Elgiz Baskaya

Michel Gorraz

Fabian Garcia

Alexandre Bustico

Torbjoern Cunis

Gauthier

Philippe Condomines

Xavier Paris

Titouan Verdu

Yuchen Leng

Baizura

Fault Detection and Diagnosis for Drones using Machine Learning by

This new era of small UAVs currently populating the airspace introduces many safety concerns, due to the absence of a pilot onboard and the less accurate nature of the sensors. This necessitates intelligent approaches to address the emergency situations that will inevitably arise for all classes of UAV operations as defined by EASA (European Aviation Safety Agency). Hardware limitations for these small vehicles point to the utilization of analytical redundancy, rather than to the usual practice of hardware redundancy in manned aviation. In the course of this study, machine learning practices are implemented in order to diagnose faults on a small fixed-wing UAV to avoid the burden of accurate modeling needed in model-based fault diagnosis. A supervised classification method, SVM (Support Vector Machines) is used to classify the faults. The data used to diagnose the faults are gyro and accelerometer measurements. The idea to restrict the data set to accelerometer and gyro measurements is to check the method's classification ability, with a small and inexpensive chip set and without the need to access the data from the autopilot, such as the control input information. This work addresses the faults in the control surfaces of a UAV. More specifically, the faults considered are the control surface stuck at an angle and the loss of effectiveness. First, a model of an aircraft is simulated. This model is not used for the design of Fault Detection and Diagnosis (FDD) algorithms, but is instead utilized to generate data. Simulated data are used instead of flight data in order to isolate the probable effects of the controller on the diagnosis, which may complicate a preliminary study on FDD for drones. The results show that for simulated measurements, SVM gives very accurate results on the classification of the loss of effectiveness faults on the control surfaces. These promising results call for further investigation so as to assess SVM performance on fault classification with flight data. Real flights were arranged to generate faulty flight data by manipulating the open source autopilot, Paparazzi. All data and the code are available in the code sharing and versioning system, Github. Training is held offline due to the need for labeled data and the computational burden of the tuning phase of the classifiers. Results show that from the flight data, SVM yields an F1 score of 0.98 for the classification of First of all, I would like to thank to my PhD advisors, Professors Daniel Delahaye and Murat Bronz, for supporting me during these past three years. I am grateful to Daniel Delahaye, for his insight during the thesis and

control surface stuck faults. For the loss of efficiency faults, some feature engineering, involving the addition of past measurements is needed in order to attain the same classification performance. A promising result is discovered when spinors are used as features instead of angular velocities. Results show that by using spinors for classification, there is a vast improvement in classification accuracy, especially when the classifiers are untuned. Using spinors and a Gaussian Kernel, an untuned classifier gives an F1 score of 0.9555, which was 0.2712 when gyro measurements were used as features. In summary, this work shows that SVM gives a satisfactory performance for the classification of faults on the control surfaces of a drone using flight data.

Thesis Supervisor: Daniel Delahaye Title: Professor Thesis Supervisor: Murat Bronz Title: Assistant Professor My grandmom, nananem. The cleverest women I have ever known, lucky to be raised by you. I wont forget that you being the person that I get along the best, never even an argument, like magic. My flees to captain's bridge has never been punished on the way along the sea to summer house, my never finishing questions never left unanswered, my passion for sea shells and flower seeds plugging the washing machines have been ignored.

My uncle Cengiz, where my logic genes have been inherited. Again, the person I have never argued even once in my lifetime, no delays in communication, or may be sometimes when something else is been processed. The best person I have ever known in my life, an angel. Too clever, too talented. And my lovely aunt Leyla, who woke me up everyday, patiently, thank you many times.

Rapunzel, my companion, you have helped me a ton, you made me graduate.

Although you wont be able to read it, you won't be the first one.

Ertan, you have helped me numerous times I stopped counting, my crisis, my anxieties, my vulnerabilities. Those days I was about to quit, you made me back, not let me to leave Rapunzel, told me that I can do it, and I did it.

I also thank my friend, my sister, Hale, for providing support and friendship that I needed.

Utku, ne 3 u la, my perfect lab mate. Hope to work AI together here or there, one day.. Estelle, I am thankful for what we have shared during three years, and grateful for her help, especially during the last phase of this thesis.

Helen, thanks to her, the paperwork which I hated with a passion became much of an ease. Such a nice person, kind, and gentle. Thank you very much. I am also grateful to Sara, Micheal, and Magda for proofreading the thesis, and Sarah for her incredible illustrations and the cover of this thesis. This work is supported by ENGIE Ineo -Groupe ADP -Safran RPAS Chair. I am grateful for their support that enabled me to pursue three years of research on this interesting subject. I am also grateful to Catherine Ronfle-Nadaud for her support during the early stages of Chaire Drones.

List of Figures

2-13

Schematics of perceptron. The perceptron is a composition of several neurons [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. x 1 to x n are the features and y is the output. . . . . . . 2-14 Mark 1 perceptron: the first custom-built hardware implementation of the perceptron. It is designed for image recognition with an array of 400 photocells connected to the "neurons" randomly. Potentiometers are used to encode the weights, and electric motors update the weights during learning [11]. . . . . . . . . . . . . . . . . . . . . . . . . . . .

2-15

Humanoid and ant robot models [START_REF]Deep Reinforcement Learning[END_REF] exhibiting walking and jumping motions respectively using reinforcement learning [START_REF] Deepmind | Producing flexible behaviors in simulated environments[END_REF]. The robots are given objectives to go from one point to the other, but not given any information about walking or jumping [START_REF]Google's DeepMind AI Just Taught Itself To Walk[END_REF]. . . . . . . . . . . . . . . .

5-20 Angular velocity w

x for faulty nominal flight data . . . . . . . . . . .

5-21 a

x vs a z feature space for faulty nominal flight data . . . . . . . . . .

5-22 a

x vs a y feature space for faulty nominal flight data . . . . . . . . . . 5-23 One of the features (accelerometer x-axis) of the original feature matrix (given in Fig. 5-5) before adding extra features . . . . . . . . . . . . .

5-24 Addition of features to involve

Chapter 1 Introduction

Lately, the popularity and reachability of Unmanned Aircraft System (UAS) have risen steeply thanks to the advancements in electronic components and their decrease in cost. This accelerating trend towards small but capable flying vehicles is extending the limits of hardware and software potential in industry and academia. Regulators from the aviation community have become increasingly concerned by the number of incidences of drones flying close to civil aircraft and airports. With the advent of the new era of UAS, different institutions around the world are addressing safe integration of UAS into airspace [9], specifically the National Aeronautics and Space Administration (NASA) [START_REF] Kopardekar | Unmanned aircraft system traffic management (utm) concept of operations[END_REF] and the Federal Aviation Administration (FAA) [START_REF] Magyarits | FAA's Approach to Unmanned Aircraft Systems (UAS) Concept Maturation, Validation & Requirements Development[END_REF] in the US, European Aviation Safety Agency (EASA) [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF] in Europe and international bases such as International Civil Aviation Organization (ICAO) [START_REF]Cir 328, Unmanned Aircraft Systems (UAS)[END_REF]. The U-Space concept in Europe (UTM in the US, which aims at enabling safe integration into airspace), provides the insight by showing in their roadmaps that the level of drone automatization and the level of drone connectivity (drone to drone and drone to infrastructure) will guide the pace of the U-Space services (U1 to U4) [START_REF]U-space blueprint[END_REF]. These enablers will allow intelligent agents to share information and automate complex procedures in case of emergencies. Thus, future aviation will inevitably move towards automatization.

Here we propose a concept that will contribute to the automatization of drones, to make them more intelligent and thus contribute to their safer integration into the airspace. These awareness abilities allow the mitigation of risks in accordance with the risk assessment procedures offered by JARUS (SORA) [START_REF]JARUS guidelines on Specific Operations Risk Assessment(SORA)[END_REF] defined by [38]. The functioning abilities of a drone following an emergency should be assessed and, depending on the availability of the environment, a recovery procedure may be initiated.

For cases in which recovery is not possible, safe ditching may be required in order to reduce the potential harm in the air or on the ground.

Motivation

Improving the flight reliability is considered to be one of the main concerns for integrating UAVs into civil airspace, according to the Unmanned Systems Roadmap by the US Office of the Secretary of Defense, DoD [START_REF]Unmanned Systems Roadmap[END_REF]. Achieving safe flight is not a straightforward task, considering the multiplexity of unknowns in the system hardware, environment, and possible system faults/failures yet to emerge. The expectation that UAVs should be less expensive than their manned counterparts effects their reliability. Cost saving measures -other than the need to support a pilot/crew onboard or a reduction in size -may lead to a decrease in system reliability.

Under the research and development programs and initiatives identified by the DoD to develop technologies and capabilities for UAS, the greatest area of control technologies is health management and adaptive control, with a budget of 74.3 m dollars. Other safety features such as the validation and verification of flight critical intelligent software are the second area, with 57.8 m dollars [START_REF]Unmanned Systems Roadmap[END_REF].

Systems are often susceptible to faults of differing nature. Existing irregularities in sensors, actuators or controller may be intensified due to the control system design and lead to failures. A fault may be hidden due to the control action [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF].

The most widely-used method to increase reliability is to increase the use of more reliable components and/or hardware redundancy. Both require an increase in the cost of the UAS, conflicting with one of the main reasons of UAS' popularity [5]. In order to provide solutions for the different foreseen categories within the airspace, a variety of approaches should be considered. While hardware redundancy may cope with failure situations of UAVs in certified operations, it may not be suitable for UAVs in open category operations or some operations in specific category, due to budget constraints. Analytical redundancy is another solution. This may be not as effective and straightforward as hardware redundancy, but relies on the design of intelligent methods in order to utilize the information on board the aircraft to deal with all potential circumstances.

Contribution

The integration of drones into the airspace requires the introduction of ingenious design to ensure safe solutions for drones. This necessitates intelligent approaches to address all potential emergency situations. One of these aspects is to ensure safe flight by designing fault detection and diagnosis systems using less expensive avionics, common in a vast number of drones. The hardware limitations for these small vehicles point to the utilization of analytical redundancy rather than the usual practice of hardware redundancy in manned aviation. For that purpose, we introduce an end-to-end design to achieve data-driven fault diagnosis for control surface faults on drones. In the course of this thesis, machine learning practices are implemented in order to diagnose faults on a small fixed-wing UAV, and to avoid the burden of accurate modeling required in model-based fault diagnosis. We aim to design a classifier via SVM to solve fault detection and diagnosis (FDD) as a classification problem for drones with actuator faults. All data and code are available in the code sharing and versioning system, Github.

In this thesis, fault classification simulations are investigated under two main sections: first, the classification of faults based on simulated flight measurements; and second, the classification of faults based on real flight data.

For the classification on data generated from simulations, a model of a MAKO UAV [8] is simulated. Sensor measurements (accelerometer and gyro data) have been calculated using information on the drone's motion and the specifications of the sensors. Generated data is usually more structured compared to real flight data.

In this preliminary application of SVM to fault diagnosis, we started with simpler problem and used data generated from models. Results show that the SVM classifier was accurate and fast in diagnosing faults on the control surfaces, with a classification accuracy of 99.999%.

Accurate results on the classification of faults with generated data have thus encouraged us to further investigate fault detection with real flight data. Since SVM is a supervised classification method, labeled data is necessary to train the algorithm.

Real flights have therefore been arranged in order to generate faulty flight data by manipulating the open source autopilot, Paparazzi. Training is held offline due to the need for labeled data and the computational burden of the tuning phase of the classifiers. Two main types of faults have been investigated; the control surface stuck fault and the loss of effectiveness of the elevon. Results indicate that the control surface stuck fault can be detected relatively easily with the data from three gyros and three accelerometers, compared to the loss of effectiveness (efficiency). The results show that over the flight data, SVM yields an F1 score of 0.98 for the classification of the control surface stuck fault. The addition of features to accommodate previous measurements improve the classification performance for tuned classifiers while the performance for untuned classification deteriorates. Classification performs poorly for the loss of efficiency faults, especially for the smaller ineffectiveness values. For the loss of efficiency fault, some feature engineering -involving the addition of past measurements -is needed in order to attain the same classification performance.

A very promising result is discovered when spinors are used as features instead of angular velocities. Result show that by using spinors for classification, there is a significant improvement in classification accuracy, especially when the classifiers are untuned. Using spinors and a Gaussian Kernel, the untuned classifier gives an F1 score of 0.9555, which is 0.2712 when the gyro measurements are used as features.

In general, this work shows that SVM gives a satisfactory performance for the classification of faults on the control surfaces of a drone using flight data. This thesis contributes to the literature with the following papers:

• Baskaya, E., Bronz

Thesis Outline

Chapter 2 presents the state of the art on the following topics:

• the integration of drones into the airspace;

• Paparazzi autopilot;

• fault tolerant control systems with a focus on fault detection and diagnosis;

• machine learning and artificial intelligence in general.

The safe integration of drones into the airspace is the motivation for this thesis.

To ensure this safe integration, the design of vehicle health management systems is crucial. Fault detection and diagnosis plays an important role in vehicle health management, and we provide a literature review of this topic. In this thesis, the method selected to detect and diagnose faults is Support Vector Machines (SVM), which is a machine learning method. Thus, the current state of the art for machine learning is also provided. Paparazzi autopilot has been used to realize flights to generate faulty data. This is also introduced in here.

Chapter 3 focuses on the equations of motion of an aircraft. Equations for translational and rotational motion are discussed separately and in detail. After the equations are derived for a generic aircraft, the calculations of forces and moments which are specific to an individual drone are presented. Then, modeling accelerometer and gyro data is explained, followed by a discussion of modeling faults in the control surfaces of an aircraft.

Chapter 4 is dedicated to machine learning algorithms with a focus on implementation. After the general practice of machine learning applications is presented, the use of Support Vector Machines to detect and diagnose faults is discussed in more detail. Chapter 6 concludes this thesis with a review of the contributions and results made.

Chapter 2

State of the Art

This chapter includes the current state of the art for a variety of topics. The integration of unmanned systems into airspace is the first topic addressed as it is the motivation for this thesis. The second topic addressed is the Paparazzi Autopilot System since it is used to realize the flight campaigns for this thesis. We also discuss how the use of the Paparazzi open source auto-pilot system can assist with the integration of unmanned aircraft system (UAS) into the airspace. Then, to achieve this safe integration, fault tolerant control systems have been examined with a focus on fault detection and diagnosis. Finally, the rise of machine learning methods in the last decade is discussed as they are utilized to diagnose faults in this study.

Integration of Drones into Airspace

Commercial advantages offered by drones are already targeted by big companies worldwide. The airspace regulatory authorities seem to be caught between the companies (that demand rapid access to airspace), and the concerns of the public about potential privacy breaches, safety and liability issues [29,[START_REF] Esther | Civilian drones: Fixing an image problem?[END_REF]. Even with today's strictly regulated airspace, reported occurrences show that there are a number of hurdles to overcome before the further integration of UAS into the airspace. • EU Regulatory Framework for drone operations;

With the Riga Conference

• proposals for the regulation of low-risk drone operations, key elements of the future Implementation Rules (IRs).

With a starting point of the Riga Declaration [START_REF]Informal Meeting of EU Ministers Responsible for Territorial Cohesion and Urban Matters. Declaration of Ministers towards the EU Urban Agenda[END_REF], and building on Regulation (EC) No 216/2008 (Basic Regulation) [START_REF]European Parliament and Council[END_REF], the A-NPA (Advance Notice of Proposed Amendment) [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF] introduces three main categories of operations and asks for public consultation. In the report, drones are grouped under two main categories; remotely piloted and autonomous. An autonomous drone is defined by the ICAO (International Civil Aviation Organization) [START_REF]Technical Opinion, Introduction of a regulatory framework for the operation of unmanned aircraft[END_REF] as: A drone that does not allow pilot intervention in the management of the flight. Aside from sounding like science fiction, one of the key reasons that EASA has switched to using the term 'drone' and categorizing as remotely piloted or autonomous -rather than using UAS or RPAS -is to ensure the fast growing development of autonomous drones. for drones, to which member states refer when developing their legally enforceable national civil aviation regulations. 2018 is the proposed year for draft SARPs with a focus on international drone operations. Until then, the work of the ICAO can be traced by studies of the UAS Study Group (set up by ICAO in 2007), which developed the Circular 328 AN/190 on Unmanned Aircraft Systems [START_REF]Cir 328, Unmanned Aircraft Systems (UAS)[END_REF], an amendment to Annex 2 (Rules of the Air) [START_REF]Amendment No. 43 to the international standards, Rules of the air[END_REF] and Annex 7 (Aircraft Nationality and Registration Marks) [START_REF]Amendment No. 6 to the international standards, Aircraft nationality and registration marks Annex 7 to[END_REF]. From a European perspective, Basic Regulation (Regulation EC No.216/2008) [START_REF]European Parliament and Council[END_REF] is that which holds at present. Article 2 and Annex II limit the regulation to apply only to drones with a maximum take off mass above 150 kg and/or except operations on military, customs, police, firefighting, search and rescue, and experimental work. Those that are not covered by Basic Regulation are handled by national aviation legislation, which are not yet harmonized and mostly designed with an assumption that small drones are operating locally. EASA is working on different aspects of drone integration into the airspace. Last year, EASA published the 'Prototype' Commission Regulation on Unmanned Aircraft Operations [START_REF]Prototype commission' regulation on unmanned aircraft operations[END_REF], after public consultancy with A-NPA 2015-10 (Advance Notice of Proposed Amendment) [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF], and its resulting Opinion [START_REF]Technical Opinion, Introduction of a regulatory framework for the operation of unmanned aircraft[END_REF] with an Explanatory Note of Opinion. Another work from EASA aims to authorize general principles for the type certification for fixed wing and helicopter drones separately, using a policy adopted by the agency in 2009 (E.Y013-01) [START_REF]Policy Statement Airworthiness Certification of Unmanned Aircraft Systems (UAS)[END_REF].

In the proposed regulation by EASA, an operation and risk centric categorization has been followed. Open, specific, and certified are the three categories proposed, corresponding to the different risk levels that they entail.

• Open Category encompasses low-risk operations, such as most leisure flights and some professional activities. Operations falling in this category do not require explicit authorization from civil aviation authorities. However, they are subject to strict operational limitations (e.g., no proximity to people, traffic, infrastructures; no dangerous items; one pilot per UAS; no item dropping).

These operational limitations are sufficient to mitigate the low risk. Though some professional activities fit into this category, the main goal is to regulate leisure types of operation [START_REF] Manfredi | Unmanned aerial system operations for retail[END_REF].

• Specific Category regroups medium-risk operations, such as operation beyond visual line of sight (i.e., no visual contact between pilot and UAV during flight). To facilitate the regulation process, several scenarios with specific operational limitations are designed. To operate within a scenario, the UAS needs to comply with a list of requirements. For operations outside the scope of those scenarios, a risk analysis must be carried out to show that the existing risks are properly mitigated. To facilitate this risk analysis process, JARUS has developed a framework called the Specific Operations Risk Assessment (SORA).

SORA considers threats -which contribute to the risk -and barriers -which mitigate the risk -in order to evaluate the actual risk of an operation, and decide if the resulting mitigated risk is low enough to allow the operation, as illustrated in Fig. 2-2. The risk analysis needs to be validated by the authorities in order to authorize an operation not included in the standard scenarios [START_REF] Manfredi | Unmanned aerial system operations for retail[END_REF].

• Certified Category Operations with risk that cannot be mitigated in Specific Category are evaluated in Certified Category. These represent high-risk operations, such as a large cargo delivery in urban area. These are likely to be operations with a risk close to current manned aviation. As such, the aircraft, avionics, pilot/crew and operator will need to be certified in order to fly these operations. The fact that a certification process is involved increases the complexity of the introduction of UAS in these types of operations. Indeed, before being able to certify a piece of equipment, a standard must be developed for this equipment. Standardization can be best understood as the process of defining details and minimum requirements for safe and uniform operations across a diverse range of implementations. However, at present, not all of the parts required to fly a UAS have the corresponding standards, e.g., Detect And Avoid (DAA) systems, C2 links, pilot training. Thus, enabling this category of operation requires extra effort and time for the industry so as to agree on standards. For Certified Category, harmonization at the ICAO is planned to allow international operations [START_REF] Manfredi | Unmanned aerial system operations for retail[END_REF].

Latest efforts for the integration of drones into airspace have welcomed a relatively new concept, called the 'U-Space'. This approach has been adopted for immediate plans at the European level, to accommodate drones in urban areas. While EASA continues to search for solutions for the integration of drones in a variety of presumed airspaces, Commissioner Violeta Bulc has mentioned other pillars at a high level conference 2 in Warsaw. She offers that in parallel to the efforts of EASA, there are two other pillars that need to be tackled; UTM (UAS Traffic Management) and the U-

2
Drones as a leverage for jobs and new business opportunities [START_REF]Drones as a leverage for jobs and new business opportunities[END_REF] Figure 2-4: Airspace design for small drone operations by Amazon [4] Space. U-Space covers the usage of drones especially in 'U-rban' areas with an equal share of airspace, in which case 'U ' stands for 'you'. To illustrate its availability to everyone, the services will be available through a mobile phone, as shown in Fig. 23.

The goals are highly challenging [20]:

• "Safe: safety at low altitude levels will be just as good as that for traditional manned aviation. The concept is to develop a system similar to that of Air Traffic Management for manned aviation."

• "Automated: the system will provide information for highly automated or autonomous drones to fly safely and avoid obstacles or collisions."

• "Up and running by 2019: for the basic services like registration, e-identification and geo-fencing. However, further U-Space services and their corresponding standards will need to be developed in the future."

EASA regulations already cover the airspace issued in U-Space, either under spe-cific or certified categories (depending on the risk of the operation). Using U-Space, a faster integration is expected in urban areas. We do not appear to be far from the images of flying vehicles populating the sky, as in science fiction -but even more advanced -without drivers, and more automated.

In the US, in order to tackle the safety challenges and help the development of regulation, NASA is currently carrying out a four-year research program (up to 2019)

to enable unmanned aircraft traffic management solutions which are structured and flexible when needed. To ensure safety, this integration needs to be achieved through airspace management and UAS reliability. In addition, preliminary airspace designs, such as that proposed by Amazon shown in Fig. 234, identify different zones depending on the UAS capabilities, population density and altitude.

United Arab Emirates (UAE) has accelerated the safe integration of drones into urban airspace, by settling an agreement for UAS Traffic Management (UTM) with Nokia, as part of its 'Next generation network for mission-critical and smart city services' [START_REF] Nokia | Nokia showcases power of drones and LTE connectivity for public safety at D4G Award event in Dubai[END_REF]. Aiming at tracking and managing all drones in the airspace, Nokia is offering solutions for automated flight permissions, no-fly zone regulation, beyond visual line of sight (BVLOS) safety operations utilizing LTE protocols for low latency, reliable and resilient communication. For compatibility with this system, drones will be equipped with LTE dongles and access modules for telemetry data access.

Paparazzi Autopilot System

An open-source autopilot, Paparazzi [14], has been adapted to generate faulty control inputs during the flight. In this section, an introduction to Paparazzi open-source autopilot system is given. Next, we discuss the properties of open-source systems that would best serve the integration of drones into the airspace. To highlight the advantages of Paparazzi, the best practices that are offered by EASA in its A-NPA [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF] are referred to, and the properties of Paparazzi to achieve this are discussed.

Open-source Autopilots for UAS

With the new era of First Person View (FPV) flights [START_REF] Fpvhub | What is First Person View (FPV) for Radio Controlled Flight?[END_REF], especially for multi-rotor UAVs, there has been an exponential increase in the hardware and software of the open-source autopilots. A brief comparison of the popular current open-source and commercial autopilots is available in Table 2.1. Usually, the trend is to make the hardware as inexpensive as possible for recreational consumers. This reality is damaging to the reputation of open-source autopilots as they are considered as not reliable or robust, because they are being used without experience. Indeed, there exists a difference in the quality of sensors used in the open-source autopilot systems compared to commercial autopilots, and this is confirmed by the price of the units. This in turn makes a difference to the flight quality of the vehicles, however, with new on-board processing power, more complex estimation algorithms and filters are being used in order to overcome this problem [9].

Introduction to Paparazzi Autopilot System

The packaged for Debian/Ubuntu but can be manually installed on any GNU/Linux operating system, even including MacOS-X. However, it is not compatible with Windows which automatically eliminates 90 % of the possible user community, and therefore it is not as popular as other existing autopilot systems currently on the user market. Airborne software is written in C, however there is an on-going effort to support C++ [9]. Paparazzi has its own complete flight plan language, where the user can define any possible trajectory using existing commands, such as circle, line, hippodrome, figureeight, survey, etc. Additionally, any function written in C language can be called from the flight plan and executed. This opens up a lot of application possibilities, such as triggering a navigation procedure via a sensor output.

One of the distinguishing features of

A real-time operating system based on ChibiOS has been used since 2015. The first implementation was mainly for adding a separate thread in order to make onboard logging at a high frequency. On going work is to divide all autopilot tasks into individual threads and manage everything according to priorities which will increase For the faulty flight data gathering necessary for this thesis, some modifications to the Paparazzi autopilot were necessary: first, injecting the real-time faults from GCS; and second, editing the controller on board so that the sent faulty input values configure the servos when changed from the GCS.

The rest of this section highlights the capacity of Paparazzi capacity to tackle issues encountered during the integration of Unmanned Aircraft System (UAS)s into the airspace. These issues have been grouped into three categories: modularity, congestion management and reliability. For each category, Paparazzi offers a unique set of features to deal with these issues.

Open-Source Systems in Relation to the New Regulatory Context

In this section, we present the Paparazzi open-source auto-pilot system and its features, as a tool towards the safe integration of low altitude UAS into the National Air Space (NAS). Paparazzi is favored thanks to its modular design, its support for congestion management and evolving reliability. We believe that the flexibility required for such solutions calls for open architecture. To ensure safety, this integration needs to be achieved through airspace management and UAS reliability. Preliminary airspace designs (for example, Amazon's design) identify different zones depending on the UAS capabilities, population density and altitude. Furthermore, the evolution of national rules increases the push to cope variety of requirements. Open-source and modular architectures are keys to successfully adapting to these requirements. From UTM point of view, Paparazzi provides features to ease congestion management, such as dynamic geofencing, trajectory communication and collision avoidance. Concerning reliability, current regulations focus on flight constraints but may be expected to involve regulations on software and hardware components as well. In such a case, the increased cost will be inevitable for the demands of certification. In the Paparazzi software case, parts of the code have been formally proved and stable versions have thousands of flight hours. Such heritage may ease the certification process for smaller companies. In addition to its flexibility and reliability, Paparazzi offers a unique set of features as an open-source software, so as to achieve safe integration of low altitude UAS into the airspace.

Modularity

The current evolving nature of regulations, and the variety of organizations in charge of the airspace rules, demands flexible solutions to cope with this unique environments. Paparazzi, as an open-source autopilot system, is easily modifiable through its modules to be able to offer such flexible solutions.

Airspace Categorization

The UAS in the National Air Space (NAS) project points to a performance-based routine access to all segments of the national airspace for all unmanned aircraft system classes, after the safety and technical issues are addressed thoroughly. Initially, National Aeronautics and Space Administration (NASA) and Federal Aviation Administration (FAA) seem to have a short-term goal to integrate UAS in low-altitude airspace as quickly as possible. They further aim to accommodate increased demand safely and efficiently in the long term. NASA and FAA appear to manage the airspace above 500 feet and that below separately. European Aviation Safety Agency (EASA), tasked by the European Union, is planning a risk-based approach, accommodating the UAS in the airspace under three different categories: low risk; specific; and high risk [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF]. Both regulators seem to categorize the airspace and scale regulatory needs according to certain criteria. To respond to the different needs of the different categories, flexibility given by the high level of modularity of open-source autopilot systems will be critical. Customizability of the software and hardware depending on the airspace gives a chance for the larger airspace community to utilize Paparazzi, scaled for their specific needs. A larger community using the same system would lead to a natural evolution of the system towards a better design.

National Regulations

International UAS flight is somewhat hampered by the Chicago convention unless an agreement holds between Contracting States [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF]. The International Civil Aviation Organization (ICAO) is aiming to develop international standards and recommended practices to which the member states can refer when developing their national civil aviation regulations. Although member states are planning to refer to the same standards and national aviation legislations, those will not be exactly the same because of the different expectations of nations towards UAS aviation. Thanks to the modular nature of the Paparazzi software and hardware suite, the functionality of the system could be enhanced according to the specific regulations held in the area of utilization.

Accommodating evolution of regulations

Prescriptive rules seem to cause some difficulties since the technical area of the UAS systems develops rapidly [START_REF]Introduction of a regulatory framework for the operation of drones[END_REF]. Innovations, both on the aircraft and on the type of operation of the UAS, will accelerate especially after the regulations are set. Thus, regulatory bodies call for refinable operational requirements and systems architecture to evolve into a safer and more efficient integration of UAS into the airspace. The systems to cope with the regulations should also be modular and flexible in order to not be superseded by innovations in the area. Thus, the aviation regulatory bodies aim to achieve designs with flexibility where possible, and structure where needed.

Having flexible hardware and software increases modularity, which is for the most part supported via open-source systems.

Congestion Management

According to UAV Factory, one of the large European UAS companies, "The future of the UAV industry is likely to be shaped by airspace congestion" [START_REF] Probst | Uav systems for civilian applications[END_REF]. Indeed, high level airspaces are becoming crowded, and large-scale solutions, such as NextGen (US)

or SESAR-JU (EU), are necessary to increase airspace capacity while maintaining the current safety levels. However, there is no such existing management solution for Very Low Level (VLL). Yet, large projects like Amazon's Prime Air and Google's Project

Wing are already ready to populate the VLL airspace.

