  In order to handle undesirable failures of a multicopter which occur in
either the pre-flight process or the in-flight process, a failsafe mechanism
design method based on supervisory control theory is proposed for the
semi-autonomous control mode. Failsafe mechanism is a control logic that guides
what subsequent actions the multicopter should take, by taking account of
real-time information from guidance, attitude control, diagnosis, and other
low-level subsystems. In order to design a failsafe mechanism for multicopters,
safety issues of multicopters are introduced. Then, user requirements including
functional requirements and safety requirements are textually described, where
function requirements determine a general multicopter plant, and safety
requirements cover the failsafe measures dealing with the presented safety
issues. In order to model the user requirements by discrete-event systems,
several multicopter modes and events are defined. On this basis, the
multicopter plant and control specifications are modeled by automata. Then, a
supervisor is synthesized by monolithic supervisory control theory. In
addition, we present three examples to demonstrate the potential blocking
phenomenon due to inappropriate design of control specifications. Also, we
discuss the meaning of correctness and the properties of the obtained
supervisor. This makes the failsafe mechanism convincingly correct and
effective. Finally, based on the obtained supervisory controller generated by
TCT software, an implementation method suitable for multicopters is presented,
in which the supervisory controller is transformed into decision-making codes.
