Autonomy does not have to mean unmanned, and the potential to increase safety, reliability and capability across a range of missions and platforms—including manned and optionally piloted—is behind 's launch of a multi-year research program to develop autonomous technology for vertical flight in demanding environments.
The Matrix Technology program is modeled on Sikorsky's X2 Technology demonstration, a $50 million internally funded effort that culminated in 2010 with a coaxial-rotor compound helicopter achieving 250 kt. in level flight, and led to industry-funded development of the S-97 Raider light tactical helicopter. As with the X2, the Matrix program has key performance parameters (KPP), milestones and deliverables—including the first flight last week of an S-76 demonstrator in autonomous mode. This is to be followed in the fourth quarter by an unmanned cargo mission with a UH-60MU fly-by-wire (FBW) Black Hawk.
“This is not 'me too' autonomy,” says Mark Miller, vice president for research and engineering. “We are addressing the specific and unique needs of rotorcraft and vertical lift, where we see the biggest untapped potential for autonomy.” Sikorsky sees in autonomy the ability to fly more missions, less limited by pilot availability, adverse weather or restricted visibility; fly missions more effectively, by eliminating sources of pilot and operator error; enable new missions in dangerous environments or with long durations; and reduce ownership cost by increasing reliability, reducing crewing and improving safety.
On one level, Sikorsky is catching up with the unmanned industry, but while high-altitude surveillance aircraft are automated, they do not fly in a stressing environment. And though small UAS fly missions autonomously, operators can afford to lose them. The autonomous rotorcraft Sikorsky envisions have significant value and operate at low altitude, so they require manned levels of reliability.
“Autonomy has been around a long time, with high-flying UAVs,” says Miller. “It is coming to vertical lift, but at a lower level, with dual redundancy, minimal contingency management and low control authority. We are targeting high redundancy, high bandwidth, full authority—andcertification.” To achieve this, Matrix will build on Sikorsky's “sound, solid” experience with FBW and advanced control laws for the RAH-66 Comanche, CH-148 Cyclone, UH-60MU, X2, CH-53K and Raider programs.
“Fly-by-wire is a third or half step to autonomy,” says Igor Cherepinsky, chief engineer for autonomy. “There is a human on board, but they are directing the vehicle, not managing the low-level control.” The goal with Matrix is to increase onboard system intelligence to a level where “the human operating the vehicle is an expert who understands the mission better than the aircraft itself,” he says.
“The mission expert may be miles away, or in the vehicle doing tasks other than basic pilotage,” says Teresa Carleton, vice president for mission system integration. “It is not just about moving the operator from the aircraft to a remote ground-control station,” she says. “It's about providing more capability in the vehicle, increasing the system intelligence to enable true autonomy and reduce the overall footprint.” Using high-level commands enabled by the onboard autonomy, an operator on the ground will be able to manage multiple aircraft to reduce system cost.
“It is all about operating cost. It has to come down,” says Chris Van Buiten, vice president for technology and innovation. Typical loss rates for unmanned aircraft today are 1/1,000 flight hours. At $12 million a copy for an unmanned Black Hawk or Radier, that means replacement cost of $12,000 per hour: “Lose two, and the program is terminated,” he says. Even a loss rate of 1/10,000 hr., for a replacement cost of $1,200/hr. “is still not acceptable. The floor is 1/100,000 hr., which is what we see in combat with the Black Hawk, for a $120/hr. replacement cost.”
The company's approach is not to develop an autonomous vehicle, but an autonomy architecture that is platform-agnostic and can be used in manned, optionally piloted and unmanned vehicles; inserted into the existing fleet and designed into future products; and incorporated into aircraft built by Sikorsky or its competitors, as a system or an “app.” “This is as much about the process as the product,” says Van Buiten. “We are getting into the world of software apps and upgrades with products that are truly vehicle-agnostic and platform-independent.”
To certify an autonomous system, the definition of flight-critical functions must be expanded to include perception, path planning and decision making, says Cherepinsky. It requires an approach that permits some level of emergent—and not predetermined or “deterministic”—behavior not allowed by today's airworthiness rules. Sikorsky's architecture deterministically bounds the emergent behavior so the autonomous system can be certified by current methods.
