1. Fly Spy – Group 12 Reliability and Safety Analysis Heather Barrett

2. Definition of Criticality Levels (In-flight operation) High : Plane crashes (goes out in a blaze of glory) or cannot be returned to manual control (flies off into the “Wild Blue Yonder”) Medium : Loss of autonomous control functionality; Must return to manual control Low : Some loss of non-critical functionality (ex. Cannot take pictures)

3. Components Chosen for Analysis Few components are complex or run hot Microcontroller (PIC24FJ256GA110): Most complex component Mux (P13V512): Operation is essential; controls switching between manual and autonomous modes Buck Converter (LTC1174) : Operation is essential; everything (including micro and mux) is powered on the +3.3 V rail

4. FMECA – Microcontroller Failure # Failure ModePossible CausesFailure EffectsMethod of Detection CriticalityRemarks A1No outputSoftware bug or chip failure Total loss of control ObservationHigh A2Some pins are “stuck” at 0 or 1 Exceeded voltage or current ratings (fried pin), software bug Runs gamut from failure to communicate with non- essential peripherals to total loss of control ObservationAll Levels

5. Control Mode Switching System

7. FMECA – Control Mode Switching System Failure # Failure ModePossible CausesFailure EffectsMethod of Detection CriticalityRemarks B1No outputMux failure, no input from micro Total loss of control ObservationHigh B2“Stuck” in autonomous mode CTRL_SW stuck high due to comparator chip or filter failure Loss of manual control ObservationMedium or high B3“Stuck” in manual mode CTRL_SW stuck low due to filter failure Loss of autonomous capability ObservationMedium

8. Power Supply

9. FMECA – Power Supply Failure # Failure ModePossible CausesFailure EffectsMethod of Detection CriticalityRemarks C1No output (0 V) Failure of LTC1174 (open) Total loss of control ObservationHigh C2Unacceptable ripple Failure of bulk capacitor Erratic behavior; component burnout ObservationMedium or High C3Output < 3.3VLow batteryErratic behavior followed by total loss of control ObservationHigh C4Output > 3.3VFailure of LTC1174 (short to battery voltage) IC DamageObservationHigh

10. Additional Remarks Due to software complexity, most of these hardware failures appear trivial concerns In retrospect, should have powered mux on +5 V rail like the servos and motor; if +3.3V source fails, mux fails (no signal to servos  CRASH)