Safety 4.0: Model-Based Approach Toward Perpetual Flight with an Autonomous, Solar-Powered Aircraft

Skydweller is an American-Spanish company in pursuit of perpetual flight. In 2019, it acquired Solar Impulse 2 as a flying testbed, a 72-meter wingspan solar-powered aircraft with reversible flight controls. Ever since, the aircraft has been continuously modified and flight tested in Albacete, Spain, to achieve a large, uncrewed, fully autonomous platform capable of perpetual endurance operations. This aircraft represents a challenge from the safety point of view due to different factors, such as design complexity, operational aspects, and cybersecurity risks, among others. This aircraft includes a wide variety of complex systems, multiple ground stations with different levels of involvement and different kinds of payloads, as well as cutting-edge technologies and the integration of components that are not purely aeronautical. The operational aspects also contribute to a high demand on safety analyses due to the time the aircraft will remain in the air and the distance from the bases of operation. Moreover, the nature of the missions that this aircraft can do (border surveillance, telecommunications, and other government, security, or firefighting missions, among others) raises certain cybersecurity risks that must be addressed to assure the overall safety of the aircraft. Skydweller uses a model-based approach to address complex issues affecting near perpetual endurance while providing a flexible safety framework for rapid development. This approach is founded on standard aviation industry practices and optimized for execution in a multinational start-up environment where analysis products must be applicable to multiple airworthiness authorities. It constitutes an implementation of Model-Based Safety Assessment for a safety-critical application in a fast development environment, where the safety case is completely integrated within the model assuring consistency and avoiding discrepancies through a single source of truth. To minimize change impact and optimize testing of the autonomous systems, Skydweller uses the concept of “Safety Boundary”, defined as the set of equipment that constitutes a minimal justified airworthy configuration, anchored for this phase, by the presence of a safety pilot on board the airframe with full control of the aircraft if necessary. The Safety Boundary concept has allowed a safety critical assessment of the human-rated full authority digital fly-by-wire system while allowing a faster, lower cost assessment of non-critical systems under development. This model-based approach allows Skydweller to produce all the safety artifacts, required by ARP 4754A and ARP 4761 (FHA, PASA/PSSA, ASA/SSA, CCA,…), that are used as Acceptable Means of Compliance for multiple airworthiness authorities, utilizing a team of two safety engineers. The effectiveness of the approach has been demonstrated before the airworthiness authorities (AESA), obtaining a permit to fly for a modified human-rated fly-by-wire system that allowed Skydweller to perform fully automated flights with the safety pilot onboard.