Within Matrix, the perception block includes all the algorithms to process data from onboard and offboard sensors. Processed data are passed to the world model, which contains not only a terrain database to orient the vehicle, but information on its mission objectives. Next come the path-planning and decision-making algorithms, which determine how the vehicle behaves. These are divided into simple, deterministic low-level intelligence (LLI) algorithms, and high-level intelligence (HLI) algorithms that are the source of emergent behavior. “We will start with low-level algorithms that are predictable, as the basis of the core intelligence, then work up to emergent behavior bounded by algorithms. The FAA is receptive to this,” says Cherepinksy.
Low-level algorithms have the authority to override any high-level commands, and provide a safe envelope within which the high-level intelligence operates. “The HLI algorithms contain the bulk of the true intelligence of the vehicle. Since these algorithms are not flight-critical, they can contain complex and/or nondeterministic behavior,” Cherepinksy says.
The HLI block is bounded by low-level intelligence algorithms “that understand what is happening,” he says. “As long as the high-level intelligence operates within bounds, its behavior is allowed,” he says. “If it goes out of bounds, the low-level intelligence block takes over. If the aircraft is flying low and fast and it sees the HLI pushing the limits, LLI takes over and saves the aircraft.”
A key is robust contingency management. “Unlike previous flight control systems, where if an actuator fails you abort the mission, here you do not have to do that. The autonomous mission manager evaluates the state of the vehicle and adjusts the mission,” says Cherepinsky. “Today's control systems lack software to tell them what to do when something goes wrong. Fault detection is great—it can tell when a sensor has failed, but lacks the next step: what to do about it and what to do without it.”
Current unmanned aircraft are painstakingly preprogrammed. “The key is not to attempt to program every contingency, but to allow some emergent behavior,” he says. “You need enough robustness in the autonomy that it will do something; you don't know exactly what, but you can bound it and be comfortable with it. That's hard to do, but is where we are headed.”
Sikorsky is taking a step-by-step approach. “As we move into this future with less-deterministic processes, the system software will evolve over time,” says Miller. “We are moving away from determinism is a slow manner, and trying not to take a leap.” Autonomy starts as an “insurance policy to deal with the latency and intermittency of communication with the aircraft. As it evolves, more capability moves to the autonomous side and the certification challenges become more critical,” he says.
“Matrix will evolve and adapt over time. Once the architecture is in place, it allows the incorporation of apps from Sikorsky and its partners that expand the capability,” says Carleton. “We have been developing the technology for a number of years, including the participation ofResearch Center in algorithm development. We have a full hardware-in-the-loop simulation capability to carry out a significant amount of testing on software we take to flight, so we can move rapidly through flight test.”
The S-67 Matrix testbed, or Sikorsky Autonomous Research Aircraft, has been equipped with an FBW flight control system. “We have interfaced with the aircraft in a cost-conscious way, to dispel the notion that full-authority fly-by-wire has to be expensive,” says Cherepinsky. High-performance computers run the autonomous mission management framework—an open system architecture that includes the world model, sensor interfaces and the application programming interface that allows apps to be developed to add capability to the vehicle.
Based at Sikorsky's test center in West Palm Beach, Fla., the S-76 retains its original flight-control system for safety, and pilots will be able to move back and forth between autonomous, manual and full-authority FBW as algorithms are developed and tested. “We call it our crewed flight termination system,” says Miller.
The S-76 will be equipped with a multi-spectral perception suite, intended to be portable to other platforms, but other sensor systems can be used. “Matrix is scalable. We will add autonomy to the UH-60MU, which does not have as robust sensors,” says Carleton. “What is critical is that the aircraft is equipped with the sensors that give it information on the environment where it operates. The closer to the ground, the more sensors are needed,” says Miller.
The S-76 and the UH-60MU, acquired from the U.S. Army, and one of two fly-by-wire Black Hawk prototypes will demonstrate the Matrix program KPPs. These are structured as “specific attributes that are meaningful in the helicopter domain,” says Miller, and include low-level autonomous flight, landing on unprepared surfaces and ships, operation in degraded visual environments, man-rated reliability and—with an eye toward fielding—reduced life-cycle cost.