Part of the congestion management problem is to avoid conflicts (and more importantly, collisions), between the UAS through strategic deconfliction and safety nets.

Another purpose of the congestion management system is to make sure that UAS do not go where they are not supposed to go, thus requiring geofencing. In order to implement the previously mentioned systems, the UAS autopilot needs to be able to perform complex operations, for example, static waypoints following is likely to be insufficient. In the following, we divide these issues into four topics of interest: 4-D trajectory management; geofencing; safety nets; and complex operations, and show how the Paparazzi system addresses them.

4-D Trajectory Management

As noted in [START_REF] Erzberger | Concept for next generation air traffic control system[END_REF], 4-D trajectories will be central in future airspace management methods. The principle of 4-D trajectory management is to have every UAS broadcasting its trajectory up to some time horizon, and to receive Unmanned Aircraft System Traffic Management (UTM) clearances in the form of trajectories. The trajectory information contains a path, a series of points through which the UAS will pass, and will at times be associated with each of these points. Thanks to this information, the idea is to perform pro-active deconfliction, as explained by Thomas et al. in [START_REF] Thomas | Options for insertion of rpas into the air traffic system[END_REF].

It implies that UTM detects future conflicts along the trajectories of all UAS and deconflicts them as safely and as quickly as possible. This kind of approach requires the autopilot to represent UAS motions with trajectories and to be able to transmit them, which is the case in Paparazzi.

Paparazzi originally supports a basic description of trajectories based on circles and straight lines, but recent updates allow it to process advanced trajectories as well. Indeed, Paparazzi can represent trajectories as functions in 2-D (x, y), 3-D (x, y, z) or 4-D (x, y, z, t). The only requirement is for the function to be differentiable at least two times at every point. The function and its closed form derivatives are computed offline and can then be quickly evaluated online. Moreover, gains can be calculated by tuning to adjust the convergence speed from the UAS starting point to the given trajectory. These gains influence the convergence path to a given trajectory and the resulting trajectory (convergence + commanded) can be computed offline,

given initial conditions and the commanded trajectory. This is of particular interest for UTM as it allows the UAS to provide not only its trajectory over time but also how it will reach this trajectory from its starting point.

It is important to note that UTM will have to solve conflicts between manned and unmanned aircraft. Thus, an air traffic controller is needed as part of the process with an appropriate display for 4-D trajectories and a communication link with both manned and unmanned aircraft.

Safety Nets

Trajectory deconfliction is the first step to manage congestion, however safety nets are also part of congestion management. Indeed, safety nets such as self-separation and collision avoidance allow UAS to fly close to each other while preserving an acceptable safety level. Though Paparazzi does not include self-separation algorithms, it does contain a light version of the TCAS II collision avoidance system. It considers intruders one at a time and is capable of coordinated avoidance maneuvers.

Values such as distance thresholds have been adapted to suit the performance of small UAS. Keeping in mind that the Parapazzi philosophy is to be configurable, so these parameters can be easily changed from a configuration file.

A module has been recently developed to input data from traffic services and display them into Paparazzi's ground control station, thus providing situational awareness to the remote pilot. Preliminary tests have been conducted using openskynetwork to display traffic around a given area. Based on this information, the remote pilot can effectively perform conflict resolution.

Geofencing

Keeping UAS away from each other is important, but keeping them out of forbidden areas is critical. Geofencing determines no-fly zones where the UAS should not enter.

To accommodate land owners while managing traffic and limiting congestion, Foina et al. [START_REF] Gomide Foina | An unmanned aerial traffic management solution for cities using an air parcel model[END_REF] have proposed a participative dynamical airspace management method:

the air-parcel model. This allows land owners to authorize/forbid flights over their land through a web interface. However, this type of approach requires the UAS to be able to handle dynamical geofencing. Furthermore, this model considers only cuboid parcels; the need for more precise airspace shapes may emerge making 3-D geofencing a fundamental need.

This type of model can be handled by Paparazzi by defining geofenced zones manually or as a function. Zones are defined as a simple geometrical shapes (e.g., a circle, a polygon, etc.), plus altitude limits, thus effectively creating 3-D geofencing.

These zones can be static, activated dynamically from the ground station or from the flight plan with associated conditions.

Complex Operations

Having 4-D trajectory management, safety nets and geofencing are useless if the UAS cannot follow instructions from the UTM regarding these tools. Indeed, new UTM paradigms suggest being able to change flight plans dynamically to answer to UTM demands. In [START_REF] Wargo | New entrants (rpa/space vehicles) operational impacts upon nas atm and atc[END_REF] two types of complex operation examples are mentioned: space transition corridors; and temporary flight restrictions. Both methods require that the UAS can modify its flight plan according to the new UTM instructions.

Modifying the flight plan dynamically is not possible, and not desirable, in Paparazzi. However, an appropriate response to these complex operations can be provided through conditional flight plans. This enables the UAS to follow different courses of action depending on given parameters. These parameters are defined offline by the user and can then be modified online by values coming from sensors or from UTM. This allows an intelligent reaction to exterior instructions; in particular, it can be used by the user to give UTM control on portions of the flight.

Reliability

The improvement of the reliability of the flight is considered to be one of the main goals for integrating military UAVs into civil airspace according to the unmanned systems roadmap of US Office of the Secretary of Defense, DoD [START_REF]Unmanned Systems Roadmap[END_REF]. Compared to manned counterparts, civil UAVs experienced more failures with a frequency of two orders of magnitude compared with military UAVs. Although this has changed in the last few years with technological improvements, making the UAVs as reliable as early manned military aircraft does not appear to be sufficient from the DoD perspective.

This can be realized by checking the biggest portion of control technologies' budget for research and development, which is health management and adaptive control.

To achieve a safe flight is not an easy task considering the unknowns of the systems hardware, environment and possible system faults and failures yet to emerge. Also, increasing demand on cost-effective systems, resulting in smaller sensors and actuators with less accuracy, impose the need for the software to achieve even more. The expectation that UAVs should be less expensive than their manned counterparts might have a hit on reliability of the systems.

Small and Medium Enterprise (SME) and Certification Costs

Using drones for quicker and cheaper deliveries could be rewarding for SMEs. Being an early bird might put the SMEs in an advantageous position, considering the increase in the capabilities of the drones with ongoing research activities and their widened application areas. Nevertheless, inexpensive access to drones and their relatively cheap utilization cost does not seem to be enough to put them to air at present, due to the heavy cost of certification and regulatory hurdles [START_REF]Unmanned Aerial Vehicle Reliability Study[END_REF]. In this regard, capable open-source solutions may be an effective way to loosen this restriction; otherwise, SMEs may not survive. Even worse, they may operate them without relevant the permissions, sacrifying a substantial fine as reported by Civil Aviation Authority (CAA). This will compromise confidence in the system contradicting the hopes for reliable the integration of drones into the airspace. As an open-source autopilot system, Paparazzi is a known platform for a computer scientist who wants to test the viability of complex software systems. Thus, parts of Paparazzi code (Ground Control Station (GCS)) have been formally proven [START_REF] Van Paassen | Checking formal verification models for human-automation interaction[END_REF] and a stable version has thousands of flight heritage. Furthermore, although Paparazzi is not certified, to be able to have access to the certified airspace, users can build up their configuration on the readily and freely available Paparazzi system, which may reduce the cost of having a certified system reaching specific airspaces.

Individuals and Education

Individuals, as well as SMEs, suffer from the same budget constraints. Personal UAV usage counts for a substantial amount of the drone ecosystem. Both US and European authorities mention the importance of individuals in the utilizations of drones. There is a community with a passion for aviation and its potential, thought it may likely be inexperienced. Paparazzi offers a whole community to help and educate these beginners through its forums enhanced by a rising number of users.

A rich documentation is available through the Wikipedia page, encouraging users to self-teach.

Flight Heritage for Risk Assessment

As the drone industry is extremely innovative, technical developments may supersede the prescriptive rules as regulations. Thus, a solution may be to follow a risk-based approach rather than to have strict rules to comply with. Predicted regulations in Europe seem to evolve under different categories dedicated to specific operation risks.

Flight heritage and occurrence reporting is expected to be an inevitable part of safety risk assessment in achieving reliable flight. The wide utilization of Paparazzi and real-time connection to the ethernet could offer reliable and practical solutions to be able report occurrences.

Support for real-time planning and onboard vehicle automation

To access low-altitude airspace with the use of small unmanned aircraft safely, an important ability could be to implement real-time planning and on-board vehicle automation. Amazon states that this approach will allow some flexibility to adapt to different situations, such as weather changes, severe winds or any other emergency needs. Paparazzi, has a real-time planning ability already implemented, allowing the user to change the trajectory in real-time through its ground control station via different strategies. The user could switch between trajectories already available or even drag the waypoints to his/her preference. The automation of the vehicles is handled in different stages. For now, the most used modes of autonomy is no autonomy, assisted mode and fully autonomous mode. No autonomy mode, or manual mode, gives whole responsibility of the aircraft dynamics to the pilot through the remote control link. The assisted mode closes some attitude control loops, giving some stability to the aircraft. This will ease the challenges of piloting which could be a significant advantage, especially for unexperienced pilots. The fully autonomous mode handles both heading and navigation through selected trajectories. In case of an emergency, the pilot takes control of the aircraft at any time, through the RC link. Features already implemented on Paparazzi, such as geofencing, go home, and its ease in adding and smodifying thresholds to various variables, support the safety procedures.

Future Evolutions

As is the same for many open-source projects, Paparazzi is in constant evolution through regular contributions. With its large community, it is difficult to keep track of all ongoing projects. In this section, we present three features being currently explored and developed at ENAC's labs.

Though there is currently no life at stake, avoiding UAS collisions is desirable for safety and operational reasons. Paparazzi's current TCAS-like collision avoidance allows the operation of numerous UAVs with little risk of collision between them.

However, future missions will include more and more UAVs in bounded size airspaces.

In this context, an efficient collision avoidance algorithm is desirable so as to allow closer operations with an acceptable number of nuisance alerts. Because it relies on advanced logics and can be adapted to different types of performances, we have chosen to implement the ACAS Xu algorithm. Though this standard's definition has just started, the baseline is already determined and may allow the development ofs a simplified version for micro UAVs.

Regarding geofencing, most current methods use boundaries in the horizontal plane into which the UAV cannot enter. However, the utilization of the VLL airspace is likely to demand more sophisticated methods to handle 3-D geofencing where a 3-D no-fly shape can be described. Though Paparazzi can emulate 3-D geofencing, it cannot yet use full 3-D models. Work is underway to extend the current geofencing to allow the loading of terrain models, and padding them with arbitrarily shaped no-fly zones.

Finally, conventional procedures to handle failures onboard could be one of the three approaches in order to achieve safe flight. The first is the fail operational systems, which are made insensitive to any single component failure. The second approach is the failsafe systems, where a controlled shut down to a safe state is practiced whenever a critical fault is pointed out by a sensor. The third approach is the fault tolerant control systems, in which components of the system are monitored and actions taken in whenever needed. The key strategy is most likely to keep the system availability and accept reduced performance. For the Paparazzi autopilot system, there is ongoing research to implement the ingenious fault detection and diagnosis module to enable reconfigurable controller loops.

Fault Tolerant Control Systems

The improvement of the reliability of the flight is considered to be one of the main obstacles to integrating UAVs into civil airspace. To achieve a safe flight is not an easy task considering the unknowns of the systems, environment and possible system faults/failures to emerge.

Loss of Control in Aviation

One of the biggest contributors to fatal accidents is considered to be aircraft loss of control (LOC). The Joint Safety Analysis Team (JSAT) defines LOC as a "significant, unintended departure of the aircraft from controlled flight, the operational flight envelope, or usual flight attitudes, including ground even". Here, significant refers to events resulting in an incidence or accident [START_REF] Russell | Joint safety analysis team-cast approved final report loss of control jsat results and analysis[END_REF]. Control failures, inappropriate pilot action (inaction) in a healthy aircraft, and vehicle impairment are examples of LOC events [START_REF] Nathan D Richards | Vehicle upset detection and recovery for onboard guidance and control[END_REF].

LOC-I (loss of control in-flight) is defined as "an extreme manifestation of a deviation from intended flight path" and is the most deadly accident type, with 37 fatal accidents per year (for fixed-wings) [START_REF]Loss of Control (LOC-I)[END_REF]. Although LOC-I is the cause behind many fatal accidents, manned aviation has a very limited use of LOC prevention and recovery [10]. Having no single action to prevent LOC events, technical limits in LOC simulations, such as full stall or failure simulations, constitute some of the challenges to LOC event prevention and recovery solutions.

To offer prevention strategies, the causes of LOC accidents and incidents should be thoroughly studied. LOC events have been categorized by Ref. [START_REF] Lambregts | Airplane upsets: Old problem, new issues[END_REF] [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]. FDD methods are used to discover if there is any fault/failure in the system and to determine the type of the fault.

After the fault is known, an assessment of the current abilities of the drone is vital.

The severity of the situation must be evaluated to decide if a recovery is possible.

If so, the current situation of the drone should be considered during the design of recovery control methodologies. In the case a recovery is likely to fail, a safe ditch maneuver can abruptly decrease the number of fatalities. Maps pointing to zones with no (or minimum) population could be uploaded onboard and the safest region to ditch can be selected. Since these situations are handled by the pilot for manned aviation, the number of works to assess and plan ditch maneuvers is few for unmanned systems. NASA is offering Safe2Ditch [2] to offer autonomous crash management but it is only currently at the design stage.

FTCS Terminology

Systems are often sensitive to faults of differing nature. Existing irregularities in sensors, actuators, or controller may be amplified due to the control system design and lead to failures (Fig. 2345678910). A fault may be hidden thanks to the control action [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF].

Since fault tolerant control is comprised of a set of different disciplines and is a relatively new topic, the terminology is not firmly established. "FDI" could be a One of the first attempts to unify the terminology was carried out by the IFAC SAFEPROCESS technical committee in 1996 and published by [START_REF] Isermann | Trends in the application of model-based fault detection and diagnosis of technical processes[END_REF]. Fault, failure and the methodology to handle them, such as fault detection, fault isolation, fault identification, fault diagnosis, and supervision terms are explained separately to avoid the ongoing ambiguity in this field. Although fault detection methods are clearer, the difference between the methods for the two steps of fault diagnosis (namely the fault isolation and fault identification) is not very obvious.

Conventions for a Safe Flight

The most widely-used method to increase reliability is to use more reliable components and/or hardware redundancy. Both require an increase in the cost of the UAS [5]. To offer solutions for all different foreseen categories of airspace, a variety of approaches should be considered. While hardware redundancy may cope with the failure situations of UAVs in the certified airspace, it may not be suitable for UAVs in open air or some subsets of specific categories due to budget constraints. Analytical redundancy is another solution, but it may be not as effective and simple as hardware redundancy, and it relies on the design of intelligent methods to utilize all information on board an aircraft to wisely deal with all eventualities.

There are three approaches to achieve safe FTC in standard flight conventions.

The first is the fail operational systems, which are made insensitive to any single point component failure. The second approach is the fail safe systems, where a controlled shut down to a safe state is practiced whenever a critical fault is noted by a sensor. The level of degradation ensures the switch to robust (alternate) or direct (minimal level of stability augmentation independent of the nature of the fault) mode.

Switching from nominal mode to the robust and direct modes leads to a decrease in the available GNC functions. This causes a degradation in ease of piloting. Furthermore, some optimality conditions may have been compromised. The third approach is the fault tolerant control systems, in which redundancy in the plant and the automation system are used to design software that monitors the components and takes in actions whenever needed. This strategy is the most probable to try to keep plant availability and to accept reduced performance [12].

RECONFIGURE project of FP7 [START_REF] Goupil | An overview of the fp7 reconfigure project: industrial, scientific and technological objectives[END_REF] aims to address the problem of piloting degradation and optimality compromise by Flight Parameter Estimation (FPE), which is the online estimation of aircraft parameters, FDD and FTC in case of off-nominal events [START_REF]RECONFIGURE FP7 Project. reconfigure.deimos-space[END_REF]. They utilize a black box nonlinear model of aircraft, and the project uses some outputs of a previous FP 7 project ADDSAFE leaded by Deimos Space [1].

Methods for Fault Tolerant Control Systems

Among the different categorizations of fault tolerance, there are options to handle faults on-line or off-line. Employing fault diagnosis schemes on-line is a way to achieve fault tolerance. In this case, as soon as a fault is detected, a supervisory agent is informed via a discrete event signal. Then, accommodation of the faults is handled with either the selection of a predetermined controller for the specific fault case, or by designing the action online with real-time analysis and optimization [12].

Another common categorization of FTCS is passive and active FTCS. In passive Even with a long list of available methods, the aerospace industry has not implemented FTC widely, except for some space systems, because of the evolving nature of the methods, the nonlinear nature of the problem, design complexity and the high possibility of wrong alarms in case of large disturbances and/or modeling uncertainties. Thus, the hardware redundancy is now the preferred way because of its ease and maturity being implemented on various critical missions with human lives.

Fault Detection and Diagnosis

FDD is handled in two main steps; fault detection and fault diagnosis. Fault diagnosis encapsulates fault isolation and fault identification. FDD should not only be sensitive to faults but must also be robust to the model uncertainties and external disturbances.

Two distinct options to proceed in analytical redundancy are the model based approaches and data-driven approaches. Model based fault diagnosis highlights the components of a system and the connections in-between, and their corresponding fault modes. Data-driven fault diagnosis relies on observational data, and it prefers dense, redundant data with a frequency larger than the failure rate.

Model-Based Methods

In model based approaches, relationships between measurements and estimated states are exploited to detect possible dysfunctions. The most common ways to implement a model-based approach is to estimate the states, the model parameters. A drawback of the model-based approaches is that they require an accurate model of the aircraft for successful detection. In a small UAV system, which is susceptible to various uncertainties/disturbances and usually lacks an accurate model, using a model-based approach might fail. Furthermore, a mathematical model of a UAV is built within the flight envelope, and does not necessarily describe the possible dynamics invoked by an on-board failure.

A fairly old study from 1984 investigates FDI systems robust to uncertainties.

One of the two steps of FDI (residual generation and decision-making) is targeted.

They offer the ability to handle model uncertainties, by designing a robust residual generation process [19]. Another study deals with model uncertainties by determining the threshold of the residual in a novel way with an application to detect aileron actuator fault [START_REF] Rotstein | Faultdetection design for uninhabited aerial vehicles[END_REF]. [START_REF] Sharma | Fault detection in nonlinear systems with unknown inputs using sliding mode observer[END_REF] uses two cascade sliding mode observers state estimation and fault detection to guarantee staying in sliding manifold in the presence of unknown disturbances and faults.

Data-Driven Methods

Model-based approaches have various successful applications up until now; most of them assuming an accurate model is available on-board. With the new era of UAVs, the airspace is expected to be populated by a strong increase in the number of UAVs.

The variety of UAVs, the expense of accurate modeling practices, the difficulty in modeling the behavior of UAV in case of failures,all call for alternative approaches for the quite challenging problem of FDD. The increased efficiency of on-board sensors, the increase in the computational capabilities of autopilot processors, and the advances in machine learning techniques in the last decade may offer efficient datadriven solutions to FDD.

In data-driven methods, a detailed knowledge about the internal dynamics of the system is not necessary. The data available is the source of information with regard to the behavior of the system. Supervised learning, which requires labeling the fault cases previously in the training data, is usually used for data-centric fault detection.

In case of an unlabeled fault, the result is expected as a probability distribution of the available normal modes, identified fault labels and a probable unknown fault. What is needed at that point is to first detect and localize the fault, and then to consult domain experts for labeling for the further integration of this fault into the diagnosis scheme [START_REF] Stutz | On data-centric diagnosis of aircraft systems[END_REF].

[43] argues artificial intelligent methods for the fault detection of complex systems. Comparison between Principle Component Analysis (PCA) and model based stochastic parity space approaches is given in [START_REF] Hagenblad | A comparison of two methods for stochastic fault detection: the parity space approach and principal component analysis[END_REF]. In [START_REF] Li | A data driven fault detection and isolation scheme for uav flight control system[END_REF], the authors argue the use of dynamic PCA since UAV flight controls is a dynamic system itself and the Dynamic Principle Component Analysis (DPCA) can reflect unknown disturbances, while model-based approaches can only model typical disturbance.

Machines on the Rise

Since machine learning methods are selected to detect and diagnose actuator faults in this thesis, a short introduction to the topic is now provided.

The mathematical analysis of learning processes goes back to the1960s when F.

Rosenblatt [START_REF] Rosenblatt | The perceptron: a probabilistic model for information storage and organization in the brain[END_REF] suggested the perceptron: the first learning machine [START_REF] Vapnik | The nature of statistical learning theory[END_REF] (see Fig. 2- 13). Inspired by a simplified model of a biological neuron, the idea of the perceptron was discussed for many years in the neurophysiological literature [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. The contributions of Rosenblatt were to describe the perceptron model as a program for computers, and to show that the model could be generalized via experiments [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. The perceptron was first implemented on an IBM 704 as an algorithm. Later, a custom-built hardware implementation of the perceptron was delivered (as shown in Fig. 234567891011121314).

The interest in perceptron came to a halt when Minsky and Papert proved that a single layer perceptron cannot learn an XOR function [START_REF] Minsky | Perceptron expanded edition[END_REF]. This led to a wrong assumption that multi-layer networks would not be able produce an XOR function.

. . . . . . Although Grossberg published that multi-layer perceptrons are capable of producing XOR functions, the declined interest has persisted for some years until the research on perceptron was revived.

Back-propagation method, proposed by several authors [START_REF] Le | Learning process in an asymmetric threshold network[END_REF][START_REF] David E Rumelhart | Learning representations by back-propagating errors[END_REF] independently in 1986, is considered to be the second birth of the perceptron. It is originally an older method (1963) [17] and was used in solving control problems [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. The application of the method to calculate the weight simultaneously for many neurons changed the developmental path of learning machines [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. In 1980s, the terminology was also changed due to an application-oriented approach in research on learning (with the introduction of powerful computers) [START_REF] Vapnik | The nature of statistical learning theory[END_REF], and multi-layer perceptrons were renamed as neural networks.

Although 1974-1980 was not very fruitful for neural networks, and was known as the AI winter, the development of statistical learning theory endured. A novel inductive principle, Structural Risk Minimization (SRM) inductive principle, was introduced in 1974 [START_REF] Vladimir | Theory of pattern recognition[END_REF]. In the SRM inductive principle, the risk in a given set of functions is minimized by controlling two factors: the value of the empirical risk; and the value of the confidence interval [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. Support Vector Machines [START_REF] Vladimir | Theory of pattern recognition[END_REF][START_REF] Vapnik | Estimation of dependences based on empirical data[END_REF] are introduced as an application of SRM by keeping the value of the empirical risk fixed (say equal to zero), and minimizing the confidence interval [START_REF] Vapnik | The nature of statistical learning theory[END_REF], as opposed to keeping the confidence interval fixed (by choosing an appropriate construction of machine) and minimizing the empirical risk (as in Neural Networks). Their applicability expanded thanks to its extension to problems that require nonlinear classifiers [13] using kernel trick, [3] and also to problems with non-separable classes [START_REF] Cortes | Support-vector networks[END_REF] using soft margin separating hyperplanes.

Almost two decades after IBM's Deep Blue beat the chess champion Kasparov [START_REF]Deep Blue[END_REF], Google DeepMind's Artificial Intelligence(AI) AlphaGo [26,18] defeating 9-dan Go professional player raises the question: what will the next victory of AI look like?

European Parliament published a draft report with recommendations to the European Commission on Civil Law Rules on Robotics [START_REF] Delvaux | Report with recommendations to the commission on civil law rules on robotics[END_REF], including a list of concerns for a possible rise of the learning machines. Not only the singularity (artificial super intelligence resulting in deep changes in human civilization) but also more inevitable outcomes are discussed, such as AI's effects on the workforce, ethical and legal issues inherent to automatized systems including drones.

The winner of the Go contest, the AI, is based on a method named Reinforcement Learning (RL). This method is used in many of the latest ground-breaking applications of AI. In reinforcement learning, the selection of actions results in consequences.

Thus, the agent interacts with its environment, by taking actions and observing the consequences via the reward function. The goal of the agent is to calculate actions that will maximize the reward. An example of this functioning can be demonstrated on a robot locomotion problem. Fig. 2-15 shows a humanoid model and an ant robot model from Google DeepMind [START_REF] Deepmind | Producing flexible behaviors in simulated environments[END_REF][START_REF]Deep Reinforcement Learning[END_REF][START_REF]Google's DeepMind AI Just Taught Itself To Walk[END_REF]. The robot models have virtual sensors which give information about their states (angle and position of the joints [START_REF]Deep Reinforcement Learning[END_REF]) and surrounding objects [START_REF]Google's DeepMind AI Just Taught Itself To Walk[END_REF]. The objective for the robots is to move from point A to point B. Although the robots were not explicitly programmed to walk or jump, and

were not given any information about what walking or jumping looks like, they learnt to move in a way very similar to walking and jumping.

In recent times, we have witness very promising application results in Neural Figure 2-15: Humanoid and ant robot models [START_REF]Deep Reinforcement Learning[END_REF] exhibiting walking and jumping motions respectively using reinforcement learning [START_REF] Deepmind | Producing flexible behaviors in simulated environments[END_REF]. The robots are given objectives to go from one point to the other, but not given any information about walking or jumping [START_REF]Google's DeepMind AI Just Taught Itself To Walk[END_REF].

Networks in its various forms. Convolutional neural networks (CNN) applied to image processing problems, and sequence models (Recurrent Neural Networks (RNN and Long short term memory (LSTM)) applied to natural language processing have produced remarkable results, raising interest in machine learning and AI in various fields. Such an example is Google's Duplex AI [START_REF] Leviathan | Google Duplex: An AI System for Accomplishing Real-World Tasks Over the Phone[END_REF], making phone calls to restaurants or hair salons, to book a table or arrange a meeting. AI talks to the person on the phone and adapts to the responses of the human on the phone, and achieves its task without being exposed that it is actually an AI.

An application of RL in aviation is demonstrated with Stanford University's autonomous helicopter [START_REF] Andrew | Shaping and policy search in reinforcement learning[END_REF]. Thanks to RL, the helicopter's autopilot performs acrobatic maneuvers, which is difficult to do with a hardcoded controller design. A photo taken during its inverted flight can be seen in Fig. 2345678910111213141516.

Machine learning has already started to take part in aviation. Operational improvements in aviation is one of the preliminary fields in which it has appeared. Recently, in an AGE sponsored competition, data scientists designed a routing algorithm using real flight data, and achieved a 12% improvement in fuel consumption efficiency.

Some other operational problems issued by machine learning are accurate arrival time AI has actually already made its way into the cockpit. Garmin implemented voice recognition features garnished with some other functions, such as changing radio channels, to assist the pilots with its audio panels GMA 350 and GMA 35, called

Telligence. One of the goals of the autonomy researchers is to look for ways in which to implement artificial intelligence to one of the core features of an aircraft: the autopilot.

Hence, the ability to use them remains challenging due to the inherent nature of the methods, that is, non-determinism. EASA A-NPAs offer different categories for drones operations, depending on the risk of the operation of concern. The difficulties waiting for the machine learning research are not currently well defined or widely argued in aviation.

Conclusion

In this chapter, we discuss the current status of drone regulation, an introduction to In Section 3, nonlinear aircraft dynamics will be discussed in order to provide insights about flight motion, and to simulate the states of an aircraft. These states can then be used to simulate sensor measurements on board a drone, and are necessary to design data-driven fault detection and diagnosis algorithms.

Paparazzi

61

Chapter 3

Nonlinear Aircraft Model

The movement of any object can be represented by changes in its location (translation)

or changes in its attitude (rotation) or a combination of both. The motion of an aircraft usually involves both translation and rotation. Studying aircraft motion is complicated as these two motions are coupled; for example a rotation might cause a change in aerodynamic forces which then affects the translation. Thus, to ease the process, the motion is broken into easier problems utilizing some assumptions. Such

an assumption for the aircraft motion is to assume that the aircraft is a point mass;

all of its mass is collected at its center of gravity, so it translates from one point to the other. Then, the aircraft's rotation is investigated by no longer assuming it as a point mass but a rigid body in space.

In this chapter, modeling both of these motions (translation and rotation motion) If the reader is not interested in detection and diagnosis via simulated data but interested in detection and diagnosis via real data, it is not essential to read this chapter as it explains the models that are used to simulate measurements. Nonetheless, having background information on the physics of the system may help to understand the features (translational acceleration and angular velocities) used in both model-based and data-driven fault diagnosis.

Attitude motion modeling

Rotation is a change in an object's attitude. A change in attitude is modeled using rotations about the center of gravity. This section derives the equations for rotation (attitude motion) in detail. Note that the equations for attitude kinematics and attitude dynamics can be found in Equations 3.35 and 3.51, respectively.

Rotations are directly affected by external torques and moments while translations are directly affected by external forces. The attitude of an aircraft during translation also affects the aerodynamic forces causing changes in translation.

A force applied at a distance from the center of mass causes a rotation. A very common approach in aircraft control is to balance those rotations, by trimming the aircraft, such that the aircraft will not rotate.

