of an airspace 

surrounding the UA as possible. Although the autopilot has automatic failsafe logic to 

engage flight termination mode if the flight range boundaries in altitude and lateral 

radius are exceeded, the PIC will broadcast a PAN-PAN message as described in Section 

2.11.1. 

- If the observer is not able to maintain LOS with the UA, the PIC will initiate lost plane 

procedures to locate the aircraft.

0-5. Near Midair Collision

A near midair collision is defined as an incident associated with the operation of the UA 

in which a possibility of collision occurs as a result of proximity of less than 500ft to another 

aircraft as determined by the PIC or the observer, or a report is received from another aircraft’s 

flight crew stating that a collision hazard existed between two or more aircraft. It is the 

responsibility of the UA ground crew and/or other flight crews to determine whether a near 

midair collision did actually occur and, if so, to initiate a NMAC report as outlined in FAA Order 

8020.11 and/or in AIM (http://www.faa.gov/ATpubs/AIM/).

- Traffic and collision avoidance is governed by FAR Part 91.113. However, since the 

DataHawk UA is significantly more maneuverable than any manned aircraft, the 

DataHawk will always give way to all other manned aircraft. Since the DataHawk is 

flying low (< 100ft AGL), it is unlikely that it can be above any manned aircraft, hence 

the primary de-confliction strategy is to engage flight termination mode causing rapid 

descent of the UA to avoid a near midair collision event. However, the PIC will decide 

the best course of action in unusual circumstances, e.g. in cases of a helicopter at 

extremely low altitudes in a landing pattern or hoisting operations. Other actions 

consist of moving the loiter circle to at safer location or safer radius, or engaging landing 

mode. 

- The UA observer will advise the PIC of an impending conflict and suggest the best course 

of action to avoid a NMAC event. If an impending conflict is detected in time to safely 

respond as above, the PIC will broadcast a warning PAN-PAN message to inform other 

traffic of the hazard and the intent of the UA operator. 

0-6. Accident and Crash Recovery

The recovery response plan outlines the specific duties and responsibilities applicable to 

the personnel required to perform an accident investigation in the event of a catastrophic 
failure. A running log of all actions encompasses agencies notified, person's names, and times 

of contact will be maintained by the PIC. Notification and reporting of all aircraft accidents and 

incidents will follow guidance as outlined in FAA Order 8020.11, 7210.56 and NTSB 830.

- Because of the small size of the UA the likelihood of significant damage to surrounding 

structures is small. There is no on-board fuel, so a post-crash fire is extremely unlikely. 

However, to avoid hazardous fumes, the procedure in this event is to let the aircraft 

burn when not endangering life or property.

0-7. Lost Aircraft Procedures

A lost plane emergency occurs when there is a communication failure leading to a lost 

communication event, and during the lost communication event the observer has lost LOS of 

the UA. With these two combined events the safe operation of the UA can no longer be 

maintained. 

- In this situation, the first priority of the PIC is to maintain as safe of an airspace 

surrounding the UA as possible. This is done by broadcasting a PAN-PAN message as 

described in Section 2.11.1. Following this, recovery operations will commence starting 

at the last known location of the UA. 

2.11.3 Ground Control Station Emergency Procedures

G-1. GCS Power Failure 

Failure of the main battery or power supply of the laptop computer running the GCS 

software is an unlikely occurrence, since the laptop is a semi-rugged type with more reliable 

components, and because a car battery backup is utilized. 

- In this event, there is no action to be taken by the ground crew, since re-boot 

procedures (e.g. after replacing the laptop battery or checking external connections) will 

require more than the 40 second time out period for lost link. After this period, the 

flight software automatically engages flight termination mode. 

G-2. GCS Lock Up

Lock up can be caused by a crash of either the Realterm of the Matlab programs that make 

up the GCS, or by a crash of the Window operating system. 

- In this event, the programs will be closed and restarted by the PIC. If this cannot be 

accomplished within the 40 second lost link time out period, the flight software will 

automatically engage flight termination mode.
G-3. GCS Radio Failure

This can result from electronics hardware failure, or the failure of a cable or connector 

linking the radio with the laptop computer or between the radio and the antenna. 

