Model-based Real-time Testing of Drone Autopilots

Key to the operation of robot drones is the autopilot software that realizes the low-level control. The correctness of autopilot implementations is currently mainly verified based on simulations. These may overlook the timing aspects of control loop executions, which are however fundamental to dependable operation. We report on our experience in applying model-based real-time testing to Ardupilot, a widely adopted autopilot. We describe our approach at deriving a model of Ardupilot's core functionality and at reducing the model to enable practical testing. Our work reveals that Ardupilot may fail in meeting the time constraints associated to critical functionality, such as enabling fail-safe operation. Through controlled experiments, we demonstrate the real-world occurrence of such erroneous executions.