Introduction

The DRx is a high-reliability, redundant avionics system composed of three complete Veronte Autopilots 1x interconnected via CAN-FD communication bus. Its architecture distributes specific roles across three distinct hardware units:

• Primary Unit: The default command unit that acts as the lead flight controller during standard operations.
• Recovery Unit: The backup (failover) unit that assumes command instantly if the Primary unit encounters a failure or exceeds predefined error thresholds.
• Monitor Unit: The system supervisor. It does not actively pilot the vehicle; instead, it executes the arbitration algorithm to continuously evaluate system health and assign command authority to the most suitable unit.

The core purpose of the DRx system is to ensure flight continuity and aircraft safety during critical hardware or software failures by leveraging the following capabilities:

• Achieve Fault Tolerance: It fully absorbs a single hardware failure, protecting the aircraft against sudden power loss, processor freezes, or critical sensor malfunctions.
• Ensure Operational Transparency: the system is capable of synchronizing flight phases, pilot stick commands, and telemetry data internally via CAN-FD.
• Customize Safety Logic: It allows users to precisely define the exact parameters and thresholds that constitute a failure, having a totally in-house custom arbitration logic program.
• Mitigate Common-Mode Failures (Heterogeneous Redundancy): It enables the Primary and Recovery units to utilize entirely different sensor technologies (e.g., distinct radar altimeters), ensuring that a specific sensor defect cannot disable both flight controllers simultaneously.
• Mitigate Zonal Failures (Distributed Redundancy): The distributed nature of the architecture ensures that localized physical events, such as fire or structural damage in one section of the aircraft, do not compromise the entire autopilot system or crash the communication infrastructure.