In this section, attitude motion is represented using kinematic and dynamics equations. First different parametrization of attitude, such as Euler angles and quaternions, are discussed. Then, kinematic and dynamic equations of attitude motion are derived for a general rigid body. These equations are later specified for the aircraft as the rigid body of interest.

b 1 ⇥ b 2 = b 3 (3.1)
The rigid body is composed of points, which do not experience any distance change between themselves during the motion of the body. The problem in representing attitude can simply be thought of specifying the orientation of this triplet with respect to some reference frame A, such as in Fig. 3-1.

Expressing the basis vectors b 1 , b 2 , b 3 of B in terms of basis vectors a 1 , a 2 , a 3 of A is given by :

b 1 = C 11 a 1 + C 12 a 2 + C 13 a 3 , b 2 = C 21 a 1 + C 22 a 2 + C 23 a 3 , b 3 = C 33 a 1 + C 32 a 2 + C 33 a 3 . (3.2)
where C ij ⌘ b i • a j is called direction cosine as it corresponds to the cosine of the angle between b i and a j . When the previous equation set is written in matrix form, we have: Here C B/A is called the direction cosine matrix, also known as the rotation matrix or coordinate transformation matrix from A to B [START_REF] Wie | Space vehicle dynamics and control[END_REF]. The direction cosines, the elements of the direction cosine matrix, are not all independent [START_REF] Wertz | Spacecraft Attitude Determination and Control[END_REF].

The direction cosine matrix is an orthonormal matrix as the basis vectors of each reference frames are orthogonal, so:

C 1 = C T (3.4)
and:

CC T = C T C = 1 (3.5)
where 1 is the identity matrix. When the orientation is preserved, an additional condition occurs:

C = 1 (3.6)
Matrices satisfying the last two properties belong to the special orthogonal group SO(3). The following relations are valid between C B/A -the direction cosine matrix of B relative to A or the direction cosine matrix from A to B -and C A/B -the direction cosine matrix of A relative to B, or the direction cosine matrix from B to A -:

[C A/B ] 1 = [C A/B ] T = C B/A [C B/A ] 1 = [C B/A ] T = C A/B (3.7)
The direction cosine maps the vectors from reference frame to body frame. Let us write an arbitrary vector H in the reference frame A and in the body frame B:

H = H 1 a 1 + H 2 a 2 + H 3 a 3 = H 0 1 b 1 + H 0 2 b 2 + H 0 3 b 3 (3.8)
Using the direction cosine matrix in the following equation, components of the arbitrary vector H are transformed from A to B:

b 1 • a 1 b 1 • a 2 b 1 • a 3 b 2 • a 1 b 2 • a 2 b 2 • a 3 b 3 • a 1 b 3 • a 2 b 3 • a 3 3

Euler Angles

One of the approaches used to represent the attitude is the use of Euler angles. It is a procedure to rotate three times in succession about one axis of the rotated body fixed reference frame. The first rotation is about any of the fixed body axes. The second one is about any of the other two axes which have not been used in the first rotation. The third one is about one of the axes which has not been used in the second rotation. The result is a combination of 12 sets of rotation types. A sequence of rotations about three different axes of reference frame A, describing the orientation of the body frame B with respect to reference frame A, can be represented as:

C 3 (✓ 3 ) : A 0 A, C 2 (✓ 2 ) : A 00 A 0 , C 1 (✓ 1 ) : B A 00 .
(3.10)

The direction cosine matrix B relative to A can be given as:

C B/A = C 1 (✓ 1 )C 2 (✓ 2 )C 3 (✓ 3 ) (3.11)
where ✓ 1 , ✓ 2 , ✓ 3 are the Euler angles. C i (✓ i ) denotes a rotation of angle ✓ i , about the i th axis of the body frame. The orientation of B with respect to A is given as:

C B/A = 2 6 6 6 6 4
1 0 0 0 cos✓ 1 sin ✓ 1 0 sin ✓ 1 cos ✓ 1 3 7 7 7 7 5 2 6 6 6 6 4 cos ✓ 2 0 sin ✓ 2 0 1 0 sin ✓ 2 0 cos✓ 2 3 7 7 7 7 5 2 6 6 6 6 4 cos ✓ 3 sin ✓ 3 0 sin ✓ 3 cos ✓ 3 0 0 0 1 3 7 7 7 7 5 = 2 6 6 6 6 4 cos ✓ 2 cos ✓ 3 cos ✓ 2 sin ✓ 3 sin ✓ 2 sin ✓ 1 sin ✓ 2 cos ✓ 3 cos ✓ 1 sin ✓ 3 sin ✓ 1 sin ✓ 2 cos ✓ 3 + cos ✓ 1 cos ✓ 1 cos ✓ 3 sin ✓ 1 cos ✓ 2 cos ✓ 1 sin ✓ 2 cos ✓ 3 + sin ✓ 1 sin ✓ 3 cos ✓ 1 sin ✓ 2 sin ✓ 3 sin ✓ 1 cos ✓ 3 cos ✓ 1 cos ✓ 2 (3.12)
For aircrafts, the Euler angles (✓ 1 , ✓ 2 , ✓ 3 ) are called roll, pitch and yaw, respectively, and can be seen in Fig. 3-2.

The rotation sequence can be selected in different ways depending on the needs of the problem. An example would be selecting a rotation sequence for a transitioning vehicle. The assumption that the pitch angle is constrained to 0 < ✓ < 90 for a conventional drone to avoid singularity, is not really feasible for a transitioning vehicle which encounters 90 < ✓ < 90 pitch during the whole flight envelope. For such a problem, selecting the sequence as yaw-roll-pitch, rather than the conventional yaw-pitch-roll sequence, is useful.

Thus, if the set of rotations are selected in a different way, such as:

C 2 (✓ 2 ) : A 0 A, C 3 (✓ 3 ) : A 00 A 0 , C 1 (✓ 1 ) : B A 00 .
(3.13) then the direction cosine matrix would differ from Eq. 3.12, and be given as:

C B/A = 2 6 6 6 6 4 cos ✓ 2 cos ✓ 3 sin ✓ 2 cos ✓ 2 sin ✓ 3 cos ✓ 1 sin ✓ 2 cos ✓ 3 + sin ✓ 1 sin ✓ 3 cos ✓ 1 cos ✓ 2 cos ✓ 1 sin ✓ 2 sin ✓ 3 + sin ✓ 2 cos ✓ 3 sin ✓ 1 sin ✓ 2 cos ✓ 3 + cos ✓ 1 sin ✓ 3 sin ✓ 1 cos ✓ 2 sin ✓ 1 sin ✓ 2 sin ✓ 3 + cos ✓ 1 cos ✓ (3.14)

Quaternions

The idea behind this representation is the Euler's eigen-axis rotation theorem. According to Euler, "the most general displacement of a rigid body with one point fixed is a rotation about some axis." In other words, it states that there exists a unit vector e, with the property:

Ce = e (3.15)
The e vector has the same components in body and reference frames :

e = e 1 a 1 + e 2 a 2 + e 3 a 3 = e 1 b 1 + e 2 b 2 + e 3 b 3 (3.16)
By rotating a rigid body about this axis e, a rotation from any given orientation to any other orientation can be achieved. Such an axis is called an Euler axis, after the Swiss mathematician and theoretical physicist, Leonard Euler (1707-1783). Euler symmetric parameters, also known as quaternions, are defined as: where is the Euler rotation angle. Hamilton (1805-1865) is considered to be the first to mention quaternions. For ease of the mathematical representations, we define a vector as :

q = 2 6 6 6 6 6 6 6 6 4 q 0 q 1 q 2 q 3 3
q = e sin ( /2) (3.18)
Euler symmetric parameters are not independent, and satisfy the constraint:

q T q + q 2 0 = q 2 0 + q 2 1 + q 2 1 + q 2 3 = 1 (3.19)
The direction cosine matrix can also be written in terms of quaternions as below

C(q) = 2 6 6 6 6 4
q 2 0 + q 2 1 q 2 2 q 2 3
2(q 1 q 2 + q 3 q 0 ) 2(q 1 q 3 q 2 q 0 ) 2(q 1 q 2 q 3 q 0 ) q 2 0 q 2 1 + q 2 2 q 2 3 2(q 2 q 3 + q 1 q 0 ) 2(q 1 q 3 + q 2 q 0 ) 2(q 2 q 3 q 1 q 0 )

q 2 1 q 2 2 + q 2 3 + q = (q 2 0 q T q)1 + 2qq T 2q 0 Q (3.20)
where:

Q = 2 6 6 6 6 4
0 q 3 q 2 q 3 0 q 1 q 2 q 1 0 3 7 7 7 7 5 (3.21)
Given the direction cosine matrix, quaternions can be calculated as:

q = 2 6 6 6 6 4 q 1 q 2 q 3 3 7 7 7 7 5 = 1 4q 0 2 6 6 6 6 4
C 23 C 32 C 31 C 13 C 12 C 21 3 7 7 7 7 5
q 0 = ± 1 2 (1 + C 11 + C 22 + C 33 ) 1 2
(3.22)

Attitude parametrization selection

In 1776, Euler showed that SO(3) has three dimensions [START_REF] Stuelpnagel | On the parametrization of the three-dimensional rotation group[END_REF]. Representations with more than three parameters are subject to constraints. Also, [START_REF] Stuelpnagel | On the parametrization of the three-dimensional rotation group[END_REF] states that no parameter set can be both global and nonsingular. So, we are faced with choosing the representation parameters as either singular or redundant. Euler angle representation has its advantages, such as having a clear physical interpretation and minimum parameter set achieving no redundancy. However, due to their important disadvantage, that is, the possibility of having singularities when describing motion, Euler angles are not selected to represent attitude in this study. Another attitude parametrization, the Gibbs vector, is not often used, and can be thought of as an interval step on the way to quaternion parametrization. There are other representation types, which are not often preferred, such as the axis-azimuth representation, which will not be discussed in this thesis [7]. Quaternion (Euler symmetric parameters) representation will be used in this study due to its advantageous nature in simulations, and having no singularities. Another advantage of quaternions is that the kinematic equations are linear in terms of quaternions. Also, quaternion multiplication offers a useful way to express composite rotations. With all of these preferable properties, quaternions are the choice for attitude representations for many attitude control missions. Table 3.1

shows a brief comparison of attitude representations [7].

In the previous sections, a variety of parameters to represent rotations are identified and the inherent properties of each technique have been examined. Now we examine how to represent attitude depending on time; namely the equations of motion.

Equations of motion are generally presented in two sections: the kinematic equations the time derivative of the attitude representation and the angular velocity, while the dynamic (or kinetic) equations describe the development of angular velocities under the influence of external moments.

Attitude kinematics

The time evolution of attitude is identified by a set of first order differential equations called the kinematic equations. The angular velocity of a reference frame B with respect to a reference frame A given in the B frame, can be written as follows:

! B/A B = ! 1 b 1 + ! 2 b 2 + ! 3 b 3 (3.23)
Recalling Eq. 3.3 and orthonomality property in Eq. 3.4: If the skew-symmetric matrix can be represented as ⌦:

+ h C B/A B i T 2 6 6 6 6 4 ! ⇥ b 1 ! ⇥ b 2 ! ⇥ b 3 3 7 7 7 7 5 = h ĊB/A B i T 2 6 6 6 6 4 b 1 b 2 b 3 3 7 7 7 7 5 + h C B/A B i T 2 6 6 6 6 4 0 ! 3 ! 2 ! 3 0 ! 1 ! 2 ! 1 0 3 7 7 7 7
⌦ = 2 6 6 6 6 4 0 ! 3 ! 2 ! 3 0 ! 1 ! 2 ! 1 0 3 7 7 7 7 5 (3.26)
and if we rearrange the terms as such: implies:

 h ĊB/A B i T h C B/A B i T ⌦ 2
 h ĊB/A B i T h C B/A B i T ⌦ = 0 (3.28)
Taking the transpose and using the relationship ⌦ T = ⌦, the kinematic differential equation for the direction cosine matrix can be written as:

ĊB/A B + ⌦C B/A B = 0 (3.29)
Angular velocity components, given in the B reference frame, can be written as:

! 1 = Ċ21 C 31 + Ċ22 C 32 + Ċ23 C 33 ! 2 = Ċ31 C 11 + Ċ32 C 12 + Ċ33 C 13 ! 3 = Ċ11 C 21 + Ċ12 C 22 + Ċ13 C 23 (3.30)
From that point, derivation depends on the attitude parameters used. When the direction cosines and their derivatives are substituted with their equivalents in terms of Euler angles, the result will give the time dependence of Euler angles. In this study however, due to reasons already discussed, quaternions are selected to represent the attitude, so the direction cosines will be written in terms of quaternions:

! 1 = 2( q1 q 0 + q2 q 3 q3 q 2 q0 q 1 ) ! 2 = 2( q2 q 0 + q3 q 1 q1 q 3 q0 q 2 ) ! 3 = 2( q3 q 0 + q1 q 2 q2 q 1 q2 q 3 ) (3.31)
The fourth equation comes from the differentiation of the quaternion norm constraint:

0 = 2( q0 q 0 + q1 q 1 + q2 q 2 + q3 q 3 ) (3.32)
Writing in matrix form: q 0 q 1 q 2 q 3 q 1 q 0 q 3 q 2 q 2 q 3 q 0 q 1 q 3 q 2 q 1 q 0 q 0 q 1 q 2 q 3 q 1 q 0 q 3 q 2 q 2 q 3 q 0 q 1 q 3 q 2 q 1 q 0

0 ! 1 ! 2 ! 3 ! 1 0 ! 3 ! 2 ! 2 ! 3 0 ! 1 ! 3 ! 2 ! 1 0 3
q 0 q 1 q 2 q 3 3 7 7 7 7 7 7 7 5 (3.34)
In a more compact form:

q0 = 1 2 q T ⌫ ! B/A B q⌫ = 1 2 ⇣ q ⇥ ⌫ + q 0 I 3 ⌘ ! B/A B (3.35)
where:

x ⇥ = 2 6 6 6 4
0 x 3 x 2 x 3 0 x 1 x 2 x 1 0 3 7 7 7 5 (3.36)
Finally the kinematic equations of motion for the aircraft in Eq. 3.34 (first equation q 1 q 2 q 3 q 0 q 3 q 2 q 3 q 0 q 1 q 2 q 1 q 0

Attitude dynamics

The equation describing the rotational motion of a rigid body moving relative to an inertial frame can written as [START_REF] Wie | Space vehicle dynamics and control[END_REF]:

Z r ⇥ Rdm = M 0 (3.38)
Here, the rotation of the rigid body takes place about an arbitrary point O. Let us take an infinitesimal mass element dm. In Fig. 3-3, r is the position vector of dm relative to O, R is the position vector of dm relative to the origin of the inertial frame, R is the acceleration of dm, and M 0 is the total external torque about point O. Now, let us take a body fixed frame B with the origin at the center of mass of the rigid body, as shown in Fig. 34. In Fig. 34, ⇢ is the position vector of dm mass . It represents the angular velocity of the body frame B with respect to inertial frame N given in the body frame B. Angular momentum vector H of a rigid body about its center of mass is given by :

H = Z ⇢ ⇥ Ṙdm (3.39)
Since R C is constant:

Ṙ = ṘC + ⇢ = ⇢ (3.40)
and from rigidity of the body:

⇢ ⌘ ⇢ d⇢ dt N = ⇢ d⇢ dt B + ! ⇥ ⇢ = ! ⇥ ⇢ (3.41)
Then, the angular momentum is given as:

H = Z ⇢ ⇥ Ṙdm = Z ⇢ ⇥ ⇢dm = Z ⇢ ⇥ (! ⇥ ⇢)dm (3.42)
The components of ⇢ and ! in the body frame B are written as:

⇢ = ⇢ 1 b 1 + ⇢ 2 b 2 + ⇢ 3 b 3 ! = ! 1 b 1 + ! 2 b 2 + ! 3 b 3 (3.43)
Then, the angular momentum can be written as:

H = H 1 b 1 + H 2 b 2 + H 3 b 3 (3.44)
where

H 1 = I 11 ! 1 + I 12 ! 2 + I 13 ! 3 H 2 = I 21 ! 1 + I 22 ! 2 + I 23 ! 3 H 3 = I 31 ! 1 + I 32 ! 2 + I 33 ! 3 (3.45)
Writing in matrix form gives: and in a compact form:

H = I! (3.47)
where I is called the inertia matrix of the rigid body about a body fixed reference frame B with the origin at the center of the mass of the rigid body.

Let us write a set of axes to achieve all the products of inertia, or all of the elements of the inertia matrix except diagonal elements, are zero. This set is called the principal axes and the moments of inertia are called the principal moments of inertia. Assuming the axes of the body reference frame B are the principal axes, then the equation for the angular momentum becomes: Now, we express the rotational equations of motion -also known as Euler's equations of motion -for a rigid body. Remember the angular momentum equation:

M = Ḣ (3.49)
where H is the angular momentum vector of the rigid body about its center of mass and M is the external moment acting on the rigid body about its center of mass. We can also write it as:

Ḣ = ⇢ dH dt N = ⇢ dH dt B + ! B/N B ⇥ H = M (3.50)
By taking the time derivative of Eq. 3.47, assuming the inertia is not dependent on time, and evaluating in Eq. 3.50, Euler's rotational equation of motion can be written as:

!B/N B = I 1 B (M B ! B/N B ⇥ I B ! B/N B ) (3.51)

Translation modeling

The movement of any object can be represented by changes in its location (translation)

or changes in its attitude (rotation), or a combination of both. Studying aircraft motion is complicated since those two motions are coupled; for example, a rotation might cause a change in aerodynamic forces which affects the translation. Thus, to ease the modeling process, the aircraft is assumed to be a point mass, with all of its mass collected at its center of gravity, while it translates from one point to the other.

Then, the motion of the that point (at its center of gravity) is described by Newton's laws of motion. The translations are in direct response to external forces, namely the lift, drag, thrust, and weight. Unfortunately, some of these forces depend on the attitude of the aircraft.

Translational kinematics

The time change of the position of the aircraft x N expressed in the navigation frame can be written in terms of translational velocity v B , expressed in the body frame as:

ẋN = d dt x N = d dt C N B x B = ĊN B x B + C N B ẋB = C N B v B (3.52)
using x B = 0. Eq. 3.52 can also be written as : where, v B = [u v w] T is the inertial velocity of the center of mass of the body expressed in the body frame B and ẋN = [ ẋn ẋe ẋd ] T is the ground speed vector expressed in the navigation frame N . N is assumed to be a local inertial frame. C N B is the direction cosine matrix which transforms a vector expressed in the body frame to its equivalent expressed in the navigation frame N .

Translational dynamics

The aircraft is assumed to be a point mass, with all of its mass collected at its center of gravity while it translates from one point to an other. Then, the motion of that point is described by Newton's laws of motion. The translations are in direct response to external forces, namely the lift, drag, thrust, and weight. From now on, the aircraft will be assumed to be flying over a small region compared to size of the Earth, so that the Earth is locally flat to neglect centripetal acceleration (due to the Earth's curvature). Another assumption is that the frame attached to the Earth is an inertial frame, by ignoring Coriolis acceleration, so that Newton's laws apply:

X j F j = d dt mv I (3.54)
Unfortunately, those forces that directly effect the translation depend on the attitude of the aircraft, complicating the dynamics.

Here, the subscript I represents the frame in which the time derivation occurs, which is an inertial frame in this case. To represent time derivation in the inertial frame in terms of time derivation in body frame, the relative rotation of the body frame with respect to the inertial frame should be included, such that:

d dt mv I = d dt mv B + ! B/I ⇥ mv (3.55)
Substituting Eq. 3.55 in Eq. 3.54 and then projecting the vector variables in the body frame, as well as assuming that mass is constant, gives:

1 m ✓ X j F B j ◆ = d v B dt B + ! B/I B ⇥ v B (3.56)
Writing the summation of forces in terms of the forces acting on the aircraft :

1 m ⇣ mg B + F thrust B + F aero B ⌘ = 2

Drone model

The calculation of aerodynamic forces and moments that are necessary to solve the equations of the motion of a drone are given in this section. During the course of this research, two kind of drones have been simulated : a drone from ETH university [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF] and MAKO (used in ENAC drone lab) given in Fig. 3456. ETH drone has two ailerons, two elevators and a rudder as its control surfaces, while MAKO has only two control surfaces: elevons. An example of an elevon can be seen in the schematic of Zagi given in Fig. 345. Changed in the same direction, elevons are used as an elevators (which change the pitch), while when changed in the reverse direction they act as ailerons (they change the roll).

First, to calculate the moments of inertia of MAKO, it is hanged from two strings, at different orientations, as shown in Fig. 34567, and the measurements are performed by timing the oscillation period for each axis. The resultant moment of inertias are given Table 3.2.

I xx 2.56 [kg • m 2 ] I yy 10.9 [kg • m 2 ] I zz 11.3 [kg • m 2 ] I zx 0.5 [kg • m 2 ] I xz 0.5 [kg • m 2 ]

Modeling of aerodynamic moments

The attitude of the aircraft changes with the torques applied to the airframe: Here, L b is the roll torque, M b is the pitch torque, and N b is the yaw torque given in body frame shown in Fig. 345.

M B = 2
The stability derivatives required to calculate the moments are given under Table 3.4 for ETH drone and under Table 3.5 for MAKO. The values for the ETH drone are taken from [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF] while for MAKO they are calculated via AVL. AVL is an open source program developed at MIT, and uses the vortex-lattice method for the aerodynamic and stability calculations. The output of the program is linearized at a selected trim condition, therefore all of the coefficients are calculated around the equilibrium point at 14m/s cruise flight condition. The center of gravity is located at X CG = 0.295 m, which corresponds to 8 % of the positive static margin that has been flight tested.

Roll torque

Roll torque is given as a multiplication of dynamic pressure q, wing surface area S, wingspan b, and dimensionless roll torque C L as :

L B = q S b C L (3.60)
Here, the dynamic pressure is calculated as :

q = ⇢V 2 T 2 (3.61)
while the air density ⇢ is given by the international standard atmosphere model for low altitude (<11000m) as :

⇢ = p 0 h 1 + ah T 0 i 5.2561 R T (3.62)
where the temperature T is given as:

T = T 0 h 1 + ah T 0 i (3.63)
with T 0 = 288.15K, a = 6.5

⇥ 10 3 K/m, R = 287.3 m 2 K 1 s 2 and p 0 = 1013 ⇥ 10 2 Nm 2 .
Next, we calculate the dimensionless roll torque in Equ. 3.60. For ETH drone, it is given by [START_REF] Stevens | Aircraft control and simulation: dynamics, controls design, and autonomous systems[END_REF][START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF][START_REF] Reinhard | Guidance and control for aerobatic maneuvers of an unmanned airplaine[END_REF] :

C L = C L a1 a1 + C L a2 a2 + C L e1 e1 + C L e2 e2 + C L p p + C L r r + C L (3.64)
For MAKO, the dimensionless roll torque is given by : Here, b is the wingspan, p, q are angular rates and V T is the norm of the airspeed vector such as :

C L = C La a + C L p p + C L r r + C L (3.
V T = q u 2 T + v 2 T + w 2 T (3.68)
Airflow acting on the aircraft is described by airspeed vector V T (see Fig. 345678).

The wind frame is shown in Fig. 3-8 with axes (x w , y w , z w ) where x w points along the airspeed vector V T . Airspeed vector, in terms of its components in body frame and in wind frame, can be given as: The relationship between V T B and V T W can be written as [START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]:

x b V T y b z b O b W v
V T B = C B W V T W (3.70)
Note that the inertial velocity of the aircraft v

B = [u v w] T is different to the airspeed vector V T B = [u T v T w T ] T .
Those two vectors are related to wind velocity W by :

v = V T + W (3.71)
When these vectors are projected on to body frame, the relation becomes:

v B = V T B + C B N W N (3.72) 90
and with components :

Pitch torque

Pitch torque is given as a multiplication of dynamic pressure q, wing surface area S, mean aero chord c, and dimensionless pitch torque C M as :

M B = q S c C M (3.74)
where the dimensionless pitch torque is given as for the ETH drone as :

C M = C M 1 + C M a1 a1 + C M a2 a2 + C M e1 e1 + C M e2 e2 + C M q q + C M↵ ↵ (3.75)
and for MAKO :

C M = C M 0 + C Me e + C M q q + C M↵ ↵ (3.76)
where the variables not introduced up to now are the dimensionless roll rate q,

elevator deflection e and angle of attack ↵. Angle of attack ↵ is defined as the angle between the projection of the airspeed vector V T onto the x b z b plane and x b axis as can be seen in Fig. 345678, and calculated as :

↵ = arctan ⇣ w T u T ⌘ (3.77)

Yaw torque

Yaw torque can be given as:

N B = q S b C N (3.78)
with a dimensionless yaw torque for the ETH drone :

C N = C N r r + C N r r + C N (3.79)
and for the MAKO :

C N = C N 0 + C Na a + C N p p + C N r r + C N (3.80)
where q is the dynamic pressure, V T is the total airspeed of the aircraft, ⇢ is the air density, S is the wing total surface, b is the wing span, and c mean aerodynamic wing chord.

Modeling of aerodynamic forces

The position of the aircraft changes with the forces applied to the airframe. The calculation of aerodynamic forces, lift force, drag force, lateral force, and thrust force are given below.

Lift force

The lift force is given in the wind frame as :

Z w = q S C Z (↵) (3.81)
where the dimensionless lift coefficient is calculated as:

C Z (↵) = C Z 0 + C Z↵ ↵ (3.82)

Drag force

Drag force in the wind frame is calculated as a multiplication of the dynamic pressure, wing surface area, and the drag coefficient as given in Equ. 3.83 :

X w = q S C X (↵, ) (3.83)
where the dimensionless drag coefficient for ETH drone is given as :

C X (↵, ) = C X 1 + C X↵ ↵ + C X ↵2 ↵ 2 + C X 2 2 (3.84)
While for MAKO, the drag force is given by [16] :

X w = q S C Z (↵, ) (3.85)
and the dimensionless drag coefficient for MAKO [16] :

C X (↵) = C X 0 + C X k C 2 Z = C X 0 + C X k (C Z 0 + C Z↵ ↵) 2 (3.86)

Lateral force

The lateral force is given as :

Y w = q S C Y ( ) (3.87)
where the dimensionless lateral coefficient for ETH drone is given as :

C Y ( ) = C Y (3.88)
and for MAKO :

C Y ( , p, r, a ) = C Y + C Y p p + C Y r r + C Ya a (3.89)
where the coefficients can be seen in Tables 3.6 and 3.7.

Thrust force model

The thrust generated by the propeller can be written as : where the dimensionless thrust coefficient for ETH drone is calculated as :

F T = ⇢n 2 D 4 C F T (3.90)
C F T = C F T 1 + C F T 2 J + C F T 3 J 2 (3.91)
Here, J is the advance ratio, and for ETH drone, it is given by:

J = V T n⇡D (3.92)
The dimensionless thrust coefficient for MAKO is given by [15] :

C F T = C F T 1 + C F T 2 • J 0 + C F Trpm • n • 60 (3.93)
with advance ratio :

J 0 = V T nD (3.94)

Shortcut to modeling

After the derivation of the aircraft flight kinematics and dynamics for translational and attitude motion, the system of first order differential equations can be summarized as follows :

ẋN = C N B v B vB = 1 m ⇥ mg B + F t B + F a B ⇤ ⇥ ! B/N B ⇤⇥ v B q0 = 1 2 q T ⌫ ! B/N B q⌫ = 1 2 ⇣ q ⇥ ⌫ + q 0 I 3 ⌘ ! B/N B J !B/N B = M B ⇥ ! B/N B ⇤⇥ J! B/N B (3.95)
where x N 2 IR 3 is the position of the center of mass of UAV in the navigation frame N , v B is the velocity of the center of mass of UAV in the body frame B, q = [q 0 , q T v ] T 2 IR 3 ⇥ IR is the unit quaternion representing the attitude of the body frame B with respect to navigation frame N expressed in the body frame B,

! B/N B
is the angular velocity of the body frame B with respect to navigation frame N expressed in the body frame B, J 2 IR 3⇥3 is the positive definite inertia matrix of the drone, M B 2 IR 3 represents the moments acting on the drone, C N B is the direction cosine matrix which transforms a vector expressed in the body frame to its equivalent expressed in the navigation frame N , I 3 2 IR 3⇥3 is the identity matrix, F t B 2 IR 3 is the thrust force expressed in the body frame and, F a B 2 IR 3 are the aerodynamic forces given in the body frame B. The navigation frame is assumed to be a local inertial frame in which Newton's Laws apply. The notation x ⇥ for a vector x = [x 1 x 2 x 3 ] T represents the skew-symmetric matrix, as given in Equ. 3.36.

Sensor Models

Accelerometer and gyro measurements are simulated using the angular velocity ! The accelerometer and gyro data is simulated as:

z gyro = k gyro ! B B/I + gyro + ⌘ gyro (3.96) z acc = k acc ! B B/I + acc + ⌘ acc (3.97)
where is the bias, and ⌘ is the zero mean Gaussian process with 2 variance with values given in Table 3.10.

Fault Models

Probable faults in the control surfaces can be grouped under two main categories When the actuators are healthy, actual control input signal will be equal to the given input signal. In case of a fault, the actual signal can be modeled as:

u (t) = Eu c + u f (3.98)
where u c is the desired control signal, E = diag(e 1 , e 2 , e 3 ) is the effectiveness of the actuators where 0  e i  1 with (i = 1, 2, 3) and u f additive actuator fault. This model makes it possible to simulate all four types of actuator faults shown in Fig. 3-10.