- In this event, the PIC will verify radio and antenna connections. If this is not the 

problem, a spare radio module cannot be substituted in time before the 40 second lost 

link time out expires, and the UA will automatically enter flight termination mode. 

2.11.4 DataHawk UA Emergency Procedures

A-1. Lost Link.

Since there is only a single communication link between the DataHawk UA and the GCS, 

a lost link constitutes a lost communication event. The CUPIC autopilot detects a lost link event 

by the absence of 1 Hz “heartbeat” packets in the uplink for 40 seconds. 

- The ground station display shows the link strength, and a 40 second timer for lost link 

time out. Both can be used by the PIC to avoid lost link, or to attempt to restore the link 

by pointing the ground antenna for improved signal strength, or by inspecting radio and 

antenna cables and connectors for faults. If these actions are ineffective and the time 

out expires, the UA will automatically enter flight termination mode due to a lost link 

event. 

- If the link is restored, the UA will automatically exit flight termination mode.

- After the communication timeout has occurred, if there is traffic in the COA airspace the 

PIC will begin broadcasting the appropriate PAN-PAN message every 5 minutes for the

duration of the lost-communication event, or until the UA is on the ground. 

A-2. Lost GPS

The autopilot counts the number of valid GPS updates in any 20 second interval. If the 

number of valid updates drops to zero, a lost GPS event is detected. 

- A lost GPS event causes an automatic engagement of flight termination mode. 

- Flight termination is cancelled if a valid GPS fix is received.

- There are no operator actions in this event. 

A-3. Engine Out

Failure of the propulsion system during the auto helix operating mode results in a 

controlled gliding descent. Both the landing and flight termination modes have the motor 

turned off. 
- The PIC will decide the safest course of action in this event. The options are to a) do 

nothing, so the UA will descend to the ground on a circular helix, b) engage landing 

mode, so the UA will descend to the ground on a fixed heading toward the landing 

coordinates, or c) engage flight termination mode, so the UA will descent rapidly in a 

spiral to the ground. 

A-4. Main battery depletion

The main battery state is displayed on the ground station (voltage, and percent capacity 

remaining), for the PIC to use in planning for landing as the battery nears its voltage cutoff limit. 

If the cutoff limit is reached, the UA automatically enters flight termination mode, and this 

mode cannot be exited once it is entered for this reason. 

- The PIC will assist the observer in determining the location of the landing due to flight 

termination. 

A-5. Autopilot Failure

This can be due to onboard power failure, electronics hardware failure, flight sensor 

failure, or actuator (servo or control surface) failure. All result in uncontrolled flight. 

- In this situation, the first priority of the PIC is to maintain as safe of an airspace

surrounding the UA as possible. This is done broadcasting a PAN-PAN message as

described in Section 2.11.1, repeating every 5 minutes until the UA has been verified to 

be on the ground, or until the maximum flight time of the UA has expired. 

- The observer will track the UA using all reasonable effort to not lose LOS.

- if the observer is not able to maintain LOS with the UA, the PIC will initiate lost plane 

procedures to locate the aircraft.

A-6. Structural Failure

The response to a structural failure is determined by the type of failure and in what condition 

the failure put the UA in. In addition, there are some failures that the autopilot will be able to 

accommodate, and others that will result in uncontrolled flight. 

- The observer will inform the PIC of any noticeable structural failures suggest the best 

course of action.

- It is up to the PIC, using their skill and knowledge, to determine what the safest course 

of action is. The options are: a) if the autopilot seems to be flying the UA safely, the 

landing mode will be commanded; b) if safe flight is compromised, the flight termination 

mode will be commanded; c) if the UA is no longer flying, every attempt will be made to 
observe the descent to assist the observer in later determining the cause of the failure. 

A-7. Degrading Performance of the Autopilot

Degrading or poor performance of the autopilot can be caused by noisy or failed 

sensors, loss of power regulation, friction in actuators, etc. 

- In this event, the PIC will determine if this degradation is likely to affect safety of flight. 

If so, either the landing mode or the flight termination mode will be engaged, as 

appropriate, to best maintain range safety. 

