The front panel consists of six NKK UB2 illuminated push buttons, four LEDs, and an SSD1306 OLED dot matrix display (Figure D.1). Each of the push button includes one red and one green LED backlight.
NKK UB2 push buttons were selected because they feature strong tactile feedback and bright light indication. Each of the button signals is RC debounced and connects to a microcontroller GPIO. Dedicated GPIO for buttons instead of array scanning enables the button press to be handled in an interrupt.
Texas Instruments TLC5926 16-Bit Constant-Current LED Sink Driver was used to drive 16 push button lights and indicator LEDs. Constant-current LED driver ensures uniform LED brightness. It is equivalent to a serial in parallel out shift register with a power stage, and it communicates with the microcontroller through SPI.
SSD1306 OLED dot matrix display was selected because of its small form factor, high brightness, and high resolution. It is visible in direct sunlight. The 128 × 96 resolution allows a large amount of information to be shown at the same time. It communicates with the microcontroller through SPI.
A Texas Instruments TPA6211A1 3.1-W Mono, Fully Differential, Class-AB Audio Am- plifier is built into the Safety Officer to provide audible feedback. It was designed to drive a surface transducer mounted to the front panel. However, tests show that the 3.1 W audio output is not loud enough to be heard over the engine noise, and the surface transducer is removed from the design to save space. The audio output can be routed through the intercom instead.
D.10
Microcontroller and Connectivity
Teensy 3.2 development board with Freescale K20P64M72SF1 was selected because it is Arduino compatible, has integrated USB and CAN bus controller, and has a small footprint.
USB The Safety Officer communicates with the flight management computer (FMC) via
USB HID protocol. It sends a packet to the FMC every 10 ms containing the status and battery voltages. It expects to receive a packet from FMC containing autopilot status every 10 ms. If the timing is not satisfied, the Safety Officer assumes the FMC is malfunctioning or disconnected and triggers autopilot disconnect.
USB HID protocol is chosen over USB Serial because USB HID uses INT (interrupt) transfer type instead of BULK. USB is never real-time. There is no guarantee on latency in either INT or BULK transfer type. However, with INT, the operating system is asked to poll the device at a certain interval. This non-realtime is acceptable because the operating system (Ubuntu Linux) that runs the FMC is not real-time after all. USB HID provides excellent performance in our test. USB HID data are packetized by the protocol instead of in
the application in USB Serial. The error detection and correction is handled at the hardware level by the USB controller.
CAN bus The CAN bus is designed for integrating remote current and temperature sensor
to monitor the aircraft status. The sensors and microcontrollers are as far as 2 m away from
the Safety Officer. SPI and I2C are not reliable at this distance. The real-time nature of
CAN bus ensures critical information such as over-current and over-temperature alarm are responded immediately. Texas Instruments TCAN1051HGV CAN transceiver is used.
D.11
PCB Layout and Mechanical Design
The physical unit must fit in a 1.187" × 7.0" rectangular hole in the instrument panel. The goal of the layout and mechanical design was to minimize the physical size of the unit and to maximize the ease of installation.
Two-board construction was needed because the vertical space (front panel board) barely fits all the switches and the OLED display. A horizontal board (main board) was added for the non-user-interface components. Figure D.15 shows the physical construction. Both the front panel and the main board are two layers. The main board has 2 oz copper for increased current capacity. The front panel board has regular 1 oz copper. They are connected with pin headers and sockets.
Figure D.15: Physical construction of the Safety Officer
The rear connectors are Würth Elektronik WR-TBL Series 3211 pluggable screw terminals (Figure D.16). They simplify the wiring process, and they can be easily unplugged when
needed.
Figure D.17 and D.18 shows the layout of the two PCB. Good thermal management, decoupling, and grounding practices were obeyed.
Figure D.16: Pluggable screw terminals on the Safety Officer The PCBs were hand pick-and-placed and reflowed in a toaster oven.
The CAD model (Figure D.19) of the PCB was imported from Altium Designer into Autodesk Fusion 360 to design the enclosure and the front panel. A 3D printed plastic enclosure and a CNC milled aluminum front panel was designed and manufactured. 3D printed plastic enclosure allows complex geometry and provides maximum support for the circuit board and components. Strain relief was added to support the USB cable. The front panel was sandblasted for a non-glaring finish. Figure D.20 shows the finished product.
D.12
Embedded Software Design
The embedded software has a timer ISR running every 10 ms for the most critical tasks, including the FSMs detailed in Section D.4, the closed-loop motor control described in Section D.6, USB communication, and fault condition detection. All push buttons are handled in higher-priority interrupts. CAN communication is handled in interrupt. The main loop communicates with the display and lights.
D.13
Test Results
The Safety Officer consistently disconnects all actuators listed in Table D.1 within 500 ms under full load. The redundant power, user interface, and communication functioned as designed.
Figure D.17: La yout of the main boa rd Figure D.18: La yout of the fron t panel boa rd 16
Figure D.19: CAD model of the Safety Officer
Figure D.20: Assembled Safety Officer