Conclusion

In this chapter, equations of motion of an aircraft are given. The motion of an aircraft usually involves both translation and rotation. Here, equations for translational and rotational motion are discussed separately and in detail. After the equations are derived for a generic aircraft, the calculation of forces and moments, which are specific Since the data is generated and now available for implementation, the methodology used in this thesis to diagnose faults is discussed in the next chapter. In this thesis, Support Vector Machines (SVM) are used as a classification method to diagnose faults on board a drone. Since SVM is a machine learning method, an introduction to machine learning methods is provided from an implementation perspective. We start with an introduction to the terminology for machine learning methods, and provide a general explanation to prepare the inputs to the machine learning algorithm. Next, Chapter 4

Methodology

In this chapter, an introduction to machine learning methods is presented. Machine learning methods is discussed with a focus on applications. Finally, a supervised learning method, Support Vector Machines (SVM), is explained as it is the method used for classification in this thesis.

Machine Learning

The aim of machine learning methods is to train a model with a given data set in order to predict the output values corresponding to a new input. According to Arthur Samuel, who coined the term machine learning, "Machine learning is the field of study that gives computers the ability to learn without being explicitly programmed".

Another definition offered by Tom Mitchell in 1998, relatively new compared to the definition by Samuel in 1959, is stated as: "A computer program is said to learn from experience E with respect to some task T and some performance measure P, if its performance on T, as measured by P, improves with experience E".

Introduction

Machine learning methods are covered under two main categories: supervised and unsupervised learning, as shown in Fig. 4-1. the available data to understand how the system behaves. In the second phase, the idea is to predict what the output of the system for a given input will be, depending on the knowledge about the system that is gained via the learning phase.

The most common types of supervised learning are the regression and classification problems. Since these are both supervised learning types, the "right answer" (right values of the output y) for each example is assumed to be known.

In unsupervised learning, the "right answers" corresponding to the training input are not available. There are other machine learning algorithms, such as reinforcement learning, that are a combination of supervised and unsupervised learning.

Terminology

A basic introduction to frequently used terms in machine learning is provided in this section.

y (i) m x (m) y (m)
Many of the machine learning tools, such as MATLAB Statistics and Machine Learning Toolbox or Tensorflow, have default settings which make them easier for beginners to use. Although they would most probably not achieve optimized results (as would be the case in the hands of an experienced user), a beginner can easily start using these tools by sending input and output vectors as arguments to the machine learning functions.

The configurations of input and output vectors to feed the learning algorithms may change from one to the other, but there is still a common convention that would be compatible with many. In this representation, each instance is given in different rows of the input vector. An example of predicting housing prices taken from Ref. [START_REF] Ng | Lecture notes in machine learning[END_REF] is provided to show the way in which to constitute the input and output matrix.

Table 4.2 uses a supervised learning regression example to show input and output vector representations. The aim of the problem in this example is to predict the prices of houses for a given the surface area. For that, known examples of houses with a surface area and corresponding price are given. Since the aim of the problem is to predict the price of a house given the surface area, the price of the house is the output of the problem. To predict the price, the available information that is known to effect the price of the house is the surface area of the house, making it the input variable. So, in Table 4.2, each row corresponds to a different house, the second column (surface area of house) constitutes the input vector and the last row (price in $1000s) corresponds to the output vector.

In this problem, there is an assumption that the price of a house is only dependent

(i) 2 ) Feature j (x (i) j ) Feature n (x (i) n )
Price in 1000$s (y)

1 2104 5 x (1) j x (1)
n 460 2 1416 3 x (2) j x (2)
n 232 3 1534 3 x (3) j x (3)
n 315 4 852 2 x (4) j x (4)
n 178 . . .

x (i) 1 x (i) 2 x (i) j x (i) n y (i) m x (m) 1 x (m) 2 x 2 j (m) x (m) n y (m)
on the surface area which does not hold in the real case. In real problems, it is more common that the output would not depend on only one variable but on many variables. For this reason, the input vector in a realistic example would more likely be an input matrix having different features in its columns, as given in Table 4.3.

Here, in this example, the output is still the price of the house, but now the features which correspond to each column of an input matrix (or sometimes called the feature matrix) are the surface area, the number of bedrooms, and can be enlarged up to a chosen number of features. It should be kept in mind that the selection of features that would lead to a better prediction of the output is a challenging problem, and would usually require some considerable experience on the system of interest.

Steps towards the learning machine

Visualizing the data A preliminary investigation of data may give the designer an idea about the ways in which to tackle a problem, since it is the designer who selects the features, the model and the type of cost function. It is true that the algorithms are optimizing some parameters of the model and the cost function but the structure itself is still usually supplied by a human. 4.2. In this example, house prices are the output (target) variable given in y-axis and size (surface area in feet 2 ) is the feature (input) variable given in x-axis. Since the output y is the price which is a continuous value (thus not a label representing a class), this problem is called a regression problem. Plotting the given data, shows that the problem could be modeled by a linear model (a linear line to fit the data given). Then, linear regression can be applied.

Since an example of a regression problem has been given above, we now take a preliminary look at the classification problem. Fig. 4-4 presents a classification problem, since the aim is to distinguish the class that a new input instance will belong to. Here, the vertical dimension is not the output, as in the previous example of linear regression, but is another feature (x 2 in this example).

The information about the output is represented by the colors of the samples in the feature space. Fig. 4-5 shows the output vs. inputs of a classification problem. With an increasing number of features, determining the degree of the polynomial via visualizing the data to represent the input/output relationship could be more complicated. In this case, the user should refer to model selection techniques rather than the insights gained by data visualization.

Feature Mapping

Depending on the results from visualizing data, it may be necessary to map the features, since a straightforward implementation of linear/logistic regression may result The housing price prediction problem can be revisited here to provide an example of feature mapping. The data given in Table 4.2 and plotted in Fig. 4-3 is a regression problem with one feature (surface area of house). To fit more accurately to the training data given, new features can be artificially added to the system as below, where the new features will be functions of the original feature:

h ✓ (x) = ✓ 0 + ✓ 1 x 1 + ✓ 2 x 2 + ✓ 3 x 3 = ✓ 0 + ✓ 1 (size) + ✓ 2 (size) 2 + ✓ 3 (size) 3 (4.1)
where:

x 1 = size x 2 = size 2 x 3 = size 3 (4.2)
By changing the model via adding features, it is now possible to fit a nonlinear Another example that requires a nonlinear model to fit the data set is the microchip assessment problem. This example is taken from the lecture notes of a machine learning course by Andrew Ng [68]. This is a two-class classification problem, where one class of microchips is faulty while the other class is functional. It is seen from the Fig. 4-6 that a linear decision boundary will not appropriately serve to classify the data. So, in order to apply logistic regression for this problem, feature mapping is necessary. An example of a mapped feature vector that could provide a satisfactory decision boundary to classify the two classes could be given as:

x mapped = h 1 x 1 x 2 x 2 1 x 1 x 2 x 2 2 x 3 1 • • • x 1 x 5 2 x 6 2 i T (4.3)
Mapping of the features could be done in various ways. We now take another example of a binary (two-class) classification problem with 100 features, which needs a nonlinear decision boundary to achieve a satisfactory classification. One way to map

O X X X X X X X X X X X X X X X X X X X X X X X X X X X X X O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O X X X X X X X X X O x 2 x 2 x 1 x 1 X Figure 4-7:
Classification example of complex decision boundaries the feature set could be such that only the quadratic terms are taken into account, which would result in a new feature set such as:

x mapped = h x 2 1 x 1 x 2 x 1 x 3 • • • x 1 x 100 x 2 2 x 2 x 3 • • • x 2 3 x 3 x 4 • • • i T (4.4) with a complexity O(n 2 ) ⇠ n 2 2 .
If 3 rd order terms are considered, the new feature set becomes:

x mapped = h x 3 1 x 1 x 2 x 3 x 2 1 x 2 • • • x 11 x 13 x 17 • • • i T (4.5)
It is important to point out that, with a higher dimensional feature vector, the model will tend to fit more accurately with the training set but may generalize poorly to new input. This is called overfitting, which is a common problem for many machine learning applications. Further explanation about overfitting and ways to overcome it will be offered in the regularization section. Increasing the dimensionality of the features, the model might also become computationally more expensive.

To fit a model or decision boundary of a circular or elliptical shape, only a subset of features can be considered, such as:

x mapped = h x 2 1 x 2 2 x 2 3 • • • x 2 N i T (4.6)
Finally, when the number of features are small, but cannot fit complex models or boundaries, such as in Fig. 4-7, then the addition of higher terms such as those given in Equ. 4.4 or the use of Neural Networks should be considered. A scheme to help select the strategy for mapping is given in Fig. 45678.

Vectorized form of the problem

The model can be written in a vectorized form in order to accommodate the larger number of features in a more compact form. To write in compact form, an extra feature x 0 = 1 is added to the feature vector, such as:

x = h x 0 x 1 x 2 • • • x n i T (4.7)
Fig. 4-9 shows the addition of the artificial feature in the feature matrix.

Also, parameters of the model are given in vectorial form, such as:

✓ = h ✓ 0 ✓ 1 ✓ 2 • • • ✓ n i T (4.8)
So, for the linear regression problem with a single feature, the model is given as:

h ✓ (x) = ✓ 0 + ✓ 1 x 1 (4.9)
and the model for n features:

h ✓ (x) = ✓ 0 + ✓ 1 x 1 + ✓ 2 x 2 + • • • + ✓ n x n (4.10)
Introducing the vectorial forms of x and ✓ enables the model to be written in a compact generic form, such as:

h ✓ (x) = ✓ | x (4.11)

Cost Function

To calculate ✓ that will fit a better model with the training data, optimization algorithms are used to minimize the cost function J(✓). Usually, the cost function and its gradient are given to the optimization algorithm as an input. Here, widelyused cost functions for linear regression (regression problem) and logistic regression (classification problem) are given.

The cost function for linear regression can be given as:

J(✓) = 1 2m m X i=1 ⇣ h ✓ (x (i) ) (y (i) ) ⌘ 2 (4.12)
and the cost function for logistic regression (classification) is given for a two-class classification problem (e.g y 2 {0, 1}) as:

J(✓) = 1 m m X i=1 h y (i) log(h ✓ (x (i) )) (1 (y (i) ))log(1 h ✓ (x (i) )) i (4.13)

Selecting the model

With a larger set of features, it may be difficult to have a sense of which model would be a better fit for a particular problem. In these cases, model selection techniques could be applied to decide which model will yield better accuracy.

To explain the procedure, first assume a model structure is already selected or

given. In such a problem, during the training process, training data is used to calculate the best model parameter vector ✓ that would minimize the objective function,

J tranining (✓).
The the trained model is then assessed with a new independent data set J test to evaluate the overfitting biases favoring the training data and avoid an over-optimistic view of the abilities of the learning algorithm.

In the model selection technique, each model is represented by a number d as shown below:

d = 1, h ✓ (x) = ✓ 0 + ✓ 1 x ! ✓ (1) ! J cv (✓ (1) ) d = 2, h ✓ (x) = ✓ 0 + ✓ 1 x + ✓ 2 x 2 ! ✓ (2) ! J cv (✓ (2) ) d = 3, h ✓ (x) = ✓ 0 + ✓ 1 x + ✓ 2 x 2 + ✓ 3 x 3 ! ✓ (3) ! J cv (✓ (3) ) . . . d = k, h ✓ (x) = ✓ 0 + ✓ 1 x 1 + • • • + ✓ k x k ! ✓ (k) ! J cv (✓ (k) )
In the previous problem of a given model structure, only the model parameter ) once minimized is selected and its generalized error is calculated with the test set J test (✓ (d)

). Fig. 4-10 summarizes the steps to be followed, which are explained in more detail as:

1. Train the model for each model structure (d = 1,2,3 .. k) by using the training set (60% of all data, randomly selected) which will output the parameters ✓ (d) for the corresponding model (d). This phase is explained in more detail in the section Calculating parameters ✓, however briefly, the general idea is to calculate the ✓ that will minimize the cost function J training given as:

J training (✓) = 1 2m training m training X i=1 ⇣ h ✓ (x (i) training ) (y (i) training ) ⌘ 2 (4.14)
2. Then, by using the cross validation data set (20% of all data, randomly selected) calculate cross validation error for each model and select the model with the smallest cross validation error:

J cv (✓) = 1 2m cv mcv X i=1 ⇣ h ✓ (x (i) cv ) (y (i) cv ) ⌘ 2 (4.15)
3. Then, by using the test set (20% of all data, randomly selected) the generalized error is estimated for the selected model:

J test (✓) = 1 2m test mtest X i=1 ⇣ h ✓ (x (i) test ) (y (i) test ) ⌘ 2 (4.
(i)) i = 1, ... m test 1 1 3 3 3 4 J cv (✓ ( 1
)
)

J cv (✓ ( 2
)
)

J cv (✓ (d)
) Although there are different methods for normalization, a common method is to use this formula:

xj = x j µ j s j (4.17)
where the mean µ j and range s j are given by:

µ j = m P i=1 x i j m s j = max(x j ) min(x j ) (4.18)
An important point is to keep values µ j and s j (or standard deviation in the cases it is preferred instead of range s j ) which are calculated during training. These values are saved since they will also be used to scale the new inputs during the prediction phase.

Training and evaluation of the Classifier

Here, it is assumed that we have selected one model and we train the parameters of only this selected model. If multiple models are to be evaluated, this training phase will be applied to all different models. Then, the selection of the best model should be done, as already explained under Selecting the model section.

Before the training phase, the data should be split into two parts: training and test sets. Then, the parameters ✓ are learnt using the training data. Finally, the trained classifier is evaluated by calculating the test set error using the test set. Those steps are given in more detail as follows:

1. Split the data set to two parts (30% for the test set and 70% for the training set). Note that if the data set is randomly ordered, the first 70% can be used for training and the rest for testing, but if the data is not randomly ordered (data is time dependent or if there is any correlation), the percentage of the data set for traing should be randomly selected between 30% and 70%;

2. Allow the model to learn the parameters ✓ from the new training set (70% of the whole data set). This step is further explained under Calculating parameters ✓ section;

3. Calculate the test set error by using the test set (30% of all data) with the parameters learnt by using the training set (70% of all data).

For linear regression, the test set error is the cost function evaluated by the test set (x test (i), y test (i)) pairs and the parameters trained by using the training set (x train (i), y train (i)) and can be given as:

J test (✓) = 1 2m test mtest X i=1 ⇣ h ✓ (x (i) test ) (y (i) test ) ⌘ 2 (4.19)
For logistic regression, the test set error is given as:

J test (✓) = 1 m test mtest X i=1 h y (i) test log( h ✓ ( x (i) test ))+(1 (y (i) test )) log( h ✓ ( x (i) test )) i (4.20)
Sometimes the misclassification error (between 0 and 1), given in Equ. 4.21, is used instead of Equ. 4.20:

test error = 1 m test mtest X i=1 ⇣ err( h ✓ ( x (i)
test ), (y

(i) test ) ⌘ (4.21)
where the error function is given as:

err(h theta (x), y) = 8 > < > : 1 if h ✓ 0.5, y = 0 or if h ✓ < 0.5, y = 1 0 otherwise (4.22)
Fig. 4-11 visualizes and summarizes the procedure explained above.

Calculating parameters ✓

The cost function is minimized to calculate the best ✓ with the use of optimization algorithms. To fit the parameters ✓, we will try to find those that minimize the cost function J(✓):

✓ min J(✓) (4.23)
For the case of a simplified example with one feature, the minimization problem can be written as:

✓ 0 , ✓ 1 min J(✓ 0 , ✓ 1 ) (4.24)
To achieve this minimization problem, there are a variety of algorithms available.

A classical approach is the gradient descent method. Others include but are not limited to, conjugate gradient, BFGS (Broyden-Fletcher-Goldfarb-Shannon) algorithm, and L-BFGS (Limited-memory BFGS). They usually require the cost function, its gradient and the Hessian approximation in order to calculate the best ✓ values.

Gradient Descent

Gradient descent will be presented for one feature problem due to its simplicity.

Here, a linear regression problem is considered, where its hypothesis (model) and cost function is given in Equ. J(✓)

(X test (i), y test (i)) i = 1, ... m test (X test (i), y test (i)) i = 1, ... m test ✓ trained J test (✓) = 1 2m test m test X i=1 ⇣ h ✓ (x (i) test ) (y (i) test ) ⌘ 2 J test (✓) = 1 m test mtest X i=1 h y (i) test log ⇣ h ✓ (x (i) test ) ⌘ + ⇣ 1 (y (i) test ) ⌘ log ⇣ h ✓ (x (i) test ) ⌘i test error = 1 m test m test X i=1 ✓ err ⇣ h ✓ (x (i)
test ), (y

(i) test ) ⌘ ◆ err ⇣ h ✓ (
h ✓ (x) = ✓ 0 + ✓ 1 x 1 J(✓ 1 , ✓ 2 ) = 1 2m m X i=1 ⇣ h ✓ (x (i) ) (y (i) ) ⌘ 2 (4.25)
The gradient descent algorithm for one feature is given as :

Algorithm 1 Gradient Descent for one feature only initialize each grad to zero Learning rate, ↵, gives the gradient descent its step size, so a larger value means a faster convergence. However, note that for a larger alpha, the solution might not converge or even diverge, while too small values might lead the optimization to con- Armigo-Goldstein rule can be used to set ↵.

An important point in the algorithm is to update the ✓ simultaneously. Thus, during one iteration, the same ✓ values should be substituted into h ✓ (x), in order to calculate the next values of ✓ 0 , ✓ 1 .

Overfitting

Overfitting is common for complicated models or decision boundaries with high order polynomial terms such as:

x mapped = h 1 x 1 x 2 x 2 1 x 1 x 2 x 2 2 x 3 1 • • • x 1 x 5 2 x 6 2 i T (4.26)
If the model is suffering from overfitting, the trained model might end up fitting well to the training set, but may fail to generalize to the new data during the prediction phase. This means that the training set error is not a good predictor of how well the model would predict on new examples. with. From left to right, these three regression problem models are underfitted, satisfactory or overfitted. But for problems with more features it might not be that obvious. Sometimes it may not even be possible to plot the model to realize if it is overfit or not. In such cases, methods to detect overfitting should be used. To avoid overfitting, a regularization parameter is used, as explained in the next section.

Regularization

Regularization is practiced in order to avoid overfitting. In regularization, a term is added to the cost function in order to penalize parameters ✓ for being too large (i.e., to make ✓ as small as possible), except for ✓ 0 which is not penalized by convention.

The cost function for linear regression with the added term for regularization is given as:

J(✓) = 1 2m  m X i=1 ⇣ h ✓ (x (i) ) (y (i) ) ⌘ 2 + n X j=1 ✓ 2 j (4.27)
For logistic regression the regularized cost function can be written as (for two-class e.g y 2 {0, 1}):

J(✓) = 1 m m X i=1 h y (i) log(h ✓ (x (i) )) (1 (y (i) ))log(1 h ✓ (x (i) )) i + 2m n X j=1 ✓ 2 j (4.28) 123
Here, the challenge is to find the appropriate value for which serves as a weight between the original part of the cost function and the second part, which penalizes ✓ for being too large. So, it tends to decrease the values of ✓. But if this lambda is too large, then the model converges to:

h ✓ (x) = ✓ 0 (4.29)
since all terms are penalized except ✓ 0 (which is not penalized by convention), such that:

h ✓ (x) = ✓ 0 + H H ✓ 1 x + H H H ✓ 2 x 2 + H H H ✓ 2 x 3 + • • • + H H H ✓ n x n (4.30)
Thus, the model becomes underfitted for large values of , and it should be tuned to acquire the optimal value.

Visualizing error to diagnose over-fit/under-fit problems

To further debug the model, a guide is given in Fig. 4 set size while the cross-validation error is decreasing without leveling off, the problem is more likely to be suffering from overfitting (high variance). Another important signature of an over-fit model is that the training error will be less than the crossvalidation error, and the difference between them would remain significant.

Best practices

After diagnosing the problem as over-fit or under-fit, the following practices are helpful to know.

To fix an under-fit model, it may help to tr:

• adding features;

• adding polynomial features;

• decreasing the regularization term.

To fix an over-fit model, it may help to try:

• adding more training examples;

• decreasing the number of features;

• increasing the regularization term.

Prediction

Finally, for a new set of input data, the output can be predicted using the trained model/classifier. One point to remember is that if scaling is applied to the training set, new data should be scaled as well before being fed to the model/classifier, using the same mean and standard deviation values previously calculated from the training set. After that, h(✓) could be evaluated using optimized ✓ and the scaled new data set x_new_scaled. So, h ✓ (x_new_scaled) gives:

h ✓ (x_new_scaled) = P ⇣ y = 1 | x; ✓ ⌘ (4.31)
which is the probability that y = 1 given x_new_scaled parametrized by ✓.

Support Vector Machines

Introduction

SVM is a relatively new approach for classification, offering promising generalization properties thanks to its foundations on the structural risk minimization principle, while other classifiers (such as logistic regression) usually minimize the empirical risk [START_REF] Steve R Gunn | Support vector machines for classification and regression[END_REF][START_REF] Shen Yin | Study on support vector machine-based fault detection in tennessee eastman process[END_REF]. This advances the capacity of generalization, even with a small number of instances, by reducing the risk of overfitting with properly tuned parameters. It can be applied to nonlinear systems and problems offering a vast number of features.

Since the problem is represented as a convex optimization problem, SVM avoids local minima, to which Neural Networks(NN) are inherently prone.

The aim of SVM is to find an optimal hyperplane maximizing the margin, which is the distance in between the boundaries, by extending them until hitting the first data point, as in Fig. 4-15. These data points that are closest to the hyperplane o p t i m a l h y p e r p l a n e max. margin The aim of SVM is to find an optimal hyperplane maximizing the margin, which is the distance in between the boundaries, by extending them until hitting the first data points (support vectors) (decision boundary) are called the support vectors and are the representatives of the data sets to be used for the decision process. This helps to abruptly decrease the data to handle, enhancing the ability to cope with the curse of dimensionality and reducing the computational complexity.

SVM implements the idea of having confidence in the prediction by using the concept of separating data with a large margin. Some other classification methods, such as logistic regression, output the probability of a new instance belonging to a particular class, thus inherently giving the confidence of the prediction as an output. On the other hand, SVM does only output if the new instance's probability of belonging to a particular class, so does not give its confidence on this decision explicitly. Rather than including this confidence information as an output in terms of probabilities, this information is introduced with the functional and geometric margins. Methods are available for calculating the posterior probabilities, which is the probability that the new measurements belongs to its predicted class [START_REF] Platt | Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods[END_REF].

The training data set includes labeled data where the label can belong to one of two possible cases. This data set is saved in a matrix X 2 IR m⇥n where m, n correspond to number of instances and features, respectively. The label information corresponding to the measurement instances is also fed to the SVM algorithm during the training phase as output vector y 2 { 1, 1}.

The aim of SVM is to find an optimal hyperplane maximizing the margin by solving the optimization problem for non-linearly separable datasets:

min ,!,b 1 2 k!k 2 + C m X i=1 ⇠ i (4.32) s.t. y i (! T x (i) + b) 1 ⇠ i , i = 1, • • • , m (4.33)
⇠ i 0, i = 1, • • • , m (4.34)
Here, the aim is to calculate the parameters ! and b of the hypothesis by minimizing the objective function. In SVM, we drop the convention of denoting the hypothesis as h(x) = ✓ T x and use h !,b (x) = g(! T x + b) where g(z) = 1 if z 0, and g(z) = 1 otherwise. In order to generalize to the non-linearly separable datasets,

⇠

i is introduced in the equation's inequality constraint. Now, in the non-separable case, the functional margins (y i (! T x (i) +b)) of the instances (examples) are permitted to have a value less than 1, different from when the case is separable. In order to ensure that most of the examples still do not violate the boundary, and thus have a functional margin of at least 1, the objective function is also increased by C⇠ i . C is called the box constraint, and usually needs to be tuned to achieve a satisfactory performance.

Introducing the dual form of the optimization problem, the use of kernels (to work efficiently in higher dimensional spaces) is eased. The dual form also allows the use of efficient optimization solvers such as Sequential Minimal Optimization (SMO) [START_REF] Platt | Sequential minimal optimization: A fast algorithm for training support vector machines[END_REF], which is the solver used in this work as well. Conventionally, the training phase of SVM requires the solution of a large quadratic programming (QP) problem.

Especially for a large training set, the computational heaviness of this phase may limit the applicability of SVM to specific problems sets. To overcome this constraint, SMO breaks the QP problem into a series of smaller QP problems which can be solved analytically.

SVM has other options to deal with not linearly separable problems, such as using kernels to map data into higher dimensional feature spaces where they can be separated with a linear hyperplane. Kernels are at the core of efficient SVM classifiers.

A kernel, in general, is defined as:

K(x, z) = (x) T (z) (4.35)
where represents the feature mapping. Usually the original features of the systems are named as attributes while the mapped set are called the features. In other words, maps the attributes to the features. Kernels offer various elegant properties such as computational efficiency. Cleverly selected, SVM classifiers can learn in high dimensional spaces represented by without the need to explicitly find or represent , but instead calculating K(x, z), which might be computationally more efficient.

Application

A binary classifier is used in this work to classify two classes, faulty and nominal.

SVM, being a supervised classification algorithm, has two main phases as shown in Fig. 4-2: training and prediction.

In the training phase, the model learns to fit the labeled data that is fed to the SVM algorithm. The labeled data set is first divided into two portions with percentages of 80% and 20%, where the larger chunk is the training set and the remaining is the test set, respectively. This phase is usually followed with a tuning phase where some of the parameters of SVM are changed. Further, the training set is divided into cross-validation and training sets. The idea to split data is to avoid overfitting. When a model is overfit, it fits very accurately to the data it is trained with but fails to generalize to new data.

This results in a poor prediction performance. To avoid overfitting, which is the main problem of parametric discrimination approaches such as neural networks, parameter

C is tuned to result in an optimal fit with the cross-validation set. Tuning C also gives the user the ability to change the classifier's sensitivity to outliers, since sometimes finding a hyperplane separating all data perfectly is not the favorable option (it may cause overfitting). Then, the final performance of the classifier is tested on the test set.

The classifier with the best performance is selected and then used in the prediction phase. For new data input, the classifier is used to predict which class the new data belongs to.

Training of the classifier

The first step is to normalize the features of the data as shown in Eq. 4.17 in order to make the values of features change within the same order of magnitude. Normalization offers advantages for the optimization algorithm and its convergence rate, during the calculation of model parameters. An important point is to keep the values of the mean and range µ j , s j (calculated with Eq. 4.18) and standard deviation (if it is used instead of range s j ). During the prediction phase, the data should first be scaled with these values attained from training data.

Default settings for SVM binary classification, included in Matlab Statistics and its Machine Learning Toolbox, utilizes SMO for optimization if outlier fractions are not specified during the function call.

Default settings of Matlab's binary SVM classifier fits a linear model, which results in a linear decision boundary. In this study, a Gaussian Kernel, which corresponds to an infinite dimensional feature mapping, is used to map the attributes:

K(x, z) = exp ✓ kx zk 2

Min objective vs. Number of function evaluations

Min observed objective Estimated min objective

Tuning of the classifier

The training phase is usually followed by a tuning phase where some of the parameters of SVM are tuned and the results are compared in order to have the best fit via cross validation set. This is the phase where the parameters of the classifier are fixed to be used in the last phase; prediction.

To avoiding overfitting, which is the main problem of parametric discrimination Finally, as a single metric to evaluate the performance of the classification, the F1 score is defined as:

f 1Score = 2 ⇤ precision ⇤ recall precision + recall (4.39)
The F1 score, indicated as f1Score in the tables throughout this study, is used as the main parameter to evaluate classifiers.

Conclusion

In this chapter, an introduction to machine learning algorithms is presented. Two

Fault detection from simulated flight data

In this section, the model of an aircraft is simulated in Matlab using the equations of motion given in Equ. 3.95. This drone model will not be used for the design of FDD algorithms, but rather to generate data that will be used by the FDD algorithms. After the equations of motion of the drone have been solved numerically, the accelerometer and gyro measurements are simulated based on the statistics of the onboard sensors. This part of the study uses the model of a MAKO drone to simulate the measurements, while the real flights (that will be explained in the forthcoming section) use a ZAGI drone.

For the MAKO simulation, the stability and aerodynamic force coefficients are generated by AVL. The input vector can be written as u (t) 2 IR 3 :

u (t) = h a e n i T (5.1)
Here, a aileron deflection angle is in degrees, e elevator deflection angle is in degrees, and n engine speed is in rev/s.

When the actuators are healthy, the actual control input signal will be equal to the given input signal. In the case of a fault, the actual signal can be modeled as:

u (t) = Eu c + u f (5.2)
where u c is the desired control signal, E = diag(e 1 , e 2 , e 3 ) is the effectiveness of the actuators where 0  e i  1 with (i = 1, 2, 3) and u f is the additive actuator fault. This model makes it possible to simulate all four types of actuator faults shown in Fig. 345678910.

Most of the FDD algorithms are designed considering open-loop systems, ignoring

the probable influence of the controller on the detection performance [START_REF] Pandita | Closed-loop performance metrics for fault detection and isolation filter and controller interaction[END_REF]. Throughout this first section, the system is also open-loop. In this chapter, a step by step approach is followed. In this first section (diagnosis with simulated data), the effect of the controller is ignored, while in the next section (diagnosis with real flight data), diagnosis is achieved alongside a functioning controller.