2.12 Avionics Equipment

Equipment Suffix Type X (No DME, no transponder)

GPS Yes

Moving map indicator (GCS) Yes

Tracking capability Yes

TCA/MCAS No

ELT No

Transponder No

2.13 Lights

Landing No

Position/Navigation No

Anti-collision No

Infrared (IR) No

2.14 Spectrum Analysis Approval

Data Link Yes

Control Link(s) Yes(1)

Operations using R/C per Title 47 CFR 95 No

NTIA/FCC Authorization No Attachment

2.15 Data Link
The SDSS data link is a single communication channel, operating in the unlicensed 902-928 MHz 

ISM band, using a spread spectrum frequency hopping protocol with Digi XBee Pro XSC radio 

hardware, with 0.1W maximum power output. The radio complies with the specifications 

described in Title 47 Part 15.247. A monopole antenna provides a doughnut shaped pattern 

with vertical polarization that is well suited to the low operation altitude of the DataHawk. 

2.16 Control Link

The SDSS control link is a single communications channel, operating in the unlicensed 902-928 

MHz ISM band, using a spread spectrum frequency hopping protocol with Digi XBee Pro XSC 

radio hardware, with 0.1W maximum power output. This link shares the same transceiver and 

antenna hardware with the data link. The radio complies with the specifications described in 

Title 47 Part 15.247. The ground antenna is a higher gain monopole than that on the UA, but is 

also vertically polarized and provides a doughnut shaped pattern that is well suited to the low 

altitude operation of the DataHawk UA. 

3.0 Operations

3.1 ATC Communications

Two-Way Voice Capability

Transmitter

VHF Band Yes

Quantity 1

In-Flight Retunable Yes

UHF Band No

Quantity 0

In-Flight Retunable No

HF Band No

Quantity 0

In-Flight Retunable No

Receiver

VHF Band Yes

Quantity 1

In-Flight Retunable Yes

UHF Band No

Quantity 0

In-Flight Retunable No

HF Band No

Quantity 0

In-Flight Retunable No

Guard (Emergency) Frequencies
VHF Yes

Quantity 1

UHF No

Quantity 0

Instantaneous Two-Way Voice

Direct to pilot Yes

SATCOM No

Relay to aircraft No

3.2 Electronic Surveillance/Detection Capability

EO/IR No

Terrain detection No

Weather/icing detection No

Onboard radar No

Other No Attachment

Electronic detection system No

Electronic detection systems attachment No Attachment

Radar observation No

NAS Operational Capability No Attachment

3.3 Visual Surveillance/Detection Capability

Maximum distance from UA

 Vertical 3000 ft

 Horizontal 1.0 NM

Aircraft based (chase aircraft) No

Visual obs from one or more ground sites Yes

Forward or side looking cameras No

3.4 Ground Based Observer Visual Surveillance/Detection Capability

A ground based observer trained in FAR Part 91 will be used to provide see-and-avoid 

capabilities for the operation of the SDSS UAS. No chase aircraft will be employed nor will a 

ground based chase vehicle be necessary. The UA is not equipped with any camera to provide 

forward or side looking capabilities.

At no time will the UA be allowed to be any further than 1.0 NM mile horizontally, or than 400 

ft vertically from the ground based observer. The observer will be co-located with the PIC and 

the GCS. The observers will follow FAR Part 91.113 Right-of-Way Rules for providing traffic and 
collision avoidance. Since the DataHawk UA is significantly more maneuverable than any 

manned category of aircraft, the DataHawk UA will always give way to all manned aircraft.

Communication between an observer and the PIC will consist of the following information:

- Notification of traffic detection

- Traffic course and altitude update

- Suggested traffic avoidance actions (none, landing mode, flight termination mode)

- Significant weather changes

- Anomalous flight characteristics of the UA

When an observer describes the traffic, bearing will be given relative to the location of the UA, 

using cardinal and intercardinal compass directions. Altitude will be given in feet AGL.

3.5 Aircraft Performance Recording

Flight data record Yes

Control station recording Yes

Voice recording No

3.6 Flight Operations Area

Flight operations are conducted for the purpose of pilot training and science sensor testing & 

calibrations of the onboard instrumentation. 

3.7 Flight Crew Qualifications

The operations crew for the SDSS comprises a two-person ground crew, consisting of a PIC and 

an observer. Neither the PIC nor the observer are allowed to serve both functions at the same 

time. Emergency procedures have been defined in the event one becomes incapacitated.