High integrity systems: ensuring mission success in One-Way UAS

In aerospace engineering, the concept of “High Integrity” is often associated with passenger safety and strict civil airworthiness certifications. However, in the domain of one-way and expendable Unmanned Aerial Systems (UAS), high integrity takes on a different, yet equally critical, meaning. For an expendable drone, whether it is an offensive loitering munition, a defensive C-UAS interceptor, or a deception decoy, there is no second chance. The aircraft has exactly one opportunity to perform its mission.

If a critical component, such as the autopilot or a flight control actuator, fails mid-flight, the mission fails catastrophically. The financial cost of losing the integrated payload, the tactical cost of missing a time-critical window, and the operational risk of the asset falling into enemy hands make system failure unacceptable. Therefore, designing for high integrity in expendable systems is not about satisfying regulatory paperwork; it is about guaranteeing absolute, uncompromising reliability in the harshest environments.

In this lesson, we will explore the engineering philosophies that define high-integrity UAS, focusing on robust autopilot architectures, Failure Detection, Isolation, and Recovery (FDIR) algorithms, and adaptive flight control under degraded system states.

The paradox of expendable reliability: why “single-use” demands high integrity

It is a common misconception that because a drone is designed to be destroyed at the end of its flight, its components can be cheap and unreliable. From a systems engineering perspective, this is a dangerous fallacy.

Consider the economics of a tactical loitering munition mission. While the airframe might be constructed of inexpensive composites and the propulsion system optimized for minimal cost, the payload bay houses sophisticated sensors, data links, and explosive warheads. The total financial and strategic investment in a single launched asset is substantial.

If an autopilot sensor fails, or if a software runtime error freezes the processor, the entire asset is lost instantly. The launch window is closed, enemy positions remain unneutralized, and highly sensitive technology may crash intact behind hostile lines.

Therefore, high integrity in one-way drones focuses on maximizing mission probability. Every critical system must be engineered with the assumption that failures will occur during flight, and the autopilot must possess the intelligence and robustness to bypass, isolate, or adapt to those failures without human intervention.

Failure detection, isolation, and recovery in Flight Control

The core of a high-integrity autopilot is its FDIR (Failure Detection, Isolation, and Recovery) framework. FDIR is a systematic, deterministic software architecture designed to constantly monitor the “health” of the drone’s sensors, processors, and actuators, taking immediate corrective action when an anomaly is detected.

Sensor cross-verification and redundancy management

An autopilot relies on a suite of sensors to estimate the drone’s attitude, altitude, and velocity. This suite typically includes Inertial Measurement Units (IMUs consisting of accelerometers and gyroscopes), magnetometers, barometric pressure sensors, and GNSS receivers.

In a high-integrity system, the autopilot does not rely on a single sensor input. Instead, it employs Sensor Cross-Verification schemes:

• Redundancy system: the autopilot houses multiple physical IMUs or GPS receivers.
• The consensus algorithm: the flight computer continuously compares the telemetry from all active sensors. If one sensor suddenly reads a spike in acceleration or a sudden loss of satellite lock that does not align with the other sensors, the cross-verification software identifies that specific sensor as “failed” due to lack of agreement with the redundant units.
• Isolation and transition: the failed sensor is instantly isolated from the navigation loops. The autopilot seamlessly transitions to the remaining healthy sensors without causing a single microsecond of flight instability.

Analytical redundancy

Adding physical sensors increases the size, weight, power, and cost (SWaP-C) of the drone, which is highly restricted in expendable platforms. To solve this, high-integrity flight software uses Analytical Redundancy (often referred to as Virtual Sensors).

Using advanced mathematical models of the aircraft’s physical dynamics, the autopilot can calculate what a sensor’s reading should be based on control inputs. For example, if the physical airspeed sensor (pitot tube) becomes blocked by ice or debris, the autopilot can estimate airspeed analytically by calculating the thrust of the motor, the angle of attack, and GPS ground speed. The software detects the discrepancy between the blocked physical sensor and the analytical model, flags a failure, and switches to the virtual airspeed estimation to save the mission.

Adaptive control and handling degraded flight states

High integrity must extend beyond sensor monitoring; the system must also survive physical and mechanical failures during flight, such as stuck control surfaces or a lost motor.

Actuator reconfiguration

In a standard fixed-wing drone, if an aileron servo fails and gets stuck in a fully deflected position, the aircraft will enter an uncontrollable roll and crash. In a high-integrity system, the autopilot’s control allocation matrix is dynamic rather than fixed.

If the FDIR system detects that a control surface is unresponsive or stuck (by comparing commanded inputs to actual changes in roll/pitch rates), it can reconfigure the remaining control surfaces in real-time:

• Differential thrust: the autopilot can use dual-propeller setups to yaw or roll the aircraft by spinning one motor faster than the other, compensating for the lost control surface.
• Control surface sharing: it can combine the remaining healthy elevator, rudder, or flap movements to generate the necessary aerodynamic forces to stabilize the airframe and guide it safely to the target coordinate, even in a severely degraded aerodynamic state.

Multirotor motor-out recovery

For C-UAS interceptor drones utilizing multirotor configurations (such as hexacopters or octocopters), a motor failure is a highly critical event. A high-integrity multirotor autopilot has pre-programmed algorithms to handle a sudden loss of thrust on a single arm.

Instead of tumbling out of the sky, the flight controller instantly redistributes power to the remaining healthy motors. It may intentionally command the drone to spin rapidly along its yaw axis (a degraded flight state known as “flat spin” control) to maintain stable lift and horizontal translation, allowing the interceptor to complete its collision run or steer away from friendly assets before neutralizing itself.

Safe termination: the ultimate ethical and operational fail-safe

The final component of high-integrity engineering is knowing when and how to terminate the mission. If the FDIR system encounters a cascade of failures so severe that stable flight is mathematically impossible, or if the drone loses its navigational reference entirely, the autopilot must execute a Safe Termination Protocol.

Unlike commercial drones that attempt to return to the landing pad, an expendable drone in a contested environment must never land intact. Falling into enemy hands allows for reverse-engineering and intelligence gathering.

A high-integrity autopilot includes dedicated, independent termination circuitry. When a critical, unrecoverable state is triggered, the autopilot executes one of several pre-defined termination states:

1. Dynamic geofencing abort: if the drone drifts outside a pre-set geographic combat zone, it immediately pitches into an unrecoverable vertical dive into an empty area.
2. Neutralization glide: the drone steers toward an unoccupied terrain feature and command-detonates its warhead or executes an intentional high-speed impact to destroy its internal electronics.
3. Data zeroization: before impact, the autopilot initiates a hardware-level wipe of all internal flash memory, erasing encrypted communication keys, proprietary flight algorithms, and mission logs to ensure zero intelligence is leaked.

Through these combined layers of software FDIR, adaptive control, and safe termination, high-integrity engineering ensures that every launched one-way drone represents a reliable tactical tool, capable of overcoming severe in-flight adversity to deliver absolute mission success.