The code for simulations in this section can be reached in Github1 . First, the measurements are simulated for faulty and nominal flight conditions. An example control input (75% loss of efficiency), could be an actual aileron command of a a = 1 corresponding to a desired d a = 4 . In the simulation, this fault is introduced after 120 s. Actual aileron command and corresponding simulated accelerometer x axis readings can be seen in Fig. 5-1. The measurements are labeled, and an example plot showing simulated measurements in two-dimensional feature space, a

x -a y , is given It is always important to visualize the features to be able to comprehend data structure before applying machine learning algorithms. For that reason, the available observations form the six-dimensional pattern space,

x = h a x a y a z ! x ! y ! z i
can be visualized in pairs, such as in Fig. 5-2. There are further methods used to visualize multidimensional data such as Tours [6,22,23] and the GGobi data visualization system [START_REF] Cook | Interactive and dynamic graphics for data analysis: with R and GGobi[END_REF]. In this work, the dimensionality reduction technique, Principle

Component Analysis (PCA), is utilized for visualization. If briefly explained, the feature vector x 2 IR n is mapped to a lower dimensional space where the new feature set will be represented by z 2 IR k . The final two-dimensional feature set can be plotted to give an idea about the distribution of faulty and nominal measurements' in feature space, as shown in Fig. 5-3.

The aim of machine learning methods is to train a model with a given data set in order to predict the output values corresponding to a new input. A binary classifier This phase is usually followed by a tuning phase, where some of the parameters of SVM are changed and the results with the best fit are compared via cross validation in order to avoid overfitting. The last phase is the prediction, where for a new instance, the classifier predicts whether it corresponds to a faulty or nominal condition.

Training data is comprised of labeled data where the label can belong to one of two possible cases. This data set is saved in X 2 IR m⇥n where m, n correspond to number of instances and features, respectively (shown in Fig. 5-5). to. To investigate the performance of the classifier on the test set, a method [START_REF] Platt | Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods[END_REF] is used to calculate the posterior probabilities given the probability that the new measurements belong to a faulty mode. Results in Fig. 56show that proper tuning achieves very accurate and instant detection of the drone fault.

Fault detection from real flight data

This second section of this chapter discusses the classification results using real flight data. Flight campaigns have been realized in the presence of a safety pilot to recover the drone in the case of loss of control when the faults are injected. A scene from one of the many flight campaigns realized by the ENAC UAV laboratory team is given in Fig. 567. The safety pilot can be seen in the photo holding the remote control.

In this section, the injection of faults to the flights are explained in detail. The Paparazzi GCS has been altered to inject real-time faults, and controllers in some of the flight modes have been changed to accommodate faults. Next, the selection of the faults and nominal phases, and also labeling data, are presented. Finally, the labeled data used to train classifiers for elevon stuck and loss of efficiency faults separately and the classifiers are evaluated. We implement a variety of techniques to improve performance, such as feature engineering and tuning the classifiers.

Injecting faults in flight from Paparazzi GCS

For the faulty flight data gathering, some modifications to the Paparazzi autopilot was necessary in two main parts: first, injecting the faults real-time from GCS; and second, editing the controller onboard so that the sent faulty input values configures the servos as manipulated from the GCS.

In order to inject faults real-time from GCS, a slider is added to the GCS to set the fault during flight and then set it back to normal flight conditions if necessary. Flying with faults is a challenge. The risk of crashing is increased on purpose, so a back up plan is necessary so as to recover from faulty situations if the drone seems to be out of control and/or about to crash. For that purpose, the faults are only injected to Auto modes, and Manual mode is always free of faults even a fault is given from the ground station. Thus, when the pilot sees a safety problem during the faulty operation, s/he can switch to Manual mode from the remote controller and then has the control of the control surfaces free from faults. Depending on the nature of the fault injected, such as for some severe stuck control surface fault data gathering, this could be a game changer, since the drone would crash unless action is taken. This is shown in Fig. 5-11 with a switch initiated by the pilot's remote control.

This figure also shows that during the control allocation phase -which is the calculation of the desired servo commands from given desired elevator/aileron commands -faults are injected if the mode is Auto 1 and Auto 2 when fault multiplicative or fault additive values are changed from the GCS by the operator. When switched to Manual mode, the control allocation does not consider the injected faults. and a corresponding example line in the data (corresponding to a command to revert to nominal condition) can be seen in Fig. 56789.

This means that to multiply the value given by the controller by 1 and add 0, it does not change the values given by the autopilot. As soon as any of the control surface effectiveness values are changed in the GCS, a new Settings value is saved to the file (shown with arrows in Fig. 567891011121314).

To find the indexes where the nominal and faulty data starts and ends, the values of the Settings message is investigated. So when there is a Settings message in the flight, it should be either a fault generation or a return to nominal condition after a fault. If the message contains the Settings message equal to [1.0 1.0 0.0 0.0], this data index is selected as the nominal condition start index and a previous index before the next Settings message is the last index of this nominal phase. The matrix holding the start and end index for the nominal phases are saved as nominal_start_stop, as shown in Table 5.1, where the first row corresponds the start index of each nominal set and the second row corresponds to the last index of the corresponding as nominal phase. As an example, we check the second nominal phase of the flight. The first nominal phase is the flight before any fault is injected, starting from take off to the first fault injection. After the fault injected for the first time, we wait a certain amount of time and then set the Settings back to normal (1.0 1.0 0 0) from the GCS. This corresponds to the 516,919th data line entry (which is SETTINGS 1.0 1.0 0 0 ) in the whole data set (see nominal_start_stop (1,1) in Table 5.1). Then, another fault is injected at the time corresponding to the 521,966th line in the data file, thus until this index (see nominal_start_stop (2,1) in Table 5.1) the data corresponds to the second nominal phase. For the fault indexes, a similar approach is followed except that the Settings messages selected are the ones that are different to [1.0 1.0 0.0 0.0]. An example is Fault #23 in Fig. 5-15 and its corresponding start and end indexes given in Table 5.2.

2813.0450 52 SETTINGS 0.000000 1.000000 0.000000 0.000000

fault phase number 1 2 • • • 23 • • • 34 fault start fault_start_stop(1,:) 456888 473827 • • • 924705 • • • 1076847 fault stop fault_start_stop(2,:) 473826 485762 • • • 925390 • • • 1077117
The next step is to choose the phases of the flight to work with. As an example, a phase of the flight where there is enough nominal data followed with an extreme fault injection is selected. This corresponds to the fourth nominal phase of the flight followed by the 23rd fault selected. Fault #23 corresponds to the right control surface stuck and can be seen in Fig. 5-14. The next step is to select the measurement corresponding to these selected time intervals, and this is achieved by logically ANDing The SVM classifier has been trained and tuned with the flight data, generated by following the steps covered above, in order to classify the faulty and nominal classes.

0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 . . . Setting index Fault # 23 index Gyro index Faulty Gyro index
The simulations have been developed under the Matlab coding environment. Some tools, such as the calculation of the f1Score, were written as Matlab scripts rather than changing some of the arguments of the toolbox functions, since they were not found available in the toolbox (either they did not exist or were difficult to obtain).

The All three steps (training, tuning and evaluation) explained thoroughly in the SVM application section, have been applied and the results are given below.

Control surface stuck fault

During the flights, the most challenging fault to realize was the control surface stuck.

The drone reacted very fast with an uncontrollable dive towards the ground and the safety pilot initiated a manual recovery by triggering the safety switch, shown in Fig. 567891011. So the time taken from starting the ignition of the control surface stuck fault until the manual pilot's intervention was very short (⇠2 seconds), which can be seen from the accelerometer x-direction readings in Fig. 567891011121314151617.

This causes the problem of skew-class classification where there is a big difference between the number of instances belonging to different classes and requires some 4 https://github.com/benelgiz/cureDDrone/tree/master/ data/v4_multiplicativeAdditive_MURET_06_07_2017 special treatment, as explained above under Section 4.2.2. Having knowledge about data is critical for machine learning applications. Usually, the performance of the learning algorithms are dependent on the level of the engineer's experience, since some of the critical decisions are handled by her/him such as selection of features (though not for all machine learning methods). The measurements are also plotted in feature spaces a x -a z and a x -a y as shown in Fig. 5-21 and Fig. 5678910111213141516171819202122. It shows that a

x -a z space gives a distribution that would the evaluation of classifiers have been presented to the reader for completeness, the f1Score will be the main variable of concern for this study for the reasons explained before. The classifier with a box constraint = 2.11 and a kernel scale = 1 have been found to give the highest f1Score (f1Score = 0.9545).

To introduce the time change behavior of the system, the feature set has been widened with the additions of data from past measurements for each feature. We consider one of the features (shown in Fig. 5-23), accelerometer data in x-axis, corresponding to one of six columns (one of six features) in the feature matrix given in Fig. 5-5.

acc t x acc (t+1)
x acc (t+2)

x acc (t+m 1)

x x acc (t+2)

A x =
x acc (t+m 1)

x acc t x acc (t+1)
x acc (t N +1)

x acc (t 1)

x acc (t+m 2)

x acc (t N +2)

x acc (t N +m)

x acc (t N +3)

x A 0 x = Figure 5
-24: Addition of features to involve N 1 previous measurements Finally, this feature addition is applied to all features of the original feature matrix, resulting in X 0 2 IR m⇥6N :

X 0 = h A 0 x A 0 y A 0 z G 0 x G 0 y G 0 z i T (5.3)
where

A 0 y , A 0 z , G 0 x , G 0 y , G 0
z are constructed in the same way as A 0

x detailed in Fig. 5-24. For N = 4, the number of features have been increased to 24 in Table 5.4, which means only three previous measures for each different attribute have been added to the feature set ((3 past + 1 instant) * 6 axis). This addition to the feature set, in general, has deteriorated the performance of the classifier, especially for the classifier with an untuned Gaussian kernel (f1Score= 0.4167) ( f 1Score = 0.5135). For the classifiers with tuned Gaussian kernels, the f1Score decreases by a small amount for the classifier tuned with heuristic method (f1Score = 0.9444) and increases by an even smaller amount (f1Score = 0.9143), hence the effect is not very obvious. Table 5.4 and first three columns of Table 5.5 are the result of the same algorithm with same number of features and percentage of training/test set ratio. Due to the usage of random functions, the seed value has been set to a constant value for reproducibility. Stratified sampling has been implemented in order to ensure a reasonable amount of data from both classes in both sets (training and test). Finally, it has been discovered that even with the selection of the same number of data for the training and test sets for both classes (faulty and nominal), some combinations of possible training/test set selections result in more precise classifiers than others. This can be seen by observing the tuned f1Scores (f1Scores=0.9444 in and f1Score= 0.9143) in Table 5.4 increasing to the f1Score (f1Score= 1) in Table 5.5.

Table 5.5 shows the evaluation results of the SVM classifiers trained with a different percentage of training and test sets. The first three columns present the results for a test to training set ratio of 1/4 while the last three columns present the ratio of 2/3.

The f1Score trained and tuned with 80% training data implies that this percentage is a good choice for this problem (with an f1Score of 1 for tuned classifiers).

Control surface loss of efficiency fault

The loss of efficiency fault was generally more difficult to diagnose. First, a fault of 10% loss of efficiency on the left elevon has been investigated (SETTINGS 1.0 0.9 0.0 0.0). This fault was the first injected fault in the course of the flight, so the corresponding nominal phase is quite long. During the first minutes of the flight, the nominal mode was kept long so as to gather more nominal data from the flight before initiating the fault sequences. The results showed the insufficiency of the method to diagnose the fault (see Table 5.6 noted as LOE1), even with a Gaussian kernel, which resulted in exceptional results for stuck control surface diagnostics. One of the explanations for that might be that since the control surface is not moving in a wide is not easy to establish from the measurements. Another reason, likely to be the main driver, could be the compensation of the fault via the controller. The aim of the controller onboard is to minimize the error to track a given reference trajectory and corresponding attitude references. Hence, when this error is not minimized, for one reason or another, the controller re-computes the control signal to minimize this error. So, due either to due to a different wind condition error or a fault in the control surface, the controller's duty is to minimize this error, and a well-designed controller might handle that especially in the condition where the effect of disturbance is not catastrophic. This controller's compensation for the fault could be known by observing the output of the controller and feeding this information, as well the set of instances. However, during the course of this study, the abilities of a classifier without the information from the controller is investigated. The main reason behind this is to challenge the abilities of a small and inexpensive set of health monitoring system that does not rely on information from the autopilot.

The loss of efficiency of the left elevon is increased to 40% degradation in order to investigate if, in this case, the SVM classifier will be able to classify the fault.

This fault is coined as LOE2 Table 5.6. The results show no recuperation in the classification results for either untuned or tuned classifiers, with f1Score= 0.0032 and f1Score= 0.2, respectively. Since the results were very poor in terms of classifying faults, the faults have been increased to have a 40% degradation in both elevons. The idea is to see at which level the result of classification will improve, and also to explore any reasons behind this ineffectiveness, except for the controller's compensation. Another issue to investigate is the effect of the number of instances for the larger datasets (nominal class) on classification. For that purpose, three different sizes for nominal data set (⇠15min, ⇠6min, ⇠3min) were investigated in terms of their effects on classification performance for a faulty measurement data set of ⇠1min. Classification results for two of the situations (⇠15min, ⇠3min) are given in Table 5.7. The reduction of the nominal data set was not a random selection throughout the complete set, but was only for the last part of the nominal data set, which is closer to the faulty data in terms of flight time instance selected. The first simulation involved ⇠15min nominal measurements, hence the most skewed classification. An untuned SVM classifier with a Gaussian kernel was not able to classify (f1Score= N aN ) the fault. Even when tuned, the classification performance was too poor to be used for predicting faults (f1Score= 0.12), as shown in Table 5.7. Reducing the number of the larger class, gyro and accelerometer measurements during nominal phase, an untuned SVM classifier with Gaussian kernel still shows poor results in classification (f1Score= 0.0073), and tuning does not provide much help (f1Score= 0.13). Compared to the larger nominal class measurements case, it gives the idea that reducing the number of instances of the bigger class might help to improve classification performance ( f 1Score = 0.01). A poor classification results with an untuned SVM classifier with a Gaussian kernel (f1Score = 0.2712), although an improvement is observed compared to the wider nominal data set ( f 1Score = 0.2616). Tuning the classifier did not enhance the classification result noticeably (f1Score = 0.2756).

Since reducing the number of instances of the larger class (nominal phase measurements) in the classification does help to a certain extent but does not result in satisfactory results for classification, adding new attributes to the feature set is considered. For that, the previous measurements of the same attribute are added to the input matrix to give the time dependent change in the behavior of the observed physical variable. Results for a set of total number of 24, 100 and 300 features are shown in Table 5.8. We now discuss the effect of adding previous measurements as separate features to the feature set (previous, three measurements were added to the input data set), resulting in 4 x 6 = 24 features. Adding three previous instance in time for each sensor measurement decreased the performance of the untuned classifier with a Gaussian kernel f1Score = 0.1375, which is classification performance decrease of f 1Score = 0.1341. By adding more features, the classifier was still not able to classify when untuned, but by tuning, the f1Score can be improved noticeably, producing a classifier with an f1Score of 0.9635 for 120 feature case and can be even more refined to an f1Score of 0.9896 for 300 features in total. So, adding features advances the classification but only when proper tuning is achieved. Otherwise, untuned, the results are even worse than before adding the features.

Use of spinors as attributes

In this thesis, until now, the use of feature engineering to ameliorate the classification performance has been performed mainly by utilizing the addition of new features to include previous measurements in all instances. The purpose was to include the time evolution of the signal, as well as the instantaneous measurements in the instances.

Here, another idea has been applied as feature engineering: to replace angular velocity measurements from gyros with spinors, such that a feature matrix is given, as in Fig. 5-25.

acc t x acc (t+1)
x acc (t+m 1) To calculate the spinors, the kinematic equations given in Eq. 5.4 are solved numerically to attain quaternions from angular velocities:

x X = acc t y acc t z acc (t+1)
q0 = 1 2 q T ⌫ ! q⌫ = 1 2 ⇣ q ⇥ ⌫ + q 0 I 3 ⌘ ! (5.4)
Given the quaternion definition in Eq. 5.5:

q = h cos ⇣ ✓ 2 ⌘ sin( ✓ 2 )e i (5.5)
the spinor is calculated via taking the logarithm of quaternion described as in Eq.

Conclusion

In this chapter, we focus on the results of SVM classification application to the fault The addition of features to accommodate the previous measurements improves the classification performance for tuned classifiers, while the untuned classification performance deteriorates. Classification performs poorly for the loss of efficiency faults, especially for small losses of effectiveness. For the loss of efficiency fault, some feature engineering -involving the addition of past measurements -is needed in order to attain similar classification performance.

A very promising result is discovered when spinors are used as features instead of angular velocities. Thus, the kinematic equations have been solved so as to calculate the quaternions using angular velocity measurements. Then spinors are calculated as a function of quaternions. Results show that by using spinors for classification, there is a vast improvement in classification accuracy, especially when the classifiers are untuned. Using spinors and a Gaussian Kernel, the untuned classifiers give an F1 score of 0.9555 which was 0.2712 when the gyro measurements were used as features.

This work thus shows that SVM yields a satisfactory performance levels for the classification of faults on the control surfaces of a drone using real flight data. The FDD algorithm designed here is a first step towards safer drone flights. The next section introduces possible future steps. pitch (theta) = 90 degrees -devision by 0). Quaternion representation used here has the scalar component as the first component: q = q0 + q1 * i + q2 * j + q3 k w , angular velocity vector with components p, q, r w = [p q r]' in detail, w describes the angular motion of the body frame b with respect to navigation frame n (NED), expressed in body frame.

Attitude transformation matrix (Direction Cosine Matrix) is used to change the frame of interest that the vector or points expressed in. Lets say that we have a vector A fixed in inertial frame. Its representation in two frames will differ even it is the same vector. The frame to express it could be changed utilizing a direction cosine matrix.

Daniel Delahaye

Laboratoire MAIAA, ENAC Toulouse, FRANCE Email: deniel.delahaye@enac.fr Abstract-The new era of small UAVs necessitates intelligent approaches towards the issue of fault diagnosis to ensure a safe flight. A recent attempt to accommodate quite a number of UAVs in the airspace requires to assure a safety level. The hardware limitations for these small vehicles point the utilization of analytical redundancy rather than the usual practice of hardware redundancy in the conventional flights. In the course of this study, fault detection and diagnosis for aircraft is reviewed. An approach of implementing machine learning practices to diagnose faults on a small fixed-wing is selected. The selection criteria behind is that, data-driven fault diagnosis enables avoiding the burden of accurate modeling needed in model-based fault diagnosis.

In this study, first, a model of an aircraft is simulated. This model is not used for the design of Fault Detection and Diagnosis (FDD) algorithms, but instead utilized to generate data and test the designed algorithms. The measurements are simulated using the statistics of the hardware in the house. Simulated data is opted instead of flight data to isolate the probable effects of the controller on the diagnosis, which will complicate this preliminary study on FDD for drones.

A supervised classification method, SVM (Support Vector Machines) is used to classify the faulty and nominal flight conditions. The features selected are the gyro and accelerometer measurements. The fault considered is loss of effectiveness in the control surfaces of the drone. Principle component analysis is used to investigate the data by reducing the feature space dimension. The training is held offline due to the need of labeled data. The results show that for simulated measurements, SVM gives very accurate results on the classification of loss of effectiveness fault on the control surfaces.

I. INTRODUCTION

The cost effectiveness and reachability of COTS elements, shrinking size of electronics serve as a perfect environment for small flying vehicles to emerge. This accelerating trend towards small but capable flying vehicles is pushing the limits of both hardware and software potentials of industry and academia. Increasing usage of these vehicles for a variety of missions pushes a further liability to secure the flight.

To achieve a safe flight is not an easy task considering the unknowns of the systems hardware, environment and possible system faults and failures to emerge. Also, increasing demand on cost effective systems, resulting in the smaller sensors and actuators with less accuracy, impose the software to achieve even more. The expectation that UAVs should be less expensive than their manned counterparts might have a hit on reliability of the system. Cost saving measures other than the need to support a pilot/crew on board or decrement in size would probably lead to decrease in system reliability.

Systems are often susceptible to faults of different nature. Existing irregularities in sensors, actuators, or controller could be amplified due to the control system design and lead to failures. A fault could be hidden thanks to the control action (1).

The widely used method to increase reliability is to use more reliable components and/or hardware redundancy. Both requires an increase in the cost of the UAS conflicting one of the main reasons of UAS design itself band consumer expectations (2). To offer solutions for all different foreseen categories of airspace, a variety of approaches should be considered. While hardware redundancy could cope with the failure situations of UAVs in the certified airspace, it may not be suitable for UAVs in open or some subsets of specific categories due to budget constraints. Analytical redundancy is another solution, may be not as effective and simple as hardware redundancy, but relies on the design of intelligent methods to utilize every bit of information on board aircraft wisely to deal with the instances.

There are three approaches to achieve safe FTC in standard flight conventions. First one is the fail operational systems which are made insensitive to any single point component failure. The second approach is the fail safe systems where a controlled shut down to a safe state is practiced whenever a critical fault is pointed out by a sensor. The level of degradation assures to switch to robust (alternate) or direct (minimal level of stability augmentation independent of the nature of the fault) mode. Switching from nominal mode to the robust and direct modes leads to a decrease in the available GNC functions. This causes a degradation in ease of piloting. And also some optimality conditions could have been compromised. The third approach is fault tolerant control systems in which redundancy in the plant and the automation system is employed to design software that monitors the components and takes in action whenever needed. The strategy is most probably to try to keep plant availability and accept reduced performance (3).

II. METHODS FOR FTCS

A common categorization of FTCS is passive and active FTCS. In passive FTCS, the flight controller is designed in such a way to accommodate not only the disturbances but also the faults. Active FTCS first distinguishes the fault via fault detection and diagnosis module and then switch between the designed controllers specific to the fault case or design a new one online (2). While active FTCS requires more tools to handle faults as seen in Fig. 1, for faults not predicted and not counted for during the design of the robust controller, this method most probably fails.

Even with a long list of available methods, aerospace industry has not implemented FTC widely, except some space systems, due to the evolving nature of the methods, the tricks coming with the nonlinear nature of the problem, design complexity and high possibility of wrong alarms in case of large disturbances and/or modeling uncertainties. So the already carried reliability measures concerning the hardware redundancy is now the preferred way because of its ease and maturity being implemented on various critical missions with considering human lives.

III. FAULT DETECTION AND DIAGNOSIS

FDD is handled in two main steps; fault detection and fault diagnosis. Fault diagnosis encapsulates fault isolation and fault identification. The methods for detection and diagnosis are investigated for their frequency of utilization separately for sensor, actuator, process and controller faults in (4). FDD should not only be sensitive to the faults but also robust to the model uncertainties and external disturbances.

Two distinct options to proceed in analytical redundancy are the model based approaches and data-driven approaches. They form the two ends of a continuous solution set line, so utilizing them in a combination might end up with better solutions. Model based fault diagnosis highlights the components of a system and the connections in-between, and their corresponding fault modes. Data driven fault diagnosis rely on the observational data and prefers dense, redundant and with a frequency larger than the failure rate.

A. Model Based

In model based approaches, relations between measurements and estimated states are exploited to detect possible dysfunction. The most common ways to implement a model based approach is to estimate the states, estimate the model parameters, or parity-space. The accuracy of the results depend on the type of faults (additive or multiplicative). Additive faults affects the variables of the process by a summation whereas the multiplicative faults by a multiplication. When only output signal can be measured, signal model based methods can be employed for fault detection such as Bandpass filters, Spectral analysis(FFT) and maximum entropy estimation. For the case, both the input and output signals are available, the utilized methods for fault detection are called the process based methods: State and output observers(estimators), Parity equations and Identification and parameter estimation. They generate residuals for state variables or output variables. When previous works investigated, it is concluded that the most widely used technique for sensor and actuator faults is the state and output observers (estimators) and for process faults, identification and parameter estimation (4).

The output of the model based fault detection methods is the stochastic behaviour with mean values and variances. With the use of change detection methods, deviations from the normal behavior can be detected. For that purpose, three available methods considered are, mean and variance estimation, likelihood-ratio-test and Bayes decision, run-sum test and two-probe t-test. Fault detection is only supported by simple threshold logic or hypothesis testing in most of the applications (4).

A bunch of studies discovers the band of different approaches for model-based fault detection. Detecting sensor and actuator faults via state estimation, utilizing an EKF is applied to a F-16 model in (5). Parameter identification via H 1 filter is used to indicate icing in (6).

A drawback of model-based approaches is that they require accurate model of the aircraft for successful detection. In a small UAV system susceptible to various uncertainties/disturbances and most of the cases does not have an accurate model, leading a model-based approach might fail. And also, a mathematical model of a UAV is constructed within the flight envelope, and does not necessarily describe the possible dynamics invoked by a failure on board.

A way to handle that is to offer solutions to cope with the uncertainties. A fairly old study in 1984, investigates the design problem FDI systems robust to uncertainties within the models. One of the two steps of FDI, two steps being the residual generation and decision-making, is targeted. They offer to handle model uncertainties, by designing a robust residual generation process (7). Another study deals with model uncertainties by determining the threshold of the residual in a novel way with an application to detect aileron actuator fault (8). ( 9) utilize two cascade sliding mode observers state estimation and fault detection to guarantee staying in sliding manifold in the presence of unknown disturbances and faults.

B. Machine Learning

Model-based approaches had various successful applications until now, most of them assuming accurate model is available on board. With the new era of UAVs, the airspace is expected to be populated by an abrupt increase in the number of UAVs. The variety of UAVs, expense of accurate modeling practices, the difficulty in modeling the behavior of UAV in case of failures, call for alternative approaches for the quite challenging problem of FDD. The increased efficiency of sensors on board, the increase in the computational capabilities of autopilot processors, and the advances in machine learning techniques in the last decade may offer efficient data-driven solutions to FDD.

In data driven methods, a detailed knowledge about the internal dynamics of the system is not necessary. The data available is the source of information with regard to the behavior of the system. Supervised learning, which requires to label the fault cases previously in the training data, is usually utilized for data-centric inference of causes. In case of an unlabeled fault, the result is expected as a probability distribution of the available normal modes, identified fault labels and a probable unknown fault. What is needed at that point is to first detect and localize the fault and then to consult domain experts for labeling for further integration of this fault into the diagnosis scheme (10).

Amidst data driven methods for FDD, such as Neural Networks (11) and Principal Component Qnalysis (PCA) (12), Support Vector Machines (SVM) appear more recently in the literature. (13) argues artificial intelligence methods for fault detection of complex systems. Comparison between PCA and model based stochastic parity space approaches is given in (14). In (15), the authors argues to use dynamic PCA since UAV flight controls is a dynamic system itself and DPCA can reflect unknown disturbances, while model-based approaches can only model typical disturbance.

SVM is introduced in 1964 in the statistical learning theory domain and relies on structural risk minimization principle (16). Although the theory has old roots, its application to classification as a machine learning algorithm is recent and originally offer solutions for two-class classification (17; 18). SVM's first application as a classifier was mainly on object classification in images and followed by fault detection lately. The use of SVM on fault detection has gained popularity thanks to its improvement in accuracy of detection (19). Application of SVM on fault detection is mostly held in mechanical machinery, such as roller bearings, gear box, turbo pump rotor and sometimes other systems; semi-conductors, refrigeration systems and chemical processes. Its application on complex systems has not been very widely adopted yet and forms the basis of study for our research.

IV. SYSTEM MODELING

In this study, first, a model of an aircraft is simulated. This model, will not be used for the design of FDI algorithms, but instead will be utilized to test them. Nonlinear aircraft flight dynamics for translational and attitude motion can be given as a system of first order partial differential equations

ẋNED = C n b v b (1) vb = 1 m ⇥ mg b + F b t + F b a ⇤ ! b b/i ⇥ v b (2) q0 = 1 2 q T ⌫ ! b b/i (3) q⌫ = 1 2 ⇣ q ⇥ ⌫ + q 0 I 3 ⌘ ! b b/i (4) J !b b/i = M ! b b/i ⇥ J! b b/i (5)
where x NED 2 IR 3 is the position of the center of mass of UAV with respect to inertial frame I expressed in the body frame B, v b is the velocity of the center of mass of UAV with to I expressed in B, q = [q 0 , q T v ] T 2 IR 3 ⇥ IR is the unit quaternion representing the attitude of the body frame B with respect to inertial frame I expressed in the body frame B, J 2 IR 3⇥3 is the positive definite inertia matrix of the drone, M 2 IR 3 represents the moments acting on the drone. The notation x ⇥ for a vector x = [x 1 x 2 x 3 ] T represents the skew-symmetric matrix The stability and aerodynamic force coefficients are generated by AVL. The input vector can be written as

x ⇥ = 2 4 0 x 3 x 2 x 3 0 x 1 x 2 x 1 0 3 5 (6)
u (t) 2 IR 3 u (t) = ⇥ a e n ⇤ T (7)
Here a aileron deflection angle in degrees, e elevator deflection angle in degrees, n engine speed in rev/s.

When the actuators are healthy, actual control input signal will be equal to the given input signal. In case of a fault the actual signal can be modeled as

u (t) = Eu c + u f ( 8
)
where u c is the desired control signal, E = diag(e 1 , e 2 , e 3 ) is the effectiveness of the actuators where 0  e i  1 with (i = 1, 2, 3) and u f additive actuator fault. This model makes it possible to simulate all four types of actuator faults shown in Fig. 2. Most of the FDI algorithms are implemented to open-loop systems, ignoring the probable influences of the controller might cause on the detection performance (20). Here the system is open-loop as well. Further implementation of a controller is foreseen to understand the effect of the selected controllers. So we follow a step by step approach and hope to end with a more realistic case, in which real flight data is utilized and diagnosis is achieved online aside a functioning controller.

Since it is not possible to see all features, we take advantage of the dimensionality reduction technique called Principle Component Analysis (PCA) for visualization. Here what we do is to map the feature vector, x 2 IR n to a lower dimensional space where the new feature set will be represented by z 2 IR k . Fig. 4 shows the resulted most significant elements for a mapped feature space from six dimensional feature vector to two. SVM is a relatively new approach for classification offering better generalization property thanks to its foundations on the structural risk minimization principle (21; 22) while other classifiers usually only minimizes the empirical risk. This advances the capacity of generalization even with a small number of instances by reducing the risk of overfitting for a nicely tuned parameters setting. It can be applied to nonlinear systems and problems offering a vast number of features. Furthermore, taking advantage of convex optimization problems in the solution of SVM models, another attractive reason to use SVM rises as avoidance of global minimas, while Neural Networks is inherently prone to local minimas.

The idea behind SVM is to find an optimal hyperplane that will linearly separate the classes. This is achieved with the introduction of maximum margin concept which is the distance in between the boundaries when they are extended until hitting the first data point as in Fig. 5. The points closest to the hyperplane (decision boundary) are called the support vectors and are the representatives of the data sets to be used for the decision process. This helps to decrease the data to handle abruptly, enhancing the ability to cope with the curse of dimensionality and reducing the computational complexity.

SVM has other tricks to deal with not linearly seperable problems such as using kernels to map data into higher dimensional feature spaces where they can be separated with a linear hyperplane.

A binary classifier is used in this work to classify two classes, faulty and nominal. The fault considered in this study is the loss of effectiveness of the control surfaces. SVM being a supervised classification algorithm has two main phases as shown in Fig. 6. In the training phase, the model is learned as a fit to the labeled data that is fed to the SVM algorithm. This Training data is comprised of labeled data where the label can belong to one of two possible cases. This data set is saved in X 2 IR m⇥n where m, n correspond to number of instances and features respectively. The label information corresponding to the measurement instances is also fed to the SVM algorithm during the training phase as output vector y 2 { 1, 1}. The aim of SVM is to find an optimal hyperplane maximizing the margin by solving the optimization problem for non-linearly separable datasets

min ,!,b 1 2 k!k 2 + C m X i=1 ⇠ i (9)
s.t. y i (! T x ( i) + b) 1 ⇠ i , i = 1, • • • , m (10) ⇠ i 0, i = 1, • • • , m (11) (12)
To avoiding overfitting, which is the main problem of parametric discrimination approaches such as neural networks, parameter C is tuned to result in the optimal fit for the cross validation set. The data set available is first divided to two portions with a percentage of %20, %80 where the bigger chunk is the training set and the remaining is the test set. Further, the training set is divided as cross-validation and training sets. The idea to split data is to avoid overfitting. Overfitting means that the models trained being very accurate fit for the data they are trained to but fail to generalize with new inputs resulting in bad prediction performance for the new data. To assess the performance of the classifier trained with the training data is tuned to give a better performance with the cross validation data. And then the final ability of the classifier is tested on the test set. This parameter also tuned for the outliers to generalize the distribution of the data rather than resulting in fine fits for each individual data in the training set. With a satisfactory result of the training & tuning is followed by the prediction where the classifier predicts if the new measurement data belongs to the faulty or nominal class. The output of the SVM classification is not the probability that the new measurement belongs to one class as is in the traditional classification problems, but directly the class information it belongs to. For investigating the performance of the classifier on the test set, a method ( 23) is used to calculate the posterior probabilities giving the probability that the new measurements belongs to faulty mode. Results shows as in Fig. 7 that prober tuning achieves very accurate and instant detection for the drone fault.

VI. CONCLUSION

Integration of drones into airspace needs the introduction of indigenous designs that will serve safe solutions for drones. One of the aspects of the problem is to assure a safe flight by designing fault detection and diagnosis with cheaper avionics common in a vast number of drones projected. This work aims to design a classifier via SVM to solve FDD of drones with actuator faults. This problem possess various challenges. This work focuses on a loss of effectiveness fault which is more difficult than a stuck fault to diagnose, but easier to mitigate.

A model of a MAKO UAV is simulated to generate data and test the designed algorithms. The simulated data of gyro and accelerometer measurements are given to classifier to train for the two class labeled data set. A supervised classification method, SVM (Support Vector Machines) is used to classify the faulty and nominal flight conditions. Principle component analysis is used to investigate the data by reducing the feature space dimension. The training is held offline due to the need of labeled data but prediction is envisioned be held real time. The results show that for simulated measurements, SVM gives very accurate results on the classification of loss of effectiveness fault on the control surfaces.

Further study is envisaged to deal with the controller diagnosis interaction and classification of multiple faults. Also discussion of SVM for online training might be addressed since SVM is in need for labeled data which requires generating the labeled data during flight.

Flexible Open Architecture for UASs Integration into the Airspace: Paparazzi Autopilot System Elgiz Baskaya ⇤ , Guido Manfredi ⇤ , Murat Bronz † ‡ and Daniel Delahaye ‡ ⇤ ENGIE Ineo -Safran RPAS Chair, ENAC, Toulouse, France Email: elgiz.baskaya@enac.fr † UAS Lab, ENAC, Toulouse, France ‡ Laboratoire MAIAA, ENAC, Toulouse, France Abstract-Air safety authorities are forced to develop regulations for UAS due to incidents disturbing public safety and demands from UAS operators. Despite numerous studies from the FAA and EASA, none of them decided on a regulation for UASs. The reliability of the flight is considered to be one of the main obstacles for UAVs integration. This is not an easy topic considering the unknowns of the systems, environment and possible failures. We believe the flexibility required for such solutions calls for open architectures. More specifically, this paper shows how the use of the Paparazzi open source auto-pilot system can ease the integration of low altitude UAS. To ensure safety, this integration needs to be achieved through airspace management and UAS reliability.

Preliminary airspace designs, e.g. Amazon's, identify different zones depending on the UAS capabilities, population density and altitude. Plus, national rules evolution push to cope with a variety of requirements. Open source and modular architectures are key to adapt to these requirements. From a UTM point of view, Paparazzi provide features to ease congestion management, such as dynamic geofencing, trajectory communication and collision avoidance. Concerning reliability, current regulations focus on flight constraints but might be expected to involve regulations on software and hardware components as well. In such case, the increased cost will be inevitable for the demands of certification. In the Paparazzi software case, parts of the code have been formally proved and stable versions have thousands of flight hours. Such heritage might ease the certification process for smaller companies.

On top of its flexibility and reliability, Paparazzi offers a unique set of features, as an open source software, to achieve safe integration of low altitude UAS in the G airspace. To conclude this work, desirable new features and future work are discussed.

I. INTRODUCTION

The cost effectiveness and reachability of commercial offthe-shelf elements, and shrinking size of electronics serve as a perfect environment for small flying vehicles to emerge. Although inherited as military purposes in its infancy, nowadays Unmanned Aircraft System (UAS) are becoming efficient platforms for scientific/commercial domains. They offer benefits in terms of cost, flexibility, endurance as well as realizing missions that would be impossible with a human onboard. Increasing usage of these vehicles for a variety of missions, such as defense, civilian tasks including transportation, communication, agriculture, disaster mitigation applications pushes demand on the airspace. Furthermore, this congestion is predicted to accelerate with the growing diversity of these systems.

Commercial advantages, offered by these efficient systems, are already targeted by big companies worldwide, specifically in the US. The airspace regulatory authorities seem to be squeezed in between the companies, demanding a fast as possible access to airspace, and the concerns of the public about potential privacy breaches, safety and liability issues [1], [2]. Even with today's strictly regulated airspace, reported occurrences show that there are hurdles to solve before a further integration of UAS to airspace.

Advent of the new era of UAS seems to be hold by an unseen barrier of lack of regulatory framework for now. Different institutions all over the world, specifically National Aeronautics and Space Administration (NASA) and Federal Aviation Administration (FAA) in US, easa in Europe and international bases such as International Civil Aviation Organization (ICAO) are addressing safe integration of UAS in airspace. Although the approaches of regulatory bodies may vary, the aim remains the same: safe integration as soon as possible.

The tackles of safety during integration of UAS to airspace refer to different technical and organizational aspects including but not limited to control of traffic in segregated and nonsegregated airspace, reliable communication, robust control of the Unmanned Air Vehicle (UAV), trajectory planning, detect&avoid.

In this study, we present the Paparazzi open source autopilot system, and its features, as a tool to ease the safe integration of low altitude UAS into National Air Space (NAS). In our argument, Paparazzi is favored thanks to its modular design, its support for congestion management and evolving reliability.

II. OPEN-SOURCE AUTOPILOTS FOR UAS

With the new era of First Person View (FPV) flights, especially for multi-rotor UAVs, there has been an exponential increment on the hardware and software of the open-source autopilots. A brief comparison of the popular current opensource and commercial autopilots is available in Table I. Usually the trend is to make the hardware as cheap as possible for recreational consumers. This reality is damaging the reputation of open-source autopilots as being not reliable or robust, just because they are being used without attention. There exists a difference on the quality of sensors used on the open-source autopilot systems compared to commercial autopilots for sure, and this is extremely represented on the price of the units. This makes a difference on the flight quality of the vehicles, however with the new on-board processing power, more complex estimation algorithms and filters are being used in order to overcome this problem. The software is originally packaged for Debian/Ubuntu but can be manually installed on any GNU/Linux operating system even including MacOS-X. However, it is not compatible with Windows which automatically eliminates 90 % of the possible user community and therefore it is not as popular as other existing autopilot systems on the user market.

A. System Architecture

The system architecture of Paparazzi consists of three segments: Ground, Airborne, and the communication link between (Figure 1). The ground software of Paparazzi is mainly written in Ocaml, with some additional parts in Python and C. Thanks to its middle-ware communication bridge called Ivy-Bus, external softwares can be directly connected with publish and subscribe method to the ground segment without needing to modify and code at all. Airborne software is completely written in C, however there is an on-going work which implements the possibility of adding some C++ code parts.

B. Distinguishing Features

One of the distinguishing property of the Paparazzi is to support multi-UAV flight (Figure 2 A real-time operating system based on ChibiOS is started to be used since 2015. The first implementation was mainly for adding a separate thread in order to make on-board logging at a high frequency. On going work is to divide all autopilot tasks into individual threads and manage everything according to priorities which will increase the safety and reliability.

C. Hardware

There exists over 20 different autopilot boards capable of running Paparazzi. Additionally, several mission based custom sensor boards have been designed under the Paparazzi project, such as Meteo-Stick1 . The rest of this work highlights Paparazzi's capacity to tackle the issues encountered during integration of UASs in the airspace. These issues have been grouped in three categories: modularity, congestion management and reliability. For each Since, with Paparazzi, the uav needs to be flashed after each modification, it is easy to rely on the random generator of the operating system (/dev/random under linux) to generate a key that will be flashed alongside with firmware, so this key will be :

• shared between UAV and groundstation • regenerated for each flight, this make hostile decypher difficult • in a multi UAV configuration, each UAV will have private cypher key For the moment, the crypto driver for chibiOS is being written in order to be implemented into Paparazzi soon. This is generally a complicated task, however as the datalink bandwith is low, it becomes easier compared to a device driver.

E. Regular Use

Highly flexible architecture of the Paparazzi systems comes with the disadvantage of being too complex for a regular user such as a recreational (model aircraft) pilot. From the developer's point of view this is a great property, however beginners and regular users do not need to use all of the new features right away so they do not need to maintain the software at the latest version. Therefore the regular user will be using a recent stable release of the system, and usually will keep on using it without modification till he needs the new additional features coming from the developer community.

On the other hand, the developers will be able to use the software versioning system with GIT, maintained at Git-Hub, and can check out and contribute to the latest software version in the beta test status. The tools that the developers need in order to do that are not too different than the ones that are required for other software projects.

IV. MODULARITY

The current evolving nature of regulations and the variety of organizations in charge of the airspace rule making calls for flexible solutions to cope with these fruitful environments. Paparazzi, as an open source autopilot system, is largely modifiable through its modules to offer such flexible solutions.

A. Airspace Categorization

The UAS in the NAS project points to a performancebased routine access to all segments of the national airspace for all unmanned aircraft system classes, after the safety and technical issues are addressed thoroughly. As a start, NASA and faa seem to have a short term goal to integrate UAS in low-altitude airspace as early as possible. They further aim to accommodate increased demand safely, efficiently in the long term. NASA and faa seem to handle the airspace above 500 feet and the one below separately. European Aviation Safety Agency (EASA), tasked by the European Union, is planning a risk based approach, accommodating the UAS in the airspace under three different categories, low risk, specific and high risk [3]. Both regulators seem to categorize the airspace and scale regulatory needs according to some criteria. To answer different needs of different categories, flexibility given by the high level of modularity of open source autopilot systems will be a handy tool. Customizability of the software and hardware depending on the airspace gives a chance for larger airspace community to utilize Paparazzi scaled for their specific needs. A larger community using the same system would lead to a natural evolution of the system toward a better design.

B. National Regulations

Circulation of UAS internationally is somewhat prevented by the Chicago convention unless an agreement holds between Contracting States [3]. ICAO is aiming to develop international standards and recommended practices to which the member states could refer to when developing their national civil aviation regulations. Even though a similar base is aimed, national aviation legislations will not be the same because of the different expectations of nations about UAS aviation. Thanks to the modular nature of the Paparazzi software and hardware suite, the functionality of the system could be enhanced according to the specific regulations held in the area of utilization.

C. Accommodating evolution of regulations

Prescriptive rules seem to cause some difficulties since the technical area on UAS systems develop rapidly [3]. Innovations both on the aircraft and the operation type of UAS will accelerate especially after the regulations are set. Thus, regulatory bodies call for refinable operational requirements and system architectures to evolve into a safer and efficient integration of UAS into airspace. The systems to cope with the regulations should also be modular and flexible in order not to be superseded by the innovations in the area. Thus, the aviation regulatory bodies aim to achieve designs with flexibility where possible, structure where needed. Having flexible hardware and software points to modularity, which is pretty much best supported via open source systems.

V. CONGESTION MANAGEMENT

According to UAV Factory, one of the large European UAS companies, "The future of the UAV industry is likely to be shaped by airspace congestion" [4]. Indeed, high level airspaces are getting crowded and large scale solutions, such as NextGen (US) or SESAR-JU (EU), are necessary to increase airspace capacity while maintaining the current safety levels. However, there is no such management solution existing for Very Low Level (VLL). Yet, large projects like Amazon's Prime Air and Google's Project Wing are already waiting to populate the VLL airspace.

Part of the congestion management problem is to avoid conflicts, and more importantly collisions, between UAS through strategic deconfliction and safety nets. Another mission of the congestion management system is to make sure that UAS do not go where they are not supposed to go, thus requiring geofencing. In order to implement the previously mentioned systems, the UAS autopilot needs to be able to perform complex operations, e.g. static waypoints following is likely to be insufficient. In the following, we divide these issues into four topics of interest: 4-D trajectory management, geofencing, safety nets, complex operations, and show how the Paparazzi system addresses them.

A. 4-D Trajectory Management

As noted in [5], 4-D trajectories will be central in future airspace management methods. The principle of 4-D trajectory management is to have every UAS broadcast its trajectory up to some time horizon and receive Unmanned Aircraft System Traffic Management (UTM)'s clearances under the form of trajectories. The trajectory information contains a path, the series of points through which the UAS will pass, and times associated to each of these points. Thanks to this information, the idea is to perform pro-active deconfliction, as explained by Thomas et al. in [6]. In clear, it implies that UTM detects future conflicts along the trajectories of all UAS and deconflicting them as safely and early as possible. This kind of approach requires the autopilot to represent UAS motions with trajectories and to be able to transmit them, which is the case in Paparazzi.

Paparazzi originally supports a basic description of trajectories based on circles and straight lines, but recent updates allow it to process advanced trajectories as well. Indeed, Paparazzi can represent trajectories as functions in 2-D (x, y), 3-D (x, y, z) or 4-D (x, y, z, t). The only requirement is for the function to be differentiable at least two times on every point. The function and its derivatives analytical formulas are computed offline and can then be quickly evaluated online. Moreover, gains can be tuned to adjust the convergence speed from the UAS starting point to the given trajectory. These gains influence the convergence path to a given trajectory and the resulting trajectory (convergence + commanded) can be computed offline given initial conditions and the commanded trajectory. This is of particular interest for UTM as it allows the UAS to provide not only its trajectory over time but also how it will reach this trajectory from its starting point.

It is important to note that UTM will have to solve conflicts between manned and unmanned aircraft. So an air traffic controller is needed in the loop with an appropriate display for 4-D trajectories and a communication link with both manned and unmanned aircraft.

B. Safety Nets

Trajectory deconfliction is the first step to manage congestion, however safety nets are also part of the congestion management. Indeed, safety nets such as self-separation and collision avoidance allow UAS to fly close to each other while preserving an acceptable safety level. Though Paparazzi does not include self-separation algorithms, it do contains a light version of the TCAS II collision avoidance system. It considers intruders one at a time and is capable of coordinated avoidance maneuvers. There is no strengthen resolution as the resolutions are not speed rates but an objective altitude to reach as fast as possible. Values such as distance thresholds have been adapted to suite the performances of small UAS. Table II shows example values used for fixed-wing UASs. Keep in mind that the Parapazzi philosophy is to be configurable, so these parameters can be easily changed from a configuration file.

On top of the TA and RA provided by the TCAS, a module has been recently developed to input data from traffic services and display them into Paparazzi's ground control station, thus providing situational awareness to the remote pilot. Preliminary test have been done using opensky-network to display traffic around a given area, based on these information the remote pilot can effectively perform conflict resolution.

C. Geofencing

Keeping UAS away from each other is an important point. But keeping them out of forbidden areas is also crucial. Geofencing allows determining no-fly zones where the UAS should not enter. To accommodate land owners while managing traffic and limiting congestion, Foina et al. [7] proposed a participative dynamical airspace management method: the airparcel model. It allows land owners to authorize/forbid flights over their lands through a web interface. However, this type of approach asks from the UASs to be able to handle dynamical geofencing. Plus, though initially this model considers only cuboid parcels, the need for more precise airspace shapes may emerge making 3-D geofencing a need. This type of model can be handled by Paparazzi by defining geofenced zones manually or programmatically. The zone is defined as a simple geometrical shape (e.g. a circle, a polygon, etc.) plus altitude limits thus effectively creating a 3-D geofencing. These zones can be static, activated dynamically from the ground station or from the flight plan with associated conditions.

D. Complex Operations

Having 4-D trajectory management, safety nets and geofencing is useless if the UASs cannot follow the instruction from UTM regarding these tools. Indeed, new UTM paradigms imply being able to change flight plans dynamically to answer to UTM demands. In [8] two types of complex operations examples are mentioned: space transition corridors and temporary flight restriction. Both these airspace management methods require from the UAS to be able to modify its flight plan according to new UTM instructions.

Modifying the flight plan dynamically is not possible, and not desirable, in Paparazzi. However, appropriate response to these complex operations can be provided through conditional flight plans. These enable the UAS to follow different courses of action depending on given parameters. These parameters are defined offline by the user and can then be modified online by values coming from sensors or from UTM. This allows intelligent reaction to exterior instruction, in particular it can be used by the user to give UTM control on portions of the flight.

VI. RELIABILITY

Improvement of the reliability of the flight is considered to be one of the main goals for integrating military UAVs into civil airspace according to Unmanned systems roadmap by US Office of the Secretary of Defense, DoD [9]. Compared to manned counterparts, UAVs experienced failures with a frequency of two orders of magnitude more in the military domain. Although this changed last years with the technological improvements, making the UAVs as reliable as early manned military aircraft, it seems not enough from the DoD perspective. This can be realized by checking the biggest chunk of control technologies budget for research and development, which is health management and adaptive control.

To achieve a safe flight is not an easy task considering the unknowns of the systems hardware, environment and possible system faults and failures to emerge. Also, increasing demand on cost effective systems, resulting in smaller sensors and actuators with less accuracy, impose the software to achieve even more. The expectation that UAVs should be less expensive than their manned counterparts might have a hit on reliability of the systems. Cost saving measures other than the need to support a pilot/crew onboard or decrement in size would probably lead to decrease in system reliability.

A. Small and Medium Enterprise (SME)s and Certification Costs

Utilizing drones for quicker and cheaper deliveries could be rewarding for SMEs since cost per mile of a drone is less then 1 / 30 of the average diesel truck. Being an early bird might put the SMEs in an advantageous position, considering the increase in the capabilities of the drones with inevitable acceleration thrusted by research activities and their widened application areas. Nevertheless, the fairly cheap access to drones and their relatively cheap utilization cost does not seem to be enough to put them to air right now due to the heavy cost of certification and regulatory hurdles [10]. In this concern, capable open source solutions could be a good way to loosen the tie. Otherwise, SMEs, an important factor in drone business might not survive. Even worse, they might operate them without relevant permission, scarifying a substantial fine as reported by Civil Aviation Authority (CAA). This will compromise security in the system contradicting the hopes for reliable integration of drones into airspace. As an open source autopilot system, Paparazzi is a known platform for computer scientist who want to test the viability of complex software systems. Thus parts of Paparazzi code (Ground Control Station (GCS)) have been formally proven [11] and stable version have thousands of flight heritage. Furthermore, although Paparazzi is not certified, to be able to have access to the certified airspace, the users can built up their configuration on readily and freely available Paparazzi system, which might reduce the cost to have a certified system to reach specific airspaces.

B. Individuals and Education

Individuals, as well as SMEs, suffer from the same budget constraints. Personal UAV usage counts for a substantial amount of the drone ecosystem. Both US and European authorities mention the importance of individuals in utilizations of drones. There is a community with a passion of aviation and potential, but most probably not very experienced. Paparazzi offers a whole community to help/educate these beginners through its forums enriched by rising number of its users. A rich documentation is available through the Wikipedia page, encouraging users to self-teach.

C. Flight Heritage for Risk Assessment

Drone industry being extremely innovative, technical developments could supersede the prescriptive rules as regulations. Thus a solution might be to follow a risk based approach rather that to have strict rules to cope with. Predicted regulations in Europe seems to evolve under different categories dedicated to specific operation risks. Flight heritage and occurrence reporting is expected to be an inevitable part of safety risk assessment to achieve reliable flight. Wide utilization of Paparazzi and real time connection to ethernet could offer reliable and practical solutions to report occurrences.

D. Support for real time planning and onboard vehicle automation

To access low-altitude airspace with the use of small unmanned aircraft safely, an important ability could be to implement real-time planning and on-board vehicle automation. Amazon offers that this approach will allow some flexibility to adapt to variable situations such as weather changes, severe winds or any other emergency needs. Paparazzi, has a realtime planning ability already implemented, letting the user change the trajectory in real-time through its ground control station via different strategies. The user could switch between trajectories already available or even drag the waypoints to his/her preference. The automation of the vehicles is handled in different stages. For now, the most used modes of autonomy is no autonomy, assisted mode and the fully autonomous mode. No autonomy mode, or manual mode, gives whole responsibility of the aircraft dynamics to the pilot through the RC link. The assisted mode closes some attitude control loops, giving some stability to aircraft. This will ease the challenges of piloting which could be a great advantage especially for the unexperienced pilots. The fully autonomous mode handles both heading and navigation through selected trajectories. In case of an emergency, the pilot take the control of the aircraft anytime, through the RC link. Features already implemented on Paparazzi, such as geofencing, go home, and its ease in adding/modifying thresholds to various variables, support safety procedures.

VII. FUTURE EVOLUTIONS

As many open source projects Paparazzi is in constant evolution through regular contributions. With its large community, it is hard to keep track of all the ongoing projects. In this section we present three features being currently explored and developed at ENAC's labs.

Though there is no life a stake, avoiding UAS collisions is desirable for safety and operational reasons. Paparazzi's current TCAS-like collision avoidance allows operating numerous UAVs with little risk of collision between them. However, future missions will include more and more UAVs in bounded size airspaces. In this context, an efficient collision avoidance algorithm is desirable to allow closer operations with an acceptable amount of nuisance alerts. Because it relies on advanced logics and can be adapted to different types of performances, we have chosen to implement the ACAS Xu algorithm. Though this standard's definition just started, the baseline is already determined and may allow developing a simplified version for micro UAVs.

Regarding geofencing, most current methods use boundaries in the horizontal plane in which the UAV cannot enter. However, the utilization of the VLL airspace is likely to demand more sophisticated methods to handle 3-D geofencing where a 3-D no-fly shape can be described. Though Paparazzi can emulate 3-D geofencing, it cannot use full 3-D models yet. Work is underway to extend the current geofencing to allow loading terrain models and padding them with arbitrary shaped no-fly zones.

Finally, conventional procedures to handle failures onboard could be one of three approaches in order to achieve safe flight. First one is the fail operational systems which are made insensitive to any single point component failure. The second approach is the failsafe systems where a controlled shut down to a safe state is practiced whenever a critical fault is pointed out by a sensor. The third approach is fault tolerant control systems in which components of the system are monitored and action taken in whenever needed. The strategy is most probably to try to keep the system availability and accept reduced performance. For Paparazzi autopilot system, there is ongoing research to implement indigenous fault detection and diagnosis module to enable reconfigurable controller loops.

VIII. CONCLUSION

The introduction of UASs in the VLL airspace comes with numerous challenges. Though various ways to address them have been proposed, there is still no certainty about how it will be done in the end. One sure thing is that it will involve two main actors: UTM and UASs. This work focused on the later.

When it comes to autopilot systems, there exist a wide range of solutions. However, in the context of a quickly evolving regulation and technology, we showed that it may be beneficial to rely on an open source solution. Indeed, the community around it and the ability to adapt it to one's needs are precious assets. Among open source solutions, the Paparazzi autopilot system distinguishes itself with a unique set of features that, we have showed, allow tackling many of the existing challenges in the UASs integration. The most interesting feature being its linux-like philosophy which confers it an unparalleled level of configurability. With a complete control, the user is not limited by the software and nothing stops him from doing the smartest designs.

Paparazzi is a living project and keeps evolving to satisfy it community, both from the research and industry. New features are added on a regular basis and the shape it will take in the future only depends on the new members that join the project.

Flight Simulation of a MAKO UAV for Use in Data-Driven Fault Diagnosis

Elgiz Baskaya ⇤ , Murat Bronz, and Daniel Delahaye ENAC

ABSTRACT

Last decade witnessed the rapid increase in number of drones of various purposes. This pushes the regulators to rush for safe integration strategies in a way to properly share the utilization of airspace. Accommodating faults and failures is one of the key issues since they constitute the bigger chunk in the occurrence reports available. The hardware limitations for these small vehicles point the utilization of analytical redundancy rather than the usual practice of hardware redundancy in the conventional flights. In the course of this study, fault detection and diagnosis for aircraft is reviewed. Then a nonlinear model for MAKO aircraft is simulated to generate faulty and nominal flight data. This platform enables to generate data for various flight conditions and design machine learning implementations for fault detection and diagnosis.

INTRODUCTION

Unmanned Aircraft Systems (UAS) are becoming more efficient platforms everyday for scientific/commercial domains offering benefits in terms of cost, flexibility, endurance as well as realizing missions that would be impossible with a human onboard. Increasing usage of these vehicles for a variety of missions, such as defense, civilian tasks including transportation, communication, agriculture, disaster mitigation applications pushes demand on the airspace. Furthermore, this congestion is predicted to accelerate with the growing diversity of these vehicles [1].

Improvement of the reliability of the flight is considered to be one of the main goals for integrating UAVs into civil airspace according to Unmanned systems roadmap by US Office of the Secretary of Defense, DoD [2]. To achieve a safe flight is not an easy task considering the unknowns of the systems hardware, environment and possible system faults and failures to emerge. Also, increasing demand on cost effective systems, resulting in the smaller sensors and actuators with less accuracy, impose the software to achieve even more. The expectation that UAVs should be less expensive than their manned counterparts might have a hit on reliability of the system. Cost saving measures other than the need to support a ⇤ Email addresses: elgiz.baskaya@enac.fr, murat.bronz@enac.fr, daniel.delahaye@enac.fr pilot/crew onboard or decrement in size would probably lead to decrease in system reliability.

Systems are often susceptible to faults of different nature. Existing irregularities in sensors, actuators, or controller could be amplified due to the control system design and lead to failures. A fault could be hidden thanks to the control action [3].

Under the research and development programs and initiatives identified by DoD in order to develop technologies and capabilities for UAS, the biggest chunk in control technologies is the health management and adaptive control with a budget of 74.3 M dollars. Other safety features such as validation and verification of flight critical intelligent software is the second with 57.8 M dollars [2].

The widely used method to increase reliability is to use more reliable components and/or hardware redundancy. Both requires an increase in the cost of the UAS conflicting one of the main reasons of UAS design itself band consumer expectations [4]. To offer solutions for all different foreseen categories of airspace, a variety of approaches should be considered. While hardware redundancy could cope with the failure situations of UAVs in the certified airspace, it may not be suitable for UAVs in open or some subsets of specific categories due to budget constraints. Analytical redundancy is another solution, may be not as effective and simple as hardware redundancy, but relies on the design of intelligent methods to utilize every bit of information onboard aircraft wisely to deal with the instances.

There are three approaches to achieve safe FTC in standard flight conventions. First one is the fail operational systems which are made insensitive to any single point component failure. The second approach is the fail safe systems where a controlled shut down to a safe state is practiced whenever a critical fault is pointed out by a sensor. The level of degradation assures to switch to robust (alternate) or direct (minimal level of stability augmentation independent of the nature of the fault) mode. Switching from nominal mode to the robust and direct modes leads to a decrease in the available GNC functions. This causes a degradation in ease of piloting. And also some optimality conditions could have been compromised. The third approach is fault tolerant control systems in which redundancy in the plant and the automation system is employed to design software that monitors the components and takes in action whenever needed. The strategy is most probably to try to keep plant availability and accept reduced performance [5]. RECONFIGURE project of FP7 [6] aims to attack at this problem of piloting degradation and optimality compromisation by attacking Flight Parameter Estimation (FPE) which is the online estimation of aircraft parameters, FDD and FTC in case of off-nominal events [7] They utilize a black box nonlinear model of aircraft and The project uses some outputs of a previous FP 7 project ADDSAFE leaded by Deimos Space [8].

METHODS FOR FTCS

Since fault tolerant control is comprised of a set of different disciplines and a relatively new topic, the terminology is not solid. FDI could be a proper example to this ambiguity. In some works, it stands for Fault Detection and Isolation while in some other Fault Detection and Identification, which could also named after Fault Detection and Diagnosis, meaning that identification is added to Fault Detection and Isolation [9].

One of the first attempts to unify the terminology is carried out by IFAC SAFEPROCESS technical committee in 1996 and published by [10]. Fault, failure, and the methodology to handle those such as fault detection, fault isolation, fault identification, fault diagnosis and supervision terms explained separately to avoid the ongoing ambiguity in this field. Although fault detection methods are clearer in the work, difference between the methods for two steps of fault diagnosis, namely the fault isolation and fault identification is not very obvious.

Among different categorizations for the fault tolerance, there are options to handle faults on-line or off-line. Employing fault diagnosis schemes on-line is a way to achieve fault tolerance. In this case, as soon as a fault detected, a supervisory agent is informed via a discrete event signal. Then accommodation of the faults are handled either with the selection of a predetermined controller for the specific fault case, or by designing the action online with real-time analysis and optimization [5].

Another common categorization of FTCS is passive and active FTCS. In passive FTCS, the flight controller is designed in such a way to accommodate not only the disturbances but also the faults. Most of the times it a robust controller and does not require a diagnosis scheme. Active FTCS first distinguishes the fault via fault detection and diagnosis module and then switch between the designed controllers specific to the fault case or design a new one online [4]. While active FTCS requires more tools to handle faults as seen in Fig. 1, for faults not predicted and not counted for during the design of the robust controller, robust controller most probably fails.

Even with a long list of available methods, aerospace industry has not implemented FTC widely, except some space systems, due to the evolving nature of the methods, the tricks coming with the nonlinear nature of the problem, design complexity and high possibility of wrong alarms in case of large disturbances and/or modeling uncertainties. So the already carried reliability measures concerning the hardware redundancy is now the preferred way because of its ease and maturity being implemented on various critical missions with considering human lives.

FAULT DETECTION AND DIAGNOSIS

FDD is handled in two main steps; fault detection and fault diagnosis. Fault diagnosis encapsulates fault isolation and fault identification. The methods for detection and diagnosis are investigated for their frequency of utilization separately for sensor, actuator, process and controller faults in [10]. FDD should not only be sensitive to the faults but also robust to the model uncertainties and external disturbances.

Two distinct options to proceed in analytical redundancy are the model based approaches and data-driven approaches. They form the two ends of a continuous solution set line, so utilizing them in a combination might end up with better solutions. Model based fault diagnosis highlights the components of a system and the connections in-between, and their corresponding fault modes. Data driven fault diagnosis rely on the observational data and prefers dense, redundant and with a frequency larger than the failure rate.

This work constitutes the basis for our research on fault detection. The idea to simulate the data using the MAKO model given here first, rather than utilizing flight data, is to start small in order to isolate some probable consequences such as the probable effect of the controller on the diagnosis. Detection of faults from real data is a challenging goal to start with as can be seen in Figure 2 real data accelerometer readings showing that it seems impossible to classify in case of a Most of the FDI algorithms are implemented to openloop systems, ignoring the probable influences of the controller might cause on the detection performance [11]. Here the system is open-loop as well. So we follow a step by step approach and hope to end with a more realistic case in the future, in which real flight data is utilized and diagnosis is achieved on-line aside a functioning controller. Here we present a literature survey for FTC of drones followed by efforts to deliver a full drone simulation which will serve as an environment to simulate measurements. A MAKO simulation is given in Matlab script which is freely available though the GIT 1 platform, using specifications MAKO, stability derivatives, aerodynamic force derivatives generated by AVL.

METHODOLOGY AND SIMULATIONS

In this study, first, a model of an aircraft is simulated. This model, will not be used for the design of FDI algorithms, but instead will be utilized to test them. Nonlinear aircraft flight dynamics for translational and attitude motion can be given as a system of first order differential equations

ẋn = C n b v b (1) vb = 1 m ⇥ mg b + F b t + F b a ⇤ ! b b/n ⇥ v b (2) q0 = 1 2 q T ⌫ ! b b/n (3) q⌫ = 1 2 ⇣ q ⇥ ⌫ + q 0 I 3 ⌘ ! b b/n (4)
The stability derivatives and aerodynamic force coefficients are generated by AVL and given in Appendix A. AVL is an open source program developed at MIT and uses vortexlattice method for the aerodynamic and stability calculations. The output of the program is linearized at a selected condition, therefore all the coefficients are calculated around the equilibrium point at 14m/s cruise flight condition. The center of gravity is located at X CG = 0.295 m, which corresponds to a 8 % of positive static margin that has been flight tested. As an addition to the aerodynamic coefficients and stability derivatives, it is useful to have the moments of inertia of the aircraft so that one can use the model in a simulator. For that purpose, the aircraft is hanged by two strings, at different orientations, as shown in Figure 4, and measurements performed by timing the oscillation period for each axis. The resultant moment of inertias are given Table 1.

Further, the equations for calculation of forces and moments are given in Appendix B to simulate translational and rotational motion of a MAKO UAV.

The input vector can be written as u (t) 2 IR 3

u (t) = ⇥ a e n ⇤ T (7)
Here a aileron deflection angle in degrees, e elevator deflection angle in degrees, n engine speed in rev/s.

To validate the written translational and attitude motion dynamics and kinematics, MATLAB Simulink 6DOF block has been utilized. This block accepts inputs as the force and moment and outputs the states of aircraft motion Fig. 6. To compare the generated model and Simulink 6DOF block, forces and moments have been calculated via equations and constants given in Appendix A and Appendix B. The simulated states from the model script have been saved in advance and called from Simulink by From Workspace blocks then compared with the 6DOF outputs. The difference found to be negligible indicating the validity of the model.

When the actuators are healthy, actual control input signal will be equal to the given input signal. In case of a fault the actual signal can be modeled as

u (t) = Eu c + u f ( 8
)
where u c is the desired control signal, E = diag(e 1 , e 2 , e 3 ) is the effectiveness of the actuators where 0  e i  1 with (i = 1, 2, 3) and u f additive actuator fault.

This model makes it possible to simulate all four types of actuator faults shown in Fig. 5.

The measurements are simulated using the statistics of the hardware in the house. The sensor suit simulated is the InvenSense MPU-9250 Nine-axis (Gyro + Accelerometer + Compass) MEMS MotionTracking Device.

z gyro = k gyro ! b b/i + gyro + ⌘ gyro (9)
z acc = k acc ! b b/i + acc + ⌘ acc (10)
Here is the bias, and ⌘ is the zero mean Gaussian process with 2 variance and given in Table 5. For faulty and normal measurement values, drone model simulation which outputs the measurements as well should be run twice with different control surface input values. As an example, a faulty situation can be that even the controller gives an desired output of 4 degrees to the control surface, the control surface might have stuck at 1 degrees. Generated set of measurements can be visualized in feature space one by one. Such an example is the normalized accelerometer measurement components plotted Fig. 7.

It is always important to visualize the features to have a grasp of data structure. For that reason, available observations forms the 6-dimensional pattern space, z 2 IR 6 can be visualized in pairs to observe. There are further methods to visualize multidimensional data such as Tours methods [12,13,14], and GGobi data visualization system [15].

In this study, dimensionality reduction technique called Principle Component Analysis (PCA) is used for visualization. In PCA, the idea in general is to map the feature vector, x 2 IR n to a lower dimensional space where the new feature set will be represented by z 2 IR k . Fig. 8 shows the resulted most significant elements for a mapped feature space from six dimensional feature vector to two. The structure of the data gives insight for the selection of some parameters or kernels for the purpose of classification. Here, it seems that a linear kernel is satisfactory by discarding the outliers. Another point is that the classifier might need a nice tuning due the the presence of outliers. The learning phase utilizes data including outliers and preciseness to fit the model to each of the data might end up an overfitted model, resulting in worse performance to generalize to new data coming in the prediction phase.

CONCLUSION

In this work, first a review on fault tolerant control for UAVs is given by pointing out its importance on today's challenging task of safe integration of drones into airspace. Datadriven methods for fault diagnosis is aimed to avoid the burden of modeling each craft especially considering for small drones it is not very realistic for most of the applications to have an accurate model for a variety reasons such as cost. AVL program is used to generate the coefficients for MAKO and a full simulation is realized. Statistics of the sensor suite in house is used for simulation of accelerometer and gyro data. For a preliminary investigation on data, six dimensional feature space is mapped to two dimensions via PCA for visualization purposes. The data shows that a linear kernel might be satisfactory for the purpose of two class classification. Due to the presence of outliers, fine tuning or using optimization techniques could be needed to avoid overfitting or under fitting during the learning phase of the classification problem.

Pitch torque

M B = q S c C M (13)
C M = C Me e + C Mq q + C M↵ ↵ (14)
Yaw torque

N B = q S b C N (15)
C N = C Na a + C Np p + C Nr r + C N ( 16
) q = ⇢V 2 T 2 (17)
Lift force

Z w = q S C Z (↵) (18)
C Z (↵) = C Z0 + C Z↵ ↵ (19)
Drag force

X w = q S C Z (↵, ) (20)
C X (↵) = C X1 + C X k C 2 Z = C X1 + C X k (C Z1 + C Z↵ ↵) 2 (21) Lateral force Y w = q S C Y ( ) (22)
F T = ⇢n 2 D 4 C F T (24)
C F T = C F T 1 + C F T 2 J + C F T 3 J 2 (25)
J = V T n⇡D (26)

2- 1

 1 Statue of mermaid in Riga handling airspace (for fun) . . . . . . . . . 2-2 SORA structure: threats, threat barriers, hazard, harm barriers, harms 2-3 U-space illustration [20] . . . . . . . . . . . . . . . . . . . . . . . . . 2-4 Airspace design for small drone operations by Amazon [4] . . . . . . . 2-5 Fleet of Paparazzi equipped drones from ENAC UAV laboratory in a flight campaign with the Pyrenees in the background. Photo by Alexandre Bustico. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2-6 Paparazzi Autopilot System overview . . . . . . . . . . . . . . . . . . 2-7 Ground Control Station showing trajectories of 2 Unmanned Air Vehicle (UAV)s using the Traffic Collision Avoidance System (TCAS) system 2-8 Drone equipped with Paparazzi on a mission for meteorological studies by Meteofrance. Photo taken by Alexandre Bustico. . . . . . . . . . . 2-9 Front and back view of Apogee autopilot . . . . . . . . . . . . . . . . 2-10 Faults altering the system . . . . . . . . . . . . . . . . . . . . . . . . 2-11 Variations of fault tolerant control systems . . . . . . . . . . . . . . 2-12 Multiple model adaptive estimation algorithm [65] . . . . . . . . . . .

2- 16 5 - 3 5 - 4 5 - 6

 16535456 Photo taken by Alexandre Bustico. . . . . . . . . . . . . . . . . . . .

  N 1 previous measurements . . . . . 5-25 New feature matrix when spinors are used as features rather than gyro measurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 List of Tables 2.1 Comparison of popular open-source and commercial autopilots [9]. . . 3.1 Attitude parametrizations of the rotation group SO(3) [7] . . . . . . . 3.2 General specifications of MAKO [16] . . . . . . . . . . . . . . . . . . 3.3 Parameters of ETH drone [30] . . . . . . . . . . . . . . . . . . . . . . 3.4 Stability derivatives for ETH UAV [30] . . . . . . . . . . . . . . . . . 3.5 Stability derivatives for MAKO extracted from AVL program at 14m/s equilibrium cruise speed [16] . . . . . . . . . . . . . . . . . . . . . . . 3.6 Aerodynamic force derivatives for ETH UAV [30] . . . . . . . . . . . 3.7 Aerodynamic force derivatives for MAKO extracted from AVL program at 14m/s equilibrium cruise speed[16] . . . . . . . . . . . . . . . . . . 3.8 Thrust force coefficients for propeller ETH UAV [30] . . . . . . . . . 3.9 Thrust force coefficients for propeller APC SF 9 ⇥ 6 from wind tunnel experiments [15] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Specifications of the sensor suit InvenSense MPU-9250 Nine-axis (Gyro + Accelerometer + Compass) MEMS MotionTracking Device[21] . . . 4.1 Machine learning terminology . . . . . . . . . . . . . . . . . . . . . . 4.2 Training set (x, y) of housing prices -one-feature example . . . . . . 4.3 Training set (x, y) of housing prices -multi-feature example . . . . . 5.1 Nominal phase start stop indexes of the flight . . . . . . . . . . . . . 5.2 Faulty phase start stop indexes of the flight . . . . . . . . . . . . . .

  , M., & Delahaye, D. (2017, September). Fault detection & diagnosis for small UAVs via machine learning. In Digital Avionics Systems Conference (DASC), 2017 IEEE/AIAA 36th (pp. 1-6). IEEE, • Baskaya, E., Bronz, M., & Delahaye, D. (2017, September). Flight Simulation of a MAKO UAV for Use in Data-Driven Fault Diagnosis. In IMAV 2017, 9th international microair vehicle conference, • Baskaya, E., Manfredi, G., Bronz, M., & Delahaye, D. (2016, September). Flexible open architecture for UASs integration into the airspace: Paparazzi autopilot system. In Digital Avionics Systems Conference (DASC), 2016 IEEE/AIAA 35th (pp. 1-7). IEEE.

Chapter 5

 5 focuses on fault classification results under two main sections: first, the classification of faults based on simulated flight measurements; and second, the classification of faults based on real flight data. In the first part, flight data is simulated using the mathematical equations explained in Chapter 3. The SVM algorithm is trained with the simulated data in order to classify the faulty and nominal phases of the simulated flight. The second part commences with explanations on realized faulty flight experiments. Paparazzi autopilot has been modified to introduce faults to control surfaces during flight. Then, the classification of the control surface stuck fault and the loss of effectiveness fault are investigated separately.

Figure 2 - 1 :

 21 Figure 2-1: Statue of mermaid in Riga handling airspace (for fun)

  While mentioning the efforts by different organizations to accommodate drones in airspace, we examine the present regulatory context from European and international perspectives. The ICAO is a United Nations Organization working with 191 Member States of the Chicago Convention (Convention on International Civil Aviation) and global aviation organizations. At the present time, the international circulation of drones is not allowed by Article 8 of the Chicago Convention [51]. Starting in 2003, the ICAO began a study on the Standards and Recommended Practices (SARPs)

Figure 2 - 2 :

 22 Figure 2-2: SORA structure: threats, threat barriers, hazard, harm barriers, harms

  Paparazzi Autopilot System provides a software and hardware solution for lowcost mini and micro unmanned air vehicles. A fleet of Paparazzi equipped drones can be seen in Fig. 2-5. This began as a personal project in 2003 by Pascal Brisset and Antoine Drouin, and afterwards gained the support of ENAC in 2005. Being one of the first (if not the first) open-source autopilot system in the world, Paparazzi has attracted much attention, and has led others to start new branches and systems. The software is originally

Figure 2 - 5 :

 25 Figure 2-5: Fleet of Paparazzi equipped drones from ENAC UAV laboratory in a flight campaign with the Pyrenees in the background. Photo by Alexandre Bustico.

  Paparazzi is to support multi-UAV flights (Figure 2-7). Several projects have been using Paparazzi Autopilot System because of this additional feature. The communication with each vehicle is established by the ground control station, however air-to-air communication between flying vehicles and the internal relay of information to the ground control station is being implemented (for a future version). Modules are the easiest and most flexible way of adding new code into Paparazzi.

Figure 2 - 6 :

 26 Figure 2-6: Paparazzi Autopilot System overview

Figure 2 - 7 :Figure 2 - 8 :

 2728 Figure 2-7: Ground Control Station showing trajectories of 2 UAVs using the TCAS system

Figure 2 - 9 :

 29 Figure 2-9: Front and back view of Apogee autopilot

Figure 2 - 10 :

 210 Figure 2-10: Faults altering the system

Fault

Figure 2 - 11 :

 211 Figure 2-11: Variations of fault tolerant control systems

Figure 2 - 12 :

 212 Figure 2-12: Multiple model adaptive estimation algorithm[START_REF] Mikel | Modified multiple model adaptive estimation (m3ae) for simultaneous parameter and state estimation[END_REF]

x 1 x 2 x 3 x n y Figure 2 - 13 :

 y213 Figure 2-13: Schematics of perceptron. The perceptron is a composition of several neurons [96]. x 1 to x n are the features and y is the output.

Figure 2 - 14 :

 214 Figure 2-14: Mark 1 perceptron: the first custom-built hardware implementation of the perceptron. It is designed for image recognition with an array of 400 photocells connected to the "neurons" randomly. Potentiometers are used to encode the weights, and electric motors update the weights during learning [11].

Figure 2 - 16 :

 216 Figure 2-16: Autonomous helicopter from Stanford University learns to fly acrobatic maneuvers using RL in autopilot[START_REF] Andrew | Shaping and policy search in reinforcement learning[END_REF]

  Autopilot which is used in this thesis and the advantages of open-source systems to aid drone integration into the airspace. Then, fault tolerant control systems are introduced with a focus on fault detection and diagnosis. Two main methods, model-based and data-driven, are discussed via reference to the literature. Then, general advancements in artificial intelligence (AI) are addressed, since one of its techniques -machine learning -is used as the methodology to detect the faults in this thesis.

  is presented in detail. Equations of rotation and translation motion are driven for generic aircraft. Then, calculation of forces and moments, which are required to solve those equations, are given for two types of drones (the aerodynamic force derivatives and stability derivatives are specific for each drone). These two examples of drones are by ETH Zurich and MAKO (used in ENAC UAV LAB). In this thesis, drone motion is simulated to generate data. The accelerometer and gyro data are generated for MAKO model, considering the specifications of IMU InvenSense MPU-9250 Nine-axis used in Paparazzi Autopilot Apogee onboard. The models derived here are not used in detection and diagnosis algorithms. The detection and diagnosis algorithms implemented in this thesis only use data.

Figure 3 - 1 :

 31 Figure 3-1: Attitude representation is simply specifying the orientation of aircraft body axes b 1 , b 2 , b 3 in the reference frame A

C 11 C 12 C 13 C 11 C 12 C 13 C 11 C 12

 1112131112131112

Figure 3 - 2 :

 32 Figure 3-2: Euler angle sequence[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

  Taking the time derivative with respect to frame A:

Figure 3 - 3 :

 33 Figure 3-3: Rigid body rotating about an arbitrary point O, given in the N frame

Figure 3 - 4 :

 34 Figure 3-4: Body frame B attached to the rigid body, given in the inertial frame N

  writing the forces in more detail gives : are the equations of motion of the aircraft.

Figure 3 - 5 :

 35 Figure 3-5: Body fixed frame and North East Down (NED) frame representations

Figure 3 Figure 3 - 7 :

 337 Figure 3-6: MAKO

Figure 3 - 8 :

 38 Figure 3-8: Wind frame, airspeed vector VT , angle of attack ↵ and side slip angle representation[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

Figure 3 - 9 :

 39  Relation revealed between the inertial velocity vector v, airspeed vector V T and wind disturbance W[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

  B/N B, and translational acceleration vB given by the system of equations of a drone summarized in Equ. 3.95 and the specifications of the hardware used in Apogee Autopilot of Paparazzi Autopilot System. The sensor suit simulated is the InvenSense MPU-9250 Nine-axis (Gyro + Accelerometer + Compass) MEMS MotionTracking Device.

[

  103]:• A total control loss of the control surface actuators. The actuator does not respond to the control signals at all. Lock-in-place, hard-over and floating around trim are such failures (see Fig.3-10).;• A partial control loss of the control surface actuators. The actuator does respond to the control signals but does so in an abnormal way. Loss of effectiveness failure is shown in Fig.3-10.

Figure 3 - 10 :

 310 Figure 3-10: Probable actuator faults [30]. (a) Loss of effectiveness: The actuator does respond to the control signals but does so in an abnormal way such as low actuation level or low response time. (b) Lock-in-place: A total control loss of the control surface actuators. The actuator freezes at a particular position. (c) Hardover: A total control loss of the control surface actuators. The actuator freezes at the minimum or maximum position limit. (d) A total control loss of the control surface actuators. Actuator does not contribute to the control authority.

  to an individual drone, are presented (aerodynamic force derivatives and stability derivatives are specific for each drone). For two different drone examples, a drone from ETH Zurich and MAKO (used in ENAC UAV LAB), and the calculation of forces and moments are given. Those forces and moments are inputs to the dynamic equations of motion. The models derived here are not used in detection and diagnosis algorithms. The detection and diagnosis algorithms used in this thesis use data only. The need for data is the driving factor to simulate the drone motion, thus, data is simulated using the MAKO drone model and specifications of IMU InvenSense MPU-9250 Nine-axis used in Paparazzi Autopilot Apogee onboard.In this thesis, the diagnosis is implemented on two types of data: first, simulated data, and second, flight data. If the reader is not interested in detection and diagnosis via simulated data, it is not essential to read this chapter since it explains the models that are used to simulate measurements. Despite this, having background information on the physics of the system may help to understand the features (translational acceleration and angular velocities) used in both model-based and data-driven fault diagnosis.

Figure 4 - 1 :

 41 Figure 4-1: Common machine learning methodologies

Figure 4 - 3 :Fig. 4 -

 434 Figure 4-3: Regression example -Housing prices as a function of surface area of the house [69]

1 Figure 4 - 4 :

 144 Figure 4-4: Classification example

Figure 4 - 5 :

 45 Figure 4-5: Classification example -output vs input

Figure 4 - 6 :

 46 Figure 4-6: Classification example of complex decision boundaries[START_REF] Ng | Machine learning lectures[END_REF]

( 2 N

 2 Divide the data set into three and calculate the test set error for each different selection of model) Use 2nd or 3rd order feature mapping x 2 1 , x 1 x 2 , x 1 x 3 , . . . , x 1 x 100 , x 2 2 , x 2 x 3 , . . . , x 2 3 , x 3 x 4 , . . . or x 3 1 , x 1 x 2 x 3 , x 2 1 x 2 , . . . , x 11 x 12 x 13 , . . .

Figure 4 - 8 :Figure 4 - 9 :

 4849 Figure 4-8: Simplified guide for feature mapping 111

  vector ✓ is calculated to minimize the cost function J training (✓). Now, since the best model is not known, it is also necessary to find the best d to minimize the cost function. Since now there are two parameters to fit, ✓ and d, three different sets of data are necessary for training, tuning and evaluation. Similar to the case where training and evaluating the model with the same data (for a given model) may lead to a biased evaluation, the added necessity to also select (or tune) the model also requires an extra set of data. These three separate sets of data are called training, cross-validation and test sets.So, the idea is to have different subsets of data to train the model (calculating ✓), to select the model structure and to evaluate the selected model structure and its corresponding parameter set. In order to do that, three distinct data sets are needed, as shown in Fig. 4-10, to train parameters ✓, to select the model structure d and to associate an error value with the chosen model. Then, the model structure d which yields the smallest J cv (✓ (d)

Figure 4 - 10 :

 410 Figure 4-10: Model selection guide

4 . 25 :

 425 Data Set (whole data given)

3 Figure 4 - 11 :

 3411 Figure 4-11: Training and evaluating the classifier

1 :m 7 :

 17 function GradDesOneFeat(X, y, theta_init, alpha, num_iters) . Inputs: X -training inputs, y -training outputs, theta -parameters, 2: alpha -learning rate, num_iters -number of iterations (termination condition) = length(y) . Number of training examples 6: for j = 1 to iter_num do . Do until satisfied for j = 1 to m do . Do for all training examples 8:

  end functionThe conventional approach is to assign an initial value to ✓ is to set ✓ init = 0. It is important to know that for different initial values, ✓ might converge to different values (local minima but not the global one), as in Fig.4-12. However, for linear regression, it is shown that the cost function shown above is convex, meaning that it has only one global minima with no other local minima. An example of the cost function converging to different solutions depending on initialization is given in Fig.4-12. A slightly different choice of ✓ init might lead to a convergence to the local minima, where J(✓) is smaller compared to local changes in ✓, but J(✓) is still not at its global minimum.

Figure 4 - 12 :

 412 Figure 4-12: Gradient descent convergence dependance on ✓ init . Two different but close choices of ✓ init might converge to local or global minima [69].

Figure 4 - 13 :Fig. 4 -

 4134 Figure 4-13: Underfitting, satisfactory or overfitting model examples (left to right)

- 14 .Figure 4 - 14 :

 14414 Figure 4-14: Diagnosing machine learning problem by plotting training and cross-validation errors

x 2 x 2 x 1 x 1 Figure 4 - 15 :

 1415 Figure 4-15: SVM working principle:The aim of SVM is to find an optimal hyperplane maximizing the margin, which is the distance in between the boundaries, by extending them until hitting the first data points (support vectors)

Figure 4 - 16 :

 416 Figure 4-16: Convergence of the objective function

  approaches such as neural networks, C (box constraint) and (kernel scale), are tuned. The classifier is trained with the training set and tuned via the cross-validation set, and then the selected classifier is evaluated with the test set. The cross-validation set selection of Matlab uses a random selection over the data set. To compare different methodologies for tuning and also the untuned classifiers, the script has been revised to generate random values from the same seed value to be consistent in comparisons. Box constraint (C) and kernel scale ( ) are tuned considering the presence of the outliers to generalize the distribution of the data rather than resulting in fine fits for each individual datum in the training set.

Figure 4 - 17 :Figure 4 - 18 :

 417418 Figure 4-17: Objective function values for different box parameter and sigma values

Figure 4 - 19 :Figure 4 -

 4194 Figure 4-19: Final results for the optimization, time of execution, optimal values of box constraint and sigma values

  main branches of machine learning -supervised and unsupervised learning -are introduced. Terminology and construction of input and output vectors are presented using easy examples of regression and classification. Regression and classification are two common problems discussed under supervised learning problem. The problems that are frequently encountered during machine learning applications are discussed and best practices to achieve more accurate results are presented.After this generic introduction to machine learning implementations, Support Vector Machines (SVM) are discussed. A very brief section explains their mathematical background and then application procedures are presented.The next chapter explains the simulation results by applying SVM to drone flight data. First, results from the application of SVM to simulated measurements are presented. Then, SVM is applied to flight data. To be precise on how the data is generated, the injection of faults during flight, and the modifications to the Paparazzi autopilot in order to realize the faults, are explained in detail.Chapter 5 Simulation ResultsThis chapter focuses on the results of fault classification simulations under two main sections: classification of faults based on simulated flight measurements and classification of faults based on real flight data. In the first part, flight data simulation uses the mathematical equations explained under mathematical modeling chapter of this thesis. The second part commences with a thorough explanation of the path taken to generate faults in real flight for two reasons: first, the importance of having knowledge on data, how it is generated/labeled; and second, constructing a guide for researches so that they can realize their own faulty flight campaigns. Following this, the classification for the control surface stuck fault and the loss of effectiveness fault are investigated separately.

Figure 5 - 1 :

 51 Figure 5-1: Loss of effectiveness fault simulation in aileron command and corresponding accelerometer x axis measurement

Figure 5 - 2 :Figure 5 - 3 :Figure 5 - 4 :

 525354 Figure 5-2: Accelerometer simulation a x vs a y

Figure 5 - 5 :Figure 5 - 6 :Figure 5 - 7 :

 555657 Figure 5-5: Feature matrix X 2 IR m⇥6 is comprised of accelerometer and gyro data of m instances

Fig. 5 -

 5 Fig. 5-8 shows the GCS view with the fault settings open. This pane can be found under Settings > FAULT as highlighted in pink in Fig. 5-8. The four-row configuration represents, from top to bottom, the multiplicative error in the right elevon, the multiplicative error in the left elevon, the additive error in the right elevon, and finally, the additive error in the left elevon. The nominal condition where there is no fault, is given by [ right lef t right_of f set lef t_of f set ] = [ 1.0 1.0 0 0 ]. This configuration allows the user to realize all types of actuator faults, such as control surface inefficiency or stuck. To generate the fault of the right elevon stuck at

Figure 5 - 9 :Figure 5 - 10 :

 59510 Figure 5-9: SETTINGS Message saves the multiplicative and additive fault values inserted from the GCS. [1.0 1.0 0.0 0.0] corresponds a command from the GCS to revert back to nominal phase

Figure 5 - 11 :

 511 Figure 5-11: Modifications on the control modes of Paparazzi autopilot

Figure 5 - 12 :

 512 Figure 5-12: Conversion of raw flight data saved to SD card onboard to .data file to be used in further calculations

Figure 5 - 13 :

 513 Figure 5-13: The flying-wing: ZAGI

Figure 5 -

 5 Figure 5-14: A piece of the flight data corresponding to nominal and two different fault phases of the flight. SETTINGS message exists only if there is a change in the multiplicative and additive fault parameters via GCS. The first data in each row corresponds to the time stamp. Second data in each row is the aircraft number which is 52 for this flight. Third data in each data line corresponds to the label of information in that line. As an example, on the last line, the label is IMU_ACCEL. This means that this line gives accelerometer readings. Last three data in this line are accelerometer x-axis (-1.187500), accelerometer y-axis (-0.916992) and accelerometer z-axis (-1.717773) readings.

Figure 5 - 15 :

 515 Figure 5-15: SETTINGS message corresponding to stuck of right control surface

Figure 5 - 16 :

 516 Figure 5-16: Indexing SETTINGS, to find the fault and nominal flight intervals, indexing GYRO measurements to AND with FAULT indexes to find the indexes of faulty gyro measurements

  simulations have been executed on HP Z820 Workstation with 3.1 GHz, 32 cores. This work investigates only binary classification, rather than multi-class classification considering multiple different faults. However, different faulty cases have been studied to further attack the problem of multi-class classification in future studies. The classifier's abilities in different fault conditions have been investigated. The main two types of faults of interest in this study are the control surface stuck fault and the LOE. The flight data 4 and code 5 that have been developed are publicly available under Github.

Figure 5 - 17 :

 517 Figure 5-17: Accelerometer readings along x-direction during flight interval just before control surface stuck (nominal, represented with blue) and during control surface stuck at 0°until the safety pilot's intervention

Fig. 5 -Figure 5 - 18 :

 5518 Figure 5-18: Accelerometer readings along x-direction during flight interval before control surface stuck (nominal, represented with blue) and during control surface stuck at 0°until the safety pilot's intervention

Fig. 5 -

 5 Fig. 5-19 and Fig. 5-20 show the accelerometer measurements along z-direction and angular velocities along x-direction during a short time interval. Here, although an average of faulty measurements would result in an obvious difference, individual measures might correspond to the nominal phase of the flight as well.

Figure 5 - 19 :Figure 5 - 20 :Figure 5 -Figure 5 -

 51952055 Figure 5-19: Accelerometer measurements along z direction a z for faulty and nominal flight data

Figure 5 - 23 :

 523 Figure 5-23: One of the features (accelerometer x-axis) of the original feature matrix (given in Fig. 5-5) before adding extra features

Figure 5 - 25 :

 525 Figure 5-25: New feature matrix when spinors are used as features rather than gyro measurement

6 Conclusion

 6 detection and diagnosis problem. Fault classification simulations are explained under two main sections: classification of faults based on simulated flight measurements; and the classification of faults based on real flight data.The first part of this chapter gives the results of SVM classification on data generated from simulations. To simulate the data, equations of motions given in Nonlinear Aircraft Model have been numerically solved for the states. Then sensor measurements (accelerometer and gyro data) have been calculated using the states and the specifications of the sensors. Generated data is usually more structured compared to the real flight data. In this preliminary application of SVM to fault diagnosis,ChapterThe integration of drones into the airspace demands the introduction of innovative designs to provide safe solutions for drones. One aspect of this issue is to ensure safe flight by designing fault detection and diagnosis systems with less expensive avionics, common in a vast number of drones. This work aims to design a classifier via SVM to solve FDD for drones with actuator faults. For that purpose, we introduce an end-to-end design to achieve data-driven fault diagnosis for the control surface faults in drones. All the data and the software code are available in the code sharing and versioning system Github.Inthis thesis, fault classification simulations are investigated under two main sections: first, the classification of faults based on simulated flight measurements; and second, the classification of faults based on real flight data. We started with the easier problem: classification of faults based on simulated flight measurements. For the classification problem using data generated by simulations, a model of a MAKO Unmanned Aerial Vehicle (UAV) is simulated. Sensor measurements (accelerometer and gyro data) are simulated using the information on the drone's motion and the specifications of the real sensors. Generated data is usually more structured compared to real flight data. There are no flight control loops involved in the model: discarding the controller's effect eases the diagnosis. The results show that the SVM classifier is accurate and fast in diagnosing the fault on the control surfaces, with a classification accuracy of 10 5 . Next, fault detection with real flight data is investigated. Since SVM is a supervised classification method, labeled data is necessary in order to train the algorithm. For this reason, real flights are arranged to generate faulty flight data by manipulating the open source autopilot, Paparazzi. Training is held offline due to the need for labeled data and the computational burden of the tuning phase of the classifiers. Two types of faults are the focus of the investigation: a stuck elevon fault and the loss of effectiveness of the elevon. Results indicate that the control surface stuck fault can be detected relatively easily with three gyros and three accelerometer measurements, compared to the loss of effectiveness fault. The results show that over the flight data, tuned SVM yields an F1 score of 0.98 for the classification of control surface faults.

  In this work, to express vectors in different frames is necessary which makes the use of DCM essential. C b n transforms the vector A expressed in the navigation frame A n into A b , a vector expressed in the drone body-fixed frame.A b = C b n ⇤ A n -->in the code : c_n_to_b Likewise a direction cosine matrix C n b , changes the representation of vector A expressed in drone body-fixed frame A b , to a representation of the same vector A in navigation frame(NED) A n . A n = C n b ⇤ A b and beware the relationship between these to transformation: C n b = inverse(C b n ) = transpose(C b n ) TIPS AND TRICKS: Forces and Moments in the dynamical equations of motion for the attitude and translational motion, are calculated in modelDrone. During the numerical integration of dynamic and kinematic equations (more specifically during the function evaluations for calculating k1 k2 k3 k4), modelDrone is evaluated with different states (due to the nature of RK4). Since forces and moments are calculated in this model, beware that they are evaluated with different state values, since they are modeled as a function of states, ending up the change of forces and moments during one time step of numerical integration.

Fig. 1 .

 1 Fig. 1. Variations of fault tolerant control systems

Fig. 2 .

 2 Fig. 2. Common actuator faults (1)

Fig. 3 .

 3 Fig. 3. Loss of effectiveness fault simulation in aileron command and corresponding accelerometer x axis measurement

Fig. 4 .

 4 Fig. 4. Principal component analysis for visualization of faulty and normal data in reduced dimensional feature space

1 Fig. 5 .

 15 Fig. 5. SVM working principle

Fig. 7 .

 7 Fig. 6. Supervised learning basics

  III. THE PAPARAZZIUAV PROJECT The Paparazzi Autopilot System aims to provide a software and hardware solution for low-cost mini and micro unmanned air vehicles. It is started as a personal project in 2003 by Pascal Brisset and Antoine Drouin, and afterwards supported by ENAC in 2005. Being one of the first (if not the first) opensource autopilot system in the world, Paparazzi has attracted attention and led the others to start new branches and systems.

  ). Several projects have been using Paparazzi Autopilot System because of this additional feature. The communication of each vehicle is being transmitted to the ground control station directly on the current version, however air to air communication between flying vehicles and internal relay of information to ground control station is being implemented for a new coming version. Modules are the easiest and most flexible way of adding new code into Paparazzi. There are over 130 modules written for Paparazzi by several developers and researchers including subjects on meteorology, imagery, surveillance, advance navigation, formation flight and collision avoidance, etc... Paparazzi has its own complete flight plan language, where the user can define any possible trajectory by existing commands such as circle, line, hippodrome, figure-eight, survey, etc... Additionally any function, written in C language, can be called from the flight plan and executed. This opens up a

Fig. 1 .

 1 Fig. 1. Paparazzi autopilot system overview.

Fig. 2 .

 2 Fig. 2. Ground Control Station showing trajectories of 2 UAVs using the TCAS system

Figure 1 :

 1 Figure 1: Variations of fault tolerant control systems

Figure 2 :

 2 Figure 2: Accelerometer data readings a x vs a y

J

  !b b/n = M ! b b/n ⇥ J! b b/n (5)1 https://github.com/benelgiz/curedRone/tree/MAKOmodel

Figure 3 : MAKO where x n 2

 32 Figure 3: MAKO

Figure 4 :

 4 Figure 4: Moments of inertia measurements for each axis, I xx , I yy , I zz .

Figure 5 :Figure 6 :Figure 7 :

 567 Figure 5: Common actuator faults [3]

Figure 8 :

 8 Figure 8: Reduced feature space z 1 vs z 2

Table 2 .

 2

	Latest	stable	re-	lease	21-	06-16	06-	08-16
	Collision	Avoid-	ance	UAV	TCAS	none
			Geofencing			3-D	3-D
			Path Definition			Formula Based	Circles Lines Patterns	Circles Lines Patterns
		Multi Flight	UAV Plan		yes scriptable	yes scriptable	alpha scriptable
			Hardware			varied	specific	varied
			Vehicle type			Fully configurable	Fully configurable	Copter Plane Rover
			Open-Source			Paparazzi	PixHawk	Ardupilot

1:

Comparison of popular open-source and commercial autopilots

[9]

.

Table 3 .

 3 1: Attitude parametrizations of the rotation group SO(3)[7]

		Number of
	Representation parameter set	Properties
			Minimal set
			Clear physical interpretation
			Often computed directly
	Euler angles	3	Trigonometric functions in rotation matrix
			No simple composition rule
			Singular for certain rotations
			Trigonometric functions in kinematic relation
			Easy orthogonality of rotation matrix
			Bilinear composition rule
			Not singular at any rotation
	Quaternions	4	Linear kinematic equations
			No clear physical interpretation
			One redundant parameter
			Simple kinematic relation
			Minimal set
	Gibbs vector	4	Clear composition rule
			Singular for certain rotations
			Simple kinematic relation

and dynamic equations. The kinematic equations provide the relationships between

Table 3 . 2

 32

	Parameter	Value	Definition
	Wing span (b)	1.288	[m]
	Wing surface area (S)	0.27	[m 2	]
	Mean aero chord (c)	0.21	[m]
	Take-off mass (m)	0.7 2.0	[kg]
	Flight velocity	10 25	[m/s]
	I I I	xx yy zz	0.02471284 0.015835159 0.037424499	[kg • m 2 [kg • m 2 [kg • m 2	] ] ]

: General specifications of MAKO

[16]

Table 3 .

 3 3: Parameters of ETH drone[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

	Parameter		Value	Definition
	Wing span (b)		3.1	[m]
	Wing surface area (S)		1.80	[m 2	]
	Mean aero chord (c)		0.58	[m]
	Take-off mass (m)		28	[kg]
	Propeller diameter (D)		28	[m]
	Time constant of the engine (⌧	n )	28	[m]

Table 3 .

 3 4: Stability derivatives for ETH UAV[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

	65)

a2 are the aileron deflections, e1 , e2 are the elevator deflections, a

Table 3 .

 3

	Parameter	Value	Definition
	C C C C C	La L p L r L M 0	0.1956 ⇥ 10 2 4.095 ⇥ 10 1 6.203 ⇥ 10 2 3.319 ⇥ 10 2 0	roll derivative roll derivative roll derivative roll derivative pitch derivative
	C C	Me M q	0.076 ⇥ 10 1 1.6834	pitch derivative pitch derivative
	C C	M↵ N 0	32.34 ⇥ 10 2 0	pitch derivative yaw derivative
	C C C C	Na N p N r	0.0126 ⇥ 10 2 4.139 ⇥ 10 2 0.1002 ⇥ 10 1	yaw derivative yaw derivative yaw derivative

5: Stability derivatives for MAKO extracted from AVL program at 14m/s equilibrium cruise speed [16] N 2.28 ⇥ 10 2 yaw derivative

Table 3 .

 3 6: Aerodynamic force derivatives for ETH UAV[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

	Parameter	Value	Definition
	C C	Z 0 Z↵	1.29 ⇥ 10 2 3.25	lift derivative lift derivative
	C C C	X 1 X↵ X ↵2	2.12 ⇥ 10 2 2.66 ⇥ 10 2 1.55	drag derivative drag derivative drag derivative
	C C	X 2 Y	4.01 ⇥ 10 1 3.79 ⇥ 10 1	drag derivative side force derivative
	Table 3.7: Aerodynamic force derivatives for MAKO extracted from AVL program at
	14m/s equilibrium cruise speed[16]
	Parameter	Value	Definition
	C C	Z 0 Z↵	8.53 ⇥ 10 2 3.9444	lift derivative lift derivative
	C	Zq	4.8198	lift derivative
	C C C C C C C	Ze X 0 X k Y Y p Y r Ya	1.6558 ⇥ 10 2 2.313 ⇥ 10 2 1.897 ⇥ 10 1 2.708 ⇥ 10 1 1.695 ⇥ 10 2 5.003 ⇥ 10 2 0.0254 ⇥ 10 2	lift derivative drag derivative drag derivative side force derivative side force derivative side force derivative side force derivative

Table 3 .

 3 8: Thrust force coefficients for propeller ETH UAV[START_REF] Guillaume | Fault-tolerant flight control and guidance systems: Practical methods for small unmanned aerial vehicles[END_REF]

	Parameter	Value	Definition
	C C C D F T 1 F T 2 F T 3	8.42 ⇥ 10 2 1.36 ⇥ 10 1 9.28 ⇥ 10 1 0.79 m	thrust derivative thrust derivative thrust derivative propeller diameter
	Table 3.9: Thrust force coefficients for propeller APC SF 9 ⇥ 6 from wind tunnel experiments [15]
	Parameter	Value	Definition
	C C C D F T 1 F T 2 F Trpm	1.342 ⇥ 10 1 1.975 ⇥ 10 1 7.048 ⇥ 10 6 0.228 m	thrust derivative thrust derivative thrust derivative propeller diameter

Table 3 .

 3 10: Specifications of the sensor suit InvenSense MPU-9250 Nine-axis (Gyro + Accelerometer + Compass) MEMS MotionTracking Device[21]

	Measurement
	z	accx	0.142	0.0319
	z	accy	0.3	0.0985
	z	accz	0.19	0.049
	z	gyro	1.55	0.0825
		x
	z	gyro	1.13	0.1673
		y
	z	gyro	1.7	0.2214
		z

Table 4 .

 4 1 shows representations of commonly used variables in machine learning. Although representations may differ from one reference to the other, we follow one coherent representation throughout this paper (see Table4.1).

			New
	Training Data Set	Learning Algorithm	Input	Hypothesis	Output
	Training Phase		Prediction Phase
		Figure 4-2: Supervised learning basics
		Table 4.1: Machine learning terminology
	x	input variable or feature
	y X y	output variable or target variable input variable vector or feature vector output variable vector or target variable vector
	m	number of training examples
	n	number of features
	i	index of training examples
	j	index of features
	x (i) j y (i) h ✓ (x) hypothesis function (model) i th training example for feature j i th training output
	✓ J(✓)	parameter set cost function

Table 4 .

 4 2: Training set (x, y) of housing prices -one-feature example training example index (i) Size in feet 2 (x) Price in 1000$s (y)

	1	2104	460
	2	1416	232
	3	1534	315
	4 . . .	852 x (i)	178

Table 4 .

 4 3: Training set (x, y) of housing prices -multi-feature example

	training example index (i)	Size feet 2 (x (i) in 1 )	Number of bed-rooms
			(x

Table 5 .

 5 1: Nominal phase start stop indexes of the flight

	nominal phase number nominal start nominal_start_stop(1,:) 516919 551627 755227 824545 • • • 2 3 4 5 • • •	12 1048055
	nominal stop nominal_start_stop(2,:) 521965 622015 782580 924704 • • •	1065548

Table 5 .

 5 3: Untuned and tuned via heuristic approach and tuned via Bayesian opti-

	mization SVM classification evaluations
		Untuned	Untuned	Tuned heuristic	Tuned Bayesian
		linear	Gaussian	Gaussian kernel	Gaussian kernel
		kernel	kernel
	kernel scale	1	1	2.1187	10.3581
	box constraint 1	1	1	1323.1
	margin	10.5927	2.0248	2.4763	5.3004
	edge	10.5875	2.0245	2.4761	5.3004
	kFoldLoss	0.2 x 10 2 1.2 x 10 3	7.571 x 10 4	1.2 x 10 3
	precision	0.76	1	1	0.913
	recall f1Score	0.8261 0.7917	0.8696 0.9302	0.913 0.9545	0.913 0.913
	comp. time	3.75s	3.4s	5917.5s	1784.7s

Table 5 .

 5 4: Untuned and tuned via heuristic approach and tuned via Bayesian opti-

	mization SVM classification evaluations
		Untuned	Tuned	Tuned
		24 features	Heuristic	Bayesian Opt.
			24 features	24 features
	kernel scale	1	6.0609	67.33
	box constraint 1	10	47330
	margin	1.9733	3.6353	5.6484
	edge	1.9678	3.6317	5.6404
	kFoldLoss	5.6 x 10 3 3.44 x 10 4	6.19 x 10 4
	precision	1	1	1
	recall f1Score	0.2632 0.4167	0.8947 0.9444	0.8421 0.9143
	comp. time	12.4s	5581.9s	1205.2s

Table 5 .

 5 5: Untuned and tuned via heuristic approach and tuned via Bayesian optimization SVM classification evaluations 10 2 5.19 x 10 2 5.33 x 10 2 3.84 x 10 2 3.7 x 10 2 5.33 x 10 2

	Tuned	Bayesian	24 features	%60 test/-	training	2 4 . 9 7 6 9		8 5 . 3 2 6 3			4.7728	4.7734	7.3421 x 10 4	0.92	0.92	0.92	235.671s
	Tuned	Heuristic 24	features %60	test/training		4 . 7 5 7 7		1 0			3.7267	3.7270	5.5 x 10 4	1	0.96	0.9796	2924.3s
	Untuned	Heuristic 24	features %60	test/training		1		1			1.9685	1.9691	5.4 x 10 3	1	0.22	0.3607	8.5s
	Tuned	Bayesian 24	features			2 4 . 9 0 2 6		9 1 7 2 . 9			5.8651	5.8651	6.8 x 10 4	1	1	1	1061s
	Tuned	Heuristic 24	features			5 . 5 1 5 4		1 0			4.0001	3.99	4.8 x 10 4	1	1	1	5853.3s
	Untuned	24 features				kernel 1	scale	box 1	con-	straint	margin 1.9697	edge 1.9680	kFoldLoss 5.5 x 10 3	precision 1	recall f1Score 0.1739 0.2963	comp. 11.3s	time

Table 5 .

 5 7: %40 Loss of efficiency fault in both elevon classification results with Gaussian kernel for two different number of nominal data sets 10 2 4.62 x 10 2 4.73 x 10 2 19.01 x 10 2 18.87 x 10 2 20.61 x 10 2

		Untuned	Tuned	Tuned	Untuned	Tuned	Tuned
			Heuristic	Bayesian		Heuristic	Bayesian
				Opt.			Opt.
	⇠15min f1Score NaN	⇠15min 0.1235	⇠15min 0.0111	⇠3min 0.2712	⇠3min 0.2756	⇠3min NaN
	kFoldLoss 4.76 x precision NaN	0.66	0.27	0.7109	0.6992	NaN
	recall	0	0.0681	0.0057	0.1679	0.1716	0

Table 5 .

 5 8: %40 Loss of efficiency fault in left elevon classification results with Gaussian kernel for 24 -120 -300 features cases

			Tuned		Tuned		Tuned
		Untuned	Heuris-	Untuned	Heuris-	Untuned	Heuris-
			tic		tic		tic
		24	24	120	120	300	300
	f1Score	0.1375	0.6414	NaN	0.9635	NaN	0.9896
	kFoldLoss 0.1898	0.1194	0.2075	0.0308	0.2071	0.0091
	precision 0.9545	0.7254	NaN	0.9804	NaN	0.9981
	recall	0.0741	0.5732	0	0.9471	0	0.9812
	further reduction in the number of instances of the nominal class (⇠3min) still gives

Table 5 .

 5 10: Results for untuned SVM classifiers with added features, original features and spinors as attributes

		Untuned	Untuned	Untuned	Untuned	Untuned
		Gaussian kernel	Gaussian kernel	Gaussian kernel	Linear kernel	Gaussian kernel
		300 feat.	24 feat.	original feat.	spinors	spinors
	f1Score	NaN	0.1375	0.2712	0.6878	0.9555
	Bayesian optimization results in a better performance in tuning the classifier, as shown
	in

Table 5 .

 5 11 in the Tuned Gaussian Kernel spinors row.

	Table 5.11: Results for tuned SVM classifiers with added features, original features
	and spinors as attributes
		Heuristic	Bayesian
		tuning	tuning
	Tuned Gaussian kernel 300 feat.	0.98	0.92
	Tuned Gaussian kernel 24 feat.	0.64	0.35
	Tuned Gaussian kernel original feat.	0.2756	NaN
	Tuned Gaussian kernel spinors	0.97	0.99

TABLE I COMPARISON

 I OF POPULAR OPEN-SOURCE AND COMMERCIAL AUTOPILOTS.Latest micro processors used in the Paparazzi hardware has an additional feature that can be use for security augmentation. The cryptographic processor can be used to both encipher and decipher data using the DES, Triple-DES or AES (128, 192, or 256) algorithms. It is a fully compliant implementation of the following standards:

	Open-Source	Vehicle type	Hardware	Multi UAV	Flight Plan	Path Definition	Geofencing	Collision Avoidance	Latest stable release
	Paparazzi	Fully configurable	varied	yes	scriptable	Formula Based	3-D	UAV TCAS	21-06-16
	PixHawk	Fully configurable	specific	yes	scriptable	Circles Lines Patterns	3-D	none	06-08-16
	Ardupilot	Copter Plane Rover	varied	alpha	scriptable	Circles Lines Patterns	2-D	none	22-06-16
	OpenPilot	multicopter	specific	none	NA	NA	none	none	15-05-15
	AeroQuad	multicopter	varied	none	NA	NA	none	none	31-01-13
	Commercial
	Picollo	Copter Plane	specific	none	dynamic	Way Point	NC	NC	NC
	MicroPilot	Copter Plane Rover Blimp	specific	yes	dynamic	Way Point	NC	NC	NC
	category, Paparazzi offers a unique set of features to deal with
	the issues at hand.
	D. Security
	• The data encryption standard (DES) and Triple-DES (TDES) as defined by Federal Information Processing
	Standards Publication (FIPS PUB 46-3, 1999 October
	25). It follows the American National Standards Institute
	(ANSI) X9.52 standard.
	• The advanced encryption standard (AES) as defined by Federal Information Processing Standards Publication
	(FIPS PUB 197, 2001 November 26)

TABLE II TYPICAL

 II VALUES FOR MAIN VARIABLES OF THE Paparazzi TCAS

		MODULE.
	TAU TA	TAU RA	DMOD	ALIM
	10s	6s	15m	10m

Table 2 :

 2 Stability derivatives for MAKO extracted from AVL program at 14m/s equilibrium cruise speed

	Parameter Value	Definition
	C C C C C	La Lp Lr L M0	0.1956 ⇥ 10 2 4.095 ⇥ 10 1 6.203 ⇥ 10 2 3.319 ⇥ 10 2 0	roll derivative roll derivative roll derivative roll derivative pitch derivative
	C C	Me Mq	0.076 ⇥ 10 1 1.6834	pitch derivative pitch derivative
	C C C C C	M↵ Na Np Nr N	32.34 ⇥ 10 2 0.0126 ⇥ 10 2 4.139 ⇥ 10 2 0.1002 ⇥ 10 1 2.28 ⇥ 10 2	pitch derivative yaw derivative yaw derivative yaw derivative yaw derivative

Table 3 :

 3 Aerodynamic force derivatives for MAKO extracted from AVL program at 14m/s equilibrium cruise speed

	Parameter Value	Definition
	C C	Z0 Z↵	8.53 ⇥ 10 2 3.9444	lift derivative lift derivative
	C	Zq	4.8198	lift derivative
	C C C C C C C	Ze X0 X k Y Yp Yr Ya	1.6558 ⇥ 10 2 2.313 ⇥ 10 2 1.897 ⇥ 10 1 2.708 ⇥ 10 1 1.695 ⇥ 10 2 5.003 ⇥ 10 2 0.0254 ⇥ 10 2	lift derivative drag derivative drag derivative side force derivative side force derivative side force derivative side force derivative

Table 4 :

 4 Thrust force coefficients for propeller APC SF 9 ⇥ 6 from wind tunnel experiments[17]

	Parameter Value	Definition
	C C C D F T 1 F T 2 F Trpm	1.342 ⇥ 10 1 1.975 ⇥ 10 1 7.048 ⇥ 10 6 0.228 m	thrust derivative thrust derivative thrust derivative propeller diameter

Table 5 :

 5 Specifications of the sensor suit InvenSense MPU-9250 Nine-axis (Gyro + Accelerometer + Compass) MEMS MotionTracking Device[18]

	Measurement
	z	accx		0.142	0.0319
	z	accy		0.3	0.0985
	z	accz		0.19	0.049
	z	gyro		1.55	0.0825
	z	gyro	x	1.13	0.1673
			y
	z	gyro		1.7	0.2214
			z
	APPENDIX B: FORCE, MOMENT CALCULATIONS
	Roll torque
			L	B = q S b C

L

(11)

C L = C La a + C Lp p + C Lr r + C L

http://wiki.paparazziuav.org/wiki/MeteoStick_v1.10

https://wiki.paparazziuav.org/wiki/Apogee/v1.00

many application details are discussed to assist the user to apply these methods to their own problems. Finally, SVM is introduced, plus the three phases encountered during its implementation -training, tuning and evaluation -are explained.

X X X X X X X X X X X X X X X X X XX X X X X X X X X O O O O

X X X X X X X X O X x 1 x 2 X X X X X X X X X X X XX X X X X O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O x 1 x 2 X X X X X X X X XUse linear regression(for regression problem) Use logistic regression (for classification problem)Is the number of original features large?O X X X X X X X X X X X X X X X X X X X X X O O O O O O O O O O O O O O O O O O O O X X X X X X X X X x 1 x 2 Do feature mapping Use Neural Networks YES NO X X X X X X X X X X X X X X X X X X X X O X X X X X X X X X X X X X X X X X X X X X O O O O O O O O O O O O O O O O O O O O O O O O X X X X X X X X X x 1 x 2 X X X X X X X X X X X X X X X X X X X X

https://github.com/benelgiz/curedRone

https://github.com/benelgiz/cureDDrone/tree/master

http://wiki.paparazziuav.org/wiki/MeteoStick v1.10

Acknowledgments

ACKNOWLEDGMENT This work was supported by the ENGIE Ineo -Groupe ADP -SAFRAN RPAS Chair. ACKNOWLEDGMENT This work was supported by the ENGIE Ineo -Sagem RPAS Chair. The authors would like to thank Gautier Hattenberger and Hector Garcia de Marina for sharing their expertise in Paparazzi.

ACKNOWLEDGEMENTS

This work was supported by the ENGIE Ineo -Groupe ADP -SAFRAN RPAS Chair. Special thanks to Gautier Hat-

5.6:

The result given in Table 5.9 shows an improvement in classification with an f1Score reaching up to 0.9915.

Untuned classification superiority

The first promising result by using spinors for classification is its advantage in untuned classifiers. This can be seen by checking the f1Score of the SVM classifier without tuning (see Table 5.10). As mentioned before, the untuned classifier for added features gives poor results, although it increases the classification accuracy when tuned

properly. An untuned SVM classifier with spinors as attributes results in an increased classification performance, with an f1Score of 0.6878. Using a Gaussian Kernel which is mathematically represented as in Eq. 5.7, the f1Score even increases up to 0.9555.

Tuned classification Bayesian optimization efficiency Table 5.11 shows the results, except for the simulations using spinors. The heuristic optimization gives a better performance for tuning the classifier, while the Bayesian optimization is likely to converge to a local minima. However, when spinors used, we start with an easier problem, and use data generated from models. There is no controller involved in the model in this preliminary application of SVM to detection, in order to discard the controller's effect on the diagnosis.

The second part investigates fault detection with real flight data. SVM, being a supervised learning algorithm, requires labeled data for both nominal and faulty flight conditions. Thus, faulty flights were realized with a security pilot ready for recovery in the event of loss of control of the aircraft. For the faulty flight data gathering, some modifications to the Paparazzi autopilot was necessary in two main parts: first, injecting the faults real-time from GCS; and second, and editing the onboard controller so that the faults injected reconfigures the servos as manipulated from the GCS.

With the flight data, two main classes of faults -control surface stuck and loss of effectiveness -have been investigated separately. A variety of techniques have been implemented to improve the performance of the classification, such as feature engineering and tuning the classifiers.

Future Work

For each failure type -jammed elevon or ineffective elevon -this thesis applies a two class classification problem: faulty data and nominal data. Future work should consider multi-class classification since it will lead to a more realistic application of fault diagnosis for drones; but the problem could be very complicated due to the vast number of possible faults. For such a problem, methods such as deep learning could be selected instead of SVM, since deep learning offers appealing performance on classification problems with a large number of classes. Another possible workaround could be to label the faults as severe, moderate and mild. Then, rather than determining the exact nature of the fault, at least an awareness of the severity of the fault could be gained. Fault Detection and Diagnosis should also be complemented by recovery.

The abilities of a drone after a fault should be assessed and a control action should be taken to mitigate the faulty situation. If recovery is not a viable option, a ditching maneuver could be undertaken to reduce the harm on the ground. Knowledge of the fault's severity could be used to choose an adequate mitigation measure.

Appendix A

Codes for FD from simulated data 1. NED (North East Down) navigation frame is inertial where Newton's law apply. A.